Backstory:
I use CACert as my certificate authority and have for years.
Up until the current certificate renewal cycle (e.g. annually), this has been pretty easy to manage.
- drop the CA Root /Class 3 certs in `/usr/local/etc/ssl/certs`
- run `certctl rehash`
- install or update the CA certs in "System -> Trust -> Authorities"
- install or update the server cert in "System -> Trust -> Certificates"
- restart the server
With a fresh-off-the-electronic-press renewed certificate for 2026, I'm now getting a "missing CA key" message on trying to either update the in-place certificate and/or import the certificate /key pair as a new certificate.
Via command line on the box, the renewed cert validates - it's just in the WebUI that it hurks.
# openssl verify -show_chain .\charon-2026.pem
charon-2026.pem: OK
Chain:
depth=0: CN=charon.lan.null-route.us (untrusted)
depth=1: O=CAcert Inc., OU=http://www.CAcert.org, CN=CAcert Class 3 Root
depth=2: O=Root CA, OU=http://www.cacert.org, CN=CA Cert Signing Authority, emailAddress=support@cacert.orgI'm sure I missed something simple, but what???