Renewed server certificate failing with "missing CA key".

[Ed V.]

Backstory:

I use CACert as my certificate authority and have for years.

Up until the current certificate renewal cycle (e.g. annually), this has been pretty easy to manage.

• drop the CA Root /Class 3 certs in `/usr/local/etc/ssl/certs`
• run `certctl rehash`
• install or update the CA certs in "System -> Trust -> Authorities"
• install or update the server cert in "System -> Trust -> Certificates"
• restart the server

With a fresh-off-the-electronic-press renewed certificate for 2026, I'm now getting a "missing CA key" message on trying to either update the in-place certificate and/or import the certificate /key pair as a new certificate.

Via command line on the box, the renewed cert validates - it's just in the WebUI that it hurks.

Code Select Expand

# openssl verify -show_chain .\charon-2026.pem
charon-2026.pem: OK
Chain:
depth=0: CN=charon.lan.null-route.us (untrusted)
depth=1: O=CAcert Inc., OU=http://www.CAcert.org, CN=CAcert Class 3 Root
depth=2: O=Root CA, OU=http://www.cacert.org, CN=CA Cert Signing Authority, emailAddress=support@cacert.org
I'm sure I missed something simple, but what???

[newsense]

Class 3 is the intermediate, issuing CA

You're missing the root CA seen at depth:2

[Ed V.]

Do you mean:

Code Select Expand

# openssl x509 -noout -subject -in /usr/local/share/certs/rootX0F.crt
subject=O=Root CA, OU=http://www.cacert.org, CN=CA Cert Signing Authority, emailAddress=support@cacert.organd

Code Select Expand

# openssl x509 -noout -subject -in /usr/local/share/certs/CACert_Class3Root_x14E228.crt
subject=O=CAcert Inc., OU=http://www.CAcert.org, CN=CAcert Class 3 Root?

It looks like the CA Root is present and OpenSSL knows about it (existing soon-to-expire server cert):

Code Select Expand

# hostname
charon.lan.null-route.us
# openssl s_client -connect charon.lan.null-route.us:443 | grep -i -e verify
Connecting to 2001:579:4c:2700:6662:66ff:fe25:7341
depth=2 O=Root CA, OU=http://www.cacert.org, CN=CA Cert Signing Authority, emailAddress=support@cacert.org
verify return:1
depth=1 O=CAcert Inc., OU=http://www.CAcert.org, CN=CAcert Class 3 Root
verify return:1
depth=0 CN=charon.lan.null-route.us
verify return:1
Verify return code: 0 (ok)
Cross-checking to make sure that the current certs from CACert are loaded:

Code Select Expand

# certctl -v rehash
[snipped for readability]
found /usr/local/share/certs/CACert_Class3Root_x14E228.crt
590d426f: CAcert Class 3 Root
found /usr/local/share/certs/ca-root-opnsense-1.crt
590d426f: duplicate
found /usr/local/share/certs/rootX0F.crt
99d0fa06: CA Cert Signing Authority
found /usr/local/share/certs/ca-root-opnsense-0.crt
99d0fa06: duplicate

and

Code Select Expand

# certctl -v list
localbase:      /usr/local
destdir:
distbase:
unprivileged:   false
verbose:        true
[snipped]
found /etc/ssl/certs/590d426f.0
590d426f: CAcert Class 3 Root
found /etc/ssl/certs/99d0fa06.0
99d0fa06: CA Cert Signing Authority
[snipped]
590d426f.0      CAcert Class 3 Root
99d0fa06.0      CA Cert Signing Authority