NGINX error after upgrade to 20.7.8

[muchacha_grande]

Global Error Log is full of "signal process started" messages. One per minute.
HTTP Error Log have many of this messages:

If I select the appropriate CA:
1 upstream SSL certificate verify error: (2:unable to get issuer certificate) while SSL handshaking to upstream, client: x.x.x.x, server: cloud.xxxx.com, request: "GET /login HTTP/2.0", upstream: "https://y.y.y.y:443/login", host: "cloud.xxxx.com"

And if I uncheck all CAs the error is:
1 upstream SSL certificate does not match "upstream0768447a263a475ab813a0e17926c340" while SSL handshaking to upstream, client: x.x.x.x, server: cloud.xxxx.com, request: "GET /login HTTP/2.0", upstream: "https://y.y.y.y:443/login", host: "cloud.xxxx.com"

[Fright]

so verification works.

(2:unable to get issuer certificate

nginx cannot build a chain to a trusted CA certificate from upstream cert
is the certificate of the certification authority in the trusted list?
how long is the chain from the root certificate to the upstream certificate?

[Fright]

upstream SSL certificate does not match "upstream0768447a263a475ab813a0e17926c340" while SSL

add upstream name from cert to **TLS: Servername override**
https://github.com/opnsense/docs/pull/305/files

[muchacha_grande]

add upstream name from cert to **TLS: Servername override**
https://github.com/opnsense/docs/pull/305/files

This worked. So now I have no CA checked and with the server override.
Still not working if I check a CA.

is the certificate of the certification authority in the trusted list?

It is. Is a Lets Encrypt certificate. I imported the CA and the certificate in OPNSense.

how long is the chain from the root certificate to the upstream certificate?

It's a Lets Encrypt certificate directly signed by the Lets Encrypt authority.

[Fright]

Lets Encrypt authority

LE CA is not root CA afaik
need to add DST Root CA X3 (or what is root CA for LE certs) to System: Trust: Authorities and select this CA in upstream

[muchacha_grande]

LE CA is not root CA afaik
need to add DST Root CA X3 (or what is root CA for LE certs) to System: Trust: Authorities and select this CA in upstream

You are right. I checked the certificate chain and it ends at DST Root CA X3. So I did what you pointed out and now it's working.
Thank you very much @Fright for your help.

Best regards.