Renewed server certificate failing with "missing CA key".

[Ed V.]

Backstory:

I use CACert as my certificate authority and have for years.

Up until the current certificate renewal cycle (e.g. annually), this has been pretty easy to manage.

• drop the CA Root /Class 3 certs in `/usr/local/etc/ssl/certs`
• run `certctl rehash`
• install or update the CA certs in "System -> Trust -> Authorities"
• install or update the server cert in "System -> Trust -> Certificates"
• restart the server

With a fresh-off-the-electronic-press renewed certificate for 2026, I'm now getting a "missing CA key" message on trying to either update the in-place certificate and/or import the certificate /key pair as a new certificate.

Via command line on the box, the renewed cert validates - it's just in the WebUI that it hurks.

Code Select Expand

# openssl verify -show_chain .\charon-2026.pem
charon-2026.pem: OK
Chain:
depth=0: CN=charon.lan.null-route.us (untrusted)
depth=1: O=CAcert Inc., OU=http://www.CAcert.org, CN=CAcert Class 3 Root
depth=2: O=Root CA, OU=http://www.cacert.org, CN=CA Cert Signing Authority, emailAddress=support@cacert.org
I'm sure I missed something simple, but what???