pfSense » pfSense Plus

Allowing multiple CAs in a single entry was always a hackish workaround for things that didn't support chains. Importing them separately is the proper solution.

However, now 23.01 responds with "Unknown CA" if you try this.

What exactly gives this error message? The CA manager? Cert manager? OpenVPN? Something else?

At this point I'd say whatever doesn't support chains of separate entries should be fixed to support chains and we shouldn't support stuffing the entries together like this anymore. they could maybe be identified and separated on upgrade if need be.

Kris Phillips wrote in #note-2:

The message of "Unknown CA" is what pfSense is sending to the remote host. This was captured in a packet capture on the interface that the LDAPS authentication was exiting.

So it's only when pfSense is authenticating against an LDAP server with TLS?

LDAP was not mentioned at all in the original subject or description.

Given the way the LDAP client wants to read certificate data it has to be chained properly, which the code already handles. Splitting the entry up is the correct solution since that was an old workaround that was only needed before chains were properly supported.

Trying to detect multiple CA entries stuffed together and breaking them out just to stitch them back together would be a ton of work to support something nobody should be doing anymore.