pfSense

It works for me here with both a standard CA and with an intermediate CA chain on multiple firewalls and against multiple LDAP servers.

In the certificate manager on the CA tab, it should show the root CA and the intermediate, and it should show the root being the issuer of the intermediate. Then make sure that the intermediate CA of the chain is selected in the auth server settings entry for the LDAP server.

If you look in /var/run/certs/ you should see a file that matches the refid of the CA (and perhaps some others from different auth attempts), it should contain the entire chain (root+intermediate)

Also, between tests, restart the GUI and PHP-FPM to be sure PHP isn't doing something dumb with caching the auth test result. We've seen that before but it's tricky to reproduce, and seems to be a PHP/PHP-FPM quirk. Either use options 16 then 11 from the console menu, or manually run /etc/rc.php-fpm_restart ; /etc/rc.restart_webgui

I tried everything you suggested but the result is still exactly the same. I attached screenshots of the configuration and connectivity test.

Is there some way to get further debug logging for exact reason why it's failing? The System Logs entries seem too generic to be of any help.

Then that's not an intermediate CA. All you need is the root. Having that non-CA in the CA manager is probably the problem. Just import the root, select the root in the LDAP settings. If that doesn't work, then follow up on the forum. Nothing changed for that scenario and it should work the same now as before, and does on all my test systems.

An intermediate means an intermediate CA, meaning the root CA signs the intermediate CA, intermediate CA signs the server cert, but it needs the root+intermediate CA to validate the entire chain. You never have to import the server cert to the client (in this case, pfSense).

We have code on 2.4.2 to prevent importing a non-CA on the CA tab, which can prevent that sort of misconfiguration.