I use ACME to get certificates for my HAProxy instance. While testing with SSLLabs I noticed the intermediate is missing from the .pem file. Please add the intermediate to the .pem so all clients can connect.
I haven't looked yet how this is done but I might take a stab at a PR.
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Resolved | BUG | c-po | T9135 pki: dependent conf_mode scripts run against a stale config cache within the same commit, causing ACME-imported CA chains to go missing | ||
| Resolved | BUG | c-po | T9102 Intermediate certificate missing from .pem in HAProxy |
The real cause is in the PKI/ACME pipeline. When an ACME cert is issued, pki.py imports the intermediate as pki ca AUTOCHAIN_<cert> and triggers dependent services (HAProxy included) to regenerate within the same commit. But that regeneration reuses an in-memory config object whose cache was already populated before the import happened, so it never sees the new CA. HAProxy's chain logic then has nothing to find.
A certbot renewal also skipped the import step entirely, so an affected cert could never self-correct on renewal.
This is a config-caching bug, not a certificate-generation bug, and can affect any service consuming a fresh ACME cert.
Workaround: run a second, unrelated commit after issuing or renewing the cert.
Fixed via T9135 root-cause