@Starko:
Sorry I never replied!
The error I got was selfmade. There has never been an issue with pfsense.
I worked through our backupped config.xml with Notepad++ and did an Replace all for the changed interface names (vr1 became em1 .. etc)
I was so lucky that out certs had the part "vr1" in it. So literally replaced parts of our certs, no wonder they were broken. After I replaced the interface names manually, the import worked fine on the new hardware.
Thanks for the follow up. Yeah be very careful doing "replace all", as cert contents commonly will match any short string you're replacing, which will of course break the cert. When I edit configs like that, I always make sure to confirm every instance of the string that's being replaced, as there are a variety of possibilities to break things like that.