pfSense-issued certificates invalid

[dodexahedron]

I have a Microsoft PKI infrastructure, and am adding pfSense as an intermediate.
I successfully created and signed the intermediate CA cert and have it installed on pfSense.
However, certificates issued by pfSense are invalid, according to chrome and openssl:

Here are the root and pfSense CA certs, as shown in the CA tab:

az-dc-2 is the root CA, and that CA is trusted by my local machine (Ubuntu 19.04). Internal websites signed with certificates directly issued by this root validate just fine.
az3-pfsense-lab-1-CA is the cert for this pfSense box. It is a CA cert signed by az-dc-2, and also validates fine according to openssl.

So, to my eye, it looks like nothing is wrong with the configuration, but the certificates that pfSense issues are still invalid.
In chrome, the chain even looks normal, but the server cert is still untrusted.

What am I missing?