Let's Encrypt (ISRG Root YR) validation failing in pkg-static on 26.07.b.20260731.1233

DarkFnh

Hi everyone,

I’ve hit an issue on 26.07.b.20260731.1233 where pkg-static is failing to validate Let's Encrypt certificates—specifically the new ISRG Root YR chain.

I'm seeing this trigger when the system tries to pull from the pfBlockerNG repository (hosted on GitHub Pages, which uses Let's Encrypt). Because pkg-static fails this TLS handshake, pfSense-upgrade is completely blocked from checking for standard system updates.

Environment
OS: pfSense Plus 26.07-BETA (amd64)
pkg: 2.7.5
OpenSSL: 3.5.7

The Error
When running a package update, the core repositories update fine, but the GitHub-hosted repo throws an authentication error explicitly calling out the Let's Encrypt root:

Certificate verification failed for /C=US/O=ISRG/CN=Root YR

pkg-static: https://pfblockerng.github.io/pkg/release/plus-26.07/meta.txz: Authentication error
Unable to update repository pfblockerng

The OS trusts Let's Encrypt, but pkg-static doesn't
The underlying OS has no issue with the Let's Encrypt chain. I ran the following tests to confirm the certificate bundle is valid:

OpenSSL validates the chain perfectly:
openssl s_client -connect pfblockerng.github.io:443 -servername pfblockerng.github.io
Result: Verify return code: 0 (ok))
Direct fetch succeeds.

Since openssl and fetch can traverse the Let's Encrypt chain without issue, it looks like pkg-static on 26.07-BETA has a bug handling this specific ISRG Root YR cross-sign/chain.

marcosm

See https://forum.netgate.com/topic/200959/pkg-warning-for-missing-le-e7-cert