# Select the pfSense certificate purpose before troubleshooting an unavailable entry

> A certificate can be present in the manager yet unsuitable for a service's required usage.

- Canonical URL: https://update.dsesecurity.com/updates/select-the-pfsense-certificate-purpose-before-troubleshooting-an-unavailable-entry/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-20T18:16:12+00:00
- Modified: 2026-10-20T18:34:34+00:00
- Last reviewed by DSE: 2026-10-20
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

A certificate can be present in the manager yet unsuitable for a service's required usage.

## Potentially affected

This concerns pfSense certificate creation and selection.

## DSE recommendation

DSE recommends documenting the intended role before generating or importing a certificate.

## Article

A certificate can be present in the manager yet unsuitable for a service’s required usage.

## Source facts

Netgate states that the selected certificate type controls key-usage properties and limits where the certificate can be used. User certificates carry client-authentication usage, while server certificates carry server-authentication usage. Using the wrong purpose can cause an error or prevent the certificate from appearing in a service’s selection list. A CSR is sent to the issuer without its private key.

Source: [Netgate — Certificate Management](https://docs.netgate.com/pfsense/en/latest/certificates/certificate.html).

## Applicability

This concerns pfSense certificate creation and selection.

## DSE recommendation

DSE recommends documenting the intended role before generating or importing a certificate. If an entry is missing from a service’s selector, inspect its usage properties before weakening validation or importing duplicate keys. Keep the private key under controlled custody and transmit only the CSR when requesting external signing. Use descriptions that distinguish client and server roles so a later renewal does not perpetuate the wrong purpose. Include the required certificate purpose in the service handoff checklist. Ask the operator to inspect that property before replacing keys or changing trust settings, and preserve the intended client/server use beside the certificate identifier so later renewals retain the design decision.

## Verification

Inspect the certificate’s usage extensions and confirm that the intended service can select it. Complete an authorized test handshake from a representative peer with normal validation enabled. Record the role and issuer without copying private-key material into the acceptance evidence or a support ticket.

## Official reference

[Netgate — Certificate Management](https://docs.netgate.com/pfsense/en/latest/certificates/certificate.html). Reviewed October 20, 2026.

## Primary reference

- Name: Netgate — Certificate Management
- Authority: docs.netgate.com
- URL: https://docs.netgate.com/pfsense/en/latest/certificates/certificate.html
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Select the pfSense certificate purpose before troubleshooting an unavailable entry,” DSE Security, https://update.dsesecurity.com/updates/select-the-pfsense-certificate-purpose-before-troubleshooting-an-unavailable-entry/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.