Select the pfSense certificate purpose before troubleshooting an unavailable entry

A certificate can be present in the manager yet unsuitable for a service’s required usage.

Source facts

Netgate states that the selected certificate type controls key-usage properties and limits where the certificate can be used. User certificates carry client-authentication usage, while server certificates carry server-authentication usage. Using the wrong purpose can cause an error or prevent the certificate from appearing in a service’s selection list. A CSR is sent to the issuer without its private key.

Source: Netgate — Certificate Management.

Applicability

This concerns pfSense certificate creation and selection.

DSE recommendation

DSE recommends documenting the intended role before generating or importing a certificate. If an entry is missing from a service’s selector, inspect its usage properties before weakening validation or importing duplicate keys. Keep the private key under controlled custody and transmit only the CSR when requesting external signing. Use descriptions that distinguish client and server roles so a later renewal does not perpetuate the wrong purpose. Include the required certificate purpose in the service handoff checklist. Ask the operator to inspect that property before replacing keys or changing trust settings, and preserve the intended client/server use beside the certificate identifier so later renewals retain the design decision.

Verification

Inspect the certificate’s usage extensions and confirm that the intended service can select it. Complete an authorized test handshake from a representative peer with normal validation enabled. Record the role and issuer without copying private-key material into the acceptance evidence or a support ticket.

Official reference

Netgate — Certificate Management. Reviewed October 20, 2026.