diff --git a/security/acme-client/pkg-descr b/security/acme-client/pkg-descr
index 832ae46ab..a7dc6c18e 100644
--- a/security/acme-client/pkg-descr
+++ b/security/acme-client/pkg-descr
@@ -13,6 +13,9 @@ Plugin Changelog
 Added:
 * add button to (re-) import a certificate into the trust storage
 
+Fixed:
+* associate certificates with the correct CA when multiple CAs use the same name (#2550)
+
 3.1
 
 Changed:
diff --git a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCertificate.php b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCertificate.php
index cfe13498d..9aaf313be 100644
--- a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCertificate.php
+++ b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCertificate.php
@@ -159,7 +159,7 @@ class LeCertificate extends LeCommon
         foreach (Config::getInstance()->object()->ca as $cacrt) {
             $cacrt_subject = cert_get_subject($cacrt->crt, true);
             $cacrt_issuer = cert_get_issuer($cacrt->crt, true);
-            if (($ca_subject == $cacrt_subject) and ($ca_issuer == $cacrt_issuer)) {
+            if (($ca_subject === $cacrt_subject) and ($ca_issuer === $cacrt_issuer)) {
                 // Use old refid instead of generating a new one
                 $ca['refid'] = (string)$cacrt->refid;
                 $ca_found = true;
@@ -257,6 +257,12 @@ class LeCertificate extends LeCommon
         // Prepare certificate for import
         cert_import($cert, $cert_content, $key_content);
 
+        // Overwrite caref in order to use the correct CA (GH #2550).
+        // This is required because cert_import() uses lookup_ca_by_subject()
+        // to find a matching CA. If multiple CAs are using the same name, the
+        // first CA wins, but it may still be the wrong CA.
+        $cert['caref'] = (string)$ca['refid'];
+
         // Check if cert was found in config
         if ($cert_found == true) {
             // Update existing cert