From f44af645e98798b92640a60e4cfbfdc9e4a8f6a4 Mon Sep 17 00:00:00 2001
From: Frank Wall <fw@moov.de>
Date: Thu, 3 Dec 2020 15:47:42 +0100
Subject: [PATCH] security/acme-client: fix certificate chain when CA changes,
 closes #2126

---
 security/acme-client/pkg-descr                                  | 1 +
 .../mvc/app/library/OPNsense/AcmeClient/LeCertificate.php       | 2 ++
 2 files changed, 3 insertions(+)

diff --git a/security/acme-client/pkg-descr b/security/acme-client/pkg-descr
index a7e1a22ee..f96250468 100644
--- a/security/acme-client/pkg-descr
+++ b/security/acme-client/pkg-descr
@@ -15,6 +15,7 @@ Added:
 
 Fixed:
 * fix creation of nsupdate secrets file
+* fix certificate chain when existing cert was signed by a new CA (#2126)
 
 2.0
 
diff --git a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCertificate.php b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCertificate.php
index ac238c2be..d19bc71c3 100644
--- a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCertificate.php
+++ b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCertificate.php
@@ -262,6 +262,8 @@ class LeCertificate extends LeCommon
                     $cfgCert->crt = $cert['crt'];
                     $cfgCert->prv = $cert['prv'];
                     $cfgCert->descr = $cert['descr'];
+                    // Update CA ref, because it may be signed by a different CA.
+                    $cfgCert->caref = $cert['caref'];
                     break;
                 }
             }