blargh. Shot waaaay too much time trying to diagnose an httpd(8) + acme-client(1) issue on a recent #OpenBSD install.

I pointed acme-client at the Let's Encrypt testing/dev endpoint, got the certs/chain/keys in the right place, reloaded httpd, and refreshed. Cert-chain looked like what I expected, rolling up to the (unrecognized) root and throwing Unknown CA warnings.

So I repointed my acme-client.conf file at the *production* Let's Encrypt endpoint, re-issued the acme-client command to re-fetch them, reloaded httpd, and refreshed the browser. but still got the same errors. The chain kept showing the old dev-signing certs, not the valid ones.

Apparently acme-client only (re)downloads certs if they're coming up on needing renewal. So acme-client was running, seeing that my bad-certs were sufficiently recent, and just not requesting/writing updated fullchain/key files.

Deleted the bogus testing certs, re-ran acme-client, reloaded httpd, and 🪄 everything worked fine. 😑

Hopefully this saves someone else the trouble.