Lets Encrypt - Radius Certificate "Request failed with status code 422

[abdlmalekluttee]

I intend to install an SSL certificate generated with "Let's Encrypt" to be used on the captive portal and admin interface and my radius
After carrying out the port-forworing of the port (80) and having verified the operation, I enter the Common name in the appropriate page, I click test, and I receive the status code 422.

To Reproduce on HTTP
Steps to reproduce the behavior:

1. Go to 'Configuration' > 'System Configuration' > 'SSL Certificates'
2. Click on 'HTTP' > 'Edit"
3. Enable 'Use Let's Encrypt' and insert the Common name (my domain pointing to my public IP);
4. Click on 'Test'
5. The error 'Request failed with status code 422' appears

To Reproduce on RADIUS
Steps to reproduce the behavior:

1. Go to 'Configuration' > 'System Configuration' > 'SSL Certificates'
2. Click on 'RADIUS' > 'Edit"
3. Enable 'Use Let's Encrypt' and insert the Common name (my domain pointing to my public IP);
4. Click on 'Test'
5. The error 'Request failed with status code 422' appears

PacketFence version:
Version: 14.1

Additional context
I opened port 80 on my firewall and confirmed that port forwarding is working correctly.
However, I noticed that the internal PacketFence firewall (Debian) is proxying HTTP traffic from port 8080 to port 80.
To address this, I mapped inbound traffic on port 80 to port 8080 on my PF box, but even after doing that, I still encountered the same 422 error.
I added the portal daemon to the Management interface (eth0) in PacketFence.

[jrouzierinverse]

Did you restart the haproxy portal?

[abdlmalekluttee]

Did you restart the haproxy portal?

I’m pretty sure I did—I’ve rebooted the VM a few times and the issue’s still there. To be safe, what’s the proper way to restart the haproxy-portal component? If there’s a GUI option, I’ll use it, if not please share the exact service name

[sridharintouch]

in packet fence cmd
sudo apt update && sudo apt upgrade -y
sudo apt install certbot python3-certbot-apache -y
sudo apt install certbot -y
sudo certbot certonly --standalone -d yourdomain.com
if error still pops up stop services using this command
pfcmd service pf stop
then try again

[abdlmalekluttee]

Thanks for the commands! They nudged me to check the Let’s Encrypt logs, which pointed me to the real cause.
When I tried issuing manually I kept failing, turned out my Kerio Control Geo-IP filter was silently blocking the HTTP-01 validator After I disabled Geo-IP, issuance worked instantly

Now i am facing a new issue after finishing setup, I tested 802.1X with my iPhone on the new SSID (PF RADIUS + Let’s Encrypt). The server certificate is presented, but iOS marks it Not Trusted. I’ve double checked it’s the correct cert
It appears PacketFence/FreeRADIUS isn’t sending the complete chain (leaf + intermediate[s]) during EAP, so iOS can’t validate it
How do I configure PF 14.1 so RADIUS presents the full chain, Is there a GUI option