I had problem to connect a InfluxDB from the pfSense because of a invalid certificate chain. The main problem here is that if you are configuring Telegraf with the pfSense UI then you are not using the system certificate chain (on FreeBSD that is /etc/ssl/cert.pem). In fact the generated Telegraf config is using: /usr/local/etc/telegraf.ca The pfSense is generating that chain from your pfSense CAs and certificates (See here for the code which generates the chain).

So in order to make this working we need to add the needed CAs to the pfSense. In my case that is Acmecert: O=Let's Encrypt, CN=Let's Encrypt Authority X3, C=US and Digital Signature Trust Co., CN=DST Root CA X3. If you are missing only one of them the verification of the chain will fail.

So add those two CAs using the pfSense UI (System > Cert. Manager > CAs). A private key is not needed:

Let’s Encrypt Authority X3:

DST Root CA X3:

Additional Debugging Steps

If some other CAs are missing or you are using a self-signed CA you can use these steps to debug further:

To test the TLS connection with the system certificate chain:

1openssl s_client -connect $HOST:8086

To test the TLS connection with the Telegraf certificate chain:

1openssl s_client -connect $HOST:8086 -CAfile /usr/local/etc/telegraf.ca

^{Note: If you see an error about reading the chain then fix the formatting of the chain: sed 's/\r//g' telegraf.ca}

If it worked you should see something like:

depth=2 O = Digital Signature Trust Co., CN = DST Root CA X3
verify return:1
depth=1 C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
verify return:1
depth=0 CN = server21.integreat-app.de
verify return:1
---
Certificate chain
 0 s:/CN=server21.integreat-app.de
   i:/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3
 1 s:/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3
   i:/O=Digital Signature Trust Co./CN=DST Root CA X3
---

If not it should output:

CONNECTED(00000003)
depth=1 C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
verify error:num=2:unable to get issuer certificate
issuer= O = Digital Signature Trust Co., CN = DST Root CA X3
verify return:1
depth=0 CN = server21.integreat-app.de
issuer= C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
verify return:1
---
Certificate chain
 0 s:CN = server21.integreat-app.de
   i:C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
 1 s:C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
   i:O = Digital Signature Trust Co., CN = DST Root CA X3
---

^{Note: unable to get issuer certificate}

To verify a chain use:

1openssl verify /usr/local/etc/telegraf.ca

Notes and Links

See here for a guide to setup Telegraf: https://blog.lbdg.me/pfsense-monitoring/