Error: No usable certificates

(Error code 0216eb)

Possible sources

This error originated from one of the following locations within the iPXE source code:

crypto/x509.c (line 1947)

General advice

Try using the latest version of iPXE. Your problem may have already been fixed.
Try building iPXE with the debug option DEBUG=x509
You can contact the iPXE developers and other iPXE users.
Refresh this page after 24 hours. This page is actively monitored, and further information may be added soon.

Additional notes

(Please edit this page to include any of your own useful hints and tips for fixing this error.)

Using DEBUG=validator often shows what failed. Or DEBUG=tls,x509:3,validator,certstore,privkey to show full details, but this could be to much information making it harder to spot the issue.

If you want to trust multiple root certificates, use one certificate per file and specify all files separated with comma as described in the commit that introduced the feature.

Checklist

Time: Check that your device time is correct. Use show unixtime:int32 to see current time in seconds of device and compare that to current actual time.
Chain: Ensure the certificate is valid in the chain that iPXE trusts.