Certificate in chain have an extension that is marked as critical that iPXE don't support. Consider if this extension should be critical and if not change it and reissue certificate. If it really needs to be critical then some development will be needed in iPXE, the certificate or at least extension needs to be sent to a developer. (You need to enabled DEBUG as described above to see exactly what fails)

Since the output can be quite verbose consider sending this to syslog or serial. Another option is to run the linux binary of iPXE which usually gives you a friendlier interface to get text from:

make -C src bin-x86_64-linux/ipxe.linux DEBUG=x509
src/bin-x86_64-linux/ipxe.linux --net slirp

To decode your certificate you can use services such as https://asn1js.eu/