External dynamic list failing at refresh

[rperez-mz]

This should be simple, but i have been at it for much too long and support hasnt been able to figure it out. Hoping someone here has had this issue.

I have a simple EDL to allow (type IP) the source is https and it's a txt file on a bitbucket repo.

I have added the certs (root and intermediate) directly from the CA that signed them (well known CA, not internal). the root had the box checked "trusted root ca cert"

I have created a cert profile with the certs

When I go to refresh I see the refresh job fail with the follwing:

 EDLRefresh job failed. Cert validation failed

EDL server certificate authentication failed. The associated external dynamic list has been removed, which might impact your policy. EDL Name: TEST-EDL-IP, EDL Source URL: https://blah.blah.blah.txt, CN: *.blah.com, Reason: self signed certificate in certificate chain

I have tried it on 3 different firewalls and all fail in the same way. All are on panos 8. I have tried it with an http source (without a cert profile) and it works as it's supposed to, so at least I know the EDL object and rules, etc work. I think it might be a stupid simple thing that I am missing, but I can't figure it out. I have no hair. Thank you for your assistance

[rperez-mz]

Thank you @Anon1 and @BPry you were right. I thought I had the whole chain. I just got in touch with the issuer and asked for the root/issuing, etc certs and indeed they were completelty different. That resolved it.