iPXE chain --autofree https://boot.netboot.xyz/menu.ipxe

[marcjones-syspro]

I'm trying to use netboot.xzy with a custom ipxe.efi, which works to load the netboot.xzy menu, but fails when selecting an option.
The initial https access works and the certificate is validated, but loading any menu option fails on the certificate check.

Here is the debug output:

CERTSTORE added certificate netboot.xyz
X509 chain 0x485942a8 added X509 0x485a1808 "netboot.xyz"
X509 chain 0x48598288 allocated
X509 chain 0x48598288 added X509 0x485a0068 "netboot.xyz"
X509 chain 0x48598288 added X509 0x485a1808 "netboot.xyz"
X509 0x485a0068 "netboot.xyz" is valid (at time 1723150175)
X509 0x485a0068 "netboot.xyz" is not a root certificate
X509 0x485a0068 "netboot.xyz" has no trusted issuer
X509 0x485a1808 "netboot.xyz" is valid (at time 1723150175)
X509 0x485a1808 "netboot.xyz" is not a root certificate
X509 0x485a1808 "netboot.xyz" has no trusted issuer
X509 chain 0x48598288 found no usable certificates
X509 chain 0x48598288 freed
X509 chain 0x485942a8 freed
Could not verify: Permission denied (https://ipxe.org/0216eb8f)
Error occured, press any key to return to menu ...

It seems like there might be a required netboot.xyz specific certificate to loaded. Do I need to add something with the certstore command or can a cert be compiled in the iPXE image? https://ipxe.org/cmd/certstore, https://ipxe.org/crypto

I see reference to cert_file_filename: ca-netboot-xyz.crt in the main.yml, but I don't see where that file is located.