We're running into this issue when using CertiNext. @Foorack's patch did the trick, but I know this will be overwritten as soon as we run through an upgrade.
LetsEncrypt seems to return a cert chain formatted with a double-new-line (0x0a)...
@shanreich , I'm curious if you've had a chance to try NFTables in newer kernels and/or in PVE 9.x. I'm specifically wondering if the IPSet merge feature in NFTables isn't as broken as when you first worked on it.
Reference bug...