diff --git a/CHANGELOG.md b/CHANGELOG.md
index 58ba79b88..051202a58 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,6 +17,8 @@
   ([#6648](https://github.com/mitmproxymitmproxy/pull/6648), @sujaldev)
 * Fix bug where wireguard config is generated with incorrect endpoint when two or more NICs are active.
   ([#6659](https://github.com/mitmproxy/mitmproxy/pull/6659), @basedBaba)
+* Fix a regression when leaf cert creation would fail with intermediate CAs in `ca_file`.
+  ([#6666](https://github.com/mitmproxy/mitmproxy/pull/6666), @manselmi)
 
 
 ## 21 January 2024: mitmproxy 10.2.2
diff --git a/mitmproxy/certs.py b/mitmproxy/certs.py
index 173311c1d..b054acf42 100644
--- a/mitmproxy/certs.py
+++ b/mitmproxy/certs.py
@@ -415,7 +415,7 @@ class CertStore:
         key = load_pem_private_key(raw, passphrase)
         dh = cls.load_dhparam(dhparam_file)
         certs = x509.load_pem_x509_certificates(raw)
-        ca = Cert(certs[-1])
+        ca = Cert(certs[0])
         if len(certs) > 1:
             chain_file: Path | None = ca_file
         else: