How to fix an incomplete SSL certificate chain

The site opens fine in your desktop browser, but a mobile app fails, a script reports “unable to get local issuer certificate”, or a payment provider's webhook cannot connect. The certificate itself is valid. What is missing is the chain that links it to a certificate authority the client already trusts.

How the chain works

• Root certificate: belongs to a certificate authority and is built into operating systems and browsers.
• Intermediate certificate: issued by the root, and used by the authority to sign website certificates day to day.
• Your certificate (the leaf): issued for your domain by the intermediate.

A client trusts your certificate by following the chain up to a root it knows. For that, your server must send your certificate and the intermediate. It should not send the root; clients already have it.

Why some clients work anyway

Some desktop browsers can fetch a missing intermediate themselves, using an address embedded in the certificate, or already have common intermediates cached. Many other clients do not: command-line tools, programming-language libraries, many mobile apps and embedded devices simply fail. So a site can look fine in your browser while being broken for a large share of real traffic.

Check your chain

1. Open the SSL Certificate Checker and enter your domain.
2. Look at Trusted chain and the Certificate chain list.
3. A complete chain shows your certificate followed by one or more intermediates, ending at a trusted authority. If it stops at your own certificate, the server is not sending the intermediate.

The checker also shows expiry dates and whether the certificate covers the name you entered, which is the other common cause of certificate errors.

Fix it

Install the full chain file rather than the certificate alone:

• Let's Encrypt and other ACME clients usually produce a fullchain.pem. Point the server at that, not at cert.pem.
• Nginx: ssl_certificate must point to a file containing your certificate followed by the intermediate.
• Apache: recent versions accept the full chain in SSLCertificateFile; older set-ups use a separate chain file setting.
• Hosting control panels and load balancers: look for a “CA bundle” or “certificate chain” box and paste the intermediate there.

If you build the file by hand, order matters: your certificate first, then the intermediate that signed it, then any higher intermediate. Reload the server and run the checker again.

Other causes of the same errors

• An expired certificate, or an expired intermediate in an old bundle.
• The wrong certificate served for this name, common on servers hosting several sites.
• Old client devices whose trusted root list predates the authority's current root.
• A firewall or antivirus product intercepting connections with its own certificate.

For keeping on top of renewals, see how to check when an SSL certificate expires and why certificate lifetimes are getting shorter.