Serve the full certificate chain on Caddy

Why it matters

The server sends its own certificate but not the intermediate certificate that links it to a trusted authority. Some browsers can fetch the missing piece, but many apps, command-line tools and mobile clients cannot and will refuse the connection.

The fix

1. Caddy always sends the full chain for certificates it obtains itself. This finding means you loaded a certificate by hand with the tls directive.
2. Replace the certificate file with one that contains the leaf followed by the intermediates, or remove the tls line and let Caddy manage the certificate.

example.com {
	# remove this line to let Caddy manage the certificate
	tls /etc/ssl/example.com/fullchain.pem /etc/ssl/example.com/privkey.pem
}

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the certificate chain and expiry check
• Renew the expired TLS certificate
• Fix a certificate that is not valid yet
• Renew the certificate before it expires
• Install a certificate that covers this hostname
• Replace the self-signed certificate with a trusted one
• Use a certificate from a publicly trusted authority
• Replace the expired intermediate certificate
• Re-issue the certificate with a stronger key
• Replace the certificate that uses a broken hash
• Fix the certificate that browsers reject