Serve the full certificate chain

Why it matters

The server sends its own certificate but not the intermediate certificate that links it to a trusted authority. Some browsers can fetch the missing piece, but many apps, command-line tools and mobile clients cannot and will refuse the connection.

The fix

1. Get the intermediate (chain) certificate from your CA. With Let's Encrypt and certbot it is already bundled in fullchain.pem.
2. Build one file with your certificate first, then each intermediate in order, and point the server at that file.
3. Do not include the root certificate. Clients already have it.
4. Reload the web server and confirm that the chain is complete with the command below, which lists every certificate the server sends.

cat example.com.crt intermediate.crt > fullchain.crt
openssl s_client -connect example.com:443 -servername example.com -showcerts </dev/null 2>/dev/null | grep -E "^ *[0-9]+ s:|^   i:"

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the certificate chain and expiry check
• Renew the expired TLS certificate
• Fix a certificate that is not valid yet
• Renew the certificate before it expires
• Install a certificate that covers this hostname
• Replace the self-signed certificate with a trusted one
• Use a certificate from a publicly trusted authority
• Replace the expired intermediate certificate
• Re-issue the certificate with a stronger key
• Replace the certificate that uses a broken hash
• Fix the certificate that browsers reject