How to fix a missing intermediate certificate
A missing intermediate certificate is the specific cause behind most incomplete-chain and authority-invalid errors. Your leaf certificate is signed by an intermediate, and that intermediate must travel with it in the handshake. When the intermediate is missing, clients that cannot fetch it on their own reject the connection.
- Likely cause
- The intermediate that signs your leaf is not being served
- Severity
- Medium to high — strict clients cannot build the chain
- Time to fix
- About 10 minutes
- Prevention
- Serve the CA-provided full chain and re-check on renewal
What causes it
- The server config references the leaf certificate rather than the full-chain file.
- The correct intermediate for your certificate authority was never downloaded or was replaced by the wrong one.
- The certificate authority moved to a new intermediate and the served bundle was not updated.
How to fix it
1. Identify the intermediate your leaf needs
Read the issuer of your leaf certificate. That issuer is the intermediate that must be served alongside it.
openssl x509 -in cert.pem -noout -issuer2. Assemble and serve the full chain
Put the leaf first, then the intermediate, in one file, and point the server at it. ACME clients already produce this as fullchain.pem.
cat cert.pem intermediate.pem > fullchain.pem3. Reload and verify no chain error remains
Reload the server and confirm an outside client can now build the full path with no "unable to get local issuer certificate" error.
openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | grep "Verify return code"
How to prevent it
Always serve the certificate authority’s full chain rather than a hand-built bundle, and re-verify the served chain after each renewal, because a shared intermediate can expire or rotate and take many sites down at once.
Source: Let's Encrypt: chain of trust
Common questions
Where do I get the right intermediate?
From your certificate authority, at issuance. ACME clients download it automatically into fullchain.pem. If you are hunting for one by hand, your tooling is likely misconfigured.
Can a missing intermediate take down many sites at once?
Yes. Thousands of servers share one intermediate, so when that intermediate expires or rotates and bundles are stale, they can fail together. The shared AddTrust root expiring in 2020 is the best-known case: chains that still followed the expired path broke older clients.
Fixed it? Catch the next one before your visitors do — monitor the certificate from outside, 3 free, no card.