How to fix an incomplete certificate chain
An incomplete certificate chain means your server sends its own certificate but not the intermediate certificates that link it to a trusted root. Browsers that can fetch the missing piece work; strict clients, API callers, and older devices fail. Because it is intermittent, an incomplete certificate chain is easy to miss until a machine that cannot recover from it breaks.
- Likely cause
- Server serves the leaf only, omitting intermediate certificates
- Severity
- Medium to high — fails on strict and non-browser clients
- Time to fix
- About 10 minutes
- Prevention
- Serve fullchain.pem and verify from outside
What causes it
- The web server is pointed at the leaf-only certificate file instead of the full-chain file.
- A certificate bundle was assembled by hand and left an intermediate out.
- A certificate authority rotated its intermediates and the server still serves the old bundle.
How to fix it
1. See how many certificates the server sends
A complete chain shows the leaf and one or more intermediates. If only one certificate comes back, the chain is incomplete.
openssl s_client -connect example.com:443 -servername example.com -showcerts </dev/null 2>/dev/null | grep -c "BEGIN CERTIFICATE"2. Point the server at the full-chain file
Use the file that contains the leaf plus intermediates. ACME clients write it as fullchain.pem; a commercial certificate authority provides a CA bundle to concatenate after the leaf.
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;3. Reload and confirm the chain is complete
Reload the server and verify the served chain again from an outside client, not from the machine itself.
sudo systemctl reload nginx
How to prevent it
Deploy the full-chain file everywhere, and monitor the served chain from outside after each renewal so an intermediate rotation cannot leave you serving a stale, incomplete bundle.
Source: Let's Encrypt: chain of trust
Common questions
Why does an incomplete chain pass in my browser?
Some browsers fetch the missing intermediate for you and cache it, so the page loads. Other clients and most non-browser software do not, so they fail. The chain is still incomplete.
How is this different from a missing intermediate?
They are the same problem stated two ways: an incomplete chain is missing one or more intermediate certificates. Serving the full chain fixes both.
Fixed it? Catch the next one before your visitors do — monitor the certificate from outside, 3 free, no card.