Troubleshooting2026-08-15•4 min read

Incomplete Certificate Chain: The Missing Intermediate Fix

· CSR.plus Team

•A chain error almost always means the server sends the leaf certificate without the intermediate that browsers need to verify it.
•The fix is a single concatenated file: leaf + intermediate(s) in the correct order.
•Verify with ssls labs-style checks and the same openssl command your visitors will trigger.

Chain errors

Symptoms

only on some clients

Missing file

Root cause

intermediate not sent

~5 minutes

Fix time

once chain is fetched

openssl

Verification

s_client + cert chain

Why the chain breaks

Browsers trust a certificate because they trust its root. Your leaf certificate is signed by an intermediate that is not in the browser’s trust store, so the server must send it during the handshake. If the server config only points to the leaf, or the concatenated file has the wrong order, clients that do not cache the intermediate fail with "incomplete chain", "unable to get local issuer certificate" or NET::ERR_CERT_AUTHORITY_INVALID.

How to fix it on Nginx and Apache

Download the full chain bundle from your CA (or from the intermediate endpoint in the certificate’s Authority Information Access extension). Concatenate: cat yourdomain.com.crt intermediate.crt root.crt > fullchain.crt — leaf first, then intermediates in order, root last. In Nginx point ssl_certificate to the fullchain file; in Apache set SSLCertificateChainFile (or include the chain in SSLCertificateFile). Then reload.

Verify the fix

Run openssl s_client -connect yourdomain.com:443 -servername yourdomain.com -showcerts 2>&1 | grep -A1 "Certificate chain". You should see the leaf followed by the intermediate. openssl verify -CAfile root.pem fullchain.crt should print "fullchain.crt: OK". Retest from a clean browser profile and with an external chain checker.

FAQ

Why does it work in some browsers and not others?

Clients that recently fetched the intermediate from a CT log or cache can verify the chain without it; others cannot. The fix is the same: send the full chain.