What is an incomplete certificate chain and how do you fix it?
2 min read
Your certificate is valid, yet some browsers and tools call your site untrusted? The usual cause is a missing intermediate certificate. Symptoms, diagnosis and per-server fixes.
Symptom: works on some devices, security warning on others
An incomplete chain is the sneakiest TLS misconfiguration: the site opens fine on your machine, but a customer's phone shows "your connection is not private"; curl fails with unable to get local issuer certificate, Java apps with PKIX path building failed. The certificate itself is valid — the server just introduces it incompletely.
Browsers never trust a server certificate directly; they validate it through intermediate certificates that link it to a trusted root. If the server does not send those intermediates, some clients repair the chain from their cache (hence "works for me") while others cannot, and refuse the connection.
Diagnosis: a definitive answer in ten seconds
Query your domain with SSLx. If the Certificate Chain badge says "Chain problem: missing intermediate certificate — browsers will not trust it", the diagnosis is final: SSLx decides with a real TLS handshake performed with verification enabled, not with guesswork. The chain cards also show visually that no INTERMEDIATE follows your SERVER certificate.
Fix: serve the full chain
Your CA usually issues two files: the server certificate and the intermediate(s). Installing only the first produces this error. Serve the concatenated file instead:
Nginx: point ssl_certificate at fullchain.pem (certbot generates it for you). Apache 2.4.8+: let SSLCertificateFile reference the fullchain file. IIS: import the intermediate into the server's "Intermediate Certification Authorities" store. Reload the service and re-test with SSLx — the badge should turn green.
Do not bother appending the root certificate; browsers know roots from their own store. Sending it is not an error, just wasted bytes on every handshake.
Test your own site
SSLx performs every diagnosis in this guide in ten seconds: chain verification, hostname matching, expiry and HSTS — free, no signup.
Test with SSLxFrequently asked questions
My certificate looks valid; why do only some users get errors?
Your machine may be repairing the missing link from its certificate cache. A first-time visitor or a strict client such as curl cannot, and rejects the connection. The server must send the complete chain.
Is "unable to get local issuer certificate" always a server-side problem?
Usually yes (a missing intermediate). The exception: corporate TLS-inspection software can produce the same error locally. If an external checker like SSLx shows green, the problem is on the client side.