Incomplete Certificate Chain

What it means

Your server sends its own certificate but not the intermediate certificate that links it to a trusted authority, so the chain cannot be completed. Desktop browsers often hide this by fetching the missing certificate themselves, but many mobile apps, older devices and API clients cannot, and they reject the connection outright.

Why it matters

A complete chain of trust requires every link from your certificate up to a root the client already trusts. Missing the intermediate certificate means only clients that are willing and able to fetch it separately can complete verification — which is a meaningful share of desktop browsers, but not most non-browser clients. The result is a site that looks fine in a quick browser check while silently failing for a portion of real traffic.

What Nivaronix checks

Nivaronix performs a strict TLS handshake with certificate verification enabled and, when it fails specifically because the issuer chain can't be resolved, reconnects diagnostically to count how many certificates the server actually sent. This is a chain-completeness check, not a scan for server-side vulnerabilities.

Example evidence

Illustrative example, not a live scan result. Run the checker below to see your own domain's actual status.

Illustrative example only — not a live scan result.

URL: https://example.com
Certificates sent by server: 1
A complete chain normally needs at least 2 (your certificate plus the intermediate that signed it)
Status: INCOMPLETE CERTIFICATE CHAIN

How to fix it

• Reinstall your certificate together with the intermediate ("chain" or "CA bundle") certificate your certificate authority supplied.
• Concatenate your leaf certificate and the CA-supplied intermediate bundle into one file, leaf first, and point the server at it (nginx `ssl_certificate`, Apache `SSLCertificateFile`; Let's Encrypt calls this file `fullchain.pem`).
• Reload the web server after making the change — a chain fix doesn't take effect until the server picks up the new file.

How to verify the fix

Run `openssl s_client -connect hostname:443 -servername hostname -showcerts` and confirm the server now sends the full chain (your certificate plus at least one intermediate), or re-run the SSL/TLS checker against the domain.