Incomplete Certificate Chain
Severity: High
Last updated August 11, 2026.
What it means
Your server sends its own certificate but not the intermediate certificate that links it to a trusted authority, so the chain cannot be completed. Desktop browsers often hide this by fetching the missing certificate themselves, but many mobile apps, older devices and API clients cannot, and they reject the connection outright.
Why it matters
A complete chain of trust requires every link from your certificate up to a root the client already trusts. Missing the intermediate certificate means only clients that are willing and able to fetch it separately can complete verification — which is a meaningful share of desktop browsers, but not most non-browser clients. The result is a site that looks fine in a quick browser check while silently failing for a portion of real traffic.
What Nivaronix checks
Nivaronix performs a strict TLS handshake with certificate verification enabled and, when it fails specifically because the issuer chain can't be resolved, reconnects diagnostically to count how many certificates the server actually sent. This is a chain-completeness check, not a scan for server-side vulnerabilities.
Example evidence
Illustrative example, not a live scan result. Run the checker below to see your own domain's actual status.
Illustrative example only — not a live scan result.
URL: https://example.com
Certificates sent by server: 1
A complete chain normally needs at least 2 (your certificate plus the intermediate that signed it)
Status: INCOMPLETE CERTIFICATE CHAINHow to fix it
- Reinstall your certificate together with the intermediate ("chain" or "CA bundle") certificate your certificate authority supplied.
- Concatenate your leaf certificate and the CA-supplied intermediate bundle into one file, leaf first, and point the server at it (nginx `ssl_certificate`, Apache `SSLCertificateFile`; Let's Encrypt calls this file `fullchain.pem`).
- Reload the web server after making the change — a chain fix doesn't take effect until the server picks up the new file.
How to verify the fix
Run `openssl s_client -connect hostname:443 -servername hostname -showcerts` and confirm the server now sends the full chain (your certificate plus at least one intermediate), or re-run the SSL/TLS checker against the domain.
FAQ
Why does my site look fine in Chrome but fail for other clients?
Desktop browsers often fetch a missing intermediate certificate themselves via AIA (Authority Information Access) chasing, silently completing the chain the server should have sent. Many mobile apps, older devices, and API/HTTP clients don't do this, so they see the same incomplete chain the server actually sent and reject the connection — the browser is masking a real server misconfiguration.
What's the difference between the leaf, intermediate, and root certificate?
The leaf certificate identifies your domain specifically. The root is a certificate authority's self-signed certificate already trusted by browsers and operating systems. The intermediate sits between them, signed by the root and used to sign your leaf — it's the link a client needs to walk the chain from your certificate up to something it already trusts, and it's the piece this finding means is missing.
How do I fix an incomplete certificate chain?
Configure your server to send the full certificate bundle — your leaf certificate plus every intermediate — not just the leaf alone. Most CAs provide a 'full chain' or 'bundle' file specifically for this; the fix is almost always using that bundle file in the server's TLS configuration instead of the standalone certificate file.
Can this happen even right after issuing a new certificate correctly?
Yes — a CA occasionally rotates which intermediate certificate it uses to sign new certificates, and a server configured with the old intermediate bundle can serve an incomplete or mismatched chain for a newly issued leaf certificate. Re-downloading the current full-chain bundle from the CA after any renewal avoids this.
Check your certificate now
Free, no signup required.