Incomplete Certificate Chain

Your server is not sending all intermediate certificates needed to verify trust. Some clients work (they cache or fetch intermediates), others fail.

What You Will See

OpenSSL and curl report "unable to verify the first certificate" or "certificate verify failed". The site loads fine in Chrome and Firefox but fails in Python, Java, or older browsers. Automated HTTP clients and CI/CD pipelines break intermittently depending on their local certificate cache.

Why This Happens

The server sends only the leaf certificate without the intermediate certificates that link it to a trusted root. Browsers often work around this by caching intermediates they have seen from other sites or by using Authority Information Access (AIA) fetching to download the missing intermediate on the fly. Programmatic clients, older browsers, and many mobile apps do not perform AIA fetching and will reject the connection.

How to Diagnose

Use the TLS Inspector to examine the certificate chain. If the chain section shows only one certificate (the leaf), your server is not sending intermediates. A properly configured chain should show the leaf certificate plus one or more intermediate certificates. The root certificate is optional since clients already have it in their trust store.

How to Fix

1. Obtain the full chain file from your CA. It is usually called fullchain.pem or ca-bundle.crt.
2. Configure your server to use the full chain file instead of just the leaf cert:

# Nginx
ssl_certificate /path/to/fullchain.pem;

# Apache
SSLCertificateChainFile /path/to/chain.pem;

3. Reload your server configuration and verify with the TLS Inspector that the full chain is now being served.