TLS certificate chain

Whether the server sends the intermediate certificate along with its own. Without it, clients that have not cached the intermediate refuse the connection.

• Help center

Browsers trust a certificate because it is signed by an intermediate certificate, which is in turn signed by a root certificate the browser already holds. The server is expected to send its own certificate together with the intermediate; the root is never sent. When the intermediate is missing, the outcome depends on the client. Desktop browsers have usually met it before or fetch it on their own and show the site normally, while some Android devices, curl, payment gateways, webhooks and other server-to-server clients refuse the connection. That is the classic "works for me, fails for them" fault.

How SiteScan checks it

The scanner makes its own handshake and counts the certificates the server sends. A single certificate that is not self-issued means the intermediate was left out: the row turns amber with "Intermediate missing". Otherwise it reads "Complete".

How to fix

• Point the server at the full chain, not the bare certificate. With Certbot that is fullchain.pem, not cert.pem; in nginx: ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
• On Apache 2.4.8 and later, SSLCertificateFile should contain your certificate followed by the intermediate.
• With a purchased certificate, concatenate your certificate and the CA bundle in that order.

See also the certificate issuer.