A common and perplexing error: the website works perfectly on your own computer, but displays a certificate error for some visitors, on certain mobile phones, or when another program (such as a payment system or an API client) connects to it. The cause is usually a missing intermediate certificate.

What is a certificate chain?

Browsers and operating systems recognise a few dozen trusted root certificates (root CAs), which are pre-installed. However, certificate authorities do not sign website certificates directly with the root certificate, but with one or more intermediate certificates (intermediate CAs). The chain looks like this:

1. Root certificate: pre-installed in the browser.
2. Intermediate certificate: signed by the root certificate.
3. Website certificate: signed by the intermediate certificate.

A browser will only accept a website’s certificate if it can trace the chain all the way back to the root certificate. To do this, the server must send the intermediate certificate(s) as well as its own certificate. The file containing the intermediate certificate(s) is called the **CA **bundle.

So why does it still work in some browsers?

Some desktop browsers remember intermediate certificates from previous visits or download them automatically. Consequently, an incomplete certificate chain often goes unnoticed on the developer’s machine. Other tools (many mobile phones, curl, PHP, Java, payment and other API services) do not do this and will report an error.

How can I check this?

The simplest way is to use the free Qualys SSL Labs test: if the certificate chain is incomplete, the report will display the line ‘Chain issues: Incomplete’.

From the command line:

openssl s_client -connect pelda.hu:443 -servername pelda.hu -showcerts </dev/null

The output must show at least two certificates under Certificate chain (the website’s certificate and the intermediate certificate). If there is only one, the intermediate certificate is missing. At the end of the output, Verify return code: 0 (ok) indicates that the chain is correct.

How can I fix this?

Free certificate on your hosting account

AutoSSL automatically installs the intermediate certificate, so you do not need to do anything.

Paid certificate in cPanel

If you have configured the certificate in Autoinstall (via cPanel) mode on the client portal, the portal will also install the intermediate certificate. For manual installation:

1. On the client portal, on the Certificates page, download the intermediate certificate (Download intermediate certificate).
2. In cPanel, under the Security section, click on the SSL/TLS icon, then click on the ‘Manage SSL sites’ link.
3. Paste the certificate (Certificate: CRT), the private key (Private Key: KEY) and the intermediate certificate into the Certificate Authority Bundle: CABUNDLE field.
4. Click the ‘Install Certificate’ button.

For more details: How can I use my existing SSL certificate?

On your own server (Nginx, Apache)

The simplest way is to combine the certificate and the intermediate certificate into a single file (the order is important: your own certificate first, followed by the intermediate certificate):

cat pelda.hu.crt ca-bundle.crt > pelda.hu-fullchain.crt

Nginx:

ssl_certificate     /etc/ssl/pelda.hu-fullchain.crt;
ssl_certificate_key /etc/ssl/pelda.hu.key;

Apache (2.4.8 or later):

SSLCertificateFile    /etc/ssl/pelda.hu-fullchain.crt
SSLCertificateKeyFile /etc/ssl/pelda.hu.key

After making the changes, reload the web server (systemctl reload nginx or systemctl reload httpd). For Let’s Encrypt certificates, Certbot already provides the concatenated chain in the fullchain.pem file; the web server must be supplied with this, not the cert.pem file.

Detailed information on configuring Apache: A step-by-step guide to setting up SSL on an Apache server.

Do not include a root certificate in the chain

There is no need (nor is it advisable) to send the root certificate to the server, as the browser already recognises it. An unnecessary certificate will only slow down the establishment of the connection.