Some server software expects a combined certificate file with a specific order: your certificate first, followed by intermediates from closest-to-your-certificate to closest-to-the-root. Getting this order wrong can cause validation failures even though every individual certificate involved is completely valid.
Checking the current order
openssl crl2pkcs7 -nocrl -certfile combined.pem | \
openssl pkcs7 -print_certs -nooutThis lists the certificates in your combined file in the order they appear, showing subject and issuer for each — letting you confirm your certificate is first, followed by intermediates in the correct chain order, rather than jumbled or duplicated.
Rebuilding the file correctly
If the order is wrong, simply concatenate the files again in the correct sequence: cat yourcert.pem intermediate.pem root.pem > fullchain.pem (though the root certificate is often unnecessary to include, since it's already in the client's trust store — check your specific server software's documentation for its exact expected format).
What to do if reordering the chain doesn't resolve the validation issue
If correcting the chain order doesn't resolve validation, confirming you have the actually correct intermediate certificates (not just correctly ordered incorrect ones) from your specific CA is worth checking, since an outdated or wrong intermediate produces a similar-looking failure to an ordering issue.
How to identify the correct order using each certificate's issuer and subject fields
Reading each certificate's Issuer and Subject fields reveals the correct chain order directly — your certificate's Issuer should match the next certificate's Subject, and so on up the chain, letting you manually reconstruct the correct sequence even without prior knowledge of what order was intended.
What tools can automatically detect and fix an incorrect chain order
Several online tools and command-line utilities can analyze a certificate bundle and automatically reorder it correctly, useful when manually tracing issuer/subject relationships across several certificates becomes tedious or error-prone for a longer chain.
How a chain order issue manifests differently across different web server software
Nginx and Apache both simply concatenate whatever certificates are in your combined file in the order given, without independently validating or correcting the order — meaning the exact same chain-order mistake produces a similar validation failure regardless of which web server software you're using, since neither corrects it automatically.
Why testing after any chain-related fix should include multiple different clients, not just one browser
Some clients (older browsers, certain API libraries, some mobile OS versions) are less forgiving of a chain order issue than modern desktop browsers, which sometimes correct minor ordering issues automatically — testing with a strict tool like OpenSSL's s_client, not just a lenient browser, gives a more reliable confirmation the fix is genuinely complete.
What to do if you're not sure which certificates in a bundle are actually intermediates versus your own
Checking each certificate's Subject field against your domain name identifies your own end-entity certificate specifically — everything else in the bundle is an intermediate, and reading each remaining certificate's Issuer and Subject fields reveals how they chain together in the correct order.
How to prevent this issue from recurring on future certificate installations
Using a single, tested combined bundle file consistently for every future installation, rather than manually reassembling certificate files fresh each time, is the most reliable way to prevent a chain-ordering mistake from recurring on a future certificate renewal or new installation.
A closing note on why this specific issue remains common despite being well understood
Chain order issues persist as a common problem specifically because certificate installation is an infrequent task for most site owners — without regular practice, the correct process is easy to forget between the rare occasions it's actually needed, which is exactly why a clear, referenceable guide like this one earns its place.
A final practical tip once you've resolved the issue
Once you've resolved a chain order issue, saving the correctly ordered bundle as a reference template for that specific CA's typical chain structure speeds up any future certificate installation from the same CA, since the correct order tends to remain consistent across a given CA's issuances.