An incomplete certificate chain — your certificate installed without its required intermediate bundle — is the underlying cause behind a large share of "works somewhere, fails somewhere else" SSL problems covered throughout this category, making it worth understanding as a root cause pattern rather than just a symptom of one specific error message.
Why it's so easy to miss
A browser that already has the missing intermediate cached (from having visited another site using the same CA recently) will silently complete the chain and show no error at all — meaning the person installing the certificate often sees it working perfectly fine in their own browser, with no indication anything is actually misconfigured, until a different visitor or client without that cached intermediate hits the gap.
The definitive way to check
openssl s_client -connect yourdomain.com:443 -showcertsThis shows exactly what your server is sending, with no client-side caching involved — if your certificate appears without at least one intermediate certificate following it in the output, that's the gap. Reinstall with the full CA bundle included, and this entire category of intermittent, hard-to-reproduce error resolves.
What exactly needs to be checked to confirm a chain is really incomplete
Running an OpenSSL chain check against your server, covered in detail in our dedicated chain-viewing guide, definitively confirms whether your server is actually sending a complete chain rather than relying on assumption or a single client's specific behavior.
How this exact issue connects to several other guides across this Troubleshooting category
Incomplete chains are a root cause behind several other specific errors covered throughout this category, including certificate authority invalid errors, mobile-specific failures, and the unable-to-get-local-issuer-certificate message covered in depth in our dedicated How-To deep-dive — recognizing the common thread helps you diagnose seemingly different symptoms faster.
What the specific fix looks like once an incomplete chain is confirmed
Obtaining the correct, complete intermediate bundle from your CA (typically available from your CA account dashboard) and installing it alongside your certificate, following your specific web server's documented process, is the direct, complete fix for this exact issue.
How to prevent this from recurring on future certificate renewals or reinstalls
Documenting the correct, complete installation process, including the specific intermediate bundle file needed, and ideally automating renewal entirely through an ACME client that handles the complete chain automatically, prevents this from recurring on future renewals.
What the exact OpenSSL command looks like for confirming chain completeness definitively
Running openssl s_client -connect yourdomain.com:443 -showcerts and counting the certificates in the output, comparing against what you expect (your certificate plus every necessary intermediate), gives definitive, unambiguous confirmation of whether your chain is genuinely complete.
How to obtain the correct, complete bundle if you're unsure what your CA requires
Your CA's account dashboard or support documentation specifies the exact required intermediate bundle for your specific certificate — when in doubt, downloading the bundle directly from your CA's own official source is more reliable than assembling one manually from a general online search.
How this specific issue disproportionately affects visitors on less common or older clients
Because chain completeness issues are in particular masked by some clients' caching behavior, they disproportionately affect a less visible subset of your actual visitors, mobile users, API integrations, less common browsers, making them easy to overlook if your own testing happens to rely on a more forgiving client.
Loading comments…