The client's message was blunt: "your certificate thing is broken, my browser says it's not secure." Loading the site directly showed a clean padlock, no warnings, certificate details looking entirely normal. Testing from a different laptop, a different network, a phone on cellular data — all clean. The temptation to write it off as a client-side issue (cached old page, browser extension interference, simple user error) was real, but the client was specific and consistent enough about what they were seeing that it seemed worth taking at face value rather than assuming they were simply wrong.
What eventually reproduced it
The client eventually sent an actual screenshot, which included the browser's name and version — an older, less common browser the developer hadn't personally tested against, and critically, one without a large cached collection of intermediate certificates from other sites already stored locally the way a heavily-used mainstream browser often does.
That detail was the whole answer. Checking the server's certificate configuration against an intermediate-chain validator (rather than just a browser, which can silently paper over a missing intermediate using its own cache) showed the server was sending only the leaf certificate — the intermediate certificate that should have accompanied it in the same handshake had never been configured. Mainstream browsers, especially ones the developer had personally tested with, had likely encountered that same CA's intermediate from some other, unrelated site recently enough to have it cached, quietly completing the chain themselves without ever surfacing the gap. The client's less common browser had no such cache to fall back on, and correctly reported the chain as broken.
The actual fix
The fix itself was small once identified — updating the server's SSL configuration to explicitly include the full intermediate bundle alongside the leaf certificate, the way it should have been configured from the start. The site then validated cleanly on every browser tested afterward, including the one that had originally caught the gap.
Why "it works for me" was the wrong instinct here
The genuinely useful lesson was less about the technical fix and more about the investigation instinct: "it works on every browser and network I have access to" quietly assumes your own testing environment is representative, and a certificate chain issue is specifically the kind of bug that's most likely to be invisible from a well-cached, mainstream setup while being completely broken for anyone without that same cache. Our incomplete chain guide covers exactly why this "works for some, fails for others" pattern happens, and how to test for it directly rather than relying on your own browser's cache to mask it.
This case study is written to illustrate a genuine, common troubleshooting pattern. It is not a direct quotation or a verified account tied to a specific, identifiable individual or company. For the underlying technical reference, see: Fixing Incomplete Chain SSL Errors
Loading comments…