What is an SSL certificate chain and what causes chain errors?

The certificate chain links your domain certificate to a trusted root CA via intermediate certificates. Chain errors occur when intermediate certificates are missing from your server config, when certificates are in the wrong order, or when an intermediate has expired. Browsers cannot complete validation if any link in the chain is absent.

How do I fix a missing intermediate certificate?

Download the intermediate certificate(s) from your CA (usually in the "Certificate Bundle" download). Create a combined file: your domain certificate first, then the intermediates in order. Configure your web server to use this combined file: ssl_certificate in nginx, SSLCertificateFile with the full chain in Apache 2.4.8+. Reload the web server after changes.

What is correct certificate chain ordering?

The chain must be ordered from leaf to root: your domain certificate first, then the issuing intermediate, then any further intermediates. The root CA is last (or omitted, since it is pre-trusted by browsers). Wrong ordering causes validation failures in some clients even when all certificates are present. Verify ordering with openssl verify.

How can I verify my certificate chain is correct?

Use an SSL checker tool to verify chain completeness and ordering instantly. From the command line: openssl s_client -connect yourdomain.com:443 -showcerts prints the full chain as presented by your server. Look for all intermediate certificates and verify they link back to a trusted root. "Verify return code: 0 (ok)" confirms a valid chain.

Back to Learning Center

SSL Basics

SSL Certificate Chain Errors: Causes and Fixes

8 min read·Updated June 2026·By CertNotify Team

Certificate chain errors are some of the trickiest SSL problems to debug because your site may work fine in most browsers but fail for some users, mobile apps, or API clients. Understanding certificate chains is essential for anyone managing TLS certificates.

What is a Certificate Chain?

A certificate chain (also called a trust chain) is a series of certificates linking your domain certificate to a Root CA that browsers inherently trust:

Root CA Certificate: Trusted by all browsers (pre-installed). Examples: DigiCert, Sectigo, ISRG Root X1.
Intermediate CA Certificate: Signs your domain cert on the Root CA's behalf. Often missing — the most common chain error.
Your Domain Certificate: Issued for yourdomain.com. Directly presented to browsers.

Common Chain Errors

Error	Cause
UNABLE_TO_GET_ISSUER_CERT_LOCALLY	Missing intermediate certificate in the chain
CERT_UNTRUSTED	Self-signed cert or intermediate not in browser trust store
UNABLE_TO_VERIFY_LEAF_SIGNATURE	Chain breaks — intermediate cannot be verified against root
CERTIFICATE_VERIFY_FAILED	General chain verification failure
ERR_CERT_AUTHORITY_INVALID	Chrome: issuer not recognized as trusted CA

Diagnose Your Chain

# OpenSSL chain check

openssl s_client -connect yourdomain.com:443 -showcerts 2>/dev/null | grep -E "s:|i:"

You should see a chain like:

s:CN = yourdomain.com
i:CN = Intermediate CA Name
s:CN = Intermediate CA Name
i:CN = Root CA Name

If you only see one "s:/i:" pair, your intermediate certificate is missing from the server configuration.

Fix: Build the Full Chain

# Concatenate certificates in order: domain → intermediate → (optional root)
cat yourdomain.crt intermediate.crt > fullchain.pem

# Verify the chain
openssl verify -CAfile root.pem -untrusted intermediate.pem yourdomain.crt

Where to get the intermediate certificate: download from your CA's documentation page. For Let's Encrypt, use the ISRG Root X1 chain. For DigiCert, use their intermediate repository.

Configure Your Web Server

# Nginx — use fullchain.pem

ssl_certificate /etc/ssl/fullchain.pem;  # domain cert + intermediates
ssl_certificate_key /etc/ssl/private.key;

# Apache — use SSLCertificateChainFile

SSLCertificateFile /etc/ssl/yourdomain.crt
SSLCertificateKeyFile /etc/ssl/private.key
SSLCertificateChainFile /etc/ssl/intermediate.crt

Why Mobile Clients Are More Sensitive

Desktop browsers use a technique called "AIA Fetching" (Authority Information Access) to automatically download missing intermediate certificates. Mobile apps, IoT devices, and server-to-server API clients often do not — they will fail with a chain error even when the same site works in Chrome. Always configure the complete chain on the server side.

Use our free SSL Certificate Checker to verify your certificate chain is complete, correctly ordered, and all intermediates are present — in seconds.