Troubleshooting Certificate Chain Errors

What is a certificate chain?

An SSL/TLS certificate chain is the path a browser follows from your server certificate up to a trusted root CA:

1. The Server Certificate (your specific domain, e.g. www.example.com)
2. Intermediate Certificate(s) (issued by the root CA to sign your server certificate)
3. The Root CA Certificate (pre-installed in browsers and operating systems)

If a link in this chain is missing, the browser cannot verify the connection and will display an "untrusted certificate" error.

Common symptoms

• "Your connection is not private" / "NET::ERR_CERT_AUTHORITY_INVALID" (Chrome)
• "Warning: Potential Security Risk Ahead" (Firefox)
• The certificate works in some browsers but fails in others
• Mobile devices show errors while desktop browsers work (desktops often cache intermediate certificates)
• SSL scanners report an "Incomplete chain" or "Missing intermediate"

Step 1: Diagnosis with online tools

Use FairSSL's SSL Scanner or other online diagnostic tools to verify your chain:

• FairSSL SSL Scanner - provides a full breakdown of the certificate chain and any identified errors
• openssl s_client via the command line (see below)

Step 2: Verification using OpenSSL

openssl s_client -connect dit-domaene.dk:443 -servername dit-domaene.dk

Check the output for the following:

• Verify return code: 0 (ok) = The chain is complete and valid
• Verify return code: 21 (unable to verify the first certificate) = The intermediate certificate is missing
• The depth=0 line represents your certificate, while depth=1 shows the intermediate

To view only the certificate chain details:

openssl s_client -connect dit-domaene.dk:443 -servername dit-domaene.dk -showcerts 2>/dev/null | openssl x509 -noout -subject -issuer

Step 3: Locating the missing intermediate certificate

Intermediate certificates are typically provided by your CA alongside your server certificate. If you cannot find them:

1. Check the issuance email from your Certificate Authority for a "CA Bundle" or "Intermediate Certificate" file.
2. Download them directly from the CA's support repository:
   • GlobalSign: support.globalsign.com
   • DigiCert: digicert.com/kb
   • Sectigo: support.sectigo.com
3. Run openssl x509 -in dit-certifikat.crt -noout -issuer to identify the issuer of your certificate and retrieve the corresponding intermediate.

Step 4: Installing the intermediate certificate

Apache / Nginx (Linux)

Concatenate the certificates in the correct order into a single file:

cat dit-certifikat.crt intermediate.crt > fullchain.crt

In Apache, use SSLCertificateChainFile or include the entire chain in SSLCertificateFile. In Nginx, use the combined file for the ssl_certificate directive.

IIS / Windows Server

1. Open certlm.msc (or MMC with the Certificates snap-in for the Local Computer).
2. Navigate to Intermediate Certification Authorities → Certificates.
3. Right-click → All Tasks → Import and select your intermediate file.

Step 5: Verifying the fix

openssl s_client -connect dit-domaene.dk:443 -servername dit-domaene.dk 2>/dev/null | grep "Verify return code"

The output should now show Verify return code: 0 (ok). You should also test the site from a mobile device or in an incognito window to ensure you aren't seeing a cached version of the old certificate.

Best practices and prevention

• Always install the provided intermediate certificates when deploying a new certificate.
• Verify the installation immediately using FairSSL's SSL Scanner.
• Use ACME clients (such as Certbot or acme.sh) which handle chain bundling automatically.
• Always point your web server configuration to the fullchain.pem file rather than just cert.pem.