A certificate chain links your site’s certificate up through one or more intermediate certificates to a root certificate that’s trusted by browsers and operating systems by default. Browsers don’t trust your certificate directly — they trust it because it chains back to a trusted root.
Why incomplete chains cause errors
If your server only sends its own (leaf) certificate without the intermediate certificate(s), most desktop browsers — which often cache intermediates from other sites — may still show the site as secure. But many mobile browsers, API clients, and server-to-server integrations don’t have that intermediate cached and will reject the connection, producing an inconsistent "works on my machine but not for some visitors" symptom.
How to check and fix it
- Use an SSL checker tool that specifically validates chain completeness, not just expiry
- Ensure your server config serves the full chain (leaf + intermediates) as one bundled file, which most CAs provide by default
- Re-test after any certificate renewal, since a chain misconfiguration commonly reappears after switching certificate providers
FAQ
Why did my SSL work fine in Chrome but fail on a customer’s phone?
This is the classic incomplete-chain symptom — Chrome desktop likely had the missing intermediate cached from browsing another site; the phone didn’t.