Have you encountered an SSL handshake error? Or a mismatched SSL certificate error?
These errors often point to an incomplete certificate chain. They can impact the security, reliability, and trustworthiness of a website or web application. It’s essential to address these issues promptly to ensure a secure and seamless user experience.
In this comprehensive guide, we’ll cover what this warning means, explain what is an SSL certificate chain, explore why these security errors happen, and provide a step-by-step walkthrough on how to fix them using an SSL certificate chain checker.
What Does an “Incomplete Certificate Chain” Warning Mean?
An incomplete certificate chain means your website’s server certificate is missing one or more certificates that connect it to a trusted authority. This missing link creates a broken certificate chain, so browsers may show security warnings or block the site.
To fix it, install the missing intermediate certificates on your web server. This forms a complete certificate chain that browsers can verify and trust.
What Is an SSL Certificate Chain?
An SSL certificate chain is a series of certificates that link the website’s SSL certificate to a trusted root certificate authority (CA). The chain typically consists of three certificates: the SSL certificate itself, an intermediate certificate, and a root certificate. The SSL certificate is issued by an intermediate certificate, whose certificate is signed by a trusted root CA. The root certificate is issued by a trusted CA, such as DigiCert, Sectigo, GlobalSign, or Let’s Encrypt (a free CA used by most websites today).
The website’s SSL certificate is also called a leaf certificate or server certificate. Browsers and operating systems usually store trusted roots in a trust store, while the web server sends the leaf and intermediate certificates.
How Do SSL Certificate Chains Work?
SSL chain certificates work by establishing a chain of trust from a website’s SSL certificate to a trusted root certificate authority. Here’s how it works:
- SSL certificate issuance
- Intermediate certificates
- Root certificates
- SSL handshake
1. SSL Certificate Issuance
When a website owner wants to secure their domain with SSL, they obtain an SSL certificate file from a CA. The SSL certificate contains information about the website’s identity and public key.
2. Intermediate Certificates
The CA issues an intermediate certificate along with the SSL certificate. This intermediate certificate is used to link the SSL certificate to the CA’s root certificate. The intermediate certificate helps establish a chain of trust from the SSL certificate to the root certificate. If a middle link is missing, the certificate chain breaks and the browser can’t complete the trust path.
3. Root Certificate
The root certificate is the top-level certificate in the full certificate chain and is issued by the CA. Root CAs are kept offline to protect their private keys.
4. SSL Handshake
When a user’s web browser connects to a website secured with SSL, the server presents its SSL certificate to the browser.
It checks the certificate chain to ensure that each certificate is valid, and that the SSL certificate chain is issued by a trusted CA. If the certificate chain is complete and valid, the browser establishes a secure connection with the server. However, if the certificate chain is incomplete or invalid, the browser may display a warning or SSL certificate error to the user indicating that the connection may not be secure.
Some browsers cache or retrieve missing intermediate certificates, so a chain may work in one browser but fail in another.
What Causes an Incomplete Certificate Chain Warning?
An incomplete certificate chain warning occurs when a website’s SSL/TLS certificate chain is missing one or more intermediate certificates. This warning is typically displayed by web browsers to alert users that the SSL/TLS certificate presented by the website cannot be fully validated.
Here are some common scenarios when an incomplete certificate chain warning may occur:
- Misconfigured server: If the web server is not configured to serve the full certificate chain, it may present only the SSL/TLS certificate without the necessary intermediate certificates.
- Certificate installation error: During the installation of an SSL/TLS certificate, if the intermediate certificates are not correctly installed or configured on the server, it can lead to an incomplete certificate chain. The same issue can occur if the certificates are in the wrong order or the server config uses the wrong CA bundle.
- Certificate renewal: When renewing an SSL/TLS certificate, if the new certificate is not configured with the correct intermediate certificates, it can result in an incomplete certificate chain.
How to Fix the Incomplete Certificate Chain Warning
To fix the incomplete SSL certificate chain warning, you will need to ensure that the server’s SSL certificate is properly configured to include the necessary intermediate certificates.
Here are the steps you can take to fix the warning:
- Identify the missing intermediate certificates: Use an SSL checker tool to identify the missing intermediate certificates for your SSL certificate. An online SSL certificate chain checker can also show whether the server is sending a complete chain.
- Obtain the missing intermediate certificates: Contact your CA or certificate provider to obtain the missing intermediate certificates.
- Install the intermediate certificates: Once you have obtained the missing intermediate certificates, install them on your server according to your server’s documentation. If your server uses a combined PEM file, place the server certificate first, followed by the intermediate certificates.
- Restart the server: After installing the intermediate certificates, restart your server to apply the changes.
- Test the SSL configuration: Use an SSL checker tool to verify that the SSL certificate chain is now complete, and that the warning no longer appears.
- Verify the certificate chain: Use an online SSL checker tool or browser developer tools to confirm or verify that your website’s SSL/TLS certificate chain is now complete. The tool should no longer report an incomplete certificate chain warning.
- Test your website: Visit your website using a web browser to ensure that the incomplete certificate chain warning no longer appears. Your website should now load without any SSL/TLS errors.
- Update SSL/TLS configuration: Review your SSL/TLS configuration to ensure that it includes the full certificate chain. Consider using the fullchain.pem file provided by some certificate authorities, which includes both your SSL/TLS certificate and the necessary intermediate certificates. For Certbot setups, fullchain.pem is typically the correct certificate file for Nginx and current Apache configurations.
- Monitor for future issues: Regularly monitor your SSL/TLS configuration and certificate expiration dates to prevent future incomplete certificate chain warnings.
How to Identify the Incomplete Certificate Chain Warning
Here is how you can identify an incomplete certificate chain warning or SSL certificate error:
- Browser warning: When you visit a website secured with SSL, your web browser may display a warning indicating that the certificate chain is incomplete or invalid. For example, you may see a message such as “Your connection is not private.”
- Certificate details: You can view the details of the SSL certificate presented by the website to check for any issues with the certificate chain.
- Certificate chain: In the certificate details, look for the certificate chain, which should include the SSL certificate, intermediate certificate(s), and the root certificate. The server usually sends the website certificate and intermediate certificates. The trusted root may come from the browser or operating system’s trust store.
- Certificate authorities: Verify that the intermediate certificates in the chain are issued by a trusted certificate authority (CA).
- Certificate expiry: Check the expiry dates of the SSL certificate and the intermediate certificates. If any of these certificates have expired, it may cause an incomplete certificate chain warning.
- Browser tools: Some browsers and online tools offer SSL certificate validation tools that can help identify issues with the certificate chain.
Results may vary because clients use different trust stores, and some browsers cache or retrieve missing intermediate certificates.
If you encounter an incomplete certificate chain warning, it is important to proceed with caution and avoid entering sensitive information on the website until the issue is resolved. Contact the website administrator or the certificate issuer for assistance in resolving the certificate chain issue.
Keep Your SSL Certificate Chain Complete
Understanding the certificate chain helps you protect your website and your visitors’ data. A broken chain can block access, create doubt, and send potential customers away. Persistent HTTPS errors may also weaken the user experience and search visibility.
A complete SSL certificate chain is one part of website security. For broader protection, pair it with a secure business email and phishing awareness. Your hosting provider may also manage or help configure your SSL certificates. Choose a reliable provider like BigRock if you need support with installation, renewal, or server settings.
