incomplete certificate chain SSL / TLS Origin: Network OSI layer 6 · Presentation Last updated 4 Nov 2026

SSL Labs: Chain issues: Incomplete — Extra download (intermediate certificate missing)

The server sends only its own certificate and not the intermediate CA(s), so some clients cannot build a trusted chain.

Exact message you may see Chain issues: Incompleteincomplete certificate chainExtra download intermediate certificate missingThis server's certificate chain is incompletecertificate chain is incomplete
Explore the map of this error Full error map →
Seen on: SSL Nginx Linux

Meaning

Browsers may cache or fetch intermediates (AIA), hiding the problem, while curl, Node, Java, Android and mobile apps fail. Install the full chain provided by your CA (fullchain.pem) in the server config, then test with SSL Labs or openssl s_client.

Common causes

  • Only the leaf certificate configured
  • Wrong bundle file order (intermediate before leaf)
  • CA delivered separate files that were ignored
  • Using cert.pem instead of fullchain.pem
  • Load balancer holding only the leaf

⚡ Quick fix

  1. Use fullchain.pem (leaf first, then intermediates)
  2. Don't include the root
  3. Verify with openssl s_client -showcerts

Detailed fix by platform

Linux

  1. openssl s_client -connect host:443 -servername host -showcerts </dev/null | grep -E " s:| i:" shows each cert's subject and issuer

How to diagnose

  1. Chain — Leaf + intermediates?
  2. Order — Leaf first?
  3. Test — SSL Labs clean?

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: Network. Errors that are often confused with or caused by this one (click to open):

1000 — Cloudflare Error 1000: DNS points to prohibited IP (Cloudflare)10001001 — Cloudflare Error 1001: DNS resolution error (Cloudflare)10011002 — Cloudflare Error 1002: DNS points to Prohibited IP / Restricted (Cloudflare)10021004 — Cloudflare Error 1004: Host Not Configured to Serve Web Traffic (Cloudflare)10041018 — Cloudflare Error 1018: Could not find host (Cloudflare)10181034 — Cloudflare Error 1034: Edge IP Restricted (Cloudflare)1034AH00558 — Apache: AH00558: apache2: Could not reliably determine the server's fully qualified domain name (Nginx / Apache)AH00558AH01909: server certificate does NOT include an ID which matches the server name — Apache: [ssl:warn] AH01909: example.com:443:0 server certificate does NOT include an ID which matches the server name (SSL / TLS)AH01909: server certi…incomplet…

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.