# SSL Labs: Chain issues: Incomplete — Extra download (intermediate certificate missing)

**Code:** `incomplete certificate chain` · **Category:** SSL / TLS · **Seen on:** SSL, Nginx, Linux

The server sends only its own certificate and not the intermediate CA(s), so some clients cannot build a trusted chain.

## Meaning

Browsers may cache or fetch intermediates (AIA), hiding the problem, while curl, Node, Java, Android and mobile apps fail. Install the full chain provided by your CA (`fullchain.pem`) in the server config, then test with SSL Labs or `openssl s_client`.

## Common causes

- Only the leaf certificate configured
- Wrong bundle file order (intermediate before leaf)
- CA delivered separate files that were ignored
- Using `cert.pem` instead of `fullchain.pem`
- Load balancer holding only the leaf

## Quick fix

1. Use `fullchain.pem` (leaf first, then intermediates)
2. Don't include the root
3. Verify with `openssl s_client -showcerts`

## Detailed fix by platform

### Linux

1. `openssl s_client -connect host:443 -servername host -showcerts </dev/null | grep -E " s:| i:"` shows each cert's subject and issuer

## How to diagnose

1. **Chain** — Leaf + intermediates?
2. **Order** — Leaf first?
3. **Test** — SSL Labs clean?

---
Source: [WhatIsMyError](https://whatismyerror.com/errors/ssl/incomplete-certificate-chain)