Your SSL certificate is valid, not expired, and covers the domain. But browsers still show a warning, or some users see "not secure". The cause is often an incomplete SSL chain. This guide explains why the chain is incomplete, how to check it, and how to fix it.
What an SSL chain is
An SSL certificate is part of a chain of trust. The chain includes:
— the server certificate (your domain);
— one or more intermediate certificates;
— the root certificate (trusted by browsers).
The browser must be able to build the full chain from your server certificate to a trusted root. If an intermediate certificate is missing, the chain is incomplete, and the browser may not trust the certificate.
Why an incomplete chain causes warnings
If the intermediate certificate is missing, the browser cannot verify the chain. It may show a warning like "Your connection is not private" or "Certificate not trusted".
What happens:
— the server sends only the server certificate;
— the browser cannot find the intermediate;
— the chain is incomplete;
— the browser shows a warning.
Some browsers cache intermediate certificates, so the warning may appear only for some users. This makes the problem hard to diagnose.
Reason 1: intermediate certificate not installed
The most common cause. The server certificate is installed, but the intermediate certificate is not.
What to check:
— is the intermediate certificate installed;
— is the full chain served;
— does the browser see the full chain.
Use SSL lookup to check the chain and see if intermediates are present.
Reason 2: server configuration error
Even if the intermediate is installed, the server may not serve it correctly. The configuration may reference only the server certificate.
What to check:
— nginx or Apache configuration;
— ssl_certificate directive includes the chain;
— SSLCertificateChainFile is set (Apache);
— the server was reloaded.
The fix: configure the server to serve the full chain. In nginx, concatenate the server certificate and intermediates into one file.
Reason 3: wrong certificate order
The order of certificates in the chain matters. If the order is wrong, the browser may not build the chain correctly.
What to check:
— order of certificates;
— server certificate first;
— intermediates after;
— root not included.
The fix: reorder the certificates correctly.
Reason 4: CDN or proxy strips the chain
If the site is behind a CDN or proxy, the CDN may strip the intermediate certificate or serve only the server certificate.
What to check:
— CDN SSL settings;
— whether the CDN serves the full chain;
— whether the CDN uses its own certificate.
The fix: configure the CDN to serve the full chain, or use the CDN's certificate.
Reason 5: outdated intermediate certificate
If the intermediate certificate is outdated, the browser may not trust it.
What to check:
— expiry date of the intermediate;
— whether it is still trusted;
— whether the CA has updated it.
The fix: download the latest intermediate from the CA and install it.
How to diagnose chain issues
A practical sequence:
— check the chain with an SSL checker;
— check the server configuration;
— check the certificate order;
— check CDN settings;
— test in different browsers;
— test from different devices.
If the chain is incomplete, the browser may show a warning only for some users. For a broader audit, SEO audit can help verify SSL, HSTS and other security factors in one place.
How to fix chain issues
Fix steps:
— download the intermediate certificate from the CA;
— install it on the server;
— configure the server to serve the full chain;
— reorder certificates correctly;
— configure CDN to serve the chain;
— test in different browsers.
FAQ
Why is my SSL chain incomplete?
Most often because the intermediate certificate is not installed, the server configuration is wrong, or a CDN strips the chain.
Does an incomplete chain affect SEO?
Yes. If browsers show warnings, users leave, and search engines may mark the site as insecure.
How do I check my SSL chain?
Use an SSL checker to see if intermediates are present and the chain is complete.
What is an intermediate certificate?
It is part of the chain of trust. It connects your server certificate to a trusted root.
Can I use only the server certificate?
No. The browser needs the full chain. Without intermediates, the chain is incomplete.
Why do some users see warnings and others do not?
Some browsers cache intermediates. Users with cached intermediates may not see warnings, even if the chain is incomplete.
How do I fix the chain in nginx?
Concatenate the server certificate and intermediates into one file and reference it in ssl_certificate.
Can a CDN cause chain issues?
Yes. Some CDNs strip intermediates. Check CDN SSL settings.
What if the chain is complete but warnings persist?
Check for expired certificates, wrong order, or other SSL issues. Test with different tools.
How often should I check the chain?
After every certificate change and periodically as part of a security audit.
