Serve the full certificate chain on Cloudflare
Why it matters
The server sends its own certificate but not the intermediate certificate that links it to a trusted authority. Some browsers can fetch the missing piece, but many apps, command-line tools and mobile clients cannot and will refuse the connection.
The fix
- If the record is Proxied, Cloudflare sends the complete chain for its edge certificates, so check whether this finding comes from a DNS-only record, which serves your own server's chain.
- For a DNS-only record, fix the chain on your server with the nginx, Apache or generic steps.
Related
- Reported by the certificate chain and expiry check
- Renew the expired TLS certificate
- Fix a certificate that is not valid yet
- Renew the certificate before it expires
- Install a certificate that covers this hostname
- Replace the self-signed certificate with a trusted one
- Use a certificate from a publicly trusted authority
- Replace the expired intermediate certificate
- Re-issue the certificate with a stronger key
- Replace the certificate that uses a broken hash
- Fix the certificate that browsers reject
Scan your domain to see whether this applies to you.