Serve the full certificate chain on nginx

Why it matters

The server sends its own certificate but not the intermediate certificate that links it to a trusted authority. Some browsers can fetch the missing piece, but many apps, command-line tools and mobile clients cannot and will refuse the connection.

The fix

1. nginx sends only what is in the ssl_certificate file, so that file must be the leaf certificate followed by the intermediates. With Let's Encrypt use fullchain.pem and not cert.pem.
2. Test and reload nginx.

ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the certificate chain and expiry check
• Renew the expired TLS certificate
• Fix a certificate that is not valid yet
• Renew the certificate before it expires
• Install a certificate that covers this hostname
• Replace the self-signed certificate with a trusted one
• Use a certificate from a publicly trusted authority
• Replace the expired intermediate certificate
• Re-issue the certificate with a stronger key
• Replace the certificate that uses a broken hash
• Fix the certificate that browsers reject