CERTIFICATE CHAINS

The Field Guide

5 chapters · last updated 21 September 2026 · free to read

An incomplete certificate chain works perfectly in your browser and fails for other people, which makes it the hardest certificate problem to notice and one of the easiest to fix.

This is the short version: what a chain is, why yours looks fine, and how to install one properly.

Chapter 1 of 5

What a chain is

Leaf, intermediate, root, and who holds which.

What a chain is

This chapter is not written yet. Drop the prose into guide-bodies/<body>.html and rebuild.

Chapter 2 of 5

Why yours looks fine

Cached intermediates, and the person least able to notice.

Why yours looks fine

This chapter is not written yet. Drop the prose into guide-bodies/<body>.html and rebuild.

Chapter 3 of 5

Who actually fails

Fresh devices, API clients, payment integrations.

Who actually fails

This chapter is not written yet. Drop the prose into guide-bodies/<body>.html and rebuild.

Chapter 4 of 5

Installing it properly

Full chain files, and where the configuration differs.

Installing it properly

This chapter is not written yet. Drop the prose into guide-bodies/<body>.html and rebuild.

Chapter 5 of 5

Testing from outside

From a machine that has never visited your site.

Testing from outside

This chapter is not written yet. Drop the prose into guide-bodies/<body>.html and rebuild.

Check yours

See where your own domain stands.

Everything above, checked on your domain in about ten seconds. Free, no account.