My certificate chain is incomplete.

What is actually wrong

A certificate is trusted through a chain: your certificate, signed by an intermediate, signed by a root your visitor's device already trusts. Your server is supposed to send the intermediate along with your own certificate. When it sends only its own, the visitor has to find the intermediate themselves.

Browsers on desktop often manage it, because they have seen that intermediate before and cached it. Fresh devices, some mobile browsers, and almost every API client and payment integration do not. Those get a trust failure.

How you will notice without checking

• Some visitors report a security warning and you cannot reproduce it
• Payment or webhook integrations fail against your site while browsers work
• It works on your machine, in your office, on your phone, every time

How to fix it

• Get the full chain file from your certificate authority, usually offered as fullchain.pem or a bundle.
• Install that instead of the certificate alone. On nginx this is ssl_certificate pointing at the full chain, not the leaf. On Apache it is SSLCertificateChainFile or a combined file.
• If a CDN or load balancer terminates TLS, the chain has to be complete there rather than on the origin.
• Test from a device that has never visited the site, or from a checker that does not cache intermediates.

Why this is worth watching rather than fixing once

It comes back. Every manual certificate installation is an opportunity to install the leaf alone, and the person doing it will test in their own browser and see it working.

The whole subject in five chapters: the certificate chains field guide.