Free tool

Certificate chain checker.

An incomplete chain works in your browser and fails everywhere else. This shows what your server actually sends.

Reads the live handshake. Nothing is stored.

The fault browsers hide from you

A certificate is only trusted if there is an unbroken path from it to a root the client already trusts. Your server is supposed to send the intermediates that make up that path.

When it does not, browsers usually paper over it. They have cached intermediates from other sites they have visited, so they fill the gap themselves and the site loads perfectly.

Nothing else does. API clients fail. Fresh devices fail. Payment integrations fail. Anything without that cache refuses the connection, and it is close to impossible to reproduce from the machine you built the site on, because your browser has the missing piece.

How to fix it

Almost always you are serving the wrong file. Your certificate authority gives you both a certificate and a bundle, and the server needs the full chain rather than the certificate alone. In nginx that is ssl_certificate fullchain.pem, not cert.pem.

More in the fix guide.

See also

Check everything at once.

One check covering registration, certificates, mail, subdomains and hosting.