A certificate chain consists of a root certificate, intermediate certificates, and an SSL certificate (server certificate). If an intermediate certificate or root certificate is missing, your browser may display a connection failure or other error when you visit the website. Follow the steps in this topic to check whether the certificate chain is complete and resolve an incomplete certificate chain.
Step 1: Check the SSL certificate chain for completeness
Run the following command on the server to check the completeness of the certificate chain. This operation can be performed directly on the server before your website goes live.
<Server_IP>: Replace with the actual IP address of the server.<Domain_Name>: Replace with the actual domain name of the website.
openssl s_client -connect <Server_IP>:443 -servername <Domain_Name>The certificate file format in the command output is typically as follows: the first part is the server certificate, and the second part is the intermediate certificate. If the output contains only the server certificate but is missing the intermediate certificate, the certificate chain is incomplete.
---
Certificate chain
0 s:C = CN, ST = Beijing, O = "xxx Technology Co., Ltd", OU = service operation department, CN = www.xxx
i:C = US, O = DigiCert Inc, CN = DigiCert SHA2 Secure Server CA
1 s:C = US, O = DigiCert Inc, CN = DigiCert SHA2 Secure Server CA
i:C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root CA
---If the server certificate and the intermediate certificate are stored in the same file, make sure that no spaces or line breaks exist between them.
-----BEGIN CERTIFICATE-----
MIIJBzCCB++gAwIBAgIJAJGNv9rVgB8rMA0GCSqGSIb3DQEBCwUAMIGOMQswCQYD
......
6616mkcOi0SU770=
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIEODCCA7igAwIBAgIBBzANBgkqhkiG9w0BAQsFADCBgzELMAkGA1UEBhMCVVMx
......
LXY2JtwE65/3YR8V3Idv7kaWKK2hJn0KCacuBKONvPi8BDAB
-----END CERTIFICATE-----Step 2: Re-download the certificate and configure it
Deploy the certificate to a web server. For more information, see Install a certificate on a server.
Deploy the certificate to an Alibaba Cloud service: Use the deployment feature in the Certificate Management Service console to apply the issued certificate with one click to a specific Alibaba Cloud resource. For details, see Deploy a certificate to an Alibaba Cloud service.