A certificate chain consists of a root certificate, intermediate certificates, and an SSL certificate (server certificate). If an intermediate certificate or root certificate is missing, your browser may display a connection failure or other error when you visit the website. Follow the steps in this topic to check whether the certificate chain is complete and resolve an incomplete certificate chain.
Step 1: Check the SSL certificate chain for completeness
Run the following command on the server to check the completeness of the certificate chain. This operation can be performed directly on the server before your website goes live.
<Server_IP>: Replace with the actual IP address of the server.<Domain_Name>: Replace with the actual domain name of the website.
openssl s_client -connect <Server_IP>:443 -servername <Domain_Name>In the output of openssl s_client -connect <Server_IP>:443 -servername <Domain_Name>, the Certificate chain section lists the levels of the certificate chain. depth indicates the level of a certificate (depth 0 is the server certificate, and depth 1 and higher are intermediate or root certificates). Verify return code indicates the verification result of the certificate chain. Compare the following two sample outputs to determine whether the certificate chain is complete.
Sample output for a complete certificate chain (the certificate chain is complete and the Verify return code is 0):
depth=2 O = GlobalSign, CN = GlobalSign
verify return:1
depth=1 C = BE, O = GlobalSign nv-sa, CN = GlobalSign RSA OV SSL CA 2018
verify return:1
depth=0 C = CN, CN = www.example.com
verify return:1
CONNECTED(00000003)
---
Certificate chain
0 s:C = CN, CN = www.example.com
i:C = BE, CN = GlobalSign RSA OV SSL CA 2018
1 s:C = BE, O = GlobalSign nv-sa, CN = GlobalSign RSA OV SSL CA 2018
i:O = GlobalSign, CN = GlobalSign
---
...
Verify return code: 0 (ok)Sample output for an incomplete certificate chain (the intermediate certificate is missing, only the server certificate is returned, and the Verify return code is 21):
depth=0 C = CN, CN = www.example.com
verify error:num=20:unable to get local issuer certificate
verify return:1
---
Certificate chain
0 s:C = CN, CN = www.example.com
i:C = BE, CN = GlobalSign RSA OV SSL CA 2018
---
...
Verify return code: 21 (unable to verify the first certificate)Comparing the two outputs: for a complete certificate chain, the Certificate chain section contains multiple depth entries (intermediate and root certificates in addition to the server certificate) and the Verify return code is 0. For an incomplete certificate chain, the Certificate chain section contains only depth 0 (the server certificate), a verify error appears (for example, error code 20 or 21), and the Verify return code is not 0. Therefore, if the command output contains only the server certificate (depth 0) but is missing the intermediate certificate (depth 1 or higher), or if the Verify return code is not 0, the certificate chain is incomplete.
---
Certificate chain
0 s:C = CN, ST = Beijing, O = "xxx Technology Co., Ltd", OU = service operation department, CN = www.xxx
i:C = US, O = DigiCert Inc, CN = DigiCert SHA2 Secure Server CA
1 s:C = US, O = DigiCert Inc, CN = DigiCert SHA2 Secure Server CA
i:C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root CA
---If the server certificate and the intermediate certificate are stored in the same file, make sure that no spaces or line breaks exist between them.
-----BEGIN CERTIFICATE-----
MIIJBzCCB++gAwIBAgIJAJGNv9rVgB8rMA0GCSqGSIb3DQEBCwUAMIGOMQswCQYD
......
6616mkcOi0SU770=
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIEODCCA7igAwIBAgIBBzANBgkqhkiG9w0BAQsFADCBgzELMAkGA1UEBhMCVVMx
......
LXY2JtwE65/3YR8V3Idv7kaWKK2hJn0KCacuBKONvPi8BDAB
-----END CERTIFICATE-----Step 2: Re-download the certificate and configure it
Deploy the certificate to a web server. For more information, see Install a certificate on a server.
Deploy the certificate to an Alibaba Cloud service: Use the deployment feature in the Certificate Management Service console to apply the issued certificate with one click to a specific Alibaba Cloud resource. For details, see Deploy a certificate to an Alibaba Cloud service.