Lesson 1.29: Serving the full chain
A server must send its own certificate and every intermediate up to (but not including) the root. Browsers often hide a missing intermediate because they cached it or fetch it themselves; command-line tools, Java services, mobile apps and IoT devices don't, and fail with 'unable to get local issuer certificate'. It's one of the most common TLS outages. In the lab you reproduce the error against Northwind's API, prove which certificate is missing with openssl verify, build the full chain in the right order, reload nginx and confirm a clean handshake.
15 min
You will learn to
- Explain certificate chains and trust anchors
- Read s_client chain and verify output
- Diagnose a missing intermediate
- Build a full-chain file in the right order
- Apply and verify the fix
Key terms
- Certificate chain
- Leaf, intermediates and root, each signed by the next.
- Trust anchor / trust store
- Root certificates a client trusts in advance / the place it keeps them.
- Intermediate certificate
- A CA certificate between root and leaf; servers must send it.
- Full chain (fullchain.pem)
- Leaf followed by its intermediates in one file.
- AIA fetching
- Some browsers download a missing intermediate from the URL in the certificate, hiding the error.
← Classical ciphers and Kerckhoffs's principle · All lessons · Does it affect us? Inventory, versions and backports →