TLS certificate chain is incomplete (leaf only, no intermediate)

A TLS (Transport Layer Security) certificate chain is the set of certificates a server presents to prove it's trustworthy, normally including both the site's own certificate and an intermediate certificate from the certificate authority that vouches for it. This check looks at what the server actually sends. On this site, only the site's own leaf certificate was presented, with no intermediate certificate included. Modern desktop browsers often paper over this automatically by fetching the missing intermediate certificate themselves, so the problem can stay invisible for a long time. But many other clients, older Android devices, some mobile apps, embedded or IoT devices, and strict TLS libraries, don't do this and will simply fail to connect securely. It's also flagged as a headline 'Chain issues: Incomplete' warning by SSL Labs, a widely used security testing tool. Your developer should reinstall the certificate using the full chain, meaning the leaf certificate bundled together with the intermediate certificate. Most certificate authorities provide a ready-made 'fullchain' file for exactly this. On an Nginx server this means pointing ssl_certificate at the fullchain.pem file. Verify the fix using the command 'openssl s_client -connect host:443 -showcerts' or by re-running an SSL Labs test. About 30 minutes.