SSL certificates rarely work in isolation — understanding the chain of trust from your certificate up to a browser-trusted root explains many common "certificate not trusted" errors and how to fix them.
The Three-Tier Trust Model
Root Certificate — the ultimate trust anchor, pre-installed in browsers/operating systems.
Intermediate Certificate — issued by the root CA, used to sign end-entity (your) certificates, acting as a buffer that protects the root's private key from ever needing direct use.
Your (Leaf/End-Entity) Certificate — issued by the intermediate, covering your specific domain.
Why Intermediates Exist
Root certificates are kept extremely secure, used as rarely as possible — intermediates let a CA issue many certificates without exposing the root's private key to routine operational use, and allow revoking a compromised intermediate without invalidating the entire root's trust.
How the Chain Is Verified
A browser validates your certificate by checking it was signed by a trusted intermediate, and that intermediate was in turn signed by a trusted root — if any link in this chain is missing or broken, validation fails, even if your leaf certificate itself is genuinely valid.
Why "Certificate Not Trusted" Sometimes Happens Despite a Valid Certificate
The most common cause: your server isn't sending the intermediate certificate along with your own — some browsers cache intermediates from previous visits to other sites and won't show an error, while others (and most automated tools) will fail validation without it.
Checking If Your Chain Is Complete
echo | openssl s_client -connect yourdomain.com:443 -showcertsShould show multiple certificates in the output — your leaf certificate followed by the intermediate(s). If only one certificate appears, your chain is incomplete.
Fixing an Incomplete Chain (Nginx)
ssl_certificate /etc/ssl/certs/fullchain.pem;Use the "fullchain" file (leaf + intermediates combined), not just the leaf certificate alone — Let's Encrypt's Certbot automatically provides this correctly-combined file by default.
Combining Certificates Manually (If Provided Separately)
cat yourdomain.crt intermediate.crt > fullchain.crtOrder matters: your certificate first, followed by the intermediate(s), in order up toward (but not including) the root.
Should You Include the Root Certificate?
No — the root should never be included in your served chain; browsers already have roots pre-installed and trust them independently. Including it is unnecessary and occasionally causes validation issues with some clients.
Testing with an Online SSL Analyzer
A dedicated SSL testing tool (search for "SSL Labs test" or similar) explicitly reports on chain completeness, flagging exactly this kind of issue clearly if present.
Common Errors
Works in most browsers but fails in specific tools/clients (curl, certain mobile apps) — a classic symptom of an incomplete chain; browsers with cached intermediate certificates mask the problem that stricter clients reveal.
"unable to get local issuer certificate" — the exact error typically produced by a missing intermediate; verify you're serving the fullchain file, not just the leaf certificate.
Continue Reading
- Common SSL Certificate Errors and How to Fix Them
- How to Generate a CSR and Install a Commercial SSL Certificate
- What Is OCSP Stapling and How to Enable It
Browse more articles in SSL/TLS & Certificates.
