← Help  /  Something not working?

Fix "unable to get local issuer certificate" and incomplete chain errors

You may see messages such as unable to get local issuer certificate, unable to verify the first certificate, certificate not trusted or incomplete certificate chain. They all mean the same thing: your server is sending your certificate on its own, without the intermediate certificate that links it to the authority.

Why it looks fine in some places and not others

Desktop browsers often fill the gap themselves by remembering or fetching the missing certificate, so the padlock looks fine. Phones, older systems, command-line tools, email programs, payment gateways and other servers calling your site usually do not, and they refuse the connection. So the site seems to work for you but not for everyone.

Check it

Enter your website in our certificate checker. If it reports that the chain is incomplete or that no intermediate certificate is being sent, this is your problem.

Fix it

1. Get your certificate and the CA bundle (also called the chain or intermediates) from your account. If you only have the certificate, paste it into our chain builder and it will find the intermediates and make a complete file for you.
2. Install them so the server sends your certificate followed by the bundle:
   • Apache 2.4.8 and newer, and nginx: join them into one file, your certificate first (cat example.crt bundle.crt > fullchain.crt), and use that file as the certificate file.
   • Older Apache: put the bundle in SSLCertificateChainFile.
   • cPanel and Plesk: paste the bundle into the CA bundle box.
   • IIS: install the bundle into the Intermediate Certification Authorities store.
   See the Apache, nginx, cPanel, Plesk and IIS guides.
3. Reload or restart the web server, then run the checker again.

Order matters. Your certificate first, then the intermediate. Do not include your private key in this file.

More in this section

• My CSR was rejected: what the messages mean
• Fix "certificate name does not match" (ERR_CERT_COMMON_NAME_INVALID)
• Fix "key values mismatch": private key does not match the certificate
• I installed the new certificate but the site still shows the old one
• Domain validation is not completing: what to check

Browse certificates →   Free SSL tools →