Certificate chain check

Verifies your TLS cert is served with the full intermediate chain — the #1 cause of "insecure connection" errors on Android and older curl.

Quick answer

Lemwatch walks the certificate chain your server sends. Missing intermediates fail the check even if the browser you tested in worked.

What it checks

Where to find it in Lemwatch

Site details → Security → SSL → Chain.

How to fix

  1. Rebundle your cert with the CA's intermediate file (cat cert.pem intermediate.pem > fullchain.pem).
  2. Restart the web server.
  3. Verify with openssl s_client -connect yourdomain.com:443 -showcerts.
  4. Enable OCSP stapling.

FAQ

Why did it work in Chrome but fail on Android?

Chrome caches missing intermediates from prior visits. Android and curl don't.

Does Let's Encrypt bundle correctly?

Yes if you use fullchain.pem, not cert.pem alone.

Related