Certificate chain check
Verifies your TLS cert is served with the full intermediate chain — the #1 cause of "insecure connection" errors on Android and older curl.
Quick answer#
Lemwatch walks the certificate chain your server sends. Missing intermediates fail the check even if the browser you tested in worked.
What it checks#
Where to find it in Lemwatch#
Site details → Security → SSL → Chain.
How to fix#
cat cert.pem intermediate.pem > fullchain.pem).openssl s_client -connect yourdomain.com:443 -showcerts.FAQ#
Why did it work in Chrome but fail on Android?#
Chrome caches missing intermediates from prior visits. Android and curl don't.
Does Let's Encrypt bundle correctly?#
Yes if you use fullchain.pem, not cert.pem alone.
Related#
Related Articles
SSL Certificate Monitoring
Track SSL certificate validity, expiry dates, and chain issues. Get warned 30, 14, and 7 days before certificates expire.
TLS version & cipher check
Confirms your server supports TLS 1.2/1.3, rejects TLS 1.0/1.1, and uses forward-secret cipher suites.
Why did my SSL grade drop?
SSL grade drops when a cipher, protocol, or certificate chain changes — here is how to identify the exact cause and fix it.
Robots.txt check
Fetches robots.txt hourly and alerts on syntax errors, disallowed indexable paths, or blocked search-engine bots.