---
title: "Certificate chain check — Lemwatch Help"
description: "Verifies your TLS cert is served with the full intermediate chain — the #1 cause of \"insecure connection\" errors on Android and older curl."
canonical: "https://lemwatch.com/help/certificate-chain-check"
source: "https://lemwatch.com"
---

# Certificate chain check

> Verifies your TLS cert is served with the full intermediate chain — the #1 cause of "insecure connection" errors on Android and older curl.

## Quick answer

 Lemwatch walks the certificate chain your server sends. Missing intermediates fail the check even if the browser you tested in worked.

## What it checks

- Full chain served (leaf + intermediates)

- Chain reaches a trusted root

- No expired intermediates

- OCSP stapling present (bonus)

## Where to find it in Lemwatch

 **Site details → Security → SSL → Chain.**

## How to fix

- Rebundle your cert with the CA's intermediate file ( cat cert.pem intermediate.pem > fullchain.pem ).

- Restart the web server.

- Verify with openssl s_client -connect yourdomain.com:443 -showcerts .

- Enable OCSP stapling.

## FAQ

### Why did it work in Chrome but fail on Android?

 Chrome caches missing intermediates from prior visits. Android and curl don't.

### Does Let's Encrypt bundle correctly?

 Yes if you use fullchain.pem , not cert.pem alone.

## Related

- SSL monitoring

- TLS version check

- Why did my SSL grade drop


## Related

- [Help centre](https://lemwatch.com/help)
- [SSL Certificate Monitoring](https://lemwatch.com/help/ssl-monitoring)
- [TLS version & cipher check](https://lemwatch.com/help/tls-version-check)
- [Why did my SSL grade drop?](https://lemwatch.com/help/why-ssl-grade-dropped)
- [HTTP/2 & HTTP/3 support check](https://lemwatch.com/help/http2-http3-support-check)
- [Gzip / Brotli compression check](https://lemwatch.com/help/gzip-brotli-compression-check)
- [Lemwatch pricing](https://lemwatch.com/pricing)
- [Certificate Transparency Monitoring](https://lemwatch.com/help/certificate-transparency)