Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
How do I tell if the certificate chain is incomplete?
Short answer
In TR7, the Chain tab in the preview of the certificate shows whether the chain is complete and which CA the missing link is: Trust chain is complete or Missing intermediate certificate — required issuer. From outside, openssl s_client -showcerts is used to check how many certificates the server sends; if only a single certificate is returned and Verify return code: 21 appears, the chain is incomplete. For sites open to the internet, the Chain Issues row of SSL Labs gives the same information. The typical symptom is that a site that opens in a desktop browser gives an error in a mobile application or in curl.
Problem: The Site Appears Untrusted on Some Clients
A missing chain is overlooked because it causes the problem to appear only on some clients: desktop browsers can complete the intermediate certificate from their cache or from the issuer address in the certificate (AIA); mobile applications, Java and command-line clients, however, do not complete it. Whether the chain is actually incomplete is determined by looking at the certificates that the server sends.
Solution: Three Methods
The methods answer the same question from different places; Method 1 shows the record in TR7, and Methods 2 and 3 show what the client receives.
| Your situation | Suitable method |
|---|---|
| Checking the certificate record in TR7 | Method 1: Chain tab |
| Seeing what the server actually sends in the handshake | Method 2: openssl s_client |
| A comprehensive report for a site open to the internet | Method 3: SSL Labs |
Method 1: Chain Tab Recommended
- How it works TR7 takes the certificate and the intermediate and root certificates to be used in the configuration, and builds the chain by verifying that each link really signs the next one; it shows the CA required by the missing link by name.
- Where it is openedCertificates & PKI → SSL/TLS Certificates → certificate row → preview → Chain
- Requirement A record that has certificate content
- Scope All certificate types
Step-by-Step Configuration
1
Adım 1 Open the certificate list
The Certificates & PKI → SSL/TLS Certificates screen is opened.
2
Adım 2 Open the preview
The certificate row is clicked; in the preview that opens on the right, the Chain tab is selected.
3
Adım 3 Read the result
The green Trust chain is complete shows that the chain has been verified up to the root CA. The orange Missing intermediate certificate — required issuer writes the issuer required by the missing link by name; if the named issuer is a root CA, only the root certificate is missing from the record, and since clients take the root from their own trust store, it does not need to be presented. The Expired and Signature Invalid badges on the links and the extra certificates under the Provided but not part of the chain heading are also checked.
Verification
1ChainTR7 side
The status at the top of the Chain tab and the link cards (Root CA, Intermediate CA, Certificate) are read.
Expected
Trust chain is completeThe missing link is completed with Suggest Completion in the Chain tab or by adding the intermediate certificate.
Method 2: openssl s_client
- How it works All the certificates that the vService sends in the TLS handshake are listed in order and verified against the trust store of the client.
- Where it is opened Command line on the client computer
- Requirement
openssl; access to the vService address - vService type HTTP, L7 TCP (encrypted frontend)
Step-by-Step Configuration
1
Adım 1 Request the chain
The domain name of the site is given with -servername; if it is not given, the first certificate of the vService in the list is returned, and if the vService uses Virtual Hosting, the connection is closed:
text
openssl s_client -connect 203.0.113.10:443 -servername www.example.com -showcerts </dev/null2
Adım 2 Read the output
The -----BEGIN CERTIFICATE----- blocks in the Certificate chain section are counted, and the Verify return code at the bottom is read. If there is only one block and Verify return code: 21 (unable to verify the first certificate) is written, the intermediate certificate is not being sent.
Verification
1ChainClient side
After the chain is completed, the command is run again.
Expected
Certificate + intermediate certificate(s) · Verify return code: 0 (ok)Method 3: SSL Labs
- How it works The SSL Labs server test connects to the site from the internet and evaluates the chain in detail.
- Where it is openedssllabs.com/ssltest
- Requirement The site being reachable from the internet on port 443
- vService type HTTP
Step-by-Step Configuration
1
Adım 1 Start the test
The domain name is entered in the SSL Labs server test and the test is started.
2
Adım 2 Read the Chain Issues row
The Certification Paths section and the Chain Issues row in the report are read; Incomplete or Extra Download shows that the chain is incomplete.
Verification
1ResultSSL Labs
After the chain is completed, the test is run again by clearing the test cache (Clear cache).
Expected
Chain issues: NoneCommon Mistakes
- Assuming the chain is complete because the site opens in a desktop browser. Browsers can complete the missing link themselves; mobile applications and command-line clients do not.
- Testing without
-servername. If SNI is not given, the first certificate of the vService is returned and the chain of the wrong certificate is examined; with Virtual Hosting, the connection is closed. - Finding the gap and leaving it there. The chain is completed with Suggest Completion in the Chain tab or by adding the intermediate certificate (How do I add the intermediate certificate chain?).
- Mistaking the root CA warning for a missing intermediate certificate. If the missing issuer in the Chain tab is a root CA, no problem occurs on the client side;
Verify return code: 0appears in theopenssl s_clientoutput.
How it is done in the documentation
