Certificate chain and intermediates

A certificate chain is your site certificate plus the intermediate certificates that connect it to a root the browser already trusts. When the server sends only the leaf certificate, some devices still work because they cached the intermediate earlier, while a fresh phone or mail client fails. On cPanel, AutoSSL and Let’s Encrypt install the full chain for you. If you installed a paid certificate by hand and it only works on your laptop, the missing piece is almost always the chain.

What the client needs during the handshake

The client starts with a set of trusted roots in its own store. It cannot build a path from your leaf certificate to one of those roots unless your server also sends the intermediates in between. Desktop browsers often remember an intermediate from another site, so the padlock still appears. A new Android profile, a Java client, or Outlook may not have that cache, and the connection fails. Tickets that say “only phones” or “only Outlook” usually point to the same missing intermediate file.

AutoSSL places the CA bundle with the leaf certificate automatically. A PFX file imported without the bundle does not. A paste labeled “the certificate” in a vendor email is often the leaf alone. Ask the vendor for the full chain or CA bundle, then install both under SSL/TLS in cPanel.

How to check the chain on the server

You can confirm what the server actually presents with a quick OpenSSL check. Look for depth values and the subject lines that follow them.

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | grep -E ‘depth|s:’

You want a depth greater than zero: the leaf, then at least one intermediate, then a root the client already holds. A single depth=0 line with no issuer above it means the intermediates are missing. SSL Labs will also flag chain issues in plain language after you install. Use that report as a check, not as the only guide.

When the chain is already correct

If AutoSSL issued the certificate, the chain is almost always complete. In that case, look next at name mismatch or expiry rather than intermediates. When you pasted a paid certificate yourself, the chain is the first thing to verify. OCSP stapling only works on top of a correct chain; it cannot invent an intermediate you never installed. After you add the bundle, retest from a device that failed before so you know the fix reached real clients.