Incomplete chain / missing intermediate

What's going on

Certificates are trusted through a chain: your certificate → an intermediate CA → a root the client already has. This bundle stops partway, so many clients (especially non-browser ones: curl, Java, mobile apps) can't verify it. Browsers sometimes paper over it, which is why 'it works in Chrome but not in the app'.

How to fix it

Serve the full chain: your certificate followed by the intermediate certificate(s), in order. Your CA provides the intermediates (often as 'fullchain' or 'CA bundle'). With Let's Encrypt, use fullchain.pem — not cert.pem — in the server config.

New to certificates? Start with the guide: How to read an SSL certificate.