Nginx SSL Certificate Incomplete Chain Issues Fix

For the basic SSL/TLS Certificate, New Users Might Get Confused and Face Error. The commonest error which is faced by SSL Labs Test is Chain issues – Incomplete error. Usually it results in ” Grade capped to B.” Here is Nginx SSL Certificate Incomplete Chain Issues Fix Guide. GeoTrust and Thawte actually sends all the needed stuffs. Usually for Quick SSL Certificates, the server certificate is send via email, you need to download the bundle certificate. It can happen to any SSL/TLS Certificate due to wrong method used in implementation.

Nginx SSL Certificate Incomplete Chain Issues Fix

We have many SSL/TLS Certificate installation guides, if you followed our’s guide, it would difficult to take place ever. The trusted root certificate should not be there, as it is already included in the system™s root certificate store. You do not need to think about it.

First you have the domain’s certificate usually send via email which looks like this :

Copy paste that to any text editor.

Second one is the Intermediate CA certificate, this might not be via email and you will get in the SSL certificate’s website. There are two Intermediate CA certificates. They are named like RSAAddTrustCA.crt, DomainValidationSecureServerCA.crt, RapidSSL also gives the two things togather – that is bundle. These also look like this :

Practical thing is that, all three should be pasted in that plain text file in this way :

These are expired examples, do not paste your domain’s cert on Question-Answer forums. Second two or made to one are publicly available, but the first one is kind of Love Letter – secret. For Nginx saving it with nginx.crt makes one certificate. Another is your key which is not relevant here.

If you SSH to your server and create a new file named foo.csr via nano text editor and paste the above thing, it will work fine after the adjust of the path to these on either nginx.conf file or /etc/nginx/sites-available/default file. If your certificates are located at foo named directory which at /path/to/, then in nginx things should look like this :

Instead of that copy paste, people add in this way :

This process of making together is called concatenation. On OS X or GNU/Linux desktop, if you copy paste on GUI, it will work fine. People says to use the cat as who will copy and paste on Microsoft Word, difficult to predict.

Alternative way to Fix Incomplete Chain Issues

There is command line tool :

It is very easy to use, you need not manually hunt your all the intermediate CA certificates and copy paste them. If you only have the server’s certificate, it will work fine. It can be difficult to use by a new user but basically it is most easy.

Contains anchor error means you have added the root certificate too. That was wrong. When you will get error; create a named directory and freshly create the file like written above.