A partner reports your API fails from their servers with a certificate error. It works in every browser you try and from your laptop. Diagnose and prevent.
Show the full answer Hide the answer
The diagnosis
An incomplete certificate chain. The server presents its own certificate but not the intermediates.
Browsers frequently recover — they cache intermediates from previous sessions and can fetch missing ones via the authority-information-access extension. Most API clients, mobile runtimes and CLI tools do neither. So the client you test with is precisely the one that hides the fault.
Confirm in seconds: openssl s_client -connect host:443 -showcerts and check whether intermediates are
returned. An external SSL checker reports the same thing.
The fix
Configure the server or load balancer with the full chain — leaf plus intermediates, not the root, which the client already trusts and which only wastes handshake bytes.
Most certificate authorities issue a fullchain file for exactly this. Deploying the leaf-only file is
the usual cause.
Prevention, which is the real question
Expiry monitoring with escalating alerts at 30, 14 and 7 days, alerting a team, not the individual who requested the certificate. Expiry is one of the most common self-inflicted outages precisely because ownership evaporates.
Automated issuance and renewal — ACME, or the cloud provider's managed certificates. Manual renewal does not scale and eventually fails on the day the person responsible is on leave.
Synthetic checks from outside your network, using a plain client rather than a browser, so chain problems surface before a partner reports them.
Chain validation in the deployment pipeline so a leaf-only file cannot reach production.
Two adjacent failures worth knowing
Root expiry breaks old clients that stopped receiving trust store updates — no server-side change can fix a client that does not trust the root. This caused widespread breakage in 2021.
mTLS revocation cannot rely on CRL or OCSP in practice; the workable control is short certificate lifetimes with automated rotation, which is what a service mesh or SPIFFE provides.