Missing intermediate
Complete the CA chain behind unable to get local issuer certificate or unable to verify the first certificate errors. Verify other trust causes if the error persists.
AIA issuer discovery · PEM chain export
Complete Your SSL Certificate Chain.
Find missing intermediate certificates and generate fullchain.pem online. Build an ordered SSL certificate chain or CA bundle for Nginx, Apache, and cloud certificate uploads.
Build your SSL certificate chain
Submit your public SSL certificate for server-side chain completion. Existing intermediate and root certificates in the same file are reused, and missing issuers are downloaded automatically. Do not submit a private key.
Put the server certificate first. Existing intermediates and roots may follow in any order. Accepts PEM or a single DER certificate, up to 1 MB.
Your completed certificate chain will appear here
Download fullchain.pem for deployment or a separate CA bundle.
INCOMPLETE CERTIFICATE CHAIN
Fix missing intermediate certificates.
An SSL certificate needs an issuer path to a root trusted by the client. Serving only cert.pem can leave that path incomplete. A browser with cached intermediates may work while a new device or command-line client reports a verification error.
Deployment bundle
Generate fullchain.pem with the leaf first, then intermediates. Export a separate CA bundle for platforms with dedicated certificate-chain fields.
Verified issuer links
Issuer names and cryptographic signatures are checked before a downloaded certificate is added. Unrelated certificates cannot complete the chain.
BUILD FULLCHAIN.PEM
How to complete a certificate chain.
No private key or domain connection is required. This tool works with certificate files rather than scanning a live server.
- 01
Add your server certificate
Paste PEM or upload a .pem, .crt, .cer, or .der certificate. If you already have a partial chain, keep the leaf certificate first.
- 02
Verify and complete the chain
Complete Cloudflare verification, then submit the certificate. The server reuses existing intermediates and roots before automatically downloading missing issuers.
- 03
Download and deploy fullchain.pem
The default deployment file contains the server certificate followed by its intermediates. Keep your existing private key separate and verify the live server after reloading.
CHAIN RESULTS
Understand the completion result.
Chain built
Each issuer link verifies and the chain reaches a self-signed root. Download the deployment bundle and check that your target clients trust that root.
Issuer unavailable
AIA is absent, blocked, or does not return a matching issuer. Supply the intermediate and root certificates from the CA, then retry.
Validity warning
An expired or not-yet-valid certificate remains unusable even with a complete chain. Renew it or resolve the validity issue before deployment.
Build and check a chain with OpenSSL.
Obtain intermediate certificates from your CA and arrange them in issuer order. Configure Nginx ssl_certificate or Apache 2.4.8+ SSLCertificateFile with fullchain.pem. Keep the private key in its separate configuration field.
After reloading the server, check the certificate chain actually served for the domain. A local bundle alone does not prove the active TLS configuration uses it.
# Inspect issuer and AIA details
openssl x509 -in cert.pem -noout -text
# Leaf first, then ordered intermediates
cat cert.pem intermediates.pem > fullchain.pem
# Verify with a root you independently trust
openssl verify -CAfile trusted-root.pem \
-untrusted intermediates.pem cert.pem
# Inspect the live server using SNI
openssl s_client -connect example.com:443 \
-servername example.com -showcerts \
-verify_return_error </dev/nullSupported formats and download limits.
Paste complete PEM CERTIFICATE blocks or upload a PEM bundle or single DER X.509 certificate. AIA downloads support PEM and DER responses. Convert P7B, PFX, or P12 files with the certificate converter first. Inputs are limited to 1 MB; automatic requests have a timeout and chain depth limit.
Completion follows one issuer path from the first certificate and does not choose an alternate path for legacy clients. Validation, issuer downloads, and signature checks run on the server after Cloudflare verification. Include any existing intermediate and root certificates after the server certificate in the same input.
Related SSL tools.
Certificate chain completion FAQ.
How do I complete an SSL certificate chain?
Paste the server certificate first, followed by any existing intermediates. After Cloudflare verification, AutoSSL reuses certificates already in the input and downloads missing issuers from Authority Information Access (AIA) URLs. Each issuer must match the certificate's issuer name and verify its signature. Download fullchain.pem after the chain reaches a self-signed root.
What is the difference between cert.pem, chain.pem, and fullchain.pem?
cert.pem normally contains only the server certificate. chain.pem or a CA bundle normally contains intermediate CA certificates. fullchain.pem combines the server certificate first and its intermediates in issuer order. The deployment output here omits the self-signed root; a separate download includes it.
Why is my certificate chain incomplete?
A server may be configured with only the leaf certificate or an outdated CA bundle. Some clients have cached intermediates and appear to work, while fresh clients fail. Missing issuers can cause unable to get local issuer certificate, unable to verify the first certificate, or curl error 60. These errors can also have other trust or validity causes.
Why did the automatic intermediate certificate download fail?
The certificate may have no AIA issuer URL, or the CA endpoint may be unavailable. Automatic downloads use a same-origin service for supported public CA repositories to avoid browser CORS and HTTP restrictions. If a repository is unsupported or AIA is absent, obtain the missing certificates from your CA and append them after the server certificate in the same input, then retry. PKCS#7 AIA responses must first be converted to PEM with the certificate converter.
Does this tool upload my certificate or need a private key?
Yes. Your public certificate or existing chain is sent to AutoSSL after Cloudflare verification. The server validates the certificates, downloads missing issuers automatically, and returns the complete chain including its root. Private keys, CSRs, and other non-certificate PEM blocks are rejected. Downloads are assembled in your browser.
Does a completed chain mean the certificate is trusted?
No. Reaching a self-signed root proves a connected signature chain, not that a browser or operating system trusts the root. This tool does not check revocation, hostname validity, CA path constraints, or every certificate policy. Expired certificates still require renewal, and private CA roots require installation in the client's trust store.
Should I include the root certificate on my server?
TLS servers normally send the server certificate and intermediate certificates. Clients already hold their trusted roots. Use fullchain.pem for typical Nginx and Apache deployments; download the chain with root only when your platform specifically requests it. This tool requires the root to verify the final issuer relationship before producing either output.