SSL Chain Fixer
Find a missing intermediate certificate and get a corrected fullchain.pem for your server.
About the SSL Chain Fixer
SSL Chain Fixer finds a missing intermediate certificate and gives you the corrected chain to install. A server should send its own certificate plus every intermediate that links it to a trusted root. When it sends only its own, browsers usually still work because they fetch the missing issuer themselves, but curl, Java, Python, and many mobile apps fail with errors such as "unable to get local issuer certificate".
The tool connects to your host, reads the certificates it actually sends, and checks whether the chain reaches a root in the public trust store. If it does not, it follows the CA Issuers address inside the certificate, downloads the issuer, confirms that it really signed your certificate, and repeats until the chain is complete. The result is a fullchain.pem with your certificate first and the intermediates after it, with the root left out as is standard.
Install that file as your server's certificate chain, then reload the web server. To inspect the certificate itself, use the SSL Checker; to read a pasted certificate, use the SSL Decoder.
Reach the developers and engineers who use these tools every day.
Frequently asked questions
Why does my site work in a browser but fail in curl or an app?
Browsers cache intermediates and fetch missing ones from the certificate. Most other clients do not, so they only trust what the server sends. Sending the full chain fixes both.
Should the root certificate be in fullchain.pem?
No. Clients already hold the roots they trust, so the file should contain your certificate followed by the intermediates. Sending the root only wastes bytes.
What if the tool says it cannot fix the chain?
Some certificates do not publish a CA Issuers address. In that case download the intermediate bundle from your certificate authority and append it to your certificate. The message names the certificate that needs an issuer.
Is it safe to download the certificate from the address in the certificate?
The address is treated as untrusted. Only public hosts are contacted, the download is size and time limited, and the downloaded certificate is used only if it cryptographically signed the certificate it is meant to complete.
Is the hostname stored?
No. The check runs on our server and the result is returned to you without being logged or persisted.