A certificate chain links your site's certificate to a root certificate that browsers trust, through one or more intermediate certificates. If the server does not send the intermediates, desktop browsers often fill the gap themselves, but many phones, apps, payment gateways and API clients fail with "unable to verify the first certificate" or "unknown issuer". The fix is to install the CA bundle.
Before you start
- Confirm the problem with an external checker such as SSL Labs. Look for "Chain issues: Incomplete" or "Extra download".
- Find the intermediate certificates from your certificate authority. They are usually in the ZIP you downloaded, named
ca-bundle,intermediate.crtorchain.pem, or on the CA's support site.
Understand the chain
| Level | Example | Install on server? |
|---|---|---|
| Leaf (your certificate) | Issued to example.com | Yes |
| Intermediate(s) | Issued by the root to the CA's issuing authority | Yes, as the CA bundle |
| Root | Built into browsers and operating systems | No |
Order matters: the bundle should list the intermediate that signed your certificate first, followed by any higher intermediates. Do not include your own certificate or the root in the bundle.
Install in cPanel
- Open cPanel → Security → SSL/TLS → Manage SSL sites.
- Select the domain and click Autofill by Domain. cPanel loads the current certificate and key and often fetches the CA bundle automatically.
- If Certificate Authority Bundle (CABUNDLE) is empty or wrong, paste the intermediates there, each with its BEGIN and END lines.
- Click Install Certificate.
Install in WHM
Open WHM → SSL/TLS → Install an SSL Certificate on a Domain, paste the certificate, click Autofill by Certificate, fill in the CA bundle if needed and click Install.
Install in Plesk
Open the domain's SSL/TLS Certificates, open the certificate and upload the bundle in the CA certificate field, then click Upload Certificate.
Install in DirectAdmin
In SSL Certificates for the domain, click Click Here to paste a CA Root Certificate, tick Use a CA Cert, paste the intermediates and save.
Verify the fix
- Run the external checker again; chain issues should show None.
- From a terminal, count the certificates sent:
openssl s_client -connect example.com:443 -servername example.com -showcerts </dev/null. You should see your certificate plus the intermediate(s). - Test on a phone using mobile data.
Where to find the right intermediate
- The certificate's Authority Information Access extension contains a URL to download the issuing certificate.
- Your CA's documentation lists current intermediates by product name.
- Do not reuse a bundle from an older certificate; CAs change intermediates over time.
Troubleshooting
- "Certificate does not match" when pasting the bundle: you pasted it into the certificate field. Put only the leaf certificate there.
- Chain still incomplete: the wrong intermediate or wrong order; download the current bundle for your exact product.
- AutoSSL certificates: these always include the correct chain. If an AutoSSL domain shows chain issues, a CDN or proxy in front is presenting a different certificate.