Debian 11: Nginx serves incomplete TLS certificate chain

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Clients fail TLS validation because nginx serves only leaf certificate without intermediate chain.

Environment & Reproduction

Some browsers connect while strict clients fail with unknown issuer or chain errors.

Root Cause Analysis

Check endpoint with `openssl s_client -connect host:443 -servername host -showcerts` and review nginx ssl directives.

Quick Triage

Server references cert file instead of fullchain file, or deploy process omits intermediates.

Step-by-Step Diagnosis

Configure nginx to use fullchain certificate bundle and correct key pair, then reload service.

Solution – Primary Fix

Retest with OpenSSL and external TLS checkers to confirm complete trust path.

Solution – Alternative Approaches

Enforce certificate deployment checks that validate chain completeness before reload.

Verification & Acceptance Criteria

Restore prior working certificate files and nginx TLS config from backup.

Rollback Plan

Add TLS chain verification to CI and post-deploy smoke tests.

Prevention & Hardening

`openssl s_client -connect host:443 -servername host -showcerts`; `sudo nginx -t`; `sudo systemctl reload nginx`

Related Errors & Cross-Refs

Attach certificate metadata, renewal logs, and nginx site config for PKI troubleshooting.

Related tutorial: View the step-by-step tutorial for debian-11.

View all debian-11 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Mixed legacy clients may require explicit chain compatibility validation during certificate rotation.