SSL Certificate Chain is Incomplete — by maxi322 on Let's Encrypt Community

intermediateforumLink only (©)

SSL Labs flagged an incomplete chain because the server sent only the leaf certificate. The answer is to serve fullchain.pem and enable the chained certificate option (here in OpenLiteSpeed), then restart and retest.

Quick steps

Point the certificate file at fullchain.pem
Enable the chained-certificate option
If still flagged, set the CA path to chain.pem
Gracefully restart and retest

Paraphrased from the source. Menus can differ by version, so check the original for full details.

Read the full thread on community.letsencrypt.org

Source: SSL Certificate Chain is Incomplete by maxi322 on Let's Encrypt Community. Licence: Link only (©).

Source reviewed: 2026-11-02
Link checked: 2026-11-02
Tested hands-on: Not by Oddbyte.Me

chainfullchain.pemssl labs

More in Certificates & HTTPS

Frequently Asked Questions (FAQ) — by Let's Encrypt

beginnerpage

Answers common questions: certificates are free DV only, last 90 days (renew about every 60), the private key stays on your server, wildcards require DNS-01, and requesting a cert can attract crawler traffic because of Certificate Transparency logs.

Certbot User Guide — by EFF Certbot

intermediatepage

The reference for Certbot: certonly vs installer plugins, standalone/webroot/manual/DNS validation, renewal, hooks, revocation and deletion. Read the renew and hooks sections to automate reloading your web server.

Challenge Types — by Let's Encrypt

intermediatepage

Compares HTTP-01 (file on port 80), DNS-01 (TXT record at _acme-challenge) and TLS-ALPN-01. DNS-01 is the one needed for wildcards or servers that are not publicly reachable, but it needs a DNS API and narrowly scoped credentials.