Questions: TLS Works From Some Clients But Fails From Others¶
- What does
openssl s_client -connect host:443show for the certificate chain? - How many certificates are sent by the server in the TLS handshake?
- Is the intermediate certificate included in the server's certificate bundle?
- Which CA issued the server certificate, and what intermediate(s) are required?
- Do browsers that work have the intermediate certificate cached from previous visits?
- What is the certificate configuration on the web server or load balancer?
- Was the certificate bundle updated when the certificate was renewed?
- Does the server send only the leaf certificate, or the full chain minus the root?
- What does an SSL Labs test report for chain completeness?
- Are there different results from clients with empty vs. populated CA stores?