Skip to content

Questions: TLS Works From Some Clients But Fails From Others

  • What does openssl s_client -connect host:443 show for the certificate chain?
  • How many certificates are sent by the server in the TLS handshake?
  • Is the intermediate certificate included in the server's certificate bundle?
  • Which CA issued the server certificate, and what intermediate(s) are required?
  • Do browsers that work have the intermediate certificate cached from previous visits?
  • What is the certificate configuration on the web server or load balancer?
  • Was the certificate bundle updated when the certificate was renewed?
  • Does the server send only the leaf certificate, or the full chain minus the root?
  • What does an SSL Labs test report for chain completeness?
  • Are there different results from clients with empty vs. populated CA stores?