Fix today

Some visitors are seeing a security warning on your site

What it means

A certificate is trusted through a chain. Your site's certificate is signed by an intermediate certificate, and that one is signed by a root certificate built into browsers and phones. Your server has to send both your certificate and the intermediate. If it only sends your own, each device has to fill the gap itself.

Some browsers can fill that gap, because they have seen the intermediate on another site or can download it on their own. Many phones, older devices, apps and other servers cannot. That is why the site can look fine on your computer while some customers see a warning.

EverThread checks your certificate the strict way, like a device that cannot fill the gap. The alert includes the error it got. UNABLE_TO_VERIFY_LEAF_SIGNATURE (often shown elsewhere as "unable to verify the first certificate") means the intermediate is missing. ERR_TLS_CERT_ALTNAME_INVALID means the certificate was issued for a different name, for example example.com but not www.example.com. DEPTH_ZERO_SELF_SIGNED_CERT or SELF_SIGNED_CERT_IN_CHAIN means a certificate no browser trusts. CERT_HAS_EXPIRED means it has simply run out.

Why it matters

Visitors on affected devices see a full-page warning such as "Your connection is not private" or "Warning: Potential Security Risk Ahead", often with a code like NET::ERR_CERT_AUTHORITY_INVALID or SEC_ERROR_UNKNOWN_ISSUER. Most will leave rather than click through.

Because it works on your own device, this can go unnoticed for months. Payment providers, booking tools and other services that connect to your site may also fail quietly, since servers are usually as strict as our check.

How to check your own site

1. Open your site on a few different devices, especially an Android phone and a browser you do not normally use. A warning on one and not another points to a chain problem.
2. Read the error in the EverThread alert and match it to the list above. It tells you which fix below you need.
3. If the error is about the name, open both example.com and www.example.com in a browser. The certificate needs to cover every address people use.
4. Your developer can confirm the chain with the command in the developer section. A healthy result shows Verify return code: 0 (ok).

How to fix it

Any website

1. Send the error from the alert to your hosting company or developer and ask them to "install the full certificate chain, including the intermediate certificate". This is a routine request.
2. If the error is a name mismatch, ask for a certificate that covers every version of your address, usually both with and without www.
3. If you bought the certificate, the download from your seller usually includes a file called something like "CA bundle", "chain" or "intermediate". That file is the missing piece.

WordPress

1. WordPress does not install certificates. Your host does. If your host provides a free certificate, ask them to reissue it, which normally installs the full chain.
2. If you installed a paid certificate yourself through the host's control panel, reinstall it and include the CA bundle file.

Shopify, Squarespace, Wix and other hosted builders

1. These platforms install certificates for you, with the full chain. You cannot change how they are installed.
2. If you see this error, the address EverThread checked may not actually point to the platform. Open your domain settings in the dashboard, look for connection warnings, and make sure both the www and bare versions of your domain are connected.
3. If everything looks right, contact the platform's support and include the error text from the alert.

cPanel hosting

1. The simplest fix is to let AutoSSL replace the certificate. Open "SSL/TLS Status", select the domain and click "Run AutoSSL".
2. For a paid certificate, open "SSL/TLS", then "Manage SSL sites". Select the domain, paste in the certificate and private key, and paste the intermediate into the "Certificate Authority Bundle (CABUNDLE)" box. cPanel can often fill in the bundle for you once the certificate is pasted. Click Install.

Cloudflare

1. With the orange cloud (proxy) on, visitors see Cloudflare's own certificate, which has a complete chain. If you get this alert, the record is probably set to "DNS only" (grey cloud), so visitors see the certificate on your server instead.
2. A common trap is a Cloudflare Origin CA certificate on your server. Cloudflare trusts it, but browsers do not. It works while the proxy is on and breaks as soon as someone switches the record to DNS only. Either turn the proxy back on, or install a publicly trusted certificate on the server.

Apache or Nginx

1. With Let's Encrypt, point your server at fullchain.pem, not cert.pem. fullchain.pem contains your certificate plus the intermediate.
2. For a paid certificate, combine your certificate and the intermediate into one file, with your certificate first, and point the server at that file.
3. For a name mismatch, reissue the certificate with every name listed, for example sudo certbot --nginx -d example.com -d www.example.com.
4. Test the configuration and reload the web server after any change.

# Nginx
ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

# Apache 2.4.8 or later
SSLCertificateFile    /etc/letsencrypt/live/example.com/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem

# Paid certificate: build the chain file yourself
cat example_com.crt intermediate.crt > example_com_fullchain.crt

What to send your developer

The TLS handshake completed, but chain or hostname verification failed. Like most non-browser clients, the checker does not download missing intermediates, so it reports what a strict client sees. Serve the leaf followed by every intermediate up to, but not including, the root. Confirm that every hostname you serve is in the certificate's Subject Alternative Names, that SNI routes each name to the right certificate, and that every TLS terminator (load balancers, CDNs, proxies) uses the same full chain. Verify with the command below.

openssl s_client -connect example.com:443 -servername example.com -showcerts </dev/null

Common questions