> ## Content Index > Fetch the complete content index at: https://debugly.dev/llms.txt > Use this file to discover other available public pages before exploring further. # The Missing Intermediate Certificate That Broke Android - URL: https://debugly.dev/missing-intermediate-certificate/ - Published: 2026-10-09T17:49:00.000Z - Updated: 2026-10-17T05:55:33.000Z - Description: The browser was happy and the phone was not, because the desktop had cached the intermediate and the mobile client had to build the chain from exactly what… - Author: Rohit Bhadani - Tags: Deep Dive, TLS, Networking I have chased this from the lie end and from the broken end, and the truth was in the hand-off, as it usually is. Strip the incomplete certificate chain down and one property makes it device-dependent: some clients cache or fetch the missing intermediate, so the failure appears on the strict clients and not on the forgiving ones, and the forgiving ones are the desktop browser you tested with. This was an nginx server with a new certificate, and the mechanics are the same for any TLS server that must present a chain. ## What the chain actually is The certificate is the leaf, and the leaf is the domain's, and the domain's is the signed by the intermediate, and the intermediate is the signed by the root, and the root is the trust store's, and the trust store is the client's, and the client's is the preinstalled roots, and the preinstalled is the not the intermediates, and the not intermediates is the server's job. The server's job is the chain's presentation, and the presentation is the leaf plus the intermediates, and the intermediates are the bridge, and the bridge is the root's reach, and the reach is the validation, and the validation is the client's build, and the build is the path, and the path is the trust, and the trust is the handshake's success. The missing intermediate is the broken bridge, and the broken bridge is the path's absence, and the absence is the untrusted, and the untrusted is the warning, and the warning is the incident, and the incident is the reason the server must send the whole chain rather than the leaf. ## Why the desktop was fine The desktop browser had the cached intermediate, and the cached was the previous visit, and the previous visit was the other site on the same CA, and the same CA was the intermediate's presence, and the presence was the build's success, and the success was the fine, and the fine was the test's lie, and the lie was the incident's delay. The mobile client had the no cache, and the no cache was the strict build, and the strict build was the server's sent chain, and the sent chain was the leaf only, and the leaf only was the path's absence, and the absence was the untrusted, and the untrusted was the warning, and the warning was the user's, and the user's was the incident. Some clients fetch the missing intermediate, and the fetch is the AIA extension, and the extension is the URL, and the URL is the CA's server, and the server is the recovery, and the recovery is the forgiveness, and the forgiveness is the inconsistency, and the inconsistency is the reason the bug survives the desktop test and appears on the phone. This is the same layering as [the TLS handshake that cost three round trips](https://debugly.dev/tls-handshake-round-trips/), same mechanism, different costume. ## The fixes **Served the full chain in the certificate file.** The file was the leaf followed by the intermediates, and the followed was the order, and the order was the required, and the required was the fix, and the fix was the concatenation, and the concatenation was the CA's bundle, and the bundle was the discipline, because the leaf alone is the incomplete chain. **Verified the chain from outside with a strict client.** The check was the openssl s\_client or the online checker, and the checker was the chain's report, and the report was the missing intermediate's detection, and the detection was the fix, and the fix was the verification, and the verification was the discipline, because the desktop browser is the forgiving tester and the forgiving tester hides the bug. **Tested on the strict client, not the convenient one.** The strict was the mobile or the curl, and the curl was the no cache, and the no cache was the honest test, and the honest test was the fix, and the fix was the tool choice, and the choice was the discipline. **Automated the renewal with the chain included.** The renewal was the ACME client, and the client was the fullchain output, and the fullchain was the deployment's input, and the input was the fix, and the fix was the configuration, and the configuration was the discipline, because the manual renewal is the one that forgets the intermediates. **Monitored the certificate expiry and the chain validity.** The monitor was the external check, and the check was the chain's completeness, and the completeness was the alert, and the alert was the prevention, and the prevention was the fix, and the fix was the scheduled probe, and the probe was the discipline. ## The rule A TLS server must present the leaf certificate plus every intermediate up to but excluding the root, because clients only trust preinstalled roots and some clients will not fetch a missing intermediate. Serve the full chain, verify from outside with a strict client such as curl or a mobile device, and automate renewal with the chain included. The site worked on every desktop in the office and failed on every Android phone, because the server sent only the leaf certificate and the desktop browsers had cached the intermediate from another site on the same CA. That is the whole pattern, and it is the part worth remembering. --- Published on [debugly.dev](https://debugly.dev/) by [Rohit Bhadani](https://debugly.dev/about/) | Founder of [Krova Cloud](https://krova.cloud/?ref=debugly.dev)