iagnosing certificate chain issues after migrat ing to OpenSSL 3.x — intermediate cert not sent

Hi,

I built a free SSL certificate checker (https://dnsrobot.net/ssl-checker) 
that validates the full TLS chain, protocol support, and cipher suites from 
an external perspective. While testing it against various servers, I've 
been noticing a pattern worth sharing.

Several sites that recently upgraded from OpenSSL 1.1.1 to 3.x have 
incomplete certificate chains — the intermediate CA isn't being sent during 
the handshake. Modern browsers handle this silently via AIA fetching, but 
older clients (Android 7-9, some curl builds, IoT devices) fail with 
handshake errors.

The typical cause: Nginx ssl_certificate only has the leaf cert, not the 
full chain. OpenSSL 1.1.1 seemed more forgiving, but 3.x appears stricter 
about only sending what's explicitly configured.

The fix is straightforward: cat server.crt intermediate.crt > fullchain.crt

You can verify with: openssl s_client -connect example.com:443 -showcerts

If it only shows 1 certificate instead of 2-3, the intermediate is missing.

Questions for the group:

   - 
   
   Is there a way to make OpenSSL 3.x automatically fetch missing 
   intermediates via AIA, similar to how browsers do it? I know s_client 
   doesn't support this by default.
   - 
   
   For anyone running OpenSSL 3.x in production: are you seeing more 
   chain-related issues compared to 1.1.1?
   - 
   
   What's the recommended way to validate certificate chain completeness as 
   part of a CI/CD pipeline? We're considering an openssl verify -CAfile step 
   but want to catch all edge cases.
   
Thanks,

Vahid

-- 
You received this message because you are subscribed to the Google Groups "openssl-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-users/e0d1989a-9455-43f2-b398-a6c05689fbaan%40openssl.org.