Installing on your web server

You have the certificate and the key; what remains is telling the server about them. The mistake that costs the most time is the same everywhere: sending the leaf certificate without its intermediates. Your own browser hides it — it caches intermediates from other sites — so the site looks fine to you and broken to everyone else.

Almost every server wants the same input, a fullchain file: the leaf first, then each intermediate, in order. The root is never included, because clients already have it.

cat example.com.crt intermediate.crt > fullchain.pem
The same server config, judged by two different clients When the server sends only the leaf certificate, a desktop browser still trusts it because it has cached the intermediate from another site, while a phone or an API client with no such cache rejects it. When the server sends the leaf and the intermediate together, both trust it. The difference is one file. what your server sends your certificate the intermediate leaf only — the common mistake leaf + intermediate — a fullchain Desktop browser has cached the intermediate from some other site Phone or API client nothing cached to fall back on TRUSTED NOT TRUSTED TRUSTED
Nothing about the certificate changes between the two halves of this loop — only whether the intermediate travels with it. That is why the site looks fine to you and fails for a visitor on a phone.

nginx

Apache httpd 2.4

Caddy

HAProxy

IIS (Windows)

Tomcat 9 / 10

Node.js

Kubernetes & cert-manager

Traefik & Docker

Mail servers