Installing an SSL certificate on nginx

nginx has no separate directive for intermediates — it sends exactly the file you point ssl_certificate at. That file must be the leaf followed by every intermediate, in order. This is the single most common cause of a site that works in your browser but fails on other devices.

cat example.com.crt intermediate.crt > /etc/ssl/certs/fullchain.pem
chmod 600 /etc/ssl/private/example.com.key

Then the server block. Redirect :80 rather than serving both.

server {
    listen 443 ssl;
    http2 on;
    server_name example.com www.example.com;

    ssl_certificate     /etc/ssl/certs/fullchain.pem;
    ssl_certificate_key /etc/ssl/private/example.com.key;

    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_session_cache   shared:SSL:10m;
    ssl_session_timeout 1d;
    ssl_stapling        on;
    ssl_stapling_verify on;

    add_header Strict-Transport-Security "max-age=63072000" always;

    root /var/www/html;
}

server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://$host$request_uri;
}

nginx -t && systemctl reload nginx

listen 443 ssl http2; has been deprecated since nginx 1.25.1 — use a separate http2 on; line. Old tutorials still show the combined form and it will log a warning.

Verify it from the outside

A config that reloads without error can still be serving the wrong file, and your own browser will hide a missing intermediate because it caches them from other sites. Check what nginx actually presents:

openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -subject -dates

Or use the Domain SSL Checker, which performs the same handshake from this server and flags an incomplete chain explicitly.

Installing an SSL certificate on nginx

Verify it from the outside

Other platforms