I have a Go Daddy SSL cert installed, and works fine everywhere except Android.

https://www.ssllabs.com/ssltest/analyze.html says the chain is incomplete, and I read on stack overflow that an SSL chain in the wrong order will fail on Android.

But how do I put it in order? On my Server? SSL cert itself needs to be rekeyed? Move things on FTP?


3 Answers 3


Following up on zakjan's answer, I had a problem when I tried to use jquery to do an AJAX request on my newly secure server, in an android webview. It worked in the browser, but not in my app.

I used this site: https://certificatechain.io/

I pasted in the text of my signed .crt file I got back from Comodo (positiveSSL), and it gave me back a concatination of everything I needed. I saved it as my domain + "chain.crt" (see below)

Then, in my apache configs, I entered something like this for that particular virtual host:

SSLEngine On
SSLCertificateFile /etc/ssl/localcerts/example_com.crt
SSLCertificateKeyFile /etc/ssl/localcerts/example.com.key
SSLCACertificateFile /etc/ssl/localcerts/example.com.chain.crt

After that, my Android app's webview did not have a problem using ajax to POST to my server. I tried it on 2 real-world devices, one running 2.3.4, one running 4.something. And on the emulator running 2.3. All worked.

I hope this helps.

  • 1
    The key for me was adding the SSLCACertificateFile directive and pointing it to the CA file my authority gave me. It wouldn't work if I simply concatenated the other certificates to my certificate file.
    – Alex W
    Dec 21, 2015 at 15:31
  • In older apaches SSLCertificateChainFile could be used instead of SSLCACertificateFile (just in case you search for this key in your configs and can't find it).
    – dr0i
    Jan 7, 2019 at 8:56
  • Incredibly, but the @Richard reply is using the site certificatechain.io and the site says "... inspired by cert-chain-resolver by Jan Žák", who replied this question here: superuser.com/a/866523/92500, thanks @zakjan! Aug 15, 2019 at 17:58
  • The SSLCACertificateFile was the line I missed. Initially I assumed my CA was too new because SSL worked when requested from some browsers/OS's, but not others. Using decoder.link/sslchecker helped clarify that my config was wrong, and this answer had the fix. Thank you!! Aug 18, 2019 at 18:02
  • certificatechain.io - is now Pedro & Grace -We Are Getting Married. They need an SSL though
    – Jon
    Aug 2, 2022 at 10:29

The chain was in crt file, that the original SSL was working off.

For GoDaddy there is a 2nd cert - gd_bundle.crt

Copy this info and add it to the crt installed on the server.

So the original crt on the server had 1 certificate, and after it will have 3 on the same file. This is the chain.

I still got contains anchor in chain issues on ssllabs.com but this is not an issue, just an option to leave in or out - according to - https://security.stackexchange.com/questions/24561/ssltest-chain-issues-contains-anchor/24566#24566

  • 2
    To get rid of chain issues remove the last certificate from gd_bundle.crt
    – sanmai
    Feb 13, 2014 at 2:19

You can solve the incomplete certificate chain issue manually by concatenating all certificates from the certificate to the trusted root certificate (exclusive, in this order), to prevent such issues. Note, the trusted root certificate should not be there, as it is already included in the system’s root certificate store.

You should be able to fetch intermediate certificates from the issuer and concat them together by yourself. Btw, I have written a script to automate the procedure, it takes a certificate to produce output of correctly chained certificates. https://github.com/zakjan/cert-chain-resolver

  • This sounds like a solution that only "tricks" the local machine into thinking the certificate is setup correctly.
    – Alex W
    Dec 21, 2015 at 15:10
  • Nope. The output certificate bundle is supposed to be uploaded to a server, which sends website content. Every client will receive the certificate with its intermediates.
    – zakjan
    Dec 24, 2015 at 21:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .