tls.cert.invalid_chain

Certificate Chain Invalid

What we check

We validate the full certificate chain from the leaf certificate through any intermediate certificates to a trusted root CA. The chain must be complete, correctly ordered, and terminate at a root our trust store recognizes.

Chain validation is independent of hostname matching — a certificate can have a valid chain but fail hostname verification, or vice versa.

What this finding means

The certificate chain presented by the server could not be validated. Common causes:

Missing intermediates. The server sends only the leaf certificate without the intermediate CA certificates that link it to a trusted root.
Untrusted root. The chain terminates at a root CA not in our trust store.
Expired intermediate. An intermediate certificate in the chain has expired, breaking the trust path.
Wrong chain order. The intermediate certificates are sent out of order.

Why it matters

Delivery failures. Sending servers that verify certificate chains (MTA-STS enforce, DANE) will refuse delivery. The chain is the proof that a trusted authority vouches for this server.
Instant F grade. An invalid chain is one of the highest-severity TLS findings and results in an automatic F for the TLS category.
Often a misconfiguration, not a missing certificate. The leaf certificate itself may be perfectly valid — the server just isn't sending the full chain.

How to fix

Identify what's missing. Check the chain the server currently presents:
```
openssl s_client -starttls smtp -connect mail.example.com:25 \
    -servername mail.example.com -showcerts 2>/dev/null | \
    grep -E 'subject=|issuer='
```
Each certificate's issuer should match the next certificate's subject. A gap means a missing intermediate.
Get the full chain. Your CA provides the intermediate certificates. For Let's Encrypt, certbot puts the full chain in fullchain.pem — make sure you are using that file, not cert.pem (leaf only).

Configure the server to send the full chain. For Postfix:

# /etc/postfix/main.cf — use fullchain, not leaf-only cert
smtpd_tls_cert_file = /etc/letsencrypt/live/mail.example.com/fullchain.pem
smtpd_tls_key_file = /etc/letsencrypt/live/mail.example.com/privkey.pem

Reload and verify:

systemctl reload postfix
openssl s_client -starttls smtp -connect mail.example.com:25 \
    -servername mail.example.com 2>/dev/null

Look for Verify return code: 0 (ok) in the output.

How it's graded

An invalid certificate chain carries a –25 penalty and triggers an instant F grade for the TLS category. See Grading Methodology for the full scoring model.

Evidence example

$ openssl s_client -starttls smtp -connect mail.example.com:25 \
    -servername mail.example.com 2>/dev/null
...
verify error:num=20:unable to get local issuer certificate
Verify return code: 21 (unable to verify the first certificate)