Typical errors

• Missing intermediate: the server only sends the leaf. Browsers often work because they cache or download intermediates, but other clients, such as Java, curl, mail servers and mobile apps, report an unknown issuer. Deploy with Include chain on.
• Wrong order: the intermediates come before the leaf, or the root comes first. Many clients reject such a chain. Keep the standard order and use Reverse chain order (root first) only for software that requires it.
• Key does not match: the private key belongs to an older certificate, for example after a renewal with a new key when only the certificate file was replaced. The service does not start or reports a key mismatch. Always deploy certificate and key together; for a PFX, TLSPilot checks this itself.

Messages, causes and solutions: chapter Deployment targets.