On the account for harkus.co.uk, the SSL certificate installed from the panel is served without the intermediate certificate(s): the TLS handshake returns only the leaf certificate (chain length 1). Browsers still load the site because they fetch the intermediate via the certificate’s AIA URL, but strict clients fail with “unable to get local issuer certificate” (curl, openssl s_client, Python ssl, older devices).
Evidence:
openssl s_client -connect harkus.co.uk:443 returns only the leaf and reports “unable to get local issuer certificate”.
This happens with both providers: Let’s Encrypt (order 6860349) and now Google Trust (order 6863040), so the bundle seems not to be sent server-side regardless of the CA.
Welcome to the InfinityFree community forum! Good to have you here.
Most people answering here are volunteers. They’re often the fastest source of help. Admin (the only staff member) checks in about once a day for issues on our end.
Volunteers can’t see your account or website. Share what you actually see, like error messages and what happens when you try something. That’s more useful than your theory of what’s wrong.
AI tools often get InfinityFree wrong. If a volunteer’s advice differs from what an AI told you, please try the volunteer’s suggestion first.
Solving an issue is a joint effort. Try the suggestions you get and report back what happened.
Beep boop, I’m a bot! I dug through the forum to get you started. I sometimes get things wrong though, so do with this what you will until a human has a look.
I can’t fix this one, and I couldn’t find anything saying you can change what chain the server sends. A person needs to look at it.
The closest answer I found is from a 2022 topic about the same symptom (SSL Labs reporting an incomplete chain on a certificate from the panel). The reply there said intermediate certificates aren’t supported on the hosting, and that browsers and operating systems fetch the missing intermediate themselves:
That matches what you describe. It’s an old topic, though, and I can’t tell whether it still applies. I also found nothing about how to upload or serve a full chain yourself.
Your point that the same thing happens with both Let’s Encrypt and Google Trust fits a server-side cause rather than anything about the CA. Other people have reported leaf-only chains recently, such as this one:
I didn’t find an answer in that topic.
I also found a similar report of the blank Status/Issuer/Expires fields in the panel, but no explanation of why it happens:
This article specifically covers the error you’re seeing:
But for your case specifically: as you already known, the lack of a certificate chain doesn’t affect browsers, is mostly affects automated tools. However, even if your site did have a full CA chain, you wouldn’t be able to connect with cURL or Python to your website, because non-browser access is blocked on our hosting: