DocumentationExperience Cloud KCS

Missing intermediate SSL certificate authority for custom domains

Last update: October 1, 2026

This article explains how to identify and resolve SSL/TLS issues caused by a missing intermediate certificate authority in the certificate chain for custom domains configured in Adobe Experience Manager.

Description description

Environment

  • Adobe Experience Manager (AEM)
  • Constraint: Custom domain SSL/TLS configuration

Issue/Symptoms

  • Browsers display security warnings about untrusted certificates.
  • SSL/TLS handshake errors occur.
  • SSL testing tools report an incomplete or untrusted certificate chain.

Cause

The SSL/TLS certificate chain for the custom domain is incomplete because the required intermediate certificate authority is missing from the installed certificate bundle. As a result, browsers and SSL validation tools cannot verify the trust chain correctly, which can lead to untrusted certificate warnings, SSL/TLS handshake errors, and reports of an incomplete certificate chain.

Resolution resolution

To fix SSL/TLS issues caused by a missing intermediate certificate authority, follow these steps:

  1. Use an SSL checker tool (such as SSL Labs or OpenSSL) to inspect the certificate chain for your custom domain and confirm if the intermediate certificate is missing.
  2. Download the required intermediate certificate from your certificate authority’s official repository.
  3. Regenerate the certificate bundle by combining the server certificate, the intermediate certificate(s), and the root certificate into a single file, following the required order: server certificate first, then intermediate(s), then root.
  4. Upload and install the updated certificate bundle on your load balancer or the server handling SSL termination for the domain.
  5. Remove any outdated or incorrectly configured certificates from the load balancer or server.
  6. Re-run SSL checker tools to verify that the full certificate chain is present and trusted, and test access to your domain in multiple browsers to ensure there are no SSL warnings.
recommendation-more-help
experience-cloud-kcs-help-kbarticles