Network & Infrastructure / Segmentation, TLS & Secure Connectivity
Incomplete TLS certificate chains behind a load balancer
A service works in some browsers but fails on fresh clients or automated agents. Cached intermediates can hide an incomplete chain supplied by the endpoint.
Environment and inputs: Stateful network boundaries, TLS endpoints and IPsec gateways; use the deployed security policy and implementation manual. Diagnostic/design example; not tested on production equipment.
Collect the evidence
Record the exact served chain, hostname, trust store and validation error on a clean client. Check every load-balancer node because one may hold an outdated certificate bundle.
Explain the result
The server must supply the chain elements expected by the deployment's trust model. A client that already knows an intermediate can succeed even when another valid client cannot build the chain.
Plan the fix
Install the correct leaf and intermediate bundle through the certificate management process. Avoid distributing a new trust anchor to clients merely to compensate for missing server intermediates.
Check the result and rollback
Test clean clients with representative trust stores and each endpoint address. Restore the previous valid bundle if the replacement changes identity, omits an intermediate or introduces an expired certificate.