What is the difference between SAN mismatch and chain missing?

SAN mismatch means the certificate does not cover the host you are visiting. Chain missing means the leaf certificate may be correct, but the server is not sending the necessary intermediate certificates.

Is it a problem if the certificate covers only the apex or only www?

Yes. Every hostname users actually visit must appear in the SAN list, or browsers may warn even if the certificate is otherwise valid.

Can chain issues look fine in some environments?

Yes. Some clients may have cached intermediates and appear to work temporarily, which is why external validation is important.

SSL Chain Missing / Domain Mismatch Fix

A practical SSL troubleshooting guide for separating SAN mismatch from incomplete certificate chains and fixing the correct deployment path.

Diagnose your site now

Problem

Users see HTTPS warnings that the certificate is not trusted or does not match the current domain. These issues look similar on the surface, but SAN mismatch and chain delivery failures require different fixes.

Symptoms

Browsers show domain mismatch or untrusted certificate warnings.
SSL Check shows the current hostname is missing from the SAN list.
TLS fails even though the certificate is not expired.
Only certain hostnames or subdomains fail over HTTPS.

Top 3 Causes

Missing SAN entries - The certificate was issued without all required hostnames.
Missing intermediate certificates - The server sends only the leaf certificate instead of the full chain.
Wrong deployment target - A certificate intended for another service was bound to the wrong virtual host or load balancer.

Diagnose with DechoNet

SSL Check to inspect SAN coverage, expiry, and chain health.
DNS Lookup to confirm where the hostname currently resolves.
Port Check to separate pure reachability problems from certificate problems.

Resolution Checklist

Confirm that every active hostname such as example.com, www.example.com, or subdomains is present in SAN.
Reissue the certificate with any missing hostnames.
Deploy fullchain.pem or the provider-required full chain artifact instead of only the leaf certificate.
Verify virtual host or SNI mapping if multiple certificates share the same infrastructure.
Re-run SSL Check to confirm both SAN coverage and chain status are healthy.

When to Escalate

Escalate to the CDN or managed load balancer team if certificates are installed outside the origin.
Escalate to security or PKI owners if you rely on private CA or enterprise certificate workflows.
Escalate to infrastructure operators if multiple certificates and SNI rules are mixed together.