How do I check if my server is sending the correct certificate chain?

Run: openssl s_client -connect yourdomain.com:443 -servername yourdomain.com -showcerts. Count the certificates shown (look for BEGIN CERTIFICATE markers). You should see at least 2: your server certificate and the intermediate CA certificate. If only 1 is shown, the intermediate is missing — concatenate your server cert and intermediate into one file: cat server.pem intermediate.pem > fullchain.pem and update your Nginx ssl_certificate or Apache SSLCertificateChainFile directive.

Why does my site work in Chrome but fail in curl or mobile browsers?

Chrome caches intermediate certificates from previous visits and can complete the chain even when the server doesn't send intermediates. curl, Java, and many mobile browsers do not cache intermediates and fail with 'unable to verify the first certificate.' The fix is always to configure your server to send the complete certificate chain. Test with: openssl s_client -connect domain:443 -servername domain -verify_return_error to see if the chain validates without cached intermediates.

What TLS versions and cipher suites should I enable for an A+ SSL Labs rating?

Enable only TLS 1.2 and TLS 1.3 (ssl_protocols TLSv1.2 TLSv1.3 in Nginx). For TLS 1.2 ciphers, use only ECDHE key exchange with AEAD ciphers: ECDHE-ECDSA-AES128-GCM-SHA256, ECDHE-RSA-AES128-GCM-SHA256, ECDHE-ECDSA-AES256-GCM-SHA384, ECDHE-RSA-AES256-GCM-SHA384, ECDHE-ECDSA-CHACHA20-POLY1305, ECDHE-RSA-CHACHA20-POLY1305. TLS 1.3 cipher suites are negotiated automatically and cannot be configured wrong. Also enable HSTS with max-age of at least 6 months.

What is OCSP stapling and how do I verify it is working?

OCSP stapling lets your server fetch a signed certificate revocation status from the CA and include it in the TLS handshake, so clients don't need to contact the CA separately. This reduces latency by ~100ms and improves privacy. Enable it in Nginx with ssl_stapling on, ssl_stapling_verify on, and a resolver directive. Verify with: openssl s_client -connect domain:443 -servername domain -status. Look for 'OCSP Response Status: successful (0x0)' in the output. If it says 'no response sent,' check that your resolver can reach the CA's OCSP responder.

How do I safely enable HSTS without breaking subdomains?

Start with a short max-age without includeSubDomains: Strict-Transport-Security: max-age=300 (5 minutes). Verify all pages work over HTTPS. Gradually increase max-age to 86400 (1 day), then 604800 (1 week). Once confident, add includeSubDomains only if all subdomains support HTTPS. Finally, increase to max-age=63072000 (2 years) and add preload. Submit to hstspreload.org for browser preloading. Warning: HSTS with includeSubDomains is effectively permanent — if any subdomain needs HTTP, users will be blocked for the max-age duration.

Debugging TLS/SSL Configuration on Servers