> ## Content Index
> Fetch the complete content index at: https://blog.gonzaleztroyano.es/llms.txt
> Use this file to discover other available public pages before exploring further.

# Certificates are not trusted on Firefox: ¡send full chain! (on Caddy)
- URL: https://blog.gonzaleztroyano.es/certificates-are-not-trusted-on-firefox-send-full-chain-caddy/
- Published: 2025-08-18T12:04:01.000Z
- Updated: 2026-01-03T18:46:31.000Z
- Author: Pablo González Troyano
- Tags: tech-notes, caddy, Let's Encrypt, SSL/TLS

## Intro

As a Caddy Server user, I faced a strange error today[\[1\]](#fn1).

I'm on my way to change my browser (previously Chrome and Edge) to [Firefox](https://www.firefox.com/es-ES/?ref=blog.gonzaleztroyano.es) and when trying to access some of my sites (the ones not proxied by Cloudflare) the following error appeared on Firefox:

---

1. Well, not really strange once understood and solved, but you know ;) [↩︎](#fnref1)

![](https://blog.gonzaleztroyano.es/content/images/2025/08/image-3.png)

## Problem

Of course, if not DNS, it's certificate chain trust ;(.

If tried to connect to the server/page/domain with the `echo "" | openssl s_client -showcerts -servername *****.glez.cloud -connect *****..glez.cloud:443` command, I receive the following errors:

![](https://blog.gonzaleztroyano.es/content/images/2025/08/imagen.png)

```plain
verify error:num=20:unable to get local issuer certificate [...]
verify error:num=21:unable to verify the first certificate [...]
Verification error: unable to verify the first certificate [...]
Secure Renegotiation IS NOT supported [...]
Verify return code: 21 (unable to verify the first certificate) [...]

```

## Solution

Although I would be the only user facing this error, these kinds of things are the ones that have to be solved when encountered. If not, the *debt* could be worse next time. 

So, to solve this problem, we have to identify it first: the server is not sending the [full certificate chain](https://support.dnsimple.com/articles/what-is-ssl-certificate-chain/?ref=blog.gonzaleztroyano.es), only the [leaf certificate](https://cert-manager.io/docs/reference/tls-terminology/?ref=blog.gonzaleztroyano.es#leaf-certificates). 

To make Caddy send the full certificate, the certificate file path on the [tls directive](https://caddyserver.com/docs/caddyfile/directives/tls?ref=blog.gonzaleztroyano.es#tls) of the CaddyFile has to point not to the leaf certificate, but to the fullchain file. In case you are using Let's Encrypt, the paths will be:

Change `tls /etc/letsencrypt/live/*domain*/cert.pem` to `tls /etc/letsencrypt/live/*domain*/fullchain.pem`

## Any doubts?

Do not hesitate to [contact me](https://blog.gonzaleztroyano.es/sobre-mi/#%C2%BFalguna-duda) with any questions, suggestions, complaints or clarifications you may have, I'll be happy to talk to you!