Incomplete TLS certificate chain — how to fix
Browsers open the site, but curl, Android and API clients don't. The server doesn't send the intermediate certificate.
What's wrong
The server sends only the site certificate without the intermediate. Desktop browsers often complete the chain themselves, so "it works for me". But curl, Java, Go, older Android and payment webhooks fail with unable to get local issuer certificate.
How to fix
Serve the fullchain — site certificate + intermediates (the root is not needed).
nginx
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; # not cert.pem
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
Apache 2.4.8+: point SSLCertificateFile at the same fullchain.
A CA certificate (not Let's Encrypt): concatenate in "site → intermediates" order:
cat example.com.crt intermediate.crt > fullchain.pem
After nginx -t && nginx -s reload, check with SSL Checker: the chain should be complete.
From a shell: openssl s_client -connect example.com:443 -servername example.com -showcerts should show more than one certificate.