The remote certificate is invalid because of errors in the certificate chain: PartialChain

Often combined with other flags, e.g. "PartialChain, RevocationStatusUnknown". HttpClient wraps it in "The SSL connection could not be established, see inner exception."

.NET SslStream / HttpClient — X509ChainStatusFlags.PartialChain: the chain could not be built up to a root

What it means

.NET could not build the chain from the server's certificate up to any root: an intermediate is missing. Even when the root is trusted (as in the reproduction), the gap between leaf and root prevents validation. .NET can download a missing intermediate from the URL in the certificate's Authority Information Access extension when one exists and is reachable, so the error shows up mostly with private CAs, locked-down networks and containers.

Why it happens

• The server sends only its leaf certificate

  common

  Kestrel, IIS bindings or reverse proxies configured with a leaf-only certificate file or PFX.

• The intermediate cannot be fetched

  occasional

  Private CAs often have no AIA URL, and firewalled hosts or containers cannot reach public ones, so .NET cannot fill the gap itself.

• The intermediate exists only on other machines

  occasional

  On Windows, intermediates cached or installed in the CertificateAuthority store make the chain work on some machines and fail on fresh servers or Linux containers.

How to fix it

1. 1.

   Check what the server sends

   One certificate in the handshake, issued by an intermediate, confirms the problem.

   openssl s_client -connect api.example.com:443 -servername api.example.com -showcerts </dev/null 2>/dev/null \
     | grep -E '^ *[0-9]+ s:|^ *i:'

2. 2.

   Send the full chain from the server

   In our test, Kestrel (.NET 10) sent only the leaf when given a full-chain PEM through ServerCertificate alone, and sent the intermediate once ServerCertificateChain was set as shown. For IIS, install the intermediate into the server's Intermediate Certification Authorities store so Windows sends it.

   // Kestrel sends intermediates only when they are given as ServerCertificateChain
   builder.WebHost.ConfigureKestrel(k => k.ConfigureHttpsDefaults(o =>
   {
       o.ServerCertificate = X509Certificate2.CreateFromPemFile("fullchain.pem", "server.key");
       var chain = new X509Certificate2Collection();
       chain.ImportFromPemFile("fullchain.pem");   // leaf + intermediates
       o.ServerCertificateChain = chain;
   }));

3. 3.

   Find the missing intermediate

   The AIA extension of the leaf points at the issuer certificate; add it to the server configuration.

   # The leaf names where its issuer can be downloaded (Authority Information Access)
   openssl x509 -in server.pem -noout -ext authorityInfoAccess

← Browse the full signature error database