Fullchain (fullchain.pem)

A fullchain file, best known as fullchain.pem from Certbot, concatenates the leaf certificate and the intermediate certificates in order, each in PEM form. Certbot writes cert.pem (leaf only), chain.pem (intermediates only), fullchain.pem (both) and privkey.pem under /etc/letsencrypt/live/<domain>/. The root certificate is normally left out because clients already have it in their trust store.

Why it matters

During the handshake the server must send every certificate the client needs to build a path to a root it trusts. If you configure only the leaf, some clients fail with errors such as "unable to get local issuer certificate", while desktop browsers may still work because they can fetch missing intermediates via AIA or have them cached. That inconsistency makes a missing chain a classic TLS misconfiguration that passes a quick browser test and then breaks API clients, mobile apps and scripts. nginx takes the full chain in ssl_certificate; Apache 2.4.8 and later also accept it in SSLCertificateFile.

Example

cat example.com.crt intermediate.crt > fullchain.pem
openssl s_client -connect example.com:443 -servername example.com -showcerts </dev/null | grep -E "^ *[0-9] s:"

ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

Common misconceptions

• The chain should include the root. It is unnecessary; clients use their own copy of the root.
• Order does not matter. Put the leaf first, then the certificate that issued it, and so on up the chain.
• It works in my browser, so the chain is fine. Browsers may hide the problem; test with curl, OpenSSL or an SSL checker.