# What Is Fullchain (fullchain.pem)? Definition and Examples

> Fullchain is a PEM file containing the server's leaf certificate followed by the intermediate certificates needed to link it to a trusted root.

Source: https://ssl.sh/glossary/fullchain/
Last updated: 2026-11-10

A fullchain file, best known as `fullchain.pem` from Certbot, concatenates the leaf certificate and the [intermediate certificates](https://ssl.sh/glossary/intermediate-certificate/) in order, each in [PEM](https://ssl.sh/glossary/pem/) form. Certbot writes `cert.pem` (leaf only), `chain.pem` (intermediates only), `fullchain.pem` (both) and `privkey.pem` under `/etc/letsencrypt/live/<domain>/`. The root certificate is normally left out because clients already have it in their trust store.

## Why it matters
During the handshake the server must send every certificate the client needs to build a path to a root it trusts. If you configure only the leaf, some clients fail with errors such as "unable to get local issuer certificate", while desktop browsers may still work because they can fetch missing intermediates via [AIA](https://ssl.sh/glossary/aia/) or have them cached. That inconsistency makes a missing chain a classic TLS misconfiguration that passes a quick browser test and then breaks API clients, mobile apps and scripts. nginx takes the full chain in `ssl_certificate`; Apache 2.4.8 and later also accept it in `SSLCertificateFile`.

## Example
```bash
cat example.com.crt intermediate.crt > fullchain.pem
openssl s_client -connect example.com:443 -servername example.com -showcerts </dev/null | grep -E "^ *[0-9] s:"
```

```nginx
ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
```

## Common misconceptions
- **The chain should include the root.** It is unnecessary; clients use their own copy of the root.
- **Order does not matter.** Put the leaf first, then the certificate that issued it, and so on up the chain.
- **It works in my browser, so the chain is fine.** Browsers may hide the problem; test with curl, OpenSSL or an [SSL checker](https://ssl.sh/tools/ssl-checker/).

## Related terms

- [证书链](https://ssl.sh/zh/glossary/certificate-chain/): 证书链是从网站终端证书经中间证书一直到受信任根证书的有序证书序列，每一张都由下一张签名。
- [中间证书](https://ssl.sh/zh/glossary/intermediate-certificate/): 中间证书是由根证书（或上级中间证书）签发、用来签发网站证书的 CA 证书，服务器必须把它和网站证书一起发送给客户端。
- [PEM](https://ssl.sh/zh/glossary/pem/): PEM 是一种把 DER 二进制数据做 Base64 编码、再用 BEGIN 和 END 行包起来的文本格式，是存放证书和私钥最常见的方式。
- [CRT 文件](https://ssl.sh/zh/glossary/crt-file/): CRT 文件是存放 X.509 证书的 .crt 或 .cer 文件，内容可能是 PEM 文本，也可能是二进制 DER，取决于生成它的平台。
- [AIA](https://ssl.sh/zh/glossary/aia/): AIA 即颁发机构信息访问，是 X.509 证书扩展，提供签发 CA 证书的下载地址，以及（可选的）该 CA 的 OCSP 服务地址。
- [根证书](https://ssl.sh/zh/glossary/root-certificate/): 根证书是位于证书链顶端、由 CA 自签名的证书，预装在操作系统或浏览器的信任库中，作为验证其他证书的信任锚。
- [CA Bundle](https://ssl.sh/zh/glossary/ca-bundle/): CA Bundle 是把多张 PEM 证书拼接在一起的文件，既可能是服务器要发送的中间证书链，也可能是客户端信任的根证书集合。