Certificate chain证书链

fullchain preference, verify-chains, WeChat Mini Program checks.完整证书链、verify-chains、小程序场景怎么查。

I have hit Mini Program failures where the browser looked fine but WeChat returned ERR_CERT_AUTHORITY_INVALID — usually the server only had the site certificate and was missing the intermediate.我排过小程序挂掉：浏览器看着正常，微信报 ERR_CERT_AUTHORITY_INVALID。常见原因是服务器上只有站点证书，缺了中间证书。

What CertHub doesCertHub 怎么处理

• Prefer fullchain.cer over a single-host .cer when deploying.部署时优先用 fullchain.cer，而不是只有站点证书的 .cer。
• If the chosen file has fewer than 2 PEM blocks, try switching to fullchain automatically.若当前文件里 PEM 证书段少于 2 段，会尝试自动切到 fullchain。
• verify-chains reports every domain’s chain count and path.verify-chains 会报告每个域名的证书段数和文件路径。

Run verification跑校验

$ docker exec acme-ssl-manager /scripts/cert-manager.sh verify-chains

✓ example.com: fullchain (2 certs) - fullchain.cer
# warning example: only 1 cert — use fullchain.cer

Manual openssl check on a live host线上主机用 openssl 复核

$ echo | openssl s_client -servername api.example.com \
  -connect api.example.com:443 -showcerts 2>/dev/null \
  | grep -c 'BEGIN CERTIFICATE'
# expect >= 2