Why a certificate sometimes works in one place and not another.
HOW THE CHAIN WORKS
Your certificate is signed by an intermediate certificate, which is signed by a root certificate that browsers trust directly. The browser must be able to follow that path.
Roots are in the browser. Intermediates must be supplied by your server alongside your certificate.
WHAT GOES WRONG
If the intermediate is missing, browsers that already cached it from another site still work, while others show an untrusted certificate error. This produces the confusing situation where a site works on your computer and fails on a colleague's.
Mobile devices and mail clients are stricter and fail more often.
WITH AUTOSSL
cPanel installs the full chain automatically. This is not something you normally have to think about.
WITH A PURCHASED CERTIFICATE
The issuer supplies a certificate bundle alongside the certificate itself. Install both. Omitting the bundle is the most common mistake when installing a paid certificate manually.
CHECKING
An online SSL checker reports whether the chain is complete.
