Intermediate certificate not served

[wtn]

I'm setting up my TLS context like so:

ssl_context do
	context = OpenSSL::SSL::SSLContext.new
	certificate_bundle_path = File.join __dir__, 'cert/public_bundle.pem'
	certificates = OpenSSL::X509::Certificate.load_file certificate_bundle_path
	server_certificate = certificates.first
	certificate_chain = certificates[1..]
	private_key_path = File.join __dir__, 'cert/private_key.pem'
	private_key = OpenSSL::PKey::RSA.new File.read(private_key_path)
	context.add_certificate server_certificate, private_key, certificate_chain
	context
end

I'm using a certificate signed by a well-known CA. The file at cert/public_bundle.pem contains the entity certificate followed by the intermediate certificate.

The problem is that Falcon only serves the entity certificate, so the connection fails unless I add the intermediate certificate to the truststore on the clients.

[ioquatix]

This looks okay to me, but maybe there is something I'm missing. For sure, it does work, e.g.

> openssl s_client -connect www.codeotaku.com:443 -servername www.codeotaku.com -showcerts
Connecting to 2600:3c01::f03c:91ff:fe18:f29b
CONNECTED(00000005)
depth=2 C=US, O=Internet Security Research Group, CN=ISRG Root X1
verify return:1
depth=1 C=US, O=Let's Encrypt, CN=R11
verify return:1
depth=0 CN=www.codeotaku.com
verify return:1
---
Certificate chain
 0 s:CN=www.codeotaku.com
   i:C=US, O=Let's Encrypt, CN=R11
   a:PKEY: RSA, 2048 (bit); sigalg: sha256WithRSAEncryption
   v:NotBefore: Jun 14 03:07:51 2025 GMT; NotAfter: Sep 12 03:07:50 2025 GMT
-----BEGIN CERTIFICATE-----
MIIE/TCCA+WgAwIBAgISBlfq92zyKsQwIgZ6zSNHJRAgMA0GCSqGSIb3DQEBCwUA
MDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQD
EwNSMTEwHhcNMjUwNjE0MDMwNzUxWhcNMjUwOTEyMDMwNzUwWjAcMRowGAYDVQQD
ExF3d3cuY29kZW90YWt1LmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC
ggEBAKJogJeOo17oCE6YO72Til5ETT5h+qVhaBBZaXwKHw3RiKWE0W+bGKzJJpkX
fhIcWT5r1J13NmEwHc5hgZy2PA7WqXZ9cY0vc8tj65315SKxZJ1zTnQ+ErKUYclt
W0f7rnjhEaWzNUkewwItdk9cBvAA8Y3kVGPaBfAPip5/RcR5J77yG8gy+FAJ2/Qf
kdQjHVHnXxJyNTBvIf5jZUy8tsDjd7UeLd7u83GvoCnt41bJMkfS5ay/caZZgJJB
c765fnq1Q4rHyzpDS/H468UkiiOSRGhLKcV7cWEnjDwxI4n4MK7cZXjFMug5nhQD
z6TgxHnirdSzwVpDE0G9PqwC9KcCAwEAAaOCAiAwggIcMA4GA1UdDwEB/wQEAwIF
oDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDAYDVR0TAQH/BAIwADAd
BgNVHQ4EFgQUbwOzFURp3RAurh/2HP62t9ZWAEswHwYDVR0jBBgwFoAUxc9GpOr0
w8B6bJXELbBeki8m47kwMwYIKwYBBQUHAQEEJzAlMCMGCCsGAQUFBzAChhdodHRw
Oi8vcjExLmkubGVuY3Iub3JnLzAcBgNVHREEFTATghF3d3cuY29kZW90YWt1LmNv
bTATBgNVHSAEDDAKMAgGBmeBDAECATAuBgNVHR8EJzAlMCOgIaAfhh1odHRwOi8v
cjExLmMubGVuY3Iub3JnLzMzLmNybDCCAQMGCisGAQQB1nkCBAIEgfQEgfEA7wB1
ABLxTjS9U3JMhAYZw48/ehP457Vih4icbTAFhOvlhiY6AAABl2yd+fMAAAQDAEYw
RAIgCQ1WwnWbUongahdLse3T0ZWj5ISWAohsR8bsGvguEtMCIA3xl6ETc7p4gr7u
Y7XXhj4AoEqJV7qe3M1wcUmc/U5aAHYApELFBklgYVSPD9TqnPt6LSZFTYepfy/f
RVn2J086hFQAAAGXbJ4BuAAABAMARzBFAiEAlhcKPg4DDYos6LgGAjbfcgZS5+eH
8kVxsYzGk2lA8OgCIDeH93kIKpoknKh7zjcuCWDHyg3UJmD7OXVOHNmqWBnmMA0G
CSqGSIb3DQEBCwUAA4IBAQCVzSemeeKn0cdfssAxuekW4g7Y2j8K+QsPBToGIiJF
soLLURlEsLecbyzvHVBsuJ4dBrPAMbSHOIdQcgpiNHca43L7qmhzM+CVbOhEE8l+
A0xhciiiygtqy9UaU78DoMT6TXcyvq0RxB/eY2AzREk32a216fzOKfKYVAxJKWCZ
+44nk3i1Fst2cu9orDCnFIa/kfPBO+Fp32sOZdiBLVhrEy8AZS/TSmZKkBgqhSf6
6zxFz0R/F4m97G38EEj57WBczC8FN3Yv3G/gQBVFXS63TplxKH5Xa6UUbB6yJT0u
9Paosm01Q+eAo91eDPZBxseuJnCzEjW0voi3uK/ZTcKE
-----END CERTIFICATE-----
 1 s:C=US, O=Let's Encrypt, CN=R11
   i:C=US, O=Internet Security Research Group, CN=ISRG Root X1
   a:PKEY: RSA, 2048 (bit); sigalg: sha256WithRSAEncryption
   v:NotBefore: Mar 13 00:00:00 2024 GMT; NotAfter: Mar 12 23:59:59 2027 GMT
-----BEGIN CERTIFICATE-----
MIIFBjCCAu6gAwIBAgIRAIp9PhPWLzDvI4a9KQdrNPgwDQYJKoZIhvcNAQELBQAw
TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh
cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjQwMzEzMDAwMDAw
WhcNMjcwMzEyMjM1OTU5WjAzMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3Mg
RW5jcnlwdDEMMAoGA1UEAxMDUjExMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
CgKCAQEAuoe8XBsAOcvKCs3UZxD5ATylTqVhyybKUvsVAbe5KPUoHu0nsyQYOWcJ
DAjs4DqwO3cOvfPlOVRBDE6uQdaZdN5R2+97/1i9qLcT9t4x1fJyyXJqC4N0lZxG
AGQUmfOx2SLZzaiSqhwmej/+71gFewiVgdtxD4774zEJuwm+UE1fj5F2PVqdnoPy
6cRms+EGZkNIGIBloDcYmpuEMpexsr3E+BUAnSeI++JjF5ZsmydnS8TbKF5pwnnw
SVzgJFDhxLyhBax7QG0AtMJBP6dYuC/FXJuluwme8f7rsIU5/agK70XEeOtlKsLP
Xzze41xNG/cLJyuqC0J3U095ah2H2QIDAQABo4H4MIH1MA4GA1UdDwEB/wQEAwIB
hjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwEgYDVR0TAQH/BAgwBgEB
/wIBADAdBgNVHQ4EFgQUxc9GpOr0w8B6bJXELbBeki8m47kwHwYDVR0jBBgwFoAU
ebRZ5nu25eQBc4AIiMgaWPbpm24wMgYIKwYBBQUHAQEEJjAkMCIGCCsGAQUFBzAC
hhZodHRwOi8veDEuaS5sZW5jci5vcmcvMBMGA1UdIAQMMAowCAYGZ4EMAQIBMCcG
A1UdHwQgMB4wHKAaoBiGFmh0dHA6Ly94MS5jLmxlbmNyLm9yZy8wDQYJKoZIhvcN
AQELBQADggIBAE7iiV0KAxyQOND1H/lxXPjDj7I3iHpvsCUf7b632IYGjukJhM1y
v4Hz/MrPU0jtvfZpQtSlET41yBOykh0FX+ou1Nj4ScOt9ZmWnO8m2OG0JAtIIE38
01S0qcYhyOE2G/93ZCkXufBL713qzXnQv5C/viOykNpKqUgxdKlEC+Hi9i2DcaR1
e9KUwQUZRhy5j/PEdEglKg3l9dtD4tuTm7kZtB8v32oOjzHTYw+7KdzdZiw/sBtn
UfhBPORNuay4pJxmY/WrhSMdzFO2q3Gu3MUBcdo27goYKjL9CTF8j/Zz55yctUoV
aneCWs/ajUX+HypkBTA+c8LGDLnWO2NKq0YD/pnARkAnYGPfUDoHR9gVSp/qRx+Z
WghiDLZsMwhN1zjtSC0uBWiugF3vTNzYIEFfaPG7Ws3jDrAMMYebQ95JQ+HIBD/R
PBuHRTBpqKlyDnkSHDHYPiNX3adPoPAcgdF3H2/W0rmoswMWgTlLn1Wu0mrks7/q
pdWfS6PJ1jty80r2VKsM/Dj3YIDfbjXKdaFU5C+8bhfJGqU3taKauuz0wHVGT3eo
6FlWkWYtbt4pgdamlwVeZEW+LM7qZEJEsMNPrfC03APKmZsJgpWCDWOKZvkZcvjV
uYkQ4omYCTX5ohy+knMjdOmdH9c7SpqEWBDC86fiNex+O0XOMEZSa8DA
-----END CERTIFICATE-----
---
Server certificate
subject=CN=www.codeotaku.com
issuer=C=US, O=Let's Encrypt, CN=R11
---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: rsa_pss_rsae_sha256
Peer Temp Key: X25519, 253 bits
---
SSL handshake has read 3130 bytes and written 1637 bytes
Verification: OK
---
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Protocol: TLSv1.3
Server public key is 2048 bit
This TLS version forbids renegotiation.
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---
---
Post-Handshake New Session Ticket arrived:
SSL-Session:
    Protocol  : TLSv1.3
    Cipher    : TLS_AES_256_GCM_SHA384
    Session-ID: C77249C480471A9FE292A22AEF6C2556AD8A6EEFFF7C04CBE59069953C62D992
    Session-ID-ctx: 
    Resumption PSK: 2BA8B4E305CC9188D94C6F893390A325E9534625F01A317E9693E234D1A112E98A3A6D5226E6EA185746EDC0EF4FADF6
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 7200 (seconds)
    TLS session ticket:
    0000 - dc 6c 86 55 b8 ef 70 54-0b c2 9c d2 f6 ff 91 f1   .l.U..pT........
    0010 - 0a 71 44 e1 27 7c 87 5d-13 1d 0a 14 22 6a 6a b6   .qD.'|.]...."jj.
    0020 - 2b 8d 7b 01 f4 cf 49 91-b7 22 07 26 04 df 1d 4e   +.{...I..".&...N
    0030 - 91 a9 f1 dd 63 50 ab ea-d0 ca d1 a5 d2 3e 01 c8   ....cP.......>..
    0040 - d6 70 b2 ac 13 b4 09 80-52 81 00 26 ab 49 b3 f2   .p......R..&.I..
    0050 - 11 8a b1 cd 94 b8 8f d5-8c b0 dc ae 47 44 19 82   ............GD..
    0060 - d4 5e 16 95 40 fc db e5-10 74 7a e7 63 90 0f 83   .^..@....tz.c...
    0070 - 82 30 b9 c5 9e 6a 52 05-54 43 b9 68 bb 15 74 9e   .0...jR.TC.h..t.
    0080 - 70 a5 ec e6 25 fd c8 07-5b 6b 5f 7e 15 77 b3 4b   p...%...[k_~.w.K
    0090 - b6 58 1a b7 8b a1 7a b2-72 ca 49 c8 69 50 95 93   .X....z.r.I.iP..
    00a0 - ea 06 f5 12 83 95 9f ba-dd 5d 7b b2 d1 47 31 fe   .........]{..G1.
    00b0 - de a2 42 f3 fe ec e6 71-ab 92 cf 75 d4 d6 14 84   ..B....q...u....
    00c0 - 18 e7 8e b8 85 64 ca 75-65 1c 62 8b ef b7 29 e7   .....d.ue.b...).
    00d0 - 43 79 f7 a6 c6 56 a6 71-ca 83 bf 2e 07 6d 96 a0   Cy...V.q.....m..

    Start Time: 1750064642
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
    Extended master secret: no
    Max Early Data: 0
---
read R BLOCK
---
Post-Handshake New Session Ticket arrived:
SSL-Session:
    Protocol  : TLSv1.3
    Cipher    : TLS_AES_256_GCM_SHA384
    Session-ID: 0199C35CACF56AD178A1E6374D16F63DCFA736910524A047896A3D3D928ADF96
    Session-ID-ctx: 
    Resumption PSK: 1FF50B9BBCFF99CDCA824225BBA45FEB413660F68A5B5BDC8F4E51B624E06E354D645D7D3BDC8373B2E08D6091E1FA54
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 7200 (seconds)
    TLS session ticket:
    0000 - dc 6c 86 55 b8 ef 70 54-0b c2 9c d2 f6 ff 91 f1   .l.U..pT........
    0010 - b2 8f 2c e4 8d 13 fe 8f-06 60 3d 10 70 3d 0f 8d   ..,......`=.p=..
    0020 - 9b 54 2e 26 9a 52 c9 2a-53 55 ec b4 61 a2 ca 56   .T.&.R.*SU..a..V
    0030 - 36 60 2f ec c6 50 6e a8-04 04 b6 ae 20 e2 c0 18   6`/..Pn..... ...
    0040 - f3 82 d7 97 0f 82 91 7d-02 d4 71 76 ea 7b c5 f9   .......}..qv.{..
    0050 - 5c 4d d9 26 df 57 af b9-2d 9e dc 55 37 2b 7b 4a   \M.&.W..-..U7+{J
    0060 - cc 5f e5 56 b0 7b dc 0b-85 43 e5 a3 f8 78 7b ee   ._.V.{...C...x{.
    0070 - 6a 51 01 6a fe 0b 5b 6f-76 d7 b6 17 c1 e5 a4 05   jQ.j..[ov.......
    0080 - 03 d0 15 13 6f cc 68 75-21 6f 52 96 b5 54 fd 92   ....o.hu!oR..T..
    0090 - 90 dd 8f 3f 0b df ab 61-5d 20 5f fd 1d 41 46 b1   ...?...a] _..AF.
    00a0 - 10 c4 a2 19 17 7d fd 34-44 4a 4e 21 51 a3 88 e1   .....}.4DJN!Q...
    00b0 - 7b f8 f0 0b cc d7 cc f4-23 6d 4c 0f be 79 02 f1   {.......#mL..y..
    00c0 - ba 97 d2 04 4c 16 33 59-c2 ed 68 8d 41 ca 5c fa   ....L.3Y..h.A.\.
    00d0 - 89 e8 75 9d f6 4f 71 10-fa ad e5 f1 86 b7 4e a2   ..u..Oq.......N.

    Start Time: 1750064642
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
    Extended master secret: no
    Max Early Data: 0
---
read R BLOCK
closed

This certificate chain comes from the default LetsEncryptTLS environment:

falcon/lib/falcon/environment/lets_encrypt_tls.rb

Lines 21 to 23 in fa80299

	def ssl_certificate_path
	File.join(lets_encrypt_root, authority, "fullchain.pem")
	end

This path is processed by the TLS environment: https://github.com/socketry/falcon/blob/main/lib/falcon/environment/tls.rb#L65

Do you mind telling me how you are starting the server? Also maybe double check this question: #300