A certificate was replaced a few months ago and appeared to work normally in Chrome and the test environment. After the change went live, several older phones and a partner application could no longer connect. The problem was discovered only after deployment. What checks do you perform before a certificate change to catch compatibility issues like this?
4 Answers
Also check DNS behavior when internal and external records differ. Split-horizon DNS, HTTPS records, and newer features such as Encrypted Client Hello can make different browsers reach different endpoints or select different certificates. Compare A and HTTPS lookups from each network, confirm the expected SNI reaches the right server, and temporarily simplify the DNS configuration if the results do not match.
Treat this as a compatibility and change-management issue, not just a browser test. Deploy to a development or staging endpoint first, run the normal application tests, and include device images representing the oldest phones and partner runtimes you still support. Test the exact public hostname with both browser and non-browser clients before rollout.
Check the certificate from outside your browser with an external TLS scanner, then verify it using commands such as `openssl s_client -connect example.com:443 -showcerts` or curl. Those checks reveal whether the server is actually sending the complete certificate chain.
The missing intermediate certificate is a very common cause. Desktop browsers may silently download an intermediate through AIA or already have it cached, while older phones and non-browser clients usually will not. Make sure the server sends the leaf and every required intermediate, then test against the root certificates available on your oldest supported devices. Also verify SANs, expiration, signature algorithms, and the TLS versions your partner still requires.
A certificate can look trusted on a Windows machine that already has the intermediate installed, even when the exported bundle is incomplete. Test from a clean client or device rather than relying on a workstation that may have cached the chain.