#### Symptom

Users are unable to sign in to the mobile app against a self-hosted OpenProject instance. The app reports a TLS/certificate verification error or just an "Unable to sign" in error, even though the site opens normally in a web browser.

####   

#### Possible cause

Your server is sending an incomplete certificate chain — only the server (leaf) certificate, without the intermediate CA certificate(s) that link it to a trusted root.

Web browsers often hide this problem: they can automatically download the missing intermediate certificate (via "AIA fetching") or reuse one they've cached from another site. Mobile app HTTP clients do not do this — they require the server to present the full chain during the TLS handshake. This is why the same server works in a browser but fails in the app.

This is a server configuration issue, not an app bug.

####   

#### How to confirm

Test your server with one of the following:

*   Online: Run SSL Labs Server Test (`https://www.ssllabs.com/ssltest/analyze.html?d={YOUR_BASE_INSTANCE_URL_HERE}`). If you see "_Chain issues: Incomplete_," this is your problem.
    
*   Command line:  
    `openssl s_client -connect your-server.com:443 -servername your-server.com </dev/null`  
    Look at the Certificate chain section. If it lists only entry 0 (the leaf) with no intermediate entries (1, 2, …), or you see Verify return code: 21 (unable to verify the first certificate), the chain is incomplete.
    

####   

#### How to fix

Reconfigure your web server to serve the full certificate chain (leaf certificate followed by the intermediate certificate(s)):

*   nginx: Point ssl\_certificate at a full-chain bundle, not the leaf-only file:  
    cat your\_domain.crt intermediate.crt &gt; fullchain.crt  
    (Order matters — leaf first, then intermediates.)
    
*   Let&#x27;s Encrypt / Certbot: Use fullchain.pem, not cert.pem.
    
*   Apache: Provide the intermediate certificate(s) via SSLCertificateFile (bundle) or SSLCertificateChainFile on older versions.
    
*   Load balancer / reverse proxy / CDN (AWS ALB, HAProxy, Cloudflare, IIS, etc.): Fill in the &quot;intermediate certificate&quot; field, which is often left empty.
    

After updating, re-run the SSL Labs test to confirm the chain issue is gone, then retry signing in from the app.