CacheUnmanagedCertificatePEMBytes returns only the first certificate and omits intermediate and root certificates. What am I doing wrong?

What is your question?

I'm using CacheUnmanagedCertificatePEMBytes and manage custom TLS for several websites using the following code:

cnf := certmagic.NewDefault() 
cnf.CacheUnmanagedCertificatePEMBytes(
  context.Background(),
  []byte(appConfig.CertValue),
  []byte(appConfig.CertKey),
  nil,
)

// I also manage `on-demand` certificates on the same 
// server for applications that do not define a custom certificate:
certmagic.Default.OnDemand = &certmagic.OnDemandConfig{
  DecisionFunc: myDecisionFunc(),
}

// and finally spin up the server using `HTTPS` method:
certmagic.HTTPS(/* ... */)

Despite passing the full certificate chain to certmagic, the server returns only the first certificate and omits intermediary and root certificates.

Browsers are handling this correctly because they retrieve the missing certificates, but when I use SSL tools, they also throw errors.

What have you already tried?

Include any other information or discussion.

Bonus: What do you use this package for, and does it help you?

I use this at stormkit.io to issue dynamic certificates for hosted apps. Self-hosted enterprise customers usually prefer to host their managed certificates so I have to use a combination between dynamic and managed certificates. It works pretty well, thanks for your work 🙏

Start by tracing CacheUnmanagedCertificatePEMBytes through the HTTPS setup and compare the certificate chain it receives with what the server exposes. Done means determining whether the reported omission is expected behavior or a defect and identifying the required change or configuration; the issue names no files or tests.