diff --git a/plugin/autocert.go b/plugin/autocert.go
index 6217dbd..382de5d 100644
--- a/plugin/autocert.go
+++ b/plugin/autocert.go
@@ -158,6 +158,8 @@ func init() {
 
 				buf = new(bytes.Buffer)
 				pem.Encode(buf, &pem.Block{Type: "CERTIFICATE", Bytes: cert})
+				// Append the CA certificate to complete the chain, so TLS clients can verify it.
+				pem.Encode(buf, &pem.Block{Type: "CERTIFICATE", Bytes: catls.Certificate[0]})
 
 				tlscertStr := buf.String()
 				config.C.TLSCertificate = &tlscertStr