The direct answer
Check the contents of the public PEM bundle, not only whether it downloads. Missing intermediates, repeated certificates or multiple VMCs can prevent a receiver from validating the intended chain.
What should the bundle contain?
The VMC fetch-and-validation Internet-Draft describes the end-entity VMC followed by its issuing chain, with the root optional. Revision 11 also allows rejection of bundles containing repeated certificates, multiple VMCs or an unsuitable order. This is work-in-progress guidance; follow the issuer’s delivery instructions and the receiver’s current requirements.
A common handoff error is combining an old bundle with a renewed one. More certificate blocks do not necessarily provide better evidence.
How should I investigate the failure?
Save the validator’s exact error and compare the hosted bundle with the issuer’s supplied file. Confirm which end-entity certificate is intended, then ask the issuer about missing or unexpected chain elements.
Avoid removing blocks at random until the error disappears. Publish the corrected public bundle, retrieve it again from the actual URL and re-run validation. Separately check validity dates, revocation and domain coverage; a correctly assembled chain does not establish all three.
Sources & further reading
Provider guidance checked on . Requirements can change; check the original guidance when implementing. Planning checklists and examples are BIMI World’s editorial suggestions.