GuideHow to check your certificate chain

Enter your domain. The tool connects to port 443 and fetches the exact chain your server presents to browsers.
Read the chain top to bottom. Leaf (your certificate) → intermediate(s) → root. Each link should be "issued by" the one below it.
Look for a gap. If the chain stops before reaching a trusted root, an intermediate is missing — that's what breaks trust on some devices.
Fix the server bundle. Reinstall the certificate with the full chain (leaf + intermediate) so every client can build a path to the root.

What a certificate chain is

Browsers don't trust your certificate directly. They trust a small set of root certificates, and your certificate is linked to one of them through one or more intermediate certificates. That linked path — leaf → intermediate → root — is the chain of trust. If any link is missing, the browser can't connect your certificate to a root it trusts, and it shows the site as not secure.

Why chains break

Intermediate not installed. The certificate file was installed without the intermediate bundle — the single most common cause.
Wrong order in the bundle. Some servers require leaf first, then intermediate; the wrong order can break the path.
Outdated intermediate. The CA rotated its intermediate and the old one is still on the server.
"Works for me" trap. Your browser cached the intermediate from another site, so it looks fine to you but fails for first-time visitors.

To see the leaf certificate's own fields (SAN, expiry, issuer), pair this with the SSL Certificate Checker or decode a PEM with the SSL Decoder.

Frequently asked questions

What's the difference between an intermediate and a root certificate?

The root is the ultimate trust anchor, pre-installed in browsers and operating systems. Intermediates sit between your certificate and the root so the CA doesn't sign directly with its root key. Your server must serve the intermediate; the root it does not.

Why does my site work in Chrome but fail in another client?

A missing intermediate. Chrome may have cached it from a previous site or fetched it automatically; stricter clients (some mobile apps, curl, older systems) don't, so they see a broken chain.

Do I need to install the root certificate too?

No. Serve the leaf and the intermediate(s). The root already lives in the client's trust store — sending it is unnecessary and adds overhead.

How do I fix a missing intermediate?

Reinstall using the full-chain bundle your CA provides (leaf plus intermediate), then re-run this checker to confirm the path reaches a trusted root.

Want a clean chain from the start? Get a certificate with the full bundle.

Compare SSL plans →