SSL & Security
Certificate Chain Checker
Check a Certificate Chain
https://
:
Builds the certificate path from the leaf up through each intermediate to a trusted root — verifying issuer links, validity dates and signature strength at every level.
Certificates are public — nothing is stored, and private keys are never used
Tool features
4 checks
Live host or pasted bundle
Fetch the chain a server actually presents on any port, or paste a PEM bundle before you deploy it.
Order detection
Arranges certificates leaf → intermediate → root and flags anything sent out of order.
Missing-intermediate check
Spots gaps in the chain that break Android, Java, curl and API clients even when Chrome looks fine.
Corrected bundle
Copy or download a correctly-ordered bundle with the self-signed root left out, ready to install.
What is a certificate chain & how it works
An SSL certificate chain links your domain's certificate to a root certificate that browsers and operating systems already trust. Your server has to send the leaf certificate plus every intermediate in between, so a client can walk the signatures up to a root it recognises.
If an intermediate is missing or the certificates arrive in the wrong order, strict clients reject the connection even though the certificate itself is valid. This tool reads the chain, checks each issuer/subject link and expiry, and rebuilds a bundle in the order servers expect.
Leaf
The end-entity certificate issued for your domain; always first in the bundle.
Intermediate
CA certificates that bridge the leaf to the root; the server must send them.
Root
The self-signed trust anchor built into clients; normally left out of the bundle.
How to use this tool
1
Provide the chain
Paste your full PEM bundle (leaf + intermediates), or enter a hostname to fetch the chain a live server presents.
2
Check the order
The tool arranges certificates leaf → intermediate → root and flags anything out of order.
3
Fix the gaps
Missing-intermediate, expired, and unrelated-certificate problems are called out with how to fix them.
4
Deploy the bundle
Copy or download the corrected, correctly-ordered bundle and install it on your server.
Related tools
4 tools
SSL Checker
Comprehensive SSL certificate analysis including validity, expiration, chain verification, TLS versions, and security assessment
Certificate Decoder
Decode and analyze SSL certificate contents, properties, and metadata in detail
Certificate Converter
Convert SSL certificates between PEM, DER, PKCS#7 (P7B) and PKCS#12 (PFX) formats securely in memory
SSL Scanner
Advanced SSL/TLS security scanner with comprehensive vulnerability assessment and configuration analysis
Frequently asked questions
5 Q&A
Leaf (your domain) first, then each intermediate, ending just before the root. Most servers (Nginx, Apache, HAProxy) require this exact order in the bundle. The root certificate should normally be omitted — clients already trust it.
No. Clients ship with trusted root certificates, so sending the root just adds bytes to the handshake. Send the leaf and intermediates only. This tool's corrected bundle excludes a self-signed root automatically.
The leaf (or end-entity) certificate is issued for your domain. Intermediates are issued by the root to the leaf, forming a chain of trust. The root is the self-signed certificate at the top that clients trust directly. Verification walks leaf → intermediate → root.
No. Pasted certificates are analyzed in server memory and discarded immediately. Host checks open a standard TLS connection to read the presented chain and nothing is logged or retained. Certificates are public information; private keys are never involved.