SSL certificate chain checker

The most common SSL misconfiguration that is not the certificate's fault

A server needs to present not just its own certificate but the intermediate certificate(s) that link it back to a root a browser already trusts. Leave one out, and the certificate itself can be completely valid while some browsers - typically ones without that intermediate cached from another site - still show a trust error. This is consistently one of the most common real SSL misconfigurations, and it looks nothing like "the certificate is wrong" to whoever is diagnosing it.

Reading the roles

• Leaf - the certificate for the domain itself, at the bottom of the chain.
• Intermediate(s) - one or more certificates the CA uses to sign leaf certificates, rather than signing directly with its root (root keys are kept offline and used as rarely as possible).
• Root - the certificate a browser or OS ships with and trusts unconditionally. If the chain reaches one, and every link in between is valid, the chain is trusted.

What "chain problems" reports

Whatever the underlying TLS/X.509 validation actually found wrong while building the chain - an incomplete chain, an expired link anywhere in it, or a name mismatch - rather than a single generic pass/fail.

Related tools

See the full SSL certificate checker for the leaf certificate's own details.