SSL Certificate Chain Viewer
Analyze SSL certificate chains and validation paths
Certificate Analysis
Ready to inspect a certificate chain
Enter a domain above and start the analysis.
Analyzing certificate chain...
Connecting to the host and validating the trust path.
Analysis failed
Server Certificate Details
-
-
-
-
-
-
Certificate Chain Hierarchy
Validation Status
Certificate Info
-
Learn more & FAQ
What does a certificate chain checker do?
A trusted HTTPS connection depends on more than just your domain's own certificate - it depends on an unbroken chain from that certificate up to a root your visitor's browser already trusts. This tool connects to your domain, retrieves every certificate it actually serves, and verifies the chain is complete and in the right order.
How to read your results
Each certificate in the chain is listed from leaf to root, with its issuer, subject, and validity dates. A complete chain shows every link resolving cleanly to a trusted root. If an intermediate is missing, it's flagged directly - that's almost always the fix needed to resolve a "not trusted" error some visitors see while others don't.
Frequently asked questions
What is a certificate chain?
A certificate chain links your domain's certificate (the leaf) up through one or more intermediate certificates to a root certificate that browsers already trust. Every link in that chain has to be present and valid for a browser to trust the connection.
Why do browsers sometimes show a trust error when my certificate looks valid?
The most common cause is a missing intermediate certificate - your server sent the leaf certificate but not the intermediate that links it to a trusted root. Some browsers cache intermediates from other sites and mask the problem, so a site can look fine on one device and broken on another.
What's the difference between the leaf, intermediate and root certificates?
The leaf certificate is issued directly to your domain. Intermediate certificates are issued by the certificate authority to bridge trust. The root certificate sits at the top, pre-installed as trusted in operating systems and browsers - it's never sent by your server directly.
How do I fix a missing intermediate certificate?
Install the full certificate bundle your certificate authority provided (leaf plus intermediates) on your server, rather than just the leaf certificate alone - most CAs provide this as a single "fullchain" or "bundle" file specifically to avoid this mistake.
Does chain order matter?
Yes - certificates should be served leaf-first, followed by intermediates in order up toward the root. A chain served out of order can fail validation in some clients even though every certificate in it is individually valid.