JSONToTable
Loading SSL Certificate Chain Validator...
Please wait a moment

How to Validate SSL Certificate Chains - Complete Guide

Step 1

Gather Your Certificate Chain

Collect all certificates in your chain in PEM format. A complete chain typically includes three types of certificates as defined by RFC 5280:

•
End-Entity Certificate: Your domain's SSL certificate (e.g., example.com)
•
Intermediate Certificate(s): CA's signing certificates that bridge your cert to the root
•
Root Certificate: Trusted CA root (optional - browsers have these built-in)

Example: Getting Certificates from Server

Use OpenSSL to download your server's certificate chain:

# Download certificate chain
openssl s_client -connect example.com:443 -showcerts < /dev/null

# Save to file
openssl s_client -connect example.com:443 -showcerts \
  < /dev/null | sed -n '/BEGIN CERT/,/END CERT/p' > chain.pem
Step 2

Paste Certificate Chain

Paste your complete certificate chain into the validator. Each certificate should be in PEM format with proper markers:

•
Correct Order: End-entity → Intermediate(s) → Root (top to bottom)
•
PEM Format: Each certificate wrapped in BEGIN/END CERTIFICATE markers
•
No Private Keys: Only certificates, never include private keys

Example: Proper Certificate Chain Format

A correctly formatted certificate chain with multiple certificates:

-----BEGIN CERTIFICATE-----
MIIDXTCCAkWgAwIBAgIJA... (Your domain certificate)
...
-----END CERTIFICATE-----

-----BEGIN CERTIFICATE-----
MIIEkjCCA3qgAwIBAgIQC... (Intermediate CA certificate)
...
-----END CERTIFICATE-----

-----BEGIN CERTIFICATE-----
MIIDdzCCAl+gAwIBAgIEA... (Root CA certificate - optional)
...
-----END CERTIFICATE-----
Step 3

Review Validation Results

The validator performs comprehensive checks following NIST guidelines and displays detailed results:

•
Chain Order Verification: Confirms certificates are in correct sequence
•
Validity Check: Verifies each certificate's expiration dates
•
Trust Path Analysis: Ensures proper issuer-subject relationships
•
Root Detection: Identifies if root certificate is included

Example: Common Validation Issues

Issues you might encounter and how to fix them:

❌ Missing Intermediate: Download from your CA and add between end-entity and root
❌ Wrong Order: Rearrange: domain cert first, then intermediates, root last
❌ Expired Certificate: Renew the certificate before continuing
⚠️ No Root Certificate: Usually okay - browsers have trusted roots built-in
Step 4

Fix Issues and Deploy

Address any validation errors or warnings, then deploy your corrected certificate chain to your web server:

•
Apache: Use SSLCertificateFile and SSLCertificateChainFile directives
•
Nginx: Concatenate all certificates into one file for ssl_certificate
•
IIS: Import complete chain via certificate management console

Example: Nginx Configuration with Full Chain

Configure Nginx to use your validated certificate chain:

# Create fullchain.pem with certificate + intermediates
cat domain.crt intermediate.crt > fullchain.pem

# Nginx configuration
server {
    listen 443 ssl http2;
    server_name example.com;
    
    ssl_certificate /path/to/fullchain.pem;
    ssl_certificate_key /path/to/private-key.pem;
    
    # Test configuration
    # nginx -t
    
    # Reload Nginx
    # systemctl reload nginx
}

Frequently Asked Questions

What is an SSL certificate chain?

An SSL certificate chain is a sequence of certificates that establish trust from your server's certificate back to a trusted root Certificate Authority (CA). It typically includes your domain certificate (end-entity), one or more intermediate CA certificates, and optionally the root CA certificate. Each certificate in the chain is signed by the next one, creating a verifiable trust path.

Why is certificate chain validation important?

Proper chain validation is critical for SSL/TLS security. An incomplete or incorrectly ordered chain causes browser warnings, failed connections, and lost user trust. Mobile browsers and some desktop browsers are particularly strict about requiring complete chains. Following CA/Browser Forum baseline requirements ensures maximum compatibility and security.

What order should certificates be in?

The correct order is: (1) Your domain's certificate (end-entity) first, (2) Intermediate CA certificate(s) next, and (3) Root CA certificate last (optional). Each certificate's "Issuer" field should match the next certificate's "Subject" field. Most servers expect this order when you concatenate certificates into a single file.

Should I include the root certificate in my chain?

Generally no - browsers and operating systems come with trusted root certificates pre-installed. Including the root certificate is optional and actually slightly increases bandwidth usage. However, for some enterprise applications or API clients with custom trust stores, you may need to include it. Check your specific deployment requirements.

How do I get missing intermediate certificates?

Download intermediate certificates from your CA's website. Most CAs (Let's Encrypt, DigiCert, Sectigo) provide a "Certificate Bundle" or "Chain" file when you get your certificate. You can also use online tools like SSL Labs Server Test to identify which intermediates are needed, or check your certificate's "Authority Information Access" (AIA) extension for the issuer's certificate URL.

What causes "certificate chain incomplete" errors?

This error means your server isn't sending all required intermediate certificates. Common causes: (1) Only installed the domain certificate without intermediates, (2) Intermediate certificate file misconfigured in server settings, (3) Certificates in wrong order, or (4) Using an old/expired intermediate certificate. Test your server with SSL Labs to diagnose the exact issue.

Can I validate certificates for expired or revoked CAs?

Yes, this tool will detect expired certificates and warn you about trust issues. However, it cannot check Certificate Revocation Lists (CRL) or OCSP status in real-time. For production validation including revocation checks, use browser developer tools or specialized tools like OpenSSL's verify command with CRL/OCSP checking enabled.

How often should I validate my certificate chain?

Validate your certificate chain: (1) Before initial deployment, (2) After certificate renewal, (3) When you notice browser warnings, (4) After server configuration changes, and (5) Periodically (monthly or quarterly) as part of security audits. Automated monitoring tools can check your live server's certificate chain 24/7 and alert you to upcoming expirations or configuration issues.

Related Tools

SSL Checker

Check SSL certificates on live websites - view validity, expiration dates, issuer details, and security status instantly

SSL Certificate Converter

Convert SSL certificates between formats: PEM (text), DER (hex), CRT (PEM file), CER (DER file) with auto-detection

SSL Certificate Decoder

Parse and view SSL/TLS certificate details including subject, issuer, validity, public key, extensions, and fingerprints

CSR Decoder

Decode and verify Certificate Signing Requests (CSR) to view subject, public key, and signature details before submission

CSR Generator

Generate Certificate Signing Requests (CSR) with private and public keys for SSL/TLS certificates using RSA or ECDSA

Self-Signed Certificate Generator

Generate self-signed SSL certificates for testing and development environments with RSA or ECDSA keys