What is a certificate chain?
Browsers don't trust your website's certificate directly. They trust a small set of root certificates built into the operating system or browser. Your certificate is signed by an intermediate certificate, which is signed by a root. That sequence, from your certificate up to the root, is the certificate chain.
Your server has to send your certificate and the intermediates. The root is already on the visitor's device, so it doesn't need to be sent.
What this chain checker shows
- Every certificate the server sends, in the order it sends them, with issuer and validity dates.
- Missing intermediate certificates, the most common chain problem.
- Wrong order or certificates that don't belong in the chain.
- Expired intermediates, which break the chain even when your own certificate is valid.
- The path browsers build to a trusted root, including the root from the trust store.
How to fix a missing intermediate certificate
Point your server at the full chain file from your certificate provider instead of only your own certificate. With Let's Encrypt (certbot) that file is fullchain.pem; other providers call it a CA bundle.
Nginx
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; (not cert.pem).
Apache
SSLCertificateFile /etc/letsencrypt/live/example.com/fullchain.pem. On Apache 2.4.8 and newer the full chain goes in this one file; SSLCertificateChainFile is no longer needed.
Caddy, Traefik and most hosting panels
They send the full chain automatically. If the chain is still incomplete, reissue the certificate from the panel.
After changing the configuration, reload the server and check the chain again.
Why does my site work in Chrome but fail elsewhere?
Desktop browsers often remember intermediates from other sites or download them on their own, which hides a missing intermediate. Many phones, command-line tools like curl, payment providers and APIs don't, so they fail with errors like "unable to get local issuer certificate". The fix is the same: send the full chain.
Questions
Should I include the root certificate in the chain?
No. Browsers use their own copy of the root. Sending it does no harm, but it adds bytes to every connection.
Is this certificate chain checker free?
Yes. Check any public website as often as you like, within a fair rate limit. Results are kept in memory for 5 minutes, then discarded.
What order should the certificates be in?
Your certificate first, then the intermediate that signed it, then the one that signed that intermediate, and so on. The fullchain.pem file is already in the right order.