A certificate chain, also called the chain of trust, is the ordered series of certificates a client follows to validate a server: the leaf certificate for your domain, one or more intermediate certificates, and a root certificate the client already trusts.
Why it matters
A client trusts your certificate only if it can build a valid path to a root in its own trust store, with each certificate signed by the next one up and none expired or revoked. A break anywhere gives errors such as NET::ERR_CERT_AUTHORITY_INVALID in Chrome or unable to verify the first certificate in Node.js.
Chains also change. When a CA rotates intermediates or an old root expires, servers still sending a stale chain can start failing on some clients while working on others.
Example
Inspect what a server actually sends:
openssl s_client -connect example.com:443 -servername example.com -showcertsLook for the Certificate chain section. Entry 0 is the leaf, 1 is the first intermediate, and each i: issuer line should match the next entry's s: subject line.
Common mistakes
- Sending the root as part of the chain. It is unnecessary and wastes handshake bytes.
- Leaving an expired cross-signed intermediate in the bundle.
- Checking only the leaf expiry date.
Related
Get notified when this term updates
Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.
This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.