The certificate chain: how a browser decides to trust a site
2 min read
How SSL certificate chains work: the roles of server, intermediate and root certificates, how the trust path is built, and the four places where chains break.
Three links: server, intermediate, root
Your browser never trusts a server certificate directly. Trust is built through a chain: the site's server certificate is signed by an intermediate, and the intermediate is signed by a root that ships inside the browser's own trust store. The browser verifies each signature link by link; if the path reaches a known root unbroken, the padlock is green.
Why don't roots sign directly? Security: root keys live in offline vaults, and day-to-day signing is delegated to intermediates. If an intermediate key leaks, only it gets revoked; the root survives.
Where chains break
Four classic failure points: the server not sending the intermediate (incomplete chain), one link expiring, a broken signature relationship (wrong order or an unrelated intermediate), and the chain ending at an untrusted root (self-signed or a private corporate CA).
Seeing the chain with your own eyes
Query any domain in SSLx and the chain is drawn card by card: each link's role (SERVER / INTERMEDIATE / ROOT), its dates and issuer; every signature link is verified individually and a broken one is marked in red. The badge on top gives the same verdict a browser would — from a real handshake performed with verification enabled.
Test your own site
SSLx performs every diagnosis in this guide in ten seconds: chain verification, hostname matching, expiry and HSTS — free, no signup.
Test with SSLxFrequently asked questions
Should I install the root certificate on my server too?
No need. Browsers carry roots in their own stores; the server's job is to send the server + intermediate certificates. Sending the root as well is not an error, just unnecessary.
My chain works on one device but not another — how?
Clients differ in their root stores and in whether they repair missing intermediates from cache. Old devices may not know new roots. An independent external test (SSLx) shows what the server actually sends and ends the guessing.