Glossary / certificate chain

What is a certificate chain

A certificate chain is the sequence of certificates that links your site's certificate to a root certificate authority the browser already trusts. Intermediate certificates sit in between. If the chain is incomplete, the browser cannot confirm trust and shows an error, even when the site's own certificate is valid.

A browser does not trust every certificate on its own, only a short list of root authorities built into the system. Your site's certificate is signed by an intermediate authority, which is signed by a root. The browser walks this chain from the site up to the root, and if all the signatures line up, it treats the site as trusted.

The key detail is the intermediate certificates. The server must send them along with the site's certificate. If an admin forgets to include the intermediate, desktop browsers sometimes fetch it themselves, but mobile browsers and apps often do not, and an error appears.

A classic symptom of a broken chain is a site that opens in one browser but fails in another or inside an app. An online SSL check shows whether every intermediate link is in place.

Example

leaf: example.com > R11 (intermediate) > ISRG Root X1

Common mistakes

• Installing only the site certificate without the intermediates. The chain then breaks and some clients see an error.
• Trusting that the site opened in your browser. Desktop may build the chain itself, but a phone will not.
• Confusing root and intermediate certificates. The root is already in the browser, it is the intermediates you must serve.
• Ignoring an SSL test warning about an incomplete chain, because it is a gamble who can open the site.

Related terms

• SSL certificate What is an SSL certificate
• TLS What is TLS
• HTTPS What is HTTPS
• wildcard certificate What is a wildcard certificate
• Let's Encrypt What is Let's Encrypt