Certificate Chain Visualiser
Visualise certificate chains from server to root CA.
No result yet
Enter a domain or paste a PEM chain to see the path from leaf to root.
What this check means
Browsers trust your certificate because it chains to a root they already know: your leaf certificate is signed by an intermediate, which is signed by a root certificate authority. This tool shows that path link by link, with the expiry of each certificate along the way.
Common issues
- Missing intermediate — the most common chain problem. Some clients fill the gap silently; others fail with a trust error.
- Expired intermediate — the leaf can be perfectly valid while an intermediate above it has expired.
- Root included in the server bundle — harmless but unnecessary; clients use their own trust store for the root.
How to fix them
Install the full chain file (often called fullchain.pem) provided by your certificate authority,
keep intermediates up to date when you renew, and re-run the check after every deployment.
Related tools
Decode any single link with the certificate decoder, or follow the handshake that delivers the chain in the visual TLS handshake.