Certificate Chain Explained

Reading time: 5 min

What is a Certificate Chain?

A certificate chain is a sequence of digital certificates that allows your browser to verify that a website's SSL certificate can be trusted.

Rather than trusting every website individually, browsers trust Certificate Authorities (CAs). The certificate chain connects your website's SSL certificate back to one of these trusted root authorities.

Without a complete certificate chain, browsers may display security warnings even if your SSL certificate is valid.

Why Does a Certificate Chain Matter?

A complete certificate chain helps browsers:

Verify website authenticity
Confirm the certificate was issued by a trusted CA
Establish a secure HTTPS connection
Prevent impersonation attacks
Build user trust

If part of the chain is missing, visitors may receive errors such as:

Certificate not trusted
Incomplete certificate chain
NET::ERR_CERT_AUTHORITY_INVALID

How a Certificate Chain Works

Every SSL certificate belongs to a chain of trust.

1. Root Certificate

The Root Certificate belongs to a trusted Certificate Authority.

Examples include:

DigiCert
Sectigo
GlobalSign
Let's Encrypt

Root certificates are already installed in operating systems and web browsers.

2. Intermediate Certificate

Root certificates do not issue website certificates directly.

Instead, they issue Intermediate Certificates.

These act as an additional layer of security between the root authority and individual websites.

3. Website SSL Certificate

Finally, your website receives its SSL certificate.

When someone visits your website, the server presents:

Website certificate
Intermediate certificate(s)

The browser already has the trusted Root Certificate stored locally.

Chain of Trust

Root Certificate

│

▼

Intermediate Certificate

│

▼

Website SSL Certificate

│

▼

Secure HTTPS Connection

What Happens if the Chain is Broken?

If your web server does not provide the required intermediate certificate(s), browsers cannot verify the chain correctly.

Possible consequences include:

Browser security warnings
Failed SSL validation
Reduced user trust
SEO impact if visitors leave the site
Failed API or application connections

How to Check Your Certificate Chain

You can inspect your certificate chain using:

Browser certificate viewer
OpenSSL
DigiCert SSL Checker
SSL Labs Server Test

These tools identify missing or incorrectly configured intermediate certificates.

Frequently Asked Questions

Is the Root Certificate sent by the server?

No.

Browsers already trust and store root certificates locally.

Why are Intermediate Certificates used?

They improve security by protecting the Root Certificate while allowing Certificate Authorities to issue millions of SSL certificates safely.

Can my SSL certificate be valid but still show errors?

Yes.

The certificate itself may be valid, but an incomplete certificate chain can still trigger browser warnings.