Certificate Chain

A certificate chain (or chain of trust) is the sequence of certificates from a server's leaf certificate, through one or more intermediate CAs, up to a trusted root CA. Browsers must verify this entire path before establishing a secure connection.

How Certificate Chains Work

When a client connects over TLS, the server presents its leaf certificate along with any intermediate certificates. The client then walks the chain: it checks that the leaf was signed by the first intermediate, that intermediate was signed by the next, and so on until it reaches a root CA that the client already trusts.

Root certificates are pre-installed in the browser or operating system trust store. The server never needs to send the root. It only needs to send the leaf and all intermediates.

Chain Structure

A typical chain has three levels:

• Leaf certificate - issued to your domain. Contains your public key, the domain name(s) in the SAN field, and the issuer (an intermediate CA).
• Intermediate certificate(s) - issued by the root CA. Signs leaf certificates. There can be one or more intermediates in the chain.
• Root certificate - self-signed and pre-installed in trust stores. The ultimate trust anchor.

Leaf:         example.com
                 signed by ↓
Intermediate: Let's Encrypt R3
                 signed by ↓
Root:         ISRG Root X1  (in trust store)

Incomplete Chains

An incomplete chain occurs when the server sends the leaf certificate but omits one or more intermediate certificates. The result depends on the client:

• Desktop browsers - Chrome and Firefox can sometimes fetch missing intermediates using the Authority Information Access (AIA) extension in the leaf cert. This masks the problem.
• Mobile browsers - less likely to perform AIA fetching. Connections may fail outright.
• API clients and CLI tools - curl, wget, and most HTTP libraries do not fetch missing intermediates. They will reject the connection with a certificate verification error.

The worst case: your site works in Chrome on desktop but fails for API consumers and mobile users. Because AIA fetching is silent, you may not notice the problem until it affects customers.

How to Fix an Incomplete Chain

The fix is to configure your web server to send the full chain (leaf + all intermediates).

• Let's Encrypt / ACME clients - use the fullchain.pem file, not cert.pem. The fullchain file concatenates your leaf and the intermediate(s).
• Nginx - set ssl_certificate to point at your fullchain file.
• Apache - use SSLCertificateFile for the leaf and SSLCertificateChainFile for the intermediate(s), or combine them into one file.
• Cloud providers - when uploading certificates, paste the leaf and intermediate PEM blocks together in order.

After deploying, verify the chain using a TLS inspection tool. A correct configuration will show the full path from leaf to root with no gaps.

Inspect your certificate chain with the TLS tool →