SSL Chain Validator
Validate a domain's SSL certificate chain over a real connection. Detect missing intermediates and confirm the chain is trusted. Free, live results.
Validate the SSL chain
Enter a domain to inspect its full certificate chain and check it is complete and trusted.
What this chain validator does
Common use cases
- 1Fixing "certificate not trusted" errors
- 2Diagnosing a missing intermediate certificate
- 3Verifying your server sends the full chain
- 4Checking a chain after installing a certificate
- 5Confirming mobile and older clients will trust you
- 6Auditing a certificate deployment
Related tools
About the SSL certificate chain
A certificate proves trust through a chain: your leaf certificate is signed by an intermediate, which is signed by a trusted root. Browsers only trust your site if they can build this chain to a root in their store — and your server must serve the leaf plus the intermediate(s).
The single most common HTTPS mistake is a missing intermediate: it often works in one browser but fails in others or on mobile. This validator opens a real connection, shows every link, and tells you whether the chain is complete and trusted.
More Free Tools Where This Came From
This utility is one of dozens of free, no-login tools for DNS, email, SEO and developers — all instant and private.
HostCloud.in · Pune, India · Serving 34,987+ Websites Since 2020
Got Questions? We Have Answers.
What is a certificate chain?
It is the sequence linking your leaf certificate to a trusted root through one or more intermediate certificates. Browsers trust your site only if this chain is complete and valid.
What is a missing intermediate?
When your server sends only the leaf certificate, some clients cannot build the chain to a root and show a "not trusted" error. Serving the intermediate(s) fixes it.
Why does it work in Chrome but fail elsewhere?
Chrome sometimes fetches or caches a missing intermediate; other browsers and mobile devices do not. A complete chain avoids these inconsistent failures.
How do I fix a broken chain?
Install the full chain (leaf plus intermediates) your CA provides, in the correct order, in your web server or load balancer configuration.
Does this connect to my server?
Yes. It performs a real TLS handshake and reads the exact chain your server serves.
Where does the root come from?
Roots live in the client's trust store, not on your server. You only need to serve the leaf and intermediates; the validator confirms it chains to a trusted root.