Certificate Chain Checker
The most common SSL/TLS misconfiguration is an incomplete or out-of-order certificate chain: a browser may trust it, but some clients, mobile apps and older systems fail because an intermediate certificate is missing.
Certificates
Paste one or more PEM certificates (-----BEGIN CERTIFICATE-----), in any order — the whole chain is fine. They are ordered and verified automatically.
Check your SSL certificate chain online
The most common SSL/TLS misconfiguration is an incomplete or out-of-order certificate chain: a browser may trust it, but some clients, mobile apps and older systems fail because an intermediate certificate is missing. This tool takes the certificates you paste (in any order) and orders them leaf → intermediate → root entirely in your browser, verifies that each certificate is signed by the next, and clearly flags missing intermediates, broken links, self-signed roots and certificates that are expiring or already expired.
Everything runs client-side with node-forge — pasted certificates are only parsed in your browser, never uploaded, which you can confirm in your browser's Network panel. Once analyzed, you can copy or download the reordered full-chain PEM and drop it straight into your Nginx, Apache or load balancer configuration.
Frequently asked questions
Why does the certificate chain order matter?
A TLS certificate list starts with the leaf certificate, followed by intermediates needed to build a trust path. The root is normally configured in the client’s trust store and can be omitted. Sending a root does not automatically establish trust.
How do I know if I'm missing an intermediate?
A missing issuer means the supplied input lacks a matching issuer certificate. Obtain intermediates from the issuer and recheck. A complete signature chain does not establish client trust and does not replace hostname or revocation checks.
Are my certificates uploaded?
This tool processes certificate or key inputs locally in the browser without sending them to a server for computation. Page-resource loading and tool computation are separate processes; inspect requests in the browser network panel.
Why does a link show as failing when my browser trusts it?
This tool verifies signatures with node-forge, which is most reliable for RSA chains; some algorithms such as EC may not verify and get flagged even though the certificate is valid. In that case, use the Certificate Decoder to cross-check each subject, issuer and validity period.
References and result limitations
Local results depend on the input and selected options. Retain the input example, format and processing rules when citing a result, and verify the output. Keep keys and other sensitive material out of public examples.
These references explain protocol or format rules; they do not endorse results produced by this site.