What is an SSL certificate chain?
An SSL certificate chain is the sequence of certificates that connects the one your server presents to a root that browsers already trust. The chain has three parts: the leaf certificate issued for your hostname, one or more intermediate certificates owned by the certificate authority, and a root certificate that ships inside the operating system or browser trust store.
Browsers do not trust your leaf certificate directly. They trust it because it was signed by an intermediate, and the intermediate was signed by a root they hold. Validation walks that path signature by signature. If any link is missing, expired, or signed by an untrusted key, the whole chain fails and the visitor sees a warning, no matter how valid your own certificate is.
The server is responsible for sending the leaf plus the intermediates in the handshake. The root is deliberately left out, because clients must use their own copy. The classic failure is a server configured with only the leaf: it works in browsers that cache or fetch the missing intermediate, then fails on the clients that do not, which makes the problem look random. The other classic failure is an expired intermediate. When the AddTrust root expired in May 2020, servers that still served the old cross-signed chain broke for millions of clients while every leaf certificate involved was still valid.
Chains change more often than most teams expect. Certificate authorities rotate intermediates, retire cross-signatures, and re-issue chains, and each rotation is a chance for a server to serve a stale bundle. A check that only looks at your certificate expiry date will miss all of it, because chain problems live in the certificates between yours and the root.
Source: RFC 5280 (certification path validation)
Common questions
What order should the certificate chain be in?
Leaf first, then each intermediate in signing order, ending nearest the root. TLS 1.3 relaxed the strict ordering rule, but clients still exist that only accept the leaf-first order, so serve it that way.
Do I need to include the root certificate?
No. Clients validate against the root in their own trust store, so sending the root adds bytes to every handshake without helping validation. Send the leaf and the intermediates.
Why does my site work in Chrome but fail elsewhere?
That pattern usually means an incomplete chain. Chrome can fetch or cache missing intermediates; many other clients, and most non-browser software, cannot. The fix is to serve the full chain from the server.
Reading up because something broke? Check the certificate you actually serve — 3 monitored free, no card.