SSL chain checker
This SSL chain checker validates the complete certificate chain your server presents — the leaf, every intermediate, and the root — the same way a browser does. A missing or expired intermediate breaks some visitors while your own machine works fine, and this check finds it in seconds. No signup.
Free instant check. No signup, no email, no crawler — we read the certificate your server presents to real visitors.
What the check covers
The whole chain, validated together
Your certificate is only trusted if every link between it and a trusted root checks out. The checker walks the chain your server actually sends and verifies each signature and validity window.
Missing intermediates
The classic "works on my machine" TLS bug. Your browser has the intermediate cached, so the site works for you. A fresh device or a strict client gets a broken chain and a security error. The check sees exactly what a fresh client sees.
Expired intermediates and roots
When the AddTrust root expired in 2020, sites with valid leaf certificates broke worldwide because a link higher up the chain had lapsed. The check validates the dates on every certificate in the chain, not just yours.
Ongoing chain monitoring
CertPost re-validates the full chain on every scheduled check and alerts you when it breaks, so a chain problem introduced by a re-issue or a CA change does not wait for a customer to report it.
Common questions
What is an SSL certificate chain?
Browsers do not trust your certificate directly. They trust a small set of root authorities, and your certificate is trusted because a chain of signatures connects it to one of those roots, usually through one or two intermediate certificates. If any link is missing, expired, or invalid, the whole chain fails.
Why does my site work for me but show a certificate error for others?
Usually a missing intermediate certificate. Your browser cached the intermediate from an earlier visit to another site, so it can complete the chain on its own. A visitor without that cache cannot, and gets a security warning. The chain checker shows what a fresh client sees.
How do I fix an incomplete certificate chain?
Configure your server to send the full chain: your certificate plus the intermediate bundle your CA provided, usually a fullchain.pem or ca-bundle file. Then re-run the check to confirm every link validates.
Does the checker validate the chain on non-HTTPS ports?
Yes. Use host:port syntax, e.g. mail.example.com:993. Mail servers are where broken chains hide longest, because mail clients often fail quietly.