Certificate chain validation: leaf, intermediate, root

A browser does not trust your certificate on its own. It trusts a chain: your leaf certificate is signed by an intermediate certificate, which is signed by a root the browser already trusts. Every link in that chain has to be present and valid for the connection to succeed. Chain validation is the check that the whole chain, as the server presents it, still holds.

The failure that catches people out is an expired or missing intermediate. Your own certificate can be perfectly valid while a certificate above it has lapsed, and browsers reject the connection anyway. Because the leaf date still looks fine, a monitor that only reads days-until-expiry stays green while visitors get security errors. This is not hypothetical: when a widely used root expired in 2020 it broke thousands of sites whose own certificates had not changed, and expired-certificate outages have taken down mobile networks and major services.

Validating the chain means reading every certificate the server sends, confirming each is signed by the next, and tracking the earliest expiry across all of them — not just the leaf. A server can also serve an incomplete chain, omitting an intermediate that some clients happen to cache and others do not, which is why the check has to look at what is actually presented on the wire rather than what should be there.