Chain · signatures · AIA
Certificate chain checker
Paste the certificates your server sends, or the files your CA gave you, in any order. The checker sorts them from leaf to root, verifies each signature in your browser and says what is missing or wrong.
Certificates
Drop the files from your CA (.crt, .pem, .cer, .der, .p7b) together, or paste the output of openssl s_client -showcerts.
What the checker does
- Orders the certificates by name and key identifier: each certificate’s issuer must be the subject of the next one.
- Verifies every signature with the issuer’s public key using Web Crypto, so a wrong intermediate with the right name is caught.
- Checks expiry, CA flags, key usage and path length on every link, and flags duplicate, unrelated or unnecessary root certificates.
Roots are not required: clients already have them, so a good server chain usually ends at an intermediate issued by a root.
Missing intermediate?
Certificates usually include their issuer’s download address (Authority Information Access), shown in the result. This page cannot fetch it for you: browsers block such requests to other sites, and SSL Glance only contacts the services named in the privacy notice. Download the file yourself, convert it with the PEM ↔ DER converter if needed, and add it to the bundle.
Frequently asked questions
In which order should a server send certificates?
Leaf first, then the intermediate that signed it, then the next one up. Leave the root out. For nginx, put them in one file in that order; Apache 2.4.8 and later reads the same file in SSLCertificateFile.
Why do some browsers accept the chain while others say it is incomplete?
Desktop browsers often fill a gap from a cache or by downloading the missing intermediate themselves; many mobile apps, API clients and curl do not. Always serve the complete chain.
What is a cross-signed certificate?
A second certificate for the same CA, signed by an older root so that older devices still trust it. If your bundle has both versions, keep the one your CA recommends.