Certificate chains connect your server's certificate to a trusted root CA through intermediate certificates. Understanding chains helps diagnose SSL errors.
Chain of Trust
Root CAs are trusted by browsers and operating systems—their certificates are pre-installed. For security, root CAs don't sign end-entity certificates directly. Instead, they sign intermediate certificates, which sign your server's certificate. This chain—root → intermediate → server—establishes trust.
Intermediate Certificates
Your server must send intermediate certificates along with its own certificate. Missing intermediates cause "certificate not trusted" errors even with a valid certificate. Certificate providers include intermediates in their installation instructions. SSL checkers verify the complete chain is present.
Common Chain Problems
Missing intermediates cause the most common SSL errors—the certificate is valid, but browsers can't verify it. Expired intermediates (rare) also break chains. Self-signed certificates have no chain and always show warnings. Cloud platforms and CDNs typically handle chain configuration automatically.
Cross-Signed Certificates
New CAs may "cross-sign" with established CAs for broader trust. Let's Encrypt initially cross-signed with IdenTrust for compatibility with older systems. Cross-signing creates multiple valid chain paths. Modern browsers handle this automatically.