What an SSL certificate chain is
An SSL certificate chain is a series of certificates that connects your website's certificate back to a root certificate your browser already trusts. Your website's certificate alone is not enough—the chain proves that a trusted authority vouched for it. Without the chain, your browser has no way to verify that the certificate is legitimate, and it will show a security warning instead of the padlock icon.
Think of it like a notary chain: you have a document (your website), a notary who signed it (your certificate), and the notary's own credentials from a higher authority (the intermediate certificate), which traces back to an official government seal (the root certificate). Each link in the chain proves the one before it is real.
Key Takeaways
- An SSL certificate chain consists of three parts: your website's certificate, one or more intermediate certificates, and a root certificate that browsers already trust.
- Your web server must send the complete chain to visitors' browsers, or the browser will reject the certificate and show a security warning.
- If the chain is broken or incomplete, your website will appear unsafe even though your certificate itself is valid.
- Certificate authorities maintain the root certificates that anchor the entire chain, and browsers update their list of trusted roots periodically.
The three parts of a certificate chain
Every SSL certificate chain has three layers. The first is your end-entity certificate—the one issued directly to your domain. It contains your website's public key and is signed by an intermediate certificate authority.
The second layer is the intermediate certificate (sometimes called an intermediate CA certificate). This certificate is issued by a root certificate authority and is used to sign your website's certificate. Most chains have one intermediate, but some have two or three. The intermediate proves that a trusted authority approved your certificate.
The third layer is the root certificate. This is the certificate at the very top of the chain, issued by a major certificate authority like DigiCert, GlobalSign, or Let's Encrypt. Your browser comes pre-loaded with a list of trusted root certificates. If your chain traces back to one of these roots, the browser trusts the entire chain.
Why your server must send the whole chain
When a visitor opens your website, their browser receives your certificate and checks whether it can verify the signature on it. To do that, the browser needs the intermediate certificate's public key. If your server does not send the intermediate certificate, the browser cannot complete the verification and will show a security error.
Your web server is responsible for sending the complete chain—your certificate plus all intermediates—to every visitor. The root certificate does not need to be sent because the browser already has it. If you installed only your end-entity certificate on your server and forgot the intermediate, visitors will see a warning even though your certificate is perfectly valid.
This is one of the most common SSL certificate problems. The certificate itself is fine, but the chain is incomplete, so the browser cannot trust it.
How to check if your chain is complete
You can verify your certificate chain using online tools or command-line utilities. One straightforward method is to use the SSL Labs SSL Server Test (run by Qualys), which scans your website and reports whether the chain is complete and correctly ordered.
From the command line, you can use OpenSSL to inspect your certificate file. The command openssl x509 -in your-certificate.crt -text -noout will display your certificate's details, including the issuer information that tells you which intermediate signed it. You can then check whether that intermediate is present on your server.
If your hosting provider or certificate authority gave you a bundle file (often named something like ca-bundle.crt or intermediate.crt), that file contains the intermediate certificates you need to install alongside your end-entity certificate.
What happens when the chain is broken
If your chain is incomplete or broken, visitors will see different warnings depending on their browser. Chrome and Firefox typically show "Your connection is not private" or "This site's security certificate is not trusted." Safari shows a similar message. The padlock icon disappears, and many visitors will leave the site rather than click through the warning.
Search engines like Google also penalize websites with broken SSL chains. A site that shows security warnings ranks lower in search results and may be flagged as unsafe in search listings. This affects both trust and traffic.
The fix is straightforward: install the complete chain on your server. Your certificate authority should provide the intermediate certificate bundle when you purchase or renew your certificate. If you are unsure which file to install, contact your hosting provider's support team—they can tell you exactly where to place the intermediate certificate file in your server configuration.
Root certificates and browser trust
Your browser comes with a built-in list of trusted root certificates, usually 50 to 100 of them. These roots are maintained by major certificate authorities and are updated periodically as new roots are added and old ones are retired. When a certificate chain traces back to one of these roots, your browser trusts it.
If a certificate chain traces back to a root that is not in your browser's trust store, the browser will reject it. This can happen if a website uses a certificate from a very new or regional certificate authority that has not yet been added to browsers' trust lists. It can also happen if someone is using a self-signed certificate (one that signs itself instead of being signed by a trusted authority).
Certificate authorities must meet strict security and audit requirements to have their root certificates included in browsers. This is why using a certificate from a recognized authority matters—it ensures your chain will be trusted by visitors worldwide.
Certificate chain order and validation
The order of certificates in your chain matters. Your server must send them in the correct sequence: your end-entity certificate first, then the intermediate certificate (or certificates, if there are multiple), but never the root. The browser will use its own copy of the root certificate to verify the chain.
When your browser receives the chain, it validates it from the bottom up. It checks that your certificate was signed by the intermediate, that the intermediate was signed by the root, and that the root is in its trust store. If any link fails, the entire chain is rejected.
Some server software makes it straightforward to configure the chain correctly—you paste all the certificates into a single file in the right order. Other setups require you to specify the certificate and chain separately. Your hosting provider's documentation or support team can walk you through the correct configuration for your specific server type.
Frequently Asked Questions
Do I need to install the root certificate on my server?
No. Your server sends only your end-entity certificate and the intermediate certificates. The root certificate is already installed in every visitor's browser, so you do not need to send it. Sending the root certificate will not break anything, but it is unnecessary.
What if I have multiple intermediate certificates in my chain?
Some certificate authorities use multiple levels of intermediates. Your server should send all of them in order, from your certificate up to (but not including) the root. Your certificate authority will provide a bundle file with all the intermediates in the correct order.
Can I use a self-signed certificate instead of a chain?
A self-signed certificate does not have a chain—it signs itself. Browsers will always show a security warning for self-signed certificates because there is no trusted authority vouching for it. Self-signed certificates are useful only for testing or internal networks where you control all the browsers.
How often do certificate chains change?
Your certificate chain changes when you renew your SSL certificate or switch to a different certificate authority. Root certificates are updated by browsers periodically, but you do not need to do anything—your browser handles the updates automatically. Your server's chain configuration stays the same unless you change your certificate.
What if my certificate authority goes out of business?
If a certificate authority shuts down, browsers will eventually remove its root certificate from their trust store. Websites using that authority's certificates will stop working. This is rare, but it is why using a well-established certificate authority matters. Major authorities like DigiCert, GlobalSign, and Let's Encrypt have been operating for years and are unlikely to disappear.