Certificate Chains

A certificate chain (or chain of trust) is the ordered list of certificates linking a server's leaf certificate up to a trusted root certificate.

Each certificate is signed by the one above it.

A typical chain has three parts:

• Leaf (end-entity) certificate for the actual server.
• Intermediate certificate(s) that signed the leaf.
• Root certificate that signed the intermediate.

To validate, a client checks each signature going up:

• The root's public key verifies the intermediate.
• The intermediate's public key verifies the leaf.

If every signature checks out and ends at a trusted root, the chain is valid.

You can view the chain a server presents using OpenSSL's s_client.

Chains link by matching fields: a certificate's Issuer equals the Subject of the certificate above it.

A very common error is a server sending only its leaf and forgetting the intermediate.

Some clients then cannot build a path to the root and report an untrusted certificate, even though everything is technically valid.

Servers should send the leaf plus all intermediates (but usually not the root, which clients already have).

This combined file is often called fullchain.pem.

You can verify a chain locally by supplying the trusted root.

Validation is more than signatures. The client also checks:

• Each certificate is within its validity dates.
• The chain is not revoked.
• CA certificates have the CA flag set in basic constraints.
• Key usage and name constraints are respected.

Sometimes a new root is not yet trusted everywhere. Cross-signing lets an older, widely trusted root also sign the new intermediate.

This creates multiple valid paths, improving compatibility with older devices.

Common chain failures include:

• Missing intermediate certificate
• Expired certificate anywhere in the path
• Wrong order in the chain file
• Untrusted or distrusted root

A server presents only its leaf certificate and some clients report it as untrusted. What is the most likely cause?

You learned how a certificate chain links a leaf to a trusted root through intermediates.

• Validation walks the chain, verifying each signature, dates, and revocation.
• Servers should send the full chain to avoid missing-intermediate errors.
• Cross-signing improves compatibility.

Next, we cover the operational tasks of managing certificates.