An SSL certificate chain, also called a certificate chain of trust, is an ordered group of digital certificates used to verify the authenticity of a website or server and establish a trusted connection between the server and a user’s browser.
Although the term SSL is still widely used, modern websites use TLS (Transport Layer Security), which replaced the older SSL protocol. The terms SSL and TLS are often used interchangeably when discussing website certificates.
A certificate chain connects a website’s SSL/TLS certificate to a trusted Certificate Authority (CA). Certificate Authorities are organizations responsible for issuing, managing, and revoking digital certificates.
How Do SSL Certificate Chains Work?
An SSL certificate chain creates a relationship of trust between a website’s server certificate and a trusted Certificate Authority.
The chain normally starts with a root certificate, which belongs to a trusted CA. The root CA issues an intermediate certificate, which then signs the website’s server or leaf certificate.
When a user visits an HTTPS website, the browser checks the certificate presented by the server. It verifies the certificate’s validity, domain name, digital signature, and connection to a trusted certificate authority.
Browsers and operating systems contain predefined lists of trusted root CAs. If the certificate chain can be traced back to one of these trusted roots, the browser can establish trust and create a secure connection.
If the chain cannot be validated, the browser may display a security warning instead of treating the connection as trusted.
Components of an SSL Certificate Chain
An SSL certificate chain generally contains three main types of certificates.
1. Server Certificate or Leaf Certificate
The server certificate, also known as the leaf certificate, is the certificate issued to a website’s domain.
Its primary purpose is to verify the identity of the website and enable an encrypted connection between the user’s browser and the server.
When you visit a website over HTTPS, the browser uses this certificate to verify that the server is authorized to represent the requested domain.
A valid certificate helps the browser display HTTPS and the familiar security indicator in the address bar.
2. Intermediate Certificate
The intermediate certificate sits between the server certificate and the root certificate.
Certificate Authorities generally do not sign website certificates directly with their root certificates. Instead, they use intermediate CAs to issue and sign server certificates.
This creates an additional layer between the highly trusted root CA and individual website certificates. The intermediate certificate is itself signed by a trusted root CA.
The intermediate certificate must be correctly configured on the server. If it is missing or incorrectly installed, some browsers, mobile devices, applications, or other clients may be unable to build a complete chain of trust.
3. Root Certificate Authority
The root certificate is the foundation of the certificate chain.
Root certificates are issued and controlled by trusted Certificate Authorities. They are used to establish trust for intermediate CAs, which can then issue certificates for websites and other services.
Root certificates are typically preinstalled in the trusted certificate stores of operating systems and browsers.
Because root certificates form the foundation of trust, Certificate Authorities must maintain strict security, auditing, and management practices around them.
How Many Certificates Are in an SSL Certificate Chain?
A typical certificate chain contains:
- One server or leaf certificate
- One or more intermediate certificates
- A trusted root certificate
The exact number can vary depending on the Certificate Authority and its trust hierarchy.
In practice, the server usually sends the leaf certificate along with the necessary intermediate certificates. The trusted root is generally already available in the client’s trust store rather than being sent by the server.
The important point is that every certificate in the chain must be properly connected and trusted.
What Is the Correct SSL Certificate Chain Order?
The certificate hierarchy is:
Root CA → Intermediate CA → Server/Leaf Certificate
However, when a browser receives the certificate chain from a server, the practical order is generally:
Server/Leaf Certificate → Intermediate Certificate(s) → Root CA
The server certificate is signed by an intermediate CA. The intermediate certificate is then signed by another trusted certificate authority, ultimately leading back to a root certificate trusted by the client’s operating system or browser.
Correct ordering and installation are important because the client needs to build this path of trust successfully.
If an intermediate certificate is missing, incorrectly configured, or presented in the wrong way, certificate validation can fail even when the website’s main certificate itself is valid.
SSL Certificate Chain Example
Consider a website using an SSL certificate issued through Amazon Trust Services.
A simplified certificate chain could look like this:
Amazon Root CA 1
↓
Amazon RSA 2048 M02
↓
*.example.com
In this example:
- Amazon Root CA 1 is the root certificate and represents the trusted foundation.
- Amazon RSA 2048 M02 is the intermediate certificate.
- *.example.com represents the website’s leaf certificate.
The website certificate is issued by the intermediate CA rather than directly by the root CA.
Amazon Trust Services provides publicly trusted certificates through Amazon Web Services and uses a structured certificate hierarchy. Services such as AWS Certificate Manager can be used to request and manage public certificates.
The leaf certificate is connected to one or more intermediate certificates, which ultimately connect to a trusted root CA. If any necessary certificate in this trust path is invalid, expired, revoked, or incorrectly configured, clients may not be able to establish trust.
How Is an SSL Certificate Chain Validated?
When a user visits an HTTPS website, the server provides its certificate information during the TLS connection process.
The certificate contains information such as:
- The domain or entity it was issued to
- The Certificate Authority that issued it
- The certificate’s validity period
- Its public key
- Digital signatures and fingerprints
- Other information required for certificate validation
The client then performs several checks.
1. The Leaf Certificate Is Checked
The browser first checks whether the server certificate is valid and within its permitted validity period.
It also checks whether the certificate was issued by a recognized authority.
2. The Domain Name Is Verified
The browser checks whether the certificate matches the domain the user is attempting to access.
For example, a certificate issued for example.com should not normally be used to authenticate an unrelated domain.
3. Intermediate Certificates Are Verified
The browser checks the digital signatures connecting the server certificate to its intermediate CA.
It continues building the certificate path until it reaches a trusted root.
4. The Root CA Is Checked
Finally, the client checks whether the root certificate is trusted by the operating system or browser.
If the complete chain is valid, the browser can establish a trusted HTTPS connection.
This process happens as part of the broader TLS handshake that takes place before secure communication begins.
What Happens if Certificate Chain Verification Fails?
If the certificate chain cannot be validated, browsers can display warnings such as:
- “Your connection is not private”
- “Not Secure”
- “Warning: Potential Security Risk Ahead”
The exact message depends on the browser and the reason for the failure.
Certificate chain problems can happen for several reasons, including:
- An expired certificate
- A revoked certificate
- An incorrect domain name
- A missing intermediate certificate
- An invalid digital signature
- Incorrect certificate installation
- A certificate issued by an untrusted authority
- Problems in the server’s certificate configuration
Users should generally avoid proceeding through a serious certificate warning unless they understand why it is occurring.
A failed certificate validation can expose users to security risks, including phishing, data interception, and man-in-the-middle attacks, depending on the circumstances.
How to Avoid SSL Certificate Chain Issues
Proper certificate management can prevent many SSL/TLS chain problems.
First, make sure the correct certificate and intermediate certificates are installed on the server. A certificate may be valid on its own but still cause problems if the server does not provide the necessary intermediate certificate.
It is also important to monitor certificate expiration dates and renew certificates before they expire.
Website owners should also regularly check:
- Certificate validity
- Certificate expiration dates
- Domain coverage
- Certificate chain configuration
- Intermediate certificate availability
- Certificate changes
- Revocation status
- HTTPS accessibility
Automated SSL/TLS monitoring can help identify problems before they affect website visitors.
Certificate issues can also negatively affect user trust and website accessibility. A browser warning can cause visitors to leave a website immediately, making certificate management an important part of website reliability and security.
SSL Certificate Monitoring
SSL certificate monitoring tools can continuously check certificates and alert website owners when something changes or goes wrong.
For example, Sematext Synthetics provides SSL certificate monitoring as part of its synthetic monitoring capabilities. Its browser monitoring can simulate real user behavior and check SSL certificates in the certificate chain.
Monitoring can help identify issues involving leaf and intermediate certificates and provide alerts when certificate changes or other problems are detected.
Sematext also provides certificate change detection, allowing teams to monitor certificates regularly and investigate unexpected changes.
This type of monitoring is particularly useful for businesses managing multiple websites, domains, applications, or services where manually checking certificates would be difficult.
Conclusion
An SSL certificate chain provides the trust structure that allows browsers to verify website certificates and establish secure HTTPS connections. It connects the server or leaf certificate through intermediate certificates to a trusted root CA.
Understanding What Is an SSL Certificate Chain? is important for anyone responsible for website security, server management, or online services. Correct certificate installation, regular renewal, and continuous monitoring can help prevent browser warnings, connection failures, and avoidable security issues.
