Mister PKI

SSL Certificates * SSL Tools * Certificate Decoder

This lesson explains how a certificate chain works in TLS and PKI environments. Understanding certificate chains is critical when troubleshooting TLS errors, validating certificates, or deploying secure services.

This article is part of the PKI for DevOps Engineers training series. In the previous lesson we explained X.509 certificates. In this lesson we focus on how certificates connect together to form a trust chain.

If you want to see certificate chains directly from a server, see our guide on using openssl s_client to inspect TLS certificates.

Table of Contents

—

What is a certificate chain?

A certificate chain is a sequence of certificates where each certificate is signed by the next certificate in the chain. The chain ultimately leads to a trusted root certificate authority (CA).

When a client connects to a server using TLS, the server presents its certificate along with intermediate certificates. The client then verifies that:

  • The certificate was signed by a trusted authority
  • The certificate has not expired
  • The hostname matches the certificate
  • The certificate chain is complete

If any of these checks fail, the TLS connection will fail.

—

Certificate chain diagram

Root CA Intermediate CA Server Certificate
Example TLS certificate chain structure.
—

Root vs Intermediate vs Leaf certificates

Root certificate

The root certificate sits at the top of the trust hierarchy. Operating systems and browsers include trusted root certificates in their trust stores.

Because root keys are extremely sensitive, they are usually kept offline and used only to sign intermediate certificates.

—

Intermediate certificate

Intermediate certificates are issued by root certificate authorities and used to sign server certificates.

Using intermediate certificates allows CAs to protect the root key and also revoke intermediate authorities if necessary.

—

Leaf certificate

The leaf certificate is the certificate installed on the server. It represents the identity of the server or application.

Leaf certificates contain hostnames in the Subject Alternative Name (SAN) field and must match the hostname used by the client.

—

Why certificate chains exist

Certificate chains provide several important security benefits.

  • Root keys remain offline and protected
  • Intermediate certificates allow flexible certificate issuance
  • Trust can be delegated without exposing root keys
  • Compromised intermediates can be revoked

This layered model is why almost every public TLS certificate is issued through one or more intermediate authorities.

—

Common certificate chain errors

DevOps engineers frequently encounter TLS errors related to certificate chains.

Some common examples include:

  • unable to get local issuer certificate
  • certificate verify failed
  • self signed certificate in certificate chain
  • unknown certificate authority

These errors usually occur when:

  • the server does not send intermediate certificates
  • the client does not trust the root CA
  • the certificate chain is misordered
—

Verify certificate chains with OpenSSL

You can validate certificate chains using the openssl verify command.

openssl verify -CAfile chain.pem server-cert.pem

This command verifies that the server certificate chains back to a trusted certificate authority.

You can also retrieve the certificate chain directly from a server using openssl s_client.

openssl s_client -connect example.com:443 -showcerts

If you want to inspect the certificate details locally, see our guide on viewing certificates with OpenSSL.

—

Frequently asked questions

What is a certificate chain?

A certificate chain is a sequence of certificates that link a server certificate to a trusted root certificate authority.

Why do servers send intermediate certificates?

Servers send intermediate certificates so clients can build a trust path between the server certificate and the trusted root certificate.

What happens if the intermediate certificate is missing?

If the intermediate certificate is missing, the client may fail to verify the certificate and the TLS connection may be rejected.

How can I view the certificate chain of a website?

You can retrieve the chain using openssl s_client.

—

Next Lesson

Now that you understand how certificate chains work, the next lesson explains how to debug TLS connections directly from the command line.

Lesson 4 – Debug TLS Connections with OpenSSL s_client →

—

Training Series Navigation