Certificate Chain of Trust (Certificate Chain)
Why You Should Care About Certificate Chain
A broken or incomplete certificate chain is one of the most common SSL configuration errors. If your server does not send the necessary intermediate certificates, some browsers and devices will fail to verify your certificate even though it is perfectly valid. This often manifests as intermittent SSL errors - working in Chrome on desktop but failing on Android or in certain corporate environments.
The chain works like a series of endorsements. Your server's certificate is signed by an intermediate CA, which is signed by a root CA. Browsers have a built-in list of trusted root certificates. If any link in this chain is missing or invalid, the browser cannot verify trust and will show a security warning.
Server operators must configure their web server to send the complete chain (end-entity certificate plus all intermediates, but not the root). Missing intermediates are the number one cause of "certificate not trusted" errors on mobile devices, because mobile browsers often have smaller certificate stores and cannot fetch missing intermediates as reliably as desktop browsers.
How to Check
An SSL checker analyzes your server's certificate chain and reports whether all intermediate certificates are properly sent. If the checker shows chain errors or missing intermediates, you need to update your server configuration to include the full chain file provided by your CA.
Check SSL CertificateLessons From the Field
In 2020, Sectigo's AddTrust External CA Root expired, breaking certificate chains for thousands of sites that had not updated their intermediate bundles. Older clients (including OpenSSL 1.0.x on Ubuntu 14.04) could not validate the new cross-signed chain, causing widespread API failures and webhook breakages for services that relied on outdated server configurations.