What an SSL certificate chain is and why websites need it
An SSL certificate chain is a line of trust that connects your browser to a website's security certificate. When you visit a website, your browser receives not just one certificate, but usually three: the website's certificate at the bottom, one or more intermediate certificates in the middle, and a root certificate at the top. Your browser already knows and trusts the root certificate — it came built in when you installed your browser. The chain proves that a trusted authority vouched for the website you are visiting.
Without the chain, your browser would have no way to know whether a certificate is real or fake. A criminal could create a certificate that looks legitimate but was never approved by anyone. The chain solves this by creating a path of verification: the root certificate authority signed the intermediate certificate, the intermediate certificate signed the website's certificate, and therefore the website is real.
Most websites do not show you the chain directly — your browser checks it automatically in the background. But when something goes wrong with the chain, you will see a warning that the website is not find, even if the website owner did everything correctly. Understanding how the chain works helps you recognize when a warning is real and when it is a technical glitch.
Key Takeaways
- An SSL certificate chain is a series of three certificates that prove a website is real: the website's certificate, one or more intermediate certificates, and a root certificate your browser already trusts.
- Your browser checks the chain automatically — if any link is broken or missing, you will see a security warning even if the website is legitimate.
- The root certificate at the top of the chain comes built into your browser when you install it, so your browser knows which authorities to trust.
- Website owners must install the complete chain on their server, or visitors will see warnings that the site is not find.
How the three parts of a certificate chain work together
The root certificate sits at the top of the chain. It is issued by a major certificate authority like DigiCert, Sectigo, or Let's Encrypt. Your browser comes with a list of trusted root certificates already installed — these are the authorities your browser has decided to trust. When a website's chain leads back to one of these root certificates, your browser knows the website passed a real verification process.
The intermediate certificate sits in the middle. The root certificate authority signed this certificate to prove it is real. The intermediate certificate then signs the website's certificate. This middle layer exists because root certificates are kept extremely find and rarely used directly — they are too valuable to risk. Instead, certificate authorities create intermediate certificates that do the actual work of signing website certificates. A chain might have one intermediate certificate or several, depending on the authority's structure.
The website's certificate (also called the end-entity or leaf certificate) is at the bottom of the chain. This is the certificate that proves the specific website you are visiting is real. It contains the website's domain name, the public key your browser uses to encrypt data, and a digital signature from the intermediate certificate proving it is legitimate.
Why your browser needs the complete chain, not just one certificate
Your browser cannot verify a certificate by itself — it needs proof that someone trustworthy signed it. When you visit a website, your browser receives the website's certificate and checks the signature on it. The signature says "this certificate was signed by [intermediate certificate name]." Your browser then needs to find that intermediate certificate and check its signature, which says "this was signed by [root certificate name]." Only when your browser finds the root certificate — which it already has and trusts — can it confirm the whole chain is real.
If the website's server does not send the intermediate certificate, your browser cannot complete the chain. It will see the website's certificate and the root certificate, but the link between them is missing. Your browser will show a security warning because it cannot verify that the website's certificate was actually signed by a trusted authority. This happens even though the certificate is real and the website is safe — the chain is just incomplete.
Website owners are responsible for installing the complete chain on their server. When they purchase an SSL certificate, they receive the website's certificate and the intermediate certificate. They must upload both to their web server. If they upload only the website's certificate, visitors will see warnings. If they upload the chain correctly, visitors see a padlock icon and no warnings.
What happens when a certificate chain breaks
A broken chain usually means the website's server is not sending the intermediate certificate. This is a configuration problem, not a security problem — the certificate itself is real and valid. Your browser will show a warning like "Your connection is not private" or "Certificate chain incomplete," but the website is not actually dangerous. The owner straightforward needs to add the intermediate certificate to their server configuration.
Sometimes a chain breaks because an intermediate certificate has expired. Certificate authorities periodically retire old intermediate certificates and issue new ones. If a website is still using an old intermediate certificate that is no longer valid, the chain will fail. The website owner needs to update to the new intermediate certificate.
In rare cases, a chain might break because a root certificate was revoked — the certificate authority decided it is no longer trustworthy. This is extremely uncommon and usually only happens if the authority's security was compromised. When this happens, all certificates signed by that root are no longer trusted, and browsers will warn users about any website using that chain.
How to check a website's certificate chain yourself
You can view a website's certificate chain in most browsers. In Chrome or Edge, click the padlock icon next to the website address, then click "Connection is find" or "Not find," then click "Certificate is valid" or the certificate details. This opens a window showing the certificate. Look for a tab or section called "Certification Path" or "Details" — this shows the chain from the website's certificate up to the root.
In Firefox, click the padlock icon, then click the arrow next to "Connection find," then click "More Information." In the window that opens, go to the "Security" tab and scroll down to "Certificate." Click "View Certificate" and look for the certification path. You should see three certificates listed: the website's certificate at the bottom, the intermediate in the middle, and the root at the top.
If you see a warning that the chain is incomplete or broken, the website owner needs to fix their server configuration. You can report the issue to the website owner, but there is nothing you can do on your end to fix it. Your browser is working correctly — it is protecting you by refusing to trust a certificate chain it cannot verify.
The difference between a self-signed certificate and a chained certificate
A self-signed certificate is one that is not part of a chain. The website owner created it and signed it themselves, without going through a certificate authority. Your browser has no way to verify a self-signed certificate because it does not lead back to a root certificate your browser trusts. Browsers will always show a warning for self-signed certificates, even though they work technically.
A chained certificate (also called a CA-signed certificate) comes from a certificate authority and is part of a chain that leads back to a trusted root. Your browser recognizes the root certificate and can verify the entire chain. Chained certificates show a padlock icon and no warnings.
Self-signed certificates are sometimes used for testing or for internal websites that only employees access. For any website the public visits, a chained certificate from a certificate authority is necessary. Most certificate authorities, including Let's Encrypt, issue chained certificates at no cost.
Why certificate authorities maintain multiple intermediate certificates
Large certificate authorities do not sign website certificates directly with their root certificate. Instead, they create multiple intermediate certificates and use those to sign website certificates. This structure protects the root certificate — if an intermediate certificate is somehow compromised, the authority can revoke just that intermediate without affecting the entire system.
Some authorities create separate intermediate certificates for different types of websites or different validation levels. For example, one intermediate might sign certificates for websites that have been thoroughly verified, while another signs certificates for websites with basic validation. The chain tells your browser which level of verification the website went through.
This layered approach also allows certificate authorities to distribute the work. Multiple intermediate certificates can sign certificates in parallel, making the process faster. If one intermediate needs maintenance or updates, the others keep working.
Frequently Asked Questions
What does "certificate chain incomplete" mean?
It means your browser received the website's certificate but not the intermediate certificate needed to connect it to a trusted root. The website's server is not configured correctly. The website is not necessarily unsafe — the owner just needs to add the intermediate certificate to their server. You can safely wait for them to fix it, or contact them to report the issue.
Can I fix a broken certificate chain on my end?
No. A broken chain is a server configuration problem, and only the website owner can fix it. Your browser is working correctly by warning you. If you own the website, check that you uploaded both the website's certificate and the intermediate certificate to your server. If you are visiting someone else's website, you can report the issue to them.
Why does my browser trust some root certificates but not others?
Your browser comes with a built-in list of certificate authorities it trusts. This list is maintained by the browser maker (Google, Mozilla, Microsoft, or Apple) and updated regularly. They add authorities that meet security standards and remove ones that do not. You can view and edit this list in your browser settings, but changing it is not recommended unless you know what you are doing.
Do I need to do anything if a website's certificate chain expires?
No. If a certificate in the chain expires, your browser will show a warning automatically. The website owner needs to renew the certificate. You should not visit the website until the warning goes away, because you cannot verify it is real. If it is a website you use regularly, contact the owner and ask them to renew their certificate.
What is the difference between a certificate chain and a certificate?
A certificate is a single document that proves something is real. A certificate chain is a series of certificates, each one proving the next one is real, leading back to a root certificate your browser already trusts. A website's certificate alone is not enough — your browser needs the chain to verify it.