CERTINITE · FREE SSL TOOLS

SSL Certificate Chain Checker

Inspect an SSL validation path and troubleshoot missing intermediates, untrusted issuers and certificate validity problems. Free, with no account required.

  • No signup required
  • Full results, always free
  • Built for IT & DevOps

Use this tool free, without an account

Enable JavaScript to use the interactive tool. Instructions and troubleshooting guidance are available below.

How it works

Enter a public hostname. The checker obtains its TLS certificate and displays the validation path built by the server’s operating system. Intermediate downloading is disabled to avoid hidden outbound requests.

What does this tool check?

  • Leaf certificate and the built intermediate/root path
  • Operating system trust assessment and chain-building errors
  • Certificate validity and signature errors reported by the chain engine
  • Hostname coverage and actionable installation guidance

Common issues & how to fix them

PartialChain or missing intermediate

Download the correct intermediate bundle from your CA and configure it alongside the leaf certificate. For Nginx, ssl_certificate commonly points to a fullchain PEM file.

Untrusted root

Check that the certificate chains to a CA trusted by your intended clients. Private PKI requires distributing its root to those clients; a public website normally needs a public CA.

Different results on different devices

Some clients have cached intermediates or different trust roots. Test your deployment with a clean client as well. The root normally does not need to be sent by the server.

Frequently asked questions

Should my server send the root certificate?

Usually no. Send the leaf and required intermediates. The client must already trust an appropriate root; sending a root cannot make it trusted.

Does this tool check the original wire ordering?

No. .NET exposes the OS-built chain here, which can reorder certificates and use locally cached intermediates. The diagram is a validation path, not evidence of the exact order or completeness of the transmitted list.

Does chain trust include certificate revocation?

No. Online CRL, OCSP and AIA retrieval are disabled. This tool does not claim to check revocation or replace a full TLS security assessment.

Related SSL tools

LIVE CHECK

SSL Certificate & Expiry Checker

Check a public website’s SSL certificate, expiry date, hostname coverage and trust chain. See days remaining and practical fixes. No signup required.

Use free tool
IN YOUR BROWSER

CSR Decoder & Signature Validator

Decode a PEM certificate signing request in your browser. Inspect subject fields, SANs, key details and verify the CSR signature without uploading it.

Use free tool
IN YOUR BROWSER

SSL Certificate Decoder

Read a PEM X.509 certificate locally: subject, issuer, expiry, SANs, fingerprints, key usage and basic constraints. Free certificate decoder without signup.

Use free tool
IN YOUR BROWSER

PEM to DER / CRT Certificate Converter

Convert an X.509 certificate between PEM and binary DER/CRT entirely in your browser. No uploads, private keys or account required.

Use free tool