Certificate tools

A service from MI Support IT - Denmark

GuidesGlossaryAboutContactPrivacy

Infrastructure & Operations

What Is Certificate Chain (Intermediate Certificates)?

A certificate chain is the sequence linking a server’s certificate to a trusted root: the leaf (end-entity) certificate is signed by an intermediate CA, which is signed by (or chains further to) a root CA present in the client’s trust store. Validation walks this chain signature by signature — and the most common TLS misconfiguration on the internet is simply failing to serve the intermediate.

Why intermediates exist

Roots are too valuable to use daily: they live offline in HSMs and sign only intermediates. The intermediates do the day-to-day issuing, so a compromise or policy problem can be contained by revoking an intermediate without replacing the root in every trust store on earth. That indirection is deliberate blast-radius control.

The classic failure: incomplete chain

Servers must send the leaf and all intermediates; clients are only guaranteed to have roots. A server that sends just the leaf works in browsers that cache or fetch intermediates (AIA chasing) and fails everywhere else — curl, Java, mobile apps, monitoring probes — producing the confusing "works in Chrome, fails in the API client" pattern. The fix is serving the fullchain file the CA provided.

Chain order also matters formally (leaf first, then each issuer), and cross-signed intermediates can create multiple valid paths — usually fine, occasionally surprising when one path expires, as the Let’s Encrypt DST Root expiry in 2021 demonstrated at scale.

Try it yourself — free tools

How MI Support IT can help

PKI Tools is built by MI Support IT, a Danish IT company with deep specialization in enterprise PKI: ADCS design and health checks, Venafi certificate automation, key ceremonies and CP/CPS documentation. Read about our PKI services or get in touch.

PKI Glossary