About Certificate Chain Validator

Validate certificate chains for completeness, signatures, dates, and trust paths. Part of the DevTools Surf developer suite. Browse more tools in the Security / Crypto collection.

Use Cases

• Diagnose 'certificate chain incomplete' errors in production HTTPS deployments
• Verify that all intermediates are correctly configured on a web server
• Check certificate expiry across an entire chain before renewals
• Validate certificates from a CA before deploying to a load balancer

Tips

• Paste the full certificate chain PEM (leaf, intermediate, root) in order — the validator checks each signature link in sequence
• The expiry timeline shows days remaining for each certificate in the chain — intermediate certificates are commonly overlooked for renewal
• Enable 'strict mode' to flag SHA-1 signatures, weak key sizes (RSA < 2048), and deprecated cipher suites alongside standard validity checks

Fun Facts

• Certificate chain validation is the process that makes HTTPS trustworthy. A browser trusts a server's certificate because it is signed by an intermediate CA, which is signed by a root CA that is pre-installed in the OS's trust store — a chain of cryptographic trust.
• Google's Certificate Transparency (CT) project, launched in 2013, requires all public TLS certificates to be logged in public append-only logs. As of 2023, these logs contain over 10 billion certificates.
• The Let's Encrypt certificate authority, launched in 2016, crossed 3 billion active certificates in 2023 — making it the largest CA in the world. It offers free automated certificates with 90-day validity.

FAQ

What is an intermediate certificate and why is it needed?

Root CA certificates are extremely valuable and kept offline. CAs issue intermediate certificates (online, lower trust) to sign end-entity (server) certificates. This two-layer structure limits exposure if an intermediate is compromised.

What does 'chain incomplete' error mean?

The browser received the server's leaf certificate but not the intermediate that links it to a trusted root. The server must send both the leaf and all intermediate certificates in the TLS handshake. Root certificates are not sent — they come from the browser's trust store.

What is certificate pinning?

Certificate pinning is when an application hard-codes the expected certificate or public key hash for a specific server, refusing connections to any other certificate even if it is CA-signed. It provides extra protection against CA compromise but complicates certificate rotation.