What is a certificate chain?
A certificate chain links a site's own certificate, through one or more intermediate certificates, to a root certificate the browser already trusts.
In more detail
Browsers and operating systems ship with a set of trusted root certificates. Roots rarely sign site certificates directly; intermediates do. The server must send its own certificate together with the intermediates, so the visitor can build a path to a root it trusts.
If an intermediate is missing, some browsers fill the gap from a cache and the site appears to work, while other clients (older phones, command-line tools, payment providers' servers) fail. That makes a broken chain hard to notice from your own laptop.
Worked example
A site sends only its own certificate. Desktop Chrome loads it, having seen the intermediate before, but a payment provider's webhook to the site fails with "unable to verify the first certificate". Installing the full chain file from the certificate issuer fixes both.
See also
Related terms: SSL certificate expiry and HTTP status code. Free tool: SSL checker. How OwlHound helps: SSL & domain expiry monitoring. All terms: monitoring glossary.
Frequently asked questions
What is an intermediate certificate?
A certificate issued by a root that in turn issues site certificates. It sits in the middle of the chain, which is why the server must send it.
Why does my site work in one browser and fail in another?
Often an incomplete chain: one browser has the missing intermediate cached, the other doesn't.
How do I fix an incomplete chain?
Install the full chain (often a file called fullchain or bundle) from your certificate issuer, then test with an outside checker rather than your own browser.
Start watching your site in minutes
Free for up to 10 sites, no card, nothing to install. Read-only access you can revoke at any time — never passwords, never admin access.