Browser tool
Chain checker
Paste the certificates a server sends and see every link checked: names, key identifiers, signatures, dates and CA rules. Nothing you paste leaves your browser.
How to use it
- Get the chain the server sends, for example with openssl s_client -connect example.com:443 -showcerts, and paste the whole output.
- Read the verdicts at the top: they say what is wrong and what to change on the server.
- Follow the chain link by link, from the server's own certificate up to the root.
Questions
Can this tool tell whether my client trusts the root?
No web page can see your trust store. The checker names the root (or the missing issuer) the chain ends at, so you can check whether your client, operating system or runtime has it.
Why does the site work in my browser but not in curl or Java?
Usually the server leaves out its intermediate certificate. Browsers can often download it or already know it; curl, OpenSSL, Python, Node.js, Java and Go do not.
Should the server send the root?
It may, but it does not need to: a client must already have the root in its trust store. Sending the leaf and the intermediates is normal.