> Check a certificate chain in your browser: find a missing intermediate, a wrong order, an expired CA or a broken signature, and see how to fix it. Source: https://pkizerotohero.com/tools/chain/ Browser tool # Chain checker Paste the certificates a server sends and see every link checked: names, key identifiers, signatures, dates and CA rules. Nothing you paste leaves your browser. *Interactive tool: Chain checker (runs in the browser at [/tools/](https://pkizerotohero.com/tools/))* ## How to use it 1. Get the chain the server sends, for example with openssl s\_client -connect example.com:443 -showcerts, and paste the whole output. 2. Read the verdicts at the top: they say what is wrong and what to change on the server. 3. Follow the chain link by link, from the server's own certificate up to the root. ## Questions Can this tool tell whether my client trusts the root? No web page can see your trust store. The checker names the root (or the missing issuer) the chain ends at, so you can check whether your client, operating system or runtime has it. Why does the site work in my browser but not in curl or Java? Usually the server leaves out its intermediate certificate. Browsers can often download it or already know it; curl, OpenSSL, Python, Node.js, Java and Go do not. Should the server send the root? It may, but it does not need to: a client must already have the root in its trust store. Sending the leaf and the intermediates is normal. ## Learn what it checks - [Certificate chains and path validation](https://pkizerotohero.com/handbook/certificate-chains/) - [Who do we trust? CAs, trust stores and self-signed certificates](https://pkizerotohero.com/handbook/trust-stores/)