OneTaskBy Tim King · Updated
Certificate Chain Order Checker
Find Missing Intermediates and Fix the Order of a fullchain.pem Bundle
OneTask is free, with no sign-up, and built by one person.
If this tool saved you time, a coffee helps keep new ones coming.
How the Certificate Chain Order Checker works
This certificate chain order checker reads the PEM certificates in your fullchain or bundle file and confirms they are complete and in the right order. Paste the whole file to find missing intermediates, certificates that do not belong, expired ones and a root that should not be there.
How the certificate chain order checker works
A server should send its own certificate first, followed by each intermediate that signed it, in order, up to but not including the trusted root. Many browsers can repair a broken chain, but phones, older systems, API clients and command line tools often cannot, so a wrong order leads to errors that only some visitors see.
The checker decodes each certificate in your browser and links them by comparing each issuer name with the subject of the next certificate, and the authority key identifier with the subject key identifier. It finds the end certificate, walks up the chain and compares that with the order you pasted. If they differ, it lists the correct order by your certificate numbers.
It also warns about duplicates, certificates unrelated to the chain, expired certificates, a root that wastes bytes on every connection, and a bundle holding only the end certificate, which is the most common cause of incomplete chain errors. Private keys are never needed and should not be pasted.
FAQ
Should the root certificate be in my chain file?
No. Clients already hold trusted roots, and a root sent by the server is ignored. Including it only makes every TLS handshake slightly larger, so remove it unless a specific client asks for it.
How do I fix a missing intermediate?
Download the intermediate from your certificate authority's website or use the fullchain file they gave you instead of the single certificate. With Let's Encrypt, point your server at fullchain.pem rather than cert.pem.
Why does the site work in my browser but not in curl?
Desktop browsers cache intermediates and can fetch missing ones themselves. curl, most programming languages and many phones cannot, so they fail with an error saying the certificate could not be verified. Fixing the chain order and completeness solves it.
See also: all Security & Identifiers tools, Dev Utilities, Formatters & Validators, Data & Encoding, SEO, Accessibility, AI.
Related tools
SSL Certificate Inspector
Decode a PEM certificate and check its dates, names and fingerprints.
PEM Inspector
Decode PEM and DER into a readable ASN.1 tree.
Certificate Expiry Calculator
See days left and the renewal date for any PEM certificate.
PEM To JWK Converter
Convert public and private keys between PEM and JWK.
.env File Checker
Lint a .env file for syntax errors, duplicates and weak secrets.