A certificate chain (also called a chain of trust or certification path) is the complete path of digital certificates needed to verify that a server's certificate is trustworthy. It consists of three tiers: the leaf (end-entity) certificate for your domain, one or more intermediate CA certificates, and a root CA certificate that clients already trust.
During TLS handshake validation, the client verifies the leaf certificate's signature using the intermediate's public key, then verifies the intermediate using the next CA's public key, continuing until it reaches a trusted root already stored locally on the client's device or operating system. The server sends only the leaf and intermediate certificates—the client supplies the root from its own trust store.
Validation also checks certificate validity periods, key usage constraints, and revocation status (via OCSP or CRLs). Path validation is formally defined in RFC 5280, Section 6.
Example: A web server certificate chain typically looks like:
- Leaf:
www.example.comcertificate - Intermediate: CA intermediate certificate (e.g., from Let's Encrypt)
- Root: Trusted root CA (e.g., IdenTrust Global Root)
WarningIncomplete Chain Problem: Server administrators sometimes install only the leaf certificate, omitting required intermediates. While some browsers cache intermediates and still validate, other clients, mobile apps, and tools will fail with "unable to get local issuer certificate." Always configure your server to serve the complete chain, including all intermediates.
Certificate chains are governed by RFC 5280 (X.509 profile), RFC 8446 (TLS 1.3), and CA/Browser Forum Baseline Requirements.