Certificate diagnostics
Paste a PEM bundle in any order. Check once, then choose a target certificate or a CA trust anchor if needed.
Processed locally. No certificate upload or AIA, OCSP or CRL requests.
Paste PEM certificates to begin.
Run once to populate these lists. Select an input CA only if you intend to use it as this run’s anchor; then check again.
Up to 20 PEM certificates, 256 KiB input and 64 path results.
Paste PEM certificates to begin.
A certificate chain checker helps when a bundle looks complete but a client still reports an issuer error. A matching issuer name is only a candidate: the certificate must also verify against that issuer’s public key. Inspect the actual links before changing a deployment file, and keep trust decisions separate from sorting.
The certificate chain checker tests each matching issuer candidate cryptographically. Two certificates can have the same subject and different keys; the report preserves both a failed candidate and a verified link instead of joining boxes merely because their names match.
A path runs from the selected target toward an issuer. A self-signed endpoint can complete that structure without being trusted. Choose a supplied CA explicitly when you want to see whether a path reaches your anchor; the initial setting makes no such assumption.
Paste complete BEGIN CERTIFICATE and END CERTIFICATE blocks, including intermediate certificates. The parser rejects private keys, other containers and leftover text. Original input numbers remain in the report even when the suggested order changes.
The first run discovers the supplied certificates. If several end certificates are present, select the intended target below the panels and check again. A trust anchor is optional and must be an explicitly selected CA from that same input.
A missing issuer is a gap in the supplied set, which may be an intermediate or an omitted root. JSON retains the diagnostic report; PEM export requires one complete, unambiguous path using all input certificates without reported defects. Editing anything requires another check.
Each name-matched candidate is tested using its public key. The report distinguishes verified, failed and unsupported verification, including self-signatures. Unsupported browser algorithms never receive a success mark.
Inspect the subject, issuer, serial number, SHA-256 fingerprint and UTC validity interval for each original block. Duplicate detection uses the entire encoded certificate, so matching subject names alone do not make certificates duplicates.
The checker reports expiry, not-yet-valid dates, missing issuers, non-CA signers, certificate-signing key usage and path-length limits. Duplicate or unhandled critical extensions remain visible instead of becoming a silent assurance.
Review PEM chain order without rewriting the editor. A JSON report includes every certificate, candidate link, path ending and diagnostic, plus explicit flags showing that revocation and system trust were not checked.
It usually means the verifier cannot find a suitable issuer in the certificates or trust sources it has. This page can identify an absent issuer or a name-matched certificate whose signature fails, but it does not inspect your client’s trust store or fetch missing material.
A server bundle normally contains the leaf followed by intermediates; the client normally already has a trusted root. This diagnostic tool may need a root to display a complete local path. Its ordered PEM includes every supplied certificate, including a root, and is not automatically a server-ready fullchain file.
No. With no selected anchor, even a complete self-signed path has no trust assumption. Selecting a CA lets you test reachability to that chosen endpoint. Browser trust, application policy and revocation remain separate checks.
Some consumers require the leaf first and its issuers after it. The checker can analyze a shuffled bundle, preserving source numbers so the proposed ordering is reviewable. Consumers differ, so verify the configuration requirements before deploying exported material.
Not here. OCSP and CRL status can change independently of the signed certificate. The JSON flags explicitly record that revocation was not checked; a completed local path is not evidence that a certificate has not been revoked.
Have a certificate-chain case to report?
Use the certificate chain checker again after adding missing issuer material or changing the selected anchor. Compare the new path with the report before replacing configuration.