Chain/Issuer Inspector

A browser doesn't trust your certificate directly — it trusts a small set of root certificate authorities baked into the OS or browser, and it needs a chain of "this CA vouches for that CA" links from your certificate up to one of those roots. Your server is responsible for sending that whole chain (minus the root itself, which the client already has); it is not the certificate authority's job to deliver it at connection time. This is the single most common TLS misconfiguration in the wild: a server that only presents its own (leaf) certificate, with no intermediates.

Most desktop browsers paper over this — they cache intermediate certificates they've seen before from other sites, so a missing-intermediate misconfiguration often looks completely fine in Chrome while failing outright for a payment gateway's server-to-server webhook call, a mobile app's HTTP client, or a colleague's freshly-installed browser that hasn't cached that intermediate yet. It is exactly the kind of bug that passes every manual check a developer does personally and then breaks for a subset of real users or integrations.

This inspector shows you the chain exactly as your server sent it — nothing filled in from a local cache — and tells you plainly whether it's complete. It also flags a self-signed leaf certificate (one that vouches for itself rather than being issued by a public CA), which will never validate in any standard client no matter how the rest of the chain looks.

If your chain comes back incomplete, the fix is almost always server configuration, not a new certificate: most CAs publish the exact intermediate bundle to concatenate after your leaf certificate in whatever file your web server or load balancer serves.

Want the full picture? Run the complete certificate health check