SSLWatchSSL certificate chain checker
Verify the full certificate chain – leaf, intermediate and root – and catch "unable to get local issuer certificate" problems before your users do.
Try: google.com · github.com · cloudflare.com
Reading the chain result
- Leaf – your site's certificate (it must match the domain).
- Intermediate – signs the leaf; your server must send it.
- Root – already trusted by browsers and operating systems.
If the result says Not trusted with UNABLE_TO_VERIFY_LEAF_SIGNATURE, the intermediate is missing. Install the full chain (for Let's Encrypt, fullchain.pem). More in SSL certificate chain explained.
Frequently asked questions
What is an SSL certificate chain?
The ordered list of certificates from your site's leaf certificate through one or more intermediates up to a trusted root certificate authority.
What causes an incomplete chain?
The server sends only the leaf certificate and not the intermediate. Browsers may cope, but curl, Java, Android apps and APIs will fail.
How do I fix a missing intermediate certificate?
Configure your web server with the full-chain file from your certificate authority, then reload the server and re-check.
How do I check the chain with OpenSSL?
Run openssl s_client -connect example.com:443 -servername example.com -showcerts and look for "Verify return code: 0 (ok)".