Online Tool Store
Certificate Chain Builder
Assemble a TLS certificate chain in the right order — leaf, intermediates, and the root that should usually be left out of the bundle.
🔒 This tool runs entirely in your browser. Your files are never uploaded to a server.
Security & Privacy
Certificate Chain Builder
Frontend preview — no upload or external service.
Chain order
3 certificates ordered: leaf (example.com, expires in 63 days) → intermediate R11 → root omitted. Each issuer matches the next subject, so the chain is complete.
How the Certificate Chain Builder works
- Paste the certificates you were issued in any order.
- Choose whether to include the root — most servers should not, since clients already trust it.
- Deploy the ordered bundle and re-test from outside your network, where the missing-intermediate error actually appears.
The method
A chain is valid when each certificate's issuer field matches the subject of the next one, ending at a root the client already trusts.
leaf.issuer = intermediate.subject; intermediate.issuer = root.subject
Order matters to most servers: leaf first, then intermediates in ascending order. Shuffling them is why a chain that "contains everything" still fails.
FAQ
Why does my site work in a browser but fail elsewhere?
Because browsers often cache or fetch missing intermediates while other clients — curl, mobile apps, API consumers — do not. A chain missing an intermediate fails there first.
Should the root certificate be in the bundle?
Usually not. The client already has it, so including it adds bytes to every handshake and proves nothing.
Is anything about my certificate sensitive?
Certificates are public by design, and this page processes them locally anyway. Private keys should never be pasted anywhere, including here.
How we compare
| Feature | Online Tool Store | A command-line tool | A paid audit service |
|---|---|---|---|
| Verifies issuer-subject links | ✓ | ✓ | ✓ |
| Warns on missing intermediate | ✓ | Manual | Yes |
| No key material needed | ✓ | ✓ | Varies |
| Runs without a terminal | ✓ | ✗ | ✗ |
Certificate Chain Builder targets the classic incomplete-chain outage — the one that looks fine in your browser and breaks every API client.