Security alerts WordPress 7.1.4 · no-login code execution in the updater 117 critical WordPress plugin CVEs · in October, most need no login

SSL certificate chain checker

Works in Chrome, fails in curl?

It’s usually the chain. See exactly what your server sends, what’s missing, and whether anything is revoked or distrusted.

trustedvalid-isrgrootx2.letsencrypt.org revokedrevoked-isrgrootx1.letsencrypt.org incompleteincomplete-chain.badssl.com ca advisorydv-g3b-emudhra.we-have-a-problem.com

What you get

The output explains itself

sample · example.com

What we check

What the checker looks at

Chain completeness
Every intermediate the browser needs is sent. Missing ones are fetched from the issuer URL so you can see what to install.
Order and issuer links
Each certificate is signed by the next one up, in order, with no strays.
Expiry on every certificate
Leaf, intermediates and root, with days left on the one that runs out first.
Revocation
Downloads the issuer’s CRL and looks for your serial number.
Trust path
Walks the chain to a root trusted by Chrome, Firefox, Safari and Windows.
Hostname match
Confirms the certificate covers the name you checked, including wildcards and SANs.
CA advisories
Flags chains through compromised or distrusted CAs, such as eMudhra.
Certificate details
Dates, serial, signature algorithm and revocation status for each certificate in the chain.

Questions

Why does my site work in the browser but fail in curl or an app?+

Browsers fetch missing intermediates on their own; curl, Java, Android and most API clients do not. If your server only sends the leaf, those clients fail with unable to get local issuer certificate or PKIX path building failed. The checker shows the gap and the intermediate to install.

What does NET::ERR_CERT_AUTHORITY_INVALID mean?+

The browser could not build a path to a root it trusts. Usually the certificate is self-signed, the chain is incomplete, or the CA has been distrusted. Run the check to see which.

What is an SSL certificate chain?+

The sequence of certificates that links your server’s certificate to a root CA that browsers and operating systems already trust: your leaf certificate, one or more intermediates, then the root.

How do you check revocation?+

We download the issuing CA’s certificate revocation list (CRL) and look for your certificate’s serial number. A match is what browsers report as NET::ERR_CERT_REVOKED.

How is this different from the certificate decoder?+

The chain checker connects to a live server and checks the chain it sends. The certificate decoder reads a PEM you paste, without connecting to anything.

Can you watch this certificate for me?+

Yes. Add the domain as a free monitor and you are alerted before it expires, when the chain changes, or when its CA lands on an advisory.

Free plan

Get told before it breaks.

Monitoring watches this certificate for you and emails you before it expires, when the chain changes, or when its CA is distrusted.

$0 / month, forever

No credit card.

Monitor it free Compare plans

  • 1 monitor, checked every 10 seconds

    From six locations, confirmed before we alert, so no false alarms.

  • Certificate expiry alerts

    Email 30, 14 and 7 days before it runs out.

  • Security scans and change alerts

    Certificate, chain, headers, DNS and email security, with an email when anything changes.

  • Cloudflare offline page

    Visitors see a status page instead of an error while you fix it.

  • 12 months of history

    Every check, change and incident, kept for a year.

  • Slack, JIRA, Linear and Teams

    Send alerts where your team already works.