SSL Chain Analyzer
Verify a PEM certificate chain order and find broken or missing links
Certificate bundle (PEM)
Paste leaf + intermediates (+ optional root)
Parsing is local. Certificate data never leaves your browser.
Examples
A complete leaf → intermediate → root chain
Three PEM blocks: example.com (leaf), Example Intermediate CA, Example Root CAChain complete — order reconstructed as leaf → intermediate → root.Click Load sample to try a real throwaway chain. The analyzer reassembles the order even if you paste the blocks shuffled.
A broken chain (missing intermediate)
Only the leaf certificate, issued by 'Example Intermediate CA'Chain broken — 'issued by "Example Intermediate CA", which is not present in the bundle'.When a cert's issuer is absent, the analyzer names the missing intermediate you must add to the bundle.
About this tool
TLS handshakes fail with errors like 'unable to get local issuer certificate' when a certificate bundle is out of order, missing an intermediate, or contains an expired entry. Eyeballing a PEM bundle to find the broken link is tedious and error-prone.
Paste your full chain (leaf + intermediates, and optionally the root) as PEM. The analyzer parses every certificate — subject, issuer, validity window, and CA flag — then reconstructs the intended order and reports whether it links from leaf to a self-signed root. It flags missing intermediates that break the chain, expired or not-yet-valid certificates, duplicate entries, and bundles with unrelated chains. Parsing is purely client-side.
How to use
Paste the bundle
Include the leaf certificate first, then each intermediate, optionally the root, as PEM blocks.
Read the status
A green 'Chain complete' means each cert's issuer matches the next cert's subject up to a root.
Investigate breaks
A red 'Chain broken' names the missing issuer you need to add as an intermediate.
Check validity
Expired or not-yet-valid certificates are flagged so you can renew in time.
Common mistakes
Mistake:Serving only the leaf certificate.
Fix:Most clients need the leaf plus the intermediates. Bundle them in the correct order.
Mistake:Putting the root first.
Fix:Order matters: leaf first, then intermediates, root last. The analyzer reconstructs order, but correct input avoids confusion.
Frequently asked questions
Related guides
How to Use the SSL/TLS Deep Inspector (A–F Grading)
Run a live TLS handshake from DevTools backend, interpret the A–F grade, and fix chain, expiry, and protocol findings.
Why Your TLS Certificate Chain Breaks (and How to Fix It)
A field guide to 'unable to get local issuer certificate' and friends. What a certificate chain is, why order and intermediates matter, and how to find the broken link in a PEM bundle.
References & standards
Related tools
AES Encryption
Encrypt and decrypt text with AES-GCM and a passphrase, fully in your browser. Uses PBKDF2 key derivation and the Web Crypto API — your data and keys never leave your device.
Basic Auth Generator
Generate an HTTP Basic Authentication header from a username and password. Produces the Authorization header and ready-to-use curl and fetch snippets. Runs fully client-side.
Bcrypt Generator & Verifier
Hash passwords with bcrypt and verify hashes — choose your cost factor (rounds 4–15), get a secure hash instantly, and check whether a password matches a hash. Runs entirely in your browser.
BIP39 Mnemonic Generator
Generate and validate BIP39 seed phrases locally for testing
Checksum Calculator
Compute file checksums (SHA-1, SHA-256, SHA-384, SHA-512) in your browser with the Web Crypto API
Client-Side File Encryptor
Encrypt any file with AES-256-GCM and PBKDF2 directly in your browser — no uploads, no accounts, wrong passwords fail loudly.