SSL Certificate Chain Checker

Catch a missing intermediate before it breaks mobile apps and APIs.

Start monitoring
See all checkers

A valid SSL certificate is not enough on its own — your server also has to send the intermediate certificate(s) that link it back to a trusted root. Forget the intermediate and you get the most frustrating kind of outage: the site loads fine in your browser (which quietly caches intermediates) but fails for mobile apps, API clients and older devices, so half your users see errors while you see nothing wrong. A certificate chain checker inspects the full chain your server actually presents and tells you whether it is complete, correctly ordered and trusted.

What it checks
  • A missing intermediate certificate — the classic "works in my browser" failure
  • The chain order (each certificate must be issued by the next one up)
  • Expired or soon-to-expire certificates anywhere in the chain
  • Self-signed or untrusted certificates
  • An unnecessarily included root certificate that just bloats the handshake
  • Changes to the chain since the last check

Why it matters

A broken chain is uniquely nasty because it is invisible from a desktop browser — the place most people test. Meanwhile your mobile app users, payment callbacks and API integrations fail with cryptic TLS errors. Because the chain only changes when a certificate is renewed or the server is reconfigured, problems tend to appear suddenly and silently at renewal time. Monitoring the chain means you find out the moment it breaks, not when a customer reports their app stopped working.

How BrandSentryPro does it

Add your site as a monitor and BrandSentryPro connects over TLS and captures the exact certificate chain your server sends. It checks the chain is complete, correctly ordered, trusted and not expiring, and re-checks over time — so a missing intermediate after a renewal, or any unexpected change to the chain, is flagged instead of slipping through.

Frequently asked questions

What is a certificate chain?
A certificate chain is the sequence of certificates that links your site's certificate (the leaf) back to a trusted root, through one or more intermediate certificates. Your server must send the leaf and the intermediates so clients can build a path to a root they trust.
Why does my site work in a browser but fail elsewhere?
Usually a missing intermediate. Browsers often cache intermediate certificates from previous sites and fill the gap automatically, so the page loads for you. Mobile apps, API clients and other tools do not, so they fail to verify the chain and refuse to connect.
How do I fix an incomplete certificate chain?
Install the full chain your certificate authority provides — the leaf certificate followed by its intermediate(s) — in the correct order on your server. A chain checker confirms the server is now sending a complete, correctly ordered chain.

Related checkers

Mixed Content Checker
Find insecure HTTP resources loaded on your HTTPS pages.
Security Headers Checker
Check for HSTS, CSP, X-Frame-Options and the other headers that protect your users.
Vulnerability Scanner
Detect outdated software and known, exploitable vulnerabilities.
Domain Expiration Checker
Never lose a domain to a missed renewal again.
IP Blacklist Checker
See if your server IP has landed on spam or malware blacklists.
Server Hardening Checker
Check Fail2Ban, rate limiting, hidden version tokens and OS updates.
OpenVAS Vulnerability Scan
Run a deep network vulnerability assessment across every exposed service.
Nameserver Checker
Track your domain's authoritative nameservers and get alerted the moment they change.
TLS Version Checker
See which TLS versions your site offers — and get alerted if a deprecated one comes back.
Typosquatting Checker
Find the lookalike domains attackers register to phish your customers.
Subdomain Takeover Checker
Find dangling subdomains an attacker could hijack to impersonate you.
DNS Record Change Checker
Get alerted the moment your A, MX, NS or TXT records change.
Phishing Domain Checker
Catch the brand + "login" domains attackers register to phish your customers.
Dependency Vulnerability Checker
Find outdated jQuery, Bootstrap and other libraries with known CVEs on your site.
Email Blacklist Checker
See if your domain or mail server is on an email blacklist.
Email Spam Rating Checker
See how likely your email is to be marked as spam — and why.
Malware Blacklist Checker
See if your site is flagged for malware, phishing or botnet activity.
Google Safe Browsing Checker
Check if your site triggers the browser malware/phishing warning.
Email Configuration Checker
Validate your MX, SPF, DKIM and DMARC records for errors.
Trustpilot Monitoring
Track your Trustpilot TrustScore and get warned when it drops.
Leaked Credential Checker
See if your domain has appeared in a known data breach.
Google Business Profile Monitoring
Track your Google star rating and get warned when it drops.
Brand Mention Monitoring
Get alerted when your brand is mentioned somewhere new on the web.
All in one place

Run this check automatically

Add a monitor and BrandSentryPro keeps every check running for you — with alerts the moment something needs attention.

Get started