Certificate Chain Checker

Verify the complete SSL certificate chain including intermediate and root certificates.

About SSL Certificate Checker

Comprehensive SSL/TLS certificate analyzer that validates certificate chains, checks expiration dates, and verifies hostname matching from multiple global locations.

Key Features

Multi-region SSL validation

Certificate chain verification

Expiration monitoring

TLS version detection

Hostname validation

Also Available via API & MCP Server

Automate ssl certificate checker checks in your CI/CD pipelines or run them directly from your AI coding agent.

REST API

Single endpoint, JSON response. Integrate into any language or platform.

cURL

curl -X POST https://probeops.com/api/v1/run \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"tool": "ssl_check", "target": "example.com"}'

Learn more about the API

MCP Server

Works with Claude Code, Cursor, Windsurf, and any MCP-compatible IDE.

Claude Code

> Check the ssl certificate checker for example.com

Claude uses the probeops_ssl_check tool to run
the check from 6 global regions and returns
structured results.

Learn more about the MCP Server

An incomplete certificate chain is one of the most frustrating SSL issues because it works on some devices but fails on others. Browsers cache intermediate certificates, so your site might load fine on your laptop while mobile users see security errors.

Our chain checker validates that your server sends the complete certificate chain: your domain certificate plus all required intermediate certificates. We test from multiple regions to catch edge-specific chain issues common with CDN deployments.

**Methodology:** Full certificate chain extraction and validation against trusted root CAs from 6 global probe locations.

Common SSL Errors & How to Fix Them

4 relevant issues

Works in some browsers but fails in others. Mobile devices often affected first.

How to Fix

Include the intermediate certificate bundle when configuring SSL. Download the full chain from your CA and concatenate: your cert + intermediate(s). Test with openssl s_client -connect domain:443 -servername domain.

intermediate certificatecertificate chainunable to verify

Chain is present but certificates are in incorrect order. Some clients may fail.

How to Fix

Reorder your certificate bundle: leaf certificate first, then intermediate(s), optionally root last. Do not include root CA for public sites. Regenerate your combined .pem or .crt file in the correct order.

chain ordercertificate orderwrong order

Certificate not issued by a trusted CA. Browser shows ERR_CERT_AUTHORITY_INVALID.

How to Fix

Replace with a certificate from a trusted CA. Free options: Let's Encrypt (certbot), Cloudflare Origin CA. For internal services, add your CA to client trust stores or use a proper internal PKI.

self signedauthority invaliduntrusted certificate

SSL works from some locations but fails from others. Common with CDNs and multi-origin setups.

How to Fix

Check all CDN edge locations have the same certificate deployed. Verify origin server certificate matches CDN. Purge CDN cache after certificate updates. Check if geo-routing serves different origins.

cdn certificateregional ssledge locationdifferent certificate

See all SSL errors →

Frequently Asked Questions

4 relevant questions

An intermediate certificate bridges the trust between your SSL certificate and the root CA (Certificate Authority) in browser trust stores. Without it, browsers can't verify your certificate's authenticity, causing "connection not private" errors. Some browsers cache intermediates, so the error may appear on some devices but not others. Always include your CA's intermediate certificate bundle.

Your server is sending only the end-entity (leaf) certificate without intermediate certificates. Browsers need the full chain to verify trust back to a root CA. Fix by concatenating your certificate with intermediate certificates in this order: your cert → intermediate(s) → (optional root). Most CAs provide a "full chain" or "bundle" file for this purpose.

The correct order is: your domain certificate (leaf) first, then intermediate certificate(s), then optionally the root CA. Never include the root CA for public-facing sites as browsers already have it. For nginx: ssl_certificate should point to a file containing your cert + intermediates concatenated. For Apache: use SSLCertificateFile and SSLCertificateChainFile.

CDNs and load balancers often serve different SSL certificates at different edge locations. A certificate might be properly deployed in US data centers but expired or misconfigured in European nodes. Regional mismatches can also occur during certificate renewals if not all edges are updated simultaneously. Multi-region testing catches these inconsistencies before they affect users.

See all SSL FAQs →

How to Check SSL Certificate ExpiryStep-by-step guide with examples and troubleshooting tips