Certificate Chains
Root, Intermediate and Leaf Certificates
A certificate chain is the sequence of certificates that links a website's own certificate back to a trusted root certificate. Each certificate in the chain is signed by the one above it, so a browser can check the whole path from the website to a root it already trusts.
The chain has three types of certificate:
- Root certificate: the top of the chain. It is self-signed and stored in the trust stores of browsers and operating systems. Root keys are usually kept offline and used rarely, to limit the risk of exposure.
- Intermediate certificate: signed by the root or by another intermediate, and used to sign certificates on the root's behalf. Intermediates let the root stay offline while daily issuance continues.
- Leaf certificate: the website's own certificate, also called the end-entity certificate. It is signed by an intermediate and names the domain it protects.
To verify a connection, the client starts at the leaf certificate, checks its signature against the intermediate, and continues upward until it reaches a root in its trust store. If the path ends at a trusted root and every check passes, the connection is trusted. The issuers behind these roots are covered in what a certificate authority does.
Why a Missing Intermediate Breaks Connections
A server should send its leaf certificate together with the intermediate certificates. The root is usually left out, because clients already hold it. If an intermediate is missing, the client may be unable to build a path to a trusted root.
Desktop browsers often avoid this problem. Many can fetch a missing intermediate on their own, using a URL inside the leaf certificate. Many other clients cannot. Mobile apps, API libraries and command-line tools usually rely only on the certificates they receive during the handshake. A site can therefore load in a browser while failing in an app that calls the same server.
Trust stores also differ. Operating systems, browsers and programming platforms each ship their own list of roots, and those lists are not identical or updated at the same time. A chain can be trusted on one platform and rejected on another, which is why certificate errors can appear for some visitors but not others. Bundles of intermediate certificates are often stored in files, covered in certificate file formats.
Example: Works in a Browser but Fails in an App
A developer's website loads in a desktop browser without any warning. A mobile app that calls the same site's API reports a certificate error. The server sends only its leaf certificate and omits the intermediate. The browser fetched the missing piece on its own, but the app did not. Configuring the server to send the full chain fixes the problem for both.
Frequently asked questions
What is the difference between a root and an intermediate certificate?
A root certificate is self-signed and trusted directly by the device, because it sits in the local trust store. An intermediate certificate is signed by a root or another intermediate, and it is trusted only because the chain leads back to a trusted root. Roots are kept offline for security, while intermediates handle everyday signing.
Why does a certificate work in one browser but not another?
The most common reason is a missing intermediate certificate, which one browser can fetch and another cannot. Another reason is that browsers use different trust stores, so one may not recognize the root that issued the certificate. Both causes produce the same symptom: a connection that succeeds for some visitors and fails for others.