What is an SSL Certificate Chain? Definition, Difference & How To

Anyone who’s ever seen a padlock icon in their browser has already benefited from an SSL certificate. But that little lock is only the tip of a much deeper system of trust—one that strings together certificates in a chain of verification connecting your browser to a trusted root. Understanding that chain is the difference between a secure site and a false sense of security.

Typical chain length: 2–3 certificates (server, intermediate, root) · Root CA certificate validity: Up to 25 years · Websites using HTTPS: Over 90% (Google Transparency Report)

What is an SSL certificate in simple terms?

An SSL certificate is a digital document that ties a domain or server to a cryptographic key pair. It allows browsers to establish an encrypted connection through the TLS handshake. DNSimple Help (technical support documentation) describes it as “a small data file that binds a cryptographic key to an organization’s details.” More practically, without one, your site visitors see a “Not Secure” warning.

What are the three types of SSL certificates?

• Domain Validation (DV): Quickest to get, only verifies domain ownership. Free from Let’s Encrypt.
• Organization Validation (OV): Checks basic business identity; used by small-to-medium companies.
• Extended Validation (EV): Rigorous identity vetting, shows company name in the address bar. Increasingly rare as browsers simplify UI.

The choice among DV, OV, and EV affects validation depth, but all rely on the same chain-of-trust mechanism underneath.

The trade-off: DV is cheap and fast, but offers no organizational identity proof. EV gives the highest trust signal, yet most browsers now treat EV same as DV in the address bar.

What is the difference between a certificate and a certificate chain?

A single SSL certificate is issued to one domain. A certificate chain is the full path from that leaf certificate, through zero or more intermediates, to a root certificate that is pre-loaded in your browser’s trust store. Without the chain, the leaf can’t be validated. Think of it like a hotel key card: the leaf certificate is your room key, but the hotel’s master-key system (intermediate and root) is what gives that key authority.

Four key contrasts, one pattern: the chain adds trust layers that a single certificate alone cannot provide.

The catch: many server admins accidentally omit the intermediate certificate, causing widespread trust failures even though the leaf is perfectly valid.

How does the chain of trust work?

The chain of trust is a hierarchical model. A root Certification Authority (CA) signs an intermediate certificate, which in turn signs the leaf certificate for your domain. When your browser receives the leaf, it checks that it was signed by an intermediate that is signed by a root it already trusts. DNSimple Help (technical support documentation) emphasizes: “the chain is only trusted if it terminates at a root in the client’s trust store.”

Root certificates are self-signed, as noted by Keyfactor Education Center (PKI education resource). That’s why they need to be pre-installed by operating system vendors and browser makers.

How do I generate a certificate chain?

Generating a certificate chain requires you to create a leaf certificate (or obtain one from a CA) and then combine it with the intermediate certificates in the correct order. The typical method uses OpenSSL.

1. Create a private key and CSR: openssl req -newkey rsa:2048 -keyout server.key -out server.csr
2. Submit the CSR to your CA; they return a leaf certificate and intermediate bundle.
3. Concatenate the chain: cat server.crt intermediate.crt root.crt > fullchain.pem – order matters: leaf first, then intermediates, then root.

The PostgreSQL Documentation (database security guide) shows an example of generating a child intermediate signed by the root. If you’re setting up your own CA, sign the intermediate CSR with the v3_intermediate_ca extension, as outlined in the FIRST CA Guide (security incident response best practices).

What commands are used to generate a certificate chain?

The essential OpenSSL commands, as compiled from PostgreSQL Documentation (database security guide) and FIRST CA Guide (security incident response best practices):

• Generate root CA key and self-signed certificate: openssl req -x509 -new -key root.key -out root.crt
• Generate intermediate CSR and sign with root: openssl x509 -req -in intermediate.csr -CA root.crt -CAkey root.key -extensions v3_intermediate_ca -out intermediate.crt
• Generate server CSR and sign with intermediate: openssl x509 -req -in server.csr -CA intermediate.crt -CAkey intermediate.key -out server.crt
• Verify chain: openssl verify -CAfile root.crt -untrusted intermediate.crt server.crt

The catch: mistaking the concatenation order is the #1 cause of “blank chain” errors in Nginx and Apache. Always verify with openssl verify -CAfile root.crt -untrusted intermediate.crt server.crt.

Why is SSL no longer used?

SSL (Secure Sockets Layer) was deprecated because of critical security vulnerabilities in the protocol. The last version, SSL 3.0, was formally deprecated by the IETF in 2015. The modern standard is TLS (Transport Layer Security), now at version 1.3 (2018). Despite the name, “SSL certificate” is a colloquial term that actually refers to a certificate used with the TLS protocol. DNSimple Help (technical support documentation) notes that industry still uses the term “SSL certificate” even though the underlying technology is TLS.

Is SSL being phased out?

Yes, and it already has been. Leading browsers and servers have removed support for SSL 2.0 and 3.0. The AWS Security Blog (cloud security best practices) explains that modern trust stores no longer include SSL-only roots. If you attempt to serve SSL 3.0 today, all major browsers reject the connection.

Do I really need an SSL certificate?

Yes, absolutely. Without an SSL/TLS certificate, the data exchanged between your server and visitors is sent in plain text, vulnerable to interception. Browsers like Chrome mark HTTP pages as “Not Secure,” often showing a red warning triangle. Google also uses HTTPS as a ranking signal, so a missing certificate can hurt search visibility.

The table below compares the consequences of not having a certificate.

What happens if you don’t have an SSL certificate?

Your site gets flagged by browsers: Chrome shows “Not Secure,” Safari displays a warning, and Firefox may block connections entirely. Any login forms, payment details, or personal information submitted are transmitted without encryption. The University of Wisconsin KnowledgeBase (educational IT documentation) points out that even internal applications using SSL require a proper chain for full trust.

The difference between a secure connection and a broken padlock often comes down to one missing intermediate file. In an era where over 90% of the web runs HTTPS, getting the chain right isn’t optional—it’s the price of admission.

Related reading: **What Is a Monorepo? Benefits, Drawbacks, and Examples** · **16 Billion Passwords Leaked: What to Do Now (2025 Guide)**

Frequently Asked Questions