SSL/TLS Certificate Chain & Intermediate Path Verifier – X.509 Trust Explorer
Diagnosing Broken Intermediate SSL/TLS Chains
When web servers are configured with only a leaf certificate instead of the full bundle (fullchain.pem), modern desktop browsers may resolve the chain through AIA chasing, while mobile devices, Java clients, and curl fail with SEC_ERROR_UNKNOWN_ISSUER.
X.509 Authority Key Identifier (AKI) Validation
This inspector resolves Issuer • Subject signatures, verifies cryptographic key lengths (RSA/ECDSA), inspects Subject Alternative Names (SANs), and confirms whether intermediate authorities properly anchor to trusted root certificates.
Frequently asked questions
Why does SSL work in Chrome but fail in curl or mobile apps?
Desktop Chrome caches intermediate CAs across browsing sessions. Mobile apps and automated curl scripts do not, requiring the server to supply the full certificate chain.
Does this tool inspect private keys?
No. It only inspects public X.509 certificates (CRT/PEM). You should never paste private keys into any public tool.
Secure multiple wildcard subdomains, boost SEO ranking, and eliminate browser warnings.