CodeParkA certificate chain is the line of signatures that links your server's certificate to a root certificate the client already trusts.
A server certificate links a public key to one or more domain names. A certificate authority (CA: a company that checks who owns a domain and signs certificates) signs it. Usually an intermediate CA signs your certificate. A root CA signs the intermediate's certificate. This sequence is the chain.
The browser or the operating system comes with a store of trusted root certificates. During the TLS handshake, the server sends its own certificate plus the intermediate certificates. The client then checks:
- each signature, one step up the chain, until it reaches a trusted root
- that each certificate is inside its validity dates
- that the names in the server certificate match the hostname
- that the certificate has not been revoked (cancelled before its end date)
A common production bug is forgetting to send the intermediate certificate. Some browsers work around it. But Node clients and curl fail with an error that says they cannot verify the certificate.
- An intermediate CA signs the leaf certificate, and a root CA signs the intermediate.
- Clients trust a built-in store of root CA certificates.
- The client checks signatures, validity dates, hostname and revocation.
- The server must send the intermediate certificates.