What Does an X.509 Certificate Chain Validator Check?
An X.509 chain links a leaf certificate to one or more intermediate certificate authorities and an explicitly trusted root. This validator builds that path by issuer name and cryptographic signature, then checks certificate dates, Basic Constraints, CA signing usage, path-length limits, Key Usage, Extended Key Usage, critical extensions, and optional TLS hostname matching. It does not use your operating system trust store: only certificates pasted into the trusted-root field are treated as trust anchors.
How to Validate a PEM Certificate Chain
- 1Paste exactly one server, client, signing, or email leaf certificate in PEM format.
- 2Expand the chain inputs and paste any intermediate certificates supplied by the issuer.
- 3Paste only root certificates you explicitly trust; placing a certificate in the intermediate field does not make it trusted.
- 4Optionally enter the expected TLS hostname and choose the required Extended Key Usage purpose.
- 5Run validation, follow the built chain from leaf to root, and review every error or warning attached to its certificate.
Common Certificate Chain Checks
Diagnose incomplete TLS bundles
Find the leaf whose issuer is missing and determine which intermediate certificate must be included by a web server or load balancer.
Verify a private PKI chain
Provide an internal root explicitly and confirm that each intermediate is a CA with a valid signing relationship and permitted path length.
Check hostname and certificate purpose
Validate DNS SAN wildcard behavior and confirm that Extended Key Usage permits server, client, code-signing, or email use.
Inspect certificates before deployment
Review dates, SHA-256 fingerprints, subjects, issuers, SANs, and usage flags before installing a PEM bundle.
Frequently asked questions
Does this use my computer's trusted root store?
No. Browser JavaScript cannot safely enumerate the operating system trust store. A chain is trusted only when it terminates at a certificate supplied in the Trusted root certificates field.
Does the validator check OCSP or certificate revocation lists?
No. This tool performs deterministic offline validation and does not contact OCSP responders or download CRLs. A warning is always shown because a cryptographically valid chain may still contain a revoked certificate.
Can I paste certificates in the wrong order?
Yes. Intermediate and root bundles may contain certificates in any order. The validator matches issuer names and verifies signatures to build the chain, and reports certificates that were not used.
Are private keys accepted or uploaded?
No private key is required. Certificate parsing and verification run locally in the browser, and pasted PEM certificates are not uploaded.