Certificate chain checker
Drop your server certificate with its intermediates (a fullchain.pem, a .p7b, a PFX or separate files). PKIScope builds the chain from the leaf to the root, verifies each signature and constraint, shows where the chain breaks and which issuer is missing, and exports the certificates in the right order. Everything runs in your browser.
What you can do
- Builds the chain leaf → intermediate → root from the certificates you load
- Verifies each signature, validity period and basic constraint
- Finds a missing intermediate and shows its issuer and AIA download URL
- Detects bundles in the wrong order
- Exports a correctly ordered fullchain.pem
Frequently asked questions
How do I fix “unable to get local issuer certificate”?
An intermediate certificate is missing from what your server sends. The chain view shows which issuer is missing and the AIA URL to download it; add it after your certificate in the bundle.
What order should a certificate chain be in?
Server certificate first, then each intermediate, each signed by the next. The root is usually left out because clients already have it.
Does the checker test my live server?
No. It checks the certificates you load, and never connects to servers or fetches URLs. To test a live server, save what it sends (for example with openssl s_client -showcerts) and drop that here.
Does a complete chain mean browsers will trust it?
Only if the root is in the browser's trust store. PKIScope has no trust store, so it tells you whether the chain is complete and correctly signed, not whether a particular client trusts the root.
Related tools
- Certificate decoder — Decode an X.509 certificate from PEM, DER, CRT or CER
- Converter — All conversions: PEM, DER, PFX, PKCS#1/PKCS#8, chains, key passwords
- Kubernetes secret — Decode and check a Kubernetes TLS Secret
- PFX viewer — Open a PFX/P12 file and see every certificate and key inside