What is a certificate chain?

Short answer

A certificate chain (chain of trust) is the signature links that run from the server certificate to the intermediate CA certificate that signs it, and from there to the root CA certificate. Since only root CAs are in the client's trust store, the server must send the intermediate certificates together with its own certificate; if an intermediate certificate is missing, many clients, especially API clients and mobile applications, do not trust the certificate. In TR7, the chain is set up with the Intermediate Cert. Content and Root Cert. Content fields of the certificate record and is shown in the Chain tab in the preview with the signature of every link validated.

Where It Is Used in TR7

Where	Field / label	What for
Certificates & PKI → SSL/TLS Certificates → Manual or PFX	Intermediate Cert. Content, Root Cert. Content: Disabled, Without Profile, Use Profiles	Adding the chain to the certificate record: with Without Profile, the content is pasted; with Use Profiles, a CA record is selected
SSL/TLS Certificates → preview → Chain	Trust chain is complete, Missing intermediate certificate — required issuer; link roles Root CA, Intermediate CA, Certificate	Seeing the status of the chain and every link
Chain tab	Suggest Completion, Also try downloading from the issuer's address (AIA), Add to this certificate's chain	Finding the missing link in other records, in CA records or at the AIA address and adding it; applies only to Manual and PFX records
Certificates & PKI → Certificate Authorities (CA)	Add a trusted CA certificate	Keeping an intermediate or root CA as a single record that multiple certificates will use (Use Profiles)

TR7 itself manages the chain of the certificates of the ACME.SH and Internal CA types; the chain in a PFX file is taken from the file.

How Does It Work?

1. In the handshake, the server sends its own certificate and the intermediate certificates.
2. The client matches the issuer of each certificate with the subject of the link above it and validates the signature with the public key of that link (RFC 5280).
3. If the chain reaches a root CA in the client's trust store, the certificate is trusted; if it does not, the connection ends with an "untrusted certificate" error.

The Chain tab of TR7 shows Trust chain is complete when the chain reaches a root CA in the record; otherwise, it writes the signer of the last link in the Missing intermediate certificate — required issuer message. If the link that appears missing is the root CA, the certificate is still served to clients with a full chain; the root comes from the client's trust store.

Common Misconceptions

• "If it opens in the browser, the chain is complete." Browsers can complete a missing intermediate certificate from the cache or from the AIA address; curl, API clients and mobile applications can reject the connection (How do I tell if the certificate chain is incomplete?).
• "The root certificate must always be added to the chain." The client already carries the root in its trust store; what is critical is the intermediate certificates.
• "When the chain changes, the vServices that use the certificate are updated one by one." The chain is part of the certificate record; when the record is updated, all the vServices that use it serve the new chain.

How it is done in the documentation

• SSL/TLS Certificates · The Certificate Chain
• SSL/TLS Certificates · Chain Tab
• SSL/TLS Certificates · Intermediate Cert. Content

Related questions

• How do I add the intermediate certificate chain?
• How do I tell if the certificate chain is incomplete?
• What is the difference between a root CA and an intermediate CA?
• What is AIA (Authority Information Access)?