Certificate chain fixer — order and complete an SSL bundle

An online tool for ordering and completing an SSL certificate chain. Paste the certificates you were given in any order and it works out which is the server certificate, which are intermediates and which do not belong, verifies every signature in the chain, and hands back a correctly ordered file ready for nginx or Apache. If the intermediate is missing it can download it from the address named inside your certificate.

How to use it

1
Paste everything you were given

The certificate, the intermediate, the CA bundle, in any order. Several files can be dropped at once.

2
Read the diagnosis

The tool says what is wrong: wrong order, missing intermediate, an unrelated certificate mixed in, or a broken signature.

3
Fetch the intermediate if it is missing

One button, using the address written inside your own certificate.

4
Install the corrected file

Copy fullchain.pem to your server and point ssl_certificate at it. Configuration snippets are below the file.

Turn a pile of certificates into the file your server actually wants

Paste above, drop files anywhere on this box, or
Order does not matter, duplicates do not matter, and extra certificates that do not belong will be identified. .p7b and .p7c bundles are unpacked automatically.

What it does

Finds the missing intermediate and fetches it
When the chain does not reach a root, the certificate itself usually names a download URL in its Authority Information Access extension. That address cannot be read from a browser, so the fetch happens on our side and the certificate is added to your chain in one click.
Order does not matter
Paste the files in whatever order you have them. Duplicates are removed, and certificates that belong to a different chain entirely are identified rather than silently mixed in.
Verifies every signature
Each link is checked cryptographically, not just by matching issuer and subject names. A chain that looks right but is not actually signed the way it claims will be caught.
Unpacks .p7b and .p7c
Certificate authorities often serve intermediates as PKCS#7 bags, which are not certificate files and cannot simply be pasted into a server config. Those are unpacked automatically.
Leaves the root out
Clients ignore a root certificate sent over the wire — they only trust the copy in their own store. The generated file omits it, which is what the specification calls for and what saves bytes on every handshake.
Catches the expired intermediate
An expired intermediate breaks a site exactly like an expired server certificate, but browsers blame the leaf — which makes it one of the hardest TLS faults to diagnose. It is called out explicitly here.

Frequently asked questions

My site works in Chrome but fails on Android, in curl and in Java. Why?

Because the intermediate certificate is missing from what your server sends. Desktop browsers hide this: they cache intermediates seen on other sites, and can download a missing one from the address in the certificate. Android, curl, Java, Python and most API clients do neither, so they see a chain that never reaches a trusted root and refuse the connection. Paste your chain here — if it says an intermediate is missing, that is the whole bug.

What order should the certificates be in?

Server certificate first, then the intermediate that issued it, then that one's issuer, and so on. The root is omitted. Some servers tolerate a different order, but OpenSSL, Java and most load balancers do not, so the safe answer is always leaf-first.

Should the root certificate be in the file?

No. A client trusts a root because it is in the client's own store, not because a server sent it — so a root over the wire is ignored, and only adds a kilobyte or two to every single handshake. It is harmless but pointless, and the file this tool produces leaves it out.

Where do I get the intermediate if my certificate does not name one?

From the certificate authority, on the same page where you collected your certificate. Let's Encrypt users normally never hit this, because certbot writes fullchain.pem with the intermediate already included — if you are configuring cert.pem instead of fullchain.pem, switching the path is the fix.

What does "unrelated certificate" mean?

A certificate in your file that neither issued anything else there nor was issued by anything there. Usually it is a leftover from a previous certificate, or a root pasted in alongside a chain that already reaches a different root. It does not break anything on its own, but it means the file was assembled by hand and is worth cleaning up.

You May Also Like

📝 CSR generator 🔄 Certificate format converter 🔗 Key and certificate matcher 🧰 Let’s Encrypt troubleshooter 🔐 SSL Checker 📜 SSL certificate decoder 🏷️ Self-signed certificate generator

How do you rate this tool?

Thank you for your rating!
Want to share more? Leave a comment!
Thank you! Your comment will appear after moderation.
Who is this tool for?
💻 Developers & IT Pros 🔒 Security & Privacy
Published Updated Author: