Certificate Chain Validator
Processing: API. Processed by cent-ai's API: sent to our server, held in memory, never stored.Enter a domain to validate its certificate chain: ordering, missing intermediates, expired links, and basic constraints. Nothing you enter here is stored or logged.
How to use it
- Enter a hostname, e.g.
example.com. - Select “Validate chain” to connect and inspect the presented chain.
- Review findings and the leaf-to-root chain display.
Example
Select “Use example” above to load a sample domain.
Privacy and security
- The hostname is sent to our API only to run the check; it is never persisted or logged.
- Private, loopback, link-local, and other reserved IP ranges are blocked.
Limitations
- Reports the chain as presented by the server in one connection — does not attempt alternate chain-building paths.
- Signature-algorithm strength within the chain is not checked (not exposed by the underlying TLS API without re-implementing certificate parsing).
FAQ
What does "only a single certificate presented" mean?
It means the server sent just the leaf certificate with no reachable intermediate — usually a sign that required intermediate certificates are missing from the server's TLS configuration, which can break clients that don't already have the intermediate cached.
Does this verify cryptographic chain-of-trust itself?
Trust is verified using the platform's own trust-store logic (the same as any TLS client would use), not a homegrown re-implementation. This tool reports on and structurally inspects what was presented — it does not reimplement certificate-chain cryptography.