What is a certificate chain (chain of trust)?

A certificate chain is the sequence of certificates that connects a server's own (leaf) certificate to a root certificate authority the client already trusts. Each certificate is signed by the next one up: leaf ← intermediate CA ← root CA. The server sends the leaf and the intermediates; the root comes from the client's trust store.

A three-level chain, verified

openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:P-256 -nodes -keyout root.key -out root.pem -subj "/CN=Example Root" -days 30 2>/dev/null
openssl req -newkey ec -pkeyopt ec_paramgen_curve:P-256 -nodes -keyout int.key -out int.csr -subj "/CN=Example Intermediate" 2>/dev/null
printf 'basicConstraints=critical,CA:TRUE\nkeyUsage=critical,keyCertSign,cRLSign\n' > ca.ext
openssl x509 -req -in int.csr -CA root.pem -CAkey root.key -extfile ca.ext -out int.pem -days 20 2>/dev/null
openssl req -newkey ec -pkeyopt ec_paramgen_curve:P-256 -nodes -keyout leaf.key -out leaf.csr -subj "/CN=www.example.test" 2>/dev/null
openssl x509 -req -in leaf.csr -CA int.pem -CAkey int.key -out leaf.pem -days 10 2>/dev/null
openssl verify -CAfile root.pem leaf.pem 2>&1 | tail -1
openssl verify -CAfile root.pem -untrusted int.pem leaf.pem

error leaf.pem: verification failed
leaf.pem: OK

Without the intermediate, verification fails; with it (-untrusted passes certificates that may be used to build the chain but are not trusted themselves), the leaf verifies against the root.

Why it matters

• Servers must send the intermediates. Browsers sometimes fetch a missing one, but curl, Python and most APIs do not, and fail with unable to get local issuer certificate.
• Only the root needs to be trusted locally; intermediates can be replaced without touching every client.
• openssl s_client -showcerts shows the chain a server actually sends.