Skip to content
rcrootcerts.com

Tools

Trust Chain Visualizer

A browser does not trust a website. It trusts a root, and then verifies a path from that root down to the certificate the server presented.

  1. Root CA

    Already in trust store

    CN=Example Trust Root R3, O=Example Trust

    A certificate your browser already trusts because it ships in the trust store.

    ↓ signs

  2. Intermediate CA

    Sent by server

    CN=Example TLS RSA Issuing CA 2026, O=Example Trust

    A middle certificate that connects the website's certificate back to something trusted.

    ↓ signs

  3. Leaf certificate

    Sent by server

    CN=www.example.com

    The certificate the website presents to prove it is really that website.

    ↓ presented by

  4. Presented by the endpoint

    Sent by server

    Website, API, application, device or workload

    The service you are connecting to.

Simulate a failure

Path builds to a trusted root. Names, dates, usage, revocation and SCTs all check out.

Why clients disagree

  • Different clients ship different root stores.
  • Some fetch missing intermediates via AIA; many do not.
  • Cross-signed roots create more than one valid path.
  • Revocation checking behaviour varies widely.
  • Pinned certificates bypass path building entirely — and break on renewal.