Certificate Chain Completer

Paste only your own certificate. We follow its issuer links, find the missing intermediates and give you the full chain file to install.

Short answer

The certificate chain completer takes only your own SSL certificate in PEM format, follows the issuer link inside it to download the missing intermediate certificates, checks that they lead to a trusted root, and returns the chain in the correct order as a fullchain.pem file for Nginx or Apache. The root certificate is shown separately because the server does not need it.

Last updated: 2026-10-18

What is a certificate chain and why is it incomplete?

A certificate chain is the series of certificates that connects your website's certificate to a root certificate authority that browsers already trust. Your certificate is usually signed by an intermediate certificate, and that intermediate is signed by a root.

Browsers hold roots, not intermediates, so your server must send the intermediates itself. Many certificate authorities deliver three files: your certificate, a bundle with the intermediates, and sometimes the root. If you install only the first, some visitors still see a padlock, because Chrome can fetch the missing piece. Others fail: curl, payment gateways, API clients, older Android versions and mail software cannot. This tool rebuilds the missing part.

Leaf: the certificate issued for your domain.
Intermediate: the certificate of the issuing authority; one or two may be needed.
Root: the trust anchor stored in browsers and operating systems; not installed on your server.

How do I complete my chain, step by step?

Paste your certificate, press the button, then download the file that matches your server.

Open your certificate file. It is text that starts with -----BEGIN CERTIFICATE-----. Copy the whole block, including the first and last lines.
Paste it into the box. Never paste a private key; the tool blocks it in your browser before anything is sent.
Press Complete the chain. We read the issuer link inside the certificate, download each missing certificate and check the signatures link up to a trusted root.
Check the ordered list: your certificate first, then each intermediate.
Download fullchain.pem, or copy the intermediates only if your hosting panel has a separate CA bundle field.

The certificate is public data, but it is sent to our server so that the server can make the downloads. We do not store it.

How do I install fullchain.pem on Nginx or Apache?

Replace your current certificate file with fullchain.pem and keep your private key file unchanged. The file must contain your certificate first, then the intermediates, and no root.

Nginx: set ssl_certificate to fullchain.pem and keep ssl_certificate_key pointing to your private key. Run nginx -t, then reload Nginx.
Apache 2.4.8 or newer: set SSLCertificateFile to fullchain.pem and keep SSLCertificateKeyFile as it is. Reload Apache.
Older Apache or hosting panels: put only your certificate in the certificate field and the intermediates in the CA bundle field, or point SSLCertificateChainFile to the intermediates file.

Afterwards run the SSL checker on your domain. The missing intermediate warning should be gone. If you manage several .ae or .com domains, repeat the check for each one, because each certificate has its own chain.

Why did the tool not find an intermediate, and what are its limits?

The tool can only follow the issuer link written inside your certificate, so it fails when that link is missing or dead.

No issuer link: some certificates do not contain one. Download the intermediate from your certificate authority's website.
Link unreachable: the authority's file server may be offline. Try again later or use the authority's download page.
Private root: a company-internal authority is reported as an untrusted root. That is expected for internal use but not for a public website.
Expired certificate: a chain cannot fix an expired leaf. Renew the certificate first.

For safety, the tool only fetches public addresses over ports 80 and 443, ignores files above 100 KB and follows at most six issuer links. It does not check revocation. If your problem is a key that does not match the certificate, use the certificate and key matcher instead.

Frequently asked questions

Should the root certificate be in my server file?

No. Browsers and operating systems already contain their trusted roots, so sending the root only makes every handshake larger. Your server file should hold your certificate followed by the intermediates. The tool shows the root separately so that you can see where the chain ends, but it keeps the root out of fullchain.pem.

In what order must the certificates be in fullchain.pem?

Your own certificate comes first, then the intermediate that signed it, then the next intermediate if there is one. Each certificate must be the issuer of the one before it. Some clients are strict about this order. The tool builds the file in exactly this order, so you can use it without rearranging anything.

Is it safe to paste my certificate into this tool?

A certificate is public: every visitor receives it when connecting to your site. It is sent to our server so that the server can download the missing intermediates, and we do not store it. Never paste a private key. The tool blocks private keys in your browser before anything is sent, but you should never copy a key into a web page.

What if my certificate has no issuer link?

Then the tool cannot download the intermediate on its own and says so. Open the website of the authority that issued your certificate, find its intermediate or CA bundle download page, choose the file matching your certificate type, and place it after your certificate. Afterwards, check the result with the SSL checker.

Does completing the chain fix an expired or mismatched certificate?

No. The chain only links your certificate to a trusted root. An expired certificate must be renewed, and a certificate that does not list your domain must be reissued with the right names. The tool reports an expired leaf so you do not waste time on the chain when the certificate itself is the problem.