Download

Fix certificate chain order

A bundle in the wrong order is the classic reason a server refuses a certificate or a client fails to trust it. This guide sorts and validates a chain with CertConvert, offline, whatever order the files arrived in.

The correct order

A chain bundle goes leaf first:

  1. The leaf certificate, issued to your server or device.
  2. The intermediate CA that issued the leaf, then the CA that issued that intermediate, and so on up.
  3. The root CA, last.

The rule behind it is simple: each certificate’s issuer is the subject of the certificate that follows it. In a server bundle the root is optional, because clients already hold the roots they trust.

How a wrong order shows up

  • nginx refuses to start and reports a key mismatch, because the first certificate in the file is not the one the key belongs to.
  • Browsers work but curl, Java or a device reports that it cannot verify the first certificate. An intermediate is missing from the bundle.
  • An appliance or load balancer rejects the upload without saying why.

In the app

  1. Open the Chain view and drag in the certificates in any order, or choose Add Certificates…. Separate files and a single mixed-up bundle both work.
  2. Choose Validate Chain. CertConvert sorts the certificates leaf to root and marks each one OK or FAIL with the reason.
  3. Pick the export format: PEM Bundle (.pem), PKCS #7 (.p7b) or PKCS #12 (.pfx) With Key.
  4. Choose Export Chain…. A PEM bundle is written leaf first. A P7B holds the same certificates as an unordered set, which is how that format works, so the importer rebuilds the order itself.

For a PFX, add the leaf’s private key with Add Key File… and set a PFX Password first.

Validation anchors to a root you supply. Tick Trust System Roots to check against the operating system’s trusted CAs instead.

From the command line

The command line is part of a copy built from source. The Mac App Store and Microsoft Store editions are the graphical app only. Build from source to use these commands.
# sort three files into one correctly ordered bundle
certconvert chain build server.pem root.pem intermediate.pem -o fullchain.pem

# or re-order a bundle that is already one file
certconvert chain build mixed-up.pem -o fullchain.pem

# validate it
certconvert chain verify fullchain.pem
certconvert chain verify fullchain.pem --system-roots

# build an ordered PFX with the key attached
certconvert chain build server.pem intermediate.pem root.pem -o chain.pfx \
            --key server.key --out-password secret
A password typed on the command line is saved in your shell history and can be seen by other processes while the command runs. The command line has no other way to take one, and deleting the history line afterwards does not undo that exposure. For a password that matters, use the app.

chain build prints the order it found, leaf first. chain verify exits with code 2 when the chain is invalid, so it can gate a deployment script. A chain with no root still passes, with a note, because it is only verified as far as its last intermediate. To gate on trust as well, include the root or pass --system-roots, which fails unless the chain ends at a CA the operating system trusts.

What validation covers

CertConvert checks the order, each signature, the validity dates and the CA flags. It does not check revocation, which would need a network connection, and it does not check extended key usage. A chain that passes here can still be refused for either reason.

Common snags

“More than one chain is present”

The certificates do not link into a single chain. Usually an intermediate is absent, or a certificate from another chain was added by mistake. Download the missing intermediate from your certificate authority and add it. The leaf’s issuer name, shown in the Inspect view, tells you which one you need.

“Root certificate not supplied”

This is a note, not a failure. The chain was verified as far as its last intermediate. Add the root, or tick Trust System Roots, to confirm the trust anchor as well.

Two certificates have the same name

Authorities reissue intermediates with the same subject and a new key. Where certificates carry key identifiers, CertConvert links them by identifier and not by name alone, so it picks the intermediate that issued yours.

Should the root be in the bundle?

Usually not for a public web server. Include it where the destination asks for the full chain, such as a private CA deployment or some appliances.

CertConvert runs on macOS and Windows and never uploads your certificates or keys. Download CertConvert.