YourSSLOutlet $1.95/moFree during preview
Menu

Certificate chain bench · free

Get the chain right.
Install it once.

Type a server's name and see exactly which certificates it sends, link by link. If an intermediate is missing, out of order or stray, you get a corrected fullchain.pem to install.

One TLS handshake on port 443, nothing else touched. Or paste a certificate file instead.

Rules

12

published, each with what to do

Contact with your server

1

TLS handshake on port 443

Certificates sold

0

no resale, no seals, no upsell

Bench Pass

$1.95/mo

or $19.50 a year · free during preview

Symptom lookup

The error you see, and the link that broke.

Most certificate trouble after an install is not the certificate itself. It is the chain around it: what the server sends, and in what order.

Message you seeWhereUsually meansRule
unable to get local issuer certificatecurl, PHP, Python, Node, GitThe server does not send the intermediate certificate.R04
Works on a desktop browser, fails on phones or appsAndroid, iOS apps, payment and mail serversSame: desktop browsers often fill in a missing intermediate on their own.R04
NET::ERR_CERT_COMMON_NAME_INVALID · SSL_ERROR_BAD_CERT_DOMAINChrome, Edge · FirefoxThe name you typed is not in the certificate's names list.R01
NET::ERR_CERT_DATE_INVALID · certificate has expiredBrowsers · OpenSSL toolsThe certificate, or an intermediate, is out of date.R02 R08
NET::ERR_CERT_AUTHORITY_INVALIDChrome, EdgeSelf-signed, a private root, or a missing intermediate.R07 R04
key values mismatch · certificate and private key do not matchNginx · ApacheThe certificate was issued for a different key. Paste the request (CSR) with the certificate to see.R12

How the bench works

Read. Check. Fix.

  1. 01

    Read what is really sent

    One TLS connection to port 443 with the right server name, recording every certificate in the order the server sends it. Or paste the files you were given: PEM, DER, .p7b, or a CSR.

  2. 02

    Check every link by signature

    Each certificate must be signed by the next one. We verify the signatures, not just the names, then run the twelve published rules: names, dates, order, missing or stray certificates, trust, key and signature strength.

  3. 03

    Take the corrected files

    A missing intermediate is fetched from the issuer's own address in the certificate and checked. You get fullchain.pem, chain.pem and the install sheet for Apache, Nginx or cPanel.

Tool 01Check a serverType a name. See the chain it sends, link by link, with the rules applied. Tool 02Read a filePaste or upload .pem .crt .cer .der .p7b or a CSR. Private keys are refused. GuideInstall sheetsWhich file goes in which box, for Apache, Nginx and cPanel. WorkbenchYour BenchKeep readings with notes behind a private link. No account, no email.

Pricing

The bench is free. The Pass is for people who install a lot.

We sell no certificates, issue none, resell none, and show no "secured by" seals. The only thing for sale is more room on the bench.

Free during preview: every Bench Pass feature is on for everyone and no payment is taken.

Free

$0

always

  • 10 server checks a day
  • No daily limit on file reads (fair use: 120 an hour), up to 6 certificates each
  • fullchain.pem, chain.pem and leaf.crt downloads
  • Install sheets and all twelve rules
  • Bench of 3 saved readings with notes

Bench Pass

$1.95/month

or $19.50 a year (two months free)

  • 60 server checks a day
  • Up to 30 certificates per file read
  • Bundle ZIP: all files + DER + a README of which box each goes in
  • Bench of 50 saved readings
  • Check a saved server again and see what changed
  • CSV of your Bench

Free during preview. No payment is taken and nothing to sign up for: every Pass feature is already on.

Plainly

What this bench does not do

  • No private keys. Anything containing a private key is refused before it is read, and nothing of it is kept.
  • No watching. It checks when you ask. There is no background monitoring, no expiry alerts, no emails.
  • No security audit. It reads certificates. It does not test ciphers, scan ports or judge how safe a site is.
  • No private networks. Only public servers are contacted; internal and reserved addresses are refused.