Hack the Route Start free Open app Encryption and trust
Certificate chain
A server's certificate, signed by an issuing CA, whose certificate a root signed: the path a client follows to someone it trusts.
Roots sign rarely and keep their keys offline; issuing (intermediate) CAs sign servers' certificates. A server
sends its own certificate and every intermediate, never the root: the client must already have the root in its
trust store. A server that leaves out the intermediate fails with unable to get local issuer certificate in curl
and apps, while browsers that kept the intermediate from another site hide the mistake. openssl s_client -showcerts shows what a server really sends; openssl verify -untrusted checks a chain by hand.