TLS certificate chains: leaf, intermediate and root

A TLS server normally presents a leaf certificate and the intermediates needed to build a path toward a trust anchor already held by the client. The root is usually not sent as proof of itself; trust comes from the client's trust store.

How certificate trust is built

Trust in a server certificate is built as a chain from the site certificate through intermediate certificate authorities to a root certificate trusted by the client. A server normally sends its own certificate and the required intermediates, but it does not need to send the root certificate.

How to check a certificate chain

Inspect the certificate for the actual hostname: validity dates, SAN names and intermediates. If one client trusts the site and another does not, compare their trust stores and the chain sent by the server; do not rely on a previously cached intermediate. For an independent reachability check, use 2ip server check; inspect the certificate chain separately.

Why clients can disagree about trust

Technical references: RFC 5280.