Everything runs on your machine — your input is processed right here in your browser and never uploaded to any server.

SSL Chain Builder

or drop your certificate files (any order, PEM or DER) anywhere on this page

How it works

1

Paste all your certificates — domain, intermediate(s), root — in any order, or add them as files.

2

Click "Build chain" and check the ordered result: Leaf → Intermediate(s) → Root.

3

Download fullchain.pem (leaf + intermediates — what servers should send).

4

If you need the root included (some appliances ask for it), download chain-with-root.pem instead.

About this tool

Your certificate authority sent you a domain certificate, an intermediate, and maybe a root — and your server wants a single, correctly ordered fullchain.pem. This tool builds it: paste or upload the certificates in any order, as PEM text or binary .crt/.der files, and it sorts them leaf-first by following each certificate’s issuer link.

It does not just sort by name: every link is cryptographically verified — each certificate’s signature is checked against the next one’s public key in your browser — so a wrong intermediate is caught before it ever reaches your server. Certificates that do not belong to the chain are listed separately instead of being silently included.

100% private

Certificates are sorted and their signatures verified entirely in your browser — nothing is uploaded. Certificates are public data, and no private key is involved in building a chain at all.

Frequently asked questions

Which file do I give my web server?

fullchain.pem (leaf first, then intermediates) plus your private key file. Nginx wants exactly this pair; Apache 2.4.8+ takes the fullchain via SSLCertificateFile. The self-signed root is normally left out because clients already trust it.

What does "signature mismatch" on a link mean?

The next certificate’s name matches the issuer, but its key did not actually sign this certificate — usually a mixed-up intermediate from a different CA generation. Download the correct intermediate from your CA and rebuild.

Some certificates were "left out" — why?

They are not part of the leaf’s chain of trust: duplicates, certs from another domain, or cross-signs that do not connect. The chain you download contains only the certificates that verifiably link together.

Related tools

Popular right now