Production Security
TLS Certificate Chain Debugging Guide
Diagnose incomplete TLS chains, wrong virtual hosts and trust-store failures using reproducible client and server evidence. This reference is written for developers who need practical validation behavior, reviewable rules and safe examples rather than copied snippets with no explanation.
Recommended workflow
| Step | Why it matters |
|---|---|
| Send the server name | Use SNI so the endpoint returns the certificate for the intended virtual host. |
| Inspect the served chain | Check leaf, intermediate order, issuer relationships and unexpected duplicates. |
| Verify identity and time | Match SAN names and validity dates against the client clock. |
| Compare trust contexts | Browser, container, JVM and operating-system stores may trust different roots. |
Starter snippet
openssl s_client -connect example.com:443 -servername example.com -showcertsReview checks
- Serve intermediates but not the root certificate.
- Test from outside the origin network.
- Document renewal ownership and expiry monitoring.
- Keep private keys out of diagnostic output.
Common mistakes
- Testing by IP without SNI.
- Assuming one successful browser proves every client trusts the chain.
- Appending certificates without checking order.
Validation should help users correct input while protecting systems from bad data. Keep syntax checks, product policy, security review and deliverability checks separate.
Related Formalint references
Continue with Tls Certificate Debugging Guide, Ssl Renewal Debugging Guide, cURL TLS Debugging.