SSL Certificate Chain Validation
What This Check Does
The SSL Certificate Chain Validation check verifies that your server is presenting a complete and valid certificate chain. A complete chain includes your domain's end-entity certificate, any intermediate CA certificates, and a path that chains up to a trusted root CA. DNS Spy attempts to build and validate this chain — if it cannot be completed or verified, this check fails.
Why It Matters
An incomplete certificate chain causes TLS handshake failures for clients that don't cache intermediate certificates. While desktop browsers often work around missing intermediates using Authority Information Access (AIA) fetching, mobile clients, API clients, IoT devices, and strict TLS implementations do not. The result is that some visitors and integrations experience connection failures that appear intermittent and are difficult to diagnose.
A broken chain can also indicate certificate misconfiguration — for example, serving certificates in the wrong order, including an expired intermediate, or omitting a cross-signed certificate needed for compatibility with older trust stores.
Good vs. Bad Configuration
Bad Configuration
The server for example.com only sends the end-entity certificate. The intermediate CA certificate is missing from the chain. Some clients can complete the chain via AIA, but curl, OpenSSL, and mobile apps frequently fail with "certificate verify failed" errors.
Good Configuration
The server for example.com sends the complete chain: the domain certificate followed by one or more intermediate CA certificates. The chain validates to a trusted root CA. All clients — browsers, curl, APIs, and mobile apps — connect successfully.
How DNS Spy Monitors This
DNS Spy performs a full TLS handshake and attempts to validate the complete certificate chain during each monitoring cycle. If chain validation fails — due to missing intermediates, expired intermediates, or an untrusted root — an alert is raised. Correctly installing the full certificate chain on your server will resolve the alert on the next monitoring cycle.
Related
Check This on Your Own Domain
DNS Spy's free scan reads your live DNS, nameservers, SSL and email-authentication records and reports what it finds. No account required. Scan a domain →
If you want the same checks to keep running: DNS Spy re-resolves every monitored domain at least every ten minutes and alerts you when a record changes. See how monitoring works →
