Everything runs on your machine — your input is processed right here in your browser and never uploaded to any server.
Paste all your certificates — domain, intermediate(s), root — in any order, or add them as files.
Click "Build chain" and check the ordered result: Leaf → Intermediate(s) → Root.
Download fullchain.pem (leaf + intermediates — what servers should send).
If you need the root included (some appliances ask for it), download chain-with-root.pem instead.
Your certificate authority sent you a domain certificate, an intermediate, and maybe a root — and your server wants a single, correctly ordered fullchain.pem. This tool builds it: paste or upload the certificates in any order, as PEM text or binary .crt/.der files, and it sorts them leaf-first by following each certificate’s issuer link.
It does not just sort by name: every link is cryptographically verified — each certificate’s signature is checked against the next one’s public key in your browser — so a wrong intermediate is caught before it ever reaches your server. Certificates that do not belong to the chain are listed separately instead of being silently included.
100% private“Certificates are sorted and their signatures verified entirely in your browser — nothing is uploaded. Certificates are public data, and no private key is involved in building a chain at all.”
fullchain.pem (leaf first, then intermediates) plus your private key file. Nginx wants exactly this pair; Apache 2.4.8+ takes the fullchain via SSLCertificateFile. The self-signed root is normally left out because clients already trust it.
The next certificate’s name matches the issuer, but its key did not actually sign this certificate — usually a mixed-up intermediate from a different CA generation. Download the correct intermediate from your CA and rebuild.
They are not part of the leaf’s chain of trust: duplicates, certs from another domain, or cross-signs that do not connect. The chain you download contains only the certificates that verifiably link together.