# SSL Certificate Chain Builder: Download fullchain.pem

> Build a domain's complete certificate chain in the right order and download fullchain.pem, cert.pem and chain.pem.

Source: https://ssl.sh/tools/chain-builder/
Last updated: 2026-11-10

Fetch a server's certificate chain and download it as fullchain.pem, cert.pem and chain.pem in the right order.

The chain builder gives you the complete certificate chain for a server in the right order. Enter a host name (and port if it is not 443), press **Build chain** and download `fullchain.pem`, ready for Nginx, Apache, HAProxy or a hosting panel. You can also paste a single leaf certificate to see where its issuing certificate can be downloaded.

## How to use it

**From a server**

1. Enter the host name, for example `www.example.com`, and the port.
2. Press **Build chain**. The tool lists each certificate with its subject, issuer and expiry date.
3. Copy or download `fullchain.pem` (leaf + intermediates), `cert.pem` (leaf) or `chain.pem` (intermediates).

**From a certificate**

1. Choose **From a certificate** and paste the leaf certificate in PEM.
2. The tool decodes it locally and shows the **CA Issuers** URL from the certificate's Authority Information Access extension. That URL serves the intermediate certificate that signed it, usually in DER format; convert it with the [SSL converter](https://ssl.sh/tools/ssl-converter/der-to-pem/).

## Why chain order matters

During the handshake the server sends a list of certificates. TLS 1.2 required the leaf first and each following certificate to certify the one before it; TLS 1.3 relaxed the rule but recommends the same order, and many clients still depend on it. If an intermediate is missing, clients that cannot fetch it on their own report errors such as [missing intermediate certificate](https://ssl.sh/errors/missing-intermediate-certificate/) or `curl: (60)`.

## After you have the chain

- Replace the certificate file on the server with `fullchain.pem` and reload the server.
- Run the [SSL checker](https://ssl.sh/tools/ssl-checker/) again: the chain should be reported as complete.
- If your CA offers several chains (Let's Encrypt has offered alternate chains in the past), use the one your oldest clients trust; check with the [certificate decoder](https://ssl.sh/tools/certificate-decoder/).


## FAQ

**Should the root certificate be in my chain file?**

No. Clients already have the root in their trust store, and sending it only adds bytes to every handshake. The builder leaves self-signed roots out of fullchain.pem and chain.pem.

**Which file do I give to Nginx, Apache or my panel?**

Nginx ssl_certificate, Apache 2.4.8+ SSLCertificateFile, HAProxy and most hosting panels want fullchain.pem. Old Apache versions and Tomcat's certificateChainFile take cert.pem and chain.pem separately.

**My browser shows the site as secure, so why fix the chain?**

Desktop browsers can repair a missing intermediate from cache or by downloading it. curl, Java, Python, Android apps and many API clients cannot, and fail with errors such as 'unable to get local issuer certificate'.