How trust is built
The browser ships a set of root certificates (trust anchors). Your server presents a cert signed by an intermediate CA, which is signed by a root. The browser walks this chain up to a trusted root before it trusts you.
Certificate chain
| Role | Note |
|---|---|
| Root | Self-signed, preinstalled in OS or browser; private key never leaves |
| Intermediate | Signed by root, signs server certs, protects the root key |
| Server cert | Your domain cert, signed by an intermediate |
Two common setup mistakes
- Sending only the server cert: the browser cannot complete the chain and warns "not trusted"; you must serve the intermediates too;
- Wrong order: put the leaf cert first, intermediates after; some clients reject a wrong order.
Verify
Use openssl s_client -showcerts to see whether the chain served is complete. The cert itself is ASN.1 and can also be inspected as Base64.
Try it
Inspect Base64 encoding: Base64.