Browsers summarize a certificate chain into a simple padlock; OpenSSL shows you every certificate the server actually sent, useful for confirming intermediates are correctly installed.
openssl s_client -connect yourdomain.com:443 -showcertsThe output lists each certificate in the chain the server presented, in order — your certificate first, followed by any intermediates. If an expected intermediate is missing from this output, that's the direct cause of "not trusted" errors some clients report even when the certificate itself is valid.
What to do if the chain shown is missing an expected intermediate certificate
A chain missing an intermediate certificate in the output means your server isn't sending the complete bundle — this is the same chain-completeness issue covered throughout this site's SSL Basics and Troubleshooting categories, generally fixed by installing the CA-provided intermediate bundle alongside your certificate.
How to save the displayed chain output to a file for further analysis
Redirecting the output of your OpenSSL chain-viewing command to a file (appending `> chain-output.txt` to the command) preserves the result for later reference or for sharing with a colleague troubleshooting the same issue, rather than needing to rerun the command each time you want to review it.
What the numbered output (0, 1, 2...) in the chain display actually represents
Each numbered entry in OpenSSL's chain output represents one certificate in the chain sent by the server, with 0 being your own end-entity certificate and increasing numbers representing each subsequent intermediate — the count and order directly reflects what your server is actually configured to send.
How to check a chain without requiring OpenSSL by using an online tool instead
Several free online SSL checker tools display a domain's full certificate chain visually without requiring any command-line tool installation, a convenient alternative when working from a machine without OpenSSL readily available, such as certain restricted or mobile environments.
Why examining the chain locally is faster than waiting for a full online scan report
A direct OpenSSL chain check returns results in seconds, while a comprehensive online SSL scan tool can take up to a minute or more to complete its full battery of tests — for a quick chain-specific check, the local command-line approach is considerably faster when you only need that one piece of information.
What to do if the command shows more certificates than you expect in the chain
Seeing more certificates than anticipated usually means multiple intermediate certificates are legitimately part of your specific chain (some CAs use two intermediates rather than one) — this is normal and not itself a problem, as long as each certificate in the sequence correctly connects to the next via matching issuer and subject fields.
How to check a chain for a server running on a non-standard port
Specifying the port directly in your OpenSSL connect command (yourdomain.com:8443, for instance) checks the chain served on that specific non-standard port, since OpenSSL defaults to port 443 unless a different port is explicitly given.
A closing note on this command's place in a broader troubleshooting toolkit
Alongside the redirect and mixed-content checks covered elsewhere on this site, direct chain inspection via OpenSSL rounds out a genuinely complete personal toolkit for diagnosing the most common categories of certificate-related issues without needing to rely solely on external tools.
A final thought on combining this with other tools covered on this site
Combining this chain-viewing technique with the certificate format conversion guide elsewhere in this category gives you a complete toolkit for inspecting, understanding, and correctly reformatting certificate files regardless of what state you receive them in.