Certificate Chain
also called Chain of Trust
The sequence from a server's certificate through one or more intermediate CAs to a root the client already trusts.
A client trusts a small set of root certificates shipped with the operating system or browser. A server's certificate is signed by an intermediate, which is signed (possibly through more intermediates) by a root. Validation walks the chain to a trusted root.
The failure that causes most certificate incidents is an incomplete chain: the server sends its own certificate but not the intermediates. Browsers often recover by fetching them; many API clients, mobile apps and command-line tools do not — so the site works in a browser and fails everywhere else, which makes the diagnosis confusing.
Also worth knowing: root expiry affects old clients that never received an update, which is what caused widespread failures when a long-lived root expired in 2021 despite every server certificate being valid.