Cluster C3: Network & Security
Certificate chain basics for developers
TLS failures are often chain failures, not certificate-expiry failures. If intermediate certificates are missing or served in the wrong order, clients that do not cache intermediates will fail handshakes even when your leaf certificate looks valid.
How a certificate chain is validated
- Client validates the server certificate (leaf) against hostname and validity window.
- Client walks through intermediate certificates up to a trusted root in its trust store.
- If any intermediate is missing or mismatched, trust fails and TLS setup is aborted.
Practical input/output example
Input
leaf cert: valid intermediate cert: missing client trust store: standard
Output
TLS handshake: failed error: unable to get local issuer certificate
Operational checks before release
- Verify full chain file order on edge/load balancer configuration.
- Run handshake tests from multiple regions and client stacks.
- Monitor certificate expiry and intermediate replacement windows together.
- Keep rollback cert bundle ready for emergency renewals.