certificate chain
also: certification path, certificate path, trust chain, CA chain
A sequence of digital certificates linked together, where each certificate signs the next one, connecting a server's certificate back to a trusted root certificate authority.
A certificate chain (or certification path) is a series of X.509 certificates that establish trust from an end-entity certificate (like a website's SSL/TLS cert) up to a root certificate authority (CA). Each certificate in the chain is signed by the private key of the certificate above it, creating an unbroken chain of cryptographic trust.
The typical structure is: Server Certificate → Intermediate CA Certificate(s) → Root CA Certificate. When a client connects to a server, the server presents its certificate along with any intermediate certificates. The client validates each signature in the chain until it reaches a root CA it already trusts (usually pre-installed in the system's certificate store).
For example, when visiting https://example.com, your browser receives the site's certificate signed by an intermediate CA like "DigiCert SHA2", which is itself signed by the root "DigiCert Global Root CA". Your browser already trusts that root, so it accepts the entire chain as valid.