Certificate chain order
Paste several certificates (or drop files). CertKit figures out which is the leaf, orders the chain leaf → intermediate → root, verifies each issuer signature and lists missing links.
Runs locally in your browser — nothing is uploaded
Ordered chain
—Issuer links
Add the missing certificate(s) above and run the ordering again.
Certificates that could not be linked
Notes
Ordered bundle (PEM)
The same certificates in leaf → root order — paste-ready for a server config.
The order is a consistency check, not a trust validation. For production trust decisions use a full certificate validator.
Questions
How does it find the order?
Every certificate names its issuer. CertKit matches each issuer name to the subject of the other certificates in your input, then verifies the issuer’s signature where possible. The certificate that issues nothing else is the leaf and the walk starts there.
What does a “missing issuer” mean?
One of your certificates was issued by a certificate that is not in the bundle (or is not in your paste). Servers need the complete chain; the report names the exact issuer you need to add.
Is the signature check a validation?
No. CertKit checks that each parent certificate cryptographically signed the child — a consistency check for building the chain. It does not validate trust anchors, revocation, hostnames or policy; use a real TLS validator for that.
What about duplicates?
Duplicates are detected (same subject and serial) and counted, then ignored for ordering — handy when a concatenated bundle has the same intermediate twice.
How this runs locally
CertKit is a static site. Parsing and cryptography run inside this browser tab using a vendored copy of node-forge 1.4.0 served from this domain. Open DevTools → Network, run the tool, and you will see no request that contains your file — nothing is uploaded, and nothing is stored.