SSL/TLS Certificate Chain of Trust — Interactive Architecture Visualizer

Client (Browser)

X.509 Chain Verifier

HANDSHAKE

Validation Engine Pending

Awaiting Server Certificate...

Active PubKey: None loaded

Parsed Cert Hierarchy

1. Leaf Cert none

2. Intermediate none

3. Root Anchor ISRG Root X1 (Local)

Chain Trust Depth 0 / 3 Verified

Web Server (example.com)

Leaf X.509 Identity

IDLE

Leaf Certificate Bundle

Subject (CN): example.com

Issuer: Let's Encrypt Y1

Public Key: RSA-2048 (0x9A..F1)

Validity: 90 Days (Valid)

OCSP Stapling: GOOD (Not Revoked)

Intermediate CA

Let's Encrypt Authority Y1

ISSUER

Authority X.509 Certificate

Subject: Let's Encrypt Y1

Signed By: ISRG Root X1

Public Key: ECDSA P-384

BasicConstraints: CA:TRUE, pathlen:0

Role: Signs Leaf Certs Online

Root CA (Trust Anchor)

ISRG Root X1 (Offline HSM)

TRUSTED

Anchor X.509 Certificate

Subject: ISRG Root X1

Issuer: ISRG Root X1 (Self)

Public Key: RSA-4096 (Pinned)

Distribution: OS / Browser Store

Private Key: Air-Gapped Vault ✓

1. The Validation Flow Initiates

When requesting a connection to https://example.com, the browser initiates the SSL/TLS handshake. The server must present proof of identity via a hierarchical Chain of Trust.