A TLS session is only as trustworthy as the path from the leaf certificate back to a root the client trusts. That path is the certificate chain, and a deployment claim should be able to read it from the public edge rather than assume it.

The leaf is not the whole story

The certificate presented for the hostname is the leaf. It carries the exact subject and validity dates you check with check-tls-expiry.sh. But the leaf is signed by an intermediate CA, which is in turn signed by a root. A client validates every link in that chain. If the edge only presents a leaf without the intermediate, a deep-validation client may fail even though the leaf itself is fine.

Read the chain the edge actually sends

openssl s_client -showcerts prints every certificate in the chain the server sent. Against this site the answer is a leaf plus intermediates back toward a root the CA publishes:

certificate 0: CN=www.xbcatm.com
    issuer    : C=US, O=Let's Encrypt, CN=YE1
    notAfter  : Nov 19 08:37:12 2026 GMT

certificate 1: CN=YE1 (intermediate)
    issuer    : C=US, O=ISRG, CN=Root YE

certificate 2/3: Root YE / ISRG Root … (trust anchors)

Four certificate blocks arrived. The site presents the leaf plus the intermediates that let a client build a path to a publicly trusted anchor. An operator who only looks at the leaf would miss whether the intermediate is present.

Why the intermediate matters for trust

The root itself is the thing a client walks up to. Intermediate issuers exist so that roots can be kept offline and revoked without reissuing every leaf. When you authorize issuance with a CAA record, you authorize the issuer (the intermediate/CA), not just the eventual leaf. The dns-caa-records note records how to make that authorization explicit. This note is the other half: confirm the presented chain actually runs through that issuer.

Check the chain without breaking the service

A read-only probe costs nothing on the wire:

$ echo | openssl s_client -connect www.xbcatm.com:443 -servername www.xbcatm.com -showcerts 2>/dev/null | grep 'BEGIN CERT' | wc -l
4

Expect at least a leaf and one intermediate. A chain of exactly one certificate with no intermediate for a public CA is a signal the edge is not sending the full path and should be investigated before trusting the rollout.

Sources