Is it possible for a single server to use two different certificate chains for TLS?

For instance, rootCA1, intermediateCert1, serverCert1, rootCA2, intermediateCert2, serverCert2.

If this is possible, what order should the .PEM file use: serverCert1, intermediateCert1, rootCA1, serverCert2, intermediateCert2, rootCA2.

  • 5
    What are you trying to gain by having two different certificate chains? Are you trying to increase trust by having two chains that each chain-up to different root certificates? If so, then you might want to consider using a cross-signed certificate.
    – mti2935
    Commented May 17 at 9:27

1 Answer 1


It is not possible to send two different leaf certificates + chain inside the same TLS handshake. It is possible though for a server to decide which single leaf certificate + chain to send based on the ciphers or signature algorithms supported by the client, specifically have both RSA and ECDSA certificate and send the one which the client can use. If this is possible and how it gets configured depends on the server.

It would also be possible for the server to send chain certificates which the client might or might not use in the hope to be more compatible with different clients this way. In practice clients can get confused though, in that they follow one chain and then fail to find a valid root CA at the end, but then don't retry with a different possible chain. This was at least the case with older versions of OpenSSL.

  • In addition to ciphersuites (1.2 down) and sigalgs (1.2 up), many servers today consider SNI and don't work at all with ancient or defective clients that don't send SNI. Commented May 17 at 23:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .