How an X.509 certificate chain establishes trust
An X.509 certificate chain (also called a chain of trust) links a server's certificate back to a trusted root through a sequence of digital signatures. The leaf certificate identifies the end entity, such as a website. It is signed by one or more intermediate certificate authorities, and the topmost intermediate is signed by a root CA whose certificate is self-signed. Each certificate is validated by checking the signature against the public key of the certificate above it.
Trust ultimately rests on the root, which is preinstalled in the operating system or browser trust store. If a client trusts the root and every signature in the chain verifies, the leaf is trusted.
Why intermediates exist
Root CA private keys are extremely valuable and are kept offline in hardware security modules. Intermediates let the root delegate day-to-day signing without exposing itself, and they can be revoked or rotated without distrusting the root. During a TLS handshake the server should send the leaf plus the intermediates so the client can build the full path; a missing intermediate is a frequent cause of trust errors. Validation also checks expiry dates, revocation status (via CRL or OCSP), and that each issuer was authorized to sign.