Why chains are matched by Subject/Issuer, not file order

A certificate chain is fundamentally a linked structure — each certificate's Issuer field names the Subject of the certificate that signed it, all the way up to a self-signed root where Issuer and Subject are the same. That relationship is what actually determines the chain, not whatever order the certificates happen to be pasted or concatenated in — a `fullchain.pem` file might list leaf-then-intermediate-then-root, or any other order depending on how it was generated. Reconstructing the chain by matching Subject/Issuer strings rather than trusting positional order is what makes this tool work correctly regardless of how the certificates were originally assembled.

"Issuer not in this set" is informative, not always an error

Root CA certificates are self-signed by definition, so a leaf or intermediate chain typically doesn't (and shouldn't) include the root — browsers and operating systems already trust well-known roots independently, via their own trust stores, without needing the server to send them. That means seeing "issuer not in this set" for what turns out to be the top of your chain is completely expected, not a problem. The same message on an intermediate certificate, however, usually does mean something's missing — a server that fails to send a required intermediate is a common, real-world cause of "certificate not trusted" errors on some clients even though the leaf certificate itself is perfectly valid.