diff --git a/backend/docs/API_REFERENCE.md b/backend/docs/API_REFERENCE.md
index 22699a0..70efa58 100644
--- a/backend/docs/API_REFERENCE.md
+++ b/backend/docs/API_REFERENCE.md
@@ -303,6 +303,39 @@ Get certificate details and status.
 
 Get parsed certificate details (issuer, subject, key type/size, validity, fingerprint). Only available for `issued` certificates.
 
+### GET /certs/tls/:id/chain
+
+Get the full certificate chain: leaf certificate details, parsed intermediate CA entries, and the PEM-concatenated full chain. Only available for `issued` certificates.
+
+**Response:**
+```json
+{
+  "leafCert": {
+    "serialNumber": "...",
+    "issuer": "...",
+    "subject": "...",
+    "validFrom": "2026-05-14T10:00:00.000Z",
+    "validTo": "2026-08-12T10:00:00.000Z",
+    "keyType": "RSA",
+    "keySize": 2048,
+    "fingerprint": "..."
+  },
+  "intermediates": [
+    {
+      "serialNumber": "...",
+      "issuer": "...",
+      "subject": "...",
+      "validFrom": "2026-01-01T00:00:00.000Z",
+      "validTo": "2031-01-01T00:00:00.000Z",
+      "fingerprint": "..."
+    }
+  ],
+  "fullChainPem": "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----"
+}
+```
+
+Returns `400` if the certificate has not yet been issued.
+
 ### PATCH /certs/tls/:id
 
 Update certificate metadata.
diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md
index 556135f..cc17b97 100644
--- a/docs/CHANGELOG.md
+++ b/docs/CHANGELOG.md
@@ -8,8 +8,12 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/). Dates a
 
 ## [Unreleased]
 
+---
+
+## [2026-05-28] — Certificate Chain
+
 ### Added
-- `GET /certs/tls/:id/chain` — returns intermediate CA chain details: per-entry subject, issuer, fingerprint, notAfter; plus `chainPem` (intermediates only) and `fullChainPem` (leaf + intermediates) fields. New `chainPem` column added to `tls_cert` table via migration. New shared types: `TlsCertChainEntry`, `TlsCertChainInfo`. (PR #79)
+- `GET /certs/tls/:id/chain` — returns full certificate chain info: leaf certificate details (`leafCert`), array of parsed intermediate CA entries (`intermediates`: serial number, issuer, subject, validity window, fingerprint per entry), and `fullChainPem` (leaf + intermediates, PEM-concatenated). New `chainPem` column added to `tls_cert` table via migration (stores the intermediate chain server-side; not itself part of the API response). New shared types: `TlsCertChainEntry`, `TlsCertChainInfo`. (PR #79)
 
 ---