What you can check
- The chain: paste fullchain.pem; I show the order, spot an extra or wrong intermediate, and verify every signature.
- A CSR before sending it to the CA: SAN names, key size, the request signature.
- Key to certificate: after a renewal the old key is often left in place and nginx fails with key values mismatch.
The same in a terminal
openssl x509 -in cert.pem -noout -text
openssl req -in request.csr -noout -text -verify
openssl x509 -in cert.pem -noout -fingerprint -sha256
# the key matches if the hashes are equal
openssl x509 -in cert.pem -noout -pubkey | openssl sha256
openssl pkey -in key.pem -pubout | openssl sha256To check a live site, use the SSL checker; to create a key and CSR, the CSR generator.