Cart 0

No products in the cart.

Account

Support guide

SSL Certificate Chain: Root, Intermediate and Bundles Explained

Most "not trusted" errors after an install come from a missing intermediate certificate. Here is how the chain works and how to build a correct bundle.

5 min read

Short answer: intermediate SSL certificates link your site’s certificate to a root certificate that browsers already trust. Your server must send your certificate plus the intermediate(s); if one is missing, many clients show “certificate not trusted”. Build the bundle in this order: your certificate first, then the intermediate(s). Leave the root out.

CertificateWho holds itSent by your server?
Leaf (server) certificateYou – issued for your domainYes, always first
Intermediate certificate(s)The CA – included in your issuance email or downloadYes, after the leaf
Root certificateBrowser and OS trust storesNo (usually omitted)

Is your chain complete?

Enter your domain and see every certificate your server sends, in order.

Test it with the SSL checker

How the SSL certificate chain works

An SSL certificate chain, also called the chain of trust, is a sequence of certificates where each one is signed by the next. The browser follows the signatures upward until it reaches a root it already trusts. If any link is missing, the trust check fails.

Root CA certificate        (stored in the browser/OS trust store)
  └── signs → Intermediate CA certificate   (sent by your server)
        └── signs → Leaf certificate: www.example.com   (sent by your server)

What is a root certificate in SSL?

A root certificate is the self-signed certificate at the top of the chain. Operating systems and browsers ship a list of trusted roots, called the root store, and update it through software updates. CAs keep root keys offline and do not sign customer certificates with them directly.

What is an intermediate certificate?

An intermediate certificate is a CA certificate signed by the root, which then signs customer certificates. It lets the CA keep the root offline. You get it from the CA together with your certificate, often as a file named ca-bundle, chain.pem or .p7b.

What is a leaf certificate in SSL?

The leaf, or end-entity certificate, is the one issued for your domain. It cannot sign other certificates. It carries your domain names, your public key and the validity dates.

Should the bundle include the root certificate?

Usually not. Clients already have the root in their trust store, so sending it adds bytes to every handshake without adding trust. Some checkers flag an included root as “contains anchor”, which is a warning, not an error. A chain can also have two intermediates, for example when a CA uses a cross-signed certificate to reach older roots. In that case include every intermediate the CA supplied, in the order given, ending with the one closest to the root.

Why intermediate SSL certificates cause “not trusted” errors

A missing intermediate is the most common reason a freshly installed certificate shows as not trusted. Your server sends only the leaf, and the client cannot connect it to a root.

The error is often inconsistent. Some desktop browsers can fetch a missing intermediate from the address in the certificate’s Authority Information Access (AIA) field, or keep a cache of known intermediates. Many other clients do not: curl, git, Python, Java, payment gateways, APIs and some mobile apps. That is why a site can look fine in your browser and still fail elsewhere.

Tip: Never test a chain only in your own browser. Use the SSL checker or openssl s_client, which show exactly what the server sends.

How to bundle SSL certificates (combine and concatenate)

  1. Collect the files

    Your certificate (e.g. example_com.crt) and the CA's intermediate file(s) from the issuance email or your account.

  2. Concatenate in order

    Leaf first, then each intermediate, ending with the one closest to the root. Linux/macOS: cat example_com.crt intermediate.crt > fullchain.pem. Windows (cmd): type example_com.crt intermediate.crt > fullchain.pem

  3. Check the joins

    Open the file. Each "—–END CERTIFICATE—–" must be on its own line, followed by "—–BEGIN CERTIFICATE—–" on the next line.

  4. Verify

    Run openssl verify -untrusted intermediate.crt example_com.crt. "OK" means the chain builds to a trusted root.

How to install an intermediate SSL certificate

Where the bundle goes depends on the server. On Nginx, point ssl_certificate to the full-chain file. On Apache 2.4.8 and later, SSLCertificateFile can hold the leaf plus intermediates. On IIS, intermediates belong in the Intermediate Certification Authorities store, which a .p7b or a PFX with chain fills for you. For full server steps, see how to install an SSL certificate.

After a change, reload the web server and test again. To see the chain your server sends, run:

openssl s_client -connect example.com:443 -servername example.com -showcerts </dev/null

Look at the “Certificate chain” list at the top and “Verify return code” at the end. Code 0 (ok) means the chain is complete.

“SSL certificate problem: unable to get local issuer certificate”

This error means the client could not find the certificate that issued the one it received. Either the server did not send the intermediate, or the client’s own CA bundle lacks the root or a private CA.

First test the server with the SSL checker. If the chain is incomplete, fix it on the server. If the chain is complete, the problem is on the client side:

  • Outdated CA bundle: update the OS package (ca-certificates) or the root store; see clear SSL state and update root certificates.
  • curl: curl --cacert /path/to/ca.pem https://example.com
  • git: git config --global http.sslCAInfo /path/to/ca.pem
  • Git for Windows: git config --global http.sslBackend schannel uses the Windows certificate store.
  • Node.js / Python: set NODE_EXTRA_CA_CERTS or REQUESTS_CA_BUNDLE to the CA file.

“Self signed certificate in certificate chain”

This means the chain ends in a root the client does not trust. Common causes are a company proxy or antivirus that inspects HTTPS, or an internal private CA. Add that root to the client’s trust store with the options above. Self-signed and private CAs are explained in self-signed vs CA-signed SSL.

Tip: Do not “fix” these errors with -k, http.sslVerify false or similar. That turns off protection against impersonation. Why it is risky and when it is acceptable is covered in disabling SSL verification.

Chain errors: cause and fix

MessageLikely causeFix
Verify return code 21: unable to verify the first certificateServer sends leaf onlyAdd intermediate(s) to the server bundle
Verify return code 20 / “unable to get local issuer certificate”Missing intermediate or outdated client CA bundleFix server chain; update client CA bundle
Verify return code 19 / “self signed certificate in certificate chain”Untrusted root (proxy, private CA)Add that root to the client trust store
Chain shows wrong intermediateOld bundle from a previous certificateDownload the bundle that matches the new certificate
Key does not match certificateFiles concatenated in the wrong orderPut the leaf first, intermediates after

After every change, run the SSL checker again to confirm the full chain is served.

Confirm your fix

Check the chain, hostname and expiry your server sends right now.

Run the SSL checker

Related articles

Frequently asked questions

My site shows "certificate not trusted" after installing. What's wrong?

In most cases your server sends only your own certificate and not the intermediate certificate. Some browsers can fill the gap, but many clients cannot, so they cannot reach a trusted root. Download the CA bundle for your certificate, place it after your certificate in the server configuration, reload the server and test with an SSL checker until the full chain shows.

What is an intermediate certificate and where do I get it?

An intermediate certificate is a CA certificate that sits between the trusted root and your certificate. It is signed by the root and signs your certificate. The CA supplies it with your certificate, usually in the issuance email or the download area, as a ca-bundle, chain or .p7b file. Always use the bundle that matches your current certificate.

What is a root certificate in SSL?

A root certificate is the self-signed certificate at the top of a chain of trust. Browsers and operating systems ship a list of trusted roots and update it through software updates. Your server normally does not send the root, because clients already have it. If a client lacks the root, it reports an untrusted or unknown issuer.

How do I install an intermediate SSL certificate?

Combine your certificate and the intermediate(s) into one file, leaf first, and point your web server to it: ssl_certificate on Nginx, SSLCertificateFile on Apache 2.4.8 and later. On IIS, import the .p7b or a PFX with chain so intermediates land in the Intermediate Certification Authorities store. Reload the server and verify the chain with openssl s_client or an SSL checker.

What is a leaf certificate in SSL?

The leaf certificate, also called the end-entity or server certificate, is the one issued for your domain. It sits at the bottom of the chain, holds your domain names and public key, and cannot sign other certificates. Your server sends it first, followed by the intermediate certificates that connect it to a trusted root.

How do I bundle SSL certificates?

Concatenate the files in order: your certificate first, then each intermediate, ending with the one closest to the root. On Linux or macOS use cat example_com.crt intermediate.crt > fullchain.pem. Make sure each END CERTIFICATE line is followed by a new line. Leave out the root. Then verify with openssl verify -untrusted intermediate.crt example_com.crt.