Certificate chains and intermediate certificates

The key point

Install the leaf certificate with the required intermediates. A correct file bundle still needs to be deployed and checked on the server.

How the chain works

Your leaf certificate is signed by an intermediate CA. There may be more than one intermediate before a root trusted by the client. The client builds and validates a path. Certificate signatures alone do not establish trust in an uploaded root.

Why untrusted errors happen

A missing intermediate can cause different results across clients because some have cached issuers or can fetch them. Expiry, hostname mismatch or a root absent from a client trust store can also break a connection. Read the error before replacing files.

Installing and checking the chain

Deploy the leaf and the required intermediates in the order and format expected by your server. A TLS server normally sends the leaf first, followed by intermediates, and does not need to send the root. If a CDN terminates TLS, check both its public certificate and the separately configured origin.

Worked example

The site works on a laptop but fails in an API client

The server may be sending only the leaf certificate. A browser with a cached intermediate might still connect, while another client cannot build a trusted path. Check the chain before assuming that the certificate must be purchased again.

Leaf certificate: Identifies your hostname and must match your installed private key.
Intermediate certificate(s): Link the leaf to a trusted root. The server normally sends these with the leaf.
Trusted root: Trust comes from the client trust store. Uploading a root does not make it trusted.
PEM or PFX: Packaging depends on the server. PFX may include the private key, so treat it as sensitive.

Your next steps

Use the SSL checker to inspect the public endpoint you are troubleshooting.
If intermediates are missing, build the chain from the issued certificate and review the resolver result.
Install the matching leaf and intermediates in the format your server requires, then check the deployed endpoint again.

Tools for this task

Next guide Renewal vs reissue: what is the difference?