An intermediate certificate is a CA certificate that is signed by a root certificate and in turn signs end-entity certificates such as the one on your web server. It forms the middle link of the chain that lets a browser trace your certificate back to a trusted root.
Why it matters
Root private keys are kept offline because their compromise would be catastrophic. CAs therefore issue day-to-day certificates from intermediates, which can be revoked or replaced without touching the root.
Browsers do not ship most intermediates. Your server is expected to send them along with its own certificate. If it does not, some clients (often desktop browsers that cache or fetch missing intermediates) work fine while others, such as curl, Java apps, older Android versions and API clients, report "unable to get local issuer certificate". That inconsistency makes the problem hard to spot.
Example
Serve the full chain, leaf first, in one file:
ssl_certificate /etc/ssl/example.com/fullchain.pem;
ssl_certificate_key /etc/ssl/example.com/privkey.pem;fullchain.pem contains your certificate followed by the intermediate(s). Do not include the root.
Common mistakes
- Installing only the leaf certificate your CA emailed you.
- Concatenating certificates in the wrong order.
- Testing in a browser only and missing failures in non-browser clients.
Related
Get notified when this term updates
Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.
This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.