Installing Intermediate Certificates

Overview

An intermediate certificate (often referred to as a CA bundle) is a critical link in the chain of trust between your server's SSL certificate and the trusted Root CA (Certificate Authority). Without the correct intermediate certificate installed, browsers will display warnings such as "Connection is not secure" – even if your certificate is technically valid.

Why are intermediate certificates necessary?

Certificate Authorities (CAs) use a hierarchical trust model:

1. Root CA – the top level, pre-installed in browsers and operating systems.
2. Intermediate CA – signed by the Root CA, used to sign your specific certificate.
3. Your SSL Certificate – signed by the Intermediate CA.

Browsers trust the Root CA, but your server must provide the intermediate certificate to complete the chain. Root CAs rarely issue certificates directly to end-users as it would be too risky; a compromise of the root key would invalidate all trust globally.

How to identify a missing intermediate

You can quickly identify this issue:

• Browser symptoms: "Connection is not private" / "Not Secure" / "NET::ERR_CERT_AUTHORITY_INVALID" despite having a valid certificate.
• Works in Chrome but not Firefox: Chrome often caches intermediate certificates from other sites, while Firefox does not. If it works in Chrome but fails in Firefox, the intermediate is almost certainly missing on the server.
• Online tests: Use the FairSSL SSL scanner, Qualys SSL Labs, or SSLshopper to verify the chain.

Step 1: Download the correct intermediate certificate

FairSSL always includes the intermediate certificate when your certificate is issued. You can also download it from:

• FairSSL Control Panel: Locate your certificate, click "Download," and select the format that includes the CA Bundle.
• CA Repositories: Sectigo, DigiCert, and GlobalSign all maintain public repositories with their current intermediate certificates.

Step 2: Installation on Windows Server (MMC)

1. Press Win+R, type mmc.exe, and press Enter.
2. Go to File → Add/Remove Snap-in (Ctrl+M).
3. Select Certificates → click Add → select Computer account → Local computer → Finish.
4. Navigate to Intermediate Certification Authorities → Certificates.
5. Right-click on Certificates → All Tasks → Import.
6. Select the intermediate certificate file (.crt, .cer, or .p7b) and follow the wizard.
7. Verify that the certificate now appears in the list and that the issuer is the correct Root CA.

Important: Do not import the intermediate certificate into "Trusted Root Certification Authorities". It must go into "Intermediate Certification Authorities".

Step 3: Installation on Linux (Apache/Nginx)

On Linux, the intermediate certificate is defined within your web server configuration:

Apache:

# Place the intermediate file
sudo cp ca-bundle.crt /etc/ssl/certs/intermediate.crt

# Within the Apache VirtualHost:
SSLCertificateChainFile /etc/ssl/certs/intermediate.crt

Nginx:

# Nginx requires the certificate and intermediate to be combined into one file:
cat your-certificate.crt intermediate.crt > /etc/ssl/certs/fullchain.crt

# Within the Nginx configuration:
ssl_certificate     /etc/ssl/certs/fullchain.crt;
ssl_certificate_key /etc/ssl/private/privkey.key;

System Certificate Store (Optional):

# Debian/Ubuntu
sudo cp intermediate.crt /usr/local/share/ca-certificates/
sudo update-ca-certificates

# RHEL/CentOS
sudo cp intermediate.crt /etc/pki/ca-trust/source/anchors/
sudo update-ca-trust

Step 4: Verify the certificate chain

# View the chain using OpenSSL
openssl s_client -connect www.example.dk:443 -servername www.example.dk < /dev/null 2>/dev/null

# You should see a 3-level chain:
# Certificate chain
#  0 s:CN = www.example.dk
#    i:CN = Intermediate CA
#  1 s:CN = Intermediate CA
#    i:CN = Root CA

# Verify locally
openssl verify -CAfile root-ca.crt -untrusted intermediate.crt your-certificate.crt
# Output should be: your-certificate.crt: OK

Troubleshooting

• "unable to get local issuer certificate": The intermediate certificate is missing on the server. Install it as described above.
• Incorrect intermediate: CAs update their intermediates regularly. Ensure you are using the correct one for your certificate issuer – this can be found in the certificate details under "Issuer".
• Chain order: In Nginx (and other systems using fullchain files), the order must be: your certificate first, followed by the intermediate(s). Do not include the root certificate.
• Errors persisting after installation: Restart the web server (sudo systemctl restart apache2 / nginx / iisreset) and clear your browser cache.