Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am using Godaddy cert, normally I would concat the cert and make into a chained cert

cat sf_bundle.crt > chained.cert

And in my nginx.conf,

ssl_certificate chained.cert

In the browser I see the chain as below:
  Starfield Secure Certification Authority
    Starfield Technologies Inc.

That is fine, everything is working.

Today, I read a blog post form CloudFlare [1], it said:

The lowest hanging fruit in terms of reducing 
the size of these certificates was to remove the 
root certificates from the certificate bundle. 
There's no reason to include these since they should already be 
present in browsers and, even if they're not, the browser won't trust them.

So, does it mean I can remove the Starfield Technologies Inc. without affecting the validaity of my SSL cert and I can have a better performance?


share|improve this question
Is the root cert really found in your bundle? I would have expected that the bundle only contains the intermediate certificate ("Starfield Secure Certification Authority"), and you do actually need that one. Use openssl x509 -text to see what's really in the bundle. – Celada Jan 27 '13 at 17:11
up vote 2 down vote accepted

It depends on what kind of entity has signed your certificate.

If it was signed directly by a root CA, then indeed there'd be little point in re-serving such root CA with your own web-server.

However, if it was issued by an intermediate CA, and you don't bundle that within your cert, then you risk the risk of having certain users receiving warnings about the certificate being broken, if they've never seen such an intermediate CA before.

How to know which situation you're in? You can test with

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.