Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My site works well on every browser and device, except on Android, where it throws a security exception. I already installed my SSL certificate on my Amazon Elastic Beanstalk instance (by installing the certificate on the load balancer).

It seems that I can be falling on the following case:

It seems that I have to install a intermediate certificate.

Can anyone help me with that? I dont really know what it means

share|improve this question

Concatenate the files provided manually, in the following order:

  • intermediate.crt (one or more, the order of these doesn't matter)
  • ROOT.crt

you can do this from a shell with the cat command

cat intermediate.crt ROOT.crt > site.chain.pem

or copy/paste them, no whitespace between, make sure certificates are on different lines

site cert
intermediate cert
root cert

If you don't have the root, concatenate the site cert with the intermediates, without root the cert. Such as:

site cert
intermediate cert

How do I Install Intermediate Certificates (in AWS)?

share|improve this answer is the certificate that I am already using ? Where is the Root cert? Do I have to download from the CA? – Tony Nov 5 '13 at 17:17
If you don't have the root, just concatenate the intermediate cert to the site cert and then upload. – Brian Knight Nov 5 '13 at 17:20
I got this message from Amazon 400 MalformedCertificate Invalid Public Key Certificate. – Tony Nov 5 '13 at 19:13
Does your file look like the update I added above for site cert + intermediate cert? – Brian Knight Nov 5 '13 at 19:20
yes.... -----BEGIN CERTIFICATE----- A LOT OF STUFF -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- ALOT OF STUFF -----END CERTIFICATE----- – Tony Nov 5 '13 at 19:24

Sounds like you need to upload the intermediate certificate as well to prove it has been signed by a root authority. You must do something like the following using the AWS command line tools:

iam-servercertupload -b mydomain.crt -k mydomain.nopass.key -c my_intermediate_cert.crt -s mydomain

Alternatively, it can be done through the GUI control panel. Whoever you purchased the cert from should be able to provide the appropriate intermediate cert(s).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.