I just bought a SSL certificate, and here are all the certificate files i got:

Root CA Certificate - xxCARoot.crt
Intermediate CA Certificate - x1.crt
Intermediate CA Certificate - x2.crt
Intermediate CA Certificate - x3.crt
Your EssentialSSL Wildcard Certificate - mydomain.crt

Now to install my certificates on apache:

  1. Do I need to expose the Root CA Certificate at all?
  2. Since apache only allows 1 SSLCertificateChainFile directive, am I supposed to create a bundle file of the intermediate CA's?
  3. If so. will the order of certificates in the bundle file be reversed like this:

    cat x3.crt x2.crt x1.crt > myca.bunndle

  4. If the root certificate does have to be added, does it come in last (after z1) or first (before x3) in the bundle (assuming the order is correct in the first place)?

up vote 8 down vote accepted
  1. No, you don't need to share the root. Your visitors that have it trusted already (likely from the company who provided their OS) will already have it.

  2. Yes, using your command should be correct, assuming they're all PEM encoded.

  3. Per the University of Wisconsin here, order does matter, but only if you provide the root.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.