Tonight I updated our TSL certificate. We deploy behind haproxy with a certificate bundled with an intermediate CA crt and private key in .pem file format. Having downloaded the renewed certificate for our domain, I made a new .pem file by just updating the corresponding part of the .pem file from the previous year. It seems to be working fine.
However, I noticed in an e-mail that we've also been issued with a new intermediate CA certificate. Do I need to update the .pem file to reflect this new certificate, or can I leave it as is? As I say, it seems to be working fine, but I'd hate to run into issues down the road because the old intermediate CA certificate expires in a couple of months or something similar.
Apologies if this is a stupid question- I'm really a junior web developer press-ganged into this sort of server admin by necessity ... Many thanks in advance.
EDIT: Possibly related: Last time I checked, our ssl setup got an A on Qualys, but now it's only getting a B, complaining that it can't verify the chain properly. I'll update to the new CA tonight. I can't upvote with only one rep, but many thanks to those who've taken the time to respond.
POST EDIT: I've updated the intermediate cert, but it wasn't the source of my Qualys issue. Thanks again.