Skip to main content

What is an Intermediary CA bundle?

Your Certificate Provider should supply you with one.

A
Written by Admin account
Updated this week

An Intermediary (or Intermediate) CA bundle is a file, often provided as a ZIP archive or a single .crt/.pem file, that contains one or more intermediate certificates issued by a trusted Root Certificate Authority (Root CA).

These intermediate certificates form a chain of trust between your server certificate and the Root CA that browsers and operating systems already trust.

In simple terms, the intermediary CA bundle helps browsers verify that your SSL/TLS certificate is legitimate and was issued by a trusted authority.


​Understanding the Chain of Trust

Digital certificates rely on a hierarchical trust model:

  1. Root CA

    • A highly trusted authority (e.g., DigiCert, GlobalSign, Let’s Encrypt).

    • Root certificates are pre-installed in browsers and operating systems.

    • Root CAs rarely issue certificates directly.

  2. Intermediate CA

    • Issued and signed by a Root CA.

    • Used to issue server (end-entity) certificates.

    • Acts as a security buffer, if compromised, the root remains protected.

  3. Server (Leaf) Certificate

    • Issued to your domain (e.g., www.example.com).

    • Installed on your web server.

The intermediary CA bundle contains the intermediate certificates that connect your server certificate back to the trusted Root CA.

[ Root CA ]
     ↑
[ Intermediate CA ]
     ↑
[ Your Server Certificate ]

​Without the correct intermediate certificates, this chain is incomplete.

Why an Intermediary CA Bundle Is Important

If your server does not present the correct intermediate certificates:

  • Browsers may display security warnings such as:

    • “Certificate not trusted”

    • “Unable to verify the certificate”

    • “Incomplete certificate chain”

  • Some devices (especially older systems or mobile devices) may completely reject the connection.

  • HTTPS connections may fail, affecting user trust and SEO.

Installing the correct intermediary CA bundle ensures that all clients can successfully validate your certificate.

What’s Inside an Intermediary CA Bundle?

An intermediary CA bundle typically includes:

  • One or more intermediate certificates

  • Certificates in formats such as:

    • .crt

    • .cer

    • .pem

  • Sometimes a combined file known as:

    • CA bundle

    • Certificate chain

    • Full chain

It does not usually include:

  • Your private key

  • The Root CA certificate (since clients already have it)

Common File Formats and Names

You may encounter files named like:

  • ca-bundle.crt

  • intermediate.pem

  • chain.pem

  • certificate_chain.crt

In many setups, the intermediary CA bundle is combined with your server certificate into a full chain certificate.

Important: Only PEM style format certificates are supported during import via the Pressidium Dashboard. If your certificate bundle is in another format you will need to convert it first.

Example (PEM Format)

A typical full chain file might look like this:

-----BEGIN CERTIFICATE-----
(Your Server Certificate)
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
(Intermediate CA Certificate)
-----END CERTIFICATE-----

How to Obtain an Intermediary CA Bundle

You can usually download the intermediary CA bundle from:

  • Your Certificate Authority’s website

  • The certificate issuance email

  • Your CA’s customer portal

Common CAs that provide intermediary bundles include:

  • DigiCert

  • Sectigo

  • GlobalSign

  • Let’s Encrypt

Did this answer your question?