I am installing SSL cert and I am in doubt about should I concatenate site cert, intermediate cert and root cert or just site and intermediate cert ?

  • Can you expend your question? do you mean 'should you add the full certificate chain?' or is this specific for a given server? Or do you mean more in general, as in "is it good practice to include the full certificate chain?'
    – LvB
    Apr 29 '16 at 9:15
  • I mean in general, is it good practices concat all certs(even root certs) or just site and intermediates, assuming that root is already installed on OS ? Apr 29 '16 at 9:17

TL;DR Concatenate all but root.

It's only required to concatenate site certificate with the intermediate certificate. If there is more than one intermediate certificates you need to concatenate all of them.

The "root certificate" is the last certificate in the chain - it's the last because it is self-signed, and no other certificate in the world could verify it.

Concatenating root will work but is not recommended. The properly implemented client-side software (web browser) cannot ever trust a root that it received from your site. It must ignore it. It has all the valid roots in its trust store and there is no use to ever trust a root that is distributed over an insecure connection from a random site.

If a user wants to except your site from certificate validation, there is also no use for them to add your root certificate to trust store. More than likely that user is not aware that they open door to nearly all their SSL connections (except pinned ones). They should only ever trust your site certificate (aka the leaf certificate).

The popular ssllabs.com test site issues a minor warning in case a root is concatenated, describing the connection with something like "contains anchor".

  • IT can however be used in those "rare" situations where the 'root' certificate the client has is expired but the new root certificate is signed (among others) with the old one.
    – LvB
    Apr 29 '16 at 9:25
  • @LvB If your communication is validated by old expired root certificate it is as expired in the server's message as it is in your browser's store. I don't understand you. I've edited the answer to be more elaborate on the topic.
    – kubanczyk
    Apr 29 '16 at 9:31
  • You see this in more complex setups of CA's (like Let's encrypt uses) as I said . its rare. and for the ost part does not invalidates your statement.
    – LvB
    Apr 29 '16 at 10:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.