This question already has an answer here:
- ssltest: Chain issues - Contains anchor 2 answers
I am setting up SSL on Nginx with a free StartSSL certificate. Based on the instructions given on this StartSSL page I created a unified certificate containing the CA's root certificate, Intermediate certificate and the one for my domain.
Testing this setup on ssllabs the following sections caught my eye.
So I thought if the root CA certificate is in the trust store why should I add it to my
.crt file and removed it from my server.
Checking again I found that the size of the certificate reduced and the Chain issues - Contains anchor disappeared.
I tested the site on Firefox and IE11 and no SSL errors were displayed.
Did I setup deploy certificate right?
Why does that page on StartSSL instruct to add the root CA certificate too if it is already present in the browsers' certificates store?