1

This question already has an answer here:

I am setting up SSL on Nginx with a free StartSSL certificate. Based on the instructions given on this StartSSL page I created a unified certificate containing the CA's root certificate, Intermediate certificate and the one for my domain.

Testing this setup on ssllabs the following sections caught my eye.

So I thought if the root CA certificate is in the trust store why should I add it to my .crt file and removed it from my server.

Checking again I found that the size of the certificate reduced and the Chain issues - Contains anchor disappeared.

I tested the site on Firefox and IE11 and no SSL errors were displayed.

Did I setup deploy certificate right?

Why does that page on StartSSL instruct to add the root CA certificate too if it is already present in the browsers' certificates store?

marked as duplicate by Thomas Pornin, Xander, Adi, AJ Henderson, Eric G Apr 28 '14 at 14:17

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.