So I purchase a certificate from DigiCert. The process goes like this:
- Generate private key and CSR on web server.
- Submit CSR to DigiCert.
- Get a signed certificate back as well as their root certificate and intermediate certificate (CA-BUNDLE).
- Upload the certificate and CA-BUNDLE to the webserver via cPanel, Plesk, w\e.
My question is simply, what is the purpose of the CA-BUNDLE?
My certificate gets signed by a DigiCert Intermediate CA which is signed by DigiCert's root CA. All browsers inherently trust DigiCert (and I assume it's intermediate CA?). The actual RSA encryption and AES key exchange is done using the values in my certificate, in fact the web server doesn't use any of the certificates in the CA bundle for anything.
With that being said, what's the point of it? and why do I have to upload it? The only thing I can see is if the client doesn't have one of the intermediate certificates installed it can ask my web server for it (and verify it against the in-browser DigiCert root)?