What is the purpose of the CA-BUNDLE on a webserver?

Question

So I purchase a certificate from DigiCert. The process goes like this:

• Generate private key and CSR on web server.
• Submit CSR to DigiCert.
• Get a signed certificate back as well as their root certificate and intermediate certificate (CA-BUNDLE).
• Upload the certificate and CA-BUNDLE to the webserver via cPanel, Plesk, w\e.

My question is simply, what is the purpose of the CA-BUNDLE?

My certificate gets signed by a DigiCert Intermediate CA which is signed by DigiCert's root CA. All browsers inherently trust DigiCert (and I assume it's intermediate CA?). The actual RSA encryption and AES key exchange is done using the values in my certificate, in fact the web server doesn't use any of the certificates in the CA bundle for anything.

With that being said, what's the point of it? and why do I have to upload it? The only thing I can see is if the client doesn't have one of the intermediate certificates installed it can ask my web server for it (and verify it against the in-browser DigiCert root)?

Answer 1

All browsers inherently trust DigiCert

True enough.

(and I assume it's intermediate CA?)

Clients may include trusted intermediate certs, but cannot be expected to. It is your job, the server, to provide any intermediate certificates necessary to validate your certificate chain up to the root (RFC 5246 7.4.2):

   certificate_list
      This is a sequence (chain) of certificates.  The sender's
      certificate MUST come first in the list.  Each following
      certificate MUST directly certify the one preceding it.  Because
      certificate validation requires that root keys be distributed
      independently, the self-signed certificate that specifies the root
      certificate authority MAY be omitted from the chain, under the
      assumption that the remote end must already possess it in order to
      validate it in any case.

The only thing I can see is if the client doesn't have one of the intermediate certificates installed it can ask my web server for it (and verify it against the in-browser DigiCert root)?

Correct. That's exactly the reason.