I created a root CA and intermediate CA, then used the intermediate to sign a leaf cert, for the purpose of enabling SSL on various web servers in an internal network. I'm trying to figure out if I need to distribute both the root and intermediate CA certs in my client truststores, or if I can get by with only distributing the root, as explained in: http://security.stackexchange.com/questions/119460/do-i-put-my-subordinate-intermediate-or-root-ca-certificate-in-my-truststore Doing a quick test with curl against an https endpoint with a leaf cert, signed by the intermediate, it appears I need the full chain, e.g.: curl --cacert chain.crt https://my-endpoint:8080/ When I tried with only the root CA, I got an error: curl --cacert root.crt https://my-endpoint:8080/ curl: (60) SSL certificate problem: unable to get issuer certificate Why do I need to provide curl the full chain instead of only the root CA? Do I need to create leaf certs with a special option to embed the full chain?