When a Root CA signs a certificate for an intermediate CA, the signed certificate has a special field set (specifically, [a certificate authority flag in the Basic Constraints extension][1]), that designates it as a CA certificate. Certificates signed for domains, as you'd get from your CA, do not have this field set, so your browser will not consider them for the chain of trusted certificates back to the root CA. [1]: http://unitstep.net/blog/2009/03/16/using-the-basic-constraints-extension-in-x509-v3-certificates-for-intermediate-cas/