CA Bundle (CA certificate bundle)

"CA bundle" has two common meanings. Some CAs and resellers deliver a .ca-bundle file containing the intermediate certificates for your server's chain. Clients, on the other hand, use a CA bundle as their trust store: a single PEM file of root certificates, such as /etc/ssl/certs/ca-certificates.crt on Debian and Ubuntu or /etc/pki/tls/certs/ca-bundle.crt on RHEL-family systems.

Why it matters

Confusing the two meanings causes most bundle-related errors. On the server side, the intermediate bundle must be appended after the leaf certificate for nginx, or configured as the chain file elsewhere; otherwise clients report a missing intermediate. On the client side, tools need to know which root bundle to use: curl takes --cacert, Python requests honors the REQUESTS_CA_BUNDLE environment variable, and Node.js adds extra roots from NODE_EXTRA_CA_CERTS. These options are also how internal services trust a private CA without changing the system store.

Example

cat example.com.crt example.com.ca-bundle > fullchain.pem
openssl crl2pkcs7 -nocrl -certfile fullchain.pem | openssl pkcs7 -print_certs -noout
curl --cacert /etc/ssl/certs/ca-certificates.crt https://example.com/

The first line builds a server chain for nginx, the second lists the subject and issuer of every certificate in the file, and the third tells curl which root bundle to trust.

Common misconceptions

• The CA bundle already includes my certificate. A CA's intermediate bundle excludes your leaf; you combine them yourself for servers like nginx.
• Any file called ca-bundle is a set of trusted roots. It may contain only intermediates; list its contents before using it.