# What Is CA Bundle (CA certificate bundle)? Definition and Examples

> CA bundles are files of concatenated PEM certificates: either the intermediates a server must send, or the root certificates a client trusts.

Source: https://ssl.sh/glossary/ca-bundle/
Last updated: 2026-11-10

"CA bundle" has two common meanings. Some CAs and resellers deliver a `.ca-bundle` file containing the intermediate certificates for your server's [chain](https://ssl.sh/glossary/certificate-chain/). Clients, on the other hand, use a CA bundle as their [trust store](https://ssl.sh/glossary/trust-store/): a single [PEM](https://ssl.sh/glossary/pem/) file of root certificates, such as `/etc/ssl/certs/ca-certificates.crt` on Debian and Ubuntu or `/etc/pki/tls/certs/ca-bundle.crt` on RHEL-family systems.

## Why it matters
Confusing the two meanings causes most bundle-related errors. On the server side, the intermediate bundle must be appended after the leaf certificate for nginx, or configured as the chain file elsewhere; otherwise clients report a missing intermediate. On the client side, tools need to know which root bundle to use: curl takes `--cacert`, Python requests honors the `REQUESTS_CA_BUNDLE` environment variable, and Node.js adds extra roots from `NODE_EXTRA_CA_CERTS`. These options are also how internal services trust a private CA without changing the system store.

## Example
```bash
cat example.com.crt example.com.ca-bundle > fullchain.pem
openssl crl2pkcs7 -nocrl -certfile fullchain.pem | openssl pkcs7 -print_certs -noout
curl --cacert /etc/ssl/certs/ca-certificates.crt https://example.com/
```

The first line builds a server chain for nginx, the second lists the subject and issuer of every certificate in the file, and the third tells curl which root bundle to trust.

## Common misconceptions
- **The CA bundle already includes my certificate.** A CA's intermediate bundle excludes your leaf; you combine them yourself for servers like nginx.
- **Any file called ca-bundle is a set of trusted roots.** It may contain only intermediates; list its contents before using it.

## Related terms

- [信任库](https://ssl.sh/zh/glossary/trust-store/): 信任库是操作系统、浏览器或编程语言运行时内置的一组根 CA 证书，验证证书链时以它们作为信任锚。
- [证书链](https://ssl.sh/zh/glossary/certificate-chain/): 证书链是从网站终端证书经中间证书一直到受信任根证书的有序证书序列，每一张都由下一张签名。
- [中间证书](https://ssl.sh/zh/glossary/intermediate-certificate/): 中间证书是由根证书（或上级中间证书）签发、用来签发网站证书的 CA 证书，服务器必须把它和网站证书一起发送给客户端。
- [fullchain](https://ssl.sh/zh/glossary/fullchain/): fullchain 是依次包含站点证书和中间证书的 PEM 文件，让客户端能把站点证书连到受信任的根证书。
- [PEM](https://ssl.sh/zh/glossary/pem/): PEM 是一种把 DER 二进制数据做 Base64 编码、再用 BEGIN 和 END 行包起来的文本格式，是存放证书和私钥最常见的方式。
- [根证书](https://ssl.sh/zh/glossary/root-certificate/): 根证书是位于证书链顶端、由 CA 自签名的证书，预装在操作系统或浏览器的信任库中，作为验证其他证书的信任锚。