Intermediate Certificate (Intermediate CA certificate)

An intermediate certificate links a server's leaf certificate to a root certificate. It is issued by the root, or by another intermediate, and has CA:TRUE in its basic constraints, so its key may sign certificates. Public CAs issue nearly all TLS certificates from intermediates so that the root key can stay offline; the entity operating an intermediate is a subordinate CA.

Why it matters

Clients ship roots, not intermediates, so the TLS server must send every intermediate needed to build the chain. Forgetting it is one of the most common deployment errors. Desktop browsers may hide the problem by caching intermediates or downloading them from the AIA URL, while curl, Python, Java, Go and many mobile apps fail with "unable to get local issuer certificate" or a similar message. CAs also rotate intermediates periodically, so hard-coding or pinning one specific intermediate eventually breaks.

Example

For nginx, put the leaf first and the intermediates after it in one file:

cat example.com.crt intermediate.crt > fullchain.pem

ssl_certificate     /etc/nginx/ssl/fullchain.pem;
ssl_certificate_key /etc/nginx/ssl/example.com.key;

Common misconceptions

• If the site works in Chrome, the chain is complete. Browsers can fill gaps that other clients cannot; test with openssl s_client or an SSL checker.
• Add the intermediate to the client trust store. Fix the server instead; patching every client hides the misconfiguration.
• Certbot's cert.pem is enough. Certbot's cert.pem contains only the leaf; nginx should point to fullchain.pem.