# What Is Intermediate Certificate? Definition and Examples

> Intermediate certificates are CA certificates, signed by a root, that issue end-entity certificates and must be served alongside the server's certificate.

Source: https://ssl.sh/glossary/intermediate-certificate/
Last updated: 2026-11-10

An intermediate certificate links a server's leaf certificate to a [root certificate](https://ssl.sh/glossary/root-certificate/). It is issued by the root, or by another intermediate, and has `CA:TRUE` in its basic constraints, so its key may sign certificates. Public CAs issue nearly all TLS certificates from intermediates so that the root key can stay offline; the entity operating an intermediate is a [subordinate CA](https://ssl.sh/glossary/subordinate-ca/).

## Why it matters
Clients ship roots, not intermediates, so the TLS server must send every intermediate needed to build the [chain](https://ssl.sh/glossary/certificate-chain/). Forgetting it is one of the most common deployment errors. Desktop browsers may hide the problem by caching intermediates or downloading them from the AIA URL, while curl, Python, Java, Go and many mobile apps fail with "unable to get local issuer certificate" or a similar message. CAs also rotate intermediates periodically, so hard-coding or pinning one specific intermediate eventually breaks.

## Example
For nginx, put the leaf first and the intermediates after it in one file:

```bash
cat example.com.crt intermediate.crt > fullchain.pem
```

```nginx
ssl_certificate     /etc/nginx/ssl/fullchain.pem;
ssl_certificate_key /etc/nginx/ssl/example.com.key;
```

## Common misconceptions
- **If the site works in Chrome, the chain is complete.** Browsers can fill gaps that other clients cannot; test with `openssl s_client` or an SSL checker.
- **Add the intermediate to the client trust store.** Fix the server instead; patching every client hides the misconfiguration.
- **Certbot's cert.pem is enough.** Certbot's `cert.pem` contains only the leaf; nginx should point to `fullchain.pem`.

## Related terms

- [根证书](https://ssl.sh/zh/glossary/root-certificate/): 根证书是位于证书链顶端、由 CA 自签名的证书，预装在操作系统或浏览器的信任库中，作为验证其他证书的信任锚。
- [证书链](https://ssl.sh/zh/glossary/certificate-chain/): 证书链是从网站终端证书经中间证书一直到受信任根证书的有序证书序列，每一张都由下一张签名。
- [下级 CA](https://ssl.sh/zh/glossary/subordinate-ca/): 下级 CA 是 CA 证书由另一个 CA（通常是根 CA）签发的证书颁发机构，一般负责实际签发终端证书。
- [fullchain](https://ssl.sh/zh/glossary/fullchain/): fullchain 是依次包含站点证书和中间证书的 PEM 文件，让客户端能把站点证书连到受信任的根证书。
- [AIA](https://ssl.sh/zh/glossary/aia/): AIA 即颁发机构信息访问，是 X.509 证书扩展，提供签发 CA 证书的下载地址，以及（可选的）该 CA 的 OCSP 服务地址。
- [CA Bundle](https://ssl.sh/zh/glossary/ca-bundle/): CA Bundle 是把多张 PEM 证书拼接在一起的文件，既可能是服务器要发送的中间证书链，也可能是客户端信任的根证书集合。
- [证书颁发机构](https://ssl.sh/zh/glossary/certificate-authority/): 证书颁发机构（CA）是负责审核申请者、签发数字证书，并把公钥与域名或身份绑定在一起的机构。