What the CA bundle is, and why your site looks untrusted without it
Your certificate does not arrive alone. Alongside it, the certificate authority gives you one or more intermediate certificates — the CA bundle. Install them and everything works. Forget them and your site looks fine on your own computer and broken on a customer's phone.
That misleading symptom is the reason for this article.
The chain of trust
No browser trusts your certificate directly. It trusts a handful of root certificates that shipped with it, and follows a chain from there:
Root → Intermediate(s) → Your certificate
Your server has to hand over the links in the middle. The browser has the root and you have yours, but without the intermediates it cannot join the two ends, and it treats the connection as untrusted.
Authorities do not issue straight from the root precisely to protect it: the root lives offline and signs only intermediates.
Why "it looks fine on my machine"
Because your browser has seen that intermediate before, on some other site, and kept it. With the intermediate cached it completes the chain by itself, even when your server never sends it.
A visitor arriving for the first time, from a phone, or from a freshly installed browser, has nothing cached — and sees the warning. The same goes for clients that are not browsers: mobile apps, curl, payment gateways, webhooks. Those almost never cache intermediates, and they are the first to break.
Which is why testing from your own machine cannot rule the problem out.
How to actually check
Use our SSL Checker: it connects from outside, with none of your cache, and tells you whether the chain is complete or a link is missing.
If it says an intermediate is missing, your certificate is fine — what is missing is server configuration.
Where the bundle goes
It depends on the server, which is why it is covered in each SSL Installation guide:
- Apache and nginx use a separate directive, or expect the certificate and the intermediates concatenated into one file.
- cPanel, WHM and Plesk have a field of their own called CA Bundle or CA Certificate.
- IIS and Exchange import them into the Windows certificate store rather than a file.
- Tomcat puts them in the same keystore as your certificate.
If the authority gave you several intermediates, they go one after another in the same file, in order: first the one that signed your certificate, then the one that signed that. Our guide on combining multiple intermediate certificates walks through it.
If you lost the bundle
Not a problem: intermediates are public, not secret the way your private key is. They come in the ZIP we sent you, you can download them again from your dashboard, or you can ask us for them.
