This post mainly serves as a reminder for myself…

When using certificates with web servers, like nginx or apache, it’s recommended to publish the entire certificate chain, since else tools like Google Chrome or curl will complain about invalid certificates, even if you bought or used Let’s Encrypt to get your certificate.

To remediate this, you need to create a bundle which consists of your certificate, the certificate used to sign your certificate (Usually called the intermediate CA) and the certificate used to sign the intermediate certificate (Usually called the root CA), which in turn should already be present on your machine if you’re using a previously trusted vendor, like Let’s Encrypt.

So, to create this bundle, simply do this from a Linux or Mac OS terminal window:

cat your-certificate.crt intermediate.crt root.crt > bundle.crt

Then copy the bundle.crt along with the private key for your certificate onto your web servers or other servers and configure your application to use the bundle.crt and the private key.