How do I add the intermediate certificate chain?

Short answer

The chain is added by pasting it as PEM into the Intermediate Cert. Content field of the certificate record (Without Profile), by selecting a CA record defined on the Certificate Authorities (CA) screen (Use Profiles), or with the Suggest Completion suggestion of the Chain tab in the preview. In a new upload, the intermediate certificates can be pasted into the Certificate Content field together with the certificate, after it; the chain in a PFX file is taken automatically. TR7 manages the chain of ACME.SH and Internal CA certificates. A chain change is applied to all the vServices that use the certificate without any additional action being required.

Problem: Some Clients Do Not Trust the Certificate

If the server sends only its own (leaf) certificate, desktop browsers that keep the intermediate certificate in their cache mostly show no problem; mobile applications, curl, Java and similar clients, however, cannot complete the chain and give an "untrusted certificate" error. The intermediate certificates must be sent together with the server certificate. An incomplete chain appears in the Chain tab in the preview with the orange Missing intermediate certificate — required issuer message (How do I tell if the certificate chain is incomplete?).

Solution: Three Methods

All three methods are for certificate records of the Manual and PFX types and are alternatives to each other.

Your situation	Suitable method
I have the PEM file of the intermediate certificate	Method 1: Pasting into the Intermediate Cert. Content field
The same intermediate certificate is used in many certificates; it should be updated from a single place	Method 2: With a CA record (Use Profiles)
I do not have the intermediate certificate; TR7 should find it	Method 3: Chain → Suggest Completion
I am uploading a new certificate; I have a fullchain file or a PFX file	The certificate and the intermediate certificates are pasted into the Certificate Content field together, or the chain in the PFX is taken automatically → How do I upload my certificate to TR7; which formats are supported?
The certificate is of the ACME.SH or Internal CA type	No action is required; TR7 manages the chain

Method 1: Pasting into the Intermediate Cert. Content Field Recommended

• How it works The intermediate certificate is pasted into the certificate record's own chain field; the certificate and the key do not change.
• Where it is openedCertificates & PKI → SSL/TLS Certificates → certificate → Edit → Intermediate Cert. Content → Without Profile
• Requirement The PEM, P7B or DER (Base64) content of the intermediate certificate
• vService type HTTP, L7 TCP (encrypted frontend)

Step-by-Step Configuration

1

Adım 1 Open the certificate edit form

On the Certificates & PKI → SSL/TLS Certificates screen, the certificate is selected and Edit is clicked (Edit). The form opens as an Edit tab above the list.

2

Adım 2 Keep the certificate and the key

The Keep Existing Certificate and Key switch is left on (on by default). While the switch is on, the certificate and key fields are hidden; the certificate and the key in the record do not change.

3

Adım 3 Paste the intermediate certificate

In the Intermediate Cert. Content field, Without Profile is selected (default Disabled); the intermediate certificate is pasted into the box that opens. If there is more than one intermediate certificate, they are pasted in an order in which the intermediate certificate that signs the certificate is at the top. If the root certificate is not needed, Root Cert. Content is left Disabled; clients take the root from their own trust store. In this case, since the Chain tab cannot build the chain up to the root CA, it shows the name of the root CA as the missing signer; if Trust chain is complete is to be seen in the tab, the root certificate is also added to this field.

4

Adım 4 Save

Edit at the bottom of the form is clicked. The change is saved without asking for confirmation and the configuration is applied again; no additional action is required on the vServices that use the certificate. In a cluster setup, with the default auto-sync, the change is also sent to the peer device; if Manual Sync Mode is on, it is sent to the peer device manually.

Verification

1Chain tabTR7 side

The certificate row is clicked in the list; the Chain tab of the preview is checked.

ExpectedTrust chain is complete

If the root certificate was not added, the tab shows the name of the root CA in the "Missing intermediate certificate — required issuer" message; if the named signer is a root CA, the intermediate certificate has been added and the check on the client side is sufficient.

2Sent chainClient side

The chain the vService presents is queried.

Command: openssl s_client -connect 203.0.113.10:443 -servername www.example.com -showcerts

ExpectedLeaf and intermediate certificate in Certificate chain · Verify return code: 0 (ok)

Method 2: With a CA Record (Use Profiles)

• How it works The intermediate certificate is saved once on the Certificate Authorities (CA) screen; certificates refer to this record. When the CA record is updated, the chain of all the certificates bound to it is updated together.
• Where it is openedCertificates & PKI → Certificate Authorities (CA) · certificate → Edit → Intermediate Cert. Content → Use Profiles
• Requirement The PEM content of the intermediate certificate
• vService type HTTP, L7 TCP (encrypted frontend)

Step-by-Step Configuration

1

Adım 1 Open the CA add form

On the Certificates & PKI → Certificate Authorities (CA) screen, Add is clicked (how to add).

2

Adım 2 Define the intermediate certificate

CA Name is entered; in the Operation field, the default Add a trusted CA certificate is left, and the intermediate certificate is pasted into the CA Certificate (PEM) field or the file is dragged.

3

Adım 3 Save the CA record

Add is clicked; the record is added to the list.

4

Adım 4 Open the certificate edit form

On the Certificates & PKI → SSL/TLS Certificates screen, the certificate is selected and Edit is clicked; Keep Existing Certificate and Key is left on.

5

Adım 5 Select the CA record

In the Intermediate Cert. Content field, Use Profiles is selected and the CA record from step 3 is selected; if there is more than one intermediate certificate in the chain, a separate CA record is created for each of them and they are selected in order. When a profile is selected, content pasted manually into the field is not used. With the add icon of the selector, a new CA record can also be opened without leaving the form.

6

Adım 6 Save

Edit at the bottom of the form is clicked; no additional action is required on the vServices that use the certificate. In a cluster setup, with the default auto-sync, the change is also sent to the peer device; if Manual Sync Mode is on, it is sent to the peer device manually.

Verification

1Chain tabTR7 side

The Chain tab is checked in the preview of the certificate; the Used in tab in the preview of the CA record shows the certificates that use the record.

ExpectedTrust chain is complete

If only the intermediate certificate was selected, the tab shows the name of the root CA as the missing signer; if the root is also selected as a CA record in the Root Cert. Content field, the status becomes complete.

Method 3: Chain → Suggest Completion

• How it works TR7 looks for the missing link, in order, in the chains of the other certificate records, in the CA records and, if requested, at the signer address (AIA) the certificate carries; it suggests only the candidates that pass signature validation. When the suggestion is confirmed, the certificates found are added to the chain content of the record, and the existing content is preserved.
• Where it is openedCertificates & PKI → SSL/TLS Certificates → certificate preview → Chain → Suggest Completion
• Requirement A certificate of the Manual or PFX type; no CA profile must be selected in the related chain field
• vService type HTTP, L7 TCP (encrypted frontend)

Step-by-Step Configuration

1

Adım 1 Open the Chain tab

On the Certificates & PKI → SSL/TLS Certificates screen, the certificate row is clicked; in the preview that opens on the right, the Chain tab is selected. If the chain is incomplete and the required signer is known, the Suggest Completion button appears.

2

Adım 2 Request a suggestion

If the link is not in the records on TR7, Also try downloading from the issuer's address (AIA) is checked; Suggest Completion is clicked. In the result, the source of each candidate is written: from another certificate, from a CA profile or downloaded (AIA).

3

Adım 3 Add to the chain

Add to this certificate's chain is clicked and the confirmation that opens is accepted; the certificates found are added to the chain and the configuration is applied again.

Verification

1Chain tabTR7 side

When the preview is refreshed, the status at the top of the Chain tab is read.

ExpectedTrust chain is complete

With the "No matching issuer certificate was found in this system" message, the intermediate certificate is downloaded from the CA's site and added with Method 1 or 2.

Common Mistakes

• Selecting a CA profile and also pasting content. When Use Profiles is selected, content pasted into the field is not used; only the selected CA records enter the chain.
• Pasting the intermediate certificates in reverse order. The chain is sent in the order in which it is pasted; the intermediate certificate that signs the certificate must be first.
• Thinking the root certificate is mandatory. Clients take the root certificate from their own trust store; it is sufficient for the intermediate certificates to be in the chain. If the signer named in the missing link message in the Chain tab is a root CA, the status in the tab is completed by filling in the Root Cert. Content field.
• Looking for a chain field in an ACME.SH or Internal CA certificate. In these types, TR7 manages the chain; there are no chain fields in the add form, and Suggest Completion cannot be applied.

How it is done in the documentation

• SSL/TLS Certificates · The Certificate Chain
• SSL/TLS Certificates · Chain Tab
• Certificate Authorities (CA) · Add a trusted CA certificate

Related questions

• How do I tell if the certificate chain is incomplete?
• The browser says "certificate not trusted"; what are the possible causes?
• How do I upload my certificate to TR7; which formats are supported?