Hi Paul, Firefox expects websites to provide all intermediate certs needed to verify the site certificate up to a built-in root certificate. The certificate issuer typically provides a bundle file for that.

(Since Firefox caches intermediate certificates after verifying them, users may have different experiences with the site depending on whether they have used sites that have the same certificate chain.)

You can use the Qualys test page to verify that your chain is complete: https://www.ssllabs.com/ssltest/

Thanks very much @jscher2000.

Just to clarify my understanding. Does this mean that if Firefox receives the cert chain file from the server which includes the full intermediate/root chain (including an already trusted root) that FF will fully trust the connection and will not flag any trust errors - even if the signed certificate is signed by an untrusted intermediate CA in that chain?

Thanks again.

Hi Paul, trust is established on the fly by checking the certificate signatures. Firefox often has not seen an intermediate cert before, but it can be trusted as long as it was validly signed and can be verified up to a trusted root certificate. After verification, it will be cached and show up in the Certificate Manager dialog, Authorities tab, with the designation "Software Security Device" (instead of "Builtin Object Token").

The server doesn't need to send the root certificate that is already included with browsers, and probably shouldn't. I think the SSL Labs test views that as a configuration error. Your bundle only needs to include the intermediate certs. Your certificate issuer should tell you which ones you need to serve.

Great. Thanks very much. Understood. I appreciate the speedy assistance.