Combine X509 Certificates

TL;DR

Yes, you can combine multiple X.509 certificates into a single file. This is often needed for servers that require a chain of trust (intermediate certificates) alongside the server certificate. The order matters: your server certificate first, followed by any intermediate certificates, and finally the root certificate (though including the root is usually unnecessary). Use OpenSSL to concatenate them.

How to Concatenate X509 Certificates

1. Understand Certificate Order
• Your server certificate: This is the one for your specific domain. It goes first.
• Intermediate certificates: These link your server certificate back to a trusted root authority. Include them in order, from closest to furthest away from your server certificate.
• Root certificate: While sometimes included, it’s generally not required as browsers usually have these already. Including it can sometimes cause issues.
2. Using OpenSSL (Recommended)

OpenSSL is a powerful command-line tool for working with X.509 certificates and cryptography. It’s available on most Linux distributions, macOS, and Windows (via Cygwin or WSL).

cat certificate1.pem intermediate1.pem intermediate2.pem > combined_certificate.pem

Replace certificate1.pem with your server certificate file, intermediate1.pem and intermediate2.pem with your intermediate certificates (if any), and combined_certificate.pem with the desired name for the combined file.

3. Verify the Combined Certificate
1. Check File Format: Ensure the combined file is in PEM format (starts with -----BEGIN CERTIFICATE-----). You can open it in a text editor to verify.
2. Inspect the Chain: Use OpenSSL to inspect the certificate chain:

   openssl s_client -showcerts -connect yourdomain.com:443

   Replace yourdomain.com with your actual domain name. This command will show you the certificates presented by the server, including any intermediate certificates.

3. Update Your Server Configuration

Once you have the combined certificate file, update your web server (e.g., Apache, Nginx) to use it instead of the individual server certificate. The exact configuration steps vary depending on your server software.

• Apache: In your virtual host configuration file, update the SSLCertificateFile directive to point to the new combined certificate file.

  SSLCertificateFile /path/to/combined_certificate.pem

• Nginx: In your server block configuration file, update the ssl_certificate directive:

  ssl_certificate /path/to/combined_certificate.pem;

4. Restart Your Server

After updating the configuration, restart your web server for the changes to take effect.