If your browser shows a trust warning after you install a new SSL.com certificate, the cause is almost always a missing link in the chain. Your server has the certificate itself, but not the intermediate and root certificates that connect it back to a browser’s trusted store. This guide walks through downloading those files and installing them in the right order.
What you need before you start
- Your issued SSL.com certificate already installed on the server.
- The certificate hierarchy that matches your certificate type, downloaded from the SSL.com Repository.
- Administrator access to the server or the certificate store you’re installing into.
Step 1: Download the certificate hierarchy
Go to the
SSL.com Repository and download the root and intermediate certificate bundle that matches your issued certificate type. Expand the downloaded file and confirm it contains both a root certificate and one or more intermediate certificates.
Step 2: Install the intermediate certificate
Install the intermediate certificate first. On most platforms this goes into the same store as your server certificate (the Trusted Root or Intermediate Certification Authorities store, or your platform’s trust keystore). On some Windows systems, the intermediate certificate installs into the Personal folder automatically. That’s expected and won’t affect your site.
Step 3: Install the root certificate
Install the root certificate into your server’s Trusted Root certificate store or keystore. Most current server operating systems and browsers already trust SSL.com’s root certificates out of the box, so this step is a safety net rather than a strict requirement for most setups. It matters most for older systems, embedded devices, and custom trust stores that don’t ship with an up-to-date root list.
Platform notes
Apache (configuration-file based). Download the CA bundle from the
SSL.com Repository and point
SSLCertificateChainFile in your virtual host configuration at the uncompressed bundle file. Reload or restart Apache after the change.
IIS / Windows. If a certificate doesn’t take effect after installation, try switching the site binding to a different certificate and then back to the SSL.com certificate. This forces IIS to re-read the chain. Older Windows Server versions may need a full IIS restart rather than just a binding change.
Other platforms (Nginx, load balancers, Java keystores, and similar). The same two certificates go into whatever trust mechanism your platform uses: a concatenated chain file for Nginx, a keystore import for Java-based servers, or the equivalent for a load balancer or reverse proxy. If your platform isn’t covered here, contact support for platform-specific steps.
Step 4: Restart and test
Restart your web server, then test the certificate chain with an SSL checker that reports the full chain, not just the leaf certificate. A correctly configured server shows the certificate, intermediate, and root as a complete, unbroken chain with no warnings.
Getting help
If you run into trust errors after following these steps, contact SSL.com support at Support@SSL.com, call 1-877-SSL-SECURE, or use the chat link on this page. Have your certificate order number ready; it speeds up troubleshooting.
