My first time setting up a server with SSL was last week after buying a PositiveSSL certificate from Namecheap.

This issue bit me hard. I was extremely frustrated for a few hours when my browser said the site was fine but OpenSSL spat out a generic failure message when trying to get a page in ruby.

Discovering that the browser caches certificates made me realize that it wasn't an OpenSSL or ruby environment issue and lead me down the path to discovering that my server setup was wrong; I needed to explicitly provide intermediate certificates. Prior to that, I figured it happened automatically (as it seemed to with my browser).

I wish I'd seen this writeup before. It would have saved me a bunch of time. In retrospect, Commodo's instructions lacked important information. Your page, on the other hand, actually explains what I needed to do.

EDIT: I should mention that support was quick at getting back to me for an unrelated question about their website. Their lacking instructions notwithstanding, I'd still wholeheartedly recommend PositiveSSL.

All CA's require a bundle, just an FYI.

Comodo has two because they have the structure like this:

=> Old Root (with trust everywhere)

==> New Root (with limited trust)

===> Issuing Intermediary

====> Your Cert (no trust without intermediary)

I think you are right, they all might have at least 1 Intermediate CA cert...

But with the basic certs it's 1 or 2 levels deeper, and the bundle file is not provided ready-to-go after the purchase.

I remember some years back you could either use a single-root cert (with just your SSLCertificateFile file), or with 1 Intermediate CA that you would just use as the SSLCertificateChainFile file.

It's pretty, well, stupid to issue from a root. That means the root has to be connected to the internet, and the CA would have to have trust revoked in the entire root should it be compromised.

COMODO provides all the files in the ZIP sent to you via email. Don't know about others.