Managing SSL Certificate Bundles

Just in case someone looks up this post again. You never add the root CA certs. The whole point is the client already has root certificates that it trusts. You job is to create a chain of trust between the root CA and your SSL certificate. So you need to include any intermediate certificates that achieve this.

Root CA (client must have this already)
  +---> Intermediate CA (you need to supply this)
           +--- Your SSL Certificate (your SSL certificate)

So your certificate is signed by the Intermediate CA, make sure you have the right one as their can be many, and the Intermediate CA is signed by the Root CA the client already trusts. This is how we create the chain of trust for SSL.