---
title: "Configure CA Certificate Chains"
slug: "polarity-configure-ca-certificate-chains"
updated: 2026-11-14T00:29:10Z
published: 2026-11-14T00:29:10Z
canonical: "knowledge.threatconnect.com/polarity-configure-ca-certificate-chains"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://knowledge.threatconnect.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure CA Certificate Chains

Install the CA certificates used by your organization so Polarity's services and Integration Store operations can load the required chain. Keep these files separate from the combined web certificate and the platform's server certificate.

## Applies To

Standard Polarity Server v5 Docker installations under `/app`. In the validated v5.7.8 deployment, the platform and web entrypoints build CA bundles from `/app/certs/ca`. The platform also creates a cleaned bundle for Node.js.

## Identify the CA Chain

Start by inspecting the issuer of the certificate installed for your Polarity Server.

```bash
openssl x509 -in /app/certs/polarity.pem -issuer -noout
```

Obtain the full applicable CA chain from your certificate administrator, the CA's repository, or your organization's approved browser export procedure. For deployments using a service such as Zscaler, include the CA certificates required by that environment. If an observed connection error identifies a different issuer, inspect that connection and obtain its applicable chain as well.

A browser can help locate the certificates in use. Open the certificate information for the Polarity Server and export the CA certificates in PEM form. Browser controls differ by browser version, so use its certificate viewer rather than relying on a particular lock or shield icon.

## Install the CA Files

1. Back up the existing certificate and CA files before changing them.
2. Place the CA certificates in `/app/certs/ca` on the Polarity Server. Use PEM-encoded files ending in `.crt` or `.pem`, with names containing letters, digits, underscores, and dashes before the extension. Avoid spaces and other special characters. Use the ownership and read permissions required by your installed containers.
3. Keep the full combined chain at `/app/caddy/config/server.crt` and the platform certificate at `/app/certs/polarity.pem`, as described in [Install or Replace a Server Certificate](/docs/polarity-install-or-replace-a-server-certificate). Adding CA files does not replace these identity files.
4. Restart the containers from the Docker host using the packaged scripts.

```bash
cd /app && ./down.sh && ./up.sh
```

## GoDaddy Certificate Example

For a deployment that requires the GoDaddy G2 bundle, create `/app/certs/ca` first if it does not exist, then download the bundle on the server with appropriate write access.

```bash
cd /app/certs/ca
wget https://certs.godaddy.com/repository/gd_bundle-g2.crt
```

Confirm that this is the bundle applicable to your deployment before installing it. Then restart the containers as shown above. Other issuers require their corresponding CA files.

## Verify the Result

Repeat the visual chain checks in [Troubleshoot SSL and Integration Store Connections](/docs/polarity-troubleshoot-ssl-and-integration-store-connections), or use its optional strict verification commands. Check both Integration Store loading and an integration installation, since a missing chain certificate commonly prevents installation even when the store page loads.

The validated deployment's application bundles differ from the operating system trust used by an independently executed `curl` command. When investigating a discrepancy, check the application's configured CA bundle and the actual error.

## Recover or Undo

If a change causes a regression, restore the previous CA files and any identity files changed, preserve their permissions, restart the containers, and repeat the checks. Keep unrelated existing CA certificates intact.

## Related Information

- [Install or Replace a Server Certificate](/docs/polarity-install-or-replace-a-server-certificate)
- [Troubleshoot SSL and Integration Store Connections](/docs/polarity-troubleshoot-ssl-and-integration-store-connections)
- [Configure Proxies](https://knowledge.threatconnect.com/docs/polarity-configuring-proxies)