# What exactly is Let's encrypts chain.pem file?

While trying to understand the use or meaning of the fullchain.pem file created by let's encrypt I stumbled upon this post in which fullchain.pem is explained as:

fullchain.pem is a concatenation of cert.pem and chain.pem in one file. In most servers you’ll specify this file as the certificate, so the entire chain will be send at once. Some clients require you to specify the above two files separate. In that case you won’t need

While chain.pem on the other hand is described as

chain.pem contains the intermediate certificate, the certificate from Let’s Encrypt containing the public key which is “coupled” to the private key which signed your certificate (the one above). This intermediate certificate is required for clients to verify your certificate;

But I have troubles really understanding what this means. By this I mean what exactly is intermediate certificate and where does it come from.

I understand the concept of CA's and the fact that CA issue certificates. I understand that the certificate issued by the CA which is put to use is the end user certificate.

I also understand the chain of trust, where there are intermediate CA between the end user certificate and the root CA.

What I can't understand is how let's encrypt can know all the possible intermediate CA between the root CA and the end certificate.

I mean it is possible to know all the CA, that the root CA itself signed. But what if those other CA's created other CA's that ends up issuing the end user certificate, how can this ever be in chain.pem?

Which then begs the question, how can those end user certificate's be ever verified, since it seems the full chain of trust, the full intermediate CA is not known in chain.pem?

Anyone kind enough to help me understand the setup? Thanks!

• There is only one intermediate for a given EE cert, and in fact only one in use at a given time with changes occurring only at intervals of several years; see letsencrypt.org/certificates Dec 30 '20 at 0:56