Parts of a certificate: leaf, intermediates, root and key

A server does not present a single certificate, but a chain:

• Leaf certificate: the certificate of the server or service, with the names (Common Name and SANs) and the public key. It is issued by an intermediate CA.
• Intermediate certificates: the certificates of the issuing CAs between the leaf and the root. A client needs them to build the path to a root it trusts. Most problems with chains are missing intermediates.
• Root certificate: the self-signed certificate of the root CA. Clients trust it because it is already in their root store, for example in Trusted Root Certification Authorities of Windows. The server normally does not send it.
• Private key: belongs to the leaf certificate and never leaves the server it is used on, except in a protected export. TLSPilot keeps it on the management host, which is why Export and the file targets need a stored key.

Full chain (often fullchain.pem) means the leaf followed by the intermediates in one PEM file, without the root. This is what web servers such as Nginx expect. A file called chain.pem usually contains only the intermediates. TLSPilot stores the chain it receives from the CA and names the files accordingly: on Linux, the default is /etc/ssl/tlspilot/<cert-id>/fullchain.pem and privkey.pem; File Path (WinRM) and UNC share write <name>-fullchain.pem and <name>-privkey.pem when the destination is a folder and the key is written to a separate file.