having a debate with someone .... When installing a server SSL certificate on the Netscaler for certificate chaining can you just link it to the intermediate cert or does it need to be linked to the intermediate cert and then the intermediate cert has to be linked to the root cert for full chaining ?

It does only need to be linked to the intermediate cert. The only reason for full chaining if if devices need the full chain. Apple devices sometimes do. Technically if devices have the intermediate and roo on them already you shouldn't even need to do that.

Cert needs to be linked to intermediate. But intermediate needs to be linked to the root. This is for Linux type machines that don't necessarily distribute all root certificates to machines.

yeah me personally i have always linked just the intermediate certificate but had a colleague swear blind the intermediate needed to be bound to the root for the chaining to work. The only time i have ever binded the intermediate to the root is when we had Apple devices which would sometimes not work if you didnt do it. Technically both right i suppose so will let colleague off 😂

We always link intermediate to root. When netscaler gateway vip certificate expires, we install new cert, and link it to intermediate, which links to root automatically. If we do not link certs, macbooks will throw, "You did not trust this certificate issuer......" error. We have faced it couple of years back.