VMC PEM Bundle Omits the Root CA Certificate

What Does “VMC PEM Bundle Omits the Root CA Certificate” Mean?

“VMC PEM bundle omits the root CA certificate” means the served PEM contains the VMC and at least one intermediate but no terminal root certificate. The VMC draft permits omission of the root, while Google's setup guidance asks for the root to be appended. Fetch and Validation of Verified Mark Certificates draft 11 documents the controlling requirement or boundary.

The local checker emits this completeness warning, but the supplied Google guidance does not state that root omission is rejected. This condition is not a universal PKIX or VMC-draft failure.

Why Does VMC PEM Bundle Omits the Root CA Certificate Appear?

VMC PEM bundle omits the root CA certificate appears when the fetched PEM has the VMC and intermediate certificate or certificates but no root; the output does not establish why the root is absent. The exact diagnostic should be read at the scope of served VMC PEM bundle rather than as proof that every BIMI layer failed.

How Do You Fix VMC PEM Bundle Omits the Root CA Certificate?

To fix VMC PEM bundle omits the root CA certificate, append the correct root when targeting Gmail or another provider that documents full-chain upload, while preserving the leaf-to-root order.

Appending a root does not make an untrusted or otherwise invalid chain acceptable.

What Should You Verify After Fixing VMC PEM Bundle Omits the Root CA Certificate?

After fixing VMC PEM bundle omits the root CA certificate, compare the served chain with issuer and provider guidance and validate it against the provider's trust set. Verification should use the exact public selector, URL, record, or file evaluated by the receiver.

The correction clears only this condition; it does not guarantee that a receiver will display an indicator.

Key Takeaways

• The affected object is served VMC PEM bundle.
• The direct correction is to append the correct root when targeting Gmail or another provider that documents full-chain upload, while preserving the leaf-to-root order.
• Appending a root does not make an untrusted or otherwise invalid chain acceptable.