Mozilla NSS -- how to deploy intermediate certificate

Hello,

I need to publish the GeoTrust intermediate certificate; I'm using 2.4.29 built against Mozilla NSS. In OpenSSL world, I'd use -- I think -- TLSCACertificateFile /path/to/CA-certificates. Here's what I've tried:

Download GeoTrust cert from https://knowledge.geotrust.com/support/knowledge-base/index?page=content&... ; save as intermediate.crt

Import with:

# certutil -d /etc/openldap/nssdb/ -A -t ",," -n geotrust-intermediate -i intermediate.crt

Certutil -L now shows:

# certutil -d /etc/openldap/nssdb/ -L

Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI

geotrust-intermediate ,, ds.clarku.edu Pu,Pu,Pu

cn=config looks like this:

olcTLSCACertificateFile: geotrust-intermediate olcTLSCACertificatePath: /etc/openldap/nssdb olcTLSCertificateFile: ds.clarku.edu

But still clients cannot verify the cert.

Any Mozilla NSS guru's know what I'm going wrong?

Thanks,

Aaron