I need to publish the GeoTrust intermediate certificate; I’m using 2.4.29 built against Mozilla NSS.  In OpenSSL world, I’d use -- I think -- TLSCACertificateFile /path/to/CA-certificates.  Here’s what I’ve tried:
Download GeoTrust cert from https://knowledge.geotrust.com/support/knowledge-base/index?page=content&id=AR1422 ; save as intermediate.crt
Import with:
# certutil -d /etc/openldap/nssdb/ -A -t ",," -n geotrust-intermediate -i  intermediate.crt
Certutil -L now shows:
# certutil -d /etc/openldap/nssdb/ -L
Certificate Nickname                                         Trust Attributes
geotrust-intermediate                                        ,,  
ds.clarku.edu                                                Pu,Pu,Pu
cn=config looks like this:
olcTLSCACertificateFile: geotrust-intermediate
olcTLSCACertificatePath: /etc/openldap/nssdb
olcTLSCertificateFile: ds.clarku.edu
But still clients cannot verify the cert.
Any Mozilla NSS guru’s know what I’m going wrong?