diff --git a/src/murmur/Meta.cpp b/src/murmur/Meta.cpp
index e9bdd4322..b68fc6714 100644
--- a/src/murmur/Meta.cpp
+++ b/src/murmur/Meta.cpp
@@ -374,7 +374,7 @@ void MetaParams::read(QString fname) {
 			if (ql.isEmpty()) {
 				qCritical("Failed to parse any CA certificates from %s", qPrintable(qsSSLCA));
 			} else {
-				QSslSocket::addDefaultCaCertificates(ql);
+				qlCA = ql;
 			}
 		} else {
 			qCritical("Failed to read %s", qPrintable(qsSSLCA));
@@ -428,8 +428,8 @@ void MetaParams::read(QString fname) {
 			qFatal("Failed to find certificate matching private key.");
 		}
 		if (ql.size() > 0) {
-			QSslSocket::addDefaultCaCertificates(ql);
-			qCritical("Adding %d CA certificates from certificate file.", ql.size());
+			qlIntermediates = ql;
+			qCritical("Adding %d intermediate certificates from certificate file.", ql.size());
 		}
 	}
 
diff --git a/src/murmur/Meta.h b/src/murmur/Meta.h
index c887a2be8..7cbfaedda 100644
--- a/src/murmur/Meta.h
+++ b/src/murmur/Meta.h
@@ -93,6 +93,22 @@ public:
 
 	QSslCertificate qscCert;
 	QSslKey qskKey;
+
+	/// qlIntermediates contains the certificates
+	/// from PEM bundle pointed to by murmur.ini's
+	/// sslCert option that do not match the key
+	/// pointed to by murmur.ini's sslKey option.
+	///
+	/// Simply put: it contains any certificates
+	/// that aren't the main certificate, or "leaf"
+	/// certificate.
+	QList<QSslCertificate> qlIntermediates;
+
+	/// qlCA contains all certificates read from
+	/// the PEM bundle pointed to by murmur.ini's
+	/// sslCA option.
+	QList<QSslCertificate> qlCA;
+
 	QByteArray qbaDHParams;
 	QByteArray qbaPassPhrase;
 	QString qsCiphers;