If you signed your own CA (Certificate Authority), the proper location to install this depends on how you configured your CRL. (Certificate Revocation List).
A CRL is where provide connected client an information on Certificate Revocation List from your CA (your server) over a simple http connection. Since you want every client to connect and automatically get information about the certificate without error, a proper location would be your public_html/ folder
You really don't have to install the certificate on every server, however hosting your own certificate as Your own CA requires that you host your CA and CRL or a server, thus all clients can get information on any Certificate that is issued by your CA automatically by connecting to your CA Server.
How it works!
Client negotiate secure connection and presented your CRL to check if the certificate presented is revoked or active? if revoked, error will occur, otherwise connection would be granted securely.
I'm assuming that:
- You've installed the certificate on your web server correctly.
- You've tested it by connecting to your web using web browser with no error
if the above are correct, what are you currently using? Apache, Nginx other?
I can only provide the right configuration for a web server, however you must let us know which server you currently installed this on and if you are not getting error when connected.
Use openssl command to troubleshoot any certificate error
openssl s_client -connect yourweb:port -prexit
What is the output of the above command ?
openssl s_client -connect facebook.com:443 -prexit | less
0 s:/C=US/ST=California/L=Menlo Park/O=Facebook, Inc./CN=*.facebook.com
i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 High Assurance Server CA
1 s:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 High Assurance Server CA
i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance EV Root CA
subject=/C=US/ST=California/L=Menlo Park/O=Facebook, Inc./CN=*.facebook.com
issuer=/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 High Assurance Server CA
No client certificate CA names sent
SSL handshake has read 3718 bytes and written 421 bytes
New, TLSv1/SSLv3, Cipher is ECDHE-ECDSA-AES128-GCM-SHA256
Server public key is 256 bit
Secure Renegotiation IS supported
Protocol : TLSv1.2
Cipher : ECDHE-ECDSA-AES128-GCM-SHA256
Rule of thumb:
if you cannot connect test your server:port then you will not be able to connect to it from anywhere.