windows installer fixes

src/server_enrollment.py

@@ -251,8 +251,24 @@ def generate_server_cert_if_needed(
         encryption_algorithm=serialization.NoEncryption()
     ).decode("utf-8")
 
+    # Bundle subordinate CA and upstream CA into server.crt for complete TLS handshake chain
+    full_server_cert_pem = server_cert_pem
+    ca_cert_path = os.path.join(cert_dir, "ca.crt")
+    if os.path.exists(ca_cert_path):
+        with open(ca_cert_path, "r", encoding="utf-8") as f:
+            ca_pem = f.read().strip()
+        if ca_pem and ca_pem not in full_server_cert_pem:
+            full_server_cert_pem = full_server_cert_pem.strip() + "\n" + ca_pem
+
+    upstream_ca_path = os.path.join(cert_dir, "upstream_ca.crt")
+    if os.path.exists(upstream_ca_path):
+        with open(upstream_ca_path, "r", encoding="utf-8") as f:
+            upstream_pem = f.read().strip()
+        if upstream_pem and upstream_pem not in full_server_cert_pem:
+            full_server_cert_pem = full_server_cert_pem.strip() + "\n" + upstream_pem
+
     with open(server_cert_path, "w", encoding="utf-8") as f:
-        f.write(server_cert_pem)
+        f.write(full_server_cert_pem)
     with open(server_key_path, "w", encoding="utf-8") as f:
         f.write(server_key_pem)