The certificate file I have on my machine that osqueryd’s

--tls_server_certs

points at contains the following:

-----BEGIN CERTIFICATE-----
<my intermediate certificate authority>
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
<my root certificate authority>
-----END CERTIFICATE-----

(note, no server certificate here)