I'd guess that X.pem is your server certificate, and it is issued by GoDaddy Secure Certificate Authority - G2

Then x_bundle-g2-g1.crt is the chain of trust till the root GoDaddy certificate.

Check the contents of x_bundle-g2-g1.crt using openssl command:

openssl crl2pkcs7 -nocrl -certfile x_bundle-g2-g1.crt | openssl pkcs7 -print_certs -text -noout | grep -E 'Subject:|Issuer:'

This hack is to print all certificates in PEM file

I expect the output would be like this:

        Issuer: C=US, ST=Arizona, L=Scottsdale, O=GoDaddy.com, Inc., CN=Go Daddy Root Certificate Authority - G2
        Subject: C=US, ST=Arizona, L=Scottsdale, O=GoDaddy.com, Inc., OU=http://certs.godaddy.com/repository/, CN=Go Daddy Secure Certificate Authority - G2
        Issuer: C=US, O=The Go Daddy Group, Inc., OU=Go Daddy Class 2 Certification Authority
        Subject: C=US, ST=Arizona, L=Scottsdale, O=GoDaddy.com, Inc., CN=Go Daddy Root Certificate Authority - G2
        Issuer: C=US, O=The Go Daddy Group, Inc., OU=Go Daddy Class 2 Certification Authority
        Subject: C=US, O=The Go Daddy Group, Inc., OU=Go Daddy Class 2 Certification Authority

That is,

1. Go Daddy Secure Certificate Authority - G2 signed by Go Daddy Root Certificate Authority - G2
2. Go Daddy Root Certificate Authority - G2
3. self-signed Go Daddy Class 2 Certification Authority

Check which certificates your web server provides to the client: openssl s_client -showcerts -servername YOUR_SERVER -connect YOUR_SERVER:443 </dev/null

I'd bet that it provides the complete chain -

• your server certificate from X.pem
• Go Daddy Secure Certificate Authority - G2
• Go Daddy Root Certificate Authority - G2

This is a precaution for end systems, such as brosers, that miss intermediate GoDaddy certificate.

"G" stands for Root certificates generation. Basically, it identifies the generation (version) of a Root certificate that signs the Chain of trust. When CA needs to get a new chain (for example, because of upgrade from SHA-1 to SHA-256), they just increment the generation number. This is good because obsolete certificates can be better identified.