I'm getting conflicting information and it seems people are using certificates a little differently depending on how much effort they want to expend in managing them, and maybe the application being used.
Client certs aside, this is my understanding: A server has a signed certificate from a CA. A client should include only the CA's intermediate and/or root certificates in it's Trusted Authority (store depends on application of course). As long as any new or renewed host certificate still uses the same roots the client doesn't need to worry about changes to the server's certificate.
FTP partners I deal with are updating or changing their server certificates and sending them to me. I see many implementations of clients just adding the server certificates to the Trusted Authority. From what I (think I) know, this not only gives me more to manage when these certs expire (annually), but I lose the benefit of CRLs (or do CRLs only work for OSes and browsers?) I thought you only add self-signed certs to Trusted Authority stores.
So, am I right to only want to add roots and intermediates to Trusted Authority stores, or do I get some benefit of adding each server certificate? Does this really matter and it's just preference?