Skip to main content
replaced http://stackoverflow.com/ with https://stackoverflow.com/
Source Link

If you have the certificate for intermediate 1 in the trust store then this means that you trust the certificates issued by this CA, which includes the server certificate in question. Thus if the server sends only its leaf certificate issued by intermediate 1 then the client will trust it.

In theory the client would also trust the server if the server additionally sends intermediate 1 and intermediate 2, i.e. the CA's needed in the trust path to the root CA. Since the client does not know (trust) the root CA but trusts intermediate 1 only the superfluous chain certificates sent by the server should be simply ignored. Most clients behave that way but there was a bug in OpenSSL version before 1.0.2 where the validation failed in this case. See OpenSSL issue#3621 or this explanation at stackoverflowthis explanation at stackoverflow for more details.

If you have the certificate for intermediate 1 in the trust store then this means that you trust the certificates issued by this CA, which includes the server certificate in question. Thus if the server sends only its leaf certificate issued by intermediate 1 then the client will trust it.

In theory the client would also trust the server if the server additionally sends intermediate 1 and intermediate 2, i.e. the CA's needed in the trust path to the root CA. Since the client does not know (trust) the root CA but trusts intermediate 1 only the superfluous chain certificates sent by the server should be simply ignored. Most clients behave that way but there was a bug in OpenSSL version before 1.0.2 where the validation failed in this case. See OpenSSL issue#3621 or this explanation at stackoverflow for more details.

If you have the certificate for intermediate 1 in the trust store then this means that you trust the certificates issued by this CA, which includes the server certificate in question. Thus if the server sends only its leaf certificate issued by intermediate 1 then the client will trust it.

In theory the client would also trust the server if the server additionally sends intermediate 1 and intermediate 2, i.e. the CA's needed in the trust path to the root CA. Since the client does not know (trust) the root CA but trusts intermediate 1 only the superfluous chain certificates sent by the server should be simply ignored. Most clients behave that way but there was a bug in OpenSSL version before 1.0.2 where the validation failed in this case. See OpenSSL issue#3621 or this explanation at stackoverflow for more details.

Source Link
Steffen Ullrich
  • 207.5k
  • 30
  • 416
  • 481

If you have the certificate for intermediate 1 in the trust store then this means that you trust the certificates issued by this CA, which includes the server certificate in question. Thus if the server sends only its leaf certificate issued by intermediate 1 then the client will trust it.

In theory the client would also trust the server if the server additionally sends intermediate 1 and intermediate 2, i.e. the CA's needed in the trust path to the root CA. Since the client does not know (trust) the root CA but trusts intermediate 1 only the superfluous chain certificates sent by the server should be simply ignored. Most clients behave that way but there was a bug in OpenSSL version before 1.0.2 where the validation failed in this case. See OpenSSL issue#3621 or this explanation at stackoverflow for more details.