Is it enough to have Intermediate CA certificate in Trust store to validate a server certificate?

Question

Lets assume that below is the chain:

Server cert -> Intermediate1 -> Intermediate2 ->Root cert

Below is the chain server sent to the client:

Server cert -> Intermediate1 -> Intermediate2

I have Intermediate1 certificate only(no other cert) in my truststore.

Given this scenario, Does client can verify the server certificate?

I'm pretty sure Client verifies successfully and initiates the SSL connection As the immediate Issuer is present in the trust store. Am i wrong?

Answer 1

If you have the certificate for intermediate 1 in the trust store then this means that you trust the certificates issued by this CA, which includes the server certificate in question. Thus if the server sends only its leaf certificate issued by intermediate 1 then the client will trust it.

In theory the client would also trust the server if the server additionally sends intermediate 1 and intermediate 2, i.e. the CA's needed in the trust path to the root CA. Since the client does not know (trust) the root CA but trusts intermediate 1 only the superfluous chain certificates sent by the server should be simply ignored. Most clients behave that way but there was a bug in OpenSSL version before 1.0.2 where the validation failed in this case. See OpenSSL issue#3621 or this explanation at stackoverflow for more details.

Answer 2

Take a look at RFC 5280 Section 6.

The selection of a trust anchor is a matter of policy: it could be the top CA in a hierarchical PKI, the CA that issued the verifier's own certificate(s), or any other CA in a network PKI. The path validation procedure is the same regardless of the choice of trust anchor. In addition, different applications may rely on different trust anchors, or may accept paths that begin with any of a set of trust anchors.

In other words, it depends on the implementation of the certification path validation at the client side. For some clients it works by having only a trusted intermediate CA certificate for others the full chain is required. Some client also cache the intermediate certificate once they have been verified in order to speed up the validation process.