Why install a certificate in the Trusted Root CA of the server?

Question

As part of configuration tasks I am doing at work I am having to learn more about how https works and how to set things up. One bit that I am not sure about is the need to install a certificate in the Trusted Root CA of the server.

I understand when a client makes a request to an HTTP server, the HTTP server responds with a certificate. The browser comes pre-installed with Root CA which it can use to validate the presented certificate from the server. All these makes sense.

What I cannot imagine is the use case where a server needs to add a certificate into trusted root store. The only use case I can think of is when the server also wants to require the client to authenticate itself. Is this the only use case why a server running http service is required to have root CA installed? Or are there more scenarios?

Answer 1

You are correct, the Root CA is required when clients connect to the service with client authentication certificates.

Your server may be a client of another service. In that case, it also needs the Root CA in its own trust-anchor store (Trusted Root CA as you called it). Without this, the server couldn't authenticate the signatures on any certificates presented to it when it connects via TLS to the other service.