Do not trust all intermediate certificates

Question

I have a trust store containing SSL certificate chain up to Root CA certificate:

Root CA -> Intermediate CA - SSL certificate

According what I saw as a best practice, only Root CA certificate should be added into trust store because SSL server should be sending SSL certificate together with its Intermediate CA certificate, and therefore we can verify the whole chain.

But what about the situation where I would like to trust only one particular Intermediate CA which issued SSL certificate and not other?

Managing party of Root CA can issue another Intermediate CA2 which would be then also trusted by my application. How to avoid such situation?

Including Intermediate CA certificate into trust store does not solve that, because Intermediate CA2 certificate would be still trusted.

Answer 1

Your trust store should contain the certificates you trust. If you trust only a single intermediate CA, and not its root, you should include the intermediate CA's certificate and not the root's.

Once a chain of trust can be built to a certificate in your trust store, it doesn't matter if that certificate was issued by another CA or not.