I have a trust store containing SSL certificate chain up to Root CA certificate:
Root CA -> Intermediate CA - SSL certificate
According what I saw as a best practice, only Root CA certificate should be added into trust store because SSL server should be sending SSL certificate together with its Intermediate CA certificate, and therefore we can verify the whole chain.
But what about the situation where I would like to trust only one particular Intermediate CA which issued SSL certificate and not other?
Managing party of Root CA can issue another Intermediate CA2 which would be then also trusted by my application. How to avoid such situation?
Including Intermediate CA certificate into trust store does not solve that, because Intermediate CA2 certificate would be still trusted.