Is it OK (from a security perspective) to add only the the server cert to client trusted store with out adding the root Certificate in SSL? In this case whether handshake completes successfully?
Yes. What you are asking about is often called "certificate pinning".
When you add a signing cert or root cert to your trust store, you are saying, "I trust all certs signed by this cert". By adding the cert to the client's trust store, you are saying, "I explicitly and directly trust this cert". In the former, you are implicitly trusting many certs, in the latter explicitly trusting exactly one cert.
There are some things to be aware of.
- Some clients might not support this model. If it's third party software, you'll want to test before you deploy this way
- you'll need a secure way to deliver the cert to your client. This mechanism has to be trusted and must prevent other, un-trusted certificates from getting onto the client. Web Browsers get their default certs from the browser manufacturer, your OS manufacturer,or from your IT department. If you're going with web browsers and it's for users outside your company, this will be much harder - they can't just connect to your non-root-chained site get a certificate warning and add the cert to their store, as they will have no way to know if they're connected to a malicious site.
- you'll need a secure mechanism to rotate the certificate when it expires or is compromised.
- testing your client app may be challenging. You'll want to connect your client app to a test server, which means you'll need a way to set your client app to use the test server's certificate.
You also get some advantages over using root or signing certs in your trust store
- if it's your custom app and nobody else's certs are in the store, you get a guarantee that clients are only communicating with your servers (until someone replaces the client's trust store)
- root/signing certs use certificate revocation lists for cert revocation, but nobody monitors those. Your approach will simply replace the cert in the client trust stores to effectively revoke a compromised cert.
- there is a smaller attack surface. In the web browser standard model, an attacker could go after any trusted root, any explicitly- or implicitly-trusted intermediate cert, or the leaf cert. With cert pinning, only the leaf cert is a target*
*I intentionally ignore attacks against the software, against weak crypto, and against client trust stores, since that's all common to both scenarios.
No, it won't work, because trust store accepts only root (self-signed) certificates and entire chain must be validated. And validation will fail if root certificate is not presented in the trust store.