I have two intermediate CAs that each sign certificates for their client users, like this:
ROOT CA / \ / \ / \ Intermediate A Intermediate B / \ Client A Client B
I run a service, Service A, that validate clients using Intermediate A's certificate chain. So, Client A connects to Service A and is authenticated. I want to set up a Service B that uses Intermediate B's chain so that it doesn't trust clients who present certs signed by Intermediate A.
If Client B has a cert signed by Intermediate B and this person attempts to connect to Service A (which uses Intermediate A's chain), will it be authenticated?