I have two intermediate CAs that each sign certificates for their client users, like this:
ROOT CA
/ \
/ \
/ \
Intermediate A Intermediate B
/ \
Client A Client B
I run a service, Service A, that validate clients using Intermediate A's certificate chain. So, Client A connects to Service A and is authenticated. I want to set up a Service B that uses Intermediate B's chain so that it doesn't trust clients who present certs signed by Intermediate A.
If Client B has a cert signed by Intermediate B and this person attempts to connect to Service A (which uses Intermediate A's chain), will it be authenticated?