In the answer to question "How TLS certificate chain is verified" it mentions that the involved intermediate certificates are "fetched and validated". How exactly is that done?
Specifically:
So I know the intermediate certificates can be stored locally at a client or served by the server. Are these two sources trusted the same? Do you have to fetch the intermediate from a server that is owned and operated by root CA or signing CA?
When a intermediate certificate is verified, does the client connect to the domain of the intermediate certificate owner to validate the certificate against the live domain? Or would a local-only algorithm do all the work up till the root certificate?