I found this article and stumbled upon the part:
So if a client trusts either of the G5 certificates as a trusted root, it will trust any certificate issued by a subordinate CA such as the G3.
As to my understanding of RFC5280 (Section 6.1.1 (d)), the server needs to indicate which TrustAnchor the client should validate the certificate path against. The author of the first article (to my understanding) claims that this indication is not necessary and/or that the client will accept my certificate it it trusts any one of the signing CAs.
So assuming we have a scenario like this:
Root A --> intermediate Root B --> intermediate intermediate --> my Cert
where Root A and Root B both signed intermediate and intermediate signed my Cert. The Server is configured to deliver intermediate and my Cert as the certificate path and will hint that Root A should be the Trust Anchor.
- A client will obviously accept my Cert if it has Root A as a Trust Anchor.
- Will a client accept my Cert if it has only Root B as a Trust Anchor?
- Will a client accept my Cert if it has only intermediate as a Trust Anchor?
- Will a client accept my Cert if it has only a self-signed Version of intermediate (but same priv/pub Key and Subject) as Trust Anchor?
- Does any answer change if Root A and Root B both have the same Subject?
- If any answer is No, how can a server know which Trust Anchor the Client has, as in which RootCA to indicate for the Path-Validation?