Certificate validation to multiple Root Certificates?

Question

I found this article and stumbled upon the part:

So if a client trusts either of the G5 certificates as a trusted root, it will trust any certificate issued by a subordinate CA such as the G3.

As to my understanding of RFC5280 (Section 6.1.1 (d)), the server needs to indicate which TrustAnchor the client should validate the certificate path against. The author of the first article (to my understanding) claims that this indication is not necessary and/or that the client will accept my certificate it it trusts any one of the signing CAs.

So assuming we have a scenario like this:

Root A --> intermediate
Root B --> intermediate
intermediate --> my Cert

where Root A and Root B both signed intermediate and intermediate signed my Cert. The Server is configured to deliver intermediate and my Cert as the certificate path and will hint that Root A should be the Trust Anchor.

1. A client will obviously accept my Cert if it has Root A as a Trust Anchor.
2. Will a client accept my Cert if it has only Root B as a Trust Anchor?
3. Will a client accept my Cert if it has only intermediate as a Trust Anchor?
4. Will a client accept my Cert if it has only a self-signed Version of intermediate (but same priv/pub Key and Subject) as Trust Anchor?
5. Does any answer change if Root A and Root B both have the same Subject?
6. If any answer is No, how can a server know which Trust Anchor the Client has, as in which RootCA to indicate for the Path-Validation?

Answer 1

I suspect, you are talking about SSL/TLS certificate validation in a HTTPS context.

how can a server know which Trust Anchor the Client has, as in which RootCA to indicate for the Path-Validation?

server don't know and not required to know about trusted anchors installed on the client. Server sends leaf and intermediate CA certificates (without roots) and the rest is up to client.

Client uses retrieved certificates and constructs certificate chains. During certification path building multiple chains can be produced (due to cross-certification). That is, leaf certificate has more than one path to one or more trusted anchors. Depending on on client configuration (crypto library), only single chain (best one) is chosen and used for the rest process of certificate validation.

Eventually, there might be a case that chains on server and client are different. For instance, server has Root A as a trust anchor (but no Root B), while client has Root B as a trust anchor (but no Root A). If intermediate certificate can be chained to Root A on server and to Root B on client, the certificate will be successfully accepted.

Does any answer change if Root A and Root B both have the same Subject?

they have to have the same subject, because one of certificate binding in the chain rules is that issuer field of the certificate must match the Subject field of the issuer certificate. Otherwise, the issuer certificate may not be found.

Will a client accept my Cert if it has only a self-signed Version of intermediate (but same priv/pub Key and Subject) as Trust Anchor?

if crypto library does support use of non-self-signed certificates as a Trusted Anchor (Microsoft CryptoAPI, for instance, does) then it is possible. Then root certificate has no effect in the certification path building.