We have set up a rootca and created a subca to sign certs. What should be deployed to /usr/local/share/ca-certificates/ to update the trusted CA stores? The certificate chain or just the RootCA cert? Most configuration files have a separate directive to point to the certificate chain so it appears that best practice is that only the rootca cert should be trusted?
The generic form of this question is whether the RootCA only should be trusted or the intermediate cert.