I am implementing a PKI for a test environment and have everything just about configured. The architecture consists of a Root CA, two issuing (intermediate CAs), and clients. Client certificates and server certificates are implemented and required for authentication. Everything is working great but I had some questions about integrating a third device.
I have a firewall that is going to look for a client certificate in order to authenticate users. The clients already have the root CA certificate uploaded to their trust store (ie the root CA that issued the Intermediate CA that issued the client cert).
In order for the firewall to authenticate users, I believe I need to add the Root CA certificate to the firewall trust store as well so that when a client presents a client certificate, the firewall can trust the client possesses a certificate that has a chain of trust back to the Root CA. This is where I am a little confused. I am fairly certain that I add the Root CA cert to the firewall but I am also wondering if the Issuing CA certificate needs to be added as well or not at all.
From this I have two questions:
The firewall received a signed certificate from the Intermediate CA and the client did as well. Do I need to add the Root CA certificate or the Intermediate CA certificate to the firewall trust store?
More importantly, why? Why is the Root CA certificate added and not the Issuing CA certificate? I think I know why but I don't know all the details, if someone could break down the details and go through what the exact process the firewall would go through to validate the client certificate.