Root CA or Intermediate CA in firewall trust store

Question

I am implementing a PKI for a test environment and have everything just about configured. The architecture consists of a Root CA, two issuing (intermediate CAs), and clients. Client certificates and server certificates are implemented and required for authentication. Everything is working great but I had some questions about integrating a third device.

I have a firewall that is going to look for a client certificate in order to authenticate users. The clients already have the root CA certificate uploaded to their trust store (ie the root CA that issued the Intermediate CA that issued the client cert).

In order for the firewall to authenticate users, I believe I need to add the Root CA certificate to the firewall trust store as well so that when a client presents a client certificate, the firewall can trust the client possesses a certificate that has a chain of trust back to the Root CA. This is where I am a little confused. I am fairly certain that I add the Root CA cert to the firewall but I am also wondering if the Issuing CA certificate needs to be added as well or not at all.

From this I have two questions:

The firewall received a signed certificate from the Intermediate CA and the client did as well. Do I need to add the Root CA certificate or the Intermediate CA certificate to the firewall trust store?

More importantly, why? Why is the Root CA certificate added and not the Issuing CA certificate? I think I know why but I don't know all the details, if someone could break down the details and go through what the exact process the firewall would go through to validate the client certificate.

Answer 1

I won't give a full explanation of how certificate validation works as there are already a number of great answers on this site if you search "how does certificate validation work".

---

Your questions:

The firewall received a signed certificate from the Intermediate CA and the client did as well. Do I need to add the Root CA certificate or the Intermediate CA certificate to the firewall trust store?

The only real answer here is "Depends how your firewall works, the manual should tell you". Usually you trust a root CA.

More importantly, why? Why is the Root CA certificate added and not the Issuing CA certificate? I think I know why but if someone could break down the details and go through what the exact process the firewall would go through to validate the client certificate.

For the exact process, see any of the other excellent answers on this site.

For an intuition, ask your self why you set up a root CA and an Intermediate CA in the first place? Why didn't you just make a root and issue your client certs off that? Usually the answer is that you want the ability to revoke the Intermediate CA if it gets compromised. If you tell your programs to explicitely trust the Intermediate CA, then even if you revoke it at the root, the software will continue to trust it, because you told it to. You may also run in to technical problems as many cert validation engines get unhappy if the cert chain doesn't end with a self-signed cert.