Let's say I want to validate an entity that presents an X509v3 certificate, "Leaf". Leaf is a cert signed by SigningCA. SigningCA's cert, "SigningCert", was signed by RootCA. RootCA's cert, "RootCert" is in my system's trust store.
I pull Leaf and see that it is signed by SigningCA. Specifically, the linkage is that in the "Authority Information Access" section of Leaf, 'CA Issuers' contains a URL that I can follow to pull down SigningCA's cert, SigningCert. So I go and pull that down and do validation. All is good.
But now I want to check that SigningCA is legit. It has it's own CA Issuers field pointing me to the cert of RootCA, RootCert.
Now my question: to validate, do I need to pull this URL, or is it sufficient that RootCert is in my trust store and has some property that allows for quick comparison against what I have already?
It seems (from some experimentation with browsers) that pulling the RootCert is not required, which makes me think that they are comparing some field in SigningCert to something present in all the certs in the trust store and reporting success if a match is found. If so, what is that thing?