What are the security implications of adding an Intermediate Certificate into the Trusted Root Store in Windows?

Question

I have 2 certificates (one root and one intermediate).

In Windows OS, the Root certificate is in the trusted root store (for current user). The other intermediate certificate (signed by the root CA), is to be found (under current user also) under the Intermediate CA store.

I am using SSL verification in one of my client applications (Kafka Confluent) and realized the client only enumerates certificates in the root store. Therefore SSL handshake fails (the intermediate CA is needed).

One solution is to import that certificate into the Trusted Root Certificate Authorities. With that solution, SSL verification at client works. However, is there any concern in doing so?

From security point of view does it make a difference if the intermediate CA exists in the Root store vs the Intermediate store on Windows?

UPDATE If more context is needed as to what exactly I am facing you can check the issue here https://github.com/edenhill/librdkafka/issues/3025

Answer 1

There is no issue with adding an intermediate.

In general it's not needed since a proper certificate chain is included by the server, so having only the roots makes things much simpler.

In a case such as yours (with misbehaving clients or servers) adding the intermediate is a reasonable solution. The intermediate will have a shorter lifetime than the root, and as long as your libraries do proper revocation checks there should be no issues (but that applies regardless). It's just a bit tedious and manual.