I created a root CA and intermediate CA, then used the intermediate to sign a leaf cert, for the purpose of enabling SSL on various web servers in an internal network.

I'm trying to figure out if I need to distribute both the root and intermediate CA certs in my client truststores, or if I can get by with only distributing the root, as explained in: http://security.stackexchange.com/questions/119460/do-i-put-my-subordinate-intermediate-or-root-ca-certificate-in-my-truststore

Doing a quick test with curl against an https endpoint with a leaf cert, signed by the intermediate, it appears I need the full chain, e.g.:

    curl --cacert chain.crt https://my-endpoint:8080/

When I tried with only the root CA, I got an error:

    curl --cacert root.crt https://my-endpoint:8080/
    curl: (60) SSL certificate problem: unable to get issuer certificate

Why do I need to provide curl the full chain instead of only the root CA? Do I need to create leaf certs with a special option to embed the full chain?