If you have the certificate for intermediate 1 in the trust store then this means that you trust the certificates issued by this CA, which includes the server certificate in question. Thus if the server sends only its leaf certificate issued by intermediate 1 then the client will trust it. In theory the client would also trust the server if the server additionally sends intermediate 1 and intermediate 2, i.e. the CA's needed in the trust path to the root CA. Since the client does not know (trust) the root CA but trusts intermediate 1 only the superfluous chain certificates sent by the server should be simply ignored. Most clients behave that way but there was a bug in OpenSSL version before 1.0.2 where the validation failed in this case. See [OpenSSL issue#3621](https://rt.openssl.org/Ticket/Display.html?id=3621&user=guest&pass=guest) or [this explanation at stackoverflow](https://stackoverflow.com/questions/27804710/python-urllib2-ssl-error/27826829#27826829) for more details.