be despatched through the server - see the RFC extract quoted above) and when that's the case, looking at the Issuer and potentially the AKI field to ascertain which Root CA issued this first intermediate CA https://ca-none.com/