be despatched through the server - see the RFC extract quoted over) and if that's the scenario, looking at the Issuer and perhaps the AKI field to verify which Root CA issued this first intermediate CA https://ca-none.com/