What are the security implications of adding an Intermediate Certificate into the Trusted Root Store in Windows?


I have 2 certificates (one root and one intermediate).

In Windows OS, the Root certificate is in the trusted root store (for current user). The other intermediate certificate (signed by the root CA), is to be found (under current user also) under the Intermediate CA store.

I am using SSL verification in one of my client applications (Kafka Confluent) and realized the client only enumerates certificates in the root store. Therefore SSL handshake fails (the intermediate CA is needed).

One solution is to import that certificate into the Trusted Root Certificate Authorities. With that solution, SSL verification at client works. However, is there any concern in doing so?

From security point of view does it make a difference if the intermediate CA exists in the Root store vs the Intermediate store on Windows?

UPDATE If more context is needed as to what exactly I am facing you can check the issue here https://github.com/edenhill/librdkafka/issues/3025