be sent via the server - begin to see the RFC extract quoted previously mentioned) and when that's the case, investigating the Issuer and perhaps the AKI industry to verify which Root CA issued this first intermediate https://ca-none.com/