be sent from the server - begin to see the RFC extract quoted above) and if that's the scenario, looking at the Issuer and most likely the AKI subject to confirm which Root CA issued this first intermediate CA https://ca-none.com/