iPXE TLS requiring trusting the intermediate certificate

[CMCDragonkai]

Ok I've tested now with just server authentication, not client authentication. The same issue occurs. This time without trusting the intermediate certificate, the TLS download fails. But by trusting the intermediate certificate (and you don't even need to trust the root certificate), the TLS download succeeds.

This is a bug. No other TLS tools (including curl and browsers) require trusting the intermediate certificate. They only require trusting the root certificate, the intermediate path validation should go up to the root. I've tried this on the latest ipxe 1.20.1.

Certificate path validation logic in iPXE is quite different from other tools then.