What's the point of intermediate CA certs? I am trying to setup an internal CA server, such that my web service communicates to another web service via trusted X.509 certs. I thought the root Cert had to basically be offline somewhere, and the intermediate cert is what would be installed on the server's Trusted Root Certification Authorities, but it appears that the Root is required there? is there something that explains this clearly?

The root CA is kept offline since it's the ultimate trust anchor for your entire PKI. The intermediate handles day-to-day signing, so if it's ever compromised you can revoke and replace it without touching the root. For placement: the root cert needs to be installed in Trusted Root Certification Authorities on any machine that needs to verify your certs. The intermediate should be bundled with the leaf cert in your server's TLS configuration. When installing the root cert into the trust store, you're only distributing the public certificate (.cer/.crt) exported from Infisical. The private key stays on the Infisical CA and never gets distributed anywhere. Validation failures here usually come down to the root public cert not being installed on those machines yet. Once that's in place the chain should build correctly.

if I revoke the intermediate, won't the root still consider the X.509 valid? like it doesn't know the intermediate was revoked does it?

The root doesn't do any active checking. When you revoke the intermediate, it's on the clients to catch that via CRL or OCSP. As long as clients are checking revocation status, they'll see the intermediate is revoked and reject any certs it signed, even if the chain technically traces back to a trusted root. So if you revoke the intermediate in Infisical, the certs it issued don't automatically become invalid on their own. You need to make sure your clients are actually doing revocation checks, otherwise they'll keep trusting those certs.

ah