Lets say we have a business owned internal CA. Its certificate is trusted by one of the Trusted Roots that is present in all browsers.
With that CA, we issue a bunch of certificates for servers in the organisation - say for webmail over SSL.
For a user coming to visit that webmail server, and has the Trusted Root present in its trusted root certificate store, would it automatically trust the webmail server cert, even though it does not explicitly trust the business CA certificate?
My understanding that intermediate certificates inherit the trust of their signatory, but want to confirm.