I'm trying to work with OpenSSL C API, I'm relatively new to all this still, and I find a lot of mixed information out there, so I think it's wise to ask for ideas/opinions/clarification.

Anyway, the client program requires a certificate or directory to be loaded which contains a "TrustStore". Is this just another meaning for the server's CA certificate itself in the case I'm creating my own SSL certificates for said server?

And if so, will the intermediate CA work for this purpose in replacement of root CA?

I think I'm on the right track. However, I just wanted some clarification so as to prevent myself making some real daft mistake, as I've heard some conflicting information in regards to this. Some say the client needs the root CA itself; other sources say they only install intermediate CA for security reasons, which seems logical.

I'm generally a little confused as to how the chain of trust works in regards to a client connection though. I've actually only ever needed to generate a CSR and install a certificate on the web server, so the client side stuff is kinda new to me.

*This question was originally asked [here](https://stackoverflow.com/questions/42850651/when-creating-self-signed-certs-is-the-ca-crt-supposed-to-be-installed-into-cli) on Stack Overflow, it was suggested that I ask the info-sec community.*