[tscs37]

There is a difference between a local CA and a CA part of the root store and/or as part of the system's CA bundle.

[throwaway613834]

So terminating in a root CA imposes more restrictions than terminating in a non-root CA here? Something about that seems off...

[tscs37]

Not root CA. Root store.

A root CA that has been installed by the computer administrator is assumed to be more trustworthy than the one installed by your OS.