Always loading the intermediate certificate trades one privacy problem for another. From https://bugzilla.mozilla.org/show_bug.cgi?id=1334485#c11 https://bugzi

Always loading the intermediate certificate trades one privacy problem for another. From https://bugzilla.mozilla.org/show_bug.cgi?id=1334485#c11 https://bugzilla.mozilla.org/show_bug.cgi?id=1334485#c11 : Another approach to this problem is to do AIA chasing (that is, fetch the URI in each certificate to attempt to find an issuer). Firefox currently does not do this for performance and privacy reasons. Doing each fetch is slow (you would probably want a cache anyway, and so would still be vulnerable to this attack). Also, a CA (or even an untrusted party, since you can't verify the trustworthiness of the AIA field until after you've already fetched data from it) can use this to track users.