Intermediates carry basicConstraints with cA set to true, often a pathLenConstraint, key usage keyCertSign and cRLSign, and, under current root program rules, extended key usages that restrict them to one purpose. Chrome's root program, for example, requires new subordinate CAs used for TLS to assert only id-kp-serverAuth.
Because the server must send them, intermediates are the most frequently missing piece of a TLS deployment. They rotate more often than roots: Let's Encrypt replaced its R10–R14 and E5–E9 intermediates with the YR and YE series in 2026, and a server with a hard-coded old chain then serves a wrong one.
Compromise or misissuance of an intermediate is handled by revoking it in the parent's CRL and by browser-pushed blocklists (Mozilla's OneCRL, Chrome's CRLSets), which is faster than waiting for every client to fetch CRLs.