A certificate authority whose own certificate is signed by the root (or another intermediate) and which issues the day-to-day end-entity certificates. Splitting issuance away from the root limits damage if an issuing key is compromised — the intermediate can be revoked without replacing the trust anchor. Servers must send intermediates during a TLS handshake because clients typically hold only roots.
Intermediate CA
Intermediate Certificate Authority