Ensure caller-supplied intermediate certificates cannot terminate the chain during compatibility-layer verification; a path must reach a configured trust anchor. Add a regression test and supporting certs.
Tobias Frauenschläger