v2: - add a patch which stores originally established chain and uses that for CERT_CHAIN_REVOCATION_CHECK_CHAIN_EXCLUDE_ROOT. The main problem with the present implementation is that the intermediate certificates maybe be received from the server and the current implementation which only uses default root store when constructing chain for WINHTTP_OPTION_SERVER_CERT_CHAIN_CONTEXT may be missing those. That actually doesn't break simple cases (the issue is not reproducible with test using test.winehq.org because crypt32 will try to find issuer from URL_OID_CERTIFICATE_ISSUER and thus reconstruct the chain. But that OID is not guaranteed to exist, the cert chain from server should not be ignored. The actual issue I am reproducing with current impl is actually trickier than missing OIDs (while that is also possible). Offending server https://www2.signon.goliath.prod.deadorbit.net has intermediate "GoDaddy TLS Root CA - R1" certificate. The version of this certificate obtained from http://certificates.godaddy.com/repository/gd_tls_root-r1.crt shows up as self signed cert (issuer is the same as cert) so reconstru cted chain ends up without actual root and fails to verify. While the one which server sends is better and features "Go Daddy Root Certificate Authority - G2". -- https://gitlab.winehq.org/wine/wine/-/merge_requests/11546#note_147723