• Poco is passing the hAdditionalStore parameter as null when calling CertGetCertificateChain.
• When the intermediate certificates are not installed on the machine, looks like hCertStore of the CERT_CONTEXT member needs to be passed as hAdditionalStore parameter to CertGetCertificateChain, for it to be able to build the entire chain.
• Without this, the created certificate chain seems to contain only the leaf certificate and thus the certificate validation fails
  • It fails to find the back of the chain (in this case leaf itself), in the certificate store.

  • poco/NetSSL_Win/src/SecureSocketImpl.cpp

    Line 1288 in 69d15c5

    PCCERT_CONTEXT pResult = CertFindCertificateInStore(trustedCerts, certs.back()->dwCertEncodingType, 0, CERT_FIND_ISSUER_OF, certs.back(), 0);

• Windows (Schannel) gives the handle to the store containing intermediate certificates under hCertStore memeber of CERT_CONTEXT certificate obtained from QueryContextAttributes (Schannel)

Note:

• Curl and Chromium seems to be passing this hAdditionalStore argument
  • https://chromium.googlesource.com/chromium/src/net/+/master/cert/cert_verify_proc_win.cc#1208
  • https://github.com/curl/curl/blob/master/lib/vtls/schannel_verify.c#L669