This question already has an answer here:
Assume you have a certificate (X509 v3) chain sent to you for validation. The chain sent to you may or may not include the root CA certificate. Is there a reliable way to find out whether this is the case?
Quite obviously only the certificate at the top of the hierarchy may be the root CA certificate, but how would I check this? I came up with a check for equality between issuer and subject, and this seems to work fine for all cases I found so far, but I'm not sure whether is foolproof.
Edit: This is not about a manual check or about which tool to use, it's about a programmatic check. So using openSSl to perform checks (as suggested in a 'possible duplicate' claim) is not an option. The question is which certificate attributes or extensions I can use in which fashion to reliably identify a root CA certificate in a given chain.
To make the question even more to the point: I suggested to check whether
subject==issuer right from the beginning. The question is whether this is a foolproof approach. So is it possible to rely on the fact that this is true if and only if it is a root certificate? What happens if I create a root certificate and a derived intermediate CA certificate and, in the latter, just choose the subject equal to the issuer? Will that result in a valid certificate? (The authority key identifier may well correctly point to the key identifier of the root CA).
(Note that I did not ask how to check whether I should trust the chain. I want to know how to reliably identify a root CA certificate in a chain).