OpenSSL shows the following certificate chain for example.com:443.
$ openssl s_client -connect example.com:443 < /dev/null | head -10 depth=1 /C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 High Assurance Server CA verify error:num=20:unable to get local issuer certificate verify return:0 DONE CONNECTED(00000003) --- Certificate chain 0 s:/C=US/ST=California/L=Los Angeles/O=Internet Corporation for Assigned Names and Numbers/OU=Technology/CN=www.example.org i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 High Assurance Server CA 1 s:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 High Assurance Server CA i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance EV Root CA --- Server certificate -----BEGIN CERTIFICATE-----
The certificate chain has the server certificate issued to www.example.org and an intermediate certificate that belongs to DigiCert SHA2 High Assurance Server CA.
However, the certificate chain does not contain the self-signed root certificate fo DigiCert High Assurance EV Root CA.
But both Firefox and Chrome also show the root certificate as part of the certificate chain. That's because these root certificates come bundled with the browsers.
I want to know if there is any way in Firefox or Chrome to figure out that only two of the three certificates in the displayed certificate chain belong to the certificate chain provided by the server in the TLS handshake? Perhaps some sort of visual indicator or some other thing that differentiates the certificates that appeared in the certificate chain from the ones that are part of the browser's trust store?