Mutual TLS for TLSv1.3 – building the client certificate chain for the server.

I’ve been testing Mutual TLS for TLSv1.3 and looking at the “openssl s_client” command directives that allow the client to offer a client certificate chain as an alternative to just the client certificate.

The scripted client command is shown below.

The “openssl s_client” commands “-certform” ,“-cert-chain” & “-build_chain” directives aid the certificate chain to be built from untrusted certificates. However, I was surprised the chain building error unless “-cert_chain” directive file included the "trusted" Self-Signed Root CA.

I do understand there is an argument that a full chain cannot be built if you don’t reach a Self-Signed Root CA – However, the server's requirement to send a client the server's certificate, all Issuing CA and Intermediate Certificates, and optionally the Self-Signed Root CA doesn’t apply to the client, when referencing the standards (I do need to go find this reference). Logically, a client can send any subset of the certificate chain that it chooses, providing the server can process the client certificate chain subset.

Therefore, my question is why in the “open s_client” command is the -cert_chain” directive documentation indicating the PEM formatted file contains “untrusted certificates”, yet the inclusion of a trusted Self-Signed Root certificate is mandatory. I therefore also assume all Issuing CA & Intermediate certificates MUST be present in the file identified by the "-cert_chain" directive?

# Mutual TLS TLSv1.3 Client – with full client certificate chain
(
printf 'GET %s HTTP/1.1\r\n' "${resource}"
printf '%s\r\n' "${Internet_server_name}"
printf 'Connection: Close\r\n'
printf '\r\n'
) | openssl 2>&1 s_client
-connect "${Internet_server_name}:${Internet_server_port}"
-showcerts
-enable_pha
-key "${Internet_client_key}"
-cert "${Internet_client_certificate}"
*-certform PEM
-cert_chain "${Internet_RootCA_and_IssuingCA}"
-build_chain *
-pass "file:${Deliverables}/readme.txt"
-tls1_3
-CAfile "${Internet_RootCA}"
-servername "${Internet_server_name}"
-ign_eof

Regards
Nigel

No source file or test is named. Start by reproducing the provided openssl s_client command and inspect the -cert_chain and -build_chain documentation and certificate-building path. Done means explaining whether a trusted root and complete intermediate chain are required, or correcting the documented behavior.