Certificate chains and how clients verify them

A server cert is trusted because a CA signed it. The CA is trusted because a root signed the CA. Walk the chain with openssl s_client and find the root.