Hi, with PKCS7_verify() you can provide a list of certificates which OpenSSL can use to build and verify the chain. Either within the PKCS7 *p7 or with STACK_OF(X509) *certs. Is there some way to figure out which certificates in p7/certs are used (or not used) to verify the chain? Regards Michael