NET::ERR_CERT_AUTHORITY_INVALID: When the Root Itself Is Not Trusted

The chain is complete and the hostname matches — and the browser still refuses it with NET::ERR_CERT_AUTHORITY_INVALID, because the root at the top of the chain is not one the client trusts. Why this differs from a missing intermediate, the causes in the order they bite, and how to read the trust anchor your server presents.