Intermediate Certificate Validation Windows 2012+ fix

[wshelor]

Fix for a problem with validating certificates in which the intermediate certificate, not the root, was used as an anchor

[JoeShook]

Do we have a test that can assert this fix? If not can we create one?
I understand this is an issue because only self signed CAs would have worked in the current state. With the CERT_CHAIN_EXCLUSIVE_ENABLE_CA_FLAG flag set on dwExclusiveFlags will allow us to treat a non-root ca an anchor.

But what happens if there is still another intermediate certificate resolved between the public cert and installed anchor?

I want to ensure this is still working.