title: X509Chain.Build() method explanation
body: <p>I want to validate chain of certificates, I get a <code>X509Certificate2</code> collection and have to validate if all the certificates build one chain.</p>
  
  <p>Usually, in order to verify the certificates chain I should take the digital signature from the leaf certificate and check if it is signed by the root certificate - <strong>but</strong> in .NET I can't find a way to extract the signature from the <code>X509Certificate2</code> object.   </p>
  
  <p>Therefore, I thought of using <code>X509Chain.Build()</code> method in the following way: </p>
  
  <pre><code>   void ValidateChain(X509Certificate2Collection collection, X509Certificate2 leaf)
      {
          X509Chain x509Chain = new X509Chain();
          x509Chain.ChainPolicy.ExtraStore.AddRange(collection);
          bool isValid = x509Chain.Build(leaf); 
      }
  </code></pre>
  
  <p>But I have some questions about the build method:</p>
  
  <ol>
  <li>As I understood, the chain was built also from my computer store, and I want that it is built only from the <code>ExtraStore</code>, how can I define this behaviour?</li>
  <li>I saw that after the chain was built it doesn't contain the Root Certificate; my question is <strong>why</strong>, and how can I verify that the chain has Root CA, since this is not part of the chain elements.</li>
  </ol>
  
  <p>I will so appreciate it if someone can explain to me how the <code>Build()</code> method works.</p>