OpenSSL already supports this, we just need to call
OpenSSL::X509::Store#add_file instead of OpenSSL::X509::Store#add_cert.
When multiple certificates are loaded, validation checks the whole
certificate chain. If a root certificate is missing and only the
intermediate is loaded, validation fails.