<!--  As an open source project with a dedicated but small maintainer team, it can sometimes take a long time for issues to be addressed so please be patient and we will get back to you as soon as we can.
-->

### Preflight Checklist
<!-- Please ensure you've completed the following steps by replacing [ ] with [x]-->

* [x] I have read the [Contributing Guidelines](https://github.com/electron/electron/blob/master/CONTRIBUTING.md) for this project.
* [x] I agree to follow the [Code of Conduct](https://github.com/electron/electron/blob/master/CODE_OF_CONDUCT.md) that this project adheres to.
* [x] I have searched the issue tracker for an issue that matches the one I want to file, without success.

### Issue Details

* **Electron Version:**
  `allElectronVersionsList.every(version => version <= 6.02)`
* **Operating System:**
  macOS 10.14.4
* **Last Known Working Electron version:**
  `null`

### Expected Behavior
A certificate chain _always_ contains a root CA in the last `issuerCert` property

### Actual Behavior
A certificate chain does _not always_ contain a root CA. Sometimes there is no last `issuerCert` property with the root CA.

### To Reproduce
```javascript
import { session } from "electron";

session.defaultSession.setCertificateVerifyProc((request, callback) => {
  console.log(request)
})
// go to https://www.google.com
```
Output:
```json
{
  "hostname": "www.google.com",
  "certificate": {
    "data": "-----BEGIN CERTIFICATE-----[...]-----END CERTIFICATE-----\n",
    "issuer": {
      "commonName": "Google Internet Authority G3",
      "organizations": ["Google Trust Services"],
      "organizationUnits": [],
      "locality": "",
      "state": "",
      "country": "US"
    },
    "issuerName": "Google Internet Authority G3",
    "subject": {
      "commonName": "www.google.com",
      "organizations": ["Google LLC"],
      "organizationUnits": [],
      "locality": "Mountain View",
      "state": "California",
      "country": "US"
    },
    "subjectName": "www.google.com",
    "serialNumber": "4C0285FE64D38AE9CF0D9E7529683F13",
    "validStart": 1564425802,
    "validExpiry": 1571682180,
    "fingerprint": "sha256/7eN7eGinc3BpdbZckdcZUqBYxGOmqbSnGnw3/tAKT7k=",
    "issuerCert": {
      "data": "-----BEGIN CERTIFICATE-----[...]-----END CERTIFICATE-----\n",
      "issuer": {
        "commonName": "GlobalSign",
        "organizations": ["GlobalSign"],
        "organizationUnits": ["GlobalSign Root CA - R2"],
        "locality": "",
        "state": "",
        "country": ""
      },
      "issuerName": "GlobalSign",
      "subject": {
        "commonName": "Google Internet Authority G3",
        "organizations": ["Google Trust Services"],
        "organizationUnits": [],
        "locality": "",
        "state": "",
        "country": "US"
      },
      "subjectName": "Google Internet Authority G3",
      "serialNumber": "01E3A9301CFC7206383F9A531D",
      "validStart": 1497484842,
      "validExpiry": 1639526442,
      "fingerprint": "sha256/vgzNVNTOzaG9Xl2ezIWgTCwfk6UiDXf96I/prQgfZBs="
    }
  },
  "verificationResult": "net::OK",
  "errorCode": 0
}
```

**There are only the leaf and intermediate certificates in the _request_ object above**

### Additional Information
But for some domains root certificate exists.
e.g. for `www.example.org`:
```json
{
  "hostname": "www.example.org",
  "certificate": {
    "data": "-----BEGIN CERTIFICATE-----[...]-----END CERTIFICATE-----\n",
    "issuer": {
      "commonName": "DigiCert SHA2 Secure Server CA",
      "organizations": ["DigiCert Inc"],
      "organizationUnits": [],
      "locality": "",
      "state": "",
      "country": "US"
    },
    "issuerName": "DigiCert SHA2 Secure Server CA",
    "subject": {
      "commonName": "www.example.org",
      "organizations": ["Internet Corporation for Assigned Names and Numbers"],
      "organizationUnits": ["Technology"],
      "locality": "Los Angeles",
      "state": "California",
      "country": "US"
    },
    "subjectName": "www.example.org",
    "serialNumber": "0FD078DD48F1A2BD4D0F2BA96B6038FE",
    "validStart": 1543363200,
    "validExpiry": 1606910400,
    "fingerprint": "sha256/klBxHFTeVG9DcODD06PsRbyWCSolpKcaGvo5avcEfrg=",
    "issuerCert": {
      "data": "-----BEGIN CERTIFICATE-----[...]-----END CERTIFICATE-----\n",
      "issuer": {
        "commonName": "DigiCert Global Root CA",
        "organizations": ["DigiCert Inc"],
        "organizationUnits": ["www.digicert.com"],
        "locality": "",
        "state": "",
        "country": "US"
      },
      "issuerName": "DigiCert Global Root CA",
      "subject": {
        "commonName": "DigiCert SHA2 Secure Server CA",
        "organizations": ["DigiCert Inc"],
        "organizationUnits": [],
        "locality": "",
        "state": "",
        "country": "US"
      },
      "subjectName": "DigiCert SHA2 Secure Server CA",
      "serialNumber": "01FDA3EB6ECA75C888438B724BCFBC91",
      "validStart": 1362744000,
      "validExpiry": 1678276800,
      "fingerprint": "sha256/FUxDPEkZKcXvaG6DjjI2ZKAOag2CLMyVj7TasD5JoI8=",
      "issuerCert": {
        "data": "-----BEGIN CERTIFICATE-----[...]-----END CERTIFICATE-----\n",
        "issuer": {
          "commonName": "DigiCert Global Root CA",
          "organizations": ["DigiCert Inc"],
          "organizationUnits": ["www.digicert.com"],
          "locality": "",
          "state": "",
          "country": "US"
        },
        "issuerName": "DigiCert Global Root CA",
        "subject": {
          "commonName": "DigiCert Global Root CA",
          "organizations": ["DigiCert Inc"],
          "organizationUnits": ["www.digicert.com"],
          "locality": "",
          "state": "",
          "country": "US"
        },
        "subjectName": "DigiCert Global Root CA",
        "serialNumber": "083BE056904246B1A1756AC95991C74A",
        "validStart": 1163116800,
        "validExpiry": 1952035200,
        "fingerprint": "sha256/Q0ig6URMeMsmXgWNXolEtNhPlmK9Jtslf4k0pEPHAWE="
      }
    }
  },
  "verificationResult": "net::OK",
  "errorCode": 0
}
```

**The full chain, including the root CA, exists in the _request_ object above**

I think [this](https://github.com/electron/electron/pull/7917/files) PR somehow related to this issue (if it is an issue (?))

My problem is that I cannot pin all root CA into my application to avoid a MITM attack.
shell/browser/net/cert_verifier_client.h
public:
  using CertVerifyProc =
      base::RepeatingCallback<void(const VerifyRequestParams& request,
                                   base::RepeatingCallback<void(int)>)>;
  explicit CertVerifierClient(CertVerifyProc proc);
  ~CertVerifierClient() override;
  
  void Verify(int default_error,
              const net::CertVerifyResult& default_result,
              const scoped_refptr<net::X509Certificate>& certificate,
              const std::string& hostname,
              int flags,
              const base::Optional<std::string>& ocsp_response,
              VerifyCallback callback) override;
 private:
  CertVerifyProc cert_verify_proc_;
};
}  
#endif