Q:

Are you supposed to see Root CA in SSL chain?

I'm confused in difference what browser shows as SSL chain vs what openSSL does. Example below what SSL chain looks like for https://www.comodo.com from browser and from open SSL. As you can see open SSL showing that Comodo RSA Certification Authority has actually a parent called AddTrust External CA Root while it's not being shown in browser.

CONNECTED(00000003)
depth=3 C = SE, O = AddTrust AB, OU = AddTrust External TTP Network, CN = AddTrust External CA Root
verify return:1
depth=2 C = GB, ST = Greater Manchester, L = Salford, O = COMODO CA Limited, CN = COMODO RSA Certification Authority
verify return:1
depth=1 C = GB, ST = Greater Manchester, L = Salford, O = COMODO CA Limited, CN = COMODO RSA Extended Validation Secure Server CA
verify return:1
depth=0 serialNumber = 3910805, jurisdictionC = US, jurisdictionST = Delaware, businessCategory = Private Organization, C = US, postalCode = 07013, ST = New Jersey, L = Clifton, street = Suite 100, street = 1255 Broad St, O = "Comodo Security Solutions, Inc.", OU = COMODO EV SSL, CN = www.comodo.com
verify return:1

A:

The computed trust chain depends on the root certificates in the trust store and on the algorithm to compute the trust chain. In this specific case the server sends the following certificates:
 0 ... CN=www.comodo.com
 1 ... CN=COMODO RSA Extended Validation Secure Server CA
 2 ... CN=COMODO RSA Certification Authority

The issuer of [0] is [1], of [1] is [2] and of [2] is ...CN=AddTrust External CA Root.
The browser has a self-signed certificates for CN=COMODO RSA Certification Authority in the trust store and prefers short trust chains and thus computes a  trust chain which ends with this certificates. Note that the CN=COMODO RSA Certification Authority the browser has is a self-signed CA certificate (i.e. root CA) and not the same certificate as send by the server. They both have the same public (and therefore private) key though so that they can both be used to successfully validate the signature of CN=COMODO RSA Extended Validation Secure Server CA.
openssl has likely also this certificate in the trust store but has also a certificate for CN=AddTrust External CA Root. Since OpenSSL first tries the longest trust path it will show the path ending with the AddTrust root. If the AddTrust certificate would not have been in the trust store it would have also shown the short trust chain ending with CN=COMODO RSA Certification Authority. This would at least  be the case with OpenSSL 1.02 and later. Previous version would fail validation if the last certificate in the send chain had no issuing root certificate in the trust store.

