curl: (60) schannel: CertGetCertificateChain trust error CERT_TRUST_IS_UNTRUSTED_ROOT

Question

have created a self-signed CA certificate ca.cer and an HTTPS server certificate signed by it. I'm using this curl version on Windows 11:

curl 8.8.0 (Windows) libcurl/8.8.0 Schannel zlib/1.3 WinIDN 
Release-Date: 2024-05-22 
Protocols: dict file ftp ftps http https imap imaps ipfs ipns mqtt pop3 pop3s smb smbs smtp smtps telnet tftp 
Features: alt-svc AsynchDNS HSTS HTTPS-proxy IDN IPv6 Kerberos Largefile libz NTLM SPNEGO SSL SSPI threadsafe Unicode UnixSockets

I run 3 commands, and I can't understand why the first one and the third one fail.

The ca.cer CA self-signed certificate has been added to the Trusted Root Certification Authorities certificates in Windows, using Administrator privileges.

First: being curl built on Schannel this one should succeed because ca.cer was added to Windows Trusted Root Authorities certificate:

C:\> curl --ssl-no-revoke -X POST https://%servername%:%port% 
curl: (60) schannel: CertGetCertificateChain trust error CERT_TRUST_IS_UNTRUSTED_ROOT

Second: this one succeeds because I pass ca.cer to --cacert:

C:\>curl --cacert ca.cer --ssl-no-revoke -X POST https://%servername%:%port%

Third: this third command fails as well:

C:\>curl --ca-native --ssl-no-revoke -X POST https://%servername%:%port% curl: (60) schannel: CertGetCertificateChain trust error CERT_TRUST_IS_UNTRUSTED_ROOT

Why does the third command fails? I can see ca.cer among the trusted roots, and have used --ca-native.