Tip of How to Verify CA chain of Kubernetes

Find root CA file of the Kubernetes cluster
Find Client certificate file
They could be in /etc/kubernetes/pki  or  /var/lib/kubelet

# openssl  verify  -CAfile ca.crt  apiserver-kubelet-client.crt
apiserver-kubelet-client.crt: OK