Choice of default long chain vs short chain

That's not accurate. /docs/man1.1.1/man1/openssl-verify.html

-untrusted file

A file of additional untrusted certificates (intermediate issuer CAs) used to construct a certificate chain from the subject certificate to a trust-anchor. The file should contain one or more certificates in PEM format. This option can be specified more than once to include untrusted certificates from multiple files.

certificates

One or more certificates to verify. If no certificates are given, verify will attempt to read a certificate from standard input. Certificates must be in PEM format.

...
The lookup first looks in the list of untrusted certificates and if no match is found the remaining lookups are from the trusted certificates. The root CA is always looked up in the trusted certificate list: if the certificate to verify is a root certificate then an exact match must be found in the trusted list.

In other words, verify doesn't expect its certificates parameter to contain a fullchain.pem file. Instead it tries to verify each entry in certificates separately.

What you want is to put the chain in an "untrusted" file and the leaf certificate in its own file. For instance:

fg.txt (1.6 KB)
untrusted.txt (3.7 KB)

Then run this:

$ openssl verify -trusted_first -CAfile /etc/ssl/certs/ca-certificates.crt -untrusted untrusted.txt fg.txt 
fg.txt: OK

If you do this, I don't think you need to do anything involving a change to use the short chain.

8 Likes