New (much nicer) approach, stolen from nginx: Append CA-chain to cert file