support for chained certificates