choose the proxy certificate version depending on the proxies in the
chain (as was similarly in gridsite before canl came)