at least as I've understood SSL the server has to send the chain in order, otherwise the server is misconfigured.

The title of the commit is a bit wrong, I first intended to create a check for non-CA certs but realized that broke in the situation of a single self-signed cert. But then realised that just picking the last should work in all situations.

But I haven't read the entire SSL RFC, so if someone has please fill in here :)