cert chain fixes