actually extract certificate chain before trying to use it