extracted certificate is a single one, not a chain