I disagree. It's still the CA cert that's used even if this server is not the CA server. I think you should move the logic of determining what is the CA certificate along and optionally set the SSL chain and CRL variables. Then in the template you can have a simple 'if not empty' for those values. Now you're setting variable values that might not be true thus confusing users who do not use the included template.