@dalen @adrienthebo according to TLS, the certificate_list <http://tools.ietf.org/html/rfc4346#page-40> always goes from sender's cert to its issuer, to its issuer, etc. So I'm pretty sure the last one is always the wrong one (unless openssl sorts them differently). Also, I know older SSL implementations sometimes get this backwards. Not an issue for agents connecting to the puppet master, but could be for an agent connecting to a third-party SSL implementation.