use cert itself as CAChain

because it could not be empty