Don't include CA certs in the chain

Patch by Simon Fayer