Don't add a cert to the chain if it's a CA cert