certificates are now validated (in their own chain) and a separate error is stored for each cert