bug-fix: don't store leaf cert as intermediate