add a script that performs intermediate certificate caching for validation.

Mostly untested.