a few more small fixes for chains containing broken certs.