chain needs to contain the leaf cert