add support for a seperate cert chain for sha2 clients