Add an error if we can't find the HTTP response header.
Remove unnecessary chain certificate in root-ca.pem.
Update root-ca.pem.
Ignore certificate purposes, since our current DTLA certificates aren't "sslserver" certificates.