CA certs can be chained (an array)