more tests for invalid chains, CAs (X509v1 intermediate CA, empty trust anchor, broken chains)