Seems reasonable, this was the way it worked before, probably due to fact, that the apache cert is issued/signed by the ca, so the chain works for verifying (not sure), will check that