signed certificates now have working SANs, but path building still doesn't work