> So certs[0] should match but to be bullet proof maybe a comparison should > be made against the complete chain. Maybe you can try change the order you assemble the certs in order to trigger such error?