anchor.diff:  paths([Cert1, Cert2 | Rest], Chain, CertDbHandle, CertDbRef, Path) ->
       case public_key:pkix_is_issuer(Cert1, Cert2) of
           true ->
  +            %% Chain orded so far
               paths([Cert2 | Rest], Chain, CertDbHandle, CertDbRef, [Cert1 | Path]);
           false ->
  +            %% Chain is unorded and/or contains extraneous certificates
               unorded_or_extraneous(Chain, CertDbHandle, CertDbRef)
       end.
           
   unorded_or_extraneous([Peer | FalseChain], CertDbHandle, CertDbRef) ->
  -   case extraneous_certs(FalseChain) of
  -       [_] ->
  -           [path_candidate(Peer, FalseChain, CertDbHandle, CertDbRef)];
  -       ChainCandidates ->
  -           lists:map(fun(Candidate) -> 
  -                             path_candidate(Peer, Candidate, CertDbHandle, CertDbRef)
  -                     end, 
  -                     ChainCandidates)
  -   end.
  -
  -path_candidate(Peer, CAs, CertDbHandle, _CertDbRef) ->
  -    {ok,  ExtractedCerts} = ssl_pkix_db:extract_trusted_certs({der, CAs}),
  +    ChainCandidates = extraneous_chains(FalseChain),
  +    lists:map(fun(Candidate) -> 
  +                      path_candidate(Peer, Candidate, CertDbHandle, CertDbRef)
  +              end, 
  +              ChainCandidates).
  +
  +path_candidate(Peer, ChainCandidateCAs, CertDbHandle, _CertDbRef) ->
  +    {ok,  ExtractedCerts} = ssl_pkix_db:extract_trusted_certs({der, ChainCandidateCAs}),
  +    %% certificate_chain/4 will make sure the chain is ordered 
       case certificate_chain(Peer, CertDbHandle, ExtractedCerts, []) of        
           {ok, undefined, Chain} ->
               lists:reverse(Chain);
  
positive.code:     end. 
  
  maybe_shorten_path(Path, PartialChainHandler, Default) ->
      try PartialChainHandler(Path) of
          {trusted_ca, Root} ->
              new_trusteded_path(Root, Path, Default);
  
negative.code:     Default.
  
  handle_incomplete_chain([PeerCert| _] = Chain0, PartialChainHandler, Default, CertDbHandle, CertDbRef) ->
      %% We received an incomplete chain, that is not all certs expected to be present are present. 
      %% See if we have the certificates to rebuild it. 
      case certificate_chain(PeerCert, CertDbHandle, CertDbRef) of
          {ok, _, [PeerCert | _] = Chain} when Chain =/= Chain0 -> %% Chain candidate found          
              handle_partial_chain(lists:reverse(Chain), PartialChainHandler, CertDbHandle, CertDbRef);
  