anchor.diff:                end,
                 ChainCandidates).
   
  -path_candidate(#cert{der=Der, otp=Otp} = Cert, ChainCandidateCAs, CertDbHandle) ->
  +path_candidate(Cert, ChainCandidateCAs, CertDbHandle) ->
       {ok,  ExtractedCerts} = ssl_pkix_db:extract_trusted_certs({der_otp, ChainCandidateCAs}),
       %% certificate_chain/4 will make sure the chain is ordered
  -    case certificate_chain(Otp, Der, CertDbHandle, ExtractedCerts, [Cert], []) of
  +    case certificate_chain(Cert, CertDbHandle, ExtractedCerts, [Cert], []) of
           {ok, undefined, Chain} ->
               lists:reverse(Chain);
           {ok, Root, Chain} ->
  
positive.code: %%--------------------------------------------------------------------
  %%% Internal functions
  %%--------------------------------------------------------------------
  certificate_chain(OtpCert, BinCert, CertDbHandle, CertsDbRef, Chain, ListDb) ->
      IssuerAndSelfSigned = 
  	case public_key:pkix_is_self_signed(OtpCert) of
  	    true ->
  
negative.code: 	{_, true = SelfSigned} ->
  	    do_certificate_chain(CertDbHandle, CertsDbRef, Chain, ignore, ignore, SelfSigned, ListDb);
  	{{error, issuer_not_found}, SelfSigned} ->
  	    case find_issuer(Cert, CertDbHandle, CertsDbRef, ListDb) of
  		{ok, {SerialNr, Issuer}} ->
  		    do_certificate_chain(CertDbHandle, CertsDbRef, Chain,
  					 SerialNr, Issuer, SelfSigned, ListDb);
  