anchor.diff:              Default
       end.
   
  -extraneous_certs(Certs) ->
  +extraneous_chains(Certs) ->
  +    %% If some certs claim to be the same cert that is have the same
  +    %% subject field we should create a list of possible chain certs
  +    %% for each such cert. Only one chain, if any, should be
  +    %% verifiable using available ROOT certs.
       Subjects = [{subject(Cert), Cert} || Cert <- Certs],
       SortedCerts = sort_by_subject(Subjects),
  -    extraneous_certs(SortedCerts,[[]]).
  -
  +    Extra = extraneous_certs(SortedCerts, []),
  +    extraneous_chains(Extra, Certs).
  +
  +extraneous_chains([{CA0, CA1}, {CA2, CA3} | _], Chain) ->
  +    [Chain -- [CA0, CA2],  
  +     Chain -- [CA0, CA3], 
  +     Chain -- [CA1, CA2],
  +     Chain -- [CA1, CA3]];
  +extraneous_chains([{CA0, CA1} | _], Chain) ->
  +    [Chain -- [CA0],  
  +     Chain -- [CA1]];					
  +extraneous_chains(_, Chain) ->
  +    %% Let if fail too many extraneous cert
  +    %% chain alternatives
  +    [Chain].
  +                                                 
  +extraneous_certs([], Acc) ->
  +    Acc;
   extraneous_certs([_], Acc) ->
       Acc;
   extraneous_certs([CA0, CA1 | Certs], Acc) ->
       {_, Name1} = public_key:pkix_subject_id(CA0),
       {_, Name2} = public_key:pkix_subject_id(CA1),
  -    NormName1 = public_key:pkix_normalize_name(Name1),
  -    NormName2 = public_key:pkix_normalize_name(Name2),
  -    case NormName1 of
  -        NormName2 ->            
  -            extraneous_certs([CA1| Certs], path_alts(CA0, CA1, Certs, Acc)); 
  +    
  +    case Name1 of
  +        Name2 -> 
  +            %% Found extraneous cert
  +            extraneous_certs([CA1 | Certs], [{CA0, CA1} | Acc]);
           _ ->
  -            extraneous_certs([CA1 | Certs], lists:map(fun(Candidate) -> [CA0 | Candidate] end, Acc))
  -    end.
  -path_alts(CA1, CA2, CAs, []) ->
  -    [[CA1 | CAs], [CA2 | CAs]];
  -path_alts(CA1, CA2, CAs, [[]]) ->
  -    [[CA1 | CAs], [CA2 | CAs]];
  -path_alts(CA1, CA2, _, [Alt1, Alt2 |Path]) ->
  -    path_alts(CA1, CA2, Alt1, Path) ++ path_alts(CA1, CA2, Alt2, Path).
  +            extraneous_certs([CA1 | Certs], Acc)
  +    end.
   
   sort_by_subject(Subjects) ->
  -    Sort = lists:keysort(1, Subjects),
  -    lists:map(fun({_, Cert}) -> Cert end, Sort).
  +     Sort = lists:keysort(1, Subjects),
  +     lists:map(fun({_, Cert}) -> Cert end, Sort).
       
  -
   subject(Cert) ->
  -    OTPCert =public_key:pkix_decode_cert(Cert, otp),
  -    TBSCert = OTPCert#'OTPCertificate'.tbsCertificate, 
  -    Subject = TBSCert#'OTPTBSCertificate'.subject,
  -    public_key:pkix_normalize_name(Subject).
  +    {_, Name} = public_key:pkix_subject_id(Cert),
  +    Name.
  
positive.code: 
  %%--------------------------------------------------------------------
  -spec trusted_cert_and_paths([der_cert()], db_handle(), certdb_ref(), fun()) ->
  				   [{der_cert() | unknown_ca | selfsigned_peer, [der_cert()]}].
  %%
  %% Description: Extracts the root cert (if not presents tries to 
  %% look it up, if not found {bad_cert, unknown_ca} will be added verification
  %% errors. Returns {RootCert | RootCertRelatedError, Path} Path = lists:reverse(Chain) -- Root
  %%--------------------------------------------------------------------
  trusted_cert_and_paths([Peer] = Chain,  CertDbHandle, CertDbRef, PartialChainHandler) ->
      OtpCert = public_key:pkix_decode_cert(Peer, otp),
  
negative.code:                                      CertDbHandle, CertDbRef)]
      end;
  trusted_cert_and_paths(Chain,  CertDbHandle, CertDbRef, PartialChainHandler) ->
      %% Construct possible certificate paths from the chain certificates.
      %% If the chain contains extraneous certificates there could be
      %% more than one possible path such chains might be used to phase out 
      %% an old certificate. 
      Paths = paths(Chain, CertDbHandle, CertDbRef),
      lists:map(fun(Path) ->
                        case handle_partial_chain(Path, PartialChainHandler, CertDbHandle, CertDbRef) of
  