anchor.diff:      {ok, CertFile} = application:get_env(?APP_NAME, web_cert_file),
       {ok, ChainFile} = application:get_env(?APP_NAME, web_cert_chain_file),
       {ok, Cert} = file:read_file(CertFile),
  -    case file:read_file(ChainFile) of
  -        {ok, Chain} -> write_to_temp([Cert, Chain]);
  -        Error ->
  -            ?warning("Error reading certificate chain in path ~p: ~p. "
  -            "rtransfer will use cert only", [ChainFile, Error]),
  -            write_to_temp([Cert])
  +    Contents =
  +        case file:read_file(ChainFile) of
  +            {ok, Chain} -> [Cert, Chain];
  +            Error ->
  +                ?warning("Error reading certificate chain in path ~p: ~p. "
  +                         "rtransfer will use cert only", [ChainFile, Error]),
  +                [Cert]
  +        end,
  +    Filename = write_certs_to_temp(Contents),
  +    true = is_list(Filename),
  +    Filename.
  +
  +%%--------------------------------------------------------------------
  +%% @private
  +%% @doc
  +%% Creates a temporary file populated with given contents.
  +%% @end
  +%%--------------------------------------------------------------------
  +-spec write_certs_to_temp(Contents :: [binary()]) -> file:filename() | false.
  +write_certs_to_temp(Contents) ->
  +    case lists:flatmap(fun public_key:pem_decode/1, Contents) of
  +        [] -> false;
  +        Ders ->
  +            TempPath = lib:nonl(os:cmd("mktemp")),
  +            OutData = public_key:pem_encode(Ders),
  +            ok = file:write_file(TempPath, OutData),
  +            TempPath
       end.
  -
  -%%--------------------------------------------------------------------
  -%% @private
  -%% @doc
  -%% Creates a temporary file populated with given contents.
  -%% @end
  -%%--------------------------------------------------------------------
  --spec write_to_temp(Contents :: [binary()]) -> file:filename().
  -write_to_temp(Contents) ->
  -    TempPath = lib:nonl(os:cmd("mktemp")),
  -    {ok, TempFile} = file:open(TempPath, [write, binary]),
  -    lists:foreach(fun(Pem) -> ok = file:write(TempFile, Pem) end, Contents),
  -    ok = file:close(TempFile),
  -    TempPath.
   
   %%--------------------------------------------------------------------
   %% @private
  
positive.code:         true ->
              {ok, KeyFile} = application:get_env(?APP_NAME, web_key_file),
              CABundle = make_ca_bundle(),
              Opts = [{use_ssl, true}, {cert_path, make_cert_bundle()}, {key_path, KeyFile} |
                      [{ca_path, CABundle} || CABundle /= false]],
              application:set_env(rtransfer_link, ssl, Opts, [{persistent, true}]);
          false ->
  
negative.code: make_ca_bundle() ->
      CADir = oz_plugin:get_cacerts_dir(),
      {ok, CertPems} = file_utils:read_files({dir, CADir}),
      write_certs_to_temp(CertPems).
  
  %%--------------------------------------------------------------------
  %% @private
  