anchor.diff:  paths([Cert1, Cert2 | Rest], Chain, CertDbHandle, CertDbRef, Path) ->
       case public_key:pkix_is_issuer(Cert1, Cert2) of
           true ->
  +            %% Chain orded so far
               paths([Cert2 | Rest], Chain, CertDbHandle, CertDbRef, [Cert1 | Path]);
           false ->
  +            %% Chain is unorded and/or contains extraneous certificates
               unorded_or_extraneous(Chain, CertDbHandle, CertDbRef)
       end.
           
   unorded_or_extraneous([Peer | FalseChain], CertDbHandle, CertDbRef) ->
  -   case extraneous_certs(FalseChain) of
  -       [_] ->
  -           [path_candidate(Peer, FalseChain, CertDbHandle, CertDbRef)];
  -       ChainCandidates ->
  -           lists:map(fun(Candidate) -> 
  -                             path_candidate(Peer, Candidate, CertDbHandle, CertDbRef)
  -                     end, 
  -                     ChainCandidates)
  -   end.
  -
  -path_candidate(Peer, CAs, CertDbHandle, _CertDbRef) ->
  -    {ok,  ExtractedCerts} = ssl_pkix_db:extract_trusted_certs({der, CAs}),
  +    ChainCandidates = extraneous_chains(FalseChain),
  +    lists:map(fun(Candidate) -> 
  +                      path_candidate(Peer, Candidate, CertDbHandle, CertDbRef)
  +              end, 
  +              ChainCandidates).
  +
  +path_candidate(Peer, ChainCandidateCAs, CertDbHandle, _CertDbRef) ->
  +    {ok,  ExtractedCerts} = ssl_pkix_db:extract_trusted_certs({der, ChainCandidateCAs}),
  +    %% certificate_chain/4 will make sure the chain is ordered 
       case certificate_chain(Peer, CertDbHandle, ExtractedCerts, []) of        
           {ok, undefined, Chain} ->
               lists:reverse(Chain);
  
positive.code: 
  %%--------------------------------------------------------------------
  -spec trusted_cert_and_paths([der_cert()], db_handle(), certdb_ref(), fun()) ->
  				   [{der_cert() | unknown_ca | selfsigned_peer, [der_cert()]}].
  %%
  %% Description: Extracts the root cert (if not presents tries to 
  %% look it up, if not found {bad_cert, unknown_ca} will be added verification
  %% errors. Returns {RootCert | RootCertRelatedError, Path} Path = lists:reverse(Chain) -- Root
  %%--------------------------------------------------------------------
  trusted_cert_and_paths([Peer] = Chain,  CertDbHandle, CertDbRef, PartialChainHandler) ->
      OtpCert = public_key:pkix_decode_cert(Peer, otp),
  
negative.code:                                      CertDbHandle, CertDbRef)]
      end;
  trusted_cert_and_paths(Chain,  CertDbHandle, CertDbRef, PartialChainHandler) ->
      %% Construct possible certificate paths from the chain certificates.
      %% If the chain contains extraneous certificates there could be
      %% more than one possible path such chains might be used to phase out 
      %% an old certificate. 
      Paths = paths(Chain, CertDbHandle, CertDbRef),
      lists:map(fun(Path) ->
                        case handle_partial_chain(Path, PartialChainHandler, CertDbHandle, CertDbRef) of
  