anchor.diff:                end,
                 ChainCandidates).
   
  -path_candidate(#cert{der=Der, otp=Otp} = Cert, ChainCandidateCAs, CertDbHandle) ->
  +path_candidate(Cert, ChainCandidateCAs, CertDbHandle) ->
       {ok,  ExtractedCerts} = ssl_pkix_db:extract_trusted_certs({der_otp, ChainCandidateCAs}),
       %% certificate_chain/4 will make sure the chain is ordered
  -    case certificate_chain(Otp, Der, CertDbHandle, ExtractedCerts, [Cert], []) of
  +    case certificate_chain(Cert, CertDbHandle, ExtractedCerts, [Cert], []) of
           {ok, undefined, Chain} ->
               lists:reverse(Chain);
           {ok, Root, Chain} ->
  
positive.code: certificate_chain(DerCert, CertDbHandle, CertsDbRef, Candidates) when is_binary(DerCert) ->
      ErlCert = public_key:pkix_decode_cert(DerCert, otp),
      Cert = #cert{der=DerCert, otp=ErlCert},
      Res = certificate_chain(ErlCert, DerCert, CertDbHandle, CertsDbRef, [Cert], Candidates),
      to_der(certificate_chain, Res);
  certificate_chain(OtpCert, CertDbHandle, CertsDbRef, Candidates) ->
      DerCert = public_key:pkix_encode('OTPCertificate', OtpCert, otp),
      Cert = #cert{der=DerCert, otp=OtpCert},
      Res = certificate_chain(Cert, DerCert, CertDbHandle, CertsDbRef, [Cert], Candidates),
      to_der(certificate_chain, Res).
  %%--------------------------------------------------------------------
  -spec file_to_certificats(binary(), term()) -> [der_cert()].
  
negative.code:     %% in the cert chain so ignore
      Default.
  
  handle_incomplete_chain([#cert{}=Peer| _] = Chain0, PartialChainHandler, Default, CertDbHandle, CertDbRef) ->
      %% We received an incomplete chain, that is not all certs expected to be present are present.
      %% See if we have the certificates to rebuild it.
      case certificate_chain(Peer, CertDbHandle, CertDbRef, [Peer], []) of
          {ok, _, [Peer | _] = Chain} when Chain =/= Chain0 -> %% Chain candidate found
              case lists:prefix(Chain0, Chain) of
                  true ->
  