Thanks for the feedback. I'm using a database of CA certificates that should contain the lowest common denominator of CA certs among different OS/browsers, and

Thanks for the feedback. I'm using a database of CA certificates that should contain the lowest common denominator of CA certs among different OS/browsers, and picking the shortest chain that leads to these roots. I may not have given sufficient thought to cases where the chain branches and you end up with multiple roots though. However, as far as I can tell b4c66180c520bad688470ef80bb22beba8391c22 is signed by a root that's in platforms as old as Android 2.2, so a further chain from it shouldn't be necessary unless you need to support even more ancient platforms (in which case you're probably going to run into other problems with SHA-2 support, SNI, etc.).