On Mon, 2014-09-08 at 23:26 -0700, Adam Williamson wrote:
This is a sequence (chain) of certificates. The sender's
certificate MUST come first in the list. Each following
certificate MUST directly certify the one preceding it.
We recently learned the hard way in GNOME that if you rely on this
behavior, some sites won't work because webmasters test their sites with
NSS, and NSS doesn't care which order certificates are sent in. (gnutls
can reorder certificates too, though.)