Hello Rob,
I just checked and all certs are being loaded into the temporary nssdb.
nssdb.list_certs() outputs:
==================================================================================================
(('CN=Certificate Authority,O=TESTCA.ETUX', TrustFlags(has_key=False,
trusted=None, ca=None, usages=frozenset([]))), ('CN=pedroperdido.com',
TrustFlags(has_key=False, trusted=None, ca=None, usages=frozenset([]))))
==================================================================================================
but trust_chain = list(reversed(nssdb.get_trust_chain(ca_nickname))) a few lines down only
contains:
=======================================
['CN=Certificate Authority,O=TESTCA.ETUX']
=======================================