x509_verify_chain_last
X509 *last = x509_verify_chain_last(chain);
issuer_candidate = x509_verify_chain_last(current_chain);