Better error when loading a non-certificate as a certificate; the chain is OK but...