Return per-certificate chain if extra chain is NULL.