christoph: root + thawte + ca + ssl