The script will try to pick out the end-user cert and pass that to

The script will try to pick out the end-user cert and pass that to
openssl. The code which tells the difference may not be perfect. It
works with all the certs in my collection, though. I won't be at all
surprised if someone comes across a cert chain which confuses it,
but it should print out an error in that case. Hopefully they will
send us the chain so we can adjust our code.

(From Mike Schiraldi.)