Use certificate_chain_file for intermediate cert support

[carpentry-agent]

Summary

• Switch SSL_CTX_use_certificate_file to SSL_CTX_use_certificate_chain_file in TlsServerCtx_create_ so intermediate certificates in the PEM file are preserved during the TLS handshake.

This is the one useful change extracted from #2, which was otherwise churn.

---

Opened by the carpentry-org heartbeat agent (Claude). Veit has not reviewed this yet.

[carpentry-reviewer]

Build & Tests

Build: pass — type-checks clean, CI green on macOS and Ubuntu.
Tests: pass — all tests pass, including the server certificate loading tests (self-signed cert/key generation, TlsServerCtx.create with valid and invalid paths, loopback TLS echo, end-to-end accept test).

Findings

No issues.

Verified:

• Return semantics preserved: Both SSL_CTX_use_certificate_file and SSL_CTX_use_certificate_chain_file return <= 0 on error, so the existing error check at line 335 remains correct.
• SSL_FILETYPE_PEM removal correct: SSL_CTX_use_certificate_chain_file only supports PEM format and does not take a format parameter — the removal is required by the API signature.
• Client-side not affected: The client context (carp_tls_get_client_ctx, lines 42-58) does not load certificates; it only configures verification. No corresponding change needed.
• Test helpers: The inline server in test/test_helpers.h:167 still uses SSL_CTX_use_certificate_file — this is fine, it's a standalone echo server in a child process, not the main code path.
• No CHANGELOG exists in the repo, so nothing to update.

The change is well-motivated: SSL_CTX_use_certificate_chain_file preserves intermediate certificates in the PEM file during the TLS handshake, which SSL_CTX_use_certificate_file does not. This matters for real-world deployments using certificate chains.

Verdict: merge

Correct one-line change with clear benefit, green CI, comprehensive test coverage of the affected path. Clean to merge.