> Let me be very clear about this. With respect to https (SSL/TLS) servers'
certificates this is NOT A BUG. RFC 2246 requires SSL/TLS servers to send
a complete cert chain. SSL/TLS servers that do not send a complete cert
chain are not in conformance with RFC 2246. Nothing in RFC 3280 relieves
an https server of its obligation to send a complete cert chain. This
complaint is not an exploitable security flaw, and hence does not qualify
for a bug bounty.