Earlier today, the https-using gnome.org sites were misconfigured to send a certificate chain consisting of their own certificate twice, followed by the CA cert. Firefox handled this fine, but GTlsConnection did not, because it expected the certs to form an actual chain.

As long as there is *some* valid chain from the first cert to a known CA, it doesn't matter (for security purposes) if there are additional certs presented as well, and since Firefox apparently ignores the extra certs in this case, we should too.