In load_external_cert(), if verification fails for a certificate in the trust chain, the error message contains the last subject name from a previous iteration of the trust chain, instead of the subject name of the current certificate. To report the correct subject, look it up using the current nickname. Part of: https://pagure.io/freeipa/issue/7761 Reviewed-By: Christian Heimes <cheimes@redhat.com>