diff --git a/lib/get-certificate.js b/lib/get-certificate.js
index 7885a90..b520ee9 100644
--- a/lib/get-certificate.js
+++ b/lib/get-certificate.js
@@ -298,53 +298,45 @@ module.exports.create = function (deps) {
         }
 
         log('Successfully verified cert at '+certUrl);
-        log('Requesting issuer certificate...');
-        request({
-          method: 'GET'
-        , url: links.up
-        , encoding: null
-        }, function(err, res, body) {
-          if (!err) {
-            try {
-              body = bodyToError(res, body);
-            } catch(e) {
-              err = e;
-            }
-          }
+        downloadIssuerCert(links);
+      });
+    }
 
-          if (err || res.statusCode!==200) {
-            return handleErr(err, 'Failed to fetch issuer certificate');
+    function downloadIssuerCert(links) {
+      log('Requesting issuer certificate...');
+      request({
+        method: 'GET'
+      , url: links.up
+      , encoding: null
+      }, function(err, res, body) {
+        if (!err) {
+          try {
+            body = bodyToError(res, body);
+          } catch(e) {
+            err = e;
           }
+        }
 
-          state.caCertPem=certBufferToPem(body);
-          log('Requesting issuer certificate: done');
-          done();
-        });
+        if (err || res.statusCode!==200) {
+          return handleErr(err, 'Failed to fetch issuer certificate');
+        }
+
+        state.chainPem=certBufferToPem(body);
+        log('Requesting issuer certificate: done');
+        done();
       });
     }
 
     function done() {
-      var certPem;
-      var privkeyPem;
+      var privkeyPem = RSA.exportPrivatePem(state.certKeypair);
 
-      try {
-        certPem = certBufferToPem(state.certificate);
-      } catch(e) {
-        console.error(e.stack);
-        //cb(new Error("Could not write output files. Please check permissions!"));
-        handleErr(e, 'Could not write output files. Please check permissions!');
-        return;
-      }
-
-      privkeyPem = RSA.exportPrivatePem(state.certKeypair);
       cb(null, {
-        cert: certPem
-      // TODO privkey isn't necessary
+        cert: certBufferToPem(state.certificate)
       , privkey: privkeyPem
-      , chain: state.caCertPem
-      // TODO nix key, ca
+      , chain: state.chainPem
+        // TODO nix backwards compat
       , key: privkeyPem
-      , ca: state.caCertPem
+      , ca: state.chainPem
       });
     }
 
@@ -412,8 +404,8 @@ module.exports.create = function (deps) {
 
   function certBufferToPem(cert) {
     cert=_toStandardBase64(cert.toString('base64'));
-    cert=cert.match(/.{1,64}/g).join('\n');
-    return '-----BEGIN CERTIFICATE-----\n'+cert+'\n-----END CERTIFICATE-----';
+    cert=cert.match(/.{1,64}/g).join('\r\n');
+    return '-----BEGIN CERTIFICATE-----\r\n'+cert+'\r\n-----END CERTIFICATE-----\r\n';
   }
 
   return getCert;