The Document Signer (DS) certificate is included in the SOd. The SOd is verified (including the certificate path) before it is returned, so the certificate chain must contain the Country Signing CA (CSCA) certificate. For more information, see SODProcessServlet in HTTP interface or ClientWS interface.