CertificateSet used in create_degenerate_pkcs7 causes the certificates order to change.
Accoridng to RFC: https://tools.ietf.org/html/rfc8894#section-3.3.2.1:
The reply must contain the issued certificate. It may also contain additional certificates, but the issued certificate MUST be the leaf certificate.
This causes the request to fail at times.