Manuel Pégourié-Gonnard f4569b14c4 Fix bug checking pathlen on first intermediate ...

Remove check on the pathLenConstraint value when looking for a parent to the
EE cert, as the constraint is on the number of intermediate certs below the
parent, and that number is always 0 at that point, so the constraint is always
satisfied.

The check was actually off-by-one, which caused valid chains to be rejected
under the following conditions:
- the parent certificate is not a trusted root, and
- it has pathLenConstraint == 0 (max_pathlen == 1 in our representation)

fixes #280

2015-11-19 11:10:38 +01:00

91 KiB

Raw Blame History

View Raw