tree 8839b658d38b85e2a30f720923e92d4a097234d0
parent 8b4331aa5612c05405192be4cacd084132010292
author Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com> 1447921386 +0100
committer Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com> 1447927838 +0100

Fix bug checking pathlen on first intermediate

Remove check on the pathLenConstraint value when looking for a parent to the
EE cert, as the constraint is on the number of intermediate certs below the
parent, and that number is always 0 at that point, so the constraint is always
satisfied.

The check was actually off-by-one, which caused valid chains to be rejected
under the following conditions:
- the parent certificate is not a trusted root, and
- it has pathLenConstraint == 0 (max_pathlen == 1 in our representation)

fixes #280