tree 1a1ed7bc2440759be586729427c22657826468d6
parent ddc6e52cc1f3720a08d2d58d4f6ad61a18c24eb7
author Hanno Becker <hanno.becker@arm.com> 1494257474 +0100
committer Hanno Becker <hanno.becker@arm.com> 1496830399 +0100

Fix implementation of VERIFY_OPTIONAL verification mode

This commit changes the behaviour of mbedtls_ssl_parse_certificate
to make the two authentication modes MBEDTLS_SSL_VERIFY_REQUIRED and
MBEDTLS_SSL_VERIFY_OPTIONAL be in the following relationship:

    Mode == MBEDTLS_SSL_VERIFY_REQUIRED
<=> Mode == MBEDTLS_SSL_VERIFY_OPTIONAL + check verify result

Also, it changes the behaviour to perform the certificate chain
verification even if the trusted CA chain is empty. Previously, the
function failed in this case, even when using optional verification,
which was brought up in #864.