tree 55be5f39452e739ddf52cb1ece60156318ee404c
parent 4d9e7cb66b4f6c2d19622966dabc3dccb24ab569
author Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com> 1498030544 +0200
committer Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com> 1520251220 +0100

Clarify documentation for directly-trusted certs

The fact that self-signed end-entity certs can be explicitly trusted by
putting them in the CA list even if they don't have the CA bit was not
documented though it's intentional, and tested by "Certificate verification #73
(selfsigned trusted without CA bit)" in test_suite_x509parse.data

It is unclear to me whether the restriction that explicitly trusted end-entity
certs must be self-signed is a good one. However, it seems intentional as it is
tested in tests #42 and #43, so I'm not touching it for now.