Reject certificate chains where the adjacent certificates have the same subject.

This is a backport of 31f31800705880da6ec185f9b31c7e125ae18c38 from master.

diff --git a/src/certificate_chain.cc b/src/certificate_chain.cc
index 614144366b1864bb79b4d744a9ded8b191730746..0d99d1c920a28083c4bcf748fe3d3dbe822928a6 100644 (file)
--- a/src/certificate_chain.cc
+++ b/src/certificate_chain.cc
@@ -464,10 +464,11 @@ CertificateChain::chain_valid (List const & chain) const
                        return false;
                }
 
-               /* I don't know why OpenSSL doesn't check this in verify_cert, but without this check
-                  the certificates_validation8 test fails.
+               /* I don't know why OpenSSL doesn't check this stuff
+                  in verify_cert, but without these checks the
+                  certificates_validation8 test fails.
                */
-               if (j->issuer() != i->subject()) {
+               if (j->issuer() != i->subject() || j->subject() == i->subject()) {
                        X509_STORE_free (store);
                        return false;
                }