Fix bug checking pathlen on first intermediate
Remove check on the pathLenConstraint value when looking for a parent to the
EE cert, as the constraint is on the number of intermediate certs below the
parent, and that number is always 0 at that point, so the constraint is always
satisfied.
The check was actually off-by-one, which caused valid chains to be rejected
under the following conditions:
- the parent certificate is not a trusted root, and
- it has pathLenConstraint == 0 (max_pathlen == 1 in our representation)
fixes #280
diff --git a/ChangeLog b/ChangeLog
index 8a736f9..6d8a5bc 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,12 @@
mbed TLS ChangeLog (Sorted per branch, date)
+= mbed TLS 2.x branch
+
+Bugfix
+ * Fix bug in certificate validation that caused valid chains to be rejected
+ when the first intermediate certificate has pathLenConstraint=0. Found by
+ Nicholas Wilson. Introduced in mbed TLS 2.2.0. #280
+
= mbed TLS 2.2.0 released 2015-11-04
Security
