Handle PKINIT DH replies with no certs
If a PKINIT Diffie-Hellman reply contains no certificates in the
SignedData object, that may be because the signer certificate was a
trust anchor as transmitted to the KDC. Heimdal's KDC, for instance,
filters client trust anchors out of the returned set of certificates.
Match against idctx->trustedCAs and idctx->intermediateCAs to handle
this case. This fix only works with OpenSSL 1.0 or later; when built
against OpenSSL 0.9.x, the client will still require a cert in the
Code changes suggested by firstname.lastname@example.org.
(cherry picked from commit db83abc7dcfe369bd4467c78eebb7028ba0c0e0d)
Author: Greg Hudson <email@example.com>
Committer: Tom Yu <firstname.lastname@example.org>
src/plugins/preauth/pkinit/pkinit_crypto_openssl.c | 9 ++++++++-
1 files changed, 8 insertions(+), 1 deletions(-)