Reject certificate chains where the adjacent certificates have the same subject.

1 files changed, 4 insertions, 3 deletions

diff --git a/src/certificate_chain.cc b/src/certificate_chain.cc
index 61414436..0d99d1c9 100644
--- a/src/certificate_chain.cc
+++ b/src/certificate_chain.cc
@@ -464,10 +464,11 @@ CertificateChain::chain_valid (List const & chain) const
 			return false;
 		}
 
-		/* I don't know why OpenSSL doesn't check this in verify_cert, but without this check
-		   the certificates_validation8 test fails.
+		/* I don't know why OpenSSL doesn't check this stuff
+		   in verify_cert, but without these checks the
+		   certificates_validation8 test fails.
 		*/
-		if (j->issuer() != i->subject()) {
+		if (j->issuer() != i->subject() || j->subject() == i->subject()) {
 			X509_STORE_free (store);
 			return false;
 		}