From 799000be2069dee4550ff145f97af72ddf68eb66 Mon Sep 17 00:00:00 2001 From: Jeff Mitchell Date: Wed, 15 Mar 2017 11:52:02 -0400 Subject: [PATCH] Set CA chain when intermediate does not have an authority key ID. This is essentially an approved review of the code provided in #2465. Fixes #2465 --- builtin/logical/pki/cert_util.go | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/builtin/logical/pki/cert_util.go b/builtin/logical/pki/cert_util.go index 212cc57555..6992e04872 100644 --- a/builtin/logical/pki/cert_util.go +++ b/builtin/logical/pki/cert_util.go @@ -66,8 +66,10 @@ func (b *caInfoBundle) GetCAChain() []*certutil.CertBlock { chain := []*certutil.CertBlock{} // Include issuing CA in Chain, not including Root Authority - if len(b.Certificate.AuthorityKeyId) > 0 && - !bytes.Equal(b.Certificate.AuthorityKeyId, b.Certificate.SubjectKeyId) { + if (len(b.Certificate.AuthorityKeyId) > 0 && + !bytes.Equal(b.Certificate.AuthorityKeyId, b.Certificate.SubjectKeyId)) || + (len(b.Certificate.AuthorityKeyId) == 0 && + !bytes.Equal(b.Certificate.RawIssuer, b.Certificate.RawSubject)) { chain = append(chain, &certutil.CertBlock{ Certificate: b.Certificate,