diff --git a/crypto/src/pkix/PkixAttrCertPathBuilder.cs b/crypto/src/pkix/PkixAttrCertPathBuilder.cs
index 646cc5db5..3d5fa18e3 100644
--- a/crypto/src/pkix/PkixAttrCertPathBuilder.cs
+++ b/crypto/src/pkix/PkixAttrCertPathBuilder.cs
@@ -143,7 +143,7 @@ namespace Org.BouncyCastle.Pkix
try
{
// check whether the issuer of <tbvCert> is a TrustAnchor
- if (PkixCertPathValidatorUtilities.FindTrustAnchor(tbvCert, pkixParams.GetTrustAnchors()) != null)
+ if (PkixCertPathValidatorUtilities.IsIssuerTrustAnchor(tbvCert, pkixParams.GetTrustAnchors()))
{
PkixCertPath certPath = new PkixCertPath(tbvPath);
PkixCertPathValidatorResult result;
diff --git a/crypto/src/pkix/PkixCertPathBuilder.cs b/crypto/src/pkix/PkixCertPathBuilder.cs
index fa38a5ec0..37a1c8c9c 100644
--- a/crypto/src/pkix/PkixCertPathBuilder.cs
+++ b/crypto/src/pkix/PkixCertPathBuilder.cs
@@ -118,7 +118,7 @@ namespace Org.BouncyCastle.Pkix
try
{
// check whether the issuer of <tbvCert> is a TrustAnchor
- if (PkixCertPathValidatorUtilities.FindTrustAnchor(tbvCert, pkixParams.GetTrustAnchors()) != null)
+ if (PkixCertPathValidatorUtilities.IsIssuerTrustAnchor(tbvCert, pkixParams.GetTrustAnchors()))
{
// exception message from possibly later tried certification
// chains
diff --git a/crypto/src/pkix/PkixCertPathValidator.cs b/crypto/src/pkix/PkixCertPathValidator.cs
index 1d7c00d7d..64039f9f1 100644
--- a/crypto/src/pkix/PkixCertPathValidator.cs
+++ b/crypto/src/pkix/PkixCertPathValidator.cs
@@ -289,6 +289,10 @@ namespace Org.BouncyCastle.Pkix
{
if (cert != null && cert.Version == 1)
{
+ // we've found the trust anchor at the top of the path, ignore and keep going
+ if ((i == 1) && cert.Equals(trust.TrustedCert))
+ continue;
+
throw new PkixCertPathValidatorException(
"Version 1 certificates can't be used as CA ones.", null, certPath, index);
}
diff --git a/crypto/src/pkix/PkixCertPathValidatorUtilities.cs b/crypto/src/pkix/PkixCertPathValidatorUtilities.cs
index a2704a746..2ccaa32ce 100644
--- a/crypto/src/pkix/PkixCertPathValidatorUtilities.cs
+++ b/crypto/src/pkix/PkixCertPathValidatorUtilities.cs
@@ -143,6 +143,20 @@ namespace Org.BouncyCastle.Pkix
return trust;
}
+ internal static bool IsIssuerTrustAnchor(
+ X509Certificate cert,
+ ISet trustAnchors)
+ {
+ try
+ {
+ return FindTrustAnchor(cert, trustAnchors) != null;
+ }
+ catch (Exception e)
+ {
+ return false;
+ }
+ }
+
internal static void AddAdditionalStoresFromAltNames(
X509Certificate cert,
PkixParameters pkixParams)
|
