Apply a small patch from Diego R. Lopez <diego.lopez@rediris.es>,

making X509_check_issued() properly match an issuer that's found in a
Authority Key Identifier.

diff --git a/crypto/x509v3/v3_purp.c b/crypto/x509v3/v3_purp.c
index b739e4fd837cf41093298c1116bfbf7e2afdd87b..30687119a30dc613fbffee4976fb652dac5837cc 100644 (file)
--- a/crypto/x509v3/v3_purp.c
+++ b/crypto/x509v3/v3_purp.c
@@ -615,7 +615,7 @@ int X509_check_issued(X509 *issuer, X509 *subject)
                                        break;
                                }
                        }
                                        break;
                                }
                        }

-                       if(nm && X509_NAME_cmp(nm, X509_get_issuer_name(issuer)))
+                       if(nm && X509_NAME_cmp(nm, X509_get_subject_name(issuer)))

                                return X509_V_ERR_AKID_ISSUER_SERIAL_MISMATCH;
                }
        }
                                return X509_V_ERR_AKID_ISSUER_SERIAL_MISMATCH;
                }
        }