x509: Properly wrap keyid in authorityKeyIdentifier in attribute certificates

The correct encoding got lost in bdec2e4f5291 ("refactored openac and
its attribute certificate factory").

Fixes #1370.

diff --git a/src/libstrongswan/plugins/x509/x509_ac.c b/src/libstrongswan/plugins/x509/x509_ac.c
index bfc200421c45781df73e238f98e6b10e169efa5b..aea8eb53db4b9e86e2d7ddd24a415209c9ac2a94 100644 (file)
--- a/src/libstrongswan/plugins/x509/x509_ac.c
+++ b/src/libstrongswan/plugins/x509/x509_ac.c
@@ -706,6 +706,7 @@ static chunk_t build_authorityKeyIdentifier(private_x509_ac_t *this)
                if (public->get_fingerprint(public, KEYID_PUBKEY_SHA1, &keyIdentifier))
                {
                        this->authKeyIdentifier = chunk_clone(keyIdentifier);
+                       keyIdentifier = asn1_simple_object(ASN1_CONTEXT_S_0, keyIdentifier);
                }
                public->destroy(public);
        }
@@ -716,7 +717,7 @@ static chunk_t build_authorityKeyIdentifier(private_x509_ac_t *this)
        return asn1_wrap(ASN1_SEQUENCE, "mm",
                                asn1_build_known_oid(OID_AUTHORITY_KEY_ID),
                                asn1_wrap(ASN1_OCTET_STRING, "m",
-                                       asn1_wrap(ASN1_SEQUENCE, "cmm",
+                                       asn1_wrap(ASN1_SEQUENCE, "mmm",
                                                keyIdentifier,
                                                authorityCertIssuer,
                                                authorityCertSerialNumber