removed a now redundant chain check

diff --git a/lib/x509/verify-high.c b/lib/x509/verify-high.c
index a4f883f3e768c43a9fb8e7743fb732900bd1d862..d8addbaeb322c76d94c5e4140089a58039d2fc3d 100644 (file)
--- a/lib/x509/verify-high.c
+++ b/lib/x509/verify-high.c
@@ -355,18 +355,6 @@ static int shorten_clist(gnutls_x509_trust_list_t list,
     uint32_t hash;
     gnutls_datum_t dn;
 
-    /* Start by truncating any disjoint list of certificates. For
-     * example, if the server presented a chain A->B->C->X->Y->Z
-     * where X is *not* actually the issuer of C, truncate at C.
-     */
-    for(i=1;i<clist_size;i++) {
-        if (!gnutls_x509_crt_check_issuer(certificate_list[i-1],
-                                          certificate_list[i])) {
-            gnutls_assert();
-            clist_size = i;
-        }
-    }
-
     if (clist_size > 1) {
         /* Check if the last certificate in the path is self signed.
          * In that case ignore it (a certificate is trusted only if it
@@ -440,10 +428,9 @@ static gnutls_x509_crt_t* sort_clist(gnutls_x509_crt_t sorted[MAX_CERTS_TO_SORT]
   for (i=0;i<MAX_CERTS_TO_SORT;i++)
     issuer[i] = -1;
 
-    /* Start by truncating any disjoint list of certificates. For
-     * example, if the server presented a chain A->B->C->X->Y->Z
-     * where X is *not* actually the issuer of C, truncate at C.
-     */
+  /* Find the issuer of each certificate and store it
+   * in issuer array.
+   */
   for(i=0;i<*clist_size;i++) 
     {
       for (j=1;j<*clist_size;j++)