fallback to random end entity certificate if trustchain building fails

diff --git a/src/charon/credentials/credential_manager.c b/src/charon/credentials/credential_manager.c
index 47c437670ce99ebf802ec9b7e492b9b1c9c71a68..a7e3d43b65aa793fa7363ad4ef8afcd41ddf8433 100644 (file)
--- a/src/charon/credentials/credential_manager.c
+++ b/src/charon/credentials/credential_manager.c
@@ -1106,7 +1106,6 @@ static auth_info_t *build_trustchain(private_credential_manager_t *this,
                trustchain->add_item(trustchain, AUTHZ_SUBJECT_CERT, subject);
                return trustchain;
        }
-       
        current = subject->get_ref(subject);
        while (TRUE)
        {
@@ -1188,10 +1187,10 @@ static private_key_t *get_private(private_credential_manager_t *this,
        }
        
        this->mutex->lock(this->mutex);
-       /* get all available end entity certificates for ourself */
+       /* try to build a trustchain for each certificate found */
        enumerator = create_cert_enumerator(this, CERT_ANY, type, id, FALSE);
        while (enumerator->enumerate(enumerator, &cert))
-       {       
+       {
                private = get_private_by_cert(this, cert, type);
                if (private)
                {
@@ -1203,9 +1202,25 @@ static private_key_t *get_private(private_credential_manager_t *this,
                                break;
                        }
                        private->destroy(private);
+                       private = NULL;
                }
        }
        enumerator->destroy(enumerator);
+       /* if no valid trustchain was found, fall back to the first usable cert */
+       if (!private)
+       {
+               enumerator = create_cert_enumerator(this, CERT_ANY, type, id, FALSE);
+               while (enumerator->enumerate(enumerator, &cert))
+               {
+                       private = get_private_by_cert(this, cert, type);
+                       if (private)
+                       {
+                               auth->add_item(auth, AUTHZ_SUBJECT_CERT, cert);
+                               break;
+                       }
+               }
+               enumerator->destroy(enumerator);
+       }
        this->mutex->unlock(this->mutex);
        return private;
 }