Fix name constraint application

A name constraint on an intermediate certificate should not constraint
the intermediate itself, but only the subordinate certificates.

Fixes GH #2737

1 files changed, 1 insertions, 6 deletions

diff --git a/src/lib/x509/x509_ext.cpp b/src/lib/x509/x509_ext.cpp
index a782d6a67..e81e15c18 100644
--- a/src/lib/x509/x509_ext.cpp
+++ b/src/lib/x509/x509_ext.cpp
@@ -665,14 +665,9 @@ void Name_Constraints::validate(const X509_Certificate& subject, const X509_Cert
       const bool issuer_name_constraint_critical =
          issuer.is_critical("X509v3.NameConstraints");
 
-      const bool at_self_signed_root = (pos == cert_path.size() - 1);
-
       // Check that all subordinate certs pass the name constraint
-      for(size_t j = 0; j <= pos; ++j)
+      for(size_t j = 0; j < pos; ++j)
          {
-         if(pos == j && at_self_signed_root)
-            continue;
-
          bool permitted = m_name_constraints.permitted().empty();
          bool failed = false;