As best I can tell the client is allowed to send a certificate chain

in response to a certificate request.

1 files changed, 0 insertions, 5 deletions

diff --git a/src/tls/tls_server.cpp b/src/tls/tls_server.cpp
index c591a45c5..e3efe9c04 100644
--- a/src/tls/tls_server.cpp
+++ b/src/tls/tls_server.cpp
@@ -475,11 +475,6 @@ void Server::process_handshake_msg(Handshake_Type type,
       {
       state->client_certs = new Certificate(contents);
 
-      // Is this allowed by the protocol?
-      if(state->client_certs->count() > 1)
-         throw TLS_Exception(Alert::CERTIFICATE_UNKNOWN,
-                             "Client sent more than one certificate");
-
       state->set_expected_next(CLIENT_KEX);
       }
    else if(type == CLIENT_KEX)