From 2988bc9df3a5efc9539471cb7455975fa25df483 Mon Sep 17 00:00:00 2001 From: "Sergio R. Caprile" Date: Tue, 4 Aug 2026 11:59:22 -0300 Subject: [PATCH] verify chain in bundle --- mongoose.c | 6 +++++- src/tls_builtin.c | 6 +++++- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/mongoose.c b/mongoose.c index 76d1e4fa..d047c8d2 100644 --- a/mongoose.c +++ b/mongoose.c @@ -18237,7 +18237,11 @@ static int mg_tls_recv_cert(struct mg_connection *c, bool is_client) { mg_error(c, r < 0 ? "failed to parse CA bundle" : "failed to find issuing CA in bundle"); return -1; - } // else r > 0 => issuer found + } else if (!ca.is_ca || // candidate issuer found + !mg_tls_verify_cert_signature(&certs[certnum - 1], &ca)) { + mg_error(c, "failed to verify CA"); + return -1; + } // issuer verified. NOTE(): may fail if two diff CAs share a CN MG_VERBOSE(("CA serial: %M", mg_print_hex, ca.sn.len, ca.sn.buf)); } if (!found_ca && tls->ca_der.len > 0) { // single cert or server diff --git a/src/tls_builtin.c b/src/tls_builtin.c index 269098e2..6bed1cf7 100644 --- a/src/tls_builtin.c +++ b/src/tls_builtin.c @@ -1892,7 +1892,11 @@ static int mg_tls_recv_cert(struct mg_connection *c, bool is_client) { mg_error(c, r < 0 ? "failed to parse CA bundle" : "failed to find issuing CA in bundle"); return -1; - } // else r > 0 => issuer found + } else if (!ca.is_ca || // candidate issuer found + !mg_tls_verify_cert_signature(&certs[certnum - 1], &ca)) { + mg_error(c, "failed to verify CA"); + return -1; + } // issuer verified. NOTE(): may fail if two diff CAs share a CN MG_VERBOSE(("CA serial: %M", mg_print_hex, ca.sn.len, ca.sn.buf)); } if (!found_ca && tls->ca_der.len > 0) { // single cert or server