certificate_complete_chain: handle duplicate intermediate subjects

[felixfontein]

SUMMARY

Fixes #399.

ISSUE TYPE

• Bugfix Pull Request

COMPONENT NAME

certificate_complete_chain

[Ajpantuso]

LGTM, but just wondering if there's a better key value that would trivialize this such as using the cert fingerprint instead of the subject?

[felixfontein]

I guess one could also include a public key fingerprint into the key, but that's not always available in the intermediate / leaf certificate.

The module doesn't do proper chain building (which would be required for validating a certificate) anyway, and will not properly handle cases such as multiple paths; it only does an approximation which allows to pick up the correct parts of a chain in the common case. (My personal case is: given a full chain, pick the root from the system's root store.)

[Ajpantuso]

I guess one could also include a public key fingerprint into the key, but that's not always available in the intermediate / leaf certificate.

I was suggesting a fingerprint of the cert, but that's effectively the same thing as using the cert object as the key (at least with the current rust backend). But again, this should work fine as is.

[patchback]

Backport to stable-1: 💚 backport PR created

✅ Backport PR branch: patchback/backports/stable-1/11a14543c8be4d5efb5cabad23a9222aa6ee4d0d/pr-403

Backported as #405

🤖 @patchback
I'm built with octomachinery and
my source is open — https:/sanitizers/patchback-github-app.

[felixfontein]

@Ajpantuso thanks for reviewing this!
@shk3bq4d thanks testing this!