1 files changed, 36 insertions, 14 deletions
diff --git a/src/pkg/crypto/tls/ca_set.go b/src/pkg/crypto/tls/ca_set.go
index 7f7566e46..ae00ac558 100644
--- a/src/pkg/crypto/tls/ca_set.go
+++ b/src/pkg/crypto/tls/ca_set.go
@@ -7,32 +7,57 @@ package tls
 import (
 	"crypto/x509"
 	"encoding/pem"
+	"strings"
 )
 
 // A CASet is a set of certificates.
 type CASet struct {
-	bySubjectKeyId map[string]*x509.Certificate
-	byName         map[string]*x509.Certificate
+	bySubjectKeyId map[string][]*x509.Certificate
+	byName         map[string][]*x509.Certificate
 }
 
+// NewCASet returns a new, empty CASet.
 func NewCASet() *CASet {
 	return &CASet{
-		make(map[string]*x509.Certificate),
-		make(map[string]*x509.Certificate),
+		make(map[string][]*x509.Certificate),
+		make(map[string][]*x509.Certificate),
 	}
 }
 
 func nameToKey(name *x509.Name) string {
-	return name.Country + "/" + name.Organization + "/" + name.OrganizationalUnit + "/" + name.CommonName
+	return strings.Join(name.Country, ",") + "/" + strings.Join(name.Organization, ",") + "/" + strings.Join(name.OrganizationalUnit, ",") + "/" + name.CommonName
 }
 
-// FindParent attempts to find the certificate in s which signs the given
-// certificate. If no such certificate can be found, it returns nil.
-func (s *CASet) FindParent(cert *x509.Certificate) (parent *x509.Certificate) {
+// FindVerifiedParent attempts to find the certificate in s which has signed
+// the given certificate. If no such certificate can be found or the signature
+// doesn't match, it returns nil.
+func (s *CASet) FindVerifiedParent(cert *x509.Certificate) (parent *x509.Certificate) {
+	var candidates []*x509.Certificate
+
 	if len(cert.AuthorityKeyId) > 0 {
-		return s.bySubjectKeyId[string(cert.AuthorityKeyId)]
+		candidates = s.bySubjectKeyId[string(cert.AuthorityKeyId)]
+	}
+	if len(candidates) == 0 {
+		candidates = s.byName[nameToKey(&cert.Issuer)]
+	}
+
+	for _, c := range candidates {
+		if cert.CheckSignatureFrom(c) == nil {
+			return c
+		}
 	}
-	return s.byName[nameToKey(&cert.Issuer)]
+
+	return nil
+}
+
+// AddCert adds a certificate to the set
+func (s *CASet) AddCert(cert *x509.Certificate) {
+	if len(cert.SubjectKeyId) > 0 {
+		keyId := string(cert.SubjectKeyId)
+		s.bySubjectKeyId[keyId] = append(s.bySubjectKeyId[keyId], cert)
+	}
+	name := nameToKey(&cert.Subject)
+	s.byName[name] = append(s.byName[name], cert)
 }
 
 // SetFromPEM attempts to parse a series of PEM encoded root certificates. It
@@ -56,10 +81,7 @@ func (s *CASet) SetFromPEM(pemCerts []byte) (ok bool) {
 			continue
 		}
 
-		if len(cert.SubjectKeyId) > 0 {
-			s.bySubjectKeyId[string(cert.SubjectKeyId)] = cert
-		}
-		s.byName[nameToKey(&cert.Subject)] = cert
+		s.AddCert(cert)
 		ok = true
 	}