rawlinp commented on issue #3181: TO API - DeliveryServices AddSSLKeys Incorrectly stores X509 certificate missing Subject/Authority Key as zero length string. URL: https://github.com/apache/trafficcontrol/issues/3181#issuecomment-451305169 I'd think if there were self-signed elements in the chain, it wouldn't pass the previous check which calls https://golang.org/pkg/crypto/x509/#Certificate.Verify and causes TO to accept a self-signed cert with a warning. So maybe the ```if link.AuthorityKeyId != nil && !bytes.Equal(link.AuthorityKeyId, link.SubjectKeyId) {``` line is unnecessary, and it should just append all the links to `pemEncodedChain` regardless of the SKI and AKI? I'd think the `Verify` method would check if SKI and AKI don't properly match up through the chain.
---------------------------------------------------------------- This is an automated message from the Apache Git Service. To respond to the message, please log on GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: [email protected] With regards, Apache Git Services
