- DecodedCert gains selfIssued for the issuer/subject name compare,
and the name-compare readers use it.
- ParseCertRelative() sets selfSigned for every self-issued
certificate whose own key verifies its signature: it reuses the
key that passed the issuer check, or calls the new
ConfirmSelfSignature(), which verifies in its own context with no
device.
- CheckChainCAExtKeyUsage() exempts a CA with selfSigned set, in
place of its own issuer key compare.
- IsSelfSignedCert() in tls13.c is renamed IsSelfIssuedCert().
- ProcessPeerCerts() reports X509_V_ERR_INVALID_CA when a chain CA
is refused with NOT_CA_ERROR.
- Comments that called the name compare self-signed now say
self-issued.
- Tests cover a key rollover CA without keyCertSign in a TLS chain
and as a trusted anchor in X509_verify_cert(), and the selfSigned
and selfIssued flags from wc_ParseCert().
Issue: F-12625
