gnutls fails to use Verisign CA cert without a Basic Constraint

[Simon Josefsson]

I reconsidered, and think we should push this patch into 2.6.x since it
helps users deal with RSA-MD5 chains.  The only recommendation we have
right now is to patch applications to provide an option to accept
RSA-MD5.  That is still insecure.  With your patch, users will have a
another transition strategy while they are moving end-entity
certificates from RSA-MD5 chains to a RSA-SHA1 chain: explicitly trust
the intermediary RSA-MD5 cert.  Users can make some additional steps to
mitigate the hazards with RSA-MD5 certs (like comparing it with several
year old intermediary RSA-MD5 certs before the RSA-MD5 vulnerability
were common knowledge).

I used your small patch and pushed the following:

http://git.savannah.gnu.org/gitweb/?p=gnutls.git;a=commitdiff;h=0ca6c0eeb67e3be4f6d79d775f23c3fccba97444

I'll be backporting this to the 2.6.x and 2.4.x branches and make some
pre-releases.

Thanks,
/Simon