From bb4ba3ecdce175d32b2ffc080a46de07f2e6d2e7 Mon Sep 17 00:00:00 2001
From: afldl <18260596452@163.com>
Date: Wed, 10 Jun 2026 11:39:00 +0800
Subject: [PATCH] fix: enforce pathlen constraint in X509 API verify path

---
 src/ssl_certman.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/ssl_certman.c b/src/ssl_certman.c
index d10e79d56f3..a9c9cb22fca 100644
--- a/src/ssl_certman.c
+++ b/src/ssl_certman.c
@@ -819,7 +819,7 @@ int CM_VerifyBuffer_ex(WOLFSSL_CERT_MANAGER* cm, const unsigned char* buff,
 
         /* Parse DER into decoded certificate fields and verify signature
          * against a known CA. */
-        ret = ParseCertRelative(cert, CERT_TYPE, VERIFY, cm, NULL);
+        ret = ParseCertRelative(cert, CHAIN_CERT_TYPE, VERIFY, cm, NULL);
      }
 
 #ifdef HAVE_CRL