···994994 (* we cannot use decode_pem_multiple since this fails on the first
995995 undecodable certificate - while we'd like to stay operational, and
996996 ignore some certificates *)
997997- let sep = "-----END CERTIFICATE-----" in
998998- let certs = Astring.String.cuts ~sep ~empty:false data in
999999- let cas =
997997+ let d = "-----" in
998998+ let new_cert = d ^ "BEGIN CERTIFICATE" ^ d
999999+ and end_of_cert = d ^ "END CERTIFICATE" ^ d in
10001000+ let len_new = String.length new_cert
10011001+ and len_end = String.length end_of_cert in
10021002+ let lines = String.split_on_char '\n' data in
10031003+ let _, cas =
10001004 List.fold_left
10011001- (fun acc data ->
10021002- let data = data ^ sep in
10031003- match X509.Certificate.decode_pem (Cstruct.of_string data) with
10041004- | Ok ca -> ca :: acc
10051005- | Error _ -> acc)
10061006- [] certs
10051005+ (fun (acc, cas) line ->
10061006+ match acc with
10071007+ | None
10081008+ when String.length line >= len_new
10091009+ && String.(equal (sub line 0 len_new) new_cert) ->
10101010+ (Some [ line ], cas)
10111011+ | None -> (None, cas)
10121012+ | Some lines
10131013+ when String.length line >= len_end
10141014+ && String.(equal (sub line 0 len_end) end_of_cert) -> (
10151015+ let data = String.concat "\n" (List.rev (line :: lines)) in
10161016+ match X509.Certificate.decode_pem (Cstruct.of_string data) with
10171017+ | Ok ca -> (None, ca :: cas)
10181018+ | Error (`Msg _) -> (None, cas))
10191019+ | Some lines -> (Some (line :: lines), cas))
10201020+ (None, []) lines
10071021 in
10081022 Ok (List.rev cas))
10091023