src/share/classes/sun/security/validator/Validator.java

rev 13446 : 8207258: Distrust TLS server certificates anchored by Symantec Root CAs

@@ -1,7 +1,7 @@
 /*
- * Copyright (c) 2002, 2015, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2002, 2019, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
  * under the terms of the GNU General Public License version 2 only, as
  * published by the Free Software Foundation.  Oracle designates this

@@ -270,11 +270,12 @@
             // included in the PKIXParameters, so the extra checks would be
             // redundant.
             boolean checkUnresolvedCritExts =
                     (type == TYPE_PKIX) ? false : true;
             endEntityChecker.check(chain[0], parameter,
-                                   checkUnresolvedCritExts);
+                                   checkUnresolvedCritExts,
+                                   chain[chain.length-1]);
         }
 
         return chain;
     }