diff --git a/‎cmd/allocator/main.go‎
Lines changed: 7 additions & 2 deletions b/‎cmd/allocator/main.go‎
Lines changed: 7 additions & 2 deletions
@@ -412,8 +412,13 @@ func (h *serviceHandler) verifyClientCertificate(rawCerts [][]byte, verifiedChai
 		KeyUsages:     []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
 	}
 
-	for _, cert := range rawCerts[1:] {
-		opts.Intermediates.AppendCertsFromPEM(cert)
+	for _, rawCert := range rawCerts[1:] {
+		cert, err := x509.ParseCertificate(rawCert)
+		if err != nil {
+			logger.WithError(err).Warning("cannot parse intermediate certificate")
+			return errors.New("bad intermediate certificate: " + err.Error())
+		}
+		opts.Intermediates.AddCert(cert)
 	}
 
 	c, err := x509.ParseCertificate(rawCerts[0])
Original file line number	Diff line number	Diff line change
`@@ -412,8 +412,13 @@ func (h *serviceHandler) verifyClientCertificate(rawCerts [][]byte, verifiedChai`
`412`	`412`	`KeyUsages: []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},`
`413`	`413`	`}`
`414`	`414`
`415`		`- for _, cert := range rawCerts[1:] {`
`416`		`- opts.Intermediates.AppendCertsFromPEM(cert)`
	`415`	`+ for _, rawCert := range rawCerts[1:] {`
	`416`	`+ cert, err := x509.ParseCertificate(rawCert)`
	`417`	`+ if err != nil {`
	`418`	`+ logger.WithError(err).Warning("cannot parse intermediate certificate")`
	`419`	`+ return errors.New("bad intermediate certificate: " + err.Error())`
	`420`	`+ }`
	`421`	`+ opts.Intermediates.AddCert(cert)`
`417`	`422`	`}`
`418`	`423`
`419`	`424`	`c, err := x509.ParseCertificate(rawCerts[0])`