Error::UnsupportedCertVersion instead of BadDER on certificate v1

src/cert.rs

@@ -135,7 +135,7 @@ fn version3(input: &mut untrusted::Reader) -> Result<(), Error> {
     der::nested(
         input,
         der::Tag::ContextSpecificConstructed0,
-        Error::BadDER,
+        Error::UnsupportedCertVersion,
         |input| {
             let version = der::small_nonnegative_integer(input)?;
             if version != 2 {

src/trust_anchor.rs

@@ -57,7 +57,7 @@ impl<'a> TrustAnchor<'a> {
             possibly_invalid_certificate_serial_number,
         ) {
             Ok(cert) => Ok(Self::from(cert)),
-            Err(Error::BadDER) => parse_cert_v1(cert_der).or(Err(Error::BadDER)),
+            Err(Error::UnsupportedCertVersion) => parse_cert_v1(cert_der).or(Err(Error::BadDER)),
             Err(err) => Err(err),
         }
     }

tests/cert_v1_unsupported.rs

@@ -0,0 +1,13 @@
+use std::convert::TryFrom;
+
+// Check with `openssl x509 -text -noout -in cert_v1.der -inform DER`
+// to verify this is a correct 1 certificate.
+const CERT_V1_DER: &[u8] = include_bytes!("cert_v1.der");
+
+#[test]
+fn error() {
+    assert_eq!(
+        Some(webpki::Error::UnsupportedCertVersion),
+        webpki::EndEntityCert::try_from(CERT_V1_DER).err()
+    );
+}