Should not assume TLS certificate chain is provided in order

[andersk]

The TLS 1.2 specification required the certificate chain to be in order:

The sender's certificate MUST come first in the list. Each following certificate MUST directly certify the one preceding it.

However, in practice, servers are commonly misconfigured to violate this requirement, and so TLS 1.3 relaxed it from MUST to SHOULD:

The sender's certificate MUST come in the first CertificateEntry in the list. Each following certificate SHOULD directly certify the one immediately preceding it.

For compatibility, Forge should not assume the chain is provided in order. It currently assumes this here:

forge/lib/x509.js

Lines 3033 to 3039 in 2bb97af

	// verify each cert in the chain using its parent, where the parent
	// is either the next in the chain or from the CA store
	var first = true;
	var error = null;
	var depth = 0;
	do {
	var cert = chain.shift();

forge/lib/x509.js

Lines 3059 to 3061 in 2bb97af

	// 2. verify with parent from chain or CA store
	if(error === null) {
	parent = chain[0] || caStore.getIssuer(cert);