From d1fb007090813ce348a2d439f12fa347a8d5010c Mon Sep 17 00:00:00 2001
From: David Hook <dgh@cryptoworkshop.com>
Date: Wed, 12 Jan 2022 15:02:59 +1100
Subject: [PATCH] added back support for subject key identifier check where
 serial number is not provided.

---
 .../java/org/bouncycastle/x509/PKIXCertPathReviewer.java  | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/prov/src/main/java/org/bouncycastle/x509/PKIXCertPathReviewer.java b/prov/src/main/java/org/bouncycastle/x509/PKIXCertPathReviewer.java
index 58a07d6c7..a78e97735 100644
--- a/prov/src/main/java/org/bouncycastle/x509/PKIXCertPathReviewer.java
+++ b/prov/src/main/java/org/bouncycastle/x509/PKIXCertPathReviewer.java
@@ -2492,6 +2492,14 @@ protected Collection getTrustAnchors(X509Certificate cert, Set trustanchors) thr
                 {
                     certSelectX509.setSerialNumber(authID.getAuthorityCertSerialNumber());
                 }
+                else
+                {
+                    byte[] keyID = authID.getKeyIdentifier();
+                    if (keyID != null)
+                    {
+                        certSelectX509.setSubjectKeyIdentifier(new DEROctetString(keyID).getEncoded());
+                    }
+                }
             }
         }
         catch (IOException ex)
-- 
2.34.1