Fix: correctly use chained certificates for AWS credential exchange

Signed-off-by: Noah Stride <noah.stride@goteleport.com>
spiffe · Feb 5, 2025 · d729c47 · d729c47
1 parent 7839538
commit d729c47
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/signer.go b/signer.go
@@ -110,7 +110,7 @@ func (s *X509SVIDSigner) Certificate() (*x509.Certificate, error) {
 // the trust anchor.
 // Implements the aws_signing_helper.Signer interface.
 func (s *X509SVIDSigner) CertificateChain() ([]*x509.Certificate, error) {
-	if len(s.SVID.Certificates) < 1 {
+	if len(s.SVID.Certificates) > 1 {
 		return s.SVID.Certificates[1:], nil
 	}
 	return nil, nil