Skip over issuerUniqueID and subjectUniqueID

src/cert.rs

@@ -106,6 +106,30 @@ impl<'a> Cert<'a> {
                     der: CertificateDer::from(cert_der.as_slice_less_safe()),
                 };
 
+                // Skip over optional and unhandled:
+                //
+                // issuerUniqueID  [1]  IMPLICIT UniqueIdentifier OPTIONAL,
+                //                      -- If present, version MUST be v2 or v3
+                // subjectUniqueID [2]  IMPLICIT UniqueIdentifier OPTIONAL,
+                //                      -- If present, version MUST be v2 or v3
+                for (tag, id) in [
+                    (
+                        der::Tag::ContextSpecificPrimitive1,
+                        DerTypeId::IssuerUniqueId,
+                    ),
+                    (
+                        der::Tag::ContextSpecificPrimitive2,
+                        DerTypeId::SubjectUniqueId,
+                    ),
+                ] {
+                    if tbs.peek(tag.into()) {
+                        der::nested(tbs, tag, Error::TrailingData(id), |tagged| {
+                            tagged.skip_to_end();
+                            Ok(())
+                        })?;
+                    }
+                }
+
                 // When used to read X509v3 Certificate.tbsCertificate.extensions, we allow
                 // the extensions to be empty.  This is in spite of RFC5280:
                 //

src/der.rs

@@ -73,6 +73,9 @@ pub(crate) enum Tag {
     ContextSpecificConstructed0 = CONTEXT_SPECIFIC | CONSTRUCTED | 0,
     ContextSpecificConstructed1 = CONTEXT_SPECIFIC | CONSTRUCTED | 1,
     ContextSpecificConstructed3 = CONTEXT_SPECIFIC | CONSTRUCTED | 3,
+
+    ContextSpecificPrimitive1 = CONTEXT_SPECIFIC | 1,
+    ContextSpecificPrimitive2 = CONTEXT_SPECIFIC | 2,
 }
 
 pub(crate) const CONSTRUCTED: u8 = 0x20;

src/error.rs

@@ -399,4 +399,6 @@ pub enum DerTypeId {
     RevokedCertificateExtension,
     RevokedCertEntry,
     IssuingDistributionPoint,
+    IssuerUniqueId,
+    SubjectUniqueId,
 }

tests/integration.rs

@@ -273,6 +273,15 @@ fn read_ee_with_large_pos_serial() {
     webpki::EndEntityCert::try_from(&ee).expect("should parse 20-octet positive serial number");
 }
 
+#[test]
+#[cfg(feature = "alloc")]
+fn read_ee_with_issuer_and_subject_unique_ids() {
+    let ee = CertificateDer::from(&include_bytes!("misc/issuer_and_subject_unique_id.der")[..]);
+
+    webpki::EndEntityCert::try_from(&ee)
+        .expect("should skip over issuerUniqueID and subjectUniqueID");
+}
+
 #[test]
 fn list_netflix_names() {
     expect_cert_dns_names(