Current Behaviour:

The current client certificate code within gurl.py in munkilib uses this code, to validate whether a Certificate can be used to authenticate with the server.

This code currently doesn't walk up the Issuing Chain, so if a server only returns the accepted root certificates, Munki refuses to use a certificate to authenticate with the server, despite it being valid for authentication.

Expected Behaviour:

It's expected that when validating whether a certificate can be used for authentication, that the chain is walked to check for accepted certificates somewhere within the chain, and then use the certificate for authentication.