fixup! Simplify and fix equality check

Author: jfreden

x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/transport/CrossClusterApiKeySignatureManager.java

@@ -220,25 +220,20 @@ public boolean verify(X509CertificateSignature signature, String... headers) thr
         private X509Certificate findTrustAnchor(X509Certificate topCert, X509Certificate[] trustAnchors) {
             X500Principal issuer = topCert.getIssuerX500Principal();
 
-            // Check if the top cert is the trust anchor, this can happen if the full chain, including trust anchor, is sent or a leaf
-            // cert is trusted directly
-            if (topCert.getSubjectX500Principal().equals(issuer)) {
-                for (X509Certificate anchor : trustAnchors) {
-                    // Match by public key to handle the case where the trust store contains the exact same issuer with different key-pair
-                    if (anchor.getPublicKey().equals(topCert.getPublicKey())) {
-                        return anchor;
-                    }
+            for (X509Certificate anchor : trustAnchors) {
+                // Check if the top cert itself is the trust anchor (handles directly trusted certs and full chains)
+                // Per X.509 spec, a certificate is uniquely identified by issuer DN + serial number
+                if (anchor.getIssuerX500Principal().equals(topCert.getIssuerX500Principal())
+                    && anchor.getSerialNumber().equals(topCert.getSerialNumber())) {
+                    return anchor;
                 }
-            }
 
-            for (X509Certificate anchor : trustAnchors) {
                 if (anchor.getSubjectX500Principal().equals(issuer)) {
                     try {
                         // Verify this anchor actually signed the top cert
                         topCert.verify(anchor.getPublicKey());
                         return anchor;
                     } catch (GeneralSecurityException e) {
-                        // This anchor's subject matches, but it didn't sign the cert
                         logger.trace(
                             "Trust anchor [{}] matches issuer name but did not sign the certificate",
                             anchor.getSubjectX500Principal()