check_cert_issuer in EAP-TLS broken in presence of X509v3 extensions

Patch from David Wood
Manual port of commit ce169385f