int X509_STORE_CTX_get1_issuer(X509 **issuer, X509_STORE_CTX *ctx, X509 *x)
{
	X509_NAME *xn;
	X509_OBJECT obj, *pobj;
	int i, ok, idx;
	xn=X509_get_issuer_name(x);
	ok=X509_STORE_get_by_subject(ctx,X509_LU_X509,xn,&obj);
	if (ok != X509_LU_X509)
		{
		if (ok == X509_LU_RETRY)
			{
			X509_OBJECT_free_contents(&obj);
			X509err(X509_F_X509_VERIFY_CERT,X509_R_SHOULD_RETRY);
			return -1;
			}
		else if (ok != X509_LU_FAIL)
			{
			X509_OBJECT_free_contents(&obj);
			/* not good :-(, break anyway */
			return -1;
			}
		return 0;
		}
	/* If certificate matches all OK */
	if(ctx->check_issued(ctx, x, obj.data.x509)) {
			*issuer = obj.data.x509;
			return 1;
	}
	X509_OBJECT_free_contents(&obj);
	/* Else find index of first matching cert */
	idx = X509_OBJECT_idx_by_subject(ctx->ctx->objs, X509_LU_X509, xn);
	/* This shouldn't normally happen since we already have one match */
	if(idx == -1) return 0;

	/* Look through all matching certificates for a suitable issuer */
	for(i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++) {
		pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);
		/* See if we've ran out of matches */
		if(pobj->type != X509_LU_X509) return 0;
		if(X509_NAME_cmp(xn, X509_get_subject_name(pobj->data.x509))) return 0;
		if(ctx->check_issued(ctx, x, pobj->data.x509)) {
			*issuer = pobj->data.x509;
			X509_OBJECT_up_ref_count(pobj);
			return 1;
		}
	}
	return 0;
}