prevent apple native cert validation from overriding error codes other than ASN_NO_SIGNER_E

Author: bigbrett

src/internal.c

@@ -16809,7 +16809,8 @@ int ProcessPeerCerts(WOLFSSL* ssl, byte* input, word32* inOutIdx,
             /* If we can't validate the peer cert chain against the CAs loaded
              * into wolfSSL, try to validate against the system certificates
              * using Apple's native trust APIs */
-            if ((ret != 0) && (ssl->ctx->doAppleNativeCertValidationFlag)) {
+            if ((ret == ASN_NO_SIGNER_E) &&
+                (ssl->ctx->doAppleNativeCertValidationFlag)) {
                 if (DoAppleNativeCertValidation(ssl, args->certs,
                                                      args->totalCerts)) {
                     WOLFSSL_MSG("Apple native cert chain validation SUCCESS");