security/certverifier/ExtendedValidation.cpp

   1 /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*-
   2  *
   3  * This Source Code Form is subject to the terms of the Mozilla Public
   4  * License, v. 2.0. If a copy of the MPL was not distributed with this
   5  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
   6
   7 #include "ExtendedValidation.h"
   8
   9 #include "cert.h"
  10 #include "hasht.h"
  11 #include "mozilla/ArrayUtils.h"
  12 #include "mozilla/Assertions.h"
  13 #include "mozilla/Base64.h"
  14 #include "mozilla/Casting.h"
  15 #include "mozilla/PodOperations.h"
  16 #include "nsDependentString.h"
  17 #include "nsString.h"
  18 #include "pk11pub.h"
  19 #include "mozpkix/pkixtypes.h"
  20
  21 namespace mozilla {
  22 namespace psm {
  23
  24 struct EVInfo {
  25   // See bug 1338873 about making these fields const.
  26   const char* dottedOid;
  27   const char*
  28       oidName;  // Set this to null to signal an invalid structure,
  29                 // (We can't have an empty list, so we'll use a dummy entry)
  30   unsigned char sha256Fingerprint[SHA256_LENGTH];
  31   const char* issuerBase64;
  32   const char* serialBase64;
  33 };
  34
  35 // HOWTO enable additional CA root certificates for EV:
  36 //
  37 // For each combination of "root certificate" and "policy OID",
  38 // one entry must be added to the array named kEVInfos.
  39 //
  40 // We use the combination of "issuer name" and "serial number" to
  41 // uniquely identify the certificate. In order to avoid problems
  42 // because of encodings when comparing certificates, we don't
  43 // use plain text representation, we rather use the original encoding
  44 // as it can be found in the root certificate (in base64 format).
  45 //
  46 // We can use the NSS utility named "pp" to extract the encoding.
  47 //
  48 // Build standalone NSS including the NSS tools, then run
  49 //   pp -t certificate-identity -i the-cert-filename
  50 //
  51 // You will need the output from sections "Issuer", "Fingerprint (SHA-256)",
  52 // "Issuer DER Base64" and "Serial DER Base64".
  53 //
  54 // The new section consists of the following components:
  55 //
  56 // - a comment that should contain the human readable issuer name
  57 //   of the certificate, as printed by the pp tool
  58 // - the EV policy OID that is associated to the EV grant
  59 // - a text description of the EV policy OID. The array can contain
  60 //   multiple entries with the same OID.
  61 //   Please make sure to use the identical OID text description for
  62 //   all entries with the same policy OID (use the text search
  63 //   feature of your text editor to find duplicates).
  64 //   When adding a new policy OID that is not yet contained in the array,
  65 //   please make sure that your new description is different from
  66 //   all the other descriptions (again use the text search feature
  67 //   to be sure).
  68 // - the SHA-256 fingerprint
  69 // - the "Issuer DER Base64" as printed by the pp tool.
  70 //   Remove all whitespaces. If you use multiple lines, make sure that
  71 //   only the final line will be followed by a comma.
  72 // - the "Serial DER Base64" (as printed by pp)
  73 //
  74 // After adding an entry, test it locally against the test site that
  75 // has been provided by the CA. Note that you must use a version of NSS
  76 // where the root certificate has already been added and marked as trusted
  77 // for issuing SSL server certificates (at least).
  78 //
  79 // If you are able to connect to the site without certificate errors,
  80 // but you don't see the EV status indicator, then most likely the CA
  81 // has a problem in their infrastructure. The most common problems are
  82 // related to the CA's OCSP infrastructure, either they use an incorrect
  83 // OCSP signing certificate, or OCSP for the intermediate certificates
  84 // isn't working, or OCSP isn't working at all.
  85
  86 #ifdef DEBUG
  87 static const size_t NUM_TEST_EV_ROOTS = 2;
  88 #endif
  89
  90 static const struct EVInfo kEVInfos[] = {
  91 // clang-format off
  92   // IMPORTANT! When extending this list, if you add another entry that uses
  93   // the same dottedOid as an existing entry, use the same oidName.
  94 #ifdef DEBUG
  95   // Debug EV certificates should all use the following OID:
  96   // 1.3.6.1.4.1.13769.666.666.666.1.500.9.1.
  97   // (multiple entries with the same OID is ok)
  98   // If you add or remove debug EV certs you must also modify NUM_TEST_EV_ROOTS
  99   // so that the correct number of certs are skipped as these debug EV certs
 100   // are NOT part of the default trust store.
 101   {
 102     // This is the PSM xpcshell testing EV certificate. It can be generated
 103     // using pycert.py and the following specification:
 104     //
 105     // issuer:evroot
 106     // subject:evroot
 107     // subjectKey:ev
 108     // issuerKey:ev
 109     // validity:20150101-20350101
 110     // extension:basicConstraints:cA,
 111     // extension:keyUsage:keyCertSign,cRLSign
 112     //
 113     // If this ever needs to change, re-generate the certificate and update the
 114     // following entry with the new fingerprint, issuer, and serial number.
 115     "1.3.6.1.4.1.13769.666.666.666.1.500.9.1",
 116     "DEBUGtesting EV OID",
 117     { 0x70, 0xED, 0xCB, 0x5A, 0xCE, 0x02, 0xC7, 0xC5, 0x0B, 0xA3, 0xD2, 0xD7,
 118       0xC6, 0xF5, 0x0E, 0x18, 0x02, 0x19, 0x17, 0xF5, 0x48, 0x08, 0x9C, 0xB3,
 119       0x8E, 0xEF, 0x9A, 0x1A, 0x4D, 0x7F, 0x82, 0x94 },
 120     "MBExDzANBgNVBAMMBmV2cm9vdA==",
 121     "IZSHsVgzcvhPgdfrgdMGlpSfMeg=",
 122   },
 123   {
 124     // This is an RSA root with an inadequate key size. It is used to test that
 125     // minimum key sizes are enforced when verifying for EV. It can be
 126     // generated using pycert.py and the following specification:
 127     //
 128     // issuer:ev_root_rsa_2040
 129     // subject:ev_root_rsa_2040
 130     // issuerKey:evRSA2040
 131     // subjectKey:evRSA2040
 132     // validity:20150101-20350101
 133     // extension:basicConstraints:cA,
 134     // extension:keyUsage:cRLSign,keyCertSign
 135     //
 136     // If this ever needs to change, re-generate the certificate and update the
 137     // following entry with the new fingerprint, issuer, and serial number.
 138     "1.3.6.1.4.1.13769.666.666.666.1.500.9.1",
 139     "DEBUGtesting EV OID",
 140     { 0x40, 0xAB, 0x5D, 0xA5, 0x89, 0x15, 0xA9, 0x4B, 0x82, 0x87, 0xB8, 0xA6,
 141       0x9A, 0x84, 0xB1, 0xDB, 0x7A, 0x9D, 0xDB, 0xB8, 0x4E, 0xE1, 0x23, 0xE3,
 142       0xC6, 0x64, 0xE7, 0x50, 0xDC, 0x35, 0x8C, 0x68  },
 143     "MBsxGTAXBgNVBAMMEGV2X3Jvb3RfcnNhXzIwNDA=",
 144     "J7nCMgtzNcSPG7jAh3CWzlTGHQg=",
 145   },
 146 #endif
 147   {
 148     // CN=Cybertrust Global Root,O=Cybertrust, Inc
 149     "1.3.6.1.4.1.6334.1.100.1",
 150     "Cybertrust EV OID",
 151     { 0x96, 0x0A, 0xDF, 0x00, 0x63, 0xE9, 0x63, 0x56, 0x75, 0x0C, 0x29,
 152       0x65, 0xDD, 0x0A, 0x08, 0x67, 0xDA, 0x0B, 0x9C, 0xBD, 0x6E, 0x77,
 153       0x71, 0x4A, 0xEA, 0xFB, 0x23, 0x49, 0xAB, 0x39, 0x3D, 0xA3 },
 154     "MDsxGDAWBgNVBAoTD0N5YmVydHJ1c3QsIEluYzEfMB0GA1UEAxMWQ3liZXJ0cnVz"
 155     "dCBHbG9iYWwgUm9vdA==",
 156     "BAAAAAABD4WqLUg=",
 157   },
 158   {
 159     // CN=SwissSign Gold CA - G2,O=SwissSign AG,C=CH
 160     "2.16.756.1.89.1.2.1.1",
 161     "SwissSign EV OID",
 162     { 0x62, 0xDD, 0x0B, 0xE9, 0xB9, 0xF5, 0x0A, 0x16, 0x3E, 0xA0, 0xF8,
 163       0xE7, 0x5C, 0x05, 0x3B, 0x1E, 0xCA, 0x57, 0xEA, 0x55, 0xC8, 0x68,
 164       0x8F, 0x64, 0x7C, 0x68, 0x81, 0xF2, 0xC8, 0x35, 0x7B, 0x95 },
 165     "MEUxCzAJBgNVBAYTAkNIMRUwEwYDVQQKEwxTd2lzc1NpZ24gQUcxHzAdBgNVBAMT"
 166     "FlN3aXNzU2lnbiBHb2xkIENBIC0gRzI=",
 167     "ALtAHEP1Xk+w",
 168   },
 169   {
 170     // CN=XRamp Global Certification Authority,O=XRamp Security Services Inc,OU=www.xrampsecurity.com,C=US
 171     "2.16.840.1.114404.1.1.2.4.1",
 172     "Trustwave EV OID",
 173     { 0xCE, 0xCD, 0xDC, 0x90, 0x50, 0x99, 0xD8, 0xDA, 0xDF, 0xC5, 0xB1,
 174       0xD2, 0x09, 0xB7, 0x37, 0xCB, 0xE2, 0xC1, 0x8C, 0xFB, 0x2C, 0x10,
 175       0xC0, 0xFF, 0x0B, 0xCF, 0x0D, 0x32, 0x86, 0xFC, 0x1A, 0xA2 },
 176     "MIGCMQswCQYDVQQGEwJVUzEeMBwGA1UECxMVd3d3LnhyYW1wc2VjdXJpdHkuY29t"
 177     "MSQwIgYDVQQKExtYUmFtcCBTZWN1cml0eSBTZXJ2aWNlcyBJbmMxLTArBgNVBAMT"
 178     "JFhSYW1wIEdsb2JhbCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eQ==",
 179     "UJRs7Bjq1ZxN1ZfvdY+grQ==",
 180   },
 181   {
 182     // CN=SecureTrust CA,O=SecureTrust Corporation,C=US
 183     "2.16.840.1.114404.1.1.2.4.1",
 184     "Trustwave EV OID",
 185     { 0xF1, 0xC1, 0xB5, 0x0A, 0xE5, 0xA2, 0x0D, 0xD8, 0x03, 0x0E, 0xC9,
 186       0xF6, 0xBC, 0x24, 0x82, 0x3D, 0xD3, 0x67, 0xB5, 0x25, 0x57, 0x59,
 187       0xB4, 0xE7, 0x1B, 0x61, 0xFC, 0xE9, 0xF7, 0x37, 0x5D, 0x73 },
 188     "MEgxCzAJBgNVBAYTAlVTMSAwHgYDVQQKExdTZWN1cmVUcnVzdCBDb3Jwb3JhdGlv"
 189     "bjEXMBUGA1UEAxMOU2VjdXJlVHJ1c3QgQ0E=",
 190     "DPCOXAgWpa1Cf/DrJxhZ0A==",
 191   },
 192   {
 193     // CN=Secure Global CA,O=SecureTrust Corporation,C=US
 194     "2.16.840.1.114404.1.1.2.4.1",
 195     "Trustwave EV OID",
 196     { 0x42, 0x00, 0xF5, 0x04, 0x3A, 0xC8, 0x59, 0x0E, 0xBB, 0x52, 0x7D,
 197       0x20, 0x9E, 0xD1, 0x50, 0x30, 0x29, 0xFB, 0xCB, 0xD4, 0x1C, 0xA1,
 198       0xB5, 0x06, 0xEC, 0x27, 0xF1, 0x5A, 0xDE, 0x7D, 0xAC, 0x69 },
 199     "MEoxCzAJBgNVBAYTAlVTMSAwHgYDVQQKExdTZWN1cmVUcnVzdCBDb3Jwb3JhdGlv"
 200     "bjEZMBcGA1UEAxMQU2VjdXJlIEdsb2JhbCBDQQ==",
 201     "B1YipOjUiolN9BPI8PjqpQ==",
 202   },
 203   {
 204     // CN=COMODO ECC Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
 205     "1.3.6.1.4.1.6449.1.2.1.5.1",
 206     "Comodo EV OID",
 207     { 0x17, 0x93, 0x92, 0x7A, 0x06, 0x14, 0x54, 0x97, 0x89, 0xAD, 0xCE,
 208       0x2F, 0x8F, 0x34, 0xF7, 0xF0, 0xB6, 0x6D, 0x0F, 0x3A, 0xE3, 0xA3,
 209       0xB8, 0x4D, 0x21, 0xEC, 0x15, 0xDB, 0xBA, 0x4F, 0xAD, 0xC7 },
 210     "MIGFMQswCQYDVQQGEwJHQjEbMBkGA1UECBMSR3JlYXRlciBNYW5jaGVzdGVyMRAw"
 211     "DgYDVQQHEwdTYWxmb3JkMRowGAYDVQQKExFDT01PRE8gQ0EgTGltaXRlZDErMCkG"
 212     "A1UEAxMiQ09NT0RPIEVDQyBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eQ==",
 213     "H0evqmIAcFBUTAGem2OZKg==",
 214   },
 215   {
 216     // CN=COMODO Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
 217     "1.3.6.1.4.1.6449.1.2.1.5.1",
 218     "Comodo EV OID",
 219     { 0x0C, 0x2C, 0xD6, 0x3D, 0xF7, 0x80, 0x6F, 0xA3, 0x99, 0xED, 0xE8,
 220       0x09, 0x11, 0x6B, 0x57, 0x5B, 0xF8, 0x79, 0x89, 0xF0, 0x65, 0x18,
 221       0xF9, 0x80, 0x8C, 0x86, 0x05, 0x03, 0x17, 0x8B, 0xAF, 0x66 },
 222     "MIGBMQswCQYDVQQGEwJHQjEbMBkGA1UECBMSR3JlYXRlciBNYW5jaGVzdGVyMRAw"
 223     "DgYDVQQHEwdTYWxmb3JkMRowGAYDVQQKExFDT01PRE8gQ0EgTGltaXRlZDEnMCUG"
 224     "A1UEAxMeQ09NT0RPIENlcnRpZmljYXRpb24gQXV0aG9yaXR5",
 225     "ToEtioJl4AsC7j41AkblPQ==",
 226   },
 227   {
 228     // CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE
 229     "1.3.6.1.4.1.6449.1.2.1.5.1",
 230     "Comodo EV OID",
 231     { 0x68, 0x7F, 0xA4, 0x51, 0x38, 0x22, 0x78, 0xFF, 0xF0, 0xC8, 0xB1,
 232       0x1F, 0x8D, 0x43, 0xD5, 0x76, 0x67, 0x1C, 0x6E, 0xB2, 0xBC, 0xEA,
 233       0xB4, 0x13, 0xFB, 0x83, 0xD9, 0x65, 0xD0, 0x6D, 0x2F, 0xF2 },
 234     "MG8xCzAJBgNVBAYTAlNFMRQwEgYDVQQKEwtBZGRUcnVzdCBBQjEmMCQGA1UECxMd"
 235     "QWRkVHJ1c3QgRXh0ZXJuYWwgVFRQIE5ldHdvcmsxIjAgBgNVBAMTGUFkZFRydXN0"
 236     "IEV4dGVybmFsIENBIFJvb3Q=",
 237     "AQ==",
 238   },
 239   {
 240     // OU=Go Daddy Class 2 Certification Authority,O=\"The Go Daddy Group, Inc.\",C=US
 241     "2.16.840.1.114413.1.7.23.3",
 242     "Go Daddy EV OID a",
 243     { 0xC3, 0x84, 0x6B, 0xF2, 0x4B, 0x9E, 0x93, 0xCA, 0x64, 0x27, 0x4C,
 244       0x0E, 0xC6, 0x7C, 0x1E, 0xCC, 0x5E, 0x02, 0x4F, 0xFC, 0xAC, 0xD2,
 245       0xD7, 0x40, 0x19, 0x35, 0x0E, 0x81, 0xFE, 0x54, 0x6A, 0xE4 },
 246     "MGMxCzAJBgNVBAYTAlVTMSEwHwYDVQQKExhUaGUgR28gRGFkZHkgR3JvdXAsIElu"
 247     "Yy4xMTAvBgNVBAsTKEdvIERhZGR5IENsYXNzIDIgQ2VydGlmaWNhdGlvbiBBdXRo"
 248     "b3JpdHk=",
 249     "AA==",
 250   },
 251   {
 252     // CN=Go Daddy Root Certificate Authority - G2,O="GoDaddy.com, Inc.",L=Scottsdale,ST=Arizona,C=US
 253     "2.16.840.1.114413.1.7.23.3",
 254     "Go Daddy EV OID a",
 255     { 0x45, 0x14, 0x0B, 0x32, 0x47, 0xEB, 0x9C, 0xC8, 0xC5, 0xB4, 0xF0,
 256       0xD7, 0xB5, 0x30, 0x91, 0xF7, 0x32, 0x92, 0x08, 0x9E, 0x6E, 0x5A,
 257       0x63, 0xE2, 0x74, 0x9D, 0xD3, 0xAC, 0xA9, 0x19, 0x8E, 0xDA },
 258     "MIGDMQswCQYDVQQGEwJVUzEQMA4GA1UECBMHQXJpem9uYTETMBEGA1UEBxMKU2Nv"
 259     "dHRzZGFsZTEaMBgGA1UEChMRR29EYWRkeS5jb20sIEluYy4xMTAvBgNVBAMTKEdv"
 260     "IERhZGR5IFJvb3QgQ2VydGlmaWNhdGUgQXV0aG9yaXR5IC0gRzI=",
 261     "AA==",
 262   },
 263   {
 264     // OU=Starfield Class 2 Certification Authority,O=\"Starfield Technologies, Inc.\",C=US
 265     "2.16.840.1.114414.1.7.23.3",
 266     "Go Daddy EV OID b",
 267     { 0x14, 0x65, 0xFA, 0x20, 0x53, 0x97, 0xB8, 0x76, 0xFA, 0xA6, 0xF0,
 268       0xA9, 0x95, 0x8E, 0x55, 0x90, 0xE4, 0x0F, 0xCC, 0x7F, 0xAA, 0x4F,
 269       0xB7, 0xC2, 0xC8, 0x67, 0x75, 0x21, 0xFB, 0x5F, 0xB6, 0x58 },
 270     "MGgxCzAJBgNVBAYTAlVTMSUwIwYDVQQKExxTdGFyZmllbGQgVGVjaG5vbG9naWVz"
 271     "LCBJbmMuMTIwMAYDVQQLEylTdGFyZmllbGQgQ2xhc3MgMiBDZXJ0aWZpY2F0aW9u"
 272     "IEF1dGhvcml0eQ==",
 273     "AA==",
 274   },
 275   {
 276     // CN=Starfield Root Certificate Authority - G2,O="Starfield Technologies, Inc.",L=Scottsdale,ST=Arizona,C=US
 277     "2.16.840.1.114414.1.7.23.3",
 278     "Go Daddy EV OID b",
 279     { 0x2C, 0xE1, 0xCB, 0x0B, 0xF9, 0xD2, 0xF9, 0xE1, 0x02, 0x99, 0x3F,
 280       0xBE, 0x21, 0x51, 0x52, 0xC3, 0xB2, 0xDD, 0x0C, 0xAB, 0xDE, 0x1C,
 281       0x68, 0xE5, 0x31, 0x9B, 0x83, 0x91, 0x54, 0xDB, 0xB7, 0xF5 },
 282     "MIGPMQswCQYDVQQGEwJVUzEQMA4GA1UECBMHQXJpem9uYTETMBEGA1UEBxMKU2Nv"
 283     "dHRzZGFsZTElMCMGA1UEChMcU3RhcmZpZWxkIFRlY2hub2xvZ2llcywgSW5jLjEy"
 284     "MDAGA1UEAxMpU3RhcmZpZWxkIFJvb3QgQ2VydGlmaWNhdGUgQXV0aG9yaXR5IC0g"
 285     "RzI=",
 286     "AA==",
 287   },
 288   {
 289     // CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
 290     "2.16.840.1.114412.2.1",
 291     "DigiCert EV OID",
 292     { 0x74, 0x31, 0xE5, 0xF4, 0xC3, 0xC1, 0xCE, 0x46, 0x90, 0x77, 0x4F,
 293       0x0B, 0x61, 0xE0, 0x54, 0x40, 0x88, 0x3B, 0xA9, 0xA0, 0x1E, 0xD0,
 294       0x0B, 0xA6, 0xAB, 0xD7, 0x80, 0x6E, 0xD3, 0xB1, 0x18, 0xCF },
 295     "MGwxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsT"
 296     "EHd3dy5kaWdpY2VydC5jb20xKzApBgNVBAMTIkRpZ2lDZXJ0IEhpZ2ggQXNzdXJh"
 297     "bmNlIEVWIFJvb3QgQ0E=",
 298     "AqxcJmoLQJuPC3nyrkYldw==",
 299   },
 300   {
 301     // CN=QuoVadis Root CA 2,O=QuoVadis Limited,C=BM
 302     "1.3.6.1.4.1.8024.0.2.100.1.2",
 303     "Quo Vadis EV OID",
 304     { 0x85, 0xA0, 0xDD, 0x7D, 0xD7, 0x20, 0xAD, 0xB7, 0xFF, 0x05, 0xF8,
 305       0x3D, 0x54, 0x2B, 0x20, 0x9D, 0xC7, 0xFF, 0x45, 0x28, 0xF7, 0xD6,
 306       0x77, 0xB1, 0x83, 0x89, 0xFE, 0xA5, 0xE5, 0xC4, 0x9E, 0x86 },
 307     "MEUxCzAJBgNVBAYTAkJNMRkwFwYDVQQKExBRdW9WYWRpcyBMaW1pdGVkMRswGQYD"
 308     "VQQDExJRdW9WYWRpcyBSb290IENBIDI=",
 309     "BQk=",
 310   },
 311   {
 312     // CN=Network Solutions Certificate Authority,O=Network Solutions L.L.C.,C=US
 313     "1.3.6.1.4.1.782.1.2.1.8.1",
 314     "Network Solutions EV OID",
 315     { 0x15, 0xF0, 0xBA, 0x00, 0xA3, 0xAC, 0x7A, 0xF3, 0xAC, 0x88, 0x4C,
 316       0x07, 0x2B, 0x10, 0x11, 0xA0, 0x77, 0xBD, 0x77, 0xC0, 0x97, 0xF4,
 317       0x01, 0x64, 0xB2, 0xF8, 0x59, 0x8A, 0xBD, 0x83, 0x86, 0x0C },
 318     "MGIxCzAJBgNVBAYTAlVTMSEwHwYDVQQKExhOZXR3b3JrIFNvbHV0aW9ucyBMLkwu"
 319     "Qy4xMDAuBgNVBAMTJ05ldHdvcmsgU29sdXRpb25zIENlcnRpZmljYXRlIEF1dGhv"
 320     "cml0eQ==",
 321     "V8szb8JcFuZHFhfjkDFo4A==",
 322   },
 323   {
 324     // CN=Entrust Root Certification Authority,OU="(c) 2006 Entrust, Inc.",OU=www.entrust.net/CPS is incorporated by reference,O="Entrust, Inc.",C=US
 325     "2.16.840.1.114028.10.1.2",
 326     "Entrust EV OID",
 327     { 0x73, 0xC1, 0x76, 0x43, 0x4F, 0x1B, 0xC6, 0xD5, 0xAD, 0xF4, 0x5B,
 328       0x0E, 0x76, 0xE7, 0x27, 0x28, 0x7C, 0x8D, 0xE5, 0x76, 0x16, 0xC1,
 329       0xE6, 0xE6, 0x14, 0x1A, 0x2B, 0x2C, 0xBC, 0x7D, 0x8E, 0x4C },
 330     "MIGwMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNRW50cnVzdCwgSW5jLjE5MDcGA1UE"
 331     "CxMwd3d3LmVudHJ1c3QubmV0L0NQUyBpcyBpbmNvcnBvcmF0ZWQgYnkgcmVmZXJl"
 332     "bmNlMR8wHQYDVQQLExYoYykgMjAwNiBFbnRydXN0LCBJbmMuMS0wKwYDVQQDEyRF"
 333     "bnRydXN0IFJvb3QgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHk=",
 334     "RWtQVA==",
 335   },
 336   {
 337     // CN=Entrust Root Certification Authority - G4,OU="(c) 2015 Entrust, Inc. - for authorized use only",OU=See www.entrust.net/legal-terms,O="Entrust, Inc.",C=US
 338     "2.16.840.1.114028.10.1.2",
 339     "Entrust EV OID",
 340     { 0xDB, 0x35, 0x17, 0xD1, 0xF6, 0x73, 0x2A, 0x2D, 0x5A, 0xB9, 0x7C,
 341       0x53, 0x3E, 0xC7, 0x07, 0x79, 0xEE, 0x32, 0x70, 0xA6, 0x2F, 0xB4,
 342       0xAC, 0x42, 0x38, 0x37, 0x24, 0x60, 0xE6, 0xF0, 0x1E, 0x88 },
 343     "MIG+MQswCQYDVQQGEwJVUzEWMBQGA1UEChMNRW50cnVzdCwgSW5jLjEoMCYGA1UE"
 344     "CxMfU2VlIHd3dy5lbnRydXN0Lm5ldC9sZWdhbC10ZXJtczE5MDcGA1UECxMwKGMp"
 345     "IDIwMTUgRW50cnVzdCwgSW5jLiAtIGZvciBhdXRob3JpemVkIHVzZSBvbmx5MTIw"
 346     "MAYDVQQDEylFbnRydXN0IFJvb3QgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgLSBH"
 347     "NA==",
 348     "ANm1Q3+vqTkPAAAAAFVlrVg=",
 349   },
 350   {
 351     // CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
 352     "2.23.140.1.1",
 353     "CA/Browser Forum EV OID",
 354     { 0xEB, 0xD4, 0x10, 0x40, 0xE4, 0xBB, 0x3E, 0xC7, 0x42, 0xC9, 0xE3,
 355       0x81, 0xD3, 0x1E, 0xF2, 0xA4, 0x1A, 0x48, 0xB6, 0x68, 0x5C, 0x96,
 356       0xE7, 0xCE, 0xF3, 0xC1, 0xDF, 0x6C, 0xD4, 0x33, 0x1C, 0x99 },
 357     "MFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMRAwDgYD"
 358     "VQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxTaWduIFJvb3QgQ0E=",
 359     "BAAAAAABFUtaw5Q=",
 360   },
 361   {
 362     // CN=GlobalSign,O=GlobalSign,OU=GlobalSign Root CA - R3
 363     "2.23.140.1.1",
 364     "CA/Browser Forum EV OID",
 365     { 0xCB, 0xB5, 0x22, 0xD7, 0xB7, 0xF1, 0x27, 0xAD, 0x6A, 0x01, 0x13,
 366       0x86, 0x5B, 0xDF, 0x1C, 0xD4, 0x10, 0x2E, 0x7D, 0x07, 0x59, 0xAF,
 367       0x63, 0x5A, 0x7C, 0xF4, 0x72, 0x0D, 0xC9, 0x63, 0xC5, 0x3B },
 368     "MEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAtIFIzMRMwEQYDVQQKEwpH"
 369     "bG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWdu",
 370     "BAAAAAABIVhTCKI=",
 371   },
 372   {
 373     // CN=Buypass Class 3 Root CA,O=Buypass AS-983163327,C=NO
 374     "2.16.578.1.26.1.3.3",
 375     "Buypass EV OID",
 376     { 0xED, 0xF7, 0xEB, 0xBC, 0xA2, 0x7A, 0x2A, 0x38, 0x4D, 0x38, 0x7B,
 377       0x7D, 0x40, 0x10, 0xC6, 0x66, 0xE2, 0xED, 0xB4, 0x84, 0x3E, 0x4C,
 378       0x29, 0xB4, 0xAE, 0x1D, 0x5B, 0x93, 0x32, 0xE6, 0xB2, 0x4D },
 379     "ME4xCzAJBgNVBAYTAk5PMR0wGwYDVQQKDBRCdXlwYXNzIEFTLTk4MzE2MzMyNzEg"
 380     "MB4GA1UEAwwXQnV5cGFzcyBDbGFzcyAzIFJvb3QgQ0E=",
 381     "Ag==",
 382   },
 383   {
 384     // CN=Chambers of Commerce Root - 2008,O=AC Camerfirma S.A.,serialNumber=A82743287,L=Madrid (see current address at www.camerfirma.com/address),C=EU
 385     "1.3.6.1.4.1.17326.10.14.2.1.2",
 386     "Camerfirma EV OID a",
 387     { 0x06, 0x3E, 0x4A, 0xFA, 0xC4, 0x91, 0xDF, 0xD3, 0x32, 0xF3, 0x08,
 388       0x9B, 0x85, 0x42, 0xE9, 0x46, 0x17, 0xD8, 0x93, 0xD7, 0xFE, 0x94,
 389       0x4E, 0x10, 0xA7, 0x93, 0x7E, 0xE2, 0x9D, 0x96, 0x93, 0xC0 },
 390     "MIGuMQswCQYDVQQGEwJFVTFDMEEGA1UEBxM6TWFkcmlkIChzZWUgY3VycmVudCBh"
 391     "ZGRyZXNzIGF0IHd3dy5jYW1lcmZpcm1hLmNvbS9hZGRyZXNzKTESMBAGA1UEBRMJ"
 392     "QTgyNzQzMjg3MRswGQYDVQQKExJBQyBDYW1lcmZpcm1hIFMuQS4xKTAnBgNVBAMT"
 393     "IENoYW1iZXJzIG9mIENvbW1lcmNlIFJvb3QgLSAyMDA4",
 394     "AKPaQn6ksa7a",
 395   },
 396   {
 397     // CN=AffirmTrust Commercial,O=AffirmTrust,C=US
 398     "1.3.6.1.4.1.34697.2.1",
 399     "AffirmTrust EV OID a",
 400     { 0x03, 0x76, 0xAB, 0x1D, 0x54, 0xC5, 0xF9, 0x80, 0x3C, 0xE4, 0xB2,
 401       0xE2, 0x01, 0xA0, 0xEE, 0x7E, 0xEF, 0x7B, 0x57, 0xB6, 0x36, 0xE8,
 402       0xA9, 0x3C, 0x9B, 0x8D, 0x48, 0x60, 0xC9, 0x6F, 0x5F, 0xA7 },
 403     "MEQxCzAJBgNVBAYTAlVTMRQwEgYDVQQKDAtBZmZpcm1UcnVzdDEfMB0GA1UEAwwW"
 404     "QWZmaXJtVHJ1c3QgQ29tbWVyY2lhbA==",
 405     "d3cGJyapsXw=",
 406   },
 407   {
 408     // CN=AffirmTrust Networking,O=AffirmTrust,C=US
 409     "1.3.6.1.4.1.34697.2.2",
 410     "AffirmTrust EV OID b",
 411     { 0x0A, 0x81, 0xEC, 0x5A, 0x92, 0x97, 0x77, 0xF1, 0x45, 0x90, 0x4A,
 412       0xF3, 0x8D, 0x5D, 0x50, 0x9F, 0x66, 0xB5, 0xE2, 0xC5, 0x8F, 0xCD,
 413       0xB5, 0x31, 0x05, 0x8B, 0x0E, 0x17, 0xF3, 0xF0, 0xB4, 0x1B },
 414     "MEQxCzAJBgNVBAYTAlVTMRQwEgYDVQQKDAtBZmZpcm1UcnVzdDEfMB0GA1UEAwwW"
 415     "QWZmaXJtVHJ1c3QgTmV0d29ya2luZw==",
 416     "fE8EORzUmS0=",
 417   },
 418   {
 419     // CN=AffirmTrust Premium,O=AffirmTrust,C=US
 420     "1.3.6.1.4.1.34697.2.3",
 421     "AffirmTrust EV OID c",
 422     { 0x70, 0xA7, 0x3F, 0x7F, 0x37, 0x6B, 0x60, 0x07, 0x42, 0x48, 0x90,
 423       0x45, 0x34, 0xB1, 0x14, 0x82, 0xD5, 0xBF, 0x0E, 0x69, 0x8E, 0xCC,
 424       0x49, 0x8D, 0xF5, 0x25, 0x77, 0xEB, 0xF2, 0xE9, 0x3B, 0x9A },
 425     "MEExCzAJBgNVBAYTAlVTMRQwEgYDVQQKDAtBZmZpcm1UcnVzdDEcMBoGA1UEAwwT"
 426     "QWZmaXJtVHJ1c3QgUHJlbWl1bQ==",
 427     "bYwURrGmCu4=",
 428   },
 429   {
 430     // CN=AffirmTrust Premium ECC,O=AffirmTrust,C=US
 431     "1.3.6.1.4.1.34697.2.4",
 432     "AffirmTrust EV OID d",
 433     { 0xBD, 0x71, 0xFD, 0xF6, 0xDA, 0x97, 0xE4, 0xCF, 0x62, 0xD1, 0x64,
 434       0x7A, 0xDD, 0x25, 0x81, 0xB0, 0x7D, 0x79, 0xAD, 0xF8, 0x39, 0x7E,
 435       0xB4, 0xEC, 0xBA, 0x9C, 0x5E, 0x84, 0x88, 0x82, 0x14, 0x23 },
 436     "MEUxCzAJBgNVBAYTAlVTMRQwEgYDVQQKDAtBZmZpcm1UcnVzdDEgMB4GA1UEAwwX"
 437     "QWZmaXJtVHJ1c3QgUHJlbWl1bSBFQ0M=",
 438     "dJclisc/elQ=",
 439   },
 440   {
 441     // CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
 442     "1.2.616.1.113527.2.5.1.1",
 443     "Certum EV OID",
 444     { 0x5C, 0x58, 0x46, 0x8D, 0x55, 0xF5, 0x8E, 0x49, 0x7E, 0x74, 0x39,
 445       0x82, 0xD2, 0xB5, 0x00, 0x10, 0xB6, 0xD1, 0x65, 0x37, 0x4A, 0xCF,
 446       0x83, 0xA7, 0xD4, 0xA3, 0x2D, 0xB7, 0x68, 0xC4, 0x40, 0x8E },
 447     "MH4xCzAJBgNVBAYTAlBMMSIwIAYDVQQKExlVbml6ZXRvIFRlY2hub2xvZ2llcyBT"
 448     "LkEuMScwJQYDVQQLEx5DZXJ0dW0gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxIjAg"
 449     "BgNVBAMTGUNlcnR1bSBUcnVzdGVkIE5ldHdvcmsgQ0E=",
 450     "BETA",
 451   },
 452   {
 453     // CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
 454     "1.2.616.1.113527.2.5.1.1",
 455     "Certum EV OID",
 456     { 0xB6, 0x76, 0xF2, 0xED, 0xDA, 0xE8, 0x77, 0x5C, 0xD3, 0x6C, 0xB0,
 457       0xF6, 0x3C, 0xD1, 0xD4, 0x60, 0x39, 0x61, 0xF4, 0x9E, 0x62, 0x65,
 458       0xBA, 0x01, 0x3A, 0x2F, 0x03, 0x07, 0xB6, 0xD0, 0xB8, 0x04 },
 459     "MIGAMQswCQYDVQQGEwJQTDEiMCAGA1UEChMZVW5pemV0byBUZWNobm9sb2dpZXMg"
 460     "Uy5BLjEnMCUGA1UECxMeQ2VydHVtIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MSQw"
 461     "IgYDVQQDExtDZXJ0dW0gVHJ1c3RlZCBOZXR3b3JrIENBIDI=",
 462     "IdbQSk8lD8kyN/yqXhKN6Q==",
 463   },
 464   {
 465     // CN=Izenpe.com,O=IZENPE S.A.,C=ES
 466     "1.3.6.1.4.1.14777.6.1.1",
 467     "Izenpe EV OID 1",
 468     { 0x25, 0x30, 0xCC, 0x8E, 0x98, 0x32, 0x15, 0x02, 0xBA, 0xD9, 0x6F,
 469       0x9B, 0x1F, 0xBA, 0x1B, 0x09, 0x9E, 0x2D, 0x29, 0x9E, 0x0F, 0x45,
 470       0x48, 0xBB, 0x91, 0x4F, 0x36, 0x3B, 0xC0, 0xD4, 0x53, 0x1F },
 471     "MDgxCzAJBgNVBAYTAkVTMRQwEgYDVQQKDAtJWkVOUEUgUy5BLjETMBEGA1UEAwwK"
 472     "SXplbnBlLmNvbQ==",
 473     "ALC3WhZIX7/hy/WL1xnmfQ==",
 474   },
 475   {
 476     // CN=Izenpe.com,O=IZENPE S.A.,C=ES
 477     "1.3.6.1.4.1.14777.6.1.2",
 478     "Izenpe EV OID 2",
 479     { 0x25, 0x30, 0xCC, 0x8E, 0x98, 0x32, 0x15, 0x02, 0xBA, 0xD9, 0x6F,
 480       0x9B, 0x1F, 0xBA, 0x1B, 0x09, 0x9E, 0x2D, 0x29, 0x9E, 0x0F, 0x45,
 481       0x48, 0xBB, 0x91, 0x4F, 0x36, 0x3B, 0xC0, 0xD4, 0x53, 0x1F },
 482     "MDgxCzAJBgNVBAYTAkVTMRQwEgYDVQQKDAtJWkVOUEUgUy5BLjETMBEGA1UEAwwK"
 483     "SXplbnBlLmNvbQ==",
 484     "ALC3WhZIX7/hy/WL1xnmfQ==",
 485   },
 486   {
 487     // CN=T-TeleSec GlobalRoot Class 3,OU=T-Systems Trust Center,O=T-Systems Enterprise Services GmbH,C=DE
 488     "1.3.6.1.4.1.7879.13.24.1",
 489     "T-Systems EV OID",
 490     { 0xFD, 0x73, 0xDA, 0xD3, 0x1C, 0x64, 0x4F, 0xF1, 0xB4, 0x3B, 0xEF,
 491       0x0C, 0xCD, 0xDA, 0x96, 0x71, 0x0B, 0x9C, 0xD9, 0x87, 0x5E, 0xCA,
 492       0x7E, 0x31, 0x70, 0x7A, 0xF3, 0xE9, 0x6D, 0x52, 0x2B, 0xBD },
 493     "MIGCMQswCQYDVQQGEwJERTErMCkGA1UECgwiVC1TeXN0ZW1zIEVudGVycHJpc2Ug"
 494     "U2VydmljZXMgR21iSDEfMB0GA1UECwwWVC1TeXN0ZW1zIFRydXN0IENlbnRlcjEl"
 495     "MCMGA1UEAwwcVC1UZWxlU2VjIEdsb2JhbFJvb3QgQ2xhc3MgMw==",
 496     "AQ==",
 497   },
 498   {
 499     // CN=TWCA Root Certification Authority,OU=Root CA,O=TAIWAN-CA,C=TW
 500     "1.3.6.1.4.1.40869.1.1.22.3",
 501     "TWCA EV OID",
 502     { 0xBF, 0xD8, 0x8F, 0xE1, 0x10, 0x1C, 0x41, 0xAE, 0x3E, 0x80, 0x1B,
 503       0xF8, 0xBE, 0x56, 0x35, 0x0E, 0xE9, 0xBA, 0xD1, 0xA6, 0xB9, 0xBD,
 504       0x51, 0x5E, 0xDC, 0x5C, 0x6D, 0x5B, 0x87, 0x11, 0xAC, 0x44 },
 505     "MF8xCzAJBgNVBAYTAlRXMRIwEAYDVQQKDAlUQUlXQU4tQ0ExEDAOBgNVBAsMB1Jv"
 506     "b3QgQ0ExKjAoBgNVBAMMIVRXQ0EgUm9vdCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0"
 507     "eQ==",
 508     "AQ==",
 509   },
 510   {
 511     // CN=D-TRUST Root Class 3 CA 2 EV 2009,O=D-Trust GmbH,C=DE
 512     "1.3.6.1.4.1.4788.2.202.1",
 513     "D-TRUST EV OID",
 514     { 0xEE, 0xC5, 0x49, 0x6B, 0x98, 0x8C, 0xE9, 0x86, 0x25, 0xB9, 0x34,
 515       0x09, 0x2E, 0xEC, 0x29, 0x08, 0xBE, 0xD0, 0xB0, 0xF3, 0x16, 0xC2,
 516       0xD4, 0x73, 0x0C, 0x84, 0xEA, 0xF1, 0xF3, 0xD3, 0x48, 0x81 },
 517     "MFAxCzAJBgNVBAYTAkRFMRUwEwYDVQQKDAxELVRydXN0IEdtYkgxKjAoBgNVBAMM"
 518     "IUQtVFJVU1QgUm9vdCBDbGFzcyAzIENBIDIgRVYgMjAwOQ==",
 519     "CYP0",
 520   },
 521   {
 522     // CN = Autoridad de Certificacion Firmaprofesional CIF A62634068, C = ES
 523     "1.3.6.1.4.1.13177.10.1.3.10",
 524     "Firmaprofesional EV OID",
 525     { 0x04, 0x04, 0x80, 0x28, 0xBF, 0x1F, 0x28, 0x64, 0xD4, 0x8F, 0x9A,
 526       0xD4, 0xD8, 0x32, 0x94, 0x36, 0x6A, 0x82, 0x88, 0x56, 0x55, 0x3F,
 527       0x3B, 0x14, 0x30, 0x3F, 0x90, 0x14, 0x7F, 0x5D, 0x40, 0xEF },
 528     "MFExCzAJBgNVBAYTAkVTMUIwQAYDVQQDDDlBdXRvcmlkYWQgZGUgQ2VydGlmaWNh"
 529     "Y2lvbiBGaXJtYXByb2Zlc2lvbmFsIENJRiBBNjI2MzQwNjg=",
 530     "U+w77vuySF8=",
 531   },
 532   {
 533     // CN = TWCA Global Root CA, OU = Root CA, O = TAIWAN-CA, C = TW
 534     "1.3.6.1.4.1.40869.1.1.22.3",
 535     "TWCA EV OID",
 536     { 0x59, 0x76, 0x90, 0x07, 0xF7, 0x68, 0x5D, 0x0F, 0xCD, 0x50, 0x87,
 537       0x2F, 0x9F, 0x95, 0xD5, 0x75, 0x5A, 0x5B, 0x2B, 0x45, 0x7D, 0x81,
 538       0xF3, 0x69, 0x2B, 0x61, 0x0A, 0x98, 0x67, 0x2F, 0x0E, 0x1B },
 539     "MFExCzAJBgNVBAYTAlRXMRIwEAYDVQQKEwlUQUlXQU4tQ0ExEDAOBgNVBAsTB1Jv"
 540     "b3QgQ0ExHDAaBgNVBAMTE1RXQ0EgR2xvYmFsIFJvb3QgQ0E=",
 541     "DL4=",
 542   },
 543   {
 544     // CN = E-Tugra Certification Authority, OU = E-Tugra Sertifikasyon Merkezi, O = E-Tuğra EBG Bilişim Teknolojileri ve Hizmetleri A.Ş., L = Ankara, C = TR
 545     "2.16.792.3.0.4.1.1.4",
 546     "ETugra EV OID",
 547     { 0xB0, 0xBF, 0xD5, 0x2B, 0xB0, 0xD7, 0xD9, 0xBD, 0x92, 0xBF, 0x5D,
 548       0x4D, 0xC1, 0x3D, 0xA2, 0x55, 0xC0, 0x2C, 0x54, 0x2F, 0x37, 0x83,
 549       0x65, 0xEA, 0x89, 0x39, 0x11, 0xF5, 0x5E, 0x55, 0xF2, 0x3C },
 550     "MIGyMQswCQYDVQQGEwJUUjEPMA0GA1UEBwwGQW5rYXJhMUAwPgYDVQQKDDdFLVR1"
 551     "xJ9yYSBFQkcgQmlsacWfaW0gVGVrbm9sb2ppbGVyaSB2ZSBIaXptZXRsZXJpIEEu"
 552     "xZ4uMSYwJAYDVQQLDB1FLVR1Z3JhIFNlcnRpZmlrYXN5b24gTWVya2V6aTEoMCYG"
 553     "A1UEAwwfRS1UdWdyYSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eQ==",
 554     "amg+nFGby1M=",
 555   },
 556   {
 557     // CN=Actalis Authentication Root CA,O=Actalis S.p.A./03358520967,L=Milan,C=IT
 558     "1.3.159.1.17.1",
 559     "Actalis EV OID",
 560     { 0x55, 0x92, 0x60, 0x84, 0xEC, 0x96, 0x3A, 0x64, 0xB9, 0x6E, 0x2A,
 561       0xBE, 0x01, 0xCE, 0x0B, 0xA8, 0x6A, 0x64, 0xFB, 0xFE, 0xBC, 0xC7,
 562       0xAA, 0xB5, 0xAF, 0xC1, 0x55, 0xB3, 0x7F, 0xD7, 0x60, 0x66 },
 563     "MGsxCzAJBgNVBAYTAklUMQ4wDAYDVQQHDAVNaWxhbjEjMCEGA1UECgwaQWN0YWxp"
 564     "cyBTLnAuQS4vMDMzNTg1MjA5NjcxJzAlBgNVBAMMHkFjdGFsaXMgQXV0aGVudGlj"
 565     "YXRpb24gUm9vdCBDQQ==",
 566     "VwoRl0LE48w=",
 567   },
 568   {
 569     // CN=DigiCert Assured ID Root G2,OU=www.digicert.com,O=DigiCert Inc,C=US
 570     "2.16.840.1.114412.2.1",
 571     "DigiCert EV OID",
 572     { 0x7D, 0x05, 0xEB, 0xB6, 0x82, 0x33, 0x9F, 0x8C, 0x94, 0x51, 0xEE,
 573       0x09, 0x4E, 0xEB, 0xFE, 0xFA, 0x79, 0x53, 0xA1, 0x14, 0xED, 0xB2,
 574       0xF4, 0x49, 0x49, 0x45, 0x2F, 0xAB, 0x7D, 0x2F, 0xC1, 0x85 },
 575     "MGUxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsT"
 576     "EHd3dy5kaWdpY2VydC5jb20xJDAiBgNVBAMTG0RpZ2lDZXJ0IEFzc3VyZWQgSUQg"
 577     "Um9vdCBHMg==",
 578     "C5McOtY5Z+pnI7/Dr5r0Sw==",
 579   },
 580   {
 581     // CN=DigiCert Assured ID Root G3,OU=www.digicert.com,O=DigiCert Inc,C=US
 582     "2.16.840.1.114412.2.1",
 583     "DigiCert EV OID",
 584     { 0x7E, 0x37, 0xCB, 0x8B, 0x4C, 0x47, 0x09, 0x0C, 0xAB, 0x36, 0x55,
 585       0x1B, 0xA6, 0xF4, 0x5D, 0xB8, 0x40, 0x68, 0x0F, 0xBA, 0x16, 0x6A,
 586       0x95, 0x2D, 0xB1, 0x00, 0x71, 0x7F, 0x43, 0x05, 0x3F, 0xC2 },
 587     "MGUxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsT"
 588     "EHd3dy5kaWdpY2VydC5jb20xJDAiBgNVBAMTG0RpZ2lDZXJ0IEFzc3VyZWQgSUQg"
 589     "Um9vdCBHMw==",
 590     "C6Fa+h3foLVJRK/NJKBs7A==",
 591   },
 592   {
 593     // CN=DigiCert Global Root G2,OU=www.digicert.com,O=DigiCert Inc,C=US
 594     "2.16.840.1.114412.2.1",
 595     "DigiCert EV OID",
 596     { 0xCB, 0x3C, 0xCB, 0xB7, 0x60, 0x31, 0xE5, 0xE0, 0x13, 0x8F, 0x8D,
 597       0xD3, 0x9A, 0x23, 0xF9, 0xDE, 0x47, 0xFF, 0xC3, 0x5E, 0x43, 0xC1,
 598       0x14, 0x4C, 0xEA, 0x27, 0xD4, 0x6A, 0x5A, 0xB1, 0xCB, 0x5F },
 599     "MGExCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsT"
 600     "EHd3dy5kaWdpY2VydC5jb20xIDAeBgNVBAMTF0RpZ2lDZXJ0IEdsb2JhbCBSb290"
 601     "IEcy",
 602     "Azrx5qcRqaC7KGSxHQn65Q==",
 603   },
 604   {
 605     // CN=DigiCert Global Root G3,OU=www.digicert.com,O=DigiCert Inc,C=US
 606     "2.16.840.1.114412.2.1",
 607     "DigiCert EV OID",
 608     { 0x31, 0xAD, 0x66, 0x48, 0xF8, 0x10, 0x41, 0x38, 0xC7, 0x38, 0xF3,
 609       0x9E, 0xA4, 0x32, 0x01, 0x33, 0x39, 0x3E, 0x3A, 0x18, 0xCC, 0x02,
 610       0x29, 0x6E, 0xF9, 0x7C, 0x2A, 0xC9, 0xEF, 0x67, 0x31, 0xD0 },
 611     "MGExCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsT"
 612     "EHd3dy5kaWdpY2VydC5jb20xIDAeBgNVBAMTF0RpZ2lDZXJ0IEdsb2JhbCBSb290"
 613     "IEcz",
 614     "BVVWvPJepDU1w6QP1atFcg==",
 615   },
 616   {
 617     // CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
 618     "2.16.840.1.114412.2.1",
 619     "DigiCert EV OID",
 620     { 0x55, 0x2F, 0x7B, 0xDC, 0xF1, 0xA7, 0xAF, 0x9E, 0x6C, 0xE6, 0x72,
 621       0x01, 0x7F, 0x4F, 0x12, 0xAB, 0xF7, 0x72, 0x40, 0xC7, 0x8E, 0x76,
 622       0x1A, 0xC2, 0x03, 0xD1, 0xD9, 0xD2, 0x0A, 0xC8, 0x99, 0x88 },
 623     "MGIxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsT"
 624     "EHd3dy5kaWdpY2VydC5jb20xITAfBgNVBAMTGERpZ2lDZXJ0IFRydXN0ZWQgUm9v"
 625     "dCBHNA==",
 626     "BZsbV56OITLiOQe9p3d1XA==",
 627   },
 628   {
 629     // CN=QuoVadis Root CA 2 G3,O=QuoVadis Limited,C=BM
 630     "1.3.6.1.4.1.8024.0.2.100.1.2",
 631     "QuoVadis EV OID",
 632     { 0x8F, 0xE4, 0xFB, 0x0A, 0xF9, 0x3A, 0x4D, 0x0D, 0x67, 0xDB, 0x0B,
 633       0xEB, 0xB2, 0x3E, 0x37, 0xC7, 0x1B, 0xF3, 0x25, 0xDC, 0xBC, 0xDD,
 634       0x24, 0x0E, 0xA0, 0x4D, 0xAF, 0x58, 0xB4, 0x7E, 0x18, 0x40 },
 635     "MEgxCzAJBgNVBAYTAkJNMRkwFwYDVQQKExBRdW9WYWRpcyBMaW1pdGVkMR4wHAYD"
 636     "VQQDExVRdW9WYWRpcyBSb290IENBIDIgRzM=",
 637     "RFc0JFuBiZs18s64KztbpybwdSg=",
 638   },
 639   {
 640     // CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
 641     "1.3.6.1.4.1.6449.1.2.1.5.1",
 642     "Comodo EV OID",
 643     { 0x52, 0xF0, 0xE1, 0xC4, 0xE5, 0x8E, 0xC6, 0x29, 0x29, 0x1B, 0x60,
 644       0x31, 0x7F, 0x07, 0x46, 0x71, 0xB8, 0x5D, 0x7E, 0xA8, 0x0D, 0x5B,
 645       0x07, 0x27, 0x34, 0x63, 0x53, 0x4B, 0x32, 0xB4, 0x02, 0x34 },
 646     "MIGFMQswCQYDVQQGEwJHQjEbMBkGA1UECBMSR3JlYXRlciBNYW5jaGVzdGVyMRAw"
 647     "DgYDVQQHEwdTYWxmb3JkMRowGAYDVQQKExFDT01PRE8gQ0EgTGltaXRlZDErMCkG"
 648     "A1UEAxMiQ09NT0RPIFJTQSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eQ==",
 649     "TKr5yttjb+Af907YWwOGnQ==",
 650   },
 651   {
 652     // CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
 653     "1.3.6.1.4.1.6449.1.2.1.5.1",
 654     "Comodo EV OID",
 655     { 0xE7, 0x93, 0xC9, 0xB0, 0x2F, 0xD8, 0xAA, 0x13, 0xE2, 0x1C, 0x31,
 656       0x22, 0x8A, 0xCC, 0xB0, 0x81, 0x19, 0x64, 0x3B, 0x74, 0x9C, 0x89,
 657       0x89, 0x64, 0xB1, 0x74, 0x6D, 0x46, 0xC3, 0xD4, 0xCB, 0xD2 },
 658     "MIGIMQswCQYDVQQGEwJVUzETMBEGA1UECBMKTmV3IEplcnNleTEUMBIGA1UEBxML"
 659     "SmVyc2V5IENpdHkxHjAcBgNVBAoTFVRoZSBVU0VSVFJVU1QgTmV0d29yazEuMCwG"
 660     "A1UEAxMlVVNFUlRydXN0IFJTQSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eQ==",
 661     "Af1tMPyjylGoG7xkDjUDLQ==",
 662   },
 663   {
 664     // CN=USERTrust ECC Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
 665     "1.3.6.1.4.1.6449.1.2.1.5.1",
 666     "Comodo EV OID",
 667     { 0x4F, 0xF4, 0x60, 0xD5, 0x4B, 0x9C, 0x86, 0xDA, 0xBF, 0xBC, 0xFC,
 668       0x57, 0x12, 0xE0, 0x40, 0x0D, 0x2B, 0xED, 0x3F, 0xBC, 0x4D, 0x4F,
 669       0xBD, 0xAA, 0x86, 0xE0, 0x6A, 0xDC, 0xD2, 0xA9, 0xAD, 0x7A },
 670     "MIGIMQswCQYDVQQGEwJVUzETMBEGA1UECBMKTmV3IEplcnNleTEUMBIGA1UEBxML"
 671     "SmVyc2V5IENpdHkxHjAcBgNVBAoTFVRoZSBVU0VSVFJVU1QgTmV0d29yazEuMCwG"
 672     "A1UEAxMlVVNFUlRydXN0IEVDQyBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eQ==",
 673     "XIuZxVqUxdJxVt7NiYDMJg==",
 674   },
 675   {
 676     // CN=GlobalSign,O=GlobalSign,OU=GlobalSign ECC Root CA - R5
 677     "2.23.140.1.1",
 678     "CA/Browser Forum EV OID",
 679     { 0x17, 0x9F, 0xBC, 0x14, 0x8A, 0x3D, 0xD0, 0x0F, 0xD2, 0x4E, 0xA1,
 680       0x34, 0x58, 0xCC, 0x43, 0xBF, 0xA7, 0xF5, 0x9C, 0x81, 0x82, 0xD7,
 681       0x83, 0xA5, 0x13, 0xF6, 0xEB, 0xEC, 0x10, 0x0C, 0x89, 0x24 },
 682     "MFAxJDAiBgNVBAsTG0dsb2JhbFNpZ24gRUNDIFJvb3QgQ0EgLSBSNTETMBEGA1UE"
 683     "ChMKR2xvYmFsU2lnbjETMBEGA1UEAxMKR2xvYmFsU2lnbg==",
 684     "YFlJ4CYuu1X5CneKcflK2Gw=",
 685   },
 686   {
 687     // CN=GlobalSign,O=GlobalSign,OU=GlobalSign Root CA - R6
 688     "2.23.140.1.1",
 689     "CA/Browser Forum EV OID",
 690     { 0x2C, 0xAB, 0xEA, 0xFE, 0x37, 0xD0, 0x6C, 0xA2, 0x2A, 0xBA, 0x73,
 691       0x91, 0xC0, 0x03, 0x3D, 0x25, 0x98, 0x29, 0x52, 0xC4, 0x53, 0x64,
 692       0x73, 0x49, 0x76, 0x3A, 0x3A, 0xB5, 0xAD, 0x6C, 0xCF, 0x69 },
 693     "MEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAtIFI2MRMwEQYDVQQKEwpH"
 694     "bG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWdu",
 695     "Rea7A4Mzw4VlSOb/RVE=",
 696   },
 697   {
 698     // CN=Entrust.net Certification Authority (2048),OU=(c) 1999 Entrust.net Limited,OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.),O=Entrust.net
 699     "2.16.840.1.114028.10.1.2",
 700     "Entrust EV OID",
 701     { 0x6D, 0xC4, 0x71, 0x72, 0xE0, 0x1C, 0xBC, 0xB0, 0xBF, 0x62, 0x58,
 702       0x0D, 0x89, 0x5F, 0xE2, 0xB8, 0xAC, 0x9A, 0xD4, 0xF8, 0x73, 0x80,
 703       0x1E, 0x0C, 0x10, 0xB9, 0xC8, 0x37, 0xD2, 0x1E, 0xB1, 0x77 },
 704     "MIG0MRQwEgYDVQQKEwtFbnRydXN0Lm5ldDFAMD4GA1UECxQ3d3d3LmVudHJ1c3Qu"
 705     "bmV0L0NQU18yMDQ4IGluY29ycC4gYnkgcmVmLiAobGltaXRzIGxpYWIuKTElMCMG"
 706     "A1UECxMcKGMpIDE5OTkgRW50cnVzdC5uZXQgTGltaXRlZDEzMDEGA1UEAxMqRW50"
 707     "cnVzdC5uZXQgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgKDIwNDgp",
 708     "OGPe+A==",
 709   },
 710   {
 711     // CN=Staat der Nederlanden EV Root CA,O=Staat der Nederlanden,C=NL
 712     "2.16.528.1.1003.1.2.7",
 713     "Staat der Nederlanden EV OID",
 714     { 0x4D, 0x24, 0x91, 0x41, 0x4C, 0xFE, 0x95, 0x67, 0x46, 0xEC, 0x4C,
 715       0xEF, 0xA6, 0xCF, 0x6F, 0x72, 0xE2, 0x8A, 0x13, 0x29, 0x43, 0x2F,
 716       0x9D, 0x8A, 0x90, 0x7A, 0xC4, 0xCB, 0x5D, 0xAD, 0xC1, 0x5A },
 717     "MFgxCzAJBgNVBAYTAk5MMR4wHAYDVQQKDBVTdGFhdCBkZXIgTmVkZXJsYW5kZW4x"
 718     "KTAnBgNVBAMMIFN0YWF0IGRlciBOZWRlcmxhbmRlbiBFViBSb290IENB",
 719     "AJiWjQ==",
 720   },
 721   {
 722     // CN=Entrust Root Certification Authority - G2,OU="(c) 2009 Entrust, Inc. - for authorized use only",OU=See www.entrust.net/legal-terms,O="Entrust, Inc.",C=US
 723     "2.16.840.1.114028.10.1.2",
 724     "Entrust EV OID",
 725     { 0x43, 0xDF, 0x57, 0x74, 0xB0, 0x3E, 0x7F, 0xEF, 0x5F, 0xE4, 0x0D,
 726       0x93, 0x1A, 0x7B, 0xED, 0xF1, 0xBB, 0x2E, 0x6B, 0x42, 0x73, 0x8C,
 727       0x4E, 0x6D, 0x38, 0x41, 0x10, 0x3D, 0x3A, 0xA7, 0xF3, 0x39 },
 728     "MIG+MQswCQYDVQQGEwJVUzEWMBQGA1UEChMNRW50cnVzdCwgSW5jLjEoMCYGA1UE"
 729     "CxMfU2VlIHd3dy5lbnRydXN0Lm5ldC9sZWdhbC10ZXJtczE5MDcGA1UECxMwKGMp"
 730     "IDIwMDkgRW50cnVzdCwgSW5jLiAtIGZvciBhdXRob3JpemVkIHVzZSBvbmx5MTIw"
 731     "MAYDVQQDEylFbnRydXN0IFJvb3QgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgLSBH"
 732     "Mg==",
 733     "SlOMKA==",
 734   },
 735   {
 736     // CN=Entrust Root Certification Authority - EC1,OU="(c) 2012 Entrust, Inc. - for authorized use only",OU=See www.entrust.net/legal-terms,O="Entrust, Inc.",C=US
 737     "2.16.840.1.114028.10.1.2",
 738     "Entrust EV OID",
 739     { 0x02, 0xED, 0x0E, 0xB2, 0x8C, 0x14, 0xDA, 0x45, 0x16, 0x5C, 0x56,
 740       0x67, 0x91, 0x70, 0x0D, 0x64, 0x51, 0xD7, 0xFB, 0x56, 0xF0, 0xB2,
 741       0xAB, 0x1D, 0x3B, 0x8E, 0xB0, 0x70, 0xE5, 0x6E, 0xDF, 0xF5 },
 742     "MIG/MQswCQYDVQQGEwJVUzEWMBQGA1UEChMNRW50cnVzdCwgSW5jLjEoMCYGA1UE"
 743     "CxMfU2VlIHd3dy5lbnRydXN0Lm5ldC9sZWdhbC10ZXJtczE5MDcGA1UECxMwKGMp"
 744     "IDIwMTIgRW50cnVzdCwgSW5jLiAtIGZvciBhdXRob3JpemVkIHVzZSBvbmx5MTMw"
 745     "MQYDVQQDEypFbnRydXN0IFJvb3QgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgLSBF"
 746     "QzE=",
 747     "AKaLeSkAAAAAUNCR+Q==",
 748   },
 749   {
 750     // CN=CFCA EV ROOT,O=China Financial Certification Authority,C=CN
 751     "2.16.156.112554.3",
 752     "CFCA EV OID",
 753     { 0x5C, 0xC3, 0xD7, 0x8E, 0x4E, 0x1D, 0x5E, 0x45, 0x54, 0x7A, 0x04,
 754       0xE6, 0x87, 0x3E, 0x64, 0xF9, 0x0C, 0xF9, 0x53, 0x6D, 0x1C, 0xCC,
 755       0x2E, 0xF8, 0x00, 0xF3, 0x55, 0xC4, 0xC5, 0xFD, 0x70, 0xFD },
 756     "MFYxCzAJBgNVBAYTAkNOMTAwLgYDVQQKDCdDaGluYSBGaW5hbmNpYWwgQ2VydGlm"
 757     "aWNhdGlvbiBBdXRob3JpdHkxFTATBgNVBAMMDENGQ0EgRVYgUk9PVA==",
 758     "GErM1g==",
 759   },
 760   {
 761     // OU=Security Communication RootCA2,O="SECOM Trust Systems CO.,LTD.",C=JP
 762     "1.2.392.200091.100.721.1",
 763     "SECOM EV OID",
 764     { 0x51, 0x3B, 0x2C, 0xEC, 0xB8, 0x10, 0xD4, 0xCD, 0xE5, 0xDD, 0x85,
 765       0x39, 0x1A, 0xDF, 0xC6, 0xC2, 0xDD, 0x60, 0xD8, 0x7B, 0xB7, 0x36,
 766       0xD2, 0xB5, 0x21, 0x48, 0x4A, 0xA4, 0x7A, 0x0E, 0xBE, 0xF6 },
 767     "MF0xCzAJBgNVBAYTAkpQMSUwIwYDVQQKExxTRUNPTSBUcnVzdCBTeXN0ZW1zIENP"
 768     "LixMVEQuMScwJQYDVQQLEx5TZWN1cml0eSBDb21tdW5pY2F0aW9uIFJvb3RDQTI=",
 769     "AA==",
 770   },
 771   {
 772     // CN=OISTE WISeKey Global Root GB CA,OU=OISTE Foundation Endorsed,O=WISeKey,C=CH
 773     "2.16.756.5.14.7.4.8",
 774     "WISeKey EV OID",
 775     { 0x6B, 0x9C, 0x08, 0xE8, 0x6E, 0xB0, 0xF7, 0x67, 0xCF, 0xAD, 0x65,
 776       0xCD, 0x98, 0xB6, 0x21, 0x49, 0xE5, 0x49, 0x4A, 0x67, 0xF5, 0x84,
 777       0x5E, 0x7B, 0xD1, 0xED, 0x01, 0x9F, 0x27, 0xB8, 0x6B, 0xD6 },
 778     "MG0xCzAJBgNVBAYTAkNIMRAwDgYDVQQKEwdXSVNlS2V5MSIwIAYDVQQLExlPSVNU"
 779     "RSBGb3VuZGF0aW9uIEVuZG9yc2VkMSgwJgYDVQQDEx9PSVNURSBXSVNlS2V5IEds"
 780     "b2JhbCBSb290IEdCIENB",
 781     "drEgUnTwhYdGs/gjGvbCwA==",
 782   },
 783   {
 784     // CN=Amazon Root CA 1,O=Amazon,C=US
 785     "2.23.140.1.1",
 786     "CA/Browser Forum EV OID",
 787     { 0x8E, 0xCD, 0xE6, 0x88, 0x4F, 0x3D, 0x87, 0xB1, 0x12, 0x5B, 0xA3,
 788       0x1A, 0xC3, 0xFC, 0xB1, 0x3D, 0x70, 0x16, 0xDE, 0x7F, 0x57, 0xCC,
 789       0x90, 0x4F, 0xE1, 0xCB, 0x97, 0xC6, 0xAE, 0x98, 0x19, 0x6E },
 790     "MDkxCzAJBgNVBAYTAlVTMQ8wDQYDVQQKEwZBbWF6b24xGTAXBgNVBAMTEEFtYXpv"
 791     "biBSb290IENBIDE=",
 792     "Bmyfz5m/jAo54vB4ikPmljZbyg==",
 793   },
 794   {
 795     // CN=Amazon Root CA 2,O=Amazon,C=US
 796     "2.23.140.1.1",
 797     "CA/Browser Forum EV OID",
 798     { 0x1B, 0xA5, 0xB2, 0xAA, 0x8C, 0x65, 0x40, 0x1A, 0x82, 0x96, 0x01,
 799       0x18, 0xF8, 0x0B, 0xEC, 0x4F, 0x62, 0x30, 0x4D, 0x83, 0xCE, 0xC4,
 800       0x71, 0x3A, 0x19, 0xC3, 0x9C, 0x01, 0x1E, 0xA4, 0x6D, 0xB4 },
 801     "MDkxCzAJBgNVBAYTAlVTMQ8wDQYDVQQKEwZBbWF6b24xGTAXBgNVBAMTEEFtYXpv"
 802     "biBSb290IENBIDI=",
 803     "Bmyf0pY1hp8KD+WGePhbJruKNw==",
 804   },
 805   {
 806     // CN=Amazon Root CA 3,O=Amazon,C=US
 807     "2.23.140.1.1",
 808     "CA/Browser Forum EV OID",
 809     { 0x18, 0xCE, 0x6C, 0xFE, 0x7B, 0xF1, 0x4E, 0x60, 0xB2, 0xE3, 0x47,
 810       0xB8, 0xDF, 0xE8, 0x68, 0xCB, 0x31, 0xD0, 0x2E, 0xBB, 0x3A, 0xDA,
 811       0x27, 0x15, 0x69, 0xF5, 0x03, 0x43, 0xB4, 0x6D, 0xB3, 0xA4 },
 812     "MDkxCzAJBgNVBAYTAlVTMQ8wDQYDVQQKEwZBbWF6b24xGTAXBgNVBAMTEEFtYXpv"
 813     "biBSb290IENBIDM=",
 814     "Bmyf1XSXNmY/Owua2eiedgPySg==",
 815   },
 816   {
 817     // CN=Amazon Root CA 4,O=Amazon,C=US
 818     "2.23.140.1.1",
 819     "CA/Browser Forum EV OID",
 820     { 0xE3, 0x5D, 0x28, 0x41, 0x9E, 0xD0, 0x20, 0x25, 0xCF, 0xA6, 0x90,
 821       0x38, 0xCD, 0x62, 0x39, 0x62, 0x45, 0x8D, 0xA5, 0xC6, 0x95, 0xFB,
 822       0xDE, 0xA3, 0xC2, 0x2B, 0x0B, 0xFB, 0x25, 0x89, 0x70, 0x92 },
 823     "MDkxCzAJBgNVBAYTAlVTMQ8wDQYDVQQKEwZBbWF6b24xGTAXBgNVBAMTEEFtYXpv"
 824     "biBSb290IENBIDQ=",
 825     "Bmyf18G7EEwpQ+Vxe3ssyBrBDg==",
 826   },
 827   {
 828     // CN=Starfield Services Root Certificate Authority - G2,O="Starfield Technologies, Inc.",L=Scottsdale,ST=Arizona,C=US
 829     "2.23.140.1.1",
 830     "CA/Browser Forum EV OID",
 831     { 0x56, 0x8D, 0x69, 0x05, 0xA2, 0xC8, 0x87, 0x08, 0xA4, 0xB3, 0x02,
 832       0x51, 0x90, 0xED, 0xCF, 0xED, 0xB1, 0x97, 0x4A, 0x60, 0x6A, 0x13,
 833       0xC6, 0xE5, 0x29, 0x0F, 0xCB, 0x2A, 0xE6, 0x3E, 0xDA, 0xB5 },
 834     "MIGYMQswCQYDVQQGEwJVUzEQMA4GA1UECBMHQXJpem9uYTETMBEGA1UEBxMKU2Nv"
 835     "dHRzZGFsZTElMCMGA1UEChMcU3RhcmZpZWxkIFRlY2hub2xvZ2llcywgSW5jLjE7"
 836     "MDkGA1UEAxMyU3RhcmZpZWxkIFNlcnZpY2VzIFJvb3QgQ2VydGlmaWNhdGUgQXV0"
 837     "aG9yaXR5IC0gRzI=",
 838     "AA==",
 839   },
 840   {
 841     // CN=LuxTrust Global Root 2,O=LuxTrust S.A.,C=LU
 842     "1.3.171.1.1.10.5.2",
 843     "LuxTrust EV OID",
 844     { 0x54, 0x45, 0x5F, 0x71, 0x29, 0xC2, 0x0B, 0x14, 0x47, 0xC4, 0x18,
 845       0xF9, 0x97, 0x16, 0x8F, 0x24, 0xC5, 0x8F, 0xC5, 0x02, 0x3B, 0xF5,
 846       0xDA, 0x5B, 0xE2, 0xEB, 0x6E, 0x1D, 0xD8, 0x90, 0x2E, 0xD5 },
 847     "MEYxCzAJBgNVBAYTAkxVMRYwFAYDVQQKDA1MdXhUcnVzdCBTLkEuMR8wHQYDVQQD"
 848     "DBZMdXhUcnVzdCBHbG9iYWwgUm9vdCAy",
 849     "Cn6m30tEntpqJIWe5rgV0xZ/u7E=",
 850   },
 851   {
 852     // CN=GDCA TrustAUTH R5 ROOT,O="GUANG DONG CERTIFICATE AUTHORITY CO.,LTD.",C=CN
 853     "1.2.156.112559.1.1.6.1",
 854     "GDCA EV OID",
 855     { 0xBF, 0xFF, 0x8F, 0xD0, 0x44, 0x33, 0x48, 0x7D, 0x6A, 0x8A, 0xA6,
 856       0x0C, 0x1A, 0x29, 0x76, 0x7A, 0x9F, 0xC2, 0xBB, 0xB0, 0x5E, 0x42,
 857       0x0F, 0x71, 0x3A, 0x13, 0xB9, 0x92, 0x89, 0x1D, 0x38, 0x93 },
 858     "MGIxCzAJBgNVBAYTAkNOMTIwMAYDVQQKDClHVUFORyBET05HIENFUlRJRklDQVRF"
 859     "IEFVVEhPUklUWSBDTy4sTFRELjEfMB0GA1UEAwwWR0RDQSBUcnVzdEFVVEggUjUg"
 860     "Uk9PVA==",
 861     "fQmX/vBH6no=",
 862   },
 863   {
 864     // CN=SSL.com EV Root Certification Authority ECC,O=SSL Corporation,L=Houston,ST=Texas,C=US
 865     "2.23.140.1.1",
 866     "CA/Browser Forum EV OID",
 867     { 0x22, 0xA2, 0xC1, 0xF7, 0xBD, 0xED, 0x70, 0x4C, 0xC1, 0xE7, 0x01,
 868       0xB5, 0xF4, 0x08, 0xC3, 0x10, 0x88, 0x0F, 0xE9, 0x56, 0xB5, 0xDE,
 869       0x2A, 0x4A, 0x44, 0xF9, 0x9C, 0x87, 0x3A, 0x25, 0xA7, 0xC8 },
 870     "MH8xCzAJBgNVBAYTAlVTMQ4wDAYDVQQIDAVUZXhhczEQMA4GA1UEBwwHSG91c3Rv"
 871     "bjEYMBYGA1UECgwPU1NMIENvcnBvcmF0aW9uMTQwMgYDVQQDDCtTU0wuY29tIEVW"
 872     "IFJvb3QgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgRUND",
 873     "LCmcWxbtBZU=",
 874   },
 875   {
 876     // CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US
 877     "2.23.140.1.1",
 878     "CA/Browser Forum EV OID",
 879     { 0x2E, 0x7B, 0xF1, 0x6C, 0xC2, 0x24, 0x85, 0xA7, 0xBB, 0xE2, 0xAA,
 880       0x86, 0x96, 0x75, 0x07, 0x61, 0xB0, 0xAE, 0x39, 0xBE, 0x3B, 0x2F,
 881       0xE9, 0xD0, 0xCC, 0x6D, 0x4E, 0xF7, 0x34, 0x91, 0x42, 0x5C },
 882     "MIGCMQswCQYDVQQGEwJVUzEOMAwGA1UECAwFVGV4YXMxEDAOBgNVBAcMB0hvdXN0"
 883     "b24xGDAWBgNVBAoMD1NTTCBDb3Jwb3JhdGlvbjE3MDUGA1UEAwwuU1NMLmNvbSBF"
 884     "ViBSb290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IFJTQSBSMg==",
 885     "VrYpzTS8ePY=",
 886   },
 887   {
 888     // CN=UCA Extended Validation Root,O=UniTrust,C=CN
 889     "2.23.140.1.1",
 890     "CA/Browser Forum EV OID",
 891     { 0xD4, 0x3A, 0xF9, 0xB3, 0x54, 0x73, 0x75, 0x5C, 0x96, 0x84, 0xFC,
 892       0x06, 0xD7, 0xD8, 0xCB, 0x70, 0xEE, 0x5C, 0x28, 0xE7, 0x73, 0xFB,
 893       0x29, 0x4E, 0xB4, 0x1E, 0xE7, 0x17, 0x22, 0x92, 0x4D, 0x24 },
 894     "MEcxCzAJBgNVBAYTAkNOMREwDwYDVQQKDAhVbmlUcnVzdDElMCMGA1UEAwwcVUNB"
 895     "IEV4dGVuZGVkIFZhbGlkYXRpb24gUm9vdA==",
 896     "T9Irj/VkyDOeTzRYZiNwYA==",
 897   },
 898   {
 899     // CN=Hongkong Post Root CA 3,O=Hongkong Post,L=Hong Kong,ST=Hong Kong,C=HK
 900     "2.23.140.1.1",
 901     "CA/Browser Forum EV OID",
 902     { 0x5A, 0x2F, 0xC0, 0x3F, 0x0C, 0x83, 0xB0, 0x90, 0xBB, 0xFA, 0x40,
 903       0x60, 0x4B, 0x09, 0x88, 0x44, 0x6C, 0x76, 0x36, 0x18, 0x3D, 0xF9,
 904       0x84, 0x6E, 0x17, 0x10, 0x1A, 0x44, 0x7F, 0xB8, 0xEF, 0xD6 },
 905     "MG8xCzAJBgNVBAYTAkhLMRIwEAYDVQQIEwlIb25nIEtvbmcxEjAQBgNVBAcTCUhv"
 906     "bmcgS29uZzEWMBQGA1UEChMNSG9uZ2tvbmcgUG9zdDEgMB4GA1UEAxMXSG9uZ2tv"
 907     "bmcgUG9zdCBSb290IENBIDM=",
 908     "CBZfikyl7ADJk0DfxMauI7gcWqQ=",
 909   },
 910   {
 911     // CN=emSign Root CA - G1,O=eMudhra Technologies Limited,OU=emSign PKI,C=IN
 912     "2.23.140.1.1",
 913     "CA/Browser Forum EV OID",
 914     { 0x40, 0xF6, 0xAF, 0x03, 0x46, 0xA9, 0x9A, 0xA1, 0xCD, 0x1D, 0x55,
 915       0x5A, 0x4E, 0x9C, 0xCE, 0x62, 0xC7, 0xF9, 0x63, 0x46, 0x03, 0xEE,
 916       0x40, 0x66, 0x15, 0x83, 0x3D, 0xC8, 0xC8, 0xD0, 0x03, 0x67 },
 917     "MGcxCzAJBgNVBAYTAklOMRMwEQYDVQQLEwplbVNpZ24gUEtJMSUwIwYDVQQKExxl"
 918     "TXVkaHJhIFRlY2hub2xvZ2llcyBMaW1pdGVkMRwwGgYDVQQDExNlbVNpZ24gUm9v"
 919     "dCBDQSAtIEcx",
 920     "MfXkYgxsWO3W2A==",
 921   },
 922   {
 923     // CN=emSign ECC Root CA - G3,O=eMudhra Technologies Limited,OU=emSign PKI,C=IN
 924     "2.23.140.1.1",
 925     "CA/Browser Forum EV OID",
 926     { 0x86, 0xA1, 0xEC, 0xBA, 0x08, 0x9C, 0x4A, 0x8D, 0x3B, 0xBE, 0x27,
 927       0x34, 0xC6, 0x12, 0xBA, 0x34, 0x1D, 0x81, 0x3E, 0x04, 0x3C, 0xF9,
 928       0xE8, 0xA8, 0x62, 0xCD, 0x5C, 0x57, 0xA3, 0x6B, 0xBE, 0x6B },
 929     "MGsxCzAJBgNVBAYTAklOMRMwEQYDVQQLEwplbVNpZ24gUEtJMSUwIwYDVQQKExxl"
 930     "TXVkaHJhIFRlY2hub2xvZ2llcyBMaW1pdGVkMSAwHgYDVQQDExdlbVNpZ24gRUND"
 931     "IFJvb3QgQ0EgLSBHMw==",
 932     "PPYHqWhwDtqLhA==",
 933   },
 934   {
 935     // CN=emSign Root CA - C1,O=eMudhra Inc,OU=emSign PKI,C=US
 936     "2.23.140.1.1",
 937     "CA/Browser Forum EV OID",
 938     { 0x12, 0x56, 0x09, 0xAA, 0x30, 0x1D, 0xA0, 0xA2, 0x49, 0xB9, 0x7A,
 939       0x82, 0x39, 0xCB, 0x6A, 0x34, 0x21, 0x6F, 0x44, 0xDC, 0xAC, 0x9F,
 940       0x39, 0x54, 0xB1, 0x42, 0x92, 0xF2, 0xE8, 0xC8, 0x60, 0x8F },
 941     "MFYxCzAJBgNVBAYTAlVTMRMwEQYDVQQLEwplbVNpZ24gUEtJMRQwEgYDVQQKEwtl"
 942     "TXVkaHJhIEluYzEcMBoGA1UEAxMTZW1TaWduIFJvb3QgQ0EgLSBDMQ==",
 943     "AK7PALrEzzL4Q7I=",
 944     },
 945   {
 946     // CN=emSign ECC Root CA - C3,O=eMudhra Inc,OU=emSign PKI,C=US
 947     "2.23.140.1.1",
 948     "CA/Browser Forum EV OID",
 949     { 0xBC, 0x4D, 0x80, 0x9B, 0x15, 0x18, 0x9D, 0x78, 0xDB, 0x3E, 0x1D,
 950       0x8C, 0xF4, 0xF9, 0x72, 0x6A, 0x79, 0x5D, 0xA1, 0x64, 0x3C, 0xA5,
 951       0xF1, 0x35, 0x8E, 0x1D, 0xDB, 0x0E, 0xDC, 0x0D, 0x7E, 0xB3 },
 952     "MFoxCzAJBgNVBAYTAlVTMRMwEQYDVQQLEwplbVNpZ24gUEtJMRQwEgYDVQQKEwtl"
 953     "TXVkaHJhIEluYzEgMB4GA1UEAxMXZW1TaWduIEVDQyBSb290IENBIC0gQzM=",
 954     "e3G2gla4EnycqA==",
 955   },
 956     // clang-format on
 957 };
 958
 959 static SECOidTag sEVInfoOIDTags[ArrayLength(kEVInfos)];
 960
 961 static_assert(SEC_OID_UNKNOWN == 0,
 962               "We depend on zero-initialized globals being interpreted as "
 963               "SEC_OID_UNKNOWN.");
 964 static_assert(
 965     ArrayLength(sEVInfoOIDTags) == ArrayLength(kEVInfos),
 966     "These arrays are used in parallel and must have the same length.");
 967
 968 static SECOidTag RegisterOID(const SECItem& oidItem, const char* oidName) {
 969   SECOidData od;
 970   od.oid.len = oidItem.len;
 971   od.oid.data = oidItem.data;
 972   od.offset = SEC_OID_UNKNOWN;
 973   od.desc = oidName;
 974   od.mechanism = CKM_INVALID_MECHANISM;
 975   od.supportedExtension = INVALID_CERT_EXTENSION;
 976   return SECOID_AddEntry(&od);
 977 }
 978
 979 static SECOidTag sCABForumEVOIDTag = SEC_OID_UNKNOWN;
 980
 981 static bool isEVPolicy(SECOidTag policyOIDTag) {
 982   if (policyOIDTag != SEC_OID_UNKNOWN && policyOIDTag == sCABForumEVOIDTag) {
 983     return true;
 984   }
 985
 986   for (const SECOidTag& oidTag : sEVInfoOIDTags) {
 987     if (policyOIDTag == oidTag) {
 988       return true;
 989     }
 990   }
 991
 992   return false;
 993 }
 994
 995 bool CertIsAuthoritativeForEVPolicy(const UniqueCERTCertificate& cert,
 996                                     const mozilla::pkix::CertPolicyId& policy) {
 997   MOZ_ASSERT(cert);
 998   if (!cert) {
 999     return false;
1000   }
1001
1002   unsigned char fingerprint[SHA256_LENGTH];
1003   SECStatus srv = PK11_HashBuf(SEC_OID_SHA256, fingerprint, cert->derCert.data,
1004                                AssertedCast<int32_t>(cert->derCert.len));
1005   if (srv != SECSuccess) {
1006     return false;
1007   }
1008
1009   const SECOidData* cabforumOIDData = SECOID_FindOIDByTag(sCABForumEVOIDTag);
1010   for (size_t i = 0; i < ArrayLength(kEVInfos); ++i) {
1011     const EVInfo& entry = kEVInfos[i];
1012
1013     // This check ensures that only the specific roots we approve for EV get
1014     // that status, and not certs (roots or otherwise) that happen to have an
1015     // OID that's already been approved for EV.
1016     if (!ArrayEqual(fingerprint, entry.sha256Fingerprint)) {
1017       continue;
1018     }
1019
1020     if (cabforumOIDData && cabforumOIDData->oid.len == policy.numBytes &&
1021         ArrayEqual(cabforumOIDData->oid.data, policy.bytes, policy.numBytes)) {
1022       return true;
1023     }
1024     const SECOidData* oidData = SECOID_FindOIDByTag(sEVInfoOIDTags[i]);
1025     if (oidData && oidData->oid.len == policy.numBytes &&
1026         ArrayEqual(oidData->oid.data, policy.bytes, policy.numBytes)) {
1027       return true;
1028     }
1029   }
1030
1031   return false;
1032 }
1033
1034 nsresult LoadExtendedValidationInfo() {
1035   static const char* sCABForumOIDString = "2.23.140.1.1";
1036   static const char* sCABForumOIDDescription = "CA/Browser Forum EV OID";
1037
1038   ScopedAutoSECItem cabforumOIDItem;
1039   if (SEC_StringToOID(nullptr, &cabforumOIDItem, sCABForumOIDString, 0) !=
1040       SECSuccess) {
1041     return NS_ERROR_FAILURE;
1042   }
1043   sCABForumEVOIDTag = RegisterOID(cabforumOIDItem, sCABForumOIDDescription);
1044   if (sCABForumEVOIDTag == SEC_OID_UNKNOWN) {
1045     return NS_ERROR_FAILURE;
1046   }
1047
1048   for (size_t i = 0; i < ArrayLength(kEVInfos); ++i) {
1049     const EVInfo& entry = kEVInfos[i];
1050
1051     SECStatus srv;
1052 #ifdef DEBUG
1053     // This section of code double-checks that we calculated the correct
1054     // certificate hash given the issuer and serial number and that it is
1055     // actually present in our loaded root certificates module. It is
1056     // unnecessary to check this in non-debug builds since we will safely fall
1057     // back to DV if the EV information is incorrect.
1058     nsAutoCString derIssuer;
1059     nsresult rv =
1060         Base64Decode(nsDependentCString(entry.issuerBase64), derIssuer);
1061     MOZ_ASSERT(NS_SUCCEEDED(rv), "Could not base64-decode built-in EV issuer");
1062     if (NS_FAILED(rv)) {
1063       return rv;
1064     }
1065
1066     nsAutoCString serialNumber;
1067     rv = Base64Decode(nsDependentCString(entry.serialBase64), serialNumber);
1068     MOZ_ASSERT(NS_SUCCEEDED(rv), "Could not base64-decode built-in EV serial");
1069     if (NS_FAILED(rv)) {
1070       return rv;
1071     }
1072
1073     CERTIssuerAndSN ias;
1074     ias.derIssuer.data =
1075         BitwiseCast<unsigned char*, const char*>(derIssuer.get());
1076     ias.derIssuer.len = derIssuer.Length();
1077     ias.serialNumber.data =
1078         BitwiseCast<unsigned char*, const char*>(serialNumber.get());
1079     ias.serialNumber.len = serialNumber.Length();
1080     ias.serialNumber.type = siUnsignedInteger;
1081
1082     UniqueCERTCertificate cert(CERT_FindCertByIssuerAndSN(nullptr, &ias));
1083
1084     // If an entry is missing in the NSS root database, it may be because the
1085     // root database is out of sync with what we expect (e.g. a different
1086     // version of system NSS is installed).
1087     if (!cert) {
1088       // The entries for the debug EV roots are at indices 0 through
1089       // NUM_TEST_EV_ROOTS - 1. Since they're not built-in, they probably
1090       // haven't been loaded yet.
1091       MOZ_ASSERT(i < NUM_TEST_EV_ROOTS, "Could not find built-in EV root");
1092     } else {
1093       unsigned char certFingerprint[SHA256_LENGTH];
1094       srv = PK11_HashBuf(SEC_OID_SHA256, certFingerprint, cert->derCert.data,
1095                          AssertedCast<int32_t>(cert->derCert.len));
1096       MOZ_ASSERT(srv == SECSuccess, "Could not hash EV root");
1097       if (srv != SECSuccess) {
1098         return NS_ERROR_FAILURE;
1099       }
1100       bool same = ArrayEqual(certFingerprint, entry.sha256Fingerprint);
1101       MOZ_ASSERT(same, "EV root fingerprint mismatch");
1102       if (!same) {
1103         return NS_ERROR_FAILURE;
1104       }
1105     }
1106 #endif
1107     // This is the code that actually enables these roots for EV.
1108     ScopedAutoSECItem evOIDItem;
1109     srv = SEC_StringToOID(nullptr, &evOIDItem, entry.dottedOid, 0);
1110     MOZ_ASSERT(srv == SECSuccess, "SEC_StringToOID failed");
1111     if (srv != SECSuccess) {
1112       return NS_ERROR_FAILURE;
1113     }
1114     sEVInfoOIDTags[i] = RegisterOID(evOIDItem, entry.oidName);
1115     if (sEVInfoOIDTags[i] == SEC_OID_UNKNOWN) {
1116       return NS_ERROR_FAILURE;
1117     }
1118   }
1119
1120   return NS_OK;
1121 }
1122
1123 // Helper function for GetFirstEVPolicy(): returns the first suitable policy
1124 // from the given list of policies.
1125 bool GetFirstEVPolicyFromPolicyList(
1126     const UniqueCERTCertificatePolicies& policies,
1127     /*out*/ mozilla::pkix::CertPolicyId& policy,
1128     /*out*/ SECOidTag& policyOidTag) {
1129   for (size_t i = 0; policies->policyInfos[i]; i++) {
1130     const CERTPolicyInfo* policyInfo = policies->policyInfos[i];
1131     SECOidTag policyInfoOID = policyInfo->oid;
1132     if (policyInfoOID == SEC_OID_UNKNOWN || !isEVPolicy(policyInfoOID)) {
1133       continue;
1134     }
1135
1136     const SECOidData* oidData = SECOID_FindOIDByTag(policyInfoOID);
1137     MOZ_ASSERT(oidData);
1138     MOZ_ASSERT(oidData->oid.data);
1139     MOZ_ASSERT(oidData->oid.len > 0);
1140     MOZ_ASSERT(oidData->oid.len <= mozilla::pkix::CertPolicyId::MAX_BYTES);
1141     if (!oidData || !oidData->oid.data || oidData->oid.len == 0 ||
1142         oidData->oid.len > mozilla::pkix::CertPolicyId::MAX_BYTES) {
1143       continue;
1144     }
1145
1146     policy.numBytes = AssertedCast<uint16_t>(oidData->oid.len);
1147     PodCopy(policy.bytes, oidData->oid.data, policy.numBytes);
1148     policyOidTag = policyInfoOID;
1149     return true;
1150   }
1151
1152   return false;
1153 }
1154
1155 bool GetFirstEVPolicy(CERTCertificate& cert,
1156                       /*out*/ mozilla::pkix::CertPolicyId& policy,
1157                       /*out*/ SECOidTag& policyOidTag) {
1158   if (!cert.extensions) {
1159     return false;
1160   }
1161
1162   for (size_t i = 0; cert.extensions[i]; i++) {
1163     const CERTCertExtension* extension = cert.extensions[i];
1164     if (SECOID_FindOIDTag(&extension->id) !=
1165         SEC_OID_X509_CERTIFICATE_POLICIES) {
1166       continue;
1167     }
1168
1169     UniqueCERTCertificatePolicies policies(
1170         CERT_DecodeCertificatePoliciesExtension(&extension->value));
1171     if (!policies) {
1172       continue;
1173     }
1174
1175     if (GetFirstEVPolicyFromPolicyList(policies, policy, policyOidTag)) {
1176       return true;
1177     }
1178   }
1179
1180   return false;
1181 }
1182
1183 }  // namespace psm
1184 }  // namespace mozilla