security/certverifier/ExtendedValidation.cpp

   1 /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*-
   2  *
   3  * This Source Code Form is subject to the terms of the Mozilla Public
   4  * License, v. 2.0. If a copy of the MPL was not distributed with this
   5  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
   6
   7 #include "ExtendedValidation.h"
   8
   9 #include "cert.h"
  10 #include "hasht.h"
  11 #include "mozilla/ArrayUtils.h"
  12 #include "mozilla/Assertions.h"
  13 #include "mozilla/Base64.h"
  14 #include "mozilla/Casting.h"
  15 #include "mozilla/PodOperations.h"
  16 #include "mozpkix/pkixder.h"
  17 #include "mozpkix/pkixtypes.h"
  18 #include "mozpkix/pkixutil.h"
  19
  20 #include "nsDependentString.h"
  21 #include "nsString.h"
  22 #include "pk11pub.h"
  23
  24 namespace mozilla {
  25
  26 namespace psm {
  27
  28 struct EVInfo {
  29   // See bug 1338873 about making these fields const.
  30   const char* dottedOid;
  31   const char*
  32       oidName;  // Set this to null to signal an invalid structure,
  33                 // (We can't have an empty list, so we'll use a dummy entry)
  34   unsigned char sha256Fingerprint[SHA256_LENGTH];
  35   const char* issuerBase64;
  36   const char* serialBase64;
  37 };
  38
  39 // HOWTO enable additional CA root certificates for EV:
  40 //
  41 // For each combination of "root certificate" and "policy OID",
  42 // one entry must be added to the array named kEVInfos.
  43 //
  44 // We use the combination of "issuer name" and "serial number" to
  45 // uniquely identify the certificate. In order to avoid problems
  46 // because of encodings when comparing certificates, we don't
  47 // use plain text representation, we rather use the original encoding
  48 // as it can be found in the root certificate (in base64 format).
  49 //
  50 // We can use the NSS utility named "pp" to extract the encoding.
  51 //
  52 // Build standalone NSS including the NSS tools, then run
  53 //   pp -t certificate-identity -i the-cert-filename
  54 //
  55 // You will need the output from sections "Issuer", "Fingerprint (SHA-256)",
  56 // "Issuer DER Base64" and "Serial DER Base64".
  57 //
  58 // The new section consists of the following components:
  59 //
  60 // - a comment that should contain the human readable issuer name
  61 //   of the certificate, as printed by the pp tool
  62 // - the EV policy OID that is associated to the EV grant
  63 // - a text description of the EV policy OID. The array can contain
  64 //   multiple entries with the same OID.
  65 //   Please make sure to use the identical OID text description for
  66 //   all entries with the same policy OID (use the text search
  67 //   feature of your text editor to find duplicates).
  68 //   When adding a new policy OID that is not yet contained in the array,
  69 //   please make sure that your new description is different from
  70 //   all the other descriptions (again use the text search feature
  71 //   to be sure).
  72 // - the SHA-256 fingerprint
  73 // - the "Issuer DER Base64" as printed by the pp tool.
  74 //   Remove all whitespaces. If you use multiple lines, make sure that
  75 //   only the final line will be followed by a comma.
  76 // - the "Serial DER Base64" (as printed by pp)
  77 //
  78 // After adding an entry, test it locally against the test site that
  79 // has been provided by the CA. Note that you must use a version of NSS
  80 // where the root certificate has already been added and marked as trusted
  81 // for issuing SSL server certificates (at least).
  82 //
  83 // If you are able to connect to the site without certificate errors,
  84 // but you don't see the EV status indicator, then most likely the CA
  85 // has a problem in their infrastructure. The most common problems are
  86 // related to the CA's OCSP infrastructure, either they use an incorrect
  87 // OCSP signing certificate, or OCSP for the intermediate certificates
  88 // isn't working, or OCSP isn't working at all.
  89
  90 #ifdef DEBUG
  91 static const size_t NUM_TEST_EV_ROOTS = 2;
  92 #endif
  93
  94 static const struct EVInfo kEVInfos[] = {
  95 // clang-format off
  96   // IMPORTANT! When extending this list, if you add another entry that uses
  97   // the same dottedOid as an existing entry, use the same oidName.
  98 #ifdef DEBUG
  99   // Debug EV certificates should all use the following OID:
 100   // 1.3.6.1.4.1.13769.666.666.666.1.500.9.1.
 101   // (multiple entries with the same OID is ok)
 102   // If you add or remove debug EV certs you must also modify NUM_TEST_EV_ROOTS
 103   // so that the correct number of certs are skipped as these debug EV certs
 104   // are NOT part of the default trust store.
 105   {
 106     // This is the PSM xpcshell testing EV certificate. It can be generated
 107     // using pycert.py and the following specification:
 108     //
 109     // issuer:evroot
 110     // subject:evroot
 111     // subjectKey:ev
 112     // issuerKey:ev
 113     // validity:20150101-20350101
 114     // extension:basicConstraints:cA,
 115     // extension:keyUsage:keyCertSign,cRLSign
 116     //
 117     // If this ever needs to change, re-generate the certificate and update the
 118     // following entry with the new fingerprint, issuer, and serial number.
 119     "1.3.6.1.4.1.13769.666.666.666.1.500.9.1",
 120     "DEBUGtesting EV OID",
 121     { 0x70, 0xED, 0xCB, 0x5A, 0xCE, 0x02, 0xC7, 0xC5, 0x0B, 0xA3, 0xD2, 0xD7,
 122       0xC6, 0xF5, 0x0E, 0x18, 0x02, 0x19, 0x17, 0xF5, 0x48, 0x08, 0x9C, 0xB3,
 123       0x8E, 0xEF, 0x9A, 0x1A, 0x4D, 0x7F, 0x82, 0x94 },
 124     "MBExDzANBgNVBAMMBmV2cm9vdA==",
 125     "IZSHsVgzcvhPgdfrgdMGlpSfMeg=",
 126   },
 127   {
 128     // This is an RSA root with an inadequate key size. It is used to test that
 129     // minimum key sizes are enforced when verifying for EV. It can be
 130     // generated using pycert.py and the following specification:
 131     //
 132     // issuer:ev_root_rsa_2040
 133     // subject:ev_root_rsa_2040
 134     // issuerKey:evRSA2040
 135     // subjectKey:evRSA2040
 136     // validity:20150101-20350101
 137     // extension:basicConstraints:cA,
 138     // extension:keyUsage:cRLSign,keyCertSign
 139     //
 140     // If this ever needs to change, re-generate the certificate and update the
 141     // following entry with the new fingerprint, issuer, and serial number.
 142     "1.3.6.1.4.1.13769.666.666.666.1.500.9.1",
 143     "DEBUGtesting EV OID",
 144     { 0x40, 0xAB, 0x5D, 0xA5, 0x89, 0x15, 0xA9, 0x4B, 0x82, 0x87, 0xB8, 0xA6,
 145       0x9A, 0x84, 0xB1, 0xDB, 0x7A, 0x9D, 0xDB, 0xB8, 0x4E, 0xE1, 0x23, 0xE3,
 146       0xC6, 0x64, 0xE7, 0x50, 0xDC, 0x35, 0x8C, 0x68  },
 147     "MBsxGTAXBgNVBAMMEGV2X3Jvb3RfcnNhXzIwNDA=",
 148     "J7nCMgtzNcSPG7jAh3CWzlTGHQg=",
 149   },
 150 #endif
 151   {
 152     // CN=SwissSign Gold CA - G2,O=SwissSign AG,C=CH
 153     "2.16.756.1.89.1.2.1.1",
 154     "SwissSign EV OID",
 155     { 0x62, 0xDD, 0x0B, 0xE9, 0xB9, 0xF5, 0x0A, 0x16, 0x3E, 0xA0, 0xF8,
 156       0xE7, 0x5C, 0x05, 0x3B, 0x1E, 0xCA, 0x57, 0xEA, 0x55, 0xC8, 0x68,
 157       0x8F, 0x64, 0x7C, 0x68, 0x81, 0xF2, 0xC8, 0x35, 0x7B, 0x95 },
 158     "MEUxCzAJBgNVBAYTAkNIMRUwEwYDVQQKEwxTd2lzc1NpZ24gQUcxHzAdBgNVBAMT"
 159     "FlN3aXNzU2lnbiBHb2xkIENBIC0gRzI=",
 160     "ALtAHEP1Xk+w",
 161   },
 162   {
 163     // CN=XRamp Global Certification Authority,O=XRamp Security Services Inc,OU=www.xrampsecurity.com,C=US
 164     "2.16.840.1.114404.1.1.2.4.1",
 165     "Trustwave EV OID",
 166     { 0xCE, 0xCD, 0xDC, 0x90, 0x50, 0x99, 0xD8, 0xDA, 0xDF, 0xC5, 0xB1,
 167       0xD2, 0x09, 0xB7, 0x37, 0xCB, 0xE2, 0xC1, 0x8C, 0xFB, 0x2C, 0x10,
 168       0xC0, 0xFF, 0x0B, 0xCF, 0x0D, 0x32, 0x86, 0xFC, 0x1A, 0xA2 },
 169     "MIGCMQswCQYDVQQGEwJVUzEeMBwGA1UECxMVd3d3LnhyYW1wc2VjdXJpdHkuY29t"
 170     "MSQwIgYDVQQKExtYUmFtcCBTZWN1cml0eSBTZXJ2aWNlcyBJbmMxLTArBgNVBAMT"
 171     "JFhSYW1wIEdsb2JhbCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eQ==",
 172     "UJRs7Bjq1ZxN1ZfvdY+grQ==",
 173   },
 174   {
 175     // CN=SecureTrust CA,O=SecureTrust Corporation,C=US
 176     "2.16.840.1.114404.1.1.2.4.1",
 177     "Trustwave EV OID",
 178     { 0xF1, 0xC1, 0xB5, 0x0A, 0xE5, 0xA2, 0x0D, 0xD8, 0x03, 0x0E, 0xC9,
 179       0xF6, 0xBC, 0x24, 0x82, 0x3D, 0xD3, 0x67, 0xB5, 0x25, 0x57, 0x59,
 180       0xB4, 0xE7, 0x1B, 0x61, 0xFC, 0xE9, 0xF7, 0x37, 0x5D, 0x73 },
 181     "MEgxCzAJBgNVBAYTAlVTMSAwHgYDVQQKExdTZWN1cmVUcnVzdCBDb3Jwb3JhdGlv"
 182     "bjEXMBUGA1UEAxMOU2VjdXJlVHJ1c3QgQ0E=",
 183     "DPCOXAgWpa1Cf/DrJxhZ0A==",
 184   },
 185   {
 186     // CN=Secure Global CA,O=SecureTrust Corporation,C=US
 187     "2.16.840.1.114404.1.1.2.4.1",
 188     "Trustwave EV OID",
 189     { 0x42, 0x00, 0xF5, 0x04, 0x3A, 0xC8, 0x59, 0x0E, 0xBB, 0x52, 0x7D,
 190       0x20, 0x9E, 0xD1, 0x50, 0x30, 0x29, 0xFB, 0xCB, 0xD4, 0x1C, 0xA1,
 191       0xB5, 0x06, 0xEC, 0x27, 0xF1, 0x5A, 0xDE, 0x7D, 0xAC, 0x69 },
 192     "MEoxCzAJBgNVBAYTAlVTMSAwHgYDVQQKExdTZWN1cmVUcnVzdCBDb3Jwb3JhdGlv"
 193     "bjEZMBcGA1UEAxMQU2VjdXJlIEdsb2JhbCBDQQ==",
 194     "B1YipOjUiolN9BPI8PjqpQ==",
 195   },
 196   {
 197     // CN=COMODO ECC Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
 198     "1.3.6.1.4.1.6449.1.2.1.5.1",
 199     "Comodo EV OID",
 200     { 0x17, 0x93, 0x92, 0x7A, 0x06, 0x14, 0x54, 0x97, 0x89, 0xAD, 0xCE,
 201       0x2F, 0x8F, 0x34, 0xF7, 0xF0, 0xB6, 0x6D, 0x0F, 0x3A, 0xE3, 0xA3,
 202       0xB8, 0x4D, 0x21, 0xEC, 0x15, 0xDB, 0xBA, 0x4F, 0xAD, 0xC7 },
 203     "MIGFMQswCQYDVQQGEwJHQjEbMBkGA1UECBMSR3JlYXRlciBNYW5jaGVzdGVyMRAw"
 204     "DgYDVQQHEwdTYWxmb3JkMRowGAYDVQQKExFDT01PRE8gQ0EgTGltaXRlZDErMCkG"
 205     "A1UEAxMiQ09NT0RPIEVDQyBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eQ==",
 206     "H0evqmIAcFBUTAGem2OZKg==",
 207   },
 208   {
 209     // CN=COMODO Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
 210     "1.3.6.1.4.1.6449.1.2.1.5.1",
 211     "Comodo EV OID",
 212     { 0x0C, 0x2C, 0xD6, 0x3D, 0xF7, 0x80, 0x6F, 0xA3, 0x99, 0xED, 0xE8,
 213       0x09, 0x11, 0x6B, 0x57, 0x5B, 0xF8, 0x79, 0x89, 0xF0, 0x65, 0x18,
 214       0xF9, 0x80, 0x8C, 0x86, 0x05, 0x03, 0x17, 0x8B, 0xAF, 0x66 },
 215     "MIGBMQswCQYDVQQGEwJHQjEbMBkGA1UECBMSR3JlYXRlciBNYW5jaGVzdGVyMRAw"
 216     "DgYDVQQHEwdTYWxmb3JkMRowGAYDVQQKExFDT01PRE8gQ0EgTGltaXRlZDEnMCUG"
 217     "A1UEAxMeQ09NT0RPIENlcnRpZmljYXRpb24gQXV0aG9yaXR5",
 218     "ToEtioJl4AsC7j41AkblPQ==",
 219   },
 220   {
 221     // OU=Go Daddy Class 2 Certification Authority,O=\"The Go Daddy Group, Inc.\",C=US
 222     "2.16.840.1.114413.1.7.23.3",
 223     "Go Daddy EV OID a",
 224     { 0xC3, 0x84, 0x6B, 0xF2, 0x4B, 0x9E, 0x93, 0xCA, 0x64, 0x27, 0x4C,
 225       0x0E, 0xC6, 0x7C, 0x1E, 0xCC, 0x5E, 0x02, 0x4F, 0xFC, 0xAC, 0xD2,
 226       0xD7, 0x40, 0x19, 0x35, 0x0E, 0x81, 0xFE, 0x54, 0x6A, 0xE4 },
 227     "MGMxCzAJBgNVBAYTAlVTMSEwHwYDVQQKExhUaGUgR28gRGFkZHkgR3JvdXAsIElu"
 228     "Yy4xMTAvBgNVBAsTKEdvIERhZGR5IENsYXNzIDIgQ2VydGlmaWNhdGlvbiBBdXRo"
 229     "b3JpdHk=",
 230     "AA==",
 231   },
 232   {
 233     // CN=Go Daddy Root Certificate Authority - G2,O="GoDaddy.com, Inc.",L=Scottsdale,ST=Arizona,C=US
 234     "2.16.840.1.114413.1.7.23.3",
 235     "Go Daddy EV OID a",
 236     { 0x45, 0x14, 0x0B, 0x32, 0x47, 0xEB, 0x9C, 0xC8, 0xC5, 0xB4, 0xF0,
 237       0xD7, 0xB5, 0x30, 0x91, 0xF7, 0x32, 0x92, 0x08, 0x9E, 0x6E, 0x5A,
 238       0x63, 0xE2, 0x74, 0x9D, 0xD3, 0xAC, 0xA9, 0x19, 0x8E, 0xDA },
 239     "MIGDMQswCQYDVQQGEwJVUzEQMA4GA1UECBMHQXJpem9uYTETMBEGA1UEBxMKU2Nv"
 240     "dHRzZGFsZTEaMBgGA1UEChMRR29EYWRkeS5jb20sIEluYy4xMTAvBgNVBAMTKEdv"
 241     "IERhZGR5IFJvb3QgQ2VydGlmaWNhdGUgQXV0aG9yaXR5IC0gRzI=",
 242     "AA==",
 243   },
 244   {
 245     // OU=Starfield Class 2 Certification Authority,O=\"Starfield Technologies, Inc.\",C=US
 246     "2.16.840.1.114414.1.7.23.3",
 247     "Go Daddy EV OID b",
 248     { 0x14, 0x65, 0xFA, 0x20, 0x53, 0x97, 0xB8, 0x76, 0xFA, 0xA6, 0xF0,
 249       0xA9, 0x95, 0x8E, 0x55, 0x90, 0xE4, 0x0F, 0xCC, 0x7F, 0xAA, 0x4F,
 250       0xB7, 0xC2, 0xC8, 0x67, 0x75, 0x21, 0xFB, 0x5F, 0xB6, 0x58 },
 251     "MGgxCzAJBgNVBAYTAlVTMSUwIwYDVQQKExxTdGFyZmllbGQgVGVjaG5vbG9naWVz"
 252     "LCBJbmMuMTIwMAYDVQQLEylTdGFyZmllbGQgQ2xhc3MgMiBDZXJ0aWZpY2F0aW9u"
 253     "IEF1dGhvcml0eQ==",
 254     "AA==",
 255   },
 256   {
 257     // CN=Starfield Root Certificate Authority - G2,O="Starfield Technologies, Inc.",L=Scottsdale,ST=Arizona,C=US
 258     "2.16.840.1.114414.1.7.23.3",
 259     "Go Daddy EV OID b",
 260     { 0x2C, 0xE1, 0xCB, 0x0B, 0xF9, 0xD2, 0xF9, 0xE1, 0x02, 0x99, 0x3F,
 261       0xBE, 0x21, 0x51, 0x52, 0xC3, 0xB2, 0xDD, 0x0C, 0xAB, 0xDE, 0x1C,
 262       0x68, 0xE5, 0x31, 0x9B, 0x83, 0x91, 0x54, 0xDB, 0xB7, 0xF5 },
 263     "MIGPMQswCQYDVQQGEwJVUzEQMA4GA1UECBMHQXJpem9uYTETMBEGA1UEBxMKU2Nv"
 264     "dHRzZGFsZTElMCMGA1UEChMcU3RhcmZpZWxkIFRlY2hub2xvZ2llcywgSW5jLjEy"
 265     "MDAGA1UEAxMpU3RhcmZpZWxkIFJvb3QgQ2VydGlmaWNhdGUgQXV0aG9yaXR5IC0g"
 266     "RzI=",
 267     "AA==",
 268   },
 269   {
 270     // CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
 271     "2.16.840.1.114412.2.1",
 272     "DigiCert EV OID",
 273     { 0x74, 0x31, 0xE5, 0xF4, 0xC3, 0xC1, 0xCE, 0x46, 0x90, 0x77, 0x4F,
 274       0x0B, 0x61, 0xE0, 0x54, 0x40, 0x88, 0x3B, 0xA9, 0xA0, 0x1E, 0xD0,
 275       0x0B, 0xA6, 0xAB, 0xD7, 0x80, 0x6E, 0xD3, 0xB1, 0x18, 0xCF },
 276     "MGwxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsT"
 277     "EHd3dy5kaWdpY2VydC5jb20xKzApBgNVBAMTIkRpZ2lDZXJ0IEhpZ2ggQXNzdXJh"
 278     "bmNlIEVWIFJvb3QgQ0E=",
 279     "AqxcJmoLQJuPC3nyrkYldw==",
 280   },
 281   {
 282     // CN=QuoVadis Root CA 2,O=QuoVadis Limited,C=BM
 283     "1.3.6.1.4.1.8024.0.2.100.1.2",
 284     "Quo Vadis EV OID",
 285     { 0x85, 0xA0, 0xDD, 0x7D, 0xD7, 0x20, 0xAD, 0xB7, 0xFF, 0x05, 0xF8,
 286       0x3D, 0x54, 0x2B, 0x20, 0x9D, 0xC7, 0xFF, 0x45, 0x28, 0xF7, 0xD6,
 287       0x77, 0xB1, 0x83, 0x89, 0xFE, 0xA5, 0xE5, 0xC4, 0x9E, 0x86 },
 288     "MEUxCzAJBgNVBAYTAkJNMRkwFwYDVQQKExBRdW9WYWRpcyBMaW1pdGVkMRswGQYD"
 289     "VQQDExJRdW9WYWRpcyBSb290IENBIDI=",
 290     "BQk=",
 291   },
 292   {
 293     // CN=Entrust Root Certification Authority,OU="(c) 2006 Entrust, Inc.",OU=www.entrust.net/CPS is incorporated by reference,O="Entrust, Inc.",C=US
 294     "2.16.840.1.114028.10.1.2",
 295     "Entrust EV OID",
 296     { 0x73, 0xC1, 0x76, 0x43, 0x4F, 0x1B, 0xC6, 0xD5, 0xAD, 0xF4, 0x5B,
 297       0x0E, 0x76, 0xE7, 0x27, 0x28, 0x7C, 0x8D, 0xE5, 0x76, 0x16, 0xC1,
 298       0xE6, 0xE6, 0x14, 0x1A, 0x2B, 0x2C, 0xBC, 0x7D, 0x8E, 0x4C },
 299     "MIGwMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNRW50cnVzdCwgSW5jLjE5MDcGA1UE"
 300     "CxMwd3d3LmVudHJ1c3QubmV0L0NQUyBpcyBpbmNvcnBvcmF0ZWQgYnkgcmVmZXJl"
 301     "bmNlMR8wHQYDVQQLExYoYykgMjAwNiBFbnRydXN0LCBJbmMuMS0wKwYDVQQDEyRF"
 302     "bnRydXN0IFJvb3QgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHk=",
 303     "RWtQVA==",
 304   },
 305   {
 306     // CN=Entrust Root Certification Authority - G4,OU="(c) 2015 Entrust, Inc. - for authorized use only",OU=See www.entrust.net/legal-terms,O="Entrust, Inc.",C=US
 307     "2.16.840.1.114028.10.1.2",
 308     "Entrust EV OID",
 309     { 0xDB, 0x35, 0x17, 0xD1, 0xF6, 0x73, 0x2A, 0x2D, 0x5A, 0xB9, 0x7C,
 310       0x53, 0x3E, 0xC7, 0x07, 0x79, 0xEE, 0x32, 0x70, 0xA6, 0x2F, 0xB4,
 311       0xAC, 0x42, 0x38, 0x37, 0x24, 0x60, 0xE6, 0xF0, 0x1E, 0x88 },
 312     "MIG+MQswCQYDVQQGEwJVUzEWMBQGA1UEChMNRW50cnVzdCwgSW5jLjEoMCYGA1UE"
 313     "CxMfU2VlIHd3dy5lbnRydXN0Lm5ldC9sZWdhbC10ZXJtczE5MDcGA1UECxMwKGMp"
 314     "IDIwMTUgRW50cnVzdCwgSW5jLiAtIGZvciBhdXRob3JpemVkIHVzZSBvbmx5MTIw"
 315     "MAYDVQQDEylFbnRydXN0IFJvb3QgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgLSBH"
 316     "NA==",
 317     "ANm1Q3+vqTkPAAAAAFVlrVg=",
 318   },
 319   {
 320     // CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
 321     "2.23.140.1.1",
 322     "CA/Browser Forum EV OID",
 323     { 0xEB, 0xD4, 0x10, 0x40, 0xE4, 0xBB, 0x3E, 0xC7, 0x42, 0xC9, 0xE3,
 324       0x81, 0xD3, 0x1E, 0xF2, 0xA4, 0x1A, 0x48, 0xB6, 0x68, 0x5C, 0x96,
 325       0xE7, 0xCE, 0xF3, 0xC1, 0xDF, 0x6C, 0xD4, 0x33, 0x1C, 0x99 },
 326     "MFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMRAwDgYD"
 327     "VQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxTaWduIFJvb3QgQ0E=",
 328     "BAAAAAABFUtaw5Q=",
 329   },
 330   {
 331     // CN=GlobalSign,O=GlobalSign,OU=GlobalSign Root CA - R3
 332     "2.23.140.1.1",
 333     "CA/Browser Forum EV OID",
 334     { 0xCB, 0xB5, 0x22, 0xD7, 0xB7, 0xF1, 0x27, 0xAD, 0x6A, 0x01, 0x13,
 335       0x86, 0x5B, 0xDF, 0x1C, 0xD4, 0x10, 0x2E, 0x7D, 0x07, 0x59, 0xAF,
 336       0x63, 0x5A, 0x7C, 0xF4, 0x72, 0x0D, 0xC9, 0x63, 0xC5, 0x3B },
 337     "MEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAtIFIzMRMwEQYDVQQKEwpH"
 338     "bG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWdu",
 339     "BAAAAAABIVhTCKI=",
 340   },
 341   {
 342     // CN=Buypass Class 3 Root CA,O=Buypass AS-983163327,C=NO
 343     "2.16.578.1.26.1.3.3",
 344     "Buypass EV OID",
 345     { 0xED, 0xF7, 0xEB, 0xBC, 0xA2, 0x7A, 0x2A, 0x38, 0x4D, 0x38, 0x7B,
 346       0x7D, 0x40, 0x10, 0xC6, 0x66, 0xE2, 0xED, 0xB4, 0x84, 0x3E, 0x4C,
 347       0x29, 0xB4, 0xAE, 0x1D, 0x5B, 0x93, 0x32, 0xE6, 0xB2, 0x4D },
 348     "ME4xCzAJBgNVBAYTAk5PMR0wGwYDVQQKDBRCdXlwYXNzIEFTLTk4MzE2MzMyNzEg"
 349     "MB4GA1UEAwwXQnV5cGFzcyBDbGFzcyAzIFJvb3QgQ0E=",
 350     "Ag==",
 351   },
 352   {
 353     // CN=AffirmTrust Commercial,O=AffirmTrust,C=US
 354     "1.3.6.1.4.1.34697.2.1",
 355     "AffirmTrust EV OID a",
 356     { 0x03, 0x76, 0xAB, 0x1D, 0x54, 0xC5, 0xF9, 0x80, 0x3C, 0xE4, 0xB2,
 357       0xE2, 0x01, 0xA0, 0xEE, 0x7E, 0xEF, 0x7B, 0x57, 0xB6, 0x36, 0xE8,
 358       0xA9, 0x3C, 0x9B, 0x8D, 0x48, 0x60, 0xC9, 0x6F, 0x5F, 0xA7 },
 359     "MEQxCzAJBgNVBAYTAlVTMRQwEgYDVQQKDAtBZmZpcm1UcnVzdDEfMB0GA1UEAwwW"
 360     "QWZmaXJtVHJ1c3QgQ29tbWVyY2lhbA==",
 361     "d3cGJyapsXw=",
 362   },
 363   {
 364     // CN=AffirmTrust Networking,O=AffirmTrust,C=US
 365     "1.3.6.1.4.1.34697.2.2",
 366     "AffirmTrust EV OID b",
 367     { 0x0A, 0x81, 0xEC, 0x5A, 0x92, 0x97, 0x77, 0xF1, 0x45, 0x90, 0x4A,
 368       0xF3, 0x8D, 0x5D, 0x50, 0x9F, 0x66, 0xB5, 0xE2, 0xC5, 0x8F, 0xCD,
 369       0xB5, 0x31, 0x05, 0x8B, 0x0E, 0x17, 0xF3, 0xF0, 0xB4, 0x1B },
 370     "MEQxCzAJBgNVBAYTAlVTMRQwEgYDVQQKDAtBZmZpcm1UcnVzdDEfMB0GA1UEAwwW"
 371     "QWZmaXJtVHJ1c3QgTmV0d29ya2luZw==",
 372     "fE8EORzUmS0=",
 373   },
 374   {
 375     // CN=AffirmTrust Premium,O=AffirmTrust,C=US
 376     "1.3.6.1.4.1.34697.2.3",
 377     "AffirmTrust EV OID c",
 378     { 0x70, 0xA7, 0x3F, 0x7F, 0x37, 0x6B, 0x60, 0x07, 0x42, 0x48, 0x90,
 379       0x45, 0x34, 0xB1, 0x14, 0x82, 0xD5, 0xBF, 0x0E, 0x69, 0x8E, 0xCC,
 380       0x49, 0x8D, 0xF5, 0x25, 0x77, 0xEB, 0xF2, 0xE9, 0x3B, 0x9A },
 381     "MEExCzAJBgNVBAYTAlVTMRQwEgYDVQQKDAtBZmZpcm1UcnVzdDEcMBoGA1UEAwwT"
 382     "QWZmaXJtVHJ1c3QgUHJlbWl1bQ==",
 383     "bYwURrGmCu4=",
 384   },
 385   {
 386     // CN=AffirmTrust Premium ECC,O=AffirmTrust,C=US
 387     "1.3.6.1.4.1.34697.2.4",
 388     "AffirmTrust EV OID d",
 389     { 0xBD, 0x71, 0xFD, 0xF6, 0xDA, 0x97, 0xE4, 0xCF, 0x62, 0xD1, 0x64,
 390       0x7A, 0xDD, 0x25, 0x81, 0xB0, 0x7D, 0x79, 0xAD, 0xF8, 0x39, 0x7E,
 391       0xB4, 0xEC, 0xBA, 0x9C, 0x5E, 0x84, 0x88, 0x82, 0x14, 0x23 },
 392     "MEUxCzAJBgNVBAYTAlVTMRQwEgYDVQQKDAtBZmZpcm1UcnVzdDEgMB4GA1UEAwwX"
 393     "QWZmaXJtVHJ1c3QgUHJlbWl1bSBFQ0M=",
 394     "dJclisc/elQ=",
 395   },
 396   {
 397     // CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
 398     "1.2.616.1.113527.2.5.1.1",
 399     "Certum EV OID",
 400     { 0x5C, 0x58, 0x46, 0x8D, 0x55, 0xF5, 0x8E, 0x49, 0x7E, 0x74, 0x39,
 401       0x82, 0xD2, 0xB5, 0x00, 0x10, 0xB6, 0xD1, 0x65, 0x37, 0x4A, 0xCF,
 402       0x83, 0xA7, 0xD4, 0xA3, 0x2D, 0xB7, 0x68, 0xC4, 0x40, 0x8E },
 403     "MH4xCzAJBgNVBAYTAlBMMSIwIAYDVQQKExlVbml6ZXRvIFRlY2hub2xvZ2llcyBT"
 404     "LkEuMScwJQYDVQQLEx5DZXJ0dW0gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxIjAg"
 405     "BgNVBAMTGUNlcnR1bSBUcnVzdGVkIE5ldHdvcmsgQ0E=",
 406     "BETA",
 407   },
 408   {
 409     // CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
 410     "1.2.616.1.113527.2.5.1.1",
 411     "Certum EV OID",
 412     { 0xB6, 0x76, 0xF2, 0xED, 0xDA, 0xE8, 0x77, 0x5C, 0xD3, 0x6C, 0xB0,
 413       0xF6, 0x3C, 0xD1, 0xD4, 0x60, 0x39, 0x61, 0xF4, 0x9E, 0x62, 0x65,
 414       0xBA, 0x01, 0x3A, 0x2F, 0x03, 0x07, 0xB6, 0xD0, 0xB8, 0x04 },
 415     "MIGAMQswCQYDVQQGEwJQTDEiMCAGA1UEChMZVW5pemV0byBUZWNobm9sb2dpZXMg"
 416     "Uy5BLjEnMCUGA1UECxMeQ2VydHVtIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MSQw"
 417     "IgYDVQQDExtDZXJ0dW0gVHJ1c3RlZCBOZXR3b3JrIENBIDI=",
 418     "IdbQSk8lD8kyN/yqXhKN6Q==",
 419   },
 420   {
 421     // CN=Izenpe.com,O=IZENPE S.A.,C=ES
 422     "1.3.6.1.4.1.14777.6.1.1",
 423     "Izenpe EV OID 1",
 424     { 0x25, 0x30, 0xCC, 0x8E, 0x98, 0x32, 0x15, 0x02, 0xBA, 0xD9, 0x6F,
 425       0x9B, 0x1F, 0xBA, 0x1B, 0x09, 0x9E, 0x2D, 0x29, 0x9E, 0x0F, 0x45,
 426       0x48, 0xBB, 0x91, 0x4F, 0x36, 0x3B, 0xC0, 0xD4, 0x53, 0x1F },
 427     "MDgxCzAJBgNVBAYTAkVTMRQwEgYDVQQKDAtJWkVOUEUgUy5BLjETMBEGA1UEAwwK"
 428     "SXplbnBlLmNvbQ==",
 429     "ALC3WhZIX7/hy/WL1xnmfQ==",
 430   },
 431   {
 432     // CN=Izenpe.com,O=IZENPE S.A.,C=ES
 433     "1.3.6.1.4.1.14777.6.1.2",
 434     "Izenpe EV OID 2",
 435     { 0x25, 0x30, 0xCC, 0x8E, 0x98, 0x32, 0x15, 0x02, 0xBA, 0xD9, 0x6F,
 436       0x9B, 0x1F, 0xBA, 0x1B, 0x09, 0x9E, 0x2D, 0x29, 0x9E, 0x0F, 0x45,
 437       0x48, 0xBB, 0x91, 0x4F, 0x36, 0x3B, 0xC0, 0xD4, 0x53, 0x1F },
 438     "MDgxCzAJBgNVBAYTAkVTMRQwEgYDVQQKDAtJWkVOUEUgUy5BLjETMBEGA1UEAwwK"
 439     "SXplbnBlLmNvbQ==",
 440     "ALC3WhZIX7/hy/WL1xnmfQ==",
 441   },
 442   {
 443     // CN=T-TeleSec GlobalRoot Class 3,OU=T-Systems Trust Center,O=T-Systems Enterprise Services GmbH,C=DE
 444     "1.3.6.1.4.1.7879.13.24.1",
 445     "T-Systems EV OID",
 446     { 0xFD, 0x73, 0xDA, 0xD3, 0x1C, 0x64, 0x4F, 0xF1, 0xB4, 0x3B, 0xEF,
 447       0x0C, 0xCD, 0xDA, 0x96, 0x71, 0x0B, 0x9C, 0xD9, 0x87, 0x5E, 0xCA,
 448       0x7E, 0x31, 0x70, 0x7A, 0xF3, 0xE9, 0x6D, 0x52, 0x2B, 0xBD },
 449     "MIGCMQswCQYDVQQGEwJERTErMCkGA1UECgwiVC1TeXN0ZW1zIEVudGVycHJpc2Ug"
 450     "U2VydmljZXMgR21iSDEfMB0GA1UECwwWVC1TeXN0ZW1zIFRydXN0IENlbnRlcjEl"
 451     "MCMGA1UEAwwcVC1UZWxlU2VjIEdsb2JhbFJvb3QgQ2xhc3MgMw==",
 452     "AQ==",
 453   },
 454   {
 455     // CN=TWCA Root Certification Authority,OU=Root CA,O=TAIWAN-CA,C=TW
 456     "1.3.6.1.4.1.40869.1.1.22.3",
 457     "TWCA EV OID",
 458     { 0xBF, 0xD8, 0x8F, 0xE1, 0x10, 0x1C, 0x41, 0xAE, 0x3E, 0x80, 0x1B,
 459       0xF8, 0xBE, 0x56, 0x35, 0x0E, 0xE9, 0xBA, 0xD1, 0xA6, 0xB9, 0xBD,
 460       0x51, 0x5E, 0xDC, 0x5C, 0x6D, 0x5B, 0x87, 0x11, 0xAC, 0x44 },
 461     "MF8xCzAJBgNVBAYTAlRXMRIwEAYDVQQKDAlUQUlXQU4tQ0ExEDAOBgNVBAsMB1Jv"
 462     "b3QgQ0ExKjAoBgNVBAMMIVRXQ0EgUm9vdCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0"
 463     "eQ==",
 464     "AQ==",
 465   },
 466   {
 467     // CN=D-TRUST Root Class 3 CA 2 EV 2009,O=D-Trust GmbH,C=DE
 468     "1.3.6.1.4.1.4788.2.202.1",
 469     "D-TRUST EV OID",
 470     { 0xEE, 0xC5, 0x49, 0x6B, 0x98, 0x8C, 0xE9, 0x86, 0x25, 0xB9, 0x34,
 471       0x09, 0x2E, 0xEC, 0x29, 0x08, 0xBE, 0xD0, 0xB0, 0xF3, 0x16, 0xC2,
 472       0xD4, 0x73, 0x0C, 0x84, 0xEA, 0xF1, 0xF3, 0xD3, 0x48, 0x81 },
 473     "MFAxCzAJBgNVBAYTAkRFMRUwEwYDVQQKDAxELVRydXN0IEdtYkgxKjAoBgNVBAMM"
 474     "IUQtVFJVU1QgUm9vdCBDbGFzcyAzIENBIDIgRVYgMjAwOQ==",
 475     "CYP0",
 476   },
 477   {
 478     // CN = TWCA Global Root CA, OU = Root CA, O = TAIWAN-CA, C = TW
 479     "1.3.6.1.4.1.40869.1.1.22.3",
 480     "TWCA EV OID",
 481     { 0x59, 0x76, 0x90, 0x07, 0xF7, 0x68, 0x5D, 0x0F, 0xCD, 0x50, 0x87,
 482       0x2F, 0x9F, 0x95, 0xD5, 0x75, 0x5A, 0x5B, 0x2B, 0x45, 0x7D, 0x81,
 483       0xF3, 0x69, 0x2B, 0x61, 0x0A, 0x98, 0x67, 0x2F, 0x0E, 0x1B },
 484     "MFExCzAJBgNVBAYTAlRXMRIwEAYDVQQKEwlUQUlXQU4tQ0ExEDAOBgNVBAsTB1Jv"
 485     "b3QgQ0ExHDAaBgNVBAMTE1RXQ0EgR2xvYmFsIFJvb3QgQ0E=",
 486     "DL4=",
 487   },
 488   {
 489     // CN=Actalis Authentication Root CA,O=Actalis S.p.A./03358520967,L=Milan,C=IT
 490     "1.3.159.1.17.1",
 491     "Actalis EV OID",
 492     { 0x55, 0x92, 0x60, 0x84, 0xEC, 0x96, 0x3A, 0x64, 0xB9, 0x6E, 0x2A,
 493       0xBE, 0x01, 0xCE, 0x0B, 0xA8, 0x6A, 0x64, 0xFB, 0xFE, 0xBC, 0xC7,
 494       0xAA, 0xB5, 0xAF, 0xC1, 0x55, 0xB3, 0x7F, 0xD7, 0x60, 0x66 },
 495     "MGsxCzAJBgNVBAYTAklUMQ4wDAYDVQQHDAVNaWxhbjEjMCEGA1UECgwaQWN0YWxp"
 496     "cyBTLnAuQS4vMDMzNTg1MjA5NjcxJzAlBgNVBAMMHkFjdGFsaXMgQXV0aGVudGlj"
 497     "YXRpb24gUm9vdCBDQQ==",
 498     "VwoRl0LE48w=",
 499   },
 500   {
 501     // CN=DigiCert Assured ID Root G2,OU=www.digicert.com,O=DigiCert Inc,C=US
 502     "2.16.840.1.114412.2.1",
 503     "DigiCert EV OID",
 504     { 0x7D, 0x05, 0xEB, 0xB6, 0x82, 0x33, 0x9F, 0x8C, 0x94, 0x51, 0xEE,
 505       0x09, 0x4E, 0xEB, 0xFE, 0xFA, 0x79, 0x53, 0xA1, 0x14, 0xED, 0xB2,
 506       0xF4, 0x49, 0x49, 0x45, 0x2F, 0xAB, 0x7D, 0x2F, 0xC1, 0x85 },
 507     "MGUxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsT"
 508     "EHd3dy5kaWdpY2VydC5jb20xJDAiBgNVBAMTG0RpZ2lDZXJ0IEFzc3VyZWQgSUQg"
 509     "Um9vdCBHMg==",
 510     "C5McOtY5Z+pnI7/Dr5r0Sw==",
 511   },
 512   {
 513     // CN=DigiCert Assured ID Root G3,OU=www.digicert.com,O=DigiCert Inc,C=US
 514     "2.16.840.1.114412.2.1",
 515     "DigiCert EV OID",
 516     { 0x7E, 0x37, 0xCB, 0x8B, 0x4C, 0x47, 0x09, 0x0C, 0xAB, 0x36, 0x55,
 517       0x1B, 0xA6, 0xF4, 0x5D, 0xB8, 0x40, 0x68, 0x0F, 0xBA, 0x16, 0x6A,
 518       0x95, 0x2D, 0xB1, 0x00, 0x71, 0x7F, 0x43, 0x05, 0x3F, 0xC2 },
 519     "MGUxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsT"
 520     "EHd3dy5kaWdpY2VydC5jb20xJDAiBgNVBAMTG0RpZ2lDZXJ0IEFzc3VyZWQgSUQg"
 521     "Um9vdCBHMw==",
 522     "C6Fa+h3foLVJRK/NJKBs7A==",
 523   },
 524   {
 525     // CN=DigiCert Global Root G2,OU=www.digicert.com,O=DigiCert Inc,C=US
 526     "2.16.840.1.114412.2.1",
 527     "DigiCert EV OID",
 528     { 0xCB, 0x3C, 0xCB, 0xB7, 0x60, 0x31, 0xE5, 0xE0, 0x13, 0x8F, 0x8D,
 529       0xD3, 0x9A, 0x23, 0xF9, 0xDE, 0x47, 0xFF, 0xC3, 0x5E, 0x43, 0xC1,
 530       0x14, 0x4C, 0xEA, 0x27, 0xD4, 0x6A, 0x5A, 0xB1, 0xCB, 0x5F },
 531     "MGExCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsT"
 532     "EHd3dy5kaWdpY2VydC5jb20xIDAeBgNVBAMTF0RpZ2lDZXJ0IEdsb2JhbCBSb290"
 533     "IEcy",
 534     "Azrx5qcRqaC7KGSxHQn65Q==",
 535   },
 536   {
 537     // CN=DigiCert Global Root G3,OU=www.digicert.com,O=DigiCert Inc,C=US
 538     "2.16.840.1.114412.2.1",
 539     "DigiCert EV OID",
 540     { 0x31, 0xAD, 0x66, 0x48, 0xF8, 0x10, 0x41, 0x38, 0xC7, 0x38, 0xF3,
 541       0x9E, 0xA4, 0x32, 0x01, 0x33, 0x39, 0x3E, 0x3A, 0x18, 0xCC, 0x02,
 542       0x29, 0x6E, 0xF9, 0x7C, 0x2A, 0xC9, 0xEF, 0x67, 0x31, 0xD0 },
 543     "MGExCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsT"
 544     "EHd3dy5kaWdpY2VydC5jb20xIDAeBgNVBAMTF0RpZ2lDZXJ0IEdsb2JhbCBSb290"
 545     "IEcz",
 546     "BVVWvPJepDU1w6QP1atFcg==",
 547   },
 548   {
 549     // CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
 550     "2.16.840.1.114412.2.1",
 551     "DigiCert EV OID",
 552     { 0x55, 0x2F, 0x7B, 0xDC, 0xF1, 0xA7, 0xAF, 0x9E, 0x6C, 0xE6, 0x72,
 553       0x01, 0x7F, 0x4F, 0x12, 0xAB, 0xF7, 0x72, 0x40, 0xC7, 0x8E, 0x76,
 554       0x1A, 0xC2, 0x03, 0xD1, 0xD9, 0xD2, 0x0A, 0xC8, 0x99, 0x88 },
 555     "MGIxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsT"
 556     "EHd3dy5kaWdpY2VydC5jb20xITAfBgNVBAMTGERpZ2lDZXJ0IFRydXN0ZWQgUm9v"
 557     "dCBHNA==",
 558     "BZsbV56OITLiOQe9p3d1XA==",
 559   },
 560   {
 561     // CN=DigiCert TLS RSA4096 Root G5,O="DigiCert, Inc.",C=US
 562     "2.23.140.1.1",
 563     "CA/Browser Forum EV OID",
 564     { 0x37, 0x1A, 0x00, 0xDC, 0x05, 0x33, 0xB3, 0x72, 0x1A, 0x7E, 0xEB,
 565       0x40, 0xE8, 0x41, 0x9E, 0x70, 0x79, 0x9D, 0x2B, 0x0A, 0x0F, 0x2C,
 566       0x1D, 0x80, 0x69, 0x31, 0x65, 0xF7, 0xCE, 0xC4, 0xAD, 0x75 },
 567     "ME0xCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5EaWdpQ2VydCwgSW5jLjElMCMGA1UE"
 568     "AxMcRGlnaUNlcnQgVExTIFJTQTQwOTYgUm9vdCBHNQ==",
 569     "CPm0eKj6ftpqMzeJ3nzPig==",
 570   },
 571   {
 572     // CN=DigiCert TLS ECC P384 Root G5,O="DigiCert, Inc.",C=US
 573     "2.23.140.1.1",
 574     "CA/Browser Forum EV OID",
 575     { 0x01, 0x8E, 0x13, 0xF0, 0x77, 0x25, 0x32, 0xCF, 0x80, 0x9B, 0xD1,
 576       0xB1, 0x72, 0x81, 0x86, 0x72, 0x83, 0xFC, 0x48, 0xC6, 0xE1, 0x3B,
 577       0xE9, 0xC6, 0x98, 0x12, 0x85, 0x4A, 0x49, 0x0C, 0x1B, 0x05 },
 578     "ME4xCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5EaWdpQ2VydCwgSW5jLjEmMCQGA1UE"
 579     "AxMdRGlnaUNlcnQgVExTIEVDQyBQMzg0IFJvb3QgRzU=",
 580     "CeCTZaz32ci5PhwLBCou8w==",
 581   },
 582   {
 583     // CN=QuoVadis Root CA 2 G3,O=QuoVadis Limited,C=BM
 584     "1.3.6.1.4.1.8024.0.2.100.1.2",
 585     "QuoVadis EV OID",
 586     { 0x8F, 0xE4, 0xFB, 0x0A, 0xF9, 0x3A, 0x4D, 0x0D, 0x67, 0xDB, 0x0B,
 587       0xEB, 0xB2, 0x3E, 0x37, 0xC7, 0x1B, 0xF3, 0x25, 0xDC, 0xBC, 0xDD,
 588       0x24, 0x0E, 0xA0, 0x4D, 0xAF, 0x58, 0xB4, 0x7E, 0x18, 0x40 },
 589     "MEgxCzAJBgNVBAYTAkJNMRkwFwYDVQQKExBRdW9WYWRpcyBMaW1pdGVkMR4wHAYD"
 590     "VQQDExVRdW9WYWRpcyBSb290IENBIDIgRzM=",
 591     "RFc0JFuBiZs18s64KztbpybwdSg=",
 592   },
 593   {
 594     // CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
 595     "1.3.6.1.4.1.6449.1.2.1.5.1",
 596     "Comodo EV OID",
 597     { 0x52, 0xF0, 0xE1, 0xC4, 0xE5, 0x8E, 0xC6, 0x29, 0x29, 0x1B, 0x60,
 598       0x31, 0x7F, 0x07, 0x46, 0x71, 0xB8, 0x5D, 0x7E, 0xA8, 0x0D, 0x5B,
 599       0x07, 0x27, 0x34, 0x63, 0x53, 0x4B, 0x32, 0xB4, 0x02, 0x34 },
 600     "MIGFMQswCQYDVQQGEwJHQjEbMBkGA1UECBMSR3JlYXRlciBNYW5jaGVzdGVyMRAw"
 601     "DgYDVQQHEwdTYWxmb3JkMRowGAYDVQQKExFDT01PRE8gQ0EgTGltaXRlZDErMCkG"
 602     "A1UEAxMiQ09NT0RPIFJTQSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eQ==",
 603     "TKr5yttjb+Af907YWwOGnQ==",
 604   },
 605   {
 606     // CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
 607     "1.3.6.1.4.1.6449.1.2.1.5.1",
 608     "Comodo EV OID",
 609     { 0xE7, 0x93, 0xC9, 0xB0, 0x2F, 0xD8, 0xAA, 0x13, 0xE2, 0x1C, 0x31,
 610       0x22, 0x8A, 0xCC, 0xB0, 0x81, 0x19, 0x64, 0x3B, 0x74, 0x9C, 0x89,
 611       0x89, 0x64, 0xB1, 0x74, 0x6D, 0x46, 0xC3, 0xD4, 0xCB, 0xD2 },
 612     "MIGIMQswCQYDVQQGEwJVUzETMBEGA1UECBMKTmV3IEplcnNleTEUMBIGA1UEBxML"
 613     "SmVyc2V5IENpdHkxHjAcBgNVBAoTFVRoZSBVU0VSVFJVU1QgTmV0d29yazEuMCwG"
 614     "A1UEAxMlVVNFUlRydXN0IFJTQSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eQ==",
 615     "Af1tMPyjylGoG7xkDjUDLQ==",
 616   },
 617   {
 618     // CN=USERTrust ECC Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
 619     "1.3.6.1.4.1.6449.1.2.1.5.1",
 620     "Comodo EV OID",
 621     { 0x4F, 0xF4, 0x60, 0xD5, 0x4B, 0x9C, 0x86, 0xDA, 0xBF, 0xBC, 0xFC,
 622       0x57, 0x12, 0xE0, 0x40, 0x0D, 0x2B, 0xED, 0x3F, 0xBC, 0x4D, 0x4F,
 623       0xBD, 0xAA, 0x86, 0xE0, 0x6A, 0xDC, 0xD2, 0xA9, 0xAD, 0x7A },
 624     "MIGIMQswCQYDVQQGEwJVUzETMBEGA1UECBMKTmV3IEplcnNleTEUMBIGA1UEBxML"
 625     "SmVyc2V5IENpdHkxHjAcBgNVBAoTFVRoZSBVU0VSVFJVU1QgTmV0d29yazEuMCwG"
 626     "A1UEAxMlVVNFUlRydXN0IEVDQyBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eQ==",
 627     "XIuZxVqUxdJxVt7NiYDMJg==",
 628   },
 629   {
 630     // CN=GlobalSign,O=GlobalSign,OU=GlobalSign ECC Root CA - R5
 631     "2.23.140.1.1",
 632     "CA/Browser Forum EV OID",
 633     { 0x17, 0x9F, 0xBC, 0x14, 0x8A, 0x3D, 0xD0, 0x0F, 0xD2, 0x4E, 0xA1,
 634       0x34, 0x58, 0xCC, 0x43, 0xBF, 0xA7, 0xF5, 0x9C, 0x81, 0x82, 0xD7,
 635       0x83, 0xA5, 0x13, 0xF6, 0xEB, 0xEC, 0x10, 0x0C, 0x89, 0x24 },
 636     "MFAxJDAiBgNVBAsTG0dsb2JhbFNpZ24gRUNDIFJvb3QgQ0EgLSBSNTETMBEGA1UE"
 637     "ChMKR2xvYmFsU2lnbjETMBEGA1UEAxMKR2xvYmFsU2lnbg==",
 638     "YFlJ4CYuu1X5CneKcflK2Gw=",
 639   },
 640   {
 641     // CN=GlobalSign,O=GlobalSign,OU=GlobalSign Root CA - R6
 642     "2.23.140.1.1",
 643     "CA/Browser Forum EV OID",
 644     { 0x2C, 0xAB, 0xEA, 0xFE, 0x37, 0xD0, 0x6C, 0xA2, 0x2A, 0xBA, 0x73,
 645       0x91, 0xC0, 0x03, 0x3D, 0x25, 0x98, 0x29, 0x52, 0xC4, 0x53, 0x64,
 646       0x73, 0x49, 0x76, 0x3A, 0x3A, 0xB5, 0xAD, 0x6C, 0xCF, 0x69 },
 647     "MEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAtIFI2MRMwEQYDVQQKEwpH"
 648     "bG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWdu",
 649     "Rea7A4Mzw4VlSOb/RVE=",
 650   },
 651   {
 652     // CN=Entrust.net Certification Authority (2048),OU=(c) 1999 Entrust.net Limited,OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.),O=Entrust.net
 653     "2.16.840.1.114028.10.1.2",
 654     "Entrust EV OID",
 655     { 0x6D, 0xC4, 0x71, 0x72, 0xE0, 0x1C, 0xBC, 0xB0, 0xBF, 0x62, 0x58,
 656       0x0D, 0x89, 0x5F, 0xE2, 0xB8, 0xAC, 0x9A, 0xD4, 0xF8, 0x73, 0x80,
 657       0x1E, 0x0C, 0x10, 0xB9, 0xC8, 0x37, 0xD2, 0x1E, 0xB1, 0x77 },
 658     "MIG0MRQwEgYDVQQKEwtFbnRydXN0Lm5ldDFAMD4GA1UECxQ3d3d3LmVudHJ1c3Qu"
 659     "bmV0L0NQU18yMDQ4IGluY29ycC4gYnkgcmVmLiAobGltaXRzIGxpYWIuKTElMCMG"
 660     "A1UECxMcKGMpIDE5OTkgRW50cnVzdC5uZXQgTGltaXRlZDEzMDEGA1UEAxMqRW50"
 661     "cnVzdC5uZXQgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgKDIwNDgp",
 662     "OGPe+A==",
 663   },
 664   {
 665     // CN=Entrust Root Certification Authority - G2,OU="(c) 2009 Entrust, Inc. - for authorized use only",OU=See www.entrust.net/legal-terms,O="Entrust, Inc.",C=US
 666     "2.16.840.1.114028.10.1.2",
 667     "Entrust EV OID",
 668     { 0x43, 0xDF, 0x57, 0x74, 0xB0, 0x3E, 0x7F, 0xEF, 0x5F, 0xE4, 0x0D,
 669       0x93, 0x1A, 0x7B, 0xED, 0xF1, 0xBB, 0x2E, 0x6B, 0x42, 0x73, 0x8C,
 670       0x4E, 0x6D, 0x38, 0x41, 0x10, 0x3D, 0x3A, 0xA7, 0xF3, 0x39 },
 671     "MIG+MQswCQYDVQQGEwJVUzEWMBQGA1UEChMNRW50cnVzdCwgSW5jLjEoMCYGA1UE"
 672     "CxMfU2VlIHd3dy5lbnRydXN0Lm5ldC9sZWdhbC10ZXJtczE5MDcGA1UECxMwKGMp"
 673     "IDIwMDkgRW50cnVzdCwgSW5jLiAtIGZvciBhdXRob3JpemVkIHVzZSBvbmx5MTIw"
 674     "MAYDVQQDEylFbnRydXN0IFJvb3QgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgLSBH"
 675     "Mg==",
 676     "SlOMKA==",
 677   },
 678   {
 679     // CN=Entrust Root Certification Authority - EC1,OU="(c) 2012 Entrust, Inc. - for authorized use only",OU=See www.entrust.net/legal-terms,O="Entrust, Inc.",C=US
 680     "2.16.840.1.114028.10.1.2",
 681     "Entrust EV OID",
 682     { 0x02, 0xED, 0x0E, 0xB2, 0x8C, 0x14, 0xDA, 0x45, 0x16, 0x5C, 0x56,
 683       0x67, 0x91, 0x70, 0x0D, 0x64, 0x51, 0xD7, 0xFB, 0x56, 0xF0, 0xB2,
 684       0xAB, 0x1D, 0x3B, 0x8E, 0xB0, 0x70, 0xE5, 0x6E, 0xDF, 0xF5 },
 685     "MIG/MQswCQYDVQQGEwJVUzEWMBQGA1UEChMNRW50cnVzdCwgSW5jLjEoMCYGA1UE"
 686     "CxMfU2VlIHd3dy5lbnRydXN0Lm5ldC9sZWdhbC10ZXJtczE5MDcGA1UECxMwKGMp"
 687     "IDIwMTIgRW50cnVzdCwgSW5jLiAtIGZvciBhdXRob3JpemVkIHVzZSBvbmx5MTMw"
 688     "MQYDVQQDEypFbnRydXN0IFJvb3QgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgLSBF"
 689     "QzE=",
 690     "AKaLeSkAAAAAUNCR+Q==",
 691   },
 692   {
 693     // CN=CFCA EV ROOT,O=China Financial Certification Authority,C=CN
 694     "2.16.156.112554.3",
 695     "CFCA EV OID",
 696     { 0x5C, 0xC3, 0xD7, 0x8E, 0x4E, 0x1D, 0x5E, 0x45, 0x54, 0x7A, 0x04,
 697       0xE6, 0x87, 0x3E, 0x64, 0xF9, 0x0C, 0xF9, 0x53, 0x6D, 0x1C, 0xCC,
 698       0x2E, 0xF8, 0x00, 0xF3, 0x55, 0xC4, 0xC5, 0xFD, 0x70, 0xFD },
 699     "MFYxCzAJBgNVBAYTAkNOMTAwLgYDVQQKDCdDaGluYSBGaW5hbmNpYWwgQ2VydGlm"
 700     "aWNhdGlvbiBBdXRob3JpdHkxFTATBgNVBAMMDENGQ0EgRVYgUk9PVA==",
 701     "GErM1g==",
 702   },
 703   {
 704     // OU=Security Communication RootCA2,O="SECOM Trust Systems CO.,LTD.",C=JP
 705     "1.2.392.200091.100.721.1",
 706     "SECOM EV OID",
 707     { 0x51, 0x3B, 0x2C, 0xEC, 0xB8, 0x10, 0xD4, 0xCD, 0xE5, 0xDD, 0x85,
 708       0x39, 0x1A, 0xDF, 0xC6, 0xC2, 0xDD, 0x60, 0xD8, 0x7B, 0xB7, 0x36,
 709       0xD2, 0xB5, 0x21, 0x48, 0x4A, 0xA4, 0x7A, 0x0E, 0xBE, 0xF6 },
 710     "MF0xCzAJBgNVBAYTAkpQMSUwIwYDVQQKExxTRUNPTSBUcnVzdCBTeXN0ZW1zIENP"
 711     "LixMVEQuMScwJQYDVQQLEx5TZWN1cml0eSBDb21tdW5pY2F0aW9uIFJvb3RDQTI=",
 712     "AA==",
 713   },
 714   {
 715     // CN=OISTE WISeKey Global Root GB CA,OU=OISTE Foundation Endorsed,O=WISeKey,C=CH
 716     "2.16.756.5.14.7.4.8",
 717     "WISeKey EV OID",
 718     { 0x6B, 0x9C, 0x08, 0xE8, 0x6E, 0xB0, 0xF7, 0x67, 0xCF, 0xAD, 0x65,
 719       0xCD, 0x98, 0xB6, 0x21, 0x49, 0xE5, 0x49, 0x4A, 0x67, 0xF5, 0x84,
 720       0x5E, 0x7B, 0xD1, 0xED, 0x01, 0x9F, 0x27, 0xB8, 0x6B, 0xD6 },
 721     "MG0xCzAJBgNVBAYTAkNIMRAwDgYDVQQKEwdXSVNlS2V5MSIwIAYDVQQLExlPSVNU"
 722     "RSBGb3VuZGF0aW9uIEVuZG9yc2VkMSgwJgYDVQQDEx9PSVNURSBXSVNlS2V5IEds"
 723     "b2JhbCBSb290IEdCIENB",
 724     "drEgUnTwhYdGs/gjGvbCwA==",
 725   },
 726   {
 727     // CN=Amazon Root CA 1,O=Amazon,C=US
 728     "2.23.140.1.1",
 729     "CA/Browser Forum EV OID",
 730     { 0x8E, 0xCD, 0xE6, 0x88, 0x4F, 0x3D, 0x87, 0xB1, 0x12, 0x5B, 0xA3,
 731       0x1A, 0xC3, 0xFC, 0xB1, 0x3D, 0x70, 0x16, 0xDE, 0x7F, 0x57, 0xCC,
 732       0x90, 0x4F, 0xE1, 0xCB, 0x97, 0xC6, 0xAE, 0x98, 0x19, 0x6E },
 733     "MDkxCzAJBgNVBAYTAlVTMQ8wDQYDVQQKEwZBbWF6b24xGTAXBgNVBAMTEEFtYXpv"
 734     "biBSb290IENBIDE=",
 735     "Bmyfz5m/jAo54vB4ikPmljZbyg==",
 736   },
 737   {
 738     // CN=Amazon Root CA 2,O=Amazon,C=US
 739     "2.23.140.1.1",
 740     "CA/Browser Forum EV OID",
 741     { 0x1B, 0xA5, 0xB2, 0xAA, 0x8C, 0x65, 0x40, 0x1A, 0x82, 0x96, 0x01,
 742       0x18, 0xF8, 0x0B, 0xEC, 0x4F, 0x62, 0x30, 0x4D, 0x83, 0xCE, 0xC4,
 743       0x71, 0x3A, 0x19, 0xC3, 0x9C, 0x01, 0x1E, 0xA4, 0x6D, 0xB4 },
 744     "MDkxCzAJBgNVBAYTAlVTMQ8wDQYDVQQKEwZBbWF6b24xGTAXBgNVBAMTEEFtYXpv"
 745     "biBSb290IENBIDI=",
 746     "Bmyf0pY1hp8KD+WGePhbJruKNw==",
 747   },
 748   {
 749     // CN=Amazon Root CA 3,O=Amazon,C=US
 750     "2.23.140.1.1",
 751     "CA/Browser Forum EV OID",
 752     { 0x18, 0xCE, 0x6C, 0xFE, 0x7B, 0xF1, 0x4E, 0x60, 0xB2, 0xE3, 0x47,
 753       0xB8, 0xDF, 0xE8, 0x68, 0xCB, 0x31, 0xD0, 0x2E, 0xBB, 0x3A, 0xDA,
 754       0x27, 0x15, 0x69, 0xF5, 0x03, 0x43, 0xB4, 0x6D, 0xB3, 0xA4 },
 755     "MDkxCzAJBgNVBAYTAlVTMQ8wDQYDVQQKEwZBbWF6b24xGTAXBgNVBAMTEEFtYXpv"
 756     "biBSb290IENBIDM=",
 757     "Bmyf1XSXNmY/Owua2eiedgPySg==",
 758   },
 759   {
 760     // CN=Amazon Root CA 4,O=Amazon,C=US
 761     "2.23.140.1.1",
 762     "CA/Browser Forum EV OID",
 763     { 0xE3, 0x5D, 0x28, 0x41, 0x9E, 0xD0, 0x20, 0x25, 0xCF, 0xA6, 0x90,
 764       0x38, 0xCD, 0x62, 0x39, 0x62, 0x45, 0x8D, 0xA5, 0xC6, 0x95, 0xFB,
 765       0xDE, 0xA3, 0xC2, 0x2B, 0x0B, 0xFB, 0x25, 0x89, 0x70, 0x92 },
 766     "MDkxCzAJBgNVBAYTAlVTMQ8wDQYDVQQKEwZBbWF6b24xGTAXBgNVBAMTEEFtYXpv"
 767     "biBSb290IENBIDQ=",
 768     "Bmyf18G7EEwpQ+Vxe3ssyBrBDg==",
 769   },
 770   {
 771     // CN=Starfield Services Root Certificate Authority - G2,O="Starfield Technologies, Inc.",L=Scottsdale,ST=Arizona,C=US
 772     "2.23.140.1.1",
 773     "CA/Browser Forum EV OID",
 774     { 0x56, 0x8D, 0x69, 0x05, 0xA2, 0xC8, 0x87, 0x08, 0xA4, 0xB3, 0x02,
 775       0x51, 0x90, 0xED, 0xCF, 0xED, 0xB1, 0x97, 0x4A, 0x60, 0x6A, 0x13,
 776       0xC6, 0xE5, 0x29, 0x0F, 0xCB, 0x2A, 0xE6, 0x3E, 0xDA, 0xB5 },
 777     "MIGYMQswCQYDVQQGEwJVUzEQMA4GA1UECBMHQXJpem9uYTETMBEGA1UEBxMKU2Nv"
 778     "dHRzZGFsZTElMCMGA1UEChMcU3RhcmZpZWxkIFRlY2hub2xvZ2llcywgSW5jLjE7"
 779     "MDkGA1UEAxMyU3RhcmZpZWxkIFNlcnZpY2VzIFJvb3QgQ2VydGlmaWNhdGUgQXV0"
 780     "aG9yaXR5IC0gRzI=",
 781     "AA==",
 782   },
 783   {
 784     // CN=GDCA TrustAUTH R5 ROOT,O="GUANG DONG CERTIFICATE AUTHORITY CO.,LTD.",C=CN
 785     "1.2.156.112559.1.1.6.1",
 786     "GDCA EV OID",
 787     { 0xBF, 0xFF, 0x8F, 0xD0, 0x44, 0x33, 0x48, 0x7D, 0x6A, 0x8A, 0xA6,
 788       0x0C, 0x1A, 0x29, 0x76, 0x7A, 0x9F, 0xC2, 0xBB, 0xB0, 0x5E, 0x42,
 789       0x0F, 0x71, 0x3A, 0x13, 0xB9, 0x92, 0x89, 0x1D, 0x38, 0x93 },
 790     "MGIxCzAJBgNVBAYTAkNOMTIwMAYDVQQKDClHVUFORyBET05HIENFUlRJRklDQVRF"
 791     "IEFVVEhPUklUWSBDTy4sTFRELjEfMB0GA1UEAwwWR0RDQSBUcnVzdEFVVEggUjUg"
 792     "Uk9PVA==",
 793     "fQmX/vBH6no=",
 794   },
 795   {
 796     // CN=SSL.com EV Root Certification Authority ECC,O=SSL Corporation,L=Houston,ST=Texas,C=US
 797     "2.23.140.1.1",
 798     "CA/Browser Forum EV OID",
 799     { 0x22, 0xA2, 0xC1, 0xF7, 0xBD, 0xED, 0x70, 0x4C, 0xC1, 0xE7, 0x01,
 800       0xB5, 0xF4, 0x08, 0xC3, 0x10, 0x88, 0x0F, 0xE9, 0x56, 0xB5, 0xDE,
 801       0x2A, 0x4A, 0x44, 0xF9, 0x9C, 0x87, 0x3A, 0x25, 0xA7, 0xC8 },
 802     "MH8xCzAJBgNVBAYTAlVTMQ4wDAYDVQQIDAVUZXhhczEQMA4GA1UEBwwHSG91c3Rv"
 803     "bjEYMBYGA1UECgwPU1NMIENvcnBvcmF0aW9uMTQwMgYDVQQDDCtTU0wuY29tIEVW"
 804     "IFJvb3QgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgRUND",
 805     "LCmcWxbtBZU=",
 806   },
 807   {
 808     // CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US
 809     "2.23.140.1.1",
 810     "CA/Browser Forum EV OID",
 811     { 0x2E, 0x7B, 0xF1, 0x6C, 0xC2, 0x24, 0x85, 0xA7, 0xBB, 0xE2, 0xAA,
 812       0x86, 0x96, 0x75, 0x07, 0x61, 0xB0, 0xAE, 0x39, 0xBE, 0x3B, 0x2F,
 813       0xE9, 0xD0, 0xCC, 0x6D, 0x4E, 0xF7, 0x34, 0x91, 0x42, 0x5C },
 814     "MIGCMQswCQYDVQQGEwJVUzEOMAwGA1UECAwFVGV4YXMxEDAOBgNVBAcMB0hvdXN0"
 815     "b24xGDAWBgNVBAoMD1NTTCBDb3Jwb3JhdGlvbjE3MDUGA1UEAwwuU1NMLmNvbSBF"
 816     "ViBSb290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IFJTQSBSMg==",
 817     "VrYpzTS8ePY=",
 818   },
 819   {
 820     // CN=SSL.com TLS ECC Root CA 2022,O=SSL Corporation,C=US
 821     "2.23.140.1.1",
 822     "CA/Browser Forum EV OID",
 823     { 0xC3, 0x2F, 0xFD, 0x9F, 0x46, 0xF9, 0x36, 0xD1, 0x6C, 0x36, 0x73,
 824       0x99, 0x09, 0x59, 0x43, 0x4B, 0x9A, 0xD6, 0x0A, 0xAF, 0xBB, 0x9E,
 825       0x7C, 0xF3, 0x36, 0x54, 0xF1, 0x44, 0xCC, 0x1B, 0xA1, 0x43 },
 826     "ME4xCzAJBgNVBAYTAlVTMRgwFgYDVQQKDA9TU0wgQ29ycG9yYXRpb24xJTAjBgNV"
 827     "BAMMHFNTTC5jb20gVExTIEVDQyBSb290IENBIDIwMjI=",
 828     "FAP1q/s3ixdAW+JDsqXRxA==",
 829   },
 830   {
 831     // CN=SSL.com TLS RSA Root CA 2022,O=SSL Corporation,C=US
 832     "2.23.140.1.1",
 833     "CA/Browser Forum EV OID",
 834     { 0x8F, 0xAF, 0x7D, 0x2E, 0x2C, 0xB4, 0x70, 0x9B, 0xB8, 0xE0, 0xB3,
 835       0x36, 0x66, 0xBF, 0x75, 0xA5, 0xDD, 0x45, 0xB5, 0xDE, 0x48, 0x0F,
 836       0x8E, 0xA8, 0xD4, 0xBF, 0xE6, 0xBE, 0xBC, 0x17, 0xF2, 0xED },
 837     "ME4xCzAJBgNVBAYTAlVTMRgwFgYDVQQKDA9TU0wgQ29ycG9yYXRpb24xJTAjBgNV"
 838     "BAMMHFNTTC5jb20gVExTIFJTQSBSb290IENBIDIwMjI=",
 839     "b77arXO9CEDii02+1PdbkQ==",
 840   },
 841   {
 842     // CN=UCA Extended Validation Root,O=UniTrust,C=CN
 843     "2.23.140.1.1",
 844     "CA/Browser Forum EV OID",
 845     { 0xD4, 0x3A, 0xF9, 0xB3, 0x54, 0x73, 0x75, 0x5C, 0x96, 0x84, 0xFC,
 846       0x06, 0xD7, 0xD8, 0xCB, 0x70, 0xEE, 0x5C, 0x28, 0xE7, 0x73, 0xFB,
 847       0x29, 0x4E, 0xB4, 0x1E, 0xE7, 0x17, 0x22, 0x92, 0x4D, 0x24 },
 848     "MEcxCzAJBgNVBAYTAkNOMREwDwYDVQQKDAhVbmlUcnVzdDElMCMGA1UEAwwcVUNB"
 849     "IEV4dGVuZGVkIFZhbGlkYXRpb24gUm9vdA==",
 850     "T9Irj/VkyDOeTzRYZiNwYA==",
 851   },
 852   {
 853     // CN=Hongkong Post Root CA 3,O=Hongkong Post,L=Hong Kong,ST=Hong Kong,C=HK
 854     "2.23.140.1.1",
 855     "CA/Browser Forum EV OID",
 856     { 0x5A, 0x2F, 0xC0, 0x3F, 0x0C, 0x83, 0xB0, 0x90, 0xBB, 0xFA, 0x40,
 857       0x60, 0x4B, 0x09, 0x88, 0x44, 0x6C, 0x76, 0x36, 0x18, 0x3D, 0xF9,
 858       0x84, 0x6E, 0x17, 0x10, 0x1A, 0x44, 0x7F, 0xB8, 0xEF, 0xD6 },
 859     "MG8xCzAJBgNVBAYTAkhLMRIwEAYDVQQIEwlIb25nIEtvbmcxEjAQBgNVBAcTCUhv"
 860     "bmcgS29uZzEWMBQGA1UEChMNSG9uZ2tvbmcgUG9zdDEgMB4GA1UEAxMXSG9uZ2tv"
 861     "bmcgUG9zdCBSb290IENBIDM=",
 862     "CBZfikyl7ADJk0DfxMauI7gcWqQ=",
 863   },
 864   {
 865     // CN=emSign Root CA - G1,O=eMudhra Technologies Limited,OU=emSign PKI,C=IN
 866     "2.23.140.1.1",
 867     "CA/Browser Forum EV OID",
 868     { 0x40, 0xF6, 0xAF, 0x03, 0x46, 0xA9, 0x9A, 0xA1, 0xCD, 0x1D, 0x55,
 869       0x5A, 0x4E, 0x9C, 0xCE, 0x62, 0xC7, 0xF9, 0x63, 0x46, 0x03, 0xEE,
 870       0x40, 0x66, 0x15, 0x83, 0x3D, 0xC8, 0xC8, 0xD0, 0x03, 0x67 },
 871     "MGcxCzAJBgNVBAYTAklOMRMwEQYDVQQLEwplbVNpZ24gUEtJMSUwIwYDVQQKExxl"
 872     "TXVkaHJhIFRlY2hub2xvZ2llcyBMaW1pdGVkMRwwGgYDVQQDExNlbVNpZ24gUm9v"
 873     "dCBDQSAtIEcx",
 874     "MfXkYgxsWO3W2A==",
 875   },
 876   {
 877     // CN=emSign ECC Root CA - G3,O=eMudhra Technologies Limited,OU=emSign PKI,C=IN
 878     "2.23.140.1.1",
 879     "CA/Browser Forum EV OID",
 880     { 0x86, 0xA1, 0xEC, 0xBA, 0x08, 0x9C, 0x4A, 0x8D, 0x3B, 0xBE, 0x27,
 881       0x34, 0xC6, 0x12, 0xBA, 0x34, 0x1D, 0x81, 0x3E, 0x04, 0x3C, 0xF9,
 882       0xE8, 0xA8, 0x62, 0xCD, 0x5C, 0x57, 0xA3, 0x6B, 0xBE, 0x6B },
 883     "MGsxCzAJBgNVBAYTAklOMRMwEQYDVQQLEwplbVNpZ24gUEtJMSUwIwYDVQQKExxl"
 884     "TXVkaHJhIFRlY2hub2xvZ2llcyBMaW1pdGVkMSAwHgYDVQQDExdlbVNpZ24gRUND"
 885     "IFJvb3QgQ0EgLSBHMw==",
 886     "PPYHqWhwDtqLhA==",
 887   },
 888   {
 889     // CN=emSign Root CA - C1,O=eMudhra Inc,OU=emSign PKI,C=US
 890     "2.23.140.1.1",
 891     "CA/Browser Forum EV OID",
 892     { 0x12, 0x56, 0x09, 0xAA, 0x30, 0x1D, 0xA0, 0xA2, 0x49, 0xB9, 0x7A,
 893       0x82, 0x39, 0xCB, 0x6A, 0x34, 0x21, 0x6F, 0x44, 0xDC, 0xAC, 0x9F,
 894       0x39, 0x54, 0xB1, 0x42, 0x92, 0xF2, 0xE8, 0xC8, 0x60, 0x8F },
 895     "MFYxCzAJBgNVBAYTAlVTMRMwEQYDVQQLEwplbVNpZ24gUEtJMRQwEgYDVQQKEwtl"
 896     "TXVkaHJhIEluYzEcMBoGA1UEAxMTZW1TaWduIFJvb3QgQ0EgLSBDMQ==",
 897     "AK7PALrEzzL4Q7I=",
 898     },
 899   {
 900     // CN=emSign ECC Root CA - C3,O=eMudhra Inc,OU=emSign PKI,C=US
 901     "2.23.140.1.1",
 902     "CA/Browser Forum EV OID",
 903     { 0xBC, 0x4D, 0x80, 0x9B, 0x15, 0x18, 0x9D, 0x78, 0xDB, 0x3E, 0x1D,
 904       0x8C, 0xF4, 0xF9, 0x72, 0x6A, 0x79, 0x5D, 0xA1, 0x64, 0x3C, 0xA5,
 905       0xF1, 0x35, 0x8E, 0x1D, 0xDB, 0x0E, 0xDC, 0x0D, 0x7E, 0xB3 },
 906     "MFoxCzAJBgNVBAYTAlVTMRMwEQYDVQQLEwplbVNpZ24gUEtJMRQwEgYDVQQKEwtl"
 907     "TXVkaHJhIEluYzEgMB4GA1UEAxMXZW1TaWduIEVDQyBSb290IENBIC0gQzM=",
 908     "e3G2gla4EnycqA==",
 909   },
 910   {
 911     // OU=certSIGN ROOT CA G2,O=CERTSIGN SA,C=RO
 912     "2.23.140.1.1",
 913     "CA/Browser Forum EV OID",
 914     { 0x65, 0x7C, 0xFE, 0x2F, 0xA7, 0x3F, 0xAA, 0x38, 0x46, 0x25, 0x71,
 915       0xF3, 0x32, 0xA2, 0x36, 0x3A, 0x46, 0xFC, 0xE7, 0x02, 0x09, 0x51,
 916       0x71, 0x07, 0x02, 0xCD, 0xFB, 0xB6, 0xEE, 0xDA, 0x33, 0x05 },
 917     "MEExCzAJBgNVBAYTAlJPMRQwEgYDVQQKEwtDRVJUU0lHTiBTQTEcMBoGA1UECxMT"
 918     "Y2VydFNJR04gUk9PVCBDQSBHMg==",
 919     "EQA0tk7GNi02",
 920   },
 921   {
 922     // CN=IdenTrust Commercial Root CA 1,O=IdenTrust,C=US
 923     "2.23.140.1.1",
 924     "CA/Browser Forum EV OID",
 925     { 0x5D, 0x56, 0x49, 0x9B, 0xE4, 0xD2, 0xE0, 0x8B, 0xCF, 0xCA, 0xD0,
 926       0x8A, 0x3E, 0x38, 0x72, 0x3D, 0x50, 0x50, 0x3B, 0xDE, 0x70, 0x69,
 927       0x48, 0xE4, 0x2F, 0x55, 0x60, 0x30, 0x19, 0xE5, 0x28, 0xAE },
 928     "MEoxCzAJBgNVBAYTAlVTMRIwEAYDVQQKEwlJZGVuVHJ1c3QxJzAlBgNVBAMTHklk"
 929     "ZW5UcnVzdCBDb21tZXJjaWFsIFJvb3QgQ0EgMQ==",
 930     "CgFCgAAAAUUjyES1AAAAAg==",
 931   },
 932   {
 933     // CN=Trustwave Global Certification Authority,O="Trustwave Holdings, Inc.",L=Chicago,ST=Illinois,C=US
 934     "2.23.140.1.1",
 935     "CA/Browser Forum EV OID",
 936     { 0x97, 0x55, 0x20, 0x15, 0xF5, 0xDD, 0xFC, 0x3C, 0x87, 0x88, 0xC0, 0x06, 0x94, 0x45, 0x55, 0x40, 0x88, 0x94, 0x45, 0x00, 0x84, 0xF1, 0x00, 0x86, 0x70, 0x86, 0xBC, 0x1A, 0x2B, 0xB5, 0x8D, 0xC8 },
 937     "MIGIMQswCQYDVQQGEwJVUzERMA8GA1UECAwISWxsaW5vaXMxEDAOBgNVBAcMB0No"
 938     "aWNhZ28xITAfBgNVBAoMGFRydXN0d2F2ZSBIb2xkaW5ncywgSW5jLjExMC8GA1UE"
 939     "AwwoVHJ1c3R3YXZlIEdsb2JhbCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eQ==",
 940     "BfcOhtpJ80Y1Lrqy",
 941   },
 942   {
 943     // CN=Trustwave Global ECC P256 Certification Authority,O="Trustwave Holdings, Inc.",L=Chicago,ST=Illinois,C=US
 944     "2.23.140.1.1",
 945     "CA/Browser Forum EV OID",
 946     { 0x94, 0x5B, 0xBC, 0x82, 0x5E, 0xA5, 0x54, 0xF4, 0x89, 0xD1, 0xFD, 0x51, 0xA7, 0x3D, 0xDF, 0x2E, 0xA6, 0x24, 0xAC, 0x70, 0x19, 0xA0, 0x52, 0x05, 0x22, 0x5C, 0x22, 0xA7, 0x8C, 0xCF, 0xA8, 0xB4 },
 947     "MIGRMQswCQYDVQQGEwJVUzERMA8GA1UECBMISWxsaW5vaXMxEDAOBgNVBAcTB0No"
 948     "aWNhZ28xITAfBgNVBAoTGFRydXN0d2F2ZSBIb2xkaW5ncywgSW5jLjE6MDgGA1UE"
 949     "AxMxVHJ1c3R3YXZlIEdsb2JhbCBFQ0MgUDI1NiBDZXJ0aWZpY2F0aW9uIEF1dGhv"
 950     "cml0eQ==",
 951     "DWpfCD8oXD5Rld9d",
 952   },
 953   {
 954     // CN=Trustwave Global ECC P384 Certification Authority,O="Trustwave Holdings, Inc.",L=Chicago,ST=Illinois,C=US
 955     "2.23.140.1.1",
 956     "CA/Browser Forum EV OID",
 957     { 0x55, 0x90, 0x38, 0x59, 0xC8, 0xC0, 0xC3, 0xEB, 0xB8, 0x75, 0x9E, 0xCE, 0x4E, 0x25, 0x57, 0x22, 0x5F, 0xF5, 0x75, 0x8B, 0xBD, 0x38, 0xEB, 0xD4, 0x82, 0x76, 0x60, 0x1E, 0x1B, 0xD5, 0x80, 0x97 },
 958     "MIGRMQswCQYDVQQGEwJVUzERMA8GA1UECBMISWxsaW5vaXMxEDAOBgNVBAcTB0No"
 959     "aWNhZ28xITAfBgNVBAoTGFRydXN0d2F2ZSBIb2xkaW5ncywgSW5jLjE6MDgGA1UE"
 960     "AxMxVHJ1c3R3YXZlIEdsb2JhbCBFQ0MgUDM4NCBDZXJ0aWZpY2F0aW9uIEF1dGhv"
 961     "cml0eQ==",
 962     "CL2Fl2yZJ6SAaEc7",
 963   },
 964   {
 965     // CN=GlobalSign Root R46,O=GlobalSign nv-sa,C=BE
 966     "2.23.140.1.1",
 967     "CA/Browser Forum EV OID",
 968     { 0x4F, 0xA3, 0x12, 0x6D, 0x8D, 0x3A, 0x11, 0xD1, 0xC4, 0x85, 0x5A, 0x4F, 0x80, 0x7C, 0xBA, 0xD6, 0xCF, 0x91, 0x9D, 0x3A, 0x5A, 0x88, 0xB0, 0x3B, 0xEA, 0x2C, 0x63, 0x72, 0xD9, 0x3C, 0x40, 0xC9 },
 969     "MEYxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMRwwGgYD"
 970     "VQQDExNHbG9iYWxTaWduIFJvb3QgUjQ2",
 971     "EdK7udcjGJ5AXwqdLdDfJWfR",
 972   },
 973   {
 974     // CN=GlobalSign Root E46,O=GlobalSign nv-sa,C=BE
 975     "2.23.140.1.1",
 976     "CA/Browser Forum EV OID",
 977     { 0xCB, 0xB9, 0xC4, 0x4D, 0x84, 0xB8, 0x04, 0x3E, 0x10, 0x50, 0xEA, 0x31, 0xA6, 0x9F, 0x51, 0x49, 0x55, 0xD7, 0xBF, 0xD2, 0xE2, 0xC6, 0xB4, 0x93, 0x01, 0x01, 0x9A, 0xD6, 0x1D, 0x9F, 0x50, 0x58 },
 978     "MEYxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMRwwGgYD"
 979     "VQQDExNHbG9iYWxTaWduIFJvb3QgRTQ2",
 980     "EdK7ujNu1LzmJGjFDYQdmOhD",
 981   },
 982   {
 983     // "CN=AC RAIZ FNMT-RCM SERVIDORES SEGUROS,OID.2.5.4.97=VATES-Q2826004J,OU=Ceres,O=FNMT-RCM,C=E
 984     "2.23.140.1.1",
 985     "CA/Browser Forum EV OID",
 986     { 0x55, 0x41, 0x53, 0xB1, 0x3D, 0x2C, 0xF9, 0xDD, 0xB7, 0x53, 0xBF, 0xBE, 0x1A, 0x4E, 0x0A, 0xE0, 0x8D, 0x0A, 0xA4, 0x18, 0x70, 0x58, 0xFE, 0x60, 0xA2, 0xB8, 0x62, 0xB2, 0xE4, 0xB8, 0x7B, 0xCB },
 987     "MHgxCzAJBgNVBAYTAkVTMREwDwYDVQQKDAhGTk1ULVJDTTEOMAwGA1UECwwFQ2Vy"
 988     "ZXMxGDAWBgNVBGEMD1ZBVEVTLVEyODI2MDA0SjEsMCoGA1UEAwwjQUMgUkFJWiBG"
 989     "Tk1ULVJDTSBTRVJWSURPUkVTIFNFR1VST1M=",
 990     "YvYybOXE42hcG2LdnC6dlQ==",
 991   },
 992   {
 993     // CN=GLOBALTRUST 2020,O=e-commerce monitoring GmbH,C=AT
 994     "2.23.140.1.1",
 995     "CA/Browser Forum EV OID",
 996     { 0x9A, 0x29, 0x6A, 0x51, 0x82, 0xD1, 0xD4, 0x51, 0xA2, 0xE3, 0x7F, 0x43, 0x9B, 0x74, 0xDA, 0xAF, 0xA2, 0x67, 0x52, 0x33, 0x29, 0xF9, 0x0F, 0x9A, 0x0D, 0x20, 0x07, 0xC3, 0x34, 0xE2, 0x3C, 0x9A },
 997     "ME0xCzAJBgNVBAYTAkFUMSMwIQYDVQQKExplLWNvbW1lcmNlIG1vbml0b3Jpbmcg"
 998     "R21iSDEZMBcGA1UEAxMQR0xPQkFMVFJVU1QgMjAyMA==",
 999     "Wku9WvtPilv6ZeU=",
1000   },
1001   {
1002     // CN=Certum Extended Validation ECC CA,OU=Certum Certification Authority,O=Asseco Data Systems S.A.,C=PL
1003     "2.23.140.1.1",
1004     "CA/Browser Forum EV OID",
1005     { 0x6B, 0x32, 0x80, 0x85, 0x62, 0x53, 0x18, 0xAA, 0x50, 0xD1, 0x73, 0xC9, 0x8D, 0x8B, 0xDA, 0x09, 0xD5, 0x7E, 0x27, 0x41, 0x3D, 0x11, 0x4C, 0xF7, 0x87, 0xA0, 0xF5, 0xD0, 0x6C, 0x03, 0x0C, 0xF6 },
1006     "MHQxCzAJBgNVBAYTAlBMMSEwHwYDVQQKExhBc3NlY28gRGF0YSBTeXN0ZW1zIFMu"
1007     "QS4xJzAlBgNVBAsTHkNlcnR1bSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEZMBcG"
1008     "A1UEAxMQQ2VydHVtIEVDLTM4NCBDQQ==",
1009     "eI8nXIESUiClBNAt3bpz9A==",
1010   },
1011   {
1012     // CN=Certum Extended Validation RSA CA,OU=Certum Certification Authority,O=Asseco Data Systems S.A.,C=PL
1013     "2.23.140.1.1",
1014     "CA/Browser Forum EV OID",
1015     { 0xFE, 0x76, 0x96, 0x57, 0x38, 0x55, 0x77, 0x3E, 0x37, 0xA9, 0x5E, 0x7A, 0xD4, 0xD9, 0xCC, 0x96, 0xC3, 0x01, 0x57, 0xC1, 0x5D, 0x31, 0x76, 0x5B, 0xA9, 0xB1, 0x57, 0x04, 0xE1, 0xAE, 0x78, 0xFD },
1016     "MHoxCzAJBgNVBAYTAlBMMSEwHwYDVQQKExhBc3NlY28gRGF0YSBTeXN0ZW1zIFMu"
1017     "QS4xJzAlBgNVBAsTHkNlcnR1bSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEfMB0G"
1018     "A1UEAxMWQ2VydHVtIFRydXN0ZWQgUm9vdCBDQQ==",
1019     "Hr9ZULjJgDdMBvfrVU+17Q==",
1020   },
1021   {
1022     // CN=ANF Secure Server Root CA,OU=ANF CA Raiz,O=ANF Autoridad de Certificacion,C=ES,serialNumber=G63287510
1023     "2.23.140.1.1",
1024     "CA/Browser Forum EV OID",
1025     { 0xFB, 0x8F, 0xEC, 0x75, 0x91, 0x69, 0xB9, 0x10, 0x6B, 0x1E, 0x51, 0x16, 0x44, 0xC6, 0x18, 0xC5, 0x13, 0x04, 0x37, 0x3F, 0x6C, 0x06, 0x43, 0x08, 0x8D, 0x8B, 0xEF, 0xFD, 0x1B, 0x99, 0x75, 0x99 },
1026     "MIGEMRIwEAYDVQQFEwlHNjMyODc1MTAxCzAJBgNVBAYTAkVTMScwJQYDVQQKEx5B"
1027     "TkYgQXV0b3JpZGFkIGRlIENlcnRpZmljYWNpb24xFDASBgNVBAsTC0FORiBDQSBS"
1028     "YWl6MSIwIAYDVQQDExlBTkYgU2VjdXJlIFNlcnZlciBSb290IENB",
1029     "DdPjvGz5a7E=",
1030   },
1031   {
1032     // CN=Hellenic Academic and Research Institutions ECC RootCA 2015,O=Hellenic Academic and Research Institutions Cert. Authority,L=Athens,C=GR
1033     "2.23.140.1.1",
1034     "CA/Browser Forum EV OID",
1035     { 0x44, 0xB5, 0x45, 0xAA, 0x8A, 0x25, 0xE6, 0x5A, 0x73, 0xCA, 0x15,
1036       0xDC, 0x27, 0xFC, 0x36, 0xD2, 0x4C, 0x1C, 0xB9, 0x95, 0x3A, 0x06,
1037       0x65, 0x39, 0xB1, 0x15, 0x82, 0xDC, 0x48, 0x7B, 0x48, 0x33 },
1038     "MIGqMQswCQYDVQQGEwJHUjEPMA0GA1UEBxMGQXRoZW5zMUQwQgYDVQQKEztIZWxs"
1039     "ZW5pYyBBY2FkZW1pYyBhbmQgUmVzZWFyY2ggSW5zdGl0dXRpb25zIENlcnQuIEF1"
1040     "dGhvcml0eTFEMEIGA1UEAxM7SGVsbGVuaWMgQWNhZGVtaWMgYW5kIFJlc2VhcmNo"
1041     "IEluc3RpdHV0aW9ucyBFQ0MgUm9vdENBIDIwMTU=",
1042     "AA==",
1043   },
1044   {
1045     // CN=Hellenic Academic and Research Institutions RootCA 2015,O=Hellenic Academic and Research Institutions Cert. Authority,L=Athens,C=GR
1046     "2.23.140.1.1",
1047     "CA/Browser Forum EV OID",
1048     { 0xA0, 0x40, 0x92, 0x9A, 0x02, 0xCE, 0x53, 0xB4, 0xAC, 0xF4, 0xF2,
1049       0xFF, 0xC6, 0x98, 0x1C, 0xE4, 0x49, 0x6F, 0x75, 0x5E, 0x6D, 0x45,
1050       0xFE, 0x0B, 0x2A, 0x69, 0x2B, 0xCD, 0x52, 0x52, 0x3F, 0x36 },
1051     "MIGmMQswCQYDVQQGEwJHUjEPMA0GA1UEBxMGQXRoZW5zMUQwQgYDVQQKEztIZWxs"
1052     "ZW5pYyBBY2FkZW1pYyBhbmQgUmVzZWFyY2ggSW5zdGl0dXRpb25zIENlcnQuIEF1"
1053     "dGhvcml0eTFAMD4GA1UEAxM3SGVsbGVuaWMgQWNhZGVtaWMgYW5kIFJlc2VhcmNo"
1054     "IEluc3RpdHV0aW9ucyBSb290Q0EgMjAxNQ==",
1055     "AA==",
1056   },
1057   {
1058     // CN=HARICA TLS RSA Root CA 2021,O=Hellenic Academic and Research Institutions CA,C=GR
1059     "2.23.140.1.1",
1060     "CA/Browser Forum EV OID",
1061     { 0xD9, 0x5D, 0x0E, 0x8E, 0xDA, 0x79, 0x52, 0x5B, 0xF9, 0xBE, 0xB1,
1062       0x1B, 0x14, 0xD2, 0x10, 0x0D, 0x32, 0x94, 0x98, 0x5F, 0x0C, 0x62,
1063       0xD9, 0xFA, 0xBD, 0x9C, 0xD9, 0x99, 0xEC, 0xCB, 0x7B, 0x1D },
1064     "MGwxCzAJBgNVBAYTAkdSMTcwNQYDVQQKDC5IZWxsZW5pYyBBY2FkZW1pYyBhbmQg"
1065     "UmVzZWFyY2ggSW5zdGl0dXRpb25zIENBMSQwIgYDVQQDDBtIQVJJQ0EgVExTIFJT"
1066     "QSBSb290IENBIDIwMjE=",
1067     "OcqTHO9D88aOk8f0ZIk4fg==",
1068   },
1069   {
1070     // CN=HARICA TLS ECC Root CA 2021,O=Hellenic Academic and Research Institutions CA,C=GR
1071     "2.23.140.1.1",
1072     "CA/Browser Forum EV OID",
1073     { 0x3F, 0x99, 0xCC, 0x47, 0x4A, 0xCF, 0xCE, 0x4D, 0xFE, 0xD5, 0x87,
1074       0x94, 0x66, 0x5E, 0x47, 0x8D, 0x15, 0x47, 0x73, 0x9F, 0x2E, 0x78,
1075       0x0F, 0x1B, 0xB4, 0xCA, 0x9B, 0x13, 0x30, 0x97, 0xD4, 0x01 },
1076     "MGwxCzAJBgNVBAYTAkdSMTcwNQYDVQQKDC5IZWxsZW5pYyBBY2FkZW1pYyBhbmQg"
1077     "UmVzZWFyY2ggSW5zdGl0dXRpb25zIENBMSQwIgYDVQQDDBtIQVJJQ0EgVExTIEVD"
1078     "QyBSb290IENBIDIwMjE=",
1079     "Z3SdjXfYO2rbIvT/WeK/zg==",
1080   },
1081   {
1082     // CN=vTrus Root CA,O="iTrusChina Co.,Ltd.",C=CN
1083     "2.23.140.1.1",
1084     "CA/Browser Forum EV OID",
1085     { 0x8A, 0x71, 0xDE, 0x65, 0x59, 0x33, 0x6F, 0x42, 0x6C, 0x26, 0xE5,
1086       0x38, 0x80, 0xD0, 0x0D, 0x88, 0xA1, 0x8D, 0xA4, 0xC6, 0xA9, 0x1F,
1087       0x0D, 0xCB, 0x61, 0x94, 0xE2, 0x06, 0xC5, 0xC9, 0x63, 0x87 },
1088     "MEMxCzAJBgNVBAYTAkNOMRwwGgYDVQQKExNpVHJ1c0NoaW5hIENvLixMdGQuMRYw"
1089     "FAYDVQQDEw12VHJ1cyBSb290IENB",
1090     "Q+NxE9izWRRdt86M/TX9b7wFjUU=",
1091   },
1092   {
1093     // CN=vTrus ECC Root CA,O="iTrusChina Co.,Ltd.",C=CN
1094     "2.23.140.1.1",
1095     "CA/Browser Forum EV OID",
1096     { 0x30, 0xFB, 0xBA, 0x2C, 0x32, 0x23, 0x8E, 0x2A, 0x98, 0x54, 0x7A,
1097       0xF9, 0x79, 0x31, 0xE5, 0x50, 0x42, 0x8B, 0x9B, 0x3F, 0x1C, 0x8E,
1098       0xEB, 0x66, 0x33, 0xDC, 0xFA, 0x86, 0xC5, 0xB2, 0x7D, 0xD3 },
1099     "MEcxCzAJBgNVBAYTAkNOMRwwGgYDVQQKExNpVHJ1c0NoaW5hIENvLixMdGQuMRow"
1100     "GAYDVQQDExF2VHJ1cyBFQ0MgUm9vdCBDQQ==",
1101     "bmq8WapTvpg5Z6LSa6Q75m0c1to=",
1102   },
1103   {
1104     // CN=Autoridad de Certificacion Firmaprofesional CIF A62634068,C=ES
1105     "2.23.140.1.1",
1106     "CA/Browser Forum EV OID",
1107     { 0x57, 0xDE, 0x05, 0x83, 0xEF, 0xD2, 0xB2, 0x6E, 0x03, 0x61, 0xDA,
1108       0x99, 0xDA, 0x9D, 0xF4, 0x64, 0x8D, 0xEF, 0x7E, 0xE8, 0x44, 0x1C,
1109       0x3B, 0x72, 0x8A, 0xFA, 0x9B, 0xCD, 0xE0, 0xF9, 0xB2, 0x6A },
1110     "MFExCzAJBgNVBAYTAkVTMUIwQAYDVQQDDDlBdXRvcmlkYWQgZGUgQ2VydGlmaWNh"
1111     "Y2lvbiBGaXJtYXByb2Zlc2lvbmFsIENJRiBBNjI2MzQwNjg=",
1112     "G3Dp0v+ubHE=",
1113   },
1114   {
1115     // CN=NetLock Arany (Class Gold) Főtanúsítvány,OU=Tanúsítványkiadók (Certification Services),O=NetLock Kft.,L=Budapest,C=HU
1116     "2.23.140.1.1",
1117     "CA/Browser Forum EV OID",
1118     { 0x6C, 0x61, 0xDA, 0xC3, 0xA2, 0xDE, 0xF0, 0x31, 0x50, 0x6B, 0xE0,
1119       0x36, 0xD2, 0xA6, 0xFE, 0x40, 0x19, 0x94, 0xFB, 0xD1, 0x3D, 0xF9,
1120       0xC8, 0xD4, 0x66, 0x59, 0x92, 0x74, 0xC4, 0x46, 0xEC, 0x98 },
1121     "MIGnMQswCQYDVQQGEwJIVTERMA8GA1UEBwwIQnVkYXBlc3QxFTATBgNVBAoMDE5l"
1122     "dExvY2sgS2Z0LjE3MDUGA1UECwwuVGFuw7pzw610dsOhbnlraWFkw7NrIChDZXJ0"
1123     "aWZpY2F0aW9uIFNlcnZpY2VzKTE1MDMGA1UEAwwsTmV0TG9jayBBcmFueSAoQ2xh"
1124     "c3MgR29sZCkgRsWRdGFuw7pzw610dsOhbnk=",
1125     "SUEs5AAQ",
1126   },
1127   {
1128     // CN=D-TRUST EV Root CA 1 2020,O=D-Trust GmbH,C=DE
1129     "2.23.140.1.1",
1130     "CA/Browser Forum EV OID",
1131     { 0x08, 0x17, 0x0D, 0x1A, 0xA3, 0x64, 0x53, 0x90, 0x1A, 0x2F, 0x95,
1132       0x92, 0x45, 0xE3, 0x47, 0xDB, 0x0C, 0x8D, 0x37, 0xAB, 0xAA, 0xBC,
1133       0x56, 0xB8, 0x1A, 0xA1, 0x00, 0xDC, 0x95, 0x89, 0x70, 0xDB },
1134     "MEgxCzAJBgNVBAYTAkRFMRUwEwYDVQQKEwxELVRydXN0IEdtYkgxIjAgBgNVBAMT"
1135     "GUQtVFJVU1QgRVYgUm9vdCBDQSAxIDIwMjA=",
1136     "XwJB13qHfEwDo6yWjfv/0A==",
1137   },
1138   {
1139     // CN=BJCA Global Root CA1,O=BEIJING CERTIFICATE AUTHORITY,C=CN
1140     "2.23.140.1.1",
1141     "CA/Browser Forum EV OID",
1142     { 0xF3, 0x89, 0x6F, 0x88, 0xFE, 0x7C, 0x0A, 0x88, 0x27, 0x66, 0xA7,
1143       0xFA, 0x6A, 0xD2, 0x74, 0x9F, 0xB5, 0x7A, 0x7F, 0x3E, 0x98, 0xFB,
1144       0x76, 0x9C, 0x1F, 0xA7, 0xB0, 0x9C, 0x2C, 0x44, 0xD5, 0xAE },
1145     "MFQxCzAJBgNVBAYTAkNOMSYwJAYDVQQKDB1CRUlKSU5HIENFUlRJRklDQVRFIEFV"
1146     "VEhPUklUWTEdMBsGA1UEAwwUQkpDQSBHbG9iYWwgUm9vdCBDQTE=",
1147     "VW9l47TZkGobCdFsPsBsIA==",
1148   },
1149   {
1150     // CN=BJCA Global Root CA2,O=BEIJING CERTIFICATE AUTHORITY,C=CN
1151     "2.23.140.1.1",
1152     "CA/Browser Forum EV OID",
1153     { 0x57, 0x4D, 0xF6, 0x93, 0x1E, 0x27, 0x80, 0x39, 0x66, 0x7B, 0x72,
1154       0x0A, 0xFD, 0xC1, 0x60, 0x0F, 0xC2, 0x7E, 0xB6, 0x6D, 0xD3, 0x09,
1155       0x29, 0x79, 0xFB, 0x73, 0x85, 0x64, 0x87, 0x21, 0x28, 0x82 },
1156     "MFQxCzAJBgNVBAYTAkNOMSYwJAYDVQQKDB1CRUlKSU5HIENFUlRJRklDQVRFIEFV"
1157     "VEhPUklUWTEdMBsGA1UEAwwUQkpDQSBHbG9iYWwgUm9vdCBDQTI=",
1158     "LBcIfWQqwP6FGFkGz7RK6w==",
1159   },
1160   {
1161     // CN=Sectigo Public Server Authentication Root E46,O=Sectigo Limited,C=GB
1162     "2.23.140.1.1",
1163     "CA/Browser Forum EV OID",
1164     { 0xC9, 0x0F, 0x26, 0xF0, 0xFB, 0x1B, 0x40, 0x18, 0xB2, 0x22, 0x27,
1165       0x51, 0x9B, 0x5C, 0xA2, 0xB5, 0x3E, 0x2C, 0xA5, 0xB3, 0xBE, 0x5C,
1166       0xF1, 0x8E, 0xFE, 0x1B, 0xEF, 0x47, 0x38, 0x0C, 0x53, 0x83 },
1167     "MF8xCzAJBgNVBAYTAkdCMRgwFgYDVQQKEw9TZWN0aWdvIExpbWl0ZWQxNjA0BgNV"
1168     "BAMTLVNlY3RpZ28gUHVibGljIFNlcnZlciBBdXRoZW50aWNhdGlvbiBSb290IEU0"
1169     "Ng==",
1170     "QvLM2htpN0RfFf51KBC49A==",
1171   },
1172   {
1173     // CN=Sectigo Public Server Authentication Root R46,O=Sectigo Limited,C=GB
1174     "2.23.140.1.1",
1175     "CA/Browser Forum EV OID",
1176     { 0x7B, 0xB6, 0x47, 0xA6, 0x2A, 0xEE, 0xAC, 0x88, 0xBF, 0x25, 0x7A,
1177       0xA5, 0x22, 0xD0, 0x1F, 0xFE, 0xA3, 0x95, 0xE0, 0xAB, 0x45, 0xC7,
1178       0x3F, 0x93, 0xF6, 0x56, 0x54, 0xEC, 0x38, 0xF2, 0x5A, 0x06 },
1179     "MF8xCzAJBgNVBAYTAkdCMRgwFgYDVQQKEw9TZWN0aWdvIExpbWl0ZWQxNjA0BgNV"
1180     "BAMTLVNlY3RpZ28gUHVibGljIFNlcnZlciBBdXRoZW50aWNhdGlvbiBSb290IFI0"
1181     "Ng==",
1182     "dY39i658BwD6qSWn4cetFA==",
1183   },
1184   {
1185     // CN=TrustAsia Global Root CA G3,O="TrustAsia Technologies, Inc.",C=CN
1186     "2.23.140.1.1",
1187     "CA/Browser Forum EV OID",
1188     { 0xE0, 0xD3, 0x22, 0x6A, 0xEB, 0x11, 0x63, 0xC2, 0xE4, 0x8F, 0xF9,
1189       0xBE, 0x3B, 0x50, 0xB4, 0xC6, 0x43, 0x1B, 0xE7, 0xBB, 0x1E, 0xAC,
1190       0xC5, 0xC3, 0x6B, 0x5D, 0x5E, 0xC5, 0x09, 0x03, 0x9A, 0x08 },
1191     "MFoxCzAJBgNVBAYTAkNOMSUwIwYDVQQKDBxUcnVzdEFzaWEgVGVjaG5vbG9naWVz"
1192     "LCBJbmMuMSQwIgYDVQQDDBtUcnVzdEFzaWEgR2xvYmFsIFJvb3QgQ0EgRzM=",
1193     "ZPYOZXdhaqs7tOqFhLuxibhxkw8=",
1194   },
1195   {
1196     // CN=TrustAsia Global Root CA G4,O="TrustAsia Technologies, Inc.",C=CN
1197     "2.23.140.1.1",
1198     "CA/Browser Forum EV OID",
1199     { 0xBE, 0x4B, 0x56, 0xCB, 0x50, 0x56, 0xC0, 0x13, 0x6A, 0x52, 0x6D,
1200       0xF4, 0x44, 0x50, 0x8D, 0xAA, 0x36, 0xA0, 0xB5, 0x4F, 0x42, 0xE4,
1201       0xAC, 0x38, 0xF7, 0x2A, 0xF4, 0x70, 0xE4, 0x79, 0x65, 0x4C },
1202     "MFoxCzAJBgNVBAYTAkNOMSUwIwYDVQQKDBxUcnVzdEFzaWEgVGVjaG5vbG9naWVz"
1203     "LCBJbmMuMSQwIgYDVQQDDBtUcnVzdEFzaWEgR2xvYmFsIFJvb3QgQ0EgRzQ=",
1204     "TyNkuI6XY57GU4HBdk7LKnQV1tc=",
1205   },
1206   {
1207     // CN=Telekom Security TLS ECC Root 2020,O=Deutsche Telekom Security GmbH,C=DE
1208     "2.23.140.1.1",
1209     "CA/Browser Forum EV OID",
1210     { 0x57, 0x8A, 0xF4, 0xDE, 0xD0, 0x85, 0x3F, 0x4E, 0x59, 0x98, 0xDB,
1211       0x4A, 0xEA, 0xF9, 0xCB, 0xEA, 0x8D, 0x94, 0x5F, 0x60, 0xB6, 0x20,
1212       0xA3, 0x8D, 0x1A, 0x3C, 0x13, 0xB2, 0xBC, 0x7B, 0xA8, 0xE1 },
1213     "MGMxCzAJBgNVBAYTAkRFMScwJQYDVQQKDB5EZXV0c2NoZSBUZWxla29tIFNlY3Vy"
1214     "aXR5IEdtYkgxKzApBgNVBAMMIlRlbGVrb20gU2VjdXJpdHkgVExTIEVDQyBSb290"
1215     "IDIwMjA=",
1216     "NjqWjMlcsljN0AFdxeVXAA==",
1217   },
1218   {
1219     // CN=Telekom Security TLS RSA Root 2023,O=Deutsche Telekom Security GmbH,C=DE
1220     "2.23.140.1.1",
1221     "CA/Browser Forum EV OID",
1222     { 0xEF, 0xC6, 0x5C, 0xAD, 0xBB, 0x59, 0xAD, 0xB6, 0xEF, 0xE8, 0x4D,
1223       0xA2, 0x23, 0x11, 0xB3, 0x56, 0x24, 0xB7, 0x1B, 0x3B, 0x1E, 0xA0,
1224       0xDA, 0x8B, 0x66, 0x55, 0x17, 0x4E, 0xC8, 0x97, 0x86, 0x46 },
1225     "MGMxCzAJBgNVBAYTAkRFMScwJQYDVQQKDB5EZXV0c2NoZSBUZWxla29tIFNlY3Vy"
1226     "aXR5IEdtYkgxKzApBgNVBAMMIlRlbGVrb20gU2VjdXJpdHkgVExTIFJTQSBSb290"
1227     "IDIwMjM=",
1228     "IZxULej27HF3+k7ow3BXlw==",
1229   },
1230     // clang-format on
1231 };
1232
1233 static pkix::CertPolicyId sEVInfoIds[ArrayLength(kEVInfos)];
1234 static_assert(
1235     ArrayLength(sEVInfoIds) == ArrayLength(kEVInfos),
1236     "These arrays are used in parallel and must have the same length.");
1237 static pkix::CertPolicyId sCABForumEVId = {};
1238
1239 bool CertIsAuthoritativeForEVPolicy(const nsTArray<uint8_t>& certBytes,
1240                                     const pkix::CertPolicyId& policy) {
1241   nsTArray<uint8_t> fingerprint;
1242   nsresult rv = Digest::DigestBuf(SEC_OID_SHA256, certBytes.Elements(),
1243                                   certBytes.Length(), fingerprint);
1244   if (NS_FAILED(rv)) {
1245     return false;
1246   }
1247   if (fingerprint.Length() != SHA256_LENGTH) {
1248     return false;
1249   }
1250
1251   for (size_t i = 0; i < ArrayLength(kEVInfos); ++i) {
1252     const EVInfo& entry = kEVInfos[i];
1253
1254     // This check ensures that only the specific roots we approve for EV get
1255     // that status, and not certs (roots or otherwise) that happen to have an
1256     // OID that's already been approved for EV.
1257     if (!ArrayEqual(&fingerprint[0], &entry.sha256Fingerprint[0],
1258                     SHA256_LENGTH)) {
1259       continue;
1260     }
1261
1262     if (policy == sCABForumEVId || policy == sEVInfoIds[i]) {
1263       return true;
1264     }
1265   }
1266
1267   return false;
1268 }
1269
1270 nsresult LoadExtendedValidationInfo() {
1271   static const char* sCABForumOIDString = "2.23.140.1.1";
1272
1273   ScopedAutoSECItem cabforumOIDItem;
1274   if (SEC_StringToOID(nullptr, &cabforumOIDItem, sCABForumOIDString, 0) !=
1275       SECSuccess) {
1276     return NS_ERROR_FAILURE;
1277   }
1278   if (cabforumOIDItem.len > pkix::CertPolicyId::MAX_BYTES) {
1279     return NS_ERROR_UNEXPECTED;
1280   }
1281
1282   sCABForumEVId.numBytes = cabforumOIDItem.len;
1283   PodCopy(sCABForumEVId.bytes, cabforumOIDItem.data, sCABForumEVId.numBytes);
1284
1285   for (size_t i = 0; i < ArrayLength(kEVInfos); ++i) {
1286     const EVInfo& entry = kEVInfos[i];
1287
1288     SECStatus srv;
1289 #ifdef DEBUG
1290     // This section of code double-checks that we calculated the correct
1291     // certificate hash given the issuer and serial number and that it is
1292     // actually present in our loaded root certificates module. It is
1293     // unnecessary to check this in non-debug builds since we will safely fall
1294     // back to DV if the EV information is incorrect.
1295     nsAutoCString derIssuer;
1296     nsresult rv =
1297         Base64Decode(nsDependentCString(entry.issuerBase64), derIssuer);
1298     MOZ_ASSERT(NS_SUCCEEDED(rv), "Could not base64-decode built-in EV issuer");
1299     if (NS_FAILED(rv)) {
1300       return rv;
1301     }
1302
1303     nsAutoCString serialNumber;
1304     rv = Base64Decode(nsDependentCString(entry.serialBase64), serialNumber);
1305     MOZ_ASSERT(NS_SUCCEEDED(rv), "Could not base64-decode built-in EV serial");
1306     if (NS_FAILED(rv)) {
1307       return rv;
1308     }
1309
1310     CERTIssuerAndSN ias;
1311     ias.derIssuer.data =
1312         BitwiseCast<unsigned char*, const char*>(derIssuer.get());
1313     ias.derIssuer.len = derIssuer.Length();
1314     ias.serialNumber.data =
1315         BitwiseCast<unsigned char*, const char*>(serialNumber.get());
1316     ias.serialNumber.len = serialNumber.Length();
1317     ias.serialNumber.type = siUnsignedInteger;
1318
1319     UniqueCERTCertificate cert(CERT_FindCertByIssuerAndSN(nullptr, &ias));
1320
1321     // If an entry is missing in the NSS root database, it may be because the
1322     // root database is out of sync with what we expect (e.g. a different
1323     // version of system NSS is installed).
1324     if (!cert) {
1325       // The entries for the debug EV roots are at indices 0 through
1326       // NUM_TEST_EV_ROOTS - 1. Since they're not built-in, they probably
1327       // haven't been loaded yet.
1328       MOZ_ASSERT(i < NUM_TEST_EV_ROOTS, "Could not find built-in EV root");
1329     } else {
1330       unsigned char certFingerprint[SHA256_LENGTH];
1331       srv = PK11_HashBuf(SEC_OID_SHA256, certFingerprint, cert->derCert.data,
1332                          AssertedCast<int32_t>(cert->derCert.len));
1333       MOZ_ASSERT(srv == SECSuccess, "Could not hash EV root");
1334       if (srv != SECSuccess) {
1335         return NS_ERROR_FAILURE;
1336       }
1337       bool same = ArrayEqual(certFingerprint, entry.sha256Fingerprint);
1338       MOZ_ASSERT(same, "EV root fingerprint mismatch");
1339       if (!same) {
1340         return NS_ERROR_FAILURE;
1341       }
1342     }
1343 #endif
1344     // This is the code that actually enables these roots for EV.
1345     ScopedAutoSECItem evOIDItem;
1346     srv = SEC_StringToOID(nullptr, &evOIDItem, entry.dottedOid, 0);
1347     MOZ_ASSERT(srv == SECSuccess, "SEC_StringToOID failed");
1348     if (srv != SECSuccess) {
1349       return NS_ERROR_FAILURE;
1350     }
1351     if (evOIDItem.len > pkix::CertPolicyId::MAX_BYTES) {
1352       return NS_ERROR_UNEXPECTED;
1353     }
1354     sEVInfoIds[i].numBytes = evOIDItem.len;
1355     PodCopy(sEVInfoIds[i].bytes, evOIDItem.data, sEVInfoIds[i].numBytes);
1356   }
1357
1358   return NS_OK;
1359 }
1360
1361 // Helper function for GetKnownEVPolicies(): reads an EV Policy if there is one,
1362 // and appends it to the given list of CertPolicyIds.
1363 void FindMatchingEVPolicy(pkix::Reader& idReader,
1364                           nsTArray<pkix::CertPolicyId>& policies) {
1365   pkix::Input cabForumEVIdBytes;
1366   pkix::Result rv =
1367       cabForumEVIdBytes.Init(sCABForumEVId.bytes, sCABForumEVId.numBytes);
1368   if (rv == pkix::Success && idReader.MatchRest(cabForumEVIdBytes)) {
1369     policies.AppendElement(sCABForumEVId);
1370     return;
1371   }
1372
1373   for (const pkix::CertPolicyId& id : sEVInfoIds) {
1374     pkix::Input idBytes;
1375     rv = idBytes.Init(id.bytes, id.numBytes);
1376     if (rv == pkix::Success && idReader.MatchRest(idBytes)) {
1377       policies.AppendElement(id);
1378       return;
1379     }
1380   }
1381 }
1382
1383 void GetKnownEVPolicies(const nsTArray<uint8_t>& certBytes,
1384                         /*out*/ nsTArray<pkix::CertPolicyId>& policies) {
1385   pkix::Input certInput;
1386   pkix::Result rv = certInput.Init(certBytes.Elements(), certBytes.Length());
1387   if (rv != pkix::Success) {
1388     return;
1389   }
1390   // we don't use the certificate for path building, so this parameter
1391   // doesn't matter
1392   pkix::EndEntityOrCA notUsedForPaths = pkix::EndEntityOrCA::MustBeEndEntity;
1393   pkix::BackCert cert(certInput, notUsedForPaths, nullptr);
1394   rv = cert.Init();
1395   if (rv != pkix::Success) {
1396     return;
1397   }
1398
1399   const pkix::Input* extensionInput = cert.GetCertificatePolicies();
1400   if (!extensionInput) {
1401     return;
1402   }
1403
1404   pkix::Reader extension(*extensionInput);
1405   pkix::Reader certificatePolicies;
1406   // certificatePolicies ::= SEQUENCE SIZE (1..MAX) OF PolicyInformation
1407   // PolicyInformation ::= SEQUENCE {
1408   //   policyIdentifier   CertPolicyId,
1409   //   ...
1410   // }
1411   // CertPolicyId ::= OBJECT IDENTIFIER
1412   rv = pkix::der::ExpectTagAndGetValue(extension, pkix::der::SEQUENCE,
1413                                        certificatePolicies);
1414   if (rv != pkix::Success || !extension.AtEnd()) {
1415     return;
1416   }
1417
1418   do {
1419     pkix::Reader policyInformation;
1420     rv = pkix::der::ExpectTagAndGetValue(
1421         certificatePolicies, pkix::der::SEQUENCE, policyInformation);
1422     if (rv != pkix::Success) {
1423       return;
1424     }
1425
1426     pkix::Reader policyOid;
1427     rv = pkix::der::ExpectTagAndGetValue(policyInformation, pkix::der::OIDTag,
1428                                          policyOid);
1429     if (rv != pkix::Success) {
1430       return;
1431     }
1432
1433     // we don't validate policy qualifiers here
1434     FindMatchingEVPolicy(policyOid, policies);
1435   } while (!certificatePolicies.AtEnd());
1436 }
1437
1438 }  // namespace psm
1439 }  // namespace mozilla