security/certverifier/ExtendedValidation.cpp

   1 /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*-
   2  *
   3  * This Source Code Form is subject to the terms of the Mozilla Public
   4  * License, v. 2.0. If a copy of the MPL was not distributed with this
   5  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
   6
   7 #include "ExtendedValidation.h"
   8
   9 #include "cert.h"
  10 #include "certdb.h"
  11 #include "base64.h"
  12 #include "hasht.h"
  13 #include "pkix/nullptr.h"
  14 #include "pkix/pkixtypes.h"
  15 #include "pk11pub.h"
  16 #include "secerr.h"
  17 #include "prerror.h"
  18 #include "prinit.h"
  19
  20 #ifdef PR_LOGGING
  21 extern PRLogModuleInfo* gPIPNSSLog;
  22 #endif
  23
  24 #define CONST_OID static const unsigned char
  25 #define OI(x) { siDEROID, (unsigned char*) x, sizeof x }
  26
  27 struct nsMyTrustedEVInfo
  28 {
  29   const char* dotted_oid;
  30   const char* oid_name; // Set this to null to signal an invalid structure,
  31                   // (We can't have an empty list, so we'll use a dummy entry)
  32   SECOidTag oid_tag;
  33   const unsigned char ev_root_sha256_fingerprint[SHA256_LENGTH];
  34   const char* issuer_base64;
  35   const char* serial_base64;
  36   CERTCertificate* cert;
  37 };
  38
  39 // HOWTO enable additional CA root certificates for EV:
  40 //
  41 // For each combination of "root certificate" and "policy OID",
  42 // one entry must be added to the array named myTrustedEVInfos.
  43 //
  44 // We use the combination of "issuer name" and "serial number" to
  45 // uniquely identify the certificate. In order to avoid problems
  46 // because of encodings when comparing certificates, we don't
  47 // use plain text representation, we rather use the original encoding
  48 // as it can be found in the root certificate (in base64 format).
  49 //
  50 // We can use the NSS utility named "pp" to extract the encoding.
  51 //
  52 // Build standalone NSS including the NSS tools, then run
  53 //   pp -t certificate-identity -i the-cert-filename
  54 //
  55 // You will need the output from sections "Issuer", "Fingerprint (SHA-256)",
  56 // "Issuer DER Base64" and "Serial DER Base64".
  57 //
  58 // The new section consists of 8 lines:
  59 //
  60 // - a comment that should contain the human readable issuer name
  61 //   of the certificate, as printed by the pp tool
  62 // - the EV policy OID that is associated to the EV grant
  63 // - a text description of the EV policy OID. The array can contain
  64 //   multiple entries with the same OID.
  65 //   Please make sure to use the identical OID text description for
  66 //   all entries with the same policy OID (use the text search
  67 //   feature of your text editor to find duplicates).
  68 //   When adding a new policy OID that is not yet contained in the array,
  69 //   please make sure that your new description is different from
  70 //   all the other descriptions (again use the text search feature
  71 //   to be sure).
  72 // - the constant SEC_OID_UNKNOWN
  73 //   (it will be replaced at runtime with another identifier)
  74 // - the SHA-256 fingerprint
  75 // - the "Issuer DER Base64" as printed by the pp tool.
  76 //   Remove all whitespaces. If you use multiple lines, make sure that
  77 //   only the final line will be followed by a comma.
  78 // - the "Serial DER Base64" (as printed by pp)
  79 // - nullptr
  80 //
  81 // After adding an entry, test it locally against the test site that
  82 // has been provided by the CA. Note that you must use a version of NSS
  83 // where the root certificate has already been added and marked as trusted
  84 // for issuing SSL server certificates (at least).
  85 //
  86 // If you are able to connect to the site without certificate errors,
  87 // but you don't see the EV status indicator, then most likely the CA
  88 // has a problem in their infrastructure. The most common problems are
  89 // related to the CA's OCSP infrastructure, either they use an incorrect
  90 // OCSP signing certificate, or OCSP for the intermediate certificates
  91 // isn't working, or OCSP isn't working at all.
  92
  93 static struct nsMyTrustedEVInfo myTrustedEVInfos[] = {
  94   // IMPORTANT! When extending this list,
  95   // pairs of dotted_oid and oid_name should always be unique pairs.
  96   // In other words, if you add another list, that uses the same dotted_oid
  97   // as an existing entry, then please use the same oid_name.
  98 #ifdef DEBUG
  99   // Debug EV certificates should all use the OID (repeating EV OID is OK):
 100   // 1.3.6.1.4.1.13769.666.666.666.1.500.9.1.
 101   // If you add or remove debug EV certs you must also modify IdentityInfoInit
 102   // (there is another #ifdef DEBUG section there) so that the correct number of
 103   // certs are skipped as these debug EV certs are NOT part of the default trust
 104   // store.
 105   {
 106     // This is the testing EV signature (xpcshell) (RSA)
 107     // CN=XPCShell EV Testing (untrustworthy) CA,OU=Security Engineering,O=Mozilla - EV debug test CA,L=Mountain View,ST=CA,C=US"
 108     "1.3.6.1.4.1.13769.666.666.666.1.500.9.1",
 109     "DEBUGtesting EV OID",
 110     SEC_OID_UNKNOWN,
 111     { 0x2D, 0x94, 0x52, 0x70, 0xAA, 0x92, 0x13, 0x0B, 0x1F, 0xB1, 0x24,
 112       0x0B, 0x24, 0xB1, 0xEE, 0x4E, 0xFB, 0x7C, 0x43, 0x45, 0x45, 0x7F,
 113       0x97, 0x6C, 0x90, 0xBF, 0xD4, 0x8A, 0x04, 0x79, 0xE4, 0x68 },
 114     "MIGnMQswCQYDVQQGEwJVUzELMAkGA1UECAwCQ0ExFjAUBgNVBAcMDU1vdW50YWlu"
 115     "IFZpZXcxIzAhBgNVBAoMGk1vemlsbGEgLSBFViBkZWJ1ZyB0ZXN0IENBMR0wGwYD"
 116     "VQQLDBRTZWN1cml0eSBFbmdpbmVlcmluZzEvMC0GA1UEAwwmWFBDU2hlbGwgRVYg"
 117     "VGVzdGluZyAodW50cnVzdHdvcnRoeSkgQ0E=",
 118     "At+3zdo=",
 119     nullptr
 120   },
 121 #endif
 122   {
 123     // OU=Security Communication EV RootCA1,O="SECOM Trust Systems CO.,LTD.",C=JP
 124     "1.2.392.200091.100.721.1",
 125     "SECOM EV OID",
 126     SEC_OID_UNKNOWN,
 127     { 0xA2, 0x2D, 0xBA, 0x68, 0x1E, 0x97, 0x37, 0x6E, 0x2D, 0x39, 0x7D,
 128       0x72, 0x8A, 0xAE, 0x3A, 0x9B, 0x62, 0x96, 0xB9, 0xFD, 0xBA, 0x60,
 129       0xBC, 0x2E, 0x11, 0xF6, 0x47, 0xF2, 0xC6, 0x75, 0xFB, 0x37 },
 130     "MGAxCzAJBgNVBAYTAkpQMSUwIwYDVQQKExxTRUNPTSBUcnVzdCBTeXN0ZW1zIENP"
 131     "LixMVEQuMSowKAYDVQQLEyFTZWN1cml0eSBDb21tdW5pY2F0aW9uIEVWIFJvb3RD"
 132     "QTE=",
 133     "AA==",
 134     nullptr
 135   },
 136   {
 137     // CN=Cybertrust Global Root,O=Cybertrust, Inc
 138     "1.3.6.1.4.1.6334.1.100.1",
 139     "Cybertrust EV OID",
 140     SEC_OID_UNKNOWN,
 141     { 0x96, 0x0A, 0xDF, 0x00, 0x63, 0xE9, 0x63, 0x56, 0x75, 0x0C, 0x29,
 142       0x65, 0xDD, 0x0A, 0x08, 0x67, 0xDA, 0x0B, 0x9C, 0xBD, 0x6E, 0x77,
 143       0x71, 0x4A, 0xEA, 0xFB, 0x23, 0x49, 0xAB, 0x39, 0x3D, 0xA3 },
 144     "MDsxGDAWBgNVBAoTD0N5YmVydHJ1c3QsIEluYzEfMB0GA1UEAxMWQ3liZXJ0cnVz"
 145     "dCBHbG9iYWwgUm9vdA==",
 146     "BAAAAAABD4WqLUg=",
 147     nullptr
 148   },
 149   {
 150     // CN=SwissSign Gold CA - G2,O=SwissSign AG,C=CH
 151     "2.16.756.1.89.1.2.1.1",
 152     "SwissSign EV OID",
 153     SEC_OID_UNKNOWN,
 154     { 0x62, 0xDD, 0x0B, 0xE9, 0xB9, 0xF5, 0x0A, 0x16, 0x3E, 0xA0, 0xF8,
 155       0xE7, 0x5C, 0x05, 0x3B, 0x1E, 0xCA, 0x57, 0xEA, 0x55, 0xC8, 0x68,
 156       0x8F, 0x64, 0x7C, 0x68, 0x81, 0xF2, 0xC8, 0x35, 0x7B, 0x95 },
 157     "MEUxCzAJBgNVBAYTAkNIMRUwEwYDVQQKEwxTd2lzc1NpZ24gQUcxHzAdBgNVBAMT"
 158     "FlN3aXNzU2lnbiBHb2xkIENBIC0gRzI=",
 159     "ALtAHEP1Xk+w",
 160     nullptr
 161   },
 162   {
 163     // CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL
 164     "1.3.6.1.4.1.23223.1.1.1",
 165     "StartCom EV OID",
 166     SEC_OID_UNKNOWN,
 167     { 0xC7, 0x66, 0xA9, 0xBE, 0xF2, 0xD4, 0x07, 0x1C, 0x86, 0x3A, 0x31,
 168       0xAA, 0x49, 0x20, 0xE8, 0x13, 0xB2, 0xD1, 0x98, 0x60, 0x8C, 0xB7,
 169       0xB7, 0xCF, 0xE2, 0x11, 0x43, 0xB8, 0x36, 0xDF, 0x09, 0xEA },
 170     "MH0xCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSswKQYDVQQL"
 171     "EyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMSkwJwYDVQQDEyBT"
 172     "dGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eQ==",
 173     "AQ==",
 174     nullptr
 175   },
 176   {
 177     // CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL
 178     "1.3.6.1.4.1.23223.1.1.1",
 179     "StartCom EV OID",
 180     SEC_OID_UNKNOWN,
 181     { 0xE1, 0x78, 0x90, 0xEE, 0x09, 0xA3, 0xFB, 0xF4, 0xF4, 0x8B, 0x9C,
 182       0x41, 0x4A, 0x17, 0xD6, 0x37, 0xB7, 0xA5, 0x06, 0x47, 0xE9, 0xBC,
 183       0x75, 0x23, 0x22, 0x72, 0x7F, 0xCC, 0x17, 0x42, 0xA9, 0x11 },
 184     "MH0xCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSswKQYDVQQL"
 185     "EyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMSkwJwYDVQQDEyBT"
 186     "dGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eQ==",
 187     "LQ==",
 188     nullptr
 189   },
 190   {
 191     // CN=StartCom Certification Authority G2,O=StartCom Ltd.,C=IL
 192     "1.3.6.1.4.1.23223.1.1.1",
 193     "StartCom EV OID",
 194     SEC_OID_UNKNOWN,
 195     { 0xC7, 0xBA, 0x65, 0x67, 0xDE, 0x93, 0xA7, 0x98, 0xAE, 0x1F, 0xAA,
 196       0x79, 0x1E, 0x71, 0x2D, 0x37, 0x8F, 0xAE, 0x1F, 0x93, 0xC4, 0x39,
 197       0x7F, 0xEA, 0x44, 0x1B, 0xB7, 0xCB, 0xE6, 0xFD, 0x59, 0x95 },
 198     "MFMxCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSwwKgYDVQQD"
 199     "EyNTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSBHMg==",
 200     "Ow==",
 201     nullptr
 202   },
 203   {
 204     // CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU="(c) 2006 VeriSign, Inc. - For authorized use only",OU=VeriSign Trust Network,O="VeriSign, Inc.",C=US
 205     "2.16.840.1.113733.1.7.23.6",
 206     "VeriSign EV OID",
 207     SEC_OID_UNKNOWN,
 208     { 0x9A, 0xCF, 0xAB, 0x7E, 0x43, 0xC8, 0xD8, 0x80, 0xD0, 0x6B, 0x26,
 209       0x2A, 0x94, 0xDE, 0xEE, 0xE4, 0xB4, 0x65, 0x99, 0x89, 0xC3, 0xD0,
 210       0xCA, 0xF1, 0x9B, 0xAF, 0x64, 0x05, 0xE4, 0x1A, 0xB7, 0xDF },
 211     "MIHKMQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNV"
 212     "BAsTFlZlcmlTaWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAyMDA2IFZl"
 213     "cmlTaWduLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMT"
 214     "PFZlcmlTaWduIENsYXNzIDMgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBB"
 215     "dXRob3JpdHkgLSBHNQ==",
 216     "GNrRniZ96LtKIVjNzGs7Sg==",
 217     nullptr
 218   },
 219   {
 220     // CN=GeoTrust Primary Certification Authority,O=GeoTrust Inc.,C=US
 221     "1.3.6.1.4.1.14370.1.6",
 222     "GeoTrust EV OID",
 223     SEC_OID_UNKNOWN,
 224     { 0x37, 0xD5, 0x10, 0x06, 0xC5, 0x12, 0xEA, 0xAB, 0x62, 0x64, 0x21,
 225       0xF1, 0xEC, 0x8C, 0x92, 0x01, 0x3F, 0xC5, 0xF8, 0x2A, 0xE9, 0x8E,
 226       0xE5, 0x33, 0xEB, 0x46, 0x19, 0xB8, 0xDE, 0xB4, 0xD0, 0x6C },
 227     "MFgxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMTEwLwYDVQQD"
 228     "EyhHZW9UcnVzdCBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5",
 229     "GKy1av1pthU6Y2yv2vrEoQ==",
 230     nullptr
 231   },
 232   {
 233     // CN=thawte Primary Root CA,OU="(c) 2006 thawte, Inc. - For authorized use only",OU=Certification Services Division,O="thawte, Inc.",C=US
 234     "2.16.840.1.113733.1.7.48.1",
 235     "Thawte EV OID",
 236     SEC_OID_UNKNOWN,
 237     { 0x8D, 0x72, 0x2F, 0x81, 0xA9, 0xC1, 0x13, 0xC0, 0x79, 0x1D, 0xF1,
 238       0x36, 0xA2, 0x96, 0x6D, 0xB2, 0x6C, 0x95, 0x0A, 0x97, 0x1D, 0xB4,
 239       0x6B, 0x41, 0x99, 0xF4, 0xEA, 0x54, 0xB7, 0x8B, 0xFB, 0x9F },
 240     "MIGpMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMdGhhd3RlLCBJbmMuMSgwJgYDVQQL"
 241     "Ex9DZXJ0aWZpY2F0aW9uIFNlcnZpY2VzIERpdmlzaW9uMTgwNgYDVQQLEy8oYykg"
 242     "MjAwNiB0aGF3dGUsIEluYy4gLSBGb3IgYXV0aG9yaXplZCB1c2Ugb25seTEfMB0G"
 243     "A1UEAxMWdGhhd3RlIFByaW1hcnkgUm9vdCBDQQ==",
 244     "NE7VVyDV7exJ9C/ON9srbQ==",
 245     nullptr
 246   },
 247   {
 248     // CN=XRamp Global Certification Authority,O=XRamp Security Services Inc,OU=www.xrampsecurity.com,C=US
 249     "2.16.840.1.114404.1.1.2.4.1",
 250     "Trustwave EV OID",
 251     SEC_OID_UNKNOWN,
 252     { 0xCE, 0xCD, 0xDC, 0x90, 0x50, 0x99, 0xD8, 0xDA, 0xDF, 0xC5, 0xB1,
 253       0xD2, 0x09, 0xB7, 0x37, 0xCB, 0xE2, 0xC1, 0x8C, 0xFB, 0x2C, 0x10,
 254       0xC0, 0xFF, 0x0B, 0xCF, 0x0D, 0x32, 0x86, 0xFC, 0x1A, 0xA2 },
 255     "MIGCMQswCQYDVQQGEwJVUzEeMBwGA1UECxMVd3d3LnhyYW1wc2VjdXJpdHkuY29t"
 256     "MSQwIgYDVQQKExtYUmFtcCBTZWN1cml0eSBTZXJ2aWNlcyBJbmMxLTArBgNVBAMT"
 257     "JFhSYW1wIEdsb2JhbCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eQ==",
 258     "UJRs7Bjq1ZxN1ZfvdY+grQ==",
 259     nullptr
 260   },
 261   {
 262     // CN=SecureTrust CA,O=SecureTrust Corporation,C=US
 263     "2.16.840.1.114404.1.1.2.4.1",
 264     "Trustwave EV OID",
 265     SEC_OID_UNKNOWN,
 266     { 0xF1, 0xC1, 0xB5, 0x0A, 0xE5, 0xA2, 0x0D, 0xD8, 0x03, 0x0E, 0xC9,
 267       0xF6, 0xBC, 0x24, 0x82, 0x3D, 0xD3, 0x67, 0xB5, 0x25, 0x57, 0x59,
 268       0xB4, 0xE7, 0x1B, 0x61, 0xFC, 0xE9, 0xF7, 0x37, 0x5D, 0x73 },
 269     "MEgxCzAJBgNVBAYTAlVTMSAwHgYDVQQKExdTZWN1cmVUcnVzdCBDb3Jwb3JhdGlv"
 270     "bjEXMBUGA1UEAxMOU2VjdXJlVHJ1c3QgQ0E=",
 271     "DPCOXAgWpa1Cf/DrJxhZ0A==",
 272     nullptr
 273   },
 274   {
 275     // CN=Secure Global CA,O=SecureTrust Corporation,C=US
 276     "2.16.840.1.114404.1.1.2.4.1",
 277     "Trustwave EV OID",
 278     SEC_OID_UNKNOWN,
 279     { 0x42, 0x00, 0xF5, 0x04, 0x3A, 0xC8, 0x59, 0x0E, 0xBB, 0x52, 0x7D,
 280       0x20, 0x9E, 0xD1, 0x50, 0x30, 0x29, 0xFB, 0xCB, 0xD4, 0x1C, 0xA1,
 281       0xB5, 0x06, 0xEC, 0x27, 0xF1, 0x5A, 0xDE, 0x7D, 0xAC, 0x69 },
 282     "MEoxCzAJBgNVBAYTAlVTMSAwHgYDVQQKExdTZWN1cmVUcnVzdCBDb3Jwb3JhdGlv"
 283     "bjEZMBcGA1UEAxMQU2VjdXJlIEdsb2JhbCBDQQ==",
 284     "B1YipOjUiolN9BPI8PjqpQ==",
 285     nullptr
 286   },
 287   {
 288     // CN=COMODO ECC Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
 289     "1.3.6.1.4.1.6449.1.2.1.5.1",
 290     "Comodo EV OID",
 291     SEC_OID_UNKNOWN,
 292     { 0x17, 0x93, 0x92, 0x7A, 0x06, 0x14, 0x54, 0x97, 0x89, 0xAD, 0xCE,
 293       0x2F, 0x8F, 0x34, 0xF7, 0xF0, 0xB6, 0x6D, 0x0F, 0x3A, 0xE3, 0xA3,
 294       0xB8, 0x4D, 0x21, 0xEC, 0x15, 0xDB, 0xBA, 0x4F, 0xAD, 0xC7 },
 295     "MIGFMQswCQYDVQQGEwJHQjEbMBkGA1UECBMSR3JlYXRlciBNYW5jaGVzdGVyMRAw"
 296     "DgYDVQQHEwdTYWxmb3JkMRowGAYDVQQKExFDT01PRE8gQ0EgTGltaXRlZDErMCkG"
 297     "A1UEAxMiQ09NT0RPIEVDQyBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eQ==",
 298     "H0evqmIAcFBUTAGem2OZKg==",
 299     nullptr
 300   },
 301   {
 302     // CN=COMODO Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
 303     "1.3.6.1.4.1.6449.1.2.1.5.1",
 304     "Comodo EV OID",
 305     SEC_OID_UNKNOWN,
 306     { 0x0C, 0x2C, 0xD6, 0x3D, 0xF7, 0x80, 0x6F, 0xA3, 0x99, 0xED, 0xE8,
 307       0x09, 0x11, 0x6B, 0x57, 0x5B, 0xF8, 0x79, 0x89, 0xF0, 0x65, 0x18,
 308       0xF9, 0x80, 0x8C, 0x86, 0x05, 0x03, 0x17, 0x8B, 0xAF, 0x66 },
 309     "MIGBMQswCQYDVQQGEwJHQjEbMBkGA1UECBMSR3JlYXRlciBNYW5jaGVzdGVyMRAw"
 310     "DgYDVQQHEwdTYWxmb3JkMRowGAYDVQQKExFDT01PRE8gQ0EgTGltaXRlZDEnMCUG"
 311     "A1UEAxMeQ09NT0RPIENlcnRpZmljYXRpb24gQXV0aG9yaXR5",
 312     "ToEtioJl4AsC7j41AkblPQ==",
 313     nullptr
 314   },
 315   {
 316     // CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE
 317     "1.3.6.1.4.1.6449.1.2.1.5.1",
 318     "Comodo EV OID",
 319     SEC_OID_UNKNOWN,
 320     { 0x68, 0x7F, 0xA4, 0x51, 0x38, 0x22, 0x78, 0xFF, 0xF0, 0xC8, 0xB1,
 321       0x1F, 0x8D, 0x43, 0xD5, 0x76, 0x67, 0x1C, 0x6E, 0xB2, 0xBC, 0xEA,
 322       0xB4, 0x13, 0xFB, 0x83, 0xD9, 0x65, 0xD0, 0x6D, 0x2F, 0xF2 },
 323     "MG8xCzAJBgNVBAYTAlNFMRQwEgYDVQQKEwtBZGRUcnVzdCBBQjEmMCQGA1UECxMd"
 324     "QWRkVHJ1c3QgRXh0ZXJuYWwgVFRQIE5ldHdvcmsxIjAgBgNVBAMTGUFkZFRydXN0"
 325     "IEV4dGVybmFsIENBIFJvb3Q=",
 326     "AQ==",
 327     nullptr
 328   },
 329   {
 330     // CN=UTN - DATACorp SGC,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
 331     "1.3.6.1.4.1.6449.1.2.1.5.1",
 332     "Comodo EV OID",
 333     SEC_OID_UNKNOWN,
 334     { 0x85, 0xFB, 0x2F, 0x91, 0xDD, 0x12, 0x27, 0x5A, 0x01, 0x45, 0xB6,
 335       0x36, 0x53, 0x4F, 0x84, 0x02, 0x4A, 0xD6, 0x8B, 0x69, 0xB8, 0xEE,
 336       0x88, 0x68, 0x4F, 0xF7, 0x11, 0x37, 0x58, 0x05, 0xB3, 0x48 },
 337     "MIGTMQswCQYDVQQGEwJVUzELMAkGA1UECBMCVVQxFzAVBgNVBAcTDlNhbHQgTGFr"
 338     "ZSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxITAfBgNVBAsT"
 339     "GGh0dHA6Ly93d3cudXNlcnRydXN0LmNvbTEbMBkGA1UEAxMSVVROIC0gREFUQUNv"
 340     "cnAgU0dD",
 341     "RL4Mi1AAIbQR0ypoBqmtaQ==",
 342     nullptr
 343   },
 344   {
 345     // CN=UTN-USERFirst-Hardware,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
 346     "1.3.6.1.4.1.6449.1.2.1.5.1",
 347     "Comodo EV OID",
 348     SEC_OID_UNKNOWN,
 349     { 0x6E, 0xA5, 0x47, 0x41, 0xD0, 0x04, 0x66, 0x7E, 0xED, 0x1B, 0x48,
 350       0x16, 0x63, 0x4A, 0xA3, 0xA7, 0x9E, 0x6E, 0x4B, 0x96, 0x95, 0x0F,
 351       0x82, 0x79, 0xDA, 0xFC, 0x8D, 0x9B, 0xD8, 0x81, 0x21, 0x37 },
 352     "MIGXMQswCQYDVQQGEwJVUzELMAkGA1UECBMCVVQxFzAVBgNVBAcTDlNhbHQgTGFr"
 353     "ZSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxITAfBgNVBAsT"
 354     "GGh0dHA6Ly93d3cudXNlcnRydXN0LmNvbTEfMB0GA1UEAxMWVVROLVVTRVJGaXJz"
 355     "dC1IYXJkd2FyZQ==",
 356     "RL4Mi1AAJLQR0zYq/mUK/Q==",
 357     nullptr
 358   },
 359   {
 360     // OU=Go Daddy Class 2 Certification Authority,O=\"The Go Daddy Group, Inc.\",C=US
 361     "2.16.840.1.114413.1.7.23.3",
 362     "Go Daddy EV OID a",
 363     SEC_OID_UNKNOWN,
 364     { 0xC3, 0x84, 0x6B, 0xF2, 0x4B, 0x9E, 0x93, 0xCA, 0x64, 0x27, 0x4C,
 365       0x0E, 0xC6, 0x7C, 0x1E, 0xCC, 0x5E, 0x02, 0x4F, 0xFC, 0xAC, 0xD2,
 366       0xD7, 0x40, 0x19, 0x35, 0x0E, 0x81, 0xFE, 0x54, 0x6A, 0xE4 },
 367     "MGMxCzAJBgNVBAYTAlVTMSEwHwYDVQQKExhUaGUgR28gRGFkZHkgR3JvdXAsIElu"
 368     "Yy4xMTAvBgNVBAsTKEdvIERhZGR5IENsYXNzIDIgQ2VydGlmaWNhdGlvbiBBdXRo"
 369     "b3JpdHk=",
 370     "AA==",
 371     nullptr
 372   },
 373   {
 374     // CN=Go Daddy Root Certificate Authority - G2,O="GoDaddy.com, Inc.",L=Scottsdale,ST=Arizona,C=US
 375     "2.16.840.1.114413.1.7.23.3",
 376     "Go Daddy EV OID a",
 377     SEC_OID_UNKNOWN,
 378     { 0x45, 0x14, 0x0B, 0x32, 0x47, 0xEB, 0x9C, 0xC8, 0xC5, 0xB4, 0xF0,
 379       0xD7, 0xB5, 0x30, 0x91, 0xF7, 0x32, 0x92, 0x08, 0x9E, 0x6E, 0x5A,
 380       0x63, 0xE2, 0x74, 0x9D, 0xD3, 0xAC, 0xA9, 0x19, 0x8E, 0xDA },
 381     "MIGDMQswCQYDVQQGEwJVUzEQMA4GA1UECBMHQXJpem9uYTETMBEGA1UEBxMKU2Nv"
 382     "dHRzZGFsZTEaMBgGA1UEChMRR29EYWRkeS5jb20sIEluYy4xMTAvBgNVBAMTKEdv"
 383     "IERhZGR5IFJvb3QgQ2VydGlmaWNhdGUgQXV0aG9yaXR5IC0gRzI=",
 384     "AA==",
 385     nullptr
 386   },
 387   {
 388     // OU=Starfield Class 2 Certification Authority,O=\"Starfield Technologies, Inc.\",C=US
 389     "2.16.840.1.114414.1.7.23.3",
 390     "Go Daddy EV OID b",
 391     SEC_OID_UNKNOWN,
 392     { 0x14, 0x65, 0xFA, 0x20, 0x53, 0x97, 0xB8, 0x76, 0xFA, 0xA6, 0xF0,
 393       0xA9, 0x95, 0x8E, 0x55, 0x90, 0xE4, 0x0F, 0xCC, 0x7F, 0xAA, 0x4F,
 394       0xB7, 0xC2, 0xC8, 0x67, 0x75, 0x21, 0xFB, 0x5F, 0xB6, 0x58 },
 395     "MGgxCzAJBgNVBAYTAlVTMSUwIwYDVQQKExxTdGFyZmllbGQgVGVjaG5vbG9naWVz"
 396     "LCBJbmMuMTIwMAYDVQQLEylTdGFyZmllbGQgQ2xhc3MgMiBDZXJ0aWZpY2F0aW9u"
 397     "IEF1dGhvcml0eQ==",
 398     "AA==",
 399     nullptr
 400   },
 401   {
 402     // CN=Starfield Root Certificate Authority - G2,O="Starfield Technologies, Inc.",L=Scottsdale,ST=Arizona,C=US
 403     "2.16.840.1.114414.1.7.23.3",
 404     "Go Daddy EV OID b",
 405     SEC_OID_UNKNOWN,
 406     { 0x2C, 0xE1, 0xCB, 0x0B, 0xF9, 0xD2, 0xF9, 0xE1, 0x02, 0x99, 0x3F,
 407       0xBE, 0x21, 0x51, 0x52, 0xC3, 0xB2, 0xDD, 0x0C, 0xAB, 0xDE, 0x1C,
 408       0x68, 0xE5, 0x31, 0x9B, 0x83, 0x91, 0x54, 0xDB, 0xB7, 0xF5 },
 409     "MIGPMQswCQYDVQQGEwJVUzEQMA4GA1UECBMHQXJpem9uYTETMBEGA1UEBxMKU2Nv"
 410     "dHRzZGFsZTElMCMGA1UEChMcU3RhcmZpZWxkIFRlY2hub2xvZ2llcywgSW5jLjEy"
 411     "MDAGA1UEAxMpU3RhcmZpZWxkIFJvb3QgQ2VydGlmaWNhdGUgQXV0aG9yaXR5IC0g"
 412     "RzI=",
 413     "AA==",
 414     nullptr
 415   },
 416   {
 417     // CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
 418     "2.16.840.1.114412.2.1",
 419     "DigiCert EV OID",
 420     SEC_OID_UNKNOWN,
 421     { 0x74, 0x31, 0xE5, 0xF4, 0xC3, 0xC1, 0xCE, 0x46, 0x90, 0x77, 0x4F,
 422       0x0B, 0x61, 0xE0, 0x54, 0x40, 0x88, 0x3B, 0xA9, 0xA0, 0x1E, 0xD0,
 423       0x0B, 0xA6, 0xAB, 0xD7, 0x80, 0x6E, 0xD3, 0xB1, 0x18, 0xCF },
 424     "MGwxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsT"
 425     "EHd3dy5kaWdpY2VydC5jb20xKzApBgNVBAMTIkRpZ2lDZXJ0IEhpZ2ggQXNzdXJh"
 426     "bmNlIEVWIFJvb3QgQ0E=",
 427     "AqxcJmoLQJuPC3nyrkYldw==",
 428     nullptr
 429   },
 430   {
 431     // CN=QuoVadis Root CA 2,O=QuoVadis Limited,C=BM
 432     "1.3.6.1.4.1.8024.0.2.100.1.2",
 433     "Quo Vadis EV OID",
 434     SEC_OID_UNKNOWN,
 435     { 0x85, 0xA0, 0xDD, 0x7D, 0xD7, 0x20, 0xAD, 0xB7, 0xFF, 0x05, 0xF8,
 436       0x3D, 0x54, 0x2B, 0x20, 0x9D, 0xC7, 0xFF, 0x45, 0x28, 0xF7, 0xD6,
 437       0x77, 0xB1, 0x83, 0x89, 0xFE, 0xA5, 0xE5, 0xC4, 0x9E, 0x86 },
 438     "MEUxCzAJBgNVBAYTAkJNMRkwFwYDVQQKExBRdW9WYWRpcyBMaW1pdGVkMRswGQYD"
 439     "VQQDExJRdW9WYWRpcyBSb290IENBIDI=",
 440     "BQk=",
 441     nullptr
 442   },
 443   {
 444     // CN=Network Solutions Certificate Authority,O=Network Solutions L.L.C.,C=US
 445     "1.3.6.1.4.1.782.1.2.1.8.1",
 446     "Network Solutions EV OID",
 447     SEC_OID_UNKNOWN,
 448     { 0x15, 0xF0, 0xBA, 0x00, 0xA3, 0xAC, 0x7A, 0xF3, 0xAC, 0x88, 0x4C,
 449       0x07, 0x2B, 0x10, 0x11, 0xA0, 0x77, 0xBD, 0x77, 0xC0, 0x97, 0xF4,
 450       0x01, 0x64, 0xB2, 0xF8, 0x59, 0x8A, 0xBD, 0x83, 0x86, 0x0C },
 451     "MGIxCzAJBgNVBAYTAlVTMSEwHwYDVQQKExhOZXR3b3JrIFNvbHV0aW9ucyBMLkwu"
 452     "Qy4xMDAuBgNVBAMTJ05ldHdvcmsgU29sdXRpb25zIENlcnRpZmljYXRlIEF1dGhv"
 453     "cml0eQ==",
 454     "V8szb8JcFuZHFhfjkDFo4A==",
 455     nullptr
 456   },
 457   {
 458     // CN=Entrust Root Certification Authority,OU="(c) 2006 Entrust, Inc.",OU=www.entrust.net/CPS is incorporated by reference,O="Entrust, Inc.",C=US
 459     "2.16.840.1.114028.10.1.2",
 460     "Entrust EV OID",
 461     SEC_OID_UNKNOWN,
 462     { 0x73, 0xC1, 0x76, 0x43, 0x4F, 0x1B, 0xC6, 0xD5, 0xAD, 0xF4, 0x5B,
 463       0x0E, 0x76, 0xE7, 0x27, 0x28, 0x7C, 0x8D, 0xE5, 0x76, 0x16, 0xC1,
 464       0xE6, 0xE6, 0x14, 0x1A, 0x2B, 0x2C, 0xBC, 0x7D, 0x8E, 0x4C },
 465     "MIGwMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNRW50cnVzdCwgSW5jLjE5MDcGA1UE"
 466     "CxMwd3d3LmVudHJ1c3QubmV0L0NQUyBpcyBpbmNvcnBvcmF0ZWQgYnkgcmVmZXJl"
 467     "bmNlMR8wHQYDVQQLExYoYykgMjAwNiBFbnRydXN0LCBJbmMuMS0wKwYDVQQDEyRF"
 468     "bnRydXN0IFJvb3QgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHk=",
 469     "RWtQVA==",
 470     nullptr
 471   },
 472   {
 473     // CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
 474     "1.3.6.1.4.1.4146.1.1",
 475     "GlobalSign EV OID",
 476     SEC_OID_UNKNOWN,
 477     { 0xEB, 0xD4, 0x10, 0x40, 0xE4, 0xBB, 0x3E, 0xC7, 0x42, 0xC9, 0xE3,
 478       0x81, 0xD3, 0x1E, 0xF2, 0xA4, 0x1A, 0x48, 0xB6, 0x68, 0x5C, 0x96,
 479       0xE7, 0xCE, 0xF3, 0xC1, 0xDF, 0x6C, 0xD4, 0x33, 0x1C, 0x99 },
 480     "MFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMRAwDgYD"
 481     "VQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxTaWduIFJvb3QgQ0E=",
 482     "BAAAAAABFUtaw5Q=",
 483     nullptr
 484   },
 485   {
 486     // CN=GlobalSign,O=GlobalSign,OU=GlobalSign Root CA - R2
 487     "1.3.6.1.4.1.4146.1.1",
 488     "GlobalSign EV OID",
 489     SEC_OID_UNKNOWN,
 490     { 0xCA, 0x42, 0xDD, 0x41, 0x74, 0x5F, 0xD0, 0xB8, 0x1E, 0xB9, 0x02,
 491       0x36, 0x2C, 0xF9, 0xD8, 0xBF, 0x71, 0x9D, 0xA1, 0xBD, 0x1B, 0x1E,
 492       0xFC, 0x94, 0x6F, 0x5B, 0x4C, 0x99, 0xF4, 0x2C, 0x1B, 0x9E },
 493     "MEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAtIFIyMRMwEQYDVQQKEwpH"
 494     "bG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWdu",
 495     "BAAAAAABD4Ym5g0=",
 496     nullptr
 497   },
 498   {
 499     // CN=GlobalSign,O=GlobalSign,OU=GlobalSign Root CA - R3
 500     "1.3.6.1.4.1.4146.1.1",
 501     "GlobalSign EV OID",
 502     SEC_OID_UNKNOWN,
 503     { 0xCB, 0xB5, 0x22, 0xD7, 0xB7, 0xF1, 0x27, 0xAD, 0x6A, 0x01, 0x13,
 504       0x86, 0x5B, 0xDF, 0x1C, 0xD4, 0x10, 0x2E, 0x7D, 0x07, 0x59, 0xAF,
 505       0x63, 0x5A, 0x7C, 0xF4, 0x72, 0x0D, 0xC9, 0x63, 0xC5, 0x3B },
 506     "MEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAtIFIzMRMwEQYDVQQKEwpH"
 507     "bG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWdu",
 508     "BAAAAAABIVhTCKI=",
 509     nullptr
 510   },
 511   {
 512     // CN=Buypass Class 3 CA 1,O=Buypass AS-983163327,C=NO
 513     "2.16.578.1.26.1.3.3",
 514     "Buypass EV OID",
 515     SEC_OID_UNKNOWN,
 516     { 0xB7, 0xB1, 0x2B, 0x17, 0x1F, 0x82, 0x1D, 0xAA, 0x99, 0x0C, 0xD0,
 517       0xFE, 0x50, 0x87, 0xB1, 0x28, 0x44, 0x8B, 0xA8, 0xE5, 0x18, 0x4F,
 518       0x84, 0xC5, 0x1E, 0x02, 0xB5, 0xC8, 0xFB, 0x96, 0x2B, 0x24 },
 519     "MEsxCzAJBgNVBAYTAk5PMR0wGwYDVQQKDBRCdXlwYXNzIEFTLTk4MzE2MzMyNzEd"
 520     "MBsGA1UEAwwUQnV5cGFzcyBDbGFzcyAzIENBIDE=",
 521     "Ag==",
 522     nullptr
 523   },
 524   {
 525     // CN=Buypass Class 3 Root CA,O=Buypass AS-983163327,C=NO
 526     "2.16.578.1.26.1.3.3",
 527     "Buypass EV OID",
 528     SEC_OID_UNKNOWN,
 529     { 0xED, 0xF7, 0xEB, 0xBC, 0xA2, 0x7A, 0x2A, 0x38, 0x4D, 0x38, 0x7B,
 530       0x7D, 0x40, 0x10, 0xC6, 0x66, 0xE2, 0xED, 0xB4, 0x84, 0x3E, 0x4C,
 531       0x29, 0xB4, 0xAE, 0x1D, 0x5B, 0x93, 0x32, 0xE6, 0xB2, 0x4D },
 532     "ME4xCzAJBgNVBAYTAk5PMR0wGwYDVQQKDBRCdXlwYXNzIEFTLTk4MzE2MzMyNzEg"
 533     "MB4GA1UEAwwXQnV5cGFzcyBDbGFzcyAzIFJvb3QgQ0E=",
 534     "Ag==",
 535     nullptr
 536   },
 537   {
 538     // CN=Class 2 Primary CA,O=Certplus,C=FR
 539     "1.3.6.1.4.1.22234.2.5.2.3.1",
 540     "Certplus EV OID",
 541     SEC_OID_UNKNOWN,
 542     { 0x0F, 0x99, 0x3C, 0x8A, 0xEF, 0x97, 0xBA, 0xAF, 0x56, 0x87, 0x14,
 543       0x0E, 0xD5, 0x9A, 0xD1, 0x82, 0x1B, 0xB4, 0xAF, 0xAC, 0xF0, 0xAA,
 544       0x9A, 0x58, 0xB5, 0xD5, 0x7A, 0x33, 0x8A, 0x3A, 0xFB, 0xCB },
 545     "MD0xCzAJBgNVBAYTAkZSMREwDwYDVQQKEwhDZXJ0cGx1czEbMBkGA1UEAxMSQ2xh"
 546     "c3MgMiBQcmltYXJ5IENB",
 547     "AIW9S/PY2uNp9pTXX8OlRCM=",
 548     nullptr
 549   },
 550   {
 551     // CN=Chambers of Commerce Root - 2008,O=AC Camerfirma S.A.,serialNumber=A82743287,L=Madrid (see current address at www.camerfirma.com/address),C=EU
 552     "1.3.6.1.4.1.17326.10.14.2.1.2",
 553     "Camerfirma EV OID a",
 554     SEC_OID_UNKNOWN,
 555     { 0x06, 0x3E, 0x4A, 0xFA, 0xC4, 0x91, 0xDF, 0xD3, 0x32, 0xF3, 0x08,
 556       0x9B, 0x85, 0x42, 0xE9, 0x46, 0x17, 0xD8, 0x93, 0xD7, 0xFE, 0x94,
 557       0x4E, 0x10, 0xA7, 0x93, 0x7E, 0xE2, 0x9D, 0x96, 0x93, 0xC0 },
 558     "MIGuMQswCQYDVQQGEwJFVTFDMEEGA1UEBxM6TWFkcmlkIChzZWUgY3VycmVudCBh"
 559     "ZGRyZXNzIGF0IHd3dy5jYW1lcmZpcm1hLmNvbS9hZGRyZXNzKTESMBAGA1UEBRMJ"
 560     "QTgyNzQzMjg3MRswGQYDVQQKExJBQyBDYW1lcmZpcm1hIFMuQS4xKTAnBgNVBAMT"
 561     "IENoYW1iZXJzIG9mIENvbW1lcmNlIFJvb3QgLSAyMDA4",
 562     "AKPaQn6ksa7a",
 563     nullptr
 564   },
 565   {
 566     // CN=Global Chambersign Root - 2008,O=AC Camerfirma S.A.,serialNumber=A82743287,L=Madrid (see current address at www.camerfirma.com/address),C=EU
 567     "1.3.6.1.4.1.17326.10.8.12.1.2",
 568     "Camerfirma EV OID b",
 569     SEC_OID_UNKNOWN,
 570     { 0x13, 0x63, 0x35, 0x43, 0x93, 0x34, 0xA7, 0x69, 0x80, 0x16, 0xA0,
 571       0xD3, 0x24, 0xDE, 0x72, 0x28, 0x4E, 0x07, 0x9D, 0x7B, 0x52, 0x20,
 572       0xBB, 0x8F, 0xBD, 0x74, 0x78, 0x16, 0xEE, 0xBE, 0xBA, 0xCA },
 573     "MIGsMQswCQYDVQQGEwJFVTFDMEEGA1UEBxM6TWFkcmlkIChzZWUgY3VycmVudCBh"
 574     "ZGRyZXNzIGF0IHd3dy5jYW1lcmZpcm1hLmNvbS9hZGRyZXNzKTESMBAGA1UEBRMJ"
 575     "QTgyNzQzMjg3MRswGQYDVQQKExJBQyBDYW1lcmZpcm1hIFMuQS4xJzAlBgNVBAMT"
 576     "Hkdsb2JhbCBDaGFtYmVyc2lnbiBSb290IC0gMjAwOA==",
 577     "AMnN0+nVfSPO",
 578     nullptr
 579   },
 580   {
 581     // CN=TC TrustCenter Universal CA III,OU=TC TrustCenter Universal CA,O=TC TrustCenter GmbH,C=DE
 582     "1.2.276.0.44.1.1.1.4",
 583     "TC TrustCenter EV OID",
 584     SEC_OID_UNKNOWN,
 585     { 0x30, 0x9B, 0x4A, 0x87, 0xF6, 0xCA, 0x56, 0xC9, 0x31, 0x69, 0xAA,
 586       0xA9, 0x9C, 0x6D, 0x98, 0x88, 0x54, 0xD7, 0x89, 0x2B, 0xD5, 0x43,
 587       0x7E, 0x2D, 0x07, 0xB2, 0x9C, 0xBE, 0xDA, 0x55, 0xD3, 0x5D },
 588     "MHsxCzAJBgNVBAYTAkRFMRwwGgYDVQQKExNUQyBUcnVzdENlbnRlciBHbWJIMSQw"
 589     "IgYDVQQLExtUQyBUcnVzdENlbnRlciBVbml2ZXJzYWwgQ0ExKDAmBgNVBAMTH1RD"
 590     "IFRydXN0Q2VudGVyIFVuaXZlcnNhbCBDQSBJSUk=",
 591     "YyUAAQACFI0zFQLkbPQ=",
 592     nullptr
 593   },
 594   {
 595     // CN=AffirmTrust Commercial,O=AffirmTrust,C=US
 596     "1.3.6.1.4.1.34697.2.1",
 597     "AffirmTrust EV OID a",
 598     SEC_OID_UNKNOWN,
 599     { 0x03, 0x76, 0xAB, 0x1D, 0x54, 0xC5, 0xF9, 0x80, 0x3C, 0xE4, 0xB2,
 600       0xE2, 0x01, 0xA0, 0xEE, 0x7E, 0xEF, 0x7B, 0x57, 0xB6, 0x36, 0xE8,
 601       0xA9, 0x3C, 0x9B, 0x8D, 0x48, 0x60, 0xC9, 0x6F, 0x5F, 0xA7 },
 602     "MEQxCzAJBgNVBAYTAlVTMRQwEgYDVQQKDAtBZmZpcm1UcnVzdDEfMB0GA1UEAwwW"
 603     "QWZmaXJtVHJ1c3QgQ29tbWVyY2lhbA==",
 604     "d3cGJyapsXw=",
 605     nullptr
 606   },
 607   {
 608     // CN=AffirmTrust Networking,O=AffirmTrust,C=US
 609     "1.3.6.1.4.1.34697.2.2",
 610     "AffirmTrust EV OID b",
 611     SEC_OID_UNKNOWN,
 612     { 0x0A, 0x81, 0xEC, 0x5A, 0x92, 0x97, 0x77, 0xF1, 0x45, 0x90, 0x4A,
 613       0xF3, 0x8D, 0x5D, 0x50, 0x9F, 0x66, 0xB5, 0xE2, 0xC5, 0x8F, 0xCD,
 614       0xB5, 0x31, 0x05, 0x8B, 0x0E, 0x17, 0xF3, 0xF0, 0xB4, 0x1B },
 615     "MEQxCzAJBgNVBAYTAlVTMRQwEgYDVQQKDAtBZmZpcm1UcnVzdDEfMB0GA1UEAwwW"
 616     "QWZmaXJtVHJ1c3QgTmV0d29ya2luZw==",
 617     "fE8EORzUmS0=",
 618     nullptr
 619   },
 620   {
 621     // CN=AffirmTrust Premium,O=AffirmTrust,C=US
 622     "1.3.6.1.4.1.34697.2.3",
 623     "AffirmTrust EV OID c",
 624     SEC_OID_UNKNOWN,
 625     { 0x70, 0xA7, 0x3F, 0x7F, 0x37, 0x6B, 0x60, 0x07, 0x42, 0x48, 0x90,
 626       0x45, 0x34, 0xB1, 0x14, 0x82, 0xD5, 0xBF, 0x0E, 0x69, 0x8E, 0xCC,
 627       0x49, 0x8D, 0xF5, 0x25, 0x77, 0xEB, 0xF2, 0xE9, 0x3B, 0x9A },
 628     "MEExCzAJBgNVBAYTAlVTMRQwEgYDVQQKDAtBZmZpcm1UcnVzdDEcMBoGA1UEAwwT"
 629     "QWZmaXJtVHJ1c3QgUHJlbWl1bQ==",
 630     "bYwURrGmCu4=",
 631     nullptr
 632   },
 633   {
 634     // CN=AffirmTrust Premium ECC,O=AffirmTrust,C=US
 635     "1.3.6.1.4.1.34697.2.4",
 636     "AffirmTrust EV OID d",
 637     SEC_OID_UNKNOWN,
 638     { 0xBD, 0x71, 0xFD, 0xF6, 0xDA, 0x97, 0xE4, 0xCF, 0x62, 0xD1, 0x64,
 639       0x7A, 0xDD, 0x25, 0x81, 0xB0, 0x7D, 0x79, 0xAD, 0xF8, 0x39, 0x7E,
 640       0xB4, 0xEC, 0xBA, 0x9C, 0x5E, 0x84, 0x88, 0x82, 0x14, 0x23 },
 641     "MEUxCzAJBgNVBAYTAlVTMRQwEgYDVQQKDAtBZmZpcm1UcnVzdDEgMB4GA1UEAwwX"
 642     "QWZmaXJtVHJ1c3QgUHJlbWl1bSBFQ0M=",
 643     "dJclisc/elQ=",
 644     nullptr
 645   },
 646   {
 647     // CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
 648     "1.2.616.1.113527.2.5.1.1",
 649     "Certum EV OID",
 650     SEC_OID_UNKNOWN,
 651     { 0x5C, 0x58, 0x46, 0x8D, 0x55, 0xF5, 0x8E, 0x49, 0x7E, 0x74, 0x39,
 652       0x82, 0xD2, 0xB5, 0x00, 0x10, 0xB6, 0xD1, 0x65, 0x37, 0x4A, 0xCF,
 653       0x83, 0xA7, 0xD4, 0xA3, 0x2D, 0xB7, 0x68, 0xC4, 0x40, 0x8E },
 654     "MH4xCzAJBgNVBAYTAlBMMSIwIAYDVQQKExlVbml6ZXRvIFRlY2hub2xvZ2llcyBT"
 655     "LkEuMScwJQYDVQQLEx5DZXJ0dW0gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxIjAg"
 656     "BgNVBAMTGUNlcnR1bSBUcnVzdGVkIE5ldHdvcmsgQ0E=",
 657     "BETA",
 658     nullptr
 659   },
 660   {
 661     // CN=Izenpe.com,O=IZENPE S.A.,C=ES
 662     "1.3.6.1.4.1.14777.6.1.1",
 663     "Izenpe EV OID 1",
 664     SEC_OID_UNKNOWN,
 665     { 0x25, 0x30, 0xCC, 0x8E, 0x98, 0x32, 0x15, 0x02, 0xBA, 0xD9, 0x6F,
 666       0x9B, 0x1F, 0xBA, 0x1B, 0x09, 0x9E, 0x2D, 0x29, 0x9E, 0x0F, 0x45,
 667       0x48, 0xBB, 0x91, 0x4F, 0x36, 0x3B, 0xC0, 0xD4, 0x53, 0x1F },
 668     "MDgxCzAJBgNVBAYTAkVTMRQwEgYDVQQKDAtJWkVOUEUgUy5BLjETMBEGA1UEAwwK"
 669     "SXplbnBlLmNvbQ==",
 670     "ALC3WhZIX7/hy/WL1xnmfQ==",
 671     nullptr
 672   },
 673   {
 674     // CN=Izenpe.com,O=IZENPE S.A.,C=ES
 675     "1.3.6.1.4.1.14777.6.1.2",
 676     "Izenpe EV OID 2",
 677     SEC_OID_UNKNOWN,
 678     { 0x25, 0x30, 0xCC, 0x8E, 0x98, 0x32, 0x15, 0x02, 0xBA, 0xD9, 0x6F,
 679       0x9B, 0x1F, 0xBA, 0x1B, 0x09, 0x9E, 0x2D, 0x29, 0x9E, 0x0F, 0x45,
 680       0x48, 0xBB, 0x91, 0x4F, 0x36, 0x3B, 0xC0, 0xD4, 0x53, 0x1F },
 681     "MDgxCzAJBgNVBAYTAkVTMRQwEgYDVQQKDAtJWkVOUEUgUy5BLjETMBEGA1UEAwwK"
 682     "SXplbnBlLmNvbQ==",
 683     "ALC3WhZIX7/hy/WL1xnmfQ==",
 684     nullptr
 685   },
 686   {
 687     // CN=A-Trust-nQual-03,OU=A-Trust-nQual-03,O=A-Trust Ges. f. Sicherheitssysteme im elektr. Datenverkehr GmbH,C=AT
 688     "1.2.40.0.17.1.22",
 689     "A-Trust EV OID",
 690     SEC_OID_UNKNOWN,
 691     { 0x79, 0x3C, 0xBF, 0x45, 0x59, 0xB9, 0xFD, 0xE3, 0x8A, 0xB2, 0x2D,
 692       0xF1, 0x68, 0x69, 0xF6, 0x98, 0x81, 0xAE, 0x14, 0xC4, 0xB0, 0x13,
 693       0x9A, 0xC7, 0x88, 0xA7, 0x8A, 0x1A, 0xFC, 0xCA, 0x02, 0xFB },
 694     "MIGNMQswCQYDVQQGEwJBVDFIMEYGA1UECgw/QS1UcnVzdCBHZXMuIGYuIFNpY2hl"
 695     "cmhlaXRzc3lzdGVtZSBpbSBlbGVrdHIuIERhdGVudmVya2VociBHbWJIMRkwFwYD"
 696     "VQQLDBBBLVRydXN0LW5RdWFsLTAzMRkwFwYDVQQDDBBBLVRydXN0LW5RdWFsLTAz",
 697     "AWwe",
 698     nullptr
 699   },
 700   {
 701     // CN=T-TeleSec GlobalRoot Class 3,OU=T-Systems Trust Center,O=T-Systems Enterprise Services GmbH,C=DE
 702     "1.3.6.1.4.1.7879.13.24.1",
 703     "T-Systems EV OID",
 704     SEC_OID_UNKNOWN,
 705     { 0xFD, 0x73, 0xDA, 0xD3, 0x1C, 0x64, 0x4F, 0xF1, 0xB4, 0x3B, 0xEF,
 706       0x0C, 0xCD, 0xDA, 0x96, 0x71, 0x0B, 0x9C, 0xD9, 0x87, 0x5E, 0xCA,
 707       0x7E, 0x31, 0x70, 0x7A, 0xF3, 0xE9, 0x6D, 0x52, 0x2B, 0xBD },
 708     "MIGCMQswCQYDVQQGEwJERTErMCkGA1UECgwiVC1TeXN0ZW1zIEVudGVycHJpc2Ug"
 709     "U2VydmljZXMgR21iSDEfMB0GA1UECwwWVC1TeXN0ZW1zIFRydXN0IENlbnRlcjEl"
 710     "MCMGA1UEAwwcVC1UZWxlU2VjIEdsb2JhbFJvb3QgQ2xhc3MgMw==",
 711     "AQ==",
 712     nullptr
 713   },
 714   {
 715     // CN=TURKTRUST Elektronik Sertifika Hizmet Saglayicisi,O=TURKTRUST Bilgi Illetisim ve Bilisim Guvenligi Hizmetleri A.S.,C=TR
 716     "2.16.792.3.0.3.1.1.5",
 717     "TurkTrust EV OID",
 718     SEC_OID_UNKNOWN,
 719     { 0x97, 0x8C, 0xD9, 0x66, 0xF2, 0xFA, 0xA0, 0x7B, 0xA7, 0xAA, 0x95,
 720       0x00, 0xD9, 0xC0, 0x2E, 0x9D, 0x77, 0xF2, 0xCD, 0xAD, 0xA6, 0xAD,
 721       0x6B, 0xA7, 0x4A, 0xF4, 0xB9, 0x1C, 0x66, 0x59, 0x3C, 0x50 },
 722     "MIG/MT8wPQYDVQQDDDZUw5xSS1RSVVNUIEVsZWt0cm9uaWsgU2VydGlmaWthIEhp"
 723     "em1ldCBTYcSfbGF5xLFjxLFzxLExCzAJBgNVBAYTAlRSMQ8wDQYDVQQHDAZBbmth"
 724     "cmExXjBcBgNVBAoMVVTDnFJLVFJVU1QgQmlsZ2kgxLBsZXRpxZ9pbSB2ZSBCaWxp"
 725     "xZ9pbSBHw7x2ZW5sacSfaSBIaXptZXRsZXJpIEEuxZ4uIChjKSBBcmFsxLFrIDIw"
 726     "MDc=",
 727     "AQ==",
 728     nullptr
 729   },
 730   {
 731     // CN=China Internet Network Information Center EV Certificates Root,O=China Internet Network Information Center,C=CN
 732     "1.3.6.1.4.1.29836.1.10",
 733     "CNNIC EV OID",
 734     SEC_OID_UNKNOWN,
 735     { 0x1C, 0x01, 0xC6, 0xF4, 0xDB, 0xB2, 0xFE, 0xFC, 0x22, 0x55, 0x8B,
 736       0x2B, 0xCA, 0x32, 0x56, 0x3F, 0x49, 0x84, 0x4A, 0xCF, 0xC3, 0x2B,
 737       0x7B, 0xE4, 0xB0, 0xFF, 0x59, 0x9F, 0x9E, 0x8C, 0x7A, 0xF7 },
 738     "MIGKMQswCQYDVQQGEwJDTjEyMDAGA1UECgwpQ2hpbmEgSW50ZXJuZXQgTmV0d29y"
 739     "ayBJbmZvcm1hdGlvbiBDZW50ZXIxRzBFBgNVBAMMPkNoaW5hIEludGVybmV0IE5l"
 740     "dHdvcmsgSW5mb3JtYXRpb24gQ2VudGVyIEVWIENlcnRpZmljYXRlcyBSb290",
 741     "SJ8AAQ==",
 742     nullptr
 743   },
 744   {
 745     // CN=TWCA Root Certification Authority,OU=Root CA,O=TAIWAN-CA,C=TW
 746     "1.3.6.1.4.1.40869.1.1.22.3",
 747     "TWCA EV OID",
 748     SEC_OID_UNKNOWN,
 749     { 0xBF, 0xD8, 0x8F, 0xE1, 0x10, 0x1C, 0x41, 0xAE, 0x3E, 0x80, 0x1B,
 750       0xF8, 0xBE, 0x56, 0x35, 0x0E, 0xE9, 0xBA, 0xD1, 0xA6, 0xB9, 0xBD,
 751       0x51, 0x5E, 0xDC, 0x5C, 0x6D, 0x5B, 0x87, 0x11, 0xAC, 0x44 },
 752     "MF8xCzAJBgNVBAYTAlRXMRIwEAYDVQQKDAlUQUlXQU4tQ0ExEDAOBgNVBAsMB1Jv"
 753     "b3QgQ0ExKjAoBgNVBAMMIVRXQ0EgUm9vdCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0"
 754     "eQ==",
 755     "AQ==",
 756     nullptr
 757   },
 758   {
 759     // CN=D-TRUST Root Class 3 CA 2 EV 2009,O=D-Trust GmbH,C=DE
 760     "1.3.6.1.4.1.4788.2.202.1",
 761     "D-TRUST EV OID",
 762     SEC_OID_UNKNOWN,
 763     { 0xEE, 0xC5, 0x49, 0x6B, 0x98, 0x8C, 0xE9, 0x86, 0x25, 0xB9, 0x34,
 764       0x09, 0x2E, 0xEC, 0x29, 0x08, 0xBE, 0xD0, 0xB0, 0xF3, 0x16, 0xC2,
 765       0xD4, 0x73, 0x0C, 0x84, 0xEA, 0xF1, 0xF3, 0xD3, 0x48, 0x81 },
 766     "MFAxCzAJBgNVBAYTAkRFMRUwEwYDVQQKDAxELVRydXN0IEdtYkgxKjAoBgNVBAMM"
 767     "IUQtVFJVU1QgUm9vdCBDbGFzcyAzIENBIDIgRVYgMjAwOQ==",
 768     "CYP0",
 769     nullptr
 770   },
 771   {
 772     // CN=Swisscom Root EV CA 2,OU=Digital Certificate Services,O=Swisscom,C=ch
 773     "2.16.756.1.83.21.0",
 774     "Swisscom  EV OID",
 775     SEC_OID_UNKNOWN,
 776     { 0xD9, 0x5F, 0xEA, 0x3C, 0xA4, 0xEE, 0xDC, 0xE7, 0x4C, 0xD7, 0x6E,
 777       0x75, 0xFC, 0x6D, 0x1F, 0xF6, 0x2C, 0x44, 0x1F, 0x0F, 0xA8, 0xBC,
 778       0x77, 0xF0, 0x34, 0xB1, 0x9E, 0x5D, 0xB2, 0x58, 0x01, 0x5D },
 779     "MGcxCzAJBgNVBAYTAmNoMREwDwYDVQQKEwhTd2lzc2NvbTElMCMGA1UECxMcRGln"
 780     "aXRhbCBDZXJ0aWZpY2F0ZSBTZXJ2aWNlczEeMBwGA1UEAxMVU3dpc3Njb20gUm9v"
 781     "dCBFViBDQSAy",
 782     "APL6ZOJ0Y9ON/RAdBB92ylg=",
 783     nullptr
 784   },
 785   {
 786     // CN=VeriSign Universal Root Certification Authority,OU="(c) 2008 VeriSign, Inc. - For authorized use only",OU=VeriSign Trust Network,O="VeriSign, Inc.",C=US
 787     "2.16.840.1.113733.1.7.23.6",
 788     "VeriSign EV OID",
 789     SEC_OID_UNKNOWN,
 790     { 0x23, 0x99, 0x56, 0x11, 0x27, 0xA5, 0x71, 0x25, 0xDE, 0x8C, 0xEF,
 791       0xEA, 0x61, 0x0D, 0xDF, 0x2F, 0xA0, 0x78, 0xB5, 0xC8, 0x06, 0x7F,
 792       0x4E, 0x82, 0x82, 0x90, 0xBF, 0xB8, 0x60, 0xE8, 0x4B, 0x3C },
 793     "MIG9MQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNV"
 794     "BAsTFlZlcmlTaWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAyMDA4IFZl"
 795     "cmlTaWduLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxODA2BgNVBAMT"
 796     "L1ZlcmlTaWduIFVuaXZlcnNhbCBSb290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5",
 797     "QBrEZCGzEyEDDrvkEhrFHQ==",
 798     nullptr
 799   },
 800   {
 801     // CN=GeoTrust Primary Certification Authority - G3,OU=(c) 2008 GeoTrust Inc. - For authorized use only,O=GeoTrust Inc.,C=US
 802     "1.3.6.1.4.1.14370.1.6",
 803     "GeoTrust EV OID",
 804     SEC_OID_UNKNOWN,
 805     { 0xB4, 0x78, 0xB8, 0x12, 0x25, 0x0D, 0xF8, 0x78, 0x63, 0x5C, 0x2A,
 806       0xA7, 0xEC, 0x7D, 0x15, 0x5E, 0xAA, 0x62, 0x5E, 0xE8, 0x29, 0x16,
 807       0xE2, 0xCD, 0x29, 0x43, 0x61, 0x88, 0x6C, 0xD1, 0xFB, 0xD4 },
 808     "MIGYMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNR2VvVHJ1c3QgSW5jLjE5MDcGA1UE"
 809     "CxMwKGMpIDIwMDggR2VvVHJ1c3QgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBv"
 810     "bmx5MTYwNAYDVQQDEy1HZW9UcnVzdCBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0"
 811     "aG9yaXR5IC0gRzM=",
 812     "FaxulBmyeUtB9iepwxgPHw==",
 813     nullptr
 814   },
 815   {
 816     // CN=thawte Primary Root CA - G3,OU="(c) 2008 thawte, Inc. - For authorized use only",OU=Certification Services Division,O="thawte, Inc.",C=US
 817     "2.16.840.1.113733.1.7.48.1",
 818     "Thawte EV OID",
 819     SEC_OID_UNKNOWN,
 820     { 0x4B, 0x03, 0xF4, 0x58, 0x07, 0xAD, 0x70, 0xF2, 0x1B, 0xFC, 0x2C,
 821       0xAE, 0x71, 0xC9, 0xFD, 0xE4, 0x60, 0x4C, 0x06, 0x4C, 0xF5, 0xFF,
 822       0xB6, 0x86, 0xBA, 0xE5, 0xDB, 0xAA, 0xD7, 0xFD, 0xD3, 0x4C },
 823     "MIGuMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMdGhhd3RlLCBJbmMuMSgwJgYDVQQL"
 824     "Ex9DZXJ0aWZpY2F0aW9uIFNlcnZpY2VzIERpdmlzaW9uMTgwNgYDVQQLEy8oYykg"
 825     "MjAwOCB0aGF3dGUsIEluYy4gLSBGb3IgYXV0aG9yaXplZCB1c2Ugb25seTEkMCIG"
 826     "A1UEAxMbdGhhd3RlIFByaW1hcnkgUm9vdCBDQSAtIEcz",
 827     "YAGXt0an6rS0mtZLL/eQ+w==",
 828     nullptr
 829   },
 830   {
 831     // CN = Autoridad de Certificacion Firmaprofesional CIF A62634068, C = ES
 832     "1.3.6.1.4.1.13177.10.1.3.10",
 833     "Firmaprofesional EV OID",
 834     SEC_OID_UNKNOWN,
 835     { 0x04, 0x04, 0x80, 0x28, 0xBF, 0x1F, 0x28, 0x64, 0xD4, 0x8F, 0x9A,
 836       0xD4, 0xD8, 0x32, 0x94, 0x36, 0x6A, 0x82, 0x88, 0x56, 0x55, 0x3F,
 837       0x3B, 0x14, 0x30, 0x3F, 0x90, 0x14, 0x7F, 0x5D, 0x40, 0xEF },
 838     "MFExCzAJBgNVBAYTAkVTMUIwQAYDVQQDDDlBdXRvcmlkYWQgZGUgQ2VydGlmaWNh"
 839     "Y2lvbiBGaXJtYXByb2Zlc2lvbmFsIENJRiBBNjI2MzQwNjg=",
 840     "U+w77vuySF8=",
 841     nullptr
 842   },
 843   {
 844     // CN = TWCA Global Root CA, OU = Root CA, O = TAIWAN-CA, C = TW
 845     "1.3.6.1.4.1.40869.1.1.22.3",
 846     "TWCA EV OID",
 847     SEC_OID_UNKNOWN,
 848     { 0x59, 0x76, 0x90, 0x07, 0xF7, 0x68, 0x5D, 0x0F, 0xCD, 0x50, 0x87,
 849       0x2F, 0x9F, 0x95, 0xD5, 0x75, 0x5A, 0x5B, 0x2B, 0x45, 0x7D, 0x81,
 850       0xF3, 0x69, 0x2B, 0x61, 0x0A, 0x98, 0x67, 0x2F, 0x0E, 0x1B },
 851     "MFExCzAJBgNVBAYTAlRXMRIwEAYDVQQKEwlUQUlXQU4tQ0ExEDAOBgNVBAsTB1Jv"
 852     "b3QgQ0ExHDAaBgNVBAMTE1RXQ0EgR2xvYmFsIFJvb3QgQ0E=",
 853     "DL4=",
 854     nullptr
 855   },
 856   {
 857     // CN = E-Tugra Certification Authority, OU = E-Tugra Sertifikasyon Merkezi, O = E-Tuğra EBG Bilişim Teknolojileri ve Hizmetleri A.Ş., L = Ankara, C = TR
 858     "2.16.792.3.0.4.1.1.4",
 859     "ETugra EV OID",
 860     SEC_OID_UNKNOWN,
 861     { 0xB0, 0xBF, 0xD5, 0x2B, 0xB0, 0xD7, 0xD9, 0xBD, 0x92, 0xBF, 0x5D,
 862       0x4D, 0xC1, 0x3D, 0xA2, 0x55, 0xC0, 0x2C, 0x54, 0x2F, 0x37, 0x83,
 863       0x65, 0xEA, 0x89, 0x39, 0x11, 0xF5, 0x5E, 0x55, 0xF2, 0x3C },
 864     "MIGyMQswCQYDVQQGEwJUUjEPMA0GA1UEBwwGQW5rYXJhMUAwPgYDVQQKDDdFLVR1"
 865     "xJ9yYSBFQkcgQmlsacWfaW0gVGVrbm9sb2ppbGVyaSB2ZSBIaXptZXRsZXJpIEEu"
 866     "xZ4uMSYwJAYDVQQLDB1FLVR1Z3JhIFNlcnRpZmlrYXN5b24gTWVya2V6aTEoMCYG"
 867     "A1UEAwwfRS1UdWdyYSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eQ==",
 868     "amg+nFGby1M=",
 869     nullptr
 870   },
 871   {
 872     // CN=Actalis Authentication Root CA,O=Actalis S.p.A./03358520967,L=Milan,C=IT
 873     "1.3.159.1.17.1",
 874     "Actalis EV OID",
 875     SEC_OID_UNKNOWN,
 876     { 0x55, 0x92, 0x60, 0x84, 0xEC, 0x96, 0x3A, 0x64, 0xB9, 0x6E, 0x2A,
 877       0xBE, 0x01, 0xCE, 0x0B, 0xA8, 0x6A, 0x64, 0xFB, 0xFE, 0xBC, 0xC7,
 878       0xAA, 0xB5, 0xAF, 0xC1, 0x55, 0xB3, 0x7F, 0xD7, 0x60, 0x66 },
 879     "MGsxCzAJBgNVBAYTAklUMQ4wDAYDVQQHDAVNaWxhbjEjMCEGA1UECgwaQWN0YWxp"
 880     "cyBTLnAuQS4vMDMzNTg1MjA5NjcxJzAlBgNVBAMMHkFjdGFsaXMgQXV0aGVudGlj"
 881     "YXRpb24gUm9vdCBDQQ==",
 882     "VwoRl0LE48w=",
 883     nullptr
 884   },
 885   {
 886     // CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN
 887     "1.3.6.1.4.1.36305.2",
 888     "WoSign EV OID",
 889     SEC_OID_UNKNOWN,
 890     { 0x4B, 0x22, 0xD5, 0xA6, 0xAE, 0xC9, 0x9F, 0x3C, 0xDB, 0x79, 0xAA,
 891       0x5E, 0xC0, 0x68, 0x38, 0x47, 0x9C, 0xD5, 0xEC, 0xBA, 0x71, 0x64,
 892       0xF7, 0xF2, 0x2D, 0xC1, 0xD6, 0x5F, 0x63, 0xD8, 0x57, 0x08 },
 893     "MFUxCzAJBgNVBAYTAkNOMRowGAYDVQQKExFXb1NpZ24gQ0EgTGltaXRlZDEqMCgG"
 894     "A1UEAxMhQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgb2YgV29TaWdu",
 895     "XmjWEXGUY1BWAGjzPsnFkQ==",
 896     nullptr
 897   },
 898   {
 899     // CN=CA ...............,O=WoSign CA Limited,C=CN
 900     "1.3.6.1.4.1.36305.2",
 901     "WoSign EV OID",
 902     SEC_OID_UNKNOWN,
 903     { 0xD6, 0xF0, 0x34, 0xBD, 0x94, 0xAA, 0x23, 0x3F, 0x02, 0x97, 0xEC,
 904       0xA4, 0x24, 0x5B, 0x28, 0x39, 0x73, 0xE4, 0x47, 0xAA, 0x59, 0x0F,
 905       0x31, 0x0C, 0x77, 0xF4, 0x8F, 0xDF, 0x83, 0x11, 0x22, 0x54 },
 906     "MEYxCzAJBgNVBAYTAkNOMRowGAYDVQQKExFXb1NpZ24gQ0EgTGltaXRlZDEbMBkG"
 907     "A1UEAwwSQ0Eg5rKD6YCa5qC56K+B5Lmm",
 908     "UHBrzdgT/BtOOzNy0hFIjQ==",
 909     nullptr
 910   },
 911   {
 912     // CN=DigiCert Assured ID Root G2,OU=www.digicert.com,O=DigiCert Inc,C=US
 913     "2.16.840.1.114412.2.1",
 914     "DigiCert EV OID",
 915     SEC_OID_UNKNOWN,
 916     { 0x7D, 0x05, 0xEB, 0xB6, 0x82, 0x33, 0x9F, 0x8C, 0x94, 0x51, 0xEE,
 917       0x09, 0x4E, 0xEB, 0xFE, 0xFA, 0x79, 0x53, 0xA1, 0x14, 0xED, 0xB2,
 918       0xF4, 0x49, 0x49, 0x45, 0x2F, 0xAB, 0x7D, 0x2F, 0xC1, 0x85 },
 919     "MGUxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsT"
 920     "EHd3dy5kaWdpY2VydC5jb20xJDAiBgNVBAMTG0RpZ2lDZXJ0IEFzc3VyZWQgSUQg"
 921     "Um9vdCBHMg==",
 922     "C5McOtY5Z+pnI7/Dr5r0Sw==",
 923     nullptr
 924   },
 925   {
 926     // CN=DigiCert Assured ID Root G3,OU=www.digicert.com,O=DigiCert Inc,C=US
 927     "2.16.840.1.114412.2.1",
 928     "DigiCert EV OID",
 929     SEC_OID_UNKNOWN,
 930     { 0x7E, 0x37, 0xCB, 0x8B, 0x4C, 0x47, 0x09, 0x0C, 0xAB, 0x36, 0x55,
 931       0x1B, 0xA6, 0xF4, 0x5D, 0xB8, 0x40, 0x68, 0x0F, 0xBA, 0x16, 0x6A,
 932       0x95, 0x2D, 0xB1, 0x00, 0x71, 0x7F, 0x43, 0x05, 0x3F, 0xC2 },
 933     "MGUxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsT"
 934     "EHd3dy5kaWdpY2VydC5jb20xJDAiBgNVBAMTG0RpZ2lDZXJ0IEFzc3VyZWQgSUQg"
 935     "Um9vdCBHMw==",
 936     "C6Fa+h3foLVJRK/NJKBs7A==",
 937     nullptr,
 938   },
 939   {
 940     // CN=DigiCert Global Root G2,OU=www.digicert.com,O=DigiCert Inc,C=US
 941     "2.16.840.1.114412.2.1",
 942     "DigiCert EV OID",
 943      SEC_OID_UNKNOWN,
 944     { 0xCB, 0x3C, 0xCB, 0xB7, 0x60, 0x31, 0xE5, 0xE0, 0x13, 0x8F, 0x8D,
 945       0xD3, 0x9A, 0x23, 0xF9, 0xDE, 0x47, 0xFF, 0xC3, 0x5E, 0x43, 0xC1,
 946       0x14, 0x4C, 0xEA, 0x27, 0xD4, 0x6A, 0x5A, 0xB1, 0xCB, 0x5F },
 947     "MGExCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsT"
 948     "EHd3dy5kaWdpY2VydC5jb20xIDAeBgNVBAMTF0RpZ2lDZXJ0IEdsb2JhbCBSb290"
 949     "IEcy",
 950     "Azrx5qcRqaC7KGSxHQn65Q==",
 951     nullptr,
 952   },
 953   {
 954     // CN=DigiCert Global Root G3,OU=www.digicert.com,O=DigiCert Inc,C=US
 955     "2.16.840.1.114412.2.1",
 956     "DigiCert EV OID",
 957     SEC_OID_UNKNOWN,
 958     { 0x31, 0xAD, 0x66, 0x48, 0xF8, 0x10, 0x41, 0x38, 0xC7, 0x38, 0xF3,
 959       0x9E, 0xA4, 0x32, 0x01, 0x33, 0x39, 0x3E, 0x3A, 0x18, 0xCC, 0x02,
 960       0x29, 0x6E, 0xF9, 0x7C, 0x2A, 0xC9, 0xEF, 0x67, 0x31, 0xD0 },
 961     "MGExCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsT"
 962     "EHd3dy5kaWdpY2VydC5jb20xIDAeBgNVBAMTF0RpZ2lDZXJ0IEdsb2JhbCBSb290"
 963     "IEcz",
 964     "BVVWvPJepDU1w6QP1atFcg==",
 965     nullptr
 966   },
 967   {
 968     // CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
 969     "2.16.840.1.114412.2.1",
 970     "DigiCert EV OID",
 971     SEC_OID_UNKNOWN,
 972     { 0x55, 0x2F, 0x7B, 0xDC, 0xF1, 0xA7, 0xAF, 0x9E, 0x6C, 0xE6, 0x72,
 973       0x01, 0x7F, 0x4F, 0x12, 0xAB, 0xF7, 0x72, 0x40, 0xC7, 0x8E, 0x76,
 974       0x1A, 0xC2, 0x03, 0xD1, 0xD9, 0xD2, 0x0A, 0xC8, 0x99, 0x88 },
 975     "MGIxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsT"
 976     "EHd3dy5kaWdpY2VydC5jb20xITAfBgNVBAMTGERpZ2lDZXJ0IFRydXN0ZWQgUm9v"
 977     "dCBHNA==",
 978     "BZsbV56OITLiOQe9p3d1XA==",
 979     nullptr
 980   },
 981   {
 982     // CN=QuoVadis Root CA 2 G3,O=QuoVadis Limited,C=BM
 983     "1.3.6.1.4.1.8024.0.2.100.1.2",
 984     "QuoVadis EV OID",
 985     SEC_OID_UNKNOWN,
 986     { 0x8F, 0xE4, 0xFB, 0x0A, 0xF9, 0x3A, 0x4D, 0x0D, 0x67, 0xDB, 0x0B,
 987       0xEB, 0xB2, 0x3E, 0x37, 0xC7, 0x1B, 0xF3, 0x25, 0xDC, 0xBC, 0xDD,
 988       0x24, 0x0E, 0xA0, 0x4D, 0xAF, 0x58, 0xB4, 0x7E, 0x18, 0x40 },
 989     "MEgxCzAJBgNVBAYTAkJNMRkwFwYDVQQKExBRdW9WYWRpcyBMaW1pdGVkMR4wHAYD"
 990     "VQQDExVRdW9WYWRpcyBSb290IENBIDIgRzM=",
 991     "RFc0JFuBiZs18s64KztbpybwdSg=",
 992     nullptr
 993   }
 994 };
 995
 996 static SECOidTag
 997 register_oid(const SECItem* oid_item, const char* oid_name)
 998 {
 999   if (!oid_item)
1000     return SEC_OID_UNKNOWN;
1001
1002   SECOidData od;
1003   od.oid.len = oid_item->len;
1004   od.oid.data = oid_item->data;
1005   od.offset = SEC_OID_UNKNOWN;
1006   od.desc = oid_name;
1007   od.mechanism = CKM_INVALID_MECHANISM;
1008   od.supportedExtension = INVALID_CERT_EXTENSION;
1009   return SECOID_AddEntry(&od);
1010 }
1011
1012 static bool
1013 isEVPolicy(SECOidTag policyOIDTag)
1014 {
1015   for (size_t iEV = 0; iEV < PR_ARRAY_SIZE(myTrustedEVInfos); ++iEV) {
1016     nsMyTrustedEVInfo& entry = myTrustedEVInfos[iEV];
1017     if (policyOIDTag == entry.oid_tag) {
1018       return true;
1019     }
1020   }
1021
1022   return false;
1023 }
1024
1025 namespace mozilla { namespace psm {
1026
1027 bool
1028 CertIsAuthoritativeForEVPolicy(const CERTCertificate* cert,
1029                                const mozilla::pkix::CertPolicyId& policy)
1030 {
1031   PR_ASSERT(cert);
1032   if (!cert) {
1033     return false;
1034   }
1035
1036   for (size_t iEV = 0; iEV < PR_ARRAY_SIZE(myTrustedEVInfos); ++iEV) {
1037     nsMyTrustedEVInfo& entry = myTrustedEVInfos[iEV];
1038     if (entry.cert && CERT_CompareCerts(cert, entry.cert)) {
1039       const SECOidData* oidData = SECOID_FindOIDByTag(entry.oid_tag);
1040       if (oidData && oidData->oid.len == policy.numBytes &&
1041           !memcmp(oidData->oid.data, policy.bytes, policy.numBytes)) {
1042         return true;
1043       }
1044     }
1045   }
1046
1047   return false;
1048 }
1049
1050 static PRStatus
1051 IdentityInfoInit()
1052 {
1053   for (size_t iEV = 0; iEV < PR_ARRAY_SIZE(myTrustedEVInfos); ++iEV) {
1054     nsMyTrustedEVInfo& entry = myTrustedEVInfos[iEV];
1055
1056     SECStatus rv;
1057     CERTIssuerAndSN ias;
1058
1059     rv = ATOB_ConvertAsciiToItem(&ias.derIssuer, const_cast<char*>(entry.issuer_base64));
1060     PR_ASSERT(rv == SECSuccess);
1061     if (rv != SECSuccess) {
1062       return PR_FAILURE;
1063     }
1064     rv = ATOB_ConvertAsciiToItem(&ias.serialNumber,
1065                                  const_cast<char*>(entry.serial_base64));
1066     PR_ASSERT(rv == SECSuccess);
1067     if (rv != SECSuccess) {
1068       SECITEM_FreeItem(&ias.derIssuer, false);
1069       return PR_FAILURE;
1070     }
1071
1072     ias.serialNumber.type = siUnsignedInteger;
1073
1074     entry.cert = CERT_FindCertByIssuerAndSN(nullptr, &ias);
1075
1076     SECITEM_FreeItem(&ias.derIssuer, false);
1077     SECITEM_FreeItem(&ias.serialNumber, false);
1078
1079     // If an entry is missing in the NSS root database, it may be because the
1080     // root database is out of sync with what we expect (e.g. a different
1081     // version of system NSS is installed). We will just silently avoid
1082     // treating that root cert as EV.
1083     if (!entry.cert) {
1084 #ifdef DEBUG
1085       // The debug CA info is at position 0, and is NOT on the NSS root db
1086       if (iEV == 0) {
1087         continue;
1088       }
1089 #endif
1090       PR_NOT_REACHED("Could not find EV root in NSS storage");
1091       continue;
1092     }
1093
1094     unsigned char certFingerprint[SHA256_LENGTH];
1095     rv = PK11_HashBuf(SEC_OID_SHA256, certFingerprint,
1096                       entry.cert->derCert.data,
1097                       static_cast<int32_t>(entry.cert->derCert.len));
1098     PR_ASSERT(rv == SECSuccess);
1099     if (rv == SECSuccess) {
1100       bool same = !memcmp(certFingerprint, entry.ev_root_sha256_fingerprint,
1101                           sizeof(certFingerprint));
1102       PR_ASSERT(same);
1103       if (same) {
1104
1105         SECItem ev_oid_item;
1106         ev_oid_item.data = nullptr;
1107         ev_oid_item.len = 0;
1108         rv = SEC_StringToOID(nullptr, &ev_oid_item, entry.dotted_oid, 0);
1109         PR_ASSERT(rv == SECSuccess);
1110         if (rv == SECSuccess) {
1111           entry.oid_tag = register_oid(&ev_oid_item, entry.oid_name);
1112           if (entry.oid_tag == SEC_OID_UNKNOWN) {
1113             rv = SECFailure;
1114           }
1115           SECITEM_FreeItem(&ev_oid_item, false);
1116         }
1117       } else {
1118         PR_SetError(SEC_ERROR_BAD_DATA, 0);
1119         rv = SECFailure;
1120       }
1121     }
1122
1123     if (rv != SECSuccess) {
1124       CERT_DestroyCertificate(entry.cert);
1125       entry.cert = nullptr;
1126       entry.oid_tag = SEC_OID_UNKNOWN;
1127       return PR_FAILURE;
1128     }
1129   }
1130
1131   return PR_SUCCESS;
1132 }
1133
1134 static PRCallOnceType sIdentityInfoCallOnce;
1135
1136 void
1137 EnsureIdentityInfoLoaded()
1138 {
1139   (void) PR_CallOnce(&sIdentityInfoCallOnce, IdentityInfoInit);
1140 }
1141
1142 void
1143 CleanupIdentityInfo()
1144 {
1145   for (size_t iEV = 0; iEV < PR_ARRAY_SIZE(myTrustedEVInfos); ++iEV) {
1146     nsMyTrustedEVInfo &entry = myTrustedEVInfos[iEV];
1147     if (entry.cert) {
1148       CERT_DestroyCertificate(entry.cert);
1149       entry.cert = nullptr;
1150     }
1151   }
1152
1153   memset(&sIdentityInfoCallOnce, 0, sizeof(PRCallOnceType));
1154 }
1155
1156 // Find the first policy OID that is known to be an EV policy OID.
1157 SECStatus
1158 GetFirstEVPolicy(CERTCertificate* cert,
1159                  /*out*/ mozilla::pkix::CertPolicyId& policy,
1160                  /*out*/ SECOidTag& policyOidTag)
1161 {
1162   if (!cert) {
1163     PR_SetError(SEC_ERROR_INVALID_ARGS, 0);
1164     return SECFailure;
1165   }
1166
1167   if (cert->extensions) {
1168     for (int i=0; cert->extensions[i]; i++) {
1169       const SECItem* oid = &cert->extensions[i]->id;
1170
1171       SECOidTag oidTag = SECOID_FindOIDTag(oid);
1172       if (oidTag != SEC_OID_X509_CERTIFICATE_POLICIES)
1173         continue;
1174
1175       SECItem* value = &cert->extensions[i]->value;
1176
1177       CERTCertificatePolicies* policies;
1178       CERTPolicyInfo** policyInfos;
1179
1180       policies = CERT_DecodeCertificatePoliciesExtension(value);
1181       if (!policies)
1182         continue;
1183
1184       policyInfos = policies->policyInfos;
1185
1186       bool found = false;
1187       while (*policyInfos) {
1188         const CERTPolicyInfo* policyInfo = *policyInfos++;
1189
1190         SECOidTag oid_tag = policyInfo->oid;
1191         if (oid_tag != SEC_OID_UNKNOWN && isEVPolicy(oid_tag)) {
1192           const SECOidData* oidData = SECOID_FindOIDByTag(oid_tag);
1193           PR_ASSERT(oidData);
1194           PR_ASSERT(oidData->oid.data);
1195           PR_ASSERT(oidData->oid.len > 0);
1196           PR_ASSERT(oidData->oid.len <= mozilla::pkix::CertPolicyId::MAX_BYTES);
1197           if (oidData && oidData->oid.data && oidData->oid.len > 0 &&
1198               oidData->oid.len <= mozilla::pkix::CertPolicyId::MAX_BYTES) {
1199             policy.numBytes = static_cast<uint16_t>(oidData->oid.len);
1200             memcpy(policy.bytes, oidData->oid.data, policy.numBytes);
1201             policyOidTag = oid_tag;
1202             found = true;
1203           }
1204           break;
1205         }
1206       }
1207       CERT_DestroyCertificatePoliciesExtension(policies);
1208       if (found) {
1209         return SECSuccess;
1210       }
1211     }
1212   }
1213
1214   PR_SetError(SEC_ERROR_POLICY_VALIDATION_FAILED, 0);
1215   return SECFailure;
1216 }
1217
1218 } } // namespace mozilla::psm