security/certverifier/ExtendedValidation.cpp

   1 /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*-
   2  *
   3  * This Source Code Form is subject to the terms of the Mozilla Public
   4  * License, v. 2.0. If a copy of the MPL was not distributed with this
   5  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
   6
   7 #include "ExtendedValidation.h"
   8
   9 #include "cert.h"
  10 #include "certdb.h"
  11 #include "base64.h"
  12 #include "hasht.h"
  13 #include "pkix/nullptr.h"
  14 #include "pkix/pkixtypes.h"
  15 #include "pk11pub.h"
  16 #include "secerr.h"
  17 #include "prerror.h"
  18 #include "prinit.h"
  19
  20 #ifdef PR_LOGGING
  21 extern PRLogModuleInfo* gPIPNSSLog;
  22 #endif
  23
  24 #define CONST_OID static const unsigned char
  25 #define OI(x) { siDEROID, (unsigned char*) x, sizeof x }
  26
  27 struct nsMyTrustedEVInfo
  28 {
  29   const char* dotted_oid;
  30   const char* oid_name; // Set this to null to signal an invalid structure,
  31                   // (We can't have an empty list, so we'll use a dummy entry)
  32   SECOidTag oid_tag;
  33   const unsigned char ev_root_sha256_fingerprint[SHA256_LENGTH];
  34   const char* issuer_base64;
  35   const char* serial_base64;
  36   CERTCertificate* cert;
  37 };
  38
  39 // HOWTO enable additional CA root certificates for EV:
  40 //
  41 // For each combination of "root certificate" and "policy OID",
  42 // one entry must be added to the array named myTrustedEVInfos.
  43 //
  44 // We use the combination of "issuer name" and "serial number" to
  45 // uniquely identify the certificate. In order to avoid problems
  46 // because of encodings when comparing certificates, we don't
  47 // use plain text representation, we rather use the original encoding
  48 // as it can be found in the root certificate (in base64 format).
  49 //
  50 // We can use the NSS utility named "pp" to extract the encoding.
  51 //
  52 // Build standalone NSS including the NSS tools, then run
  53 //   pp -t certificate-identity -i the-cert-filename
  54 //
  55 // You will need the output from sections "Issuer", "Fingerprint (SHA-256)",
  56 // "Issuer DER Base64" and "Serial DER Base64".
  57 //
  58 // The new section consists of 8 lines:
  59 //
  60 // - a comment that should contain the human readable issuer name
  61 //   of the certificate, as printed by the pp tool
  62 // - the EV policy OID that is associated to the EV grant
  63 // - a text description of the EV policy OID. The array can contain
  64 //   multiple entries with the same OID.
  65 //   Please make sure to use the identical OID text description for
  66 //   all entries with the same policy OID (use the text search
  67 //   feature of your text editor to find duplicates).
  68 //   When adding a new policy OID that is not yet contained in the array,
  69 //   please make sure that your new description is different from
  70 //   all the other descriptions (again use the text search feature
  71 //   to be sure).
  72 // - the constant SEC_OID_UNKNOWN
  73 //   (it will be replaced at runtime with another identifier)
  74 // - the SHA-256 fingerprint
  75 // - the "Issuer DER Base64" as printed by the pp tool.
  76 //   Remove all whitespaces. If you use multiple lines, make sure that
  77 //   only the final line will be followed by a comma.
  78 // - the "Serial DER Base64" (as printed by pp)
  79 // - nullptr
  80 //
  81 // After adding an entry, test it locally against the test site that
  82 // has been provided by the CA. Note that you must use a version of NSS
  83 // where the root certificate has already been added and marked as trusted
  84 // for issuing SSL server certificates (at least).
  85 //
  86 // If you are able to connect to the site without certificate errors,
  87 // but you don't see the EV status indicator, then most likely the CA
  88 // has a problem in their infrastructure. The most common problems are
  89 // related to the CA's OCSP infrastructure, either they use an incorrect
  90 // OCSP signing certificate, or OCSP for the intermediate certificates
  91 // isn't working, or OCSP isn't working at all.
  92
  93 #ifdef DEBUG
  94 static const size_t NUM_TEST_EV_ROOTS = 2;
  95 #endif
  96
  97 static struct nsMyTrustedEVInfo myTrustedEVInfos[] = {
  98   // IMPORTANT! When extending this list,
  99   // pairs of dotted_oid and oid_name should always be unique pairs.
 100   // In other words, if you add another list, that uses the same dotted_oid
 101   // as an existing entry, then please use the same oid_name.
 102 #ifdef DEBUG
 103   // Debug EV certificates should all use the OID (repeating EV OID is OK):
 104   // 1.3.6.1.4.1.13769.666.666.666.1.500.9.1.
 105   // If you add or remove debug EV certs you must also modify NUM_TEST_EV_ROOTS
 106   // so that the correct number of certs are skipped as these debug EV certs are
 107   // NOT part of the default trust store.
 108   {
 109     // This is the testing EV signature (xpcshell) (RSA)
 110     // CN=XPCShell EV Testing (untrustworthy) CA,OU=Security Engineering,O=Mozilla - EV debug test CA,L=Mountain View,ST=CA,C=US"
 111     "1.3.6.1.4.1.13769.666.666.666.1.500.9.1",
 112     "DEBUGtesting EV OID",
 113     SEC_OID_UNKNOWN,
 114     { 0x2D, 0x94, 0x52, 0x70, 0xAA, 0x92, 0x13, 0x0B, 0x1F, 0xB1, 0x24,
 115       0x0B, 0x24, 0xB1, 0xEE, 0x4E, 0xFB, 0x7C, 0x43, 0x45, 0x45, 0x7F,
 116       0x97, 0x6C, 0x90, 0xBF, 0xD4, 0x8A, 0x04, 0x79, 0xE4, 0x68 },
 117     "MIGnMQswCQYDVQQGEwJVUzELMAkGA1UECAwCQ0ExFjAUBgNVBAcMDU1vdW50YWlu"
 118     "IFZpZXcxIzAhBgNVBAoMGk1vemlsbGEgLSBFViBkZWJ1ZyB0ZXN0IENBMR0wGwYD"
 119     "VQQLDBRTZWN1cml0eSBFbmdpbmVlcmluZzEvMC0GA1UEAwwmWFBDU2hlbGwgRVYg"
 120     "VGVzdGluZyAodW50cnVzdHdvcnRoeSkgQ0E=",
 121     "At+3zdo=",
 122     nullptr
 123   },
 124   {
 125     // The RSA root with an inadequate key size used for EV key size checking
 126     // O=ev_root_rsa_2040,CN=XPCShell Key Size Testing rsa 2040-bit (EV)
 127     "1.3.6.1.4.1.13769.666.666.666.1.500.9.1",
 128     "DEBUGtesting EV OID",
 129     SEC_OID_UNKNOWN,
 130     { 0xA9, 0xCF, 0x93, 0x7B, 0x12, 0x9E, 0x39, 0xD2, 0x43, 0x10, 0x33,
 131       0x6B, 0xC6, 0xAD, 0x86, 0xA2, 0x7A, 0x9D, 0xA4, 0x5B, 0x67, 0xB2,
 132       0xB7, 0xC1, 0xDC, 0x47, 0x8E, 0xD8, 0xA9, 0x6E, 0x2D, 0x6A },
 133     "MFExNDAyBgNVBAMMK1hQQ1NoZWxsIEtleSBTaXplIFRlc3RpbmcgcnNhIDIwNDAt"
 134     "Yml0IChFVikxGTAXBgNVBAoMEGV2X3Jvb3RfcnNhXzIwNDA=",
 135     "ASt16w==",
 136     nullptr
 137   },
 138 #endif
 139   {
 140     // OU=Security Communication EV RootCA1,O="SECOM Trust Systems CO.,LTD.",C=JP
 141     "1.2.392.200091.100.721.1",
 142     "SECOM EV OID",
 143     SEC_OID_UNKNOWN,
 144     { 0xA2, 0x2D, 0xBA, 0x68, 0x1E, 0x97, 0x37, 0x6E, 0x2D, 0x39, 0x7D,
 145       0x72, 0x8A, 0xAE, 0x3A, 0x9B, 0x62, 0x96, 0xB9, 0xFD, 0xBA, 0x60,
 146       0xBC, 0x2E, 0x11, 0xF6, 0x47, 0xF2, 0xC6, 0x75, 0xFB, 0x37 },
 147     "MGAxCzAJBgNVBAYTAkpQMSUwIwYDVQQKExxTRUNPTSBUcnVzdCBTeXN0ZW1zIENP"
 148     "LixMVEQuMSowKAYDVQQLEyFTZWN1cml0eSBDb21tdW5pY2F0aW9uIEVWIFJvb3RD"
 149     "QTE=",
 150     "AA==",
 151     nullptr
 152   },
 153   {
 154     // CN=Cybertrust Global Root,O=Cybertrust, Inc
 155     "1.3.6.1.4.1.6334.1.100.1",
 156     "Cybertrust EV OID",
 157     SEC_OID_UNKNOWN,
 158     { 0x96, 0x0A, 0xDF, 0x00, 0x63, 0xE9, 0x63, 0x56, 0x75, 0x0C, 0x29,
 159       0x65, 0xDD, 0x0A, 0x08, 0x67, 0xDA, 0x0B, 0x9C, 0xBD, 0x6E, 0x77,
 160       0x71, 0x4A, 0xEA, 0xFB, 0x23, 0x49, 0xAB, 0x39, 0x3D, 0xA3 },
 161     "MDsxGDAWBgNVBAoTD0N5YmVydHJ1c3QsIEluYzEfMB0GA1UEAxMWQ3liZXJ0cnVz"
 162     "dCBHbG9iYWwgUm9vdA==",
 163     "BAAAAAABD4WqLUg=",
 164     nullptr
 165   },
 166   {
 167     // CN=SwissSign Gold CA - G2,O=SwissSign AG,C=CH
 168     "2.16.756.1.89.1.2.1.1",
 169     "SwissSign EV OID",
 170     SEC_OID_UNKNOWN,
 171     { 0x62, 0xDD, 0x0B, 0xE9, 0xB9, 0xF5, 0x0A, 0x16, 0x3E, 0xA0, 0xF8,
 172       0xE7, 0x5C, 0x05, 0x3B, 0x1E, 0xCA, 0x57, 0xEA, 0x55, 0xC8, 0x68,
 173       0x8F, 0x64, 0x7C, 0x68, 0x81, 0xF2, 0xC8, 0x35, 0x7B, 0x95 },
 174     "MEUxCzAJBgNVBAYTAkNIMRUwEwYDVQQKEwxTd2lzc1NpZ24gQUcxHzAdBgNVBAMT"
 175     "FlN3aXNzU2lnbiBHb2xkIENBIC0gRzI=",
 176     "ALtAHEP1Xk+w",
 177     nullptr
 178   },
 179   {
 180     // CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL
 181     "1.3.6.1.4.1.23223.1.1.1",
 182     "StartCom EV OID",
 183     SEC_OID_UNKNOWN,
 184     { 0xC7, 0x66, 0xA9, 0xBE, 0xF2, 0xD4, 0x07, 0x1C, 0x86, 0x3A, 0x31,
 185       0xAA, 0x49, 0x20, 0xE8, 0x13, 0xB2, 0xD1, 0x98, 0x60, 0x8C, 0xB7,
 186       0xB7, 0xCF, 0xE2, 0x11, 0x43, 0xB8, 0x36, 0xDF, 0x09, 0xEA },
 187     "MH0xCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSswKQYDVQQL"
 188     "EyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMSkwJwYDVQQDEyBT"
 189     "dGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eQ==",
 190     "AQ==",
 191     nullptr
 192   },
 193   {
 194     // CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL
 195     "1.3.6.1.4.1.23223.1.1.1",
 196     "StartCom EV OID",
 197     SEC_OID_UNKNOWN,
 198     { 0xE1, 0x78, 0x90, 0xEE, 0x09, 0xA3, 0xFB, 0xF4, 0xF4, 0x8B, 0x9C,
 199       0x41, 0x4A, 0x17, 0xD6, 0x37, 0xB7, 0xA5, 0x06, 0x47, 0xE9, 0xBC,
 200       0x75, 0x23, 0x22, 0x72, 0x7F, 0xCC, 0x17, 0x42, 0xA9, 0x11 },
 201     "MH0xCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSswKQYDVQQL"
 202     "EyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMSkwJwYDVQQDEyBT"
 203     "dGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eQ==",
 204     "LQ==",
 205     nullptr
 206   },
 207   {
 208     // CN=StartCom Certification Authority G2,O=StartCom Ltd.,C=IL
 209     "1.3.6.1.4.1.23223.1.1.1",
 210     "StartCom EV OID",
 211     SEC_OID_UNKNOWN,
 212     { 0xC7, 0xBA, 0x65, 0x67, 0xDE, 0x93, 0xA7, 0x98, 0xAE, 0x1F, 0xAA,
 213       0x79, 0x1E, 0x71, 0x2D, 0x37, 0x8F, 0xAE, 0x1F, 0x93, 0xC4, 0x39,
 214       0x7F, 0xEA, 0x44, 0x1B, 0xB7, 0xCB, 0xE6, 0xFD, 0x59, 0x95 },
 215     "MFMxCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSwwKgYDVQQD"
 216     "EyNTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSBHMg==",
 217     "Ow==",
 218     nullptr
 219   },
 220   {
 221     // CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU="(c) 2006 VeriSign, Inc. - For authorized use only",OU=VeriSign Trust Network,O="VeriSign, Inc.",C=US
 222     "2.16.840.1.113733.1.7.23.6",
 223     "VeriSign EV OID",
 224     SEC_OID_UNKNOWN,
 225     { 0x9A, 0xCF, 0xAB, 0x7E, 0x43, 0xC8, 0xD8, 0x80, 0xD0, 0x6B, 0x26,
 226       0x2A, 0x94, 0xDE, 0xEE, 0xE4, 0xB4, 0x65, 0x99, 0x89, 0xC3, 0xD0,
 227       0xCA, 0xF1, 0x9B, 0xAF, 0x64, 0x05, 0xE4, 0x1A, 0xB7, 0xDF },
 228     "MIHKMQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNV"
 229     "BAsTFlZlcmlTaWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAyMDA2IFZl"
 230     "cmlTaWduLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMT"
 231     "PFZlcmlTaWduIENsYXNzIDMgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBB"
 232     "dXRob3JpdHkgLSBHNQ==",
 233     "GNrRniZ96LtKIVjNzGs7Sg==",
 234     nullptr
 235   },
 236   {
 237     // CN=GeoTrust Primary Certification Authority,O=GeoTrust Inc.,C=US
 238     "1.3.6.1.4.1.14370.1.6",
 239     "GeoTrust EV OID",
 240     SEC_OID_UNKNOWN,
 241     { 0x37, 0xD5, 0x10, 0x06, 0xC5, 0x12, 0xEA, 0xAB, 0x62, 0x64, 0x21,
 242       0xF1, 0xEC, 0x8C, 0x92, 0x01, 0x3F, 0xC5, 0xF8, 0x2A, 0xE9, 0x8E,
 243       0xE5, 0x33, 0xEB, 0x46, 0x19, 0xB8, 0xDE, 0xB4, 0xD0, 0x6C },
 244     "MFgxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMTEwLwYDVQQD"
 245     "EyhHZW9UcnVzdCBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5",
 246     "GKy1av1pthU6Y2yv2vrEoQ==",
 247     nullptr
 248   },
 249   {
 250     // CN=thawte Primary Root CA,OU="(c) 2006 thawte, Inc. - For authorized use only",OU=Certification Services Division,O="thawte, Inc.",C=US
 251     "2.16.840.1.113733.1.7.48.1",
 252     "Thawte EV OID",
 253     SEC_OID_UNKNOWN,
 254     { 0x8D, 0x72, 0x2F, 0x81, 0xA9, 0xC1, 0x13, 0xC0, 0x79, 0x1D, 0xF1,
 255       0x36, 0xA2, 0x96, 0x6D, 0xB2, 0x6C, 0x95, 0x0A, 0x97, 0x1D, 0xB4,
 256       0x6B, 0x41, 0x99, 0xF4, 0xEA, 0x54, 0xB7, 0x8B, 0xFB, 0x9F },
 257     "MIGpMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMdGhhd3RlLCBJbmMuMSgwJgYDVQQL"
 258     "Ex9DZXJ0aWZpY2F0aW9uIFNlcnZpY2VzIERpdmlzaW9uMTgwNgYDVQQLEy8oYykg"
 259     "MjAwNiB0aGF3dGUsIEluYy4gLSBGb3IgYXV0aG9yaXplZCB1c2Ugb25seTEfMB0G"
 260     "A1UEAxMWdGhhd3RlIFByaW1hcnkgUm9vdCBDQQ==",
 261     "NE7VVyDV7exJ9C/ON9srbQ==",
 262     nullptr
 263   },
 264   {
 265     // CN=XRamp Global Certification Authority,O=XRamp Security Services Inc,OU=www.xrampsecurity.com,C=US
 266     "2.16.840.1.114404.1.1.2.4.1",
 267     "Trustwave EV OID",
 268     SEC_OID_UNKNOWN,
 269     { 0xCE, 0xCD, 0xDC, 0x90, 0x50, 0x99, 0xD8, 0xDA, 0xDF, 0xC5, 0xB1,
 270       0xD2, 0x09, 0xB7, 0x37, 0xCB, 0xE2, 0xC1, 0x8C, 0xFB, 0x2C, 0x10,
 271       0xC0, 0xFF, 0x0B, 0xCF, 0x0D, 0x32, 0x86, 0xFC, 0x1A, 0xA2 },
 272     "MIGCMQswCQYDVQQGEwJVUzEeMBwGA1UECxMVd3d3LnhyYW1wc2VjdXJpdHkuY29t"
 273     "MSQwIgYDVQQKExtYUmFtcCBTZWN1cml0eSBTZXJ2aWNlcyBJbmMxLTArBgNVBAMT"
 274     "JFhSYW1wIEdsb2JhbCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eQ==",
 275     "UJRs7Bjq1ZxN1ZfvdY+grQ==",
 276     nullptr
 277   },
 278   {
 279     // CN=SecureTrust CA,O=SecureTrust Corporation,C=US
 280     "2.16.840.1.114404.1.1.2.4.1",
 281     "Trustwave EV OID",
 282     SEC_OID_UNKNOWN,
 283     { 0xF1, 0xC1, 0xB5, 0x0A, 0xE5, 0xA2, 0x0D, 0xD8, 0x03, 0x0E, 0xC9,
 284       0xF6, 0xBC, 0x24, 0x82, 0x3D, 0xD3, 0x67, 0xB5, 0x25, 0x57, 0x59,
 285       0xB4, 0xE7, 0x1B, 0x61, 0xFC, 0xE9, 0xF7, 0x37, 0x5D, 0x73 },
 286     "MEgxCzAJBgNVBAYTAlVTMSAwHgYDVQQKExdTZWN1cmVUcnVzdCBDb3Jwb3JhdGlv"
 287     "bjEXMBUGA1UEAxMOU2VjdXJlVHJ1c3QgQ0E=",
 288     "DPCOXAgWpa1Cf/DrJxhZ0A==",
 289     nullptr
 290   },
 291   {
 292     // CN=Secure Global CA,O=SecureTrust Corporation,C=US
 293     "2.16.840.1.114404.1.1.2.4.1",
 294     "Trustwave EV OID",
 295     SEC_OID_UNKNOWN,
 296     { 0x42, 0x00, 0xF5, 0x04, 0x3A, 0xC8, 0x59, 0x0E, 0xBB, 0x52, 0x7D,
 297       0x20, 0x9E, 0xD1, 0x50, 0x30, 0x29, 0xFB, 0xCB, 0xD4, 0x1C, 0xA1,
 298       0xB5, 0x06, 0xEC, 0x27, 0xF1, 0x5A, 0xDE, 0x7D, 0xAC, 0x69 },
 299     "MEoxCzAJBgNVBAYTAlVTMSAwHgYDVQQKExdTZWN1cmVUcnVzdCBDb3Jwb3JhdGlv"
 300     "bjEZMBcGA1UEAxMQU2VjdXJlIEdsb2JhbCBDQQ==",
 301     "B1YipOjUiolN9BPI8PjqpQ==",
 302     nullptr
 303   },
 304   {
 305     // CN=COMODO ECC Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
 306     "1.3.6.1.4.1.6449.1.2.1.5.1",
 307     "Comodo EV OID",
 308     SEC_OID_UNKNOWN,
 309     { 0x17, 0x93, 0x92, 0x7A, 0x06, 0x14, 0x54, 0x97, 0x89, 0xAD, 0xCE,
 310       0x2F, 0x8F, 0x34, 0xF7, 0xF0, 0xB6, 0x6D, 0x0F, 0x3A, 0xE3, 0xA3,
 311       0xB8, 0x4D, 0x21, 0xEC, 0x15, 0xDB, 0xBA, 0x4F, 0xAD, 0xC7 },
 312     "MIGFMQswCQYDVQQGEwJHQjEbMBkGA1UECBMSR3JlYXRlciBNYW5jaGVzdGVyMRAw"
 313     "DgYDVQQHEwdTYWxmb3JkMRowGAYDVQQKExFDT01PRE8gQ0EgTGltaXRlZDErMCkG"
 314     "A1UEAxMiQ09NT0RPIEVDQyBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eQ==",
 315     "H0evqmIAcFBUTAGem2OZKg==",
 316     nullptr
 317   },
 318   {
 319     // CN=COMODO Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
 320     "1.3.6.1.4.1.6449.1.2.1.5.1",
 321     "Comodo EV OID",
 322     SEC_OID_UNKNOWN,
 323     { 0x0C, 0x2C, 0xD6, 0x3D, 0xF7, 0x80, 0x6F, 0xA3, 0x99, 0xED, 0xE8,
 324       0x09, 0x11, 0x6B, 0x57, 0x5B, 0xF8, 0x79, 0x89, 0xF0, 0x65, 0x18,
 325       0xF9, 0x80, 0x8C, 0x86, 0x05, 0x03, 0x17, 0x8B, 0xAF, 0x66 },
 326     "MIGBMQswCQYDVQQGEwJHQjEbMBkGA1UECBMSR3JlYXRlciBNYW5jaGVzdGVyMRAw"
 327     "DgYDVQQHEwdTYWxmb3JkMRowGAYDVQQKExFDT01PRE8gQ0EgTGltaXRlZDEnMCUG"
 328     "A1UEAxMeQ09NT0RPIENlcnRpZmljYXRpb24gQXV0aG9yaXR5",
 329     "ToEtioJl4AsC7j41AkblPQ==",
 330     nullptr
 331   },
 332   {
 333     // CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE
 334     "1.3.6.1.4.1.6449.1.2.1.5.1",
 335     "Comodo EV OID",
 336     SEC_OID_UNKNOWN,
 337     { 0x68, 0x7F, 0xA4, 0x51, 0x38, 0x22, 0x78, 0xFF, 0xF0, 0xC8, 0xB1,
 338       0x1F, 0x8D, 0x43, 0xD5, 0x76, 0x67, 0x1C, 0x6E, 0xB2, 0xBC, 0xEA,
 339       0xB4, 0x13, 0xFB, 0x83, 0xD9, 0x65, 0xD0, 0x6D, 0x2F, 0xF2 },
 340     "MG8xCzAJBgNVBAYTAlNFMRQwEgYDVQQKEwtBZGRUcnVzdCBBQjEmMCQGA1UECxMd"
 341     "QWRkVHJ1c3QgRXh0ZXJuYWwgVFRQIE5ldHdvcmsxIjAgBgNVBAMTGUFkZFRydXN0"
 342     "IEV4dGVybmFsIENBIFJvb3Q=",
 343     "AQ==",
 344     nullptr
 345   },
 346   {
 347     // CN=UTN - DATACorp SGC,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
 348     "1.3.6.1.4.1.6449.1.2.1.5.1",
 349     "Comodo EV OID",
 350     SEC_OID_UNKNOWN,
 351     { 0x85, 0xFB, 0x2F, 0x91, 0xDD, 0x12, 0x27, 0x5A, 0x01, 0x45, 0xB6,
 352       0x36, 0x53, 0x4F, 0x84, 0x02, 0x4A, 0xD6, 0x8B, 0x69, 0xB8, 0xEE,
 353       0x88, 0x68, 0x4F, 0xF7, 0x11, 0x37, 0x58, 0x05, 0xB3, 0x48 },
 354     "MIGTMQswCQYDVQQGEwJVUzELMAkGA1UECBMCVVQxFzAVBgNVBAcTDlNhbHQgTGFr"
 355     "ZSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxITAfBgNVBAsT"
 356     "GGh0dHA6Ly93d3cudXNlcnRydXN0LmNvbTEbMBkGA1UEAxMSVVROIC0gREFUQUNv"
 357     "cnAgU0dD",
 358     "RL4Mi1AAIbQR0ypoBqmtaQ==",
 359     nullptr
 360   },
 361   {
 362     // CN=UTN-USERFirst-Hardware,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
 363     "1.3.6.1.4.1.6449.1.2.1.5.1",
 364     "Comodo EV OID",
 365     SEC_OID_UNKNOWN,
 366     { 0x6E, 0xA5, 0x47, 0x41, 0xD0, 0x04, 0x66, 0x7E, 0xED, 0x1B, 0x48,
 367       0x16, 0x63, 0x4A, 0xA3, 0xA7, 0x9E, 0x6E, 0x4B, 0x96, 0x95, 0x0F,
 368       0x82, 0x79, 0xDA, 0xFC, 0x8D, 0x9B, 0xD8, 0x81, 0x21, 0x37 },
 369     "MIGXMQswCQYDVQQGEwJVUzELMAkGA1UECBMCVVQxFzAVBgNVBAcTDlNhbHQgTGFr"
 370     "ZSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxITAfBgNVBAsT"
 371     "GGh0dHA6Ly93d3cudXNlcnRydXN0LmNvbTEfMB0GA1UEAxMWVVROLVVTRVJGaXJz"
 372     "dC1IYXJkd2FyZQ==",
 373     "RL4Mi1AAJLQR0zYq/mUK/Q==",
 374     nullptr
 375   },
 376   {
 377     // OU=Go Daddy Class 2 Certification Authority,O=\"The Go Daddy Group, Inc.\",C=US
 378     "2.16.840.1.114413.1.7.23.3",
 379     "Go Daddy EV OID a",
 380     SEC_OID_UNKNOWN,
 381     { 0xC3, 0x84, 0x6B, 0xF2, 0x4B, 0x9E, 0x93, 0xCA, 0x64, 0x27, 0x4C,
 382       0x0E, 0xC6, 0x7C, 0x1E, 0xCC, 0x5E, 0x02, 0x4F, 0xFC, 0xAC, 0xD2,
 383       0xD7, 0x40, 0x19, 0x35, 0x0E, 0x81, 0xFE, 0x54, 0x6A, 0xE4 },
 384     "MGMxCzAJBgNVBAYTAlVTMSEwHwYDVQQKExhUaGUgR28gRGFkZHkgR3JvdXAsIElu"
 385     "Yy4xMTAvBgNVBAsTKEdvIERhZGR5IENsYXNzIDIgQ2VydGlmaWNhdGlvbiBBdXRo"
 386     "b3JpdHk=",
 387     "AA==",
 388     nullptr
 389   },
 390   {
 391     // CN=Go Daddy Root Certificate Authority - G2,O="GoDaddy.com, Inc.",L=Scottsdale,ST=Arizona,C=US
 392     "2.16.840.1.114413.1.7.23.3",
 393     "Go Daddy EV OID a",
 394     SEC_OID_UNKNOWN,
 395     { 0x45, 0x14, 0x0B, 0x32, 0x47, 0xEB, 0x9C, 0xC8, 0xC5, 0xB4, 0xF0,
 396       0xD7, 0xB5, 0x30, 0x91, 0xF7, 0x32, 0x92, 0x08, 0x9E, 0x6E, 0x5A,
 397       0x63, 0xE2, 0x74, 0x9D, 0xD3, 0xAC, 0xA9, 0x19, 0x8E, 0xDA },
 398     "MIGDMQswCQYDVQQGEwJVUzEQMA4GA1UECBMHQXJpem9uYTETMBEGA1UEBxMKU2Nv"
 399     "dHRzZGFsZTEaMBgGA1UEChMRR29EYWRkeS5jb20sIEluYy4xMTAvBgNVBAMTKEdv"
 400     "IERhZGR5IFJvb3QgQ2VydGlmaWNhdGUgQXV0aG9yaXR5IC0gRzI=",
 401     "AA==",
 402     nullptr
 403   },
 404   {
 405     // OU=Starfield Class 2 Certification Authority,O=\"Starfield Technologies, Inc.\",C=US
 406     "2.16.840.1.114414.1.7.23.3",
 407     "Go Daddy EV OID b",
 408     SEC_OID_UNKNOWN,
 409     { 0x14, 0x65, 0xFA, 0x20, 0x53, 0x97, 0xB8, 0x76, 0xFA, 0xA6, 0xF0,
 410       0xA9, 0x95, 0x8E, 0x55, 0x90, 0xE4, 0x0F, 0xCC, 0x7F, 0xAA, 0x4F,
 411       0xB7, 0xC2, 0xC8, 0x67, 0x75, 0x21, 0xFB, 0x5F, 0xB6, 0x58 },
 412     "MGgxCzAJBgNVBAYTAlVTMSUwIwYDVQQKExxTdGFyZmllbGQgVGVjaG5vbG9naWVz"
 413     "LCBJbmMuMTIwMAYDVQQLEylTdGFyZmllbGQgQ2xhc3MgMiBDZXJ0aWZpY2F0aW9u"
 414     "IEF1dGhvcml0eQ==",
 415     "AA==",
 416     nullptr
 417   },
 418   {
 419     // CN=Starfield Root Certificate Authority - G2,O="Starfield Technologies, Inc.",L=Scottsdale,ST=Arizona,C=US
 420     "2.16.840.1.114414.1.7.23.3",
 421     "Go Daddy EV OID b",
 422     SEC_OID_UNKNOWN,
 423     { 0x2C, 0xE1, 0xCB, 0x0B, 0xF9, 0xD2, 0xF9, 0xE1, 0x02, 0x99, 0x3F,
 424       0xBE, 0x21, 0x51, 0x52, 0xC3, 0xB2, 0xDD, 0x0C, 0xAB, 0xDE, 0x1C,
 425       0x68, 0xE5, 0x31, 0x9B, 0x83, 0x91, 0x54, 0xDB, 0xB7, 0xF5 },
 426     "MIGPMQswCQYDVQQGEwJVUzEQMA4GA1UECBMHQXJpem9uYTETMBEGA1UEBxMKU2Nv"
 427     "dHRzZGFsZTElMCMGA1UEChMcU3RhcmZpZWxkIFRlY2hub2xvZ2llcywgSW5jLjEy"
 428     "MDAGA1UEAxMpU3RhcmZpZWxkIFJvb3QgQ2VydGlmaWNhdGUgQXV0aG9yaXR5IC0g"
 429     "RzI=",
 430     "AA==",
 431     nullptr
 432   },
 433   {
 434     // CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
 435     "2.16.840.1.114412.2.1",
 436     "DigiCert EV OID",
 437     SEC_OID_UNKNOWN,
 438     { 0x74, 0x31, 0xE5, 0xF4, 0xC3, 0xC1, 0xCE, 0x46, 0x90, 0x77, 0x4F,
 439       0x0B, 0x61, 0xE0, 0x54, 0x40, 0x88, 0x3B, 0xA9, 0xA0, 0x1E, 0xD0,
 440       0x0B, 0xA6, 0xAB, 0xD7, 0x80, 0x6E, 0xD3, 0xB1, 0x18, 0xCF },
 441     "MGwxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsT"
 442     "EHd3dy5kaWdpY2VydC5jb20xKzApBgNVBAMTIkRpZ2lDZXJ0IEhpZ2ggQXNzdXJh"
 443     "bmNlIEVWIFJvb3QgQ0E=",
 444     "AqxcJmoLQJuPC3nyrkYldw==",
 445     nullptr
 446   },
 447   {
 448     // CN=QuoVadis Root CA 2,O=QuoVadis Limited,C=BM
 449     "1.3.6.1.4.1.8024.0.2.100.1.2",
 450     "Quo Vadis EV OID",
 451     SEC_OID_UNKNOWN,
 452     { 0x85, 0xA0, 0xDD, 0x7D, 0xD7, 0x20, 0xAD, 0xB7, 0xFF, 0x05, 0xF8,
 453       0x3D, 0x54, 0x2B, 0x20, 0x9D, 0xC7, 0xFF, 0x45, 0x28, 0xF7, 0xD6,
 454       0x77, 0xB1, 0x83, 0x89, 0xFE, 0xA5, 0xE5, 0xC4, 0x9E, 0x86 },
 455     "MEUxCzAJBgNVBAYTAkJNMRkwFwYDVQQKExBRdW9WYWRpcyBMaW1pdGVkMRswGQYD"
 456     "VQQDExJRdW9WYWRpcyBSb290IENBIDI=",
 457     "BQk=",
 458     nullptr
 459   },
 460   {
 461     // CN=Network Solutions Certificate Authority,O=Network Solutions L.L.C.,C=US
 462     "1.3.6.1.4.1.782.1.2.1.8.1",
 463     "Network Solutions EV OID",
 464     SEC_OID_UNKNOWN,
 465     { 0x15, 0xF0, 0xBA, 0x00, 0xA3, 0xAC, 0x7A, 0xF3, 0xAC, 0x88, 0x4C,
 466       0x07, 0x2B, 0x10, 0x11, 0xA0, 0x77, 0xBD, 0x77, 0xC0, 0x97, 0xF4,
 467       0x01, 0x64, 0xB2, 0xF8, 0x59, 0x8A, 0xBD, 0x83, 0x86, 0x0C },
 468     "MGIxCzAJBgNVBAYTAlVTMSEwHwYDVQQKExhOZXR3b3JrIFNvbHV0aW9ucyBMLkwu"
 469     "Qy4xMDAuBgNVBAMTJ05ldHdvcmsgU29sdXRpb25zIENlcnRpZmljYXRlIEF1dGhv"
 470     "cml0eQ==",
 471     "V8szb8JcFuZHFhfjkDFo4A==",
 472     nullptr
 473   },
 474   {
 475     // CN=Entrust Root Certification Authority,OU="(c) 2006 Entrust, Inc.",OU=www.entrust.net/CPS is incorporated by reference,O="Entrust, Inc.",C=US
 476     "2.16.840.1.114028.10.1.2",
 477     "Entrust EV OID",
 478     SEC_OID_UNKNOWN,
 479     { 0x73, 0xC1, 0x76, 0x43, 0x4F, 0x1B, 0xC6, 0xD5, 0xAD, 0xF4, 0x5B,
 480       0x0E, 0x76, 0xE7, 0x27, 0x28, 0x7C, 0x8D, 0xE5, 0x76, 0x16, 0xC1,
 481       0xE6, 0xE6, 0x14, 0x1A, 0x2B, 0x2C, 0xBC, 0x7D, 0x8E, 0x4C },
 482     "MIGwMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNRW50cnVzdCwgSW5jLjE5MDcGA1UE"
 483     "CxMwd3d3LmVudHJ1c3QubmV0L0NQUyBpcyBpbmNvcnBvcmF0ZWQgYnkgcmVmZXJl"
 484     "bmNlMR8wHQYDVQQLExYoYykgMjAwNiBFbnRydXN0LCBJbmMuMS0wKwYDVQQDEyRF"
 485     "bnRydXN0IFJvb3QgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHk=",
 486     "RWtQVA==",
 487     nullptr
 488   },
 489   {
 490     // CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
 491     "1.3.6.1.4.1.4146.1.1",
 492     "GlobalSign EV OID",
 493     SEC_OID_UNKNOWN,
 494     { 0xEB, 0xD4, 0x10, 0x40, 0xE4, 0xBB, 0x3E, 0xC7, 0x42, 0xC9, 0xE3,
 495       0x81, 0xD3, 0x1E, 0xF2, 0xA4, 0x1A, 0x48, 0xB6, 0x68, 0x5C, 0x96,
 496       0xE7, 0xCE, 0xF3, 0xC1, 0xDF, 0x6C, 0xD4, 0x33, 0x1C, 0x99 },
 497     "MFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMRAwDgYD"
 498     "VQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxTaWduIFJvb3QgQ0E=",
 499     "BAAAAAABFUtaw5Q=",
 500     nullptr
 501   },
 502   {
 503     // CN=GlobalSign,O=GlobalSign,OU=GlobalSign Root CA - R2
 504     "1.3.6.1.4.1.4146.1.1",
 505     "GlobalSign EV OID",
 506     SEC_OID_UNKNOWN,
 507     { 0xCA, 0x42, 0xDD, 0x41, 0x74, 0x5F, 0xD0, 0xB8, 0x1E, 0xB9, 0x02,
 508       0x36, 0x2C, 0xF9, 0xD8, 0xBF, 0x71, 0x9D, 0xA1, 0xBD, 0x1B, 0x1E,
 509       0xFC, 0x94, 0x6F, 0x5B, 0x4C, 0x99, 0xF4, 0x2C, 0x1B, 0x9E },
 510     "MEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAtIFIyMRMwEQYDVQQKEwpH"
 511     "bG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWdu",
 512     "BAAAAAABD4Ym5g0=",
 513     nullptr
 514   },
 515   {
 516     // CN=GlobalSign,O=GlobalSign,OU=GlobalSign Root CA - R3
 517     "1.3.6.1.4.1.4146.1.1",
 518     "GlobalSign EV OID",
 519     SEC_OID_UNKNOWN,
 520     { 0xCB, 0xB5, 0x22, 0xD7, 0xB7, 0xF1, 0x27, 0xAD, 0x6A, 0x01, 0x13,
 521       0x86, 0x5B, 0xDF, 0x1C, 0xD4, 0x10, 0x2E, 0x7D, 0x07, 0x59, 0xAF,
 522       0x63, 0x5A, 0x7C, 0xF4, 0x72, 0x0D, 0xC9, 0x63, 0xC5, 0x3B },
 523     "MEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAtIFIzMRMwEQYDVQQKEwpH"
 524     "bG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWdu",
 525     "BAAAAAABIVhTCKI=",
 526     nullptr
 527   },
 528   {
 529     // CN=Buypass Class 3 CA 1,O=Buypass AS-983163327,C=NO
 530     "2.16.578.1.26.1.3.3",
 531     "Buypass EV OID",
 532     SEC_OID_UNKNOWN,
 533     { 0xB7, 0xB1, 0x2B, 0x17, 0x1F, 0x82, 0x1D, 0xAA, 0x99, 0x0C, 0xD0,
 534       0xFE, 0x50, 0x87, 0xB1, 0x28, 0x44, 0x8B, 0xA8, 0xE5, 0x18, 0x4F,
 535       0x84, 0xC5, 0x1E, 0x02, 0xB5, 0xC8, 0xFB, 0x96, 0x2B, 0x24 },
 536     "MEsxCzAJBgNVBAYTAk5PMR0wGwYDVQQKDBRCdXlwYXNzIEFTLTk4MzE2MzMyNzEd"
 537     "MBsGA1UEAwwUQnV5cGFzcyBDbGFzcyAzIENBIDE=",
 538     "Ag==",
 539     nullptr
 540   },
 541   {
 542     // CN=Buypass Class 3 Root CA,O=Buypass AS-983163327,C=NO
 543     "2.16.578.1.26.1.3.3",
 544     "Buypass EV OID",
 545     SEC_OID_UNKNOWN,
 546     { 0xED, 0xF7, 0xEB, 0xBC, 0xA2, 0x7A, 0x2A, 0x38, 0x4D, 0x38, 0x7B,
 547       0x7D, 0x40, 0x10, 0xC6, 0x66, 0xE2, 0xED, 0xB4, 0x84, 0x3E, 0x4C,
 548       0x29, 0xB4, 0xAE, 0x1D, 0x5B, 0x93, 0x32, 0xE6, 0xB2, 0x4D },
 549     "ME4xCzAJBgNVBAYTAk5PMR0wGwYDVQQKDBRCdXlwYXNzIEFTLTk4MzE2MzMyNzEg"
 550     "MB4GA1UEAwwXQnV5cGFzcyBDbGFzcyAzIFJvb3QgQ0E=",
 551     "Ag==",
 552     nullptr
 553   },
 554   {
 555     // CN=Class 2 Primary CA,O=Certplus,C=FR
 556     "1.3.6.1.4.1.22234.2.5.2.3.1",
 557     "Certplus EV OID",
 558     SEC_OID_UNKNOWN,
 559     { 0x0F, 0x99, 0x3C, 0x8A, 0xEF, 0x97, 0xBA, 0xAF, 0x56, 0x87, 0x14,
 560       0x0E, 0xD5, 0x9A, 0xD1, 0x82, 0x1B, 0xB4, 0xAF, 0xAC, 0xF0, 0xAA,
 561       0x9A, 0x58, 0xB5, 0xD5, 0x7A, 0x33, 0x8A, 0x3A, 0xFB, 0xCB },
 562     "MD0xCzAJBgNVBAYTAkZSMREwDwYDVQQKEwhDZXJ0cGx1czEbMBkGA1UEAxMSQ2xh"
 563     "c3MgMiBQcmltYXJ5IENB",
 564     "AIW9S/PY2uNp9pTXX8OlRCM=",
 565     nullptr
 566   },
 567   {
 568     // CN=Chambers of Commerce Root - 2008,O=AC Camerfirma S.A.,serialNumber=A82743287,L=Madrid (see current address at www.camerfirma.com/address),C=EU
 569     "1.3.6.1.4.1.17326.10.14.2.1.2",
 570     "Camerfirma EV OID a",
 571     SEC_OID_UNKNOWN,
 572     { 0x06, 0x3E, 0x4A, 0xFA, 0xC4, 0x91, 0xDF, 0xD3, 0x32, 0xF3, 0x08,
 573       0x9B, 0x85, 0x42, 0xE9, 0x46, 0x17, 0xD8, 0x93, 0xD7, 0xFE, 0x94,
 574       0x4E, 0x10, 0xA7, 0x93, 0x7E, 0xE2, 0x9D, 0x96, 0x93, 0xC0 },
 575     "MIGuMQswCQYDVQQGEwJFVTFDMEEGA1UEBxM6TWFkcmlkIChzZWUgY3VycmVudCBh"
 576     "ZGRyZXNzIGF0IHd3dy5jYW1lcmZpcm1hLmNvbS9hZGRyZXNzKTESMBAGA1UEBRMJ"
 577     "QTgyNzQzMjg3MRswGQYDVQQKExJBQyBDYW1lcmZpcm1hIFMuQS4xKTAnBgNVBAMT"
 578     "IENoYW1iZXJzIG9mIENvbW1lcmNlIFJvb3QgLSAyMDA4",
 579     "AKPaQn6ksa7a",
 580     nullptr
 581   },
 582   {
 583     // CN=Global Chambersign Root - 2008,O=AC Camerfirma S.A.,serialNumber=A82743287,L=Madrid (see current address at www.camerfirma.com/address),C=EU
 584     "1.3.6.1.4.1.17326.10.8.12.1.2",
 585     "Camerfirma EV OID b",
 586     SEC_OID_UNKNOWN,
 587     { 0x13, 0x63, 0x35, 0x43, 0x93, 0x34, 0xA7, 0x69, 0x80, 0x16, 0xA0,
 588       0xD3, 0x24, 0xDE, 0x72, 0x28, 0x4E, 0x07, 0x9D, 0x7B, 0x52, 0x20,
 589       0xBB, 0x8F, 0xBD, 0x74, 0x78, 0x16, 0xEE, 0xBE, 0xBA, 0xCA },
 590     "MIGsMQswCQYDVQQGEwJFVTFDMEEGA1UEBxM6TWFkcmlkIChzZWUgY3VycmVudCBh"
 591     "ZGRyZXNzIGF0IHd3dy5jYW1lcmZpcm1hLmNvbS9hZGRyZXNzKTESMBAGA1UEBRMJ"
 592     "QTgyNzQzMjg3MRswGQYDVQQKExJBQyBDYW1lcmZpcm1hIFMuQS4xJzAlBgNVBAMT"
 593     "Hkdsb2JhbCBDaGFtYmVyc2lnbiBSb290IC0gMjAwOA==",
 594     "AMnN0+nVfSPO",
 595     nullptr
 596   },
 597   {
 598     // CN=TC TrustCenter Universal CA III,OU=TC TrustCenter Universal CA,O=TC TrustCenter GmbH,C=DE
 599     "1.2.276.0.44.1.1.1.4",
 600     "TC TrustCenter EV OID",
 601     SEC_OID_UNKNOWN,
 602     { 0x30, 0x9B, 0x4A, 0x87, 0xF6, 0xCA, 0x56, 0xC9, 0x31, 0x69, 0xAA,
 603       0xA9, 0x9C, 0x6D, 0x98, 0x88, 0x54, 0xD7, 0x89, 0x2B, 0xD5, 0x43,
 604       0x7E, 0x2D, 0x07, 0xB2, 0x9C, 0xBE, 0xDA, 0x55, 0xD3, 0x5D },
 605     "MHsxCzAJBgNVBAYTAkRFMRwwGgYDVQQKExNUQyBUcnVzdENlbnRlciBHbWJIMSQw"
 606     "IgYDVQQLExtUQyBUcnVzdENlbnRlciBVbml2ZXJzYWwgQ0ExKDAmBgNVBAMTH1RD"
 607     "IFRydXN0Q2VudGVyIFVuaXZlcnNhbCBDQSBJSUk=",
 608     "YyUAAQACFI0zFQLkbPQ=",
 609     nullptr
 610   },
 611   {
 612     // CN=AffirmTrust Commercial,O=AffirmTrust,C=US
 613     "1.3.6.1.4.1.34697.2.1",
 614     "AffirmTrust EV OID a",
 615     SEC_OID_UNKNOWN,
 616     { 0x03, 0x76, 0xAB, 0x1D, 0x54, 0xC5, 0xF9, 0x80, 0x3C, 0xE4, 0xB2,
 617       0xE2, 0x01, 0xA0, 0xEE, 0x7E, 0xEF, 0x7B, 0x57, 0xB6, 0x36, 0xE8,
 618       0xA9, 0x3C, 0x9B, 0x8D, 0x48, 0x60, 0xC9, 0x6F, 0x5F, 0xA7 },
 619     "MEQxCzAJBgNVBAYTAlVTMRQwEgYDVQQKDAtBZmZpcm1UcnVzdDEfMB0GA1UEAwwW"
 620     "QWZmaXJtVHJ1c3QgQ29tbWVyY2lhbA==",
 621     "d3cGJyapsXw=",
 622     nullptr
 623   },
 624   {
 625     // CN=AffirmTrust Networking,O=AffirmTrust,C=US
 626     "1.3.6.1.4.1.34697.2.2",
 627     "AffirmTrust EV OID b",
 628     SEC_OID_UNKNOWN,
 629     { 0x0A, 0x81, 0xEC, 0x5A, 0x92, 0x97, 0x77, 0xF1, 0x45, 0x90, 0x4A,
 630       0xF3, 0x8D, 0x5D, 0x50, 0x9F, 0x66, 0xB5, 0xE2, 0xC5, 0x8F, 0xCD,
 631       0xB5, 0x31, 0x05, 0x8B, 0x0E, 0x17, 0xF3, 0xF0, 0xB4, 0x1B },
 632     "MEQxCzAJBgNVBAYTAlVTMRQwEgYDVQQKDAtBZmZpcm1UcnVzdDEfMB0GA1UEAwwW"
 633     "QWZmaXJtVHJ1c3QgTmV0d29ya2luZw==",
 634     "fE8EORzUmS0=",
 635     nullptr
 636   },
 637   {
 638     // CN=AffirmTrust Premium,O=AffirmTrust,C=US
 639     "1.3.6.1.4.1.34697.2.3",
 640     "AffirmTrust EV OID c",
 641     SEC_OID_UNKNOWN,
 642     { 0x70, 0xA7, 0x3F, 0x7F, 0x37, 0x6B, 0x60, 0x07, 0x42, 0x48, 0x90,
 643       0x45, 0x34, 0xB1, 0x14, 0x82, 0xD5, 0xBF, 0x0E, 0x69, 0x8E, 0xCC,
 644       0x49, 0x8D, 0xF5, 0x25, 0x77, 0xEB, 0xF2, 0xE9, 0x3B, 0x9A },
 645     "MEExCzAJBgNVBAYTAlVTMRQwEgYDVQQKDAtBZmZpcm1UcnVzdDEcMBoGA1UEAwwT"
 646     "QWZmaXJtVHJ1c3QgUHJlbWl1bQ==",
 647     "bYwURrGmCu4=",
 648     nullptr
 649   },
 650   {
 651     // CN=AffirmTrust Premium ECC,O=AffirmTrust,C=US
 652     "1.3.6.1.4.1.34697.2.4",
 653     "AffirmTrust EV OID d",
 654     SEC_OID_UNKNOWN,
 655     { 0xBD, 0x71, 0xFD, 0xF6, 0xDA, 0x97, 0xE4, 0xCF, 0x62, 0xD1, 0x64,
 656       0x7A, 0xDD, 0x25, 0x81, 0xB0, 0x7D, 0x79, 0xAD, 0xF8, 0x39, 0x7E,
 657       0xB4, 0xEC, 0xBA, 0x9C, 0x5E, 0x84, 0x88, 0x82, 0x14, 0x23 },
 658     "MEUxCzAJBgNVBAYTAlVTMRQwEgYDVQQKDAtBZmZpcm1UcnVzdDEgMB4GA1UEAwwX"
 659     "QWZmaXJtVHJ1c3QgUHJlbWl1bSBFQ0M=",
 660     "dJclisc/elQ=",
 661     nullptr
 662   },
 663   {
 664     // CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
 665     "1.2.616.1.113527.2.5.1.1",
 666     "Certum EV OID",
 667     SEC_OID_UNKNOWN,
 668     { 0x5C, 0x58, 0x46, 0x8D, 0x55, 0xF5, 0x8E, 0x49, 0x7E, 0x74, 0x39,
 669       0x82, 0xD2, 0xB5, 0x00, 0x10, 0xB6, 0xD1, 0x65, 0x37, 0x4A, 0xCF,
 670       0x83, 0xA7, 0xD4, 0xA3, 0x2D, 0xB7, 0x68, 0xC4, 0x40, 0x8E },
 671     "MH4xCzAJBgNVBAYTAlBMMSIwIAYDVQQKExlVbml6ZXRvIFRlY2hub2xvZ2llcyBT"
 672     "LkEuMScwJQYDVQQLEx5DZXJ0dW0gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxIjAg"
 673     "BgNVBAMTGUNlcnR1bSBUcnVzdGVkIE5ldHdvcmsgQ0E=",
 674     "BETA",
 675     nullptr
 676   },
 677   {
 678     // CN=Izenpe.com,O=IZENPE S.A.,C=ES
 679     "1.3.6.1.4.1.14777.6.1.1",
 680     "Izenpe EV OID 1",
 681     SEC_OID_UNKNOWN,
 682     { 0x25, 0x30, 0xCC, 0x8E, 0x98, 0x32, 0x15, 0x02, 0xBA, 0xD9, 0x6F,
 683       0x9B, 0x1F, 0xBA, 0x1B, 0x09, 0x9E, 0x2D, 0x29, 0x9E, 0x0F, 0x45,
 684       0x48, 0xBB, 0x91, 0x4F, 0x36, 0x3B, 0xC0, 0xD4, 0x53, 0x1F },
 685     "MDgxCzAJBgNVBAYTAkVTMRQwEgYDVQQKDAtJWkVOUEUgUy5BLjETMBEGA1UEAwwK"
 686     "SXplbnBlLmNvbQ==",
 687     "ALC3WhZIX7/hy/WL1xnmfQ==",
 688     nullptr
 689   },
 690   {
 691     // CN=Izenpe.com,O=IZENPE S.A.,C=ES
 692     "1.3.6.1.4.1.14777.6.1.2",
 693     "Izenpe EV OID 2",
 694     SEC_OID_UNKNOWN,
 695     { 0x25, 0x30, 0xCC, 0x8E, 0x98, 0x32, 0x15, 0x02, 0xBA, 0xD9, 0x6F,
 696       0x9B, 0x1F, 0xBA, 0x1B, 0x09, 0x9E, 0x2D, 0x29, 0x9E, 0x0F, 0x45,
 697       0x48, 0xBB, 0x91, 0x4F, 0x36, 0x3B, 0xC0, 0xD4, 0x53, 0x1F },
 698     "MDgxCzAJBgNVBAYTAkVTMRQwEgYDVQQKDAtJWkVOUEUgUy5BLjETMBEGA1UEAwwK"
 699     "SXplbnBlLmNvbQ==",
 700     "ALC3WhZIX7/hy/WL1xnmfQ==",
 701     nullptr
 702   },
 703   {
 704     // CN=A-Trust-nQual-03,OU=A-Trust-nQual-03,O=A-Trust Ges. f. Sicherheitssysteme im elektr. Datenverkehr GmbH,C=AT
 705     "1.2.40.0.17.1.22",
 706     "A-Trust EV OID",
 707     SEC_OID_UNKNOWN,
 708     { 0x79, 0x3C, 0xBF, 0x45, 0x59, 0xB9, 0xFD, 0xE3, 0x8A, 0xB2, 0x2D,
 709       0xF1, 0x68, 0x69, 0xF6, 0x98, 0x81, 0xAE, 0x14, 0xC4, 0xB0, 0x13,
 710       0x9A, 0xC7, 0x88, 0xA7, 0x8A, 0x1A, 0xFC, 0xCA, 0x02, 0xFB },
 711     "MIGNMQswCQYDVQQGEwJBVDFIMEYGA1UECgw/QS1UcnVzdCBHZXMuIGYuIFNpY2hl"
 712     "cmhlaXRzc3lzdGVtZSBpbSBlbGVrdHIuIERhdGVudmVya2VociBHbWJIMRkwFwYD"
 713     "VQQLDBBBLVRydXN0LW5RdWFsLTAzMRkwFwYDVQQDDBBBLVRydXN0LW5RdWFsLTAz",
 714     "AWwe",
 715     nullptr
 716   },
 717   {
 718     // CN=T-TeleSec GlobalRoot Class 3,OU=T-Systems Trust Center,O=T-Systems Enterprise Services GmbH,C=DE
 719     "1.3.6.1.4.1.7879.13.24.1",
 720     "T-Systems EV OID",
 721     SEC_OID_UNKNOWN,
 722     { 0xFD, 0x73, 0xDA, 0xD3, 0x1C, 0x64, 0x4F, 0xF1, 0xB4, 0x3B, 0xEF,
 723       0x0C, 0xCD, 0xDA, 0x96, 0x71, 0x0B, 0x9C, 0xD9, 0x87, 0x5E, 0xCA,
 724       0x7E, 0x31, 0x70, 0x7A, 0xF3, 0xE9, 0x6D, 0x52, 0x2B, 0xBD },
 725     "MIGCMQswCQYDVQQGEwJERTErMCkGA1UECgwiVC1TeXN0ZW1zIEVudGVycHJpc2Ug"
 726     "U2VydmljZXMgR21iSDEfMB0GA1UECwwWVC1TeXN0ZW1zIFRydXN0IENlbnRlcjEl"
 727     "MCMGA1UEAwwcVC1UZWxlU2VjIEdsb2JhbFJvb3QgQ2xhc3MgMw==",
 728     "AQ==",
 729     nullptr
 730   },
 731   {
 732     // CN=TURKTRUST Elektronik Sertifika Hizmet Saglayicisi,O=TURKTRUST Bilgi Illetisim ve Bilisim Guvenligi Hizmetleri A.S.,C=TR
 733     "2.16.792.3.0.3.1.1.5",
 734     "TurkTrust EV OID",
 735     SEC_OID_UNKNOWN,
 736     { 0x97, 0x8C, 0xD9, 0x66, 0xF2, 0xFA, 0xA0, 0x7B, 0xA7, 0xAA, 0x95,
 737       0x00, 0xD9, 0xC0, 0x2E, 0x9D, 0x77, 0xF2, 0xCD, 0xAD, 0xA6, 0xAD,
 738       0x6B, 0xA7, 0x4A, 0xF4, 0xB9, 0x1C, 0x66, 0x59, 0x3C, 0x50 },
 739     "MIG/MT8wPQYDVQQDDDZUw5xSS1RSVVNUIEVsZWt0cm9uaWsgU2VydGlmaWthIEhp"
 740     "em1ldCBTYcSfbGF5xLFjxLFzxLExCzAJBgNVBAYTAlRSMQ8wDQYDVQQHDAZBbmth"
 741     "cmExXjBcBgNVBAoMVVTDnFJLVFJVU1QgQmlsZ2kgxLBsZXRpxZ9pbSB2ZSBCaWxp"
 742     "xZ9pbSBHw7x2ZW5sacSfaSBIaXptZXRsZXJpIEEuxZ4uIChjKSBBcmFsxLFrIDIw"
 743     "MDc=",
 744     "AQ==",
 745     nullptr
 746   },
 747   {
 748     // CN=China Internet Network Information Center EV Certificates Root,O=China Internet Network Information Center,C=CN
 749     "1.3.6.1.4.1.29836.1.10",
 750     "CNNIC EV OID",
 751     SEC_OID_UNKNOWN,
 752     { 0x1C, 0x01, 0xC6, 0xF4, 0xDB, 0xB2, 0xFE, 0xFC, 0x22, 0x55, 0x8B,
 753       0x2B, 0xCA, 0x32, 0x56, 0x3F, 0x49, 0x84, 0x4A, 0xCF, 0xC3, 0x2B,
 754       0x7B, 0xE4, 0xB0, 0xFF, 0x59, 0x9F, 0x9E, 0x8C, 0x7A, 0xF7 },
 755     "MIGKMQswCQYDVQQGEwJDTjEyMDAGA1UECgwpQ2hpbmEgSW50ZXJuZXQgTmV0d29y"
 756     "ayBJbmZvcm1hdGlvbiBDZW50ZXIxRzBFBgNVBAMMPkNoaW5hIEludGVybmV0IE5l"
 757     "dHdvcmsgSW5mb3JtYXRpb24gQ2VudGVyIEVWIENlcnRpZmljYXRlcyBSb290",
 758     "SJ8AAQ==",
 759     nullptr
 760   },
 761   {
 762     // CN=TWCA Root Certification Authority,OU=Root CA,O=TAIWAN-CA,C=TW
 763     "1.3.6.1.4.1.40869.1.1.22.3",
 764     "TWCA EV OID",
 765     SEC_OID_UNKNOWN,
 766     { 0xBF, 0xD8, 0x8F, 0xE1, 0x10, 0x1C, 0x41, 0xAE, 0x3E, 0x80, 0x1B,
 767       0xF8, 0xBE, 0x56, 0x35, 0x0E, 0xE9, 0xBA, 0xD1, 0xA6, 0xB9, 0xBD,
 768       0x51, 0x5E, 0xDC, 0x5C, 0x6D, 0x5B, 0x87, 0x11, 0xAC, 0x44 },
 769     "MF8xCzAJBgNVBAYTAlRXMRIwEAYDVQQKDAlUQUlXQU4tQ0ExEDAOBgNVBAsMB1Jv"
 770     "b3QgQ0ExKjAoBgNVBAMMIVRXQ0EgUm9vdCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0"
 771     "eQ==",
 772     "AQ==",
 773     nullptr
 774   },
 775   {
 776     // CN=D-TRUST Root Class 3 CA 2 EV 2009,O=D-Trust GmbH,C=DE
 777     "1.3.6.1.4.1.4788.2.202.1",
 778     "D-TRUST EV OID",
 779     SEC_OID_UNKNOWN,
 780     { 0xEE, 0xC5, 0x49, 0x6B, 0x98, 0x8C, 0xE9, 0x86, 0x25, 0xB9, 0x34,
 781       0x09, 0x2E, 0xEC, 0x29, 0x08, 0xBE, 0xD0, 0xB0, 0xF3, 0x16, 0xC2,
 782       0xD4, 0x73, 0x0C, 0x84, 0xEA, 0xF1, 0xF3, 0xD3, 0x48, 0x81 },
 783     "MFAxCzAJBgNVBAYTAkRFMRUwEwYDVQQKDAxELVRydXN0IEdtYkgxKjAoBgNVBAMM"
 784     "IUQtVFJVU1QgUm9vdCBDbGFzcyAzIENBIDIgRVYgMjAwOQ==",
 785     "CYP0",
 786     nullptr
 787   },
 788   {
 789     // CN=Swisscom Root EV CA 2,OU=Digital Certificate Services,O=Swisscom,C=ch
 790     "2.16.756.1.83.21.0",
 791     "Swisscom  EV OID",
 792     SEC_OID_UNKNOWN,
 793     { 0xD9, 0x5F, 0xEA, 0x3C, 0xA4, 0xEE, 0xDC, 0xE7, 0x4C, 0xD7, 0x6E,
 794       0x75, 0xFC, 0x6D, 0x1F, 0xF6, 0x2C, 0x44, 0x1F, 0x0F, 0xA8, 0xBC,
 795       0x77, 0xF0, 0x34, 0xB1, 0x9E, 0x5D, 0xB2, 0x58, 0x01, 0x5D },
 796     "MGcxCzAJBgNVBAYTAmNoMREwDwYDVQQKEwhTd2lzc2NvbTElMCMGA1UECxMcRGln"
 797     "aXRhbCBDZXJ0aWZpY2F0ZSBTZXJ2aWNlczEeMBwGA1UEAxMVU3dpc3Njb20gUm9v"
 798     "dCBFViBDQSAy",
 799     "APL6ZOJ0Y9ON/RAdBB92ylg=",
 800     nullptr
 801   },
 802   {
 803     // CN=VeriSign Universal Root Certification Authority,OU="(c) 2008 VeriSign, Inc. - For authorized use only",OU=VeriSign Trust Network,O="VeriSign, Inc.",C=US
 804     "2.16.840.1.113733.1.7.23.6",
 805     "VeriSign EV OID",
 806     SEC_OID_UNKNOWN,
 807     { 0x23, 0x99, 0x56, 0x11, 0x27, 0xA5, 0x71, 0x25, 0xDE, 0x8C, 0xEF,
 808       0xEA, 0x61, 0x0D, 0xDF, 0x2F, 0xA0, 0x78, 0xB5, 0xC8, 0x06, 0x7F,
 809       0x4E, 0x82, 0x82, 0x90, 0xBF, 0xB8, 0x60, 0xE8, 0x4B, 0x3C },
 810     "MIG9MQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNV"
 811     "BAsTFlZlcmlTaWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAyMDA4IFZl"
 812     "cmlTaWduLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxODA2BgNVBAMT"
 813     "L1ZlcmlTaWduIFVuaXZlcnNhbCBSb290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5",
 814     "QBrEZCGzEyEDDrvkEhrFHQ==",
 815     nullptr
 816   },
 817   {
 818     // CN=GeoTrust Primary Certification Authority - G3,OU=(c) 2008 GeoTrust Inc. - For authorized use only,O=GeoTrust Inc.,C=US
 819     "1.3.6.1.4.1.14370.1.6",
 820     "GeoTrust EV OID",
 821     SEC_OID_UNKNOWN,
 822     { 0xB4, 0x78, 0xB8, 0x12, 0x25, 0x0D, 0xF8, 0x78, 0x63, 0x5C, 0x2A,
 823       0xA7, 0xEC, 0x7D, 0x15, 0x5E, 0xAA, 0x62, 0x5E, 0xE8, 0x29, 0x16,
 824       0xE2, 0xCD, 0x29, 0x43, 0x61, 0x88, 0x6C, 0xD1, 0xFB, 0xD4 },
 825     "MIGYMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNR2VvVHJ1c3QgSW5jLjE5MDcGA1UE"
 826     "CxMwKGMpIDIwMDggR2VvVHJ1c3QgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBv"
 827     "bmx5MTYwNAYDVQQDEy1HZW9UcnVzdCBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0"
 828     "aG9yaXR5IC0gRzM=",
 829     "FaxulBmyeUtB9iepwxgPHw==",
 830     nullptr
 831   },
 832   {
 833     // CN=thawte Primary Root CA - G3,OU="(c) 2008 thawte, Inc. - For authorized use only",OU=Certification Services Division,O="thawte, Inc.",C=US
 834     "2.16.840.1.113733.1.7.48.1",
 835     "Thawte EV OID",
 836     SEC_OID_UNKNOWN,
 837     { 0x4B, 0x03, 0xF4, 0x58, 0x07, 0xAD, 0x70, 0xF2, 0x1B, 0xFC, 0x2C,
 838       0xAE, 0x71, 0xC9, 0xFD, 0xE4, 0x60, 0x4C, 0x06, 0x4C, 0xF5, 0xFF,
 839       0xB6, 0x86, 0xBA, 0xE5, 0xDB, 0xAA, 0xD7, 0xFD, 0xD3, 0x4C },
 840     "MIGuMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMdGhhd3RlLCBJbmMuMSgwJgYDVQQL"
 841     "Ex9DZXJ0aWZpY2F0aW9uIFNlcnZpY2VzIERpdmlzaW9uMTgwNgYDVQQLEy8oYykg"
 842     "MjAwOCB0aGF3dGUsIEluYy4gLSBGb3IgYXV0aG9yaXplZCB1c2Ugb25seTEkMCIG"
 843     "A1UEAxMbdGhhd3RlIFByaW1hcnkgUm9vdCBDQSAtIEcz",
 844     "YAGXt0an6rS0mtZLL/eQ+w==",
 845     nullptr
 846   },
 847   {
 848     // CN = Autoridad de Certificacion Firmaprofesional CIF A62634068, C = ES
 849     "1.3.6.1.4.1.13177.10.1.3.10",
 850     "Firmaprofesional EV OID",
 851     SEC_OID_UNKNOWN,
 852     { 0x04, 0x04, 0x80, 0x28, 0xBF, 0x1F, 0x28, 0x64, 0xD4, 0x8F, 0x9A,
 853       0xD4, 0xD8, 0x32, 0x94, 0x36, 0x6A, 0x82, 0x88, 0x56, 0x55, 0x3F,
 854       0x3B, 0x14, 0x30, 0x3F, 0x90, 0x14, 0x7F, 0x5D, 0x40, 0xEF },
 855     "MFExCzAJBgNVBAYTAkVTMUIwQAYDVQQDDDlBdXRvcmlkYWQgZGUgQ2VydGlmaWNh"
 856     "Y2lvbiBGaXJtYXByb2Zlc2lvbmFsIENJRiBBNjI2MzQwNjg=",
 857     "U+w77vuySF8=",
 858     nullptr
 859   },
 860   {
 861     // CN = TWCA Global Root CA, OU = Root CA, O = TAIWAN-CA, C = TW
 862     "1.3.6.1.4.1.40869.1.1.22.3",
 863     "TWCA EV OID",
 864     SEC_OID_UNKNOWN,
 865     { 0x59, 0x76, 0x90, 0x07, 0xF7, 0x68, 0x5D, 0x0F, 0xCD, 0x50, 0x87,
 866       0x2F, 0x9F, 0x95, 0xD5, 0x75, 0x5A, 0x5B, 0x2B, 0x45, 0x7D, 0x81,
 867       0xF3, 0x69, 0x2B, 0x61, 0x0A, 0x98, 0x67, 0x2F, 0x0E, 0x1B },
 868     "MFExCzAJBgNVBAYTAlRXMRIwEAYDVQQKEwlUQUlXQU4tQ0ExEDAOBgNVBAsTB1Jv"
 869     "b3QgQ0ExHDAaBgNVBAMTE1RXQ0EgR2xvYmFsIFJvb3QgQ0E=",
 870     "DL4=",
 871     nullptr
 872   },
 873   {
 874     // CN = E-Tugra Certification Authority, OU = E-Tugra Sertifikasyon Merkezi, O = E-Tuğra EBG Bilişim Teknolojileri ve Hizmetleri A.Ş., L = Ankara, C = TR
 875     "2.16.792.3.0.4.1.1.4",
 876     "ETugra EV OID",
 877     SEC_OID_UNKNOWN,
 878     { 0xB0, 0xBF, 0xD5, 0x2B, 0xB0, 0xD7, 0xD9, 0xBD, 0x92, 0xBF, 0x5D,
 879       0x4D, 0xC1, 0x3D, 0xA2, 0x55, 0xC0, 0x2C, 0x54, 0x2F, 0x37, 0x83,
 880       0x65, 0xEA, 0x89, 0x39, 0x11, 0xF5, 0x5E, 0x55, 0xF2, 0x3C },
 881     "MIGyMQswCQYDVQQGEwJUUjEPMA0GA1UEBwwGQW5rYXJhMUAwPgYDVQQKDDdFLVR1"
 882     "xJ9yYSBFQkcgQmlsacWfaW0gVGVrbm9sb2ppbGVyaSB2ZSBIaXptZXRsZXJpIEEu"
 883     "xZ4uMSYwJAYDVQQLDB1FLVR1Z3JhIFNlcnRpZmlrYXN5b24gTWVya2V6aTEoMCYG"
 884     "A1UEAwwfRS1UdWdyYSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eQ==",
 885     "amg+nFGby1M=",
 886     nullptr
 887   },
 888   {
 889     // CN=Actalis Authentication Root CA,O=Actalis S.p.A./03358520967,L=Milan,C=IT
 890     "1.3.159.1.17.1",
 891     "Actalis EV OID",
 892     SEC_OID_UNKNOWN,
 893     { 0x55, 0x92, 0x60, 0x84, 0xEC, 0x96, 0x3A, 0x64, 0xB9, 0x6E, 0x2A,
 894       0xBE, 0x01, 0xCE, 0x0B, 0xA8, 0x6A, 0x64, 0xFB, 0xFE, 0xBC, 0xC7,
 895       0xAA, 0xB5, 0xAF, 0xC1, 0x55, 0xB3, 0x7F, 0xD7, 0x60, 0x66 },
 896     "MGsxCzAJBgNVBAYTAklUMQ4wDAYDVQQHDAVNaWxhbjEjMCEGA1UECgwaQWN0YWxp"
 897     "cyBTLnAuQS4vMDMzNTg1MjA5NjcxJzAlBgNVBAMMHkFjdGFsaXMgQXV0aGVudGlj"
 898     "YXRpb24gUm9vdCBDQQ==",
 899     "VwoRl0LE48w=",
 900     nullptr
 901   },
 902   {
 903     // CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN
 904     "1.3.6.1.4.1.36305.2",
 905     "WoSign EV OID",
 906     SEC_OID_UNKNOWN,
 907     { 0x4B, 0x22, 0xD5, 0xA6, 0xAE, 0xC9, 0x9F, 0x3C, 0xDB, 0x79, 0xAA,
 908       0x5E, 0xC0, 0x68, 0x38, 0x47, 0x9C, 0xD5, 0xEC, 0xBA, 0x71, 0x64,
 909       0xF7, 0xF2, 0x2D, 0xC1, 0xD6, 0x5F, 0x63, 0xD8, 0x57, 0x08 },
 910     "MFUxCzAJBgNVBAYTAkNOMRowGAYDVQQKExFXb1NpZ24gQ0EgTGltaXRlZDEqMCgG"
 911     "A1UEAxMhQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgb2YgV29TaWdu",
 912     "XmjWEXGUY1BWAGjzPsnFkQ==",
 913     nullptr
 914   },
 915   {
 916     // CN=CA ...............,O=WoSign CA Limited,C=CN
 917     "1.3.6.1.4.1.36305.2",
 918     "WoSign EV OID",
 919     SEC_OID_UNKNOWN,
 920     { 0xD6, 0xF0, 0x34, 0xBD, 0x94, 0xAA, 0x23, 0x3F, 0x02, 0x97, 0xEC,
 921       0xA4, 0x24, 0x5B, 0x28, 0x39, 0x73, 0xE4, 0x47, 0xAA, 0x59, 0x0F,
 922       0x31, 0x0C, 0x77, 0xF4, 0x8F, 0xDF, 0x83, 0x11, 0x22, 0x54 },
 923     "MEYxCzAJBgNVBAYTAkNOMRowGAYDVQQKExFXb1NpZ24gQ0EgTGltaXRlZDEbMBkG"
 924     "A1UEAwwSQ0Eg5rKD6YCa5qC56K+B5Lmm",
 925     "UHBrzdgT/BtOOzNy0hFIjQ==",
 926     nullptr
 927   },
 928   {
 929     // CN=DigiCert Assured ID Root G2,OU=www.digicert.com,O=DigiCert Inc,C=US
 930     "2.16.840.1.114412.2.1",
 931     "DigiCert EV OID",
 932     SEC_OID_UNKNOWN,
 933     { 0x7D, 0x05, 0xEB, 0xB6, 0x82, 0x33, 0x9F, 0x8C, 0x94, 0x51, 0xEE,
 934       0x09, 0x4E, 0xEB, 0xFE, 0xFA, 0x79, 0x53, 0xA1, 0x14, 0xED, 0xB2,
 935       0xF4, 0x49, 0x49, 0x45, 0x2F, 0xAB, 0x7D, 0x2F, 0xC1, 0x85 },
 936     "MGUxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsT"
 937     "EHd3dy5kaWdpY2VydC5jb20xJDAiBgNVBAMTG0RpZ2lDZXJ0IEFzc3VyZWQgSUQg"
 938     "Um9vdCBHMg==",
 939     "C5McOtY5Z+pnI7/Dr5r0Sw==",
 940     nullptr
 941   },
 942   {
 943     // CN=DigiCert Assured ID Root G3,OU=www.digicert.com,O=DigiCert Inc,C=US
 944     "2.16.840.1.114412.2.1",
 945     "DigiCert EV OID",
 946     SEC_OID_UNKNOWN,
 947     { 0x7E, 0x37, 0xCB, 0x8B, 0x4C, 0x47, 0x09, 0x0C, 0xAB, 0x36, 0x55,
 948       0x1B, 0xA6, 0xF4, 0x5D, 0xB8, 0x40, 0x68, 0x0F, 0xBA, 0x16, 0x6A,
 949       0x95, 0x2D, 0xB1, 0x00, 0x71, 0x7F, 0x43, 0x05, 0x3F, 0xC2 },
 950     "MGUxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsT"
 951     "EHd3dy5kaWdpY2VydC5jb20xJDAiBgNVBAMTG0RpZ2lDZXJ0IEFzc3VyZWQgSUQg"
 952     "Um9vdCBHMw==",
 953     "C6Fa+h3foLVJRK/NJKBs7A==",
 954     nullptr,
 955   },
 956   {
 957     // CN=DigiCert Global Root G2,OU=www.digicert.com,O=DigiCert Inc,C=US
 958     "2.16.840.1.114412.2.1",
 959     "DigiCert EV OID",
 960      SEC_OID_UNKNOWN,
 961     { 0xCB, 0x3C, 0xCB, 0xB7, 0x60, 0x31, 0xE5, 0xE0, 0x13, 0x8F, 0x8D,
 962       0xD3, 0x9A, 0x23, 0xF9, 0xDE, 0x47, 0xFF, 0xC3, 0x5E, 0x43, 0xC1,
 963       0x14, 0x4C, 0xEA, 0x27, 0xD4, 0x6A, 0x5A, 0xB1, 0xCB, 0x5F },
 964     "MGExCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsT"
 965     "EHd3dy5kaWdpY2VydC5jb20xIDAeBgNVBAMTF0RpZ2lDZXJ0IEdsb2JhbCBSb290"
 966     "IEcy",
 967     "Azrx5qcRqaC7KGSxHQn65Q==",
 968     nullptr,
 969   },
 970   {
 971     // CN=DigiCert Global Root G3,OU=www.digicert.com,O=DigiCert Inc,C=US
 972     "2.16.840.1.114412.2.1",
 973     "DigiCert EV OID",
 974     SEC_OID_UNKNOWN,
 975     { 0x31, 0xAD, 0x66, 0x48, 0xF8, 0x10, 0x41, 0x38, 0xC7, 0x38, 0xF3,
 976       0x9E, 0xA4, 0x32, 0x01, 0x33, 0x39, 0x3E, 0x3A, 0x18, 0xCC, 0x02,
 977       0x29, 0x6E, 0xF9, 0x7C, 0x2A, 0xC9, 0xEF, 0x67, 0x31, 0xD0 },
 978     "MGExCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsT"
 979     "EHd3dy5kaWdpY2VydC5jb20xIDAeBgNVBAMTF0RpZ2lDZXJ0IEdsb2JhbCBSb290"
 980     "IEcz",
 981     "BVVWvPJepDU1w6QP1atFcg==",
 982     nullptr
 983   },
 984   {
 985     // CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
 986     "2.16.840.1.114412.2.1",
 987     "DigiCert EV OID",
 988     SEC_OID_UNKNOWN,
 989     { 0x55, 0x2F, 0x7B, 0xDC, 0xF1, 0xA7, 0xAF, 0x9E, 0x6C, 0xE6, 0x72,
 990       0x01, 0x7F, 0x4F, 0x12, 0xAB, 0xF7, 0x72, 0x40, 0xC7, 0x8E, 0x76,
 991       0x1A, 0xC2, 0x03, 0xD1, 0xD9, 0xD2, 0x0A, 0xC8, 0x99, 0x88 },
 992     "MGIxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsT"
 993     "EHd3dy5kaWdpY2VydC5jb20xITAfBgNVBAMTGERpZ2lDZXJ0IFRydXN0ZWQgUm9v"
 994     "dCBHNA==",
 995     "BZsbV56OITLiOQe9p3d1XA==",
 996     nullptr
 997   },
 998   {
 999     // CN=QuoVadis Root CA 2 G3,O=QuoVadis Limited,C=BM
1000     "1.3.6.1.4.1.8024.0.2.100.1.2",
1001     "QuoVadis EV OID",
1002     SEC_OID_UNKNOWN,
1003     { 0x8F, 0xE4, 0xFB, 0x0A, 0xF9, 0x3A, 0x4D, 0x0D, 0x67, 0xDB, 0x0B,
1004       0xEB, 0xB2, 0x3E, 0x37, 0xC7, 0x1B, 0xF3, 0x25, 0xDC, 0xBC, 0xDD,
1005       0x24, 0x0E, 0xA0, 0x4D, 0xAF, 0x58, 0xB4, 0x7E, 0x18, 0x40 },
1006     "MEgxCzAJBgNVBAYTAkJNMRkwFwYDVQQKExBRdW9WYWRpcyBMaW1pdGVkMR4wHAYD"
1007     "VQQDExVRdW9WYWRpcyBSb290IENBIDIgRzM=",
1008     "RFc0JFuBiZs18s64KztbpybwdSg=",
1009     nullptr
1010   },
1011   {
1012     // CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
1013     "1.3.6.1.4.1.6449.1.2.1.5.1",
1014     "Comodo EV OID",
1015     SEC_OID_UNKNOWN,
1016     { 0x52, 0xF0, 0xE1, 0xC4, 0xE5, 0x8E, 0xC6, 0x29, 0x29, 0x1B, 0x60,
1017       0x31, 0x7F, 0x07, 0x46, 0x71, 0xB8, 0x5D, 0x7E, 0xA8, 0x0D, 0x5B,
1018       0x07, 0x27, 0x34, 0x63, 0x53, 0x4B, 0x32, 0xB4, 0x02, 0x34 },
1019     "MIGFMQswCQYDVQQGEwJHQjEbMBkGA1UECBMSR3JlYXRlciBNYW5jaGVzdGVyMRAw"
1020     "DgYDVQQHEwdTYWxmb3JkMRowGAYDVQQKExFDT01PRE8gQ0EgTGltaXRlZDErMCkG"
1021     "A1UEAxMiQ09NT0RPIFJTQSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eQ==",
1022     "TKr5yttjb+Af907YWwOGnQ==",
1023     nullptr
1024   },
1025   {
1026     // CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
1027     "1.3.6.1.4.1.6449.1.2.1.5.1",
1028     "Comodo EV OID",
1029     SEC_OID_UNKNOWN,
1030     { 0xE7, 0x93, 0xC9, 0xB0, 0x2F, 0xD8, 0xAA, 0x13, 0xE2, 0x1C, 0x31,
1031       0x22, 0x8A, 0xCC, 0xB0, 0x81, 0x19, 0x64, 0x3B, 0x74, 0x9C, 0x89,
1032       0x89, 0x64, 0xB1, 0x74, 0x6D, 0x46, 0xC3, 0xD4, 0xCB, 0xD2 },
1033     "MIGIMQswCQYDVQQGEwJVUzETMBEGA1UECBMKTmV3IEplcnNleTEUMBIGA1UEBxML"
1034     "SmVyc2V5IENpdHkxHjAcBgNVBAoTFVRoZSBVU0VSVFJVU1QgTmV0d29yazEuMCwG"
1035     "A1UEAxMlVVNFUlRydXN0IFJTQSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eQ==",
1036     "Af1tMPyjylGoG7xkDjUDLQ==",
1037     nullptr
1038   },
1039   {
1040     // CN=USERTrust ECC Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
1041     "1.3.6.1.4.1.6449.1.2.1.5.1",
1042     "Comodo EV OID",
1043     SEC_OID_UNKNOWN,
1044     { 0x4F, 0xF4, 0x60, 0xD5, 0x4B, 0x9C, 0x86, 0xDA, 0xBF, 0xBC, 0xFC,
1045       0x57, 0x12, 0xE0, 0x40, 0x0D, 0x2B, 0xED, 0x3F, 0xBC, 0x4D, 0x4F,
1046       0xBD, 0xAA, 0x86, 0xE0, 0x6A, 0xDC, 0xD2, 0xA9, 0xAD, 0x7A },
1047     "MIGIMQswCQYDVQQGEwJVUzETMBEGA1UECBMKTmV3IEplcnNleTEUMBIGA1UEBxML"
1048     "SmVyc2V5IENpdHkxHjAcBgNVBAoTFVRoZSBVU0VSVFJVU1QgTmV0d29yazEuMCwG"
1049     "A1UEAxMlVVNFUlRydXN0IEVDQyBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eQ==",
1050     "XIuZxVqUxdJxVt7NiYDMJg==",
1051     nullptr
1052   },
1053   {
1054     // CN=GlobalSign,O=GlobalSign,OU=GlobalSign ECC Root CA - R4
1055     "1.3.6.1.4.1.4146.1.1",
1056     "GlobalSign EV OID",
1057     SEC_OID_UNKNOWN,
1058     { 0xBE, 0xC9, 0x49, 0x11, 0xC2, 0x95, 0x56, 0x76, 0xDB, 0x6C, 0x0A,
1059       0x55, 0x09, 0x86, 0xD7, 0x6E, 0x3B, 0xA0, 0x05, 0x66, 0x7C, 0x44,
1060       0x2C, 0x97, 0x62, 0xB4, 0xFB, 0xB7, 0x73, 0xDE, 0x22, 0x8C },
1061     "MFAxJDAiBgNVBAsTG0dsb2JhbFNpZ24gRUNDIFJvb3QgQ0EgLSBSNDETMBEGA1UE"
1062     "ChMKR2xvYmFsU2lnbjETMBEGA1UEAxMKR2xvYmFsU2lnbg==",
1063     "KjikHJYKBN5CsiilC+g0mAI=",
1064     nullptr
1065   },
1066   {
1067     // CN=GlobalSign,O=GlobalSign,OU=GlobalSign ECC Root CA - R5
1068     "1.3.6.1.4.1.4146.1.1",
1069     "GlobalSign EV OID",
1070     SEC_OID_UNKNOWN,
1071     { 0x17, 0x9F, 0xBC, 0x14, 0x8A, 0x3D, 0xD0, 0x0F, 0xD2, 0x4E, 0xA1,
1072       0x34, 0x58, 0xCC, 0x43, 0xBF, 0xA7, 0xF5, 0x9C, 0x81, 0x82, 0xD7,
1073       0x83, 0xA5, 0x13, 0xF6, 0xEB, 0xEC, 0x10, 0x0C, 0x89, 0x24 },
1074     "MFAxJDAiBgNVBAsTG0dsb2JhbFNpZ24gRUNDIFJvb3QgQ0EgLSBSNTETMBEGA1UE"
1075     "ChMKR2xvYmFsU2lnbjETMBEGA1UEAxMKR2xvYmFsU2lnbg==",
1076     "YFlJ4CYuu1X5CneKcflK2Gw=",
1077     nullptr
1078   },
1079   {
1080     // CN=Entrust.net Certification Authority (2048),OU=(c) 1999 Entrust.net Limited,OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.),O=Entrust.net
1081     "2.16.840.1.114028.10.1.2",
1082     "Entrust EV OID",
1083     SEC_OID_UNKNOWN,
1084     { 0x6D, 0xC4, 0x71, 0x72, 0xE0, 0x1C, 0xBC, 0xB0, 0xBF, 0x62, 0x58,
1085       0x0D, 0x89, 0x5F, 0xE2, 0xB8, 0xAC, 0x9A, 0xD4, 0xF8, 0x73, 0x80,
1086       0x1E, 0x0C, 0x10, 0xB9, 0xC8, 0x37, 0xD2, 0x1E, 0xB1, 0x77 },
1087     "MIG0MRQwEgYDVQQKEwtFbnRydXN0Lm5ldDFAMD4GA1UECxQ3d3d3LmVudHJ1c3Qu"
1088     "bmV0L0NQU18yMDQ4IGluY29ycC4gYnkgcmVmLiAobGltaXRzIGxpYWIuKTElMCMG"
1089     "A1UECxMcKGMpIDE5OTkgRW50cnVzdC5uZXQgTGltaXRlZDEzMDEGA1UEAxMqRW50"
1090     "cnVzdC5uZXQgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgKDIwNDgp",
1091     "OGPe+A==",
1092     nullptr
1093   }
1094 };
1095
1096 static SECOidTag
1097 register_oid(const SECItem* oid_item, const char* oid_name)
1098 {
1099   if (!oid_item)
1100     return SEC_OID_UNKNOWN;
1101
1102   SECOidData od;
1103   od.oid.len = oid_item->len;
1104   od.oid.data = oid_item->data;
1105   od.offset = SEC_OID_UNKNOWN;
1106   od.desc = oid_name;
1107   od.mechanism = CKM_INVALID_MECHANISM;
1108   od.supportedExtension = INVALID_CERT_EXTENSION;
1109   return SECOID_AddEntry(&od);
1110 }
1111
1112 static bool
1113 isEVPolicy(SECOidTag policyOIDTag)
1114 {
1115   for (size_t iEV = 0; iEV < PR_ARRAY_SIZE(myTrustedEVInfos); ++iEV) {
1116     nsMyTrustedEVInfo& entry = myTrustedEVInfos[iEV];
1117     if (policyOIDTag == entry.oid_tag) {
1118       return true;
1119     }
1120   }
1121
1122   return false;
1123 }
1124
1125 namespace mozilla { namespace psm {
1126
1127 bool
1128 CertIsAuthoritativeForEVPolicy(const CERTCertificate* cert,
1129                                const mozilla::pkix::CertPolicyId& policy)
1130 {
1131   PR_ASSERT(cert);
1132   if (!cert) {
1133     return false;
1134   }
1135
1136   for (size_t iEV = 0; iEV < PR_ARRAY_SIZE(myTrustedEVInfos); ++iEV) {
1137     nsMyTrustedEVInfo& entry = myTrustedEVInfos[iEV];
1138     if (entry.cert && CERT_CompareCerts(cert, entry.cert)) {
1139       const SECOidData* oidData = SECOID_FindOIDByTag(entry.oid_tag);
1140       if (oidData && oidData->oid.len == policy.numBytes &&
1141           !memcmp(oidData->oid.data, policy.bytes, policy.numBytes)) {
1142         return true;
1143       }
1144     }
1145   }
1146
1147   return false;
1148 }
1149
1150 static PRStatus
1151 IdentityInfoInit()
1152 {
1153   for (size_t iEV = 0; iEV < PR_ARRAY_SIZE(myTrustedEVInfos); ++iEV) {
1154     nsMyTrustedEVInfo& entry = myTrustedEVInfos[iEV];
1155
1156     SECStatus rv;
1157     CERTIssuerAndSN ias;
1158
1159     rv = ATOB_ConvertAsciiToItem(&ias.derIssuer, const_cast<char*>(entry.issuer_base64));
1160     PR_ASSERT(rv == SECSuccess);
1161     if (rv != SECSuccess) {
1162       return PR_FAILURE;
1163     }
1164     rv = ATOB_ConvertAsciiToItem(&ias.serialNumber,
1165                                  const_cast<char*>(entry.serial_base64));
1166     PR_ASSERT(rv == SECSuccess);
1167     if (rv != SECSuccess) {
1168       SECITEM_FreeItem(&ias.derIssuer, false);
1169       return PR_FAILURE;
1170     }
1171
1172     ias.serialNumber.type = siUnsignedInteger;
1173
1174     entry.cert = CERT_FindCertByIssuerAndSN(nullptr, &ias);
1175
1176     SECITEM_FreeItem(&ias.derIssuer, false);
1177     SECITEM_FreeItem(&ias.serialNumber, false);
1178
1179     // If an entry is missing in the NSS root database, it may be because the
1180     // root database is out of sync with what we expect (e.g. a different
1181     // version of system NSS is installed). We will just silently avoid
1182     // treating that root cert as EV.
1183     if (!entry.cert) {
1184 #ifdef DEBUG
1185       // The debug CA structs are at positions 0 to NUM_TEST_EV_ROOTS - 1, and
1186       // are NOT in the NSS root DB.
1187       if (iEV < NUM_TEST_EV_ROOTS) {
1188         continue;
1189       }
1190 #endif
1191       PR_NOT_REACHED("Could not find EV root in NSS storage");
1192       continue;
1193     }
1194
1195     unsigned char certFingerprint[SHA256_LENGTH];
1196     rv = PK11_HashBuf(SEC_OID_SHA256, certFingerprint,
1197                       entry.cert->derCert.data,
1198                       static_cast<int32_t>(entry.cert->derCert.len));
1199     PR_ASSERT(rv == SECSuccess);
1200     if (rv == SECSuccess) {
1201       bool same = !memcmp(certFingerprint, entry.ev_root_sha256_fingerprint,
1202                           sizeof(certFingerprint));
1203       PR_ASSERT(same);
1204       if (same) {
1205
1206         SECItem ev_oid_item;
1207         ev_oid_item.data = nullptr;
1208         ev_oid_item.len = 0;
1209         rv = SEC_StringToOID(nullptr, &ev_oid_item, entry.dotted_oid, 0);
1210         PR_ASSERT(rv == SECSuccess);
1211         if (rv == SECSuccess) {
1212           entry.oid_tag = register_oid(&ev_oid_item, entry.oid_name);
1213           if (entry.oid_tag == SEC_OID_UNKNOWN) {
1214             rv = SECFailure;
1215           }
1216           SECITEM_FreeItem(&ev_oid_item, false);
1217         }
1218       } else {
1219         PR_SetError(SEC_ERROR_BAD_DATA, 0);
1220         rv = SECFailure;
1221       }
1222     }
1223
1224     if (rv != SECSuccess) {
1225       CERT_DestroyCertificate(entry.cert);
1226       entry.cert = nullptr;
1227       entry.oid_tag = SEC_OID_UNKNOWN;
1228       return PR_FAILURE;
1229     }
1230   }
1231
1232   return PR_SUCCESS;
1233 }
1234
1235 static PRCallOnceType sIdentityInfoCallOnce;
1236
1237 void
1238 EnsureIdentityInfoLoaded()
1239 {
1240   (void) PR_CallOnce(&sIdentityInfoCallOnce, IdentityInfoInit);
1241 }
1242
1243 void
1244 CleanupIdentityInfo()
1245 {
1246   for (size_t iEV = 0; iEV < PR_ARRAY_SIZE(myTrustedEVInfos); ++iEV) {
1247     nsMyTrustedEVInfo &entry = myTrustedEVInfos[iEV];
1248     if (entry.cert) {
1249       CERT_DestroyCertificate(entry.cert);
1250       entry.cert = nullptr;
1251     }
1252   }
1253
1254   memset(&sIdentityInfoCallOnce, 0, sizeof(PRCallOnceType));
1255 }
1256
1257 // Find the first policy OID that is known to be an EV policy OID.
1258 SECStatus
1259 GetFirstEVPolicy(CERTCertificate* cert,
1260                  /*out*/ mozilla::pkix::CertPolicyId& policy,
1261                  /*out*/ SECOidTag& policyOidTag)
1262 {
1263   if (!cert) {
1264     PR_SetError(SEC_ERROR_INVALID_ARGS, 0);
1265     return SECFailure;
1266   }
1267
1268   if (cert->extensions) {
1269     for (int i=0; cert->extensions[i]; i++) {
1270       const SECItem* oid = &cert->extensions[i]->id;
1271
1272       SECOidTag oidTag = SECOID_FindOIDTag(oid);
1273       if (oidTag != SEC_OID_X509_CERTIFICATE_POLICIES)
1274         continue;
1275
1276       SECItem* value = &cert->extensions[i]->value;
1277
1278       CERTCertificatePolicies* policies;
1279       CERTPolicyInfo** policyInfos;
1280
1281       policies = CERT_DecodeCertificatePoliciesExtension(value);
1282       if (!policies)
1283         continue;
1284
1285       policyInfos = policies->policyInfos;
1286
1287       bool found = false;
1288       while (*policyInfos) {
1289         const CERTPolicyInfo* policyInfo = *policyInfos++;
1290
1291         SECOidTag oid_tag = policyInfo->oid;
1292         if (oid_tag != SEC_OID_UNKNOWN && isEVPolicy(oid_tag)) {
1293           const SECOidData* oidData = SECOID_FindOIDByTag(oid_tag);
1294           PR_ASSERT(oidData);
1295           PR_ASSERT(oidData->oid.data);
1296           PR_ASSERT(oidData->oid.len > 0);
1297           PR_ASSERT(oidData->oid.len <= mozilla::pkix::CertPolicyId::MAX_BYTES);
1298           if (oidData && oidData->oid.data && oidData->oid.len > 0 &&
1299               oidData->oid.len <= mozilla::pkix::CertPolicyId::MAX_BYTES) {
1300             policy.numBytes = static_cast<uint16_t>(oidData->oid.len);
1301             memcpy(policy.bytes, oidData->oid.data, policy.numBytes);
1302             policyOidTag = oid_tag;
1303             found = true;
1304           }
1305           break;
1306         }
1307       }
1308       CERT_DestroyCertificatePoliciesExtension(policies);
1309       if (found) {
1310         return SECSuccess;
1311       }
1312     }
1313   }
1314
1315   PR_SetError(SEC_ERROR_POLICY_VALIDATION_FAILED, 0);
1316   return SECFailure;
1317 }
1318
1319 } } // namespace mozilla::psm