dlls/crypt32/tests/chain.c

   1 /*
   2  * crypt32 certificate chain functions tests
   3  *
   4  * Copyright 2006 Juan Lang
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2.1 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, write to the Free Software
  18  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  19  */
  20 #include <assert.h>
  21 #include <stdio.h>
  22 #include <stdarg.h>
  23 #include <windef.h>
  24 #include <winbase.h>
  25 #include <winerror.h>
  26 #include <wincrypt.h>
  27
  28 #include "wine/test.h"
  29
  30 static const BYTE selfSignedCert[] = {
  31  0x30, 0x82, 0x01, 0x1f, 0x30, 0x81, 0xce, 0xa0, 0x03, 0x02, 0x01, 0x02, 0x02,
  32  0x10, 0xeb, 0x0d, 0x57, 0x2a, 0x9c, 0x09, 0xba, 0xa4, 0x4a, 0xb7, 0x25, 0x49,
  33  0xd9, 0x3e, 0xb5, 0x73, 0x30, 0x09, 0x06, 0x05, 0x2b, 0x0e, 0x03, 0x02, 0x1d,
  34  0x05, 0x00, 0x30, 0x15, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x03,
  35  0x13, 0x0a, 0x4a, 0x75, 0x61, 0x6e, 0x20, 0x4c, 0x61, 0x6e, 0x67, 0x00, 0x30,
  36  0x1e, 0x17, 0x0d, 0x30, 0x36, 0x30, 0x36, 0x32, 0x39, 0x30, 0x35, 0x30, 0x30,
  37  0x34, 0x36, 0x5a, 0x17, 0x0d, 0x30, 0x37, 0x30, 0x36, 0x32, 0x39, 0x31, 0x31,
  38  0x30, 0x30, 0x34, 0x36, 0x5a, 0x30, 0x15, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03,
  39  0x55, 0x04, 0x03, 0x13, 0x0a, 0x4a, 0x75, 0x61, 0x6e, 0x20, 0x4c, 0x61, 0x6e,
  40  0x67, 0x00, 0x30, 0x5c, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7,
  41  0x0d, 0x01, 0x01, 0x01, 0x05, 0x00, 0x03, 0x4b, 0x00, 0x30, 0x48, 0x02, 0x41,
  42  0x00, 0xe2, 0x54, 0x3a, 0xa7, 0x83, 0xb1, 0x27, 0x14, 0x3e, 0x59, 0xbb, 0xb4,
  43  0x53, 0xe6, 0x1f, 0xe7, 0x5d, 0xf1, 0x21, 0x68, 0xad, 0x85, 0x53, 0xdb, 0x6b,
  44  0x1e, 0xeb, 0x65, 0x97, 0x03, 0x86, 0x60, 0xde, 0xf3, 0x6c, 0x38, 0x75, 0xe0,
  45  0x4c, 0x61, 0xbb, 0xbc, 0x62, 0x17, 0xa9, 0xcd, 0x79, 0x3f, 0x21, 0x4e, 0x96,
  46  0xcb, 0x0e, 0xdc, 0x61, 0x94, 0x30, 0x18, 0x10, 0x6b, 0xd0, 0x1c, 0x10, 0x79,
  47  0x02, 0x03, 0x01, 0x00, 0x01, 0x30, 0x09, 0x06, 0x05, 0x2b, 0x0e, 0x03, 0x02,
  48  0x1d, 0x05, 0x00, 0x03, 0x41, 0x00, 0x25, 0x90, 0x53, 0x34, 0xd9, 0x56, 0x41,
  49  0x5e, 0xdb, 0x7e, 0x01, 0x36, 0xec, 0x27, 0x61, 0x5e, 0xb7, 0x4d, 0x90, 0x66,
  50  0xa2, 0xe1, 0x9d, 0x58, 0x76, 0xd4, 0x9c, 0xba, 0x2c, 0x84, 0xc6, 0x83, 0x7a,
  51  0x22, 0x0d, 0x03, 0x69, 0x32, 0x1a, 0x6d, 0xcb, 0x0c, 0x15, 0xb3, 0x6b, 0xc7,
  52  0x0a, 0x8c, 0xb4, 0x5c, 0x34, 0x78, 0xe0, 0x3c, 0x9c, 0xe9, 0xf3, 0x30, 0x9f,
  53  0xa8, 0x76, 0x57, 0x92, 0x36 };
  54
  55 static BOOL (WINAPI *pCertCreateCertificateChainEngine)(PCERT_CHAIN_ENGINE_CONFIG,HCERTCHAINENGINE*);
  56 static BOOL (WINAPI *pCertGetCertificateChain)(HCERTCHAINENGINE,PCCERT_CONTEXT,LPFILETIME,HCERTSTORE,PCERT_CHAIN_PARA,DWORD,LPVOID,PCCERT_CHAIN_CONTEXT*);
  57 static VOID (WINAPI *pCertFreeCertificateChain)(PCCERT_CHAIN_CONTEXT);
  58 static VOID (WINAPI *pCertFreeCertificateChainEngine)(HCERTCHAINENGINE);
  59 static BOOL (WINAPI *pCertVerifyCertificateChainPolicy)(LPCSTR,PCCERT_CHAIN_CONTEXT,PCERT_CHAIN_POLICY_PARA,PCERT_CHAIN_POLICY_STATUS);
  60
  61
  62 static void testCreateCertChainEngine(void)
  63 {
  64     BOOL ret;
  65     CERT_CHAIN_ENGINE_CONFIG config = { 0 };
  66     HCERTCHAINENGINE engine;
  67     HCERTSTORE store;
  68
  69     if (!pCertCreateCertificateChainEngine || !pCertFreeCertificateChainEngine)
  70     {
  71         win_skip("Cert*CertificateChainEngine() functions are not available\n");
  72         return;
  73     }
  74
  75     /* Crash
  76     ret = pCertCreateCertificateChainEngine(NULL, NULL);
  77     ret = pCertCreateCertificateChainEngine(NULL, &engine);
  78     ret = pCertCreateCertificateChainEngine(&config, NULL);
  79      */
  80     ret = pCertCreateCertificateChainEngine(&config, &engine);
  81     ok(!ret && GetLastError() == E_INVALIDARG,
  82      "Expected E_INVALIDARG, got %08x\n", GetLastError());
  83     /* Crashes
  84     config.cbSize = sizeof(config);
  85     ret = pCertCreateCertificateChainEngine(&config, NULL);
  86      */
  87     config.cbSize = sizeof(config);
  88     ret = pCertCreateCertificateChainEngine(&config, &engine);
  89     ok(ret, "CertCreateCertificateChainEngine failed: %08x\n", GetLastError());
  90     pCertFreeCertificateChainEngine(engine);
  91     config.dwFlags = 0xff000000;
  92     ret = pCertCreateCertificateChainEngine(&config, &engine);
  93     ok(ret, "CertCreateCertificateChainEngine failed: %08x\n", GetLastError());
  94     pCertFreeCertificateChainEngine(engine);
  95
  96     /* Creating a cert with no root certs at all is allowed.. */
  97     store = CertOpenStore(CERT_STORE_PROV_MEMORY, 0, 0,
  98      CERT_STORE_CREATE_NEW_FLAG, NULL);
  99     config.hRestrictedRoot = store;
 100     ret = pCertCreateCertificateChainEngine(&config, &engine);
 101     ok(ret, "CertCreateCertificateChainEngine failed: %08x\n", GetLastError());
 102     pCertFreeCertificateChainEngine(engine);
 103
 104     /* but creating one with a restricted root with a cert that isn't a member
 105      * of the Root store isn't allowed.
 106      */
 107     CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING, selfSignedCert,
 108      sizeof(selfSignedCert), CERT_STORE_ADD_ALWAYS, NULL);
 109     ret = pCertCreateCertificateChainEngine(&config, &engine);
 110     ok(!ret && GetLastError() == CRYPT_E_NOT_FOUND,
 111      "Expected CRYPT_E_NOT_FOUND, got %08x\n", GetLastError());
 112
 113     CertCloseStore(store, 0);
 114 }
 115
 116 static const BYTE bigCert[] = { 0x30, 0x7a, 0x02, 0x01, 0x01, 0x30, 0x02, 0x06,
 117  0x00, 0x30, 0x15, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13,
 118  0x0a, 0x4a, 0x75, 0x61, 0x6e, 0x20, 0x4c, 0x61, 0x6e, 0x67, 0x00, 0x30, 0x22,
 119  0x18, 0x0f, 0x31, 0x36, 0x30, 0x31, 0x30, 0x31, 0x30, 0x31, 0x30, 0x30, 0x30,
 120  0x30, 0x30, 0x30, 0x5a, 0x18, 0x0f, 0x31, 0x36, 0x30, 0x31, 0x30, 0x31, 0x30,
 121  0x31, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x5a, 0x30, 0x15, 0x31, 0x13, 0x30,
 122  0x11, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x0a, 0x4a, 0x75, 0x61, 0x6e, 0x20,
 123  0x4c, 0x61, 0x6e, 0x67, 0x00, 0x30, 0x07, 0x30, 0x02, 0x06, 0x00, 0x03, 0x01,
 124  0x00, 0xa3, 0x16, 0x30, 0x14, 0x30, 0x12, 0x06, 0x03, 0x55, 0x1d, 0x13, 0x01,
 125  0x01, 0xff, 0x04, 0x08, 0x30, 0x06, 0x01, 0x01, 0xff, 0x02, 0x01, 0x01 };
 126 static const BYTE iTunesCert0[] = {
 127 0x30,0x82,0x04,0xbf,0x30,0x82,0x04,0x28,0xa0,0x03,0x02,0x01,0x02,0x02,0x10,
 128 0x41,0x91,0xa1,0x5a,0x39,0x78,0xdf,0xcf,0x49,0x65,0x66,0x38,0x1d,0x4c,0x75,
 129 0xc2,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x05,
 130 0x00,0x30,0x5f,0x31,0x0b,0x30,0x09,0x06,0x03,0x55,0x04,0x06,0x13,0x02,0x55,
 131 0x53,0x31,0x17,0x30,0x15,0x06,0x03,0x55,0x04,0x0a,0x13,0x0e,0x56,0x65,0x72,
 132 0x69,0x53,0x69,0x67,0x6e,0x2c,0x20,0x49,0x6e,0x63,0x2e,0x31,0x37,0x30,0x35,
 133 0x06,0x03,0x55,0x04,0x0b,0x13,0x2e,0x43,0x6c,0x61,0x73,0x73,0x20,0x33,0x20,
 134 0x50,0x75,0x62,0x6c,0x69,0x63,0x20,0x50,0x72,0x69,0x6d,0x61,0x72,0x79,0x20,
 135 0x43,0x65,0x72,0x74,0x69,0x66,0x69,0x63,0x61,0x74,0x69,0x6f,0x6e,0x20,0x41,
 136 0x75,0x74,0x68,0x6f,0x72,0x69,0x74,0x79,0x30,0x1e,0x17,0x0d,0x30,0x34,0x30,
 137 0x37,0x31,0x36,0x30,0x30,0x30,0x30,0x30,0x30,0x5a,0x17,0x0d,0x31,0x34,0x30,
 138 0x37,0x31,0x35,0x32,0x33,0x35,0x39,0x35,0x39,0x5a,0x30,0x81,0xb4,0x31,0x0b,
 139 0x30,0x09,0x06,0x03,0x55,0x04,0x06,0x13,0x02,0x55,0x53,0x31,0x17,0x30,0x15,
 140 0x06,0x03,0x55,0x04,0x0a,0x13,0x0e,0x56,0x65,0x72,0x69,0x53,0x69,0x67,0x6e,
 141 0x2c,0x20,0x49,0x6e,0x63,0x2e,0x31,0x1f,0x30,0x1d,0x06,0x03,0x55,0x04,0x0b,
 142 0x13,0x16,0x56,0x65,0x72,0x69,0x53,0x69,0x67,0x6e,0x20,0x54,0x72,0x75,0x73,
 143 0x74,0x20,0x4e,0x65,0x74,0x77,0x6f,0x72,0x6b,0x31,0x3b,0x30,0x39,0x06,0x03,
 144 0x55,0x04,0x0b,0x13,0x32,0x54,0x65,0x72,0x6d,0x73,0x20,0x6f,0x66,0x20,0x75,
 145 0x73,0x65,0x20,0x61,0x74,0x20,0x68,0x74,0x74,0x70,0x73,0x3a,0x2f,0x2f,0x77,
 146 0x77,0x77,0x2e,0x76,0x65,0x72,0x69,0x73,0x69,0x67,0x6e,0x2e,0x63,0x6f,0x6d,
 147 0x2f,0x72,0x70,0x61,0x20,0x28,0x63,0x29,0x30,0x34,0x31,0x2e,0x30,0x2c,0x06,
 148 0x03,0x55,0x04,0x03,0x13,0x25,0x56,0x65,0x72,0x69,0x53,0x69,0x67,0x6e,0x20,
 149 0x43,0x6c,0x61,0x73,0x73,0x20,0x33,0x20,0x43,0x6f,0x64,0x65,0x20,0x53,0x69,
 150 0x67,0x6e,0x69,0x6e,0x67,0x20,0x32,0x30,0x30,0x34,0x20,0x43,0x41,0x30,0x82,
 151 0x01,0x22,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x01,
 152 0x05,0x00,0x03,0x82,0x01,0x0f,0x00,0x30,0x82,0x01,0x0a,0x02,0x82,0x01,0x01,
 153 0x00,0xbe,0xbc,0xee,0xbc,0x7e,0xef,0x83,0xeb,0xe0,0x37,0x4f,0xfb,0x03,0x10,
 154 0x38,0xbe,0x08,0xd2,0x8c,0x7d,0x9d,0xfa,0x92,0x7f,0x19,0x0c,0xc2,0x6b,0xee,
 155 0x42,0x52,0x8c,0xde,0xd3,0x1c,0x48,0x13,0x25,0xea,0xc1,0x63,0x7a,0xf9,0x51,
 156 0x65,0xee,0xd3,0xaa,0x3b,0xf5,0xf0,0x94,0x9c,0x2b,0xfb,0xf2,0x66,0xd4,0x24,
 157 0xda,0xf7,0xf5,0x9f,0x6e,0x19,0x39,0x36,0xbc,0xd0,0xa3,0x76,0x08,0x1e,0x22,
 158 0x27,0x24,0x6c,0x38,0x91,0x27,0xe2,0x84,0x49,0xae,0x1b,0x8a,0xa1,0xfd,0x25,
 159 0x82,0x2c,0x10,0x30,0xe8,0x71,0xab,0x28,0xe8,0x77,0x4a,0x51,0xf1,0xec,0xcd,
 160 0xf8,0xf0,0x54,0xd4,0x6f,0xc0,0xe3,0x6d,0x0a,0x8f,0xd9,0xd8,0x64,0x8d,0x63,
 161 0xb2,0x2d,0x4e,0x27,0xf6,0x85,0x0e,0xfe,0x6d,0xe3,0x29,0x99,0xe2,0x85,0x47,
 162 0x7c,0x2d,0x86,0x7f,0xe8,0x57,0x8f,0xad,0x67,0xc2,0x33,0x32,0x91,0x13,0x20,
 163 0xfc,0xa9,0x23,0x14,0x9a,0x6d,0xc2,0x84,0x4b,0x76,0x68,0x04,0xd5,0x71,0x2c,
 164 0x5d,0x21,0xfa,0x88,0x0d,0x26,0xfd,0x1f,0x2d,0x91,0x2b,0xe7,0x01,0x55,0x4d,
 165 0xf2,0x6d,0x35,0x28,0x82,0xdf,0xd9,0x6b,0x5c,0xb6,0xd6,0xd9,0xaa,0x81,0xfd,
 166 0x5f,0xcd,0x83,0xba,0x63,0x9d,0xd0,0x22,0xfc,0xa9,0x3b,0x42,0x69,0xb2,0x8e,
 167 0x3a,0xb5,0xbc,0xb4,0x9e,0x0f,0x5e,0xc4,0xea,0x2c,0x82,0x8b,0x28,0xfd,0x53,
 168 0x08,0x96,0xdd,0xb5,0x01,0x20,0xd1,0xf9,0xa5,0x18,0xe7,0xc0,0xee,0x51,0x70,
 169 0x37,0xe1,0xb6,0x05,0x48,0x52,0x48,0x6f,0x38,0xea,0xc3,0xe8,0x6c,0x7b,0x44,
 170 0x84,0xbb,0x02,0x03,0x01,0x00,0x01,0xa3,0x82,0x01,0xa0,0x30,0x82,0x01,0x9c,
 171 0x30,0x12,0x06,0x03,0x55,0x1d,0x13,0x01,0x01,0xff,0x04,0x08,0x30,0x06,0x01,
 172 0x01,0xff,0x02,0x01,0x00,0x30,0x44,0x06,0x03,0x55,0x1d,0x20,0x04,0x3d,0x30,
 173 0x3b,0x30,0x39,0x06,0x0b,0x60,0x86,0x48,0x01,0x86,0xf8,0x45,0x01,0x07,0x17,
 174 0x03,0x30,0x2a,0x30,0x28,0x06,0x08,0x2b,0x06,0x01,0x05,0x05,0x07,0x02,0x01,
 175 0x16,0x1c,0x68,0x74,0x74,0x70,0x73,0x3a,0x2f,0x2f,0x77,0x77,0x77,0x2e,0x76,
 176 0x65,0x72,0x69,0x73,0x69,0x67,0x6e,0x2e,0x63,0x6f,0x6d,0x2f,0x72,0x70,0x61,
 177 0x30,0x31,0x06,0x03,0x55,0x1d,0x1f,0x04,0x2a,0x30,0x28,0x30,0x26,0xa0,0x24,
 178 0xa0,0x22,0x86,0x20,0x68,0x74,0x74,0x70,0x3a,0x2f,0x2f,0x63,0x72,0x6c,0x2e,
 179 0x76,0x65,0x72,0x69,0x73,0x69,0x67,0x6e,0x2e,0x63,0x6f,0x6d,0x2f,0x70,0x63,
 180 0x61,0x33,0x2e,0x63,0x72,0x6c,0x30,0x1d,0x06,0x03,0x55,0x1d,0x25,0x04,0x16,
 181 0x30,0x14,0x06,0x08,0x2b,0x06,0x01,0x05,0x05,0x07,0x03,0x02,0x06,0x08,0x2b,
 182 0x06,0x01,0x05,0x05,0x07,0x03,0x03,0x30,0x0e,0x06,0x03,0x55,0x1d,0x0f,0x01,
 183 0x01,0xff,0x04,0x04,0x03,0x02,0x01,0x06,0x30,0x11,0x06,0x09,0x60,0x86,0x48,
 184 0x01,0x86,0xf8,0x42,0x01,0x01,0x04,0x04,0x03,0x02,0x00,0x01,0x30,0x29,0x06,
 185 0x03,0x55,0x1d,0x11,0x04,0x22,0x30,0x20,0xa4,0x1e,0x30,0x1c,0x31,0x1a,0x30,
 186 0x18,0x06,0x03,0x55,0x04,0x03,0x13,0x11,0x43,0x6c,0x61,0x73,0x73,0x33,0x43,
 187 0x41,0x32,0x30,0x34,0x38,0x2d,0x31,0x2d,0x34,0x33,0x30,0x1d,0x06,0x03,0x55,
 188 0x1d,0x0e,0x04,0x16,0x04,0x14,0x08,0xf5,0x51,0xe8,0xfb,0xfe,0x3d,0x3d,0x64,
 189 0x36,0x7c,0x68,0xcf,0x5b,0x78,0xa8,0xdf,0xb9,0xc5,0x37,0x30,0x81,0x80,0x06,
 190 0x03,0x55,0x1d,0x23,0x04,0x79,0x30,0x77,0xa1,0x63,0xa4,0x61,0x30,0x5f,0x31,
 191 0x0b,0x30,0x09,0x06,0x03,0x55,0x04,0x06,0x13,0x02,0x55,0x53,0x31,0x17,0x30,
 192 0x15,0x06,0x03,0x55,0x04,0x0a,0x13,0x0e,0x56,0x65,0x72,0x69,0x53,0x69,0x67,
 193 0x6e,0x2c,0x20,0x49,0x6e,0x63,0x2e,0x31,0x37,0x30,0x35,0x06,0x03,0x55,0x04,
 194 0x0b,0x13,0x2e,0x43,0x6c,0x61,0x73,0x73,0x20,0x33,0x20,0x50,0x75,0x62,0x6c,
 195 0x69,0x63,0x20,0x50,0x72,0x69,0x6d,0x61,0x72,0x79,0x20,0x43,0x65,0x72,0x74,
 196 0x69,0x66,0x69,0x63,0x61,0x74,0x69,0x6f,0x6e,0x20,0x41,0x75,0x74,0x68,0x6f,
 197 0x72,0x69,0x74,0x79,0x82,0x10,0x70,0xba,0xe4,0x1d,0x10,0xd9,0x29,0x34,0xb6,
 198 0x38,0xca,0x7b,0x03,0xcc,0xba,0xbf,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,
 199 0xf7,0x0d,0x01,0x01,0x05,0x05,0x00,0x03,0x81,0x81,0x00,0xae,0x3a,0x17,0xb8,
 200 0x4a,0x7b,0x55,0xfa,0x64,0x55,0xec,0x40,0xa4,0xed,0x49,0x41,0x90,0x99,0x9c,
 201 0x89,0xbc,0xaf,0x2e,0x1d,0xca,0x78,0x23,0xf9,0x1c,0x19,0x0f,0x7f,0xeb,0x68,
 202 0xbc,0x32,0xd9,0x88,0x38,0xde,0xdc,0x3f,0xd3,0x89,0xb4,0x3f,0xb1,0x82,0x96,
 203 0xf1,0xa4,0x5a,0xba,0xed,0x2e,0x26,0xd3,0xde,0x7c,0x01,0x6e,0x00,0x0a,0x00,
 204 0xa4,0x06,0x92,0x11,0x48,0x09,0x40,0xf9,0x1c,0x18,0x79,0x67,0x23,0x24,0xe0,
 205 0xbb,0xd5,0xe1,0x50,0xae,0x1b,0xf5,0x0e,0xdd,0xe0,0x2e,0x81,0xcd,0x80,0xa3,
 206 0x6c,0x52,0x4f,0x91,0x75,0x55,0x8a,0xba,0x22,0xf2,0xd2,0xea,0x41,0x75,0x88,
 207 0x2f,0x63,0x55,0x7d,0x1e,0x54,0x5a,0x95,0x59,0xca,0xd9,0x34,0x81,0xc0,0x5f,
 208 0x5e,0xf6,0x7a,0xb5 };
 209 static const BYTE iTunesCert1[] = {
 210 0x30,0x82,0x04,0xf1,0x30,0x82,0x03,0xd9,0xa0,0x03,0x02,0x01,0x02,0x02,0x10,
 211 0x0f,0x1a,0xa0,0xe0,0x9b,0x9b,0x61,0xa6,0xb6,0xfe,0x40,0xd2,0xdf,0x6a,0xf6,
 212 0x8d,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x05,
 213 0x00,0x30,0x81,0xb4,0x31,0x0b,0x30,0x09,0x06,0x03,0x55,0x04,0x06,0x13,0x02,
 214 0x55,0x53,0x31,0x17,0x30,0x15,0x06,0x03,0x55,0x04,0x0a,0x13,0x0e,0x56,0x65,
 215 0x72,0x69,0x53,0x69,0x67,0x6e,0x2c,0x20,0x49,0x6e,0x63,0x2e,0x31,0x1f,0x30,
 216 0x1d,0x06,0x03,0x55,0x04,0x0b,0x13,0x16,0x56,0x65,0x72,0x69,0x53,0x69,0x67,
 217 0x6e,0x20,0x54,0x72,0x75,0x73,0x74,0x20,0x4e,0x65,0x74,0x77,0x6f,0x72,0x6b,
 218 0x31,0x3b,0x30,0x39,0x06,0x03,0x55,0x04,0x0b,0x13,0x32,0x54,0x65,0x72,0x6d,
 219 0x73,0x20,0x6f,0x66,0x20,0x75,0x73,0x65,0x20,0x61,0x74,0x20,0x68,0x74,0x74,
 220 0x70,0x73,0x3a,0x2f,0x2f,0x77,0x77,0x77,0x2e,0x76,0x65,0x72,0x69,0x73,0x69,
 221 0x67,0x6e,0x2e,0x63,0x6f,0x6d,0x2f,0x72,0x70,0x61,0x20,0x28,0x63,0x29,0x30,
 222 0x34,0x31,0x2e,0x30,0x2c,0x06,0x03,0x55,0x04,0x03,0x13,0x25,0x56,0x65,0x72,
 223 0x69,0x53,0x69,0x67,0x6e,0x20,0x43,0x6c,0x61,0x73,0x73,0x20,0x33,0x20,0x43,
 224 0x6f,0x64,0x65,0x20,0x53,0x69,0x67,0x6e,0x69,0x6e,0x67,0x20,0x32,0x30,0x30,
 225 0x34,0x20,0x43,0x41,0x30,0x1e,0x17,0x0d,0x30,0x36,0x30,0x31,0x31,0x37,0x30,
 226 0x30,0x30,0x30,0x30,0x30,0x5a,0x17,0x0d,0x30,0x38,0x30,0x31,0x32,0x32,0x32,
 227 0x33,0x35,0x39,0x35,0x39,0x5a,0x30,0x81,0xb4,0x31,0x0b,0x30,0x09,0x06,0x03,
 228 0x55,0x04,0x06,0x13,0x02,0x55,0x53,0x31,0x13,0x30,0x11,0x06,0x03,0x55,0x04,
 229 0x08,0x13,0x0a,0x43,0x61,0x6c,0x69,0x66,0x6f,0x72,0x6e,0x69,0x61,0x31,0x12,
 230 0x30,0x10,0x06,0x03,0x55,0x04,0x07,0x13,0x09,0x43,0x75,0x70,0x65,0x72,0x74,
 231 0x69,0x6e,0x6f,0x31,0x1d,0x30,0x1b,0x06,0x03,0x55,0x04,0x0a,0x14,0x14,0x41,
 232 0x70,0x70,0x6c,0x65,0x20,0x43,0x6f,0x6d,0x70,0x75,0x74,0x65,0x72,0x2c,0x20,
 233 0x49,0x6e,0x63,0x2e,0x31,0x3e,0x30,0x3c,0x06,0x03,0x55,0x04,0x0b,0x13,0x35,
 234 0x44,0x69,0x67,0x69,0x74,0x61,0x6c,0x20,0x49,0x44,0x20,0x43,0x6c,0x61,0x73,
 235 0x73,0x20,0x33,0x20,0x2d,0x20,0x4d,0x69,0x63,0x72,0x6f,0x73,0x6f,0x66,0x74,
 236 0x20,0x53,0x6f,0x66,0x74,0x77,0x61,0x72,0x65,0x20,0x56,0x61,0x6c,0x69,0x64,
 237 0x61,0x74,0x69,0x6f,0x6e,0x20,0x76,0x32,0x31,0x1d,0x30,0x1b,0x06,0x03,0x55,
 238 0x04,0x03,0x14,0x14,0x41,0x70,0x70,0x6c,0x65,0x20,0x43,0x6f,0x6d,0x70,0x75,
 239 0x74,0x65,0x72,0x2c,0x20,0x49,0x6e,0x63,0x2e,0x30,0x81,0x9f,0x30,0x0d,0x06,
 240 0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x01,0x05,0x00,0x03,0x81,0x8d,
 241 0x00,0x30,0x81,0x89,0x02,0x81,0x81,0x00,0xd3,0xab,0x3b,0x7f,0xec,0x48,0x84,
 242 0xce,0xa8,0x1a,0x12,0xf3,0x3c,0x87,0xcb,0x24,0x58,0x96,0x02,0x87,0x66,0x49,
 243 0xeb,0x89,0xee,0x79,0x44,0x70,0x8d,0xe7,0xd4,0x1f,0x30,0x92,0xc0,0x9c,0x35,
 244 0x78,0xc0,0xaf,0x1c,0xb6,0x28,0xd3,0xe0,0xe0,0x9d,0xd3,0x49,0x76,0x73,0x57,
 245 0x19,0x4d,0x8d,0x70,0x85,0x64,0x4d,0x1d,0xc6,0x02,0x3e,0xe5,0x2c,0x66,0x07,
 246 0xd2,0x27,0x4b,0xd6,0xc8,0x3c,0x93,0xb6,0x15,0x0c,0xde,0x5b,0xd7,0x93,0xdd,
 247 0xbe,0x85,0x62,0x34,0x17,0x8a,0x05,0x60,0xf0,0x8a,0x1c,0x5a,0x40,0x21,0x8d,
 248 0x51,0x6c,0xb0,0x62,0xd8,0xb5,0xd4,0xf9,0xb1,0xd0,0x58,0x7a,0x7a,0x82,0x55,
 249 0xb3,0xf9,0x53,0x71,0xde,0xd2,0xc9,0x37,0x8c,0xf6,0x5a,0x1f,0x2d,0xcd,0x7c,
 250 0x67,0x02,0x03,0x01,0x00,0x01,0xa3,0x82,0x01,0x7f,0x30,0x82,0x01,0x7b,0x30,
 251 0x09,0x06,0x03,0x55,0x1d,0x13,0x04,0x02,0x30,0x00,0x30,0x0e,0x06,0x03,0x55,
 252 0x1d,0x0f,0x01,0x01,0xff,0x04,0x04,0x03,0x02,0x07,0x80,0x30,0x40,0x06,0x03,
 253 0x55,0x1d,0x1f,0x04,0x39,0x30,0x37,0x30,0x35,0xa0,0x33,0xa0,0x31,0x86,0x2f,
 254 0x68,0x74,0x74,0x70,0x3a,0x2f,0x2f,0x43,0x53,0x43,0x33,0x2d,0x32,0x30,0x30,
 255 0x34,0x2d,0x63,0x72,0x6c,0x2e,0x76,0x65,0x72,0x69,0x73,0x69,0x67,0x6e,0x2e,
 256 0x63,0x6f,0x6d,0x2f,0x43,0x53,0x43,0x33,0x2d,0x32,0x30,0x30,0x34,0x2e,0x63,
 257 0x72,0x6c,0x30,0x44,0x06,0x03,0x55,0x1d,0x20,0x04,0x3d,0x30,0x3b,0x30,0x39,
 258 0x06,0x0b,0x60,0x86,0x48,0x01,0x86,0xf8,0x45,0x01,0x07,0x17,0x03,0x30,0x2a,
 259 0x30,0x28,0x06,0x08,0x2b,0x06,0x01,0x05,0x05,0x07,0x02,0x01,0x16,0x1c,0x68,
 260 0x74,0x74,0x70,0x73,0x3a,0x2f,0x2f,0x77,0x77,0x77,0x2e,0x76,0x65,0x72,0x69,
 261 0x73,0x69,0x67,0x6e,0x2e,0x63,0x6f,0x6d,0x2f,0x72,0x70,0x61,0x30,0x13,0x06,
 262 0x03,0x55,0x1d,0x25,0x04,0x0c,0x30,0x0a,0x06,0x08,0x2b,0x06,0x01,0x05,0x05,
 263 0x07,0x03,0x03,0x30,0x75,0x06,0x08,0x2b,0x06,0x01,0x05,0x05,0x07,0x01,0x01,
 264 0x04,0x69,0x30,0x67,0x30,0x24,0x06,0x08,0x2b,0x06,0x01,0x05,0x05,0x07,0x30,
 265 0x01,0x86,0x18,0x68,0x74,0x74,0x70,0x3a,0x2f,0x2f,0x6f,0x63,0x73,0x70,0x2e,
 266 0x76,0x65,0x72,0x69,0x73,0x69,0x67,0x6e,0x2e,0x63,0x6f,0x6d,0x30,0x3f,0x06,
 267 0x08,0x2b,0x06,0x01,0x05,0x05,0x07,0x30,0x02,0x86,0x33,0x68,0x74,0x74,0x70,
 268 0x3a,0x2f,0x2f,0x43,0x53,0x43,0x33,0x2d,0x32,0x30,0x30,0x34,0x2d,0x61,0x69,
 269 0x61,0x2e,0x76,0x65,0x72,0x69,0x73,0x69,0x67,0x6e,0x2e,0x63,0x6f,0x6d,0x2f,
 270 0x43,0x53,0x43,0x33,0x2d,0x32,0x30,0x30,0x34,0x2d,0x61,0x69,0x61,0x2e,0x63,
 271 0x65,0x72,0x30,0x1f,0x06,0x03,0x55,0x1d,0x23,0x04,0x18,0x30,0x16,0x80,0x14,
 272 0x08,0xf5,0x51,0xe8,0xfb,0xfe,0x3d,0x3d,0x64,0x36,0x7c,0x68,0xcf,0x5b,0x78,
 273 0xa8,0xdf,0xb9,0xc5,0x37,0x30,0x11,0x06,0x09,0x60,0x86,0x48,0x01,0x86,0xf8,
 274 0x42,0x01,0x01,0x04,0x04,0x03,0x02,0x04,0x10,0x30,0x16,0x06,0x0a,0x2b,0x06,
 275 0x01,0x04,0x01,0x82,0x37,0x02,0x01,0x1b,0x04,0x08,0x30,0x06,0x01,0x01,0x00,
 276 0x01,0x01,0xff,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,
 277 0x05,0x05,0x00,0x03,0x82,0x01,0x01,0x00,0x6a,0xa6,0x06,0xd0,0x33,0x18,0x64,
 278 0xe2,0x69,0x82,0xee,0x6e,0x36,0x9e,0x9d,0x9a,0x0e,0x18,0xa8,0xac,0x9d,0x10,
 279 0xed,0x01,0x3c,0xb9,0x61,0x04,0x62,0xf3,0x85,0x8f,0xcc,0x4f,0x2c,0x66,0x35,
 280 0x54,0x25,0x45,0x8d,0x95,0x1c,0xd2,0x33,0xbe,0x2e,0xdd,0x7f,0x74,0xaf,0x03,
 281 0x7b,0x86,0x63,0xb0,0xc9,0xe6,0xbd,0xc7,0x8e,0xde,0x03,0x18,0x98,0x82,0xc3,
 282 0xbb,0xf8,0x15,0x99,0x1a,0xa9,0xdd,0xb9,0x5d,0xb9,0xbd,0x53,0x95,0x25,0x76,
 283 0xfb,0x5c,0x53,0x90,0xea,0x01,0x0a,0xa0,0xb1,0xbf,0x09,0x1b,0x97,0x8f,0x40,
 284 0xfa,0x85,0x12,0x74,0x01,0xdb,0xf6,0xdb,0x09,0xd6,0x5f,0x4f,0xd7,0x17,0xb4,
 285 0xbf,0x9e,0x2f,0x86,0x52,0x5d,0x70,0x24,0x52,0x32,0x1e,0xa5,0x1d,0x39,0x8b,
 286 0x66,0xf6,0xba,0x9b,0x69,0x8e,0x12,0x60,0xdb,0xb6,0xcf,0xe6,0x0d,0xd6,0x1c,
 287 0x8f,0xd4,0x5b,0x4b,0x00,0xde,0x21,0x93,0xfb,0x6e,0xc7,0x3d,0xb4,0x66,0x0d,
 288 0x29,0x0c,0x4e,0xe9,0x3f,0x94,0xd6,0xd6,0xdc,0xec,0xf8,0x53,0x3b,0x62,0xd5,
 289 0x97,0x50,0x53,0x84,0x17,0xfe,0xe2,0xed,0x4c,0x23,0x0a,0x49,0xce,0x5b,0xe9,
 290 0x70,0x31,0xc1,0x04,0x02,0x02,0x6c,0xb8,0x52,0xcd,0xc7,0x4e,0x70,0xb4,0x13,
 291 0xd7,0xe0,0x92,0xba,0x44,0x1a,0x10,0x4c,0x6e,0x45,0xc6,0x86,0x04,0xc6,0x64,
 292 0xd3,0x9c,0x6e,0xc1,0x9c,0xac,0x74,0x3d,0x77,0x06,0x5e,0x28,0x28,0x5c,0xf5,
 293 0xe0,0x9c,0x19,0xd8,0xba,0x74,0x81,0x2d,0x67,0x77,0x93,0x8d,0xbf,0xd2,0x52,
 294 0x00,0xe6,0xa5,0x38,0x4e,0x2e,0x73,0x66,0x7a };
 295 static const BYTE verisignCA[] = {
 296 0x30,0x82,0x02,0x3c,0x30,0x82,0x01,0xa5,0x02,0x10,0x70,0xba,0xe4,0x1d,0x10,
 297 0xd9,0x29,0x34,0xb6,0x38,0xca,0x7b,0x03,0xcc,0xba,0xbf,0x30,0x0d,0x06,0x09,
 298 0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x02,0x05,0x00,0x30,0x5f,0x31,0x0b,
 299 0x30,0x09,0x06,0x03,0x55,0x04,0x06,0x13,0x02,0x55,0x53,0x31,0x17,0x30,0x15,
 300 0x06,0x03,0x55,0x04,0x0a,0x13,0x0e,0x56,0x65,0x72,0x69,0x53,0x69,0x67,0x6e,
 301 0x2c,0x20,0x49,0x6e,0x63,0x2e,0x31,0x37,0x30,0x35,0x06,0x03,0x55,0x04,0x0b,
 302 0x13,0x2e,0x43,0x6c,0x61,0x73,0x73,0x20,0x33,0x20,0x50,0x75,0x62,0x6c,0x69,
 303 0x63,0x20,0x50,0x72,0x69,0x6d,0x61,0x72,0x79,0x20,0x43,0x65,0x72,0x74,0x69,
 304 0x66,0x69,0x63,0x61,0x74,0x69,0x6f,0x6e,0x20,0x41,0x75,0x74,0x68,0x6f,0x72,
 305 0x69,0x74,0x79,0x30,0x1e,0x17,0x0d,0x39,0x36,0x30,0x31,0x32,0x39,0x30,0x30,
 306 0x30,0x30,0x30,0x30,0x5a,0x17,0x0d,0x32,0x38,0x30,0x38,0x30,0x31,0x32,0x33,
 307 0x35,0x39,0x35,0x39,0x5a,0x30,0x5f,0x31,0x0b,0x30,0x09,0x06,0x03,0x55,0x04,
 308 0x06,0x13,0x02,0x55,0x53,0x31,0x17,0x30,0x15,0x06,0x03,0x55,0x04,0x0a,0x13,
 309 0x0e,0x56,0x65,0x72,0x69,0x53,0x69,0x67,0x6e,0x2c,0x20,0x49,0x6e,0x63,0x2e,
 310 0x31,0x37,0x30,0x35,0x06,0x03,0x55,0x04,0x0b,0x13,0x2e,0x43,0x6c,0x61,0x73,
 311 0x73,0x20,0x33,0x20,0x50,0x75,0x62,0x6c,0x69,0x63,0x20,0x50,0x72,0x69,0x6d,
 312 0x61,0x72,0x79,0x20,0x43,0x65,0x72,0x74,0x69,0x66,0x69,0x63,0x61,0x74,0x69,
 313 0x6f,0x6e,0x20,0x41,0x75,0x74,0x68,0x6f,0x72,0x69,0x74,0x79,0x30,0x81,0x9f,
 314 0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x01,0x05,0x00,
 315 0x03,0x81,0x8d,0x00,0x30,0x81,0x89,0x02,0x81,0x81,0x00,0xc9,0x5c,0x59,0x9e,
 316 0xf2,0x1b,0x8a,0x01,0x14,0xb4,0x10,0xdf,0x04,0x40,0xdb,0xe3,0x57,0xaf,0x6a,
 317 0x45,0x40,0x8f,0x84,0x0c,0x0b,0xd1,0x33,0xd9,0xd9,0x11,0xcf,0xee,0x02,0x58,
 318 0x1f,0x25,0xf7,0x2a,0xa8,0x44,0x05,0xaa,0xec,0x03,0x1f,0x78,0x7f,0x9e,0x93,
 319 0xb9,0x9a,0x00,0xaa,0x23,0x7d,0xd6,0xac,0x85,0xa2,0x63,0x45,0xc7,0x72,0x27,
 320 0xcc,0xf4,0x4c,0xc6,0x75,0x71,0xd2,0x39,0xef,0x4f,0x42,0xf0,0x75,0xdf,0x0a,
 321 0x90,0xc6,0x8e,0x20,0x6f,0x98,0x0f,0xf8,0xac,0x23,0x5f,0x70,0x29,0x36,0xa4,
 322 0xc9,0x86,0xe7,0xb1,0x9a,0x20,0xcb,0x53,0xa5,0x85,0xe7,0x3d,0xbe,0x7d,0x9a,
 323 0xfe,0x24,0x45,0x33,0xdc,0x76,0x15,0xed,0x0f,0xa2,0x71,0x64,0x4c,0x65,0x2e,
 324 0x81,0x68,0x45,0xa7,0x02,0x03,0x01,0x00,0x01,0x30,0x0d,0x06,0x09,0x2a,0x86,
 325 0x48,0x86,0xf7,0x0d,0x01,0x01,0x02,0x05,0x00,0x03,0x81,0x81,0x00,0xbb,0x4c,
 326 0x12,0x2b,0xcf,0x2c,0x26,0x00,0x4f,0x14,0x13,0xdd,0xa6,0xfb,0xfc,0x0a,0x11,
 327 0x84,0x8c,0xf3,0x28,0x1c,0x67,0x92,0x2f,0x7c,0xb6,0xc5,0xfa,0xdf,0xf0,0xe8,
 328 0x95,0xbc,0x1d,0x8f,0x6c,0x2c,0xa8,0x51,0xcc,0x73,0xd8,0xa4,0xc0,0x53,0xf0,
 329 0x4e,0xd6,0x26,0xc0,0x76,0x01,0x57,0x81,0x92,0x5e,0x21,0xf1,0xd1,0xb1,0xff,
 330 0xe7,0xd0,0x21,0x58,0xcd,0x69,0x17,0xe3,0x44,0x1c,0x9c,0x19,0x44,0x39,0x89,
 331 0x5c,0xdc,0x9c,0x00,0x0f,0x56,0x8d,0x02,0x99,0xed,0xa2,0x90,0x45,0x4c,0xe4,
 332 0xbb,0x10,0xa4,0x3d,0xf0,0x32,0x03,0x0e,0xf1,0xce,0xf8,0xe8,0xc9,0x51,0x8c,
 333 0xe6,0x62,0x9f,0xe6,0x9f,0xc0,0x7d,0xb7,0x72,0x9c,0xc9,0x36,0x3a,0x6b,0x9f,
 334 0x4e,0xa8,0xff,0x64,0x0d,0x64 };
 335 /* www.google.com's cert */
 336 static const BYTE google[] = {
 337 0x30,0x82,0x03,0x21,0x30,0x82,0x02,0x8a,0xa0,0x03,0x02,0x01,0x02,0x02,0x10,
 338 0x01,0x2a,0x39,0x76,0x0d,0x3f,0x4f,0xc9,0x0b,0xe7,0xbd,0x2b,0xcf,0x95,0x2e,
 339 0x7a,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x05,
 340 0x00,0x30,0x4c,0x31,0x0b,0x30,0x09,0x06,0x03,0x55,0x04,0x06,0x13,0x02,0x5a,
 341 0x41,0x31,0x25,0x30,0x23,0x06,0x03,0x55,0x04,0x0a,0x13,0x1c,0x54,0x68,0x61,
 342 0x77,0x74,0x65,0x20,0x43,0x6f,0x6e,0x73,0x75,0x6c,0x74,0x69,0x6e,0x67,0x20,
 343 0x28,0x50,0x74,0x79,0x29,0x20,0x4c,0x74,0x64,0x2e,0x31,0x16,0x30,0x14,0x06,
 344 0x03,0x55,0x04,0x03,0x13,0x0d,0x54,0x68,0x61,0x77,0x74,0x65,0x20,0x53,0x47,
 345 0x43,0x20,0x43,0x41,0x30,0x1e,0x17,0x0d,0x30,0x39,0x30,0x33,0x32,0x37,0x32,
 346 0x32,0x32,0x30,0x30,0x37,0x5a,0x17,0x0d,0x31,0x30,0x30,0x33,0x32,0x37,0x32,
 347 0x32,0x32,0x30,0x30,0x37,0x5a,0x30,0x68,0x31,0x0b,0x30,0x09,0x06,0x03,0x55,
 348 0x04,0x06,0x13,0x02,0x55,0x53,0x31,0x13,0x30,0x11,0x06,0x03,0x55,0x04,0x08,
 349 0x13,0x0a,0x43,0x61,0x6c,0x69,0x66,0x6f,0x72,0x6e,0x69,0x61,0x31,0x16,0x30,
 350 0x14,0x06,0x03,0x55,0x04,0x07,0x13,0x0d,0x4d,0x6f,0x75,0x6e,0x74,0x61,0x69,
 351 0x6e,0x20,0x56,0x69,0x65,0x77,0x31,0x13,0x30,0x11,0x06,0x03,0x55,0x04,0x0a,
 352 0x13,0x0a,0x47,0x6f,0x6f,0x67,0x6c,0x65,0x20,0x49,0x6e,0x63,0x31,0x17,0x30,
 353 0x15,0x06,0x03,0x55,0x04,0x03,0x13,0x0e,0x77,0x77,0x77,0x2e,0x67,0x6f,0x6f,
 354 0x67,0x6c,0x65,0x2e,0x63,0x6f,0x6d,0x30,0x81,0x9f,0x30,0x0d,0x06,0x09,0x2a,
 355 0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x01,0x05,0x00,0x03,0x81,0x8d,0x00,0x30,
 356 0x81,0x89,0x02,0x81,0x81,0x00,0xd6,0xb9,0xe1,0xad,0xb8,0x61,0x0b,0x1f,0x4e,
 357 0xb6,0x3c,0x09,0x3d,0xab,0xe8,0xe3,0x2b,0xb6,0xe8,0xa4,0x3a,0x78,0x2f,0xd3,
 358 0x51,0x20,0x22,0x45,0x95,0xd8,0x00,0x91,0x33,0x9a,0xa7,0xa2,0x48,0xea,0x30,
 359 0x57,0x26,0x97,0x66,0xc7,0x5a,0xef,0xf1,0x9b,0x0c,0x3f,0xe1,0xb9,0x7f,0x7b,
 360 0xc3,0xc7,0xcc,0xaf,0x9c,0xd0,0x1f,0x3c,0x81,0x15,0x10,0x58,0xfc,0x06,0xb3,
 361 0xbf,0xbc,0x9c,0x02,0xb9,0x51,0xdc,0xfb,0xa6,0xb9,0x17,0x42,0xe6,0x46,0xe7,
 362 0x22,0xcf,0x6c,0x27,0x10,0xfe,0x54,0xe6,0x92,0x6c,0x0c,0x60,0x76,0x9a,0xce,
 363 0xf8,0x7f,0xac,0xb8,0x5a,0x08,0x4a,0xdc,0xb1,0x64,0xbd,0xa0,0x74,0x41,0xb2,
 364 0xac,0x8f,0x86,0x9d,0x1a,0xde,0x58,0x09,0xfd,0x6c,0x0a,0x25,0xe0,0x79,0x02,
 365 0x03,0x01,0x00,0x01,0xa3,0x81,0xe7,0x30,0x81,0xe4,0x30,0x28,0x06,0x03,0x55,
 366 0x1d,0x25,0x04,0x21,0x30,0x1f,0x06,0x08,0x2b,0x06,0x01,0x05,0x05,0x07,0x03,
 367 0x01,0x06,0x08,0x2b,0x06,0x01,0x05,0x05,0x07,0x03,0x02,0x06,0x09,0x60,0x86,
 368 0x48,0x01,0x86,0xf8,0x42,0x04,0x01,0x30,0x36,0x06,0x03,0x55,0x1d,0x1f,0x04,
 369 0x2f,0x30,0x2d,0x30,0x2b,0xa0,0x29,0xa0,0x27,0x86,0x25,0x68,0x74,0x74,0x70,
 370 0x3a,0x2f,0x2f,0x63,0x72,0x6c,0x2e,0x74,0x68,0x61,0x77,0x74,0x65,0x2e,0x63,
 371 0x6f,0x6d,0x2f,0x54,0x68,0x61,0x77,0x74,0x65,0x53,0x47,0x43,0x43,0x41,0x2e,
 372 0x63,0x72,0x6c,0x30,0x72,0x06,0x08,0x2b,0x06,0x01,0x05,0x05,0x07,0x01,0x01,
 373 0x04,0x66,0x30,0x64,0x30,0x22,0x06,0x08,0x2b,0x06,0x01,0x05,0x05,0x07,0x30,
 374 0x01,0x86,0x16,0x68,0x74,0x74,0x70,0x3a,0x2f,0x2f,0x6f,0x63,0x73,0x70,0x2e,
 375 0x74,0x68,0x61,0x77,0x74,0x65,0x2e,0x63,0x6f,0x6d,0x30,0x3e,0x06,0x08,0x2b,
 376 0x06,0x01,0x05,0x05,0x07,0x30,0x02,0x86,0x32,0x68,0x74,0x74,0x70,0x3a,0x2f,
 377 0x2f,0x77,0x77,0x77,0x2e,0x74,0x68,0x61,0x77,0x74,0x65,0x2e,0x63,0x6f,0x6d,
 378 0x2f,0x72,0x65,0x70,0x6f,0x73,0x69,0x74,0x6f,0x72,0x79,0x2f,0x54,0x68,0x61,
 379 0x77,0x74,0x65,0x5f,0x53,0x47,0x43,0x5f,0x43,0x41,0x2e,0x63,0x72,0x74,0x30,
 380 0x0c,0x06,0x03,0x55,0x1d,0x13,0x01,0x01,0xff,0x04,0x02,0x30,0x00,0x30,0x0d,
 381 0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x05,0x00,0x03,0x81,
 382 0x81,0x00,0x39,0xb6,0xfb,0x11,0xbc,0x33,0x2c,0xc3,0x90,0x48,0xe3,0x6e,0xc3,
 383 0x9b,0x38,0xb1,0x42,0xd1,0x00,0x09,0x58,0x63,0xa0,0xe1,0x98,0x1c,0x85,0xf2,
 384 0xef,0x10,0x1d,0x60,0x4e,0x51,0x09,0x62,0xf5,0x05,0xbd,0x9d,0x4f,0x87,0x6c,
 385 0x98,0x72,0x07,0x80,0xc3,0x59,0x48,0x14,0xe2,0xd6,0xef,0xd0,0x8f,0x33,0x6a,
 386 0x68,0x31,0xfa,0xb7,0xbb,0x85,0xcc,0xf7,0xc7,0x47,0x7b,0x67,0x93,0x3c,0xc3,
 387 0x16,0x51,0x9b,0x6f,0x87,0x20,0xfd,0x67,0x4c,0x2b,0xea,0x6a,0x49,0xdb,0x11,
 388 0xd1,0xbd,0xd7,0x95,0x22,0x43,0x7a,0x06,0x7b,0x4e,0xf6,0x37,0x8e,0xa2,0xb9,
 389 0xcf,0x1f,0xa5,0xd2,0xbd,0x3b,0x04,0x97,0x39,0xb3,0x0f,0xfa,0x38,0xb5,0xaf,
 390 0x55,0x20,0x88,0x60,0x93,0xf2,0xde,0xdb,0xff,0xdf };
 391 static const BYTE thawte_sgc_ca[] = {
 392 0x30,0x82,0x03,0x23,0x30,0x82,0x02,0x8c,0xa0,0x03,0x02,0x01,0x02,0x02,0x04,
 393 0x30,0x00,0x00,0x02,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,
 394 0x01,0x05,0x05,0x00,0x30,0x5f,0x31,0x0b,0x30,0x09,0x06,0x03,0x55,0x04,0x06,
 395 0x13,0x02,0x55,0x53,0x31,0x17,0x30,0x15,0x06,0x03,0x55,0x04,0x0a,0x13,0x0e,
 396 0x56,0x65,0x72,0x69,0x53,0x69,0x67,0x6e,0x2c,0x20,0x49,0x6e,0x63,0x2e,0x31,
 397 0x37,0x30,0x35,0x06,0x03,0x55,0x04,0x0b,0x13,0x2e,0x43,0x6c,0x61,0x73,0x73,
 398 0x20,0x33,0x20,0x50,0x75,0x62,0x6c,0x69,0x63,0x20,0x50,0x72,0x69,0x6d,0x61,
 399 0x72,0x79,0x20,0x43,0x65,0x72,0x74,0x69,0x66,0x69,0x63,0x61,0x74,0x69,0x6f,
 400 0x6e,0x20,0x41,0x75,0x74,0x68,0x6f,0x72,0x69,0x74,0x79,0x30,0x1e,0x17,0x0d,
 401 0x30,0x34,0x30,0x35,0x31,0x33,0x30,0x30,0x30,0x30,0x30,0x30,0x5a,0x17,0x0d,
 402 0x31,0x34,0x30,0x35,0x31,0x32,0x32,0x33,0x35,0x39,0x35,0x39,0x5a,0x30,0x4c,
 403 0x31,0x0b,0x30,0x09,0x06,0x03,0x55,0x04,0x06,0x13,0x02,0x5a,0x41,0x31,0x25,
 404 0x30,0x23,0x06,0x03,0x55,0x04,0x0a,0x13,0x1c,0x54,0x68,0x61,0x77,0x74,0x65,
 405 0x20,0x43,0x6f,0x6e,0x73,0x75,0x6c,0x74,0x69,0x6e,0x67,0x20,0x28,0x50,0x74,
 406 0x79,0x29,0x20,0x4c,0x74,0x64,0x2e,0x31,0x16,0x30,0x14,0x06,0x03,0x55,0x04,
 407 0x03,0x13,0x0d,0x54,0x68,0x61,0x77,0x74,0x65,0x20,0x53,0x47,0x43,0x20,0x43,
 408 0x41,0x30,0x81,0x9f,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,
 409 0x01,0x01,0x05,0x00,0x03,0x81,0x8d,0x00,0x30,0x81,0x89,0x02,0x81,0x81,0x00,
 410 0xd4,0xd3,0x67,0xd0,0x8d,0x15,0x7f,0xae,0xcd,0x31,0xfe,0x7d,0x1d,0x91,0xa1,
 411 0x3f,0x0b,0x71,0x3c,0xac,0xcc,0xc8,0x64,0xfb,0x63,0xfc,0x32,0x4b,0x07,0x94,
 412 0xbd,0x6f,0x80,0xba,0x2f,0xe1,0x04,0x93,0xc0,0x33,0xfc,0x09,0x33,0x23,0xe9,
 413 0x0b,0x74,0x2b,0x71,0xc4,0x03,0xc6,0xd2,0xcd,0xe2,0x2f,0xf5,0x09,0x63,0xcd,
 414 0xff,0x48,0xa5,0x00,0xbf,0xe0,0xe7,0xf3,0x88,0xb7,0x2d,0x32,0xde,0x98,0x36,
 415 0xe6,0x0a,0xad,0x00,0x7b,0xc4,0x64,0x4a,0x3b,0x84,0x75,0x03,0xf2,0x70,0x92,
 416 0x7d,0x0e,0x62,0xf5,0x21,0xab,0x69,0x36,0x84,0x31,0x75,0x90,0xf8,0xbf,0xc7,
 417 0x6c,0x88,0x1b,0x06,0x95,0x7c,0xc9,0xe5,0xa8,0xde,0x75,0xa1,0x2c,0x7a,0x68,
 418 0xdf,0xd5,0xca,0x1c,0x87,0x58,0x60,0x19,0x02,0x03,0x01,0x00,0x01,0xa3,0x81,
 419 0xfe,0x30,0x81,0xfb,0x30,0x12,0x06,0x03,0x55,0x1d,0x13,0x01,0x01,0xff,0x04,
 420 0x08,0x30,0x06,0x01,0x01,0xff,0x02,0x01,0x00,0x30,0x0b,0x06,0x03,0x55,0x1d,
 421 0x0f,0x04,0x04,0x03,0x02,0x01,0x06,0x30,0x11,0x06,0x09,0x60,0x86,0x48,0x01,
 422 0x86,0xf8,0x42,0x01,0x01,0x04,0x04,0x03,0x02,0x01,0x06,0x30,0x28,0x06,0x03,
 423 0x55,0x1d,0x11,0x04,0x21,0x30,0x1f,0xa4,0x1d,0x30,0x1b,0x31,0x19,0x30,0x17,
 424 0x06,0x03,0x55,0x04,0x03,0x13,0x10,0x50,0x72,0x69,0x76,0x61,0x74,0x65,0x4c,
 425 0x61,0x62,0x65,0x6c,0x33,0x2d,0x31,0x35,0x30,0x31,0x06,0x03,0x55,0x1d,0x1f,
 426 0x04,0x2a,0x30,0x28,0x30,0x26,0xa0,0x24,0xa0,0x22,0x86,0x20,0x68,0x74,0x74,
 427 0x70,0x3a,0x2f,0x2f,0x63,0x72,0x6c,0x2e,0x76,0x65,0x72,0x69,0x73,0x69,0x67,
 428 0x6e,0x2e,0x63,0x6f,0x6d,0x2f,0x70,0x63,0x61,0x33,0x2e,0x63,0x72,0x6c,0x30,
 429 0x32,0x06,0x08,0x2b,0x06,0x01,0x05,0x05,0x07,0x01,0x01,0x04,0x26,0x30,0x24,
 430 0x30,0x22,0x06,0x08,0x2b,0x06,0x01,0x05,0x05,0x07,0x30,0x01,0x86,0x16,0x68,
 431 0x74,0x74,0x70,0x3a,0x2f,0x2f,0x6f,0x63,0x73,0x70,0x2e,0x74,0x68,0x61,0x77,
 432 0x74,0x65,0x2e,0x63,0x6f,0x6d,0x30,0x34,0x06,0x03,0x55,0x1d,0x25,0x04,0x2d,
 433 0x30,0x2b,0x06,0x08,0x2b,0x06,0x01,0x05,0x05,0x07,0x03,0x01,0x06,0x08,0x2b,
 434 0x06,0x01,0x05,0x05,0x07,0x03,0x02,0x06,0x09,0x60,0x86,0x48,0x01,0x86,0xf8,
 435 0x42,0x04,0x01,0x06,0x0a,0x60,0x86,0x48,0x01,0x86,0xf8,0x45,0x01,0x08,0x01,
 436 0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x05,0x00,
 437 0x03,0x81,0x81,0x00,0x55,0xac,0x63,0xea,0xde,0xa1,0xdd,0xd2,0x90,0x5f,0x9f,
 438 0x0b,0xce,0x76,0xbe,0x13,0x51,0x8f,0x93,0xd9,0x05,0x2b,0xc8,0x1b,0x77,0x4b,
 439 0xad,0x69,0x50,0xa1,0xee,0xde,0xdc,0xfd,0xdb,0x07,0xe9,0xe8,0x39,0x94,0xdc,
 440 0xab,0x72,0x79,0x2f,0x06,0xbf,0xab,0x81,0x70,0xc4,0xa8,0xed,0xea,0x53,0x34,
 441 0xed,0xef,0x1e,0x53,0xd9,0x06,0xc7,0x56,0x2b,0xd1,0x5c,0xf4,0xd1,0x8a,0x8e,
 442 0xb4,0x2b,0xb1,0x37,0x90,0x48,0x08,0x42,0x25,0xc5,0x3e,0x8a,0xcb,0x7f,0xeb,
 443 0x6f,0x04,0xd1,0x6d,0xc5,0x74,0xa2,0xf7,0xa2,0x7c,0x7b,0x60,0x3c,0x77,0xcd,
 444 0x0e,0xce,0x48,0x02,0x7f,0x01,0x2f,0xb6,0x9b,0x37,0xe0,0x2a,0x2a,0x36,0xdc,
 445 0xd5,0x85,0xd6,0xac,0xe5,0x3f,0x54,0x6f,0x96,0x1e,0x05,0xaf };
 446
 447 /* chain0_0 -> chain0_1:
 448  * A simple, valid chain
 449  */
 450 static const BYTE chain0_0[] = {
 451 0x30,0x82,0x01,0xc2,0x30,0x82,0x01,0x2d,0xa0,0x03,0x02,0x01,0x02,0x02,0x10,
 452 0x73,0x87,0xdb,0x32,0x3a,0x6c,0x89,0x74,0x0f,0xda,0x07,0xd4,0x6a,0x2c,0x81,
 453 0x59,0x30,0x0b,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x30,
 454 0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,0x43,0x65,0x72,
 455 0x74,0x31,0x30,0x1e,0x17,0x0d,0x30,0x37,0x30,0x31,0x30,0x31,0x30,0x30,0x30,
 456 0x30,0x30,0x30,0x5a,0x17,0x0d,0x30,0x37,0x31,0x32,0x33,0x31,0x32,0x33,0x35,
 457 0x39,0x35,0x39,0x5a,0x30,0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,
 458 0x13,0x05,0x43,0x65,0x72,0x74,0x31,0x30,0x81,0x9d,0x30,0x0b,0x06,0x09,0x2a,
 459 0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x01,0x03,0x81,0x8d,0x00,0x30,0x81,0x89,
 460 0x02,0x81,0x81,0x00,0xad,0x7e,0xca,0xf3,0xe5,0x99,0xc2,0x2a,0xca,0x50,0x82,
 461 0x7c,0x2d,0xa4,0x81,0xcd,0x0d,0x0d,0x86,0xd7,0xd8,0xb2,0xde,0xc5,0xc3,0x34,
 462 0x9e,0x07,0x78,0x08,0x11,0x12,0x2d,0x21,0x0a,0x09,0x07,0x14,0x03,0x7a,0xe7,
 463 0x3b,0x58,0xf1,0xde,0x3e,0x01,0x25,0x93,0xab,0x8f,0xce,0x1f,0xc1,0x33,0x91,
 464 0xfe,0x59,0xb9,0x3b,0x9e,0x95,0x12,0x89,0x8e,0xc3,0x4b,0x98,0x1b,0x99,0xc5,
 465 0x07,0xe2,0xdf,0x15,0x4c,0x39,0x76,0x06,0xad,0xdb,0x16,0x06,0x49,0xba,0xcd,
 466 0x0f,0x07,0xd6,0xea,0x27,0xa6,0xfe,0x3d,0x88,0xe5,0x97,0x45,0x72,0xb6,0x1c,
 467 0xc0,0x1c,0xb1,0xa2,0x89,0xe8,0x37,0x9e,0xf6,0x2a,0xcf,0xd5,0x1f,0x2f,0x35,
 468 0x5e,0x8f,0x3a,0x9c,0x61,0xb1,0xf1,0x6c,0xff,0x8c,0xb2,0x2f,0x02,0x03,0x01,
 469 0x00,0x01,0xa3,0x23,0x30,0x21,0x30,0x0e,0x06,0x03,0x55,0x1d,0x0f,0x01,0x01,
 470 0xff,0x04,0x04,0x03,0x02,0x00,0x04,0x30,0x0f,0x06,0x03,0x55,0x1d,0x13,0x01,
 471 0x01,0xff,0x04,0x05,0x30,0x03,0x01,0x01,0xff,0x30,0x0b,0x06,0x09,0x2a,0x86,
 472 0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x03,0x81,0x81,0x00,0x82,0xcd,0x5c,0x0a,
 473 0x9d,0x0d,0x3f,0xd1,0xd8,0x74,0xfc,0x52,0x65,0x11,0x76,0x10,0x62,0xb0,0x9a,
 474 0xc5,0x54,0x66,0xae,0xfa,0xd5,0x66,0x36,0xcb,0x1e,0xe7,0xad,0xb9,0xfa,0x2e,
 475 0xbb,0xb9,0x0b,0x4b,0xbf,0xe7,0x26,0x75,0x2c,0xae,0x2d,0x14,0x84,0x92,0xae,
 476 0x56,0xdf,0x55,0x56,0xf3,0xa6,0xc5,0x21,0xa8,0x5e,0xce,0x7a,0x9d,0xff,0x7f,
 477 0x10,0xd9,0xc3,0x05,0x52,0x86,0xdc,0x9b,0x46,0xe7,0x69,0xfb,0x1e,0xf0,0x68,
 478 0x7d,0x34,0xd7,0xf3,0x56,0xe3,0x0a,0xf3,0xe4,0xdc,0x0f,0xd6,0x4d,0xa8,0xc5,
 479 0xb5,0x5b,0xbf,0x0b,0x5d,0xe7,0x76,0xa1,0x56,0xc1,0xa7,0x55,0xa0,0x88,0x7f,
 480 0x57,0x8e,0x64,0xda,0x6f,0xaa,0x9c,0xca,0x47,0xf3,0x37,0x08,0x4b,0x9a,0xdc,
 481 0xbc,0x65,0x4d,0x9a };
 482 static const BYTE chain0_1[] = {
 483 0x30,0x82,0x01,0x98,0x30,0x82,0x01,0x01,0xa0,0x03,0x02,0x01,0x02,0x02,0x01,
 484 0x01,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x05,
 485 0x00,0x30,0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,0x43,
 486 0x65,0x72,0x74,0x31,0x30,0x22,0x18,0x0f,0x31,0x36,0x30,0x31,0x31,0x31,0x32,
 487 0x32,0x31,0x38,0x35,0x32,0x30,0x37,0x5a,0x18,0x0f,0x31,0x36,0x32,0x38,0x30,
 488 0x38,0x32,0x36,0x30,0x35,0x32,0x30,0x35,0x37,0x5a,0x30,0x10,0x31,0x0e,0x30,
 489 0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,0x43,0x65,0x72,0x74,0x32,0x30,0x81,
 490 0x9f,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x01,0x05,
 491 0x00,0x03,0x81,0x8d,0x00,0x30,0x81,0x89,0x02,0x81,0x81,0x00,0xb8,0x52,0xda,
 492 0xc5,0x4b,0x3f,0xe5,0x33,0x0e,0x67,0x5f,0x48,0x21,0xdc,0x7e,0xef,0x37,0x33,
 493 0xba,0xff,0xb4,0xc6,0xdc,0xb6,0x17,0x8e,0x20,0x55,0x07,0x12,0xd2,0x7b,0x3c,
 494 0xce,0x30,0xc5,0xa7,0x48,0x9f,0x6e,0xfe,0xb8,0xbe,0xdb,0x9f,0x9b,0x17,0x60,
 495 0x16,0xde,0xc6,0x8b,0x47,0xd1,0x57,0x71,0x3c,0x93,0xfc,0xbd,0xec,0x44,0x32,
 496 0x3b,0xb9,0xcf,0x6b,0x05,0x72,0xa7,0x87,0x8e,0x7e,0xd4,0x9a,0x87,0x1c,0x2f,
 497 0xb7,0x82,0x40,0xfc,0x6a,0x80,0x83,0x68,0x28,0xce,0x84,0xf4,0x0b,0x2e,0x44,
 498 0xcb,0x53,0xac,0x85,0x85,0xb5,0x46,0x36,0x98,0x3c,0x10,0x02,0xaa,0x02,0xbc,
 499 0x8b,0xa2,0x23,0xb2,0xd3,0x51,0x9a,0x22,0x4a,0xe3,0xaa,0x4e,0x7c,0xda,0x38,
 500 0xcf,0x49,0x98,0x72,0xa3,0x02,0x03,0x01,0x00,0x01,0x30,0x0d,0x06,0x09,0x2a,
 501 0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x05,0x00,0x03,0x81,0x81,0x00,0x3c,
 502 0x90,0x45,0x5b,0x81,0x25,0x9d,0x7a,0x10,0x9f,0x15,0x25,0x03,0x52,0x78,0x09,
 503 0x6f,0x62,0x66,0x78,0x01,0x69,0x6a,0x7f,0x19,0x02,0x18,0xd8,0xc0,0x89,0x2f,
 504 0x0f,0x47,0xa7,0x17,0xc2,0xd7,0xe2,0x81,0x7e,0xea,0x54,0xd4,0xe6,0xcc,0x8f,
 505 0x88,0x1a,0xee,0x28,0x42,0x6c,0x77,0xf5,0xec,0x8c,0x05,0xa5,0x7f,0xee,0x2e,
 506 0x0b,0xbc,0xde,0xb0,0x71,0x2c,0x83,0x32,0xcb,0x49,0x00,0x46,0x03,0x95,0x58,
 507 0x6c,0x57,0x0c,0x5a,0x69,0x3c,0xfa,0xbf,0x46,0x7a,0x4d,0xd0,0x23,0x77,0x23,
 508 0xac,0x1d,0x33,0xb7,0x87,0xb4,0xc6,0x6b,0x52,0xa1,0xed,0x9a,0xb8,0x8e,0x1a,
 509 0xcb,0xc3,0xd3,0x50,0xe0,0x0d,0x12,0x5d,0x0e,0x84,0x52,0xa5,0x12,0x76,0x6b,
 510 0xbf,0xb8,0xbe,0x51,0xc0,0xa6,0xae };
 511 /* chain0_0 -> chain1_1:
 512  * A chain whose signature is bad
 513  */
 514 static const BYTE chain1_1[] = {
 515 0x30,0x82,0x01,0x98,0x30,0x82,0x01,0x01,0xa0,0x03,0x02,0x01,0x02,0x02,0x01,
 516 0x01,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x05,
 517 0x00,0x30,0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,0x43,
 518 0x65,0x72,0x74,0x31,0x30,0x22,0x18,0x0f,0x31,0x36,0x30,0x31,0x31,0x31,0x32,
 519 0x32,0x31,0x38,0x35,0x32,0x30,0x37,0x5a,0x18,0x0f,0x31,0x36,0x32,0x38,0x30,
 520 0x38,0x32,0x36,0x30,0x35,0x32,0x30,0x35,0x37,0x5a,0x30,0x10,0x31,0x0e,0x30,
 521 0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,0x43,0x65,0x72,0x74,0x32,0x30,0x81,
 522 0x9f,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x01,0x05,
 523 0x00,0x03,0x81,0x8d,0x00,0x30,0x81,0x89,0x02,0x81,0x81,0x00,0xad,0x7e,0xca,
 524 0xf3,0xe5,0x99,0xc2,0x2a,0xca,0x50,0x82,0x7c,0x2d,0xa4,0x81,0xcd,0x0d,0x0d,
 525 0x86,0xd7,0xd8,0xb2,0xde,0xc5,0xc3,0x34,0x9e,0x07,0x78,0x08,0x11,0x12,0x2d,
 526 0x21,0x0a,0x09,0x07,0x14,0x03,0x7a,0xe7,0x3b,0x58,0xf1,0xde,0x3e,0x01,0x25,
 527 0x93,0xab,0x8f,0xce,0x1f,0xc1,0x33,0x91,0xfe,0x59,0xb9,0x3b,0x9e,0x95,0x12,
 528 0x89,0x8e,0xc3,0x4b,0x98,0x1b,0x99,0xc5,0x07,0xe2,0xdf,0x15,0x4c,0x39,0x76,
 529 0x06,0xad,0xdb,0x16,0x06,0x49,0xba,0xcd,0x0f,0x07,0xd6,0xea,0x27,0xa6,0xfe,
 530 0x3d,0x88,0xe5,0x97,0x45,0x72,0xb6,0x1c,0xc0,0x1c,0xb1,0xa2,0x89,0xe8,0x37,
 531 0x9e,0xf6,0x2a,0xcf,0xd5,0x1f,0x2f,0x35,0x5e,0x8f,0x3a,0x9c,0x61,0xb1,0xf1,
 532 0x6c,0xff,0x8c,0xb2,0x2f,0x02,0x03,0x01,0x00,0x01,0x30,0x0d,0x06,0x09,0x2a,
 533 0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x05,0x00,0x03,0x81,0x81,0x00,0xad,
 534 0x16,0xaa,0x77,0xab,0xd5,0x1a,0x6c,0x90,0x5d,0x4e,0x61,0x49,0x89,0x6e,0x9f,
 535 0x03,0x7b,0x4a,0x49,0xb1,0x46,0x75,0xf3,0x69,0xeb,0x96,0x13,0x3c,0x35,0xb5,
 536 0x37,0x3b,0xc2,0x84,0x5c,0xe5,0x7c,0x46,0xf6,0x6b,0xc7,0x4e,0x72,0x91,0xf4,
 537 0xde,0xc5,0x66,0x0f,0x2d,0x39,0xc6,0x9e,0x8e,0x25,0x4d,0x3f,0x7b,0x45,0xe1,
 538 0xc6,0x1a,0x7e,0x28,0x83,0xf8,0x87,0x30,0x4e,0xa5,0xfd,0x32,0x7a,0xed,0x53,
 539 0x10,0x3b,0x14,0xe5,0xf1,0x32,0x77,0xf1,0x29,0x72,0x98,0x2b,0xa3,0x17,0xd6,
 540 0x8c,0x65,0xaa,0x3b,0x6d,0xab,0xb3,0xbe,0xfa,0x72,0x38,0xf7,0xd0,0xb6,0x0f,
 541 0x5c,0x0d,0xec,0x17,0x43,0x2a,0xfd,0xc1,0x01,0x43,0x98,0xd3,0x1b,0x84,0x3e,
 542 0x32,0xcf,0xda,0x1d,0xc2,0xc9,0x61 };
 543 /* chain2_0 -> chain0_1:
 544  * A chain whose time nesting is invalid.
 545  */
 546 static const BYTE chain2_0[] = {
 547 0x30,0x82,0x01,0xc2,0x30,0x82,0x01,0x2d,0xa0,0x03,0x02,0x01,0x02,0x02,0x10,
 548 0x11,0x58,0x73,0x34,0x62,0x2b,0xa5,0xa5,0x54,0x4a,0x14,0x48,0x3c,0x90,0x4e,
 549 0x86,0x30,0x0b,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x30,
 550 0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,0x43,0x65,0x72,
 551 0x74,0x31,0x30,0x1e,0x17,0x0d,0x30,0x36,0x30,0x31,0x30,0x31,0x30,0x30,0x30,
 552 0x30,0x30,0x30,0x5a,0x17,0x0d,0x30,0x36,0x31,0x32,0x33,0x31,0x32,0x33,0x35,
 553 0x39,0x35,0x39,0x5a,0x30,0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,
 554 0x13,0x05,0x43,0x65,0x72,0x74,0x31,0x30,0x81,0x9d,0x30,0x0b,0x06,0x09,0x2a,
 555 0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x01,0x03,0x81,0x8d,0x00,0x30,0x81,0x89,
 556 0x02,0x81,0x81,0x00,0xad,0x7e,0xca,0xf3,0xe5,0x99,0xc2,0x2a,0xca,0x50,0x82,
 557 0x7c,0x2d,0xa4,0x81,0xcd,0x0d,0x0d,0x86,0xd7,0xd8,0xb2,0xde,0xc5,0xc3,0x34,
 558 0x9e,0x07,0x78,0x08,0x11,0x12,0x2d,0x21,0x0a,0x09,0x07,0x14,0x03,0x7a,0xe7,
 559 0x3b,0x58,0xf1,0xde,0x3e,0x01,0x25,0x93,0xab,0x8f,0xce,0x1f,0xc1,0x33,0x91,
 560 0xfe,0x59,0xb9,0x3b,0x9e,0x95,0x12,0x89,0x8e,0xc3,0x4b,0x98,0x1b,0x99,0xc5,
 561 0x07,0xe2,0xdf,0x15,0x4c,0x39,0x76,0x06,0xad,0xdb,0x16,0x06,0x49,0xba,0xcd,
 562 0x0f,0x07,0xd6,0xea,0x27,0xa6,0xfe,0x3d,0x88,0xe5,0x97,0x45,0x72,0xb6,0x1c,
 563 0xc0,0x1c,0xb1,0xa2,0x89,0xe8,0x37,0x9e,0xf6,0x2a,0xcf,0xd5,0x1f,0x2f,0x35,
 564 0x5e,0x8f,0x3a,0x9c,0x61,0xb1,0xf1,0x6c,0xff,0x8c,0xb2,0x2f,0x02,0x03,0x01,
 565 0x00,0x01,0xa3,0x23,0x30,0x21,0x30,0x0e,0x06,0x03,0x55,0x1d,0x0f,0x01,0x01,
 566 0xff,0x04,0x04,0x03,0x02,0x00,0x04,0x30,0x0f,0x06,0x03,0x55,0x1d,0x13,0x01,
 567 0x01,0xff,0x04,0x05,0x30,0x03,0x01,0x01,0xff,0x30,0x0b,0x06,0x09,0x2a,0x86,
 568 0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x03,0x81,0x81,0x00,0x88,0x44,0x83,0xfc,
 569 0x38,0xa4,0x6e,0x53,0x24,0x8f,0xac,0xcf,0xc0,0xb9,0xaa,0xdc,0x5f,0x30,0xf3,
 570 0xc3,0x5c,0xd5,0x10,0x4e,0xb7,0x30,0x24,0x80,0xb3,0x5e,0xcb,0x6a,0xec,0x88,
 571 0xa6,0x02,0xbd,0x37,0x97,0xcc,0x60,0x04,0x03,0xdd,0xfa,0xb0,0x4e,0xd6,0x00,
 572 0x22,0x41,0xaa,0x2b,0x3c,0x3e,0x1f,0xcd,0xe3,0xf0,0x88,0x84,0x1c,0x00,0xc4,
 573 0x97,0x69,0x3d,0x40,0x6d,0x33,0x8c,0xb7,0xb4,0x41,0xf3,0x28,0x00,0xa8,0xa1,
 574 0x81,0x76,0x50,0x69,0xb2,0x2c,0xc4,0x56,0xab,0x2b,0x4a,0x77,0x41,0x3e,0x6c,
 575 0x78,0x0b,0xf9,0x6c,0x86,0x84,0x1a,0x5a,0x0e,0x8c,0x12,0x59,0xbd,0x74,0xf3,
 576 0xb9,0x91,0xa1,0x70,0x91,0xf3,0xe8,0x8d,0x78,0x42,0xc3,0x4f,0xfa,0xef,0xe7,
 577 0xca,0x09,0x5c,0x18 };
 578 /* chain3_0 -> chain0_1:
 579  * A chain whose root cannot be a CA.
 580  */
 581 static const BYTE chain3_0[] = {
 582 0x30,0x82,0x01,0xad,0x30,0x82,0x01,0x1a,0xa0,0x03,0x02,0x01,0x02,0x02,0x10,
 583 0x63,0x73,0xee,0x45,0x59,0x76,0x1a,0x9e,0x47,0xf1,0xfb,0xf0,0x42,0x44,0x26,
 584 0xeb,0x30,0x09,0x06,0x05,0x2b,0x0e,0x03,0x02,0x1d,0x05,0x00,0x30,0x10,0x31,
 585 0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,0x43,0x65,0x72,0x74,0x31,
 586 0x30,0x1e,0x17,0x0d,0x30,0x37,0x30,0x31,0x30,0x31,0x30,0x30,0x30,0x30,0x30,
 587 0x30,0x5a,0x17,0x0d,0x30,0x37,0x31,0x32,0x33,0x31,0x32,0x33,0x35,0x39,0x35,
 588 0x39,0x5a,0x30,0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,
 589 0x43,0x65,0x72,0x74,0x31,0x30,0x81,0x9f,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,
 590 0x86,0xf7,0x0d,0x01,0x01,0x01,0x05,0x00,0x03,0x81,0x8d,0x00,0x30,0x81,0x89,
 591 0x02,0x81,0x81,0x00,0xad,0x7e,0xca,0xf3,0xe5,0x99,0xc2,0x2a,0xca,0x50,0x82,
 592 0x7c,0x2d,0xa4,0x81,0xcd,0x0d,0x0d,0x86,0xd7,0xd8,0xb2,0xde,0xc5,0xc3,0x34,
 593 0x9e,0x07,0x78,0x08,0x11,0x12,0x2d,0x21,0x0a,0x09,0x07,0x14,0x03,0x7a,0xe7,
 594 0x3b,0x58,0xf1,0xde,0x3e,0x01,0x25,0x93,0xab,0x8f,0xce,0x1f,0xc1,0x33,0x91,
 595 0xfe,0x59,0xb9,0x3b,0x9e,0x95,0x12,0x89,0x8e,0xc3,0x4b,0x98,0x1b,0x99,0xc5,
 596 0x07,0xe2,0xdf,0x15,0x4c,0x39,0x76,0x06,0xad,0xdb,0x16,0x06,0x49,0xba,0xcd,
 597 0x0f,0x07,0xd6,0xea,0x27,0xa6,0xfe,0x3d,0x88,0xe5,0x97,0x45,0x72,0xb6,0x1c,
 598 0xc0,0x1c,0xb1,0xa2,0x89,0xe8,0x37,0x9e,0xf6,0x2a,0xcf,0xd5,0x1f,0x2f,0x35,
 599 0x5e,0x8f,0x3a,0x9c,0x61,0xb1,0xf1,0x6c,0xff,0x8c,0xb2,0x2f,0x02,0x03,0x01,
 600 0x00,0x01,0xa3,0x10,0x30,0x0e,0x30,0x0c,0x06,0x03,0x55,0x1d,0x13,0x01,0x01,
 601 0xff,0x04,0x02,0x30,0x00,0x30,0x09,0x06,0x05,0x2b,0x0e,0x03,0x02,0x1d,0x05,
 602 0x00,0x03,0x81,0x81,0x00,0x53,0xb7,0xa9,0x90,0xe0,0x88,0x36,0xc0,0x2d,0xb1,
 603 0xa3,0x97,0xff,0x16,0x62,0x29,0xa2,0xfd,0x92,0x90,0xb7,0x8d,0xd9,0xdf,0x57,
 604 0x94,0x5a,0xce,0x36,0x5c,0x95,0x24,0xab,0x4f,0x63,0x55,0xa7,0xea,0x8b,0xaf,
 605 0xd9,0x41,0x6a,0x2f,0xd8,0x9e,0x1c,0x2d,0xc0,0x11,0x52,0x09,0x4b,0x31,0x1f,
 606 0x5e,0x8f,0x4b,0xbf,0x20,0x73,0x2d,0x04,0x11,0x56,0x6d,0xb1,0xbe,0xb4,0x5d,
 607 0x70,0x6b,0xb2,0xd0,0xd3,0xf5,0x5d,0x60,0x08,0x65,0x2c,0xe3,0x78,0x5a,0x05,
 608 0x36,0xe1,0xf1,0x67,0x3a,0x25,0xf3,0x47,0x83,0xce,0x4f,0xb0,0x74,0x7a,0x35,
 609 0xa0,0x7f,0x70,0x64,0x8a,0x14,0x66,0x03,0xf6,0xae,0xdf,0x1b,0xf5,0x80,0x87,
 610 0x06,0x39,0x76,0x70,0x7b,0xd2,0x83,0xe9,0xce,0x1f,0xf8,0x66,0xc1 };
 611 /* chain4_0 -> chain4_1 -> chain4_2:
 612  * A chain whose path length constraint is violated.
 613  */
 614 static const BYTE chain4_0[] = {
 615 0x30,0x82,0x01,0xb3,0x30,0x82,0x01,0x20,0xa0,0x03,0x02,0x01,0x02,0x02,0x10,
 616 0xcb,0xdc,0x8d,0xca,0xc1,0x0e,0x9c,0x9d,0x4f,0x0a,0xc1,0x09,0x31,0x32,0x94,
 617 0xf9,0x30,0x09,0x06,0x05,0x2b,0x0e,0x03,0x02,0x1d,0x05,0x00,0x30,0x10,0x31,
 618 0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,0x43,0x65,0x72,0x74,0x31,
 619 0x30,0x1e,0x17,0x0d,0x30,0x37,0x30,0x31,0x30,0x31,0x30,0x30,0x30,0x30,0x30,
 620 0x30,0x5a,0x17,0x0d,0x30,0x37,0x31,0x32,0x33,0x31,0x32,0x33,0x35,0x39,0x35,
 621 0x39,0x5a,0x30,0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,
 622 0x43,0x65,0x72,0x74,0x31,0x30,0x81,0x9f,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,
 623 0x86,0xf7,0x0d,0x01,0x01,0x01,0x05,0x00,0x03,0x81,0x8d,0x00,0x30,0x81,0x89,
 624 0x02,0x81,0x81,0x00,0xad,0x7e,0xca,0xf3,0xe5,0x99,0xc2,0x2a,0xca,0x50,0x82,
 625 0x7c,0x2d,0xa4,0x81,0xcd,0x0d,0x0d,0x86,0xd7,0xd8,0xb2,0xde,0xc5,0xc3,0x34,
 626 0x9e,0x07,0x78,0x08,0x11,0x12,0x2d,0x21,0x0a,0x09,0x07,0x14,0x03,0x7a,0xe7,
 627 0x3b,0x58,0xf1,0xde,0x3e,0x01,0x25,0x93,0xab,0x8f,0xce,0x1f,0xc1,0x33,0x91,
 628 0xfe,0x59,0xb9,0x3b,0x9e,0x95,0x12,0x89,0x8e,0xc3,0x4b,0x98,0x1b,0x99,0xc5,
 629 0x07,0xe2,0xdf,0x15,0x4c,0x39,0x76,0x06,0xad,0xdb,0x16,0x06,0x49,0xba,0xcd,
 630 0x0f,0x07,0xd6,0xea,0x27,0xa6,0xfe,0x3d,0x88,0xe5,0x97,0x45,0x72,0xb6,0x1c,
 631 0xc0,0x1c,0xb1,0xa2,0x89,0xe8,0x37,0x9e,0xf6,0x2a,0xcf,0xd5,0x1f,0x2f,0x35,
 632 0x5e,0x8f,0x3a,0x9c,0x61,0xb1,0xf1,0x6c,0xff,0x8c,0xb2,0x2f,0x02,0x03,0x01,
 633 0x00,0x01,0xa3,0x16,0x30,0x14,0x30,0x12,0x06,0x03,0x55,0x1d,0x13,0x01,0x01,
 634 0xff,0x04,0x08,0x30,0x06,0x01,0x01,0xff,0x02,0x01,0x00,0x30,0x09,0x06,0x05,
 635 0x2b,0x0e,0x03,0x02,0x1d,0x05,0x00,0x03,0x81,0x81,0x00,0x93,0xe8,0x98,0xbe,
 636 0x7b,0x5c,0x4c,0x58,0xbd,0xee,0x31,0x55,0xa8,0xb5,0x86,0xfc,0x23,0x55,0x48,
 637 0xda,0x95,0x60,0x0f,0x53,0x64,0x66,0x50,0x78,0xdc,0x1c,0xf3,0xec,0x38,0x7d,
 638 0x07,0x58,0x19,0xcf,0x83,0xfc,0x92,0xc4,0x3e,0x48,0x5b,0x45,0x54,0xf7,0x15,
 639 0x6f,0xb0,0x5e,0x8c,0xbf,0x03,0x62,0x17,0x27,0x28,0x59,0x49,0xde,0x52,0x2d,
 640 0x4b,0xb3,0x1e,0x4d,0x4f,0x2c,0xa8,0x1e,0x70,0xd1,0xdb,0xe7,0x98,0x6c,0x6f,
 641 0xaa,0x94,0xea,0x5d,0x7f,0xc5,0x1d,0x2a,0x4d,0xb7,0x4c,0xac,0xa6,0xbf,0x79,
 642 0x9a,0xf6,0x1e,0x98,0x64,0x14,0x2e,0xbd,0x8a,0xaf,0xac,0x52,0xd2,0x2c,0xdd,
 643 0xcd,0x1b,0x3d,0x28,0x43,0xea,0x25,0x91,0x15,0xb8,0x54,0x72,0x33,0xca,0xd8,
 644 0x5f,0x06,0x4c,0x97 };
 645 static const BYTE chain4_1[] = {
 646 0x30,0x82,0x01,0xb3,0x30,0x82,0x01,0x1e,0xa0,0x03,0x02,0x01,0x02,0x02,0x01,
 647 0x01,0x30,0x0b,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x30,
 648 0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,0x43,0x65,0x72,
 649 0x74,0x31,0x30,0x1e,0x17,0x0d,0x30,0x37,0x30,0x31,0x30,0x31,0x30,0x30,0x30,
 650 0x30,0x30,0x30,0x5a,0x17,0x0d,0x30,0x37,0x31,0x32,0x33,0x31,0x32,0x33,0x35,
 651 0x39,0x35,0x39,0x5a,0x30,0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,
 652 0x13,0x05,0x43,0x65,0x72,0x74,0x32,0x30,0x81,0x9d,0x30,0x0b,0x06,0x09,0x2a,
 653 0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x01,0x03,0x81,0x8d,0x00,0x30,0x81,0x89,
 654 0x02,0x81,0x81,0x00,0xb8,0x52,0xda,0xc5,0x4b,0x3f,0xe5,0x33,0x0e,0x67,0x5f,
 655 0x48,0x21,0xdc,0x7e,0xef,0x37,0x33,0xba,0xff,0xb4,0xc6,0xdc,0xb6,0x17,0x8e,
 656 0x20,0x55,0x07,0x12,0xd2,0x7b,0x3c,0xce,0x30,0xc5,0xa7,0x48,0x9f,0x6e,0xfe,
 657 0xb8,0xbe,0xdb,0x9f,0x9b,0x17,0x60,0x16,0xde,0xc6,0x8b,0x47,0xd1,0x57,0x71,
 658 0x3c,0x93,0xfc,0xbd,0xec,0x44,0x32,0x3b,0xb9,0xcf,0x6b,0x05,0x72,0xa7,0x87,
 659 0x8e,0x7e,0xd4,0x9a,0x87,0x1c,0x2f,0xb7,0x82,0x40,0xfc,0x6a,0x80,0x83,0x68,
 660 0x28,0xce,0x84,0xf4,0x0b,0x2e,0x44,0xcb,0x53,0xac,0x85,0x85,0xb5,0x46,0x36,
 661 0x98,0x3c,0x10,0x02,0xaa,0x02,0xbc,0x8b,0xa2,0x23,0xb2,0xd3,0x51,0x9a,0x22,
 662 0x4a,0xe3,0xaa,0x4e,0x7c,0xda,0x38,0xcf,0x49,0x98,0x72,0xa3,0x02,0x03,0x01,
 663 0x00,0x01,0xa3,0x23,0x30,0x21,0x30,0x0e,0x06,0x03,0x55,0x1d,0x0f,0x01,0x01,
 664 0xff,0x04,0x04,0x03,0x02,0x00,0x04,0x30,0x0f,0x06,0x03,0x55,0x1d,0x13,0x01,
 665 0x01,0xff,0x04,0x05,0x30,0x03,0x01,0x01,0xff,0x30,0x0b,0x06,0x09,0x2a,0x86,
 666 0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x03,0x81,0x81,0x00,0x26,0x56,0x31,0x53,
 667 0x65,0xe3,0xd8,0x59,0xc8,0x6f,0xa3,0x5b,0x8a,0x11,0x53,0xde,0x8d,0x6f,0x6d,
 668 0x8c,0xe1,0x79,0x25,0xb2,0xbf,0xc6,0x3b,0xa1,0x8b,0x6b,0xcd,0x99,0xcf,0x0c,
 669 0x6f,0xaa,0xbc,0xd0,0x3d,0xb2,0xf8,0x1c,0x6f,0xb0,0x84,0x7b,0xb1,0x88,0xec,
 670 0xd6,0x77,0xbe,0xb1,0x0b,0x8c,0x18,0x85,0xb7,0x38,0x81,0x12,0xc9,0xc7,0x4a,
 671 0xf6,0x83,0xc4,0xd9,0xae,0xb6,0x1d,0xbb,0xd2,0x08,0x01,0x4a,0xe1,0xdc,0x8f,
 672 0x67,0xa9,0xed,0xe2,0x3f,0x96,0xf6,0x72,0x7e,0x4a,0x63,0x46,0xc4,0x82,0x89,
 673 0x0a,0x81,0xc8,0x3a,0x9c,0xe7,0x23,0x5f,0x8d,0xd9,0x6c,0xb2,0x5d,0x9a,0x40,
 674 0x04,0x04,0xd5,0x4a,0x29,0x57,0xbd,0x18,0xd8,0xca,0x1f,0xf7,0xf8,0x23,0x07,
 675 0x4b,0x03,0xa3,0xd9 };
 676 static const BYTE chain4_2[] = {
 677 0x30,0x82,0x01,0x98,0x30,0x82,0x01,0x01,0xa0,0x03,0x02,0x01,0x02,0x02,0x01,
 678 0x01,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x05,
 679 0x00,0x30,0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,0x43,
 680 0x65,0x72,0x74,0x32,0x30,0x22,0x18,0x0f,0x31,0x36,0x30,0x31,0x31,0x31,0x32,
 681 0x32,0x31,0x38,0x35,0x32,0x30,0x37,0x5a,0x18,0x0f,0x31,0x36,0x32,0x38,0x30,
 682 0x38,0x32,0x36,0x30,0x35,0x32,0x30,0x35,0x37,0x5a,0x30,0x10,0x31,0x0e,0x30,
 683 0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,0x43,0x65,0x72,0x74,0x33,0x30,0x81,
 684 0x9f,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x01,0x05,
 685 0x00,0x03,0x81,0x8d,0x00,0x30,0x81,0x89,0x02,0x81,0x81,0x00,0xc3,0x31,0x35,
 686 0xc3,0x9d,0x8a,0x87,0x20,0xc6,0x32,0xe9,0xb1,0xf6,0x8f,0xf9,0x05,0x73,0x1d,
 687 0xa7,0xde,0xab,0x15,0x8a,0x9c,0x7f,0x11,0x7e,0x77,0xa0,0x42,0x80,0xf4,0x79,
 688 0xda,0x98,0x7b,0x00,0xfa,0x8f,0x0c,0xd0,0xeb,0x8a,0x80,0xed,0x07,0xfc,0x64,
 689 0x71,0x03,0xc1,0xd6,0x2f,0x9b,0xde,0x42,0x63,0xd9,0x79,0xea,0xdd,0x10,0xe8,
 690 0x68,0xc8,0x69,0x4f,0x4a,0x39,0x23,0x87,0xca,0xd1,0xc9,0x77,0x14,0x30,0x85,
 691 0x9e,0xf7,0x79,0xf9,0x07,0xb7,0x7c,0x55,0xcb,0xa7,0xd5,0xb8,0x44,0xb5,0x20,
 692 0xb5,0x01,0x5c,0xa2,0xd1,0xd5,0xad,0x0f,0x87,0xaf,0x37,0xd1,0x39,0x0c,0x0d,
 693 0xd5,0xde,0x26,0x7a,0xed,0xf9,0x2a,0xb1,0x60,0x65,0x2d,0x08,0x24,0x51,0x1d,
 694 0xb0,0x0a,0xb5,0x13,0xc7,0x02,0x03,0x01,0x00,0x01,0x30,0x0d,0x06,0x09,0x2a,
 695 0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x05,0x00,0x03,0x81,0x81,0x00,0xaa,
 696 0x0e,0x17,0x8d,0x5b,0xca,0x11,0xda,0x5a,0xb5,0xd4,0xe8,0x63,0xce,0xa5,0x67,
 697 0x11,0x2f,0xf8,0xb8,0x9f,0x89,0x46,0x7d,0x20,0x94,0x5f,0x0d,0x02,0x7e,0x5e,
 698 0x8c,0x33,0xfc,0x24,0x56,0x08,0xe6,0xf1,0x4d,0x29,0xd5,0xef,0x03,0xe3,0x9a,
 699 0xc6,0xcd,0x6e,0xe3,0xe6,0x45,0xaa,0xce,0x5a,0x2f,0x37,0x6c,0x07,0xd2,0x28,
 700 0x63,0x8e,0x55,0x8a,0xad,0xe3,0x8a,0x58,0x3d,0x24,0x09,0x1e,0x9a,0x7d,0x5f,
 701 0x05,0xc4,0x51,0x18,0x17,0x46,0x33,0x4d,0x72,0x05,0xc2,0x02,0xb6,0x05,0x22,
 702 0x23,0xcc,0xf9,0x1f,0x87,0x6c,0x4a,0x3d,0x6f,0xdb,0x59,0xf6,0x79,0x81,0x02,
 703 0x45,0x9f,0xc8,0xc3,0xf0,0x90,0x82,0xaf,0x58,0x80,0x18,0xea,0x73,0x50,0x29,
 704 0x71,0x8d,0xc1,0x9e,0x53,0x19,0x5a };
 705 /* chain5_0 -> chain5_1:
 706  * A chain whose name constraints aren't met.
 707  */
 708 static const BYTE chain5_0[] = {
 709 0x30,0x82,0x01,0xe0,0x30,0x82,0x01,0x4b,0xa0,0x03,0x02,0x01,0x02,0x02,0x10,
 710 0xed,0xb8,0x3b,0xf2,0x95,0xe6,0x8e,0xdf,0x75,0x6a,0x22,0xbc,0xca,0x51,0xb6,
 711 0x83,0x30,0x0b,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x30,
 712 0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,0x43,0x65,0x72,
 713 0x74,0x31,0x30,0x1e,0x17,0x0d,0x30,0x37,0x30,0x31,0x30,0x31,0x30,0x30,0x30,
 714 0x30,0x30,0x30,0x5a,0x17,0x0d,0x30,0x37,0x31,0x32,0x33,0x31,0x32,0x33,0x35,
 715 0x39,0x35,0x39,0x5a,0x30,0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,
 716 0x13,0x05,0x43,0x65,0x72,0x74,0x31,0x30,0x81,0x9d,0x30,0x0b,0x06,0x09,0x2a,
 717 0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x01,0x03,0x81,0x8d,0x00,0x30,0x81,0x89,
 718 0x02,0x81,0x81,0x00,0xad,0x7e,0xca,0xf3,0xe5,0x99,0xc2,0x2a,0xca,0x50,0x82,
 719 0x7c,0x2d,0xa4,0x81,0xcd,0x0d,0x0d,0x86,0xd7,0xd8,0xb2,0xde,0xc5,0xc3,0x34,
 720 0x9e,0x07,0x78,0x08,0x11,0x12,0x2d,0x21,0x0a,0x09,0x07,0x14,0x03,0x7a,0xe7,
 721 0x3b,0x58,0xf1,0xde,0x3e,0x01,0x25,0x93,0xab,0x8f,0xce,0x1f,0xc1,0x33,0x91,
 722 0xfe,0x59,0xb9,0x3b,0x9e,0x95,0x12,0x89,0x8e,0xc3,0x4b,0x98,0x1b,0x99,0xc5,
 723 0x07,0xe2,0xdf,0x15,0x4c,0x39,0x76,0x06,0xad,0xdb,0x16,0x06,0x49,0xba,0xcd,
 724 0x0f,0x07,0xd6,0xea,0x27,0xa6,0xfe,0x3d,0x88,0xe5,0x97,0x45,0x72,0xb6,0x1c,
 725 0xc0,0x1c,0xb1,0xa2,0x89,0xe8,0x37,0x9e,0xf6,0x2a,0xcf,0xd5,0x1f,0x2f,0x35,
 726 0x5e,0x8f,0x3a,0x9c,0x61,0xb1,0xf1,0x6c,0xff,0x8c,0xb2,0x2f,0x02,0x03,0x01,
 727 0x00,0x01,0xa3,0x41,0x30,0x3f,0x30,0x0e,0x06,0x03,0x55,0x1d,0x0f,0x01,0x01,
 728 0xff,0x04,0x04,0x03,0x02,0x00,0x04,0x30,0x0f,0x06,0x03,0x55,0x1d,0x13,0x01,
 729 0x01,0xff,0x04,0x05,0x30,0x03,0x01,0x01,0xff,0x30,0x1c,0x06,0x03,0x55,0x1d,
 730 0x1e,0x01,0x01,0xff,0x04,0x12,0x30,0x10,0xa0,0x0e,0x30,0x0c,0x82,0x0a,0x77,
 731 0x69,0x6e,0x65,0x68,0x71,0x2e,0x6f,0x72,0x67,0x30,0x0b,0x06,0x09,0x2a,0x86,
 732 0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x03,0x81,0x81,0x00,0x7f,0x98,0xd1,0x58,
 733 0x70,0x36,0x2c,0x08,0x63,0x2c,0xf9,0xe0,0x16,0xda,0x59,0xd9,0x1b,0xa5,0xba,
 734 0xe0,0xec,0xd9,0x0a,0x1b,0x78,0xd0,0xea,0x49,0xc7,0x01,0x06,0x78,0xe5,0xb3,
 735 0x81,0x5a,0x53,0x3d,0x9b,0x0d,0xaf,0xc8,0x04,0x57,0x15,0xee,0xfd,0x05,0x80,
 736 0x72,0x8a,0x54,0x51,0x6a,0x15,0xdc,0xbf,0xfc,0xe3,0x04,0xe4,0x6f,0x20,0xb2,
 737 0xfd,0xa6,0x32,0x4c,0xbc,0x1b,0x60,0xf7,0xc3,0x9c,0x5f,0x17,0x94,0xc7,0xdf,
 738 0x9f,0xae,0xdb,0x72,0x8a,0x98,0x28,0x9d,0x26,0x1f,0x14,0x76,0xb1,0x8e,0x26,
 739 0xf6,0x97,0x96,0x57,0x14,0x9e,0x44,0x13,0xef,0x85,0xc1,0x6f,0x38,0xda,0xf2,
 740 0x3a,0xf6,0xad,0x0b,0x35,0xcf,0xea,0xb0,0x5a,0x9c,0x36,0x80,0x45,0x1f,0x88,
 741 0x2f,0xff,0xb4,0xb5 };
 742 static const BYTE chain5_1[] = {
 743 0x30,0x82,0x01,0xb2,0x30,0x82,0x01,0x1b,0xa0,0x03,0x02,0x01,0x02,0x02,0x01,
 744 0x01,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x05,
 745 0x00,0x30,0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,0x43,
 746 0x65,0x72,0x74,0x31,0x30,0x1e,0x17,0x0d,0x30,0x37,0x30,0x31,0x30,0x31,0x30,
 747 0x30,0x30,0x30,0x30,0x30,0x5a,0x17,0x0d,0x30,0x37,0x31,0x32,0x33,0x31,0x32,
 748 0x33,0x35,0x39,0x35,0x39,0x5a,0x30,0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,
 749 0x04,0x03,0x13,0x05,0x43,0x65,0x72,0x74,0x32,0x30,0x81,0x9f,0x30,0x0d,0x06,
 750 0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x01,0x05,0x00,0x03,0x81,0x8d,
 751 0x00,0x30,0x81,0x89,0x02,0x81,0x81,0x00,0xb8,0x52,0xda,0xc5,0x4b,0x3f,0xe5,
 752 0x33,0x0e,0x67,0x5f,0x48,0x21,0xdc,0x7e,0xef,0x37,0x33,0xba,0xff,0xb4,0xc6,
 753 0xdc,0xb6,0x17,0x8e,0x20,0x55,0x07,0x12,0xd2,0x7b,0x3c,0xce,0x30,0xc5,0xa7,
 754 0x48,0x9f,0x6e,0xfe,0xb8,0xbe,0xdb,0x9f,0x9b,0x17,0x60,0x16,0xde,0xc6,0x8b,
 755 0x47,0xd1,0x57,0x71,0x3c,0x93,0xfc,0xbd,0xec,0x44,0x32,0x3b,0xb9,0xcf,0x6b,
 756 0x05,0x72,0xa7,0x87,0x8e,0x7e,0xd4,0x9a,0x87,0x1c,0x2f,0xb7,0x82,0x40,0xfc,
 757 0x6a,0x80,0x83,0x68,0x28,0xce,0x84,0xf4,0x0b,0x2e,0x44,0xcb,0x53,0xac,0x85,
 758 0x85,0xb5,0x46,0x36,0x98,0x3c,0x10,0x02,0xaa,0x02,0xbc,0x8b,0xa2,0x23,0xb2,
 759 0xd3,0x51,0x9a,0x22,0x4a,0xe3,0xaa,0x4e,0x7c,0xda,0x38,0xcf,0x49,0x98,0x72,
 760 0xa3,0x02,0x03,0x01,0x00,0x01,0xa3,0x1c,0x30,0x1a,0x30,0x18,0x06,0x03,0x55,
 761 0x1d,0x07,0x01,0x01,0xff,0x04,0x0e,0x30,0x0c,0x82,0x0a,0x77,0x69,0x6e,0x65,
 762 0x68,0x71,0x2e,0x63,0x6f,0x6d,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,
 763 0x0d,0x01,0x01,0x05,0x05,0x00,0x03,0x81,0x81,0x00,0x08,0x08,0xf5,0x1c,0xca,
 764 0x3b,0x5a,0xd7,0x45,0xac,0x29,0x5c,0x10,0x9d,0xb0,0x4a,0xdb,0x36,0x0b,0x39,
 765 0x14,0x87,0x3d,0x06,0xe8,0x0d,0x54,0xa7,0xb9,0x50,0x14,0x29,0x05,0xd2,0x75,
 766 0xe4,0x88,0xd8,0x8e,0x7e,0xab,0x61,0xba,0x3c,0xb2,0x4f,0x8f,0xfd,0x00,0x6b,
 767 0x94,0x69,0xf0,0x13,0x40,0x7d,0x4e,0x7c,0xac,0xf0,0x1b,0x07,0x2c,0x96,0x46,
 768 0xf6,0x38,0x38,0xc6,0x65,0x2c,0x02,0x28,0x62,0x6f,0x7d,0xf9,0x4d,0xff,0xb1,
 769 0x38,0x0e,0xce,0x89,0x0e,0xdd,0x22,0x51,0xd2,0x6b,0x0e,0x80,0x3c,0xa6,0x0c,
 770 0xe7,0x8b,0x3b,0x2a,0x2f,0x46,0xed,0xda,0x96,0x1a,0xc1,0x5c,0xfe,0xe0,0xef,
 771 0xdb,0xe0,0x11,0xc4,0x56,0x12,0xe2,0x4b,0x84,0xde,0xaf,0x7f,0x3c,0x9f,0xcb,
 772 0xb6,0xac,0x92 };
 773 /* chain0_0 -> chain4_1:
 774  * A chain whose end certificate is a CA.
 775  */
 776 /* chain0_0 -> chain 7_1:
 777  * A chain with a bad critical extension.
 778  */
 779 static const BYTE chain7_1[] = {
 780 0x30,0x82,0x01,0x93,0x30,0x81,0xfd,0xa0,0x03,0x02,0x01,0x02,0x02,0x01,0x01,
 781 0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x05,0x00,
 782 0x30,0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,0x43,0x65,
 783 0x72,0x74,0x31,0x30,0x1e,0x17,0x0d,0x30,0x37,0x30,0x31,0x30,0x31,0x30,0x30,
 784 0x30,0x30,0x30,0x30,0x5a,0x17,0x0d,0x30,0x37,0x31,0x32,0x33,0x31,0x32,0x33,
 785 0x35,0x39,0x35,0x39,0x5a,0x30,0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,
 786 0x03,0x13,0x05,0x43,0x65,0x72,0x74,0x32,0x30,0x81,0x9f,0x30,0x0d,0x06,0x09,
 787 0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x01,0x05,0x00,0x03,0x81,0x8d,0x00,
 788 0x30,0x81,0x89,0x02,0x81,0x81,0x00,0xb8,0x52,0xda,0xc5,0x4b,0x3f,0xe5,0x33,
 789 0x0e,0x67,0x5f,0x48,0x21,0xdc,0x7e,0xef,0x37,0x33,0xba,0xff,0xb4,0xc6,0xdc,
 790 0xb6,0x17,0x8e,0x20,0x55,0x07,0x12,0xd2,0x7b,0x3c,0xce,0x30,0xc5,0xa7,0x48,
 791 0x9f,0x6e,0xfe,0xb8,0xbe,0xdb,0x9f,0x9b,0x17,0x60,0x16,0xde,0xc6,0x8b,0x47,
 792 0xd1,0x57,0x71,0x3c,0x93,0xfc,0xbd,0xec,0x44,0x32,0x3b,0xb9,0xcf,0x6b,0x05,
 793 0x72,0xa7,0x87,0x8e,0x7e,0xd4,0x9a,0x87,0x1c,0x2f,0xb7,0x82,0x40,0xfc,0x6a,
 794 0x80,0x83,0x68,0x28,0xce,0x84,0xf4,0x0b,0x2e,0x44,0xcb,0x53,0xac,0x85,0x85,
 795 0xb5,0x46,0x36,0x98,0x3c,0x10,0x02,0xaa,0x02,0xbc,0x8b,0xa2,0x23,0xb2,0xd3,
 796 0x51,0x9a,0x22,0x4a,0xe3,0xaa,0x4e,0x7c,0xda,0x38,0xcf,0x49,0x98,0x72,0xa3,
 797 0x02,0x03,0x01,0x00,0x01,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,
 798 0x01,0x01,0x05,0x05,0x00,0x03,0x81,0x81,0x00,0x9f,0x69,0xfd,0x26,0xd5,0x4b,
 799 0xe0,0xab,0x12,0x21,0xb9,0xfc,0xf7,0xe0,0x0c,0x09,0x94,0xad,0x27,0xd7,0x9d,
 800 0xa3,0xcc,0x46,0x2a,0x25,0x9a,0x24,0xa7,0x31,0x58,0x78,0xf5,0xfc,0x30,0xe1,
 801 0x6d,0xfd,0x59,0xab,0xbe,0x69,0xa0,0xea,0xe3,0x7d,0x7a,0x7b,0xe5,0x85,0xeb,
 802 0x86,0x6a,0x84,0x3c,0x96,0x01,0x1a,0x70,0xa7,0xb8,0xcb,0xf2,0x11,0xe7,0x52,
 803 0x9c,0x58,0x2d,0xac,0x63,0xce,0x72,0x4b,0xad,0x62,0xa8,0x1d,0x75,0x96,0xe2,
 804 0x27,0xf5,0x6f,0xba,0x91,0xf8,0xf1,0xb0,0xbf,0x90,0x24,0x6d,0xba,0x5d,0xd7,
 805 0x39,0x63,0x3b,0x7c,0x04,0x5d,0x89,0x9d,0x1c,0xf2,0xf7,0xcc,0xdf,0x6e,0x8a,
 806 0x43,0xa9,0xdd,0x86,0x05,0xa2,0xf3,0x22,0x2d,0x1e,0x70,0xa1,0x59,0xd7,0xa5,
 807 0x94,0x7d };
 808 /* chain8_0 -> chain8_1 -> chain8_2:
 809  * A chain whose root cert validity time doesn't overlap the end cert's
 810  * validity time.
 811  */
 812 static const BYTE chain8_0[] = {
 813 0x30,0x82,0x01,0xc2,0x30,0x82,0x01,0x2d,0xa0,0x03,0x02,0x01,0x02,0x02,0x10,
 814 0x76,0x09,0xeb,0xc1,0x06,0x61,0x69,0x50,0x0e,0x0c,0xaf,0xc9,0x0a,0x6b,0x93,
 815 0x50,0x30,0x0b,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x30,
 816 0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,0x43,0x65,0x72,
 817 0x74,0x31,0x30,0x1e,0x17,0x0d,0x30,0x37,0x30,0x31,0x30,0x31,0x30,0x30,0x30,
 818 0x30,0x30,0x30,0x5a,0x17,0x0d,0x30,0x37,0x30,0x36,0x30,0x31,0x30,0x30,0x30,
 819 0x30,0x30,0x30,0x5a,0x30,0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,
 820 0x13,0x05,0x43,0x65,0x72,0x74,0x31,0x30,0x81,0x9d,0x30,0x0b,0x06,0x09,0x2a,
 821 0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x01,0x03,0x81,0x8d,0x00,0x30,0x81,0x89,
 822 0x02,0x81,0x81,0x00,0xad,0x7e,0xca,0xf3,0xe5,0x99,0xc2,0x2a,0xca,0x50,0x82,
 823 0x7c,0x2d,0xa4,0x81,0xcd,0x0d,0x0d,0x86,0xd7,0xd8,0xb2,0xde,0xc5,0xc3,0x34,
 824 0x9e,0x07,0x78,0x08,0x11,0x12,0x2d,0x21,0x0a,0x09,0x07,0x14,0x03,0x7a,0xe7,
 825 0x3b,0x58,0xf1,0xde,0x3e,0x01,0x25,0x93,0xab,0x8f,0xce,0x1f,0xc1,0x33,0x91,
 826 0xfe,0x59,0xb9,0x3b,0x9e,0x95,0x12,0x89,0x8e,0xc3,0x4b,0x98,0x1b,0x99,0xc5,
 827 0x07,0xe2,0xdf,0x15,0x4c,0x39,0x76,0x06,0xad,0xdb,0x16,0x06,0x49,0xba,0xcd,
 828 0x0f,0x07,0xd6,0xea,0x27,0xa6,0xfe,0x3d,0x88,0xe5,0x97,0x45,0x72,0xb6,0x1c,
 829 0xc0,0x1c,0xb1,0xa2,0x89,0xe8,0x37,0x9e,0xf6,0x2a,0xcf,0xd5,0x1f,0x2f,0x35,
 830 0x5e,0x8f,0x3a,0x9c,0x61,0xb1,0xf1,0x6c,0xff,0x8c,0xb2,0x2f,0x02,0x03,0x01,
 831 0x00,0x01,0xa3,0x23,0x30,0x21,0x30,0x0e,0x06,0x03,0x55,0x1d,0x0f,0x01,0x01,
 832 0xff,0x04,0x04,0x03,0x02,0x00,0x04,0x30,0x0f,0x06,0x03,0x55,0x1d,0x13,0x01,
 833 0x01,0xff,0x04,0x05,0x30,0x03,0x01,0x01,0xff,0x30,0x0b,0x06,0x09,0x2a,0x86,
 834 0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x03,0x81,0x81,0x00,0x87,0x74,0x4a,0xb7,
 835 0xbe,0xd4,0x21,0xa5,0x5f,0x51,0xd6,0xea,0x89,0x4c,0x68,0x16,0x38,0x09,0x49,
 836 0xf5,0xef,0xac,0x0c,0x59,0x27,0xa3,0x0f,0x8f,0xb9,0x21,0x35,0x91,0xef,0x15,
 837 0x91,0xe2,0xac,0xf2,0xad,0xfe,0x05,0x9a,0x9f,0x24,0x81,0x75,0x69,0x57,0x51,
 838 0xe3,0x2f,0x29,0xad,0x55,0x8b,0xc7,0x25,0xbe,0xcd,0x38,0xa7,0xff,0xdb,0xb0,
 839 0x85,0x4e,0x8d,0x56,0x5a,0x79,0xf7,0x7a,0xfb,0x64,0x3d,0x4e,0x04,0x34,0xf7,
 840 0x2f,0x7f,0xe3,0x21,0xee,0x8d,0xd3,0xb0,0x26,0x7d,0xb8,0xc3,0xb6,0x0f,0xe2,
 841 0x3f,0xb6,0x8a,0x53,0x27,0xc0,0xe1,0xfb,0xd8,0xea,0xfe,0xed,0x80,0x51,0xb6,
 842 0x46,0x59,0x65,0x6c,0x34,0x01,0xcc,0x2e,0x50,0xc7,0x4e,0x37,0x83,0x54,0x3f,
 843 0x7b,0xa2,0x1d,0x3a };
 844 static const BYTE chain8_1[] = {
 845 0x30,0x82,0x01,0x93,0x30,0x81,0xfd,0xa0,0x03,0x02,0x01,0x02,0x02,0x01,0x01,
 846 0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x05,0x00,
 847 0x30,0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,0x43,0x65,
 848 0x72,0x74,0x31,0x30,0x1e,0x17,0x0d,0x30,0x37,0x30,0x35,0x30,0x31,0x30,0x30,
 849 0x30,0x30,0x30,0x30,0x5a,0x17,0x0d,0x30,0x37,0x31,0x30,0x30,0x31,0x30,0x30,
 850 0x30,0x30,0x30,0x30,0x5a,0x30,0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,
 851 0x03,0x13,0x05,0x43,0x65,0x72,0x74,0x32,0x30,0x81,0x9f,0x30,0x0d,0x06,0x09,
 852 0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x01,0x05,0x00,0x03,0x81,0x8d,0x00,
 853 0x30,0x81,0x89,0x02,0x81,0x81,0x00,0xb8,0x52,0xda,0xc5,0x4b,0x3f,0xe5,0x33,
 854 0x0e,0x67,0x5f,0x48,0x21,0xdc,0x7e,0xef,0x37,0x33,0xba,0xff,0xb4,0xc6,0xdc,
 855 0xb6,0x17,0x8e,0x20,0x55,0x07,0x12,0xd2,0x7b,0x3c,0xce,0x30,0xc5,0xa7,0x48,
 856 0x9f,0x6e,0xfe,0xb8,0xbe,0xdb,0x9f,0x9b,0x17,0x60,0x16,0xde,0xc6,0x8b,0x47,
 857 0xd1,0x57,0x71,0x3c,0x93,0xfc,0xbd,0xec,0x44,0x32,0x3b,0xb9,0xcf,0x6b,0x05,
 858 0x72,0xa7,0x87,0x8e,0x7e,0xd4,0x9a,0x87,0x1c,0x2f,0xb7,0x82,0x40,0xfc,0x6a,
 859 0x80,0x83,0x68,0x28,0xce,0x84,0xf4,0x0b,0x2e,0x44,0xcb,0x53,0xac,0x85,0x85,
 860 0xb5,0x46,0x36,0x98,0x3c,0x10,0x02,0xaa,0x02,0xbc,0x8b,0xa2,0x23,0xb2,0xd3,
 861 0x51,0x9a,0x22,0x4a,0xe3,0xaa,0x4e,0x7c,0xda,0x38,0xcf,0x49,0x98,0x72,0xa3,
 862 0x02,0x03,0x01,0x00,0x01,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,
 863 0x01,0x01,0x05,0x05,0x00,0x03,0x81,0x81,0x00,0x22,0xf1,0x66,0x00,0x79,0xd2,
 864 0xe6,0xb2,0xb2,0xf7,0x2f,0x98,0x92,0x7d,0x73,0xc3,0x6c,0x5c,0x77,0x20,0xe3,
 865 0xbf,0x3e,0xe0,0xb3,0x5c,0x68,0xb4,0x9b,0x3a,0x41,0xae,0x94,0xa0,0x80,0x3a,
 866 0xfe,0x5d,0x7a,0x56,0x87,0x85,0x44,0x45,0xcf,0xa6,0xd3,0x10,0xe7,0x73,0x41,
 867 0xf2,0x7f,0x88,0x85,0x91,0x8e,0xe6,0xec,0xe2,0xce,0x08,0xbc,0xa5,0x76,0xe5,
 868 0x4d,0x1d,0xb7,0x70,0x31,0xdd,0xc9,0x9a,0x15,0x32,0x11,0x5a,0x4e,0x62,0xc8,
 869 0xd1,0xf8,0xec,0x46,0x39,0x5b,0xe7,0x67,0x1f,0x58,0xe8,0xa1,0xa0,0x5b,0xf7,
 870 0x8a,0x6d,0x5f,0x91,0x18,0xd4,0x90,0x85,0xff,0x30,0xc7,0xca,0x9c,0xc6,0x92,
 871 0xb0,0xca,0x16,0xc4,0xa4,0xc0,0xd6,0xe8,0xff,0x15,0x19,0xd1,0x30,0x61,0xf3,
 872 0xef,0x9f };
 873 static const BYTE chain8_2[] = {
 874 0x30,0x82,0x01,0x93,0x30,0x81,0xfd,0xa0,0x03,0x02,0x01,0x02,0x02,0x01,0x01,
 875 0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x05,0x00,
 876 0x30,0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,0x43,0x65,
 877 0x72,0x74,0x32,0x30,0x1e,0x17,0x0d,0x30,0x37,0x30,0x39,0x30,0x31,0x30,0x30,
 878 0x30,0x30,0x30,0x30,0x5a,0x17,0x0d,0x30,0x37,0x31,0x32,0x33,0x31,0x32,0x33,
 879 0x35,0x39,0x35,0x39,0x5a,0x30,0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,
 880 0x03,0x13,0x05,0x43,0x65,0x72,0x74,0x33,0x30,0x81,0x9f,0x30,0x0d,0x06,0x09,
 881 0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x01,0x05,0x00,0x03,0x81,0x8d,0x00,
 882 0x30,0x81,0x89,0x02,0x81,0x81,0x00,0xc3,0x31,0x35,0xc3,0x9d,0x8a,0x87,0x20,
 883 0xc6,0x32,0xe9,0xb1,0xf6,0x8f,0xf9,0x05,0x73,0x1d,0xa7,0xde,0xab,0x15,0x8a,
 884 0x9c,0x7f,0x11,0x7e,0x77,0xa0,0x42,0x80,0xf4,0x79,0xda,0x98,0x7b,0x00,0xfa,
 885 0x8f,0x0c,0xd0,0xeb,0x8a,0x80,0xed,0x07,0xfc,0x64,0x71,0x03,0xc1,0xd6,0x2f,
 886 0x9b,0xde,0x42,0x63,0xd9,0x79,0xea,0xdd,0x10,0xe8,0x68,0xc8,0x69,0x4f,0x4a,
 887 0x39,0x23,0x87,0xca,0xd1,0xc9,0x77,0x14,0x30,0x85,0x9e,0xf7,0x79,0xf9,0x07,
 888 0xb7,0x7c,0x55,0xcb,0xa7,0xd5,0xb8,0x44,0xb5,0x20,0xb5,0x01,0x5c,0xa2,0xd1,
 889 0xd5,0xad,0x0f,0x87,0xaf,0x37,0xd1,0x39,0x0c,0x0d,0xd5,0xde,0x26,0x7a,0xed,
 890 0xf9,0x2a,0xb1,0x60,0x65,0x2d,0x08,0x24,0x51,0x1d,0xb0,0x0a,0xb5,0x13,0xc7,
 891 0x02,0x03,0x01,0x00,0x01,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,
 892 0x01,0x01,0x05,0x05,0x00,0x03,0x81,0x81,0x00,0x33,0x95,0x73,0x7c,0x7c,0xb0,
 893 0xbb,0x2b,0xe0,0xc4,0x12,0xf0,0x26,0x85,0x97,0x0c,0x81,0xde,0xc5,0x52,0x04,
 894 0xcb,0xee,0x11,0x9a,0x2e,0xa2,0xc4,0x76,0xd5,0x57,0xd1,0x2f,0x2d,0x6f,0x42,
 895 0xbf,0x23,0x85,0x59,0x5c,0x96,0x8d,0xef,0xbc,0xb6,0xf5,0xd3,0x66,0x99,0x54,
 896 0x95,0x09,0x28,0x0b,0x4f,0x05,0x5f,0x61,0x20,0xa8,0x0d,0x46,0x9a,0xab,0x29,
 897 0x97,0x6b,0xa3,0xcd,0xd7,0x5a,0xda,0xaa,0x8e,0xad,0x5a,0x66,0x58,0xf6,0x63,
 898 0x76,0x10,0xdc,0xb0,0xee,0x3f,0x82,0x6d,0x29,0xb9,0xcb,0x99,0x15,0xbb,0xb9,
 899 0x74,0x73,0x00,0x14,0x74,0x79,0xad,0x89,0x73,0xaa,0xa2,0x0e,0x52,0xe8,0x28,
 900 0x69,0xe6,0x8c,0x1e,0xce,0x3a,0x6d,0x85,0x33,0x1e,0x21,0xa3,0x42,0x61,0x3a,
 901 0xeb,0x25 };
 902 /* chain9_0 -> chain7_1:
 903  * A cyclic chain.
 904  */
 905 static const BYTE chain9_0[] = {
 906 0x30,0x82,0x01,0x93,0x30,0x81,0xfd,0xa0,0x03,0x02,0x01,0x02,0x02,0x01,0x01,
 907 0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x05,0x00,
 908 0x30,0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,0x43,0x65,
 909 0x72,0x74,0x32,0x30,0x1e,0x17,0x0d,0x30,0x37,0x30,0x31,0x30,0x31,0x30,0x30,
 910 0x30,0x30,0x30,0x30,0x5a,0x17,0x0d,0x30,0x37,0x31,0x32,0x33,0x31,0x32,0x33,
 911 0x35,0x39,0x35,0x39,0x5a,0x30,0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,
 912 0x03,0x13,0x05,0x43,0x65,0x72,0x74,0x31,0x30,0x81,0x9f,0x30,0x0d,0x06,0x09,
 913 0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x01,0x05,0x00,0x03,0x81,0x8d,0x00,
 914 0x30,0x81,0x89,0x02,0x81,0x81,0x00,0xad,0x7e,0xca,0xf3,0xe5,0x99,0xc2,0x2a,
 915 0xca,0x50,0x82,0x7c,0x2d,0xa4,0x81,0xcd,0x0d,0x0d,0x86,0xd7,0xd8,0xb2,0xde,
 916 0xc5,0xc3,0x34,0x9e,0x07,0x78,0x08,0x11,0x12,0x2d,0x21,0x0a,0x09,0x07,0x14,
 917 0x03,0x7a,0xe7,0x3b,0x58,0xf1,0xde,0x3e,0x01,0x25,0x93,0xab,0x8f,0xce,0x1f,
 918 0xc1,0x33,0x91,0xfe,0x59,0xb9,0x3b,0x9e,0x95,0x12,0x89,0x8e,0xc3,0x4b,0x98,
 919 0x1b,0x99,0xc5,0x07,0xe2,0xdf,0x15,0x4c,0x39,0x76,0x06,0xad,0xdb,0x16,0x06,
 920 0x49,0xba,0xcd,0x0f,0x07,0xd6,0xea,0x27,0xa6,0xfe,0x3d,0x88,0xe5,0x97,0x45,
 921 0x72,0xb6,0x1c,0xc0,0x1c,0xb1,0xa2,0x89,0xe8,0x37,0x9e,0xf6,0x2a,0xcf,0xd5,
 922 0x1f,0x2f,0x35,0x5e,0x8f,0x3a,0x9c,0x61,0xb1,0xf1,0x6c,0xff,0x8c,0xb2,0x2f,
 923 0x02,0x03,0x01,0x00,0x01,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,
 924 0x01,0x01,0x05,0x05,0x00,0x03,0x81,0x81,0x00,0x2c,0xf5,0x25,0xaa,0xb4,0x63,
 925 0x5a,0x5d,0xae,0x7b,0x42,0x79,0xbc,0x41,0x2f,0x8a,0x2a,0x70,0x9f,0x8e,0xb2,
 926 0x14,0x1b,0x6f,0xb2,0xf3,0x3e,0xab,0x06,0x9c,0xa8,0x92,0x43,0xc4,0x57,0x63,
 927 0xa4,0xee,0x83,0x04,0xab,0xa5,0x2c,0xd9,0x90,0xed,0xc9,0x4d,0xa8,0x7b,0xca,
 928 0x3b,0x5f,0xdf,0x46,0xe1,0x3b,0x7f,0x72,0xb7,0x92,0x82,0xe6,0x05,0xc3,0x64,
 929 0x38,0xfb,0x86,0x13,0xeb,0x19,0xb6,0x16,0x82,0x63,0x84,0x13,0x04,0x38,0x51,
 930 0x4c,0x89,0x12,0xf1,0x13,0x46,0x75,0x4e,0x99,0x46,0xcb,0xc6,0x76,0x9f,0x97,
 931 0x9c,0xda,0x63,0x01,0x6a,0x71,0x68,0xc4,0x21,0x67,0xa6,0x51,0x19,0x5e,0xc7,
 932 0x8c,0x8d,0x63,0x5c,0xbe,0x04,0x8f,0xad,0xea,0xa5,0xcd,0xc3,0xd6,0x6b,0xc7,
 933 0xb5,0x56 };
 934 /* chain0_0 -+
 935  *            +-> chain7_1
 936  * chain10_1 -+
 937  * A chain with two issuers, only one of whose dates is valid.
 938  */
 939 static const BYTE chain10_1[] = {
 940 0x30,0x82,0x01,0x9b,0x30,0x82,0x01,0x08,0xa0,0x03,0x02,0x01,0x02,0x02,0x10,
 941 0xbf,0x99,0x4f,0x14,0x03,0x77,0x44,0xb8,0x49,0x02,0x70,0xa1,0xb8,0x9c,0xa7,
 942 0x24,0x30,0x09,0x06,0x05,0x2b,0x0e,0x03,0x02,0x1d,0x05,0x00,0x30,0x10,0x31,
 943 0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,0x43,0x65,0x72,0x74,0x31,
 944 0x30,0x1e,0x17,0x0d,0x30,0x37,0x30,0x31,0x30,0x31,0x30,0x30,0x30,0x30,0x30,
 945 0x30,0x5a,0x17,0x0d,0x30,0x37,0x31,0x32,0x33,0x31,0x32,0x33,0x35,0x39,0x35,
 946 0x39,0x5a,0x30,0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,
 947 0x43,0x65,0x72,0x74,0x31,0x30,0x81,0x9f,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,
 948 0x86,0xf7,0x0d,0x01,0x01,0x01,0x05,0x00,0x03,0x81,0x8d,0x00,0x30,0x81,0x89,
 949 0x02,0x81,0x81,0x00,0xad,0x7e,0xca,0xf3,0xe5,0x99,0xc2,0x2a,0xca,0x50,0x82,
 950 0x7c,0x2d,0xa4,0x81,0xcd,0x0d,0x0d,0x86,0xd7,0xd8,0xb2,0xde,0xc5,0xc3,0x34,
 951 0x9e,0x07,0x78,0x08,0x11,0x12,0x2d,0x21,0x0a,0x09,0x07,0x14,0x03,0x7a,0xe7,
 952 0x3b,0x58,0xf1,0xde,0x3e,0x01,0x25,0x93,0xab,0x8f,0xce,0x1f,0xc1,0x33,0x91,
 953 0xfe,0x59,0xb9,0x3b,0x9e,0x95,0x12,0x89,0x8e,0xc3,0x4b,0x98,0x1b,0x99,0xc5,
 954 0x07,0xe2,0xdf,0x15,0x4c,0x39,0x76,0x06,0xad,0xdb,0x16,0x06,0x49,0xba,0xcd,
 955 0x0f,0x07,0xd6,0xea,0x27,0xa6,0xfe,0x3d,0x88,0xe5,0x97,0x45,0x72,0xb6,0x1c,
 956 0xc0,0x1c,0xb1,0xa2,0x89,0xe8,0x37,0x9e,0xf6,0x2a,0xcf,0xd5,0x1f,0x2f,0x35,
 957 0x5e,0x8f,0x3a,0x9c,0x61,0xb1,0xf1,0x6c,0xff,0x8c,0xb2,0x2f,0x02,0x03,0x01,
 958 0x00,0x01,0x30,0x09,0x06,0x05,0x2b,0x0e,0x03,0x02,0x1d,0x05,0x00,0x03,0x81,
 959 0x81,0x00,0xa8,0xec,0x8c,0x34,0xe7,0x2c,0xdf,0x75,0x87,0xc4,0xf7,0xda,0x71,
 960 0x72,0x29,0xb2,0x48,0xa8,0x2a,0xec,0x7b,0x7d,0x19,0xb9,0x5f,0x1d,0xd9,0x91,
 961 0x2b,0xc4,0x28,0x7e,0xd6,0xb5,0x91,0x69,0xa5,0x8a,0x1a,0x1f,0x97,0x98,0x46,
 962 0x9d,0xdf,0x12,0xf6,0x45,0x62,0xad,0x60,0xb6,0xba,0xb0,0xfd,0xf5,0x9f,0xc6,
 963 0x98,0x05,0x4f,0x4d,0x48,0xdc,0xee,0x69,0xbe,0xb8,0xc4,0xc4,0xd7,0x1b,0xb1,
 964 0x1f,0x64,0xd6,0x45,0xa7,0xdb,0xb3,0x87,0x63,0x0f,0x54,0xe1,0x3a,0x6b,0x57,
 965 0x36,0xd7,0x68,0x65,0xcf,0xda,0x57,0x8d,0xcd,0x84,0x75,0x47,0x26,0x2c,0xef,
 966 0x1e,0x8f,0xc7,0x3b,0xee,0x5d,0x03,0xa6,0xdf,0x3a,0x20,0xb2,0xcc,0xc9,0x09,
 967 0x2c,0xfe,0x2b,0x79,0xb0,0xca,0x2c,0x9a,0x81,0x6b };
 968 /* chain0_0 -+
 969  *            +-> chain7_1
 970  * chain11_1 -+
 971  * A chain with two issuers, only one of whose public keys matches the
 972  * signature.
 973  */
 974 static const BYTE chain11_1[] = {
 975 0x30,0x82,0x01,0x9b,0x30,0x82,0x01,0x08,0xa0,0x03,0x02,0x01,0x02,0x02,0x10,
 976 0x72,0x41,0xa2,0x53,0xd2,0x33,0x0b,0xac,0x4a,0x30,0xfe,0x0a,0xe0,0x2e,0xd4,
 977 0x03,0x30,0x09,0x06,0x05,0x2b,0x0e,0x03,0x02,0x1d,0x05,0x00,0x30,0x10,0x31,
 978 0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,0x43,0x65,0x72,0x74,0x31,
 979 0x30,0x1e,0x17,0x0d,0x30,0x37,0x30,0x31,0x30,0x31,0x30,0x30,0x30,0x30,0x30,
 980 0x30,0x5a,0x17,0x0d,0x30,0x37,0x31,0x32,0x33,0x31,0x32,0x33,0x35,0x39,0x35,
 981 0x39,0x5a,0x30,0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,
 982 0x43,0x65,0x72,0x74,0x31,0x30,0x81,0x9f,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,
 983 0x86,0xf7,0x0d,0x01,0x01,0x01,0x05,0x00,0x03,0x81,0x8d,0x00,0x30,0x81,0x89,
 984 0x02,0x81,0x81,0x00,0xc3,0x31,0x35,0xc3,0x9d,0x8a,0x87,0x20,0xc6,0x32,0xe9,
 985 0xb1,0xf6,0x8f,0xf9,0x05,0x73,0x1d,0xa7,0xde,0xab,0x15,0x8a,0x9c,0x7f,0x11,
 986 0x7e,0x77,0xa0,0x42,0x80,0xf4,0x79,0xda,0x98,0x7b,0x00,0xfa,0x8f,0x0c,0xd0,
 987 0xeb,0x8a,0x80,0xed,0x07,0xfc,0x64,0x71,0x03,0xc1,0xd6,0x2f,0x9b,0xde,0x42,
 988 0x63,0xd9,0x79,0xea,0xdd,0x10,0xe8,0x68,0xc8,0x69,0x4f,0x4a,0x39,0x23,0x87,
 989 0xca,0xd1,0xc9,0x77,0x14,0x30,0x85,0x9e,0xf7,0x79,0xf9,0x07,0xb7,0x7c,0x55,
 990 0xcb,0xa7,0xd5,0xb8,0x44,0xb5,0x20,0xb5,0x01,0x5c,0xa2,0xd1,0xd5,0xad,0x0f,
 991 0x87,0xaf,0x37,0xd1,0x39,0x0c,0x0d,0xd5,0xde,0x26,0x7a,0xed,0xf9,0x2a,0xb1,
 992 0x60,0x65,0x2d,0x08,0x24,0x51,0x1d,0xb0,0x0a,0xb5,0x13,0xc7,0x02,0x03,0x01,
 993 0x00,0x01,0x30,0x09,0x06,0x05,0x2b,0x0e,0x03,0x02,0x1d,0x05,0x00,0x03,0x81,
 994 0x81,0x00,0x51,0x17,0xfb,0x2a,0x69,0x31,0x36,0xa7,0x37,0x2c,0x1f,0x38,0xee,
 995 0xe3,0xf1,0xae,0x63,0x61,0xac,0x63,0x13,0xc2,0x3b,0x29,0xca,0xb1,0x8e,0x27,
 996 0x41,0xfa,0xb3,0x7d,0x42,0xbe,0xf0,0x9c,0xe0,0xc7,0x69,0xba,0x80,0xf4,0x87,
 997 0x7c,0x6f,0x77,0x70,0x6b,0x77,0x7d,0x5c,0x58,0x95,0x07,0xbd,0xac,0xe2,0x5d,
 998 0x65,0x12,0xb0,0xae,0xf4,0x01,0x14,0x01,0xba,0xf9,0xa0,0x32,0x10,0xea,0x09,
 999 0x12,0xcf,0xf1,0xbc,0x37,0xc9,0x42,0xc3,0x8c,0x9e,0xa2,0xc3,0x5e,0x2e,0x56,
1000 0xe9,0xa7,0xd8,0x1c,0x1c,0x8c,0x1c,0x2f,0xd8,0xfb,0x67,0x44,0xd4,0xa3,0x79,
1001 0x6d,0x53,0x17,0x56,0x3c,0x3e,0xd0,0x67,0x36,0x0c,0x8b,0x77,0xab,0x40,0xc7,
1002 0x27,0xd9,0x44,0x69,0x13,0xeb,0x09,0xec,0x06,0xe2 };
1003 /* chain12_0 -> chain7_1:
1004  * A chain whose root has an invalid signature.
1005  */
1006 static const BYTE chain12_0[] = {
1007 0x30,0x82,0x01,0xc2,0x30,0x82,0x01,0x2d,0xa0,0x03,0x02,0x01,0x02,0x02,0x10,
1008 0x73,0x87,0xdb,0x32,0x3a,0x6c,0x89,0x74,0x0f,0xda,0x07,0xd4,0x6a,0x2c,0x81,
1009 0x59,0x30,0x0b,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x30,
1010 0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,0x43,0x65,0x72,
1011 0x74,0x31,0x30,0x1e,0x17,0x0d,0x30,0x37,0x30,0x31,0x30,0x31,0x30,0x30,0x30,
1012 0x30,0x30,0x30,0x5a,0x17,0x0d,0x30,0x37,0x31,0x32,0x33,0x31,0x32,0x33,0x35,
1013 0x39,0x35,0x39,0x5a,0x30,0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,
1014 0x13,0x05,0x43,0x65,0x72,0x74,0x31,0x30,0x81,0x9d,0x30,0x0b,0x06,0x09,0x2a,
1015 0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x01,0x03,0x81,0x8d,0x00,0x30,0x81,0x89,
1016 0x02,0x81,0x81,0x00,0xad,0x7e,0xca,0xf3,0xe5,0x99,0xc2,0x2a,0xca,0x50,0x82,
1017 0x7c,0x2d,0xa4,0x81,0xcd,0x0d,0x0d,0x86,0xd7,0xd8,0xb2,0xde,0xc5,0xc3,0x34,
1018 0x9e,0x07,0x78,0x08,0x11,0x12,0x2d,0x21,0x0a,0x09,0x07,0x14,0x03,0x7a,0xe7,
1019 0x3b,0x58,0xf1,0xde,0x3e,0x01,0x25,0x93,0xab,0x8f,0xce,0x1f,0xc1,0x33,0x91,
1020 0xfe,0x59,0xb9,0x3b,0x9e,0x95,0x12,0x89,0x8e,0xc3,0x4b,0x98,0x1b,0x99,0xc5,
1021 0x07,0xe2,0xdf,0x15,0x4c,0x39,0x76,0x06,0xad,0xdb,0x16,0x06,0x49,0xba,0xcd,
1022 0x0f,0x07,0xd6,0xea,0x27,0xa6,0xfe,0x3d,0x88,0xe5,0x97,0x45,0x72,0xb6,0x1c,
1023 0xc0,0x1c,0xb1,0xa2,0x89,0xe8,0x37,0x9e,0xf6,0x2a,0xcf,0xd5,0x1f,0x2f,0x35,
1024 0x5e,0x8f,0x3a,0x9c,0x61,0xb1,0xf1,0x6c,0xff,0x8c,0xb2,0x2f,0x02,0x03,0x01,
1025 0x00,0x01,0xa3,0x23,0x30,0x21,0x30,0x0e,0x06,0x03,0x55,0x1d,0x0f,0x01,0x01,
1026 0xff,0x04,0x04,0x03,0x02,0x00,0x04,0x30,0x0f,0x06,0x03,0x55,0x1d,0x13,0x01,
1027 0x01,0xff,0x04,0x05,0x30,0x03,0x01,0x01,0xff,0x30,0x0b,0x06,0x09,0x2a,0x86,
1028 0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x03,0x81,0x81,0x00,0x82,0xcd,0x5c,0x0a,
1029 0x9d,0x0d,0x3f,0xd1,0xd8,0x74,0xfc,0x52,0x65,0x11,0x76,0x10,0x62,0xb0,0x9a,
1030 0xc5,0x54,0x66,0xae,0xfa,0xd5,0x66,0x36,0xcb,0x1e,0xe7,0xad,0xb9,0xfa,0x2e,
1031 0xbb,0xb9,0x0b,0x4b,0xbf,0xe7,0x26,0x75,0x2c,0xae,0x2d,0x14,0x84,0x92,0xae,
1032 0x56,0xdf,0x55,0x56,0xf3,0xa6,0xc5,0x21,0xa8,0x5e,0xce,0x7a,0x9d,0xff,0x7f,
1033 0x10,0xd9,0xc3,0x05,0x52,0x86,0xdc,0x9b,0x46,0xe7,0x69,0xfb,0x1e,0xf0,0x68,
1034 0x7d,0x34,0xd7,0xf3,0x56,0xe3,0x0a,0xf3,0xe4,0xdc,0x0f,0xd6,0x4d,0xa8,0xc5,
1035 0xb5,0x5b,0xbf,0x0b,0x5d,0xe7,0x76,0xa1,0x56,0xc1,0xa7,0x55,0xa0,0x88,0x7f,
1036 0x57,0x8e,0x64,0xda,0x6f,0xaa,0x9c,0xca,0x47,0xf3,0x37,0x08,0x4b,0x9a,0xdc,
1037 0xbc,0x65,0x4d,0xff };
1038 /* chain0_0 -> chain13_1:
1039  * A chain whose time validity nesting is invalid.
1040  */
1041 static const BYTE chain13_1[] = {
1042 0x30,0x82,0x01,0x93,0x30,0x81,0xfd,0xa0,0x03,0x02,0x01,0x02,0x02,0x01,0x01,
1043 0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x05,0x00,
1044 0x30,0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,0x43,0x65,
1045 0x72,0x74,0x31,0x30,0x1e,0x17,0x0d,0x30,0x36,0x30,0x31,0x30,0x31,0x30,0x30,
1046 0x30,0x30,0x30,0x30,0x5a,0x17,0x0d,0x30,0x37,0x31,0x32,0x33,0x31,0x32,0x33,
1047 0x35,0x39,0x35,0x39,0x5a,0x30,0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,
1048 0x03,0x13,0x05,0x43,0x65,0x72,0x74,0x32,0x30,0x81,0x9f,0x30,0x0d,0x06,0x09,
1049 0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x01,0x05,0x00,0x03,0x81,0x8d,0x00,
1050 0x30,0x81,0x89,0x02,0x81,0x81,0x00,0xb8,0x52,0xda,0xc5,0x4b,0x3f,0xe5,0x33,
1051 0x0e,0x67,0x5f,0x48,0x21,0xdc,0x7e,0xef,0x37,0x33,0xba,0xff,0xb4,0xc6,0xdc,
1052 0xb6,0x17,0x8e,0x20,0x55,0x07,0x12,0xd2,0x7b,0x3c,0xce,0x30,0xc5,0xa7,0x48,
1053 0x9f,0x6e,0xfe,0xb8,0xbe,0xdb,0x9f,0x9b,0x17,0x60,0x16,0xde,0xc6,0x8b,0x47,
1054 0xd1,0x57,0x71,0x3c,0x93,0xfc,0xbd,0xec,0x44,0x32,0x3b,0xb9,0xcf,0x6b,0x05,
1055 0x72,0xa7,0x87,0x8e,0x7e,0xd4,0x9a,0x87,0x1c,0x2f,0xb7,0x82,0x40,0xfc,0x6a,
1056 0x80,0x83,0x68,0x28,0xce,0x84,0xf4,0x0b,0x2e,0x44,0xcb,0x53,0xac,0x85,0x85,
1057 0xb5,0x46,0x36,0x98,0x3c,0x10,0x02,0xaa,0x02,0xbc,0x8b,0xa2,0x23,0xb2,0xd3,
1058 0x51,0x9a,0x22,0x4a,0xe3,0xaa,0x4e,0x7c,0xda,0x38,0xcf,0x49,0x98,0x72,0xa3,
1059 0x02,0x03,0x01,0x00,0x01,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,
1060 0x01,0x01,0x05,0x05,0x00,0x03,0x81,0x81,0x00,0x85,0xc9,0xc5,0x08,0x0b,0xb1,
1061 0xff,0x58,0x8f,0xee,0x66,0x5f,0xa3,0x77,0x63,0x9f,0xd1,0x53,0x03,0xdc,0xf6,
1062 0x59,0x08,0x02,0x1f,0xdc,0x52,0x5a,0x52,0x38,0xa4,0x0b,0x83,0x12,0x19,0xd6,
1063 0xb5,0xb8,0x81,0x17,0xcd,0x10,0x5d,0x96,0x16,0x9d,0x51,0x5b,0xf9,0x31,0x3e,
1064 0x36,0xac,0x30,0xd5,0xd6,0xa0,0x30,0x5c,0x9c,0xcb,0xe1,0x02,0xfd,0x73,0xc3,
1065 0xa1,0x58,0xfe,0x12,0xb0,0xa6,0xbd,0x11,0x86,0xdb,0x20,0x17,0x29,0x1e,0x09,
1066 0x63,0x4d,0x28,0xe4,0x55,0x2d,0xa1,0x78,0xde,0x28,0x0b,0x1b,0x35,0x40,0x4c,
1067 0xf1,0xb0,0x6e,0x82,0x34,0x2b,0x7f,0x3b,0x2e,0x27,0x6b,0xf7,0xde,0x73,0x9a,
1068 0x98,0xac,0x79,0x33,0x1a,0xdd,0x03,0x95,0x60,0x8a,0x08,0xba,0xcb,0x8a,0xbf,
1069 0xea,0xe3 };
1070 /* chain14_0 -> chain14_1:
1071  * A chain whose root is allowed to sign certificates.
1072  */
1073 static const BYTE chain14_0[] = {
1074 0x30,0x82,0x01,0xc2,0x30,0x82,0x01,0x2d,0xa0,0x03,0x02,0x01,0x02,0x02,0x10,
1075 0xe0,0x3a,0xae,0xb4,0x23,0x65,0x59,0x5c,0x05,0x85,0x76,0x8b,0x8e,0x7f,0xa4,
1076 0x12,0x30,0x0b,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x30,
1077 0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,0x43,0x65,0x72,
1078 0x74,0x31,0x30,0x1e,0x17,0x0d,0x30,0x37,0x30,0x31,0x30,0x31,0x30,0x30,0x30,
1079 0x30,0x30,0x30,0x5a,0x17,0x0d,0x30,0x37,0x31,0x32,0x33,0x31,0x32,0x33,0x35,
1080 0x39,0x35,0x39,0x5a,0x30,0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,
1081 0x13,0x05,0x43,0x65,0x72,0x74,0x31,0x30,0x81,0x9d,0x30,0x0b,0x06,0x09,0x2a,
1082 0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x01,0x03,0x81,0x8d,0x00,0x30,0x81,0x89,
1083 0x02,0x81,0x81,0x00,0xad,0x7e,0xca,0xf3,0xe5,0x99,0xc2,0x2a,0xca,0x50,0x82,
1084 0x7c,0x2d,0xa4,0x81,0xcd,0x0d,0x0d,0x86,0xd7,0xd8,0xb2,0xde,0xc5,0xc3,0x34,
1085 0x9e,0x07,0x78,0x08,0x11,0x12,0x2d,0x21,0x0a,0x09,0x07,0x14,0x03,0x7a,0xe7,
1086 0x3b,0x58,0xf1,0xde,0x3e,0x01,0x25,0x93,0xab,0x8f,0xce,0x1f,0xc1,0x33,0x91,
1087 0xfe,0x59,0xb9,0x3b,0x9e,0x95,0x12,0x89,0x8e,0xc3,0x4b,0x98,0x1b,0x99,0xc5,
1088 0x07,0xe2,0xdf,0x15,0x4c,0x39,0x76,0x06,0xad,0xdb,0x16,0x06,0x49,0xba,0xcd,
1089 0x0f,0x07,0xd6,0xea,0x27,0xa6,0xfe,0x3d,0x88,0xe5,0x97,0x45,0x72,0xb6,0x1c,
1090 0xc0,0x1c,0xb1,0xa2,0x89,0xe8,0x37,0x9e,0xf6,0x2a,0xcf,0xd5,0x1f,0x2f,0x35,
1091 0x5e,0x8f,0x3a,0x9c,0x61,0xb1,0xf1,0x6c,0xff,0x8c,0xb2,0x2f,0x02,0x03,0x01,
1092 0x00,0x01,0xa3,0x23,0x30,0x21,0x30,0x0e,0x06,0x03,0x55,0x1d,0x0f,0x01,0x01,
1093 0xff,0x04,0x04,0x03,0x02,0x00,0x04,0x30,0x0f,0x06,0x03,0x55,0x1d,0x13,0x01,
1094 0x01,0xff,0x04,0x05,0x30,0x03,0x01,0x01,0xff,0x30,0x0b,0x06,0x09,0x2a,0x86,
1095 0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x03,0x81,0x81,0x00,0x10,0xb9,0x5c,0x13,
1096 0x7f,0xe9,0xf3,0x45,0xfb,0x40,0xa2,0x2b,0xe6,0x99,0x5e,0x74,0x9a,0x0b,0x15,
1097 0xa0,0x16,0xf2,0xff,0x6e,0xfa,0x92,0x78,0x4f,0x05,0x02,0xbd,0x70,0x4f,0x28,
1098 0x6f,0x43,0xc7,0xaa,0xaf,0xb6,0xd1,0x60,0x77,0xc6,0x8a,0x58,0x85,0xf0,0xac,
1099 0x04,0x90,0x4a,0x06,0xf0,0x17,0x88,0x12,0x90,0x22,0x65,0x98,0xb1,0x67,0x93,
1100 0x8a,0xe6,0x2d,0x54,0x79,0x99,0xd3,0x8c,0xe7,0x86,0xf4,0xec,0x08,0xae,0x18,
1101 0xa3,0xa9,0x23,0x7b,0x4f,0x8d,0xde,0xe6,0xf9,0x11,0x92,0xcf,0xe0,0x45,0xc3,
1102 0x42,0x72,0x43,0x64,0x07,0x8b,0x7f,0x28,0x11,0x0a,0xea,0xf2,0xbd,0x24,0x1b,
1103 0x93,0x5c,0x6f,0xed,0x67,0xae,0xee,0x7e,0x40,0x88,0x8b,0x28,0x2c,0xe7,0xee,
1104 0xec,0x34,0xe0,0x7b };
1105 static const BYTE chain14_1[] = {
1106 0x30,0x82,0x01,0x8d,0x30,0x81,0xf9,0xa0,0x03,0x02,0x01,0x02,0x02,0x01,0x01,
1107 0x30,0x0b,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x30,0x10,
1108 0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,0x43,0x65,0x72,0x74,
1109 0x31,0x30,0x1e,0x17,0x0d,0x30,0x37,0x30,0x31,0x30,0x31,0x30,0x30,0x30,0x30,
1110 0x30,0x30,0x5a,0x17,0x0d,0x30,0x37,0x31,0x32,0x33,0x31,0x32,0x33,0x35,0x39,
1111 0x35,0x39,0x5a,0x30,0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,
1112 0x05,0x43,0x65,0x72,0x74,0x32,0x30,0x81,0x9d,0x30,0x0b,0x06,0x09,0x2a,0x86,
1113 0x48,0x86,0xf7,0x0d,0x01,0x01,0x01,0x03,0x81,0x8d,0x00,0x30,0x81,0x89,0x02,
1114 0x81,0x81,0x00,0xb8,0x52,0xda,0xc5,0x4b,0x3f,0xe5,0x33,0x0e,0x67,0x5f,0x48,
1115 0x21,0xdc,0x7e,0xef,0x37,0x33,0xba,0xff,0xb4,0xc6,0xdc,0xb6,0x17,0x8e,0x20,
1116 0x55,0x07,0x12,0xd2,0x7b,0x3c,0xce,0x30,0xc5,0xa7,0x48,0x9f,0x6e,0xfe,0xb8,
1117 0xbe,0xdb,0x9f,0x9b,0x17,0x60,0x16,0xde,0xc6,0x8b,0x47,0xd1,0x57,0x71,0x3c,
1118 0x93,0xfc,0xbd,0xec,0x44,0x32,0x3b,0xb9,0xcf,0x6b,0x05,0x72,0xa7,0x87,0x8e,
1119 0x7e,0xd4,0x9a,0x87,0x1c,0x2f,0xb7,0x82,0x40,0xfc,0x6a,0x80,0x83,0x68,0x28,
1120 0xce,0x84,0xf4,0x0b,0x2e,0x44,0xcb,0x53,0xac,0x85,0x85,0xb5,0x46,0x36,0x98,
1121 0x3c,0x10,0x02,0xaa,0x02,0xbc,0x8b,0xa2,0x23,0xb2,0xd3,0x51,0x9a,0x22,0x4a,
1122 0xe3,0xaa,0x4e,0x7c,0xda,0x38,0xcf,0x49,0x98,0x72,0xa3,0x02,0x03,0x01,0x00,
1123 0x01,0x30,0x0b,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x03,
1124 0x81,0x81,0x00,0x63,0x67,0x7f,0x82,0x91,0xe2,0x42,0x45,0x98,0xbc,0xe5,0x03,
1125 0x6c,0x7d,0xc9,0xab,0xdb,0x95,0xc4,0x96,0x86,0xfd,0xcf,0xe6,0x32,0x4a,0x0b,
1126 0x7c,0x5b,0x76,0x39,0x71,0x26,0x54,0x60,0x1d,0xce,0x4f,0x29,0x22,0x9a,0xb7,
1127 0x7d,0x8d,0xfa,0x2c,0x99,0x0d,0xa6,0xa4,0x2e,0xd3,0xf6,0x3e,0xaf,0xea,0x89,
1128 0xa0,0x16,0x40,0x0f,0xf1,0x50,0xaa,0x98,0xdc,0xc2,0x69,0x90,0x6f,0xc6,0x4a,
1129 0xee,0x26,0x9e,0x5e,0x7d,0x4b,0x06,0x65,0x54,0x15,0x67,0x9e,0xe5,0x1d,0x1c,
1130 0x6f,0x0c,0x6e,0x84,0x29,0xf9,0x12,0xe9,0x71,0xdd,0xaf,0x9a,0x3d,0x2a,0xc1,
1131 0x60,0xeb,0x27,0xed,0x7c,0xbf,0xc4,0x84,0x17,0xa5,0xa6,0x41,0x29,0x13,0x8d,
1132 0x6c,0xdd,0x7c,0x3d,0x01,0x03,0xf8,0x70,0x97,0x3c,0x45 };
1133 /* chain15_0 -> chain14_1:
1134  * A chain whose root is not allowed to sign certificates.
1135  */
1136 static const BYTE chain15_0[] = {
1137 0x30,0x82,0x01,0xc2,0x30,0x82,0x01,0x2d,0xa0,0x03,0x02,0x01,0x02,0x02,0x10,
1138 0x10,0xb3,0x62,0xed,0xed,0x4a,0x92,0xda,0x74,0x62,0x74,0x48,0x99,0xa5,0xe9,
1139 0x0d,0x30,0x0b,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x30,
1140 0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,0x43,0x65,0x72,
1141 0x74,0x31,0x30,0x1e,0x17,0x0d,0x30,0x37,0x30,0x31,0x30,0x31,0x30,0x30,0x30,
1142 0x30,0x30,0x30,0x5a,0x17,0x0d,0x30,0x37,0x31,0x32,0x33,0x31,0x32,0x33,0x35,
1143 0x39,0x35,0x39,0x5a,0x30,0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,
1144 0x13,0x05,0x43,0x65,0x72,0x74,0x31,0x30,0x81,0x9d,0x30,0x0b,0x06,0x09,0x2a,
1145 0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x01,0x03,0x81,0x8d,0x00,0x30,0x81,0x89,
1146 0x02,0x81,0x81,0x00,0xad,0x7e,0xca,0xf3,0xe5,0x99,0xc2,0x2a,0xca,0x50,0x82,
1147 0x7c,0x2d,0xa4,0x81,0xcd,0x0d,0x0d,0x86,0xd7,0xd8,0xb2,0xde,0xc5,0xc3,0x34,
1148 0x9e,0x07,0x78,0x08,0x11,0x12,0x2d,0x21,0x0a,0x09,0x07,0x14,0x03,0x7a,0xe7,
1149 0x3b,0x58,0xf1,0xde,0x3e,0x01,0x25,0x93,0xab,0x8f,0xce,0x1f,0xc1,0x33,0x91,
1150 0xfe,0x59,0xb9,0x3b,0x9e,0x95,0x12,0x89,0x8e,0xc3,0x4b,0x98,0x1b,0x99,0xc5,
1151 0x07,0xe2,0xdf,0x15,0x4c,0x39,0x76,0x06,0xad,0xdb,0x16,0x06,0x49,0xba,0xcd,
1152 0x0f,0x07,0xd6,0xea,0x27,0xa6,0xfe,0x3d,0x88,0xe5,0x97,0x45,0x72,0xb6,0x1c,
1153 0xc0,0x1c,0xb1,0xa2,0x89,0xe8,0x37,0x9e,0xf6,0x2a,0xcf,0xd5,0x1f,0x2f,0x35,
1154 0x5e,0x8f,0x3a,0x9c,0x61,0xb1,0xf1,0x6c,0xff,0x8c,0xb2,0x2f,0x02,0x03,0x01,
1155 0x00,0x01,0xa3,0x23,0x30,0x21,0x30,0x0e,0x06,0x03,0x55,0x1d,0x0f,0x01,0x01,
1156 0xff,0x04,0x04,0x03,0x02,0x00,0x00,0x30,0x0f,0x06,0x03,0x55,0x1d,0x13,0x01,
1157 0x01,0xff,0x04,0x05,0x30,0x03,0x01,0x01,0xff,0x30,0x0b,0x06,0x09,0x2a,0x86,
1158 0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x03,0x81,0x81,0x00,0x51,0x48,0x43,0xc9,
1159 0xe3,0xb4,0xbc,0xc1,0x1d,0x98,0x14,0x69,0xd9,0xec,0x83,0x4d,0x07,0x70,0x58,
1160 0xe9,0x45,0x88,0xe5,0x11,0x4a,0xf0,0x58,0x2d,0x8d,0x08,0x35,0x76,0x0e,0x42,
1161 0x9f,0x62,0xda,0xf9,0x71,0x51,0x58,0xc7,0xd3,0x7e,0x88,0x6a,0x92,0xd2,0xfe,
1162 0x86,0x4f,0xa2,0x17,0xe3,0xdd,0x9b,0x55,0xe0,0xdc,0xa7,0xe7,0x08,0xe0,0x0a,
1163 0xa6,0xf3,0x09,0x17,0x63,0x10,0x89,0xe6,0x07,0x00,0x8e,0x2c,0x44,0x79,0x3e,
1164 0x6c,0x51,0x9a,0xa3,0x59,0x17,0x8b,0x90,0xa8,0x82,0x64,0x09,0x77,0x95,0x55,
1165 0xd6,0x38,0x43,0x8c,0x66,0xe6,0x7b,0xb9,0xf4,0xe1,0x7b,0x86,0x9b,0x8e,0xe3,
1166 0x56,0xc9,0x62,0x62,0x6e,0x3d,0x4d,0x67,0x8d,0x5e,0x20,0xe5,0xd0,0xfa,0xaa,
1167 0xbe,0x91,0xa8,0xf1 };
1168 /* chain0_0 -> chain16_1:
1169  * A chain whose end cert has a name constraints extension saying it can't
1170  * be a CA, and which also has a key usage extension allowing it to sign
1171  * certs.
1172  */
1173 static const BYTE chain16_1[] = {
1174 0x30,0x82,0x01,0xb0,0x30,0x82,0x01,0x1b,0xa0,0x03,0x02,0x01,0x02,0x02,0x01,
1175 0x01,0x30,0x0b,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x30,
1176 0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,0x43,0x65,0x72,
1177 0x74,0x31,0x30,0x1e,0x17,0x0d,0x30,0x37,0x30,0x31,0x30,0x31,0x30,0x30,0x30,
1178 0x30,0x30,0x30,0x5a,0x17,0x0d,0x30,0x37,0x31,0x32,0x33,0x31,0x32,0x33,0x35,
1179 0x39,0x35,0x39,0x5a,0x30,0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,
1180 0x13,0x05,0x43,0x65,0x72,0x74,0x32,0x30,0x81,0x9d,0x30,0x0b,0x06,0x09,0x2a,
1181 0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x01,0x03,0x81,0x8d,0x00,0x30,0x81,0x89,
1182 0x02,0x81,0x81,0x00,0xb8,0x52,0xda,0xc5,0x4b,0x3f,0xe5,0x33,0x0e,0x67,0x5f,
1183 0x48,0x21,0xdc,0x7e,0xef,0x37,0x33,0xba,0xff,0xb4,0xc6,0xdc,0xb6,0x17,0x8e,
1184 0x20,0x55,0x07,0x12,0xd2,0x7b,0x3c,0xce,0x30,0xc5,0xa7,0x48,0x9f,0x6e,0xfe,
1185 0xb8,0xbe,0xdb,0x9f,0x9b,0x17,0x60,0x16,0xde,0xc6,0x8b,0x47,0xd1,0x57,0x71,
1186 0x3c,0x93,0xfc,0xbd,0xec,0x44,0x32,0x3b,0xb9,0xcf,0x6b,0x05,0x72,0xa7,0x87,
1187 0x8e,0x7e,0xd4,0x9a,0x87,0x1c,0x2f,0xb7,0x82,0x40,0xfc,0x6a,0x80,0x83,0x68,
1188 0x28,0xce,0x84,0xf4,0x0b,0x2e,0x44,0xcb,0x53,0xac,0x85,0x85,0xb5,0x46,0x36,
1189 0x98,0x3c,0x10,0x02,0xaa,0x02,0xbc,0x8b,0xa2,0x23,0xb2,0xd3,0x51,0x9a,0x22,
1190 0x4a,0xe3,0xaa,0x4e,0x7c,0xda,0x38,0xcf,0x49,0x98,0x72,0xa3,0x02,0x03,0x01,
1191 0x00,0x01,0xa3,0x20,0x30,0x1e,0x30,0x0e,0x06,0x03,0x55,0x1d,0x0f,0x01,0x01,
1192 0xff,0x04,0x04,0x03,0x02,0x00,0x04,0x30,0x0c,0x06,0x03,0x55,0x1d,0x13,0x01,
1193 0x01,0xff,0x04,0x02,0x30,0x00,0x30,0x0b,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,
1194 0x0d,0x01,0x01,0x05,0x03,0x81,0x81,0x00,0x47,0xdb,0xb4,0x95,0xb1,0xe2,0x5c,
1195 0x03,0x3b,0x28,0x16,0x6b,0xed,0xe9,0x38,0xeb,0x74,0xe6,0xde,0xc5,0xaf,0x93,
1196 0xad,0x2e,0xaa,0x29,0x14,0x21,0xae,0xe9,0x7d,0x46,0x18,0x05,0x67,0xad,0x2d,
1197 0xaa,0xfa,0xf8,0x41,0xc8,0x8c,0xde,0xe0,0xd7,0x3e,0x9a,0x89,0x58,0x71,0x73,
1198 0x57,0xc1,0xd9,0x42,0x51,0xfb,0xaa,0xb8,0x50,0x98,0x9b,0x87,0xb1,0x14,0xa2,
1199 0x23,0xa7,0xfc,0x51,0x23,0x97,0x9f,0xef,0x06,0x83,0x63,0x91,0x14,0xc3,0xbe,
1200 0xaa,0xc8,0x7c,0x03,0x0e,0x41,0x5a,0x23,0x9c,0x1d,0x32,0x3a,0xa5,0xf1,0x6a,
1201 0x56,0x6c,0x36,0xe3,0x3d,0xa1,0xac,0x8e,0x1a,0x75,0x30,0x1c,0xd8,0xbc,0xae,
1202 0x3e,0x4a,0x1a,0x05,0xf4,0x09,0x24,0xb2,0x89,0x75,0xa4,0x28,0x78,0x6b,0xfa,
1203 0xcc };
1204 /* chain0_0 -> chain17_1 -> chain17_2:
1205  * A root cert, an intermediate cert that's a CA and allowed to sign a cert,
1206  * and an end cert.
1207  */
1208 static const BYTE chain17_1[] = {
1209 0x30,0x82,0x01,0xb3,0x30,0x82,0x01,0x1e,0xa0,0x03,0x02,0x01,0x02,0x02,0x01,
1210 0x01,0x30,0x0b,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x30,
1211 0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,0x43,0x65,0x72,
1212 0x74,0x31,0x30,0x1e,0x17,0x0d,0x30,0x37,0x30,0x31,0x30,0x31,0x30,0x30,0x30,
1213 0x30,0x30,0x30,0x5a,0x17,0x0d,0x30,0x37,0x31,0x32,0x33,0x31,0x32,0x33,0x35,
1214 0x39,0x35,0x39,0x5a,0x30,0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,
1215 0x13,0x05,0x43,0x65,0x72,0x74,0x32,0x30,0x81,0x9d,0x30,0x0b,0x06,0x09,0x2a,
1216 0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x01,0x03,0x81,0x8d,0x00,0x30,0x81,0x89,
1217 0x02,0x81,0x81,0x00,0xb8,0x52,0xda,0xc5,0x4b,0x3f,0xe5,0x33,0x0e,0x67,0x5f,
1218 0x48,0x21,0xdc,0x7e,0xef,0x37,0x33,0xba,0xff,0xb4,0xc6,0xdc,0xb6,0x17,0x8e,
1219 0x20,0x55,0x07,0x12,0xd2,0x7b,0x3c,0xce,0x30,0xc5,0xa7,0x48,0x9f,0x6e,0xfe,
1220 0xb8,0xbe,0xdb,0x9f,0x9b,0x17,0x60,0x16,0xde,0xc6,0x8b,0x47,0xd1,0x57,0x71,
1221 0x3c,0x93,0xfc,0xbd,0xec,0x44,0x32,0x3b,0xb9,0xcf,0x6b,0x05,0x72,0xa7,0x87,
1222 0x8e,0x7e,0xd4,0x9a,0x87,0x1c,0x2f,0xb7,0x82,0x40,0xfc,0x6a,0x80,0x83,0x68,
1223 0x28,0xce,0x84,0xf4,0x0b,0x2e,0x44,0xcb,0x53,0xac,0x85,0x85,0xb5,0x46,0x36,
1224 0x98,0x3c,0x10,0x02,0xaa,0x02,0xbc,0x8b,0xa2,0x23,0xb2,0xd3,0x51,0x9a,0x22,
1225 0x4a,0xe3,0xaa,0x4e,0x7c,0xda,0x38,0xcf,0x49,0x98,0x72,0xa3,0x02,0x03,0x01,
1226 0x00,0x01,0xa3,0x23,0x30,0x21,0x30,0x0e,0x06,0x03,0x55,0x1d,0x0f,0x01,0x01,
1227 0xff,0x04,0x04,0x03,0x02,0x00,0x04,0x30,0x0f,0x06,0x03,0x55,0x1d,0x13,0x01,
1228 0x01,0xff,0x04,0x05,0x30,0x03,0x01,0x01,0xff,0x30,0x0b,0x06,0x09,0x2a,0x86,
1229 0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x03,0x81,0x81,0x00,0x26,0x56,0x31,0x53,
1230 0x65,0xe3,0xd8,0x59,0xc8,0x6f,0xa3,0x5b,0x8a,0x11,0x53,0xde,0x8d,0x6f,0x6d,
1231 0x8c,0xe1,0x79,0x25,0xb2,0xbf,0xc6,0x3b,0xa1,0x8b,0x6b,0xcd,0x99,0xcf,0x0c,
1232 0x6f,0xaa,0xbc,0xd0,0x3d,0xb2,0xf8,0x1c,0x6f,0xb0,0x84,0x7b,0xb1,0x88,0xec,
1233 0xd6,0x77,0xbe,0xb1,0x0b,0x8c,0x18,0x85,0xb7,0x38,0x81,0x12,0xc9,0xc7,0x4a,
1234 0xf6,0x83,0xc4,0xd9,0xae,0xb6,0x1d,0xbb,0xd2,0x08,0x01,0x4a,0xe1,0xdc,0x8f,
1235 0x67,0xa9,0xed,0xe2,0x3f,0x96,0xf6,0x72,0x7e,0x4a,0x63,0x46,0xc4,0x82,0x89,
1236 0x0a,0x81,0xc8,0x3a,0x9c,0xe7,0x23,0x5f,0x8d,0xd9,0x6c,0xb2,0x5d,0x9a,0x40,
1237 0x04,0x04,0xd5,0x4a,0x29,0x57,0xbd,0x18,0xd8,0xca,0x1f,0xf7,0xf8,0x23,0x07,
1238 0x4b,0x03,0xa3,0xd9 };
1239 static const BYTE chain17_2[] = {
1240 0x30,0x82,0x01,0x8d,0x30,0x81,0xf9,0xa0,0x03,0x02,0x01,0x02,0x02,0x01,0x01,
1241 0x30,0x0b,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x30,0x10,
1242 0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,0x43,0x65,0x72,0x74,
1243 0x32,0x30,0x1e,0x17,0x0d,0x30,0x37,0x30,0x31,0x30,0x31,0x30,0x30,0x30,0x30,
1244 0x30,0x30,0x5a,0x17,0x0d,0x30,0x37,0x31,0x32,0x33,0x31,0x32,0x33,0x35,0x39,
1245 0x35,0x39,0x5a,0x30,0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,
1246 0x05,0x43,0x65,0x72,0x74,0x33,0x30,0x81,0x9d,0x30,0x0b,0x06,0x09,0x2a,0x86,
1247 0x48,0x86,0xf7,0x0d,0x01,0x01,0x01,0x03,0x81,0x8d,0x00,0x30,0x81,0x89,0x02,
1248 0x81,0x81,0x00,0xc3,0x31,0x35,0xc3,0x9d,0x8a,0x87,0x20,0xc6,0x32,0xe9,0xb1,
1249 0xf6,0x8f,0xf9,0x05,0x73,0x1d,0xa7,0xde,0xab,0x15,0x8a,0x9c,0x7f,0x11,0x7e,
1250 0x77,0xa0,0x42,0x80,0xf4,0x79,0xda,0x98,0x7b,0x00,0xfa,0x8f,0x0c,0xd0,0xeb,
1251 0x8a,0x80,0xed,0x07,0xfc,0x64,0x71,0x03,0xc1,0xd6,0x2f,0x9b,0xde,0x42,0x63,
1252 0xd9,0x79,0xea,0xdd,0x10,0xe8,0x68,0xc8,0x69,0x4f,0x4a,0x39,0x23,0x87,0xca,
1253 0xd1,0xc9,0x77,0x14,0x30,0x85,0x9e,0xf7,0x79,0xf9,0x07,0xb7,0x7c,0x55,0xcb,
1254 0xa7,0xd5,0xb8,0x44,0xb5,0x20,0xb5,0x01,0x5c,0xa2,0xd1,0xd5,0xad,0x0f,0x87,
1255 0xaf,0x37,0xd1,0x39,0x0c,0x0d,0xd5,0xde,0x26,0x7a,0xed,0xf9,0x2a,0xb1,0x60,
1256 0x65,0x2d,0x08,0x24,0x51,0x1d,0xb0,0x0a,0xb5,0x13,0xc7,0x02,0x03,0x01,0x00,
1257 0x01,0x30,0x0b,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x03,
1258 0x81,0x81,0x00,0x5c,0xb5,0x55,0xd7,0x2c,0x70,0xc5,0x6e,0xc0,0x8e,0x30,0x1f,
1259 0xf2,0x8e,0x55,0xd6,0xf6,0x95,0xa4,0x51,0xd8,0xf0,0x39,0x98,0x12,0x57,0xa7,
1260 0x6d,0x0c,0xfd,0xcb,0x25,0xf1,0xc4,0x73,0x85,0x78,0x82,0x15,0x12,0x08,0xb6,
1261 0x05,0x85,0x4f,0x5a,0x59,0x1f,0x03,0xdf,0x04,0xef,0xc2,0xb0,0xee,0xd7,0x73,
1262 0x09,0xca,0xbb,0xfb,0xd8,0xec,0x8b,0x39,0x01,0x14,0xc9,0x03,0xc9,0x08,0x4d,
1263 0x97,0xc7,0xf2,0x0b,0x54,0x67,0xf7,0x7c,0xc6,0xee,0x74,0xd5,0xa2,0x10,0x3e,
1264 0xd9,0x3a,0x7a,0x9d,0xeb,0xeb,0xd8,0x8e,0x43,0x74,0xc3,0xa5,0x3b,0x1a,0x4b,
1265 0x8a,0xbc,0x6a,0x2c,0x15,0x4b,0x72,0x0b,0xac,0xa4,0x1a,0x97,0x80,0xf8,0xb1,
1266 0xd3,0xd7,0x1a,0xf3,0xf5,0x9f,0x7c,0x4c,0x7d,0x7c,0xc7 };
1267 /* chain0_0 -> chain18_1 -> chain18_2:
1268  * A root, an intermediate CA not allowed to sign certs, and an end cert.
1269  */
1270 static const BYTE chain18_1[] = {
1271 0x30,0x82,0x01,0xb3,0x30,0x82,0x01,0x1e,0xa0,0x03,0x02,0x01,0x02,0x02,0x01,
1272 0x01,0x30,0x0b,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x30,
1273 0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,0x43,0x65,0x72,
1274 0x74,0x31,0x30,0x1e,0x17,0x0d,0x30,0x37,0x30,0x31,0x30,0x31,0x30,0x30,0x30,
1275 0x30,0x30,0x30,0x5a,0x17,0x0d,0x30,0x37,0x31,0x32,0x33,0x31,0x32,0x33,0x35,
1276 0x39,0x35,0x39,0x5a,0x30,0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,
1277 0x13,0x05,0x43,0x65,0x72,0x74,0x32,0x30,0x81,0x9d,0x30,0x0b,0x06,0x09,0x2a,
1278 0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x01,0x03,0x81,0x8d,0x00,0x30,0x81,0x89,
1279 0x02,0x81,0x81,0x00,0xb8,0x52,0xda,0xc5,0x4b,0x3f,0xe5,0x33,0x0e,0x67,0x5f,
1280 0x48,0x21,0xdc,0x7e,0xef,0x37,0x33,0xba,0xff,0xb4,0xc6,0xdc,0xb6,0x17,0x8e,
1281 0x20,0x55,0x07,0x12,0xd2,0x7b,0x3c,0xce,0x30,0xc5,0xa7,0x48,0x9f,0x6e,0xfe,
1282 0xb8,0xbe,0xdb,0x9f,0x9b,0x17,0x60,0x16,0xde,0xc6,0x8b,0x47,0xd1,0x57,0x71,
1283 0x3c,0x93,0xfc,0xbd,0xec,0x44,0x32,0x3b,0xb9,0xcf,0x6b,0x05,0x72,0xa7,0x87,
1284 0x8e,0x7e,0xd4,0x9a,0x87,0x1c,0x2f,0xb7,0x82,0x40,0xfc,0x6a,0x80,0x83,0x68,
1285 0x28,0xce,0x84,0xf4,0x0b,0x2e,0x44,0xcb,0x53,0xac,0x85,0x85,0xb5,0x46,0x36,
1286 0x98,0x3c,0x10,0x02,0xaa,0x02,0xbc,0x8b,0xa2,0x23,0xb2,0xd3,0x51,0x9a,0x22,
1287 0x4a,0xe3,0xaa,0x4e,0x7c,0xda,0x38,0xcf,0x49,0x98,0x72,0xa3,0x02,0x03,0x01,
1288 0x00,0x01,0xa3,0x23,0x30,0x21,0x30,0x0e,0x06,0x03,0x55,0x1d,0x0f,0x01,0x01,
1289 0xff,0x04,0x04,0x03,0x02,0x00,0x00,0x30,0x0f,0x06,0x03,0x55,0x1d,0x13,0x01,
1290 0x01,0xff,0x04,0x05,0x30,0x03,0x01,0x01,0xff,0x30,0x0b,0x06,0x09,0x2a,0x86,
1291 0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x03,0x81,0x81,0x00,0x2c,0x49,0x9f,0xc2,
1292 0xce,0xf5,0x0d,0x59,0xaa,0xff,0xa0,0x72,0xa7,0xcf,0x4c,0x35,0xc5,0x5e,0x1b,
1293 0x32,0xe6,0x46,0x53,0x3e,0x70,0xe6,0xbc,0xa2,0x37,0xe0,0x9d,0x41,0x40,0x12,
1294 0x9e,0x81,0x2b,0xd9,0x46,0x3a,0xdc,0xd7,0x37,0xc4,0xbf,0x0f,0x0c,0xf8,0x74,
1295 0x7a,0xf9,0x92,0x2d,0xf8,0xfe,0xec,0x17,0xfb,0x38,0x4f,0x83,0x02,0x6f,0x49,
1296 0xb4,0xad,0xb2,0x84,0x41,0x13,0x71,0x32,0xee,0x34,0x8d,0xea,0x2b,0x64,0x9b,
1297 0x26,0x76,0xe9,0xcc,0xdf,0x73,0xe0,0x84,0xc1,0x8b,0xea,0xfc,0x8c,0x18,0x93,
1298 0xfd,0xa3,0x5f,0x8f,0xde,0x05,0x11,0x88,0x62,0x0b,0x03,0x35,0x1a,0xef,0x65,
1299 0x82,0x06,0xc8,0xa5,0xf6,0xd2,0x1e,0x46,0xc2,0x86,0xe7,0x26,0x8e,0x9e,0x10,
1300 0x33,0xe2,0x89,0x93 };
1301 static const BYTE chain18_2[] = {
1302 0x30,0x82,0x01,0x8d,0x30,0x81,0xf9,0xa0,0x03,0x02,0x01,0x02,0x02,0x01,0x01,
1303 0x30,0x0b,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x30,0x10,
1304 0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,0x43,0x65,0x72,0x74,
1305 0x32,0x30,0x1e,0x17,0x0d,0x30,0x37,0x30,0x31,0x30,0x31,0x30,0x30,0x30,0x30,
1306 0x30,0x30,0x5a,0x17,0x0d,0x30,0x37,0x31,0x32,0x33,0x31,0x32,0x33,0x35,0x39,
1307 0x35,0x39,0x5a,0x30,0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,
1308 0x05,0x43,0x65,0x72,0x74,0x33,0x30,0x81,0x9d,0x30,0x0b,0x06,0x09,0x2a,0x86,
1309 0x48,0x86,0xf7,0x0d,0x01,0x01,0x01,0x03,0x81,0x8d,0x00,0x30,0x81,0x89,0x02,
1310 0x81,0x81,0x00,0xc3,0x31,0x35,0xc3,0x9d,0x8a,0x87,0x20,0xc6,0x32,0xe9,0xb1,
1311 0xf6,0x8f,0xf9,0x05,0x73,0x1d,0xa7,0xde,0xab,0x15,0x8a,0x9c,0x7f,0x11,0x7e,
1312 0x77,0xa0,0x42,0x80,0xf4,0x79,0xda,0x98,0x7b,0x00,0xfa,0x8f,0x0c,0xd0,0xeb,
1313 0x8a,0x80,0xed,0x07,0xfc,0x64,0x71,0x03,0xc1,0xd6,0x2f,0x9b,0xde,0x42,0x63,
1314 0xd9,0x79,0xea,0xdd,0x10,0xe8,0x68,0xc8,0x69,0x4f,0x4a,0x39,0x23,0x87,0xca,
1315 0xd1,0xc9,0x77,0x14,0x30,0x85,0x9e,0xf7,0x79,0xf9,0x07,0xb7,0x7c,0x55,0xcb,
1316 0xa7,0xd5,0xb8,0x44,0xb5,0x20,0xb5,0x01,0x5c,0xa2,0xd1,0xd5,0xad,0x0f,0x87,
1317 0xaf,0x37,0xd1,0x39,0x0c,0x0d,0xd5,0xde,0x26,0x7a,0xed,0xf9,0x2a,0xb1,0x60,
1318 0x65,0x2d,0x08,0x24,0x51,0x1d,0xb0,0x0a,0xb5,0x13,0xc7,0x02,0x03,0x01,0x00,
1319 0x01,0x30,0x0b,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x03,
1320 0x81,0x81,0x00,0x5c,0xb5,0x55,0xd7,0x2c,0x70,0xc5,0x6e,0xc0,0x8e,0x30,0x1f,
1321 0xf2,0x8e,0x55,0xd6,0xf6,0x95,0xa4,0x51,0xd8,0xf0,0x39,0x98,0x12,0x57,0xa7,
1322 0x6d,0x0c,0xfd,0xcb,0x25,0xf1,0xc4,0x73,0x85,0x78,0x82,0x15,0x12,0x08,0xb6,
1323 0x05,0x85,0x4f,0x5a,0x59,0x1f,0x03,0xdf,0x04,0xef,0xc2,0xb0,0xee,0xd7,0x73,
1324 0x09,0xca,0xbb,0xfb,0xd8,0xec,0x8b,0x39,0x01,0x14,0xc9,0x03,0xc9,0x08,0x4d,
1325 0x97,0xc7,0xf2,0x0b,0x54,0x67,0xf7,0x7c,0xc6,0xee,0x74,0xd5,0xa2,0x10,0x3e,
1326 0xd9,0x3a,0x7a,0x9d,0xeb,0xeb,0xd8,0x8e,0x43,0x74,0xc3,0xa5,0x3b,0x1a,0x4b,
1327 0x8a,0xbc,0x6a,0x2c,0x15,0x4b,0x72,0x0b,0xac,0xa4,0x1a,0x97,0x80,0xf8,0xb1,
1328 0xd3,0xd7,0x1a,0xf3,0xf5,0x9f,0x7c,0x4c,0x7d,0x7c,0xc7 };
1329
1330 typedef struct _CONST_DATA_BLOB
1331 {
1332     DWORD       cbData;
1333     const BYTE *pbData;
1334 } CONST_DATA_BLOB;
1335
1336 typedef struct _CONST_BLOB_ARRAY
1337 {
1338     DWORD cBlob;
1339     CONST_DATA_BLOB *rgBlob;
1340 } CONST_BLOB_ARRAY;
1341
1342 #define TODO_CHAIN    1
1343 #define TODO_ERROR    2
1344 #define TODO_INFO     4
1345 #define TODO_ELEMENTS 8
1346 #define TODO_CHAINS   16
1347 #define TODO_POLICY   32
1348
1349 /* Gets a certificate chain built from a store containing all the certs in
1350  * certArray, where the last certificate in the chain is expected to be the
1351  * end certificate (the one from which the chain is built.)
1352  */
1353 static PCCERT_CHAIN_CONTEXT getChain(const CONST_BLOB_ARRAY *certArray,
1354  DWORD flags, BOOL includeStore, LPSYSTEMTIME checkTime, DWORD todo,
1355  DWORD testIndex)
1356 {
1357     HCERTSTORE store;
1358     PCCERT_CHAIN_CONTEXT chain = NULL;
1359
1360     store = CertOpenStore(CERT_STORE_PROV_MEMORY, 0, 0,
1361      CERT_STORE_CREATE_NEW_FLAG, NULL);
1362     if (store)
1363     {
1364         BOOL ret;
1365         PCCERT_CONTEXT endCert;
1366
1367         if (certArray->cBlob > 1)
1368         {
1369             DWORD i;
1370
1371             for (i = 0, ret = TRUE; ret && i < certArray->cBlob - 1; i++)
1372             {
1373                 ret = CertAddEncodedCertificateToStore(store,
1374                  X509_ASN_ENCODING, certArray->rgBlob[i].pbData,
1375                  certArray->rgBlob[i].cbData, CERT_STORE_ADD_ALWAYS, NULL);
1376                 ok(ret, "Chain %d: adding cert %d failed: %08x\n",
1377                  testIndex, i, GetLastError());
1378             }
1379         }
1380         ret = CertAddEncodedCertificateToStore(store,
1381          X509_ASN_ENCODING, certArray->rgBlob[certArray->cBlob - 1].pbData,
1382          certArray->rgBlob[certArray->cBlob - 1].cbData, CERT_STORE_ADD_ALWAYS,
1383          &endCert);
1384         ok(ret, "Chain %d: adding end cert failed: %08x\n",
1385          testIndex, GetLastError());
1386         if (ret)
1387         {
1388             /* FIXME: allow caller to specify usage matches? */
1389             CERT_CHAIN_PARA chainPara = { sizeof(chainPara), { 0 } };
1390             FILETIME fileTime;
1391
1392             SystemTimeToFileTime(checkTime, &fileTime);
1393             ret = pCertGetCertificateChain(NULL, endCert, &fileTime,
1394              includeStore ? store : NULL, &chainPara, flags, NULL, &chain);
1395             if (todo & TODO_CHAIN)
1396                 todo_wine ok(ret, "Chain %d: CertGetCertificateChain failed: %08x\n",
1397                  testIndex, GetLastError());
1398             else
1399                 ok(ret, "Chain %d: CertGetCertificateChain failed: %08x\n",
1400                  testIndex, GetLastError());
1401             CertFreeCertificateContext(endCert);
1402         }
1403         CertCloseStore(store, 0);
1404     }
1405     return chain;
1406 }
1407
1408 typedef struct _SimpleChainStatusCheck
1409 {
1410     DWORD                    cElement;
1411     const CERT_TRUST_STATUS *rgElementStatus;
1412 } SimpleChainStatusCheck;
1413
1414 static void checkElementStatus(const CERT_TRUST_STATUS *expected,
1415  const CERT_TRUST_STATUS *got, const CERT_TRUST_STATUS *ignore,
1416  DWORD todo, DWORD testIndex, DWORD chainIndex, DWORD elementIndex)
1417 {
1418     if (got->dwErrorStatus == expected->dwErrorStatus)
1419         ok(got->dwErrorStatus == expected->dwErrorStatus,
1420          "Chain %d, element [%d,%d]: expected error %08x, got %08x\n",
1421          testIndex, chainIndex, elementIndex, expected->dwErrorStatus,
1422          got->dwErrorStatus);
1423     else if (todo & TODO_ERROR)
1424         todo_wine
1425         ok(got->dwErrorStatus == expected->dwErrorStatus ||
1426          broken((got->dwErrorStatus & ~ignore->dwErrorStatus) ==
1427          (expected->dwErrorStatus & ~ignore->dwErrorStatus)),
1428          "Chain %d, element [%d,%d]: expected error %08x, got %08x\n",
1429          testIndex, chainIndex, elementIndex, expected->dwErrorStatus,
1430          got->dwErrorStatus);
1431     else
1432         ok(got->dwErrorStatus == expected->dwErrorStatus ||
1433          broken((got->dwErrorStatus & ~ignore->dwErrorStatus) ==
1434          (expected->dwErrorStatus & ~ignore->dwErrorStatus)),
1435          "Chain %d, element [%d,%d]: expected error %08x, got %08x. %08x is "
1436          "expected if no valid Verisign root certificate is available.\n",
1437          testIndex, chainIndex, elementIndex, expected->dwErrorStatus,
1438          got->dwErrorStatus, CERT_TRUST_IS_UNTRUSTED_ROOT);
1439     if (got->dwInfoStatus == expected->dwInfoStatus)
1440         ok(got->dwInfoStatus == expected->dwInfoStatus,
1441          "Chain %d, element [%d,%d]: expected info %08x, got %08x\n",
1442          testIndex, chainIndex, elementIndex, expected->dwInfoStatus,
1443          got->dwInfoStatus);
1444     else if (todo & TODO_INFO)
1445         todo_wine
1446         ok(got->dwInfoStatus == expected->dwInfoStatus ||
1447          broken((got->dwInfoStatus & ~ignore->dwInfoStatus) ==
1448          (expected->dwInfoStatus & ~ignore->dwInfoStatus)),
1449          "Chain %d, element [%d,%d]: expected info %08x, got %08x\n",
1450          testIndex, chainIndex, elementIndex, expected->dwInfoStatus,
1451          got->dwInfoStatus);
1452     else
1453         ok(got->dwInfoStatus == expected->dwInfoStatus ||
1454          broken((got->dwInfoStatus & ~ignore->dwInfoStatus) ==
1455          (expected->dwInfoStatus & ~ignore->dwInfoStatus)),
1456          "Chain %d, element [%d,%d]: expected info %08x, got %08x\n",
1457          testIndex, chainIndex, elementIndex, expected->dwInfoStatus,
1458          got->dwInfoStatus);
1459 }
1460
1461 static void checkSimpleChainStatus(const CERT_SIMPLE_CHAIN *simpleChain,
1462  const SimpleChainStatusCheck *simpleChainStatus,
1463  const CERT_TRUST_STATUS *ignore, DWORD todo, DWORD testIndex, DWORD chainIndex)
1464 {
1465     if (todo & TODO_ELEMENTS)
1466         todo_wine ok(simpleChain->cElement == simpleChainStatus->cElement,
1467          "Chain %d: expected %d elements, got %d\n", testIndex,
1468          simpleChainStatus->cElement, simpleChain->cElement);
1469     else
1470         ok(simpleChain->cElement == simpleChainStatus->cElement,
1471          "Chain %d: expected %d elements, got %d\n", testIndex,
1472          simpleChainStatus->cElement, simpleChain->cElement);
1473     if (simpleChain->cElement == simpleChainStatus->cElement)
1474     {
1475         DWORD i;
1476
1477         for (i = 0; i < simpleChain->cElement; i++)
1478             checkElementStatus(&simpleChainStatus->rgElementStatus[i],
1479              &simpleChain->rgpElement[i]->TrustStatus, ignore, todo, testIndex,
1480              chainIndex, i);
1481     }
1482 }
1483
1484 typedef struct _ChainStatusCheck
1485 {
1486     CERT_TRUST_STATUS             statusToIgnore;
1487     CERT_TRUST_STATUS             status;
1488     DWORD                         cChain;
1489     const SimpleChainStatusCheck *rgChainStatus;
1490 } ChainStatusCheck;
1491
1492 static void checkChainStatus(PCCERT_CHAIN_CONTEXT chain,
1493  const ChainStatusCheck *chainStatus, DWORD todo, DWORD testIndex)
1494 {
1495     ok(chain->cChain == chainStatus->cChain,
1496      "Chain %d: expected %d simple chains, got %d\n", testIndex,
1497      chainStatus->cChain, chain->cChain);
1498     if (todo & TODO_ERROR &&
1499      chain->TrustStatus.dwErrorStatus != chainStatus->status.dwErrorStatus)
1500         todo_wine ok(chain->TrustStatus.dwErrorStatus ==
1501          chainStatus->status.dwErrorStatus ||
1502          broken((chain->TrustStatus.dwErrorStatus &
1503          ~chainStatus->statusToIgnore.dwErrorStatus) ==
1504          (chainStatus->status.dwErrorStatus &
1505          ~chainStatus->statusToIgnore.dwErrorStatus)),
1506          "Chain %d: expected error %08x, got %08x\n",
1507          testIndex, chainStatus->status.dwErrorStatus,
1508          chain->TrustStatus.dwErrorStatus);
1509     else
1510         ok(chain->TrustStatus.dwErrorStatus ==
1511          chainStatus->status.dwErrorStatus ||
1512          broken((chain->TrustStatus.dwErrorStatus &
1513          ~chainStatus->statusToIgnore.dwErrorStatus) ==
1514          (chainStatus->status.dwErrorStatus &
1515          ~chainStatus->statusToIgnore.dwErrorStatus)),
1516          "Chain %d: expected error %08x, got %08x. %08x is expected if no valid "
1517          "Verisign root certificate is available.\n",
1518          testIndex, chainStatus->status.dwErrorStatus,
1519          chain->TrustStatus.dwErrorStatus, CERT_TRUST_IS_UNTRUSTED_ROOT);
1520     if (todo & TODO_INFO &&
1521      chain->TrustStatus.dwInfoStatus != chainStatus->status.dwInfoStatus)
1522         todo_wine ok(chain->TrustStatus.dwInfoStatus ==
1523          chainStatus->status.dwInfoStatus ||
1524          broken((chain->TrustStatus.dwInfoStatus &
1525          ~chainStatus->statusToIgnore.dwInfoStatus) ==
1526          (chainStatus->status.dwInfoStatus &
1527          ~chainStatus->statusToIgnore.dwInfoStatus)),
1528          "Chain %d: expected info %08x, got %08x\n",
1529          testIndex, chainStatus->status.dwInfoStatus,
1530          chain->TrustStatus.dwInfoStatus);
1531     else
1532         ok(chain->TrustStatus.dwInfoStatus ==
1533          chainStatus->status.dwInfoStatus ||
1534          broken((chain->TrustStatus.dwInfoStatus &
1535          ~chainStatus->statusToIgnore.dwInfoStatus) ==
1536          (chainStatus->status.dwInfoStatus &
1537          ~chainStatus->statusToIgnore.dwInfoStatus)),
1538          "Chain %d: expected info %08x, got %08x\n",
1539          testIndex, chainStatus->status.dwInfoStatus,
1540          chain->TrustStatus.dwInfoStatus);
1541     if (chain->cChain == chainStatus->cChain)
1542     {
1543         DWORD i;
1544
1545         for (i = 0; i < chain->cChain; i++)
1546             checkSimpleChainStatus(chain->rgpChain[i],
1547              &chainStatus->rgChainStatus[i], &chainStatus->statusToIgnore,
1548              todo, testIndex, i);
1549     }
1550 }
1551
1552 typedef struct _ChainCheck
1553 {
1554     CONST_BLOB_ARRAY certs;
1555     ChainStatusCheck status;
1556     DWORD            todo;
1557 } ChainCheck;
1558
1559 static CONST_DATA_BLOB chain0[] = {
1560  { sizeof(chain0_0), chain0_0 },
1561  { sizeof(chain0_1), chain0_1 },
1562 };
1563 static const CERT_TRUST_STATUS elementStatus0[] = {
1564  { CERT_TRUST_IS_NOT_TIME_VALID, CERT_TRUST_HAS_NAME_MATCH_ISSUER },
1565  { CERT_TRUST_IS_UNTRUSTED_ROOT,
1566    CERT_TRUST_HAS_NAME_MATCH_ISSUER | CERT_TRUST_IS_SELF_SIGNED },
1567 };
1568 static const SimpleChainStatusCheck simpleStatus0[] = {
1569  { sizeof(elementStatus0) / sizeof(elementStatus0[0]), elementStatus0 },
1570 };
1571 static CONST_DATA_BLOB chain1[] = {
1572  { sizeof(chain0_0), chain0_0 },
1573  { sizeof(chain1_1), chain1_1 },
1574 };
1575 static const CERT_TRUST_STATUS elementStatus1[] = {
1576  { CERT_TRUST_IS_NOT_TIME_VALID | CERT_TRUST_IS_NOT_SIGNATURE_VALID,
1577    CERT_TRUST_HAS_NAME_MATCH_ISSUER },
1578  { CERT_TRUST_IS_UNTRUSTED_ROOT,
1579    CERT_TRUST_HAS_NAME_MATCH_ISSUER | CERT_TRUST_IS_SELF_SIGNED },
1580 };
1581 static const SimpleChainStatusCheck simpleStatus1[] = {
1582  { sizeof(elementStatus1) / sizeof(elementStatus1[0]), elementStatus1 },
1583 };
1584 static CONST_DATA_BLOB chain2[] = {
1585  { sizeof(chain2_0), chain2_0 },
1586  { sizeof(chain0_1), chain0_1 },
1587 };
1588 static const CERT_TRUST_STATUS elementStatus2[] = {
1589  { CERT_TRUST_IS_NOT_TIME_VALID, CERT_TRUST_HAS_NAME_MATCH_ISSUER },
1590  { CERT_TRUST_IS_NOT_TIME_VALID | CERT_TRUST_IS_UNTRUSTED_ROOT,
1591    CERT_TRUST_HAS_NAME_MATCH_ISSUER | CERT_TRUST_IS_SELF_SIGNED },
1592 };
1593 static const SimpleChainStatusCheck simpleStatus2[] = {
1594  { sizeof(elementStatus2) / sizeof(elementStatus2[0]), elementStatus2 },
1595 };
1596 static CONST_DATA_BLOB chain3[] = {
1597  { sizeof(chain3_0), chain3_0 },
1598  { sizeof(chain0_1), chain0_1 },
1599 };
1600 static const CERT_TRUST_STATUS elementStatus3[] = {
1601  { CERT_TRUST_IS_NOT_TIME_VALID, CERT_TRUST_HAS_NAME_MATCH_ISSUER },
1602  { CERT_TRUST_INVALID_BASIC_CONSTRAINTS | CERT_TRUST_IS_UNTRUSTED_ROOT,
1603    CERT_TRUST_HAS_NAME_MATCH_ISSUER | CERT_TRUST_IS_SELF_SIGNED },
1604 };
1605 static const SimpleChainStatusCheck simpleStatus3[] = {
1606  { sizeof(elementStatus3) / sizeof(elementStatus3[0]), elementStatus3 },
1607 };
1608 static CONST_DATA_BLOB chain4[] = {
1609  { sizeof(chain4_0), chain4_0 },
1610  { sizeof(chain4_1), chain4_1 },
1611  { sizeof(chain4_2), chain4_2 },
1612 };
1613 static const CERT_TRUST_STATUS elementStatus4[] = {
1614  { CERT_TRUST_IS_NOT_TIME_VALID, CERT_TRUST_HAS_NAME_MATCH_ISSUER },
1615  { CERT_TRUST_INVALID_BASIC_CONSTRAINTS, CERT_TRUST_HAS_NAME_MATCH_ISSUER },
1616  { CERT_TRUST_INVALID_BASIC_CONSTRAINTS | CERT_TRUST_IS_UNTRUSTED_ROOT,
1617    CERT_TRUST_HAS_NAME_MATCH_ISSUER | CERT_TRUST_IS_SELF_SIGNED },
1618 };
1619 static const SimpleChainStatusCheck simpleStatus4[] = {
1620  { sizeof(elementStatus4) / sizeof(elementStatus4[0]), elementStatus4 },
1621 };
1622 static CONST_DATA_BLOB chain5[] = {
1623  { sizeof(chain5_0), chain5_0 },
1624  { sizeof(chain5_1), chain5_1 },
1625 };
1626 static const CERT_TRUST_STATUS elementStatus5[] = {
1627  { CERT_TRUST_NO_ERROR, CERT_TRUST_HAS_NAME_MATCH_ISSUER },
1628  { CERT_TRUST_HAS_NOT_PERMITTED_NAME_CONSTRAINT |
1629    CERT_TRUST_IS_UNTRUSTED_ROOT,
1630    CERT_TRUST_HAS_NAME_MATCH_ISSUER | CERT_TRUST_IS_SELF_SIGNED },
1631 };
1632 static const SimpleChainStatusCheck simpleStatus5[] = {
1633  { sizeof(elementStatus5) / sizeof(elementStatus5[0]), elementStatus5 },
1634 };
1635 static CONST_DATA_BLOB chain6[] = {
1636  { sizeof(chain0_0), chain0_0 },
1637  { sizeof(chain4_1), chain4_1 },
1638 };
1639 static const CERT_TRUST_STATUS elementStatus6[] = {
1640  { CERT_TRUST_NO_ERROR, CERT_TRUST_HAS_NAME_MATCH_ISSUER },
1641  { CERT_TRUST_IS_UNTRUSTED_ROOT,
1642    CERT_TRUST_HAS_NAME_MATCH_ISSUER | CERT_TRUST_IS_SELF_SIGNED },
1643 };
1644 static const SimpleChainStatusCheck simpleStatus6[] = {
1645  { sizeof(elementStatus6) / sizeof(elementStatus6[0]), elementStatus6 },
1646 };
1647 static CONST_DATA_BLOB chain7[] = {
1648  { sizeof(chain0_0), chain0_0 },
1649  { sizeof(chain7_1), chain7_1 },
1650 };
1651 static const CERT_TRUST_STATUS elementStatus7[] = {
1652  { CERT_TRUST_NO_ERROR, CERT_TRUST_HAS_NAME_MATCH_ISSUER },
1653  { CERT_TRUST_IS_UNTRUSTED_ROOT,
1654    CERT_TRUST_HAS_NAME_MATCH_ISSUER | CERT_TRUST_IS_SELF_SIGNED },
1655 };
1656 static const SimpleChainStatusCheck simpleStatus7[] = {
1657  { sizeof(elementStatus7) / sizeof(elementStatus7[0]), elementStatus7 },
1658 };
1659 static CONST_DATA_BLOB chain8[] = {
1660  { sizeof(chain8_0), chain8_0 },
1661  { sizeof(chain8_1), chain8_1 },
1662  { sizeof(chain8_2), chain8_2 },
1663 };
1664 static const CERT_TRUST_STATUS elementStatus8[] = {
1665  { CERT_TRUST_NO_ERROR, CERT_TRUST_HAS_NAME_MATCH_ISSUER },
1666  { CERT_TRUST_INVALID_BASIC_CONSTRAINTS, CERT_TRUST_HAS_NAME_MATCH_ISSUER },
1667  { CERT_TRUST_IS_UNTRUSTED_ROOT | CERT_TRUST_IS_NOT_TIME_VALID,
1668    CERT_TRUST_HAS_NAME_MATCH_ISSUER | CERT_TRUST_IS_SELF_SIGNED },
1669 };
1670 static const SimpleChainStatusCheck simpleStatus8[] = {
1671  { sizeof(elementStatus8) / sizeof(elementStatus8[0]), elementStatus8 },
1672 };
1673 static CONST_DATA_BLOB chain9[] = {
1674  { sizeof(chain9_0), chain9_0 },
1675  { sizeof(chain7_1), chain7_1 },
1676 };
1677 static const CERT_TRUST_STATUS elementStatus9[] = {
1678  { CERT_TRUST_NO_ERROR, CERT_TRUST_HAS_NAME_MATCH_ISSUER },
1679  { CERT_TRUST_INVALID_BASIC_CONSTRAINTS, CERT_TRUST_HAS_NAME_MATCH_ISSUER },
1680  { CERT_TRUST_INVALID_BASIC_CONSTRAINTS | CERT_TRUST_IS_CYCLIC,
1681    CERT_TRUST_HAS_NAME_MATCH_ISSUER },
1682 };
1683 static const SimpleChainStatusCheck simpleStatus9[] = {
1684  { sizeof(elementStatus9) / sizeof(elementStatus9[0]), elementStatus9 },
1685 };
1686 static CONST_DATA_BLOB chain10[] = {
1687  { sizeof(chain0_0), chain0_0 },
1688  { sizeof(chain10_1), chain10_1 },
1689  { sizeof(chain7_1), chain7_1 },
1690 };
1691 static const CERT_TRUST_STATUS elementStatus10[] = {
1692  { CERT_TRUST_NO_ERROR, CERT_TRUST_HAS_NAME_MATCH_ISSUER },
1693  { CERT_TRUST_IS_UNTRUSTED_ROOT,
1694    CERT_TRUST_IS_SELF_SIGNED | CERT_TRUST_HAS_NAME_MATCH_ISSUER },
1695 };
1696 static const SimpleChainStatusCheck simpleStatus10[] = {
1697  { sizeof(elementStatus10) / sizeof(elementStatus10[0]), elementStatus10 },
1698 };
1699 static CONST_DATA_BLOB chain11[] = {
1700  { sizeof(chain0_0), chain0_0 },
1701  { sizeof(chain11_1), chain11_1 },
1702  { sizeof(chain7_1), chain7_1 },
1703 };
1704 static CONST_DATA_BLOB chain12[] = {
1705  { sizeof(chain12_0), chain12_0 },
1706  { sizeof(chain7_1), chain7_1 },
1707 };
1708 static const CERT_TRUST_STATUS elementStatus12[] = {
1709  { CERT_TRUST_NO_ERROR, CERT_TRUST_HAS_NAME_MATCH_ISSUER },
1710  { CERT_TRUST_IS_NOT_SIGNATURE_VALID | CERT_TRUST_IS_UNTRUSTED_ROOT,
1711    CERT_TRUST_IS_SELF_SIGNED | CERT_TRUST_HAS_NAME_MATCH_ISSUER },
1712 };
1713 static const SimpleChainStatusCheck simpleStatus12[] = {
1714  { sizeof(elementStatus12) / sizeof(elementStatus12[0]), elementStatus12 },
1715 };
1716 static CONST_DATA_BLOB chain13[] = {
1717  { sizeof(chain0_0), chain0_0 },
1718  { sizeof(chain13_1), chain13_1 },
1719 };
1720 static const CERT_TRUST_STATUS elementStatus13[] = {
1721  { CERT_TRUST_NO_ERROR, CERT_TRUST_HAS_NAME_MATCH_ISSUER },
1722  { CERT_TRUST_IS_UNTRUSTED_ROOT,
1723    CERT_TRUST_IS_SELF_SIGNED | CERT_TRUST_HAS_NAME_MATCH_ISSUER },
1724 };
1725 static const SimpleChainStatusCheck simpleStatus13[] = {
1726  { sizeof(elementStatus13) / sizeof(elementStatus13[0]), elementStatus13 },
1727 };
1728 static CONST_DATA_BLOB chain14[] = {
1729  { sizeof(chain14_0), chain14_0 },
1730  { sizeof(chain14_1), chain14_1 },
1731 };
1732 static const CERT_TRUST_STATUS elementStatus14[] = {
1733  { CERT_TRUST_NO_ERROR, CERT_TRUST_HAS_NAME_MATCH_ISSUER },
1734  { CERT_TRUST_IS_UNTRUSTED_ROOT,
1735    CERT_TRUST_IS_SELF_SIGNED | CERT_TRUST_HAS_NAME_MATCH_ISSUER },
1736 };
1737 static const SimpleChainStatusCheck simpleStatus14[] = {
1738  { sizeof(elementStatus14) / sizeof(elementStatus14[0]), elementStatus14 },
1739 };
1740 static CONST_DATA_BLOB chain15[] = {
1741  { sizeof(chain15_0), chain15_0 },
1742  { sizeof(chain14_1), chain14_1 },
1743 };
1744 static const CERT_TRUST_STATUS elementStatus15[] = {
1745  { CERT_TRUST_NO_ERROR, CERT_TRUST_HAS_NAME_MATCH_ISSUER },
1746  { CERT_TRUST_IS_UNTRUSTED_ROOT | CERT_TRUST_IS_NOT_VALID_FOR_USAGE,
1747    CERT_TRUST_IS_SELF_SIGNED | CERT_TRUST_HAS_NAME_MATCH_ISSUER },
1748 };
1749 static const SimpleChainStatusCheck simpleStatus15[] = {
1750  { sizeof(elementStatus15) / sizeof(elementStatus15[0]), elementStatus15 },
1751 };
1752 static CONST_DATA_BLOB chain16[] = {
1753  { sizeof(chain0_0), chain0_0 },
1754  { sizeof(chain16_1), chain16_1 },
1755 };
1756 static const CERT_TRUST_STATUS elementStatus16[] = {
1757  { CERT_TRUST_NO_ERROR | CERT_TRUST_IS_NOT_VALID_FOR_USAGE,
1758    CERT_TRUST_HAS_NAME_MATCH_ISSUER },
1759  { CERT_TRUST_IS_UNTRUSTED_ROOT,
1760    CERT_TRUST_IS_SELF_SIGNED | CERT_TRUST_HAS_NAME_MATCH_ISSUER },
1761 };
1762 static const SimpleChainStatusCheck simpleStatus16[] = {
1763  { sizeof(elementStatus16) / sizeof(elementStatus16[0]), elementStatus16 },
1764 };
1765 static CONST_DATA_BLOB chain17[] = {
1766  { sizeof(chain0_0), chain0_0 },
1767  { sizeof(chain17_1), chain17_1 },
1768  { sizeof(chain17_2), chain17_2 },
1769 };
1770 static const CERT_TRUST_STATUS elementStatus17[] = {
1771  { CERT_TRUST_NO_ERROR, CERT_TRUST_HAS_NAME_MATCH_ISSUER },
1772  { CERT_TRUST_NO_ERROR, CERT_TRUST_HAS_NAME_MATCH_ISSUER },
1773  { CERT_TRUST_IS_UNTRUSTED_ROOT,
1774    CERT_TRUST_IS_SELF_SIGNED | CERT_TRUST_HAS_NAME_MATCH_ISSUER },
1775 };
1776 static const SimpleChainStatusCheck simpleStatus17[] = {
1777  { sizeof(elementStatus17) / sizeof(elementStatus17[0]), elementStatus17 },
1778 };
1779 static CONST_DATA_BLOB chain18[] = {
1780  { sizeof(chain0_0), chain0_0 },
1781  { sizeof(chain18_1), chain18_1 },
1782  { sizeof(chain18_2), chain18_2 },
1783 };
1784 static const CERT_TRUST_STATUS elementStatus18[] = {
1785  { CERT_TRUST_NO_ERROR, CERT_TRUST_HAS_NAME_MATCH_ISSUER },
1786  { CERT_TRUST_IS_NOT_VALID_FOR_USAGE, CERT_TRUST_HAS_NAME_MATCH_ISSUER },
1787  { CERT_TRUST_IS_UNTRUSTED_ROOT,
1788    CERT_TRUST_IS_SELF_SIGNED | CERT_TRUST_HAS_NAME_MATCH_ISSUER },
1789 };
1790 static const SimpleChainStatusCheck simpleStatus18[] = {
1791  { sizeof(elementStatus18) / sizeof(elementStatus18[0]), elementStatus18 },
1792 };
1793 static CONST_DATA_BLOB selfSignedChain[] = {
1794  { sizeof(selfSignedCert), selfSignedCert }
1795 };
1796 static const CERT_TRUST_STATUS selfSignedElementStatus[] = {
1797  { CERT_TRUST_IS_NOT_TIME_VALID | CERT_TRUST_IS_UNTRUSTED_ROOT,
1798    CERT_TRUST_HAS_NAME_MATCH_ISSUER | CERT_TRUST_IS_SELF_SIGNED },
1799 };
1800 static const SimpleChainStatusCheck selfSignedSimpleStatus[] = {
1801  { sizeof(selfSignedElementStatus) / sizeof(selfSignedElementStatus[0]),
1802    selfSignedElementStatus },
1803 };
1804 static CONST_DATA_BLOB iTunesChain[] = {
1805  { sizeof(verisignCA), verisignCA },
1806  { sizeof(iTunesCert0), iTunesCert0 },
1807  { sizeof(iTunesCert1), iTunesCert1 },
1808 };
1809 static const CERT_TRUST_STATUS iTunesElementStatus[] = {
1810  { CERT_TRUST_NO_ERROR, CERT_TRUST_HAS_KEY_MATCH_ISSUER },
1811  { CERT_TRUST_NO_ERROR, CERT_TRUST_HAS_EXACT_MATCH_ISSUER },
1812  { CERT_TRUST_NO_ERROR,
1813    CERT_TRUST_HAS_NAME_MATCH_ISSUER | CERT_TRUST_IS_SELF_SIGNED},
1814 };
1815 static const SimpleChainStatusCheck iTunesSimpleStatus[] = {
1816  { sizeof(iTunesElementStatus) / sizeof(iTunesElementStatus[0]),
1817    iTunesElementStatus },
1818 };
1819 static CONST_DATA_BLOB googleChain[] = {
1820  { sizeof(verisignCA), verisignCA },
1821  { sizeof(thawte_sgc_ca), thawte_sgc_ca },
1822  { sizeof(google), google },
1823 };
1824 /* The Google cert is only valid from 3/27/2009 to 3/27/2010, so with the date
1825  * tested (October 2007) it's not time valid.
1826  */
1827 static const CERT_TRUST_STATUS googleElementStatus[] = {
1828  { CERT_TRUST_IS_NOT_TIME_VALID, CERT_TRUST_HAS_NAME_MATCH_ISSUER },
1829  { CERT_TRUST_NO_ERROR, CERT_TRUST_HAS_NAME_MATCH_ISSUER },
1830  { CERT_TRUST_NO_ERROR,
1831    CERT_TRUST_HAS_NAME_MATCH_ISSUER | CERT_TRUST_IS_SELF_SIGNED},
1832 };
1833 static const SimpleChainStatusCheck googleSimpleStatus[] = {
1834  { sizeof(googleElementStatus) / sizeof(googleElementStatus[0]),
1835    googleElementStatus },
1836 };
1837 static ChainCheck chainCheck[] = {
1838  /* Windows XP erroneously sets CERT_TRUST_HAS_PREFERRED_ISSUER on all
1839   * elements, so ignore it.
1840   * Windows 98/NT4 also set CERT_TRUST_IS_NOT_TIME_NESTED on chains they
1841   * shouldn't, so ignore those too.
1842   */
1843  { { sizeof(chain0) / sizeof(chain0[0]), chain0 },
1844    { { CERT_TRUST_IS_NOT_TIME_NESTED, CERT_TRUST_HAS_PREFERRED_ISSUER },
1845      { CERT_TRUST_IS_UNTRUSTED_ROOT | CERT_TRUST_IS_NOT_TIME_VALID, 0 },
1846      1, simpleStatus0 }, 0 },
1847  { { sizeof(chain1) / sizeof(chain1[0]), chain1 },
1848    { { CERT_TRUST_IS_NOT_TIME_NESTED, CERT_TRUST_HAS_PREFERRED_ISSUER },
1849      { CERT_TRUST_IS_UNTRUSTED_ROOT | CERT_TRUST_IS_NOT_SIGNATURE_VALID |
1850        CERT_TRUST_IS_NOT_TIME_VALID, 0 },
1851      1, simpleStatus1 }, 0 },
1852  { { sizeof(chain2) / sizeof(chain2[0]), chain2 },
1853    { { CERT_TRUST_IS_NOT_TIME_NESTED, CERT_TRUST_HAS_PREFERRED_ISSUER },
1854      { CERT_TRUST_IS_UNTRUSTED_ROOT | CERT_TRUST_IS_NOT_TIME_VALID, 0 },
1855      1, simpleStatus2 }, 0 },
1856  /* Earlier versions of Windows incorrectly don't set
1857   * CERT_TRUST_INVALID_BASIC_CONSTRAINTS on this chain.
1858   */
1859  { { sizeof(chain3) / sizeof(chain3[0]), chain3 },
1860    { { CERT_TRUST_IS_NOT_TIME_NESTED | CERT_TRUST_INVALID_BASIC_CONSTRAINTS,
1861        CERT_TRUST_HAS_PREFERRED_ISSUER },
1862      { CERT_TRUST_INVALID_BASIC_CONSTRAINTS | CERT_TRUST_IS_UNTRUSTED_ROOT |
1863        CERT_TRUST_IS_NOT_TIME_VALID, 0 },
1864      1, simpleStatus3 }, 0 },
1865  /* Earlier versions of Windows incorrectly don't set
1866   * CERT_TRUST_INVALID_BASIC_CONSTRAINTS on this chain.
1867   */
1868  { { sizeof(chain4) / sizeof(chain4[0]), chain4 },
1869    { { CERT_TRUST_IS_NOT_TIME_NESTED | CERT_TRUST_INVALID_BASIC_CONSTRAINTS,
1870        CERT_TRUST_HAS_PREFERRED_ISSUER },
1871      { CERT_TRUST_INVALID_BASIC_CONSTRAINTS | CERT_TRUST_IS_UNTRUSTED_ROOT |
1872        CERT_TRUST_IS_NOT_TIME_VALID, 0 },
1873      1, simpleStatus4 }, 0 },
1874  /* Windows versions prior to Vista/2008 incorrectly set
1875   * CERT_TRUST_HAS_NOT_DEFINED_NAME_CONSTRAINT on this chain, so ignore it.
1876   * Similarly, some older versions of Windows incorrectly set
1877   * CERT_TRUST_HAS_NOT_PERMITTED_NAME_CONSTRAINT, ignore that too.
1878   */
1879  { { sizeof(chain5) / sizeof(chain5[0]), chain5 },
1880    { { CERT_TRUST_HAS_NOT_DEFINED_NAME_CONSTRAINT |
1881        CERT_TRUST_HAS_NOT_PERMITTED_NAME_CONSTRAINT,
1882        CERT_TRUST_HAS_PREFERRED_ISSUER },
1883      { CERT_TRUST_HAS_NOT_PERMITTED_NAME_CONSTRAINT |
1884        CERT_TRUST_IS_UNTRUSTED_ROOT, 0 }, 1, simpleStatus5 }, 0 },
1885  { { sizeof(chain6) / sizeof(chain6[0]), chain6 },
1886    { { 0, CERT_TRUST_HAS_PREFERRED_ISSUER },
1887      { CERT_TRUST_IS_UNTRUSTED_ROOT, 0 }, 1, simpleStatus6 }, 0 },
1888  { { sizeof(chain7) / sizeof(chain7[0]), chain7 },
1889    { { 0, CERT_TRUST_HAS_PREFERRED_ISSUER },
1890      { CERT_TRUST_IS_UNTRUSTED_ROOT, 0 }, 1, simpleStatus7 }, 0 },
1891  /* Earlier versions of Windows incorrectly don't set
1892   * CERT_TRUST_INVALID_BASIC_CONSTRAINTS on this chain.
1893   */
1894  { { sizeof(chain8) / sizeof(chain8[0]), chain8 },
1895    { { CERT_TRUST_IS_NOT_TIME_NESTED | CERT_TRUST_INVALID_BASIC_CONSTRAINTS,
1896        CERT_TRUST_HAS_PREFERRED_ISSUER },
1897      { CERT_TRUST_INVALID_BASIC_CONSTRAINTS | CERT_TRUST_IS_UNTRUSTED_ROOT |
1898        CERT_TRUST_IS_NOT_TIME_VALID, 0 },
1899      1, simpleStatus8 }, 0 },
1900  /* Earlier versions of Windows incorrectly don't set
1901   * CERT_TRUST_INVALID_BASIC_CONSTRAINTS on this chain.
1902   */
1903  { { sizeof(chain9) / sizeof(chain9[0]), chain9 },
1904    { { CERT_TRUST_IS_NOT_TIME_NESTED | CERT_TRUST_INVALID_BASIC_CONSTRAINTS,
1905        CERT_TRUST_HAS_PREFERRED_ISSUER },
1906      { CERT_TRUST_IS_PARTIAL_CHAIN |
1907        CERT_TRUST_INVALID_BASIC_CONSTRAINTS | CERT_TRUST_IS_CYCLIC, 0 },
1908      1, simpleStatus9 }, 0 },
1909  { { sizeof(chain10) / sizeof(chain10[0]), chain10 },
1910    { { 0, CERT_TRUST_HAS_PREFERRED_ISSUER },
1911      { CERT_TRUST_IS_UNTRUSTED_ROOT, 0 }, 1, simpleStatus10 }, 0 },
1912  { { sizeof(chain11) / sizeof(chain11[0]), chain11 },
1913    { { 0, CERT_TRUST_HAS_PREFERRED_ISSUER },
1914      { CERT_TRUST_IS_UNTRUSTED_ROOT, 0 }, 1, simpleStatus10 }, 0 },
1915  { { sizeof(chain12) / sizeof(chain12[0]), chain12 },
1916    { { 0, CERT_TRUST_HAS_PREFERRED_ISSUER },
1917      { CERT_TRUST_IS_UNTRUSTED_ROOT | CERT_TRUST_IS_NOT_SIGNATURE_VALID, 0 },
1918      1, simpleStatus12 }, 0 },
1919  { { sizeof(chain13) / sizeof(chain13[0]), chain13 },
1920    { { CERT_TRUST_IS_NOT_TIME_NESTED, CERT_TRUST_HAS_PREFERRED_ISSUER },
1921      { CERT_TRUST_IS_UNTRUSTED_ROOT, 0 }, 1, simpleStatus13 },
1922    0 },
1923  { { sizeof(chain14) / sizeof(chain14[0]), chain14 },
1924    { { CERT_TRUST_IS_NOT_TIME_NESTED, CERT_TRUST_HAS_PREFERRED_ISSUER },
1925      { CERT_TRUST_IS_UNTRUSTED_ROOT, 0 }, 1, simpleStatus14 },
1926    0 },
1927  /* Earlier versions of crypt32 incorrectly do not complain that the end cert's
1928   * key usage is invalid, so ignore that error.
1929   */
1930  { { sizeof(chain15) / sizeof(chain15[0]), chain15 },
1931    { { CERT_TRUST_IS_NOT_TIME_NESTED | CERT_TRUST_IS_NOT_VALID_FOR_USAGE,
1932        CERT_TRUST_HAS_PREFERRED_ISSUER },
1933      { CERT_TRUST_IS_UNTRUSTED_ROOT | CERT_TRUST_IS_NOT_VALID_FOR_USAGE, 0 },
1934      1, simpleStatus15 },
1935    0 },
1936  { { sizeof(chain16) / sizeof(chain16[0]), chain16 },
1937    { { CERT_TRUST_IS_NOT_TIME_NESTED | CERT_TRUST_IS_NOT_VALID_FOR_USAGE,
1938        CERT_TRUST_HAS_PREFERRED_ISSUER },
1939      { CERT_TRUST_IS_UNTRUSTED_ROOT | CERT_TRUST_IS_NOT_VALID_FOR_USAGE, 0 },
1940      1, simpleStatus16 },
1941    0 },
1942  { { sizeof(chain17) / sizeof(chain17[0]), chain17 },
1943    { { CERT_TRUST_IS_NOT_TIME_NESTED, CERT_TRUST_HAS_PREFERRED_ISSUER },
1944      { CERT_TRUST_IS_UNTRUSTED_ROOT, 0 }, 1, simpleStatus17 },
1945    0 },
1946  { { sizeof(chain18) / sizeof(chain18[0]), chain18 },
1947    { { CERT_TRUST_IS_NOT_TIME_NESTED | CERT_TRUST_IS_NOT_VALID_FOR_USAGE,
1948        CERT_TRUST_HAS_PREFERRED_ISSUER },
1949      { CERT_TRUST_IS_UNTRUSTED_ROOT | CERT_TRUST_IS_NOT_VALID_FOR_USAGE, 0 },
1950      1, simpleStatus18 },
1951    0 },
1952  { { sizeof(selfSignedChain) / sizeof(selfSignedChain[0]), selfSignedChain },
1953    { { 0, CERT_TRUST_HAS_PREFERRED_ISSUER },
1954      { CERT_TRUST_IS_NOT_TIME_VALID | CERT_TRUST_IS_UNTRUSTED_ROOT, 0 },
1955      1, selfSignedSimpleStatus }, 0 },
1956  /* The iTunes chain may or may not have its root trusted, so ignore the
1957   * error
1958   */
1959  { { sizeof(iTunesChain) / sizeof(iTunesChain[0]), iTunesChain },
1960    { { CERT_TRUST_IS_UNTRUSTED_ROOT, CERT_TRUST_HAS_PREFERRED_ISSUER },
1961      { 0, 0 },
1962        1, iTunesSimpleStatus }, 0 },
1963  /* The google chain may or may not have its root trusted, so ignore the error
1964   */
1965  { { sizeof(googleChain) / sizeof(googleChain[0]), googleChain },
1966    { { CERT_TRUST_IS_UNTRUSTED_ROOT, CERT_TRUST_HAS_PREFERRED_ISSUER },
1967      { CERT_TRUST_IS_NOT_TIME_VALID, 0 },
1968        1, googleSimpleStatus }, 0 },
1969 };
1970
1971 static const CERT_TRUST_STATUS elementStatus8NoStore[] = {
1972  { CERT_TRUST_NO_ERROR, CERT_TRUST_HAS_NAME_MATCH_ISSUER },
1973 };
1974 static const SimpleChainStatusCheck simpleStatus8NoStore[] = {
1975  { sizeof(elementStatus8NoStore) / sizeof(elementStatus8NoStore[0]),
1976    elementStatus8NoStore },
1977 };
1978 static ChainCheck chainCheckNoStore[] = {
1979  { { sizeof(selfSignedChain) / sizeof(selfSignedChain[0]), selfSignedChain },
1980    { { 0, CERT_TRUST_HAS_PREFERRED_ISSUER },
1981      { CERT_TRUST_IS_NOT_TIME_VALID | CERT_TRUST_IS_UNTRUSTED_ROOT, 0 },
1982      1, selfSignedSimpleStatus },
1983    0 },
1984  { { sizeof(chain8) / sizeof(chain8[0]), chain8 },
1985    { { 0, CERT_TRUST_HAS_PREFERRED_ISSUER },
1986      { CERT_TRUST_IS_PARTIAL_CHAIN, 0 },
1987      1, simpleStatus8NoStore },
1988    0 },
1989 };
1990
1991 /* Wednesday, Oct 1, 2007 */
1992 static SYSTEMTIME oct2007 = { 2007, 10, 1, 1, 0, 0, 0, 0 };
1993 /* Wednesday, Oct 28, 2009 */
1994 static SYSTEMTIME oct2009 = { 2009, 10, 3, 28, 0, 0, 0, 0 };
1995
1996 static void testGetCertChain(void)
1997 {
1998     BOOL ret;
1999     PCCERT_CONTEXT cert;
2000     CERT_CHAIN_PARA para = { 0 };
2001     PCCERT_CHAIN_CONTEXT chain;
2002     DWORD i;
2003
2004     /* Basic parameter checks */
2005     if (0)
2006     {
2007         /* Crash on Vista */
2008         ret = pCertGetCertificateChain(NULL, NULL, NULL, NULL, NULL, 0, NULL, NULL);
2009         ok(!ret && GetLastError() == E_INVALIDARG,
2010          "Expected E_INVALIDARG, got %08x\n", GetLastError());
2011     }
2012     ret = pCertGetCertificateChain(NULL, NULL, NULL, NULL, NULL, 0, NULL,
2013      &chain);
2014     ok(!ret && GetLastError() == E_INVALIDARG,
2015      "Expected E_INVALIDARG, got %08x\n", GetLastError());
2016     /* Crash
2017     ret = pCertGetCertificateChain(NULL, NULL, NULL, NULL, &para, 0, NULL, NULL);
2018     ret = pCertGetCertificateChain(NULL, NULL, NULL, NULL, &para, 0, NULL,
2019      &chain);
2020      */
2021     cert = CertCreateCertificateContext(X509_ASN_ENCODING, bigCert,
2022      sizeof(bigCert));
2023     if (0)
2024     {
2025         /* Crash on Vista */
2026         ret = pCertGetCertificateChain(NULL, cert, NULL, NULL, NULL, 0, NULL, NULL);
2027         ok(!ret && GetLastError() == E_INVALIDARG,
2028          "Expected E_INVALIDARG, got %08x\n", GetLastError());
2029     }
2030     /* Crash
2031     ret = pCertGetCertificateChain(NULL, cert, NULL, NULL, &para, 0, NULL, NULL);
2032      */
2033
2034     /* Tests with an invalid cert (one whose signature is bad) */
2035     SetLastError(0xdeadbeef);
2036     ret = pCertGetCertificateChain(NULL, cert, NULL, NULL, &para, 0, NULL,
2037      &chain);
2038     ok(!ret, "Expected failure\n");
2039     ok(GetLastError() == ERROR_INVALID_DATA ||
2040      GetLastError() == CRYPT_E_ASN1_BADTAG /* Vista */,
2041      "Expected ERROR_INVALID_DATA or CRYPT_E_ASN1_BADTAG, got %d\n", GetLastError());
2042     para.cbSize = sizeof(para);
2043     SetLastError(0xdeadbeef);
2044     ret = pCertGetCertificateChain(NULL, cert, NULL, NULL, &para, 0, NULL,
2045      &chain);
2046     ok(!ret, "Expected failure\n");
2047     ok(GetLastError() == ERROR_INVALID_DATA ||
2048      GetLastError() == CRYPT_E_ASN1_BADTAG /* Vista */,
2049      "Expected ERROR_INVALID_DATA or CRYPT_E_ASN1_BADTAG, got %d\n", GetLastError());
2050
2051     para.cbSize = 0;
2052     SetLastError(0xdeadbeef);
2053     ret = pCertGetCertificateChain(NULL, cert, NULL, NULL, &para, 0, NULL,
2054      &chain);
2055     ok(!ret, "Expected failure\n");
2056     ok(GetLastError() == ERROR_INVALID_DATA ||
2057      GetLastError() == CRYPT_E_ASN1_BADTAG, /* Vista and higher */
2058      "Expected ERROR_INVALID_DATA or CRYPT_E_ASN1_BADTAG, got %d\n", GetLastError());
2059
2060     CertFreeCertificateContext(cert);
2061
2062     for (i = 0; i < sizeof(chainCheck) / sizeof(chainCheck[0]); i++)
2063     {
2064         chain = getChain(&chainCheck[i].certs, 0, TRUE, &oct2007,
2065          chainCheck[i].todo, i);
2066         if (chain)
2067         {
2068             checkChainStatus(chain, &chainCheck[i].status, chainCheck[i].todo,
2069              i);
2070             pCertFreeCertificateChain(chain);
2071         }
2072     }
2073     for (i = 0; i < sizeof(chainCheckNoStore) / sizeof(chainCheckNoStore[0]);
2074      i++)
2075     {
2076         chain = getChain(&chainCheckNoStore[i].certs, 0, FALSE, &oct2007,
2077          chainCheckNoStore[i].todo, i);
2078         if (chain)
2079         {
2080             checkChainStatus(chain, &chainCheckNoStore[i].status,
2081              chainCheckNoStore[i].todo, i);
2082             pCertFreeCertificateChain(chain);
2083         }
2084     }
2085 }
2086
2087 static void test_CERT_CHAIN_PARA_cbSize(void)
2088 {
2089     BOOL ret;
2090     PCCERT_CONTEXT cert;
2091     CERT_CHAIN_PARA para = { 0 };
2092     PCCERT_CHAIN_CONTEXT chain;
2093     HCERTSTORE store;
2094     DWORD i;
2095
2096     store = CertOpenStore(CERT_STORE_PROV_MEMORY, 0, 0,
2097      CERT_STORE_CREATE_NEW_FLAG, NULL);
2098
2099     ret = CertAddEncodedCertificateToStore(store,
2100      X509_ASN_ENCODING, chain0_0, sizeof(chain0_0),
2101      CERT_STORE_ADD_ALWAYS, NULL);
2102     ret = CertAddEncodedCertificateToStore(store,
2103      X509_ASN_ENCODING, chain0_1, sizeof(chain0_1),
2104      CERT_STORE_ADD_ALWAYS, &cert);
2105
2106     for (i = 0; i < sizeof(CERT_CHAIN_PARA) + 2; i++)
2107     {
2108         FILETIME fileTime;
2109
2110         SystemTimeToFileTime(&oct2007, &fileTime);
2111
2112         para.cbSize = i;
2113         ret = pCertGetCertificateChain(NULL, cert, &fileTime,
2114          NULL, &para, 0, NULL, &chain);
2115         ok(ret, "CertGetCertificateChain failed %u\n", GetLastError());
2116         pCertFreeCertificateChain(chain);
2117     }
2118
2119     CertCloseStore(store, 0);
2120 }
2121
2122 typedef struct _ChainPolicyCheck
2123 {
2124     CONST_BLOB_ARRAY                certs;
2125     CERT_CHAIN_POLICY_STATUS        status;
2126     const CERT_CHAIN_POLICY_STATUS *brokenStatus;
2127     DWORD                           todo;
2128 } ChainPolicyCheck;
2129
2130 static const ChainPolicyCheck basePolicyCheck[] = {
2131  { { sizeof(chain0) / sizeof(chain0[0]), chain0 },
2132    { 0, CERT_E_UNTRUSTEDROOT, 0, 1, NULL }, NULL, 0 },
2133  { { sizeof(chain1) / sizeof(chain1[0]), chain1 },
2134    { 0, TRUST_E_CERT_SIGNATURE, 0, 0, NULL }, NULL, 0 },
2135  { { sizeof(chain2) / sizeof(chain2[0]), chain2 },
2136    { 0, CERT_E_UNTRUSTEDROOT, 0, 1, NULL }, NULL, 0 },
2137  { { sizeof(chain3) / sizeof(chain3[0]), chain3 },
2138    { 0, CERT_E_UNTRUSTEDROOT, 0, 1, NULL }, NULL, 0 },
2139  { { sizeof(chain4) / sizeof(chain4[0]), chain4 },
2140    { 0, CERT_E_UNTRUSTEDROOT, 0, 2, NULL }, NULL, 0 },
2141  { { sizeof(chain5) / sizeof(chain5[0]), chain5 },
2142    { 0, CERT_E_UNTRUSTEDROOT, 0, 1, NULL }, NULL, 0 },
2143  { { sizeof(chain6) / sizeof(chain6[0]), chain6 },
2144    { 0, CERT_E_UNTRUSTEDROOT, 0, 1, NULL }, NULL, 0 },
2145  { { sizeof(chain7) / sizeof(chain7[0]), chain7 },
2146    { 0, CERT_E_UNTRUSTEDROOT, 0, 1, NULL }, NULL, 0 },
2147  { { sizeof(chain8) / sizeof(chain8[0]), chain8 },
2148    { 0, CERT_E_UNTRUSTEDROOT, 0, 2, NULL }, NULL, 0 },
2149  { { sizeof(chain9) / sizeof(chain9[0]), chain9 },
2150    { 0, CERT_E_CHAINING, 0, -1, NULL }, NULL, 0 },
2151  { { sizeof(chain10) / sizeof(chain10[0]), chain10 },
2152    { 0, CERT_E_UNTRUSTEDROOT, 0, 1, NULL }, NULL, 0 },
2153  { { sizeof(chain11) / sizeof(chain11[0]), chain11 },
2154    { 0, CERT_E_UNTRUSTEDROOT, 0, 1, NULL }, NULL, 0 },
2155  { { sizeof(chain12) / sizeof(chain12[0]), chain12 },
2156    { 0, TRUST_E_CERT_SIGNATURE, 0, 1, NULL }, NULL, 0 },
2157  { { sizeof(selfSignedChain) / sizeof(selfSignedChain[0]), selfSignedChain },
2158    { 0, CERT_E_UNTRUSTEDROOT, 0, 0, NULL }, NULL, 0 },
2159 };
2160
2161 static const ChainPolicyCheck sslPolicyCheck[] = {
2162  { { sizeof(chain0) / sizeof(chain0[0]), chain0 },
2163    { 0, CERT_E_UNTRUSTEDROOT, 0, 1, NULL }, NULL, 0 },
2164  { { sizeof(chain1) / sizeof(chain1[0]), chain1 },
2165    { 0, TRUST_E_CERT_SIGNATURE, 0, 0, NULL }, NULL, 0 },
2166  { { sizeof(chain2) / sizeof(chain2[0]), chain2 },
2167    { 0, CERT_E_UNTRUSTEDROOT, 0, 1, NULL }, NULL, 0 },
2168  { { sizeof(chain3) / sizeof(chain3[0]), chain3 },
2169    { 0, CERT_E_UNTRUSTEDROOT, 0, 1, NULL }, NULL, 0 },
2170  { { sizeof(chain4) / sizeof(chain4[0]), chain4 },
2171    { 0, CERT_E_UNTRUSTEDROOT, 0, 2, NULL }, NULL, 0 },
2172  { { sizeof(chain5) / sizeof(chain5[0]), chain5 },
2173    { 0, CERT_E_UNTRUSTEDROOT, 0, 1, NULL }, NULL, 0 },
2174  { { sizeof(chain6) / sizeof(chain6[0]), chain6 },
2175    { 0, CERT_E_UNTRUSTEDROOT, 0, 1, NULL }, NULL, 0 },
2176  { { sizeof(chain7) / sizeof(chain7[0]), chain7 },
2177    { 0, CERT_E_UNTRUSTEDROOT, 0, 1, NULL }, NULL, 0 },
2178  { { sizeof(chain8) / sizeof(chain8[0]), chain8 },
2179    { 0, CERT_E_UNTRUSTEDROOT, 0, 2, NULL }, NULL, 0 },
2180  { { sizeof(chain9) / sizeof(chain9[0]), chain9 },
2181    { 0, CERT_E_UNTRUSTEDROOT, 0, -1, NULL }, NULL, 0 },
2182  { { sizeof(chain10) / sizeof(chain10[0]), chain10 },
2183    { 0, CERT_E_UNTRUSTEDROOT, 0, 1, NULL }, NULL, 0 },
2184  { { sizeof(chain11) / sizeof(chain11[0]), chain11 },
2185    { 0, CERT_E_UNTRUSTEDROOT, 0, 1, NULL }, NULL, 0 },
2186  { { sizeof(chain12) / sizeof(chain12[0]), chain12 },
2187    { 0, TRUST_E_CERT_SIGNATURE, 0, 1, NULL }, NULL, 0 },
2188  { { sizeof(selfSignedChain) / sizeof(selfSignedChain[0]), selfSignedChain },
2189    { 0, CERT_E_UNTRUSTEDROOT, 0, 0, NULL }, NULL, 0 },
2190 };
2191
2192 static const ChainPolicyCheck sslPolicyCheckWithMatchingNameExpired = {
2193  { sizeof(googleChain) / sizeof(googleChain[0]), googleChain },
2194  { 0, CERT_E_EXPIRED, 0, 0, NULL}, NULL, 0
2195 };
2196
2197 static const ChainPolicyCheck sslPolicyCheckWithMatchingName = {
2198  { sizeof(googleChain) / sizeof(googleChain[0]), googleChain },
2199  { 0, 0, -1, -1, NULL}, NULL, 0
2200 };
2201
2202 static const ChainPolicyCheck sslPolicyCheckWithoutMatchingName = {
2203  { sizeof(iTunesChain) / sizeof(iTunesChain[0]), iTunesChain },
2204  { 0, CERT_E_CN_NO_MATCH, 0, 0, NULL}, NULL, 0
2205 };
2206
2207 static const ChainPolicyCheck authenticodePolicyCheck[] = {
2208  { { sizeof(chain0) / sizeof(chain0[0]), chain0 },
2209    { 0, CERT_E_UNTRUSTEDROOT, 0, 1, NULL }, NULL, 0 },
2210  { { sizeof(chain1) / sizeof(chain1[0]), chain1 },
2211    { 0, TRUST_E_CERT_SIGNATURE, 0, 0, NULL }, NULL, 0 },
2212  { { sizeof(chain2) / sizeof(chain2[0]), chain2 },
2213    { 0, CERT_E_UNTRUSTEDROOT, 0, 1, NULL }, NULL, 0 },
2214  { { sizeof(chain3) / sizeof(chain3[0]), chain3 },
2215    { 0, CERT_E_UNTRUSTEDROOT, 0, 1, NULL }, NULL, 0 },
2216  { { sizeof(chain4) / sizeof(chain4[0]), chain4 },
2217    { 0, CERT_E_UNTRUSTEDROOT, 0, 2, NULL }, NULL, 0 },
2218  { { sizeof(chain5) / sizeof(chain5[0]), chain5 },
2219    { 0, CERT_E_UNTRUSTEDROOT, 0, 1, NULL }, NULL, 0 },
2220  { { sizeof(chain6) / sizeof(chain6[0]), chain6 },
2221    { 0, CERT_E_UNTRUSTEDROOT, 0, 1, NULL }, NULL, 0 },
2222  { { sizeof(chain7) / sizeof(chain7[0]), chain7 },
2223    { 0, CERT_E_UNTRUSTEDROOT, 0, 1, NULL }, NULL, 0 },
2224  { { sizeof(chain8) / sizeof(chain8[0]), chain8 },
2225    { 0, CERT_E_UNTRUSTEDROOT, 0, 2, NULL }, NULL, 0 },
2226  { { sizeof(chain9) / sizeof(chain9[0]), chain9 },
2227    { 0, CERT_E_CHAINING, 0, -1, NULL }, NULL, 0 },
2228  { { sizeof(chain10) / sizeof(chain10[0]), chain10 },
2229    { 0, CERT_E_UNTRUSTEDROOT, 0, 1, NULL }, NULL, 0 },
2230  { { sizeof(chain11) / sizeof(chain11[0]), chain11 },
2231    { 0, CERT_E_UNTRUSTEDROOT, 0, 1, NULL }, NULL, 0 },
2232  { { sizeof(chain12) / sizeof(chain12[0]), chain12 },
2233    { 0, TRUST_E_CERT_SIGNATURE, 0, 1, NULL }, NULL, 0 },
2234  { { sizeof(selfSignedChain) / sizeof(selfSignedChain[0]), selfSignedChain },
2235    { 0, CERT_E_UNTRUSTEDROOT, 0, 0, NULL }, NULL, 0 },
2236 };
2237
2238 /* On some older systems, the element index is set to 2 rather than 1 for
2239  * chain 4, because they do not catch the basic constraints error in the
2240  * chain, which occurs at element 1.
2241  */
2242 static const CERT_CHAIN_POLICY_STATUS chain4BrokenStatus =
2243  { 0, TRUST_E_BASIC_CONSTRAINTS, 0, 2, NULL };
2244
2245 static const ChainPolicyCheck basicConstraintsPolicyCheck[] = {
2246  { { sizeof(chain0) / sizeof(chain0[0]), chain0 },
2247    { 0, 0, -1, -1, NULL }, NULL, 0 },
2248  { { sizeof(chain1) / sizeof(chain1[0]), chain1 },
2249    { 0, 0, -1, -1, NULL }, NULL, 0 },
2250  { { sizeof(chain2) / sizeof(chain2[0]), chain2 },
2251    { 0, 0, -1, -1, NULL }, NULL, 0 },
2252  { { sizeof(chain3) / sizeof(chain3[0]), chain3 },
2253    { 0, TRUST_E_BASIC_CONSTRAINTS, 0, 1, NULL }, NULL, 0 },
2254  { { sizeof(chain4) / sizeof(chain4[0]), chain4 },
2255    { 0, TRUST_E_BASIC_CONSTRAINTS, 0, 1, NULL }, &chain4BrokenStatus, 0 },
2256  { { sizeof(chain5) / sizeof(chain5[0]), chain5 },
2257    { 0, 0, -1, -1, NULL }, NULL, 0 },
2258  { { sizeof(chain6) / sizeof(chain6[0]), chain6 },
2259    { 0, 0, -1, -1, NULL }, NULL, 0 },
2260  { { sizeof(chain7) / sizeof(chain7[0]), chain7 },
2261    { 0, 0, -1, -1, NULL }, NULL, 0 },
2262  { { sizeof(chain8) / sizeof(chain8[0]), chain8 },
2263    { 0, TRUST_E_BASIC_CONSTRAINTS, 0, 1, NULL }, NULL, 0 },
2264  { { sizeof(chain9) / sizeof(chain9[0]), chain9 },
2265    { 0, TRUST_E_BASIC_CONSTRAINTS, 0, 1, NULL }, NULL, 0 },
2266  { { sizeof(chain10) / sizeof(chain10[0]), chain10 },
2267    { 0, 0, -1, -1, NULL }, NULL, 0 },
2268  { { sizeof(chain11) / sizeof(chain11[0]), chain11 },
2269    { 0, 0, -1, -1, NULL }, NULL, 0 },
2270  { { sizeof(chain12) / sizeof(chain12[0]), chain12 },
2271    { 0, 0, -1, -1, NULL }, NULL, 0 },
2272  { { sizeof(selfSignedChain) / sizeof(selfSignedChain[0]), selfSignedChain },
2273    { 0, 0, -1, -1, NULL }, NULL, 0 },
2274 };
2275
2276 static const char *num_to_str(WORD num)
2277 {
2278     static char buf[6];
2279
2280     sprintf(buf, "#%04X", num);
2281     return buf;
2282 }
2283
2284 static void checkChainPolicyStatus(LPCSTR policy, const ChainPolicyCheck *check,
2285  DWORD testIndex, SYSTEMTIME *sysTime, PCERT_CHAIN_POLICY_PARA para)
2286
2287 {
2288     PCCERT_CHAIN_CONTEXT chain = getChain(&check->certs, 0, TRUE, sysTime,
2289      check->todo, testIndex);
2290
2291     if (chain)
2292     {
2293         CERT_CHAIN_POLICY_STATUS policyStatus = { 0 };
2294         BOOL ret = pCertVerifyCertificateChainPolicy(policy, chain, para,
2295          &policyStatus);
2296
2297         if (check->todo & TODO_POLICY)
2298             todo_wine ok(ret,
2299              "%s[%d]: CertVerifyCertificateChainPolicy failed: %08x\n",
2300              HIWORD(policy) ? policy : num_to_str(LOWORD(policy)),
2301              testIndex, GetLastError());
2302         else
2303         {
2304             if (!ret && GetLastError() == ERROR_FILE_NOT_FOUND)
2305             {
2306                 skip("%d: missing policy %s, skipping test\n", testIndex,
2307                  HIWORD(policy) ? policy : num_to_str(LOWORD(policy)));
2308                 pCertFreeCertificateChain(chain);
2309                 return;
2310             }
2311             ok(ret, "%s[%d]: CertVerifyCertificateChainPolicy failed: %08x\n",
2312              HIWORD(policy) ? policy : num_to_str(LOWORD(policy)), testIndex,
2313              GetLastError());
2314         }
2315         if (ret)
2316         {
2317             if (check->todo & TODO_ERROR)
2318                 todo_wine ok(policyStatus.dwError == check->status.dwError ||
2319                  broken(policyStatus.dwError == CERT_TRUST_NO_ERROR) ||
2320                  (check->brokenStatus && broken(policyStatus.dwError ==
2321                  check->brokenStatus->dwError)),
2322                  "%s[%d]: expected %08x, got %08x\n",
2323                  HIWORD(policy) ? policy : num_to_str(LOWORD(policy)),
2324                  testIndex, check->status.dwError, policyStatus.dwError);
2325             else
2326                 ok(policyStatus.dwError == check->status.dwError ||
2327                  broken(policyStatus.dwError == CERT_TRUST_NO_ERROR) ||
2328                  (check->brokenStatus && broken(policyStatus.dwError ==
2329                  check->brokenStatus->dwError)),
2330                  "%s[%d]: expected %08x, got %08x\n",
2331                  HIWORD(policy) ? policy : num_to_str(LOWORD(policy)),
2332                  testIndex, check->status.dwError, policyStatus.dwError);
2333             if (policyStatus.dwError != check->status.dwError)
2334             {
2335                 skip("%s[%d]: error %08x doesn't match expected %08x, not checking indexes\n",
2336                  HIWORD(policy) ? policy : num_to_str(LOWORD(policy)),
2337                  testIndex, policyStatus.dwError, check->status.dwError);
2338                 pCertFreeCertificateChain(chain);
2339                 return;
2340             }
2341             if (check->todo & TODO_CHAINS)
2342                 todo_wine ok(policyStatus.lChainIndex ==
2343                  check->status.lChainIndex ||
2344                  (check->brokenStatus && broken(policyStatus.lChainIndex ==
2345                  check->brokenStatus->lChainIndex)),
2346                  "%s[%d]: expected %d, got %d\n",
2347                  HIWORD(policy) ? policy : num_to_str(LOWORD(policy)),
2348                  testIndex, check->status.lChainIndex,
2349                  policyStatus.lChainIndex);
2350             else
2351                 ok(policyStatus.lChainIndex == check->status.lChainIndex ||
2352                  (check->brokenStatus && broken(policyStatus.lChainIndex ==
2353                  check->brokenStatus->lChainIndex)),
2354                  "%s[%d]: expected %d, got %d\n",
2355                  HIWORD(policy) ? policy : num_to_str(LOWORD(policy)),
2356                  testIndex,
2357                  check->status.lChainIndex, policyStatus.lChainIndex);
2358             if (check->todo & TODO_ELEMENTS)
2359                 todo_wine ok(policyStatus.lElementIndex ==
2360                  check->status.lElementIndex ||
2361                  (check->brokenStatus && broken(policyStatus.lElementIndex ==
2362                  check->brokenStatus->lElementIndex)),
2363                  "%s[%d]: expected %d, got %d\n",
2364                  HIWORD(policy) ? policy : num_to_str(LOWORD(policy)),
2365                  testIndex,
2366                  check->status.lElementIndex, policyStatus.lElementIndex);
2367             else
2368                 ok(policyStatus.lElementIndex == check->status.lElementIndex ||
2369                  (check->brokenStatus && broken(policyStatus.lElementIndex ==
2370                  check->brokenStatus->lElementIndex)),
2371                  "%s[%d]: expected %d, got %d\n",
2372                  HIWORD(policy) ? policy : num_to_str(LOWORD(policy)),
2373                  testIndex,
2374                  check->status.lElementIndex, policyStatus.lElementIndex);
2375         }
2376         pCertFreeCertificateChain(chain);
2377     }
2378 }
2379
2380 static void check_ssl_policy(void)
2381 {
2382     DWORD i;
2383     CERT_CHAIN_POLICY_PARA policyPara = { 0 };
2384     SSL_EXTRA_CERT_CHAIN_POLICY_PARA sslPolicyPara = { { 0 } };
2385     WCHAR winehq[] = { 'w','i','n','e','h','q','.','o','r','g',0 };
2386     WCHAR google_dot_com[] = { 'w','w','w','.','g','o','o','g','l','e','.',
2387      'c','o','m',0 };
2388
2389     /* Check ssl policy with no parameter */
2390     for (i = 0;
2391      i < sizeof(sslPolicyCheck) / sizeof(sslPolicyCheck[0]); i++)
2392         checkChainPolicyStatus(CERT_CHAIN_POLICY_SSL, &sslPolicyCheck[i], i,
2393          &oct2007, NULL);
2394     /* Check again with a policy parameter that specifies nothing */
2395     for (i = 0;
2396      i < sizeof(sslPolicyCheck) / sizeof(sslPolicyCheck[0]); i++)
2397         checkChainPolicyStatus(CERT_CHAIN_POLICY_SSL, &sslPolicyCheck[i], i,
2398          &oct2007, &policyPara);
2399     /* Check yet again, but specify an empty SSL_EXTRA_CERT_CHAIN_POLICY_PARA
2400      * argument.
2401      */
2402     policyPara.pvExtraPolicyPara = &sslPolicyPara;
2403     for (i = 0;
2404      i < sizeof(sslPolicyCheck) / sizeof(sslPolicyCheck[0]); i++)
2405         checkChainPolicyStatus(CERT_CHAIN_POLICY_SSL, &sslPolicyCheck[i], i,
2406          &oct2007, &policyPara);
2407     /* And again, but specify the auth type as a client */
2408     sslPolicyPara.dwAuthType = AUTHTYPE_CLIENT;
2409     for (i = 0;
2410      i < sizeof(sslPolicyCheck) / sizeof(sslPolicyCheck[0]); i++)
2411         checkChainPolicyStatus(CERT_CHAIN_POLICY_SSL, &sslPolicyCheck[i], i,
2412          &oct2007, &policyPara);
2413     /* And again, but specify the auth type as a server */
2414     sslPolicyPara.dwAuthType = AUTHTYPE_SERVER;
2415     for (i = 0;
2416      i < sizeof(sslPolicyCheck) / sizeof(sslPolicyCheck[0]); i++)
2417         checkChainPolicyStatus(CERT_CHAIN_POLICY_SSL, &sslPolicyCheck[i], i,
2418          &oct2007, &policyPara);
2419     /* And again authenticating a client, but specify the size of the policy
2420      * parameter.
2421      */
2422     sslPolicyPara.cbSize = sizeof(sslPolicyCheck);
2423     sslPolicyPara.dwAuthType = AUTHTYPE_CLIENT;
2424     for (i = 0;
2425      i < sizeof(sslPolicyCheck) / sizeof(sslPolicyCheck[0]); i++)
2426         checkChainPolicyStatus(CERT_CHAIN_POLICY_SSL, &sslPolicyCheck[i], i,
2427          &oct2007, &policyPara);
2428     /* One more time authenticating a client, but specify winehq.org as the
2429      * server name.
2430      */
2431     sslPolicyPara.pwszServerName = winehq;
2432     for (i = 0;
2433      i < sizeof(sslPolicyCheck) / sizeof(sslPolicyCheck[0]); i++)
2434         checkChainPolicyStatus(CERT_CHAIN_POLICY_SSL, &sslPolicyCheck[i], i,
2435          &oct2007, &policyPara);
2436     /* And again authenticating a server, still specifying winehq.org as the
2437      * server name.
2438      */
2439     sslPolicyPara.dwAuthType = AUTHTYPE_SERVER;
2440     for (i = 0;
2441      i < sizeof(sslPolicyCheck) / sizeof(sslPolicyCheck[0]); i++)
2442         checkChainPolicyStatus(CERT_CHAIN_POLICY_SSL, &sslPolicyCheck[i], i,
2443          &oct2007, &policyPara);
2444     /* And again authenticating a server, this time specifying the size of the
2445      * policy param.
2446      */
2447     policyPara.cbSize = sizeof(policyPara);
2448     for (i = 0;
2449      i < sizeof(sslPolicyCheck) / sizeof(sslPolicyCheck[0]); i++)
2450         checkChainPolicyStatus(CERT_CHAIN_POLICY_SSL, &sslPolicyCheck[i], i,
2451          &oct2007, &policyPara);
2452     /* Yet again, but checking the iTunes chain, which contains a name
2453      * extension.
2454      */
2455     checkChainPolicyStatus(CERT_CHAIN_POLICY_SSL,
2456      &sslPolicyCheckWithoutMatchingName, 0, &oct2007, &policyPara);
2457     /* And again, but checking the Google chain at a bad date */
2458     sslPolicyPara.pwszServerName = google_dot_com;
2459     checkChainPolicyStatus(CERT_CHAIN_POLICY_SSL,
2460      &sslPolicyCheckWithMatchingNameExpired, 0, &oct2007, &policyPara);
2461     /* And again, but checking the Google chain at a good date */
2462     sslPolicyPara.pwszServerName = google_dot_com;
2463     checkChainPolicyStatus(CERT_CHAIN_POLICY_SSL,
2464      &sslPolicyCheckWithMatchingName, 0, &oct2009, &policyPara);
2465 }
2466
2467 static void testVerifyCertChainPolicy(void)
2468 {
2469     BOOL ret;
2470     PCCERT_CONTEXT cert;
2471     CERT_CHAIN_PARA chainPara = { sizeof(CERT_CHAIN_PARA), { 0 } };
2472     PCCERT_CHAIN_CONTEXT chain;
2473     CERT_CHAIN_POLICY_STATUS policyStatus = { 0 };
2474     CERT_CHAIN_POLICY_PARA policyPara = { 0 };
2475     DWORD i;
2476
2477     if (!pCertVerifyCertificateChainPolicy)
2478     {
2479         win_skip("CertVerifyCertificateChainPolicy() is not available\n");
2480         return;
2481     }
2482
2483     /* Crash
2484     ret = pCertVerifyCertificateChainPolicy(NULL, NULL, NULL, NULL);
2485     ret = pCertVerifyCertificateChainPolicy(CERT_CHAIN_POLICY_BASE, NULL, NULL,
2486      NULL);
2487     ret = pCertVerifyCertificateChainPolicy(CERT_CHAIN_POLICY_BASE, NULL,
2488      &chainPara, NULL);
2489      */
2490     SetLastError(0xdeadbeef);
2491     ret = pCertVerifyCertificateChainPolicy(NULL, NULL, NULL, &policyStatus);
2492     ok(!ret && GetLastError() == ERROR_FILE_NOT_FOUND,
2493      "Expected ERROR_FILE_NOT_FOUND, got %08x\n", GetLastError());
2494     /* Crashes
2495     ret = pCertVerifyCertificateChainPolicy(CERT_CHAIN_POLICY_BASE, NULL, NULL,
2496      &policyStatus);
2497      */
2498     cert = CertCreateCertificateContext(X509_ASN_ENCODING, selfSignedCert,
2499      sizeof(selfSignedCert));
2500     pCertGetCertificateChain(NULL, cert, NULL, NULL, &chainPara, 0, NULL,
2501      &chain);
2502     /* Crash
2503     ret = pCertVerifyCertificateChainPolicy(NULL, chain, NULL, NULL);
2504     ret = pCertVerifyCertificateChainPolicy(CERT_CHAIN_POLICY_BASE, chain, NULL,
2505      NULL);
2506     ret = pCertVerifyCertificateChainPolicy(CERT_CHAIN_POLICY_BASE, chain,
2507      &chainPara, NULL);
2508      */
2509     /* Size of policy status is apparently ignored, as is pChainPolicyPara */
2510     ret = pCertVerifyCertificateChainPolicy(CERT_CHAIN_POLICY_BASE, chain, NULL,
2511      &policyStatus);
2512     ok(ret, "CertVerifyCertificateChainPolicy failed: %08x\n", GetLastError());
2513     ok(policyStatus.dwError == CERT_E_UNTRUSTEDROOT,
2514      "Expected CERT_E_UNTRUSTEDROOT, got %08x\n", policyStatus.dwError);
2515     ok(policyStatus.lChainIndex == 0 && policyStatus.lElementIndex == 0,
2516      "Expected both indexes 0, got %d, %d\n", policyStatus.lChainIndex,
2517      policyStatus.lElementIndex);
2518     ret = pCertVerifyCertificateChainPolicy(CERT_CHAIN_POLICY_BASE, chain,
2519      &policyPara, &policyStatus);
2520     ok(ret, "CertVerifyCertificateChainPolicy failed: %08x\n", GetLastError());
2521     ok(policyStatus.dwError == CERT_E_UNTRUSTEDROOT,
2522      "Expected CERT_E_UNTRUSTEDROOT, got %08x\n", policyStatus.dwError);
2523     ok(policyStatus.lChainIndex == 0 && policyStatus.lElementIndex == 0,
2524      "Expected both indexes 0, got %d, %d\n", policyStatus.lChainIndex,
2525      policyStatus.lElementIndex);
2526     pCertFreeCertificateChain(chain);
2527     CertFreeCertificateContext(cert);
2528
2529     for (i = 0;
2530      i < sizeof(basePolicyCheck) / sizeof(basePolicyCheck[0]); i++)
2531         checkChainPolicyStatus(CERT_CHAIN_POLICY_BASE, &basePolicyCheck[i], i,
2532          &oct2007, NULL);
2533     check_ssl_policy();
2534     /* The authenticode policy doesn't seem to check anything beyond the base
2535      * policy.  It might check for chains signed by the MS test cert, but none
2536      * of these chains is.
2537      */
2538     for (i = 0; i <
2539      sizeof(authenticodePolicyCheck) / sizeof(authenticodePolicyCheck[0]); i++)
2540         checkChainPolicyStatus(CERT_CHAIN_POLICY_AUTHENTICODE,
2541          &authenticodePolicyCheck[i], i, &oct2007, NULL);
2542     for (i = 0; i <
2543      sizeof(basicConstraintsPolicyCheck) / sizeof(basicConstraintsPolicyCheck[0]);
2544      i++)
2545         checkChainPolicyStatus(CERT_CHAIN_POLICY_BASIC_CONSTRAINTS,
2546          &basicConstraintsPolicyCheck[i], i, &oct2007, NULL);
2547 }
2548
2549 START_TEST(chain)
2550 {
2551     HMODULE hCrypt32 = GetModuleHandleA("crypt32.dll");
2552     pCertCreateCertificateChainEngine = (void*)GetProcAddress(hCrypt32, "CertCreateCertificateChainEngine");
2553     pCertGetCertificateChain = (void*)GetProcAddress(hCrypt32, "CertGetCertificateChain");
2554     pCertFreeCertificateChain = (void*)GetProcAddress(hCrypt32, "CertFreeCertificateChain");
2555     pCertFreeCertificateChainEngine = (void*)GetProcAddress(hCrypt32, "CertFreeCertificateChainEngine");
2556     pCertVerifyCertificateChainPolicy = (void*)GetProcAddress(hCrypt32, "CertVerifyCertificateChainPolicy");
2557
2558     testCreateCertChainEngine();
2559     if (!pCertGetCertificateChain)
2560     {
2561         win_skip("CertGetCertificateChain() is not available\n");
2562     }
2563     else
2564     {
2565         testVerifyCertChainPolicy();
2566         testGetCertChain();
2567         test_CERT_CHAIN_PARA_cbSize();
2568     }
2569 }