git.oblomov.eu Git - wine/blob - dlls/crypt32/tests/chain.c

   1 /*
   2  * crypt32 certificate chain functions tests
   3  *
   4  * Copyright 2006 Juan Lang
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2.1 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, write to the Free Software
  18  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  19  */
  20 #include <assert.h>
  21 #include <stdio.h>
  22 #include <stdarg.h>
  23 #include <windef.h>
  24 #include <winbase.h>
  25 #include <winerror.h>
  26 #include <wincrypt.h>
  27
  28 #include "wine/test.h"
  29
  30 static const BYTE selfSignedCert[] = {
  31  0x30, 0x82, 0x01, 0x1f, 0x30, 0x81, 0xce, 0xa0, 0x03, 0x02, 0x01, 0x02, 0x02,
  32  0x10, 0xeb, 0x0d, 0x57, 0x2a, 0x9c, 0x09, 0xba, 0xa4, 0x4a, 0xb7, 0x25, 0x49,
  33  0xd9, 0x3e, 0xb5, 0x73, 0x30, 0x09, 0x06, 0x05, 0x2b, 0x0e, 0x03, 0x02, 0x1d,
  34  0x05, 0x00, 0x30, 0x15, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x03,
  35  0x13, 0x0a, 0x4a, 0x75, 0x61, 0x6e, 0x20, 0x4c, 0x61, 0x6e, 0x67, 0x00, 0x30,
  36  0x1e, 0x17, 0x0d, 0x30, 0x36, 0x30, 0x36, 0x32, 0x39, 0x30, 0x35, 0x30, 0x30,
  37  0x34, 0x36, 0x5a, 0x17, 0x0d, 0x30, 0x37, 0x30, 0x36, 0x32, 0x39, 0x31, 0x31,
  38  0x30, 0x30, 0x34, 0x36, 0x5a, 0x30, 0x15, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03,
  39  0x55, 0x04, 0x03, 0x13, 0x0a, 0x4a, 0x75, 0x61, 0x6e, 0x20, 0x4c, 0x61, 0x6e,
  40  0x67, 0x00, 0x30, 0x5c, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7,
  41  0x0d, 0x01, 0x01, 0x01, 0x05, 0x00, 0x03, 0x4b, 0x00, 0x30, 0x48, 0x02, 0x41,
  42  0x00, 0xe2, 0x54, 0x3a, 0xa7, 0x83, 0xb1, 0x27, 0x14, 0x3e, 0x59, 0xbb, 0xb4,
  43  0x53, 0xe6, 0x1f, 0xe7, 0x5d, 0xf1, 0x21, 0x68, 0xad, 0x85, 0x53, 0xdb, 0x6b,
  44  0x1e, 0xeb, 0x65, 0x97, 0x03, 0x86, 0x60, 0xde, 0xf3, 0x6c, 0x38, 0x75, 0xe0,
  45  0x4c, 0x61, 0xbb, 0xbc, 0x62, 0x17, 0xa9, 0xcd, 0x79, 0x3f, 0x21, 0x4e, 0x96,
  46  0xcb, 0x0e, 0xdc, 0x61, 0x94, 0x30, 0x18, 0x10, 0x6b, 0xd0, 0x1c, 0x10, 0x79,
  47  0x02, 0x03, 0x01, 0x00, 0x01, 0x30, 0x09, 0x06, 0x05, 0x2b, 0x0e, 0x03, 0x02,
  48  0x1d, 0x05, 0x00, 0x03, 0x41, 0x00, 0x25, 0x90, 0x53, 0x34, 0xd9, 0x56, 0x41,
  49  0x5e, 0xdb, 0x7e, 0x01, 0x36, 0xec, 0x27, 0x61, 0x5e, 0xb7, 0x4d, 0x90, 0x66,
  50  0xa2, 0xe1, 0x9d, 0x58, 0x76, 0xd4, 0x9c, 0xba, 0x2c, 0x84, 0xc6, 0x83, 0x7a,
  51  0x22, 0x0d, 0x03, 0x69, 0x32, 0x1a, 0x6d, 0xcb, 0x0c, 0x15, 0xb3, 0x6b, 0xc7,
  52  0x0a, 0x8c, 0xb4, 0x5c, 0x34, 0x78, 0xe0, 0x3c, 0x9c, 0xe9, 0xf3, 0x30, 0x9f,
  53  0xa8, 0x76, 0x57, 0x92, 0x36 };
  54
  55 static BOOL (WINAPI *pCertCreateCertificateChainEngine)(PCERT_CHAIN_ENGINE_CONFIG,HCERTCHAINENGINE*);
  56 static BOOL (WINAPI *pCertGetCertificateChain)(HCERTCHAINENGINE,PCCERT_CONTEXT,LPFILETIME,HCERTSTORE,PCERT_CHAIN_PARA,DWORD,LPVOID,PCCERT_CHAIN_CONTEXT*);
  57 static VOID (WINAPI *pCertFreeCertificateChain)(PCCERT_CHAIN_CONTEXT);
  58 static VOID (WINAPI *pCertFreeCertificateChainEngine)(HCERTCHAINENGINE);
  59 static BOOL (WINAPI *pCertVerifyCertificateChainPolicy)(LPCSTR,PCCERT_CHAIN_CONTEXT,PCERT_CHAIN_POLICY_PARA,PCERT_CHAIN_POLICY_STATUS);
  60
  61
  62 static void testCreateCertChainEngine(void)
  63 {
  64     BOOL ret;
  65     CERT_CHAIN_ENGINE_CONFIG config = { 0 };
  66     HCERTCHAINENGINE engine;
  67     HCERTSTORE store;
  68
  69     if (!pCertCreateCertificateChainEngine || !pCertFreeCertificateChainEngine)
  70     {
  71         win_skip("Cert*CertificateChainEngine() functions are not available\n");
  72         return;
  73     }
  74
  75     /* Crash
  76     ret = pCertCreateCertificateChainEngine(NULL, NULL);
  77     ret = pCertCreateCertificateChainEngine(NULL, &engine);
  78     ret = pCertCreateCertificateChainEngine(&config, NULL);
  79      */
  80     ret = pCertCreateCertificateChainEngine(&config, &engine);
  81     ok(!ret && GetLastError() == E_INVALIDARG,
  82      "Expected E_INVALIDARG, got %08x\n", GetLastError());
  83     /* Crashes
  84     config.cbSize = sizeof(config);
  85     ret = pCertCreateCertificateChainEngine(&config, NULL);
  86      */
  87     config.cbSize = sizeof(config);
  88     ret = pCertCreateCertificateChainEngine(&config, &engine);
  89     ok(ret, "CertCreateCertificateChainEngine failed: %08x\n", GetLastError());
  90     pCertFreeCertificateChainEngine(engine);
  91     config.dwFlags = 0xff000000;
  92     ret = pCertCreateCertificateChainEngine(&config, &engine);
  93     ok(ret, "CertCreateCertificateChainEngine failed: %08x\n", GetLastError());
  94     pCertFreeCertificateChainEngine(engine);
  95
  96     /* Creating a cert with no root certs at all is allowed.. */
  97     store = CertOpenStore(CERT_STORE_PROV_MEMORY, 0, 0,
  98      CERT_STORE_CREATE_NEW_FLAG, NULL);
  99     config.hRestrictedRoot = store;
 100     ret = pCertCreateCertificateChainEngine(&config, &engine);
 101     ok(ret, "CertCreateCertificateChainEngine failed: %08x\n", GetLastError());
 102     pCertFreeCertificateChainEngine(engine);
 103
 104     /* but creating one with a restricted root with a cert that isn't a member
 105      * of the Root store isn't allowed.
 106      */
 107     CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING, selfSignedCert,
 108      sizeof(selfSignedCert), CERT_STORE_ADD_ALWAYS, NULL);
 109     ret = pCertCreateCertificateChainEngine(&config, &engine);
 110     ok(!ret && GetLastError() == CRYPT_E_NOT_FOUND,
 111      "Expected CRYPT_E_NOT_FOUND, got %08x\n", GetLastError());
 112
 113     CertCloseStore(store, 0);
 114 }
 115
 116 static const BYTE bigCert[] = { 0x30, 0x7a, 0x02, 0x01, 0x01, 0x30, 0x02, 0x06,
 117  0x00, 0x30, 0x15, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13,
 118  0x0a, 0x4a, 0x75, 0x61, 0x6e, 0x20, 0x4c, 0x61, 0x6e, 0x67, 0x00, 0x30, 0x22,
 119  0x18, 0x0f, 0x31, 0x36, 0x30, 0x31, 0x30, 0x31, 0x30, 0x31, 0x30, 0x30, 0x30,
 120  0x30, 0x30, 0x30, 0x5a, 0x18, 0x0f, 0x31, 0x36, 0x30, 0x31, 0x30, 0x31, 0x30,
 121  0x31, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x5a, 0x30, 0x15, 0x31, 0x13, 0x30,
 122  0x11, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x0a, 0x4a, 0x75, 0x61, 0x6e, 0x20,
 123  0x4c, 0x61, 0x6e, 0x67, 0x00, 0x30, 0x07, 0x30, 0x02, 0x06, 0x00, 0x03, 0x01,
 124  0x00, 0xa3, 0x16, 0x30, 0x14, 0x30, 0x12, 0x06, 0x03, 0x55, 0x1d, 0x13, 0x01,
 125  0x01, 0xff, 0x04, 0x08, 0x30, 0x06, 0x01, 0x01, 0xff, 0x02, 0x01, 0x01 };
 126 static const BYTE iTunesCert0[] = {
 127 0x30,0x82,0x04,0xbf,0x30,0x82,0x04,0x28,0xa0,0x03,0x02,0x01,0x02,0x02,0x10,
 128 0x41,0x91,0xa1,0x5a,0x39,0x78,0xdf,0xcf,0x49,0x65,0x66,0x38,0x1d,0x4c,0x75,
 129 0xc2,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x05,
 130 0x00,0x30,0x5f,0x31,0x0b,0x30,0x09,0x06,0x03,0x55,0x04,0x06,0x13,0x02,0x55,
 131 0x53,0x31,0x17,0x30,0x15,0x06,0x03,0x55,0x04,0x0a,0x13,0x0e,0x56,0x65,0x72,
 132 0x69,0x53,0x69,0x67,0x6e,0x2c,0x20,0x49,0x6e,0x63,0x2e,0x31,0x37,0x30,0x35,
 133 0x06,0x03,0x55,0x04,0x0b,0x13,0x2e,0x43,0x6c,0x61,0x73,0x73,0x20,0x33,0x20,
 134 0x50,0x75,0x62,0x6c,0x69,0x63,0x20,0x50,0x72,0x69,0x6d,0x61,0x72,0x79,0x20,
 135 0x43,0x65,0x72,0x74,0x69,0x66,0x69,0x63,0x61,0x74,0x69,0x6f,0x6e,0x20,0x41,
 136 0x75,0x74,0x68,0x6f,0x72,0x69,0x74,0x79,0x30,0x1e,0x17,0x0d,0x30,0x34,0x30,
 137 0x37,0x31,0x36,0x30,0x30,0x30,0x30,0x30,0x30,0x5a,0x17,0x0d,0x31,0x34,0x30,
 138 0x37,0x31,0x35,0x32,0x33,0x35,0x39,0x35,0x39,0x5a,0x30,0x81,0xb4,0x31,0x0b,
 139 0x30,0x09,0x06,0x03,0x55,0x04,0x06,0x13,0x02,0x55,0x53,0x31,0x17,0x30,0x15,
 140 0x06,0x03,0x55,0x04,0x0a,0x13,0x0e,0x56,0x65,0x72,0x69,0x53,0x69,0x67,0x6e,
 141 0x2c,0x20,0x49,0x6e,0x63,0x2e,0x31,0x1f,0x30,0x1d,0x06,0x03,0x55,0x04,0x0b,
 142 0x13,0x16,0x56,0x65,0x72,0x69,0x53,0x69,0x67,0x6e,0x20,0x54,0x72,0x75,0x73,
 143 0x74,0x20,0x4e,0x65,0x74,0x77,0x6f,0x72,0x6b,0x31,0x3b,0x30,0x39,0x06,0x03,
 144 0x55,0x04,0x0b,0x13,0x32,0x54,0x65,0x72,0x6d,0x73,0x20,0x6f,0x66,0x20,0x75,
 145 0x73,0x65,0x20,0x61,0x74,0x20,0x68,0x74,0x74,0x70,0x73,0x3a,0x2f,0x2f,0x77,
 146 0x77,0x77,0x2e,0x76,0x65,0x72,0x69,0x73,0x69,0x67,0x6e,0x2e,0x63,0x6f,0x6d,
 147 0x2f,0x72,0x70,0x61,0x20,0x28,0x63,0x29,0x30,0x34,0x31,0x2e,0x30,0x2c,0x06,
 148 0x03,0x55,0x04,0x03,0x13,0x25,0x56,0x65,0x72,0x69,0x53,0x69,0x67,0x6e,0x20,
 149 0x43,0x6c,0x61,0x73,0x73,0x20,0x33,0x20,0x43,0x6f,0x64,0x65,0x20,0x53,0x69,
 150 0x67,0x6e,0x69,0x6e,0x67,0x20,0x32,0x30,0x30,0x34,0x20,0x43,0x41,0x30,0x82,
 151 0x01,0x22,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x01,
 152 0x05,0x00,0x03,0x82,0x01,0x0f,0x00,0x30,0x82,0x01,0x0a,0x02,0x82,0x01,0x01,
 153 0x00,0xbe,0xbc,0xee,0xbc,0x7e,0xef,0x83,0xeb,0xe0,0x37,0x4f,0xfb,0x03,0x10,
 154 0x38,0xbe,0x08,0xd2,0x8c,0x7d,0x9d,0xfa,0x92,0x7f,0x19,0x0c,0xc2,0x6b,0xee,
 155 0x42,0x52,0x8c,0xde,0xd3,0x1c,0x48,0x13,0x25,0xea,0xc1,0x63,0x7a,0xf9,0x51,
 156 0x65,0xee,0xd3,0xaa,0x3b,0xf5,0xf0,0x94,0x9c,0x2b,0xfb,0xf2,0x66,0xd4,0x24,
 157 0xda,0xf7,0xf5,0x9f,0x6e,0x19,0x39,0x36,0xbc,0xd0,0xa3,0x76,0x08,0x1e,0x22,
 158 0x27,0x24,0x6c,0x38,0x91,0x27,0xe2,0x84,0x49,0xae,0x1b,0x8a,0xa1,0xfd,0x25,
 159 0x82,0x2c,0x10,0x30,0xe8,0x71,0xab,0x28,0xe8,0x77,0x4a,0x51,0xf1,0xec,0xcd,
 160 0xf8,0xf0,0x54,0xd4,0x6f,0xc0,0xe3,0x6d,0x0a,0x8f,0xd9,0xd8,0x64,0x8d,0x63,
 161 0xb2,0x2d,0x4e,0x27,0xf6,0x85,0x0e,0xfe,0x6d,0xe3,0x29,0x99,0xe2,0x85,0x47,
 162 0x7c,0x2d,0x86,0x7f,0xe8,0x57,0x8f,0xad,0x67,0xc2,0x33,0x32,0x91,0x13,0x20,
 163 0xfc,0xa9,0x23,0x14,0x9a,0x6d,0xc2,0x84,0x4b,0x76,0x68,0x04,0xd5,0x71,0x2c,
 164 0x5d,0x21,0xfa,0x88,0x0d,0x26,0xfd,0x1f,0x2d,0x91,0x2b,0xe7,0x01,0x55,0x4d,
 165 0xf2,0x6d,0x35,0x28,0x82,0xdf,0xd9,0x6b,0x5c,0xb6,0xd6,0xd9,0xaa,0x81,0xfd,
 166 0x5f,0xcd,0x83,0xba,0x63,0x9d,0xd0,0x22,0xfc,0xa9,0x3b,0x42,0x69,0xb2,0x8e,
 167 0x3a,0xb5,0xbc,0xb4,0x9e,0x0f,0x5e,0xc4,0xea,0x2c,0x82,0x8b,0x28,0xfd,0x53,
 168 0x08,0x96,0xdd,0xb5,0x01,0x20,0xd1,0xf9,0xa5,0x18,0xe7,0xc0,0xee,0x51,0x70,
 169 0x37,0xe1,0xb6,0x05,0x48,0x52,0x48,0x6f,0x38,0xea,0xc3,0xe8,0x6c,0x7b,0x44,
 170 0x84,0xbb,0x02,0x03,0x01,0x00,0x01,0xa3,0x82,0x01,0xa0,0x30,0x82,0x01,0x9c,
 171 0x30,0x12,0x06,0x03,0x55,0x1d,0x13,0x01,0x01,0xff,0x04,0x08,0x30,0x06,0x01,
 172 0x01,0xff,0x02,0x01,0x00,0x30,0x44,0x06,0x03,0x55,0x1d,0x20,0x04,0x3d,0x30,
 173 0x3b,0x30,0x39,0x06,0x0b,0x60,0x86,0x48,0x01,0x86,0xf8,0x45,0x01,0x07,0x17,
 174 0x03,0x30,0x2a,0x30,0x28,0x06,0x08,0x2b,0x06,0x01,0x05,0x05,0x07,0x02,0x01,
 175 0x16,0x1c,0x68,0x74,0x74,0x70,0x73,0x3a,0x2f,0x2f,0x77,0x77,0x77,0x2e,0x76,
 176 0x65,0x72,0x69,0x73,0x69,0x67,0x6e,0x2e,0x63,0x6f,0x6d,0x2f,0x72,0x70,0x61,
 177 0x30,0x31,0x06,0x03,0x55,0x1d,0x1f,0x04,0x2a,0x30,0x28,0x30,0x26,0xa0,0x24,
 178 0xa0,0x22,0x86,0x20,0x68,0x74,0x74,0x70,0x3a,0x2f,0x2f,0x63,0x72,0x6c,0x2e,
 179 0x76,0x65,0x72,0x69,0x73,0x69,0x67,0x6e,0x2e,0x63,0x6f,0x6d,0x2f,0x70,0x63,
 180 0x61,0x33,0x2e,0x63,0x72,0x6c,0x30,0x1d,0x06,0x03,0x55,0x1d,0x25,0x04,0x16,
 181 0x30,0x14,0x06,0x08,0x2b,0x06,0x01,0x05,0x05,0x07,0x03,0x02,0x06,0x08,0x2b,
 182 0x06,0x01,0x05,0x05,0x07,0x03,0x03,0x30,0x0e,0x06,0x03,0x55,0x1d,0x0f,0x01,
 183 0x01,0xff,0x04,0x04,0x03,0x02,0x01,0x06,0x30,0x11,0x06,0x09,0x60,0x86,0x48,
 184 0x01,0x86,0xf8,0x42,0x01,0x01,0x04,0x04,0x03,0x02,0x00,0x01,0x30,0x29,0x06,
 185 0x03,0x55,0x1d,0x11,0x04,0x22,0x30,0x20,0xa4,0x1e,0x30,0x1c,0x31,0x1a,0x30,
 186 0x18,0x06,0x03,0x55,0x04,0x03,0x13,0x11,0x43,0x6c,0x61,0x73,0x73,0x33,0x43,
 187 0x41,0x32,0x30,0x34,0x38,0x2d,0x31,0x2d,0x34,0x33,0x30,0x1d,0x06,0x03,0x55,
 188 0x1d,0x0e,0x04,0x16,0x04,0x14,0x08,0xf5,0x51,0xe8,0xfb,0xfe,0x3d,0x3d,0x64,
 189 0x36,0x7c,0x68,0xcf,0x5b,0x78,0xa8,0xdf,0xb9,0xc5,0x37,0x30,0x81,0x80,0x06,
 190 0x03,0x55,0x1d,0x23,0x04,0x79,0x30,0x77,0xa1,0x63,0xa4,0x61,0x30,0x5f,0x31,
 191 0x0b,0x30,0x09,0x06,0x03,0x55,0x04,0x06,0x13,0x02,0x55,0x53,0x31,0x17,0x30,
 192 0x15,0x06,0x03,0x55,0x04,0x0a,0x13,0x0e,0x56,0x65,0x72,0x69,0x53,0x69,0x67,
 193 0x6e,0x2c,0x20,0x49,0x6e,0x63,0x2e,0x31,0x37,0x30,0x35,0x06,0x03,0x55,0x04,
 194 0x0b,0x13,0x2e,0x43,0x6c,0x61,0x73,0x73,0x20,0x33,0x20,0x50,0x75,0x62,0x6c,
 195 0x69,0x63,0x20,0x50,0x72,0x69,0x6d,0x61,0x72,0x79,0x20,0x43,0x65,0x72,0x74,
 196 0x69,0x66,0x69,0x63,0x61,0x74,0x69,0x6f,0x6e,0x20,0x41,0x75,0x74,0x68,0x6f,
 197 0x72,0x69,0x74,0x79,0x82,0x10,0x70,0xba,0xe4,0x1d,0x10,0xd9,0x29,0x34,0xb6,
 198 0x38,0xca,0x7b,0x03,0xcc,0xba,0xbf,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,
 199 0xf7,0x0d,0x01,0x01,0x05,0x05,0x00,0x03,0x81,0x81,0x00,0xae,0x3a,0x17,0xb8,
 200 0x4a,0x7b,0x55,0xfa,0x64,0x55,0xec,0x40,0xa4,0xed,0x49,0x41,0x90,0x99,0x9c,
 201 0x89,0xbc,0xaf,0x2e,0x1d,0xca,0x78,0x23,0xf9,0x1c,0x19,0x0f,0x7f,0xeb,0x68,
 202 0xbc,0x32,0xd9,0x88,0x38,0xde,0xdc,0x3f,0xd3,0x89,0xb4,0x3f,0xb1,0x82,0x96,
 203 0xf1,0xa4,0x5a,0xba,0xed,0x2e,0x26,0xd3,0xde,0x7c,0x01,0x6e,0x00,0x0a,0x00,
 204 0xa4,0x06,0x92,0x11,0x48,0x09,0x40,0xf9,0x1c,0x18,0x79,0x67,0x23,0x24,0xe0,
 205 0xbb,0xd5,0xe1,0x50,0xae,0x1b,0xf5,0x0e,0xdd,0xe0,0x2e,0x81,0xcd,0x80,0xa3,
 206 0x6c,0x52,0x4f,0x91,0x75,0x55,0x8a,0xba,0x22,0xf2,0xd2,0xea,0x41,0x75,0x88,
 207 0x2f,0x63,0x55,0x7d,0x1e,0x54,0x5a,0x95,0x59,0xca,0xd9,0x34,0x81,0xc0,0x5f,
 208 0x5e,0xf6,0x7a,0xb5 };
 209 static const BYTE iTunesCert1[] = {
 210 0x30,0x82,0x04,0xf1,0x30,0x82,0x03,0xd9,0xa0,0x03,0x02,0x01,0x02,0x02,0x10,
 211 0x0f,0x1a,0xa0,0xe0,0x9b,0x9b,0x61,0xa6,0xb6,0xfe,0x40,0xd2,0xdf,0x6a,0xf6,
 212 0x8d,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x05,
 213 0x00,0x30,0x81,0xb4,0x31,0x0b,0x30,0x09,0x06,0x03,0x55,0x04,0x06,0x13,0x02,
 214 0x55,0x53,0x31,0x17,0x30,0x15,0x06,0x03,0x55,0x04,0x0a,0x13,0x0e,0x56,0x65,
 215 0x72,0x69,0x53,0x69,0x67,0x6e,0x2c,0x20,0x49,0x6e,0x63,0x2e,0x31,0x1f,0x30,
 216 0x1d,0x06,0x03,0x55,0x04,0x0b,0x13,0x16,0x56,0x65,0x72,0x69,0x53,0x69,0x67,
 217 0x6e,0x20,0x54,0x72,0x75,0x73,0x74,0x20,0x4e,0x65,0x74,0x77,0x6f,0x72,0x6b,
 218 0x31,0x3b,0x30,0x39,0x06,0x03,0x55,0x04,0x0b,0x13,0x32,0x54,0x65,0x72,0x6d,
 219 0x73,0x20,0x6f,0x66,0x20,0x75,0x73,0x65,0x20,0x61,0x74,0x20,0x68,0x74,0x74,
 220 0x70,0x73,0x3a,0x2f,0x2f,0x77,0x77,0x77,0x2e,0x76,0x65,0x72,0x69,0x73,0x69,
 221 0x67,0x6e,0x2e,0x63,0x6f,0x6d,0x2f,0x72,0x70,0x61,0x20,0x28,0x63,0x29,0x30,
 222 0x34,0x31,0x2e,0x30,0x2c,0x06,0x03,0x55,0x04,0x03,0x13,0x25,0x56,0x65,0x72,
 223 0x69,0x53,0x69,0x67,0x6e,0x20,0x43,0x6c,0x61,0x73,0x73,0x20,0x33,0x20,0x43,
 224 0x6f,0x64,0x65,0x20,0x53,0x69,0x67,0x6e,0x69,0x6e,0x67,0x20,0x32,0x30,0x30,
 225 0x34,0x20,0x43,0x41,0x30,0x1e,0x17,0x0d,0x30,0x36,0x30,0x31,0x31,0x37,0x30,
 226 0x30,0x30,0x30,0x30,0x30,0x5a,0x17,0x0d,0x30,0x38,0x30,0x31,0x32,0x32,0x32,
 227 0x33,0x35,0x39,0x35,0x39,0x5a,0x30,0x81,0xb4,0x31,0x0b,0x30,0x09,0x06,0x03,
 228 0x55,0x04,0x06,0x13,0x02,0x55,0x53,0x31,0x13,0x30,0x11,0x06,0x03,0x55,0x04,
 229 0x08,0x13,0x0a,0x43,0x61,0x6c,0x69,0x66,0x6f,0x72,0x6e,0x69,0x61,0x31,0x12,
 230 0x30,0x10,0x06,0x03,0x55,0x04,0x07,0x13,0x09,0x43,0x75,0x70,0x65,0x72,0x74,
 231 0x69,0x6e,0x6f,0x31,0x1d,0x30,0x1b,0x06,0x03,0x55,0x04,0x0a,0x14,0x14,0x41,
 232 0x70,0x70,0x6c,0x65,0x20,0x43,0x6f,0x6d,0x70,0x75,0x74,0x65,0x72,0x2c,0x20,
 233 0x49,0x6e,0x63,0x2e,0x31,0x3e,0x30,0x3c,0x06,0x03,0x55,0x04,0x0b,0x13,0x35,
 234 0x44,0x69,0x67,0x69,0x74,0x61,0x6c,0x20,0x49,0x44,0x20,0x43,0x6c,0x61,0x73,
 235 0x73,0x20,0x33,0x20,0x2d,0x20,0x4d,0x69,0x63,0x72,0x6f,0x73,0x6f,0x66,0x74,
 236 0x20,0x53,0x6f,0x66,0x74,0x77,0x61,0x72,0x65,0x20,0x56,0x61,0x6c,0x69,0x64,
 237 0x61,0x74,0x69,0x6f,0x6e,0x20,0x76,0x32,0x31,0x1d,0x30,0x1b,0x06,0x03,0x55,
 238 0x04,0x03,0x14,0x14,0x41,0x70,0x70,0x6c,0x65,0x20,0x43,0x6f,0x6d,0x70,0x75,
 239 0x74,0x65,0x72,0x2c,0x20,0x49,0x6e,0x63,0x2e,0x30,0x81,0x9f,0x30,0x0d,0x06,
 240 0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x01,0x05,0x00,0x03,0x81,0x8d,
 241 0x00,0x30,0x81,0x89,0x02,0x81,0x81,0x00,0xd3,0xab,0x3b,0x7f,0xec,0x48,0x84,
 242 0xce,0xa8,0x1a,0x12,0xf3,0x3c,0x87,0xcb,0x24,0x58,0x96,0x02,0x87,0x66,0x49,
 243 0xeb,0x89,0xee,0x79,0x44,0x70,0x8d,0xe7,0xd4,0x1f,0x30,0x92,0xc0,0x9c,0x35,
 244 0x78,0xc0,0xaf,0x1c,0xb6,0x28,0xd3,0xe0,0xe0,0x9d,0xd3,0x49,0x76,0x73,0x57,
 245 0x19,0x4d,0x8d,0x70,0x85,0x64,0x4d,0x1d,0xc6,0x02,0x3e,0xe5,0x2c,0x66,0x07,
 246 0xd2,0x27,0x4b,0xd6,0xc8,0x3c,0x93,0xb6,0x15,0x0c,0xde,0x5b,0xd7,0x93,0xdd,
 247 0xbe,0x85,0x62,0x34,0x17,0x8a,0x05,0x60,0xf0,0x8a,0x1c,0x5a,0x40,0x21,0x8d,
 248 0x51,0x6c,0xb0,0x62,0xd8,0xb5,0xd4,0xf9,0xb1,0xd0,0x58,0x7a,0x7a,0x82,0x55,
 249 0xb3,0xf9,0x53,0x71,0xde,0xd2,0xc9,0x37,0x8c,0xf6,0x5a,0x1f,0x2d,0xcd,0x7c,
 250 0x67,0x02,0x03,0x01,0x00,0x01,0xa3,0x82,0x01,0x7f,0x30,0x82,0x01,0x7b,0x30,
 251 0x09,0x06,0x03,0x55,0x1d,0x13,0x04,0x02,0x30,0x00,0x30,0x0e,0x06,0x03,0x55,
 252 0x1d,0x0f,0x01,0x01,0xff,0x04,0x04,0x03,0x02,0x07,0x80,0x30,0x40,0x06,0x03,
 253 0x55,0x1d,0x1f,0x04,0x39,0x30,0x37,0x30,0x35,0xa0,0x33,0xa0,0x31,0x86,0x2f,
 254 0x68,0x74,0x74,0x70,0x3a,0x2f,0x2f,0x43,0x53,0x43,0x33,0x2d,0x32,0x30,0x30,
 255 0x34,0x2d,0x63,0x72,0x6c,0x2e,0x76,0x65,0x72,0x69,0x73,0x69,0x67,0x6e,0x2e,
 256 0x63,0x6f,0x6d,0x2f,0x43,0x53,0x43,0x33,0x2d,0x32,0x30,0x30,0x34,0x2e,0x63,
 257 0x72,0x6c,0x30,0x44,0x06,0x03,0x55,0x1d,0x20,0x04,0x3d,0x30,0x3b,0x30,0x39,
 258 0x06,0x0b,0x60,0x86,0x48,0x01,0x86,0xf8,0x45,0x01,0x07,0x17,0x03,0x30,0x2a,
 259 0x30,0x28,0x06,0x08,0x2b,0x06,0x01,0x05,0x05,0x07,0x02,0x01,0x16,0x1c,0x68,
 260 0x74,0x74,0x70,0x73,0x3a,0x2f,0x2f,0x77,0x77,0x77,0x2e,0x76,0x65,0x72,0x69,
 261 0x73,0x69,0x67,0x6e,0x2e,0x63,0x6f,0x6d,0x2f,0x72,0x70,0x61,0x30,0x13,0x06,
 262 0x03,0x55,0x1d,0x25,0x04,0x0c,0x30,0x0a,0x06,0x08,0x2b,0x06,0x01,0x05,0x05,
 263 0x07,0x03,0x03,0x30,0x75,0x06,0x08,0x2b,0x06,0x01,0x05,0x05,0x07,0x01,0x01,
 264 0x04,0x69,0x30,0x67,0x30,0x24,0x06,0x08,0x2b,0x06,0x01,0x05,0x05,0x07,0x30,
 265 0x01,0x86,0x18,0x68,0x74,0x74,0x70,0x3a,0x2f,0x2f,0x6f,0x63,0x73,0x70,0x2e,
 266 0x76,0x65,0x72,0x69,0x73,0x69,0x67,0x6e,0x2e,0x63,0x6f,0x6d,0x30,0x3f,0x06,
 267 0x08,0x2b,0x06,0x01,0x05,0x05,0x07,0x30,0x02,0x86,0x33,0x68,0x74,0x74,0x70,
 268 0x3a,0x2f,0x2f,0x43,0x53,0x43,0x33,0x2d,0x32,0x30,0x30,0x34,0x2d,0x61,0x69,
 269 0x61,0x2e,0x76,0x65,0x72,0x69,0x73,0x69,0x67,0x6e,0x2e,0x63,0x6f,0x6d,0x2f,
 270 0x43,0x53,0x43,0x33,0x2d,0x32,0x30,0x30,0x34,0x2d,0x61,0x69,0x61,0x2e,0x63,
 271 0x65,0x72,0x30,0x1f,0x06,0x03,0x55,0x1d,0x23,0x04,0x18,0x30,0x16,0x80,0x14,
 272 0x08,0xf5,0x51,0xe8,0xfb,0xfe,0x3d,0x3d,0x64,0x36,0x7c,0x68,0xcf,0x5b,0x78,
 273 0xa8,0xdf,0xb9,0xc5,0x37,0x30,0x11,0x06,0x09,0x60,0x86,0x48,0x01,0x86,0xf8,
 274 0x42,0x01,0x01,0x04,0x04,0x03,0x02,0x04,0x10,0x30,0x16,0x06,0x0a,0x2b,0x06,
 275 0x01,0x04,0x01,0x82,0x37,0x02,0x01,0x1b,0x04,0x08,0x30,0x06,0x01,0x01,0x00,
 276 0x01,0x01,0xff,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,
 277 0x05,0x05,0x00,0x03,0x82,0x01,0x01,0x00,0x6a,0xa6,0x06,0xd0,0x33,0x18,0x64,
 278 0xe2,0x69,0x82,0xee,0x6e,0x36,0x9e,0x9d,0x9a,0x0e,0x18,0xa8,0xac,0x9d,0x10,
 279 0xed,0x01,0x3c,0xb9,0x61,0x04,0x62,0xf3,0x85,0x8f,0xcc,0x4f,0x2c,0x66,0x35,
 280 0x54,0x25,0x45,0x8d,0x95,0x1c,0xd2,0x33,0xbe,0x2e,0xdd,0x7f,0x74,0xaf,0x03,
 281 0x7b,0x86,0x63,0xb0,0xc9,0xe6,0xbd,0xc7,0x8e,0xde,0x03,0x18,0x98,0x82,0xc3,
 282 0xbb,0xf8,0x15,0x99,0x1a,0xa9,0xdd,0xb9,0x5d,0xb9,0xbd,0x53,0x95,0x25,0x76,
 283 0xfb,0x5c,0x53,0x90,0xea,0x01,0x0a,0xa0,0xb1,0xbf,0x09,0x1b,0x97,0x8f,0x40,
 284 0xfa,0x85,0x12,0x74,0x01,0xdb,0xf6,0xdb,0x09,0xd6,0x5f,0x4f,0xd7,0x17,0xb4,
 285 0xbf,0x9e,0x2f,0x86,0x52,0x5d,0x70,0x24,0x52,0x32,0x1e,0xa5,0x1d,0x39,0x8b,
 286 0x66,0xf6,0xba,0x9b,0x69,0x8e,0x12,0x60,0xdb,0xb6,0xcf,0xe6,0x0d,0xd6,0x1c,
 287 0x8f,0xd4,0x5b,0x4b,0x00,0xde,0x21,0x93,0xfb,0x6e,0xc7,0x3d,0xb4,0x66,0x0d,
 288 0x29,0x0c,0x4e,0xe9,0x3f,0x94,0xd6,0xd6,0xdc,0xec,0xf8,0x53,0x3b,0x62,0xd5,
 289 0x97,0x50,0x53,0x84,0x17,0xfe,0xe2,0xed,0x4c,0x23,0x0a,0x49,0xce,0x5b,0xe9,
 290 0x70,0x31,0xc1,0x04,0x02,0x02,0x6c,0xb8,0x52,0xcd,0xc7,0x4e,0x70,0xb4,0x13,
 291 0xd7,0xe0,0x92,0xba,0x44,0x1a,0x10,0x4c,0x6e,0x45,0xc6,0x86,0x04,0xc6,0x64,
 292 0xd3,0x9c,0x6e,0xc1,0x9c,0xac,0x74,0x3d,0x77,0x06,0x5e,0x28,0x28,0x5c,0xf5,
 293 0xe0,0x9c,0x19,0xd8,0xba,0x74,0x81,0x2d,0x67,0x77,0x93,0x8d,0xbf,0xd2,0x52,
 294 0x00,0xe6,0xa5,0x38,0x4e,0x2e,0x73,0x66,0x7a };
 295 static const BYTE verisignCA[] = {
 296 0x30,0x82,0x02,0x3c,0x30,0x82,0x01,0xa5,0x02,0x10,0x70,0xba,0xe4,0x1d,0x10,
 297 0xd9,0x29,0x34,0xb6,0x38,0xca,0x7b,0x03,0xcc,0xba,0xbf,0x30,0x0d,0x06,0x09,
 298 0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x02,0x05,0x00,0x30,0x5f,0x31,0x0b,
 299 0x30,0x09,0x06,0x03,0x55,0x04,0x06,0x13,0x02,0x55,0x53,0x31,0x17,0x30,0x15,
 300 0x06,0x03,0x55,0x04,0x0a,0x13,0x0e,0x56,0x65,0x72,0x69,0x53,0x69,0x67,0x6e,
 301 0x2c,0x20,0x49,0x6e,0x63,0x2e,0x31,0x37,0x30,0x35,0x06,0x03,0x55,0x04,0x0b,
 302 0x13,0x2e,0x43,0x6c,0x61,0x73,0x73,0x20,0x33,0x20,0x50,0x75,0x62,0x6c,0x69,
 303 0x63,0x20,0x50,0x72,0x69,0x6d,0x61,0x72,0x79,0x20,0x43,0x65,0x72,0x74,0x69,
 304 0x66,0x69,0x63,0x61,0x74,0x69,0x6f,0x6e,0x20,0x41,0x75,0x74,0x68,0x6f,0x72,
 305 0x69,0x74,0x79,0x30,0x1e,0x17,0x0d,0x39,0x36,0x30,0x31,0x32,0x39,0x30,0x30,
 306 0x30,0x30,0x30,0x30,0x5a,0x17,0x0d,0x32,0x38,0x30,0x38,0x30,0x31,0x32,0x33,
 307 0x35,0x39,0x35,0x39,0x5a,0x30,0x5f,0x31,0x0b,0x30,0x09,0x06,0x03,0x55,0x04,
 308 0x06,0x13,0x02,0x55,0x53,0x31,0x17,0x30,0x15,0x06,0x03,0x55,0x04,0x0a,0x13,
 309 0x0e,0x56,0x65,0x72,0x69,0x53,0x69,0x67,0x6e,0x2c,0x20,0x49,0x6e,0x63,0x2e,
 310 0x31,0x37,0x30,0x35,0x06,0x03,0x55,0x04,0x0b,0x13,0x2e,0x43,0x6c,0x61,0x73,
 311 0x73,0x20,0x33,0x20,0x50,0x75,0x62,0x6c,0x69,0x63,0x20,0x50,0x72,0x69,0x6d,
 312 0x61,0x72,0x79,0x20,0x43,0x65,0x72,0x74,0x69,0x66,0x69,0x63,0x61,0x74,0x69,
 313 0x6f,0x6e,0x20,0x41,0x75,0x74,0x68,0x6f,0x72,0x69,0x74,0x79,0x30,0x81,0x9f,
 314 0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x01,0x05,0x00,
 315 0x03,0x81,0x8d,0x00,0x30,0x81,0x89,0x02,0x81,0x81,0x00,0xc9,0x5c,0x59,0x9e,
 316 0xf2,0x1b,0x8a,0x01,0x14,0xb4,0x10,0xdf,0x04,0x40,0xdb,0xe3,0x57,0xaf,0x6a,
 317 0x45,0x40,0x8f,0x84,0x0c,0x0b,0xd1,0x33,0xd9,0xd9,0x11,0xcf,0xee,0x02,0x58,
 318 0x1f,0x25,0xf7,0x2a,0xa8,0x44,0x05,0xaa,0xec,0x03,0x1f,0x78,0x7f,0x9e,0x93,
 319 0xb9,0x9a,0x00,0xaa,0x23,0x7d,0xd6,0xac,0x85,0xa2,0x63,0x45,0xc7,0x72,0x27,
 320 0xcc,0xf4,0x4c,0xc6,0x75,0x71,0xd2,0x39,0xef,0x4f,0x42,0xf0,0x75,0xdf,0x0a,
 321 0x90,0xc6,0x8e,0x20,0x6f,0x98,0x0f,0xf8,0xac,0x23,0x5f,0x70,0x29,0x36,0xa4,
 322 0xc9,0x86,0xe7,0xb1,0x9a,0x20,0xcb,0x53,0xa5,0x85,0xe7,0x3d,0xbe,0x7d,0x9a,
 323 0xfe,0x24,0x45,0x33,0xdc,0x76,0x15,0xed,0x0f,0xa2,0x71,0x64,0x4c,0x65,0x2e,
 324 0x81,0x68,0x45,0xa7,0x02,0x03,0x01,0x00,0x01,0x30,0x0d,0x06,0x09,0x2a,0x86,
 325 0x48,0x86,0xf7,0x0d,0x01,0x01,0x02,0x05,0x00,0x03,0x81,0x81,0x00,0xbb,0x4c,
 326 0x12,0x2b,0xcf,0x2c,0x26,0x00,0x4f,0x14,0x13,0xdd,0xa6,0xfb,0xfc,0x0a,0x11,
 327 0x84,0x8c,0xf3,0x28,0x1c,0x67,0x92,0x2f,0x7c,0xb6,0xc5,0xfa,0xdf,0xf0,0xe8,
 328 0x95,0xbc,0x1d,0x8f,0x6c,0x2c,0xa8,0x51,0xcc,0x73,0xd8,0xa4,0xc0,0x53,0xf0,
 329 0x4e,0xd6,0x26,0xc0,0x76,0x01,0x57,0x81,0x92,0x5e,0x21,0xf1,0xd1,0xb1,0xff,
 330 0xe7,0xd0,0x21,0x58,0xcd,0x69,0x17,0xe3,0x44,0x1c,0x9c,0x19,0x44,0x39,0x89,
 331 0x5c,0xdc,0x9c,0x00,0x0f,0x56,0x8d,0x02,0x99,0xed,0xa2,0x90,0x45,0x4c,0xe4,
 332 0xbb,0x10,0xa4,0x3d,0xf0,0x32,0x03,0x0e,0xf1,0xce,0xf8,0xe8,0xc9,0x51,0x8c,
 333 0xe6,0x62,0x9f,0xe6,0x9f,0xc0,0x7d,0xb7,0x72,0x9c,0xc9,0x36,0x3a,0x6b,0x9f,
 334 0x4e,0xa8,0xff,0x64,0x0d,0x64 };
 335
 336 /* chain0_0 -> chain0_1:
 337  * A simple, valid chain
 338  */
 339 static const BYTE chain0_0[] = {
 340 0x30,0x82,0x01,0x9b,0x30,0x82,0x01,0x08,0xa0,0x03,0x02,0x01,0x02,0x02,0x10,
 341 0xa0,0x9a,0x52,0x5b,0xea,0x24,0xa2,0xb8,0x42,0x63,0x07,0xc3,0xda,0x16,0x08,
 342 0x85,0x30,0x09,0x06,0x05,0x2b,0x0e,0x03,0x02,0x1d,0x05,0x00,0x30,0x10,0x31,
 343 0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,0x43,0x65,0x72,0x74,0x31,
 344 0x30,0x1e,0x17,0x0d,0x30,0x37,0x30,0x31,0x30,0x31,0x30,0x30,0x30,0x30,0x30,
 345 0x30,0x5a,0x17,0x0d,0x30,0x37,0x31,0x32,0x33,0x31,0x32,0x33,0x35,0x39,0x35,
 346 0x39,0x5a,0x30,0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,
 347 0x43,0x65,0x72,0x74,0x31,0x30,0x81,0x9f,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,
 348 0x86,0xf7,0x0d,0x01,0x01,0x01,0x05,0x00,0x03,0x81,0x8d,0x00,0x30,0x81,0x89,
 349 0x02,0x81,0x81,0x00,0xad,0x7e,0xca,0xf3,0xe5,0x99,0xc2,0x2a,0xca,0x50,0x82,
 350 0x7c,0x2d,0xa4,0x81,0xcd,0x0d,0x0d,0x86,0xd7,0xd8,0xb2,0xde,0xc5,0xc3,0x34,
 351 0x9e,0x07,0x78,0x08,0x11,0x12,0x2d,0x21,0x0a,0x09,0x07,0x14,0x03,0x7a,0xe7,
 352 0x3b,0x58,0xf1,0xde,0x3e,0x01,0x25,0x93,0xab,0x8f,0xce,0x1f,0xc1,0x33,0x91,
 353 0xfe,0x59,0xb9,0x3b,0x9e,0x95,0x12,0x89,0x8e,0xc3,0x4b,0x98,0x1b,0x99,0xc5,
 354 0x07,0xe2,0xdf,0x15,0x4c,0x39,0x76,0x06,0xad,0xdb,0x16,0x06,0x49,0xba,0xcd,
 355 0x0f,0x07,0xd6,0xea,0x27,0xa6,0xfe,0x3d,0x88,0xe5,0x97,0x45,0x72,0xb6,0x1c,
 356 0xc0,0x1c,0xb1,0xa2,0x89,0xe8,0x37,0x9e,0xf6,0x2a,0xcf,0xd5,0x1f,0x2f,0x35,
 357 0x5e,0x8f,0x3a,0x9c,0x61,0xb1,0xf1,0x6c,0xff,0x8c,0xb2,0x2f,0x02,0x03,0x01,
 358 0x00,0x01,0x30,0x09,0x06,0x05,0x2b,0x0e,0x03,0x02,0x1d,0x05,0x00,0x03,0x81,
 359 0x81,0x00,0x98,0x32,0xf8,0xd2,0x7a,0x34,0x64,0x9d,0x40,0xd3,0x85,0x62,0x58,
 360 0x13,0xba,0x2f,0xac,0x2f,0xbd,0x4c,0xe3,0xba,0x05,0xa5,0xbf,0x33,0x4b,0x4a,
 361 0x38,0xd6,0xc9,0x9e,0xa7,0x69,0x95,0xc2,0x67,0x22,0xb6,0xec,0x1f,0x92,0xbc,
 362 0xd3,0xd1,0x59,0x12,0xff,0x83,0xba,0xa1,0x17,0xec,0x52,0x8c,0x21,0x7d,0xf8,
 363 0x68,0x63,0x46,0xbe,0x48,0xd7,0xeb,0x8d,0xbf,0x5e,0x87,0x5f,0xc7,0x56,0x2d,
 364 0xf7,0xf8,0x41,0x8a,0xd1,0xb4,0xe8,0x18,0x71,0xf9,0xf1,0x89,0x7c,0xfc,0x67,
 365 0x9b,0x83,0x5d,0x54,0xb5,0xfd,0x5d,0x94,0x41,0xcd,0x31,0x7d,0x5d,0x02,0x38,
 366 0xff,0x75,0x7d,0xb9,0x86,0x70,0xe4,0x6d,0x96,0x97,0x30,0xeb,0x88,0x45,0xb5,
 367 0x2b,0x7c,0x29,0x84,0x6c,0xe9,0xa3,0xb6,0x11,0x78 };
 368 static const BYTE chain0_1[] = {
 369 0x30,0x82,0x01,0x98,0x30,0x82,0x01,0x01,0xa0,0x03,0x02,0x01,0x02,0x02,0x01,
 370 0x01,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x05,
 371 0x00,0x30,0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,0x43,
 372 0x65,0x72,0x74,0x31,0x30,0x22,0x18,0x0f,0x31,0x36,0x30,0x31,0x31,0x31,0x32,
 373 0x32,0x31,0x38,0x35,0x32,0x30,0x37,0x5a,0x18,0x0f,0x31,0x36,0x32,0x38,0x30,
 374 0x38,0x32,0x36,0x30,0x35,0x32,0x30,0x35,0x37,0x5a,0x30,0x10,0x31,0x0e,0x30,
 375 0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,0x43,0x65,0x72,0x74,0x32,0x30,0x81,
 376 0x9f,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x01,0x05,
 377 0x00,0x03,0x81,0x8d,0x00,0x30,0x81,0x89,0x02,0x81,0x81,0x00,0xb8,0x52,0xda,
 378 0xc5,0x4b,0x3f,0xe5,0x33,0x0e,0x67,0x5f,0x48,0x21,0xdc,0x7e,0xef,0x37,0x33,
 379 0xba,0xff,0xb4,0xc6,0xdc,0xb6,0x17,0x8e,0x20,0x55,0x07,0x12,0xd2,0x7b,0x3c,
 380 0xce,0x30,0xc5,0xa7,0x48,0x9f,0x6e,0xfe,0xb8,0xbe,0xdb,0x9f,0x9b,0x17,0x60,
 381 0x16,0xde,0xc6,0x8b,0x47,0xd1,0x57,0x71,0x3c,0x93,0xfc,0xbd,0xec,0x44,0x32,
 382 0x3b,0xb9,0xcf,0x6b,0x05,0x72,0xa7,0x87,0x8e,0x7e,0xd4,0x9a,0x87,0x1c,0x2f,
 383 0xb7,0x82,0x40,0xfc,0x6a,0x80,0x83,0x68,0x28,0xce,0x84,0xf4,0x0b,0x2e,0x44,
 384 0xcb,0x53,0xac,0x85,0x85,0xb5,0x46,0x36,0x98,0x3c,0x10,0x02,0xaa,0x02,0xbc,
 385 0x8b,0xa2,0x23,0xb2,0xd3,0x51,0x9a,0x22,0x4a,0xe3,0xaa,0x4e,0x7c,0xda,0x38,
 386 0xcf,0x49,0x98,0x72,0xa3,0x02,0x03,0x01,0x00,0x01,0x30,0x0d,0x06,0x09,0x2a,
 387 0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x05,0x00,0x03,0x81,0x81,0x00,0x3c,
 388 0x90,0x45,0x5b,0x81,0x25,0x9d,0x7a,0x10,0x9f,0x15,0x25,0x03,0x52,0x78,0x09,
 389 0x6f,0x62,0x66,0x78,0x01,0x69,0x6a,0x7f,0x19,0x02,0x18,0xd8,0xc0,0x89,0x2f,
 390 0x0f,0x47,0xa7,0x17,0xc2,0xd7,0xe2,0x81,0x7e,0xea,0x54,0xd4,0xe6,0xcc,0x8f,
 391 0x88,0x1a,0xee,0x28,0x42,0x6c,0x77,0xf5,0xec,0x8c,0x05,0xa5,0x7f,0xee,0x2e,
 392 0x0b,0xbc,0xde,0xb0,0x71,0x2c,0x83,0x32,0xcb,0x49,0x00,0x46,0x03,0x95,0x58,
 393 0x6c,0x57,0x0c,0x5a,0x69,0x3c,0xfa,0xbf,0x46,0x7a,0x4d,0xd0,0x23,0x77,0x23,
 394 0xac,0x1d,0x33,0xb7,0x87,0xb4,0xc6,0x6b,0x52,0xa1,0xed,0x9a,0xb8,0x8e,0x1a,
 395 0xcb,0xc3,0xd3,0x50,0xe0,0x0d,0x12,0x5d,0x0e,0x84,0x52,0xa5,0x12,0x76,0x6b,
 396 0xbf,0xb8,0xbe,0x51,0xc0,0xa6,0xae };
 397 /* chain0_0 -> chain1_1:
 398  * A chain whose signature is bad
 399  */
 400 static const BYTE chain1_1[] = {
 401 0x30,0x82,0x01,0x98,0x30,0x82,0x01,0x01,0xa0,0x03,0x02,0x01,0x02,0x02,0x01,
 402 0x01,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x05,
 403 0x00,0x30,0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,0x43,
 404 0x65,0x72,0x74,0x31,0x30,0x22,0x18,0x0f,0x31,0x36,0x30,0x31,0x31,0x31,0x32,
 405 0x32,0x31,0x38,0x35,0x32,0x30,0x37,0x5a,0x18,0x0f,0x31,0x36,0x32,0x38,0x30,
 406 0x38,0x32,0x36,0x30,0x35,0x32,0x30,0x35,0x37,0x5a,0x30,0x10,0x31,0x0e,0x30,
 407 0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,0x43,0x65,0x72,0x74,0x32,0x30,0x81,
 408 0x9f,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x01,0x05,
 409 0x00,0x03,0x81,0x8d,0x00,0x30,0x81,0x89,0x02,0x81,0x81,0x00,0xad,0x7e,0xca,
 410 0xf3,0xe5,0x99,0xc2,0x2a,0xca,0x50,0x82,0x7c,0x2d,0xa4,0x81,0xcd,0x0d,0x0d,
 411 0x86,0xd7,0xd8,0xb2,0xde,0xc5,0xc3,0x34,0x9e,0x07,0x78,0x08,0x11,0x12,0x2d,
 412 0x21,0x0a,0x09,0x07,0x14,0x03,0x7a,0xe7,0x3b,0x58,0xf1,0xde,0x3e,0x01,0x25,
 413 0x93,0xab,0x8f,0xce,0x1f,0xc1,0x33,0x91,0xfe,0x59,0xb9,0x3b,0x9e,0x95,0x12,
 414 0x89,0x8e,0xc3,0x4b,0x98,0x1b,0x99,0xc5,0x07,0xe2,0xdf,0x15,0x4c,0x39,0x76,
 415 0x06,0xad,0xdb,0x16,0x06,0x49,0xba,0xcd,0x0f,0x07,0xd6,0xea,0x27,0xa6,0xfe,
 416 0x3d,0x88,0xe5,0x97,0x45,0x72,0xb6,0x1c,0xc0,0x1c,0xb1,0xa2,0x89,0xe8,0x37,
 417 0x9e,0xf6,0x2a,0xcf,0xd5,0x1f,0x2f,0x35,0x5e,0x8f,0x3a,0x9c,0x61,0xb1,0xf1,
 418 0x6c,0xff,0x8c,0xb2,0x2f,0x02,0x03,0x01,0x00,0x01,0x30,0x0d,0x06,0x09,0x2a,
 419 0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x05,0x00,0x03,0x81,0x81,0x00,0xad,
 420 0x16,0xaa,0x77,0xab,0xd5,0x1a,0x6c,0x90,0x5d,0x4e,0x61,0x49,0x89,0x6e,0x9f,
 421 0x03,0x7b,0x4a,0x49,0xb1,0x46,0x75,0xf3,0x69,0xeb,0x96,0x13,0x3c,0x35,0xb5,
 422 0x37,0x3b,0xc2,0x84,0x5c,0xe5,0x7c,0x46,0xf6,0x6b,0xc7,0x4e,0x72,0x91,0xf4,
 423 0xde,0xc5,0x66,0x0f,0x2d,0x39,0xc6,0x9e,0x8e,0x25,0x4d,0x3f,0x7b,0x45,0xe1,
 424 0xc6,0x1a,0x7e,0x28,0x83,0xf8,0x87,0x30,0x4e,0xa5,0xfd,0x32,0x7a,0xed,0x53,
 425 0x10,0x3b,0x14,0xe5,0xf1,0x32,0x77,0xf1,0x29,0x72,0x98,0x2b,0xa3,0x17,0xd6,
 426 0x8c,0x65,0xaa,0x3b,0x6d,0xab,0xb3,0xbe,0xfa,0x72,0x38,0xf7,0xd0,0xb6,0x0f,
 427 0x5c,0x0d,0xec,0x17,0x43,0x2a,0xfd,0xc1,0x01,0x43,0x98,0xd3,0x1b,0x84,0x3e,
 428 0x32,0xcf,0xda,0x1d,0xc2,0xc9,0x61 };
 429 /* chain2_0 -> chain0_1:
 430  * A chain whose time nesting is invalid.
 431  */
 432 static const BYTE chain2_0[] = {
 433 0x30,0x82,0x01,0x9b,0x30,0x82,0x01,0x08,0xa0,0x03,0x02,0x01,0x02,0x02,0x10,
 434 0x23,0x82,0x3b,0x9e,0x51,0x6e,0xc9,0x8c,0x4f,0x22,0x48,0x21,0x20,0xb4,0xa3,
 435 0xac,0x30,0x09,0x06,0x05,0x2b,0x0e,0x03,0x02,0x1d,0x05,0x00,0x30,0x10,0x31,
 436 0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,0x43,0x65,0x72,0x74,0x31,
 437 0x30,0x1e,0x17,0x0d,0x30,0x36,0x30,0x31,0x30,0x31,0x30,0x30,0x30,0x30,0x30,
 438 0x30,0x5a,0x17,0x0d,0x30,0x36,0x31,0x32,0x33,0x31,0x32,0x33,0x35,0x39,0x35,
 439 0x39,0x5a,0x30,0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,
 440 0x43,0x65,0x72,0x74,0x31,0x30,0x81,0x9f,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,
 441 0x86,0xf7,0x0d,0x01,0x01,0x01,0x05,0x00,0x03,0x81,0x8d,0x00,0x30,0x81,0x89,
 442 0x02,0x81,0x81,0x00,0xad,0x7e,0xca,0xf3,0xe5,0x99,0xc2,0x2a,0xca,0x50,0x82,
 443 0x7c,0x2d,0xa4,0x81,0xcd,0x0d,0x0d,0x86,0xd7,0xd8,0xb2,0xde,0xc5,0xc3,0x34,
 444 0x9e,0x07,0x78,0x08,0x11,0x12,0x2d,0x21,0x0a,0x09,0x07,0x14,0x03,0x7a,0xe7,
 445 0x3b,0x58,0xf1,0xde,0x3e,0x01,0x25,0x93,0xab,0x8f,0xce,0x1f,0xc1,0x33,0x91,
 446 0xfe,0x59,0xb9,0x3b,0x9e,0x95,0x12,0x89,0x8e,0xc3,0x4b,0x98,0x1b,0x99,0xc5,
 447 0x07,0xe2,0xdf,0x15,0x4c,0x39,0x76,0x06,0xad,0xdb,0x16,0x06,0x49,0xba,0xcd,
 448 0x0f,0x07,0xd6,0xea,0x27,0xa6,0xfe,0x3d,0x88,0xe5,0x97,0x45,0x72,0xb6,0x1c,
 449 0xc0,0x1c,0xb1,0xa2,0x89,0xe8,0x37,0x9e,0xf6,0x2a,0xcf,0xd5,0x1f,0x2f,0x35,
 450 0x5e,0x8f,0x3a,0x9c,0x61,0xb1,0xf1,0x6c,0xff,0x8c,0xb2,0x2f,0x02,0x03,0x01,
 451 0x00,0x01,0x30,0x09,0x06,0x05,0x2b,0x0e,0x03,0x02,0x1d,0x05,0x00,0x03,0x81,
 452 0x81,0x00,0x18,0x5c,0xb9,0x2f,0x27,0xa5,0x4b,0x2c,0xda,0x04,0x78,0x46,0x5e,
 453 0x36,0xe7,0xc9,0xbb,0x42,0xf6,0x85,0x56,0x45,0xca,0x51,0xb2,0xcf,0x2b,0xbd,
 454 0xed,0x77,0xcf,0x12,0xf5,0x29,0xc2,0x42,0x32,0xf4,0xad,0x25,0xc1,0x17,0xef,
 455 0x93,0xbf,0xa5,0x61,0xb8,0xc7,0x4b,0xae,0xa8,0x1c,0x08,0xda,0x98,0xe0,0x5c,
 456 0x55,0x08,0x74,0xf7,0xf4,0xdc,0x38,0x2b,0xa9,0x2b,0x1e,0x12,0x7b,0xc1,0x61,
 457 0xe5,0x8d,0xf3,0xdc,0x21,0xe2,0xd2,0x56,0x4f,0xb4,0x8d,0x8c,0x36,0x69,0xf8,
 458 0x82,0x83,0x28,0x6d,0x0d,0x81,0x73,0xec,0x41,0x5c,0x90,0x7a,0xc5,0x27,0x36,
 459 0x9d,0xaa,0xf5,0xe0,0x8b,0xf0,0xfa,0x7d,0x41,0x8f,0x6a,0x36,0xa8,0x61,0x75,
 460 0xc0,0xf2,0x06,0xe8,0x83,0xdb,0xbe,0xc4,0x5b,0x72 };
 461 /* chain3_0 -> chain0_1:
 462  * A chain whose root cannot be a CA.
 463  */
 464 static const BYTE chain3_0[] = {
 465 0x30,0x82,0x01,0xad,0x30,0x82,0x01,0x1a,0xa0,0x03,0x02,0x01,0x02,0x02,0x10,
 466 0x63,0x73,0xee,0x45,0x59,0x76,0x1a,0x9e,0x47,0xf1,0xfb,0xf0,0x42,0x44,0x26,
 467 0xeb,0x30,0x09,0x06,0x05,0x2b,0x0e,0x03,0x02,0x1d,0x05,0x00,0x30,0x10,0x31,
 468 0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,0x43,0x65,0x72,0x74,0x31,
 469 0x30,0x1e,0x17,0x0d,0x30,0x37,0x30,0x31,0x30,0x31,0x30,0x30,0x30,0x30,0x30,
 470 0x30,0x5a,0x17,0x0d,0x30,0x37,0x31,0x32,0x33,0x31,0x32,0x33,0x35,0x39,0x35,
 471 0x39,0x5a,0x30,0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,
 472 0x43,0x65,0x72,0x74,0x31,0x30,0x81,0x9f,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,
 473 0x86,0xf7,0x0d,0x01,0x01,0x01,0x05,0x00,0x03,0x81,0x8d,0x00,0x30,0x81,0x89,
 474 0x02,0x81,0x81,0x00,0xad,0x7e,0xca,0xf3,0xe5,0x99,0xc2,0x2a,0xca,0x50,0x82,
 475 0x7c,0x2d,0xa4,0x81,0xcd,0x0d,0x0d,0x86,0xd7,0xd8,0xb2,0xde,0xc5,0xc3,0x34,
 476 0x9e,0x07,0x78,0x08,0x11,0x12,0x2d,0x21,0x0a,0x09,0x07,0x14,0x03,0x7a,0xe7,
 477 0x3b,0x58,0xf1,0xde,0x3e,0x01,0x25,0x93,0xab,0x8f,0xce,0x1f,0xc1,0x33,0x91,
 478 0xfe,0x59,0xb9,0x3b,0x9e,0x95,0x12,0x89,0x8e,0xc3,0x4b,0x98,0x1b,0x99,0xc5,
 479 0x07,0xe2,0xdf,0x15,0x4c,0x39,0x76,0x06,0xad,0xdb,0x16,0x06,0x49,0xba,0xcd,
 480 0x0f,0x07,0xd6,0xea,0x27,0xa6,0xfe,0x3d,0x88,0xe5,0x97,0x45,0x72,0xb6,0x1c,
 481 0xc0,0x1c,0xb1,0xa2,0x89,0xe8,0x37,0x9e,0xf6,0x2a,0xcf,0xd5,0x1f,0x2f,0x35,
 482 0x5e,0x8f,0x3a,0x9c,0x61,0xb1,0xf1,0x6c,0xff,0x8c,0xb2,0x2f,0x02,0x03,0x01,
 483 0x00,0x01,0xa3,0x10,0x30,0x0e,0x30,0x0c,0x06,0x03,0x55,0x1d,0x13,0x01,0x01,
 484 0xff,0x04,0x02,0x30,0x00,0x30,0x09,0x06,0x05,0x2b,0x0e,0x03,0x02,0x1d,0x05,
 485 0x00,0x03,0x81,0x81,0x00,0x53,0xb7,0xa9,0x90,0xe0,0x88,0x36,0xc0,0x2d,0xb1,
 486 0xa3,0x97,0xff,0x16,0x62,0x29,0xa2,0xfd,0x92,0x90,0xb7,0x8d,0xd9,0xdf,0x57,
 487 0x94,0x5a,0xce,0x36,0x5c,0x95,0x24,0xab,0x4f,0x63,0x55,0xa7,0xea,0x8b,0xaf,
 488 0xd9,0x41,0x6a,0x2f,0xd8,0x9e,0x1c,0x2d,0xc0,0x11,0x52,0x09,0x4b,0x31,0x1f,
 489 0x5e,0x8f,0x4b,0xbf,0x20,0x73,0x2d,0x04,0x11,0x56,0x6d,0xb1,0xbe,0xb4,0x5d,
 490 0x70,0x6b,0xb2,0xd0,0xd3,0xf5,0x5d,0x60,0x08,0x65,0x2c,0xe3,0x78,0x5a,0x05,
 491 0x36,0xe1,0xf1,0x67,0x3a,0x25,0xf3,0x47,0x83,0xce,0x4f,0xb0,0x74,0x7a,0x35,
 492 0xa0,0x7f,0x70,0x64,0x8a,0x14,0x66,0x03,0xf6,0xae,0xdf,0x1b,0xf5,0x80,0x87,
 493 0x06,0x39,0x76,0x70,0x7b,0xd2,0x83,0xe9,0xce,0x1f,0xf8,0x66,0xc1 };
 494 /* chain4_0 -> chain0_1 -> chain4_2:
 495  * A chain whose path length constraint is violated.
 496  */
 497 static const BYTE chain4_0[] = {
 498 0x30,0x82,0x01,0xb3,0x30,0x82,0x01,0x20,0xa0,0x03,0x02,0x01,0x02,0x02,0x10,
 499 0xcb,0xdc,0x8d,0xca,0xc1,0x0e,0x9c,0x9d,0x4f,0x0a,0xc1,0x09,0x31,0x32,0x94,
 500 0xf9,0x30,0x09,0x06,0x05,0x2b,0x0e,0x03,0x02,0x1d,0x05,0x00,0x30,0x10,0x31,
 501 0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,0x43,0x65,0x72,0x74,0x31,
 502 0x30,0x1e,0x17,0x0d,0x30,0x37,0x30,0x31,0x30,0x31,0x30,0x30,0x30,0x30,0x30,
 503 0x30,0x5a,0x17,0x0d,0x30,0x37,0x31,0x32,0x33,0x31,0x32,0x33,0x35,0x39,0x35,
 504 0x39,0x5a,0x30,0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,
 505 0x43,0x65,0x72,0x74,0x31,0x30,0x81,0x9f,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,
 506 0x86,0xf7,0x0d,0x01,0x01,0x01,0x05,0x00,0x03,0x81,0x8d,0x00,0x30,0x81,0x89,
 507 0x02,0x81,0x81,0x00,0xad,0x7e,0xca,0xf3,0xe5,0x99,0xc2,0x2a,0xca,0x50,0x82,
 508 0x7c,0x2d,0xa4,0x81,0xcd,0x0d,0x0d,0x86,0xd7,0xd8,0xb2,0xde,0xc5,0xc3,0x34,
 509 0x9e,0x07,0x78,0x08,0x11,0x12,0x2d,0x21,0x0a,0x09,0x07,0x14,0x03,0x7a,0xe7,
 510 0x3b,0x58,0xf1,0xde,0x3e,0x01,0x25,0x93,0xab,0x8f,0xce,0x1f,0xc1,0x33,0x91,
 511 0xfe,0x59,0xb9,0x3b,0x9e,0x95,0x12,0x89,0x8e,0xc3,0x4b,0x98,0x1b,0x99,0xc5,
 512 0x07,0xe2,0xdf,0x15,0x4c,0x39,0x76,0x06,0xad,0xdb,0x16,0x06,0x49,0xba,0xcd,
 513 0x0f,0x07,0xd6,0xea,0x27,0xa6,0xfe,0x3d,0x88,0xe5,0x97,0x45,0x72,0xb6,0x1c,
 514 0xc0,0x1c,0xb1,0xa2,0x89,0xe8,0x37,0x9e,0xf6,0x2a,0xcf,0xd5,0x1f,0x2f,0x35,
 515 0x5e,0x8f,0x3a,0x9c,0x61,0xb1,0xf1,0x6c,0xff,0x8c,0xb2,0x2f,0x02,0x03,0x01,
 516 0x00,0x01,0xa3,0x16,0x30,0x14,0x30,0x12,0x06,0x03,0x55,0x1d,0x13,0x01,0x01,
 517 0xff,0x04,0x08,0x30,0x06,0x01,0x01,0xff,0x02,0x01,0x00,0x30,0x09,0x06,0x05,
 518 0x2b,0x0e,0x03,0x02,0x1d,0x05,0x00,0x03,0x81,0x81,0x00,0x93,0xe8,0x98,0xbe,
 519 0x7b,0x5c,0x4c,0x58,0xbd,0xee,0x31,0x55,0xa8,0xb5,0x86,0xfc,0x23,0x55,0x48,
 520 0xda,0x95,0x60,0x0f,0x53,0x64,0x66,0x50,0x78,0xdc,0x1c,0xf3,0xec,0x38,0x7d,
 521 0x07,0x58,0x19,0xcf,0x83,0xfc,0x92,0xc4,0x3e,0x48,0x5b,0x45,0x54,0xf7,0x15,
 522 0x6f,0xb0,0x5e,0x8c,0xbf,0x03,0x62,0x17,0x27,0x28,0x59,0x49,0xde,0x52,0x2d,
 523 0x4b,0xb3,0x1e,0x4d,0x4f,0x2c,0xa8,0x1e,0x70,0xd1,0xdb,0xe7,0x98,0x6c,0x6f,
 524 0xaa,0x94,0xea,0x5d,0x7f,0xc5,0x1d,0x2a,0x4d,0xb7,0x4c,0xac,0xa6,0xbf,0x79,
 525 0x9a,0xf6,0x1e,0x98,0x64,0x14,0x2e,0xbd,0x8a,0xaf,0xac,0x52,0xd2,0x2c,0xdd,
 526 0xcd,0x1b,0x3d,0x28,0x43,0xea,0x25,0x91,0x15,0xb8,0x54,0x72,0x33,0xca,0xd8,
 527 0x5f,0x06,0x4c,0x97 };
 528 static const BYTE chain4_2[] = {
 529 0x30,0x82,0x01,0x98,0x30,0x82,0x01,0x01,0xa0,0x03,0x02,0x01,0x02,0x02,0x01,
 530 0x01,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x05,
 531 0x00,0x30,0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,0x43,
 532 0x65,0x72,0x74,0x32,0x30,0x22,0x18,0x0f,0x31,0x36,0x30,0x31,0x31,0x31,0x32,
 533 0x32,0x31,0x38,0x35,0x32,0x30,0x37,0x5a,0x18,0x0f,0x31,0x36,0x32,0x38,0x30,
 534 0x38,0x32,0x36,0x30,0x35,0x32,0x30,0x35,0x37,0x5a,0x30,0x10,0x31,0x0e,0x30,
 535 0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,0x43,0x65,0x72,0x74,0x33,0x30,0x81,
 536 0x9f,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x01,0x05,
 537 0x00,0x03,0x81,0x8d,0x00,0x30,0x81,0x89,0x02,0x81,0x81,0x00,0xc3,0x31,0x35,
 538 0xc3,0x9d,0x8a,0x87,0x20,0xc6,0x32,0xe9,0xb1,0xf6,0x8f,0xf9,0x05,0x73,0x1d,
 539 0xa7,0xde,0xab,0x15,0x8a,0x9c,0x7f,0x11,0x7e,0x77,0xa0,0x42,0x80,0xf4,0x79,
 540 0xda,0x98,0x7b,0x00,0xfa,0x8f,0x0c,0xd0,0xeb,0x8a,0x80,0xed,0x07,0xfc,0x64,
 541 0x71,0x03,0xc1,0xd6,0x2f,0x9b,0xde,0x42,0x63,0xd9,0x79,0xea,0xdd,0x10,0xe8,
 542 0x68,0xc8,0x69,0x4f,0x4a,0x39,0x23,0x87,0xca,0xd1,0xc9,0x77,0x14,0x30,0x85,
 543 0x9e,0xf7,0x79,0xf9,0x07,0xb7,0x7c,0x55,0xcb,0xa7,0xd5,0xb8,0x44,0xb5,0x20,
 544 0xb5,0x01,0x5c,0xa2,0xd1,0xd5,0xad,0x0f,0x87,0xaf,0x37,0xd1,0x39,0x0c,0x0d,
 545 0xd5,0xde,0x26,0x7a,0xed,0xf9,0x2a,0xb1,0x60,0x65,0x2d,0x08,0x24,0x51,0x1d,
 546 0xb0,0x0a,0xb5,0x13,0xc7,0x02,0x03,0x01,0x00,0x01,0x30,0x0d,0x06,0x09,0x2a,
 547 0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x05,0x00,0x03,0x81,0x81,0x00,0xaa,
 548 0x0e,0x17,0x8d,0x5b,0xca,0x11,0xda,0x5a,0xb5,0xd4,0xe8,0x63,0xce,0xa5,0x67,
 549 0x11,0x2f,0xf8,0xb8,0x9f,0x89,0x46,0x7d,0x20,0x94,0x5f,0x0d,0x02,0x7e,0x5e,
 550 0x8c,0x33,0xfc,0x24,0x56,0x08,0xe6,0xf1,0x4d,0x29,0xd5,0xef,0x03,0xe3,0x9a,
 551 0xc6,0xcd,0x6e,0xe3,0xe6,0x45,0xaa,0xce,0x5a,0x2f,0x37,0x6c,0x07,0xd2,0x28,
 552 0x63,0x8e,0x55,0x8a,0xad,0xe3,0x8a,0x58,0x3d,0x24,0x09,0x1e,0x9a,0x7d,0x5f,
 553 0x05,0xc4,0x51,0x18,0x17,0x46,0x33,0x4d,0x72,0x05,0xc2,0x02,0xb6,0x05,0x22,
 554 0x23,0xcc,0xf9,0x1f,0x87,0x6c,0x4a,0x3d,0x6f,0xdb,0x59,0xf6,0x79,0x81,0x02,
 555 0x45,0x9f,0xc8,0xc3,0xf0,0x90,0x82,0xaf,0x58,0x80,0x18,0xea,0x73,0x50,0x29,
 556 0x71,0x8d,0xc1,0x9e,0x53,0x19,0x5a };
 557 /* chain5_0 -> chain5_1:
 558  * A chain whose name constraints aren't met.
 559  */
 560 static const BYTE chain5_0[] = {
 561 0x30,0x82,0x01,0xbd,0x30,0x82,0x01,0x2a,0xa0,0x03,0x02,0x01,0x02,0x02,0x10,
 562 0x80,0xc5,0x90,0x33,0xb6,0xb5,0xf7,0x99,0x4e,0x6d,0xfc,0xf9,0x4a,0xa7,0xcb,
 563 0x20,0x30,0x09,0x06,0x05,0x2b,0x0e,0x03,0x02,0x1d,0x05,0x00,0x30,0x10,0x31,
 564 0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,0x43,0x65,0x72,0x74,0x31,
 565 0x30,0x1e,0x17,0x0d,0x30,0x37,0x30,0x31,0x30,0x31,0x30,0x30,0x30,0x30,0x30,
 566 0x30,0x5a,0x17,0x0d,0x30,0x37,0x31,0x32,0x33,0x31,0x32,0x33,0x35,0x39,0x35,
 567 0x39,0x5a,0x30,0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,
 568 0x43,0x65,0x72,0x74,0x31,0x30,0x81,0x9f,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,
 569 0x86,0xf7,0x0d,0x01,0x01,0x01,0x05,0x00,0x03,0x81,0x8d,0x00,0x30,0x81,0x89,
 570 0x02,0x81,0x81,0x00,0xad,0x7e,0xca,0xf3,0xe5,0x99,0xc2,0x2a,0xca,0x50,0x82,
 571 0x7c,0x2d,0xa4,0x81,0xcd,0x0d,0x0d,0x86,0xd7,0xd8,0xb2,0xde,0xc5,0xc3,0x34,
 572 0x9e,0x07,0x78,0x08,0x11,0x12,0x2d,0x21,0x0a,0x09,0x07,0x14,0x03,0x7a,0xe7,
 573 0x3b,0x58,0xf1,0xde,0x3e,0x01,0x25,0x93,0xab,0x8f,0xce,0x1f,0xc1,0x33,0x91,
 574 0xfe,0x59,0xb9,0x3b,0x9e,0x95,0x12,0x89,0x8e,0xc3,0x4b,0x98,0x1b,0x99,0xc5,
 575 0x07,0xe2,0xdf,0x15,0x4c,0x39,0x76,0x06,0xad,0xdb,0x16,0x06,0x49,0xba,0xcd,
 576 0x0f,0x07,0xd6,0xea,0x27,0xa6,0xfe,0x3d,0x88,0xe5,0x97,0x45,0x72,0xb6,0x1c,
 577 0xc0,0x1c,0xb1,0xa2,0x89,0xe8,0x37,0x9e,0xf6,0x2a,0xcf,0xd5,0x1f,0x2f,0x35,
 578 0x5e,0x8f,0x3a,0x9c,0x61,0xb1,0xf1,0x6c,0xff,0x8c,0xb2,0x2f,0x02,0x03,0x01,
 579 0x00,0x01,0xa3,0x20,0x30,0x1e,0x30,0x1c,0x06,0x03,0x55,0x1d,0x1e,0x01,0x01,
 580 0xff,0x04,0x12,0x30,0x10,0xa0,0x0e,0x30,0x0c,0x82,0x0a,0x77,0x69,0x6e,0x65,
 581 0x68,0x71,0x2e,0x6f,0x72,0x67,0x30,0x09,0x06,0x05,0x2b,0x0e,0x03,0x02,0x1d,
 582 0x05,0x00,0x03,0x81,0x81,0x00,0x17,0x4a,0x31,0x42,0x6a,0x43,0x85,0xf8,0x91,
 583 0x17,0xc2,0x09,0xbe,0xba,0x1f,0x49,0x23,0x2e,0xa1,0x24,0x58,0x46,0xe8,0xfe,
 584 0x6e,0xbc,0x61,0xb9,0x71,0x92,0x99,0x43,0xd4,0x60,0x54,0xe8,0x29,0x78,0x97,
 585 0xb5,0xb4,0x79,0xad,0xe0,0x1e,0x2b,0x8c,0xb8,0x96,0x9f,0xf1,0x23,0x72,0x45,
 586 0xb7,0x1d,0xe1,0xed,0x0a,0x91,0xf3,0x79,0x8b,0x23,0xd8,0xd4,0x10,0x1b,0x9d,
 587 0xf2,0x7b,0xd9,0x6d,0x85,0x23,0x52,0xd5,0xbf,0x56,0x4f,0x81,0x3c,0x8d,0x62,
 588 0x17,0x0b,0xd7,0x2e,0x5b,0xa1,0xee,0x09,0x99,0x39,0x41,0x57,0x8c,0x3b,0xc4,
 589 0x30,0x1d,0xf5,0x87,0x4f,0x81,0x56,0xfa,0xc1,0x83,0x69,0xf2,0x4a,0x97,0xc9,
 590 0xd9,0x20,0xfa,0x09,0x8c,0x9f,0x13,0xfe,0x0f,0x4d,0x50,0xd3,0x24,0x1f };
 591 static const BYTE chain5_1[] = {
 592 0x30,0x82,0x01,0xb2,0x30,0x82,0x01,0x1b,0xa0,0x03,0x02,0x01,0x02,0x02,0x01,
 593 0x01,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x05,
 594 0x00,0x30,0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,0x43,
 595 0x65,0x72,0x74,0x31,0x30,0x1e,0x17,0x0d,0x30,0x37,0x30,0x31,0x30,0x31,0x30,
 596 0x30,0x30,0x30,0x30,0x30,0x5a,0x17,0x0d,0x30,0x37,0x31,0x32,0x33,0x31,0x32,
 597 0x33,0x35,0x39,0x35,0x39,0x5a,0x30,0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,
 598 0x04,0x03,0x13,0x05,0x43,0x65,0x72,0x74,0x32,0x30,0x81,0x9f,0x30,0x0d,0x06,
 599 0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x01,0x05,0x00,0x03,0x81,0x8d,
 600 0x00,0x30,0x81,0x89,0x02,0x81,0x81,0x00,0xb8,0x52,0xda,0xc5,0x4b,0x3f,0xe5,
 601 0x33,0x0e,0x67,0x5f,0x48,0x21,0xdc,0x7e,0xef,0x37,0x33,0xba,0xff,0xb4,0xc6,
 602 0xdc,0xb6,0x17,0x8e,0x20,0x55,0x07,0x12,0xd2,0x7b,0x3c,0xce,0x30,0xc5,0xa7,
 603 0x48,0x9f,0x6e,0xfe,0xb8,0xbe,0xdb,0x9f,0x9b,0x17,0x60,0x16,0xde,0xc6,0x8b,
 604 0x47,0xd1,0x57,0x71,0x3c,0x93,0xfc,0xbd,0xec,0x44,0x32,0x3b,0xb9,0xcf,0x6b,
 605 0x05,0x72,0xa7,0x87,0x8e,0x7e,0xd4,0x9a,0x87,0x1c,0x2f,0xb7,0x82,0x40,0xfc,
 606 0x6a,0x80,0x83,0x68,0x28,0xce,0x84,0xf4,0x0b,0x2e,0x44,0xcb,0x53,0xac,0x85,
 607 0x85,0xb5,0x46,0x36,0x98,0x3c,0x10,0x02,0xaa,0x02,0xbc,0x8b,0xa2,0x23,0xb2,
 608 0xd3,0x51,0x9a,0x22,0x4a,0xe3,0xaa,0x4e,0x7c,0xda,0x38,0xcf,0x49,0x98,0x72,
 609 0xa3,0x02,0x03,0x01,0x00,0x01,0xa3,0x1c,0x30,0x1a,0x30,0x18,0x06,0x03,0x55,
 610 0x1d,0x07,0x01,0x01,0xff,0x04,0x0e,0x30,0x0c,0x82,0x0a,0x77,0x69,0x6e,0x65,
 611 0x68,0x71,0x2e,0x63,0x6f,0x6d,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,
 612 0x0d,0x01,0x01,0x05,0x05,0x00,0x03,0x81,0x81,0x00,0x08,0x08,0xf5,0x1c,0xca,
 613 0x3b,0x5a,0xd7,0x45,0xac,0x29,0x5c,0x10,0x9d,0xb0,0x4a,0xdb,0x36,0x0b,0x39,
 614 0x14,0x87,0x3d,0x06,0xe8,0x0d,0x54,0xa7,0xb9,0x50,0x14,0x29,0x05,0xd2,0x75,
 615 0xe4,0x88,0xd8,0x8e,0x7e,0xab,0x61,0xba,0x3c,0xb2,0x4f,0x8f,0xfd,0x00,0x6b,
 616 0x94,0x69,0xf0,0x13,0x40,0x7d,0x4e,0x7c,0xac,0xf0,0x1b,0x07,0x2c,0x96,0x46,
 617 0xf6,0x38,0x38,0xc6,0x65,0x2c,0x02,0x28,0x62,0x6f,0x7d,0xf9,0x4d,0xff,0xb1,
 618 0x38,0x0e,0xce,0x89,0x0e,0xdd,0x22,0x51,0xd2,0x6b,0x0e,0x80,0x3c,0xa6,0x0c,
 619 0xe7,0x8b,0x3b,0x2a,0x2f,0x46,0xed,0xda,0x96,0x1a,0xc1,0x5c,0xfe,0xe0,0xef,
 620 0xdb,0xe0,0x11,0xc4,0x56,0x12,0xe2,0x4b,0x84,0xde,0xaf,0x7f,0x3c,0x9f,0xcb,
 621 0xb6,0xac,0x92 };
 622 /* chain0_0 -> chain6_1:
 623  * A chain whose end certificate is a CA.
 624  */
 625 static const BYTE chain6_1[] = {
 626 0x30,0x82,0x01,0xa9,0x30,0x82,0x01,0x12,0xa0,0x03,0x02,0x01,0x02,0x02,0x01,
 627 0x01,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x05,
 628 0x00,0x30,0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,0x43,
 629 0x65,0x72,0x74,0x31,0x30,0x1e,0x17,0x0d,0x30,0x37,0x30,0x31,0x30,0x31,0x30,
 630 0x30,0x30,0x30,0x30,0x30,0x5a,0x17,0x0d,0x30,0x37,0x31,0x32,0x33,0x31,0x32,
 631 0x33,0x35,0x39,0x35,0x39,0x5a,0x30,0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,
 632 0x04,0x03,0x13,0x05,0x43,0x65,0x72,0x74,0x32,0x30,0x81,0x9f,0x30,0x0d,0x06,
 633 0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x01,0x05,0x00,0x03,0x81,0x8d,
 634 0x00,0x30,0x81,0x89,0x02,0x81,0x81,0x00,0xb8,0x52,0xda,0xc5,0x4b,0x3f,0xe5,
 635 0x33,0x0e,0x67,0x5f,0x48,0x21,0xdc,0x7e,0xef,0x37,0x33,0xba,0xff,0xb4,0xc6,
 636 0xdc,0xb6,0x17,0x8e,0x20,0x55,0x07,0x12,0xd2,0x7b,0x3c,0xce,0x30,0xc5,0xa7,
 637 0x48,0x9f,0x6e,0xfe,0xb8,0xbe,0xdb,0x9f,0x9b,0x17,0x60,0x16,0xde,0xc6,0x8b,
 638 0x47,0xd1,0x57,0x71,0x3c,0x93,0xfc,0xbd,0xec,0x44,0x32,0x3b,0xb9,0xcf,0x6b,
 639 0x05,0x72,0xa7,0x87,0x8e,0x7e,0xd4,0x9a,0x87,0x1c,0x2f,0xb7,0x82,0x40,0xfc,
 640 0x6a,0x80,0x83,0x68,0x28,0xce,0x84,0xf4,0x0b,0x2e,0x44,0xcb,0x53,0xac,0x85,
 641 0x85,0xb5,0x46,0x36,0x98,0x3c,0x10,0x02,0xaa,0x02,0xbc,0x8b,0xa2,0x23,0xb2,
 642 0xd3,0x51,0x9a,0x22,0x4a,0xe3,0xaa,0x4e,0x7c,0xda,0x38,0xcf,0x49,0x98,0x72,
 643 0xa3,0x02,0x03,0x01,0x00,0x01,0xa3,0x13,0x30,0x11,0x30,0x0f,0x06,0x03,0x55,
 644 0x1d,0x13,0x01,0x01,0xff,0x04,0x05,0x30,0x03,0x01,0x01,0xff,0x30,0x0d,0x06,
 645 0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x05,0x00,0x03,0x81,0x81,
 646 0x00,0x08,0x71,0x6d,0x6c,0xbf,0xf1,0x0f,0xe9,0x5b,0x9f,0x9c,0x9d,0xa5,0x07,
 647 0x83,0x28,0xa1,0x05,0x0b,0x92,0x73,0xb9,0x8a,0x99,0xbe,0x1e,0x21,0x53,0x9f,
 648 0xae,0x44,0x7b,0x89,0x09,0x36,0x4a,0xef,0xe7,0x73,0x9f,0x84,0x8d,0x9a,0xec,
 649 0x52,0xcd,0x58,0x14,0x2d,0x22,0x5c,0x03,0x6a,0xb3,0x35,0x40,0x35,0x66,0xba,
 650 0xc5,0xe2,0x32,0x72,0x60,0x52,0x86,0xbc,0x6a,0xc3,0x24,0x05,0x6b,0x02,0xe3,
 651 0x70,0xa3,0xad,0x09,0x88,0x1e,0xd1,0x34,0xca,0x52,0x6a,0x55,0x38,0x88,0x60,
 652 0xfa,0x9a,0x1f,0xe9,0x29,0x47,0x54,0x96,0x53,0x65,0x27,0xb1,0x66,0xd0,0x11,
 653 0x1c,0xf6,0x20,0x07,0xb4,0x66,0x88,0x18,0xdc,0x0c,0x57,0x7e,0x1f,0x8a,0x49,
 654 0x7a,0xe2,0x34,0x52,0x0b,0x46,0x6b,0xfd,0x27 };
 655 /* chain0_0 -> chain 7_1:
 656  * A chain with a bad critical extension.
 657  */
 658 static const BYTE chain7_1[] = {
 659 0x30,0x82,0x01,0x93,0x30,0x81,0xfd,0xa0,0x03,0x02,0x01,0x02,0x02,0x01,0x01,
 660 0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x05,0x00,
 661 0x30,0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,0x43,0x65,
 662 0x72,0x74,0x31,0x30,0x1e,0x17,0x0d,0x30,0x37,0x30,0x31,0x30,0x31,0x30,0x30,
 663 0x30,0x30,0x30,0x30,0x5a,0x17,0x0d,0x30,0x37,0x31,0x32,0x33,0x31,0x32,0x33,
 664 0x35,0x39,0x35,0x39,0x5a,0x30,0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,
 665 0x03,0x13,0x05,0x43,0x65,0x72,0x74,0x32,0x30,0x81,0x9f,0x30,0x0d,0x06,0x09,
 666 0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x01,0x05,0x00,0x03,0x81,0x8d,0x00,
 667 0x30,0x81,0x89,0x02,0x81,0x81,0x00,0xb8,0x52,0xda,0xc5,0x4b,0x3f,0xe5,0x33,
 668 0x0e,0x67,0x5f,0x48,0x21,0xdc,0x7e,0xef,0x37,0x33,0xba,0xff,0xb4,0xc6,0xdc,
 669 0xb6,0x17,0x8e,0x20,0x55,0x07,0x12,0xd2,0x7b,0x3c,0xce,0x30,0xc5,0xa7,0x48,
 670 0x9f,0x6e,0xfe,0xb8,0xbe,0xdb,0x9f,0x9b,0x17,0x60,0x16,0xde,0xc6,0x8b,0x47,
 671 0xd1,0x57,0x71,0x3c,0x93,0xfc,0xbd,0xec,0x44,0x32,0x3b,0xb9,0xcf,0x6b,0x05,
 672 0x72,0xa7,0x87,0x8e,0x7e,0xd4,0x9a,0x87,0x1c,0x2f,0xb7,0x82,0x40,0xfc,0x6a,
 673 0x80,0x83,0x68,0x28,0xce,0x84,0xf4,0x0b,0x2e,0x44,0xcb,0x53,0xac,0x85,0x85,
 674 0xb5,0x46,0x36,0x98,0x3c,0x10,0x02,0xaa,0x02,0xbc,0x8b,0xa2,0x23,0xb2,0xd3,
 675 0x51,0x9a,0x22,0x4a,0xe3,0xaa,0x4e,0x7c,0xda,0x38,0xcf,0x49,0x98,0x72,0xa3,
 676 0x02,0x03,0x01,0x00,0x01,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,
 677 0x01,0x01,0x05,0x05,0x00,0x03,0x81,0x81,0x00,0x9f,0x69,0xfd,0x26,0xd5,0x4b,
 678 0xe0,0xab,0x12,0x21,0xb9,0xfc,0xf7,0xe0,0x0c,0x09,0x94,0xad,0x27,0xd7,0x9d,
 679 0xa3,0xcc,0x46,0x2a,0x25,0x9a,0x24,0xa7,0x31,0x58,0x78,0xf5,0xfc,0x30,0xe1,
 680 0x6d,0xfd,0x59,0xab,0xbe,0x69,0xa0,0xea,0xe3,0x7d,0x7a,0x7b,0xe5,0x85,0xeb,
 681 0x86,0x6a,0x84,0x3c,0x96,0x01,0x1a,0x70,0xa7,0xb8,0xcb,0xf2,0x11,0xe7,0x52,
 682 0x9c,0x58,0x2d,0xac,0x63,0xce,0x72,0x4b,0xad,0x62,0xa8,0x1d,0x75,0x96,0xe2,
 683 0x27,0xf5,0x6f,0xba,0x91,0xf8,0xf1,0xb0,0xbf,0x90,0x24,0x6d,0xba,0x5d,0xd7,
 684 0x39,0x63,0x3b,0x7c,0x04,0x5d,0x89,0x9d,0x1c,0xf2,0xf7,0xcc,0xdf,0x6e,0x8a,
 685 0x43,0xa9,0xdd,0x86,0x05,0xa2,0xf3,0x22,0x2d,0x1e,0x70,0xa1,0x59,0xd7,0xa5,
 686 0x94,0x7d };
 687 /* chain8_0 -> chain8_1 -> chain8_2:
 688  * A chain whose root cert validity time doesn't overlap the end cert's
 689  * validity time.
 690  */
 691 static const BYTE chain8_0[] = {
 692 0x30,0x82,0x01,0x9b,0x30,0x82,0x01,0x08,0xa0,0x03,0x02,0x01,0x02,0x02,0x10,
 693 0xfb,0x25,0xa6,0x55,0x98,0xbc,0xdf,0xb7,0x40,0x86,0x44,0xb9,0x36,0x03,0x82,
 694 0x9b,0x30,0x09,0x06,0x05,0x2b,0x0e,0x03,0x02,0x1d,0x05,0x00,0x30,0x10,0x31,
 695 0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,0x43,0x65,0x72,0x74,0x31,
 696 0x30,0x1e,0x17,0x0d,0x30,0x37,0x30,0x31,0x30,0x31,0x30,0x30,0x30,0x30,0x30,
 697 0x30,0x5a,0x17,0x0d,0x30,0x37,0x30,0x36,0x30,0x31,0x30,0x30,0x30,0x30,0x30,
 698 0x30,0x5a,0x30,0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,
 699 0x43,0x65,0x72,0x74,0x31,0x30,0x81,0x9f,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,
 700 0x86,0xf7,0x0d,0x01,0x01,0x01,0x05,0x00,0x03,0x81,0x8d,0x00,0x30,0x81,0x89,
 701 0x02,0x81,0x81,0x00,0xad,0x7e,0xca,0xf3,0xe5,0x99,0xc2,0x2a,0xca,0x50,0x82,
 702 0x7c,0x2d,0xa4,0x81,0xcd,0x0d,0x0d,0x86,0xd7,0xd8,0xb2,0xde,0xc5,0xc3,0x34,
 703 0x9e,0x07,0x78,0x08,0x11,0x12,0x2d,0x21,0x0a,0x09,0x07,0x14,0x03,0x7a,0xe7,
 704 0x3b,0x58,0xf1,0xde,0x3e,0x01,0x25,0x93,0xab,0x8f,0xce,0x1f,0xc1,0x33,0x91,
 705 0xfe,0x59,0xb9,0x3b,0x9e,0x95,0x12,0x89,0x8e,0xc3,0x4b,0x98,0x1b,0x99,0xc5,
 706 0x07,0xe2,0xdf,0x15,0x4c,0x39,0x76,0x06,0xad,0xdb,0x16,0x06,0x49,0xba,0xcd,
 707 0x0f,0x07,0xd6,0xea,0x27,0xa6,0xfe,0x3d,0x88,0xe5,0x97,0x45,0x72,0xb6,0x1c,
 708 0xc0,0x1c,0xb1,0xa2,0x89,0xe8,0x37,0x9e,0xf6,0x2a,0xcf,0xd5,0x1f,0x2f,0x35,
 709 0x5e,0x8f,0x3a,0x9c,0x61,0xb1,0xf1,0x6c,0xff,0x8c,0xb2,0x2f,0x02,0x03,0x01,
 710 0x00,0x01,0x30,0x09,0x06,0x05,0x2b,0x0e,0x03,0x02,0x1d,0x05,0x00,0x03,0x81,
 711 0x81,0x00,0x17,0xdf,0x1d,0x1d,0xa3,0x3b,0x0c,0x26,0x3e,0xc7,0x6c,0x8c,0xbd,
 712 0xc7,0x62,0x01,0xba,0xbd,0x2e,0x6a,0x8d,0xe1,0x4e,0x0a,0xc1,0xc1,0x9a,0xb1,
 713 0x43,0x82,0x05,0xb9,0xf8,0x27,0x4d,0x3e,0x8c,0xaa,0xff,0x5c,0x88,0x82,0x3b,
 714 0x09,0xa4,0x23,0x06,0x54,0x16,0xbf,0xc6,0x57,0x6b,0xb1,0x80,0x2c,0xd2,0x7f,
 715 0x28,0xfc,0xb5,0xac,0x5b,0x1f,0x14,0xb9,0xd8,0x49,0x6a,0x0d,0xf1,0x55,0x51,
 716 0xcd,0x0c,0x2b,0x5b,0xfa,0x01,0x08,0x82,0x98,0x6d,0x39,0xde,0x9a,0xb1,0xbf,
 717 0xc5,0xbd,0x05,0xd1,0x64,0x21,0xc4,0x99,0x40,0xdb,0x3e,0xa0,0x8e,0x46,0x80,
 718 0xd0,0x74,0x93,0xbd,0xad,0x81,0xba,0x40,0x8e,0x0a,0x67,0x47,0xc4,0xae,0xd4,
 719 0xca,0xd8,0x3b,0xa4,0xa6,0xbd,0xc8,0xa9,0x67,0xf9 };
 720 static const BYTE chain8_1[] = {
 721 0x30,0x82,0x01,0x93,0x30,0x81,0xfd,0xa0,0x03,0x02,0x01,0x02,0x02,0x01,0x01,
 722 0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x05,0x00,
 723 0x30,0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,0x43,0x65,
 724 0x72,0x74,0x31,0x30,0x1e,0x17,0x0d,0x30,0x37,0x30,0x35,0x30,0x31,0x30,0x30,
 725 0x30,0x30,0x30,0x30,0x5a,0x17,0x0d,0x30,0x37,0x31,0x30,0x30,0x31,0x30,0x30,
 726 0x30,0x30,0x30,0x30,0x5a,0x30,0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,
 727 0x03,0x13,0x05,0x43,0x65,0x72,0x74,0x32,0x30,0x81,0x9f,0x30,0x0d,0x06,0x09,
 728 0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x01,0x05,0x00,0x03,0x81,0x8d,0x00,
 729 0x30,0x81,0x89,0x02,0x81,0x81,0x00,0xb8,0x52,0xda,0xc5,0x4b,0x3f,0xe5,0x33,
 730 0x0e,0x67,0x5f,0x48,0x21,0xdc,0x7e,0xef,0x37,0x33,0xba,0xff,0xb4,0xc6,0xdc,
 731 0xb6,0x17,0x8e,0x20,0x55,0x07,0x12,0xd2,0x7b,0x3c,0xce,0x30,0xc5,0xa7,0x48,
 732 0x9f,0x6e,0xfe,0xb8,0xbe,0xdb,0x9f,0x9b,0x17,0x60,0x16,0xde,0xc6,0x8b,0x47,
 733 0xd1,0x57,0x71,0x3c,0x93,0xfc,0xbd,0xec,0x44,0x32,0x3b,0xb9,0xcf,0x6b,0x05,
 734 0x72,0xa7,0x87,0x8e,0x7e,0xd4,0x9a,0x87,0x1c,0x2f,0xb7,0x82,0x40,0xfc,0x6a,
 735 0x80,0x83,0x68,0x28,0xce,0x84,0xf4,0x0b,0x2e,0x44,0xcb,0x53,0xac,0x85,0x85,
 736 0xb5,0x46,0x36,0x98,0x3c,0x10,0x02,0xaa,0x02,0xbc,0x8b,0xa2,0x23,0xb2,0xd3,
 737 0x51,0x9a,0x22,0x4a,0xe3,0xaa,0x4e,0x7c,0xda,0x38,0xcf,0x49,0x98,0x72,0xa3,
 738 0x02,0x03,0x01,0x00,0x01,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,
 739 0x01,0x01,0x05,0x05,0x00,0x03,0x81,0x81,0x00,0x22,0xf1,0x66,0x00,0x79,0xd2,
 740 0xe6,0xb2,0xb2,0xf7,0x2f,0x98,0x92,0x7d,0x73,0xc3,0x6c,0x5c,0x77,0x20,0xe3,
 741 0xbf,0x3e,0xe0,0xb3,0x5c,0x68,0xb4,0x9b,0x3a,0x41,0xae,0x94,0xa0,0x80,0x3a,
 742 0xfe,0x5d,0x7a,0x56,0x87,0x85,0x44,0x45,0xcf,0xa6,0xd3,0x10,0xe7,0x73,0x41,
 743 0xf2,0x7f,0x88,0x85,0x91,0x8e,0xe6,0xec,0xe2,0xce,0x08,0xbc,0xa5,0x76,0xe5,
 744 0x4d,0x1d,0xb7,0x70,0x31,0xdd,0xc9,0x9a,0x15,0x32,0x11,0x5a,0x4e,0x62,0xc8,
 745 0xd1,0xf8,0xec,0x46,0x39,0x5b,0xe7,0x67,0x1f,0x58,0xe8,0xa1,0xa0,0x5b,0xf7,
 746 0x8a,0x6d,0x5f,0x91,0x18,0xd4,0x90,0x85,0xff,0x30,0xc7,0xca,0x9c,0xc6,0x92,
 747 0xb0,0xca,0x16,0xc4,0xa4,0xc0,0xd6,0xe8,0xff,0x15,0x19,0xd1,0x30,0x61,0xf3,
 748 0xef,0x9f };
 749 static const BYTE chain8_2[] = {
 750 0x30,0x82,0x01,0x93,0x30,0x81,0xfd,0xa0,0x03,0x02,0x01,0x02,0x02,0x01,0x01,
 751 0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x05,0x00,
 752 0x30,0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,0x43,0x65,
 753 0x72,0x74,0x32,0x30,0x1e,0x17,0x0d,0x30,0x37,0x30,0x39,0x30,0x31,0x30,0x30,
 754 0x30,0x30,0x30,0x30,0x5a,0x17,0x0d,0x30,0x37,0x31,0x32,0x33,0x31,0x32,0x33,
 755 0x35,0x39,0x35,0x39,0x5a,0x30,0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,
 756 0x03,0x13,0x05,0x43,0x65,0x72,0x74,0x33,0x30,0x81,0x9f,0x30,0x0d,0x06,0x09,
 757 0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x01,0x05,0x00,0x03,0x81,0x8d,0x00,
 758 0x30,0x81,0x89,0x02,0x81,0x81,0x00,0xc3,0x31,0x35,0xc3,0x9d,0x8a,0x87,0x20,
 759 0xc6,0x32,0xe9,0xb1,0xf6,0x8f,0xf9,0x05,0x73,0x1d,0xa7,0xde,0xab,0x15,0x8a,
 760 0x9c,0x7f,0x11,0x7e,0x77,0xa0,0x42,0x80,0xf4,0x79,0xda,0x98,0x7b,0x00,0xfa,
 761 0x8f,0x0c,0xd0,0xeb,0x8a,0x80,0xed,0x07,0xfc,0x64,0x71,0x03,0xc1,0xd6,0x2f,
 762 0x9b,0xde,0x42,0x63,0xd9,0x79,0xea,0xdd,0x10,0xe8,0x68,0xc8,0x69,0x4f,0x4a,
 763 0x39,0x23,0x87,0xca,0xd1,0xc9,0x77,0x14,0x30,0x85,0x9e,0xf7,0x79,0xf9,0x07,
 764 0xb7,0x7c,0x55,0xcb,0xa7,0xd5,0xb8,0x44,0xb5,0x20,0xb5,0x01,0x5c,0xa2,0xd1,
 765 0xd5,0xad,0x0f,0x87,0xaf,0x37,0xd1,0x39,0x0c,0x0d,0xd5,0xde,0x26,0x7a,0xed,
 766 0xf9,0x2a,0xb1,0x60,0x65,0x2d,0x08,0x24,0x51,0x1d,0xb0,0x0a,0xb5,0x13,0xc7,
 767 0x02,0x03,0x01,0x00,0x01,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,
 768 0x01,0x01,0x05,0x05,0x00,0x03,0x81,0x81,0x00,0x33,0x95,0x73,0x7c,0x7c,0xb0,
 769 0xbb,0x2b,0xe0,0xc4,0x12,0xf0,0x26,0x85,0x97,0x0c,0x81,0xde,0xc5,0x52,0x04,
 770 0xcb,0xee,0x11,0x9a,0x2e,0xa2,0xc4,0x76,0xd5,0x57,0xd1,0x2f,0x2d,0x6f,0x42,
 771 0xbf,0x23,0x85,0x59,0x5c,0x96,0x8d,0xef,0xbc,0xb6,0xf5,0xd3,0x66,0x99,0x54,
 772 0x95,0x09,0x28,0x0b,0x4f,0x05,0x5f,0x61,0x20,0xa8,0x0d,0x46,0x9a,0xab,0x29,
 773 0x97,0x6b,0xa3,0xcd,0xd7,0x5a,0xda,0xaa,0x8e,0xad,0x5a,0x66,0x58,0xf6,0x63,
 774 0x76,0x10,0xdc,0xb0,0xee,0x3f,0x82,0x6d,0x29,0xb9,0xcb,0x99,0x15,0xbb,0xb9,
 775 0x74,0x73,0x00,0x14,0x74,0x79,0xad,0x89,0x73,0xaa,0xa2,0x0e,0x52,0xe8,0x28,
 776 0x69,0xe6,0x8c,0x1e,0xce,0x3a,0x6d,0x85,0x33,0x1e,0x21,0xa3,0x42,0x61,0x3a,
 777 0xeb,0x25 };
 778 /* chain9_0 -> chain7_1:
 779  * A cyclic chain.
 780  */
 781 static const BYTE chain9_0[] = {
 782 0x30,0x82,0x01,0x93,0x30,0x81,0xfd,0xa0,0x03,0x02,0x01,0x02,0x02,0x01,0x01,
 783 0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x05,0x00,
 784 0x30,0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,0x43,0x65,
 785 0x72,0x74,0x32,0x30,0x1e,0x17,0x0d,0x30,0x37,0x30,0x31,0x30,0x31,0x30,0x30,
 786 0x30,0x30,0x30,0x30,0x5a,0x17,0x0d,0x30,0x37,0x31,0x32,0x33,0x31,0x32,0x33,
 787 0x35,0x39,0x35,0x39,0x5a,0x30,0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,
 788 0x03,0x13,0x05,0x43,0x65,0x72,0x74,0x31,0x30,0x81,0x9f,0x30,0x0d,0x06,0x09,
 789 0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x01,0x05,0x00,0x03,0x81,0x8d,0x00,
 790 0x30,0x81,0x89,0x02,0x81,0x81,0x00,0xad,0x7e,0xca,0xf3,0xe5,0x99,0xc2,0x2a,
 791 0xca,0x50,0x82,0x7c,0x2d,0xa4,0x81,0xcd,0x0d,0x0d,0x86,0xd7,0xd8,0xb2,0xde,
 792 0xc5,0xc3,0x34,0x9e,0x07,0x78,0x08,0x11,0x12,0x2d,0x21,0x0a,0x09,0x07,0x14,
 793 0x03,0x7a,0xe7,0x3b,0x58,0xf1,0xde,0x3e,0x01,0x25,0x93,0xab,0x8f,0xce,0x1f,
 794 0xc1,0x33,0x91,0xfe,0x59,0xb9,0x3b,0x9e,0x95,0x12,0x89,0x8e,0xc3,0x4b,0x98,
 795 0x1b,0x99,0xc5,0x07,0xe2,0xdf,0x15,0x4c,0x39,0x76,0x06,0xad,0xdb,0x16,0x06,
 796 0x49,0xba,0xcd,0x0f,0x07,0xd6,0xea,0x27,0xa6,0xfe,0x3d,0x88,0xe5,0x97,0x45,
 797 0x72,0xb6,0x1c,0xc0,0x1c,0xb1,0xa2,0x89,0xe8,0x37,0x9e,0xf6,0x2a,0xcf,0xd5,
 798 0x1f,0x2f,0x35,0x5e,0x8f,0x3a,0x9c,0x61,0xb1,0xf1,0x6c,0xff,0x8c,0xb2,0x2f,
 799 0x02,0x03,0x01,0x00,0x01,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,
 800 0x01,0x01,0x05,0x05,0x00,0x03,0x81,0x81,0x00,0x2c,0xf5,0x25,0xaa,0xb4,0x63,
 801 0x5a,0x5d,0xae,0x7b,0x42,0x79,0xbc,0x41,0x2f,0x8a,0x2a,0x70,0x9f,0x8e,0xb2,
 802 0x14,0x1b,0x6f,0xb2,0xf3,0x3e,0xab,0x06,0x9c,0xa8,0x92,0x43,0xc4,0x57,0x63,
 803 0xa4,0xee,0x83,0x04,0xab,0xa5,0x2c,0xd9,0x90,0xed,0xc9,0x4d,0xa8,0x7b,0xca,
 804 0x3b,0x5f,0xdf,0x46,0xe1,0x3b,0x7f,0x72,0xb7,0x92,0x82,0xe6,0x05,0xc3,0x64,
 805 0x38,0xfb,0x86,0x13,0xeb,0x19,0xb6,0x16,0x82,0x63,0x84,0x13,0x04,0x38,0x51,
 806 0x4c,0x89,0x12,0xf1,0x13,0x46,0x75,0x4e,0x99,0x46,0xcb,0xc6,0x76,0x9f,0x97,
 807 0x9c,0xda,0x63,0x01,0x6a,0x71,0x68,0xc4,0x21,0x67,0xa6,0x51,0x19,0x5e,0xc7,
 808 0x8c,0x8d,0x63,0x5c,0xbe,0x04,0x8f,0xad,0xea,0xa5,0xcd,0xc3,0xd6,0x6b,0xc7,
 809 0xb5,0x56 };
 810 /* chain0_0 -+
 811  *            +-> chain7_1
 812  * chain10_1 -+
 813  * A chain with two issuers, only one of whose dates is valid.
 814  */
 815 static const BYTE chain10_1[] = {
 816 0x30,0x82,0x01,0x9b,0x30,0x82,0x01,0x08,0xa0,0x03,0x02,0x01,0x02,0x02,0x10,
 817 0xbf,0x99,0x4f,0x14,0x03,0x77,0x44,0xb8,0x49,0x02,0x70,0xa1,0xb8,0x9c,0xa7,
 818 0x24,0x30,0x09,0x06,0x05,0x2b,0x0e,0x03,0x02,0x1d,0x05,0x00,0x30,0x10,0x31,
 819 0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,0x43,0x65,0x72,0x74,0x31,
 820 0x30,0x1e,0x17,0x0d,0x30,0x37,0x30,0x31,0x30,0x31,0x30,0x30,0x30,0x30,0x30,
 821 0x30,0x5a,0x17,0x0d,0x30,0x37,0x31,0x32,0x33,0x31,0x32,0x33,0x35,0x39,0x35,
 822 0x39,0x5a,0x30,0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,
 823 0x43,0x65,0x72,0x74,0x31,0x30,0x81,0x9f,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,
 824 0x86,0xf7,0x0d,0x01,0x01,0x01,0x05,0x00,0x03,0x81,0x8d,0x00,0x30,0x81,0x89,
 825 0x02,0x81,0x81,0x00,0xad,0x7e,0xca,0xf3,0xe5,0x99,0xc2,0x2a,0xca,0x50,0x82,
 826 0x7c,0x2d,0xa4,0x81,0xcd,0x0d,0x0d,0x86,0xd7,0xd8,0xb2,0xde,0xc5,0xc3,0x34,
 827 0x9e,0x07,0x78,0x08,0x11,0x12,0x2d,0x21,0x0a,0x09,0x07,0x14,0x03,0x7a,0xe7,
 828 0x3b,0x58,0xf1,0xde,0x3e,0x01,0x25,0x93,0xab,0x8f,0xce,0x1f,0xc1,0x33,0x91,
 829 0xfe,0x59,0xb9,0x3b,0x9e,0x95,0x12,0x89,0x8e,0xc3,0x4b,0x98,0x1b,0x99,0xc5,
 830 0x07,0xe2,0xdf,0x15,0x4c,0x39,0x76,0x06,0xad,0xdb,0x16,0x06,0x49,0xba,0xcd,
 831 0x0f,0x07,0xd6,0xea,0x27,0xa6,0xfe,0x3d,0x88,0xe5,0x97,0x45,0x72,0xb6,0x1c,
 832 0xc0,0x1c,0xb1,0xa2,0x89,0xe8,0x37,0x9e,0xf6,0x2a,0xcf,0xd5,0x1f,0x2f,0x35,
 833 0x5e,0x8f,0x3a,0x9c,0x61,0xb1,0xf1,0x6c,0xff,0x8c,0xb2,0x2f,0x02,0x03,0x01,
 834 0x00,0x01,0x30,0x09,0x06,0x05,0x2b,0x0e,0x03,0x02,0x1d,0x05,0x00,0x03,0x81,
 835 0x81,0x00,0xa8,0xec,0x8c,0x34,0xe7,0x2c,0xdf,0x75,0x87,0xc4,0xf7,0xda,0x71,
 836 0x72,0x29,0xb2,0x48,0xa8,0x2a,0xec,0x7b,0x7d,0x19,0xb9,0x5f,0x1d,0xd9,0x91,
 837 0x2b,0xc4,0x28,0x7e,0xd6,0xb5,0x91,0x69,0xa5,0x8a,0x1a,0x1f,0x97,0x98,0x46,
 838 0x9d,0xdf,0x12,0xf6,0x45,0x62,0xad,0x60,0xb6,0xba,0xb0,0xfd,0xf5,0x9f,0xc6,
 839 0x98,0x05,0x4f,0x4d,0x48,0xdc,0xee,0x69,0xbe,0xb8,0xc4,0xc4,0xd7,0x1b,0xb1,
 840 0x1f,0x64,0xd6,0x45,0xa7,0xdb,0xb3,0x87,0x63,0x0f,0x54,0xe1,0x3a,0x6b,0x57,
 841 0x36,0xd7,0x68,0x65,0xcf,0xda,0x57,0x8d,0xcd,0x84,0x75,0x47,0x26,0x2c,0xef,
 842 0x1e,0x8f,0xc7,0x3b,0xee,0x5d,0x03,0xa6,0xdf,0x3a,0x20,0xb2,0xcc,0xc9,0x09,
 843 0x2c,0xfe,0x2b,0x79,0xb0,0xca,0x2c,0x9a,0x81,0x6b };
 844 /* chain0_0 -+
 845  *            +-> chain7_1
 846  * chain11_1 -+
 847  * A chain with two issuers, only one of whose public keys matches the
 848  * signature.
 849  */
 850 static const BYTE chain11_1[] = {
 851 0x30,0x82,0x01,0x9b,0x30,0x82,0x01,0x08,0xa0,0x03,0x02,0x01,0x02,0x02,0x10,
 852 0x72,0x41,0xa2,0x53,0xd2,0x33,0x0b,0xac,0x4a,0x30,0xfe,0x0a,0xe0,0x2e,0xd4,
 853 0x03,0x30,0x09,0x06,0x05,0x2b,0x0e,0x03,0x02,0x1d,0x05,0x00,0x30,0x10,0x31,
 854 0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,0x43,0x65,0x72,0x74,0x31,
 855 0x30,0x1e,0x17,0x0d,0x30,0x37,0x30,0x31,0x30,0x31,0x30,0x30,0x30,0x30,0x30,
 856 0x30,0x5a,0x17,0x0d,0x30,0x37,0x31,0x32,0x33,0x31,0x32,0x33,0x35,0x39,0x35,
 857 0x39,0x5a,0x30,0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,
 858 0x43,0x65,0x72,0x74,0x31,0x30,0x81,0x9f,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,
 859 0x86,0xf7,0x0d,0x01,0x01,0x01,0x05,0x00,0x03,0x81,0x8d,0x00,0x30,0x81,0x89,
 860 0x02,0x81,0x81,0x00,0xc3,0x31,0x35,0xc3,0x9d,0x8a,0x87,0x20,0xc6,0x32,0xe9,
 861 0xb1,0xf6,0x8f,0xf9,0x05,0x73,0x1d,0xa7,0xde,0xab,0x15,0x8a,0x9c,0x7f,0x11,
 862 0x7e,0x77,0xa0,0x42,0x80,0xf4,0x79,0xda,0x98,0x7b,0x00,0xfa,0x8f,0x0c,0xd0,
 863 0xeb,0x8a,0x80,0xed,0x07,0xfc,0x64,0x71,0x03,0xc1,0xd6,0x2f,0x9b,0xde,0x42,
 864 0x63,0xd9,0x79,0xea,0xdd,0x10,0xe8,0x68,0xc8,0x69,0x4f,0x4a,0x39,0x23,0x87,
 865 0xca,0xd1,0xc9,0x77,0x14,0x30,0x85,0x9e,0xf7,0x79,0xf9,0x07,0xb7,0x7c,0x55,
 866 0xcb,0xa7,0xd5,0xb8,0x44,0xb5,0x20,0xb5,0x01,0x5c,0xa2,0xd1,0xd5,0xad,0x0f,
 867 0x87,0xaf,0x37,0xd1,0x39,0x0c,0x0d,0xd5,0xde,0x26,0x7a,0xed,0xf9,0x2a,0xb1,
 868 0x60,0x65,0x2d,0x08,0x24,0x51,0x1d,0xb0,0x0a,0xb5,0x13,0xc7,0x02,0x03,0x01,
 869 0x00,0x01,0x30,0x09,0x06,0x05,0x2b,0x0e,0x03,0x02,0x1d,0x05,0x00,0x03,0x81,
 870 0x81,0x00,0x51,0x17,0xfb,0x2a,0x69,0x31,0x36,0xa7,0x37,0x2c,0x1f,0x38,0xee,
 871 0xe3,0xf1,0xae,0x63,0x61,0xac,0x63,0x13,0xc2,0x3b,0x29,0xca,0xb1,0x8e,0x27,
 872 0x41,0xfa,0xb3,0x7d,0x42,0xbe,0xf0,0x9c,0xe0,0xc7,0x69,0xba,0x80,0xf4,0x87,
 873 0x7c,0x6f,0x77,0x70,0x6b,0x77,0x7d,0x5c,0x58,0x95,0x07,0xbd,0xac,0xe2,0x5d,
 874 0x65,0x12,0xb0,0xae,0xf4,0x01,0x14,0x01,0xba,0xf9,0xa0,0x32,0x10,0xea,0x09,
 875 0x12,0xcf,0xf1,0xbc,0x37,0xc9,0x42,0xc3,0x8c,0x9e,0xa2,0xc3,0x5e,0x2e,0x56,
 876 0xe9,0xa7,0xd8,0x1c,0x1c,0x8c,0x1c,0x2f,0xd8,0xfb,0x67,0x44,0xd4,0xa3,0x79,
 877 0x6d,0x53,0x17,0x56,0x3c,0x3e,0xd0,0x67,0x36,0x0c,0x8b,0x77,0xab,0x40,0xc7,
 878 0x27,0xd9,0x44,0x69,0x13,0xeb,0x09,0xec,0x06,0xe2 };
 879 /* chain12_0 -> chain7_1:
 880  * A chain whose root has an invalid signature.
 881  */
 882 static const BYTE chain12_0[] = {
 883 0x30,0x82,0x01,0x9b,0x30,0x82,0x01,0x08,0xa0,0x03,0x02,0x01,0x02,0x02,0x10,
 884 0x2f,0x67,0x04,0x50,0xe4,0xac,0x81,0x81,0x44,0x25,0x25,0x81,0xbe,0x8a,0x6c,
 885 0x3c,0x30,0x09,0x06,0x05,0x2b,0x0e,0x03,0x02,0x1d,0x05,0x00,0x30,0x10,0x31,
 886 0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,0x43,0x65,0x72,0x74,0x31,
 887 0x30,0x1e,0x17,0x0d,0x30,0x37,0x30,0x31,0x30,0x31,0x30,0x30,0x30,0x30,0x30,
 888 0x30,0x5a,0x17,0x0d,0x30,0x37,0x31,0x32,0x33,0x31,0x32,0x33,0x35,0x39,0x35,
 889 0x39,0x5a,0x30,0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,
 890 0x43,0x65,0x72,0x74,0x31,0x30,0x81,0x9f,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,
 891 0x86,0xf7,0x0d,0x01,0x01,0x01,0x05,0x00,0x03,0x81,0x8d,0x00,0x30,0x81,0x89,
 892 0x02,0x81,0x81,0x00,0xad,0x7e,0xca,0xf3,0xe5,0x99,0xc2,0x2a,0xca,0x50,0x82,
 893 0x7c,0x2d,0xa4,0x81,0xcd,0x0d,0x0d,0x86,0xd7,0xd8,0xb2,0xde,0xc5,0xc3,0x34,
 894 0x9e,0x07,0x78,0x08,0x11,0x12,0x2d,0x21,0x0a,0x09,0x07,0x14,0x03,0x7a,0xe7,
 895 0x3b,0x58,0xf1,0xde,0x3e,0x01,0x25,0x93,0xab,0x8f,0xce,0x1f,0xc1,0x33,0x91,
 896 0xfe,0x59,0xb9,0x3b,0x9e,0x95,0x12,0x89,0x8e,0xc3,0x4b,0x98,0x1b,0x99,0xc5,
 897 0x07,0xe2,0xdf,0x15,0x4c,0x39,0x76,0x06,0xad,0xdb,0x16,0x06,0x49,0xba,0xcd,
 898 0x0f,0x07,0xd6,0xea,0x27,0xa6,0xfe,0x3d,0x88,0xe5,0x97,0x45,0x72,0xb6,0x1c,
 899 0xc0,0x1c,0xb1,0xa2,0x89,0xe8,0x37,0x9e,0xf6,0x2a,0xcf,0xd5,0x1f,0x2f,0x35,
 900 0x5e,0x8f,0x3a,0x9c,0x61,0xb1,0xf1,0x6c,0xff,0x8c,0xb2,0x2f,0x02,0x03,0x01,
 901 0x00,0x01,0x30,0x09,0x06,0x05,0x2b,0x0e,0x03,0x02,0x1d,0x05,0x00,0x03,0x81,
 902 0x81,0x00,0x82,0xa8,0x28,0x6e,0x85,0xbb,0xa4,0xac,0xf4,0xe3,0xbc,0xe5,0x08,
 903 0x76,0x8a,0x1b,0x51,0xea,0xca,0x49,0x46,0x70,0x75,0x38,0x70,0x71,0xa1,0x1c,
 904 0x67,0x77,0x70,0x7d,0xdf,0xd0,0xc6,0xa4,0xfc,0x30,0x22,0x2f,0x52,0x56,0x16,
 905 0xe7,0xe2,0x7e,0x6a,0xcf,0x24,0x0b,0xe2,0xad,0x94,0x52,0x2c,0xcc,0x56,0xd3,
 906 0x2e,0xe2,0xd3,0x3d,0x2f,0xdb,0x22,0xb2,0xff,0xf3,0x20,0xc1,0x62,0xc2,0x3c,
 907 0x24,0x48,0x19,0x13,0x2c,0x8a,0x80,0xcd,0xb5,0xe1,0x84,0xc2,0xee,0x14,0xfe,
 908 0x59,0xe6,0xed,0x7b,0x8b,0xec,0xcc,0x27,0x56,0xa1,0x0e,0x73,0xe7,0x37,0x20,
 909 0x97,0x27,0x12,0xed,0x9f,0xe9,0xec,0x44,0xde,0x3f,0x07,0xa4,0x07,0x42,0x5b,
 910 0x7e,0xe5,0xe1,0x42,0x10,0x4c,0x38,0xd7,0x2b,0xff };
 911 /* chain0_0 -> chain13_1:
 912  * A chain whose time validity nesting is invalid.
 913  */
 914 static const BYTE chain13_1[] = {
 915 0x30,0x82,0x01,0x93,0x30,0x81,0xfd,0xa0,0x03,0x02,0x01,0x02,0x02,0x01,0x01,
 916 0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x05,0x00,
 917 0x30,0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,0x03,0x13,0x05,0x43,0x65,
 918 0x72,0x74,0x31,0x30,0x1e,0x17,0x0d,0x30,0x36,0x30,0x31,0x30,0x31,0x30,0x30,
 919 0x30,0x30,0x30,0x30,0x5a,0x17,0x0d,0x30,0x37,0x31,0x32,0x33,0x31,0x32,0x33,
 920 0x35,0x39,0x35,0x39,0x5a,0x30,0x10,0x31,0x0e,0x30,0x0c,0x06,0x03,0x55,0x04,
 921 0x03,0x13,0x05,0x43,0x65,0x72,0x74,0x32,0x30,0x81,0x9f,0x30,0x0d,0x06,0x09,
 922 0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x01,0x05,0x00,0x03,0x81,0x8d,0x00,
 923 0x30,0x81,0x89,0x02,0x81,0x81,0x00,0xb8,0x52,0xda,0xc5,0x4b,0x3f,0xe5,0x33,
 924 0x0e,0x67,0x5f,0x48,0x21,0xdc,0x7e,0xef,0x37,0x33,0xba,0xff,0xb4,0xc6,0xdc,
 925 0xb6,0x17,0x8e,0x20,0x55,0x07,0x12,0xd2,0x7b,0x3c,0xce,0x30,0xc5,0xa7,0x48,
 926 0x9f,0x6e,0xfe,0xb8,0xbe,0xdb,0x9f,0x9b,0x17,0x60,0x16,0xde,0xc6,0x8b,0x47,
 927 0xd1,0x57,0x71,0x3c,0x93,0xfc,0xbd,0xec,0x44,0x32,0x3b,0xb9,0xcf,0x6b,0x05,
 928 0x72,0xa7,0x87,0x8e,0x7e,0xd4,0x9a,0x87,0x1c,0x2f,0xb7,0x82,0x40,0xfc,0x6a,
 929 0x80,0x83,0x68,0x28,0xce,0x84,0xf4,0x0b,0x2e,0x44,0xcb,0x53,0xac,0x85,0x85,
 930 0xb5,0x46,0x36,0x98,0x3c,0x10,0x02,0xaa,0x02,0xbc,0x8b,0xa2,0x23,0xb2,0xd3,
 931 0x51,0x9a,0x22,0x4a,0xe3,0xaa,0x4e,0x7c,0xda,0x38,0xcf,0x49,0x98,0x72,0xa3,
 932 0x02,0x03,0x01,0x00,0x01,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,
 933 0x01,0x01,0x05,0x05,0x00,0x03,0x81,0x81,0x00,0x85,0xc9,0xc5,0x08,0x0b,0xb1,
 934 0xff,0x58,0x8f,0xee,0x66,0x5f,0xa3,0x77,0x63,0x9f,0xd1,0x53,0x03,0xdc,0xf6,
 935 0x59,0x08,0x02,0x1f,0xdc,0x52,0x5a,0x52,0x38,0xa4,0x0b,0x83,0x12,0x19,0xd6,
 936 0xb5,0xb8,0x81,0x17,0xcd,0x10,0x5d,0x96,0x16,0x9d,0x51,0x5b,0xf9,0x31,0x3e,
 937 0x36,0xac,0x30,0xd5,0xd6,0xa0,0x30,0x5c,0x9c,0xcb,0xe1,0x02,0xfd,0x73,0xc3,
 938 0xa1,0x58,0xfe,0x12,0xb0,0xa6,0xbd,0x11,0x86,0xdb,0x20,0x17,0x29,0x1e,0x09,
 939 0x63,0x4d,0x28,0xe4,0x55,0x2d,0xa1,0x78,0xde,0x28,0x0b,0x1b,0x35,0x40,0x4c,
 940 0xf1,0xb0,0x6e,0x82,0x34,0x2b,0x7f,0x3b,0x2e,0x27,0x6b,0xf7,0xde,0x73,0x9a,
 941 0x98,0xac,0x79,0x33,0x1a,0xdd,0x03,0x95,0x60,0x8a,0x08,0xba,0xcb,0x8a,0xbf,
 942 0xea,0xe3 };
 943
 944 typedef struct _CONST_DATA_BLOB
 945 {
 946     DWORD       cbData;
 947     const BYTE *pbData;
 948 } CONST_DATA_BLOB;
 949
 950 typedef struct _CONST_BLOB_ARRAY
 951 {
 952     DWORD cBlob;
 953     CONST_DATA_BLOB *rgBlob;
 954 } CONST_BLOB_ARRAY;
 955
 956 #define TODO_CHAIN    1
 957 #define TODO_ERROR    2
 958 #define TODO_INFO     4
 959 #define TODO_ELEMENTS 8
 960 #define TODO_CHAINS   16
 961 #define TODO_POLICY   32
 962
 963 /* Gets a certificate chain built from a store containing all the certs in
 964  * certArray, where the last certificate in the chain is expected to be the
 965  * end certificate (the one from which the chain is built.)
 966  */
 967 static PCCERT_CHAIN_CONTEXT getChain(const CONST_BLOB_ARRAY *certArray,
 968  DWORD flags, BOOL includeStore, LPSYSTEMTIME checkTime, DWORD todo,
 969  DWORD testIndex)
 970 {
 971     HCERTSTORE store;
 972     PCCERT_CHAIN_CONTEXT chain = NULL;
 973
 974     store = CertOpenStore(CERT_STORE_PROV_MEMORY, 0, 0,
 975      CERT_STORE_CREATE_NEW_FLAG, NULL);
 976     if (store)
 977     {
 978         BOOL ret;
 979         PCCERT_CONTEXT endCert;
 980
 981         if (certArray->cBlob > 1)
 982         {
 983             DWORD i;
 984
 985             for (i = 0, ret = TRUE; ret && i < certArray->cBlob - 1; i++)
 986             {
 987                 ret = CertAddEncodedCertificateToStore(store,
 988                  X509_ASN_ENCODING, certArray->rgBlob[i].pbData,
 989                  certArray->rgBlob[i].cbData, CERT_STORE_ADD_ALWAYS, NULL);
 990                 ok(ret, "Chain %d: adding cert %d failed: %08x\n",
 991                  testIndex, i, GetLastError());
 992             }
 993         }
 994         ret = CertAddEncodedCertificateToStore(store,
 995          X509_ASN_ENCODING, certArray->rgBlob[certArray->cBlob - 1].pbData,
 996          certArray->rgBlob[certArray->cBlob - 1].cbData, CERT_STORE_ADD_ALWAYS,
 997          &endCert);
 998         ok(ret, "Chain %d: adding end cert failed: %08x\n",
 999          testIndex, GetLastError());
1000         if (ret)
1001         {
1002             /* FIXME: allow caller to specify usage matches? */
1003             CERT_CHAIN_PARA chainPara = { sizeof(chainPara), { 0 } };
1004             FILETIME fileTime;
1005
1006             SystemTimeToFileTime(checkTime, &fileTime);
1007             ret = pCertGetCertificateChain(NULL, endCert, &fileTime,
1008              includeStore ? store : NULL, &chainPara, flags, NULL, &chain);
1009             if (todo & TODO_CHAIN)
1010                 todo_wine ok(ret, "Chain %d: CertGetCertificateChain failed: %08x\n",
1011                  testIndex, GetLastError());
1012             else
1013                 ok(ret, "Chain %d: CertGetCertificateChain failed: %08x\n",
1014                  testIndex, GetLastError());
1015             CertFreeCertificateContext(endCert);
1016         }
1017         CertCloseStore(store, 0);
1018     }
1019     return chain;
1020 }
1021
1022 typedef struct _SimpleChainStatusCheck
1023 {
1024     DWORD                    cElement;
1025     const CERT_TRUST_STATUS *rgElementStatus;
1026 } SimpleChainStatusCheck;
1027
1028 static void checkElementStatus(const CERT_TRUST_STATUS *expected,
1029  const CERT_TRUST_STATUS *got, const CERT_TRUST_STATUS *ignore,
1030  DWORD todo, DWORD testIndex, DWORD chainIndex, DWORD elementIndex)
1031 {
1032     if (got->dwErrorStatus == expected->dwErrorStatus)
1033         ok(got->dwErrorStatus == expected->dwErrorStatus,
1034          "Chain %d, element [%d,%d]: expected error %08x, got %08x\n",
1035          testIndex, chainIndex, elementIndex, expected->dwErrorStatus,
1036          got->dwErrorStatus);
1037     else if (todo & TODO_ERROR)
1038         todo_wine
1039         ok(got->dwErrorStatus == expected->dwErrorStatus ||
1040          broken((got->dwErrorStatus & ~ignore->dwErrorStatus) ==
1041          (expected->dwErrorStatus & ~ignore->dwErrorStatus)),
1042          "Chain %d, element [%d,%d]: expected error %08x, got %08x\n",
1043          testIndex, chainIndex, elementIndex, expected->dwErrorStatus,
1044          got->dwErrorStatus);
1045     else
1046         ok(got->dwErrorStatus == expected->dwErrorStatus ||
1047          broken((got->dwErrorStatus & ~ignore->dwErrorStatus) ==
1048          (expected->dwErrorStatus & ~ignore->dwErrorStatus)),
1049          "Chain %d, element [%d,%d]: expected error %08x, got %08x. %08x is "
1050          "expected if no valid Verisign root certificate is available.\n",
1051          testIndex, chainIndex, elementIndex, expected->dwErrorStatus,
1052          got->dwErrorStatus, CERT_TRUST_IS_UNTRUSTED_ROOT);
1053     if (got->dwInfoStatus == expected->dwInfoStatus)
1054         ok(got->dwInfoStatus == expected->dwInfoStatus,
1055          "Chain %d, element [%d,%d]: expected info %08x, got %08x\n",
1056          testIndex, chainIndex, elementIndex, expected->dwInfoStatus,
1057          got->dwInfoStatus);
1058     else if (todo & TODO_INFO)
1059         todo_wine
1060         ok(got->dwInfoStatus == expected->dwInfoStatus ||
1061          broken((got->dwInfoStatus & ~ignore->dwInfoStatus) ==
1062          (expected->dwInfoStatus & ~ignore->dwInfoStatus)),
1063          "Chain %d, element [%d,%d]: expected info %08x, got %08x\n",
1064          testIndex, chainIndex, elementIndex, expected->dwInfoStatus,
1065          got->dwInfoStatus);
1066     else
1067         ok(got->dwInfoStatus == expected->dwInfoStatus ||
1068          broken((got->dwInfoStatus & ~ignore->dwInfoStatus) ==
1069          (expected->dwInfoStatus & ~ignore->dwInfoStatus)),
1070          "Chain %d, element [%d,%d]: expected info %08x, got %08x\n",
1071          testIndex, chainIndex, elementIndex, expected->dwInfoStatus,
1072          got->dwInfoStatus);
1073 }
1074
1075 static void checkSimpleChainStatus(const CERT_SIMPLE_CHAIN *simpleChain,
1076  const SimpleChainStatusCheck *simpleChainStatus,
1077  const CERT_TRUST_STATUS *ignore, DWORD todo, DWORD testIndex, DWORD chainIndex)
1078 {
1079     if (todo & TODO_ELEMENTS)
1080         todo_wine ok(simpleChain->cElement == simpleChainStatus->cElement,
1081          "Chain %d: expected %d elements, got %d\n", testIndex,
1082          simpleChainStatus->cElement, simpleChain->cElement);
1083     else
1084         ok(simpleChain->cElement == simpleChainStatus->cElement,
1085          "Chain %d: expected %d elements, got %d\n", testIndex,
1086          simpleChainStatus->cElement, simpleChain->cElement);
1087     if (simpleChain->cElement == simpleChainStatus->cElement)
1088     {
1089         DWORD i;
1090
1091         for (i = 0; i < simpleChain->cElement; i++)
1092             checkElementStatus(&simpleChainStatus->rgElementStatus[i],
1093              &simpleChain->rgpElement[i]->TrustStatus, ignore, todo, testIndex,
1094              chainIndex, i);
1095     }
1096 }
1097
1098 typedef struct _ChainStatusCheck
1099 {
1100     CERT_TRUST_STATUS             statusToIgnore;
1101     CERT_TRUST_STATUS             status;
1102     DWORD                         cChain;
1103     const SimpleChainStatusCheck *rgChainStatus;
1104 } ChainStatusCheck;
1105
1106 static void checkChainStatus(PCCERT_CHAIN_CONTEXT chain,
1107  const ChainStatusCheck *chainStatus, DWORD todo, DWORD testIndex)
1108 {
1109     ok(chain->cChain == chainStatus->cChain,
1110      "Chain %d: expected %d simple chains, got %d\n", testIndex,
1111      chainStatus->cChain, chain->cChain);
1112     if (todo & TODO_ERROR &&
1113      chain->TrustStatus.dwErrorStatus != chainStatus->status.dwErrorStatus)
1114         todo_wine ok(chain->TrustStatus.dwErrorStatus ==
1115          chainStatus->status.dwErrorStatus ||
1116          broken((chain->TrustStatus.dwErrorStatus &
1117          ~chainStatus->statusToIgnore.dwErrorStatus) ==
1118          (chainStatus->status.dwErrorStatus &
1119          ~chainStatus->statusToIgnore.dwErrorStatus)),
1120          "Chain %d: expected error %08x, got %08x\n",
1121          testIndex, chainStatus->status.dwErrorStatus,
1122          chain->TrustStatus.dwErrorStatus);
1123     else
1124         ok(chain->TrustStatus.dwErrorStatus ==
1125          chainStatus->status.dwErrorStatus ||
1126          broken((chain->TrustStatus.dwErrorStatus &
1127          ~chainStatus->statusToIgnore.dwErrorStatus) ==
1128          (chainStatus->status.dwErrorStatus &
1129          ~chainStatus->statusToIgnore.dwErrorStatus)),
1130          "Chain %d: expected error %08x, got %08x. %08x is expected if no valid "
1131          "Verisign root certificate is available.\n",
1132          testIndex, chainStatus->status.dwErrorStatus,
1133          chain->TrustStatus.dwErrorStatus, CERT_TRUST_IS_UNTRUSTED_ROOT);
1134     if (todo & TODO_INFO &&
1135      chain->TrustStatus.dwInfoStatus != chainStatus->status.dwInfoStatus)
1136         todo_wine ok(chain->TrustStatus.dwInfoStatus ==
1137          chainStatus->status.dwInfoStatus ||
1138          broken((chain->TrustStatus.dwInfoStatus &
1139          ~chainStatus->statusToIgnore.dwInfoStatus) ==
1140          (chainStatus->status.dwInfoStatus &
1141          ~chainStatus->statusToIgnore.dwInfoStatus)),
1142          "Chain %d: expected info %08x, got %08x\n",
1143          testIndex, chainStatus->status.dwInfoStatus,
1144          chain->TrustStatus.dwInfoStatus);
1145     else
1146         ok(chain->TrustStatus.dwInfoStatus ==
1147          chainStatus->status.dwInfoStatus ||
1148          broken((chain->TrustStatus.dwInfoStatus &
1149          ~chainStatus->statusToIgnore.dwInfoStatus) ==
1150          (chainStatus->status.dwInfoStatus &
1151          ~chainStatus->statusToIgnore.dwInfoStatus)),
1152          "Chain %d: expected info %08x, got %08x\n",
1153          testIndex, chainStatus->status.dwInfoStatus,
1154          chain->TrustStatus.dwInfoStatus);
1155     if (chain->cChain == chainStatus->cChain)
1156     {
1157         DWORD i;
1158
1159         for (i = 0; i < chain->cChain; i++)
1160             checkSimpleChainStatus(chain->rgpChain[i],
1161              &chainStatus->rgChainStatus[i], &chainStatus->statusToIgnore,
1162              todo, testIndex, i);
1163     }
1164 }
1165
1166 typedef struct _ChainCheck
1167 {
1168     CONST_BLOB_ARRAY certs;
1169     ChainStatusCheck status;
1170     DWORD            todo;
1171 } ChainCheck;
1172
1173 static CONST_DATA_BLOB chain0[] = {
1174  { sizeof(chain0_0), chain0_0 },
1175  { sizeof(chain0_1), chain0_1 },
1176 };
1177 static const CERT_TRUST_STATUS elementStatus0[] = {
1178  { CERT_TRUST_IS_NOT_TIME_VALID, CERT_TRUST_HAS_NAME_MATCH_ISSUER },
1179  { CERT_TRUST_IS_UNTRUSTED_ROOT,
1180    CERT_TRUST_HAS_NAME_MATCH_ISSUER | CERT_TRUST_IS_SELF_SIGNED },
1181 };
1182 static const SimpleChainStatusCheck simpleStatus0[] = {
1183  { sizeof(elementStatus0) / sizeof(elementStatus0[0]), elementStatus0 },
1184 };
1185 static CONST_DATA_BLOB chain1[] = {
1186  { sizeof(chain0_0), chain0_0 },
1187  { sizeof(chain1_1), chain1_1 },
1188 };
1189 static const CERT_TRUST_STATUS elementStatus1[] = {
1190  { CERT_TRUST_IS_NOT_TIME_VALID | CERT_TRUST_IS_NOT_SIGNATURE_VALID,
1191    CERT_TRUST_HAS_NAME_MATCH_ISSUER },
1192  { CERT_TRUST_IS_UNTRUSTED_ROOT,
1193    CERT_TRUST_HAS_NAME_MATCH_ISSUER | CERT_TRUST_IS_SELF_SIGNED },
1194 };
1195 static const SimpleChainStatusCheck simpleStatus1[] = {
1196  { sizeof(elementStatus1) / sizeof(elementStatus1[0]), elementStatus1 },
1197 };
1198 static CONST_DATA_BLOB chain2[] = {
1199  { sizeof(chain2_0), chain2_0 },
1200  { sizeof(chain0_1), chain0_1 },
1201 };
1202 static const CERT_TRUST_STATUS elementStatus2[] = {
1203  { CERT_TRUST_IS_NOT_TIME_VALID, CERT_TRUST_HAS_NAME_MATCH_ISSUER },
1204  { CERT_TRUST_IS_NOT_TIME_VALID | CERT_TRUST_IS_UNTRUSTED_ROOT,
1205    CERT_TRUST_HAS_NAME_MATCH_ISSUER | CERT_TRUST_IS_SELF_SIGNED },
1206 };
1207 static const SimpleChainStatusCheck simpleStatus2[] = {
1208  { sizeof(elementStatus2) / sizeof(elementStatus2[0]), elementStatus2 },
1209 };
1210 static CONST_DATA_BLOB chain3[] = {
1211  { sizeof(chain3_0), chain3_0 },
1212  { sizeof(chain0_1), chain0_1 },
1213 };
1214 static const CERT_TRUST_STATUS elementStatus3[] = {
1215  { CERT_TRUST_IS_NOT_TIME_VALID, CERT_TRUST_HAS_NAME_MATCH_ISSUER },
1216  { CERT_TRUST_INVALID_BASIC_CONSTRAINTS | CERT_TRUST_IS_UNTRUSTED_ROOT,
1217    CERT_TRUST_HAS_NAME_MATCH_ISSUER | CERT_TRUST_IS_SELF_SIGNED },
1218 };
1219 static const SimpleChainStatusCheck simpleStatus3[] = {
1220  { sizeof(elementStatus3) / sizeof(elementStatus3[0]), elementStatus3 },
1221 };
1222 static CONST_DATA_BLOB chain4[] = {
1223  { sizeof(chain4_0), chain4_0 },
1224  { sizeof(chain0_1), chain0_1 },
1225  { sizeof(chain4_2), chain4_2 },
1226 };
1227 static const CERT_TRUST_STATUS elementStatus4[] = {
1228  { CERT_TRUST_IS_NOT_TIME_VALID, CERT_TRUST_HAS_NAME_MATCH_ISSUER },
1229  { CERT_TRUST_INVALID_BASIC_CONSTRAINTS | CERT_TRUST_IS_NOT_TIME_VALID,
1230    CERT_TRUST_HAS_NAME_MATCH_ISSUER },
1231  { CERT_TRUST_INVALID_BASIC_CONSTRAINTS | CERT_TRUST_IS_UNTRUSTED_ROOT,
1232    CERT_TRUST_HAS_NAME_MATCH_ISSUER | CERT_TRUST_IS_SELF_SIGNED },
1233 };
1234 static const SimpleChainStatusCheck simpleStatus4[] = {
1235  { sizeof(elementStatus4) / sizeof(elementStatus4[0]), elementStatus4 },
1236 };
1237 static CONST_DATA_BLOB chain5[] = {
1238  { sizeof(chain5_0), chain5_0 },
1239  { sizeof(chain5_1), chain5_1 },
1240 };
1241 static const CERT_TRUST_STATUS elementStatus5[] = {
1242  { CERT_TRUST_NO_ERROR, CERT_TRUST_HAS_NAME_MATCH_ISSUER },
1243  { CERT_TRUST_HAS_NOT_PERMITTED_NAME_CONSTRAINT |
1244    CERT_TRUST_IS_UNTRUSTED_ROOT,
1245    CERT_TRUST_HAS_NAME_MATCH_ISSUER | CERT_TRUST_IS_SELF_SIGNED },
1246 };
1247 static const SimpleChainStatusCheck simpleStatus5[] = {
1248  { sizeof(elementStatus5) / sizeof(elementStatus5[0]), elementStatus5 },
1249 };
1250 static CONST_DATA_BLOB chain6[] = {
1251  { sizeof(chain0_0), chain0_0 },
1252  { sizeof(chain6_1), chain6_1 },
1253 };
1254 static const CERT_TRUST_STATUS elementStatus6[] = {
1255  { CERT_TRUST_NO_ERROR, CERT_TRUST_HAS_NAME_MATCH_ISSUER },
1256  { CERT_TRUST_IS_UNTRUSTED_ROOT,
1257    CERT_TRUST_HAS_NAME_MATCH_ISSUER | CERT_TRUST_IS_SELF_SIGNED },
1258 };
1259 static const SimpleChainStatusCheck simpleStatus6[] = {
1260  { sizeof(elementStatus6) / sizeof(elementStatus6[0]), elementStatus6 },
1261 };
1262 static CONST_DATA_BLOB chain7[] = {
1263  { sizeof(chain0_0), chain0_0 },
1264  { sizeof(chain7_1), chain7_1 },
1265 };
1266 static const CERT_TRUST_STATUS elementStatus7[] = {
1267  { CERT_TRUST_NO_ERROR, CERT_TRUST_HAS_NAME_MATCH_ISSUER },
1268  { CERT_TRUST_IS_UNTRUSTED_ROOT,
1269    CERT_TRUST_HAS_NAME_MATCH_ISSUER | CERT_TRUST_IS_SELF_SIGNED },
1270 };
1271 static const SimpleChainStatusCheck simpleStatus7[] = {
1272  { sizeof(elementStatus7) / sizeof(elementStatus7[0]), elementStatus7 },
1273 };
1274 static CONST_DATA_BLOB chain8[] = {
1275  { sizeof(chain8_0), chain8_0 },
1276  { sizeof(chain8_1), chain8_1 },
1277  { sizeof(chain8_2), chain8_2 },
1278 };
1279 static const CERT_TRUST_STATUS elementStatus8[] = {
1280  { CERT_TRUST_NO_ERROR, CERT_TRUST_HAS_NAME_MATCH_ISSUER },
1281  { CERT_TRUST_INVALID_BASIC_CONSTRAINTS, CERT_TRUST_HAS_NAME_MATCH_ISSUER },
1282  { CERT_TRUST_IS_UNTRUSTED_ROOT | CERT_TRUST_IS_NOT_TIME_VALID,
1283    CERT_TRUST_HAS_NAME_MATCH_ISSUER | CERT_TRUST_IS_SELF_SIGNED },
1284 };
1285 static const SimpleChainStatusCheck simpleStatus8[] = {
1286  { sizeof(elementStatus8) / sizeof(elementStatus8[0]), elementStatus8 },
1287 };
1288 static CONST_DATA_BLOB chain9[] = {
1289  { sizeof(chain9_0), chain9_0 },
1290  { sizeof(chain7_1), chain7_1 },
1291 };
1292 static const CERT_TRUST_STATUS elementStatus9[] = {
1293  { CERT_TRUST_NO_ERROR, CERT_TRUST_HAS_NAME_MATCH_ISSUER },
1294  { CERT_TRUST_INVALID_BASIC_CONSTRAINTS, CERT_TRUST_HAS_NAME_MATCH_ISSUER },
1295  { CERT_TRUST_INVALID_BASIC_CONSTRAINTS | CERT_TRUST_IS_CYCLIC,
1296    CERT_TRUST_HAS_NAME_MATCH_ISSUER },
1297 };
1298 static const SimpleChainStatusCheck simpleStatus9[] = {
1299  { sizeof(elementStatus9) / sizeof(elementStatus9[0]), elementStatus9 },
1300 };
1301 static CONST_DATA_BLOB chain10[] = {
1302  { sizeof(chain0_0), chain0_0 },
1303  { sizeof(chain10_1), chain10_1 },
1304  { sizeof(chain7_1), chain7_1 },
1305 };
1306 static const CERT_TRUST_STATUS elementStatus10[] = {
1307  { CERT_TRUST_NO_ERROR, CERT_TRUST_HAS_NAME_MATCH_ISSUER },
1308  { CERT_TRUST_IS_UNTRUSTED_ROOT,
1309    CERT_TRUST_IS_SELF_SIGNED | CERT_TRUST_HAS_NAME_MATCH_ISSUER },
1310 };
1311 static const SimpleChainStatusCheck simpleStatus10[] = {
1312  { sizeof(elementStatus10) / sizeof(elementStatus10[0]), elementStatus10 },
1313 };
1314 static CONST_DATA_BLOB chain11[] = {
1315  { sizeof(chain0_0), chain0_0 },
1316  { sizeof(chain11_1), chain11_1 },
1317  { sizeof(chain7_1), chain7_1 },
1318 };
1319 static CONST_DATA_BLOB chain12[] = {
1320  { sizeof(chain12_0), chain12_0 },
1321  { sizeof(chain7_1), chain7_1 },
1322 };
1323 static const CERT_TRUST_STATUS elementStatus12[] = {
1324  { CERT_TRUST_NO_ERROR, CERT_TRUST_HAS_NAME_MATCH_ISSUER },
1325  { CERT_TRUST_IS_NOT_SIGNATURE_VALID | CERT_TRUST_IS_UNTRUSTED_ROOT,
1326    CERT_TRUST_IS_SELF_SIGNED | CERT_TRUST_HAS_NAME_MATCH_ISSUER },
1327 };
1328 static const SimpleChainStatusCheck simpleStatus12[] = {
1329  { sizeof(elementStatus12) / sizeof(elementStatus12[0]), elementStatus12 },
1330 };
1331 static CONST_DATA_BLOB chain13[] = {
1332  { sizeof(chain0_0), chain0_0 },
1333  { sizeof(chain13_1), chain13_1 },
1334 };
1335 static const CERT_TRUST_STATUS elementStatus13[] = {
1336  { CERT_TRUST_NO_ERROR, CERT_TRUST_HAS_NAME_MATCH_ISSUER },
1337  { CERT_TRUST_IS_UNTRUSTED_ROOT,
1338    CERT_TRUST_IS_SELF_SIGNED | CERT_TRUST_HAS_NAME_MATCH_ISSUER },
1339 };
1340 static const SimpleChainStatusCheck simpleStatus13[] = {
1341  { sizeof(elementStatus13) / sizeof(elementStatus13[0]), elementStatus13 },
1342 };
1343 static CONST_DATA_BLOB selfSignedChain[] = {
1344  { sizeof(selfSignedCert), selfSignedCert }
1345 };
1346 static const CERT_TRUST_STATUS selfSignedElementStatus[] = {
1347  { CERT_TRUST_IS_NOT_TIME_VALID | CERT_TRUST_IS_UNTRUSTED_ROOT,
1348    CERT_TRUST_HAS_NAME_MATCH_ISSUER | CERT_TRUST_IS_SELF_SIGNED },
1349 };
1350 static const SimpleChainStatusCheck selfSignedSimpleStatus[] = {
1351  { sizeof(selfSignedElementStatus) / sizeof(selfSignedElementStatus[0]),
1352    selfSignedElementStatus },
1353 };
1354 static CONST_DATA_BLOB iTunesChain[] = {
1355  { sizeof(verisignCA), verisignCA },
1356  { sizeof(iTunesCert0), iTunesCert0 },
1357  { sizeof(iTunesCert1), iTunesCert1 },
1358 };
1359 static const CERT_TRUST_STATUS iTunesElementStatus[] = {
1360  { CERT_TRUST_NO_ERROR, CERT_TRUST_HAS_KEY_MATCH_ISSUER },
1361  { CERT_TRUST_NO_ERROR, CERT_TRUST_HAS_EXACT_MATCH_ISSUER },
1362  { CERT_TRUST_NO_ERROR,
1363    CERT_TRUST_HAS_NAME_MATCH_ISSUER | CERT_TRUST_IS_SELF_SIGNED},
1364 };
1365 static const SimpleChainStatusCheck iTunesSimpleStatus[] = {
1366  { sizeof(iTunesElementStatus) / sizeof(iTunesElementStatus[0]),
1367    iTunesElementStatus },
1368 };
1369 static ChainCheck chainCheck[] = {
1370  /* Windows XP erroneously sets CERT_TRUST_HAS_PREFERRED_ISSUER on all
1371   * elements, so ignore it.
1372   * Windows 98/NT4 also set CERT_TRUST_IS_NOT_TIME_NESTED on chains they
1373   * shouldn't, so ignore those too.
1374   */
1375  { { sizeof(chain0) / sizeof(chain0[0]), chain0 },
1376    { { CERT_TRUST_IS_NOT_TIME_NESTED, CERT_TRUST_HAS_PREFERRED_ISSUER },
1377      { CERT_TRUST_IS_UNTRUSTED_ROOT | CERT_TRUST_IS_NOT_TIME_VALID, 0 },
1378      1, simpleStatus0 }, 0 },
1379  { { sizeof(chain1) / sizeof(chain1[0]), chain1 },
1380    { { CERT_TRUST_IS_NOT_TIME_NESTED, CERT_TRUST_HAS_PREFERRED_ISSUER },
1381      { CERT_TRUST_IS_UNTRUSTED_ROOT | CERT_TRUST_IS_NOT_SIGNATURE_VALID |
1382        CERT_TRUST_IS_NOT_TIME_VALID, 0 },
1383      1, simpleStatus1 }, 0 },
1384  { { sizeof(chain2) / sizeof(chain2[0]), chain2 },
1385    { { CERT_TRUST_IS_NOT_TIME_NESTED, CERT_TRUST_HAS_PREFERRED_ISSUER },
1386      { CERT_TRUST_IS_UNTRUSTED_ROOT | CERT_TRUST_IS_NOT_TIME_VALID, 0 },
1387      1, simpleStatus2 }, 0 },
1388  /* Earlier versions of Windows incorrectly don't set
1389   * CERT_TRUST_INVALID_BASIC_CONSTRAINTS on this chain.
1390   */
1391  { { sizeof(chain3) / sizeof(chain3[0]), chain3 },
1392    { { CERT_TRUST_IS_NOT_TIME_NESTED | CERT_TRUST_INVALID_BASIC_CONSTRAINTS,
1393        CERT_TRUST_HAS_PREFERRED_ISSUER },
1394      { CERT_TRUST_INVALID_BASIC_CONSTRAINTS | CERT_TRUST_IS_UNTRUSTED_ROOT |
1395        CERT_TRUST_IS_NOT_TIME_VALID, 0 },
1396      1, simpleStatus3 }, 0 },
1397  /* Earlier versions of Windows incorrectly don't set
1398   * CERT_TRUST_INVALID_BASIC_CONSTRAINTS on this chain.
1399   */
1400  { { sizeof(chain4) / sizeof(chain4[0]), chain4 },
1401    { { CERT_TRUST_IS_NOT_TIME_NESTED | CERT_TRUST_INVALID_BASIC_CONSTRAINTS,
1402        CERT_TRUST_HAS_PREFERRED_ISSUER },
1403      { CERT_TRUST_INVALID_BASIC_CONSTRAINTS | CERT_TRUST_IS_UNTRUSTED_ROOT |
1404        CERT_TRUST_IS_NOT_TIME_VALID, 0 },
1405      1, simpleStatus4 }, 0 },
1406  /* Windows versions prior to Vista/2008 incorrectly set
1407   * CERT_TRUST_HAS_NOT_DEFINED_NAME_CONSTRAINT on this chain, so ignore it.
1408   * Similarly, some older versions of Windows incorrectly set
1409   * CERT_TRUST_HAS_NOT_PERMITTED_NAME_CONSTRAINT, ignore that too.
1410   */
1411  { { sizeof(chain5) / sizeof(chain5[0]), chain5 },
1412    { { CERT_TRUST_HAS_NOT_DEFINED_NAME_CONSTRAINT |
1413        CERT_TRUST_HAS_NOT_PERMITTED_NAME_CONSTRAINT,
1414        CERT_TRUST_HAS_PREFERRED_ISSUER },
1415      { CERT_TRUST_HAS_NOT_PERMITTED_NAME_CONSTRAINT |
1416        CERT_TRUST_IS_UNTRUSTED_ROOT, 0 }, 1, simpleStatus5 }, 0 },
1417  { { sizeof(chain6) / sizeof(chain6[0]), chain6 },
1418    { { 0, CERT_TRUST_HAS_PREFERRED_ISSUER },
1419      { CERT_TRUST_IS_UNTRUSTED_ROOT, 0 }, 1, simpleStatus6 }, 0 },
1420  { { sizeof(chain7) / sizeof(chain7[0]), chain7 },
1421    { { 0, CERT_TRUST_HAS_PREFERRED_ISSUER },
1422      { CERT_TRUST_IS_UNTRUSTED_ROOT, 0 }, 1, simpleStatus7 }, 0 },
1423  /* Earlier versions of Windows incorrectly don't set
1424   * CERT_TRUST_INVALID_BASIC_CONSTRAINTS on this chain.
1425   */
1426  { { sizeof(chain8) / sizeof(chain8[0]), chain8 },
1427    { { CERT_TRUST_IS_NOT_TIME_NESTED | CERT_TRUST_INVALID_BASIC_CONSTRAINTS,
1428        CERT_TRUST_HAS_PREFERRED_ISSUER },
1429      { CERT_TRUST_INVALID_BASIC_CONSTRAINTS | CERT_TRUST_IS_UNTRUSTED_ROOT |
1430        CERT_TRUST_IS_NOT_TIME_VALID, 0 },
1431      1, simpleStatus8 }, 0 },
1432  /* Earlier versions of Windows incorrectly don't set
1433   * CERT_TRUST_INVALID_BASIC_CONSTRAINTS on this chain.
1434   */
1435  { { sizeof(chain9) / sizeof(chain9[0]), chain9 },
1436    { { CERT_TRUST_IS_NOT_TIME_NESTED | CERT_TRUST_INVALID_BASIC_CONSTRAINTS,
1437        CERT_TRUST_HAS_PREFERRED_ISSUER },
1438      { CERT_TRUST_IS_PARTIAL_CHAIN |
1439        CERT_TRUST_INVALID_BASIC_CONSTRAINTS | CERT_TRUST_IS_CYCLIC, 0 },
1440      1, simpleStatus9 }, 0 },
1441  { { sizeof(chain10) / sizeof(chain10[0]), chain10 },
1442    { { 0, CERT_TRUST_HAS_PREFERRED_ISSUER },
1443      { CERT_TRUST_IS_UNTRUSTED_ROOT, 0 }, 1, simpleStatus10 }, 0 },
1444  { { sizeof(chain11) / sizeof(chain11[0]), chain11 },
1445    { { 0, CERT_TRUST_HAS_PREFERRED_ISSUER },
1446      { CERT_TRUST_IS_UNTRUSTED_ROOT, 0 }, 1, simpleStatus10 }, 0 },
1447  { { sizeof(chain12) / sizeof(chain12[0]), chain12 },
1448    { { 0, CERT_TRUST_HAS_PREFERRED_ISSUER },
1449      { CERT_TRUST_IS_UNTRUSTED_ROOT | CERT_TRUST_IS_NOT_SIGNATURE_VALID, 0 },
1450      1, simpleStatus12 }, 0 },
1451  { { sizeof(chain13) / sizeof(chain13[0]), chain13 },
1452    { { CERT_TRUST_IS_NOT_TIME_NESTED, CERT_TRUST_HAS_PREFERRED_ISSUER },
1453      { CERT_TRUST_IS_UNTRUSTED_ROOT, 0 }, 1, simpleStatus13 },
1454    0 },
1455  { { sizeof(selfSignedChain) / sizeof(selfSignedChain[0]), selfSignedChain },
1456    { { 0, CERT_TRUST_HAS_PREFERRED_ISSUER },
1457      { CERT_TRUST_IS_NOT_TIME_VALID | CERT_TRUST_IS_UNTRUSTED_ROOT, 0 },
1458      1, selfSignedSimpleStatus }, 0 },
1459  /* The iTunes chain may or may not have its root trusted, so ignore the
1460   * error
1461   */
1462  { { sizeof(iTunesChain) / sizeof(iTunesChain[0]), iTunesChain },
1463    { { CERT_TRUST_IS_UNTRUSTED_ROOT, CERT_TRUST_HAS_PREFERRED_ISSUER },
1464      { 0, 0 },
1465        1, iTunesSimpleStatus }, 0 },
1466 };
1467
1468 static const CERT_TRUST_STATUS elementStatus8NoStore[] = {
1469  { CERT_TRUST_NO_ERROR, CERT_TRUST_HAS_NAME_MATCH_ISSUER },
1470 };
1471 static const SimpleChainStatusCheck simpleStatus8NoStore[] = {
1472  { sizeof(elementStatus8NoStore) / sizeof(elementStatus8NoStore[0]),
1473    elementStatus8NoStore },
1474 };
1475 static ChainCheck chainCheckNoStore[] = {
1476  { { sizeof(selfSignedChain) / sizeof(selfSignedChain[0]), selfSignedChain },
1477    { { 0, CERT_TRUST_HAS_PREFERRED_ISSUER },
1478      { CERT_TRUST_IS_NOT_TIME_VALID | CERT_TRUST_IS_UNTRUSTED_ROOT, 0 },
1479      1, selfSignedSimpleStatus },
1480    0 },
1481  { { sizeof(chain8) / sizeof(chain8[0]), chain8 },
1482    { { 0, CERT_TRUST_HAS_PREFERRED_ISSUER },
1483      { CERT_TRUST_IS_PARTIAL_CHAIN, 0 },
1484      1, simpleStatus8NoStore },
1485    0 },
1486 };
1487
1488 /* Wednesday, Oct 1, 2007 */
1489 static SYSTEMTIME oct2007 = { 2007, 10, 1, 1, 0, 0, 0, 0 };
1490
1491 static void testGetCertChain(void)
1492 {
1493     BOOL ret;
1494     PCCERT_CONTEXT cert;
1495     CERT_CHAIN_PARA para = { 0 };
1496     PCCERT_CHAIN_CONTEXT chain;
1497     DWORD i;
1498
1499     /* Basic parameter checks */
1500     if (0)
1501     {
1502         /* Crash on Vista */
1503         ret = pCertGetCertificateChain(NULL, NULL, NULL, NULL, NULL, 0, NULL, NULL);
1504         ok(!ret && GetLastError() == E_INVALIDARG,
1505          "Expected E_INVALIDARG, got %08x\n", GetLastError());
1506     }
1507     ret = pCertGetCertificateChain(NULL, NULL, NULL, NULL, NULL, 0, NULL,
1508      &chain);
1509     ok(!ret && GetLastError() == E_INVALIDARG,
1510      "Expected E_INVALIDARG, got %08x\n", GetLastError());
1511     /* Crash
1512     ret = pCertGetCertificateChain(NULL, NULL, NULL, NULL, &para, 0, NULL, NULL);
1513     ret = pCertGetCertificateChain(NULL, NULL, NULL, NULL, &para, 0, NULL,
1514      &chain);
1515      */
1516     cert = CertCreateCertificateContext(X509_ASN_ENCODING, bigCert,
1517      sizeof(bigCert));
1518     if (0)
1519     {
1520         /* Crash on Vista */
1521         ret = pCertGetCertificateChain(NULL, cert, NULL, NULL, NULL, 0, NULL, NULL);
1522         ok(!ret && GetLastError() == E_INVALIDARG,
1523          "Expected E_INVALIDARG, got %08x\n", GetLastError());
1524     }
1525     /* Crash
1526     ret = pCertGetCertificateChain(NULL, cert, NULL, NULL, &para, 0, NULL, NULL);
1527      */
1528
1529     /* Tests with an invalid cert (one whose signature is bad) */
1530     SetLastError(0xdeadbeef);
1531     ret = pCertGetCertificateChain(NULL, cert, NULL, NULL, &para, 0, NULL,
1532      &chain);
1533     ok(!ret, "Expected failure\n");
1534     ok(GetLastError() == ERROR_INVALID_DATA ||
1535      GetLastError() == CRYPT_E_ASN1_BADTAG /* Vista */,
1536      "Expected ERROR_INVALID_DATA or CRYPT_E_ASN1_BADTAG, got %d\n", GetLastError());
1537     para.cbSize = sizeof(para);
1538     SetLastError(0xdeadbeef);
1539     ret = pCertGetCertificateChain(NULL, cert, NULL, NULL, &para, 0, NULL,
1540      &chain);
1541     ok(!ret, "Expected failure\n");
1542     ok(GetLastError() == ERROR_INVALID_DATA ||
1543      GetLastError() == CRYPT_E_ASN1_BADTAG /* Vista */,
1544      "Expected ERROR_INVALID_DATA or CRYPT_E_ASN1_BADTAG, got %d\n", GetLastError());
1545
1546     para.cbSize = 0;
1547     SetLastError(0xdeadbeef);
1548     ret = pCertGetCertificateChain(NULL, cert, NULL, NULL, &para, 0, NULL,
1549      &chain);
1550     ok(!ret, "Expected failure\n");
1551     ok(GetLastError() == ERROR_INVALID_DATA ||
1552      GetLastError() == CRYPT_E_ASN1_BADTAG, /* Vista and higher */
1553      "Expected ERROR_INVALID_DATA or CRYPT_E_ASN1_BADTAG, got %d\n", GetLastError());
1554
1555     CertFreeCertificateContext(cert);
1556
1557     for (i = 0; i < sizeof(chainCheck) / sizeof(chainCheck[0]); i++)
1558     {
1559         chain = getChain(&chainCheck[i].certs, 0, TRUE, &oct2007,
1560          chainCheck[i].todo, i);
1561         if (chain)
1562         {
1563             checkChainStatus(chain, &chainCheck[i].status, chainCheck[i].todo,
1564              i);
1565             pCertFreeCertificateChain(chain);
1566         }
1567     }
1568     for (i = 0; i < sizeof(chainCheckNoStore) / sizeof(chainCheckNoStore[0]);
1569      i++)
1570     {
1571         chain = getChain(&chainCheckNoStore[i].certs, 0, FALSE, &oct2007,
1572          chainCheckNoStore[i].todo, i);
1573         if (chain)
1574         {
1575             checkChainStatus(chain, &chainCheckNoStore[i].status,
1576              chainCheckNoStore[i].todo, i);
1577             pCertFreeCertificateChain(chain);
1578         }
1579     }
1580 }
1581
1582 static void test_CERT_CHAIN_PARA_cbSize(void)
1583 {
1584     BOOL ret;
1585     PCCERT_CONTEXT cert;
1586     CERT_CHAIN_PARA para = { 0 };
1587     PCCERT_CHAIN_CONTEXT chain;
1588     HCERTSTORE store;
1589     DWORD i;
1590
1591     store = CertOpenStore(CERT_STORE_PROV_MEMORY, 0, 0,
1592      CERT_STORE_CREATE_NEW_FLAG, NULL);
1593
1594     ret = CertAddEncodedCertificateToStore(store,
1595      X509_ASN_ENCODING, chain0_0, sizeof(chain0_0),
1596      CERT_STORE_ADD_ALWAYS, NULL);
1597     ret = CertAddEncodedCertificateToStore(store,
1598      X509_ASN_ENCODING, chain0_1, sizeof(chain0_1),
1599      CERT_STORE_ADD_ALWAYS, &cert);
1600
1601     for (i = 0; i < sizeof(CERT_CHAIN_PARA) + 2; i++)
1602     {
1603         FILETIME fileTime;
1604
1605         SystemTimeToFileTime(&oct2007, &fileTime);
1606
1607         para.cbSize = i;
1608         ret = pCertGetCertificateChain(NULL, cert, &fileTime,
1609          NULL, &para, 0, NULL, &chain);
1610         ok(ret, "CertGetCertificateChain failed %u\n", GetLastError());
1611         pCertFreeCertificateChain(chain);
1612     }
1613
1614     CertCloseStore(store, 0);
1615 }
1616
1617 typedef struct _ChainPolicyCheck
1618 {
1619     CONST_BLOB_ARRAY                certs;
1620     CERT_CHAIN_POLICY_STATUS        status;
1621     const CERT_CHAIN_POLICY_STATUS *brokenStatus;
1622     DWORD                           todo;
1623 } ChainPolicyCheck;
1624
1625 static const ChainPolicyCheck basePolicyCheck[] = {
1626  { { sizeof(chain0) / sizeof(chain0[0]), chain0 },
1627    { 0, CERT_E_UNTRUSTEDROOT, 0, 1, NULL }, NULL, 0 },
1628  { { sizeof(chain1) / sizeof(chain1[0]), chain1 },
1629    { 0, TRUST_E_CERT_SIGNATURE, 0, 0, NULL }, NULL, 0 },
1630  { { sizeof(chain2) / sizeof(chain2[0]), chain2 },
1631    { 0, CERT_E_UNTRUSTEDROOT, 0, 1, NULL }, NULL, 0 },
1632  { { sizeof(chain3) / sizeof(chain3[0]), chain3 },
1633    { 0, CERT_E_UNTRUSTEDROOT, 0, 1, NULL }, NULL, 0 },
1634  { { sizeof(chain4) / sizeof(chain4[0]), chain4 },
1635    { 0, CERT_E_UNTRUSTEDROOT, 0, 2, NULL }, NULL, 0 },
1636  { { sizeof(chain5) / sizeof(chain5[0]), chain5 },
1637    { 0, CERT_E_UNTRUSTEDROOT, 0, 1, NULL }, NULL, 0 },
1638  { { sizeof(chain6) / sizeof(chain6[0]), chain6 },
1639    { 0, CERT_E_UNTRUSTEDROOT, 0, 1, NULL }, NULL, 0 },
1640  { { sizeof(chain7) / sizeof(chain7[0]), chain7 },
1641    { 0, CERT_E_UNTRUSTEDROOT, 0, 1, NULL }, NULL, 0 },
1642  { { sizeof(chain8) / sizeof(chain8[0]), chain8 },
1643    { 0, CERT_E_UNTRUSTEDROOT, 0, 2, NULL }, NULL, 0 },
1644  { { sizeof(chain9) / sizeof(chain9[0]), chain9 },
1645    { 0, CERT_E_CHAINING, 0, -1, NULL }, NULL, 0 },
1646  { { sizeof(chain10) / sizeof(chain10[0]), chain10 },
1647    { 0, CERT_E_UNTRUSTEDROOT, 0, 1, NULL }, NULL, 0 },
1648  { { sizeof(chain11) / sizeof(chain11[0]), chain11 },
1649    { 0, CERT_E_UNTRUSTEDROOT, 0, 1, NULL }, NULL, 0 },
1650  { { sizeof(chain12) / sizeof(chain12[0]), chain12 },
1651    { 0, TRUST_E_CERT_SIGNATURE, 0, 1, NULL }, NULL, 0 },
1652  { { sizeof(selfSignedChain) / sizeof(selfSignedChain[0]), selfSignedChain },
1653    { 0, CERT_E_UNTRUSTEDROOT, 0, 0, NULL }, NULL, 0 },
1654 };
1655
1656 static const ChainPolicyCheck authenticodePolicyCheck[] = {
1657  { { sizeof(chain0) / sizeof(chain0[0]), chain0 },
1658    { 0, CERT_E_UNTRUSTEDROOT, 0, 1, NULL }, NULL, 0 },
1659  { { sizeof(chain1) / sizeof(chain1[0]), chain1 },
1660    { 0, TRUST_E_CERT_SIGNATURE, 0, 0, NULL }, NULL, 0 },
1661  { { sizeof(chain2) / sizeof(chain2[0]), chain2 },
1662    { 0, CERT_E_UNTRUSTEDROOT, 0, 1, NULL }, NULL, 0 },
1663  { { sizeof(chain3) / sizeof(chain3[0]), chain3 },
1664    { 0, CERT_E_UNTRUSTEDROOT, 0, 1, NULL }, NULL, 0 },
1665  { { sizeof(chain4) / sizeof(chain4[0]), chain4 },
1666    { 0, CERT_E_UNTRUSTEDROOT, 0, 2, NULL }, NULL, 0 },
1667  { { sizeof(chain5) / sizeof(chain5[0]), chain5 },
1668    { 0, CERT_E_UNTRUSTEDROOT, 0, 1, NULL }, NULL, 0 },
1669  { { sizeof(chain6) / sizeof(chain6[0]), chain6 },
1670    { 0, CERT_E_UNTRUSTEDROOT, 0, 1, NULL }, NULL, 0 },
1671  { { sizeof(chain7) / sizeof(chain7[0]), chain7 },
1672    { 0, CERT_E_UNTRUSTEDROOT, 0, 1, NULL }, NULL, 0 },
1673  { { sizeof(chain8) / sizeof(chain8[0]), chain8 },
1674    { 0, CERT_E_UNTRUSTEDROOT, 0, 2, NULL }, NULL, 0 },
1675  { { sizeof(chain9) / sizeof(chain9[0]), chain9 },
1676    { 0, CERT_E_CHAINING, 0, -1, NULL }, NULL, 0 },
1677  { { sizeof(chain10) / sizeof(chain10[0]), chain10 },
1678    { 0, CERT_E_UNTRUSTEDROOT, 0, 1, NULL }, NULL, 0 },
1679  { { sizeof(chain11) / sizeof(chain11[0]), chain11 },
1680    { 0, CERT_E_UNTRUSTEDROOT, 0, 1, NULL }, NULL, 0 },
1681  { { sizeof(chain12) / sizeof(chain12[0]), chain12 },
1682    { 0, TRUST_E_CERT_SIGNATURE, 0, 1, NULL }, NULL, 0 },
1683  { { sizeof(selfSignedChain) / sizeof(selfSignedChain[0]), selfSignedChain },
1684    { 0, CERT_E_UNTRUSTEDROOT, 0, 0, NULL }, NULL, 0 },
1685 };
1686
1687 /* On some older systems, the element index is set to 2 rather than 1 for
1688  * chain 4, because they do not catch the basic constraints error in the
1689  * chain, which occurs at element 1.
1690  */
1691 static const CERT_CHAIN_POLICY_STATUS chain4BrokenStatus =
1692  { 0, TRUST_E_BASIC_CONSTRAINTS, 0, 2, NULL };
1693
1694 static const ChainPolicyCheck basicConstraintsPolicyCheck[] = {
1695  { { sizeof(chain0) / sizeof(chain0[0]), chain0 },
1696    { 0, 0, -1, -1, NULL }, NULL, 0 },
1697  { { sizeof(chain1) / sizeof(chain1[0]), chain1 },
1698    { 0, 0, -1, -1, NULL }, NULL, 0 },
1699  { { sizeof(chain2) / sizeof(chain2[0]), chain2 },
1700    { 0, 0, -1, -1, NULL }, NULL, 0 },
1701  { { sizeof(chain3) / sizeof(chain3[0]), chain3 },
1702    { 0, TRUST_E_BASIC_CONSTRAINTS, 0, 1, NULL }, NULL, 0 },
1703  { { sizeof(chain4) / sizeof(chain4[0]), chain4 },
1704    { 0, TRUST_E_BASIC_CONSTRAINTS, 0, 1, NULL }, &chain4BrokenStatus, 0 },
1705  { { sizeof(chain5) / sizeof(chain5[0]), chain5 },
1706    { 0, 0, -1, -1, NULL }, NULL, 0 },
1707  { { sizeof(chain6) / sizeof(chain6[0]), chain6 },
1708    { 0, 0, -1, -1, NULL }, NULL, 0 },
1709  { { sizeof(chain7) / sizeof(chain7[0]), chain7 },
1710    { 0, 0, -1, -1, NULL }, NULL, 0 },
1711  { { sizeof(chain8) / sizeof(chain8[0]), chain8 },
1712    { 0, TRUST_E_BASIC_CONSTRAINTS, 0, 1, NULL }, NULL, 0 },
1713  { { sizeof(chain9) / sizeof(chain9[0]), chain9 },
1714    { 0, TRUST_E_BASIC_CONSTRAINTS, 0, 1, NULL }, NULL, 0 },
1715  { { sizeof(chain10) / sizeof(chain10[0]), chain10 },
1716    { 0, 0, -1, -1, NULL }, NULL, 0 },
1717  { { sizeof(chain11) / sizeof(chain11[0]), chain11 },
1718    { 0, 0, -1, -1, NULL }, NULL, 0 },
1719  { { sizeof(chain12) / sizeof(chain12[0]), chain12 },
1720    { 0, 0, -1, -1, NULL }, NULL, 0 },
1721  { { sizeof(selfSignedChain) / sizeof(selfSignedChain[0]), selfSignedChain },
1722    { 0, 0, -1, -1, NULL }, NULL, 0 },
1723 };
1724
1725 static const char *num_to_str(WORD num)
1726 {
1727     static char buf[6];
1728
1729     sprintf(buf, "#%04X", num);
1730     return buf;
1731 }
1732
1733 static void checkChainPolicyStatus(LPCSTR policy, const ChainPolicyCheck *check,
1734  DWORD testIndex)
1735 {
1736     PCCERT_CHAIN_CONTEXT chain = getChain(&check->certs, 0, TRUE, &oct2007,
1737      check->todo, testIndex);
1738
1739     if (chain)
1740     {
1741         CERT_CHAIN_POLICY_STATUS policyStatus = { 0 };
1742         BOOL ret = pCertVerifyCertificateChainPolicy(policy, chain, NULL,
1743          &policyStatus);
1744
1745         if (check->todo & TODO_POLICY)
1746             todo_wine ok(ret,
1747              "%s[%d]: CertVerifyCertificateChainPolicy failed: %08x\n",
1748              HIWORD(policy) ? policy : num_to_str(LOWORD(policy)),
1749              testIndex, GetLastError());
1750         else
1751         {
1752             if (!ret && GetLastError() == ERROR_FILE_NOT_FOUND)
1753             {
1754                 skip("%d: missing policy %s, skipping test\n", testIndex,
1755                  HIWORD(policy) ? policy : num_to_str(LOWORD(policy)));
1756                 pCertFreeCertificateChain(chain);
1757                 return;
1758             }
1759             ok(ret, "%s[%d]: CertVerifyCertificateChainPolicy failed: %08x\n",
1760              HIWORD(policy) ? policy : num_to_str(LOWORD(policy)), testIndex,
1761              GetLastError());
1762         }
1763         if (ret)
1764         {
1765             if (check->todo & TODO_ERROR)
1766                 todo_wine ok(policyStatus.dwError == check->status.dwError ||
1767                  broken(policyStatus.dwError == CERT_TRUST_NO_ERROR) ||
1768                  (check->brokenStatus && broken(policyStatus.dwError ==
1769                  check->brokenStatus->dwError)),
1770                  "%s[%d]: expected %08x, got %08x\n",
1771                  HIWORD(policy) ? policy : num_to_str(LOWORD(policy)),
1772                  testIndex, check->status.dwError, policyStatus.dwError);
1773             else
1774                 ok(policyStatus.dwError == check->status.dwError ||
1775                  broken(policyStatus.dwError == CERT_TRUST_NO_ERROR) ||
1776                  (check->brokenStatus && broken(policyStatus.dwError ==
1777                  check->brokenStatus->dwError)),
1778                  "%s[%d]: expected %08x, got %08x\n",
1779                  HIWORD(policy) ? policy : num_to_str(LOWORD(policy)),
1780                  testIndex, check->status.dwError, policyStatus.dwError);
1781             if (policyStatus.dwError != check->status.dwError)
1782             {
1783                 skip("%s[%d]: error %08x doesn't match expected %08x, not checking indexes\n",
1784                  HIWORD(policy) ? policy : num_to_str(LOWORD(policy)),
1785                  testIndex, policyStatus.dwError, check->status.dwError);
1786                 pCertFreeCertificateChain(chain);
1787                 return;
1788             }
1789             if (check->todo & TODO_CHAINS)
1790                 todo_wine ok(policyStatus.lChainIndex ==
1791                  check->status.lChainIndex ||
1792                  (check->brokenStatus && broken(policyStatus.lChainIndex ==
1793                  check->brokenStatus->lChainIndex)),
1794                  "%s[%d]: expected %d, got %d\n",
1795                  HIWORD(policy) ? policy : num_to_str(LOWORD(policy)),
1796                  testIndex, check->status.lChainIndex,
1797                  policyStatus.lChainIndex);
1798             else
1799                 ok(policyStatus.lChainIndex == check->status.lChainIndex ||
1800                  (check->brokenStatus && broken(policyStatus.lChainIndex ==
1801                  check->brokenStatus->lChainIndex)),
1802                  "%s[%d]: expected %d, got %d\n",
1803                  HIWORD(policy) ? policy : num_to_str(LOWORD(policy)),
1804                  testIndex,
1805                  check->status.lChainIndex, policyStatus.lChainIndex);
1806             if (check->todo & TODO_ELEMENTS)
1807                 todo_wine ok(policyStatus.lElementIndex ==
1808                  check->status.lElementIndex ||
1809                  (check->brokenStatus && broken(policyStatus.lElementIndex ==
1810                  check->brokenStatus->lElementIndex)),
1811                  "%s[%d]: expected %d, got %d\n",
1812                  HIWORD(policy) ? policy : num_to_str(LOWORD(policy)),
1813                  testIndex,
1814                  check->status.lElementIndex, policyStatus.lElementIndex);
1815             else
1816                 ok(policyStatus.lElementIndex == check->status.lElementIndex ||
1817                  (check->brokenStatus && broken(policyStatus.lElementIndex ==
1818                  check->brokenStatus->lElementIndex)),
1819                  "%s[%d]: expected %d, got %d\n",
1820                  HIWORD(policy) ? policy : num_to_str(LOWORD(policy)),
1821                  testIndex,
1822                  check->status.lElementIndex, policyStatus.lElementIndex);
1823         }
1824         pCertFreeCertificateChain(chain);
1825     }
1826 }
1827
1828 static void testVerifyCertChainPolicy(void)
1829 {
1830     BOOL ret;
1831     PCCERT_CONTEXT cert;
1832     CERT_CHAIN_PARA chainPara = { sizeof(CERT_CHAIN_PARA), { 0 } };
1833     PCCERT_CHAIN_CONTEXT chain;
1834     CERT_CHAIN_POLICY_STATUS policyStatus = { 0 };
1835     CERT_CHAIN_POLICY_PARA policyPara = { 0 };
1836     DWORD i;
1837
1838     if (!pCertVerifyCertificateChainPolicy)
1839     {
1840         win_skip("CertVerifyCertificateChainPolicy() is not available\n");
1841         return;
1842     }
1843
1844     /* Crash
1845     ret = pCertVerifyCertificateChainPolicy(NULL, NULL, NULL, NULL);
1846     ret = pCertVerifyCertificateChainPolicy(CERT_CHAIN_POLICY_BASE, NULL, NULL,
1847      NULL);
1848     ret = pCertVerifyCertificateChainPolicy(CERT_CHAIN_POLICY_BASE, NULL,
1849      &chainPara, NULL);
1850      */
1851     SetLastError(0xdeadbeef);
1852     ret = pCertVerifyCertificateChainPolicy(NULL, NULL, NULL, &policyStatus);
1853     ok(!ret && GetLastError() == ERROR_FILE_NOT_FOUND,
1854      "Expected ERROR_FILE_NOT_FOUND, got %08x\n", GetLastError());
1855     /* Crashes
1856     ret = pCertVerifyCertificateChainPolicy(CERT_CHAIN_POLICY_BASE, NULL, NULL,
1857      &policyStatus);
1858      */
1859     cert = CertCreateCertificateContext(X509_ASN_ENCODING, selfSignedCert,
1860      sizeof(selfSignedCert));
1861     pCertGetCertificateChain(NULL, cert, NULL, NULL, &chainPara, 0, NULL,
1862      &chain);
1863     /* Crash
1864     ret = pCertVerifyCertificateChainPolicy(NULL, chain, NULL, NULL);
1865     ret = pCertVerifyCertificateChainPolicy(CERT_CHAIN_POLICY_BASE, chain, NULL,
1866      NULL);
1867     ret = pCertVerifyCertificateChainPolicy(CERT_CHAIN_POLICY_BASE, chain,
1868      &chainPara, NULL);
1869      */
1870     /* Size of policy status is apparently ignored, as is pChainPolicyPara */
1871     ret = pCertVerifyCertificateChainPolicy(CERT_CHAIN_POLICY_BASE, chain, NULL,
1872      &policyStatus);
1873     ok(ret, "CertVerifyCertificateChainPolicy failed: %08x\n", GetLastError());
1874     ok(policyStatus.dwError == CERT_E_UNTRUSTEDROOT,
1875      "Expected CERT_E_UNTRUSTEDROOT, got %08x\n", policyStatus.dwError);
1876     ok(policyStatus.lChainIndex == 0 && policyStatus.lElementIndex == 0,
1877      "Expected both indexes 0, got %d, %d\n", policyStatus.lChainIndex,
1878      policyStatus.lElementIndex);
1879     ret = pCertVerifyCertificateChainPolicy(CERT_CHAIN_POLICY_BASE, chain,
1880      &policyPara, &policyStatus);
1881     ok(ret, "CertVerifyCertificateChainPolicy failed: %08x\n", GetLastError());
1882     ok(policyStatus.dwError == CERT_E_UNTRUSTEDROOT,
1883      "Expected CERT_E_UNTRUSTEDROOT, got %08x\n", policyStatus.dwError);
1884     ok(policyStatus.lChainIndex == 0 && policyStatus.lElementIndex == 0,
1885      "Expected both indexes 0, got %d, %d\n", policyStatus.lChainIndex,
1886      policyStatus.lElementIndex);
1887     pCertFreeCertificateChain(chain);
1888     CertFreeCertificateContext(cert);
1889
1890     for (i = 0;
1891      i < sizeof(basePolicyCheck) / sizeof(basePolicyCheck[0]); i++)
1892         checkChainPolicyStatus(CERT_CHAIN_POLICY_BASE, &basePolicyCheck[i], i);
1893     /* The authenticode policy doesn't seem to check anything beyond the base
1894      * policy.  It might check for chains signed by the MS test cert, but none
1895      * of these chains is.
1896      */
1897     for (i = 0; i <
1898      sizeof(authenticodePolicyCheck) / sizeof(authenticodePolicyCheck[0]); i++)
1899         checkChainPolicyStatus(CERT_CHAIN_POLICY_AUTHENTICODE,
1900          &authenticodePolicyCheck[i], i);
1901     for (i = 0; i <
1902      sizeof(basicConstraintsPolicyCheck) / sizeof(basicConstraintsPolicyCheck[0]);
1903      i++)
1904         checkChainPolicyStatus(CERT_CHAIN_POLICY_BASIC_CONSTRAINTS,
1905          &basicConstraintsPolicyCheck[i], i);
1906 }
1907
1908 START_TEST(chain)
1909 {
1910     HMODULE hCrypt32 = GetModuleHandleA("crypt32.dll");
1911     pCertCreateCertificateChainEngine = (void*)GetProcAddress(hCrypt32, "CertCreateCertificateChainEngine");
1912     pCertGetCertificateChain = (void*)GetProcAddress(hCrypt32, "CertGetCertificateChain");
1913     pCertFreeCertificateChain = (void*)GetProcAddress(hCrypt32, "CertFreeCertificateChain");
1914     pCertFreeCertificateChainEngine = (void*)GetProcAddress(hCrypt32, "CertFreeCertificateChainEngine");
1915     pCertVerifyCertificateChainPolicy = (void*)GetProcAddress(hCrypt32, "CertVerifyCertificateChainPolicy");
1916
1917     testCreateCertChainEngine();
1918     if (!pCertGetCertificateChain)
1919     {
1920         win_skip("CertGetCertificateChain() is not available\n");
1921     }
1922     else
1923     {
1924         testVerifyCertChainPolicy();
1925         testGetCertChain();
1926         test_CERT_CHAIN_PARA_cbSize();
1927     }
1928 }