rpms/perl-Net-SSLeay
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Replace expired test certificates

Browse Source
This commit is contained in:
Petr Písař 2019-04-18 11:37:02 +02:00
parent f571bb6a69
commit 3320d4f81c
2 changed files with 837 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

828
Net-SSLeay-1.86_09-Replace-Twitter-chain-with-our-own-chain.patch Normal file
View File

@ -0,0 +1,828 @@
From de64ed801edfa51fbd941a1a8e8bf23cdcb82e47 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@redhat.com>
Date: Thu, 18 Apr 2019 11:01:45 +0200
Subject: [PATCH] Replace Twitter chain with our own chain
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
The Twitter's certiticate expires every year and thus tests fail when
it expires.
This patch replaces it with a chain of certificates that we generate
(and can regenerate with t/data/Makefile anytime) with a 10-year
validity.
It also adjusts other tests to use a different certificate from the
Twitter's one. That allows us to remove it completely.
<https://rt.cpan.org/Ticket/Display.html?id=129201>
<https://github.com/radiator-software/p5-net-ssleay/pull/128>
Signed-off-by: Petr Písař <ppisar@redhat.com>
---
MANIFEST | 15 +-
t/data/cert_twitter.crt.pem | 37 ----
t/data/cert_twitter.crt.pem_dump | 284 -------------------------------
t/data/chain_leaf.crt.pem | 45 +++++
t/data/chain_twitter.crt.pem | 95 -----------
t/data/digicert.crt.pem | 23 ---
t/data/test_CAinter.crt.pem | 15 ++
t/data/test_CAinter.extensions | 1 +
t/data/test_CAinter.key.pem | 27 +++
t/data/test_CAinter.req.pem | 15 ++
t/data/test_leaf.crt.pem | 16 ++
t/data/test_leaf.key.pem | 27 +++
t/data/test_leaf.req.pem | 15 ++
t/local/32_x509_get_cert_info.t | 5 +-
t/local/33_x509_create_cert.t | 2 +-
t/local/36_verify.t | 4 +-
16 files changed, 175 insertions(+), 451 deletions(-)
delete mode 100644 t/data/cert_twitter.crt.pem
delete mode 100644 t/data/cert_twitter.crt.pem_dump
create mode 100644 t/data/chain_leaf.crt.pem
delete mode 100755 t/data/chain_twitter.crt.pem
delete mode 100755 t/data/digicert.crt.pem
create mode 100644 t/data/test_CAinter.crt.pem
create mode 100644 t/data/test_CAinter.extensions
create mode 100644 t/data/test_CAinter.key.pem
create mode 100644 t/data/test_CAinter.req.pem
create mode 100644 t/data/test_leaf.crt.pem
create mode 100644 t/data/test_leaf.key.pem
create mode 100644 t/data/test_leaf.req.pem
diff --git a/MANIFEST b/MANIFEST
index b36241d..cc64cee 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -39,15 +39,11 @@ README.OSX
README.VMS
README.Win32
SSLeay.xs
-t/data/0f89dbb5.0
t/data/binary-test.file
t/data/cert.pem
t/data/cert_paypal.crt.pem
t/data/cert_paypal.crt.pem_dump
-t/data/cert_twitter.crt.pem
-t/data/cert_twitter.crt.pem_dump
-t/data/chain_twitter.crt.pem
-t/data/digicert.crt.pem
+t/data/chain_leaf.crt.pem
t/data/key.pem
t/data/key.pem.e
t/data/pkcs12-full.p12
@@ -59,6 +55,13 @@ t/data/test_CA1.crt.pem
t/data/test_CA1.encrypted_key.pem
t/data/test_CA1.key.der
t/data/test_CA1.key.pem
+t/data/test_CAinter.crt.pem
+t/data/test_CAinter.extensions
+t/data/test_CAinter.key.pem
+t/data/test_CAinter.req.pem
+t/data/test_leaf.crt.pem
+t/data/test_leaf.key.pem
+t/data/test_leaf.req.pem
t/data/testcert_cdp.crt.pem
t/data/testcert_cdp.crt.pem_dump
t/data/testcert_extended.crt.pem
@@ -116,8 +119,8 @@ t/local/50_digest.t
t/local/61_threads-cb-crash.t
t/local/62_threads-ctx_new-deadlock.t
t/local/63_ec_key_generate_key.t
-t/local/65_security_level.t
t/local/64_ticket_sharing.t
+t/local/65_security_level.t
t/local/65_ticket_sharing_2.t
t/local/66_curves.t
t/local/kwalitee.t
diff --git a/t/data/cert_twitter.crt.pem b/t/data/cert_twitter.crt.pem
deleted file mode 100644
index eb3acc1..0000000
--- a/t/data/cert_twitter.crt.pem
+++ /dev/null
@@ -1,37 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIGfjCCBWagAwIBAgIQFyfdZD5CNvh/ebsEa8GYAjANBgkqhkiG9w0BAQUFADCB
-ujELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQL
-ExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTswOQYDVQQLEzJUZXJtcyBvZiB1c2Ug
-YXQgaHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL3JwYSAoYykwNjE0MDIGA1UEAxMr
-VmVyaVNpZ24gQ2xhc3MgMyBFeHRlbmRlZCBWYWxpZGF0aW9uIFNTTCBDQTAeFw0x
-MTA3MDcwMDAwMDBaFw0xMjA3MjcyMzU5NTlaMIIBGTETMBEGCysGAQQBgjc8AgED
-EwJVUzEZMBcGCysGAQQBgjc8AgECEwhEZWxhd2FyZTEdMBsGA1UEDxMUUHJpdmF0
-ZSBPcmdhbml6YXRpb24xEDAOBgNVBAUTBzQzMzc0NDYxCzAJBgNVBAYTAlVTMQ4w
-DAYDVQQRFAU5NDEwNzETMBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UEBxQNU2Fu
-IEZyYW5jaXNjbzEhMB8GA1UECRQYNzk1IEZvbHNvbSBTdCwgU3VpdGUgNjAwMRYw
-FAYDVQQKFA1Ud2l0dGVyLCBJbmMuMRswGQYDVQQLFBJUd2l0dGVyIE9wZXJhdGlv
-bnMxFDASBgNVBAMUC3R3aXR0ZXIuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
-MIIBCgKCAQEAmiGqkw9ArpnvvWnom/W+HxNDKXf0cFCrjErr0tfFs10UzA12xxOE
-gI0WmWM5B/0W8f5ueEY3/ziPO3i+jJvHDJUQqQaH8LJAhOyEr6EpVWncfaMK2Ufd
-y1s+iQzcQLZqpB3W/J+5mf7dhy1F/tUWyP2cvxC7dWJQjv3RY2ca/PDzy7a4bcqT
-Bg9bx42t4c5LmjkpOsckevS9lpuwBc0I1+1Nshm+sdfJKKIWwQ4+ylshom/d0S2a
-e+pRxoRiPbjXkqEcOAQjmHaz4U5gavPjVq5Uk0Sw96z90gGo/WxtOvJ584NJtiiQ
-erP9fbAefJGqCgcsE3x+IjrJymlvVUgs0QIDAQABo4ICHDCCAhgwJwYDVR0RBCAw
-HoIPd3d3LnR3aXR0ZXIuY29tggt0d2l0dGVyLmNvbTAJBgNVHRMEAjAAMB0GA1Ud
-DgQWBBToMED2PZslwbExjhP13omUFc0GPzALBgNVHQ8EBAMCBaAwQgYDVR0fBDsw
-OTA3oDWgM4YxaHR0cDovL0VWU2VjdXJlLWNybC52ZXJpc2lnbi5jb20vRVZTZWN1
-cmUyMDA2LmNybDBEBgNVHSAEPTA7MDkGC2CGSAGG+EUBBxcGMCowKAYIKwYBBQUH
-AgEWHGh0dHBzOi8vd3d3LnZlcmlzaWduLmNvbS9ycGEwHQYDVR0lBBYwFAYIKwYB
-BQUHAwEGCCsGAQUFBwMCMB8GA1UdIwQYMBaAFPyKULqeuSVae1WFT5UAY4/pWGtD
-MHwGCCsGAQUFBwEBBHAwbjAtBggrBgEFBQcwAYYhaHR0cDovL0VWU2VjdXJlLW9j
-c3AudmVyaXNpZ24uY29tMD0GCCsGAQUFBzAChjFodHRwOi8vRVZTZWN1cmUtYWlh
-LnZlcmlzaWduLmNvbS9FVlNlY3VyZTIwMDYuY2VyMG4GCCsGAQUFBwEMBGIwYKFe
-oFwwWjBYMFYWCWltYWdlL2dpZjAhMB8wBwYFKw4DAhoEFEtruSiWBgy70FI4myms
-SweLIQUYMCYWJGh0dHA6Ly9sb2dvLnZlcmlzaWduLmNvbS92c2xvZ28xLmdpZjAN
-BgkqhkiG9w0BAQUFAAOCAQEACNvSG4VmJCidoFDNgMmsqJ5HAfXkoEuED7wBJcGQ
-eLtQ8G/FLVrbsbXRiyxa/ytYWKqX1hkPrhgx9P9DlBlQvOl2/VHBznTqczhgxKnT
-OXJeGwnr7IgCsgyd6vJ2g27Crv9954NRmrG0GttPbTHNkeEmQUJsgVEOkOdiQm+J
-mVwTctfQe0W6WKdgIid+x5XvkfdYgYOrZTYBUUCz0eqZaSGliTiestyMnluZRBRG
-hkOPeahGh/IWonrwil4hWDIx1Yas0pR/9Pzr4BeW0LlQqbvrFif2mdsJcqKSPQ4I
-O4XIL3vqiJiv9GWRRIZl5DJAwjlPZ6W2X0KUeFAYGwvDDw==
------END CERTIFICATE-----
diff --git a/t/data/cert_twitter.crt.pem_dump b/t/data/cert_twitter.crt.pem_dump
deleted file mode 100644
index 279c011..0000000
--- a/t/data/cert_twitter.crt.pem_dump
+++ /dev/null
@@ -1,284 +0,0 @@
-
-# exported via command: perl examples/x509_cert_details.pl -dump -pem t/data/cert_twitter.crt.pem > t/data/cert_twitter.crt.pem_dump
-# hashref dumped via Data::Dump
-{
- cdp => ["http://EVSecure-crl.verisign.com/EVSecure2006.crl"],
- certificate_type => 49,
- digest_sha1 => {
- pubkey => pack("H*","e83040f63d9b25c1b1318e13f5de899415cd063f"),
- x509 => pack("H*","ea9defd63361d97671e16c689f54a659d7f10e66"),
- },
- extensions => {
- count => 10,
- entries => [
- {
- critical => 0,
- data => "DNS:www.twitter.com, DNS:twitter.com",
- ln => "X509v3 Subject Alternative Name",
- nid => 85,
- oid => "2.5.29.17",
- sn => "subjectAltName",
- },
- {
- critical => 0,
- data => "CA:FALSE",
- ln => "X509v3 Basic Constraints",
- nid => 87,
- oid => "2.5.29.19",
- sn => "basicConstraints",
- },
- {
- critical => 0,
- data => "E8:30:40:F6:3D:9B:25:C1:B1:31:8E:13:F5:DE:89:94:15:CD:06:3F",
- ln => "X509v3 Subject Key Identifier",
- nid => 82,
- oid => "2.5.29.14",
- sn => "subjectKeyIdentifier",
- },
- {
- critical => 0,
- data => "Digital Signature, Key Encipherment",
- ln => "X509v3 Key Usage",
- nid => 83,
- oid => "2.5.29.15",
- sn => "keyUsage",
- },
- {
- critical => 0,
- data => "\nFull Name:\n URI:http://EVSecure-crl.verisign.com/EVSecure2006.crl\n",
- ln => "X509v3 CRL Distribution Points",
- nid => 103,
- oid => "2.5.29.31",
- sn => "crlDistributionPoints",
- },
- {
- critical => 0,
- data => "Policy: 2.16.840.1.113733.1.7.23.6\n CPS: https://www.verisign.com/rpa\n",
- ln => "X509v3 Certificate Policies",
- nid => 89,
- oid => "2.5.29.32",
- sn => "certificatePolicies",
- },
- {
- critical => 0,
- data => "TLS Web Server Authentication, TLS Web Client Authentication",
- ln => "X509v3 Extended Key Usage",
- nid => 126,
- oid => "2.5.29.37",
- sn => "extendedKeyUsage",
- },
- {
- critical => 0,
- data => "keyid:FC:8A:50:BA:9E:B9:25:5A:7B:55:85:4F:95:00:63:8F:E9:58:6B:43\n",
- ln => "X509v3 Authority Key Identifier",
- nid => 90,
- oid => "2.5.29.35",
- sn => "authorityKeyIdentifier",
- },
- {
- critical => 0,
- data => "OCSP - URI:http://EVSecure-ocsp.verisign.com\nCA Issuers - URI:http://EVSecure-aia.verisign.com/EVSecure2006.cer\n",
- ln => "Authority Information Access",
- nid => 177,
- oid => "1.3.6.1.5.5.7.1.1",
- sn => "authorityInfoAccess",
- },
- {
- critical => 0,
- data => undef,
- ln => undef,
- nid => undef,
- oid => "1.3.6.1.5.5.7.1.12",
- sn => undef,
- },
- ],
- },
- extkeyusage => {
- ln => [
- "TLS Web Server Authentication",
- "TLS Web Client Authentication",
- ],
- nid => [129, 130],
- oid => ["1.3.6.1.5.5.7.3.1", "1.3.6.1.5.5.7.3.2"],
- sn => ["serverAuth", "clientAuth"],
- },
- fingerprint => {
- md5 => "34:A7:92:6A:78:82:D5:3F:11:C4:66:D0:70:66:CF:E1",
- sha1 => "EA:9D:EF:D6:33:61:D9:76:71:E1:6C:68:9F:54:A6:59:D7:F1:0E:66",
- },
- hash => {
- issuer => { dec => 1853825729, hex => "6E7F22C1" },
- issuer_and_serial => { dec => 2422658675, hex => "9066D673" },
- subject => { dec => 3318511233, hex => "C5CC7681" },
- },
- issuer => {
- count => 5,
- entries => [
- {
- data => "US",
- data_utf8_decoded => "US",
- ln => "countryName",
- nid => 14,
- oid => "2.5.4.6",
- sn => "C",
- },
- {
- data => "VeriSign, Inc.",
- data_utf8_decoded => "VeriSign, Inc.",
- ln => "organizationName",
- nid => 17,
- oid => "2.5.4.10",
- sn => "O",
- },
- {
- data => "VeriSign Trust Network",
- data_utf8_decoded => "VeriSign Trust Network",
- ln => "organizationalUnitName",
- nid => 18,
- oid => "2.5.4.11",
- sn => "OU",
- },
- {
- data => "Terms of use at https://www.verisign.com/rpa (c)06",
- data_utf8_decoded => "Terms of use at https://www.verisign.com/rpa (c)06",
- ln => "organizationalUnitName",
- nid => 18,
- oid => "2.5.4.11",
- sn => "OU",
- },
- {
- data => "VeriSign Class 3 Extended Validation SSL CA",
- data_utf8_decoded => "VeriSign Class 3 Extended Validation SSL CA",
- ln => "commonName",
- nid => 13,
- oid => "2.5.4.3",
- sn => "CN",
- },
- ],
- oneline => "/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use at https://www.verisign.com/rpa (c)06/CN=VeriSign Class 3 Extended Validation SSL CA",
- print_rfc2253 => "CN=VeriSign Class 3 Extended Validation SSL CA,OU=Terms of use at https://www.verisign.com/rpa (c)06,OU=VeriSign Trust Network,O=VeriSign\\, Inc.,C=US",
- print_rfc2253_utf8 => "CN=VeriSign Class 3 Extended Validation SSL CA,OU=Terms of use at https://www.verisign.com/rpa (c)06,OU=VeriSign Trust Network,O=VeriSign\\, Inc.,C=US",
- print_rfc2253_utf8_decoded => "CN=VeriSign Class 3 Extended Validation SSL CA,OU=Terms of use at https://www.verisign.com/rpa (c)06,OU=VeriSign Trust Network,O=VeriSign\\, Inc.,C=US",
- },
- keyusage => ["digitalSignature", "keyEncipherment"],
- not_after => "2012-07-27T23:59:59Z",
- not_before => "2011-07-07T00:00:00Z",
- ns_cert_type => [],
- pubkey_alg => "rsaEncryption",
- pubkey_bits => 2048,
- pubkey_id => 6,
- pubkey_size => 256,
- serial => {
- dec => "30779233835142701104683847010155075586",
- hex => "1727DD643E4236F87F79BB046BC19802",
- long => -1,
- },
- signature_alg => "sha1WithRSAEncryption",
- subject => {
- altnames => [2, "www.twitter.com", 2, "twitter.com"],
- count => 12,
- entries => [
- {
- data => "US",
- data_utf8_decoded => "US",
- ln => undef,
- nid => undef,
- oid => "1.3.6.1.4.1.311.60.2.1.3",
- sn => undef,
- },
- {
- data => "Delaware",
- data_utf8_decoded => "Delaware",
- ln => undef,
- nid => undef,
- oid => "1.3.6.1.4.1.311.60.2.1.2",
- sn => undef,
- },
- {
- data => "Private Organization",
- data_utf8_decoded => "Private Organization",
- ln => "businessCategory",
- nid => 860,
- oid => "2.5.4.15",
- sn => "businessCategory",
- },
- {
- data => 4337446,
- data_utf8_decoded => 4337446,
- ln => "serialNumber",
- nid => 105,
- oid => "2.5.4.5",
- sn => "serialNumber",
- },
- {
- data => "US",
- data_utf8_decoded => "US",
- ln => "countryName",
- nid => 14,
- oid => "2.5.4.6",
- sn => "C",
- },
- {
- data => 94107,
- data_utf8_decoded => 94107,
- ln => "postalCode",
- nid => 661,
- oid => "2.5.4.17",
- sn => "postalCode",
- },
- {
- data => "California",
- data_utf8_decoded => "California",
- ln => "stateOrProvinceName",
- nid => 16,
- oid => "2.5.4.8",
- sn => "ST",
- },
- {
- data => "San Francisco",
- data_utf8_decoded => "San Francisco",
- ln => "localityName",
- nid => 15,
- oid => "2.5.4.7",
- sn => "L",
- },
- {
- data => "795 Folsom St, Suite 600",
- data_utf8_decoded => "795 Folsom St, Suite 600",
- ln => "streetAddress",
- nid => 660,
- oid => "2.5.4.9",
- sn => "street",
- },
- {
- data => "Twitter, Inc.",
- data_utf8_decoded => "Twitter, Inc.",
- ln => "organizationName",
- nid => 17,
- oid => "2.5.4.10",
- sn => "O",
- },
- {
- data => "Twitter Operations",
- data_utf8_decoded => "Twitter Operations",
- ln => "organizationalUnitName",
- nid => 18,
- oid => "2.5.4.11",
- sn => "OU",
- },
- {
- data => "twitter.com",
- data_utf8_decoded => "twitter.com",
- ln => "commonName",
- nid => 13,
- oid => "2.5.4.3",
- sn => "CN",
- },
- ],
- oneline => "/1.3.6.1.4.1.311.60.2.1.3=US/1.3.6.1.4.1.311.60.2.1.2=Delaware/businessCategory=Private Organization/serialNumber=4337446/C=US/postalCode=94107/ST=California/L=San Francisco/street=795 Folsom St, Suite 600/O=Twitter, Inc./OU=Twitter Operations/CN=twitter.com",
- print_rfc2253 => "CN=twitter.com,OU=Twitter Operations,O=Twitter\\, Inc.,street=795 Folsom St\\, Suite 600,L=San Francisco,ST=California,postalCode=94107,C=US,serialNumber=4337446,businessCategory=Private Organization,1.3.6.1.4.1.311.60.2.1.2=#130844656C6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553",
- print_rfc2253_utf8 => "CN=twitter.com,OU=Twitter Operations,O=Twitter\\, Inc.,street=795 Folsom St\\, Suite 600,L=San Francisco,ST=California,postalCode=94107,C=US,serialNumber=4337446,businessCategory=Private Organization,1.3.6.1.4.1.311.60.2.1.2=#130844656C6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553",
- print_rfc2253_utf8_decoded => "CN=twitter.com,OU=Twitter Operations,O=Twitter\\, Inc.,street=795 Folsom St\\, Suite 600,L=San Francisco,ST=California,postalCode=94107,C=US,serialNumber=4337446,businessCategory=Private Organization,1.3.6.1.4.1.311.60.2.1.2=#130844656C6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553",
- },
- version => 2,
-}
diff --git a/t/data/chain_leaf.crt.pem b/t/data/chain_leaf.crt.pem
new file mode 100644
index 0000000..2b382b7
--- /dev/null
+++ b/t/data/chain_leaf.crt.pem
@@ -0,0 +1,45 @@
+-----BEGIN CERTIFICATE-----
+MIICmjCCAYICAQEwDQYJKoZIhvcNAQELBQAwFzEVMBMGA1UEAwwMSW50ZXJtZWRp
+YXRlMB4XDTE5MDQxNzE1MTY1M1oXDTI5MDQxNDE1MTY1M1owDzENMAsGA1UEAwwE
+TGVhZjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAOa0eYS3XsiXadYF
+53ZTfaNhbbkpCWnFddFQ/c3Z7QToJ6DkTiqDNTpHodvrG+CFDVuO0RJONQDf4jH6
+6B6ityFYWc4RkAPqfat0k7NZpj5dVWp9uDgmEWABmf0KE9WqzYDbtTljlS1POHI9
+UFCdF3/T0UbGtdKSzzo/STJf8vLOTf5YJQZHImvZeQbCgXtBN8hdLtfdU5FQYbaK
+cGyDvW6mBg1ZxYgJx+hE9NNeAsAWp2rAXGZIatQ98KNmwY5VH6cBX4ggasQucUUI
+Bg5ih7fvWP2k0FyaiIsme9nWLsbuNg3s3tMahuRO1rE0Z0Vj/5JBUmT6J27ZBKGZ
+Rn7C2x8CAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAgleJwB7rE7w+B4jlRqP72kkR
+XL7MZSV2vr+CTS4t+iLlbHweApiEJmQ3szY69d/gtdznSacp8CHOGihRazRsudn2
+G6QHbjXNBs16KnEEnHiIbk0YrnAa0xxrKvxOHPX+lfvYEcN2QqVtiFF0IsTqck8I
+vMYYe5zf4RDd2S1q31l67LoFSmFhrAqPbDITrx8tMhyAEW6zNxNkCaM/+8Bu94E3
+Ec7QDmpbE4Qz80qzmCmpv7NBnvrn0uYO1IkPrq2XetbhWHoliYImeS2OojdnPVbx
+sP1q5i9FYnnvFA8xl4TORjqtIajX6bXVkWZBXkbtDGKLnxzJ+vPagxwEzOphmA==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICIjCCAYugAwIBAgIDEjRWMA0GCSqGSIb3DQEBBQUAMCsxCzAJBgNVBAYTAlVT
+MQ4wDAYDVQQKEwVEZW1vMTEMMAoGA1UEAxMDQ0ExMCAXDTEyMDEwMTAwMDAwMFoY
+DzIxMTExMjMxMjM1OTU5WjArMQswCQYDVQQGEwJVUzEOMAwGA1UEChMFRGVtbzEx
+DDAKBgNVBAMTA0NBMTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAy1ygNguH
+72n0l+1uy9HEM6t2LWJEmC0w4tAuXk9H1FseQMV28eBQXdyg3wK+yli6l6c9k9Aj
+HAZ/6TXTVmOxtTgkXbvHlwcE3pTiHJSvZWGQMORCPNkjjiVBiLBdGQ3qFKyV+NA5
+K4XnVy0jkeS/BHx7KO7m+DOLVow8FO1CstUCAwEAAaNSMFAwDwYDVR0TAQH/BAUw
+AwEB/zAdBgNVHQ4EFgQUyBzakgqpSAg6dnYVOATxNNkV0CAwCwYDVR0PBAQDAgEG
+MBEGCWCGSAGG+EIBAQQEAwIABzANBgkqhkiG9w0BAQUFAAOBgQBG1QBfo1kZRN50
+/a3ZoQufIj0FJLMS/WkUnW0RLqEewyhEK9u86eoglcz5SxdD4T+VN9+MxoZ2J83P
+b21Y4FUDqnkdoGAPdoxX+7iLQcxVoMK72n72QSSzvfnjsr9+pazLp1P6ZK9epbZf
+s2WM0ty3a+sYmXANG8wGazAyRDMi0Q==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICTzCCAbigAwIBAgIBAjANBgkqhkiG9w0BAQsFADArMQswCQYDVQQGEwJVUzEO
+MAwGA1UEChMFRGVtbzExDDAKBgNVBAMTA0NBMTAeFw0xOTA0MTcxNTEzMjFaFw0y
+OTA0MTQxNTEzMjFaMBcxFTATBgNVBAMMDEludGVybWVkaWF0ZTCCASIwDQYJKoZI
+hvcNAQEBBQADggEPADCCAQoCggEBAMjKRTFhhQvcFd8kkjjevKPjZRFmhd5zVWAB
+tqrAEdhWwxpI3Jg1j49sbBWL2WKFhASPzYgPTE1CTQ6eH46ySmgLt8qzdPp8+kiC
+RDU0h7j0YQS2jLIgMsF2J8Xt8RRjjgAw25Mv2ZgppdUR8xr6KpqIaUqsve0a8wCu
+8ZFCaGMd0OcRGd7HaGSZ3Inafa8r3XtJ+HT+6iJLKyRfvwVv+9bYyyQKW8gVxMBs
+51bSfELsgMzNi61HHLzp3LIE7LpWCsjiZiRIC32ZRLBzhg6Nia/TY3ooyYJJI1mH
+gGAxO2QbYuRpKjitLvTxrGhGljAnbs+jbYoGz9PqLkHsmcV2YVMCAwEAAaMTMBEw
+DwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOBgQC5/u770nJSh9Iev0OA
+0tZ7lsVAJisJEHN34plK1oUD76mFh514ntLLDElfzMYJfXpL0WD87nisIeLpXysC
+BC3QQgqfpbylZtFON5W5lxyjfVnQwFsvDC3UdK6rxCoFk/zvHeU5dahwGUHN7t7G
+lJm4FfFveSZwMn7Pvgq1eKNJ4g==
+-----END CERTIFICATE-----
diff --git a/t/data/chain_twitter.crt.pem b/t/data/chain_twitter.crt.pem
deleted file mode 100755
index 9dd5f7a..0000000
--- a/t/data/chain_twitter.crt.pem
+++ /dev/null
@@ -1,95 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIG6DCCBdCgAwIBAgIQDmdXKeZyRvcaXeXGF6L5UTANBgkqhkiG9w0BAQsFADB1
-MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
-d3cuZGlnaWNlcnQuY29tMTQwMgYDVQQDEytEaWdpQ2VydCBTSEEyIEV4dGVuZGVk
-IFZhbGlkYXRpb24gU2VydmVyIENBMB4XDTE4MDIyMzAwMDAwMFoXDTE5MDQwODEy
-MDAwMFowgeQxHTAbBgNVBA8MFFByaXZhdGUgT3JnYW5pemF0aW9uMRMwEQYLKwYB
-BAGCNzwCAQMTAlVTMRkwFwYLKwYBBAGCNzwCAQITCERlbGF3YXJlMRAwDgYDVQQF
-Ewc0MzM3NDQ2MQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQG
-A1UEBxMNU2FuIEZyYW5jaXNjbzEWMBQGA1UEChMNVHdpdHRlciwgSW5jLjEZMBcG
-A1UECxMQVHdpdHRlciBTZWN1cml0eTEUMBIGA1UEAxMLdHdpdHRlci5jb20wggEi
-MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDRDIxB2Cj0SQtIOuWHjdzO5XKD
-lqUEFW69HmazatAWqN0Up9jel/8GMzfwMso650IRBBrhvJTPc3TdHn/JEscGAcnp
-IRrZkbTtpKMIJeNuWiACQosREt0Ur8gGLce4PJlt2BqMRJJ++SE8eV9Ryyl2Sgm+
-kqY65SML27IecrOkNmMuZKIUw/gLpt8msOnxy5JJWsjA3z9ND6FAx2DCbZ5GDIpt
-gK07FIV2z+cg1MStpf1TbgZ93pmmX9hnFk4F7VDS6Uf2K5YsPdsI0SwpW9HiG3TK
-9oz2GvsXffU6HGGM9Vcrpi5WhlaYHT1xCQ13caOduBxCkwhRZY2AFdyCR2MpAgMB
-AAGjggMCMIIC/jAfBgNVHSMEGDAWgBQ901Cl1qCt7vNKYApl0yHU+PjWDzAdBgNV
-HQ4EFgQUjI1wmILOVLL4dplPJjT+dTMjsUUwJwYDVR0RBCAwHoILdHdpdHRlci5j
-b22CD3d3dy50d2l0dGVyLmNvbTAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYI
-KwYBBQUHAwEGCCsGAQUFBwMCMHUGA1UdHwRuMGwwNKAyoDCGLmh0dHA6Ly9jcmwz
-LmRpZ2ljZXJ0LmNvbS9zaGEyLWV2LXNlcnZlci1nMi5jcmwwNKAyoDCGLmh0dHA6
-Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9zaGEyLWV2LXNlcnZlci1nMi5jcmwwSwYDVR0g
-BEQwQjA3BglghkgBhv1sAgEwKjAoBggrBgEFBQcCARYcaHR0cHM6Ly93d3cuZGln
-aWNlcnQuY29tL0NQUzAHBgVngQwBATCBiAYIKwYBBQUHAQEEfDB6MCQGCCsGAQUF
-BzABhhhodHRwOi8vb2NzcC5kaWdpY2VydC5jb20wUgYIKwYBBQUHMAKGRmh0dHA6
-Ly9jYWNlcnRzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydFNIQTJFeHRlbmRlZFZhbGlk
-YXRpb25TZXJ2ZXJDQS5jcnQwDAYDVR0TAQH/BAIwADCCAQUGCisGAQQB1nkCBAIE
-gfYEgfMA8QB3AKS5CZC0GFgUh7sTosxncAo8NZgE+RvfuON3zQ7IDdwQAAABYcBN
-gy8AAAQDAEgwRgIhAOW65zPD/WuWN0kNEKx0LZBxTqLrQSkh6G7db+TT+FQcAiEA
-o9jTxePOzkuDoq+kO/FY8wKYp+/RWLXj2VbL8wKI/SkAdgBWFAaaL9fC7NP14b1E
-sj7HRna5vJkRXMDvlJhV1onQ3QAAAWHATYOxAAAEAwBHMEUCIQCUWpCOm+ejKxg1
-LyfPlxMEyTqmEyrajGx8PbTaBet8XwIgUKQXhoLMKb66Cvs4goSt3wWLDkX4WmFW
-DPcR9Mbq87gwDQYJKoZIhvcNAQELBQADggEBAJlV+Uez02kinJi7AHiYujgJ5j1k
-icieSrL+qspP6CMv6OCAa353vrVc95+iwDWimE9ovJZrANWpW2bNHClLb/R4pjlc
-yDpzXdCzrQzkqUXmIZZ95hU7SxC56fC3ybINy2e2YqOjUPxBoZjZjWBa20opMMxg
-ntG1ZqcZ9mZE7JJbOqfCyFbe5eyszpujATD3K24IVW5IXdzWd1udumbL5jUdYA56
-TjnyBCxlBjjLdQt2IWOiMATp+IlslwEpNScMl/gSLEX5b550/tn/5MaIY7cPNG38
-WNiLTkomw//7coTN6HdctcTSojOWQqjl8PLzcG+UxZd3vFe7Kf07VFBHav4=
------END CERTIFICATE-----
-
-subject=C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert High Assurance EV Root CA
-
-issuer=C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert High Assurance EV Root CA
-
------BEGIN CERTIFICATE-----
-MIIDxTCCAq2gAwIBAgIQAqxcJmoLQJuPC3nyrkYldzANBgkqhkiG9w0BAQUFADBs
-MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
-d3cuZGlnaWNlcnQuY29tMSswKQYDVQQDEyJEaWdpQ2VydCBIaWdoIEFzc3VyYW5j
-ZSBFViBSb290IENBMB4XDTA2MTExMDAwMDAwMFoXDTMxMTExMDAwMDAwMFowbDEL
-MAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3
-LmRpZ2ljZXJ0LmNvbTErMCkGA1UEAxMiRGlnaUNlcnQgSGlnaCBBc3N1cmFuY2Ug
-RVYgUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMbM5XPm
-+9S75S0tMqbf5YE/yc0lSbZxKsPVlDRnogocsF9ppkCxxLeyj9CYpKlBWTrT3JTW
-PNt0OKRKzE0lgvdKpVMSOO7zSW1xkX5jtqumX8OkhPhPYlG++MXs2ziS4wblCJEM
-xChBVfvLWokVfnHoNb9Ncgk9vjo4UFt3MRuNs8ckRZqnrG0AFFoEt7oT61EKmEFB
-Ik5lYYeBQVCmeVyJ3hlKV9Uu5l0cUyx+mM0aBhakaHPQNAQTXKFx01p8VdteZOE3
-hzBWBOURtCmAEvF5OYiiAhF8J2a3iLd48soKqDirCmTCv2ZdlYTBoSUeh10aUAsg
-EsxBu24LUTi4S8sCAwEAAaNjMGEwDgYDVR0PAQH/BAQDAgGGMA8GA1UdEwEB/wQF
-MAMBAf8wHQYDVR0OBBYEFLE+w2kD+L9HAdSYJhoIAu9jZCvDMB8GA1UdIwQYMBaA
-FLE+w2kD+L9HAdSYJhoIAu9jZCvDMA0GCSqGSIb3DQEBBQUAA4IBAQAcGgaX3Nec
-nzyIZgYIVyHbIUf4KmeqvxgydkAQV8GK83rZEWWONfqe/EW1ntlMMUu4kehDLI6z
-eM7b41N5cdblIZQB2lWHmiRk9opmzN6cN82oNLFpmyPInngiK3BD41VHMWEZ71jF
-hS9OMPagMRYjyOfiZRYzy78aG6A9+MpeizGLYAiJLQwGXFK3xPkKmNEVX58Svnw2
-Yzi9RKR/5CYrCsSXaQ3pjOLAEFe4yHYSkVXySGnYvCoCWw9E1CAx2/S6cCZdkGCe
-vEsXCS+0yx5DaMkHJ8HSXPfqIbloEpw8nL+e/IBcm2PN7EeqJSdnoDfzAIJ9VNep
-+OkuE6N36B9K
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIEtjCCA56gAwIBAgIQDHmpRLCMEZUgkmFf4msdgzANBgkqhkiG9w0BAQsFADBs
-MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
-d3cuZGlnaWNlcnQuY29tMSswKQYDVQQDEyJEaWdpQ2VydCBIaWdoIEFzc3VyYW5j
-ZSBFViBSb290IENBMB4XDTEzMTAyMjEyMDAwMFoXDTI4MTAyMjEyMDAwMFowdTEL
-MAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3
-LmRpZ2ljZXJ0LmNvbTE0MDIGA1UEAxMrRGlnaUNlcnQgU0hBMiBFeHRlbmRlZCBW
-YWxpZGF0aW9uIFNlcnZlciBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC
-ggEBANdTpARR+JmmFkhLZyeqk0nQOe0MsLAAh/FnKIaFjI5j2ryxQDji0/XspQUY
-uD0+xZkXMuwYjPrxDKZkIYXLBxA0sFKIKx9om9KxjxKws9LniB8f7zh3VFNfgHk/
-LhqqqB5LKw2rt2O5Nbd9FLxZS99RStKh4gzikIKHaq7q12TWmFXo/a8aUGxUvBHy
-/Urynbt/DvTVvo4WiRJV2MBxNO723C3sxIclho3YIeSwTQyJ3DkmF93215SF2AQh
-cJ1vb/9cuhnhRctWVyh+HA1BV6q3uCe7seT6Ku8hI3UarS2bhjWMnHe1c63YlC3k
-8wyd7sFOYn4XwHGeLN7x+RAoGTMCAwEAAaOCAUkwggFFMBIGA1UdEwEB/wQIMAYB
-Af8CAQAwDgYDVR0PAQH/BAQDAgGGMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEF
-BQcDAjA0BggrBgEFBQcBAQQoMCYwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRp
-Z2ljZXJ0LmNvbTBLBgNVHR8ERDBCMECgPqA8hjpodHRwOi8vY3JsNC5kaWdpY2Vy
-dC5jb20vRGlnaUNlcnRIaWdoQXNzdXJhbmNlRVZSb290Q0EuY3JsMD0GA1UdIAQ2
-MDQwMgYEVR0gADAqMCgGCCsGAQUFBwIBFhxodHRwczovL3d3dy5kaWdpY2VydC5j
-b20vQ1BTMB0GA1UdDgQWBBQ901Cl1qCt7vNKYApl0yHU+PjWDzAfBgNVHSMEGDAW
-gBSxPsNpA/i/RwHUmCYaCALvY2QrwzANBgkqhkiG9w0BAQsFAAOCAQEAnbbQkIbh
-hgLtxaDwNBx0wY12zIYKqPBKikLWP8ipTa18CK3mtlC4ohpNiAexKSHc59rGPCHg
-4xFJcKx6HQGkyhE6V6t9VypAdP3THYUYUN9XR3WhfVUgLkc3UHKMf4Ib0mKPLQNa
-2sPIoc4sUqIAY+tzunHISScjl2SFnjgOrWNoPLpSgVh5oywM395t6zHyuqB8bPEs
-1OG9d4Q3A84ytciagRpKkk47RpqF/oOi+Z6Mo8wNXrM9zwR4jxQUezKcxwCmXMS1
-oVWNWlZopCJwqjyBcdmdqEU79OX2olHdx3ti6G8MdOu42vi/hw15UJGQmxg7kVkn
-8TUoE6smftX3eg==
------END CERTIFICATE-----
diff --git a/t/data/digicert.crt.pem b/t/data/digicert.crt.pem
deleted file mode 100755
index 9e6810a..0000000
--- a/t/data/digicert.crt.pem
+++ /dev/null
@@ -1,23 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDxTCCAq2gAwIBAgIQAqxcJmoLQJuPC3nyrkYldzANBgkqhkiG9w0BAQUFADBs
-MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
-d3cuZGlnaWNlcnQuY29tMSswKQYDVQQDEyJEaWdpQ2VydCBIaWdoIEFzc3VyYW5j
-ZSBFViBSb290IENBMB4XDTA2MTExMDAwMDAwMFoXDTMxMTExMDAwMDAwMFowbDEL
-MAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3
-LmRpZ2ljZXJ0LmNvbTErMCkGA1UEAxMiRGlnaUNlcnQgSGlnaCBBc3N1cmFuY2Ug
-RVYgUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMbM5XPm
-+9S75S0tMqbf5YE/yc0lSbZxKsPVlDRnogocsF9ppkCxxLeyj9CYpKlBWTrT3JTW
-PNt0OKRKzE0lgvdKpVMSOO7zSW1xkX5jtqumX8OkhPhPYlG++MXs2ziS4wblCJEM
-xChBVfvLWokVfnHoNb9Ncgk9vjo4UFt3MRuNs8ckRZqnrG0AFFoEt7oT61EKmEFB
-Ik5lYYeBQVCmeVyJ3hlKV9Uu5l0cUyx+mM0aBhakaHPQNAQTXKFx01p8VdteZOE3
-hzBWBOURtCmAEvF5OYiiAhF8J2a3iLd48soKqDirCmTCv2ZdlYTBoSUeh10aUAsg
-EsxBu24LUTi4S8sCAwEAAaNjMGEwDgYDVR0PAQH/BAQDAgGGMA8GA1UdEwEB/wQF
-MAMBAf8wHQYDVR0OBBYEFLE+w2kD+L9HAdSYJhoIAu9jZCvDMB8GA1UdIwQYMBaA
-FLE+w2kD+L9HAdSYJhoIAu9jZCvDMA0GCSqGSIb3DQEBBQUAA4IBAQAcGgaX3Nec
-nzyIZgYIVyHbIUf4KmeqvxgydkAQV8GK83rZEWWONfqe/EW1ntlMMUu4kehDLI6z
-eM7b41N5cdblIZQB2lWHmiRk9opmzN6cN82oNLFpmyPInngiK3BD41VHMWEZ71jF
-hS9OMPagMRYjyOfiZRYzy78aG6A9+MpeizGLYAiJLQwGXFK3xPkKmNEVX58Svnw2
-Yzi9RKR/5CYrCsSXaQ3pjOLAEFe4yHYSkVXySGnYvCoCWw9E1CAx2/S6cCZdkGCe
-vEsXCS+0yx5DaMkHJ8HSXPfqIbloEpw8nL+e/IBcm2PN7EeqJSdnoDfzAIJ9VNep
-+OkuE6N36B9K
------END CERTIFICATE-----
diff --git a/t/data/test_CAinter.crt.pem b/t/data/test_CAinter.crt.pem
new file mode 100644
index 0000000..12e978f
--- /dev/null
+++ b/t/data/test_CAinter.crt.pem
@@ -0,0 +1,15 @@
+-----BEGIN CERTIFICATE-----
+MIICTzCCAbigAwIBAgIBAjANBgkqhkiG9w0BAQsFADArMQswCQYDVQQGEwJVUzEO
+MAwGA1UEChMFRGVtbzExDDAKBgNVBAMTA0NBMTAeFw0xOTA0MTcxNTEzMjFaFw0y
+OTA0MTQxNTEzMjFaMBcxFTATBgNVBAMMDEludGVybWVkaWF0ZTCCASIwDQYJKoZI
+hvcNAQEBBQADggEPADCCAQoCggEBAMjKRTFhhQvcFd8kkjjevKPjZRFmhd5zVWAB
+tqrAEdhWwxpI3Jg1j49sbBWL2WKFhASPzYgPTE1CTQ6eH46ySmgLt8qzdPp8+kiC
+RDU0h7j0YQS2jLIgMsF2J8Xt8RRjjgAw25Mv2ZgppdUR8xr6KpqIaUqsve0a8wCu
+8ZFCaGMd0OcRGd7HaGSZ3Inafa8r3XtJ+HT+6iJLKyRfvwVv+9bYyyQKW8gVxMBs
+51bSfELsgMzNi61HHLzp3LIE7LpWCsjiZiRIC32ZRLBzhg6Nia/TY3ooyYJJI1mH
+gGAxO2QbYuRpKjitLvTxrGhGljAnbs+jbYoGz9PqLkHsmcV2YVMCAwEAAaMTMBEw
+DwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOBgQC5/u770nJSh9Iev0OA
+0tZ7lsVAJisJEHN34plK1oUD76mFh514ntLLDElfzMYJfXpL0WD87nisIeLpXysC
+BC3QQgqfpbylZtFON5W5lxyjfVnQwFsvDC3UdK6rxCoFk/zvHeU5dahwGUHN7t7G
+lJm4FfFveSZwMn7Pvgq1eKNJ4g==
+-----END CERTIFICATE-----
diff --git a/t/data/test_CAinter.extensions b/t/data/test_CAinter.extensions
new file mode 100644
index 0000000..9a3aedb
--- /dev/null
+++ b/t/data/test_CAinter.extensions
@@ -0,0 +1 @@
+basicConstraints=critical,CA:TRUE
diff --git a/t/data/test_CAinter.key.pem b/t/data/test_CAinter.key.pem
new file mode 100644
index 0000000..3e6e9c2
--- /dev/null
+++ b/t/data/test_CAinter.key.pem
@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEpAIBAAKCAQEAyMpFMWGFC9wV3ySSON68o+NlEWaF3nNVYAG2qsAR2FbDGkjc
+mDWPj2xsFYvZYoWEBI/NiA9MTUJNDp4fjrJKaAu3yrN0+nz6SIJENTSHuPRhBLaM
+siAywXYnxe3xFGOOADDbky/ZmCml1RHzGvoqmohpSqy97RrzAK7xkUJoYx3Q5xEZ
+3sdoZJncidp9ryvde0n4dP7qIksrJF+/BW/71tjLJApbyBXEwGznVtJ8QuyAzM2L
+rUccvOncsgTsulYKyOJmJEgLfZlEsHOGDo2Jr9NjeijJgkkjWYeAYDE7ZBti5Gkq
+OK0u9PGsaEaWMCduz6NtigbP0+ouQeyZxXZhUwIDAQABAoIBAQCs7Nbukmg9MIx9
+o0dzRxD7rImMlNlSHc43YwJoyAYWZZKd/oZNaEN9aAkl/U149jgenaKLPXGfUCyB
+HFldUduXBBCDuE5UtHHxJI+NqvIAricoIffGKMjNqO7UHfp0btELBQj2GE20KJoz
+iMPwReePM1BLCb6Ah6ckvYY6bhDs2mfaQKwOHu7JuEinCf//5jjuqmCWSzLYSN6G
+Z8GZJ7wkqC5US1DzxW9S6XtfHpj1UIiasI6UriF0Zc3C/xD3v6rjXEhB7skiOs/5
+IReOL8HNISnMF9X5L3d1+JT0M7FE+jkST5IhplA0TxaMydf7mKl0yw30ujkfg5fM
+CxmaW0GBAoGBAO6YGs7SAcay3zT8f0gs/8DWP/Xnxn9MkQ3OetG6GHiP73rV+RZn
+72hp1l0GFjeRmEKu5yb9Fy1EHiXsee8ZKsBOmlZPBKB8/sPwKWBn3ZlxIiVQriuj
+5uMNwTgEdTVfSfrp0W4ho6hVc+6M301FkhYlHCaRIbPw8CadRlx4oBazAoGBANdw
+JsTBYFQoxDIeZMiXIDvdKoZV+jXluI9KvpCHCKQx36hLRBwYr0lQcXJWWcWyCfew
+6aBA6nw6aoPCpTvrD4n/wC0WPsAhqyOCB1yCH8cvMbul65AHx0sArGOa1xzZH8Eg
++GVj801MhQNMT8cXTUCVm5fs1qQVbYKWa+wD2trhAoGBAIVo7Yx5pt6Yw/AXw3/z
+EWqdIhR47efeQzlqHAjLOsWnDewsWuQpZ5eFnoRTU/bsZSvcKooFeIEqFoV0DdYg
+x2PST8A03Mx0N+wNjMVILoOO293rmAf01LRey4xsCbG3P2Gafi1Lh/wnE/TuNio5
+3W6ef3gdLLA158JfrKkmFbW7AoGABrt6equQVxDvEKHihGI0n6pJqekF6KlFGzU6
+v0l4+6iTVK8FcdtTnvbklK4eIA9wQE1G/7sHmNo6eeObRkQSOD3Fw6LuUxK6RmHJ
+2Ro35AGVjEejFN0pXS6oNHSiRESEuYROPtzgvYmmnnPECnSv9VS3iAferUH+KhaJ
+SNbWAAECgYBO4VJbt4EP08uQleYBoO9JVHVmYYKtavFL3YR08k4xh4qtndwVeRZT
+Z9ywS3maA383wvuCy3xUBmi0AY7xDvgaPaPYZT6YIaiosdEaMkI+juV/Uno96W+w
+wuRywxcAi1JNm3rbIGpUbdUxxo4ATOlD3C7A/X5AmRC24YRGol8Ciw==
+-----END RSA PRIVATE KEY-----
diff --git a/t/data/test_CAinter.req.pem b/t/data/test_CAinter.req.pem
new file mode 100644
index 0000000..dfb7a0f
--- /dev/null
+++ b/t/data/test_CAinter.req.pem
@@ -0,0 +1,15 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIICXDCCAUQCAQAwFzEVMBMGA1UEAwwMSW50ZXJtZWRpYXRlMIIBIjANBgkqhkiG
+9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyMpFMWGFC9wV3ySSON68o+NlEWaF3nNVYAG2
+qsAR2FbDGkjcmDWPj2xsFYvZYoWEBI/NiA9MTUJNDp4fjrJKaAu3yrN0+nz6SIJE
+NTSHuPRhBLaMsiAywXYnxe3xFGOOADDbky/ZmCml1RHzGvoqmohpSqy97RrzAK7x
+kUJoYx3Q5xEZ3sdoZJncidp9ryvde0n4dP7qIksrJF+/BW/71tjLJApbyBXEwGzn
+VtJ8QuyAzM2LrUccvOncsgTsulYKyOJmJEgLfZlEsHOGDo2Jr9NjeijJgkkjWYeA
+YDE7ZBti5GkqOK0u9PGsaEaWMCduz6NtigbP0+ouQeyZxXZhUwIDAQABoAAwDQYJ
+KoZIhvcNAQELBQADggEBAEwFJmFml/WqQebFs3/KvL174FUDzNRMfsNuekJHJAVY
+r3TjSWrhLhRq/O71gCFn/WnaE/GACciE3djW+Y61GYJ33kXsoxiKhmmGdfJmpND8
+6J5IglzsF2RedJZoZ+pwJ0XML1jSIjozxGSqNai++r9nKzVKve97JVSM1faBMuBf
+5fWn4uxE8ODlgFE2nAkd5srarGDgEtwqPaLwvWzlONhCK9iBvoSrvTo9It6ibjG+
+fnbHb3ZhkWXKrILEz3NSHRaQHlQxoDGBfHhxZGj0CfjcTj+piZzpyqxpIELP0jNO
+mKhN0Gg3nR2eU6XHjy0JRhqqADUF77SQRomwTTRE5eU=
+-----END CERTIFICATE REQUEST-----
diff --git a/t/data/test_leaf.crt.pem b/t/data/test_leaf.crt.pem
new file mode 100644
index 0000000..642e909
--- /dev/null
+++ b/t/data/test_leaf.crt.pem
@@ -0,0 +1,16 @@
+-----BEGIN CERTIFICATE-----
+MIICmjCCAYICAQEwDQYJKoZIhvcNAQELBQAwFzEVMBMGA1UEAwwMSW50ZXJtZWRp
+YXRlMB4XDTE5MDQxNzE1MTY1M1oXDTI5MDQxNDE1MTY1M1owDzENMAsGA1UEAwwE
+TGVhZjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAOa0eYS3XsiXadYF
+53ZTfaNhbbkpCWnFddFQ/c3Z7QToJ6DkTiqDNTpHodvrG+CFDVuO0RJONQDf4jH6
+6B6ityFYWc4RkAPqfat0k7NZpj5dVWp9uDgmEWABmf0KE9WqzYDbtTljlS1POHI9
+UFCdF3/T0UbGtdKSzzo/STJf8vLOTf5YJQZHImvZeQbCgXtBN8hdLtfdU5FQYbaK
+cGyDvW6mBg1ZxYgJx+hE9NNeAsAWp2rAXGZIatQ98KNmwY5VH6cBX4ggasQucUUI
+Bg5ih7fvWP2k0FyaiIsme9nWLsbuNg3s3tMahuRO1rE0Z0Vj/5JBUmT6J27ZBKGZ
+Rn7C2x8CAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAgleJwB7rE7w+B4jlRqP72kkR
+XL7MZSV2vr+CTS4t+iLlbHweApiEJmQ3szY69d/gtdznSacp8CHOGihRazRsudn2
+G6QHbjXNBs16KnEEnHiIbk0YrnAa0xxrKvxOHPX+lfvYEcN2QqVtiFF0IsTqck8I
+vMYYe5zf4RDd2S1q31l67LoFSmFhrAqPbDITrx8tMhyAEW6zNxNkCaM/+8Bu94E3
+Ec7QDmpbE4Qz80qzmCmpv7NBnvrn0uYO1IkPrq2XetbhWHoliYImeS2OojdnPVbx
+sP1q5i9FYnnvFA8xl4TORjqtIajX6bXVkWZBXkbtDGKLnxzJ+vPagxwEzOphmA==
+-----END CERTIFICATE-----
diff --git a/t/data/test_leaf.key.pem b/t/data/test_leaf.key.pem
new file mode 100644
index 0000000..bc7ecc3
--- /dev/null
+++ b/t/data/test_leaf.key.pem
@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEowIBAAKCAQEA5rR5hLdeyJdp1gXndlN9o2FtuSkJacV10VD9zdntBOgnoORO
+KoM1Okeh2+sb4IUNW47REk41AN/iMfroHqK3IVhZzhGQA+p9q3STs1mmPl1Van24
+OCYRYAGZ/QoT1arNgNu1OWOVLU84cj1QUJ0Xf9PRRsa10pLPOj9JMl/y8s5N/lgl
+Bkcia9l5BsKBe0E3yF0u191TkVBhtopwbIO9bqYGDVnFiAnH6ET0014CwBanasBc
+Zkhq1D3wo2bBjlUfpwFfiCBqxC5xRQgGDmKHt+9Y/aTQXJqIiyZ72dYuxu42Deze
+0xqG5E7WsTRnRWP/kkFSZPonbtkEoZlGfsLbHwIDAQABAoIBACt/2e3JOWjvC7ic
+EmGAKo9UvoCMGUdFQQq/j6txrLwhHd+7THW9mZqsiPtTYEU8MSGTUx51eo74p8iu
+u3eTTJ5P71boftQOMbXTXEoT3EGkDYfvvn1vyBTnGGbasJS4CNmEE66HdUg+yLDZ
+mLwqcpTalnoW24+huMsNxbpm1wMqwWqQstpWG7LL+BaPc3AlvS6A4Zk0wxF6av0P
+7AWcfqa+9tLIuphH0aJc6LTedkk65SfhGuJAl0p9mR8fLMtqpDIiyAzN6eteHKe8
+1+sSk0Qwm6wzPtk4EaT92dXTuRcsqHIGezsLtI0LRaXSTuVrwzYzS+DPyvsm/3h4
+fx9+FukCgYEA88yVSAsFRXBpcM5QOVgHMT0gr2y/ieCvcn6IV9s/rTs3P4Lnp7u3
+INHjOKEIIKDo1i/++RfLy6gZFJolT2AoO5KwgGh7gAzQhTaeiRFe0guDfQ/TyqIy
+jZkCuhue9ONqOEBJzf8d7yoLIGuABQmmwd9ynUmEUj6ZwA9R+cq3q5MCgYEA8kAi
+61ZvAT0oqheZSrxNCXXAYUtJno1btZL6eGn5yZJYY686TAR/sXZ/VprkBPljLSKC
+2SMy+3cJylmB1hDE1mPZVKOXb5GOxbZVcPlmRi3yVgSrRmWiR93o3Kk9Ee2Bozbh
+gGDSe75+k0zPvGuKWNFawLTgYnV2jHMe7jvmwcUCgYAcMLnKPMv9PYRTsOeB2fXq
+8aCH6FE1hi+DU7I8RnPUehZnV6GluYTxXJOjhqtD6pdBvQcEkoXUJLnRsglCZmIA
+kXOrRWmSYujxnmEyhDmsm/w2R9A7jAnAacLw9iSpOGqd2oEuOqOhdgEXXJbO/lCz
+9jxwh4GvaOGqXZsjARe/1QKBgFRK5Numk7GGqmOlGn3az6N/CZXRMKiu3z5rCiRk
+G7p75a2qB0r0Ncp2RRDJjJX+gPfvjkAn81F0tj9mrbri0tsWm0TMN6FmsJszOr+4
+yFGbIzuzHDW+n50KJkDB0rIuRnGYYxbcmeDdBAYVMCOL9/O3xTBQv9MCtGFinVyg
+E0dRAoGBAM/qws7uzcrr5m0YGrC7vkyONS2Cb9pzygjHpvwE/tUZA4+4LJYdHIVE
+j7FBejnhTL9o9HvDwBBEPZXoSt3Ev0TnF/LKR1PcuDHWhyDHphdkq7BSk1tswW5/
+NXVb289b59dV3QpwrLzF6jQtAvm1bUXc1PoNFhrBjFzUGLslz5Io
+-----END RSA PRIVATE KEY-----
diff --git a/t/data/test_leaf.req.pem b/t/data/test_leaf.req.pem
new file mode 100644
index 0000000..fcc5f45
--- /dev/null
+++ b/t/data/test_leaf.req.pem
@@ -0,0 +1,15 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIICVDCCATwCAQAwDzENMAsGA1UEAwwETGVhZjCCASIwDQYJKoZIhvcNAQEBBQAD
+ggEPADCCAQoCggEBAOa0eYS3XsiXadYF53ZTfaNhbbkpCWnFddFQ/c3Z7QToJ6Dk
+TiqDNTpHodvrG+CFDVuO0RJONQDf4jH66B6ityFYWc4RkAPqfat0k7NZpj5dVWp9
+uDgmEWABmf0KE9WqzYDbtTljlS1POHI9UFCdF3/T0UbGtdKSzzo/STJf8vLOTf5Y
+JQZHImvZeQbCgXtBN8hdLtfdU5FQYbaKcGyDvW6mBg1ZxYgJx+hE9NNeAsAWp2rA
+XGZIatQ98KNmwY5VH6cBX4ggasQucUUIBg5ih7fvWP2k0FyaiIsme9nWLsbuNg3s
+3tMahuRO1rE0Z0Vj/5JBUmT6J27ZBKGZRn7C2x8CAwEAAaAAMA0GCSqGSIb3DQEB
+CwUAA4IBAQAIZ7M0DLAkqPm8kdM+h53+BMkK2ngfb1K0qgRMAc3ij8ernF+QsqV1
+CiBk4w2bGQ+pxVf5XNjVuw0otV3C0NSlFSAmZXldXdJpW7WUWLG7HTstjjfNMJ3v
+9XxrqqoHBIvdWNk4Lni8nDqzm8SDtZRByqO9sv/Mlg2cq1A6TrQAOaDMz8YaHtom
+LFCzEkqtaxuG1fi5F5Px+HJQT3gF1shwdEED6pCuVIgGpNDBceZq76eweKC9WEOq
+77Is1jkfBC046dAVDpmz+avNbiP0SABemcSnvOJUnGM7EjLMY51OoZ0nc3CH0cO3
+RVw6jE12UUQXyaxEZqAbKCk0CXfAOIBw
+-----END CERTIFICATE REQUEST-----
diff --git a/t/local/32_x509_get_cert_info.t b/t/local/32_x509_get_cert_info.t
index 08d158d..b8b3dd6 100644
--- a/t/local/32_x509_get_cert_info.t
+++ b/t/local/32_x509_get_cert_info.t
@@ -2,7 +2,7 @@
use strict;
use warnings;
-use Test::More tests => 1261;
+use Test::More tests => 1016;
use Net::SSLeay;
use File::Spec;
use lib '.';
@@ -19,12 +19,11 @@ my $hash = Net::SSLeay::X509_NAME_hash($name);
ok ($hash = 4003674586, "X509_NAME_hash");
# NOTE: *.pem_dump files are generated by helper script e.g.:
-# perl examples/X509_cert_details.pl -dump -pem t/data/cert_twitter.crt.pem > t/data/cert_paypal.crt.pem_dump
+# perl examples/X509_cert_details.pl -dump -pem t/data/cert_paypal.crt.pem > t/data/cert_paypal.crt.pem_dump
#
# Caution from perl 25 onwards, need use lib '.'; above in order to 'do' these files
my $dump = {
"cert_paypal.crt.pem" => do(File::Spec->catfile('t', 'data', 'cert_paypal.crt.pem_dump')),
- "cert_twitter.crt.pem" => do(File::Spec->catfile('t', 'data', 'cert_twitter.crt.pem_dump')),
"testcert_extended.crt.pem" => do(File::Spec->catfile('t', 'data', 'testcert_extended.crt.pem_dump')),
"testcert_simple.crt.pem" => do(File::Spec->catfile('t', 'data', 'testcert_simple.crt.pem_dump')),
"testcert_strange.crt.pem" => do(File::Spec->catfile('t', 'data', 'testcert_strange.crt.pem_dump')),
diff --git a/t/local/33_x509_create_cert.t b/t/local/33_x509_create_cert.t
index 69a64b1..437524e 100755
--- a/t/local/33_x509_create_cert.t
+++ b/t/local/33_x509_create_cert.t
@@ -240,7 +240,7 @@ is(Net::SSLeay::X509_NAME_cmp($ca_issuer, $ca_subject), 0, "X509_NAME_cmp");
{ ### X509 certificate - copy some fields from other certificate
- my $orig_crt_pem = File::Spec->catfile('t', 'data', 'cert_twitter.crt.pem');
+ my $orig_crt_pem = File::Spec->catfile('t', 'data', 'test_leaf.crt.pem');
ok(my $bio = Net::SSLeay::BIO_new_file($orig_crt_pem, 'r'), "BIO_new_file");
ok(my $orig_cert = Net::SSLeay::PEM_read_bio_X509($bio), "PEM_read_bio_X509");
diff --git a/t/local/36_verify.t b/t/local/36_verify.t
index 66e369d..f7e908c 100644
--- a/t/local/36_verify.t
+++ b/t/local/36_verify.t
@@ -204,8 +204,8 @@ sub test_wildcard_checks
}
sub verify_local_trust {
- my $digicert_ca = File::Spec->catfile('t', 'data', 'digicert.crt.pem');
- my $twitter_chain = File::Spec->catfile('t', 'data', 'chain_twitter.crt.pem');
+ my $digicert_ca = File::Spec->catfile('t', 'data', 'test_CA1.crt.pem');
+ my $twitter_chain = File::Spec->catfile('t', 'data', 'chain_leaf.crt.pem');
# read in twitter chain
my $bio = Net::SSLeay::BIO_new_file($twitter_chain, 'r');
--
2.20.1

10
perl-Net-SSLeay.spec
View File

@ -10,7 +10,7 @@
Name: perl-Net-SSLeay
Version: 1.86
Release: 0.2.09%{?dist}
Release: 0.3.09%{?dist}
Summary: Perl extension for using OpenSSL
License: Artistic 2.0
URL: https://metacpan.org/release/Net-SSLeay
@ -18,6 +18,9 @@ Source0: https://cpan.metacpan.org/authors/id/C/CH/CHRISN/Net-SSLeay-%{cpan_vers
# Adapt tests to system-wide crypto policy, bug #1614884
Patch0: Net-SSLeay-1.85-Adapt-CTX_get_min_proto_version-tests-to-system-wide.patch
Patch10: Net-SSLeay-1.86_09-pkgconfig.patch
# Replace expired test certificates, CPAN RT#129201, proposed to upstream
# <https://github.com/radiator-software/p5-net-ssleay/pull/129>
Patch11: Net-SSLeay-1.86_09-Replace-Twitter-chain-with-our-own-chain.patch
# =========== Module Build ===========================
BuildRequires: coreutils
BuildRequires: findutils
@ -86,6 +89,8 @@ so you can write servers or clients for more complicated applications.
# https://github.com/radiator-software/p5-net-ssleay/pull/127
%patch10
%patch11 -p1
# Fix permissions in examples to avoid bogus doc-file dependencies
chmod -c 644 examples/*
@ -131,6 +136,9 @@ make test
%{_mandir}/man3/Net::SSLeay::Handle.3*
%changelog
* Thu Apr 18 2019 Petr Pisar <ppisar@redhat.com> - 1.86-0.3.09
- Replace expired test certificates (CPAN RT#129201)
* Fri Mar 29 2019 Paul Howarth <paul@city-fan.org> - 1.86-0.2.09
- Get libraries to link against from pkg-config
https://github.com/radiator-software/p5-net-ssleay/pull/127