From 3320d4f81c8454bac92a15925ce966e30c3cc53d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= Date: Thu, 18 Apr 2019 11:37:02 +0200 Subject: [PATCH] Replace expired test certificates --- ...ace-Twitter-chain-with-our-own-chain.patch | 828 ++++++++++++++++++ perl-Net-SSLeay.spec | 10 +- 2 files changed, 837 insertions(+), 1 deletion(-) create mode 100644 Net-SSLeay-1.86_09-Replace-Twitter-chain-with-our-own-chain.patch diff --git a/Net-SSLeay-1.86_09-Replace-Twitter-chain-with-our-own-chain.patch b/Net-SSLeay-1.86_09-Replace-Twitter-chain-with-our-own-chain.patch new file mode 100644 index 0000000..f01148e --- /dev/null +++ b/Net-SSLeay-1.86_09-Replace-Twitter-chain-with-our-own-chain.patch @@ -0,0 +1,828 @@ +From de64ed801edfa51fbd941a1a8e8bf23cdcb82e47 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= +Date: Thu, 18 Apr 2019 11:01:45 +0200 +Subject: [PATCH] Replace Twitter chain with our own chain +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +The Twitter's certiticate expires every year and thus tests fail when +it expires. + +This patch replaces it with a chain of certificates that we generate +(and can regenerate with t/data/Makefile anytime) with a 10-year +validity. + +It also adjusts other tests to use a different certificate from the +Twitter's one. That allows us to remove it completely. + + + + +Signed-off-by: Petr Písař +--- + MANIFEST | 15 +- + t/data/cert_twitter.crt.pem | 37 ---- + t/data/cert_twitter.crt.pem_dump | 284 ------------------------------- + t/data/chain_leaf.crt.pem | 45 +++++ + t/data/chain_twitter.crt.pem | 95 ----------- + t/data/digicert.crt.pem | 23 --- + t/data/test_CAinter.crt.pem | 15 ++ + t/data/test_CAinter.extensions | 1 + + t/data/test_CAinter.key.pem | 27 +++ + t/data/test_CAinter.req.pem | 15 ++ + t/data/test_leaf.crt.pem | 16 ++ + t/data/test_leaf.key.pem | 27 +++ + t/data/test_leaf.req.pem | 15 ++ + t/local/32_x509_get_cert_info.t | 5 +- + t/local/33_x509_create_cert.t | 2 +- + t/local/36_verify.t | 4 +- + 16 files changed, 175 insertions(+), 451 deletions(-) + delete mode 100644 t/data/cert_twitter.crt.pem + delete mode 100644 t/data/cert_twitter.crt.pem_dump + create mode 100644 t/data/chain_leaf.crt.pem + delete mode 100755 t/data/chain_twitter.crt.pem + delete mode 100755 t/data/digicert.crt.pem + create mode 100644 t/data/test_CAinter.crt.pem + create mode 100644 t/data/test_CAinter.extensions + create mode 100644 t/data/test_CAinter.key.pem + create mode 100644 t/data/test_CAinter.req.pem + create mode 100644 t/data/test_leaf.crt.pem + create mode 100644 t/data/test_leaf.key.pem + create mode 100644 t/data/test_leaf.req.pem + +diff --git a/MANIFEST b/MANIFEST +index b36241d..cc64cee 100644 +--- a/MANIFEST ++++ b/MANIFEST +@@ -39,15 +39,11 @@ README.OSX + README.VMS + README.Win32 + SSLeay.xs +-t/data/0f89dbb5.0 + t/data/binary-test.file + t/data/cert.pem + t/data/cert_paypal.crt.pem + t/data/cert_paypal.crt.pem_dump +-t/data/cert_twitter.crt.pem +-t/data/cert_twitter.crt.pem_dump +-t/data/chain_twitter.crt.pem +-t/data/digicert.crt.pem ++t/data/chain_leaf.crt.pem + t/data/key.pem + t/data/key.pem.e + t/data/pkcs12-full.p12 +@@ -59,6 +55,13 @@ t/data/test_CA1.crt.pem + t/data/test_CA1.encrypted_key.pem + t/data/test_CA1.key.der + t/data/test_CA1.key.pem ++t/data/test_CAinter.crt.pem ++t/data/test_CAinter.extensions ++t/data/test_CAinter.key.pem ++t/data/test_CAinter.req.pem ++t/data/test_leaf.crt.pem ++t/data/test_leaf.key.pem ++t/data/test_leaf.req.pem + t/data/testcert_cdp.crt.pem + t/data/testcert_cdp.crt.pem_dump + t/data/testcert_extended.crt.pem +@@ -116,8 +119,8 @@ t/local/50_digest.t + t/local/61_threads-cb-crash.t + t/local/62_threads-ctx_new-deadlock.t + t/local/63_ec_key_generate_key.t +-t/local/65_security_level.t + t/local/64_ticket_sharing.t ++t/local/65_security_level.t + t/local/65_ticket_sharing_2.t + t/local/66_curves.t + t/local/kwalitee.t +diff --git a/t/data/cert_twitter.crt.pem b/t/data/cert_twitter.crt.pem +deleted file mode 100644 +index eb3acc1..0000000 +--- a/t/data/cert_twitter.crt.pem ++++ /dev/null +@@ -1,37 +0,0 @@ +------BEGIN CERTIFICATE----- +-MIIGfjCCBWagAwIBAgIQFyfdZD5CNvh/ebsEa8GYAjANBgkqhkiG9w0BAQUFADCB +-ujELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQL +-ExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTswOQYDVQQLEzJUZXJtcyBvZiB1c2Ug +-YXQgaHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL3JwYSAoYykwNjE0MDIGA1UEAxMr +-VmVyaVNpZ24gQ2xhc3MgMyBFeHRlbmRlZCBWYWxpZGF0aW9uIFNTTCBDQTAeFw0x +-MTA3MDcwMDAwMDBaFw0xMjA3MjcyMzU5NTlaMIIBGTETMBEGCysGAQQBgjc8AgED +-EwJVUzEZMBcGCysGAQQBgjc8AgECEwhEZWxhd2FyZTEdMBsGA1UEDxMUUHJpdmF0 +-ZSBPcmdhbml6YXRpb24xEDAOBgNVBAUTBzQzMzc0NDYxCzAJBgNVBAYTAlVTMQ4w +-DAYDVQQRFAU5NDEwNzETMBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UEBxQNU2Fu +-IEZyYW5jaXNjbzEhMB8GA1UECRQYNzk1IEZvbHNvbSBTdCwgU3VpdGUgNjAwMRYw +-FAYDVQQKFA1Ud2l0dGVyLCBJbmMuMRswGQYDVQQLFBJUd2l0dGVyIE9wZXJhdGlv +-bnMxFDASBgNVBAMUC3R3aXR0ZXIuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A +-MIIBCgKCAQEAmiGqkw9ArpnvvWnom/W+HxNDKXf0cFCrjErr0tfFs10UzA12xxOE +-gI0WmWM5B/0W8f5ueEY3/ziPO3i+jJvHDJUQqQaH8LJAhOyEr6EpVWncfaMK2Ufd +-y1s+iQzcQLZqpB3W/J+5mf7dhy1F/tUWyP2cvxC7dWJQjv3RY2ca/PDzy7a4bcqT +-Bg9bx42t4c5LmjkpOsckevS9lpuwBc0I1+1Nshm+sdfJKKIWwQ4+ylshom/d0S2a +-e+pRxoRiPbjXkqEcOAQjmHaz4U5gavPjVq5Uk0Sw96z90gGo/WxtOvJ584NJtiiQ +-erP9fbAefJGqCgcsE3x+IjrJymlvVUgs0QIDAQABo4ICHDCCAhgwJwYDVR0RBCAw +-HoIPd3d3LnR3aXR0ZXIuY29tggt0d2l0dGVyLmNvbTAJBgNVHRMEAjAAMB0GA1Ud +-DgQWBBToMED2PZslwbExjhP13omUFc0GPzALBgNVHQ8EBAMCBaAwQgYDVR0fBDsw +-OTA3oDWgM4YxaHR0cDovL0VWU2VjdXJlLWNybC52ZXJpc2lnbi5jb20vRVZTZWN1 +-cmUyMDA2LmNybDBEBgNVHSAEPTA7MDkGC2CGSAGG+EUBBxcGMCowKAYIKwYBBQUH +-AgEWHGh0dHBzOi8vd3d3LnZlcmlzaWduLmNvbS9ycGEwHQYDVR0lBBYwFAYIKwYB +-BQUHAwEGCCsGAQUFBwMCMB8GA1UdIwQYMBaAFPyKULqeuSVae1WFT5UAY4/pWGtD +-MHwGCCsGAQUFBwEBBHAwbjAtBggrBgEFBQcwAYYhaHR0cDovL0VWU2VjdXJlLW9j +-c3AudmVyaXNpZ24uY29tMD0GCCsGAQUFBzAChjFodHRwOi8vRVZTZWN1cmUtYWlh +-LnZlcmlzaWduLmNvbS9FVlNlY3VyZTIwMDYuY2VyMG4GCCsGAQUFBwEMBGIwYKFe +-oFwwWjBYMFYWCWltYWdlL2dpZjAhMB8wBwYFKw4DAhoEFEtruSiWBgy70FI4myms +-SweLIQUYMCYWJGh0dHA6Ly9sb2dvLnZlcmlzaWduLmNvbS92c2xvZ28xLmdpZjAN +-BgkqhkiG9w0BAQUFAAOCAQEACNvSG4VmJCidoFDNgMmsqJ5HAfXkoEuED7wBJcGQ +-eLtQ8G/FLVrbsbXRiyxa/ytYWKqX1hkPrhgx9P9DlBlQvOl2/VHBznTqczhgxKnT +-OXJeGwnr7IgCsgyd6vJ2g27Crv9954NRmrG0GttPbTHNkeEmQUJsgVEOkOdiQm+J +-mVwTctfQe0W6WKdgIid+x5XvkfdYgYOrZTYBUUCz0eqZaSGliTiestyMnluZRBRG +-hkOPeahGh/IWonrwil4hWDIx1Yas0pR/9Pzr4BeW0LlQqbvrFif2mdsJcqKSPQ4I +-O4XIL3vqiJiv9GWRRIZl5DJAwjlPZ6W2X0KUeFAYGwvDDw== +------END CERTIFICATE----- +diff --git a/t/data/cert_twitter.crt.pem_dump b/t/data/cert_twitter.crt.pem_dump +deleted file mode 100644 +index 279c011..0000000 +--- a/t/data/cert_twitter.crt.pem_dump ++++ /dev/null +@@ -1,284 +0,0 @@ +- +-# exported via command: perl examples/x509_cert_details.pl -dump -pem t/data/cert_twitter.crt.pem > t/data/cert_twitter.crt.pem_dump +-# hashref dumped via Data::Dump +-{ +- cdp => ["http://EVSecure-crl.verisign.com/EVSecure2006.crl"], +- certificate_type => 49, +- digest_sha1 => { +- pubkey => pack("H*","e83040f63d9b25c1b1318e13f5de899415cd063f"), +- x509 => pack("H*","ea9defd63361d97671e16c689f54a659d7f10e66"), +- }, +- extensions => { +- count => 10, +- entries => [ +- { +- critical => 0, +- data => "DNS:www.twitter.com, DNS:twitter.com", +- ln => "X509v3 Subject Alternative Name", +- nid => 85, +- oid => "2.5.29.17", +- sn => "subjectAltName", +- }, +- { +- critical => 0, +- data => "CA:FALSE", +- ln => "X509v3 Basic Constraints", +- nid => 87, +- oid => "2.5.29.19", +- sn => "basicConstraints", +- }, +- { +- critical => 0, +- data => "E8:30:40:F6:3D:9B:25:C1:B1:31:8E:13:F5:DE:89:94:15:CD:06:3F", +- ln => "X509v3 Subject Key Identifier", +- nid => 82, +- oid => "2.5.29.14", +- sn => "subjectKeyIdentifier", +- }, +- { +- critical => 0, +- data => "Digital Signature, Key Encipherment", +- ln => "X509v3 Key Usage", +- nid => 83, +- oid => "2.5.29.15", +- sn => "keyUsage", +- }, +- { +- critical => 0, +- data => "\nFull Name:\n URI:http://EVSecure-crl.verisign.com/EVSecure2006.crl\n", +- ln => "X509v3 CRL Distribution Points", +- nid => 103, +- oid => "2.5.29.31", +- sn => "crlDistributionPoints", +- }, +- { +- critical => 0, +- data => "Policy: 2.16.840.1.113733.1.7.23.6\n CPS: https://www.verisign.com/rpa\n", +- ln => "X509v3 Certificate Policies", +- nid => 89, +- oid => "2.5.29.32", +- sn => "certificatePolicies", +- }, +- { +- critical => 0, +- data => "TLS Web Server Authentication, TLS Web Client Authentication", +- ln => "X509v3 Extended Key Usage", +- nid => 126, +- oid => "2.5.29.37", +- sn => "extendedKeyUsage", +- }, +- { +- critical => 0, +- data => "keyid:FC:8A:50:BA:9E:B9:25:5A:7B:55:85:4F:95:00:63:8F:E9:58:6B:43\n", +- ln => "X509v3 Authority Key Identifier", +- nid => 90, +- oid => "2.5.29.35", +- sn => "authorityKeyIdentifier", +- }, +- { +- critical => 0, +- data => "OCSP - URI:http://EVSecure-ocsp.verisign.com\nCA Issuers - URI:http://EVSecure-aia.verisign.com/EVSecure2006.cer\n", +- ln => "Authority Information Access", +- nid => 177, +- oid => "1.3.6.1.5.5.7.1.1", +- sn => "authorityInfoAccess", +- }, +- { +- critical => 0, +- data => undef, +- ln => undef, +- nid => undef, +- oid => "1.3.6.1.5.5.7.1.12", +- sn => undef, +- }, +- ], +- }, +- extkeyusage => { +- ln => [ +- "TLS Web Server Authentication", +- "TLS Web Client Authentication", +- ], +- nid => [129, 130], +- oid => ["1.3.6.1.5.5.7.3.1", "1.3.6.1.5.5.7.3.2"], +- sn => ["serverAuth", "clientAuth"], +- }, +- fingerprint => { +- md5 => "34:A7:92:6A:78:82:D5:3F:11:C4:66:D0:70:66:CF:E1", +- sha1 => "EA:9D:EF:D6:33:61:D9:76:71:E1:6C:68:9F:54:A6:59:D7:F1:0E:66", +- }, +- hash => { +- issuer => { dec => 1853825729, hex => "6E7F22C1" }, +- issuer_and_serial => { dec => 2422658675, hex => "9066D673" }, +- subject => { dec => 3318511233, hex => "C5CC7681" }, +- }, +- issuer => { +- count => 5, +- entries => [ +- { +- data => "US", +- data_utf8_decoded => "US", +- ln => "countryName", +- nid => 14, +- oid => "2.5.4.6", +- sn => "C", +- }, +- { +- data => "VeriSign, Inc.", +- data_utf8_decoded => "VeriSign, Inc.", +- ln => "organizationName", +- nid => 17, +- oid => "2.5.4.10", +- sn => "O", +- }, +- { +- data => "VeriSign Trust Network", +- data_utf8_decoded => "VeriSign Trust Network", +- ln => "organizationalUnitName", +- nid => 18, +- oid => "2.5.4.11", +- sn => "OU", +- }, +- { +- data => "Terms of use at https://www.verisign.com/rpa (c)06", +- data_utf8_decoded => "Terms of use at https://www.verisign.com/rpa (c)06", +- ln => "organizationalUnitName", +- nid => 18, +- oid => "2.5.4.11", +- sn => "OU", +- }, +- { +- data => "VeriSign Class 3 Extended Validation SSL CA", +- data_utf8_decoded => "VeriSign Class 3 Extended Validation SSL CA", +- ln => "commonName", +- nid => 13, +- oid => "2.5.4.3", +- sn => "CN", +- }, +- ], +- oneline => "/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use at https://www.verisign.com/rpa (c)06/CN=VeriSign Class 3 Extended Validation SSL CA", +- print_rfc2253 => "CN=VeriSign Class 3 Extended Validation SSL CA,OU=Terms of use at https://www.verisign.com/rpa (c)06,OU=VeriSign Trust Network,O=VeriSign\\, Inc.,C=US", +- print_rfc2253_utf8 => "CN=VeriSign Class 3 Extended Validation SSL CA,OU=Terms of use at https://www.verisign.com/rpa (c)06,OU=VeriSign Trust Network,O=VeriSign\\, Inc.,C=US", +- print_rfc2253_utf8_decoded => "CN=VeriSign Class 3 Extended Validation SSL CA,OU=Terms of use at https://www.verisign.com/rpa (c)06,OU=VeriSign Trust Network,O=VeriSign\\, Inc.,C=US", +- }, +- keyusage => ["digitalSignature", "keyEncipherment"], +- not_after => "2012-07-27T23:59:59Z", +- not_before => "2011-07-07T00:00:00Z", +- ns_cert_type => [], +- pubkey_alg => "rsaEncryption", +- pubkey_bits => 2048, +- pubkey_id => 6, +- pubkey_size => 256, +- serial => { +- dec => "30779233835142701104683847010155075586", +- hex => "1727DD643E4236F87F79BB046BC19802", +- long => -1, +- }, +- signature_alg => "sha1WithRSAEncryption", +- subject => { +- altnames => [2, "www.twitter.com", 2, "twitter.com"], +- count => 12, +- entries => [ +- { +- data => "US", +- data_utf8_decoded => "US", +- ln => undef, +- nid => undef, +- oid => "1.3.6.1.4.1.311.60.2.1.3", +- sn => undef, +- }, +- { +- data => "Delaware", +- data_utf8_decoded => "Delaware", +- ln => undef, +- nid => undef, +- oid => "1.3.6.1.4.1.311.60.2.1.2", +- sn => undef, +- }, +- { +- data => "Private Organization", +- data_utf8_decoded => "Private Organization", +- ln => "businessCategory", +- nid => 860, +- oid => "2.5.4.15", +- sn => "businessCategory", +- }, +- { +- data => 4337446, +- data_utf8_decoded => 4337446, +- ln => "serialNumber", +- nid => 105, +- oid => "2.5.4.5", +- sn => "serialNumber", +- }, +- { +- data => "US", +- data_utf8_decoded => "US", +- ln => "countryName", +- nid => 14, +- oid => "2.5.4.6", +- sn => "C", +- }, +- { +- data => 94107, +- data_utf8_decoded => 94107, +- ln => "postalCode", +- nid => 661, +- oid => "2.5.4.17", +- sn => "postalCode", +- }, +- { +- data => "California", +- data_utf8_decoded => "California", +- ln => "stateOrProvinceName", +- nid => 16, +- oid => "2.5.4.8", +- sn => "ST", +- }, +- { +- data => "San Francisco", +- data_utf8_decoded => "San Francisco", +- ln => "localityName", +- nid => 15, +- oid => "2.5.4.7", +- sn => "L", +- }, +- { +- data => "795 Folsom St, Suite 600", +- data_utf8_decoded => "795 Folsom St, Suite 600", +- ln => "streetAddress", +- nid => 660, +- oid => "2.5.4.9", +- sn => "street", +- }, +- { +- data => "Twitter, Inc.", +- data_utf8_decoded => "Twitter, Inc.", +- ln => "organizationName", +- nid => 17, +- oid => "2.5.4.10", +- sn => "O", +- }, +- { +- data => "Twitter Operations", +- data_utf8_decoded => "Twitter Operations", +- ln => "organizationalUnitName", +- nid => 18, +- oid => "2.5.4.11", +- sn => "OU", +- }, +- { +- data => "twitter.com", +- data_utf8_decoded => "twitter.com", +- ln => "commonName", +- nid => 13, +- oid => "2.5.4.3", +- sn => "CN", +- }, +- ], +- oneline => "/1.3.6.1.4.1.311.60.2.1.3=US/1.3.6.1.4.1.311.60.2.1.2=Delaware/businessCategory=Private Organization/serialNumber=4337446/C=US/postalCode=94107/ST=California/L=San Francisco/street=795 Folsom St, Suite 600/O=Twitter, Inc./OU=Twitter Operations/CN=twitter.com", +- print_rfc2253 => "CN=twitter.com,OU=Twitter Operations,O=Twitter\\, Inc.,street=795 Folsom St\\, Suite 600,L=San Francisco,ST=California,postalCode=94107,C=US,serialNumber=4337446,businessCategory=Private Organization,1.3.6.1.4.1.311.60.2.1.2=#130844656C6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553", +- print_rfc2253_utf8 => "CN=twitter.com,OU=Twitter Operations,O=Twitter\\, Inc.,street=795 Folsom St\\, Suite 600,L=San Francisco,ST=California,postalCode=94107,C=US,serialNumber=4337446,businessCategory=Private Organization,1.3.6.1.4.1.311.60.2.1.2=#130844656C6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553", +- print_rfc2253_utf8_decoded => "CN=twitter.com,OU=Twitter Operations,O=Twitter\\, Inc.,street=795 Folsom St\\, Suite 600,L=San Francisco,ST=California,postalCode=94107,C=US,serialNumber=4337446,businessCategory=Private Organization,1.3.6.1.4.1.311.60.2.1.2=#130844656C6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553", +- }, +- version => 2, +-} +diff --git a/t/data/chain_leaf.crt.pem b/t/data/chain_leaf.crt.pem +new file mode 100644 +index 0000000..2b382b7 +--- /dev/null ++++ b/t/data/chain_leaf.crt.pem +@@ -0,0 +1,45 @@ ++-----BEGIN CERTIFICATE----- ++MIICmjCCAYICAQEwDQYJKoZIhvcNAQELBQAwFzEVMBMGA1UEAwwMSW50ZXJtZWRp ++YXRlMB4XDTE5MDQxNzE1MTY1M1oXDTI5MDQxNDE1MTY1M1owDzENMAsGA1UEAwwE ++TGVhZjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAOa0eYS3XsiXadYF ++53ZTfaNhbbkpCWnFddFQ/c3Z7QToJ6DkTiqDNTpHodvrG+CFDVuO0RJONQDf4jH6 ++6B6ityFYWc4RkAPqfat0k7NZpj5dVWp9uDgmEWABmf0KE9WqzYDbtTljlS1POHI9 ++UFCdF3/T0UbGtdKSzzo/STJf8vLOTf5YJQZHImvZeQbCgXtBN8hdLtfdU5FQYbaK ++cGyDvW6mBg1ZxYgJx+hE9NNeAsAWp2rAXGZIatQ98KNmwY5VH6cBX4ggasQucUUI ++Bg5ih7fvWP2k0FyaiIsme9nWLsbuNg3s3tMahuRO1rE0Z0Vj/5JBUmT6J27ZBKGZ ++Rn7C2x8CAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAgleJwB7rE7w+B4jlRqP72kkR ++XL7MZSV2vr+CTS4t+iLlbHweApiEJmQ3szY69d/gtdznSacp8CHOGihRazRsudn2 ++G6QHbjXNBs16KnEEnHiIbk0YrnAa0xxrKvxOHPX+lfvYEcN2QqVtiFF0IsTqck8I ++vMYYe5zf4RDd2S1q31l67LoFSmFhrAqPbDITrx8tMhyAEW6zNxNkCaM/+8Bu94E3 ++Ec7QDmpbE4Qz80qzmCmpv7NBnvrn0uYO1IkPrq2XetbhWHoliYImeS2OojdnPVbx ++sP1q5i9FYnnvFA8xl4TORjqtIajX6bXVkWZBXkbtDGKLnxzJ+vPagxwEzOphmA== ++-----END CERTIFICATE----- ++-----BEGIN CERTIFICATE----- ++MIICIjCCAYugAwIBAgIDEjRWMA0GCSqGSIb3DQEBBQUAMCsxCzAJBgNVBAYTAlVT ++MQ4wDAYDVQQKEwVEZW1vMTEMMAoGA1UEAxMDQ0ExMCAXDTEyMDEwMTAwMDAwMFoY ++DzIxMTExMjMxMjM1OTU5WjArMQswCQYDVQQGEwJVUzEOMAwGA1UEChMFRGVtbzEx ++DDAKBgNVBAMTA0NBMTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAy1ygNguH ++72n0l+1uy9HEM6t2LWJEmC0w4tAuXk9H1FseQMV28eBQXdyg3wK+yli6l6c9k9Aj ++HAZ/6TXTVmOxtTgkXbvHlwcE3pTiHJSvZWGQMORCPNkjjiVBiLBdGQ3qFKyV+NA5 ++K4XnVy0jkeS/BHx7KO7m+DOLVow8FO1CstUCAwEAAaNSMFAwDwYDVR0TAQH/BAUw ++AwEB/zAdBgNVHQ4EFgQUyBzakgqpSAg6dnYVOATxNNkV0CAwCwYDVR0PBAQDAgEG ++MBEGCWCGSAGG+EIBAQQEAwIABzANBgkqhkiG9w0BAQUFAAOBgQBG1QBfo1kZRN50 ++/a3ZoQufIj0FJLMS/WkUnW0RLqEewyhEK9u86eoglcz5SxdD4T+VN9+MxoZ2J83P ++b21Y4FUDqnkdoGAPdoxX+7iLQcxVoMK72n72QSSzvfnjsr9+pazLp1P6ZK9epbZf ++s2WM0ty3a+sYmXANG8wGazAyRDMi0Q== ++-----END CERTIFICATE----- ++-----BEGIN CERTIFICATE----- ++MIICTzCCAbigAwIBAgIBAjANBgkqhkiG9w0BAQsFADArMQswCQYDVQQGEwJVUzEO ++MAwGA1UEChMFRGVtbzExDDAKBgNVBAMTA0NBMTAeFw0xOTA0MTcxNTEzMjFaFw0y ++OTA0MTQxNTEzMjFaMBcxFTATBgNVBAMMDEludGVybWVkaWF0ZTCCASIwDQYJKoZI ++hvcNAQEBBQADggEPADCCAQoCggEBAMjKRTFhhQvcFd8kkjjevKPjZRFmhd5zVWAB ++tqrAEdhWwxpI3Jg1j49sbBWL2WKFhASPzYgPTE1CTQ6eH46ySmgLt8qzdPp8+kiC ++RDU0h7j0YQS2jLIgMsF2J8Xt8RRjjgAw25Mv2ZgppdUR8xr6KpqIaUqsve0a8wCu ++8ZFCaGMd0OcRGd7HaGSZ3Inafa8r3XtJ+HT+6iJLKyRfvwVv+9bYyyQKW8gVxMBs ++51bSfELsgMzNi61HHLzp3LIE7LpWCsjiZiRIC32ZRLBzhg6Nia/TY3ooyYJJI1mH ++gGAxO2QbYuRpKjitLvTxrGhGljAnbs+jbYoGz9PqLkHsmcV2YVMCAwEAAaMTMBEw ++DwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOBgQC5/u770nJSh9Iev0OA ++0tZ7lsVAJisJEHN34plK1oUD76mFh514ntLLDElfzMYJfXpL0WD87nisIeLpXysC ++BC3QQgqfpbylZtFON5W5lxyjfVnQwFsvDC3UdK6rxCoFk/zvHeU5dahwGUHN7t7G ++lJm4FfFveSZwMn7Pvgq1eKNJ4g== ++-----END CERTIFICATE----- +diff --git a/t/data/chain_twitter.crt.pem b/t/data/chain_twitter.crt.pem +deleted file mode 100755 +index 9dd5f7a..0000000 +--- a/t/data/chain_twitter.crt.pem ++++ /dev/null +@@ -1,95 +0,0 @@ +------BEGIN CERTIFICATE----- +-MIIG6DCCBdCgAwIBAgIQDmdXKeZyRvcaXeXGF6L5UTANBgkqhkiG9w0BAQsFADB1 +-MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3 +-d3cuZGlnaWNlcnQuY29tMTQwMgYDVQQDEytEaWdpQ2VydCBTSEEyIEV4dGVuZGVk +-IFZhbGlkYXRpb24gU2VydmVyIENBMB4XDTE4MDIyMzAwMDAwMFoXDTE5MDQwODEy +-MDAwMFowgeQxHTAbBgNVBA8MFFByaXZhdGUgT3JnYW5pemF0aW9uMRMwEQYLKwYB +-BAGCNzwCAQMTAlVTMRkwFwYLKwYBBAGCNzwCAQITCERlbGF3YXJlMRAwDgYDVQQF +-Ewc0MzM3NDQ2MQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQG +-A1UEBxMNU2FuIEZyYW5jaXNjbzEWMBQGA1UEChMNVHdpdHRlciwgSW5jLjEZMBcG +-A1UECxMQVHdpdHRlciBTZWN1cml0eTEUMBIGA1UEAxMLdHdpdHRlci5jb20wggEi +-MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDRDIxB2Cj0SQtIOuWHjdzO5XKD +-lqUEFW69HmazatAWqN0Up9jel/8GMzfwMso650IRBBrhvJTPc3TdHn/JEscGAcnp +-IRrZkbTtpKMIJeNuWiACQosREt0Ur8gGLce4PJlt2BqMRJJ++SE8eV9Ryyl2Sgm+ +-kqY65SML27IecrOkNmMuZKIUw/gLpt8msOnxy5JJWsjA3z9ND6FAx2DCbZ5GDIpt +-gK07FIV2z+cg1MStpf1TbgZ93pmmX9hnFk4F7VDS6Uf2K5YsPdsI0SwpW9HiG3TK +-9oz2GvsXffU6HGGM9Vcrpi5WhlaYHT1xCQ13caOduBxCkwhRZY2AFdyCR2MpAgMB +-AAGjggMCMIIC/jAfBgNVHSMEGDAWgBQ901Cl1qCt7vNKYApl0yHU+PjWDzAdBgNV +-HQ4EFgQUjI1wmILOVLL4dplPJjT+dTMjsUUwJwYDVR0RBCAwHoILdHdpdHRlci5j +-b22CD3d3dy50d2l0dGVyLmNvbTAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYI +-KwYBBQUHAwEGCCsGAQUFBwMCMHUGA1UdHwRuMGwwNKAyoDCGLmh0dHA6Ly9jcmwz +-LmRpZ2ljZXJ0LmNvbS9zaGEyLWV2LXNlcnZlci1nMi5jcmwwNKAyoDCGLmh0dHA6 +-Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9zaGEyLWV2LXNlcnZlci1nMi5jcmwwSwYDVR0g +-BEQwQjA3BglghkgBhv1sAgEwKjAoBggrBgEFBQcCARYcaHR0cHM6Ly93d3cuZGln +-aWNlcnQuY29tL0NQUzAHBgVngQwBATCBiAYIKwYBBQUHAQEEfDB6MCQGCCsGAQUF +-BzABhhhodHRwOi8vb2NzcC5kaWdpY2VydC5jb20wUgYIKwYBBQUHMAKGRmh0dHA6 +-Ly9jYWNlcnRzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydFNIQTJFeHRlbmRlZFZhbGlk +-YXRpb25TZXJ2ZXJDQS5jcnQwDAYDVR0TAQH/BAIwADCCAQUGCisGAQQB1nkCBAIE +-gfYEgfMA8QB3AKS5CZC0GFgUh7sTosxncAo8NZgE+RvfuON3zQ7IDdwQAAABYcBN +-gy8AAAQDAEgwRgIhAOW65zPD/WuWN0kNEKx0LZBxTqLrQSkh6G7db+TT+FQcAiEA +-o9jTxePOzkuDoq+kO/FY8wKYp+/RWLXj2VbL8wKI/SkAdgBWFAaaL9fC7NP14b1E +-sj7HRna5vJkRXMDvlJhV1onQ3QAAAWHATYOxAAAEAwBHMEUCIQCUWpCOm+ejKxg1 +-LyfPlxMEyTqmEyrajGx8PbTaBet8XwIgUKQXhoLMKb66Cvs4goSt3wWLDkX4WmFW +-DPcR9Mbq87gwDQYJKoZIhvcNAQELBQADggEBAJlV+Uez02kinJi7AHiYujgJ5j1k +-icieSrL+qspP6CMv6OCAa353vrVc95+iwDWimE9ovJZrANWpW2bNHClLb/R4pjlc +-yDpzXdCzrQzkqUXmIZZ95hU7SxC56fC3ybINy2e2YqOjUPxBoZjZjWBa20opMMxg +-ntG1ZqcZ9mZE7JJbOqfCyFbe5eyszpujATD3K24IVW5IXdzWd1udumbL5jUdYA56 +-TjnyBCxlBjjLdQt2IWOiMATp+IlslwEpNScMl/gSLEX5b550/tn/5MaIY7cPNG38 +-WNiLTkomw//7coTN6HdctcTSojOWQqjl8PLzcG+UxZd3vFe7Kf07VFBHav4= +------END CERTIFICATE----- +- +-subject=C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert High Assurance EV Root CA +- +-issuer=C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert High Assurance EV Root CA +- +------BEGIN CERTIFICATE----- +-MIIDxTCCAq2gAwIBAgIQAqxcJmoLQJuPC3nyrkYldzANBgkqhkiG9w0BAQUFADBs +-MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3 +-d3cuZGlnaWNlcnQuY29tMSswKQYDVQQDEyJEaWdpQ2VydCBIaWdoIEFzc3VyYW5j +-ZSBFViBSb290IENBMB4XDTA2MTExMDAwMDAwMFoXDTMxMTExMDAwMDAwMFowbDEL +-MAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3 +-LmRpZ2ljZXJ0LmNvbTErMCkGA1UEAxMiRGlnaUNlcnQgSGlnaCBBc3N1cmFuY2Ug +-RVYgUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMbM5XPm +-+9S75S0tMqbf5YE/yc0lSbZxKsPVlDRnogocsF9ppkCxxLeyj9CYpKlBWTrT3JTW +-PNt0OKRKzE0lgvdKpVMSOO7zSW1xkX5jtqumX8OkhPhPYlG++MXs2ziS4wblCJEM +-xChBVfvLWokVfnHoNb9Ncgk9vjo4UFt3MRuNs8ckRZqnrG0AFFoEt7oT61EKmEFB +-Ik5lYYeBQVCmeVyJ3hlKV9Uu5l0cUyx+mM0aBhakaHPQNAQTXKFx01p8VdteZOE3 +-hzBWBOURtCmAEvF5OYiiAhF8J2a3iLd48soKqDirCmTCv2ZdlYTBoSUeh10aUAsg +-EsxBu24LUTi4S8sCAwEAAaNjMGEwDgYDVR0PAQH/BAQDAgGGMA8GA1UdEwEB/wQF +-MAMBAf8wHQYDVR0OBBYEFLE+w2kD+L9HAdSYJhoIAu9jZCvDMB8GA1UdIwQYMBaA +-FLE+w2kD+L9HAdSYJhoIAu9jZCvDMA0GCSqGSIb3DQEBBQUAA4IBAQAcGgaX3Nec +-nzyIZgYIVyHbIUf4KmeqvxgydkAQV8GK83rZEWWONfqe/EW1ntlMMUu4kehDLI6z +-eM7b41N5cdblIZQB2lWHmiRk9opmzN6cN82oNLFpmyPInngiK3BD41VHMWEZ71jF +-hS9OMPagMRYjyOfiZRYzy78aG6A9+MpeizGLYAiJLQwGXFK3xPkKmNEVX58Svnw2 +-Yzi9RKR/5CYrCsSXaQ3pjOLAEFe4yHYSkVXySGnYvCoCWw9E1CAx2/S6cCZdkGCe +-vEsXCS+0yx5DaMkHJ8HSXPfqIbloEpw8nL+e/IBcm2PN7EeqJSdnoDfzAIJ9VNep +-+OkuE6N36B9K +------END CERTIFICATE----- +------BEGIN CERTIFICATE----- +-MIIEtjCCA56gAwIBAgIQDHmpRLCMEZUgkmFf4msdgzANBgkqhkiG9w0BAQsFADBs +-MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3 +-d3cuZGlnaWNlcnQuY29tMSswKQYDVQQDEyJEaWdpQ2VydCBIaWdoIEFzc3VyYW5j +-ZSBFViBSb290IENBMB4XDTEzMTAyMjEyMDAwMFoXDTI4MTAyMjEyMDAwMFowdTEL +-MAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3 +-LmRpZ2ljZXJ0LmNvbTE0MDIGA1UEAxMrRGlnaUNlcnQgU0hBMiBFeHRlbmRlZCBW +-YWxpZGF0aW9uIFNlcnZlciBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC +-ggEBANdTpARR+JmmFkhLZyeqk0nQOe0MsLAAh/FnKIaFjI5j2ryxQDji0/XspQUY +-uD0+xZkXMuwYjPrxDKZkIYXLBxA0sFKIKx9om9KxjxKws9LniB8f7zh3VFNfgHk/ +-LhqqqB5LKw2rt2O5Nbd9FLxZS99RStKh4gzikIKHaq7q12TWmFXo/a8aUGxUvBHy +-/Urynbt/DvTVvo4WiRJV2MBxNO723C3sxIclho3YIeSwTQyJ3DkmF93215SF2AQh +-cJ1vb/9cuhnhRctWVyh+HA1BV6q3uCe7seT6Ku8hI3UarS2bhjWMnHe1c63YlC3k +-8wyd7sFOYn4XwHGeLN7x+RAoGTMCAwEAAaOCAUkwggFFMBIGA1UdEwEB/wQIMAYB +-Af8CAQAwDgYDVR0PAQH/BAQDAgGGMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEF +-BQcDAjA0BggrBgEFBQcBAQQoMCYwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRp +-Z2ljZXJ0LmNvbTBLBgNVHR8ERDBCMECgPqA8hjpodHRwOi8vY3JsNC5kaWdpY2Vy +-dC5jb20vRGlnaUNlcnRIaWdoQXNzdXJhbmNlRVZSb290Q0EuY3JsMD0GA1UdIAQ2 +-MDQwMgYEVR0gADAqMCgGCCsGAQUFBwIBFhxodHRwczovL3d3dy5kaWdpY2VydC5j +-b20vQ1BTMB0GA1UdDgQWBBQ901Cl1qCt7vNKYApl0yHU+PjWDzAfBgNVHSMEGDAW +-gBSxPsNpA/i/RwHUmCYaCALvY2QrwzANBgkqhkiG9w0BAQsFAAOCAQEAnbbQkIbh +-hgLtxaDwNBx0wY12zIYKqPBKikLWP8ipTa18CK3mtlC4ohpNiAexKSHc59rGPCHg +-4xFJcKx6HQGkyhE6V6t9VypAdP3THYUYUN9XR3WhfVUgLkc3UHKMf4Ib0mKPLQNa +-2sPIoc4sUqIAY+tzunHISScjl2SFnjgOrWNoPLpSgVh5oywM395t6zHyuqB8bPEs +-1OG9d4Q3A84ytciagRpKkk47RpqF/oOi+Z6Mo8wNXrM9zwR4jxQUezKcxwCmXMS1 +-oVWNWlZopCJwqjyBcdmdqEU79OX2olHdx3ti6G8MdOu42vi/hw15UJGQmxg7kVkn +-8TUoE6smftX3eg== +------END CERTIFICATE----- +diff --git a/t/data/digicert.crt.pem b/t/data/digicert.crt.pem +deleted file mode 100755 +index 9e6810a..0000000 +--- a/t/data/digicert.crt.pem ++++ /dev/null +@@ -1,23 +0,0 @@ +------BEGIN CERTIFICATE----- +-MIIDxTCCAq2gAwIBAgIQAqxcJmoLQJuPC3nyrkYldzANBgkqhkiG9w0BAQUFADBs +-MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3 +-d3cuZGlnaWNlcnQuY29tMSswKQYDVQQDEyJEaWdpQ2VydCBIaWdoIEFzc3VyYW5j +-ZSBFViBSb290IENBMB4XDTA2MTExMDAwMDAwMFoXDTMxMTExMDAwMDAwMFowbDEL +-MAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3 +-LmRpZ2ljZXJ0LmNvbTErMCkGA1UEAxMiRGlnaUNlcnQgSGlnaCBBc3N1cmFuY2Ug +-RVYgUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMbM5XPm +-+9S75S0tMqbf5YE/yc0lSbZxKsPVlDRnogocsF9ppkCxxLeyj9CYpKlBWTrT3JTW +-PNt0OKRKzE0lgvdKpVMSOO7zSW1xkX5jtqumX8OkhPhPYlG++MXs2ziS4wblCJEM +-xChBVfvLWokVfnHoNb9Ncgk9vjo4UFt3MRuNs8ckRZqnrG0AFFoEt7oT61EKmEFB +-Ik5lYYeBQVCmeVyJ3hlKV9Uu5l0cUyx+mM0aBhakaHPQNAQTXKFx01p8VdteZOE3 +-hzBWBOURtCmAEvF5OYiiAhF8J2a3iLd48soKqDirCmTCv2ZdlYTBoSUeh10aUAsg +-EsxBu24LUTi4S8sCAwEAAaNjMGEwDgYDVR0PAQH/BAQDAgGGMA8GA1UdEwEB/wQF +-MAMBAf8wHQYDVR0OBBYEFLE+w2kD+L9HAdSYJhoIAu9jZCvDMB8GA1UdIwQYMBaA +-FLE+w2kD+L9HAdSYJhoIAu9jZCvDMA0GCSqGSIb3DQEBBQUAA4IBAQAcGgaX3Nec +-nzyIZgYIVyHbIUf4KmeqvxgydkAQV8GK83rZEWWONfqe/EW1ntlMMUu4kehDLI6z +-eM7b41N5cdblIZQB2lWHmiRk9opmzN6cN82oNLFpmyPInngiK3BD41VHMWEZ71jF +-hS9OMPagMRYjyOfiZRYzy78aG6A9+MpeizGLYAiJLQwGXFK3xPkKmNEVX58Svnw2 +-Yzi9RKR/5CYrCsSXaQ3pjOLAEFe4yHYSkVXySGnYvCoCWw9E1CAx2/S6cCZdkGCe +-vEsXCS+0yx5DaMkHJ8HSXPfqIbloEpw8nL+e/IBcm2PN7EeqJSdnoDfzAIJ9VNep +-+OkuE6N36B9K +------END CERTIFICATE----- +diff --git a/t/data/test_CAinter.crt.pem b/t/data/test_CAinter.crt.pem +new file mode 100644 +index 0000000..12e978f +--- /dev/null ++++ b/t/data/test_CAinter.crt.pem +@@ -0,0 +1,15 @@ ++-----BEGIN CERTIFICATE----- ++MIICTzCCAbigAwIBAgIBAjANBgkqhkiG9w0BAQsFADArMQswCQYDVQQGEwJVUzEO ++MAwGA1UEChMFRGVtbzExDDAKBgNVBAMTA0NBMTAeFw0xOTA0MTcxNTEzMjFaFw0y ++OTA0MTQxNTEzMjFaMBcxFTATBgNVBAMMDEludGVybWVkaWF0ZTCCASIwDQYJKoZI ++hvcNAQEBBQADggEPADCCAQoCggEBAMjKRTFhhQvcFd8kkjjevKPjZRFmhd5zVWAB ++tqrAEdhWwxpI3Jg1j49sbBWL2WKFhASPzYgPTE1CTQ6eH46ySmgLt8qzdPp8+kiC ++RDU0h7j0YQS2jLIgMsF2J8Xt8RRjjgAw25Mv2ZgppdUR8xr6KpqIaUqsve0a8wCu ++8ZFCaGMd0OcRGd7HaGSZ3Inafa8r3XtJ+HT+6iJLKyRfvwVv+9bYyyQKW8gVxMBs ++51bSfELsgMzNi61HHLzp3LIE7LpWCsjiZiRIC32ZRLBzhg6Nia/TY3ooyYJJI1mH ++gGAxO2QbYuRpKjitLvTxrGhGljAnbs+jbYoGz9PqLkHsmcV2YVMCAwEAAaMTMBEw ++DwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOBgQC5/u770nJSh9Iev0OA ++0tZ7lsVAJisJEHN34plK1oUD76mFh514ntLLDElfzMYJfXpL0WD87nisIeLpXysC ++BC3QQgqfpbylZtFON5W5lxyjfVnQwFsvDC3UdK6rxCoFk/zvHeU5dahwGUHN7t7G ++lJm4FfFveSZwMn7Pvgq1eKNJ4g== ++-----END CERTIFICATE----- +diff --git a/t/data/test_CAinter.extensions b/t/data/test_CAinter.extensions +new file mode 100644 +index 0000000..9a3aedb +--- /dev/null ++++ b/t/data/test_CAinter.extensions +@@ -0,0 +1 @@ ++basicConstraints=critical,CA:TRUE +diff --git a/t/data/test_CAinter.key.pem b/t/data/test_CAinter.key.pem +new file mode 100644 +index 0000000..3e6e9c2 +--- /dev/null ++++ b/t/data/test_CAinter.key.pem +@@ -0,0 +1,27 @@ ++-----BEGIN RSA PRIVATE KEY----- ++MIIEpAIBAAKCAQEAyMpFMWGFC9wV3ySSON68o+NlEWaF3nNVYAG2qsAR2FbDGkjc ++mDWPj2xsFYvZYoWEBI/NiA9MTUJNDp4fjrJKaAu3yrN0+nz6SIJENTSHuPRhBLaM ++siAywXYnxe3xFGOOADDbky/ZmCml1RHzGvoqmohpSqy97RrzAK7xkUJoYx3Q5xEZ ++3sdoZJncidp9ryvde0n4dP7qIksrJF+/BW/71tjLJApbyBXEwGznVtJ8QuyAzM2L ++rUccvOncsgTsulYKyOJmJEgLfZlEsHOGDo2Jr9NjeijJgkkjWYeAYDE7ZBti5Gkq ++OK0u9PGsaEaWMCduz6NtigbP0+ouQeyZxXZhUwIDAQABAoIBAQCs7Nbukmg9MIx9 ++o0dzRxD7rImMlNlSHc43YwJoyAYWZZKd/oZNaEN9aAkl/U149jgenaKLPXGfUCyB ++HFldUduXBBCDuE5UtHHxJI+NqvIAricoIffGKMjNqO7UHfp0btELBQj2GE20KJoz ++iMPwReePM1BLCb6Ah6ckvYY6bhDs2mfaQKwOHu7JuEinCf//5jjuqmCWSzLYSN6G ++Z8GZJ7wkqC5US1DzxW9S6XtfHpj1UIiasI6UriF0Zc3C/xD3v6rjXEhB7skiOs/5 ++IReOL8HNISnMF9X5L3d1+JT0M7FE+jkST5IhplA0TxaMydf7mKl0yw30ujkfg5fM ++CxmaW0GBAoGBAO6YGs7SAcay3zT8f0gs/8DWP/Xnxn9MkQ3OetG6GHiP73rV+RZn ++72hp1l0GFjeRmEKu5yb9Fy1EHiXsee8ZKsBOmlZPBKB8/sPwKWBn3ZlxIiVQriuj ++5uMNwTgEdTVfSfrp0W4ho6hVc+6M301FkhYlHCaRIbPw8CadRlx4oBazAoGBANdw ++JsTBYFQoxDIeZMiXIDvdKoZV+jXluI9KvpCHCKQx36hLRBwYr0lQcXJWWcWyCfew ++6aBA6nw6aoPCpTvrD4n/wC0WPsAhqyOCB1yCH8cvMbul65AHx0sArGOa1xzZH8Eg +++GVj801MhQNMT8cXTUCVm5fs1qQVbYKWa+wD2trhAoGBAIVo7Yx5pt6Yw/AXw3/z ++EWqdIhR47efeQzlqHAjLOsWnDewsWuQpZ5eFnoRTU/bsZSvcKooFeIEqFoV0DdYg ++x2PST8A03Mx0N+wNjMVILoOO293rmAf01LRey4xsCbG3P2Gafi1Lh/wnE/TuNio5 ++3W6ef3gdLLA158JfrKkmFbW7AoGABrt6equQVxDvEKHihGI0n6pJqekF6KlFGzU6 ++v0l4+6iTVK8FcdtTnvbklK4eIA9wQE1G/7sHmNo6eeObRkQSOD3Fw6LuUxK6RmHJ ++2Ro35AGVjEejFN0pXS6oNHSiRESEuYROPtzgvYmmnnPECnSv9VS3iAferUH+KhaJ ++SNbWAAECgYBO4VJbt4EP08uQleYBoO9JVHVmYYKtavFL3YR08k4xh4qtndwVeRZT ++Z9ywS3maA383wvuCy3xUBmi0AY7xDvgaPaPYZT6YIaiosdEaMkI+juV/Uno96W+w ++wuRywxcAi1JNm3rbIGpUbdUxxo4ATOlD3C7A/X5AmRC24YRGol8Ciw== ++-----END RSA PRIVATE KEY----- +diff --git a/t/data/test_CAinter.req.pem b/t/data/test_CAinter.req.pem +new file mode 100644 +index 0000000..dfb7a0f +--- /dev/null ++++ b/t/data/test_CAinter.req.pem +@@ -0,0 +1,15 @@ ++-----BEGIN CERTIFICATE REQUEST----- ++MIICXDCCAUQCAQAwFzEVMBMGA1UEAwwMSW50ZXJtZWRpYXRlMIIBIjANBgkqhkiG ++9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyMpFMWGFC9wV3ySSON68o+NlEWaF3nNVYAG2 ++qsAR2FbDGkjcmDWPj2xsFYvZYoWEBI/NiA9MTUJNDp4fjrJKaAu3yrN0+nz6SIJE ++NTSHuPRhBLaMsiAywXYnxe3xFGOOADDbky/ZmCml1RHzGvoqmohpSqy97RrzAK7x ++kUJoYx3Q5xEZ3sdoZJncidp9ryvde0n4dP7qIksrJF+/BW/71tjLJApbyBXEwGzn ++VtJ8QuyAzM2LrUccvOncsgTsulYKyOJmJEgLfZlEsHOGDo2Jr9NjeijJgkkjWYeA ++YDE7ZBti5GkqOK0u9PGsaEaWMCduz6NtigbP0+ouQeyZxXZhUwIDAQABoAAwDQYJ ++KoZIhvcNAQELBQADggEBAEwFJmFml/WqQebFs3/KvL174FUDzNRMfsNuekJHJAVY ++r3TjSWrhLhRq/O71gCFn/WnaE/GACciE3djW+Y61GYJ33kXsoxiKhmmGdfJmpND8 ++6J5IglzsF2RedJZoZ+pwJ0XML1jSIjozxGSqNai++r9nKzVKve97JVSM1faBMuBf ++5fWn4uxE8ODlgFE2nAkd5srarGDgEtwqPaLwvWzlONhCK9iBvoSrvTo9It6ibjG+ ++fnbHb3ZhkWXKrILEz3NSHRaQHlQxoDGBfHhxZGj0CfjcTj+piZzpyqxpIELP0jNO ++mKhN0Gg3nR2eU6XHjy0JRhqqADUF77SQRomwTTRE5eU= ++-----END CERTIFICATE REQUEST----- +diff --git a/t/data/test_leaf.crt.pem b/t/data/test_leaf.crt.pem +new file mode 100644 +index 0000000..642e909 +--- /dev/null ++++ b/t/data/test_leaf.crt.pem +@@ -0,0 +1,16 @@ ++-----BEGIN CERTIFICATE----- ++MIICmjCCAYICAQEwDQYJKoZIhvcNAQELBQAwFzEVMBMGA1UEAwwMSW50ZXJtZWRp ++YXRlMB4XDTE5MDQxNzE1MTY1M1oXDTI5MDQxNDE1MTY1M1owDzENMAsGA1UEAwwE ++TGVhZjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAOa0eYS3XsiXadYF ++53ZTfaNhbbkpCWnFddFQ/c3Z7QToJ6DkTiqDNTpHodvrG+CFDVuO0RJONQDf4jH6 ++6B6ityFYWc4RkAPqfat0k7NZpj5dVWp9uDgmEWABmf0KE9WqzYDbtTljlS1POHI9 ++UFCdF3/T0UbGtdKSzzo/STJf8vLOTf5YJQZHImvZeQbCgXtBN8hdLtfdU5FQYbaK ++cGyDvW6mBg1ZxYgJx+hE9NNeAsAWp2rAXGZIatQ98KNmwY5VH6cBX4ggasQucUUI ++Bg5ih7fvWP2k0FyaiIsme9nWLsbuNg3s3tMahuRO1rE0Z0Vj/5JBUmT6J27ZBKGZ ++Rn7C2x8CAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAgleJwB7rE7w+B4jlRqP72kkR ++XL7MZSV2vr+CTS4t+iLlbHweApiEJmQ3szY69d/gtdznSacp8CHOGihRazRsudn2 ++G6QHbjXNBs16KnEEnHiIbk0YrnAa0xxrKvxOHPX+lfvYEcN2QqVtiFF0IsTqck8I ++vMYYe5zf4RDd2S1q31l67LoFSmFhrAqPbDITrx8tMhyAEW6zNxNkCaM/+8Bu94E3 ++Ec7QDmpbE4Qz80qzmCmpv7NBnvrn0uYO1IkPrq2XetbhWHoliYImeS2OojdnPVbx ++sP1q5i9FYnnvFA8xl4TORjqtIajX6bXVkWZBXkbtDGKLnxzJ+vPagxwEzOphmA== ++-----END CERTIFICATE----- +diff --git a/t/data/test_leaf.key.pem b/t/data/test_leaf.key.pem +new file mode 100644 +index 0000000..bc7ecc3 +--- /dev/null ++++ b/t/data/test_leaf.key.pem +@@ -0,0 +1,27 @@ ++-----BEGIN RSA PRIVATE KEY----- ++MIIEowIBAAKCAQEA5rR5hLdeyJdp1gXndlN9o2FtuSkJacV10VD9zdntBOgnoORO ++KoM1Okeh2+sb4IUNW47REk41AN/iMfroHqK3IVhZzhGQA+p9q3STs1mmPl1Van24 ++OCYRYAGZ/QoT1arNgNu1OWOVLU84cj1QUJ0Xf9PRRsa10pLPOj9JMl/y8s5N/lgl ++Bkcia9l5BsKBe0E3yF0u191TkVBhtopwbIO9bqYGDVnFiAnH6ET0014CwBanasBc ++Zkhq1D3wo2bBjlUfpwFfiCBqxC5xRQgGDmKHt+9Y/aTQXJqIiyZ72dYuxu42Deze ++0xqG5E7WsTRnRWP/kkFSZPonbtkEoZlGfsLbHwIDAQABAoIBACt/2e3JOWjvC7ic ++EmGAKo9UvoCMGUdFQQq/j6txrLwhHd+7THW9mZqsiPtTYEU8MSGTUx51eo74p8iu ++u3eTTJ5P71boftQOMbXTXEoT3EGkDYfvvn1vyBTnGGbasJS4CNmEE66HdUg+yLDZ ++mLwqcpTalnoW24+huMsNxbpm1wMqwWqQstpWG7LL+BaPc3AlvS6A4Zk0wxF6av0P ++7AWcfqa+9tLIuphH0aJc6LTedkk65SfhGuJAl0p9mR8fLMtqpDIiyAzN6eteHKe8 ++1+sSk0Qwm6wzPtk4EaT92dXTuRcsqHIGezsLtI0LRaXSTuVrwzYzS+DPyvsm/3h4 ++fx9+FukCgYEA88yVSAsFRXBpcM5QOVgHMT0gr2y/ieCvcn6IV9s/rTs3P4Lnp7u3 ++INHjOKEIIKDo1i/++RfLy6gZFJolT2AoO5KwgGh7gAzQhTaeiRFe0guDfQ/TyqIy ++jZkCuhue9ONqOEBJzf8d7yoLIGuABQmmwd9ynUmEUj6ZwA9R+cq3q5MCgYEA8kAi ++61ZvAT0oqheZSrxNCXXAYUtJno1btZL6eGn5yZJYY686TAR/sXZ/VprkBPljLSKC ++2SMy+3cJylmB1hDE1mPZVKOXb5GOxbZVcPlmRi3yVgSrRmWiR93o3Kk9Ee2Bozbh ++gGDSe75+k0zPvGuKWNFawLTgYnV2jHMe7jvmwcUCgYAcMLnKPMv9PYRTsOeB2fXq ++8aCH6FE1hi+DU7I8RnPUehZnV6GluYTxXJOjhqtD6pdBvQcEkoXUJLnRsglCZmIA ++kXOrRWmSYujxnmEyhDmsm/w2R9A7jAnAacLw9iSpOGqd2oEuOqOhdgEXXJbO/lCz ++9jxwh4GvaOGqXZsjARe/1QKBgFRK5Numk7GGqmOlGn3az6N/CZXRMKiu3z5rCiRk ++G7p75a2qB0r0Ncp2RRDJjJX+gPfvjkAn81F0tj9mrbri0tsWm0TMN6FmsJszOr+4 ++yFGbIzuzHDW+n50KJkDB0rIuRnGYYxbcmeDdBAYVMCOL9/O3xTBQv9MCtGFinVyg ++E0dRAoGBAM/qws7uzcrr5m0YGrC7vkyONS2Cb9pzygjHpvwE/tUZA4+4LJYdHIVE ++j7FBejnhTL9o9HvDwBBEPZXoSt3Ev0TnF/LKR1PcuDHWhyDHphdkq7BSk1tswW5/ ++NXVb289b59dV3QpwrLzF6jQtAvm1bUXc1PoNFhrBjFzUGLslz5Io ++-----END RSA PRIVATE KEY----- +diff --git a/t/data/test_leaf.req.pem b/t/data/test_leaf.req.pem +new file mode 100644 +index 0000000..fcc5f45 +--- /dev/null ++++ b/t/data/test_leaf.req.pem +@@ -0,0 +1,15 @@ ++-----BEGIN CERTIFICATE REQUEST----- ++MIICVDCCATwCAQAwDzENMAsGA1UEAwwETGVhZjCCASIwDQYJKoZIhvcNAQEBBQAD ++ggEPADCCAQoCggEBAOa0eYS3XsiXadYF53ZTfaNhbbkpCWnFddFQ/c3Z7QToJ6Dk ++TiqDNTpHodvrG+CFDVuO0RJONQDf4jH66B6ityFYWc4RkAPqfat0k7NZpj5dVWp9 ++uDgmEWABmf0KE9WqzYDbtTljlS1POHI9UFCdF3/T0UbGtdKSzzo/STJf8vLOTf5Y ++JQZHImvZeQbCgXtBN8hdLtfdU5FQYbaKcGyDvW6mBg1ZxYgJx+hE9NNeAsAWp2rA ++XGZIatQ98KNmwY5VH6cBX4ggasQucUUIBg5ih7fvWP2k0FyaiIsme9nWLsbuNg3s ++3tMahuRO1rE0Z0Vj/5JBUmT6J27ZBKGZRn7C2x8CAwEAAaAAMA0GCSqGSIb3DQEB ++CwUAA4IBAQAIZ7M0DLAkqPm8kdM+h53+BMkK2ngfb1K0qgRMAc3ij8ernF+QsqV1 ++CiBk4w2bGQ+pxVf5XNjVuw0otV3C0NSlFSAmZXldXdJpW7WUWLG7HTstjjfNMJ3v ++9XxrqqoHBIvdWNk4Lni8nDqzm8SDtZRByqO9sv/Mlg2cq1A6TrQAOaDMz8YaHtom ++LFCzEkqtaxuG1fi5F5Px+HJQT3gF1shwdEED6pCuVIgGpNDBceZq76eweKC9WEOq ++77Is1jkfBC046dAVDpmz+avNbiP0SABemcSnvOJUnGM7EjLMY51OoZ0nc3CH0cO3 ++RVw6jE12UUQXyaxEZqAbKCk0CXfAOIBw ++-----END CERTIFICATE REQUEST----- +diff --git a/t/local/32_x509_get_cert_info.t b/t/local/32_x509_get_cert_info.t +index 08d158d..b8b3dd6 100644 +--- a/t/local/32_x509_get_cert_info.t ++++ b/t/local/32_x509_get_cert_info.t +@@ -2,7 +2,7 @@ + + use strict; + use warnings; +-use Test::More tests => 1261; ++use Test::More tests => 1016; + use Net::SSLeay; + use File::Spec; + use lib '.'; +@@ -19,12 +19,11 @@ my $hash = Net::SSLeay::X509_NAME_hash($name); + ok ($hash = 4003674586, "X509_NAME_hash"); + + # NOTE: *.pem_dump files are generated by helper script e.g.: +-# perl examples/X509_cert_details.pl -dump -pem t/data/cert_twitter.crt.pem > t/data/cert_paypal.crt.pem_dump ++# perl examples/X509_cert_details.pl -dump -pem t/data/cert_paypal.crt.pem > t/data/cert_paypal.crt.pem_dump + # + # Caution from perl 25 onwards, need use lib '.'; above in order to 'do' these files + my $dump = { + "cert_paypal.crt.pem" => do(File::Spec->catfile('t', 'data', 'cert_paypal.crt.pem_dump')), +- "cert_twitter.crt.pem" => do(File::Spec->catfile('t', 'data', 'cert_twitter.crt.pem_dump')), + "testcert_extended.crt.pem" => do(File::Spec->catfile('t', 'data', 'testcert_extended.crt.pem_dump')), + "testcert_simple.crt.pem" => do(File::Spec->catfile('t', 'data', 'testcert_simple.crt.pem_dump')), + "testcert_strange.crt.pem" => do(File::Spec->catfile('t', 'data', 'testcert_strange.crt.pem_dump')), +diff --git a/t/local/33_x509_create_cert.t b/t/local/33_x509_create_cert.t +index 69a64b1..437524e 100755 +--- a/t/local/33_x509_create_cert.t ++++ b/t/local/33_x509_create_cert.t +@@ -240,7 +240,7 @@ is(Net::SSLeay::X509_NAME_cmp($ca_issuer, $ca_subject), 0, "X509_NAME_cmp"); + + { ### X509 certificate - copy some fields from other certificate + +- my $orig_crt_pem = File::Spec->catfile('t', 'data', 'cert_twitter.crt.pem'); ++ my $orig_crt_pem = File::Spec->catfile('t', 'data', 'test_leaf.crt.pem'); + ok(my $bio = Net::SSLeay::BIO_new_file($orig_crt_pem, 'r'), "BIO_new_file"); + ok(my $orig_cert = Net::SSLeay::PEM_read_bio_X509($bio), "PEM_read_bio_X509"); + +diff --git a/t/local/36_verify.t b/t/local/36_verify.t +index 66e369d..f7e908c 100644 +--- a/t/local/36_verify.t ++++ b/t/local/36_verify.t +@@ -204,8 +204,8 @@ sub test_wildcard_checks + } + + sub verify_local_trust { +- my $digicert_ca = File::Spec->catfile('t', 'data', 'digicert.crt.pem'); +- my $twitter_chain = File::Spec->catfile('t', 'data', 'chain_twitter.crt.pem'); ++ my $digicert_ca = File::Spec->catfile('t', 'data', 'test_CA1.crt.pem'); ++ my $twitter_chain = File::Spec->catfile('t', 'data', 'chain_leaf.crt.pem'); + + # read in twitter chain + my $bio = Net::SSLeay::BIO_new_file($twitter_chain, 'r'); +-- +2.20.1 + diff --git a/perl-Net-SSLeay.spec b/perl-Net-SSLeay.spec index 6ce63a8..b81eef0 100644 --- a/perl-Net-SSLeay.spec +++ b/perl-Net-SSLeay.spec @@ -10,7 +10,7 @@ Name: perl-Net-SSLeay Version: 1.86 -Release: 0.2.09%{?dist} +Release: 0.3.09%{?dist} Summary: Perl extension for using OpenSSL License: Artistic 2.0 URL: https://metacpan.org/release/Net-SSLeay @@ -18,6 +18,9 @@ Source0: https://cpan.metacpan.org/authors/id/C/CH/CHRISN/Net-SSLeay-%{cpan_vers # Adapt tests to system-wide crypto policy, bug #1614884 Patch0: Net-SSLeay-1.85-Adapt-CTX_get_min_proto_version-tests-to-system-wide.patch Patch10: Net-SSLeay-1.86_09-pkgconfig.patch +# Replace expired test certificates, CPAN RT#129201, proposed to upstream +# +Patch11: Net-SSLeay-1.86_09-Replace-Twitter-chain-with-our-own-chain.patch # =========== Module Build =========================== BuildRequires: coreutils BuildRequires: findutils @@ -86,6 +89,8 @@ so you can write servers or clients for more complicated applications. # https://github.com/radiator-software/p5-net-ssleay/pull/127 %patch10 +%patch11 -p1 + # Fix permissions in examples to avoid bogus doc-file dependencies chmod -c 644 examples/* @@ -131,6 +136,9 @@ make test %{_mandir}/man3/Net::SSLeay::Handle.3* %changelog +* Thu Apr 18 2019 Petr Pisar - 1.86-0.3.09 +- Replace expired test certificates (CPAN RT#129201) + * Fri Mar 29 2019 Paul Howarth - 1.86-0.2.09 - Get libraries to link against from pkg-config https://github.com/radiator-software/p5-net-ssleay/pull/127