Refuse to accept certificate chains containing any RSA public key smaller

net/data/ssl/certificates/1024-rsa-ee-by-1024-rsa-intermediate.pem

Index: net/data/ssl/certificates/1024-rsa-ee-by-1024-rsa-intermediate.pem
===================================================================
--- net/data/ssl/certificates/1024-rsa-ee-by-1024-rsa-intermediate.pem	(revision 0)
+++ net/data/ssl/certificates/1024-rsa-ee-by-1024-rsa-intermediate.pem	(revision 0)
@@ -0,0 +1,50 @@
+Certificate:
+    Data:
+        Version: 1 (0x0)
+        Serial Number: 237 (0xed)
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: CN=1024 rsa Test intermediate CA
+        Validity
+            Not Before: Dec 12 22:47:53 2011 GMT
+            Not After : Dec  9 22:47:53 2021 GMT
+        Subject: C=US, ST=California, L=Mountain View, O=Test CA, CN=127.0.0.1
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:de:52:f9:7c:4e:29:e3:35:24:63:74:83:70:5b:
+                    90:75:75:53:65:cb:74:a1:8e:b8:5a:bf:17:d0:0d:
+                    a5:73:af:13:08:94:e4:ad:c3:d3:5c:bd:fd:b0:f7:
+                    0b:97:55:bd:7b:4d:87:54:d3:6b:0f:3f:1c:b9:fc:
+                    3b:65:20:29:4e:18:f0:77:fe:13:bb:b3:25:30:e4:
+                    3e:04:fa:49:4a:45:d0:80:a0:de:ba:1c:c9:be:ca:
+                    83:cc:94:18:f9:16:ab:3d:0f:43:28:b2:2c:d9:cf:
+                    43:17:17:48:9a:8e:6f:7a:53:46:4e:aa:ff:89:7b:
+                    a8:0e:e4:04:41:b8:45:a5:4f
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Alternative Name: 
+                IP Address:127.0.0.1

[wtc, 2011/12/13 21:56:18]

Please document these new test certificates in the
net/data/ssl/certificates/README file.

Ideally these test certificates should have a dNSName of
www.example.com instead of an iPAddress of 127.0.0.1 in
the subject alternative name.

Since you have already generated these test certificates,
you can ignore this suggestion.

+    Signature Algorithm: sha1WithRSAEncryption
+        99:ed:12:d1:1c:a1:a4:f6:88:30:23:40:69:af:14:ba:7b:e9:
+        24:ef:01:a9:6f:b0:77:78:91:49:f7:84:17:84:ca:63:e1:71:
+        8c:52:50:b7:20:06:fc:58:c9:20:d4:fa:78:89:5f:da:0b:2d:
+        88:c9:41:ed:a6:52:c6:f8:dc:c9:1a:11:c7:ab:0a:ae:80:e4:
+        7c:15:41:ac:64:63:3e:93:e5:ad:dc:de:e8:dc:d6:ca:0a:fd:
+        01:01:d7:4d:4a:dd:c6:93:7c:52:ad:61:18:09:8c:29:ae:6b:
+        42:d1:3a:98:d8:14:45:e4:d7:e1:b2:1e:12:92:99:65:6c:13:
+        03:46
+-----BEGIN CERTIFICATE-----
+MIICDTCCAXYCAgDtMA0GCSqGSIb3DQEBBQUAMCgxJjAkBgNVBAMMHTEwMjQgcnNh
+IFRlc3QgaW50ZXJtZWRpYXRlIENBMB4XDTExMTIxMjIyNDc1M1oXDTIxMTIwOTIy
+NDc1M1owYDELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNV
+BAcMDU1vdW50YWluIFZpZXcxEDAOBgNVBAoMB1Rlc3QgQ0ExEjAQBgNVBAMMCTEy
+Ny4wLjAuMTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA3lL5fE4p4zUkY3SD
+cFuQdXVTZct0oY64Wr8X0A2lc68TCJTkrcPTXL39sPcLl1W9e02HVNNrDz8cufw7
+ZSApThjwd/4Tu7MlMOQ+BPpJSkXQgKDeuhzJvsqDzJQY+RarPQ9DKLIs2c9DFxdI
+mo5velNGTqr/iXuoDuQEQbhFpU8CAwEAAaMTMBEwDwYDVR0RBAgwBocEfwAAATAN
+BgkqhkiG9w0BAQUFAAOBgQCZ7RLRHKGk9ogwI0BprxS6e+kk7wGpb7B3eJFJ94QX
+hMpj4XGMUlC3IAb8WMkg1Pp4iV/aCy2IyUHtplLG+NzJGhHHqwqugOR8FUGsZGM+
+k+Wt3N7o3NbKCv0BAddNSt3Gk3xSrWEYCYwprmtC0TqY2BRF5Nfhsh4SkpllbBMD
+Rg==
+-----END CERTIFICATE-----