NOT FOR REVIEW....

net/data/verify_certificate_chain_unittest/intermediary-basic-constraints-ca-false.pem

Index: net/data/verify_certificate_chain_unittest/intermediary-basic-constraints-ca-false.pem
diff --git a/net/data/verify_certificate_chain_unittest/intermediary-basic-constraints-ca-false.pem b/net/data/verify_certificate_chain_unittest/intermediary-basic-constraints-ca-false.pem
new file mode 100644
index 0000000000000000000000000000000000000000..17e3eb5b002db844d70ddb95a12798c81b09a5c5
--- /dev/null
+++ b/net/data/verify_certificate_chain_unittest/intermediary-basic-constraints-ca-false.pem
@@ -0,0 +1,281 @@
+[Created by: generate-intermediary-basic-constraints-ca-false.py]
+
+Simple certificate chain with 1 intermediary and a trusted
+root. The intermediary has a basic constraints extension that indicates it is
+NOT a CA
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 1 (0x1)
+    Signature Algorithm: sha256WithRSAEncryption
+        Issuer: CN=Intermediary
+        Validity
+            Not Before: Jan  1 12:00:00 2015 GMT
+            Not After : Jan  1 12:00:00 2016 GMT
+        Subject: CN=Target
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:af:3f:28:cd:de:50:38:ad:64:1b:a3:0f:9f:36:
+                    f8:e2:c9:ee:80:70:97:16:c1:7f:41:92:a6:1e:cf:
+                    12:1f:c8:39:c0:b2:8e:cc:44:08:0b:ff:8c:ce:ea:
+                    55:ff:36:b9:ec:ec:c8:18:7b:e7:ea:c7:37:a6:23:
+                    da:af:b7:f0:1c:dd:bc:04:18:fb:4e:0e:ee:a9:84:
+                    57:83:4b:61:60:45:89:7c:3f:d1:a6:fd:a8:c3:04:
+                    20:7b:81:c2:87:2c:fd:90:24:26:64:05:07:50:da:
+                    5b:e9:10:d4:a7:90:6b:43:65:8d:87:44:e0:9a:54:
+                    fa:06:87:91:58:fa:cb:23:67:ad:57:ee:a2:12:94:
+                    c3:ef:ee:09:7b:a4:a6:f1:6c:6f:86:8d:56:16:08:
+                    da:40:a1:23:83:47:c3:db:76:5a:27:39:e9:cf:91:
+                    a4:2b:40:42:b3:00:b9:65:41:9b:e6:bd:08:9f:27:
+                    54:dd:b4:65:7d:bd:c4:31:2f:39:e9:b7:17:52:db:
+                    8a:ef:ea:a1:53:07:bc:e2:83:32:ea:f8:12:c8:f7:
+                    15:0f:c6:ed:d5:d3:bb:d8:40:85:4e:27:25:49:dd:
+                    56:24:1e:c8:9c:29:84:e8:55:49:75:7c:30:a8:65:
+                    77:74:65:52:ef:d8:53:2c:1d:e8:47:54:db:38:83:
+                    29:37
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                13:1A:5E:4D:F3:B0:A3:3D:65:87:2A:B0:F6:8C:BF:76:3B:25:17:16
+            X509v3 Authority Key Identifier: 
+                keyid:87:86:D7:57:FA:3D:BD:CD:3E:46:A0:E6:36:C3:AF:2F:3E:9D:38:E4
+
+            Authority Information Access: 
+                CA Issuers - URI:http://url-for-aia/Intermediary.cer
+
+            X509v3 CRL Distribution Points: 
+
+                Full Name:
+                  URI:http://url-for-crl/Intermediary.crl
+
+            X509v3 Key Usage: critical
+                Digital Signature, Key Encipherment
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, TLS Web Client Authentication
+    Signature Algorithm: sha256WithRSAEncryption
+         05:63:28:a9:c1:a7:7e:2d:0d:8b:2c:36:11:ab:86:7d:3e:b4:
+         56:e0:22:86:31:68:bb:c4:4d:26:b3:13:f9:81:47:8b:a5:53:
+         87:61:79:0d:f8:b2:f3:4d:1f:a6:21:9e:b4:90:4b:2b:3a:e0:
+         b2:5f:a2:af:6f:41:aa:1d:d0:a8:9d:fc:3d:85:d1:69:f3:a9:
+         0c:af:25:92:af:01:71:55:b4:a9:ac:9a:3d:5a:7e:3c:e3:1c:
+         f7:de:82:bc:88:87:1c:be:75:a4:f9:13:5c:ff:e6:76:84:28:
+         43:bf:8e:d2:03:67:df:7d:aa:44:a4:da:e1:20:ce:ac:11:f2:
+         f9:8a:7e:94:09:2d:35:0f:db:74:e6:23:21:18:16:49:cb:d5:
+         52:d8:ca:4d:20:3b:7a:04:7e:5d:1c:49:da:03:37:cb:bb:ee:
+         d1:d9:c5:6a:65:35:5f:ed:d1:38:8d:3e:ef:42:d3:b9:81:70:
+         8d:e5:b6:ed:46:7d:e8:b2:12:45:fa:18:36:36:00:48:2e:87:
+         85:8a:19:01:c1:0a:5e:cc:79:ae:1b:fe:2d:2d:d8:d9:1d:2c:
+         a7:fa:7a:2e:6e:24:7b:61:2a:0a:4a:ee:f5:e9:2c:4b:dc:ea:
+         cc:1c:9d:38:af:78:55:20:80:e7:9d:a7:fe:dc:e4:a6:af:ce:
+         4e:6a:18:cb
+-----BEGIN CERTIFICATE-----
+MIIDjTCCAnWgAwIBAgIBATANBgkqhkiG9w0BAQsFADAXMRUwEwYDVQQDDAxJbnRl
+cm1lZGlhcnkwHhcNMTUwMTAxMTIwMDAwWhcNMTYwMTAxMTIwMDAwWjARMQ8wDQYD
+VQQDDAZUYXJnZXQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCvPyjN
+3lA4rWQbow+fNvjiye6AcJcWwX9BkqYezxIfyDnAso7MRAgL/4zO6lX/Nrns7MgY
+e+fqxzemI9qvt/Ac3bwEGPtODu6phFeDS2FgRYl8P9Gm/ajDBCB7gcKHLP2QJCZk
+BQdQ2lvpENSnkGtDZY2HROCaVPoGh5FY+ssjZ61X7qISlMPv7gl7pKbxbG+GjVYW
+CNpAoSODR8PbdlonOenPkaQrQEKzALllQZvmvQifJ1TdtGV9vcQxLznptxdS24rv
+6qFTB7zigzLq+BLI9xUPxu3V07vYQIVOJyVJ3VYkHsicKYToVUl1fDCoZXd0ZVLv
+2FMsHehHVNs4gyk3AgMBAAGjgekwgeYwHQYDVR0OBBYEFBMaXk3zsKM9ZYcqsPaM
+v3Y7JRcWMB8GA1UdIwQYMBaAFIeG11f6Pb3NPkag5jbDry8+nTjkMD8GCCsGAQUF
+BwEBBDMwMTAvBggrBgEFBQcwAoYjaHR0cDovL3VybC1mb3ItYWlhL0ludGVybWVk
+aWFyeS5jZXIwNAYDVR0fBC0wKzApoCegJYYjaHR0cDovL3VybC1mb3ItY3JsL0lu
+dGVybWVkaWFyeS5jcmwwDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUF
+BwMBBggrBgEFBQcDAjANBgkqhkiG9w0BAQsFAAOCAQEABWMoqcGnfi0Niyw2EauG
+fT60VuAihjFou8RNJrMT+YFHi6VTh2F5Dfiy800fpiGetJBLKzrgsl+ir29Bqh3Q
+qJ38PYXRafOpDK8lkq8BcVW0qayaPVp+POMc996CvIiHHL51pPkTXP/mdoQoQ7+O
+0gNn332qRKTa4SDOrBHy+Yp+lAktNQ/bdOYjIRgWScvVUtjKTSA7egR+XRxJ2gM3
+y7vu0dnFamU1X+3ROI0+70LTuYFwjeW27UZ96LISRfoYNjYASC6HhYoZAcEKXsx5
+rhv+LS3Y2R0sp/p6Lm4ke2EqCkru9eksS9zqzBydOK94VSCA552n/tzkpq/OTmoY
+yw==
+-----END CERTIFICATE-----
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 2 (0x2)
+    Signature Algorithm: sha256WithRSAEncryption
+        Issuer: CN=Root
+        Validity
+            Not Before: Jan  1 12:00:00 2015 GMT
+            Not After : Jan  1 12:00:00 2016 GMT
+        Subject: CN=Intermediary
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:e5:25:d9:e0:d5:dc:2e:c1:58:68:6c:0a:88:64:
+                    02:f7:76:61:ea:94:22:ca:db:f7:0c:19:b5:ea:1c:
+                    3f:eb:2d:10:10:b6:91:92:24:49:e9:d8:61:c4:cf:
+                    2b:ca:58:1a:81:43:7b:a7:68:65:69:73:d1:3c:62:
+                    88:b3:01:12:50:31:09:dd:0a:0f:89:1f:b4:15:7d:
+                    81:6d:c0:c0:e6:af:24:29:8a:5b:66:29:fb:d8:08:
+                    c9:9a:31:97:35:bf:91:72:a6:1f:9c:0b:b2:f9:45:
+                    0c:33:d2:29:79:01:df:bc:c6:7c:99:d0:e0:ae:2c:
+                    89:95:e3:ee:ff:7a:9b:e7:4d:c6:b5:b1:6b:4e:be:
+                    97:8e:9a:f6:26:bf:40:7b:33:13:f3:75:6c:8b:f7:
+                    3b:8b:9d:31:53:fb:a6:dc:86:68:2b:fd:ad:ba:91:
+                    07:72:86:b8:6f:ec:74:af:c5:74:d9:33:4c:e3:4f:
+                    35:0a:63:8a:3d:97:48:c2:7b:00:4d:46:99:67:4f:
+                    68:f8:2c:17:f5:2f:09:27:c4:23:1e:2f:96:47:81:
+                    05:71:8a:65:32:40:0a:70:a5:11:e8:b4:6c:6e:0e:
+                    3a:cb:4e:9a:fc:08:f5:c9:93:96:e5:95:72:06:1c:
+                    3c:39:a9:02:1a:96:1d:06:0e:1c:c0:43:21:0c:95:
+                    df:d1
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                87:86:D7:57:FA:3D:BD:CD:3E:46:A0:E6:36:C3:AF:2F:3E:9D:38:E4
+            X509v3 Authority Key Identifier: 
+                keyid:A4:08:0A:96:A5:26:E0:1A:45:1B:DC:89:00:2B:40:25:6A:C6:E9:92
+
+            Authority Information Access: 
+                CA Issuers - URI:http://url-for-aia/Root.cer
+
+            X509v3 CRL Distribution Points: 
+
+                Full Name:
+                  URI:http://url-for-crl/Root.crl
+
+            X509v3 Key Usage: critical
+                Certificate Sign, CRL Sign
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+    Signature Algorithm: sha256WithRSAEncryption
+         67:f8:a9:2c:cf:fb:04:68:ab:50:fe:42:57:c6:57:3e:cd:c1:
+         d6:66:20:68:90:7d:42:1f:6c:d7:d8:22:bc:9e:1b:49:21:51:
+         5e:e6:82:be:72:bc:f5:f4:35:b6:42:48:5e:1f:d3:f1:33:5d:
+         b9:d4:ca:d8:92:f8:8c:c6:36:9b:cc:42:73:d0:8d:fe:23:fd:
+         46:23:cb:b8:63:b1:63:3d:49:fa:3a:0f:31:7f:c7:4c:a7:86:
+         80:d9:08:a5:41:9b:6d:3f:e9:51:c4:b7:62:10:9c:08:45:9e:
+         1f:04:2c:4c:b8:2b:27:bf:6e:a1:a7:62:a7:e8:55:a6:ef:02:
+         4a:65:be:d2:6f:f4:6e:37:2f:b4:7e:d9:4a:cd:d6:48:46:36:
+         78:8a:a3:c6:93:cc:05:1d:98:64:69:2c:bd:6b:15:f1:ca:42:
+         ca:d2:fb:d0:ee:49:74:8a:ed:75:68:4c:93:4e:05:90:f6:85:
+         8e:20:81:64:f2:9e:2c:81:f4:9c:c5:14:02:5b:77:78:20:57:
+         9c:9f:15:18:30:a6:de:11:74:d1:f2:b7:af:9f:1c:c1:b0:20:
+         ac:4e:42:fc:16:bf:5d:6a:06:34:0c:fa:95:d4:1c:37:8a:b7:
+         e7:a6:e6:cc:e4:7b:dc:8f:d3:77:06:10:18:17:76:c5:9f:b4:
+         85:11:7e:b7
+-----BEGIN CERTIFICATE-----
+MIIDajCCAlKgAwIBAgIBAjANBgkqhkiG9w0BAQsFADAPMQ0wCwYDVQQDDARSb290
+MB4XDTE1MDEwMTEyMDAwMFoXDTE2MDEwMTEyMDAwMFowFzEVMBMGA1UEAwwMSW50
+ZXJtZWRpYXJ5MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA5SXZ4NXc
+LsFYaGwKiGQC93Zh6pQiytv3DBm16hw/6y0QELaRkiRJ6dhhxM8rylgagUN7p2hl
+aXPRPGKIswESUDEJ3QoPiR+0FX2BbcDA5q8kKYpbZin72AjJmjGXNb+RcqYfnAuy
++UUMM9IpeQHfvMZ8mdDgriyJlePu/3qb503GtbFrTr6Xjpr2Jr9AezMT83Vsi/c7
+i50xU/um3IZoK/2tupEHcoa4b+x0r8V02TNM4081CmOKPZdIwnsATUaZZ09o+CwX
+9S8JJ8QjHi+WR4EFcYplMkAKcKUR6LRsbg46y06a/Aj1yZOW5ZVyBhw8OakCGpYd
+Bg4cwEMhDJXf0QIDAQABo4HIMIHFMB0GA1UdDgQWBBSHhtdX+j29zT5GoOY2w68v
+Pp045DAfBgNVHSMEGDAWgBSkCAqWpSbgGkUb3IkAK0AlasbpkjA3BggrBgEFBQcB
+AQQrMCkwJwYIKwYBBQUHMAKGG2h0dHA6Ly91cmwtZm9yLWFpYS9Sb290LmNlcjAs
+BgNVHR8EJTAjMCGgH6AdhhtodHRwOi8vdXJsLWZvci1jcmwvUm9vdC5jcmwwDgYD
+VR0PAQH/BAQDAgEGMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADggEBAGf4
+qSzP+wRoq1D+QlfGVz7NwdZmIGiQfUIfbNfYIryeG0khUV7mgr5yvPX0NbZCSF4f
+0/EzXbnUytiS+IzGNpvMQnPQjf4j/UYjy7hjsWM9Sfo6DzF/x0ynhoDZCKVBm20/
+6VHEt2IQnAhFnh8ELEy4Kye/bqGnYqfoVabvAkplvtJv9G43L7R+2UrN1khGNniK
+o8aTzAUdmGRpLL1rFfHKQsrS+9DuSXSK7XVoTJNOBZD2hY4ggWTyniyB9JzFFAJb
+d3ggV5yfFRgwpt4RdNHyt6+fHMGwIKxOQvwWv11qBjQM+pXUHDeKt+em5szke9yP
+03cGEBgXdsWftIURfrc=
+-----END CERTIFICATE-----
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 1 (0x1)
+    Signature Algorithm: sha256WithRSAEncryption
+        Issuer: CN=Root
+        Validity
+            Not Before: Jan  1 12:00:00 2015 GMT
+            Not After : Jan  1 12:00:00 2016 GMT
+        Subject: CN=Root
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:9e:0b:7e:57:1e:74:78:c7:84:fd:d0:8f:68:26:
+                    08:10:74:e1:84:c8:9f:b3:b0:55:60:8f:e8:c3:10:
+                    79:e8:3d:75:71:d0:9b:70:a1:77:7f:36:e0:f8:c3:
+                    bd:7a:67:74:50:4e:30:da:14:24:7e:cb:29:e5:98:
+                    b5:d7:94:87:7b:03:4f:f8:81:85:ee:7e:f2:b3:de:
+                    f2:4a:3c:f2:4f:2e:43:d7:e0:4b:2f:64:0e:9e:e1:
+                    45:c2:e0:1f:16:ef:b5:05:94:79:f8:26:d3:63:3f:
+                    ea:ee:9c:f9:83:36:a9:bc:63:2e:74:3a:70:f2:48:
+                    d9:79:38:df:93:92:40:e4:91:b3:4b:eb:6a:d6:c8:
+                    8d:65:b7:a9:a2:cd:07:36:6a:5e:02:76:d4:e6:01:
+                    9c:52:3f:1b:1d:e6:80:62:82:ae:67:35:29:cb:c3:
+                    91:70:73:ab:43:e7:0b:f7:fa:fc:28:7e:ee:d2:25:
+                    6a:d1:10:8a:7f:93:4e:92:5f:a6:4f:a1:95:34:65:
+                    c9:49:c5:77:aa:c6:0a:fc:a2:05:e8:7c:9a:9c:86:
+                    39:eb:83:c0:00:d6:02:db:20:7d:b8:38:86:0f:70:
+                    d3:fb:19:db:5e:1b:99:39:91:d8:9a:4e:cb:71:5b:
+                    54:6c:8c:40:ca:1f:96:fa:2a:df:e8:94:04:ca:39:
+                    98:97
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                A4:08:0A:96:A5:26:E0:1A:45:1B:DC:89:00:2B:40:25:6A:C6:E9:92
+            X509v3 Authority Key Identifier: 
+                keyid:A4:08:0A:96:A5:26:E0:1A:45:1B:DC:89:00:2B:40:25:6A:C6:E9:92
+
+            Authority Information Access: 
+                CA Issuers - URI:http://url-for-aia/Root.cer
+
+            X509v3 CRL Distribution Points: 
+
+                Full Name:
+                  URI:http://url-for-crl/Root.crl
+
+            X509v3 Key Usage: critical
+                Certificate Sign, CRL Sign
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+    Signature Algorithm: sha256WithRSAEncryption
+         32:aa:89:c8:d1:1d:20:f9:e4:ea:16:79:af:d7:26:75:e0:ce:
+         2b:c5:7c:b1:0d:68:38:60:a4:58:62:e5:85:a9:e0:86:8a:75:
+         32:8e:ba:62:31:07:5c:59:bf:f5:dc:74:85:7a:39:40:2e:03:
+         08:84:d4:11:e0:ae:1d:cf:70:d0:09:ef:16:27:1f:9b:00:18:
+         ac:da:c3:f4:76:0d:95:7b:24:6d:4c:3a:c6:43:31:a6:e1:ae:
+         57:5a:1a:a7:67:af:a0:ac:af:c6:78:ce:e7:2e:21:34:53:d3:
+         ff:7c:42:77:9e:ba:59:25:34:ae:0d:5e:3b:a9:f5:cd:b7:57:
+         a6:40:e7:92:b6:a6:8d:fd:a0:f7:76:21:1e:68:ae:7f:5a:64:
+         94:ec:84:0f:f7:05:4e:0f:91:0d:f2:69:de:3e:b9:ed:71:c8:
+         03:cc:9f:55:3b:bf:74:4f:21:75:be:2d:ba:e4:cd:f8:56:0f:
+         1a:32:5a:e5:e4:e8:3e:f5:7b:e1:12:2f:83:4d:4a:d3:68:1a:
+         42:2c:1e:d9:af:41:32:cd:63:3c:19:df:17:4f:b1:f4:0d:99:
+         56:49:43:05:f6:97:72:ba:ff:40:f6:bc:38:fc:0d:b2:e1:1a:
+         ea:b5:e1:f7:81:ac:cb:f3:00:b4:65:77:f7:67:6d:67:d3:1f:
+         ba:45:94:90
+-----BEGIN TRUSTED_CERTIFICATE-----
+MIIDZTCCAk2gAwIBAgIBATANBgkqhkiG9w0BAQsFADAPMQ0wCwYDVQQDDARSb290
+MB4XDTE1MDEwMTEyMDAwMFoXDTE2MDEwMTEyMDAwMFowDzENMAsGA1UEAwwEUm9v
+dDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJ4LflcedHjHhP3Qj2gm
+CBB04YTIn7OwVWCP6MMQeeg9dXHQm3Chd3824PjDvXpndFBOMNoUJH7LKeWYtdeU
+h3sDT/iBhe5+8rPe8ko88k8uQ9fgSy9kDp7hRcLgHxbvtQWUefgm02M/6u6c+YM2
+qbxjLnQ6cPJI2Xk435OSQOSRs0vratbIjWW3qaLNBzZqXgJ21OYBnFI/Gx3mgGKC
+rmc1KcvDkXBzq0PnC/f6/Ch+7tIlatEQin+TTpJfpk+hlTRlyUnFd6rGCvyiBeh8
+mpyGOeuDwADWAtsgfbg4hg9w0/sZ214bmTmR2JpOy3FbVGyMQMoflvoq3+iUBMo5
+mJcCAwEAAaOByzCByDAdBgNVHQ4EFgQUpAgKlqUm4BpFG9yJACtAJWrG6ZIwHwYD
+VR0jBBgwFoAUpAgKlqUm4BpFG9yJACtAJWrG6ZIwNwYIKwYBBQUHAQEEKzApMCcG
+CCsGAQUFBzAChhtodHRwOi8vdXJsLWZvci1haWEvUm9vdC5jZXIwLAYDVR0fBCUw
+IzAhoB+gHYYbaHR0cDovL3VybC1mb3ItY3JsL1Jvb3QuY3JsMA4GA1UdDwEB/wQE
+AwIBBjAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQAyqonI0R0g
++eTqFnmv1yZ14M4rxXyxDWg4YKRYYuWFqeCGinUyjrpiMQdcWb/13HSFejlALgMI
+hNQR4K4dz3DQCe8WJx+bABis2sP0dg2VeyRtTDrGQzGm4a5XWhqnZ6+grK/GeM7n
+LiE0U9P/fEJ3nrpZJTSuDV47qfXNt1emQOeStqaN/aD3diEeaK5/WmSU7IQP9wVO
+D5EN8mnePrntccgDzJ9VO790TyF1vi265M34Vg8aMlrl5Og+9XvhEi+DTUrTaBpC
+LB7Zr0EyzWM8Gd8XT7H0DZlWSUMF9pdyuv9A9rw4/A2y4RrqteH3gazL8wC0ZXf3
+Z21n0x+6RZSQ
+-----END TRUSTED_CERTIFICATE-----
+
+-----BEGIN TIME-----
+MTYwMzAyMTIwMDAwWg==
+-----END TIME-----
+
+-----BEGIN VERIFY_RESULT-----
+RkFJTA==
+-----END VERIFY_RESULT-----