NOT FOR REVIEW....

net/data/verify_certificate_chain_unittest/intermediary-basic-constraints-not-critical.pem

Index: net/data/verify_certificate_chain_unittest/intermediary-basic-constraints-not-critical.pem
diff --git a/net/data/verify_certificate_chain_unittest/intermediary-basic-constraints-not-critical.pem b/net/data/verify_certificate_chain_unittest/intermediary-basic-constraints-not-critical.pem
new file mode 100644
index 0000000000000000000000000000000000000000..4934bc7dfec2304d77bb2594b0aa0874db0312c0
--- /dev/null
+++ b/net/data/verify_certificate_chain_unittest/intermediary-basic-constraints-not-critical.pem
@@ -0,0 +1,281 @@
+[Created by: generate-intermediary-basic-constraints-not-critical.py]
+
+Simple certificate chain with 1 intermediary and a trusted
+root. The intermediary has a basic constraints extension but does not mark it
+as critical.
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 1 (0x1)
+    Signature Algorithm: sha256WithRSAEncryption
+        Issuer: CN=Intermediary
+        Validity
+            Not Before: Jan  1 12:00:00 2015 GMT
+            Not After : Jan  1 12:00:00 2016 GMT
+        Subject: CN=Target
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:e6:e3:e8:e4:eb:a1:68:42:6a:a4:d2:9e:27:e8:
+                    4e:9a:05:fd:8d:a0:53:1c:38:22:40:03:9f:f2:df:
+                    45:9a:07:cf:7d:b9:b6:23:3e:80:7d:a5:5d:08:9a:
+                    16:ec:7f:b4:1b:37:09:50:7b:1d:d9:ee:db:58:d8:
+                    72:ae:e6:51:5c:1b:36:ab:81:b1:d6:ed:84:a3:38:
+                    00:9e:47:c9:56:c4:2d:1d:bc:c8:c5:ed:55:52:1e:
+                    b5:4b:a8:2f:23:2c:e6:3a:3f:e2:27:77:93:f6:c9:
+                    e2:cb:94:fd:7b:32:63:79:d2:34:9b:28:e3:a0:70:
+                    a3:75:b8:e5:ca:b7:10:2c:fd:5b:4d:a8:8c:2b:b4:
+                    ad:8d:d5:d0:96:de:1c:45:e7:0e:47:8a:b7:ce:05:
+                    0b:3c:56:58:5a:5f:7d:fa:7c:e8:c0:aa:fc:f1:90:
+                    d3:0d:59:9b:07:60:09:0f:8c:93:41:df:99:f2:44:
+                    ef:85:96:e1:09:f0:9b:f7:05:b7:da:b1:47:80:fa:
+                    02:e8:0c:83:7b:de:be:1a:20:f1:e2:bb:6f:a2:20:
+                    ac:38:42:81:07:49:71:c8:ca:c8:b3:31:9c:1a:8e:
+                    18:54:e6:82:9f:96:7d:d6:2d:f3:d5:eb:e6:32:58:
+                    fe:ea:00:79:64:46:bd:0a:b0:bf:43:51:38:c6:07:
+                    66:57
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                BC:B2:6E:AC:84:BA:FB:7A:F9:D5:99:26:D4:1A:DA:58:A9:46:1B:B2
+            X509v3 Authority Key Identifier: 
+                keyid:D8:89:56:5D:5C:5A:1E:89:78:18:20:B5:1E:72:64:2B:EB:9C:D7:1C
+
+            Authority Information Access: 
+                CA Issuers - URI:http://url-for-aia/Intermediary.cer
+
+            X509v3 CRL Distribution Points: 
+
+                Full Name:
+                  URI:http://url-for-crl/Intermediary.crl
+
+            X509v3 Key Usage: critical
+                Digital Signature, Key Encipherment
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, TLS Web Client Authentication
+    Signature Algorithm: sha256WithRSAEncryption
+         97:85:da:f0:27:d1:60:e1:7e:dc:bd:f1:2b:0f:e5:de:c0:f9:
+         cf:15:4d:3d:fa:cb:cb:17:3c:58:92:55:01:91:65:13:02:b8:
+         47:6e:5d:d7:ec:41:fa:bf:e0:6f:0a:b8:db:5f:47:e7:0f:a0:
+         c6:1e:03:9e:fb:02:f0:3d:4b:9e:4b:f4:c3:4b:59:ae:53:9a:
+         08:6c:06:91:33:7b:1c:1d:70:7e:6e:1a:78:ee:09:67:18:9a:
+         cd:c1:4f:8d:41:b0:75:fe:14:e7:d0:bc:53:17:f3:63:41:76:
+         c7:5e:1b:44:cd:bc:a4:f8:c7:8d:eb:6d:40:3a:ef:2a:1e:38:
+         a2:6e:9d:ad:46:42:34:27:ee:4b:ea:cb:27:e5:c3:a7:bc:4a:
+         40:b3:69:69:5c:d4:32:83:84:54:43:a3:74:e1:ba:1a:fb:56:
+         99:0f:2c:14:2e:1f:a1:29:78:f7:be:d1:6b:f5:0a:05:0f:d4:
+         52:6f:aa:f2:81:1f:40:ac:84:cb:ff:08:ad:a2:e8:bf:e3:03:
+         34:da:9a:1d:9b:26:5d:86:70:90:bf:c2:aa:da:a2:4c:2e:da:
+         2b:d3:7f:bd:38:4a:e4:c7:0e:57:9c:4b:2b:bb:2f:4a:6d:7a:
+         e8:cb:6c:4d:52:1e:d1:b9:10:5d:b9:db:fb:67:f6:76:ba:65:
+         d7:4e:1c:79
+-----BEGIN CERTIFICATE-----
+MIIDjTCCAnWgAwIBAgIBATANBgkqhkiG9w0BAQsFADAXMRUwEwYDVQQDDAxJbnRl
+cm1lZGlhcnkwHhcNMTUwMTAxMTIwMDAwWhcNMTYwMTAxMTIwMDAwWjARMQ8wDQYD
+VQQDDAZUYXJnZXQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDm4+jk
+66FoQmqk0p4n6E6aBf2NoFMcOCJAA5/y30WaB899ubYjPoB9pV0Imhbsf7QbNwlQ
+ex3Z7ttY2HKu5lFcGzargbHW7YSjOACeR8lWxC0dvMjF7VVSHrVLqC8jLOY6P+In
+d5P2yeLLlP17MmN50jSbKOOgcKN1uOXKtxAs/VtNqIwrtK2N1dCW3hxF5w5HirfO
+BQs8VlhaX336fOjAqvzxkNMNWZsHYAkPjJNB35nyRO+FluEJ8Jv3BbfasUeA+gLo
+DIN73r4aIPHiu2+iIKw4QoEHSXHIysizMZwajhhU5oKfln3WLfPV6+YyWP7qAHlk
+Rr0KsL9DUTjGB2ZXAgMBAAGjgekwgeYwHQYDVR0OBBYEFLyybqyEuvt6+dWZJtQa
+2lipRhuyMB8GA1UdIwQYMBaAFNiJVl1cWh6JeBggtR5yZCvrnNccMD8GCCsGAQUF
+BwEBBDMwMTAvBggrBgEFBQcwAoYjaHR0cDovL3VybC1mb3ItYWlhL0ludGVybWVk
+aWFyeS5jZXIwNAYDVR0fBC0wKzApoCegJYYjaHR0cDovL3VybC1mb3ItY3JsL0lu
+dGVybWVkaWFyeS5jcmwwDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUF
+BwMBBggrBgEFBQcDAjANBgkqhkiG9w0BAQsFAAOCAQEAl4Xa8CfRYOF+3L3xKw/l
+3sD5zxVNPfrLyxc8WJJVAZFlEwK4R25d1+xB+r/gbwq4219H5w+gxh4DnvsC8D1L
+nkv0w0tZrlOaCGwGkTN7HB1wfm4aeO4JZxiazcFPjUGwdf4U59C8UxfzY0F2x14b
+RM28pPjHjettQDrvKh44om6drUZCNCfuS+rLJ+XDp7xKQLNpaVzUMoOEVEOjdOG6
+GvtWmQ8sFC4foSl4977Ra/UKBQ/UUm+q8oEfQKyEy/8IraLov+MDNNqaHZsmXYZw
+kL/CqtqiTC7aK9N/vThK5McOV5xLK7svSm166MtsTVIe0bkQXbnb+2f2drpl104c
+eQ==
+-----END CERTIFICATE-----
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 2 (0x2)
+    Signature Algorithm: sha256WithRSAEncryption
+        Issuer: CN=Root
+        Validity
+            Not Before: Jan  1 12:00:00 2015 GMT
+            Not After : Jan  1 12:00:00 2016 GMT
+        Subject: CN=Intermediary
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:9c:3f:b7:83:c7:4f:4c:23:b4:b3:0c:73:e3:d1:
+                    25:3b:b6:6e:17:7f:f2:64:26:90:bf:e0:26:fc:4a:
+                    af:10:0c:05:2a:c1:88:ce:cd:b7:ae:b3:73:e8:ca:
+                    bc:ae:8a:0a:8a:8f:4d:eb:fe:71:ec:1b:af:80:71:
+                    75:90:9a:34:64:a1:0a:88:f0:80:56:9c:90:6c:51:
+                    80:db:a8:3c:65:f9:39:82:97:c1:0b:7f:32:bd:3e:
+                    59:bf:22:29:50:ec:8b:f3:d0:ea:e5:9e:e2:e1:6a:
+                    90:20:83:12:d6:37:ce:59:23:22:1e:df:32:67:30:
+                    a8:83:0c:17:7e:4e:90:53:b8:04:9a:33:20:57:79:
+                    3c:51:36:52:ea:c4:eb:a0:0e:2b:e5:a7:44:2a:31:
+                    92:2c:97:a0:92:11:cf:1f:5b:ac:70:fa:61:73:6d:
+                    c6:b8:e6:18:87:b4:4e:cf:8f:71:f5:d0:27:f7:99:
+                    0d:d5:06:bc:c9:8a:6d:83:c5:60:85:3a:32:bb:91:
+                    91:63:63:e6:0e:46:74:4b:c9:7d:d0:2d:60:da:2d:
+                    26:c7:32:a3:a5:db:c0:ef:01:65:11:24:c1:5d:b6:
+                    80:bd:b6:8b:b2:54:5e:aa:a9:69:fd:e5:e0:52:a7:
+                    78:ce:0c:47:cf:33:a7:19:77:5f:4f:e5:e5:80:81:
+                    f0:77
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                D8:89:56:5D:5C:5A:1E:89:78:18:20:B5:1E:72:64:2B:EB:9C:D7:1C
+            X509v3 Authority Key Identifier: 
+                keyid:57:B0:A0:49:FC:14:4D:FB:F8:61:9F:00:FB:E2:3B:1D:76:06:AA:5E
+
+            Authority Information Access: 
+                CA Issuers - URI:http://url-for-aia/Root.cer
+
+            X509v3 CRL Distribution Points: 
+
+                Full Name:
+                  URI:http://url-for-crl/Root.crl
+
+            X509v3 Key Usage: critical
+                Certificate Sign, CRL Sign
+            X509v3 Basic Constraints: 
+                CA:TRUE
+    Signature Algorithm: sha256WithRSAEncryption
+         af:d1:9c:3c:f5:d4:93:2b:30:ce:57:73:ed:1c:aa:03:b7:32:
+         4c:e9:d1:41:5e:f6:52:df:42:f5:fe:92:5a:9a:b7:81:ac:b5:
+         c2:95:54:37:67:8d:e9:fa:75:7d:d4:bd:b2:e7:47:e7:92:a7:
+         a6:24:02:1f:9e:14:45:9b:fb:a9:97:3d:52:b3:5d:6b:bf:a4:
+         5c:65:72:1a:55:68:d9:59:83:79:50:ce:d7:b2:7c:9c:c2:98:
+         e8:79:6c:57:c1:7b:10:09:c0:5f:2c:da:83:11:cd:2c:8b:fb:
+         52:ab:58:5e:5a:82:ac:b6:1a:17:68:f8:41:2d:0c:b4:6c:f0:
+         18:9b:d3:d3:49:2a:4a:8c:c3:85:71:35:c4:27:b1:ab:de:e0:
+         22:bf:ad:5f:73:70:9f:38:38:a2:cc:05:be:78:3d:c6:e0:9b:
+         8c:cc:8e:c7:1a:d1:c7:5d:37:01:cb:46:83:81:26:f9:5c:41:
+         ba:5f:84:54:52:50:f6:da:a9:67:f0:a1:ab:1c:8a:c6:bc:91:
+         73:5d:8a:73:dd:98:fa:7a:29:98:71:e1:89:f7:8f:a3:16:aa:
+         83:0d:3c:83:f1:d1:52:9b:bb:5e:43:6f:b8:f2:d0:48:2c:24:
+         58:6c:24:d1:4b:16:c2:60:84:ba:36:c1:8b:89:d1:fb:1a:d9:
+         53:b9:62:6e
+-----BEGIN CERTIFICATE-----
+MIIDajCCAlKgAwIBAgIBAjANBgkqhkiG9w0BAQsFADAPMQ0wCwYDVQQDDARSb290
+MB4XDTE1MDEwMTEyMDAwMFoXDTE2MDEwMTEyMDAwMFowFzEVMBMGA1UEAwwMSW50
+ZXJtZWRpYXJ5MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnD+3g8dP
+TCO0swxz49ElO7ZuF3/yZCaQv+Am/EqvEAwFKsGIzs23rrNz6Mq8rooKio9N6/5x
+7BuvgHF1kJo0ZKEKiPCAVpyQbFGA26g8Zfk5gpfBC38yvT5ZvyIpUOyL89Dq5Z7i
+4WqQIIMS1jfOWSMiHt8yZzCogwwXfk6QU7gEmjMgV3k8UTZS6sTroA4r5adEKjGS
+LJegkhHPH1uscPphc23GuOYYh7ROz49x9dAn95kN1Qa8yYptg8VghToyu5GRY2Pm
+DkZ0S8l90C1g2i0mxzKjpdvA7wFlESTBXbaAvbaLslReqqlp/eXgUqd4zgxHzzOn
+GXdfT+XlgIHwdwIDAQABo4HIMIHFMB0GA1UdDgQWBBTYiVZdXFoeiXgYILUecmQr
+65zXHDAfBgNVHSMEGDAWgBRXsKBJ/BRN+/hhnwD74jsddgaqXjA3BggrBgEFBQcB
+AQQrMCkwJwYIKwYBBQUHMAKGG2h0dHA6Ly91cmwtZm9yLWFpYS9Sb290LmNlcjAs
+BgNVHR8EJTAjMCGgH6AdhhtodHRwOi8vdXJsLWZvci1jcmwvUm9vdC5jcmwwDgYD
+VR0PAQH/BAQDAgEGMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAK/R
+nDz11JMrMM5Xc+0cqgO3Mkzp0UFe9lLfQvX+klqat4GstcKVVDdnjen6dX3UvbLn
+R+eSp6YkAh+eFEWb+6mXPVKzXWu/pFxlchpVaNlZg3lQzteyfJzCmOh5bFfBexAJ
+wF8s2oMRzSyL+1KrWF5agqy2Ghdo+EEtDLRs8Bib09NJKkqMw4VxNcQnsave4CK/
+rV9zcJ84OKLMBb54Pcbgm4zMjsca0cddNwHLRoOBJvlcQbpfhFRSUPbaqWfwoasc
+isa8kXNdinPdmPp6KZhx4Yn3j6MWqoMNPIPx0VKbu15Db7jy0EgsJFhsJNFLFsJg
+hLo2wYuJ0fsa2VO5Ym4=
+-----END CERTIFICATE-----
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 1 (0x1)
+    Signature Algorithm: sha256WithRSAEncryption
+        Issuer: CN=Root
+        Validity
+            Not Before: Jan  1 12:00:00 2015 GMT
+            Not After : Jan  1 12:00:00 2016 GMT
+        Subject: CN=Root
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:d1:26:67:07:c1:b5:20:d0:5d:b5:cb:7e:20:ea:
+                    43:20:53:fa:86:e1:03:65:4e:d9:0f:fa:8c:38:ac:
+                    74:38:da:57:57:e1:fd:04:85:93:b9:c3:79:cc:33:
+                    dc:79:10:40:33:25:0a:d9:d8:ca:fe:5e:f8:b0:7c:
+                    bb:86:94:b5:ea:6f:cd:55:fe:35:d4:f7:7b:20:79:
+                    6d:c4:8d:0d:a7:64:9c:1c:4c:d8:47:53:08:8c:f2:
+                    bc:80:22:f2:a6:f9:8c:61:7c:02:1a:fd:b8:f7:59:
+                    b0:c0:3a:7a:65:84:5b:00:52:c6:0b:c8:23:00:4f:
+                    69:59:d8:9f:b9:e9:ef:fa:a1:68:82:2c:6b:72:6a:
+                    5a:a9:d5:51:44:c2:4a:f8:81:93:93:d0:e7:8d:ae:
+                    57:ec:c9:81:d6:1a:fd:38:95:43:11:b8:be:39:24:
+                    32:47:51:0f:6c:e1:3d:df:54:a0:4c:ef:f7:35:7c:
+                    31:3c:d8:a4:68:07:19:9f:ef:ed:e0:84:c8:ff:88:
+                    9d:80:3a:83:e0:ec:6e:8f:bf:82:b6:27:b3:a7:6c:
+                    6e:f2:bd:8e:69:a6:e5:f1:1c:7a:d1:01:fd:0b:22:
+                    af:26:82:8a:cc:ba:1c:fe:e3:5f:97:da:13:61:3f:
+                    10:a8:e3:3b:21:de:f7:a1:fb:aa:eb:49:ca:d5:f1:
+                    ed:7d
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                57:B0:A0:49:FC:14:4D:FB:F8:61:9F:00:FB:E2:3B:1D:76:06:AA:5E
+            X509v3 Authority Key Identifier: 
+                keyid:57:B0:A0:49:FC:14:4D:FB:F8:61:9F:00:FB:E2:3B:1D:76:06:AA:5E
+
+            Authority Information Access: 
+                CA Issuers - URI:http://url-for-aia/Root.cer
+
+            X509v3 CRL Distribution Points: 
+
+                Full Name:
+                  URI:http://url-for-crl/Root.crl
+
+            X509v3 Key Usage: critical
+                Certificate Sign, CRL Sign
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+    Signature Algorithm: sha256WithRSAEncryption
+         13:2c:77:90:a3:14:3d:8b:96:f2:6d:6e:14:d4:8a:46:f7:04:
+         9d:03:72:a0:c5:08:f3:ba:af:c7:36:b5:c3:67:9e:9e:52:f4:
+         a1:eb:8f:6d:bc:a3:ef:d1:af:df:2e:50:61:75:92:8f:72:be:
+         ae:db:1d:50:c6:e7:bb:2b:04:d6:9c:d5:35:f2:04:e3:68:3b:
+         4a:98:4b:93:16:67:2a:82:13:55:ad:de:be:16:59:61:f1:6c:
+         19:87:ad:70:3d:91:b4:c1:01:36:23:77:62:9b:86:a4:33:49:
+         f2:90:bf:5f:30:43:2e:22:be:ff:27:d1:40:88:18:42:52:0b:
+         30:40:a3:08:68:ab:c9:05:6e:a7:41:5d:c0:82:b6:97:6c:bb:
+         34:48:64:d0:5b:de:e1:1e:8b:46:23:02:9a:d3:1b:0d:7d:71:
+         2d:3c:04:c7:47:d3:2b:4e:e6:78:2a:22:23:13:a5:03:b4:f4:
+         8e:5d:71:12:bc:a4:1f:4d:bd:87:c5:aa:58:24:10:30:24:fc:
+         b6:bc:1b:e2:e7:56:6c:aa:d9:f1:bb:c9:43:7e:35:56:d8:35:
+         92:11:bb:1c:0d:1e:2a:6a:17:fa:cc:34:27:bc:58:ec:40:2b:
+         55:b9:06:f5:f3:35:09:a2:df:d8:38:9a:92:14:3e:fa:cd:a2:
+         aa:b1:ca:eb
+-----BEGIN TRUSTED_CERTIFICATE-----
+MIIDZTCCAk2gAwIBAgIBATANBgkqhkiG9w0BAQsFADAPMQ0wCwYDVQQDDARSb290
+MB4XDTE1MDEwMTEyMDAwMFoXDTE2MDEwMTEyMDAwMFowDzENMAsGA1UEAwwEUm9v
+dDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANEmZwfBtSDQXbXLfiDq
+QyBT+obhA2VO2Q/6jDisdDjaV1fh/QSFk7nDecwz3HkQQDMlCtnYyv5e+LB8u4aU
+tepvzVX+NdT3eyB5bcSNDadknBxM2EdTCIzyvIAi8qb5jGF8Ahr9uPdZsMA6emWE
+WwBSxgvIIwBPaVnYn7np7/qhaIIsa3JqWqnVUUTCSviBk5PQ542uV+zJgdYa/TiV
+QxG4vjkkMkdRD2zhPd9UoEzv9zV8MTzYpGgHGZ/v7eCEyP+InYA6g+Dsbo+/grYn
+s6dsbvK9jmmm5fEcetEB/QsiryaCisy6HP7jX5faE2E/EKjjOyHe96H7qutJytXx
+7X0CAwEAAaOByzCByDAdBgNVHQ4EFgQUV7CgSfwUTfv4YZ8A++I7HXYGql4wHwYD
+VR0jBBgwFoAUV7CgSfwUTfv4YZ8A++I7HXYGql4wNwYIKwYBBQUHAQEEKzApMCcG
+CCsGAQUFBzAChhtodHRwOi8vdXJsLWZvci1haWEvUm9vdC5jZXIwLAYDVR0fBCUw
+IzAhoB+gHYYbaHR0cDovL3VybC1mb3ItY3JsL1Jvb3QuY3JsMA4GA1UdDwEB/wQE
+AwIBBjAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQATLHeQoxQ9
+i5bybW4U1IpG9wSdA3KgxQjzuq/HNrXDZ56eUvSh649tvKPv0a/fLlBhdZKPcr6u
+2x1Qxue7KwTWnNU18gTjaDtKmEuTFmcqghNVrd6+Fllh8WwZh61wPZG0wQE2I3di
+m4akM0nykL9fMEMuIr7/J9FAiBhCUgswQKMIaKvJBW6nQV3AgraXbLs0SGTQW97h
+HotGIwKa0xsNfXEtPATHR9MrTuZ4KiIjE6UDtPSOXXESvKQfTb2HxapYJBAwJPy2
+vBvi51Zsqtnxu8lDfjVW2DWSEbscDR4qahf6zDQnvFjsQCtVuQb18zUJot/YOJqS
+FD76zaKqscrr
+-----END TRUSTED_CERTIFICATE-----
+
+-----BEGIN TIME-----
+MTYwMzAyMTIwMDAwWg==
+-----END TIME-----
+
+-----BEGIN VERIFY_RESULT-----
+U1VDQ0VTUw==
+-----END VERIFY_RESULT-----