NOT FOR REVIEW....

net/data/verify_certificate_chain_unittest/intermediary-lacks-basic-constraints.pem

Index: net/data/verify_certificate_chain_unittest/intermediary-lacks-basic-constraints.pem
diff --git a/net/data/verify_certificate_chain_unittest/intermediary-lacks-basic-constraints.pem b/net/data/verify_certificate_chain_unittest/intermediary-lacks-basic-constraints.pem
new file mode 100644
index 0000000000000000000000000000000000000000..d78a0f67bc20ff631910f0c00293b157c98fcb57
--- /dev/null
+++ b/net/data/verify_certificate_chain_unittest/intermediary-lacks-basic-constraints.pem
@@ -0,0 +1,277 @@
+[Created by: generate-intermediary-lacks-basic-constraints.py]
+
+Simple certificate chain with 1 intermediary and a trusted
+root. The intermediary lacks the basic constraints extension.
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 1 (0x1)
+    Signature Algorithm: sha256WithRSAEncryption
+        Issuer: CN=Intermediary
+        Validity
+            Not Before: Jan  1 12:00:00 2015 GMT
+            Not After : Jan  1 12:00:00 2016 GMT
+        Subject: CN=Target
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:b0:01:84:d5:7e:5e:a5:79:55:fe:e0:7a:a1:9c:
+                    f9:14:2b:66:6e:87:00:b3:ad:4e:53:5b:74:76:de:
+                    05:d6:83:57:8e:cb:6b:25:7d:58:b9:5c:c9:34:e2:
+                    75:10:17:43:a3:27:67:ef:11:44:86:10:2c:f4:74:
+                    37:40:ae:32:ca:88:de:25:25:0c:08:b3:bc:1e:22:
+                    0c:6f:50:a4:24:de:e7:5f:1a:cf:d2:61:47:52:0d:
+                    6d:b0:b8:e7:5f:ec:3a:ff:c1:6c:03:c2:5e:59:a9:
+                    ee:cd:4b:32:eb:97:f5:73:3b:6b:96:5c:70:c8:24:
+                    e5:93:d4:f1:92:aa:bf:73:ca:5d:bd:47:09:20:99:
+                    5f:72:8b:f6:ad:ee:1e:2c:22:dd:62:e3:db:35:0c:
+                    9a:f4:a9:4b:83:3f:fb:e8:67:e3:99:71:0a:04:2c:
+                    92:33:29:a7:62:03:dc:3c:3c:61:03:2b:ee:66:6d:
+                    4d:37:10:f0:53:10:cf:7c:87:f1:7f:8c:a0:2a:44:
+                    03:cf:b9:26:a6:81:17:ee:ad:98:96:a0:f0:f1:2d:
+                    d5:ab:d7:60:a4:4e:2b:2e:7e:9d:df:ab:53:40:99:
+                    62:49:65:fb:35:b5:d0:d0:ba:b0:a2:71:c0:43:78:
+                    31:19:5c:0d:b4:00:ae:47:b1:12:f6:b2:da:d7:81:
+                    d4:c3
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                95:63:87:59:46:1E:05:99:FA:C2:D5:95:8B:98:FA:E4:22:F5:F1:A4
+            X509v3 Authority Key Identifier: 
+                keyid:5C:16:54:2C:AD:2B:9C:54:04:49:76:A3:BF:C5:D5:EA:53:29:0D:04
+
+            Authority Information Access: 
+                CA Issuers - URI:http://url-for-aia/Intermediary.cer
+
+            X509v3 CRL Distribution Points: 
+
+                Full Name:
+                  URI:http://url-for-crl/Intermediary.crl
+
+            X509v3 Key Usage: critical
+                Digital Signature, Key Encipherment
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, TLS Web Client Authentication
+    Signature Algorithm: sha256WithRSAEncryption
+         b0:92:a9:27:ed:bd:0c:f0:0d:9a:3f:20:82:07:9c:c9:c0:07:
+         01:58:ee:b5:94:63:3e:a9:15:2c:58:ef:d9:67:21:d7:6f:02:
+         91:3d:c6:66:ba:41:c1:18:e5:a9:a6:e8:3e:fc:4d:1c:b4:e9:
+         98:ea:65:a8:f5:1c:99:7b:42:8c:57:63:93:19:85:34:65:cf:
+         6e:f9:ec:1f:42:9f:7f:66:5f:e6:8b:5d:f7:bb:29:0c:49:42:
+         57:7e:d1:dc:05:11:d4:3d:ae:e5:d8:53:71:c1:eb:14:0e:68:
+         ec:dc:29:9c:3e:5d:17:c5:b5:80:56:c1:18:1b:42:ed:d2:64:
+         b0:71:f9:4d:c9:bb:92:a6:d8:a8:1e:ef:bc:15:87:91:36:45:
+         40:57:e4:57:cc:03:5a:ce:79:15:42:38:da:4b:3c:ec:b6:a2:
+         13:8b:a4:c2:c0:b2:f1:04:2e:8f:92:2c:3d:a5:27:92:c8:42:
+         9f:13:16:ac:6d:0a:eb:d0:ed:8a:fd:2f:ab:0b:12:13:a1:9a:
+         cd:d2:fb:10:02:2d:51:62:7d:92:ce:f5:8e:4e:ba:fd:c9:9f:
+         97:a5:07:93:9c:58:16:99:a8:63:ee:46:65:ec:62:b9:7f:c3:
+         da:7f:a6:ab:3c:1d:06:b6:62:b3:59:bf:a2:74:fa:7c:a1:cb:
+         5e:4c:e4:94
+-----BEGIN CERTIFICATE-----
+MIIDjTCCAnWgAwIBAgIBATANBgkqhkiG9w0BAQsFADAXMRUwEwYDVQQDDAxJbnRl
+cm1lZGlhcnkwHhcNMTUwMTAxMTIwMDAwWhcNMTYwMTAxMTIwMDAwWjARMQ8wDQYD
+VQQDDAZUYXJnZXQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCwAYTV
+fl6leVX+4HqhnPkUK2ZuhwCzrU5TW3R23gXWg1eOy2slfVi5XMk04nUQF0OjJ2fv
+EUSGECz0dDdArjLKiN4lJQwIs7weIgxvUKQk3udfGs/SYUdSDW2wuOdf7Dr/wWwD
+wl5Zqe7NSzLrl/VzO2uWXHDIJOWT1PGSqr9zyl29RwkgmV9yi/at7h4sIt1i49s1
+DJr0qUuDP/voZ+OZcQoELJIzKadiA9w8PGEDK+5mbU03EPBTEM98h/F/jKAqRAPP
+uSamgRfurZiWoPDxLdWr12CkTisufp3fq1NAmWJJZfs1tdDQurCiccBDeDEZXA20
+AK5HsRL2strXgdTDAgMBAAGjgekwgeYwHQYDVR0OBBYEFJVjh1lGHgWZ+sLVlYuY
++uQi9fGkMB8GA1UdIwQYMBaAFFwWVCytK5xUBEl2o7/F1epTKQ0EMD8GCCsGAQUF
+BwEBBDMwMTAvBggrBgEFBQcwAoYjaHR0cDovL3VybC1mb3ItYWlhL0ludGVybWVk
+aWFyeS5jZXIwNAYDVR0fBC0wKzApoCegJYYjaHR0cDovL3VybC1mb3ItY3JsL0lu
+dGVybWVkaWFyeS5jcmwwDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUF
+BwMBBggrBgEFBQcDAjANBgkqhkiG9w0BAQsFAAOCAQEAsJKpJ+29DPANmj8gggec
+ycAHAVjutZRjPqkVLFjv2Wch128CkT3GZrpBwRjlqaboPvxNHLTpmOplqPUcmXtC
+jFdjkxmFNGXPbvnsH0Kff2Zf5otd97spDElCV37R3AUR1D2u5dhTccHrFA5o7Nwp
+nD5dF8W1gFbBGBtC7dJksHH5Tcm7kqbYqB7vvBWHkTZFQFfkV8wDWs55FUI42ks8
+7LaiE4ukwsCy8QQuj5IsPaUnkshCnxMWrG0K69Dtiv0vqwsSE6GazdL7EAItUWJ9
+ks71jk66/cmfl6UHk5xYFpmoY+5GZexiuX/D2n+mqzwdBrZis1m/onT6fKHLXkzk
+lA==
+-----END CERTIFICATE-----
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 2 (0x2)
+    Signature Algorithm: sha256WithRSAEncryption
+        Issuer: CN=Root
+        Validity
+            Not Before: Jan  1 12:00:00 2015 GMT
+            Not After : Jan  1 12:00:00 2016 GMT
+        Subject: CN=Intermediary
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:d4:a0:f0:34:cb:5d:1a:a9:96:32:30:80:73:27:
+                    3b:e3:3e:33:04:e8:82:9a:45:71:df:05:22:5d:9d:
+                    cc:d5:f5:46:69:48:1f:98:b1:3f:9f:52:3f:d2:5f:
+                    b2:0b:b7:5b:9d:19:e4:44:81:5b:3d:f8:0b:67:47:
+                    9c:c7:88:b9:18:cb:76:16:6c:85:2e:8e:38:a1:1f:
+                    55:e2:1f:a1:57:54:60:ca:3b:ca:a6:d5:9d:12:91:
+                    e8:d7:f9:7b:4a:72:30:4d:1c:4d:e2:2a:23:72:4a:
+                    0f:3f:86:b1:34:43:28:9c:fa:0d:2c:3c:71:88:4c:
+                    34:0d:49:31:7b:76:cd:b6:4f:f6:9d:02:8d:42:a7:
+                    f0:4d:a7:17:37:24:40:ca:0f:33:0b:8e:a4:b9:f6:
+                    af:b7:0b:cc:47:36:6e:4e:5e:a9:87:e0:d6:c2:40:
+                    27:ad:db:3d:44:1c:73:8d:af:5b:af:98:79:9d:94:
+                    ba:b3:74:0d:5a:78:19:01:a2:03:eb:19:34:d7:95:
+                    25:5b:9a:e1:c0:53:2f:f5:e7:64:81:59:05:d9:41:
+                    0e:07:85:c6:59:75:7a:26:9e:ec:a4:d1:e2:6b:99:
+                    28:ae:b0:08:3d:3d:d4:30:ed:e9:15:4c:2e:83:77:
+                    2e:1b:db:e3:04:eb:c0:7d:b4:1d:c1:73:51:38:b1:
+                    eb:5d
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                5C:16:54:2C:AD:2B:9C:54:04:49:76:A3:BF:C5:D5:EA:53:29:0D:04
+            X509v3 Authority Key Identifier: 
+                keyid:E7:11:89:A7:2F:9D:73:99:89:20:CB:77:E2:FF:6D:C4:5C:FE:D9:17
+
+            Authority Information Access: 
+                CA Issuers - URI:http://url-for-aia/Root.cer
+
+            X509v3 CRL Distribution Points: 
+
+                Full Name:
+                  URI:http://url-for-crl/Root.crl
+
+            X509v3 Key Usage: critical
+                Certificate Sign, CRL Sign
+    Signature Algorithm: sha256WithRSAEncryption
+         8f:13:d1:ff:4f:38:3c:7b:ae:fc:97:7d:34:fd:5f:17:4d:60:
+         26:94:2e:7e:7d:94:c6:1b:36:87:0f:e0:84:a8:48:a1:f2:a5:
+         b7:90:69:00:61:5c:27:e3:fa:bd:63:6f:c0:36:d4:1d:6b:91:
+         7b:4b:28:27:46:17:6f:54:ee:a9:95:85:f3:13:e6:cc:66:84:
+         7a:19:ec:f6:d8:3b:15:51:1f:7c:48:91:06:00:a8:c2:a6:f0:
+         ad:0c:bc:a5:af:13:3a:1d:a8:12:77:73:e6:f3:0f:89:a6:6f:
+         2f:42:a7:d1:dc:72:ae:ff:42:ef:76:dc:c4:73:06:23:51:9f:
+         b9:c6:f6:e4:9b:f2:d0:86:05:84:c5:46:e1:44:20:33:08:e2:
+         ff:af:48:1b:12:e5:61:e7:06:f2:67:5c:8f:b9:09:94:a6:ad:
+         09:13:ed:f1:c7:4a:96:55:2a:48:18:42:14:a9:c9:21:48:4d:
+         5f:4e:2e:61:b8:2c:ce:df:02:bf:ed:14:f4:4f:8c:fd:d6:d9:
+         fe:27:7f:10:94:24:29:72:86:a1:fa:fe:fd:63:b0:f4:2f:6a:
+         47:c9:02:3e:90:52:c3:97:b9:d6:4f:6f:09:58:12:c6:21:19:
+         33:ae:8c:e3:51:66:f2:ab:82:ef:48:a6:1a:e2:fe:a2:7a:11:
+         8a:39:ea:5e
+-----BEGIN CERTIFICATE-----
+MIIDXDCCAkSgAwIBAgIBAjANBgkqhkiG9w0BAQsFADAPMQ0wCwYDVQQDDARSb290
+MB4XDTE1MDEwMTEyMDAwMFoXDTE2MDEwMTEyMDAwMFowFzEVMBMGA1UEAwwMSW50
+ZXJtZWRpYXJ5MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1KDwNMtd
+GqmWMjCAcyc74z4zBOiCmkVx3wUiXZ3M1fVGaUgfmLE/n1I/0l+yC7dbnRnkRIFb
+PfgLZ0ecx4i5GMt2FmyFLo44oR9V4h+hV1RgyjvKptWdEpHo1/l7SnIwTRxN4ioj
+ckoPP4axNEMonPoNLDxxiEw0DUkxe3bNtk/2nQKNQqfwTacXNyRAyg8zC46kufav
+twvMRzZuTl6ph+DWwkAnrds9RBxzja9br5h5nZS6s3QNWngZAaID6xk015UlW5rh
+wFMv9edkgVkF2UEOB4XGWXV6Jp7spNHia5korrAIPT3UMO3pFUwug3cuG9vjBOvA
+fbQdwXNROLHrXQIDAQABo4G6MIG3MB0GA1UdDgQWBBRcFlQsrSucVARJdqO/xdXq
+UykNBDAfBgNVHSMEGDAWgBTnEYmnL51zmYkgy3fi/23EXP7ZFzA3BggrBgEFBQcB
+AQQrMCkwJwYIKwYBBQUHMAKGG2h0dHA6Ly91cmwtZm9yLWFpYS9Sb290LmNlcjAs
+BgNVHR8EJTAjMCGgH6AdhhtodHRwOi8vdXJsLWZvci1jcmwvUm9vdC5jcmwwDgYD
+VR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4IBAQCPE9H/Tzg8e678l300/V8X
+TWAmlC5+fZTGGzaHD+CEqEih8qW3kGkAYVwn4/q9Y2/ANtQda5F7SygnRhdvVO6p
+lYXzE+bMZoR6Gez22DsVUR98SJEGAKjCpvCtDLylrxM6HagSd3Pm8w+Jpm8vQqfR
+3HKu/0LvdtzEcwYjUZ+5xvbkm/LQhgWExUbhRCAzCOL/r0gbEuVh5wbyZ1yPuQmU
+pq0JE+3xx0qWVSpIGEIUqckhSE1fTi5huCzO3wK/7RT0T4z91tn+J38QlCQpcoah
++v79Y7D0L2pHyQI+kFLDl7nWT28JWBLGIRkzrozjUWbyq4LvSKYa4v6iehGKOepe
+-----END CERTIFICATE-----
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 1 (0x1)
+    Signature Algorithm: sha256WithRSAEncryption
+        Issuer: CN=Root
+        Validity
+            Not Before: Jan  1 12:00:00 2015 GMT
+            Not After : Jan  1 12:00:00 2016 GMT
+        Subject: CN=Root
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:de:ad:87:46:73:e6:87:4d:b9:a9:64:1e:d1:84:
+                    4f:87:80:8f:8b:ba:4d:72:f2:58:6d:30:51:cb:be:
+                    31:a7:c9:54:64:63:0e:69:51:e1:24:06:33:de:c9:
+                    c8:74:94:4f:60:39:69:17:44:03:e0:b3:4e:de:b0:
+                    69:5b:90:da:8b:9b:90:ff:ae:d5:ab:d0:08:31:d1:
+                    a4:55:e5:fd:62:9a:a8:d8:5c:e9:b9:2d:a2:98:70:
+                    ed:91:6a:4d:b4:fc:da:c1:49:4e:0c:8b:6e:df:6a:
+                    e4:6f:13:5d:15:62:da:75:0c:58:d3:2a:b3:6f:41:
+                    90:e2:a5:f0:52:21:72:02:34:6b:1f:6a:62:ad:d5:
+                    dc:cc:b0:9a:6d:bd:bc:ff:f4:98:9a:ff:cd:a4:3b:
+                    e5:4b:ec:89:95:e0:9e:ae:1b:e2:56:f9:db:39:17:
+                    67:ed:4a:c1:bf:12:b5:66:53:16:0a:ca:ce:08:70:
+                    19:d2:ec:a5:31:b2:18:4b:ae:7c:8a:3d:e3:72:85:
+                    26:c1:34:55:35:d5:58:02:fe:60:9e:e1:a3:98:f2:
+                    c0:d0:b3:2c:66:2f:9e:96:40:21:07:50:ed:49:8d:
+                    f2:aa:27:b7:08:26:2e:6b:b8:a9:5a:85:e6:79:3b:
+                    3e:e2:7b:10:d9:74:52:b8:1f:3a:29:c4:78:2f:fc:
+                    f3:93
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                E7:11:89:A7:2F:9D:73:99:89:20:CB:77:E2:FF:6D:C4:5C:FE:D9:17
+            X509v3 Authority Key Identifier: 
+                keyid:E7:11:89:A7:2F:9D:73:99:89:20:CB:77:E2:FF:6D:C4:5C:FE:D9:17
+
+            Authority Information Access: 
+                CA Issuers - URI:http://url-for-aia/Root.cer
+
+            X509v3 CRL Distribution Points: 
+
+                Full Name:
+                  URI:http://url-for-crl/Root.crl
+
+            X509v3 Key Usage: critical
+                Certificate Sign, CRL Sign
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+    Signature Algorithm: sha256WithRSAEncryption
+         5b:73:15:1c:df:1f:a0:4b:d7:94:58:ea:47:d8:d1:4d:1a:37:
+         83:89:00:c1:07:9b:4f:1c:db:e9:4e:55:eb:27:50:f9:fd:bc:
+         4c:56:d9:98:6c:f8:e5:47:ab:20:33:0e:88:09:37:82:4f:92:
+         7c:cb:7d:28:df:22:c3:03:3e:a6:b4:21:aa:44:01:18:c6:ea:
+         d3:4e:89:4c:ad:51:71:b8:02:4b:92:c9:9e:1d:7c:8b:9b:34:
+         96:24:e5:78:74:bc:f0:d1:66:8d:4a:e2:eb:f3:61:03:88:d2:
+         7a:7a:d3:17:73:fe:e7:4b:b5:22:10:d9:4e:68:ec:25:ec:79:
+         ce:e2:6e:c1:dc:d7:2f:87:2a:94:99:05:bc:55:27:58:a1:17:
+         e1:fe:37:75:81:0a:97:cb:71:f5:32:e3:ca:a3:8e:bb:92:dc:
+         51:99:67:a3:b9:14:be:c3:26:8b:eb:9e:42:e6:32:cd:5d:d0:
+         35:89:0c:89:a2:23:2f:6f:a9:5a:34:4a:fd:dd:8d:cd:cd:f6:
+         52:4b:6b:31:ca:23:71:a5:3e:d6:23:49:e0:b6:27:99:47:cb:
+         5d:62:c2:04:ce:9c:4c:03:f1:17:2d:49:54:c2:82:fd:11:3e:
+         3b:b0:61:04:0a:c9:37:e4:a2:69:7a:12:ea:f6:88:3c:7c:30:
+         e4:14:21:ac
+-----BEGIN TRUSTED_CERTIFICATE-----
+MIIDZTCCAk2gAwIBAgIBATANBgkqhkiG9w0BAQsFADAPMQ0wCwYDVQQDDARSb290
+MB4XDTE1MDEwMTEyMDAwMFoXDTE2MDEwMTEyMDAwMFowDzENMAsGA1UEAwwEUm9v
+dDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAN6th0Zz5odNualkHtGE
+T4eAj4u6TXLyWG0wUcu+MafJVGRjDmlR4SQGM97JyHSUT2A5aRdEA+CzTt6waVuQ
+2oubkP+u1avQCDHRpFXl/WKaqNhc6bktophw7ZFqTbT82sFJTgyLbt9q5G8TXRVi
+2nUMWNMqs29BkOKl8FIhcgI0ax9qYq3V3Mywmm29vP/0mJr/zaQ75UvsiZXgnq4b
+4lb52zkXZ+1Kwb8StWZTFgrKzghwGdLspTGyGEuufIo943KFJsE0VTXVWAL+YJ7h
+o5jywNCzLGYvnpZAIQdQ7UmN8qontwgmLmu4qVqF5nk7PuJ7ENl0UrgfOinEeC/8
+85MCAwEAAaOByzCByDAdBgNVHQ4EFgQU5xGJpy+dc5mJIMt34v9txFz+2RcwHwYD
+VR0jBBgwFoAU5xGJpy+dc5mJIMt34v9txFz+2RcwNwYIKwYBBQUHAQEEKzApMCcG
+CCsGAQUFBzAChhtodHRwOi8vdXJsLWZvci1haWEvUm9vdC5jZXIwLAYDVR0fBCUw
+IzAhoB+gHYYbaHR0cDovL3VybC1mb3ItY3JsL1Jvb3QuY3JsMA4GA1UdDwEB/wQE
+AwIBBjAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQBbcxUc3x+g
+S9eUWOpH2NFNGjeDiQDBB5tPHNvpTlXrJ1D5/bxMVtmYbPjlR6sgMw6ICTeCT5J8
+y30o3yLDAz6mtCGqRAEYxurTTolMrVFxuAJLksmeHXyLmzSWJOV4dLzw0WaNSuLr
+82EDiNJ6etMXc/7nS7UiENlOaOwl7HnO4m7B3NcvhyqUmQW8VSdYoRfh/jd1gQqX
+y3H1MuPKo467ktxRmWejuRS+wyaL655C5jLNXdA1iQyJoiMvb6laNEr93Y3NzfZS
+S2sxyiNxpT7WI0ngtieZR8tdYsIEzpxMA/EXLUlUwoL9ET47sGEECsk35KJpehLq
+9og8fDDkFCGs
+-----END TRUSTED_CERTIFICATE-----
+
+-----BEGIN TIME-----
+MTYwMzAyMTIwMDAwWg==
+-----END TIME-----
+
+-----BEGIN VERIFY_RESULT-----
+RkFJTA==
+-----END VERIFY_RESULT-----