NOT FOR REVIEW....

net/data/verify_certificate_chain_unittest/intermediary-lacks-signing-key-usage.pem

Index: net/data/verify_certificate_chain_unittest/intermediary-lacks-signing-key-usage.pem
diff --git a/net/data/verify_certificate_chain_unittest/intermediary-lacks-signing-key-usage.pem b/net/data/verify_certificate_chain_unittest/intermediary-lacks-signing-key-usage.pem
new file mode 100644
index 0000000000000000000000000000000000000000..6ff438efec9a2496ec53de1e9d4e24187c1d9e10
--- /dev/null
+++ b/net/data/verify_certificate_chain_unittest/intermediary-lacks-signing-key-usage.pem
@@ -0,0 +1,281 @@
+[Created by: generate-intermediary-lacks-signing-key-usage.py]
+
+Simple certificate chain with 1 intermediary and a trusted
+root. The intermediary lacks the correct usage for signing certificates
+(keyCertSign)
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 1 (0x1)
+    Signature Algorithm: sha256WithRSAEncryption
+        Issuer: CN=Intermediary
+        Validity
+            Not Before: Jan  1 12:00:00 2015 GMT
+            Not After : Jan  1 12:00:00 2016 GMT
+        Subject: CN=Target
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:a7:99:f5:68:3b:08:18:67:3b:1d:76:39:13:0e:
+                    dd:7e:25:88:8f:16:19:b8:0b:2e:36:74:65:7d:17:
+                    70:0c:cd:3d:80:92:fc:8d:3b:c5:fd:74:9c:ba:04:
+                    5b:7f:76:c2:97:36:50:0c:20:c1:6f:0f:77:92:53:
+                    94:09:3f:ec:19:56:aa:a9:03:7e:7a:31:85:b8:91:
+                    df:65:85:dd:4e:0c:95:f1:9a:71:f0:bb:cb:15:5a:
+                    87:27:91:e6:a7:34:26:82:02:54:8b:47:16:6c:3b:
+                    4e:76:61:bc:1f:1d:e2:5c:be:4d:a9:01:93:8d:86:
+                    31:b4:d1:72:b7:9b:44:c0:95:ce:98:ef:60:b3:b9:
+                    db:11:9a:6e:64:a9:40:af:5c:63:97:83:72:32:a4:
+                    9e:1d:b3:71:ec:83:1d:0f:0d:ab:c5:14:8d:63:fc:
+                    13:ed:77:cd:06:93:8b:82:e6:59:e9:d0:61:0e:29:
+                    36:e0:04:6d:33:aa:66:b4:b5:54:79:ee:f6:6b:53:
+                    ac:83:ca:4d:d0:13:e7:a3:14:8d:5e:1d:5a:24:bd:
+                    2e:71:8e:7b:cd:37:57:bf:12:83:de:11:cd:15:ab:
+                    cb:46:a7:c5:0f:c5:9c:81:9e:4c:98:67:d2:db:16:
+                    68:e5:4b:73:76:46:d7:01:8c:b4:5c:ab:e4:07:ed:
+                    87:4f
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                23:9E:35:C0:A3:2A:B9:39:56:22:FA:C6:3F:0C:E0:FC:E8:28:27:30
+            X509v3 Authority Key Identifier: 
+                keyid:40:A1:65:34:74:FB:BA:1B:F0:C1:EC:36:80:DB:6C:D2:D8:CC:B9:FC
+
+            Authority Information Access: 
+                CA Issuers - URI:http://url-for-aia/Intermediary.cer
+
+            X509v3 CRL Distribution Points: 
+
+                Full Name:
+                  URI:http://url-for-crl/Intermediary.crl
+
+            X509v3 Key Usage: critical
+                Digital Signature, Key Encipherment
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, TLS Web Client Authentication
+    Signature Algorithm: sha256WithRSAEncryption
+         35:e9:e6:fc:e8:59:10:40:ac:1f:96:5e:3b:0c:23:8b:2c:a3:
+         b4:b5:c2:9e:8e:d1:1e:93:f3:15:4b:f8:46:9f:86:33:65:cc:
+         d9:5a:51:69:f1:1a:4f:9a:54:b8:4d:c0:c6:67:d9:6c:2b:4f:
+         ea:a5:3e:86:67:53:06:a4:28:85:d4:b3:67:67:74:2a:8c:35:
+         8f:6a:d7:d0:5c:1b:06:14:5b:c4:89:bf:d9:17:3a:cb:17:d4:
+         36:11:b6:54:21:3e:bc:62:72:ff:d2:41:60:b3:77:63:c4:c8:
+         59:0b:07:35:5a:d0:20:d2:26:c4:88:fb:7c:51:b5:02:6e:84:
+         30:77:1a:ac:c0:04:c2:cd:98:a9:6f:53:b9:0c:dc:94:1f:e8:
+         6a:9c:8c:7a:bf:3c:d3:56:19:6a:51:7d:8c:02:6b:9b:1f:c8:
+         95:2c:a8:af:46:c1:b9:a6:52:fc:82:70:28:68:45:b4:8d:8f:
+         a5:9f:6e:0e:70:a0:b0:3c:22:cb:cf:ba:7b:d1:2b:c3:e2:7f:
+         55:47:e1:8f:b2:0a:aa:ff:6f:73:4e:2a:25:cd:0a:aa:ec:7a:
+         12:2a:b0:56:d2:d5:04:d4:a6:6a:1e:f5:22:ef:58:ad:89:ed:
+         b9:df:85:cf:58:62:1d:99:b2:8a:fc:50:b6:42:8b:74:b5:19:
+         13:d2:cd:21
+-----BEGIN CERTIFICATE-----
+MIIDjTCCAnWgAwIBAgIBATANBgkqhkiG9w0BAQsFADAXMRUwEwYDVQQDDAxJbnRl
+cm1lZGlhcnkwHhcNMTUwMTAxMTIwMDAwWhcNMTYwMTAxMTIwMDAwWjARMQ8wDQYD
+VQQDDAZUYXJnZXQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCnmfVo
+OwgYZzsddjkTDt1+JYiPFhm4Cy42dGV9F3AMzT2AkvyNO8X9dJy6BFt/dsKXNlAM
+IMFvD3eSU5QJP+wZVqqpA356MYW4kd9lhd1ODJXxmnHwu8sVWocnkeanNCaCAlSL
+RxZsO052YbwfHeJcvk2pAZONhjG00XK3m0TAlc6Y72CzudsRmm5kqUCvXGOXg3Iy
+pJ4ds3Hsgx0PDavFFI1j/BPtd80Gk4uC5lnp0GEOKTbgBG0zqma0tVR57vZrU6yD
+yk3QE+ejFI1eHVokvS5xjnvNN1e/EoPeEc0Vq8tGp8UPxZyBnkyYZ9LbFmjlS3N2
+RtcBjLRcq+QH7YdPAgMBAAGjgekwgeYwHQYDVR0OBBYEFCOeNcCjKrk5ViL6xj8M
+4PzoKCcwMB8GA1UdIwQYMBaAFEChZTR0+7ob8MHsNoDbbNLYzLn8MD8GCCsGAQUF
+BwEBBDMwMTAvBggrBgEFBQcwAoYjaHR0cDovL3VybC1mb3ItYWlhL0ludGVybWVk
+aWFyeS5jZXIwNAYDVR0fBC0wKzApoCegJYYjaHR0cDovL3VybC1mb3ItY3JsL0lu
+dGVybWVkaWFyeS5jcmwwDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUF
+BwMBBggrBgEFBQcDAjANBgkqhkiG9w0BAQsFAAOCAQEANenm/OhZEECsH5ZeOwwj
+iyyjtLXCno7RHpPzFUv4Rp+GM2XM2VpRafEaT5pUuE3AxmfZbCtP6qU+hmdTBqQo
+hdSzZ2d0Kow1j2rX0FwbBhRbxIm/2Rc6yxfUNhG2VCE+vGJy/9JBYLN3Y8TIWQsH
+NVrQINImxIj7fFG1Am6EMHcarMAEws2YqW9TuQzclB/oapyMer8801YZalF9jAJr
+mx/IlSyor0bBuaZS/IJwKGhFtI2PpZ9uDnCgsDwiy8+6e9Erw+J/VUfhj7IKqv9v
+c04qJc0Kqux6EiqwVtLVBNSmah71Iu9YrYntud+Fz1hiHZmyivxQtkKLdLUZE9LN
+IQ==
+-----END CERTIFICATE-----
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 2 (0x2)
+    Signature Algorithm: sha256WithRSAEncryption
+        Issuer: CN=Root
+        Validity
+            Not Before: Jan  1 12:00:00 2015 GMT
+            Not After : Jan  1 12:00:00 2016 GMT
+        Subject: CN=Intermediary
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:d2:3f:88:22:6d:bb:bd:00:98:f9:24:0b:57:98:
+                    f9:09:b5:ff:d8:ef:5d:c4:0e:fd:ef:af:02:4c:b9:
+                    c5:d6:fd:a0:c6:09:93:b2:c9:c9:d7:50:eb:34:2b:
+                    d7:4c:19:79:44:48:67:fc:a4:6e:5c:3f:a0:71:28:
+                    2d:4b:51:57:44:69:02:58:15:6d:89:3f:d7:17:51:
+                    12:34:30:c2:78:fb:95:f1:50:fb:76:6a:7a:a4:06:
+                    d8:5a:18:45:0d:bd:4b:d3:3c:a5:b9:ac:ca:c4:33:
+                    d4:d9:65:8d:96:bf:cc:a5:1a:e1:35:b4:61:0d:60:
+                    f4:6f:43:9e:1e:d8:48:31:fd:34:ee:b8:16:c2:b3:
+                    2a:9a:da:d4:73:7a:ef:2e:20:7c:55:fe:b0:c0:f2:
+                    39:84:cb:38:71:6f:a5:6b:5c:b8:3d:a2:14:eb:29:
+                    89:e3:79:9c:07:5c:54:87:cc:ec:b8:ac:35:8d:ad:
+                    41:81:38:4c:e2:ea:3d:bf:a1:ef:ea:cc:a1:6c:fd:
+                    11:b6:46:6f:7c:5c:71:60:1c:6c:31:41:29:e5:13:
+                    43:19:64:94:25:5d:0d:4d:c8:83:ab:e3:e9:4c:22:
+                    16:ea:d5:70:52:f1:ed:ce:7a:0d:b1:03:56:7a:c1:
+                    9a:54:a1:fd:ea:e3:87:12:9a:08:69:bf:f1:f9:26:
+                    88:07
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                40:A1:65:34:74:FB:BA:1B:F0:C1:EC:36:80:DB:6C:D2:D8:CC:B9:FC
+            X509v3 Authority Key Identifier: 
+                keyid:9D:87:D3:E6:AA:56:41:F7:DC:3E:08:AC:47:85:87:63:84:7A:8F:A4
+
+            Authority Information Access: 
+                CA Issuers - URI:http://url-for-aia/Root.cer
+
+            X509v3 CRL Distribution Points: 
+
+                Full Name:
+                  URI:http://url-for-crl/Root.crl
+
+            X509v3 Key Usage: critical
+                Digital Signature, Key Encipherment
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+    Signature Algorithm: sha256WithRSAEncryption
+         66:4c:e6:74:81:fd:af:4b:c5:1c:cc:90:12:78:f1:6f:9b:56:
+         5b:7f:58:2a:db:cf:de:c6:b7:1b:9f:31:d0:23:3f:ba:e3:c3:
+         be:06:5d:0d:2c:7d:07:ac:bf:23:ac:4f:35:ed:d9:10:85:25:
+         e7:b0:83:bb:07:cf:d2:79:af:63:03:e3:05:e5:bc:8d:c1:37:
+         47:65:31:14:d8:50:a5:5c:9c:fe:e2:91:b3:45:9d:0b:03:d6:
+         f2:87:a7:09:b8:a9:a6:a9:06:99:37:23:77:a5:14:a6:bb:fa:
+         08:93:0e:45:c6:f5:05:bb:9b:8a:2d:62:43:56:78:de:45:a2:
+         a5:c2:1c:ee:a6:64:9d:2c:43:4f:f7:fe:0c:86:47:8e:21:e5:
+         32:6e:b6:db:19:98:76:e6:ae:9e:e1:b8:e5:58:28:97:58:b6:
+         c7:a1:fc:17:63:78:9f:7a:4e:9a:dd:3e:1e:bb:3f:bc:cb:e8:
+         1d:bb:ab:c4:e6:78:de:af:5e:66:2e:65:10:ae:8e:ed:1c:00:
+         a8:db:3c:97:6a:df:aa:4f:25:51:9e:53:c8:84:24:ac:f8:9f:
+         a7:47:4f:5a:f4:5c:10:a9:39:4f:79:bb:ef:93:ec:be:98:49:
+         da:5e:45:05:cb:7e:7b:f4:b4:21:53:4f:c8:a5:b7:4a:bb:dc:
+         c2:33:ad:ef
+-----BEGIN CERTIFICATE-----
+MIIDbTCCAlWgAwIBAgIBAjANBgkqhkiG9w0BAQsFADAPMQ0wCwYDVQQDDARSb290
+MB4XDTE1MDEwMTEyMDAwMFoXDTE2MDEwMTEyMDAwMFowFzEVMBMGA1UEAwwMSW50
+ZXJtZWRpYXJ5MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0j+IIm27
+vQCY+SQLV5j5CbX/2O9dxA79768CTLnF1v2gxgmTssnJ11DrNCvXTBl5REhn/KRu
+XD+gcSgtS1FXRGkCWBVtiT/XF1ESNDDCePuV8VD7dmp6pAbYWhhFDb1L0zyluazK
+xDPU2WWNlr/MpRrhNbRhDWD0b0OeHthIMf007rgWwrMqmtrUc3rvLiB8Vf6wwPI5
+hMs4cW+la1y4PaIU6ymJ43mcB1xUh8zsuKw1ja1BgThM4uo9v6Hv6syhbP0RtkZv
+fFxxYBxsMUEp5RNDGWSUJV0NTciDq+PpTCIW6tVwUvHtznoNsQNWesGaVKH96uOH
+EpoIab/x+SaIBwIDAQABo4HLMIHIMB0GA1UdDgQWBBRAoWU0dPu6G/DB7DaA22zS
+2My5/DAfBgNVHSMEGDAWgBSdh9PmqlZB99w+CKxHhYdjhHqPpDA3BggrBgEFBQcB
+AQQrMCkwJwYIKwYBBQUHMAKGG2h0dHA6Ly91cmwtZm9yLWFpYS9Sb290LmNlcjAs
+BgNVHR8EJTAjMCGgH6AdhhtodHRwOi8vdXJsLWZvci1jcmwvUm9vdC5jcmwwDgYD
+VR0PAQH/BAQDAgWgMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEB
+AGZM5nSB/a9LxRzMkBJ48W+bVlt/WCrbz97GtxufMdAjP7rjw74GXQ0sfQesvyOs
+TzXt2RCFJeewg7sHz9J5r2MD4wXlvI3BN0dlMRTYUKVcnP7ikbNFnQsD1vKHpwm4
+qaapBpk3I3elFKa7+giTDkXG9QW7m4otYkNWeN5FoqXCHO6mZJ0sQ0/3/gyGR44h
+5TJuttsZmHbmrp7huOVYKJdYtseh/BdjeJ96TprdPh67P7zL6B27q8TmeN6vXmYu
+ZRCuju0cAKjbPJdq36pPJVGeU8iEJKz4n6dHT1r0XBCpOU95u++T7L6YSdpeRQXL
+fnv0tCFTT8ilt0q73MIzre8=
+-----END CERTIFICATE-----
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 1 (0x1)
+    Signature Algorithm: sha256WithRSAEncryption
+        Issuer: CN=Root
+        Validity
+            Not Before: Jan  1 12:00:00 2015 GMT
+            Not After : Jan  1 12:00:00 2016 GMT
+        Subject: CN=Root
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:d9:8d:b6:29:5f:74:d8:f6:28:04:b6:06:c9:03:
+                    ed:26:ff:73:ce:dd:ce:f7:c0:41:90:6b:37:0e:c8:
+                    9c:a1:72:75:a8:ab:ab:ca:0d:36:38:b1:a7:b9:2f:
+                    cf:fd:ef:71:66:f1:53:8b:3f:fa:52:83:24:ae:8b:
+                    7d:e0:46:24:f2:18:56:dc:3c:34:e4:c4:de:db:4f:
+                    86:21:3d:24:1f:ee:7f:a0:a5:f1:b7:3b:57:89:af:
+                    e1:51:34:ab:d8:40:b0:30:b8:78:2c:39:20:d2:25:
+                    8f:2a:1b:55:0a:ac:00:f9:a7:ff:80:b2:86:dd:ea:
+                    6d:72:77:10:7f:01:5f:eb:0c:35:a9:23:51:c7:9d:
+                    d0:a8:ab:cb:c7:27:48:b3:f6:99:c6:f1:37:ba:31:
+                    d2:a1:fe:3b:fb:79:85:5c:a3:08:1f:64:a2:d1:ad:
+                    3c:7e:ad:06:66:5e:fa:d2:c2:72:27:74:c4:14:fc:
+                    83:28:8f:87:9e:26:2e:92:83:12:d3:68:78:ae:49:
+                    91:a4:16:78:a0:98:26:da:24:d8:64:43:82:3b:88:
+                    74:ae:96:92:94:88:fb:21:72:07:bc:75:b1:cb:56:
+                    c5:9e:80:80:7b:57:34:2d:3f:7f:8d:33:25:f0:33:
+                    f6:7a:7d:b3:29:9d:de:c6:ff:9a:58:80:f7:5f:58:
+                    cc:61
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                9D:87:D3:E6:AA:56:41:F7:DC:3E:08:AC:47:85:87:63:84:7A:8F:A4
+            X509v3 Authority Key Identifier: 
+                keyid:9D:87:D3:E6:AA:56:41:F7:DC:3E:08:AC:47:85:87:63:84:7A:8F:A4
+
+            Authority Information Access: 
+                CA Issuers - URI:http://url-for-aia/Root.cer
+
+            X509v3 CRL Distribution Points: 
+
+                Full Name:
+                  URI:http://url-for-crl/Root.crl
+
+            X509v3 Key Usage: critical
+                Certificate Sign, CRL Sign
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+    Signature Algorithm: sha256WithRSAEncryption
+         7f:f3:11:7a:54:38:fd:d0:66:18:7f:b4:8e:df:9f:16:52:49:
+         c3:75:7a:79:51:f4:3b:08:77:3c:42:06:2a:4b:87:68:02:76:
+         bc:6b:59:55:1b:07:d5:16:a2:9f:61:2a:5e:fd:2e:a4:84:14:
+         36:65:f6:02:5d:39:0a:af:d4:fb:01:51:e5:73:49:79:68:71:
+         3b:da:6b:62:b9:b0:6a:32:da:2f:19:fd:3a:62:40:2f:26:7f:
+         48:13:e0:6b:90:18:f5:86:76:f1:06:91:4d:8f:72:41:5c:5d:
+         63:5c:a7:a8:a1:93:81:86:16:d3:33:62:95:d4:ed:8a:f3:d2:
+         4a:8c:a8:14:75:68:37:23:62:09:d1:b3:92:60:63:18:cf:fa:
+         d0:9a:a0:de:03:51:56:c9:31:11:f2:73:c0:3b:4c:0a:82:56:
+         6c:d0:6b:3b:6c:c9:8a:98:b9:e9:c1:22:94:6f:50:be:95:41:
+         e8:67:cd:74:88:b4:d6:a5:35:fe:c0:81:3d:ea:97:c0:d5:49:
+         2c:b7:9b:2b:04:b7:d4:17:9d:d3:3b:03:3f:79:ee:11:60:e5:
+         a1:e7:d4:41:7a:f8:40:d5:70:d8:35:ae:72:02:ff:af:55:d4:
+         0c:5e:c9:25:95:7f:88:b7:16:f0:d5:52:8c:a5:5c:f7:fe:5c:
+         a5:c7:30:d4
+-----BEGIN TRUSTED_CERTIFICATE-----
+MIIDZTCCAk2gAwIBAgIBATANBgkqhkiG9w0BAQsFADAPMQ0wCwYDVQQDDARSb290
+MB4XDTE1MDEwMTEyMDAwMFoXDTE2MDEwMTEyMDAwMFowDzENMAsGA1UEAwwEUm9v
+dDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANmNtilfdNj2KAS2BskD
+7Sb/c87dzvfAQZBrNw7InKFydairq8oNNjixp7kvz/3vcWbxU4s/+lKDJK6LfeBG
+JPIYVtw8NOTE3ttPhiE9JB/uf6Cl8bc7V4mv4VE0q9hAsDC4eCw5INIljyobVQqs
+APmn/4Cyht3qbXJ3EH8BX+sMNakjUced0Kiry8cnSLP2mcbxN7ox0qH+O/t5hVyj
+CB9kotGtPH6tBmZe+tLCcid0xBT8gyiPh54mLpKDEtNoeK5JkaQWeKCYJtok2GRD
+gjuIdK6WkpSI+yFyB7x1sctWxZ6AgHtXNC0/f40zJfAz9np9symd3sb/mliA919Y
+zGECAwEAAaOByzCByDAdBgNVHQ4EFgQUnYfT5qpWQffcPgisR4WHY4R6j6QwHwYD
+VR0jBBgwFoAUnYfT5qpWQffcPgisR4WHY4R6j6QwNwYIKwYBBQUHAQEEKzApMCcG
+CCsGAQUFBzAChhtodHRwOi8vdXJsLWZvci1haWEvUm9vdC5jZXIwLAYDVR0fBCUw
+IzAhoB+gHYYbaHR0cDovL3VybC1mb3ItY3JsL1Jvb3QuY3JsMA4GA1UdDwEB/wQE
+AwIBBjAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQB/8xF6VDj9
+0GYYf7SO358WUknDdXp5UfQ7CHc8QgYqS4doAna8a1lVGwfVFqKfYSpe/S6khBQ2
+ZfYCXTkKr9T7AVHlc0l5aHE72mtiubBqMtovGf06YkAvJn9IE+BrkBj1hnbxBpFN
+j3JBXF1jXKeooZOBhhbTM2KV1O2K89JKjKgUdWg3I2IJ0bOSYGMYz/rQmqDeA1FW
+yTER8nPAO0wKglZs0Gs7bMmKmLnpwSKUb1C+lUHoZ810iLTWpTX+wIE96pfA1Uks
+t5srBLfUF53TOwM/ee4RYOWh59RBevhA1XDYNa5yAv+vVdQMXskllX+Itxbw1VKM
+pVz3/lylxzDU
+-----END TRUSTED_CERTIFICATE-----
+
+-----BEGIN TIME-----
+MTYwMzAyMTIwMDAwWg==
+-----END TIME-----
+
+-----BEGIN VERIFY_RESULT-----
+RkFJTA==
+-----END VERIFY_RESULT-----