NOT FOR REVIEW....

net/data/verify_certificate_chain_unittest/intermediary-unknown-critical-extension.pem

Index: net/data/verify_certificate_chain_unittest/intermediary-unknown-critical-extension.pem
diff --git a/net/data/verify_certificate_chain_unittest/intermediary-unknown-critical-extension.pem b/net/data/verify_certificate_chain_unittest/intermediary-unknown-critical-extension.pem
new file mode 100644
index 0000000000000000000000000000000000000000..992c9755d738d200a69d343927bb1b2eb568d27b
--- /dev/null
+++ b/net/data/verify_certificate_chain_unittest/intermediary-unknown-critical-extension.pem
@@ -0,0 +1,283 @@
+[Created by: generate-intermediary-unknown-critical-extension.py]
+
+Simple certificate chain with 1 intermediary and a trusted
+root. The intermediary has an unknown X.509 extension that is marked as
+critical
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 1 (0x1)
+    Signature Algorithm: sha256WithRSAEncryption
+        Issuer: CN=Intermediary
+        Validity
+            Not Before: Jan  1 12:00:00 2015 GMT
+            Not After : Jan  1 12:00:00 2016 GMT
+        Subject: CN=Target
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:a0:39:05:45:44:71:de:07:70:5d:4e:32:bc:fe:
+                    88:68:7f:ce:83:ab:a3:b9:db:71:84:d0:5b:25:5e:
+                    dd:be:f3:32:76:6c:d4:e8:f9:dd:ae:80:98:3f:ff:
+                    7d:58:68:ed:cc:e8:0f:0e:47:97:19:40:9a:24:e6:
+                    c0:cb:c5:62:1d:cd:07:2b:6a:7d:3d:45:b8:77:e6:
+                    0d:3d:1f:e3:eb:00:65:fb:60:9f:ca:bc:7f:e2:b1:
+                    57:31:47:9e:9d:72:56:55:ea:57:7f:ba:94:b8:e5:
+                    2c:70:49:67:61:5c:e9:25:9f:ad:09:b1:04:06:ef:
+                    02:3d:3c:cb:5f:40:3e:d5:3e:15:34:d8:58:8a:ba:
+                    27:16:04:cd:a8:1a:22:a2:67:cc:4e:68:6a:9d:81:
+                    7e:f4:1c:a4:93:69:24:a5:22:85:c1:f6:71:cc:7e:
+                    73:35:6a:b2:33:3c:39:9d:a0:a2:fa:06:98:70:f3:
+                    41:27:76:3a:b8:19:5b:6d:1e:e7:db:58:15:b4:65:
+                    e7:26:5a:11:27:51:71:0e:9c:29:82:ab:6a:e4:81:
+                    8b:ae:f0:b6:91:d6:ab:9f:bc:b1:a4:90:3d:c4:b8:
+                    fc:ff:58:34:a7:3d:1a:42:cf:c8:67:dd:d6:ff:50:
+                    8c:eb:da:78:39:05:93:59:1f:92:ac:f4:78:00:bc:
+                    89:f1
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                A5:5A:3A:47:D0:26:B0:7A:2F:35:01:49:1F:D2:4F:69:24:28:D6:A7
+            X509v3 Authority Key Identifier: 
+                keyid:96:9F:69:15:37:A6:9E:09:E7:44:DC:3F:16:0A:84:34:73:78:E8:4D
+
+            Authority Information Access: 
+                CA Issuers - URI:http://url-for-aia/Intermediary.cer
+
+            X509v3 CRL Distribution Points: 
+
+                Full Name:
+                  URI:http://url-for-crl/Intermediary.crl
+
+            X509v3 Key Usage: critical
+                Digital Signature, Key Encipherment
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, TLS Web Client Authentication
+    Signature Algorithm: sha256WithRSAEncryption
+         8f:ff:34:8b:4d:07:77:67:1a:fe:86:e8:72:0d:0e:b1:04:e8:
+         d2:f9:6d:3b:61:6a:43:6d:79:0e:33:d4:34:0e:73:25:4a:5a:
+         86:7a:24:69:ea:ae:91:ec:08:e2:d4:d3:e6:bb:89:d5:a1:02:
+         6f:39:25:21:a4:7a:49:88:78:31:fb:ae:53:e6:b5:90:b1:59:
+         cd:e9:62:38:1a:3b:84:85:a9:08:c4:83:64:4e:87:5a:54:1a:
+         60:58:d9:97:3c:37:c3:93:8d:b8:22:00:5f:8b:98:8e:24:f0:
+         be:60:12:ae:03:94:9f:d8:40:07:68:5f:f4:98:b8:51:e8:a9:
+         07:bd:12:01:27:9a:3a:ec:20:37:d5:b8:ca:c2:98:20:5a:c0:
+         dc:f3:3a:23:57:23:0a:ac:3e:93:9b:3c:06:6a:ee:cf:0c:a1:
+         87:28:04:bb:c5:e7:0d:89:5f:00:07:33:7d:ed:2b:8c:4a:1d:
+         95:fa:fe:3f:9c:7a:be:e4:d9:b3:79:91:62:db:8c:98:c0:bb:
+         9b:13:4b:dc:2e:1d:e1:4e:6b:46:ea:e9:23:ce:4f:36:d3:32:
+         95:f6:6e:23:46:bd:e7:81:9f:3a:65:2e:cc:12:07:54:db:f7:
+         a1:b2:c8:c4:56:e2:de:ea:92:24:9c:55:f8:36:c2:d2:9f:4f:
+         54:50:f6:51
+-----BEGIN CERTIFICATE-----
+MIIDjTCCAnWgAwIBAgIBATANBgkqhkiG9w0BAQsFADAXMRUwEwYDVQQDDAxJbnRl
+cm1lZGlhcnkwHhcNMTUwMTAxMTIwMDAwWhcNMTYwMTAxMTIwMDAwWjARMQ8wDQYD
+VQQDDAZUYXJnZXQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCgOQVF
+RHHeB3BdTjK8/ohof86Dq6O523GE0FslXt2+8zJ2bNTo+d2ugJg//31YaO3M6A8O
+R5cZQJok5sDLxWIdzQcran09Rbh35g09H+PrAGX7YJ/KvH/isVcxR56dclZV6ld/
+upS45SxwSWdhXOkln60JsQQG7wI9PMtfQD7VPhU02FiKuicWBM2oGiKiZ8xOaGqd
+gX70HKSTaSSlIoXB9nHMfnM1arIzPDmdoKL6Bphw80Endjq4GVttHufbWBW0Zecm
+WhEnUXEOnCmCq2rkgYuu8LaR1qufvLGkkD3EuPz/WDSnPRpCz8hn3db/UIzr2ng5
+BZNZH5Ks9HgAvInxAgMBAAGjgekwgeYwHQYDVR0OBBYEFKVaOkfQJrB6LzUBSR/S
+T2kkKNanMB8GA1UdIwQYMBaAFJafaRU3pp4J50TcPxYKhDRzeOhNMD8GCCsGAQUF
+BwEBBDMwMTAvBggrBgEFBQcwAoYjaHR0cDovL3VybC1mb3ItYWlhL0ludGVybWVk
+aWFyeS5jZXIwNAYDVR0fBC0wKzApoCegJYYjaHR0cDovL3VybC1mb3ItY3JsL0lu
+dGVybWVkaWFyeS5jcmwwDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUF
+BwMBBggrBgEFBQcDAjANBgkqhkiG9w0BAQsFAAOCAQEAj/80i00Hd2ca/obocg0O
+sQTo0vltO2FqQ215DjPUNA5zJUpahnokaequkewI4tTT5ruJ1aECbzklIaR6SYh4
+MfuuU+a1kLFZzeliOBo7hIWpCMSDZE6HWlQaYFjZlzw3w5ONuCIAX4uYjiTwvmAS
+rgOUn9hAB2hf9Ji4UeipB70SASeaOuwgN9W4ysKYIFrA3PM6I1cjCqw+k5s8Bmru
+zwyhhygEu8XnDYlfAAczfe0rjEodlfr+P5x6vuTZs3mRYtuMmMC7mxNL3C4d4U5r
+RurpI85PNtMylfZuI0a954GfOmUuzBIHVNv3obLIxFbi3uqSJJxV+DbC0p9PVFD2
+UQ==
+-----END CERTIFICATE-----
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 2 (0x2)
+    Signature Algorithm: sha256WithRSAEncryption
+        Issuer: CN=Root
+        Validity
+            Not Before: Jan  1 12:00:00 2015 GMT
+            Not After : Jan  1 12:00:00 2016 GMT
+        Subject: CN=Intermediary
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:c6:6b:49:35:c6:7c:32:c2:17:90:55:72:45:b2:
+                    08:23:44:64:38:94:5e:6e:70:a4:f9:52:52:17:f8:
+                    0d:35:23:f5:e5:c5:aa:41:68:4e:33:b7:50:66:5f:
+                    23:a4:4c:6e:4a:fe:5b:83:e6:b1:04:03:e3:48:ab:
+                    84:6e:28:2a:26:d7:18:ee:bf:67:45:a2:82:07:af:
+                    9e:45:5a:c0:d6:0c:fb:87:fe:40:4a:26:92:44:72:
+                    bc:e4:b5:23:b2:e5:bf:a2:f1:37:d4:21:74:a9:d9:
+                    bb:6c:18:1a:24:5f:ba:03:02:11:4d:6e:75:a9:62:
+                    ce:90:a4:a2:05:1c:5f:65:a0:97:83:63:27:46:5a:
+                    41:9f:9b:19:e3:79:63:c0:eb:07:ac:58:0b:42:7e:
+                    26:f7:a5:6b:e6:4f:7a:7a:1d:aa:63:5d:6c:11:de:
+                    17:7d:df:ae:7f:8d:35:72:06:57:be:2a:5e:07:d5:
+                    c7:d3:23:88:b8:07:30:75:6d:37:7d:7b:28:0e:1a:
+                    0c:97:75:1e:11:0a:3f:75:88:b5:2e:f4:85:c8:ce:
+                    7c:98:3d:90:8d:5f:e5:48:88:cc:bc:88:e3:29:f6:
+                    d3:99:d4:d8:41:8b:01:47:d3:63:cf:2d:4e:0a:76:
+                    39:7f:c6:41:94:46:c4:41:59:d2:3d:36:23:f2:d0:
+                    7f:d9
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                96:9F:69:15:37:A6:9E:09:E7:44:DC:3F:16:0A:84:34:73:78:E8:4D
+            X509v3 Authority Key Identifier: 
+                keyid:08:2E:9F:BD:4C:82:DB:FD:6B:68:94:F4:CA:4A:6D:6E:83:EC:E8:C4
+
+            Authority Information Access: 
+                CA Issuers - URI:http://url-for-aia/Root.cer
+
+            X509v3 CRL Distribution Points: 
+
+                Full Name:
+                  URI:http://url-for-crl/Root.crl
+
+            X509v3 Key Usage: critical
+                Certificate Sign, CRL Sign
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+            1.2.3.4: critical
+                ....
+    Signature Algorithm: sha256WithRSAEncryption
+         25:0f:c0:09:8b:32:30:a1:da:33:98:61:4a:c1:cb:70:fb:40:
+         9e:25:38:be:bc:68:02:ec:49:48:6c:bc:3e:54:22:b4:fd:04:
+         8f:ff:9c:f0:52:bf:07:63:13:87:d1:42:96:be:00:93:4b:98:
+         b5:be:2f:52:e9:f4:7b:c5:3b:79:53:4c:8c:83:e8:67:42:de:
+         5e:c8:b5:73:6f:c6:0d:5a:c0:f4:be:fd:26:47:ce:68:c1:83:
+         f7:25:49:7f:c9:4e:25:0d:11:b9:b0:b2:dd:74:75:ea:1c:20:
+         7f:00:04:5c:dc:0d:15:db:67:48:02:a4:ae:28:02:68:d1:ad:
+         3f:0c:5c:50:a1:be:fa:8e:e6:4a:74:a6:9b:d0:0d:4c:a3:3e:
+         f2:89:b6:e9:83:99:cd:6c:a0:7f:2b:cc:ac:4e:c0:c2:31:85:
+         94:ca:0c:64:fb:c3:e1:c0:83:78:98:bc:df:28:2f:54:ae:1c:
+         a6:ce:07:67:b6:b8:df:61:6a:d2:5e:9d:28:b5:42:f8:44:9e:
+         9a:c3:36:de:79:d4:33:d7:a9:c2:2d:64:ec:f6:7f:23:36:cc:
+         db:45:c7:2f:ac:80:14:cc:ff:4e:67:e2:3c:b5:d7:23:d9:11:
+         88:c2:ed:99:2d:c5:ea:ca:db:ab:b2:8d:b8:d8:43:18:62:9c:
+         f2:be:fc:30
+-----BEGIN CERTIFICATE-----
+MIIDfTCCAmWgAwIBAgIBAjANBgkqhkiG9w0BAQsFADAPMQ0wCwYDVQQDDARSb290
+MB4XDTE1MDEwMTEyMDAwMFoXDTE2MDEwMTEyMDAwMFowFzEVMBMGA1UEAwwMSW50
+ZXJtZWRpYXJ5MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxmtJNcZ8
+MsIXkFVyRbIII0RkOJRebnCk+VJSF/gNNSP15cWqQWhOM7dQZl8jpExuSv5bg+ax
+BAPjSKuEbigqJtcY7r9nRaKCB6+eRVrA1gz7h/5ASiaSRHK85LUjsuW/ovE31CF0
+qdm7bBgaJF+6AwIRTW51qWLOkKSiBRxfZaCXg2MnRlpBn5sZ43ljwOsHrFgLQn4m
+96Vr5k96eh2qY11sEd4Xfd+uf401cgZXvipeB9XH0yOIuAcwdW03fXsoDhoMl3Ue
+EQo/dYi1LvSFyM58mD2QjV/lSIjMvIjjKfbTmdTYQYsBR9Njzy1OCnY5f8ZBlEbE
+QVnSPTYj8tB/2QIDAQABo4HbMIHYMB0GA1UdDgQWBBSWn2kVN6aeCedE3D8WCoQ0
+c3joTTAfBgNVHSMEGDAWgBQILp+9TILb/WtolPTKSm1ug+zoxDA3BggrBgEFBQcB
+AQQrMCkwJwYIKwYBBQUHMAKGG2h0dHA6Ly91cmwtZm9yLWFpYS9Sb290LmNlcjAs
+BgNVHR8EJTAjMCGgH6AdhhtodHRwOi8vdXJsLWZvci1jcmwvUm9vdC5jcmwwDgYD
+VR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wDgYDKgMEAQH/BAQBAgMEMA0G
+CSqGSIb3DQEBCwUAA4IBAQAlD8AJizIwodozmGFKwctw+0CeJTi+vGgC7ElIbLw+
+VCK0/QSP/5zwUr8HYxOH0UKWvgCTS5i1vi9S6fR7xTt5U0yMg+hnQt5eyLVzb8YN
+WsD0vv0mR85owYP3JUl/yU4lDRG5sLLddHXqHCB/AARc3A0V22dIAqSuKAJo0a0/
+DFxQob76juZKdKab0A1Moz7yibbpg5nNbKB/K8ysTsDCMYWUygxk+8PhwIN4mLzf
+KC9UrhymzgdntrjfYWrSXp0otUL4RJ6awzbeedQz16nCLWTs9n8jNszbRccvrIAU
+zP9OZ+I8tdcj2RGIwu2ZLcXqyturso242EMYYpzyvvww
+-----END CERTIFICATE-----
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 1 (0x1)
+    Signature Algorithm: sha256WithRSAEncryption
+        Issuer: CN=Root
+        Validity
+            Not Before: Jan  1 12:00:00 2015 GMT
+            Not After : Jan  1 12:00:00 2016 GMT
+        Subject: CN=Root
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:c5:72:0c:e4:a5:90:1a:e8:94:d4:0d:f6:27:19:
+                    77:61:fb:39:f5:42:ec:cf:92:ca:f5:86:c0:50:c6:
+                    63:a7:65:79:73:35:ed:18:e6:1e:0a:7d:a0:bd:c8:
+                    3f:3c:3f:46:7a:a6:e7:f2:a9:33:df:13:0b:49:3e:
+                    c7:b0:d5:04:4b:6a:9e:45:af:8c:f9:2f:38:06:74:
+                    64:64:21:97:a1:a1:8f:b5:b8:51:75:4c:80:ed:53:
+                    82:66:19:92:bd:5c:c1:ac:52:d4:6e:fa:32:68:aa:
+                    e4:36:11:f8:59:9b:0d:94:89:35:b9:44:eb:cc:62:
+                    a6:91:88:d4:ed:8f:2c:aa:2a:42:c5:41:c2:91:3d:
+                    7c:a4:b8:48:30:ac:95:72:eb:2d:50:34:b6:e2:f7:
+                    29:7b:28:e7:d5:01:34:ba:77:95:f0:d0:07:84:2c:
+                    56:cd:df:db:08:1d:9a:80:87:b2:41:05:85:58:12:
+                    f3:be:33:82:0f:b5:ee:a9:a8:76:6c:08:8e:00:7f:
+                    ee:2c:0b:9e:a3:8b:58:49:c4:d0:f8:d2:b8:95:55:
+                    3d:33:10:00:49:a5:0f:2f:6c:7d:2d:c1:24:c0:37:
+                    68:e9:8c:0e:c7:83:07:a6:10:fd:f4:91:e0:5f:35:
+                    e9:60:ba:f7:1a:80:4a:0d:ec:92:56:6f:e8:8e:5d:
+                    a7:45
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                08:2E:9F:BD:4C:82:DB:FD:6B:68:94:F4:CA:4A:6D:6E:83:EC:E8:C4
+            X509v3 Authority Key Identifier: 
+                keyid:08:2E:9F:BD:4C:82:DB:FD:6B:68:94:F4:CA:4A:6D:6E:83:EC:E8:C4
+
+            Authority Information Access: 
+                CA Issuers - URI:http://url-for-aia/Root.cer
+
+            X509v3 CRL Distribution Points: 
+
+                Full Name:
+                  URI:http://url-for-crl/Root.crl
+
+            X509v3 Key Usage: critical
+                Certificate Sign, CRL Sign
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+    Signature Algorithm: sha256WithRSAEncryption
+         09:bc:c0:0a:f7:91:40:61:a4:a1:c6:1c:52:0b:bb:a8:b9:45:
+         7d:38:f7:4b:59:71:97:19:dd:03:59:df:f3:46:f6:6d:69:3a:
+         e9:89:ec:8f:ae:9c:19:fd:ca:2b:e5:26:8f:e1:f7:d1:60:14:
+         57:6f:5e:5c:87:5d:61:fd:f3:c8:1f:d3:b3:8a:3a:e4:7e:0f:
+         48:9c:83:86:cc:52:6c:7d:0c:3d:6d:9e:49:a1:41:f2:61:be:
+         0c:1b:0d:9c:0e:cd:14:9e:cd:c5:8f:98:cd:9e:cf:9d:f3:8d:
+         26:70:65:f5:02:ad:98:f1:71:b5:09:02:83:7d:6c:81:60:9b:
+         c9:f5:c1:ab:07:ea:14:a5:29:1a:0d:f2:ee:41:21:23:27:a1:
+         da:94:11:47:17:8e:5c:89:9d:23:ca:63:94:39:a0:cb:d2:49:
+         d9:45:51:35:e1:e3:91:34:d7:61:8c:bb:13:0e:e0:cf:c3:e6:
+         cc:20:33:88:89:01:40:6d:7a:48:db:db:41:d5:ad:87:54:82:
+         91:91:1c:59:c5:74:07:82:99:54:aa:51:8d:3f:1f:ac:7e:55:
+         b7:f2:4d:1a:96:a5:ea:0d:64:17:64:c2:78:ea:7f:7f:fe:43:
+         a6:88:aa:cb:1f:2c:a5:02:f1:1f:b3:44:9a:0e:c6:59:46:3e:
+         1e:60:ff:78
+-----BEGIN TRUSTED_CERTIFICATE-----
+MIIDZTCCAk2gAwIBAgIBATANBgkqhkiG9w0BAQsFADAPMQ0wCwYDVQQDDARSb290
+MB4XDTE1MDEwMTEyMDAwMFoXDTE2MDEwMTEyMDAwMFowDzENMAsGA1UEAwwEUm9v
+dDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMVyDOSlkBrolNQN9icZ
+d2H7OfVC7M+SyvWGwFDGY6dleXM17RjmHgp9oL3IPzw/Rnqm5/KpM98TC0k+x7DV
+BEtqnkWvjPkvOAZ0ZGQhl6Ghj7W4UXVMgO1TgmYZkr1cwaxS1G76Mmiq5DYR+Fmb
+DZSJNblE68xippGI1O2PLKoqQsVBwpE9fKS4SDCslXLrLVA0tuL3KXso59UBNLp3
+lfDQB4QsVs3f2wgdmoCHskEFhVgS874zgg+17qmodmwIjgB/7iwLnqOLWEnE0PjS
+uJVVPTMQAEmlDy9sfS3BJMA3aOmMDseDB6YQ/fSR4F816WC69xqASg3sklZv6I5d
+p0UCAwEAAaOByzCByDAdBgNVHQ4EFgQUCC6fvUyC2/1raJT0ykptboPs6MQwHwYD
+VR0jBBgwFoAUCC6fvUyC2/1raJT0ykptboPs6MQwNwYIKwYBBQUHAQEEKzApMCcG
+CCsGAQUFBzAChhtodHRwOi8vdXJsLWZvci1haWEvUm9vdC5jZXIwLAYDVR0fBCUw
+IzAhoB+gHYYbaHR0cDovL3VybC1mb3ItY3JsL1Jvb3QuY3JsMA4GA1UdDwEB/wQE
+AwIBBjAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQAJvMAK95FA
+YaShxhxSC7uouUV9OPdLWXGXGd0DWd/zRvZtaTrpieyPrpwZ/cor5SaP4ffRYBRX
+b15ch11h/fPIH9Ozijrkfg9InIOGzFJsfQw9bZ5JoUHyYb4MGw2cDs0Uns3Fj5jN
+ns+d840mcGX1Aq2Y8XG1CQKDfWyBYJvJ9cGrB+oUpSkaDfLuQSEjJ6HalBFHF45c
+iZ0jymOUOaDL0knZRVE14eORNNdhjLsTDuDPw+bMIDOIiQFAbXpI29tB1a2HVIKR
+kRxZxXQHgplUqlGNPx+sflW38k0alqXqDWQXZMJ46n9//kOmiKrLHyylAvEfs0Sa
+DsZZRj4eYP94
+-----END TRUSTED_CERTIFICATE-----
+
+-----BEGIN TIME-----
+MTYwMzAyMTIwMDAwWg==
+-----END TIME-----
+
+-----BEGIN VERIFY_RESULT-----
+RkFJTA==
+-----END VERIFY_RESULT-----