Add script for generating certificates that require an explicit policy

Add script for generating certificates that require an explicit policy

Add a script and update the certificates used for testing a certificate
chain that requires an explicit policy, but where verification is
attempted with no policy specified.

BUG=111742
R=wtc

Committed: https://src.chromium.org/viewvc/chrome?view=rev&revision=213781

[Ryan Sleevi, 2013-06-28 19:41:27]

wtc: More test cleanup

[wtc, 2013-07-01 19:46:53]

Patch set 1 LGTM. Good cleanup!

https://codereview.chromium.org/18223006/diff/1/net/cert/cert_verify_proc_uni...
File net/cert/cert_verify_proc_unittest.cc (right):

https://codereview.chromium.org/18223006/diff/1/net/cert/cert_verify_proc_uni...
net/cert/cert_verify_proc_unittest.cc:761: ImportCertFromFile(certs_dir,
"aia-cert.pem");

Nit: the change to this unit test is not reflected in the CL's description.

https://codereview.chromium.org/18223006/diff/1/net/cert/x509_certificate_uni...
File net/cert/x509_certificate_unittest.cc (left):

https://codereview.chromium.org/18223006/diff/1/net/cert/x509_certificate_uni...
net/cert/x509_certificate_unittest.cc:743: ImportCertFromFile(certs_dir,
"dod_root_ca_2_cert.der");

Can we remove www_us_army_mil_cert.der, dod_ca_17_cert.der, and
dod_root_ca_2_cert.der now, or are they still being used by some
unit tests?

https://codereview.chromium.org/18223006/diff/1/net/data/ssl/certificates/README
File net/data/ssl/certificates/README (right):

https://codereview.chromium.org/18223006/diff/1/net/data/ssl/certificates/REA...
net/data/ssl/certificates/README:218: intermediatei, with skipCerts=0. This is
used for regression testing

Typo: intermediatei => intermediate

Nit: skipCerts => SkipCerts

https://codereview.chromium.org/18223006/diff/1/net/data/ssl/certificates/exp...
File net/data/ssl/certificates/explicit-policy-chain.pem (right):

https://codereview.chromium.org/18223006/diff/1/net/data/ssl/certificates/exp...
net/data/ssl/certificates/explicit-policy-chain.pem:157: -----BEGIN
CERTIFICATE-----

Nit: The root CA certificate does not have a human-readable preamble.

https://codereview.chromium.org/18223006/diff/1/net/data/ssl/scripts/generate...
File net/data/ssl/scripts/generate-policy-certs.sh (right):

https://codereview.chromium.org/18223006/diff/1/net/data/ssl/scripts/generate...
net/data/ssl/scripts/generate-policy-certs.sh:64: CA_COMMON_NAME="Policy Test
Intermediate CA" \

Should this be "Policy Test Root CA"? I don't know whether this CA_COMMON_NAME
is referring to the intermediate CA or the root CA.

https://codereview.chromium.org/18223006/diff/1/net/data/ssl/scripts/generate...
net/data/ssl/scripts/generate-policy-certs.sh:75:
CA_COMMON_NAME="policy_test.example" \

Should this be "Policy Test Intermediate CA"? "policy_test.example" is clearly
not a CA.

[Ryan Sleevi, 2013-07-03 21:29:44]

https://codereview.chromium.org/18223006/diff/1/net/cert/x509_certificate_uni...
File net/cert/x509_certificate_unittest.cc (left):

https://codereview.chromium.org/18223006/diff/1/net/cert/x509_certificate_uni...
net/cert/x509_certificate_unittest.cc:743: ImportCertFromFile(certs_dir,
"dod_root_ca_2_cert.der");
On 2013/07/01 19:46:53, wtc wrote:
> 
> Can we remove www_us_army_mil_cert.der, dod_ca_17_cert.der, and
> dod_root_ca_2_cert.der now, or are they still being used by some
> unit tests?

They're still being used by some unittests, which I was going to clean up
separately (the CertDatabaseNSS tests)

https://codereview.chromium.org/18223006/diff/1/net/data/ssl/scripts/generate...
File net/data/ssl/scripts/generate-policy-certs.sh (right):

https://codereview.chromium.org/18223006/diff/1/net/data/ssl/scripts/generate...
net/data/ssl/scripts/generate-policy-certs.sh:64: CA_COMMON_NAME="Policy Test
Intermediate CA" \
On 2013/07/01 19:46:53, wtc wrote:
> 
> Should this be "Policy Test Root CA"? I don't know whether this CA_COMMON_NAME
> is referring to the intermediate CA or the root CA.

No, it's unused.

https://codereview.chromium.org/18223006/diff/1/net/data/ssl/scripts/generate...
net/data/ssl/scripts/generate-policy-certs.sh:75:
CA_COMMON_NAME="policy_test.example" \
On 2013/07/01 19:46:53, wtc wrote:
> 
> Should this be "Policy Test Intermediate CA"? "policy_test.example" is clearly
> not a CA.

No, this is really the 'common name'. It's an inherited artifact of policy.cnf
being copied from ca.cnf, as in that workflow, ee certs come from ee.cnf.

Renamed the field COMMON_NAME, and updated line 64 to indicate "UNUSED"

[commit-bot: I haz the power, 2013-07-03 21:32:30]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/rsleevi@chromium.org/18223006/12001

[commit-bot: I haz the power, 2013-07-04 04:16:23]

The commit queue went berserk retrying too often for a
seemingly flaky test on builder android_dbg:
http://build.chromium.org/p/tryserver.chromium/buildstatus?builder=android_db...
http://build.chromium.org/p/tryserver.chromium/buildstatus?builder=android_db...
http://build.chromium.org/p/tryserver.chromium/buildstatus?builder=android_db...
http://build.chromium.org/p/tryserver.chromium/buildstatus?builder=android_db...
http://build.chromium.org/p/tryserver.chromium/buildstatus?builder=android_db...

[commit-bot: I haz the power, 2013-07-25 19:24:01]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/rsleevi@chromium.org/18223006/35001

[commit-bot: I haz the power, 2013-07-25 22:38:39]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/rsleevi@chromium.org/18223006/35001

[commit-bot: I haz the power, 2013-07-25 23:11:15]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/rsleevi@chromium.org/18223006/35001

[commit-bot: I haz the power, 2013-07-26 03:37:59]

Failed to trigger a try job on android_dbg
HTTP Error 400: Bad Request

[commit-bot: I haz the power, 2013-07-26 03:45:04]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/rsleevi@chromium.org/18223006/72001

[commit-bot: I haz the power, 2013-07-26 07:39:39]

Change committed as 213781