Certificate path builder for new certificate verification library

net/data/verify_certificate_chain_unittest/key-rollover-newchain.pem

Index: net/data/verify_certificate_chain_unittest/key-rollover-newchain.pem
diff --git a/net/data/verify_certificate_chain_unittest/key-rollover-newchain.pem b/net/data/verify_certificate_chain_unittest/key-rollover-newchain.pem
new file mode 100644
index 0000000000000000000000000000000000000000..df5b31d5964ec7dd7232f5b3a38038e6a0d2f2b6
--- /dev/null
+++ b/net/data/verify_certificate_chain_unittest/key-rollover-newchain.pem
@@ -0,0 +1,279 @@
+[Created by: ./generate-key-rollover.py]
+
+XXX
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 1 (0x1)
+    Signature Algorithm: sha256WithRSAEncryption
+        Issuer: CN=Intermediary
+        Validity
+            Not Before: Jan  1 12:00:00 2015 GMT
+            Not After : Jan  1 12:00:00 2016 GMT
+        Subject: CN=Target
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:b9:1b:49:eb:08:65:2b:a5:5d:92:9f:e5:07:05:
+                    c4:3d:85:8e:1d:11:6c:fa:71:e6:5c:e7:17:31:30:
+                    82:56:49:e6:68:84:85:55:49:1a:9e:4c:26:a8:65:
+                    e0:01:d3:f9:ed:1c:b7:83:16:92:a1:7a:df:14:56:
+                    67:da:ea:8c:f6:c6:06:48:b6:72:85:6d:b5:ff:c8:
+                    a8:8b:23:1f:38:51:f5:64:14:bd:71:c8:80:b2:8f:
+                    39:7d:fc:90:c8:05:37:63:15:67:5a:a1:48:df:f3:
+                    44:d8:49:55:72:41:40:37:fe:00:ad:51:63:15:78:
+                    05:7a:f2:0f:3a:ca:e8:8c:fc:56:f4:6f:6a:1c:a6:
+                    37:8d:4d:43:7a:5b:2a:89:06:04:28:87:87:b8:3e:
+                    2f:5c:5d:11:f6:d9:84:fa:de:c3:7e:a0:b0:08:3d:
+                    c9:4d:bb:92:53:12:e5:f2:4e:77:2a:53:f6:6b:b7:
+                    d1:6d:a9:21:09:af:83:54:c3:34:c1:14:34:98:f3:
+                    cb:5b:ea:20:bc:b8:e4:e5:ca:ea:5d:e8:0f:4f:69:
+                    19:96:b6:b7:61:ed:23:59:1a:73:29:49:35:3c:9d:
+                    8f:30:c5:e9:51:86:de:ec:f6:56:fd:e7:02:0a:a3:
+                    c8:59:a3:c8:3f:f2:b1:4e:7c:19:0b:ca:58:af:3e:
+                    1d:ed
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                FA:CD:A7:85:6D:78:FE:5E:95:83:3C:8A:CC:6A:20:20:A5:CE:EE:F2
+            X509v3 Authority Key Identifier: 
+                keyid:3A:00:86:40:B7:6F:BE:09:88:20:CE:AB:2E:35:2B:48:CF:9C:B6:59
+
+            Authority Information Access: 
+                CA Issuers - URI:http://url-for-aia/Intermediary.cer
+
+            X509v3 CRL Distribution Points: 
+
+                Full Name:
+                  URI:http://url-for-crl/Intermediary.crl
+
+            X509v3 Key Usage: critical
+                Digital Signature, Key Encipherment
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, TLS Web Client Authentication
+    Signature Algorithm: sha256WithRSAEncryption
+         78:3f:be:50:16:e8:7c:7d:88:91:5b:db:41:db:7c:78:77:30:
+         93:94:0f:bc:ab:08:85:6f:c0:c0:6f:4a:e3:13:aa:c0:32:8c:
+         c1:41:56:31:0c:dd:47:97:45:7e:70:c2:0e:4f:9f:d4:c0:8f:
+         32:b7:fa:dd:a9:0b:db:35:32:ff:e4:35:8d:d6:a9:a9:32:17:
+         2e:62:51:a7:94:31:d2:a0:ed:49:c2:22:4f:33:4e:98:87:22:
+         f8:55:47:de:ff:5a:3f:72:de:2c:33:8e:de:eb:44:12:0e:37:
+         a6:00:9a:45:7c:40:a8:29:f3:39:06:2a:e3:be:bb:83:02:77:
+         9d:06:62:80:ff:64:90:49:82:d8:dc:d4:13:6f:2d:9c:2a:b8:
+         7e:92:7a:31:83:ed:46:db:53:00:86:90:bd:ac:4e:5e:88:14:
+         92:0c:01:88:13:76:be:ae:d1:0f:9c:1c:64:24:d1:09:85:ad:
+         6f:fb:8e:51:13:10:37:c3:7d:02:1c:d2:a4:2d:cb:f4:3f:47:
+         f7:49:6b:71:26:5b:a6:f5:79:4d:63:04:05:41:7c:01:da:6e:
+         46:6a:82:78:cc:cf:55:81:b7:83:75:20:71:4a:e9:dd:8c:fb:
+         9d:49:5f:25:ea:d4:8b:77:a3:82:e2:5c:6b:2e:bb:bd:a9:24:
+         da:67:e8:9f
+-----BEGIN CERTIFICATE-----
+MIIDjTCCAnWgAwIBAgIBATANBgkqhkiG9w0BAQsFADAXMRUwEwYDVQQDDAxJbnRl
+cm1lZGlhcnkwHhcNMTUwMTAxMTIwMDAwWhcNMTYwMTAxMTIwMDAwWjARMQ8wDQYD
+VQQDDAZUYXJnZXQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC5G0nr
+CGUrpV2Sn+UHBcQ9hY4dEWz6ceZc5xcxMIJWSeZohIVVSRqeTCaoZeAB0/ntHLeD
+FpKhet8UVmfa6oz2xgZItnKFbbX/yKiLIx84UfVkFL1xyICyjzl9/JDIBTdjFWda
+oUjf80TYSVVyQUA3/gCtUWMVeAV68g86yuiM/Fb0b2ocpjeNTUN6WyqJBgQoh4e4
+Pi9cXRH22YT63sN+oLAIPclNu5JTEuXyTncqU/Zrt9FtqSEJr4NUwzTBFDSY88tb
+6iC8uOTlyupd6A9PaRmWtrdh7SNZGnMpSTU8nY8wxelRht7s9lb95wIKo8hZo8g/
+8rFOfBkLylivPh3tAgMBAAGjgekwgeYwHQYDVR0OBBYEFPrNp4VteP5elYM8isxq
+ICClzu7yMB8GA1UdIwQYMBaAFDoAhkC3b74JiCDOqy41K0jPnLZZMD8GCCsGAQUF
+BwEBBDMwMTAvBggrBgEFBQcwAoYjaHR0cDovL3VybC1mb3ItYWlhL0ludGVybWVk
+aWFyeS5jZXIwNAYDVR0fBC0wKzApoCegJYYjaHR0cDovL3VybC1mb3ItY3JsL0lu
+dGVybWVkaWFyeS5jcmwwDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUF
+BwMBBggrBgEFBQcDAjANBgkqhkiG9w0BAQsFAAOCAQEAeD++UBbofH2IkVvbQdt8
+eHcwk5QPvKsIhW/AwG9K4xOqwDKMwUFWMQzdR5dFfnDCDk+f1MCPMrf63akL2zUy
+/+Q1jdapqTIXLmJRp5Qx0qDtScIiTzNOmIci+FVH3v9aP3LeLDOO3utEEg43pgCa
+RXxAqCnzOQYq4767gwJ3nQZigP9kkEmC2NzUE28tnCq4fpJ6MYPtRttTAIaQvaxO
+XogUkgwBiBN2vq7RD5wcZCTRCYWtb/uOURMQN8N9AhzSpC3L9D9H90lrcSZbpvV5
+TWMEBUF8AdpuRmqCeMzPVYG3g3UgcUrp3Yz7nUlfJerUi3ejguJcay67vakk2mfo
+nw==
+-----END CERTIFICATE-----
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 2 (0x2)
+    Signature Algorithm: sha256WithRSAEncryption
+        Issuer: CN=Root
+        Validity
+            Not Before: Jan  2 12:00:00 2015 GMT
+            Not After : Jan  1 12:00:00 2016 GMT
+        Subject: CN=Intermediary
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:a5:a5:9a:81:bf:e2:c1:50:ce:ca:68:4e:b0:2d:
+                    00:14:f9:23:80:c7:d5:0c:39:3e:c3:08:01:f1:2b:
+                    e5:3d:53:e1:0e:5b:59:3e:6f:c6:e2:e4:7b:32:26:
+                    d5:58:e9:96:a8:a3:43:a1:af:45:65:e0:5d:b3:6b:
+                    4a:26:09:7c:d4:2d:62:11:f3:63:71:96:8f:d0:59:
+                    b3:d9:fd:32:60:44:96:b1:5e:b9:5b:b3:e3:63:30:
+                    e0:4e:89:c9:d8:b6:56:db:3a:a7:36:fb:e2:ca:06:
+                    f8:3a:97:d3:83:2b:79:59:79:9c:61:19:d9:9a:14:
+                    f9:5c:5b:bc:6c:34:91:73:d9:24:ca:80:20:8f:ba:
+                    47:81:93:7d:2d:71:12:88:4f:f4:61:64:20:a0:51:
+                    3b:e8:5f:a2:83:8a:de:b5:7c:7e:ac:91:5a:25:66:
+                    d6:3b:10:03:62:2f:1f:10:bf:a8:c3:d4:29:d8:6d:
+                    06:2e:84:38:88:c0:0c:68:26:af:c3:dd:eb:29:3d:
+                    62:60:a4:57:78:c1:36:64:5b:93:0a:f3:4e:57:91:
+                    40:66:59:b4:aa:ba:6d:cf:b6:24:c3:c1:0d:14:c3:
+                    04:99:dd:f4:57:55:f3:48:ae:c6:2a:01:fe:5c:d2:
+                    ca:c0:17:65:b7:13:ff:3e:9a:40:8f:5f:ac:7e:02:
+                    2f:9b
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                3A:00:86:40:B7:6F:BE:09:88:20:CE:AB:2E:35:2B:48:CF:9C:B6:59
+            X509v3 Authority Key Identifier: 
+                keyid:90:3D:A5:65:AA:58:8E:4D:EB:9B:39:EB:54:36:AF:6F:57:4D:30:D0
+
+            Authority Information Access: 
+                CA Issuers - URI:http://url-for-aia/Root.cer
+
+            X509v3 CRL Distribution Points: 
+
+                Full Name:
+                  URI:http://url-for-crl/Root.crl
+
+            X509v3 Key Usage: critical
+                Certificate Sign, CRL Sign
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+    Signature Algorithm: sha256WithRSAEncryption
+         7b:c3:91:47:d7:4e:fb:75:74:14:7e:43:cf:d2:40:e2:15:c0:
+         a5:dc:f1:4c:7c:fb:13:f7:bf:a1:4f:db:bc:41:a2:2a:a2:7b:
+         72:9a:78:40:64:77:b6:7a:ac:70:94:80:14:2c:60:42:a1:1d:
+         50:a3:9b:f0:ce:70:00:0d:48:0d:86:66:21:f0:d5:0d:69:d9:
+         40:0e:5b:07:4b:93:ee:82:62:4f:68:73:a9:50:91:08:8c:12:
+         49:a4:f8:6c:97:82:7e:61:0d:be:cd:65:d9:89:0f:68:5d:ab:
+         9d:dc:aa:40:1d:3c:3e:ab:fe:66:65:f9:c4:0c:7b:30:0e:e5:
+         4c:17:60:8b:c6:05:f6:71:85:c6:fb:86:56:c1:79:88:35:56:
+         1f:23:fb:a4:6a:4e:88:47:97:43:8b:23:e2:dd:c4:3d:92:6d:
+         cd:81:82:f2:60:b0:ef:d0:4c:b0:41:f5:7e:e6:1d:f5:04:df:
+         4f:08:74:be:86:20:8e:4d:73:1c:42:61:91:44:36:c3:a5:7a:
+         98:f2:6a:5a:61:51:7b:f4:18:9b:ae:fb:16:35:c9:c7:3f:6f:
+         f6:7d:9c:84:d4:bd:57:5c:ff:42:f2:44:9c:b4:ef:5b:bc:d4:
+         f4:60:c9:98:45:ba:7e:ec:21:6d:a1:c4:71:05:ef:54:0d:30:
+         b4:98:52:c9
+-----BEGIN CERTIFICATE-----
+MIIDbTCCAlWgAwIBAgIBAjANBgkqhkiG9w0BAQsFADAPMQ0wCwYDVQQDDARSb290
+MB4XDTE1MDEwMjEyMDAwMFoXDTE2MDEwMTEyMDAwMFowFzEVMBMGA1UEAwwMSW50
+ZXJtZWRpYXJ5MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEApaWagb/i
+wVDOymhOsC0AFPkjgMfVDDk+wwgB8SvlPVPhDltZPm/G4uR7MibVWOmWqKNDoa9F
+ZeBds2tKJgl81C1iEfNjcZaP0Fmz2f0yYESWsV65W7PjYzDgTonJ2LZW2zqnNvvi
+ygb4OpfTgyt5WXmcYRnZmhT5XFu8bDSRc9kkyoAgj7pHgZN9LXESiE/0YWQgoFE7
+6F+ig4retXx+rJFaJWbWOxADYi8fEL+ow9Qp2G0GLoQ4iMAMaCavw93rKT1iYKRX
+eME2ZFuTCvNOV5FAZlm0qrptz7Ykw8ENFMMEmd30V1XzSK7GKgH+XNLKwBdltxP/
+PppAj1+sfgIvmwIDAQABo4HLMIHIMB0GA1UdDgQWBBQ6AIZAt2++CYggzqsuNStI
+z5y2WTAfBgNVHSMEGDAWgBSQPaVlqliOTeubOetUNq9vV00w0DA3BggrBgEFBQcB
+AQQrMCkwJwYIKwYBBQUHMAKGG2h0dHA6Ly91cmwtZm9yLWFpYS9Sb290LmNlcjAs
+BgNVHR8EJTAjMCGgH6AdhhtodHRwOi8vdXJsLWZvci1jcmwvUm9vdC5jcmwwDgYD
+VR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEB
+AHvDkUfXTvt1dBR+Q8/SQOIVwKXc8Ux8+xP3v6FP27xBoiqie3KaeEBkd7Z6rHCU
+gBQsYEKhHVCjm/DOcAANSA2GZiHw1Q1p2UAOWwdLk+6CYk9oc6lQkQiMEkmk+GyX
+gn5hDb7NZdmJD2hdq53cqkAdPD6r/mZl+cQMezAO5UwXYIvGBfZxhcb7hlbBeYg1
+Vh8j+6RqTohHl0OLI+LdxD2Sbc2BgvJgsO/QTLBB9X7mHfUE308IdL6GII5NcxxC
+YZFENsOlepjyalphUXv0GJuu+xY1ycc/b/Z9nITUvVdc/0LyRJy071u81PRgyZhF
+un7sIW2hxHEF71QNMLSYUsk=
+-----END CERTIFICATE-----
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 1 (0x1)
+    Signature Algorithm: sha256WithRSAEncryption
+        Issuer: CN=Root
+        Validity
+            Not Before: Jan  2 12:00:00 2015 GMT
+            Not After : Jan  1 12:00:00 2016 GMT
+        Subject: CN=Root
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:ae:62:ef:d6:9a:64:a0:fe:c8:82:19:6f:a2:8d:
+                    0c:bf:30:9b:44:df:ee:cf:d7:35:34:09:27:01:72:
+                    a7:97:6b:e7:1a:b1:7c:29:26:35:33:16:9a:88:9d:
+                    68:31:be:6a:07:c1:7e:92:1e:6e:46:cf:2d:c9:53:
+                    81:19:c3:eb:df:02:fc:eb:1d:34:e1:56:4f:76:85:
+                    58:18:96:eb:29:94:8a:b8:dc:14:2c:a7:1d:9f:0c:
+                    4c:ef:73:35:39:4d:b0:93:a2:a0:c5:22:d8:06:58:
+                    75:4b:2d:b2:e2:54:ee:bc:06:eb:d3:eb:64:3e:f2:
+                    84:78:32:af:ed:44:c5:fb:27:49:8a:d7:56:1c:ab:
+                    92:a0:3c:32:4b:14:d3:17:bd:50:b0:4b:1c:c3:69:
+                    f0:8b:67:ca:e4:72:c6:52:4f:1b:19:17:e4:73:e4:
+                    f9:0a:5a:55:57:8c:f5:76:f9:7f:94:ba:91:d2:fb:
+                    95:de:55:94:a3:63:82:9c:04:b5:64:46:3a:cd:7e:
+                    f8:e2:11:0c:47:4a:d3:c4:2c:60:2a:8d:47:0f:ea:
+                    02:a4:d0:23:e4:71:3e:63:fa:f6:84:39:63:ba:63:
+                    fd:75:51:36:db:82:2e:fd:41:3c:99:19:4a:c6:4d:
+                    be:c3:d1:91:23:05:3f:18:11:5a:c3:38:15:de:e5:
+                    3f:df
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                90:3D:A5:65:AA:58:8E:4D:EB:9B:39:EB:54:36:AF:6F:57:4D:30:D0
+            X509v3 Authority Key Identifier: 
+                keyid:90:3D:A5:65:AA:58:8E:4D:EB:9B:39:EB:54:36:AF:6F:57:4D:30:D0
+
+            Authority Information Access: 
+                CA Issuers - URI:http://url-for-aia/Root.cer
+
+            X509v3 CRL Distribution Points: 
+
+                Full Name:
+                  URI:http://url-for-crl/Root.crl
+
+            X509v3 Key Usage: critical
+                Certificate Sign, CRL Sign
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+    Signature Algorithm: sha256WithRSAEncryption
+         20:f2:1d:db:43:7a:f2:55:9a:73:eb:f0:ed:7a:2b:9a:b4:d4:
+         91:61:ee:ba:41:9e:36:5b:b7:51:93:7f:9c:ea:69:91:98:32:
+         88:8e:01:ed:a8:f8:44:7d:53:68:e0:66:08:cc:c3:b2:7b:6b:
+         53:17:6a:3d:66:29:32:cf:39:5a:9c:41:2f:8a:d3:f0:0c:d7:
+         41:b9:85:b8:d8:c0:4c:6b:3c:7e:5e:88:ef:ce:b6:ca:58:88:
+         87:5a:c0:51:bb:2e:de:f6:3b:b5:d8:78:19:a9:0a:81:13:a0:
+         93:74:9a:cd:dc:93:62:05:a3:f6:87:2f:2a:e8:2f:11:69:ba:
+         c0:34:05:05:f6:a5:b1:6c:ad:7a:ba:21:cd:c2:dc:59:71:87:
+         f6:d1:d1:b3:17:80:38:43:43:fd:f9:fe:0b:c3:30:1f:fd:bd:
+         56:65:29:91:ae:c0:cd:44:78:99:5c:dc:9f:57:02:fc:fd:82:
+         13:29:3e:70:7f:9d:ba:93:1e:dc:20:61:59:3d:7a:ef:3f:47:
+         a8:2c:eb:90:70:b6:30:24:8f:a4:91:ac:48:3d:dc:c6:42:b7:
+         dc:17:71:21:7b:09:d9:48:8c:d9:67:89:a1:4b:37:9c:b9:d1:
+         0b:43:8e:ab:23:71:f4:60:86:a5:a3:bb:27:33:20:37:4b:b4:
+         1d:19:49:c8
+-----BEGIN TRUSTED_CERTIFICATE-----
+MIIDZTCCAk2gAwIBAgIBATANBgkqhkiG9w0BAQsFADAPMQ0wCwYDVQQDDARSb290
+MB4XDTE1MDEwMjEyMDAwMFoXDTE2MDEwMTEyMDAwMFowDzENMAsGA1UEAwwEUm9v
+dDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK5i79aaZKD+yIIZb6KN
+DL8wm0Tf7s/XNTQJJwFyp5dr5xqxfCkmNTMWmoidaDG+agfBfpIebkbPLclTgRnD
+698C/OsdNOFWT3aFWBiW6ymUirjcFCynHZ8MTO9zNTlNsJOioMUi2AZYdUstsuJU
+7rwG69PrZD7yhHgyr+1ExfsnSYrXVhyrkqA8MksU0xe9ULBLHMNp8ItnyuRyxlJP
+GxkX5HPk+QpaVVeM9Xb5f5S6kdL7ld5VlKNjgpwEtWRGOs1++OIRDEdK08QsYCqN
+Rw/qAqTQI+RxPmP69oQ5Y7pj/XVRNtuCLv1BPJkZSsZNvsPRkSMFPxgRWsM4Fd7l
+P98CAwEAAaOByzCByDAdBgNVHQ4EFgQUkD2lZapYjk3rmznrVDavb1dNMNAwHwYD
+VR0jBBgwFoAUkD2lZapYjk3rmznrVDavb1dNMNAwNwYIKwYBBQUHAQEEKzApMCcG
+CCsGAQUFBzAChhtodHRwOi8vdXJsLWZvci1haWEvUm9vdC5jZXIwLAYDVR0fBCUw
+IzAhoB+gHYYbaHR0cDovL3VybC1mb3ItY3JsL1Jvb3QuY3JsMA4GA1UdDwEB/wQE
+AwIBBjAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQAg8h3bQ3ry
+VZpz6/DteiuatNSRYe66QZ42W7dRk3+c6mmRmDKIjgHtqPhEfVNo4GYIzMOye2tT
+F2o9ZikyzzlanEEvitPwDNdBuYW42MBMazx+XojvzrbKWIiHWsBRuy7e9ju12HgZ
+qQqBE6CTdJrN3JNiBaP2hy8q6C8RabrANAUF9qWxbK16uiHNwtxZcYf20dGzF4A4
+Q0P9+f4LwzAf/b1WZSmRrsDNRHiZXNyfVwL8/YITKT5wf526kx7cIGFZPXrvP0eo
+LOuQcLYwJI+kkaxIPdzGQrfcF3EhewnZSIzZZ4mhSzecudELQ46rI3H0YIalo7sn
+MyA3S7QdGUnI
+-----END TRUSTED_CERTIFICATE-----
+
+-----BEGIN TIME-----
+MTUwMzAyMTIwMDAwWg==
+-----END TIME-----
+
+-----BEGIN VERIFY_RESULT-----
+U1VDQ0VTUw==
+-----END VERIFY_RESULT-----