Certificate path builder for new certificate verification library

net/data/verify_certificate_chain_unittest/key-rollover-oldchain.pem

Index: net/data/verify_certificate_chain_unittest/key-rollover-oldchain.pem
diff --git a/net/data/verify_certificate_chain_unittest/key-rollover-oldchain.pem b/net/data/verify_certificate_chain_unittest/key-rollover-oldchain.pem
new file mode 100644
index 0000000000000000000000000000000000000000..c016d89dd64491f462e8892cdf87e01bcd5e9f34
--- /dev/null
+++ b/net/data/verify_certificate_chain_unittest/key-rollover-oldchain.pem
@@ -0,0 +1,279 @@
+[Created by: ./generate-key-rollover.py]
+
+XXX
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 1 (0x1)
+    Signature Algorithm: sha256WithRSAEncryption
+        Issuer: CN=Intermediary
+        Validity
+            Not Before: Jan  1 12:00:00 2015 GMT
+            Not After : Jan  1 12:00:00 2016 GMT
+        Subject: CN=Target
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:b9:1b:49:eb:08:65:2b:a5:5d:92:9f:e5:07:05:
+                    c4:3d:85:8e:1d:11:6c:fa:71:e6:5c:e7:17:31:30:
+                    82:56:49:e6:68:84:85:55:49:1a:9e:4c:26:a8:65:
+                    e0:01:d3:f9:ed:1c:b7:83:16:92:a1:7a:df:14:56:
+                    67:da:ea:8c:f6:c6:06:48:b6:72:85:6d:b5:ff:c8:
+                    a8:8b:23:1f:38:51:f5:64:14:bd:71:c8:80:b2:8f:
+                    39:7d:fc:90:c8:05:37:63:15:67:5a:a1:48:df:f3:
+                    44:d8:49:55:72:41:40:37:fe:00:ad:51:63:15:78:
+                    05:7a:f2:0f:3a:ca:e8:8c:fc:56:f4:6f:6a:1c:a6:
+                    37:8d:4d:43:7a:5b:2a:89:06:04:28:87:87:b8:3e:
+                    2f:5c:5d:11:f6:d9:84:fa:de:c3:7e:a0:b0:08:3d:
+                    c9:4d:bb:92:53:12:e5:f2:4e:77:2a:53:f6:6b:b7:
+                    d1:6d:a9:21:09:af:83:54:c3:34:c1:14:34:98:f3:
+                    cb:5b:ea:20:bc:b8:e4:e5:ca:ea:5d:e8:0f:4f:69:
+                    19:96:b6:b7:61:ed:23:59:1a:73:29:49:35:3c:9d:
+                    8f:30:c5:e9:51:86:de:ec:f6:56:fd:e7:02:0a:a3:
+                    c8:59:a3:c8:3f:f2:b1:4e:7c:19:0b:ca:58:af:3e:
+                    1d:ed
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                FA:CD:A7:85:6D:78:FE:5E:95:83:3C:8A:CC:6A:20:20:A5:CE:EE:F2
+            X509v3 Authority Key Identifier: 
+                keyid:3A:00:86:40:B7:6F:BE:09:88:20:CE:AB:2E:35:2B:48:CF:9C:B6:59
+
+            Authority Information Access: 
+                CA Issuers - URI:http://url-for-aia/Intermediary.cer
+
+            X509v3 CRL Distribution Points: 
+
+                Full Name:
+                  URI:http://url-for-crl/Intermediary.crl
+
+            X509v3 Key Usage: critical
+                Digital Signature, Key Encipherment
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, TLS Web Client Authentication
+    Signature Algorithm: sha256WithRSAEncryption
+         78:3f:be:50:16:e8:7c:7d:88:91:5b:db:41:db:7c:78:77:30:
+         93:94:0f:bc:ab:08:85:6f:c0:c0:6f:4a:e3:13:aa:c0:32:8c:
+         c1:41:56:31:0c:dd:47:97:45:7e:70:c2:0e:4f:9f:d4:c0:8f:
+         32:b7:fa:dd:a9:0b:db:35:32:ff:e4:35:8d:d6:a9:a9:32:17:
+         2e:62:51:a7:94:31:d2:a0:ed:49:c2:22:4f:33:4e:98:87:22:
+         f8:55:47:de:ff:5a:3f:72:de:2c:33:8e:de:eb:44:12:0e:37:
+         a6:00:9a:45:7c:40:a8:29:f3:39:06:2a:e3:be:bb:83:02:77:
+         9d:06:62:80:ff:64:90:49:82:d8:dc:d4:13:6f:2d:9c:2a:b8:
+         7e:92:7a:31:83:ed:46:db:53:00:86:90:bd:ac:4e:5e:88:14:
+         92:0c:01:88:13:76:be:ae:d1:0f:9c:1c:64:24:d1:09:85:ad:
+         6f:fb:8e:51:13:10:37:c3:7d:02:1c:d2:a4:2d:cb:f4:3f:47:
+         f7:49:6b:71:26:5b:a6:f5:79:4d:63:04:05:41:7c:01:da:6e:
+         46:6a:82:78:cc:cf:55:81:b7:83:75:20:71:4a:e9:dd:8c:fb:
+         9d:49:5f:25:ea:d4:8b:77:a3:82:e2:5c:6b:2e:bb:bd:a9:24:
+         da:67:e8:9f
+-----BEGIN CERTIFICATE-----
+MIIDjTCCAnWgAwIBAgIBATANBgkqhkiG9w0BAQsFADAXMRUwEwYDVQQDDAxJbnRl
+cm1lZGlhcnkwHhcNMTUwMTAxMTIwMDAwWhcNMTYwMTAxMTIwMDAwWjARMQ8wDQYD
+VQQDDAZUYXJnZXQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC5G0nr
+CGUrpV2Sn+UHBcQ9hY4dEWz6ceZc5xcxMIJWSeZohIVVSRqeTCaoZeAB0/ntHLeD
+FpKhet8UVmfa6oz2xgZItnKFbbX/yKiLIx84UfVkFL1xyICyjzl9/JDIBTdjFWda
+oUjf80TYSVVyQUA3/gCtUWMVeAV68g86yuiM/Fb0b2ocpjeNTUN6WyqJBgQoh4e4
+Pi9cXRH22YT63sN+oLAIPclNu5JTEuXyTncqU/Zrt9FtqSEJr4NUwzTBFDSY88tb
+6iC8uOTlyupd6A9PaRmWtrdh7SNZGnMpSTU8nY8wxelRht7s9lb95wIKo8hZo8g/
+8rFOfBkLylivPh3tAgMBAAGjgekwgeYwHQYDVR0OBBYEFPrNp4VteP5elYM8isxq
+ICClzu7yMB8GA1UdIwQYMBaAFDoAhkC3b74JiCDOqy41K0jPnLZZMD8GCCsGAQUF
+BwEBBDMwMTAvBggrBgEFBQcwAoYjaHR0cDovL3VybC1mb3ItYWlhL0ludGVybWVk
+aWFyeS5jZXIwNAYDVR0fBC0wKzApoCegJYYjaHR0cDovL3VybC1mb3ItY3JsL0lu
+dGVybWVkaWFyeS5jcmwwDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUF
+BwMBBggrBgEFBQcDAjANBgkqhkiG9w0BAQsFAAOCAQEAeD++UBbofH2IkVvbQdt8
+eHcwk5QPvKsIhW/AwG9K4xOqwDKMwUFWMQzdR5dFfnDCDk+f1MCPMrf63akL2zUy
+/+Q1jdapqTIXLmJRp5Qx0qDtScIiTzNOmIci+FVH3v9aP3LeLDOO3utEEg43pgCa
+RXxAqCnzOQYq4767gwJ3nQZigP9kkEmC2NzUE28tnCq4fpJ6MYPtRttTAIaQvaxO
+XogUkgwBiBN2vq7RD5wcZCTRCYWtb/uOURMQN8N9AhzSpC3L9D9H90lrcSZbpvV5
+TWMEBUF8AdpuRmqCeMzPVYG3g3UgcUrp3Yz7nUlfJerUi3ejguJcay67vakk2mfo
+nw==
+-----END CERTIFICATE-----
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 2 (0x2)
+    Signature Algorithm: sha256WithRSAEncryption
+        Issuer: CN=Root
+        Validity
+            Not Before: Jan  1 12:00:00 2015 GMT
+            Not After : Jan  1 12:00:00 2016 GMT
+        Subject: CN=Intermediary
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:a5:a5:9a:81:bf:e2:c1:50:ce:ca:68:4e:b0:2d:
+                    00:14:f9:23:80:c7:d5:0c:39:3e:c3:08:01:f1:2b:
+                    e5:3d:53:e1:0e:5b:59:3e:6f:c6:e2:e4:7b:32:26:
+                    d5:58:e9:96:a8:a3:43:a1:af:45:65:e0:5d:b3:6b:
+                    4a:26:09:7c:d4:2d:62:11:f3:63:71:96:8f:d0:59:
+                    b3:d9:fd:32:60:44:96:b1:5e:b9:5b:b3:e3:63:30:
+                    e0:4e:89:c9:d8:b6:56:db:3a:a7:36:fb:e2:ca:06:
+                    f8:3a:97:d3:83:2b:79:59:79:9c:61:19:d9:9a:14:
+                    f9:5c:5b:bc:6c:34:91:73:d9:24:ca:80:20:8f:ba:
+                    47:81:93:7d:2d:71:12:88:4f:f4:61:64:20:a0:51:
+                    3b:e8:5f:a2:83:8a:de:b5:7c:7e:ac:91:5a:25:66:
+                    d6:3b:10:03:62:2f:1f:10:bf:a8:c3:d4:29:d8:6d:
+                    06:2e:84:38:88:c0:0c:68:26:af:c3:dd:eb:29:3d:
+                    62:60:a4:57:78:c1:36:64:5b:93:0a:f3:4e:57:91:
+                    40:66:59:b4:aa:ba:6d:cf:b6:24:c3:c1:0d:14:c3:
+                    04:99:dd:f4:57:55:f3:48:ae:c6:2a:01:fe:5c:d2:
+                    ca:c0:17:65:b7:13:ff:3e:9a:40:8f:5f:ac:7e:02:
+                    2f:9b
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                3A:00:86:40:B7:6F:BE:09:88:20:CE:AB:2E:35:2B:48:CF:9C:B6:59
+            X509v3 Authority Key Identifier: 
+                keyid:1F:DF:05:26:02:76:12:14:FC:65:13:32:9D:2D:D4:AD:C1:41:CA:18
+
+            Authority Information Access: 
+                CA Issuers - URI:http://url-for-aia/Root.cer
+
+            X509v3 CRL Distribution Points: 
+
+                Full Name:
+                  URI:http://url-for-crl/Root.crl
+
+            X509v3 Key Usage: critical
+                Certificate Sign, CRL Sign
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+    Signature Algorithm: sha256WithRSAEncryption
+         40:94:b7:83:6f:34:e1:12:7a:85:7c:69:9a:00:94:41:4a:10:
+         23:35:62:49:e6:52:30:c9:f2:9d:53:d8:b5:c3:a6:91:56:84:
+         83:50:86:60:62:a2:e8:03:32:0d:07:17:db:c9:9c:74:9b:a4:
+         28:8d:d0:f0:1d:6a:bd:62:a9:cb:ca:dd:a2:37:d0:5b:1e:94:
+         72:33:df:ac:bd:77:a6:b1:92:76:7c:7a:3d:f8:58:b0:c9:55:
+         0d:1e:c8:5f:c2:16:bb:d4:c5:b7:1a:7d:85:6b:b3:9f:40:d6:
+         0e:52:36:03:53:8e:14:03:77:97:ec:af:da:cd:7a:38:57:fd:
+         f6:82:60:89:ee:f7:aa:73:e7:6b:d1:ca:86:aa:ef:9f:84:3d:
+         ac:db:27:0a:7e:3d:fe:b7:55:df:60:5e:e8:75:ca:03:1a:68:
+         98:39:a8:8b:9c:7a:dd:7b:14:13:f2:7f:76:a4:6f:66:d4:d0:
+         a3:c6:f8:9c:86:d8:40:47:58:3c:5f:f1:c6:5d:6d:ca:8a:51:
+         4c:ed:65:5c:73:f8:59:fb:62:6a:00:2d:ab:17:c0:a9:32:d0:
+         7c:7a:07:93:2e:c2:0a:d3:d3:b3:a6:7f:62:52:aa:94:59:57:
+         42:26:1b:fd:9c:d7:ff:63:5b:ab:c6:bf:79:af:89:27:6b:c1:
+         c0:29:88:6d
+-----BEGIN CERTIFICATE-----
+MIIDbTCCAlWgAwIBAgIBAjANBgkqhkiG9w0BAQsFADAPMQ0wCwYDVQQDDARSb290
+MB4XDTE1MDEwMTEyMDAwMFoXDTE2MDEwMTEyMDAwMFowFzEVMBMGA1UEAwwMSW50
+ZXJtZWRpYXJ5MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEApaWagb/i
+wVDOymhOsC0AFPkjgMfVDDk+wwgB8SvlPVPhDltZPm/G4uR7MibVWOmWqKNDoa9F
+ZeBds2tKJgl81C1iEfNjcZaP0Fmz2f0yYESWsV65W7PjYzDgTonJ2LZW2zqnNvvi
+ygb4OpfTgyt5WXmcYRnZmhT5XFu8bDSRc9kkyoAgj7pHgZN9LXESiE/0YWQgoFE7
+6F+ig4retXx+rJFaJWbWOxADYi8fEL+ow9Qp2G0GLoQ4iMAMaCavw93rKT1iYKRX
+eME2ZFuTCvNOV5FAZlm0qrptz7Ykw8ENFMMEmd30V1XzSK7GKgH+XNLKwBdltxP/
+PppAj1+sfgIvmwIDAQABo4HLMIHIMB0GA1UdDgQWBBQ6AIZAt2++CYggzqsuNStI
+z5y2WTAfBgNVHSMEGDAWgBQf3wUmAnYSFPxlEzKdLdStwUHKGDA3BggrBgEFBQcB
+AQQrMCkwJwYIKwYBBQUHMAKGG2h0dHA6Ly91cmwtZm9yLWFpYS9Sb290LmNlcjAs
+BgNVHR8EJTAjMCGgH6AdhhtodHRwOi8vdXJsLWZvci1jcmwvUm9vdC5jcmwwDgYD
+VR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEB
+AECUt4NvNOESeoV8aZoAlEFKECM1YknmUjDJ8p1T2LXDppFWhINQhmBiougDMg0H
+F9vJnHSbpCiN0PAdar1iqcvK3aI30FselHIz36y9d6axknZ8ej34WLDJVQ0eyF/C
+FrvUxbcafYVrs59A1g5SNgNTjhQDd5fsr9rNejhX/faCYInu96pz52vRyoaq75+E
+PazbJwp+Pf63Vd9gXuh1ygMaaJg5qIucet17FBPyf3akb2bU0KPG+JyG2EBHWDxf
+8cZdbcqKUUztZVxz+Fn7YmoALasXwKky0Hx6B5MuwgrT07Omf2JSqpRZV0ImG/2c
+1/9jW6vGv3mviSdrwcApiG0=
+-----END CERTIFICATE-----
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 1 (0x1)
+    Signature Algorithm: sha256WithRSAEncryption
+        Issuer: CN=Root
+        Validity
+            Not Before: Jan  1 12:00:00 2015 GMT
+            Not After : Jan  1 12:00:00 2016 GMT
+        Subject: CN=Root
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:af:3f:90:c4:59:f7:51:29:4d:58:71:26:5b:24:
+                    6f:bf:e7:7d:e9:d7:59:59:4a:66:f3:e5:bd:f7:39:
+                    7f:eb:1c:b6:97:59:dc:59:ed:bb:ff:62:2b:93:cd:
+                    54:1a:52:57:4f:16:df:d8:4d:65:20:60:08:84:5f:
+                    f4:a5:9c:44:30:1c:78:0e:35:8f:f5:08:aa:3e:7a:
+                    5c:b7:c2:c6:20:3b:f8:55:ae:e9:fe:52:7d:a9:2e:
+                    8b:18:fc:89:cf:4e:74:ab:31:3a:9b:84:0c:92:52:
+                    04:5e:c2:31:87:ec:89:90:1e:c5:2a:75:a9:f0:7a:
+                    b0:36:9e:20:6d:1f:21:0c:8d:f5:56:92:de:50:4f:
+                    38:1b:03:80:04:dc:96:b0:05:97:64:77:3c:01:e4:
+                    84:58:dd:79:1f:2c:96:9f:18:86:51:21:9d:34:f8:
+                    5c:63:0f:0b:a7:07:a8:b0:3e:0c:32:bb:b1:2a:e4:
+                    96:b0:8d:5b:64:e1:57:2e:d0:2e:69:19:01:a5:71:
+                    4d:c7:9f:86:fc:fe:97:1f:e8:a5:cc:b8:bd:0e:a4:
+                    49:e2:bc:35:fe:44:15:ba:93:ae:f1:58:a2:78:98:
+                    71:10:54:3d:bf:4f:4c:ce:10:1a:4c:9b:9f:51:ec:
+                    f6:4c:2d:6c:b9:04:fb:f5:6b:99:43:af:57:dd:ad:
+                    42:b7
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                1F:DF:05:26:02:76:12:14:FC:65:13:32:9D:2D:D4:AD:C1:41:CA:18
+            X509v3 Authority Key Identifier: 
+                keyid:1F:DF:05:26:02:76:12:14:FC:65:13:32:9D:2D:D4:AD:C1:41:CA:18
+
+            Authority Information Access: 
+                CA Issuers - URI:http://url-for-aia/Root.cer
+
+            X509v3 CRL Distribution Points: 
+
+                Full Name:
+                  URI:http://url-for-crl/Root.crl
+
+            X509v3 Key Usage: critical
+                Certificate Sign, CRL Sign
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+    Signature Algorithm: sha256WithRSAEncryption
+         2f:00:88:52:22:15:6e:86:61:7a:d2:26:99:c9:c7:57:3f:f7:
+         69:a6:e1:ba:5e:98:4c:63:72:69:f3:ab:82:50:8d:bf:c8:03:
+         0c:7b:73:0d:34:8e:46:b2:c8:0f:b4:57:a3:ae:54:ef:55:b2:
+         7c:ce:42:2a:b5:c5:d6:3b:20:7f:ae:22:7e:26:44:82:6a:4a:
+         16:73:8b:7c:50:a1:a4:87:47:e9:89:97:af:74:f3:fa:b3:e7:
+         30:65:8f:af:4f:b5:57:e9:25:ca:7c:db:19:29:a9:11:7b:ce:
+         e0:fe:d4:47:b3:38:99:6a:0c:64:c6:1c:03:8d:a6:98:61:06:
+         9a:90:f6:99:d0:f5:07:11:ed:bc:b2:96:9f:8a:48:f4:59:6b:
+         73:ed:08:90:16:c6:55:35:71:27:52:dc:52:b6:9d:b3:a5:5e:
+         bc:2c:0d:9c:3f:d1:77:25:f9:77:24:20:ea:de:0e:cc:d2:8d:
+         1c:cb:0d:c8:87:36:2b:16:65:17:97:96:3a:26:fd:e4:6f:13:
+         37:72:1c:44:4c:e8:f6:6b:30:d6:ec:1d:85:2a:38:9b:fa:94:
+         9a:1c:c8:c3:30:12:b9:ba:e5:d6:a9:84:6d:99:55:a3:71:8a:
+         2f:f9:eb:2d:40:db:7f:7d:8d:46:5b:a0:a0:b6:60:d1:4f:81:
+         3f:e5:2f:d3
+-----BEGIN TRUSTED_CERTIFICATE-----
+MIIDZTCCAk2gAwIBAgIBATANBgkqhkiG9w0BAQsFADAPMQ0wCwYDVQQDDARSb290
+MB4XDTE1MDEwMTEyMDAwMFoXDTE2MDEwMTEyMDAwMFowDzENMAsGA1UEAwwEUm9v
+dDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK8/kMRZ91EpTVhxJlsk
+b7/nfenXWVlKZvPlvfc5f+sctpdZ3Fntu/9iK5PNVBpSV08W39hNZSBgCIRf9KWc
+RDAceA41j/UIqj56XLfCxiA7+FWu6f5Sfakuixj8ic9OdKsxOpuEDJJSBF7CMYfs
+iZAexSp1qfB6sDaeIG0fIQyN9VaS3lBPOBsDgATclrAFl2R3PAHkhFjdeR8slp8Y
+hlEhnTT4XGMPC6cHqLA+DDK7sSrklrCNW2ThVy7QLmkZAaVxTcefhvz+lx/opcy4
+vQ6kSeK8Nf5EFbqTrvFYoniYcRBUPb9PTM4QGkybn1Hs9kwtbLkE+/VrmUOvV92t
+QrcCAwEAAaOByzCByDAdBgNVHQ4EFgQUH98FJgJ2EhT8ZRMynS3UrcFByhgwHwYD
+VR0jBBgwFoAUH98FJgJ2EhT8ZRMynS3UrcFByhgwNwYIKwYBBQUHAQEEKzApMCcG
+CCsGAQUFBzAChhtodHRwOi8vdXJsLWZvci1haWEvUm9vdC5jZXIwLAYDVR0fBCUw
+IzAhoB+gHYYbaHR0cDovL3VybC1mb3ItY3JsL1Jvb3QuY3JsMA4GA1UdDwEB/wQE
+AwIBBjAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQAvAIhSIhVu
+hmF60iaZycdXP/dppuG6XphMY3Jp86uCUI2/yAMMe3MNNI5GssgPtFejrlTvVbJ8
+zkIqtcXWOyB/riJ+JkSCakoWc4t8UKGkh0fpiZevdPP6s+cwZY+vT7VX6SXKfNsZ
+KakRe87g/tRHsziZagxkxhwDjaaYYQaakPaZ0PUHEe28spafikj0WWtz7QiQFsZV
+NXEnUtxStp2zpV68LA2cP9F3Jfl3JCDq3g7M0o0cyw3IhzYrFmUXl5Y6Jv3kbxM3
+chxETOj2azDW7B2FKjib+pSaHMjDMBK5uuXWqYRtmVWjcYov+estQNt/fY1GW6Cg
+tmDRT4E/5S/T
+-----END TRUSTED_CERTIFICATE-----
+
+-----BEGIN TIME-----
+MTUwMzAyMTIwMDAwWg==
+-----END TIME-----
+
+-----BEGIN VERIFY_RESULT-----
+U1VDQ0VTUw==
+-----END VERIFY_RESULT-----