Support trust anchor constraints, by specifying them as a certificate.

net/data/verify_certificate_chain_unittest/violates-pathlen-1-root.pem

Index: net/data/verify_certificate_chain_unittest/violates-pathlen-1-root.pem
diff --git a/net/data/verify_certificate_chain_unittest/violates-pathlen-1-root.pem b/net/data/verify_certificate_chain_unittest/violates-pathlen-1-root.pem
deleted file mode 100644
index 912ab567c245fb289ba6affb2acb834598819b31..0000000000000000000000000000000000000000
--- a/net/data/verify_certificate_chain_unittest/violates-pathlen-1-root.pem
+++ /dev/null
@@ -1,370 +0,0 @@
-[Created by: generate-violates-pathlen-1-root.py]
-
-Certificate chain with 2 intermediates and one end entity certificate. The
-root certificate has a pathlen:1 restriction. Ordinarily this would be an
-invalid chain, however constraints on trust anchors are not validated.
-
-Certificate:
-    Data:
-        Version: 3 (0x2)
-        Serial Number: 1 (0x1)
-    Signature Algorithm: sha256WithRSAEncryption
-        Issuer: CN=Intermediate2
-        Validity
-            Not Before: Jan  1 12:00:00 2015 GMT
-            Not After : Jan  1 12:00:00 2016 GMT
-        Subject: CN=Target
-        Subject Public Key Info:
-            Public Key Algorithm: rsaEncryption
-                Public-Key: (2048 bit)
-                Modulus:
-                    00:c7:02:89:18:09:bc:9f:9c:9a:41:35:a9:5f:f7:
-                    c2:22:3e:b2:39:fe:ba:57:1d:95:2e:dd:65:23:45:
-                    ce:33:77:99:dd:f1:d7:69:0b:fb:a7:0e:89:98:02:
-                    7a:94:58:7b:61:e6:10:98:69:1a:09:2b:9f:73:3a:
-                    d8:70:18:64:e2:8a:85:87:c5:69:f3:45:1e:70:d8:
-                    c0:5e:23:6c:a6:7d:8f:77:23:8a:5d:74:a0:0b:d5:
-                    7f:a7:dd:f5:21:2d:02:c2:0f:e0:c8:f8:29:20:f5:
-                    5e:33:58:2a:38:c8:41:a6:25:66:ac:cf:c4:03:cb:
-                    03:25:db:e6:65:3d:bd:ab:da:fb:8f:b5:0e:d8:ba:
-                    3d:14:2b:9b:07:62:13:d4:1c:ea:b1:d5:7d:4d:54:
-                    04:c0:13:fb:d1:df:c2:36:e3:00:cf:fa:49:0b:44:
-                    9c:05:80:19:75:02:25:41:3d:e0:e6:cd:87:d8:63:
-                    d7:84:3d:0c:3a:c8:ec:e8:58:22:62:2f:18:e9:ad:
-                    45:ce:b8:a6:63:c2:65:29:69:1e:21:08:8d:3a:da:
-                    96:e0:89:27:09:cc:35:e9:f1:f0:d8:f3:61:c5:05:
-                    3e:b1:d0:00:3c:7e:25:4a:36:e3:1d:b4:95:37:2d:
-                    44:ac:9e:79:38:67:e7:c7:ac:0c:71:d3:d1:60:86:
-                    44:09
-                Exponent: 65537 (0x10001)
-        X509v3 extensions:
-            X509v3 Subject Key Identifier: 
-                C6:CC:7E:B5:7C:7A:51:EC:1C:35:E1:CD:3C:A7:FC:06:31:53:CA:06
-            X509v3 Authority Key Identifier: 
-                keyid:48:BF:34:63:E8:E4:FB:87:49:F2:0E:A0:23:38:D2:BE:6A:3D:45:3C
-
-            Authority Information Access: 
-                CA Issuers - URI:http://url-for-aia/Intermediate2.cer
-
-            X509v3 CRL Distribution Points: 
-
-                Full Name:
-                  URI:http://url-for-crl/Intermediate2.crl
-
-            X509v3 Key Usage: critical
-                Digital Signature, Key Encipherment
-            X509v3 Extended Key Usage: 
-                TLS Web Server Authentication, TLS Web Client Authentication
-    Signature Algorithm: sha256WithRSAEncryption
-         51:8c:f9:c8:cb:cc:14:e3:54:cd:63:1a:f0:1e:0b:a3:6e:60:
-         99:68:06:fe:e6:97:f5:68:e7:d8:7a:e1:b1:78:48:3e:03:57:
-         e4:84:5a:24:08:47:9f:fb:73:1a:7f:76:66:40:5d:ac:2f:f4:
-         f0:9e:b1:21:b0:15:5f:d1:68:4a:b6:fe:84:23:05:51:7d:d3:
-         22:95:81:d0:76:87:29:9c:24:e8:3f:e0:41:a0:bb:57:96:1d:
-         7e:92:2d:22:b3:98:67:4c:87:5e:42:f5:c9:08:fb:b9:05:25:
-         73:b8:f0:9a:45:62:96:c6:48:b6:fe:ac:6c:42:a4:9e:41:aa:
-         fd:55:86:8e:4f:85:9e:b7:26:75:e3:79:28:ed:09:8d:63:35:
-         b5:55:78:13:46:43:17:3d:e8:12:c8:c3:c6:2f:88:f9:ce:b5:
-         df:af:6d:70:6f:6b:f6:1e:ff:1a:44:84:b6:51:7a:b1:7c:4f:
-         b4:7a:19:83:4c:85:b8:d0:e7:65:2e:0e:e2:ed:92:33:c4:f9:
-         cd:35:78:96:d6:8e:06:2c:17:18:0e:bf:be:f0:c5:7f:d3:85:
-         71:62:94:83:d8:1b:51:c4:77:37:d3:6a:fd:43:b4:54:44:fe:
-         f9:da:01:3e:59:d4:7b:a4:26:32:e4:ba:9a:bf:f3:2b:6c:71:
-         d2:1e:2c:c4
------BEGIN CERTIFICATE-----
-MIIDkDCCAnigAwIBAgIBATANBgkqhkiG9w0BAQsFADAYMRYwFAYDVQQDDA1JbnRl
-cm1lZGlhdGUyMB4XDTE1MDEwMTEyMDAwMFoXDTE2MDEwMTEyMDAwMFowETEPMA0G
-A1UEAwwGVGFyZ2V0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxwKJ
-GAm8n5yaQTWpX/fCIj6yOf66Vx2VLt1lI0XOM3eZ3fHXaQv7pw6JmAJ6lFh7YeYQ
-mGkaCSufczrYcBhk4oqFh8Vp80UecNjAXiNspn2PdyOKXXSgC9V/p931IS0Cwg/g
-yPgpIPVeM1gqOMhBpiVmrM/EA8sDJdvmZT29q9r7j7UO2Lo9FCubB2IT1BzqsdV9
-TVQEwBP70d/CNuMAz/pJC0ScBYAZdQIlQT3g5s2H2GPXhD0MOsjs6FgiYi8Y6a1F
-zrimY8JlKWkeIQiNOtqW4IknCcw16fHw2PNhxQU+sdAAPH4lSjbjHbSVNy1ErJ55
-OGfnx6wMcdPRYIZECQIDAQABo4HrMIHoMB0GA1UdDgQWBBTGzH61fHpR7Bw14c08
-p/wGMVPKBjAfBgNVHSMEGDAWgBRIvzRj6OT7h0nyDqAjONK+aj1FPDBABggrBgEF
-BQcBAQQ0MDIwMAYIKwYBBQUHMAKGJGh0dHA6Ly91cmwtZm9yLWFpYS9JbnRlcm1l
-ZGlhdGUyLmNlcjA1BgNVHR8ELjAsMCqgKKAmhiRodHRwOi8vdXJsLWZvci1jcmwv
-SW50ZXJtZWRpYXRlMi5jcmwwDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsG
-AQUFBwMBBggrBgEFBQcDAjANBgkqhkiG9w0BAQsFAAOCAQEAUYz5yMvMFONUzWMa
-8B4Lo25gmWgG/uaX9Wjn2HrhsXhIPgNX5IRaJAhHn/tzGn92ZkBdrC/08J6xIbAV
-X9FoSrb+hCMFUX3TIpWB0HaHKZwk6D/gQaC7V5YdfpItIrOYZ0yHXkL1yQj7uQUl
-c7jwmkVilsZItv6sbEKknkGq/VWGjk+FnrcmdeN5KO0JjWM1tVV4E0ZDFz3oEsjD
-xi+I+c61369tcG9r9h7/GkSEtlF6sXxPtHoZg0yFuNDnZS4O4u2SM8T5zTV4ltaO
-BiwXGA6/vvDFf9OFcWKUg9gbUcR3N9Nq/UO0VET++doBPlnUe6QmMuS6mr/zK2xx
-0h4sxA==
------END CERTIFICATE-----
-
-Certificate:
-    Data:
-        Version: 3 (0x2)
-        Serial Number: 1 (0x1)
-    Signature Algorithm: sha256WithRSAEncryption
-        Issuer: CN=Intermediate1
-        Validity
-            Not Before: Jan  1 12:00:00 2015 GMT
-            Not After : Jan  1 12:00:00 2016 GMT
-        Subject: CN=Intermediate2
-        Subject Public Key Info:
-            Public Key Algorithm: rsaEncryption
-                Public-Key: (2048 bit)
-                Modulus:
-                    00:9b:46:28:e2:70:56:b6:e1:f2:57:56:40:07:c9:
-                    66:0f:15:6f:6a:e9:b6:35:a4:f1:a7:17:4c:86:a4:
-                    8c:b7:74:55:0f:f2:cb:b0:43:11:4a:61:e0:9f:ea:
-                    8a:2b:c2:75:0f:b6:50:49:bc:ad:5c:3f:6c:92:4c:
-                    64:dc:50:2e:4d:66:65:eb:ba:9f:17:b7:d1:7e:ff:
-                    5d:d2:41:1f:9d:37:94:97:e1:f6:22:88:26:e2:8a:
-                    65:0f:0d:16:1d:b1:cc:df:e4:b1:78:87:f0:c6:f5:
-                    f0:21:c9:f6:69:34:64:4c:cd:5b:27:ad:ee:0b:3d:
-                    e3:ee:7a:6b:35:21:23:2b:6d:a4:82:c1:e0:37:f1:
-                    46:3c:16:c4:b9:20:29:16:13:14:26:05:41:c7:1e:
-                    21:e9:57:69:a4:3a:7b:b1:fe:92:c4:72:75:f7:bc:
-                    c0:ef:ba:4a:0c:73:37:c1:48:e2:4d:07:c4:14:da:
-                    ae:26:31:39:06:b8:43:6b:ec:2a:df:c8:db:02:af:
-                    24:9a:f2:af:28:98:1b:f3:0f:0d:57:2c:a5:c5:80:
-                    ef:71:41:9f:99:16:20:d1:e2:f7:1d:59:1d:84:e2:
-                    0b:2d:23:f7:2f:05:9e:51:c3:c9:65:84:ba:db:23:
-                    2e:7e:43:b4:c1:eb:12:63:f4:3c:32:2e:18:dd:4c:
-                    ad:8b
-                Exponent: 65537 (0x10001)
-        X509v3 extensions:
-            X509v3 Subject Key Identifier: 
-                48:BF:34:63:E8:E4:FB:87:49:F2:0E:A0:23:38:D2:BE:6A:3D:45:3C
-            X509v3 Authority Key Identifier: 
-                keyid:87:09:94:1A:5F:B2:4B:AE:02:70:24:A9:73:76:78:FD:C0:0E:DC:56
-
-            Authority Information Access: 
-                CA Issuers - URI:http://url-for-aia/Intermediate1.cer
-
-            X509v3 CRL Distribution Points: 
-
-                Full Name:
-                  URI:http://url-for-crl/Intermediate1.crl
-
-            X509v3 Key Usage: critical
-                Certificate Sign, CRL Sign
-            X509v3 Basic Constraints: critical
-                CA:TRUE
-    Signature Algorithm: sha256WithRSAEncryption
-         be:14:33:c3:9f:0f:7b:fa:15:2f:1d:2c:29:52:bc:27:de:b3:
-         7a:f5:d2:e4:3a:51:38:97:8f:90:b2:ce:5d:50:88:77:5c:e8:
-         ae:35:01:68:13:3a:ca:5b:6c:ab:a2:ac:f0:e0:97:37:6f:ff:
-         15:d2:4a:f7:ff:80:7c:64:c8:6a:11:c1:02:f0:4b:0e:97:24:
-         81:7e:90:a4:38:41:af:8d:0b:eb:0b:24:2b:dc:89:4d:32:d1:
-         0b:b1:7c:67:6e:4f:43:bf:e0:63:9b:e8:f4:42:9c:3b:db:7e:
-         ec:f7:64:82:28:73:8c:a0:2e:73:d2:45:dd:3a:ad:6a:6a:5e:
-         ae:6d:f3:cd:be:4a:95:5c:d0:0d:87:54:b6:83:40:ed:14:e5:
-         d7:9d:23:e2:04:d1:6c:a0:2c:0a:ca:42:57:cc:f7:0b:66:4e:
-         35:ef:e3:93:5f:87:e9:0e:64:c7:52:c9:22:16:61:f9:ec:f7:
-         f0:4a:7a:b8:ef:d6:34:d4:6c:3d:b5:a9:6c:0b:f4:19:a8:9b:
-         04:d5:04:9f:fc:04:fe:60:7a:14:70:6f:38:92:80:be:8a:a6:
-         c4:57:a2:40:5d:bc:06:53:83:6d:f3:5f:f5:22:4a:22:10:a2:
-         82:00:87:35:77:07:f1:34:81:2f:86:0b:1a:3b:8f:3d:88:0c:
-         3a:a0:15:25
------BEGIN CERTIFICATE-----
-MIIDiTCCAnGgAwIBAgIBATANBgkqhkiG9w0BAQsFADAYMRYwFAYDVQQDDA1JbnRl
-cm1lZGlhdGUxMB4XDTE1MDEwMTEyMDAwMFoXDTE2MDEwMTEyMDAwMFowGDEWMBQG
-A1UEAwwNSW50ZXJtZWRpYXRlMjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC
-ggEBAJtGKOJwVrbh8ldWQAfJZg8Vb2rptjWk8acXTIakjLd0VQ/yy7BDEUph4J/q
-iivCdQ+2UEm8rVw/bJJMZNxQLk1mZeu6nxe30X7/XdJBH503lJfh9iKIJuKKZQ8N
-Fh2xzN/ksXiH8Mb18CHJ9mk0ZEzNWyet7gs94+56azUhIyttpILB4DfxRjwWxLkg
-KRYTFCYFQcceIelXaaQ6e7H+ksRydfe8wO+6SgxzN8FI4k0HxBTariYxOQa4Q2vs
-Kt/I2wKvJJryryiYG/MPDVcspcWA73FBn5kWINHi9x1ZHYTiCy0j9y8FnlHDyWWE
-utsjLn5DtMHrEmP0PDIuGN1MrYsCAwEAAaOB3TCB2jAdBgNVHQ4EFgQUSL80Y+jk
-+4dJ8g6gIzjSvmo9RTwwHwYDVR0jBBgwFoAUhwmUGl+yS64CcCSpc3Z4/cAO3FYw
-QAYIKwYBBQUHAQEENDAyMDAGCCsGAQUFBzAChiRodHRwOi8vdXJsLWZvci1haWEv
-SW50ZXJtZWRpYXRlMS5jZXIwNQYDVR0fBC4wLDAqoCigJoYkaHR0cDovL3VybC1m
-b3ItY3JsL0ludGVybWVkaWF0ZTEuY3JsMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMB
-Af8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQC+FDPDnw97+hUvHSwpUrwn3rN6
-9dLkOlE4l4+Qss5dUIh3XOiuNQFoEzrKW2yroqzw4Jc3b/8V0kr3/4B8ZMhqEcEC
-8EsOlySBfpCkOEGvjQvrCyQr3IlNMtELsXxnbk9Dv+Bjm+j0Qpw7237s92SCKHOM
-oC5z0kXdOq1qal6ubfPNvkqVXNANh1S2g0DtFOXXnSPiBNFsoCwKykJXzPcLZk41
-7+OTX4fpDmTHUskiFmH57PfwSnq479Y01Gw9talsC/QZqJsE1QSf/AT+YHoUcG84
-koC+iqbEV6JAXbwGU4Nt81/1IkoiEKKCAIc1dwfxNIEvhgsaO489iAw6oBUl
------END CERTIFICATE-----
-
-Certificate:
-    Data:
-        Version: 3 (0x2)
-        Serial Number: 2 (0x2)
-    Signature Algorithm: sha256WithRSAEncryption
-        Issuer: CN=Root
-        Validity
-            Not Before: Jan  1 12:00:00 2015 GMT
-            Not After : Jan  1 12:00:00 2016 GMT
-        Subject: CN=Intermediate1
-        Subject Public Key Info:
-            Public Key Algorithm: rsaEncryption
-                Public-Key: (2048 bit)
-                Modulus:
-                    00:cc:c9:7a:84:dc:8e:0c:4b:60:fc:fb:35:ff:5c:
-                    72:00:1d:25:df:87:50:fa:65:2e:fa:40:a2:c7:9a:
-                    cb:b5:2e:b6:0d:d8:80:6c:54:ef:44:c9:2f:a4:20:
-                    60:07:c7:0a:f9:0f:62:0c:30:9e:ff:9b:3f:a7:35:
-                    6a:ab:a3:56:ca:1b:ea:62:90:0f:ef:e3:29:52:dc:
-                    88:06:a5:65:1f:29:ba:73:11:b5:98:70:dd:88:7f:
-                    83:a6:0b:4c:da:42:92:e6:08:45:da:f4:54:e0:8d:
-                    67:6c:97:0b:fd:8c:13:65:81:6a:1b:49:1b:4e:c7:
-                    de:dc:b5:68:1d:14:57:23:98:33:7b:43:a2:bf:da:
-                    bf:ef:e7:58:43:27:d3:d6:a9:45:d0:8d:e7:d7:48:
-                    b1:dc:f1:00:9b:85:8a:66:3e:20:f3:fc:e1:0f:89:
-                    9f:28:a6:2d:2c:f7:a2:44:e8:47:5a:0a:fa:cd:8e:
-                    40:2a:75:06:6d:ca:38:89:b6:9d:1f:15:d9:42:36:
-                    14:7e:2b:c4:e3:d7:03:a6:cf:4c:cb:34:c0:ce:e9:
-                    ad:05:da:8c:73:91:25:d3:23:3e:70:ab:16:e7:fe:
-                    8b:95:69:f6:4f:98:68:86:04:d6:70:bd:0f:9a:37:
-                    0b:35:b9:ad:18:27:aa:15:b7:08:d0:54:1e:94:af:
-                    ed:f9
-                Exponent: 65537 (0x10001)
-        X509v3 extensions:
-            X509v3 Subject Key Identifier: 
-                87:09:94:1A:5F:B2:4B:AE:02:70:24:A9:73:76:78:FD:C0:0E:DC:56
-            X509v3 Authority Key Identifier: 
-                keyid:0F:0F:6A:FA:74:D2:B6:49:DD:B5:2E:25:97:97:E3:E0:51:F7:1E:2A
-
-            Authority Information Access: 
-                CA Issuers - URI:http://url-for-aia/Root.cer
-
-            X509v3 CRL Distribution Points: 
-
-                Full Name:
-                  URI:http://url-for-crl/Root.crl
-
-            X509v3 Key Usage: critical
-                Certificate Sign, CRL Sign
-            X509v3 Basic Constraints: critical
-                CA:TRUE
-    Signature Algorithm: sha256WithRSAEncryption
-         db:01:1b:5b:f9:4f:9a:03:74:cb:a6:84:16:ab:ba:bb:63:7d:
-         22:94:f5:70:03:dd:6d:fa:53:f2:23:c6:7b:a2:d2:62:96:ba:
-         5a:95:f8:c8:a0:1f:f5:37:01:ce:a5:56:ef:19:5e:da:30:3a:
-         81:ac:13:37:74:dd:5d:1b:b0:4a:cc:c0:b5:8f:d0:ce:6e:06:
-         2b:74:c0:c4:70:fa:3b:90:d1:7b:c3:10:b3:8f:e1:69:42:ec:
-         82:5c:09:ad:5b:0e:8d:4a:18:83:ec:f8:82:dc:e9:d8:5c:fa:
-         cc:f9:c9:6d:cc:b4:db:b0:d8:99:b9:fb:30:d2:28:a0:46:b8:
-         77:fc:c2:12:eb:75:52:20:81:85:da:a6:ed:71:49:db:5c:4f:
-         a5:31:0f:59:c2:73:8d:da:10:be:ec:0c:4a:f8:d4:35:c7:13:
-         5c:eb:f3:c8:42:19:d7:22:07:13:ac:71:46:9f:12:73:9e:0d:
-         2e:c6:75:2d:fc:00:b4:99:13:e4:35:be:7f:7a:2f:2c:7b:44:
-         57:3f:0f:2b:bb:06:25:45:94:2c:2d:af:c0:9f:e2:29:14:61:
-         53:9d:ac:89:d2:04:c6:b9:52:a0:21:70:6f:b1:c0:9c:c9:6d:
-         07:ab:14:d3:d3:49:05:bb:1e:4d:47:b6:62:6d:a2:35:3c:47:
-         3e:32:1c:11
------BEGIN CERTIFICATE-----
-MIIDbjCCAlagAwIBAgIBAjANBgkqhkiG9w0BAQsFADAPMQ0wCwYDVQQDDARSb290
-MB4XDTE1MDEwMTEyMDAwMFoXDTE2MDEwMTEyMDAwMFowGDEWMBQGA1UEAwwNSW50
-ZXJtZWRpYXRlMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMzJeoTc
-jgxLYPz7Nf9ccgAdJd+HUPplLvpAoseay7Uutg3YgGxU70TJL6QgYAfHCvkPYgww
-nv+bP6c1aqujVsob6mKQD+/jKVLciAalZR8punMRtZhw3Yh/g6YLTNpCkuYIRdr0
-VOCNZ2yXC/2ME2WBahtJG07H3ty1aB0UVyOYM3tDor/av+/nWEMn09apRdCN59dI
-sdzxAJuFimY+IPP84Q+JnyimLSz3okToR1oK+s2OQCp1Bm3KOIm2nR8V2UI2FH4r
-xOPXA6bPTMs0wM7prQXajHORJdMjPnCrFuf+i5Vp9k+YaIYE1nC9D5o3CzW5rRgn
-qhW3CNBUHpSv7fkCAwEAAaOByzCByDAdBgNVHQ4EFgQUhwmUGl+yS64CcCSpc3Z4
-/cAO3FYwHwYDVR0jBBgwFoAUDw9q+nTStkndtS4ll5fj4FH3HiowNwYIKwYBBQUH
-AQEEKzApMCcGCCsGAQUFBzAChhtodHRwOi8vdXJsLWZvci1haWEvUm9vdC5jZXIw
-LAYDVR0fBCUwIzAhoB+gHYYbaHR0cDovL3VybC1mb3ItY3JsL1Jvb3QuY3JsMA4G
-A1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IB
-AQDbARtb+U+aA3TLpoQWq7q7Y30ilPVwA91t+lPyI8Z7otJilrpalfjIoB/1NwHO
-pVbvGV7aMDqBrBM3dN1dG7BKzMC1j9DObgYrdMDEcPo7kNF7wxCzj+FpQuyCXAmt
-Ww6NShiD7PiC3OnYXPrM+cltzLTbsNiZufsw0iigRrh3/MIS63VSIIGF2qbtcUnb
-XE+lMQ9ZwnON2hC+7AxK+NQ1xxNc6/PIQhnXIgcTrHFGnxJzng0uxnUt/AC0mRPk
-Nb5/ei8se0RXPw8ruwYlRZQsLa/An+IpFGFTnayJ0gTGuVKgIXBvscCcyW0HqxTT
-00kFux5NR7ZibaI1PEc+MhwR
------END CERTIFICATE-----
-
-Certificate:
-    Data:
-        Version: 3 (0x2)
-        Serial Number: 1 (0x1)
-    Signature Algorithm: sha256WithRSAEncryption
-        Issuer: CN=Root
-        Validity
-            Not Before: Jan  1 12:00:00 2015 GMT
-            Not After : Jan  1 12:00:00 2016 GMT
-        Subject: CN=Root
-        Subject Public Key Info:
-            Public Key Algorithm: rsaEncryption
-                Public-Key: (2048 bit)
-                Modulus:
-                    00:f1:6d:df:8a:62:88:18:33:0e:b6:95:4d:a7:53:
-                    82:ad:ec:81:5e:c7:e1:d8:b9:38:a5:eb:3f:8e:d8:
-                    97:bb:ed:29:77:b2:d6:ac:34:96:a0:cd:a2:33:d8:
-                    88:49:88:6b:ce:aa:91:02:b9:33:51:52:d5:e7:b6:
-                    ef:55:d3:d6:6a:f3:3f:87:d9:1b:60:b2:e3:b3:78:
-                    be:e2:8c:b4:30:f3:60:75:eb:30:c5:71:51:49:90:
-                    b9:99:5c:2c:78:9e:72:0d:02:3f:16:bb:6d:f7:f7:
-                    9e:07:d2:b4:47:85:ea:b0:92:3e:b6:8a:41:71:6a:
-                    4c:f6:ba:6d:60:4f:7c:29:b3:82:1d:04:07:76:32:
-                    bc:25:38:2c:e4:be:29:2d:80:c3:20:62:a3:65:31:
-                    f2:14:93:2d:92:9d:54:8b:96:4e:4d:df:4e:f7:80:
-                    b2:e7:88:fd:06:32:30:3e:64:9d:e4:96:e0:0e:3a:
-                    ea:c3:4f:ca:df:4a:46:22:1f:df:92:bd:24:82:59:
-                    20:36:95:62:82:92:2e:d9:d7:a7:93:1e:a7:75:fb:
-                    a9:22:a6:98:4d:e6:f2:b4:12:d0:76:0c:b8:a2:fc:
-                    c3:5e:e7:df:fb:c0:b5:90:5b:a8:1a:1d:33:ae:ab:
-                    e3:25:3d:87:b5:58:c6:bc:e4:fa:db:e9:50:67:3f:
-                    ad:ad
-                Exponent: 65537 (0x10001)
-        X509v3 extensions:
-            X509v3 Subject Key Identifier: 
-                0F:0F:6A:FA:74:D2:B6:49:DD:B5:2E:25:97:97:E3:E0:51:F7:1E:2A
-            X509v3 Authority Key Identifier: 
-                keyid:0F:0F:6A:FA:74:D2:B6:49:DD:B5:2E:25:97:97:E3:E0:51:F7:1E:2A
-
-            Authority Information Access: 
-                CA Issuers - URI:http://url-for-aia/Root.cer
-
-            X509v3 CRL Distribution Points: 
-
-                Full Name:
-                  URI:http://url-for-crl/Root.crl
-
-            X509v3 Key Usage: critical
-                Certificate Sign, CRL Sign
-            X509v3 Basic Constraints: critical
-                CA:TRUE, pathlen:1
-    Signature Algorithm: sha256WithRSAEncryption
-         38:cf:2c:95:d8:1b:14:a6:43:13:ed:9b:a2:9f:54:eb:33:64:
-         2b:a6:c0:04:81:23:52:27:f1:17:12:a1:9a:f0:d2:77:dd:06:
-         95:90:a5:bb:be:e1:98:f7:f0:11:a3:fc:71:80:c7:d0:72:f3:
-         d4:dc:3f:36:51:52:66:5f:92:a8:fa:ca:4f:8f:8f:2a:3d:93:
-         12:8a:4f:94:69:99:6f:60:0b:86:81:91:00:98:cd:00:37:a7:
-         c7:60:e9:f4:07:85:5b:db:35:9b:61:bb:b6:aa:ca:a2:af:1c:
-         a4:e2:f8:0d:2b:84:2a:9f:7f:53:b6:25:31:ff:31:b8:e6:03:
-         3c:f3:a1:5c:1a:51:4b:3e:d6:82:c9:24:d2:e8:3c:06:6b:b7:
-         f9:f5:77:55:67:fd:75:93:1a:d4:07:5d:6c:7c:6a:ed:12:9c:
-         b5:d6:f2:df:0c:39:a9:05:b9:11:b9:ca:21:31:26:5c:63:ac:
-         c3:bb:a7:e7:87:82:80:10:3a:32:fb:3a:9a:a8:0d:cf:af:94:
-         a4:a2:8a:0e:1c:1d:89:05:82:53:b6:86:1d:80:b4:00:de:31:
-         f1:20:4e:77:65:16:28:70:95:78:6b:d3:2e:e5:30:40:32:d2:
-         f6:b6:5c:30:de:07:70:5f:87:6b:51:31:85:4b:cf:8c:d9:0e:
-         01:9a:12:6c
------BEGIN TRUST_ANCHOR_UNCONSTRAINED-----
-MIIDaDCCAlCgAwIBAgIBATANBgkqhkiG9w0BAQsFADAPMQ0wCwYDVQQDDARSb290
-MB4XDTE1MDEwMTEyMDAwMFoXDTE2MDEwMTEyMDAwMFowDzENMAsGA1UEAwwEUm9v
-dDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAPFt34piiBgzDraVTadT
-gq3sgV7H4di5OKXrP47Yl7vtKXey1qw0lqDNojPYiEmIa86qkQK5M1FS1ee271XT
-1mrzP4fZG2Cy47N4vuKMtDDzYHXrMMVxUUmQuZlcLHiecg0CPxa7bff3ngfStEeF
-6rCSPraKQXFqTPa6bWBPfCmzgh0EB3YyvCU4LOS+KS2AwyBio2Ux8hSTLZKdVIuW
-Tk3fTveAsueI/QYyMD5kneSW4A466sNPyt9KRiIf35K9JIJZIDaVYoKSLtnXp5Me
-p3X7qSKmmE3m8rQS0HYMuKL8w17n3/vAtZBbqBodM66r4yU9h7VYxrzk+tvpUGc/
-ra0CAwEAAaOBzjCByzAdBgNVHQ4EFgQUDw9q+nTStkndtS4ll5fj4FH3HiowHwYD
-VR0jBBgwFoAUDw9q+nTStkndtS4ll5fj4FH3HiowNwYIKwYBBQUHAQEEKzApMCcG
-CCsGAQUFBzAChhtodHRwOi8vdXJsLWZvci1haWEvUm9vdC5jZXIwLAYDVR0fBCUw
-IzAhoB+gHYYbaHR0cDovL3VybC1mb3ItY3JsL1Jvb3QuY3JsMA4GA1UdDwEB/wQE
-AwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMA0GCSqGSIb3DQEBCwUAA4IBAQA4zyyV
-2BsUpkMT7Zuin1TrM2QrpsAEgSNSJ/EXEqGa8NJ33QaVkKW7vuGY9/ARo/xxgMfQ
-cvPU3D82UVJmX5Ko+spPj48qPZMSik+UaZlvYAuGgZEAmM0AN6fHYOn0B4Vb2zWb
-Ybu2qsqirxyk4vgNK4Qqn39TtiUx/zG45gM886FcGlFLPtaCySTS6DwGa7f59XdV
-Z/11kxrUB11sfGrtEpy11vLfDDmpBbkRucohMSZcY6zDu6fnh4KAEDoy+zqaqA3P
-r5SkoooOHB2JBYJTtoYdgLQA3jHxIE53ZRYocJV4a9Mu5TBAMtL2tlww3gdwX4dr
-UTGFS8+M2Q4BmhJs
------END TRUST_ANCHOR_UNCONSTRAINED-----
-
------BEGIN TIME-----
-MTUwMzAyMTIwMDAwWg==
------END TIME-----
-
------BEGIN VERIFY_RESULT-----
-U1VDQ0VTUw==
------END VERIFY_RESULT-----