Support trust anchor constraints, by specifying them as a certificate.

net/data/verify_certificate_chain_unittest/violates-pathlen-1-constrained-root.pem

Index: net/data/verify_certificate_chain_unittest/violates-pathlen-1-constrained-root.pem
diff --git a/net/data/verify_certificate_chain_unittest/violates-pathlen-1-constrained-root.pem b/net/data/verify_certificate_chain_unittest/violates-pathlen-1-constrained-root.pem
new file mode 100644
index 0000000000000000000000000000000000000000..df74ba28a1201e005c2cc84cb64dcd638c067868
--- /dev/null
+++ b/net/data/verify_certificate_chain_unittest/violates-pathlen-1-constrained-root.pem
@@ -0,0 +1,370 @@
+[Created by: generate-violates-pathlen-1-constrained-root.py]
+
+Certificate chain with 2 intermediates and one end entity certificate. The
+root certificate has a pathlen:1 restriction, and constraints are enforced
+on this trust anchor making it an invalid chain.
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 1 (0x1)
+    Signature Algorithm: sha256WithRSAEncryption
+        Issuer: CN=Intermediate2
+        Validity
+            Not Before: Jan  1 12:00:00 2015 GMT
+            Not After : Jan  1 12:00:00 2016 GMT
+        Subject: CN=Target
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:b3:a3:d6:09:6c:d5:c4:2b:7b:c6:2d:9f:d3:91:
+                    39:f1:53:f0:93:49:96:8d:97:0c:d5:36:1d:7c:86:
+                    4f:2c:12:2c:5a:c9:32:b8:ff:21:71:f4:47:06:6f:
+                    30:08:2e:76:71:04:ec:f1:9d:f1:b0:59:36:03:64:
+                    1f:35:b0:a4:e6:ef:e6:aa:94:4e:d8:6e:aa:9f:92:
+                    63:a6:9a:42:47:fc:30:99:a5:c5:90:11:bb:b5:9d:
+                    b1:b0:ec:12:c2:1f:29:42:57:d7:90:97:78:5f:5c:
+                    28:ab:49:7f:24:f3:2a:0f:68:a2:0a:e5:2a:54:8e:
+                    90:04:71:e2:13:9e:52:2e:c7:e6:ff:35:36:e7:01:
+                    d7:2b:7f:5b:54:c0:20:e6:b3:09:16:e7:13:bb:96:
+                    3e:b7:45:3d:8d:5e:3b:6a:fe:c2:cb:5b:0d:bf:ed:
+                    92:98:74:9e:f1:7b:94:71:d0:b1:50:ec:81:06:3d:
+                    12:39:f2:00:d3:60:9c:3c:9c:5a:a1:58:cc:56:b1:
+                    4f:a7:a1:ec:c7:c5:52:70:81:99:99:a4:ef:de:f4:
+                    0d:c1:c5:ff:c6:83:c6:e8:d4:bd:f8:27:f9:86:e0:
+                    3c:d4:7b:31:17:4d:49:c8:ce:c0:27:6a:4f:0a:fb:
+                    79:75:93:47:b0:05:f8:2e:10:f4:0b:39:ce:f6:43:
+                    87:07
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                FD:9F:2A:24:CC:3C:CE:DA:6D:41:F0:3B:79:09:11:71:B2:29:31:17
+            X509v3 Authority Key Identifier: 
+                keyid:4D:F0:7D:C0:A0:7D:84:3E:38:63:E2:76:18:78:25:8C:09:DD:12:36
+
+            Authority Information Access: 
+                CA Issuers - URI:http://url-for-aia/Intermediate2.cer
+
+            X509v3 CRL Distribution Points: 
+
+                Full Name:
+                  URI:http://url-for-crl/Intermediate2.crl
+
+            X509v3 Key Usage: critical
+                Digital Signature, Key Encipherment
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, TLS Web Client Authentication
+    Signature Algorithm: sha256WithRSAEncryption
+         2b:4d:3f:19:05:a2:6b:66:7e:85:21:18:9a:0c:f0:81:cd:f7:
+         81:71:50:38:95:f4:d0:68:d6:e2:02:9b:f3:08:1e:8c:4a:57:
+         b6:2b:e3:57:7c:ca:70:74:48:ee:d6:5f:2e:f7:b5:fc:95:75:
+         fa:c3:1d:5c:e1:aa:dc:85:cc:4c:2f:a7:05:b6:4f:38:a7:50:
+         44:8c:4a:1f:2c:fc:37:f4:96:a9:03:77:65:b0:5d:a4:36:f9:
+         29:ab:6e:1e:64:47:9b:cd:89:45:85:84:d3:4a:0f:97:87:99:
+         83:15:67:cb:42:80:69:8d:17:89:d0:1a:c5:e5:48:60:86:b3:
+         20:2e:9a:40:7b:ec:90:53:fd:b4:6e:6b:d2:82:2b:5a:5c:e4:
+         fe:ee:16:ec:15:20:f8:4d:07:b6:f0:9a:95:6c:08:d4:d0:b2:
+         09:3d:67:40:13:a6:5b:21:5f:03:4b:d7:c5:83:a9:2d:a1:1b:
+         93:c6:5b:6d:36:85:f7:4c:9c:65:33:ab:e1:8f:e1:18:c1:6b:
+         ec:4c:c7:a4:de:8a:b8:a1:66:a3:94:e3:40:5e:8c:cd:42:e5:
+         f2:8a:e0:5b:19:01:5b:ba:74:eb:11:3b:ac:56:04:6b:a7:22:
+         35:9b:ac:3e:da:12:3f:42:39:3d:7e:7d:ac:1e:3c:c6:7b:09:
+         8f:97:f2:f2
+-----BEGIN CERTIFICATE-----
+MIIDkDCCAnigAwIBAgIBATANBgkqhkiG9w0BAQsFADAYMRYwFAYDVQQDDA1JbnRl
+cm1lZGlhdGUyMB4XDTE1MDEwMTEyMDAwMFoXDTE2MDEwMTEyMDAwMFowETEPMA0G
+A1UEAwwGVGFyZ2V0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAs6PW
+CWzVxCt7xi2f05E58VPwk0mWjZcM1TYdfIZPLBIsWskyuP8hcfRHBm8wCC52cQTs
+8Z3xsFk2A2QfNbCk5u/mqpRO2G6qn5JjpppCR/wwmaXFkBG7tZ2xsOwSwh8pQlfX
+kJd4X1woq0l/JPMqD2iiCuUqVI6QBHHiE55SLsfm/zU25wHXK39bVMAg5rMJFucT
+u5Y+t0U9jV47av7Cy1sNv+2SmHSe8XuUcdCxUOyBBj0SOfIA02CcPJxaoVjMVrFP
+p6Hsx8VScIGZmaTv3vQNwcX/xoPG6NS9+Cf5huA81HsxF01JyM7AJ2pPCvt5dZNH
+sAX4LhD0CznO9kOHBwIDAQABo4HrMIHoMB0GA1UdDgQWBBT9nyokzDzO2m1B8Dt5
+CRFxsikxFzAfBgNVHSMEGDAWgBRN8H3AoH2EPjhj4nYYeCWMCd0SNjBABggrBgEF
+BQcBAQQ0MDIwMAYIKwYBBQUHMAKGJGh0dHA6Ly91cmwtZm9yLWFpYS9JbnRlcm1l
+ZGlhdGUyLmNlcjA1BgNVHR8ELjAsMCqgKKAmhiRodHRwOi8vdXJsLWZvci1jcmwv
+SW50ZXJtZWRpYXRlMi5jcmwwDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsG
+AQUFBwMBBggrBgEFBQcDAjANBgkqhkiG9w0BAQsFAAOCAQEAK00/GQWia2Z+hSEY
+mgzwgc33gXFQOJX00GjW4gKb8wgejEpXtivjV3zKcHRI7tZfLve1/JV1+sMdXOGq
+3IXMTC+nBbZPOKdQRIxKHyz8N/SWqQN3ZbBdpDb5KatuHmRHm82JRYWE00oPl4eZ
+gxVny0KAaY0XidAaxeVIYIazIC6aQHvskFP9tG5r0oIrWlzk/u4W7BUg+E0HtvCa
+lWwI1NCyCT1nQBOmWyFfA0vXxYOpLaEbk8ZbbTaF90ycZTOr4Y/hGMFr7EzHpN6K
+uKFmo5TjQF6MzULl8orgWxkBW7p06xE7rFYEa6ciNZusPtoSP0I5PX59rB48xnsJ
+j5fy8g==
+-----END CERTIFICATE-----
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 1 (0x1)
+    Signature Algorithm: sha256WithRSAEncryption
+        Issuer: CN=Intermediate1
+        Validity
+            Not Before: Jan  1 12:00:00 2015 GMT
+            Not After : Jan  1 12:00:00 2016 GMT
+        Subject: CN=Intermediate2
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:c9:f0:db:40:19:44:5e:67:d4:e7:dd:4f:67:12:
+                    71:af:2a:42:76:de:6a:c0:ce:e6:9f:78:4e:90:f9:
+                    62:6a:14:9d:5e:63:3a:55:8e:88:a4:83:34:f6:f1:
+                    35:19:d1:fe:94:61:b6:9a:c6:b0:47:81:95:69:21:
+                    ff:ca:c9:c9:79:4c:ac:ee:f6:08:ba:eb:ae:fe:96:
+                    8a:dc:97:11:c1:2f:8b:55:9f:58:cb:b1:8f:c3:2a:
+                    36:0b:4b:d2:17:36:45:0d:33:64:b0:58:27:45:a1:
+                    71:f1:db:2c:d7:de:6f:6d:f5:bc:38:62:c3:5a:9d:
+                    f5:95:58:1d:ef:c2:00:6a:e5:c2:97:84:f7:ac:cc:
+                    19:18:f0:f8:cb:1a:b0:7b:b4:63:cc:35:5d:8c:cf:
+                    f0:0c:a6:7e:fa:19:96:a9:dd:8a:26:ef:31:e9:38:
+                    44:11:62:ff:30:35:fe:86:2a:5f:52:20:93:2a:a8:
+                    5c:a9:c6:16:08:3e:c1:da:34:4e:83:28:a1:d4:6c:
+                    78:58:06:a0:ef:65:69:4c:19:65:0a:82:98:d4:cf:
+                    56:22:d2:47:b1:82:40:8f:fc:50:5d:52:c5:12:a8:
+                    0f:17:0c:18:3b:ef:9b:8c:3c:da:c4:c2:2d:63:44:
+                    59:08:8e:54:4a:5d:1d:e7:ba:2f:7a:d7:92:40:8d:
+                    f4:9f
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                4D:F0:7D:C0:A0:7D:84:3E:38:63:E2:76:18:78:25:8C:09:DD:12:36
+            X509v3 Authority Key Identifier: 
+                keyid:C5:16:E8:6A:00:06:4F:0B:E0:6E:86:89:50:32:72:E0:22:08:AE:60
+
+            Authority Information Access: 
+                CA Issuers - URI:http://url-for-aia/Intermediate1.cer
+
+            X509v3 CRL Distribution Points: 
+
+                Full Name:
+                  URI:http://url-for-crl/Intermediate1.crl
+
+            X509v3 Key Usage: critical
+                Certificate Sign, CRL Sign
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+    Signature Algorithm: sha256WithRSAEncryption
+         52:00:7b:6d:93:e0:12:f4:bd:3e:1e:67:ac:a2:a2:46:dd:68:
+         7f:41:c5:7e:a4:04:07:d2:5b:1a:d3:26:b7:9d:6a:62:9c:51:
+         a5:19:55:7d:1d:42:4d:88:12:39:21:a5:fe:59:27:94:92:7c:
+         4c:54:f6:85:f7:7d:3b:ac:23:51:63:67:05:66:b3:5e:4e:c2:
+         db:e9:33:e6:5a:7c:08:96:16:b9:33:af:83:02:15:d0:eb:2f:
+         02:98:18:5a:53:ca:f5:ee:a8:3c:95:44:bd:c7:bf:47:f4:7b:
+         22:e5:b2:df:ee:e1:e2:eb:50:89:a9:ad:72:e2:03:74:f7:82:
+         90:2a:6e:36:39:f6:06:95:81:52:56:e1:7e:35:32:43:90:78:
+         57:54:00:fc:df:39:e6:f6:92:d6:57:5d:01:ee:69:a0:fb:8c:
+         df:75:9b:8c:0e:e7:af:27:d4:11:01:c3:9d:56:7b:52:0b:06:
+         57:1f:40:13:12:76:2a:40:b1:97:47:5f:6d:c4:5a:45:99:cd:
+         96:61:ce:52:47:5f:8d:66:14:6d:a2:3c:bb:6e:0f:9c:3c:ba:
+         9e:fb:75:92:32:eb:f3:71:16:d5:c6:84:e4:7d:c5:79:3f:ce:
+         08:57:96:5b:56:c5:28:d5:96:41:f0:bc:a7:72:a1:18:6f:ab:
+         d9:e5:47:93
+-----BEGIN CERTIFICATE-----
+MIIDiTCCAnGgAwIBAgIBATANBgkqhkiG9w0BAQsFADAYMRYwFAYDVQQDDA1JbnRl
+cm1lZGlhdGUxMB4XDTE1MDEwMTEyMDAwMFoXDTE2MDEwMTEyMDAwMFowGDEWMBQG
+A1UEAwwNSW50ZXJtZWRpYXRlMjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC
+ggEBAMnw20AZRF5n1OfdT2cSca8qQnbeasDO5p94TpD5YmoUnV5jOlWOiKSDNPbx
+NRnR/pRhtprGsEeBlWkh/8rJyXlMrO72CLrrrv6WityXEcEvi1WfWMuxj8MqNgtL
+0hc2RQ0zZLBYJ0WhcfHbLNfeb231vDhiw1qd9ZVYHe/CAGrlwpeE96zMGRjw+Msa
+sHu0Y8w1XYzP8AymfvoZlqndiibvMek4RBFi/zA1/oYqX1IgkyqoXKnGFgg+wdo0
+ToMoodRseFgGoO9laUwZZQqCmNTPViLSR7GCQI/8UF1SxRKoDxcMGDvvm4w82sTC
+LWNEWQiOVEpdHee6L3rXkkCN9J8CAwEAAaOB3TCB2jAdBgNVHQ4EFgQUTfB9wKB9
+hD44Y+J2GHgljAndEjYwHwYDVR0jBBgwFoAUxRboagAGTwvgboaJUDJy4CIIrmAw
+QAYIKwYBBQUHAQEENDAyMDAGCCsGAQUFBzAChiRodHRwOi8vdXJsLWZvci1haWEv
+SW50ZXJtZWRpYXRlMS5jZXIwNQYDVR0fBC4wLDAqoCigJoYkaHR0cDovL3VybC1m
+b3ItY3JsL0ludGVybWVkaWF0ZTEuY3JsMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMB
+Af8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQBSAHttk+AS9L0+HmesoqJG3Wh/
+QcV+pAQH0lsa0ya3nWpinFGlGVV9HUJNiBI5IaX+WSeUknxMVPaF9307rCNRY2cF
+ZrNeTsLb6TPmWnwIlha5M6+DAhXQ6y8CmBhaU8r17qg8lUS9x79H9Hsi5bLf7uHi
+61CJqa1y4gN094KQKm42OfYGlYFSVuF+NTJDkHhXVAD83znm9pLWV10B7mmg+4zf
+dZuMDuevJ9QRAcOdVntSCwZXH0ATEnYqQLGXR19txFpFmc2WYc5SR1+NZhRtojy7
+bg+cPLqe+3WSMuvzcRbVxoTkfcV5P84IV5ZbVsUo1ZZB8LyncqEYb6vZ5UeT
+-----END CERTIFICATE-----
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 2 (0x2)
+    Signature Algorithm: sha256WithRSAEncryption
+        Issuer: CN=Root
+        Validity
+            Not Before: Jan  1 12:00:00 2015 GMT
+            Not After : Jan  1 12:00:00 2016 GMT
+        Subject: CN=Intermediate1
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:e9:9a:81:41:08:cf:b0:5d:90:15:7b:33:d8:14:
+                    e0:04:05:c4:86:6c:65:6d:fa:9c:cb:68:e8:d3:3f:
+                    1f:02:00:4c:b0:8d:21:ab:fb:f4:ea:e4:d5:10:84:
+                    73:99:ed:ac:1a:d8:96:66:21:0b:8a:40:56:54:37:
+                    1e:49:b4:96:d8:be:63:8a:b2:5c:16:a1:c6:79:d0:
+                    30:3d:ee:83:da:58:e3:cf:7b:fd:37:d6:29:74:6a:
+                    69:8a:62:9f:1a:6f:22:7b:2b:68:51:b8:af:91:d3:
+                    48:7a:a1:d1:cb:ea:d7:c2:54:f7:09:55:a4:7f:cf:
+                    33:87:43:80:bb:04:2d:be:77:ea:db:e4:59:a6:4b:
+                    c4:9e:d4:6a:54:b6:45:4d:4e:28:c0:13:33:d2:0a:
+                    12:49:4a:d7:e0:60:a7:88:0b:3d:54:61:5a:e1:e5:
+                    f3:56:56:42:f0:3c:4e:65:dc:b9:c3:07:7f:56:da:
+                    4a:45:c4:e4:ba:e7:66:e2:09:e3:4d:84:5d:24:af:
+                    bc:d2:2b:24:39:e3:04:bd:7c:1d:cf:71:5b:60:64:
+                    dc:f3:75:e3:18:44:3b:8f:b1:70:72:20:ab:da:30:
+                    bb:18:0d:d1:ed:fd:e8:87:5c:58:2d:de:11:e6:e8:
+                    0a:99:66:fd:a3:c3:b9:6b:02:ac:07:0c:35:c1:90:
+                    66:2d
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                C5:16:E8:6A:00:06:4F:0B:E0:6E:86:89:50:32:72:E0:22:08:AE:60
+            X509v3 Authority Key Identifier: 
+                keyid:E8:DD:B2:61:D1:FC:02:1F:CD:68:F1:34:9D:6E:55:E7:97:B5:3A:23
+
+            Authority Information Access: 
+                CA Issuers - URI:http://url-for-aia/Root.cer
+
+            X509v3 CRL Distribution Points: 
+
+                Full Name:
+                  URI:http://url-for-crl/Root.crl
+
+            X509v3 Key Usage: critical
+                Certificate Sign, CRL Sign
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+    Signature Algorithm: sha256WithRSAEncryption
+         68:ca:ff:4f:17:59:d1:14:01:ad:bd:21:09:39:d3:de:3f:9e:
+         12:71:16:9c:49:f6:e1:2d:d2:d3:4f:93:d3:60:a0:6f:9e:ac:
+         49:99:a2:2c:ad:fc:29:1a:e1:5a:6e:07:e8:83:67:67:e1:23:
+         c4:01:e2:b5:c3:c1:28:f3:71:3e:49:e7:1e:dc:ee:66:fb:eb:
+         64:3d:5c:2f:e2:1d:fd:55:f6:98:ff:fc:af:82:aa:45:d0:be:
+         89:bd:73:4b:87:fb:a8:9e:c7:03:75:77:7c:d1:8c:50:f0:03:
+         e2:7a:2e:f5:f8:dd:53:33:9f:86:d3:f3:32:83:d2:2a:70:67:
+         ca:8a:f1:df:15:b0:fd:38:bf:67:4e:22:e2:6f:73:6c:a6:b9:
+         27:c9:89:ce:a3:9e:00:7c:82:55:44:d5:e6:2a:3d:1c:80:e1:
+         ef:37:f5:ab:e0:ea:25:b4:45:4c:28:50:2d:cb:ed:bb:6b:1d:
+         06:3e:16:e4:f0:b8:15:16:6e:7a:91:cd:f3:1c:39:2c:ec:d3:
+         7e:0b:e0:de:2a:f1:d5:27:78:a6:9c:3a:3f:b8:cc:b2:f6:9c:
+         8f:f1:9b:ce:c6:67:eb:9f:f5:4b:39:87:89:ef:d2:2f:ba:73:
+         d8:af:cc:90:95:9d:95:e4:1c:a5:fb:3a:85:f6:f8:cc:69:ae:
+         2e:6a:fc:6e
+-----BEGIN CERTIFICATE-----
+MIIDbjCCAlagAwIBAgIBAjANBgkqhkiG9w0BAQsFADAPMQ0wCwYDVQQDDARSb290
+MB4XDTE1MDEwMTEyMDAwMFoXDTE2MDEwMTEyMDAwMFowGDEWMBQGA1UEAwwNSW50
+ZXJtZWRpYXRlMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAOmagUEI
+z7BdkBV7M9gU4AQFxIZsZW36nMto6NM/HwIATLCNIav79Ork1RCEc5ntrBrYlmYh
+C4pAVlQ3Hkm0lti+Y4qyXBahxnnQMD3ug9pY4897/TfWKXRqaYpinxpvInsraFG4
+r5HTSHqh0cvq18JU9wlVpH/PM4dDgLsELb536tvkWaZLxJ7UalS2RU1OKMATM9IK
+EklK1+Bgp4gLPVRhWuHl81ZWQvA8TmXcucMHf1baSkXE5LrnZuIJ402EXSSvvNIr
+JDnjBL18Hc9xW2Bk3PN14xhEO4+xcHIgq9owuxgN0e396IdcWC3eEeboCplm/aPD
+uWsCrAcMNcGQZi0CAwEAAaOByzCByDAdBgNVHQ4EFgQUxRboagAGTwvgboaJUDJy
+4CIIrmAwHwYDVR0jBBgwFoAU6N2yYdH8Ah/NaPE0nW5V55e1OiMwNwYIKwYBBQUH
+AQEEKzApMCcGCCsGAQUFBzAChhtodHRwOi8vdXJsLWZvci1haWEvUm9vdC5jZXIw
+LAYDVR0fBCUwIzAhoB+gHYYbaHR0cDovL3VybC1mb3ItY3JsL1Jvb3QuY3JsMA4G
+A1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IB
+AQBoyv9PF1nRFAGtvSEJOdPeP54ScRacSfbhLdLTT5PTYKBvnqxJmaIsrfwpGuFa
+bgfog2dn4SPEAeK1w8Eo83E+Sece3O5m++tkPVwv4h39VfaY//yvgqpF0L6JvXNL
+h/uonscDdXd80YxQ8APiei71+N1TM5+G0/Myg9IqcGfKivHfFbD9OL9nTiLib3Ns
+prknyYnOo54AfIJVRNXmKj0cgOHvN/Wr4OoltEVMKFAty+27ax0GPhbk8LgVFm56
+kc3zHDks7NN+C+DeKvHVJ3imnDo/uMyy9pyP8ZvOxmfrn/VLOYeJ79IvunPYr8yQ
+lZ2V5Byl+zqF9vjMaa4uavxu
+-----END CERTIFICATE-----
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 1 (0x1)
+    Signature Algorithm: sha256WithRSAEncryption
+        Issuer: CN=Root
+        Validity
+            Not Before: Jan  1 12:00:00 2015 GMT
+            Not After : Jan  1 12:00:00 2016 GMT
+        Subject: CN=Root
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:ca:b8:37:0e:d3:aa:65:77:fd:8d:e5:02:89:2e:
+                    62:d3:50:7d:1b:05:5b:f1:d5:5d:b2:94:57:c2:c2:
+                    70:a5:fa:cb:02:e0:02:c0:d7:de:1b:2d:2d:b0:46:
+                    2e:d8:8e:69:7b:51:a7:cf:47:cf:bb:25:1e:ed:ed:
+                    67:ba:e8:a5:f7:85:59:d7:a2:fb:4f:55:00:22:05:
+                    84:e3:31:20:2b:e0:ff:72:9e:99:de:be:67:48:60:
+                    ac:86:35:3a:da:85:06:5b:92:29:7c:da:50:1c:e0:
+                    34:d8:5e:81:26:18:7e:de:07:20:c2:59:3b:43:f1:
+                    bd:02:29:d4:ae:29:6e:bb:dc:be:48:2c:9a:15:18:
+                    33:86:6f:c3:26:2e:88:46:35:ce:92:b1:c2:a6:96:
+                    cc:2c:e0:60:87:1f:9b:e2:a0:ce:7f:af:53:04:d8:
+                    24:cb:da:19:ca:3b:fe:02:f1:11:05:e7:40:af:2d:
+                    eb:df:c4:53:1e:64:5a:73:b5:93:42:46:64:72:a5:
+                    d9:d4:e0:70:65:f5:89:c3:07:83:17:0d:83:a8:aa:
+                    69:b5:56:57:20:1b:38:49:72:16:fb:a0:b4:d9:55:
+                    32:0a:e7:1c:1f:ec:3d:fc:7a:b9:81:02:d8:9e:57:
+                    cd:97:18:16:6e:de:36:fe:d2:63:73:b3:8a:6e:57:
+                    93:a9
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                E8:DD:B2:61:D1:FC:02:1F:CD:68:F1:34:9D:6E:55:E7:97:B5:3A:23
+            X509v3 Authority Key Identifier: 
+                keyid:E8:DD:B2:61:D1:FC:02:1F:CD:68:F1:34:9D:6E:55:E7:97:B5:3A:23
+
+            Authority Information Access: 
+                CA Issuers - URI:http://url-for-aia/Root.cer
+
+            X509v3 CRL Distribution Points: 
+
+                Full Name:
+                  URI:http://url-for-crl/Root.crl
+
+            X509v3 Key Usage: critical
+                Certificate Sign, CRL Sign
+            X509v3 Basic Constraints: critical
+                CA:TRUE, pathlen:1
+    Signature Algorithm: sha256WithRSAEncryption
+         a5:51:20:51:70:47:97:be:a8:b8:d8:76:64:ac:f1:47:36:3c:
+         4d:c2:d1:b1:23:81:dc:2e:c0:36:d1:83:97:af:94:c3:46:fd:
+         bb:5e:9b:ca:e2:42:06:bb:ff:d4:68:f0:53:7f:96:43:cb:6f:
+         24:09:53:a0:fb:d2:79:10:0f:f9:f8:3d:04:cb:23:40:50:37:
+         5a:29:67:da:8a:b7:30:5b:62:b2:62:ce:70:43:81:29:c1:79:
+         91:c8:b6:80:76:cf:93:45:70:ee:6b:22:a1:69:29:a6:e3:62:
+         d0:3d:27:67:86:26:dc:71:49:e3:1a:98:05:63:26:d8:e5:80:
+         b7:d9:38:db:1b:97:fc:0b:97:1f:5a:59:24:ea:6c:f6:c2:f6:
+         c1:ee:b8:02:48:1a:23:97:1d:3f:24:45:9c:f4:37:6f:ee:73:
+         1b:bf:d3:c1:ed:a1:50:37:48:28:2f:ee:68:bc:d6:a8:35:a5:
+         1c:00:a1:52:29:b5:a4:2a:79:f4:f9:a0:a5:30:6f:3f:01:ca:
+         47:f0:08:8a:3f:3e:a9:bf:3e:4c:ef:e3:c3:ec:35:c5:5b:f3:
+         58:18:80:be:08:e9:c2:77:a6:17:5c:62:3c:77:fe:a6:69:0e:
+         de:ca:96:dd:ed:13:01:ef:20:85:2f:94:a2:7d:30:df:c5:4d:
+         84:e2:4d:1c
+-----BEGIN TRUST_ANCHOR_CONSTRAINED-----
+MIIDaDCCAlCgAwIBAgIBATANBgkqhkiG9w0BAQsFADAPMQ0wCwYDVQQDDARSb290
+MB4XDTE1MDEwMTEyMDAwMFoXDTE2MDEwMTEyMDAwMFowDzENMAsGA1UEAwwEUm9v
+dDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMq4Nw7TqmV3/Y3lAoku
+YtNQfRsFW/HVXbKUV8LCcKX6ywLgAsDX3hstLbBGLtiOaXtRp89Hz7slHu3tZ7ro
+pfeFWdei+09VACIFhOMxICvg/3Kemd6+Z0hgrIY1OtqFBluSKXzaUBzgNNhegSYY
+ft4HIMJZO0PxvQIp1K4pbrvcvkgsmhUYM4ZvwyYuiEY1zpKxwqaWzCzgYIcfm+Kg
+zn+vUwTYJMvaGco7/gLxEQXnQK8t69/EUx5kWnO1k0JGZHKl2dTgcGX1icMHgxcN
+g6iqabVWVyAbOElyFvugtNlVMgrnHB/sPfx6uYEC2J5XzZcYFm7eNv7SY3Ozim5X
+k6kCAwEAAaOBzjCByzAdBgNVHQ4EFgQU6N2yYdH8Ah/NaPE0nW5V55e1OiMwHwYD
+VR0jBBgwFoAU6N2yYdH8Ah/NaPE0nW5V55e1OiMwNwYIKwYBBQUHAQEEKzApMCcG
+CCsGAQUFBzAChhtodHRwOi8vdXJsLWZvci1haWEvUm9vdC5jZXIwLAYDVR0fBCUw
+IzAhoB+gHYYbaHR0cDovL3VybC1mb3ItY3JsL1Jvb3QuY3JsMA4GA1UdDwEB/wQE
+AwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMA0GCSqGSIb3DQEBCwUAA4IBAQClUSBR
+cEeXvqi42HZkrPFHNjxNwtGxI4HcLsA20YOXr5TDRv27XpvK4kIGu//UaPBTf5ZD
+y28kCVOg+9J5EA/5+D0EyyNAUDdaKWfaircwW2KyYs5wQ4EpwXmRyLaAds+TRXDu
+ayKhaSmm42LQPSdnhibccUnjGpgFYybY5YC32TjbG5f8C5cfWlkk6mz2wvbB7rgC
+SBojlx0/JEWc9Ddv7nMbv9PB7aFQN0goL+5ovNaoNaUcAKFSKbWkKnn0+aClMG8/
+AcpH8AiKPz6pvz5M7+PD7DXFW/NYGIC+COnCd6YXXGI8d/6maQ7eypbd7RMB7yCF
+L5SifTDfxU2E4k0c
+-----END TRUST_ANCHOR_CONSTRAINED-----
+
+-----BEGIN TIME-----
+MTUwMzAyMTIwMDAwWg==
+-----END TIME-----
+
+-----BEGIN VERIFY_RESULT-----
+RkFJTA==
+-----END VERIFY_RESULT-----