*WIP* Mac Unittest for client cert selection with intermediate certs

net/data/ssl/certificates/README

 This directory contains various certificates for use with SSL-related
 unit tests.
 
 ===== Real-world certificates that need manual updating
 - google.binary.p7b
 - google.chain.pem
 - google.pem_cert.p7b
 - google.pem_pkcs7.p7b
 - google.pkcs7.p7b
 - google.single.der
@@ skipping 233 matching lines @@
      - each .pk8 file contains the same key as the corresponding .key file
        as PKCS#8 PrivateKeyInfo in DER encoding.
      - client_3.pem is nearly identical to client_2.pem, except it is used
        to test wifi EAP-TLS authentication so it uses a different set
        of X509v3 extensions.  Specifically it includes two Subject
        Alternative Name fields recognized by Chrome OS.
      - client_4.pem is similar to client_2.pem but is a P-256 ECDSA key rather
        than RSA.
      - client_root_ca.pem is the CA certificate which signed client_*_ca.pem.
 
+===== From net/data/ssl/scripts/generate-client-certificates-keychains.sh
+- client_1.keychain: An OSX Keychain containing the generated
+  certificate & private key "client_1.pem" and "client_1.key".
+- client_2.keychain: An OSX Keychain containing the generated
+  certificate client_1_ca.pem.
+
 ===== From net/data/ssl/scripts/generate-bad-eku-certs.sh
 - eku-test-root.pem
 - non-crit-codeSigning-chain.pem
 - crit-codeSigning-chain.pem
      Two code-signing certificates (eKU: codeSigning; eKU: critical,
      codeSigning) which we use to test that clients are making sure that web
      server certs are checked for correct eKU fields (when an eKU field is
      present). Since codeSigning is not valid for web server auth, the checks
      should fail.
 
@@ skipping 32 matching lines @@
      aia-cert.pem has a caIssuers that points to "aia-test.invalid" as the URL
      containing the intermediate, which can be served via a URLRequestFilter.
      aia-intermediate.der is stored in DER form for convenience, since that is
      the form expected of certificates discovered via AIA.
 
 ===== From net/data/ssl/scripts/generate-self-signed-certs.sh
  - self-signed-invalid-name.pem
  - self-signed-invalid-sig.pem
      Two "self-signed" certificates with mismatched names or an invalid
      signature, respectively.