Record UMA metrics for Must-Staple certificates on private roots

net/data/ssl/scripts/generate-test-certs.sh

 #!/bin/sh
 
 # Copyright 2013 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 # This script generates a set of test (end-entity, intermediate, root)
 # certificates that can be used to test fetching of an intermediate via AIA.
 
 try() {
@@ skipping 353 matching lines @@
 CA_COMMON_NAME="Test Root CA" \
   try openssl ca \
     -batch \
     -extensions user_cert \
     -startdate 160601000000Z \
     -enddate   170703000000Z \
     -in out/post_june_2016.req \
     -out ../certificates/post_june_2016.pem \
     -config ca.cnf
 
+# Includes the TLS feature extension
+try openssl req -x509 -newkey rsa:2048 \
+  -keyout out/tls_feature_extension.key \
+  -out ../certificates/tls_feature_extension.pem \
+  -days 365 \
+  -extensions req_extensions_with_tls_feature \
+  -nodes -config ee.cnf
+
 
 # Regenerate CRLSets
 ## Block a leaf cert directly by SPKI
 try python crlsetutil.py -o ../certificates/crlset_by_leaf_spki.raw \
 <<CRLBYLEAFSPKI
 {
   "BlockedBySPKI": ["../certificates/ok_cert.pem"]
 }
 CRLBYLEAFSPKI
 
@@ skipping 11 matching lines @@
 ## Block a leaf cert by issuer-hash-and-serial. However, this will be issued
 ## from an intermediate CA issued underneath a root.
 try python crlsetutil.py -o ../certificates/crlset_by_intermediate_serial.raw \
 <<CRLSETBYINTERMEDIATESERIAL
 {
   "BlockedByHash": {
     "../certificates/quic_intermediate.crt": [3]
   }
 }
 CRLSETBYINTERMEDIATESERIAL