Add a key purpose parameter to Certificate PathBuilder.

net/data/verify_certificate_chain_unittest/intermediate-restricts-eku-ok.pem

+[Created by: generate-intermediate-restricts-eku-ok.py]
+
+Certificate chain with 1 intermediate and a trusted root. The intermediate
+restricts the EKU to serverAuth, and the target has serverAuth +
+clientAuth. Verification is expected to succeed as this is consistent with
+the requested key purpose.
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 1 (0x1)
+    Signature Algorithm: sha256WithRSAEncryption
+        Issuer: CN=Intermediate
+        Validity
+            Not Before: Jan  1 12:00:00 2015 GMT
+            Not After : Jan  1 12:00:00 2016 GMT
+        Subject: CN=Target
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:c1:ef:92:ab:1a:11:79:16:cb:3b:3e:ea:65:31:
+                    13:6c:1e:1e:93:e1:c2:45:30:ea:92:1f:50:6a:25:
+                    69:be:fc:1d:01:1f:2e:b6:bc:dd:da:6a:f4:05:ca:
+                    3c:29:00:9e:d8:e4:98:0c:12:4e:c7:a6:52:37:9c:
+                    af:03:fd:63:d5:08:1f:3e:d7:70:7a:be:67:bf:6c:
+                    d3:98:3d:66:13:d8:dc:31:e2:ff:ae:57:cf:6a:b8:
+                    4b:2b:fa:4c:52:3a:7b:38:97:73:15:18:2d:87:77:
+                    a5:28:98:a7:98:07:23:cf:66:1c:cb:a5:b6:6f:af:
+                    a1:90:46:da:83:24:9b:8d:f6:aa:b0:1c:6f:2f:97:
+                    32:94:14:5a:e9:51:d5:ad:9f:ad:81:19:fe:01:e9:
+                    a0:cd:22:17:5f:1d:42:6d:64:6e:10:e9:65:57:fa:
+                    09:c4:e4:30:f2:d8:9b:47:13:35:5f:de:8e:e2:87:
+                    95:b8:fb:a3:a1:17:db:46:ee:c6:41:a1:3c:97:3d:
+                    e4:fd:2b:96:0e:e2:ea:73:d9:0e:be:c5:cc:19:de:
+                    3d:60:2c:ed:74:40:f4:25:31:ab:50:1b:95:21:f4:
+                    e3:67:93:6a:29:e6:ed:65:b9:03:34:87:b0:80:4a:
+                    61:55:7c:74:2c:85:bd:63:c4:27:69:87:ed:16:4c:
+                    4e:11
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                49:CD:D1:E5:6F:EE:D5:A2:1C:9C:E7:BE:5B:76:F3:61:6B:59:08:62
+            X509v3 Authority Key Identifier: 
+                keyid:0A:49:B8:DC:BF:7B:98:79:34:56:85:97:28:78:7F:E8:9D:43:F2:C8
+
+            Authority Information Access: 
+                CA Issuers - URI:http://url-for-aia/Intermediate.cer
+
+            X509v3 CRL Distribution Points: 
+
+                Full Name:
+                  URI:http://url-for-crl/Intermediate.crl
+
+            X509v3 Key Usage: critical
+                Digital Signature, Key Encipherment
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, TLS Web Client Authentication
+    Signature Algorithm: sha256WithRSAEncryption
+         1f:6b:cb:ab:9c:a0:94:13:fa:0a:7b:d8:d5:45:7d:f3:67:2d:
+         f5:b4:09:4e:6e:76:c4:fc:ea:87:79:89:95:31:01:30:08:ab:
+         ba:8d:b5:06:5f:5a:ec:82:cd:47:e8:5e:d5:14:2e:97:f4:09:
+         bf:ef:05:80:2e:8d:35:4e:46:58:29:4f:30:1a:32:7b:3c:53:
+         e7:6b:76:0b:ff:99:af:19:80:09:05:4a:5b:cf:80:67:cd:47:
+         be:85:d5:45:8f:53:63:e7:9f:51:51:6e:67:13:d1:cb:eb:ed:
+         b5:64:74:82:cd:59:8c:e1:48:70:0e:f6:78:e5:a5:46:86:b5:
+         04:4c:13:13:9e:3a:cf:88:9e:a0:15:60:d1:17:24:dd:95:50:
+         b0:76:70:99:0a:36:62:bd:c6:5b:72:6a:06:ee:49:f8:f4:71:
+         77:66:c5:38:51:10:00:43:d7:5a:3a:08:19:eb:d1:0c:03:7e:
+         37:9a:f0:ae:33:b2:1c:9a:ff:34:d0:2c:7b:61:61:9d:b3:40:
+         0a:e5:13:bb:8a:4a:b8:4b:67:d3:eb:83:7e:e1:45:8a:b7:f6:
+         f4:e5:3c:bf:d9:c5:18:ca:d8:29:f1:dd:bd:a7:5d:e8:83:43:
+         9a:58:4e:d4:47:67:73:fc:26:76:65:90:9e:c2:46:e4:61:79:
+         82:5b:89:cd
+-----BEGIN CERTIFICATE-----
+MIIDjTCCAnWgAwIBAgIBATANBgkqhkiG9w0BAQsFADAXMRUwEwYDVQQDDAxJbnRl
+cm1lZGlhdGUwHhcNMTUwMTAxMTIwMDAwWhcNMTYwMTAxMTIwMDAwWjARMQ8wDQYD
+VQQDDAZUYXJnZXQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDB75Kr
+GhF5Fss7PuplMRNsHh6T4cJFMOqSH1BqJWm+/B0BHy62vN3aavQFyjwpAJ7Y5JgM
+Ek7HplI3nK8D/WPVCB8+13B6vme/bNOYPWYT2Nwx4v+uV89quEsr+kxSOns4l3MV
+GC2Hd6UomKeYByPPZhzLpbZvr6GQRtqDJJuN9qqwHG8vlzKUFFrpUdWtn62BGf4B
+6aDNIhdfHUJtZG4Q6WVX+gnE5DDy2JtHEzVf3o7ih5W4+6OhF9tG7sZBoTyXPeT9
+K5YO4upz2Q6+xcwZ3j1gLO10QPQlMatQG5Uh9ONnk2op5u1luQM0h7CASmFVfHQs
+hb1jxCdph+0WTE4RAgMBAAGjgekwgeYwHQYDVR0OBBYEFEnN0eVv7tWiHJznvlt2
+82FrWQhiMB8GA1UdIwQYMBaAFApJuNy/e5h5NFaFlyh4f+idQ/LIMD8GCCsGAQUF
+BwEBBDMwMTAvBggrBgEFBQcwAoYjaHR0cDovL3VybC1mb3ItYWlhL0ludGVybWVk
+aWF0ZS5jZXIwNAYDVR0fBC0wKzApoCegJYYjaHR0cDovL3VybC1mb3ItY3JsL0lu
+dGVybWVkaWF0ZS5jcmwwDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUF
+BwMBBggrBgEFBQcDAjANBgkqhkiG9w0BAQsFAAOCAQEAH2vLq5yglBP6CnvY1UV9
+82ct9bQJTm52xPzqh3mJlTEBMAiruo21Bl9a7ILNR+he1RQul/QJv+8FgC6NNU5G
+WClPMBoyezxT52t2C/+ZrxmACQVKW8+AZ81HvoXVRY9TY+efUVFuZxPRy+vttWR0
+gs1ZjOFIcA72eOWlRoa1BEwTE546z4ieoBVg0Rck3ZVQsHZwmQo2Yr3GW3JqBu5J
++PRxd2bFOFEQAEPXWjoIGevRDAN+N5rwrjOyHJr/NNAse2FhnbNACuUTu4pKuEtn
+0+uDfuFFirf29OU8v9nFGMrYKfHdvadd6INDmlhO1Ednc/wmdmWQnsJG5GF5gluJ
+zQ==
+-----END CERTIFICATE-----
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 2 (0x2)
+    Signature Algorithm: sha256WithRSAEncryption
+        Issuer: CN=Root
+        Validity
+            Not Before: Jan  1 12:00:00 2015 GMT
+            Not After : Jan  1 12:00:00 2016 GMT
+        Subject: CN=Intermediate
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:da:87:0b:ce:e5:65:2f:bd:d3:9e:5f:a4:b6:5a:
+                    95:74:36:f7:27:4b:e9:e4:08:6c:0c:8a:ee:c7:aa:
+                    9c:6b:2d:03:ff:4a:b8:50:93:ef:bc:d0:30:09:d8:
+                    bf:f2:02:1d:08:01:d5:4c:2d:a9:c0:5b:43:3d:33:
+                    85:f4:21:c5:39:a8:48:70:06:fa:00:93:f1:4d:31:
+                    13:55:29:66:c8:10:e2:92:03:b1:f4:59:f2:22:b3:
+                    03:10:21:87:02:de:6d:61:28:ed:2c:3d:54:f5:df:
+                    f5:d6:ba:b7:a5:f9:10:e9:35:34:25:ff:a8:b9:54:
+                    ec:ad:96:bb:1c:d5:0d:c6:50:54:a9:5a:76:87:38:
+                    00:10:cd:6b:d9:f8:7f:65:24:05:14:43:9c:4f:a8:
+                    95:53:bd:72:af:14:fa:ba:35:3b:b4:79:6f:90:4b:
+                    0d:0e:70:eb:cb:79:44:6a:4f:dc:85:24:8e:ba:10:
+                    a1:5f:d8:79:a5:9a:18:e5:3e:98:4b:1f:5e:5c:11:
+                    d2:e9:79:52:5f:26:23:1e:5e:30:c6:b2:ce:47:36:
+                    b6:96:c5:88:3c:55:8f:56:97:da:81:a3:84:eb:d8:
+                    01:a3:c2:ae:bd:76:f9:55:3b:19:12:c8:84:b4:12:
+                    3a:fa:d9:4f:e6:9c:48:88:4a:e3:33:1b:56:59:16:
+                    88:93
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                0A:49:B8:DC:BF:7B:98:79:34:56:85:97:28:78:7F:E8:9D:43:F2:C8
+            X509v3 Authority Key Identifier: 
+                keyid:10:E1:A9:CE:4B:F4:D0:BA:5E:A5:9F:12:F7:A2:69:60:B1:86:03:92
+
+            Authority Information Access: 
+                CA Issuers - URI:http://url-for-aia/Root.cer
+
+            X509v3 CRL Distribution Points: 
+
+                Full Name:
+                  URI:http://url-for-crl/Root.crl
+
+            X509v3 Key Usage: critical
+                Certificate Sign, CRL Sign
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication
+    Signature Algorithm: sha256WithRSAEncryption
+         71:2e:02:a8:27:e4:f1:3d:07:0d:73:48:24:e9:34:68:74:c1:
+         fc:b8:4d:28:19:02:87:ac:07:1e:37:6e:dd:65:2a:17:fc:55:
+         78:ae:a5:d4:07:3c:b5:ce:fc:87:35:fa:fc:d5:48:e5:42:60:
+         f8:6d:10:1e:22:45:81:25:ff:ae:a0:97:3d:81:f7:7f:a5:81:
+         4e:75:27:29:2d:46:a4:d8:7b:16:07:e5:40:9c:34:84:cc:71:
+         75:ab:e2:57:21:da:ea:64:3d:26:74:f9:fc:39:cb:fa:72:69:
+         b0:4f:b1:c6:46:94:29:7f:8b:91:81:34:59:3b:55:54:df:3c:
+         ff:81:0c:c8:43:f7:6f:51:b3:b1:66:a7:58:e6:a0:1d:95:be:
+         1e:8e:95:4f:fd:2a:13:a2:0a:6a:36:6a:ba:94:ad:3e:ea:a2:
+         f8:92:b7:0c:6b:0f:d4:21:ee:7b:56:07:b6:04:3d:bd:85:dd:
+         15:3e:ac:31:1a:6b:18:d7:57:51:d4:21:4d:6f:ea:55:ec:7a:
+         a0:55:7b:f3:c7:70:f2:38:b4:05:51:98:21:69:e4:cc:81:02:
+         64:f6:1d:5f:a4:6a:5d:81:80:57:f3:d9:81:78:af:e0:c3:02:
+         4c:d5:82:96:60:db:f1:e4:70:5a:e7:f1:1c:6f:06:fe:37:06:
+         a2:42:9e:37
+-----BEGIN CERTIFICATE-----
+MIIDgjCCAmqgAwIBAgIBAjANBgkqhkiG9w0BAQsFADAPMQ0wCwYDVQQDDARSb290
+MB4XDTE1MDEwMTEyMDAwMFoXDTE2MDEwMTEyMDAwMFowFzEVMBMGA1UEAwwMSW50
+ZXJtZWRpYXRlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2ocLzuVl
+L73Tnl+ktlqVdDb3J0vp5AhsDIrux6qcay0D/0q4UJPvvNAwCdi/8gIdCAHVTC2p
+wFtDPTOF9CHFOahIcAb6AJPxTTETVSlmyBDikgOx9FnyIrMDECGHAt5tYSjtLD1U
+9d/11rq3pfkQ6TU0Jf+ouVTsrZa7HNUNxlBUqVp2hzgAEM1r2fh/ZSQFFEOcT6iV
+U71yrxT6ujU7tHlvkEsNDnDry3lEak/chSSOuhChX9h5pZoY5T6YSx9eXBHS6XlS
+XyYjHl4wxrLORza2lsWIPFWPVpfagaOE69gBo8KuvXb5VTsZEsiEtBI6+tlP5pxI
+iErjMxtWWRaIkwIDAQABo4HgMIHdMB0GA1UdDgQWBBQKSbjcv3uYeTRWhZcoeH/o
+nUPyyDAfBgNVHSMEGDAWgBQQ4anOS/TQul6lnxL3omlgsYYDkjA3BggrBgEFBQcB
+AQQrMCkwJwYIKwYBBQUHMAKGG2h0dHA6Ly91cmwtZm9yLWFpYS9Sb290LmNlcjAs
+BgNVHR8EJTAjMCGgH6AdhhtodHRwOi8vdXJsLWZvci1jcmwvUm9vdC5jcmwwDgYD
+VR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wEwYDVR0lBAwwCgYIKwYBBQUH
+AwEwDQYJKoZIhvcNAQELBQADggEBAHEuAqgn5PE9Bw1zSCTpNGh0wfy4TSgZAoes
+Bx43bt1lKhf8VXiupdQHPLXO/Ic1+vzVSOVCYPhtEB4iRYEl/66glz2B93+lgU51
+JyktRqTYexYH5UCcNITMcXWr4lch2upkPSZ0+fw5y/pyabBPscZGlCl/i5GBNFk7
+VVTfPP+BDMhD929Rs7Fmp1jmoB2Vvh6OlU/9KhOiCmo2arqUrT7qoviStwxrD9Qh
+7ntWB7YEPb2F3RU+rDEaaxjXV1HUIU1v6lXseqBVe/PHcPI4tAVRmCFp5MyBAmT2
+HV+kal2BgFfz2YF4r+DDAkzVgpZg2/HkcFrn8RxvBv43BqJCnjc=
+-----END CERTIFICATE-----
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 1 (0x1)
+    Signature Algorithm: sha256WithRSAEncryption
+        Issuer: CN=Root
+        Validity
+            Not Before: Jan  1 12:00:00 2015 GMT
+            Not After : Jan  1 12:00:00 2016 GMT
+        Subject: CN=Root
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:d9:52:1a:79:3c:9d:11:4e:52:4d:03:54:20:98:
+                    ca:d8:d9:23:6a:23:da:bd:7b:2e:00:f2:dc:9a:3d:
+                    e0:e9:85:68:6f:6d:7e:df:c0:2c:97:46:08:91:c5:
+                    23:0e:63:75:b3:ab:37:c4:4e:f7:00:26:81:38:89:
+                    6c:d7:33:31:c3:bf:92:3a:bf:7e:10:95:2b:03:f9:
+                    e4:a4:28:1a:3d:76:89:13:74:e8:c1:f8:7c:39:9b:
+                    4c:f3:ac:7f:ff:01:36:88:20:19:ab:ee:c3:73:dd:
+                    e4:14:5e:0d:d6:2b:db:25:f6:e5:7d:6d:26:d2:9d:
+                    b4:fe:da:52:b0:02:c0:8e:ab:94:92:6c:c4:3d:59:
+                    1e:91:6c:d6:08:18:36:60:2d:15:44:be:f3:cc:70:
+                    23:a9:f8:c0:ec:06:aa:a3:da:ac:ce:96:5f:45:00:
+                    24:18:9a:48:6b:9a:cd:ab:e4:18:f9:4b:cd:07:fc:
+                    77:f5:7d:4d:78:76:78:76:23:b1:f3:67:bf:42:e6:
+                    71:15:f9:a9:12:ba:8f:9b:c8:90:a5:c0:6e:31:7f:
+                    eb:75:63:72:5e:46:4b:75:c2:16:81:1f:84:d3:0a:
+                    1a:f3:1a:ac:b2:97:ba:31:d0:b1:e5:54:c5:32:37:
+                    83:38:32:ff:04:74:80:8c:47:b5:55:5a:69:e1:ac:
+                    cb:11
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                10:E1:A9:CE:4B:F4:D0:BA:5E:A5:9F:12:F7:A2:69:60:B1:86:03:92
+            X509v3 Authority Key Identifier: 
+                keyid:10:E1:A9:CE:4B:F4:D0:BA:5E:A5:9F:12:F7:A2:69:60:B1:86:03:92
+
+            Authority Information Access: 
+                CA Issuers - URI:http://url-for-aia/Root.cer
+
+            X509v3 CRL Distribution Points: 
+
+                Full Name:
+                  URI:http://url-for-crl/Root.crl
+
+            X509v3 Key Usage: critical
+                Certificate Sign, CRL Sign
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+    Signature Algorithm: sha256WithRSAEncryption
+         99:dc:3d:77:8b:f9:60:6a:fb:43:dc:6a:ab:4c:47:ea:39:e9:
+         04:f5:b1:95:7e:95:e8:21:1b:c9:3f:93:61:67:15:d6:a7:88:
+         f6:42:bb:5c:b1:7f:b9:7a:d2:6a:ea:f2:76:00:ac:ad:d3:02:
+         ab:6e:7e:77:5a:51:04:98:a4:c2:ca:5b:8c:76:c8:c8:6f:03:
+         54:07:c4:b5:cc:64:fe:23:95:2a:d0:6c:c8:bc:87:1c:bd:fd:
+         45:73:7c:ac:34:8c:78:62:f3:b6:4d:f3:dc:14:e7:8b:33:a0:
+         e7:61:04:c4:ba:b3:69:df:bb:1d:e2:8b:3e:ee:37:1c:56:50:
+         3f:d7:7d:f0:aa:de:e1:6f:ff:6a:8e:2f:61:36:0e:20:18:e2:
+         24:fc:d4:09:60:5e:63:f4:4b:69:56:8f:72:84:af:01:d5:b4:
+         55:c2:e0:b9:3e:1f:2d:3c:b5:f9:fd:15:fe:ce:80:0a:03:4f:
+         56:eb:cf:1f:b4:48:f5:64:f1:2f:1b:74:fb:4a:ef:08:54:7c:
+         46:2d:84:03:8e:12:28:32:d0:d7:c0:d7:61:5c:ec:a3:17:81:
+         d5:2b:1d:f7:08:ec:2b:b1:ab:78:d0:d9:4d:eb:7a:8d:4e:05:
+         fa:9a:91:c1:75:94:39:c7:b4:83:59:08:1a:5c:a5:34:0f:1c:
+         49:2b:16:b3
+-----BEGIN TRUST_ANCHOR_UNCONSTRAINED-----
+MIIDZTCCAk2gAwIBAgIBATANBgkqhkiG9w0BAQsFADAPMQ0wCwYDVQQDDARSb290
+MB4XDTE1MDEwMTEyMDAwMFoXDTE2MDEwMTEyMDAwMFowDzENMAsGA1UEAwwEUm9v
+dDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANlSGnk8nRFOUk0DVCCY
+ytjZI2oj2r17LgDy3Jo94OmFaG9tft/ALJdGCJHFIw5jdbOrN8RO9wAmgTiJbNcz
+McO/kjq/fhCVKwP55KQoGj12iRN06MH4fDmbTPOsf/8BNoggGavuw3Pd5BReDdYr
+2yX25X1tJtKdtP7aUrACwI6rlJJsxD1ZHpFs1ggYNmAtFUS+88xwI6n4wOwGqqPa
+rM6WX0UAJBiaSGuazavkGPlLzQf8d/V9TXh2eHYjsfNnv0LmcRX5qRK6j5vIkKXA
+bjF/63Vjcl5GS3XCFoEfhNMKGvMarLKXujHQseVUxTI3gzgy/wR0gIxHtVVaaeGs
+yxECAwEAAaOByzCByDAdBgNVHQ4EFgQUEOGpzkv00LpepZ8S96JpYLGGA5IwHwYD
+VR0jBBgwFoAUEOGpzkv00LpepZ8S96JpYLGGA5IwNwYIKwYBBQUHAQEEKzApMCcG
+CCsGAQUFBzAChhtodHRwOi8vdXJsLWZvci1haWEvUm9vdC5jZXIwLAYDVR0fBCUw
+IzAhoB+gHYYbaHR0cDovL3VybC1mb3ItY3JsL1Jvb3QuY3JsMA4GA1UdDwEB/wQE
+AwIBBjAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQCZ3D13i/lg
+avtD3GqrTEfqOekE9bGVfpXoIRvJP5NhZxXWp4j2QrtcsX+5etJq6vJ2AKyt0wKr
+bn53WlEEmKTCyluMdsjIbwNUB8S1zGT+I5Uq0GzIvIccvf1Fc3ysNIx4YvO2TfPc
+FOeLM6DnYQTEurNp37sd4os+7jccVlA/133wqt7hb/9qji9hNg4gGOIk/NQJYF5j
+9EtpVo9yhK8B1bRVwuC5Ph8tPLX5/RX+zoAKA09W688ftEj1ZPEvG3T7Su8IVHxG
+LYQDjhIoMtDXwNdhXOyjF4HVKx33COwrsat40NlN63qNTgX6mpHBdZQ5x7SDWQga
+XKU0DxxJKxaz
+-----END TRUST_ANCHOR_UNCONSTRAINED-----
+
+150302120000Z
+-----BEGIN TIME-----
+MTUwMzAyMTIwMDAwWg==
+-----END TIME-----
+
+SUCCESS
+-----BEGIN VERIFY_RESULT-----
+U1VDQ0VTUw==
+-----END VERIFY_RESULT-----
+
+serverAuth
+-----BEGIN KEY_PURPOSE-----
+c2VydmVyQXV0aA==
+-----END KEY_PURPOSE-----