Add a key purpose parameter to Certificate PathBuilder.

net/data/verify_certificate_chain_unittest/target-restricts-eku-fail.pem

+[Created by: generate-target-has-wrong-eku.py]
+
+Certificate chain with 1 intermediate and a trusted root. The target
+certificate has only clientAuth EKU, so is expected to fail when verifying for
+serverAuth.
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 1 (0x1)
+    Signature Algorithm: sha256WithRSAEncryption
+        Issuer: CN=Intermediate
+        Validity
+            Not Before: Jan  1 12:00:00 2015 GMT
+            Not After : Jan  1 12:00:00 2016 GMT
+        Subject: CN=Target
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:bd:3a:d0:87:ed:fc:60:1d:8a:e5:b2:b7:bb:bf:
+                    2a:5a:11:89:a1:f7:7f:67:37:25:54:04:f4:5f:9c:
+                    f4:e6:db:93:81:72:c4:53:27:a1:ef:68:f6:2c:d6:
+                    a5:52:e7:f8:7c:96:01:8a:91:ff:b9:6a:4a:f5:a2:
+                    cf:e2:46:31:2f:c2:93:32:6f:89:c4:fe:31:c7:92:
+                    f9:05:48:8f:6c:0d:10:10:32:51:f7:bd:b8:4f:54:
+                    9e:59:b2:9e:d7:9e:73:1c:9f:36:43:73:5b:fe:1a:
+                    17:ce:cf:5d:76:59:08:54:95:d5:9d:95:eb:27:5f:
+                    7e:9a:a5:d3:c3:a4:35:b6:e3:fe:64:c2:84:db:e7:
+                    54:61:4c:e3:21:7d:0e:e9:bb:1f:f9:75:4b:83:66:
+                    3c:da:9c:55:4c:7a:32:e4:6b:79:c1:c1:7d:3f:e2:
+                    31:c4:89:ee:b9:0f:82:8a:9d:bf:21:8f:e6:b0:c0:
+                    43:b1:a8:75:6f:b9:49:1c:7f:8f:84:83:b2:90:b5:
+                    56:fa:59:41:f8:21:ad:90:5b:2e:64:33:16:56:cd:
+                    67:b5:a6:7b:0e:f5:ba:c6:38:54:c1:ae:bc:10:f2:
+                    b0:51:4b:19:c3:b9:43:2b:6f:df:f9:f4:6d:47:ad:
+                    c5:38:54:d9:c0:d0:78:f6:46:bb:1f:ea:1a:c1:b5:
+                    58:ad
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                03:84:55:9F:48:62:78:19:FF:56:17:80:54:1A:AE:D8:EF:06:F6:A7
+            X509v3 Authority Key Identifier: 
+                keyid:D2:6A:CE:59:BB:01:16:D7:54:F7:2B:1E:94:6E:8A:C6:41:62:47:81
+
+            Authority Information Access: 
+                CA Issuers - URI:http://url-for-aia/Intermediate.cer
+
+            X509v3 CRL Distribution Points: 
+
+                Full Name:
+                  URI:http://url-for-crl/Intermediate.crl
+
+            X509v3 Key Usage: critical
+                Digital Signature, Key Encipherment
+            X509v3 Extended Key Usage: 
+                TLS Web Client Authentication
+    Signature Algorithm: sha256WithRSAEncryption
+         2c:75:f7:da:48:8d:e0:d0:77:9e:95:85:12:4d:b6:db:1a:14:
+         d0:a7:e6:8e:e9:d7:23:fc:43:1b:be:74:b5:d6:b4:53:15:49:
+         39:a2:16:0f:2d:cc:6c:64:d2:36:79:df:cf:8b:be:ab:c1:7a:
+         e7:8c:26:17:d6:ba:16:8c:10:a9:9b:1a:85:fc:ee:8e:63:4a:
+         d9:77:51:90:91:19:d2:e8:62:ab:89:5b:ea:bc:98:66:8c:78:
+         25:34:d9:9a:50:16:89:4b:22:73:ad:8f:bf:7e:04:75:05:cf:
+         38:b2:e4:c9:fe:ad:47:1e:47:6e:1d:84:88:87:5a:42:00:6b:
+         ed:d0:f8:4d:d8:b8:26:b9:54:88:51:df:42:66:0a:25:71:58:
+         bf:4e:78:8c:ca:fc:7e:b2:6f:f7:5a:47:b0:33:54:0f:c6:fb:
+         ca:fc:07:f1:40:fb:44:1e:77:97:bd:71:81:b0:0b:32:4c:a4:
+         21:06:5d:41:9e:6f:ef:7b:08:e2:93:b2:e8:aa:1f:e7:da:37:
+         23:7c:7a:45:d4:90:2f:db:1a:46:db:24:3c:90:f6:21:77:1e:
+         f7:39:e9:9f:47:db:51:30:08:6d:ca:2c:72:f5:33:61:ad:1d:
+         7e:bb:ed:cf:34:18:59:7c:e0:d6:92:20:3a:85:a6:67:81:ef:
+         a0:7a:89:e5
+-----BEGIN CERTIFICATE-----
+MIIDgzCCAmugAwIBAgIBATANBgkqhkiG9w0BAQsFADAXMRUwEwYDVQQDDAxJbnRl
+cm1lZGlhdGUwHhcNMTUwMTAxMTIwMDAwWhcNMTYwMTAxMTIwMDAwWjARMQ8wDQYD
+VQQDDAZUYXJnZXQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC9OtCH
+7fxgHYrlsre7vypaEYmh939nNyVUBPRfnPTm25OBcsRTJ6HvaPYs1qVS5/h8lgGK
+kf+5akr1os/iRjEvwpMyb4nE/jHHkvkFSI9sDRAQMlH3vbhPVJ5Zsp7XnnMcnzZD
+c1v+GhfOz112WQhUldWdlesnX36apdPDpDW24/5kwoTb51RhTOMhfQ7pux/5dUuD
+ZjzanFVMejLka3nBwX0/4jHEie65D4KKnb8hj+awwEOxqHVvuUkcf4+Eg7KQtVb6
+WUH4Ia2QWy5kMxZWzWe1pnsO9brGOFTBrrwQ8rBRSxnDuUMrb9/59G1HrcU4VNnA
+0Hj2Rrsf6hrBtVitAgMBAAGjgd8wgdwwHQYDVR0OBBYEFAOEVZ9IYngZ/1YXgFQa
+rtjvBvanMB8GA1UdIwQYMBaAFNJqzlm7ARbXVPcrHpRuisZBYkeBMD8GCCsGAQUF
+BwEBBDMwMTAvBggrBgEFBQcwAoYjaHR0cDovL3VybC1mb3ItYWlhL0ludGVybWVk
+aWF0ZS5jZXIwNAYDVR0fBC0wKzApoCegJYYjaHR0cDovL3VybC1mb3ItY3JsL0lu
+dGVybWVkaWF0ZS5jcmwwDgYDVR0PAQH/BAQDAgWgMBMGA1UdJQQMMAoGCCsGAQUF
+BwMCMA0GCSqGSIb3DQEBCwUAA4IBAQAsdffaSI3g0HeelYUSTbbbGhTQp+aO6dcj
+/EMbvnS11rRTFUk5ohYPLcxsZNI2ed/Pi76rwXrnjCYX1roWjBCpmxqF/O6OY0rZ
+d1GQkRnS6GKriVvqvJhmjHglNNmaUBaJSyJzrY+/fgR1Bc84suTJ/q1HHkduHYSI
+h1pCAGvt0PhN2LgmuVSIUd9CZgolcVi/TniMyvx+sm/3WkewM1QPxvvK/AfxQPtE
+HneXvXGBsAsyTKQhBl1Bnm/vewjik7Loqh/n2jcjfHpF1JAv2xpG2yQ8kPYhdx73
+OemfR9tRMAhtyixy9TNhrR1+u+3PNBhZfODWkiA6haZnge+geonl
+-----END CERTIFICATE-----
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 2 (0x2)
+    Signature Algorithm: sha256WithRSAEncryption
+        Issuer: CN=Root
+        Validity
+            Not Before: Jan  1 12:00:00 2015 GMT
+            Not After : Jan  1 12:00:00 2016 GMT
+        Subject: CN=Intermediate
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:cb:6a:e2:84:69:85:60:c0:31:5b:bb:f8:4e:77:
+                    9f:35:a9:b3:ff:05:9f:cc:02:d8:15:e1:68:4d:a3:
+                    75:88:dc:f7:8a:9e:21:0d:d8:0b:cb:3e:4d:96:75:
+                    3b:ab:af:b0:97:44:f3:7b:d1:74:60:fa:d9:46:82:
+                    17:54:aa:f5:3c:e0:45:74:1d:ab:d9:13:78:59:04:
+                    3a:4c:59:44:d2:32:8f:0e:df:59:1e:7b:65:a5:fa:
+                    61:33:d3:0a:71:6c:13:c3:1d:33:7a:80:5b:35:ff:
+                    24:d7:ad:09:0e:c3:9c:b7:28:f5:88:98:3b:d4:b0:
+                    de:6a:80:2b:ac:25:f7:62:e3:c2:dc:86:ac:14:4d:
+                    87:0f:19:f3:5e:c0:19:b2:a8:2f:51:a0:56:55:ac:
+                    cd:4b:8c:95:7f:6c:2d:42:d2:b5:47:87:ba:6c:70:
+                    11:d3:ea:9f:6f:08:c1:91:e1:6d:68:7f:3a:b2:d9:
+                    bf:f0:e7:50:a7:84:3b:1b:5c:92:f9:d7:36:1c:c0:
+                    90:50:c0:74:d8:23:ab:9e:3a:73:e2:7f:12:28:02:
+                    c9:2c:5f:a0:e6:0e:f4:11:a9:4f:4b:89:73:43:26:
+                    84:b5:28:e4:24:3d:30:9d:f5:24:f4:7a:fa:a8:2c:
+                    03:15:52:5c:98:64:ee:c4:21:93:b3:c0:b5:fe:8a:
+                    ff:c7
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                D2:6A:CE:59:BB:01:16:D7:54:F7:2B:1E:94:6E:8A:C6:41:62:47:81
+            X509v3 Authority Key Identifier: 
+                keyid:F2:CD:C7:95:71:41:67:C9:47:D3:08:A6:6C:23:BA:F3:A1:2A:B6:37
+
+            Authority Information Access: 
+                CA Issuers - URI:http://url-for-aia/Root.cer
+
+            X509v3 CRL Distribution Points: 
+
+                Full Name:
+                  URI:http://url-for-crl/Root.crl
+
+            X509v3 Key Usage: critical
+                Certificate Sign, CRL Sign
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+    Signature Algorithm: sha256WithRSAEncryption
+         8f:8e:84:c9:07:62:d5:2c:d4:c5:a7:11:40:d1:06:75:2b:d8:
+         04:2e:df:1e:d4:21:bc:b0:75:ef:0c:ed:82:f1:ab:af:59:49:
+         32:09:28:8e:ed:5c:86:09:ad:d1:08:78:07:bf:40:df:1d:02:
+         11:73:20:ae:a7:48:05:65:d5:08:f8:4e:19:62:f5:b7:37:bb:
+         44:ca:d6:dd:a1:19:52:ab:8f:e4:bc:c0:0e:d4:1e:b1:fa:d8:
+         86:be:c5:e3:e0:9a:60:a7:ca:ae:ca:33:32:a3:ea:09:92:26:
+         4a:ba:d7:36:13:14:11:e1:93:9e:2c:41:16:22:5f:56:70:5b:
+         9c:e9:2a:42:40:2c:fe:09:0f:5b:45:e0:fe:f6:ff:c7:bd:83:
+         03:68:3b:3b:43:ef:a3:0e:a4:7d:cd:dd:5c:0a:b5:3a:29:00:
+         1d:54:1b:74:59:ee:60:55:c5:78:93:0e:e1:73:fa:c1:8a:70:
+         02:42:ef:41:56:6e:95:e5:3d:7a:a4:9c:d7:71:8f:0e:99:92:
+         47:60:d0:ed:24:e8:0b:89:e3:dd:05:5d:d8:14:c7:a0:98:e4:
+         44:bb:14:af:4e:dc:76:4c:74:d5:b8:1a:74:88:0e:e0:3f:c0:
+         9a:74:c7:36:5e:86:36:42:9c:4a:cc:66:44:2c:a2:75:19:73:
+         ad:ed:01:f8
+-----BEGIN CERTIFICATE-----
+MIIDbTCCAlWgAwIBAgIBAjANBgkqhkiG9w0BAQsFADAPMQ0wCwYDVQQDDARSb290
+MB4XDTE1MDEwMTEyMDAwMFoXDTE2MDEwMTEyMDAwMFowFzEVMBMGA1UEAwwMSW50
+ZXJtZWRpYXRlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAy2rihGmF
+YMAxW7v4TnefNamz/wWfzALYFeFoTaN1iNz3ip4hDdgLyz5NlnU7q6+wl0Tze9F0
+YPrZRoIXVKr1POBFdB2r2RN4WQQ6TFlE0jKPDt9ZHntlpfphM9MKcWwTwx0zeoBb
+Nf8k160JDsOctyj1iJg71LDeaoArrCX3YuPC3IasFE2HDxnzXsAZsqgvUaBWVazN
+S4yVf2wtQtK1R4e6bHAR0+qfbwjBkeFtaH86stm/8OdQp4Q7G1yS+dc2HMCQUMB0
+2COrnjpz4n8SKALJLF+g5g70EalPS4lzQyaEtSjkJD0wnfUk9Hr6qCwDFVJcmGTu
+xCGTs8C1/or/xwIDAQABo4HLMIHIMB0GA1UdDgQWBBTSas5ZuwEW11T3Kx6UborG
+QWJHgTAfBgNVHSMEGDAWgBTyzceVcUFnyUfTCKZsI7rzoSq2NzA3BggrBgEFBQcB
+AQQrMCkwJwYIKwYBBQUHMAKGG2h0dHA6Ly91cmwtZm9yLWFpYS9Sb290LmNlcjAs
+BgNVHR8EJTAjMCGgH6AdhhtodHRwOi8vdXJsLWZvci1jcmwvUm9vdC5jcmwwDgYD
+VR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEB
+AI+OhMkHYtUs1MWnEUDRBnUr2AQu3x7UIbywde8M7YLxq69ZSTIJKI7tXIYJrdEI
+eAe/QN8dAhFzIK6nSAVl1Qj4Thli9bc3u0TK1t2hGVKrj+S8wA7UHrH62Ia+xePg
+mmCnyq7KMzKj6gmSJkq61zYTFBHhk54sQRYiX1ZwW5zpKkJALP4JD1tF4P72/8e9
+gwNoOztD76MOpH3N3VwKtTopAB1UG3RZ7mBVxXiTDuFz+sGKcAJC70FWbpXlPXqk
+nNdxjw6Zkkdg0O0k6AuJ490FXdgUx6CY5ES7FK9O3HZMdNW4GnSIDuA/wJp0xzZe
+hjZCnErMZkQsonUZc63tAfg=
+-----END CERTIFICATE-----
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 1 (0x1)
+    Signature Algorithm: sha256WithRSAEncryption
+        Issuer: CN=Root
+        Validity
+            Not Before: Jan  1 12:00:00 2015 GMT
+            Not After : Jan  1 12:00:00 2016 GMT
+        Subject: CN=Root
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:d5:54:1b:11:1e:60:1b:b3:6f:63:c8:37:84:89:
+                    f0:a9:85:e6:4d:5d:54:3f:1d:39:bf:1c:c7:bb:ef:
+                    ac:58:f7:10:88:a1:44:8d:6d:55:5b:06:c4:c4:d7:
+                    59:4d:a6:31:da:0e:66:41:c3:80:44:57:b3:2d:b1:
+                    ad:a7:6e:82:9c:d5:21:cc:69:e9:c0:96:c4:e5:2b:
+                    b5:b1:02:4b:38:c2:32:94:de:37:3a:bc:59:51:4a:
+                    e4:01:3c:9a:e0:32:76:aa:b3:91:23:2d:df:96:41:
+                    e7:9d:87:9a:2a:fe:94:9e:b4:62:a8:e3:75:4f:74:
+                    27:c3:f6:69:eb:e4:ec:8e:a1:30:c9:41:7d:bb:75:
+                    02:ac:98:4c:8d:23:5f:c4:ca:0a:bc:66:57:a2:8a:
+                    48:f7:d0:79:c5:d8:c0:c9:4f:da:90:19:bb:0a:d2:
+                    10:12:37:79:90:13:8a:4b:1a:26:cc:1c:30:3d:91:
+                    6d:d2:61:bb:80:13:29:0f:72:7c:2b:96:49:00:93:
+                    5a:83:60:6b:a3:62:f3:b5:92:1b:54:43:6d:09:6b:
+                    d5:ef:99:00:e4:db:f3:62:14:c5:b2:9e:40:86:d2:
+                    de:4a:3b:2b:50:f9:ab:5d:2f:ab:13:b4:e1:7e:1f:
+                    98:a2:05:79:04:fb:d9:99:4d:35:8e:4f:eb:c4:c1:
+                    be:d1
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                F2:CD:C7:95:71:41:67:C9:47:D3:08:A6:6C:23:BA:F3:A1:2A:B6:37
+            X509v3 Authority Key Identifier: 
+                keyid:F2:CD:C7:95:71:41:67:C9:47:D3:08:A6:6C:23:BA:F3:A1:2A:B6:37
+
+            Authority Information Access: 
+                CA Issuers - URI:http://url-for-aia/Root.cer
+
+            X509v3 CRL Distribution Points: 
+
+                Full Name:
+                  URI:http://url-for-crl/Root.crl
+
+            X509v3 Key Usage: critical
+                Certificate Sign, CRL Sign
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+    Signature Algorithm: sha256WithRSAEncryption
+         1c:63:79:01:6d:32:04:a3:e9:1e:2b:25:f5:6f:c8:a4:eb:22:
+         df:b0:35:48:cc:4d:a5:a7:49:ca:d5:9f:e1:41:6c:a0:e1:84:
+         86:cd:22:e4:a2:7d:04:0d:b5:c3:3b:37:86:ec:b3:17:8b:4c:
+         74:06:43:91:3e:19:dd:43:73:62:7a:f5:d7:d0:2d:41:7b:a1:
+         ad:0e:1d:41:9d:0c:69:6a:f9:b9:1c:70:b9:21:90:5f:b3:0d:
+         2d:e5:47:0e:07:39:7c:31:5a:ed:9b:fc:7c:fd:f0:ff:f0:3c:
+         80:5f:66:8b:a3:ec:fc:d6:07:aa:09:16:a7:5c:05:e9:e0:a9:
+         bf:c6:84:d0:59:1e:bf:2e:59:5a:3b:bf:4f:be:47:b8:74:47:
+         87:49:19:81:d0:d4:18:f1:d7:b6:02:5e:43:67:62:f7:7c:01:
+         d9:9c:91:66:6c:92:ea:c0:45:c8:93:69:3f:0a:a2:15:6d:9e:
+         72:55:99:b6:e9:14:26:c3:71:19:e6:96:44:83:57:b3:42:a1:
+         8e:2a:c2:e9:61:0e:5f:db:c0:4a:f1:ef:c5:d8:67:3f:0d:0b:
+         54:45:62:06:fd:13:ab:f8:8d:9e:84:18:6d:b8:1a:08:4f:9e:
+         2e:bc:78:ef:e3:f7:85:15:ec:db:2c:c7:0c:18:48:f0:f2:c2:
+         0c:20:61:ea
+-----BEGIN TRUST_ANCHOR_UNCONSTRAINED-----
+MIIDZTCCAk2gAwIBAgIBATANBgkqhkiG9w0BAQsFADAPMQ0wCwYDVQQDDARSb290
+MB4XDTE1MDEwMTEyMDAwMFoXDTE2MDEwMTEyMDAwMFowDzENMAsGA1UEAwwEUm9v
+dDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANVUGxEeYBuzb2PIN4SJ
+8KmF5k1dVD8dOb8cx7vvrFj3EIihRI1tVVsGxMTXWU2mMdoOZkHDgERXsy2xradu
+gpzVIcxp6cCWxOUrtbECSzjCMpTeNzq8WVFK5AE8muAydqqzkSMt35ZB552Hmir+
+lJ60YqjjdU90J8P2aevk7I6hMMlBfbt1AqyYTI0jX8TKCrxmV6KKSPfQecXYwMlP
+2pAZuwrSEBI3eZATiksaJswcMD2RbdJhu4ATKQ9yfCuWSQCTWoNga6Ni87WSG1RD
+bQlr1e+ZAOTb82IUxbKeQIbS3ko7K1D5q10vqxO04X4fmKIFeQT72ZlNNY5P68TB
+vtECAwEAAaOByzCByDAdBgNVHQ4EFgQU8s3HlXFBZ8lH0wimbCO686EqtjcwHwYD
+VR0jBBgwFoAU8s3HlXFBZ8lH0wimbCO686EqtjcwNwYIKwYBBQUHAQEEKzApMCcG
+CCsGAQUFBzAChhtodHRwOi8vdXJsLWZvci1haWEvUm9vdC5jZXIwLAYDVR0fBCUw
+IzAhoB+gHYYbaHR0cDovL3VybC1mb3ItY3JsL1Jvb3QuY3JsMA4GA1UdDwEB/wQE
+AwIBBjAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQAcY3kBbTIE
+o+keKyX1b8ik6yLfsDVIzE2lp0nK1Z/hQWyg4YSGzSLkon0EDbXDOzeG7LMXi0x0
+BkORPhndQ3NievXX0C1Be6GtDh1BnQxpavm5HHC5IZBfsw0t5UcOBzl8MVrtm/x8
+/fD/8DyAX2aLo+z81geqCRanXAXp4Km/xoTQWR6/LllaO79Pvke4dEeHSRmB0NQY
+8de2Al5DZ2L3fAHZnJFmbJLqwEXIk2k/CqIVbZ5yVZm26RQmw3EZ5pZEg1ezQqGO
+KsLpYQ5f28BK8e/F2Gc/DQtURWIG/ROr+I2ehBhtuBoIT54uvHjv4/eFFezbLMcM
+GEjw8sIMIGHq
+-----END TRUST_ANCHOR_UNCONSTRAINED-----
+
+150302120000Z
+-----BEGIN TIME-----
+MTUwMzAyMTIwMDAwWg==
+-----END TIME-----
+
+FAIL
+-----BEGIN VERIFY_RESULT-----
+RkFJTA==
+-----END VERIFY_RESULT-----
+
+serverAuth
+-----BEGIN KEY_PURPOSE-----
+c2VydmVyQXV0aA==
+-----END KEY_PURPOSE-----
+
+----- Certificate i=0 (CN=Target) -----
+ERROR: The extended key usage does not include server auth
+
+
+-----BEGIN ERRORS-----
+LS0tLS0gQ2VydGlmaWNhdGUgaT0wIChDTj1UYXJnZXQpIC0tLS0tCkVSUk9SOiBUaGUgZXh0ZW5kZWQga2V5IHVzYWdlIGRvZXMgbm90IGluY2x1ZGUgc2VydmVyIGF1dGgKCg==
+-----END ERRORS-----