Add tests for keyUsage to the built-in cert verifier.

net/data/verify_certificate_chain_unittest/serverauth-rsa-ku-digitalsignature.pem

+[Created by: generate-serverauth-rsa-ku-digitalsignature.py]
+
+Certificate chain with 1 intermediate, a trusted root, and a target
+certificate for serverAuth that has only digitalSignature.
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 1 (0x1)
+    Signature Algorithm: sha256WithRSAEncryption
+        Issuer: CN=Intermediate
+        Validity
+            Not Before: Jan  1 12:00:00 2015 GMT
+            Not After : Jan  1 12:00:00 2016 GMT
+        Subject: CN=Target
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:c5:7e:f2:5d:c5:ea:a1:5c:84:25:88:33:d7:cc:
+                    e3:60:35:09:1c:fa:84:c8:8c:fb:e1:17:44:1b:a2:
+                    20:bd:26:d4:e9:4c:25:f8:d0:f4:0c:85:a9:c3:97:
+                    8a:c6:b9:ec:17:0b:a1:80:75:e5:10:2c:08:63:6d:
+                    6f:4d:db:1c:c1:d2:77:e8:89:63:aa:bd:f7:02:8d:
+                    29:10:8e:f3:bd:4b:3a:f7:35:1c:ac:40:6a:bd:31:
+                    a8:69:c0:2b:49:11:0a:3e:9b:e8:f9:c6:c1:6b:74:
+                    9f:f4:18:3a:d5:66:bd:83:dd:da:dd:d6:f8:6c:53:
+                    73:7a:6d:9f:17:e5:12:54:6d:3e:86:8d:18:05:91:
+                    97:a6:3b:a8:d2:7b:45:32:7e:1f:ae:44:67:54:38:
+                    ed:6d:c2:52:d3:2f:9f:b6:3d:de:f7:68:21:58:92:
+                    d4:2a:52:75:68:6f:42:6d:e7:97:76:bc:e7:13:eb:
+                    7b:4b:74:86:91:22:27:29:4b:bd:30:0b:f4:f7:ce:
+                    16:3a:52:5f:bd:5c:75:af:5a:71:fc:d8:bd:77:c2:
+                    6e:13:af:3b:35:18:ed:c6:d7:90:40:88:05:9e:ca:
+                    09:f9:0a:54:07:b3:16:ea:6a:50:38:9a:52:02:35:
+                    90:cb:cf:83:da:53:89:ad:d4:13:21:dc:28:03:df:
+                    b7:17
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                AF:70:95:38:BB:6C:27:E5:BA:D2:69:0E:52:43:3B:A9:DE:7D:2C:DE
+            X509v3 Authority Key Identifier: 
+                keyid:BB:73:63:B7:37:30:F3:34:DD:91:77:CF:4C:DE:03:3B:C9:64:BD:85
+
+            Authority Information Access: 
+                CA Issuers - URI:http://url-for-aia/Intermediate.cer
+
+            X509v3 CRL Distribution Points: 
+
+                Full Name:
+                  URI:http://url-for-crl/Intermediate.crl
+
+            X509v3 Key Usage: critical
+                Digital Signature
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication
+    Signature Algorithm: sha256WithRSAEncryption
+         c3:63:39:12:88:4d:d4:e2:d4:9e:f4:ce:20:0b:66:6a:41:7e:
+         71:b3:2b:13:4a:af:7a:64:05:66:23:27:bb:91:63:b5:fe:7e:
+         1a:3e:f7:9b:4d:4e:45:ca:b6:3b:4a:5c:81:17:04:85:7d:f4:
+         d5:a4:fc:93:08:a5:c9:12:d6:e7:62:67:87:39:d6:75:cf:b0:
+         f3:79:23:8d:0f:a9:27:de:16:b6:1d:a3:be:1b:ff:67:c9:f4:
+         5a:33:a3:a4:75:79:2c:7c:a3:36:22:33:da:fb:a4:62:48:04:
+         07:77:ac:1c:cb:02:15:48:c4:82:8b:55:b3:2e:21:40:80:0b:
+         a5:9d:1b:62:6d:57:5f:f6:49:d9:6e:a7:9f:e7:af:40:e4:0b:
+         a8:3d:14:08:db:e7:a1:c6:62:69:4f:48:26:ab:02:5e:0f:90:
+         4f:1c:ad:d1:b3:d4:a4:a5:fd:6a:56:5b:a3:4b:9e:e4:b0:8f:
+         f3:10:23:20:df:7e:77:53:9a:c4:c8:f4:ab:99:7c:c5:85:f0:
+         d4:7f:7a:72:cd:7d:42:ff:07:d2:23:89:e2:e6:0e:24:3e:7b:
+         f1:c8:dd:ce:ba:ad:65:23:63:0a:47:03:99:ca:5b:67:8d:15:
+         f6:f2:f1:68:fb:66:94:2e:4d:4e:7e:b6:7d:9d:b8:d9:ef:3c:
+         08:55:d7:16
+-----BEGIN CERTIFICATE-----
+MIIDgzCCAmugAwIBAgIBATANBgkqhkiG9w0BAQsFADAXMRUwEwYDVQQDDAxJbnRl
+cm1lZGlhdGUwHhcNMTUwMTAxMTIwMDAwWhcNMTYwMTAxMTIwMDAwWjARMQ8wDQYD
+VQQDDAZUYXJnZXQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDFfvJd
+xeqhXIQliDPXzONgNQkc+oTIjPvhF0QboiC9JtTpTCX40PQMhanDl4rGuewXC6GA
+deUQLAhjbW9N2xzB0nfoiWOqvfcCjSkQjvO9Szr3NRysQGq9MahpwCtJEQo+m+j5
+xsFrdJ/0GDrVZr2D3drd1vhsU3N6bZ8X5RJUbT6GjRgFkZemO6jSe0Uyfh+uRGdU
+OO1twlLTL5+2Pd73aCFYktQqUnVob0Jt55d2vOcT63tLdIaRIicpS70wC/T3zhY6
+Ul+9XHWvWnH82L13wm4Trzs1GO3G15BAiAWeygn5ClQHsxbqalA4mlICNZDLz4Pa
+U4mt1BMh3CgD37cXAgMBAAGjgd8wgdwwHQYDVR0OBBYEFK9wlTi7bCflutJpDlJD
+O6nefSzeMB8GA1UdIwQYMBaAFLtzY7c3MPM03ZF3z0zeAzvJZL2FMD8GCCsGAQUF
+BwEBBDMwMTAvBggrBgEFBQcwAoYjaHR0cDovL3VybC1mb3ItYWlhL0ludGVybWVk
+aWF0ZS5jZXIwNAYDVR0fBC0wKzApoCegJYYjaHR0cDovL3VybC1mb3ItY3JsL0lu
+dGVybWVkaWF0ZS5jcmwwDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUF
+BwMBMA0GCSqGSIb3DQEBCwUAA4IBAQDDYzkSiE3U4tSe9M4gC2ZqQX5xsysTSq96
+ZAVmIye7kWO1/n4aPvebTU5FyrY7SlyBFwSFffTVpPyTCKXJEtbnYmeHOdZ1z7Dz
+eSOND6kn3ha2HaO+G/9nyfRaM6OkdXksfKM2IjPa+6RiSAQHd6wcywIVSMSCi1Wz
+LiFAgAulnRtibVdf9knZbqef569A5AuoPRQI2+ehxmJpT0gmqwJeD5BPHK3Rs9Sk
+pf1qVlujS57ksI/zECMg3353U5rEyPSrmXzFhfDUf3pyzX1C/wfSI4ni5g4kPnvx
+yN3Ouq1lI2MKRwOZyltnjRX28vFo+2aULk1OfrZ9nbjZ7zwIVdcW
+-----END CERTIFICATE-----
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 2 (0x2)
+    Signature Algorithm: sha256WithRSAEncryption
+        Issuer: CN=Root
+        Validity
+            Not Before: Jan  1 12:00:00 2015 GMT
+            Not After : Jan  1 12:00:00 2016 GMT
+        Subject: CN=Intermediate
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:e4:08:b7:00:bd:dc:6b:5c:7a:fd:fd:54:76:c0:
+                    b3:d7:c0:ac:43:78:4f:e7:d7:29:04:6e:f2:c1:9a:
+                    5c:70:86:c9:e4:fb:50:1b:e8:2e:42:71:fb:22:d4:
+                    d8:7d:95:9d:a6:59:a1:e7:db:2e:cc:c7:75:db:c8:
+                    31:4f:18:fa:a3:b8:bf:d7:0b:08:2d:87:d1:f0:c1:
+                    4f:2e:2f:4e:48:39:30:cf:62:d0:1d:bf:55:e5:dd:
+                    4e:63:85:b6:29:ac:91:ec:13:1c:a2:36:e4:2d:f3:
+                    5b:ec:95:e1:a8:00:86:c5:96:7c:74:a6:18:69:2e:
+                    c2:5b:95:1d:81:46:d4:81:10:24:d9:c9:da:9c:a2:
+                    d0:5c:2d:4f:83:e5:a1:c0:a2:c4:a5:7f:de:78:9c:
+                    57:af:12:5c:1d:65:62:01:bf:71:49:52:06:3a:bb:
+                    f8:aa:5b:12:80:15:0a:14:7d:46:3e:79:1a:b0:4e:
+                    6f:59:bc:2f:57:f7:dd:4c:50:82:4c:7d:f9:38:3d:
+                    c4:29:63:0a:a9:df:70:3d:02:da:0c:56:9b:76:9d:
+                    73:dd:86:11:b8:d7:59:86:e2:16:b3:93:8c:43:33:
+                    41:b1:6b:38:f3:67:54:00:e3:c1:06:7f:1f:c2:fd:
+                    f4:76:42:63:4c:bc:cb:28:b0:cf:b5:cd:9f:bf:ff:
+                    ea:db
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                BB:73:63:B7:37:30:F3:34:DD:91:77:CF:4C:DE:03:3B:C9:64:BD:85
+            X509v3 Authority Key Identifier: 
+                keyid:8F:51:99:A2:01:B7:93:0B:E1:7D:90:CE:20:20:90:C8:B3:73:2E:EB
+
+            Authority Information Access: 
+                CA Issuers - URI:http://url-for-aia/Root.cer
+
+            X509v3 CRL Distribution Points: 
+
+                Full Name:
+                  URI:http://url-for-crl/Root.crl
+
+            X509v3 Key Usage: critical
+                Certificate Sign, CRL Sign
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+    Signature Algorithm: sha256WithRSAEncryption
+         17:40:15:83:75:85:ab:70:bd:8d:e0:ce:52:cd:9e:d5:ea:f1:
+         b9:1c:e9:8d:9a:58:28:1d:a0:09:14:00:bc:c3:45:96:92:91:
+         32:99:6f:da:59:a8:b3:5b:97:f3:ec:a0:ad:8c:7d:45:9a:7e:
+         8b:be:90:c9:63:95:f3:97:22:cf:b1:c8:e0:93:95:a2:df:52:
+         e3:02:7d:d0:5f:22:0a:85:9c:ee:1f:a6:bf:f9:f4:ef:f1:6e:
+         61:27:f5:7a:1e:e4:97:a2:27:8e:6c:d4:bc:bd:d8:70:cf:a5:
+         5f:07:e1:ab:42:ac:98:09:bf:31:f0:12:5f:54:38:84:18:bd:
+         9b:0b:57:ee:bf:be:64:ab:ce:29:da:55:d4:ce:8f:8c:5f:87:
+         49:17:21:a8:af:03:cf:b6:e7:9a:df:bf:ee:53:24:f6:f7:b2:
+         9c:22:cc:a2:c9:4a:ad:a3:c9:cd:6a:f2:97:ac:17:a6:e6:f5:
+         f3:d6:ad:8e:2e:7c:39:61:d3:d0:a4:79:08:b5:e8:1c:3a:39:
+         4a:a2:3b:69:46:64:14:57:de:58:b0:f2:4c:c2:90:e8:e4:3b:
+         56:5b:6e:62:67:22:d2:d0:4c:5b:7c:3f:c9:c0:d3:e9:cf:99:
+         a1:51:f5:16:9d:ec:1a:ff:c0:6f:83:8b:7b:a9:68:c0:b7:5f:
+         c9:5c:8c:58
+-----BEGIN CERTIFICATE-----
+MIIDbTCCAlWgAwIBAgIBAjANBgkqhkiG9w0BAQsFADAPMQ0wCwYDVQQDDARSb290
+MB4XDTE1MDEwMTEyMDAwMFoXDTE2MDEwMTEyMDAwMFowFzEVMBMGA1UEAwwMSW50
+ZXJtZWRpYXRlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA5Ai3AL3c
+a1x6/f1UdsCz18CsQ3hP59cpBG7ywZpccIbJ5PtQG+guQnH7ItTYfZWdplmh59su
+zMd128gxTxj6o7i/1wsILYfR8MFPLi9OSDkwz2LQHb9V5d1OY4W2KayR7BMcojbk
+LfNb7JXhqACGxZZ8dKYYaS7CW5UdgUbUgRAk2cnanKLQXC1Pg+WhwKLEpX/eeJxX
+rxJcHWViAb9xSVIGOrv4qlsSgBUKFH1GPnkasE5vWbwvV/fdTFCCTH35OD3EKWMK
+qd9wPQLaDFabdp1z3YYRuNdZhuIWs5OMQzNBsWs482dUAOPBBn8fwv30dkJjTLzL
+KLDPtc2fv//q2wIDAQABo4HLMIHIMB0GA1UdDgQWBBS7c2O3NzDzNN2Rd89M3gM7
+yWS9hTAfBgNVHSMEGDAWgBSPUZmiAbeTC+F9kM4gIJDIs3Mu6zA3BggrBgEFBQcB
+AQQrMCkwJwYIKwYBBQUHMAKGG2h0dHA6Ly91cmwtZm9yLWFpYS9Sb290LmNlcjAs
+BgNVHR8EJTAjMCGgH6AdhhtodHRwOi8vdXJsLWZvci1jcmwvUm9vdC5jcmwwDgYD
+VR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEB
+ABdAFYN1hatwvY3gzlLNntXq8bkc6Y2aWCgdoAkUALzDRZaSkTKZb9pZqLNbl/Ps
+oK2MfUWafou+kMljlfOXIs+xyOCTlaLfUuMCfdBfIgqFnO4fpr/59O/xbmEn9Xoe
+5JeiJ45s1Ly92HDPpV8H4atCrJgJvzHwEl9UOIQYvZsLV+6/vmSrzinaVdTOj4xf
+h0kXIaivA8+255rfv+5TJPb3spwizKLJSq2jyc1q8pesF6bm9fPWrY4ufDlh09Ck
+eQi16Bw6OUqiO2lGZBRX3liw8kzCkOjkO1ZbbmJnItLQTFt8P8nA0+nPmaFR9Rad
+7Br/wG+Di3upaMC3X8lcjFg=
+-----END CERTIFICATE-----
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 1 (0x1)
+    Signature Algorithm: sha256WithRSAEncryption
+        Issuer: CN=Root
+        Validity
+            Not Before: Jan  1 12:00:00 2015 GMT
+            Not After : Jan  1 12:00:00 2016 GMT
+        Subject: CN=Root
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:c7:66:8c:31:87:5f:d9:77:88:56:9d:5d:f5:0e:
+                    62:3e:1a:99:ff:2d:5a:89:16:a7:0b:da:ba:c7:5a:
+                    2f:fa:84:48:fd:e1:f4:e0:f0:ac:f0:66:f9:9f:ce:
+                    c9:54:61:27:48:f6:84:6f:35:31:54:23:3f:b9:c7:
+                    97:28:7d:30:6e:6d:fd:a0:c2:b9:9b:c0:1f:fb:fa:
+                    51:5a:89:f7:33:85:bc:58:58:d5:3d:6d:54:c2:3a:
+                    c4:3c:d0:58:ed:43:aa:76:95:68:62:da:75:e2:fd:
+                    dc:11:8d:dc:70:92:c5:3e:15:e3:68:1a:79:17:20:
+                    81:de:12:75:cb:c8:81:36:f6:a6:2b:8b:35:95:7a:
+                    49:99:d1:3e:47:04:7e:74:d6:31:4b:a3:a2:09:0c:
+                    95:18:18:05:2e:e4:6f:5a:1c:aa:1d:29:fe:9d:a9:
+                    26:da:b6:e4:dc:11:93:a0:4c:af:4a:cc:1a:bc:99:
+                    2b:3a:52:1f:7c:4c:7a:87:1c:57:95:81:e4:b3:de:
+                    92:98:e9:c1:22:7a:87:36:b7:a2:97:63:f2:cf:57:
+                    8b:e0:6b:5b:e4:11:90:c7:5b:15:fe:72:2c:34:c9:
+                    7e:db:1e:f1:bb:b6:5c:6d:2c:ab:36:4d:22:5e:f0:
+                    1a:3b:6a:7a:d1:58:f4:84:51:19:b5:39:91:ca:b9:
+                    0a:13
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                8F:51:99:A2:01:B7:93:0B:E1:7D:90:CE:20:20:90:C8:B3:73:2E:EB
+            X509v3 Authority Key Identifier: 
+                keyid:8F:51:99:A2:01:B7:93:0B:E1:7D:90:CE:20:20:90:C8:B3:73:2E:EB
+
+            Authority Information Access: 
+                CA Issuers - URI:http://url-for-aia/Root.cer
+
+            X509v3 CRL Distribution Points: 
+
+                Full Name:
+                  URI:http://url-for-crl/Root.crl
+
+            X509v3 Key Usage: critical
+                Certificate Sign, CRL Sign
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+    Signature Algorithm: sha256WithRSAEncryption
+         5d:07:b5:ec:0b:f3:78:ba:bb:f4:27:c2:5b:93:59:f0:0c:52:
+         cb:fd:36:de:9b:0e:c7:cb:57:46:86:bf:fb:e1:a5:31:20:43:
+         17:61:40:37:d1:e7:6f:f0:86:85:23:a2:96:28:a5:e2:bc:53:
+         7f:e4:a2:4d:8c:9c:a6:f5:dd:18:1f:e4:a6:66:33:dd:2f:da:
+         d7:a3:ad:c7:24:a5:e9:ce:68:a3:f1:f5:46:4b:36:40:d0:a3:
+         32:c1:14:17:10:ec:27:4d:d2:48:c3:1d:6b:45:92:bb:c9:d6:
+         cd:25:26:3b:dc:4a:d4:80:89:7b:44:f5:2a:c0:a1:3a:8d:e8:
+         60:64:34:45:a7:cb:ef:86:41:90:7d:fb:7d:1f:87:30:b9:49:
+         89:21:35:b1:ee:f2:fc:8d:12:08:06:4a:af:07:fb:25:60:83:
+         17:ae:27:6e:31:39:ff:de:d9:a9:f5:04:bc:a6:c3:6e:a4:6a:
+         07:d6:82:e7:26:fb:9b:6f:88:fa:c7:61:63:cc:15:d2:b4:2c:
+         af:aa:49:d9:40:a6:ab:c2:3c:7b:e1:07:5c:50:e5:69:59:c7:
+         e5:8b:ca:70:72:12:f5:5d:6b:b6:05:7c:e2:1b:87:0e:25:4e:
+         dd:63:91:a6:ca:b3:70:69:97:ce:9a:7c:c8:15:b0:23:b5:1a:
+         59:43:cd:3f
+-----BEGIN TRUST_ANCHOR_UNCONSTRAINED-----
+MIIDZTCCAk2gAwIBAgIBATANBgkqhkiG9w0BAQsFADAPMQ0wCwYDVQQDDARSb290
+MB4XDTE1MDEwMTEyMDAwMFoXDTE2MDEwMTEyMDAwMFowDzENMAsGA1UEAwwEUm9v
+dDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMdmjDGHX9l3iFadXfUO
+Yj4amf8tWokWpwvausdaL/qESP3h9ODwrPBm+Z/OyVRhJ0j2hG81MVQjP7nHlyh9
+MG5t/aDCuZvAH/v6UVqJ9zOFvFhY1T1tVMI6xDzQWO1DqnaVaGLadeL93BGN3HCS
+xT4V42gaeRcggd4SdcvIgTb2piuLNZV6SZnRPkcEfnTWMUujogkMlRgYBS7kb1oc
+qh0p/p2pJtq25NwRk6BMr0rMGryZKzpSH3xMeoccV5WB5LPekpjpwSJ6hza3opdj
+8s9Xi+BrW+QRkMdbFf5yLDTJftse8bu2XG0sqzZNIl7wGjtqetFY9IRRGbU5kcq5
+ChMCAwEAAaOByzCByDAdBgNVHQ4EFgQUj1GZogG3kwvhfZDOICCQyLNzLuswHwYD
+VR0jBBgwFoAUj1GZogG3kwvhfZDOICCQyLNzLuswNwYIKwYBBQUHAQEEKzApMCcG
+CCsGAQUFBzAChhtodHRwOi8vdXJsLWZvci1haWEvUm9vdC5jZXIwLAYDVR0fBCUw
+IzAhoB+gHYYbaHR0cDovL3VybC1mb3ItY3JsL1Jvb3QuY3JsMA4GA1UdDwEB/wQE
+AwIBBjAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQBdB7XsC/N4
+urv0J8Jbk1nwDFLL/Tbemw7Hy1dGhr/74aUxIEMXYUA30edv8IaFI6KWKKXivFN/
+5KJNjJym9d0YH+SmZjPdL9rXo63HJKXpzmij8fVGSzZA0KMywRQXEOwnTdJIwx1r
+RZK7ydbNJSY73ErUgIl7RPUqwKE6jehgZDRFp8vvhkGQfft9H4cwuUmJITWx7vL8
+jRIIBkqvB/slYIMXriduMTn/3tmp9QS8psNupGoH1oLnJvubb4j6x2FjzBXStCyv
+qknZQKarwjx74QdcUOVpWcfli8pwchL1XWu2BXziG4cOJU7dY5GmyrNwaZfOmnzI
+FbAjtRpZQ80/
+-----END TRUST_ANCHOR_UNCONSTRAINED-----
+
+150302120000Z
+-----BEGIN TIME-----
+MTUwMzAyMTIwMDAwWg==
+-----END TIME-----
+
+SUCCESS
+-----BEGIN VERIFY_RESULT-----
+U1VDQ0VTUw==
+-----END VERIFY_RESULT-----
+
+serverAuth
+-----BEGIN KEY_PURPOSE-----
+c2VydmVyQXV0aA==
+-----END KEY_PURPOSE-----