Reject certificates that contain unknown policy qualifiers if the

net/data/verify_certificate_chain_unittest/unknown-non-critical-policy-qualifier/chain.pem

+[Created by: generate-chains.py]
+
+The intermediate has a policies extension (not marked as critical),
+which contains an unknown qualifer (1.2.3.4).
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 1 (0x1)
+    Signature Algorithm: sha256WithRSAEncryption
+        Issuer: CN=Intermediate
+        Validity
+            Not Before: Jan  1 12:00:00 2015 GMT
+            Not After : Jan  1 12:00:00 2016 GMT
+        Subject: CN=Target
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:be:d9:c3:94:6a:c2:d7:1b:b4:33:1a:29:0d:ca:
+                    48:e2:f1:94:93:27:36:71:c1:a2:dc:67:0e:5d:67:
+                    b0:a9:08:9c:67:08:ba:d9:74:5f:01:62:5d:7f:2a:
+                    bb:32:ed:0c:af:c8:5a:b5:02:24:45:6f:90:4c:83:
+                    ab:0e:30:19:c2:df:bc:d5:25:99:b0:f3:5e:e1:27:
+                    5b:06:2f:ca:3e:d6:49:fb:87:8d:d3:fd:b9:b9:27:
+                    80:be:b5:88:72:3b:1b:20:3f:04:69:04:89:66:ee:
+                    20:f7:c2:90:c1:27:aa:29:fa:88:ff:2f:10:3b:81:
+                    cf:d0:b9:e9:a7:84:dc:f1:a7:d0:49:e0:6e:17:b2:
+                    ba:09:ed:be:9c:a3:f2:66:37:dd:20:98:43:31:bd:
+                    02:d1:55:63:88:f6:55:13:20:b7:b9:0b:c9:c9:fb:
+                    a3:5b:0f:90:56:e8:8a:dc:a5:7a:92:bc:46:5d:82:
+                    a4:e1:42:2c:7c:76:65:63:87:f4:e0:5a:cf:15:22:
+                    13:49:1d:aa:0d:ea:25:08:7c:63:19:39:2f:1d:15:
+                    2e:7c:9a:e7:d5:03:21:76:6c:22:1a:be:12:8b:72:
+                    c5:cb:0f:41:ef:0f:d3:be:78:1d:12:e0:c2:29:eb:
+                    d7:36:28:54:ad:8d:ce:c8:79:2f:4f:13:c1:2b:3b:
+                    e4:ff
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                FE:3D:1B:76:A0:3D:EE:69:00:5B:D4:61:90:68:18:E3:29:EC:66:A3
+            X509v3 Authority Key Identifier: 
+                keyid:49:F0:C4:09:BE:16:68:CF:0A:C1:E0:EF:8F:A6:34:1F:94:63:6F:E6
+
+            Authority Information Access: 
+                CA Issuers - URI:http://url-for-aia/Intermediate.cer
+
+            X509v3 CRL Distribution Points: 
+
+                Full Name:
+                  URI:http://url-for-crl/Intermediate.crl
+
+            X509v3 Key Usage: critical
+                Digital Signature, Key Encipherment
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, TLS Web Client Authentication
+    Signature Algorithm: sha256WithRSAEncryption
+         22:98:2c:68:6e:42:33:22:00:d9:a3:a4:ec:bc:b6:19:c9:a5:
+         07:bd:ec:da:e0:82:4c:71:d6:59:b0:ee:8e:04:78:08:e5:1e:
+         d2:02:30:96:df:2b:ed:a7:c0:89:4d:88:23:84:67:4b:32:d8:
+         cd:61:5c:50:45:3a:8f:de:1e:86:a3:b9:01:7b:02:71:8e:35:
+         02:54:3f:89:de:66:17:2d:06:d2:af:a5:17:40:b7:66:4e:32:
+         35:9e:c0:c1:eb:57:13:af:f1:0e:7a:8a:d7:9b:05:a6:24:55:
+         ae:c1:c1:60:45:c8:70:4f:59:a1:c6:aa:51:03:5a:ca:26:30:
+         33:36:2b:09:45:10:cf:3f:3c:f1:a8:da:34:a8:59:59:94:4b:
+         5b:c1:31:f5:21:1c:cc:02:40:a2:78:bc:03:29:18:df:d4:9d:
+         df:50:38:c6:b5:f2:7c:b6:bc:30:f5:f5:b4:fd:65:16:5c:c3:
+         cf:19:c0:13:72:77:e4:ea:9e:37:2f:78:27:0e:27:10:56:14:
+         4b:c7:88:2c:e9:bb:63:ef:43:0b:25:6e:bb:83:e6:87:94:67:
+         a5:da:94:ff:81:3a:e2:86:c4:1d:a9:50:1f:69:be:ab:63:03:
+         f7:b6:a9:b6:b5:59:b3:4f:11:64:98:40:de:c0:39:c8:ab:b5:
+         3c:69:08:8b
+-----BEGIN CERTIFICATE-----
+MIIDjTCCAnWgAwIBAgIBATANBgkqhkiG9w0BAQsFADAXMRUwEwYDVQQDDAxJbnRl
+cm1lZGlhdGUwHhcNMTUwMTAxMTIwMDAwWhcNMTYwMTAxMTIwMDAwWjARMQ8wDQYD
+VQQDDAZUYXJnZXQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC+2cOU
+asLXG7QzGikNykji8ZSTJzZxwaLcZw5dZ7CpCJxnCLrZdF8BYl1/Krsy7QyvyFq1
+AiRFb5BMg6sOMBnC37zVJZmw817hJ1sGL8o+1kn7h43T/bm5J4C+tYhyOxsgPwRp
+BIlm7iD3wpDBJ6op+oj/LxA7gc/QuemnhNzxp9BJ4G4XsroJ7b6co/JmN90gmEMx
+vQLRVWOI9lUTILe5C8nJ+6NbD5BW6IrcpXqSvEZdgqThQix8dmVjh/TgWs8VIhNJ
+HaoN6iUIfGMZOS8dFS58mufVAyF2bCIavhKLcsXLD0HvD9O+eB0S4MIp69c2KFSt
+jc7IeS9PE8ErO+T/AgMBAAGjgekwgeYwHQYDVR0OBBYEFP49G3agPe5pAFvUYZBo
+GOMp7GajMB8GA1UdIwQYMBaAFEnwxAm+FmjPCsHg74+mNB+UY2/mMD8GCCsGAQUF
+BwEBBDMwMTAvBggrBgEFBQcwAoYjaHR0cDovL3VybC1mb3ItYWlhL0ludGVybWVk
+aWF0ZS5jZXIwNAYDVR0fBC0wKzApoCegJYYjaHR0cDovL3VybC1mb3ItY3JsL0lu
+dGVybWVkaWF0ZS5jcmwwDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUF
+BwMBBggrBgEFBQcDAjANBgkqhkiG9w0BAQsFAAOCAQEAIpgsaG5CMyIA2aOk7Ly2
+GcmlB73s2uCCTHHWWbDujgR4COUe0gIwlt8r7afAiU2II4RnSzLYzWFcUEU6j94e
+hqO5AXsCcY41AlQ/id5mFy0G0q+lF0C3Zk4yNZ7AwetXE6/xDnqK15sFpiRVrsHB
+YEXIcE9ZocaqUQNayiYwMzYrCUUQzz888ajaNKhZWZRLW8Ex9SEczAJAoni8AykY
+39Sd31A4xrXyfLa8MPX1tP1lFlzDzxnAE3J35OqeNy94Jw4nEFYUS8eILOm7Y+9D
+CyVuu4Pmh5RnpdqU/4E64obEHalQH2m+q2MD97aptrVZs08RZJhA3sA5yKu1PGkI
+iw==
+-----END CERTIFICATE-----
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 2 (0x2)
+    Signature Algorithm: sha256WithRSAEncryption
+        Issuer: CN=Root
+        Validity
+            Not Before: Jan  1 12:00:00 2015 GMT
+            Not After : Jan  1 12:00:00 2016 GMT
+        Subject: CN=Intermediate
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:d9:74:6c:03:22:ab:05:1b:af:d1:34:43:ac:2a:
+                    a3:bd:5d:dc:13:39:5f:df:ff:f4:bd:3c:bd:56:1e:
+                    b5:e9:b2:19:1d:49:ff:9c:5a:31:9c:20:74:87:27:
+                    81:22:50:a3:c2:90:da:48:da:c2:cd:4a:4d:dd:ec:
+                    75:d7:61:5b:32:57:1e:1d:63:82:54:69:49:f1:ff:
+                    3e:a5:67:46:b2:77:73:61:ce:30:9c:d5:f7:36:1f:
+                    83:0e:12:f8:37:48:a9:36:e6:38:61:13:5a:1d:a7:
+                    70:17:d2:0d:81:87:f0:cf:02:3c:13:56:fc:e9:79:
+                    96:c0:6d:8a:5d:a7:ad:e7:c5:3f:09:28:aa:e9:a8:
+                    6b:23:a3:78:fe:34:11:ba:d0:12:59:cf:b3:8a:68:
+                    df:96:2f:44:b0:b9:72:54:cf:ba:1b:2c:8c:56:a4:
+                    9d:db:b8:55:72:42:04:13:77:cc:75:04:3d:e9:b1:
+                    fa:a4:19:1b:3d:6f:0a:c2:7a:48:37:8b:35:c6:e1:
+                    cc:c6:50:b5:45:c0:f2:30:ca:ff:df:75:af:4b:c3:
+                    c7:63:11:da:fb:54:bf:53:57:a0:ce:75:18:53:8e:
+                    c7:49:c3:4a:79:88:a4:1d:34:a4:e0:d2:f4:63:ca:
+                    5a:02:89:c3:94:a3:38:32:f6:3b:e1:06:e4:02:e4:
+                    d0:25
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                49:F0:C4:09:BE:16:68:CF:0A:C1:E0:EF:8F:A6:34:1F:94:63:6F:E6
+            X509v3 Authority Key Identifier: 
+                keyid:27:0D:D0:55:88:5D:DE:1C:37:96:A0:62:14:C2:19:3C:C6:A4:1F:D1
+
+            Authority Information Access: 
+                CA Issuers - URI:http://url-for-aia/Root.cer
+
+            X509v3 CRL Distribution Points: 
+
+                Full Name:
+                  URI:http://url-for-crl/Root.crl
+
+            X509v3 Key Usage: critical
+                Certificate Sign, CRL Sign
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+            X509v3 Certificate Policies: 
+                Policy: 1.2.3
+                    Unknown Qualifier: 1.2.3.4
+
+    Signature Algorithm: sha256WithRSAEncryption
+         6e:62:b6:3a:f3:09:f3:b0:03:99:44:33:cb:8d:b5:aa:7c:8d:
+         e8:5e:3e:9a:fe:75:be:61:c9:1f:97:72:3b:b9:e8:76:25:37:
+         ff:ec:cf:66:a5:2f:3a:fb:1a:a3:97:c8:b9:f5:f9:b9:f4:28:
+         7f:f4:57:49:5f:08:2c:26:bd:2e:50:db:13:2b:a6:0b:61:58:
+         32:64:30:b7:2a:92:0f:b2:3d:fa:9a:63:e8:9c:37:03:5f:29:
+         c0:f4:78:47:45:ab:b3:84:43:34:84:21:24:51:64:c1:df:94:
+         95:55:18:2e:a1:a9:41:bd:19:42:73:46:7d:19:59:67:1a:5e:
+         19:1e:56:ad:4a:e5:1d:bb:4e:83:a1:ef:08:9b:ca:0c:5a:8b:
+         c2:a1:15:67:75:d4:80:17:85:d0:c8:27:61:8e:29:66:f5:2d:
+         b8:08:d4:1b:c9:e9:e9:1b:d4:9c:b6:7c:17:4d:c9:58:4f:01:
+         4c:1e:23:c9:f5:75:78:e3:54:81:8b:7e:44:a7:f4:61:cc:38:
+         eb:3f:55:0c:4a:03:ec:02:11:4b:83:c2:e9:77:48:9e:c3:85:
+         d8:99:9d:38:69:26:cb:16:2f:0c:31:05:29:ab:58:2f:d4:ef:
+         20:7e:a9:56:fa:cb:76:bb:f5:15:05:1a:33:fa:88:46:21:2c:
+         23:f3:dd:f8
+-----BEGIN CERTIFICATE-----
+MIIDizCCAnOgAwIBAgIBAjANBgkqhkiG9w0BAQsFADAPMQ0wCwYDVQQDDARSb290
+MB4XDTE1MDEwMTEyMDAwMFoXDTE2MDEwMTEyMDAwMFowFzEVMBMGA1UEAwwMSW50
+ZXJtZWRpYXRlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2XRsAyKr
+BRuv0TRDrCqjvV3cEzlf3//0vTy9Vh616bIZHUn/nFoxnCB0hyeBIlCjwpDaSNrC
+zUpN3ex112FbMlceHWOCVGlJ8f8+pWdGsndzYc4wnNX3Nh+DDhL4N0ipNuY4YRNa
+HadwF9INgYfwzwI8E1b86XmWwG2KXaet58U/CSiq6ahrI6N4/jQRutASWc+zimjf
+li9EsLlyVM+6GyyMVqSd27hVckIEE3fMdQQ96bH6pBkbPW8KwnpIN4s1xuHMxlC1
+RcDyMMr/33WvS8PHYxHa+1S/U1egznUYU47HScNKeYikHTSk4NL0Y8paAonDlKM4
+MvY74QbkAuTQJQIDAQABo4HpMIHmMB0GA1UdDgQWBBRJ8MQJvhZozwrB4O+PpjQf
+lGNv5jAfBgNVHSMEGDAWgBQnDdBViF3eHDeWoGIUwhk8xqQf0TA3BggrBgEFBQcB
+AQQrMCkwJwYIKwYBBQUHMAKGG2h0dHA6Ly91cmwtZm9yLWFpYS9Sb290LmNlcjAs
+BgNVHR8EJTAjMCGgH6AdhhtodHRwOi8vdXJsLWZvci1jcmwvUm9vdC5jcmwwDgYD
+VR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHAYDVR0gBBUwEzARBgIqAzAL
+MAkGAyoDBAwCaGkwDQYJKoZIhvcNAQELBQADggEBAG5itjrzCfOwA5lEM8uNtap8
+jehePpr+db5hyR+Xcju56HYlN//sz2alLzr7GqOXyLn1+bn0KH/0V0lfCCwmvS5Q
+2xMrpgthWDJkMLcqkg+yPfqaY+icNwNfKcD0eEdFq7OEQzSEISRRZMHflJVVGC6h
+qUG9GUJzRn0ZWWcaXhkeVq1K5R27ToOh7wibygxai8KhFWd11IAXhdDIJ2GOKWb1
+LbgI1BvJ6ekb1Jy2fBdNyVhPAUweI8n1dXjjVIGLfkSn9GHMOOs/VQxKA+wCEUuD
+wul3SJ7DhdiZnThpJssWLwwxBSmrWC/U7yB+qVb6y3a79RUFGjP6iEYhLCPz3fg=
+-----END CERTIFICATE-----
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 1 (0x1)
+    Signature Algorithm: sha256WithRSAEncryption
+        Issuer: CN=Root
+        Validity
+            Not Before: Jan  1 12:00:00 2015 GMT
+            Not After : Jan  1 12:00:00 2016 GMT
+        Subject: CN=Root
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:a0:f9:c1:fa:93:42:7b:bf:e5:1e:21:e2:f5:cd:
+                    db:f7:61:04:6e:ea:06:4c:fc:d5:2e:9f:5e:6e:97:
+                    b2:d4:c3:f1:4c:18:01:5e:3e:85:e2:c0:73:ce:56:
+                    fb:cc:4c:4e:f0:37:b5:e0:c6:31:5c:c0:06:5a:90:
+                    24:d8:5d:88:ab:e3:53:2b:12:90:0b:16:c6:db:19:
+                    74:e7:29:63:53:d9:5b:f3:e7:80:8c:5e:86:ff:e8:
+                    e3:72:6b:09:6c:64:6b:92:34:f2:9c:bd:f4:b7:c1:
+                    31:6f:74:00:31:3a:45:70:9f:5d:a5:d3:9c:91:7f:
+                    fb:87:95:ef:07:f3:8d:8e:c9:a5:cb:ed:cc:2d:23:
+                    bf:e4:98:93:88:8d:be:bc:50:02:2c:3a:0d:52:53:
+                    7e:9a:20:04:da:52:db:a4:e5:72:bc:d6:40:40:7f:
+                    51:86:29:d7:f5:f7:db:85:b3:a0:7d:7a:c5:04:3e:
+                    e9:73:ca:65:3c:13:91:46:a1:b4:fb:6b:8b:a0:5e:
+                    7c:c9:9d:3c:5e:c5:f6:2a:99:df:2e:13:1e:7d:d8:
+                    db:30:02:52:d7:94:16:93:b8:20:5d:77:4d:26:6e:
+                    9c:c8:5e:0a:56:ad:ba:d9:26:c0:80:dd:66:aa:09:
+                    09:18:41:fa:f2:5c:7f:ae:10:45:25:ba:cc:0d:5d:
+                    d8:3b
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                27:0D:D0:55:88:5D:DE:1C:37:96:A0:62:14:C2:19:3C:C6:A4:1F:D1
+            X509v3 Authority Key Identifier: 
+                keyid:27:0D:D0:55:88:5D:DE:1C:37:96:A0:62:14:C2:19:3C:C6:A4:1F:D1
+
+            Authority Information Access: 
+                CA Issuers - URI:http://url-for-aia/Root.cer
+
+            X509v3 CRL Distribution Points: 
+
+                Full Name:
+                  URI:http://url-for-crl/Root.crl
+
+            X509v3 Key Usage: critical
+                Certificate Sign, CRL Sign
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+    Signature Algorithm: sha256WithRSAEncryption
+         01:8b:38:40:44:1d:07:f2:7c:3f:c0:c1:2a:73:7e:9c:7b:42:
+         20:3a:79:cd:8d:ea:20:c5:72:07:0f:72:3b:50:0e:83:1c:43:
+         3d:ed:67:61:be:d1:2a:5d:52:f9:54:5a:5d:04:f8:b9:fd:62:
+         87:a4:52:cf:e5:d3:ff:55:77:9c:80:59:e9:f6:55:7a:5a:51:
+         e4:93:56:35:f7:5d:92:7d:98:8e:ed:1b:16:68:c6:04:3d:28:
+         c4:9c:26:51:dc:a4:38:dc:dc:04:bb:de:ae:8b:25:0a:e1:a1:
+         3d:22:7e:6f:a3:26:76:98:dd:68:d5:e0:29:41:42:2d:17:00:
+         18:ef:a1:34:41:19:24:8c:4b:a8:83:48:f4:57:a8:ef:76:db:
+         a8:bf:c3:6f:f2:7d:4e:c9:1a:84:90:1a:85:61:a4:30:16:3b:
+         a2:62:70:96:a3:4e:55:f9:e2:a5:f0:ac:16:3f:b2:6a:4b:62:
+         fa:73:94:8d:5b:d8:e7:36:04:54:93:a7:3c:59:42:42:f6:4c:
+         41:4a:54:b2:3a:ea:69:33:1b:5b:d7:21:c5:9e:3f:6f:9c:bd:
+         d7:55:73:e6:0f:20:60:4e:88:b4:de:a8:f4:29:3d:f9:fb:2d:
+         61:7e:4d:5d:94:e0:85:0b:47:52:75:f6:94:ad:d0:ba:d5:37:
+         4b:9f:3a:02
+-----BEGIN CERTIFICATE-----
+MIIDZTCCAk2gAwIBAgIBATANBgkqhkiG9w0BAQsFADAPMQ0wCwYDVQQDDARSb290
+MB4XDTE1MDEwMTEyMDAwMFoXDTE2MDEwMTEyMDAwMFowDzENMAsGA1UEAwwEUm9v
+dDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKD5wfqTQnu/5R4h4vXN
+2/dhBG7qBkz81S6fXm6XstTD8UwYAV4+heLAc85W+8xMTvA3teDGMVzABlqQJNhd
+iKvjUysSkAsWxtsZdOcpY1PZW/PngIxehv/o43JrCWxka5I08py99LfBMW90ADE6
+RXCfXaXTnJF/+4eV7wfzjY7JpcvtzC0jv+SYk4iNvrxQAiw6DVJTfpogBNpS26Tl
+crzWQEB/UYYp1/X324WzoH16xQQ+6XPKZTwTkUahtPtri6BefMmdPF7F9iqZ3y4T
+Hn3Y2zACUteUFpO4IF13TSZunMheClatutkmwIDdZqoJCRhB+vJcf64QRSW6zA1d
+2DsCAwEAAaOByzCByDAdBgNVHQ4EFgQUJw3QVYhd3hw3lqBiFMIZPMakH9EwHwYD
+VR0jBBgwFoAUJw3QVYhd3hw3lqBiFMIZPMakH9EwNwYIKwYBBQUHAQEEKzApMCcG
+CCsGAQUFBzAChhtodHRwOi8vdXJsLWZvci1haWEvUm9vdC5jZXIwLAYDVR0fBCUw
+IzAhoB+gHYYbaHR0cDovL3VybC1mb3ItY3JsL1Jvb3QuY3JsMA4GA1UdDwEB/wQE
+AwIBBjAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQABizhARB0H
+8nw/wMEqc36ce0IgOnnNjeogxXIHD3I7UA6DHEM97WdhvtEqXVL5VFpdBPi5/WKH
+pFLP5dP/VXecgFnp9lV6WlHkk1Y1912SfZiO7RsWaMYEPSjEnCZR3KQ43NwEu96u
+iyUK4aE9In5voyZ2mN1o1eApQUItFwAY76E0QRkkjEuog0j0V6jvdtuov8Nv8n1O
+yRqEkBqFYaQwFjuiYnCWo05V+eKl8KwWP7JqS2L6c5SNW9jnNgRUk6c8WUJC9kxB
+SlSyOuppMxtb1yHFnj9vnL3XVXPmDyBgToi03qj0KT35+y1hfk1dlOCFC0dSdfaU
+rdC61TdLnzoC
+-----END CERTIFICATE-----