test: add test certs for cert intent validation

tests/pems/intent/cert_chain_generator.py

@@ -0,0 +1,157 @@
+import datetime
+from pathlib import Path
+from cryptography import x509
+from cryptography.hazmat.primitives.asymmetric import ec
+from cryptography.hazmat.primitives import hashes
+from cryptography.hazmat.primitives import serialization
+
+
+class ExtensionConfig:
+    def __init__(self, extension: x509.ExtensionType, critical: bool = True):
+        self.extension = extension
+        self.critical = critical
+
+
+class CertConfig:
+    def __init__(self, extensions: [ExtensionConfig] = []):
+        self.extensions = extensions
+        self.private_key = ec.generate_private_key(ec.SECP256R1())
+
+
+class CertChainBuilder:
+    class _CertAndKey:
+        def __init__(self, name: str, cert: x509.Certificate, private_key: ec.EllipticCurvePrivateKey):
+            self.name = name
+            self.cert = cert
+            self.private_key = private_key
+
+    class _CertChain:
+        def __init__(self, cert_chain: ["CertChainBuilder._CertAndKey"]):
+            self.cert_chain = cert_chain
+
+        def write(self, cert_dir: str):
+            assert len(self.cert_chain) > 0
+            Path(cert_dir).mkdir(exist_ok=True)
+
+            # Write each individual certificate to its own pem. This allows the trust store to be
+            # customized with specific certificates.
+            for i, cert_and_key in enumerate(self.cert_chain):
+                with open(f"{cert_dir}/{cert_and_key.name}-cert.pem", "wb") as f:
+                    f.write(cert_and_key.cert.public_bytes(encoding=serialization.Encoding.PEM))
+
+            # Write the certificate chain to be sent in the TLS handshake to a pem, which can omit
+            # the root certificate.
+            with open(f"{cert_dir}/cert-chain.pem", "wb") as f:
+                cert_chain_without_root = self.cert_chain[:-1]
+                for cert_and_key in cert_chain_without_root:
+                    f.write(cert_and_key.cert.public_bytes(encoding=serialization.Encoding.PEM))
+
+            # Write the leaf private key to a pem.
+            leaf = self.cert_chain[0]
+            with open(f"{cert_dir}/{leaf.name}-key.pem", "wb") as f:
+                f.write(leaf.private_key.private_bytes(
+                    encoding=serialization.Encoding.PEM,
+                    format=serialization.PrivateFormat.TraditionalOpenSSL,
+                    encryption_algorithm=serialization.NoEncryption(),
+                ))
+
+    def __init__(self):
+        self._configs: [CertConfig] = []
+
+    def add_cert(self, config: CertConfig):
+        self._configs.append(config)
+
+    def build(self) -> _CertChain:
+        assert len(self._configs) > 0
+
+        issuer_name = self._x509_name("root")
+        issuer_key = self._configs[0].private_key
+
+        cert_chain = []
+
+        # Build the chain from the root to the leaf.
+        for i, config in enumerate(reversed(self._configs)):
+            builder = x509.CertificateBuilder()
+
+            if i == 0:
+                name = "root"
+            elif i < len(self._configs) - 1:
+                name = f"intermediate_{i}"
+            else:
+                name = "leaf"
+            subject_name = self._x509_name(name)
+            builder = builder.subject_name(subject_name)
+
+            builder = builder.issuer_name(issuer_name)
+            builder = builder.public_key(config.private_key.public_key())
+            builder = builder.serial_number(x509.random_serial_number())
+            builder = builder.not_valid_before(datetime.datetime.now(datetime.timezone.utc))
+            builder = builder.not_valid_after(
+                datetime.datetime.now(datetime.timezone.utc) + datetime.timedelta(days=365*100)
+            )
+
+            # Add some extensions by default, to avoid specifying them in every ExtensionBuilder.
+            builder = builder.add_extension(
+                x509.SubjectKeyIdentifier.from_public_key(config.private_key.public_key()),
+                critical=False,
+            )
+            builder = builder.add_extension(
+                x509.AuthorityKeyIdentifier.from_issuer_public_key(issuer_key.public_key()),
+                critical=False,
+            )
+            if name == "leaf":
+                builder = builder.add_extension(
+                    x509.SubjectAlternativeName([x509.DNSName("localhost")]),
+                    critical=False,
+                )
+
+            for extension_config in config.extensions:
+                builder = builder.add_extension(extension_config.extension, extension_config.critical)
+
+            cert_and_key = self._CertAndKey(
+                name,
+                builder.sign(issuer_key, hashes.SHA256()),
+                config.private_key,
+            )
+            # Insert at the front of the list to allow the final certificate chain to start from
+            # the leaf and end at the root.
+            cert_chain.insert(0, cert_and_key)
+
+            issuer_name = subject_name
+            issuer_key = config.private_key
+
+        return self._CertChain(cert_chain)
+
+    @staticmethod
+    def _x509_name(common_name: str):
+        return x509.Name([
+            x509.NameAttribute(x509.NameOID.COUNTRY_NAME, "US"),
+            x509.NameAttribute(x509.NameOID.STATE_OR_PROVINCE_NAME, "Massachusetts"),
+            x509.NameAttribute(x509.NameOID.LOCALITY_NAME, "Boston"),
+            x509.NameAttribute(x509.NameOID.ORGANIZATION_NAME, "s2n"),
+            x509.NameAttribute(x509.NameOID.COMMON_NAME, common_name),
+        ])
+
+
+def key_usage_kwargs(**kwargs):
+    """
+    The cryptography.x509.KeyUsage constructor takes a mandatory argument for each KeyUsage field.
+    Rather than specify each field when creating each KeyUsage extension, have each field default
+    to False, and only specify fields that will be set to True.
+    """
+    kwargs_dict = {
+        "digital_signature": False,
+        "content_commitment": False,
+        "key_encipherment": False,
+        "data_encipherment": False,
+        "key_agreement": False,
+        "key_cert_sign": False,
+        "crl_sign": False,
+        "encipher_only": False,
+        "decipher_only": False,
+    }
+    for key in kwargs:
+        assert key in kwargs_dict
+
+    kwargs_dict.update(kwargs)
+    return kwargs_dict

tests/pems/intent/cert_chains/bc_non_ca_intermediate/cert-chain.pem

@@ -0,0 +1,26 @@
+-----BEGIN CERTIFICATE-----
+MIICCzCCAbKgAwIBAgIUb3zr2QC+mWMRq3lGij62Jr4RYC0wCgYIKoZIzj0EAwIw
+XTELMAkGA1UEBhMCVVMxFjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxDzANBgNVBAcM
+BkJvc3RvbjEMMAoGA1UECgwDczJuMRcwFQYDVQQDDA5pbnRlcm1lZGlhdGVfMTAg
+Fw0yNTAzMTExNzQ4MjJaGA8yMTI1MDIxNTE3NDgyMlowUzELMAkGA1UEBhMCVVMx
+FjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxDzANBgNVBAcMBkJvc3RvbjEMMAoGA1UE
+CgwDczJuMQ0wCwYDVQQDDARsZWFmMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE
+vRn5dVwYN9FcMXPuqhH6zGqKeZZfptEPt68BaXiGrtgsKveTqAiV8qAVlgfoo+Xb
+1Tti//3tsbP2kOZSRHKdEqNYMFYwHQYDVR0OBBYEFEbiaqgVM+Hh/0Pzxqws18cO
+xRBrMB8GA1UdIwQYMBaAFMSxsbPFKRzGPKpotDtf0Drj41XcMBQGA1UdEQQNMAuC
+CWxvY2FsaG9zdDAKBggqhkjOPQQDAgNHADBEAiBkkGeJViuZ0theRrmjXPwla7Wl
+6my0exAGP6Sx9W9RZwIgCWAqIvvPdc7AJcOBfWapoIEuPy6c0JUdiACx/+3C9fw=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICBTCCAaqgAwIBAgIUcuzhAMupv0MGds2F2q+mVZcGU2YwCgYIKoZIzj0EAwIw
+UzELMAkGA1UEBhMCVVMxFjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxDzANBgNVBAcM
+BkJvc3RvbjEMMAoGA1UECgwDczJuMQ0wCwYDVQQDDARyb290MCAXDTI1MDMxMTE3
+NDgyMloYDzIxMjUwMjE1MTc0ODIyWjBdMQswCQYDVQQGEwJVUzEWMBQGA1UECAwN
+TWFzc2FjaHVzZXR0czEPMA0GA1UEBwwGQm9zdG9uMQwwCgYDVQQKDANzMm4xFzAV
+BgNVBAMMDmludGVybWVkaWF0ZV8xMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE
+OlHBug9yazPeBJECGyMCh6eg64Qh4lXB/JLIbTA4oIKzB7M3q3AFi2ZD0mknfwUX
+8uzwAy3U/RZ3n4KzkiO/Z6NQME4wHQYDVR0OBBYEFMSxsbPFKRzGPKpotDtf0Drj
+41XcMB8GA1UdIwQYMBaAFEVcYMm7IGnHJECmPT7m1tNor9ECMAwGA1UdEwEB/wQC
+MAAwCgYIKoZIzj0EAwIDSQAwRgIhAJ0QYZ9wu1Tg2GSEGYH686w4LsQgnPSBpytx
+0bVCO5pgAiEA6lzfJ6hPVGDM79xPyvq7F7qI/3E034Sy4bbJ1UpN6y0=
+-----END CERTIFICATE-----

tests/pems/intent/cert_chains/bc_non_ca_intermediate/intermediate_1-cert.pem

@@ -0,0 +1,13 @@
+-----BEGIN CERTIFICATE-----
+MIICBTCCAaqgAwIBAgIUcuzhAMupv0MGds2F2q+mVZcGU2YwCgYIKoZIzj0EAwIw
+UzELMAkGA1UEBhMCVVMxFjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxDzANBgNVBAcM
+BkJvc3RvbjEMMAoGA1UECgwDczJuMQ0wCwYDVQQDDARyb290MCAXDTI1MDMxMTE3
+NDgyMloYDzIxMjUwMjE1MTc0ODIyWjBdMQswCQYDVQQGEwJVUzEWMBQGA1UECAwN
+TWFzc2FjaHVzZXR0czEPMA0GA1UEBwwGQm9zdG9uMQwwCgYDVQQKDANzMm4xFzAV
+BgNVBAMMDmludGVybWVkaWF0ZV8xMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE
+OlHBug9yazPeBJECGyMCh6eg64Qh4lXB/JLIbTA4oIKzB7M3q3AFi2ZD0mknfwUX
+8uzwAy3U/RZ3n4KzkiO/Z6NQME4wHQYDVR0OBBYEFMSxsbPFKRzGPKpotDtf0Drj
+41XcMB8GA1UdIwQYMBaAFEVcYMm7IGnHJECmPT7m1tNor9ECMAwGA1UdEwEB/wQC
+MAAwCgYIKoZIzj0EAwIDSQAwRgIhAJ0QYZ9wu1Tg2GSEGYH686w4LsQgnPSBpytx
+0bVCO5pgAiEA6lzfJ6hPVGDM79xPyvq7F7qI/3E034Sy4bbJ1UpN6y0=
+-----END CERTIFICATE-----

tests/pems/intent/cert_chains/bc_non_ca_intermediate/leaf-cert.pem

@@ -0,0 +1,13 @@
+-----BEGIN CERTIFICATE-----
+MIICCzCCAbKgAwIBAgIUb3zr2QC+mWMRq3lGij62Jr4RYC0wCgYIKoZIzj0EAwIw
+XTELMAkGA1UEBhMCVVMxFjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxDzANBgNVBAcM
+BkJvc3RvbjEMMAoGA1UECgwDczJuMRcwFQYDVQQDDA5pbnRlcm1lZGlhdGVfMTAg
+Fw0yNTAzMTExNzQ4MjJaGA8yMTI1MDIxNTE3NDgyMlowUzELMAkGA1UEBhMCVVMx
+FjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxDzANBgNVBAcMBkJvc3RvbjEMMAoGA1UE
+CgwDczJuMQ0wCwYDVQQDDARsZWFmMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE
+vRn5dVwYN9FcMXPuqhH6zGqKeZZfptEPt68BaXiGrtgsKveTqAiV8qAVlgfoo+Xb
+1Tti//3tsbP2kOZSRHKdEqNYMFYwHQYDVR0OBBYEFEbiaqgVM+Hh/0Pzxqws18cO
+xRBrMB8GA1UdIwQYMBaAFMSxsbPFKRzGPKpotDtf0Drj41XcMBQGA1UdEQQNMAuC
+CWxvY2FsaG9zdDAKBggqhkjOPQQDAgNHADBEAiBkkGeJViuZ0theRrmjXPwla7Wl
+6my0exAGP6Sx9W9RZwIgCWAqIvvPdc7AJcOBfWapoIEuPy6c0JUdiACx/+3C9fw=
+-----END CERTIFICATE-----

tests/pems/intent/cert_chains/bc_non_ca_intermediate/leaf-key.pem

@@ -0,0 +1,5 @@
+-----BEGIN EC PRIVATE KEY-----
+MHcCAQEEIBSkunuaOjt1IN5T6rmlqYsmIPKT/LbpP0YPaomtsBBRoAoGCCqGSM49
+AwEHoUQDQgAEvRn5dVwYN9FcMXPuqhH6zGqKeZZfptEPt68BaXiGrtgsKveTqAiV
+8qAVlgfoo+Xb1Tti//3tsbP2kOZSRHKdEg==
+-----END EC PRIVATE KEY-----

tests/pems/intent/cert_chains/bc_non_ca_intermediate/root-cert.pem

@@ -0,0 +1,13 @@
+-----BEGIN CERTIFICATE-----
+MIIB/TCCAaOgAwIBAgIUPZ9gCwdPf5eWOpWjXqM2Xq1u9+owCgYIKoZIzj0EAwIw
+UzELMAkGA1UEBhMCVVMxFjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxDzANBgNVBAcM
+BkJvc3RvbjEMMAoGA1UECgwDczJuMQ0wCwYDVQQDDARyb290MCAXDTI1MDMxMTE3
+NDgyMloYDzIxMjUwMjE1MTc0ODIyWjBTMQswCQYDVQQGEwJVUzEWMBQGA1UECAwN
+TWFzc2FjaHVzZXR0czEPMA0GA1UEBwwGQm9zdG9uMQwwCgYDVQQKDANzMm4xDTAL
+BgNVBAMMBHJvb3QwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAATzGozb11zJZgUE
+vRKrVTacFwhpHZ+kAVyKyDnYPyHzS09gRVDdriF0Sn8QdBuaVQrVqOlKu94W9MTU
+PcbifDZvo1MwUTAdBgNVHQ4EFgQURVxgybsgacckQKY9PubW02iv0QIwHwYDVR0j
+BBgwFoAURuJqqBUz4eH/Q/PGrCzXxw7FEGswDwYDVR0TAQH/BAUwAwEB/zAKBggq
+hkjOPQQDAgNIADBFAiEA3FyPOjHduIoOQZSlhUlnLBqElvk2mHcD2cbH+p485aoC
+ICeEuJ+c/Cs68dyBGLWCEPnB1Q24AqKTY1o46wNSA0ov
+-----END CERTIFICATE-----

tests/pems/intent/cert_chains/eku_clientAuth_and_serverAuth_and_emailProtection_intermediate/cert-chain.pem

@@ -0,0 +1,28 @@
+-----BEGIN CERTIFICATE-----
+MIICDTCCAbKgAwIBAgIUB6m5iUwO8BKuYQDSfZURZlCVr+swCgYIKoZIzj0EAwIw
+XTELMAkGA1UEBhMCVVMxFjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxDzANBgNVBAcM
+BkJvc3RvbjEMMAoGA1UECgwDczJuMRcwFQYDVQQDDA5pbnRlcm1lZGlhdGVfMTAg
+Fw0yNTAzMTExNzQ4MjJaGA8yMTI1MDIxNTE3NDgyMlowUzELMAkGA1UEBhMCVVMx
+FjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxDzANBgNVBAcMBkJvc3RvbjEMMAoGA1UE
+CgwDczJuMQ0wCwYDVQQDDARsZWFmMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE
+WYMrno5ni/9wZx0u+fj7d6KXk5dqpl9x6xZ2NX/OmxdhDaylJArW5Isaw4K+kaBD
+BptA8kJ2PS84A6DVWeaZvaNYMFYwHQYDVR0OBBYEFGzlCFdddV5dNlkLsfQwBBrt
+F2+5MB8GA1UdIwQYMBaAFJvnhV8Uq3Da8R358D7oGnnALKvfMBQGA1UdEQQNMAuC
+CWxvY2FsaG9zdDAKBggqhkjOPQQDAgNJADBGAiEAxJO7enqHD9nzRgAv5emtWtXK
+2p+Obu9ijpEQ5Q35cAsCIQDcuDq4VELIqhN5tDNZjX0bYP5s5qbTdPjunKAiGlHp
+XA==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICMzCCAdmgAwIBAgIUEw098E3BYb7r+TZCEtjiZ0N+KRYwCgYIKoZIzj0EAwIw
+UzELMAkGA1UEBhMCVVMxFjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxDzANBgNVBAcM
+BkJvc3RvbjEMMAoGA1UECgwDczJuMQ0wCwYDVQQDDARyb290MCAXDTI1MDMxMTE3
+NDgyMloYDzIxMjUwMjE1MTc0ODIyWjBdMQswCQYDVQQGEwJVUzEWMBQGA1UECAwN
+TWFzc2FjaHVzZXR0czEPMA0GA1UEBwwGQm9zdG9uMQwwCgYDVQQKDANzMm4xFzAV
+BgNVBAMMDmludGVybWVkaWF0ZV8xMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE
+lyuPEELNVhkIFpSlkP2IuksfVml7l1p9dal/3E5yWx80LRf5XZ8tcU/9jpOyn5lM
+2wUGnTTzneuiX7IShcK7r6N/MH0wHQYDVR0OBBYEFJvnhV8Uq3Da8R358D7oGnnA
+LKvfMB8GA1UdIwQYMBaAFGincFdiDlfasUlhzl1eOScfuSxtMCoGA1UdJQEB/wQg
+MB4GCCsGAQUFBwMCBggrBgEFBQcDAQYIKwYBBQUHAwQwDwYDVR0TAQH/BAUwAwEB
+/zAKBggqhkjOPQQDAgNIADBFAiEA74t+aMgPcjjyCLxobdLeqjz3iDyeZkPgp4X0
+jzaFaaUCICf/QBQDOqYylcgOoSA5oJvTDVL713hM2j+PQmnWa26Z
+-----END CERTIFICATE-----

tests/pems/intent/cert_chains/eku_clientAuth_and_serverAuth_and_emailProtection_intermediate/intermediate_1-cert.pem

@@ -0,0 +1,14 @@
+-----BEGIN CERTIFICATE-----
+MIICMzCCAdmgAwIBAgIUEw098E3BYb7r+TZCEtjiZ0N+KRYwCgYIKoZIzj0EAwIw
+UzELMAkGA1UEBhMCVVMxFjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxDzANBgNVBAcM
+BkJvc3RvbjEMMAoGA1UECgwDczJuMQ0wCwYDVQQDDARyb290MCAXDTI1MDMxMTE3
+NDgyMloYDzIxMjUwMjE1MTc0ODIyWjBdMQswCQYDVQQGEwJVUzEWMBQGA1UECAwN
+TWFzc2FjaHVzZXR0czEPMA0GA1UEBwwGQm9zdG9uMQwwCgYDVQQKDANzMm4xFzAV
+BgNVBAMMDmludGVybWVkaWF0ZV8xMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE
+lyuPEELNVhkIFpSlkP2IuksfVml7l1p9dal/3E5yWx80LRf5XZ8tcU/9jpOyn5lM
+2wUGnTTzneuiX7IShcK7r6N/MH0wHQYDVR0OBBYEFJvnhV8Uq3Da8R358D7oGnnA
+LKvfMB8GA1UdIwQYMBaAFGincFdiDlfasUlhzl1eOScfuSxtMCoGA1UdJQEB/wQg
+MB4GCCsGAQUFBwMCBggrBgEFBQcDAQYIKwYBBQUHAwQwDwYDVR0TAQH/BAUwAwEB
+/zAKBggqhkjOPQQDAgNIADBFAiEA74t+aMgPcjjyCLxobdLeqjz3iDyeZkPgp4X0
+jzaFaaUCICf/QBQDOqYylcgOoSA5oJvTDVL713hM2j+PQmnWa26Z
+-----END CERTIFICATE-----

tests/pems/intent/cert_chains/eku_clientAuth_and_serverAuth_and_emailProtection_intermediate/leaf-cert.pem

@@ -0,0 +1,14 @@
+-----BEGIN CERTIFICATE-----
+MIICDTCCAbKgAwIBAgIUB6m5iUwO8BKuYQDSfZURZlCVr+swCgYIKoZIzj0EAwIw
+XTELMAkGA1UEBhMCVVMxFjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxDzANBgNVBAcM
+BkJvc3RvbjEMMAoGA1UECgwDczJuMRcwFQYDVQQDDA5pbnRlcm1lZGlhdGVfMTAg
+Fw0yNTAzMTExNzQ4MjJaGA8yMTI1MDIxNTE3NDgyMlowUzELMAkGA1UEBhMCVVMx
+FjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxDzANBgNVBAcMBkJvc3RvbjEMMAoGA1UE
+CgwDczJuMQ0wCwYDVQQDDARsZWFmMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE
+WYMrno5ni/9wZx0u+fj7d6KXk5dqpl9x6xZ2NX/OmxdhDaylJArW5Isaw4K+kaBD
+BptA8kJ2PS84A6DVWeaZvaNYMFYwHQYDVR0OBBYEFGzlCFdddV5dNlkLsfQwBBrt
+F2+5MB8GA1UdIwQYMBaAFJvnhV8Uq3Da8R358D7oGnnALKvfMBQGA1UdEQQNMAuC
+CWxvY2FsaG9zdDAKBggqhkjOPQQDAgNJADBGAiEAxJO7enqHD9nzRgAv5emtWtXK
+2p+Obu9ijpEQ5Q35cAsCIQDcuDq4VELIqhN5tDNZjX0bYP5s5qbTdPjunKAiGlHp
+XA==
+-----END CERTIFICATE-----

tests/pems/intent/cert_chains/eku_clientAuth_and_serverAuth_and_emailProtection_intermediate/leaf-key.pem

@@ -0,0 +1,5 @@
+-----BEGIN EC PRIVATE KEY-----
+MHcCAQEEIIQWyNlURou07akwqRfgXbyHArHFMkslO8emi+KCo6qPoAoGCCqGSM49
+AwEHoUQDQgAEWYMrno5ni/9wZx0u+fj7d6KXk5dqpl9x6xZ2NX/OmxdhDaylJArW
+5Isaw4K+kaBDBptA8kJ2PS84A6DVWeaZvQ==
+-----END EC PRIVATE KEY-----

tests/pems/intent/cert_chains/eku_clientAuth_and_serverAuth_and_emailProtection_intermediate/root-cert.pem

@@ -0,0 +1,13 @@
+-----BEGIN CERTIFICATE-----
+MIIB/jCCAaOgAwIBAgIUbqfc7n8juXqcA5PL4sAO+QcwRzYwCgYIKoZIzj0EAwIw
+UzELMAkGA1UEBhMCVVMxFjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxDzANBgNVBAcM
+BkJvc3RvbjEMMAoGA1UECgwDczJuMQ0wCwYDVQQDDARyb290MCAXDTI1MDMxMTE3
+NDgyMloYDzIxMjUwMjE1MTc0ODIyWjBTMQswCQYDVQQGEwJVUzEWMBQGA1UECAwN
+TWFzc2FjaHVzZXR0czEPMA0GA1UEBwwGQm9zdG9uMQwwCgYDVQQKDANzMm4xDTAL
+BgNVBAMMBHJvb3QwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAATLfRrfg7RLz96R
+/oJxQjcycVh2+yJEHejCogWS3Xjkl+XM3G7PzJS9LH5MvifQkhxdwR9IRyhks1pH
+klIm3x7to1MwUTAdBgNVHQ4EFgQUaKdwV2IOV9qxSWHOXV45Jx+5LG0wHwYDVR0j
+BBgwFoAUbOUIV111Xl02WQux9DAEGu0Xb7kwDwYDVR0TAQH/BAUwAwEB/zAKBggq
+hkjOPQQDAgNJADBGAiEAmxSI8Yrr8I/e0JyAP580h1SQrbvFdRh5wC1o5gD1+FIC
+IQC5Lewswt1Xu5J8ssWg0H6i8tW37AS3l4RCJ6R1MH86sg==
+-----END CERTIFICATE-----

tests/pems/intent/cert_chains/eku_clientAuth_and_serverAuth_and_emailProtection_leaf/cert-chain.pem

@@ -0,0 +1,14 @@
+-----BEGIN CERTIFICATE-----
+MIICMTCCAdagAwIBAgIUO6Yp3G8/pBJ5Q1jmaQX+/n6YVe8wCgYIKoZIzj0EAwIw
+UzELMAkGA1UEBhMCVVMxFjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxDzANBgNVBAcM
+BkJvc3RvbjEMMAoGA1UECgwDczJuMQ0wCwYDVQQDDARyb290MCAXDTI1MDMxMTE3
+NDgyMloYDzIxMjUwMjE1MTc0ODIyWjBTMQswCQYDVQQGEwJVUzEWMBQGA1UECAwN
+TWFzc2FjaHVzZXR0czEPMA0GA1UEBwwGQm9zdG9uMQwwCgYDVQQKDANzMm4xDTAL
+BgNVBAMMBGxlYWYwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARHs+0YQ+JWqn3k
+WOJlI8PgpcwM4lbDXsziZo/HjYcN6EwG6AECodSMFiaQtLDxYKFeqM3zO6KAN7ar
+syh1OipAo4GFMIGCMB0GA1UdDgQWBBRO1gEGK/pbBtZk/0bBlZJ95LBTxDAfBgNV
+HSMEGDAWgBS2+Ho8pK0TmXpH8aYcvhkd+rw69zAUBgNVHREEDTALgglsb2NhbGhv
+c3QwKgYDVR0lAQH/BCAwHgYIKwYBBQUHAwIGCCsGAQUFBwMBBggrBgEFBQcDBDAK
+BggqhkjOPQQDAgNJADBGAiEAkqVMYyJAvLadEdv/Ub4eulmq8iKMyguuu13NKyn/
+DwACIQCXoYq/QxqFgMinNigz6bf3PwHtOjl6i/WK6J/0VrNU4Q==
+-----END CERTIFICATE-----

tests/pems/intent/cert_chains/eku_clientAuth_and_serverAuth_and_emailProtection_leaf/leaf-cert.pem

@@ -0,0 +1,14 @@
+-----BEGIN CERTIFICATE-----
+MIICMTCCAdagAwIBAgIUO6Yp3G8/pBJ5Q1jmaQX+/n6YVe8wCgYIKoZIzj0EAwIw
+UzELMAkGA1UEBhMCVVMxFjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxDzANBgNVBAcM
+BkJvc3RvbjEMMAoGA1UECgwDczJuMQ0wCwYDVQQDDARyb290MCAXDTI1MDMxMTE3
+NDgyMloYDzIxMjUwMjE1MTc0ODIyWjBTMQswCQYDVQQGEwJVUzEWMBQGA1UECAwN
+TWFzc2FjaHVzZXR0czEPMA0GA1UEBwwGQm9zdG9uMQwwCgYDVQQKDANzMm4xDTAL
+BgNVBAMMBGxlYWYwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARHs+0YQ+JWqn3k
+WOJlI8PgpcwM4lbDXsziZo/HjYcN6EwG6AECodSMFiaQtLDxYKFeqM3zO6KAN7ar
+syh1OipAo4GFMIGCMB0GA1UdDgQWBBRO1gEGK/pbBtZk/0bBlZJ95LBTxDAfBgNV
+HSMEGDAWgBS2+Ho8pK0TmXpH8aYcvhkd+rw69zAUBgNVHREEDTALgglsb2NhbGhv
+c3QwKgYDVR0lAQH/BCAwHgYIKwYBBQUHAwIGCCsGAQUFBwMBBggrBgEFBQcDBDAK
+BggqhkjOPQQDAgNJADBGAiEAkqVMYyJAvLadEdv/Ub4eulmq8iKMyguuu13NKyn/
+DwACIQCXoYq/QxqFgMinNigz6bf3PwHtOjl6i/WK6J/0VrNU4Q==
+-----END CERTIFICATE-----

tests/pems/intent/cert_chains/eku_clientAuth_and_serverAuth_and_emailProtection_leaf/leaf-key.pem

@@ -0,0 +1,5 @@
+-----BEGIN EC PRIVATE KEY-----
+MHcCAQEEIG0BEqAcMK33aopW12KmORMvXheUDher0W38L55o+njfoAoGCCqGSM49
+AwEHoUQDQgAER7PtGEPiVqp95FjiZSPD4KXMDOJWw17M4maPx42HDehMBugBAqHU
+jBYmkLSw8WChXqjN8zuigDe2q7ModToqQA==
+-----END EC PRIVATE KEY-----

tests/pems/intent/cert_chains/eku_clientAuth_and_serverAuth_and_emailProtection_leaf/root-cert.pem

@@ -0,0 +1,13 @@
+-----BEGIN CERTIFICATE-----
+MIIB/TCCAaOgAwIBAgIUVZE/F5G+yPjays7N9TlBkARSLHMwCgYIKoZIzj0EAwIw
+UzELMAkGA1UEBhMCVVMxFjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxDzANBgNVBAcM
+BkJvc3RvbjEMMAoGA1UECgwDczJuMQ0wCwYDVQQDDARyb290MCAXDTI1MDMxMTE3
+NDgyMloYDzIxMjUwMjE1MTc0ODIyWjBTMQswCQYDVQQGEwJVUzEWMBQGA1UECAwN
+TWFzc2FjaHVzZXR0czEPMA0GA1UEBwwGQm9zdG9uMQwwCgYDVQQKDANzMm4xDTAL
+BgNVBAMMBHJvb3QwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAR8KZjUaNG+WHnn
+QIPe4ZaPVv5N9pc+2EB4HymVHkWoAR+9bEOnQosIOk8LXP83r9/XyMfHCQ+tqCs3
+rDi22Hm0o1MwUTAdBgNVHQ4EFgQUtvh6PKStE5l6R/GmHL4ZHfq8OvcwHwYDVR0j
+BBgwFoAUTtYBBiv6WwbWZP9GwZWSfeSwU8QwDwYDVR0TAQH/BAUwAwEB/zAKBggq
+hkjOPQQDAgNIADBFAiEAhlyv1nSkvU7pkTrLGnFq08aBfbFBkHmZieFg1gpJnbEC
+IEnz+yTPsh8zfaNx1/yJ7wLrPK+ttvpB7/HYGNOwYrdJ
+-----END CERTIFICATE-----

tests/pems/intent/cert_chains/eku_clientAuth_and_serverAuth_intermediate/cert-chain.pem

@@ -0,0 +1,28 @@
+-----BEGIN CERTIFICATE-----
+MIICDTCCAbKgAwIBAgIUHm6huyJ30S6f+cDxHBM9ivztFDcwCgYIKoZIzj0EAwIw
+XTELMAkGA1UEBhMCVVMxFjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxDzANBgNVBAcM
+BkJvc3RvbjEMMAoGA1UECgwDczJuMRcwFQYDVQQDDA5pbnRlcm1lZGlhdGVfMTAg
+Fw0yNTAzMTExNzQ4MjJaGA8yMTI1MDIxNTE3NDgyMlowUzELMAkGA1UEBhMCVVMx
+FjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxDzANBgNVBAcMBkJvc3RvbjEMMAoGA1UE
+CgwDczJuMQ0wCwYDVQQDDARsZWFmMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE
+yQJ3o0nOGUVn2lc4gc0LZtlZKE4YvhPNlyzknVLGYMD5HLkRyrKAWtdwISBgY5q+
+ItJk/MPo1/Ut8976rvyQ2aNYMFYwHQYDVR0OBBYEFAKwLvI+lL0cOKvQ1YNalaC/
+YvF+MB8GA1UdIwQYMBaAFAA9CkdQsRuHvE50L1Yur+VuvEDJMBQGA1UdEQQNMAuC
+CWxvY2FsaG9zdDAKBggqhkjOPQQDAgNJADBGAiEAtsRd90syj0tWlqjsAqxFdQL4
+PcAmy3LruCDd4Mf/ix4CIQDP81tcr2oj4Caylq1RM0MG4mzhZYL6/4pTF9aLWTPr
+sQ==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICKDCCAc+gAwIBAgIUTDQSg/U//IM1aE2ZQ8tX6cYMDnwwCgYIKoZIzj0EAwIw
+UzELMAkGA1UEBhMCVVMxFjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxDzANBgNVBAcM
+BkJvc3RvbjEMMAoGA1UECgwDczJuMQ0wCwYDVQQDDARyb290MCAXDTI1MDMxMTE3
+NDgyMloYDzIxMjUwMjE1MTc0ODIyWjBdMQswCQYDVQQGEwJVUzEWMBQGA1UECAwN
+TWFzc2FjaHVzZXR0czEPMA0GA1UEBwwGQm9zdG9uMQwwCgYDVQQKDANzMm4xFzAV
+BgNVBAMMDmludGVybWVkaWF0ZV8xMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE
+6dPmSrohMv9IpgTL7frKM6g3LMVAVIzPuBAhWAzF+yDVcZP5507pN61c7dQ4T7rL
+SNOvl7S04CzM3KPyTEAQI6N1MHMwHQYDVR0OBBYEFAA9CkdQsRuHvE50L1Yur+Vu
+vEDJMB8GA1UdIwQYMBaAFAjJ15kuS/dzlzZtSHqiroeDdDG9MCAGA1UdJQEB/wQW
+MBQGCCsGAQUFBwMCBggrBgEFBQcDATAPBgNVHRMBAf8EBTADAQH/MAoGCCqGSM49
+BAMCA0cAMEQCIBudqL1IchfZaad3yKMIncqGEcgoxc+IBARSScPHmOYzAiApNsWL
+62dO1bkORKzCpcqlPF9Hgwe+IuFl1Y37/tlkZg==
+-----END CERTIFICATE-----