Verify that known roots are indeed signing themselves.

This filters out certificates with signing algorithms that we can't
handle.

Also, make unit tests better.

1 files changed, 49 insertions, 0 deletions

diff --git a/test/testdata/chains/5.96974cd6b663a7184526b1d648ad815cf51e801a.pem b/test/testdata/chains/5.96974cd6b663a7184526b1d648ad815cf51e801a.pem
new file mode 100644
index 0000000..4b0bcf5
--- /dev/null
+++ b/test/testdata/chains/5.96974cd6b663a7184526b1d648ad815cf51e801a.pem
@@ -0,0 +1,49 @@
+Certificate:
+    Data:
+        Version: 1 (0x0)
+        Serial Number:
+            ca:f6:c1:f5:70:e2:e9:03:6b:73:fc:06:92:1c:2a:f1
+    Signature Algorithm: md2WithRSAEncryption
+        Issuer: L=Internet, O=VeriSign, Inc., OU=VeriSign Individual Software Publishers CA
+        Validity
+            Not Before: Apr  9 00:00:00 1996 GMT
+            Not After : Jan  7 23:59:59 2004 GMT
+        Subject: L=Internet, O=VeriSign, Inc., OU=VeriSign Individual Software Publishers CA
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (1024 bit)
+                Modulus:
+                    00:c1:7a:ca:65:a7:2d:d5:0f:4f:6c:47:32:f8:73:
+                    77:86:e5:3d:f2:6f:79:90:b5:de:4f:d2:14:79:33:
+                    4b:b2:0e:46:fd:88:72:2a:c2:fc:64:9e:61:8f:6b:
+                    c0:5b:e8:f0:11:04:da:7a:ba:72:f6:ec:5d:af:fb:
+                    f1:97:f1:14:d2:28:e3:28:85:5c:7b:bd:8a:a2:7f:
+                    c2:33:b5:6d:0b:92:78:0b:38:71:74:85:7f:3d:ba:
+                    b9:2f:ef:be:27:48:0d:38:22:c9:56:30:8d:77:fa:
+                    5d:2c:5a:9c:97:ce:70:30:e9:51:5f:a6:8b:e4:95:
+                    96:a5:a0:17:77:f1:93:b8:29
+                Exponent: 65537 (0x10001)
+    Signature Algorithm: md2WithRSAEncryption
+         c0:8f:9f:d7:7f:0e:26:f7:47:fd:65:7b:63:92:06:46:cc:e0:
+         5e:4b:81:58:b3:97:ec:05:18:13:15:d6:97:10:2a:7f:f8:56:
+         ad:d8:0e:7a:bf:27:48:45:07:9f:25:22:ac:70:12:06:69:37:
+         80:58:58:d8:8a:34:5a:07:c6:27:da:c6:fb:9e:b1:7d:64:20:
+         80:4f:f4:a1:15:7b:19:61:af:c6:ab:c0:26:65:fe:8c:07:87:
+         3f:1a:c4:8e:b2:40:44:10:7e:2c:61:7a:fe:ad:a3:c8:be:cc:
+         bd:5e:aa:af:ac:c5:bf:11:67:58:2a:32:f3:25:dd:b6:74:43:
+         c0:7c
+-----BEGIN CERTIFICATE-----
+MIICQTCCAaoCEQDK9sH1cOLpA2tz/AaSHCrxMA0GCSqGSIb3DQEBAgUAMGExETAP
+BgNVBAcTCEludGVybmV0MRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEzMDEGA1UE
+CxMqVmVyaVNpZ24gSW5kaXZpZHVhbCBTb2Z0d2FyZSBQdWJsaXNoZXJzIENBMB4X
+DTk2MDQwOTAwMDAwMFoXDTA0MDEwNzIzNTk1OVowYTERMA8GA1UEBxMISW50ZXJu
+ZXQxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMTMwMQYDVQQLEypWZXJpU2lnbiBJ
+bmRpdmlkdWFsIFNvZnR3YXJlIFB1Ymxpc2hlcnMgQ0EwgZ8wDQYJKoZIhvcNAQEB
+BQADgY0AMIGJAoGBAMF6ymWnLdUPT2xHMvhzd4blPfJveZC13k/SFHkzS7IORv2I
+cirC/GSeYY9rwFvo8BEE2nq6cvbsXa/78ZfxFNIo4yiFXHu9iqJ/wjO1bQuSeAs4
+cXSFfz26uS/vvidIDTgiyVYwjXf6XSxanJfOcDDpUV+mi+SVlqWgF3fxk7gpAgMB
+AAEwDQYJKoZIhvcNAQECBQADgYEAwI+f138OJvdH/WV7Y5IGRszgXkuBWLOX7AUY
+ExXWlxAqf/hWrdgOer8nSEUHnyUirHASBmk3gFhY2Io0WgfGJ9rG+56xfWQggE/0
+oRV7GWGvxqvAJmX+jAeHPxrEjrJARBB+LGF6/q2jyL7MvV6qr6zFvxFnWCoy8yXd
+tnRDwHw=
+-----END CERTIFICATE-----