blob: b9f9182007d80de278206042cbca05e2c834c367 [file] [log] [blame]
[Created by: generate-key-rollover.py]
A certificate tree with two self-signed root certificates(oldroot, newroot),
and a third root certificate (newrootrollover) which has the same key as newroot
but is signed by oldroot, all with the same subject and issuer.
There are two intermediates with the same key, subject and issuer
(oldintermediate signed by oldroot, and newintermediate signed by newroot).
The target certificate is signed by the intermediate key.
In graphical form:
oldroot-------->newrootrollover newroot
| | |
v v v
oldintermediate newintermediate
| |
+------------+-------------+
|
v
target
Several chains are output:
key-rollover-oldchain.pem:
target<-oldintermediate<-oldroot
key-rollover-rolloverchain.pem:
target<-newintermediate<-newrootrollover<-oldroot
key-rollover-longrolloverchain.pem:
target<-newintermediate<-newroot<-newrootrollover<-oldroot
key-rollover-newchain.pem:
target<-newintermediate<-newroot
All of these chains should verify successfully.
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 1 (0x1)
Signature Algorithm: sha256WithRSAEncryption
Issuer: CN=Intermediate
Validity
Not Before: Jan 1 12:00:00 2015 GMT
Not After : Jan 1 12:00:00 2016 GMT
Subject: CN=Target
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
00:d0:14:31:90:c4:c6:d0:b9:10:9e:e4:7a:e2:bc:
16:ab:d2:5e:d7:3d:00:11:bf:25:0b:32:17:57:c4:
fb:f6:60:0d:5a:7c:43:08:88:e6:35:f7:39:0f:dc:
d7:ef:22:18:52:5b:de:27:35:10:93:ab:c0:ae:98:
1b:e1:c7:40:a8:be:84:2a:e6:69:7c:c4:68:1e:c4:
0d:29:97:55:12:fb:30:86:a3:8f:03:0c:d4:4b:22:
76:ac:a8:db:fd:20:4c:46:ea:21:9b:59:4f:ea:9c:
20:6f:ff:e1:7c:7d:64:5c:4b:91:4d:ac:56:1d:19:
12:6c:af:f2:99:40:21:9d:06:b9:a2:90:2c:7b:bc:
af:fe:c0:40:a1:06:89:62:f3:f3:fd:a0:07:61:aa:
c2:f9:e1:0e:13:96:92:ac:53:ba:ed:a5:36:c9:b9:
04:e7:13:67:bc:0e:63:dc:22:29:53:e2:e3:59:ab:
5c:25:cd:d9:fb:46:4e:91:70:dd:41:4b:35:87:a4:
fd:2c:66:be:75:7e:03:e9:12:61:66:cb:19:88:a1:
61:b7:13:b4:ab:51:a6:d5:58:9c:db:8c:a2:1a:da:
c3:6f:cb:b6:b1:65:d8:a3:a3:d1:87:d8:b9:bb:b8:
c1:83:f1:83:38:2a:fd:a3:f6:a6:59:f2:27:f1:e3:
50:29
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Subject Key Identifier:
01:D0:19:F4:6B:86:BC:17:3B:FB:74:95:0F:53:BD:BD:4E:CA:10:D6
X509v3 Authority Key Identifier:
keyid:D3:97:C6:F7:B9:E5:17:69:6D:78:39:77:3A:0A:AD:32:2D:40:AC:07
Authority Information Access:
CA Issuers - URI:http://url-for-aia/Intermediate.cer
X509v3 CRL Distribution Points:
Full Name:
URI:http://url-for-crl/Intermediate.crl
X509v3 Key Usage: critical
Digital Signature, Key Encipherment
X509v3 Extended Key Usage:
TLS Web Server Authentication, TLS Web Client Authentication
Signature Algorithm: sha256WithRSAEncryption
0e:b6:ad:85:34:3d:cf:9c:2f:8c:e7:90:80:33:f6:12:99:40:
6d:89:7b:5c:08:c9:a9:fc:40:24:1e:14:ac:6c:6a:11:aa:3e:
ea:c1:19:32:75:67:26:fe:c0:f9:55:e9:b6:04:74:c9:e3:22:
59:3a:06:5a:5f:25:6d:1d:df:48:62:a4:ee:d0:87:df:20:9d:
9c:95:aa:4e:77:05:28:e6:66:ac:ae:23:e4:74:df:5a:b4:21:
e7:3d:0f:95:61:84:11:7e:d8:72:66:dd:85:c7:41:fe:44:12:
da:4c:c7:1b:ab:7d:4b:3d:c4:38:2d:b9:54:8a:26:1e:76:1b:
f6:0b:8a:e9:fa:9f:0a:e6:cc:6d:c5:55:f1:a5:29:20:42:05:
d4:5a:4f:27:ab:b6:e4:c4:ea:4d:8b:97:53:67:03:75:32:1f:
9d:1e:b8:72:e1:c4:5a:09:15:d7:ce:a3:59:ed:cc:4d:0f:ea:
c0:1d:57:1a:43:d7:7a:63:86:b0:b8:5c:4f:34:29:a4:be:90:
c4:6b:39:20:c9:25:96:7d:a1:cc:ee:f7:57:04:69:d7:21:66:
1d:cc:4e:6c:10:1a:6e:87:11:f3:e3:ae:9e:5b:64:04:ee:ac:
c6:0a:24:80:e4:0a:0e:89:49:9d:0f:1d:74:b2:f6:db:7e:25:
a1:d0:6e:7e
-----BEGIN CERTIFICATE-----
MIIDjTCCAnWgAwIBAgIBATANBgkqhkiG9w0BAQsFADAXMRUwEwYDVQQDDAxJbnRl
cm1lZGlhdGUwHhcNMTUwMTAxMTIwMDAwWhcNMTYwMTAxMTIwMDAwWjARMQ8wDQYD
VQQDDAZUYXJnZXQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDQFDGQ
xMbQuRCe5HrivBar0l7XPQARvyULMhdXxPv2YA1afEMIiOY19zkP3NfvIhhSW94n
NRCTq8CumBvhx0CovoQq5ml8xGgexA0pl1US+zCGo48DDNRLInasqNv9IExG6iGb
WU/qnCBv/+F8fWRcS5FNrFYdGRJsr/KZQCGdBrmikCx7vK/+wEChBoli8/P9oAdh
qsL54Q4TlpKsU7rtpTbJuQTnE2e8DmPcIilT4uNZq1wlzdn7Rk6RcN1BSzWHpP0s
Zr51fgPpEmFmyxmIoWG3E7SrUabVWJzbjKIa2sNvy7axZdijo9GH2Lm7uMGD8YM4
Kv2j9qZZ8ifx41ApAgMBAAGjgekwgeYwHQYDVR0OBBYEFAHQGfRrhrwXO/t0lQ9T
vb1OyhDWMB8GA1UdIwQYMBaAFNOXxve55RdpbXg5dzoKrTItQKwHMD8GCCsGAQUF
BwEBBDMwMTAvBggrBgEFBQcwAoYjaHR0cDovL3VybC1mb3ItYWlhL0ludGVybWVk
aWF0ZS5jZXIwNAYDVR0fBC0wKzApoCegJYYjaHR0cDovL3VybC1mb3ItY3JsL0lu
dGVybWVkaWF0ZS5jcmwwDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUF
BwMBBggrBgEFBQcDAjANBgkqhkiG9w0BAQsFAAOCAQEADrathTQ9z5wvjOeQgDP2
EplAbYl7XAjJqfxAJB4UrGxqEao+6sEZMnVnJv7A+VXptgR0yeMiWToGWl8lbR3f
SGKk7tCH3yCdnJWqTncFKOZmrK4j5HTfWrQh5z0PlWGEEX7YcmbdhcdB/kQS2kzH
G6t9Sz3EOC25VIomHnYb9guK6fqfCubMbcVV8aUpIEIF1FpPJ6u25MTqTYuXU2cD
dTIfnR64cuHEWgkV186jWe3MTQ/qwB1XGkPXemOGsLhcTzQppL6QxGs5IMklln2h
zO73VwRp1yFmHcxObBAabocR8+OunltkBO6sxgokgOQKDolJnQ8ddLL2234lodBu
fg==
-----END CERTIFICATE-----
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 2 (0x2)
Signature Algorithm: sha256WithRSAEncryption
Issuer: CN=Root
Validity
Not Before: Jan 1 12:00:00 2015 GMT
Not After : Jan 1 12:00:00 2016 GMT
Subject: CN=Intermediate
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
00:bf:ca:00:55:10:61:e4:0e:a3:f8:57:b8:7b:19:
34:5a:77:b8:06:39:88:07:0c:ec:d0:3b:4a:53:02:
3c:d1:d3:da:48:ae:8a:1a:1c:3d:30:bb:b3:36:80:
a1:6f:cd:32:fd:54:26:b9:77:d7:1e:11:30:6c:eb:
d7:11:9a:d9:af:54:7e:0e:37:c3:8d:f3:0a:5d:ec:
82:d6:6e:f3:46:f4:2a:82:24:e4:28:38:c2:fa:6a:
a6:f7:38:cd:94:50:20:bd:ee:50:9e:3a:a3:40:1a:
49:77:eb:b2:05:8c:01:46:e6:ef:8f:55:91:0a:7a:
44:10:62:b8:9f:3e:81:31:ae:08:95:29:37:47:53:
ec:f3:c7:9c:f0:be:64:70:b3:81:f0:04:f4:a4:aa:
41:ad:16:8f:13:31:af:9b:eb:55:dc:93:6d:56:cf:
d6:f0:0a:fb:11:9e:32:59:d4:07:28:e1:fe:60:73:
bf:43:bf:ff:c9:dc:f2:ca:3a:e1:0c:bd:90:0b:c2:
ab:91:d5:2e:72:5d:5e:f0:f8:45:7b:3d:37:89:d1:
16:bd:9b:4f:c9:c4:34:c7:c4:23:a4:04:4b:13:db:
1a:b5:82:d0:f6:cd:99:fe:f3:0d:98:81:65:5e:2f:
9e:a4:c1:5b:2b:67:b5:07:2a:24:a6:e7:06:5f:49:
d6:d5
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Subject Key Identifier:
D3:97:C6:F7:B9:E5:17:69:6D:78:39:77:3A:0A:AD:32:2D:40:AC:07
X509v3 Authority Key Identifier:
keyid:5D:A1:03:3D:8F:13:F9:08:AF:1E:83:6C:BC:DE:6F:A3:B5:C2:1A:EA
Authority Information Access:
CA Issuers - URI:http://url-for-aia/Root.cer
X509v3 CRL Distribution Points:
Full Name:
URI:http://url-for-crl/Root.crl
X509v3 Key Usage: critical
Certificate Sign, CRL Sign
X509v3 Basic Constraints: critical
CA:TRUE
Signature Algorithm: sha256WithRSAEncryption
9f:f2:71:1d:88:6c:57:db:19:12:ed:da:7c:5e:ef:81:90:30:
2f:f8:9a:df:de:90:bc:9d:6b:26:64:10:87:b8:45:78:8d:8d:
37:fe:c8:86:75:d0:a2:c5:88:78:b6:8d:30:f7:8c:63:5e:3f:
8d:7d:54:81:68:80:34:dd:cf:37:73:24:91:ef:42:7a:5c:ed:
94:9a:b9:6f:a6:13:1d:04:9d:0a:e6:53:eb:6c:2d:7b:24:06:
b3:d4:3a:79:94:17:68:9e:c2:36:91:b7:30:f2:cf:c3:6c:22:
2d:73:2c:e6:ca:d0:97:db:a1:f6:7e:2e:e2:5b:27:d5:86:a9:
ec:92:3b:f9:5d:ae:bd:f9:a7:d6:a9:dd:f9:93:49:2d:f1:99:
a6:98:10:43:0e:2f:98:97:e0:17:36:86:57:75:22:63:65:39:
eb:69:e9:cc:4d:9c:9b:35:63:5b:1b:04:fb:7a:b4:91:30:a2:
5c:4e:c0:a8:7c:94:ce:4c:d8:eb:f2:fe:34:be:e6:76:bc:fe:
8c:9e:d3:3b:6d:ae:62:92:8b:0f:41:9c:d7:65:0d:7b:1b:c5:
e9:5f:11:a2:f1:18:22:5e:0d:e7:9b:b7:b7:c5:34:77:ef:32:
b5:94:ef:dd:a6:6e:a7:07:43:c9:7f:b8:04:2a:88:53:44:93:
a2:db:05:93
-----BEGIN CERTIFICATE-----
MIIDbTCCAlWgAwIBAgIBAjANBgkqhkiG9w0BAQsFADAPMQ0wCwYDVQQDDARSb290
MB4XDTE1MDEwMTEyMDAwMFoXDTE2MDEwMTEyMDAwMFowFzEVMBMGA1UEAwwMSW50
ZXJtZWRpYXRlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAv8oAVRBh
5A6j+Fe4exk0Wne4BjmIBwzs0DtKUwI80dPaSK6KGhw9MLuzNoChb80y/VQmuXfX
HhEwbOvXEZrZr1R+DjfDjfMKXeyC1m7zRvQqgiTkKDjC+mqm9zjNlFAgve5Qnjqj
QBpJd+uyBYwBRubvj1WRCnpEEGK4nz6BMa4IlSk3R1Ps88ec8L5kcLOB8AT0pKpB
rRaPEzGvm+tV3JNtVs/W8Ar7EZ4yWdQHKOH+YHO/Q7//ydzyyjrhDL2QC8KrkdUu
cl1e8PhFez03idEWvZtPycQ0x8QjpARLE9satYLQ9s2Z/vMNmIFlXi+epMFbK2e1
ByokpucGX0nW1QIDAQABo4HLMIHIMB0GA1UdDgQWBBTTl8b3ueUXaW14OXc6Cq0y
LUCsBzAfBgNVHSMEGDAWgBRdoQM9jxP5CK8eg2y83m+jtcIa6jA3BggrBgEFBQcB
AQQrMCkwJwYIKwYBBQUHMAKGG2h0dHA6Ly91cmwtZm9yLWFpYS9Sb290LmNlcjAs
BgNVHR8EJTAjMCGgH6AdhhtodHRwOi8vdXJsLWZvci1jcmwvUm9vdC5jcmwwDgYD
VR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEB
AJ/ycR2IbFfbGRLt2nxe74GQMC/4mt/ekLydayZkEIe4RXiNjTf+yIZ10KLFiHi2
jTD3jGNeP419VIFogDTdzzdzJJHvQnpc7ZSauW+mEx0EnQrmU+tsLXskBrPUOnmU
F2iewjaRtzDyz8NsIi1zLObK0JfbofZ+LuJbJ9WGqeySO/ldrr35p9ap3fmTSS3x
maaYEEMOL5iX4Bc2hld1ImNlOetp6cxNnJs1Y1sbBPt6tJEwolxOwKh8lM5M2Ovy
/jS+5na8/oye0zttrmKSiw9BnNdlDXsbxelfEaLxGCJeDeebt7fFNHfvMrWU792m
bqcHQ8l/uAQqiFNEk6LbBZM=
-----END CERTIFICATE-----
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 1 (0x1)
Signature Algorithm: sha256WithRSAEncryption
Issuer: CN=Root
Validity
Not Before: Jan 1 12:00:00 2015 GMT
Not After : Jan 1 12:00:00 2016 GMT
Subject: CN=Root
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
00:a7:67:cf:1d:f5:54:e9:96:54:bc:65:8c:b7:9e:
72:39:05:68:3d:44:e5:93:d8:4b:61:b1:a4:b4:b4:
4c:c6:a0:92:b6:4d:06:3a:5b:b2:0a:8a:27:cb:b1:
e7:c3:35:47:ef:ac:2d:a7:d0:9c:b2:50:6a:58:3d:
12:a4:85:dc:77:a9:08:e5:f4:1f:c0:ef:00:51:cd:
68:62:d5:e5:cc:01:be:be:42:8b:35:fb:00:9c:30:
84:0c:d7:35:7d:88:d1:1b:43:78:19:79:aa:06:b3:
ac:5c:69:a0:23:f0:69:dc:89:59:97:05:df:01:ae:
5b:8f:01:a0:78:4f:05:4e:36:ac:00:b4:8d:e8:79:
05:07:f2:76:a4:63:3f:95:21:06:57:61:a9:f0:43:
04:d1:92:d3:9d:bb:b3:8f:5b:ef:ab:81:a0:23:11:
38:b5:02:b2:95:1d:ac:da:b8:36:60:d7:d7:01:6d:
e8:ed:32:21:b4:84:97:33:7c:67:88:0e:44:c7:12:
87:85:6a:49:80:82:cb:1e:16:2b:2f:6d:98:82:a0:
a0:30:cc:55:df:93:65:e0:9a:08:24:8a:47:cc:69:
53:3c:b7:62:fa:df:11:64:d0:3f:52:43:80:f8:cf:
7b:6f:d0:65:20:fb:22:d0:43:ca:fc:fc:0f:bd:1c:
42:b9
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Subject Key Identifier:
5D:A1:03:3D:8F:13:F9:08:AF:1E:83:6C:BC:DE:6F:A3:B5:C2:1A:EA
X509v3 Authority Key Identifier:
keyid:5D:A1:03:3D:8F:13:F9:08:AF:1E:83:6C:BC:DE:6F:A3:B5:C2:1A:EA
Authority Information Access:
CA Issuers - URI:http://url-for-aia/Root.cer
X509v3 CRL Distribution Points:
Full Name:
URI:http://url-for-crl/Root.crl
X509v3 Key Usage: critical
Certificate Sign, CRL Sign
X509v3 Basic Constraints: critical
CA:TRUE
Signature Algorithm: sha256WithRSAEncryption
7f:ec:13:f0:46:53:d5:75:08:a5:37:44:9c:47:19:9e:05:ef:
d6:30:68:1e:0b:c8:3c:84:93:51:36:25:48:60:56:d4:79:1f:
b6:2c:91:e3:6f:61:f9:e7:7d:c8:b6:7b:70:7f:27:6d:2c:38:
ec:73:e4:8c:86:f4:48:8e:1b:09:0d:9f:f8:5a:1f:95:ed:f1:
03:ea:99:64:d6:2d:46:4e:b8:0b:67:10:98:8e:19:2e:31:e1:
e3:d6:fe:7c:97:e9:a3:7a:18:25:9c:d4:4f:ce:a9:11:1d:f0:
53:32:8a:e8:8e:8d:80:fb:f1:c1:c1:6a:c1:cf:d2:36:a2:b1:
f9:32:9e:05:fd:73:1a:b9:37:e5:55:b2:1e:78:84:a5:04:45:
4a:d5:24:ad:20:39:fe:ab:ce:38:dd:c0:1e:2f:dd:ce:b4:5c:
49:1d:ab:7a:e1:bd:e9:a6:d2:02:64:8a:a9:97:36:89:42:c2:
82:14:ec:aa:dd:77:be:b1:d6:d2:4f:8b:a4:fe:5b:06:28:1c:
2f:4e:83:15:1f:10:a9:c6:ce:8e:a6:ca:bb:2c:01:6a:ae:99:
59:44:05:fc:a5:7e:fe:73:5f:df:b5:0b:48:b5:43:b6:10:9f:
42:2e:8b:65:f6:47:25:27:66:ef:a6:a0:ca:d3:cc:9c:ac:2d:
22:5b:87:5c
-----BEGIN TRUST_ANCHOR_UNCONSTRAINED-----
MIIDZTCCAk2gAwIBAgIBATANBgkqhkiG9w0BAQsFADAPMQ0wCwYDVQQDDARSb290
MB4XDTE1MDEwMTEyMDAwMFoXDTE2MDEwMTEyMDAwMFowDzENMAsGA1UEAwwEUm9v
dDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKdnzx31VOmWVLxljLee
cjkFaD1E5ZPYS2GxpLS0TMagkrZNBjpbsgqKJ8ux58M1R++sLafQnLJQalg9EqSF
3HepCOX0H8DvAFHNaGLV5cwBvr5CizX7AJwwhAzXNX2I0RtDeBl5qgazrFxpoCPw
adyJWZcF3wGuW48BoHhPBU42rAC0jeh5BQfydqRjP5UhBldhqfBDBNGS0527s49b
76uBoCMROLUCspUdrNq4NmDX1wFt6O0yIbSElzN8Z4gORMcSh4VqSYCCyx4WKy9t
mIKgoDDMVd+TZeCaCCSKR8xpUzy3YvrfEWTQP1JDgPjPe2/QZSD7ItBDyvz8D70c
QrkCAwEAAaOByzCByDAdBgNVHQ4EFgQUXaEDPY8T+QivHoNsvN5vo7XCGuowHwYD
VR0jBBgwFoAUXaEDPY8T+QivHoNsvN5vo7XCGuowNwYIKwYBBQUHAQEEKzApMCcG
CCsGAQUFBzAChhtodHRwOi8vdXJsLWZvci1haWEvUm9vdC5jZXIwLAYDVR0fBCUw
IzAhoB+gHYYbaHR0cDovL3VybC1mb3ItY3JsL1Jvb3QuY3JsMA4GA1UdDwEB/wQE
AwIBBjAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQB/7BPwRlPV
dQilN0ScRxmeBe/WMGgeC8g8hJNRNiVIYFbUeR+2LJHjb2H5533ItntwfydtLDjs
c+SMhvRIjhsJDZ/4Wh+V7fED6plk1i1GTrgLZxCYjhkuMeHj1v58l+mjehglnNRP
zqkRHfBTMorojo2A+/HBwWrBz9I2orH5Mp4F/XMauTflVbIeeISlBEVK1SStIDn+
q8443cAeL93OtFxJHat64b3pptICZIqplzaJQsKCFOyq3Xe+sdbST4uk/lsGKBwv
ToMVHxCpxs6Opsq7LAFqrplZRAX8pX7+c1/ftQtItUO2EJ9CLotl9kclJ2bvpqDK
08ycrC0iW4dc
-----END TRUST_ANCHOR_UNCONSTRAINED-----
150302120000Z
-----BEGIN TIME-----
MTUwMzAyMTIwMDAwWg==
-----END TIME-----
SUCCESS
-----BEGIN VERIFY_RESULT-----
U1VDQ0VTUw==
-----END VERIFY_RESULT-----