crypto_glue/x509/
chain.rs

1use crate::x509::{AlgorithmIdentifier, BasicConstraints, Certificate, KeyUsage, oiddb::rfc5912};
2use crate::{
3    ecdsa_p256::{EcdsaP256DerSignature, EcdsaP256PublicKey, EcdsaP256VerifyingKey},
4    ecdsa_p384::{EcdsaP384DerSignature, EcdsaP384PublicKey, EcdsaP384VerifyingKey},
5    rsa::{RS256PublicKey, RS256Signature, RS256VerifyingKey, RS384VerifyingKey},
6    s256::{Sha256, Sha256Output},
7    traits::{Digest, Verifier, hazmat::PrehashVerifier},
8};
9use der::Encode;
10use der::referenced::OwnedToRef;
11use std::time::{Duration, SystemTime};
12use tracing::{debug, error, trace, warn};
13
14#[derive(Debug, Clone, Copy, PartialEq, Eq)]
15pub enum X509VerificationError {
16    InvalidSystemTime,
17    BasicConstraintsNotPresent,
18    LeafMustNotBeCA,
19    KeyUsageNotValid,
20    ExtensionFailure,
21    NotBefore,
22    NotAfter,
23    NoMatchingIssuer,
24    InvalidIssuer,
25    ExcessivePathLength,
26    CaNotMarkedAsSuch,
27    PathLengthExceeded,
28    SignatureAlgorithmMismatch,
29    SignatureAlgorithmNotImplemented,
30    DerSignatureInvalid,
31    VerifyingKeyFromSpki,
32    SignatureVerificationFailed,
33    CertificateSerialisation,
34    KeyUsageNotPresent,
35    SubjectPublicKeyInformationInvalid,
36}
37
38pub struct X509Store {
39    store: Vec<Certificate>,
40    leaf_basic_constraints_required: bool,
41}
42
43impl X509Store {
44    pub fn new(ca_roots: &[Certificate]) -> Self {
45        Self {
46            store: ca_roots.iter().map(|c| (*c).clone()).collect(),
47            leaf_basic_constraints_required: true,
48        }
49    }
50
51    pub fn leaf_basic_constraints_required(&mut self, enable: bool) {
52        self.leaf_basic_constraints_required = enable;
53    }
54
55    pub fn verify(
56        &self,
57        leaf: &Certificate,
58        intermediates: &[Certificate],
59        current_time: SystemTime,
60    ) -> Result<&Certificate, X509VerificationError> {
61        // To verify this, we need to get the "rightmost" certificate that we then
62        // check is valid wrt to our store.
63        //
64        // Our caller has passed in:
65        //
66        // [ leaf, inter, inter, ... ]
67        //
68        // where the signing flows right to left
69        //
70        // [ leaf <- inter <- inter, ... ]
71        //
72        // So the initial stage is to validate the intermediate chain, and determine
73        // the intermediate closest to the root.
74
75        let current_time_unix = current_time
76            .duration_since(SystemTime::UNIX_EPOCH)
77            .map_err(|_| X509VerificationError::InvalidSystemTime)?;
78
79        let mut certificate_to_validate = leaf;
80        self.validate_leaf(certificate_to_validate, current_time_unix)?;
81
82        // PATH LENGTH
83        let mut path_length = 0;
84
85        for intermediate in intermediates {
86            // validate that intermediate signed the current certificate we
87            // are scrutinising.
88
89            self.validate_pair(
90                certificate_to_validate,
91                intermediate,
92                current_time_unix,
93                path_length,
94            )?;
95
96            // If it was valid, we now need to check the intermediate next.
97            certificate_to_validate = intermediate;
98
99            // The path length now increments by one as we added a CA to the path.
100            path_length = path_length
101                .checked_add(1)
102                .ok_or(X509VerificationError::ExcessivePathLength)?;
103        }
104
105        // Now, the certificate_to_validate is positioned. We have either validated
106        // the chain of intermediates to the leaf, or the leaf was the only certificate
107        // present.
108
109        // At this point, we now can check that our ca_store actually contains
110        // something that validates this certificate.
111
112        let authority_cert = self.locate_authority_certificate(certificate_to_validate)?;
113
114        self.validate_pair(
115            certificate_to_validate,
116            authority_cert,
117            current_time_unix,
118            path_length,
119        )?;
120
121        // At this point we have established the chain back to the CA is valid along
122        // the path of intermediates.
123
124        // That's it! Return the CA that ultimately signed this chain.
125        Ok(authority_cert)
126    }
127
128    fn validate_leaf(
129        &self,
130        certificate_to_validate: &Certificate,
131        current_time: Duration,
132    ) -> Result<(), X509VerificationError> {
133        // Client Leaf Cert
134        //   Basic Constraints: critical
135        //     CA:FALSE
136        let maybe_basic_constraints = certificate_to_validate
137            .tbs_certificate()
138            .get_extension::<BasicConstraints>()
139            .map_err(|_err| X509VerificationError::ExtensionFailure)?;
140        // If not present, we act as if this is not a CA.
141        // .ok_or(
142
143        if let Some((_critical, basic_constraints)) = maybe_basic_constraints {
144            if basic_constraints.ca {
145                return Err(X509VerificationError::LeafMustNotBeCA);
146            }
147        } else if self.leaf_basic_constraints_required {
148            return Err(X509VerificationError::BasicConstraintsNotPresent);
149        };
150
151        let maybe_keyusage = certificate_to_validate
152            .tbs_certificate()
153            .get_extension::<KeyUsage>()
154            .map_err(|_err| X509VerificationError::ExtensionFailure)?;
155
156        if let Some((_critical, key_usage)) = maybe_keyusage {
157            //   Key Usage: critical
158            //     Digital Signature
159            if !key_usage.digital_signature() {
160                return Err(X509VerificationError::KeyUsageNotValid);
161            }
162        }
163
164        // Valid time range.
165        let not_before = certificate_to_validate
166            .tbs_certificate()
167            .validity()
168            .not_before
169            .to_unix_duration();
170
171        if not_before > current_time {
172            trace!(?not_before, ?current_time);
173            return Err(X509VerificationError::NotBefore);
174        }
175
176        let not_after = certificate_to_validate
177            .tbs_certificate()
178            .validity()
179            .not_after
180            .to_unix_duration();
181
182        if current_time > not_after {
183            debug!(?current_time, ?not_after);
184            return Err(X509VerificationError::NotAfter);
185        }
186
187        Ok(())
188    }
189
190    fn validate_pair(
191        &self,
192        certificate_to_validate: &Certificate,
193        authority: &Certificate,
194        current_time: Duration,
195        path_length: u8,
196    ) -> Result<(), X509VerificationError> {
197        if authority.tbs_certificate().subject()
198            != certificate_to_validate.tbs_certificate().issuer()
199        {
200            return Err(X509VerificationError::InvalidIssuer);
201        }
202
203        // Intermediate:
204        //   Basic Constraints: critical
205        //     CA:TRUE
206        //     pathlen:0  // indicates no subordinate CA's
207
208        let (_critical, basic_constraints) = authority
209            .tbs_certificate()
210            .get_extension::<BasicConstraints>()
211            .map_err(|_err| X509VerificationError::ExtensionFailure)?
212            // You are a CA, you must have this.
213            .ok_or(X509VerificationError::BasicConstraintsNotPresent)?;
214
215        if !basic_constraints.ca {
216            return Err(X509VerificationError::CaNotMarkedAsSuch);
217        }
218
219        if let Some(ca_pathlen) = basic_constraints.path_len_constraint {
220            // The current depth of the validation path exceeds that of the
221            // allowed path length of the certificate.
222            if path_length > ca_pathlen {
223                return Err(X509VerificationError::PathLengthExceeded);
224            }
225        }
226
227        let (_critical, key_usage) = authority
228            .tbs_certificate()
229            .get_extension::<KeyUsage>()
230            .map_err(|_err| X509VerificationError::ExtensionFailure)?
231            .ok_or(X509VerificationError::KeyUsageNotPresent)?;
232
233        if !key_usage.key_cert_sign() {
234            return Err(X509VerificationError::KeyUsageNotValid);
235        }
236
237        // Valid time range.
238        let not_before = authority
239            .tbs_certificate()
240            .validity()
241            .not_before
242            .to_unix_duration();
243
244        if not_before > current_time {
245            return Err(X509VerificationError::NotBefore);
246        }
247
248        let not_after = authority
249            .tbs_certificate()
250            .validity()
251            .not_after
252            .to_unix_duration();
253
254        if current_time > not_after {
255            return Err(X509VerificationError::NotAfter);
256        }
257
258        // Now validate the signature of the certificate_to_validate
259        // A reasonable person would assume that a CA can only issue certificates using the same
260        // algorithm that it declares that it uses. However, that's simply just false, some
261        // CA's, especially that use RSA, may use a different digest.
262        if certificate_to_validate.signature_algorithm() != authority.tbs_certificate().signature()
263        {
264            warn!(validate_signature = ?certificate_to_validate.signature_algorithm(), authority_signature = ?authority.tbs_certificate().signature());
265            // return Err(X509VerificationError::SignatureAlgorithmMismatch);
266        }
267
268        let cert_to_validate_data = certificate_to_validate
269            .tbs_certificate()
270            .to_der()
271            .map_err(|_err| X509VerificationError::CertificateSerialisation)?;
272
273        let cert_to_validate_signature = certificate_to_validate
274            .signature()
275            .as_bytes()
276            .ok_or(X509VerificationError::DerSignatureInvalid)?;
277
278        verify_der_signature(
279            &cert_to_validate_data,
280            cert_to_validate_signature,
281            certificate_to_validate.signature_algorithm(),
282            authority,
283        )?;
284
285        Ok(())
286    }
287
288    fn locate_authority_certificate(
289        &self,
290        certificate_to_validate: &Certificate,
291    ) -> Result<&Certificate, X509VerificationError> {
292        self.store
293            .iter()
294            .find(|ca_cert| {
295                ca_cert.tbs_certificate().subject()
296                    == certificate_to_validate.tbs_certificate().issuer()
297            })
298            .ok_or(X509VerificationError::NoMatchingIssuer)
299    }
300}
301
302// We can't use the generic x509_verify_signature here because the format
303// of these signatures within an x509 cert is DER and different than the
304// "generic" signatures you may get on something like a JWT
305fn verify_der_signature(
306    data: &[u8],
307    signature: &[u8],
308    signature_algorithm: &AlgorithmIdentifier<der::Any>,
309    certificate: &Certificate,
310) -> Result<(), X509VerificationError> {
311    let subject_public_key_info = certificate
312        .tbs_certificate()
313        .subject_public_key_info()
314        .owned_to_ref();
315
316    let (spki_alg_oid, spki_alg_params) = subject_public_key_info
317        .algorithm
318        .oids()
319        .map_err(|_| X509VerificationError::SubjectPublicKeyInformationInvalid)?;
320
321    trace!(?signature_algorithm.oid, ?spki_alg_oid, ?spki_alg_params);
322
323    match (signature_algorithm.oid, spki_alg_oid, spki_alg_params) {
324        (rfc5912::ECDSA_WITH_SHA_256, rfc5912::ID_EC_PUBLIC_KEY, Some(rfc5912::SECP_256_R_1)) => {
325            let signature = EcdsaP256DerSignature::try_from(signature).map_err(|err| {
326                error!(?err);
327                X509VerificationError::DerSignatureInvalid
328            })?;
329
330            let verifier = EcdsaP256PublicKey::try_from(subject_public_key_info)
331                .map(EcdsaP256VerifyingKey::from)
332                .map_err(|_err| X509VerificationError::VerifyingKeyFromSpki)?;
333
334            verifier
335                .verify(data, &signature)
336                .map_err(|_err| X509VerificationError::SignatureVerificationFailed)?;
337        }
338        (rfc5912::ECDSA_WITH_SHA_256, rfc5912::ID_EC_PUBLIC_KEY, Some(rfc5912::SECP_384_R_1)) => {
339            let signature = EcdsaP384DerSignature::try_from(signature)
340                .map_err(|_err| X509VerificationError::DerSignatureInvalid)?;
341
342            let verifier = EcdsaP384PublicKey::try_from(subject_public_key_info)
343                .map(EcdsaP384VerifyingKey::from)
344                .map_err(|_err| X509VerificationError::VerifyingKeyFromSpki)?;
345
346            // let
347            let mut hasher = Sha256::new();
348            hasher.update(data);
349            let out: Sha256Output = hasher.finalize();
350
351            verifier
352                .verify_prehash(out.as_slice(), &signature)
353                .map_err(|_err| X509VerificationError::SignatureVerificationFailed)?;
354        }
355        (rfc5912::ECDSA_WITH_SHA_384, rfc5912::ID_EC_PUBLIC_KEY, Some(rfc5912::SECP_384_R_1)) => {
356            let signature = EcdsaP384DerSignature::try_from(signature)
357                .map_err(|_err| X509VerificationError::DerSignatureInvalid)?;
358
359            let verifier = EcdsaP384PublicKey::try_from(subject_public_key_info)
360                .map(EcdsaP384VerifyingKey::from)
361                .map_err(|_err| X509VerificationError::VerifyingKeyFromSpki)?;
362
363            verifier
364                .verify(data, &signature)
365                .map_err(|_err| X509VerificationError::SignatureVerificationFailed)?;
366        }
367        (rfc5912::SHA_256_WITH_RSA_ENCRYPTION, rfc5912::RSA_ENCRYPTION, None) => {
368            let signature = RS256Signature::try_from(signature)
369                .map_err(|_err| X509VerificationError::DerSignatureInvalid)?;
370
371            let verifier = RS256PublicKey::try_from(subject_public_key_info)
372                .map(RS256VerifyingKey::new)
373                .map_err(|_err| X509VerificationError::VerifyingKeyFromSpki)?;
374
375            verifier
376                .verify(data, &signature)
377                .map_err(|_err| X509VerificationError::SignatureVerificationFailed)?;
378        }
379        (rfc5912::SHA_384_WITH_RSA_ENCRYPTION, rfc5912::RSA_ENCRYPTION, None) => {
380            let signature = RS256Signature::try_from(signature)
381                .map_err(|_err| X509VerificationError::DerSignatureInvalid)?;
382
383            let verifier = RS256PublicKey::try_from(subject_public_key_info)
384                .map(RS384VerifyingKey::new)
385                .map_err(|_err| X509VerificationError::VerifyingKeyFromSpki)?;
386
387            verifier
388                .verify(data, &signature)
389                .map_err(|_err| X509VerificationError::SignatureVerificationFailed)?;
390        }
391        (signature_algorithm_oid, spki_alg_oid, spki_alg_params) => {
392            error!(?signature_algorithm_oid, ?spki_alg_oid, ?spki_alg_params);
393            return Err(X509VerificationError::SignatureAlgorithmNotImplemented);
394        }
395    }
396
397    Ok(())
398}
399
400#[cfg(test)]
401mod tests {
402    use super::X509Store;
403    use crate::ecdsa_p384::{
404        EcdsaP384PublicKey,
405        // EcdsaP384DerSignature,
406        EcdsaP384Signature,
407        EcdsaP384VerifyingKey,
408    };
409    use crate::test_ca::*;
410    use crate::traits::{DecodePem, Signer, Verifier};
411    use crate::x509::{Certificate, Name, Time, X509Display};
412    use der::referenced::OwnedToRef;
413    use std::str::FromStr;
414    use std::time::Duration;
415    use std::time::SystemTime;
416
417    #[cfg(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none")))]
418    use wasm_bindgen_test::*;
419    #[cfg(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none")))]
420    wasm_bindgen_test_configure!(run_in_browser);
421
422    #[test]
423    #[cfg_attr(
424        all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none")),
425        wasm_bindgen_test
426    )]
427    fn x509_chain_verify_basic() {
428        let _ = tracing_subscriber::fmt::try_init();
429
430        let now = now();
431        let not_before = Time::try_from(now).expect("Failed to convert SystemTime to Time");
432        let not_after = Time::try_from(now + Duration::new(3600, 0))
433            .expect("Failed to convert SystemTime to Time");
434
435        let (root_signing_key, root_ca_cert) = build_test_ca_root(not_before, not_after);
436
437        let (int_signing_key, int_ca_cert) =
438            build_test_ca_int(not_before, not_after, &root_signing_key, &root_ca_cert);
439
440        let subject = Name::from_str("CN=localhost").expect("Failed to parse subject name");
441        let (server_key, server_csr) = build_test_csr(&subject);
442
443        let server_cert = test_ca_sign_server_csr(
444            not_before,
445            not_after,
446            &server_csr,
447            &int_signing_key,
448            &int_ca_cert,
449        );
450
451        tracing::debug!(cert = %X509Display::from(&server_cert));
452
453        // Also sign some data to validate.
454        let test_data = [0, 1, 2, 3, 4, 5, 6, 7, 8, 9];
455
456        let test_data_signature: EcdsaP384Signature = server_key
457            .try_sign(&test_data)
458            // .map(|sig: EcdsaP384Signature | sig.to_der())
459            .expect("Unable to sign test data");
460
461        // Certs setup, validate now.
462        let ca_store = X509Store::new(&[root_ca_cert]);
463
464        let leaf = &server_cert;
465        let chain = [int_ca_cert];
466
467        assert!(ca_store.verify(leaf, &chain, now).is_ok());
468
469        // Now validate our data signature.
470        let subject_public_key_info = server_cert
471            .tbs_certificate()
472            .subject_public_key_info()
473            .owned_to_ref();
474
475        let verifier = EcdsaP384PublicKey::try_from(subject_public_key_info)
476            .map(EcdsaP384VerifyingKey::from)
477            .expect("Failed to create EcdsaP384VerifyingKey");
478
479        verifier
480            .verify(&test_data, &test_data_signature)
481            .expect("Failed to verify test data signature");
482    }
483
484    #[test]
485    #[cfg_attr(
486        all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none")),
487        wasm_bindgen_test
488    )]
489    fn x509_chain_verify_rsa_fido_mds() {
490        let _ = tracing_subscriber::fmt::try_init();
491
492        let global_sign_root_cert =
493            Certificate::from_pem(GLOBAL_SIGN_ROOT).expect("Failed to parse GlobalSign Root cert");
494        let mds_cert = Certificate::from_pem(FIDO_MDS).expect("Failed to parse FIDO MDS cert");
495
496        let ca_store = X509Store::new(&[global_sign_root_cert]);
497
498        // To check before expiry
499        let now = SystemTime::UNIX_EPOCH + Duration::from_secs(1753733820);
500        let leaf = &mds_cert;
501        let chain = [];
502
503        let result = ca_store.verify(leaf, &chain, now);
504        assert!(result.is_ok());
505
506        // Check expiry causes this to be invalid
507        let now = SystemTime::UNIX_EPOCH + Duration::from_secs(1753733825);
508        let result = ca_store.verify(leaf, &chain, now);
509        assert!(result.is_err());
510    }
511
512    #[test]
513    #[cfg_attr(
514        all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none")),
515        wasm_bindgen_test
516    )]
517    fn x509_chain_verify_rsa_yubico_u2f() {
518        let _ = tracing_subscriber::fmt::try_init();
519
520        let yubico_u2f_root_cert =
521            Certificate::from_pem(YUBICO_U2F_ROOT).expect("Failed to parse Yubico U2F Root cert");
522        let yubico_device_attest = Certificate::from_pem(YUBICO_DEVICE_ATTEST)
523            .expect("Failed to parse Yubico Device Attest cert");
524
525        let ca_store = X509Store::new(&[yubico_u2f_root_cert]);
526
527        let now = now();
528        let leaf = &yubico_device_attest;
529        let chain = [];
530
531        assert!(ca_store.verify(leaf, &chain, now).is_ok());
532    }
533
534    const YUBICO_U2F_ROOT: &str = r#"-----BEGIN CERTIFICATE-----
535MIIDHjCCAgagAwIBAgIEG0BT9zANBgkqhkiG9w0BAQsFADAuMSwwKgYDVQQDEyNZ
536dWJpY28gVTJGIFJvb3QgQ0EgU2VyaWFsIDQ1NzIwMDYzMTAgFw0xNDA4MDEwMDAw
537MDBaGA8yMDUwMDkwNDAwMDAwMFowLjEsMCoGA1UEAxMjWXViaWNvIFUyRiBSb290
538IENBIFNlcmlhbCA0NTcyMDA2MzEwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
539AoIBAQC/jwYuhBVlqaiYWEMsrWFisgJ+PtM91eSrpI4TK7U53mwCIawSDHy8vUmk
5405N2KAj9abvT9NP5SMS1hQi3usxoYGonXQgfO6ZXyUA9a+KAkqdFnBnlyugSeCOep
5418EdZFfsaRFtMjkwz5Gcz2Py4vIYvCdMHPtwaz0bVuzneueIEz6TnQjE63Rdt2zbw
542nebwTG5ZybeWSwbzy+BJ34ZHcUhPAY89yJQXuE0IzMZFcEBbPNRbWECRKgjq//qT
5439nmDOFVlSRCt2wiqPSzluwn+v+suQEBsUjTGMEd25tKXXTkNW21wIWbxeSyUoTXw
544LvGS6xlwQSgNpk2qXYwf8iXg7VWZAgMBAAGjQjBAMB0GA1UdDgQWBBQgIvz0bNGJ
545hjgpToksyKpP9xv9oDAPBgNVHRMECDAGAQH/AgEAMA4GA1UdDwEB/wQEAwIBBjAN
546BgkqhkiG9w0BAQsFAAOCAQEAjvjuOMDSa+JXFCLyBKsycXtBVZsJ4Ue3LbaEsPY4
547MYN/hIQ5ZM5p7EjfcnMG4CtYkNsfNHc0AhBLdq45rnT87q/6O3vUEtNMafbhU6kt
548hX7Y+9XFN9NpmYxr+ekVY5xOxi8h9JDIgoMP4VB1uS0aunL1IGqrNooL9mmFnL2k
549LVVee6/VR6C5+KSTCMCWppMuJIZII2v9o4dkoZ8Y7QRjQlLfYzd3qGtKbw7xaF1U
550sG/5xUb/Btwb2X2g4InpiB/yt/3CpQXpiWX/K4mBvUKiGn05ZsqeY1gx4g0xLBqc
551U9psmyPzK+Vsgw2jeRQ5JlKDyqE0hebfC1tvFu0CCrJFcw==
552-----END CERTIFICATE-----"#;
553
554    const YUBICO_DEVICE_ATTEST: &str = r#"-----BEGIN CERTIFICATE-----
555MIICvTCCAaWgAwIBAgIEGKxGwDANBgkqhkiG9w0BAQsFADAuMSwwKgYDVQQDEyNZ
556dWJpY28gVTJGIFJvb3QgQ0EgU2VyaWFsIDQ1NzIwMDYzMTAgFw0xNDA4MDEwMDAw
557MDBaGA8yMDUwMDkwNDAwMDAwMFowbjELMAkGA1UEBhMCU0UxEjAQBgNVBAoMCVl1
558YmljbyBBQjEiMCAGA1UECwwZQXV0aGVudGljYXRvciBBdHRlc3RhdGlvbjEnMCUG
559A1UEAwweWXViaWNvIFUyRiBFRSBTZXJpYWwgNDEzOTQzNDg4MFkwEwYHKoZIzj0C
560AQYIKoZIzj0DAQcDQgAEeeo7LHxJcBBiIwzSP+tg5SkxcdSD8QC+hZ1rD4OXAwG1
561Rs3Ubs/K4+PzD4Hp7WK9Jo1MHr03s7y+kqjCrutOOqNsMGowIgYJKwYBBAGCxAoC
562BBUxLjMuNi4xLjQuMS40MTQ4Mi4xLjcwEwYLKwYBBAGC5RwCAQEEBAMCBSAwIQYL
563KwYBBAGC5RwBAQQEEgQQy2lIHo/3QDmT7AonKaFUqDAMBgNVHRMBAf8EAjAAMA0G
564CSqGSIb3DQEBCwUAA4IBAQCXnQOX2GD4LuFdMRx5brr7Ivqn4ITZurTGG7tX8+a0
565wYpIN7hcPE7b5IND9Nal2bHO2orh/tSRKSFzBY5e4cvda9rAdVfGoOjTaCW6FZ5/
566ta2M2vgEhoz5Do8fiuoXwBa1XCp61JfIlPtx11PXm5pIS2w3bXI7mY0uHUMGvxAz
567ta74zKXLslaLaSQibSKjWKt9h+SsXy4JGqcVefOlaQlJfXL1Tga6wcO0QTu6Xq+U
568w7ZPNPnrpBrLauKDd202RlN4SP7ohL3d9bG6V5hUz/3OusNEBZUn5W3VmPj1ZnFa
569vkMB3RkRMOa58MZAORJT4imAPzrvJ0vtv94/y71C6tZ5
570-----END CERTIFICATE-----"#;
571
572    const GLOBAL_SIGN_ROOT: &str = r#"-----BEGIN CERTIFICATE-----
573MIIEYTCCA0mgAwIBAgIOSKQC3SeSDaIINJ3RmXswDQYJKoZIhvcNAQELBQAwTDEg
574MB4GA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjMxEzARBgNVBAoTCkdsb2Jh
575bFNpZ24xEzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMTYwOTIxMDAwMDAwWhcNMjYw
576OTIxMDAwMDAwWjBiMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xvYmFsU2lnbiBu
577di1zYTE4MDYGA1UEAxMvR2xvYmFsU2lnbiBFeHRlbmRlZCBWYWxpZGF0aW9uIENB
578IC0gU0hBMjU2IC0gRzMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCr
579awNnVNXcEfvFohPBjBkn3BB04mGDPfqO24+lD+SpvkY/Ar5EpAkcJjOfR0iBFYhW
580N80HzpXYy2tIA7mbXpKu2JpmYdU1xcoQpQK0ujE/we+vEDyjyjmtf76LLqbOfuq3
581xZbSqUqAY+MOvA67nnpdawvkHgJBFVPnxui45XH4BwTwbtDucx+Mo7EK4mS0Ti+P
5821NzARxFNCUFM8Wxc32wxXKff6WU4TbqUx/UJm485ttkFqu0Ox4wTUUbn0uuzK7yV
5833Y986EtGzhKBraMH36MekSYlE473GqHetRi9qbNG5pM++Sa+WjR9E1e0Yws16CGq
584smVKwAqg4uc43eBTFUhVAgMBAAGjggEpMIIBJTAOBgNVHQ8BAf8EBAMCAQYwEgYD
585VR0TAQH/BAgwBgEB/wIBADAdBgNVHQ4EFgQU3bPnbagu6MVObs905nU8lBXO6B0w
586HwYDVR0jBBgwFoAUj/BLf6guRSSuTVD6Y5qL3uLdG7wwPgYIKwYBBQUHAQEEMjAw
587MC4GCCsGAQUFBzABhiJodHRwOi8vb2NzcDIuZ2xvYmFsc2lnbi5jb20vcm9vdHIz
588MDYGA1UdHwQvMC0wK6ApoCeGJWh0dHA6Ly9jcmwuZ2xvYmFsc2lnbi5jb20vcm9v
589dC1yMy5jcmwwRwYDVR0gBEAwPjA8BgRVHSAAMDQwMgYIKwYBBQUHAgEWJmh0dHBz
590Oi8vd3d3Lmdsb2JhbHNpZ24uY29tL3JlcG9zaXRvcnkvMA0GCSqGSIb3DQEBCwUA
591A4IBAQBVaJzl0J/i0zUV38iMXIQ+Q/yht+JZZ5DW1otGL5OYV0LZ6ZE6xh+WuvWJ
592J4hrDbhfo6khUEaFtRUnurqzutvVyWgW8msnoP0gtMZO11cwPUMUuUV8iGyIOuIB
5930flo6G+XbV74SZuR5v5RAgqgGXucYUPZWvv9AfzMMQhRQkr/MO/WR2XSdiBrXHoD
594L2xk4DmjA4K6iPI+1+qMhyrkUM/2ZEdA8ldqwl8nQDkKS7vq6sUZ5LPVdfpxJZZu
5955JBj4y7FNFTVW1OMlCUvwt5H8aFgBMLFik9xqK6JFHpYxYmf4t2sLLxN0LlCthJE
596abvp10ZlOtfu8hL5gCXcxnwGxzSb
597-----END CERTIFICATE-----"#;
598
599    const FIDO_MDS: &str = r#"-----BEGIN CERTIFICATE-----
600MIIHGTCCBgGgAwIBAgIMIa7sY/5SFH8UYph5MA0GCSqGSIb3DQEBCwUAMGIxCzAJ
601BgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMTgwNgYDVQQDEy9H
602bG9iYWxTaWduIEV4dGVuZGVkIFZhbGlkYXRpb24gQ0EgLSBTSEEyNTYgLSBHMzAe
603Fw0yNDA2MjYyMDE3MDRaFw0yNTA3MjgyMDE3MDNaMIHSMR0wGwYDVQQPDBRQcml2
604YXRlIE9yZ2FuaXphdGlvbjEQMA4GA1UEBRMHMzQ1NDI4NDETMBEGCysGAQQBgjc8
605AgEDEwJVUzEbMBkGCysGAQQBgjc8AgECEwpDYWxpZm9ybmlhMQswCQYDVQQGEwJV
606UzEPMA0GA1UECBMGT3JlZ29uMRIwEAYDVQQHEwlCZWF2ZXJ0b24xHDAaBgNVBAoT
607E0ZJRE8gQUxMSUFOQ0UsIElOQy4xHTAbBgNVBAMTFG1kcy5maWRvYWxsaWFuY2Uu
608b3JnMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA6AskoQ0bFp93JQQd
609p1b8nFCmB67dTNUptwkKtnHj0Y18DWopH8CKORM1LjAHyjMTPoOGXb5/rt1wDfOK
610b0chqSG9llrBzp/N0BuLL0ZFyZEAYt4th8Y0Ooc3FQtXZ99T6HNW+fmXaLbYxxnG
611nsxAxjVQmHwCZBnx+WPKgi6BqaYcY05M8uzWkgSp1nE4jD+JQ9HN0HSFhzHe3LW4
612v0th2Jz1OQmMhwia0SD/V6YXIqkXkqmmFenhCfSG+/LiLgWxmeIwApJ5oe10Dvmi
613JYeaaFkgbEc/b7/6PMaa4X/0aZZ1J7C0EHvn5lUHb8hfBbzGhsBKOpQW1uOhiK+y
614I9oKQQIDAQABo4IDXDCCA1gwDgYDVR0PAQH/BAQDAgWgMAwGA1UdEwEB/wQCMAAw
615gZYGCCsGAQUFBwEBBIGJMIGGMEcGCCsGAQUFBzAChjtodHRwOi8vc2VjdXJlLmds
616b2JhbHNpZ24uY29tL2NhY2VydC9nc2V4dGVuZHZhbHNoYTJnM3IzLmNydDA7Bggr
617BgEFBQcwAYYvaHR0cDovL29jc3AyLmdsb2JhbHNpZ24uY29tL2dzZXh0ZW5kdmFs
618c2hhMmczcjMwVQYDVR0gBE4wTDBBBgkrBgEEAaAyAQEwNDAyBggrBgEFBQcCARYm
619aHR0cHM6Ly93d3cuZ2xvYmFsc2lnbi5jb20vcmVwb3NpdG9yeS8wBwYFZ4EMAQEw
620RQYDVR0fBD4wPDA6oDigNoY0aHR0cDovL2NybC5nbG9iYWxzaWduLmNvbS9ncy9n
621c2V4dGVuZHZhbHNoYTJnM3IzLmNybDAfBgNVHREEGDAWghRtZHMuZmlkb2FsbGlh
622bmNlLm9yZzAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwHwYDVR0jBBgw
623FoAU3bPnbagu6MVObs905nU8lBXO6B0wHQYDVR0OBBYEFMaN4X1b9AHuWDPJK1AY
624dg2MQGhxMIIBfwYKKwYBBAHWeQIEAgSCAW8EggFrAWkAdgAS8U40vVNyTIQGGcOP
625P3oT+Oe1YoeInG0wBYTr5YYmOgAAAZBWMd/sAAAEAwBHMEUCIQDLehoLcAsQrMOG
626NzpCOEewntO7/FGYjM1BJwLaooEZeAIgKXVD02S4x8C+5zfxgVFbin3VHlP4l+FU
627925i66QhsVoAdgAN4fIwK9MNwUBiEgnqVS78R3R8sdfpMO8OQh60fk6qNAAAAZBW
628Md0DAAAEAwBHMEUCIFQEuBdgAXVF0joEul6oLwpIrz818XXZWbtg3LWJvInhAiEA
629iibo7o9oSc8UUnUUf6/4QhxBZ1DGGN34Qv1t8Cp+a5UAdwDm0jFjQHeMwRBBBtdx
630uc7B0kD2loSG+7qHMh39HjeOUAAAAZBWMd8eAAAEAwBIMEYCIQDQZGnntKA3LnHj
631V76+Fq55Nypv1BsHZLfhG736TcspLwIhANHF8kMePNAIooXltURI5i+sNF96x2zR
632PA6Ly2D/DezDMA0GCSqGSIb3DQEBCwUAA4IBAQBxWM7olfKF6bhJ8SzVKIKgfeV+
633YDqQS1Z9r453X5ZFv3jfD74uhsGjg2fI5vMulZzlFwXNTta0bf0TzaC0rkhuAcnc
634Rfi0rk9MmI6HMuG4qaEO+6JJxst/OH/1k/GC8gh2MgwX6Aq9b33kaMTEnGeByFEH
635Qf/4ZcuhoOkVeQ7MX+p0BNdaNdp6v6au4WDf0JJgTPPV//VJykqOCV6zgTt3hra0
636HR9+f1CMFvtSC1OpP197c7XGNdK2Rnn/6Z2y7Ak9G3iYhGhS/Ssz9zsOUTi7b+SY
637ywLlY2y0vY1svPUSJEWjhMtVDL9b2/DvIhNqp0kGCiXCGmtzW5DxgXE1ckkh
638-----END CERTIFICATE-----"#;
639}
crypto_glue/x509/chain.rs

crypto_glue/x509/
chain.rs
