From 2f2e914e359d9f006f4c61bb6dfa9d951f6569c2 Mon Sep 17 00:00:00 2001
From: Cedric Staub <cs@squareup.com>
Date: Fri, 18 Aug 2017 12:52:26 -0700
Subject: [PATCH 1/4] Fix DNS name constraints handling

---
 lib/display.go                            |  58 ++++++++++++++++------
 lib/encoder.go                            |   4 +-
 test-certs/Makefile                       |   5 +-
 test-certs/example-custom-oid.crt         |  20 ++++++++
 test-certs/example-custom-oid.csr         |  16 ++++++
 test-certs/example-custom-oid.jceks       | Bin 0 -> 2175 bytes
 test-certs/example-custom-oid.key         |  27 ++++++++++
 test-certs/example-custom-oid.p12         | Bin 0 -> 2538 bytes
 test-certs/example-custom-oid.p7b         |  21 ++++++++
 test-certs/example-name-constraints.crt   |  23 +++++++++
 test-certs/example-name-constraints.csr   |  17 +++++++
 test-certs/example-name-constraints.jceks | Bin 0 -> 2333 bytes
 test-certs/example-name-constraints.p12   | Bin 0 -> 2718 bytes
 test-certs/example-name-constraints.p7b   |  24 +++++++++
 test-certs/openssl.ext                    |   4 ++
 15 files changed, 202 insertions(+), 17 deletions(-)
 create mode 100644 test-certs/example-custom-oid.crt
 create mode 100644 test-certs/example-custom-oid.csr
 create mode 100644 test-certs/example-custom-oid.jceks
 create mode 100644 test-certs/example-custom-oid.key
 create mode 100644 test-certs/example-custom-oid.p12
 create mode 100644 test-certs/example-custom-oid.p7b
 create mode 100644 test-certs/example-name-constraints.crt
 create mode 100644 test-certs/example-name-constraints.csr
 create mode 100644 test-certs/example-name-constraints.jceks
 create mode 100644 test-certs/example-name-constraints.p12
 create mode 100644 test-certs/example-name-constraints.p7b

diff --git a/lib/display.go b/lib/display.go
index bc2b25b..23b7b1c 100644
--- a/lib/display.go
+++ b/lib/display.go
@@ -48,30 +48,57 @@ Subject Info:
 Issuer Info:
 	{{- template "PkixName" .Issuer.Name}}
 {{- if .Subject.KeyID}}
-Subject Key ID: {{.Subject.KeyID | hexify}}{{end}}{{if .Issuer.KeyID}}
-Authority Key ID: {{.Issuer.KeyID | hexify}}{{end}}{{if .BasicConstraints}}
-Basic Constraints: CA:{{.BasicConstraints.IsCA}}{{if .BasicConstraints.MaxPathLen}}, pathlen:{{.BasicConstraints.MaxPathLen}}{{end}}{{end}}{{if .NameConstraints}}
-Name Constraints {{if .PermittedDNSDomains.Critical}}(critical){{end}}: {{range .NameConstraints.PermittedDNSDomains}}
-	{{.}}{{end}}{{end}}{{if .KeyUsage}}
-Key Usage:{{range .KeyUsage | keyUsage}}
-	{{.}}{{end}}{{end}}{{if .ExtKeyUsage}}
-Extended Key Usage:{{range .ExtKeyUsage}}
-	{{. | extKeyUsage}}{{end}}{{end}}
+Subject Key ID: {{.Subject.KeyID | hexify}}
+{{- end}}
+{{- if .Issuer.KeyID}}
+Authority Key ID: {{.Issuer.KeyID | hexify}}
+{{- end}}
+{{- if .BasicConstraints}}
+Basic Constraints: CA:{{.BasicConstraints.IsCA}}{{if .BasicConstraints.MaxPathLen}}, pathlen:{{.BasicConstraints.MaxPathLen}}{{end}}{{end}}
+{{- if .NameConstraints}}
+DNS Name Constraints{{if .NameConstraints.Critical}} (critical){{end}}: 
+{{- if .NameConstraints.PermittedDNSDomains}}
+Permitted:
+	{{wrapWith .Width "\n\t" (join ", " .NameConstraints.PermittedDNSDomains)}}
+{{- end}}
+{{- if .NameConstraints.ExcludedDNSDomains}}
+Excluded:
+	{{wrapWith .Width "\n\t" (join ", " .NameConstraints.ExcludedDNSDomains)}}
+{{- end}}
+{{- end}}
+{{- if .KeyUsage}}
+Key Usage:
+{{- range .KeyUsage | keyUsage}}
+	{{.}}
+{{- end}}
+{{- end}}
+{{- if .ExtKeyUsage}}
+Extended Key Usage:
+{{- range .ExtKeyUsage}}
+	{{. | extKeyUsage}}{{end}}
+{{- end}}
 {{- if .AltDNSNames}}
 DNS Names:
-	{{wrapWith .Width "\n\t" (join ", " .AltDNSNames)}}{{end}}
+	{{wrapWith .Width "\n\t" (join ", " .AltDNSNames)}}
+{{- end}}
 {{- if .AltIPAddresses}}
 IP Addresses:
-	{{wrapWith .Width "\n\t" (join ", " .AltIPAddresses)}}{{end}}
+	{{wrapWith .Width "\n\t" (join ", " .AltIPAddresses)}}
+{{- end}}
 {{- if .URINames}}
 URI Names:
-	{{wrapWith .Width "\n\t" (join ", " .URINames)}}{{end}}
+	{{wrapWith .Width "\n\t" (join ", " .URINames)}}
+{{- end}}
 {{- if .EmailAddresses}}
 Email Addresses:
-	{{wrapWith .Width "\n\t" (join ", " .EmailAddresses)}}{{end}}
+	{{wrapWith .Width "\n\t" (join ", " .EmailAddresses)}}
+{{- end}}
 {{- if .Warnings}}
-Warnings:{{range .Warnings}}
-	{{. | redify}}{{end}}{{end}}`
+Warnings:
+{{- range .Warnings}}
+	{{. | redify}}
+{{- end}}
+{{- end}}`
 
 var layout = `
 {{- if .Alias}}{{.Alias}}
@@ -280,6 +307,7 @@ func greenify(text string) string {
 	return green.SprintfFunc()("%s", text)
 }
 
+// PrintShortName turns a pkix.Name into a string of RDN tuples.
 func PrintShortName(name pkix.Name) (out string) {
 	// Try to print CN for short name if present.
 	if name.CommonName != "" {
diff --git a/lib/encoder.go b/lib/encoder.go
index d80b77b..63f0a03 100644
--- a/lib/encoder.go
+++ b/lib/encoder.go
@@ -173,6 +173,7 @@ type basicConstraints struct {
 type nameConstraints struct {
 	Critical            bool     `json:"critical,omitempty"`
 	PermittedDNSDomains []string `json:"permitted_dns_domains,omitempty"`
+	ExcludedDNSDomains  []string `json:"excluded_dns_domains,omitempty"`
 }
 
 // simpleCertificate is a JSON-representable certificate metadata holder.
@@ -249,10 +250,11 @@ func createSimpleCertificate(name string, cert *x509.Certificate) simpleCertific
 		}
 	}
 
-	if len(cert.PermittedDNSDomains) > 0 {
+	if len(cert.PermittedDNSDomains) > 0 || len(cert.ExcludedDNSDomains) > 0 {
 		out.NameConstraints = &nameConstraints{
 			Critical:            cert.PermittedDNSDomainsCritical,
 			PermittedDNSDomains: cert.PermittedDNSDomains,
+			ExcludedDNSDomains:  cert.ExcludedDNSDomains,
 		}
 	}
 
diff --git a/test-certs/Makefile b/test-certs/Makefile
index 854235e..8909f1e 100644
--- a/test-certs/Makefile
+++ b/test-certs/Makefile
@@ -1,7 +1,7 @@
 TARGETS = \
 	example-root example-leaf example-sha1 example-md5 example-root-bad-ku \
 	example-bad-serial example-small-key example-expired example-elliptic-sha1 \
-	example-custom-oid
+	example-custom-oid example-name-constraints
 
 all: \
 	$(addsuffix .crt,$(TARGETS)) \
@@ -80,3 +80,6 @@ example-custom-oid.csr: example-custom-oid.key
 
 example-custom-oid.crt: example-custom-oid.csr
 	openssl x509 -req -sha256 -in $< -signkey $(@:.crt=.key) -out $@ -days 2500 -extfile openssl.ext -extensions leaf
+
+example-name-constraints.crt: example-name-constraints.csr
+	openssl x509 -req -sha256 -in $< -signkey $(@:.crt=.key) -out $@ -days 2500 -extfile openssl.ext -extensions root_with_constraints
diff --git a/test-certs/example-custom-oid.crt b/test-certs/example-custom-oid.crt
new file mode 100644
index 0000000..e9bd80e
--- /dev/null
+++ b/test-certs/example-custom-oid.crt
@@ -0,0 +1,20 @@
+-----BEGIN CERTIFICATE-----
+MIIDPDCCAiSgAwIBAgIJAMnEiF0KGVsZMA0GCSqGSIb3DQEBCwUAMDUxHDAaBgNV
+BAMME2V4YW1wbGUtY3VzdG9tLW9pZHMxFTATBggrBgEEAYKgMgwHZXhhbXBsZTAe
+Fw0xNzA4MTgxOTQyMDZaFw0yNDA2MjIxOTQyMDZaMDUxHDAaBgNVBAMME2V4YW1w
+bGUtY3VzdG9tLW9pZHMxFTATBggrBgEEAYKgMgwHZXhhbXBsZTCCASIwDQYJKoZI
+hvcNAQEBBQADggEPADCCAQoCggEBAMcjcsRRkqeVQxzhzKTgdt29XnihRrNRnsa2
+o2KVZGQOcavJGkosjD1xG9/I8m4dr04h/2Mc06g6VH65wWWJ5UKceBks00/ftFcG
+9I5iorXf5WQQPM73y9zYtmJtE6WUBh6f0MmlTr76g4mI26zfliWsubrB1MRQ8RTD
+9TY8lgk/UCmT63YryrYBTEMwgqAZInN95ir0n4vt53ee6JfNwSYIyLxGRZFYOEeP
+30hlntw1vN+q1kyTsY/xSA4BnD8tXliJ0AR5he+wmExrrlTDKxp1fm63ODOBZQVJ
+0L/LMvEul2Qa3xtWdp6WB5LygmTOC1DpipqRhhQAgJb5qwaJSGMCAwEAAaNPME0w
+HQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMBMCwGA1UdEQQlMCOHBH8AAAGH
+EAAAAAAAAAAAAAAAAAAAAAGCCWxvY2FsaG9zdDANBgkqhkiG9w0BAQsFAAOCAQEA
+Tglf3JyqYQXGA7cftxoNh8ZHbKlGwZ/V7qGPunhY+3lUdcU9nMrGJkHfhtHjbxwy
+Mp8Xin+oJWxvQC74MhwN4eYmbgxoeIhnWpwycuLC748/dEF3G+lbzPoBDGC7oaLd
+Bdy4ChAAPGu47fQrkxCJP9TTYWrTcrgo7rioB+7v7Hu68nW3qp5hlcBOpI5f8SIm
+2RKJMZDkavUrwQx/wRWqG5lrn7mRVNNJ1hO//NrfrcobtGdKCSH9uoNTCYvBtcAT
+j+MGqfv1mmYaTzS3RGBd3w14bWxR9qBuFB5GccgPMzW6hMaIhGM5+qjdQ0GnOgnz
+n2g4qtGeN+uglDfulWZ7lA==
+-----END CERTIFICATE-----
diff --git a/test-certs/example-custom-oid.csr b/test-certs/example-custom-oid.csr
new file mode 100644
index 0000000..9a9e03d
--- /dev/null
+++ b/test-certs/example-custom-oid.csr
@@ -0,0 +1,16 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIICejCCAWICAQAwNTEcMBoGA1UEAwwTZXhhbXBsZS1jdXN0b20tb2lkczEVMBMG
+CCsGAQQBgqAyDAdleGFtcGxlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
+AQEAxyNyxFGSp5VDHOHMpOB23b1eeKFGs1GexrajYpVkZA5xq8kaSiyMPXEb38jy
+bh2vTiH/YxzTqDpUfrnBZYnlQpx4GSzTT9+0Vwb0jmKitd/lZBA8zvfL3Ni2Ym0T
+pZQGHp/QyaVOvvqDiYjbrN+WJay5usHUxFDxFMP1NjyWCT9QKZPrdivKtgFMQzCC
+oBkic33mKvSfi+3nd57ol83BJgjIvEZFkVg4R4/fSGWe3DW836rWTJOxj/FIDgGc
+Py1eWInQBHmF77CYTGuuVMMrGnV+brc4M4FlBUnQv8sy8S6XZBrfG1Z2npYHkvKC
+ZM4LUOmKmpGGFACAlvmrBolIYwIDAQABoAAwDQYJKoZIhvcNAQEFBQADggEBAFqr
+qQK9/gLAxBxUfny7cCN+NFBb11HJx8HerLKqBGN4VOh27SkJGg6H5ozj/qwhElVw
+SQUX33TigC6roiPDK3+KvL9fxjUY60xnLRXKciMm/1jqeYjht33hQMZAi4OwT+dG
+FFVys2zlSFXxqX79+6mkKUIRurymnJWjOHNWOhrDckShDjf5N+A3lUNWgwu7M0cX
+T5Bv/6AFV4vuMJALv4JTBC60bT+cfXmYxCox+5rZ+bT+6uOFWu+0H4CPXfP9OU5B
+/aA20r2bN16TftaLPY9HSJNPXqlZHX196e6+oqd16Rr6AyYAvGlKmpJgpm5OS17r
+7yMFrPWSWlsOmIhxhXs=
+-----END CERTIFICATE REQUEST-----
diff --git a/test-certs/example-custom-oid.jceks b/test-certs/example-custom-oid.jceks
new file mode 100644
index 0000000000000000000000000000000000000000..6ccf8ef435671513ebc40e28591f89839f553f2e
GIT binary patch
literal 2175
zcmbVNdoa|G7T@o_*k!%huvA`cUca@HC4QS{8^wB+Udp2o>zP+YEMd#_CTUwMgeB^i
z=ZdVfc@#Dhp%pDsly^Up>o&i+)6D(vo|(_gIdjgOIrBMZKBuRrrw0TAfwuwtg4Fp)
zcS?}|c^%KN&`W_7oj_l&?bMmo_k_J55cCU<3Z20zz!6$-019Y=r2!lYDhv(!W2IwH
z^q*ir21<o?xW_$*nbld+e4QkC&4wtO`BK})*EQC?KMi;W@=6sgMDDFUHG7mZb`$EA
zq+6TjODs{t(UOwh*(jKdJ8!tbVyQCvqA61}#}IiIyAe7V_ZMn4c5z|YgwT^m*BW!H
zvaoZ81rA*XJ!Z(EE@SLpi<#*PGV_z@Pm7(@Uj`C%HwKvlNaU^<Wp&kHkM#5(p~k-2
zyo2K!<>-8-xh)CXsx`7A?kts;G<r_yoZN%e5Rijqsi`sH&2rgk@lqdF*K5g+O{P^L
zaAk8--^oV*Ts!-Ieu&(MxwZqvgBBSG+(_!U4|Y8=Rti})BEdH=A+^2l(@u9mZk@^I
zu0)x?yje$DpWB+u8Dpa3?YD-)hOj0=L?tgrMN$Y0D`Hg3{TZG2Rxc~|qT~zhOuUZT
zg&`T83QX$V1n+hifwH;1V{-rAa%x)?!LONX*{TjSC31N6g+^u#NqDb;6Mga1Is4m0
zMS9U_noVzC=V<0Bv6ftlj4C}Uf)bFdnO|HlWSrJK<(QG9!*+at;F0F8x~Qu#1>+&h
z&GDhGZ0Ls^ZPSgeH>;eMdc1xrBRsfdDsD{~V`eUQHJTPsHgw!Q^@r9Lc1>6B?j^^H
zn2dQx=m~ch@(Z6vmz@d!()|X8t@@D<B%qsFORn=LW>dZ$wCalI{(Z=z9MVcQ4OU%9
zChlrgepa<eZu)W-HTbQcrJw5*V_g&yPK+lBkJJOcXxx^yuk4g$B2m=#T|GGlozY3l
z<6Zv*RYUCC5mY{=yKY<K@HMsyM3xoK7(CrL*_J|~!`M`|;j{=t+|KE~hKqEB>g>RN
zc#jQWbPZv;Q=8WD@%yv`l@%~TQunsWz95C1*ul_JiX1ZUqE=WsKRiyajH=!p)ZrfD
zSmtwoV<v?bDl$9h#vy|{&C0b0dB*a{ppIZ^U;X8A_1r@&f4{lSxXTnwi3%Di_yf9m
z9aHl}5IJM*cd9!p&blQ+Wf5ydF&{s+>H^YlQZ1FAEwT>iRXTm#Fz}v!!EK(+g+gbm
z>1wdagWE+x=`NHQ!Rg9k?05a9J+8xUvw;G*hZZhVvsN-YK*E5ZA=L;TKUy&I+=w8V
zU!+EOJAOhf)ReR%YrXrueypxnHba~xn7);rY4nciwHX39<d3^r?901aw#!43#y+ab
z1Imv@Hs4JH|CNtcS&`Xv!!W{YB5r!Oaxrm*DHBjT5#u%`IV*%tib#ZDiIO7MhgVz)
zaE>R$Kkv0#|MpOGcIsz$*_Uw0oy4QchXll0r?1Q#TsKQDHm#$E0XFb3Ab(bQWj;}3
zNxl+(n#;B5{<El$Wg%cxv7f9SMoh)Tbx+Mi>C&fD!D8w696y{?3!YFMd4}ZeSqPYt
zIN%AFkZ`Y_i`klvjk8Kl%@yK)T&wlxbQ24Z!?G(k0coRN?Uwi&<-ttl76XOMGh?sN
zCA36TVp+9Z4)O7$oR4s~&6f7yO~VydeS>&2t+>uMgYl@P#aGS5ZI~xDxe#`0dFO3r
z<guqr+qbeyf@=Iz(#3&SFYqL(a#b6*z@(ylt>cU76KTwXJJ=~_K2OC~mYlyf>H1w!
z+E|&jw3B@-+LXkhoQPO?E0%zz$5#rKED68-rH3$AT?3pE2n0EZqe4t@RInNo0tUcf
z1gNt;`3zG2lspavM`$LJ64y`wAOZv74D>MD3JGz6LPVwiS4>0oWO34P;a~bmW#UDJ
z{wcvJqfvT>ID#HQ&uAYWxBny>h2MwUkH`NL{=aRhfXeR!0x%GS3W$SnQ~(L40s!cR
zYDl|7W@(NE=EKY4@$j)`x5z^4#|{i`U6DtQmzP*@MW=#|c8Y1RBEMrXK&jep_m(H7
zzs%S<rjc`=CNQT*%4_%A^J|X7ms36N)$#>i5+*%s-J?Tw9u(=4Y`AhkUuTJ3%X&O5
zd8Cq`t6tg2<_xrx7i6BT>^I3p5XpP9K8I^{)d5E=a8#zeN@(<y=5oQ!x#<YT%&k`(
z4dIR_)>av=ghOe3(s{<H!4p1f@JQC9v;~qFKqu<BxzhTeQP;md%sb*&<@`)bAuJ}K
zo}eFh9(K6zX*YgB_m-CeU-4KtBUdPMk?PeWLjH6kKO<2F6r1~Z1)N6m1VaE2P-Krg
zic{L&nUXqG4kz<#JusLM1pHqQz-j*{EeTb}sU|_MZNJ1MiS7IN-2f`WKhV?N-zPBi
z((jaS-^4cM0LTt;c9hO?hjAhGJL?rtN!&yJ<<^{nH}i#Q>`2#*DCe-}rt~hZh8aJR
zHyMb*;|tI?u9d0#2OiY@j>n)rOlbs&`a~vspQPhMCfdHH5iglVD1JKiavcyo*Hn0K
z3^v+;lmMCdHOwt*Wl7M81O4t7`$HPA^9^M}^IyMQVK0W&vl#9<t#-w!XBSj7hNWnF
z=^rnyXmLcZab#JFxBUtlGo1Sm4@y7%@s9tXOR>h=2C;jS9q)v=$*FCXPMd_6Z>;2B
zP_W-uZ+Y$v9~DXQcUWZx$S7L}cZlm7uoJk+37$slWn&g*rN)S*0v`g4$1wcN%r>0Q
dxo{=ByfDUNrUSCT5N_Cgqsu1i&cJ)(zX1|9wq^hT

literal 0
HcmV?d00001

diff --git a/test-certs/example-custom-oid.key b/test-certs/example-custom-oid.key
new file mode 100644
index 0000000..42586b3
--- /dev/null
+++ b/test-certs/example-custom-oid.key
@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEpAIBAAKCAQEAxyNyxFGSp5VDHOHMpOB23b1eeKFGs1GexrajYpVkZA5xq8ka
+SiyMPXEb38jybh2vTiH/YxzTqDpUfrnBZYnlQpx4GSzTT9+0Vwb0jmKitd/lZBA8
+zvfL3Ni2Ym0TpZQGHp/QyaVOvvqDiYjbrN+WJay5usHUxFDxFMP1NjyWCT9QKZPr
+divKtgFMQzCCoBkic33mKvSfi+3nd57ol83BJgjIvEZFkVg4R4/fSGWe3DW836rW
+TJOxj/FIDgGcPy1eWInQBHmF77CYTGuuVMMrGnV+brc4M4FlBUnQv8sy8S6XZBrf
+G1Z2npYHkvKCZM4LUOmKmpGGFACAlvmrBolIYwIDAQABAoIBAFbQmmkB0viiNtbx
+jYDXppp2wye9z4+/ZoPk/Yet7007iszEaGSr1Ru4ItnFxgLBiDp80dTIrXFqtIlm
+u+xjWIJYqnb3Nsxcj0ddbeJhF+RITr334jqshsCp7aEtQmJuDNju/VvbaGAT4KJl
++rb75n5YNcQ4WmSXkPJnl5Bki1hN75zjlnVlD+FV+/j0hz2Kg7mAQkJqbLn7Cd/4
+398qYABak0aAA2ZH2DeybZsZGstka2yIypQsJVQNYvxWcxCNweWMOljRPfxX50Oa
+ZIuuO70VQlXmIZYHruvqpImEOSWQtiVm2lTR+jVR6wof/oWOWkYqefoAQdLJy1ud
+FgEFUXkCgYEA7sSMOVM6pvz+ALz3aKFCqUYe+yA3HBkCUDF8ESVNnl9OMQB5mXRg
+J6kxr8z/Pu8P8J9Np87hBZPSJe7rFavfhjgxJ1rnrg73Btq4+TZ85qby3H57Ybnm
+SVohAWOQfEaPt9wD4AIy8p/tKBaWoNnBwuYBux52WX0iO2nZIgTA+W0CgYEA1YK2
+k55Rfo6WfUWCK3CyR+6kGfphxPY3GWkuckTh3M8cQvFzQEZ6p4eBPBxxZ9VtogXR
+CP5AXzHZYNhH9s9djmiZh/m0MHGKILQD3feD0dtypySQ0gCh+NOCxAProB2gDK5C
+kCOJ5x45nujiPcz8mqq/qvWBQjEaOunL8ivNdw8CgYBS8Ek5PHT6PpVI0lsqqCGM
+xUPLvcQG6ZUJIDdViVyt77MsiFq0+FzSSg5tX8smJEqoLd3+tXkqw89Sx+w3Ke3K
+JMjGP+iMaLxcUCvCva+jO0jPWMwpBTc+MaWXYut0j9oqZq2d6YWjC/SIYVhPZXTN
+67GcOxenPDVg6AK5s2cI/QKBgQCD5C8smUv2Rdaoo9t5QjCfRseQVJ84sG/w/ox2
+gh6T7Eyk/coYFnGGM6qdm2Rio/EJeVZbm9Pf+kcyD+jEiexdIDhXSuUIV9rfwNPy
+tgd0B3+XyHq9fy6PKvlIZLOVQTexHaR4rbtuTbmCdJHtY0dXs8qarPWgEf0GD46w
+lmZh+QKBgQDPPfnORduMYFTLmcqHBDIyK4X4Y4bZfsEJkoyRbPRP2YSTuliFzuUe
+qBDOPcy9JcDg+jAmTmPeaEKK3Ad516QpS4uk7u0n5AE3UTdiC7ICs4+VmGWOO2T4
+mQP1CdSxBEsYap5ZT1szVwRllInSHLqCeKDSI6LD+0AzA2biBaRmaw==
+-----END RSA PRIVATE KEY-----
diff --git a/test-certs/example-custom-oid.p12 b/test-certs/example-custom-oid.p12
new file mode 100644
index 0000000000000000000000000000000000000000..47e577519bfefd84e5b7717d5946c07778ab31cc
GIT binary patch
literal 2538
zcmY+^XEYp$76<S#)##mwZV{r4AbObu5hYOvqlOT@Oms#Wy+n_)L^r~U6(MSb5i1dG
zMhj7*t`dxl5-oXh&U<g)`*82M=YQ|HAAblOd>u#yLg3)_P`E^bUcxaw6^yD32Y&{}
z!3!_rrwAOF^Pd&83<svZjKDxD00IZP_-8|f;DOTo`vV;n6u|(d9=ftH)&np%0RpK3
z(Kygp-8^MZv+|y;(UN#ys>k3Mq_J2-xvP3oJ+D@rt`2`+w+q<j%4n>%b7HyE#uVhN
z#o@bTB&@8PFkRKev42%T^J`*wHX_#;w3|aYFs^8puIT+Jp_LL!pW5#xGr5zS%*v1o
z3~*LXx+<%hn*kl{WZ!32dKA-*(5Y^}xA%AR(<5@{QVu1VTDSJ6F^x;4UMll56iNIf
zr8`LtSqHtUQ`xB0_Yp4~j)kCv|16C<eC@xv_BbH$W9m5DHgsD|dZLi!j9a{OrhjgK
z9=S2_q1h1qP_ECQ<eK+ZUykB(3buR5sQ#%w_Cn@9rdZ|`U-CGc1ushx2bpg%v7~Z|
zk9~|K9H3{TnN-}qxu?AuTbFYn`axr1m02oAyZ`6%4zRo7C{y%BKK;~UZl`H&<v7hj
zjU=^^65Tat`6p+*qxI5)YLsfX#nlyMXCal8)TpuN^u{7BhGuZj1RG(m;OF;l%DT)y
z7<w;tYxx8*Ocj&*bfY^VVo&6SWHk6@g>U;;@d5i~xobJ-WO7oJg#(`t{@daYXNL{f
z-aLwG&00$vy$o?xgYG@OzIWIy^9)@jGU*8SBf-~p&-D0d&YVM}9E(2}5knQe^0{a?
z<VDdN`4MS#W>v<*-7t)0x^DSbc0u^)0Y~2KRf|57#>I>Z1!f9VKa`0_BHOfMWedKY
z{-_OUR!4);@6`Mhnyv)R#cg+^!O2izklOQiDiNaSfI%TP8zVLqqi~^P&wceK&uAv)
zGcV#+eW8!&u%dulSzK)=d}e$fp#6^Dh{}ZcU8RJg|5t*N-rqN)Fihv)y>`t#xoh>x
z3EP@U)xqJBOADw*rz<yN#*ewbyV1%yyMpP{37nQDj}h)nUrfq1?abHn@ocoThr2dj
zT&zEKPgv2Eenrr*&dRkP!9_E#SA;TiHA$VV;|3Emao33olHq(7s2d4N9|N=UnueKK
zcw&Z*GbDy5@W<X(z6<=2)r_v!W+7Mywp#r=*>HDQsZ`Ku(JP0Rgtl(tXi03meMFk=
zjSg~#1FKKtb<QeGE>3%EFcTsD`J+$$?C<tIIfLwtx7qmmW28d)B+KBmn*PM`eZ89@
zWg0am+~@g@GBOoSt1&G09-lo%BK)m}p28>E@GoX>2&mR@GU~vtS%)}#KWgD5|B;={
z+O>7|+D1VGNh4$o3kF(%yyp^x_m#s$Jx$I9YIv&TY^IYRzG;~^vTP~1h$g8LUY=y6
zziBKxC_%yt9E*M87o^bE+{(`4t)Z=(+W|8z5Wvw8k2>CGTJaR4jU%`taFC$?0iX;A
zc?8BmoG)XC%d&ye{)Yn^D&VCXyO(Zk{htz`UrOkcHr{5Fry71K0mgyfYp&4D_M|i!
zmHJ&|Odp;IbT5A;^&hJ6?#6d_8SQ-+i>{)}O;Ss<<EPxlCTvDBP>{%@ZIpQaYYFMZ
z-<`&IRCj{&P&Q~mrL%6I@tC!rqB%5qdqt12iF%aQa?`Rk%M9u9bb21w%v(sV;y!<f
zEwe0ds*;Fndulk=uJ-N(JHgmn5jlX)3vM(`6U+AZnwoq>U&=JPSvZWkGvD&e@Yxr0
z^NvL?o~Seu;<u$mI#PfY@vcsHZ-<Wrf;yJ+)%z|Dxns=FKa8e$!QB03kKtic)w5gy
z{i=~6Gc&I#Cnoi8fAwmgda6I#=-!cgTQW`56KF^n$cn0)vsh9=i7`q5Q99>Kg*Es3
z;kSx7JH*jr)&&jcpY*lt1s8N|h{!sHV&Lc0*<G2TAh#C-Q-gQ!{ZU|D!zz{QN6gI%
zvWjFBi20%+#2lt&Q#7spiPm(M-aG;|l~$E*{vsLzhrvx$V>!+e)ok;Ax=>v71z}mP
zSGLS54R8zjBhw6VgX7dZD%^+MX)~FkM-Su1-pgQV35QD*CIeoAY9@y#o;<U80FYUr
zR7EpO-d3=&OxqC&AINysF+b1YRUI485qd0VBES{I&|I<eW|E)VZAEcbTemk$af3<F
z)3;s6gg45FGi6hFpSD<Ne8PrvW=QsJXkO>l<)imr^L2jFiUZS<-CU!JqLeg{&wl)l
z1u$HQ$I0+o+|rPG>jtbhD{!^=Nj&OEy=(np+{IZSdqKG*$vXX<aCVxUm_xEibMKky
zB$x(CIF^1p_WkT^^wEN7QbiYfbbnPG!-W3}BLc*VD(Se?!peg6+nr5A$*Bi9w(Cuh
z8}3U@k$$21Y<Aw&-hLp3mw^?5O}loEWaZfjQfku%;&#++&CG-gi?Sw)nY})5VQrBU
zfyEOFm`-Pcyv2rs^<Os_eaZY5`*!RlREpqw3Qok&Y^e5z%xRrk_8Ip6sgQAc*CdQ~
zjb-inF`_ig_4#Cd14jv_{D|4%@TJG6PuyHrxu9kTnRHrIy8alIchkZf&<#I|2lt1@
zI}`qZi5BxhPJ-sKfuZ>bcV_Z1<MzF(LlMa}#2@nu2Eq+KS<+dj==H9n!aFdnH;bSv
zhLZXQs`)s{E_FyKaDnR9$nIIl_r^hcb@|58F{@9V1XMZ}wPEa7%oR(T%EH{w7L*XJ
zNVcSoYSb+?%IUZGP#Gb8Bxj(N<g%<xkv-<f%I51i2WU*;m9Tw(!kQh%Db>%LMC21_
zJam1_p2Rh_e@OQhLQC&Rp`4f`8tO~;o-2bk1tpJm6C<8TD$urexEm{abM);8cGlJm
zZs1Lou7uw|kC4x_T6enzA6<E~jTDo%`hYQ?4MO2V6-7usJ4oj1uzBpB^>C$7i1Mp`
z8&e%yAe7q#8NVOAchp8tWF!<YOn#4%w-bw;E6$+Np5*lV0iz~!t*QB?B;OuHoL1N3
z17ChJOA)Gy41L9#G;9KzzuUFA(gP-+^9PF2RLO3w3CIpj;vs!Isy;G(?^#x>Je=1Z
zBg*FuLRsdb#UcchQX_r68}cO{%sg8u@>-hVhb;w9uvJ90o-HEnoO%Pz+{i*B7hDg_
zEQG}|GUo-39y}RhSTy*Fk}Mh_{9hg6?6MqSHg__A9CS#cJxd_Y8hK*MO>AZ9M9BSf
z#3n1s_Zz?k5CV7r@CNt+ye?-cfHNQv@E8yP@V(5WF1tJ6Awm`*h=4;O*BL-SZU_L(
l762pm=#my;7@fl>@^m3n+rRrEz|{Wd&E=uI2kF0P{TF>op+x`y

literal 0
HcmV?d00001

diff --git a/test-certs/example-custom-oid.p7b b/test-certs/example-custom-oid.p7b
new file mode 100644
index 0000000..0880af8
--- /dev/null
+++ b/test-certs/example-custom-oid.p7b
@@ -0,0 +1,21 @@
+-----BEGIN PKCS7-----
+MIIDbQYJKoZIhvcNAQcCoIIDXjCCA1oCAQExADALBgkqhkiG9w0BBwGgggNAMIID
+PDCCAiSgAwIBAgIJAMnEiF0KGVsZMA0GCSqGSIb3DQEBCwUAMDUxHDAaBgNVBAMM
+E2V4YW1wbGUtY3VzdG9tLW9pZHMxFTATBggrBgEEAYKgMgwHZXhhbXBsZTAeFw0x
+NzA4MTgxOTQyMDZaFw0yNDA2MjIxOTQyMDZaMDUxHDAaBgNVBAMME2V4YW1wbGUt
+Y3VzdG9tLW9pZHMxFTATBggrBgEEAYKgMgwHZXhhbXBsZTCCASIwDQYJKoZIhvcN
+AQEBBQADggEPADCCAQoCggEBAMcjcsRRkqeVQxzhzKTgdt29XnihRrNRnsa2o2KV
+ZGQOcavJGkosjD1xG9/I8m4dr04h/2Mc06g6VH65wWWJ5UKceBks00/ftFcG9I5i
+orXf5WQQPM73y9zYtmJtE6WUBh6f0MmlTr76g4mI26zfliWsubrB1MRQ8RTD9TY8
+lgk/UCmT63YryrYBTEMwgqAZInN95ir0n4vt53ee6JfNwSYIyLxGRZFYOEeP30hl
+ntw1vN+q1kyTsY/xSA4BnD8tXliJ0AR5he+wmExrrlTDKxp1fm63ODOBZQVJ0L/L
+MvEul2Qa3xtWdp6WB5LygmTOC1DpipqRhhQAgJb5qwaJSGMCAwEAAaNPME0wHQYD
+VR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMBMCwGA1UdEQQlMCOHBH8AAAGHEAAA
+AAAAAAAAAAAAAAAAAAGCCWxvY2FsaG9zdDANBgkqhkiG9w0BAQsFAAOCAQEATglf
+3JyqYQXGA7cftxoNh8ZHbKlGwZ/V7qGPunhY+3lUdcU9nMrGJkHfhtHjbxwyMp8X
+in+oJWxvQC74MhwN4eYmbgxoeIhnWpwycuLC748/dEF3G+lbzPoBDGC7oaLdBdy4
+ChAAPGu47fQrkxCJP9TTYWrTcrgo7rioB+7v7Hu68nW3qp5hlcBOpI5f8SIm2RKJ
+MZDkavUrwQx/wRWqG5lrn7mRVNNJ1hO//NrfrcobtGdKCSH9uoNTCYvBtcATj+MG
+qfv1mmYaTzS3RGBd3w14bWxR9qBuFB5GccgPMzW6hMaIhGM5+qjdQ0GnOgnzn2g4
+qtGeN+uglDfulWZ7lKEAMQA=
+-----END PKCS7-----
diff --git a/test-certs/example-name-constraints.crt b/test-certs/example-name-constraints.crt
new file mode 100644
index 0000000..cbff43a
--- /dev/null
+++ b/test-certs/example-name-constraints.crt
@@ -0,0 +1,23 @@
+-----BEGIN CERTIFICATE-----
+MIID1DCCArygAwIBAgIJAL8xOGAOaSzBMA0GCSqGSIb3DQEBCwUAMGExCzAJBgNV
+BAYTAlVTMQswCQYDVQQIEwJDQTEQMA4GA1UEChMHY2VydGlnbzEQMA4GA1UECxMH
+ZXhhbXBsZTEhMB8GA1UEAxMYZXhhbXBsZS1uYW1lLWNvbnN0cmFpbnRzMB4XDTE3
+MDgxODE5NDg1MFoXDTI0MDYyMjE5NDg1MFowYTELMAkGA1UEBhMCVVMxCzAJBgNV
+BAgTAkNBMRAwDgYDVQQKEwdjZXJ0aWdvMRAwDgYDVQQLEwdleGFtcGxlMSEwHwYD
+VQQDExhleGFtcGxlLW5hbWUtY29uc3RyYWludHMwggEiMA0GCSqGSIb3DQEBAQUA
+A4IBDwAwggEKAoIBAQDkrrryvC1a63Vc2yCBb0SliieU6TnqZAQ5rJzAa4zf7uq9
+obwLuGfZV5j/7nYl04M2gPiz4Rk8uia14tIqBjFjB5DH7czuaPiGKgMSKMXt9lPZ
+xu3ZnRLRmF+I/zlIjxqLU9bxem7Qs7RBoncbbd65gy8PPe2J09rJdrcj5V/hD2jZ
+pNWtrYA6ANGsMSxLchtpn3LKyDy/bW2HIhXmqVIq/2j2p2ljKf6E63L4S7e7FW8E
+MGiW9y+DLO5U7qSZUiqgAiXHjTKWtYgbnlqboPtZRV5quN2PE0KD3FOLhAQX5MKS
+3P48+cjeswmruNVc8qjdCi1NLsRCTHukM/WxAC35AgMBAAGjgY4wgYswDgYDVR0P
+AQH/BAQDAgIEMBIGA1UdEwEB/wQIMAYBAf8CAQAwZQYDVR0eBF4wXKAsMA6CDC5l
+eGFtcGxlLmNvbTAKhwjAqAAA//8AADAOgQwuZXhhbXBsZS5jb22hLDAOggwuZXhh
+bXBsZS5vcmcwCocICgoAAP//AAAwDoEMLmV4YW1wbGUub3JnMA0GCSqGSIb3DQEB
+CwUAA4IBAQBDxhzTZc0fB7B2EvHmzz45J3xgk/aQksKFXeWxyX7UdgSY+gzABRMk
+txHCMZtdTJxi4BACpRlO4QMbJXSiofhGJQb+ThSvM1CQv+W5X4j7/40RBfRnWbQP
+ZGfxSyGhLYAIzUsHi6X7DbJmzV2EixPbYKCJ+5Vlf7IH0aDexzf4xKLQdy+cWy1g
+Y4bHiiQbVqfTjlzdsMuiFqoZe3/NhOP93XSMZErx6pJ/lrWiO+6ytM3gdwh1y0DE
+tFmaBKzI+2uQwt6DHQuPmOSEmI7NcrVS2WhPVPa7fIY/ExUy7jqIr2qM59eSl7OC
+AhzgLtgqfwLgbj5PWZENYlNRXmZGi4GD
+-----END CERTIFICATE-----
diff --git a/test-certs/example-name-constraints.csr b/test-certs/example-name-constraints.csr
new file mode 100644
index 0000000..678c951
--- /dev/null
+++ b/test-certs/example-name-constraints.csr
@@ -0,0 +1,17 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIICpjCCAY4CAQAwYTELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAkNBMRAwDgYDVQQK
+EwdjZXJ0aWdvMRAwDgYDVQQLEwdleGFtcGxlMSEwHwYDVQQDExhleGFtcGxlLW5h
+bWUtY29uc3RyYWludHMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDk
+rrryvC1a63Vc2yCBb0SliieU6TnqZAQ5rJzAa4zf7uq9obwLuGfZV5j/7nYl04M2
+gPiz4Rk8uia14tIqBjFjB5DH7czuaPiGKgMSKMXt9lPZxu3ZnRLRmF+I/zlIjxqL
+U9bxem7Qs7RBoncbbd65gy8PPe2J09rJdrcj5V/hD2jZpNWtrYA6ANGsMSxLchtp
+n3LKyDy/bW2HIhXmqVIq/2j2p2ljKf6E63L4S7e7FW8EMGiW9y+DLO5U7qSZUiqg
+AiXHjTKWtYgbnlqboPtZRV5quN2PE0KD3FOLhAQX5MKS3P48+cjeswmruNVc8qjd
+Ci1NLsRCTHukM/WxAC35AgMBAAGgADANBgkqhkiG9w0BAQUFAAOCAQEAf486fgU4
+srGDTypLMY/rBBf/Y8Dhp+O/bEeHEDbSCBM4k8/WwsQvgZqwkvzQ6xW8HAXBWDe6
+r0swDFc4wkKPpwQBhAu6JT8FxozCfbsGT9ITBESWZnphs5bXJmhcXFOjNa78jSPX
+uygXlQZB+vKmpURZYehg/sLBFTUslOtrM/PTC40KZfLP6CgRiMASQbZyKcKudHJi
+sSiyK3FLCeMoIEDiDAT7CdTH6VKRwgIH9S/D2ZtuNAm0rS2HjRjH3HOYPJy5S2Gl
+V8k1LPiCcMc2eDhSkbESvn4MLORHGQdm+bonduG2xn+Mm1WZGF5sVcJ4u13oG06S
+WcVAIB7TSGAoDw==
+-----END CERTIFICATE REQUEST-----
diff --git a/test-certs/example-name-constraints.jceks b/test-certs/example-name-constraints.jceks
new file mode 100644
index 0000000000000000000000000000000000000000..498f74e819e3ce583291925e9122893aafb73ff8
GIT binary patch
literal 2333
zcmcgsXHb*r8qJqR4?;kCkt+QQJ%A{1K?MXf3QLh5no=%RkyQx2OHdb(jtz+*9U;;b
z0g>Ka0-+fe3`!M5$%5m~Txah6dw)Fh&Uw!H@ji3ToW8!kJ_rN?Js9A}@Z+z!_y%0X
zEBU$j;+5R|{epr6UA+B*gAN3jw-<!JK_KvtAOXGv3L;q)kN_NzhoS+H1J0bi6ygpK
z^)`Y6Ja7WM3nfddQqe8v6_(}t_cf^@9U~ocT>H!6x-Q}HiQU>n%j>n;mNtQxNHZDs
z_9Lbprz!d#GfcE2{xA3G{QmAGZ^v;kK@7WaVdty>?e43B^b0CP`?H=1tzL!Z5?B#y
zla-8IXwlZ7bLJ^{4llAnn|ksZyX(+qlAuMI^!04r!E<tz0U6QCYL0X3ky8oQStWL1
z@q~&wllz9b@X6uPDXaNQ={%LZ9y`C+yz%le!X9JYMJ%qj>CeZW>FD7+-!QHmGXm*v
z)Sp&*)uw+pkd!_0O@e$UetuQ5j$P5uQYtkvoIRM?MYh1*J`{TtIaVRQ;wN)@Hm|S#
zUibS?C%a1h2auhV5EfGE)+l9_z_G?JLd_5AjF%_M7ghK72KAl{kNw&m@<6RGxD%;(
zRHY7#n-^KE8hg59dWFF>RaVMW?;DE}cA$-p)Upi~X`Gs1FDK8cRjwRIXrBE&yxk{)
z9MEdkjSX)`t#18w?sOBtA);n7=vro8IW$I8W_(_8!qYah=>GV8vq)&$w?{6OmbW&7
z#jN!BxT7Sd#oFQnv+B@ieUxQ;JW7}6yFMie@(=OdC}PlY4~e*=(DvOX<IFSjnxr)O
zKj>rZJu(nM{6qsoveQdx|GDw(C)lh4I&;K6>uTYEHCY#aLRdG%i1m?afHd5RN~3l^
z9vd8gW^;!8EWx_p;4B#x89bCFqgb=NdD$n+y2517v)?><;$0L+>tp^96NzoXp0cC$
zQVJ$dnhS^_QejXUZ#&3=jD>Vk5CX5<8c9oh<u=u-^wQ-?_rXb?3@_3H&8Nv*5$b5S
z3in#vR_VHR%V*Wlrmw$eGTS2%l&be_&BR%*SKlf3uuA7Wojf*j(gQwOe@M+0;+C^k
z9}?>jC7H%Z>aROAMJBjCbE=jMJyCC1+>)keztta9YAT&qs(IC0sqJ(QRk8V_Vcs}1
zu_DQ9(ZYLvj|v2{`MgfXM0QARJQwvrMv+&b21&-AO>>C`nH}Oc@r|GTs6MBA&n_y4
zSOw%sz3(cG@5y_9lil#cjvXCiTk+(C@mJ$auB5N+fY%%~19!FP9oKc5LSbQ`R*qzF
z`Y}qjSX(HW_989+Wt#z!+)`J%8CUSOrD3SjGpy&MnCdlY-SV_~9qk#M&p9B6Imo#?
zTPyeDLW`{Nh6Sq6P;1YPYkfn|rufSX>#5u$MAFF&1$9Xmt+&|aF(1d2)PS#Y_6^#t
zpJQRy?KbLi5b;h6YTMk-zx8pDe0jqR<p_$RYjiMt-qH2#l|;!7+|52(UzKi!a5(AC
zQpVh-m=`ui09lvOcpItaF0N`JK2s%Q-K5%_!YD*RnSBCYYr!MrY-z&BJR*F(_9uOD
zoD7LVoky$4*$-<{f-Z^qsKo`G;LED@?M%_Od4xAnDk^TU*<1+GkP`9b`$n;rd(UxK
z4aXA=mURW^ZzK&MoOnVk=1RP6vvQBWxqnqsSha~({OGzeZ>RkdT}6IXeDBRJD*B>I
zo<?2M{`qr(%2v8+)sieW@1|~6R|5@<*iTa4dvP{lpe;|$yq>b8d{i6%D?FXT{(T_d
zVJSEuMKoUfb1O<Ahf?QQM$Huyzk`(Kv^pNKVLc9K-AUHS{?Uqv-;^~#ECd3Z012=W
zkN_nY!k_>Y$^vP@Xgj04726Kd$|4_kChiLd0I(q-pbLf#WI@6%!I5a_CEP!N84Wcu
zz#IWlhYTy4$qgSE?Ct6Q&xQ@n^s|03$3U?|4GjH13mFvU<G^Tv+8AvNR$W^IwBzGY
zRR=XyRe!?&#}^2I#D5+RARsUTzzG2f04tOL0FZ_9#&xoi-AahVpW;#e|9Y4td*?6g
zvO640%5A-pGPAn;vWU#q;5liN#aIoM9*)+G+^L=w&})>bog0!zV%(T+chcXjdhNu?
z!?=%k(6@1uZ|IYG+=E$82@LF+biriY*jl*XKy{5lahQ<r^owW}&J*;+;rHF4^^%KD
zvz%U&4@RFoi`0P(k}!&9fkNH|fp5F?T6}%uC3ruSUXW*aZ9n#QliQD33EVNOZ{qcb
zgI@Q(s6;ESUR-^UeL=nuD&3i?dapJ?DBtdW;hwFrqfY}R9c>srg-ecs^DVR!r}p)B
zyQZsI${I!;)}K&VmCh-@HZ;HSKy9lMqO=Qz0T7@hDh-TE{^7X@Cjc<ua2ON{2e}XY
z6+s_jW)OMsKmiDdKirAJ9YKdeMG!?`SN<6XWjB9ckTssU^$7&RU_c-sD(V-m=vTFW
zpy#2QmG!@<54m5ndSDp<F?u6BjPDg=dLGKX_Mu-ND;wdQxqX}19(#GQvis&pC_L*c
zdn*DhRnOIqxqsO_*Oht%`cS}P7A7PeTwJtcB8}X);Hglvy4|w)!YN^ok;;YG^t7$v
zboX2{J65C=$=qwkl>BgyqspWAa!fM%Pv^qKy}S5ZRZN40)16v7uZsu5RC4W=oZaF&
zlca>K9}lNFP@eY`AAKrt<5q9X{C7%lio5CBGV#{E+G5?+s+wME7;{L^sn<2OIdD?f
z-j&<!)6pVq=~)XgS!un2wHGG6EH7?1MZ}#%^Qx}uBvkmM(8h^>R1=`WROJczTTrT>
mzNKvjhb!*9qlZayRP_FUNO{VRdKbP0yIE2`GoY)vIr=wv%mFC?

literal 0
HcmV?d00001

diff --git a/test-certs/example-name-constraints.p12 b/test-certs/example-name-constraints.p12
new file mode 100644
index 0000000000000000000000000000000000000000..b18527e99121de886b2996cf8cdb198b01acac49
GIT binary patch
literal 2718
zcmY+^S5y;P76#xXgaCm=>7huGjtK;i>d=E4>E!~7(wov$svs?JDN-XvF1<_d9f=@K
zsvzMCLO_TDp)0)zgR^GFnTNB^zyE#KdHm2gXgUZ;g~maxA#~yqw<8W<KpJ2!4r&O-
zL3J-`EE)%X`+Eh+#er)sstOPgaB&s=-T=|u5a_>uU;skUa4>DTM<R}YR+|C>(E>tn
zU_U8?!K<(BX|&}PA5HK(FL?<?+VpiBEV<37Z}Kq)12ZaYPompQDBR-Ld)<K;pO;#5
z*aVt85^Xm;=?U?uciN1S^hrRXED{<ganrqH-%-?nEs#|<pjX^SjN@7L$)og?vzmn0
zysp9rhEEYU(o1o6mcbp~n=zH{j$e%FV&{I6lZm%>IHipHPnAB_m=(ajlHCX)R1+q+
zpdzN;XBl&aII1Pzd&;RM?i!!e=QWRH&L*sRoLEQOb+Al5=Z=fEBAz=GSI7_hK2jJ(
zWrlwiR>qTsiL9UXy^p9}gp2WdD0C#Acs~ob--+3s@*b=T(n!F#j*I3`7FF#FSlFvd
zzo|hOqlwQ1I~kXcTo`10U29<aQ!7G5j(!!!Bns93WJXE8hC=}*C-%(f$cVL$b^5S@
zfEorUr`o7!5=q>MV*KNv<lBsR-YctTUXar=TfIJ!2fQH@=2;7cMe-w8>-NfG!_rWN
zCrxrE!j8t-#dRUwj)uw^Dk(jE_+c{D+1(Y(6{jBTiJv-Gb#+u3!r3bqe<kt|7yMQJ
z)&wgvP!~Oup#Fr@0Y@*%8-L25f+SPP*L7!;WV>_}_hO09*)_UJjea2`K)DhO%mbs(
zbgCuhmTXGJK<WOdeJ{6zcmiK5mPc+^35$?NCM`&PP8o)I1%mvF3oUR9?>~RI&IVu%
zIg>c{vKZdkCc4#(*EM~DmS>N5y>2+P7c*?=xuHA*@ESTE5%GIY#oK3{ge~t+uBU3T
z|C_!OlKucQBz1dw+lnS*pA*<F*vusebo64X6u2j>4yFTk{b1%;xfF&*L^9?TAe<R8
zNcBM;DkB;gBrry`fK75hiM52O6r8x~7@im>^r1a?kF5v3Yz^rY6A#><Pa3d3z0c@K
zlUAlj-Yz8w^I?vLii7iz$gjlP&~@dVcrP~YMS>aQ>sr!E>tX40-#j6plJkncZsXbK
z7TFJm>To9e{sgUJ4)`N(gbA&W!IV$quDC@Z|8SWgzP*_s_SQBz8^WYw=~JRRs{=4<
zUy#-PA?>0@>R&E3jZF<|2z#9tl;a@N31tpXQVBh`H;B42a|b0v+eXv`Ieh;|w!u>W
z!8o}HyH!sFQfm9d7Gvq)^yNTvkBF+15P_?-1@o^G1jew@$+2aAxQVga)mG*?+_Yo>
zHX`2UZ}~hMKfReIE@~0Uc9U8egL<AS9q}(?{O9sB2#z4brCIA`illo~3_rCoq9%19
z6{g43MC=evr6{e}#4uRnu^#S3nVb^f&C#&TJvM=-TwTv5%sY9@)l2IoWv>Suu1E{0
z5GJ|5<f~TJj4aextoVhSHeQYgUUk7QY*;YmuWviWeH*|_q_9*DdR~bU-7BFFTb$bT
z2CELu_UPyzMt^1L^0u{F&eb2e`7`G5MJtk9?<;XsCcNtpI|@6DJVb{XS%Ggq_~!N$
zzjQfGEM6gc=~KMa$20^Cr&MT_Q5_6>Ke)!A)DW;>XEYZ&C;PaPbP#?v@I87Njibi>
z4^+80YELkZ+T)^jxj0S``v0&61%fVo+q{5n_5U=Z`lT8Ec+#wwC*Ay)W?&rnz2Ag|
zr#r>YlN42P2{9bqj1KloG}1i??RE|2Xv-YG8_>4DoNN62U9$eVJ_r?w(wjPCr*&KY
z3<!}5#aq&@O1x^?DnJ08gE!o@bm}qguE)Aihb3kk)4(@NiLXw`<{Ej$$uGn6dPS=i
z(zu%aBczh~sxM3NN<k7aW1YqgpT{ug)r)IYELm|{Gy8h0KZ>&}V4oA26D-N*%r=~b
zMZ0RxTN&lxtd<X^W7VE`X}oWFL?%wjxiY@fol-mQ&&-!l#WCn-Zb?^RWBq!mM{5s`
z%(u8Ey5Tc9^KVNg1QpU6eX{=Kx&Ojm-ncYKj$S>owG4Il1CeOVB%A2ox(RyoDV&|X
zoUbH>WrNOlnW=6Z*G$(b`%|{+oaLOATEwIn5QU8pFvF4*MkBuN4-Cy}$W0yle^+$T
zIo^eD<{AVT3xL1pJgJ2B**M*`>auXb$g>w)XXWs9VIv8#8c+f7wr~sTx}j5J*PvfI
z2fgKolQq<n3~tjD&HcUJxsF0cQe5}tn>&CFACRFLr&axQQ%BX2gau9E(K6h7Br574
zU%T8nw?tf24`CLa9a{5qesXZ3{M@}tSLC>D4#!99vXM=Azoh_Cyob{imFaapQFZWI
zj|m%6P&Bz6%15PrgLik=>OG_PC`jhhheY0&_isf{6|!7=oZ39bvrDtpV|A^jx%rJz
z<itIf<bH*<A=8kDr*c=lp^jp`J0InkwSAR<jvck8f3PlX`4W)OfV;KrgxuDq`F_qd
z^|zmD{WrFyrQDF7I`6wt^4IU4C>`3RpVxn{MrlP#I%p+iPs@>@s^HUxG^fC|`4hG;
z`&js2!8^VE=h{2h-u`$3IxQbQ7RsJCG1w&gZ|MAiDHJsn2+o>ltq?5uWN*)`X>^I|
zbG7cOw9s`KxlDr|_y!$YaV^S|K|*Y>lMBPIbK`!$)*a95$ehNXH-x_hv&lT9TdqW-
zI0dJvB?pkOu!?T)$QSyunbw2z>9OkE=_Jm_;;+WsNcDK$`h)&34#zQgV4VM+G5#@S
z#BBrlVwWTHv+_!#gn0UrU`q<PWpiz!Vr-Re48&Wzx@-M$U$7wQuZG|%24_M?{#Z`&
zoyh#np>OlW+O_s>N^i2rFd&HUYgaDpb9%4es~%p5qQ#P02{Vwvx0~g{=iVXX=VGeD
zkAgfXsw}1eu=3>!ei1MJp5b+!-J2Um-&k^|^tPKm93`e$K&EiF-X8!2vKF_b6|M>>
z{hUWl-&4>?v3l4>0MJu}wGeam{{Fs4&PsN{`7lN8zx#>1aaSIGNqtAT%CjDmT6c=@
ze(S9)A8__un6G8$PxWKjTYUD$VroiJK5TUR*+$)3t3i)gA7nFB-`TY3R_pF<RQc}B
zY{|a`33!{p)mapN@Xc*<$iNI6&3-;e!(_{+8#>wdkUf)XQt=>O({?>@Bfjp6(wpI#
zFcoFm$SWKUGjvb36`B0-Y&L3ngLelW+3{7}%aZA$Y#tE?^JPZ~rlM*M*9`)@R`efc
zs|X#u0Mi_YxV$WC|Ih|0%UbkLBS5HcUlRPT9W|kP<D85_?sX048dN)APyf<gOwti-
zdxjeKYGUi%-MPu6=`L*?CtB*NN!|<_)l%M6mvTf4{8vXhRw*_x3t|wez|~r&+&GQY
zFgXk)i6CXm(5k;5u}DetpaBj5KY$Iu4e%J?dXZ58_kT^lk{!U~V)6ud0iIrT4==J8
zz!NQn=10>(sIS4PK%CS7Fw5iN`x*GU%?<_CDP-~_C9v8l@fMgi$BVw%Xhih+FJ}J<
Dg#7u)

literal 0
HcmV?d00001

diff --git a/test-certs/example-name-constraints.p7b b/test-certs/example-name-constraints.p7b
new file mode 100644
index 0000000..5f047d5
--- /dev/null
+++ b/test-certs/example-name-constraints.p7b
@@ -0,0 +1,24 @@
+-----BEGIN PKCS7-----
+MIIEBQYJKoZIhvcNAQcCoIID9jCCA/ICAQExADALBgkqhkiG9w0BBwGgggPYMIID
+1DCCArygAwIBAgIJAL8xOGAOaSzBMA0GCSqGSIb3DQEBCwUAMGExCzAJBgNVBAYT
+AlVTMQswCQYDVQQIEwJDQTEQMA4GA1UEChMHY2VydGlnbzEQMA4GA1UECxMHZXhh
+bXBsZTEhMB8GA1UEAxMYZXhhbXBsZS1uYW1lLWNvbnN0cmFpbnRzMB4XDTE3MDgx
+ODE5NDg1MFoXDTI0MDYyMjE5NDg1MFowYTELMAkGA1UEBhMCVVMxCzAJBgNVBAgT
+AkNBMRAwDgYDVQQKEwdjZXJ0aWdvMRAwDgYDVQQLEwdleGFtcGxlMSEwHwYDVQQD
+ExhleGFtcGxlLW5hbWUtY29uc3RyYWludHMwggEiMA0GCSqGSIb3DQEBAQUAA4IB
+DwAwggEKAoIBAQDkrrryvC1a63Vc2yCBb0SliieU6TnqZAQ5rJzAa4zf7uq9obwL
+uGfZV5j/7nYl04M2gPiz4Rk8uia14tIqBjFjB5DH7czuaPiGKgMSKMXt9lPZxu3Z
+nRLRmF+I/zlIjxqLU9bxem7Qs7RBoncbbd65gy8PPe2J09rJdrcj5V/hD2jZpNWt
+rYA6ANGsMSxLchtpn3LKyDy/bW2HIhXmqVIq/2j2p2ljKf6E63L4S7e7FW8EMGiW
+9y+DLO5U7qSZUiqgAiXHjTKWtYgbnlqboPtZRV5quN2PE0KD3FOLhAQX5MKS3P48
++cjeswmruNVc8qjdCi1NLsRCTHukM/WxAC35AgMBAAGjgY4wgYswDgYDVR0PAQH/
+BAQDAgIEMBIGA1UdEwEB/wQIMAYBAf8CAQAwZQYDVR0eBF4wXKAsMA6CDC5leGFt
+cGxlLmNvbTAKhwjAqAAA//8AADAOgQwuZXhhbXBsZS5jb22hLDAOggwuZXhhbXBs
+ZS5vcmcwCocICgoAAP//AAAwDoEMLmV4YW1wbGUub3JnMA0GCSqGSIb3DQEBCwUA
+A4IBAQBDxhzTZc0fB7B2EvHmzz45J3xgk/aQksKFXeWxyX7UdgSY+gzABRMktxHC
+MZtdTJxi4BACpRlO4QMbJXSiofhGJQb+ThSvM1CQv+W5X4j7/40RBfRnWbQPZGfx
+SyGhLYAIzUsHi6X7DbJmzV2EixPbYKCJ+5Vlf7IH0aDexzf4xKLQdy+cWy1gY4bH
+iiQbVqfTjlzdsMuiFqoZe3/NhOP93XSMZErx6pJ/lrWiO+6ytM3gdwh1y0DEtFma
+BKzI+2uQwt6DHQuPmOSEmI7NcrVS2WhPVPa7fIY/ExUy7jqIr2qM59eSl7OCAhzg
+LtgqfwLgbj5PWZENYlNRXmZGi4GDoQAxAA==
+-----END PKCS7-----
diff --git a/test-certs/openssl.ext b/test-certs/openssl.ext
index e48c744..9f42098 100644
--- a/test-certs/openssl.ext
+++ b/test-certs/openssl.ext
@@ -7,3 +7,7 @@ subjectAltName = IP:127.0.0.1,IP:::1,DNS:localhost
 [root_bad]
 keyUsage=critical, cRLSign
 basicConstraints=critical, CA:TRUE, pathlen:0
+[root_with_constraints]
+keyUsage=critical, keyCertSign
+basicConstraints=critical, CA:TRUE, pathlen:0
+nameConstraints=permitted;DNS:.example.com,permitted;IP:192.168.0.0/255.255.0.0,permitted;email:.example.com,excluded;DNS:.example.org,excluded;IP:10.10.0.0/255.255.0.0,excluded;email:.example.org

From 9fa238ed8e19c4311da94d6ddc16bd85bae0ba80 Mon Sep 17 00:00:00 2001
From: Cedric Staub <cs@squareup.com>
Date: Fri, 18 Aug 2017 12:52:51 -0700
Subject: [PATCH 2/4] Require Go 1.9 in Travis-CI build

---
 .travis.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 207116c..e375f43 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -3,7 +3,7 @@
 language: go
 
 go:
-  - 1.8
+  - 1.9
 
 install:
   - go get github.com/Masterminds/glide
@@ -33,4 +33,4 @@ deploy:
   on:
     repo: square/certigo
     tags: true
-    go: 1.8
+    go: 1.9

From 892328ae857f8bba8a9945a5020fb51d48477a1e Mon Sep 17 00:00:00 2001
From: Cedric Staub <cs@squareup.com>
Date: Fri, 18 Aug 2017 12:53:04 -0700
Subject: [PATCH 3/4] Update README to mention Go 1.9 requirement

---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 4060581..ef17141 100644
--- a/README.md
+++ b/README.md
@@ -27,7 +27,7 @@ On macOS you can also use homebrew to install:
 
     brew install certigo
 
-Note that certigo requires Go 1.8 or later to build.
+Note that certigo requires Go 1.9 or later to build.
 
 ### Develop
 

From 284598d9f2b79ab3ec63cf23b4fabe1b02d7abcd Mon Sep 17 00:00:00 2001
From: Cedric Staub <cs@squareup.com>
Date: Fri, 18 Aug 2017 12:56:43 -0700
Subject: [PATCH 4/4] Add test for certificate with name constraints

---
 tests/dump-name-constraints-to-text.t | 56 +++++++++++++++++++++++++++
 1 file changed, 56 insertions(+)
 create mode 100644 tests/dump-name-constraints-to-text.t

diff --git a/tests/dump-name-constraints-to-text.t b/tests/dump-name-constraints-to-text.t
new file mode 100644
index 0000000..2741971
--- /dev/null
+++ b/tests/dump-name-constraints-to-text.t
@@ -0,0 +1,56 @@
+Set up test data.
+
+  $ cat > example-name-constraints.crt <<EOF
+  > -----BEGIN CERTIFICATE-----
+  > MIID1DCCArygAwIBAgIJAL8xOGAOaSzBMA0GCSqGSIb3DQEBCwUAMGExCzAJBgNV
+  > BAYTAlVTMQswCQYDVQQIEwJDQTEQMA4GA1UEChMHY2VydGlnbzEQMA4GA1UECxMH
+  > ZXhhbXBsZTEhMB8GA1UEAxMYZXhhbXBsZS1uYW1lLWNvbnN0cmFpbnRzMB4XDTE3
+  > MDgxODE5NDg1MFoXDTI0MDYyMjE5NDg1MFowYTELMAkGA1UEBhMCVVMxCzAJBgNV
+  > BAgTAkNBMRAwDgYDVQQKEwdjZXJ0aWdvMRAwDgYDVQQLEwdleGFtcGxlMSEwHwYD
+  > VQQDExhleGFtcGxlLW5hbWUtY29uc3RyYWludHMwggEiMA0GCSqGSIb3DQEBAQUA
+  > A4IBDwAwggEKAoIBAQDkrrryvC1a63Vc2yCBb0SliieU6TnqZAQ5rJzAa4zf7uq9
+  > obwLuGfZV5j/7nYl04M2gPiz4Rk8uia14tIqBjFjB5DH7czuaPiGKgMSKMXt9lPZ
+  > xu3ZnRLRmF+I/zlIjxqLU9bxem7Qs7RBoncbbd65gy8PPe2J09rJdrcj5V/hD2jZ
+  > pNWtrYA6ANGsMSxLchtpn3LKyDy/bW2HIhXmqVIq/2j2p2ljKf6E63L4S7e7FW8E
+  > MGiW9y+DLO5U7qSZUiqgAiXHjTKWtYgbnlqboPtZRV5quN2PE0KD3FOLhAQX5MKS
+  > 3P48+cjeswmruNVc8qjdCi1NLsRCTHukM/WxAC35AgMBAAGjgY4wgYswDgYDVR0P
+  > AQH/BAQDAgIEMBIGA1UdEwEB/wQIMAYBAf8CAQAwZQYDVR0eBF4wXKAsMA6CDC5l
+  > eGFtcGxlLmNvbTAKhwjAqAAA//8AADAOgQwuZXhhbXBsZS5jb22hLDAOggwuZXhh
+  > bXBsZS5vcmcwCocICgoAAP//AAAwDoEMLmV4YW1wbGUub3JnMA0GCSqGSIb3DQEB
+  > CwUAA4IBAQBDxhzTZc0fB7B2EvHmzz45J3xgk/aQksKFXeWxyX7UdgSY+gzABRMk
+  > txHCMZtdTJxi4BACpRlO4QMbJXSiofhGJQb+ThSvM1CQv+W5X4j7/40RBfRnWbQP
+  > ZGfxSyGhLYAIzUsHi6X7DbJmzV2EixPbYKCJ+5Vlf7IH0aDexzf4xKLQdy+cWy1g
+  > Y4bHiiQbVqfTjlzdsMuiFqoZe3/NhOP93XSMZErx6pJ/lrWiO+6ytM3gdwh1y0DE
+  > tFmaBKzI+2uQwt6DHQuPmOSEmI7NcrVS2WhPVPa7fIY/ExUy7jqIr2qM59eSl7OC
+  > AhzgLtgqfwLgbj5PWZENYlNRXmZGi4GD
+  > -----END CERTIFICATE-----
+  > EOF
+
+Dump an example certificate with name constraints (example-name-constraints.crt)
+
+  $ certigo --verbose dump example-name-constraints.crt
+  ** CERTIFICATE 1 **
+  Serial: 13776854720312847553
+  Valid: 2017-08-18 19:48 UTC to 2024-06-22 19:48 UTC
+  Signature: SHA256-RSA (self-signed)
+  Subject Info:
+  \tCountry: US (esc)
+  \tProvince: CA (esc)
+  \tOrganization: certigo (esc)
+  \tOrganizational Unit: example (esc)
+  \tCommonName: example-name-constraints (esc)
+  Issuer Info:
+  \tCountry: US (esc)
+  \tProvince: CA (esc)
+  \tOrganization: certigo (esc)
+  \tOrganizational Unit: example (esc)
+  \tCommonName: example-name-constraints (esc)
+  Basic Constraints: CA:true, pathlen:0
+  DNS Name Constraints:
+  Permitted:
+  \t.example.com (esc)
+  Excluded:
+  \t.example.org (esc)
+  Key Usage:
+  \tCert Sign (esc)
+