Add certificate validation events

.github/configs/os-check-linux.json

@@ -592,5 +592,14 @@
  "configure": ["--enable-leanpsk"],
  "extra_cflags": "-Wdeclaration-after-statement -Wnull-dereference -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE -Werror=implicit-function-declaration -Wno-error=cpp",
  "check": false,
- "run": [["./wolfcrypt/test/testwolfcrypt"]]}
+ "run": [["./wolfcrypt/test/testwolfcrypt"]]},
+{"name": "cert-events-crl",
+ "comment": "Certificate validation events without the compatibility layer. --enable-all covers them with OPENSSL_EXTRA on, where the TLS verify path and the error codes it passes on differ.",
+ "configure": ["--enable-cert-events", "--enable-crl"]},
+{"name": "cert-events-crl-asn-original",
+ "comment": "As cert-events-crl with the original ASN.1 parser, which reports field failures from its own code and rejects unique IDs outright.",
+ "configure": ["--enable-cert-events", "--enable-crl", "--enable-asn=original"]},
+{"name": "cert-events-tiny",
+ "comment": "Certificate validation events without CRL and with WOLFSSL_X509_TINY, which does not decode some extensions the strict checks use.",
+ "configure": ["--enable-cert-events", "CPPFLAGS=-DWOLFSSL_X509_TINY"]}
 ]

CMakeLists.txt

@@ -1944,6 +1944,10 @@ add_option("WOLFSSL_CERTGENCACHE"
     "Enable decoded cert caching (default: disabled)"
     "no" "yes;no")
 
+add_option("WOLFSSL_CERT_EVENTS"
+    "Enable structured certificate and CRL validation event callback (default: disabled)"
+    "no" "yes;no")
+
 # Chain verify callback
 add_option("WOLFSSL_CHAIN_VERIFY_CB"
     "Enable replacing peer certificate verification with a user callback (default: disabled)"
@@ -3577,6 +3581,9 @@ endif()
 if(WOLFSSL_CERTGENCACHE)
     list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_CERT_GEN_CACHE")
 endif()
+if(WOLFSSL_CERT_EVENTS)
+    list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_CERT_EVENTS")
+endif()
 
 if(WOLFSSL_CHAIN_VERIFY_CB)
     list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_CHAIN_VERIFY_CB")

ChangeLog.md

@@ -26,6 +26,26 @@
   curve equation need no curve arithmetic, so both are still done on the host.
   Both macros are documented in
   `wolfcrypt/src/port/nxp/README_SE050.md` and `IDE/CRYPTOCELL/README.md`. by @SparkiDev
+* Added certificate validation events (`--enable-cert-events`,
+  `WOLFSSL_CERT_EVENTS`; off by default and in `--enable-all`). A callback set
+  with `wolfSSL_CertManagerSetCertEventCb()`, `wolfSSL_CTX_SetCertEventCb()`,
+  `wolfSSL_X509_STORE_SetCertEventCb()` or `wc_SetCertEventCallback()`
+  observes each certificate and CRL check: a DEFECT event for each failed
+  certificate or CRL check, with the certificate's role and chain depth, the
+  RFC 5280 field and the reason; a RESULT event when a verification
+  finishes; an INFO event with each certificate's algorithms and key size;
+  the certificate's subject, issuer and serial number and the TLS
+  connection; and a stable condition value for each failure, named after the
+  IEC 62351-9 and IEC 62351-3 audit events, for security logging such as the
+  EU Cyber Resilience Act calls for. The callback cannot change a result;
+  the verify callback still decides.
+  Optional strict profile checks (unique IDs, no AKID, a CA without key
+  usage, no CRL distribution point, no OCSP responder, a CRL thisUpdate in
+  the future) are reported as NOTICE events, and each can be enforced with
+  `wolfSSL_CertManagerSetCertEventStrict()` to fail with its own
+  `ASN_STRICT_*_E` error. They run after every other check, also when the
+  verify callback allows another failure, so allowing one failure never
+  skips another check. by @sameehj
 
 ## Behavioral Changes
 * **Behavioral change (DSA now uses the leftmost |q| bytes of the digest)**:

certs/test/catalog.txt

@@ -19,3 +19,13 @@ cert-ext-oid-collide.der:
   OID, not the mapped one. Does not collide under WOLFSSL_OLD_OID_SUM.
   Signature is invalid; only ever parsed, never verified. Regenerate with
   certs/test/gen-oid-collide-cert.sh.
+cert-events/*.der, cert-events/*.pem:
+  Copies of certs/server-cert.der, each with exactly one defect and signed
+  again with certs/ca-key.pem, so verification reaches the defect.
+  good.der has no defect. strict-*.der and crl-this-update-future.der test
+  the strict profile checks; strict-good.der passes them. The chain-*.pem
+  files are chains for a server using certs/server-key.pem, with CAs keyed by
+  certs/intermediate/ca-int*-key.pem under certs/ca-cert.pem; chain-good.pem
+  has no fault. Used by the certificate validation event tests in
+  tests/api/test_certman.c. Valid until 2049. Regenerate with
+  certs/test/gen-cert-events.py.

certs/test/cert-events/chain-good.pem

@@ -0,0 +1,44 @@
+-----BEGIN CERTIFICATE-----
+MIIDjTCCAnWgAwIBAgIEDOfhATANBgkqhkiG9w0BAQsFADAdMRswGQYDVQQDDBJD
+ZXJ0IEV2ZW50cyBJbnQgQ0EwHhcNMjUwMTAxMDAwMDAwWhcNNDkxMjMxMjM1OTU5
+WjCBkTELMAkGA1UEBhMCVVMxEDAOBgNVBAgMB01vbnRhbmExEDAOBgNVBAcMB0Jv
+emVtYW4xEDAOBgNVBAoMB3dvbGZTU0wxEDAOBgNVBAsMB1N1cHBvcnQxGDAWBgNV
+BAMMD3d3dy53b2xmc3NsLmNvbTEgMB4GCSqGSIb3DQEJARYRZmFjdHNAd29sZnNz
+bC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDAlQjhV0HycW23
+0kVBJwFlxkWu8rwkMLiVzi9O1vYciLx8n/uoZ3/+XJxRdfeKygfnNS+P4b17wC98
+q2SoF/zKXXu64CHlci5vLobYlXParBtTuV8/1xkNJU/hY2NRiwtkP61DuKUcXDSz
+rgCgY8X2fwtZaHhzpowYqQJtr8MZAS64EOPGzEC0aaNGM2mHbsS7F6bz6N2tc7x7
+LyG1/WZRDL1Us+FtXxy8I3PRCQOJFNIQuWTDKtChlkq84dQaW8egwMFjeA9ENzAy
+loAyI5Whd7oT0pdz4l0lyWoNwzlgpLSwaUJCCenYCLwzILNYIqeq68Th5mGDxdKW
+39nQT63XAgMBAAGjYDBeMB0GA1UdDgQWBBThtKDO3gM48K71o8iI1Qzx51GhMTAf
+BgNVHSMEGDAWgBTVJPMMuhIZLGVl2yrQko+ZE1Z6zzAMBgNVHRMBAf8EAjAAMA4G
+A1UdDwEB/wQEAwIFoDANBgkqhkiG9w0BAQsFAAOCAQEADFPxXawK3q/t9put9pte
+o8hbpqwzHz09yq5ulKczd554M+RQPDqabj6w9ew7jaa45bqgl+5lX5e4TGW0/XNV
+T29z7cpk5aeaddcEqqPrftU0xDMEMeIaYxB4HZRRy+h2tefHVhpT4y7oUzTJAkXx
+s9EYvAPOvhPwxkMtZKD5BOeB5LzmilLVxtjWQJjIQjxk45T6Mxij8xeEJBZ1YjBo
+4bqunXBay1MI8Z0vyN9VNU4+rLY4xpy8R3SoEjUHK+TmpB6ukJr0HVd6xoCezvmz
+LEmpUtwEmz53/QJIYumZNqZA+a+6SnWTq/lCrvhjP/rVr4LRe62PSqChlKwa/BXh
+Eg==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDlDCCAnygAwIBAgIEDOfhAjANBgkqhkiG9w0BAQsFADCBlTELMAkGA1UEBhMC
+VVMxEDAOBgNVBAgMB01vbnRhbmExEDAOBgNVBAcMB0JvemVtYW4xETAPBgNVBAoM
+CFNhd3Rvb3RoMRMwEQYDVQQLDApDb25zdWx0aW5nMRgwFgYDVQQDDA93d3cud29s
+ZnNzbC5jb20xIDAeBgkqhkiG9w0BCQEWEWZhY3RzQHdvbGZzc2wuY29tMB4XDTI1
+MDEwMTAwMDAwMFoXDTQ5MTIzMTIzNTk1OVowHTEbMBkGA1UEAwwSQ2VydCBFdmVu
+dHMgSW50IENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAw6JzXSFi
+IM46cTinlLvbhwQcWhueSw0+yvil9w1q3COQImorWGNKKGpIqOdzH6JV2E0CO+LL
+a+KDyVGPd/3cLV0jtyOafrYpaOgqTqn+MnAxnvDv7viN4/zz1yjdeh2erSMr8aZ/
+NFIpZtLlZFVk1t1LQTtVg27AEQ5uIMIWc+sw/wlGu+fMxgNEQRHGwWw2L0r5kVXK
+WF43uCgQMIlAlnfPcGakVftpC+fZsjNl23I6d7crSfy2zVgQjauqy0BFdwI5GLOP
+MwFId1C+jnOn3jagSY4sFq+5+0ItNWrbNDfVFFl9ZXLli2VVSyBeR/n4OtNs2Tr1
+xwFGMcN5mhi+SQIDAQABo2MwYTAdBgNVHQ4EFgQU1STzDLoSGSxlZdsq0JKPmRNW
+es8wHwYDVR0jBBgwFoAUJ45nEXTDJh0/7TNjs6TYHTDl6NUwDwYDVR0TAQH/BAUw
+AwEB/zAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADggEBACbBE+e3IaQt
+2VDvUXw3pZWoXuXDTCwI022Go69y7n0lUXoA1O2yPwVQmexeiIo7w3V5K4Z/RzSg
+Sm30R+7XeB6Z6SQ08sm5FKXg3fNOlC7OIrcGZYqRX+ztOViKEtUqADhK2aQeMKxx
+Awf586aef8Ilk8eRyt92pmbscJCa//rdn8PQEbDQQ/LOQUN/wLw32p8aEtO85xvf
+fBh+UUKeFZCRPUTnHvr/Z2Vwc9cxDkR+1c228u2OZJl1EnwIQOBfZypuxgczuP8G
+OHHe0Zsd7TSNUblIwEeb9GqpwRk1Jym31DZU/lmf+jhmSLH2YhJanaMXGnPPgix2
+1p6wecWxr+c=
+-----END CERTIFICATE-----

certs/test/cert-events/chain-leaf-eku-client-only.pem

@@ -0,0 +1,44 @@
+-----BEGIN CERTIFICATE-----
+MIIDojCCAoqgAwIBAgIEDOfhDjANBgkqhkiG9w0BAQsFADAdMRswGQYDVQQDDBJD
+ZXJ0IEV2ZW50cyBJbnQgQ0EwHhcNMjUwMTAxMDAwMDAwWhcNNDkxMjMxMjM1OTU5
+WjCBkTELMAkGA1UEBhMCVVMxEDAOBgNVBAgMB01vbnRhbmExEDAOBgNVBAcMB0Jv
+emVtYW4xEDAOBgNVBAoMB3dvbGZTU0wxEDAOBgNVBAsMB1N1cHBvcnQxGDAWBgNV
+BAMMD3d3dy53b2xmc3NsLmNvbTEgMB4GCSqGSIb3DQEJARYRZmFjdHNAd29sZnNz
+bC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDAlQjhV0HycW23
+0kVBJwFlxkWu8rwkMLiVzi9O1vYciLx8n/uoZ3/+XJxRdfeKygfnNS+P4b17wC98
+q2SoF/zKXXu64CHlci5vLobYlXParBtTuV8/1xkNJU/hY2NRiwtkP61DuKUcXDSz
+rgCgY8X2fwtZaHhzpowYqQJtr8MZAS64EOPGzEC0aaNGM2mHbsS7F6bz6N2tc7x7
+LyG1/WZRDL1Us+FtXxy8I3PRCQOJFNIQuWTDKtChlkq84dQaW8egwMFjeA9ENzAy
+loAyI5Whd7oT0pdz4l0lyWoNwzlgpLSwaUJCCenYCLwzILNYIqeq68Th5mGDxdKW
+39nQT63XAgMBAAGjdTBzMB0GA1UdDgQWBBThtKDO3gM48K71o8iI1Qzx51GhMTAf
+BgNVHSMEGDAWgBTVJPMMuhIZLGVl2yrQko+ZE1Z6zzAMBgNVHRMBAf8EAjAAMA4G
+A1UdDwEB/wQEAwIFoDATBgNVHSUEDDAKBggrBgEFBQcDAjANBgkqhkiG9w0BAQsF
+AAOCAQEAYaZZL5eho/TnyO7CliZC1aMJUVSD9n98K28bxuPrtO3KAPuJd3krLvQU
+dJR6Zg7e3A/whY/fn35Oi7KL0MYULO1bWUZQXO+0X2L5PR3WX2IPsG5R3RCsP3rz
+JoIgajfHnmjeD35Oq1RUDwaCpt00hDW7VXqyrTZg2SG78niO/+DJDNhy9IwQFUHX
+1l+z034eDTQaecb3vZsvqsn5OdynK8EGLK0sHcgwp7BK7gRg0KwVKCSoLrwDE3QC
+7l9wO+xb+NAQw5xxupitWUfrQUY3ZxHXAJOLSD5guR3ho4wN2ibCotWflfBuuLNR
+NzsM1UBzJLqRS3zNb7vZW+VsQWvw3g==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDlDCCAnygAwIBAgIEDOfhDzANBgkqhkiG9w0BAQsFADCBlTELMAkGA1UEBhMC
+VVMxEDAOBgNVBAgMB01vbnRhbmExEDAOBgNVBAcMB0JvemVtYW4xETAPBgNVBAoM
+CFNhd3Rvb3RoMRMwEQYDVQQLDApDb25zdWx0aW5nMRgwFgYDVQQDDA93d3cud29s
+ZnNzbC5jb20xIDAeBgkqhkiG9w0BCQEWEWZhY3RzQHdvbGZzc2wuY29tMB4XDTI1
+MDEwMTAwMDAwMFoXDTQ5MTIzMTIzNTk1OVowHTEbMBkGA1UEAwwSQ2VydCBFdmVu
+dHMgSW50IENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAw6JzXSFi
+IM46cTinlLvbhwQcWhueSw0+yvil9w1q3COQImorWGNKKGpIqOdzH6JV2E0CO+LL
+a+KDyVGPd/3cLV0jtyOafrYpaOgqTqn+MnAxnvDv7viN4/zz1yjdeh2erSMr8aZ/
+NFIpZtLlZFVk1t1LQTtVg27AEQ5uIMIWc+sw/wlGu+fMxgNEQRHGwWw2L0r5kVXK
+WF43uCgQMIlAlnfPcGakVftpC+fZsjNl23I6d7crSfy2zVgQjauqy0BFdwI5GLOP
+MwFId1C+jnOn3jagSY4sFq+5+0ItNWrbNDfVFFl9ZXLli2VVSyBeR/n4OtNs2Tr1
+xwFGMcN5mhi+SQIDAQABo2MwYTAdBgNVHQ4EFgQU1STzDLoSGSxlZdsq0JKPmRNW
+es8wHwYDVR0jBBgwFoAUJ45nEXTDJh0/7TNjs6TYHTDl6NUwDwYDVR0TAQH/BAUw
+AwEB/zAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADggEBAK5snKw4GCEV
+bR/TRttX83AE9dc8OlxTZdedHtYQ8LtWfZhzogjdbsETkpymXi+fFv5Orci5ihh+
+ev730zu0vl1uDo7abKhOLOS3ytSeTwwi37Fw2cVRiTxPq7aBrXAxobesAW2afDRu
+ZaimDeQNKtoV7RmR8LcyT8YYY2fL+IvwZGac2A/yFNAUjqHQOwJEDcbMyeq0bFU0
+dSHGQrlbrjUQlQuNabKBOncaeyHxw9YPlcb67BYp+F8se7nKemFMgRJGpPj04VX1
+DqZbih17h1QGH6xgDxasHSPbGfK57oYh9+ria493rhrxtzaqYYpz39GB6X8zrjnu
+m6FofCWCgRQ=
+-----END CERTIFICATE-----

certs/test/cert-events/chain-leaf-ku-no-digsig.pem

@@ -0,0 +1,44 @@
+-----BEGIN CERTIFICATE-----
+MIIDjTCCAnWgAwIBAgIEDOfhDDANBgkqhkiG9w0BAQsFADAdMRswGQYDVQQDDBJD
+ZXJ0IEV2ZW50cyBJbnQgQ0EwHhcNMjUwMTAxMDAwMDAwWhcNNDkxMjMxMjM1OTU5
+WjCBkTELMAkGA1UEBhMCVVMxEDAOBgNVBAgMB01vbnRhbmExEDAOBgNVBAcMB0Jv
+emVtYW4xEDAOBgNVBAoMB3dvbGZTU0wxEDAOBgNVBAsMB1N1cHBvcnQxGDAWBgNV
+BAMMD3d3dy53b2xmc3NsLmNvbTEgMB4GCSqGSIb3DQEJARYRZmFjdHNAd29sZnNz
+bC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDAlQjhV0HycW23
+0kVBJwFlxkWu8rwkMLiVzi9O1vYciLx8n/uoZ3/+XJxRdfeKygfnNS+P4b17wC98
+q2SoF/zKXXu64CHlci5vLobYlXParBtTuV8/1xkNJU/hY2NRiwtkP61DuKUcXDSz
+rgCgY8X2fwtZaHhzpowYqQJtr8MZAS64EOPGzEC0aaNGM2mHbsS7F6bz6N2tc7x7
+LyG1/WZRDL1Us+FtXxy8I3PRCQOJFNIQuWTDKtChlkq84dQaW8egwMFjeA9ENzAy
+loAyI5Whd7oT0pdz4l0lyWoNwzlgpLSwaUJCCenYCLwzILNYIqeq68Th5mGDxdKW
+39nQT63XAgMBAAGjYDBeMB0GA1UdDgQWBBThtKDO3gM48K71o8iI1Qzx51GhMTAf
+BgNVHSMEGDAWgBTVJPMMuhIZLGVl2yrQko+ZE1Z6zzAMBgNVHRMBAf8EAjAAMA4G
+A1UdDwEB/wQEAwIFIDANBgkqhkiG9w0BAQsFAAOCAQEAMmOO4rOcYcZjZdZrvBaT
+KmF3e1N3unte3MmsCetDCrLNk80Mk8zRfQE17RXp082rXI2s+7JfarmZkxXa4wBF
+rX4Vw/RPy8YWisA7snEmNIfjxbtS0UONdBkL5F08u8n8YmDIUEdQhD6OwgujUeXW
++NnXBTM35XRmqDXEJCIUyCLjMjFxruRYbN2nEhSF7KuSF+hivWDGzz/4gj2lAWe/
+7fvPAb0HaauYpfCOOCMaJmIYwPWwliA9QDewvyuI3OXBy91tHMaF+UkY6IFUhytr
+RQOXVTOXND9ke9zNodGLUjkPxQnkBpllyebZujRSlMNdjlKk6aQ47FzOSwKkefB0
+kw==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDlDCCAnygAwIBAgIEDOfhDTANBgkqhkiG9w0BAQsFADCBlTELMAkGA1UEBhMC
+VVMxEDAOBgNVBAgMB01vbnRhbmExEDAOBgNVBAcMB0JvemVtYW4xETAPBgNVBAoM
+CFNhd3Rvb3RoMRMwEQYDVQQLDApDb25zdWx0aW5nMRgwFgYDVQQDDA93d3cud29s
+ZnNzbC5jb20xIDAeBgkqhkiG9w0BCQEWEWZhY3RzQHdvbGZzc2wuY29tMB4XDTI1
+MDEwMTAwMDAwMFoXDTQ5MTIzMTIzNTk1OVowHTEbMBkGA1UEAwwSQ2VydCBFdmVu
+dHMgSW50IENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAw6JzXSFi
+IM46cTinlLvbhwQcWhueSw0+yvil9w1q3COQImorWGNKKGpIqOdzH6JV2E0CO+LL
+a+KDyVGPd/3cLV0jtyOafrYpaOgqTqn+MnAxnvDv7viN4/zz1yjdeh2erSMr8aZ/
+NFIpZtLlZFVk1t1LQTtVg27AEQ5uIMIWc+sw/wlGu+fMxgNEQRHGwWw2L0r5kVXK
+WF43uCgQMIlAlnfPcGakVftpC+fZsjNl23I6d7crSfy2zVgQjauqy0BFdwI5GLOP
+MwFId1C+jnOn3jagSY4sFq+5+0ItNWrbNDfVFFl9ZXLli2VVSyBeR/n4OtNs2Tr1
+xwFGMcN5mhi+SQIDAQABo2MwYTAdBgNVHQ4EFgQU1STzDLoSGSxlZdsq0JKPmRNW
+es8wHwYDVR0jBBgwFoAUJ45nEXTDJh0/7TNjs6TYHTDl6NUwDwYDVR0TAQH/BAUw
+AwEB/zAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADggEBAK2TiY13fREh
+iaOc3+iG9cS1hDmyAV0bCQXNQeNIyu7M2OQJ014Qp6FU0Ntkng4R6+/Jo/QdhXJu
+bBVebYSvrLQMiOzvuBUhuyS3J/s5ht1baiHrNkg+b1OurFED1VPKZNHXZzQDmdZV
+nuN26H5jPpH5+gbHCSmZtBeaPinSBnjjVX6zqYwURKna3UO3NRET4ARYm35s3Jag
+X70KedeHjJJn93oMh20PqTiwWMmbxF9VGC/EO+AOPV9pbzph/Mwupo+99uZlzWPm
+JGPCq2AN0VwwA7IiZF70xvkoVBJ9sWydJvhtmwhlL9s9AqLIQSoP99jF+ygxL4UT
+fsnuu2qjGno=
+-----END CERTIFICATE-----

certs/test/cert-events/chain-pathlen-exceeded.pem

@@ -0,0 +1,64 @@
+-----BEGIN CERTIFICATE-----
+MIIDmzCCAoOgAwIBAgIEDOfhCDANBgkqhkiG9w0BAQsFADArMSkwJwYDVQQDDCBD
+ZXJ0IEV2ZW50cyBJbnQgQmVsb3cgUGF0aCBMZW4gMDAeFw0yNTAxMDEwMDAwMDBa
+Fw00OTEyMzEyMzU5NTlaMIGRMQswCQYDVQQGEwJVUzEQMA4GA1UECAwHTW9udGFu
+YTEQMA4GA1UEBwwHQm96ZW1hbjEQMA4GA1UECgwHd29sZlNTTDEQMA4GA1UECwwH
+U3VwcG9ydDEYMBYGA1UEAwwPd3d3LndvbGZzc2wuY29tMSAwHgYJKoZIhvcNAQkB
+FhFmYWN0c0B3b2xmc3NsLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC
+ggEBAMCVCOFXQfJxbbfSRUEnAWXGRa7yvCQwuJXOL07W9hyIvHyf+6hnf/5cnFF1
+94rKB+c1L4/hvXvAL3yrZKgX/Mpde7rgIeVyLm8uhtiVc9qsG1O5Xz/XGQ0lT+Fj
+Y1GLC2Q/rUO4pRxcNLOuAKBjxfZ/C1loeHOmjBipAm2vwxkBLrgQ48bMQLRpo0Yz
+aYduxLsXpvPo3a1zvHsvIbX9ZlEMvVSz4W1fHLwjc9EJA4kU0hC5ZMMq0KGWSrzh
+1Bpbx6DAwWN4D0Q3MDKWgDIjlaF3uhPSl3PiXSXJag3DOWCktLBpQkIJ6dgIvDMg
+s1gip6rrxOHmYYPF0pbf2dBPrdcCAwEAAaNgMF4wHQYDVR0OBBYEFOG0oM7eAzjw
+rvWjyIjVDPHnUaExMB8GA1UdIwQYMBaAFLVTZnQGSfrz9de5DFQNb1IVzo47MAwG
+A1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgWgMA0GCSqGSIb3DQEBCwUAA4IBAQCz
+CQjW+raVw32vb3OLunuaXcrei1Z8eEQr0zITtGA9DcbbuQKFl9J9zMa+TK0vxHcn
+od8bEehanjIOx6D2O3TuwV5eXL+RAFioC7AddhSzbqcgsJ1+0oiRSFaQphBnK0Hj
+5OZMNtTCbt0/CyZShizv7KPik1gvdFUOEt7WQm8I1uSZAZiSxYdXale/ucZfZQE+
+XdCZPzR3aHvMsMyEoYieKnd+N5pm73eI7dsDCmqLbxRkzMpJ44RulESU19u8at8d
+YtKNmgWGOal2SpLK1CEBZQcwFUQ49BYJZxwoELzy6r2zUbq2nWOJh+Y0uYfrIq0S
+Cw2lw/2U3KEgHbFZAjd3
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDMTCCAhmgAwIBAgIEDOfhBzANBgkqhkiG9w0BAQsFADAlMSMwIQYDVQQDDBpD
+ZXJ0IEV2ZW50cyBJbnQgUGF0aCBMZW4gMDAeFw0yNTAxMDEwMDAwMDBaFw00OTEy
+MzEyMzU5NTlaMCsxKTAnBgNVBAMMIENlcnQgRXZlbnRzIEludCBCZWxvdyBQYXRo
+IExlbiAwMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAz8k9WQGfHXeR
+VsurBoLBgTGa4vnG+aNALYZC119BpQVCD18ra70pkuVSxlz5fp37jtZpjAORhxwf
+vyRZRMzvr5IqBuGhAVsEV4oatgTiwjwQPEIxAarD8jIeAZXQkadmwSJoNlMqUgPr
+tZuCAST50a77U0xaBuVuWtasWygaU+jXpc5unDTDCAvLL47f74w19bC8XQ+uCkrP
+VAHSPLR47kgQVoBPg4dOZx9PFy4+LfVtyQeiPjKSDx6kC1WmH4TvnXXvZnx19+dA
+OpzBM0I9L3+ZXXsE1alsQeiJFlj9OqAEvXfWY15qE1k3X/FZAUVInIv3FvRQ91q0
+WjP29UHBPQIDAQABo2MwYTAdBgNVHQ4EFgQUtVNmdAZJ+vP117kMVA1vUhXOjjsw
+HwYDVR0jBBgwFoAU1STzDLoSGSxlZdsq0JKPmRNWes8wDwYDVR0TAQH/BAUwAwEB
+/zAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADggEBAF8swcw3zBIwEpo3
+bNoUdwQbxOsEjllRW3ntFrXOQIN+CaeUZS4m3gFWcxc+I+BWNG9xI1MUe4e2ONB3
+rVssRcb+EwhbsBdy69wfozme4mz4TPwvCScFskBx8JTlSYmkUlIvriG/DOnxnh5V
+VPz3d7PZMG8Xfs5gCmiA9Ce92dVMCvS9iLO7E7s2s8tNS4BXg7jHkErT3EXl/Em5
+PDWAB78w+Hi+BdSObrQXyqJFbvH3EU+JUp8bopC1c1kpuGaio3+BCvLjq3QWxxVq
+tIQY7X4igZ6eHBwqdgPdMRrqP0w2Pxrvk2LgmIiaBVINupZuAxcp3bSbFC/9JvFR
+GzYwgPQ=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDnzCCAoegAwIBAgIEDOfhCTANBgkqhkiG9w0BAQsFADCBlTELMAkGA1UEBhMC
+VVMxEDAOBgNVBAgMB01vbnRhbmExEDAOBgNVBAcMB0JvemVtYW4xETAPBgNVBAoM
+CFNhd3Rvb3RoMRMwEQYDVQQLDApDb25zdWx0aW5nMRgwFgYDVQQDDA93d3cud29s
+ZnNzbC5jb20xIDAeBgkqhkiG9w0BCQEWEWZhY3RzQHdvbGZzc2wuY29tMB4XDTI1
+MDEwMTAwMDAwMFoXDTQ5MTIzMTIzNTk1OVowJTEjMCEGA1UEAwwaQ2VydCBFdmVu
+dHMgSW50IFBhdGggTGVuIDAwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB
+AQDDonNdIWIgzjpxOKeUu9uHBBxaG55LDT7K+KX3DWrcI5AiaitYY0ooakio53Mf
+olXYTQI74str4oPJUY93/dwtXSO3I5p+tilo6CpOqf4ycDGe8O/u+I3j/PPXKN16
+HZ6tIyvxpn80Uilm0uVkVWTW3UtBO1WDbsARDm4gwhZz6zD/CUa758zGA0RBEcbB
+bDYvSvmRVcpYXje4KBAwiUCWd89wZqRV+2kL59myM2Xbcjp3tytJ/LbNWBCNq6rL
+QEV3AjkYs48zAUh3UL6Oc6feNqBJjiwWr7n7Qi01ats0N9UUWX1lcuWLZVVLIF5H
++fg602zZOvXHAUYxw3maGL5JAgMBAAGjZjBkMB0GA1UdDgQWBBTVJPMMuhIZLGVl
+2yrQko+ZE1Z6zzAfBgNVHSMEGDAWgBQnjmcRdMMmHT/tM2OzpNgdMOXo1TASBgNV
+HRMBAf8ECDAGAQH/AgEAMA4GA1UdDwEB/wQEAwIBBjANBgkqhkiG9w0BAQsFAAOC
+AQEArg2UeBHCzg64mtL7TjeqMHeCGWOHRcRsFAVOXMCv1X+5wDILGGeDj+R6LKCR
+0lQ+pwCXTE4vPaD0wT1KmxamDxu2IkKyFWhO9sXUoeu+9gGf/bNiLQFcUrJfWcDm
+7Kr/q2dHxgk3BiRog5c+mgVIn398HmECEE07KPL/+HmPn+Xq7m6ZepvvCKPmYJiV
+HsURIJlyIRJub5Gqc9Q4/9uyw0uKKicwaJBS//LAHJrqgTHm3nwXdt1dEQnsVDbt
+bpgxKHEcZAg3k6KrWpBY0BeyBbMler/B1FDvglmQNvwG3m6JnkTvN3GHfk5Jswe/
+49t0gvVXrtDazlmtqm8Pmhx2CQ==
+-----END CERTIFICATE-----

certs/test/cert-events/chain-signer-no-certsign.pem

@@ -0,0 +1,44 @@
+-----BEGIN CERTIFICATE-----
+MIIDlzCCAn+gAwIBAgIEDOfhBTANBgkqhkiG9w0BAQsFADAnMSUwIwYDVQQDDBxD
+ZXJ0IEV2ZW50cyBJbnQgTm8gQ2VydCBTaWduMB4XDTI1MDEwMTAwMDAwMFoXDTQ5
+MTIzMTIzNTk1OVowgZExCzAJBgNVBAYTAlVTMRAwDgYDVQQIDAdNb250YW5hMRAw
+DgYDVQQHDAdCb3plbWFuMRAwDgYDVQQKDAd3b2xmU1NMMRAwDgYDVQQLDAdTdXBw
+b3J0MRgwFgYDVQQDDA93d3cud29sZnNzbC5jb20xIDAeBgkqhkiG9w0BCQEWEWZh
+Y3RzQHdvbGZzc2wuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
+wJUI4VdB8nFtt9JFQScBZcZFrvK8JDC4lc4vTtb2HIi8fJ/7qGd//lycUXX3isoH
+5zUvj+G9e8AvfKtkqBf8yl17uuAh5XIuby6G2JVz2qwbU7lfP9cZDSVP4WNjUYsL
+ZD+tQ7ilHFw0s64AoGPF9n8LWWh4c6aMGKkCba/DGQEuuBDjxsxAtGmjRjNph27E
+uxem8+jdrXO8ey8htf1mUQy9VLPhbV8cvCNz0QkDiRTSELlkwyrQoZZKvOHUGlvH
+oMDBY3gPRDcwMpaAMiOVoXe6E9KXc+JdJclqDcM5YKS0sGlCQgnp2Ai8MyCzWCKn
+quvE4eZhg8XSlt/Z0E+t1wIDAQABo2AwXjAdBgNVHQ4EFgQU4bSgzt4DOPCu9aPI
+iNUM8edRoTEwHwYDVR0jBBgwFoAU1STzDLoSGSxlZdsq0JKPmRNWes8wDAYDVR0T
+AQH/BAIwADAOBgNVHQ8BAf8EBAMCBaAwDQYJKoZIhvcNAQELBQADggEBAL0W4MsN
+3twP4O/NGU0YBCWgQTehvpP7ZdztPFuZcn7Uw9nqjsNGg/De8cwKx3/TNtafaQ9Z
+/gElj5PBGsvc4V/Lr2BjW7hGBiB46O2OvAtyeIj82jjst5ZKDU67tvFfBAq1WcTN
+biGPglbUBkTPatPnsMmnWtf6aYvJwpvXxPhNeCORGPzNsICw8/erVAUPEpKTg+Bp
+yy58dmEjX2ebhVJJx56rpdeNMdQyVbTgrIs0l6vYegSMka9+8Xnmd5UkkIZPotuu
+plmWGJ8mv80z+WWaUNwdqSSkBPSOw0nOA9LL8QQZ0azeEXnQRQqOPNGo8tlPEOGt
+nP7FN7jo4ACAwCY=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDnjCCAoagAwIBAgIEDOfhBjANBgkqhkiG9w0BAQsFADCBlTELMAkGA1UEBhMC
+VVMxEDAOBgNVBAgMB01vbnRhbmExEDAOBgNVBAcMB0JvemVtYW4xETAPBgNVBAoM
+CFNhd3Rvb3RoMRMwEQYDVQQLDApDb25zdWx0aW5nMRgwFgYDVQQDDA93d3cud29s
+ZnNzbC5jb20xIDAeBgkqhkiG9w0BCQEWEWZhY3RzQHdvbGZzc2wuY29tMB4XDTI1
+MDEwMTAwMDAwMFoXDTQ5MTIzMTIzNTk1OVowJzElMCMGA1UEAwwcQ2VydCBFdmVu
+dHMgSW50IE5vIENlcnQgU2lnbjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC
+ggEBAMOic10hYiDOOnE4p5S724cEHFobnksNPsr4pfcNatwjkCJqK1hjSihqSKjn
+cx+iVdhNAjviy2vig8lRj3f93C1dI7cjmn62KWjoKk6p/jJwMZ7w7+74jeP889co
+3Xodnq0jK/GmfzRSKWbS5WRVZNbdS0E7VYNuwBEObiDCFnPrMP8JRrvnzMYDREER
+xsFsNi9K+ZFVylheN7goEDCJQJZ3z3BmpFX7aQvn2bIzZdtyOne3K0n8ts1YEI2r
+qstARXcCORizjzMBSHdQvo5zp942oEmOLBavuftCLTVq2zQ31RRZfWVy5YtlVUsg
+Xkf5+DrTbNk69ccBRjHDeZoYvkkCAwEAAaNjMGEwHQYDVR0OBBYEFNUk8wy6Ehks
+ZWXbKtCSj5kTVnrPMB8GA1UdIwQYMBaAFCeOZxF0wyYdP+0zY7Ok2B0w5ejVMA8G
+A1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgeAMA0GCSqGSIb3DQEBCwUAA4IB
+AQBtYp7VKBfbxDzwVvIj0mIRImJxndgvoP5xhieeIzfDubZfbdsLJvZq2XDLlI2p
+dwnyCHNdLShq39salj8xeCE34QaiwBGrARqvd6CBOJ1vs4Xb0BNlWuRoQa0cnw9x
+oRb61apTJwtzTgFTxeOA/OcTwUaOBYnRLucGU5awy5ecGkUOpbqqd5hA2KBr9/bq
+ullwRNzjzwPupuPJc1W6WvfXzi3hxmT487F0XLwhlWTDGqkbM+KfE1vZsVScCs+r
+VZmgcCw8sIvMp3U9Y/v/I+vnrrNU52vUlfr+4oyBt2UBoWiNcT03uFtLichAR3lZ
+w6fHwSp1UphPOiQH67zF0JKp
+-----END CERTIFICATE-----