Allow Pistache::Listener to load and serve certificate chains (#772)

* Update test certificate generation to use explicit cert config.

Previously, no configuration was supplied on certificate generation, so
the certificates being used for testing were completely generic. This
limited the effectiveness and transparency of testing.

* Fix listener.cc to load a cert chain and provide it for server auth.

Added test with a server cert signed by an intermediate CA.

Previously, listener.cc would only load the first cert in a cert pack
and use this to authenticate itself to clients. This meant that if the
server held a cert signed by an intermediate CA, a client trusting only
the root CA would be unable to authenticate the server's cert.

See the OpenSSL docs here:
https://www.openssl.org/docs/man1.0.2/man3/SSL_CTX_use_certificate_file.html
for an overview of the SSL_CTX_use_certificate_file() and
SSL_CTX_use_certificate_chain_file() functions.

src/server/listener.cc

@@ -393,7 +393,7 @@ ssl::SSLCtxPtr ssl_create_context(const std::string &cert,
   SSL_CTX_set_ecdh_auto(GetSSLContext(ctx), 1);
 #endif /* OPENSSL_VERSION_NUMBER */
 
-  if (SSL_CTX_use_certificate_file(GetSSLContext(ctx), cert.c_str(), SSL_FILETYPE_PEM) <= 0) {
+  if (SSL_CTX_use_certificate_chain_file(GetSSLContext(ctx), cert.c_str()) <= 0) {
     ERR_print_errors_fp(stderr);
     throw std::runtime_error("Cannot load SSL certificate");
   }

tests/CMakeLists.txt

@@ -42,6 +42,10 @@ if (PISTACHE_USE_SSL)
     configure_file("certs/client.key" "certs/client.key" COPYONLY)
     configure_file("certs/client.crt" "certs/client.crt" COPYONLY)
     configure_file("certs/rootCA.crt" "certs/rootCA.crt" COPYONLY)
+    configure_file("certs/server_from_intermediate_with_chain.crt" "certs/server_from_intermediate_with_chain.crt" COPYONLY)
+    configure_file("certs/server_from_intermediate.crt" "certs/server_from_intermediate.crt" COPYONLY)
+    configure_file("certs/server_from_intermediate.key" "certs/server_from_intermediate.key" COPYONLY)
+    configure_file("certs/intermediateCA.crt" "certs/intermediateCA.crt" COPYONLY)
 
     pistache_test(https_server_test)
 endif (PISTACHE_USE_SSL)

tests/certs/client.crt

 -----BEGIN CERTIFICATE-----
-MIICyDCCAbACAQIwDQYJKoZIhvcNAQELBQAwFjEUMBIGA1UEAwwLcGlzdGFjaGUu
-aW8wHhcNMjAwMjE5MDU0MDIzWhcNMzAwMjE2MDU0MDIzWjA+MQswCQYDVQQGEwJV
-UzELMAkGA1UECAwCV0ExETAPBgNVBAoMCFBpc3RhY2hlMQ8wDQYDVQQDDAZjbGll
-bnQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDjJiKK0T2P3+26LOBc
-Yi/bgO3euVIT5fdh2jOlWjqQdDcDzspDi0LdiK78dVj++rxvc28G4iM23k91p8qx
-hD/gqx/t0qbBrTZHtPIgBFmTsUap2zFAYxeyoPEGKtSVLq78znShFHPRIaspeEJj
-Ap0V+a870zAOBFWWS30HLF1E8CuuWFcbIVDYKo5/3DS781pagFQSQShDFuvf7lE1
-in0W2xmDwELFSi/XE1eDTqqkHHY28qGdf2ydTHH91xWCtMkAonHiVXLl20R5T5WN
-BZSPLs2e0Y4Mo/qPsT/W5P8rd7fB1kmqxiLtOo3QgHw7hY7A11TWSRaawLlBRgER
-no+TAgMBAAEwDQYJKoZIhvcNAQELBQADggEBACePwJuI69eqs5Rt/w246PdeMAxo
-azqdj1LIW5ygkrLx2ptCiqZcuNTwXInk0iSkh5dF8HbzeVZkf8tcnn36PPMmgryX
-7+d/8xa1CUv29thHpej7l2Y+n4OF8g1eQlNSMe9FxAfEJpALhctcPsE88hedUvpE
-PyAPAcriVghhayHSzwO7v5whQZj4gW95Mu2NstqBE2Gx5jYXpyUtE89Tw9YIrwaT
-Va7ozgOus9qerVOLPsxCgkC5kcFQt0x+3M81s9u2V3vIQRvrDOW37f1yyq2B0Oxb
-Rs2IUX3j1wVzlpJAp8NbHuoQ9G+xXnMTO8enV6nSfOfUlI1N/bhtSxsLDuc=
+MIIC/jCCAeagAwIBAgIBAjANBgkqhkiG9w0BAQsFADAWMRQwEgYDVQQDDAtwaXN0
+YWNoZS5pbzAeFw0yMDA1MjYyMDUxMTRaFw0zMDA1MjQyMDUxMTRaMD4xCzAJBgNV
+BAYTAlVTMQswCQYDVQQIDAJXQTERMA8GA1UECgwIUGlzdGFjaGUxDzANBgNVBAMM
+BmNsaWVudDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKye4EiuDYIo
+5PBL5cS6BRIv+ndojxoEaw3nuOT27x39ue3WuDTXRUi/70MDRCx2enZ78KluAsY/
+dFBO4Oy41VAx7gWFV3Y+D/8epw1NT4Utz/OBZgVVlrU//OU0g1ePVTIrjsrIasqJ
+Rkqa+d9GgBugnFnjqcd1Dotyk/YYjuAZt0WuBRLqIgLi346QyDv0XitbcT+x8k4y
+yqhDcnOdQO42SlmH7RyAaq2C+0n4rjISGYiIdC5/5Nuqpc9Pzk3asLJkp7s4sVf9
+7umFBSvBRWrM5HIHePzBbrz3hw6MvGWO1GfO+kqFMCUQniRUeXLixlhJp97cO93b
+ZsrCoi3jIvcCAwEAAaMvMC0wCQYDVR0TBAIwADALBgNVHQ8EBAMCBaAwEwYDVR0l
+BAwwCgYIKwYBBQUHAwIwDQYJKoZIhvcNAQELBQADggEBAE6MKgUv1yg6Y4OI5lnf
+xYOxiSgsgfXxZNN9upBga+GfB79d/0NPeEVjm2sHtmGDKBF/2ItmV6WOJu+MJA31
+pIqSn7g9bo95YdPpIpQjGeefFdZm0+GJ/4QabjxqpLUS0k+znvCYptvvYWa5Zu1Z
+tnWes3Jxnm1ZYLoIuruHTvWXILQjuPXG+8s8R9cDjzdThWBpQ//xJVvgqbX0bWXE
+hFEz8AX2KCEDsvXoUutAf9OiBXT1sJ7lq/i+RU/l2N6v6MbKt0ERDyjXYQBZNSxc
+rb2oLsP2g6My2lymVLWUMgms5o6TqAb6r1qaZtkFyWM6UxotsaivczX75ZvFGlzL
+W64=
 -----END CERTIFICATE-----

tests/certs/client.key

 -----BEGIN RSA PRIVATE KEY-----
-MIIEpQIBAAKCAQEA4yYiitE9j9/tuizgXGIv24Dt3rlSE+X3YdozpVo6kHQ3A87K
-Q4tC3Yiu/HVY/vq8b3NvBuIjNt5PdafKsYQ/4Ksf7dKmwa02R7TyIARZk7FGqdsx
-QGMXsqDxBirUlS6u/M50oRRz0SGrKXhCYwKdFfmvO9MwDgRVlkt9ByxdRPArrlhX
-GyFQ2CqOf9w0u/NaWoBUEkEoQxbr3+5RNYp9FtsZg8BCxUov1xNXg06qpBx2NvKh
-nX9snUxx/dcVgrTJAKJx4lVy5dtEeU+VjQWUjy7NntGODKP6j7E/1uT/K3e3wdZJ
-qsYi7TqN0IB8O4WOwNdU1kkWmsC5QUYBEZ6PkwIDAQABAoIBAQCf1wT1lDny1Uuu
-98dFmx48IyS/1r6oG+oRpH81OyH85pqUBl8UWpnJ1FX2dwkSHBSfhKY7PMQ05wkZ
-LOKYOgzNJv4H13Ta0u1gVjcPSqBSKqwj+IdW3KQfYdtZUKhY9gnTAeDWPNMm9b9B
-Jkvo6jzp6tJhkcG+C1TCtwobEx/q0pbGha+v/lE0OyT5K1DBW26kIMzQ5MEjHF8u
-57TDgBHGD4Lmd/nlX1j0gs20ccsNWnXrxX+my6rUIG+m0p5/OreV7WoIEmLEVH9H
-G8cXY0jd1FJQ5XBEfCtlvQRBtn/eIr7nU9ZXxn6w9TFJ3YXxtQr7/Gt9NQdLkiMp
-U9KEoPyhAoGBAP3X6C68U8NNJC3tkrgXci3TQSvl5W0MBMGFd9jdjUR8IUl13OkT
-Z/Ut8Deu+s7fZGdfrrqjToryIQ8lwdDuND6b4+8kDL8Z8bS+0tTyZ230D0YwolzS
-LouGEMAqLmBN1yF+44Hn5VVD8zl7DWOMj0wB1/vFEQ7cJFLRTPuv/OkRAoGBAOUU
-K1hZqaAGcjNcjm6T8z5T25TmFuAUqZTEMfXUqBlbRnMzfe4GGRsA6ZpHmr5E4qwX
-UpUixfPqjlXuR8liqcUGtWVi6ojOCuGdanizHkTMOLmC3n1RU6rEl1hRod4KDKC1
-Ua8IgxN2uyEoa420ck6qBIH/YVxmqwSGSF6I+Y5jAoGAXWxxD4JQcbiacCzXqtk2
-NJdjjPx3i8K4nWC50x73NxVYSukN/NofkKTvnA7SUAD3uvQEIryn04t5j1GeG38P
-y1skcIccCdlKk/MHNUhhuJ3yYSrVFsRkTQVydMcRenArlTBWGyF1zgPMKIOZUeIR
-ey/Shd7pgEaVN8XAR4Fl24ECgYEAsZr4nDAwFhTJV87r0wm8LlefyAq4M5VxgRi3
-z2vHxJkCvvBuMyvhLRGBDA92BwyrXVdbvKrQJPN21WK/n4ByNYKlAu00/0oYH6IH
-WXst/ZMEa7fuPeTe5Gg1GtF3mQnbjoHlybnkviNwpB2NfbkoYprokc1pM9WZxBFE
-bJ7wNRcCgYEA5a+gsy+Tdv0QBH4O0HK9n0RIqALc39PiXvzoLsUKE9AGH9uSiz1c
-3AJ2SwPMTHgltfBDuqHUlAW3vVvZY9HrfdlEuCcNch8X2wP+ETkTHmODVe50I9KF
-rnPEdYLgE4uyUDlIQjSlFaMqmpAP0aS5T3TNixignLnpCSYm/ihKRpw=
+MIIEowIBAAKCAQEArJ7gSK4Ngijk8EvlxLoFEi/6d2iPGgRrDee45PbvHf257da4
+NNdFSL/vQwNELHZ6dnvwqW4Cxj90UE7g7LjVUDHuBYVXdj4P/x6nDU1PhS3P84Fm
+BVWWtT/85TSDV49VMiuOyshqyolGSpr530aAG6CcWeOpx3UOi3KT9hiO4Bm3Ra4F
+EuoiAuLfjpDIO/ReK1txP7HyTjLKqENyc51A7jZKWYftHIBqrYL7SfiuMhIZiIh0
+Ln/k26qlz0/OTdqwsmSnuzixV/3u6YUFK8FFaszkcgd4/MFuvPeHDoy8ZY7UZ876
+SoUwJRCeJFR5cuLGWEmn3tw73dtmysKiLeMi9wIDAQABAoIBAHu4BvGwZZgjLSqY
+ix57YIUPhAkvFFlGT2AQ83CPFwQ8xJSVL0MYAt1ISviRj7v6Un03CV61rSFfe0LP
+td+T/bbTgk/MqMnjY12rH3mmLlc6ZW+WD4PFOxW+vcec4oHQBfTGSTpHeFqfFpUE
+DBCdm9WxQD4gsJ924yzIuwlHwqcUOd/B36U1zIRbN9MDLb3Rxym1pLyKECHcKHme
+AwtxZzKBLRmCjhdKO5+8mCRYcOZ4ZVGZgoSaeIdeemLi7TB3CQ/eFdB3QJzaOLKE
+jU3jbNeUnju3D80pooht/7nXd79BaKsaJ3g1BY6aQomjOw8wLXZP7bj6qX12GBva
+PBgNWHECgYEA1yVu+K91l0U/55S3E9xARRRaFHidrxFPBbfrHg63iSYgnbhrC/42
+iYrKOjoIXIqDmB8MellFBeRf1luRprba0gWx7ll3Y6j/6GE1DEkZzd/X0RCxpd5W
+PhdPbENJhIQoCIDLw5PcZGRQ4qQZ2Z+wbIWzPQDSvvLMnTm1CInejw8CgYEAzWY2
+JWS3nmNGMeH+t9GAELigMb9fquUj8BKeVsX796tDGooJ5gpo+R87fldygBtYDG35
+5WId8NO61aLWBUHP5QC2M/3JpbE+fhrueZ2zOBCLQZW/eTNfS0Elq5m4LmNF2F04
+59vEU3VzTGe4iSv6iwNgGGxPyujTUUPo1sumLZkCgYB6KeJKSW8O9x5jQ/l0yIKh
+9v1zVE3NI5noWFekGJ00vjaU+Cuogq+7B9jumRc4XNp+HVs7eccMonGcyR/6Nygn
+S16ORbTaHRM6gz/Y+wUw9mKYbs9ArO/xj9DkW4y6N0R4F5IcOrBRPPkEyEN5ZAiM
+hpqREA+ap0lyGVtnPsnmFwKBgHaBpnPkrFxiArn9Hi2IXk9HdoW9WMEM+7Mjyt9d
+04aN9WV2h0eGchJqBrVaVuG65Q4m1auW9JdiUcW48aqO0hfaVUWiA5nprZisiTL5
+3dFXGkF42MRg83ZD3CwpwK5i8IVpI9ACaD+O4DsRDNN34FIcXHE67L6xnlqgx9JG
+JVbhAoGBAJtPtotdI/JDvYr6skrgWFaaY5YLtVsIREcYzAc/cOFGtTe6YwsF9o/b
+VWTmDLswG54L2fS2gmqgz9oVrfytrk7/2+lkKG0l4izDXUzv4XVpbRj80y5dKyeR
+NXDb2Uol/I04tZoy5D7a2ce5WVZorGTVZAEzeKn389y5CrXdk4OB
 -----END RSA PRIVATE KEY-----

tests/certs/intermediateCA.crt

+-----BEGIN CERTIFICATE-----
+MIIC6jCCAdKgAwIBAgIBATANBgkqhkiG9w0BAQsFADAWMRQwEgYDVQQDDAtwaXN0
+YWNoZS5pbzAeFw0yMDA1MjYyMDUxMTRaFw0zMDA1MjQyMDUxMTRaMEYxCzAJBgNV
+BAYTAlVTMQswCQYDVQQIDAJXQTERMA8GA1UECgwIUGlzdGFjaGUxFzAVBgNVBAMM
+DmludGVybWVkaWF0ZUNBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
+0iEC56M/lo5cxAqSIxMvISygNusCndcVigTW1e6iKSJib2ve4/q0egeyUO9uU/dU
+ciOILmNOa3zuNJmol0iowS85wyte8E53hH15qk9QpRI6UMhmveUyKfdTbiwlfLO6
+gMdXPkAsr/vXTP5QUZYDFfujYBtk5CDpfxQR4hPdgA0zud97BiZMm69AunH5A0jx
+eu9AsmYJwVrTFM3EX/j8m8Fg06IeJHaD42Sz942gnglJWvRfS2IJbpnr7sOGvZ/0
+FIJdqjAV8v3qNcDf6X5436SCLCDZXADIHedP2AGMYLaplEZLC7UaTNm9zIvvYg0X
+dR6VWb+tOSVKU4aNCehyvwIDAQABoxMwETAPBgNVHRMBAf8EBTADAQH/MA0GCSqG
+SIb3DQEBCwUAA4IBAQANF+lALL3xWgXrhJA2RkBziSLFyF3YE/g7kVhZHko+Cxks
+UzDBZrkn7fbhorTu/j2+QiA/mOGauVNfrgkeZvK1jXvwsE1CmH0e95SczEZVydhm
+U8nPGYY2Jhq7JuSJSgYOp7ewweAbibHFo8kYVO2aNYfHHcyS9fDVzJ/Ojn7qnIvS
+JO1aUvWqzdGn0XLPdKj2Jms6NN59/iXgF5I9r5NRMOgA4pUaSe7lUcMT8Oy+PyYE
+3qKszDIGURdP3Ujzdl6YM3edZJTCieBq6AJwY0CmO6TUJmkpQT0Avx3jyV6lajQH
+6qvKipItp6aUx/Uq9eFrpUvXsFSOsdIS1IS+9qHW
+-----END CERTIFICATE-----

tests/certs/intermediateCA.key

+-----BEGIN RSA PRIVATE KEY-----
+MIIEowIBAAKCAQEA0iEC56M/lo5cxAqSIxMvISygNusCndcVigTW1e6iKSJib2ve
+4/q0egeyUO9uU/dUciOILmNOa3zuNJmol0iowS85wyte8E53hH15qk9QpRI6UMhm
+veUyKfdTbiwlfLO6gMdXPkAsr/vXTP5QUZYDFfujYBtk5CDpfxQR4hPdgA0zud97
+BiZMm69AunH5A0jxeu9AsmYJwVrTFM3EX/j8m8Fg06IeJHaD42Sz942gnglJWvRf
+S2IJbpnr7sOGvZ/0FIJdqjAV8v3qNcDf6X5436SCLCDZXADIHedP2AGMYLaplEZL
+C7UaTNm9zIvvYg0XdR6VWb+tOSVKU4aNCehyvwIDAQABAoIBAHahvIoaWGQfq6/i
+Z+71fb40+58Fv0xtifOKF+BgAZ1HlFtjg0si15Gtlraq9pbhJAPsm43U8wksVy/L
+MKt4kg2/I9VUPx1cr41VacMFVHpdeB7zhU3ggBnBUJD6y49DyR+7az3x7UjN3hfR
+3HazQrq+ftZboPJKwojEQ/RnUr5fr1BCCOJuhOwlKd7bs2u7E18uwCEx9FGPQj1p
+LP5xTetrxOeLcTXLzxp88EApzostQHY2N7aeAY/SnBIwBg1niC630BxNI4hfwNex
+kgC5xVEIPvgkbGsy86Aje3xzqRLMfibou/YO5pKyz0slvhxGxmZnEWmLBndxDGDf
+WH8nqQECgYEA9zxyS2bG6fGct0ZSrjht3fpRTKSt/dHyUMNdIIYWR9W/6E7qncrE
+wsiXmxyoWxD1lc5NQiETV+G4TWWSUkfKLUYNGRMYoCHc8Rsz6YehLRhahGnW52zF
++x+mA+EOIaREvsRRkY5VBuZi6e9Mz7lBkgtfceQ/CbeFsb0t5vLFkPECgYEA2ZPV
+oEl4r3k88yWYcMRyBojZhCIvPDuMBLGPyUVx7N32EO7g1/aGfbLSx4I1X8DN4M2I
+oTM8GCGjC5momJvSo2TK2WbJ+C/BwqRNryETxnkYLM4OIlBuV0t585Gp7W5qmrIE
+wbCqi/HGId5RmjF6omGgpCWLYHVzES9BnPfAPq8CgYEA2HbQCzx9RC8K61xi368A
+Yq3bqKM2w1iiNBwY2XUM5PA9CgSuXmE+TNycAG7i6Hi8zODHu/KBoRw75Wfc6LV6
+SpFevml90hZT/7W1ie36LCV6exy/z/foj6pyDEtruAC/P9dbI3ne8B+e0vt14Rlu
+U5QpiOoyVyubnrboDaDZYcECgYBgYx6LQKEnU1VN/gS3SD+fZ3a9E4vLajHQTnz9
+VDdxEK+WtsyCv+K6wsKfwa41eit6gHMbvp/LrPMXC35mBPneiqNWhjPJMBbtTG5h
+vAyPq0urZalbSDhpkbU30vrthTHS0DRNPh9/mZ8FmACch3jlgMxyi3NgSwerwDyX
+9iWDXwKBgH4rsQLuADLO6XtsRJz+ez0CXsYACs9v1X61rLIVoE3acPUl1uh721Ne
+w309RiNexEVEIQMg0OKHm9hBPGSkoXUp47TyoZri5kE9fqbYNSRc8/bTa0jIEFlP
+7ZWtiMegJ2Y7jvW2/IaqXw/HI+RPefeKGrT3So3Z/xAwPx5NWHGA
+-----END RSA PRIVATE KEY-----

tests/certs/new-certs.sh

@@ -28,7 +28,7 @@ openssl req -new -sha256 -key server.key \
   -out server.csr || exit $?
 
 log "Create server.crt"
-openssl x509 -req -in server.csr -days ${DAYS} -sha256 \
+openssl x509 -req -in server.csr -days ${DAYS} -sha256 -extfile openssl.conf \
   -CA rootCA.crt -CAkey rootCA.key -set_serial 01 \
   -extensions server -out server.crt || exit $?
 
@@ -43,16 +43,55 @@ openssl req -new -sha256 -key client.key \
   -out client.csr || exit $?
 
 log "Create client.crt"
-openssl x509 -req -in client.csr -days ${DAYS} -sha256 \
+openssl x509 -req -in client.csr -days ${DAYS} -sha256 -extfile openssl.conf \
   -CA rootCA.crt -CAkey rootCA.key -set_serial 02 \
   -extensions client -out client.crt || exit $?
 
 rm -f client.csr || exit $?
 
+log "Create intermediateCA.key"
+openssl genrsa -out intermediateCA.key ${BITS} || exit $?
+
+log "Create intermediateCA.csr"
+openssl req -new -sha256 -key intermediateCA.key \
+  -subj "/C=US/ST=WA/O=Pistache/CN=intermediateCA" \
+  -out intermediateCA.csr || exit $?
+
+log "Create intermediateCA.crt"
+openssl x509 -req -in intermediateCA.csr -days ${DAYS} -sha256 -extfile openssl.conf \
+  -CA rootCA.crt -CAkey rootCA.key -set_serial 01 \
+  -extensions intermediateCA -out intermediateCA.crt || exit $?
+
+rm -f intermediateCA.csr || exit $?
+
+log "Create server_from_intermediate.key"
+openssl genrsa -out server_from_intermediate.key ${BITS} || exit $?
+
+log "Create server_from_intermediate.csr"
+openssl req -new -sha256 -key server_from_intermediate.key \
+  -subj "/C=US/ST=WA/O=Pistache/CN=server_from_intermediate" \
+  -out server_from_intermediate.csr || exit $?
+
+log "Create server_from_intermediate.crt"
+openssl x509 -req -in server_from_intermediate.csr -days ${DAYS} -sha256 -extfile openssl.conf \
+  -CA intermediateCA.crt -CAkey intermediateCA.key -set_serial 01 \
+  -extensions server -out server_from_intermediate.crt || exit $?
+
+rm -f server_from_intermediate.csr || exit $?
+
 log "Verify server certificate"
 openssl verify -purpose sslserver -CAfile rootCA.crt server.crt || exit $?
 
 log "Verify client certificate"
 openssl verify -purpose sslclient -CAfile rootCA.crt client.crt || exit $?
 
+log "Verify server_from_intermediate certificate against intermediate"
+openssl verify -purpose sslserver -partial_chain -CAfile intermediateCA.crt server_from_intermediate.crt || exit $?
+
+log "Verify server_from_intermediate certificate against root using intermediate"
+openssl verify -purpose sslserver -untrusted intermediateCA.crt -CAfile rootCA.crt server_from_intermediate.crt || exit $?
+
+log "Create server_from_intermediate_with_chain.crt"
+cat server_from_intermediate.crt intermediateCA.crt > server_from_intermediate_with_chain.crt
+
 log "done"

tests/certs/openssl.conf

+[server]
+basicConstraints = CA:FALSE
+keyUsage = digitalSignature, keyEncipherment
+extendedKeyUsage = serverAuth
+
+[client]
+basicConstraints = CA:FALSE
+keyUsage = digitalSignature, keyEncipherment
+extendedKeyUsage = clientAuth
+
+[intermediateCA]
+basicConstraints = critical,CA:TRUE
+

tests/certs/rootCA.crt

 -----BEGIN CERTIFICATE-----
-MIIDHjCCAgagAwIBAgIUCGlkAfscFo4ehhm8dWcvnzG7JRowDQYJKoZIhvcNAQEL
-BQAwFjEUMBIGA1UEAwwLcGlzdGFjaGUuaW8wHhcNMjAwMjE5MDU0MDIyWhcNMzAw
-MjE2MDU0MDIyWjAWMRQwEgYDVQQDDAtwaXN0YWNoZS5pbzCCASIwDQYJKoZIhvcN
-AQEBBQADggEPADCCAQoCggEBAJ6YunssG8tACyaCqN8yT2cXB+zE2k1ga5kU3USx
-wB+SyZo6MDQIzcEeIYgfAEVsXiuP6UWeshWcjh8k1sEoFvSj7UTaoRr6zvyPEemI
-KKMylI2os+ytNlRDSjSbs9ib+0+2iCDnCVGgT5buHecdqGIEajUyS7edWGLXoBgI
-wrI6ooPNkrVJ+tnAvUR/xI4RJQth7ZxIQDviVyB3ozMZ5b/f8Lhrnz3MDxEvBgCG
-hTCnHFicZecGLhwr2V+QY2LbVgpRnwiIBVz1hxZz6L9wueFMCGa+3Lz7IPfj1qUO
-q2pyx6zgaxgfn4TdZkwYbNDrBS+p8Pc0NDZNraMddSci7eMCAwEAAaNkMGIwHQYD
-VR0OBBYEFJj6NWCqM/iqAocqjXzdKFSCDLNKMB8GA1UdIwQYMBaAFJj6NWCqM/iq
-AocqjXzdKFSCDLNKMA8GA1UdEwEB/wQFMAMBAf8wDwYDVR0RBAgwBocEfwAAATAN
-BgkqhkiG9w0BAQsFAAOCAQEACPaVSkw66uGcUHFL3323x51reqGtMTV1aqOtXoXc
-CkQBKyWvxSS0+vDX5ABGd1VaPpQPpEfxAo9blCxlkiFWMgQPBOJXv55SgtdH2F64
-jjUAjYC6IzXljrhoU9kJCfOEWrhvjiOQKE2FKTO8D5DSFHXwk1uxYqLbp+lxVoRo
-86YxSUagmcgyrE5UEa6RZnT5sk8ReuWrigCsMGPQ4cSqOB8958PkAtTu9B3GCyUk
-5RDUpUkfEgwu4hEBQQxYvs31PNWCcblIiHdsZNAomF7Y9SDE3msgs9IAfblyyBZ9
-tq4vim3Z4CFxMXXa/EMxEnSfrpAUdF1iGy0DO2u4mYT8Yw==
+MIIDHjCCAgagAwIBAgIUH6i1DBf3YuE9ymt1WqeCDYezHj8wDQYJKoZIhvcNAQEL
+BQAwFjEUMBIGA1UEAwwLcGlzdGFjaGUuaW8wHhcNMjAwNTI2MjA1MTE0WhcNMzAw
+NTI0MjA1MTE0WjAWMRQwEgYDVQQDDAtwaXN0YWNoZS5pbzCCASIwDQYJKoZIhvcN
+AQEBBQADggEPADCCAQoCggEBAKn28Tw4bjSPEz2Yf6r1lT3j8cQJB3w+Z3EhDeTI
+gYnmY29qrNs82VUjMm079pynXjWVlme6jWKzNNy0HdCMOkLDP3s68CrnJ9nUqxrX
+UvT8vt7TWphbAYjQLHyMcdZ8+7rp08CKjRAm95UjAc+LdsonjTLV0ywXI7lfNycI
+NqGJG+nRvZu5Qzm8HgIlHAdPOn3wT1lgeNewxtW0f2n+3NkwloysRvepkP0ixSVj
+8dR6zHBbE+2L5udtVv/WQ6v189LUWcFNzn8B8AVtdbAdPeMkxhLxfLuF9Hl050Jg
+mkQLBGj1hrRzN3/4iw9aow8viek496Dhl1FDwu9hXup6uDECAwEAAaNkMGIwHQYD
+VR0OBBYEFNmgjXI1qW58zQD2A/QJSNKIAn4GMB8GA1UdIwQYMBaAFNmgjXI1qW58
+zQD2A/QJSNKIAn4GMA8GA1UdEwEB/wQFMAMBAf8wDwYDVR0RBAgwBocEfwAAATAN
+BgkqhkiG9w0BAQsFAAOCAQEAQ0Koy9Lyj5jN9QVT7y6FhyZM7ZAHB+Z48cYzJODa
+mhcN2it13dwK+Vgv+BwKxirormLjPs/ryEnPXM9PWfKw6kTymcJnFG2tOEd2yN8G
+qNY/RJdmCy7mdkxJWharJOyhpH6YkmOrFpP8bBqPDQm3FALPOZqNw/yhDBBZRg9x
+nNtUrTnrEUz0+GTwF6ryMVeh0ekU5hKb/ghGybRNjyuTIVL0C23qKPGvbZ9RswtL
+BVrI8gtQs/dHuaonAhCIJs3QnIDZV6pGtc0WuUeb62c+jOF4GBXDdoGYWqQ3D0i4
+whMHA6gAAIFUkMZSD77gKgJkReqwZjnivC8b1xlej8j7ZA==
 -----END CERTIFICATE-----

tests/certs/rootCA.key

 -----BEGIN PRIVATE KEY-----
-MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCemLp7LBvLQAsm
-gqjfMk9nFwfsxNpNYGuZFN1EscAfksmaOjA0CM3BHiGIHwBFbF4rj+lFnrIVnI4f
-JNbBKBb0o+1E2qEa+s78jxHpiCijMpSNqLPsrTZUQ0o0m7PYm/tPtogg5wlRoE+W
-7h3nHahiBGo1Mku3nVhi16AYCMKyOqKDzZK1SfrZwL1Ef8SOESULYe2cSEA74lcg
-d6MzGeW/3/C4a589zA8RLwYAhoUwpxxYnGXnBi4cK9lfkGNi21YKUZ8IiAVc9YcW
-c+i/cLnhTAhmvty8+yD349alDqtqcses4GsYH5+E3WZMGGzQ6wUvqfD3NDQ2Ta2j
-HXUnIu3jAgMBAAECggEAJIUAs+o1QDkwGB8QKc0Y8aEhBwlRR24DeM2QIghYOC0B
-1Uy+2syILIb2q7SPyGyqxpct3QUs9sMFCvDdrr6/gnfY4/kADglg7lE3i7H5wZKd
-GH2XaNF96CtShAiyghdw6Csc746j27LxgMy2AAkZQ/DGUBeTzeUifCgwyjgCNS3k
-d7d0FWyFJDy7hzBaJ3wcJSOe5xvu0To25B2fzeGaGwkGwi71lT1qc/Z5biXI5puN
-xgAcOFioaFQwb2+b/925sXd6d0nycnaZGLUDWEncHoMXfG48BMTOylvDcLQ/nimf
-9t15/AbU/sYDFoDHF/nva/s3nJICmIaicTFn+0O0sQKBgQDO7zWfd+0Xp4Md3DRY
-CnTBeUSrCERzKonDzZ2xK+XuO9kPEpvBklsL6lcRZ7sP8nzcY9JhfOykpahz1Zm1
-0x0wV/p2cC5/4/HX4mqQ8urMXUpo788/h5+3Ck+F696Q41WCkZUFIpu4tgYWoxuY
-R0l+pHGt3YGHPAQiBAtZTf5rKQKBgQDEM3GH2CFAE7Dt5me7Bm5OAW82FJpWsSTe
-Mi/4UCg+wK/gumTPxeNRvQZg6rWF5QNHElMzCkGxwIhwWeeOTmLWvnvNKhhikkF0
-9iafHAMHT6tpw/THyZKE/9cFLQWNlgEf+0scySzThuF1NYjbG1UHfJpnghlsHbzU
-5AftdTs+KwKBgQCtJ78QFHLhQztU5ikqrn0qU8Yg84cLc0HaBRj54sjAw3WKxkBt
-BoGHA+0dVFZULs1KQYEOMFF4KGI/ozG+0svu4v9i0dYnD98TjZMsfQf6P+n+ywP5
-ngwIRulqH4eaZ4/q9NTkeiQhuLZ5hLyXfLdD8GhrWxmCxraSnB2++aN1mQKBgQCe
-CiorGGdALBxapTttJTL41qL0VwgzSKG/8YE+baLdWWzSgpHt4yLGlpJqwuTRI7XO
-K+6ksGBWhBXjGigxMubev7UNgBkAXXsocZaOl4vA+eXDXjrwK2hAhax32NoeQHRL
-hKnuWAYppP464ZKJm6yUSUQ+mEdOFW4jtkLEfafo3QKBgFAypReQmaBgOzEQAdkS
-K+3piliGJ/RywWZaVO/XT/Cb3PK8fg8h8qZNtpS1pVfRJBt8ISR1sxfAvkRvtXRk
-6MjIpnd4KOm/Is2Z2sM3RyRwNvVM9z5/apuehvwiY1GlqXuMZN16swGkYFi1Z6i5
-DEI3I8kNTNu9/dr9M3cJuIeM
+MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQCp9vE8OG40jxM9
+mH+q9ZU94/HECQd8PmdxIQ3kyIGJ5mNvaqzbPNlVIzJtO/acp141lZZnuo1iszTc
+tB3QjDpCwz97OvAq5yfZ1Ksa11L0/L7e01qYWwGI0Cx8jHHWfPu66dPAio0QJveV
+IwHPi3bKJ40y1dMsFyO5XzcnCDahiRvp0b2buUM5vB4CJRwHTzp98E9ZYHjXsMbV
+tH9p/tzZMJaMrEb3qZD9IsUlY/HUesxwWxPti+bnbVb/1kOr9fPS1FnBTc5/AfAF
+bXWwHT3jJMYS8Xy7hfR5dOdCYJpECwRo9Ya0czd/+IsPWqMPL4npOPeg4ZdRQ8Lv
+YV7qergxAgMBAAECggEBAJeXHEmtuv09rtd9MED2kImGyJcjxn1V20TXSmEHRCIO
+ThmNd2aCuwRoRA2RMb8+t5PrOx6BEKE7XKaMLxtWNpBdPD1Yr+RUDwMF3yYtblv7
+IPH0aBUC9jdkFIlxagb3qj1nV+meqXoCh0eI1ZCavvRGmnUAqTvl14L6HWK+vJsN
+DdoafJ/Bsl8d3oFwetxwaN1RFS/fqBDTLA2puviOt2XAJtET3cKHReBM6iDpbYZH
+2zCk/TpXuoxCSgbKjtlFKvodhO/QHNK3e9FlSNCn1WYsui17WzzJ5IMmaa+Bxu3w
+09CMHc/zKeSldfT5ejEhYqIwlwsNIt9a0MeA1etPcNECgYEA3zof94jI2xlO6LXP
+FAF92TGnRxzCdzle4jJwyZx6iYkhuE1f5EnA1wRcz9Mzx9IEaa6VwUZ7qTJokkmu
+dVUgzmW3SMGp4l6JWHniVxo3bhIGTvG3G9I+n5Dyd2vJMjhED46jVPK3tqEMaiHJ
+3u6GKjZ9gdXCOyp13yxTpCjyYc8CgYEAwur53lhR/mpjp0cMxFyXSFOMB7CEUwIK
+FJCrXX+xEXnBIqtyXvjv2tIz15V6rYGAauIk++c2aQfgz2Sn+5cyL8hrJrLICwRw
+nCGRfJCIvmUAir2yqI/XS1IrUB7/lEOpqFfFvK3qIUW5gX9kqGbTXfc3T8MUpcw+
+M38k73yJxf8CgYAIlHxcEFbgDQX6bdqKw0/qBD2Qvys+V+csvJGXPjt7g9jW86pm
+5OrTmOhUWKLZ4FmpEjvRVPs10qkwTkK1YdND+6bi1gbIm6edzfmELY7J3Ul+yU2n
+dRpRGcooCu2Nz5nWGz5t6nJjQ6dtgOT4e6SOhM+oKOYxTf1/2X1Rhv1iAwKBgQCN
+YUK8M/PFRgXiX3azNzXEEFWRfkd8rg4BvK2Ps/8LXfTo4NKkcIwJfE5+IL5K+5PZ
+8w5AaQTeSgiWZbwykQimAAk4mJTg6OeFWBPe9jc5Yqlx+QaNnUfcKk2gX9uh/zIg
+GQokQUGBwME9XNn2DB9kGNzVzfo8CFlVoPN5giusoQKBgQCIsA/w51MusAcuDGC4
+73llmyYkFR+KcJ7hWYRrzHFfI0ecI/vdWoZoDHhL59CDOLoaeXPmu7B70WOyCG4l
+PdOkUaWKgT+5XR2DA7/CZt8D5lTJOPEPIqJ9uaahoJPnFzSsUlUW98kh/3EFgvRF
+64t3XtDpQwSRUaH1eNyFTrteag==
 -----END PRIVATE KEY-----

tests/certs/server.crt

 -----BEGIN CERTIFICATE-----
-MIICyDCCAbACAQEwDQYJKoZIhvcNAQELBQAwFjEUMBIGA1UEAwwLcGlzdGFjaGUu
-aW8wHhcNMjAwMjE5MDU0MDIzWhcNMzAwMjE2MDU0MDIzWjA+MQswCQYDVQQGEwJV
-UzELMAkGA1UECAwCV0ExETAPBgNVBAoMCFBpc3RhY2hlMQ8wDQYDVQQDDAZzZXJ2
-ZXIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDgXDn4HI3bKDqcLZ4Q
-+/1/4DB01hcQE8tlcFCAUdHDDJ26iGbQl94BZrVJuGgaUvEwgqcjdsWeiu+ItSyS
-+DtnlSzcO7ebD3jpVe7uqck63pKIgKw4S4ZP1m9dbAAbTO8Qpmlw9joSLN4Vg38U
-JlmeH7hAwh9M4yTt7yCTaMZMN63fo996b9BXfgJvkbL1RfFvym4dQJ0fM9uDFSxn
-v3LXXzJ7okjxyW3OM3H6Q9T+Viy7ljiT5cDhGjBhpvpR+ejGqOp5Qqhtz8ffF6jz
-GyAblXzD0CSqt9RTDDPV2c4T/E0KkH6R4KciQkUp3ZobRM/HDYjAysCkxd9x5ruE
-W8jNAgMBAAEwDQYJKoZIhvcNAQELBQADggEBAFn8CUD+EnMB4KTdyYCRzVTdEEGk
-y4Eo4ONh7vxcQK5vUZMMQE8jG2obZYigv1u17MaF4JF89o5hxJyEngTJadi27Sv9
-VgMsBatx2nIf9Wlz6us2eGSs7+i5lZL+5fcowP0zQ9vHj9aW7r0Jl02RY8D3OS1Z
-FYgkKvhveAlJpRhO0RgwuVWvRNXkhG6/l8YDsqha9JQYdBdMgUwpigUO6H+/Zrrm
-kfyH98Ed2Yh7HM7/hZAYG9JUXE5ZdRCFCKykHx6AM/Pvm2biUwi4dQsvx1JPpzyv
-MtFIMgd00gHJg+a72r82R2DipI8MkUU6Y2n4I0YJ8fN1iHBJjnZR3NF7lw4=
+MIIC/jCCAeagAwIBAgIBATANBgkqhkiG9w0BAQsFADAWMRQwEgYDVQQDDAtwaXN0
+YWNoZS5pbzAeFw0yMDA1MjYyMDUxMTRaFw0zMDA1MjQyMDUxMTRaMD4xCzAJBgNV
+BAYTAlVTMQswCQYDVQQIDAJXQTERMA8GA1UECgwIUGlzdGFjaGUxDzANBgNVBAMM
+BnNlcnZlcjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMItSaWOvHCl
+DVTJiIrNTSMqVtrcc+MuCq67wotzvIbEKuwsm4SyYze23VTbUYBlnQFww1fSHxtD
+NocuzonsQFLrRgsuaHZu1ia53MPpOEBdYmUOE65zRrkvoGMERBsYiswFmyWMk+0f
+E+E/qICYIq9nL78ejFqTqeAlfZ5Fhy0iq56ktMOdtEOUT5XrDJgaAK8CRxnOuEav
+m07JluOCgEJ4bcYIKebZTcfaP+SiWu7MGKGaEgJVatPQmBmQE8YUSdEiAaya2z0y
+oAyvCsl9VbJnnO2S5gLx0tS5y5n+lnmoENW31kcc9hbddpdKNCOKhiGUtkF4d8JP
+ySPWMvvJ2bUCAwEAAaMvMC0wCQYDVR0TBAIwADALBgNVHQ8EBAMCBaAwEwYDVR0l
+BAwwCgYIKwYBBQUHAwEwDQYJKoZIhvcNAQELBQADggEBAAZ9SmSwZAeXx8xkoKEo
+6PaEtU9fra8KPXOxy9FgFESlBdMIprBfKO5hAG1N9tlN2ptXTZwRHs/38XkTwNgQ
+HTRS0faVn5kYJVndBtGem6HD0K++5G57HHRZKEKjhKbFLqRf9AGvyAM4V37wEaMf
+ISWA1ndHROFJFVSfc0+fjWBTtqsdNyai0Z+iJc3GkuSozWRGpaBicGKkG2+5+LrD
+e7I0Q7F7q2roAP+2HKVUm7IoT3gwsQt3IXcxKhLE2nF2G+ptXpzk/YeZGrQz/ELZ
+HhNkI94g8CLbmGihFWxIjPdIJ4nd1378I7jEd877T7bdsyRlPkTGuZpMAvN2Joqh
+ePc=
 -----END CERTIFICATE-----

tests/certs/server.key

 -----BEGIN RSA PRIVATE KEY-----
-MIIEpAIBAAKCAQEA4Fw5+ByN2yg6nC2eEPv9f+AwdNYXEBPLZXBQgFHRwwyduohm
-0JfeAWa1SbhoGlLxMIKnI3bFnorviLUskvg7Z5Us3Du3mw946VXu7qnJOt6SiICs
-OEuGT9ZvXWwAG0zvEKZpcPY6EizeFYN/FCZZnh+4QMIfTOMk7e8gk2jGTDet36Pf
-em/QV34Cb5Gy9UXxb8puHUCdHzPbgxUsZ79y118ye6JI8cltzjNx+kPU/lYsu5Y4
-k+XA4RowYab6UfnoxqjqeUKobc/H3xeo8xsgG5V8w9AkqrfUUwwz1dnOE/xNCpB+
-keCnIkJFKd2aG0TPxw2IwMrApMXfcea7hFvIzQIDAQABAoIBAQDUqLZNpYsUKup6
-9IY5pRBgL/jeFbtggtKswKudJXCEx6WNlBKYLwrAG0FEsiUCppF0oLKZ289u+lQX
-KVspp15vTSdrTLM4p4685LYHxCk3wpX0Crqy1Wtmq2N9kov7VI3ZI1MYPltGtP6A
-N9axG7SgO4Ki5x1R/I8ZdCpVbt9ehzW25QyYD3s9Pix2RWtG4kMxOoqvaHeGdxmJ
-TVcXuSP9OYXUTjOwcs0avYK4jPzQDhwPFwGdAMRjIh6RiJxGShyyRHUaqfEoVsRx
-UR0606GeQThLtTgQp7o3G4j4f1JyTk5axrvLSHxbdDpF1zgr0BsLUn6Ag0uz974/
-ska0kc/BAoGBAPUxRkzYQxTKW48WEb7b3xm292KNUY4OxQc4f5LDDsvWGhbJJzRI
-QHnh8FKklyGDWX4QE2XqWriOGTJFDA8IxNBIkKs2Z6HRa8LygNPzJG897RC1skur
-FFkjvs4yYKJMov6L0pOFnVWDnPNWJGFug3TENMVH8do+eePTRkAjAL7xAoGBAOo/
-4iF7xyZcDOCymEhIxZU0fO44Vamm4mCVxlbMZ4MJ1e2nEK1vBn8VLaQmYsy0pFEV
-I6WUzuOpw4b9/AagO0cEuh6AeXJV/FpyAylmk3b8M0CPpT1kzgUbaBXIj+2WoDdP
-Lwplr6Clh56tbZLyqBkFnjcrHZC0MlDOODUpP5+dAoGAW/jSvOp2JytMstx9ZZFG
-G3g1TYNi7x19LJs1x1BhkXZLLPbhPMxJWy60HdvdUNXbUN0o2ZbR1t5+dwvNXSpV
-4ScHFSIAN4O9n0+loVtX9F5POXBeY+HVbSZqYSAmfVqv3TmHkIyTGsuWqPRMCzwQ
-FVGv1byJ7Op4gEv00wQOOJECgYEAxFC9puohQNisQjPqw8mZLS5L9SlpQUEHP4LG
-MkAkEAHSM9VreK4vd5m8InG5I23Qt9NLiJ1ptgq0PxHkgXkPtLkVcjKhlVzSnMoo
-NC4vL+y010qLZSRyNH1/gaIQXUF7DF9kQQZvZebT/fvCdQDAOBgpPHr50Cf0cxwg
-pwzmsVECgYA9R/bNIUjLDvk3TQnOcja/EqPPYp82NUexdvVwvOurhx7JRhrICnx9
-eRdwgthhld5QCmVos++rLKSAdCgqwJE2rzAtoXJP5USUdvWE1dFZf/WX0jf27Vwc
-pkko29lbrCJLe0ilXw0PQSotdFOS7dICpPJqOqF7QVPThT8/57Fd/g==
+MIIEogIBAAKCAQEAwi1JpY68cKUNVMmIis1NIypW2txz4y4KrrvCi3O8hsQq7Cyb
+hLJjN7bdVNtRgGWdAXDDV9IfG0M2hy7OiexAUutGCy5odm7WJrncw+k4QF1iZQ4T
+rnNGuS+gYwREGxiKzAWbJYyT7R8T4T+ogJgir2cvvx6MWpOp4CV9nkWHLSKrnqS0
+w520Q5RPlesMmBoArwJHGc64Rq+bTsmW44KAQnhtxggp5tlNx9o/5KJa7swYoZoS
+AlVq09CYGZATxhRJ0SIBrJrbPTKgDK8KyX1Vsmec7ZLmAvHS1LnLmf6WeagQ1bfW
+Rxz2Ft12l0o0I4qGIZS2QXh3wk/JI9Yy+8nZtQIDAQABAoIBACD9DKwByeXhRJiI
+/JeINXip8sOP/Gg2JD53S5/hc7/5h8lD8s/idpS6jnOiJwCHQttByw4adoptKtBg
+lVo9NthffDDeG4UzY1KE9QqbjqDwvIyqjZFvqC5B9x+bU+6+hqYOtcL1VRRN2VTF
+Od1O+2WNREFV8UZaG9wmwmanLUXvd9jJ7sR8uydvi2xSVKM2kac5kVzcwq8spcvb
+gfjVdFarm6P5pPK9BEcYNwLam1azwhn8IJMUGM1xSLbqwVaUaykjN2IWOskbFtNF
+BqHuZ+O6oJKga4iMJ4kPxBgq3MPXMyU4yRno1b3SfqpK7FFq7p26cBUDrvaBoslB
+K5/OjkECgYEA9YUHki8HhM3+bmoiAWT3XnLirFIGPhQyjMC5kB7uOSOBhMovTS8r
+mtS42tOwVQLTrZ+LrPhUGWNvCsUFJBZ0nvdPO4hVeUaLFvK7mEtcCVCqQUkgbLER
+5HVoLX+3sEjC/Vl17Tam62dznYR9cZWMJh27c3Xdcy2Y/ETX2/OnOakCgYEAyncy
+61eq7tifJhsk8j2ADk4TW+idH6daOUN9kTjATgQQeINtmnGkzO3I6qzAlaRBDmZM
+ggcvQpipg/HTFM+6HWkPDHgcb4tfqYNCumRDMZG8hfdKL+ezsQAB5gZvb88J+sgW
+uQopn0tj29B/oO587P2dzmtRWZpyzeiDcnZnXy0CgYBpEHVt9Bwmk7Q2ccp9iERn
+MYiYrz0moaQEIZEHAIV3BB+vwIm/YNkrF67HTeFeb6g/2099RINQngFtvWP2znk3
+caOBWVUiYbKxrkvi3xTSk6dX6sAqYxfCCQ/8sHPdxzVSD09spH+HqyyJkqHP0mw3
+/28w+JY8bJ3UDm3FHR5JiQKBgEaU/XRb8KQpcnn3Vo74b68M+uS8mCIT1nlGFP1O
+eoP4GMHal5gS7C/g6X0eUlkYlPFvKlbeKFSgIeB0qnCD5k8gc/WV3dvpC6VttBKE
+p4QdWUqepgdDUDpxVTgaoDirRcBehsVlTJNS1fIoooW4/mYkGCKA+TAyjrlHyKNb
+sbfVAoGAUDGg+Mm7fpXl6fATxTHg3nPL4COFh/beADKTL8ig3n1NwU6c3Z8W+gEw
+mM9d2cW/gSjOQWwdlr0xi1GTbRKpw5lYepdzA/d4gJianaPeM/MLcso3R6JI3CSO
+qYn32yorfADCr0ZgYp6MqheBeGO4xS4/KUHZZBkT4jBTF4uvsto=
 -----END RSA PRIVATE KEY-----

tests/certs/server_from_intermediate.crt

+-----BEGIN CERTIFICATE-----
+MIIDQDCCAiigAwIBAgIBATANBgkqhkiG9w0BAQsFADBGMQswCQYDVQQGEwJVUzEL
+MAkGA1UECAwCV0ExETAPBgNVBAoMCFBpc3RhY2hlMRcwFQYDVQQDDA5pbnRlcm1l
+ZGlhdGVDQTAeFw0yMDA1MjYyMDUxMTRaFw0zMDA1MjQyMDUxMTRaMFAxCzAJBgNV
+BAYTAlVTMQswCQYDVQQIDAJXQTERMA8GA1UECgwIUGlzdGFjaGUxITAfBgNVBAMM
+GHNlcnZlcl9mcm9tX2ludGVybWVkaWF0ZTCCASIwDQYJKoZIhvcNAQEBBQADggEP
+ADCCAQoCggEBAK/zY4j/BN+vq79y4I3BJG4b3GTZUWInwspCbRLKk5U+nMDfSKdG
+i0WItjkOAhpgC9lfBCtc1CSGVGqysOxHSuvFdrJKEDIJDXALj6X0BiNfiCH31uZw
+uKmAOPJfQX80Nkvcxvg0mFkpXuFtk6hNVzVHGr1d6UZa6+GMWgLryEDyPYinLzJw
+CasFK/68VD65jISouvkYO8ucgGRvWreXdjnyQjfJucx6H2kj1+u/B6KbqFsjZ2eW
+YnUywtXw+54AtQzbAMGX2imxB/HEIGC+XEnnCoXLuKYU5S+z7fw5CYiBCEFW/45L
+j+4+BWzWpQ2HfJAshMLuUAuMGGtr8n/c8X0CAwEAAaMvMC0wCQYDVR0TBAIwADAL
+BgNVHQ8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDQYJKoZIhvcNAQELBQAD
+ggEBAK3Gv+WH4JapUJ8ui0rnLqox7Ng+uh92dQFS/kHc8l54+aP4h+Q1H+UOj/3O
+4zLe8Dzk37PMZCId1rkI/1KuMk1rHYUJkSlhKFVrToXHlU6xFd/Lh4pI8U6KwwPc
+FEOp+PKB9tVRHWnn91Xfwt6JHGJH7cIovgWP3RFPXsF+XK0KpcGziPc8+67YYpeO
+U1uFB1nbQV6W4gqw68RU3P+7iFrlgAuQBywZysDEP/BLJl6YbLrq4WpSNpJMDurG
+9tMZJgGxcgWFjskpRyy6tOvpnSuZ0x7C/YKhhBtxPnCxJ21ge++CNpN9093QVKzQ
+SyIaowDOQV48TSPnfDcMAt3P73A=
+-----END CERTIFICATE-----

tests/certs/server_from_intermediate.key

+-----BEGIN RSA PRIVATE KEY-----
+MIIEogIBAAKCAQEAr/NjiP8E36+rv3LgjcEkbhvcZNlRYifCykJtEsqTlT6cwN9I
+p0aLRYi2OQ4CGmAL2V8EK1zUJIZUarKw7EdK68V2skoQMgkNcAuPpfQGI1+IIffW
+5nC4qYA48l9BfzQ2S9zG+DSYWSle4W2TqE1XNUcavV3pRlrr4YxaAuvIQPI9iKcv
+MnAJqwUr/rxUPrmMhKi6+Rg7y5yAZG9at5d2OfJCN8m5zHofaSPX678HopuoWyNn
+Z5ZidTLC1fD7ngC1DNsAwZfaKbEH8cQgYL5cSecKhcu4phTlL7Pt/DkJiIEIQVb/
+jkuP7j4FbNalDYd8kCyEwu5QC4wYa2vyf9zxfQIDAQABAoIBAA/Nbj0Zmlh0sJor
+ORvCIwF4oxyzn+mO5KHBwYYUh5i53N49r4rGfS+rjaImLe4sfiPxsrAqUCtPnTlP
+/y/ZX1M5kuWEXVwBECHmB+rBteNraxCR780Whp9CktrBz2IbUF0T4RLdtmkbnBfm
+/YH6IED6t94WFyNoexLwxgzJHF0ovlNPRyVkVEVIiiWUhDBocMtCRn81Rqj8wpcW
+mwU/tj9jSYfX3dZtkN/mCXOGpe3aHsX58RNcY97Nciwxcz3dBJ8wL10HlCVSYA+R
+6ms05f+1H01SzcCsssYAefwdGI+bRGT8/VJugx735hJ/SsHdRnec6pDKB5mYEV7q
+URJq9cECgYEA3Jfmxji4VPjG7l+FG41KoWk/ZPx6NQp0JfXVO69EvJ+4QHHlMTYD
+VsxrHqe5CMLXmgjXS/05JUjMfaS9RfpE7UJj0E9I6lTX9Y5fu4ToTIf/SHFu43pH
+0jz/9LBp9SlbtM2j1s8QhnRqeoO94wgh+4GIbiMO9CNJqonDv2sBRHUCgYEAzDEj
+d6Wf+SvQfTQbZV0dy4tQ50am/d7YWC1Pe4FJ9hjPwcoB3Jp9xdoYFrUwHtz66r1u
+2xN9BbYg0B/ofbzGMpnOJrz9CCX7uBleN+zUAilIcVZLILKcH/csA+H8oYT+Ahve
+5lCXb4h7jfAVT5WH76oy6WeRDfvuyyy9VnPut+kCgYA0UfLyYNGXlcnZD97KQiDJ
+V+UpVpjFq80Qk9YXaeKrulZBMsJhgaYZGDLv+mfwpAXvCtnFtDGxniqiQkiCKHHg
+tDZoWeW5bpYqL7KVD1jpjfgGfqEGYyJVwxISPyVieIS/xWZutH3+5e27UTPgfTVS
+Kc7qEHajgRsfz70V0ZNjYQKBgClF+XRSzx4vhAn6wVrg0of1FhpZhqGkLLjOF9XQ
+EWIkK8JxEaVEuQ2IAvx8DUj/w9w1BDZWHxxLbyCCgpz/zlQmEKx14POHsfTJc+j7
+/vKc4569IZxvXe18KbJzOHxxhGJqvchyG9oYjVjoYXZftEV2cqoJHCHmfaMl3POf
+pW4ZAoGAdZFFT7Tc5ZEYAWE5+MSZbp173hGewp4jkECv9nj/LfhM5XJml3+siNfF
+9xMwspfYPkblN1127xcYZk2rUKqd2tlsg2FYAj6zQIuv/nnah/nSN2peYHpDgtIW
+ZLJIeTaHWprQsxkBHmMVWe6cIgrziZgn5WFit6yG3+Ppu+duOSM=
+-----END RSA PRIVATE KEY-----

tests/certs/server_from_intermediate_with_chain.crt

+-----BEGIN CERTIFICATE-----
+MIIDQDCCAiigAwIBAgIBATANBgkqhkiG9w0BAQsFADBGMQswCQYDVQQGEwJVUzEL
+MAkGA1UECAwCV0ExETAPBgNVBAoMCFBpc3RhY2hlMRcwFQYDVQQDDA5pbnRlcm1l
+ZGlhdGVDQTAeFw0yMDA1MjYyMDUxMTRaFw0zMDA1MjQyMDUxMTRaMFAxCzAJBgNV
+BAYTAlVTMQswCQYDVQQIDAJXQTERMA8GA1UECgwIUGlzdGFjaGUxITAfBgNVBAMM
+GHNlcnZlcl9mcm9tX2ludGVybWVkaWF0ZTCCASIwDQYJKoZIhvcNAQEBBQADggEP
+ADCCAQoCggEBAK/zY4j/BN+vq79y4I3BJG4b3GTZUWInwspCbRLKk5U+nMDfSKdG
+i0WItjkOAhpgC9lfBCtc1CSGVGqysOxHSuvFdrJKEDIJDXALj6X0BiNfiCH31uZw
+uKmAOPJfQX80Nkvcxvg0mFkpXuFtk6hNVzVHGr1d6UZa6+GMWgLryEDyPYinLzJw
+CasFK/68VD65jISouvkYO8ucgGRvWreXdjnyQjfJucx6H2kj1+u/B6KbqFsjZ2eW
+YnUywtXw+54AtQzbAMGX2imxB/HEIGC+XEnnCoXLuKYU5S+z7fw5CYiBCEFW/45L
+j+4+BWzWpQ2HfJAshMLuUAuMGGtr8n/c8X0CAwEAAaMvMC0wCQYDVR0TBAIwADAL
+BgNVHQ8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDQYJKoZIhvcNAQELBQAD
+ggEBAK3Gv+WH4JapUJ8ui0rnLqox7Ng+uh92dQFS/kHc8l54+aP4h+Q1H+UOj/3O
+4zLe8Dzk37PMZCId1rkI/1KuMk1rHYUJkSlhKFVrToXHlU6xFd/Lh4pI8U6KwwPc
+FEOp+PKB9tVRHWnn91Xfwt6JHGJH7cIovgWP3RFPXsF+XK0KpcGziPc8+67YYpeO
+U1uFB1nbQV6W4gqw68RU3P+7iFrlgAuQBywZysDEP/BLJl6YbLrq4WpSNpJMDurG
+9tMZJgGxcgWFjskpRyy6tOvpnSuZ0x7C/YKhhBtxPnCxJ21ge++CNpN9093QVKzQ
+SyIaowDOQV48TSPnfDcMAt3P73A=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIC6jCCAdKgAwIBAgIBATANBgkqhkiG9w0BAQsFADAWMRQwEgYDVQQDDAtwaXN0
+YWNoZS5pbzAeFw0yMDA1MjYyMDUxMTRaFw0zMDA1MjQyMDUxMTRaMEYxCzAJBgNV
+BAYTAlVTMQswCQYDVQQIDAJXQTERMA8GA1UECgwIUGlzdGFjaGUxFzAVBgNVBAMM
+DmludGVybWVkaWF0ZUNBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
+0iEC56M/lo5cxAqSIxMvISygNusCndcVigTW1e6iKSJib2ve4/q0egeyUO9uU/dU
+ciOILmNOa3zuNJmol0iowS85wyte8E53hH15qk9QpRI6UMhmveUyKfdTbiwlfLO6
+gMdXPkAsr/vXTP5QUZYDFfujYBtk5CDpfxQR4hPdgA0zud97BiZMm69AunH5A0jx
+eu9AsmYJwVrTFM3EX/j8m8Fg06IeJHaD42Sz942gnglJWvRfS2IJbpnr7sOGvZ/0
+FIJdqjAV8v3qNcDf6X5436SCLCDZXADIHedP2AGMYLaplEZLC7UaTNm9zIvvYg0X
+dR6VWb+tOSVKU4aNCehyvwIDAQABoxMwETAPBgNVHRMBAf8EBTADAQH/MA0GCSqG
+SIb3DQEBCwUAA4IBAQANF+lALL3xWgXrhJA2RkBziSLFyF3YE/g7kVhZHko+Cxks
+UzDBZrkn7fbhorTu/j2+QiA/mOGauVNfrgkeZvK1jXvwsE1CmH0e95SczEZVydhm
+U8nPGYY2Jhq7JuSJSgYOp7ewweAbibHFo8kYVO2aNYfHHcyS9fDVzJ/Ojn7qnIvS
+JO1aUvWqzdGn0XLPdKj2Jms6NN59/iXgF5I9r5NRMOgA4pUaSe7lUcMT8Oy+PyYE
+3qKszDIGURdP3Ujzdl6YM3edZJTCieBq6AJwY0CmO6TUJmkpQT0Avx3jyV6lajQH
+6qvKipItp6aUx/Uq9eFrpUvXsFSOsdIS1IS+9qHW
+-----END CERTIFICATE-----

tests/https_server_test.cc

@@ -83,6 +83,46 @@ TEST(http_client_test, basic_tls_request) {
   ASSERT_EQ(buffer, "Hello, World!");
 }
 
+TEST(http_client_test, basic_tls_request_with_chained_server_cert) {
+  Http::Endpoint server(Address("localhost", Pistache::Port(0)));
+  auto flags = Tcp::Options::ReuseAddr;
+  auto server_opts = Http::Endpoint::options().flags(flags);
+
+  server.init(server_opts);
+  server.setHandler(Http::make_handler<HelloHandler>());
+  server.useSSL("./certs/server_from_intermediate_with_chain.crt",
+      "./certs/server_from_intermediate.key");
+  server.serveThreaded();
+
+  CURL *curl;
+  CURLcode res;
+  std::string buffer;
+
+  curl_global_init(CURL_GLOBAL_DEFAULT);
+  curl = curl_easy_init();
+  ASSERT_NE(curl, nullptr);
+
+  const auto url = getServerUrl(server);
+  curl_easy_setopt(curl, CURLOPT_URL, url.c_str());
+  curl_easy_setopt(curl, CURLOPT_CAINFO, "./certs/rootCA.crt");
+  curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 1);
+  curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, &write_cb);
+  curl_easy_setopt(curl, CURLOPT_WRITEDATA, &buffer);
+
+  /* Skip hostname check */
+  curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0L);
+
+  res = curl_easy_perform(curl);
+
+  curl_easy_cleanup(curl);
+  curl_global_cleanup();
+
+  server.shutdown();
+
+  ASSERT_EQ(res, CURLE_OK);
+  ASSERT_EQ(buffer, "Hello, World!");
+}
+
 TEST(http_client_test, basic_tls_request_with_auth) {
   Http::Endpoint server(Address("localhost", Pistache::Port(0)));
   auto flags = Tcp::Options::ReuseAddr;