_ Git - BearSSL/blob - x509/alltests.txt

   1 ; Most/all of these test chains use the same structure:
   2 ;    root -> ica1 -> ica2 -> ee
   3 ; "ica1" is "Intermediate CA 1"
   4 ; "ee" is "end-entity", i.e. the client or server certificate itself
   5 ;
   6 ; In SSL/TLS order, the EE comes first. The root may or may not be included
   7 ; as a self-signed certificate.
   8
   9 [key]
  10 name = root-rsa2048
  11 type = RSA
  12 n = B6D934D450FDB3AF7A73F1CE38BF5D6F45E1FD4EB198C6608326D217D1C5B79AA3C1DE6339979CF05E5CC81C17B988196DF0B62E3050A1546E93C0DBCF30CB9F1E2779F1C3995235AA3DB6DFB0AD7CCB49CDC0EDE766102AE9CE281F2150FA774C2DDAEF3C58EB4EBFCEE9FB1ADAA383A3CDA3CA9380DCDAF317CC7AAB33809CB2D47F463FC53CDC6194B727296E2ABC5B0936D4C63B0DEBBECEDB1D1CBC106A7171B3F2CA289A77F28AEC42EFB14A8EE2F21A322ACDC0A6462C9AC28537917F46A19381A17466DFBAB339209193FA1DA1A885E7E4F907F610F6A82701B67F12C340C3C9E2B0AB49183A64B659B795B59636DF2269AA726A544E2729A30E9715
  13 e = 010001
  14
  15 [key]
  16 name = root-p256
  17 type = EC
  18 curve = P-256
  19 q = 047174BAABB9302E81D5E557F9F320680C9CF964DBB4200D6DEA40D04A6E42FDB69A682544F6DF7BC4FCDEDD7BBBC5DB7C763F4166406EDBA787C2E5D8C5F37F8D
  20
  21 [key]
  22 name = root-p384
  23 type = EC
  24 curve = P-384
  25 q = 040ED28B3F7F0A38A6DB72CB4DAC8198C3D595BFABEE2E4A3CC6797F1A272C57AD715F96B5FDA29C4DD87B75B1438B6A92C4FD0282A3080A857F28AB31FF8B49F805470A01EE551F7F27C914E7E780AE474558D6F5539BAE806626514FE560478B
  26
  27 [key]
  28 name = root-p521
  29 type = EC
  30 curve = P-521
  31 q = 040168E669615D1B20F2E753D2C86312F51094D3E5C6CF49E8D73418278CD769FE40A84AD4F34865D59D94D5685B389E0CFD0450754CAE81ED1D4A91D0773F7A002ED701DEF2DBDEFC7554E74CD600693DBDE1A7E09CD9044774C744C7CE575BF8B645FF79FCCE06116F61D44FDAE62D3046F4EB41DECB8219B279A5B8CE2A47F3DF0D463B
  32
  33 [key]
  34 name = ica1-rsa2048
  35 type = RSA
  36 n = B3E86BAF9C1652E3810C50AB25CECC0DC7F21F7F50DF2C5C35D6622E632741A7E453A84B27FA1391A3FA094A2F3B5ECF77B38AC1CD49959C750D6474EFE4D74BB9A19B68D2307148EAF74B14DF3F47A9D8BBEC8F28CCFADFB41F947C96FC080528F9E8F42F2FEE629C8A3AE0855860B60F2D30B4C04154914C1F5FADF119F0C022A67DD83F793459427B5BB541C4647F52CF3C3722A12F7925942441C23FFAC775FB48B50D18A7F454F32E6ED84358C4AB50E805AD91B61E0175B3549CDEA09915FBACF15C974951CCEF58126F736BB33414010F5A9DFAAAD693D3E2EAC3ABBC4EEDCC51A1B8F894B6B42CA8862B1FF6514329525E1389B36A78604E4EC01BA5
  37 e = 010001
  38
  39 [key]
  40 name = ica2-rsa2048
  41 type = RSA
  42 n = AE15F7CBEEE3961BCA63D22681B2D8163423735684FCFDB2E98E9DD0D9D0D706A191EF8D4F604E16BDE6529EE557867B7A7FFCBC34AD86EC9150ADD5C7D18D83E95ABA2FDB0DB92131FAA2FD91EC37836261809C6A82253309DF8F7893EACFDB93B0A2687CEA873E369C4B379A71E52084C3789A2BA42C7E76D561A9131272F14B411BC6A555BA9D8965C06699C0F17C9B61B24E6601B0A9C4FDC8C1D0C789BE2746DE6271BA27F52A850F436026BC2A9D07AAD608DC26D86956A1D308DED858936B0EC2AF783E2574D49F001820BFD7158DB9D13D8900A01264E186C0D580F124B2D2FB4C677CAE3DC9BF47026DE47C0D4490518CCD026237F86FB96701C695
  43 e = 010001
  44
  45 [key]
  46 name = ee-rsa2048
  47 type = RSA
  48 n = D47A1D27BA2B3A67B2916AFBE78344CAED1C75ADDD4D8362D6AA6895B224217B15AE2A996815ED66F0B858E7D3F52EC6D92A5EE70E2EE7FC6759C0C8617D4BA46FDD9FD9C8858764C7BA1A0F29D496A8789A6B6220A932D0EEA98C286147A2502A63F621DEDAD8D5F07FC5008270E6A3BF5C89274F51927703C3B0CC2E3BEC23F22F5341AF8993FFD280B14397DED619A092127A3D6679E1C1BCE17770A28B3D4684533FE44E424137921E1FFD38B3F7EF873980D356CFF4E013DE64B072A40384C441ED6FFA3EE2CA0420D2D7DC2C822B7AE26DA11C48DBCF894F34973D28A853DAE7C1E17315A330767F8F2342143D5134D25AAD3C9BCBC8FE7F6E8E40F3BD
  49 e = 010001
  50
  51 [key]
  52 name = ee-p256
  53 type = EC
  54 curve = P-256
  55 q = 045F389DA7FF4D8AAFF63439461AFC3ADFF423AAA9EAFBC508DE008EBE79A537584C6DDD01CAAB47DF89B6C7171F38FC1D2014DD45C0E08F934E380BFCE999A149
  56
  57 [key]
  58 name = ee-p384
  59 type = EC
  60 curve = P-384
  61 q = 0415A488877F3D14830E29A1C2F2C0745CE8CF5E684304D1668972389BA615B34E9648D5A7861E49DFFFBFFFEAD7FC6AF11BC4516C3557332DD86DDFDE2A236CCEA844EBD594CCD3ED5B7AE0061BD6595737B59FE754BCDAB6FE38D34D93DBBF30
  62
  63 [key]
  64 name = ee-p521
  65 type = EC
  66 curve = P-521
  67 q = 040060547ACA9D520FB3272833236CBF8E71AC286A3001FBB1E2C3FD8BAB0817DDE4E4FA53550F120D678F4D55AE4FF36C7C8EAE9E32A08A44FC66F45331E08946077A0139B87FE54B986012A94838C8006034941CD0512E596436D2E8E61CA93585D5C06EAD5094585B5B2A3E013803B3E6AAA1D4156EF09E8352029BB70AC6BF338F918B
  68
  69 ; Trust anchor: the root.
  70 [anchor]
  71 name = root
  72 DN_file = dn-root.der
  73 key = root-rsa2048
  74 type = CA
  75
  76 ; Trust anchor: root with an ECDSA key (in P-256 curve)
  77 [anchor]
  78 name = root-p256
  79 DN_file = dn-root.der
  80 key = root-p256
  81 type = CA
  82
  83 ; Trust anchor: root with an ECDSA key (in P-384 curve)
  84 [anchor]
  85 name = root-p384
  86 DN_file = dn-root.der
  87 key = root-p384
  88 type = CA
  89
  90 ; Trust anchor: root with an ECDSA key (in P-521 curve)
  91 [anchor]
  92 name = root-p521
  93 DN_file = dn-root.der
  94 key = root-p521
  95 type = CA
  96
  97 ; Intermediate CA 1 as trust anchor.
  98 [anchor]
  99 name = ica1
 100 DN_file = dn-ica1.der
 101 key = ica1-rsa2048
 102 type = CA
 103
 104 ; Intermediate CA 2 as trust anchor.
 105 [anchor]
 106 name = ica2
 107 DN_file = dn-ica2.der
 108 key = ica2-rsa2048
 109 type = CA
 110
 111 ; EE certificate as trust anchor (direct trust only).
 112 [anchor]
 113 name = ee
 114 DN_file = dn-ee.der
 115 key = ee-rsa2048
 116 type = EE
 117
 118 ; Base valid chain.
 119 [chain]
 120 name = base
 121 anchors = root
 122 chain = ee.crt ica2.crt ica1.crt
 123 servername = www.example.com
 124 keytype = RSA
 125 keyusage = KEYX
 126 eekey = ee-rsa2048
 127 status = 0
 128
 129 ; Valid chain except that no trust anchor is provided; this should fail
 130 ; with BR_ERR_X509_NOT_TRUSTED.
 131 [chain]
 132 name = noTA
 133 anchors =
 134 chain = ee.crt ica2.crt ica1.crt
 135 servername = www.example.com
 136 keytype = RSA
 137 keyusage = KEYX
 138 status = 62
 139
 140 ; Use of intermediate CA 1 as anchor (extra certificates are ignored).
 141 [chain]
 142 name = anchorICA1
 143 anchors = ica1
 144 chain = ee.crt ica2.crt junk.crt junk.crt
 145 servername = www.example.com
 146 keytype = RSA
 147 keyusage = KEYX
 148 eekey = ee-rsa2048
 149 status = 0
 150
 151 ; Use of intermediate CA 2 as anchor (extra certificates are ignored).
 152 [chain]
 153 name = anchorICA2
 154 anchors = ica2
 155 chain = ee.crt junk.crt junk.crt
 156 servername = www.example.com
 157 keytype = RSA
 158 keyusage = KEYX
 159 eekey = ee-rsa2048
 160 status = 0
 161
 162 ; Direct trust of EE.
 163 [chain]
 164 name = directTrust
 165 anchors = ee
 166 chain = ee.crt junk.crt junk.crt
 167 servername = www.example.com
 168 keytype = RSA
 169 keyusage = KEYX
 170 eekey = ee-rsa2048
 171 status = 0
 172
 173 ; Server name check: name does not match the SAN nor the CN.
 174 [chain]
 175 name = wrongName1
 176 anchors = root
 177 chain = ee.crt ica2.crt ica1.crt
 178 servername = foo.example.com
 179 keytype = RSA
 180 keyusage = KEYX
 181 status = 56
 182
 183 ; Server name check: name matches the CN but not the SAN, and there is
 184 ; a SAN so the CN is ignored.
 185 [chain]
 186 name = wrongName2
 187 anchors = root
 188 chain = ee-names.crt ica2.crt ica1.crt
 189 servername = www.example.com
 190 keytype = RSA
 191 keyusage = KEYX
 192 status = 56
 193
 194 ; Server name check: name does not match CN, but matches the first SAN
 195 ; name.
 196 [chain]
 197 name = goodName1
 198 anchors = root
 199 chain = ee-names.crt ica2.crt ica1.crt
 200 servername = foo.example.com
 201 keytype = RSA
 202 keyusage = KEYX
 203 eekey = ee-rsa2048
 204 status = 0
 205
 206 ; Server name check: name does not match CN, but matches the second SAN
 207 ; name.
 208 [chain]
 209 name = goodName2
 210 anchors = root
 211 chain = ee-names.crt ica2.crt ica1.crt
 212 servername = barqux.example.com
 213 keytype = RSA
 214 keyusage = KEYX
 215 eekey = ee-rsa2048
 216 status = 0
 217
 218 ; Server name check: no SAN, but the CN matches the server name.
 219 [chain]
 220 name = goodName3
 221 anchors = root
 222 chain = ee-names2.crt ica2.crt ica1.crt
 223 servername = www.example.com
 224 keytype = RSA
 225 keyusage = KEYX
 226 eekey = ee-rsa2048
 227 status = 0
 228
 229 ; Server name check: no SAN, and the CN does not match the server name.
 230 [chain]
 231 name = wrongName3
 232 anchors = root
 233 chain = ee-names2.crt ica2.crt ica1.crt
 234 servername = foo.example.com
 235 keytype = RSA
 236 keyusage = KEYX
 237 status = 56
 238
 239 ; Server name check: no SAN, and the CN does not match the server name,
 240 ; although its byte contents seem to match (but with BMPString encoding).
 241 [chain]
 242 name = wrongName4
 243 anchors = root
 244 chain = ee-names3.crt ica2.crt ica1.crt
 245 servername = www1.example.com
 246 keytype = RSA
 247 keyusage = KEYX
 248 status = 56
 249
 250 ; Server name check: no SAN, and the CN uses BMPString encoding, but we
 251 ; do not actually request a server name check, so this should pass.
 252 [chain]
 253 name = ignoreName1
 254 anchors = root
 255 chain = ee-names3.crt ica2.crt ica1.crt
 256 keytype = RSA
 257 keyusage = KEYX
 258 eekey = ee-rsa2048
 259 status = 0
 260
 261 ; Wildcard processing: the name 'localhost' should not match because
 262 ; the engine recognises the wildcard only in a '*.' starting sequence,
 263 ; so the lone '*' in a SAN will not be accepted.
 264 [chain]
 265 name = wildcard1
 266 anchors = root
 267 chain = ee-names4.crt ica2.crt ica1.crt
 268 servername = localhost
 269 keytype = RSA
 270 keyusage = KEYX
 271 status = 56
 272
 273 ; Wildcard processing: the name 'example.com' will be matched by '*.com'.
 274 [chain]
 275 name = wildcard2
 276 anchors = root
 277 chain = ee-names4.crt ica2.crt ica1.crt
 278 servername = example.com
 279 keytype = RSA
 280 keyusage = KEYX
 281 eekey = ee-rsa2048
 282 status = 0
 283
 284 ; Wildcard processing: the name 'www.example.com' will be matched by
 285 ; '*.example.com'.
 286 [chain]
 287 name = wildcard3
 288 anchors = root
 289 chain = ee-names4.crt ica2.crt ica1.crt
 290 servername = www.example.com
 291 keytype = RSA
 292 keyusage = KEYX
 293 eekey = ee-rsa2048
 294 status = 0
 295
 296 ; Wildcard processing: the name 'foo.foo.example.com' will not be matched by
 297 ; 'foo.*.example.com' because we accept the wildcard only in the first name
 298 ; component.
 299 [chain]
 300 name = wildcard4
 301 anchors = root
 302 chain = ee-names4.crt ica2.crt ica1.crt
 303 servername = foo.foo.example.com
 304 keytype = RSA
 305 keyusage = KEYX
 306 status = 56
 307
 308 ; Wildcard processing: the name 'foo.bar.example.com' will not be matched by
 309 ; 'foo.*.example.com', but '*.bar.example.com' will fit.
 310 [chain]
 311 name = wildcard5
 312 anchors = root
 313 chain = ee-names4.crt ica2.crt ica1.crt
 314 servername = foo.bar.example.com
 315 keytype = RSA
 316 keyusage = KEYX
 317 eekey = ee-rsa2048
 318 status = 0
 319
 320 ; Wildcard processing: the name 'foo.bar.example.foobar' will not be matched by
 321 ; '*.*.example.foobar' because we support only a single level of wildcard.
 322 [chain]
 323 name = wildcard6
 324 anchors = root
 325 chain = ee-names4.crt ica2.crt ica1.crt
 326 servername = foo.bar.example.foobar
 327 keytype = RSA
 328 keyusage = KEYX
 329 status = 56
 330
 331 ; Wildcard processing: the name 'foo.*.example.foobar' will be matched
 332 ; by '*.*.example.foobar' because the '*' in the provided server name matches
 333 ; the second '*' in '*.*.example.foobar'. This is a corner case with no
 334 ; practical impact because expected server names are usually extracted from
 335 ; URL and cannot have embedded '*' in them.
 336 [chain]
 337 name = wildcard7
 338 anchors = root
 339 chain = ee-names4.crt ica2.crt ica1.crt
 340 servername = foo.*.example.com
 341 keytype = RSA
 342 keyusage = KEYX
 343 eekey = ee-rsa2048
 344 status = 0
 345
 346 ; Hash function support: the chain uses only SHA-256.
 347 [chain]
 348 name = hashSHA256Only
 349 anchors = root
 350 chain = ee.crt ica2.crt ica1.crt
 351 servername = www.example.com
 352 keytype = RSA
 353 keyusage = KEYX
 354 hashes = sha256
 355 eekey = ee-rsa2048
 356 status = 0
 357
 358 ; Hash function support: the chain uses only SHA-256.
 359 [chain]
 360 name = hashSHA256Unsupported
 361 anchors = root
 362 chain = ee.crt ica2.crt ica1.crt
 363 servername = www.example.com
 364 keytype = RSA
 365 keyusage = KEYX
 366 hashes = md5 sha1 sha224 sha384 sha512
 367 status = 49
 368
 369 ; Hash function support: signature on EE uses SHA-1.
 370 [chain]
 371 name = hashSHA1
 372 anchors = root
 373 chain = ee-sha1.crt ica2.crt ica1.crt
 374 servername = www.example.com
 375 keytype = RSA
 376 keyusage = KEYX
 377 eekey = ee-rsa2048
 378 status = 0
 379
 380 ; Hash function support: signature on EE uses SHA-224.
 381 [chain]
 382 name = hashSHA224
 383 anchors = root
 384 chain = ee-sha224.crt ica2.crt ica1.crt
 385 servername = www.example.com
 386 keytype = RSA
 387 keyusage = KEYX
 388 eekey = ee-rsa2048
 389 status = 0
 390
 391 ; Hash function support: signature on EE uses SHA-384.
 392 [chain]
 393 name = hashSHA384
 394 anchors = root
 395 chain = ee-sha384.crt ica2.crt ica1.crt
 396 servername = www.example.com
 397 keytype = RSA
 398 keyusage = KEYX
 399 eekey = ee-rsa2048
 400 status = 0
 401
 402 ; Hash function support: signature on EE uses SHA-512.
 403 [chain]
 404 name = hashSHA512
 405 anchors = root
 406 chain = ee-sha512.crt ica2.crt ica1.crt
 407 servername = www.example.com
 408 keytype = RSA
 409 keyusage = KEYX
 410 eekey = ee-rsa2048
 411 status = 0
 412
 413 ; Hash function support: signature on EE uses MD5. This is rejected by
 414 ; the engine (even though MD5 is supported as a hash function).
 415 [chain]
 416 name = hashMD5
 417 anchors = root
 418 chain = ee-md5.crt ica2.crt ica1.crt
 419 servername = www.example.com
 420 keytype = RSA
 421 keyusage = KEYX
 422 status = 49
 423
 424 ; EE certificate has trailing garbage (an extra byte), which should be
 425 ; rejected.
 426 [chain]
 427 name = trailingGarbage
 428 anchors = root
 429 chain = ee-trailing.crt ica2.crt ica1.crt
 430 servername = www.example.com
 431 keytype = RSA
 432 keyusage = KEYX
 433 status = 40
 434
 435 ; Signature on EE certificate is incorrect (one byte modified in signature).
 436 [chain]
 437 name = badSignature1
 438 anchors = root
 439 chain = ee-badsig1.crt ica2.crt ica1.crt
 440 servername = www.example.com
 441 keytype = RSA
 442 keyusage = KEYX
 443 status = 52
 444
 445 ; Signature on EE certificate is incorrect (one byte modified in serial
 446 ; number).
 447 [chain]
 448 name = badSignature2
 449 anchors = root
 450 chain = ee-badsig2.crt ica2.crt ica1.crt
 451 servername = www.example.com
 452 keytype = RSA
 453 keyusage = KEYX
 454 status = 52
 455
 456 ; Signature on EE certificate is incorrect but this is ignored because we
 457 ; use a direct trust model here.
 458 [chain]
 459 name = ignoredSignature1
 460 anchors = ee
 461 chain = ee-badsig1.crt ica2.crt ica1.crt
 462 servername = www.example.com
 463 keytype = RSA
 464 keyusage = KEYX
 465 eekey = ee-rsa2048
 466 status = 0
 467
 468 ; Signature on EE certificate is incorrect but this is ignored because we
 469 ; use a direct trust model here.
 470 [chain]
 471 name = ignoredSignature2
 472 anchors = ee
 473 chain = ee-badsig2.crt ica2.crt ica1.crt
 474 servername = www.example.com
 475 keytype = RSA
 476 keyusage = KEYX
 477 eekey = ee-rsa2048
 478 status = 0
 479
 480 ; Intermediate CA 1 has a 1016-bit RSA key, which should be rejected
 481 ; with BR_ERR_X509_WEAK_PUBLIC_KEY.
 482 [chain]
 483 name = rsa1016
 484 anchors = root
 485 chain = ee.crt ica2-1016.crt ica1-1016.crt
 486 servername = www.example.com
 487 keytype = RSA
 488 keyusage = KEYX
 489 status = 60
 490
 491 ; Intermediate CA 1 has a 1017-bit RSA key, which should be accepted
 492 ; (because that's 128 bytes, which is the lower limit).
 493 [chain]
 494 name = rsa1017
 495 anchors = root
 496 chain = ee.crt ica2-1017.crt ica1-1017.crt
 497 servername = www.example.com
 498 keytype = RSA
 499 keyusage = KEYX
 500 eekey = ee-rsa2048
 501 status = 0
 502
 503 ; Intermediate CA 1 has a 4096-bit RSA key, which should be supported.
 504 [chain]
 505 name = rsa4096
 506 anchors = root
 507 chain = ee.crt ica2-4096.crt ica1-4096.crt
 508 servername = www.example.com
 509 keytype = RSA
 510 keyusage = KEYX
 511 eekey = ee-rsa2048
 512 status = 0
 513
 514 ; EE is valid from 2010/02/17 11:40:35 to 2098/07/20 15:11:08. The
 515 ; start date is in UTCTime, the end date is in GeneralizedTime.
 516 [chain]
 517 name = date1
 518 anchors = ica2
 519 chain = ee-dates.crt ica2.crt ica1.crt
 520 time = 2010-02-17 11:40:34Z
 521 servername = www.example.com
 522 keytype = RSA
 523 keyusage = KEYX
 524 status = 54
 525
 526 ; EE is valid from 2010/02/17 11:40:35 to 2098/07/20 15:11:08. The
 527 ; start date is in UTCTime, the end date is in GeneralizedTime.
 528 [chain]
 529 name = date2
 530 anchors = ica2
 531 chain = ee-dates.crt ica2.crt ica1.crt
 532 time = 2010-02-17 11:40:36Z
 533 servername = www.example.com
 534 keytype = RSA
 535 keyusage = KEYX
 536 eekey = ee-rsa2048
 537 status = 0
 538
 539 ; EE is valid from 2010/02/17 11:40:35 to 2098/07/20 15:11:08. The
 540 ; start date is in UTCTime, the end date is in GeneralizedTime.
 541 [chain]
 542 name = date3
 543 anchors = ica2
 544 chain = ee-dates.crt ica2.crt ica1.crt
 545 time = 2098-07-20 15:11:07Z
 546 servername = www.example.com
 547 keytype = RSA
 548 keyusage = KEYX
 549 eekey = ee-rsa2048
 550 status = 0
 551
 552 ; EE is valid from 2010/02/17 11:40:35 to 2098/07/20 15:11:08. The
 553 ; start date is in UTCTime, the end date is in GeneralizedTime.
 554 [chain]
 555 name = date4
 556 anchors = ica2
 557 chain = ee-dates.crt ica2.crt ica1.crt
 558 time = 2098-07-20 15:11:09Z
 559 servername = www.example.com
 560 keytype = RSA
 561 keyusage = KEYX
 562 status = 54
 563
 564 ; Intermediate CA 2 certificate is not a CA.
 565 [chain]
 566 name = notCA
 567 anchors = root
 568 chain = ee-dates.crt ica2-notCA.crt ica1.crt
 569 servername = www.example.com
 570 keytype = RSA
 571 keyusage = KEYX
 572 status = 58
 573
 574 ; A chain using ECDSA with P-256.
 575 [chain]
 576 name = secp256r1
 577 anchors = root-p256
 578 chain = ee-p256.crt ica2-p256.crt ica1-p256.crt
 579 servername = www.example.com
 580 keytype = EC
 581 keyusage = SIGN
 582 eekey = ee-p256
 583 status = 0
 584
 585 ; A chain using ECDSA with P-384.
 586 [chain]
 587 name = secp384r1
 588 anchors = root-p384
 589 chain = ee-p384.crt ica2-p384.crt ica1-p384.crt
 590 servername = www.example.com
 591 keytype = EC
 592 keyusage = SIGN
 593 eekey = ee-p384
 594 status = 0
 595
 596 ; A chain using ECDSA with P-521.
 597 [chain]
 598 name = secp521r1
 599 anchors = root-p521
 600 chain = ee-p521.crt ica2-p521.crt ica1-p521.crt
 601 servername = www.example.com
 602 keytype = EC
 603 keyusage = SIGN
 604 eekey = ee-p521
 605 status = 0
 606
 607 ; A chain using ECDSA with P-256, signature on EE uses SHA-1.
 608 [chain]
 609 name = secp256r1-sha1
 610 anchors = root-p256
 611 chain = ee-p256-sha1.crt ica2-p256.crt ica1-p256.crt
 612 servername = www.example.com
 613 keytype = EC
 614 keyusage = SIGN
 615 eekey = ee-p256
 616 status = 0
 617
 618 ; A chain using ECDSA with P-256, signature on EE uses SHA-224.
 619 [chain]
 620 name = secp256r1-sha224
 621 anchors = root-p256
 622 chain = ee-p256-sha224.crt ica2-p256.crt ica1-p256.crt
 623 servername = www.example.com
 624 keytype = EC
 625 keyusage = SIGN
 626 eekey = ee-p256
 627 status = 0
 628
 629 ; A chain using ECDSA with P-256, signature on EE uses SHA-256.
 630 [chain]
 631 name = secp256r1-sha256
 632 anchors = root-p256
 633 chain = ee-p256-sha256.crt ica2-p256.crt ica1-p256.crt
 634 servername = www.example.com
 635 keytype = EC
 636 keyusage = SIGN
 637 eekey = ee-p256
 638 status = 0
 639
 640 ; A chain using ECDSA with P-256, signature on EE uses SHA-384.
 641 [chain]
 642 name = secp256r1-sha384
 643 anchors = root-p256
 644 chain = ee-p256-sha384.crt ica2-p256.crt ica1-p256.crt
 645 servername = www.example.com
 646 keytype = EC
 647 keyusage = SIGN
 648 eekey = ee-p256
 649 status = 0
 650
 651 ; A chain using ECDSA with P-256, signature on EE uses SHA-512.
 652 [chain]
 653 name = secp256r1-sha512
 654 anchors = root-p256
 655 chain = ee-p256-sha512.crt ica2-p256.crt ica1-p256.crt
 656 servername = www.example.com
 657 keytype = EC
 658 keyusage = SIGN
 659 eekey = ee-p256
 660 status = 0