Implement loading a certificate chain in PEM format - fixes #1453

src/main/java/io/vertx/core/net/impl/KeyStoreHelper.java

@@ -38,7 +38,9 @@
 import java.security.cert.CertificateFactory;
 import java.security.cert.X509Certificate;
 import java.security.spec.PKCS8EncodedKeySpec;
+import java.util.ArrayList;
 import java.util.Base64;
+import java.util.List;
 import java.util.function.Supplier;
 import java.util.stream.Stream;
 
@@ -207,7 +209,7 @@ public PrivateKey loadPrivateKey() throws Exception {
       if (keyValue == null) {
         throw new RuntimeException("Missing private key path");
       }
-      byte[] value = loadPem(keyValue.get(), "PRIVATE KEY");
+      byte[] value = loadPems(keyValue.get(), "PRIVATE KEY").get(0);
       KeyFactory rsaKeyFactory = KeyFactory.getInstance("RSA");
       return rsaKeyFactory.generatePrivate(new PKCS8EncodedKeySpec(value));
     }
@@ -241,33 +243,48 @@ public KeyStore loadStore(VertxInternal vertx) throws Exception {
     }
   }
 
-  private static byte[] loadPem(Buffer data, String delimiter) throws IOException {
+  private static List<byte[]> loadPems(Buffer data, String delimiter) throws IOException {
     String pem = data.toString();
     String beginDelimiter = "-----BEGIN " + delimiter + "-----";
     String endDelimiter = "-----END " + delimiter + "-----";
-    int begin = pem.indexOf(beginDelimiter);
-    if (begin == -1) {
-      throw new RuntimeException("Missing " + beginDelimiter + " delimiter");
-    }
-    begin += beginDelimiter.length();
-    int end = pem.indexOf(endDelimiter, begin);
-    if (end == -1) {
-      throw new RuntimeException("Missing " + endDelimiter + " delimiter");
+    List<byte[]> pems = new ArrayList<>();
+    int index = 0;
+    while (true) {
+      index = pem.indexOf(beginDelimiter, index);
+      if (index == -1) {
+        break;
+      }
+      index += beginDelimiter.length();
+      int end = pem.indexOf(endDelimiter, index);
+      if (end == -1) {
+        throw new RuntimeException("Missing " + endDelimiter + " delimiter");
+      }
+      String content = pem.substring(index, end);
+      content = content.replaceAll("\\s", "");
+      if (content.length() == 0) {
+        throw new RuntimeException("Empty pem file");
+      }
+      index = end + 1;
+      pems.add(Base64.getDecoder().decode(content));
     }
-    String content = pem.substring(begin, end);
-    content = content.replaceAll("\\s", "");
-    if (content.length() == 0) {
-      throw new RuntimeException("Empty pem file");
+    if (pems.isEmpty()) {
+      throw new RuntimeException("Missing " + beginDelimiter + " delimiter");
     }
-    return Base64.getDecoder().decode(content);
+    return pems;
   }
 
-  private static X509Certificate[] loadCerts(Buffer cert) throws Exception {
-    if (cert == null) {
+  private static X509Certificate[] loadCerts(Buffer buffer) throws Exception {
+    if (buffer == null) {
       throw new RuntimeException("Missing X.509 certificate path");
     }
-    byte[] value = loadPem(cert, "CERTIFICATE");
+    List<byte[]> pems = loadPems(buffer, "CERTIFICATE");
     CertificateFactory certFactory = CertificateFactory.getInstance("X.509");
-    return certFactory.generateCertificates(new ByteArrayInputStream(value)).toArray(new X509Certificate[0]);
+    List<X509Certificate> certs = new ArrayList<>(pems.size());
+    for (byte[] pem : pems) {
+      for (Certificate cert : certFactory.generateCertificates(new ByteArrayInputStream(pem))) {
+        certs.add((X509Certificate) cert);
+      }
+    }
+    return certs.toArray(new X509Certificate[certs.size()]);
   }
 }

src/test/java/io/vertx/test/core/HttpTLSTest.java

@@ -139,6 +139,18 @@ public void testTLSClientTrustServerCertPEMRootCAWithPEMRootCA() throws Exceptio
     testTLS(TLSCert.NONE, TLSCert.PEM_ROOT_CA, TLSCert.PEM_ROOT_CA, TLSCert.NONE).pass();
   }
 
+  @Test
+  // Server specifies cert chain that the client trusts via a CA (not trust all)
+  public void testTLSClientTrustServerCertPEMRootCAWithPEMCAChain() throws Exception {
+    testTLS(TLSCert.NONE, TLSCert.PEM_ROOT_CA, TLSCert.PEM_CA_CHAIN, TLSCert.NONE).pass();
+  }
+
+  @Test
+  // Server specifies intermediate cert that the client doesn't trust because it is missing the intermediate CA signed by the root CA
+  public void testTLSClientUntrustedServerCertPEMRootCAWithPEMCA() throws Exception {
+    testTLS(TLSCert.NONE, TLSCert.PEM_ROOT_CA, TLSCert.PEM_CA, TLSCert.NONE).fail();
+  }
+
   @Test
   // Server specifies cert that the client trusts (not trust all)
   public void testTLSClientTrustPKCS12ServerCert() throws Exception {

src/test/java/io/vertx/test/core/TLSCert.java

@@ -15,6 +15,7 @@
  */
 package io.vertx.test.core;
 
+import io.netty.handler.codec.UnsupportedMessageTypeException;
 import io.vertx.core.net.JksOptions;
 import io.vertx.core.net.KeyCertOptions;
 import io.vertx.core.net.PemKeyCertOptions;
@@ -166,6 +167,46 @@ KeyCertOptions getClientKeyCertOptions() {
     }
   },
 
+  // Signed by an intermediate CA
+  PEM_CA() {
+    @Override
+    KeyCertOptions getServerKeyCertOptions() {
+      return new PemKeyCertOptions().setKeyPath("tls/server-key.pem").setCertPath("tls/server-cert-int-ca.pem");
+    }
+    @Override
+    TrustOptions getServerTrustOptions() {
+      return new PemTrustOptions().addCertPath("tls/int-ca/ca-cert.pem");
+    }
+    @Override
+    TrustOptions getClientTrustOptions() {
+      return new PemTrustOptions().addCertPath("tls/int-ca/ca-cert.pem");
+    }
+    @Override
+    KeyCertOptions getClientKeyCertOptions() {
+      throw new UnsupportedMessageTypeException();
+    }
+  },
+
+  // Signed by an intermediate CA using a chain
+  PEM_CA_CHAIN() {
+    @Override
+    KeyCertOptions getServerKeyCertOptions() {
+      return new PemKeyCertOptions().setKeyPath("tls/server-key.pem").setCertPath("tls/server-cert-ca-chain.pem");
+    }
+    @Override
+    TrustOptions getServerTrustOptions() {
+      return new PemTrustOptions().addCertPath("tls/root-ca/ca-cert.pem");
+    }
+    @Override
+    TrustOptions getClientTrustOptions() {
+      return new PemTrustOptions().addCertPath("tls/root-ca/ca-cert.pem");
+    }
+    @Override
+    KeyCertOptions getClientKeyCertOptions() {
+      throw new UnsupportedMessageTypeException();
+    }
+  },
+
   // Man-in-middle attack : the server cert CN does not match the resolved URI host
   MIM() {
       @Override

src/test/resources/tls/int-ca/01.pem

@@ -0,0 +1,65 @@
+Certificate:
+    Data:
+        Version: 1 (0x0)
+        Serial Number: 1 (0x1)
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: CN=localhost
+        Validity
+            Not Before: Jun  4 15:20:57 2016 GMT
+            Not After : Jun  4 15:20:57 2017 GMT
+        Subject: CN=localhost
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (2048 bit)
+                Modulus (2048 bit):
+                    00:9a:c7:2c:01:f8:a4:3d:f8:72:40:39:ed:94:74:
+                    8a:e8:d7:2f:59:fb:85:45:97:83:7f:f2:78:5b:be:
+                    db:12:fd:7b:36:4c:92:75:1f:a1:0b:eb:ec:7b:9e:
+                    2e:13:d7:81:94:09:27:0a:54:46:08:83:03:62:1d:
+                    53:29:5e:18:31:95:84:47:9f:14:f1:3a:58:10:64:
+                    24:4e:c0:d5:71:30:c1:26:2e:bc:6a:e0:d5:8e:c0:
+                    66:dd:43:2c:09:ee:18:06:de:ba:36:ea:b3:3f:43:
+                    34:70:2e:14:5b:09:1f:a0:b1:77:6c:52:f7:03:fe:
+                    7a:ed:94:3d:b8:cf:f4:5f:07:03:68:79:3c:d8:ee:
+                    ce:29:a8:15:6a:7b:11:ed:4f:0a:6c:6e:b4:e2:2a:
+                    d6:60:e7:b9:2f:d0:a2:25:18:8a:01:d9:53:9e:12:
+                    8f:96:06:0c:d9:ff:a0:7f:58:f8:9b:9e:29:7c:a0:
+                    4c:76:4d:c6:c9:87:85:6f:ce:ab:4d:80:6f:b2:02:
+                    2b:58:9d:c9:b0:27:96:77:a8:55:44:78:4d:ab:29:
+                    2c:62:8c:e2:d6:86:4d:20:5c:6f:2e:af:21:85:8b:
+                    78:0b:fa:a8:94:8d:75:05:6f:62:19:c7:45:8b:77:
+                    5d:5a:dc:cb:5a:bc:7d:68:9d:0c:93:62:b0:e5:73:
+                    31:c7
+                Exponent: 65537 (0x10001)
+    Signature Algorithm: sha1WithRSAEncryption
+        a3:ad:02:b0:c2:f2:7c:5c:9b:9d:dc:60:bd:d9:b5:b6:d8:20:
+        69:97:b8:01:63:90:14:c9:62:ce:c0:64:a9:56:7d:43:1f:f8:
+        ef:99:8b:06:9b:7a:8e:4b:8b:4e:18:7b:13:c2:55:01:2b:b1:
+        72:54:8b:9c:1b:a4:fb:ac:f4:eb:1a:96:90:a3:a1:8a:5e:27:
+        e5:01:76:d7:e9:41:e3:9a:9d:1d:a1:90:f2:47:60:b3:4e:58:
+        88:bd:eb:5f:20:7c:a3:85:fa:1a:a6:1d:87:24:6b:d4:a9:ee:
+        67:4f:04:49:aa:41:ad:2d:e2:92:c6:b4:e0:fd:b7:fa:35:74:
+        39:e5:3e:cf:4b:79:4c:77:0b:6b:19:63:d0:3a:cc:42:1a:7c:
+        42:74:70:83:76:02:74:d6:75:47:25:62:ff:a3:80:d1:e1:8b:
+        e6:3d:80:e2:ba:08:a4:e9:f7:db:b4:cf:a3:0e:a3:6b:21:f6:
+        30:01:c0:5b:bf:95:da:b0:ac:d3:6f:fb:e6:20:fa:3a:6c:6f:
+        c9:25:a1:46:ee:ac:df:4b:45:5f:30:f4:a2:6e:c1:70:16:02:
+        33:0c:a2:d9:27:0c:b3:c2:bf:05:8f:8e:3c:9a:02:4d:ee:98:
+        89:05:fe:31:a0:a9:d0:b1:37:57:c4:87:44:d1:76:d8:e4:6c:
+        c6:b0:b3:02
+-----BEGIN CERTIFICATE-----
+MIICnDCCAYQCAQEwDQYJKoZIhvcNAQEFBQAwFDESMBAGA1UEAxMJbG9jYWxob3N0
+MB4XDTE2MDYwNDE1MjA1N1oXDTE3MDYwNDE1MjA1N1owFDESMBAGA1UEAxMJbG9j
+YWxob3N0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAmscsAfikPfhy
+QDntlHSK6NcvWfuFRZeDf/J4W77bEv17NkySdR+hC+vse54uE9eBlAknClRGCIMD
+Yh1TKV4YMZWER58U8TpYEGQkTsDVcTDBJi68auDVjsBm3UMsCe4YBt66NuqzP0M0
+cC4UWwkfoLF3bFL3A/567ZQ9uM/0XwcDaHk82O7OKagVansR7U8KbG604irWYOe5
+L9CiJRiKAdlTnhKPlgYM2f+gf1j4m54pfKBMdk3GyYeFb86rTYBvsgIrWJ3JsCeW
+d6hVRHhNqyksYozi1oZNIFxvLq8hhYt4C/qolI11BW9iGcdFi3ddWtzLWrx9aJ0M
+k2Kw5XMxxwIDAQABMA0GCSqGSIb3DQEBBQUAA4IBAQCjrQKwwvJ8XJud3GC92bW2
+2CBpl7gBY5AUyWLOwGSpVn1DH/jvmYsGm3qOS4tOGHsTwlUBK7FyVIucG6T7rPTr
+GpaQo6GKXiflAXbX6UHjmp0doZDyR2CzTliIvetfIHyjhfoaph2HJGvUqe5nTwRJ
+qkGtLeKSxrTg/bf6NXQ55T7PS3lMdwtrGWPQOsxCGnxCdHCDdgJ01nVHJWL/o4DR
+4YvmPYDiugik6ffbtM+jDqNrIfYwAcBbv5XasKzTb/vmIPo6bG/JJaFG7qzfS0Vf
+MPSibsFwFgIzDKLZJwyzwr8Fj448mgJN7piJBf4xoKnQsTdXxIdE0XbY5GzGsLMC
+-----END CERTIFICATE-----

src/test/resources/tls/int-ca/ca-cert-root-ca.pem

@@ -0,0 +1,16 @@
+-----BEGIN CERTIFICATE-----
+MIICnDCCAYQCAQMwDQYJKoZIhvcNAQEFBQAwFDESMBAGA1UEAxMJbG9jYWxob3N0
+MB4XDTE2MDYwNDE1MTYwOVoXDTE3MDYwNDE1MTYwOVowFDESMBAGA1UEAxMJbG9j
+YWxob3N0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4yNV6CfCl3k5
+TgoPxIsbMqFG0dNZODQ9/aoAoMdqVXDliw3uS8QWuIhF9d4krdXTTZ7tXVkijyRO
+t8jbzgUViRWnTWtyZej4UGMKjRm9578YzVu0CfcRqP+YBZU2eNB+3+VBjnEYW7m3
+cUxYghBq3ZmIy/wCAez8iFtCMZ0gyzT2HdpqFMXccFbmRhsWXNq7q+Px9xDIieom
+lwcDBTA0Vn92Iw7Bc9cK2gqOyYU2GlZ2C2uWOkUnFxMTDPu0JE3Trcbaub9HOibO
+S+UaQ+sleAtssqpSkUvxUfnRy3Vw7Symz9GWNqPWfi6nZgkSUOuCSig3ZltMKU2u
+u15ccxe+nwIDAQABMA0GCSqGSIb3DQEBBQUAA4IBAQAdGPJfxv4XWx4+WsqrMqa3
+yG9Q8ASAe1LSr7zYkD+vYIHECp6RlAUCF2MFNQLlv8UEMYUQFneg2YfE5bOtoED5
+XdDDtIcX9MK6qMFKg1v/8UE5DizE7DreyraI0kI5PysUx/TQuOrqDV9ajcGWUr7j
+G+uJ9k3t6db4Ec5rxG9FLmIeVAkNeqiT9lrtMt17uxAN7NYFk8MaWrMwjAQt/kuA
+FT00JWWkqwGKhn6oSujvzVHOe5ewvKlO0ioCGitCnxDlvX6tcECKqGFRSPIRFft0
+KifC+xFh2vFdYWAGMyiLWwcnN6bO0Dwh7t2rlXut4yXZ1lEbD9RNe+BEvs12864Z
+-----END CERTIFICATE-----

src/test/resources/tls/int-ca/ca-cert.pem

@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDIDCCAgigAwIBAgIJANboJkFZgd1/MA0GCSqGSIb3DQEBBQUAMBQxEjAQBgNV
+BAMTCWxvY2FsaG9zdDAeFw0xNjA2MDQxNTE1NDZaFw0xNjA3MDQxNTE1NDZaMBQx
+EjAQBgNVBAMTCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC
+ggEBAOMjVegnwpd5OU4KD8SLGzKhRtHTWTg0Pf2qAKDHalVw5YsN7kvEFriIRfXe
+JK3V002e7V1ZIo8kTrfI284FFYkVp01rcmXo+FBjCo0Zvee/GM1btAn3Eaj/mAWV
+NnjQft/lQY5xGFu5t3FMWIIQat2ZiMv8AgHs/IhbQjGdIMs09h3aahTF3HBW5kYb
+Flzau6vj8fcQyInqJpcHAwUwNFZ/diMOwXPXCtoKjsmFNhpWdgtrljpFJxcTEwz7
+tCRN063G2rm/RzomzkvlGkPrJXgLbLKqUpFL8VH50ct1cO0sps/Rljaj1n4up2YJ
+ElDrgkooN2ZbTClNrrteXHMXvp8CAwEAAaN1MHMwHQYDVR0OBBYEFPrLV+X8y3Mf
++xyiS9P/mkHyJmeGMEQGA1UdIwQ9MDuAFPrLV+X8y3Mf+xyiS9P/mkHyJmeGoRik
+FjAUMRIwEAYDVQQDEwlsb2NhbGhvc3SCCQDW6CZBWYHdfzAMBgNVHRMEBTADAQH/
+MA0GCSqGSIb3DQEBBQUAA4IBAQAKdaEOgizR4fvchvSxB95ce+NqorXddkvt3n9y
+UMcl7EBpxQbz6qyPivQ//cuMJx1GLEaMpPrK2EepNqzEINtI7rfYkQyhl/Vu0wZq
+4TKxnMtm/NMCutfsC0iuXTGC+dhPZkWAWghMo3l59DlhfSyM/DRKei+YnQOVlufg
+r3y8Rul2vkjCEUtnDb6VBshRIWa4AlsPWn3RHzxCi9ay+7yPkSZ8M2PteOAnhblu
+CbT/VkKHIIz0HDcGmE/ezL7k8Tq8TnPDSatVZe5lo+H9ViyQljR6194zzI78qh1F
+ArBUCqNPt40QrHVVyQEoHhqRRx6Q6jEqkIHlMr6V2pxAeWmo
+-----END CERTIFICATE-----

src/test/resources/tls/int-ca/ca-csr.pem

@@ -0,0 +1,15 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIICWTCCAUECAQAwFDESMBAGA1UEAxMJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0B
+AQEFAAOCAQ8AMIIBCgKCAQEA4yNV6CfCl3k5TgoPxIsbMqFG0dNZODQ9/aoAoMdq
+VXDliw3uS8QWuIhF9d4krdXTTZ7tXVkijyROt8jbzgUViRWnTWtyZej4UGMKjRm9
+578YzVu0CfcRqP+YBZU2eNB+3+VBjnEYW7m3cUxYghBq3ZmIy/wCAez8iFtCMZ0g
+yzT2HdpqFMXccFbmRhsWXNq7q+Px9xDIieomlwcDBTA0Vn92Iw7Bc9cK2gqOyYU2
+GlZ2C2uWOkUnFxMTDPu0JE3Trcbaub9HOibOS+UaQ+sleAtssqpSkUvxUfnRy3Vw
+7Symz9GWNqPWfi6nZgkSUOuCSig3ZltMKU2uu15ccxe+nwIDAQABoAAwDQYJKoZI
+hvcNAQELBQADggEBAF7rR7EDVCj64T1sRtNtPU1JHS31My6PchSuLPToRtGrVW1O
+AeDkn6nJC9bJPFnEddbxcD0FC9eyn1DJhUvqY01HQSHqThK26maQcxNWKlmIPUWI
+brHXyZegVkTV42ntEwhkeyr8WmwE8LXWmLAYyfaG7P8+LRVUruX6EGBcXbjP7YW8
+YvbDLwXf5pZ7buzGUQJgoNujSU1IVyTubvQF3B3BNvryHPq0YsQI4XcnbkXAhjjh
+9Zb/mKBWnJGEx+9CzlsNjUs+zVtsjTZBZ1LP+Cn4x79Mb3M5fg3/BtMbW1eQP5PB
+Up287c/+fg8i9nIBsE7wvuuqd4Up06dp67f98hY=
+-----END CERTIFICATE REQUEST-----

src/test/resources/tls/int-ca/ca-key.pem

@@ -0,0 +1,30 @@
+-----BEGIN RSA PRIVATE KEY-----
+Proc-Type: 4,ENCRYPTED
+DEK-Info: DES-EDE3-CBC,2C95E30C1602841C
+
+2pbe7XfTpH3W4mcSH3derNHeAO/7Ug2slvjNPj2WfNO6jVzkd/5yxHOjpsVZ9stv
+vH7e+3hbD64LrwNgzQKQHJSgL1JOYIFVjFlD1IIrx7E/bW1eIcPvYFsnGQeWgIPc
+xsgOKgQWtmDeKVvhZePZpRmD9CfPcVdrsxSmqvz1ngWkxJVl763mlCMWTTxZ8rGn
+/7rxo8e2v0hHYg6D+WvQtagImzOT+f+ZvyTt68mFUpQDFRAQNM3JsyeBSTrtWU7w
+5iKKQPT0tl5tSa0m+HFnSaYb5tL2MeOXroWWZRXBvQQUXqP9miP4nYNURjatD7Ct
+2XUxd+Rzl6xV3rlbEskJtexQVkD8NiS8jrwr9sBV6BPJC7tLflBRsUILzWwS1DkJ
+0hJWtc2Aic7s0UwwjuEZ5HACTBtXA5MM99Qp7SigmcO5qCphYpcPGm+SpHkeOVp+
+9YaEffpEXNFR6w9zHhabMm1Nq1oBinZuF6MAH0Pa/RRV0KV00Uwbv94GwsKv/Tdw
+THfw1MT80ZnWJ9UEFkDphcXl5zVLVWjbJfkrMwAbtLFqdDew9iQlCByKkEAxif/S
+JNNxF4AoAfzQ+bjCDOD2CF1VlD6bCrjrOZnyXHhFGZirUFPwde3+zK/5blJv2I9Y
+6oEJFEeYzWoecq/LVxa62Cu920hGKpp48FxivV6I1ANYvHATWFTowXLkWfIJco+E
+ouEo5RL64FPjfcwQUlwPL2OC1a0Lq0r9U4aiaAaURqTylIZ2MG9MrGLeJH+WbYNi
+D9PE8bgzkv8I5xXSrWYg4t7Jnrq6RPYpzeentkIl4HiOeuS+JJR0IBK/FnJiB1Fv
+AXaopDKoDjgfyvwWDGcQQg3blLlhUABHOeoNIFm3jqMKfcxphaTdMxVJI1gUnWvv
+gvRzSprqeMauEFagB9g579qIYxzBhp8QsMz7kfvfO8znAOSehu1yTYPRnMIUe+cM
+LQbDzxqPxEFWKtPglQYIXWO1utv0kGhbGXR0mNpmLWGoHRUyhydjDB/FEHfrS8nE
+19ShYVQdEB1Fdq6ExxVug/A1w2DdQ0feERDt3VHCCRpmm9DwYr8Ild7mKcgJq8O+
+yxXqZviepaj4EeotxX6dLNMO6x5ej0/KVBwFXmrg8OhGs+CIN0+jWQVAWj8rDMyP
+BbZOVtcA5BU9AvOWYdPQQMsRXEGnNWIuYBipvOinADJxlHZszPDxVroUf/dtKC2o
+iIeYjNXPxwRuHp6xdQeJ4dO4FbhS+wjE775vj9+Pr1i44MOBUj691OmLmia4Bg5j
+PRzT4spfirWuO/LJyLQwbzbL92AoOFKyQxczLlDM8kVF2rPbAFf2Owia2Z9CiehH
+lHwuB8+RQXp7w0GNOOWWyelLSpfTIA2/ds1ZrFN6rRU1q8MYk4AhSZLEHrAKreaM
+D6MfLIzSf8d/ysSrFTBpi3HAiIPUOzrhVdRNWnFxzDRJHWt6m4fUmVdUlle+avRx
+8WuD5RQuUScyDvXg0gwnsYi5NFDwH8mJkbkOPXgskslvk2MqBK9XEuAJNT2ROMu0
+pywN414tL8qO/V9S4GbFGsSWTtsTjVig+mkfDV0bEysK0YFnww8neA==
+-----END RSA PRIVATE KEY-----

src/test/resources/tls/int-ca/crlnumber

@@ -0,0 +1 @@
+1000

src/test/resources/tls/int-ca/index.txt

@@ -0,0 +1 @@
+V	170604152057Z		01	unknown	/CN=localhost

src/test/resources/tls/int-ca/index.txt.attr

@@ -0,0 +1 @@
+unique_subject = no

src/test/resources/tls/int-ca/index.txt.attr.old

@@ -0,0 +1 @@
+unique_subject = no

src/test/resources/tls/int-ca/serial

@@ -0,0 +1 @@
+02

src/test/resources/tls/int-ca/serial.old

@@ -0,0 +1 @@
+01

src/test/resources/tls/openssl.cnf

@@ -11,6 +11,16 @@ default_days     = 365
 crlnumber        = root-ca/crlnumber
 default_crl_days = 365
 
+[ CA_int ]
+new_certs_dir    = int-ca
+database         = int-ca/index.txt
+default_md       = sha1
+policy           = policy_match
+serial           = int-ca/serial
+default_days     = 365
+crlnumber        = int-ca/crlnumber
+default_crl_days = 365
+
 [ policy_match ]
 countryName             = optional
 stateOrProvinceName     = optional