# Copyright 2021 The Chromium Authors
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.

# Test certificates for the Chrome Root Store. This file should not be used for
# anything other than testing.
#
# TODO(hchao): create test certs instead of using real certs.

# Starfield Services Root Certificate Authority - G2
trust_anchors {
  sha256_hex: "568d6905a2c88708a4b3025190edcfedb1974a606a13c6e5290fcb2ae63edab5"
  crs_root_id: 4
}

# OISTE WISeKey Global Root GB CA
trust_anchors {
  sha256_hex: "6b9c08e86eb0f767cfad65cd98b62149e5494a67f5845e7bd1ed019f27b86bd6"
  constraints: {
    sct_not_after_sec: 0x5AF
    max_version_exclusive: "125.0.6368.2"
    permitted_dns_names: "foo.example.com"
    permitted_dns_names: "bar.example.com"
  }
  constraints: {
    sct_all_after_sec: 0x2579
    min_version: "128"
  }
  constraints: {
    permitted_dns_names: "baz.example.com"
  }
  crs_root_id: 7
}

# CN=Actalis Authentication Root CA, O=Actalis S.p.A./03358520967, L=Milan, C=IT
# https://ssltest-a.actalis.it:8443
trust_anchors {
  sha256_hex: "55926084ec963a64b96e2abe01ce0ba86a64fbfebcc7aab5afc155b37fd76066"
  ev_policy_oids: "2.23.140.1.1"
  eutl: true
  crs_root_id: 3
}

# Anchors for testing combinations of |enforce_anchor_expiry| and
# |enforce_anchor_constraints| flags.

# DigiCert TLS ECC P384 Root G5
trust_anchors {
  sha256_hex: "d92e93252eabca950870b94331990963a2dd5db96d833c82b08e41afd1719178"
  enforce_anchor_expiry: true
}

# USERTrust RSA Certification Authority
trust_anchors {
  sha256_hex: "68b9c761219a5b1f0131784474665db61bbdb109e00f05ca9f74244ee5f5f52b"
  enforce_anchor_constraints: true
}

# AddTrust External CA Root
trust_anchors {
  sha256_hex: "687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff2"
  enforce_anchor_expiry: true
  enforce_anchor_constraints: true
  trust_anchor_id: "\x05\x05\x05"
}

# GTS Root R1
trust_anchors {
  sha256_hex: "d947432abde7b7fa90fc2e6b59101b1280e0e1c7e4e40fa3c6887fff57a7f4cf"
  crs_root_id: 21
}

# "CN=Qualified e-Szigno TLS CA 2018,O=Microsec Ltd.,L=Budapest,C=HU,2.5.4.97=#130e56415448552d3233353834343937"
additional_certs {
  sha256_hex: "f7c7e28fb5e79f314aaac6bbba932f15e1a72069f435d4c9e707f93ca1482ee3"
  eutl: true
}

# Sectigo RSA Organization Validation Secure Server CA
additional_certs {
  sha256_hex: "72a34ac2b424aed3f6b0b04755b88cc027dccc806fddb22b4cd7c47773973ec0"
  enforce_anchor_expiry: true
  trust_anchor_id: "\x01\x01\x01\x01"
  tls_trust_anchor: true
}

# WR2 (Google Trust Services)
additional_certs {
  sha256_hex: "e6fe22bf45e4f0d3b85c59e02c0f495418e1eb8d3210f788d48cd5e1cb547cd4"
  enforce_anchor_constraints: true
  trust_anchor_id: "\x03\x03\x03\x03"
  tls_trust_anchor: true
  # Same crs_root_id as GTS Root R1, which is the issuer of this cert.
  crs_root_id: 21
}

# Go Daddy Secure Certificate Authority - G2
additional_certs {
  sha256_hex: "973a41276ffd01e027a2aad49e34c37846d3e976ff6a620b6712e33832041aa6"
  enforce_anchor_expiry: true
  enforce_anchor_constraints: true
  trust_anchor_id: "\x02\x02\x02\x02"
  tls_trust_anchor: true
}

# Anchor for testing that a certificate which is not EUTL and not a TLS trust anchor is discarded.

# COMODO RSA Extended Validation Secure Server CA
additional_certs {
  sha256_hex: "7e0e16c0056f41a9f4c61f571503c3bcf079e2bddb228bf2219ac31200496b5c"
  trust_anchor_id: "\x01\x02\x03\x03"
  crs_root_id: 25
}

# Anchor for testing that a tls_trust_anchor cert is trusted even if it doesn't have an associated Trust Anchor ID.

# DigiCert SHA2 High Assurance Server CA
additional_certs {
  sha256_hex: "19400be5b7a31fb733917700789d2f0a2471c0c9d506c0e504c06c16d7cb17c0"
  enforce_anchor_expiry: true
  enforce_anchor_constraints: true
  tls_trust_anchor: true
}