Add HttpClientConfig::extraCaFile to trust extra CA certificates (#24)

SSL_CERT_FILE replaces the default store, so trusting a private CA or a
TLS-inspecting proxy meant building a combined bundle by hand. The new field
names a PEM file whose certificates are added to the default store.

It applies to the target connection and to the connection to an https://
proxy. A file that cannot be read or holds no certificate fails the connection
and the message names the path; it is not skipped. proxy_tunnel takes the path
as a trailing default argument and TlsSocket gains set_extra_ca_file. With the
field empty nothing changes.

Author: yspbwx2010

.github/workflows/ci.yml

@@ -368,7 +368,7 @@ jobs:
       - name: The hermetic tests
         run: |
           set -o pipefail
-          for t in test_framing test_tls_verify test_pool test_proxy test_cancel test_handshake_timeout; do
+          for t in test_framing test_tls_verify test_pool test_proxy test_cancel test_handshake_timeout test_extra_ca; do
             mcpp test "$t" 2>&1 | tee "$t.log"
             grep -q "^$t \.\.\. ok" "$t.log"
           done

CHANGELOG.md

@@ -2,6 +2,8 @@
 
 ## Unreleased
 
+### TLS handshake time limit
+
 The TLS handshake is bounded by `connectTimeoutMs`. It had no limit: after the
 TCP connection was up, a server (or an https:// proxy) that accepted it and never
 sent its ServerHello held `send`, `send_stream` and `download_to_file` for good
@@ -23,6 +25,19 @@ unless the caller passed a stop token.
   the new parameter in its type. `Socket` gains `set_deadline`, `deadline_hit`
   and `wait_before_recv`.
 
+### Extra CA certificates
+
+`HttpClientConfig::extraCaFile` is a path to a PEM file whose certificates are
+trusted in addition to the default store, which `SSL_CERT_FILE` can only replace.
+It is for a private CA or a proxy that re-signs TLS.
+
+* It applies wherever a trust store is built: the target, and the connection to
+  an `https://` proxy.
+* A file that cannot be read or holds no certificate fails the connection, and
+  `statusText` names the file.
+* `proxy_tunnel` takes the path as a trailing default argument, and `TlsSocket`
+  gains `set_extra_ca_file`. Nothing changes while the field is empty.
+
 ## 0.3.4
 
 A request in flight can be abandoned from another thread. Everything is added

README.md

@@ -86,8 +86,24 @@ includes in that file, or use libc++ 23 or libstdc++.
 | `maxRedirects` | 10 | 0 disables redirect following |
 | `maxResponseBodyBytes` | 64 MiB | the most `send()` will hold in memory; does not bound `download_to_file` or `send_stream` |
 | `retryOnStaleConnection` | true | resend once when a pooled connection turns out to have been closed while idle |
+| `extraCaFile` | empty | path of a PEM file of CA certificates to trust in addition to the default store, see below |
 | `proxy` | none | proxy URL, see below |
 
+### Extra CA certificates
+
+A private CA, or a proxy that re-signs TLS, is not in the default store, and
+`SSL_CERT_FILE` replaces that store instead of adding to it. Set `extraCaFile`
+to a PEM file and its certificates are trusted as well as the default ones:
+
+```cpp
+cfg.extraCaFile = "/etc/corp/root-ca.pem";
+```
+
+It applies to the connection to an `https://` proxy as well as to the target. If
+the file cannot be read or holds no certificate, the connection fails and
+`statusText` names the file. The file adds to a default store and does not stand
+in for one: with none found, the connection fails as described under `verifySsl`.
+
 ### Proxies
 
 Set `proxy` to a URL and every request is tunnelled through it with `CONNECT`:

src/http.cppm

@@ -107,6 +107,13 @@ export struct HttpClientConfig {
     // endpoints, and restricting it there would make the retry inapplicable to
     // nearly every request it exists to rescue. Set false to opt out.
     bool retryOnStaleConnection { true };
+
+    // A PEM file of CA certificates to trust in addition to the default store
+    // (`SSL_CERT_FILE`, or else the system roots), for a private CA or a proxy that
+    // re-signs TLS. It applies to the connection to an https:// proxy as well.
+    // A file that cannot be read or holds no certificate fails the connection,
+    // with the path in `statusText`. Empty means none.
+    std::string extraCaFile;
 };
 
 // Progress callback for streaming downloads: (totalBytes, downloadedBytes)
@@ -1042,10 +1049,12 @@ private:
     // connection failed: a proxy that refused the tunnel says so in its own words.
     bool open_connection(TlsSocket& sock, const ParsedUrl& parsed, std::string& error,
                          std::stop_token stop) {
+        sock.set_extra_ca_file(config_.extraCaFile);
         if (config_.proxy.has_value()) {
             auto tunnel = proxy_tunnel(parse_proxy_url(config_.proxy.value()),
                                        parsed.host, parsed.port,
-                                       config_.connectTimeoutMs, config_.verifySsl, stop);
+                                       config_.connectTimeoutMs, config_.verifySsl, stop,
+                                       config_.extraCaFile);
             if (!tunnel.ok()) {
                 error = std::move(tunnel.error);
                 return false;

src/proxy.cppm

@@ -347,12 +347,13 @@ export struct ProxyTunnel {
     }
 };
 
-// `verifySsl` is for the connection to an https:// proxy, and is the same
-// setting that governs the connection to the target.
+// `verifySsl` and `extraCaFile` are for the connection to an https:// proxy, and
+// are the same settings that govern the connection to the target.
 export ProxyTunnel proxy_tunnel(const ProxyConfig& proxy,
                                 std::string_view targetHost, int targetPort,
                                 int timeoutMs, bool verifySsl = true,
-                                std::stop_token stop = {}) {
+                                std::stop_token stop = {},
+                                std::string_view extraCaFile = {}) {
     ProxyTunnel tunnel;
     tunnel.socket.set_stop(stop);
     const std::string where = proxy.host + ":" + std::to_string(proxy.port);
@@ -369,6 +370,7 @@ export ProxyTunnel proxy_tunnel(const ProxyConfig& proxy,
     } else if (proxy.scheme == "https") {
         auto tls = std::make_unique<TlsSocket>();
         tls->set_stop(stop);
+        tls->set_extra_ca_file(std::string(extraCaFile));
         if (!tls->connect(proxy.host.c_str(), proxy.port, timeoutMs, verifySsl)) {
             // The session says why when the TCP connection was up, which is
             // where a proxy certificate that does not verify is refused.

src/tls.cppm

@@ -166,7 +166,8 @@ public:
         : socket_(std::move(other.socket_))
         , lower_(std::move(other.lower_))
         , state_(std::move(other.state_))
-        , error_(std::move(other.error_)) {
+        , error_(std::move(other.error_))
+        , extraCaFile_(std::move(other.extraCaFile_)) {
         // Re-bind BIO to point to our socket_ (not the moved-from one)
         bind_bio();
     }
@@ -179,6 +180,7 @@ public:
             lower_ = std::move(other.lower_);
             state_ = std::move(other.state_);
             error_ = std::move(other.error_);
+            extraCaFile_ = std::move(other.extraCaFile_);
             // Re-bind BIO to point to our socket_
             bind_bio();
         }
@@ -207,6 +209,10 @@ public:
         socket_.set_stop(std::move(stop));
     }
 
+    // A PEM file of roots to trust in addition to the default store. Call before
+    // connect(); setup fails if the file cannot be read or holds no certificate.
+    void set_extra_ca_file(std::string path) { extraCaFile_ = std::move(path); }
+
     // Connect over an already-established Socket (e.g. a proxy tunnel).
     // Takes ownership of the socket and performs TLS handshake on top of it.
     // The handshake gives up after `handshakeTimeoutMs`; a negative value waits
@@ -328,6 +334,7 @@ private:
     std::unique_ptr<TlsSocket> lower_;
     std::unique_ptr<TlsState> state_;
     std::string error_;
+    std::string extraCaFile_;
 
     // The session beneath this one, when there is one, is closed as well: a
     // failed handshake to the target leaves nothing of the tunnel open.
@@ -425,6 +432,24 @@ private:
             if (ret < 0) {
                 return fail("cannot parse the CA certificate bundle: " + mbedtls_message(ret));
             }
+        }
+        // Roots the caller adds to the above. A file that cannot be used is an
+        // error, not something to skip: the caller named it because a server
+        // needs it, and skipping would surface later as a verification failure
+        // that does not mention the file.
+        if (!extraCaFile_.empty()) {
+            std::ifstream in(extraCaFile_, std::ios::binary);
+            if (!in) return fail("cannot read extra CA file '" + extraCaFile_ + "'");
+            std::string extra((std::istreambuf_iterator<char>(in)), {});
+            ret = mbedtls_x509_crt_parse(
+                &state_->ca_cert,
+                reinterpret_cast<const unsigned char*>(extra.c_str()), extra.size() + 1);
+            if (ret < 0) {
+                return fail("cannot parse extra CA file '" + extraCaFile_ + "': "
+                            + mbedtls_message(ret));
+            }
+        }
+        if (!ca_pem.empty() || !extraCaFile_.empty()) {
             mbedtls_ssl_conf_ca_chain(&state_->conf, &state_->ca_cert, nullptr);
         }
 

tests/extra_ca_certs.hpp

@@ -0,0 +1,161 @@
+// Two private CAs, each with one server certificate (CN=localhost, SAN localhost
+// and 127.0.0.1), for test_extra_ca.cpp. Valid for a century. The keys are here
+// on purpose: they authenticate nothing and must never be used for anything.
+//
+// Made with openssl: a self-signed CA with basicConstraints CA:TRUE and
+// keyUsage keyCertSign, and a leaf signed by it whose extensions are
+// basicConstraints CA:FALSE, extendedKeyUsage serverAuth and
+// subjectAltName DNS:localhost,IP:127.0.0.1.
+#pragma once
+
+namespace extra_ca_test {
+
+inline constexpr const char* kCa1Pem = R"PEM(-----BEGIN CERTIFICATE-----
+MIIDLzCCAhegAwIBAgIUG2Zap6LiJwyHlkOt1Ko7G28l+DcwDQYJKoZIhvcNAQEL
+BQAwHjEcMBoGA1UEAwwTdGlueWh0dHBzIHRlc3QgQ0EgMTAgFw0yNjEwMDkwODQ3
+MzNaGA8yMTI2MDkxNTA4NDczM1owHjEcMBoGA1UEAwwTdGlueWh0dHBzIHRlc3Qg
+Q0EgMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALCFaWIMBSe8OolK
+5ExxlX3LbNgg3XlOLxa604zHI0nLWFhKJalkticwwMaX4gcJQdETCXADq+V8qj48
+014c3uUC7xlb+INULhe2ocThipOSwhh4E1Vyv8ywNhgVEw8r+Lgl2ExaSIGzcx4O
+2tWuOvzQHhe6JG8G5YRWVk5ydimhFGY6VdGzUPfHAID+3JEqr6RUeCct4Ehx2zbg
+mkn7ZBu0PHtP2fjrc5KnVwXWDH91MbSfJ1WQvPq5kPbSpeeLoWvDznzpUjg+9aTB
+Dbyxu+/5YVFy5jWWEpgOKakyKnfsQ6XTqzz6dvogAjjh3UWTHe01osluXqY8tjls
+gapw+N8CAwEAAaNjMGEwHQYDVR0OBBYEFP3PSVqEY/jqpWJmAzftRY3zFZPtMB8G
+A1UdIwQYMBaAFP3PSVqEY/jqpWJmAzftRY3zFZPtMA8GA1UdEwEB/wQFMAMBAf8w
+DgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4IBAQAhMIwH6LSKiywbxaFK
+RlUIqgThCIP9uUOZ0m/6jjgMwSJhU0IZ4COCewFVPEGepeqhNjDXHD9Y0EHbxDi5
+cCsk2fSz9xfsjBniI+xETlxGLoCrNDAmNEfPv8mT9UnNKG7KqLghQiHpMbx47895
+wTbr1OldFAlU8usR9pOigRc6j5cmf9b1Tu/piUTFsy5xoANPt/HRg3o/w0mfR8c5
+bHQ3LaqcQO+uBpKAy9guHpszKosOmbTX6AB5JBSyo70u3jx0PHgQuOJTEeKP1PBJ
+51EyNShztp7bn+Rz0OLsMk2h6AMns7HB2m5gEIq/ELlaWDYruqiYFmGpqcm7deVd
+v6DH
+-----END CERTIFICATE-----
+)PEM";
+
+inline constexpr const char* kLeaf1Pem = R"PEM(-----BEGIN CERTIFICATE-----
+MIIDTzCCAjegAwIBAgIUO+WtedkpuiIwKSiJ20nYcEG4pNQwDQYJKoZIhvcNAQEL
+BQAwHjEcMBoGA1UEAwwTdGlueWh0dHBzIHRlc3QgQ0EgMTAgFw0yNjEwMDkwODQ3
+MzNaGA8yMTI2MDkxNTA4NDczM1owFDESMBAGA1UEAwwJbG9jYWxob3N0MIIBIjAN
+BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAj3gXKIHuAZ2h0DeMqxZX2ImgZJan
+arOOw8vKg8yqyfgAeEtenmH42Hv4DAPhHVycq9DyXutiXVxQ+v1y7ABfG9RG2Z0u
+Ueen2TqNDz5F6CrlUeG/Fgk3OVOWVeglcJpd8vqiVzrgRRtc4+uREGlu2YPusgSX
+rbVL+6VARdEfypluaStOt1kJkQlLUxa5A7OpsXKIDLRnOKSHCyx1CCJNy3jwPmqz
+vng6M/FYns/73TxqSZ8Wi7CRdCpNWjlwfJ0zunjeYdrGUchgVpbyWedexZzKwLMO
+NFnjY20qPmN0ZIcXSg+IfZJcUKSD6t+kWZAOtcFwrO6xi7SWFQwNyskW3wIDAQAB
+o4GMMIGJMAkGA1UdEwQCMAAwCwYDVR0PBAQDAgWgMBMGA1UdJQQMMAoGCCsGAQUF
+BwMBMBoGA1UdEQQTMBGCCWxvY2FsaG9zdIcEfwAAATAdBgNVHQ4EFgQUNtDg1vH4
+jNeYzFRvdHWYhhdO6WEwHwYDVR0jBBgwFoAU/c9JWoRj+OqlYmYDN+1FjfMVk+0w
+DQYJKoZIhvcNAQELBQADggEBAEUwKddb7KxhgZ5a41u78wRANsfkXHJEXX6l2IWL
+cOAE9PU2LFj4muABzp7g6WA5rOF5Dt34E3PSB8EQIMTY6SBA9V6Y80/8uBlsF+Er
+Labg6ABrvswpGPn7sc65m8uDUYdG5jm0P2lure9mV8kdiYURk0/eOIpdCp8CcuFx
+iG1LsAMz9h0WAgbkfIzigDGx9TkvqTZNSfzvvObgGmeRfo++pLMEjifug9NBRHuN
+dMiQ4NBvRv+HvJHGSAD1fpm8QvEiMk7spf+PyZbJZP34YZlbJfZJXvBxnTnJY6rD
+amz7EBggI4kRiDGG5vxgyH2bYe9uzw01jb02QJyUvJqvOv4=
+-----END CERTIFICATE-----
+)PEM";
+
+inline constexpr const char* kLeaf1KeyPem = R"PEM(-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCPeBcoge4BnaHQ
+N4yrFlfYiaBklqdqs47Dy8qDzKrJ+AB4S16eYfjYe/gMA+EdXJyr0PJe62JdXFD6
+/XLsAF8b1EbZnS5R56fZOo0PPkXoKuVR4b8WCTc5U5ZV6CVwml3y+qJXOuBFG1zj
+65EQaW7Zg+6yBJettUv7pUBF0R/KmW5pK063WQmRCUtTFrkDs6mxcogMtGc4pIcL
+LHUIIk3LePA+arO+eDoz8Viez/vdPGpJnxaLsJF0Kk1aOXB8nTO6eN5h2sZRyGBW
+lvJZ517FnMrAsw40WeNjbSo+Y3RkhxdKD4h9klxQpIPq36RZkA61wXCs7rGLtJYV
+DA3KyRbfAgMBAAECggEAI/sGM86CFj2mO0XzLWUpGtFJPHDcA9KMV2Zgn7VQj952
+n7SnQiln80MD7l96sZZsZFq+rjdyL9/bH1c43x8oux39ts3ItBnY6o3Ymp4Pgi5f
+3K008x3Uj7f62Aikexz7uthIpn/JhwtZvH9znh4TAtInptWoBJSXPcEv4VKVGoYI
+HglTL1/TvIkyo2hwdLBqOuUF5PioHktG8MZH2ILqFJTfB5bWmOPXDMAEuZD9pkQK
+LfyD9AntTRKVxRO/sXjHy27IXSKbDoZq4kqqLkxk0BGJpf4BnxxjZUWoqbQ7MZHs
+MS26/fcpMWSJygYT8vMkAQYrGjrEkKQSvABFTmkegQKBgQDASz/4vpa+qPf9soX8
+n9+XXSPBeyNeNKpl2p0b+7h8skRIdi/gmttSiC9g/L2fuI2rpoikii1qxQ1XN+wA
+LOcOrL5p/RJdGKAyu8n8cRSGFkhkOO5s2zLsSdXUHesVqWc8keI37DoJkySYEsiC
+WI0MZNNK01cUFttD+nEqxgCicQKBgQC+/+3u+aWF1rumheoUV9pRk65F0jJRnTAQ
+bfiRE7jWhs/LSYpJ1EOgc0OYaRnJPwKYuck4/Z7K3beNKPH3jPJ+89UvfRjHKE/3
+o89yACWZATh2XMjvZUUUmvn+Om+yMBxWhy1vyTJU+XhFVSIROofqg5xH3F3hMC6P
+WIyJctVWTwKBgDUdE+BrFEw5c7Y5d1Td++5dJaEtmAlPVrmndrnh/4VB4CZ7rqHF
+ZEsZnqyVYvMZENiWuStplz3ki9jJc4Bg5rlg8X9pDYd1Y9pfkF0QBvE6emhkaUbc
+DObDRjK+yM5E6mUKjoeP0kAOyo7OsV9/ggYoW0xRr722yn2uUU/VPRuhAoGBALu/
+TX5cTdWa98g/2JH4rbUEqwkdDrNlBQsRXoYVUdsml3mnp1TdX0CILQjTPzKwSngg
+H+lyfLXDbhtHBVqmZPRf8M4GdOXH/ZtanZ7dABg/t+W5XRbdgCM6F8VMYeFRI3n2
+1LYOmvgmZZAZmCxBUbs3dda5ilrCBvKHQ1YU2BpHAoGAGZVbkJ0lnCoXf3tyMBCZ
+MliDj7Q6fSGd22ZAoYy/XGLmZUMi/ZK+PkdzVwT6CDwJY07vBDwUIj5qBHlmaHGS
+qC7o3bmhdtC4R+eN4Gb6mdKB3wCdrRhx2HTBGDf4aoPwGtUw+kUdlve1L+Rwsdfc
+zCIifQbNtFiGohWrskdamio=
+-----END PRIVATE KEY-----
+)PEM";
+
+inline constexpr const char* kCa2Pem = R"PEM(-----BEGIN CERTIFICATE-----
+MIIDLzCCAhegAwIBAgIUe6yBH1jY6Ogs0HBiaUEsnbZlB54wDQYJKoZIhvcNAQEL
+BQAwHjEcMBoGA1UEAwwTdGlueWh0dHBzIHRlc3QgQ0EgMjAgFw0yNjEwMDkwODQ3
+MzNaGA8yMTI2MDkxNTA4NDczM1owHjEcMBoGA1UEAwwTdGlueWh0dHBzIHRlc3Qg
+Q0EgMjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJXfKHI6jLsG/yLn
+UqcDb+PBuw4+C6eaYUwgJNJ5VNubXZpjg1JJxqBqOYFKJ69J5OULqBD2A3DWCAKh
+vh6FOHeSdXlvwnZQN0fLwtnYcmL90XJaDrUwaFn/NrceqsgBo+pNXHcVb6OYwxQr
+Np9/3kta6vbWp9cC8D6vCkmp2ehrz2UfBo4m6oh1Re2ATEBn0H2OD41LKyQslpF4
+CFkm2rIdkTsqlGtdoBkE+JyBX+eoZAlnRBRC5NxJDLEtDlxoPlbVRP/YgPeazv1g
+tMgUvBhmC5AROU6oEpiXiGxas/3m3av/21shsq0iz+b+1QOF5gt9MdOEm2mxrxfF
+hkf0pH0CAwEAAaNjMGEwHQYDVR0OBBYEFMV3Z2Qg+uzCT8vmKJV84SBhwzQQMB8G
+A1UdIwQYMBaAFMV3Z2Qg+uzCT8vmKJV84SBhwzQQMA8GA1UdEwEB/wQFMAMBAf8w
+DgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4IBAQBmve5C71LtGh24Sq3Q
+kNsEROTQYwjbI1W1tEC5C/bqeUFLl4YxyzIHyGFiNSZ7aaaOSRrMEY2aCG2f7am0
+Rckygp6fFaTTAfWnsgH7fVxvBEwywNlLDaAU/co20cnFa1MfUO1MfstF56lqllgX
+NHE/PAOCV/ZcO3DAmJ1lWbsJcXQKplbNlZIeEBwqJs2i3xpiJHxhckg95wyq2vnX
+qtCBiGlK7LBawlHLAbYEXf4LTDAJvb5OFfb8vIJN5pn7PKvMhhMtp4i0r0nDgLkR
+nP25ABxH8uw8KV7rCzp6i0LDSMRAU6pbs/C8kvMSv8BmF2FFK4OX4+29aIPH/utP
+x/4p
+-----END CERTIFICATE-----
+)PEM";
+
+inline constexpr const char* kLeaf2Pem = R"PEM(-----BEGIN CERTIFICATE-----
+MIIDTzCCAjegAwIBAgIUBQEev9nx9U9d1N63ZONvDn/2u9owDQYJKoZIhvcNAQEL
+BQAwHjEcMBoGA1UEAwwTdGlueWh0dHBzIHRlc3QgQ0EgMjAgFw0yNjEwMDkwODQ3
+MzNaGA8yMTI2MDkxNTA4NDczM1owFDESMBAGA1UEAwwJbG9jYWxob3N0MIIBIjAN
+BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4piCGItiClSpVhm3Rw2h/OTfgyE4
+vrEXqkEcHB7Oq4z23KeluS9r6eM/6i0ezRUTCI71Q6UBQ/n7mQUPb5ePHZygVqL+
+QEYGiO6xH2q3kB3oDzNixaPYUCg0u7WLCbv4E6E8ngqcpMSBTxTH/Be3AB1j0I9a
+AH3xmVbY1E2V79uYhRVc7cQ0mNfXkj1K4G0AaPKuiwwVKnE7/z/BwA4vqWjH9jsV
+s1JFhjPpydBY73VWEVE0Ou1ntBNoKGilsVJBs4lf4P8pu9hBS8H0PCAk784kVY8n
+0Y1G2xU3fSash6HjljjKtWg+mudbu2edVG8pkv13JYxJNNIUCXLvRH6m4QIDAQAB
+o4GMMIGJMAkGA1UdEwQCMAAwCwYDVR0PBAQDAgWgMBMGA1UdJQQMMAoGCCsGAQUF
+BwMBMBoGA1UdEQQTMBGCCWxvY2FsaG9zdIcEfwAAATAdBgNVHQ4EFgQUSfHOwhMo
+5rrgK8aDsQ4K7lvGJ5IwHwYDVR0jBBgwFoAUxXdnZCD67MJPy+YolXzhIGHDNBAw
+DQYJKoZIhvcNAQELBQADggEBAIQ2kQBTG7wSFAa/fGup6cph+pV2ZVikoQUN0C9U
+29uJaGALXNhx5RUDduPZP0i1Q9chYh55HcCT/CtbVlkO3X3BwLmgvqJel0O0nDnR
+bIA90Ccs0wOYBY1bkWqcjqALJlddjeeerYdV3PulAp5uklf5ZWxgxl6XSucRW1fH
+wvtBbQ7TirbYos0nZqAF4pxpMq4KLfWa7eAVMThL6ImiQyOYZsblMxZqAOPh8RIU
+lmZG8/79aHwWyQdCC7p91dD5bCtOwrn1VZvTgmrzp8+TQnzqGuKAlUZEJXp/OF+a
+qana9iMkkKQyE7y+DGZz09xKrvlh8l7kxJMES6ynN/XjITg=
+-----END CERTIFICATE-----
+)PEM";
+
+inline constexpr const char* kLeaf2KeyPem = R"PEM(-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDimIIYi2IKVKlW
+GbdHDaH85N+DITi+sReqQRwcHs6rjPbcp6W5L2vp4z/qLR7NFRMIjvVDpQFD+fuZ
+BQ9vl48dnKBWov5ARgaI7rEfareQHegPM2LFo9hQKDS7tYsJu/gToTyeCpykxIFP
+FMf8F7cAHWPQj1oAffGZVtjUTZXv25iFFVztxDSY19eSPUrgbQBo8q6LDBUqcTv/
+P8HADi+paMf2OxWzUkWGM+nJ0FjvdVYRUTQ67We0E2goaKWxUkGziV/g/ym72EFL
+wfQ8ICTvziRVjyfRjUbbFTd9JqyHoeOWOMq1aD6a51u7Z51UbymS/XcljEk00hQJ
+cu9EfqbhAgMBAAECggEAFmUu1HiwKae47cjQX64mAK3pNldZ+aTcmyfgvJnB4Nwn
+iOLr4uvgLUdXyZAIj4nh7fJdJMCh6aNDHdpNboDK9QkGItHssZMKMc3vhRShzFVc
+WmZAgJqjNjbnEVdNxNpGWEBTEqanWTSPuC5sXorEfDcrZpFIeqx37KkT+JWreD9r
+DEsHVL51wGwD7KC06qv/IUbQXrfUtwJouof0X3iF/1bSmBTi3gVvyRpBaECRAZab
+bOktlfKP/9FquA7KegY0HaaByXC073lj7pl3H9AmnYihXfTHSnxRMLq31IhpWzIN
+Bbx/+vaVWgt/lWdedAVg8wVqlen4PSTstKYpq9WrHQKBgQD0SeekTgwjHfixaGm8
+7BoYHrszO32ua7BPAi8zXjbJi2SwFqyLlsw52FaYMMFxWRCarhtOKzUR0AnfB+Tp
+HUsNlg5IOzeBXz26Care6Ymmx0jc1ZTrNMNoSTRMhZ4Cq16pD/mXSFNRQaBxP1Uy
+ZTKzbz/UMZ6dbw+wY0lRp5gABQKBgQDtdXZHyPWns5OY34IYkO/cX3FY7K6BqqQz
+8ciULN1v8bK32J8NXuuHRpbl+gJQ9ZwSzTyUBEW2EJArSmiVQBWLfITOv+Ubb34a
+7RmiMO7ectqDsydpXyNr5GVvmJSN7ua/Bgse71ZEER+5T+Wk1IFrmc+dgWD7p1wX
+DPoRGVruLQKBgGxA++extmsxcu2bKZBQyFd79tUDPfS3QBAjFaubyoeRv/LQeXH6
+R1Iy7lzO7ko+f78r/Gmtd/0GxfkR1H0BQCsrHfUgWL556C6y7geOUjOYCE/kTfPV
+E+r41bY7WAQy0OX2cFJ7+H//pwvIVwbYFZmyaQStYG6/sqIlvW3z6MXJAoGAFNv1
+qPapRbMLqykvJ3NL7sLflR0tcyyHQhziLsoGJbhIp8e6qRUGgZqc1NTycSQyMqCe
+yq3ZZdXspDDkIQBBJECq9fJ7cL6JiFn9n3bG9PmH4nvRYXs/BFJK6tOvcQxkbrFc
+Nrp1jIMok0HGfYVBXS9kwoRD/bdE6q10Jh5hE30CgYEA1cUVunt7NYrY2NV+jF+1
+kp9Imom/F0ao4wowMmrcJTm1zgw4BehYaRoE7BVOxoq4Rc7SBgSlvb8aoy7EXuu7
+eieh8GE4WeiFGcDtCdpS82s/3IOeHwHo9I7wFa16r1jy/ooygVPM3RB8q7KOmfP+
+Hmwo4XQ7djlELruiEfglIt4=
+-----END PRIVATE KEY-----
+)PEM";
+
+} // namespace extra_ca_test