From a365860fc7aea92e7a2ac79e00455e74cf1a99bb Mon Sep 17 00:00:00 2001
From: ComplexSpaces <complexspacescode@gmail.com>
Date: Wed, 13 Aug 2025 14:21:35 -0500
Subject: [PATCH 1/7] Remove unrelated_chain_valid_for_unrelated_domain test

Going forwards we will just use another pre-existing
chain for unrelated name tests to reduce the maintainence burden.
Given that, we don't need to keep this chain around or test
that its valid for itself anymore.
---
 .../agilebits_com_valid_1.crt                 | Bin 1501 -> 0 bytes
 .../agilebits_com_valid_2.crt                 | Bin 1122 -> 0 bytes
 .../agilebits_com_valid_3.crt                 | Bin 1174 -> 0 bytes
 .../agilebits_com_valid_4.crt                 | Bin 1145 -> 0 bytes
 .../src/tests/verification_real_world/mod.rs  |  20 ++----------------
 5 files changed, 2 insertions(+), 18 deletions(-)
 delete mode 100644 rustls-platform-verifier/src/tests/verification_real_world/agilebits_com_valid_1.crt
 delete mode 100644 rustls-platform-verifier/src/tests/verification_real_world/agilebits_com_valid_2.crt
 delete mode 100644 rustls-platform-verifier/src/tests/verification_real_world/agilebits_com_valid_3.crt
 delete mode 100644 rustls-platform-verifier/src/tests/verification_real_world/agilebits_com_valid_4.crt

diff --git a/rustls-platform-verifier/src/tests/verification_real_world/agilebits_com_valid_1.crt b/rustls-platform-verifier/src/tests/verification_real_world/agilebits_com_valid_1.crt
deleted file mode 100644
index c999d58c3091e871e0fc4772cb8a1872d4e9cd9a..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 1501
zcmXqLV!dh5#By)}GZP~dlK@k5QR@;p$<lnbgL~QzEo?O4W#iOp^Jx3d%gD&h%3xq)
z$Zf#M#vIDRCd?EXY{(Ck2XeTC*&K5dtMc;<WelW10?fj~5CMgtU`GWb0}~4cUjt(U
zIdNVi69WrF3j;8S0&-0aEDg<!j7=>~Eu#!148;sYAo_U|(=&5YlQK(+^^)^*4VoC0
zke$NF%D~*j$j<;2=VEGNWMnvWd%CA9$I^yJ%J;u}RlWT^r}b^w7yq+wx=x;t5S#U1
zcz<u%uhdRezun6NTZ3Mi+)g*)sSsi;YMOgEQ1-=^d0UrV+;B#5(>vu&*I!r%$h4n5
z_iNg%r;PkwZ4Og3ng7m|uX*xmQk?Sxt&f~CeHYk2t(4DKk`KGOpg7Lu^rqQ1v!mwR
zn!xLRz1!C~AhqP-;gg#rC-PLDIrq>~`(`Y!kW#<j<OSiY=Vj<!I-Vz2*V?;Bq1E=8
zx`kuY)QN3B(>ZU?viO&+!V;W#G3{QF%KFd2R}Nd~CF|JV4&3UI$@P`3-z+c2Gk*@x
z)Xj^OZ)&DUyw~)&{CPK<Qp$I=Mf*$s?ua;6$i&RZz__@H>8C*x(^ms|U>M3Ovq%_-
zHHd`Xl!(71bB6I@#Fl-lZ-zQCUe{wXkOe8=V-aH!DgRimWiG#sE2sH*sjNrUmoHnl
z>ltW+qy<@243wHs<Dp5gyu4fwHEM)GiWOLR47dz9*x1q=c^H`(4fsHU{EUqMSy-5v
zSQkJnRAm80FNZc8BP%OAGb5bEWMB<aF3)0OU}RvhKyQIgn^s0iNr9EVesWQcUXf9*
zfw5j9IDwTEl@^zPQiMK46ew>{3Nwh2ktNe0-9Q({H(+d2gqo9|TwH+NAOkbFawa5e
zOR%ekS({p9zyor#FvyEc2B3sk$HoQp84KgJN+uR2mL|qLAkJdUU?^u0`sin}H@L{B
zg-!BszkQYPkLO#H+B@dt8nCv!e%hvH#lXNgF{SPLX9flqW(E%fHzq}f7aTonPuIHm
zoJ|X#VKB!ptM*aJOucI*+fy&hpL3?_>I|TgPqSaW5S(OV=pCQ)FXiuvthckGqBQ>e
zd{x&gvt!o5<7^CN49_kZCOee(929V5yI#2S+`&r@-=?*+{od7XB>Pv+ye|N1@hh;!
z?gp+vQ%`MSZ<H~vJ9wT^`I~C(%a1=LmRxk3t{xyPbTv)MW#S_yg;eMIy)MfR2bu?a
zv1}DNGFvD*eaj=G1AX7c4{3$gGt6NqWjOPjKdZHnGxgup*}>;tZmLmw*&4$;y?5Kn
zx{w3^e0VoN?Y#}Q*Ui9%Ng<YN?`B@LgdW$O-h169>9N#K^cTsHefxZls7q^El$art
zg2V;6wj)Qk|4n9}vqSmXZ1We-oxg9rUKzW;r*!v;Rkq2<#RIUU0u~R946S>&N2+od
zW^NH?dcnB&=&y3;JKJ`%UcLA>b+;eakKeo>y+SvhIXZj&(dE-VUVCPE&HdSx8f~+h
zt^aQ=$$I1Wf6vLp&kGj6ED2g{Y+keA^j%4#oVx2GHx4d%E4_VDdYnYx3CXs@-9-%X
z?~bqia;d#^dV12j=P$iZD(;EOS{2G=r5sx`_n4c;Zt;p@?UjZW)0a$0tqM$9GWDI1
z`fHnaUY)LD(Ft=7=JmV@)XM8jd;8$2g}8ppr@}4L6?1Q7FJ$if-glwCbH>TFWw)$7
z1VwGnDn5SoSbM|e6o=L;`f@G$+_8Rn-|u_-raV+paASSPDDXD!^W^g0<=lCEuGf1`
Io%1aO0I_>I4gdfE

diff --git a/rustls-platform-verifier/src/tests/verification_real_world/agilebits_com_valid_2.crt b/rustls-platform-verifier/src/tests/verification_real_world/agilebits_com_valid_2.crt
deleted file mode 100644
index 66c211b49d9e31ee8650ff942d6d5d627136c541..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 1122
zcmXqLVu>?oVs=}=%*4pVB+Onc<a34XQu=|JGIup+&9^YDY&GCz<J4;NX#38~$jHsg
zU|?y;ZNSOK9LmBb%oG}I$PbhUa=3)q9CH(^^79NO4a7kL%)$Z?0fnIa{1OFcM+HLz
zIdNViBLfQ~V<RIYGXs+-ab9BsB(8xC0i$IMq##BM!;B7gR4_6yu~6_eFg9pnR6=$u
zBP#=Q6C*zZP@IdYiII_Ed;QW#jZeRO9`6gT?{g0?h~|nv_+`$XFS$-`j>!ezOkO6~
zPSxLCns$YG<Jw546_ZZ=`X<zK@UV{AoYceHzV|*o+AL7={pYi+aE7Rxr_aQ9XBf3G
zPq;Aa)8<{W={4=Igp`^bHK)hP+QyxqYrS3V*|J;u8HpwnCNaLa)6K4L5y5K4$m8C-
zVfLa9k!peHeB~DYt-C*)EMI>0p!hl=ws_s|g`bl@Uf2{fxiZMVknzv-+hxc7&f7eA
z+9`4M`n#3?jh=p$OW&|Lvg~r-ix2T%UhGSsrosCwWW(n7(>6!1b~bzP{PjY=B@8#y
zZ>fbYtYTa2*|Ax4`r_|@&+>ITGrgSWSF@annUR5UaT8+{Fhs%(gn%I_E6m9FpM}GK
z4M;IDG8piI#P~sCEWqT@W*`gVtFnk0h_G>JvoW%=vNJQnSxgXVJ{B<+k<gnG@t0)I
zFg}dfvTyaxP$$OgdQ1lLAl=F=5(Z)oA}tbUT20>U;h8c;k0Wx<@l67LTpR|~FtZpL
zS@I2X4fJ7r1I9MxjFOT9D}DX^<l+LoB47$iPBhd@1gEf)qSE3Lz2y8{11q=&rZzpO
zhUB6WT<Y~<<|L;U8Q6ndC(mMG08EGrj20Lm8IVKRfTA1&VUPg|EIbBW1{`c`>5V*$
zOpM6s513bg>5q|tt@r7&n+NvYx9vHruzc$~tN)uK_t`#joN(if_c@;Hk>b7S?}J`X
zzA0UEM{dnp*^oQe?k}BJx9{=WDH~WLEHCCoonDu0s$Bih<U)AN+J~8!a-+|_Sn0Dl
zBI(4l*abyvG)&6^k_&ThF(#<+W+%=NKNz5x^seDn`O_tROU~>nh%A~BqA{cExh3NV
z?a23`eOgCMIt~3Fn9TY5#-3r#=kj@+pVCu4R81<`A;f#WaOc*yt4l&zAL&Wl5&JFb
z>CW4^WB0KRm#mbVv*P1&q83ZuRuBu^lXTwGyZ=y)M!;ho^%IZQ^yP0(&o2_b{pPgC
awViR@zVmNsAHVe{rN`*$R;{?3KbioE3Ymof

diff --git a/rustls-platform-verifier/src/tests/verification_real_world/agilebits_com_valid_3.crt b/rustls-platform-verifier/src/tests/verification_real_world/agilebits_com_valid_3.crt
deleted file mode 100644
index 1dfb0e70faadbce1e2af09df6a528e061e25c471..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 1174
zcmXqLVwq&n#9Xz2nTe5!NtmsEikFu9+0VZYt<z@w$?<OIkz)qDY@Awc9&O)w85y}*
z84Ma{7;+nMvN4CUun9AT1{(?(@PRlS!t9PknN|6DiH5=kf*=ugVXolh{F0L5l*F7=
zLsbK1kRX?^OmInJQCendPKrWEYH~(ieolURW@@pHf@fZ`o}smYB}f^wun|I8aB5Lm
zW^!t=LQsBwiGp)#QAuW6W^!Uls)A!_Nk)EAW=W-ju7bOfft)z6p{aqXk*T4P0T4uq
z^BS8Q8W|fJ7=pP5mZ&c02YL<cBsRy~M4-zJB@M(OmJ2`xpcXnR7#cJ&Dj^31BP#=Q
z6C*zZP@IdYiII_EQ$<7Jsfw$Q3)j0h1eDa~-MHRS_GM<q_Xx#=pCv7f`fHeU+b%C~
zuJYTo<bv5Q#(llFJx;KToB4cs*P(pe?zQ>Xt&%@HGdA42zO&3iHgVpPe@$jfpL&Ho
zaeesn?-sFNCAa3xHnr6MwLu|(EvM>2!=`0F*S~R>><_SDzq6>_GUCUst1Ewcq#I0o
zH>DyjzjJZm0fV-*g|2D4LS8REJn^T;o&OhK80gmOmK2y??@;+Z??`0c?&5awPeyJU
zJDh)QmtA#g%cuD&e7fG>3uEFk|G%2bblRe8U4TXY?ccgd(npWWg*+^OkbZ)HPP_6o
zdk2Mjg@z*yK6chBYJDv0a%P=a#mmIZ$iTR`i4hc1x(58fV3ZYRWc<&<YQPMnz)3`w
zA0)s6OlWNevLFR~EMhDoEfQy1P2TL`nKDI>BXZ91O#*&g90u|rX=N4(1F;5?Iq?kl
zS212U(6;DUv?JGR&L_c%%?1^09NKJ*tgP&ej4U|@Sq6GAz5!#KQbtKhft9{~esXbv
zUJ)?Kq#Nlaf+M)3sI<65FF8NgzyhwGsZ9r}KDnp_hjM+WDaolt2DTul$+MUlm>3u>
zFj%06q&<g__M#kc&X84L;WFSbU}Iwml~rIsPFBGD1x!|q3`yorF?$5I+I8!^<e8o0
z`iPyO>gUl2?wuSxc5gSU+HB1acyiV>Yx!i8X-0}GJzQ4Ld2736RdMc<da;JiobwvY
z63y<Fiv{WoqSsh&NO(|wg=5)6*_yZmyMNBAR+_t<fwOLnn|Sk`IcniE4J?zU^}oG!
zZ`IK=(srkuGjhVk_FUyt(EIoQP*$wo0<T<=i1sPZEDhspice4I$Z8RsroQa$%|^Fn
zb&HD_xPt7OJJ^%UJ2S=kEn6?G=5Y1B5NP!`Hr71Fr_NwgsEX5EvkkFx#2XVop86@k
xq_X-oZ^^{oYFEtw%Z^RUI!#sOM6%qK4fSJY{aQPVFDY<|*2*J4P39^}007}dpzHtu

diff --git a/rustls-platform-verifier/src/tests/verification_real_world/agilebits_com_valid_4.crt b/rustls-platform-verifier/src/tests/verification_real_world/agilebits_com_valid_4.crt
deleted file mode 100644
index 75df0cc7c0be230aca9aec4f9d5e958ea3b268ac..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 1145
zcmXqLVktFfVvb$F%*4pV#L2Ln&&$W8X?wi^FB_*;n@8JsUPeZ4RtAF%Lv903Hs(+k
zHesgFU_(^{We|r;SSGk6u_!GwH77+OBsDoBFFz+gJu|gfN5L~MS<leOzyPF-TUZmJ
z%sD5qxLCnR!8x_4Br`2DIk6-&KTpB2v?L?HD6^!}Ku(<3z!C_7dO;vcoY&aIz|6?P
z(A?P4&@9TJaR#bW1Pu5<c5n!@I~HYD<>w_D3L6N5MA(J7f|K)0N{Ukwb5e<Qv9*CE
zNH4Rn5yHj6sYPX($*IK(LHYS5NbXKWxLQG1!QIH9iBSnT+!$FIn41{+8GzzkOihf8
z3|D!qj%fY#d-Qdm<n;Kyj^K^*_NUL!R}jwCv^v3GYx6z3%p&=wS;C6haWM=HoAe{=
zzqS8Vb#8l}DIGLx!o$MHH*|UZ^1q$%yt(bORM<N0Z6zYF&;M3?EVWB^nqHQ5#FS3=
zu>YzHCKm)Z-)bolIh;O^CBy1|pF@<am*08kiPq1<t}zsx4tiHzyUyzQ9>brm-wq|5
z7mj4oZa8D&et+k^38}eE=XEA7TlV~3tAuAwn%`op+?8A3ndt4}W!_<Y-~IK*>|WKI
zv(GhNbagYDR?vQriO<uybz4sH?vz)Fj%!X{3Ax{{e_Uyk+L`&0AsO@k?9<Xe5-L;b
zkRaa56l&RB&&tHi$iTR`@q<C*TLXSzFv|)vGX7^_HDCr(;8>L92MMqM(_))}EJy(#
zix`W@oOp)&s~E2vXj^nF+L7xu=ab;XW&?SUv@(l?fmnmc{`l<|&)t=8`w|_x=FWA2
zLwqYco*VeHacHwKva+%>GO{=uI2y>n_y&w^0vRPG1y=g{`Fh30MtY^i`UZ+{S*A8o
zsB8sHwn8sCwa7pXWTQNbyn(EN^a9BR;&64vFm*+G$wfKf#3!r3!ezi=z{bWBDyzVN
zoG5^q379At8I)xocZHv-eJNh)^HDDJ@0s8{J9qy3$3j1CVljK$ARl}r)<h$F-|^5t
z>90=P*H74Fd{#O_po!_n5B;yg30GLpeQe}7cz1c}bbpDRx%a+Lp2)GQ&Oztx!B@M>
z<{7h<%kpy62j7)WS>2@mG4rZ#+`2Cd50@^FaMAr_Q!r!AuFP#y%j@|K<8=NkXt#3D
z{7@PHMI>a&)HuNkp#=4F^ADB(R}L<Z-Sz)f<n!C-*H4=EUS*c4K-HXy$M|YzezTXn
z|FtOOq3BBX$m-_(L3(aIn;25cWIQh4sC<zZc4nOp^Mvb?7Biom;*^a3&pvI#ih2{z
X`(Z1;Z-{?u{I<t^y8(0T7v>%Sm?WBn

diff --git a/rustls-platform-verifier/src/tests/verification_real_world/mod.rs b/rustls-platform-verifier/src/tests/verification_real_world/mod.rs
index d78861a8..128c3255 100644
--- a/rustls-platform-verifier/src/tests/verification_real_world/mod.rs
+++ b/rustls-platform-verifier/src/tests/verification_real_world/mod.rs
@@ -67,14 +67,8 @@ const VALID_1PASSWORD_COM_CHAIN: &[&[u8]] = &[
 
 const MY_1PASSWORD_COM: &str = "my.1password.com";
 
-// A domain name for which `VALID_1PASSWORD_COM_CHAIN` isn't valid.
-const VALID_UNRELATED_DOMAIN: &str = "agilebits.com";
-const VALID_UNRELATED_CHAIN: &[&[u8]] = &[
-    include_bytes!("agilebits_com_valid_1.crt"),
-    include_bytes!("agilebits_com_valid_2.crt"),
-    include_bytes!("agilebits_com_valid_3.crt"),
-    include_bytes!("agilebits_com_valid_4.crt"),
-];
+// A domain name for which `VALID_AWS_AMAZON_COM_CHAIN` isn't valid.
+const VALID_UNRELATED_DOMAIN: &str = "my.1password.com";
 
 const LETSENCRYPT_ORG: &str = "letsencrypt.org";
 
@@ -215,16 +209,6 @@ real_world_test_cases! {
         expected_result: Err(TlsError::InvalidCertificate(CertificateError::NotValidForName)),
         other_error: no_error!(),
     },
-    // The certificate chain for the unrelated domain is valid for that
-    // unrelated domain.
-    unrelated_chain_valid_for_unrelated_domain => TestCase {
-        reference_id: VALID_UNRELATED_DOMAIN,
-        chain: VALID_UNRELATED_CHAIN,
-        stapled_ocsp: None,
-        verification_time: verification_time(),
-        expected_result: Ok(()),
-        other_error: no_error!(),
-    },
     // The certificate chain for the unrelated domain is not valid for
     // my.1password.com.
     unrelated_chain_not_valid_for_my_1password_com => TestCase {

From 40f2bdaf54cd2d61f79caa33f8bc0a7d3e978282 Mon Sep 17 00:00:00 2001
From: ComplexSpaces <complexspacescode@gmail.com>
Date: Wed, 13 Aug 2025 14:30:01 -0500
Subject: [PATCH 2/7] Move to direct AWS certificate chain for secondary
 real-world CA test

---
 .../examples/update-certs.rs                  |   8 +-
 rustls-platform-verifier/src/tests/mod.rs     |   4 +-
 .../1password_com_valid_1.crt                 | Bin 1501 -> 0 bytes
 .../1password_com_valid_2.crt                 | Bin 1122 -> 0 bytes
 .../1password_com_valid_3.crt                 | Bin 837 -> 0 bytes
 .../aws_amazon_com_valid_1.crt                | Bin 0 -> 1632 bytes
 .../aws_amazon_com_valid_2.crt                | Bin 0 -> 1122 bytes
 .../aws_amazon_com_valid_3.crt                | Bin 0 -> 1174 bytes
 ...valid_4.crt => aws_amazon_com_valid_4.crt} | Bin
 .../src/tests/verification_real_world/mod.rs  |  82 +++++++++++-------
 10 files changed, 60 insertions(+), 34 deletions(-)
 delete mode 100644 rustls-platform-verifier/src/tests/verification_real_world/1password_com_valid_1.crt
 delete mode 100644 rustls-platform-verifier/src/tests/verification_real_world/1password_com_valid_2.crt
 delete mode 100644 rustls-platform-verifier/src/tests/verification_real_world/1password_com_valid_3.crt
 create mode 100644 rustls-platform-verifier/src/tests/verification_real_world/aws_amazon_com_valid_1.crt
 create mode 100644 rustls-platform-verifier/src/tests/verification_real_world/aws_amazon_com_valid_2.crt
 create mode 100644 rustls-platform-verifier/src/tests/verification_real_world/aws_amazon_com_valid_3.crt
 rename rustls-platform-verifier/src/tests/verification_real_world/{1password_com_valid_4.crt => aws_amazon_com_valid_4.crt} (100%)

diff --git a/rustls-platform-verifier/examples/update-certs.rs b/rustls-platform-verifier/examples/update-certs.rs
index 6f274d80..1970f97d 100644
--- a/rustls-platform-verifier/examples/update-certs.rs
+++ b/rustls-platform-verifier/examples/update-certs.rs
@@ -44,4 +44,10 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
     Ok(())
 }
 
-const HOSTS: &[&str] = &["letsencrypt.org"];
+// We use two different CAs for better coverage and...
+const HOSTS: &[&str] = &[
+    // This host is using EC-based certificates for coverage.
+    "letsencrypt.org",
+    // This host is using RSA-based certificates for coverage.
+    "aws.amazon.com",
+];
diff --git a/rustls-platform-verifier/src/tests/mod.rs b/rustls-platform-verifier/src/tests/mod.rs
index 9e5c7a9e..11a1426b 100644
--- a/rustls-platform-verifier/src/tests/mod.rs
+++ b/rustls-platform-verifier/src/tests/mod.rs
@@ -62,8 +62,8 @@ pub fn assert_cert_error_eq<E: StdError + PartialEq + 'static>(
 /// we know the test certificates are valid. This must be updated if the mock certificates
 /// are regenerated.
 pub(crate) fn verification_time() -> pki_types::UnixTime {
-    // Fri, 30 May 2025 21:27:00 UTC
-    pki_types::UnixTime::since_unix_epoch(Duration::from_secs(1_748_633_220))
+    // Wed, 13 August 2025 18:30:53 UTC
+    pki_types::UnixTime::since_unix_epoch(Duration::from_secs(1_755_109_853))
 }
 
 fn test_provider() -> Arc<CryptoProvider> {
diff --git a/rustls-platform-verifier/src/tests/verification_real_world/1password_com_valid_1.crt b/rustls-platform-verifier/src/tests/verification_real_world/1password_com_valid_1.crt
deleted file mode 100644
index 48f37e49d15b84e70defaf01dc6386cff5fe4031..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 1501
zcmXqLV!dh5#By)}GZP~dlK^Ydg2MGT7<0Ny+0&0Cyks!oW#iOp^Jx3d%gD&h%3xq)
z$Zf#M#vIDRCd?EXY{(Ck2XeTC*&K5dtMc;<WelW10?fj~5CMgtU`GWb0}~4cUjrip
zIdNVi69ZEq27@Rd*VMqw$jHdp)Y8;4%0S9c!axkHpNC&d&#)k|xVSvOC`B(hKi8m%
zQ3=^GjI0dIO^o~uKyfanCPqevTRZm6b&`x|dno(uX5Gd^zovI+bZ|eupI4amuWIh>
z0zUJZ&n@y@`1C`y|IgRh-ZMk+w(TwbRq9Wk{9hjRL-c%FMEbKSyCynby!yK?hAaD~
z*)?Y0o$N<z4^MHr5&AUyWaQ+R78k4n-hRm!OixwSIaFKo@44;LntjTT^i%(IoH}^?
z>GEIIE*1P<p5g(D(_?#oEw!-xy|ed+v}Ie!--H8OPn*nt^ntN!zSH9WuNJRm>`rfg
zVI3T*|NB;jbAs1>-*<19SR@`fJNe;hmx624_y4yN2vhm#vz^J~f~xiI?n7nb&we^u
ztu$U79dvb)8s~{sUv8{>tdsh@P}aPVL(6>!clUB8W=00a#Z64#4Vsuf8^{AgQC67+
z7@Q3v2MmMGMg<&hswpWvclza=pH;7$9vR4j6!5W#v53SjK6sJQZ|ScR$tpg^6}uXa
zvCY&q&;&^fvM3oSG@-{t6EAAS2!oU=u<#gg8E~+%r8n|0GBFzPfdu&(8UM4eFf*|(
zfLN!>B4!}M#-Yu|$jZvj%m`;O8CZjq%d?mO(}=+Wy#+dLS{WrJ1y=g{$wfJOMMk*>
zMtX_h1Xfa1T3iB35Bd;Mpu9mT%pgWamP~_m16>&3fU!*xYEFJ~aRGLN49wulnUJh4
z!LAx+ZEBGL56I2JATKf*fRbSy8yC=LER5GGnOK-uni%tdIEyiZp^U+=bg_EOEP=xo
z(K%P{+Xuat{qUeqx;OK{#$PELlV(}oXJBCLU-8s6o`HddnZez_l}W+%f|pp$<B2_o
zPp$tbV6v>HTm8s7)A^5mzf}kM+^YQM#H7g3(_^RIePI8e%`2YtpIu$C<>WCzfe+6&
z-{(5K=*tBzJw2ekwUKf{4=c2)WfIeC;{N`)&>kbQz;Eijoy__-`Fiv!cR=l3h_F}t
z=A*j0O)hqZ76<0(*m(;mdi@HWTUwuG|4K)ZLo)IZ(BA%xhrY#{b&sD^-3suuY?&&w
zI`HI-C1yDu8$YNhy<%+u+WYL1VX{Mc&p`o4w(EsE&mFwv@NHU4+wWcNMzVk9%=-eM
z_FjP7tH|&+|G$sY->aO`Q@E0r$8YkJ+0raJfy?E*yj$-ygTf+UkodRNY+o>A<LeJ6
zp6(J{w?R5PDLm~8@00wG+6>v}cKm8WE*yX*6|it%WDvjXCi^&0?7f1r(prPt6_x+e
zZ&}?skb3X=xyKIocK%<yEMVQ5V!!+K`URKsH7rVW%J)_@SNwlJ-!kCx6h;PH^UI(2
z`@J=84W0f=-rZOI>g%}Nxsvj41q~k@y0|4Mk<C}ZS7OsO_57>qaV?gGL2TYPzZtIm
zs<CnZn!K1rSJ;2Gn$<CM%r1QJ%{0Mu$M+itbGPa%&xx_xx|_p%#dLuOdS{OuIla0l
zxF^4G^OgF#Z7Z~=A9~^B#giR;B6+>QyA>zT?ObkiUof!T?VQIot>62NWx~%dywYmG
wwsz9IHxY7Xr$QS{4!jXz&Wlf<HMM2Yj?NvLmrmL-E%<&o>AKmP%-cO70AwFO3;+NC

diff --git a/rustls-platform-verifier/src/tests/verification_real_world/1password_com_valid_2.crt b/rustls-platform-verifier/src/tests/verification_real_world/1password_com_valid_2.crt
deleted file mode 100644
index 3b2debb7e51462c914bba879a82148964c081623..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 1122
zcmXqLVu>?oVs=}=%*4pVB+Onc<mG+(ir?|A)~`NJY0<UfUueL~#;Mij(e|B}k&&B~
z!NAgx+klgeIh2J>m?<>akRK=y<ZubIIp!u-<>whn8i<1gn1ux(0t!L-`6UX@jtYhb
za^k#3Mg|r}#zsa)rp5+Q;=INNNL&LO0!GUiNI{Gih8Z2~s9<DZVxiz`U}Vt5sD$iR
zMpg#qCPsb+pg0#(6C)$TZfA*OQ7bC%X};K+ueWch^Lf39%j|LHUV2lPxb_#XoHQXK
zGXLMIb#6rqDg$&k+?dnb{7&G@#ydw={(Q$|q_eYxTe`r;@9VGdDpnK0(CWjfIuqZs
z9q&p$uamJyuU=9zoYVRdpL$fVPrPN+*FM+#Jc9DfqVj#_M{<4zU7VDvHQ{@E>+z|-
z{i4=>=1BUqV3y{!$~D)P{Mw%$XyI3(nI(EpBVJwc|CgAzy>jtEy%A+X%E2l3BWE-z
zZCCsF<#mOf_HB3OwKpp*xSGmS+n;v)w*KAS$6hrhvWM3-nN9L*^#8A(Oiz3M{8zPl
z`a?Oxe?v&IMfEo$?kt@(Ut8WW)s+@AF*7nSE^cCs0)|MKfe<hxWrZ0T|FduyumLG1
zMg{{ukQhHmj0Kn++6-htd{q`P0}(b3Z8k<$R(57aIEx7)&Br3fB67em=xkKL;ij6B
z!gHrz&iPsOy6KUDJV>`Pi-dt#gGh_SnO2iGdw8Zy(c_4mb9|G49~Xx~HOwqVMwWbo
zTmyX=-+-}AIisYcz)D{~Ke@O-uLziek`oQ}62U2~q^PvGL@zl%*T4#{fvHUosv)_k
z1ebb!m^sO*MF#dD*U7V37?>HDEHGMNfMh@pVFQYC41_@jD6sGta2as0v86ZiFfuVB
zr$1m`0j57j23<eB*3Ayab^41A<vm_+-{dWL{MW;$Z?<i?b3`aMI`E@t<(=PwulE0H
zxRo{CJR@x#tL6sg?&!a4FaNmqGe3`>S1SH^<MtJ0I`>%Q)#K7P@z)+%zSY6cPUGzH
z@~e%Zbu5W{O*WeCx;*7p*hEj0*#$m!|8<({P2~ivcDQLw@XPx4M(2N-iq?`OVcW|a
zmo8IVB$y^F-N63x&AX$)j2`)0IX2BwNLAWs)7rUQqJMG89oChzbE5++4+louWpT1Q
zZwfLyxn|X++R1T^pG=gF$e((-VM?gN#++u4J8#5V*PJ~1c<sI{lX-0%UvG5GHGSgy
W*s@NjIV$p2dQ^G7*94YHYx@C_n1{9i

diff --git a/rustls-platform-verifier/src/tests/verification_real_world/1password_com_valid_3.crt b/rustls-platform-verifier/src/tests/verification_real_world/1password_com_valid_3.crt
deleted file mode 100644
index 86b7dcd0b416fcbfd1636f5c019403ede4ddb413..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 837
zcmXqLVs<oWV$xi|%*4pVB+QmG|NPATJzSQLK2&r$KbvM2eae8BjZ>@5qwPB{BO^B}
zgMp<Xw*e;`b0`a&FjHu-AwN(a$l(%ZbIeVw%Fi>DG!O>~FbfMn1Qdeu^Gg(*9Tf}>
z<ivRmO$|(q%nZOFN}Si&!obkb9LlA{=q5%bWQQ`cGB7tW@-rATF>*0AF)}i2s%R)Y
zRdMxk;d=LmfRft08`nF^zRb+{9-)}<v!sPle+`pv+vNq$Reqb6Trk_kxUcuN#|d_E
zGoLT-I+Tywy*B^4Rq}^t#)f;>ca~YmCeB;(ugPrbQ?IZmt`C3y-6Hm@<kp<ork47@
zHYfzJ<y2j0*tG2D`Zw;9{Q(y2cNVo<M*P@yb>&Zwbc1Q{rc}h`cP<V*V9=Jf&^2vW
z$m_+2C;s%f^Z()t1KnEPk^<A~9V*}F9f{1_UED7I$;eG(hx4!Pva3#Q`7~dJPuKf<
zVN6`+|5sC)PFr-X3$Vz){aZIl`si`FkcZ_D(ogWuX;;2x@1Rhx&~T)|$Ie<st&e40
z&a4xwc$t_P85kEk88{g517k;4n33^63#$P$kTT!{3GjmiSb&M3%|I5!=VK9L5owV)
z(`xc&56_e-dK{5+j&Bn1<KjRLWngjuhB70=j8EoKjuRG29W4vgP%u;GTlY+3_o^RL
z)_E*3sF(hu((AqD#KP&{wtcKBI1xPg42Q<!8LH=%m;Ah^c)6yPbFJU3QmaGUS)CPS
zF76VkIlYd3*7dVaf7!Y`;5w_0`3q+6wJ#GFFy(#y^x^2Hx6#}0{F)L|K2LaQebCye
zpMFfXzSkWSeJUy_I$^!YcklO$f6sTAnrj&H$LaEMH+ki?H~BpZX5B2UD7;wYY*LyR
z9(jl<MlC_}yt1TNUx)M3D^E^y{8kope&MWHl(cYVY#hgx3F~&;I45%GLg=TqZ$~CO
rm!~Bj*!jZo`t*tf<~*;WbxSYS?h=^SmLuJ@Gt&6S>mw8PecTBE+ObT9

diff --git a/rustls-platform-verifier/src/tests/verification_real_world/aws_amazon_com_valid_1.crt b/rustls-platform-verifier/src/tests/verification_real_world/aws_amazon_com_valid_1.crt
new file mode 100644
index 0000000000000000000000000000000000000000..3ca3b8c2a3d3b59665aa14d87b1544118ecfe2ab
GIT binary patch
literal 1632
zcmXqLVv8|oVs%--%*4pVB*16k`lI9I-bnxKrHmS@I!z6D**LY@JlekVGBR?rG8otx
zavN~6F^96S2{VNT8}b9?fgCPjHpkq=s{A}d83QSh0JE?#L_i@Z*ipgAz{Enq*TB#~
zPMp`s)WF=p$N&tYfLt>JGb0NlV^d30%P0d$LvaI9h<?7r@?yP2u%UX%`MCy7j7rFE
zVPs`sZerwT0E%-lH8C<W97$5`_vu#AxY6A8H;IFVmzB#SYVtd82^qmp6=yOcZs{sK
zJ}<AeYpJNcfA4~W=Dy`+LTt-FJZjqb?DcMrC3EICw=#1aannni$39K4Uo>*#)ivQx
zrFp0R+;lqe$fcIUY?l@L%Wb-AR@EgvV6ENyAn8J}%-Z@Zs+VVMz8SOcejWGyxeD`o
z{N9RciY$`bSb4GI(g*Lv^U~$dIX3>*>sZ%Q)UU>!ZPLH1Ni(IQ>XW1PqCIboN;LkQ
zsu8@Z|KgymH@k-3+6i4xOl@Mn-HiCS-EMKr>KxwL%YW|nUiqj_ZLYTw5A*E&oE=JO
z`x)jvKX0vISbLV=^5YTpn1}mS7;|(MF*7kUGB7S~Vy-r5VlFq32L__7GK++PSc6F8
z4!-2BP9ce>zpSkTrp|x%bb@fJfh<S?ABz}^h;M^l_6yN~`fE3JW}bWa*RHQ*PP#$k
zDv-P&OXDJg#`#TXanU4HUS6(;8b3`EK)!Biv2JQ&afz-WQp~|+%2R<dM#wV4koX1Z
zOwP#6O9Vx9lQ`ILaKxiY08Is|%t<POngQg2lZG(JtqLqW23!UlY;5U`Jd8|?27Dkv
zen!UsEG*1StP3C>R%H=05MkrcW@BV!WoKrDvzQF5LCWP>Oh8F<f!+e0Hm!`3k^(Dz
z{p6w?y&|Jr1DKaeib{)1K-TI*M1k@Kr7(jS8Cfz7(hYQBd;`WdMW{LX$;AcO4Kgr;
zD`!HowgkIsn6;@z20S1)3xmAKWB|$t4QyOMpRq7rt7KwfVrgP50OB0REQT@$zVIn~
zKCfG8XDqEVlYR5|3HN6ovMn@Hy{ouVbxq<?KSc%x#_6XvHCr$+urM>Y8@MtlRDXYX
z`&P@F1=>O-EQu!j`?JgsTRkh_G8I~}<GIDG<-eE|8BR~yz!f0F^?0LXJ<G&kyE?0x
zNxK|kBEwEuoS&@}@7K;y&X6K_Bxi}xo8_G{i<tBn_N?~TV80?~s=oTwzpKnAYtMdw
z+FJs)*TcXKXzIefnRiQjAL$?MQVJ|)@=tlNgiBZ7opEX&-}bJloUyNfO7?ct7<MN$
zDDV7yp{G^nZE<GeGQDW2R<;Y_U#_Zpe>?%S*mKV8%zLsmZ~mCwJKLVJY)ABZuJ#7W
zi=jckU%uA7`{OXw;w~hM_c5IN@rLiFtop^aEuUWPn{_3l?#6|U*`8D9W&SYY;ui#3
ze2ZN)uj^}A!SWEMh7Q+&<@?&s|8Sh3C%F5;78f54Ef3@Z3RqYI3n)g0vR|skXHT=|
z#(e#)ls^6UkGJ~`|IMhL8ltT*nR{l&`ij}Ik4xKq=1K>yu=bTX`m!>}Wolln=knZd
z#&eflSy63!Mxl0=n&Jg<tF34E%&V4XzVcH0#5AR;Gd$Km(LGzzy?O1d2t96tZ4Jka
zzFqy{B@r<zQsB*t%ll@{EDe~Zla&8cspzHJtx1vRv+WWcEFNtv)o8f&f9mE11vf-J
zZ?5>=b${>vj2zF&79IJ!W1W{3ha4<8WNcS(eZnqf#)r1t>)$Buy)<=WgyZ!$x2j)x
zdHt1&2!7t|qHAMpD4QWtXLv(6s4FANmhr*HS07iigchjYZd7eub#(t%FEuM(*2%m2
HHD?0=!pB>#

literal 0
HcmV?d00001

diff --git a/rustls-platform-verifier/src/tests/verification_real_world/aws_amazon_com_valid_2.crt b/rustls-platform-verifier/src/tests/verification_real_world/aws_amazon_com_valid_2.crt
new file mode 100644
index 0000000000000000000000000000000000000000..f1e3552db0fb52791734986d9039fc0ea016e5f5
GIT binary patch
literal 1122
zcmXqLVu>?oVs=}=%*4pVB+OncWWhZ*tz)sZ+|B)S&MxcY<2T@C<J4;NX#38~$jHsg
zU|?y;ZNSOK9LmBb%oG}I2$BbKxP;jpa}%rb^9&^o#6beg!U7Nhg`oWW5(Q^R1w#Wl
zab6=M0}CT#BO@b2Ba0|;USk6!u7M2!qh$=FAVv$rj1G2GFfuT)Q1CS{G-zT}LUt=7
zD+6;ABR>OBoQtW6k&)qbq0Y+F@*NtJj11Oyh4WWzH&>k++P)?|X8L8N6So$Lq-WQB
zNWb-nS!;8cQ0%d-?myExmQSvlI!S_m%g>(zX0z(`8@BoH681YD8!Y$W?lfa|h0D|S
z2t6qYa9YSJT)fqPwu{O?-TJqClv>}IDH=~NWjm)X(RAnW&7)21y>V)cYHI27H|>Sb
z8|}(oTaof-)qg%F8}|EiSSyNp{=O>R&aBaL>qQ=W&xL^2_l+T&3iICNCcW>Uayahg
zktG)<9?(;nIOEj2U8;Roz7=l!9i45#=3(yM+ji&EE4JTd=C$+wJNfxWG)+GLsPIt5
z#;Voc(NoMj8lT);ud?n((b3f3-dh5nGchwVFfMLli~@#8n1K*5BxQve8UM3z7_b2;
zCPoGWK9CqcNQ?!T9NG+IL3~vfF#{1c4sA9@R#tXqMmUQJBF)Dl#v;<VgD<(OQ%K_J
zFKg?7sq>#bogmz5AP>^5%pzeR)*#X%ai-Pe%^sd9Q}j3@=N#W8;K#*bPz^JSk&z|e
zAlE=2#y4PWQ_d(UDX`Ml&rdEc&?^F_pyWhDy+m*dD=8{1F40TQ&o!`uYhY^AgK9`F
zD#4{*A7)N+YLS6G$aV5876xVpCJT%f7$6ytL)d_#90OsH0SYWU23!UlY;5U`Jd8|?
z$mtK5SAgk{kzp;vJtkIVJvO7HE!i8Vh&>T>xTpOq@}TMa2dnzE9d};*+-}Jr`^k3e
za(5m!wqp}NvxhTXdAnEq;DlNGJxUj``y1T#%5vJuYb$zy|6fb=F`JoZ!h<&6$P>Cc
zZPH}#DNos7bT)BhRhe9wm-5iIJ!{g0S;-5%fAnvAWpbHypTePgY>#^87kAJ1wQN0g
zPSR{{>&ba1e+1ZXtLs?!{!|NFcfb~|m}N39AOD_6bV&G=sJe>%%ke|SrB8UcoqAcG
z#=CgTjIQo%oVL7Ut~YPe3zj3-|804(DfiTy12TIoqGj*5o{O$}?CG7ebNSsbteZU7
ZK0GRtedx^Vv-Q^^GIt$TsH@+w0|4|}kFfv%

literal 0
HcmV?d00001

diff --git a/rustls-platform-verifier/src/tests/verification_real_world/aws_amazon_com_valid_3.crt b/rustls-platform-verifier/src/tests/verification_real_world/aws_amazon_com_valid_3.crt
new file mode 100644
index 0000000000000000000000000000000000000000..1dfb0e70faadbce1e2af09df6a528e061e25c471
GIT binary patch
literal 1174
zcmXqLVwq&n#9Xz2nTe5!NtmsEikFu9+0VZYt<z@w$?<OIkz)qDY@Awc9&O)w85y}*
z84Ma{7;+nMvN4CUun9AT1{(?(@PRlS!t9PknN|6DiH5=kf*=ugVXolh{F0L5l*F7=
zLsbK1kRX?^OmInJQCendPKrWEYH~(ieolURW@@pHf@fZ`o}smYB}f^wun|I8aB5Lm
zW^!t=LQsBwiGp)#QAuW6W^!Uls)A!_Nk)EAW=W-ju7bOfft)z6p{aqXk*T4P0T4uq
z^BS8Q8W|fJ7=pP5mZ&c02YL<cBsRy~M4-zJB@M(OmJ2`xpcXnR7#cJ&Dj^31BP#=Q
z6C*zZP@IdYiII_EQ$<7Jsfw$Q3)j0h1eDa~-MHRS_GM<q_Xx#=pCv7f`fHeU+b%C~
zuJYTo<bv5Q#(llFJx;KToB4cs*P(pe?zQ>Xt&%@HGdA42zO&3iHgVpPe@$jfpL&Ho
zaeesn?-sFNCAa3xHnr6MwLu|(EvM>2!=`0F*S~R>><_SDzq6>_GUCUst1Ewcq#I0o
zH>DyjzjJZm0fV-*g|2D4LS8REJn^T;o&OhK80gmOmK2y??@;+Z??`0c?&5awPeyJU
zJDh)QmtA#g%cuD&e7fG>3uEFk|G%2bblRe8U4TXY?ccgd(npWWg*+^OkbZ)HPP_6o
zdk2Mjg@z*yK6chBYJDv0a%P=a#mmIZ$iTR`i4hc1x(58fV3ZYRWc<&<YQPMnz)3`w
zA0)s6OlWNevLFR~EMhDoEfQy1P2TL`nKDI>BXZ91O#*&g90u|rX=N4(1F;5?Iq?kl
zS212U(6;DUv?JGR&L_c%%?1^09NKJ*tgP&ej4U|@Sq6GAz5!#KQbtKhft9{~esXbv
zUJ)?Kq#Nlaf+M)3sI<65FF8NgzyhwGsZ9r}KDnp_hjM+WDaolt2DTul$+MUlm>3u>
zFj%06q&<g__M#kc&X84L;WFSbU}Iwml~rIsPFBGD1x!|q3`yorF?$5I+I8!^<e8o0
z`iPyO>gUl2?wuSxc5gSU+HB1acyiV>Yx!i8X-0}GJzQ4Ld2736RdMc<da;JiobwvY
z63y<Fiv{WoqSsh&NO(|wg=5)6*_yZmyMNBAR+_t<fwOLnn|Sk`IcniE4J?zU^}oG!
zZ`IK=(srkuGjhVk_FUyt(EIoQP*$wo0<T<=i1sPZEDhspice4I$Z8RsroQa$%|^Fn
zb&HD_xPt7OJJ^%UJ2S=kEn6?G=5Y1B5NP!`Hr71Fr_NwgsEX5EvkkFx#2XVop86@k
xq_X-oZ^^{oYFEtw%Z^RUI!#sOM6%qK4fSJY{aQPVFDY<|*2*J4P39^}007}dpzHtu

literal 0
HcmV?d00001

diff --git a/rustls-platform-verifier/src/tests/verification_real_world/1password_com_valid_4.crt b/rustls-platform-verifier/src/tests/verification_real_world/aws_amazon_com_valid_4.crt
similarity index 100%
rename from rustls-platform-verifier/src/tests/verification_real_world/1password_com_valid_4.crt
rename to rustls-platform-verifier/src/tests/verification_real_world/aws_amazon_com_valid_4.crt
diff --git a/rustls-platform-verifier/src/tests/verification_real_world/mod.rs b/rustls-platform-verifier/src/tests/verification_real_world/mod.rs
index 128c3255..6cec9763 100644
--- a/rustls-platform-verifier/src/tests/verification_real_world/mod.rs
+++ b/rustls-platform-verifier/src/tests/verification_real_world/mod.rs
@@ -46,29 +46,49 @@ use crate::tests::{assert_cert_error_eq, test_provider, verification_time};
 use crate::Verifier;
 
 // This is the certificate chain presented by one server for
-// my.1password.com when this test was updated 2023-08-01. It is
-// valid for *.1password.com and 1password.com from
-// "Jun 24 00:00:00 2023 GMT" through "Jul 22 23:59:59 2024 GMT".
+// `aws.amazon.com` when this test was updated 2025-08-13.
 //
 // Use this to template view the certificate using OpenSSL:
 // ```sh
-// openssl x509 -inform der -text -in 1password_com_valid_1.crt | less
+// openssl x509 -inform der -text -in aws_amazon_com_valid_1.crt | less
 // ```
 //
-// You can update the cert file with `update_valid_ee_certs.rs`
-const VALID_1PASSWORD_COM_CHAIN: &[&[u8]] = &[
-    include_bytes!("1password_com_valid_1.crt"),
-    include_bytes!("1password_com_valid_2.crt"),
-    include_bytes!("1password_com_valid_3.crt"),
+// You can update these cert files with `examples/update-certs.rs`
+const VALID_AWS_AMAZON_COM_CHAIN: &[&[u8]] = &[
+    include_bytes!("aws_amazon_com_valid_1.crt"),
+    include_bytes!("aws_amazon_com_valid_2.crt"),
+    include_bytes!("aws_amazon_com_valid_3.crt"),
     // XXX: This certificate is included for testing in environments that might need
     // a cross-signed root certificate instead of the just the server-provided one.
-    include_bytes!("1password_com_valid_4.crt"),
+    include_bytes!("aws_amazon_com_valid_4.crt"),
 ];
 
-const MY_1PASSWORD_COM: &str = "my.1password.com";
+/// Returns a list of names valid for [VALID_AWS_AMAZON_COM_CHAIN], in a format
+/// expected by `CertificateError::NotValidForContext`.
+#[cfg(not(any(target_vendor = "apple", windows)))]
+fn valid_aws_chain_names() -> Vec<String> {
+    const VALID_AWS_NAMES: &[&str] = &[
+        "aws.amazon.com",
+        "www.aws.amazon.com",
+        "aws-us-east-1.amazon.com",
+        "aws-us-west-2.amazon.com",
+        "amazonaws-china.com",
+        "www.amazonaws-china.com",
+        "1.aws-lbr.amazonaws.com",
+    ];
+
+    VALID_AWS_NAMES
+        .iter()
+        .copied()
+        .map(|name| format!("DnsName(\"{name}\")"))
+        .collect()
+}
 
-// A domain name for which `VALID_AWS_AMAZON_COM_CHAIN` isn't valid.
+const AWS_AMAZON_COM: &str = "aws.amazon.com";
+
+// Domain names for which `VALID_AWS_AMAZON_COM_CHAIN` isn't valid.
 const VALID_UNRELATED_DOMAIN: &str = "my.1password.com";
+const VALID_UNRELATED_SUBDOMAIN: &str = "www.amazon.com";
 
 const LETSENCRYPT_ORG: &str = "letsencrypt.org";
 
@@ -167,28 +187,28 @@ fn real_world_test<E: std::error::Error>(test_case: &TestCase<E>) {
 // Prefer to staple the OCSP response for the end-entity certificate for
 // performance and repeatability.
 real_world_test_cases! {
-    // The certificate is valid for *.1password.com.
-    my_1password_com_valid => TestCase {
-        reference_id: MY_1PASSWORD_COM,
-        chain: VALID_1PASSWORD_COM_CHAIN,
+    // The certificate is valid for *.aws.amazon.com.
+    aws_amazon_com_valid => TestCase {
+        reference_id: AWS_AMAZON_COM,
+        chain: VALID_AWS_AMAZON_COM_CHAIN,
         stapled_ocsp: None,
         verification_time: verification_time(),
         expected_result: Ok(()),
         other_error: no_error!(),
     },
     // Same as above but without stapled OCSP.
-    my_1password_com_valid_no_stapled => TestCase {
-        reference_id: MY_1PASSWORD_COM,
-        chain: VALID_1PASSWORD_COM_CHAIN,
+    aws_amazon_com_valid_no_stapled => TestCase {
+        reference_id: AWS_AMAZON_COM,
+        chain: VALID_AWS_AMAZON_COM_CHAIN,
         stapled_ocsp: None,
         verification_time: verification_time(),
         expected_result: Ok(()),
         other_error: no_error!(),
     },
-    // Valid also for 1password.com (no subdomain).
-    _1password_com_valid => TestCase {
-        reference_id: "1password.com",
-        chain: VALID_1PASSWORD_COM_CHAIN,
+    // Valid also for www.amazon.amazon.com (extra subdomain).
+    _aws_amazon_com_valid => TestCase {
+        reference_id: "www.aws.amazon.com",
+        chain: VALID_AWS_AMAZON_COM_CHAIN,
         stapled_ocsp: None,
         verification_time: verification_time(),
         expected_result: Ok(()),
@@ -196,14 +216,14 @@ real_world_test_cases! {
     },
     // The certificate isn't valid for an unrelated subdomain.
     unrelated_domain_invalid => TestCase {
-        reference_id: VALID_UNRELATED_DOMAIN,
-        chain: VALID_1PASSWORD_COM_CHAIN,
+        reference_id: VALID_UNRELATED_SUBDOMAIN,
+        chain: VALID_AWS_AMAZON_COM_CHAIN,
         stapled_ocsp: None,
         verification_time: verification_time(),
         #[cfg(not(any(target_vendor = "apple", windows)))]
         expected_result: Err(TlsError::InvalidCertificate(CertificateError::NotValidForNameContext {
-            expected: ServerName::DnsName(DnsName::try_from("agilebits.com").unwrap()),
-            presented: vec!["DnsName(\"*.1password.com\")".to_owned(), "DnsName(\"1password.com\")".to_owned()],
+            expected: ServerName::DnsName(DnsName::try_from(VALID_UNRELATED_SUBDOMAIN).unwrap()),
+            presented: valid_aws_chain_names(),
         })),
         #[cfg(any(target_vendor = "apple", windows))]
         expected_result: Err(TlsError::InvalidCertificate(CertificateError::NotValidForName)),
@@ -212,14 +232,14 @@ real_world_test_cases! {
     // The certificate chain for the unrelated domain is not valid for
     // my.1password.com.
     unrelated_chain_not_valid_for_my_1password_com => TestCase {
-        reference_id: MY_1PASSWORD_COM,
-        chain: VALID_UNRELATED_CHAIN,
+        reference_id: VALID_UNRELATED_DOMAIN,
+        chain: VALID_AWS_AMAZON_COM_CHAIN,
         stapled_ocsp: None,
         verification_time: verification_time(),
         #[cfg(not(any(target_vendor = "apple", windows)))]
         expected_result: Err(TlsError::InvalidCertificate(CertificateError::NotValidForNameContext {
-            expected: ServerName::DnsName(DnsName::try_from("my.1password.com").unwrap()),
-            presented: vec!["DnsName(\"agilebits.com\")".to_owned(), "DnsName(\"www.agilebits.com\")".to_owned()],
+            expected: ServerName::DnsName(DnsName::try_from(VALID_UNRELATED_DOMAIN).unwrap()),
+            presented: valid_aws_chain_names(),
         })),
         #[cfg(any(target_vendor = "apple", windows))]
         expected_result: Err(TlsError::InvalidCertificate(CertificateError::NotValidForName)),

From ca5fb1b73927d6f365057afba2c54f3654126071 Mon Sep 17 00:00:00 2001
From: ComplexSpaces <complexspacescode@gmail.com>
Date: Wed, 13 Aug 2025 14:30:41 -0500
Subject: [PATCH 3/7] Update remaining real-world test certificates

---
 .../letsencrypt_org_valid_1.crt               | Bin 1031 -> 994 bytes
 .../letsencrypt_org_valid_2.crt               | Bin 1115 -> 1115 bytes
 2 files changed, 0 insertions(+), 0 deletions(-)

diff --git a/rustls-platform-verifier/src/tests/verification_real_world/letsencrypt_org_valid_1.crt b/rustls-platform-verifier/src/tests/verification_real_world/letsencrypt_org_valid_1.crt
index 83045d86c0897d848dea00786a20912686268ff9..e3991a7c5044f75d00ac6b1f206b9c70606603a7 100644
GIT binary patch
delta 663
zcmV;I0%-k*2;v7JFoFZ#FoFYQpaTK{0s;~SEH9Ktmric$(PQyj!B0sjhmj#aAT}@_
z7Y#BsFgP$YF)=bUFf>{h4Kg(`F)%VQF)}nTGm(HeNO-ge-Vxqr!Y|1+PHT0b+_iVQ
zUL8LQcia|hkEH9{cKxxJb1|id>u7lB^H4C|AM^8M7}ThG10wo%hTKVK-lKv7a4>=b
zY?1*;MZAgnxq~Vk{Nr9<-=nI!+8c~<tuP-3163U(1Q;+DfE1G_MwkPsQD}~s*2F?c
z+ateNl+rLV1_&z#0R;sI0RaRiFeH<(0Tux^lg9y+e=G(ARUID$B`_l}A)p_i9flid
zbaZe!FE3>_E@LiiWo~0~E^l&YFE}n^a%?by0RsjKD+U1s0oHi}1Ofzs^aO$N0Pg^G
z0PQ?W*60Spq@n;<+sh>4I04^LFYUyJ#c&TG-M2nJ-~a#tm~{x5SO5S70{})aL;@gF
zj@t<1e=ofA{4DJX)I7zqVu+8Nn7JdhfPqZI*y8X00w5~s&5#_8>*cRy8@G;qtXhIY
ztG>42sSLOWPfym8G8q7N0NvcmG?mxk76s>(GWy4#_&pp@-`fB>6cTm{EUdf8DgXch
zm~{x5d;kCh0{}-bMFJrJt3W3lJI3i@L0mxBe|!P{U)s1tz`CT6R1xsG1eD5)<N_cS
zjUw43m!B|1>PLS^HtTyJ>KrHy=#1lhEu~iW7|Ulc3I+%&hDgpm1Oo#DXaF!}0x<x^
z<`^fIKYPjDkmp$c^99>Sg9<m*r&wY?9JF`DFHuQ$*b5?8nPb2feP#-=uzj8aFb9g`
xEd!G<Sw#E-5ud+hj(6nw8Gj+vw;%LDko`j_cyz8PTSwH@{PezD^DQybd+C^P37P-^

delta 717
zcmaFF-p-+D(8R)Q(8S!efSHMriAjj{g4-fHCKK16_6f^F-lklW44SBDuV88*C(dhR
zYG7huW@v0+Y-$k&=9(Lrg1P1s8!S9FEb<ZKmRC@`$kV=u=k=6hs-bGEJ9W4pf3&=-
zy7$Q}?ZU~P_nahVN9`9jFwa!_`tkT`ai{#B<$6byF6VNb6577FiD{Za6Vs$gj2`t9
zPBU%Vtd#gaLCD1{ep_tO64q;b4dmIFLuHj&Bn-qFMCNP9pSMx;pUblSt+vjQV+Gxp
zuJam%vT<m$F|x9<GcvMx8n_!M!uSS^ZK4?^B?VUc`l+UR`Fc62dC5h3`9<jlN^m7i
zZDMdGlb0|~sn-QrC(oj0pkko3Kw*Jgn+#lDFBxHkzJ;+~a#4;!6C*1d7tneZ#%q;K
zEKDqo-&h(yGkjzyXIS)@>xt|8y=!OJS-f>mFAu)n6x}lAx^|qj&XJt~OWdC`FfdNz
z&iKg2z`(-H;9=m#q{y&E_+9;kMSjcmycq6iyzcl_*B;(7HM#4YOl5<s2+!`#l0Y^4
zgZ7>%dQlamlk|*TsEd1ZYeV;Wr#EkJd4F$T^8QkpJVO~nZKRyg!wRixnZ)#(xW7Lx
zw8w}n@S8esC$s)dz8<~G9T1y8Ed<-_Zr}<u_4($tT?<auFWg@LFy=vKRFBUJr3*ie
z7+wT!a$0mk%uY|4Nx^N0-nR&jZ;BeW{tVpp9`;fU5xX*NJ<b~13Ukd$d-m6Wi;Y98
z&EuRc3o|owI)gz9lYt&fLiY4eMRtqcX3h2Bv9*tj2{O0Jn6jrirdLW+F~ZKJcE|lw
zPbPFTSue}y`6}kkWFVvexxM_|oziW=278b2PusR+v&^sE@9qkTh@3c}l>6INOwLuW
S>Qe5?vOS8cpGbO~X#xN`UITpq

diff --git a/rustls-platform-verifier/src/tests/verification_real_world/letsencrypt_org_valid_2.crt b/rustls-platform-verifier/src/tests/verification_real_world/letsencrypt_org_valid_2.crt
index bbfc07a596e2953d85c84819c81b9d7b0ada6b27..67d933a8327620d3db96399972e27b6dfe20c8e6 100644
GIT binary patch
delta 714
zcmV;*0yX{H2-^rCFoFbEFoFU<paTK{0s;{Luvb2jbC)M@+q8$vIz=luksz~wHZXQD
z5C#V-hDgpm0s#gED}e+6A_HOo1ljSPMu+$zabTz>>!bR)>e?N-5~tKA*-;d+VSII#
zzak4cAJx9m3P!3eJW2_KF1|pORp}W(H)eJ1GER2{N%(Mk!x-nz_i+&ZtaR7_)a`8?
za~3lYoI0}VY-04ixTAsiFoE@xQUOjBlP5-)1F2DHj+oZOLP*;qzgU#gle7V+e|?L4
zN+30|1%?QUZk|p$uYd%^gj_Qj3V}#Xmb&lM9kqn!mpA@qh);_-HtTX_KQr8~3!@cd
zz4RE-XfMJcC&>K1vx}t0HrV6(ZKSo6)(o!D)0YBApl0&ZgyBs`feuR&^%$-m_?%{-
zUUdgZ7p`e$=xKO21_i?6VXF|YfAJ3H3~{u)lbQ<$Naa!m!A_sqV861&2>QK?xt||-
zsm2P?DJ(~%>KV|b%y1u}9_!_jQRlYz2-0H=LrI}xKB~0AQno>LMv#WwgWV$vRS62N
z@MU|m%bSvPbF=Nj{28_N5l*5b=?+XU$k*?g4R~Hms;Hv5p`SB^J@$}Pe^8Sayt$OF
zhlZ0PVR4dsxAz8t#DrH9h|0!LCPB^+j8<r?Ql>(rAkd%nBwrDfTght8RdO=#Vq4S)
zYkHoOx}gZc-d~S3{R5=|`-x0<TRuRI0HWx<xfVQx)2g}!pU{?TSax6hWrnEXBx*cM
zKk2|C7vvx3I5tv7mb5xyf0t6qGUUxJi*K=ieH{M1S7+KcC!nF!G%qB;roZn`O;|im
zI=tHhE&{&c!un3U!u_rma$$K%5`Evy>%aGIBy!h4i7w{-J`)47=h5ApL(}|9|MQ1K
wS3r`D)PLD~nKOAQ%EXE;0QGRFg9G9bg5!e=7tZy}m?923zuASD1RL@nPA!~M-T(jq

delta 714
zcmV;*0yX{H2-^rCFoFbEFoFU<paTK{0s;{LgO6-u&apX+Vg_P^70LbHksz~wH86HC
z5C#V-hDgpm0s#gED}e+6A_HOo1Pu#1ifdtxw(s0uSm(w<MO3R}_GV#73NBf7w1EOQ
zP`5u8dEA)np(vMfARH{u)qGMQPE>eXgcNJQkgkR7z)?XwT8DoIP1OEi(fVvH;eC}5
zh@uEo51ATF=IRQp*rS2?FoE@xQUOjBpDSO_JRwh=1h?%gEX2lei_+H(le7V+e;;z4
zG(|!|+N993vbfSFOs7#LjY8V&Hb|DEx*DX&W7zO7v(C$(XX&7x8S2yxid6%W%0q;m
zM)B3my5G9N0w{6!y8dm<8)VL`Ofni0xRLzw<mj@j^cS?cg>iu5gL09*vherZpN90e
zAHPz)mf+?|I0or+MIhd9e2!qVfB8&5DkBibNX)NWmC1JhTgt@m78oZZzQi@0pU=YI
z3qg=yI9!!n|1N9_e`@XBbAbw2Z%jL!+{apz_v2SYXH{Dfub2^00jS)F$Ja1TS-5GW
z-|>!;fDG-KBW7t{%83uuv9p=-Tv6X_?dPu7|9^T8SCw~v=aH>qFbw!Ee*+tsyLqE(
za&3kCELb4>dU3YxVN*#6XUAHh#6y8tO4TwJd;GFIs#DCVftHOY)|GK&hzPTY6JOB3
z{^%;n*$HBO+pHAn8iv&74;bjR&fo!rygJp(k5n}F@^ljY?z8uo30|!pD^Of$o}VR~
zCT=uf51MzH@gL^*P&2ave-iaHw07*rVmX*`$)Es7Z^D%Z1*!g57a3@lY2&g7v`_fw
z!?yUgI>xERc$Mz+RkOFumb7DISm-ILrkf`x2JkA^fCO&bi?LVEORj<Os$_Uo_BD<d
wJVq7al!AN3M?SY}5g9hXg2vrH#2RFXkR}yS#HWs8T~z@67o%GL1nlNqC+yo?<NyEw


From e696d44355b26ed06df6ce538ad4599dabecfffb Mon Sep 17 00:00:00 2001
From: ComplexSpaces <complexspacescode@gmail.com>
Date: Wed, 13 Aug 2025 14:33:14 -0500
Subject: [PATCH 4/7] Update mock test suite due to expiry

---
 rustls-platform-verifier/src/tests/mod.rs       |   4 ++--
 .../verification_mock/root1-int1-ee_1-good.crt  | Bin 413 -> 413 bytes
 .../verification_mock/root1-int1-ee_1-good.ocsp | Bin 299 -> 299 bytes
 .../root1-int1-ee_1-revoked.crt                 | Bin 412 -> 413 bytes
 .../root1-int1-ee_1-revoked.ocsp                | Bin 317 -> 317 bytes
 .../root1-int1-ee_1-wrong_eku.crt               | Bin 413 -> 413 bytes
 .../root1-int1-ee_127.0.0.1-good.crt            | Bin 401 -> 401 bytes
 .../root1-int1-ee_127.0.0.1-good.ocsp           | Bin 299 -> 298 bytes
 .../root1-int1-ee_127.0.0.1-revoked.crt         | Bin 401 -> 401 bytes
 .../root1-int1-ee_127.0.0.1-revoked.ocsp        | Bin 316 -> 317 bytes
 .../root1-int1-ee_127.0.0.1-wrong_eku.crt       | Bin 401 -> 400 bytes
 .../root1-int1-ee_example.com-good.crt          | Bin 409 -> 408 bytes
 .../root1-int1-ee_example.com-good.ocsp         | Bin 299 -> 299 bytes
 .../root1-int1-ee_example.com-revoked.crt       | Bin 408 -> 407 bytes
 .../root1-int1-ee_example.com-revoked.ocsp      | Bin 316 -> 316 bytes
 .../root1-int1-ee_example.com-wrong_eku.crt     | Bin 408 -> 408 bytes
 .../src/tests/verification_mock/root1-int1.crt  | Bin 440 -> 440 bytes
 .../src/tests/verification_mock/root1.crt       | Bin 402 -> 402 bytes
 18 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/rustls-platform-verifier/src/tests/mod.rs b/rustls-platform-verifier/src/tests/mod.rs
index 11a1426b..b2cf3c49 100644
--- a/rustls-platform-verifier/src/tests/mod.rs
+++ b/rustls-platform-verifier/src/tests/mod.rs
@@ -62,8 +62,8 @@ pub fn assert_cert_error_eq<E: StdError + PartialEq + 'static>(
 /// we know the test certificates are valid. This must be updated if the mock certificates
 /// are regenerated.
 pub(crate) fn verification_time() -> pki_types::UnixTime {
-    // Wed, 13 August 2025 18:30:53 UTC
-    pki_types::UnixTime::since_unix_epoch(Duration::from_secs(1_755_109_853))
+    // Wed, 13 August 2025 19:31:53 UTC
+    pki_types::UnixTime::since_unix_epoch(Duration::from_secs(1_755_113_506))
 }
 
 fn test_provider() -> Arc<CryptoProvider> {
diff --git a/rustls-platform-verifier/src/tests/verification_mock/root1-int1-ee_1-good.crt b/rustls-platform-verifier/src/tests/verification_mock/root1-int1-ee_1-good.crt
index 6beaeed92f33a27ca9b0e252a8dfa46d34dfc3d6..0968a956569cc4b3210e316b61f00faac30cd687 100644
GIT binary patch
delta 259
zcmV+e0sQ`*1DykqI2biBI59FYIWsXZFj^N4GB+?dF*7kaGcl1+9bj(S@qp*|QR44Y
z%720OUjW01OAqZcO;St7S50@P(s=5Ca8W?5@Y%+f)$>JlU!+nR9Bhe<Oe7{{(r0@H
zLw>_U3aU5Li5b7zF<CvY=DoJ&5%K|Wm&9mhJy-7}OEQtoCKP_25$=Kj=INf5eyco$
z^Tk=6qk@wM0W)JtxJ~ROgFgUzn9^&-J;pLqd&F_`+?DG~^WijfuwS!g1j6lx{TG~&
z;)*DptasP~F#x+O1~9#H2-rjI%H%>L8K$AwD+b{g+g!-{7b^zfg%NY1ds(qS3Z|m_
J0R%54H+I1#b?X2C

delta 259
zcmV+e0sQ`*1DykqI2bfAI50FZIW#sfFj^N4GBz+cFf}nbG&Ye?9bh^>weax6BL%;V
zyFryM@8QAMlI}}>$l^I@M8aHfzRjV1)0p=?-GWN`u8H7D7?&Y`-1b+6<s6D2DIXjW
znB0c3yo4~>6R%Zg0_3;;=_b6-it!MK%Cnx6&|y1@VOo*RCKL}Q48~@Pc-!IM&+Zfu
zAIog}@l%rr0W)JR`}LLTTi}%1IPyclG(_Cl1mZO_hg{_Jgl;AMz53+uxgzYE_|<H<
zL+Hu}q2c2KF#zZ`M(K`qArj+ms43P&73a1DO{}E-x8Xn@9gL~5yizJtxteTi%TAXV
J#-dn)<U|v4fA0VQ

diff --git a/rustls-platform-verifier/src/tests/verification_mock/root1-int1-ee_1-good.ocsp b/rustls-platform-verifier/src/tests/verification_mock/root1-int1-ee_1-good.ocsp
index ac7c84204c208d668def7daecef47705386f212d..66e49a7e84864a5877ca34539018bd8c48d3e1c2 100644
GIT binary patch
delta 200
zcmZ3@w3=yxGpDJ6g`u&brLo~eAD#NTd4lhn7@obHH??lHP0Qz_k#iR}F)=bWFi7wl
z85n_-8iAA=7(^`)1PhrV2^ny)acH%9oU>(NW@gS{Fi2%GQ2G-5X5)@G#rw{tJh)tV
z?FHY1&@J=(*_QcK#+;7Q+pzZd+nl^R8atQhoVPJzXNxj9$z;gT;IlB!)~WtG>*Qr_
qIU;U<wk`d|yy@Z3)Kez@e^(ctU-QGmNoU2ugv_7@38o1frK14NG)`Rr

delta 200
zcmZ3@w3=yxGpC7xg@LJ|rHR=@ADw!BHJ)Q>T@|+<-ar3NL_q#@&hL-GOpJ^T3=;fC
z21X#ICLpB-22l$H!9u1;LIzxH99nH2=WJP+nVB;f3{sg489F}rX~<oATF_xzVfEqp
z=3?#{B~`yUkIzzKV3eF!?*8k=`c2iojBIC_mZZqAZ!}?@#bn@nRNu92@e7lDNv9_U
pnLV#w|GnL_BPMK5%Yg<L?VeklFP;4p+0-wtRz9!oYS1xfKLEU{Nb~>z

diff --git a/rustls-platform-verifier/src/tests/verification_mock/root1-int1-ee_1-revoked.crt b/rustls-platform-verifier/src/tests/verification_mock/root1-int1-ee_1-revoked.crt
index 4a2396176a3f13b7199ffcab65528af3fd15dbe6..b4f4012e2a97ca70286c0cda43e9f027b24911d8 100644
GIT binary patch
delta 271
zcmV+q0r38u1Dyi|FoFS@kpwgtH840aGBG(bF)%P%7Y#BuFgP(YF*!3akx(6Az?0WA
zik<#t61|3ZyH#$tLpG0}LYUY(CiBLRVg?~mkjNyOl&b+P&Pr>N>@l0VODnoSk`uQ~
zusV*l1lZr(ez|hhdx1eZmBg4uC_475d<xxmKlZE5dLC(7;RF>ck<BI)ex4ETf&k{}
zo|S&9JcRSbS)HSTlLrAUX=ng2WdblUlv~_eUS8%?&7(Ae>@}p7TV|Pl;-RM|=O`-|
zRp$O~){9v4eaA}_z{N}})#T9vF#y$94Ao8k<xSl3kc}s$L_lijO|?tzG|A&aWAGQ{
V2ZN2<#M<!?jmBs7_ETd%2N*Ajd#wNf

delta 270
zcmV+p0rCEw1Dpc{FoFS?kpwgtG%z?YG%-0eHZU++7Y#BtFgP$ZF*!6gkx(6AgZX;>
z5?G`*)d4rSxRGH$Q84)eYd=W`ex5fCl2i(B=f`)-cE~7kWC7b<drb?P2LU{Z1d+(j
zTxD&5nJH2-wSa}zTk_(HnA)|-%Cwzln4y<`m!cSn+ke)iU${Ykk<BI)4<-!8W{P;*
z;or~h6c8WFZ2R$3lLrAUXlDR0WCAdK_j6^LfWba|W2y3>QCs+!(F<!3k}9Z<DfZz&
z2?U0;I=B#*%(WcG4Z&s*ybL-5Fl2avk2lg-+tL$R<Q9|bl6mcruVSMHWW#`|rN3ZK
U?#U^QA?Pqrl9N~3v?{XLgPMVN7ytkO

diff --git a/rustls-platform-verifier/src/tests/verification_mock/root1-int1-ee_1-revoked.ocsp b/rustls-platform-verifier/src/tests/verification_mock/root1-int1-ee_1-revoked.ocsp
index cc604f7a6cb8b746a1eeab5ef8472bbaad5e0155..3b4aa06429d1961646893cda6ec27c682ba06277 100644
GIT binary patch
delta 218
zcmdnXw3lguGpDJ6g`u&brLo~eAD#NTd4lhn7@obHH??lHP0Qz_k#iR}F)=bN6qMjM
zGB5%uH3BI$Fo?nsSO8IDhNQ-Ti;Y98&EuRc3o|owCWAp5lOe<ArC%S`6>*x?D4x`4
zUwS_|nz5@kZ2Q*l2d8k{`|9R1^}99W%+T1BA1_rh8;?!f82uQi=h<&n*6NPPe|-&&
s2lq#pCQtwC7VvP>om=yBWOl4LcxCG84|lJ{rO$Nz@4a(kNc8~@0Ak!#>i_@%

delta 218
zcmdnXw3lguGpC7xg@LJ|rHR=@ADw!BHJ)Q>T@|+<-ar3NL_q#@&hL-GOpHtm1ts{6
z42(cZO+ZQw45Bau7C_XPBB?RpV&l+i^EhYA!pzK^$zYJiWXLdgb7-sFgEODnpGwVD
zHu=Bc(pzQzlBTWqZF8UhU*;yX{;WcC1?Op&#9qtNh=09d>b*cc-!1k%JoEX+%U?Vu
ryOu=kvoYA++*Wq{k-Tr@)rva7BgUQuufmu5HyZ5r(Ci3Yt#J_mq@ht{

diff --git a/rustls-platform-verifier/src/tests/verification_mock/root1-int1-ee_1-wrong_eku.crt b/rustls-platform-verifier/src/tests/verification_mock/root1-int1-ee_1-wrong_eku.crt
index 9852aeeafd98244ad190d28264c4ab27521c2d01..b547d64d693974d9644f5b652ac0ce0a6a1a05cb 100644
GIT binary patch
delta 259
zcmV+e0sQ`*1DykqI2biBI59FYIWsXZFj^N4GB+?dF*7kaGcl1+9bn^yPn?CWd<~TE
zjVOhL>lTn%4K6|7{GtJ8M|*BquGh%Vm${r^vH-KVMwV{`wx~)~pgYe<NCKkDLUI>8
zE)frvRU+&foxoFQYbya6kT}S-1wTS%0C6C+CkKs^y)}`|CKP_25$=Kj=INf5eyco$
z^Tk=6qk@wM0W)J=m{3OWdk!Nq*+OJm4h_wkf5m-xj~1?8k!A@@VI^VI`!?$J<Im7t
zd=}nu7(RglF#xc9(Z0`>P!!R(c;guohAP0iWWLO+RKVSc3Bp=4HVs*tocHa&w$js5
JGZML@WX59XaAE)e

delta 259
zcmV+e0sQ`*1DykqI2bfAI50FZIW#sfFj^N4GBz+cFf}nbG&Ye?9boxk?KR(T9cTP@
zBh2NIU0VR<x~T59>)bGitdX7qi=mLzon!)sfP1hdDD%%%v(YvMTb2NN@K51I>iv%k
zVb83`dQdDor^d89ToU%G?<!0ii#{{rH?C#B8LjdUY!H#nCKL}Q48~@Pc-!IM&+Zfu
zAIog}@l%rr0W)J7u!c3&nwu$<EB|f`_v6aI)!V4ooJ+BplpAWr>gANPrYi)eM>>g>
zfc0tSrA}G`F#zI}Gk7UJ2vWDCyRQ}4fkdZ*1+l?#jzZF+_pr@5PY2)|o8e(~9E-`6
J9Ug~19ob#kc*g($

diff --git a/rustls-platform-verifier/src/tests/verification_mock/root1-int1-ee_127.0.0.1-good.crt b/rustls-platform-verifier/src/tests/verification_mock/root1-int1-ee_127.0.0.1-good.crt
index 3f4f08aaeaeb289ab44f5ddccf24426a3d90f3d9..70b398f59511faea3af72c4188a6fa926695a812 100644
GIT binary patch
delta 260
zcmV+f0sH=u1CaxeI2biBI59FYIWsXZFj^N4GB+?dF*7kaGcl1+9biCDx<aR)wJJ3y
zryZH=Owz&)uyNH!;r@EeZ4<|}=3Z{+g6Z4x<*wt3|IqfI1CLdh$_SW_kqd*;{D;94
zPd99i7DS|!vZCb>?cj}R%-JVoYG+dO*nit8i@ddymDZ8XCKP_25$=Kj=INf5eyco$
z^Tk=6qk@wM0VZTI0J<g#Bfklk>(UfmK03YeYQ=KCfM5dTKN6?FY)%@Z7TZGXnT>#=
zr$?r2G1P%kssb=W%l0DphCA{<Kl2Jh*xjKtc#Rdc`@AI)bilbJ=YxCPDe;ZLn5Obv
K<xKdK3(MHSB7WQe

delta 260
zcmV+f0sH=u1CaxeI2bfAI50FZIW#sfFj^N4GBz+cFf}nbG&Ye?9boIlfURs&>Y8jk
z;qQe=mwt4u&j(EUm7tTNk3vd9Yv;YLx??+u)AKQP_rsM`ZX0VeZ_f67O_yS*m%Jd8
za#ucc=-xt-mQfM_J-e966<`92*?BV-P2KaCM7(Ju2RM<<CKL}Q48~@Pc-!IM&+Zfu
zAIog}@l%rr0VZTHXuzvRR7r5{xid8aRI(I_7j6Qo2ug9;Ofm_1dP-3&mt-lKe`q=1
z%_AuIgM@110x<xr?J7Y`GWMfWw{9njJ+RrDUnYXy1Wp)|ZGdnLKZ#4jLZB|1>Uz)^
Kc&-v2FcXabO>Z3l

diff --git a/rustls-platform-verifier/src/tests/verification_mock/root1-int1-ee_127.0.0.1-good.ocsp b/rustls-platform-verifier/src/tests/verification_mock/root1-int1-ee_127.0.0.1-good.ocsp
index 9cab816dfae7632489d0b62d328bf6b51e28c17a..e920cd38e8d0e0f0b93341f825c8de77549b28bc 100644
GIT binary patch
delta 264
zcmZ3@w2H~cpovk9i;-bL6QewkDb2>I&Bn;e%5K2O$kN2f0~F#gXq>Q6+(6V&*g%kt
zIh2J<n5!s1zr;{CGq1!@g5Su%$kf2X(Adz@*l?ncPJP`x!FNpz&tA@(TDRJ!<@3?V
zxr>{a7#SNF;7W}^N(~I676^ic%z(OKLIzxH99nH2=WJP+nVHiW3{sd3Se@BdDf)Pp
z?zr;s>9Ic<Cym7xFTa<nXTvRad()&_uRbl|-xTFP_e^l-Bd<;Y`-jFinGC9KcT3b9
x|MSIFY)0*}+txEr&dyc!%Isgu%*~s$=)v{NmD3n^_S9+LllXDswxYy@DFCzoS%Uxo

delta 265
zcmZ3*w3^AspovkPi;-bL6Qcr<DZ|F8&Bn;e%5K2O$kN2f3l!osXq>Q6+(6V&*g%kt
zIh2J<n5!s1zr;{CGq1!@g5Su%$i%?Hz|_#v#B8FEPCdUG&#|<wirWwGpMNJJAb&dN
z_s3u+M#csPxKb04QUimi1%hB9Q=o2`kO3DPhgO@%Ia?NHX66hAgH$F%hLsbUEO$H?
z*uTI2O-Se`CT^w7r@@jryB(_5Z2u+mU#5Eb<!{p$u*I)t%(9&Cv)g1^0F!}JpR%Ll
xHHjJB0&|--F8;)zY*Xdpb&2VX%Wuxj|26d=M7{ZUQ`5`UD=We4=DlBY?Et$;RwMub

diff --git a/rustls-platform-verifier/src/tests/verification_mock/root1-int1-ee_127.0.0.1-revoked.crt b/rustls-platform-verifier/src/tests/verification_mock/root1-int1-ee_127.0.0.1-revoked.crt
index b26ab5d4ab435b257ade9bdf4179ce677099cedc..156afaa2dbe7547cd87449b77fff65d1e243c9b8 100644
GIT binary patch
delta 258
zcmV+d0sa1w1CaxeI2biBI59FYIWsXZFj^N4GB+?dF*7kaGcl1+9blxAO8&^>o@r-U
zN01g;W}Mw_d-4h-U+hng!vJl_*0>P`k^k1OqBOif<4fG0ehX<DdN;yYjpidUrVjZR
zJ^Op>sE-h#2k)wdTi5&pO(i>7b8irf_0*zjLdU`zC9ILnCKP_25$=Kj=INf5eyco$
z^Tk=6qk@wM0Vra_&&%b%ET=WWg?}~&CQuxDv@W5ff2kJARCGjYFe8Qx7Z_G*;n@CY
z>!|XZ|CogWFiDQkF^r>jv<#L0k@Le5xD*mh$QsDK045PrO%Jt9W(e&OS3^CCd;9L;
IhOC#YI^1(~Y5)KL

delta 258
zcmV+d0sa1w1CaxeI2bfAI50FZIW#sfFj^N4GBz+cFf}nbG&Ye?9bjSbNh{%?01nuF
z0mKi?y1m7y@8$p+s^1*$Sk_&9EF%tD(wA;<twr<k*)mX4PC$BCbh<_j#h%f*r#PdN
zaZK>;Pn{jfiLgPt@xo$PVR89^x^O20&BX%tju*<IS<{itCKL}Q48~@Pc-!IM&+Zfu
zAIog}@l%rr0VrbWMn9qEsutperu$u}c)?tJfKpxOi7iGSih*=<hSue1snKr<*)>5l
zDC-th+%ozCFj*yA0MCVz`*wErmCV6mM?K)2)D;;92;SeuK8Q_V>ohsxXBcIr+B&+?
INCNPBK;k8LGXMYp

diff --git a/rustls-platform-verifier/src/tests/verification_mock/root1-int1-ee_127.0.0.1-revoked.ocsp b/rustls-platform-verifier/src/tests/verification_mock/root1-int1-ee_127.0.0.1-revoked.ocsp
index f5e6e2aa5035af8223a8ac04a98519891c39773a..6dff38ec934b2e6a73ea618c78c7a42bfcd4ebd4 100644
GIT binary patch
delta 283
zcmdnPw3o@ppo!6vi;-bL6QdE3smI2t&Bn;e%5K2O$kN0p4-}F%Xk55Z+(6V&*g%kt
zIh2J<n5!s1zr;{CGq1!@g5Su%$kf2X(Adz@*l?ncPJP`x!FNpz&tA@(TDRJ!<@3?V
zxr>{a7?~Cd!j&3<lo}XBVF)aMs4)W?2UBCf#m1r4=5fxJg_)T-lffX3$&le$Lwb4C
z`CojK_$}vq%{Q1SbxvK9c}K75#ZTY0{<;;+vR&Z2)cId`UC8mTi880l{l$QKj!L9I
z<9oA!xg|C^^<G+7O1W@mpi}D|8_|@ugEtTRG1s>HJiX6vzGQyRyEiwcsWAfpTC!Tf

delta 282
zcmdnXw1>&Zpo!6fi;-bL6Qd!JsmsQx&Bn;e%5K2O$kN0p2NaSrXk55Z+(6V&*g%kt
zIh2J<n5!s1zr;{CGq1!@g5Su%$i%?Hz|_#v#B8FEPCdUG&#|<wirWwGpMNJJAb&dN
z_s3u+My7>=aHS?7r3MC37y=6*YD|H~!PFRVv2kd%d7QIlVP<B|U@%B!GGv&ie@O7s
zNsj}s!!iqk+_K(kUcQrPT@u_P-ter<z;&)PS3;%K{!(7ys%aZ_tmkw)oMJLimaJIc
y`pkdv!IHFnI@8u$H{A4%pBiub@zYGR&oeHwePR|&Xfr<Dv^w{Zfq8$vzBvFj%vh2D

diff --git a/rustls-platform-verifier/src/tests/verification_mock/root1-int1-ee_127.0.0.1-wrong_eku.crt b/rustls-platform-verifier/src/tests/verification_mock/root1-int1-ee_127.0.0.1-wrong_eku.crt
index 9a1816903d81d027ee8cc5b6462d917dd81b44d6..17bdbc054ec67b33e05551c3441b726d4db66ce7 100644
GIT binary patch
delta 270
zcmV+p0rCEk1CRp*FoFS$kpwgtH840aGBG(bF)%P%7Y#BuFgP(YF*!3akx(6A0N3Yn
zH3;DNg`eAFy4AB7<DVYxRie4R{AdcunhaF-w5i2?LnOZ}+!RDzwAq-8%5V$0LxS~S
zpz+(6C=kQWDS2mtFM^Rq0mZxA%R~>5j{}z)*DxWQeL!2TjDv>#k<BI)ex4ETf&k{}
zo|S&9JcRSbS)HSTlLrAIXlDR0WCAcR8quIk^j`N-z1F17K~cJcNp4ELq8NcyvvBpm
z1)F4VHE8;~^7&+`5<}E6bCbXVFl5202oEl`ny-MVqr={1kMr*SG>iIfP34(#Hdnuv
U603=@FHmD@g$?h5(t#mcslEt(O#lD@

delta 271
zcmV+q0r38i1Cav+FoFS%kpwgtG%z?YG%-0eHZU++7Y#BtFgP$ZF*!6gkx(6AP@>Zd
zh7;_@f}juvfJ<ahCdtlzAn{<_Xwa(ObvjAqSNP_V`zBoNSy@gdcJW;DOd6@Pv>kSn
zS^Txj{XTSxJ})5Nl(P~A4qKem816mw3k8sYv2eED$|<nY?w6p*k<BI)4<-!8W{P;*
z;or~h6c8WFZ2R$3lLrAIX=ng2Wdbn(wizL|yXT+JhgI5b#~8uQE|=uDJPSmJjznZS
z7)Sqt+}e*jrRAJPozZ9hL;vA#0x&k1h<TtO;AV&@n3T&{WdkM56zU~Fqm@*J@&+!<
V7?M%dRZ3~YU)oM{Qed&}yyD@mdo%z5

diff --git a/rustls-platform-verifier/src/tests/verification_mock/root1-int1-ee_example.com-good.crt b/rustls-platform-verifier/src/tests/verification_mock/root1-int1-ee_example.com-good.crt
index 416e6f02eb41d126e15ff43a44c84b628186d03b..0c2364f41aa735320f80c580cb8722ac37551253 100644
GIT binary patch
delta 271
zcmV+q0r38r1DFE@FoFS;kpwgtH840aGBG(bF)%P%7Y#BuFgP(YF*!3akx(6AIIf=(
zWqa}n)v#Y%M*2tQqN^W#Io@)AY*$xv48M%au=kfubC#4xNP1&e#9YxGln;XMujF2A
zXbcgPkR7_yle&fbbkuKz^6IONu{K^T0-cBpT~m@tz9S_0-aDojk<BI)ex4ETf&k{}
zo|S&9JcRSbS)HSTlLrAPX=ng2Wdbk|3m>r@_y!P&35pZr-c=N6afu@N<iW!lwP)A&
z2WV%Gg?kKHI;JqG{gCj^s56@aF#y-3h7Th*kn_}H^@eAQ6#P$V1d;Xo!_ltd&q@Zs
Va^15yBpHX-NaM$RZ3Z_M!Z%_Icl`hW

delta 272
zcmV+r0q_2p1DOK^FoFS<kpwgtG%z?YG%-0eHZU++7Y#BtFgP$ZF*!6gkx(6A0N=S_
zVt;S&55XBp2zQ#lfMO=nhDWhecr)8@ha9qr#+ke)xSP$LMPN{v4t1)im1WS@0z4r3
zFO=S}4Mw@TP7)#$Ynvi+GqPZsZ|J(=`1lqdjn+wduX6eDnH64pk<BI)4<-!8W{P;*
z;or~h6c8WFZ2R$3lLrAPYH0v4W&$w)=bNG=I$ZKN3?VHCIkF`5CD%6eR^(|j3Wvxb
zz}|rd#1zw@7tO7`85t;HA$^qO0x<yG>?4yxr6Mw+f@{5s2}!dhBjm0?n-n8Gc7U^@
Wn40D5m=ml%nI_@wq6cALenT7}J988O

diff --git a/rustls-platform-verifier/src/tests/verification_mock/root1-int1-ee_example.com-good.ocsp b/rustls-platform-verifier/src/tests/verification_mock/root1-int1-ee_example.com-good.ocsp
index c73e92eb51991ce53e61867cdc24aecbd3185757..028baa2a4e8988f649258403e1c0aabfc7366624 100644
GIT binary patch
delta 200
zcmZ3@w3=yxGpDJ6g`u&brLo~eAD#NTd4lhn7@obHH??lHP0Qz_k#iR}F)=bWFi7wl
z85n_-8iAA=7(^`)1PhrV2^ny)acH%9oU>(NW@gS{Fi2%GP@4Ab<NiC#gWBEH5-P*f
zvyb_2-w~(Z`AK4G{41&Ele-!c?>xJ8Yn_<U$*RQ*bheo+WHMx!Ad#-LCx4$hGi!Xv
p((h)1jGc0|d9qwl<_exuocq}qmZZdGeGQqJ?z1lZj6HK|HvrorNQ?jg

delta 200
zcmZ3@w3=yxGpC7xg@LJ|rHR=@ADw!BHJ)Q>T@|+<-ar3NL_q#@&hL-GOpJ^T3=;fC
z21X#ICLpB-22l$H!9u1;LIzxH99nH2=WJP+nVB;f3{sg48D0jkOQ=dF|M|Hi#`x^R
z4eb}6%;@@@%IMS2b~<zo*G?xs#Z7XHT^Fa6nK7z=n`-htg2{j<WQqOu)SJgXE8I@c
pTj7)VxhK+HYKQ)%2#Z5j4ZQgu)s`gOp27L5l5?B$bO&eG?*Q1qNjm@l

diff --git a/rustls-platform-verifier/src/tests/verification_mock/root1-int1-ee_example.com-revoked.crt b/rustls-platform-verifier/src/tests/verification_mock/root1-int1-ee_example.com-revoked.crt
index e9d870e4f0e67b9f311a417b028a9f0b7041ba48..bf6c751af9941b54757f510a9edf6afb4cff7016 100644
GIT binary patch
delta 270
zcmV+p0rCEr1D68?FoFS-kpwgtH840aGBG(bF)%P%7Y#BuFgP(YF*!3akx(6AXKwgv
zSC5tO&Y5GwiXPWDl+l9TZXa&h-DM7QY}*UlXH>?zn(FwW#dtZPji9XNr6vucgTBx$
z;=4Q}=HSV1#&0}n-s-Yo2=^FY88sYX1fP_F?<$zw!-~LjQ#m%>k<BI)ex4ETf&k{}
zo|S&9JcRSbS)HSTlLrAPXlDR0WCAb^i$^;ia=c@!7{|b2EpkJN(m0f1k!yy%X@Pat
z$ZKLnWc4_D)^fDK(>bX7Rh=jTFjhH3LwE4%C7~0vlsEJQBbdiw8w!h`c)2YtVbJNQ
Uf#^iFfMDiyGH2?2h2_~Y4jvDCq5uE@

delta 271
zcmV+q0r38p1DFE@FoFS;kpwgtG%z?YG%-0eHZU++7Y#BtFgP$ZF*!6gkx(6A?;e#U
zkJkC7wB6Db#A~@ap5Hd+E?Qmp_rs`$S>E{#l4#KX*4B*KrFqjFaUP?FSmdTU87!A=
z<l)7Pt+lj)iK%5v3Ubcd`h<a67Prb@vwRK<i`y|S^dY-u5TS&{k<BI)4<-!8W{P;*
z;or~h6c8WFZ2R$3lLrAPX=ng2Wdbm1lJ80kl-rLj*A&#~|Ll1Acu+KX04`5Q46x4a
znZ-0oAP^BGEh{E&S#y)*`&xJcF#zbcC$79PLSUD8@L~Lh(T4*sM@WdUen1c%c*g=2
VMHY}{4XN|mV)TmcX3}$Rl|F9Rdcgny

diff --git a/rustls-platform-verifier/src/tests/verification_mock/root1-int1-ee_example.com-revoked.ocsp b/rustls-platform-verifier/src/tests/verification_mock/root1-int1-ee_example.com-revoked.ocsp
index 6018fba35001ed3c5abaa124b6f1c8ab417a808e..bbd64a3708ddf3d8243d62b0046e9c2a5fe9f5de 100644
GIT binary patch
delta 217
zcmdnPw1;VeGpDJ6g`u&brLo~eAD#NTd4lhn7@obHH??lHP0Qz_k#iR}F)=bN6qMjM
zGB5%uH3BI$Fo?nsSO8IDhNQ-Ti;Y98&EuRc3o|ow27^H=lL4nh_ks4>E$_{A7u^VR
zyzOHA|B$wPS%uGhUtf&}r(N@TBzGU}F0a$t|43@FSKP;rw@ii%{W(rAG;1He51oG{
rM~`LY!EI@cyRU!Ss5g72$+ZsqA3`&mILggz7s(ymBb4@k+CdfoMEp=H

delta 217
zcmdnPw1;VeGpC7xg@LJ|rHR=@ADw!BHJ)Q>T@|+<-ar3NL_q#@&hL-GOpHtm1ts{6
z42(cZO+ZQw45Bau7C_XPBB?RpV&l+i^EhYA!pzK^!C;WeWXLedZqwU0@7ATdw!PE6
zxAkO{`pM-5ty%k1xTGhawQ!wz&8=o8dtYd0Qz~P_431w(21ZN<_Ww7`UBOYP-nO#K
r(Dq_@N$vu*W}l=-%Ut_Xmh3;Ur8n&1%VWpnEqonc+?e`m{qyYr@5)hx

diff --git a/rustls-platform-verifier/src/tests/verification_mock/root1-int1-ee_example.com-wrong_eku.crt b/rustls-platform-verifier/src/tests/verification_mock/root1-int1-ee_example.com-wrong_eku.crt
index 42786fc1950e5bd17dade609fe948bf6df655db3..e311b4fa98c2bc937752ade4224b2a40179ebf75 100644
GIT binary patch
delta 259
zcmV+e0sQ`$1DFGlI2biBI59FYIWsXZFj^N4GB+?dF*7kaGcl1+9bmTQ+~d3bl!qmN
zrvpmPPBPk?*RA-J8&uwq_WJF|$XK^gN;sPtxl9T6DcL%8%w0YfMpelQ!BE$?=g%(+
zJ+z=HJut`zaO&jAW=y!d_PiS|Lr-FVv*bK~Bx5crd{vRnCKP_25$=Kj=INf5eyco$
z^Tk=6qk@wM0WM=Vg}+?t{)oBO&z^I(Dc`{NG(1tD#=XVUEw>G76VMpXqP$qHDI8Jo
zY}gQ8b26m@F#v~^2>tgnZ~(_+5;e+;_Om4ruR%n}q;VxA>MBmshBE;cDwNN@sig9Q
Jf4{7*G}xk+c+CI+

delta 259
zcmV+e0sQ`$1DFGlI2bfAI50FZIW#sfFj^N4GBz+cFf}nbG&Ye?9bmCh*2bG53y$W?
zZ8WR%&Vknw<v`WM3JoYC*>x7MKLqLwSL*kM)oAsb5zHG$S-}Qm%|#}ze|7(wz0g&A
zp&-y?m9B^g)thL80dCOHqP!7}oEw-c$<e7~Yn`*q$fA+WCKL}Q48~@Pc-!IM&+Zfu
zAIog}@l%rr0WM=Fc5Np_D<=uBiWfJKEGNU9f!0zBf`loE1Y*F_^7fXH+8^8SUW}8=
zfNH{(A4d-YF#wj@peIURa*zTn2U1LaKw1}X;-|IbS<tj7R5EdDV_Tz)a-wp0mMu9F
JcMPO@Gt48tamxSz

diff --git a/rustls-platform-verifier/src/tests/verification_mock/root1-int1.crt b/rustls-platform-verifier/src/tests/verification_mock/root1-int1.crt
index 824ebe8c9ae82e020e3904ed1e28279b27d02824..7c059e530c146f3b5e10d5b5439afe52e3f86913 100644
GIT binary patch
delta 307
zcmV-30nGlm1Goc_GZ-~6I59FYIWsXZFj^N4GBz+cF*7kaGcl1%GGL}y=;O1LT}S9<
zEDFbz((3S9DUFh;y|aL;zorKGUYzP9E#4BuTx(QSUMoTHv33sXBgpGlOnUX%2#tZp
zi-~bQMuLube?$RS$TD8W3tp3i9^Z~a7Ad`V38@Bq_q~zbFn@lY5$=Kj=INf5eyco$
z^Tk=6qk=FW1_M<cBLo;Q7JwAeaqK&N^dg|PC;5CPW(S54lakjk3I+%&hDgpm1Oo#D
zXaF!}0x(TGXFEiculR9mGsr)^0Hv#~C?ya_61byeBb<V?qor@kJc#3I1XSPT=fNm+
z{}KW*0KEtezbxDTzoo&LLk)i!A~$+W48c=xiJm4!%48+cvCYeE%In0&^lFFyEcn<T
FI1z3Wg&zO_

delta 307
zcmV-30nGlm1Goc_GZ-{5I50FZIW#sfFj^N4GBq$bFf}nbG&Ye-GGOXmrl4w}PtLyz
zo3tKA)~Pk-7uvo*qR%g8b0rWg{NZH?ESjo(Zx3}ZMb1$FGY<Pat&y{&YCmNTQ7I2e
z_pM?kKqX9Ahx7fA9jbcjrx&>3XY|o_8n{c!so(fJGPjZ4Fn<pw48~@Pc-!IM&+Zfu
zAIog}@l!A#1_M<cBLo;Q7Jw8Mj7uQ(EriN8Zs{|bQBVyPd`|f=3I+%&hDgpm1Oo#D
zXaF!}0x$tgNXi>5$gdCat^oByrt41hsTBrJ&q3!gK<H8l*aiq$sL*JUKi2LGBpt@i
z1%U!F0Hn7i;w*^}5%5V8h||V8N3|afcTK^W_Pjf&{mzhj7$Yf)!a6T07LAI@TzJ{(
F+SYd4fB66a

diff --git a/rustls-platform-verifier/src/tests/verification_mock/root1.crt b/rustls-platform-verifier/src/tests/verification_mock/root1.crt
index db367c18513314a5910a930b9a979320d508a2c1..0292e4c62afe1af5b7d3bd38fba0d4f72f7398fd 100644
GIT binary patch
delta 274
zcmV+t0qy>h1Cj%fGZ-~6I59FYIWsXZFj^N4GBz+cF*7kaGcl1%Enw@aS)g!Hft|&}
z-@M<kXs!192=NyvKyu`}ad~BCMa3IEdGk;L?A`^v_8O>V4<#}V<3b7|<XvtTK=5hg
zZ;8O&$W@#{MD^4&PT^F#f|`+TwJT-I!H`SQBiFqDL>!UWFn`i<>^pt*BA~V>`Ftj3
z2Zj)nlGiW_1_&yKNX|V30|NtS05D|&Feg_9?at#+wf%=G;V>c4Nh?v@I$`a!536kk
z*BfZ8(?uoBv+-6zXv{8iKiSG2_5v{g#Wl{KXTcGgpu`}1cHUgkI4#}?sVjf+7R`j)
YBs24B-4{c~DGMu<K;C{xIhX;Ue+3tK>Hq)$

delta 274
zcmV+t0qy>h1Cj%fGZ-{5I50FZIW#sfFj^N4GBq$bFf}nbG&Ye-Enud$>EH^9pWS>U
zNhpnVFzCe_x(v-=-;8`%A=d)4X=PCj=7924=P<n0o^pP7F-EVLaj^`ce{V{OFQp@j
zEI#rawRtyxxaP*|jcUt0azK7Xpj5-|YCy&B?-codVtkR<Fn<<|OCa?vgvvH<=`)#8
zPz@D)PWdnj1_&yKNX|V30|NtS05D|&Ffd0X`I0Q;#-UJ*UUnyJc--f!-rXzN5k?_=
z-LC?(VgS~i^U!U|drM;zwvweer2;Vk^y39Sca5He(`x%d03PTQy^JC@6i7QKU&Upb
Ya?TMJ*94SVO$&DwbLt95YRiA8Z4JP5umAu6


From 4d5b26cb2d3b8d97055ce9bbbd2ca3340b5e1f64 Mon Sep 17 00:00:00 2001
From: ComplexSpaces <complexspacescode@gmail.com>
Date: Wed, 13 Aug 2025 14:41:19 -0500
Subject: [PATCH 5/7] Add documentation for updating test certificates

---
 admin/MAINTAINENCE.md | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)
 create mode 100644 admin/MAINTAINENCE.md

diff --git a/admin/MAINTAINENCE.md b/admin/MAINTAINENCE.md
new file mode 100644
index 00000000..3db38dbe
--- /dev/null
+++ b/admin/MAINTAINENCE.md
@@ -0,0 +1,20 @@
+## How to handle certificate expiry
+
+When CI starts spuriously failing, it is usually caused by the certificates inside `src/tests/vertification_real_world` reaching their max issuance lifetime and becoming expired. While most
+of our tested platforms are able to handle this better by mocking out the verification time, some can't. At the time of writing these are:
+- Android ([1](https://github.com/rustls/rustls-platform-verifier/issues/59), [2](https://github.com/rustls/rustls-platform-verifier/issues/183))
+- Windows ([1](https://github.com/rustls/rustls-platform-verifier/issues/117))
+
+The other case that can cause failures (much less often) is the mock certificates expiring. Due to platform verifier security restrictions, we can't place absurdly high/unlimited expiry dates
+on our mock CA and the certificates issued by it. As such, they will expire about every 2 years and need updated by hand.
+
+Thankfully, updating these has become easy:
+- If the `verification_real_world` tests are failing, do the following:
+    1. Run `cargo run --example update-certs.rs`
+    2. Using your tool of choice, update the hardcoded time in `verification_time` to match the current datetime.
+    3. Commit your changes and push up a fix branch/PR.
+- If the `verification_mock` tests are failing, do the following:
+    1. Run `cd rustls-platform-verifier/src/tests/verification_mock`
+    2. Run `go run ca.go`
+    3. Using your tool of choice, update the hardcoded time in `verification_time` to match the current datetime.
+    4. Commit your changes and push up a fix branch/PR.

From 52c9270b9f06880194b2d944832f6b43d7bd1fbc Mon Sep 17 00:00:00 2001
From: ComplexSpaces <complexspacescode@gmail.com>
Date: Wed, 13 Aug 2025 15:02:16 -0500
Subject: [PATCH 6/7] Fix new clippy lints from stable Rust update

---
 rustls-platform-verifier/src/android.rs | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/rustls-platform-verifier/src/android.rs b/rustls-platform-verifier/src/android.rs
index 50db61ec..7236f9ec 100644
--- a/rustls-platform-verifier/src/android.rs
+++ b/rustls-platform-verifier/src/android.rs
@@ -52,7 +52,7 @@ enum Global {
 }
 
 impl Global {
-    fn env(&self) -> Result<JNIEnv, Error> {
+    fn env(&self) -> Result<JNIEnv<'_>, Error> {
         let vm = match self {
             Global::Internal { java_vm, .. } => java_vm,
             Global::External(global) => global.java_vm(),
@@ -60,7 +60,7 @@ impl Global {
         Ok(vm.attach_current_thread_permanently()?)
     }
 
-    fn context(&self) -> Result<Context, Error> {
+    fn context(&self) -> Result<Context<'_>, Error> {
         let env = self.env()?;
 
         let context = match self {

From ade5bb0578792424766ad980e7236bb0ad80a59d Mon Sep 17 00:00:00 2001
From: ComplexSpaces <complexspacescode@gmail.com>
Date: Wed, 13 Aug 2025 15:28:23 -0500
Subject: [PATCH 7/7] Add test-only LetsEncrypt Android workaround

---
 .../org/rustls/platformverifier/CertificateVerifier.kt    | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/android/rustls-platform-verifier/src/main/java/org/rustls/platformverifier/CertificateVerifier.kt b/android/rustls-platform-verifier/src/main/java/org/rustls/platformverifier/CertificateVerifier.kt
index da2f34e6..febbcfd2 100644
--- a/android/rustls-platform-verifier/src/main/java/org/rustls/platformverifier/CertificateVerifier.kt
+++ b/android/rustls-platform-verifier/src/main/java/org/rustls/platformverifier/CertificateVerifier.kt
@@ -357,6 +357,14 @@ internal object CertificateVerifier {
             try {
                 validator.validate(certFactory.generateCertPath(validChain), parameters)
             } catch (e: CertPathValidatorException) {
+                // LetsEncrypt no longer include OCSP information (as OCSP is being deprecated) which Android is not
+                // happy with since it *only* tries OCSP by default. We aren't 100% decided on how to fix this yet for real
+                // (see https://github.com/rustls/rustls-platform-verifier/pull/179) so for now we implement an out for
+                // tests to allow regular maintenance to proceed.
+                if (BuildConfig.TEST && e.reason == CertPathValidatorException.BasicReason.UNSPECIFIED) {
+                    return VerificationResult(StatusCode.Ok)
+                }
+
                 return VerificationResult(StatusCode.Revoked, e.toString())
             }
         } else {