[Created by: generate-chains.py]

A certificate tree with two self-signed root certificates(oldroot, newroot),
and a third root certificate (newrootrollover) which has the same key as newroot
but is signed by oldroot, all with the same subject and issuer.
There are two intermediates with the same key, subject and issuer
(oldintermediate signed by oldroot, and newintermediate signed by newroot).
The target certificate is signed by the intermediate key.


In graphical form:

   oldroot-------->newrootrollover  newroot
      |                      |        |
      v                      v        v
oldintermediate           newintermediate
      |                          |
      +------------+-------------+
                   |
                   v
                 target


Several chains are output:
  key-rollover-oldchain.pem:
    target<-oldintermediate<-oldroot
  key-rollover-rolloverchain.pem:
    target<-newintermediate<-newrootrollover<-oldroot
  key-rollover-longrolloverchain.pem:
    target<-newintermediate<-newroot<-newrootrollover<-oldroot
  key-rollover-newchain.pem:
    target<-newintermediate<-newroot

All of these chains should verify successfully.


Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            60:cf:3c:af:c2:01:a7:ee:48:ed:83:9c:13:19:f0:c1:ff:af:13:68
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=Intermediate
        Validity
            Not Before: Jan  1 12:00:00 2015 GMT
            Not After : Jan  1 12:00:00 2016 GMT
        Subject: CN=Target
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:ef:77:94:e8:68:c5:7e:1d:9b:ae:10:cd:d5:bb:
                    96:27:0c:05:17:f4:ec:bc:da:7d:28:e5:b7:e5:8f:
                    da:d8:ae:7a:2a:d2:e3:15:9b:12:62:79:02:61:3d:
                    3f:8b:64:4e:fb:7d:e1:59:bd:2f:83:ad:d3:b8:e5:
                    45:33:c4:13:5f:79:ef:8a:3e:c0:39:20:81:e2:98:
                    b9:e6:c9:60:b6:8e:b4:bf:b4:2b:55:ae:b1:7c:21:
                    d3:fe:ec:f0:56:31:fe:0a:19:c4:2c:54:a4:97:aa:
                    84:a2:83:f8:5a:9a:f3:11:b8:ad:3b:14:3a:68:5a:
                    72:24:49:6f:6f:5a:02:39:91:07:09:cb:18:57:13:
                    1e:a4:54:03:31:5c:b6:e9:7d:78:2d:e8:ba:2f:70:
                    17:0a:03:11:aa:90:c7:5e:f0:1b:7f:56:39:f5:e0:
                    1f:1e:33:8d:23:30:e6:7a:ba:5e:ca:46:33:13:04:
                    5c:65:b0:be:53:7f:ab:a7:9f:8d:fb:bd:46:e5:87:
                    44:31:55:e5:9f:97:7e:a3:ec:69:a8:d7:8b:47:ae:
                    48:ae:74:50:5e:57:55:31:ca:36:ec:43:a1:dd:61:
                    b2:18:12:6a:29:0b:63:24:d5:71:4d:da:e7:0f:0d:
                    e3:2c:aa:76:6b:f9:2c:93:c2:fa:f9:40:2c:1b:34:
                    65:53
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier: 
                FA:2D:AF:E0:5F:8E:8E:18:7A:FB:AF:FE:D9:C9:A3:62:AA:B8:2A:18
            X509v3 Authority Key Identifier: 
                keyid:CC:72:60:F0:8D:8C:CB:A9:6C:FF:09:57:F3:6A:FE:29:46:24:26:5B

            Authority Information Access: 
                CA Issuers - URI:http://url-for-aia/Intermediate.cer

            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://url-for-crl/Intermediate.crl

            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment
            X509v3 Extended Key Usage: 
                TLS Web Server Authentication, TLS Web Client Authentication
    Signature Algorithm: sha256WithRSAEncryption
         01:db:ae:1e:db:9c:37:2a:1c:f6:44:c8:55:cb:39:9d:88:f5:
         72:27:94:80:ec:51:ce:86:c3:64:b9:7f:f6:c2:83:38:9c:66:
         27:44:94:31:28:bc:ed:37:dc:bd:7c:84:d5:c6:44:74:ef:81:
         54:01:78:55:d0:59:60:99:bc:ab:bb:6a:45:0b:50:f9:de:d4:
         3e:ce:ed:1a:26:8f:8b:6c:2d:3a:b2:e8:4b:17:c4:b8:d6:41:
         4e:fa:8c:af:70:44:6f:30:71:f5:92:62:7e:db:19:f2:67:18:
         e9:17:a6:98:b7:9e:7e:df:69:0c:d9:ad:65:b8:0b:5c:1d:c0:
         a9:4c:e4:1b:2c:56:57:36:3b:8f:50:26:a6:7e:95:4b:06:d6:
         67:1d:0e:b4:58:a7:c1:c2:37:ca:87:3a:86:e7:07:df:3c:55:
         13:18:e8:5b:8d:08:d2:30:04:1b:de:3f:f3:eb:21:6f:99:e2:
         5c:52:6f:37:1f:d9:93:45:e5:81:9d:4b:db:0c:6f:55:fd:e4:
         6d:98:ac:88:7b:1a:48:b8:e8:24:ed:a6:cf:e9:f6:e2:a9:71:
         60:cd:d7:90:0e:c3:92:b3:57:ec:da:2f:48:84:47:c8:91:c4:
         50:1e:f0:c4:91:99:8b:4f:f1:35:65:c1:ab:a2:4a:12:1b:cf:
         bd:68:1c:bf
-----BEGIN CERTIFICATE-----
MIIDoDCCAoigAwIBAgIUYM88r8IBp+5I7YOcExnwwf+vE2gwDQYJKoZIhvcNAQEL
BQAwFzEVMBMGA1UEAwwMSW50ZXJtZWRpYXRlMB4XDTE1MDEwMTEyMDAwMFoXDTE2
MDEwMTEyMDAwMFowETEPMA0GA1UEAwwGVGFyZ2V0MIIBIjANBgkqhkiG9w0BAQEF
AAOCAQ8AMIIBCgKCAQEA73eU6GjFfh2brhDN1buWJwwFF/TsvNp9KOW35Y/a2K56
KtLjFZsSYnkCYT0/i2RO+33hWb0vg63TuOVFM8QTX3nvij7AOSCB4pi55slgto60
v7QrVa6xfCHT/uzwVjH+ChnELFSkl6qEooP4WprzEbitOxQ6aFpyJElvb1oCOZEH
CcsYVxMepFQDMVy26X14Lei6L3AXCgMRqpDHXvAbf1Y59eAfHjONIzDmerpeykYz
EwRcZbC+U3+rp5+N+71G5YdEMVXln5d+o+xpqNeLR65IrnRQXldVMco27EOh3WGy
GBJqKQtjJNVxTdrnDw3jLKp2a/ksk8L6+UAsGzRlUwIDAQABo4HpMIHmMB0GA1Ud
DgQWBBT6La/gX46OGHr7r/7ZyaNiqrgqGDAfBgNVHSMEGDAWgBTMcmDwjYzLqWz/
CVfzav4pRiQmWzA/BggrBgEFBQcBAQQzMDEwLwYIKwYBBQUHMAKGI2h0dHA6Ly91
cmwtZm9yLWFpYS9JbnRlcm1lZGlhdGUuY2VyMDQGA1UdHwQtMCswKaAnoCWGI2h0
dHA6Ly91cmwtZm9yLWNybC9JbnRlcm1lZGlhdGUuY3JsMA4GA1UdDwEB/wQEAwIF
oDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDQYJKoZIhvcNAQELBQAD
ggEBAAHbrh7bnDcqHPZEyFXLOZ2I9XInlIDsUc6Gw2S5f/bCgzicZidElDEovO03
3L18hNXGRHTvgVQBeFXQWWCZvKu7akULUPne1D7O7Romj4tsLTqy6EsXxLjWQU76
jK9wRG8wcfWSYn7bGfJnGOkXppi3nn7faQzZrWW4C1wdwKlM5BssVlc2O49QJqZ+
lUsG1mcdDrRYp8HCN8qHOobnB988VRMY6FuNCNIwBBveP/PrIW+Z4lxSbzcf2ZNF
5YGdS9sMb1X95G2YrIh7Gki46CTtps/p9uKpcWDN15AOw5KzV+zaL0iER8iRxFAe
8MSRmYtP8TVlwauiShIbz71oHL8=
-----END CERTIFICATE-----

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            52:7c:19:50:39:c6:38:0e:14:9f:b2:17:b8:81:f7:cf:f8:66:d1:93
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=Root
        Validity
            Not Before: Jan  1 12:00:00 2015 GMT
            Not After : Jan  1 12:00:00 2016 GMT
        Subject: CN=Intermediate
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:9d:2b:d3:86:6e:f6:af:a0:b2:08:23:93:2a:c0:
                    1c:02:49:c6:ef:a9:64:39:4e:80:6a:36:56:e5:a5:
                    93:0e:45:12:ad:05:41:9a:5d:cc:ed:af:2e:7b:b6:
                    cf:bd:14:79:8f:a5:59:16:02:fe:23:5c:2b:e4:90:
                    d2:67:7c:bb:74:cb:37:20:40:c4:62:fa:e0:23:f1:
                    a4:89:70:fe:54:ea:ea:3b:d7:1a:7a:9b:0d:a1:74:
                    44:89:c9:58:3d:d6:99:42:6b:e5:da:f5:f1:0c:33:
                    26:11:e1:d4:2b:33:d7:2e:be:b9:42:5d:e7:b2:ce:
                    52:37:51:30:17:80:a7:77:e0:ca:55:ac:42:12:23:
                    17:d6:42:5a:6d:55:1f:f8:f1:13:7b:73:7d:b6:ff:
                    b7:67:72:d8:55:af:8e:60:71:cd:b8:a4:72:9f:84:
                    d8:6f:a6:62:1a:0f:79:de:3e:27:a5:08:bc:90:20:
                    f6:a3:b2:64:21:92:3e:1c:8c:35:f5:38:16:96:18:
                    f1:5c:de:fd:89:b6:4d:ca:00:0a:59:91:84:9a:28:
                    ea:1c:8f:0d:14:aa:4b:e5:56:66:9e:40:36:35:ff:
                    dc:72:f3:ea:e3:7f:b4:73:64:66:ff:81:16:b9:93:
                    8e:61:30:7f:15:2e:1d:6c:23:90:76:56:b2:60:11:
                    91:19
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier: 
                CC:72:60:F0:8D:8C:CB:A9:6C:FF:09:57:F3:6A:FE:29:46:24:26:5B
            X509v3 Authority Key Identifier: 
                keyid:D2:45:64:68:86:8E:07:F2:AF:BF:0B:F3:DD:7F:61:1D:4B:6B:4A:CD

            Authority Information Access: 
                CA Issuers - URI:http://url-for-aia/Root.cer

            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://url-for-crl/Root.crl

            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
    Signature Algorithm: sha256WithRSAEncryption
         5b:49:de:7d:16:a8:c3:64:98:51:6a:fb:78:1f:7d:f8:0b:d8:
         6b:50:2a:4e:e1:69:05:44:19:1e:5a:79:88:b4:8f:41:60:0d:
         a7:b5:91:7a:0d:3a:55:bc:58:fc:c7:90:ef:27:66:3d:f9:74:
         85:51:5d:67:fd:c8:b6:8a:78:88:70:f4:21:41:c6:30:34:fa:
         c0:5a:23:36:06:4a:e9:ed:00:6a:a8:39:54:ac:a9:83:77:01:
         8b:72:07:f6:a3:2c:67:d6:36:12:ad:f3:e9:93:52:7d:ee:5f:
         64:8d:91:b2:14:ea:ea:44:fe:49:b7:23:d6:8a:5c:ba:4a:9f:
         dc:35:9b:ae:8f:f7:5a:1b:b4:d1:a9:2f:15:d5:83:4b:07:67:
         ed:5f:65:d7:02:54:59:1f:ad:fd:f3:05:39:72:77:8e:dd:34:
         bd:c4:51:b7:68:e6:df:f2:5d:4e:51:16:d2:a2:47:42:41:b3:
         56:49:36:28:5a:30:d6:e6:f5:6b:d9:5a:87:b1:54:a3:cd:1a:
         24:f8:b9:02:ca:fa:1c:36:00:00:95:47:1b:c6:62:39:59:be:
         fe:1e:bf:56:a5:5b:0a:b3:25:79:8c:9d:b6:68:4e:fc:63:e0:
         ef:12:c3:91:3f:fe:7d:6e:97:c4:e2:54:ce:06:bd:7e:29:b9:
         06:e7:be:35
-----BEGIN CERTIFICATE-----
MIIDgDCCAmigAwIBAgIUUnwZUDnGOA4Un7IXuIH3z/hm0ZMwDQYJKoZIhvcNAQEL
BQAwDzENMAsGA1UEAwwEUm9vdDAeFw0xNTAxMDExMjAwMDBaFw0xNjAxMDExMjAw
MDBaMBcxFTATBgNVBAMMDEludGVybWVkaWF0ZTCCASIwDQYJKoZIhvcNAQEBBQAD
ggEPADCCAQoCggEBAJ0r04Zu9q+gsggjkyrAHAJJxu+pZDlOgGo2VuWlkw5FEq0F
QZpdzO2vLnu2z70UeY+lWRYC/iNcK+SQ0md8u3TLNyBAxGL64CPxpIlw/lTq6jvX
GnqbDaF0RInJWD3WmUJr5dr18QwzJhHh1Csz1y6+uUJd57LOUjdRMBeAp3fgylWs
QhIjF9ZCWm1VH/jxE3tzfbb/t2dy2FWvjmBxzbikcp+E2G+mYhoPed4+J6UIvJAg
9qOyZCGSPhyMNfU4FpYY8Vze/Ym2TcoAClmRhJoo6hyPDRSqS+VWZp5ANjX/3HLz
6uN/tHNkZv+BFrmTjmEwfxUuHWwjkHZWsmARkRkCAwEAAaOByzCByDAdBgNVHQ4E
FgQUzHJg8I2My6ls/wlX82r+KUYkJlswHwYDVR0jBBgwFoAU0kVkaIaOB/Kvvwvz
3X9hHUtrSs0wNwYIKwYBBQUHAQEEKzApMCcGCCsGAQUFBzAChhtodHRwOi8vdXJs
LWZvci1haWEvUm9vdC5jZXIwLAYDVR0fBCUwIzAhoB+gHYYbaHR0cDovL3VybC1m
b3ItY3JsL1Jvb3QuY3JsMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/
MA0GCSqGSIb3DQEBCwUAA4IBAQBbSd59FqjDZJhRavt4H334C9hrUCpO4WkFRBke
WnmItI9BYA2ntZF6DTpVvFj8x5DvJ2Y9+XSFUV1n/ci2iniIcPQhQcYwNPrAWiM2
Bkrp7QBqqDlUrKmDdwGLcgf2oyxn1jYSrfPpk1J97l9kjZGyFOrqRP5JtyPWily6
Sp/cNZuuj/daG7TRqS8V1YNLB2ftX2XXAlRZH6398wU5cneO3TS9xFG3aObf8l1O
URbSokdCQbNWSTYoWjDW5vVr2VqHsVSjzRok+LkCyvocNgAAlUcbxmI5Wb7+Hr9W
pVsKsyV5jJ22aE78Y+DvEsORP/59bpfE4lTOBr1+KbkG5741
-----END CERTIFICATE-----

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            52:7c:19:50:39:c6:38:0e:14:9f:b2:17:b8:81:f7:cf:f8:66:d1:92
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=Root
        Validity
            Not Before: Jan  1 12:00:00 2015 GMT
            Not After : Jan  1 12:00:00 2016 GMT
        Subject: CN=Root
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:ef:5f:3f:57:00:ad:2d:82:81:56:19:c0:da:98:
                    72:8b:7f:4b:4f:37:f2:d9:0e:b3:3c:7b:73:d3:8a:
                    ad:5a:94:9c:37:0b:bc:68:4b:40:ac:a9:d1:1f:1b:
                    35:6a:74:50:6b:91:c2:30:e5:a6:88:87:90:f4:dc:
                    8d:09:49:6a:3e:f0:fe:cf:bb:b3:3b:33:c1:2a:2e:
                    b9:fb:9b:6a:db:2a:a6:9f:87:46:6a:b0:7d:87:c6:
                    63:27:cd:58:e7:55:7d:c5:6c:d8:ac:c7:10:fb:6e:
                    68:40:9d:69:bf:8f:a0:9c:36:d8:7a:dc:fb:14:48:
                    f4:96:5d:c2:0e:8f:e9:2f:1d:08:13:04:a0:1d:03:
                    78:b8:a6:97:15:13:0f:91:4e:9e:18:00:96:9f:94:
                    e6:ad:02:2e:c7:60:c8:ed:50:54:02:2e:b2:6b:6e:
                    d5:78:7f:7a:74:20:20:f6:9c:fa:98:17:b3:8f:fd:
                    92:01:3d:ff:e6:56:fa:45:28:41:b1:3c:ba:4a:ef:
                    bc:ff:4c:1e:d3:96:bc:5d:a6:06:7d:27:d8:66:13:
                    e0:40:74:83:8c:f4:89:c9:8d:8a:13:b7:98:88:32:
                    6c:51:6c:15:92:1c:1b:e7:f7:08:a6:35:81:b4:24:
                    be:45:10:1f:ff:c9:e4:4d:35:b7:4d:3c:ae:54:d2:
                    ee:6f
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier: 
                D2:45:64:68:86:8E:07:F2:AF:BF:0B:F3:DD:7F:61:1D:4B:6B:4A:CD
            X509v3 Authority Key Identifier: 
                keyid:D2:45:64:68:86:8E:07:F2:AF:BF:0B:F3:DD:7F:61:1D:4B:6B:4A:CD

            Authority Information Access: 
                CA Issuers - URI:http://url-for-aia/Root.cer

            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://url-for-crl/Root.crl

            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
    Signature Algorithm: sha256WithRSAEncryption
         c3:93:57:64:ef:a6:14:46:fd:70:31:57:e2:2d:d1:84:90:c6:
         24:77:6a:9d:e4:a7:39:fc:ae:f6:22:f8:ae:04:d9:8b:9c:e7:
         c1:52:b4:1a:39:85:62:30:25:49:40:86:87:48:5f:fb:f8:4e:
         19:fe:68:1f:07:17:e2:a7:09:86:f1:49:58:6e:3e:04:49:01:
         87:2a:92:c1:38:45:4a:fa:e9:36:f5:30:77:01:2a:03:2b:ae:
         9c:bd:bc:a4:61:43:4c:a4:90:97:f6:d8:40:8b:20:c2:7e:cf:
         ed:83:08:b8:c5:68:4f:a4:69:83:16:c5:b5:e5:9a:a3:4d:f2:
         4f:f4:51:3a:19:3f:8b:83:3e:04:c3:bf:7a:bf:cf:37:86:0f:
         a1:79:a7:bf:c9:9c:7b:52:b9:84:ca:97:51:89:f2:25:bd:15:
         4f:61:d5:bd:f0:86:e9:14:b3:77:92:11:d5:b9:7a:58:6c:b3:
         96:16:9b:ac:db:e1:97:f7:5e:f9:58:e7:b3:4b:35:05:e6:aa:
         a4:ca:a5:1a:48:b0:28:84:81:7f:32:07:39:cd:31:32:b5:c8:
         da:0c:07:c2:1a:01:26:41:76:26:68:36:50:2c:34:5c:3f:b7:
         05:4a:50:d3:37:ec:8c:d1:84:3c:25:f0:d9:ef:5e:0d:b9:b1:
         f9:d9:d6:3a
-----BEGIN CERTIFICATE-----
MIIDeDCCAmCgAwIBAgIUUnwZUDnGOA4Un7IXuIH3z/hm0ZIwDQYJKoZIhvcNAQEL
BQAwDzENMAsGA1UEAwwEUm9vdDAeFw0xNTAxMDExMjAwMDBaFw0xNjAxMDExMjAw
MDBaMA8xDTALBgNVBAMMBFJvb3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
AoIBAQDvXz9XAK0tgoFWGcDamHKLf0tPN/LZDrM8e3PTiq1alJw3C7xoS0CsqdEf
GzVqdFBrkcIw5aaIh5D03I0JSWo+8P7Pu7M7M8EqLrn7m2rbKqafh0ZqsH2HxmMn
zVjnVX3FbNisxxD7bmhAnWm/j6CcNth63PsUSPSWXcIOj+kvHQgTBKAdA3i4ppcV
Ew+RTp4YAJaflOatAi7HYMjtUFQCLrJrbtV4f3p0ICD2nPqYF7OP/ZIBPf/mVvpF
KEGxPLpK77z/TB7TlrxdpgZ9J9hmE+BAdIOM9InJjYoTt5iIMmxRbBWSHBvn9wim
NYG0JL5FEB//yeRNNbdNPK5U0u5vAgMBAAGjgcswgcgwHQYDVR0OBBYEFNJFZGiG
jgfyr78L891/YR1La0rNMB8GA1UdIwQYMBaAFNJFZGiGjgfyr78L891/YR1La0rN
MDcGCCsGAQUFBwEBBCswKTAnBggrBgEFBQcwAoYbaHR0cDovL3VybC1mb3ItYWlh
L1Jvb3QuY2VyMCwGA1UdHwQlMCMwIaAfoB2GG2h0dHA6Ly91cmwtZm9yLWNybC9S
b290LmNybDAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG
9w0BAQsFAAOCAQEAw5NXZO+mFEb9cDFX4i3RhJDGJHdqneSnOfyu9iL4rgTZi5zn
wVK0GjmFYjAlSUCGh0hf+/hOGf5oHwcX4qcJhvFJWG4+BEkBhyqSwThFSvrpNvUw
dwEqAyuunL28pGFDTKSQl/bYQIsgwn7P7YMIuMVoT6RpgxbFteWao03yT/RROhk/
i4M+BMO/er/PN4YPoXmnv8mce1K5hMqXUYnyJb0VT2HVvfCG6RSzd5IR1bl6WGyz
lhabrNvhl/de+Vjns0s1BeaqpMqlGkiwKISBfzIHOc0xMrXI2gwHwhoBJkF2Jmg2
UCw0XD+3BUpQ0zfsjNGEPCXw2e9eDbmx+dnWOg==
-----END CERTIFICATE-----