[Created by: ./generate-chains.py]

Certificate chain where the target certificate contains an
MSApplicationPolicies extension that is marked as critical and
also contains an extendedKeyUsage extension.

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            5f:ba:be:0d:0e:03:3a:d8:7e:ea:37:ed:8a:b5:54:b2:6f:ae:c4:ab
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=Intermediate
        Validity
            Not Before: Oct  5 12:00:00 2021 GMT
            Not After : Oct  5 12:00:00 2022 GMT
        Subject: CN=Target
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:dc:ef:39:2d:3e:82:ed:41:24:9b:af:4e:c7:37:
                    e2:c9:a9:47:32:16:5b:52:3f:82:14:63:bb:6e:b1:
                    cc:9d:a2:b4:df:90:42:73:14:c1:24:98:83:e5:58:
                    c4:bd:4c:0d:01:31:b4:c5:4e:a2:a4:e1:8f:ff:d8:
                    95:4a:7f:90:50:18:81:74:04:e0:29:82:d7:a8:be:
                    c7:b5:c8:43:93:31:99:33:04:7b:b1:3f:8c:77:44:
                    f3:66:85:93:10:88:79:f2:30:1d:a5:3a:78:82:ae:
                    bb:b4:21:2a:64:00:5b:42:07:04:b7:a0:fb:f0:4b:
                    74:e8:23:53:da:8e:0c:39:da:f2:b2:df:d3:88:91:
                    11:b5:60:68:26:8e:58:81:a3:d3:06:2a:e7:e0:df:
                    ba:8b:07:0f:d2:98:6c:6a:4b:54:9d:b6:34:e0:99:
                    c4:04:b8:02:04:ec:7d:e5:04:f2:4f:1e:50:38:d4:
                    f0:ca:c7:ca:e8:b3:93:d5:40:14:1b:77:25:45:38:
                    77:49:92:b4:41:fa:f4:3e:cc:d7:b2:35:72:94:67:
                    cf:76:e8:e3:9e:5a:67:d9:6d:44:e9:12:4c:40:f6:
                    56:b9:21:d7:51:4e:68:f5:5b:70:c4:9a:82:38:12:
                    e3:60:f3:dc:c3:90:e1:41:31:d5:db:8b:87:96:b6:
                    45:75
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier: 
                08:E2:C4:5E:E8:5A:C1:B2:5A:B5:7E:1C:A2:8B:FB:31:B2:94:58:70
            X509v3 Authority Key Identifier: 
                C9:C5:2E:C4:9B:E4:8A:91:4B:38:EF:9B:47:0E:C5:43:F2:B2:5E:9B
            Authority Information Access: 
                CA Issuers - URI:http://url-for-aia/Intermediate.cer
            X509v3 CRL Distribution Points: 
                Full Name:
                  URI:http://url-for-crl/Intermediate.crl
            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment
            X509v3 Extended Key Usage: 
                TLS Web Server Authentication
            1.3.6.1.4.1.311.21.10: critical
                ....
    Signature Algorithm: sha256WithRSAEncryption
    Signature Value:
        18:3c:42:10:c8:bf:96:cf:17:23:7f:43:d4:bb:5b:d4:fb:4e:
        fe:ae:33:af:b3:15:0b:42:20:71:29:08:a6:98:0f:1e:89:b8:
        d3:f7:d9:12:13:80:3e:d7:db:a7:ee:1e:d8:fd:e7:ba:47:b1:
        5e:cb:42:30:d7:f6:6c:1e:5b:93:0f:4e:d0:76:2a:24:c8:9c:
        d2:fc:39:05:70:47:71:17:05:67:d1:b5:91:b3:40:12:c7:b8:
        9c:de:71:7e:f6:b6:cc:68:f1:44:bb:2e:08:e6:b8:39:37:b4:
        90:00:0c:f9:56:9d:e0:83:fc:14:1c:0d:e5:1f:e3:7f:6d:4d:
        0c:9d:58:5f:cf:78:9a:d1:f6:bb:56:b7:dd:e2:33:74:f6:25:
        06:42:1f:f4:66:74:c0:56:a5:f9:31:16:70:c8:55:eb:fa:b3:
        02:4f:c5:46:c4:86:42:ac:29:7c:5e:40:97:e2:11:a2:d0:2a:
        60:64:07:fc:f3:8f:d9:ca:64:6d:ec:8e:43:38:ab:6b:d4:62:
        93:4a:e4:06:e2:3c:82:4a:3f:af:ea:78:41:51:28:84:69:87:
        1f:52:7b:00:aa:67:05:ec:1f:02:8d:31:34:ae:5e:f5:81:17:
        de:72:5a:ef:8d:32:90:fd:fb:c8:a1:b7:eb:31:9c:a8:b2:36:
        bd:08:c2:44
-----BEGIN CERTIFICATE-----
MIIDrDCCApSgAwIBAgIUX7q+DQ4DOth+6jftirVUsm+uxKswDQYJKoZIhvcNAQEL
BQAwFzEVMBMGA1UEAwwMSW50ZXJtZWRpYXRlMB4XDTIxMTAwNTEyMDAwMFoXDTIy
MTAwNTEyMDAwMFowETEPMA0GA1UEAwwGVGFyZ2V0MIIBIjANBgkqhkiG9w0BAQEF
AAOCAQ8AMIIBCgKCAQEA3O85LT6C7UEkm69OxzfiyalHMhZbUj+CFGO7brHMnaK0
35BCcxTBJJiD5VjEvUwNATG0xU6ipOGP/9iVSn+QUBiBdATgKYLXqL7HtchDkzGZ
MwR7sT+Md0TzZoWTEIh58jAdpTp4gq67tCEqZABbQgcEt6D78Et06CNT2o4MOdry
st/TiJERtWBoJo5YgaPTBirn4N+6iwcP0phsaktUnbY04JnEBLgCBOx95QTyTx5Q
ONTwysfK6LOT1UAUG3clRTh3SZK0Qfr0PszXsjVylGfPdujjnlpn2W1E6RJMQPZW
uSHXUU5o9VtwxJqCOBLjYPPcw5DhQTHV24uHlrZFdQIDAQABo4H1MIHyMB0GA1Ud
DgQWBBQI4sRe6FrBslq1fhyii/sxspRYcDAfBgNVHSMEGDAWgBTJxS7Em+SKkUs4
75tHDsVD8rJemzA/BggrBgEFBQcBAQQzMDEwLwYIKwYBBQUHMAKGI2h0dHA6Ly91
cmwtZm9yLWFpYS9JbnRlcm1lZGlhdGUuY2VyMDQGA1UdHwQtMCswKaAnoCWGI2h0
dHA6Ly91cmwtZm9yLWNybC9JbnRlcm1lZGlhdGUuY3JsMA4GA1UdDwEB/wQEAwIF
oDATBgNVHSUEDDAKBggrBgEFBQcDATAUBgkrBgEEAYI3FQoBAf8EBAECAwQwDQYJ
KoZIhvcNAQELBQADggEBABg8QhDIv5bPFyN/Q9S7W9T7Tv6uM6+zFQtCIHEpCKaY
Dx6JuNP32RITgD7X26fuHtj957pHsV7LQjDX9mweW5MPTtB2KiTInNL8OQVwR3EX
BWfRtZGzQBLHuJzecX72tsxo8US7LgjmuDk3tJAADPlWneCD/BQcDeUf439tTQyd
WF/PeJrR9rtWt93iM3T2JQZCH/RmdMBWpfkxFnDIVev6swJPxUbEhkKsKXxeQJfi
EaLQKmBkB/zzj9nKZG3sjkM4q2vUYpNK5AbiPIJKP6/qeEFRKIRphx9SewCqZwXs
HwKNMTSuXvWBF95yWu+NMpD9+8iht+sxnKiyNr0IwkQ=
-----END CERTIFICATE-----

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7c:33:ee:4f:ce:05:2b:47:de:9a:ce:d8:36:a9:40:43:e0:1c:fc:42
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=Root
        Validity
            Not Before: Oct  5 12:00:00 2021 GMT
            Not After : Oct  5 12:00:00 2022 GMT
        Subject: CN=Intermediate
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:97:4d:9e:0c:43:a9:0d:f0:5c:d4:7b:cf:3a:a0:
                    8b:01:6e:cb:30:1c:92:3b:b7:49:92:4b:36:7e:bb:
                    e3:e6:03:98:60:87:ba:52:12:98:9c:6b:e5:f4:6e:
                    98:46:8c:fc:c7:c2:af:c5:70:b3:be:bd:b9:ba:7e:
                    15:29:e3:34:96:2f:94:70:9f:70:35:a2:da:70:c8:
                    62:e0:30:78:5d:b6:81:ee:91:4a:cc:b4:65:62:f3:
                    1b:99:c2:65:8b:d5:79:3f:d6:86:e5:58:d5:60:ef:
                    27:0a:9c:80:a6:49:a2:d0:50:a6:ae:1f:e3:d4:e3:
                    63:4c:33:9d:ab:8e:b2:37:da:9a:7e:8b:36:c3:5f:
                    24:9b:b1:51:2b:2a:b4:fd:1f:2a:99:ee:21:71:c8:
                    61:65:1c:56:be:7f:91:46:49:15:82:08:50:54:15:
                    83:3f:ab:ef:0b:3d:87:ab:d3:82:2d:25:d2:2f:de:
                    82:95:b9:25:53:98:4a:16:b8:f8:d4:f7:26:9a:a8:
                    97:5e:15:ec:25:5c:fa:f6:2a:f5:2e:48:2c:11:2e:
                    b2:b4:5c:79:4a:c1:66:49:c6:3a:cd:fd:8b:e3:87:
                    f2:5f:99:3f:37:00:1e:22:64:86:0a:d0:fb:79:fa:
                    2e:e1:54:ac:38:ba:82:c6:bc:48:9c:5e:aa:a3:e9:
                    27:df
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier: 
                C9:C5:2E:C4:9B:E4:8A:91:4B:38:EF:9B:47:0E:C5:43:F2:B2:5E:9B
            X509v3 Authority Key Identifier: 
                C9:1B:0A:27:43:C5:EF:E5:72:BC:94:85:D7:E5:F8:99:E1:50:24:8D
            Authority Information Access: 
                CA Issuers - URI:http://url-for-aia/Root.cer
            X509v3 CRL Distribution Points: 
                Full Name:
                  URI:http://url-for-crl/Root.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
    Signature Algorithm: sha256WithRSAEncryption
    Signature Value:
        0b:d4:58:a1:0b:ab:a6:15:de:06:ff:0d:2a:90:7b:b7:33:53:
        47:15:9e:58:69:68:d8:29:72:bc:8f:30:26:c4:51:f0:9c:51:
        d8:7a:01:25:1f:ef:7b:4e:80:4d:f8:71:98:94:3a:2e:05:0e:
        95:6f:9b:84:32:bd:2e:4b:de:f2:20:ba:39:9e:81:94:0c:35:
        02:48:93:be:de:8f:d1:10:69:3d:77:e0:2d:19:6a:f5:fb:50:
        eb:8d:07:14:73:db:66:0f:20:82:8f:a5:1d:8a:0b:b5:62:63:
        bf:c0:a1:61:f3:b6:9b:f9:72:60:40:66:9a:c4:59:fe:61:60:
        76:64:d9:e2:de:59:55:2a:12:25:e9:21:0a:ed:50:e1:5e:71:
        57:b9:4e:a9:d8:92:9a:47:79:ac:88:d0:4d:7c:96:73:d4:b6:
        38:b5:39:54:49:63:2a:f8:e8:7e:87:3e:49:26:d6:0f:35:79:
        ad:df:b2:3b:08:61:e5:b8:ca:ee:58:71:b3:5c:bd:18:02:ae:
        ec:c6:4c:69:65:c3:81:eb:52:0d:d9:9c:12:65:10:28:50:2d:
        4c:95:8f:df:e0:f5:57:7e:55:9d:98:74:2e:d9:a9:d6:0c:6d:
        12:61:f9:b6:6d:51:f8:be:27:93:f8:49:06:72:cc:39:a2:a8:
        2d:ac:fb:0a
-----BEGIN CERTIFICATE-----
MIIDgDCCAmigAwIBAgIUfDPuT84FK0fems7YNqlAQ+Ac/EIwDQYJKoZIhvcNAQEL
BQAwDzENMAsGA1UEAwwEUm9vdDAeFw0yMTEwMDUxMjAwMDBaFw0yMjEwMDUxMjAw
MDBaMBcxFTATBgNVBAMMDEludGVybWVkaWF0ZTCCASIwDQYJKoZIhvcNAQEBBQAD
ggEPADCCAQoCggEBAJdNngxDqQ3wXNR7zzqgiwFuyzAckju3SZJLNn674+YDmGCH
ulISmJxr5fRumEaM/MfCr8Vws769ubp+FSnjNJYvlHCfcDWi2nDIYuAweF22ge6R
Ssy0ZWLzG5nCZYvVeT/WhuVY1WDvJwqcgKZJotBQpq4f49TjY0wznauOsjfamn6L
NsNfJJuxUSsqtP0fKpnuIXHIYWUcVr5/kUZJFYIIUFQVgz+r7ws9h6vTgi0l0i/e
gpW5JVOYSha4+NT3Jpqol14V7CVc+vYq9S5ILBEusrRceUrBZknGOs39i+OH8l+Z
PzcAHiJkhgrQ+3n6LuFUrDi6gsa8SJxeqqPpJ98CAwEAAaOByzCByDAdBgNVHQ4E
FgQUycUuxJvkipFLOO+bRw7FQ/KyXpswHwYDVR0jBBgwFoAUyRsKJ0PF7+VyvJSF
1+X4meFQJI0wNwYIKwYBBQUHAQEEKzApMCcGCCsGAQUFBzAChhtodHRwOi8vdXJs
LWZvci1haWEvUm9vdC5jZXIwLAYDVR0fBCUwIzAhoB+gHYYbaHR0cDovL3VybC1m
b3ItY3JsL1Jvb3QuY3JsMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/
MA0GCSqGSIb3DQEBCwUAA4IBAQAL1FihC6umFd4G/w0qkHu3M1NHFZ5YaWjYKXK8
jzAmxFHwnFHYegElH+97ToBN+HGYlDouBQ6Vb5uEMr0uS97yILo5noGUDDUCSJO+
3o/REGk9d+AtGWr1+1DrjQcUc9tmDyCCj6Udigu1YmO/wKFh87ab+XJgQGaaxFn+
YWB2ZNni3llVKhIl6SEK7VDhXnFXuU6p2JKaR3msiNBNfJZz1LY4tTlUSWMq+Oh+
hz5JJtYPNXmt37I7CGHluMruWHGzXL0YAq7sxkxpZcOB61IN2ZwSZRAoUC1MlY/f
4PVXflWdmHQu2anWDG0SYfm2bVH4vieT+EkGcsw5oqgtrPsK
-----END CERTIFICATE-----

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7c:33:ee:4f:ce:05:2b:47:de:9a:ce:d8:36:a9:40:43:e0:1c:fc:41
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=Root
        Validity
            Not Before: Oct  5 12:00:00 2021 GMT
            Not After : Oct  5 12:00:00 2022 GMT
        Subject: CN=Root
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:c2:4d:67:95:5f:5c:db:5a:55:2a:c8:09:cf:ed:
                    c9:1c:4c:38:f4:53:65:24:ec:f0:15:8d:fb:c5:1b:
                    42:fe:b1:59:1d:16:6b:7d:59:62:72:62:9c:b5:08:
                    c9:c7:f8:d3:02:29:0c:c1:9d:ff:1d:f7:e3:f3:bd:
                    33:08:05:ac:2a:52:46:48:f9:41:a7:9a:00:59:78:
                    68:17:6a:17:59:0b:b2:e7:3a:de:a7:2d:b4:19:76:
                    52:85:22:0c:d5:15:10:7c:a3:25:ca:75:ed:b5:74:
                    96:a0:f4:8d:0c:17:42:8e:44:c2:9a:53:ee:58:4a:
                    f3:0f:ec:c1:20:d9:f7:9b:07:13:b5:59:a7:8d:91:
                    5e:51:a8:12:7e:db:e9:ad:ec:da:e7:52:b5:2b:85:
                    7c:dd:77:8f:6f:6a:12:24:b7:f5:d7:74:7d:98:e9:
                    21:1c:21:ba:e7:fc:52:e4:8d:05:a7:1a:9f:98:a3:
                    76:6c:a5:3a:5a:a1:6b:ae:be:bc:25:a5:eb:c1:ad:
                    79:5c:d1:03:ca:c9:a6:d3:14:8d:f4:ed:28:6a:16:
                    9a:f7:48:32:9b:d2:93:c5:44:f3:23:b0:4b:ff:b1:
                    aa:06:d3:ba:4e:e4:e3:3d:29:e2:d4:39:05:49:ba:
                    1f:4d:f1:7a:c6:df:95:45:bd:07:34:c2:13:14:6c:
                    6c:23
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier: 
                C9:1B:0A:27:43:C5:EF:E5:72:BC:94:85:D7:E5:F8:99:E1:50:24:8D
            X509v3 Authority Key Identifier: 
                C9:1B:0A:27:43:C5:EF:E5:72:BC:94:85:D7:E5:F8:99:E1:50:24:8D
            Authority Information Access: 
                CA Issuers - URI:http://url-for-aia/Root.cer
            X509v3 CRL Distribution Points: 
                Full Name:
                  URI:http://url-for-crl/Root.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
    Signature Algorithm: sha256WithRSAEncryption
    Signature Value:
        4b:0a:eb:db:66:15:dd:13:18:04:94:a1:cc:10:25:94:50:1d:
        0c:f8:01:c9:c7:ca:00:11:a2:8c:29:39:99:e6:17:0c:4f:8d:
        bc:71:ee:b2:b6:9b:22:6b:fa:ec:cf:fd:c6:e8:e5:87:86:8e:
        99:b7:eb:cf:74:25:29:c2:71:76:5a:22:48:49:f1:5a:37:e6:
        f7:ff:99:78:10:ca:6f:c0:73:73:71:48:8e:07:50:63:56:98:
        79:f2:f6:46:9a:1c:be:ef:71:c3:37:89:21:6c:a6:d5:24:72:
        8d:79:5a:ec:ef:a1:50:a5:f0:ae:37:af:18:ce:e4:81:2c:30:
        83:1e:14:e0:95:70:b0:ab:c2:8f:72:38:17:07:7a:51:2f:3e:
        d3:30:3a:aa:02:6c:35:fe:f3:29:52:fd:b3:fc:d0:d0:80:35:
        3b:bb:58:4e:d0:78:2a:d9:eb:a6:75:aa:4f:df:3c:66:1a:3a:
        03:98:69:cf:97:15:bf:06:ff:9f:6b:4c:78:b6:b2:9c:f9:80:
        41:3d:0f:25:77:63:3c:d8:15:f6:38:b8:fb:94:b1:bf:a9:39:
        ef:18:47:f2:88:7d:a6:88:f6:4e:58:c1:59:db:29:dd:e0:3a:
        6f:5b:e2:3e:2b:60:2e:58:18:1c:72:3a:99:eb:99:bb:e6:d7:
        c5:07:d5:fa
-----BEGIN CERTIFICATE-----
MIIDeDCCAmCgAwIBAgIUfDPuT84FK0fems7YNqlAQ+Ac/EEwDQYJKoZIhvcNAQEL
BQAwDzENMAsGA1UEAwwEUm9vdDAeFw0yMTEwMDUxMjAwMDBaFw0yMjEwMDUxMjAw
MDBaMA8xDTALBgNVBAMMBFJvb3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
AoIBAQDCTWeVX1zbWlUqyAnP7ckcTDj0U2Uk7PAVjfvFG0L+sVkdFmt9WWJyYpy1
CMnH+NMCKQzBnf8d9+PzvTMIBawqUkZI+UGnmgBZeGgXahdZC7LnOt6nLbQZdlKF
IgzVFRB8oyXKde21dJag9I0MF0KORMKaU+5YSvMP7MEg2febBxO1WaeNkV5RqBJ+
2+mt7NrnUrUrhXzdd49vahIkt/XXdH2Y6SEcIbrn/FLkjQWnGp+Yo3ZspTpaoWuu
vrwlpevBrXlc0QPKyabTFI307ShqFpr3SDKb0pPFRPMjsEv/saoG07pO5OM9KeLU
OQVJuh9N8XrG35VFvQc0whMUbGwjAgMBAAGjgcswgcgwHQYDVR0OBBYEFMkbCidD
xe/lcryUhdfl+JnhUCSNMB8GA1UdIwQYMBaAFMkbCidDxe/lcryUhdfl+JnhUCSN
MDcGCCsGAQUFBwEBBCswKTAnBggrBgEFBQcwAoYbaHR0cDovL3VybC1mb3ItYWlh
L1Jvb3QuY2VyMCwGA1UdHwQlMCMwIaAfoB2GG2h0dHA6Ly91cmwtZm9yLWNybC9S
b290LmNybDAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG
9w0BAQsFAAOCAQEASwrr22YV3RMYBJShzBAllFAdDPgBycfKABGijCk5meYXDE+N
vHHusrabImv67M/9xujlh4aOmbfrz3QlKcJxdloiSEnxWjfm9/+ZeBDKb8Bzc3FI
jgdQY1aYefL2Rpocvu9xwzeJIWym1SRyjXla7O+hUKXwrjevGM7kgSwwgx4U4JVw
sKvCj3I4Fwd6US8+0zA6qgJsNf7zKVL9s/zQ0IA1O7tYTtB4KtnrpnWqT988Zho6
A5hpz5cVvwb/n2tMeLaynPmAQT0PJXdjPNgV9ji4+5Sxv6k57xhH8oh9poj2TljB
Wdsp3eA6b1viPitgLlgYHHI6meuZu+bXxQfV+g==
-----END CERTIFICATE-----