OSX/utilities/SecAppleAnchor.c

   1 /*
   2  * Copyright (c) 2015-2016 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24 #include <AssertMacros.h>
  25
  26 #include "SecAppleAnchorPriv.h"
  27 #include "SecInternalReleasePriv.h"
  28 #include "SecCFWrappers.h"
  29 #include <Security/SecCertificatePriv.h>
  30
  31 static CFDictionaryRef getAnchors(void);
  32
  33
  34 bool
  35 SecIsAppleTrustAnchorData(CFDataRef cert,
  36                           SecAppleTrustAnchorFlags flags)
  37 {
  38     CFDictionaryRef anchors = NULL;
  39     CFTypeRef value = NULL;
  40     bool res = false;
  41
  42     anchors = getAnchors();
  43     require(anchors, fail);
  44
  45     value = CFDictionaryGetValue(anchors, cert);
  46     require_quiet(value, fail);
  47
  48     require(isBoolean(value), fail);
  49
  50     res = CFBooleanGetValue(value);
  51
  52
  53  fail:
  54     return res;
  55 }
  56
  57
  58 bool
  59 SecIsAppleTrustAnchor(SecCertificateRef cert,
  60                       SecAppleTrustAnchorFlags flags)
  61 {
  62     CFDataRef data;
  63     bool res = false;
  64
  65     data = SecCertificateCopySHA256Digest(cert);
  66     require(data, fail);
  67
  68     res = SecIsAppleTrustAnchorData(data, flags);
  69
  70 fail:
  71     CFReleaseNull(data);
  72     return res;
  73 }
  74
  75 /* subject:/C=US/O=Apple Inc./OU=Apple Certification Authority/CN=Apple Root CA */
  76 /* SKID: 2B:D0:69:47:94:76:09:FE:F4:6B:8D:2E:40:A6:F7:47:4D:7F:08:5E */
  77 /* Not Before: Apr 25 21:40:36 2006 GMT, Not After : Feb  9 21:40:36 2035 GMT */
  78 /* Signature Algorithm: sha1WithRSAEncryption */
  79 static const unsigned char AppleRootCAHash[32] = {
  80     0xb0, 0xb1, 0x73, 0x0e, 0xcb, 0xc7, 0xff, 0x45, 0x05, 0x14, 0x2c, 0x49, 0xf1, 0x29, 0x5e, 0x6e,
  81     0xda, 0x6b, 0xca, 0xed, 0x7e, 0x2c, 0x68, 0xc5, 0xbe, 0x91, 0xb5, 0xa1, 0x10, 0x01, 0xf0, 0x24
  82 };
  83
  84 /* subject:/CN=Apple Root CA - G2/OU=Apple Certification Authority/O=Apple Inc./C=US */
  85 /* SKID: C4:99:13:6C:18:03:C2:7B:C0:A3:A0:0D:7F:72:80:7A:1C:77:26:8D */
  86 /* Not Before: Apr 30 18:10:09 2014 GMT, Not After : Apr 30 18:10:09 2039 GMT */
  87 /* Signature Algorithm: sha384WithRSAEncryption */
  88 static const unsigned char AppleRootG2Hash[32] = {
  89     0xc2, 0xb9, 0xb0, 0x42, 0xdd, 0x57, 0x83, 0x0e, 0x7d, 0x11, 0x7d, 0xac, 0x55, 0xac, 0x8a, 0xe1,
  90     0x94, 0x07, 0xd3, 0x8e, 0x41, 0xd8, 0x8f, 0x32, 0x15, 0xbc, 0x3a, 0x89, 0x04, 0x44, 0xa0, 0x50
  91 };
  92
  93 /* subject:/CN=Apple Root CA - G3/OU=Apple Certification Authority/O=Apple Inc./C=US */
  94 /* SKID: BB:B0:DE:A1:58:33:88:9A:A4:8A:99:DE:BE:BD:EB:AF:DA:CB:24:AB */
  95 /* Not Before: Apr 30 18:19:06 2014 GMT, Not After : Apr 30 18:19:06 2039 GMT */
  96 /* Signature Algorithm: ecdsa-with-SHA38 */
  97 static const unsigned char AppleRootG3Hash[32] = {
  98     0x63, 0x34, 0x3a, 0xbf, 0xb8, 0x9a, 0x6a, 0x03, 0xeb, 0xb5, 0x7e, 0x9b, 0x3f, 0x5f, 0xa7, 0xbe,
  99     0x7c, 0x4f, 0x5c, 0x75, 0x6f, 0x30, 0x17, 0xb3, 0xa8, 0xc4, 0x88, 0xc3, 0x65, 0x3e, 0x91, 0x79
 100 };
 101
 102
 103 static void
 104 addAnchor(CFMutableDictionaryRef anchors,
 105           const unsigned char *trustAnchor, size_t size,
 106           bool production)
 107 {
 108     CFDataRef value = CFDataCreateWithBytesNoCopy(NULL, trustAnchor, size, kCFAllocatorNull);
 109     if (CFDictionaryGetValue(anchors, value))
 110         abort();
 111     CFDictionarySetValue(anchors, value, production ? kCFBooleanTrue : kCFBooleanFalse);
 112     CFReleaseSafe(value);
 113 }
 114
 115
 116 static CFDictionaryRef
 117 getAnchors(void)
 118 {
 119     static dispatch_once_t onceToken;
 120     static CFDictionaryRef anchors = NULL;
 121     dispatch_once(&onceToken, ^{
 122         CFMutableDictionaryRef temp;
 123
 124         temp = CFDictionaryCreateMutableForCFTypes(NULL);
 125         addAnchor(temp, AppleRootCAHash, sizeof(AppleRootCAHash), true);
 126         addAnchor(temp, AppleRootG2Hash, sizeof(AppleRootG2Hash), true);
 127         addAnchor(temp, AppleRootG3Hash, sizeof(AppleRootG3Hash), true);
 128
 129
 130         anchors = temp;
 131     });
 132     return anchors;
 133 }
 134
 135 /* subject:/C=US/O=Apple Inc./OU=Apple Certification Authority/CN=Apple Root CA */
 136 /* SKID: 2B:D0:69:47:94:76:09:FE:F4:6B:8D:2E:40:A6:F7:47:4D:7F:08:5E */
 137 /* Not Before: Apr 25 21:40:36 2006 GMT, Not After : Feb  9 21:40:36 2035 GMT */
 138 /* Signature Algorithm: sha1WithRSAEncryption */
 139 static const unsigned char AppleRootCA[1215]={
 140     0x30,0x82,0x04,0xBB,0x30,0x82,0x03,0xA3,0xA0,0x03,0x02,0x01,0x02,0x02,0x01,0x02,
 141     0x30,0x0D,0x06,0x09,0x2A,0x86,0x48,0x86,0xF7,0x0D,0x01,0x01,0x05,0x05,0x00,0x30,
 142     0x62,0x31,0x0B,0x30,0x09,0x06,0x03,0x55,0x04,0x06,0x13,0x02,0x55,0x53,0x31,0x13,
 143     0x30,0x11,0x06,0x03,0x55,0x04,0x0A,0x13,0x0A,0x41,0x70,0x70,0x6C,0x65,0x20,0x49,
 144     0x6E,0x63,0x2E,0x31,0x26,0x30,0x24,0x06,0x03,0x55,0x04,0x0B,0x13,0x1D,0x41,0x70,
 145     0x70,0x6C,0x65,0x20,0x43,0x65,0x72,0x74,0x69,0x66,0x69,0x63,0x61,0x74,0x69,0x6F,
 146     0x6E,0x20,0x41,0x75,0x74,0x68,0x6F,0x72,0x69,0x74,0x79,0x31,0x16,0x30,0x14,0x06,
 147     0x03,0x55,0x04,0x03,0x13,0x0D,0x41,0x70,0x70,0x6C,0x65,0x20,0x52,0x6F,0x6F,0x74,
 148     0x20,0x43,0x41,0x30,0x1E,0x17,0x0D,0x30,0x36,0x30,0x34,0x32,0x35,0x32,0x31,0x34,
 149     0x30,0x33,0x36,0x5A,0x17,0x0D,0x33,0x35,0x30,0x32,0x30,0x39,0x32,0x31,0x34,0x30,
 150     0x33,0x36,0x5A,0x30,0x62,0x31,0x0B,0x30,0x09,0x06,0x03,0x55,0x04,0x06,0x13,0x02,
 151     0x55,0x53,0x31,0x13,0x30,0x11,0x06,0x03,0x55,0x04,0x0A,0x13,0x0A,0x41,0x70,0x70,
 152     0x6C,0x65,0x20,0x49,0x6E,0x63,0x2E,0x31,0x26,0x30,0x24,0x06,0x03,0x55,0x04,0x0B,
 153     0x13,0x1D,0x41,0x70,0x70,0x6C,0x65,0x20,0x43,0x65,0x72,0x74,0x69,0x66,0x69,0x63,
 154     0x61,0x74,0x69,0x6F,0x6E,0x20,0x41,0x75,0x74,0x68,0x6F,0x72,0x69,0x74,0x79,0x31,
 155     0x16,0x30,0x14,0x06,0x03,0x55,0x04,0x03,0x13,0x0D,0x41,0x70,0x70,0x6C,0x65,0x20,
 156     0x52,0x6F,0x6F,0x74,0x20,0x43,0x41,0x30,0x82,0x01,0x22,0x30,0x0D,0x06,0x09,0x2A,
 157     0x86,0x48,0x86,0xF7,0x0D,0x01,0x01,0x01,0x05,0x00,0x03,0x82,0x01,0x0F,0x00,0x30,
 158     0x82,0x01,0x0A,0x02,0x82,0x01,0x01,0x00,0xE4,0x91,0xA9,0x09,0x1F,0x91,0xDB,0x1E,
 159     0x47,0x50,0xEB,0x05,0xED,0x5E,0x79,0x84,0x2D,0xEB,0x36,0xA2,0x57,0x4C,0x55,0xEC,
 160     0x8B,0x19,0x89,0xDE,0xF9,0x4B,0x6C,0xF5,0x07,0xAB,0x22,0x30,0x02,0xE8,0x18,0x3E,
 161     0xF8,0x50,0x09,0xD3,0x7F,0x41,0xA8,0x98,0xF9,0xD1,0xCA,0x66,0x9C,0x24,0x6B,0x11,
 162     0xD0,0xA3,0xBB,0xE4,0x1B,0x2A,0xC3,0x1F,0x95,0x9E,0x7A,0x0C,0xA4,0x47,0x8B,0x5B,
 163     0xD4,0x16,0x37,0x33,0xCB,0xC4,0x0F,0x4D,0xCE,0x14,0x69,0xD1,0xC9,0x19,0x72,0xF5,
 164     0x5D,0x0E,0xD5,0x7F,0x5F,0x9B,0xF2,0x25,0x03,0xBA,0x55,0x8F,0x4D,0x5D,0x0D,0xF1,
 165     0x64,0x35,0x23,0x15,0x4B,0x15,0x59,0x1D,0xB3,0x94,0xF7,0xF6,0x9C,0x9E,0xCF,0x50,
 166     0xBA,0xC1,0x58,0x50,0x67,0x8F,0x08,0xB4,0x20,0xF7,0xCB,0xAC,0x2C,0x20,0x6F,0x70,
 167     0xB6,0x3F,0x01,0x30,0x8C,0xB7,0x43,0xCF,0x0F,0x9D,0x3D,0xF3,0x2B,0x49,0x28,0x1A,
 168     0xC8,0xFE,0xCE,0xB5,0xB9,0x0E,0xD9,0x5E,0x1C,0xD6,0xCB,0x3D,0xB5,0x3A,0xAD,0xF4,
 169     0x0F,0x0E,0x00,0x92,0x0B,0xB1,0x21,0x16,0x2E,0x74,0xD5,0x3C,0x0D,0xDB,0x62,0x16,
 170     0xAB,0xA3,0x71,0x92,0x47,0x53,0x55,0xC1,0xAF,0x2F,0x41,0xB3,0xF8,0xFB,0xE3,0x70,
 171     0xCD,0xE6,0xA3,0x4C,0x45,0x7E,0x1F,0x4C,0x6B,0x50,0x96,0x41,0x89,0xC4,0x74,0x62,
 172     0x0B,0x10,0x83,0x41,0x87,0x33,0x8A,0x81,0xB1,0x30,0x58,0xEC,0x5A,0x04,0x32,0x8C,
 173     0x68,0xB3,0x8F,0x1D,0xDE,0x65,0x73,0xFF,0x67,0x5E,0x65,0xBC,0x49,0xD8,0x76,0x9F,
 174     0x33,0x14,0x65,0xA1,0x77,0x94,0xC9,0x2D,0x02,0x03,0x01,0x00,0x01,0xA3,0x82,0x01,
 175     0x7A,0x30,0x82,0x01,0x76,0x30,0x0E,0x06,0x03,0x55,0x1D,0x0F,0x01,0x01,0xFF,0x04,
 176     0x04,0x03,0x02,0x01,0x06,0x30,0x0F,0x06,0x03,0x55,0x1D,0x13,0x01,0x01,0xFF,0x04,
 177     0x05,0x30,0x03,0x01,0x01,0xFF,0x30,0x1D,0x06,0x03,0x55,0x1D,0x0E,0x04,0x16,0x04,
 178     0x14,0x2B,0xD0,0x69,0x47,0x94,0x76,0x09,0xFE,0xF4,0x6B,0x8D,0x2E,0x40,0xA6,0xF7,
 179     0x47,0x4D,0x7F,0x08,0x5E,0x30,0x1F,0x06,0x03,0x55,0x1D,0x23,0x04,0x18,0x30,0x16,
 180     0x80,0x14,0x2B,0xD0,0x69,0x47,0x94,0x76,0x09,0xFE,0xF4,0x6B,0x8D,0x2E,0x40,0xA6,
 181     0xF7,0x47,0x4D,0x7F,0x08,0x5E,0x30,0x82,0x01,0x11,0x06,0x03,0x55,0x1D,0x20,0x04,
 182     0x82,0x01,0x08,0x30,0x82,0x01,0x04,0x30,0x82,0x01,0x00,0x06,0x09,0x2A,0x86,0x48,
 183     0x86,0xF7,0x63,0x64,0x05,0x01,0x30,0x81,0xF2,0x30,0x2A,0x06,0x08,0x2B,0x06,0x01,
 184     0x05,0x05,0x07,0x02,0x01,0x16,0x1E,0x68,0x74,0x74,0x70,0x73,0x3A,0x2F,0x2F,0x77,
 185     0x77,0x77,0x2E,0x61,0x70,0x70,0x6C,0x65,0x2E,0x63,0x6F,0x6D,0x2F,0x61,0x70,0x70,
 186     0x6C,0x65,0x63,0x61,0x2F,0x30,0x81,0xC3,0x06,0x08,0x2B,0x06,0x01,0x05,0x05,0x07,
 187     0x02,0x02,0x30,0x81,0xB6,0x1A,0x81,0xB3,0x52,0x65,0x6C,0x69,0x61,0x6E,0x63,0x65,
 188     0x20,0x6F,0x6E,0x20,0x74,0x68,0x69,0x73,0x20,0x63,0x65,0x72,0x74,0x69,0x66,0x69,
 189     0x63,0x61,0x74,0x65,0x20,0x62,0x79,0x20,0x61,0x6E,0x79,0x20,0x70,0x61,0x72,0x74,
 190     0x79,0x20,0x61,0x73,0x73,0x75,0x6D,0x65,0x73,0x20,0x61,0x63,0x63,0x65,0x70,0x74,
 191     0x61,0x6E,0x63,0x65,0x20,0x6F,0x66,0x20,0x74,0x68,0x65,0x20,0x74,0x68,0x65,0x6E,
 192     0x20,0x61,0x70,0x70,0x6C,0x69,0x63,0x61,0x62,0x6C,0x65,0x20,0x73,0x74,0x61,0x6E,
 193     0x64,0x61,0x72,0x64,0x20,0x74,0x65,0x72,0x6D,0x73,0x20,0x61,0x6E,0x64,0x20,0x63,
 194     0x6F,0x6E,0x64,0x69,0x74,0x69,0x6F,0x6E,0x73,0x20,0x6F,0x66,0x20,0x75,0x73,0x65,
 195     0x2C,0x20,0x63,0x65,0x72,0x74,0x69,0x66,0x69,0x63,0x61,0x74,0x65,0x20,0x70,0x6F,
 196     0x6C,0x69,0x63,0x79,0x20,0x61,0x6E,0x64,0x20,0x63,0x65,0x72,0x74,0x69,0x66,0x69,
 197     0x63,0x61,0x74,0x69,0x6F,0x6E,0x20,0x70,0x72,0x61,0x63,0x74,0x69,0x63,0x65,0x20,
 198     0x73,0x74,0x61,0x74,0x65,0x6D,0x65,0x6E,0x74,0x73,0x2E,0x30,0x0D,0x06,0x09,0x2A,
 199     0x86,0x48,0x86,0xF7,0x0D,0x01,0x01,0x05,0x05,0x00,0x03,0x82,0x01,0x01,0x00,0x5C,
 200     0x36,0x99,0x4C,0x2D,0x78,0xB7,0xED,0x8C,0x9B,0xDC,0xF3,0x77,0x9B,0xF2,0x76,0xD2,
 201     0x77,0x30,0x4F,0xC1,0x1F,0x85,0x83,0x85,0x1B,0x99,0x3D,0x47,0x37,0xF2,0xA9,0x9B,
 202     0x40,0x8E,0x2C,0xD4,0xB1,0x90,0x12,0xD8,0xBE,0xF4,0x73,0x9B,0xEE,0xD2,0x64,0x0F,
 203     0xCB,0x79,0x4F,0x34,0xD8,0xA2,0x3E,0xF9,0x78,0xFF,0x6B,0xC8,0x07,0xEC,0x7D,0x39,
 204     0x83,0x8B,0x53,0x20,0xD3,0x38,0xC4,0xB1,0xBF,0x9A,0x4F,0x0A,0x6B,0xFF,0x2B,0xFC,
 205     0x59,0xA7,0x05,0x09,0x7C,0x17,0x40,0x56,0x11,0x1E,0x74,0xD3,0xB7,0x8B,0x23,0x3B,
 206     0x47,0xA3,0xD5,0x6F,0x24,0xE2,0xEB,0xD1,0xB7,0x70,0xDF,0x0F,0x45,0xE1,0x27,0xCA,
 207     0xF1,0x6D,0x78,0xED,0xE7,0xB5,0x17,0x17,0xA8,0xDC,0x7E,0x22,0x35,0xCA,0x25,0xD5,
 208     0xD9,0x0F,0xD6,0x6B,0xD4,0xA2,0x24,0x23,0x11,0xF7,0xA1,0xAC,0x8F,0x73,0x81,0x60,
 209     0xC6,0x1B,0x5B,0x09,0x2F,0x92,0xB2,0xF8,0x44,0x48,0xF0,0x60,0x38,0x9E,0x15,0xF5,
 210     0x3D,0x26,0x67,0x20,0x8A,0x33,0x6A,0xF7,0x0D,0x82,0xCF,0xDE,0xEB,0xA3,0x2F,0xF9,
 211     0x53,0x6A,0x5B,0x64,0xC0,0x63,0x33,0x77,0xF7,0x3A,0x07,0x2C,0x56,0xEB,0xDA,0x0F,
 212     0x21,0x0E,0xDA,0xBA,0x73,0x19,0x4F,0xB5,0xD9,0x36,0x7F,0xC1,0x87,0x55,0xD9,0xA7,
 213     0x99,0xB9,0x32,0x42,0xFB,0xD8,0xD5,0x71,0x9E,0x7E,0xA1,0x52,0xB7,0x1B,0xBD,0x93,
 214     0x42,0x24,0x12,0x2A,0xC7,0x0F,0x1D,0xB6,0x4D,0x9C,0x5E,0x63,0xC8,0x4B,0x80,0x17,
 215     0x50,0xAA,0x8A,0xD5,0xDA,0xE4,0xFC,0xD0,0x09,0x07,0x37,0xB0,0x75,0x75,0x21,
 216 };
 217
 218 /* subject:/CN=Apple Root CA - G2/OU=Apple Certification Authority/O=Apple Inc./C=US */
 219 /* SKID: C4:99:13:6C:18:03:C2:7B:C0:A3:A0:0D:7F:72:80:7A:1C:77:26:8D */
 220 /* Not Before: Apr 30 18:10:09 2014 GMT, Not After : Apr 30 18:10:09 2039 GMT */
 221 /* Signature Algorithm: sha384WithRSAEncryption */
 222 static const unsigned char AppleRootG2[1430]={
 223     0x30,0x82,0x05,0x92,0x30,0x82,0x03,0x7A,0xA0,0x03,0x02,0x01,0x02,0x02,0x08,0x01,
 224     0xE0,0xE5,0xB5,0x83,0x67,0xA3,0xE0,0x30,0x0D,0x06,0x09,0x2A,0x86,0x48,0x86,0xF7,
 225     0x0D,0x01,0x01,0x0C,0x05,0x00,0x30,0x67,0x31,0x1B,0x30,0x19,0x06,0x03,0x55,0x04,
 226     0x03,0x0C,0x12,0x41,0x70,0x70,0x6C,0x65,0x20,0x52,0x6F,0x6F,0x74,0x20,0x43,0x41,
 227     0x20,0x2D,0x20,0x47,0x32,0x31,0x26,0x30,0x24,0x06,0x03,0x55,0x04,0x0B,0x0C,0x1D,
 228     0x41,0x70,0x70,0x6C,0x65,0x20,0x43,0x65,0x72,0x74,0x69,0x66,0x69,0x63,0x61,0x74,
 229     0x69,0x6F,0x6E,0x20,0x41,0x75,0x74,0x68,0x6F,0x72,0x69,0x74,0x79,0x31,0x13,0x30,
 230     0x11,0x06,0x03,0x55,0x04,0x0A,0x0C,0x0A,0x41,0x70,0x70,0x6C,0x65,0x20,0x49,0x6E,
 231     0x63,0x2E,0x31,0x0B,0x30,0x09,0x06,0x03,0x55,0x04,0x06,0x13,0x02,0x55,0x53,0x30,
 232     0x1E,0x17,0x0D,0x31,0x34,0x30,0x34,0x33,0x30,0x31,0x38,0x31,0x30,0x30,0x39,0x5A,
 233     0x17,0x0D,0x33,0x39,0x30,0x34,0x33,0x30,0x31,0x38,0x31,0x30,0x30,0x39,0x5A,0x30,
 234     0x67,0x31,0x1B,0x30,0x19,0x06,0x03,0x55,0x04,0x03,0x0C,0x12,0x41,0x70,0x70,0x6C,
 235     0x65,0x20,0x52,0x6F,0x6F,0x74,0x20,0x43,0x41,0x20,0x2D,0x20,0x47,0x32,0x31,0x26,
 236     0x30,0x24,0x06,0x03,0x55,0x04,0x0B,0x0C,0x1D,0x41,0x70,0x70,0x6C,0x65,0x20,0x43,
 237     0x65,0x72,0x74,0x69,0x66,0x69,0x63,0x61,0x74,0x69,0x6F,0x6E,0x20,0x41,0x75,0x74,
 238     0x68,0x6F,0x72,0x69,0x74,0x79,0x31,0x13,0x30,0x11,0x06,0x03,0x55,0x04,0x0A,0x0C,
 239     0x0A,0x41,0x70,0x70,0x6C,0x65,0x20,0x49,0x6E,0x63,0x2E,0x31,0x0B,0x30,0x09,0x06,
 240     0x03,0x55,0x04,0x06,0x13,0x02,0x55,0x53,0x30,0x82,0x02,0x22,0x30,0x0D,0x06,0x09,
 241     0x2A,0x86,0x48,0x86,0xF7,0x0D,0x01,0x01,0x01,0x05,0x00,0x03,0x82,0x02,0x0F,0x00,
 242     0x30,0x82,0x02,0x0A,0x02,0x82,0x02,0x01,0x00,0xD8,0x11,0x12,0x48,0x48,0xDA,0x29,
 243     0x8A,0x49,0xC5,0x1C,0xC7,0xEC,0x6E,0x33,0x6D,0xFE,0x4D,0xFB,0xE0,0x1C,0xDE,0xAC,
 244     0x5E,0xE2,0x36,0xA7,0x24,0xF9,0x7F,0x50,0x6B,0x4C,0xCE,0xB9,0x30,0x54,0x27,0xE5,
 245     0xB3,0xD6,0xED,0x25,0xE6,0x30,0xB6,0x05,0x37,0x5E,0x14,0x22,0x11,0xC5,0xE8,0xAA,
 246     0x1B,0xD2,0xFB,0xB2,0xD2,0x09,0x95,0x38,0xA4,0xEF,0x2A,0x49,0x8C,0x5D,0x3E,0x71,
 247     0x66,0x03,0x38,0xFB,0x16,0xF5,0x85,0x88,0xE4,0x5A,0x92,0x0C,0x04,0x32,0xF2,0xC8,
 248     0x40,0xFB,0x52,0x5F,0x9F,0xF6,0xC0,0xF1,0xE3,0xBA,0x45,0xA0,0x50,0xD5,0x12,0x8B,
 249     0xF2,0xDD,0xDE,0x91,0x86,0x23,0xF0,0xF5,0xB6,0x72,0x2E,0x01,0xDA,0x0B,0xF6,0x2E,
 250     0x39,0x08,0x5F,0x19,0xA1,0x63,0x41,0x0B,0x1C,0xA7,0x94,0xC1,0x86,0xC4,0x53,0x2F,
 251     0x76,0xF6,0x0A,0xD7,0x0C,0xD1,0x83,0x3F,0x1A,0x53,0x19,0xF3,0x57,0xD5,0x27,0x7F,
 252     0xFC,0x13,0xB8,0xF8,0x92,0x8D,0xFC,0xD3,0x28,0x43,0x3C,0xB5,0x68,0x00,0x25,0x5D,
 253     0x27,0x62,0xD3,0xDD,0x55,0xDD,0x44,0x20,0x90,0x83,0x35,0x93,0xC5,0xBF,0xB8,0x19,
 254     0xFB,0x6B,0xE3,0xDC,0x08,0x42,0xE6,0xAF,0x6D,0xFA,0x9E,0x40,0xCA,0x4E,0x85,0x85,
 255     0x78,0x49,0xB1,0xD7,0xC3,0xC1,0x30,0x39,0x32,0xAB,0x7E,0x5F,0xAA,0xD3,0x8B,0x6F,
 256     0x9F,0x2D,0x1A,0x21,0x68,0x70,0x67,0xB3,0xA3,0xF1,0x98,0x41,0x6D,0x91,0x7C,0xF8,
 257     0xD7,0xDB,0xA8,0xE7,0x5F,0x21,0x1A,0x8C,0x33,0xBF,0x31,0x74,0xB7,0xB8,0xD1,0xF4,
 258     0xE0,0x22,0xF4,0xBF,0x72,0x34,0xDF,0xF7,0x81,0x4D,0x71,0x7D,0x51,0xA1,0xE2,0xB3,
 259     0xF0,0xD3,0x28,0x16,0x73,0x6F,0xCD,0xCC,0xAD,0x37,0x7D,0x4E,0xEB,0xAD,0x40,0xE1,
 260     0x3F,0x81,0xFD,0xF7,0x3D,0x0A,0x3E,0xA2,0xF1,0xBD,0x31,0x96,0x29,0x59,0xDC,0xC2,
 261     0x19,0x80,0x8C,0x5B,0x74,0xC6,0x2C,0xD3,0x10,0x53,0x26,0x1D,0x14,0x4F,0xC4,0xD4,
 262     0x81,0x66,0x3C,0x87,0x67,0x33,0x27,0x14,0x08,0xE9,0xB4,0x77,0x84,0x34,0x52,0x8F,
 263     0x89,0xF8,0x68,0x98,0x17,0xBF,0xC3,0xBB,0xAA,0x13,0x93,0x1F,0x5D,0x54,0x2F,0xA8,
 264     0xC7,0x7C,0xFB,0x0D,0x14,0xBE,0x15,0x3D,0x24,0x34,0xF2,0x9A,0xDC,0x75,0x41,0x66,
 265     0x22,0xB4,0x01,0xD6,0x0B,0xAF,0x90,0x9E,0x0C,0xEA,0x62,0xF8,0x9B,0x59,0x3C,0x08,
 266     0xE2,0x96,0x34,0xE4,0x63,0xDE,0xBC,0x37,0xD4,0xEB,0x0C,0x88,0x03,0x43,0x0B,0x50,
 267     0xAF,0xA0,0x34,0xDD,0x50,0x4D,0x15,0xFB,0x5A,0x24,0xD8,0x0C,0xFA,0x0C,0x63,0x9E,
 268     0x1F,0x03,0xB1,0xE1,0xEE,0xE1,0xAA,0x43,0xF4,0x66,0x65,0x28,0x37,0x02,0x31,0xEF,
 269     0x01,0xC7,0x1E,0xD1,0xCC,0x9F,0x6D,0xCA,0x54,0x3A,0x40,0xDB,0xCE,0xCF,0x4F,0x46,
 270     0x8B,0x4A,0x65,0x9A,0x6A,0xC6,0x68,0x6C,0xD7,0xCC,0x99,0x1B,0x47,0xB0,0x72,0xC3,
 271     0x77,0x8F,0xC4,0xF7,0x61,0x9C,0x74,0x1F,0xCE,0xFD,0x6B,0xA1,0xC2,0x9C,0x94,0x82,
 272     0xAB,0x94,0xA2,0xE7,0xBD,0x1B,0xBA,0xB9,0x70,0x39,0x95,0x17,0xC5,0x29,0xF3,0x39,
 273     0x58,0x34,0xF5,0xC4,0xA4,0xC6,0x7B,0x60,0xB9,0x66,0x43,0x50,0x3F,0x6E,0x61,0xFC,
 274     0x0E,0xF9,0x86,0xAA,0x60,0x0C,0x43,0x4B,0x95,0x02,0x03,0x01,0x00,0x01,0xA3,0x42,
 275     0x30,0x40,0x30,0x1D,0x06,0x03,0x55,0x1D,0x0E,0x04,0x16,0x04,0x14,0xC4,0x99,0x13,
 276     0x6C,0x18,0x03,0xC2,0x7B,0xC0,0xA3,0xA0,0x0D,0x7F,0x72,0x80,0x7A,0x1C,0x77,0x26,
 277     0x8D,0x30,0x0F,0x06,0x03,0x55,0x1D,0x13,0x01,0x01,0xFF,0x04,0x05,0x30,0x03,0x01,
 278     0x01,0xFF,0x30,0x0E,0x06,0x03,0x55,0x1D,0x0F,0x01,0x01,0xFF,0x04,0x04,0x03,0x02,
 279     0x01,0x06,0x30,0x0D,0x06,0x09,0x2A,0x86,0x48,0x86,0xF7,0x0D,0x01,0x01,0x0C,0x05,
 280     0x00,0x03,0x82,0x02,0x01,0x00,0x51,0xA6,0xF3,0xE2,0xF4,0xB8,0x3D,0x93,0xBF,0x2D,
 281     0xCE,0x0F,0xBB,0x5B,0xE1,0x55,0x14,0x4E,0x4E,0xD1,0xE5,0xCE,0x79,0x5D,0x81,0x7F,
 282     0xFE,0xB6,0xF0,0x87,0x33,0xF8,0xEF,0x94,0xE5,0x7E,0xDC,0x6A,0x79,0xA7,0x1C,0xBE,
 283     0xF0,0x94,0xB7,0xA6,0xD1,0x30,0x9C,0xC8,0x0D,0x0A,0x75,0x9E,0x7D,0x92,0x95,0x7E,
 284     0x18,0x9D,0x7E,0xC2,0x71,0x69,0x7C,0x14,0xEA,0xCF,0x83,0x0E,0xE4,0x14,0x42,0x9E,
 285     0x74,0x0E,0x10,0xCD,0xAB,0x1A,0xBA,0x11,0x61,0x81,0x78,0xD8,0xF1,0xB5,0x45,0x40,
 286     0x78,0xAB,0xA8,0xC0,0xCE,0xFB,0x7D,0x63,0x37,0x68,0xF6,0xE7,0xFB,0xAF,0xC6,0xC3,
 287     0x4B,0xEC,0x1F,0x36,0x26,0x13,0x54,0x86,0x94,0x72,0xB2,0xEA,0x02,0xED,0x8B,0x6D,
 288     0xE4,0x0C,0xA6,0x90,0xC0,0x57,0x75,0xCF,0x8C,0x42,0x7D,0x5C,0xE6,0x31,0x7D,0xF3,
 289     0xC9,0xB2,0x92,0x69,0x46,0x0E,0x88,0xF8,0xE3,0x2D,0x42,0xB2,0x38,0xA8,0xA6,0x19,
 290     0x8D,0xF1,0x9F,0xCD,0xEE,0x6A,0x65,0xBC,0x1A,0xB0,0x25,0xBD,0xA7,0x29,0xFD,0xF4,
 291     0x3E,0xA2,0x75,0x49,0xBF,0x9E,0xDB,0xC9,0xF7,0xA7,0x1E,0x63,0x99,0xE1,0x5C,0x46,
 292     0xFF,0x92,0x05,0x8C,0xFA,0x1E,0x20,0xF9,0x86,0x94,0x56,0x25,0xE5,0xB4,0x57,0x38,
 293     0x9D,0xEB,0x88,0x64,0x14,0x21,0x49,0x21,0x39,0xBF,0x62,0x66,0xA9,0xB1,0xA2,0xCA,
 294     0x6F,0x3F,0x21,0x60,0xC5,0x89,0xD4,0x45,0x36,0xC8,0x98,0x7C,0xBD,0xF6,0xFE,0x99,
 295     0x49,0x80,0x3B,0x2C,0xD2,0xA6,0xA7,0x88,0x03,0x04,0x31,0x19,0xB7,0xB6,0x3A,0x61,
 296     0x45,0xFA,0xC9,0xF2,0x23,0xC8,0x63,0x73,0xBF,0x56,0x89,0x31,0xB0,0xD9,0x7C,0x62,
 297     0xA7,0x7B,0x15,0xA8,0x88,0x8A,0xAB,0x38,0x40,0xC2,0xCC,0x12,0xFF,0x15,0xE3,0xF0,
 298     0x37,0xDF,0x37,0x72,0xCB,0xCC,0x98,0xE6,0xBF,0xA2,0xBC,0xFA,0x26,0x8A,0x71,0x56,
 299     0xD7,0xE7,0x24,0x1B,0x48,0x44,0x3E,0x9E,0xFC,0x9F,0xC9,0xCC,0x1A,0xEC,0x43,0x3C,
 300     0x01,0xBC,0x34,0x78,0xC8,0x69,0xF5,0xC6,0xE6,0x56,0xEC,0x06,0x09,0x36,0x90,0xEB,
 301     0x14,0x4A,0x1B,0x5E,0xC9,0x88,0x23,0xDA,0x03,0x30,0x91,0x0B,0xB8,0x36,0x3E,0xF9,
 302     0xE7,0xB5,0x28,0x6F,0xBE,0x3F,0xEC,0x3C,0x8F,0x65,0x1D,0xE5,0xC0,0x1E,0x87,0xA4,
 303     0xAA,0xBA,0x98,0xFD,0x92,0xE3,0x6C,0x26,0x77,0xDD,0x06,0xB4,0x64,0x06,0x87,0xF4,
 304     0x4E,0xD6,0xBA,0x4A,0xAA,0x16,0xA8,0xF4,0x05,0x67,0x66,0x96,0xBA,0xE2,0x55,0x79,
 305     0xC3,0x2C,0x5D,0x49,0x8F,0x80,0x49,0x2B,0x8A,0x12,0xC7,0x76,0x80,0x51,0xDF,0xBA,
 306     0xBD,0x65,0x5D,0x3E,0x37,0x47,0x63,0x31,0xE9,0xE5,0xF4,0xC5,0x3F,0x4B,0xAD,0x04,
 307     0x8A,0x7A,0x71,0x2C,0xAF,0x09,0x43,0x37,0x0F,0xA8,0xE3,0x32,0x4F,0xF4,0x45,0xB6,
 308     0x6D,0x97,0x36,0xEC,0x84,0xF5,0x0A,0x01,0xEA,0x17,0xBB,0x85,0x8D,0x42,0x93,0x70,
 309     0xC3,0x50,0xE5,0x14,0x8B,0xBF,0x3F,0xC3,0x41,0x0F,0xDD,0x22,0x04,0x23,0x08,0x8A,
 310     0xBA,0x6D,0x71,0x44,0xAB,0x73,0x09,0x3A,0xC9,0xF9,0x52,0x80,0x09,0xDF,0xBA,0xE9,
 311     0xE6,0x16,0xCA,0x2E,0x2E,0x4C,0xB2,0xD3,0xDC,0xE5,0x04,0x54,0xB2,0xD4,0x34,0x80,
 312     0x32,0xB5,0xBC,0x0F,0x17,0xE1,
 313 };
 314
 315 /* subject:/CN=Apple Root CA - G3/OU=Apple Certification Authority/O=Apple Inc./C=US */
 316 /* SKID: BB:B0:DE:A1:58:33:88:9A:A4:8A:99:DE:BE:BD:EB:AF:DA:CB:24:AB */
 317 /* Not Before: Apr 30 18:19:06 2014 GMT, Not After : Apr 30 18:19:06 2039 GMT */
 318 /* Signature Algorithm: ecdsa-with-SHA38 */
 319 static const unsigned char AppleRootG3[583]={
 320     0x30,0x82,0x02,0x43,0x30,0x82,0x01,0xC9,0xA0,0x03,0x02,0x01,0x02,0x02,0x08,0x2D,
 321     0xC5,0xFC,0x88,0xD2,0xC5,0x4B,0x95,0x30,0x0A,0x06,0x08,0x2A,0x86,0x48,0xCE,0x3D,
 322     0x04,0x03,0x03,0x30,0x67,0x31,0x1B,0x30,0x19,0x06,0x03,0x55,0x04,0x03,0x0C,0x12,
 323     0x41,0x70,0x70,0x6C,0x65,0x20,0x52,0x6F,0x6F,0x74,0x20,0x43,0x41,0x20,0x2D,0x20,
 324     0x47,0x33,0x31,0x26,0x30,0x24,0x06,0x03,0x55,0x04,0x0B,0x0C,0x1D,0x41,0x70,0x70,
 325     0x6C,0x65,0x20,0x43,0x65,0x72,0x74,0x69,0x66,0x69,0x63,0x61,0x74,0x69,0x6F,0x6E,
 326     0x20,0x41,0x75,0x74,0x68,0x6F,0x72,0x69,0x74,0x79,0x31,0x13,0x30,0x11,0x06,0x03,
 327     0x55,0x04,0x0A,0x0C,0x0A,0x41,0x70,0x70,0x6C,0x65,0x20,0x49,0x6E,0x63,0x2E,0x31,
 328     0x0B,0x30,0x09,0x06,0x03,0x55,0x04,0x06,0x13,0x02,0x55,0x53,0x30,0x1E,0x17,0x0D,
 329     0x31,0x34,0x30,0x34,0x33,0x30,0x31,0x38,0x31,0x39,0x30,0x36,0x5A,0x17,0x0D,0x33,
 330     0x39,0x30,0x34,0x33,0x30,0x31,0x38,0x31,0x39,0x30,0x36,0x5A,0x30,0x67,0x31,0x1B,
 331     0x30,0x19,0x06,0x03,0x55,0x04,0x03,0x0C,0x12,0x41,0x70,0x70,0x6C,0x65,0x20,0x52,
 332     0x6F,0x6F,0x74,0x20,0x43,0x41,0x20,0x2D,0x20,0x47,0x33,0x31,0x26,0x30,0x24,0x06,
 333     0x03,0x55,0x04,0x0B,0x0C,0x1D,0x41,0x70,0x70,0x6C,0x65,0x20,0x43,0x65,0x72,0x74,
 334     0x69,0x66,0x69,0x63,0x61,0x74,0x69,0x6F,0x6E,0x20,0x41,0x75,0x74,0x68,0x6F,0x72,
 335     0x69,0x74,0x79,0x31,0x13,0x30,0x11,0x06,0x03,0x55,0x04,0x0A,0x0C,0x0A,0x41,0x70,
 336     0x70,0x6C,0x65,0x20,0x49,0x6E,0x63,0x2E,0x31,0x0B,0x30,0x09,0x06,0x03,0x55,0x04,
 337     0x06,0x13,0x02,0x55,0x53,0x30,0x76,0x30,0x10,0x06,0x07,0x2A,0x86,0x48,0xCE,0x3D,
 338     0x02,0x01,0x06,0x05,0x2B,0x81,0x04,0x00,0x22,0x03,0x62,0x00,0x04,0x98,0xE9,0x2F,
 339     0x3D,0x40,0x72,0xA4,0xED,0x93,0x22,0x72,0x81,0x13,0x1C,0xDD,0x10,0x95,0xF1,0xC5,
 340     0xA3,0x4E,0x71,0xDC,0x14,0x16,0xD9,0x0E,0xE5,0xA6,0x05,0x2A,0x77,0x64,0x7B,0x5F,
 341     0x4E,0x38,0xD3,0xBB,0x1C,0x44,0xB5,0x7F,0xF5,0x1F,0xB6,0x32,0x62,0x5D,0xC9,0xE9,
 342     0x84,0x5B,0x4F,0x30,0x4F,0x11,0x5A,0x00,0xFD,0x58,0x58,0x0C,0xA5,0xF5,0x0F,0x2C,
 343     0x4D,0x07,0x47,0x13,0x75,0xDA,0x97,0x97,0x97,0x6F,0x31,0x5C,0xED,0x2B,0x9D,0x7B,
 344     0x20,0x3B,0xD8,0xB9,0x54,0xD9,0x5E,0x99,0xA4,0x3A,0x51,0x0A,0x31,0xA3,0x42,0x30,
 345     0x40,0x30,0x1D,0x06,0x03,0x55,0x1D,0x0E,0x04,0x16,0x04,0x14,0xBB,0xB0,0xDE,0xA1,
 346     0x58,0x33,0x88,0x9A,0xA4,0x8A,0x99,0xDE,0xBE,0xBD,0xEB,0xAF,0xDA,0xCB,0x24,0xAB,
 347     0x30,0x0F,0x06,0x03,0x55,0x1D,0x13,0x01,0x01,0xFF,0x04,0x05,0x30,0x03,0x01,0x01,
 348     0xFF,0x30,0x0E,0x06,0x03,0x55,0x1D,0x0F,0x01,0x01,0xFF,0x04,0x04,0x03,0x02,0x01,
 349     0x06,0x30,0x0A,0x06,0x08,0x2A,0x86,0x48,0xCE,0x3D,0x04,0x03,0x03,0x03,0x68,0x00,
 350     0x30,0x65,0x02,0x31,0x00,0x83,0xE9,0xC1,0xC4,0x16,0x5E,0x1A,0x5D,0x34,0x18,0xD9,
 351     0xED,0xEF,0xF4,0x6C,0x0E,0x00,0x46,0x4B,0xB8,0xDF,0xB2,0x46,0x11,0xC5,0x0F,0xFD,
 352     0xE6,0x7A,0x8C,0xA1,0xA6,0x6B,0xCE,0xC2,0x03,0xD4,0x9C,0xF5,0x93,0xC6,0x74,0xB8,
 353     0x6A,0xDF,0xAA,0x23,0x15,0x02,0x30,0x6D,0x66,0x8A,0x10,0xCA,0xD4,0x0D,0xD4,0x4F,
 354     0xCD,0x8D,0x43,0x3E,0xB4,0x8A,0x63,0xA5,0x33,0x6E,0xE3,0x6D,0xDA,0x17,0xB7,0x64,
 355     0x1F,0xC8,0x53,0x26,0xF9,0x88,0x62,0x74,0x39,0x0B,0x17,0x5B,0xCB,0x51,0xA8,0x0C,
 356     0xE8,0x18,0x03,0xE7,0xA2,0xB2,0x28,
 357 };
 358
 359
 360 static void
 361 addCertificate(CFMutableArrayRef anchors,
 362                const unsigned char *anchor, size_t size) {
 363     SecCertificateRef cert = SecCertificateCreateWithBytes(NULL, anchor, size);
 364     if (CFArrayContainsValue(anchors, CFRangeMake(0, CFArrayGetCount(anchors)), cert)) {
 365         abort();
 366     }
 367     CFArrayAppendValue(anchors, cert);
 368     CFReleaseNull(cert);
 369 }
 370
 371 CFArrayRef SecGetAppleTrustAnchors(bool allowNonProduction)
 372 {
 373     static CFArrayRef anchors = NULL;
 374     static dispatch_once_t onceToken;
 375     dispatch_once(&onceToken, ^{
 376         CFMutableArrayRef temp = NULL;
 377         temp = CFArrayCreateMutableForCFTypesWithCapacity(NULL, 3);
 378
 379         addCertificate(temp, AppleRootCA, sizeof(AppleRootCA));
 380         addCertificate(temp, AppleRootG2, sizeof(AppleRootG2));
 381         addCertificate(temp, AppleRootG3, sizeof(AppleRootG3));
 382
 383         anchors = temp;
 384     });
 385     return anchors;
 386 }