Add check for sha1 CA certificate

[ehelms]

No description provided.

[ekohl]

I just saw http://sven.stormbind.net/blog/posts/pkix_look_into_cert_chains/ as a nice way to inspect a full chain

[ekohl]

Please also test this where the chain is one certificate signed by SHA256 and one by SHA1. In reality I think the intermediate is more likely to be SHA256 with a SHA1 root. I think your current code only verifies the first certificate (intermediate) and it will miss the root, which the JIRA issue told us was the actual cause.

[ehelms]

I just saw http://sven.stormbind.net/blog/posts/pkix_look_into_cert_chains/ as a nice way to inspect a full chain

I'll take a look at this method - this isn't the first issue we've had with not checking the full chain as it's not been an easy thing to do.

[ehelms]

Updated with a bundle and checks on the bundle.

[ehelms]

@ekohl @evgeni Can you re-review please?

[ekohl]

Tests aren't happy with my suggestions :)

[ekohl]

@evgeni mind giving it a final read through?

[evgeni]

nits in the test fixtures, but nothing serious