react-native-audio-browser 0.2.0-next.1 → 0.2.0-next.11

package/android/src/test/java/com/audiobrowser/tls/AiaCertChaserTest.kt

@@ -7,12 +7,98 @@ import java.security.cert.PKIXParameters
 import java.security.cert.TrustAnchor
 import java.security.cert.X509Certificate
 import java.util.Date
+import javax.security.auth.x500.X500Principal
 import org.junit.Assert.assertEquals
 import org.junit.Assert.assertThrows
 import org.junit.Test
+import org.mockito.Mockito.mock
+import org.mockito.Mockito.`when`
 
 class AiaCertChaserTest {
 
+  /**
+   * A certificate whose AIA extension value is exactly [extensionValue].
+   *
+   * Subject and issuer are stubbed to distinct principals on purpose: an unstubbed mock answers
+   * null to both, which `completeChain` would read as a self-signed root and stop on before
+   * fetching anything.
+   */
+  private fun certWithAia(extensionValue: ByteArray): X509Certificate =
+    mock(X509Certificate::class.java).also {
+      `when`(it.getExtensionValue("1.3.6.1.5.5.7.1.1")).thenReturn(extensionValue)
+      `when`(it.subjectX500Principal).thenReturn(X500Principal("CN=leaf"))
+      `when`(it.issuerX500Principal).thenReturn(X500Principal("CN=issuer"))
+    }
+
+  /** A DER tag-length-value, with the length in whichever form fits. */
+  private fun der(tag: Int, content: ByteArray): ByteArray {
+    val length =
+      when (val n = content.size) {
+        in 0..0x7F -> byteArrayOf(n.toByte())
+        in 0x80..0xFF -> byteArrayOf(0x81.toByte(), n.toByte())
+        in 0x100..0xFFFF -> byteArrayOf(0x82.toByte(), (n shr 8).toByte(), n.toByte())
+        else -> byteArrayOf(0x83.toByte(), (n shr 16).toByte(), (n shr 8).toByte(), n.toByte())
+      }
+    return byteArrayOf(tag.toByte()) + length + content
+  }
+
+  /** A well-formed AIA extension value listing [urls] as caIssuers locations. */
+  private fun aiaExtension(urls: List<String>): ByteArray {
+    val caIssuersOid = byteArrayOf(0x2B, 0x06, 0x01, 0x05, 0x05, 0x07, 0x30, 0x02)
+    val descriptions =
+      urls.fold(ByteArray(0)) { acc, url ->
+        acc + der(0x30, der(0x06, caIssuersOid) + der(0x86, url.toByteArray(Charsets.US_ASCII)))
+      }
+    return der(0x04, der(0x30, descriptions))
+  }
+
+  @Test
+  fun `the AIA fixture builder round-trips through the parser`() {
+    // Guards the two tests below: if this builder were malformed they would pass by parsing
+    // nothing at all, rather than by the cap doing its job.
+    val urls = listOf("http://ca1.example/i.crt", "http://ca2.example/i.crt")
+
+    assertEquals(urls, AiaCertChaser.extractCaIssuerUrls(certWithAia(aiaExtension(urls))))
+  }
+
+  @Test(timeout = 5_000)
+  fun `a negative long-form length does not hang the parser`() {
+    // OCTET STRING { SEQUENCE { tag 0x00, long-form length 0xFFFFFFFA = -6 } }.
+    // The length's four bytes shift into a negative Int, so `pos += len` rewinds the
+    // reader by exactly the six bytes it just consumed: the tag is not a SEQUENCE, the
+    // loop `continue`s, and the reader is back where it started with more input to read.
+    val aia =
+      byteArrayOf(
+        0x04,
+        0x08,
+        0x30,
+        0x06,
+        0x00,
+        0x84.toByte(),
+        0xFF.toByte(),
+        0xFF.toByte(),
+        0xFF.toByte(),
+        0xFA.toByte(),
+      )
+
+    assertEquals(emptyList<String>(), AiaCertChaser.extractCaIssuerUrls(certWithAia(aia)))
+  }
+
+  @Test(timeout = 5_000)
+  fun `a length running past the buffer is treated as no AIA`() {
+    // SEQUENCE claiming 0x7F content bytes inside a 2-byte buffer.
+    val aia = byteArrayOf(0x04, 0x04, 0x30, 0x02, 0x30, 0x7F)
+
+    assertEquals(emptyList<String>(), AiaCertChaser.extractCaIssuerUrls(certWithAia(aia)))
+  }
+
+  @Test(timeout = 5_000)
+  fun `truncated DER is treated as no AIA`() {
+    val aia = byteArrayOf(0x04, 0x08, 0x30)
+
+    assertEquals(emptyList<String>(), AiaCertChaser.extractCaIssuerUrls(certWithAia(aia)))
+  }
+
   @Test
   fun `extracts CA Issuers URL from real leaf certificate AIA extension`() {
     val leaf = CertFixtures.cert("stationplaylist-leaf.pem")
@@ -27,7 +113,7 @@ class AiaCertChaserTest {
     val leaf = CertFixtures.cert("stationplaylist-leaf.pem")
     val r13 = CertFixtures.cert("letsencrypt-r13.pem")
     // Fetcher knows only the R13 URL (the leaf's AIA pointer); empty for the root URL.
-    val fetch = { url: String ->
+    val fetch = { url: String, _: Long ->
       if (url == "http://r13.i.lencr.org/") listOf(r13) else emptyList()
     }
 
@@ -44,8 +130,8 @@ class AiaCertChaserTest {
 
     // A PKCS#7-style bundle where the genuine issuer is not first must still be selected.
     val completed =
-      AiaCertChaser.completeChain(listOf(leaf)) {
-        if (it == "http://r13.i.lencr.org/") listOf(unrelated, r13) else emptyList()
+      AiaCertChaser.completeChain(listOf(leaf)) { url, _ ->
+        if (url == "http://r13.i.lencr.org/") listOf(unrelated, r13) else emptyList()
       }
 
     assertEquals(listOf(leaf, r13), completed)
@@ -57,7 +143,7 @@ class AiaCertChaserTest {
     var fetches = 0
 
     val completed =
-      AiaCertChaser.completeChain(listOf(root)) {
+      AiaCertChaser.completeChain(listOf(root)) { _, _ ->
         fetches++
         emptyList()
       }
@@ -66,11 +152,115 @@ class AiaCertChaserTest {
     assertEquals(0, fetches)
   }
 
+  @Test
+  fun `completeChain stops at a chain that already reaches a trust anchor`() {
+    val leaf = CertFixtures.cert("stationplaylist-leaf.pem")
+    val r13 = CertFixtures.cert("letsencrypt-r13.pem")
+    val root = CertFixtures.cert("isrg-root-x1.pem")
+    val fetched = mutableListOf<String>()
+
+    // R13's own AIA points at the ISRG root, so without knowing the anchors this walks one hop
+    // too far and pays for a second blocking fetch on the ordinary rescue path.
+    val completed =
+      AiaCertChaser.completeChain(
+        listOf(leaf),
+        anchorSubjects = setOf(root.subjectX500Principal),
+      ) { url, _ ->
+        fetched.add(url)
+        if (url == "http://r13.i.lencr.org/") listOf(r13) else listOf(root)
+      }
+
+    assertEquals(listOf(leaf, r13), completed)
+    assertEquals(listOf("http://r13.i.lencr.org/"), fetched)
+  }
+
+  @Test
+  fun `completeChain fetches nothing when the presented chain is already anchored`() {
+    val leaf = CertFixtures.cert("stationplaylist-leaf.pem")
+    val r13 = CertFixtures.cert("letsencrypt-r13.pem")
+    val root = CertFixtures.cert("isrg-root-x1.pem")
+    var fetches = 0
+
+    // The shape of every non-path failure — expiry, hostname mismatch, CT — where the server
+    // sent a complete chain and validation failed for some other reason.
+    val completed =
+      AiaCertChaser.completeChain(
+        listOf(leaf, r13),
+        anchorSubjects = setOf(root.subjectX500Principal),
+      ) { _, _ ->
+        fetches++
+        emptyList()
+      }
+
+    assertEquals(listOf(leaf, r13), completed)
+    assertEquals(0, fetches)
+  }
+
+  @Test
+  fun `completeChain tries only a few of a certificate's CA-Issuers URLs`() {
+    // The extension is authored by the server that just failed validation, and nothing limits
+    // how many URLs it lists. Each one costs a blocking connect on the handshake thread, so
+    // hundreds of them are a denial of service whatever each individual fetch costs.
+    val manyUrls = (1..500).map { "http://ca$it.example/issuer.crt" }
+    val cert = certWithAia(aiaExtension(manyUrls))
+    val fetched = mutableListOf<String>()
+
+    AiaCertChaser.completeChain(listOf(cert)) { url, _ ->
+      fetched.add(url)
+      emptyList()
+    }
+
+    assertEquals(AiaCertChaser.MAX_URLS_PER_CERT, fetched.size)
+  }
+
+  @Test
+  fun `duplicate CA-Issuers URLs do not consume the URL cap`() {
+    // 500 copies of one dead URL followed by a distinct one: the cap must buy distinct hosts,
+    // not three visits to the same dead one.
+    val urls = List(500) { "http://ca.example/issuer.crt" } + "http://ca-b.example/issuer.crt"
+    val cert = certWithAia(aiaExtension(urls))
+    val fetched = mutableListOf<String>()
+
+    AiaCertChaser.completeChain(listOf(cert)) { url, _ ->
+      fetched.add(url)
+      emptyList()
+    }
+
+    assertEquals(listOf("http://ca.example/issuer.crt", "http://ca-b.example/issuer.crt"), fetched)
+  }
+
+  @Test
+  fun `completeChain stops fetching once its wall-clock budget is spent`() {
+    val cert = certWithAia(aiaExtension((1..500).map { "http://ca$it.example/issuer.crt" }))
+    var fetches = 0
+    var nanos = 0L
+    val deadlines = mutableListOf<Long>()
+
+    // Each fetch "takes" 8s against a 20s budget, so the walk must stop after a handful even
+    // though the URL cap alone would have allowed more.
+    AiaCertChaser.completeChain(
+      listOf(cert),
+      maxUrlsPerCert = 500,
+      budgetMs = 20_000,
+      nowNanos = { nanos },
+    ) { _, deadline ->
+      fetches++
+      deadlines.add(deadline)
+      nanos += 8_000_000_000
+      emptyList()
+    }
+
+    assertEquals(3, fetches)
+    // Every fetch is handed the same walk-wide deadline, so it can clip its own I/O to it —
+    // the budget bounds the fetches themselves, not just how many of them start.
+    assertEquals(listOf(20_000_000_000L, 20_000_000_000L, 20_000_000_000L), deadlines)
+  }
+
   @Test
   fun `completeChain stops when the issuer cannot be fetched`() {
     val leaf = CertFixtures.cert("stationplaylist-leaf.pem")
 
-    val completed = AiaCertChaser.completeChain(listOf(leaf)) { emptyList() }
+    val completed = AiaCertChaser.completeChain(listOf(leaf)) { _, _ -> emptyList() }
 
     assertEquals(listOf(leaf), completed)
   }
@@ -88,8 +278,8 @@ class AiaCertChaserTest {
 
     // After AIA chasing splices in R13, the chain validates to the trusted root.
     val completed =
-      AiaCertChaser.completeChain(listOf(leaf)) {
-        if (it == "http://r13.i.lencr.org/") listOf(r13) else emptyList()
+      AiaCertChaser.completeChain(listOf(leaf)) { url, _ ->
+        if (url == "http://r13.i.lencr.org/") listOf(r13) else emptyList()
       }
     validatePath(completed, root, date) // must not throw
   }

package/android/src/test/java/com/audiobrowser/tls/AiaChasingTrustManagerTest.kt

@@ -1,7 +1,10 @@
 package com.audiobrowser.tls
 
+import java.net.Socket
 import java.security.cert.CertificateException
 import java.security.cert.X509Certificate
+import javax.net.ssl.SSLEngine
+import javax.net.ssl.X509ExtendedTrustManager
 import javax.net.ssl.X509TrustManager
 import org.junit.Assert.assertEquals
 import org.junit.Assert.assertThrows
@@ -31,8 +34,8 @@ class AiaChasingTrustManagerTest {
     val r13 = CertFixtures.cert("letsencrypt-r13.pem")
     val delegate = FakeDelegate(trustsChainOfSize = 2)
     val tm =
-      AiaChasingTrustManager(delegate) {
-        if (it == "http://r13.i.lencr.org/") listOf(r13) else emptyList()
+      AiaChasingTrustManager(delegate) { url, _ ->
+        if (url == "http://r13.i.lencr.org/") listOf(r13) else emptyList()
       }
 
     // Must not throw: the leaf-only chain is rejected, AIA fills in R13, the [leaf, R13] chain
@@ -46,7 +49,7 @@ class AiaChasingTrustManagerTest {
   fun `rethrows the original failure when no intermediate can be fetched`() {
     val leaf = CertFixtures.cert("stationplaylist-leaf.pem")
     val delegate = FakeDelegate(trustsChainOfSize = 2)
-    val tm = AiaChasingTrustManager(delegate) { emptyList() }
+    val tm = AiaChasingTrustManager(delegate) { _, _ -> emptyList() }
 
     assertThrows(CertificateException::class.java) { tm.checkServerTrusted(arrayOf(leaf), "RSA") }
 
@@ -60,7 +63,7 @@ class AiaChasingTrustManagerTest {
     val delegate = FakeDelegate(trustsChainOfSize = 1)
     var fetches = 0
     val tm =
-      AiaChasingTrustManager(delegate) {
+      AiaChasingTrustManager(delegate) { _, _ ->
         fetches++
         emptyList()
       }
@@ -70,4 +73,322 @@ class AiaChasingTrustManagerTest {
     assertEquals(0, fetches)
     assertEquals(listOf(1), delegate.checkedChainSizes)
   }
+
+  // -- the API 24+ variant, which is what the platform actually calls into --
+
+  /**
+   * Stands in for Android's `RootTrustManager` under a per-domain network security config: the
+   * hostname-aware overloads work, and the two-argument one refuses to answer at all.
+   */
+  private class FakeDomainConfigDelegate(private val trustsChainOfSize: Int) :
+    X509ExtendedTrustManager() {
+    val hostnameAwareChecks = mutableListOf<Int>()
+
+    override fun checkServerTrusted(chain: Array<X509Certificate>, authType: String) =
+      throw CertificateException(
+        "Domain specific configurations require that hostname aware " +
+          "checkServerTrusted(X509Certificate[], String, String) is used"
+      )
+
+    override fun checkServerTrusted(
+      chain: Array<X509Certificate>,
+      authType: String,
+      socket: Socket?,
+    ) {
+      hostnameAwareChecks.add(chain.size)
+      if (chain.size != trustsChainOfSize) {
+        throw CertificateException("Trust anchor for certification path not found.")
+      }
+    }
+
+    override fun checkServerTrusted(
+      chain: Array<X509Certificate>,
+      authType: String,
+      engine: SSLEngine?,
+    ) = checkServerTrusted(chain, authType, null as Socket?)
+
+    override fun checkClientTrusted(chain: Array<X509Certificate>, authType: String) = Unit
+
+    override fun checkClientTrusted(
+      chain: Array<X509Certificate>,
+      authType: String,
+      socket: Socket?,
+    ) = Unit
+
+    override fun checkClientTrusted(
+      chain: Array<X509Certificate>,
+      authType: String,
+      engine: SSLEngine?,
+    ) = Unit
+
+    override fun getAcceptedIssuers(): Array<X509Certificate> = emptyArray()
+  }
+
+  @Test
+  fun `a complete chain rejected for some other reason is not chased`() {
+    val leaf = CertFixtures.cert("stationplaylist-leaf.pem")
+    val r13 = CertFixtures.cert("letsencrypt-r13.pem")
+    val root = CertFixtures.cert("isrg-root-x1.pem")
+    // Trusts nothing — an expired chain, a hostname mismatch, a CT refusal all look like this:
+    // the delegate rejects a chain that is not missing anything.
+    val delegate =
+      object : X509TrustManager {
+        override fun checkServerTrusted(chain: Array<X509Certificate>, authType: String) =
+          throw CertificateException("certificate expired")
+
+        override fun checkClientTrusted(chain: Array<X509Certificate>, authType: String) = Unit
+
+        override fun getAcceptedIssuers(): Array<X509Certificate> = arrayOf(root)
+      }
+    var fetches = 0
+    val tm =
+      AiaChasingTrustManager(delegate) { _, _ ->
+        fetches++
+        emptyList()
+      }
+
+    assertThrows(CertificateException::class.java) {
+      tm.checkServerTrusted(arrayOf(leaf, r13), "RSA")
+    }
+
+    // Chasing could not have helped, so it must not have reached out to a host named by a
+    // certificate that just failed validation.
+    assertEquals(0, fetches)
+  }
+
+  @Test
+  fun `the original failure is kept when the completed chain fails too`() {
+    val leaf = CertFixtures.cert("stationplaylist-leaf.pem")
+    val r13 = CertFixtures.cert("letsencrypt-r13.pem")
+    // Trusts no chain of any size, so the retry fails as well.
+    val delegate = FakeDelegate(trustsChainOfSize = -1)
+    val tm = AiaChasingTrustManager(delegate) { _, _ -> listOf(r13) }
+
+    val thrown =
+      assertThrows(CertificateException::class.java) { tm.checkServerTrusted(arrayOf(leaf), "RSA") }
+
+    assertEquals(1, thrown.suppressed.size)
+  }
+
+  @Test
+  fun `client checks are forwarded, not routed through the server path`() {
+    val leaf = CertFixtures.cert("stationplaylist-leaf.pem")
+    var clientChecks = 0
+    val delegate =
+      object : X509ExtendedTrustManager() {
+        override fun checkServerTrusted(chain: Array<X509Certificate>, authType: String) =
+          throw CertificateException("server path must not be used for a client check")
+
+        override fun checkServerTrusted(
+          chain: Array<X509Certificate>,
+          authType: String,
+          socket: Socket?,
+        ) = throw CertificateException("server path must not be used for a client check")
+
+        override fun checkServerTrusted(
+          chain: Array<X509Certificate>,
+          authType: String,
+          engine: SSLEngine?,
+        ) = throw CertificateException("server path must not be used for a client check")
+
+        override fun checkClientTrusted(chain: Array<X509Certificate>, authType: String) {
+          clientChecks++
+        }
+
+        override fun checkClientTrusted(
+          chain: Array<X509Certificate>,
+          authType: String,
+          socket: Socket?,
+        ) {
+          clientChecks++
+        }
+
+        override fun checkClientTrusted(
+          chain: Array<X509Certificate>,
+          authType: String,
+          engine: SSLEngine?,
+        ) {
+          clientChecks++
+        }
+
+        override fun getAcceptedIssuers(): Array<X509Certificate> = emptyArray()
+      }
+    val tm = AiaChasingExtendedTrustManager(delegate) { _, _ -> emptyList() }
+
+    tm.checkClientTrusted(arrayOf(leaf), "RSA")
+    tm.checkClientTrusted(arrayOf(leaf), "RSA", null as Socket?)
+    tm.checkClientTrusted(arrayOf(leaf), "RSA", null as SSLEngine?)
+
+    assertEquals(3, clientChecks)
+  }
+
+  /** A delegate carrying the Android-specific hostname-aware method, as `RootTrustManager` does. */
+  @Suppress("unused")
+  private class HostAwareDelegate(private val trustsChainOfSize: Int) : X509TrustManager {
+    val hosts = mutableListOf<String>()
+
+    fun checkServerTrusted(
+      chain: Array<X509Certificate>,
+      authType: String,
+      host: String,
+    ): List<X509Certificate> {
+      hosts.add(host)
+      if (chain.size != trustsChainOfSize) {
+        throw CertificateException("Trust anchor for certification path not found.")
+      }
+      return chain.toList()
+    }
+
+    override fun checkServerTrusted(chain: Array<X509Certificate>, authType: String) =
+      throw CertificateException("the host-aware overload should have been used")
+
+    override fun checkClientTrusted(chain: Array<X509Certificate>, authType: String) = Unit
+
+    override fun getAcceptedIssuers(): Array<X509Certificate> = emptyArray()
+  }
+
+  @Test
+  fun `the X509TrustManagerExtensions signature is present and forwards the host`() {
+    val leaf = CertFixtures.cert("stationplaylist-leaf.pem")
+    val r13 = CertFixtures.cert("letsencrypt-r13.pem")
+    val delegate = HostAwareDelegate(trustsChainOfSize = 2)
+    val tm =
+      AiaChasingExtendedTrustManager(delegate) { url, _ ->
+        if (url == "http://r13.i.lencr.org/") listOf(r13) else emptyList()
+      }
+
+    // The method X509TrustManagerExtensions looks up reflectively must exist on the wrapper...
+    val method =
+      tm.javaClass.getMethod(
+        "checkServerTrusted",
+        Array<X509Certificate>::class.java,
+        String::class.java,
+        String::class.java,
+      )
+
+    // ...and must reach the delegate's own host-aware method, so pinning still sees the host.
+    val accepted = tm.checkServerTrusted(arrayOf(leaf), "RSA", "ca.example")
+
+    assertEquals(listOf(leaf, r13), accepted)
+    assertEquals(listOf("ca.example", "ca.example"), delegate.hosts)
+    assertEquals(List::class.java, method.returnType)
+  }
+
+  @Test
+  fun `the host-aware signature falls back to the extended overloads when the delegate lacks it`() {
+    val leaf = CertFixtures.cert("stationplaylist-leaf.pem")
+    val r13 = CertFixtures.cert("letsencrypt-r13.pem")
+    // An extended delegate without the Android-specific String-host method, whose two-argument
+    // form refuses outright — the domain-config case. The fallback must route through its
+    // extended overloads, and must report the AIA-completed chain that actually validated.
+    val delegate = FakeDomainConfigDelegate(trustsChainOfSize = 2)
+    val tm =
+      AiaChasingExtendedTrustManager(delegate) { url, _ ->
+        if (url == "http://r13.i.lencr.org/") listOf(r13) else emptyList()
+      }
+
+    val accepted = tm.checkServerTrusted(arrayOf(leaf), "RSA", "ca.example")
+
+    assertEquals(listOf(leaf, r13), accepted)
+    assertEquals(listOf(1, 2), delegate.hostnameAwareChecks)
+  }
+
+  /** A host-aware delegate that validates fine but reports an empty accepted chain. */
+  @Suppress("unused")
+  private class SilentHostAwareDelegate(private val trustsChainOfSize: Int) : X509TrustManager {
+    fun checkServerTrusted(
+      chain: Array<X509Certificate>,
+      authType: String,
+      host: String,
+    ): List<X509Certificate> {
+      if (chain.size != trustsChainOfSize) {
+        throw CertificateException("Trust anchor for certification path not found.")
+      }
+      return emptyList()
+    }
+
+    override fun checkServerTrusted(chain: Array<X509Certificate>, authType: String) =
+      throw CertificateException("the host-aware overload should have been used")
+
+    override fun checkClientTrusted(chain: Array<X509Certificate>, authType: String) = Unit
+
+    override fun getAcceptedIssuers(): Array<X509Certificate> = emptyArray()
+  }
+
+  @Test
+  fun `a delegate reporting an empty accepted chain still yields the chain that validated`() {
+    val leaf = CertFixtures.cert("stationplaylist-leaf.pem")
+    val r13 = CertFixtures.cert("letsencrypt-r13.pem")
+    val delegate = SilentHostAwareDelegate(trustsChainOfSize = 2)
+    val tm =
+      AiaChasingExtendedTrustManager(delegate) { url, _ ->
+        if (url == "http://r13.i.lencr.org/") listOf(r13) else emptyList()
+      }
+
+    // An empty list from the delegate on success must not be passed through: the checked chain
+    // is what it accepted, and a pinning consumer given [] would fail a valid connection.
+    val accepted = tm.checkServerTrusted(arrayOf(leaf), "RSA", "ca.example")
+
+    assertEquals(listOf(leaf, r13), accepted)
+  }
+
+  @Test
+  fun `forwards to the hostname-aware overload the platform requires`() {
+    val leaf = CertFixtures.cert("stationplaylist-leaf.pem")
+    val r13 = CertFixtures.cert("letsencrypt-r13.pem")
+    val delegate = FakeDomainConfigDelegate(trustsChainOfSize = 2)
+    val tm =
+      AiaChasingExtendedTrustManager(delegate) { url, _ ->
+        if (url == "http://r13.i.lencr.org/") listOf(r13) else emptyList()
+      }
+
+    // The socket overload must reach the delegate's socket overload. Routing it through the
+    // two-argument form instead would throw the domain-config refusal, which is what a plain
+    // X509TrustManager wrapper causes for every connection in the process.
+    tm.checkServerTrusted(arrayOf(leaf), "RSA", null as Socket?)
+
+    assertEquals(listOf(1, 2), delegate.hostnameAwareChecks)
+  }
+
+  @Test
+  fun `the engine overload is hostname-aware too`() {
+    val leaf = CertFixtures.cert("stationplaylist-leaf.pem")
+    val delegate = FakeDomainConfigDelegate(trustsChainOfSize = 1)
+
+    AiaChasingExtendedTrustManager(delegate) { _, _ -> emptyList() }
+      .checkServerTrusted(arrayOf(leaf), "RSA", null as SSLEngine?)
+
+    assertEquals(listOf(1), delegate.hostnameAwareChecks)
+  }
+
+  @Test
+  fun `a delegate without extended overloads still works`() {
+    val leaf = CertFixtures.cert("stationplaylist-leaf.pem")
+    val r13 = CertFixtures.cert("letsencrypt-r13.pem")
+    val delegate = FakeDelegate(trustsChainOfSize = 2)
+    val tm =
+      AiaChasingExtendedTrustManager(delegate) { url, _ ->
+        if (url == "http://r13.i.lencr.org/") listOf(r13) else emptyList()
+      }
+
+    tm.checkServerTrusted(arrayOf(leaf), "RSA", null as Socket?)
+
+    assertEquals(listOf(1, 2), delegate.checkedChainSizes)
+  }
+
+  @Test
+  fun `the extended variant does not weaken trust`() {
+    val leaf = CertFixtures.cert("stationplaylist-leaf.pem")
+    val r13 = CertFixtures.cert("letsencrypt-r13.pem")
+    // Trusts nothing, whatever the chain.
+    val delegate = FakeDomainConfigDelegate(trustsChainOfSize = -1)
+    val tm = AiaChasingExtendedTrustManager(delegate) { _, _ -> listOf(r13) }
+
+    assertThrows(CertificateException::class.java) {
+      tm.checkServerTrusted(arrayOf(leaf), "RSA", null as Socket?)
+    }
+
+    // The completed chain was offered to the delegate and refused, rather than assumed good.
+    assertEquals(listOf(1, 2), delegate.hostnameAwareChecks)
+  }
 }