Expand certificate chain validation options

[atc0005]

Overview

This was pulled from #211 (comment):

Validations (some repeated):

• cert chain ordering
• hostname
• expiration
• duplicates
• has root cert
• has multiple intermediates
• missing intermediates
• missing root

I will need to review the current list of GH issues and file new ones for any validation checks that appear viable and are not already represented by a separate issue. I can process these as part of future milestone efforts.

TODO

• expiration
• hostname
• subject alternate names
• certificate chain verification (validating signatures from leaf to root)
• duplicates
• has root cert
• missing root cert
• multiple intermediates
• missing intermediates

Some of these will end up being research items instead of confirmed TODO items.

For example, would it really be valuable to flag a certificate chain for not including a root certificate? From what I recall, current best practices indicate that you should only include the leaf and one or more intermediates necessary to complete the chain from the leaf to a root certificate which should already be present in the local certificates store on the client system.

[atc0005]

Spun off separate GH issues for research and potential implementation.