[X.509] Certificate Chain Validation

[averevki]

Summary

Test intermediate CA certificate chain validation with AuthPolicy + XFCC. Adapted from existing test_mtls_trust_chain.py::test_mtls_trust_chain_success which validates the same scenario with AuthConfig + TLSEnvoy.

Setup

• Intermediate CA certificates; full chain included in XFCC header

Tests

• Client certificate signed by labeled intermediate CA → 200 OK
• Client certificate signed by unlabeled intermediate CA → 401 Unauthorized

References

• Parent issue: E2E tests for X.509 Client Certificate Authentication in AuthPolicy (XFCC header) #885
• RFC 0015
• Existing trust chain test