'Specifying a C{trustRoot} of L{platformTrust} when initializing
L{sslverify.OpenSSLCertificateOptions} causes certificates issued by a
newly created CA to be rejected by an SSL connection using these
options.
Note that this test should I{always} pass, even on platforms where the
CA certificates are not installed, as long as L{platformTrust} rejects
completely invalid / unknown root CA certificates.  This is simply a
smoke test to make sure that verification is happening at all.'

def test_trustRootPlatformRejectsUntrustedCA(self):

    (caSelfCert, serverCert) = certificatesForAuthorityAndServer()
    chainedCert = pathContainingDumpOf(self, serverCert, caSelfCert)
    privateKey = pathContainingDumpOf(self, serverCert.privateKey)
    (sProto, cProto, pump) = loopbackTLSConnection(trustRoot=platformTrust(), privateKeyFile=privateKey, chainedCertFile=chainedCert)
    self.assertEqual(cProto.wrappedProtocol.data, '')
    self.assertEqual(cProto.wrappedProtocol.lostReason.type, SSL.Error)
    err = cProto.wrappedProtocol.lostReason.value
    self.assertEqual(err.args[0][0][2], 'tlsv1    alert    unknown    ca')
