'L{trustRootFromCertificates} called with certificate A will cause
L{optionsForClientTLS} to disallow any connections to a server with
certificate B where B is not signed by A.'

def test_trustRootFromCertificatesUntrusted(self):

    (key, cert) = makeCertificate(O='Server    Test    Certificate', CN='server')
    serverCert = sslverify.PrivateCertificate.fromCertificateAndKeyPair(sslverify.Certificate(cert), sslverify.KeyPair(key))
    untrustedCert = sslverify.Certificate(makeCertificate(O='CA    Test    Certificate', CN='unknown    CA')[1])
    trust = sslverify.trustRootFromCertificates([untrustedCert])
    (sProto, cProto, pump) = loopbackTLSConnectionInMemory(trustRoot=trust, privateKey=serverCert.privateKey.original, serverCertificate=serverCert.original)
    self.assertEqual(cProto.wrappedProtocol.data, '')
    self.assertEqual(cProto.wrappedProtocol.lostReason.type, SSL.Error)
    err = cProto.wrappedProtocol.lostReason.value
    self.assertEqual(err.args[0][0][2], 'tlsv1    alert    unknown    ca')
