credentials: sample delegated crl signer certs and CRLs

re-using the existing revoked PAI and DACs, and generated the indirect
CRL by revoking the same ones.

credentials/test/revoked-attestation-certificates/Chip-Test-PAA-FFF1-Delegated-CRL-Signer-Cert.pem

@@ -0,0 +1,13 @@
+-----BEGIN CERTIFICATE-----
+MIIB3jCCAYSgAwIBAgIUN0VEmprq7pGmVkijbDtpPl8U060wCgYIKoZIzj0EAwIw
+MDEYMBYGA1UEAwwPTWF0dGVyIFRlc3QgUEFBMRQwEgYKKwYBBAGConwCAQwERkZG
+MTAgFw0yNDEyMjAwODUwMzZaGA8yMTI0MTEyNjA4NTAzNlowSjEyMDAGA1UEAwwp
+TWF0dGVyIFRlc3QgUEFBIERlbGVnYXRlZCBDUkwgU2lnbmVyIEZGRjExFDASBgor
+BgEEAYKifAICDARGRkYxMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEaGswz0ZC
+Dd6F8pDBp+AuJsgSRRy3LAgAHq5F5mPV4D8SGXkXPAr/969MmxV1ifaIl8lXA8iG
+xJ5E5/kJRJpvu6NgMF4wDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCAYIwHQYD
+VR0OBBYEFAsXPNYVBXqMSFXWx9GcV7pEJQJLMB8GA1UdIwQYMBaAFGr9IncfUR/s
+vxZBl2cQ3NwxoXF+MAoGCCqGSM49BAMCA0gAMEUCIHMX8kl5v8uH9nA1KVaLRcan
+ucVPpXpUeD6hHr3+Luz4AiEA+yejFOAVby2r+TkwNwa/GViOTzqyJNoUXVTrWVSF
+dgg=
+-----END CERTIFICATE-----

credentials/test/revoked-attestation-certificates/Chip-Test-PAA-FFF1-Delegated-CRL-Signer-Key.pem

@@ -0,0 +1,5 @@
+-----BEGIN PRIVATE KEY-----
+MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQg00lpwVOJLhlEByQc
+FuApLsnGO+ulYZ3rDbcpsbHr182hRANCAARoazDPRkIN3oXykMGn4C4myBJFHLcs
+CAAerkXmY9XgPxIZeRc8Cv/3r0ybFXWJ9oiXyVcDyIbEnkTn+QlEmm+7
+-----END PRIVATE KEY-----

credentials/test/revoked-attestation-certificates/Chip-Test-PAA-FFF1-Delegated-CRL.pem

@@ -0,0 +1,9 @@
+-----BEGIN X509 CRL-----
+MIIBIjCByQIBATAKBggqhkjOPQQDAjBKMTIwMAYDVQQDDClNYXR0ZXIgVGVzdCBQ
+QUEgRGVsZWdhdGVkIENSTCBTaWduZXIgRkZGMTEUMBIGCisGAQQBgqJ8AgIMBEZG
+RjEXDTI0MTIyMDEwNDkzN1oYDzIxMjQxMjIxMTA0OTM3WjAbMBkCCDAmZDkrij8q
+Fw0yNDEyMjAxMDQ5MDNaoC8wLTAfBgNVHSMEGDAWgBQLFzzWFQV6jEhV1sfRnFe6
+RCUCSzAKBgNVHRQEAwIBAjAKBggqhkjOPQQDAgNIADBFAiBODiXnWPxXD1ukQX5G
+f0sPk+6kq0ZldrInaKRrhvrS4AIhALqvyYokAjw4AYQ3cE8ZkDFlxpNwpduiE7wC
+KfQPQHgL
+-----END X509 CRL-----

credentials/test/revoked-attestation-certificates/Matter-Development-PAI-FFF1-Delegated-CRL-Signer-Cert.pem

@@ -0,0 +1,13 @@
+-----BEGIN CERTIFICATE-----
+MIICADCCAaagAwIBAgIUVw1fcu6iCWBq1dXGGsKsld6mFBYwCgYIKoZIzj0EAwIw
+PTElMCMGA1UEAwwcTWF0dGVyIERldiBQQUkgMHhGRkYxIG5vIFBJRDEUMBIGCisG
+AQQBgqJ8AgEMBEZGRjEwIBcNMjQxMjIwMDkzNjQ5WhgPMjEyNDExMjYwOTM2NDla
+MF8xMTAvBgNVBAMMKE1hdHRlciBEZXYgUEFJIERlbGVnYXRlZCBDUkwgU2lnbmVy
+IEZGRjExFDASBgorBgEEAYKifAICDARGRkYxMRQwEgYKKwYBBAGConwCAgwEODAw
+MTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABNqxBPAik9Rc5p3oA6u/6kOHU1RA
+QTNguQNsiptO/U8WgzRmzxru3KagacAHCvfjHAPOKpzFFaYiukphrWTXeYGjYDBe
+MAwGA1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgGCMB0GA1UdDgQWBBTNmS7mcSA0
+/ou1w0Ql37q9jrSeiTAfBgNVHSMEGDAWgBRjVA5H9kscONE4hKRi0WwZXY/7PDAK
+BggqhkjOPQQDAgNIADBFAiBMSO42anuD/014dvZwoG9vNgkErcCYKxuFjOoNq0AZ
+TAIhAMmZKBBa5UxAcnACDvYo2l55oSh8ieqLk1lbPJeA69Yl
+-----END CERTIFICATE-----

credentials/test/revoked-attestation-certificates/Matter-Development-PAI-FFF1-Delegated-CRL-Signer-Key.pem

@@ -0,0 +1,5 @@
+-----BEGIN PRIVATE KEY-----
+MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgyVr680c6XfirYKEl
+h51p8+7JU/7t60KHdNb/1IRM326hRANCAATasQTwIpPUXOad6AOrv+pDh1NUQEEz
+YLkDbIqbTv1PFoM0Zs8a7tymoGnABwr34xwDziqcxRWmIrpKYa1k13mB
+-----END PRIVATE KEY-----

credentials/test/revoked-attestation-certificates/Matter-Development-PAI-FFF1-noPID-Delegated-CRL.pem

@@ -0,0 +1,10 @@
+-----BEGIN X509 CRL-----
+MIIBbzCCARQCAQEwCgYIKoZIzj0EAwIwXzExMC8GA1UEAwwoTWF0dGVyIERldiBQ
+QUkgRGVsZWdhdGVkIENSTCBTaWduZXIgRkZGMTEUMBIGCisGAQQBgqJ8AgIMBEZG
+RjExFDASBgorBgEEAYKifAICDAQ4MDAxFw0yNDEyMjAxMDUyNDZaGA8yMTI0MTIy
+MTEwNTI0NlowUTAZAggKsEJJQyP+VBcNMjQxMjIwMTA1MjQ0WjAZAggZNn2XjqxT
+OhcNMjQxMjIwMTA1MjMzWjAZAgglaTg9JLs26hcNMjQxMjIwMTA1MjM5WqAvMC0w
+HwYDVR0jBBgwFoAUzZku5nEgNP6LtcNEJd+6vY60nokwCgYDVR0UBAMCAQQwCgYI
+KoZIzj0EAwIDSQAwRgIhAMWax1hzDWwQn1dpj5Tg+ln1wGrPG6JDIOu+wFRFBc80
+AiEAqQj5PwEPp5QW1X9OvgnH3QXPQ0FKlTQY8MXHDo4qD2w=
+-----END X509 CRL-----

credentials/test/revoked-attestation-certificates/README.md

@@ -0,0 +1,60 @@
+# Revoked Attestation Certificates
+
+This directory contains test certificates, keys, and CRLs for device attestation revocation testing scenarios.
+The test certificates and keys are intended to be used for testing purposes only and should not be used in production environments.
+
+## Direct CRL Signing
+In this approach, the CA directly signs the Certificate Revocation List (CRL).
+
+### PAA Signed CRL
+Process:
+1. PAA issues the PAI
+2. PAI issues the DAC
+3. PAA revokes the PAI and updates the CRL
+
+- PAA: `Chip-Test-PAA-FFF1-Cert.[pem|der]`
+- CRL: `Chip-Test-PAA-FFF1-CRL.[der|pem]`
+- PAI(revoked): `Chip-Test-PAI-FFF1-noPID-Revoked-Cert.[pem|der]`
+- DAC(signed by revoked PAI): `Chip-Test-DAC-FFF1-8001-Signed-By-Revoked-PAI-Cert.[pem|der]`
+
+### PAI Signed CRL
+Process:
+1. PAI issues the 3 DACs
+2. PAI issues the DAC and updates the CRL
+
+- PAI: `Matter-Development-PAI-FFF1-noPID-Cert.[pem|der]`
+- CRL: `Matter-Development-PAI-FFF1-noPID-CRL.[pem|der]`
+- DACs(revoked):
+    - `Matter-Development-DAC-FFF1-8001-Revoked-01-Cert.[pem|der]`
+    - `Matter-Development-DAC-FFF1-8002-Revoked-02-Cert.[pem|der]`
+    - `Matter-Development-DAC-FFF1-8003-Revoked-03-Cert.[pem|der]`
+
+## Indirect CRL Signing (delegated CRL signing)
+In this approach, the CA delegates the CRL signing responsibility to a separate entity.
+
+### PAA Delegated CRL Signing
+Process:
+1. PAA issues the PAI
+2. PAA issues the Delegated CRL Signer
+3. PAI issues the DAC
+4. Delegated CRL Signer revokes the PAI and updates the CRL
+
+- PAA: `Chip-Test-PAA-FFF1-Cert.[pem|der]`
+- CRL: `Chip-Test-PAA-FFF1-Delegated-CRL.[der|pem]`
+- PAA delegated CRL Signer: `Chip-Test-PAA-FFF1-Delegated-CRL-Signer-Cert.[pem|der]`
+- PAI(revoked by PAA delegated CRL Signer): `Chip-Test-PAI-FFF1-noPID-Revoked-Cert.[pem|der]`
+- DAC(signed by revoked PAI): `Chip-Test-DAC-FFF1-8001-Signed-By-Revoked-PAI-Cert.[pem|der]`
+
+### PAI Delegated CRL Signing
+Process:
+1. PAI issues the 3 DACs
+2. PAI issues the Delegated CRL Signer
+3. Delegated CRL Signer revokes the DACs and updates the CRL
+
+- PAI: `Matter-Development-PAI-FFF1-noPID-Cert.[pem|der]`
+- CRL: `Matter-Development-PAI-FFF1-noPID-Delegated-CRL.[pem|der]`
+- PAI delegated CRL Signer: `Matter-Development-PAI-FFF1-Delegated-CRL-Signer-Cert.[pem|der]`
+- DACs(revoked):
+    - `Matter-Development-DAC-FFF1-8001-Revoked-01-Cert.[pem|der]`
+    - `Matter-Development-DAC-FFF1-8002-Revoked-02-Cert.[pem|der]`
+    - `Matter-Development-DAC-FFF1-8003-Revoked-03-Cert.[pem|der]`