ct-fetch should verify certs

[jcjones]

Around these lines:

ct-mapreduce/cmd/ct-fetch/ct-fetch.go

Lines 187 to 198 in a691f52

	if len(ep.LogEntry.Chain) < 1 {
	glog.Warningf("[%s] No issuer known for certificate precert=%v index=%d serial=%s subject=%+v issuer=%+v",
	ep.LogURL, precert, ep.LogEntry.Index, storage.NewSerial(cert).String(), cert.Subject, cert.Issuer)
	continue
	}
	issuingCert, err := x509.ParseCertificate(ep.LogEntry.Chain[0].Data)
	if err != nil {
	glog.Errorf("[%s] Problem decoding issuing certificate: index: %d error: %s", ep.LogURL, ep.LogEntry.Index, err)
	continue
	}
	metrics.MeasureSince([]string{"insertCTWorker", "ParseCertificates"}, parseTime)

ct-fetch should verify that the certificate was signed by its issuer, to ensure it's a real certificate. This is important in the event that a CT log is coerced to log an invalid certificate.

If the certificate is valid but from an unknown issuer, tools can more readily handle that via whitelisting. But it's much better to ensure that we never log certificates that are actively themselves fraudulent.