Generate crypto material for tests

Makefile

@@ -44,6 +44,7 @@ build/$(OPENSSL_NAME).tar.gz: | build/
 $(OPENSSL_DIR)/: build/$(OPENSSL_NAME).tar.gz build/chacha-poly.patch
 	tar -C build -xf build/$(OPENSSL_NAME).tar.gz
 	patch -d $(OPENSSL_DIR) -p1 < build/chacha-poly.patch
+	patch -d $(OPENSSL_DIR) -p1 < disable_digest_check.path
 
 $(OPENSSL_DIR)/Makefile: | $(OPENSSL_DIR)/
 	#cd $(OPENSSL_DIR) && ./Configure enable-ssl2 enable-ssl3 enable-weak-ssl-ciphers enable-zlib enable-rc5 enable-rc2 enable-gost enable-md2 enable-mdc2 enable-shared linux-x86_64
@@ -91,10 +92,13 @@ $(RUBY_OPENSSL_EXT_DIR)/Makefile: libs | $(RUBY_DIR)/
 	patch -d $(RUBY_DIR)/ -p1 < multiple_certs.patch
 	cd $(RUBY_OPENSSL_EXT_DIR) && ruby extconf.rb
 
-$(RUBY_OPENSSL_EXT_DIR)/openssl.so: $(LIBS) #$(RUBY_OPENSSL_EXT_DIR)/Makefile
+$(RUBY_OPENSSL_EXT_DIR)/openssl.so: $(LIBS) $(RUBY_OPENSSL_EXT_DIR)/Makefile
 	top_srcdir=../.. $(MAKE) -C $(RUBY_OPENSSL_EXT_DIR)
 
 lib/openssl.so: $(RUBY_OPENSSL_EXT_DIR)/openssl.so
 	cp $< $@
 
 ext: lib/openssl.so
+
+test-material:
+	bin/generate-test-material.rb

bin/generate-test-material.rb

@@ -0,0 +1,144 @@
+#!/usr/bin/env ruby
+$:.unshift File.expand_path File.join File.dirname(__FILE__), '../lib'
+require 'rubygems'
+require 'bundler/setup'
+require 'openssl'
+require 'socket'
+require 'cryptcheck'
+
+LOG       = ::CryptCheck::Logger
+LOG.level = ENV['LOG'] || :info
+
+OpenSSL::PKey::EC.send :alias_method, :private?, :private_key?
+
+CA_KEY_USAGE            = %w(keyCertSign cRLSign)
+CA_EXTENDED_KEY_USAGE   = []
+CA_NETSCAPE_CERT_TYPE = %w(sslCA)
+RSA_KEY_USAGE           = %w(digitalSignature)
+ECDSA_KEY_USAGE         = %w(digitalSignature)
+CERT_EXTENDED_KEY_USAGE = %w(serverAuth)
+CERT_NETSCAPE_CERT_TYPE = %w(server)
+
+
+def certificate(key, subject, san: %w(DNS:localhost),
+				from: Time.utc(2000, 1, 1), to: Time.utc(2001, 1, 1),
+				issuer: nil, ca: false,
+				key_usage: ECDSA_KEY_USAGE, extended_key_usage: CERT_EXTENDED_KEY_USAGE,
+				netscape_cert_type: CERT_NETSCAPE_CERT_TYPE,
+				hash: OpenSSL::Digest::SHA512, extensions: [])
+	cert            = OpenSSL::X509::Certificate.new
+	cert.version    = 3
+	cert.serial     = rand 2**63 .. 2**64
+	cert.not_before = from if from
+	cert.not_after  = to if to
+
+	cert.public_key = case key
+						  when OpenSSL::PKey::EC
+							  curve             = key.group.curve_name
+							  public            = OpenSSL::PKey::EC.new curve
+							  public.public_key = key.public_key
+							  public
+						  else
+							  key.public_key
+					  end
+
+	name         = OpenSSL::X509::Name.parse subject
+	cert.subject = name
+
+	issuer       = { cert: cert, key: key } unless issuer
+	cert.issuer  = issuer[:cert].subject
+
+	extension_factory                     = OpenSSL::X509::ExtensionFactory.new nil, cert
+	extension_factory.subject_certificate = cert
+	extension_factory.issuer_certificate  = issuer[:cert]
+
+	cert.add_extension extension_factory.create_extension 'basicConstraints', "CA:#{ca.to_s.upcase}", true
+	cert.add_extension extension_factory.create_extension 'keyUsage', key_usage.uniq.join(','), true unless key_usage.empty?
+	cert.add_extension extension_factory.create_extension 'extendedKeyUsage', extended_key_usage.uniq.join(','), true unless extended_key_usage.empty?
+	cert.add_extension extension_factory.create_extension 'nsCertType', netscape_cert_type.uniq.join(',') unless netscape_cert_type.empty?
+	cert.add_extension extension_factory.create_extension 'subjectKeyIdentifier', 'hash'
+	cert.add_extension extension_factory.create_extension 'authorityKeyIdentifier', 'keyid:always'
+	cert.add_extension extension_factory.create_extension 'subjectAltName', san.uniq.join(',') unless san.empty?
+
+	extensions.each { |e| cert.add_extension e }
+
+	cert.sign issuer[:key], hash.new
+
+	cert
+end
+
+def generate_dh(size)
+	filename = "spec/resources/dh-#{size}.pem"
+	return if File.exist? filename
+	LOG.info "Generate dh-#{size}"
+	File.write filename, OpenSSL::PKey::DH.new(size).to_pem
+end
+
+def generate_material(name, key, cert)
+	key_file = "spec/resources/#{name}.pem"
+	key      = if File.exists?(key_file)
+				   OpenSSL::PKey.read File.read key_file
+			   else
+				   LOG.info "Generate #{name} key"
+				   key = key.call
+				   File.write key_file, key.to_pem
+				   key
+			   end
+
+	cert_file = "spec/resources/#{name}.crt"
+	cert      = if File.exist?(cert_file)
+					OpenSSL::X509::Certificate.new File.read cert_file
+				else
+					LOG.info "Generate #{name} cert"
+					cert = cert.call key
+					File.write cert_file, cert.to_pem
+					cert
+				end
+
+	[key, cert]
+end
+
+ca_key, ca_cert = generate_material 'ca',
+									-> () { OpenSSL::PKey::EC.new('secp384r1').generate_key },
+									-> (k) { certificate k, '/CN=ca', ca: true, key_usage: CA_KEY_USAGE, extended_key_usage: CA_EXTENDED_KEY_USAGE, netscape_cert_type: CA_NETSCAPE_CERT_TYPE }
+
+intermediate_key, intermediate_cert = generate_material 'intermediate',
+														-> () { OpenSSL::PKey::EC.new('secp384r1').generate_key },
+														-> (key) { certificate key, '/CN=intermediate', ca: true, issuer: { cert: ca_cert, key: ca_key }, key_usage: CA_KEY_USAGE, extended_key_usage: CA_EXTENDED_KEY_USAGE, netscape_cert_type: CA_NETSCAPE_CERT_TYPE }
+issuer                              = { cert: intermediate_cert, key: intermediate_key }
+
+[512, 768, 1024, 2048, 3072, 4096].each do |s|
+	generate_material "rsa-#{s}",
+					  -> () { OpenSSL::PKey::RSA.new s },
+					  -> (key) { certificate key, "/CN=rsa-#{s}", issuer: issuer, key_usage: RSA_KEY_USAGE }
+	generate_dh s
+end
+
+CryptCheck::Tls::Curve.each do |c|
+	c = c.name
+	generate_material "ecdsa-#{c}",
+					  -> () { OpenSSL::PKey::EC.new(c).generate_key },
+					  -> (key) { certificate key, "/CN=ecdsa-#{c}", issuer: issuer }
+end
+
+generate_material 'self-signed',
+				  -> { OpenSSL::PKey::EC.new('prime256v1').generate_key },
+				  -> (key) { certificate key, '/CN=self-signed', ca: true,
+										 key_usage:                  CA_KEY_USAGE+ECDSA_KEY_USAGE,
+										 extended_key_usage:         CA_EXTENDED_KEY_USAGE + CERT_EXTENDED_KEY_USAGE,
+										 netscape_cert_type: CA_NETSCAPE_CERT_TYPE + CERT_NETSCAPE_CERT_TYPE }
+
+# Require patched OpenSSL to be able to issue MD5 certificates
+generate_material 'md5',
+				  -> { OpenSSL::PKey::EC.new('prime256v1').generate_key },
+				  -> (key) { certificate key, '/CN=md5', issuer: issuer, hash: OpenSSL::Digest::MD5 }
+
+# Require patched OpenSSL to be able to issue SHA1 certificates
+generate_material 'sha1',
+				  -> { OpenSSL::PKey::EC.new('prime256v1').generate_key },
+				  -> (key) { certificate key, '/CN=sha1', issuer: issuer, hash: OpenSSL::Digest::SHA1 }
+
+must_staple = OpenSSL::X509::Extension.new '1.3.6.1.5.5.7.1.24', '0', true
+generate_material 'must-staple',
+				  -> () { OpenSSL::PKey::EC.new('prime256v1').generate_key },
+				  -> (key) { certificate key, '/CN=must-staple', issuer: issuer, extensions: [must_staple] }

disable_digest_check.path

@@ -0,0 +1,76 @@
+diff --git a/crypto/dsa/dsa_pmeth.c b/crypto/dsa/dsa_pmeth.c
+index 42b8bb0..baaa76f 100644
+--- a/crypto/dsa/dsa_pmeth.c
++++ b/crypto/dsa/dsa_pmeth.c
+@@ -174,26 +174,26 @@ static int pkey_dsa_ctrl(EVP_PKEY_CTX *ctx, int type, int p1, void *p2)
+         return 1;
+ 
+     case EVP_PKEY_CTRL_DSA_PARAMGEN_MD:
+-        if (EVP_MD_type((const EVP_MD *)p2) != NID_sha1 &&
+-            EVP_MD_type((const EVP_MD *)p2) != NID_sha224 &&
+-            EVP_MD_type((const EVP_MD *)p2) != NID_sha256) {
+-            DSAerr(DSA_F_PKEY_DSA_CTRL, DSA_R_INVALID_DIGEST_TYPE);
+-            return 0;
+-        }
++        // if (EVP_MD_type((const EVP_MD *)p2) != NID_sha1 &&
++        //     EVP_MD_type((const EVP_MD *)p2) != NID_sha224 &&
++        //     EVP_MD_type((const EVP_MD *)p2) != NID_sha256) {
++        //     DSAerr(DSA_F_PKEY_DSA_CTRL, DSA_R_INVALID_DIGEST_TYPE);
++        //     return 0;
++        // }
+         dctx->md = p2;
+         return 1;
+ 
+     case EVP_PKEY_CTRL_MD:
+-        if (EVP_MD_type((const EVP_MD *)p2) != NID_sha1 &&
+-            EVP_MD_type((const EVP_MD *)p2) != NID_dsa &&
+-            EVP_MD_type((const EVP_MD *)p2) != NID_dsaWithSHA &&
+-            EVP_MD_type((const EVP_MD *)p2) != NID_sha224 &&
+-            EVP_MD_type((const EVP_MD *)p2) != NID_sha256 &&
+-            EVP_MD_type((const EVP_MD *)p2) != NID_sha384 &&
+-            EVP_MD_type((const EVP_MD *)p2) != NID_sha512) {
+-            DSAerr(DSA_F_PKEY_DSA_CTRL, DSA_R_INVALID_DIGEST_TYPE);
+-            return 0;
+-        }
++        // if (EVP_MD_type((const EVP_MD *)p2) != NID_sha1 &&
++        //     EVP_MD_type((const EVP_MD *)p2) != NID_dsa &&
++        //     EVP_MD_type((const EVP_MD *)p2) != NID_dsaWithSHA &&
++        //     EVP_MD_type((const EVP_MD *)p2) != NID_sha224 &&
++        //     EVP_MD_type((const EVP_MD *)p2) != NID_sha256 &&
++        //     EVP_MD_type((const EVP_MD *)p2) != NID_sha384 &&
++        //     EVP_MD_type((const EVP_MD *)p2) != NID_sha512) {
++        //     DSAerr(DSA_F_PKEY_DSA_CTRL, DSA_R_INVALID_DIGEST_TYPE);
++        //     return 0;
++        // }
+         dctx->md = p2;
+         return 1;
+ 
+diff --git a/crypto/ec/ec_pmeth.c b/crypto/ec/ec_pmeth.c
+index b767490..70eea17 100644
+--- a/crypto/ec/ec_pmeth.c
++++ b/crypto/ec/ec_pmeth.c
+@@ -379,15 +379,15 @@ static int pkey_ec_ctrl(EVP_PKEY_CTX *ctx, int type, int p1, void *p2)
+         return dctx->kdf_ukmlen;
+ 
+     case EVP_PKEY_CTRL_MD:
+-        if (EVP_MD_type((const EVP_MD *)p2) != NID_sha1 &&
+-            EVP_MD_type((const EVP_MD *)p2) != NID_ecdsa_with_SHA1 &&
+-            EVP_MD_type((const EVP_MD *)p2) != NID_sha224 &&
+-            EVP_MD_type((const EVP_MD *)p2) != NID_sha256 &&
+-            EVP_MD_type((const EVP_MD *)p2) != NID_sha384 &&
+-            EVP_MD_type((const EVP_MD *)p2) != NID_sha512) {
+-            ECerr(EC_F_PKEY_EC_CTRL, EC_R_INVALID_DIGEST_TYPE);
+-            return 0;
+-        }
++        // if (EVP_MD_type((const EVP_MD *)p2) != NID_sha1 &&
++        //     EVP_MD_type((const EVP_MD *)p2) != NID_ecdsa_with_SHA1 &&
++        //     EVP_MD_type((const EVP_MD *)p2) != NID_sha224 &&
++        //     EVP_MD_type((const EVP_MD *)p2) != NID_sha256 &&
++        //     EVP_MD_type((const EVP_MD *)p2) != NID_sha384 &&
++        //     EVP_MD_type((const EVP_MD *)p2) != NID_sha512) {
++        //     ECerr(EC_F_PKEY_EC_CTRL, EC_R_INVALID_DIGEST_TYPE);
++        //     return 0;
++        // }
+         dctx->md = p2;
+         return 1;
+ 

spec/resources/ca.crt

@@ -1,13 +1,12 @@
 -----BEGIN CERTIFICATE-----
-MIIB7zCCAXWgAwIBAgIJAKFu2k3vOIffMAoGCCqGSM49BAMEMBIxEDAOBgNVBAMM
-B3Rlc3QtY2EwHhcNMTcwMTIyMTg1NTUxWhcNMTgwMTIyMTg1NTUxWjASMRAwDgYD
-VQQDDAd0ZXN0LWNhMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEhVE2pSx4GG922yqA
-z0W0usG8dFdY4qtTD5mwwBzRhu9NegzQmaE5oHNzQrQE8v0/ShrSHNdID6Phty9K
-lPYoenUmpH0sdJDqQ5cVUDkmw0+f+XpROtCiBcN8kTmiVXQ5o4GWMIGTMA8GA1Ud
-EwEB/wQFMAMBAf8wCwYDVR0PBAQDAgL0MB0GA1UdJQQWMBQGCCsGAQUFBwMBBggr
-BgEFBQcDAjAdBgNVHQ4EFgQU2saIfk29nr+adaNemnS2AaNjXJEwHwYDVR0jBBgw
-FoAU2saIfk29nr+adaNemnS2AaNjXJEwFAYDVR0RBA0wC4IJbG9jYWxob3N0MAoG
-CCqGSM49BAMEA2gAMGUCMQCzxeexb5HauoM8OQPBK7MWxzganLfVoi1GCsbvjUQy
-AB8AAVijIPwT/MGcigge4z8CMFimJXl934AtL8iM+Jd9ykvNXXxzSn9YRm9aLD3K
-w6vam+k+gA4sdijDbRC/Tc/3NQ==
+MIIBwzCCAUqgAwIBAwIJAKlvU4MMj9FAMAoGCCqGSM49BAMEMA0xCzAJBgNVBAMM
+AmNhMB4XDTAwMDEwMTAwMDAwMFoXDTAxMDEwMTAwMDAwMFowDTELMAkGA1UEAwwC
+Y2EwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAASeQcdqy/n+tsyX4MIFD2kA/6T/IMOV
+tuJIHFUdWa6hOvozb0O18EXP7ZKxIn5WzOOsLMZRk/hxPTmrKxDL9taeZUHw+UGT
+KIU8ECJ2WtIvMsySPZGPM50Y9MA3Plizby2jdjB0MA8GA1UdEwEB/wQFMAMBAf8w
+DgYDVR0PAQH/BAQDAgEGMBEGCWCGSAGG+EIBAQQEAwICBDAdBgNVHQ4EFgQURRb1
+3Y5HR1QFOXMFZykLelX/p1AwHwYDVR0jBBgwFoAURRb13Y5HR1QFOXMFZykLelX/
+p1AwCgYIKoZIzj0EAwQDZwAwZAIwJ7SSvTdCuvmX2WUjNboVgELYt//kLc1vYED5
+R9U2z+9b4ZixtnA5y+o+uUzDI/4kAjAUpyGlrM8ts/NNSdCe8f12llg7VUPgFZ7g
+aasnq3YijB+lawuzV3sVVzWp+VDdHcw=
 -----END CERTIFICATE-----

spec/resources/custom.crt

@@ -1,13 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIB6jCCAXCgAwIBAgIJAKyx4KGEOyVdMAoGCCqGSM49BAMEMBwxGjAYBgNVBAMM
-EXRlc3QtaW50ZXJtZWRpYXRlMB4XDTE3MDEyMjE4NTU1MVoXDTE4MDEyMjE4NTU1
-MVowFDESMBAGA1UEAwwJdGVzdC1sZWFmMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE
-kZFi7jp4Z+3m1lR/aIHuNalLQtjaCErIgrWhFL7oUjzWMN1dR3nAmmosKlCSRc7A
-Xazs+CC0QB1LgsZCFFPhPqUd5456iwCHaSVQ3maESrZtzJo78v/fE9HRuuh5fFiL
-o4GFMIGCMAsGA1UdDwQEAwIE8DAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUH
-AwIwHQYDVR0OBBYEFB54cEd+wLKHpMKYkYCxmSgWERrQMB8GA1UdIwQYMBaAFMgN
-6Mqlnk3ZRmp4RrAXXKeC3yVHMBQGA1UdEQQNMAuCCWxvY2FsaG9zdDAKBggqhkjO
-PQQDBANoADBlAjEAwbhbwXjekyl3esK9ywh+jKCVhf7BzaF4H7LAxUE1PmXTORrZ
-tqz2MXK3/zYfe1bXAjAuan+xZ4d5zCgBvnFO2/LMEX07SFQJT3l1hKAZjpbdNm/K
-MY23IR6iLWkPlG1u+Wo=
------END CERTIFICATE-----

spec/resources/ecdsa-brainpoolP256r1.crt

@@ -0,0 +1,12 @@
+-----BEGIN CERTIFICATE-----
+MIIBzDCCAVKgAwIBAwIJAPr1Hn25EiltMAoGCCqGSM49BAMEMBcxFTATBgNVBAMM
+DGludGVybWVkaWF0ZTAeFw0wMDAxMDEwMDAwMDBaFw0wMTAxMDEwMDAwMDBaMBAx
+DjAMBgNVBAMMBWVjZHNhMFowFAYHKoZIzj0CAQYJKyQDAwIIAQEHA0IABHFxLQty
+7xhy4VNRwiEDQKZsW7LJtCLyTjdRWhouxNloIYipXMlS37km9UEdrsd42FDFDfTt
+KG6uCEVEGZzBoCWjgYwwgYkwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCB4Aw
+FgYDVR0lAQH/BAwwCgYIKwYBBQUHAwEwEQYJYIZIAYb4QgEBBAQDAgZAMB0GA1Ud
+DgQWBBR83waQCLiJ+QFYrLsXxHS2CYzYODAfBgNVHSMEGDAWgBQAeFKgmR+RS4S6
+aGaGjlA/5PWD+zAKBggqhkjOPQQDBANoADBlAjBmqsTwClBDF483fguALG+50Fn3
+ftYiZf8lPnj32A0H9ZqZTjQ2Gz5gAjSfp8Pw5gQCMQCUrJEWHPAScQn9Yjv1uYvZ
+pchlKHlqijnVVjYKQale+Xp5wwwZ08iXyvv/Z7cPUXM=
+-----END CERTIFICATE-----

spec/resources/ecdsa-brainpoolP384r1.crt

@@ -0,0 +1,13 @@
+-----BEGIN CERTIFICATE-----
+MIIB7DCCAXKgAwIBAwIJALTXGe8d5mhaMAoGCCqGSM49BAMEMBcxFTATBgNVBAMM
+DGludGVybWVkaWF0ZTAeFw0wMDAxMDEwMDAwMDBaFw0wMTAxMDEwMDAwMDBaMBAx
+DjAMBgNVBAMMBWVjZHNhMHowFAYHKoZIzj0CAQYJKyQDAwIIAQELA2IABIiO142r
+cv9Tz6PTp/Jhr3ohNMkZ5TjA+nsOyRbFLBxs+MguJthE/QtrwgyRDHtvEl2oJpGU
+ExAtgnCi1q3GcjLrcbT8Zho5u5PLjqr9KdyWh7ouwufm4mAkkcRSOwexGaOBjDCB
+iTAMBgNVHRMBAf8EAjAAMA4GA1UdDwEB/wQEAwIHgDAWBgNVHSUBAf8EDDAKBggr
+BgEFBQcDATARBglghkgBhvhCAQEEBAMCBkAwHQYDVR0OBBYEFP31WrC65Yw3JWl5
+k4z+1MPji2HOMB8GA1UdIwQYMBaAFAB4UqCZH5FLhLpoZoaOUD/k9YP7MAoGCCqG
+SM49BAMEA2gAMGUCMQDpPfanlncn4nDqMB0d4mq3NLpE8aMP+9ugAzKomfyK0TkB
+w5X54IdJ0gXci9MdJLoCMCacRwcRNQKmk843/aQbLQla+g+pr0Hhs13iHtulFG1M
++m0NNmS5fhNFFXWzq6nq4Q==
+-----END CERTIFICATE-----

spec/resources/ecdsa-brainpoolP512r1.crt

@@ -0,0 +1,14 @@
+-----BEGIN CERTIFICATE-----
+MIICDTCCAZSgAwIBAwIJAKHV+4wDmpfrMAoGCCqGSM49BAMEMBcxFTATBgNVBAMM
+DGludGVybWVkaWF0ZTAeFw0wMDAxMDEwMDAwMDBaFw0wMTAxMDEwMDAwMDBaMBAx
+DjAMBgNVBAMMBWVjZHNhMIGbMBQGByqGSM49AgEGCSskAwMCCAEBDQOBggAETU4L
+RaMd+CLdfZABdjY3Wk3VcvkO135O9rKoCsFvzW3tCNPTLy6TJ6yg8/S7QKbzfrHn
+pMWz6kpzvofAQdoM8WyBzjkwXciqLBfN6unTT25IQ4l6splIwrhAIkGToJaCLJ86
+YK80gWTWSvO6swR126rNwrZmnifqjIYFWf/8xM6jgYwwgYkwDAYDVR0TAQH/BAIw
+ADAOBgNVHQ8BAf8EBAMCB4AwFgYDVR0lAQH/BAwwCgYIKwYBBQUHAwEwEQYJYIZI
+AYb4QgEBBAQDAgZAMB0GA1UdDgQWBBQYhVlcLpuKWQ345i5CnTlEUkyxajAfBgNV
+HSMEGDAWgBQAeFKgmR+RS4S6aGaGjlA/5PWD+zAKBggqhkjOPQQDBANnADBkAjB5
+Zq9An3M1jOLoQWgJ7IlLDodV30rSA/gceVgQTCJf3RqvJM8HBTdR3uuSRNu7Hx4C
+MF9VI9fbjV+NZMmIIMrvhnJNKXUigRhoLf/ndp9CGewoH3u0EDgJl9Tp6LYKUD0d
+TQ==
+-----END CERTIFICATE-----

spec/resources/ecdsa-prime192v1.crt

@@ -0,0 +1,12 @@
+-----BEGIN CERTIFICATE-----
+MIIBvDCCAUGgAwIBAwIJAJM3S+91lkEaMAoGCCqGSM49BAMEMBcxFTATBgNVBAMM
+DGludGVybWVkaWF0ZTAeFw0wMDAxMDEwMDAwMDBaFw0wMTAxMDEwMDAwMDBaMBAx
+DjAMBgNVBAMMBWVjZHNhMEkwEwYHKoZIzj0CAQYIKoZIzj0DAQEDMgAEh5mjpf7u
+mEKpZ3WifMfHaVYLgI8n1OweEzlBFq6Gaa0QSvXjg4yWUTQXjN41Oifro4GMMIGJ
+MAwGA1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgeAMBYGA1UdJQEB/wQMMAoGCCsG
+AQUFBwMBMBEGCWCGSAGG+EIBAQQEAwIGQDAdBgNVHQ4EFgQUpjXAQYVTSb9/xILg
+vIv45Iqc8i4wHwYDVR0jBBgwFoAUAHhSoJkfkUuEumhmho5QP+T1g/swCgYIKoZI
+zj0EAwQDaQAwZgIxAIwa5GSlj2256H9kpDm+sHs67EUxt1qBVxEvl7oKEz84z7YX
+bzEOH+we/5yabN7XXQIxAOtPQAOt1c/oPFbvucY4YcyTGudbkd415PSbnY8r0GnF
+zzJLr8jwEpZhqDqYo2qASg==
+-----END CERTIFICATE-----

spec/resources/ecdsa-prime256v1.crt

@@ -0,0 +1,12 @@
+-----BEGIN CERTIFICATE-----
+MIIByzCCAVGgAwIBAwIJAMeS8IDc/lmbMAoGCCqGSM49BAMEMBcxFTATBgNVBAMM
+DGludGVybWVkaWF0ZTAeFw0wMDAxMDEwMDAwMDBaFw0wMTAxMDEwMDAwMDBaMBAx
+DjAMBgNVBAMMBWVjZHNhMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEz/BWOEKE
+xDBUxv4k9QEWUtFgAVxMPVz9tDwY3JXgiK4E7hlWJwzeH4kTQ7vDzwCKNOwO+y6Y
+8KKPYuUeT7UlKKOBjDCBiTAMBgNVHRMBAf8EAjAAMA4GA1UdDwEB/wQEAwIHgDAW
+BgNVHSUBAf8EDDAKBggrBgEFBQcDATARBglghkgBhvhCAQEEBAMCBkAwHQYDVR0O
+BBYEFGeM4UHnDNjeBalqpCPL8NqBK2pMMB8GA1UdIwQYMBaAFAB4UqCZH5FLhLpo
+ZoaOUD/k9YP7MAoGCCqGSM49BAMEA2gAMGUCMFXt4/1sekantuaN3W3jcSn/bngN
+zGfT3MWpfFJ/8qK7VWY6bwQ4EoXw7QkIt0dTqgIxAILGucxtGr6A/CxYCooB8jPH
+Z87CYJy9bFjfAbv2ApcqvFycs92yME6AebsKKrVgpg==
+-----END CERTIFICATE-----

spec/resources/ecdsa-secp256k1.crt

@@ -0,0 +1,12 @@
+-----BEGIN CERTIFICATE-----
+MIIByDCCAU6gAwIBAwIJANprzzZg6AHxMAoGCCqGSM49BAMEMBcxFTATBgNVBAMM
+DGludGVybWVkaWF0ZTAeFw0wMDAxMDEwMDAwMDBaFw0wMTAxMDEwMDAwMDBaMBAx
+DjAMBgNVBAMMBWVjZHNhMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEJmjt/BjILXkJ
+l+CMx9/87cRSUl1vnuN5Dd+em4ArBqDgyGZ9X9lao/Z7T+F4gIjfzzhglKVpnT/W
+wJ47hppl5qOBjDCBiTAMBgNVHRMBAf8EAjAAMA4GA1UdDwEB/wQEAwIHgDAWBgNV
+HSUBAf8EDDAKBggrBgEFBQcDATARBglghkgBhvhCAQEEBAMCBkAwHQYDVR0OBBYE
+FPeZAAyGbmiTZQgscj0iBquxgZWFMB8GA1UdIwQYMBaAFAB4UqCZH5FLhLpoZoaO
+UD/k9YP7MAoGCCqGSM49BAMEA2gAMGUCMBsY93/5lijFLI20Mktd7RIZBsJUjjLl
+2N2+bd+NDAF7VmS5PJmmpefF0YZgukkXZgIxAP4eyjI763RCYpAUVuTMlBrEI/Je
+jCD2UjcKphq3k5Z06Sk1Ia8ZCS7ffsrGDGekgw==
+-----END CERTIFICATE-----

spec/resources/ecdsa-secp384r1.crt

@@ -0,0 +1,13 @@
+-----BEGIN CERTIFICATE-----
+MIIB6TCCAW6gAwIBAwIJAP7v5hy58sn+MAoGCCqGSM49BAMEMBcxFTATBgNVBAMM
+DGludGVybWVkaWF0ZTAeFw0wMDAxMDEwMDAwMDBaFw0wMTAxMDEwMDAwMDBaMBAx
+DjAMBgNVBAMMBWVjZHNhMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE3qt0llDfBV2H
+z9aq6keDMZFpFDGVtc27VaveVGkAE8LkcSh2OxnFFA/PeJQIRdi5AYX1lms4Abfa
+FWpchvHj8kazY7u29AX6KHPHRiQn9xXmkxuE2LP3uIbncGXM1z90o4GMMIGJMAwG
+A1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgeAMBYGA1UdJQEB/wQMMAoGCCsGAQUF
+BwMBMBEGCWCGSAGG+EIBAQQEAwIGQDAdBgNVHQ4EFgQUE2LMlSwxKfiuh483u0H5
+G+xT7BMwHwYDVR0jBBgwFoAUAHhSoJkfkUuEumhmho5QP+T1g/swCgYIKoZIzj0E
+AwQDaQAwZgIxAIkh6xE41g15p5E/lpSUWDhofFVRsxaIX+Uk9v8+0NZRFTSAQ6mI
+aQbQqd4za7MiPQIxANGjaL2H//Gm1WvqZ2Ej66ZmYh+bdV5MK3DdgLbMX67UrdJq
+rDtcfdXyHfhxneNJNQ==
+-----END CERTIFICATE-----

spec/resources/ecdsa-secp521r1.crt

@@ -0,0 +1,14 @@
+-----BEGIN CERTIFICATE-----
+MIICDzCCAZSgAwIBAwIJAJKnWaLDsHmbMAoGCCqGSM49BAMEMBcxFTATBgNVBAMM
+DGludGVybWVkaWF0ZTAeFw0wMDAxMDEwMDAwMDBaFw0wMTAxMDEwMDAwMDBaMBAx
+DjAMBgNVBAMMBWVjZHNhMIGbMBAGByqGSM49AgEGBSuBBAAjA4GGAAQAXpCE3Hta
+PqnG21p5aKXM/iRAsqL80WQ8vU3yjs3Vo7JY9gmeK9cG3bEBh5ZkeTI6RM2KOU/d
+ZaI85CgXBP3ITSYBYdF0Yvt4IQadWYcEAJh4OWV5YYB7GezpKBYa+7b41XTah4WX
+NAKzlsGnBD2/Ia1inNbmqt+vBiwY+zPzq7OlGRKjgYwwgYkwDAYDVR0TAQH/BAIw
+ADAOBgNVHQ8BAf8EBAMCB4AwFgYDVR0lAQH/BAwwCgYIKwYBBQUHAwEwEQYJYIZI
+AYb4QgEBBAQDAgZAMB0GA1UdDgQWBBTOnqsJXwUmyKTluwMDC421HLZQOjAfBgNV
+HSMEGDAWgBQAeFKgmR+RS4S6aGaGjlA/5PWD+zAKBggqhkjOPQQDBANpADBmAjEA
+pjb+OcGjt/XWPgF/o4eYXadjaRWEnK05YRlqoCz9GO70OeYGDZRTM/A6CfcNY70l
+AjEA8/zaj035DO9L8kUW5EGTCEdXafOsdWHVPcLmDvShRcG04iDYn8ImaLXp/v9q
+NBg5
+-----END CERTIFICATE-----

spec/resources/ecdsa-sect283k1.crt

@@ -0,0 +1,12 @@
+-----BEGIN CERTIFICATE-----
+MIIBzzCCAVagAwIBAwIJAN+djpDGt4laMAoGCCqGSM49BAMEMBcxFTATBgNVBAMM
+DGludGVybWVkaWF0ZTAeFw0wMDAxMDEwMDAwMDBaFw0wMTAxMDEwMDAwMDBaMBAx
+DjAMBgNVBAMMBWVjZHNhMF4wEAYHKoZIzj0CAQYFK4EEABADSgAEBsLWcHZaX2za
+WzgKQcnN2jlAMM4kiY+SShj9a6jorRPAtRqjAYuLRWUajcd0qWr8IoRwqiag32Ur
+cPzF0qQkTh0+XrLIGRMWo4GMMIGJMAwGA1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQD
+AgeAMBYGA1UdJQEB/wQMMAoGCCsGAQUFBwMBMBEGCWCGSAGG+EIBAQQEAwIGQDAd
+BgNVHQ4EFgQU6LaUN9GzOtUtE8BHaUJ65Dax1eQwHwYDVR0jBBgwFoAUAHhSoJkf
+kUuEumhmho5QP+T1g/swCgYIKoZIzj0EAwQDZwAwZAIwWk7yzMu4wdzge81r+/rR
+uf7riBOZem/d+bCkdeD9RmvKS6ZOLBMmc1afKz+l9kmmAjAIkfNaBGQJq9rH0W/7
+5ZNb9GCMU9OTH3I0xvR4oMzKWAppxSyd7eeEpkyrj2bvSoc=
+-----END CERTIFICATE-----

spec/resources/ecdsa-sect283r1.crt

@@ -0,0 +1,12 @@
+-----BEGIN CERTIFICATE-----
+MIIB0DCCAVagAwIBAwIJAN/6y0kK9I+mMAoGCCqGSM49BAMEMBcxFTATBgNVBAMM
+DGludGVybWVkaWF0ZTAeFw0wMDAxMDEwMDAwMDBaFw0wMTAxMDEwMDAwMDBaMBAx
+DjAMBgNVBAMMBWVjZHNhMF4wEAYHKoZIzj0CAQYFK4EEABEDSgAEBp5QVA6vH3LX
+996ssT9bep3FQ0AbIoJoeX/U/FGtW63ivgK5A7cQJ+/O+QFD9uSSZZvvK2oKnUvI
+C/8I5DhEXilWQafSu6jko4GMMIGJMAwGA1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQD
+AgeAMBYGA1UdJQEB/wQMMAoGCCsGAQUFBwMBMBEGCWCGSAGG+EIBAQQEAwIGQDAd
+BgNVHQ4EFgQUQYK9NgeJBZ7DnLvETOYZo3tzTwowHwYDVR0jBBgwFoAUAHhSoJkf
+kUuEumhmho5QP+T1g/swCgYIKoZIzj0EAwQDaAAwZQIwf8GaosiWKKTbXr3BrNW2
+EyM/R0OCIXf+wFXUusL22uYQFB2fMmZX0TP+TUYFhDQKAjEAlSnlGtHrl5HhJcYm
+jhzdbJOlobI9htHvHLYaMMucwfPoPY06uFCfpYc9O7uLsCEs
+-----END CERTIFICATE-----

spec/resources/ecdsa-sect409k1.crt

@@ -0,0 +1,13 @@
+-----BEGIN CERTIFICATE-----
+MIIB7zCCAXagAwIBAwIJAPEERwFmhX16MAoGCCqGSM49BAMEMBcxFTATBgNVBAMM
+DGludGVybWVkaWF0ZTAeFw0wMDAxMDEwMDAwMDBaFw0wMTAxMDEwMDAwMDBaMBAx
+DjAMBgNVBAMMBWVjZHNhMH4wEAYHKoZIzj0CAQYFK4EEACQDagAEAJVMaHl6+yvp
+1wPQp+vwxPlwuS7YWZ1M0lE5OofWyQbIUA13amAvEHoozJ/ZrMMPEE4XhAGvyuiV
+HRK5B7gsJY/i5tLcNgvxPcbRj9/S3Xs72emMAgVc8cRyRgc8rdfdFkUpCtiQJZij
+gYwwgYkwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCB4AwFgYDVR0lAQH/BAww
+CgYIKwYBBQUHAwEwEQYJYIZIAYb4QgEBBAQDAgZAMB0GA1UdDgQWBBQ14wJcU+Lb
+H5cng3keFD0meW+QjjAfBgNVHSMEGDAWgBQAeFKgmR+RS4S6aGaGjlA/5PWD+zAK
+BggqhkjOPQQDBANnADBkAjAf2UY0KheiI0v6a4OdwfS9a0fHycnk2+MkLDwLt+WY
+8dz6WKM/Lz5rm4pL9JofJO0CMHQ2PmAbCLZW4MYJAlj7eTjZi/gtLUipHpEW6CYh
+mu3xdBSqq+3j67HR3H/C6GzK1A==
+-----END CERTIFICATE-----

spec/resources/ecdsa-sect409r1.crt

@@ -0,0 +1,13 @@
+-----BEGIN CERTIFICATE-----
+MIIB8DCCAXagAwIBAwIJAJ38kUuZF8j2MAoGCCqGSM49BAMEMBcxFTATBgNVBAMM
+DGludGVybWVkaWF0ZTAeFw0wMDAxMDEwMDAwMDBaFw0wMTAxMDEwMDAwMDBaMBAx
+DjAMBgNVBAMMBWVjZHNhMH4wEAYHKoZIzj0CAQYFK4EEACUDagAEAYy6o9uvpmAL
+hK2BTEwFprF9F8CYiPDP8XIw4LofUylpQ/UC2Y1Z9CU3/OI7P8F4JTNesQAiCZg/
+YX1We4S5oUQeo2VaQpVXMaHjF6gAOCq/5dwKRIVVkF3egeADZnGuaQALRWektymj
+gYwwgYkwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCB4AwFgYDVR0lAQH/BAww
+CgYIKwYBBQUHAwEwEQYJYIZIAYb4QgEBBAQDAgZAMB0GA1UdDgQWBBRncOAhq+yH
+7Hn4FDP50cd+UdSAEjAfBgNVHSMEGDAWgBQAeFKgmR+RS4S6aGaGjlA/5PWD+zAK
+BggqhkjOPQQDBANoADBlAjEAonxF9gvSeYxNxwBQmc+tf1T1kQUJGX27dak0gfu7
+5jWip9aG6h4++M48zpGH83HmAjBVp2Ya2yIHIBrBrdkmhQReePzgb4rDnhCQMgyC
+NDxUr8/g8zWOxE9ZurAcXC4eE/4=
+-----END CERTIFICATE-----

spec/resources/ecdsa-sect571k1.crt

@@ -0,0 +1,14 @@
+-----BEGIN CERTIFICATE-----
+MIICGjCCAaCgAwIBAwIJAKDFLBGhFzlYMAoGCCqGSM49BAMEMBcxFTATBgNVBAMM
+DGludGVybWVkaWF0ZTAeFw0wMDAxMDEwMDAwMDBaFw0wMTAxMDEwMDAwMDBaMBAx
+DjAMBgNVBAMMBWVjZHNhMIGnMBAGByqGSM49AgEGBSuBBAAmA4GSAAQH2rvw88SM
++Oeo2tr+X4BjAj9DBdY3xTLgPmhCXMpG3DBX89FCEmvRUsYvoiw0kmRttL/pFWdu
+tk7GGeBu+snP7fDYUHAtENYFNIFZNQ5O9EgkuxJGHTSbJeejiuEz/8BJc3FzFRD2
+CLElWnq2mnkA9nPuUpyC9PstpyxBXPDrWQf4bYVCDhOpnTCCrbJAXjOjgYwwgYkw
+DAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCB4AwFgYDVR0lAQH/BAwwCgYIKwYB
+BQUHAwEwEQYJYIZIAYb4QgEBBAQDAgZAMB0GA1UdDgQWBBQDfzlcSMU42BChA1Z6
+TpfxK6Ib2jAfBgNVHSMEGDAWgBQAeFKgmR+RS4S6aGaGjlA/5PWD+zAKBggqhkjO
+PQQDBANoADBlAjEAqRBmSQ9w/c32497KO0y+xVhUP681fPvig3giNSQgkasjydJ6
+DBfa3VZBP1O4wRBvAjBQshUHnuLE181Nabheel0lohpq6Zw5zfoObWwO3fYlmwwL
+gTnXmFOx4YEhSdK947c=
+-----END CERTIFICATE-----

spec/resources/ecdsa-sect571r1.crt

@@ -0,0 +1,14 @@
+-----BEGIN CERTIFICATE-----
+MIICGTCCAaCgAwIBAwIJAPgcvMv7leMNMAoGCCqGSM49BAMEMBcxFTATBgNVBAMM
+DGludGVybWVkaWF0ZTAeFw0wMDAxMDEwMDAwMDBaFw0wMTAxMDEwMDAwMDBaMBAx
+DjAMBgNVBAMMBWVjZHNhMIGnMBAGByqGSM49AgEGBSuBBAAnA4GSAAQCWNStXkYH
+xj+zaW2pqqZ5s6tVxrZWerVeFtWpXMBmv8hsckdGahtvOko7C63YkbBXvNVsba8s
+mllWoYPt5kRs4SSYsdnQfHwGgG+rSZpwqb45m3gyJamU21XL6SQ35JZ4QPQLKPhW
+mep7qVJGNc0Nf9PFg92/JHnvGDNIrwSCACeoPJk6lQbhuVwSvaazpyujgYwwgYkw
+DAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCB4AwFgYDVR0lAQH/BAwwCgYIKwYB
+BQUHAwEwEQYJYIZIAYb4QgEBBAQDAgZAMB0GA1UdDgQWBBS3R3xbg5V1fc0H+xHz
+SyGjp2oowjAfBgNVHSMEGDAWgBQAeFKgmR+RS4S6aGaGjlA/5PWD+zAKBggqhkjO
+PQQDBANnADBkAjAp5lY1izems7Ld+8U7CpoMAHxLT1MXUMo/YRTgpR9Mmmp4RKd8
++tnZvfMT/nZsIAwCMGrKVM8hCU8GWtuaYw0QNGjf34GvUmsqWogbvu9xukXCIG01
+hVPEsdUwABgIjNrSDA==
+-----END CERTIFICATE-----

spec/resources/intermediate.crt

@@ -1,13 +1,12 @@
 -----BEGIN CERTIFICATE-----
-MIIB+TCCAX+gAwIBAgIJAOko1FM8hOfNMAoGCCqGSM49BAMEMBIxEDAOBgNVBAMM
-B3Rlc3QtY2EwHhcNMTcwMTIyMTg1NTUxWhcNMTgwMTIyMTg1NTUxWjAcMRowGAYD
-VQQDDBF0ZXN0LWludGVybWVkaWF0ZTB2MBAGByqGSM49AgEGBSuBBAAiA2IABNjg
-qyABIHj96OvYN1YCe+z3mILDlm1qNXm1bpoMcx7AVANk+AFUjbK/mhSyx5ONbBw/
-4kMBNtVW7OpkiZwLr57SbqDv0n4ExirUvvBm7OcqqSY+73lXM/cezMTRA/3ZqqOB
-ljCBkzAPBgNVHRMBAf8EBTADAQH/MAsGA1UdDwQEAwIC9DAdBgNVHSUEFjAUBggr
-BgEFBQcDAQYIKwYBBQUHAwIwHQYDVR0OBBYEFMgN6Mqlnk3ZRmp4RrAXXKeC3yVH
-MB8GA1UdIwQYMBaAFNrGiH5NvZ6/mnWjXpp0tgGjY1yRMBQGA1UdEQQNMAuCCWxv
-Y2FsaG9zdDAKBggqhkjOPQQDBANoADBlAjAUAte4U3OtzmeQLA/Cq1JTtsrE7sy9
-kZzxGHxACZ53sTGA2c4K86lR2RGoXYvW62wCMQCNSLH+qukadu52ip7HTkihrtae
-hBVOBO+el6rCcby91xUuWU24AJy9Ce9TxcQC384=
+MIIBzTCCAVSgAwIBAwIJAJGZiLHRskwrMAoGCCqGSM49BAMEMA0xCzAJBgNVBAMM
+AmNhMB4XDTAwMDEwMTAwMDAwMFoXDTAxMDEwMTAwMDAwMFowFzEVMBMGA1UEAwwM
+aW50ZXJtZWRpYXRlMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEKN30P7XEaQ18+iRv
+d+P5gAdjZAX+NXPVTOAqBaPx9FnwIbd7LvAAbhhgvtPSNAHuipe7tSc9fPv6mGOn
+MkDxZ7eLpxoLEcOlbmhJFsIvV9VvesKwAuQrSHWliGPnpTvXo3YwdDAPBgNVHRMB
+Af8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjARBglghkgBhvhCAQEEBAMCAgQwHQYD
+VR0OBBYEFAB4UqCZH5FLhLpoZoaOUD/k9YP7MB8GA1UdIwQYMBaAFEUW9d2OR0dU
+BTlzBWcpC3pV/6dQMAoGCCqGSM49BAMEA2cAMGQCMCN4U7KIqh1F09gi0UTtNaEJ
+JMm/3VWU+Fe1cNtZniH0/emVZkUk3CgnkEqQAFtY6QIwL61nzp+fT4D8lHDisbbJ
+AoHL24XQ5jo2iKUq70DogO5A26uWWQh5/4bG+AEcW9sx
 -----END CERTIFICATE-----

spec/resources/md5.crt

@@ -0,0 +1,12 @@
+-----BEGIN CERTIFICATE-----
+MIIByzCCAVCgAwIBAwIJAOg4GiMlL2qfMAsGCSqGSIb3DQEBBDAXMRUwEwYDVQQD
+DAxpbnRlcm1lZGlhdGUwHhcNMDAwMTAxMDAwMDAwWhcNMDEwMTAxMDAwMDAwWjAO
+MQwwCgYDVQQDDANtZDUwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAATx1C8bo5pA
+zE06gBiOXpOdOitxE5Cfi6MixQpxuJMOty7HiyzamzQ4Vr6F2eenCAChkLrkHUun
+jUUCrKfqgNfXo4GMMIGJMAwGA1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgeAMBYG
+A1UdJQEB/wQMMAoGCCsGAQUFBwMBMBEGCWCGSAGG+EIBAQQEAwIGQDAdBgNVHQ4E
+FgQUGqSSGG8wVN5TEcxdGxS77PdfBMkwHwYDVR0jBBgwFoAUAHhSoJkfkUuEumhm
+ho5QP+T1g/swCwYJKoZIhvcNAQEEA2gAMGUCMQDzEZ7wUy1SUcNGlIhl/cADzAmy
+s6A8SAYGioGiRRBIvONpY2Qj8x6GwrONYo7O0e0CMECcT7ztjyNgwZOJvF0nFlW/
+72ax0jHmDKDn06sIaNF5nkqLiHVBPbByQl8OLBBulw==
+-----END CERTIFICATE-----

spec/resources/must-staple.crt

@@ -0,0 +1,13 @@
+-----BEGIN CERTIFICATE-----
+MIIB5DCCAWmgAwIBAwIJANbDvMZ8+NGNMAoGCCqGSM49BAMEMBcxFTATBgNVBAMM
+DGludGVybWVkaWF0ZTAeFw0wMDAxMDEwMDAwMDBaFw0wMTAxMDEwMDAwMDBaMBYx
+FDASBgNVBAMMC211c3Qtc3RhcGxlMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE
+vBVPSoUh7qsJcsfSjTISKh+4jaaHadnQpqEMW8iRScVAcz6xnFnz6iukLhJFYXd6
+du0lthPwV5uMrhSfu/6b1aOBnjCBmzAMBgNVHRMBAf8EAjAAMA4GA1UdDwEB/wQE
+AwIHgDAWBgNVHSUBAf8EDDAKBggrBgEFBQcDATARBglghkgBhvhCAQEEBAMCBkAw
+HQYDVR0OBBYEFFBrn72mWwzWPz1VE+KVZbvTMM4nMB8GA1UdIwQYMBaAFAB4UqCZ
+H5FLhLpoZoaOUD/k9YP7MBAGCCsGAQUFBwEYAQH/BAEwMAoGCCqGSM49BAMEA2kA
+MGYCMQDW0qQqcjmNrEvH8nmNwuPEHNOcbbhNXD/mGMaU7rnkdL8hZTvYInn8m00F
+qzUaw1gCMQDT2OmQef8B9Z3wRtZUUd8u4KA89rWRwbU0PQDHaMNMZEKzY8Zdp6Ho
+HYneKFKDSI4=
+-----END CERTIFICATE-----

spec/resources/rsa-1024.crt

@@ -0,0 +1,14 @@
+-----BEGIN CERTIFICATE-----
+MIICETCCAZigAwIBAwIJAKyF8+J/8aORMAoGCCqGSM49BAMEMBcxFTATBgNVBAMM
+DGludGVybWVkaWF0ZTAeFw0wMDAxMDEwMDAwMDBaFw0wMTAxMDEwMDAwMDBaMBAx
+DjAMBgNVBAMMBWVjZHNhMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC+Wh9i
+6af92r6HdK8VVyxjIXLpkk9peQnF1HYeePiEe7L7EgRMAdtTGzSBpo9Wbs9YKESm
+wcwLn3i0meOl4s+0hOCPhNY7O4WGoozgeTNoicJ8Ln8KmhaOnkGNEgtThxOmpyih
+8+r9LwqSfVgR2nXL9eO1gPml15bupB9/PvWF/wIDAQABo4GMMIGJMAwGA1UdEwEB
+/wQCMAAwDgYDVR0PAQH/BAQDAgeAMBYGA1UdJQEB/wQMMAoGCCsGAQUFBwMBMBEG
+CWCGSAGG+EIBAQQEAwIGQDAdBgNVHQ4EFgQU1OC0bMk6mKiQ03ToQKmnaW7wWcAw
+HwYDVR0jBBgwFoAUAHhSoJkfkUuEumhmho5QP+T1g/swCgYIKoZIzj0EAwQDZwAw
+ZAIwLBi8qdWOWkFfbW3Y4qrKo2XT4K2cvb6+71Dko4q7iWffzO2zKnSpFqn5enPQ
+u527AjAcp+IGbKPt1nj3MiJtq5Ww6yfg/MsR0hrXlYYjMV2CY6n8vXCOcsUp0ICr
+u+4Cetk=
+-----END CERTIFICATE-----

spec/resources/rsa-1024.pem

@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXQIBAAKBgQC0xBo+MgjnYqvszjUpslonvcQVI1TG7yxlGCWqpvN0a3zdgBpV
-lpXv7q/821jUtlLc2BhNohRXuoejc2oiG7IOv7Md204NnoTQbxLo6gehnMyo86il
-Q7KNAAW4tam79xNgOfdkkV0d80AfG148j+N6jDZCOoZ3dFwH4a6vcSWRgQIDAQAB
-AoGBAJ7j+MVOqbDpdIG0R9qc4M4p6Z9C7RPny7gY35L/KOPeT2VLYtp0gNrjjWHP
-VGe002U3tTUYEJWEahFsM5BDk+ASqyzesPD5lWzi6QSO3cIkvNSYLdBezNprcPk4
-PEy1pX+IXrRFeDXE/wncovuYP2STF18SSP7YgCMBAAwgeZAhAkEA7xLuNz6Qt7HK
-euShzsvmzNUIaoBXa9qiOWoIb7aHa/uK87SwXpy6iV85TdWowD34JPnPiRx6FSPk
-4rOXYBq0lQJBAMGQYF/ItKUGYnwj7z2Q7N3/Pz5fTyoqzQI7Nza8aCEabFNzAdMv
-nZ2ROyWC/qXZ1osgPuwTBBfu9ty7GH2p4j0CQQCk+jJLCzDAor7waV/Dne+qQAQr
-wl8RfXFfH22s8Y+oE5CCtpjS4WLUM1MPBDcMWncnxP/TRUR13CwxyO7YEfW1AkBv
-VRqJnUiB7sUwv/54O+Zx3cFDn9BJ4apfES411nJSL/+ElA7FqIqQuZr6fXj4be5f
-wWFPqbReC72Dwj1Y8iDFAkAXpo8CtvqtxQYdbIh0Jmdj2xHWppkbBs9dT/qVAOdO
-RIA5UKKyyweZc+6ZFbAMeouhHGljcL73zOZt5V4YloT7
+MIICXAIBAAKBgQC+Wh9i6af92r6HdK8VVyxjIXLpkk9peQnF1HYeePiEe7L7EgRM
+AdtTGzSBpo9Wbs9YKESmwcwLn3i0meOl4s+0hOCPhNY7O4WGoozgeTNoicJ8Ln8K
+mhaOnkGNEgtThxOmpyih8+r9LwqSfVgR2nXL9eO1gPml15bupB9/PvWF/wIDAQAB
+AoGAZNUgoyja0GI7Y02wIUHYRXrGgGv8nQZ84sq091dlbeiI2u6kUA77u35BxhwQ
++dwhAbXzB9LI369OJX0PViRbmX1AdgTJwJLXkDB/ZI53FYFpb2n068M4SJza7XfP
+Dt4BxDD6+jlPXZvQl39X8ix6spnduSla7bu3vhTMnzwz52ECQQD1zE16OWx42yRR
+ZLjtdb9lx+QLGDO9jl3qDdFeePqdb7wWPpwPWltsZNUBYBFl+tSfX5XW/WCw0whQ
+NC7ulq/1AkEAxkCvYC77cXXySfZ5gL3HZnjGL9E4b05g3P/F0/wDdBeV1Pf7EMS7
+C3zN2vOYegx6pvNcsvOiZllJQUl3XHhpowJAfSesA6Ido2QiF/erWe3sqQyhBy0p
+m0lUdIrYorwDEAsGwGTc3cxqZMTq2Kpr8XtIrGXlS/T0ONUblIsdoorDyQJADSyR
+OuAEX3bKAfY5/r8duAaAjP7nNCZOM4FfoQWXKSjEESHlcijQkSPa/hi/4iRgJiX3
+3ABqo0h9oLQEFYX+5wJBALnnSFipTA4wbl2+Azk2ON2f3IN7k9XBGoa0vMkELK/Y
+u9dxara7fIdA0mNtZmaxskxBV73ZGfIEDbxwgOSmDts=
 -----END RSA PRIVATE KEY-----

spec/resources/rsa-2048.crt

@@ -0,0 +1,16 @@
+-----BEGIN CERTIFICATE-----
+MIIClzCCAhygAwIBAwIJAM2sre8y+fwqMAoGCCqGSM49BAMEMBcxFTATBgNVBAMM
+DGludGVybWVkaWF0ZTAeFw0wMDAxMDEwMDAwMDBaFw0wMTAxMDEwMDAwMDBaMBAx
+DjAMBgNVBAMMBWVjZHNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
+orI1NFrMMLkDclhUDnOqHWFtUyabQrGD4uUbaWNxR4T+fC54qND75keMZdHmQvsu
+KZJRJSUIixOnosxUMEPWpQJ4Sg5bmK2t9tQ8O30u6sOEQ0lwlpba1Nq/aVtJ+mIi
+rsmoy4+mM9Pvt0u+AUDrHEvtPFsrw2bPazuz2eM7yW2l7mhSVoMxxJXv4HmPYECG
+HfTZLVp8Js6m7QVwFfZ70NyRc9U2zDBT6hXHH5/QKvmBQUerE39eDPRIvGfYjS1K
+CzD4YnyXOQDmxvMJoxjdeu7fdejYSDVPDR8zNGQpuMLo2UA9PZCbj6HLQhP6rXhc
+XQbI6BX2YS2ey4wf0enb4wIDAQABo4GMMIGJMAwGA1UdEwEB/wQCMAAwDgYDVR0P
+AQH/BAQDAgeAMBYGA1UdJQEB/wQMMAoGCCsGAQUFBwMBMBEGCWCGSAGG+EIBAQQE
+AwIGQDAdBgNVHQ4EFgQUTxIM2O5bu94Zjn1sZHUeILyRqK4wHwYDVR0jBBgwFoAU
+AHhSoJkfkUuEumhmho5QP+T1g/swCgYIKoZIzj0EAwQDaQAwZgIxAJzXhVwvuqn0
+WKIvnR9irvGqOy16bAhRuUadhH4H5yHaWIihzxnoTOl1WSBwRhokKgIxAId/0ZpG
+4Jc9fdDuZ+Qi8UKRvBb0SNF226gTCTtn9VrO/cujSHhc+nyKfP71L/5tCg==
+-----END CERTIFICATE-----

spec/resources/rsa-3072.crt

@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDFzCCApygAwIBAwIJALm5kmnyIuMCMAoGCCqGSM49BAMEMBcxFTATBgNVBAMM
+DGludGVybWVkaWF0ZTAeFw0wMDAxMDEwMDAwMDBaFw0wMTAxMDEwMDAwMDBaMBAx
+DjAMBgNVBAMMBWVjZHNhMIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEA
+r6CAtxcIHGrxk23AgK4/fQVeZ1X3O2HE8ZZqdRGb+Qp2wBICacowcKU7R+6jYPE/
+vUQv1jVaSHFMrJFsN/Mj/2ZLrZV7jECOxexaiF+1SRJ9g6RK25r9etZ/gmYyJQkL
+Zr5LH501CSWpPPOy/M80VjsEnQE0OeWgEkJee7pr41SgVbBQb+VtU72JHd1J6b94
+zqXOGuLCfJbQU23hpTolc3jTGwsC8iN64HtqirNqMJoSQj2TblNb7E/DfrWM6G1l
+y8RDSUaswr1PUEeOEhnPPxQsGWdOCRmBdnWjlwKb+bs6/QMJ41/ZOFZpwMsFFNSU
+Fpcli/hxFf7yuk4mk3lACyAe33nJvyU/UdnjWbhEYAsskOKO/i3LkafS5mpkH/+7
+kmf/bWiin69Amw9p9wTRJEVL8N+CmnphUs8dMkVAxEFzrnLHD4+m6NCPkc2TMAGo
+faDbEmHU2CBQfExmZanp3YV9EQCAI+tOIuziiEoSsZCO2DzThZaAONBDKrsnuMJ3
+AgMBAAGjgYwwgYkwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCB4AwFgYDVR0l
+AQH/BAwwCgYIKwYBBQUHAwEwEQYJYIZIAYb4QgEBBAQDAgZAMB0GA1UdDgQWBBSS
+eIf+CrQ6Jd1X8LOERjZIQNqGZDAfBgNVHSMEGDAWgBQAeFKgmR+RS4S6aGaGjlA/
+5PWD+zAKBggqhkjOPQQDBANpADBmAjEArrptDgqzqJd3SmO1VdlyxCy4dawrfwqK
+MmInreWtWwMoWKI+/7miQ5Phw1hF7rKjAjEA0znENSImIsqWyy9BlTZMjd948GPm
+tqlfyecH4dkA2vqnrKy47GOtQJLCphudLwZg
+-----END CERTIFICATE-----

spec/resources/rsa-4096.crt

@@ -0,0 +1,22 @@
+-----BEGIN CERTIFICATE-----
+MIIDlzCCAxygAwIBAwIJAIIijrAYJBaYMAoGCCqGSM49BAMEMBcxFTATBgNVBAMM
+DGludGVybWVkaWF0ZTAeFw0wMDAxMDEwMDAwMDBaFw0wMTAxMDEwMDAwMDBaMBAx
+DjAMBgNVBAMMBWVjZHNhMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA
+wFiTxqV2kKUI2zbrv2tFNeEjugbLdXxNV9AZjKEmkMKA3MaCuWwLkPlniR4k5nmp
+LHPIxPNcJC5ycr9+rWDWICY4b54K9MOQkVoyidCzJwctxuvokI0gzqfCVrHpHYFV
+fU0V4irsEjcfgQoc4Y7wt4OPtb4z3yf74lzekG6+rRebaFcqPujpErBYFuIxE7fY
+ineFParlB3pGaWi0aYuRvSs3ZTVIbRKVcW3AV0n/WzfjTSaMij4flZXgosBt6UzB
+rRBMcxd8e0QpciOpzzw8dWYAXlgsFoB7XE8fjfxDYkgnc1X05q/mFmqyhAuh+Lhg
+Xlbtu6wkV1GMceVPZkJijeHwS+3Ee4ao2UHGZeXjL/01C/5xiyjAU2eecbcQFuS9
+z6YkLp2WpmHYaNmYg8Q7JgWQ6bZrF8+aFsdA5KPLhQLkvDTM2YHQLGP+48xT6uel
+KkktH4J3UNEeFFxLJFA8nTruGXFNIzDb/xBK3u1Hj9tWIrZp6RjSgiwZRYzNSfgo
+XF4QSGdMmY/JWBv4NB2PWB7pb5yS4wFuyJumrJeiEv68djYc7LEO5nqSmnXGmR53
+yn10SPejGaCyREur8f1rp4uSLZ07E5ECGS0Yf0i37LPhLaIUaDr20Hq3DlIA8apV
+DcYgeSpHiIkoVg2IYeS9s5vYNcPXiwxHl6yhf7moEb8CAwEAAaOBjDCBiTAMBgNV
+HRMBAf8EAjAAMA4GA1UdDwEB/wQEAwIHgDAWBgNVHSUBAf8EDDAKBggrBgEFBQcD
+ATARBglghkgBhvhCAQEEBAMCBkAwHQYDVR0OBBYEFPlHI23c8inFv5LPovmMLF7m
+EBQgMB8GA1UdIwQYMBaAFAB4UqCZH5FLhLpoZoaOUD/k9YP7MAoGCCqGSM49BAME
+A2kAMGYCMQD+lr2emoR9Y2rOUWYeBLQHoZUuiage6wzeuXOcHz33AvR07zLdDPhx
+CF1SNUDEX4UCMQCHJrjjqLF1nleU7cJbprFtTkxafzY41/MWcwd1iLQ/PJNawFIZ
+7sgyboZOblvL7ig=
+-----END CERTIFICATE-----

spec/resources/rsa-512.crt

@@ -0,0 +1,12 @@
+-----BEGIN CERTIFICATE-----
+MIIBzTCCAVSgAwIBAwIJAIusKLoLX7bsMAoGCCqGSM49BAMEMBcxFTATBgNVBAMM
+DGludGVybWVkaWF0ZTAeFw0wMDAxMDEwMDAwMDBaFw0wMTAxMDEwMDAwMDBaMBAx
+DjAMBgNVBAMMBWVjZHNhMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAL4vULTDXDkQ
+RxjIU8q4i61OAyr/D5uk7/f6s+gGNEePm5cau4+nri22kQ4a5/+gSzCDoSmVxZgx
+mY9NZ2DoTxsCAwEAAaOBjDCBiTAMBgNVHRMBAf8EAjAAMA4GA1UdDwEB/wQEAwIH
+gDAWBgNVHSUBAf8EDDAKBggrBgEFBQcDATARBglghkgBhvhCAQEEBAMCBkAwHQYD
+VR0OBBYEFCuhlibqfA/pi1VBEaYQ98gbTeD8MB8GA1UdIwQYMBaAFAB4UqCZH5FL
+hLpoZoaOUD/k9YP7MAoGCCqGSM49BAMEA2cAMGQCMGFkcij1XcYqBeB5D07XCyGs
+KvSrmFetcgV0+RRAhpqmOIaFBAMYJcEipVWcKlJ/PgIwfl48Znn7w6fgUQvFFV30
+zodBiwxxW/qpM1CgA0dvEB9/0T3KOIrvIp/MimpOfA18
+-----END CERTIFICATE-----

spec/resources/rsa-768.crt

@@ -0,0 +1,13 @@
+-----BEGIN CERTIFICATE-----
+MIIB7jCCAXSgAwIBAwIJAOpKX9r4hq3tMAoGCCqGSM49BAMEMBcxFTATBgNVBAMM
+DGludGVybWVkaWF0ZTAeFw0wMDAxMDEwMDAwMDBaFw0wMTAxMDEwMDAwMDBaMBAx
+DjAMBgNVBAMMBWVjZHNhMHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAK1LlPCnGDTs
+l20PBthCFmheQrsIacDJ9QovffGtRCGO7O8L2J/i89MWP5cNRZKWSPdbt5RrOhxt
+KadRc8BZRWi2Kkj/Bhf25ccedjaPWdjLA2Nqfhyarzi3VAzzNHOOvQIDAQABo4GM
+MIGJMAwGA1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgeAMBYGA1UdJQEB/wQMMAoG
+CCsGAQUFBwMBMBEGCWCGSAGG+EIBAQQEAwIGQDAdBgNVHQ4EFgQUeKpPPmQi5EFx
+/ya9A8eDnuLEOnwwHwYDVR0jBBgwFoAUAHhSoJkfkUuEumhmho5QP+T1g/swCgYI
+KoZIzj0EAwQDaAAwZQIwJ6v6If88s1scl/3mhl3Xij1IryBDCnF+I/mJ87OOvaGr
+JdF7wtoiaKWq97MGPp+jAjEA1l2Vb1le7Ou/UMRfj7zBMEMRjUsQYYOfFNkgdY7o
+J/nZhrFsEYodMMQjKrJq5r/g
+-----END CERTIFICATE-----

spec/resources/self-signed.crt

@@ -1,13 +1,12 @@
 -----BEGIN CERTIFICATE-----
-MIICBjCCAYugAwIBAgIJAPnnJnLp7H/XMAoGCCqGSM49BAMEMBQxEjAQBgNVBAMM
-CWxvY2FsaG9zdDAeFw0xNzAxMjIxNjM1NDdaFw0xODAxMjIxNjM1NDdaMBQxEjAQ
-BgNVBAMMCWxvY2FsaG9zdDB2MBAGByqGSM49AgEGBSuBBAAiA2IABJvRcgAMkjzZ
-p0YD/mXa2Td8sy7fBr7F5Sj8toSmLAxkxxPCnm9DDdLQXy7IZXA1HJkiRUIJ8BTk
-gSxmKQBwl3my2quHGx7GSZshpER4tRtqWI21dTUkuu9bGR66bbLa8aOBqDCBpTAP
-BgNVHRMBAf8EBTADAQH/MAsGA1UdDwQEAwIC9DAdBgNVHSUEFjAUBggrBgEFBQcD
-AQYIKwYBBQUHAwIwHQYDVR0OBBYEFCEkGXQc44mMopATg1jr+stKnF4LMB8GA1Ud
-IwQYMBaAFCEkGXQc44mMopATg1jr+stKnF4LMBQGA1UdEQQNMAuCCWxvY2FsaG9z
-dDAQBggrBgEFBQcBGAEB/wQBMDAKBggqhkjOPQQDBANpADBmAjEAkPKxToKRloWT
-eH4lGaUrqBGpRof92rWmJiBLs5WnaYM73S/GdKNK1j0jKRCKXKpzAjEAgpjvaUhd
-qXkR3g8iWedrFjkVHHVrUGV9JW7elHP7bD6XryqsGRNK2X8yq0J616gP
+MIIBsjCCAVmgAwIBAwIJAIWcZTacPsW2MAoGCCqGSM49BAMEMBYxFDASBgNVBAMM
+C3NlbGYtc2lnbmVkMB4XDTAwMDEwMTAwMDAwMFoXDTAxMDEwMTAwMDAwMFowFjEU
+MBIGA1UEAwwLc2VsZi1zaWduZWQwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARM
+cLdZOmHY7MIISzm+AU0Qf81O7PCedDgobv2c75M4T8Vr2DyydzeDrq3zEgFZzB1N
+2mb/vO4t1r2djczV3RlSo4GPMIGMMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/
+BAQDAgGGMBYGA1UdJQEB/wQMMAoGCCsGAQUFBwMBMBEGCWCGSAGG+EIBAQQEAwIC
+RDAdBgNVHQ4EFgQU9cUaSnS1wTgDUTO/hg2/bmHzdV0wHwYDVR0jBBgwFoAU9cUa
+SnS1wTgDUTO/hg2/bmHzdV0wCgYIKoZIzj0EAwQDRwAwRAIgJ25g2tM8OSC9rgSP
+iwq/AffU5Wp4cK4TAY3j9WSevSQCIElM6ESRSbSRliOPwj5YVJ3P6WP4/9ZDG5rN
+x3QQwwvE
 -----END CERTIFICATE-----

spec/resources/sha1.crt

@@ -0,0 +1,12 @@
+-----BEGIN CERTIFICATE-----
+MIIByDCCAU+gAwIBAwIJAIh9+NXSIWNlMAkGByqGSM49BAEwFzEVMBMGA1UEAwwM
+aW50ZXJtZWRpYXRlMB4XDTAwMDEwMTAwMDAwMFoXDTAxMDEwMTAwMDAwMFowDzEN
+MAsGA1UEAwwEc2hhMTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABLkLGZc0Rmjz
+hR04uZOb2Fiw+74GEUigcE/+xd/kATNp2wtfHPmdsqWfNfJb3WeoTt5hTKqRF6rw
+aJNRuGw6FuCjgYwwgYkwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCB4AwFgYD
+VR0lAQH/BAwwCgYIKwYBBQUHAwEwEQYJYIZIAYb4QgEBBAQDAgZAMB0GA1UdDgQW
+BBQkRXPFW+c/3gVpLSa61TN7VPc69jAfBgNVHSMEGDAWgBQAeFKgmR+RS4S6aGaG
+jlA/5PWD+zAJBgcqhkjOPQQBA2gAMGUCMAuuX5kasC26adZjrPDBeTHoK8VKH+BE
+NL6B2M9gGdBLaM4lnR0bTym+/j7D2/KcKwIxAPIsm1lV52Qh69JmB5Qde22LSWIo
+Jd+wwyJ7u2EXBWHXf/CAgMfzc6vctngLWVxsww==
+-----END CERTIFICATE-----