Merge pull request #313 from randombit/path-validation-fixes

Fix cert validation bugs found by x509test.

54 files changed, 2851 insertions, 119 deletions

diff --git a/src/lib/cert/x509/cert_status.h b/src/lib/cert/x509/cert_status.h
index 56777cae8..5028af384 100644
--- a/src/lib/cert/x509/cert_status.h
+++ b/src/lib/cert/x509/cert_status.h
@@ -31,6 +31,8 @@ enum class Certificate_Status_Code {
    CERT_ISSUER_NOT_FOUND = 3000,
    CANNOT_ESTABLISH_TRUST,
 
+   CERT_CHAIN_LOOP,
+
    // Validation errors
    POLICY_ERROR = 4000,
    INVALID_USAGE,
@@ -42,6 +44,8 @@ enum class Certificate_Status_Code {
    OCSP_CERT_NOT_LISTED,
    OCSP_BAD_STATUS,
 
+   CERT_NAME_NOMATCH,
+
    // Hard failures
    CERT_IS_REVOKED = 5000,
    CRL_BAD_SIGNATURE,
diff --git a/src/lib/cert/x509/info.txt b/src/lib/cert/x509/info.txt
index 291be3114..be1e879c3 100644
--- a/src/lib/cert/x509/info.txt
+++ b/src/lib/cert/x509/info.txt
@@ -1,4 +1,4 @@
-define X509_CERTIFICATES 20131128
+define X509_CERTIFICATES 20151023
 define OCSP 20131128
 
 <requires>
diff --git a/src/lib/cert/x509/key_constraint.h b/src/lib/cert/x509/key_constraint.h
index 3509b6868..179e413b5 100644
--- a/src/lib/cert/x509/key_constraint.h
+++ b/src/lib/cert/x509/key_constraint.h
@@ -18,15 +18,15 @@ namespace Botan {
 */
 enum Key_Constraints {
    NO_CONSTRAINTS     = 0,
-   DIGITAL_SIGNATURE  = 32768,
-   NON_REPUDIATION    = 16384,
-   KEY_ENCIPHERMENT   = 8192,
-   DATA_ENCIPHERMENT  = 4096,
-   KEY_AGREEMENT      = 2048,
-   KEY_CERT_SIGN      = 1024,
-   CRL_SIGN           = 512,
-   ENCIPHER_ONLY      = 256,
-   DECIPHER_ONLY      = 128
+   DIGITAL_SIGNATURE  = 1 << 15,
+   NON_REPUDIATION    = 1 << 14,
+   KEY_ENCIPHERMENT   = 1 << 13,
+   DATA_ENCIPHERMENT  = 1 << 12,
+   KEY_AGREEMENT      = 1 << 11,
+   KEY_CERT_SIGN      = 1 << 10,
+   CRL_SIGN           = 1 << 9,
+   ENCIPHER_ONLY      = 1 << 8,
+   DECIPHER_ONLY      = 1 << 7
 };
 
 class Public_Key;
diff --git a/src/lib/cert/x509/x509cert.cpp b/src/lib/cert/x509/x509cert.cpp
index 43bf1099d..3d1ebbbad 100644
--- a/src/lib/cert/x509/x509cert.cpp
+++ b/src/lib/cert/x509/x509cert.cpp
@@ -1,6 +1,6 @@
 /*
 * X.509 Certificates
-* (C) 1999-2010 Jack Lloyd
+* (C) 1999-2010,2015 Jack Lloyd
 *
 * Botan is released under the Simplified BSD License (see license.txt)
 */
@@ -224,7 +224,7 @@ bool X509_Certificate::is_CA_cert() const
    if(!subject.get1_u32bit("X509v3.BasicConstraints.is_ca"))
       return false;
 
-   return allowed_usage(KEY_CERT_SIGN);
+   return allowed_usage(Key_Constraints(KEY_CERT_SIGN));
    }
 
 bool X509_Certificate::allowed_usage(Key_Constraints usage) const
@@ -236,10 +236,37 @@ bool X509_Certificate::allowed_usage(Key_Constraints usage) const
 
 bool X509_Certificate::allowed_usage(const std::string& usage) const
    {
-   for(auto constraint : ex_constraints())
-      if(constraint == usage)
+   const std::vector<std::string> ex = ex_constraints();
+
+   if(ex.empty())
+      return true;
+
+   if(std::find(ex.begin(), ex.end(), usage) != ex.end())
+      return true;
+
+   return false;
+   }
+
+bool X509_Certificate::allowed_usage(Usage_Type usage) const
+   {
+   switch(usage)
+      {
+      case Usage_Type::UNSPECIFIED:
          return true;
 
+      case Usage_Type::TLS_SERVER_AUTH:
+         return allowed_usage(Key_Constraints(DATA_ENCIPHERMENT | KEY_ENCIPHERMENT | DIGITAL_SIGNATURE)) && allowed_usage("PKIX.ServerAuth");
+
+      case Usage_Type::TLS_CLIENT_AUTH:
+         return allowed_usage(Key_Constraints(DIGITAL_SIGNATURE | NON_REPUDIATION)) && allowed_usage("PKIX.ClientAuth");
+
+      case Usage_Type::OCSP_RESPONDER:
+         return allowed_usage(Key_Constraints(DIGITAL_SIGNATURE | NON_REPUDIATION)) && allowed_usage("PKIX.OCSPSigning");
+
+      case Usage_Type::CERTIFICATE_AUTHORITY:
+         return is_CA_cert();
+      }
+
    return false;
    }
 
@@ -330,36 +357,6 @@ std::vector<byte> X509_Certificate::raw_subject_dn() const
    return subject.get1_memvec("X509.Certificate.dn_bits");
    }
 
-namespace {
-
-bool cert_subject_dns_match(const std::string& name,
-                            const std::vector<std::string>& cert_names)
-   {
-   for(size_t i = 0; i != cert_names.size(); ++i)
-      {
-      const std::string cn = cert_names[i];
-
-      if(cn == name)
-         return true;
-
-      /*
-      * Possible wildcard match. We only support the most basic form of
-      * cert wildcarding ala RFC 2595
-      */
-      if(cn.size() > 2 && cn[0] == '*' && cn[1] == '.' && name.size() > cn.size())
-         {
-         const std::string base = cn.substr(1, std::string::npos);
-
-         if(name.compare(name.size() - base.size(), base.size(), base) == 0)
-            return true;
-         }
-      }
-
-   return false;
-   }
-
-}
-
 std::string X509_Certificate::fingerprint(const std::string& hash_name) const
    {
    std::unique_ptr<HashFunction> hash(HashFunction::create(hash_name));
@@ -385,11 +382,17 @@ bool X509_Certificate::matches_dns_name(const std::string& name) const
    if(name == "")
       return false;
 
-   if(cert_subject_dns_match(name, subject_info("DNS")))
-      return true;
+   std::vector<std::string> issued_names = subject_info("DNS");
 
-   if(cert_subject_dns_match(name, subject_info("Name")))
-      return true;
+   // Fall back to CN only if no DNS names are set (RFC 6125 sec 6.4.4)
+   if(issued_names.empty())
+      issued_names = subject_info("Name");
+
+   for(size_t i = 0; i != issued_names.size(); ++i)
+      {
+      if(host_wildcard_match(issued_names[i], name))
+         return true;
+      }
 
    return false;
    }
@@ -430,45 +433,36 @@ bool operator!=(const X509_Certificate& cert1, const X509_Certificate& cert2)
 
 std::string X509_Certificate::to_string() const
    {
-   const char* dn_fields[] = { "Name",
-                               "Email",
-                               "Organization",
-                               "Organizational Unit",
-                               "Locality",
-                               "State",
-                               "Country",
-                               "IP",
-                               "DNS",
-                               "URI",
-                               "PKIX.XMPPAddr",
-                               nullptr };
+   const std::vector<std::string> dn_fields{
+      "Name",
+      "Email",
+      "Organization",
+      "Organizational Unit",
+      "Locality",
+      "State",
+      "Country",
+      "IP",
+      "DNS",
+      "URI",
+      "PKIX.XMPPAddr"
+      };
 
    std::ostringstream out;
 
-   for(size_t i = 0; dn_fields[i]; ++i)
+   for(auto&& field : dn_fields)
       {
-      const std::vector<std::string> vals = this->subject_info(dn_fields[i]);
-
-      if(vals.empty())
-         continue;
-
-      out << "Subject " << dn_fields[i] << ":";
-      for(size_t j = 0; j != vals.size(); ++j)
-         out << " " << vals[j];
-      out << "\n";
+      for(auto&& val : subject_info(field))
+         {
+         out << "Subject " << field << ": " << val << "\n";
+         }
       }
 
-   for(size_t i = 0; dn_fields[i]; ++i)
+   for(auto&& field : dn_fields)
       {
-      const std::vector<std::string> vals = this->issuer_info(dn_fields[i]);
-
-      if(vals.empty())
-         continue;
-
-      out << "Issuer " << dn_fields[i] << ":";
-      for(size_t j = 0; j != vals.size(); ++j)
-         out << " " << vals[j];
-      out << "\n";
+      for(auto&& val : issuer_info(field))
+         {
+         out << "Issuer " << field << ": " << val << "\n";
+         }
       }
 
    out << "Version: " << this->x509_version() << "\n";
diff --git a/src/lib/cert/x509/x509cert.h b/src/lib/cert/x509/x509cert.h
index 1a46d290f..578360a80 100644
--- a/src/lib/cert/x509/x509cert.h
+++ b/src/lib/cert/x509/x509cert.h
@@ -1,6 +1,6 @@
 /*
 * X.509 Certificates
-* (C) 1999-2007 Jack Lloyd
+* (C) 1999-2007,2015 Jack Lloyd
 *
 * Botan is released under the Simplified BSD License (see license.txt)
 */
@@ -18,6 +18,15 @@
 
 namespace Botan {
 
+enum class Usage_Type
+   {
+   UNSPECIFIED, // no restrictions
+   TLS_SERVER_AUTH,
+   TLS_CLIENT_AUTH,
+   CERTIFICATE_AUTHORITY,
+   OCSP_RESPONDER
+   };
+
 /**
 * This class represents X.509 Certificate
 */
@@ -137,6 +146,8 @@ class BOTAN_DLL X509_Certificate : public X509_Object
       */
       bool allowed_usage(const std::string& usage) const;
 
+      bool allowed_usage(Usage_Type usage) const;
+
       /**
       * Get the path limit as defined in the BasicConstraints extension of
       * this certificate.
diff --git a/src/lib/cert/x509/x509path.cpp b/src/lib/cert/x509/x509path.cpp
index 09cabcb65..a6c3ce6e9 100644
--- a/src/lib/cert/x509/x509path.cpp
+++ b/src/lib/cert/x509/x509path.cpp
@@ -214,7 +214,9 @@ check_chain(const std::vector<X509_Certificate>& cert_path,
 Path_Validation_Result x509_path_validate(
    const std::vector<X509_Certificate>& end_certs,
    const Path_Validation_Restrictions& restrictions,
-   const std::vector<Certificate_Store*>& certstores)
+   const std::vector<Certificate_Store*>& certstores,
+   const std::string& hostname,
+   Usage_Type usage)
    {
    if(end_certs.empty())
       throw std::invalid_argument("x509_path_validate called with no subjects");
@@ -222,6 +224,13 @@ Path_Validation_Result x509_path_validate(
    std::vector<X509_Certificate> cert_path;
    cert_path.push_back(end_certs[0]);
 
+   /*
+   * This is an inelegant but functional way of preventing path loops
+   * (where C1 -> C2 -> C3 -> C1). We store a set of all the certificate
+   * fingerprints in the path. If there is a duplicate, we error out.
+   */
+   std::set<std::string> certs_seen;
+
    Certificate_Store_Overlay extra(end_certs);
 
    // iterate until we reach a root or cannot find the issuer
@@ -231,38 +240,55 @@ Path_Validation_Result x509_path_validate(
       if(!cert)
          return Path_Validation_Result(Certificate_Status_Code::CERT_ISSUER_NOT_FOUND);
 
+      const std::string fprint = cert->fingerprint("SHA-256");
+      if(certs_seen.count(fprint) > 0)
+         return Path_Validation_Result(Certificate_Status_Code::CERT_CHAIN_LOOP);
+      certs_seen.insert(fprint);
       cert_path.push_back(*cert);
       }
 
-   return Path_Validation_Result(check_chain(cert_path, restrictions, certstores),
-                                 std::move(cert_path));
+   std::vector<std::set<Certificate_Status_Code>> res = check_chain(cert_path, restrictions, certstores);
+
+   if(hostname != "" && !cert_path[0].matches_dns_name(hostname))
+      res[0].insert(Certificate_Status_Code::CERT_NAME_NOMATCH);
+
+   if(!cert_path[0].allowed_usage(usage))
+      res[0].insert(Certificate_Status_Code::INVALID_USAGE);
+
+   return Path_Validation_Result(res, std::move(cert_path));
    }
 
 Path_Validation_Result x509_path_validate(
    const X509_Certificate& end_cert,
    const Path_Validation_Restrictions& restrictions,
-   const std::vector<Certificate_Store*>& certstores)
+   const std::vector<Certificate_Store*>& certstores,
+   const std::string& hostname,
+   Usage_Type usage)
    {
    std::vector<X509_Certificate> certs;
    certs.push_back(end_cert);
-   return x509_path_validate(certs, restrictions, certstores);
+   return x509_path_validate(certs, restrictions, certstores, hostname, usage);
    }
 
 Path_Validation_Result x509_path_validate(
    const std::vector<X509_Certificate>& end_certs,
    const Path_Validation_Restrictions& restrictions,
-   const Certificate_Store& store)
+   const Certificate_Store& store,
+   const std::string& hostname,
+   Usage_Type usage)
    {
    std::vector<Certificate_Store*> certstores;
    certstores.push_back(const_cast<Certificate_Store*>(&store));
 
-   return x509_path_validate(end_certs, restrictions, certstores);
+   return x509_path_validate(end_certs, restrictions, certstores, hostname, usage);
    }
 
 Path_Validation_Result x509_path_validate(
    const X509_Certificate& end_cert,
    const Path_Validation_Restrictions& restrictions,
-   const Certificate_Store& store)
+   const Certificate_Store& store,
+   const std::string& hostname,
+   Usage_Type usage)
    {
    std::vector<X509_Certificate> certs;
    certs.push_back(end_cert);
@@ -270,7 +296,7 @@ Path_Validation_Result x509_path_validate(
    std::vector<Certificate_Store*> certstores;
    certstores.push_back(const_cast<Certificate_Store*>(&store));
 
-   return x509_path_validate(certs, restrictions, certstores);
+   return x509_path_validate(certs, restrictions, certstores, hostname, usage);
    }
 
 Path_Validation_Restrictions::Path_Validation_Restrictions(bool require_rev,
@@ -310,6 +336,9 @@ Path_Validation_Result::Path_Validation_Result(std::vector<std::set<Certificate_
 
 const X509_Certificate& Path_Validation_Result::trust_root() const
    {
+   if(m_cert_path.empty())
+      throw std::runtime_error("Path_Validation_Result::trust_root no path set");
+
    return m_cert_path[m_cert_path.size()-1];
    }
 
@@ -366,6 +395,8 @@ const char* Path_Validation_Result::status_string(Certificate_Status_Code code)
          return "Certificate issuer not found";
       case Certificate_Status_Code::CANNOT_ESTABLISH_TRUST:
          return "Cannot establish trust";
+      case Certificate_Status_Code::CERT_CHAIN_LOOP:
+         return "Loop in certificate chain";
 
       case Certificate_Status_Code::POLICY_ERROR:
          return "Policy error";
@@ -381,6 +412,8 @@ const char* Path_Validation_Result::status_string(Certificate_Status_Code code)
          return "OCSP cert not listed";
       case Certificate_Status_Code::OCSP_BAD_STATUS:
          return "OCSP bad status";
+      case Certificate_Status_Code::CERT_NAME_NOMATCH:
+         return "Certificate does not match provided name";
 
       case Certificate_Status_Code::CERT_IS_REVOKED:
          return "Certificate is revoked";
@@ -388,9 +421,10 @@ const char* Path_Validation_Result::status_string(Certificate_Status_Code code)
          return "CRL bad signature";
       case Certificate_Status_Code::SIGNATURE_ERROR:
          return "Signature error";
-      default:
-         return "Unknown error";
+         // intentionally no default so we are warned
       }
+
+   return "Unknown error";
    }
 
 }
diff --git a/src/lib/cert/x509/x509path.h b/src/lib/cert/x509/x509path.h
index f400641be..c56aef21f 100644
--- a/src/lib/cert/x509/x509path.h
+++ b/src/lib/cert/x509/x509path.h
@@ -132,13 +132,16 @@ class BOTAN_DLL Path_Validation_Result
       std::vector<X509_Certificate> m_cert_path;
    };
 
+
 /**
 * PKIX Path Validation
 */
 Path_Validation_Result BOTAN_DLL x509_path_validate(
    const std::vector<X509_Certificate>& end_certs,
    const Path_Validation_Restrictions& restrictions,
-   const std::vector<Certificate_Store*>& certstores);
+   const std::vector<Certificate_Store*>& certstores,
+   const std::string& hostname = "",
+   Usage_Type usage = Usage_Type::UNSPECIFIED);
 
 /**
 * PKIX Path Validation
@@ -146,7 +149,9 @@ Path_Validation_Result BOTAN_DLL x509_path_validate(
 Path_Validation_Result BOTAN_DLL x509_path_validate(
    const X509_Certificate& end_cert,
    const Path_Validation_Restrictions& restrictions,
-   const std::vector<Certificate_Store*>& certstores);
+   const std::vector<Certificate_Store*>& certstores,
+   const std::string& hostname = "",
+   Usage_Type usage = Usage_Type::UNSPECIFIED);
 
 /**
 * PKIX Path Validation
@@ -154,7 +159,9 @@ Path_Validation_Result BOTAN_DLL x509_path_validate(
 Path_Validation_Result BOTAN_DLL x509_path_validate(
    const X509_Certificate& end_cert,
    const Path_Validation_Restrictions& restrictions,
-   const Certificate_Store& store);
+   const Certificate_Store& store,
+   const std::string& hostname = "",
+   Usage_Type usage = Usage_Type::UNSPECIFIED);
 
 /**
 * PKIX Path Validation
@@ -162,7 +169,9 @@ Path_Validation_Result BOTAN_DLL x509_path_validate(
 Path_Validation_Result BOTAN_DLL x509_path_validate(
    const std::vector<X509_Certificate>& end_certs,
    const Path_Validation_Restrictions& restrictions,
-   const Certificate_Store& store);
+   const Certificate_Store& store,
+   const std::string& hostname = "",
+   Usage_Type usage = Usage_Type::UNSPECIFIED);
 
 }
 
diff --git a/src/lib/tls/credentials_manager.cpp b/src/lib/tls/credentials_manager.cpp
index 6443bb246..43ba7650a 100644
--- a/src/lib/tls/credentials_manager.cpp
+++ b/src/lib/tls/credentials_manager.cpp
@@ -104,6 +104,17 @@ bool cert_in_some_store(const std::vector<Certificate_Store*>& trusted_CAs,
    return false;
    }
 
+Usage_Type choose_leaf_usage(const std::string& ctx)
+   {
+   // These are reversed because ctx is denoting the current perspective
+   if(ctx == "tls-client")
+      return Usage_Type::TLS_SERVER_AUTH;
+   else if(ctx == "tls-server")
+      return Usage_Type::TLS_CLIENT_AUTH;
+   else
+      return Usage_Type::UNSPECIFIED;
+   }
+
 }
 
 void Credentials_Manager::verify_certificate_chain(
@@ -120,16 +131,12 @@ void Credentials_Manager::verify_certificate_chain(
 
    auto result = x509_path_validate(cert_chain,
                                     restrictions,
-                                    trusted_CAs);
-
-   if(!result.successful_validation())
-      throw std::runtime_error("Certificate validation failure: " + result.result_string());
+                                    trusted_CAs,
+                                    purported_hostname,
+                                    choose_leaf_usage(type));
 
    if(!cert_in_some_store(trusted_CAs, result.trust_root()))
       throw std::runtime_error("Certificate chain roots in unknown/untrusted CA");
-
-   if(purported_hostname != "" && !cert_chain[0].matches_dns_name(purported_hostname))
-      throw std::runtime_error("Certificate did not match hostname");
    }
 
 }
diff --git a/src/lib/utils/parsing.cpp b/src/lib/utils/parsing.cpp
index ea89c8e5f..40eae656a 100644
--- a/src/lib/utils/parsing.cpp
+++ b/src/lib/utils/parsing.cpp
@@ -1,6 +1,6 @@
 /*
 * Various string utils and parsing functions
-* (C) 1999-2007,2013,2014 Jack Lloyd
+* (C) 1999-2007,2013,2014,2015 Jack Lloyd
 * (C) 2015 Simon Warta (Kullo GmbH)
 *
 * Botan is released under the Simplified BSD License (see license.txt)
@@ -333,4 +333,25 @@ std::string replace_char(const std::string& str, char from_char, char to_char)
    return out;
    }
 
+bool host_wildcard_match(const std::string& issued, const std::string& host)
+   {
+   if(issued == host)
+      return true;
+
+   if(issued.size() > 2 && issued[0] == '*' && issued[1] == '.')
+      {
+      size_t host_i = host.find('.');
+      if(host_i == std::string::npos || host_i == host.size() - 1)
+         return false;
+
+      const std::string host_base = host.substr(host_i + 1);
+      const std::string issued_base = issued.substr(2);
+
+      if(host_base == issued_base)
+         return true;
+         }
+
+   return false;
+   }
+
 }
diff --git a/src/lib/utils/parsing.h b/src/lib/utils/parsing.h
index 25416d43a..db8db198e 100644
--- a/src/lib/utils/parsing.h
+++ b/src/lib/utils/parsing.h
@@ -128,6 +128,8 @@ std::map<std::string, std::string> BOTAN_DLL read_cfg(std::istream& is);
 
 std::string BOTAN_DLL clean_ws(const std::string& s);
 
+bool BOTAN_DLL host_wildcard_match(const std::string& wildcard, const std::string& host);
+
 
 }
 
diff --git a/src/tests/data/x509test/InvalidExtendedKeyUsage.pem b/src/tests/data/x509test/InvalidExtendedKeyUsage.pem
new file mode 100644
index 000000000..1077d478f
--- /dev/null
+++ b/src/tests/data/x509test/InvalidExtendedKeyUsage.pem
@@ -0,0 +1,39 @@
+-----BEGIN CERTIFICATE-----
+MIIDNTCCAp6gAwIBAgICBTYwDQYJKoZIhvcNAQEFBQAwgcQxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUw
+OS50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMB4XDTE1MTAy
+MDE2MjAyNVoXDTE2MTAyMTE2MjAyNVowgcAxCzAJBgNVBAYTAlVTMQswCQYDVQQI
+DAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQKDCVDZXJ0aWZp
+Y2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQLDBlYNTA5IFZl
+cmlmaWNhdGlvbiBDaGVja2VyMRUwEwYDVQQDDAx3d3cudGxzLnRlc3QxHzAdBgkq
+hkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0A
+MIGJAoGBAOVehzMzeL21cKiXqT7azmOk3yTNoRT4ZZIVcPiaSTKX7m+1e26KvDi+
+0bMOAa61edho6OlJ5p0CFOz2A2ebU4QLSl3N4c/jXs60BBx413Vz2Vj0PV93mYQ4
+lUOPZFKoELXGrkllDykq9DPvXVGrl86610YHB85jtzKDnjbR0aDfAgMBAAGjODA2
+MDQGA1UdJQEB/wQqMCgGCCsGAQUFBwMIBggrBgEFBQcDBAYIKwYBBQUHAwIGCCsG
+AQUFBwMDMA0GCSqGSIb3DQEBBQUAA4GBAGIOqLpfp3UtxxXF9tEEycMZnNze+NKb
+ZyheuTnYgfOPvoKgTSQZy8MQfj+KtUFPYkgyHfKfDKcCx6CgTTDQXDCDxILehIzX
+3+ap5mBURcwlo+kyIkRHxtqjSMnW/n/1XYvByFq7PfB03IPBopUcZccL0cfUTqEJ
+bK9QDOU+O6hQ
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDFDCCAn2gAwIBAgICA+kwDQYJKoZIhvcNAQEFBQAwgcQxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUw
+OS50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMB4XDTE1MTAy
+MDE2MDM1OFoXDTE2MTAyMTE2MDM1OFowgcQxCzAJBgNVBAYTAlVTMQswCQYDVQQI
+DAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQKDCVDZXJ0aWZp
+Y2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQLDBlYNTA5IFZl
+cmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUwOS50ZXN0MR8w
+HQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMIGfMA0GCSqGSIb3DQEBAQUA
+A4GNADCBiQKBgQDI2TejJ3VtoPlkcjQsqbaiMRCtLGdIN7Ful9z7PWU7AVbuJZxD
+QCeFuFmYsCpBgZD3Rw8JaNfMZLKG3D/peIQ/Hjc44BsFR8H9oa0bIDkZN3kS9O80
+vU4urBwTwt9AFDvGPD4UiFulXsAAHDA4KoBg03R56bm2B+8y2JKiGEQ92QIDAQAB
+oxMwETAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBBQUAA4GBALqNB/JaqkTX
+slppJEaBHTY5/bGGWwV/0t3WMDNFaMrFgcsEY/KjUSyfWh9c6BHOdr21MmNe4YDh
+T8gv9TmcGNsEJRIYD1jly3tCDyA2W0AUIzob1GMGkV8ddKBUrmt/+qLzagxdOrQ0
+dRcxFarWaAJVGhJ+p6kWJt7XJnK341bP
+-----END CERTIFICATE-----
diff --git a/src/tests/data/x509test/InvalidIntCAFlag.pem b/src/tests/data/x509test/InvalidIntCAFlag.pem
new file mode 100644
index 000000000..bf8eadbb4
--- /dev/null
+++ b/src/tests/data/x509test/InvalidIntCAFlag.pem
@@ -0,0 +1,97 @@
+-----BEGIN CERTIFICATE-----
+MIIDADCCAmmgAwIBAgICBVMwDQYJKoZIhvcNAQEFBQAwgckxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMR4wHAYDVQQDDBVpbnQubGV2My5j
+YS5hdXRob3JpdHkxHzAdBgkqhkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wHhcN
+MTUxMDIwMTYyMDI3WhcNMTYxMDIxMTYyMDI3WjCBwDELMAkGA1UEBhMCVVMxCzAJ
+BgNVBAgMAkNBMRgwFgYDVQQHDA9TYW4gTHVpcyBPYmlzcG8xLjAsBgNVBAoMJUNl
+cnRpZmljYXRlIFZhbGlkYXRpb24gYW5kIENvbXBsaWFuY2UxIjAgBgNVBAsMGVg1
+MDkgVmVyaWZpY2F0aW9uIENoZWNrZXIxFTATBgNVBAMMDHd3dy50bHMudGVzdDEf
+MB0GCSqGSIb3DQEJARYQc29tZW9uZUBtYWlsLmNvbTCBnzANBgkqhkiG9w0BAQEF
+AAOBjQAwgYkCgYEA1OL+Ud1tnY7uAY1FHW5aj+I9WSeeaZdgdnofZC8lKGq6HbbD
+vC1BQZyqwQBTOdInwHeMtrn8OZiGjsDEi9VCSZsRWILxdM78kZ/+dE79icFns4is
+Wnl7qjqybI8WTpRZRgYl3sCgwm0Ewn8mcfDSjQ0P1VhtEjI2Qc62LCaHA0ECAwEA
+ATANBgkqhkiG9w0BAQUFAAOBgQCdidZbDaHGn6nXkExvUNA6tJUj6yw+irx/S2Z3
+Gm6cnXA0xUI7lNTXrYKJeOE14ldhNEsTwvPNtQTI/2k1XsXPK5lqSvv70x11Afo0
+GD3Y9VeuUBJf/oLw9R8ztG5MEEfdnlfoGk+2ixG/kyURVAApNTGx7rIUijzkNrvh
+QAkUqA==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDLjCCApegAwIBAgICBVIwDQYJKoZIhvcNAQEFBQAwgckxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMR4wHAYDVQQDDBVpbnQubGV2Mi5j
+YS5hdXRob3JpdHkxHzAdBgkqhkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wHhcN
+MTUxMDIwMTYyMDI3WhcNMTYxMDIxMTYyMDI3WjCByTELMAkGA1UEBhMCVVMxCzAJ
+BgNVBAgMAkNBMRgwFgYDVQQHDA9TYW4gTHVpcyBPYmlzcG8xLjAsBgNVBAoMJUNl
+cnRpZmljYXRlIFZhbGlkYXRpb24gYW5kIENvbXBsaWFuY2UxIjAgBgNVBAsMGVg1
+MDkgVmVyaWZpY2F0aW9uIENoZWNrZXIxHjAcBgNVBAMMFWludC5sZXYzLmNhLmF1
+dGhvcml0eTEfMB0GCSqGSIb3DQEJARYQc29tZW9uZUBtYWlsLmNvbTCBnzANBgkq
+hkiG9w0BAQEFAAOBjQAwgYkCgYEAqZXlFKG9wD3BRNkpS1Xcg8ox3HJT+/xbIwnL
+V6MQW/5IX8TY2DhskLwP/fZjAzxkA4Or6/iYGaz6wiYXiprlR8Lp3NvC4abNEC41
+AZA+n4CeC9lYLs1utp9frawY4X5HOG/ucUuR87yp0HKpRHWxHZsju/QNRLf/gxzQ
+SaxmmgMCAwEAAaMjMCEwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYw
+DQYJKoZIhvcNAQEFBQADgYEAJ6dd7TMmcuXJTcnU41EpPhfSqzatpl7jfEHpS0qK
++uObFtHQJYxfYenBePD1yzT/chOGrOgSnSZLLRtW/BCx2vfO39q5ZYJpVOQsP1qk
+10oa5gSm1oJGGVtuzjp+LtEH/XXuVGYOFie5aIewxGDCKRy0KGe66XkiMX6929Iw
+6+U=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDLjCCApegAwIBAgICBVEwDQYJKoZIhvcNAQEFBQAwgckxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMR4wHAYDVQQDDBVpbnQubGV2MS5j
+YS5hdXRob3JpdHkxHzAdBgkqhkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wHhcN
+MTUxMDIwMTYyMDI3WhcNMTYxMDIxMTYyMDI3WjCByTELMAkGA1UEBhMCVVMxCzAJ
+BgNVBAgMAkNBMRgwFgYDVQQHDA9TYW4gTHVpcyBPYmlzcG8xLjAsBgNVBAoMJUNl
+cnRpZmljYXRlIFZhbGlkYXRpb24gYW5kIENvbXBsaWFuY2UxIjAgBgNVBAsMGVg1
+MDkgVmVyaWZpY2F0aW9uIENoZWNrZXIxHjAcBgNVBAMMFWludC5sZXYyLmNhLmF1
+dGhvcml0eTEfMB0GCSqGSIb3DQEJARYQc29tZW9uZUBtYWlsLmNvbTCBnzANBgkq
+hkiG9w0BAQEFAAOBjQAwgYkCgYEAzZCH1Og5mpBoBQZh4GFooIi1iSt266u41CTP
+Z6U7OBE68qz4/5cwp4cLYn52bq1f+2ZDFm7RNUNDlPuLO9ErxormeP6gTXSg7pul
+6Gsx9k6xTADg5GC/ohp6SBTJIghpYcVrhUh11jK4qsgVTDUr+0w/h4ZAMnQ14Cn4
+FP6CcdUCAwEAAaMjMCEwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYw
+DQYJKoZIhvcNAQEFBQADgYEAe6/pn+C5xgCGLhg06afuNpiwJzxszgV9mEfewBHF
+FShXmCcAo7+S9WSQbX+4P7v/e2OH5QTH0eZn9BD7d5NgMrGNzp7UK9yHvTMxSmlg
+u19Rda32QhT/N1yI7fpuBIXOWVKcor51JGgsZflFc4M5VWSWdqKk+OsmcpcJbVbu
+UDE=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDFjCCAn+gAwIBAgICBVAwDQYJKoZIhvcNAQEFBQAwgcQxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUw
+OS50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMB4XDTE1MTAy
+MDE2MjAyN1oXDTE2MTAyMTE2MjAyN1owgckxCzAJBgNVBAYTAlVTMQswCQYDVQQI
+DAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQKDCVDZXJ0aWZp
+Y2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQLDBlYNTA5IFZl
+cmlmaWNhdGlvbiBDaGVja2VyMR4wHAYDVQQDDBVpbnQubGV2MS5jYS5hdXRob3Jp
+dHkxHzAdBgkqhkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wgZ8wDQYJKoZIhvcN
+AQEBBQADgY0AMIGJAoGBAKIZPXpqy0ciWiUU1eWWdUDIjJVzM+LgCFEPoKT5W13M
+aK2zmNTI4V4euf7CRNtFKgVbWZHuDjCLo/R1Qk0L+LFGBz7j/hQYF8uBsHhXcbkM
+KSjbZijDJEB7Od/bVrCa05ZLBvf11j8NvHqI+Nbj8krgcCwCMoACpz4vRYnkRBYh
+AgMBAAGjEDAOMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQEFBQADgYEANsC9YG6c
+qt2NBA3ZIrNXJq3cVEq5UZS2ysIEoioCByQN9G/gypLn4TYuTwhVrrjTRH+T840J
+uhS6lXxjcmYckHKmN068kbscNoYFyx7r1p4EGp7ufqJ7Y0MDiu9pz/1uiowyD6EC
+wxYVVC/30+KI7YU9kqdOhCWObFVqv5fuWrQ=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDFDCCAn2gAwIBAgICA+kwDQYJKoZIhvcNAQEFBQAwgcQxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUw
+OS50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMB4XDTE1MTAy
+MDE2MDM1OFoXDTE2MTAyMTE2MDM1OFowgcQxCzAJBgNVBAYTAlVTMQswCQYDVQQI
+DAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQKDCVDZXJ0aWZp
+Y2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQLDBlYNTA5IFZl
+cmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUwOS50ZXN0MR8w
+HQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMIGfMA0GCSqGSIb3DQEBAQUA
+A4GNADCBiQKBgQDI2TejJ3VtoPlkcjQsqbaiMRCtLGdIN7Ful9z7PWU7AVbuJZxD
+QCeFuFmYsCpBgZD3Rw8JaNfMZLKG3D/peIQ/Hjc44BsFR8H9oa0bIDkZN3kS9O80
+vU4urBwTwt9AFDvGPD4UiFulXsAAHDA4KoBg03R56bm2B+8y2JKiGEQ92QIDAQAB
+oxMwETAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBBQUAA4GBALqNB/JaqkTX
+slppJEaBHTY5/bGGWwV/0t3WMDNFaMrFgcsEY/KjUSyfWh9c6BHOdr21MmNe4YDh
+T8gv9TmcGNsEJRIYD1jly3tCDyA2W0AUIzob1GMGkV8ddKBUrmt/+qLzagxdOrQ0
+dRcxFarWaAJVGhJ+p6kWJt7XJnK341bP
+-----END CERTIFICATE-----
diff --git a/src/tests/data/x509test/InvalidIntCAKeyUsage.pem b/src/tests/data/x509test/InvalidIntCAKeyUsage.pem
new file mode 100644
index 000000000..46ea7094f
--- /dev/null
+++ b/src/tests/data/x509test/InvalidIntCAKeyUsage.pem
@@ -0,0 +1,97 @@
+-----BEGIN CERTIFICATE-----
+MIIDADCCAmmgAwIBAgICBWswDQYJKoZIhvcNAQEFBQAwgckxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMR4wHAYDVQQDDBVpbnQubGV2My5j
+YS5hdXRob3JpdHkxHzAdBgkqhkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wHhcN
+MTUxMDIwMTYyMDI3WhcNMTYxMDIxMTYyMDI3WjCBwDELMAkGA1UEBhMCVVMxCzAJ
+BgNVBAgMAkNBMRgwFgYDVQQHDA9TYW4gTHVpcyBPYmlzcG8xLjAsBgNVBAoMJUNl
+cnRpZmljYXRlIFZhbGlkYXRpb24gYW5kIENvbXBsaWFuY2UxIjAgBgNVBAsMGVg1
+MDkgVmVyaWZpY2F0aW9uIENoZWNrZXIxFTATBgNVBAMMDHd3dy50bHMudGVzdDEf
+MB0GCSqGSIb3DQEJARYQc29tZW9uZUBtYWlsLmNvbTCBnzANBgkqhkiG9w0BAQEF
+AAOBjQAwgYkCgYEAs080jMr1dYNkhWW2r1ZDa+ZE6+W+CXF0mY4sIlRFShSLrcvL
+JBcPQ4j1rDDJ8Ubh5B+kX/C3SoTci4TkFjVzDv/VHV+/LsvNUTQgwnKH0SGkQ3tM
+wGPA92YTVQ8ivG+dl1fptY/WqJ0XWZgAqDzViSCODwZBNfDKRWIB2xIBnecCAwEA
+ATANBgkqhkiG9w0BAQUFAAOBgQAC6m+nyqIJCOOO01wAWcow7w3lOLMH8t4uyBFS
+Xm6v8owIFAYZtYD9/zq2neRH1g5ZeXbbJTeI7pqeLpO95kZTdFcWc5mdLDt6OaTE
+SRo1dlyyLpmU0+rh+rnQMeStR6xI5ATBGsqhPd+GSiFT0Y1vQLhFjJVVL7d9YVhQ
+xdPfCA==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDLjCCApegAwIBAgICBWowDQYJKoZIhvcNAQEFBQAwgckxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMR4wHAYDVQQDDBVpbnQubGV2Mi5j
+YS5hdXRob3JpdHkxHzAdBgkqhkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wHhcN
+MTUxMDIwMTYyMDI3WhcNMTYxMDIxMTYyMDI3WjCByTELMAkGA1UEBhMCVVMxCzAJ
+BgNVBAgMAkNBMRgwFgYDVQQHDA9TYW4gTHVpcyBPYmlzcG8xLjAsBgNVBAoMJUNl
+cnRpZmljYXRlIFZhbGlkYXRpb24gYW5kIENvbXBsaWFuY2UxIjAgBgNVBAsMGVg1
+MDkgVmVyaWZpY2F0aW9uIENoZWNrZXIxHjAcBgNVBAMMFWludC5sZXYzLmNhLmF1
+dGhvcml0eTEfMB0GCSqGSIb3DQEJARYQc29tZW9uZUBtYWlsLmNvbTCBnzANBgkq
+hkiG9w0BAQEFAAOBjQAwgYkCgYEAvE1H7UcgRvB+y9fQU1A0kTR4ejPyNsHfKqfb
+D7d2/Q62fnYZTC3wqSAVCqOJ5GpPjtLYXe0rJ31jC1Ck2Yhtvk1cB1mOr4KPzuVx
+mbtbkc7SfXohshaoQDERcXzDqILEh0GSv5Nn/NLUiKrD/ND7hp+xkCnpnilUvbVG
+MupyCjkCAwEAAaMjMCEwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYw
+DQYJKoZIhvcNAQEFBQADgYEAWM/xRM22jbcK0Hyd5WwvRnzgNYNUP7tfsH0Kvmv8
+2xOCblejAaEb02BjLaLBibGDv5rDl9a1wtE5JWI+6VuniPov3NMdHtxdJLkb10kd
+Aoy16jGFh9gAwDqjUi/gJNRy3PQE5yZlgfQCdc0b0eFxehFdBPXLd+aOd3LjF1Tj
+4S4=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDLjCCApegAwIBAgICBWkwDQYJKoZIhvcNAQEFBQAwgckxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMR4wHAYDVQQDDBVpbnQubGV2MS5j
+YS5hdXRob3JpdHkxHzAdBgkqhkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wHhcN
+MTUxMDIwMTYyMDI3WhcNMTYxMDIxMTYyMDI3WjCByTELMAkGA1UEBhMCVVMxCzAJ
+BgNVBAgMAkNBMRgwFgYDVQQHDA9TYW4gTHVpcyBPYmlzcG8xLjAsBgNVBAoMJUNl
+cnRpZmljYXRlIFZhbGlkYXRpb24gYW5kIENvbXBsaWFuY2UxIjAgBgNVBAsMGVg1
+MDkgVmVyaWZpY2F0aW9uIENoZWNrZXIxHjAcBgNVBAMMFWludC5sZXYyLmNhLmF1
+dGhvcml0eTEfMB0GCSqGSIb3DQEJARYQc29tZW9uZUBtYWlsLmNvbTCBnzANBgkq
+hkiG9w0BAQEFAAOBjQAwgYkCgYEA0EtiWsU5Tu9NOGVdC+Os0gTnhyu1B617QIbv
+FR9VMMih79+6eXnb1RDCZX6A75tXm5P4dUXkD5/b8IGSPy2IU5EdMv5EdTTBRccy
+AaOPcNOaGT+TL9fZPeACE6G3RWJiK7fxp2gyZexMGtQVzkrFtw6AgS3uKS1t1y2A
+GW/hmsMCAwEAAaMjMCEwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYw
+DQYJKoZIhvcNAQEFBQADgYEARoBDHytQRiZ3i7ou2K55mXnlYA5JS5ndhcDjawlc
+FDtxanT6KndHQNXpMyz36UdjA+870ZBxSC2pp+RsqpObwk/UW8Ez145Ozd1xQzya
+dGqR9jvznK6KQVTY+0QUHzLRTtVMZZgUtmzYCPFqjxVGzSNIUfdxBsaJwDuGQI9R
+2Qg=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDKTCCApKgAwIBAgICBWgwDQYJKoZIhvcNAQEFBQAwgcQxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUw
+OS50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMB4XDTE1MTAy
+MDE2MjAyN1oXDTE2MTAyMTE2MjAyN1owgckxCzAJBgNVBAYTAlVTMQswCQYDVQQI
+DAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQKDCVDZXJ0aWZp
+Y2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQLDBlYNTA5IFZl
+cmlmaWNhdGlvbiBDaGVja2VyMR4wHAYDVQQDDBVpbnQubGV2MS5jYS5hdXRob3Jp
+dHkxHzAdBgkqhkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wgZ8wDQYJKoZIhvcN
+AQEBBQADgY0AMIGJAoGBAN2oe7dx8qpMmFRz8H9+mWoWf8Af6mDvkbMIJlvcwjp1
+gHv3gw5pnXSg1X1tbaAn5ZYkVQV5B+kMvKxIUSobw2fxed1/mrMKJGPwLXBkjr46
+fc/Sg2OymroOE9syEhw1jo2PlOkaJXD04H9ajNizGh2rXuWU+h+mcmd6qyPyb3Dr
+AgMBAAGjIzAhMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgGiMA0GCSqG
+SIb3DQEBBQUAA4GBAAEhJezQ5KRFKzZYYkBaEvVixk/x4xwkFeLvfgzeIePdNq0t
+DxkJ2o/84T7mx4FG0uZ41Oab/50j9+wYbuOOkL5zJgSECoatW5dPIwUVC6Vw84aW
+AV/MEEpM2PSYc5D/8uE6ElORbjjcsgzL7+s3U76gZzaaBemFT+MT5dhiULju
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDFDCCAn2gAwIBAgICA+kwDQYJKoZIhvcNAQEFBQAwgcQxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUw
+OS50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMB4XDTE1MTAy
+MDE2MDM1OFoXDTE2MTAyMTE2MDM1OFowgcQxCzAJBgNVBAYTAlVTMQswCQYDVQQI
+DAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQKDCVDZXJ0aWZp
+Y2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQLDBlYNTA5IFZl
+cmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUwOS50ZXN0MR8w
+HQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMIGfMA0GCSqGSIb3DQEBAQUA
+A4GNADCBiQKBgQDI2TejJ3VtoPlkcjQsqbaiMRCtLGdIN7Ful9z7PWU7AVbuJZxD
+QCeFuFmYsCpBgZD3Rw8JaNfMZLKG3D/peIQ/Hjc44BsFR8H9oa0bIDkZN3kS9O80
+vU4urBwTwt9AFDvGPD4UiFulXsAAHDA4KoBg03R56bm2B+8y2JKiGEQ92QIDAQAB
+oxMwETAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBBQUAA4GBALqNB/JaqkTX
+slppJEaBHTY5/bGGWwV/0t3WMDNFaMrFgcsEY/KjUSyfWh9c6BHOdr21MmNe4YDh
+T8gv9TmcGNsEJRIYD1jly3tCDyA2W0AUIzob1GMGkV8ddKBUrmt/+qLzagxdOrQ0
+dRcxFarWaAJVGhJ+p6kWJt7XJnK341bP
+-----END CERTIFICATE-----
diff --git a/src/tests/data/x509test/InvalidIntCALen.pem b/src/tests/data/x509test/InvalidIntCALen.pem
new file mode 100644
index 000000000..66b70d725
--- /dev/null
+++ b/src/tests/data/x509test/InvalidIntCALen.pem
@@ -0,0 +1,97 @@
+-----BEGIN CERTIFICATE-----
+MIIDADCCAmmgAwIBAgICBWMwDQYJKoZIhvcNAQEFBQAwgckxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMR4wHAYDVQQDDBVpbnQubGV2My5j
+YS5hdXRob3JpdHkxHzAdBgkqhkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wHhcN
+MTUxMDIwMTYyMDI3WhcNMTYxMDIxMTYyMDI3WjCBwDELMAkGA1UEBhMCVVMxCzAJ
+BgNVBAgMAkNBMRgwFgYDVQQHDA9TYW4gTHVpcyBPYmlzcG8xLjAsBgNVBAoMJUNl
+cnRpZmljYXRlIFZhbGlkYXRpb24gYW5kIENvbXBsaWFuY2UxIjAgBgNVBAsMGVg1
+MDkgVmVyaWZpY2F0aW9uIENoZWNrZXIxFTATBgNVBAMMDHd3dy50bHMudGVzdDEf
+MB0GCSqGSIb3DQEJARYQc29tZW9uZUBtYWlsLmNvbTCBnzANBgkqhkiG9w0BAQEF
+AAOBjQAwgYkCgYEAwhW8qYanEvDgb9ZTsgnBpLN2lb79VTAOEuvV7g1mMi2FtH7C
+pCxL6V0Qo/tIEszrG5MSFqpY6lTD7d2oZwCwnt5rg11GTF0v5Pr8tBZQ9XvfZFH2
+hEBp8cwuO3AR3ej+43lWRMAVnZ98HjUqsAq9YpBlt0ah9oUyH/IGdMG1lBECAwEA
+ATANBgkqhkiG9w0BAQUFAAOBgQB3/xEObIIQlzFkmSWCHKMtL0fRxs0EbFVJbejY
+q4wch1p2fgJJYjS+a6CEfVGxq9+ock9QPNLyZl289NpnSSszXVFya4s119n2uISH
+0kKF+9+v9QzxYgt80BeKK80LFNl7iExsx+FQqb2lfbWxY6JmmylpDFbpTUq/t0eN
+Ru3NMg==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDLjCCApegAwIBAgICBWIwDQYJKoZIhvcNAQEFBQAwgckxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMR4wHAYDVQQDDBVpbnQubGV2Mi5j
+YS5hdXRob3JpdHkxHzAdBgkqhkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wHhcN
+MTUxMDIwMTYyMDI3WhcNMTYxMDIxMTYyMDI3WjCByTELMAkGA1UEBhMCVVMxCzAJ
+BgNVBAgMAkNBMRgwFgYDVQQHDA9TYW4gTHVpcyBPYmlzcG8xLjAsBgNVBAoMJUNl
+cnRpZmljYXRlIFZhbGlkYXRpb24gYW5kIENvbXBsaWFuY2UxIjAgBgNVBAsMGVg1
+MDkgVmVyaWZpY2F0aW9uIENoZWNrZXIxHjAcBgNVBAMMFWludC5sZXYzLmNhLmF1
+dGhvcml0eTEfMB0GCSqGSIb3DQEJARYQc29tZW9uZUBtYWlsLmNvbTCBnzANBgkq
+hkiG9w0BAQEFAAOBjQAwgYkCgYEA4J95YklZ4IoZiobKO6B9wpdQYdjKpDAH6qlJ
+dlD1M5Sm5Jr9VCxqeBzTMuzxtJpi0nqJSep3DIFRGvUkFcahYbRpPVMsfnsXJviK
+TNBFqrH0Gs1RYOzGZS41iFdQxeul1eorjPrNfkEDxLSQt4nnqxe0e0+8ok9ztEc3
+YZRiyAUCAwEAAaMjMCEwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYw
+DQYJKoZIhvcNAQEFBQADgYEAloxrmzdw+QC2UOfovVgAyHAgaVfQzoEdVN/O/4Fx
+WOWTZ7rnpyp++ToB42zEixiYgDv0Z039NdiXRHemzXQpntYnBOE3ro0lX4kso0sr
+95Iwo9/2Whm2y66LmxDR0z+EIpH3ticnU1idmpd6uYDDIGYoJ8doDcq5bZBGa7QB
+MiU=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDMTCCApqgAwIBAgICBWEwDQYJKoZIhvcNAQEFBQAwgckxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMR4wHAYDVQQDDBVpbnQubGV2MS5j
+YS5hdXRob3JpdHkxHzAdBgkqhkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wHhcN
+MTUxMDIwMTYyMDI3WhcNMTYxMDIxMTYyMDI3WjCByTELMAkGA1UEBhMCVVMxCzAJ
+BgNVBAgMAkNBMRgwFgYDVQQHDA9TYW4gTHVpcyBPYmlzcG8xLjAsBgNVBAoMJUNl
+cnRpZmljYXRlIFZhbGlkYXRpb24gYW5kIENvbXBsaWFuY2UxIjAgBgNVBAsMGVg1
+MDkgVmVyaWZpY2F0aW9uIENoZWNrZXIxHjAcBgNVBAMMFWludC5sZXYyLmNhLmF1
+dGhvcml0eTEfMB0GCSqGSIb3DQEJARYQc29tZW9uZUBtYWlsLmNvbTCBnzANBgkq
+hkiG9w0BAQEFAAOBjQAwgYkCgYEAuIQ770rmUh+jbjSOyktIVHJO+az/nVsFUSbp
+LHSvQAprzyqZ/UG2g23He+1JW4WPF0AEuRJnCWbLu1p+VrOmtBkbO1DgX0ksv4V/
+MH4L3Un7nPNfyK3wdl1hZ9rEzhSVG+M74p193EQL4FmiIJlljelChqF3CF45urjt
+UYg1LuECAwEAAaMmMCQwEgYDVR0TAQH/BAgwBgEB/wIBATAOBgNVHQ8BAf8EBAMC
+AQYwDQYJKoZIhvcNAQEFBQADgYEAt+La7O+rtTCpIk30d+I/uqxeAnXrW60bRciG
+KXWKdVizrXMo6SGOkKGafT4kQ7LF+cdcTexuXFS9iR3pcJfCb+b5B9Sp1K7EMA+1
+s1aEHHe4V/+NgGSTXvT+lvZtzeBXdPCmOPXW0YuTyaVjt1C/MMZdpcMMDq82S5Rk
+mLlDpjg=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDLDCCApWgAwIBAgICBWAwDQYJKoZIhvcNAQEFBQAwgcQxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUw
+OS50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMB4XDTE1MTAy
+MDE2MjAyN1oXDTE2MTAyMTE2MjAyN1owgckxCzAJBgNVBAYTAlVTMQswCQYDVQQI
+DAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQKDCVDZXJ0aWZp
+Y2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQLDBlYNTA5IFZl
+cmlmaWNhdGlvbiBDaGVja2VyMR4wHAYDVQQDDBVpbnQubGV2MS5jYS5hdXRob3Jp
+dHkxHzAdBgkqhkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wgZ8wDQYJKoZIhvcN
+AQEBBQADgY0AMIGJAoGBAM2H6tTUFiHB6OEkUybL/NfDItiXuCq6pj7f9DH82QXm
+C57NAbuEdU0lo1nGfkbR7HHeMjWOV+02Zn/tHqjtiGIJD9bnYF7z5vjp9l1a2W6m
+C+XIgU4Lc2RRkhJTSwlimPqTy4T8zf+S3DFOeofFUjVjbsNtvHzciniG4PESjN5n
+AgMBAAGjJjAkMBIGA1UdEwEB/wQIMAYBAf8CAQEwDgYDVR0PAQH/BAQDAgEGMA0G
+CSqGSIb3DQEBBQUAA4GBAEY5Lt3JY054K/Ntb30/83vKvHE0KiWI4wnhS2p86W3w
+vrPbs2KD5+NMT/XrQ0JJuY+YlhYLLJsjd2sDoxz763q4zXYU190fapA7ADfwwcBo
+/HIVuVn0FSrlZjksukh5Kh1uEu79lw1htXSPX/yrkFpgUb4lSVxQD9D6BCLIxWZw
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDFDCCAn2gAwIBAgICA+kwDQYJKoZIhvcNAQEFBQAwgcQxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUw
+OS50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMB4XDTE1MTAy
+MDE2MDM1OFoXDTE2MTAyMTE2MDM1OFowgcQxCzAJBgNVBAYTAlVTMQswCQYDVQQI
+DAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQKDCVDZXJ0aWZp
+Y2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQLDBlYNTA5IFZl
+cmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUwOS50ZXN0MR8w
+HQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMIGfMA0GCSqGSIb3DQEBAQUA
+A4GNADCBiQKBgQDI2TejJ3VtoPlkcjQsqbaiMRCtLGdIN7Ful9z7PWU7AVbuJZxD
+QCeFuFmYsCpBgZD3Rw8JaNfMZLKG3D/peIQ/Hjc44BsFR8H9oa0bIDkZN3kS9O80
+vU4urBwTwt9AFDvGPD4UiFulXsAAHDA4KoBg03R56bm2B+8y2JKiGEQ92QIDAQAB
+oxMwETAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBBQUAA4GBALqNB/JaqkTX
+slppJEaBHTY5/bGGWwV/0t3WMDNFaMrFgcsEY/KjUSyfWh9c6BHOdr21MmNe4YDh
+T8gv9TmcGNsEJRIYD1jly3tCDyA2W0AUIzob1GMGkV8ddKBUrmt/+qLzagxdOrQ0
+dRcxFarWaAJVGhJ+p6kWJt7XJnK341bP
+-----END CERTIFICATE-----
diff --git a/src/tests/data/x509test/InvalidIntCALoop.pem b/src/tests/data/x509test/InvalidIntCALoop.pem
new file mode 100644
index 000000000..bdc130f46
--- /dev/null
+++ b/src/tests/data/x509test/InvalidIntCALoop.pem
@@ -0,0 +1,79 @@
+-----BEGIN CERTIFICATE-----
+MIIDADCCAmmgAwIBAgICBXswDQYJKoZIhvcNAQEFBQAwgckxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMR4wHAYDVQQDDBVpbnQubGV2My5j
+YS5hdXRob3JpdHkxHzAdBgkqhkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wHhcN
+MTUxMDIwMTYyMDI4WhcNMTYxMDIxMTYyMDI4WjCBwDELMAkGA1UEBhMCVVMxCzAJ
+BgNVBAgMAkNBMRgwFgYDVQQHDA9TYW4gTHVpcyBPYmlzcG8xLjAsBgNVBAoMJUNl
+cnRpZmljYXRlIFZhbGlkYXRpb24gYW5kIENvbXBsaWFuY2UxIjAgBgNVBAsMGVg1
+MDkgVmVyaWZpY2F0aW9uIENoZWNrZXIxFTATBgNVBAMMDHd3dy50bHMudGVzdDEf
+MB0GCSqGSIb3DQEJARYQc29tZW9uZUBtYWlsLmNvbTCBnzANBgkqhkiG9w0BAQEF
+AAOBjQAwgYkCgYEAnmXnZivUgr/iHm0VdnME2ZjQFYmQCSxrBbCQpIF6dJTrLSuI
+DbqwZTor5oZZUKDYUwJK66DR+YvmAEpbdEtqDW7KE9i7pCFn/RAjVRMIoVPDelYO
+hCrX1SjH0IhKmSrzyYRJqFR4Da3IaXWCxUW+Vd7j+nnKB6qByaVh0G3IYdECAwEA
+ATANBgkqhkiG9w0BAQUFAAOBgQBjtqcclNio3aqM4jk6ZSim1cd1CP4FrmoguwQa
+YGcSeTafl9iUCLjdgn5dcuTptg1t1IZwk181N5U6z8muiG5LJBqjw7laoQV7+fR5
+J4BC2GbDTXCObnM0zJCD+KOYfQROkQrvepX9NSiHAdajoXN5NFj79wSG87Jj+eEw
+nqbvhg==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDLjCCApegAwIBAgICBXowDQYJKoZIhvcNAQEFBQAwgckxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMR4wHAYDVQQDDBVpbnQubGV2Mi5j
+YS5hdXRob3JpdHkxHzAdBgkqhkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wHhcN
+MTUxMDIwMTYyMDI4WhcNMTYxMDIxMTYyMDI4WjCByTELMAkGA1UEBhMCVVMxCzAJ
+BgNVBAgMAkNBMRgwFgYDVQQHDA9TYW4gTHVpcyBPYmlzcG8xLjAsBgNVBAoMJUNl
+cnRpZmljYXRlIFZhbGlkYXRpb24gYW5kIENvbXBsaWFuY2UxIjAgBgNVBAsMGVg1
+MDkgVmVyaWZpY2F0aW9uIENoZWNrZXIxHjAcBgNVBAMMFWludC5sZXYzLmNhLmF1
+dGhvcml0eTEfMB0GCSqGSIb3DQEJARYQc29tZW9uZUBtYWlsLmNvbTCBnzANBgkq
+hkiG9w0BAQEFAAOBjQAwgYkCgYEA5iteXsj5C5OqcDqs9SCqtbTem22GYpaacDEW
+5jPoHLH/7iqIf3uezQ1rZlMSS5rT+iYH4Yv7xEFcDGQKL25rjkV0zmfTRGCh78JN
+GW1YG2yb0hR9P7w9BIUl2LJMhBeEFjEIXCzGNdfzqD8dm+g1uSm7sLMGtPR/rucU
+l77a2FUCAwEAAaMjMCEwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYw
+DQYJKoZIhvcNAQEFBQADgYEALrfXMs6XfoYB9Aj57YAXunFTfdQaBaLrsquZiEk4
+aAjt3+tRBV6BRZBRqW+8q2iDfJqIa8ti+bonDpGc0J309C1UmIsO0ASxZkeBX14S
+23Mp/eD5LAKeMoUUiLSlWN+FlyWfY2axA0UDvb5s2q3NvSyx0qY8FBWNeHdwvX9I
+Mn8=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDLjCCApegAwIBAgICBXkwDQYJKoZIhvcNAQEFBQAwgckxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMR4wHAYDVQQDDBVpbnQubGV2MS5j
+YS5hdXRob3JpdHkxHzAdBgkqhkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wHhcN
+MTUxMDIwMTYyMDI4WhcNMTYxMDIxMTYyMDI4WjCByTELMAkGA1UEBhMCVVMxCzAJ
+BgNVBAgMAkNBMRgwFgYDVQQHDA9TYW4gTHVpcyBPYmlzcG8xLjAsBgNVBAoMJUNl
+cnRpZmljYXRlIFZhbGlkYXRpb24gYW5kIENvbXBsaWFuY2UxIjAgBgNVBAsMGVg1
+MDkgVmVyaWZpY2F0aW9uIENoZWNrZXIxHjAcBgNVBAMMFWludC5sZXYyLmNhLmF1
+dGhvcml0eTEfMB0GCSqGSIb3DQEJARYQc29tZW9uZUBtYWlsLmNvbTCBnzANBgkq
+hkiG9w0BAQEFAAOBjQAwgYkCgYEAqsPZjU3HvuNLa4iBQ6X1HuIHTpXxZ3/QxaaY
+AWelfG65MtlBFPHrSBEpWcmntUTA75gPXYOP/yu1sAgHzXlAEA4IwRQd4oHr3s+1
+1iZOr2oIEaez72ifgTerQlfBDnxSDqiM91VNuRqkaGXx+qYO7Oyf/VCCVg6QdSDy
+dbghbykCAwEAAaMjMCEwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYw
+DQYJKoZIhvcNAQEFBQADgYEAcJTkIw9pDpmnOW+TBxJ6ygLSkbFwkZR89LTD2hEU
+1bTQfqlVAaSYWzkErtc2NfUhn9ukseBw6l2QX1NxBSD/uo0Le2cszvkcE+yNiQZa
+KZ2AtHPOFqpQ/P/wNX/qup7HvGdBvosKXn7z8RegVM/Bswspv8Gbv+GRsLhaz3m9
+XY0=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDLjCCApegAwIBAgICBXgwDQYJKoZIhvcNAQEFBQAwgckxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMR4wHAYDVQQDDBVpbnQubGV2My5j
+YS5hdXRob3JpdHkxHzAdBgkqhkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wHhcN
+MTUxMDIwMTYyMDI4WhcNMTYxMDIxMTYyMDI4WjCByTELMAkGA1UEBhMCVVMxCzAJ
+BgNVBAgMAkNBMRgwFgYDVQQHDA9TYW4gTHVpcyBPYmlzcG8xLjAsBgNVBAoMJUNl
+cnRpZmljYXRlIFZhbGlkYXRpb24gYW5kIENvbXBsaWFuY2UxIjAgBgNVBAsMGVg1
+MDkgVmVyaWZpY2F0aW9uIENoZWNrZXIxHjAcBgNVBAMMFWludC5sZXYxLmNhLmF1
+dGhvcml0eTEfMB0GCSqGSIb3DQEJARYQc29tZW9uZUBtYWlsLmNvbTCBnzANBgkq
+hkiG9w0BAQEFAAOBjQAwgYkCgYEAzkSy3H+LjALk3Sg3mM6DzB8KzGph1hPUofX4
+9v5yIxToLHykHWAGneGKQY+6bjv5dlkJh5YdI4VDUglDSN+7DV/en+X8ipUliRkK
+4Ic2xl7FeVfKi4ZdA6pK/EvHSkSzzq9bCjZvGQr2QjUX3A7AslCGfhQxbdBUm82M
+UtTpEL0CAwEAAaMjMCEwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYw
+DQYJKoZIhvcNAQEFBQADgYEADnUvQyw1XzfNt4ZHwj8SAP0X6iBGbEWpDf1IbZcU
+pNcsE2lAo0zIWV9ShhuVBGNOWVxiCWyPeQGPUm/oQX4rDu3hhKK0ff5DHrIkeQOd
+R3vSw2U9ftWGC7ah/mImTIlZGVfas+SKAZMv91YnandHHlIzEtv8Yqn1nLMezjU9
+FSI=
+-----END CERTIFICATE-----
diff --git a/src/tests/data/x509test/InvalidIntCASelfSign.pem b/src/tests/data/x509test/InvalidIntCASelfSign.pem
new file mode 100644
index 000000000..212cad56f
--- /dev/null
+++ b/src/tests/data/x509test/InvalidIntCASelfSign.pem
@@ -0,0 +1,79 @@
+-----BEGIN CERTIFICATE-----
+MIIDADCCAmmgAwIBAgICBV8wDQYJKoZIhvcNAQEFBQAwgckxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMR4wHAYDVQQDDBVpbnQubGV2My5j
+YS5hdXRob3JpdHkxHzAdBgkqhkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wHhcN
+MTUxMDIwMTYyMDI3WhcNMTYxMDIxMTYyMDI3WjCBwDELMAkGA1UEBhMCVVMxCzAJ
+BgNVBAgMAkNBMRgwFgYDVQQHDA9TYW4gTHVpcyBPYmlzcG8xLjAsBgNVBAoMJUNl
+cnRpZmljYXRlIFZhbGlkYXRpb24gYW5kIENvbXBsaWFuY2UxIjAgBgNVBAsMGVg1
+MDkgVmVyaWZpY2F0aW9uIENoZWNrZXIxFTATBgNVBAMMDHd3dy50bHMudGVzdDEf
+MB0GCSqGSIb3DQEJARYQc29tZW9uZUBtYWlsLmNvbTCBnzANBgkqhkiG9w0BAQEF
+AAOBjQAwgYkCgYEAsom1fnARuMevEExpCF56bBFF6U0bVkBX2UcuXRIU8l2Gu4nl
+Mn/qTPzOK+TTCdI6sxv4NlnYwrkuipGZgoCL7IArSOJfpTrHWPszK7X7eo2ZpTF6
+2+qeUGf0r+geX/STSbEcABnjCYgCdLhZfjmCrLNRZQaf0P91XFC1C/MgweMCAwEA
+ATANBgkqhkiG9w0BAQUFAAOBgQAETF0DSF1rPOwqGX2xQXq7pbruHnNKq09GiObp
+tCJ0Jc2QZAvkrqKI5b52xyaP3ZxFFky+2dV49y/nrIHtJuw/3Sxch4kHyFA6Kjma
+P7AG6w9neLOFGfF8jVJScZOtHVrNFao2VGBco0NraKW1C3exJlscBJoPddy2Cld/
+GpCFsw==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDLjCCApegAwIBAgICBV4wDQYJKoZIhvcNAQEFBQAwgckxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMR4wHAYDVQQDDBVpbnQubGV2Mi5j
+YS5hdXRob3JpdHkxHzAdBgkqhkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wHhcN
+MTUxMDIwMTYyMDI3WhcNMTYxMDIxMTYyMDI3WjCByTELMAkGA1UEBhMCVVMxCzAJ
+BgNVBAgMAkNBMRgwFgYDVQQHDA9TYW4gTHVpcyBPYmlzcG8xLjAsBgNVBAoMJUNl
+cnRpZmljYXRlIFZhbGlkYXRpb24gYW5kIENvbXBsaWFuY2UxIjAgBgNVBAsMGVg1
+MDkgVmVyaWZpY2F0aW9uIENoZWNrZXIxHjAcBgNVBAMMFWludC5sZXYzLmNhLmF1
+dGhvcml0eTEfMB0GCSqGSIb3DQEJARYQc29tZW9uZUBtYWlsLmNvbTCBnzANBgkq
+hkiG9w0BAQEFAAOBjQAwgYkCgYEAnxjsz3c15kCCvXdynh4AhQ8f1a0Qj5yk2LOj
+XT8Oe3XVErMWVHJkAbmwAh0ir4HtI7gqZTdUZe2DQ/Syx/dn1zcXUr3VLerk+fkM
+ilejsR7pRWfr5pIA8L5YupZxG5feH8AWMAyCOcbL3iogrv7rGo2Uv9b5xpiDlPpp
+H8t3+1sCAwEAAaMjMCEwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYw
+DQYJKoZIhvcNAQEFBQADgYEApaIfSqUQbr0bUCocdSvaYUTRVnnZTYhpj2ktvMhO
+BFB5iQgOl3k9Bxm0RxHqK50ix50f0sSFdP7Z/IpLzdkDODOKQIkKKfSiLQs3E0Pg
+omHUaTY6udk17mlLkp4kNhonzcqPCx5fFD2btVSvsYbaM4Q+WX7AmYlEXu3cRxIA
+RoQ=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDLjCCApegAwIBAgICBV0wDQYJKoZIhvcNAQEFBQAwgckxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMR4wHAYDVQQDDBVpbnQubGV2MS5j
+YS5hdXRob3JpdHkxHzAdBgkqhkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wHhcN
+MTUxMDIwMTYyMDI3WhcNMTYxMDIxMTYyMDI3WjCByTELMAkGA1UEBhMCVVMxCzAJ
+BgNVBAgMAkNBMRgwFgYDVQQHDA9TYW4gTHVpcyBPYmlzcG8xLjAsBgNVBAoMJUNl
+cnRpZmljYXRlIFZhbGlkYXRpb24gYW5kIENvbXBsaWFuY2UxIjAgBgNVBAsMGVg1
+MDkgVmVyaWZpY2F0aW9uIENoZWNrZXIxHjAcBgNVBAMMFWludC5sZXYyLmNhLmF1
+dGhvcml0eTEfMB0GCSqGSIb3DQEJARYQc29tZW9uZUBtYWlsLmNvbTCBnzANBgkq
+hkiG9w0BAQEFAAOBjQAwgYkCgYEAvuDuMaBRVeccDQMHApE8OldJRDpf1pLjODvx
+0/j/QkdRUJTiL3orG1XvT9RuRidRa6iqaKp0Cs4pE7QLv7Vo2Qpq3xgwDf42X9pS
+pesx+bzJePTgb/X+rpAx7WNkdkTOoKBUgbbwLjsti/Es4whPXezaZXr6fJd+iuwd
+xk+WYXUCAwEAAaMjMCEwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYw
+DQYJKoZIhvcNAQEFBQADgYEAhMMK1V6OwGRPnBbNddykOBVW546m0F/in8H9cZH/
+jSKMhDxifPV8q0GLF6u+JSQTH6x3llvumXcnwb65gkwmLgVV/TmF4BuiyF59f9Bt
+aeU9tBKb6Ef6Hv8hNhVGE11wuIjUERiyPgJ1PAWBKnIHGXEhqg9adpHL3NlFCD7r
+sCY=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDLjCCApegAwIBAgICBVwwDQYJKoZIhvcNAQEFBQAwgckxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMR4wHAYDVQQDDBVpbnQubGV2MS5j
+YS5hdXRob3JpdHkxHzAdBgkqhkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wHhcN
+MTUxMDIwMTYyMDI3WhcNMTYxMDIxMTYyMDI3WjCByTELMAkGA1UEBhMCVVMxCzAJ
+BgNVBAgMAkNBMRgwFgYDVQQHDA9TYW4gTHVpcyBPYmlzcG8xLjAsBgNVBAoMJUNl
+cnRpZmljYXRlIFZhbGlkYXRpb24gYW5kIENvbXBsaWFuY2UxIjAgBgNVBAsMGVg1
+MDkgVmVyaWZpY2F0aW9uIENoZWNrZXIxHjAcBgNVBAMMFWludC5sZXYxLmNhLmF1
+dGhvcml0eTEfMB0GCSqGSIb3DQEJARYQc29tZW9uZUBtYWlsLmNvbTCBnzANBgkq
+hkiG9w0BAQEFAAOBjQAwgYkCgYEAzPLH+D/L14UV4upNVj8GUzVK0hPqnN3x6Lzy
+u/1rXne9nhP+HB/toJUe/VeRw+xs3aVpPE1z9Fx/+h5hmzxM8CmxifdBkhI61AwH
+/X/8z+wKfmo5mKTYbP13wHg6aZjlDnKWnabvUYv2VUqfffa9mz+lY8wVm4OTtRXS
+v2hI+sUCAwEAAaMjMCEwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYw
+DQYJKoZIhvcNAQEFBQADgYEAXW153EIEyP0VOyYWIqLMz77XShXmckYKbBKS/kWH
+7iYaZhy6Jw1MXluiQ2kYzgxbjBXvFlGo0IOKTnU05NmCOGU3bgBIiZ/oTiQcSges
+Omqg7oK85c/kFEQ3QrboJZ+w5HgDtp3Bi6U1qESfnvsjwWhqnXmmtd77z/w0vFYp
+t5M=
+-----END CERTIFICATE-----
diff --git a/src/tests/data/x509test/InvalidIntCAVersionOne.pem b/src/tests/data/x509test/InvalidIntCAVersionOne.pem
new file mode 100644
index 000000000..135b25929
--- /dev/null
+++ b/src/tests/data/x509test/InvalidIntCAVersionOne.pem
@@ -0,0 +1,97 @@
+-----BEGIN CERTIFICATE-----
+MIIDADCCAmmgAwIBAgICBXMwDQYJKoZIhvcNAQEFBQAwgckxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMR4wHAYDVQQDDBVpbnQubGV2My5j
+YS5hdXRob3JpdHkxHzAdBgkqhkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wHhcN
+MTUxMDIwMTYyMDI4WhcNMTYxMDIxMTYyMDI4WjCBwDELMAkGA1UEBhMCVVMxCzAJ
+BgNVBAgMAkNBMRgwFgYDVQQHDA9TYW4gTHVpcyBPYmlzcG8xLjAsBgNVBAoMJUNl
+cnRpZmljYXRlIFZhbGlkYXRpb24gYW5kIENvbXBsaWFuY2UxIjAgBgNVBAsMGVg1
+MDkgVmVyaWZpY2F0aW9uIENoZWNrZXIxFTATBgNVBAMMDHd3dy50bHMudGVzdDEf
+MB0GCSqGSIb3DQEJARYQc29tZW9uZUBtYWlsLmNvbTCBnzANBgkqhkiG9w0BAQEF
+AAOBjQAwgYkCgYEAoTaHrOkrTBz4bUkJL0WPdClVfptiHd6cKfLIK81Vt88NCHDW
++APuxXvGQ6WqDuOKZdjlbmzvUEN9+JDxZQ3tbg1oOITchMeHXeskuQhBaTiyDqyj
+afwRBeFB8kj4fhR7TBIiQ6CmWZg/xn1UR4j19gBggK1gmvZsE+D6GJsmsUMCAwEA
+ATANBgkqhkiG9w0BAQUFAAOBgQArbFpH3hYIOGCIaR+TkNbaTzqEo4tite//XxnL
+VX2Ky+vdZVrjtFbgCkk0SrCIHUJLBA7twxpYvHzVrqr5nKBQd0RRgyK5dukunlDq
+4aGduZV0Attlb8TifEvURbNZJpSWy4X3CEm+ksn77lnfB3wdCdD/PEAUNJsuxjC8
+kSc4Gw==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDLjCCApegAwIBAgICBXIwDQYJKoZIhvcNAQEFBQAwgckxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMR4wHAYDVQQDDBVpbnQubGV2Mi5j
+YS5hdXRob3JpdHkxHzAdBgkqhkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wHhcN
+MTUxMDIwMTYyMDI4WhcNMTYxMDIxMTYyMDI4WjCByTELMAkGA1UEBhMCVVMxCzAJ
+BgNVBAgMAkNBMRgwFgYDVQQHDA9TYW4gTHVpcyBPYmlzcG8xLjAsBgNVBAoMJUNl
+cnRpZmljYXRlIFZhbGlkYXRpb24gYW5kIENvbXBsaWFuY2UxIjAgBgNVBAsMGVg1
+MDkgVmVyaWZpY2F0aW9uIENoZWNrZXIxHjAcBgNVBAMMFWludC5sZXYzLmNhLmF1
+dGhvcml0eTEfMB0GCSqGSIb3DQEJARYQc29tZW9uZUBtYWlsLmNvbTCBnzANBgkq
+hkiG9w0BAQEFAAOBjQAwgYkCgYEAs6XFhRh2cg8Bdv3FGVPcpT3f2nFbSWh2pkJ0
+SaTByNgVLHSug+Ucz5ZwYOWUrTg73qobjid7IzrPEooUxaKm7Kjxu5QBEr2t9RkZ
+YI6LT0QISvjMpG/JTTEBX9lZHkkfAgdre+0hXhdi5TA+0+mrmYk3FGHkJ+62WRht
+tGga9EMCAwEAAaMjMCEwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYw
+DQYJKoZIhvcNAQEFBQADgYEAe6FozKwO6hDkrO6SR88z2iZWG/lJ4g+CJeXnsubK
+2r7ewmsq8LchFaoCi8/w2gJgc/wGUCbIWjZ8T4e10qK7MBAzn07lK2uShbdJg/a5
+5telqfgRlngor9W7PmZdvv2NbGkLCv/mvlYdUDWLNUE0G80hwxe1j4kofAxhycbI
+sO0=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDLjCCApegAwIBAgICBXEwDQYJKoZIhvcNAQEFBQAwgckxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMR4wHAYDVQQDDBVpbnQubGV2MS5j
+YS5hdXRob3JpdHkxHzAdBgkqhkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wHhcN
+MTUxMDIwMTYyMDI4WhcNMTYxMDIxMTYyMDI4WjCByTELMAkGA1UEBhMCVVMxCzAJ
+BgNVBAgMAkNBMRgwFgYDVQQHDA9TYW4gTHVpcyBPYmlzcG8xLjAsBgNVBAoMJUNl
+cnRpZmljYXRlIFZhbGlkYXRpb24gYW5kIENvbXBsaWFuY2UxIjAgBgNVBAsMGVg1
+MDkgVmVyaWZpY2F0aW9uIENoZWNrZXIxHjAcBgNVBAMMFWludC5sZXYyLmNhLmF1
+dGhvcml0eTEfMB0GCSqGSIb3DQEJARYQc29tZW9uZUBtYWlsLmNvbTCBnzANBgkq
+hkiG9w0BAQEFAAOBjQAwgYkCgYEAvkZQsSfaEYwugamnfXUxQufz/cvE0oDdL8U6
+X/9BGGXggsCEksl3O0oQHOArKkf1lq7b0KIeeUlv98E99HXOcnlDXvzukxfgFTNJ
+/4K1ZiwvxDEZ8I/ZvIOEu6VFkzGWSlanegisM9LBXWhaZqX6uEC9Fmobs6cIcKY2
+IesFQ9MCAwEAAaMjMCEwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYw
+DQYJKoZIhvcNAQEFBQADgYEARqyWAHKlbjy2tbh4KMLBkuzkORhOvzGQ3fzWTvnr
+nZQSqB/4ytBfPiEx7fYa9zhwDbCP/6cLIAx8t+Bb8uZzfH7BimoRjk1Gp1fbKsqc
+aSAg3+a/IqjF1ApEpyk3YKbUf2sGVz/nW+KSrILzsGIoXA3OKVhEeuadbbWiPx3P
+OWw=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIC/zCCAmgCAgVwMA0GCSqGSIb3DQEBBQUAMIHEMQswCQYDVQQGEwJVUzELMAkG
+A1UECAwCQ0ExGDAWBgNVBAcMD1NhbiBMdWlzIE9iaXNwbzEuMCwGA1UECgwlQ2Vy
+dGlmaWNhdGUgVmFsaWRhdGlvbiBhbmQgQ29tcGxpYW5jZTEiMCAGA1UECwwZWDUw
+OSBWZXJpZmljYXRpb24gQ2hlY2tlcjEZMBcGA1UEAwwQdmVyaWZ5Lng1MDkudGVz
+dDEfMB0GCSqGSIb3DQEJARYQc29tZW9uZUBtYWlsLmNvbTAeFw0xNTEwMjAxNjIw
+MjdaFw0xNjEwMjExNjIwMjdaMIHJMQswCQYDVQQGEwJVUzELMAkGA1UECAwCQ0Ex
+GDAWBgNVBAcMD1NhbiBMdWlzIE9iaXNwbzEuMCwGA1UECgwlQ2VydGlmaWNhdGUg
+VmFsaWRhdGlvbiBhbmQgQ29tcGxpYW5jZTEiMCAGA1UECwwZWDUwOSBWZXJpZmlj
+YXRpb24gQ2hlY2tlcjEeMBwGA1UEAwwVaW50LmxldjEuY2EuYXV0aG9yaXR5MR8w
+HQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMIGfMA0GCSqGSIb3DQEBAQUA
+A4GNADCBiQKBgQDN97AmDaTx876SjtpHnrtzpTEWCm7mdEY6JkaxwTKLiPwcjWr0
+E+TZeq4YDyJJD+EPZlAje+NOpTuaWYkQcb0HHvh3mPmvwJhkjv94lw8TZlDjgQ6d
+DjGiX7Ie1KTt5KerIg4upK+qn39ByZow30X/SQVgtFxpG7AiLB3WRzNivQIDAQAB
+MA0GCSqGSIb3DQEBBQUAA4GBADME04IYoOqkgxlSa8XYB7FqMF7+8GbEJ5jS5FMY
+3hRSmFvwcurB7QbcKZUQDontXpmvwi6h8LqHTRlm/BJSCkknlLcQHARTOxhVYL3P
+fej0AiIn4flYB8azuLpTNzPSayNGT1/3n+tBlinD25kcVd5WxRmrdl/mHU+LDVaz
+RoqP
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDFDCCAn2gAwIBAgICA+kwDQYJKoZIhvcNAQEFBQAwgcQxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUw
+OS50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMB4XDTE1MTAy
+MDE2MDM1OFoXDTE2MTAyMTE2MDM1OFowgcQxCzAJBgNVBAYTAlVTMQswCQYDVQQI
+DAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQKDCVDZXJ0aWZp
+Y2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQLDBlYNTA5IFZl
+cmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUwOS50ZXN0MR8w
+HQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMIGfMA0GCSqGSIb3DQEBAQUA
+A4GNADCBiQKBgQDI2TejJ3VtoPlkcjQsqbaiMRCtLGdIN7Ful9z7PWU7AVbuJZxD
+QCeFuFmYsCpBgZD3Rw8JaNfMZLKG3D/peIQ/Hjc44BsFR8H9oa0bIDkZN3kS9O80
+vU4urBwTwt9AFDvGPD4UiFulXsAAHDA4KoBg03R56bm2B+8y2JKiGEQ92QIDAQAB
+oxMwETAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBBQUAA4GBALqNB/JaqkTX
+slppJEaBHTY5/bGGWwV/0t3WMDNFaMrFgcsEY/KjUSyfWh9c6BHOdr21MmNe4YDh
+T8gv9TmcGNsEJRIYD1jly3tCDyA2W0AUIzob1GMGkV8ddKBUrmt/+qLzagxdOrQ0
+dRcxFarWaAJVGhJ+p6kWJt7XJnK341bP
+-----END CERTIFICATE-----
diff --git a/src/tests/data/x509test/InvalidIntCAVersionTwo.pem b/src/tests/data/x509test/InvalidIntCAVersionTwo.pem
new file mode 100644
index 000000000..09e51407d
--- /dev/null
+++ b/src/tests/data/x509test/InvalidIntCAVersionTwo.pem
@@ -0,0 +1,97 @@
+-----BEGIN CERTIFICATE-----
+MIIDADCCAmmgAwIBAgICBXcwDQYJKoZIhvcNAQEFBQAwgckxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMR4wHAYDVQQDDBVpbnQubGV2My5j
+YS5hdXRob3JpdHkxHzAdBgkqhkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wHhcN
+MTUxMDIwMTYyMDI4WhcNMTYxMDIxMTYyMDI4WjCBwDELMAkGA1UEBhMCVVMxCzAJ
+BgNVBAgMAkNBMRgwFgYDVQQHDA9TYW4gTHVpcyBPYmlzcG8xLjAsBgNVBAoMJUNl
+cnRpZmljYXRlIFZhbGlkYXRpb24gYW5kIENvbXBsaWFuY2UxIjAgBgNVBAsMGVg1
+MDkgVmVyaWZpY2F0aW9uIENoZWNrZXIxFTATBgNVBAMMDHd3dy50bHMudGVzdDEf
+MB0GCSqGSIb3DQEJARYQc29tZW9uZUBtYWlsLmNvbTCBnzANBgkqhkiG9w0BAQEF
+AAOBjQAwgYkCgYEAxFCLLNsJzBo7D7ORMhtuSVDjU+GpAiLYREeDtFnazGUgwlUr
+vdUoVdVgmuvxJQ0DtaWnv3zELb4cT1TYGiNMWXepd13T4yIOv0mKMUzFQdrBXCRw
+oPLJbSPLNJipe96BLdLfhDwbaAYEgfA6QAb/Hrnk+utmY4KXLhN7DmxgXbcCAwEA
+ATANBgkqhkiG9w0BAQUFAAOBgQCoZLe6DNhGFkO2sCW8LfwsR6YuGVXXOyAJtjsR
+U1s8Y4zp6hFhwFmNr94dQQswNv8oxY3CUw+1aLTFHetj668A+lxDOadlM3RFpYng
+uQOwFAi/Dq4IFx6AJWCm4/0fhBSXRKQe/EVe4A9sYZV49/7E85nLrGvI9GNovm0U
+FNc2xA==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDLjCCApegAwIBAgICBXYwDQYJKoZIhvcNAQEFBQAwgckxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMR4wHAYDVQQDDBVpbnQubGV2Mi5j
+YS5hdXRob3JpdHkxHzAdBgkqhkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wHhcN
+MTUxMDIwMTYyMDI4WhcNMTYxMDIxMTYyMDI4WjCByTELMAkGA1UEBhMCVVMxCzAJ
+BgNVBAgMAkNBMRgwFgYDVQQHDA9TYW4gTHVpcyBPYmlzcG8xLjAsBgNVBAoMJUNl
+cnRpZmljYXRlIFZhbGlkYXRpb24gYW5kIENvbXBsaWFuY2UxIjAgBgNVBAsMGVg1
+MDkgVmVyaWZpY2F0aW9uIENoZWNrZXIxHjAcBgNVBAMMFWludC5sZXYzLmNhLmF1
+dGhvcml0eTEfMB0GCSqGSIb3DQEJARYQc29tZW9uZUBtYWlsLmNvbTCBnzANBgkq
+hkiG9w0BAQEFAAOBjQAwgYkCgYEA9K+FayI6+UT3+xAMI68BgDhrz9vQRe6iZ3gh
+X0hDIYFuANWqomodzD93ADsFB1/qJyP5E28pOSbATkXyC4UfrUZW2ZUgk0/4PcF9
+BUGz3PyIDKrjiJoJAXNKLdf81spi6gQAphui01zp9fforzTUPP4NkUpGPWXI4QEH
++Q4pDPcCAwEAAaMjMCEwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYw
+DQYJKoZIhvcNAQEFBQADgYEAbdK3s1eLW+7NAsBAPFR96QBBVYo95EzIQ4wHiFa7
+pvvrYSIr8GyzmCrAjnTcFFc7GV2bHHgmi2QnC92ZxiIJ7sIlgkzRxlELeoLiKuyJ
+PquhYUhTDby2lM0lBwpXwZJCdIsH7JElU3iUfffiZoKLkRl/YKKtdPahoNzn+5OX
+ONk=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDLjCCApegAwIBAgICBXUwDQYJKoZIhvcNAQEFBQAwgckxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMR4wHAYDVQQDDBVpbnQubGV2MS5j
+YS5hdXRob3JpdHkxHzAdBgkqhkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wHhcN
+MTUxMDIwMTYyMDI4WhcNMTYxMDIxMTYyMDI4WjCByTELMAkGA1UEBhMCVVMxCzAJ
+BgNVBAgMAkNBMRgwFgYDVQQHDA9TYW4gTHVpcyBPYmlzcG8xLjAsBgNVBAoMJUNl
+cnRpZmljYXRlIFZhbGlkYXRpb24gYW5kIENvbXBsaWFuY2UxIjAgBgNVBAsMGVg1
+MDkgVmVyaWZpY2F0aW9uIENoZWNrZXIxHjAcBgNVBAMMFWludC5sZXYyLmNhLmF1
+dGhvcml0eTEfMB0GCSqGSIb3DQEJARYQc29tZW9uZUBtYWlsLmNvbTCBnzANBgkq
+hkiG9w0BAQEFAAOBjQAwgYkCgYEApLkcf+JB6O2mJ9CY3w7nRlrjOnp7jAhkHMCG
+fDR8tFdRETBon6NzD6sHYMbmwkbFrTq/2XNW0IOjFWeWjrr37VJ3jhYMBLGJzDVG
+xdG1sjB1dsrv23JluHaYdipotbBDj/03TewfFsOSFYOdSoLOSLaSvSaA+cThFelh
+RHv3yn0CAwEAAaMjMCEwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYw
+DQYJKoZIhvcNAQEFBQADgYEA1XOlYsC/HWs6XRdHnEoajPO1TwzHWoBP9ditpdcx
+If0TtHCEVi/KYR1RNo7WGXsYkOXpSAdt+QLXClBdy5E2LozLO24pCcI6TnimQTW0
+Dq7S+6Pr/79SS3AepA74+y9qQhFXAR4+bQiFApaUX8/voap3LBNLJzGX/8DlFscW
+1hY=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDBDCCAm2gAwIBAQICBXQwDQYJKoZIhvcNAQEFBQAwgcQxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUw
+OS50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMB4XDTE1MTAy
+MDE2MjAyOFoXDTE2MTAyMTE2MjAyOFowgckxCzAJBgNVBAYTAlVTMQswCQYDVQQI
+DAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQKDCVDZXJ0aWZp
+Y2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQLDBlYNTA5IFZl
+cmlmaWNhdGlvbiBDaGVja2VyMR4wHAYDVQQDDBVpbnQubGV2MS5jYS5hdXRob3Jp
+dHkxHzAdBgkqhkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wgZ8wDQYJKoZIhvcN
+AQEBBQADgY0AMIGJAoGBANW2KEP1QNNBo0O3Z5R+qFq9AWGxGunlBXKRJ8DdpmXU
+zmirBjdNL1aDVNeNXsTK/dKLSy/Yul4IosYd69G0q2PrwaXUzew6LlBX9c4QbbBf
+L3x3pBKmuJ29vX9IKxggpL5yH1ENZEHCqJ0FCxB0SfrjoTVtGPMzNada9HWqmtCv
+AgMBAAEwDQYJKoZIhvcNAQEFBQADgYEAMqt9r+fd2yb4Dm4xI8oZcy7HPLJ3C/Ht
+Q6beOjUTzMqw2Od127enkpAxREfJSR7QpmwLyEj1niH7cymtPA5ojERGZjlIkmSx
+Y0tBC2+RYu1iW2rW9jz9wnLFLqG4WAsXzUXW+xizehuDqVpBGAPbQ7mtIRUaXrAC
+3m623OT7aS0=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDFDCCAn2gAwIBAgICA+kwDQYJKoZIhvcNAQEFBQAwgcQxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUw
+OS50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMB4XDTE1MTAy
+MDE2MDM1OFoXDTE2MTAyMTE2MDM1OFowgcQxCzAJBgNVBAYTAlVTMQswCQYDVQQI
+DAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQKDCVDZXJ0aWZp
+Y2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQLDBlYNTA5IFZl
+cmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUwOS50ZXN0MR8w
+HQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMIGfMA0GCSqGSIb3DQEBAQUA
+A4GNADCBiQKBgQDI2TejJ3VtoPlkcjQsqbaiMRCtLGdIN7Ful9z7PWU7AVbuJZxD
+QCeFuFmYsCpBgZD3Rw8JaNfMZLKG3D/peIQ/Hjc44BsFR8H9oa0bIDkZN3kS9O80
+vU4urBwTwt9AFDvGPD4UiFulXsAAHDA4KoBg03R56bm2B+8y2JKiGEQ92QIDAQAB
+oxMwETAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBBQUAA4GBALqNB/JaqkTX
+slppJEaBHTY5/bGGWwV/0t3WMDNFaMrFgcsEY/KjUSyfWh9c6BHOdr21MmNe4YDh
+T8gv9TmcGNsEJRIYD1jly3tCDyA2W0AUIzob1GMGkV8ddKBUrmt/+qLzagxdOrQ0
+dRcxFarWaAJVGhJ+p6kWJt7XJnK341bP
+-----END CERTIFICATE-----
diff --git a/src/tests/data/x509test/InvalidKeyUsage.pem b/src/tests/data/x509test/InvalidKeyUsage.pem
new file mode 100644
index 000000000..dfaf41b5c
--- /dev/null
+++ b/src/tests/data/x509test/InvalidKeyUsage.pem
@@ -0,0 +1,38 @@
+-----BEGIN CERTIFICATE-----
+MIIDDzCCAnigAwIBAgICBRcwDQYJKoZIhvcNAQEFBQAwgcQxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUw
+OS50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMB4XDTE1MTAy
+MDE2MjAyNVoXDTE2MTAyMTE2MjAyNVowgcAxCzAJBgNVBAYTAlVTMQswCQYDVQQI
+DAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQKDCVDZXJ0aWZp
+Y2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQLDBlYNTA5IFZl
+cmlmaWNhdGlvbiBDaGVja2VyMRUwEwYDVQQDDAx3d3cudGxzLnRlc3QxHzAdBgkq
+hkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0A
+MIGJAoGBAJ9OccDbTmiIksv7f7ciHz9hs/FtN3NsN/1OrGvSoax0ltDfo/G9A8wC
+O/Yzf1Uy4YPicQmroVVRtR9OQaf0LCRe3L1fkfWKD2K/3mRjH1CHGwjo5BuyeKfO
+Z+x8dBnSUSPyz1FPgHeTUY2DHlHd/6PSYR6e3kIDkyk4vaEGQ1irAgMBAAGjEjAQ
+MA4GA1UdDwEB/wQEAwIBAjANBgkqhkiG9w0BAQUFAAOBgQCTm86qq55do9W/CzCx
+Db4MtuLRvxHjlSDr/gbBhcEMsxftibeNUXyfGaGROXoefdLW/kzmMPFDzr8kdxY1
++so0TlCYbe/YMrvMVpSC2EblhHM6B3rzHVfADH90S3M5iqA+1JDQKXr9EEKQSK/e
+t/HCRAqms3qq8clkOyiTh5wn+w==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDFDCCAn2gAwIBAgICA+kwDQYJKoZIhvcNAQEFBQAwgcQxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUw
+OS50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMB4XDTE1MTAy
+MDE2MDM1OFoXDTE2MTAyMTE2MDM1OFowgcQxCzAJBgNVBAYTAlVTMQswCQYDVQQI
+DAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQKDCVDZXJ0aWZp
+Y2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQLDBlYNTA5IFZl
+cmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUwOS50ZXN0MR8w
+HQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMIGfMA0GCSqGSIb3DQEBAQUA
+A4GNADCBiQKBgQDI2TejJ3VtoPlkcjQsqbaiMRCtLGdIN7Ful9z7PWU7AVbuJZxD
+QCeFuFmYsCpBgZD3Rw8JaNfMZLKG3D/peIQ/Hjc44BsFR8H9oa0bIDkZN3kS9O80
+vU4urBwTwt9AFDvGPD4UiFulXsAAHDA4KoBg03R56bm2B+8y2JKiGEQ92QIDAQAB
+oxMwETAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBBQUAA4GBALqNB/JaqkTX
+slppJEaBHTY5/bGGWwV/0t3WMDNFaMrFgcsEY/KjUSyfWh9c6BHOdr21MmNe4YDh
+T8gv9TmcGNsEJRIYD1jly3tCDyA2W0AUIzob1GMGkV8ddKBUrmt/+qLzagxdOrQ0
+dRcxFarWaAJVGhJ+p6kWJt7XJnK341bP
+-----END CERTIFICATE-----
diff --git a/src/tests/data/x509test/InvalidName.pem b/src/tests/data/x509test/InvalidName.pem
new file mode 100644
index 000000000..1d911713d
--- /dev/null
+++ b/src/tests/data/x509test/InvalidName.pem
@@ -0,0 +1,38 @@
+-----BEGIN CERTIFICATE-----
+MIIDCDCCAnGgAwIBAgICBS0wDQYJKoZIhvcNAQEFBQAwgcQxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUw
+OS50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMB4XDTE1MTAy
+MDE2MjAxNloXDTE2MTAyMTE2MjAxNlowgc0xCzAJBgNVBAYTAlVTMQswCQYDVQQI
+DAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQKDCVDZXJ0aWZp
+Y2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQLDBlYNTA5IFZl
+cmlmaWNhdGlvbiBDaGVja2VyMSIwIAYDVQQDDBl3d3cudGxzLnRlc3QuaW52YWxp
+ZC50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMIGfMA0GCSqG
+SIb3DQEBAQUAA4GNADCBiQKBgQDpwcnxAdRIPpgJVdkAUHUkRFmtBhaUT7RUKSp2
+l1dH1pc3cJerHiBI+ocTu7jrFTUa4fFFUs/8kgpGMWct7KQx0GHR1fYnUBQFLpXF
+7q0Jz4iI6No2osXur+UNq1rObMxcDua4QvdCiGg/Dr5LyNrBumVlzmoaROR501WM
+VRE6lwIDAQABMA0GCSqGSIb3DQEBBQUAA4GBAHyWRPotkRuVkU7+Qws5ZLugJATt
+zXGN5M28hQODXfhk/R0U79/Zt2aGWTNeTrPkZbCGbvV06rKAGzWX83iSK2HiaZU0
+v0gM0nMo99lX8dyWmyEojyIGBzg8FCV7VlYbMvSdmWhjCha+ilxDVBkNSKR/wUv+
+i6d4uJpNCqa9INag
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDFDCCAn2gAwIBAgICA+kwDQYJKoZIhvcNAQEFBQAwgcQxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUw
+OS50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMB4XDTE1MTAy
+MDE2MDM1OFoXDTE2MTAyMTE2MDM1OFowgcQxCzAJBgNVBAYTAlVTMQswCQYDVQQI
+DAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQKDCVDZXJ0aWZp
+Y2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQLDBlYNTA5IFZl
+cmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUwOS50ZXN0MR8w
+HQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMIGfMA0GCSqGSIb3DQEBAQUA
+A4GNADCBiQKBgQDI2TejJ3VtoPlkcjQsqbaiMRCtLGdIN7Ful9z7PWU7AVbuJZxD
+QCeFuFmYsCpBgZD3Rw8JaNfMZLKG3D/peIQ/Hjc44BsFR8H9oa0bIDkZN3kS9O80
+vU4urBwTwt9AFDvGPD4UiFulXsAAHDA4KoBg03R56bm2B+8y2JKiGEQ92QIDAQAB
+oxMwETAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBBQUAA4GBALqNB/JaqkTX
+slppJEaBHTY5/bGGWwV/0t3WMDNFaMrFgcsEY/KjUSyfWh9c6BHOdr21MmNe4YDh
+T8gv9TmcGNsEJRIYD1jly3tCDyA2W0AUIzob1GMGkV8ddKBUrmt/+qLzagxdOrQ0
+dRcxFarWaAJVGhJ+p6kWJt7XJnK341bP
+-----END CERTIFICATE-----
diff --git a/src/tests/data/x509test/InvalidNameAltName.pem b/src/tests/data/x509test/InvalidNameAltName.pem
new file mode 100644
index 000000000..432c5f7b4
--- /dev/null
+++ b/src/tests/data/x509test/InvalidNameAltName.pem
@@ -0,0 +1,39 @@
+-----BEGIN CERTIFICATE-----
+MIIDNTCCAp6gAwIBAgICBSUwDQYJKoZIhvcNAQEFBQAwgcQxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUw
+OS50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMB4XDTE1MTAy
+MDE2MjAyMloXDTE2MTAyMTE2MjAyMlowgc0xCzAJBgNVBAYTAlVTMQswCQYDVQQI
+DAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQKDCVDZXJ0aWZp
+Y2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQLDBlYNTA5IFZl
+cmlmaWNhdGlvbiBDaGVja2VyMSIwIAYDVQQDDBl3d3cudGxzLnRlc3QuaW52YWxp
+ZC50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMIGfMA0GCSqG
+SIb3DQEBAQUAA4GNADCBiQKBgQCwjxxDC308U7KsLzaApJrUDI8sMKP4bUFHqXz8
+IMMb9qPHtADyvQcFoFtG3Tar6wpa3K9Mrx4ex67fN4CCWxZA15En4sSiczUoLgra
+h0Gh+52GkWk/0YQ6wPmQUMuNooVmuFUMA88w0SCN0yaHPWP+cNJaFF6+wwE0mAhf
+UClNQQIDAQABoyswKTAnBgNVHREBAf8EHTAbghl3d3cudGxzLnRlc3QuaW52YWxp
+ZC50ZXN0MA0GCSqGSIb3DQEBBQUAA4GBABVIzzLgsqfDqy7frGI+dQ2LMOA59pJU
+2C8+2QFtoDcDZLRoWyU20NVFaydkRQl0XDw0jwMvmG1bBKr0P8s+8eVilFRkiU7r
+7f9+Zzuuz3mOvUx9V/uGnVyyHDOAv7WPrEacZmMgWJgriK8iE6yFLGyhGq25vTH/
+XgRWAik4E1kN
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDFDCCAn2gAwIBAgICA+kwDQYJKoZIhvcNAQEFBQAwgcQxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUw
+OS50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMB4XDTE1MTAy
+MDE2MDM1OFoXDTE2MTAyMTE2MDM1OFowgcQxCzAJBgNVBAYTAlVTMQswCQYDVQQI
+DAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQKDCVDZXJ0aWZp
+Y2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQLDBlYNTA5IFZl
+cmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUwOS50ZXN0MR8w
+HQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMIGfMA0GCSqGSIb3DQEBAQUA
+A4GNADCBiQKBgQDI2TejJ3VtoPlkcjQsqbaiMRCtLGdIN7Ful9z7PWU7AVbuJZxD
+QCeFuFmYsCpBgZD3Rw8JaNfMZLKG3D/peIQ/Hjc44BsFR8H9oa0bIDkZN3kS9O80
+vU4urBwTwt9AFDvGPD4UiFulXsAAHDA4KoBg03R56bm2B+8y2JKiGEQ92QIDAQAB
+oxMwETAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBBQUAA4GBALqNB/JaqkTX
+slppJEaBHTY5/bGGWwV/0t3WMDNFaMrFgcsEY/KjUSyfWh9c6BHOdr21MmNe4YDh
+T8gv9TmcGNsEJRIYD1jly3tCDyA2W0AUIzob1GMGkV8ddKBUrmt/+qLzagxdOrQ0
+dRcxFarWaAJVGhJ+p6kWJt7XJnK341bP
+-----END CERTIFICATE-----
diff --git a/src/tests/data/x509test/InvalidNameAltNameWithSubj.pem b/src/tests/data/x509test/InvalidNameAltNameWithSubj.pem
new file mode 100644
index 000000000..906df5abf
--- /dev/null
+++ b/src/tests/data/x509test/InvalidNameAltNameWithSubj.pem
@@ -0,0 +1,38 @@
+-----BEGIN CERTIFICATE-----
+MIIDKDCCApGgAwIBAgICBX0wDQYJKoZIhvcNAQEFBQAwgcQxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUw
+OS50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMB4XDTE1MTAy
+MDE2MjAzNFoXDTE2MTAyMTE2MjAzNFowgcAxCzAJBgNVBAYTAlVTMQswCQYDVQQI
+DAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQKDCVDZXJ0aWZp
+Y2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQLDBlYNTA5IFZl
+cmlmaWNhdGlvbiBDaGVja2VyMRUwEwYDVQQDDAx3d3cudGxzLnRlc3QxHzAdBgkq
+hkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0A
+MIGJAoGBALHJIrXXxvMe9C8uDdBq1yv331JYWcIsW4txS4k5CPqEKfc/Txs/KO66
+pXYH3bGg+Wcy2WCnw0GITIK9br+cBs+929C8AXdSsrenYzZMLLHCiiuZ3jvY0oKk
+4xJ5Uo3FDRVyMNOM9z8VSnKyHwokiNwatNn1CTW+gDvuduXc3j6VAgMBAAGjKzAp
+MCcGA1UdEQEB/wQdMBuCGXd3dy50bHMudGVzdC5pbnZhbGlkLnRlc3QwDQYJKoZI
+hvcNAQEFBQADgYEAxntcJCBk5QT1LbuzgHrqUP/ehz0trIleep+8P4OiPYOEzJNB
+IQtgNgYoxZ5gf3DojYU7+5Zr2L/hic64Em2jwyD+uE0MzUF+D7ZC5IvOLNQcjsMr
+BmYAM7w2t80IY9zvoYJgqtEOUMMX0ZnmZ8e5qT4MMo3vTZY/3BjzupEBwUg=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDFDCCAn2gAwIBAgICA+kwDQYJKoZIhvcNAQEFBQAwgcQxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUw
+OS50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMB4XDTE1MTAy
+MDE2MDM1OFoXDTE2MTAyMTE2MDM1OFowgcQxCzAJBgNVBAYTAlVTMQswCQYDVQQI
+DAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQKDCVDZXJ0aWZp
+Y2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQLDBlYNTA5IFZl
+cmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUwOS50ZXN0MR8w
+HQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMIGfMA0GCSqGSIb3DQEBAQUA
+A4GNADCBiQKBgQDI2TejJ3VtoPlkcjQsqbaiMRCtLGdIN7Ful9z7PWU7AVbuJZxD
+QCeFuFmYsCpBgZD3Rw8JaNfMZLKG3D/peIQ/Hjc44BsFR8H9oa0bIDkZN3kS9O80
+vU4urBwTwt9AFDvGPD4UiFulXsAAHDA4KoBg03R56bm2B+8y2JKiGEQ92QIDAQAB
+oxMwETAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBBQUAA4GBALqNB/JaqkTX
+slppJEaBHTY5/bGGWwV/0t3WMDNFaMrFgcsEY/KjUSyfWh9c6BHOdr21MmNe4YDh
+T8gv9TmcGNsEJRIYD1jly3tCDyA2W0AUIzob1GMGkV8ddKBUrmt/+qLzagxdOrQ0
+dRcxFarWaAJVGhJ+p6kWJt7XJnK341bP
+-----END CERTIFICATE-----
diff --git a/src/tests/data/x509test/InvalidNameConstraintExclude.pem b/src/tests/data/x509test/InvalidNameConstraintExclude.pem
new file mode 100644
index 000000000..9cc79586d
--- /dev/null
+++ b/src/tests/data/x509test/InvalidNameConstraintExclude.pem
@@ -0,0 +1,99 @@
+-----BEGIN CERTIFICATE-----
+MIIDHTCCAoagAwIBAgICBZ0wDQYJKoZIhvcNAQEFBQAwgckxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMR4wHAYDVQQDDBVpbnQubGV2My5j
+YS5hdXRob3JpdHkxHzAdBgkqhkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wHhcN
+MTUxMDIwMTYyMDM1WhcNMTYxMDIxMTYyMDM1WjCBwDELMAkGA1UEBhMCVVMxCzAJ
+BgNVBAgMAkNBMRgwFgYDVQQHDA9TYW4gTHVpcyBPYmlzcG8xLjAsBgNVBAoMJUNl
+cnRpZmljYXRlIFZhbGlkYXRpb24gYW5kIENvbXBsaWFuY2UxIjAgBgNVBAsMGVg1
+MDkgVmVyaWZpY2F0aW9uIENoZWNrZXIxFTATBgNVBAMMDHd3dy50bHMudGVzdDEf
+MB0GCSqGSIb3DQEJARYQc29tZW9uZUBtYWlsLmNvbTCBnzANBgkqhkiG9w0BAQEF
+AAOBjQAwgYkCgYEAqlu9+3LUJw49TD7NNtZwzrfalSD3BCXGqaXmCRulYHNRD0Dh
+Pds/uJlUgIFkf2orncbNjMuNlUzrV4P8L7KX+RF4uIxiW01kpg3rl4INsqn8NWLI
+FLbfBEkgebc46bEeq967UX8KEitbrRgq+1FeLlYFbMdBZvbYXhf5Le7KxBECAwEA
+AaMbMBkwFwYDVR0RBBAwDoIMd3d3LnRscy50ZXN0MA0GCSqGSIb3DQEBBQUAA4GB
+ABZNX4ryTfWDtl2+FvBw3XhEObVyQ05xvZoO8SdLqI5XWxGYHKMEVjKwBX5Jp+fx
+JhnyJdBpcRrCNsZqIMX8IPraRcoFBeaEaXCOQXxFmXpUcKbvJspYV06KYLoHiys+
+UsQv3BE5hzAx3xBhvPxGWRNX8eILNu2g/CTQ+XN8SG4a
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDUDCCArmgAwIBAgICBZwwDQYJKoZIhvcNAQEFBQAwgckxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMR4wHAYDVQQDDBVpbnQubGV2Mi5j
+YS5hdXRob3JpdHkxHzAdBgkqhkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wHhcN
+MTUxMDIwMTYyMDM1WhcNMTYxMDIxMTYyMDM1WjCByTELMAkGA1UEBhMCVVMxCzAJ
+BgNVBAgMAkNBMRgwFgYDVQQHDA9TYW4gTHVpcyBPYmlzcG8xLjAsBgNVBAoMJUNl
+cnRpZmljYXRlIFZhbGlkYXRpb24gYW5kIENvbXBsaWFuY2UxIjAgBgNVBAsMGVg1
+MDkgVmVyaWZpY2F0aW9uIENoZWNrZXIxHjAcBgNVBAMMFWludC5sZXYzLmNhLmF1
+dGhvcml0eTEfMB0GCSqGSIb3DQEJARYQc29tZW9uZUBtYWlsLmNvbTCBnzANBgkq
+hkiG9w0BAQEFAAOBjQAwgYkCgYEA579YJqJyfSBD/xEyHXjZ5bu5YwCRWgk6/KjQ
+pSSBwl7Ik1G/JUhFP8S85hU03XJ9ENW12YkbiZmwl7TIng8sdLXGZqZTSHMyZlCk
++Rg1Iv2ZuUozDLbwyfk7RuBE+mrLKzr/IrM0UAL58K2n63m6rUBxDaxE7lCZlJZb
+YSRS4PcCAwEAAaNFMEMwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYw
+IAYDVR0RBBkwF4IVaW50LmxldjMuY2EuYXV0aG9yaXR5MA0GCSqGSIb3DQEBBQUA
+A4GBAER2ODEeD35c57omwLqA5HDSy2urJIxx3IqzeXAvzZ27W5CWoDeLkX6So8Pj
+PLYcLTW+whf8LAzbFRzpQt49P2MPudtGoTBF1yfTwRdoPqxwsZ5fJJwuEfs0Vy28
+3bpFT3POHjSdtnn+zYdu3do5FJ2XISmCkwLyxcMscn7+gmbC
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDUDCCArmgAwIBAgICBZswDQYJKoZIhvcNAQEFBQAwgckxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMR4wHAYDVQQDDBVpbnQubGV2MS5j
+YS5hdXRob3JpdHkxHzAdBgkqhkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wHhcN
+MTUxMDIwMTYyMDM1WhcNMTYxMDIxMTYyMDM1WjCByTELMAkGA1UEBhMCVVMxCzAJ
+BgNVBAgMAkNBMRgwFgYDVQQHDA9TYW4gTHVpcyBPYmlzcG8xLjAsBgNVBAoMJUNl
+cnRpZmljYXRlIFZhbGlkYXRpb24gYW5kIENvbXBsaWFuY2UxIjAgBgNVBAsMGVg1
+MDkgVmVyaWZpY2F0aW9uIENoZWNrZXIxHjAcBgNVBAMMFWludC5sZXYyLmNhLmF1
+dGhvcml0eTEfMB0GCSqGSIb3DQEJARYQc29tZW9uZUBtYWlsLmNvbTCBnzANBgkq
+hkiG9w0BAQEFAAOBjQAwgYkCgYEAnMA5zohoyoq3U6ziijLTMiCYASAwYvSq5KnN
+ZUYtb2Q6570id89nfBRSqH5gepvU3FyOCwMENtPVDCIJDaJKNeNPzbe0C1aDTiJZ
+tDx0vt37yRIxbVr3Py+rW8xywVsVQfxUrVB4n6eA/6Gqu7+JFbcfMnX/wFU4Ialu
+nVkcSTcCAwEAAaNFMEMwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYw
+IAYDVR0RBBkwF4IVaW50LmxldjIuY2EuYXV0aG9yaXR5MA0GCSqGSIb3DQEBBQUA
+A4GBABuBh/2ZOrd/VyGTSwlD9FiautDnqtuuetsjiOGTEWWSHdx1Fr0Z0KAybfTX
+Zbl1uhZNrr63+Lmv4Ds85RyZA0VFHz0rrw1665fXYec4XcXHdySJEnY0gQWHHG73
+7+TalgUhyp/V627E6sntLUqMuWNpiVJTCXcCPtntWOLS3WLt
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDdzCCAuCgAwIBAgICBZowDQYJKoZIhvcNAQEFBQAwgcQxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUw
+OS50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMB4XDTE1MTAy
+MDE2MjAzNVoXDTE2MTAyMTE2MjAzNVowgckxCzAJBgNVBAYTAlVTMQswCQYDVQQI
+DAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQKDCVDZXJ0aWZp
+Y2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQLDBlYNTA5IFZl
+cmlmaWNhdGlvbiBDaGVja2VyMR4wHAYDVQQDDBVpbnQubGV2MS5jYS5hdXRob3Jp
+dHkxHzAdBgkqhkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wgZ8wDQYJKoZIhvcN
+AQEBBQADgY0AMIGJAoGBAKmvPjnuWdpUGTOyt2uobCWuE8i9/IyFvmnvdm7QeHST
+Yvb+3wPXxUgIhh7FwUL5Cg/xtEQu5aWrlbCS/8qM2oSxKJ64mZC9jlwO+sFkExSo
+5/vskozM1LCjpodRbH7rqmcplJbcJ/5FBttELVAUSXCqx4QFRLWrgWVUYtwYPisX
+AgMBAAGjcTBvMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMCAGA1Ud
+EQQZMBeCFWludC5sZXYxLmNhLmF1dGhvcml0eTAqBgNVHR4BAf8EIDAeoBEwD4IN
+LmNhLmF1dGhvcml0eaEJMAeCBS50ZXN0MA0GCSqGSIb3DQEBBQUAA4GBADjNUz+b
+BKZQPJTRSDR2BmcOOPrJLKY5OoWz9OFne+DXtBY4iWw7n6bwJeDl8CO1rclu04XL
+zI/jzsdToQuq9QCTLqudQhZJqcbK8Vl+1XsfBhW+ynkU2Dm4am0lRSNwXrfoA1OW
+45ys8ockOR/7MxYelf06Z/9dsdJaFNJE6ANX
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDFDCCAn2gAwIBAgICA+kwDQYJKoZIhvcNAQEFBQAwgcQxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUw
+OS50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMB4XDTE1MTAy
+MDE2MDM1OFoXDTE2MTAyMTE2MDM1OFowgcQxCzAJBgNVBAYTAlVTMQswCQYDVQQI
+DAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQKDCVDZXJ0aWZp
+Y2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQLDBlYNTA5IFZl
+cmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUwOS50ZXN0MR8w
+HQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMIGfMA0GCSqGSIb3DQEBAQUA
+A4GNADCBiQKBgQDI2TejJ3VtoPlkcjQsqbaiMRCtLGdIN7Ful9z7PWU7AVbuJZxD
+QCeFuFmYsCpBgZD3Rw8JaNfMZLKG3D/peIQ/Hjc44BsFR8H9oa0bIDkZN3kS9O80
+vU4urBwTwt9AFDvGPD4UiFulXsAAHDA4KoBg03R56bm2B+8y2JKiGEQ92QIDAQAB
+oxMwETAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBBQUAA4GBALqNB/JaqkTX
+slppJEaBHTY5/bGGWwV/0t3WMDNFaMrFgcsEY/KjUSyfWh9c6BHOdr21MmNe4YDh
+T8gv9TmcGNsEJRIYD1jly3tCDyA2W0AUIzob1GMGkV8ddKBUrmt/+qLzagxdOrQ0
+dRcxFarWaAJVGhJ+p6kWJt7XJnK341bP
+-----END CERTIFICATE-----
diff --git a/src/tests/data/x509test/InvalidNameConstraintPermit.pem b/src/tests/data/x509test/InvalidNameConstraintPermit.pem
new file mode 100644
index 000000000..3aece322f
--- /dev/null
+++ b/src/tests/data/x509test/InvalidNameConstraintPermit.pem
@@ -0,0 +1,99 @@
+-----BEGIN CERTIFICATE-----
+MIIDHTCCAoagAwIBAgICBaEwDQYJKoZIhvcNAQEFBQAwgckxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMR4wHAYDVQQDDBVpbnQubGV2My5j
+YS5hdXRob3JpdHkxHzAdBgkqhkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wHhcN
+MTUxMDIwMTYyMDM1WhcNMTYxMDIxMTYyMDM1WjCBwDELMAkGA1UEBhMCVVMxCzAJ
+BgNVBAgMAkNBMRgwFgYDVQQHDA9TYW4gTHVpcyBPYmlzcG8xLjAsBgNVBAoMJUNl
+cnRpZmljYXRlIFZhbGlkYXRpb24gYW5kIENvbXBsaWFuY2UxIjAgBgNVBAsMGVg1
+MDkgVmVyaWZpY2F0aW9uIENoZWNrZXIxFTATBgNVBAMMDHd3dy50bHMudGVzdDEf
+MB0GCSqGSIb3DQEJARYQc29tZW9uZUBtYWlsLmNvbTCBnzANBgkqhkiG9w0BAQEF
+AAOBjQAwgYkCgYEAquH5DGj3UqA7pyN3Id+yKxEAYcCl98L8hCtxdGNMbQXWRK7D
+QCGzh9G+Bl3gYH9992AdXEsm0++TXfYlQheHRkLfpXVLXbRfG20ozjYysA8v6/bd
+yBAFXkBSnkWLDjwTh2A/oGOlpLpF6VQs2lbXshFamV4kYTEHITTlFcpolGcCAwEA
+AaMbMBkwFwYDVR0RBBAwDoIMd3d3LnRscy50ZXN0MA0GCSqGSIb3DQEBBQUAA4GB
+AGDWwGwd7XFWl5PuRRaD6Il0fvwmZMCwF7/ZaT8z41M6B1lcMtFpyZnKVnNlBiVq
+xohS7FWGOtNlumAyJlPBOamlP/YEwNIF9ViczVP2gUgAGt/ORHDjAfMpFvvWuuWn
+ZN3sUxByKZ4dsabGqZjKFRn1sjioN27d1zKaQUAAk5a+
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDUDCCArmgAwIBAgICBaAwDQYJKoZIhvcNAQEFBQAwgckxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMR4wHAYDVQQDDBVpbnQubGV2Mi5j
+YS5hdXRob3JpdHkxHzAdBgkqhkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wHhcN
+MTUxMDIwMTYyMDM1WhcNMTYxMDIxMTYyMDM1WjCByTELMAkGA1UEBhMCVVMxCzAJ
+BgNVBAgMAkNBMRgwFgYDVQQHDA9TYW4gTHVpcyBPYmlzcG8xLjAsBgNVBAoMJUNl
+cnRpZmljYXRlIFZhbGlkYXRpb24gYW5kIENvbXBsaWFuY2UxIjAgBgNVBAsMGVg1
+MDkgVmVyaWZpY2F0aW9uIENoZWNrZXIxHjAcBgNVBAMMFWludC5sZXYzLmNhLmF1
+dGhvcml0eTEfMB0GCSqGSIb3DQEJARYQc29tZW9uZUBtYWlsLmNvbTCBnzANBgkq
+hkiG9w0BAQEFAAOBjQAwgYkCgYEAzeyQKMhnPliae0StIhU7iOLM5mNAZ1QaCmHg
+ERKKH0uSWYyAe6PVfv19INdeDWNMJD6STv48XnfgEjmN6WMjfMvsgDt14VhZ1psp
+BCpm6haqO25B0G15QtW+jPZzxYhWugqBeGbUZKmn3S1XCI1lwK3Pot3bZCWGFvd4
+nDIr0V8CAwEAAaNFMEMwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYw
+IAYDVR0RBBkwF4IVaW50LmxldjMuY2EuYXV0aG9yaXR5MA0GCSqGSIb3DQEBBQUA
+A4GBAD0zwk8VDRgVV4si+F9UusIi6Wn52p6R5koG9y3VPffD311PJsADaHkUmuZD
+AXoZpJnPhjCvGZr3a4+uBu/u0DJ/bQmWzF71ZV7B1jMNU7mY2he0m9BUV51Fuzmo
+iwJlqG79kCNkOorM5GZGvGIhTGBpfiRgfuM8tqsR14o+CURd
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDUDCCArmgAwIBAgICBZ8wDQYJKoZIhvcNAQEFBQAwgckxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMR4wHAYDVQQDDBVpbnQubGV2MS5j
+YS5hdXRob3JpdHkxHzAdBgkqhkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wHhcN
+MTUxMDIwMTYyMDM1WhcNMTYxMDIxMTYyMDM1WjCByTELMAkGA1UEBhMCVVMxCzAJ
+BgNVBAgMAkNBMRgwFgYDVQQHDA9TYW4gTHVpcyBPYmlzcG8xLjAsBgNVBAoMJUNl
+cnRpZmljYXRlIFZhbGlkYXRpb24gYW5kIENvbXBsaWFuY2UxIjAgBgNVBAsMGVg1
+MDkgVmVyaWZpY2F0aW9uIENoZWNrZXIxHjAcBgNVBAMMFWludC5sZXYyLmNhLmF1
+dGhvcml0eTEfMB0GCSqGSIb3DQEJARYQc29tZW9uZUBtYWlsLmNvbTCBnzANBgkq
+hkiG9w0BAQEFAAOBjQAwgYkCgYEAxf/HgvShafzkOloC3RxJSnJKO5euYPGgmbdT
+6RiveMznQ6d30X2jEpT5F3HhhUDNGhaW2JO5OqBXfXiiB6zpxEXbTCW+RcHevKkT
+iIOCgqK2hFUiVJGtPntQn4IQGWV2HZB0jstC6F34nSafw9sAVkkioMdvMuXH0tbt
+1Lx+NSUCAwEAAaNFMEMwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYw
+IAYDVR0RBBkwF4IVaW50LmxldjIuY2EuYXV0aG9yaXR5MA0GCSqGSIb3DQEBBQUA
+A4GBAFUJltAwOJ9kYlcec2YSr4Ly2ze3sKPJxJuXKEp51h9os5lz2XolYHcpjEni
+p5ZesxiLdtFbXXAy7OH+5QimAN9BvWXG2AuW83oPT65mlBSZIhpcIAPPZx6egSSQ
+Z/pT+fCKRnGu0zltdoO2SNSb+i+nNXjByVPQt024VdnufaJ/
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDdjCCAt+gAwIBAgICBZ4wDQYJKoZIhvcNAQEFBQAwgcQxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUw
+OS50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMB4XDTE1MTAy
+MDE2MjAzNVoXDTE2MTAyMTE2MjAzNVowgckxCzAJBgNVBAYTAlVTMQswCQYDVQQI
+DAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQKDCVDZXJ0aWZp
+Y2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQLDBlYNTA5IFZl
+cmlmaWNhdGlvbiBDaGVja2VyMR4wHAYDVQQDDBVpbnQubGV2MS5jYS5hdXRob3Jp
+dHkxHzAdBgkqhkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wgZ8wDQYJKoZIhvcN
+AQEBBQADgY0AMIGJAoGBAMt3pACHEotGkwBgzZ3Mg91P08RFDoIf9Cb0UHxEcVFL
+FaVneTUKmD9LxdtDU5OJCPTgYW8nJiJTUEGbc3TfzrCa5zrq4lpKYfDH0LBVZco0
+AkTzz9/NCbkltlLivjblGeURSbNtZRkBjJ83fHEYFHJtzeziCgxN5JsZ4mY+/r5P
+AgMBAAGjcDBuMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMCAGA1Ud
+EQQZMBeCFWludC5sZXYxLmNhLmF1dGhvcml0eTApBgNVHR4BAf8EHzAdoBswD4IN
+LmNhLmF1dGhvcml0eTAIggYudGVzdHgwDQYJKoZIhvcNAQEFBQADgYEAmzKbZleA
+w9P0nVJvr1etPe7hFVyqVB57LqmBnh9dx2kHPzzErLAfJHISHVlf2XJBBgE4e/sd
+0rEy4f9qtFfep1W9fFfIK2FD5ltGdseKFeTpLtCio2EJmhX8VDBe3ryEGgnL6Rvb
+6zL7bjG67htCIDFGeADhcdo4dHZ1zsbIBAA=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDFDCCAn2gAwIBAgICA+kwDQYJKoZIhvcNAQEFBQAwgcQxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUw
+OS50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMB4XDTE1MTAy
+MDE2MDM1OFoXDTE2MTAyMTE2MDM1OFowgcQxCzAJBgNVBAYTAlVTMQswCQYDVQQI
+DAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQKDCVDZXJ0aWZp
+Y2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQLDBlYNTA5IFZl
+cmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUwOS50ZXN0MR8w
+HQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMIGfMA0GCSqGSIb3DQEBAQUA
+A4GNADCBiQKBgQDI2TejJ3VtoPlkcjQsqbaiMRCtLGdIN7Ful9z7PWU7AVbuJZxD
+QCeFuFmYsCpBgZD3Rw8JaNfMZLKG3D/peIQ/Hjc44BsFR8H9oa0bIDkZN3kS9O80
+vU4urBwTwt9AFDvGPD4UiFulXsAAHDA4KoBg03R56bm2B+8y2JKiGEQ92QIDAQAB
+oxMwETAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBBQUAA4GBALqNB/JaqkTX
+slppJEaBHTY5/bGGWwV/0t3WMDNFaMrFgcsEY/KjUSyfWh9c6BHOdr21MmNe4YDh
+T8gv9TmcGNsEJRIYD1jly3tCDyA2W0AUIzob1GMGkV8ddKBUrmt/+qLzagxdOrQ0
+dRcxFarWaAJVGhJ+p6kWJt7XJnK341bP
+-----END CERTIFICATE-----
diff --git a/src/tests/data/x509test/InvalidNameConstraintPermitRight.pem b/src/tests/data/x509test/InvalidNameConstraintPermitRight.pem
new file mode 100644
index 000000000..00da5076a
--- /dev/null
+++ b/src/tests/data/x509test/InvalidNameConstraintPermitRight.pem
@@ -0,0 +1,99 @@
+-----BEGIN CERTIFICATE-----
+MIIDHTCCAoagAwIBAgICBaUwDQYJKoZIhvcNAQEFBQAwgckxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMR4wHAYDVQQDDBVpbnQubGV2My5j
+YS5hdXRob3JpdHkxHzAdBgkqhkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wHhcN
+MTUxMDIwMTYyMDM1WhcNMTYxMDIxMTYyMDM1WjCBwDELMAkGA1UEBhMCVVMxCzAJ
+BgNVBAgMAkNBMRgwFgYDVQQHDA9TYW4gTHVpcyBPYmlzcG8xLjAsBgNVBAoMJUNl
+cnRpZmljYXRlIFZhbGlkYXRpb24gYW5kIENvbXBsaWFuY2UxIjAgBgNVBAsMGVg1
+MDkgVmVyaWZpY2F0aW9uIENoZWNrZXIxFTATBgNVBAMMDHd3dy50bHMudGVzdDEf
+MB0GCSqGSIb3DQEJARYQc29tZW9uZUBtYWlsLmNvbTCBnzANBgkqhkiG9w0BAQEF
+AAOBjQAwgYkCgYEA46JkF8OGNUalSaSDTlr3fnNMySgww5I4B4Stx+oXuCSSDv5+
+7ZfbVGWJO2DNen0mbaiGSIx2+vNilJ+MZPH8b57gRFDw0B671cQiXoy5Uk1ewjuL
+qFbMGYLLBdhdiaq5rt1J/5ui625+qvN0eroE8xvos44JgrHfe+d1Q3g3vSECAwEA
+AaMbMBkwFwYDVR0RBBAwDoIMd3d3LnRscy50ZXN0MA0GCSqGSIb3DQEBBQUAA4GB
+AKUo1PZnjkiyQ0MNqTU3gqJpzZPvh8fL1kDB46dTc3oEfuLXHFQ/Px8fpqpWh2y7
+tZ4bbHIzsel0w36R+VxZlzEa9OGi8h2cuUI6Td57ghD7K9542NKUkviHCW7numZm
+iHJ0WxpEhMlqc8AuV4MF217mVDb904gzBSHbNh1k/7hP
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDUDCCArmgAwIBAgICBaQwDQYJKoZIhvcNAQEFBQAwgckxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMR4wHAYDVQQDDBVpbnQubGV2Mi5j
+YS5hdXRob3JpdHkxHzAdBgkqhkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wHhcN
+MTUxMDIwMTYyMDM1WhcNMTYxMDIxMTYyMDM1WjCByTELMAkGA1UEBhMCVVMxCzAJ
+BgNVBAgMAkNBMRgwFgYDVQQHDA9TYW4gTHVpcyBPYmlzcG8xLjAsBgNVBAoMJUNl
+cnRpZmljYXRlIFZhbGlkYXRpb24gYW5kIENvbXBsaWFuY2UxIjAgBgNVBAsMGVg1
+MDkgVmVyaWZpY2F0aW9uIENoZWNrZXIxHjAcBgNVBAMMFWludC5sZXYzLmNhLmF1
+dGhvcml0eTEfMB0GCSqGSIb3DQEJARYQc29tZW9uZUBtYWlsLmNvbTCBnzANBgkq
+hkiG9w0BAQEFAAOBjQAwgYkCgYEA1zCgafoq+uf6A4/QrlroqLywNj09nZXmXK9F
+HqgOxCatL8eVvv5I3Gug27Dut4cYmxUPhLM1YUm99eK9w8fjRn/RZ9LgKcpwCMZl
+jUt30uFOInqC7X3JDiJDONgDrv6hPbNpDHJHOpP+zIozZYRJ6b8Ny8GUw4egbBPa
+FBgsV40CAwEAAaNFMEMwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYw
+IAYDVR0RBBkwF4IVaW50LmxldjMuY2EuYXV0aG9yaXR5MA0GCSqGSIb3DQEBBQUA
+A4GBADnnZd4jyd0LBVc4DgMy1K/sWa1Y+YxLapzI5C+3gyEo0AjcYzvizCGoH0Fh
+KWlvknAip6QyFdFEQLAeTYGiNYnBU+hhNrd8HejaFe5AZK+WLSOoEqIewwYDxGH9
+jWSeOPIMA8WdDFTao1Fe1B8C3iJdA4ya08Bf6N9fQK8CTkG8
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDUDCCArmgAwIBAgICBaMwDQYJKoZIhvcNAQEFBQAwgckxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMR4wHAYDVQQDDBVpbnQubGV2MS5j
+YS5hdXRob3JpdHkxHzAdBgkqhkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wHhcN
+MTUxMDIwMTYyMDM1WhcNMTYxMDIxMTYyMDM1WjCByTELMAkGA1UEBhMCVVMxCzAJ
+BgNVBAgMAkNBMRgwFgYDVQQHDA9TYW4gTHVpcyBPYmlzcG8xLjAsBgNVBAoMJUNl
+cnRpZmljYXRlIFZhbGlkYXRpb24gYW5kIENvbXBsaWFuY2UxIjAgBgNVBAsMGVg1
+MDkgVmVyaWZpY2F0aW9uIENoZWNrZXIxHjAcBgNVBAMMFWludC5sZXYyLmNhLmF1
+dGhvcml0eTEfMB0GCSqGSIb3DQEJARYQc29tZW9uZUBtYWlsLmNvbTCBnzANBgkq
+hkiG9w0BAQEFAAOBjQAwgYkCgYEA1a6Iet+pElb/Wpgj8zIYU1KtjgGqKH9PdYX3
+TzcpVImis8bBBVQ2S6d+RjJ8L9UduEgUPCcaenXCOLS9W0Nna7HPk4Bi/kbx2CwS
+xAo6JJFaWYvcrX+RwdIf+2QAxA26DZfBdKFXMx3rjEv6KEiW/n7tf8MQ1gESv0FV
+dBuAolMCAwEAAaNFMEMwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYw
+IAYDVR0RBBkwF4IVaW50LmxldjIuY2EuYXV0aG9yaXR5MA0GCSqGSIb3DQEBBQUA
+A4GBAE5OCrt7E9FHPC2U1fbm1Pw98ADu/+5qeGV0H+yHCwwSITj8RCt4iqyf9cOY
+TQkApYxxb9qtfgrhpUCXshc+RMZ+GBIMaF6KPvA8Q4mR+ygdjouOkizfrjjVkDVz
+IBo2rWieSVv2E0hOvuj5Il8kSwtufpI+jd5KdSBlwk+81dcA
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDdDCCAt2gAwIBAgICBaIwDQYJKoZIhvcNAQEFBQAwgcQxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUw
+OS50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMB4XDTE1MTAy
+MDE2MjAzNVoXDTE2MTAyMTE2MjAzNVowgckxCzAJBgNVBAYTAlVTMQswCQYDVQQI
+DAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQKDCVDZXJ0aWZp
+Y2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQLDBlYNTA5IFZl
+cmlmaWNhdGlvbiBDaGVja2VyMR4wHAYDVQQDDBVpbnQubGV2MS5jYS5hdXRob3Jp
+dHkxHzAdBgkqhkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wgZ8wDQYJKoZIhvcN
+AQEBBQADgY0AMIGJAoGBAKi9QUr+ALhErVJHA+VsEkh05o525a8ttlRXi0Gz3Uk5
+Q/3m1RZYdIzTP030DG5zl9UXCwzjH340qJH+EdtTUd3ObLkmwUQu+ZjR5Al3QBfT
+p0zdED4mXwP83aM1mZKzKug4lOyBIgJS8cGkQ6HXSw4pDibDqT2FcdTL9vvqinn5
+AgMBAAGjbjBsMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMCAGA1Ud
+EQQZMBeCFWludC5sZXYxLmNhLmF1dGhvcml0eTAnBgNVHR4BAf8EHTAboBkwD4IN
+LmNhLmF1dGhvcml0eTAGggQudGxzMA0GCSqGSIb3DQEBBQUAA4GBAB4XPEcOd6C4
+cf3tDRlRhBoOgXhHBYgOWig8PJfrHxld7oN5wB4gNDPHJ+iDmurchnYw/+eUnvtc
+yvrwNITZPCiezotwzahJth+YHtdW01s91hY6nRw0ymYz6eBzM9fWnR0ponsfK0wx
+dBOEcZTRvIDFUHSUCQC0FM+IZcdilbY9
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDFDCCAn2gAwIBAgICA+kwDQYJKoZIhvcNAQEFBQAwgcQxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUw
+OS50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMB4XDTE1MTAy
+MDE2MDM1OFoXDTE2MTAyMTE2MDM1OFowgcQxCzAJBgNVBAYTAlVTMQswCQYDVQQI
+DAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQKDCVDZXJ0aWZp
+Y2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQLDBlYNTA5IFZl
+cmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUwOS50ZXN0MR8w
+HQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMIGfMA0GCSqGSIb3DQEBAQUA
+A4GNADCBiQKBgQDI2TejJ3VtoPlkcjQsqbaiMRCtLGdIN7Ful9z7PWU7AVbuJZxD
+QCeFuFmYsCpBgZD3Rw8JaNfMZLKG3D/peIQ/Hjc44BsFR8H9oa0bIDkZN3kS9O80
+vU4urBwTwt9AFDvGPD4UiFulXsAAHDA4KoBg03R56bm2B+8y2JKiGEQ92QIDAQAB
+oxMwETAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBBQUAA4GBALqNB/JaqkTX
+slppJEaBHTY5/bGGWwV/0t3WMDNFaMrFgcsEY/KjUSyfWh9c6BHOdr21MmNe4YDh
+T8gv9TmcGNsEJRIYD1jly3tCDyA2W0AUIzob1GMGkV8ddKBUrmt/+qLzagxdOrQ0
+dRcxFarWaAJVGhJ+p6kWJt7XJnK341bP
+-----END CERTIFICATE-----
diff --git a/src/tests/data/x509test/InvalidNameConstraintPermitThenExclude.pem b/src/tests/data/x509test/InvalidNameConstraintPermitThenExclude.pem
new file mode 100644
index 000000000..fedfe2893
--- /dev/null
+++ b/src/tests/data/x509test/InvalidNameConstraintPermitThenExclude.pem
@@ -0,0 +1,100 @@
+-----BEGIN CERTIFICATE-----
+MIIDHTCCAoagAwIBAgICBakwDQYJKoZIhvcNAQEFBQAwgckxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMR4wHAYDVQQDDBVpbnQubGV2My5j
+YS5hdXRob3JpdHkxHzAdBgkqhkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wHhcN
+MTUxMDIwMTYyMDM1WhcNMTYxMDIxMTYyMDM1WjCBwDELMAkGA1UEBhMCVVMxCzAJ
+BgNVBAgMAkNBMRgwFgYDVQQHDA9TYW4gTHVpcyBPYmlzcG8xLjAsBgNVBAoMJUNl
+cnRpZmljYXRlIFZhbGlkYXRpb24gYW5kIENvbXBsaWFuY2UxIjAgBgNVBAsMGVg1
+MDkgVmVyaWZpY2F0aW9uIENoZWNrZXIxFTATBgNVBAMMDHd3dy50bHMudGVzdDEf
+MB0GCSqGSIb3DQEJARYQc29tZW9uZUBtYWlsLmNvbTCBnzANBgkqhkiG9w0BAQEF
+AAOBjQAwgYkCgYEA4Z/pPfSMPZgg/bImH0j8j8+4qDDsZWCRa7Ra7KSkD/PoxBcl
+qA/KBo0h0uhRo3CiHfefM43UrkLQxVtEZGZYyw2OMP872mdvLt1AF/9ZKItjrRYI
+WxuXzhgu0QzgokUlYzCyFpl7gtTrWk+SJyJbwuVx4udt3I+x60M2I+wHTlMCAwEA
+AaMbMBkwFwYDVR0RBBAwDoIMd3d3LnRscy50ZXN0MA0GCSqGSIb3DQEBBQUAA4GB
+AB9QtP9p/q9pk+EXTZ8SyTfEnit8i8f2u4aaecQteKTkI6uSrBPxfc2+ICtS7K5z
+OGLo9zd06utdUFqNALahTZB1eTXFYwqq5sUvrsaJrDcXFQh/zaRf0jHINbmKJOLM
+3I6Y5ZgY7L1tRUjjVC4/259vO1Wsij8+R4uHvYa/OQC0
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDUDCCArmgAwIBAgICBagwDQYJKoZIhvcNAQEFBQAwgckxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMR4wHAYDVQQDDBVpbnQubGV2Mi5j
+YS5hdXRob3JpdHkxHzAdBgkqhkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wHhcN
+MTUxMDIwMTYyMDM1WhcNMTYxMDIxMTYyMDM1WjCByTELMAkGA1UEBhMCVVMxCzAJ
+BgNVBAgMAkNBMRgwFgYDVQQHDA9TYW4gTHVpcyBPYmlzcG8xLjAsBgNVBAoMJUNl
+cnRpZmljYXRlIFZhbGlkYXRpb24gYW5kIENvbXBsaWFuY2UxIjAgBgNVBAsMGVg1
+MDkgVmVyaWZpY2F0aW9uIENoZWNrZXIxHjAcBgNVBAMMFWludC5sZXYzLmNhLmF1
+dGhvcml0eTEfMB0GCSqGSIb3DQEJARYQc29tZW9uZUBtYWlsLmNvbTCBnzANBgkq
+hkiG9w0BAQEFAAOBjQAwgYkCgYEA3thjDA2sxHu53nc6HTKksipHDMu0/yCPd10N
+l9GfqhK3F5T17R1Rbw7uJV03m6wPY4oxUBlYA8ah3M7pXAUMSbhNV3XmRwOaMDKg
+ATeabnvp8cAqvkht6EgjV8z9/lEhnOFj6c0uXfixrsDP0Vh/fcdGEv0J15OqFZFb
+VwBq48cCAwEAAaNFMEMwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYw
+IAYDVR0RBBkwF4IVaW50LmxldjMuY2EuYXV0aG9yaXR5MA0GCSqGSIb3DQEBBQUA
+A4GBADMERR6zxo4VqaeTp9ZoTyzQnMjxC7hSlk0rh4nCigKbjvacUlzHZ8Y3IkrE
+BGPsxPqOhwUTQKocIKWRpa4k+gkTWK/F5Bc+rGOECWNGOcx6nXodj2r/YeIcV7Zs
+PMR0Jm4e0UlYQXehsdLqAQkXj0dtGq1P9RcDvBgQ7FuMZdZ/
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDaTCCAtKgAwIBAgICBacwDQYJKoZIhvcNAQEFBQAwgckxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMR4wHAYDVQQDDBVpbnQubGV2MS5j
+YS5hdXRob3JpdHkxHzAdBgkqhkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wHhcN
+MTUxMDIwMTYyMDM1WhcNMTYxMDIxMTYyMDM1WjCByTELMAkGA1UEBhMCVVMxCzAJ
+BgNVBAgMAkNBMRgwFgYDVQQHDA9TYW4gTHVpcyBPYmlzcG8xLjAsBgNVBAoMJUNl
+cnRpZmljYXRlIFZhbGlkYXRpb24gYW5kIENvbXBsaWFuY2UxIjAgBgNVBAsMGVg1
+MDkgVmVyaWZpY2F0aW9uIENoZWNrZXIxHjAcBgNVBAMMFWludC5sZXYyLmNhLmF1
+dGhvcml0eTEfMB0GCSqGSIb3DQEJARYQc29tZW9uZUBtYWlsLmNvbTCBnzANBgkq
+hkiG9w0BAQEFAAOBjQAwgYkCgYEAy1HYncuyzWVT9aOjiXiR2mIROZpsmsmOWRaD
+tnJq2e9IS1biUte2dStyenB6GVSEIdz+W160CqDzxljbNQ/6bRsFgXkaJCp76Eo+
+0ho6J99Z6AupchweIisGRlTKVy0QMs1jduQHnA18dfyhPRec2qzf4Z+5GuvQ7bCL
+UQQUVa8CAwEAAaNeMFwwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYw
+IAYDVR0RBBkwF4IVaW50LmxldjIuY2EuYXV0aG9yaXR5MBcGA1UdHgEB/wQNMAuh
+CTAHggUudGVzdDANBgkqhkiG9w0BAQUFAAOBgQAbmBRP1wD8DrpZqKiPBUVvIjPP
+jUhAzxnjJIp8LANZE1Q2S64tsapW7hqRDEwqihfFXZ0R8U6Mq10prv1ZR2qmwZVW
++wcdlzFOT3+/v2PmuLu/C6xgXRnHLMdTXZuaWKMG61H2rrjUWz5MdfJu/EIwHHJS
+QZXoeQfSkJnZz+g17g==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDdTCCAt6gAwIBAgICBaYwDQYJKoZIhvcNAQEFBQAwgcQxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUw
+OS50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMB4XDTE1MTAy
+MDE2MjAzNVoXDTE2MTAyMTE2MjAzNVowgckxCzAJBgNVBAYTAlVTMQswCQYDVQQI
+DAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQKDCVDZXJ0aWZp
+Y2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQLDBlYNTA5IFZl
+cmlmaWNhdGlvbiBDaGVja2VyMR4wHAYDVQQDDBVpbnQubGV2MS5jYS5hdXRob3Jp
+dHkxHzAdBgkqhkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wgZ8wDQYJKoZIhvcN
+AQEBBQADgY0AMIGJAoGBAL6W2iiMkMtBSzeGiBREFbHWxaZCT+AyFeAG5MKszv24
+L8LMyFlq8a3o1Mve3q5LaiFtqMAIcgTNwkrLZfGpQwn6UinpTHMpDYCwBjvVmoJA
+HymK623+2GpiQ6INGL4dNsQCniDEBgvHGaGBIov/T4sFZZMUCh9AD/2XNYcWJVdn
+AgMBAAGjbzBtMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMCAGA1Ud
+EQQZMBeCFWludC5sZXYxLmNhLmF1dGhvcml0eTAoBgNVHR4BAf8EHjAcoBowD4IN
+LmNhLmF1dGhvcml0eTAHggUudGVzdDANBgkqhkiG9w0BAQUFAAOBgQBxuFm4+Qlt
+wy2CUH5Fwu4q3UKYI0nqGVFWw4sRXAhE8ekh8A1wOCsFbV9SRPl2ZFEIpSmUihjb
+IeRA1erlO/2xx8TY734wzHbp+U6qjWoWWbC4v9kMoW8EQVSwWVZ82+Y8LPIVB0bP
+kEl+OP3ah0WaqXVuQzAQlXGYqxZFWUA7Wg==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDFDCCAn2gAwIBAgICA+kwDQYJKoZIhvcNAQEFBQAwgcQxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUw
+OS50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMB4XDTE1MTAy
+MDE2MDM1OFoXDTE2MTAyMTE2MDM1OFowgcQxCzAJBgNVBAYTAlVTMQswCQYDVQQI
+DAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQKDCVDZXJ0aWZp
+Y2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQLDBlYNTA5IFZl
+cmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUwOS50ZXN0MR8w
+HQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMIGfMA0GCSqGSIb3DQEBAQUA
+A4GNADCBiQKBgQDI2TejJ3VtoPlkcjQsqbaiMRCtLGdIN7Ful9z7PWU7AVbuJZxD
+QCeFuFmYsCpBgZD3Rw8JaNfMZLKG3D/peIQ/Hjc44BsFR8H9oa0bIDkZN3kS9O80
+vU4urBwTwt9AFDvGPD4UiFulXsAAHDA4KoBg03R56bm2B+8y2JKiGEQ92QIDAQAB
+oxMwETAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBBQUAA4GBALqNB/JaqkTX
+slppJEaBHTY5/bGGWwV/0t3WMDNFaMrFgcsEY/KjUSyfWh9c6BHOdr21MmNe4YDh
+T8gv9TmcGNsEJRIYD1jly3tCDyA2W0AUIzob1GMGkV8ddKBUrmt/+qLzagxdOrQ0
+dRcxFarWaAJVGhJ+p6kWJt7XJnK341bP
+-----END CERTIFICATE-----
diff --git a/src/tests/data/x509test/InvalidNotAfter.pem b/src/tests/data/x509test/InvalidNotAfter.pem
new file mode 100644
index 000000000..710607051
--- /dev/null
+++ b/src/tests/data/x509test/InvalidNotAfter.pem
@@ -0,0 +1,37 @@
+-----BEGIN CERTIFICATE-----
+MIIC+zCCAmSgAwIBAgICBSIwDQYJKoZIhvcNAQEFBQAwgcQxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUw
+OS50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMB4XDTE1MTAy
+MDE2MjAxNloXDTE1MTAyMDE2MjAxNlowgcAxCzAJBgNVBAYTAlVTMQswCQYDVQQI
+DAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQKDCVDZXJ0aWZp
+Y2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQLDBlYNTA5IFZl
+cmlmaWNhdGlvbiBDaGVja2VyMRUwEwYDVQQDDAx3d3cudGxzLnRlc3QxHzAdBgkq
+hkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0A
+MIGJAoGBALnLv3AyB82npd10twi+JMFEC4PCM9h+P4YjTdMi2tu3sDZKeJ2r2SXH
+4Lu5TPNWcB7x8TQqIYO9LTBV2q9afq5ghT6DyTnAIjMK6u4kKOqU8Bw2mfiK7HDa
+3Jt5C53qzctFCcJMSGTU3Wa5jQtrax5w8GyIu4dYS6BtAW9cwko7AgMBAAEwDQYJ
+KoZIhvcNAQEFBQADgYEAHvDGEqV4hIrP8niDoTkfDEizGv0ZvoW280wbuWlprNbu
+RNwGJeIS7SQWJ8KazZM4ug2A2/CpFaAOCZMnP/DOpEYOqU6BaDWLNug6FqNvI+zD
+W6BJ6WvBfVv2Da9iOMe6L8JyanjXAGQlY7hgZh6VmUUGb7cbV+8TOog9iMdyWQg=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDFDCCAn2gAwIBAgICA+kwDQYJKoZIhvcNAQEFBQAwgcQxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUw
+OS50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMB4XDTE1MTAy
+MDE2MDM1OFoXDTE2MTAyMTE2MDM1OFowgcQxCzAJBgNVBAYTAlVTMQswCQYDVQQI
+DAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQKDCVDZXJ0aWZp
+Y2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQLDBlYNTA5IFZl
+cmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUwOS50ZXN0MR8w
+HQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMIGfMA0GCSqGSIb3DQEBAQUA
+A4GNADCBiQKBgQDI2TejJ3VtoPlkcjQsqbaiMRCtLGdIN7Ful9z7PWU7AVbuJZxD
+QCeFuFmYsCpBgZD3Rw8JaNfMZLKG3D/peIQ/Hjc44BsFR8H9oa0bIDkZN3kS9O80
+vU4urBwTwt9AFDvGPD4UiFulXsAAHDA4KoBg03R56bm2B+8y2JKiGEQ92QIDAQAB
+oxMwETAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBBQUAA4GBALqNB/JaqkTX
+slppJEaBHTY5/bGGWwV/0t3WMDNFaMrFgcsEY/KjUSyfWh9c6BHOdr21MmNe4YDh
+T8gv9TmcGNsEJRIYD1jly3tCDyA2W0AUIzob1GMGkV8ddKBUrmt/+qLzagxdOrQ0
+dRcxFarWaAJVGhJ+p6kWJt7XJnK341bP
+-----END CERTIFICATE-----
diff --git a/src/tests/data/x509test/InvalidNotAfterChained.pem b/src/tests/data/x509test/InvalidNotAfterChained.pem
new file mode 100644
index 000000000..25ae1c861
--- /dev/null
+++ b/src/tests/data/x509test/InvalidNotAfterChained.pem
@@ -0,0 +1,97 @@
+-----BEGIN CERTIFICATE-----
+MIIDADCCAmmgAwIBAgICBTAwDQYJKoZIhvcNAQEFBQAwgckxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMR4wHAYDVQQDDBVpbnQubGV2My5j
+YS5hdXRob3JpdHkxHzAdBgkqhkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wHhcN
+MTUxMDIwMTYyMDIyWhcNMTYxMDIxMTYyMDIyWjCBwDELMAkGA1UEBhMCVVMxCzAJ
+BgNVBAgMAkNBMRgwFgYDVQQHDA9TYW4gTHVpcyBPYmlzcG8xLjAsBgNVBAoMJUNl
+cnRpZmljYXRlIFZhbGlkYXRpb24gYW5kIENvbXBsaWFuY2UxIjAgBgNVBAsMGVg1
+MDkgVmVyaWZpY2F0aW9uIENoZWNrZXIxFTATBgNVBAMMDHd3dy50bHMudGVzdDEf
+MB0GCSqGSIb3DQEJARYQc29tZW9uZUBtYWlsLmNvbTCBnzANBgkqhkiG9w0BAQEF
+AAOBjQAwgYkCgYEAsbQhSON6xrzAMoVeGM36YP69fH5qX2arKKwaVvCTgfbj3y5/
+jPCwgCmFkG+ZVEUS6crc6/1Rf1jfva4eYsp09KamdJZXoPtNqWPVZXAJ3JOb3zYx
+QIWwb3SJOhXGvm+Di7oH5qbaPHrNFnHW7ERgvEfcckYCqFe+PSBgMG8XIxkCAwEA
+ATANBgkqhkiG9w0BAQUFAAOBgQATTavXzwODs3/8Extn3yYClK3djy+ZoEwsqYy3
+dTeqysXjQ1pkVjqYlvAGtX4P4Rz48z4slW3GdhgqCH3T+fuGFpUpVH4rMVa5ZfGj
+i8XV0NE9ZbZ5arw05eE5u6MCENcVvK7SvzRRL5M8J1e/Phf2G8mxixmtCzC7LN7n
+J7W0gQ==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDLjCCApegAwIBAgICBS8wDQYJKoZIhvcNAQEFBQAwgckxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMR4wHAYDVQQDDBVpbnQubGV2Mi5j
+YS5hdXRob3JpdHkxHzAdBgkqhkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wHhcN
+MTUxMDIwMTYyMDIyWhcNMTYxMDIxMTYyMDIyWjCByTELMAkGA1UEBhMCVVMxCzAJ
+BgNVBAgMAkNBMRgwFgYDVQQHDA9TYW4gTHVpcyBPYmlzcG8xLjAsBgNVBAoMJUNl
+cnRpZmljYXRlIFZhbGlkYXRpb24gYW5kIENvbXBsaWFuY2UxIjAgBgNVBAsMGVg1
+MDkgVmVyaWZpY2F0aW9uIENoZWNrZXIxHjAcBgNVBAMMFWludC5sZXYzLmNhLmF1
+dGhvcml0eTEfMB0GCSqGSIb3DQEJARYQc29tZW9uZUBtYWlsLmNvbTCBnzANBgkq
+hkiG9w0BAQEFAAOBjQAwgYkCgYEAn5YPsT1SO1RWYNqIpfVNNjaHBvfIznu45nlB
+xj7v+P524kPz7CO4RvDvQjL9kf6+pyjyMC7Q52FfvVMm6IzJIlx1EwMRxb/l9ved
+y4EMsL+BSkkmRAz/dwZWVe3OmDj3goQ3dQtcC1tdXUsC7o1o4u2i5qJsj4nLu0Cq
+HX2syp0CAwEAAaMjMCEwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYw
+DQYJKoZIhvcNAQEFBQADgYEABrRNnhboO/3EV+Lv4svTXtbGG4sBzets3Tc/aHIV
+t1smo3Q+wVAnN8qLPcWSBJxC1WtVvS9UOfY9tpbU+5YRbMbwLQRas2Rz1iCgHVuv
++T4Qwwul5Auz/INbOLbYBl1w1hbcmoxH621+8gmUJtrTIIQyQsb7HyuYy5nLqyWr
+i1s=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDLjCCApegAwIBAgICBS4wDQYJKoZIhvcNAQEFBQAwgckxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMR4wHAYDVQQDDBVpbnQubGV2MS5j
+YS5hdXRob3JpdHkxHzAdBgkqhkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wHhcN
+MTUxMDIwMTYyMDIyWhcNMTYxMDIxMTYyMDIyWjCByTELMAkGA1UEBhMCVVMxCzAJ
+BgNVBAgMAkNBMRgwFgYDVQQHDA9TYW4gTHVpcyBPYmlzcG8xLjAsBgNVBAoMJUNl
+cnRpZmljYXRlIFZhbGlkYXRpb24gYW5kIENvbXBsaWFuY2UxIjAgBgNVBAsMGVg1
+MDkgVmVyaWZpY2F0aW9uIENoZWNrZXIxHjAcBgNVBAMMFWludC5sZXYyLmNhLmF1
+dGhvcml0eTEfMB0GCSqGSIb3DQEJARYQc29tZW9uZUBtYWlsLmNvbTCBnzANBgkq
+hkiG9w0BAQEFAAOBjQAwgYkCgYEAzYW1/olecip0CmSEgjshaDvRWVRbvnjSzCAk
+We4h+CC3P/OrCOigj6UJJ0dKoZ/ANoxJAr3ve6iOXPxCIm9pHMFntUFHYTeVODYS
+kSvxajE7m+5JqIXgMtk2i5yUMK+eeNOddwBdghWt1gAqf36fdiDw+n948mPCrRqr
++StY8ZkCAwEAAaMjMCEwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYw
+DQYJKoZIhvcNAQEFBQADgYEALnjy5NAAhGpwD20HSEl/cx64qYn2LGSV1QezaKMx
+8GXiFpt9r9wHE/CkuMJpGXkiQjw2rYjUwFDQZkXobi3azMzVyZ48BkA6//WLQ4wC
+m/uJ0Y3+ONIF3NVebLbftgKpPhPvz+lbn5jd36minKiGC0zdiXX6zYYIA4A5xmpA
+kG4=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDKTCCApKgAwIBAgICBSgwDQYJKoZIhvcNAQEFBQAwgcQxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUw
+OS50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMB4XDTE1MTAy
+MDE2MjAyMloXDTE1MTAyMDE2MjAyMlowgckxCzAJBgNVBAYTAlVTMQswCQYDVQQI
+DAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQKDCVDZXJ0aWZp
+Y2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQLDBlYNTA5IFZl
+cmlmaWNhdGlvbiBDaGVja2VyMR4wHAYDVQQDDBVpbnQubGV2MS5jYS5hdXRob3Jp
+dHkxHzAdBgkqhkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wgZ8wDQYJKoZIhvcN
+AQEBBQADgY0AMIGJAoGBANQlSEGZ+JsH4feAXMn842mpEGMEUIt70Po2IJZq2WVO
+pLNmACrrYXu0zx5H0KLuL/Hgndc9VbYf07iKIK5Ds30glpMJZ/TfS4O/qNAnRY7X
+LA1vNFYK2TANC1hRMfaz1KrbuJb4JHkueVCqYjqMfVSwJQE3GXZUa0fQ8e/qEYwd
+AgMBAAGjIzAhMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMA0GCSqG
+SIb3DQEBBQUAA4GBAKHEF9BD2UMwOdm5OajvkunuLruEeaT7+MwZnGG07d/pEvfz
+urUi61RjbNkCE4676SLd7EDbBxrbFQH5NcFVj9VlZvUC2mX8vuu9zhRXTOoUsJFF
+brSAYdARmQge/tOrT34I/BWR2Fi5wWbs+bRo1SvN1a9l3J7BUzmqsgYPnlXb
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDFDCCAn2gAwIBAgICA+kwDQYJKoZIhvcNAQEFBQAwgcQxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUw
+OS50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMB4XDTE1MTAy
+MDE2MDM1OFoXDTE2MTAyMTE2MDM1OFowgcQxCzAJBgNVBAYTAlVTMQswCQYDVQQI
+DAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQKDCVDZXJ0aWZp
+Y2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQLDBlYNTA5IFZl
+cmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUwOS50ZXN0MR8w
+HQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMIGfMA0GCSqGSIb3DQEBAQUA
+A4GNADCBiQKBgQDI2TejJ3VtoPlkcjQsqbaiMRCtLGdIN7Ful9z7PWU7AVbuJZxD
+QCeFuFmYsCpBgZD3Rw8JaNfMZLKG3D/peIQ/Hjc44BsFR8H9oa0bIDkZN3kS9O80
+vU4urBwTwt9AFDvGPD4UiFulXsAAHDA4KoBg03R56bm2B+8y2JKiGEQ92QIDAQAB
+oxMwETAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBBQUAA4GBALqNB/JaqkTX
+slppJEaBHTY5/bGGWwV/0t3WMDNFaMrFgcsEY/KjUSyfWh9c6BHOdr21MmNe4YDh
+T8gv9TmcGNsEJRIYD1jly3tCDyA2W0AUIzob1GMGkV8ddKBUrmt/+qLzagxdOrQ0
+dRcxFarWaAJVGhJ+p6kWJt7XJnK341bP
+-----END CERTIFICATE-----
diff --git a/src/tests/data/x509test/InvalidNotBefore.pem b/src/tests/data/x509test/InvalidNotBefore.pem
new file mode 100644
index 000000000..4e18b4bdf
--- /dev/null
+++ b/src/tests/data/x509test/InvalidNotBefore.pem
@@ -0,0 +1,37 @@
+-----BEGIN CERTIFICATE-----
+MIIC+zCCAmSgAwIBAgICBTEwDQYJKoZIhvcNAQEFBQAwgcQxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUw
+OS50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMB4XDTE1MTAy
+NDE2MjAxNloXDTE2MTAyMTE2MjAxNlowgcAxCzAJBgNVBAYTAlVTMQswCQYDVQQI
+DAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQKDCVDZXJ0aWZp
+Y2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQLDBlYNTA5IFZl
+cmlmaWNhdGlvbiBDaGVja2VyMRUwEwYDVQQDDAx3d3cudGxzLnRlc3QxHzAdBgkq
+hkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0A
+MIGJAoGBAPLeZoJev7YWp1dROtVhH/brTvxADbB5Zc7d4AJuCY6+tIDxIi438IZx
+Xjr1Mb3ptD/gLnvekc/BjAiuMssu4Q7NZbanwDOElMIXKmdhpwRWYKZfDEyJz5t1
+2tyZpJBWUrL26b2+GttLg7lfeT3qg7srnFvqEB3kGN6L+rFajobrAgMBAAEwDQYJ
+KoZIhvcNAQEFBQADgYEAj6/9hGBdOnz2tree0Lk5Nt7wWhKboYXMnBh8rqugCgAm
+2a+PGiZMMWMSHBGD2ArEMmTqCqJElMx8gLuPHESNWTCAxu+kBQKTQ2ZfftAcoi4z
+2Bk81ofO2SZMpOCZ8N25Imd7EG59FE9ovYM0CQkVNho2nDdnkiv51U1Q47m52aI=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDFDCCAn2gAwIBAgICA+kwDQYJKoZIhvcNAQEFBQAwgcQxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUw
+OS50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMB4XDTE1MTAy
+MDE2MDM1OFoXDTE2MTAyMTE2MDM1OFowgcQxCzAJBgNVBAYTAlVTMQswCQYDVQQI
+DAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQKDCVDZXJ0aWZp
+Y2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQLDBlYNTA5IFZl
+cmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUwOS50ZXN0MR8w
+HQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMIGfMA0GCSqGSIb3DQEBAQUA
+A4GNADCBiQKBgQDI2TejJ3VtoPlkcjQsqbaiMRCtLGdIN7Ful9z7PWU7AVbuJZxD
+QCeFuFmYsCpBgZD3Rw8JaNfMZLKG3D/peIQ/Hjc44BsFR8H9oa0bIDkZN3kS9O80
+vU4urBwTwt9AFDvGPD4UiFulXsAAHDA4KoBg03R56bm2B+8y2JKiGEQ92QIDAQAB
+oxMwETAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBBQUAA4GBALqNB/JaqkTX
+slppJEaBHTY5/bGGWwV/0t3WMDNFaMrFgcsEY/KjUSyfWh9c6BHOdr21MmNe4YDh
+T8gv9TmcGNsEJRIYD1jly3tCDyA2W0AUIzob1GMGkV8ddKBUrmt/+qLzagxdOrQ0
+dRcxFarWaAJVGhJ+p6kWJt7XJnK341bP
+-----END CERTIFICATE-----
diff --git a/src/tests/data/x509test/InvalidNotBeforeChained.pem b/src/tests/data/x509test/InvalidNotBeforeChained.pem
new file mode 100644
index 000000000..412eb578c
--- /dev/null
+++ b/src/tests/data/x509test/InvalidNotBeforeChained.pem
@@ -0,0 +1,97 @@
+-----BEGIN CERTIFICATE-----
+MIIDADCCAmmgAwIBAgICBU8wDQYJKoZIhvcNAQEFBQAwgckxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMR4wHAYDVQQDDBVpbnQubGV2My5j
+YS5hdXRob3JpdHkxHzAdBgkqhkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wHhcN
+MTUxMDIwMTYyMDI0WhcNMTYxMDIxMTYyMDI0WjCBwDELMAkGA1UEBhMCVVMxCzAJ
+BgNVBAgMAkNBMRgwFgYDVQQHDA9TYW4gTHVpcyBPYmlzcG8xLjAsBgNVBAoMJUNl
+cnRpZmljYXRlIFZhbGlkYXRpb24gYW5kIENvbXBsaWFuY2UxIjAgBgNVBAsMGVg1
+MDkgVmVyaWZpY2F0aW9uIENoZWNrZXIxFTATBgNVBAMMDHd3dy50bHMudGVzdDEf
+MB0GCSqGSIb3DQEJARYQc29tZW9uZUBtYWlsLmNvbTCBnzANBgkqhkiG9w0BAQEF
+AAOBjQAwgYkCgYEAwvYZAtfuvra0iFtp2F+zznHtGNMQDH0wpAuQLpLf2kp/vEXV
+eBYwq5m9s16trYLC+y9vaC1pgQQfixuQA9xY3DswQyPIztcIPz8r9LQL5YQ8EDzo
+mm64G+WZ7kn5xX4zCRmX3mS09tQOhe00Thqg+JIkcmoG7hGbcEEZ7iZrRocCAwEA
+ATANBgkqhkiG9w0BAQUFAAOBgQAeJrnaVGhxc0Oi8a29sTHaTQB9COvE0Th3ZqZ5
+sZ0fKadhmR52C+acUv45rNPwwb8omiw84PZdh+bBYTs75eAEDNb3YlFMb7IQbhlV
+mebUO1g0WQ5S7Yd1NPpP4BAfGHkEhXJTWY8dzlpFtubRjlcVtJlWdRi4yoPTfsM8
+HxuJlA==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDLjCCApegAwIBAgICBU4wDQYJKoZIhvcNAQEFBQAwgckxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMR4wHAYDVQQDDBVpbnQubGV2Mi5j
+YS5hdXRob3JpdHkxHzAdBgkqhkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wHhcN
+MTUxMDIwMTYyMDI0WhcNMTYxMDIxMTYyMDI0WjCByTELMAkGA1UEBhMCVVMxCzAJ
+BgNVBAgMAkNBMRgwFgYDVQQHDA9TYW4gTHVpcyBPYmlzcG8xLjAsBgNVBAoMJUNl
+cnRpZmljYXRlIFZhbGlkYXRpb24gYW5kIENvbXBsaWFuY2UxIjAgBgNVBAsMGVg1
+MDkgVmVyaWZpY2F0aW9uIENoZWNrZXIxHjAcBgNVBAMMFWludC5sZXYzLmNhLmF1
+dGhvcml0eTEfMB0GCSqGSIb3DQEJARYQc29tZW9uZUBtYWlsLmNvbTCBnzANBgkq
+hkiG9w0BAQEFAAOBjQAwgYkCgYEAp1rCp+dbNbi3SpGNr4fgJDXWUKa5ydd74ryZ
+1TyMVHOaJZvAupi4hFrleQcVpTmdtlNq5BRvyJW1sq6H7d2b3TSXfIi/LdvE9wSe
+Wt/llQbp64px6iB1bpHNdLiIr8BcOciqupSNyiMIfPXQ3tRXWjCd0fZcIuStQEFn
+bxkWdbMCAwEAAaMjMCEwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYw
+DQYJKoZIhvcNAQEFBQADgYEAvYoLXJHeWQkFv1315AOAQGpsdsN8NFnONtvWlczN
+PiWAI48ZzzxA1ZKS38eELVtKyl2EmltonB2WA3aW3OAPET4ID/995e6c0m01hQ68
+Fxca7n0SKq88AQpUm6a8T/RgduCu77Jjv8wKj0AUH1qCX8GogpdFQTUAwhdvfGnu
+pX8=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDLjCCApegAwIBAgICBU0wDQYJKoZIhvcNAQEFBQAwgckxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMR4wHAYDVQQDDBVpbnQubGV2MS5j
+YS5hdXRob3JpdHkxHzAdBgkqhkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wHhcN
+MTUxMDIwMTYyMDI0WhcNMTYxMDIxMTYyMDI0WjCByTELMAkGA1UEBhMCVVMxCzAJ
+BgNVBAgMAkNBMRgwFgYDVQQHDA9TYW4gTHVpcyBPYmlzcG8xLjAsBgNVBAoMJUNl
+cnRpZmljYXRlIFZhbGlkYXRpb24gYW5kIENvbXBsaWFuY2UxIjAgBgNVBAsMGVg1
+MDkgVmVyaWZpY2F0aW9uIENoZWNrZXIxHjAcBgNVBAMMFWludC5sZXYyLmNhLmF1
+dGhvcml0eTEfMB0GCSqGSIb3DQEJARYQc29tZW9uZUBtYWlsLmNvbTCBnzANBgkq
+hkiG9w0BAQEFAAOBjQAwgYkCgYEAz6xQVmb+uXY+VNnWYkBuOvMODOzh/v4vMkp1
+n9JNvqmrb6A6UUtD2/2/uuGEbYbvLKmjijSC2b/no79L1fd8sNbAEi5rUPPlTTwN
+7j1C9bduyyAoua0/mvkxW0jgqHC2Bbw8J44kZM2D+gfTxFe5Iqow6Z56XLiGoAYW
+C5BFtWcCAwEAAaMjMCEwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYw
+DQYJKoZIhvcNAQEFBQADgYEAchcIZ6Z4LiGsR7UWNd02AJaihwZD2HqHSlY1753K
+e9gztxydjMyyHXgVoWc/ZBM9NBuchJwwTb8oEHEfKahIRmZmj5pcvj2KCHz8XQjo
+TiA4QrX3PB2b7ZR178NsnUEUuX9NRKLwnTMIYM7IsDpDBC0YLA7VZGnzemlvsgwl
+Wbs=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDKTCCApKgAwIBAgICBUcwDQYJKoZIhvcNAQEFBQAwgcQxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUw
+OS50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMB4XDTE1MTAy
+NDE2MjAyNFoXDTE2MTAyMTE2MjAyNFowgckxCzAJBgNVBAYTAlVTMQswCQYDVQQI
+DAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQKDCVDZXJ0aWZp
+Y2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQLDBlYNTA5IFZl
+cmlmaWNhdGlvbiBDaGVja2VyMR4wHAYDVQQDDBVpbnQubGV2MS5jYS5hdXRob3Jp
+dHkxHzAdBgkqhkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wgZ8wDQYJKoZIhvcN
+AQEBBQADgY0AMIGJAoGBAL7MqH32J1i03pXI2CNPR1rc135VJoJIR/u8B1cc5rd/
+rBkunOXV4Ouk0GpTjnk8z9QjJQHFMHpR08AhF6/ILoBDnLGqox1WpS1b1tjw97d0
+uD0mlXRhv/amaBjhK/To1PeuQcdzWrwfUzeanQIc6eJQ2Mg6RxLLnV8DXfjUZ7tZ
+AgMBAAGjIzAhMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMA0GCSqG
+SIb3DQEBBQUAA4GBACyvNhQw3lDTtoTPKfGIEYWsdxXkPrLCUM0V4lNGAdFk7iDb
+642lISrtLNks3TfyeuW2R2lwedOExsJpa2HJdvApo9a//a9UULcjiSvzlc5ScjS2
+WL5zhFUpuY/g/JNBW1EM/B7l5W/6S50Q2tjr2AcOkoKDmKegbwjXwLuD3FCu
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDFDCCAn2gAwIBAgICA+kwDQYJKoZIhvcNAQEFBQAwgcQxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUw
+OS50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMB4XDTE1MTAy
+MDE2MDM1OFoXDTE2MTAyMTE2MDM1OFowgcQxCzAJBgNVBAYTAlVTMQswCQYDVQQI
+DAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQKDCVDZXJ0aWZp
+Y2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQLDBlYNTA5IFZl
+cmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUwOS50ZXN0MR8w
+HQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMIGfMA0GCSqGSIb3DQEBAQUA
+A4GNADCBiQKBgQDI2TejJ3VtoPlkcjQsqbaiMRCtLGdIN7Ful9z7PWU7AVbuJZxD
+QCeFuFmYsCpBgZD3Rw8JaNfMZLKG3D/peIQ/Hjc44BsFR8H9oa0bIDkZN3kS9O80
+vU4urBwTwt9AFDvGPD4UiFulXsAAHDA4KoBg03R56bm2B+8y2JKiGEQ92QIDAQAB
+oxMwETAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBBQUAA4GBALqNB/JaqkTX
+slppJEaBHTY5/bGGWwV/0t3WMDNFaMrFgcsEY/KjUSyfWh9c6BHOdr21MmNe4YDh
+T8gv9TmcGNsEJRIYD1jly3tCDyA2W0AUIzob1GMGkV8ddKBUrmt/+qLzagxdOrQ0
+dRcxFarWaAJVGhJ+p6kWJt7XJnK341bP
+-----END CERTIFICATE-----
diff --git a/src/tests/data/x509test/InvalidSelfSign.pem b/src/tests/data/x509test/InvalidSelfSign.pem
new file mode 100644
index 000000000..e86d22825
--- /dev/null
+++ b/src/tests/data/x509test/InvalidSelfSign.pem
@@ -0,0 +1,18 @@
+-----BEGIN CERTIFICATE-----
+MIIC9zCCAmCgAwIBAgICBRYwDQYJKoZIhvcNAQEFBQAwgcAxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMRUwEwYDVQQDDAx3d3cudGxzLnRl
+c3QxHzAdBgkqhkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wHhcNMTUxMDIwMTYy
+MDEzWhcNMTYxMDIxMTYyMDEzWjCBwDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNB
+MRgwFgYDVQQHDA9TYW4gTHVpcyBPYmlzcG8xLjAsBgNVBAoMJUNlcnRpZmljYXRl
+IFZhbGlkYXRpb24gYW5kIENvbXBsaWFuY2UxIjAgBgNVBAsMGVg1MDkgVmVyaWZp
+Y2F0aW9uIENoZWNrZXIxFTATBgNVBAMMDHd3dy50bHMudGVzdDEfMB0GCSqGSIb3
+DQEJARYQc29tZW9uZUBtYWlsLmNvbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkC
+gYEAqv3vC7ay9UTYAZxJoovYraYkjs8is7YpfsHJXaqvHtPj2xutetMCYcIwVexG
+amD9z5pl14ZGtWUO/K7Yha5Fqhrk49bH/M52dcV/2LnXXeqti+HDVfzsxdc2z311
+RYYc7xQxwo+ubnR69qkGG3KwbdouGTpc47NdI7A0gUkavcMCAwEAATANBgkqhkiG
+9w0BAQUFAAOBgQBmFIcuPVsCwFh9rbOkJfm8rE28xX6ZsY8qXOnZry8J1LBU9EaM
+UNnsRG9VB5XWtdK4eoBJyTixVDz57rRUVO8ElrfYAIfGe95oZlJc00xT3P7UXRMa
+AQia66AIfDbvQG/MWZL4mgCm/DJZLPbUf/3k/ayJmw4O3SPyKJ2/D8KrIw==
+-----END CERTIFICATE-----
diff --git a/src/tests/data/x509test/InvalidWildcardAll.pem b/src/tests/data/x509test/InvalidWildcardAll.pem
new file mode 100644
index 000000000..d5eaf6b12
--- /dev/null
+++ b/src/tests/data/x509test/InvalidWildcardAll.pem
@@ -0,0 +1,37 @@
+-----BEGIN CERTIFICATE-----
+MIIC9DCCAl2gAwIBAgICBYQwDQYJKoZIhvcNAQEFBQAwgcQxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUw
+OS50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMB4XDTE1MTAy
+MDE2MjAyOFoXDTE2MTAyMTE2MjAyOFowgbkxCzAJBgNVBAYTAlVTMQswCQYDVQQI
+DAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQKDCVDZXJ0aWZp
+Y2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQLDBlYNTA5IFZl
+cmlmaWNhdGlvbiBDaGVja2VyMQ4wDAYDVQQDDAUqLiouKjEfMB0GCSqGSIb3DQEJ
+ARYQc29tZW9uZUBtYWlsLmNvbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA
+sQKpi0Vjn+H8G+GcTxrp6w39KXYKuyUfILXe+vuo2Au1jomz3E6t7aiiul+EuRaf
+uA/CMIdT8yl4+KP8VICqSbOAuknRlSeOMs/6Xjg38TcP0f7aaLBt5f/qt19wF9+6
+AdYUT7baeZ/QwAWNIHaW/z6DiXwD/BV53vzH6D7IcEUCAwEAATANBgkqhkiG9w0B
+AQUFAAOBgQCruQezcbBRplYmC3rQwZwoXbe6/QOKp6jYRhmC3iWPQMO+udgeAI9W
+g2w2wuayZhLYttmlhEPrR+qKII6CZ0wxOtUyuXP3fT5eNJEs07pvGTaFhPmlYprt
+iYbtbAxSq65PYl9lvUBdqvmff5bu8Qaxo96uDMHtxlVRtai9WTAbvw==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDFDCCAn2gAwIBAgICA+kwDQYJKoZIhvcNAQEFBQAwgcQxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUw
+OS50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMB4XDTE1MTAy
+MDE2MDM1OFoXDTE2MTAyMTE2MDM1OFowgcQxCzAJBgNVBAYTAlVTMQswCQYDVQQI
+DAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQKDCVDZXJ0aWZp
+Y2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQLDBlYNTA5IFZl
+cmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUwOS50ZXN0MR8w
+HQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMIGfMA0GCSqGSIb3DQEBAQUA
+A4GNADCBiQKBgQDI2TejJ3VtoPlkcjQsqbaiMRCtLGdIN7Ful9z7PWU7AVbuJZxD
+QCeFuFmYsCpBgZD3Rw8JaNfMZLKG3D/peIQ/Hjc44BsFR8H9oa0bIDkZN3kS9O80
+vU4urBwTwt9AFDvGPD4UiFulXsAAHDA4KoBg03R56bm2B+8y2JKiGEQ92QIDAQAB
+oxMwETAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBBQUAA4GBALqNB/JaqkTX
+slppJEaBHTY5/bGGWwV/0t3WMDNFaMrFgcsEY/KjUSyfWh9c6BHOdr21MmNe4YDh
+T8gv9TmcGNsEJRIYD1jly3tCDyA2W0AUIzob1GMGkV8ddKBUrmt/+qLzagxdOrQ0
+dRcxFarWaAJVGhJ+p6kWJt7XJnK341bP
+-----END CERTIFICATE-----
diff --git a/src/tests/data/x509test/InvalidWildcardAllAltName.pem b/src/tests/data/x509test/InvalidWildcardAllAltName.pem
new file mode 100644
index 000000000..b1bd6c1af
--- /dev/null
+++ b/src/tests/data/x509test/InvalidWildcardAllAltName.pem
@@ -0,0 +1,38 @@
+-----BEGIN CERTIFICATE-----
+MIIDITCCAoqgAwIBAgICBYcwDQYJKoZIhvcNAQEFBQAwgcQxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUw
+OS50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMB4XDTE1MTAy
+MDE2MjAyOFoXDTE2MTAyMTE2MjAyOFowgc0xCzAJBgNVBAYTAlVTMQswCQYDVQQI
+DAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQKDCVDZXJ0aWZp
+Y2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQLDBlYNTA5IFZl
+cmlmaWNhdGlvbiBDaGVja2VyMSIwIAYDVQQDDBl3d3cudGxzLnRlc3QuaW52YWxp
+ZC50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMIGfMA0GCSqG
+SIb3DQEBAQUAA4GNADCBiQKBgQDIX+1/MXEwTPXFImigK+Dx5xCBHljUJ56zvvfv
+W2Gurq7/R6YjVyY9c/G328TbUssFHxi6YdSwN3XhuM0CVxCmkKo45Duy8IAUtKM2
++yAbC+W4fMaRvLN9Ff/Q0t9CCGs/5wFh6EEFP/FWH81P5yquNrkSBof+vvc63fAW
+5GVwjQIDAQABoxcwFTATBgNVHREBAf8ECTAHggUqLiouKjANBgkqhkiG9w0BAQUF
+AAOBgQA7TNSyxf/cXaLBRny3SW4BhgsOW4CP3K2/ANvSHbBnNvy9UnAGZXTbTrSW
+hmCQqIsJ2qotJsWnytCBLf07jhO6uYohFwKWuDSGBdBoOnrs1fuQnlRBWHgOd16q
+SAc+snIsoLoQNWyLm2ghCHFTWU+z7OodCggCHwmedpLErBa1og==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDFDCCAn2gAwIBAgICA+kwDQYJKoZIhvcNAQEFBQAwgcQxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUw
+OS50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMB4XDTE1MTAy
+MDE2MDM1OFoXDTE2MTAyMTE2MDM1OFowgcQxCzAJBgNVBAYTAlVTMQswCQYDVQQI
+DAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQKDCVDZXJ0aWZp
+Y2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQLDBlYNTA5IFZl
+cmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUwOS50ZXN0MR8w
+HQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMIGfMA0GCSqGSIb3DQEBAQUA
+A4GNADCBiQKBgQDI2TejJ3VtoPlkcjQsqbaiMRCtLGdIN7Ful9z7PWU7AVbuJZxD
+QCeFuFmYsCpBgZD3Rw8JaNfMZLKG3D/peIQ/Hjc44BsFR8H9oa0bIDkZN3kS9O80
+vU4urBwTwt9AFDvGPD4UiFulXsAAHDA4KoBg03R56bm2B+8y2JKiGEQ92QIDAQAB
+oxMwETAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBBQUAA4GBALqNB/JaqkTX
+slppJEaBHTY5/bGGWwV/0t3WMDNFaMrFgcsEY/KjUSyfWh9c6BHOdr21MmNe4YDh
+T8gv9TmcGNsEJRIYD1jly3tCDyA2W0AUIzob1GMGkV8ddKBUrmt/+qLzagxdOrQ0
+dRcxFarWaAJVGhJ+p6kWJt7XJnK341bP
+-----END CERTIFICATE-----
diff --git a/src/tests/data/x509test/InvalidWildcardLeft.pem b/src/tests/data/x509test/InvalidWildcardLeft.pem
new file mode 100644
index 000000000..e7e0fe605
--- /dev/null
+++ b/src/tests/data/x509test/InvalidWildcardLeft.pem
@@ -0,0 +1,37 @@
+-----BEGIN CERTIFICATE-----
+MIIC9TCCAl6gAwIBAgICBYAwDQYJKoZIhvcNAQEFBQAwgcQxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUw
+OS50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMB4XDTE1MTAy
+MDE2MjAyOFoXDTE2MTAyMTE2MjAyOFowgboxCzAJBgNVBAYTAlVTMQswCQYDVQQI
+DAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQKDCVDZXJ0aWZp
+Y2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQLDBlYNTA5IFZl
+cmlmaWNhdGlvbiBDaGVja2VyMQ8wDQYDVQQDDAYqLnRlc3QxHzAdBgkqhkiG9w0B
+CQEWEHNvbWVvbmVAbWFpbC5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGB
+AMzZREK0of+aoPJkedjQ7JoGU14YetcwhGupU3zoXAvQJkTgax8LNzqQ+2JSeKfg
+Pt6+K0S2uXIRneHYAlSWUSvHoSxplsCqBZER7oVLx6dbLNxSNu8ZlwuH0py2DpvB
+cvLcLgx6NaXat4oA4lBjPC/a8rcfNfxyX8TNy2X2sBLzAgMBAAEwDQYJKoZIhvcN
+AQEFBQADgYEAgVTj5F3n+HwNz7QG24FF36T2NfQ2OdLo0XmkS27dhd5gX/X9aFlK
+4SnfKy0HX+l0Y2b9QCfmxjBB7n12/5msrOHQbKvuYTeeZ+e5Dz0NGU4hXZH/qTPg
+EQTQr96LcSh+RQMSmi1VhgeqZZZ3yWPJNLtFWCt4aBGBBMnT0h5Ksxg=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDFDCCAn2gAwIBAgICA+kwDQYJKoZIhvcNAQEFBQAwgcQxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUw
+OS50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMB4XDTE1MTAy
+MDE2MDM1OFoXDTE2MTAyMTE2MDM1OFowgcQxCzAJBgNVBAYTAlVTMQswCQYDVQQI
+DAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQKDCVDZXJ0aWZp
+Y2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQLDBlYNTA5IFZl
+cmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUwOS50ZXN0MR8w
+HQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMIGfMA0GCSqGSIb3DQEBAQUA
+A4GNADCBiQKBgQDI2TejJ3VtoPlkcjQsqbaiMRCtLGdIN7Ful9z7PWU7AVbuJZxD
+QCeFuFmYsCpBgZD3Rw8JaNfMZLKG3D/peIQ/Hjc44BsFR8H9oa0bIDkZN3kS9O80
+vU4urBwTwt9AFDvGPD4UiFulXsAAHDA4KoBg03R56bm2B+8y2JKiGEQ92QIDAQAB
+oxMwETAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBBQUAA4GBALqNB/JaqkTX
+slppJEaBHTY5/bGGWwV/0t3WMDNFaMrFgcsEY/KjUSyfWh9c6BHOdr21MmNe4YDh
+T8gv9TmcGNsEJRIYD1jly3tCDyA2W0AUIzob1GMGkV8ddKBUrmt/+qLzagxdOrQ0
+dRcxFarWaAJVGhJ+p6kWJt7XJnK341bP
+-----END CERTIFICATE-----
diff --git a/src/tests/data/x509test/InvalidWildcardLeftAltName.pem b/src/tests/data/x509test/InvalidWildcardLeftAltName.pem
new file mode 100644
index 000000000..f91e83b32
--- /dev/null
+++ b/src/tests/data/x509test/InvalidWildcardLeftAltName.pem
@@ -0,0 +1,38 @@
+-----BEGIN CERTIFICATE-----
+MIIDIjCCAougAwIBAgICBYMwDQYJKoZIhvcNAQEFBQAwgcQxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUw
+OS50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMB4XDTE1MTAy
+MDE2MjAyOFoXDTE2MTAyMTE2MjAyOFowgc0xCzAJBgNVBAYTAlVTMQswCQYDVQQI
+DAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQKDCVDZXJ0aWZp
+Y2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQLDBlYNTA5IFZl
+cmlmaWNhdGlvbiBDaGVja2VyMSIwIAYDVQQDDBl3d3cudGxzLnRlc3QuaW52YWxp
+ZC50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMIGfMA0GCSqG
+SIb3DQEBAQUAA4GNADCBiQKBgQDZ+EVqAyuE6lRwlLSh/oJusIiZc6WKasK6jGpf
+WgOU+f/rPDR3SqysRIicKxVEu4bpK9d+QGWwUIwI9bGtVlOSKeRMgFPPYOcndLW2
+tKvRQ5L/f7py/fk+n58JsHvXVFTG9CB2+qgzrsct+sRt5AUDyl0tJkiVkhDHPYhQ
+W+N0/wIDAQABoxgwFjAUBgNVHREBAf8ECjAIggYqLnRlc3QwDQYJKoZIhvcNAQEF
+BQADgYEARfFHSnKF+AtJ5G5mNPQYOylDYpDu3Vypcv7uSpYkpguGaMsjAda3/TI0
+S4HlFBBE/TAx9v+HF0jfXq/rVlgzhwlA/WWru/ByCJOQLZYwQKvia0lUI/g3N5DF
+/Xfw484O1oqhObq1vFcH1Nf9xCxAi/Nt8rooc14lxG7RyLGdLlM=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDFDCCAn2gAwIBAgICA+kwDQYJKoZIhvcNAQEFBQAwgcQxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUw
+OS50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMB4XDTE1MTAy
+MDE2MDM1OFoXDTE2MTAyMTE2MDM1OFowgcQxCzAJBgNVBAYTAlVTMQswCQYDVQQI
+DAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQKDCVDZXJ0aWZp
+Y2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQLDBlYNTA5IFZl
+cmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUwOS50ZXN0MR8w
+HQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMIGfMA0GCSqGSIb3DQEBAQUA
+A4GNADCBiQKBgQDI2TejJ3VtoPlkcjQsqbaiMRCtLGdIN7Ful9z7PWU7AVbuJZxD
+QCeFuFmYsCpBgZD3Rw8JaNfMZLKG3D/peIQ/Hjc44BsFR8H9oa0bIDkZN3kS9O80
+vU4urBwTwt9AFDvGPD4UiFulXsAAHDA4KoBg03R56bm2B+8y2JKiGEQ92QIDAQAB
+oxMwETAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBBQUAA4GBALqNB/JaqkTX
+slppJEaBHTY5/bGGWwV/0t3WMDNFaMrFgcsEY/KjUSyfWh9c6BHOdr21MmNe4YDh
+T8gv9TmcGNsEJRIYD1jly3tCDyA2W0AUIzob1GMGkV8ddKBUrmt/+qLzagxdOrQ0
+dRcxFarWaAJVGhJ+p6kWJt7XJnK341bP
+-----END CERTIFICATE-----
diff --git a/src/tests/data/x509test/InvalidWildcardMid.pem b/src/tests/data/x509test/InvalidWildcardMid.pem
new file mode 100644
index 000000000..11a9547d1
--- /dev/null
+++ b/src/tests/data/x509test/InvalidWildcardMid.pem
@@ -0,0 +1,37 @@
+-----BEGIN CERTIFICATE-----
+MIIC+TCCAmKgAwIBAgICBYkwDQYJKoZIhvcNAQEFBQAwgcQxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUw
+OS50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMB4XDTE1MTAy
+MDE2MjAyOFoXDTE2MTAyMTE2MjAyOFowgb4xCzAJBgNVBAYTAlVTMQswCQYDVQQI
+DAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQKDCVDZXJ0aWZp
+Y2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQLDBlYNTA5IFZl
+cmlmaWNhdGlvbiBDaGVja2VyMRMwEQYDVQQDDAp3d3cuKi50ZXN0MR8wHQYJKoZI
+hvcNAQkBFhBzb21lb25lQG1haWwuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCB
+iQKBgQDLn7fPepflQP2HYMoNIzWj3nCkYsjY2PLee4hNKwjAtaN5d7VB+KSwTExT
+sIR879bhnhrsAarBCgdsfC4X1kgFVy+TPQBjWVbUCyUnxX8+1iDLODSUkusxiDXj
+a3WSxb/Y0WLfC5NMFhp8DwrDhDba3pyY0gQ64rkTL0RlMW5AswIDAQABMA0GCSqG
+SIb3DQEBBQUAA4GBAK8kfCilBCqNP5WICILa8r6UPfeJRlOXf/tt+AUbfdYo1w4/
+iyszJwc6ris8aIbEpdeCjo7iDDloRT/D3vCfBGcy6l0IKPziZOpKN4ytyHYjelRv
+QVNPfBFZ/Zy+jDAYAx+50ntkcB9NyOPOYNZXLaG3GAY++lMQJrH0bSwQFFtw
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDFDCCAn2gAwIBAgICA+kwDQYJKoZIhvcNAQEFBQAwgcQxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUw
+OS50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMB4XDTE1MTAy
+MDE2MDM1OFoXDTE2MTAyMTE2MDM1OFowgcQxCzAJBgNVBAYTAlVTMQswCQYDVQQI
+DAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQKDCVDZXJ0aWZp
+Y2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQLDBlYNTA5IFZl
+cmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUwOS50ZXN0MR8w
+HQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMIGfMA0GCSqGSIb3DQEBAQUA
+A4GNADCBiQKBgQDI2TejJ3VtoPlkcjQsqbaiMRCtLGdIN7Ful9z7PWU7AVbuJZxD
+QCeFuFmYsCpBgZD3Rw8JaNfMZLKG3D/peIQ/Hjc44BsFR8H9oa0bIDkZN3kS9O80
+vU4urBwTwt9AFDvGPD4UiFulXsAAHDA4KoBg03R56bm2B+8y2JKiGEQ92QIDAQAB
+oxMwETAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBBQUAA4GBALqNB/JaqkTX
+slppJEaBHTY5/bGGWwV/0t3WMDNFaMrFgcsEY/KjUSyfWh9c6BHOdr21MmNe4YDh
+T8gv9TmcGNsEJRIYD1jly3tCDyA2W0AUIzob1GMGkV8ddKBUrmt/+qLzagxdOrQ0
+dRcxFarWaAJVGhJ+p6kWJt7XJnK341bP
+-----END CERTIFICATE-----
diff --git a/src/tests/data/x509test/InvalidWildcardMidAltName.pem b/src/tests/data/x509test/InvalidWildcardMidAltName.pem
new file mode 100644
index 000000000..d4a7e0b03
--- /dev/null
+++ b/src/tests/data/x509test/InvalidWildcardMidAltName.pem
@@ -0,0 +1,38 @@
+-----BEGIN CERTIFICATE-----
+MIIDJjCCAo+gAwIBAgICBYwwDQYJKoZIhvcNAQEFBQAwgcQxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUw
+OS50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMB4XDTE1MTAy
+MDE2MjAyOFoXDTE2MTAyMTE2MjAyOFowgc0xCzAJBgNVBAYTAlVTMQswCQYDVQQI
+DAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQKDCVDZXJ0aWZp
+Y2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQLDBlYNTA5IFZl
+cmlmaWNhdGlvbiBDaGVja2VyMSIwIAYDVQQDDBl3d3cudGxzLnRlc3QuaW52YWxp
+ZC50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMIGfMA0GCSqG
+SIb3DQEBAQUAA4GNADCBiQKBgQCpu+Fwy+cvq04SskVQAQL9ID9QLmipmH/y27Kk
+LKbB7gXUedxMEbJLE5vvaWvVtYO3taAVsuQh6aNt7b8cXSjzXzN9GIE7rVxOSr5b
+3Lc9cqq2B7Jhp9HF/viAMAVvjDWR/MPOkQV0A9tlY640B1yXhwQCCSqI+bvZNgof
+No+z3QIDAQABoxwwGjAYBgNVHREBAf8EDjAMggp3d3cuKi50ZXN0MA0GCSqGSIb3
+DQEBBQUAA4GBAEKuXokalBre/8OU43XtOoKpFGY6AG80tgNW1+Uf2Yoi7b/uxmCQ
+E6TyWpWwcEM6BiZskbiZE/cUKcbZcDrhvgLngj3oLrAIQRuAK1wsJngJaNjsT2vt
+KBznbSr7QYiO5tjrmVhuMZN5Yie9LaZ1fUmqPf7jYH1KeVs4uHPWmOzD
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDFDCCAn2gAwIBAgICA+kwDQYJKoZIhvcNAQEFBQAwgcQxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUw
+OS50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMB4XDTE1MTAy
+MDE2MDM1OFoXDTE2MTAyMTE2MDM1OFowgcQxCzAJBgNVBAYTAlVTMQswCQYDVQQI
+DAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQKDCVDZXJ0aWZp
+Y2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQLDBlYNTA5IFZl
+cmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUwOS50ZXN0MR8w
+HQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMIGfMA0GCSqGSIb3DQEBAQUA
+A4GNADCBiQKBgQDI2TejJ3VtoPlkcjQsqbaiMRCtLGdIN7Ful9z7PWU7AVbuJZxD
+QCeFuFmYsCpBgZD3Rw8JaNfMZLKG3D/peIQ/Hjc44BsFR8H9oa0bIDkZN3kS9O80
+vU4urBwTwt9AFDvGPD4UiFulXsAAHDA4KoBg03R56bm2B+8y2JKiGEQ92QIDAQAB
+oxMwETAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBBQUAA4GBALqNB/JaqkTX
+slppJEaBHTY5/bGGWwV/0t3WMDNFaMrFgcsEY/KjUSyfWh9c6BHOdr21MmNe4YDh
+T8gv9TmcGNsEJRIYD1jly3tCDyA2W0AUIzob1GMGkV8ddKBUrmt/+qLzagxdOrQ0
+dRcxFarWaAJVGhJ+p6kWJt7XJnK341bP
+-----END CERTIFICATE-----
diff --git a/src/tests/data/x509test/InvalidWildcardMidMixed.pem b/src/tests/data/x509test/InvalidWildcardMidMixed.pem
new file mode 100644
index 000000000..82c554554
--- /dev/null
+++ b/src/tests/data/x509test/InvalidWildcardMidMixed.pem
@@ -0,0 +1,37 @@
+-----BEGIN CERTIFICATE-----
+MIIC+jCCAmOgAwIBAgICBY0wDQYJKoZIhvcNAQEFBQAwgcQxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUw
+OS50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMB4XDTE1MTAy
+MDE2MjAyOFoXDTE2MTAyMTE2MjAyOFowgb8xCzAJBgNVBAYTAlVTMQswCQYDVQQI
+DAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQKDCVDZXJ0aWZp
+Y2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQLDBlYNTA5IFZl
+cmlmaWNhdGlvbiBDaGVja2VyMRQwEgYDVQQDDAt3d3cuKnMudGVzdDEfMB0GCSqG
+SIb3DQEJARYQc29tZW9uZUBtYWlsLmNvbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAw
+gYkCgYEA12d3pW20ggJr+ql15wOx4qrbMXx4Y5ajC39DSOs7ZHpSUadvzuO/84nc
+TDCBgDk1YcVkmMezp2lBd+VIgppQ6I841XXKWEpqIg/AOMmBgt8BfWtHJ6TtXgU3
+tbAncg5bVCHFV5c5m5el1Ovg8dseqP4HK3AQxDZDfFgZ5vUDobsCAwEAATANBgkq
+hkiG9w0BAQUFAAOBgQCMxsaEoGm9uPf1hOmgLErI9+nwxUsGJoRr1fRlO0uGF+nu
+Ek8bT3rPlb+Kzr0x+qqOQqczs2+DTGuayiTdeJHWTrJInByJREdHJ4nEDDuW6WqX
+TlQ/EK1QIyytuvPPGD2m+YQiADL8UI7SwlYAm7R/dKZFdww19fESVklOi9NEDQ==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDFDCCAn2gAwIBAgICA+kwDQYJKoZIhvcNAQEFBQAwgcQxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUw
+OS50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMB4XDTE1MTAy
+MDE2MDM1OFoXDTE2MTAyMTE2MDM1OFowgcQxCzAJBgNVBAYTAlVTMQswCQYDVQQI
+DAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQKDCVDZXJ0aWZp
+Y2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQLDBlYNTA5IFZl
+cmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUwOS50ZXN0MR8w
+HQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMIGfMA0GCSqGSIb3DQEBAQUA
+A4GNADCBiQKBgQDI2TejJ3VtoPlkcjQsqbaiMRCtLGdIN7Ful9z7PWU7AVbuJZxD
+QCeFuFmYsCpBgZD3Rw8JaNfMZLKG3D/peIQ/Hjc44BsFR8H9oa0bIDkZN3kS9O80
+vU4urBwTwt9AFDvGPD4UiFulXsAAHDA4KoBg03R56bm2B+8y2JKiGEQ92QIDAQAB
+oxMwETAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBBQUAA4GBALqNB/JaqkTX
+slppJEaBHTY5/bGGWwV/0t3WMDNFaMrFgcsEY/KjUSyfWh9c6BHOdr21MmNe4YDh
+T8gv9TmcGNsEJRIYD1jly3tCDyA2W0AUIzob1GMGkV8ddKBUrmt/+qLzagxdOrQ0
+dRcxFarWaAJVGhJ+p6kWJt7XJnK341bP
+-----END CERTIFICATE-----
diff --git a/src/tests/data/x509test/InvalidWildcardMidMixedAltName.pem b/src/tests/data/x509test/InvalidWildcardMidMixedAltName.pem
new file mode 100644
index 000000000..3e3c4fdd8
--- /dev/null
+++ b/src/tests/data/x509test/InvalidWildcardMidMixedAltName.pem
@@ -0,0 +1,38 @@
+-----BEGIN CERTIFICATE-----
+MIIDJzCCApCgAwIBAgICBZAwDQYJKoZIhvcNAQEFBQAwgcQxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUw
+OS50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMB4XDTE1MTAy
+MDE2MjAyOFoXDTE2MTAyMTE2MjAyOFowgc0xCzAJBgNVBAYTAlVTMQswCQYDVQQI
+DAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQKDCVDZXJ0aWZp
+Y2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQLDBlYNTA5IFZl
+cmlmaWNhdGlvbiBDaGVja2VyMSIwIAYDVQQDDBl3d3cudGxzLnRlc3QuaW52YWxp
+ZC50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMIGfMA0GCSqG
+SIb3DQEBAQUAA4GNADCBiQKBgQDAqz51KTTwasFgU6IkK589/dM/hSiuxApyRkcv
+LwFI8XFoF8Kqu7Mi/O+cWfzD5eVJHPN3H6xASSBsVYc3uOgY9pbM80KMUSMovAcI
+YBJ9aTv/uvrKesXhX/BiURbnWj9jkHaWWlnnXSNnw3y6UovI6K//hU/+u8QP7pKY
+DKNS8QIDAQABox0wGzAZBgNVHREBAf8EDzANggt3d3cuKnMudGVzdDANBgkqhkiG
+9w0BAQUFAAOBgQAgMKayhXb38Gbl7q9p+LI5yyV+gPsYQYIsZ1JlAvcrIBrlal/6
++5yGM3ggqmzz86umeQX+pD/Dj5eS0J6NNzAuyuK0Mvq9CI3sXlA5FpptIFumA+NM
+t+nOrqv2uKHeL5+9QLHVpS03b1ecyE6BM54YWwk/8UquuNE2/QEq4/Jq5w==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDFDCCAn2gAwIBAgICA+kwDQYJKoZIhvcNAQEFBQAwgcQxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUw
+OS50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMB4XDTE1MTAy
+MDE2MDM1OFoXDTE2MTAyMTE2MDM1OFowgcQxCzAJBgNVBAYTAlVTMQswCQYDVQQI
+DAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQKDCVDZXJ0aWZp
+Y2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQLDBlYNTA5IFZl
+cmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUwOS50ZXN0MR8w
+HQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMIGfMA0GCSqGSIb3DQEBAQUA
+A4GNADCBiQKBgQDI2TejJ3VtoPlkcjQsqbaiMRCtLGdIN7Ful9z7PWU7AVbuJZxD
+QCeFuFmYsCpBgZD3Rw8JaNfMZLKG3D/peIQ/Hjc44BsFR8H9oa0bIDkZN3kS9O80
+vU4urBwTwt9AFDvGPD4UiFulXsAAHDA4KoBg03R56bm2B+8y2JKiGEQ92QIDAQAB
+oxMwETAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBBQUAA4GBALqNB/JaqkTX
+slppJEaBHTY5/bGGWwV/0t3WMDNFaMrFgcsEY/KjUSyfWh9c6BHOdr21MmNe4YDh
+T8gv9TmcGNsEJRIYD1jly3tCDyA2W0AUIzob1GMGkV8ddKBUrmt/+qLzagxdOrQ0
+dRcxFarWaAJVGhJ+p6kWJt7XJnK341bP
+-----END CERTIFICATE-----
diff --git a/src/tests/data/x509test/InvalidWildcardSingle.pem b/src/tests/data/x509test/InvalidWildcardSingle.pem
new file mode 100644
index 000000000..ef6992c09
--- /dev/null
+++ b/src/tests/data/x509test/InvalidWildcardSingle.pem
@@ -0,0 +1,37 @@
+-----BEGIN CERTIFICATE-----
+MIIC8DCCAlmgAwIBAgICBXwwDQYJKoZIhvcNAQEFBQAwgcQxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUw
+OS50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMB4XDTE1MTAy
+MDE2MjAyOFoXDTE2MTAyMTE2MjAyOFowgbUxCzAJBgNVBAYTAlVTMQswCQYDVQQI
+DAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQKDCVDZXJ0aWZp
+Y2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQLDBlYNTA5IFZl
+cmlmaWNhdGlvbiBDaGVja2VyMQowCAYDVQQDDAEqMR8wHQYJKoZIhvcNAQkBFhBz
+b21lb25lQG1haWwuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDmwWc4
+AgjQxiczSc8sbiZMUpm/NvZ7ncASTpl3H00d7GVF4wBLC25ZKke7cABz4l0SjDx5
+7szbDVAFkkoGcYN0uU1H5KYrvn6T/KZBGDNxTINBSLigzx98fP6KjunVvsKXo0zt
+6ILxJ93GGCvr19aYPfekr3rzqbHSzCjGYMOATQIDAQABMA0GCSqGSIb3DQEBBQUA
+A4GBAGg1BmBeCbAoHM4MqhX4STpUl+fQ+r8Ge+5HpmiCDE+Y14C+MRTVo+HI3/tW
+sY2C0uM565/I/Gt3PdaC+XMvQ3f/h95nyxEgJIF2Hb2UexfY7rhUSyIvSN6QfFE3
+RhUIjIz3ycG5l29nUxefVXDsBm7DJxD6cAl6GAiTt24UPsqs
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDFDCCAn2gAwIBAgICA+kwDQYJKoZIhvcNAQEFBQAwgcQxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUw
+OS50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMB4XDTE1MTAy
+MDE2MDM1OFoXDTE2MTAyMTE2MDM1OFowgcQxCzAJBgNVBAYTAlVTMQswCQYDVQQI
+DAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQKDCVDZXJ0aWZp
+Y2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQLDBlYNTA5IFZl
+cmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUwOS50ZXN0MR8w
+HQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMIGfMA0GCSqGSIb3DQEBAQUA
+A4GNADCBiQKBgQDI2TejJ3VtoPlkcjQsqbaiMRCtLGdIN7Ful9z7PWU7AVbuJZxD
+QCeFuFmYsCpBgZD3Rw8JaNfMZLKG3D/peIQ/Hjc44BsFR8H9oa0bIDkZN3kS9O80
+vU4urBwTwt9AFDvGPD4UiFulXsAAHDA4KoBg03R56bm2B+8y2JKiGEQ92QIDAQAB
+oxMwETAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBBQUAA4GBALqNB/JaqkTX
+slppJEaBHTY5/bGGWwV/0t3WMDNFaMrFgcsEY/KjUSyfWh9c6BHOdr21MmNe4YDh
+T8gv9TmcGNsEJRIYD1jly3tCDyA2W0AUIzob1GMGkV8ddKBUrmt/+qLzagxdOrQ0
+dRcxFarWaAJVGhJ+p6kWJt7XJnK341bP
+-----END CERTIFICATE-----
diff --git a/src/tests/data/x509test/InvalidWildcardSingleAltName.pem b/src/tests/data/x509test/InvalidWildcardSingleAltName.pem
new file mode 100644
index 000000000..2c4157cc5
--- /dev/null
+++ b/src/tests/data/x509test/InvalidWildcardSingleAltName.pem
@@ -0,0 +1,38 @@
+-----BEGIN CERTIFICATE-----
+MIIDHTCCAoagAwIBAgICBX8wDQYJKoZIhvcNAQEFBQAwgcQxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUw
+OS50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMB4XDTE1MTAy
+MDE2MjAyOFoXDTE2MTAyMTE2MjAyOFowgc0xCzAJBgNVBAYTAlVTMQswCQYDVQQI
+DAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQKDCVDZXJ0aWZp
+Y2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQLDBlYNTA5IFZl
+cmlmaWNhdGlvbiBDaGVja2VyMSIwIAYDVQQDDBl3d3cudGxzLnRlc3QuaW52YWxp
+ZC50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMIGfMA0GCSqG
+SIb3DQEBAQUAA4GNADCBiQKBgQDb1MaXH6cTSHnJ6JiXn15cgl1/Y+v3RPpnNwYH
+2kGJYRSxLP0CjZWJxfK5fGngREshLnEFj7Y9oIQnUAuQ11dvKxzQAIGSBTV26uLy
+hWRM6NHlOY/PwjaHqrT5mFcH+UMp5j6tfRbJr56ZXA4lwYAO2wCRsMxg/1g3cbmz
+hNfzwQIDAQABoxMwETAPBgNVHREBAf8EBTADggEqMA0GCSqGSIb3DQEBBQUAA4GB
+ADwFt57Ai8yIE4RXJAixmJOY0uZEwzNsaW193Rvcglr6Pa4MIVaROb5V7srrBmqA
+IroeFaOI+OYsKw4PqPE6py2bpQWBjia16aBAJdCO8tpZi4tOfk8kJAYgeWaH/nXS
+VMnQC8MuVH+FQpJTC/Nx/G0p9YFjHMi8IG1BBQxwmw8a
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDFDCCAn2gAwIBAgICA+kwDQYJKoZIhvcNAQEFBQAwgcQxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUw
+OS50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMB4XDTE1MTAy
+MDE2MDM1OFoXDTE2MTAyMTE2MDM1OFowgcQxCzAJBgNVBAYTAlVTMQswCQYDVQQI
+DAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQKDCVDZXJ0aWZp
+Y2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQLDBlYNTA5IFZl
+cmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUwOS50ZXN0MR8w
+HQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMIGfMA0GCSqGSIb3DQEBAQUA
+A4GNADCBiQKBgQDI2TejJ3VtoPlkcjQsqbaiMRCtLGdIN7Ful9z7PWU7AVbuJZxD
+QCeFuFmYsCpBgZD3Rw8JaNfMZLKG3D/peIQ/Hjc44BsFR8H9oa0bIDkZN3kS9O80
+vU4urBwTwt9AFDvGPD4UiFulXsAAHDA4KoBg03R56bm2B+8y2JKiGEQ92QIDAQAB
+oxMwETAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBBQUAA4GBALqNB/JaqkTX
+slppJEaBHTY5/bGGWwV/0t3WMDNFaMrFgcsEY/KjUSyfWh9c6BHOdr21MmNe4YDh
+T8gv9TmcGNsEJRIYD1jly3tCDyA2W0AUIzob1GMGkV8ddKBUrmt/+qLzagxdOrQ0
+dRcxFarWaAJVGhJ+p6kWJt7XJnK341bP
+-----END CERTIFICATE-----
diff --git a/src/tests/data/x509test/MissingIntCABasicConstraintWithCertSign.pem b/src/tests/data/x509test/MissingIntCABasicConstraintWithCertSign.pem
new file mode 100644
index 000000000..7ed001ef8
--- /dev/null
+++ b/src/tests/data/x509test/MissingIntCABasicConstraintWithCertSign.pem
@@ -0,0 +1,97 @@
+-----BEGIN CERTIFICATE-----
+MIIDADCCAmmgAwIBAgICBW8wDQYJKoZIhvcNAQEFBQAwgckxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMR4wHAYDVQQDDBVpbnQubGV2My5j
+YS5hdXRob3JpdHkxHzAdBgkqhkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wHhcN
+MTUxMDIwMTYyMDI3WhcNMTYxMDIxMTYyMDI3WjCBwDELMAkGA1UEBhMCVVMxCzAJ
+BgNVBAgMAkNBMRgwFgYDVQQHDA9TYW4gTHVpcyBPYmlzcG8xLjAsBgNVBAoMJUNl
+cnRpZmljYXRlIFZhbGlkYXRpb24gYW5kIENvbXBsaWFuY2UxIjAgBgNVBAsMGVg1
+MDkgVmVyaWZpY2F0aW9uIENoZWNrZXIxFTATBgNVBAMMDHd3dy50bHMudGVzdDEf
+MB0GCSqGSIb3DQEJARYQc29tZW9uZUBtYWlsLmNvbTCBnzANBgkqhkiG9w0BAQEF
+AAOBjQAwgYkCgYEA34jzzg8Xh2qmEg91TRs8g/BZ6JevyLY6Sw8j0fDA60GIdrXo
+kB5RA9Y4yrvxq4QwkDOP7ytx8TFBUKLxpThyiNNH1vcCNwsHhZe7ocvcMvNDZfPf
+cfcKHrGtQ27LWpE0swfE6eeRvZi9rvREUnmCq6lSfNQv+SokgA82Ofpe3PMCAwEA
+ATANBgkqhkiG9w0BAQUFAAOBgQB97v2tb0rxPu7GshfSG77t0wub+/3eCWGsW2tp
+3aVL04S6DZinZh3AHuzQ1oFBVLwVfD1QAsy1+mY21Xsvy7YMKfaHXnjik9vKRjLs
+hPuXjM0mMguSGYw6dL+X2K9Z5nqU0oppzlhcKY1BCx/mNAdPGzPrU70gSymCxBfM
+aBCuTg==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDLjCCApegAwIBAgICBW4wDQYJKoZIhvcNAQEFBQAwgckxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMR4wHAYDVQQDDBVpbnQubGV2Mi5j
+YS5hdXRob3JpdHkxHzAdBgkqhkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wHhcN
+MTUxMDIwMTYyMDI3WhcNMTYxMDIxMTYyMDI3WjCByTELMAkGA1UEBhMCVVMxCzAJ
+BgNVBAgMAkNBMRgwFgYDVQQHDA9TYW4gTHVpcyBPYmlzcG8xLjAsBgNVBAoMJUNl
+cnRpZmljYXRlIFZhbGlkYXRpb24gYW5kIENvbXBsaWFuY2UxIjAgBgNVBAsMGVg1
+MDkgVmVyaWZpY2F0aW9uIENoZWNrZXIxHjAcBgNVBAMMFWludC5sZXYzLmNhLmF1
+dGhvcml0eTEfMB0GCSqGSIb3DQEJARYQc29tZW9uZUBtYWlsLmNvbTCBnzANBgkq
+hkiG9w0BAQEFAAOBjQAwgYkCgYEAk7UWIs2Bjbt0W5AmVRuVOh7SaU749Ss8uLms
+3ktkDHdG+G5rBaeqbFmIFxuO7asU6SoioEqDQSNJbZl6awnvdI/3ZmdyqGocWrfm
+6HHH+AmvYbQBlOh3eybIwJiywSC6GdjDJH+I6gxzLQPItOarjHc8C74AqWLeq730
+MAe7glkCAwEAAaMjMCEwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYw
+DQYJKoZIhvcNAQEFBQADgYEAc4B5EUesuaruiUuRyzUh4GoYbEP+t1lga+SYtq4l
+sxcO+9YZSlle9zb7jU5Ykv5BEOtnyL0961zLEv/sLgtOjFwr5inJi2a3a/P3bsV7
+TNQAH3KNI29q/Qm/+A6XaMk/q2aXmQPraIA3s8NsQFOGeIQ4nz9zTyiOKjPQgwHT
+b3A=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDLjCCApegAwIBAgICBW0wDQYJKoZIhvcNAQEFBQAwgckxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMR4wHAYDVQQDDBVpbnQubGV2MS5j
+YS5hdXRob3JpdHkxHzAdBgkqhkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wHhcN
+MTUxMDIwMTYyMDI3WhcNMTYxMDIxMTYyMDI3WjCByTELMAkGA1UEBhMCVVMxCzAJ
+BgNVBAgMAkNBMRgwFgYDVQQHDA9TYW4gTHVpcyBPYmlzcG8xLjAsBgNVBAoMJUNl
+cnRpZmljYXRlIFZhbGlkYXRpb24gYW5kIENvbXBsaWFuY2UxIjAgBgNVBAsMGVg1
+MDkgVmVyaWZpY2F0aW9uIENoZWNrZXIxHjAcBgNVBAMMFWludC5sZXYyLmNhLmF1
+dGhvcml0eTEfMB0GCSqGSIb3DQEJARYQc29tZW9uZUBtYWlsLmNvbTCBnzANBgkq
+hkiG9w0BAQEFAAOBjQAwgYkCgYEAw3sX/u/yrRj1IiYRe3q8cid1nocGUlgtpTj4
+II/YlaJ84coohPwDKQ/+Q4ZOHfevU9xabeP94vm+UiOoIyFPJfJI/3muapxsWmQi
+F5Ia1kZSLci6x8eE4LPUgB16aCqCH1XgeXPTFmkAKYjGXxpc5SeqTrF4MOLwrUkk
+mwZSapkCAwEAAaMjMCEwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYw
+DQYJKoZIhvcNAQEFBQADgYEAE18x27W7wxwLtR32oBtaPCsR53EW5/cVQzcalZvX
+yGPgyv20TPbgE1lqW1PiXJG875uPqWU+97UyV97VTKBqdHsIHV7HCXSoFZnlnd1z
+mBkZcl3n1/ba2y2imtHMDlQXCf7GLkzRmj6aVjN2Q0aPeC9t+y0kXtAJajaWKFbk
+hZw=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDGDCCAoGgAwIBAgICBWwwDQYJKoZIhvcNAQEFBQAwgcQxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUw
+OS50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMB4XDTE1MTAy
+MDE2MjAyN1oXDTE2MTAyMTE2MjAyN1owgckxCzAJBgNVBAYTAlVTMQswCQYDVQQI
+DAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQKDCVDZXJ0aWZp
+Y2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQLDBlYNTA5IFZl
+cmlmaWNhdGlvbiBDaGVja2VyMR4wHAYDVQQDDBVpbnQubGV2MS5jYS5hdXRob3Jp
+dHkxHzAdBgkqhkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wgZ8wDQYJKoZIhvcN
+AQEBBQADgY0AMIGJAoGBAL01za7b2MBCkDvSwc2SF6opdd80MnZ7dZWqQzRboXVz
+NLdxh833kQ3Mml8Kkc2s7YJ5qstqHQ5M9Suo/s0QYOSU5wbb1ssWo/mLeAuS5Dr1
+/tfsgvBM1lDvjXITVxKkb0DF8iTsgDsj/PnSvMK84nVOGEIOYoP/imG3x6GRc/EB
+AgMBAAGjEjAQMA4GA1UdDwEB/wQEAwIBBjANBgkqhkiG9w0BAQUFAAOBgQCJ/MJn
+xUsQhyGZxbWRdY2VnLOn90Aky3oTdHYVEkhFDUjS1ZmyOduAypHa9+QKTO16eDP6
+MhrVh/hU8W/4/QThYa4z5lLw47UUSgQcXr8C0311TAEPSTnV+ZpOu0fFjfMv73c/
+qXVFe68hM3ndXiJOJ16L93v5T9UiOYKK7M8wMw==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDFDCCAn2gAwIBAgICA+kwDQYJKoZIhvcNAQEFBQAwgcQxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUw
+OS50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMB4XDTE1MTAy
+MDE2MDM1OFoXDTE2MTAyMTE2MDM1OFowgcQxCzAJBgNVBAYTAlVTMQswCQYDVQQI
+DAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQKDCVDZXJ0aWZp
+Y2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQLDBlYNTA5IFZl
+cmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUwOS50ZXN0MR8w
+HQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMIGfMA0GCSqGSIb3DQEBAQUA
+A4GNADCBiQKBgQDI2TejJ3VtoPlkcjQsqbaiMRCtLGdIN7Ful9z7PWU7AVbuJZxD
+QCeFuFmYsCpBgZD3Rw8JaNfMZLKG3D/peIQ/Hjc44BsFR8H9oa0bIDkZN3kS9O80
+vU4urBwTwt9AFDvGPD4UiFulXsAAHDA4KoBg03R56bm2B+8y2JKiGEQ92QIDAQAB
+oxMwETAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBBQUAA4GBALqNB/JaqkTX
+slppJEaBHTY5/bGGWwV/0t3WMDNFaMrFgcsEY/KjUSyfWh9c6BHOdr21MmNe4YDh
+T8gv9TmcGNsEJRIYD1jly3tCDyA2W0AUIzob1GMGkV8ddKBUrmt/+qLzagxdOrQ0
+dRcxFarWaAJVGhJ+p6kWJt7XJnK341bP
+-----END CERTIFICATE-----
diff --git a/src/tests/data/x509test/MissingIntCAExtensions.pem b/src/tests/data/x509test/MissingIntCAExtensions.pem
new file mode 100644
index 000000000..ce5d7ca25
--- /dev/null
+++ b/src/tests/data/x509test/MissingIntCAExtensions.pem
@@ -0,0 +1,97 @@
+-----BEGIN CERTIFICATE-----
+MIIDADCCAmmgAwIBAgICBWcwDQYJKoZIhvcNAQEFBQAwgckxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMR4wHAYDVQQDDBVpbnQubGV2My5j
+YS5hdXRob3JpdHkxHzAdBgkqhkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wHhcN
+MTUxMDIwMTYyMDI3WhcNMTYxMDIxMTYyMDI3WjCBwDELMAkGA1UEBhMCVVMxCzAJ
+BgNVBAgMAkNBMRgwFgYDVQQHDA9TYW4gTHVpcyBPYmlzcG8xLjAsBgNVBAoMJUNl
+cnRpZmljYXRlIFZhbGlkYXRpb24gYW5kIENvbXBsaWFuY2UxIjAgBgNVBAsMGVg1
+MDkgVmVyaWZpY2F0aW9uIENoZWNrZXIxFTATBgNVBAMMDHd3dy50bHMudGVzdDEf
+MB0GCSqGSIb3DQEJARYQc29tZW9uZUBtYWlsLmNvbTCBnzANBgkqhkiG9w0BAQEF
+AAOBjQAwgYkCgYEA11PHrH3zRiw4nwdy3CV8KR0vmJwxLa3k35YuzN49LMyQyeKa
+sYfAX3IQky92z8htlWEyejznIJ60sBPJjfPP6vErjPxvJ9vMtHyj8rSzJMe6E2RU
+Hpo3UXYdYCLm5xUKx6BhUJU2/u7v6gIddXNx7zZa8YibCdOz2gt9t1qnVmkCAwEA
+ATANBgkqhkiG9w0BAQUFAAOBgQBbZA9K2xUGOU9ng1QyCdYFN6hvQeaDmt1hMS57
+SLn0vUlJeq6RN9uT94tbNozYE04/aLsRQkXA2f4i2nyYubl7vNPW56TgvjJmXDbd
+tNlGm91gLYvPQ87/S6BOlqNeNGzv7fky3LIeoQAXKT8+HkwQOODujrR93hdT7S90
+jjuHHQ==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDLjCCApegAwIBAgICBWYwDQYJKoZIhvcNAQEFBQAwgckxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMR4wHAYDVQQDDBVpbnQubGV2Mi5j
+YS5hdXRob3JpdHkxHzAdBgkqhkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wHhcN
+MTUxMDIwMTYyMDI3WhcNMTYxMDIxMTYyMDI3WjCByTELMAkGA1UEBhMCVVMxCzAJ
+BgNVBAgMAkNBMRgwFgYDVQQHDA9TYW4gTHVpcyBPYmlzcG8xLjAsBgNVBAoMJUNl
+cnRpZmljYXRlIFZhbGlkYXRpb24gYW5kIENvbXBsaWFuY2UxIjAgBgNVBAsMGVg1
+MDkgVmVyaWZpY2F0aW9uIENoZWNrZXIxHjAcBgNVBAMMFWludC5sZXYzLmNhLmF1
+dGhvcml0eTEfMB0GCSqGSIb3DQEJARYQc29tZW9uZUBtYWlsLmNvbTCBnzANBgkq
+hkiG9w0BAQEFAAOBjQAwgYkCgYEAxQo/lGJZhEiNiBpflFrzdQJQwM/qGLNwyYtZ
+/JXrzGssz1IJNwCkJcZM+Ub5MJEK120LD+jMFzQ5nEOxDRbGJl1aI0GvCXtSQiH2
++nT+Ld4jNxEQKgpcnJ2bGRyUpmIQPnrlz/6l0u7uC06C8eEHP6ruIHMaOyw0A0+l
+eUmDiXsCAwEAAaMjMCEwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYw
+DQYJKoZIhvcNAQEFBQADgYEAhvk31fgBPTTwnz4opQFEqkP3yw9/3dG6a7J6e8F+
+x0tulAr3IMyIQbNwlaey+OOqdayTWmT2wK/k1JYa7SNVWtWw+kqAjh8KcXEmmwOc
+Ygr2RmPIBJD6awEQ+vq8HdgusHtT3qjs0DoNV7P9nx9U5512WXi9qy1CnDh9D+ZE
+mWc=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDLjCCApegAwIBAgICBWUwDQYJKoZIhvcNAQEFBQAwgckxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMR4wHAYDVQQDDBVpbnQubGV2MS5j
+YS5hdXRob3JpdHkxHzAdBgkqhkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wHhcN
+MTUxMDIwMTYyMDI3WhcNMTYxMDIxMTYyMDI3WjCByTELMAkGA1UEBhMCVVMxCzAJ
+BgNVBAgMAkNBMRgwFgYDVQQHDA9TYW4gTHVpcyBPYmlzcG8xLjAsBgNVBAoMJUNl
+cnRpZmljYXRlIFZhbGlkYXRpb24gYW5kIENvbXBsaWFuY2UxIjAgBgNVBAsMGVg1
+MDkgVmVyaWZpY2F0aW9uIENoZWNrZXIxHjAcBgNVBAMMFWludC5sZXYyLmNhLmF1
+dGhvcml0eTEfMB0GCSqGSIb3DQEJARYQc29tZW9uZUBtYWlsLmNvbTCBnzANBgkq
+hkiG9w0BAQEFAAOBjQAwgYkCgYEAulbTAYuMCmjCPJLCKT0If1fDL8e+t6YQrWmm
+fLrW1qx8M2jUCSoiyxKieWStxc6IDrP2sRHDtEPN0tqFO7msQpF/3ldCJxh9Kyfg
+uafSpr3aItwqa1oxhmR2+vbLkvjWUAw1BIVuyhpNRBDjvJ263t+75PfwqeKUahIt
+h8bIcDMCAwEAAaMjMCEwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYw
+DQYJKoZIhvcNAQEFBQADgYEAWkhX69giEWoSz7/jaGYoFPMYHRIW0udxRhohjtno
+2ToCrbDO+sJQXxymc4Tl4tqXFiaQzD/+wH+WrRp78VRawFVnTUtFPVlCNXgGYVBS
+rrYzr9iuveC/YISowDwYf0GmZvhVxa6/62U+g7LwNb6MQum9WbYj8K0zeW/0KWYV
+fak=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDBDCCAm2gAwIBAgICBWQwDQYJKoZIhvcNAQEFBQAwgcQxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUw
+OS50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMB4XDTE1MTAy
+MDE2MjAyN1oXDTE2MTAyMTE2MjAyN1owgckxCzAJBgNVBAYTAlVTMQswCQYDVQQI
+DAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQKDCVDZXJ0aWZp
+Y2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQLDBlYNTA5IFZl
+cmlmaWNhdGlvbiBDaGVja2VyMR4wHAYDVQQDDBVpbnQubGV2MS5jYS5hdXRob3Jp
+dHkxHzAdBgkqhkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wgZ8wDQYJKoZIhvcN
+AQEBBQADgY0AMIGJAoGBAKqNdXfgN8FRHOohmOpzAgqv3Pb+rp0J4uTRCEzHoq1e
+WPE1jYFGwjOJ9IRExWJfsgHMpapchWypkMUTK5XLZn14EvY7+9M3zH3MN5sxTvES
+TQBYstlzV7LtfFXebzZCx4A490e4Q7G1OGGu3KqTzF/TdkNPpUQBymFpL3nE/anL
+AgMBAAEwDQYJKoZIhvcNAQEFBQADgYEAVoILkySxthWJZ7jz2tviJeSQdKhS/fvU
+iOPcxKPAFbzvSID2xzTgC/9ZiDVEOZd6/4ohZpS1Ow1PaCuheC6WZBCNCdeY311h
+BbfnQ0Wf9VbFs/UJjalOo8ygwAkV1Vg/DfTjpk0FuCTb1u77uuGZXJCo8ThO7b/y
+pv+LN+S9LFc=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDFDCCAn2gAwIBAgICA+kwDQYJKoZIhvcNAQEFBQAwgcQxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUw
+OS50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMB4XDTE1MTAy
+MDE2MDM1OFoXDTE2MTAyMTE2MDM1OFowgcQxCzAJBgNVBAYTAlVTMQswCQYDVQQI
+DAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQKDCVDZXJ0aWZp
+Y2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQLDBlYNTA5IFZl
+cmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUwOS50ZXN0MR8w
+HQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMIGfMA0GCSqGSIb3DQEBAQUA
+A4GNADCBiQKBgQDI2TejJ3VtoPlkcjQsqbaiMRCtLGdIN7Ful9z7PWU7AVbuJZxD
+QCeFuFmYsCpBgZD3Rw8JaNfMZLKG3D/peIQ/Hjc44BsFR8H9oa0bIDkZN3kS9O80
+vU4urBwTwt9AFDvGPD4UiFulXsAAHDA4KoBg03R56bm2B+8y2JKiGEQ92QIDAQAB
+oxMwETAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBBQUAA4GBALqNB/JaqkTX
+slppJEaBHTY5/bGGWwV/0t3WMDNFaMrFgcsEY/KjUSyfWh9c6BHOdr21MmNe4YDh
+T8gv9TmcGNsEJRIYD1jly3tCDyA2W0AUIzob1GMGkV8ddKBUrmt/+qLzagxdOrQ0
+dRcxFarWaAJVGhJ+p6kWJt7XJnK341bP
+-----END CERTIFICATE-----
diff --git a/src/tests/data/x509test/ValidAltName.pem b/src/tests/data/x509test/ValidAltName.pem
new file mode 100644
index 000000000..5ac372128
--- /dev/null
+++ b/src/tests/data/x509test/ValidAltName.pem
@@ -0,0 +1,38 @@
+-----BEGIN CERTIFICATE-----
+MIIDKDCCApGgAwIBAgICBX4wDQYJKoZIhvcNAQEFBQAwgcQxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUw
+OS50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMB4XDTE1MTAy
+MDE2MjAxMFoXDTE2MTAyMTE2MjAxMFowgc0xCzAJBgNVBAYTAlVTMQswCQYDVQQI
+DAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQKDCVDZXJ0aWZp
+Y2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQLDBlYNTA5IFZl
+cmlmaWNhdGlvbiBDaGVja2VyMSIwIAYDVQQDDBl3d3cudGxzLnRlc3QuaW52YWxp
+ZC50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMIGfMA0GCSqG
+SIb3DQEBAQUAA4GNADCBiQKBgQC1DBM8CLNnuNfYnRvo1cU7mEAvazteLQ+RfSGI
+hNEQGMYokUG/1bPs6E730KJnrvqjz/ZN48UPglqa8r5ybTmDEDpR5tR8dcNnWFCp
+fJCx2ewfZujqLFWLlsS3lSEA/NDbe6IOvyo2dauX/VAmKeFnHWJm/H0KPJ50KHR8
+rG+IoQIDAQABox4wHDAaBgNVHREBAf8EEDAOggx3d3cudGxzLnRlc3QwDQYJKoZI
+hvcNAQEFBQADgYEAWjU68nLPJChlJhaRSnAdzz4XB5VmK8vSkw54WwK8HnjmK0jO
+0Novc3HH98Fh06VCFdW/NdbegI/P2xldqJlKP6AVB9Cdr+vecTNZ8P6WrRwBBuJ+
+NrwSm6RiiXxkZn/IcfUqRB1M15igpQvAxxHmjeaLHbX8tUtS6ZnvZGcVtuo=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDFDCCAn2gAwIBAgICA+kwDQYJKoZIhvcNAQEFBQAwgcQxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUw
+OS50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMB4XDTE1MTAy
+MDE2MDM1OFoXDTE2MTAyMTE2MDM1OFowgcQxCzAJBgNVBAYTAlVTMQswCQYDVQQI
+DAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQKDCVDZXJ0aWZp
+Y2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQLDBlYNTA5IFZl
+cmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUwOS50ZXN0MR8w
+HQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMIGfMA0GCSqGSIb3DQEBAQUA
+A4GNADCBiQKBgQDI2TejJ3VtoPlkcjQsqbaiMRCtLGdIN7Ful9z7PWU7AVbuJZxD
+QCeFuFmYsCpBgZD3Rw8JaNfMZLKG3D/peIQ/Hjc44BsFR8H9oa0bIDkZN3kS9O80
+vU4urBwTwt9AFDvGPD4UiFulXsAAHDA4KoBg03R56bm2B+8y2JKiGEQ92QIDAQAB
+oxMwETAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBBQUAA4GBALqNB/JaqkTX
+slppJEaBHTY5/bGGWwV/0t3WMDNFaMrFgcsEY/KjUSyfWh9c6BHOdr21MmNe4YDh
+T8gv9TmcGNsEJRIYD1jly3tCDyA2W0AUIzob1GMGkV8ddKBUrmt/+qLzagxdOrQ0
+dRcxFarWaAJVGhJ+p6kWJt7XJnK341bP
+-----END CERTIFICATE-----
diff --git a/src/tests/data/x509test/ValidCert.pem b/src/tests/data/x509test/ValidCert.pem
new file mode 100644
index 000000000..204789966
--- /dev/null
+++ b/src/tests/data/x509test/ValidCert.pem
@@ -0,0 +1,37 @@
+-----BEGIN CERTIFICATE-----
+MIIC+zCCAmSgAwIBAgICBRUwDQYJKoZIhvcNAQEFBQAwgcQxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUw
+OS50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMB4XDTE1MTAy
+MDE2MjAxMFoXDTE2MTAyMTE2MjAxMFowgcAxCzAJBgNVBAYTAlVTMQswCQYDVQQI
+DAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQKDCVDZXJ0aWZp
+Y2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQLDBlYNTA5IFZl
+cmlmaWNhdGlvbiBDaGVja2VyMRUwEwYDVQQDDAx3d3cudGxzLnRlc3QxHzAdBgkq
+hkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0A
+MIGJAoGBAN6X3nIL0PLqwnjANgHFOCxezp1eg/sfyofyei1Tp3hafq9ZWQn62pyg
+2Aqt0z7SRq4fLKGwyuh1sEhazf5xPgy8L8RGUU+ZRyJAHwQXs15W+sbfphs1liDk
+BLuFgcUCEEZ5HfH8kmH1lYOfgisxgVhALQseUCBUNfGXbkX/xIrHAgMBAAEwDQYJ
+KoZIhvcNAQEFBQADgYEAVpHtniZAAgBrjbV0Kk0IgYyJYY1zCwZ4oiYpl+WeJpE5
+ygClBCwluCfDbFZMBtpV48mYR4f0KfISFy2W5rdOSi2fdo3NlBUUASUuZCBmPS9t
+jy6d1QsK3SCMJa9PV6KR7o6ETbRGoji2HvzlpzGxmh7iN88kFBCjZrYEcuQ+RW0=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDFDCCAn2gAwIBAgICA+kwDQYJKoZIhvcNAQEFBQAwgcQxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUw
+OS50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMB4XDTE1MTAy
+MDE2MDM1OFoXDTE2MTAyMTE2MDM1OFowgcQxCzAJBgNVBAYTAlVTMQswCQYDVQQI
+DAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQKDCVDZXJ0aWZp
+Y2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQLDBlYNTA5IFZl
+cmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUwOS50ZXN0MR8w
+HQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMIGfMA0GCSqGSIb3DQEBAQUA
+A4GNADCBiQKBgQDI2TejJ3VtoPlkcjQsqbaiMRCtLGdIN7Ful9z7PWU7AVbuJZxD
+QCeFuFmYsCpBgZD3Rw8JaNfMZLKG3D/peIQ/Hjc44BsFR8H9oa0bIDkZN3kS9O80
+vU4urBwTwt9AFDvGPD4UiFulXsAAHDA4KoBg03R56bm2B+8y2JKiGEQ92QIDAQAB
+oxMwETAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBBQUAA4GBALqNB/JaqkTX
+slppJEaBHTY5/bGGWwV/0t3WMDNFaMrFgcsEY/KjUSyfWh9c6BHOdr21MmNe4YDh
+T8gv9TmcGNsEJRIYD1jly3tCDyA2W0AUIzob1GMGkV8ddKBUrmt/+qLzagxdOrQ0
+dRcxFarWaAJVGhJ+p6kWJt7XJnK341bP
+-----END CERTIFICATE-----
diff --git a/src/tests/data/x509test/ValidChained.pem b/src/tests/data/x509test/ValidChained.pem
new file mode 100644
index 000000000..a7248de4c
--- /dev/null
+++ b/src/tests/data/x509test/ValidChained.pem
@@ -0,0 +1,97 @@
+-----BEGIN CERTIFICATE-----
+MIIDADCCAmmgAwIBAgICBXcwDQYJKoZIhvcNAQEFBQAwgckxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMR4wHAYDVQQDDBVpbnQubGV2My5j
+YS5hdXRob3JpdHkxHzAdBgkqhkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wHhcN
+MTUxMDIwMTYyMDEwWhcNMTYxMDIxMTYyMDEwWjCBwDELMAkGA1UEBhMCVVMxCzAJ
+BgNVBAgMAkNBMRgwFgYDVQQHDA9TYW4gTHVpcyBPYmlzcG8xLjAsBgNVBAoMJUNl
+cnRpZmljYXRlIFZhbGlkYXRpb24gYW5kIENvbXBsaWFuY2UxIjAgBgNVBAsMGVg1
+MDkgVmVyaWZpY2F0aW9uIENoZWNrZXIxFTATBgNVBAMMDHd3dy50bHMudGVzdDEf
+MB0GCSqGSIb3DQEJARYQc29tZW9uZUBtYWlsLmNvbTCBnzANBgkqhkiG9w0BAQEF
+AAOBjQAwgYkCgYEAwCwNoOZ+rgu7MQ9INb8eGNjlTemzlcR4vKXytUDyX06qG2Qm
+0wt+egqkuVIdfEt6yzhZGVysuqZTbwRu8/YVy7P+m4m2SkXa7qwymS/f3JtBLPtG
+iUBN9DKFXufyn3SOspu/NZ4bpqJEJ9w0LUGf1LTGvdPoNYQnT+XAUfVAkNcCAwEA
+ATANBgkqhkiG9w0BAQUFAAOBgQBw6Mirr+EWa2IMUf17Ae2a/KLdcY9rfltjktyJ
+ZAPZSMHE390Vd4NzC+IwUAAwUMjVyhE/JVzf3fN1xV957ojDbFhRgJbRKDkuYp4D
+D2C761Fh2vMNTnvy3CShzF17ZeauE3xt5EuZaBYhuLqXTmZPzZ8vRZyWPx0g+wlY
+BfC6uQ==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDLjCCApegAwIBAgICBXYwDQYJKoZIhvcNAQEFBQAwgckxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMR4wHAYDVQQDDBVpbnQubGV2Mi5j
+YS5hdXRob3JpdHkxHzAdBgkqhkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wHhcN
+MTUxMDIwMTYyMDEwWhcNMTYxMDIxMTYyMDEwWjCByTELMAkGA1UEBhMCVVMxCzAJ
+BgNVBAgMAkNBMRgwFgYDVQQHDA9TYW4gTHVpcyBPYmlzcG8xLjAsBgNVBAoMJUNl
+cnRpZmljYXRlIFZhbGlkYXRpb24gYW5kIENvbXBsaWFuY2UxIjAgBgNVBAsMGVg1
+MDkgVmVyaWZpY2F0aW9uIENoZWNrZXIxHjAcBgNVBAMMFWludC5sZXYzLmNhLmF1
+dGhvcml0eTEfMB0GCSqGSIb3DQEJARYQc29tZW9uZUBtYWlsLmNvbTCBnzANBgkq
+hkiG9w0BAQEFAAOBjQAwgYkCgYEA3gWLf6PchbaPfsouVbXoPCvt/X5yp5x0Bsfk
+Xvsb+fo1ZHJJkOOWFMx2h6+G4bJSXCE2rvyAlL7gB2Z9zG97I6NlLsPtOCdYyg63
+iuOxbBgzkbqzXYCWJdoYm+WbZfKEBkAYh5Qdh6CnCv8MNbdlAqh15M6whqVmVcbH
++qk9CGsCAwEAAaMjMCEwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYw
+DQYJKoZIhvcNAQEFBQADgYEAj+dfoCHzPGAuPjm0qXy4gF72wg7sK3VibXD7un7A
+5mLgHVaNpOPNBFdXGIfX/ThLzzrMGtDHnnWuK4l76Pawd0e/FEfAaV0eiatGzwZ0
+FCA6Ol4B6fTMXBCKJ6XDvg0ONEBzfkJ3JX+6mHIPA18re0kDOPZBCIFNb3lCf1TD
+464=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDLjCCApegAwIBAgICBXUwDQYJKoZIhvcNAQEFBQAwgckxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMR4wHAYDVQQDDBVpbnQubGV2MS5j
+YS5hdXRob3JpdHkxHzAdBgkqhkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wHhcN
+MTUxMDIwMTYyMDEwWhcNMTYxMDIxMTYyMDEwWjCByTELMAkGA1UEBhMCVVMxCzAJ
+BgNVBAgMAkNBMRgwFgYDVQQHDA9TYW4gTHVpcyBPYmlzcG8xLjAsBgNVBAoMJUNl
+cnRpZmljYXRlIFZhbGlkYXRpb24gYW5kIENvbXBsaWFuY2UxIjAgBgNVBAsMGVg1
+MDkgVmVyaWZpY2F0aW9uIENoZWNrZXIxHjAcBgNVBAMMFWludC5sZXYyLmNhLmF1
+dGhvcml0eTEfMB0GCSqGSIb3DQEJARYQc29tZW9uZUBtYWlsLmNvbTCBnzANBgkq
+hkiG9w0BAQEFAAOBjQAwgYkCgYEAtnqePBelZGBjlAsrTnGAOcFdXaS6WdgFp1Ct
+SnhmpKvFlsoSDaKBT/dBp5aghAoaj/cECi1cE+ngrOjM+PQgrJpFD2WLFwsRzm7P
+TQPIBbtWjI8oCZnkwfvlAl13wyWeRnm2lrSwgmvmqg4aldsTbR032VCRKtmepyB9
+nh45g/8CAwEAAaMjMCEwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYw
+DQYJKoZIhvcNAQEFBQADgYEAPnEL+w27sXOAKIHemIWed7MSZq0YMrgGGYifoiDR
+0PoGbaG7pvgoFpjHe2B6mfoDwD17rsjjKox2x+vkrsDeBoPa4DiclqUAPuqW4qmg
+OnS4o698ccLkm4arfCuk1y4al86j3h3ZXlvGm2RJZyb1UDXXjRgRCrs5L3cFqHog
+Z0c=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDKTCCApKgAwIBAgICBXQwDQYJKoZIhvcNAQEFBQAwgcQxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUw
+OS50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMB4XDTE1MTAy
+MDE2MjAxMFoXDTE2MTAyMTE2MjAxMFowgckxCzAJBgNVBAYTAlVTMQswCQYDVQQI
+DAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQKDCVDZXJ0aWZp
+Y2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQLDBlYNTA5IFZl
+cmlmaWNhdGlvbiBDaGVja2VyMR4wHAYDVQQDDBVpbnQubGV2MS5jYS5hdXRob3Jp
+dHkxHzAdBgkqhkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wgZ8wDQYJKoZIhvcN
+AQEBBQADgY0AMIGJAoGBANfFYKEzGMbuSThFeCcE3bCK1DABcu/kxLiJK4/dK2Nt
+tfel+Pklt1JAk0vt5o4AtmIH68kSc/IbzYhK/Z9GNcHd5H+T/5jkGKBTDYiwql8v
+Mg1qgJN7jHgxvBMTN2GJRY/QATq9U2LPc1gg8K9xJBwkv2b4OCc3kl6jsxL8h3NB
+AgMBAAGjIzAhMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMA0GCSqG
+SIb3DQEBBQUAA4GBAMBUe+6du56LFJs4kiD9pNCk6WrhseAsebpuT4HuqmmRcz10
+KhsWmEfXOO8qV9KPktHeb7N9IBEJqWVcBhhNFMjgrLWPwVmc+aKK+IPvFTO/Kckr
+j+l+VCVZHrpuJO6ePXMbcZGZIhhmav8kWBEd9eyEm7h9SNazsT2vR30Is9r7
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDFDCCAn2gAwIBAgICA+kwDQYJKoZIhvcNAQEFBQAwgcQxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUw
+OS50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMB4XDTE1MTAy
+MDE2MDM1OFoXDTE2MTAyMTE2MDM1OFowgcQxCzAJBgNVBAYTAlVTMQswCQYDVQQI
+DAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQKDCVDZXJ0aWZp
+Y2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQLDBlYNTA5IFZl
+cmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUwOS50ZXN0MR8w
+HQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMIGfMA0GCSqGSIb3DQEBAQUA
+A4GNADCBiQKBgQDI2TejJ3VtoPlkcjQsqbaiMRCtLGdIN7Ful9z7PWU7AVbuJZxD
+QCeFuFmYsCpBgZD3Rw8JaNfMZLKG3D/peIQ/Hjc44BsFR8H9oa0bIDkZN3kS9O80
+vU4urBwTwt9AFDvGPD4UiFulXsAAHDA4KoBg03R56bm2B+8y2JKiGEQ92QIDAQAB
+oxMwETAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBBQUAA4GBALqNB/JaqkTX
+slppJEaBHTY5/bGGWwV/0t3WMDNFaMrFgcsEY/KjUSyfWh9c6BHOdr21MmNe4YDh
+T8gv9TmcGNsEJRIYD1jly3tCDyA2W0AUIzob1GMGkV8ddKBUrmt/+qLzagxdOrQ0
+dRcxFarWaAJVGhJ+p6kWJt7XJnK341bP
+-----END CERTIFICATE-----
diff --git a/src/tests/data/x509test/ValidIntCALen.pem b/src/tests/data/x509test/ValidIntCALen.pem
new file mode 100644
index 000000000..68e6cf91c
--- /dev/null
+++ b/src/tests/data/x509test/ValidIntCALen.pem
@@ -0,0 +1,97 @@
+-----BEGIN CERTIFICATE-----
+MIIDADCCAmmgAwIBAgICBVcwDQYJKoZIhvcNAQEFBQAwgckxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMR4wHAYDVQQDDBVpbnQubGV2My5j
+YS5hdXRob3JpdHkxHzAdBgkqhkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wHhcN
+MTUxMDIwMTYyMDI4WhcNMTYxMDIxMTYyMDI4WjCBwDELMAkGA1UEBhMCVVMxCzAJ
+BgNVBAgMAkNBMRgwFgYDVQQHDA9TYW4gTHVpcyBPYmlzcG8xLjAsBgNVBAoMJUNl
+cnRpZmljYXRlIFZhbGlkYXRpb24gYW5kIENvbXBsaWFuY2UxIjAgBgNVBAsMGVg1
+MDkgVmVyaWZpY2F0aW9uIENoZWNrZXIxFTATBgNVBAMMDHd3dy50bHMudGVzdDEf
+MB0GCSqGSIb3DQEJARYQc29tZW9uZUBtYWlsLmNvbTCBnzANBgkqhkiG9w0BAQEF
+AAOBjQAwgYkCgYEA0P2TWIzoFt6EHNAUW4BKtlwWpn/NMaeQqJHTjewzAvQJ5qul
+ZdgaguVAibak5DtnM1XrvJTYDGxdhyQtkFWwgGZS/9VYP6YfX0JspnCPu2jdv1Mv
+Ziii2F3fSkvHGIMMs2dXqWheV4jOpqtztr9blhN2Ed935QoX70I/gjCNFJECAwEA
+ATANBgkqhkiG9w0BAQUFAAOBgQANla2/x6sDwGwtedPSTvUCx+tp5uQoX6AqlpAY
+bv9YWNW97yMV4ZTyfSyppjNf59TFnXcfEDDU3xsoK0thRL8fv+PNmL0lWsL9q7Jj
+XHo8w8sE9d5mOvWqjYcwlBOMksI42Rj2nTwEVbH5GC/w2A9y1eJqqbvEn5xjZFsb
+1HUnPA==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDMTCCApqgAwIBAgICBVYwDQYJKoZIhvcNAQEFBQAwgckxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMR4wHAYDVQQDDBVpbnQubGV2Mi5j
+YS5hdXRob3JpdHkxHzAdBgkqhkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wHhcN
+MTUxMDIwMTYyMDI4WhcNMTYxMDIxMTYyMDI4WjCByTELMAkGA1UEBhMCVVMxCzAJ
+BgNVBAgMAkNBMRgwFgYDVQQHDA9TYW4gTHVpcyBPYmlzcG8xLjAsBgNVBAoMJUNl
+cnRpZmljYXRlIFZhbGlkYXRpb24gYW5kIENvbXBsaWFuY2UxIjAgBgNVBAsMGVg1
+MDkgVmVyaWZpY2F0aW9uIENoZWNrZXIxHjAcBgNVBAMMFWludC5sZXYzLmNhLmF1
+dGhvcml0eTEfMB0GCSqGSIb3DQEJARYQc29tZW9uZUBtYWlsLmNvbTCBnzANBgkq
+hkiG9w0BAQEFAAOBjQAwgYkCgYEAxLsGmdJe0lSVprI7J4xOu+D7iimUDcsM5Mab
+tYkT+IIUep5okqyCyEVhY1pzLQK3pABg2kaBkD5D59wGnavxObry0At1b76dAZ03
+avqUs/y2tLjJfp1TC1m7Jvp1m2ehD+KAo1rItgwyNOqRXPkVJL7nWSHNvDWkvtYF
+10s8cT0CAwEAAaMmMCQwEgYDVR0TAQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMC
+AQYwDQYJKoZIhvcNAQEFBQADgYEAgmz8CDyA1w10yxjIfFAL1dv4imvQncu4CJTy
+iv+jbqoJzYQ24nR85hkVZMCkoTxfp9QQjFoCMGVQO+UwjOOpjcm2B6sEX44nqjTr
+UwBjUbdFnoXu2L3U98IHttE9Rx2969DMTXy7zsDUDSFWnuU9BI4i2wtAnQPDtruj
+jLFeHRs=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDLjCCApegAwIBAgICBVUwDQYJKoZIhvcNAQEFBQAwgckxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMR4wHAYDVQQDDBVpbnQubGV2MS5j
+YS5hdXRob3JpdHkxHzAdBgkqhkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wHhcN
+MTUxMDIwMTYyMDI4WhcNMTYxMDIxMTYyMDI4WjCByTELMAkGA1UEBhMCVVMxCzAJ
+BgNVBAgMAkNBMRgwFgYDVQQHDA9TYW4gTHVpcyBPYmlzcG8xLjAsBgNVBAoMJUNl
+cnRpZmljYXRlIFZhbGlkYXRpb24gYW5kIENvbXBsaWFuY2UxIjAgBgNVBAsMGVg1
+MDkgVmVyaWZpY2F0aW9uIENoZWNrZXIxHjAcBgNVBAMMFWludC5sZXYyLmNhLmF1
+dGhvcml0eTEfMB0GCSqGSIb3DQEJARYQc29tZW9uZUBtYWlsLmNvbTCBnzANBgkq
+hkiG9w0BAQEFAAOBjQAwgYkCgYEA3/Bn96S7g+EduHhDqO1xeHx9KIP7FA2UnLxc
+PeblmR3J5gTk4Twzwus0R4+b6qFJp3WN7CvnuaXsNea6bAG7y09ceNKHqDSByzch
+ZYKGpZcQ7WDn/4rfWKceIV/qhvQ4zdu5sEVBjdkZVhqbyPTu814zPEOLzQMmm2zh
+FhWHEssCAwEAAaMjMCEwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYw
+DQYJKoZIhvcNAQEFBQADgYEAIY5V0/fZq/7iTtq6hKnC+Aa3nGWr5cQC95dzZ+PT
+5XfCgIMr3VSZi0tfmBBVTMBkOUzXBmqK6iOORAPb6Gb+tpEGWM8jgLgTx2835MHW
+ffaByIL0enuAjhPl3Xhuq8VPUzLNQgprml4XaYPYrQidBcMFkqS4Oz44PtxNQ7BM
+B8o=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDLDCCApWgAwIBAgICBVQwDQYJKoZIhvcNAQEFBQAwgcQxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUw
+OS50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMB4XDTE1MTAy
+MDE2MjAyOFoXDTE2MTAyMTE2MjAyOFowgckxCzAJBgNVBAYTAlVTMQswCQYDVQQI
+DAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQKDCVDZXJ0aWZp
+Y2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQLDBlYNTA5IFZl
+cmlmaWNhdGlvbiBDaGVja2VyMR4wHAYDVQQDDBVpbnQubGV2MS5jYS5hdXRob3Jp
+dHkxHzAdBgkqhkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wgZ8wDQYJKoZIhvcN
+AQEBBQADgY0AMIGJAoGBALz4tk1wnzfDW39Lu8fcN4gCoU47RgTiXV/duqvJ36kY
+qyJ7WwlgJGOHOhmLJjpt7WwjDWNRRVS8kPPVfhcZDtMX3IgiaRAEWjij3fpUd6Ai
+tiJrnaLdyXlCS5Wt3sEF2/qazv44x4SEaeHtO69kZC565g6bOyaPIyKVwnMmMKVp
+AgMBAAGjJjAkMBIGA1UdEwEB/wQIMAYBAf8CAQUwDgYDVR0PAQH/BAQDAgEGMA0G
+CSqGSIb3DQEBBQUAA4GBAMaNLpFGlwisXxlMQxRja4FHvdFW2A6jwVH4wJqhSSBQ
+wetgAMaSN28uR+HUC0OWss0L6763fa3hzVVMKEhk1nljGoLyn/Vr1SK1P8KNTyc8
+eGNJwKtAjlooMxD4dJvN/kqN7kkmLRGfPK13mnSlP4X3PBa9fXTzxZi4N3QBb2ph
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDFDCCAn2gAwIBAgICA+kwDQYJKoZIhvcNAQEFBQAwgcQxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUw
+OS50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMB4XDTE1MTAy
+MDE2MDM1OFoXDTE2MTAyMTE2MDM1OFowgcQxCzAJBgNVBAYTAlVTMQswCQYDVQQI
+DAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQKDCVDZXJ0aWZp
+Y2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQLDBlYNTA5IFZl
+cmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUwOS50ZXN0MR8w
+HQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMIGfMA0GCSqGSIb3DQEBAQUA
+A4GNADCBiQKBgQDI2TejJ3VtoPlkcjQsqbaiMRCtLGdIN7Ful9z7PWU7AVbuJZxD
+QCeFuFmYsCpBgZD3Rw8JaNfMZLKG3D/peIQ/Hjc44BsFR8H9oa0bIDkZN3kS9O80
+vU4urBwTwt9AFDvGPD4UiFulXsAAHDA4KoBg03R56bm2B+8y2JKiGEQ92QIDAQAB
+oxMwETAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBBQUAA4GBALqNB/JaqkTX
+slppJEaBHTY5/bGGWwV/0t3WMDNFaMrFgcsEY/KjUSyfWh9c6BHOdr21MmNe4YDh
+T8gv9TmcGNsEJRIYD1jly3tCDyA2W0AUIzob1GMGkV8ddKBUrmt/+qLzagxdOrQ0
+dRcxFarWaAJVGhJ+p6kWJt7XJnK341bP
+-----END CERTIFICATE-----
diff --git a/src/tests/data/x509test/ValidNameConstraint.pem b/src/tests/data/x509test/ValidNameConstraint.pem
new file mode 100644
index 000000000..3085e0cb3
--- /dev/null
+++ b/src/tests/data/x509test/ValidNameConstraint.pem
@@ -0,0 +1,100 @@
+-----BEGIN CERTIFICATE-----
+MIIDHTCCAoagAwIBAgICBZkwDQYJKoZIhvcNAQEFBQAwgckxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMR4wHAYDVQQDDBVpbnQubGV2My5j
+YS5hdXRob3JpdHkxHzAdBgkqhkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wHhcN
+MTUxMDIwMTYyMDEwWhcNMTYxMDIxMTYyMDEwWjCBwDELMAkGA1UEBhMCVVMxCzAJ
+BgNVBAgMAkNBMRgwFgYDVQQHDA9TYW4gTHVpcyBPYmlzcG8xLjAsBgNVBAoMJUNl
+cnRpZmljYXRlIFZhbGlkYXRpb24gYW5kIENvbXBsaWFuY2UxIjAgBgNVBAsMGVg1
+MDkgVmVyaWZpY2F0aW9uIENoZWNrZXIxFTATBgNVBAMMDHd3dy50bHMudGVzdDEf
+MB0GCSqGSIb3DQEJARYQc29tZW9uZUBtYWlsLmNvbTCBnzANBgkqhkiG9w0BAQEF
+AAOBjQAwgYkCgYEA1YOhYZy3JK18g0L2gYiDNqgFAmEa9BkNCZmnGmhceJDxHWs6
+eAaLAkWLf8OiedGOnVMgZ93e98k1OsjI+Naml//ekxEDaxSdz+QrFwk7naZcgoI+
+SrlhdDgNhUC0X1DE8I2IrIQUmxCiEjnPtVwImswL4OlMzxPSM4p698cbdH0CAwEA
+AaMbMBkwFwYDVR0RBBAwDoIMd3d3LnRscy50ZXN0MA0GCSqGSIb3DQEBBQUAA4GB
+AAvL8Gjr/lX6pkBDj+fTJFuhDq27vRQkBc3KtCWPRYO47sbAn7PSj1xjy2qVpf0y
+2+5q8DbopxXNYG52PZw9pxotvLf7h0u8q84ruQosmaUbURhkTJoqY4TYz0hVVhJf
+VkFk0hnh287gMy7501H5HZi4G3B0/Cb965V4zrqaPLYO
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDUDCCArmgAwIBAgICBZgwDQYJKoZIhvcNAQEFBQAwgckxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMR4wHAYDVQQDDBVpbnQubGV2Mi5j
+YS5hdXRob3JpdHkxHzAdBgkqhkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wHhcN
+MTUxMDIwMTYyMDEwWhcNMTYxMDIxMTYyMDEwWjCByTELMAkGA1UEBhMCVVMxCzAJ
+BgNVBAgMAkNBMRgwFgYDVQQHDA9TYW4gTHVpcyBPYmlzcG8xLjAsBgNVBAoMJUNl
+cnRpZmljYXRlIFZhbGlkYXRpb24gYW5kIENvbXBsaWFuY2UxIjAgBgNVBAsMGVg1
+MDkgVmVyaWZpY2F0aW9uIENoZWNrZXIxHjAcBgNVBAMMFWludC5sZXYzLmNhLmF1
+dGhvcml0eTEfMB0GCSqGSIb3DQEJARYQc29tZW9uZUBtYWlsLmNvbTCBnzANBgkq
+hkiG9w0BAQEFAAOBjQAwgYkCgYEA1+JYv4lqbDzFlNIt9Mc3jI0fDxzAHg4Efdn4
+vuBozAiYAnuXdpDf+CgRP/ioIhfgzgmztzmSAchF5VPRG+xc5hSBCwWrp1OPFyj6
+5nX6RxsuU8wlyzNfZOJ4CpwNrFhWvHRGKvDVNaTYOASGRjz8V3uQ56f/7HmdmBoV
+WYz+XiECAwEAAaNFMEMwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYw
+IAYDVR0RBBkwF4IVaW50LmxldjMuY2EuYXV0aG9yaXR5MA0GCSqGSIb3DQEBBQUA
+A4GBAHrocfhfL6JI0SH0aDhvRTyW1gmD9BTSQvDLiW7VF7fCCh0SEKS8rif75ITR
+s/JCnAaSsDickAOCwfOzNxPwwTQupuuwNSZVis0tTy+A3tYrENdLnYjvNfs+qGh2
+OJDbt/vN7V/VXSWwSzDHJSPuU35dygkZwFoCe6CSmxhELZK6
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDfTCCAuagAwIBAgICBZcwDQYJKoZIhvcNAQEFBQAwgckxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMR4wHAYDVQQDDBVpbnQubGV2MS5j
+YS5hdXRob3JpdHkxHzAdBgkqhkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wHhcN
+MTUxMDIwMTYyMDEwWhcNMTYxMDIxMTYyMDEwWjCByTELMAkGA1UEBhMCVVMxCzAJ
+BgNVBAgMAkNBMRgwFgYDVQQHDA9TYW4gTHVpcyBPYmlzcG8xLjAsBgNVBAoMJUNl
+cnRpZmljYXRlIFZhbGlkYXRpb24gYW5kIENvbXBsaWFuY2UxIjAgBgNVBAsMGVg1
+MDkgVmVyaWZpY2F0aW9uIENoZWNrZXIxHjAcBgNVBAMMFWludC5sZXYyLmNhLmF1
+dGhvcml0eTEfMB0GCSqGSIb3DQEJARYQc29tZW9uZUBtYWlsLmNvbTCBnzANBgkq
+hkiG9w0BAQEFAAOBjQAwgYkCgYEAvBAI1Vb+DE+Ls0fMCWeLJK5ih73IjV9GXBp9
+lLPa8U/pFuov0U5XyeMvv6OsGp27z788VApHhxNP98xMBA86oAo7C5YpXLD7c7ez
+nadlmKq3v3z6c1vDbs9UNViZhT8hSBeFhBvHMY2ZJjimR6UMseygppAlB3CxnlvD
+U1ceLXkCAwEAAaNyMHAwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYw
+IAYDVR0RBBkwF4IVaW50LmxldjIuY2EuYXV0aG9yaXR5MCsGA1UdHgEB/wQhMB+h
+HTAbghl3d3cudGxzLnRlc3QuaW52YWxpZC50ZXN0MA0GCSqGSIb3DQEBBQUAA4GB
+ABAHb6ut1XijezhmC+ieQpSeqKcQI9+YacUssH3vyDfgVD5vjDx5jbmr99J5OMGu
+IXJr2NPjsYfe+Jl28XibvSVSF4KE1WUCaD5LmXl7KBkbO+DBbnjZqVK7dO84yQn2
+B7YO4QaXeInTyFkyMyZZItsgpheKfngozrJouQ/Fd4SN
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDdTCCAt6gAwIBAgICBZYwDQYJKoZIhvcNAQEFBQAwgcQxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUw
+OS50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMB4XDTE1MTAy
+MDE2MjAxMFoXDTE2MTAyMTE2MjAxMFowgckxCzAJBgNVBAYTAlVTMQswCQYDVQQI
+DAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQKDCVDZXJ0aWZp
+Y2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQLDBlYNTA5IFZl
+cmlmaWNhdGlvbiBDaGVja2VyMR4wHAYDVQQDDBVpbnQubGV2MS5jYS5hdXRob3Jp
+dHkxHzAdBgkqhkiG9w0BCQEWEHNvbWVvbmVAbWFpbC5jb20wgZ8wDQYJKoZIhvcN
+AQEBBQADgY0AMIGJAoGBAMQCtMsmfgeXju0UpAgnKddgp7Ytaeh9Fe45+nsWUxKt
+UXUumhLqNVYvB3/N91a/Zbye9Vzx25WrBVaxUve23R2u/OtO6/N9shmxMDw93bMA
+P9XJTxzksQ2LbpDx0Evo70DFm6uVqADO1ecqSQ9iv0kOTIVsGmIIxs8O9leJOeJ1
+AgMBAAGjbzBtMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMCAGA1Ud
+EQQZMBeCFWludC5sZXYxLmNhLmF1dGhvcml0eTAoBgNVHR4BAf8EHjAcoBowD4IN
+LmNhLmF1dGhvcml0eTAHggUudGVzdDANBgkqhkiG9w0BAQUFAAOBgQCW+xgaaODO
+NXKsIV+CUbMUmlRVsLWwsi32FLuqbjAyb61G7TPQWQulG2ixpauKlf1NjrBQPDKA
+5T9hUjAHRN2qZZBDqZ2AOr3srRngoLiV9/u4LavKt+vYKvyL5mD4266y7DuoQ0kB
+r6IgVc+mL8seW6f/WPInKQkQnE06bYBO7g==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDFDCCAn2gAwIBAgICA+kwDQYJKoZIhvcNAQEFBQAwgcQxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUw
+OS50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMB4XDTE1MTAy
+MDE2MDM1OFoXDTE2MTAyMTE2MDM1OFowgcQxCzAJBgNVBAYTAlVTMQswCQYDVQQI
+DAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQKDCVDZXJ0aWZp
+Y2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQLDBlYNTA5IFZl
+cmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUwOS50ZXN0MR8w
+HQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMIGfMA0GCSqGSIb3DQEBAQUA
+A4GNADCBiQKBgQDI2TejJ3VtoPlkcjQsqbaiMRCtLGdIN7Ful9z7PWU7AVbuJZxD
+QCeFuFmYsCpBgZD3Rw8JaNfMZLKG3D/peIQ/Hjc44BsFR8H9oa0bIDkZN3kS9O80
+vU4urBwTwt9AFDvGPD4UiFulXsAAHDA4KoBg03R56bm2B+8y2JKiGEQ92QIDAQAB
+oxMwETAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBBQUAA4GBALqNB/JaqkTX
+slppJEaBHTY5/bGGWwV/0t3WMDNFaMrFgcsEY/KjUSyfWh9c6BHOdr21MmNe4YDh
+T8gv9TmcGNsEJRIYD1jly3tCDyA2W0AUIzob1GMGkV8ddKBUrmt/+qLzagxdOrQ0
+dRcxFarWaAJVGhJ+p6kWJt7XJnK341bP
+-----END CERTIFICATE-----
diff --git a/src/tests/data/x509test/ValidWildcard.pem b/src/tests/data/x509test/ValidWildcard.pem
new file mode 100644
index 000000000..80e38c6f4
--- /dev/null
+++ b/src/tests/data/x509test/ValidWildcard.pem
@@ -0,0 +1,37 @@
+-----BEGIN CERTIFICATE-----
+MIIC+TCCAmKgAwIBAgICBZEwDQYJKoZIhvcNAQEFBQAwgcQxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUw
+OS50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMB4XDTE1MTAy
+MDE2MjAxMFoXDTE2MTAyMTE2MjAxMFowgb4xCzAJBgNVBAYTAlVTMQswCQYDVQQI
+DAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQKDCVDZXJ0aWZp
+Y2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQLDBlYNTA5IFZl
+cmlmaWNhdGlvbiBDaGVja2VyMRMwEQYDVQQDDAoqLnRscy50ZXN0MR8wHQYJKoZI
+hvcNAQkBFhBzb21lb25lQG1haWwuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCB
+iQKBgQDht+9MZmL+5loPrHQ0SElrwe1KWiBJ+e7dkoA4ZkP+hsZNr9ls+TSCBelB
+qzJf3v3gIxpG0UJ6/uUZcmz+p/GoQW7CieIueJJ37Y0R9ghaclFHw33tUWsxgKrT
+mzcYS0eOfEEnfMH/XsGPjg5wVROS8nl9XoSXzUiatecMpnwNGwIDAQABMA0GCSqG
+SIb3DQEBBQUAA4GBAER+QBx0LmdzEuGsryG3Id66iA4Q77NF9J2oNsg8BLypGqP4
+qImscj4zPWdryxgfAeneCSy+A0v+tuTeT0yqUq5aWlsiT9nJ3QXOM7dQdk3SWSEg
+/OPU5EcJ9g1BOdET8kYLrnzEoqjf7s+Hb0IkyNN0xDO5Tdbkjjt1sfHsSzYb
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDFDCCAn2gAwIBAgICA+kwDQYJKoZIhvcNAQEFBQAwgcQxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUw
+OS50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMB4XDTE1MTAy
+MDE2MDM1OFoXDTE2MTAyMTE2MDM1OFowgcQxCzAJBgNVBAYTAlVTMQswCQYDVQQI
+DAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQKDCVDZXJ0aWZp
+Y2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQLDBlYNTA5IFZl
+cmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUwOS50ZXN0MR8w
+HQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMIGfMA0GCSqGSIb3DQEBAQUA
+A4GNADCBiQKBgQDI2TejJ3VtoPlkcjQsqbaiMRCtLGdIN7Ful9z7PWU7AVbuJZxD
+QCeFuFmYsCpBgZD3Rw8JaNfMZLKG3D/peIQ/Hjc44BsFR8H9oa0bIDkZN3kS9O80
+vU4urBwTwt9AFDvGPD4UiFulXsAAHDA4KoBg03R56bm2B+8y2JKiGEQ92QIDAQAB
+oxMwETAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBBQUAA4GBALqNB/JaqkTX
+slppJEaBHTY5/bGGWwV/0t3WMDNFaMrFgcsEY/KjUSyfWh9c6BHOdr21MmNe4YDh
+T8gv9TmcGNsEJRIYD1jly3tCDyA2W0AUIzob1GMGkV8ddKBUrmt/+qLzagxdOrQ0
+dRcxFarWaAJVGhJ+p6kWJt7XJnK341bP
+-----END CERTIFICATE-----
diff --git a/src/tests/data/x509test/expected.txt b/src/tests/data/x509test/expected.txt
new file mode 100644
index 000000000..67e2937eb
--- /dev/null
+++ b/src/tests/data/x509test/expected.txt
@@ -0,0 +1,43 @@
+InvalidExtendedKeyUsage.pem:Invalid usage
+InvalidIntCAFlag.pem:CA certificate not allowed to issue certs
+InvalidIntCAKeyUsage.pem:CA certificate not allowed to issue certs
+InvalidIntCALen.pem:Certificate chain too long
+InvalidIntCALoop.pem:Loop in certificate chain
+InvalidIntCASelfSign.pem:Cannot establish trust
+InvalidIntCAVersionOne.pem:CA certificate not allowed to issue certs
+InvalidIntCAVersionTwo.pem:CA certificate not allowed to issue certs
+InvalidKeyUsage.pem:Invalid usage
+InvalidName.pem:Certificate does not match provided name
+InvalidNameAltName.pem:Certificate does not match provided name
+InvalidNameAltNameWithSubj.pem:Certificate does not match provided name
+InvalidNotAfter.pem:Certificate has expired
+InvalidNotAfterChained.pem:Certificate has expired
+InvalidSelfSign.pem:Cannot establish trust
+InvalidWildcardAll.pem:Certificate does not match provided name
+InvalidWildcardAllAltName.pem:Certificate does not match provided name
+InvalidWildcardLeft.pem:Certificate does not match provided name
+InvalidWildcardLeftAltName.pem:Certificate does not match provided name
+InvalidWildcardMid.pem:Certificate does not match provided name
+InvalidWildcardMidAltName.pem:Certificate does not match provided name
+InvalidWildcardMidMixed.pem:Certificate does not match provided name
+InvalidWildcardMidMixedAltName.pem:Certificate does not match provided name
+InvalidWildcardSingle.pem:Certificate does not match provided name
+InvalidWildcardSingleAltName.pem:Certificate does not match provided name
+MissingIntCABasicConstraintWithCertSign.pem:CA certificate not allowed to issue certs
+MissingIntCAExtensions.pem:CA certificate not allowed to issue certs
+ValidAltName.pem:Verified
+ValidCert.pem:Verified
+ValidChained.pem:Verified
+ValidIntCALen.pem:Verified
+ValidWildcard.pem:Verified
+
+# Need to fix date settings in x509test and regen
+#InvalidNotBefore.pem:Certificate is not yet valid
+#InvalidNotBeforeChained.pem:Certificate is not yet valid
+
+# Missing name constraints
+InvalidNameConstraintExclude.pem:Certificate issuer not found
+InvalidNameConstraintPermit.pem:Certificate issuer not found
+InvalidNameConstraintPermitRight.pem:Certificate issuer not found
+InvalidNameConstraintPermitThenExclude.pem:Certificate issuer not found
+ValidNameConstraint.pem:Certificate issuer not found
diff --git a/src/tests/data/x509test/root.pem b/src/tests/data/x509test/root.pem
new file mode 100644
index 000000000..b6b894a04
--- /dev/null
+++ b/src/tests/data/x509test/root.pem
@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDFDCCAn2gAwIBAgICA+kwDQYJKoZIhvcNAQEFBQAwgcQxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQK
+DCVDZXJ0aWZpY2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQL
+DBlYNTA5IFZlcmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUw
+OS50ZXN0MR8wHQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMB4XDTE1MTAy
+MDE2MDM1OFoXDTE2MTAyMTE2MDM1OFowgcQxCzAJBgNVBAYTAlVTMQswCQYDVQQI
+DAJDQTEYMBYGA1UEBwwPU2FuIEx1aXMgT2Jpc3BvMS4wLAYDVQQKDCVDZXJ0aWZp
+Y2F0ZSBWYWxpZGF0aW9uIGFuZCBDb21wbGlhbmNlMSIwIAYDVQQLDBlYNTA5IFZl
+cmlmaWNhdGlvbiBDaGVja2VyMRkwFwYDVQQDDBB2ZXJpZnkueDUwOS50ZXN0MR8w
+HQYJKoZIhvcNAQkBFhBzb21lb25lQG1haWwuY29tMIGfMA0GCSqGSIb3DQEBAQUA
+A4GNADCBiQKBgQDI2TejJ3VtoPlkcjQsqbaiMRCtLGdIN7Ful9z7PWU7AVbuJZxD
+QCeFuFmYsCpBgZD3Rw8JaNfMZLKG3D/peIQ/Hjc44BsFR8H9oa0bIDkZN3kS9O80
+vU4urBwTwt9AFDvGPD4UiFulXsAAHDA4KoBg03R56bm2B+8y2JKiGEQ92QIDAQAB
+oxMwETAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBBQUAA4GBALqNB/JaqkTX
+slppJEaBHTY5/bGGWwV/0t3WMDNFaMrFgcsEY/KjUSyfWh9c6BHOdr21MmNe4YDh
+T8gv9TmcGNsEJRIYD1jly3tCDyA2W0AUIzob1GMGkV8ddKBUrmt/+qLzagxdOrQ0
+dRcxFarWaAJVGhJ+p6kWJt7XJnK341bP
+-----END CERTIFICATE-----
diff --git a/src/tests/nist_x509.cpp b/src/tests/nist_x509.cpp
index 04b569d32..65e154293 100644
--- a/src/tests/nist_x509.cpp
+++ b/src/tests/nist_x509.cpp
@@ -1,16 +1,7 @@
 /*
-* (C) 2006,2011,2012,2014 Jack Lloyd
+* (C) 2006,2011,2012,2014,2015 Jack Lloyd
 *
 * Botan is released under the Simplified BSD License (see license.txt)
-*
-* Code to run the X.509v3 processing tests described in "Conformance
-*  Testing of Relying Party Client Certificate Path Proccessing Logic",
-*  which is available on NIST's web site.
-*
-* Known Failures/Problems:
-*  - Policy extensions are not implemented, so we skip tests #34-#53.
-*  - Tests #75 and #76 are skipped as they make use of relatively
-*    obscure CRL extensions which are not supported.
 */
 
 #include "tests.h"
@@ -22,6 +13,7 @@
 
 #include <algorithm>
 #include <iostream>
+#include <fstream>
 #include <iomanip>
 #include <string>
 #include <vector>
@@ -32,11 +24,110 @@ using namespace Botan;
 
 std::map<size_t, Path_Validation_Result::Code> get_expected();
 
+namespace {
+
+std::vector<X509_Certificate> load_cert_file(const std::string& filename)
+   {
+   DataSource_Stream in(filename);
+
+   std::vector<X509_Certificate> certs;
+   while(!in.end_of_data())
+      {
+      try {
+      certs.emplace_back(in);
+      }
+      catch(Decoding_Error) {}
+      }
+
+   return certs;
+   }
+
+std::map<std::string, std::string> read_results(const std::string& results_file)
+   {
+   std::ifstream in(results_file);
+   if(!in.good())
+      throw std::runtime_error("Failed reading " + results_file);
+
+   std::map<std::string, std::string> m;
+   std::string line;
+   while(in.good())
+      {
+      std::getline(in, line);
+      if(line == "")
+         continue;
+      if(line[0] == '#')
+         continue;
+
+      std::vector<std::string> parts = split_on(line, ':');
+
+      if(parts.size() != 2)
+         throw std::runtime_error("Invalid line " + line);
+
+      m[parts[0]] = parts[1];
+      }
+
+   return m;
+   }
+
+}
+
+size_t test_x509_x509test()
+   {
+   // Test certs generated by https://github.com/yymax/x509test
+   const std::string test_dir = "src/tests/data/x509test";
+
+   std::map<std::string, std::string> results = read_results(test_dir + "/expected.txt");
+
+   const Path_Validation_Restrictions default_restrictions;
+
+   size_t fail = 0;
+
+   X509_Certificate root(test_dir + "/root.pem");
+   Certificate_Store_In_Memory trusted;
+   trusted.add_certificate(root);
+
+   for(auto i = results.begin(); i != results.end(); ++i)
+      {
+      const std::string fsname = i->first;
+      const std::string expected = i->second;
+
+      std::vector<X509_Certificate> certs = load_cert_file(test_dir + "/" + fsname);
+
+      if(certs.empty())
+         throw std::runtime_error("Failed to read certs from " + fsname);
+
+      Path_Validation_Result result = x509_path_validate(certs, default_restrictions, trusted,
+                                                         "www.tls.test", Usage_Type::TLS_SERVER_AUTH);
+
+      if(result.successful_validation() && result.trust_root() != root)
+         result = Path_Validation_Result(Certificate_Status_Code::CANNOT_ESTABLISH_TRUST);
+
+      if(result.result_string() != expected)
+         {
+         std::cout << "FAIL " << fsname << " expected '" << expected << "' got '" << result.result_string() << "'\n";
+         ++fail;
+         }
+      }
+
+   test_report("X.509 (x509test)", results.size(), fail);
+
+   return fail;
+   }
+
 size_t test_nist_x509()
    {
+   /**
+   * Code to run the X.509v3 processing tests described in "Conformance
+   *  Testing of Relying Party Client Certificate Path Proccessing Logic",
+   *  which is available on NIST's web site.
+   *
+   * Known Failures/Problems:
+   *  - Policy extensions are not implemented, so we skip tests #34-#53.
+   *  - Tests #75 and #76 are skipped as they make use of relatively
+   *    obscure CRL extensions which are not supported.
+   */
    const std::string root_test_dir = "src/tests/data/nist_x509/";
    const size_t total_tests = 76;
-
    try
       {
       // Do nothing, just test filesystem access
@@ -61,8 +152,8 @@ size_t test_nist_x509()
    for(size_t test_no = 1; test_no <= total_tests; ++test_no)
       {
       const std::string test_dir = root_test_dir + "/test" + (test_no <= 9 ? "0" : "") + std::to_string(test_no);
-      
-      const std::vector<std::string> all_files = get_files_recursive(test_dir);    
+
+      const std::vector<std::string> all_files = get_files_recursive(test_dir);
       if (all_files.empty())
          std::cout << "Warning: No test files found in '" << test_dir << "'" << std::endl;
 
@@ -83,6 +174,7 @@ size_t test_nist_x509()
 
       if(expected_results.find(test_no) == expected_results.end())
          {
+         //printf("Skipping %d\n", test_no);
          skipped++;
          continue;
          }
@@ -284,6 +376,7 @@ std::map<size_t, Path_Validation_Result::Code> get_expected()
 
 #else
 
+size_t test_x509_x509test() { return 0; }
 size_t test_nist_x509() { return 0; }
 
 #endif
diff --git a/src/tests/tests.cpp b/src/tests/tests.cpp
index d213b6a3a..61378b1a2 100644
--- a/src/tests/tests.cpp
+++ b/src/tests/tests.cpp
@@ -38,10 +38,10 @@ size_t run_tests_in_dir(const std::string& dir, std::function<size_t (const std:
    try
       {
       auto files = get_files_recursive(dir);
-      
+
       if (files.empty())
          std::cout << "Warning: No test files found in '" << dir << "'" << std::endl;
-      
+
       for(const auto file: files)
          fails += fn(file);
       }
@@ -312,6 +312,7 @@ int main(int argc, char* argv[])
    DEF_TEST(pk_keygen);
    DEF_TEST(cvc);
    DEF_TEST(x509);
+   DEF_TEST(x509_x509test);
    DEF_TEST(nist_x509);
    DEF_TEST(tls);
    DEF_TEST(compression);
diff --git a/src/tests/tests.h b/src/tests/tests.h
index 6d6a2d34c..1e496ccb2 100644
--- a/src/tests/tests.h
+++ b/src/tests/tests.h
@@ -165,6 +165,7 @@ size_t test_ecdsa_unit();
 size_t test_ecdh_unit();
 
 size_t test_x509();
+size_t test_x509_x509test();
 size_t test_cvc();
 
 size_t test_tls();