make ca use openssl ca command so we can add ocsp tests, and regen certs

git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@16900 ec53bebd-3082-4978-b11e-865c3cabbd6b
2006-04-01 00:41:04 +00:00
parent 4bffd93906
commit b4f2aeb697
34 changed files with 579 additions and 163 deletions
--- a/lib/hx509/data/ca.crt
+++ b/lib/hx509/data/ca.crt
@@ -1,15 +1,15 @@
 -----BEGIN CERTIFICATE-----
-MIICbDCCAdWgAwIBAgIJAOMz1JsD8LslMA0GCSqGSIb3DQEBBAUAMCoxGzAZBgNV
-BAMMEmh4NTA5IFRlc3QgUm9vdCBDQTELMAkGA1UEBhMCU0UwHhcNMDUwNzI3MTg1
-MzMyWhcNMTUwNzI1MTg1MzMyWjAqMRswGQYDVQQDDBJoeDUwOSBUZXN0IFJvb3Qg
-Q0ExCzAJBgNVBAYTAlNFMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDPcVad
-eB+0GfNoj8EVENZSPfMBNYbWtU9A+z662pmW7fBWEAaNtD3vod8nmanHvLSniVX0
-UX3HFgpPCha1sHkQ0c9ljycCS6Y/HFYhcandC5jPBfbTGSlwY8qfbSeKXcJbmAOu
-XYkVbxMLGUWvgWtebA4tyxe4bIMnm0FTEJe0+wIDAQABo4GZMIGWMB0GA1UdDgQW
-BBRsRocil3APjbqMz1V7uBdYezklFjBaBgNVHSMEUzBRgBRsRocil3APjbqMz1V7
-uBdYezklFqEupCwwKjEbMBkGA1UEAwwSaHg1MDkgVGVzdCBSb290IENBMQswCQYD
-VQQGEwJTRYIJAOMz1JsD8LslMAwGA1UdEwQFMAMBAf8wCwYDVR0PBAQDAgEGMA0G
-CSqGSIb3DQEBBAUAA4GBAG+X2RxED6rfXlH8pGq9P2w4bFxBbhyKm/m08PsgYQH7
-vtylbId+TO/hWRGjr6+s9HUlPJavfpcQHpcyT4zFPk/SOLrYbZAGEWIuMpddopq+
-e3mvChqyF5mYbCdOumyYBzxgB4FjhEvfB7sYa0WZMMU3rJsGdGnGPQlDk8+G8XhG
+MIICbDCCAdWgAwIBAgIJANUKkFeDDjxTMA0GCSqGSIb3DQEBBAUAMCoxGzAZBgNV
+BAMMEmh4NTA5IFRlc3QgUm9vdCBDQTELMAkGA1UEBhMCU0UwHhcNMDYwNDAxMDAz
+OTE2WhcNMTYwMzI5MDAzOTE2WjAqMRswGQYDVQQDDBJoeDUwOSBUZXN0IFJvb3Qg
+Q0ExCzAJBgNVBAYTAlNFMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDhzV/2
+18E3JhjrtUuy63CXQSuhLc/DPI63hieM1DADhnPtUeLrKkLll90WIEJoGgwRosZ3
+xKfXGQ3NcDGw9U9y19yO8tCdiOF2x7Pm5Xqyc4Ej5CuVBD+6dKoJCPq9Pbat+m5N
+4cQKI4GklwsYVp6L3MkVD7/ycbYEh2VIoyWsywIDAQABo4GZMIGWMB0GA1UdDgQW
+BBRlfDG/HHB55/+H/2mDtfnz7GBIRzBaBgNVHSMEUzBRgBRlfDG/HHB55/+H/2mD
+tfnz7GBIR6EupCwwKjEbMBkGA1UEAwwSaHg1MDkgVGVzdCBSb290IENBMQswCQYD
+VQQGEwJTRYIJANUKkFeDDjxTMAwGA1UdEwQFMAMBAf8wCwYDVR0PBAQDAgHmMA0G
+CSqGSIb3DQEBBAUAA4GBAIcvbaLuHd8JddZlUpR5g/Yz4wbZt6ruwPkoRh4bR0yJ
+R2Y1enc8/6j/RDlZyq1RAI2rA3wMWFDD/flvHS0ufacxI0pfQ65acgI/A7Q1b90D
+6wrwuwzLp7kKYMrxZcVEGSG6TMIJ6uH+RpMgFH3T+Pz937UDKalHh6MMRzRzcIkH
 -----END CERTIFICATE-----
--- a/lib/hx509/data/ca.key
+++ b/lib/hx509/data/ca.key
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXQIBAAKBgQDPcVadeB+0GfNoj8EVENZSPfMBNYbWtU9A+z662pmW7fBWEAaN
-tD3vod8nmanHvLSniVX0UX3HFgpPCha1sHkQ0c9ljycCS6Y/HFYhcandC5jPBfbT
-GSlwY8qfbSeKXcJbmAOuXYkVbxMLGUWvgWtebA4tyxe4bIMnm0FTEJe0+wIDAQAB
-AoGBAJrZNte7KKdPS9R8opvwApxHpBL9+tZhZ3TRV4Ux0r7IhMQpmErFBgrQIX01
-BniT06LQMLp87k/jkvRnSoZ74hIkwSj0xyydFGqDuYbsmwYtaSPJx/Kn3s7JzYoR
-s1fUHbxYg7xWyl9lQfRAH3cGspbw5GLuciiCCCKiDfxAcXC5AkEA8HOG2WeIAP/5
-6eui46I/d3fT0uRjKMwS3hMVLUyH42MDcFbWJ+taJLxzEz/dQxeYgVRXoqtLFLn5
-53o38j6ovwJBANzbYdeZXT9d/XE7WPdLqmhRLkHwrWfkjfXYrPP0eb6V/p+ft0af
-6aqgpG+FIIr7LSObKtPZOEu1ytM6yeQMpsUCQQDLHqxxhvXq8lHpeza02OCISV9V
-Lb1eP1ZI5xHinF3GhmPnSFPMkRIrKk6DmlWNUadwyRDmx5C7R4eGNUaBitD9AkAl
-0+mRPPJsvROAxnJ5gNtCHM14e9mnlsz908vjyPblPtmqy3dfwFoMYJFpjHrDczwL
-AjO2r1jmFtATl9kml0glAkAb/p57WPmzmVnDXPJJ3R3e2koYs1V4YEIOi81pX4E/
-epqrh4vqD71bHlIvARk6yWY9wB9OV13QEQex7gGENd4N
+MIICXgIBAAKBgQDhzV/218E3JhjrtUuy63CXQSuhLc/DPI63hieM1DADhnPtUeLr
+KkLll90WIEJoGgwRosZ3xKfXGQ3NcDGw9U9y19yO8tCdiOF2x7Pm5Xqyc4Ej5CuV
+BD+6dKoJCPq9Pbat+m5N4cQKI4GklwsYVp6L3MkVD7/ycbYEh2VIoyWsywIDAQAB
+AoGBAIGttz1Gb7rCcHF+LzlUKddUIEBy1O0lbDlOHIyul9yObSmQa6fvH3hIHTrF
+0B2FSAUg3KaQFGxeASVJF+CvIa6YspzMMOwJMXexQnrF0LaDLcluSvTKT/JYStH3
+owVzBRAgkPmYodbWXQvA/MyVNmtxIyLGfp0ESmOLktrGCwxBAkEA9xt/9MrPrE6H
+BSyJNc9m2hkMHsFtVUzU38sYHuUsQVWXkoPH3ChF04OHQtY5Mm8SqZcKn79k4iNl
+sBoHmYLr+wJBAOntmV92/tUmY9hjWCJSLZPavLJaleNz0vv2T0pxb3sQI+cj2LuD
+6Qo45L002Oyw3QKdP67oaRWVJtxBpdTwGXECQQDeRl9QC8rInI55ifkWbSyATH2J
+gMZfL1Bgyig1SkIHtv0zrtRtZdCBlVNrPJWQlzb7U8EbtycA/4Qt5wwk+w5XAkEA
+vNbibi9YbmcsSN2Bo0sloer9UxlPUKsKkf33akgCT5zq7seASXemI2tkM906lG/+
+KgMZCrBxTEv4b+vK3Afq8QJAVow5JodJ8500xVNKe3s6m73xkvDmRLj+/IDQc8PD
+/nhQ3BTMkbw8rDAnYZpXJ2syazDBU4t1l8HroC86SLc5/w==
 -----END RSA PRIVATE KEY-----
--- a/lib/hx509/data/gen-req.sh
+++ b/lib/hx509/data/gen-req.sh
@@ -12,36 +12,59 @@ gen_cert()
 		-sha1 \
 		-nodes \
 		-keyout out.key \
-		-out cert.req
+		-out cert.req > /dev/null 2>/dev/null

        if [ "$3" = "ca" ] ; then
-	    ca_arg="-signkey out.key"
-	else
-	    ca_arg="-CA $2.crt -CAkey $2.key -CAcreateserial"
-	fi
-
 	    openssl x509 \
 		-req \
 		-days 3650 \
 		-in cert.req \
 		-extfile openssl.cnf \
 		-extensions $4 \
-		$ca_arg \
+                -signkey out.key \
 		-out cert.crt

+		ln -s ca.crt `openssl x509 -hash -noout -in cert.crt`.0
+	else
+
+	    openssl ca \
+		-name $4 \
+		-days 3650 \
+		-cert $2.crt \
+		-keyfile $2.key \
+		-in cert.req \
+		-out cert.crt \
+		-outdir . \
+		-batch \
+		-config openssl.cnf 
+	fi
+
 	mv cert.crt $3.crt
 	mv out.key $3.key
 }

+echo "01" > serial
+> index.txt
+rm -f *.0
+
 gen_cert "hx509 Test Root CA" "root" "ca" "v3_ca"
-gen_cert "Test cert" "ca" "test" "usr_cert"
-gen_cert "Test cert KeyEncipherment" "ca" "test-ke-only" "usr_cert_ke"
-gen_cert "Test cert DigitalSignature" "ca" "test-ds-only" "usr_cert_ds"
-gen_cert "Sub CA" "ca" "sub-ca" "v3_ca"
-gen_cert "Test sub cert" "sub-ca" "sub-cert" "usr_cert"
+gen_cert "OCSP responder" "ca" "ocsp-responder" "ocsp"
+gen_cert "Test cert" "ca" "test" "usr"
+gen_cert "Revoke cert" "ca" "revoke" "usr"
+gen_cert "Test cert KeyEncipherment" "ca" "test-ke-only" "usr_ke"
+gen_cert "Test cert DigitalSignature" "ca" "test-ds-only" "usr_ds"
+gen_cert "Sub CA" "ca" "sub-ca" "subca"
+gen_cert "Test sub cert" "sub-ca" "sub-cert" "usr"

 cat sub-ca.crt ca.crt > sub-ca-combined.crt

+openssl ca \
+    -name usr \
+    -cert ca.crt \
+    -keyfile ca.key \
+    -revoke revoke.crt \
+    -config openssl.cnf 
+
 openssl pkcs12 \
    -export \
    -in test.crt \
@@ -105,3 +128,52 @@ openssl smime \
    -out test-enveloped-aes-128 \
    -aes128 \
    test.crt
+
+echo ocsp requests
+
+openssl ocsp \
+    -issuer ca.crt \
+    -cert test.crt \
+    -reqout ocsp-req1.der
+
+openssl ocsp \
+    -index index.txt \
+    -rsigner ocsp-responder.crt \
+    -rkey ocsp-responder.key \
+    -CA ca.crt \
+    -reqin ocsp-req1.der \
+    -noverify \
+    -respout ocsp-resp1-ocsp.der
+
+openssl ocsp \
+    -index index.txt \
+    -rsigner ca.crt \
+    -rkey ca.key \
+    -CA ca.crt \
+    -reqin ocsp-req1.der \
+    -noverify \
+    -respout ocsp-resp1-ca.der
+
+openssl ocsp \
+    -index index.txt \
+    -rsigner ocsp-responder.crt \
+    -rkey ocsp-responder.key \
+    -CA ca.crt \
+    -resp_no_certs \
+    -reqin ocsp-req1.der \
+    -noverify \
+    -respout ocsp-resp1-ocsp-no-cert.der
+
+openssl ocsp \
+    -issuer ca.crt \
+    -cert revoke.crt \
+    -reqout ocsp-req2.der
+
+openssl ocsp \
+    -index index.txt \
+    -rsigner ocsp-responder.crt \
+    -rkey ocsp-responder.key \
+    -CA ca.crt \
+    -reqin ocsp-req2.der \
+    -noverify \
+    -respout ocsp-resp2.der
--- a/lib/hx509/data/index.txt
+++ b/lib/hx509/data/index.txt
@@ -0,0 +1,7 @@
+V	160329003917Z		01	unknown	/C=SE/CN=OCSP responder
+V	160329003917Z		02	unknown	/C=SE/CN=Test cert
+R	160329003917Z	060401003919Z	03	unknown	/C=SE/CN=Revoke cert
+V	160329003918Z		04	unknown	/C=SE/CN=Test cert KeyEncipherment
+V	160329003918Z		05	unknown	/C=SE/CN=Test cert DigitalSignature
+V	160329003918Z		06	unknown	/C=SE/CN=Sub CA
+V	160329003919Z		07	unknown	/C=SE/CN=Test sub cert
--- a/lib/hx509/data/index.txt.attr
+++ b/lib/hx509/data/index.txt.attr
@@ -0,0 +1 @@
+unique_subject = yes
--- a/lib/hx509/data/ocsp-req1.der
+++ b/lib/hx509/data/ocsp-req1.der
--- a/lib/hx509/data/ocsp-req2.der
+++ b/lib/hx509/data/ocsp-req2.der
--- a/lib/hx509/data/ocsp-resp1-2.der
+++ b/lib/hx509/data/ocsp-resp1-2.der
--- a/lib/hx509/data/ocsp-resp1-3.der
+++ b/lib/hx509/data/ocsp-resp1-3.der
--- a/lib/hx509/data/ocsp-resp1-ca.der
+++ b/lib/hx509/data/ocsp-resp1-ca.der
--- a/lib/hx509/data/ocsp-resp1-ocsp-no-cert.der
+++ b/lib/hx509/data/ocsp-resp1-ocsp-no-cert.der
--- a/lib/hx509/data/ocsp-resp1-ocsp.der
+++ b/lib/hx509/data/ocsp-resp1-ocsp.der
--- a/lib/hx509/data/ocsp-resp1.der
+++ b/lib/hx509/data/ocsp-resp1.der
--- a/lib/hx509/data/ocsp-resp2.der
+++ b/lib/hx509/data/ocsp-resp2.der
--- a/lib/hx509/data/ocsp-responder.crt
+++ b/lib/hx509/data/ocsp-responder.crt
@@ -0,0 +1,56 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 1 (0x1)
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: CN=hx509 Test Root CA, C=SE
+        Validity
+            Not Before: Apr  1 00:39:17 2006 GMT
+            Not After : Mar 29 00:39:17 2016 GMT
+        Subject: C=SE, CN=OCSP responder
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:ae:c5:54:89:f0:1c:15:82:54:9e:59:ff:3b:d7:
+                    f7:dd:1f:27:da:12:d1:43:27:06:dc:df:bb:1e:7b:
+                    6c:1a:7c:7e:0a:3e:5f:0d:87:f5:12:f5:54:e8:29:
+                    d1:5f:e4:17:fc:8f:51:a4:e8:6d:be:0b:34:f5:ca:
+                    ba:ee:62:ce:c5:9a:ab:0f:85:a0:0b:3a:a5:e1:6a:
+                    54:67:1d:3f:28:e9:51:7e:d1:cd:2f:5d:8c:4b:12:
+                    d6:2f:1a:fa:f8:61:ae:d3:81:ad:83:50:19:d7:83:
+                    39:98:03:11:9f:96:cd:4a:b1:3b:3d:a6:28:e0:aa:
+                    fc:bb:d5:e0:ea:90:02:e5:ef
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            X509v3 Key Usage: 
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Extended Key Usage: 
+                OCSP No Check, OCSP Signing
+            X509v3 Subject Key Identifier: 
+                F1:69:4A:75:40:87:86:6C:14:61:69:13:38:59:21:56:59:CE:55:35
+    Signature Algorithm: sha1WithRSAEncryption
+        a5:fd:44:20:1a:5c:a8:c2:09:7e:92:e0:a3:74:e2:0b:8a:05:
+        43:7c:c2:97:28:fd:69:9c:dd:48:33:c4:96:2f:b3:d9:ea:35:
+        65:8c:dc:0e:66:49:de:ca:db:eb:ad:21:66:d3:e0:f5:b4:a0:
+        79:19:ee:94:de:a4:1b:05:01:c0:28:33:d4:47:a8:4d:3c:06:
+        63:c6:18:91:d3:04:86:8f:d4:5e:ca:df:13:88:71:9e:76:71:
+        c5:56:c3:1f:dc:3f:62:44:22:bb:98:ae:cf:a4:08:dd:aa:d4:
+        87:71:fb:70:52:e8:90:06:58:e5:ee:39:c8:04:bf:61:76:6b:
+        05:12
+-----BEGIN CERTIFICATE-----
+MIICHzCCAYigAwIBAgIBATANBgkqhkiG9w0BAQUFADAqMRswGQYDVQQDDBJoeDUw
+OSBUZXN0IFJvb3QgQ0ExCzAJBgNVBAYTAlNFMB4XDTA2MDQwMTAwMzkxN1oXDTE2
+MDMyOTAwMzkxN1owJjELMAkGA1UEBhMCU0UxFzAVBgNVBAMMDk9DU1AgcmVzcG9u
+ZGVyMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCuxVSJ8BwVglSeWf871/fd
+HyfaEtFDJwbc37see2wafH4KPl8Nh/US9VToKdFf5Bf8j1Gk6G2+CzT1yrruYs7F
+mqsPhaALOqXhalRnHT8o6VF+0c0vXYxLEtYvGvr4Ya7Tga2DUBnXgzmYAxGfls1K
+sTs9pijgqvy71eDqkALl7wIDAQABo1kwVzAJBgNVHRMEAjAAMAsGA1UdDwQEAwIF
+4DAeBgNVHSUEFzAVBgkrBgEFBQcwAQUGCCsGAQUFBwMJMB0GA1UdDgQWBBTxaUp1
+QIeGbBRhaRM4WSFWWc5VNTANBgkqhkiG9w0BAQUFAAOBgQCl/UQgGlyowgl+kuCj
+dOILigVDfMKXKP1pnN1IM8SWL7PZ6jVljNwOZkneytvrrSFm0+D1tKB5Ge6U3qQb
+BQHAKDPUR6hNPAZjxhiR0wSGj9Reyt8TiHGednHFVsMf3D9iRCK7mK7PpAjdqtSH
+cftwUuiQBljl7jnIBL9hdmsFEg==
+-----END CERTIFICATE-----
--- a/lib/hx509/data/ocsp-responder.key
+++ b/lib/hx509/data/ocsp-responder.key
@@ -0,0 +1,15 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIICXQIBAAKBgQCuxVSJ8BwVglSeWf871/fdHyfaEtFDJwbc37see2wafH4KPl8N
+h/US9VToKdFf5Bf8j1Gk6G2+CzT1yrruYs7FmqsPhaALOqXhalRnHT8o6VF+0c0v
+XYxLEtYvGvr4Ya7Tga2DUBnXgzmYAxGfls1KsTs9pijgqvy71eDqkALl7wIDAQAB
+AoGBAJJsWw6R70WKAtEEf5UotM46ew32dAI54UMN4tx/9SsfoA1/Ae35OTdf+Xnl
+Bzi6heogPPvXi5IMG5vN9N0iRS7gnfxr77Lum7G7mrQL9+bgz1N6unnuXZbbYjCD
+IYihsobke4c3ddfyfHBJRV7ofUGRdi6y1U/K3iItvz6ZuaIhAkEA1IRLkeTC2MAe
+EEw4cFoFEav6zk1X3ptdRd0fW622EEghzzo09CFTpp41Jq2ro0LB7a5m3WmVCXeO
+ulNUlUvhvwJBANKH42jr0boQ16Qk1tiXc17qqa5h3Su4EJxJn8XbYV0v4T6WS1tR
+V39IMNuSSr9trGxmtElqj+uzJvaOAi40p9ECQQCzxM1gNpEUZT+JLdC4SY3sKvzY
+MtjXt7ko9iomlUVjdIEVGPneYaqvUTlI5LRCQKBnfJYLSdsGzRnxR7hPKodlAkBK
+BfOEmZ3lQTTBBx7vitjK39GHeettCsv0V8Kwq8EhJcuZ2PhoBEKygyyCl35mrmY4
+uyfaxHgUFKq3eBj2LBdxAkAUOwyFB0iRAgs9M1z+LsdSsPfmwCHIhOnH2Z2P1q7k
+Kl3r4R1pgsVc1QX1kjauNNuaKziBl7ZjVqg9ovSD84gr
+-----END RSA PRIVATE KEY-----
--- a/lib/hx509/data/openssl.cnf
+++ b/lib/hx509/data/openssl.cnf
@@ -1,3 +1,48 @@
+[ca]
+
+default_ca = user
+
+[usr]
+database	= index.txt
+serial		= serial
+x509_extensions = usr_cert
+default_md=sha1
+policy		= policy_match
+certs		= .
+
+[ocsp]
+database	= index.txt
+serial		= serial
+x509_extensions = ocsp_cert
+default_md=sha1
+policy		= policy_match
+certs		= .
+
+[usr_ke]
+database	= index.txt
+serial		= serial
+x509_extensions = usr_cert_ke
+default_md=sha1
+policy		= policy_match
+certs		= .
+
+[usr_ds]
+database	= index.txt
+serial		= serial
+x509_extensions = usr_cert_ds
+default_md=sha1
+policy		= policy_match
+certs		= .
+
+[subca]
+database	= index.txt
+serial		= serial
+x509_extensions = v3_ca
+default_md=sha1
+policy		= policy_match
+certs		= .
+
+
 [ req ]
 distinguished_name	= req_distinguished_name
 x509_extensions		= v3_ca	# The extentions to add to the self signed cert
@@ -9,20 +54,29 @@ string_mask = utf8only
 subjectKeyIdentifier=hash
 authorityKeyIdentifier=keyid:always,issuer:always
 basicConstraints = CA:true
-keyUsage = cRLSign, keyCertSign
+keyUsage = cRLSign, keyCertSign, keyEncipherment, nonRepudiation, digitalSignature

 [ usr_cert ]
 basicConstraints=CA:FALSE
 keyUsage = nonRepudiation, digitalSignature, keyEncipherment
+subjectKeyIdentifier	= hash

 [ usr_cert_ke ]
 basicConstraints=CA:FALSE
 keyUsage = nonRepudiation, keyEncipherment
+subjectKeyIdentifier	= hash

 [ usr_cert_ds ]
 basicConstraints=CA:FALSE
 keyUsage = nonRepudiation, digitalSignature
+subjectKeyIdentifier	= hash

+[ ocsp_cert ]
+basicConstraints=CA:FALSE
+keyUsage = nonRepudiation, digitalSignature, keyEncipherment
+# ocsp-nocheck and kp-OCSPSigning
+extendedKeyUsage	= 1.3.6.1.5.5.7.48.1.5, 1.3.6.1.5.5.7.3.9
+subjectKeyIdentifier	= hash

 [ req_distinguished_name ]
 countryName			= Country Name (2 letter code)
@@ -39,3 +93,7 @@ commonName_max			= 64
 #challengePassword              = A challenge password
 #challengePassword_min          = 4
 #challengePassword_max          = 20
+
+[ policy_match ]
+countryName		= match
+commonName		= supplied
--- a/lib/hx509/data/serial
+++ b/lib/hx509/data/serial
@@ -0,0 +1 @@
+08
--- a/lib/hx509/data/sub-ca.crt
+++ b/lib/hx509/data/sub-ca.crt
@@ -1,15 +1,60 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 6 (0x6)
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: CN=hx509 Test Root CA, C=SE
+        Validity
+            Not Before: Apr  1 00:39:18 2006 GMT
+            Not After : Mar 29 00:39:18 2016 GMT
+        Subject: C=SE, CN=Sub CA
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:bd:40:1a:9c:18:ec:61:aa:bd:9f:b8:4a:b0:92:
+                    ce:7f:b9:47:d3:87:62:c2:85:c1:2d:a0:78:ab:c7:
+                    61:cd:6b:80:14:3e:19:94:68:0b:95:43:33:b1:f3:
+                    2f:71:e1:3d:c7:a3:89:63:df:1f:3a:40:da:1d:64:
+                    78:76:81:08:35:37:f1:ca:01:f4:f0:ea:8c:40:56:
+                    d2:18:30:df:23:d5:32:79:67:00:5e:27:bf:41:f6:
+                    52:69:ab:25:e5:26:42:31:8a:14:10:ed:f0:00:77:
+                    07:dd:08:9e:b0:06:13:7e:d2:05:91:c0:29:6d:d2:
+                    86:eb:3a:ce:e2:10:07:38:27
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                6A:9F:D0:FD:9B:6E:C9:14:4E:F7:8A:2A:C5:BD:87:2A:1A:35:47:26
+            X509v3 Authority Key Identifier: 
+                keyid:65:7C:31:BF:1C:70:79:E7:FF:87:FF:69:83:B5:F9:F3:EC:60:48:47
+                DirName:/CN=hx509 Test Root CA/C=SE
+                serial:D5:0A:90:57:83:0E:3C:53
+
+            X509v3 Basic Constraints: 
+                CA:TRUE
+            X509v3 Key Usage: 
+                Digital Signature, Non Repudiation, Key Encipherment, Certificate Sign, CRL Sign
+    Signature Algorithm: sha1WithRSAEncryption
+        25:e9:58:b4:5f:22:f1:24:aa:71:72:9f:f8:ec:94:57:5e:d9:
+        0d:a4:d8:6c:a2:31:a1:86:9c:f4:1b:8d:e3:ef:9c:62:d0:30:
+        2b:cf:70:e3:2d:61:78:ca:03:73:77:ea:cc:cb:60:71:be:8d:
+        99:d2:70:a5:59:eb:f1:c3:0f:4c:eb:33:55:b9:21:dc:f4:0d:
+        ef:cb:99:ba:57:24:2a:7f:63:2f:be:6f:dd:28:01:4b:8e:9d:
+        92:bd:75:50:de:9a:0a:b1:0b:e0:2c:f8:01:8a:39:99:e0:d9:
+        f7:ff:87:7e:f0:dc:53:2d:73:3d:b2:24:43:3b:83:9d:3c:81:
+        72:a0
 -----BEGIN CERTIFICATE-----
-MIICYDCCAcmgAwIBAgIJALVp8kub/fs+MA0GCSqGSIb3DQEBBAUAMCoxGzAZBgNV
-BAMMEmh4NTA5IFRlc3QgUm9vdCBDQTELMAkGA1UEBhMCU0UwHhcNMDUwNzI3MTg1
-MzM0WhcNMTUwNzI1MTg1MzM0WjAeMQ8wDQYDVQQDDAZTdWIgQ0ExCzAJBgNVBAYT
-AlNFMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDDibIa55bdhQsprtd7ehUo
-QnevOIwG7GOCmcKleVezXssNkBXbbIiuLHaEUd3ioWRH3VqCvieggcONzobxz5xT
-YIGIFtBIi0kuYspcjFKQAcFQKYlaWiHyplIkvrBJ82wV9bfDjOuz/SNtLLiQloTe
-/EUFb0AKEIoJP4ttqBSg8QIDAQABo4GZMIGWMB0GA1UdDgQWBBSstZ+3+wf3ZpFf
-ZsoHSEQCjczYUDBaBgNVHSMEUzBRgBRsRocil3APjbqMz1V7uBdYezklFqEupCww
-KjEbMBkGA1UEAwwSaHg1MDkgVGVzdCBSb290IENBMQswCQYDVQQGEwJTRYIJAOMz
-1JsD8LslMAwGA1UdEwQFMAMBAf8wCwYDVR0PBAQDAgEGMA0GCSqGSIb3DQEBBAUA
-A4GBADEFo+RVb0CfiZW2TIq34HiWMMqRPW6SYaAn5mTx1Dk0LNRtP52aoyFaayCW
-QXx3sP9o9P0BwirhbRnMdltt/N2RohzcAlL0zy9C6wcIEKmMziBpQB+svdnG8q26
-n6Bj8NLtOOqYeEeaupjt1rGKf63FUVhyz1wcxvqd8OSdmZQg
+MIICWDCCAcGgAwIBAgIBBjANBgkqhkiG9w0BAQUFADAqMRswGQYDVQQDDBJoeDUw
+OSBUZXN0IFJvb3QgQ0ExCzAJBgNVBAYTAlNFMB4XDTA2MDQwMTAwMzkxOFoXDTE2
+MDMyOTAwMzkxOFowHjELMAkGA1UEBhMCU0UxDzANBgNVBAMMBlN1YiBDQTCBnzAN
+BgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAvUAanBjsYaq9n7hKsJLOf7lH04diwoXB
+LaB4q8dhzWuAFD4ZlGgLlUMzsfMvceE9x6OJY98fOkDaHWR4doEINTfxygH08OqM
+QFbSGDDfI9UyeWcAXie/QfZSaasl5SZCMYoUEO3wAHcH3QiesAYTftIFkcApbdKG
+6zrO4hAHOCcCAwEAAaOBmTCBljAdBgNVHQ4EFgQUap/Q/ZtuyRRO94oqxb2HKho1
+RyYwWgYDVR0jBFMwUYAUZXwxvxxweef/h/9pg7X58+xgSEehLqQsMCoxGzAZBgNV
+BAMMEmh4NTA5IFRlc3QgUm9vdCBDQTELMAkGA1UEBhMCU0WCCQDVCpBXgw48UzAM
+BgNVHRMEBTADAQH/MAsGA1UdDwQEAwIB5jANBgkqhkiG9w0BAQUFAAOBgQAl6Vi0
+XyLxJKpxcp/47JRXXtkNpNhsojGhhpz0G43j75xi0DArz3DjLWF4ygNzd+rMy2Bx
+vo2Z0nClWevxww9M6zNVuSHc9A3vy5m6VyQqf2Mvvm/dKAFLjp2SvXVQ3poKsQvg
+LPgBijmZ4Nn3/4d+8NxTLXM9siRDO4OdPIFyoA==
 -----END CERTIFICATE-----
--- a/lib/hx509/data/sub-ca.key
+++ b/lib/hx509/data/sub-ca.key
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXAIBAAKBgQDDibIa55bdhQsprtd7ehUoQnevOIwG7GOCmcKleVezXssNkBXb
-bIiuLHaEUd3ioWRH3VqCvieggcONzobxz5xTYIGIFtBIi0kuYspcjFKQAcFQKYla
-WiHyplIkvrBJ82wV9bfDjOuz/SNtLLiQloTe/EUFb0AKEIoJP4ttqBSg8QIDAQAB
-AoGBAK82om6zWJ9UySTns9TEF1NFBAPxsp+9kImFiEJIkgp7hY24r603+t2/n89/
-oEikf7xZn/IJvG55+KYICymA9Dy852JI75pbEUUraOWvFhG7AuAa9Qfyy8cVTiTC
-f8yY2H3MH6uYI8ZfPU47BvvJt8U+AmViU3CAunOdtM4wazaxAkEA5SVEJhqJ9GKz
-RaMPFYQvlASqD3UdPEDXf9I4Chuy7wv+HMkTpvMs9ICSslIxzSTHYlwfuz3Tv+c6
-ewK60kUBnQJBANp0JRM0oSF3ep5J8PJarV/VG74i7PaGVTULs3TMC06wIIu+mdLa
-iaChBCAdCxJngNBdBeObzv1175aUq2+9lmUCQGKtH6HA//NrpYOxakd7uvlk4M7z
-Qfm2epaisls3/mAOrAk9VecpBQztaT69QpDy66GhxlBdmZgkPPzH+ieea8kCQFKj
-jULureXTJPesURHda6jNHWmYHLxFpQYkHwcYCU8DIcy7lcVGFrpFLyJW2lFkBj7M
-ceXgkzUe4Du+kfv7ZGECQGG4fci9tf9/wBY4EcaCwKt275CQh3VKi2aJHssANnEF
-VRzP03sVkPLBBriQB1+XanTpO6rQMDmRUVcaXwZ/Z44=
+MIICWwIBAAKBgQC9QBqcGOxhqr2fuEqwks5/uUfTh2LChcEtoHirx2HNa4AUPhmU
+aAuVQzOx8y9x4T3Ho4lj3x86QNodZHh2gQg1N/HKAfTw6oxAVtIYMN8j1TJ5ZwBe
+J79B9lJpqyXlJkIxihQQ7fAAdwfdCJ6wBhN+0gWRwClt0obrOs7iEAc4JwIDAQAB
+AoGALnRI095OT98Qct9S/irbI4EAf4zxEhyxAZktZcUoXbswkkd4EfTEOxxm2Rx/
+ne2TM6kR9YD0cmEu6R4bb8NWlwUxkMXetx0dQ2SO0MeIBDT4CeRFFtu03VonPv0O
+lJfBDvRsOKfMSUD81aSBZh4VnF+fZpELI36ojHYHpRpBUskCQQDv6NEF9XBcaAy0
+Wl99nts/kp5BafFR7o1KtSJot8TaCINqO5b5hx4udFEDhgEXv6I6+YIpzssT5ZYv
+x6+n0FXdAkEAyfF8Hs8X+YDr4ja1p7umH8PvIRWagpebdpC0V21Jz4hstl5KoLSt
+z/uQMyIoaB4haX2NgOhJ82H2ffAGWCKP0wJAUnXVkpTAICLravo9JDJ77af5mUZO
+2fiCvBDyWMgBc2fFs7fztqTIrPLx/aILshv+KQMlyDT5/EbHjni2WZn0SQJAAk1B
+V+yOXmasyaBMA8RsyVHnaN4hK7nkqL5Pf+ub+sSYUJ/Ug+5rSMKaSyrpgP5O7S/k
+LAL5zM9iCt9wgxKpxwJAeOfSRgtjo0CAhdYVTvjnRAy6ifamUsZDT0HWpAL1PfMb
+eO++6YPvtMgynCkDdeu6XZ4UQaCFraOVvs2917Jtkw==
 -----END RSA PRIVATE KEY-----
--- a/lib/hx509/data/sub-cert.crt
+++ b/lib/hx509/data/sub-cert.crt
@@ -1,12 +1,53 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 7 (0x7)
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=SE, CN=Sub CA
+        Validity
+            Not Before: Apr  1 00:39:19 2006 GMT
+            Not After : Mar 29 00:39:19 2016 GMT
+        Subject: C=SE, CN=Test sub cert
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:b7:4d:3c:eb:86:e4:f2:6d:68:25:e9:34:c3:53:
+                    c8:c3:37:74:bb:3c:c8:78:30:95:37:55:3a:5b:2b:
+                    c6:c5:32:bc:b1:f4:55:e3:f6:3f:7f:d7:1a:15:26:
+                    45:95:cb:3a:68:d0:76:1d:7f:17:48:0a:24:6d:91:
+                    4d:83:ab:49:dd:3a:69:04:54:1a:8b:59:28:0b:4c:
+                    f7:3f:51:e6:28:cb:8e:e0:f0:20:57:84:3e:6f:97:
+                    2f:86:c4:b7:da:80:55:96:9b:6c:fa:06:d5:4c:92:
+                    52:d9:cd:f1:b7:9f:9f:2c:16:20:ea:95:3a:e4:d6:
+                    b1:b6:53:06:2b:fc:21:df:31
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            X509v3 Key Usage: 
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Subject Key Identifier: 
+                1E:04:E5:7C:72:55:BC:87:6B:F5:92:29:7C:4C:C3:25:CC:FD:71:CD
+    Signature Algorithm: sha1WithRSAEncryption
+        4f:f2:81:50:c1:0a:e8:2d:ed:e7:0d:ac:57:e2:67:75:59:cf:
+        ea:48:ca:77:f3:57:e5:cc:47:7f:53:7a:f5:55:41:27:eb:ee:
+        85:b3:62:95:10:4a:9b:8a:b1:12:84:ec:b3:a1:c0:d2:fc:3d:
+        15:ab:67:02:62:48:1e:6d:02:02:44:81:72:62:96:30:16:4c:
+        f2:80:c0:04:55:1d:0d:65:f3:0c:cb:f8:78:98:66:98:85:fd:
+        d1:4e:ba:22:e8:dc:d2:10:89:b4:a4:15:c5:ca:c3:1d:d8:9c:
+        74:e0:f8:c7:cf:25:11:8e:80:6a:a9:0e:95:4f:1a:b0:97:53:
+        b3:8c
 -----BEGIN CERTIFICATE-----
-MIIB2zCCAUSgAwIBAgIJAOi6DZWGy39aMA0GCSqGSIb3DQEBBAUAMB4xDzANBgNV
-BAMMBlN1YiBDQTELMAkGA1UEBhMCU0UwHhcNMDUwNzI3MTg1MzM0WhcNMTUwNzI1
-MTg1MzM0WjAlMRYwFAYDVQQDDA1UZXN0IHN1YiBjZXJ0MQswCQYDVQQGEwJTRTCB
-nzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA0j19dTW/5ZqS3eEFxvYAV3n7ymz+
-iUVnQdrLyT9nFwJ2c6CX/OmDrd6rY8pT0ixvheEi6oDHyMExyEfzLnPfqamWYe2U
-Wjr6TJynfw6cT6gmWnBCx692iTlKahdao/d91NIbhPiIFZswzWvpdo7yHALHI9DK
-etkG8oaQEP/jIOUCAwEAAaMaMBgwCQYDVR0TBAIwADALBgNVHQ8EBAMCBeAwDQYJ
-KoZIhvcNAQEEBQADgYEAkbAZsjzyAtOA9Mj8nF9vm3bYfxbtviid/AB6d84K4s+I
-1yh6UOZ+cMr3zwScWcGWarx5eWMxRYn+3okudtrDm6CiLBIhNOYne8Cs/9S4glNv
-Sc0jLvRn/PVcBtuPavUa2NgFxaFIm3kGv+8SqKROrkig30OZr3WlVb7UFSmXFfY=
+MIIB8jCCAVugAwIBAgIBBzANBgkqhkiG9w0BAQUFADAeMQswCQYDVQQGEwJTRTEP
+MA0GA1UEAwwGU3ViIENBMB4XDTA2MDQwMTAwMzkxOVoXDTE2MDMyOTAwMzkxOVow
+JTELMAkGA1UEBhMCU0UxFjAUBgNVBAMMDVRlc3Qgc3ViIGNlcnQwgZ8wDQYJKoZI
+hvcNAQEBBQADgY0AMIGJAoGBALdNPOuG5PJtaCXpNMNTyMM3dLs8yHgwlTdVOlsr
+xsUyvLH0VeP2P3/XGhUmRZXLOmjQdh1/F0gKJG2RTYOrSd06aQRUGotZKAtM9z9R
+5ijLjuDwIFeEPm+XL4bEt9qAVZabbPoG1UySUtnN8befnywWIOqVOuTWsbZTBiv8
+Id8xAgMBAAGjOTA3MAkGA1UdEwQCMAAwCwYDVR0PBAQDAgXgMB0GA1UdDgQWBBQe
+BOV8clW8h2v1kil8TMMlzP1xzTANBgkqhkiG9w0BAQUFAAOBgQBP8oFQwQroLe3n
+DaxX4md1Wc/qSMp381flzEd/U3r1VUEn6+6Fs2KVEEqbirEShOyzocDS/D0Vq2cC
+YkgebQICRIFyYpYwFkzygMAEVR0NZfMMy/h4mGaYhf3RTroi6NzSEIm0pBXFysMd
+2Jx04PjHzyURjoBqqQ6VTxqwl1OzjA==
 -----END CERTIFICATE-----
--- a/lib/hx509/data/sub-cert.key
+++ b/lib/hx509/data/sub-cert.key
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXQIBAAKBgQDSPX11Nb/lmpLd4QXG9gBXefvKbP6JRWdB2svJP2cXAnZzoJf8
-6YOt3qtjylPSLG+F4SLqgMfIwTHIR/Muc9+pqZZh7ZRaOvpMnKd/DpxPqCZacELH
-r3aJOUpqF1qj933U0huE+IgVmzDNa+l2jvIcAscj0Mp62QbyhpAQ/+Mg5QIDAQAB
-AoGBAICwyv7YK+Krv4K5nwOuyX7CWHIMTbJRHWeeOmexu7TF+SPGBcL2XXgseNTY
-oH5iXNGigfDxa1ljiMmD4UNqAlmIDhZtPjgFdOzGk7GkzE9iHVA4OTLtkHYbT9Op
-c3TGlmYlJ35RUwn1mUSxyKfxooBa9m/dWbOVv3+ZHIBvoCbxAkEA8SueerCpsODV
-zPU8PDrT/KIs3+pfWF4hPnRsZvGJI7CLviTA3wHTrxYN6YmbpZO36YNBkVb3gfR3
-5t0Vk4u+MwJBAN8q+9cGEKWVvF9uGvJ0WHrO7b02AQTaw1a3khA9nq52cQDitLpU
-VVFlf8BeUAKZKiU4Ep71nOuwtLeQt2VK3IcCQQDrRnFqIfS5sO4C8G+eFon+WTxM
-CbqQW+w0oKGsYBA4+B+sFPDv3jlkArD51xw4EP8HWNxbbKszZYqfd6l38olPAkAx
-Zkdm+o22yaVwDmRipQRs8t9HUev50h8JVAs+ExXMEqXDB2vwDvjv0qLrxzS4zoS4
-xmfAzieVOIFYXO1ru52DAkAamldM+vjbpljDPj4D0RAZCBWWfTzizIJHVx0ikQjD
-DT1RK6/9PmR3ZvSLFJVJ7RkDvff74nQmsyAMlCF/9VkW
+MIICXQIBAAKBgQC3TTzrhuTybWgl6TTDU8jDN3S7PMh4MJU3VTpbK8bFMryx9FXj
+9j9/1xoVJkWVyzpo0HYdfxdICiRtkU2Dq0ndOmkEVBqLWSgLTPc/UeYoy47g8CBX
+hD5vly+GxLfagFWWm2z6BtVMklLZzfG3n58sFiDqlTrk1rG2UwYr/CHfMQIDAQAB
+AoGBALFMrXNn/EYd21JoO1f/z748AtYlGgdffsWR06tiMZaG2AwNOZMRmiQuzJTO
+expEBFBj6wvm5X8SCGBO3rpQUVVeS6KDEMWoJNFB8bsG6eGHrmmiKpLA5xrI8EJB
+mKmxu74k35WoC+1NLpXl4PsasyVr6HPNKuvWbz/XO3UMWJ4NAkEA6KPGCanHvMAq
+BQyg39quzxqz4TUiRuj3gjICZRulfzgLNg/zdC1bsCvvH19Wfcbrz8CrySgE60cg
+0ouQnFzz4wJBAMm1LuruNf7owbnBesV9whkcWNUetdqAggMnAtqFI2xpH8soN5CF
+eLgzh0YtzWyHyO9ies9LIUWkfnLV/tRKlNsCQQCQ2O/EMn7XifpfvHYqCvnOn3yi
+WzflWMZKvSJ6m5UWuelZFuNpUZiF/0TajrzGgWVvrDIJhC5T46yPCzDV+pYrAkAd
+xKeP9GfzntY4W92Kl+y1WAGkMkwUWzLU1EUPiuaXcUxH5z+MDKasSK6GJOxUQBXf
+fmExhpz6cjRXLk3VdsxRAkA2D2AbDmbawkO0/9dso5eUwVGmJqICOlJr+oTHUSGQ
+DqtjRO48EsHIx2rVWZHB+jCvuXRwzxs1r393G+FZQ+a4
 -----END RSA PRIVATE KEY-----
--- a/lib/hx509/data/sub-cert.p12
+++ b/lib/hx509/data/sub-cert.p12
--- a/lib/hx509/data/test-ds-only.crt
+++ b/lib/hx509/data/test-ds-only.crt
@@ -1,13 +1,53 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 5 (0x5)
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: CN=hx509 Test Root CA, C=SE
+        Validity
+            Not Before: Apr  1 00:39:18 2006 GMT
+            Not After : Mar 29 00:39:18 2016 GMT
+        Subject: C=SE, CN=Test cert DigitalSignature
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:db:ab:a5:49:21:4d:a9:cd:8f:d0:a7:16:f8:74:
+                    a6:e0:34:d3:66:35:29:c9:33:b7:80:08:c4:02:3a:
+                    9b:8e:5a:70:2f:11:2a:f3:f7:ab:f4:11:e0:59:d5:
+                    41:87:69:83:5b:19:72:70:db:a9:fd:05:27:ba:62:
+                    d4:0f:6f:bf:f9:a2:66:be:98:c6:35:61:16:a7:bd:
+                    81:43:05:c2:2a:55:ac:a0:78:a6:dd:b5:de:63:d7:
+                    75:83:c6:1c:ad:62:6c:c1:b8:e8:12:09:61:fc:6e:
+                    d8:a4:3d:62:b2:26:5a:b0:25:4e:91:cd:ed:76:05:
+                    7c:a1:d7:7e:42:9f:64:47:83
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            X509v3 Key Usage: 
+                Digital Signature, Non Repudiation
+            X509v3 Subject Key Identifier: 
+                6B:B2:C3:8A:CF:7D:BE:89:32:C0:68:70:F5:45:9F:09:CE:56:89:24
+    Signature Algorithm: sha1WithRSAEncryption
+        c2:73:cd:ba:5d:d0:a4:52:97:62:f0:69:42:88:c9:a8:10:01:
+        29:3b:89:72:91:17:4d:56:f6:7c:b8:21:ea:8d:91:fa:6f:30:
+        b5:d7:c4:2c:94:fe:b6:f4:e2:e9:2f:85:f8:0e:b7:c9:cf:15:
+        f6:7c:e0:b0:6e:d7:a7:12:87:7b:6c:9f:0a:4b:a3:0e:56:fb:
+        5d:41:6e:a0:07:f4:a4:ca:e6:70:ae:7d:42:1a:8a:16:13:72:
+        96:14:1e:ad:85:eb:ba:bc:88:bb:45:dc:7f:b7:fd:96:75:21:
+        eb:de:1d:60:da:67:bf:64:68:c9:f2:d9:86:fe:a1:74:6f:a4:
+        e0:1f
 -----BEGIN CERTIFICATE-----
-MIIB9DCCAV2gAwIBAgIJALVp8kub/fs9MA0GCSqGSIb3DQEBBAUAMCoxGzAZBgNV
-BAMMEmh4NTA5IFRlc3QgUm9vdCBDQTELMAkGA1UEBhMCU0UwHhcNMDUwNzI3MTg1
-MzMzWhcNMTUwNzI1MTg1MzMzWjAyMSMwIQYDVQQDDBpUZXN0IGNlcnQgRGlnaXRh
-bFNpZ25hdHVyZTELMAkGA1UEBhMCU0UwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
-AoGBAMKVdReMNkZBL8wYWaUTKczT3470P8r7MXqqg6rv5q/612wbKWnTPe5Vny7X
-qZ4p0rDpX2hZGfD5Gggr496L2GSQ6Eec1bOTJznlSg9BHc5PCfNL+RJ0bG/n4vmG
-eJKJqFwrGI0pS6qjPIh9PhuoEINwY1J2qUjvlstxa8hj9QeBAgMBAAGjGjAYMAkG
-A1UdEwQCMAAwCwYDVR0PBAQDAgbAMA0GCSqGSIb3DQEBBAUAA4GBAC9SHuwolAun
-acsx2royYktE1EfBBvlA+j3hFrOki0nHyGBDIPxI90hwOVJ+3Nr7cG0Fge8TnZSX
-aauFM307Nn0qYLHB6gwCAgrgJrKHU9hhOiq7IQGK9qxhxEwgZ/u/rPUi7IidlY4p
-reYJuZ6rDbt5qkarTIEuAUiHLQv5qEks
+MIICCzCCAXSgAwIBAgIBBTANBgkqhkiG9w0BAQUFADAqMRswGQYDVQQDDBJoeDUw
+OSBUZXN0IFJvb3QgQ0ExCzAJBgNVBAYTAlNFMB4XDTA2MDQwMTAwMzkxOFoXDTE2
+MDMyOTAwMzkxOFowMjELMAkGA1UEBhMCU0UxIzAhBgNVBAMMGlRlc3QgY2VydCBE
+aWdpdGFsU2lnbmF0dXJlMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDbq6VJ
+IU2pzY/Qpxb4dKbgNNNmNSnJM7eACMQCOpuOWnAvESrz96v0EeBZ1UGHaYNbGXJw
+26n9BSe6YtQPb7/5oma+mMY1YRanvYFDBcIqVaygeKbdtd5j13WDxhytYmzBuOgS
+CWH8btikPWKyJlqwJU6Rze12BXyh135Cn2RHgwIDAQABozkwNzAJBgNVHRMEAjAA
+MAsGA1UdDwQEAwIGwDAdBgNVHQ4EFgQUa7LDis99vokywGhw9UWfCc5WiSQwDQYJ
+KoZIhvcNAQEFBQADgYEAwnPNul3QpFKXYvBpQojJqBABKTuJcpEXTVb2fLgh6o2R
+m8wtdfELJT+tvTi6S+F+A63yc8V9nzgsG7XpxKHe2yfCkujDlb7XUFuoAf0pMrm
+cK59QhqKFhNylhQerYXruryIu0Xcf7f9lnUh694dYNpnv2RoyfLZhv6hdG+k4B8=
 -----END CERTIFICATE-----
--- a/lib/hx509/data/test-ds-only.key
+++ b/lib/hx509/data/test-ds-only.key
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXAIBAAKBgQDClXUXjDZGQS/MGFmlEynM09+O9D/K+zF6qoOq7+av+tdsGylp
-0z3uVZ8u16meKdKw6V9oWRnw+RoIK+Pei9hkkOhHnNWzkyc55UoPQR3OTwnzS/kS
-dGxv5+L5hniSiahcKxiNKUuqozyIfT4bqBCDcGNSdqlI75bLcWvIY/UHgQIDAQAB
-AoGAdXupm9MTPe3DvxWAopNkbIAL/ZLpJVPutuJW5xE7lkr8YBAyO+vH+6uEldKu
-XYlg5WGyMh2B9SVhm0dsqISE3H14k384hLyITpnsaD6N52gDotkQoKbos111buVS
-xqJ3nc2ithp3igDF8OsZCLvt6BD/FnBveXD35Fx1VC6sN7ECQQDpvWWXROhjc5ZV
-AL6WLqr8fs7xl/QrzKk50AyNX0vjxUXMIvr5ukF/0S/+EDxqgjZZoxvdVj7yWNrG
-qDZRpjLVAkEA1R1uvUDn7lGLVuteCnVdhkTCR9cvljGVCxcb+iEprniClOnPkBQ5
-p7ZbhjzqSnwTc2pezgb2ZWVLEOjljNkf/QJAE0uBMWWM0XjfNhEjqn4bu1A0gRkM
-HPl+Frmn75uoRhso0dspYKgRdB2umoh4lEo/dlLSoAjYlWTkWnXUVhUkKQJAf+J0
-lG7BfrpCMjt1KDN7ltnl97RCYw+Hz6rjZ/rEh2Tbfz67BkuMuX5td6VQNrgz99tJ
-3rpA22GoZRJMxXN5hQJBALFgvcFLvT+pUDGYuhyQB8f3aNmmDyDyMnQdUkHEX/j+
-g9vXCpWOvOn7IorE9eScuSHrOCwJbeW4zqdeAD3UElc=
+MIICXgIBAAKBgQDbq6VJIU2pzY/Qpxb4dKbgNNNmNSnJM7eACMQCOpuOWnAvESrz
+96v0EeBZ1UGHaYNbGXJw26n9BSe6YtQPb7/5oma+mMY1YRanvYFDBcIqVaygeKbd
+td5j13WDxhytYmzBuOgSCWH8btikPWKyJlqwJU6Rze12BXyh135Cn2RHgwIDAQAB
+AoGAS3r8TVeTLxCCJSj03KSAnrOoHAuScx9BI05fw4BN6SksORAGGVR2EmR+GYAM
+hzH7P7dLunnQPC+kSgghY7h7VvG2AguGyOa8n44LEgWLoRF0YCcYCqopCbUOcXWP
+hHnQV98I5TDDowAz2fI/Cvos5a5VI5aeJDr2/AORR67zlpECQQDxtT30CGuXkolK
+i0K7NTr1kZSfHi/X3L4B+rKRod0rRbOKpxlWwO/wLL13Bw0iWS6Le/N1tzxWf3AK
+djOcPfY7AkEA6KjR63+zpbwGOi5gDLv+ChbGvLxw9EezM6nUg1o4aZKOdHR3fa2X
+MDuVCVnM53NQkTr9nNg2VCekv+jFQ6k3WQJBAM8MDQzcpaWKHdbgIgKRX3b6BNCk
+oCEN8ylo4cwEVpt5somECB2bWi1ndcjfHm4c7NUJEYz1sFb8BTLA/AbLwP8CQQCg
+KCZpUL0f57D5uBbSbU7RLyCbp7Sx0/GeLNhnm2Gd+w8pR0tCLo8W2s0bZL/Sy+S4
+NL2EjKnJgIi+usOgcgnxAkEAh/W1Bat+6adEa4QagHT7t0mlYVBfRMVd4ta5+3nw
+6RX6B0wZYc0qWXImE4VoDv1n9fShBEcWKPpGVjPwZ2smhw==
 -----END RSA PRIVATE KEY-----
--- a/lib/hx509/data/test-enveloped-aes-128
+++ b/lib/hx509/data/test-enveloped-aes-128
--- a/lib/hx509/data/test-ke-only.crt
+++ b/lib/hx509/data/test-ke-only.crt
@@ -1,13 +1,53 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 4 (0x4)
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: CN=hx509 Test Root CA, C=SE
+        Validity
+            Not Before: Apr  1 00:39:18 2006 GMT
+            Not After : Mar 29 00:39:18 2016 GMT
+        Subject: C=SE, CN=Test cert KeyEncipherment
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:e1:02:e1:c8:2d:11:87:f9:34:bf:9b:5c:8c:eb:
+                    d2:57:5b:33:3f:21:3f:39:d1:98:87:eb:85:40:16:
+                    05:fb:47:44:c3:34:68:98:7e:ad:3e:c3:5e:52:f8:
+                    93:14:87:75:ce:49:df:43:23:2d:50:4d:af:0d:56:
+                    dc:c0:4f:5c:62:ad:cd:2b:69:60:e0:32:86:66:32:
+                    b3:da:67:85:31:85:29:e2:03:ff:48:00:70:6f:ba:
+                    df:90:98:1e:ea:39:6b:22:c4:fe:e8:99:7f:6c:28:
+                    6f:ca:53:21:98:48:36:a4:41:32:69:7f:2f:ae:04:
+                    c7:64:0c:08:0e:e8:af:2c:a5
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            X509v3 Key Usage: 
+                Non Repudiation, Key Encipherment
+            X509v3 Subject Key Identifier: 
+                C2:02:13:9B:08:BA:D3:9C:7B:A0:47:98:5D:B4:3B:EB:B3:68:D6:86
+    Signature Algorithm: sha1WithRSAEncryption
+        1b:1d:b3:0a:8c:dc:11:16:2a:76:55:7d:f6:2d:17:19:d6:8e:
+        f8:ab:ac:10:a6:53:a0:68:0e:d3:51:43:1a:22:46:df:0c:0c:
+        1a:40:c0:a9:d4:07:14:c9:fa:f2:b3:61:24:c4:a4:bc:b9:43:
+        29:a3:30:1c:fa:80:2d:b2:ac:05:76:8b:2b:b1:75:20:70:21:
+        f2:81:00:e7:57:41:5e:40:b1:9d:5c:11:29:15:77:0c:49:4a:
+        bc:27:c9:02:db:a4:45:33:a0:ac:90:63:f3:ca:d0:94:39:58:
+        a2:00:13:ce:c6:fa:8a:14:5d:7d:d6:6c:8c:0d:e6:d1:1c:3d:
+        63:e5
 -----BEGIN CERTIFICATE-----
-MIIB8zCCAVygAwIBAgIJALVp8kub/fs8MA0GCSqGSIb3DQEBBAUAMCoxGzAZBgNV
-BAMMEmh4NTA5IFRlc3QgUm9vdCBDQTELMAkGA1UEBhMCU0UwHhcNMDUwNzI3MTg1
-MzMzWhcNMTUwNzI1MTg1MzMzWjAxMSIwIAYDVQQDDBlUZXN0IGNlcnQgS2V5RW5j
-aXBoZXJtZW50MQswCQYDVQQGEwJTRTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkC
-gYEAvjMopip15yzjulTf3QYmf4ETapHYHfLb+QYpbQSaSnCR5NwqYAvDKQpEj/6A
-Qqo/2TLiLJ8O19Ulss1byT0/kczXoHvQiZkjPwh44xE4sTV4gFDOFYicyavfCRis
-x1Xu/4jk+RLu+9SGaA4TdKHfiL0EVsIjBusXeiS8paPgrpkCAwEAAaMaMBgwCQYD
-VR0TBAIwADALBgNVHQ8EBAMCBWAwDQYJKoZIhvcNAQEEBQADgYEANeC3isbZ3KBX
-/HtxF8CZdgbiQQJ8rltUcSy9n/WK8tpwgKFW/sa5teMLQ6XjSjPLoTei3qjHYiPG
-aW5XK+EzlbaOKetWdjAkNEsAAN4rmHpKuVnqxvzG9vvoK8+pD/eRrNBcTnPPlWkZ
-+fzsMOCvORzrvxrbFGMzD8//qRHRNlI=
+MIICCjCCAXOgAwIBAgIBBDANBgkqhkiG9w0BAQUFADAqMRswGQYDVQQDDBJoeDUw
+OSBUZXN0IFJvb3QgQ0ExCzAJBgNVBAYTAlNFMB4XDTA2MDQwMTAwMzkxOFoXDTE2
+MDMyOTAwMzkxOFowMTELMAkGA1UEBhMCU0UxIjAgBgNVBAMMGVRlc3QgY2VydCBL
+ZXlFbmNpcGhlcm1lbnQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAOEC4cgt
+EYf5NL+bXIzr0ldbMz8hPznRmIfrhUAWBftHRMM0aJh+rT7DXlL4kxSHdc5J30Mj
+LVBNrw1W3MBPXGKtzStpYOAyhmYys9pnhTGFKeID/0gAcG+635CYHuo5ayLE/uiZ
+f2wob8pTIZhINqRBMml/L64Ex2QMCA7oryylAgMBAAGjOTA3MAkGA1UdEwQCMAAw
+CwYDVR0PBAQDAgVgMB0GA1UdDgQWBBTCAhObCLrTnHugR5hdtDvrs2jWhjANBgkq
+hkiG9w0BAQUFAAOBgQAbHbMKjNwRFip2VX32LRcZ1o74q6wQplOgaA7TUUMaIkbf
+DAwaQMCp1AcUyfrys2EkxKS8uUMpozAc+oAtsqwFdosrsXUgcCHygQDnV0FeQLGd
+XBEpFXcMSUq8J8kC26RFM6CskGPzytCUOViiABPOxvqKFF191myMDebRHD1j5Q==
 -----END CERTIFICATE-----
--- a/lib/hx509/data/test-ke-only.key
+++ b/lib/hx509/data/test-ke-only.key
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICWwIBAAKBgQC+MyimKnXnLOO6VN/dBiZ/gRNqkdgd8tv5BiltBJpKcJHk3Cpg
-C8MpCkSP/oBCqj/ZMuIsnw7X1SWyzVvJPT+RzNege9CJmSM/CHjjETixNXiAUM4V
-iJzJq98JGKzHVe7/iOT5Eu771IZoDhN0od+IvQRWwiMG6xd6JLylo+CumQIDAQAB
-AoGANBvKADRT1wEKZwtHxcMgmwAe9Kx+XD4kHAafJNoE92392oijJ2sxjbXdcOHV
-++2uzm/NXVI6e9FOobz3b5vTJUIGwh44hhGOXX5tCxZWO7pLVmBnK8VUfrprmaGC
-ZFKKqpXLErDXSZxA1gpbQsz2NMGhVzwR3WMUeNzulY8PowECQQD4qMG6hrL35/x2
-+aydV3R3mAOqoiH9YH3yw4MzJNfQf8o1oQAfOnYbsQQ5BHZmRLP4u81KRA5TfOnd
-0uIymuThAkEAw9CYVfIw8CDaj2hZm200sVfjEStOqKVN3Oso3Mpk2aQ7Q6TOFG1i
-J7mRlUAUqEOQD3a0tN1eH43132/64dJIuQJAeX5S8aUgypnRs/v3yATUBh8DI5sG
-Snub7kJy10lYHSpjDWL14Uw6KvuJmaZBh2RoHs771h58dXRh/B0uohUmYQJAPvEs
-JmRFSsqktngqZYWC7IZ9nKU5EYihMKP+bIo6RKM/0YyGGZbXeEF0BG+mtDeTdQUJ
-LSIDAU2WfQ33rOL1MQJAX7rW0vtkLoaAKO1wA1/NZasZY+LXTbt5sHkkrpRznrHm
-TIiriBRGtVHg1J2Mv7cGe4RvN92adZFumHnILQZ+zg==
+MIICXQIBAAKBgQDhAuHILRGH+TS/m1yM69JXWzM/IT850ZiH64VAFgX7R0TDNGiY
+fq0+w15S+JMUh3XOSd9DIy1QTa8NVtzAT1xirc0raWDgMoZmMrPaZ4UxhSniA/9I
+AHBvut+QmB7qOWsixP7omX9sKG/KUyGYSDakQTJpfy+uBMdkDAgO6K8spQIDAQAB
+AoGBAMjtI+T2qcL7++hluX11T70GCXsEG0tsKIKnA7Q4dlruRy7w673Q0K9NEjuR
+EPWyCLaPLLjs/pfI5tpIiJOJynn/B6Aht+6xB7VsdBIhVfkEZrOU4lMSjOEt49OT
+zd5rbjxKyvO4V7jDBKsMEzuk4h01YfjwCxstkIuD2Tm950u5AkEA8YSxOe0DPuQR
+u8/kIWjaq6mcOfwg5+PgCxSEVhYZ8/8kGP6MjKuJV33/K7dYynFmP0fUW34upuGp
+gdEc7fJ+2wJBAO6AzlfoL5tJV+tkb68oW87+s8gLUwdd1boB5ZA76iLGB8ifR7ZN
+1NLT9+1kNmjTqPAmqNVAQYAxrnKAhB2AGn8CQEybvmuVVpY4WbetNbuzOsmAv2FV
+LErh6Usacu+riwfuQlD7TTHBp4rtGGeRfMSaO8iOzDlJSRr+MXpQDlEbvkkCQQDF
+Nm7pE43h+rifZRJQpK+drtCb9nk2WynyP8VCCbjl/hfLlaFnpl334txcSIQRFAva
+YC01AIfo56vW9FvKRPYjAkAeO8QHZwocr0K7hJFYnhygFyEuVm6AGOWAKzRPcBsk
+1v2FLhM0xlmzW3JrfqMKaPK0dkmZ9PWKt//q/EE50w13
 -----END RSA PRIVATE KEY-----
--- a/lib/hx509/data/test-signed-data
+++ b/lib/hx509/data/test-signed-data
--- a/lib/hx509/data/test-signed-data-noattr
+++ b/lib/hx509/data/test-signed-data-noattr
--- a/lib/hx509/data/test-signed-data-noattr-nocerts
+++ b/lib/hx509/data/test-signed-data-noattr-nocerts
--- a/lib/hx509/data/test.crt
+++ b/lib/hx509/data/test.crt
@@ -1,13 +1,53 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 2 (0x2)
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: CN=hx509 Test Root CA, C=SE
+        Validity
+            Not Before: Apr  1 00:39:17 2006 GMT
+            Not After : Mar 29 00:39:17 2016 GMT
+        Subject: C=SE, CN=Test cert
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:9a:df:af:c3:93:a4:2e:78:10:ea:13:51:dd:90:
+                    c1:ba:9f:4e:8c:35:bb:3b:32:23:28:c7:e9:60:a0:
+                    d3:86:27:cf:56:a8:98:26:8d:80:6b:54:4f:ae:6c:
+                    29:67:44:7d:0c:ae:8d:b9:a1:05:48:7d:89:e0:35:
+                    84:af:5e:38:7d:ba:42:e3:06:ad:5f:22:a6:a7:a7:
+                    3f:7c:58:d2:ca:b6:6c:e8:d2:e9:cb:65:c6:9f:9f:
+                    96:37:7e:df:dd:fb:b4:ee:8c:2b:eb:f5:74:71:97:
+                    55:b6:d2:8d:7a:50:b0:92:fd:da:8f:74:0f:d6:ec:
+                    55:a1:0c:f7:a5:fd:f3:77:a3
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            X509v3 Key Usage: 
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Subject Key Identifier: 
+                B6:48:11:B3:C5:67:44:EE:DD:FE:B1:C6:D4:4F:BA:90:34:91:8E:FD
+    Signature Algorithm: sha1WithRSAEncryption
+        a2:4c:69:9f:5c:e8:11:4c:ff:23:02:ae:f4:60:25:fd:b9:d0:
+        44:f7:86:e1:f4:c1:fa:db:45:aa:01:c4:1c:bf:9b:22:05:2a:
+        1e:da:0d:ee:4d:9c:1a:13:70:9b:a5:d1:78:63:db:89:a3:27:
+        f1:73:66:d4:8f:9d:38:8c:bf:4d:fd:43:15:c2:fb:46:cc:7e:
+        2f:ec:4a:c9:41:74:37:ff:fc:a9:1a:ed:36:77:59:19:b3:80:
+        3d:64:ff:11:18:a9:57:7b:38:01:54:aa:81:a9:5f:67:c2:22:
+        bd:25:f4:96:f7:d2:38:05:7a:e1:e6:a0:4e:57:9f:e1:cb:07:
+        cb:69
 -----BEGIN CERTIFICATE-----
-MIIB4zCCAUygAwIBAgIJALVp8kub/fs7MA0GCSqGSIb3DQEBBAUAMCoxGzAZBgNV
-BAMMEmh4NTA5IFRlc3QgUm9vdCBDQTELMAkGA1UEBhMCU0UwHhcNMDUwNzI3MTg1
-MzMzWhcNMTUwNzI1MTg1MzMzWjAhMRIwEAYDVQQDDAlUZXN0IGNlcnQxCzAJBgNV
-BAYTAlNFMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDM3b2EMYGRiwhGPlqJ
-fg/ZTcQyNqw4HBW0w9DVQvapgw1AxPo+VcZdAcL778WB/lunODg8rYVOuJGnNx3m
-iIfv2qn8y8JWDtx4xzN7TOKhx0J10zJ/iz2Yfg5CNPgV4kJca34fpYXv9B+1lMZy
-cjcezFNbOvVr3uHYEi/dQQEGbQIDAQABoxowGDAJBgNVHRMEAjAAMAsGA1UdDwQE
-AwIF4DANBgkqhkiG9w0BAQQFAAOBgQA03TpR/zxVKM1P9in9TtyGDhK0YToKCepQ
-s5KTrYXRFyCP1nT13OcY01sZxS6KhXcwkTNTCKvU9h2V6Al2BCQpBBtI8Tz6JPO5
-JUzkW6PMNd0zAv4hH0TQhk0ibEWr+HvbMVCyEDAHOlHip30IP8L9UUTnGaXKw9H/
-IjZkp54/PA==
+MIIB+jCCAWOgAwIBAgIBAjANBgkqhkiG9w0BAQUFADAqMRswGQYDVQQDDBJoeDUw
+OSBUZXN0IFJvb3QgQ0ExCzAJBgNVBAYTAlNFMB4XDTA2MDQwMTAwMzkxN1oXDTE2
+MDMyOTAwMzkxN1owITELMAkGA1UEBhMCU0UxEjAQBgNVBAMMCVRlc3QgY2VydDCB
+nzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAmt+vw5OkLngQ6hNR3ZDBup9OjDW7
+OzIjKMfpYKDThifPVqiYJo2Aa1RPrmwpZ0R9DK6NuaEFSH2J4DWEr144fbpC4wat
+XyKmp6c/fFjSyrZs6NLpy2XGn5+WN37f3fu07owr6/V0cZdVttKNelCwkv3aj3QP
+1uxVoQz3pf3zd6MCAwEAAaM5MDcwCQYDVR0TBAIwADALBgNVHQ8EBAMCBeAwHQYD
+VR0OBBYEFLZIEbPFZ0Tu3f6xxtRPupA0kY79MA0GCSqGSIb3DQEBBQUAA4GBAKJM
+aZ9c6BFM/yMCrvRgJf250ET3huH0wfrbRaoBxBy/myIFKh7aDe5NnBoTcJul0Xhj
+24mjJ/FzZtSPnTiMv039QxXC+0bMfi/sSslBdDf//Kka7TZ3WRmzgD1k/xEYqVd7
+OAFUqoGpX2fCIr0l9Jb30jgFeuHmoE5Xn+HLB8tp
 -----END CERTIFICATE-----
--- a/lib/hx509/data/test.key
+++ b/lib/hx509/data/test.key
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXAIBAAKBgQDM3b2EMYGRiwhGPlqJfg/ZTcQyNqw4HBW0w9DVQvapgw1AxPo+
-VcZdAcL778WB/lunODg8rYVOuJGnNx3miIfv2qn8y8JWDtx4xzN7TOKhx0J10zJ/
-iz2Yfg5CNPgV4kJca34fpYXv9B+1lMZycjcezFNbOvVr3uHYEi/dQQEGbQIDAQAB
-AoGARg/reWMo6ap/uO4oLm9jYjC7UWTrPwEz1y9EozqUeuJrzOPQpTLWdQZeNaUJ
-ieyAUc7jRLUfKw3qGiK6YhX9TshkO1DhvSjpalEMyK8Fg9s+GzqvgdM6L7pLKxIZ
-elI9suRUKi0qS4cEr6O88CRHeDsuaQ1bynuPvBm1rPcOow0CQQDsYX/NhZu74gOW
-WrIB4WypkCRow5DsaQZIH+NS0VnqtY+lTqimonTbEJEuPF7t5pH+ACfm2oPnP8wt
-c/VZzd0XAkEA3d6iDldujhGkRzW34HJ4B0xtzTmHWKRzdRKkf0D9DWw8AxwB6r8P
-TjEL4luoqX9c3FIre/sb96dCO+ipJ24TGwJAP1FinZfjfnFtSpIiypQqukTtK87u
-/BSp5Rn9l4qSjmdyAfLPBEvSB3gpm3v6Zbl0c9hw18rCuGgDdk1wdEzLowJBANyG
-kSUYGjbzqglth1p77Hm0qd62M6UTr/7JjN8/RUa2MeAVUoJ1bU0Wyu0ulbIDedUz
-hy0wJlg900OguaELc8kCQAp3eP5b7NmvEOZaRi+U0M60ENK9SKCGDGBHv40sS7Zw
-gW/rcbCSkdTLYiLeA+xeiImtRYQDh0BX0XFYdiG7NAw=
+MIICXQIBAAKBgQCa36/Dk6QueBDqE1HdkMG6n06MNbs7MiMox+lgoNOGJ89WqJgm
+jYBrVE+ubClnRH0Mro25oQVIfYngNYSvXjh9ukLjBq1fIqanpz98WNLKtmzo0unL
+Zcafn5Y3ft/d+7TujCvr9XRxl1W20o16ULCS/dqPdA/W7FWhDPel/fN3owIDAQAB
+AoGAVP2eWijit7GiLqKtkXbIKd8U3vL5rdGk49NZanK3we6E5RyeasHKkJvzIlgv
+HIHEUjpUgmMwIAjsqgMUrpx5SQNUb2e3ZQx83+u9jBOKCih0CqA3Z/syGNVONwzX
+lcNqR8+XzxWLyjw2xrGmY6kKiMFSWNcF/ipSv+i/ipEcx9kCQQDNAne7b3afAIUC
+SZILCUAwecZAi8JlOeYcx9ilyX/ebUVVzfuc7cCmi6/3amkWLbu2M00kXcX7MTRj
++XNoqXXAkEAwWTt7EZEOUtn7xzovL4IjTVujDs6AWkR+mVVlHU5ry2LFvqoqinq
+k0Po1EDVK7Ch94SQiSzD9UzA6aXDPq1rFQJAVfvF+gAq8U9HegkfTq+nk21PoDy9
+4LTi9YlALXCQx9purSlCcbQqC/AkcpHX12yBAU8M+Ma3xb4Cajj5TkD8awJBAI9b
+xva/u7EREbFxp6DJ6cLrWdA/0ybagUYxOfg70Y/m3dUh6EeDnOyfiYdVq++gFuBJ
+d28ILRa4V8SbaRkcKmUCQQCENcBGVpgLkGa6GwdtrQ+62+WbzKiz5kJ4N01M2SZC
+5+pspQ/3ocPiRMmDUmNQgsUs7fVe17b1RMSzAZ3t4a/9
 -----END RSA PRIVATE KEY-----
--- a/lib/hx509/data/test.p12
+++ b/lib/hx509/data/test.p12