Keep the original DER encoding around when decoding certificates so hx509_cert_binary() does not rewrite certificates unnecessarily. Add regression coverage for direct certificate binary output and keyless stores.
Roland C. Dowdeswell