Adding or make functional OpenSSL compat APIs

.github/configs/os-check-linux.json

@@ -6,6 +6,18 @@
  "configure": ["--enable-usersettings"], "prepare": [["sed", "-i", "s/if 0/if 1/", "user_settings.h"]]},
 {"name": "all-no-client-auth", "minutes": 9.0,
  "configure": ["--enable-all", "CPPFLAGS=-DWOLFSSL_NO_CLIENT_AUTH"]},
+{"name": "opensslall-no-aes-128", "minutes": 9.0,
+ "comment": "AES-128 compiled out. Tests that pick a 128 bit key or an AES-128 cipher suite have to say so; --enable-all cannot be used here because it turns on HAVE_CMAC_KDF, which settings.h rejects alongside NO_AES_128.",
+ "configure": ["--enable-opensslall", "--enable-crl", "--enable-ocsp", "--enable-certgen", "--enable-certreq", "--enable-certext", "--enable-keygen", "--enable-aeskeywrap=padding", "CPPFLAGS=-DNO_AES_128"]},
+{"name": "opensslall-single-ec-curve", "minutes": 9.0,
+ "comment": "Only P-256 built. Tests naming P-384 or P-521 have to say so; --enable-all cannot be used here because it defines HAVE_ECC384 and HAVE_ECC521 regardless of ECC_USER_CURVES, which would silently un-restrict the build.",
+ "configure": ["--enable-opensslall", "--enable-crl", "--enable-ocsp", "--enable-certgen", "--enable-certreq", "--enable-certext", "--enable-keygen", "--enable-aeskeywrap=padding", "CPPFLAGS=-DECC_USER_CURVES -DHAVE_ECC256"]},
+{"name": "all-ignore-netscape-cert-type", "minutes": 9.0,
+ "comment": "Builds with the netscape certificate type compiled out. The type is optional, so the code that reads it has to be guarded everywhere; this configuration is what catches a guard that was missed.",
+ "configure": ["--enable-all", "CPPFLAGS=-DIGNORE_NETSCAPE_CERT_TYPE"]},
+{"name": "all-aeskeywrap-padding", "minutes": 9.0,
+ "comment": "--enable-all brings the compatibility layer and RFC 3394 key wrap, but not RFC 5649 padding; this builds and runs the EVP_aes_*_wrap_pad tests.",
+ "configure": ["--enable-all", "--enable-aeskeywrap=padding"]},
 {"name": "all-public-mp", "minutes": 8.0,
  "comment": "--enable-all plus WOLFSSL_PUBLIC_MP. The shared-secret-at-infinity regression assertion needs direct mp access to plant an out-of-range scalar, because the import path itself now rejects one; without this the assertion is compiled out of every mainstream build.",
  "configure": ["--enable-all", "CPPFLAGS=-DWOLFSSL_PUBLIC_MP"]},
@@ -298,6 +310,12 @@
  "configure": ["CPPFLAGS=-DNO_WOLFSSL_SERVER -DWOLFSSL_NO_CLIENT_AUTH"]},
 {"name": "no-wolfssl-client", "minutes": 1.0,
  "configure": ["CPPFLAGS=-DNO_WOLFSSL_CLIENT"]},
+{"name": "static-no-wolfssl-client",
+ "comment": "A static build with the client compiled out. --disable-shared is what defines WOLFSSL_TEST_STATIC_BUILD, and no other entry in this list is a static build, so the tests behind that macro are never compiled anywhere else. Those tests reach for client-only methods unless guarded, which is how the TLSX key share tests came to not compile here at all.",
+ "configure": ["--disable-shared", "--enable-static", "--disable-asm", "--disable-sp-asm", "--enable-tlsv12", "--enable-tls13", "CPPFLAGS=-DNO_WOLFSSL_CLIENT"]},
+{"name": "static-no-wolfssl-server",
+ "comment": "The mirror of static-no-wolfssl-client: the same static build with the server compiled out instead, so a WOLFSSL_TEST_STATIC_BUILD test that reaches for a server-only method is caught the same way.",
+ "configure": ["--disable-shared", "--enable-static", "--disable-asm", "--disable-sp-asm", "--enable-tlsv12", "--enable-tls13", "CPPFLAGS=-DNO_WOLFSSL_SERVER"]},
 {"name": "testwolfcrypt-ca", "minutes": 1.0,
  "comment": "user_settings.h builds running only testwolfcrypt: pure crypto, no platform-specific features, so Linux-only coverage is sufficient. Not converted: user_settings_baremetal.h.",
  "user_settings": "examples/configs/user_settings_ca.h",

certs/any-eku-cert.pem

@@ -0,0 +1,91 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 8 (0x8)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=Montana, L=Bozeman, O=Sawtooth, OU=Consulting, CN=www.wolfssl.com, emailAddress=facts@wolfssl.com
+        Validity
+            Not Before: Sep  2 00:07:02 2026 GMT
+            Not After : May 29 00:07:02 2029 GMT
+        Subject: C=US, ST=Montana, L=Bozeman, O=wolfSSL, OU=AnyEKU, CN=www.wolfssl.com, emailAddress=facts@wolfssl.com
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:c0:95:08:e1:57:41:f2:71:6d:b7:d2:45:41:27:
+                    01:65:c6:45:ae:f2:bc:24:30:b8:95:ce:2f:4e:d6:
+                    f6:1c:88:bc:7c:9f:fb:a8:67:7f:fe:5c:9c:51:75:
+                    f7:8a:ca:07:e7:35:2f:8f:e1:bd:7b:c0:2f:7c:ab:
+                    64:a8:17:fc:ca:5d:7b:ba:e0:21:e5:72:2e:6f:2e:
+                    86:d8:95:73:da:ac:1b:53:b9:5f:3f:d7:19:0d:25:
+                    4f:e1:63:63:51:8b:0b:64:3f:ad:43:b8:a5:1c:5c:
+                    34:b3:ae:00:a0:63:c5:f6:7f:0b:59:68:78:73:a6:
+                    8c:18:a9:02:6d:af:c3:19:01:2e:b8:10:e3:c6:cc:
+                    40:b4:69:a3:46:33:69:87:6e:c4:bb:17:a6:f3:e8:
+                    dd:ad:73:bc:7b:2f:21:b5:fd:66:51:0c:bd:54:b3:
+                    e1:6d:5f:1c:bc:23:73:d1:09:03:89:14:d2:10:b9:
+                    64:c3:2a:d0:a1:96:4a:bc:e1:d4:1a:5b:c7:a0:c0:
+                    c1:63:78:0f:44:37:30:32:96:80:32:23:95:a1:77:
+                    ba:13:d2:97:73:e2:5d:25:c9:6a:0d:c3:39:60:a4:
+                    b4:b0:69:42:42:09:e9:d8:08:bc:33:20:b3:58:22:
+                    a7:aa:eb:c4:e1:e6:61:83:c5:d2:96:df:d9:d0:4f:
+                    ad:d7
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                B3:11:32:C9:92:98:84:E2:C9:F8:D0:3B:6E:03:42:CA:1F:0E:8E:3C
+            X509v3 Authority Key Identifier: 
+                keyid:27:8E:67:11:74:C3:26:1D:3F:ED:33:63:B3:A4:D8:1D:30:E5:E8:D5
+                DirName:/C=US/ST=Montana/L=Bozeman/O=Sawtooth/OU=Consulting/CN=www.wolfssl.com/emailAddress=facts@wolfssl.com
+                serial:67:19:D2:A8:7F:E3:2D:FA:75:7A:4F:E7:B2:02:D9:AD:C4:77:5E:F8
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            X509v3 Key Usage: 
+                Digital Signature, Key Encipherment
+            X509v3 Extended Key Usage: 
+                Any Extended Key Usage
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        b6:67:56:e6:f3:73:c3:b4:bf:85:9a:c2:e8:2e:ed:b7:a8:19:
+        09:5f:c5:71:b1:03:be:fc:b9:c8:66:77:6e:f7:52:67:d8:39:
+        3a:7c:58:7e:51:59:63:55:a0:89:64:83:bd:e4:f4:74:35:e3:
+        99:2c:7b:45:09:2e:88:a0:6c:0a:c5:e3:ba:91:47:22:f8:3c:
+        e1:55:6a:16:77:2c:37:05:82:b1:71:43:40:85:f3:f9:8d:f7:
+        6e:d5:e1:59:f3:2c:cd:18:10:7e:aa:a6:f5:97:ca:ed:a0:cd:
+        53:f6:96:52:b9:43:6f:b4:a2:d5:b2:bf:3b:86:68:9e:56:0f:
+        b4:87:29:4d:a1:14:61:94:72:64:37:ac:2d:f7:5c:ad:14:ba:
+        a2:ff:b1:e6:fd:ae:48:26:c9:a5:38:e7:2a:f2:2e:41:05:10:
+        f4:aa:1a:62:b5:6a:34:de:f7:68:74:78:bb:16:22:89:77:d0:
+        82:f0:07:bc:ce:4e:4e:8f:9b:df:04:b6:82:ae:4b:0e:b9:c9:
+        57:32:d8:31:8e:8f:8a:13:a1:eb:dd:fa:21:6c:24:5a:27:16:
+        07:d7:1d:07:74:4b:9c:9f:96:ae:54:8d:eb:93:10:a8:ef:3f:
+        ea:2b:fe:89:6b:27:5b:d1:23:a7:ec:43:a5:eb:a4:40:e1:97:
+        24:51:f0:83
+-----BEGIN CERTIFICATE-----
+MIIEyDCCA7CgAwIBAgIBCDANBgkqhkiG9w0BAQsFADCBlTELMAkGA1UEBhMCVVMx
+EDAOBgNVBAgMB01vbnRhbmExEDAOBgNVBAcMB0JvemVtYW4xETAPBgNVBAoMCFNh
+d3Rvb3RoMRMwEQYDVQQLDApDb25zdWx0aW5nMRgwFgYDVQQDDA93d3cud29sZnNz
+bC5jb20xIDAeBgkqhkiG9w0BCQEWEWZhY3RzQHdvbGZzc2wuY29tMB4XDTI2MDkw
+MjAwMDcwMloXDTI5MDUyOTAwMDcwMlowgZAxCzAJBgNVBAYTAlVTMRAwDgYDVQQI
+DAdNb250YW5hMRAwDgYDVQQHDAdCb3plbWFuMRAwDgYDVQQKDAd3b2xmU1NMMQ8w
+DQYDVQQLDAZBbnlFS1UxGDAWBgNVBAMMD3d3dy53b2xmc3NsLmNvbTEgMB4GCSqG
+SIb3DQEJARYRZmFjdHNAd29sZnNzbC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IB
+DwAwggEKAoIBAQDAlQjhV0HycW230kVBJwFlxkWu8rwkMLiVzi9O1vYciLx8n/uo
+Z3/+XJxRdfeKygfnNS+P4b17wC98q2SoF/zKXXu64CHlci5vLobYlXParBtTuV8/
+1xkNJU/hY2NRiwtkP61DuKUcXDSzrgCgY8X2fwtZaHhzpowYqQJtr8MZAS64EOPG
+zEC0aaNGM2mHbsS7F6bz6N2tc7x7LyG1/WZRDL1Us+FtXxy8I3PRCQOJFNIQuWTD
+KtChlkq84dQaW8egwMFjeA9ENzAyloAyI5Whd7oT0pdz4l0lyWoNwzlgpLSwaUJC
+CenYCLwzILNYIqeq68Th5mGDxdKW39nQT63XAgMBAAGjggEkMIIBIDAdBgNVHQ4E
+FgQUsxEyyZKYhOLJ+NA7bgNCyh8OjjwwgdUGA1UdIwSBzTCByoAUJ45nEXTDJh0/
+7TNjs6TYHTDl6NWhgZukgZgwgZUxCzAJBgNVBAYTAlVTMRAwDgYDVQQIDAdNb250
+YW5hMRAwDgYDVQQHDAdCb3plbWFuMREwDwYDVQQKDAhTYXd0b290aDETMBEGA1UE
+CwwKQ29uc3VsdGluZzEYMBYGA1UEAwwPd3d3LndvbGZzc2wuY29tMSAwHgYJKoZI
+hvcNAQkBFhFmYWN0c0B3b2xmc3NsLmNvbYIUZxnSqH/jLfp1ek/nsgLZrcR3Xvgw
+CQYDVR0TBAIwADALBgNVHQ8EBAMCBaAwDwYDVR0lBAgwBgYEVR0lADANBgkqhkiG
+9w0BAQsFAAOCAQEAtmdW5vNzw7S/hZrC6C7tt6gZCV/FcbEDvvy5yGZ3bvdSZ9g5
+OnxYflFZY1WgiWSDveT0dDXjmSx7RQkuiKBsCsXjupFHIvg84VVqFncsNwWCsXFD
+QIXz+Y33btXhWfMszRgQfqqm9ZfK7aDNU/aWUrlDb7Si1bK/O4ZonlYPtIcpTaEU
+YZRyZDesLfdcrRS6ov+x5v2uSCbJpTjnKvIuQQUQ9KoaYrVqNN73aHR4uxYiiXfQ
+gvAHvM5OTo+b3wS2gq5LDrnJVzLYMY6PihOh6936IWwkWicWB9cdB3RLnJ+WrlSN
+65MQqO8/6iv+iWsnW9Ejp+xDpeukQOGXJFHwgw==
+-----END CERTIFICATE-----

certs/check_cert_chains.sh

@@ -21,7 +21,11 @@ pairs="rsapss/ecc-leaf-rsapss.pem rsapss/ca-rsapss.pem classic
 mldsa/ecc-leaf-mldsa44.pem mldsa/mldsa44-cert.pem mldsa
 server-cert-sha1.pem ca-cert.pem sha1
 client-cert-sha1.pem ca-cert.pem sha1
-server-cert-sha1-root.pem ca-cert.pem classic"
+server-cert-sha1-root.pem ca-cert.pem classic
+any-eku-cert.pem ca-cert.pem classic
+ns-cert-type-cert.pem ca-cert.pem classic
+ns-ca-only-cert.pem ca-cert.pem classic
+code-sign-cert.pem ca-cert.pem classic"
 
 failed=0
 

certs/code-sign-cert.pem

@@ -0,0 +1,28 @@
+-----BEGIN CERTIFICATE-----
+MIIE0TCCA7mgAwIBAgIBCzANBgkqhkiG9w0BAQsFADCBlTELMAkGA1UEBhMCVVMx
+EDAOBgNVBAgMB01vbnRhbmExEDAOBgNVBAcMB0JvemVtYW4xETAPBgNVBAoMCFNh
+d3Rvb3RoMRMwEQYDVQQLDApDb25zdWx0aW5nMRgwFgYDVQQDDA93d3cud29sZnNz
+bC5jb20xIDAeBgkqhkiG9w0BCQEWEWZhY3RzQHdvbGZzc2wuY29tMB4XDTI2MDkw
+MjA4MDExNVoXDTI5MDUyOTA4MDExNVowgZIxCzAJBgNVBAYTAlVTMRAwDgYDVQQI
+DAdNb250YW5hMRAwDgYDVQQHDAdCb3plbWFuMRAwDgYDVQQKDAd3b2xmU1NMMREw
+DwYDVQQLDAhDb2RlU2lnbjEYMBYGA1UEAwwPd3d3LndvbGZzc2wuY29tMSAwHgYJ
+KoZIhvcNAQkBFhFmYWN0c0B3b2xmc3NsLmNvbTCCASIwDQYJKoZIhvcNAQEBBQAD
+ggEPADCCAQoCggEBAMCVCOFXQfJxbbfSRUEnAWXGRa7yvCQwuJXOL07W9hyIvHyf
++6hnf/5cnFF194rKB+c1L4/hvXvAL3yrZKgX/Mpde7rgIeVyLm8uhtiVc9qsG1O5
+Xz/XGQ0lT+FjY1GLC2Q/rUO4pRxcNLOuAKBjxfZ/C1loeHOmjBipAm2vwxkBLrgQ
+48bMQLRpo0YzaYduxLsXpvPo3a1zvHsvIbX9ZlEMvVSz4W1fHLwjc9EJA4kU0hC5
+ZMMq0KGWSrzh1Bpbx6DAwWN4D0Q3MDKWgDIjlaF3uhPSl3PiXSXJag3DOWCktLBp
+QkIJ6dgIvDMgs1gip6rrxOHmYYPF0pbf2dBPrdcCAwEAAaOCASswggEnMB0GA1Ud
+DgQWBBSzETLJkpiE4sn40DtuA0LKHw6OPDCB1QYDVR0jBIHNMIHKgBQnjmcRdMMm
+HT/tM2OzpNgdMOXo1aGBm6SBmDCBlTELMAkGA1UEBhMCVVMxEDAOBgNVBAgMB01v
+bnRhbmExEDAOBgNVBAcMB0JvemVtYW4xETAPBgNVBAoMCFNhd3Rvb3RoMRMwEQYD
+VQQLDApDb25zdWx0aW5nMRgwFgYDVQQDDA93d3cud29sZnNzbC5jb20xIDAeBgkq
+hkiG9w0BCQEWEWZhY3RzQHdvbGZzc2wuY29tghRnGdKof+Mt+nV6T+eyAtmtxHde
++DAJBgNVHRMEAjAAMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcD
+AzANBgkqhkiG9w0BAQsFAAOCAQEAWNcuUFFKcIucIE1+YrPItb7fLvktk4tVSgpz
+BK5tI2zp/etq4YMqv04hAGUZ26VXriiJwgAxRo/d/bMAnOJpsWD4r/QjcAiCqvAS
+d2tk0eqfHbLOI/hQPowDddUKzM+MeEV0G+GgV4hTMBAEICYdCk9DjlSefHdtnaHD
+Qh5I2Fa/ERK9L8cQGDZ0xfH5Uxn8TmAtH+4BX0NbDjkRkb/4HrpNeVgSbA+9OTOk
+Oiq3EonyAVqWrIWeZBfM2hX8ynUJbrpK1/C7T+wCV9MGlHRudY9al6ujBqfhgock
+VkAEsL8m8vUdtURYSWi0f+72OgqjNjtXZl1GIBoAhdfkJdvy6w==
+-----END CERTIFICATE-----

certs/include.am

@@ -92,6 +92,12 @@ EXTRA_DIST += \
              certs/fpki-cert.der \
              certs/fpki-certpol-cert.der \
              certs/rid-cert.der \
+             certs/any-eku-cert.pem \
+             certs/ns-cert-type-cert.pem \
+             certs/ns-ca-only-cert.pem \
+             certs/code-sign-cert.pem \
+             certs/v1-root-cert.pem \
+             certs/v1-self-issued-cert.pem \
              certs/dh-priv-2048.der \
              certs/dh-priv-2048.pem \
              certs/dh-pub-2048.der \

certs/ns-ca-only-cert.pem

@@ -0,0 +1,28 @@
+-----BEGIN CERTIFICATE-----
+MIIEtDCCA5ygAwIBAgIBCjANBgkqhkiG9w0BAQsFADCBlTELMAkGA1UEBhMCVVMx
+EDAOBgNVBAgMB01vbnRhbmExEDAOBgNVBAcMB0JvemVtYW4xETAPBgNVBAoMCFNh
+d3Rvb3RoMRMwEQYDVQQLDApDb25zdWx0aW5nMRgwFgYDVQQDDA93d3cud29sZnNz
+bC5jb20xIDAeBgkqhkiG9w0BCQEWEWZhY3RzQHdvbGZzc2wuY29tMB4XDTI2MDkw
+MjA3NDE1OFoXDTI5MDUyOTA3NDE1OFowgZIxCzAJBgNVBAYTAlVTMRAwDgYDVQQI
+DAdNb250YW5hMRAwDgYDVQQHDAdCb3plbWFuMRAwDgYDVQQKDAd3b2xmU1NMMREw
+DwYDVQQLDAhOc0NhT25seTEYMBYGA1UEAwwPd3d3LndvbGZzc2wuY29tMSAwHgYJ
+KoZIhvcNAQkBFhFmYWN0c0B3b2xmc3NsLmNvbTCCASIwDQYJKoZIhvcNAQEBBQAD
+ggEPADCCAQoCggEBAMCVCOFXQfJxbbfSRUEnAWXGRa7yvCQwuJXOL07W9hyIvHyf
++6hnf/5cnFF194rKB+c1L4/hvXvAL3yrZKgX/Mpde7rgIeVyLm8uhtiVc9qsG1O5
+Xz/XGQ0lT+FjY1GLC2Q/rUO4pRxcNLOuAKBjxfZ/C1loeHOmjBipAm2vwxkBLrgQ
+48bMQLRpo0YzaYduxLsXpvPo3a1zvHsvIbX9ZlEMvVSz4W1fHLwjc9EJA4kU0hC5
+ZMMq0KGWSrzh1Bpbx6DAwWN4D0Q3MDKWgDIjlaF3uhPSl3PiXSXJag3DOWCktLBp
+QkIJ6dgIvDMgs1gip6rrxOHmYYPF0pbf2dBPrdcCAwEAAaOCAQ4wggEKMB0GA1Ud
+DgQWBBSzETLJkpiE4sn40DtuA0LKHw6OPDCB1QYDVR0jBIHNMIHKgBQnjmcRdMMm
+HT/tM2OzpNgdMOXo1aGBm6SBmDCBlTELMAkGA1UEBhMCVVMxEDAOBgNVBAgMB01v
+bnRhbmExEDAOBgNVBAcMB0JvemVtYW4xETAPBgNVBAoMCFNhd3Rvb3RoMRMwEQYD
+VQQLDApDb25zdWx0aW5nMRgwFgYDVQQDDA93d3cud29sZnNzbC5jb20xIDAeBgkq
+hkiG9w0BCQEWEWZhY3RzQHdvbGZzc2wuY29tghRnGdKof+Mt+nV6T+eyAtmtxHde
++DARBglghkgBhvhCAQEEBAMCAgQwDQYJKoZIhvcNAQELBQADggEBAF1cEysIplz3
+RNxaFTGxOQrvX9WidcBbWzBECrpIjOhT0+x/kZNUdC4cT4cjiQdu0GSwb6dNv5nS
+8nvBypvfw7q5v7VMRBuz7379A0gF4OXaOjAxn0rgi8GADDqzyGS/KTb01ZAZO66T
+WJ3OnWT3JoypLbX/3URLY5d9mLX6y/zoLsScm1k1FiYDxjeEUf5ucbdqw2FkNqQA
+t0rpeVqrAHIMZ08DXJy6+fAg7h2wvKDEVvIfDGTSdGnLyKEkk46B8agYoLnFwqkw
+a/CzizH5vJQGJrwV9TiC7igmGkEJoIoCMYSwJLjie8Jiua/HRWnwPnosGlBGbWnq
+FziSMN5OVJE=
+-----END CERTIFICATE-----

certs/ns-cert-type-cert.pem

@@ -0,0 +1,94 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 9 (0x9)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=Montana, L=Bozeman, O=Sawtooth, OU=Consulting, CN=www.wolfssl.com, emailAddress=facts@wolfssl.com
+        Validity
+            Not Before: Sep  2 00:51:23 2026 GMT
+            Not After : May 29 00:51:23 2029 GMT
+        Subject: C=US, ST=Montana, L=Bozeman, O=wolfSSL, OU=NsCertType, CN=www.wolfssl.com, emailAddress=facts@wolfssl.com
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:c0:95:08:e1:57:41:f2:71:6d:b7:d2:45:41:27:
+                    01:65:c6:45:ae:f2:bc:24:30:b8:95:ce:2f:4e:d6:
+                    f6:1c:88:bc:7c:9f:fb:a8:67:7f:fe:5c:9c:51:75:
+                    f7:8a:ca:07:e7:35:2f:8f:e1:bd:7b:c0:2f:7c:ab:
+                    64:a8:17:fc:ca:5d:7b:ba:e0:21:e5:72:2e:6f:2e:
+                    86:d8:95:73:da:ac:1b:53:b9:5f:3f:d7:19:0d:25:
+                    4f:e1:63:63:51:8b:0b:64:3f:ad:43:b8:a5:1c:5c:
+                    34:b3:ae:00:a0:63:c5:f6:7f:0b:59:68:78:73:a6:
+                    8c:18:a9:02:6d:af:c3:19:01:2e:b8:10:e3:c6:cc:
+                    40:b4:69:a3:46:33:69:87:6e:c4:bb:17:a6:f3:e8:
+                    dd:ad:73:bc:7b:2f:21:b5:fd:66:51:0c:bd:54:b3:
+                    e1:6d:5f:1c:bc:23:73:d1:09:03:89:14:d2:10:b9:
+                    64:c3:2a:d0:a1:96:4a:bc:e1:d4:1a:5b:c7:a0:c0:
+                    c1:63:78:0f:44:37:30:32:96:80:32:23:95:a1:77:
+                    ba:13:d2:97:73:e2:5d:25:c9:6a:0d:c3:39:60:a4:
+                    b4:b0:69:42:42:09:e9:d8:08:bc:33:20:b3:58:22:
+                    a7:aa:eb:c4:e1:e6:61:83:c5:d2:96:df:d9:d0:4f:
+                    ad:d7
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                B3:11:32:C9:92:98:84:E2:C9:F8:D0:3B:6E:03:42:CA:1F:0E:8E:3C
+            X509v3 Authority Key Identifier: 
+                keyid:27:8E:67:11:74:C3:26:1D:3F:ED:33:63:B3:A4:D8:1D:30:E5:E8:D5
+                DirName:/C=US/ST=Montana/L=Bozeman/O=Sawtooth/OU=Consulting/CN=www.wolfssl.com/emailAddress=facts@wolfssl.com
+                serial:67:19:D2:A8:7F:E3:2D:FA:75:7A:4F:E7:B2:02:D9:AD:C4:77:5E:F8
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            X509v3 Key Usage: 
+                Digital Signature, Key Encipherment
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, TLS Web Client Authentication
+            Netscape Cert Type: 
+                SSL Client
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        45:f2:69:de:54:df:5c:69:6c:a1:2b:e2:78:07:a2:1a:11:3f:
+        04:e8:c8:0c:4e:fe:0d:e5:72:a7:92:b1:6b:b2:48:f4:59:19:
+        c3:b6:3b:b6:52:c8:b9:76:83:85:0b:f5:b5:fd:20:ff:77:e6:
+        f9:b1:77:d7:eb:58:6f:cd:16:f4:11:b5:9c:61:16:7e:1f:92:
+        68:98:9c:16:35:cd:98:ae:40:f4:84:96:45:40:8b:3c:31:4d:
+        3d:38:1f:57:3b:13:15:40:a7:e6:ad:ca:18:4b:91:18:e5:9d:
+        92:95:3d:1d:c4:a0:2d:74:37:ae:9e:72:d5:e5:cd:0f:24:c3:
+        80:11:ed:39:61:6b:d4:14:9a:a6:c0:ee:21:32:2a:99:c5:e8:
+        e8:c6:95:f4:4d:12:59:12:67:aa:59:e2:c4:66:7b:e2:e2:ab:
+        4c:b9:d9:63:d7:f8:32:70:d2:15:76:88:cd:c3:9a:00:45:5d:
+        32:f1:6d:c1:fb:05:13:c2:d1:70:55:60:b5:14:27:d8:eb:c6:
+        20:fb:81:28:08:4d:8b:bd:95:17:52:98:e6:62:79:8e:30:1f:
+        d9:ef:93:c9:a4:6c:5a:f4:34:4b:2b:cc:29:91:90:96:2e:75:
+        1a:44:49:c9:98:a1:6d:3f:ae:7e:e3:57:06:dc:d0:23:78:cd:
+        f3:1c:65:54
+-----BEGIN CERTIFICATE-----
+MIIE7TCCA9WgAwIBAgIBCTANBgkqhkiG9w0BAQsFADCBlTELMAkGA1UEBhMCVVMx
+EDAOBgNVBAgMB01vbnRhbmExEDAOBgNVBAcMB0JvemVtYW4xETAPBgNVBAoMCFNh
+d3Rvb3RoMRMwEQYDVQQLDApDb25zdWx0aW5nMRgwFgYDVQQDDA93d3cud29sZnNz
+bC5jb20xIDAeBgkqhkiG9w0BCQEWEWZhY3RzQHdvbGZzc2wuY29tMB4XDTI2MDkw
+MjAwNTEyM1oXDTI5MDUyOTAwNTEyM1owgZQxCzAJBgNVBAYTAlVTMRAwDgYDVQQI
+DAdNb250YW5hMRAwDgYDVQQHDAdCb3plbWFuMRAwDgYDVQQKDAd3b2xmU1NMMRMw
+EQYDVQQLDApOc0NlcnRUeXBlMRgwFgYDVQQDDA93d3cud29sZnNzbC5jb20xIDAe
+BgkqhkiG9w0BCQEWEWZhY3RzQHdvbGZzc2wuY29tMIIBIjANBgkqhkiG9w0BAQEF
+AAOCAQ8AMIIBCgKCAQEAwJUI4VdB8nFtt9JFQScBZcZFrvK8JDC4lc4vTtb2HIi8
+fJ/7qGd//lycUXX3isoH5zUvj+G9e8AvfKtkqBf8yl17uuAh5XIuby6G2JVz2qwb
+U7lfP9cZDSVP4WNjUYsLZD+tQ7ilHFw0s64AoGPF9n8LWWh4c6aMGKkCba/DGQEu
+uBDjxsxAtGmjRjNph27Euxem8+jdrXO8ey8htf1mUQy9VLPhbV8cvCNz0QkDiRTS
+ELlkwyrQoZZKvOHUGlvHoMDBY3gPRDcwMpaAMiOVoXe6E9KXc+JdJclqDcM5YKS0
+sGlCQgnp2Ai8MyCzWCKnquvE4eZhg8XSlt/Z0E+t1wIDAQABo4IBRTCCAUEwHQYD
+VR0OBBYEFLMRMsmSmITiyfjQO24DQsofDo48MIHVBgNVHSMEgc0wgcqAFCeOZxF0
+wyYdP+0zY7Ok2B0w5ejVoYGbpIGYMIGVMQswCQYDVQQGEwJVUzEQMA4GA1UECAwH
+TW9udGFuYTEQMA4GA1UEBwwHQm96ZW1hbjERMA8GA1UECgwIU2F3dG9vdGgxEzAR
+BgNVBAsMCkNvbnN1bHRpbmcxGDAWBgNVBAMMD3d3dy53b2xmc3NsLmNvbTEgMB4G
+CSqGSIb3DQEJARYRZmFjdHNAd29sZnNzbC5jb22CFGcZ0qh/4y36dXpP57IC2a3E
+d174MAkGA1UdEwQCMAAwCwYDVR0PBAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMB
+BggrBgEFBQcDAjARBglghkgBhvhCAQEEBAMCB4AwDQYJKoZIhvcNAQELBQADggEB
+AEXyad5U31xpbKEr4ngHohoRPwToyAxO/g3lcqeSsWuySPRZGcO2O7ZSyLl2g4UL
+9bX9IP935vmxd9frWG/NFvQRtZxhFn4fkmiYnBY1zZiuQPSElkVAizwxTT04H1c7
+ExVAp+atyhhLkRjlnZKVPR3EoC10N66ectXlzQ8kw4AR7Tlha9QUmqbA7iEyKpnF
+6OjGlfRNElkSZ6pZ4sRme+Liq0y52WPX+DJw0hV2iM3DmgBFXTLxbcH7BRPC0XBV
+YLUUJ9jrxiD7gSgITYu9lRdSmOZieY4wH9nvk8mkbFr0NEsrzCmRkJYudRpEScmY
+oW0/rn7jVwbc0CN4zfMcZVQ=
+-----END CERTIFICATE-----