From 146e87ece9ab49abe63a74e6e0f20f2ac0d6d27e Mon Sep 17 00:00:00 2001
From: Joni Hahkala <joni.hahkala@cern.ch>
Date: Thu, 16 Dec 2010 17:28:44 +0000
Subject: [PATCH] Add test certs with hostname of the host generating the certs
 in altname and altname with just emailaddress.

---
 bin/generate-ca-certificates-for-cvs.sh |   2 +-
 bin/generate-test-certificates.sh       |  37 +++++-
 config/req_conf.cnf                     |  12 ++
 doc/README                              |   7 ++
 test/bad-ca/bad.cert                    |  28 ++---
 test/bad-ca/bad.p12                     | Bin 1789 -> 1789 bytes
 test/bad-ca/bad.priv                    |  26 ++---
 test/bad-ca/req_conf.cnf                |  12 ++
 test/big-ca/big.cert                    | 102 ++++++++---------
 test/big-ca/big.p12                     | Bin 7629 -> 7629 bytes
 test/big-ca/big.priv                    | 194 ++++++++++++++++----------------
 test/big-ca/req_conf.cnf                |  12 ++
 test/expired-ca/expired.cert            |  26 ++---
 test/expired-ca/expired.p12             | Bin 1797 -> 1797 bytes
 test/expired-ca/expired.priv            |  26 ++---
 test/expired-ca/req_conf.cnf            |  12 ++
 test/fake-ca/fake.cert                  |  28 ++---
 test/fake-ca/fake.p12                   | Bin 1789 -> 1789 bytes
 test/fake-ca/fake.priv                  |  26 ++---
 test/fake-ca/req_conf.cnf               |  12 ++
 test/nokeyusage-ca/nokeyusage.cert      |  24 ++--
 test/nokeyusage-ca/nokeyusage.p12       | Bin 1813 -> 1813 bytes
 test/nokeyusage-ca/nokeyusage.priv      |  26 ++---
 test/nokeyusage-ca/req_conf.cnf         |  12 ++
 test/root-ca/req_conf.cnf               |  12 ++
 test/root-ca/root.cert                  |  28 ++---
 test/root-ca/root.p12                   | Bin 1789 -> 1789 bytes
 test/root-ca/root.priv                  |  26 ++---
 test/slash-ca/req_conf.cnf              |  12 ++
 test/slash-ca/slash.cert                |  22 ++--
 test/slash-ca/slash.p12                 | Bin 1885 -> 1885 bytes
 test/slash-ca/slash.priv                |  26 ++---
 test/subca-ca/index.txt                 |   2 +-
 test/subca-ca/req_conf.cnf              |  12 ++
 test/subca-ca/subca.cert                |  68 +++++------
 test/subca-ca/subca.p12                 | Bin 1789 -> 1789 bytes
 test/subca-ca/subca.priv                |  26 ++---
 test/subca-ca/subca.req                 |  14 +--
 test/subsubca-ca/index.txt              |   2 +-
 test/subsubca-ca/req_conf.cnf           |  12 ++
 test/subsubca-ca/subsubca.cert          |  64 +++++------
 test/subsubca-ca/subsubca.p12           | Bin 1781 -> 1781 bytes
 test/subsubca-ca/subsubca.priv          |  26 ++---
 test/subsubca-ca/subsubca.req           |  14 +--
 test/trusted-ca/req_conf.cnf            |  12 ++
 test/trusted-ca/trusted.cert            |  26 ++---
 test/trusted-ca/trusted.p12             | Bin 1797 -> 1797 bytes
 test/trusted-ca/trusted.priv            |  26 ++---
 48 files changed, 612 insertions(+), 442 deletions(-)

diff --git a/bin/generate-ca-certificates-for-cvs.sh b/bin/generate-ca-certificates-for-cvs.sh
index 0817536..751f8b0 100755
--- a/bin/generate-ca-certificates-for-cvs.sh
+++ b/bin/generate-ca-certificates-for-cvs.sh
@@ -21,6 +21,7 @@ CATYPES='trusted bad fake big expired nokeyusage root subca subsubca slash'
 #CATYPES='slash'
 BIG_BITS=8192
 SMALL_BITS=1024
+export DNS_HOSTNAME=DNS:$HOSTNAME
 
 function create_ca {
     catype=$1
@@ -112,7 +113,6 @@ function generate_ca_cert {
     bits=$5           # number of bits for the CA cert
     export CASROOT=../
     
-
     echo `pwd`
 
     if [ "$catype" = "slash" ]; then
diff --git a/bin/generate-test-certificates.sh b/bin/generate-test-certificates.sh
index cfee168..0fb17e2 100755
--- a/bin/generate-test-certificates.sh
+++ b/bin/generate-test-certificates.sh
@@ -100,7 +100,7 @@ function create_cert {
     fi
 
     case $flags in
-        client|server|clientserver|fclient|none|altname)
+        client|server|clientserver|fclient|none|altname|altname2|altname3)
             echo "Generating a $flags certificate"
             echo $CA_DIR
 	    echo PDW=`pwd`
@@ -700,6 +700,13 @@ function create_all {
 
     PROXY_VALIDITY=10000
 
+	echo $DNS_HOSTNAME
+	
+	TYPE="altname2"
+	CTYPE="altname"
+	
+	create_cert $CERT_DIR/${catype}_${TYPE} "$catype hostname only in altname" ${TYPE} $DAYS
+	
     TYPE="client"
     CTYPE="client"
 
@@ -894,9 +901,31 @@ function create_all {
 	create_cert $CERT_DIR/${catype}_${TYPE} "$catype\/xxx.foo.bar" ${TYPE} $DAYS
 	
 	TYPE="altname"
-	CTYPE="altname2"
+	CTYPE="altname"
 	
-	create_cert $CERT_DIR/${catype}_${TYPE}2 "xxx.foo.bar" ${TYPE} $DAYS
+	create_cert $CERT_DIR/${catype}_${TYPE}_2 "$catype altname/CN=xxx.foo.bar" ${TYPE} $DAYS
+
+	echo $DNS_HOSTNAME
+	
+	TYPE="altname2"
+	CTYPE="altname"
+	
+	create_cert $CERT_DIR/${catype}_${TYPE} "$catype hostname only in altname" ${TYPE} $DAYS
+	
+	TYPE="altname2"
+	CTYPE="altname"
+	
+	create_cert $CERT_DIR/${catype}_${TYPE}_2 "$catype altname cont hostname/CN=$HOSTNAME" ${TYPE} $DAYS
+	
+	TYPE="altname3"
+	CTYPE="altname"
+	
+	create_cert $CERT_DIR/${catype}_${TYPE} "$catype altname but no hostname anywhere" ${TYPE} $DAYS
+	
+	TYPE="altname3"
+	CTYPE="altname"
+	
+	create_cert $CERT_DIR/${catype}_${TYPE}_2 "$catype altname without hosname/CN=$HOSTNAME" ${TYPE} $DAYS
 	
 	TYPE="server"
 	CTYPE="server2"
@@ -1071,6 +1100,8 @@ VOMS='no'
 # if we only show environmental settings
 ONLYENV='no'
 
+export DNS_HOSTNAME=DNS:$HOSTNAME
+
 while true; do
     case "$1" in
         -a|--all)
diff --git a/config/req_conf.cnf b/config/req_conf.cnf
index 68b12c6..21270d8 100644
--- a/config/req_conf.cnf
+++ b/config/req_conf.cnf
@@ -71,6 +71,18 @@ nsCertType		= server
 nsComment		= "OpenSSL Generated Server Certificate"
 subjectAltName 		= DNS:*.hoo.org,DNS:joo.haa.org,IP:123.124.220.1,DNS:g*a.e*.com
 
+[ ca_altname2 ]
+# This is OK for an SSL server.
+nsCertType		= server
+nsComment		= "OpenSSL Generated Server Certificate"
+subjectAltName		= $ENV::DNS_HOSTNAME
+
+[ ca_altname3 ]
+# This is OK for an SSL server.
+nsCertType		= server
+nsComment		= "OpenSSL Generated Server Certificate"
+subjectAltName 		= email:john.doe@foo.bar
+
 [ ca_client ]
 # For normal client use this is typical
 nsCertType 		= client, email
diff --git a/doc/README b/doc/README
index 42e6d21..3b34532 100644
--- a/doc/README
+++ b/doc/README
@@ -66,3 +66,10 @@ This command will also put the CA cert and signing policy for EACH CA except for
                                    certificates/
                                                 <CA hash>.0
                                                 <CA hash>.signing_policy
+
+trusted_altname.cert - hostname xxx.foo.bar in CN with trusted/ prefix emulating service prefix. altname has DNS:*.hoo.org, DNS:joo.haa.org, IP Address:123.124.220.1, DNS:g*a.e*.com. Should work for corresponding hosts.
+trusted_altname.cert - hostname xxx.foo.bar in CN. altname has DNS:*.hoo.org, DNS:joo.haa.org, IP Address:123.124.220.1, DNS:g*a.e*.com. Should work for corresponding hosts.
+trusted_altname2.cert - hostname of machine where generated only in the altname. Should work.
+trusted_altname2_2.cert - hostname of machine where generated both in CN and altname. Should work.
+trusted_altname3.cert - altname with email address and no hostname anywhere. should fail as a host certificate.
+trusted_altname3_2.cert - altname with email address, but hostname in CN. Should work.
\ No newline at end of file
diff --git a/test/bad-ca/bad.cert b/test/bad-ca/bad.cert
index cd9f2c1..51504c4 100644
--- a/test/bad-ca/bad.cert
+++ b/test/bad-ca/bad.cert
@@ -1,19 +1,19 @@
 -----BEGIN CERTIFICATE-----
-MIIC/zCCAmigAwIBAgIJAPe3/MmuJUjsMA0GCSqGSIb3DQEBBQUAMFkxCzAJBgNV
+MIIC/zCCAmigAwIBAgIJAPyX1GUEW7U4MA0GCSqGSIb3DQEBBQUAMFkxCzAJBgNV
 BAYTAlVHMQ8wDQYDVQQHEwZUcm9waWMxDzANBgNVBAoTBlV0b3BpYTETMBEGA1UE
-CxMKUmVsYXhhdGlvbjETMBEGA1UEAxMKdGhlIGJhZCBDQTAeFw0xMDEwMjAxNjUy
-MTZaFw0zODAzMDcxNjUyMTZaMFkxCzAJBgNVBAYTAlVHMQ8wDQYDVQQHEwZUcm9w
+CxMKUmVsYXhhdGlvbjETMBEGA1UEAxMKdGhlIGJhZCBDQTAeFw0xMDEyMTYxNzIz
+MDlaFw0zODA1MDMxNzIzMDlaMFkxCzAJBgNVBAYTAlVHMQ8wDQYDVQQHEwZUcm9w
 aWMxDzANBgNVBAoTBlV0b3BpYTETMBEGA1UECxMKUmVsYXhhdGlvbjETMBEGA1UE
-AxMKdGhlIGJhZCBDQTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEApkPGi7SK
-Yqfmuu+uGMgL6nvBmaYGa3nzrnhBjSn8U9BoUbZE8xPEDUOSR7hmaSB/H4I2vdie
-0axwzrbqi7CQfnW9lqq7Wbb582pZLWMsX8z9rjL0eNVso+6QonddPGdis7OVeaxk
-OpxqIwXv9nyF60wwKvSre3pLQ4+n4q5XFTMCAwEAAaOBzjCByzAMBgNVHRMEBTAD
-AQH/MB0GA1UdDgQWBBRfaPHxjoe71DDa0e3Bua0GUCcUSDCBiwYDVR0jBIGDMIGA
-gBRfaPHxjoe71DDa0e3Bua0GUCcUSKFdpFswWTELMAkGA1UEBhMCVUcxDzANBgNV
+AxMKdGhlIGJhZCBDQTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAyFjAIRIE
+hy7WExZv2wzxQhCjS83hm7MFHhTsL5n+mkWWkpVQaLmGWXrnyn3IUbD2lu5KysL6
+Y3lYqlYBy+z47C0cGLfhLN3K5b5FLSgG+lGGwVdjWIlh3OrLIF/JPvkiqvUyj4vM
+cnHKFLrhCJwH9QfkJaoQPTu2MxWQFt8XEnMCAwEAAaOBzjCByzAMBgNVHRMEBTAD
+AQH/MB0GA1UdDgQWBBQuDrF3Ok8SCnxrWpbzpcVrOGfXdjCBiwYDVR0jBIGDMIGA
+gBQuDrF3Ok8SCnxrWpbzpcVrOGfXdqFdpFswWTELMAkGA1UEBhMCVUcxDzANBgNV
 BAcTBlRyb3BpYzEPMA0GA1UEChMGVXRvcGlhMRMwEQYDVQQLEwpSZWxheGF0aW9u
-MRMwEQYDVQQDEwp0aGUgYmFkIENBggkA97f8ya4lSOwwDgYDVR0PAQH/BAQDAgEG
-MA0GCSqGSIb3DQEBBQUAA4GBABFHTqKL33d9OCX3hEyxZx696elbJuqfiXzLzWOB
-y7AQXkHnOI7xv3ooxbzMJnrAG67f+JnyneGoLB4FnFeMoOWIt2B05ebmlvaJzAHX
-+Fdqp2ZE2nADgMJ1+YREPOIlmpOttOAKjYMU9Og4rExdlM2Vp9+zCPhBBfiHGkY1
-wTZ2
+MRMwEQYDVQQDEwp0aGUgYmFkIENBggkA/JfUZQRbtTgwDgYDVR0PAQH/BAQDAgEG
+MA0GCSqGSIb3DQEBBQUAA4GBAMT1HF5n25PgC9dybe2AQzGV9iFIU7KDITtNmGwJ
+iOQ6eg+p5d037jxHNSF0EJjAAfCJDGUOn4bZhEDv8zDzVUuuY63yngZ5arVDZaZT
+EUF00J6JI389GNqg1ZxpYgSu5gkiSEydr0g5NL6Gu0JsCp5ZVNP1k/thUGqavxMw
+feKY
 -----END CERTIFICATE-----
diff --git a/test/bad-ca/bad.p12 b/test/bad-ca/bad.p12
index c020d9296300df9c5e4bbf86d34ec323972dc9e3..9673666d39af0949a2916febe20f4b337c866469 100644
GIT binary patch
delta 1658
zcmV-=28H?k4gC#}U4H_KWvI2-agG842mpYB17J1x(BC;D)%!9i&LR0Z5z)>DTI+k*
z@!R{Ri-jO>$OOsNYGjx%btKI2%QM?ube!1l?9^~n0{Q4Bi**cR4=z71!st37IsDDp
z1u2e#>a(+Xe`W`LC*9KU9dc>UFYBM=!tD!N=}7Z7%7q^IHGiaP`Uy5!3S)ddJv<!r
z-NoZw;iIV(F)iyQMi@&NE%dr^&skDVAeJxG=|Rl$%+g`;al-(!?8{(LtkGL9ZKq%_
z&okTJwd;CjAFvs@c?8KU-auN4Qr~&m&jD2g<AhfW9GZpMzT!IsjwlYJbWvZl2&$yG
zUM8=<a8t;E`G25=)shhciEkl0!T8F-sLmDF>EO4lBGEugjHyw9LJ|@C-pkW^9^ujM
zC}Fk$t@^%$KlYYscpi5oDg6)|xpn_D7?C{EO1`SJyhl+y@4K1EkNJH2*-C(J<KWAE
zTYxs>KEK#Re<xe^5mVKIcI}WugLwNUh4$t_+XS3TiGRo7?+71G3;!ayS=R@CNg{H)
zeNvDcFKuiO*S|8aSmDXH+DlY@aR9t6bTV$@T8Og6=lma=QG_pTeP*WV+R#!)5bq(+
zz+4WEYL{8W<Gk8F;&Ua>&fW_$z%Voe2{J?>bh6%Y!hi147Ox%kGoG1WM(gBdkv2Jm
zS!tV8`+tGV{@1YbJ=WwnY4BJ;?oY^ANx{7b1w&ENG)8OrT)~&Mksnkrx1C*1maW;$
z#Lzqw#0l4~nQVsoT7SeNC_}hcXq4JdB<U<D5W{7uE26;bY;B(^_osu9B5KSKYYp>^
zYcR=&eFF8h$Tc3)S!+*YX@Nh8<y1&=IGBp4B!3l%i&QO{yZE<79Qf=yr0A@vrl%^$
zF+(~4rFDPq2}yE>vPG!b$>7JWXHO+X4^Nhp+77pHajEt)h$h?nRlyDrj}@5MvD{02
z#q0W@5|~B?HTMg*-44G=ik3$~-e4zaYpqU*6hz>h5}(O>kTt4rsd<Vc$G0s2az~7P
z#eZl@$nh7ouRUh9?=r>@r`$lQhq-J$GG7yzCtt2MAI>SI{+)6caXy%{hX!=LlFo39
z4!3f!j+QsMS>KE@w;w2!9{!ogl@3pE7-{V@aOs1M%V2)L9%Pn-o&5Dy?Qf$~oswf*
zUu#i!l-@Dg+v-%#plphLFoFX41_>&LNR!qBJ%2a9UFxYIy@>(>2ml0v0)Pwbe}-iR
z?Vs0yJ%%V$nDNGo_*Gy`<fU_+k`=UljPW!(p3ry!444}&VKJz~%YPLy33VE7O&%^c
zg4FW>i--Aw3CB!Wr0WV0E|Qykr4C9n#3nj@4pV)}a+{GBWLHrUq9b0uoZ2?yJ~btW
zihp=^@FJQUoc1F6ph}dsKB*7#WVir%{h9ALRZUW#U?mOY|8eb+9N~`jeW3(g1RNx>
zhxsD&K1`?q{(j;~u`Xd$0Es5nBY-H|w=J^yN50hVa(6uheM3(ps13G&+~KIE7B{So
zX6HYj9fzC=*4KQEKk}baZQepH5(UUA27jqNTt0-;-&^(LjRS3`<5qFD3Gn-v`B{o#
z>pNAu4tn0(TPH5hnx@7SBQ)BOm3~-H;9#qoL39YANwMXgf?YQq*(X9Az#VKCw4k;M
zI26zP`y0947jl8Cy<Vt5q&N4KKXfr;-)*2`0)`>>pfN6h8y*oc{}H)fW6y2eE`PWA
z4;!kEKxe)6G_?`Ymf+=air3iqk61bkdcb{(nkv;wf!)f9ZzADU1V3rNX)K@66;ZRy
zWkNr<vSzJ!r624_YpA6r!?6WDmc;3ct~N&O0+_JNi?K+<ZZZ9OJQHjpK&gGP6+kFN
zA{}jmN&Q&FB-xxmw_QpAHraVoFn^ZrRYg&)fLAq67UM?Jr*jk`qfrU%Iz*{k)oKmt
z(n|n)iL^+5Dp_5I7nrVn03ic{hyHGUxuilarAYddRH(ip3}9Apexj&7uPd7ZjFY(&
z1v-7zw)bE-3l;<ocoZZj{HWKfePMT?17AVf3m%-dSAjFbX&HXSq9<Af)NfA9?$IHx
zcyndB1kI%AA9&MZ!H2dnB`_lf2`Yw2hW8Bt2^BFG1QZwfq&yP;cIL^=7bH%f{q&U?
z+;%WAFd;Ar1_dh)0|FWa00b0u6dx(6ME(>x8m$>lW1wUvvg*(T2-f+ub4rDoqXGg5
E0MK9<;s5{u

delta 1658
zcmV-=28H?k4gC#}U4H?f#6a#KEe-+#2mpYB17H{f-!)r6+$Rs@DOdz(EyCi+otrkY
zK@KqCUa1VC9J5%mY^mV!@~yOV{VpfRd`GdRyYdunGw@z&iwN}y{AG4b=_dThSriq^
zD&<Cn>INPeu+F1l4a}a6`?09*V@ht!nqj!l<-;C?6m@$*I)DDdn^R)SByc*SA99!#
z&zc(6<CRLIKMVj}+l#DW<mC)uP;1^e+KVu8WpY!c?$Hb)<UK^~Fu$k-7(9yYMZSU)
zqXAhbkA)UY(4~qPGmZ?HjL;pS3E++!WqM~W2_KXW8|KT7i^*$C{fN_JPYEjnr%)57
zU(N7!pJ5gztAA)FmM3kua<MF5zTpFkU4s_HYqiXT9Bp>=nc;5UR!B?Gd1lM#z%Vrb
zCNUsDTB(nD`GAMKTANY8g;%O4&X9ZfM;LDLQ_IVu7#Mtam0Ndu#8H9cO`qz%@r>)%
z9_YZz3EU5)p|$dFyb)qGo!Hj;L$+=;(SNreg<*_Q-+$#k1m(a}K-T;0z>o1H%Vs(x
zWk5yAhwjDreB$7FoH>@<TC5Hoj23m}*#iZpiUj{}lmJB(os2{v7+e1722t3wlFlM<
z{H`Xrsx%a40`y(4$K!$WjC}Skrv1J2hL-1aG%}@QSiJ4c{aSGt2=<VHpV@e>Xy^_-
z3cqYnLx1#4+l1Ol$@SW)7@42lkCx7=>npqRtdEPD;8(D-WllLw*Wf@EZMc3xg2*{r
z5gXd--Y!1qt?EdL?kM>jt9C+;uHYw=lOMCXgV-Po@AT4aW<HkyldiBZC!~%!$_n~S
zKf-yzC;l$ua4Iw99ZlQ;iuZ^IkFZ(Y2Qr~<Du3T9*o0pNPok^jTtjw##Puu_za5N{
z=du+=mbrLT?_0}s_c9tw7VpG&7uMJa{95Z4Y<2}&@=GPwXd>E@?TK_BaZwAJrLFe3
zAk3(xGzx`sXtE?)max1$#QSdAG;IwZqCzj(QH8<I!z0xg&5AdmMzyDrf>LnF3(Ny-
zLVt>THr`HbzPv6I!uYl@#Ts*R?whbKob48h1-(QPNl~RtoqTp!XoWYyml>4*c1aDS
z2P>{#ctg7?FffhQBBDEvJDS^RHK*HLf0~x!_C`!^b*D&pQued_9hO+nq@1VwjDlba
zurSK!J~Cad?psd)QjHFUFoFX41_>&LNR!qBJ%5VRtDss9VuS($2ml0v0)TH1xzt<T
zAUL`GLi(TGXA_T=Ju({rCnA&Z*CNRDp-(d%@<KKoMEJCd9N(}r#uaTk(3-?_oGZ(-
ze#vw|HWzX|qpdmPs!=wq_9y;j<5N7`E?(MRXLneve9fIQ<27ZlLohi(wEGZU&rs-4
zb$=83p7)d`v}j{-1;OYN2YXE-dF<f@1>$=*l_qVi3&={B>TKdp<1!$?oNn8ct#zTf
z9gnj4saIYtM_4t)#qwwzcr`1RDev!2(f8CV=Zsof&dLtdZ5+<C-SIwygN|{3Q>%({
z*?Crk$1QX)cr2~44VUV36pecD(ignu9DmHQQq{Q}?~~(@IKMb0$Z)9Y$zpo6ROA;e
zO*GUhmfq$|ry7pVoDPG0jRE1bU)ef62(RuIuyT^oUqv!@42g33;`1btKyJEjbfSt*
z4jp#`^Ket56Xvlp7;C-{a#KJ{GLk$_H{vg;fBldvEL`a@9~Sx#M+okOY^rA8WPeNC
zfGZ*-GDKXC$Tu08V5~{u{+7AKK!?+S#@Td5$wHEtiXK%mqm%O#s2K)Ua})D}^jKEM
zeEn3>?oA;nZWJLZhp<{>t~VtWaz@rpvJ01NB1sWoBS=wT=x}>!Yi6d=@+e^=_KDKh
z@%x8?)Jargm%okk?M!#xy-^Ge;eP<|kx*<63n{Oi!6IVw*nE+=k5k#{nPjT3+3uwg
z5y~7}PN}&x8X9v~i~6|vby0l#i+7XM!$$?Q$(xO`nDi@E%t%4GNp~TfR~5}?l<nmk
zxYGx6yw7k^0g19r@ZBg9tZR#_9pTo~*)u6qz_mAR4dF@B+Na+askZ=T`ELfK>}+B$
z;k^tkXQL|vZ}2`-{-TyKB`_lf2`Yw2hW8Bt2^BFG1Qejv%%DWNmr(miC+06SM7^A@
zhNdtvFd;Ar1_dh)0|FWa00a~p^PsS&(3aTN`@jktTB_#e?q=--2qp`m+LMl0Mgjr|
E0OYYFi~s-t

diff --git a/test/bad-ca/bad.priv b/test/bad-ca/bad.priv
index 5a56659..0faee27 100644
--- a/test/bad-ca/bad.priv
+++ b/test/bad-ca/bad.priv
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXAIBAAKBgQCmQ8aLtIpip+a6764YyAvqe8GZpgZrefOueEGNKfxT0GhRtkTz
-E8QNQ5JHuGZpIH8fgja92J7RrHDOtuqLsJB+db2WqrtZtvnzalktYyxfzP2uMvR4
-1Wyj7pCid108Z2Kzs5V5rGQ6nGojBe/2fIXrTDAq9Kt7ektDj6firlcVMwIDAQAB
-AoGAbd49llYQWE8RNhhqGDAhR6rN7SV7+ouUzobi8lB7UDtYpB5pA6PdGtK7GC+v
-ZOq3dm/KkrtRf8aOqNrQtMxRPl6oeszQ2BH9tuUzXyx2UnoXwHodGRPO6kJB2iTH
-JklwCjerjZCjJzTQiO+ZS1lWBICmmVnE+RQov17yjcxk1pkCQQDZ0/q9iK4XZRtw
-VX1XcDeW8kIhhBC3p3TTUSfIRdL97d+XM7qRL2G5sBxBg3z+hpgerC7n/cbqfjOQ
-rMRZ+ny9AkEAw2abPTWS0hIrYqYCZBmPx8Ah9YpTmUldqCMJpQdZtUXG2oOEK229
-A55bcJIftTZmu/oXjvedcSDemmafYpAQrwJBAJUOd3AnDWo457PQ7DpfMcr678Hb
-i00BK/JGgICNNzpIAk6HOU2MLMVR+6PhBDFvjLzAekCJ6gogXczMTHh97ckCQCbB
-BO0A4Ru06tHn5vV/dFrDqniOdMIkIOUl/dWzPYGMU0Inb2FFpIVBNRWAhbVlEr8Z
-fO6oAZvcTwoEbHwZ4pUCQGzf1po97EbwqQhSEcLC4KQa7J2ZH3WTueOm6V/fkWqe
-sR4ezWgPMbMmZ4N2mnRrHEIJGsclVeL3x0vrfzLNn6E=
+MIICXAIBAAKBgQDIWMAhEgSHLtYTFm/bDPFCEKNLzeGbswUeFOwvmf6aRZaSlVBo
+uYZZeufKfchRsPaW7krKwvpjeViqVgHL7PjsLRwYt+Es3crlvkUtKAb6UYbBV2NY
+iWHc6ssgX8k++SKq9TKPi8xyccoUuuEInAf1B+QlqhA9O7YzFZAW3xcScwIDAQAB
+AoGAKoBhaeKXoVH3Sh9VZWPufnRnH/qyJMSqjkIkBMkncPTYR4pzf3P0I2FmcNeU
+OnhPJ5+vsCoC0j146NHMGcXQ3HFyOJkH0JdQVw4+DtV361mmQ82rLI8wPnACw4oN
+CLG2NyZFBhisxsk8n2H7MdblAFcEwNUDkePF2L9pdbspXWkCQQDkF87ohjcbf35r
+yI3oJqcu10GkD6HGblnGOMakrloBDbXDg8CqcNHOYhCDWxZnvwZdVTvnIUM8Ky6R
+2vIpu7D3AkEA4NvjhP6t9pI23bnc/31R33c4Lzr/w3htImB1ckBjeRr/+a9RJDgL
+ZfjYEbESxpTYkeaxKc0ZDhzgzmzGygiHZQJBAJkvXChRq0TudQsSICvfebw9mLoE
+PZO0nNpBWzdSWOQIPyBVpdlR97XxqkFttThr1GxuR9LMRglsvtP6BVT91rUCQHYW
+xOwpnE7sBuh3HfsHY6IKSHV1dLDBY/8zzTpNWnBVn60PR3vP+xx4jXDtH8EulnY5
+Qz2Cuu/QdreyJMwhookCQGnQXNNfYJdaJ7poQVgw/6h4LEazL/GUgrBPSKefxJe/
+ns+w5YzdpYOWdydBhB/9J+haE3e/Z8qK0E/z+GSrSNE=
 -----END RSA PRIVATE KEY-----
diff --git a/test/bad-ca/req_conf.cnf b/test/bad-ca/req_conf.cnf
index f83fdc4..772b36e 100644
--- a/test/bad-ca/req_conf.cnf
+++ b/test/bad-ca/req_conf.cnf
@@ -71,6 +71,18 @@ nsCertType		= server
 nsComment		= "OpenSSL Generated Server Certificate"
 subjectAltName 		= DNS:*.hoo.org,DNS:joo.haa.org,IP:123.124.220.1,DNS:g*a.e*.com
 
+[ ca_altname2 ]
+# This is OK for an SSL server.
+nsCertType		= server
+nsComment		= "OpenSSL Generated Server Certificate"
+subjectAltName		= $ENV::DNS_HOSTNAME
+
+[ ca_altname3 ]
+# This is OK for an SSL server.
+nsCertType		= server
+nsComment		= "OpenSSL Generated Server Certificate"
+subjectAltName 		= email:john.doe@foo.bar
+
 [ ca_client ]
 # For normal client use this is typical
 nsCertType 		= client, email
diff --git a/test/big-ca/big.cert b/test/big-ca/big.cert
index f04ad8a..f57f5a9 100644
--- a/test/big-ca/big.cert
+++ b/test/big-ca/big.cert
@@ -1,56 +1,56 @@
 -----BEGIN CERTIFICATE-----
-MIIKBDCCBeygAwIBAgIJAKVV51wHtbBLMA0GCSqGSIb3DQEBBQUAMFkxCzAJBgNV
+MIIKBDCCBeygAwIBAgIJAO61iS86gZAOMA0GCSqGSIb3DQEBBQUAMFkxCzAJBgNV
 BAYTAlVHMQ8wDQYDVQQHEwZUcm9waWMxDzANBgNVBAoTBlV0b3BpYTETMBEGA1UE
-CxMKUmVsYXhhdGlvbjETMBEGA1UEAxMKdGhlIGJpZyBDQTAeFw0xMDEwMjAxNjUy
-NDRaFw0zODAzMDcxNjUyNDRaMFkxCzAJBgNVBAYTAlVHMQ8wDQYDVQQHEwZUcm9w
+CxMKUmVsYXhhdGlvbjETMBEGA1UEAxMKdGhlIGJpZyBDQTAeFw0xMDEyMTYxNzIz
+MTNaFw0zODA1MDMxNzIzMTNaMFkxCzAJBgNVBAYTAlVHMQ8wDQYDVQQHEwZUcm9w
 aWMxDzANBgNVBAoTBlV0b3BpYTETMBEGA1UECxMKUmVsYXhhdGlvbjETMBEGA1UE
-AxMKdGhlIGJpZyBDQTCCBCIwDQYJKoZIhvcNAQEBBQADggQPADCCBAoCggQBAMMG
-ecG2/hBOsk7TgOZBSS6DENtu10pQ+PjREjCdzuGM4X5SDbJQwUb6AScGwy54FKgo
-mk0vgCUA8HLV7OeDXnePWH6ZuNzOukseejOQV7ykUToR05AuDJRzLeSbaOvYDI0N
-dGdswdnlU6MwXA3KkGx6pw1k0/MO8p1Jf+hewSHQazUNl8QfJohhBDjFaIpX44LN
-/sRyzGYb4uQ49VYyrZ/SW6EgdSxneW8ScFYHDCCEmL/A3vugx6q/Dm3ZvgAT9qhb
-aKwwnbJbid4uq/NTpLh0xz3H3wPIMY47AsNe01oDzBYb7gEg0jwen1ztDnpSe7pI
-WU8OARqVL0zJLyPHw+cDnBmJyIOoK4xZhkJ5a0WReF1V6ShQRuHGzf8hYN3kHIH1
-J9lHy4ET7AbKvQX+xTvdXdtqMluMhN1jkDwqv8Jr3zgYgxpAIttlsMTAFQMzctEC
-sMol5BP6w2pJB7SFKgfE1sGoyX8I9UnftDnG22sfRfOB0NBajn1bfO3gzpgEm4gq
-uzMfhIkPgiiuP+wBRI4homnlYjn06QoUn7yXKL4FFio4OlXVyvY1b6Ntb+cyb4Y/
-lgA4wp12OMIBB71NTuIgz3erDdTw9IWToIUPXH7ldyMWvFrj6oVHv6i0Jx9moYZ3
-1/Faz0prq3Hk3qN5p+rp+wsF2Xbq8I6T7Jpk+EvmerXrRxd8tY1Y4L24W1qE0IJk
-OPPwfhPx3WXRUXr4lty0KGcdnbXJWQyhvl5T2Ta0+GPJIlgQoM6DFG2T8fYHn3aC
-ItIgLBNj6JnSRC6Q9LW/i9WKtw8sDIoOpz7D2tzLb4iB6tcrFF2AVba/RvezY/Y7
-leTzZKPiNy9ojPPVxH+sMzBF453RRceYbkcuPIMyYQFwxhK402XUCboN7MCKh9C0
-aZ8tckCavbw27slr69kwB+YrTBe7zj3B13dJ14Y7j2NY7pnUPYMKRlISbkFcAUwL
-/HDpNxqcSehNK95N3JsmXFcL03Fxx2CSCv4321q9xpxL9uaFs5X7P+2RwNHPgXrC
-SSKF34Z29izgjYKKKjbs2wyBqS7yN90R3J4fKxqfZlZTpnicaIvzHEQqENirvSdx
-anYCN5TYoo2b0/NNYqOeHfjSwhsgVO0PGLDWsLVmnXA4kUInHGkBwzJKuRuGyLnT
-oPFG0alOTb8+AzCbcR11FC77MIR5XFOYhmNC3yeV29kQAbe4pfAb7Ba2oOhJjH+3
-6qiYMXHkvTz1lTVq/ccSQ0I7inKUKKYl2Dq97GC64brbqQRtiaQwWjlf/4sFa1fe
-xpV3KhjG8oswj8y8OH+OeMzXwMk2diqFwhZFlOsqeNj9spX2o5IkYE7jiYpzbGDr
-AFttYu6AFyv5J85ByXkCAwEAAaOBzjCByzAMBgNVHRMEBTADAQH/MB0GA1UdDgQW
-BBQMcEL2C349KJCO5EIYkZNzfsfImjCBiwYDVR0jBIGDMIGAgBQMcEL2C349KJCO
-5EIYkZNzfsfImqFdpFswWTELMAkGA1UEBhMCVUcxDzANBgNVBAcTBlRyb3BpYzEP
+AxMKdGhlIGJpZyBDQTCCBCIwDQYJKoZIhvcNAQEBBQADggQPADCCBAoCggQBANL4
+TJ9SW2xUysd24EPw09DwTieiFxpUmEJBZy2K651XmuqZRFnIkGw7PsYyHaWbYOvT
+E4eyJE0EHZRq76DEudwmeln9q63SVvYak2XYmnlLs6unxf/F580uyLoS8PX0Krey
+Jex1RDEipVCM4/eUDn/rfDXE92rQ5lS3RTr/qqc2KvXMZowe8UB231ZNxSvuzx3+
+UcMjxFBeEIC6bh+32uY6RSDKO/pKqO0dSVwKU4UwNplzYLPM1gMaKXhxf1qcdKQa
+8Th0eXpXqK0JBNR0OqoAeBWxLSlhZpXvKMiUXvgg2TLiKVozmFGT15eC2QsSq7ij
+WD9kbc0d364lGs57upw1aVubzFeaCqDMd5sPyW0MAw93+uZXuRmAwevngVGZzGbI
+ArpZhj7+KT8VzATNRkQiZ+/f0koFhY3eAPh1DxExJy0adFSQ7Sf5XBDZNeLVVVjT
+WEu3mEZrr7Jo+AvTY9IGA2ETs+JL9QVbmOjyyhVeb6CF+g4VA1gDycH6/yDGENdj
+iBvr10Af57Mzxl1wtaE6NM20nvrMPALcBw3Y3EIK9LFDq+EkN63CkczSjKQDsdjf
+uGDLELk1l7P6dpqAUbHJaD2JYAARX2IjfLtV/wNZJRWwnLJ9iSb6smaz98vuw5OM
+DK2/iUNJxPCe56YYQUqwKSnaUVG3bLRP0+idGb2sUyiytNC95gL76VGnlWeUt4Xo
+gj6DPJ/QABcdZ7AhJ/hW8s8yXmjkJyP6pNBr25BY0+LGjP5kuE6YrRQFYcFMrnRS
+3FAhd4SkoK3qM0xuTwbzvCbzmcFZDLexG/u6hjm76l0vw4+K0F3bk/ttKZFxvSKm
+SDZzQyPrD0a69hKuVD7jt/fD2vU5SkItGpmnnVbuZYssEfE6o450QSbMU4Rcbvw3
+okw5fQYBI7oLdpdLQgMZEtPKGz/76Wqw8eaeAT3rhHZF+wS6/w8NUZtUmem/ESLf
+aKDqAmZ4/i8OeCTfn5fbtqyfrni3qR29qlCDlNNcrmM89Vz+p1mSg8hdeAS115Sf
+bsbGYtpygeSG0WEAQvG095Gpq4xFmQrbdZ62wTihbQh2rOl8hd2pAO622P8GVj1T
+OcK1i4ZtA+TwP789dhr6MgBPn87MlwxDsgNNpcqJyo+CNPJwJ1HgppxJORz/snVC
+4dpDcYqsxyOAiKcR2b9jsld9GjxM02cYioxk8L263zbGZ/js7JZvx9Ovu96szdtt
+40+bbfQmzbja/fP+rPol/DxQnOhT1/+ub75L4VUx01AWwyFhsK0ozknZ5QgtZxsk
+fCuuONW93WQK3uJZdh1MH4q2JOCdl4bvNjJyYFKyma4ZRPCPoI+3VOFqhXV1z7Re
+zjsvIuU23dHcepMsinkCAwEAAaOBzjCByzAMBgNVHRMEBTADAQH/MB0GA1UdDgQW
+BBSxUNHUrHgUBI5ufRE3C4Uzx2611jCBiwYDVR0jBIGDMIGAgBSxUNHUrHgUBI5u
+fRE3C4Uzx2611qFdpFswWTELMAkGA1UEBhMCVUcxDzANBgNVBAcTBlRyb3BpYzEP
 MA0GA1UEChMGVXRvcGlhMRMwEQYDVQQLEwpSZWxheGF0aW9uMRMwEQYDVQQDEwp0
-aGUgYmlnIENBggkApVXnXAe1sEswDgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEB
-BQUAA4IEAQB+cFTCquPGQwN+CGEfH2S4ILi7x9q+AqDBPXaqhvP8VQ05ZKm/7YpE
-hjHmJBjUETZNYq88duXrehf/6msrrwwFMFzJ9b1tY8iAL+xVQjAPpjJNneY5tlBY
-trzoh8yxYuhFYtDm2UqwyVX3UK2FlnZRjT2CCNvwIfAwgHMwtTnpbs2h61ciEvKC
-t+GFiIloIX9YaSi2Hma1ouKJqaRsIW2AeXj80Vk5x/xNVBS1CiN5hsJ2EKAp20hX
-TiUytCU+rMN9ZI5+0Q2czshWqnMDiywx3zDtKyr50KKO7CU0gGKTGTizYlhZhytz
-dl2UWGvkftvyvAUHSu0GQl9/L9lGgYjaPX7aNoxTX/NUMh/Ds/NSgqOFyAZYXh2N
-Gm3HMkd53xYhslfF7/1Kj8Yi3voICsB72FpV3i14N2ascUbIMBEoAcIk/MtAAXJH
-N2FtyAYZ8FVquMD0WphNT8Ursb72Ih8DumnFN4ax70Jy4juOHmg94qZ3aBH7rAV8
-RqnK9hhdaPtHQpcXrftcKoz6MsOBRR7QW3YjhZhvmvkk3x9XtbeUjsF6IVsnXxqI
-4OnXsvcSnmh9j4hTt0ZA1QEs4iFKRk7kMXXcxiK+6TVWSWKj4Z+fLBsIm9DkRQoD
-LTHWB2pTNRnDA1LTNy6XTx+9iiUkS9Yhz7tqgBLfxZw1QcQ22Rpj6pUuuZn/ryBs
-+R83ZMY+zK33tEZezHmoGhiFYvg0+655z+qd6lizgk7pZ815brqFDJgzH+mQJLoW
-had8MeOH65mHHD7XtiaOhiz68N2j2l3Bi7MnKJuSwvyxPXh69/1mfAjjy5n1ZbKB
-QtP8+vDaCjxqOpI42nQvzddj42AQZpYIAoxKVjsdOlN6QzO+hT3dqw79TGpG8s1A
-p2EYIzw58qTVi/QM/ZxQDvtDTamJUgI3kzNy7dkupZVI9w9A3r0FTCLQmsR2Pa5H
-L++rQls8Frioi+sDdkFoqHEQxw3VJx6aISZro0S56zMaiSFaDU61tsWuZNNhqMKZ
-Ja80C7q3yW+yQBAw6BGg+vUqlxxg5qaXH8SNXO3nxnj+9rOU5a2e9fhOzwIz52db
-JISqEF8c0xDNyxtz8Obdqn7/uGMAvx129GYmzuY6rG9iUFzPxGE+DIm91Fj8WRNH
-beDF4RPLXMdXT4jzHgJe/BLq3X7nEbdpFsjkomMX5dSR7JQZ6p+jG1HbTSohk70k
-hM2Ue80jLE4F3g9O2Eres95Hv9nxeckGGa9RBlC9LgVxhe+NcIEhEU+wzGnC9hQ+
-ywtcudcuM7RXXRjCQNmR1LeUCuQpzRPOvL7t2kFAkF6jxfr4DT7gAX4WfuMq0XLw
-wqIVPAoga2hF4W5At6miafcSGudGnVzC
+aGUgYmlnIENBggkA7rWJLzqBkA4wDgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEB
+BQUAA4IEAQBSE5/nS0jdN4v0rc9V0msXE5rBI3D9zg6ZKvUQW8nYky4pQkY2Mm/v
+h60Mu3BpeCUEPTsreJZqiYGJpAeblsjlHzIZXeGpD+VW1/nok3qwrLz/CPYMNzy7
+Qn60Mpd47mvNM5yTygZF/XNO3qT9OTnqa/jmKO6bXJozll8Krb66f/7jSnLRUaVc
+kqyuPSNRpINOeOfrtzvzGmyda85S3eipyuHAwANYCbr/RLHIRM1FInJuQJ1utd9S
+STzNCfZVO0xMP4jZS3Brno5aQkAPIfysCPvWGWSGAgH92KdL9LqoIHaTGZijtY6A
+Fkm4P1MdtGg1X5IaMizFqeDAy/ZAXsrivnnQtucqtNcoP/+kyjrEhgXgHL7xFvQ/
+FVmQ1fZJjp0Wu51bWJFuDXye5p3+x6y9IZk/KY/25m+RQL3Ai95J88maRYz+F1uw
+cY1hv1LYKcyOw3K1eCPVpLhBtA7LfZVhZNYuQzEnjrGT2o+y8Y3/9a/JiNUJ57BH
+FmlQFsoaGVS08AGuzgLwAX7m1sbltqSLG12dNthso807boKdlqYSPeUctxHBPELQ
+Z6KShu3SsanaQaqRMOlhzCktAhMqQ9onM6aAjIE+lXZHOE/vEkIPJ6/uW1+fe6nY
+o2jx83RfNTCBMH2TKfu9qnOpCjIW3QAryK6eTacxQsoiFZudQajYKSdXYHejfp1M
+WD9eG33z7WVBuf+o7EE6/lhR3vY5E4auB6wqyM3PZJQsAhVqjiaujQee0yiMGja8
+5HVsmv0Pxqi1YnByP6vf2x4KPXzjGrzYqD9VuJuEYl7R9XsRsOOCRKVO+C18iKfe
+mcMOt6lYkwEaDiSw9CBfq7I10Ro1Nj/OIoowPV10kyDS1z1gUk/bddl/z4aNkC9K
+YeWb9gIf/L3IT6tMklqo46K1pCJAChtreTAHR3Xa6xEC5nkotBQcmlKDHkYzKYeM
+u0FW50rohUJ7kz6Djw9IgxEpz6dPJI+C0Hx2I2jbIporD6aK0RiD15/UYu2q8vVp
+fJsICJQrLfIzWG++iLlvwApcszWve3CrnWvw6hxzKJ07FX8HMxx3KGPEi3lkUnaR
+0lXLLncS4cQSd1k8jRw6ZS68gAMao3wudgijtQlDPSopb4/LUCVCJG38KZ8t+KTZ
+fKYcm1TvJFBgK2TIxZIy2g6Y+Es+MpIt2Sb2iV2bf0S0NrJKiNY6Kbl4VktkagTU
+LcfHBwp61dJsJwrfoeCFoi50JBMZO2d7Urv70A6RbvhUI43cEj4f4L2ENm/OWMPE
+RHAeGUVAQZlmhxqELEAaZK9VGbnvPa9r3m8whn+OkOabWVSZQzMrCizbs5T4EaH1
+m2YchzTLlINAbvI9awVaTdxmWPtWniyb
 -----END CERTIFICATE-----
diff --git a/test/big-ca/big.p12 b/test/big-ca/big.p12
index 8a23797b088edef6320473d9a75c8399cad5dbe1..e8926368e6894a09842bca29e6a830a788b1317d 100644
GIT binary patch
delta 7536
zcmV-$9gpJ8JIy<gU4I;wXL_sB00ja92mpYB3TQbW13}R*5#%S*eR8%*vG-X$azhwc
zhR`4A=eOW)Sg}=!DJW@Lnm>LAd5MBQ?^biegJP2`C<EAzcV*iY60}aZDJ#foE*Tnp
zBD9iP8;F6LT^ed>8sEo1(Tp7-GzPSjDQrXB`&Ku}>#Uea^nVN<(R`^=$}<Z6mL@^T
zyE=i_nOju}><_9a)*abb%m%{Al|Pe_1Spo^cqjl6ezvAj;H1~_RaTMy?$%g+H6W|j
zfL?Wo(=nj)m8Rx*Z$jAa&}-x^3JbYWWg_;#Q=A{HMvFzsK$A>_JooZ&G&|o$Xtg%o
z;6=K(ZB%M^OMhLr1UGYyd~#Pmzmejw9{p$@9WB@;?*;PQ3V_%vCqo^c$}alZ<VV>l
zBYd+`si%%|!JS5(yh7b`(Jf^nQW(ZI1B1XVYIHjfxvv|wDJSnEYw>Q7J=>$!oWBUB
z&2d82k}LMz$8d_JE1vKb93n5A$Ws}fdGfj#xDelSG=JVzx4W{rv%L)o6Rn&&eY7M~
zcBK5y=I&t`Y%)jV;0Lgs%)RK5G-!ZCIt_<%sfL>ft(f^`1}KBsOZTz0JYJjSrq%=4
zs0n*bD=<&xOvRyHos07jaEIV$bJ2RVA3X@8Lb~$X3@)v?jG$M>A5Cx6kMZfA)s}>o
zpx@M-!hgB<rU9#-BnskShVP6NoabY&_t6aTIBzSj^B+TYL>YhE)(W6jGi`@LB%Z-p
zgeOSoPJpLlrq0a0VzWVdB)Vz=&~ocd<9`*Ybr@-ndVpQS-gV|>Gcw;J1Xp3Xohidd
zvh{8!`x(W0?XUrr99M_Vl+yekF>8j6K%QPY9)H5#mqpvl6D~x?z<tS-K7Al;aAvrg
zD_JUYdVFA}9ZYrH2T78KzO(9i0VcdBE-4k({0d%zVcFM)V!o|}PluU8Aasi&*8O@#
zZ2|mV6q|mFJJfh~crDdDI&yeVCAN0*aW61|c4aSc&5C;#HPnX0V-kyYV4PYY9nPmc
zjDJ_pa3Y0SXY6!v%oP5Z;a+9HvWi|Z<{H}dYkwA+Y{5Y{ILqV-dYx}Etn<62Q(Um=
zvF;SNY9=@97HweV6uUdTSo7E#^9tbW(oatv%s@qBZzKi$1qk$d%Dm^5{rs#j$%&BT
zMotIw1#ND>4DMFlBH>C0jnpf>pcg>S*?)j-Mq7k9`-oJy(YlBgV(A&7=^SCpCZNXz
zs*V2uR9}|<2GTf7Ff!D6#dPk`s}Oq$N<La*1e;=f-u6ofg`PRxk2Bg^%0txdP>3Kv
z=i^WBpv$`>OQGv3k9YH2W<YujmCJLtM1KtYA4nMPepz}4SZ!;c_1;7TNRXK*9)BDa
zyY^o*g!0N)(`KW#R$&GbQ|@xRY_+N4BG1DpmzPr%W|Gz`5txF3HWLf%YC@7|95`6Q
zFO`|QVoEQnVqYeza|Fc)8NW)K+E54Z@w=v&E=uEZEKx}*co(WrpYm#QH0g&}#AH`C
z#$#~Jdu!60vBn0gCTtLrrz<mO$$z#hQX2V_vrhG<LwHEz&BoeKP9`blCnvo{M)3s3
zLvF5E(rNn!ro&1tQiK&{bhHR`(STcd(`qNWNsRF7a&C+@lExy{?S+DRe9q;c1tT9u
z(NftWW0@ZM{$MLc-=+c7qI&{^KBx<y+Y^g#u9wkh81@$!<&$~X!97{|Du3yFf-<)=
zp`>9P>Bw%uEQ%o6JJcxpwhpWQ5SRVArwL%Xr#wh00H2bS%h1H+S6@ySqtqDpbuqkl
zSVeKf!|=24geEf_=&njngP>9MX)UFE&!($=+<-;B!SytJh==;|aXaTZv;Z?DYg_~y
zoex%b09sy+Sh+d_I^a(O2Y;-#BYJ>I+vPQ@-c3IR043%O*!y*tvILt1{|j-CInu>>
zS58_Q_RGGzMGQza<C3En+C*U|6?D1V+amI;b-#}4pK^`$k=>SK^S94v9T5y$f{(=+
zx#pM{w}%WTS(GNs4W7bPWl39z%5IYseymxs)q=KsmW#hu9il%6lz+g>)#q#Tbq@Ax
zq_{)guJKTl8|*7&%n$%Ahcy?|VET#=f3-WvH@8lY@X@6TrNfpxNfvC5$ySe~CiqU1
zZK@>F>LG*e0nssIXHpl@w+|h4Kyj2rO%5QU=*v^IwC*%{|2XM*k>!rtq#-kA?{3Ox
z-P0uIGL9jTP!WS}mw$SvdOHS6v4%TMDf&&+L|JGQt%9-ZWc0hHbu57vfd&+!sDI<d
z_?sB_X>PY@M`O)Z!t)n%iF>p)9x8@IS0o~H9&Ym<frpDy?0c*F&DXB+rhoQIS!pYj
zlQN0F@aC2VaOV#!G4_X8g{Ko%satIko&&Om8Wn$rQKEjU^?&aRm<IBJWXVP!Y<yhG
zZ33SiE?$?m{_fW^7&_;2#4j7+ptrAc1_H|d%OYw-9{pLitgTK|Q8ECtEJ>L=o?rL+
ze0Sdpzp(4JMr7nh{{`;|<R;srh%hGnLAt(kEFDeZbZ>&O(ATN!M`H3J0K}@q&wqmS
zkR4r)n!oJEtAAP+_?6ET5IjbBf#e@#W$JQa-^y<P3M7xfh1UPIaANgFAzK|ks9%tU
zpWQEr@R0^<E6E)KX6i}$dj4VWWhK2$F7VP@@9VP$6+<3s)Z|GZG&vh7ZSA8Q=*}vM
zSt#QYiNNtzBHmCq&c0{4_njfU&H-L{WEepOm8yVG9e*h~{U=UfAh%Acs|B?}8&}SL
zN6$J(=-1lA9RvxPL#v1>eE~r0-bdTJt=*UaW-a5Gn`*%nW)F*5rH)K>e_)gw>Ym9g
zFNK5qS%TrCX0y#f?x?imq);$v=OQD2y!jf0qwCp8*-Kaj58*Chj_Di#*O4@2tlwlH
zM)`Nxk$-t~kFhJg@iTK~{!}sW@Sfa#9VfSaLF$Bdf1wc3A8UPleV`_wE~VcX*ptfz
zaH>ufLADaaAa{D9(nLxt%`MkAP<n*9B(gQT7-KVnT7n_%aF($X83`X#;d{%aJ8B+7
zoy$aCD4W49md5a$RL-qP{tYJtynkSOo?jvimVaE&7xY#APVIhROZ@W=Py%I-N&R!4
z1zEwA5`~+himV8ycsLOK5^pMG`9bxyAs8H~T>ZVrOP+;HRrG{I-gyX75Z78XCr4hF
z`6Kgmo%+&*mS{ODfIuM{2hm=TnhN@Q=7}e@TTH>XfNMq_TiDKhQsN-Xp)*j^Rlsy6
zQ-2${?0xajjy@i9$iyBrs}k+4i66h7R1~FR+g*@zLQ2+ar+BK2Xi{G~C?q=2knyLt
zF`w1okehj60DvMVi3e&G#dx3qA7D<{&|PR3zTNQ0PprcYcnb`8@6dqq`PQlm|4kxq
z9u3Q#4S0TIHM_R{tE8~A1rTzE3z;+|ZGYb^6!1vHkz-@0tGAkw`IyPvOrP7NLne*k
z(QA+P>wIMZcV<j1ofzQel>I;f(DCuN$z$4<x?z}d+ui*LX%V{O!#$^&qce=T?wFL~
zEQj+bwV(H@4R%##+acSjC%9JdX|4pe;qBwsFubn*Z$k0%*k}o@o3t7d^*-Q&9Sz=<
z#c<(>nwWTOE4xvX)e1&`p+Afqspou-0s;sC1cDMst!giRp{)>jywUMT13_eNLW9Dr
zC?Jh6O6mZU5f-QlcR}?**j2tyb1Wc+s8&Ug_4MFGzFzeY;KRkc@G1Ilz0}L<xwvji
z&OP%iNN{!~>ixwa{Ea~9MK)tp7|g_p#?%h1ofRdb7Ynde;zh21ELqZBbInHQO73YB
z2LisFSwuMIhlX{ip`>u!N$jh!sxUJ4WhyY1zu#c&8;#|H(HA^hgO<Mox0P7n*Am+1
zJK4q1yu)tVou#iQP&wiMYQDN9@HsJb$L+XToWx1Trk+~m??EA=CW3}TIW__(E$>+6
z6NYlN2VCt}c9t%G%YykIWvMbayA)Uj2rJB?l$x?jY5H9!oiK@{xtL~%>zV27_l&WY
zQzZJrK~^zdeaaiRpD0&DbZ8uC1RF`j?~8-<9C}}2fV}o%#(wX7&K5)v19At3#!~1o
zP)x$fHwMN&J}aEpM$mGP2Uy^c7W8&&rRvEOp;@PcO`xrR6070h4h(apJd%dsQb#VJ
zH7cwHMl-N==u=MqXm1N=B8>`SwGDtOEn)4>9CM9Ee+3Vv0374n+YtT~mh<9(u`Uc}
z>CulwH&`b7>+?ZSp>>dbcr^QK4$=mBh<+fy;+{AWN0;AXn_`EwD1j-9mE2M(nlS-x
z981si**}|qkqNNlO&`&Flm7xmcLzkI;TXy&!m6ta#yjQoayNKjunsGS_w{|M5L9(`
zu-W+cA3R)`3M7Es?s0tvrS!<*=GcW4c%0#xk&v+5&b!Z%mlfv}c8VXfNl?X7XvkKB
z3L+>=RyK3hUM@yGJA~*Se}&_=Wto{FBMs$J7x5T>n{+s`zV0XkfRNR+8)>|T)~WDE
zq6|6!>(wl9IKo+27nasn)G=s1()bArUTS+0+u4j8TWBw*z?m5D8OcIFN>Ke!2Y`qt
zG)%t5z>MRurmi70Z53y?u32U-l{Wlq6QlPI6~I9G5=uHemp?ZkpEI|<0sg18tysgF
zLIbjYn*Az#m)$HQ<Pp8u&~Rd9xHT+-@>+48pY(ON8;N4YUY94#@PsCFUmk-6Sb||{
zoD(?s1x?!b2bWnrx+NcClC}0NaLo5|`>&oy7IbSb2w_*r&EGpvkdR*u$rGgw!9WnP
zt4D<)p=Y2fN(W6A?~WzxeFceoX`xC%aVNxo;{D~8wYnYIKcjzDQBd;xk?ZDvO!%S7
zIOWc(AM&-qw!GySZjN5uAJErP>J=n98jSP0lzp84RCB{aP$OMNuV=xu*d)cb6@Z}O
z0vWNmYfOvv^L0n65CtK=`Udw*wPK0%N!1tl{<4!_+K%J7WW<=DK_R<vrf4rX^dnP$
z$43X1;Er<XqzxOCe6atGic3=e;UzaP>*~~t`1aQoin6`db(H&9yy6bev;~C?EExdc
zgwaK9L+eC^m;x-CVO6}69k-jiWcTr#p*gK6M{hHi{=CG?iK<b8<ozKC;-=P(y1})u
zlWWH}fjA|NTQ5-Xb5T-Af!>?kk^Pf@Iwpn1CP?NU73NwcM$JLd(b=b(i0TK#^?5Xt
zQ$>~8H{>lA!n$;k-DCvwwB858r~T<zI+%&fza%;dQm=>fK@=q=Pbkz`m=$33E7Tx%
z<fys*c_&#TnEpbmjfL?RFa&&{o(Kh%=E@!w)aordN`OOWR?IAL29AJ?vrdtJH^BA8
zMe@vAfqfxZyjP$^TxnH%L{1Tqjp{m$H&@yR`)CdzJnjI4lGwUaXt?>tRGkXL^QS#+
z!N@h;PJ<IYYm;{T4A4yYiEyPRm49WjNr*S&IsZ-@R5ZO=Yb=2n>9Px!oUi(l^JWo&
zwx25xaoZ+_TVW+TJ`4i}glrmrrj`DP+Q~M^RFeZ7DzFT>8FL#UkYoF$4C^h%UF{If
z<aKTM4$~fN`~Uy@-mDb{>q+#=lh&>@l3<xh?_bdyv7xIXMfxyqYnd=-<^*XF1%5PW
z{SD}Uv;w5Q^?J{+o_M#LNT-c}3TTySIHxjW;+75`kIbQH*vYs~B;(S5i>J#ZIz0xl
z`*SE*8Au&_$mYqDi~P^@IY1OUkr&3Mfyt-;^IP7ch);3D#inzVPHLLcwc8WiWD?`&
zuUj!ok6;|=AEDX1Q)3h~&L*WyDK%$}lWnd5xpia^K5cL1J!Wn)W@iG81><F&D3uuI
zcyF(k_2zGh|ARsdmu0Sh;~Yv<Ax|y)*8$tt?37fqSrN(nC@O}3h8&2AMIhMtsJW9M
zEw%#n2$08apghZ~os!Rti@G$!H=`QhYiwtMM>$dvM`4wkND8i;>hw$#(av0Iq!Kcg
z-}60ZDct6JyYH~HnDx_a%XJ5W<2wdX;Na7Mi01%A6Q)&O-lZ^qJa^JLB{B_5VUV~B
zfZ<hjh>($w!K7~k&y2~W`;BT)$%W)~8a8*6F8Qk*uHajT*z}Y$8yjd8wfX>^aS#)%
zFVvR#)*XG((S86o#<N_9Y%JxvL`1v+FdWp+Q%Ru`y$h}T4pL@{{Z;02QJ#^?RApL=
zSSrWUC0N$T8pIxdcpIKkP0eq)F$g<sSDp4CXciX`c~qOf^zdB8#Pp!Qg){Ng0zWH1
ze)1&4;xY)&uNDNS|JH+sV6dDQH#!8l$94{6+>F-~j|j3)#VyaL%ExIi&L;6UN*)*@
zY>Ouo4d@3zCF9*m4)dGPt}9)NeVysZDqKe%?qxf<a`{Go$umZpf+X+O^qca~TCts_
zMr&H@8uNkl>=HeOP;L*v9ITf%mlEb+)O6XEPCFi$+f`l~<}c!1&hCy+2RpK1QY$Mg
zc%GOk`FgNt<|u15u}}uCq)1*)7mhHVw<eXTaa5g6YpQ>(Qrbwljn4pJ?IJ?6I-_dE
zzxW0AgKSxU7toEtUx`?_GLKNn1G5Bol1ht!e<8|TDSM`uH|@1wVK7O03|<!ljGJ&h
zV2YWoFJ9cY#;tpSv*Cf=)L);kgn<-nm&^5aJ&7>EHHTvhTI$lsQ+5Gg_w7dV4>RK!
z4FF4CCFuAnV%O|@gHIOG&v!`Fg#g5Q>-W$>p?f`lq6llejR4w+lLyogOkbk~e;Cyg
z)lQ?}Eq|28jtahx(*j8@uhonMB1V~#>6%cS2&GW&HLZ#3x_#38<J%B>APjQ61p&Su
zox?i44`(Iwqwdj*pI1NDqh|`)gz>_D=FQus6fh6;3hAPNwWOv9+oCoGysL$?QO=7M
z4Fwi|k#%@T2xHX1iz+ZU@KdBrFtWme8I2lhE*nasb-jt8XvQzBs3aGXtPfO5?!(=R
z{7yM66bLyN>=;eI!ee_${`sVK=53n=VFBuo(>JlM$j*DoDf#?cUi~@eo|W9hcVhS!
zh4MoeT{c&v43x=iA8YwbW}oQ!3DbKU9!eO0-b|$JHtffx9v?t0D(<K+slj{xqq(3S
zjxuGI*JN|iqV!bJ_y^kw@2_Jp9ZIqVAtGotKt?7)3&1YRv-3r*&`yS!G=)cVRKA<A
zTx(7=XWFy}s`n%%k~f@g2qo9j6n9ZJlYv(cT@U<SNyG<89rUM*hY*C3=2*TAg-=F*
z7+?GV{O?O!F;(Qt&L6zl!BX$Zy!9BE*s2!i<e%<*`Wk8Debq`4t?C>?7U-mZ2|b`k
z0yEADT?zIj9ZxS2ubaRNQEH2XA%jHN+)1`VlF-by3>%4}La8bHtHF?>ygA#?<GgWS
zIG)T7F3=VWgt*v)Rv7sy>9_y7$U}>NFRF`mT`Wohw*EVf{vsN~$QfB&v{sthaj0g4
zNe+CqAA>YQxA8cdfLVKh>bCZY_AJ5IN@fa7IuBZj)u>ribr-7Ia9|od1j%^GHtl`g
z6=UA?6!mwQI298KQlm<)oY9^7w2XPWyteg-bWib2RJawz|8OWmb%a|MemLuY@(oId
zA|x|peA|(oHH|3-mOXn$g3Wh5n0CeWz%R8vQ@FkiKYrk>b8NEOt|frQn-HG7xq4LW
z^VZxwR81pHCx+RQ6Aop^s?##|R2^={xVYV?P+SraeM$TxW*+~SvZWWgx;LEc8~ixI
z%$Z)){_4G#ksVR*Q|#76!H~Lt@~l3)rOcw#wODc9NWU7nJcvGePG$=2;@s^52oqdz
zh<dq-BZ~PntwT)glUp0#$<M{lU2s$nFh@BpYoxcbUm8MS54<}f-@~P(OWcM&7jW6L
zs1j|eYQsa6&b|cWg4r{R*d~pZ;ZlWNELujhU{Jz`LYGoNq|EGZs%ce!<jZ0+L(QUC
zO1LrE`L}{P^I}ZO<dK}r5(#g)wd|tU;OLJ#Z2HZv+QK<YnT0|rk*r2OQP%|p!@dRl
z_$_>W9x5P}W&%(lY-oK0{Hcqp{M2QcFmcM@BkS(K=g7>&1_>6A{Ca#8lz;SRCQj%M
zt|}HHpcRL!4H|GwS6wcDyy2468`1WL+|G%ay(GM&SG{S<;;04Ek>XC*5U9YR@lCZ@
zbv=FoM-*3ZNiS1oP+eQfM;w-JvZ?2(0Z9dKmDpWRqYpfI@n)!CuugR%?zVrUO%2xg
zS`BqnTE%w`>Ne=Re53o3M~;g}$BtfXsWfj0Cd=YD2kMsCR3Aov;aVxGAl%Q39{{D&
zyNZS}c^O2zFN*z9X9jpL4NWh6)rk}PiNrcM;cXtcIRxnly9UX5o_G&cM2i3?kXf0P
z#r<Yj(F<hhtTjlj(F$apEfT|Z?n8mmm_A!_b-VJuy7m5)KOPzGI_Y`Hphwl+9tz`6
zwwVg7+Wa|Vd_94G8}!M<*@%8TEValL4|czdr16dMrE>w@n^)d@z4L2gv?}Ob1ggwq
zNPWODz=>TRYNFy))1Z>y_06@ZO~Csp-HBSa=+DKSEoB=W`)hfN|5m~Qbn}W}@6qud
zs3#7CZ8@D7uYTo(7VC1{3{^+FpogO-U%ma1yR44iTcDbM>Jt=~uHOy<=yr3gc@8w3
zH}1*@f1iNo^HEZ<?uB;fiTx>EHosj<<yv=2<FQ>`XfxTGXhvEaIf1h6adGuPN<IHe
zwEf2WYo-owEQB|Jx6Ie+*FAneE(vGNQnTrX=naHdn`V7DKZ;^z7e-}K9T9~wOwph9
zzr|65TTkbInpjezc;7eUd9<(0NS9iGdF`paqV8L-t3XnN&~+YTf23nvIqlOksn?<;
z^n1F;V-2^35Gb3-4LjS``(GHU`dM(0e@XT@ov65s-yYOa3994Q>+ioLw`DlRFLj$N
zk>5uPE24YW#e_wy@~|B&G#oAV<s^=@39Oes8;#k26&3h?S~C&#vlBIYeP0}j)SxKR
z%Se2(E#RW8Q(i43f_AQcLb8aUz!CwA?gx==KFQ=A@DJFjFrY5C0=_#BVKxkHQ^l?;
zPTR?GbpZdc-sS6jxaiC7^sQL2Zq<_ir3Y}D#rB*?Mz_rhU6w2kv_b};7F{emxApMQ
z(aGt5a9*d9uhA~3#UuL!!N81jYK8coP|gp(#@24qy-+q{aC2aP(78&>T#jOYr&or$
zY|tle<V1O`OEL?_xk3lkS_N53gVV{G>|YP0zh3ZGSep;^wBK>mG-z3l*S%ou*!nry
zl%DQPuNVm=XV%Og_sbq45&C95RuryuZVh99?GMe!ApKr-`YdqyE<Qex??lj3$LG4P
zCtFL$jX42zN6aw(!XsUwFOLG%P4?*Z_IT}IlO$#9ucnG^z&Emob&s07S)gRI9Ws{U
zz7B<AF|ky-a$Yb}PlHNz?wKU?RZSXF$8^>>EyQcpA<3!6JM<;V$jX)*#xL&0PHP2!
zwk!bFVx&&@s;p<45Y96v;)8D3?2eiD=LOQYUPr^Z=-g2=06|VTSyn8trv!sUo5>pM
z+1)2>jx;7ES{u)?-vvo(!1n_d`+aCHPBo;j`q;eg#!{2WoTrSoq$3&chw1>Xi?zbM
zWc7f8+I-<Xi7S6AA^g~*+&gu!(9tn}B*N)bH`f{QV*X5R9MKRw(}35Ij512Z$U*{s
zg97ubF)LPsfCzTvr?}b`bk_R$s<^v1h_scb62l(}6~-O<MDr6lF5IzOl~Hg#t<Z%7
z^7q#_hH`1g$7s8qk!Et0W%^-d`P#)Y4NxypQ<#Z|LpOey?m<$*KPZ$@nrj_@SZ@h_
zk~}<hfsJaR$}%BN$F@(LHB(D^J&}g#*&9}<&bhlu0+{%u=oWEzpW{zN;E>Fuu+5_&
z1!{Jw>OpW68oU~@TDR1c#<>p3J2a|b9AvLpm1cQ$PYZ5r=dPUi(*KZTkos*+AO1)0
zyn|>t_CBjgnvCj%jiaJwF(oipBL)d7hDe6@4FL%iF%|?AE4`Aq0AZjs@wj7EUtk+<
zXDBWEFflM8FbM_)D-Ht!8U+9Z6b~-f#>eY7-|o9X=odW^YdGUO5d;VW`l-u?n=G~h
G0tf(}o`u=~

delta 7536
zcmV-$9gpJ8JIy<gU4P1U_Kk7Ac8CH32mpYB3TR-6C665d=|Q8XwB}>$qP&Uj^Aoy~
z$@Gqqr>Hm@i+}-y83*`6bP5RzeDjDYA_<$m^OvO>Ftn5WuS4*%pt$(QW0v6C*mZCC
zm*26*hsv7#ZmO16mVfO^h>s6@JQ{F}4^$gV2RUV2U_(nrQh!EoXU(ga8A;vj7@4FZ
zmsTvCUhA~RmfpQ$5^Ary4CMIql0slSDCL<8p)Tf5>=ZVmfH9RdgxLbz^YXh$=7|6a
z_s)R4bSQbH?|ZE*`MuT&pH!y;Z|h}8@a+k&fAhcS>dfXLyJ$2@3YpJl@3NVzdKy_I
zQ3*`z^+rcrdVhulm~3?Et#&t5!GhGtNU0FPFYp)l>y{4X#MS$F{b~71+We7Ukr$Qu
zzP~TJk!uu-;uzw{;QJiZasZ~-RZXiT@4gXn)~@h|E&^H}1<XqYsdgg21ff|1L2a*E
zsFSs&7y}uq>7@j|KJY)ZObGfIgjSkqLnQ82A{Y&ts(%=w+xSR?)uoMcdMsym25!3h
z5-f<1l#Rdf4y`5mK|Pkom|F(GA6tEhhSEfHsL(V$_}y-sUeUbPt#J$Q&`Qp(>)@f+
zW^DpKf@YvLDEk(MH!hhvd_KGi(<v6o29c^&5AEaO?MTBXDOB<cEkI;9C_}rc*rWJ~
zhq=YIoqtmO@fsU+wjyS5{q=FzcepQBm`9Y$#7EeNoh?~>_Eir{&K02Ly1>dQbMQXD
z9TK{gQBx-j4_ky^_HR#kP3e(ISg5akG+Sk4;0G-H%$Tu*&|^&{Qt!o_Qvc7o&Rv20
z__#Q$e68%#q`(Dlf$nWj(GnxC0T{)kPmRj&%YW*=Bg?hEIq6Pe&CsW0DqVp7<)5zH
zA&d>vbmCox_aJQ6vMK{lVU+;akcjvH@pKNuW{n)XUa0#?UcU~uIbZ@znXU^dE#Yrg
z^2J_;6ctZ0?=i_kd+MEi_sX`2u(a`pLghSC^s$C34lB>D36kL`Mc$ref~&B6JH%(E
zcz>9%iRywVdfa~W!8eOKt3_&OuS=Ni`|r}TJs~m%ZO7$C>@1k5z)Z3|uCeC-ZlWMl
zU+DJ$Mp=Lb_fOotjK#Qz;W>bB3t~e%mlV|o*K!qa_~(%ZfP%}03&afzmu@V?4KNYz
z1~FJ8Ec9^;{TFt|5_#A33?I?b59k*%|9^rHkDye2+~}e~p1E-G3V92J-V*QQE&oo|
z1-Qj3xy;;t?>vx8j9C(;p;MSON0U%?ULb@B*clSO`dA@O7kVQ%gV;pO2I5X}^*Sps
zWNKKev6j&e283Y!6VfZ`B>Imf!lRJ7L2#MLS$?#68{fw6>U{@CXq4$^5EZk1)qlBe
zhW*!W2@&4X_zpw-*n5>I8gR7%&=W<9fcy$V-i*ogD3Mso5~|$7WGV0hBb}d5P8UTd
zU<B|+zDr}^kLq417(EH9{z<Cqd9E<*0q`$gHY%16uiuQWV!*C5gv5@CB0z#*<P!`B
z80Ih$6KR4wG{hHMU<-?3d$r`bIe))c;1z;md|<+^%Cw79w=21n8k)xQDvAVlgS@H8
zPf~R3i){+RjYyA1qM48iF2(8J!iCV)J+M_0RlJ)$dD7d`xLg%i0jv+L_|PG+%umb5
zj*lj&noS2o7s=2pGb0pJ2|tl@P~V%tGLXNyE~r!nf6^ct;c|Ve?r5C;&42x{GP%|w
zxjt3fH5-h=u-bp~H8@3@FyYy`G8|Aho@oQ#X6nlCpS*8ep9ipASQ((*E0~m?n>Bnw
zm1TG})z#GF9!+wwM=yP~68GzgC)QU_MVJ5o0J0efDbg_dpi#65KW|Vm01JOpxj6kS
zADr-)DHzwxXwzLlXU_))0)INB=Owr`m*j_J5+{9-g&Yv>_{4H+%a;iW7{jb+YI1UZ
z5AXbLl7B?)O6xy&PKSFcp%QzH=-fKoLe2fh2@o#|E8#r_miV|&1oohk_$?zPD|is~
zX7@{iJaoOA?if;bv}+MXh27SF`uqk-ENchx3aHQ6aJo5DRBk9i3V(TPno5&UCB5Lh
z0GuJ9%-z$pW%mWXaP?rB5pOJ}qZlQ_ymB@*Tpct9SuKW$d5KaI<xJi{lPL^<VF%(t
zv?tyXg8sA(Hg&A0p+7qs7Z`Ismru0E#v?;GRB&{Cw*1#ZljNTHFnWGeHj!})#4g<n
zl0*VvXoX!5r<2h+D}UiBk21Ha+IvnHKW;kLGE|D>o!YSf)S~8`lM!HVk3`V#i}9hW
z3=07${T4>N3iKLZ_JWZPt*d{j_$SH4tR!aXm*-<~v94`ltW-VbrPeG>PG*Gsg%i2k
z-bTKUFOMA12n<pj=!|qL?rYx}7e0d9-T+DR=&@>Scm5}On}1wOXEBv&y@qsZ!jg~s
z@&fW6-K3&G_8Pmi_X4&<L7W=vSbM)vcr}O21ig;8?Q>wcGgjRM?MW5r`W&B+sN-{<
z=hHb#-iw1>h`Fw_J5sxp3P^(8Z2C+`^$bsu#qpv=%zpIaKsL-~V_ShQ)37g5^X~u@
zC|4i8#H`wglYhHOo!|$`m(>E&rex;F`Jt@2kzq5$3JHckjb1Z8ZfQm}Gf7F<egU{2
z^^*6!!P){o1`GpM*gVWQc03!Qdw-y%W!#^T`KKkxdcIg|-b|#*-Ib3P<F!9gj049@
z^o5jBa)=a<j3FIjcvBX9SY_qE{RIBT4+y%t1u=8Ew13zbq3uR-6g`iz;gVMKcF<V3
z+G^`c9?wNKby#G0Tfa!xh;-9z58J0jkreZq>Pm%6f@gzM5s;pb(_3SNCL4*%1U1b<
zH_N%4N`d^_EfJ0^X0@|oyoP`$Bdc&_IOgw<kVuW%x$S5&S8Jvx$On|w9MtY1kEfpJ
zC@L9tPk((4Wlt~E)?Ge4&SHY7_UZZ9U!h?~e;XFEKLz`gJyEPb3H+>=r-0bU&12!~
zgG$`Qri?1qeO|i>R8X13$7zmO;#&_+)w!-7vUqN+1L?JS?J7Nubf}AXGr-bO!d`!k
znMWvdhkzo}gu&<j2*|y-312usmsom#OizZJ{eMh{Lhg7f{@loQ*eRl)i*3|LWMr(y
zMEg;=00s0DML6m&^UU$zi#Jt0I(W_#u{N!~;j&|cD;$LX-%9yd31959W42~GH(k@n
z{Y~%d88Lddx-_pso2E}zFn$*9Y%WB)6lIoTZyFJF=RdCG)%!yw)p7c*B2Ur-9`)}6
zMt}2W0A&!~VJjMsf#N(Zgx7k)uZp;fKH5RlFHrkk+`HW?7CO_K<(Ghv8VsXSX=Dxe
z<)D75B+3hgBH$-O67`DsbRu!t&3tt57aF#9w3{-J8lyr`KwLLFHHbJ{?A>m9;H_h}
z4(5|+(K(d`nKs7$ljdpxE~g!hJ|naroPSL9-CE|3%5#)VKA9uOvC8_-*m1R)5>OZT
z#vX0U5qa%BPwn!%+N4sNJ~GZg5LxP%(0BNP&rrBiaog60;nRT8n8*wqxM4glR*O>Z
zYKn=6t>a)fahk^p`98?b4#)x}q?#-~$VIKjKOus0xg*zUh58CU1a~X*Fx`=otPM1m
z-M-je25~nMV=A4K)e1&`)~L)^-8nW@0s;sC1cDMsYC_&aYyT#C#pUT8F!6IX8iyU1
zXj8#rOEE4jBb_3(MeY}IaoMCblVxr)+<(6Z>eEh>ox~Q1zig#LP2n9X1F=c+!&S7W
zLE#>UBt$RAUxHCRBVADe;9$VFqX2E!G@)Nnr-XYQ-Pk3iifprgf>sDd>%<<sh2R4o
zaC;!|8!*55ZlH?3_#GowAZ2cw!d>v4Tnp5NUdhu9BTe>^qF>g#uY+p6*S|cY7~2<X
z15f1-t_x!v<A{ePKlt&n|1;;5xcYb+HzzZ|Ar)$R1iF4&5uZ}-ed4$?Q7CJSY-D(g
zZ_nz|^#zh`s2&%8(gq8#S(4zxB+{8+?wG0}6r+L1QuATC9(GGUGYEL|Rom-r4en2%
zVd~fNqHjvQC~o3FqyLo8Qe)k_Uwok_a9?_DJ#6{w&_#S<8|IU2jx7BvW^mHAvEpA@
zjI}16CCjMK`vC%1rzlB7LhgfIy4Dr=U)J$7<<lg3J3-BVs=rwV!2s&&_;ix!Y{ftt
zln+o9I8cvAt4d9XpJ++7J$di~l>=+oiWx<!Tjl*m7!#!PcxJV5@$<oi2cf}nk%R4#
z6?FK!8e}>Rr<1Uu*x*&n$csAXtYU#J)WM>k+EACe=5r+T91xlG?IA8~N8}fxWXwY*
z$EIZT1c%dq>f+MtsVP^1QH1fmE192QdZsM35asI51%LT?8C&qs+e8s-lrBr+z>EB*
zNknsy2px#myQjP3rjYCPhd}j-bLmq=((r`c2(h|1s=+&O&wwxu*Zhvr#Z4gS>=<cZ
zkRGJ6`9|GhR&DW&(y&CI%3H*U(185C=~ks#8-C}1gXZu-x7P|0ccKt>aGJm~S3zpG
z+H-w03rzZ)<4nIk6XjJ?Eo+&iZl#M?#=;4*0c1JqxFbs@4#*C?P4bJE&E_I#-q5<l
zCv?ehz~>n_?9AOb@huB;gY&brG&j=aql=zg*#8?Iq52D9$a)FdQv|h4<n!_sE7Jq%
z_QI`yCUaNmTxs|y8tYw7t!`D=LHK%vYbXtVoIn??HmD&3g+}YbbEWVQU~c*b!Vwno
z@yEsRQ~4}<->+{}_&;VbXuv*5m!6i=O!xxu-;T{F-Gj|&DRpOxQN~UhAQa8Z<Pj{B
zsXplP8~SNDaZ%8P4nwD>_j^KLhW7Sl3ASs0!CD6K4MTg@bdB==`?iLUET(e9)R@6K
zrCiMP(VZfpTwT(a$`jw~LT<3Mv0q4~xU#oNIS#x*gs=EK%YfXU<-$)xGT3;ajgpLm
z;>=AMNXz`3p7dQr(n(o}H7{4Zr+%&KZw_=(Tb|atFElj2u>P>@v@q??t3At;hsc9}
z01t`}8wdElHKrkO=pMdjwe*KBr3Disu=iX+fr0BdI}2P>R769da@Zhoiyl)$1M=f<
z`(s;h-XbPpgU*I>A-IRN8P|PszVy}^ZGtp?*WL)w$P$RX-zrsEmSEPsafRhWB=}~e
za;CJ8nX%mGS+|Ix#0?0E3(3uZGpJU7@6V(}y9l4t6=5(XTDzeyU;a(()`(ggQ1MqQ
zZpd<h99GMn;4fS?_a8Ov1kw-Qr-)iSM>IOW>lpnwJ_r~Z8sr;;(|Aokyr)4k_{rCb
zH86{nbI=RdQ3y_uj#s&_tdQ<!@=9N3y-pYDO4anDC9YI5L}<u)D|X^D31~il3x~D&
z1WJquYAoP(6AACp*8MZP0}&x#a$ZTg$DU${&!?VfmCA~cc<78boj8@zfpgslXj{6_
zxcH+%KrjLdA>xy?MJ1|n815smzdk2(<;Db4Z_`*z86_u3c%h^l!hP0r(#h`B>N7_k
zp2zO)7x4;&i09Y5`KlZr=|E9`pC<BNc_~E@l`DQv1>(w8E=d4^7>@1Je<QXUlnvhR
zO)wKeGqBTQ4S=2uueDokJ}cfSN98>0ogIvN;V^SW@ZIB60$l4j^gIyit)4Tsb<ecC
zi&w&hoqo?6@mB_W_Iu|%JPy26%t{_E1lMe4;m61`Ypc}R5f&r=ic{BrjaTR2{G22A
zx4KRG&}!#Z8X%lN18044#vhC{s9+Y$k(Yc~aK^xX@lguOkubvaq^U064UdQMmgkJX
z|9czZth$%7IqYrJ+al=I2;gX;KC`6|#7x3kK<U6+xa$N{HCND5L^A4m09soeryC>_
z_RUe|LpZ`oSZoymmW#Q6{P099_(tyYaV^smL7yX%KmnGPWp0S4W$_5Klkh;{JEkmK
zoq)OEE`Z#)S)-=II5b(9*b1XsQ-G0R18sB-iTVq-DcJQOEG&aLs&4S$b*jz9BayQ>
zFS7I}UebXOfm!$Z4bzNY67J-)hKcpjDLLQ#fup20&*XgA-5g$j5zuX}ERh^c`SD;Y
zkBCFCDmm}RP>~853$5lHUXdIfkd2j3<WKI(xD+$YW-4EFd<b@gW;+0(Vb&I~U<viO
zkz?~M3V^(L?*Dgj`$3`!Cm4m9D~UzaB(hG-oIhUSvA-EwD*#L^<*g{q?`H`qr<N0Q
zbxW1UmPGE?+5kU)6g*7UqeYETc<op<yR8pO!lqBV-2H`HHwYyQqi|EILAM^C&M;rZ
z3N#l|d#7>C$uHSTXZLw5Wt#jUU7#q>1!E?k52<HR8?%K|o~=!Iu!47dhhfF=BvqSj
zXNnL#6@GlZ71x2H1l>P*az)bGszEJ6|KR8G*R00EB>ww<d~olQ3DJQZ9X$egY61oR
zuE9V6E;r416*d#6iE%g7J_YKfR0579V`KgQ!kB|=(phmVE#FZ}((uP}eIiJ2FZ!u5
zw4$`(TEfB-)gjv5aa>Uf)6FSDrJP#vvWJ$MX#CLXX!Do--bQmO7;>{acMf211f28d
z?DWo1#XDSoO;8h!axW9F9Xqy{?TWeZQxsric*~Yjm|yqBaM>Rr*_AsFEbXvt>yp57
z%uvII(9;#Kb5ZT=_HNlyGSKt>i~VT<Cj(%UxkBRwKz&b%z}tb4#wu3U^KB}Udd+YX
zOgIC(<W^bC4$XwiraXRlKo@;ncjpka2f7rck>^-{aV5-oct+*~Xoj+o^Z!Q$|1*DJ
zg*L^lWF6&ecCktb-}n^iJpN11#eGPkZ(}M#p(_lN>2YQpaui17(ZrNnR4B`$qrKTF
zr(vG8?AxtgegZLv4kAsVVkXCnOm4Xjx6T_0=0^4Ewk78Rq={AuVj8=~p=*?P=1(nk
z0o%fVE**+2XNrFBZY8NYE`74gVgzZ*p*T08>5>t=*<R?>#U#?BV}+kb0X|0pchV@#
zcu_r|*JQQ^6f8M1j63wULtp%SPpl1t_xR}{Vk<<|%K)jlrHq-{v|C_jsYKc|3Z%p@
zCbdHs37}OP+)32t%njVjLvKkG|Lz=*ZavF?wmr4r@C14x58Od=5UloWHSgym)Fwl^
zwqiwY1CCTvL}FxyKR^?uE&;;TLhHM8WIQf7bmY<(1=)#nmhyt>NWfJA7ZRT&rWoo#
zOt}9AA{;A_LBxK65Bl^{U^FR#a!lQ@44~EP%r{_~JYja_xAB5hTEDV`CoKYhg$mez
z24I638d&S0A=N@Fmz3Dr*ukKN-<ac$J%tHz;R*UL91x5*BUNnJ>?7TayCodCXEVHy
zhCWX2!9ZbjS?Mn^xsspTU~wRQDp>#fKDX$!V_nyYQ=4I9;!p7_{#Dv^O|j_8F0B?m
z$!%x<i1b3wZe<)9L8z80^Tldpm*jwdY8S(nNaqXMD5E(!Of-c(enT2fTH`ds{_O8b
z$di>+ts>q7JH~bii$2eG2M<<Dayi!~Okge-%oERn=C%uuV+r?@xCMM{xn@hZu87lQ
z4@X4!T)r7qTs@$V?wtdMveA%X)2-6~xC=!sRGm72pCY6CFZUDB;i5|hO&H&QV=deF
znFZosG&=ORSbx#g=p{krEVhTVT=1CYj`T%~V%^%HBPV$8sNrG4iVQiaG8@`;-4BIy
zU1y@mlqQo1wEE7ggce55dXEU+sR2~`Ri1bkCL5#Kv+@wW@3HuqwW(w@j1Zw{0}`$P
zPyk-6YSU<^v6mTk#rTLD%0=^k)&!yn1)!NuFj}zgye%+mRbN@l3w&wXg4ikOi|Q4>
zXz1|k^(UiFBuJ`;m$iR2{<>kI-u1&E=?G;|O8csfo|Bqo3h&I=9pg67A0><>t}bpB
z_S(O;-ltp}Sjd{Ysbl|kN{Muigi@j5zI9Bzm3Xk>y)Z40<xm49E&fA)`UBBlz`d#e
z@}aoM&@9EG4JOW<zJ%Ur5VzdIBwqyFe2MtyFnh}$sOS%MtKXpw?eYcYI)14!H4za4
z>@xJ$d(VlwMVD`9lhS6+c$`l@g?N(<-b&5Px!97c7v?-_+Wpw7cn~DYrrM?v+xRnR
z*_7zWiIzOMBvjGKP@ngIiMQ<FU2J7^D(6l9H-t`%EpGSq&lz}^99}Z4fqh)73>3ce
z%Px=zIiC~S^Nt7+{XqtmZPG9nu+oTXkmv1|u~udqPx?6UxF{`q;-<qmmt9NR86KDI
z(V*4P|G*4;5f1vzvBp#-*#P)K>=Z(NqcEkFkw;tv7&RMr<y+i;7Ezzhm?pY^%ns-5
zF=N}u7e1cTVK!k%V&ZfbSMbh5(&)dBY11WhviVs@@bke|ruX792bzm=MHA^~0es;}
zb?v!u#UUe^mb3ohF#ALDbm%7I_HzN`eynE6%bExF3Cwh|h}@$q?mN&VJY>?Iqwg`d
z*4e7E4q3O&Q62n$16|DY-D!h(CK-k<H<t20Y->9;WKd7(7LSd{1xz9a6nQW`@9Xo<
zSrG|)7&{`Gn%{xWWE<wyl8l<D!*69t7FEDj7L_nIwVM<xjpcUeC-wQ&27DxX&J;o@
z{E%Fh=t5N}X`P^=HEFkc9D<Tnzlf5XVd9~-89PvMX67M(+JTVN*YBF+wWzr|nn7^2
znqvU6k-tu21mFd1;^@2zTnwDau^9<u8J<3!+yHgB7eH1jMRDsJiU$G?FT^WiObLh~
z3}ue)o=Bqo1Qquue$x^IaPgm2-K6vTfGxnwALfrXp<_&qF5CQPwx5p&KG5D=y(Vox
zf<Ws15VnnfXSow5Jq9M9N19^rz<k~T@)$26DhD7_R9ifWKbq9U|9@=TbPf8W8VE;m
zx9DD8)6&ieEXTkL_b0X6P<A7sanb4z?@TJ1;<j@}eb*vu7EZ9EZi>Fz7^m~4IE9Ov
zT~LPCqq1M&m8r71F<^Tf?gTU*I13-567Z7;=2zu^Ks@s(0zy^jN5t>badN6<)W|tM
zY=Z%dD?={c>t9GRjd1-aRFRb0p*U?sLYC#hmp?QaDAwl-w=IPyH9eCjf|NK)85&R8
zLh$w8hZGw2@uEu~KT^x!iBbQg(d9a;5&K3>#=@Zyo4b(iQrQoO8y+!t&(otm+1*=*
z8`nO6b*@CC+<$LsMLH^n%9_uWvi%>!sb9m-_u%A2IH_YI(b?X_nRb+Ht~xS)fph=J
z0#$R@@^Q$HJu;=k(xFDQVka<oVa0qvWbgDZ<mS-+N=p7V(evq+j1O#d*lxWfMJl7e
zh_)v22lz-)`^FPeNPA*+%IGIJu#O#0wAWaFl~Kks*Za;(O58>sg%B5T-mO#IU0~&s
z3No6wqL>OBeD*Cv7Fet+-NC_4`|e~OSfbR2$qV4z<=XO(7;qm?QfGtXwoOx|cXwXR
z0(eK_<Mx*sC?g<bXD&sjcJHhmHvE=VRh9$IJN)<=`!+57`*F1%rVY;^i#_&yyq7J1
zF4L7NBH6_CDxGX9ZO`8e*S%VvQ_vP0lz2p>8)`ODkCOeyhZ&}2+eu%@wOWMy?-9V%
zJ7{eNLKo8KHRh*1zz3DxDJShpDg;-?DxD&i@TAjpt<3bLnKxk|)n-z@yBn5&*-{(+
zN`oVPn~!B_!-)pTVX|Hu*zZ9df!=O^0{*tLDk-8<X)?`Md$2M!HpGzqP9=92YHKJT
zym;7%99F2yI<l>E=lt2Tn~q+`#lNjJFWP!7BzLhOQfL;_Q4&SApkZsM)*X_*e1kgM
z@cfq|Es2-l8yi6eyJbY;HZXJOV}sM;YS*>qB`o&AV)2Qj$XZtgcY-YPpj5Gc^ZLyl
z?(cKa=Hj;}JxF$1rjQznQi<6RX`>jCGUAPD*IUNe!HAkD`)g8Rg>b{l<1145=Fvg0
z$DIL??NEJ9JT%O*-WLFL{vHM8L-@0VfOc5q)rykF3=j~{w#P)pVCH#RH`zDfx2Uu_
z<QQwy-Q!~^@3gSe@TqDFF(oipBL)d7hDe6@4FL%iF%|?A)+mkJIv&}zW7b>;TC$i|
zZQ=w+FflM8FbM_)D-Ht!8U+9Z6yB`)SayH=7a+|QkWgjLxouUhBLoQSFKrEyn<Qrf
G0tf*1`>I9&

diff --git a/test/big-ca/big.priv b/test/big-ca/big.priv
index e17c2d4..cf331c1 100644
--- a/test/big-ca/big.priv
+++ b/test/big-ca/big.priv
@@ -1,99 +1,99 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIISKQIBAAKCBAEAwwZ5wbb+EE6yTtOA5kFJLoMQ227XSlD4+NESMJ3O4YzhflIN
-slDBRvoBJwbDLngUqCiaTS+AJQDwctXs54Ned49Yfpm43M66Sx56M5BXvKRROhHT
-kC4MlHMt5Jto69gMjQ10Z2zB2eVTozBcDcqQbHqnDWTT8w7ynUl/6F7BIdBrNQ2X
-xB8miGEEOMVoilfjgs3+xHLMZhvi5Dj1VjKtn9JboSB1LGd5bxJwVgcMIISYv8De
-+6DHqr8Obdm+ABP2qFtorDCdsluJ3i6r81OkuHTHPcffA8gxjjsCw17TWgPMFhvu
-ASDSPB6fXO0OelJ7ukhZTw4BGpUvTMkvI8fD5wOcGYnIg6grjFmGQnlrRZF4XVXp
-KFBG4cbN/yFg3eQcgfUn2UfLgRPsBsq9Bf7FO91d22oyW4yE3WOQPCq/wmvfOBiD
-GkAi22WwxMAVAzNy0QKwyiXkE/rDakkHtIUqB8TWwajJfwj1Sd+0Ocbbax9F84HQ
-0FqOfVt87eDOmASbiCq7Mx+EiQ+CKK4/7AFEjiGiaeViOfTpChSfvJcovgUWKjg6
-VdXK9jVvo21v5zJvhj+WADjCnXY4wgEHvU1O4iDPd6sN1PD0hZOghQ9cfuV3Ixa8
-WuPqhUe/qLQnH2ahhnfX8VrPSmurceTeo3mn6un7CwXZdurwjpPsmmT4S+Z6tetH
-F3y1jVjgvbhbWoTQgmQ48/B+E/HdZdFReviW3LQoZx2dtclZDKG+XlPZNrT4Y8ki
-WBCgzoMUbZPx9gefdoIi0iAsE2PomdJELpD0tb+L1Yq3DywMig6nPsPa3MtviIHq
-1ysUXYBVtr9G97Nj9juV5PNko+I3L2iM89XEf6wzMEXjndFFx5huRy48gzJhAXDG
-ErjTZdQJug3swIqH0LRpny1yQJq9vDbuyWvr2TAH5itMF7vOPcHXd0nXhjuPY1ju
-mdQ9gwpGUhJuQVwBTAv8cOk3GpxJ6E0r3k3cmyZcVwvTcXHHYJIK/jfbWr3GnEv2
-5oWzlfs/7ZHA0c+BesJJIoXfhnb2LOCNgooqNuzbDIGpLvI33RHcnh8rGp9mVlOm
-eJxoi/McRCoQ2Ku9J3FqdgI3lNiijZvT801io54d+NLCGyBU7Q8YsNawtWadcDiR
-QiccaQHDMkq5G4bIudOg8UbRqU5Nvz4DMJtxHXUULvswhHlcU5iGY0LfJ5Xb2RAB
-t7il8BvsFrag6EmMf7fqqJgxceS9PPWVNWr9xxJDQjuKcpQopiXYOr3sYLrhutup
-BG2JpDBaOV//iwVrV97GlXcqGMbyizCPzLw4f454zNfAyTZ2KoXCFkWU6yp42P2y
-lfajkiRgTuOJinNsYOsAW21i7oAXK/knzkHJeQIDAQABAoIEAQDBpDxgy4GYT4tc
-GUVzWn9/X0PtnTDG6X9MDssw2oAAFBIRiwdudiByiOl8BormKPTZwvbyjKeAFl6o
-pyCC/z1dGUeU7K1RETKIQ8qySC/VbpH4Rpr6Hb7/5x06T9Tt16cepq1dw+72m21g
-KzQ7vVWJYH9eHS8Vt1HOOpx17R92o6rPEqAOa5+m6i128QvL0VhlGIROKm4pNKck
-VCnFXKxodEXmxoORg2xfjL9dq8Gux/mi6657yjh2oR2ClSDCkw/mOlzEG8F4xsst
-gMna4MI9JDZwcXROHQiXYKBtvEm+puaNTU4UcLJOX1l8uyQU8LFJVWzXwd/2tQoy
-A9B6hm9NgZgNA3HEx8X1pS5Z8pVAjiAlDJhlHtBCfVMsb8fuigCESRc39sFpeI5y
-b/sfaMgNmM8IfXlizTNfXuxn0Up1kQYifLQv7F6v2VibAt3aP8tRHIrNLLI55FMD
-xV+RLmd9L0TNJPps2Eg1AZnBhGF5C6Q5FDxxpHi2n5B74StAZdLIcSVOrYy7SlrC
-acGuY9PeDCdnXgsZ4MNC7xdr+erKQeKwKQRDFfRgYs5mRtNFjB6P/bLCpZkXH7tb
-Zgp5O7mHbWySNZWWSWmA+AP6GjaNCOoyPPDojkTd8U+sArSVySG4kmYnjzMjgaTJ
-gaZOSw0fgxNw7m3uVXhlGRtkcbzYHlGBHCuXncTUvhhHloIcnU1Hs9/DfPwySo63
-0xOvP0lTGZP1wURgIY7PBLKSzBEEWZrH1Yi8BwuZ9hCpZ/hgygzHTTNoHsOUsCRw
-mbXEqGm73A03LmPQuLR+YQmZGcgdPBQEp+o4Jsbdwy55wfLGZEwSUVjivAICy4Gx
-uEzyIRnP4IKgStMQNuypdNoqMFmQeKBZHGgosDorZVQWo7Ojwh1r78Lwlq8nf8Eg
-n1Kux2eByVxQ/Rh5v4gMtEQytcc9FOt/vYKeyH8iQmSil0PESrPz2wfWaChH9CYk
-4NSNCI7/9xV99NIjXAvGRZ/B6aNDw+mK6s8UvpNQs4tMeK1dZ1tzvDCxN3ISqe1l
-ODSl1r44h2Q44yQllTZl/UYiUwUnlUuZ00h8dV3Pvhrm5qGVtrVmrc112+40tM3N
-LYcDChBztYUDVDoE64s9C4FXp1UAEInKT+O8KM9LIY0RT4zKhHa8hAfvLy6YZoLP
-icevE6/aEcxPFbwBq9BuJ37fRnMU+ELa/nSlINmc6IMs11VaOZQbauUHfxfq0UQO
-ao5ImskIPKlW5ro+l3tVo2GSi5fAUX0ZB+O6wpgYYLnQBNXGYd1XCRUtF8ymdKEd
-LsmLj1Q6avI0XqU3rPdiVKtqpUMhcZ+HGmqbZoIx67Lrw5iMcDzy2vdaskQELwtJ
-9RAKz18BAoICAQD94VFeIjjwhvXk+3VQitqvjV5RwEBFdb3TY5u35TD96RdjCp+C
-n2u7k1jwuv02qHbo5mv6XtuReOBtxBXXamG+jafhvPx5+fkAkcOYTC12cZDrzCri
-IbCXXzOL6n5KLEBzE3JkV7jfF6A1E+hlHrcFlJVA+IAz7YpJdlYF0OpD2J567IA8
-ysC2QUPj3FOkXVQu7plorkaTI+3ShjqmEZyWsDOKWIbtBfzJtG9R4WXwKWRrqOhw
-dpOxd66IGKQ5GwtZq+NYEIblfpSnARIhgo7dhEXeNBPbgIql7xap78BcZKq8Iu5/
-xDU5X4qam4pFCbkWE3DH1nwSsCVBPYZoe7hYAV3tDK95+Pl4oo1ERc/D4s9Kp4XK
-QWw7N/6NTQQZ4VOr9peMOuYayS5hI1jJxHW1z2P7r4cvAddm8HAzKoExsKyHqvU1
-X8PLnJ9oDsMezIchNW8EYiQf2HCKz/oAxWTSxrnaJ4otkF2BVdfRkUGMjuoogzMY
-Y2nbnh7r/6bnAVgnho1R/+pXtwqdQx5kEMFCZ+lCgRLUxX1REjnIZC90cNfznhOl
-GkEomkAXClJPo6+MFJNSg4S13gSp1rTc4vyWxaAscQjknarqaMugLOe9cKia4LH2
-bGt0AfpqrVbUWrTOG/yHkBsmXyA+YXTTAFlu0klTn8ib8BvOe1ffgGSP3QKCAgEA
-xKdaONI66IQ0GcL1hJlIJXgygJJO+KsEgtrcfI7YDjXBwVXc3LPlNEoPtI5iA11K
-t0wTgeqq7VcDe4vfydCQXFc4UNxqtx8RbLfPEj2Khp8NiwADQiRSVWo4bH08buxT
-Jf+euy7fK8ATkaK2OiCnMYnBmyepnp6/pThvYMLve+2DGoUOh49b2x73rn0xUZUl
-stqEhfjm8OZw8yyOT2dGUB6gSVaJsTwx55DPh/PxgEbsqgvwDBIc1oqLF5KJsduP
-ukMJkGHaulvyqxFQ+Jq9TtdDNUUkbDgTmW0RhXcX3vm3ZxePQhUqvpbFcr9sSsq6
-HAzmKPVruqU6CADp8fZ1GuPds5cIbPDFb+JtXqV84sZnGOwphKEiK78/EoNM5AzQ
-qB+I2wttTzA/Pon+YFWkVCXfRvqwRP/jk1o28RnN8KCWWDR2RC64Dwo5sF5wTVUu
-QSTYGTJLlLBZ/BIixvaTgoDf+ZKRiC7DPqJg4MPw1zidhwR2yatygg3yB6LZROXt
-y6mPJqvTGClSpSq7qt1j+fGKS82+hNtTSMrvjewTHnF1+jW/t1+unCm9IFb0Sit6
-QUbWWyau+AzzJ7o7MfiTK5cQ6yELKBeWXkzB0T5rDCwrv/aHwlfwBjCNziDLUpJk
-an/YX17rzSuIrVKfmtfeJ7f0qO8Yad8onRCOzM4mVE0CggIAXz8H8sPuDrbjS4vX
-QGdHkfL8frkco7J/i+3jvsMadTfckUir/SpoFZA7Ht1YIAhlzAyeV+j8gQATWrrk
-4tNDZmTopfTr16sjcsY81kdGCxiiIQSQ1hODl9aclRJdXOBrMYELOn/6mJ/Zd/BH
-EKDMUyiiMiTInDKy3cqqjTYKnXeIRV+y4JvEXtvvZ24CZzioW48iOLahPZSOJZw8
-Jo+W6qWiQHXj8Mp9QwMRfGuOfeJZjVZqFb82u67F6MMt4Uq3IGYvPZu9sB2kEV+C
-eNXtWUfFmo55ILGB0qz3GLwcs80EjN6iEYb/3M1uR4CxCCOUr6aNejuKgsxYvbgi
-U9KOn12r6kIHF0CD/3EkhIeYYcoWsNBWjkGrJDBmrIZHUppJdMtnobF7IHN3lfPX
-3KJ68sGipgr9MXKEaFcuENQSchzxLVjC88pAv4O7/iMDqutaiufsBX34RYZC+qD6
-Dw3/PGBX23NYEK4Hln0pIbNYHy6CxL4sDitFzKHuweVArYvAkduV6zySo2PFdKh4
-n1v11T78sPmRogeRczfeO8LyVsH7EqesgRVvepccEkjKBpzHQEt71coHoN9xanJl
-mjUCRGJSLDof9vz74UN9mVMfgd/hMXG48lVMntIbK6hqWfLJwEWZoRY8SVII275e
-QMbxxnTYE6pvbalQFVAK8IvPrnUCggIAF0Rdrl9hTOVnbKzec6PXH2fLQd8NrOo/
-DGRstegItBW0KPXJvesi8T7aANjfy9ob3vgHTtW/B3nGFbYE8lHU4rgHF7ocfjIU
-07Ijs9rIKwlihtGnkQnPHAAHUP64Sb94TwSheTAgg4KkThTcTqBSZ9AOshbNQNEz
-h47XzrEBuL3vRxH7GBrkGVbeoyx4y1hEL5cfGuLKIDKDpqHc7JQhg5U8DbFJdUjT
-9rvxcfpw1maN1ci3zBXQh6m4rz9NP1fk93q7BPQu9uGuIoNX+zIDt/JMJ19Y4dz4
-pKx86DehAWa2RmJJNt5eQlKAZgU0AN1fi7YS/UGcT2cBKLVC+LfaPyY6subpvkn2
-cjhuDEa0Mfibdh1rBCA0dMyZ38zdKhZCEcI5ZQFDG51vviyBhlBbswEQG8vJU0Cb
-YnHIElqlPRUi9KiwXXzRliX1kWJ7EwtC/74mO0TyIFOFMgfLSZMe/M/WsCahRWWT
-ADQiFjXYpv4x1Sm4DEBWugCAZFrmLfquWexj3YVy4mbxOk2GCr9K9uWXIUTkh7+T
-aQdptHb8BBwUg1gcqMuPUza1A8CGAsiGHHcPIZXAGeUeV9L28gChGQU0oT01nra7
-uciHHgSukbAgNQQsJ9hTs8fG316N7+UWMGuT5CTM7Wd7MlaWP7HOvRBMyDgRwWT/
-3yV4X878RfkCggIBALuyVgyrf/8RCm7JN1+NfUVmpzuvPoKFsWIVz7nXp5PACMvA
-+e4ayiEoGcI5aY95+/dJNt8JDj069+SLaWmRizn+4vxcVXArts3ox3VyqsDWVyNt
-lL8xg4ufCkTylcOItxcEfZzIZt/w7m2bEgCBHh4mB2wUrZoSh4byRXhom1h/EVHt
-CotMjQp4NTtT5/7lP6bc+jIjaeJKonz2CmC1wt9QHHpEgfNTrBnmFhQpZOXVF891
-QxtIFjWa04fPtDLK7FlZacWd+sFWOmYA+BAW2fNbl4Q8U3AKNGJ/OkPnaBGg6Dwu
-VrKI/cWdotca5AN1VVHT0riyuAxs5x2HFUTmf2UF9Pl1e6zNQKLabac2CtiYcKef
-cG7liL0/qdE8V1vn16QOHoQcWGJ5hELOmM0OOQbHemj8+nxw+pm3LJ1X3VApHuAA
-xe1d5eFxYUuUtqJpw2G+YqONfhCKDDYhnUG+RLD/ytw7lA3QhXlEzIzfGwHbns54
-JqGStgeGBTXcQv7+zH4fJRB5zbGt5G5SnwYrb/nAiHpwiT4KXoftQLY9ex3A16AI
-a0F5v9Oij/Gz1TjneK0EMaxD9VYxr3yj8lpRmxP9fPCALcTfDVlyWj3Vj7nSSPmB
-wX8QSlzgaVEHdkS0OPZ33c1lrQy8BouQNPyF/DNQFeeDnxXSEBB1FCL6s7jT
+MIISKQIBAAKCBAEA0vhMn1JbbFTKx3bgQ/DT0PBOJ6IXGlSYQkFnLYrrnVea6plE
+WciQbDs+xjIdpZtg69MTh7IkTQQdlGrvoMS53CZ6Wf2rrdJW9hqTZdiaeUuzq6fF
+/8XnzS7IuhLw9fQqt7Il7HVEMSKlUIzj95QOf+t8NcT3atDmVLdFOv+qpzYq9cxm
+jB7xQHbfVk3FK+7PHf5RwyPEUF4QgLpuH7fa5jpFIMo7+kqo7R1JXApThTA2mXNg
+s8zWAxopeHF/Wpx0pBrxOHR5eleorQkE1HQ6qgB4FbEtKWFmle8oyJRe+CDZMuIp
+WjOYUZPXl4LZCxKruKNYP2RtzR3friUaznu6nDVpW5vMV5oKoMx3mw/JbQwDD3f6
+5le5GYDB6+eBUZnMZsgCulmGPv4pPxXMBM1GRCJn79/SSgWFjd4A+HUPETEnLRp0
+VJDtJ/lcENk14tVVWNNYS7eYRmuvsmj4C9Nj0gYDYROz4kv1BVuY6PLKFV5voIX6
+DhUDWAPJwfr/IMYQ12OIG+vXQB/nszPGXXC1oTo0zbSe+sw8AtwHDdjcQgr0sUOr
+4SQ3rcKRzNKMpAOx2N+4YMsQuTWXs/p2moBRscloPYlgABFfYiN8u1X/A1klFbCc
+sn2JJvqyZrP3y+7Dk4wMrb+JQ0nE8J7nphhBSrApKdpRUbdstE/T6J0ZvaxTKLK0
+0L3mAvvpUaeVZ5S3heiCPoM8n9AAFx1nsCEn+FbyzzJeaOQnI/qk0GvbkFjT4saM
+/mS4TpitFAVhwUyudFLcUCF3hKSgreozTG5PBvO8JvOZwVkMt7Eb+7qGObvqXS/D
+j4rQXduT+20pkXG9IqZINnNDI+sPRrr2Eq5UPuO398Pa9TlKQi0amaedVu5liywR
+8TqjjnRBJsxThFxu/DeiTDl9BgEjugt2l0tCAxkS08obP/vparDx5p4BPeuEdkX7
+BLr/Dw1Rm1SZ6b8RIt9ooOoCZnj+Lw54JN+fl9u2rJ+ueLepHb2qUIOU01yuYzz1
+XP6nWZKDyF14BLXXlJ9uxsZi2nKB5IbRYQBC8bT3kamrjEWZCtt1nrbBOKFtCHas
+6XyF3akA7rbY/wZWPVM5wrWLhm0D5PA/vz12GvoyAE+fzsyXDEOyA02lyonKj4I0
+8nAnUeCmnEk5HP+ydULh2kNxiqzHI4CIpxHZv2OyV30aPEzTZxiKjGTwvbrfNsZn
++Ozslm/H06+73qzN223jT5tt9CbNuNr98/6s+iX8PFCc6FPX/65vvkvhVTHTUBbD
+IWGwrSjOSdnlCC1nGyR8K6441b3dZAre4ll2HUwfirYk4J2Xhu82MnJgUrKZrhlE
+8I+gj7dU4WqFdXXPtF7OOy8i5Tbd0dx6kyyKeQIDAQABAoIEAEoLsAjzRPc+w3VC
+ue/epNlenm+2qlkpe881WVtYuN2ek9bnOGAyzs3N9XhmupUXdesPSHmGAsutOByR
+c81/fqRQNP1E1W7Kto7mQPmsDnuoIEWNOydMdNFFLFpyr3QD4MJcmoblmauNN2yQ
+JqsMohIvuoa8vQIWk+ED+h59AY5yqp1ewldHvPEdR8Hoxd1nkfY6/sN42DxE55Hm
+3SPwybmolf6uPGLatXOTpd3SGgJTK7asEjLJIAwysH9/hm1tIFtAwY1JBCH2hlNF
+KRbQPI7SX1NtviYZ84GIUU4lFTgNf24mhtEL7tgjBbY9zKPgR7kkS6LkQs2NQKbE
+iyYRsyuEa5gllJDilfxeB1S7M708TA6v07Xo8CSNVoLP3Emhq2YfqSVyqnWNiziD
+E/pTeegME2LTseEdEwT5+Gk73K/yCogAEvhjbXlsQe3/7rPQoIXul7zrkVyWCzKZ
+OQYdiZl7VtBJtAcnFbZtsbuBC4B4hsFWhK9QnL3Vhoi46ba9DcgrPOhf3Eq7Z/0z
+nNnK51TRMxtH28y2xhFS3H71sEjVw5A76iW5KnmoIrg65fXi/hbaXsJKQ3Jd5wLa
+U6pig0ndIOMIRlN/xXSSdALkaf7o2OVF+ZmEChFOSDNX0w8WnDo7G3AYG7ssNx0l
+CLT5KmFmduwjngsKT/LxWbT4/sHdCCNDYh75yL3Hd+dUmV8mmJ9G0YXtpPBFtCxk
+KUhiLeWX1ZrRSL8mRIy4xfjypmZqnvEPvkngJ1QGb5qynQJmf6pfl3qirr2zL8lh
+yykouI5gy7flrgINzhddVK3UzlYJClKks6vu2cnSGt7Co63wIMBRxPXrV0FRz6rD
+PFbLdtjkvJgWmfu0fUQqXno124ovEaffHtno8zHqF+qYSk07JE6gt8UbrkETQ28/
+c1kQcCmNmlt+5sfZ5aLEKL/N48voaQ8ZXH0IUo+YPVC3keobgpQ3Snx4S5LEWieF
+d+Tbe7RLkUSSkBLFdN3yITsLTOThOouMlb/y/BXlvzt63z041apZO8xVJoq8FRHt
+0vyY6oqakBBqm64UsgGwJwinGKERzNV3AP971n1OSETkElMqjnfoL2OwP+czFzDU
+NJoc/no1fqX+hOVg6fH05uPgwXq9N1l/g/yUzH4s8/t3ggvIscKBmA+4dw52Ydwu
+ptGYyBpAvPxy+FDT9dCD9gKySu60ToP0tGHDUwNJzn330WURea+rjYrLWnGew7PZ
+AtmiSYYv6c6eo5CS5GVoSZRiDrsZEbUQIt1F7cvrP1WiwKzxvBWRSzT7Q+x6KcJc
+I1GG8juNDSX6H7Z9wKPg/3TPHdBEJlKdNrziQWfvg3EXUW41GXw83wiWFFDDrOIC
+vRbhFiECggIBAPu3UNt6SvrixYF+1femlNskteaNAL4JfuO2Ws1yeW7KFxPNctJy
+JnPDYmgXtuceQWcknM+UqoswGGPtR/SeDB62Q3YZziZt5xe1xtq/JKFxRU1I9SS3
+9Z7sWOmF4g+d1+5c4aHcM/L4enmsADFsTGO7KDpGtHKSVPEnHe9nH9aJqwJHeqoJ
+Y0eOUMgSFNKfsI/ONWrlMqfrZdSeLj+ANxocKgu6ULTwwWVf3bOaucrtdm12nNKm
+jtB8uWHNTQtUtdNmHMtftAsEApP2kko6xyGy1vNY//dw78oFVvefX4ur1KlYllWv
+qM0tiTbgTFg+88Op2V6aQlGyoa6cMw7JOAIyAsDMKo6/gpftTxgyte/0XqEfPALN
+OWQQzGLEGUqWWoTw4Q4nnuFX8W8xv0HlLCNMC8Y1+MicGT/fdsYirUWzpF/SXRxq
+rdGpVCxP3hMCcikJdIg5MBi8WhnDPAKqPuTx5jMxyDu/5A/tn+2zRKAnqBN7LfiI
+uWnRpAVIi11cThjzg9MK1qBiGi3zcV8qf3vXD93K96/Z3zSzrrJhNa5kh6dnd1ER
+oQEhG8BDUJ2sP8yumGUR8ViL7ZR0tjStXUc3IkgvLqCM5haxBRvPgEHA59e+vfi/
+nT1KgVd0N4VbRxHalV6dR3mKfolt+wRoTxELyiDYU0ZMPQPiOUoaUR6NAoICAQDW
+j3WZeQpTrk+sSHlUWMLfuE2Zb9rraXruMIsovIl+G6Tea7xB2+hf2c1W20pRz14J
+ic1qxRKvxu/lay8KB5b+AOPF/WhWDF5W26xuwXbM0vH3Mgc0u8u7jdPHOeK+vaRd
+RriXtdlIdDoqCaY8lbvVj0NpAFMuAR0yN4gc1va2G6lpk33mQuhdBaTeQ8Ta4BR1
+FFI3vajhaALlTY/vDKepqXwqhutkmXM+vHEtZpy27Fj9/KA5xDj5ALvNlBbkN6Xd
+rO0GWZUl3AtgTR2h9MG0dFpL4cgTP/h8+Syc4DCsiB2EJRgkTmTwPr7du+PmXm44
+jhUzZA9tQk9alDPoWiQqKAQ5/hIO6iN9dAkrdBht4jxgV2BTMpE/Y8PJMLBeho9Q
+5Tbb1JOFTXXMgsz+0Ffxm3xkFMm4e2ZerWcSv97SxOl/3yNAGn1hCJPC8uZmEawv
+o5TWMOIcwI7q9DaTQO3tPbLigb6wyOBDFE4hXwy19tBOvMp7bfJiWCgT2TQ33O0K
+BBkQqYhpHKn8tUfI5QaU2Q9SnoRMl/CvI4a5ucUnLfFQD+WUxIe8ON6wUZsurd3q
+yI9OqegyW6v0FePB/LhLywTMeq3WvvhWnqgfS85d+sWiHLA8JgP9iB0T2uSeB0TQ
+07iBOWI2445dcMc+NowMcEixgpZyxOpL1qrKJuuGnQKCAgB8Py8lNscd8aOl2NKK
+zGn7hbJX28+6/frpMZC+ijvQaOZdOvLrV7cNOysu0E3S5QdJfzP77pkD3Tic0nnL
+D9xRqIvCFti/9U21UV+Xh/Pv0HZxwIpolnkh+e2lTxWXucTk/mnNOGFYFDh4KGNs
+AdXvAGnJ4i6dwwc0hadsDU4U2p1Toa61ka60mlXbe7lVgcdoJFQPsJSBeFsqSO3x
+IDuSosZKRawitBfyDxDi34PH29CyFXMxM0+ZL4dd9DWMW0Lo1yVtaY74RQF0wafS
+BhNW2ezp70thexiRcnNMBRnnWmi9MmH6Z5t9s3VgZfSpNmGiegs2fBQyOWc/RhCZ
+ws7nnoHnYp+7GGLA1T1OZ3GQwOGYzE8V3vDuKLCKK9uECpUhu7iLARmWh48/4KFU
+SGeyAI5rRybG9u4rrgT1phY7KoH/XlnhdfLYY6mNudqXLYTmJqmjt/66pvYec1UC
+x8AFyDVlnbQFciGDjzp63RsJpql6/DljzTEgP3+jr/xCmBZgkIrIODhasDHV7q1O
+WS7WFQDa7J236mYXoH2hxQP3Ud33zsWBeZ8sbIhDLbb0LRrM0H2ene2wVFlwBvAN
+Lmm1hkxgrxFn5ESKfNRVtuXLDwohXyBsUUCvCUCwx0fEhpqdAHTsX9vw7WCqO2RE
+96vXcSdTcRQhxe30Jc07e6QA3QKCAgEAwsrtvk8YpA5OASCvHneTPJ9LvDDD9RQH
+ajYiMPKydQ5N6Sywdq5a0qKffOqMF6gHPOuh1fxjUbhv1b4wr49icuqF4BuHXQ/P
+mlXHv6ne3GfrCzydNDAG8Bj8GxSfmgH8Nj7dmcacJN54a+/kv35FUMbHMY389nhG
+dG/cICq9Q2nrrZEdLS6zXLiiDLREBV6I1B6F4ltK9pGCh4GaWjIICc14j/d7wBJc
+gal9qvVM8/mxda2kHa3a953F4wc+nSU0bgPwEOLFuOCEZ4K7k2zta5Jy5A9woKFk
+TLm/2hDjv8+31GAFAfk2RLMCf7Z0WpKCyM+dydFe/BfGiXqhgaJM0QURiUD0Thwd
+6mitZoj5INHTdLf/GKmBGqbNelu806SgepYO7xeYct53QxvBVtn57bz2+rmwxc8q
+imwtduVBO+NQBiqkCy/BgpXR6Jyzthj3VSzTFH6+2dGsLv1WiuvY1pk8Tc3zPPay
+O9Q0drGfjZgtWD6oKdUQyF42zIZWlRz7CyvbQbhYwu0mGurN6EKdbgd+lMibXhpX
+hfnf98ADkOVx/vjfuueOP8D10+fS1lc9cUlyab1xtD5r56bz5ws0moMPsUDzkFJC
+jgluozMkgUgJo3seOQ1edA/eLkd9ZUc+H8UH7jIVy7Vea9DW4tGM5kIOjTH8uuex
+uvaCihM5ozUCggIBAODv3U1NeNbEBIGqGTl+/mRq9HQnp0rI5/k1dz79sZDtyCWM
+u3SGpKU9V/a60shcgEv8QDQ9clJHoJ/dP29OM0JdcMhntGh9Or5qDEJVK8/NtkuS
+eqb52cnsEMr9cBOEmdtHTLvOCYjXIailV0BsHDuuAkBlETbUZ9caxob5X38gBemc
++B5P+rE7BhsZGW5rRh7QVE7g1xzhiOhxUhdT02onphLQc1I9cr+O1QxHmYjAIPJ/
+U49KcZ71rZY2225WihkjYVXw2CmO/HWWIl2QLobs2QGP3RE6p/6qTPDbv5Fq8FIY
+upqjNCcKVg6FBqp4hH/GEMBM0N3hHbQrW0eBAV9IH5AXZO1CR353cca710UEZ2Hg
+E9Yu8HK5KWmNSXEmmLC/0pEjap+VM8mxUZ7bmpnGuB3uBiC2DE6ROu64Fdy/j6Km
+bUFo0Y7AMxFk1nVaXpCtYJeLcpsRsq28raRGgI68049DEgpgEC7u9HTmmUlEJNRO
+i6Pf5o9B5Gttc6u5+6fzo0AIJlkoJ8a5lTvcQotTpcWm1lol3YvWEawBlP3T7zvS
+AUN6+Pp9DNoL6yVgT5rN+4NOd+zxV5y3xGZ3Si358uz7LnL5kN4pVnJiK9gPhwNb
+KOB2UONFc1YhzARjozk7UHDJwBHOtudQsfWrmDrZPbnlyFm2fmJww4Kf/d+f
 -----END RSA PRIVATE KEY-----
diff --git a/test/big-ca/req_conf.cnf b/test/big-ca/req_conf.cnf
index e77f3e2..9524ec5 100644
--- a/test/big-ca/req_conf.cnf
+++ b/test/big-ca/req_conf.cnf
@@ -71,6 +71,18 @@ nsCertType		= server
 nsComment		= "OpenSSL Generated Server Certificate"
 subjectAltName 		= DNS:*.hoo.org,DNS:joo.haa.org,IP:123.124.220.1,DNS:g*a.e*.com
 
+[ ca_altname2 ]
+# This is OK for an SSL server.
+nsCertType		= server
+nsComment		= "OpenSSL Generated Server Certificate"
+subjectAltName		= $ENV::DNS_HOSTNAME
+
+[ ca_altname3 ]
+# This is OK for an SSL server.
+nsCertType		= server
+nsComment		= "OpenSSL Generated Server Certificate"
+subjectAltName 		= email:john.doe@foo.bar
+
 [ ca_client ]
 # For normal client use this is typical
 nsCertType 		= client, email
diff --git a/test/expired-ca/expired.cert b/test/expired-ca/expired.cert
index 440f926..6385c4d 100644
--- a/test/expired-ca/expired.cert
+++ b/test/expired-ca/expired.cert
@@ -1,19 +1,19 @@
 -----BEGIN CERTIFICATE-----
-MIIDCzCCAnSgAwIBAgIJAN23QK+AMmhTMA0GCSqGSIb3DQEBBQUAMF0xCzAJBgNV
+MIIDCzCCAnSgAwIBAgIJANbLTjynlDJIMA0GCSqGSIb3DQEBBQUAMF0xCzAJBgNV
 BAYTAlVHMQ8wDQYDVQQHEwZUcm9waWMxDzANBgNVBAoTBlV0b3BpYTETMBEGA1UE
-CxMKUmVsYXhhdGlvbjEXMBUGA1UEAxMOdGhlIGV4cGlyZWQgQ0EwHhcNMTAxMDIw
-MTY1MjQ0WhcNMTAxMDE5MTY1MjQ0WjBdMQswCQYDVQQGEwJVRzEPMA0GA1UEBxMG
+CxMKUmVsYXhhdGlvbjEXMBUGA1UEAxMOdGhlIGV4cGlyZWQgQ0EwHhcNMTAxMjE2
+MTcyMzEzWhcNMTAxMjE1MTcyMzEzWjBdMQswCQYDVQQGEwJVRzEPMA0GA1UEBxMG
 VHJvcGljMQ8wDQYDVQQKEwZVdG9waWExEzARBgNVBAsTClJlbGF4YXRpb24xFzAV
 BgNVBAMTDnRoZSBleHBpcmVkIENBMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKB
-gQDnMgpTkbybjlpmrG+hH7ZBvvrVwJ5TNg9c9FXph2ZUbIfMcH0XUyk7Ca6lDz8F
-tDZO12sDNwG6UP0BvPfmhua8nMuHvOdIjJqF64YVY6NSIov6ClOp5UQgO8ktxdxw
-SC5EI1VT9LmZgwdm1Ha3Set4XHmiGF8lxpYZ+TkhA+c57wIDAQABo4HSMIHPMAwG
-A1UdEwQFMAMBAf8wHQYDVR0OBBYEFEJ5gcaXFSZGfbec5yrTGWZ2Gr1iMIGPBgNV
-HSMEgYcwgYSAFEJ5gcaXFSZGfbec5yrTGWZ2Gr1ioWGkXzBdMQswCQYDVQQGEwJV
+gQCyL1xmtX8CGM5PfEou8uW23mlgQecVzCkWSL5q8oa3v0AUTI6oMJzLKOgCt6ej
+0HNSnGsoOwQrvG1sjR8GNPcSN7MK4to/1xPR4+wlIr+R5w1s8fCBzQsuVEdIthFp
+Hp8U/xB13FDFouFRT7Iztb0Hww1qFQfnKji1f7G7m1VZLwIDAQABo4HSMIHPMAwG
+A1UdEwQFMAMBAf8wHQYDVR0OBBYEFFqbGmHdV/NQQlNSwzcfKNJpdmSqMIGPBgNV
+HSMEgYcwgYSAFFqbGmHdV/NQQlNSwzcfKNJpdmSqoWGkXzBdMQswCQYDVQQGEwJV
 RzEPMA0GA1UEBxMGVHJvcGljMQ8wDQYDVQQKEwZVdG9waWExEzARBgNVBAsTClJl
-bGF4YXRpb24xFzAVBgNVBAMTDnRoZSBleHBpcmVkIENBggkA3bdAr4AyaFMwDgYD
-VR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBBQUAA4GBAHpHwTKopaRPmqC4DMScBbdY
-F8tF0gls/xcW9mXpCfDH4+3bSOMS/5P3nxkIuJcsz6+fw0Ae1QSRv96HHKx1Dp03
-nU/kV4iu5dAd1uMX8SwO6qbfZyoST6i4KodUSwDkW901ptK3QmYT3WqP+IusdAAo
-PHTcUpG4frcj7Z69K2BK
+bGF4YXRpb24xFzAVBgNVBAMTDnRoZSBleHBpcmVkIENBggkA1stOPKeUMkgwDgYD
+VR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBBQUAA4GBAJHrEyQ6gk50iaWb5CmDwXmk
+mJ60QSeogrjZaOXnEE9ibTOU62DHBnRupPl5F5LunBEkj43ZAxemKN66oDjdRRpT
+nO1kDuUFCVO223f6o7iYr468k/JfINqs7/6Rli6kHkOrbiWedu/EA4bCuvz8vtdT
+cZAQwVROG3O8UCWr54h5
 -----END CERTIFICATE-----
diff --git a/test/expired-ca/expired.p12 b/test/expired-ca/expired.p12
index 9eebe8613204be01abb0793a95f2482f4a3a8e5e..a606eb6a03a6cd4a5ddb525ef4854ee58f08e650 100644
GIT binary patch
delta 1658
zcmV-=28H>B4uuYoU4K0q=T2%gsR;rC2mpYB185r4sc2r5vpzKZ$3<CDXVk~01OK9l
z)r;aE!}3rIJ9(PTi9}shqw3_HJ{IEPMOav!QrUk|hrv)6(y(QRISLTj!>VcA4WN}A
z!!g2+5r#=cN>;+$>-D~J{XYrH1@6%LB@6gm*Z4Jy(r$cxsec>^y^d@w6w^p1@*0sH
z-r}pAo&{xAtiemZVGgGICu9SBS>aOEU9Q)}Mmn&>7`kJuLTo4d1}0SfT#H70%lGF{
zTz|kUU6!RH0^?f}f(UzE8^1b*^}|No+Eu#COlW^O457hSVE&xS@l#<r4gF(C8IsI?
zTu?e#EfwP^sDI?d)tvYM6lWQ9@2fN5gpj4jlAa+iO;V#~&<4Fw!81MSAlh5+$SNf4
zGc3j@7j^1)=AJQ8J`P9!jUd1-MYRthj`-xTfQZra#(>#OcQ=uvo%#4LSY-MQks_pi
z$^Pe(4%tiMN?{chvCAX{GmuvApKu<a-fszDQ_*3Spnv{h_{Xhrxb}(|@5$FjrI1k7
zkONZ%QAl@K(sl%o<*kN0E^HBS?B!jKxpqevUm!+kSfo_&xx|>S$cbK6GbZcrwh_9_
z9rrl1qdl&)HVFD>YGUh>3MIpyLgoN^LA@~xxN%@UKx7A?V-XrJxS)l0qkJ^WtMN{7
zeZg{gVSiyjRjv|Uys(*|yF;q@oqtdM-o?9Sb$UK_t_gq@D!jwmDW?h_XdDgy4Ox6G
zl-ByGe&PaRuyqQ8b|~6<A6p|j?D;7~_`cd<8Q~b=6l>k-MnU;42z=(mZ=TK>7_&1U
zjP%V2+3~{WZmZjZa@Dg$x;u|r4icycBC9_m^M90YYHdZES2hVllM&U|TzaRtzH58I
zDf5!6^ks8~f|cSG4i=M_5$D(YDY^Ul#_Ft%o&IT)5@1v;`^`(9LMs=RCiGq-qYGEf
zQSmh}ee4Yd>Cx#NIOt@p5uHs`*I0agdk%QyCfZp3Ssyw<R2g+*LL*o6YoCQ6w;*Sn
zcYnd{x(uYJcZlL@&M!-bdttmAh#|}AGv~e4!@$NwZ7Qw5k~-X`<37BhEbg74ZA#3!
z?BaQ|ea&de!m!(NQ~Uqc=9=96s>kt7#(UM%G-#B#=MQqu?Y;)!#`G&XX@)0C%h-c~
zMWESqgU%gIW96SB_{p(O%v5)9(GhnJFq75;MStr`jwYxoAISm&2ml0v0)UUn#d<ZM
zjS9?0Hi7n0@-bQhptm0pBTgF<H4Qad4aZkkrodJL=b(jrF1{oBG_5pwb2@2K56Iqq
zR2}V|F$26W;Vek!)aHVK496pkTGXD9(X}V&3FDZHaY((h(zN3CUs+PqZllpD42DOP
zYkx-!BAJY2*_jpF+Or3ol8|n{QElh$tg++G<dVZHKW|16-IZHoZ^p#*4gxzJcz5`x
z??KWI{tCH*E4ukBFbLPJSaEbr)Jd>H0FtK7Z(5n%vyRIPX6|vzyEN%9>~zLYIlJ@p
zFBEkF8XizWG$;zQv;3qs@MbY!4zc<kWq(*LnfzhEF!NyV^R<X_cVVN&wRsL+d8Yb;
z;Sn^3A5rdKrAwwc)n0zXonzq7x<~6k)a>UYM!itwsmpXf+QO5G+tww{b41nxu@yyn
zH?h?DxD=@p-H-mq=6`|)d<TX`_?c2K<pGGSI9p>t&<zTgC~piJ;S_Yrq$JR9+kbi9
z=p9ip5!!HFR0c^G&5vsjKnhnqMT((_lV54#MBNid9LbT5=3ZccABLNI8lEU_SZE%d
ziiIJ;8>7_|d+O)KncA0y1vADx`9sP>Kk6Vg+d39u%66b-RdQfu+;&^8m?LLIOCZ)I
zV)M447FdaXaPBI@rUr!xO`}kHCVy_vZY2lnsC6P@<8hzM#vE_Z4v+IE*Y^*s41=bf
z9p?bqZlW&hFX*hA04aeIc?AB#k0~DzL&kg!ql`-A-57=|Mop$(@dUqX@0Y3&HXu|r
z-69^ce&>IVcsti@&0g^hdV6xB(f<WTv>;Lc#7-CQ)4dz8$jeGr+YC*~Yj42gFo#N(
z7+N(skkSdP-}LvH%qE*LB`_lf2`Yw2hW8Bt2^BFG1Qd!|^s2)`LQmuL!${hh_u(<+
z<~cAiFd;Ar1_dh)0|FWa00b20?Hz@H!wttYG+mP>DnNbo&4p|P2=K3+oT~^hk^%w<
E0Cx!_L;wH)

delta 1658
zcmV-=28H>B4uuYoU4MGs9OonfNB9B)2mpYB189RHT2Gh>GAqvxs)IRkc=vM$PP2)H
zif!%<O-Qkp(a*!ET6|5KN=yV$P94xmfxQ)pl6`6Ru{~Fvt#urra5Qt*a?@JtRn+5P
zJM%72q0<+DQQ+cFNMG&M&iWyB!vOV)WZy#y1DVin^sZ-2F@G$Ij6OkcJ%Z~xX9SSl
z@B4fWf~S$YxTbC9Ue0gqjhIH5vQ?TP3;{THt;D~Efng0N2O<V(+B*f8%GfM<L^H6c
z7!hXx2JEZdfof(ZUHf+Ur)a$ao(3oYgizX>V$hHm>M?*1J_ED8>qNYi0nacG6=gB0
zHSkWEdVDhlQ-9%0v+w1g`gc!Qa-c~|<4>xarNcCX$A~-eXD=skADvUIB}W+GhjEjB
zt*qD=eO@HReAWWiSLN$Q)n^&gB7xUWSLQ`tE*(==@*uA1;FeXStXOI&Nh+emd%_Zn
zox0{cZZ3Ct?;&y>{$}qc<1RMMjmZH|CoaPuMGrBi(tpR49a$%9so!v{Ao?yYCHhG5
z0G=8(@Oeq8UPD83PWk6fKi<2wd(;ui0UNEKqw(Z8K(l8tKTIw6N})g!JFlyB$j>kA
z@5XT!00%@7n!Pi64Rb7WyZ|(T6otv|Ci6|gESo5yZfLv}M9b3#Ug9ldaiUg-M)`7(
zsN<_Dn15G9dfT`c+e)u-G{nd|?q1%EG-LElrpobiS7y0~fqIyoL;iog+J@H4giv2k
zx2u$wr=M;iA=K%g|AnmtYc$n7EY4%X)$%ael+#E2>(bl2{r<hzr&g~FEf8^+^Fl|`
zk}p8wd+d9OyeJ5D*!?oA*hcp(<*V>E06536)_-3mGviTsCPfRH>!+D9y_5gk`tu_c
zql7)-NFKvX9UJv{P2HLMJOKTA$f`&zLLxr}y?2^|Z1W{PmELEt-TKt%-~YwUK8Z<6
z)W_{F*CEzxil;xIz~x|e-@h-Ctu0#F!UV3wi(~efHgBDb!Pb3|f};rOCbya3>1iy!
ziGRwM8B-8piaz&qC>?uC`d{QG_$TL@%L0>M7H5*h-#shxsJYUY9h%(+zTnBD3^P52
zEqH7VWo>FX9Bcga?H67{g^6cZONK(SpLaCT)mu_I8Z?9;+KVqqN1+kjbx(?FF&pHS
zI#vP1)Vnet=sYJP|M(?A-0d{C>v>JCFq75;MSoHi6D2t4G7AC%2ml0v0)UWlp~dD)
zd_f0mGlXbG4imBYsda;O(Un;KmvL4vlWE^t20?}aUQaPCj-d_u@%%%v=(k!SQm`Zk
zeqMC9)|~ndz~|aDoQTFD%#RGr&^LrBPJ)ML#*rdjQ#(T*cLd?-i-EU`*Bz$X)uY3l
zCx4noIn&xSX=<=S!S*hiWxQ~-Pw+x<MwN~L`TRLAZJ)+f<55I+UAp^<bQIE_1Hv+X
zdm65H6s;D;pR3JUM}b?`>mLNVM?6<x2H}_>*9Wo(GCPql7F-}8p={>UT?CubtLxhu
zkvm(WQ<!11ge;*MMx@A2T*0kGr4o~smw!{DSMdjj9qGyrVU%(bca!i*rUGZWIbY?9
z$NgpHj~YW}<eQf$9oMGZK;K`n85l2floR?yRVp3`0X=bZ2s4qzz<@uon6|KLW96Q(
zCs6I5J6Bn|8#g$Byr7Q(RM>+4(&Sp1Wrq=U20}oNv6YJZZXCD=9Zgq;_2yN2Fn^mv
zYgwEMI)V*y8`sz$wiP-kVNWE(bK28D&pGBe3MCf#JQ@8$;Yl_T;yJ~(YK`i{R31bE
zJ2S<cfkg1ZX~KfAu~)3d&y#VNh&*snE$mkzjZ_X*af)LvjTdsHXsFL|sG=`3cvH2;
z<4_1y)0d*J_Hl89k$@@`bteXO&ws-rg<!B!xaMgYNn2yUP?yToRU>nM4^DO=^rEyV
zZWu64{IX}Ja&yKQg|?vL2RpPYzOIWUt40F&Q`cEKsn)O4?Bs$PNXZwtWNbsOH)69`
zhvVM#rx-|6@Mh<CGco@ly~eV}WRUI+Eov8?<Fm3ZdDe;r@wID(BXA5-&u?|X>XIxW
zY4hSK(gSX3#sbM@6vjd^B`_lf2`Yw2hW8Bt2^BFG1Qa8XoK}{AkFSnJ(E%D5=)T*2
z$4)RYFd;Ar1_dh)0|FWa00a~y!UUrcNRZI#m6SM@=?i=3moqB_2%qxNmEsf#DFOlr
E0GKfmSpWb4

diff --git a/test/expired-ca/expired.priv b/test/expired-ca/expired.priv
index ff95185..834337e 100644
--- a/test/expired-ca/expired.priv
+++ b/test/expired-ca/expired.priv
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXgIBAAKBgQDnMgpTkbybjlpmrG+hH7ZBvvrVwJ5TNg9c9FXph2ZUbIfMcH0X
-Uyk7Ca6lDz8FtDZO12sDNwG6UP0BvPfmhua8nMuHvOdIjJqF64YVY6NSIov6ClOp
-5UQgO8ktxdxwSC5EI1VT9LmZgwdm1Ha3Set4XHmiGF8lxpYZ+TkhA+c57wIDAQAB
-AoGAC2w3gmWC8hSYdtYyNb3BXYI4FnOL3wSewbL4w68C6UzrcLhmFc7wDJCv5kvY
-i0maHU8bZG9FUJVLytgxT1x+7d6oEpZhZM63DQHNOYq/50e5lyheJLYpHfz4zlIn
-gbdWTVmwwP+jYXH+UXGouV9N3Wb+bPMld4RL/32CF4xnCaECQQD/Kl2cME9BgmF7
-1drjZ3Ifly7Kjx6YnuqDEWm8tNApWz+/C0vXL9hd478wf6JnfwD+cmWBOx2azGEa
-RFSCjVfpAkEA5/ObJkAhSigieK7beLAXszGZ6xHH1hEyE+RBCNon4Xisyub+H2fU
-pMM+pipjyQa834tF9BVupylnKSYMqfE0FwJBAMLpDLp7GH905ZwffmVIpp9E76Qg
-8QEqGv7ldTyFbaC5qBb5vQPx8ze8+VVFmbuvAwZaQfkWPAX76oyS928GIskCQQC7
-cECQSIKeSpCQtbzlame8hvi63UN/2aV+LZXgcWqI6du4m7H/7wgHnT+jR94bNTar
-7wA4npksvGiA+B6DtkdBAkEA7UFEpZxfPRkDXAJosKg6wR/dTQNj4YmwQyLjn+jo
-DiuJGAOpflk/ITn1UhLp7GL7Jvz1WYwZpjrYI4nXxK7ZwA==
+MIICXAIBAAKBgQCyL1xmtX8CGM5PfEou8uW23mlgQecVzCkWSL5q8oa3v0AUTI6o
+MJzLKOgCt6ej0HNSnGsoOwQrvG1sjR8GNPcSN7MK4to/1xPR4+wlIr+R5w1s8fCB
+zQsuVEdIthFpHp8U/xB13FDFouFRT7Iztb0Hww1qFQfnKji1f7G7m1VZLwIDAQAB
+AoGAMB2L5QxDlKxgIaSdX5oln8DlUaHaJc+wlJzmFnkRGdMiGZkmuJIP9OhB5mHz
+ec/TJE6qvP1avfiuz64333Qz9xrrZKihCsdgDLsXWGa3Hpg/yt61Ba797XOq3zRp
+WN6yTCuckQUHIMOH50j5g5GYMCPRE/MAM3R/Cy/CnGDhWbkCQQDf8dhm0W1UNrsZ
+EMsHFVQ7G2gkpJxPQ8nENov/PQwetZXUKGlmYs4NY/DH5QoW25hOS/VmSYV7UH7y
+Kj2eOllLAkEAy7C2XkSwp8SnpnIMf6FPofzD26mZi8mOZ0vYkjG//O4DEUMz21FV
+0ZIb741ymUHH7avrcfEqBgMyPrGoYXGVLQJBAJ+u6HqwPL/+4ryFz+92EwCukz0F
+r3uJv7ZMmtjeI+VF39dPFZDvRTQhHlC7Dc2sudairRJJvIdop4xv+E36Fy8CQE5/
+A0jA3/NHbfRO71IgMDgU2MXGTk34ltBoAkYUthAbCUOVyl4ysgfZbrqaoBc/qnSF
+VG7MqY03nh1bCbDDvOECQBGiBBk5Bntn4BsFBrd02TaypGF7htMhzpfMtK4x0ix2
+16GXhgRvAEROLFry5mJaM/Fg8X3ipxbWCyBEzxWnC00=
 -----END RSA PRIVATE KEY-----
diff --git a/test/expired-ca/req_conf.cnf b/test/expired-ca/req_conf.cnf
index f24098f..23b0504 100644
--- a/test/expired-ca/req_conf.cnf
+++ b/test/expired-ca/req_conf.cnf
@@ -71,6 +71,18 @@ nsCertType		= server
 nsComment		= "OpenSSL Generated Server Certificate"
 subjectAltName 		= DNS:*.hoo.org,DNS:joo.haa.org,IP:123.124.220.1,DNS:g*a.e*.com
 
+[ ca_altname2 ]
+# This is OK for an SSL server.
+nsCertType		= server
+nsComment		= "OpenSSL Generated Server Certificate"
+subjectAltName		= $ENV::DNS_HOSTNAME
+
+[ ca_altname3 ]
+# This is OK for an SSL server.
+nsCertType		= server
+nsComment		= "OpenSSL Generated Server Certificate"
+subjectAltName 		= email:john.doe@foo.bar
+
 [ ca_client ]
 # For normal client use this is typical
 nsCertType 		= client, email
diff --git a/test/fake-ca/fake.cert b/test/fake-ca/fake.cert
index bfbdd1e..f779733 100644
--- a/test/fake-ca/fake.cert
+++ b/test/fake-ca/fake.cert
@@ -1,19 +1,19 @@
 -----BEGIN CERTIFICATE-----
-MIIDAjCCAmugAwIBAgIJAMRgtGNnWt5xMA0GCSqGSIb3DQEBBQUAMFoxCzAJBgNV
+MIIDAjCCAmugAwIBAgIJAJ47rLNvvXxtMA0GCSqGSIb3DQEBBQUAMFoxCzAJBgNV
 BAYTAlVHMQ8wDQYDVQQHEwZUcm9waWMxDzANBgNVBAoTBlV0b3BpYTETMBEGA1UE
-CxMKUmVsYXhhdGlvbjEUMBIGA1UEAxMLdGhlIGZha2UgQ0EwHhcNMTAxMDIwMTY1
-MjE2WhcNMzgwMzA3MTY1MjE2WjBaMQswCQYDVQQGEwJVRzEPMA0GA1UEBxMGVHJv
+CxMKUmVsYXhhdGlvbjEUMBIGA1UEAxMLdGhlIGZha2UgQ0EwHhcNMTAxMjE2MTcy
+MzA5WhcNMzgwNTAzMTcyMzA5WjBaMQswCQYDVQQGEwJVRzEPMA0GA1UEBxMGVHJv
 cGljMQ8wDQYDVQQKEwZVdG9waWExEzARBgNVBAsTClJlbGF4YXRpb24xFDASBgNV
-BAMTC3RoZSBmYWtlIENBMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDPQZuO
-DFEXZX1tjiMPefDs+x50ks7f9YxAXWttg4PDLF5OHhaxpDkEIvTjZhfKtHKWbIb3
-AwtWqVWikRWBfn+zy3GHVgw8f5ckC2GPZdJLuyZa6cCrcebecNFtiNo2g+xo+cPG
-Rzb55mZGkfRu1qc8oSVdHxROg3J2n2dA9datcQIDAQABo4HPMIHMMAwGA1UdEwQF
-MAMBAf8wHQYDVR0OBBYEFCrRoQXb27zNDbFi3agF4fFAddkDMIGMBgNVHSMEgYQw
-gYGAFCrRoQXb27zNDbFi3agF4fFAddkDoV6kXDBaMQswCQYDVQQGEwJVRzEPMA0G
+BAMTC3RoZSBmYWtlIENBMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDp5shV
+W7TJt1k69urRkk1MBD5CEOhgJvCh0PNKQVkF8KjnAqkRDUywUukU0+SIQz/NNYFX
+ATC8t3AFUH2sbvEogcpCPTm1D+SQznEYw5G6TO0cPGG085yOWTSdpXI1z3sGBhTs
+WMVNYF14gmgNik6vgKAth/tSS3MSLAon086i7wIDAQABo4HPMIHMMAwGA1UdEwQF
+MAMBAf8wHQYDVR0OBBYEFJMbyYcSo6yXJUmr8dlyMAkpkY2nMIGMBgNVHSMEgYQw
+gYGAFJMbyYcSo6yXJUmr8dlyMAkpkY2noV6kXDBaMQswCQYDVQQGEwJVRzEPMA0G
 A1UEBxMGVHJvcGljMQ8wDQYDVQQKEwZVdG9waWExEzARBgNVBAsTClJlbGF4YXRp
-b24xFDASBgNVBAMTC3RoZSBmYWtlIENBggkAxGC0Y2da3nEwDgYDVR0PAQH/BAQD
-AgEGMA0GCSqGSIb3DQEBBQUAA4GBADtAdfT4zNLReqjPASKT1Zpgec63KJS48CrA
-dWkx+oEozW4J4Hok+824GpclVPVYnrVpxPbCafyOOfnULzjASeKmk+w7aJq1UiDr
-KWMWtsUyToS+ExJ7wH7MP5gYPMpSiGOi0DNNH1Uzce70h0AvbSSsXJE8Xuks7KA+
-DqOuvWLL
+b24xFDASBgNVBAMTC3RoZSBmYWtlIENBggkAnjuss2+9fG0wDgYDVR0PAQH/BAQD
+AgEGMA0GCSqGSIb3DQEBBQUAA4GBAHUG2f9J6MkrzC801Zw6OpasF40i9mSQmEqi
+lRU0HeV1Aq21giZ0OSdxgfl1abd2jg/FPZmtakowBWdBbs0woRkBlpGr0HRIDSwk
+ajiISVBmWL9KAejQc1e/8QrNOZwTd0NqWLknjw0ecQg6w2YiwzmupcnDOQIDfD02
+A2hHpJQV
 -----END CERTIFICATE-----
diff --git a/test/fake-ca/fake.p12 b/test/fake-ca/fake.p12
index b8bf09ef350c8c620f5befceeb5a04f608832d05..d6a3c3ef9e46853eec8515aafb630f66151df91c 100644
GIT binary patch
delta 1658
zcmV-=28H?k4gC#}U4MaoFmh$$vpoU=2mpYB17Ju9lOo*LQz;<mN?MGrN!@Ljl5^6%
zJpwP6=`7uj1tewz4o#%Cb{BOkq1?*Z8a<$hA+OhBcTs|%_9`X)cw#)P;B&vw`v{~W
z0cix(4(cONBsqygsyyqqt_eB=BsiCU42UZ6v4dAvoc0_-?0-akEwryDp)Bv#Nvy;b
zU+Ai5ip-OXDK)~=qIh%R+ndacmlKVsBMeS$_Qh_?n7sfa5ctSdBqv_*#SewSsmdB4
z#Mp*F1W$W+(CfGqC^j<^<MBrnuPdASn}#tA#AP}8H4nzfVR`b(Vk<4@k5{jIICbDY
zQf3K)(#sFB!+(RbFC7fC6@&V`YM}$bKr?TZ$?abYzt(x9J7=0b%PEP5wnAy38o79k
zp4%{$O0=@Fs!V~Ouq2I>>3Ng*s!Spw@ZDI5l!w(rI1QXVJryhZhhDtU-sI;%e9tNI
zl<$I0#o{UjXsbSR`C*Fh?&BJi7!ciY%hMpadd!;XqJR0Fmvf{R4Y>e{$?$i`evhOj
z_`AeO6JmCo`(${7)*?VvxKc{-_UjyiB=6QBc*%WTnJY;BGVY(4ce}ZB@o`=)Z9jq*
zR+2!iugDItu{y8oa;BVYaa`I&OWsC}+{e!Gl8~25H37p171#lVCS`Pm2Y8BZ0<v|-
zw_Of#B!9a@qb~0acW7c)&-{9B8!K6yPswJ3gMK=!&&G~^lvpn<a9=rEnCJ};Xv9@z
z)ND}u*FrMOCtwuO?Ezt70d-uORniVA1Gkk1+|o$gf5|Lr{2@>wm@8GOg`LF*5IVV@
z5%n@yvI7YPfp_Zlc8Alqu^|7ucp4NhN-?VUuYUm%s#9pmEK!W5F+No(J6c#K71D8r
z$mp)KN$*)0XYF6;6Dazzd}%IfD3D!d?N%-*dTl23aOp1GC6qG<;`XCBiL9^al|^i7
zsJ4YR3~4s91;g;R|CAzN{J3;)xIB&>r?uYFLgT;GXiD=pvt{Qs#!(S2aVFeh7RMwe
zI)6hKyDR;qm&ztr_s4fSoXmi%hky3EPLdEc2Q^K;B!M1dD*JitRhe1Wk47|NbC`;%
z?-|i?xm7XcaX^J`A{V~wPtKO${vQL<$!}s}*?=%gogMw_pOK%qqzkzZkJWGtyCNto
zT5p2^s-#Ex8w@h(a%S3QFoFX41_>&LNR!qBJ%0)lu1AJfehLBt2ml0v0)X5`5Gp8+
zr~&|1sScn@lGe<+JuXn-Rov8@+jZ2<e@GsaHkyM|MqMESTVs&(Y~2SFx*bHUVcKlk
z;2BZ<eZ2{ll4&xbYMe$kA^VcPOeU`H8zbJZ2mYdsv6+rtmg{LKe!XeSo*MHTO5HFM
zsekAf$=P$=PIg>!Dm}OE&2Xlj6yqb@pGeNuB&;LlZtUv0`OOEsolF|^%@$Ic;u2J~
zjjiAR5=G_0?{W11yT_UqXCy(le8;1bP8hv`qa>j!gf`&|`QyLZ-ui+>^?swu>OU+j
zb;d-<2T(<72<Me~mm^P${QY1xF<fQ^hJU?`7~rn%t}jUb{!s26lPx&{2A_K$yy3_&
ztGOT~xl0R7@9C^}GQggQjOB^E%}RZH+<+CC@??F=_U=y0Gt&RC>#_J}NNBM75wOG#
z1L*aAk+FV7i6EKukC3mlSYGcv$b3)oTw%DX@sI~innoS;l_SMs$Owiex+h-qp?_V)
z=m|4;$Hj=UYsSy00rIoy^kM~MI;V`qyM)um#)VwSX1mnI0kv>I_AknXx!L9X%UO(W
z?=X4|^oml9?wV%Pz;mHzGWoF4R{dsmz!j5J<JxWAS54ps-ZA<KzPMaMJ4sO;m2DvA
z3!nN&uc#>`a;9|8CRvuEaE-~#W`8hYMb^K0IQGn-mtwOtYsq;QIb=L}K+uYd)K#Dj
zBKGx2K$P4Bx5huV_@s^>J1_a?GZr2A;%z@f1!htb|DRY5^Ahvp>(^~^id*<5D(9Sr
zg7mXq6-^-~6_0<0Ibpr*(cfJ3m^-cQ*}z$Kx$3?Ku1pC4+(l{`^gq13PH&7)Vvj5|
z%l%8Q^0B-9fLKd<=(mC~B`_lf2`Yw2hW8Bt2^BFG1Qg}VBLZe`*&ce0%0*)0fxMWn
zV6-qXFd;Ar1_dh)0|FWa00b1yM%W*0;I<w=`)I4PD>{l0{f`3#2vL8>oOQ5TW&#2T
E03By2)&Kwi

delta 1658
zcmV-=28H?k4gC#}U4IM~XoSv4F82Zg2mpYB17NG}<_xt%nZfNvfzeGN23ge8JiKeD
zlonn(Ksxe)hIsz?G;FugV6n<J)<K_kPC(veZx>6LO+<pW2rwj~B(zH+608e`r3{xF
zOTh&fRo}AiNiG7Z_qm_jATc>JjjHT_v{uy!_1bb1n2*g+UVq@SAP$5qdHN|p94EwG
z8W$5g7Rh~i7=2dmAvgFVNp+yKQNLLVC<N)P=`})?#Nqmu?J*Kxu(*>}or3Qn>}t%K
zNB3&zpn7+~6f9HPRN;Zh<@<;TiOHIZ@TQuL5?O99Ns`6$*dN!uJ@(BD<_f6^dOHMe
zA@K{<(*@SstbcQqOY6i4o?YAX0w6P!`lEM0KS;yk+V=pFKy&AaJ$P`FlB*jfzQ}N-
z$%)a|PJ8&0mM*m%GDhL?WVwuK?U;p*zF+#fCy}kFB4IJ4H+=%G!-&D;^zwMnuOt{`
zA1o;vo-`Yz9(Mo?$<@r5>Z;_mLAL6?^Fl5*;yBEs@PD41LC=)nAC~6GYeoDw@+yKf
zULj`^V*g;0n8fEQfgS2N&~$+ul+!+$!pv+n-34j}zV+`%+CFCsLI&h^cc>+%*GxqX
z6Q=2<-V<*oXQ&;K%T5+>W!hbHRM|#YsLK0ll6hK>Q&sKhuvaIHxqM~i+Jx9;$h{kk
z*|s5~?|*Q>Cv?@~685qB^T}#z*p)G@YrPX2ANim7K~#_zAu^MO#5a#L@TzJYh~6_#
zl8_1um!h5g*f?eITUkvhBmJ+1>C?<+JHEV_Fhau~8L7MZNT_$m1}~W8-4Mw*FR!OK
z4v^Ywe%@~&DtT5k{*QS^iKE<y?L<#)3Szx`>wl>B==Fv#_a%eB6&Fz3lNkV~vQmf~
z5`&o{=kKFR#pb(oc0m|Ywi&sz=pLaaI|vzV47ub#i{9S^f%|Hf^<6-QH~uVD9XvI(
z2qP-GgA&|;SJ(+FmHz@6zhbv@(w_@yYcS+FhHDyI#S*&1x91s)ATaPScZ+lQ+=QLi
zIDalc97hL%L0N7c!RpTt<ueyPc|1dB3P^+}ltc82y(U>>eC@WW{~r!OYa>xK-s*`Z
z%{p+9#}7GVY&Ac=frVq=c32AI2Ce8;V5c6>wRskU{tDi4I=9U|h!B08uLiltgTsy8
z*9Hec$NSRLSDw0Zv{Nh(FoFX41_>&LNR!qBJ%1aiu^%5Xv$+BS2ml0v0)X@)-rT<Z
zO)QHJIVBJUOv`xKXAwn|nc~H4_r1zf*$Pl2*gPYZsb3>I-9fVXZCm2LHB|CPRVXQ+
z-CF!VLyH9twN5PGQ$@H5I1>f^f};*X;=ft*(EF3#J0LOC&Cw?mnLMXv>uO{^G%lBm
zuYa5qmJXJxp-RTu>Q?vNNtXE;q_80a+l7DJtr>GqX7av;;T(S#0^(V#7`;Fmc*x;_
z>P5>kcf1biNwMN#Od4>!aVOT+wwp=fGQFO!xmyWLH)I!sj<r2m=?d0+AyK6P<$Gg+
zDuE>Uq6KJwx>l)Wqc1r!vuFLSnOk%`W`9o@W;GXFqTQKZz(a>xKwZwMv719ytx4`H
zvF$9=E{p0Fwd&0AmN0#xD=#=C34WNrh9ZYfQF?g_ke;Mh^yqHeeiw%<Tt1H!#<3d!
z@tC_$sn&|-(sAkyU>`S*)RVTkMRIF)V)uQ-1y{G>ACP&?Ao&-?ha{rM!5fNxD1Y=o
zvc~cRHz^hsBy6#=PmA`O>?;KCD!0*t(w3m6S@s4hLt!Qzj)iT<GZM2<>RY5Q5*odg
zKN-;gLLU2-@wB|Qa`5<F#Z+8PN=l>%L|8piV5o7XJ7_bEHc)N6L9p(eirJ?Pbw8w~
z%i!W{B=+Vty&B&AVY95ar1E}_34em9n98C4DHu83JDUO=_rZ~#%OMi>s!8C54ZUB7
zXG1~ypqrC38uGgANy{J<meop$o(>4#o1@CMv$G8)fyY@BH{0MmlM0xu_|&%|-l8zi
zzYZOZvbBdjDh;duY#Q?yuW#^{zK)Qi-iyk?+9<?&=n<5vKV^BDMh>tYX>W%<EcF>(
zj6ExWn_mMvn-iOHBxv(7B`_lf2`Yw2hW8Bt2^BFG1QbU3+_hgiskDvV(>m3bT?y(K
z{5CK#Fd;Ar1_dh)0|FWa00b0xlL(mrp6`l7?--2sfzBGZLl;^E2o-C-YQPYh&;kMo
E07}UjcK`qY

diff --git a/test/fake-ca/fake.priv b/test/fake-ca/fake.priv
index 18885f0..0adf012 100644
--- a/test/fake-ca/fake.priv
+++ b/test/fake-ca/fake.priv
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICWwIBAAKBgQDPQZuODFEXZX1tjiMPefDs+x50ks7f9YxAXWttg4PDLF5OHhax
-pDkEIvTjZhfKtHKWbIb3AwtWqVWikRWBfn+zy3GHVgw8f5ckC2GPZdJLuyZa6cCr
-cebecNFtiNo2g+xo+cPGRzb55mZGkfRu1qc8oSVdHxROg3J2n2dA9datcQIDAQAB
-AoGAO2gBz3CGWd90WU+xiwEX5sWAEEf4VkeKwPRGE6jrvqjcCyYiuR5qXV4rtXaR
-AUBBzA4ljW3o9Rkqe6N8d5arwXgTL2aniAAMihkCck//LJCEsLBteIbfuoBuLekX
-lbQL1Ws2EtaFvex0P28bPmvigOAU3oAbOGHTO3Q8qZIO+nUCQQD1OSpK2DaFYQ0T
-mJDwwNMjQQL5qLAnXbGVURhnsiLu1Vv9m4pNUJ1DhkHSsj2rlNpU8uEPwiKKXbRh
-4zYoMcFDAkEA2F1NXDjTOB2OuO0FkKT8QbIq/dCV75DwIR3vOuSUj9KF+QsVYzHX
-N2qykOobl/IyunNKe13ilg1sUtsBIZyhOwJAXKsTnmECiXjZdjRLYY+cuk/RDgN/
-PgEcIK8ap+UbamHad4YVx43VQDU2HqcYwwRnVX7LKidU4jDy/6LbTmku/QJAFaMv
-C1v7c48xKLk7Zz24pHFG718ev3iFKyqtM/yMBt4M290J5IOlfDtFZEylOcrU2+SP
-vEqlUFBDVv3j3RKm5QJABdr8oyfdf0VL1R9L+7MmAuEpgZYMzEhMPa43OdMyeiF4
-NWSdFqn6eJ6PJAj3g/xNch9Apx8xvm6jX/vvf6Diyw==
+MIICXAIBAAKBgQDp5shVW7TJt1k69urRkk1MBD5CEOhgJvCh0PNKQVkF8KjnAqkR
+DUywUukU0+SIQz/NNYFXATC8t3AFUH2sbvEogcpCPTm1D+SQznEYw5G6TO0cPGG0
+85yOWTSdpXI1z3sGBhTsWMVNYF14gmgNik6vgKAth/tSS3MSLAon086i7wIDAQAB
+AoGAdFXIxku6e6mpw94TpPCzaV+i55EpQsmbXaBjoUcnVAECwQNdu5F11y0lqKpL
+PErWbOZz0iZRa0uBd+M03pK/dobLuKM4uPx+6XqKyGjzP3TFWj8n8S3v3Vf7YLPn
+RI00IkZklPmA6Zwq86woDCouHIQq+4uq1z+eX2UNQJ8iLyECQQD2C4JcfhwN22Y0
+IqmwXCXsy/WkGjCKpaW0V5UPlKe7wz7jyWdp4xmdZd3KyNrl/6nwGwnuQAfsXdO6
+Zs0Posm1AkEA811+UsIZVAeMeuu8i9heT3EcAQfmQK6xCnQaNv4g8B6STkDf5PER
+gsg7YUvB4FMdrFuMSRosCWbeGVNj98OQkwJBAIfrm7xUvlK5XSB39Z3Dif/iPHTH
+MwGkuIGD0Iim6nJDTb6wSDyqhD/7QicABk0Ai3Rku3uuS7I7svdKSwXUO/ECQAbo
+LGGk6Jsd67rBXgSKC4MtrqHI25wSWSv2x5ev9rdZ5sUZykDxJpITpLvKLqJzOXBe
+2MhqWb2akcseNsQdZMkCQHQHid1TRCxukOIyrrM+iXrHkDolt2A2xnJMCFuzqHSI
+o0MEcNJEuQ/wT41tMYQrXjlkdHeL2coXhn1sh7qwCvU=
 -----END RSA PRIVATE KEY-----
diff --git a/test/fake-ca/req_conf.cnf b/test/fake-ca/req_conf.cnf
index a4e1106..597cd4f 100644
--- a/test/fake-ca/req_conf.cnf
+++ b/test/fake-ca/req_conf.cnf
@@ -71,6 +71,18 @@ nsCertType		= server
 nsComment		= "OpenSSL Generated Server Certificate"
 subjectAltName 		= DNS:*.hoo.org,DNS:joo.haa.org,IP:123.124.220.1,DNS:g*a.e*.com
 
+[ ca_altname2 ]
+# This is OK for an SSL server.
+nsCertType		= server
+nsComment		= "OpenSSL Generated Server Certificate"
+subjectAltName		= $ENV::DNS_HOSTNAME
+
+[ ca_altname3 ]
+# This is OK for an SSL server.
+nsCertType		= server
+nsComment		= "OpenSSL Generated Server Certificate"
+subjectAltName 		= email:john.doe@foo.bar
+
 [ ca_client ]
 # For normal client use this is typical
 nsCertType 		= client, email
diff --git a/test/nokeyusage-ca/nokeyusage.cert b/test/nokeyusage-ca/nokeyusage.cert
index 7120ce0..aefceff 100644
--- a/test/nokeyusage-ca/nokeyusage.cert
+++ b/test/nokeyusage-ca/nokeyusage.cert
@@ -1,19 +1,19 @@
 -----BEGIN CERTIFICATE-----
-MIIDFDCCAn2gAwIBAgIJAJWmCb2bQ//CMA0GCSqGSIb3DQEBBQUAMGAxCzAJBgNV
+MIIDFDCCAn2gAwIBAgIJAPZ7YDhrX55SMA0GCSqGSIb3DQEBBQUAMGAxCzAJBgNV
 BAYTAlVHMQ8wDQYDVQQHEwZUcm9waWMxDzANBgNVBAoTBlV0b3BpYTETMBEGA1UE
 CxMKUmVsYXhhdGlvbjEaMBgGA1UEAxMRdGhlIG5va2V5dXNhZ2UgQ0EwHhcNMTAx
-MDIwMTY1MjQ0WhcNMzgwMzA3MTY1MjQ0WjBgMQswCQYDVQQGEwJVRzEPMA0GA1UE
+MjE2MTcyMzEzWhcNMzgwNTAzMTcyMzEzWjBgMQswCQYDVQQGEwJVRzEPMA0GA1UE
 BxMGVHJvcGljMQ8wDQYDVQQKEwZVdG9waWExEzARBgNVBAsTClJlbGF4YXRpb24x
 GjAYBgNVBAMTEXRoZSBub2tleXVzYWdlIENBMIGfMA0GCSqGSIb3DQEBAQUAA4GN
-ADCBiQKBgQDIgqo89ltJt3WWn1M6V+yamW139XrDqZ874kc9+vaJimtUrhJhRb2v
-vSTyQA+DeqqGczO1dONK6D3wv/Pbwt3H7riwRP2FNTUImFf5miy7OPavVEzkk8qL
-7HBjgOw+bq0iFDiZTuAlgJl2zmmUZ1jv8lIVDM5k/y5ywaZ6vVum3wIDAQABo4HV
-MIHSMAwGA1UdEwQFMAMBAf8wHQYDVR0OBBYEFB9jM7treX65Nu59NlropGozGvQJ
-MIGSBgNVHSMEgYowgYeAFB9jM7treX65Nu59NlropGozGvQJoWSkYjBgMQswCQYD
+ADCBiQKBgQDx5Sz93RLCLWRTfRtPmqCzRFvFVp3c+c85paLf4t2Bei/qpu60ptzl
+oizAlcKfExOKJ059FTIMIewVEWwcv7JShiB+v2ckFcLTmX2uB+T3ntEJP2T2sTBQ
+SvGOopjfbOCn1RjskvSofCW5yu47F+pdCWA+XBeUwsE3QFmzRUejLwIDAQABo4HV
+MIHSMAwGA1UdEwQFMAMBAf8wHQYDVR0OBBYEFBBaxa2WNA6NT+7Yh/JWOHWbuDO9
+MIGSBgNVHSMEgYowgYeAFBBaxa2WNA6NT+7Yh/JWOHWbuDO9oWSkYjBgMQswCQYD
 VQQGEwJVRzEPMA0GA1UEBxMGVHJvcGljMQ8wDQYDVQQKEwZVdG9waWExEzARBgNV
-BAsTClJlbGF4YXRpb24xGjAYBgNVBAMTEXRoZSBub2tleXVzYWdlIENBggkAlaYJ
-vZtD/8IwDgYDVR0PAQH/BAQDAgECMA0GCSqGSIb3DQEBBQUAA4GBABaaGF4XDMMf
-l41dMk0ypykGW3fT8ri94+bR+VVPQuhDs22ApWAJ+awWLOkIbVC8027hX/zomDEZ
-j+3UfUxDagSFw0Eun1VNnIf1JvIkL3W6diQrOIX+HjUKWd9DIkXDJGi2q2kYwvLk
-0z0M/dDu+lMBuq8RGUnQpmdbOE7kbwGq
+BAsTClJlbGF4YXRpb24xGjAYBgNVBAMTEXRoZSBub2tleXVzYWdlIENBggkA9ntg
+OGtfnlIwDgYDVR0PAQH/BAQDAgECMA0GCSqGSIb3DQEBBQUAA4GBAMvhCDIdYcDW
+WgWc/S/k7+sEzbA3eASrPR524l/tUwby+VFtDNhzo52jBAB4BXCOeyu3QdckQ5Y4
+AmiJTJ74HUBDVpFsKwVNEgClgJyC8so4FDblPqmuI2vVuH87zUKd467kR8jXU46G
+yo/qd5Pjqh+Zm7qQWdTlElovq5qlAB1d
 -----END CERTIFICATE-----
diff --git a/test/nokeyusage-ca/nokeyusage.p12 b/test/nokeyusage-ca/nokeyusage.p12
index 45311781a5f1cf16743317a1b24bffa8f5aac818..9e0bf165ef0babfa30b6b26da07427913023d6f4 100644
GIT binary patch
delta 1674
zcmV;526g$B4wVj&U4QT$H?In^>H7i#2mpYB19&dK>w{Bnc9l2jx}HQnzVSY>-NR}>
z?^`10%#&fe#2%w$lu@@c=4P%!l1B3|jPhsh(Bz>&hR4CMhkYk?rY+8rVt#%}Sf^)U
zd04!5EQ3JW%ZatDJQbO1B^s?99V9CjN<OBUwLD7N)cj!X6@O6Q&f6NLFE(7>81WJM
zd~;4-?A;{}%gEB5^K65Oi&K-ukjMR(x!7}aO~C|Ss&eFn!Y)re23~k@9Wh<&c^MJo
ztMXO7Qt@|;w9Pf69TC<Z`fuTv8Q#T!F;ZDr#g#U^2o?|($o`k*$EmX78uu&1Ptzl3
zXvVVgh+UWClYf9k$+L@dA*1pgn?6z+xH&PZ68cu+ag&)<A0a^FW$<u(1yKP5FJ!1b
zu{WvcBpO^6$atJ{|G>~B7Jn|Wy_d>v!V-lAB{IDB2Tf)}%l=*XLoxV@-q~LFSUho&
zixVh!CQ&*8-h0LKrSxtBH|YA=0<QKGz)m;Vg78wpRez9gbdLI06r%^xN~8?l_B0>_
z6b`j;T@T1`JZ=8@O#o1VZ+OpxBlq<;l^u%Ts05@M``3M!z)s8gQHDUjFV>?U0DbJ{
z`5gYEi`*jcQp?`uK#{VQ62c)Ns72PuL@Pb$^(p7Hd{4E_;}oX&*_vtNr13tV3%)o`
z*bZ|tM}Oh|na1brbN{-q|0s|8Gdr%8oMRm^VaYQEqt!zukQ#jtLx3#NQ10;Jz8M+5
zZz|59`XInsb#vy08UdGN524F2S|%>;HFwB|L;#i0^7tqBhP=li-w!}>WAu_^NuA8c
zEnOis&~Tm(ktE1gnh>UiVZJ5o=FwR9bm%i9Uw=B&C^UOyX^p%*MhtxI`h>dYNMq~S
z&&6*_d#qkW0LjC-<EX2~`s!GJ=o?0mgf7_hqtkP`{EsGFzCu(Rs#$W;0Z2PUOKnjG
zt)N60Nosn)y2Pn?E2iQ|x7-^{HU)+_x=3Q8No|cp0zy7YE@1z0?Sw@B9#CZylEhZM
z#(zEb%E-Ibl462hjjx1@3j}Ih)X)N$*-Uy~jJ`SgZR)#iKn&R_4OtWOe0lee&K9ry
zIc;j|fn29j+5D3SH<;f9nRorw!XxIbjvPju%lZanwa&6^QTQV0+s^AuCI^|W;*p-f
z?+_Q&P_&ZdL<>zgk;6RzNY?<f0(I)7KM(!i8OTKeUE2bPid|Q~(v#%_Mt}00NnDG6
zs{{f92ml0v0)W0*_?a9Jfv@6E2oyGZZ%!CGqWD@@B=ahf_Sv;9y`E6oY`X!a69q1I
z&!z7sL?z98!>Mo6Ncs)$Jap!#BLFf#_v>4qFp(^Gi{sL)#Wm_sAbseW{XJR-o&EMf
z6umP_+rW@)q@K=A^Ysx=T7OSxn^LGGMdC4lf!VYP{vsQ+tmnCB2mmF3->&Gjl`Aq2
zSDoIhtLVuQShDNk5GE|)PkM+3fN=2)m>9CsWrdj7ohR1Bbo;F(vYy?jB;sGvc%5uW
z^Tgj(2!dRc-KIo;RJ?ZU<3>hXq3(?{CbM5oi%Qo1p)y!C_ZtSIO@AI!0Sf?HC^BI)
z-57ngZc!`bpfgSZGk%jn3j?AA24nF>!9=SeHgS!v)xK(gtMMe=99%S>^d|TIlUQ?q
zbQ=o3GiuM;KA|ifbynSyRPhAoS469*S+KgldK>Vp?WwjJyU5mWPzA(O!XBiYe}vhQ
zn?9T}F2(*T4kKQGuzw5$a1F1ob@+bJ?a<#Bbv`3FZ*~F!@n6N7^DmmM8^Oh`MzMjf
zGvy_n-t~7Rg34B)p_sZOPl$L}0-P8dWXY(S+zl@QQa21u%3(lJ5e(9D;ySdSiuyOq
zWkl;6G92`i-K96y4>nin5AU83`K2IwY6JTlr<z|&Sy7o>l7EWf@ns@yIh*L(OBqGb
zwdJVSbXabI*#%+n1n}|ywlU%ziOJM$oxM6s-4rf4u!FZem&a+hJ|*+vE6xC%gUR|G
zqp;S(cN^!`v+N$09u8N};(6G|zM3fosQ&NX7P9Dln5w}VgRDXbqDZ}5SLoR}wOLv*
zUZ*RJP1}+r?Qd$srfws(%ej{aW#E4NF~0d!_)6<BB`_lf2`Yw2hW8Bt2^BFG1QY=k
z0bhB+1WjPcE(G!I(Im~0h2JnSFd;Ar1_dh)0|FWa00b0ued^R_vZ`%P#WeP#XU$uA
UuLgny2z!xlw;BNsLjnQ_0HWqIcmMzZ

delta 1674
zcmV;526g$B4wVj&U4O>Upo2z=zySgR2mpYB19;(X(I=mxi9-c^e93-HaAlR7eq6rY
zMr{`)celAR$JY>I-!~};E`^$G&69j90!qg;P(-KmipRc_p-8jbK3ImKV@v-XB^v1u
z?RTi%pf|9Dq|KZlClK_v3H-H8vi~WPxF-e_e#`35^~PFeIe(DN+Dw$_)+mc*E~B`|
zZ4F6DY-)X`w_;q{n~3mslGb6tQ?s#7;0c9-6=DxA-=`b<yj8nK<gAS<wY2gqHToyl
zxaxenH7T4@E~O7vBqt{CMNsrYR`h*=*+e2HzuVInQjB>mAoAJtZx(QpzgI+Hle&g(
z>8`80906(Ud4E6fU!_6)(U#z-S}aW5=+I36B(gohZjl6W7`efIlE3J4WNy?r&XUV|
z7Qn97;!kYjh^h5SikhB*^a9E5c~QWwBn84`t0)51tMLfgdH48h-L3?<z>xim6tkav
z9sR5uyU~2iOi)An$)Z*LhxX|3<y6f7EfPg1pa^1X-ha=u14Y}t&l9*MBEqRSCUcZ4
zZ1JJoT_inZwC%=k|0F2~)P@eJ<{gt_t1fzOS{2~UK`O*2SU)yapINhk`f5Rq@u+Eu
zwWlslunM<$i_G*__CmA}GW^Z|oCXop*hwctQ~k25tq|*>=PZO#STP){&TOGi!47hj
zo+PG|41ZjzJ$Il-3IR-IYiZ$bC<QFHSAbD3O8;47z)@wWs!5phdn{nPwM@|#kO@O_
z#~(}?nE1R?wJRACT=<IANXS~<fi@i=bYq(>0*Ujlc4+qFy8n#wN!vNG9KiAD7nT-g
zSOfK|t4)OScvvs4sJ}8ZXObV^K{L@SGFVtEa)0*P98~-f>9makWx7F(Z;g(|Uf7%|
zZK(JAFDMU(D_%}LM~V2y{FOE!w*z6k36oK2h;nz!$XH&T@Pk6S1;xje-ke~q*)ta`
zI4DY7f5$zzIA#KoSQr=0`Az+QNEpv<c6%yv^sPXel{7j0>{lM7rMWpLziE;}YG2xp
ztA7^p%;(f70tTCB3Xz!LTZ9}1gN0m*@Ag^O=hSN}0s39f2@WnYd?+LsAPO2^H-ty_
zYTU|6GvR%8+ttM)=F1wcOD&t`oz(D8_i{(`kcXi&%U_8y%Xlb7xYmQ0LE=Xck(Q>8
zJo56dFWwW!=w%aj;>|ymjMog&;+GgiA`iuQBnJ_4^Rl^oO&<BoSCi!fMt_YWKyolA
z8-)S_2ml0v0)Sz?GRmv@al1-Ao24ME;TZNE7=MqpZxA=jbAcVrL!%aUIs3vYHF6Uf
zw&O^v29AY{{n@-ii_vIu4VP2??sxQ@%~*BR58RMx>!`EgHtRmRZjY#~;H)PF3)sBw
zD3wXcLIUBOy01NeyPMA6M}N%fgKA!qi3g+!BdKTjM@)BELihJ+oFgX9699&)L9d5!
z9S9A0rOBHtM_gWbM{i*ap^>(BD8Qq1KkVhfQI7gQ0`l#FBdlI7U2D4BBW>V|CN&HY
z#J9`M33^7Wv|;=o)KbAPTqb3yHhCphAV+~X`ruG<@Rx4BP&=d4fq$yfbzXjc7oI^T
zT|~2J(0g`9M0(12rW0dc(=eZ$8TYNjY^N3+8Y=MxP{J#{AtdCP(O=rIq9|wZEgJI$
z$_JqV4%ZWT@?xs(@n+OuH(jL>@_kTrYmGJq2R-%50mG6LyjuZJsq#D(QoL}g4OgaL
zos4QpWJx(weZ-ZJ>VI$WmBv_j#l1tp4iUODzL-AuMa;8Xs2&dW$PtWDvSK#Gd8x>J
zjh!lXF0HQCIN=o3{B-b3psL}fUu*QmlVE~Xg#)tOV-^oU72#D$9ig4DFR2bAmR80A
zJ(JKLyUXJGY*`B{>)!&44Z>oCAH*7>9b@ArGpngzJQ8x{W`CEfQxFkldsCLHy)Niq
z*il;D;u$kmZ(<&ETVU7l7Si+(@kMigt(fI9*vwJU%JCKlU4-=@G%)%MJGPzb2;gC=
zRG$tWzZo8M?ZraVPtp_s=je4)X616_;ZR?+f;<Gy_+0mQ$7LHLS7=ve<Aa~<B;3UQ
zhfM|O0CYa6H*fnRwK&3&R9o&s1ZeBKodkLe!K{5TB`_lf2`Yw2hW8Bt2^BFG1QcQ!
z4~6gEna>_fEKxMnDr8QD77j2mFd;Ar1_dh)0|FWa00b0yT*Vp<=s)le*lG!60MyTQ
UW=S>#2*ZE)E_+|!wgLhO0PYPVUjP6A

diff --git a/test/nokeyusage-ca/nokeyusage.priv b/test/nokeyusage-ca/nokeyusage.priv
index 290b664..359f435 100644
--- a/test/nokeyusage-ca/nokeyusage.priv
+++ b/test/nokeyusage-ca/nokeyusage.priv
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXgIBAAKBgQDIgqo89ltJt3WWn1M6V+yamW139XrDqZ874kc9+vaJimtUrhJh
-Rb2vvSTyQA+DeqqGczO1dONK6D3wv/Pbwt3H7riwRP2FNTUImFf5miy7OPavVEzk
-k8qL7HBjgOw+bq0iFDiZTuAlgJl2zmmUZ1jv8lIVDM5k/y5ywaZ6vVum3wIDAQAB
-AoGAP8vzRnpMCWRp8Ya4AHRBP99ZSTW93ct2cqNIb5wOHS0BgWvxRSnfdK8Ftl5T
-kU3SO/0jkrSiLQ8/xf4NJPsXfRkTmXpbJQi8qzS0irIayQNGN8XEGpZJN5ZzYWNQ
-xJwtKy4v1Mhp14viEwcimeD94NxnG6yS+ibHRGelE2iOi8ECQQDz0HOQCtycLpJC
-/Sj576N+lnuNhNRDik+/QgonYAdKh3Tc0sDw6ySTRnD7UjF2En1OnipRvzfXmtbm
-HdSl5gZnAkEA0ogmiP0TtCk7PVgSfxKTdHSYAZC29OmV5qAiXWaZfjB9ABC0Xiuc
-ub2y3cbi0yA4EyEVQxrhNkqk9LVAH5ZgyQJBANMsOduJvNg9cgs5cBNCXu5Wcj75
-zEuPcVDrZxYBk28W8b4NgHVqhOxWd6cF4rcsfoHodikFoN1KTFVVgwgJuoMCQQCj
-s4g7NoXurazJe0UOl9QeVlanyO3qLAMKC/QMqi2p6GwZ8+M74i+AYdfGCNLwlXnk
-rfHJdwotXAc92/2bUiO5AkEAvaz4iWY16kl+7E2ccFHqM6w2Tc9BQMITEdl1Ydvr
-0gn8CNdr5hZvrNn29v7LGAsMqvuZPjCmEgUxskrECB/iig==
+MIICXgIBAAKBgQDx5Sz93RLCLWRTfRtPmqCzRFvFVp3c+c85paLf4t2Bei/qpu60
+ptzloizAlcKfExOKJ059FTIMIewVEWwcv7JShiB+v2ckFcLTmX2uB+T3ntEJP2T2
+sTBQSvGOopjfbOCn1RjskvSofCW5yu47F+pdCWA+XBeUwsE3QFmzRUejLwIDAQAB
+AoGBANNoZPr2BJf6Te19sKnQzVP/kWkVu2BOX6LVNVUQlGC9pjUhcgwmrXZwV0Z1
+XKPkazZaBgnhxVy/JPKAyIkTrMcp9lY8ydLsttB0m30pA/Vp+T1zmv+CCKApRMgB
+fho0avEmQz5vsa9hppB3E1Ikj47TynaJxBbtk8NON5aqv1cRAkEA/JOeXu0Nddmj
+p8p0bPFjetQwDuVnGEpE+u8bvUPjSu6Y9EsJsZfs2VZDifIdan3NvEfo0h2ak5oz
+2TCC1WLsOQJBAPUsfr+0NzIuYQR3wl61/vG5o3Usu0OjPxwx35/TgAjNzIcClCC8
+HvAg76JGCBut4UCjIht5WcZpLi9oomdP2qcCQQCpWbkoYL1TtXe7u01Q9pEC/F60
+vi/f43xY3BW3U1uFFHHN6ro3L2yJVQO37HS4wF0/zt9Wcq8AJLZ6+8HdnZRRAkA6
+zvl4MlorB0TuNWvCHBWTFdxHdvtUNgwlTzE8vRaxBexRViUB1R32q2/PlMzNFuA5
+COhdfrYyCXiyln6eGWFxAkEA3A6CojzW5WTf5AruK/yNR0c2gvNwBjhaJjS/oK4k
+DwrWW06vqIwrptUYREc08Ysl9miysH7lRLXbH8JfddU6aw==
 -----END RSA PRIVATE KEY-----
diff --git a/test/nokeyusage-ca/req_conf.cnf b/test/nokeyusage-ca/req_conf.cnf
index 89c0379..ca5bb3d 100644
--- a/test/nokeyusage-ca/req_conf.cnf
+++ b/test/nokeyusage-ca/req_conf.cnf
@@ -71,6 +71,18 @@ nsCertType		= server
 nsComment		= "OpenSSL Generated Server Certificate"
 subjectAltName 		= DNS:*.hoo.org,DNS:joo.haa.org,IP:123.124.220.1,DNS:g*a.e*.com
 
+[ ca_altname2 ]
+# This is OK for an SSL server.
+nsCertType		= server
+nsComment		= "OpenSSL Generated Server Certificate"
+subjectAltName		= $ENV::DNS_HOSTNAME
+
+[ ca_altname3 ]
+# This is OK for an SSL server.
+nsCertType		= server
+nsComment		= "OpenSSL Generated Server Certificate"
+subjectAltName 		= email:john.doe@foo.bar
+
 [ ca_client ]
 # For normal client use this is typical
 nsCertType 		= client, email
diff --git a/test/root-ca/req_conf.cnf b/test/root-ca/req_conf.cnf
index cb1a7cf..91b892c 100644
--- a/test/root-ca/req_conf.cnf
+++ b/test/root-ca/req_conf.cnf
@@ -71,6 +71,18 @@ nsCertType		= server
 nsComment		= "OpenSSL Generated Server Certificate"
 subjectAltName 		= DNS:*.hoo.org,DNS:joo.haa.org,IP:123.124.220.1,DNS:g*a.e*.com
 
+[ ca_altname2 ]
+# This is OK for an SSL server.
+nsCertType		= server
+nsComment		= "OpenSSL Generated Server Certificate"
+subjectAltName		= $ENV::DNS_HOSTNAME
+
+[ ca_altname3 ]
+# This is OK for an SSL server.
+nsCertType		= server
+nsComment		= "OpenSSL Generated Server Certificate"
+subjectAltName 		= email:john.doe@foo.bar
+
 [ ca_client ]
 # For normal client use this is typical
 nsCertType 		= client, email
diff --git a/test/root-ca/root.cert b/test/root-ca/root.cert
index 8968fd0..7c47b28 100644
--- a/test/root-ca/root.cert
+++ b/test/root-ca/root.cert
@@ -1,19 +1,19 @@
 -----BEGIN CERTIFICATE-----
-MIIDAjCCAmugAwIBAgIJALymCxFFOtFhMA0GCSqGSIb3DQEBBQUAMFoxCzAJBgNV
+MIIDAjCCAmugAwIBAgIJAKNRwvjdf7maMA0GCSqGSIb3DQEBBQUAMFoxCzAJBgNV
 BAYTAlVHMQ8wDQYDVQQHEwZUcm9waWMxDzANBgNVBAoTBlV0b3BpYTETMBEGA1UE
-CxMKUmVsYXhhdGlvbjEUMBIGA1UEAxMLdGhlIHJvb3QgQ0EwHhcNMTAxMDIwMTY1
-MjQ0WhcNMzgwMzA3MTY1MjQ0WjBaMQswCQYDVQQGEwJVRzEPMA0GA1UEBxMGVHJv
+CxMKUmVsYXhhdGlvbjEUMBIGA1UEAxMLdGhlIHJvb3QgQ0EwHhcNMTAxMjE2MTcy
+MzEzWhcNMzgwNTAzMTcyMzEzWjBaMQswCQYDVQQGEwJVRzEPMA0GA1UEBxMGVHJv
 cGljMQ8wDQYDVQQKEwZVdG9waWExEzARBgNVBAsTClJlbGF4YXRpb24xFDASBgNV
-BAMTC3RoZSByb290IENBMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC05doZ
-RddZ/07J2iOvZS5PKdrW96qvLTkZlaqOxSK76JV1WsmryI8x7x0KByIkoc20L8B2
-03BqRxz8DWlf1MZhSp1sgRz3OrVDvmBE+xLTNxBQd6ywihtTSXwjkWic+i/kbtX0
-cY3hOUehvp3Eu0RtC+Lm6Pfa1GoOt3H0lqV2rwIDAQABo4HPMIHMMAwGA1UdEwQF
-MAMBAf8wHQYDVR0OBBYEFFgU2I1O7TwDeiboLxYkHEekcWGFMIGMBgNVHSMEgYQw
-gYGAFFgU2I1O7TwDeiboLxYkHEekcWGFoV6kXDBaMQswCQYDVQQGEwJVRzEPMA0G
+BAMTC3RoZSByb290IENBMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCwtt6B
+km6plmUmXk1okHED/Mratlz01+wDjjEH1/DMs0TYCvjdCrijG3Mcu9czj4x4HDv/
+/swoNwT805BgYP00vxDwh3oraTsaipjaxIeYks8hXH54JZuuLOiM5GuTDLkvXdOy
+VnaNVU9tFtjJX+kYMvozlDVcH9NJwzyQosaUJQIDAQABo4HPMIHMMAwGA1UdEwQF
+MAMBAf8wHQYDVR0OBBYEFNLhBH6Nc1RTScVTrR6E2YoAC2pvMIGMBgNVHSMEgYQw
+gYGAFNLhBH6Nc1RTScVTrR6E2YoAC2pvoV6kXDBaMQswCQYDVQQGEwJVRzEPMA0G
 A1UEBxMGVHJvcGljMQ8wDQYDVQQKEwZVdG9waWExEzARBgNVBAsTClJlbGF4YXRp
-b24xFDASBgNVBAMTC3RoZSByb290IENBggkAvKYLEUU60WEwDgYDVR0PAQH/BAQD
-AgEGMA0GCSqGSIb3DQEBBQUAA4GBAImQUVtrgcgeP/KW0uv/8vKHxn8f4ogYqwpM
-z/h7Th6y7Kq9x+XZRtQ6Q8c/L0AqRD8lClT1QsXHjA1eh6jlpfMsPIx49km8a8LL
-Ci7Nn/fTAP9lBuNsuYYmXMW70JGEtanPV+YSANMSb81nv0vxTANfZPNlLyxKg6fA
-naOpkjnp
+b24xFDASBgNVBAMTC3RoZSByb290IENBggkAo1HC+N1/uZowDgYDVR0PAQH/BAQD
+AgEGMA0GCSqGSIb3DQEBBQUAA4GBAK2QXF62pXErsW9eZZasxSOxNyna/4dNsznP
+GhA1Ua6hWLUFEiMuzagnuALzTceSS9CJPUBgpIxOIR6bcOlY7MvtmI9rIds97VoI
+iCFRCb/eBtqaFgLHwaUFi14z/qxfAscRH53Ub0NNQPrLhOhnMwwvRXJ/wr3zOf8k
+RQtwJL57
 -----END CERTIFICATE-----
diff --git a/test/root-ca/root.p12 b/test/root-ca/root.p12
index f5ca2e7453bcaf0d8247a72ed95e8d46931b4bb0..55f38fc52e2b20b8b404aaee584320d306d38886 100644
GIT binary patch
delta 1658
zcmV-=28H?k4gC#}U4QWhzRiP!>MQ~R2mpYB17Os#(kibl7?G-G&ab~;zPx)=Vgg*E
zFI1@OO<MHQ3Y3O`54V;ab4OS^t)6Nr4jH`pTXyExm}GtAklc|pUeYOc)YyR+U@!_T
z=$AyET}n8$zc3!Ah5`g=%5IClPvAqR3S&<^adhD#y<cA0F@L7!9OFYo<u{v!z_xkw
zdD4DfE0iEzGo=q_hDBKz0y*Lii2^qZC$u8L%s&NA-S{KtFcaR&bu}9R-bk@c#$Fw_
zUB(Juq=2Z}Ccgqc9k5}fgg(NN@?I5u3!`Xton&12c<w6o+^F^Ex{l^88Gz#*rW>5v
zidBHyDy}2AeSb=<%X)jZi#r`YG;-!~)Ah;2Q9o^<9fM#SCAuvz*)2h%Rhr6d-P<bs
znJU$YF)8Ar#&V@Q<q5`OQTgY2-*gzMRfJ&)l42}QTelhEP_^43kUI^0v^!Y$;3WY4
zfTm_7Pecl%?Sa+R-dhQX&+?iNHrZ9H#Rl%b855Zf_<!WYho=GqV{(^ua1Yj~H+o%8
zY9&5Zti=TJ%(>=WC#G}an!X#QWopK^mx49#!*S94Bp7_OQgr0$a2g`6WW5v4+h5o5
zR$o*fk6a<kp+YSfW7(}&|A>Tc`jK#M7n61Ok~=-1zbqzFpqbv)fZXTL@uLltqdgLN
zX2M9&+JB*)hl!SQc~M3>C5><XsSv5#icB>bs%0I6LuLIcf*VKEyPdh&gfbrP7EL##
zg!}!=>)KBM&f)welZo@|SMC&tEt0f(`2b?u<vqn@ekO0zTt*d~P2DAjyRe2ZqSUG1
zoqF06^Wj1}9lPC~KdkrI8H&sa#jqUvBs8xOlYdyTI5hF>A6iB27(j6*s<b{?tT3^6
zz#H6CbPi!wejb8dFseQi3{D*Ho<<1aYYA15Y<)_PfptS*>ru{XJddv85xGssd^=@q
z1!haw+#Ucp!KsNAXCa1K!F8eACC`>N)jD7?7_)$jq(NF-@&|-z?j9UzK#S{l2gZ7%
zihs{WCbQomPUi&H;m**T{jg*d&56TV4-Dx}sZ+infBPV_q#Ddo(_+Yf+3tNG6s+si
zo91GR^C1?Lw$UgeY*-3{nAC*yRDzI$i1C9}<|#C>I6MvB&wIsL8G*0OxrfgK*tZTU
z!s@h+5mgRKwk4tqF)`V?FoFX41_>&LNR!qBJ%4-`%0N^(0;mE42ml0v0)R|wlJQQ6
zjs|Qq7K2)hQA}OGmOoTO`272Gg(5#aH1qOL#xn2_QjijYY}SJZCiJtp4?|X=_&Q%n
zgbA??n~M$s+dLy3AVng@-wen_|B3%HSz5GRa8@-S>J|b9!zzxZDWt74aw5$sIuoG}
zcz+zz0Pu?26C0&RHJgztv0&9@&_@#%K`6ZMQHE10!Vv(Kx+ea_FP^5kiD>(2Be6$9
zrZ60OP9yFSJVbFSW)FYSMvvpUnUR6P;v1%~-l$chMY&3J3QW+L!#oHkh*;pxfxhK2
z;J3s@tP@2+rP3p)-!L^+vMBlAkjMhNJb#VLRmU0gnqMMsqhRYBl4D2JOu+6S1P8z?
zd)Z|7ZTQ;xhz>C>gvMn8P9^`t8#csyBC#3Zx`qO;#+e*q0CYaHuk)iPN<sl2*l)00
z-`bBW<dQkLpNo@x;<Kp6i$-Fw9KXd9t4n*$0{f<Rr3DqqsOco8^Y2fSNDeolS%0q`
z##<TeYuu>*{%3L)shvIUq{t*X$Y{G&e4uh`0h9WLN_O#Yc~LD_&KF4f+?#8fR}yD}
z^wvt?fW!7hRTn(KgJHmRO6Q}0{gEDXiRTD#A>=pKMmRL;r^|Y*cZ)DfDGJyv1n2c)
zRrCpXv}JMJ_`3BI%GI4!Ob!2kgn!|A#jRkl)Wv0=teYSjzk`tIlCB{<#-kmWrewoe
z%=sJLOEkGQA*k_>I0xx8!(9_qE+mnU<W!ThF&14)0Y9pgMAzHP+m5O7e(7>;Jz1jj
zfwc4g75nv~Z;Z(hA>Prp<b2sC$FINDLpm+2UXzpHJdE`v;-!32hjgVY#cx||kE}o?
z@H)x4ZfvFCcm{VUfqla<B`_lf2`Yw2hW8Bt2^BFG1Qdz+&VCxRj6<5i0w-hZ^ZO~2
zjH56yFd;Ar1_dh)0|FWa00a~zwNJ8}*9=clxLk|(i2&X?st9QW2+KiM2v?dYHUa_&
E0Pg7*X8-^I

delta 1658
zcmV-=28H?k4gC#}U4MpcHSo$dVdnw@2mpYB17Izi$j~e4x*k&+Fp3iA6w^4wVKRwi
z9T{m*m!lFLcq^*|Bdy^{&^RPuBFp$t943r<&XDM?hQIc`tB$2|eh8J~EPK)&lgrJ-
zCI%xWMZREO>Q)VQMog;7a$WBfU-!IIC_J*bf>fO?u;#Jmynh8aLx3}hT1!ofxNBJM
z(zQ1>`>RmZFfWROc7oCM6;TL+ZBe`<van488PX@&GmYxR$o1ud6N<>0ABkoe(EJ<C
z@XdwgCJ@?5jL~ATI`K;?T+)`~WG$I7pc>dmHe!1|2a`cwB0yqR4Auz*khH8}`>o4F
zADuB0yUr*iP=Eg-<}H6=zYnJ5JNzR5K9e(Mf~)+Uq{kY)^Ow%`X~BoEujby-vIsM5
z|00HK^}RE6Gt%%$kHI7kgKF?GbVtjhrlL~Gox;f*YK~Opo**|a(*#)N(aVWfZypMj
zvh5oh1Gz?t29l9|V^-FFev>k-fu_an%rksyxZxsJYJc~NR?!dUtCy`;>6-`E^!MS8
zN6_r3E=1C8ojE2=T~Y|2sPWL}e}SLofD0gVpXS{}WxQ_mIf~jvPyv8B33B!$b}!@r
zO^ca2OEc_xx7pH%H*MHPuMj=JASp-od2pP$gClt(C0%uqvZX2}4De62+GPb7>^c=<
zIeVDrK7Wpd6)Ti3@TmA(+#hFxmkm90HI>au?C{ZCc5@)*1Ml@GF0dLUsh3;#(e60s
zzm&HLh@7-PNL34F*oVtN5U^?_I5rVq<WGK9=3e0yd0i1VfVR=8@ysGiyr4F@KAJ?<
z1WgCPSbeLkwq0=#ih>b1H~59p5-s!c>P$N*#DB$wn_`DBk*OPp@E9`0TR7ECq5n(P
z%m;lm;5WgR16Yq$H<KBA_TVD04A+JoVFg2*Vf})bc+?|!AEIgj+oAEua~4o}AY>@)
zP+a9rWN}#L>Q4XsOU7~T!-ufp?mQ)Q4QNcbOMCJaSczm67!YvJJ=U2tAqP*>gJatv
z!GC=_2BDB^q|Q~5)%#)v;Q8247JHjBoGJ>p-uc%~7rmTbVcd8`+;RB7t9~AQttMM#
z?rjwUNCGk_Xq*oeJMX3)y4n;(3cB*~D<^WSJ18<aR7eZL*bqlBf-wf8Bmm5bid!E&
zX*k{X&VviXiE{&01mrO>FoFX41_>&LNR!qBJ%75eq#unm{gDC!2ml0v0)S07*tB?E
z0B?>)8QwSHf1wKMQGTe{U6f9eI}cLROJU*2t&m)iijn?MC#N(^WfWdSx1$ldO7EcP
zg5bk^z??hpOeeN%Ztb?J7;1ArDwHau0#rNrw-Gt{ZY!eb=2K4$Bak|li@-itTev6(
z-G66CV{g30KEGF^4-}uunscu?A{!_eF1vslpT6Z`ArB-{h_**AUsJp?O`Gi(i^I_$
zApInbn8I;}*(-xn!!;}6J-wu)*tL3U@2A`qdLuB_QfDs0#cPxdK=f12UY*DtP%ZM0
z+6XtwZR8=1O<anU94NPU-Yz)~s<F;Z6@OtS7nSDQydD+0P72-%X6l^cuw#AR2!R<K
zw1JT00c*AM`!l@P+$CAkyIQ+@oSnIUx~l<WGimt7Ty-DKF0mf0VmwlkcTQ^(%ttTX
zC}M?IR<rwyw6ab!e8R<CL@@ruW*BZt-o^7UF>fRv-Dgpn5yJ=tz6H|+DNnN9YJYui
zNhvQ&jvu&Bm<weKdm8EW2s`M*IveGcOeluzsE(rBbg5fpv=>bN8#s7DC8OfolU<lV
zHCzD^trJ!@7k|}*^|G}*OBv9Od)r6b0N-QOPCKpLo;Pm(&$ESmB{%dtn-0zCIHrGD
zO(C~Tf97l|$hZNENpE;H306c`ZGR0`t+(Tz=DEr*w$3l?aIE2xyY;CfJYOlY*vrn(
zJ^Q#2spxn@+}NK^n5|nzo(vIS1j;dSB!b@n8JV?1uLbUNfhv-oh+Ewk1Xp-qzTd(4
zR15ssmmL6HAH~Y3#-Np766(`kExzAVuQdk)wl>0e?R0t3)d5Js31}`nXK$zimy(`!
zqfF;6UNk2C`4y0Rof@YxB`_lf2`Yw2hW8Bt2^BFG1Qeqc!ivC{CiZJYVw0uN-iD~`
z9QH6VFd;Ar1_dh)0|FWa00b1#){4AqfSc?m#4ahtSL%OC=n<C$2y-i**=BC@`vL+8
E06x<Sod5s;

diff --git a/test/root-ca/root.priv b/test/root-ca/root.priv
index 09e435b..10a31ac 100644
--- a/test/root-ca/root.priv
+++ b/test/root-ca/root.priv
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICWwIBAAKBgQC05doZRddZ/07J2iOvZS5PKdrW96qvLTkZlaqOxSK76JV1Wsmr
-yI8x7x0KByIkoc20L8B203BqRxz8DWlf1MZhSp1sgRz3OrVDvmBE+xLTNxBQd6yw
-ihtTSXwjkWic+i/kbtX0cY3hOUehvp3Eu0RtC+Lm6Pfa1GoOt3H0lqV2rwIDAQAB
-AoGAb6QDK+G8fCBigZSMvWxWXijYlB6ZSi9AtBd4AVCMlSd/RcPX/ppyNUD6zPuG
-CNGK4A8wWqU3FX/51Vx5kdkA7HPUB4fiXJmFLKyCQJhrf3YyJpH2aZiyBWpWJ97r
-JXLraGMkoiEz3GhZPvyzrI1YSXo9jxA+JKbkXS65E7O11LECQQDp2k6o2mCusq+T
-gyLvLFjAWPfqfaMJ7BKOfJym2PkAS0dC+6CnV92U6uPOWiSEjh3Ob6XwEBOu3Nzs
-WXZnivJTAkEAxgerF8HyG/FS0w5ec0WcQ8rFu7/fcNgvPw7bBwy7pdUzKZ5Q987p
-C2HZAOTKWT18/F1OyMtKMn7AEm06hHcWtQJAYAWR0ueIV3NrgKiSCZ8t+h0N/y0D
-aymSHQuxzxi8dZBzfF+SAeSkSWeBjtOYtw0b1A4oFsCjNGPgGvRJGA8HnQJARauS
-/SPF2yDXA9wNTL7T0GH5mSlTIi9cx/GhC2Tma9yLSHwjflu0T8XYA+F6c1UXsO3e
-9vPWoddIGfOF3+7J9QJABjMCbdOPnPX++E/pkqpnkdEMjk/n8iXx8YCVbEgwl8hP
-/CRsI7kJWgzCvzCrH81YCO+DeQljX2XDUiOkM6DRYg==
+MIICWwIBAAKBgQCwtt6Bkm6plmUmXk1okHED/Mratlz01+wDjjEH1/DMs0TYCvjd
+CrijG3Mcu9czj4x4HDv//swoNwT805BgYP00vxDwh3oraTsaipjaxIeYks8hXH54
+JZuuLOiM5GuTDLkvXdOyVnaNVU9tFtjJX+kYMvozlDVcH9NJwzyQosaUJQIDAQAB
+AoGAd71BobyOHX1ZxpjJjNuqqJAHCBHfhMw2EOatVGo+sQWb1WQB4w0btPGpm0Ow
+ezB+dvhys3B795foWkQkpRmzF4Rb7w3t9DQ1tShqwyXCPTURSl9RxS8nQcGUX2/Y
+/8Ei8jGEHWn/8IyryJmnetCulibNFOTVZrB+aAxBPWhopEECQQDmoC6ks//tS7My
+9iXx48xyM4Pd2UYzM/eRvjuYsaAbYDF95w5Ai6esdLCVNJgAUe259TtO0cdJgJup
+EJwBlVkxAkEAxCg3PeeoOppBLxvtLszlLf8r+DmteI57hGwVPHtIElX7BLg9ItoT
+7joP/ZRfE4VZApuf4/kFUOCkb7/U9aWtNQJAO/FibjjCymCkoRhNYIO+/efZ3G2+
+y0w0itMRFm0Emlj0RC8sCybBXBewVfenkl25Fl5hHel0jOw6iUTh559z4QJASek1
+V3gQZXR2F0AYkMfXmwtJEBD7ki9tzynCnrV9JJuNJ+wb7SPq2pq6J7xeTsayEU9+
+YbIVFLJwg0LvBVhV+QJASxW/aJQukNB9fZC3SFBz/6ed17lpK/F8958lnbNJAx1S
+Nvcv/KvKiND0dFbAvu/GzL69wjqTq0P6qIQ5U3pYUw==
 -----END RSA PRIVATE KEY-----
diff --git a/test/slash-ca/req_conf.cnf b/test/slash-ca/req_conf.cnf
index 41e981b..157af63 100644
--- a/test/slash-ca/req_conf.cnf
+++ b/test/slash-ca/req_conf.cnf
@@ -71,6 +71,18 @@ nsCertType		= server
 nsComment		= "OpenSSL Generated Server Certificate"
 subjectAltName 		= DNS:*.hoo.org,DNS:joo.haa.org,IP:123.124.220.1,DNS:g*a.e*.com
 
+[ ca_altname2 ]
+# This is OK for an SSL server.
+nsCertType		= server
+nsComment		= "OpenSSL Generated Server Certificate"
+subjectAltName		= $ENV::DNS_HOSTNAME
+
+[ ca_altname3 ]
+# This is OK for an SSL server.
+nsCertType		= server
+nsComment		= "OpenSSL Generated Server Certificate"
+subjectAltName 		= email:john.doe@foo.bar
+
 [ ca_client ]
 # For normal client use this is typical
 nsCertType 		= client, email
diff --git a/test/slash-ca/slash.cert b/test/slash-ca/slash.cert
index 5902073..c591946 100644
--- a/test/slash-ca/slash.cert
+++ b/test/slash-ca/slash.cert
@@ -1,20 +1,20 @@
 -----BEGIN CERTIFICATE-----
-MIIDXDCCAsWgAwIBAgIJAI9If1GAVZjzMA0GCSqGSIb3DQEBBQUAMHgxCzAJBgNV
+MIIDXDCCAsWgAwIBAgIJAIg5QkW7J8/JMA0GCSqGSIb3DQEBBQUAMHgxCzAJBgNV
 BAYTAlVHMQ8wDQYDVQQHEwZUcm9waWMxLDAqBgNVBAoTI2h0dHA6Ly9zbGFzaC5z
 bGFzaC5lZHU6NzY1Ni90ZXN0aW5nMRMwEQYDVQQLEwpSZWxheGF0aW9uMRUwEwYD
-VQQDEwx0aGUgc2xhc2ggQ0EwHhcNMTAxMDIwMTY1MjQ1WhcNMzgwMzA3MTY1MjQ1
+VQQDEwx0aGUgc2xhc2ggQ0EwHhcNMTAxMjE2MTcyMzE0WhcNMzgwNTAzMTcyMzE0
 WjB4MQswCQYDVQQGEwJVRzEPMA0GA1UEBxMGVHJvcGljMSwwKgYDVQQKEyNodHRw
 Oi8vc2xhc2guc2xhc2guZWR1Ojc2NTYvdGVzdGluZzETMBEGA1UECxMKUmVsYXhh
 dGlvbjEVMBMGA1UEAxMMdGhlIHNsYXNoIENBMIGfMA0GCSqGSIb3DQEBAQUAA4GN
-ADCBiQKBgQDGvUstaalxpzmvku/qAqFNopTCrHwRu88r0Mzq1GrIIY3moADQKqDf
-LxEbv6qbqinyrBWBkjuiNWD5dwrDMT44ifFlYsHTXPk1VmRGcWmCgpDbxkL+mQPn
-U2aBrdik4tLlSyVJYMjm2N7lJAOEaObCOC7AayJ09igehHXaISI/RQIDAQABo4Ht
-MIHqMAwGA1UdEwQFMAMBAf8wHQYDVR0OBBYEFCJpKy919GUf+8BpVr4QGhV1bc9S
-MIGqBgNVHSMEgaIwgZ+AFCJpKy919GUf+8BpVr4QGhV1bc9SoXykejB4MQswCQYD
+ADCBiQKBgQDluI75hMEoE1TGyj7XTjElxLx9LKCj3QmkuNco7/nSVu3jXkEWSUSp
+tfNLQ+nnWZ4MlPtL0x21BqFZA5YGV/P8T/Q/oX8fTyFnLc2FTWAmujrbpQHPknUa
+EO9CRiJjK7DuoWwsEjRClbRuB297zrTdQH9RFzJ8UbBt4bi0ckNp1QIDAQABo4Ht
+MIHqMAwGA1UdEwQFMAMBAf8wHQYDVR0OBBYEFBryqVaj4vDBMxXwlXHGXyWzH1L6
+MIGqBgNVHSMEgaIwgZ+AFBryqVaj4vDBMxXwlXHGXyWzH1L6oXykejB4MQswCQYD
 VQQGEwJVRzEPMA0GA1UEBxMGVHJvcGljMSwwKgYDVQQKEyNodHRwOi8vc2xhc2gu
 c2xhc2guZWR1Ojc2NTYvdGVzdGluZzETMBEGA1UECxMKUmVsYXhhdGlvbjEVMBMG
-A1UEAxMMdGhlIHNsYXNoIENBggkAj0h/UYBVmPMwDgYDVR0PAQH/BAQDAgEGMA0G
-CSqGSIb3DQEBBQUAA4GBAAYYKZtd0ius8+Roc/o9n3r0GLhWmoWxfXL3THKMQ2o4
-w2FLcOyMr/y8bBUT+aIho4JdDmho4wedMX8ApQLUsyiKk6R5vZ8L2yX457/dYVq5
-lvbl9FNpdVDpDbAJfrT61OLVMD7p+nfNiNoSr8BnrGpgo1FYRruJajB9+FvS1M3u
+A1UEAxMMdGhlIHNsYXNoIENBggkAiDlCRbsnz8kwDgYDVR0PAQH/BAQDAgEGMA0G
+CSqGSIb3DQEBBQUAA4GBAI9+LLLaK1ANc8da9g9w2d8i5jN8ln6pUKcemE0ScT+3
+F0Qyc1jdqpmulEtrHD8/XJDydSoiKhhaWqYbW+KZYIumoWG8fUJ1FJLQfvUqCLaS
+dnIvE5h7BaEBERgE450YP1uidOoJXCCqUgpr3SywrSUwEfykwF2veljqn9poYSOM
 -----END CERTIFICATE-----
diff --git a/test/slash-ca/slash.p12 b/test/slash-ca/slash.p12
index 16c06a1c55b7dab850c10b5b4e244a4ec1630523..ff9fb631a9a4bbbc70d7cf27086043690b7f32c2 100644
GIT binary patch
delta 1746
zcmV;@1}*vB4&4rrU4H<*5_M6GuG#_u2mpYB1Hj-`0$F_VWw}K13YQoLxpwRvZ_VsO
zpSG&qxko?tnbLCtes@MlfVnG;N^L}6ik2?8t!6`WxBoq2GFS0Mq0C`fbX!$%cH7Yf
z=_<U4an5O1Qv-8?d-%#v1)9-ETjxF`_yxbf14IWi?igy1S${08;gwg9H#Ns`7vP;5
z?#HGI0|X&o@6ZW3QMH7teK$Tx+~u$T^pf-1GAslhR^N7~W8D~EmCsrCWK&*8lS7rk
zj|K^N_`^l=xRjIVJn;^aGB`N8r{ILsENnOst14o_Uaw!pDd~OCTvRQ{JHE%Y_*ANu
zyiaAJkb$=Icz?7C{%3mgZ{uN>ok>Rbts5*IIYVVC2YX6q`rrJ}+A*>;jkW23BL?EO
z6Di17+ZPN<N_*zTkuRP#?0R*B_R=-c&s%bG=J&;`u@isN84(4Kd8eHdk(spc7&0%h
zkv7gZEhF}NGJ0#iv8^Ml){9byjqFq^Csr_f5O6ByE`QImPu(L4u{g`bt_pO+c!*3_
zy7v(}0la)i<v5<?%ntxBeytMOjrC&~{Kn3MvOyonCa<kKc>R-owa6s~sPAR1Tx&et
zlPDvI=Md5!bS_tEPqs9D0w>{+Hq_TV6*fi<$=rQQZ1@G3s2^h>xXD(^O28>J#;aGi
zH9i33BY!$Ua-BsrjH3B8<acK4WV8fkNNb7=_Df#x{xC#ckgQjlY%U<X;jb;tr<`))
z8Op{zdOi;L{aP!dCa2g4Q|1bB(S+;6Emd7wm)c(AZ{(C2QI>c%8R~3*@A$bUm$n>G
zyr*WfWcTB(Ccj&Rj|h$27wOpopD+W&KiON<cYn-~n-t0vJ|LUn{5{Rl^DKzo0BD3(
zr06GcAnD2p47_w0+empG%dfZ{^@CC$F>6_oY1Go+P)Qx3(gxRfp;IsYIP*|M0?RO<
z=!H4w5T2Pqcu$guJ+NB^QtLg?25l~$JARW)xDvpjbMf6Gn5bKsy2ARj|JS{q;KY1x
zOMf8-ncEK|qs$Q-$x2^9Nt?r{*QEX{kKApbYD?A@Nsaw;dqiPl@KJje1NgAQ1*Wix
zGJAkkDfB({au6h7{7O2WQVlmV3g<N%Vh2S;jA$acjT@0))A>UR%*M!g1F-M%>Uii=
zZ)eujImqzwG~IX%VCJiMWZwz=ULshacUL{fP75%)S*r_PW(&4b?ITJvGQ@`G*TLX5
zM|eWoY;*l4qq<H~r@Wys2JjWNH(Tlw@-PRm`C3}@LM?7ja-7c69xDWps&ZPn276`A
z23phhjxQ>b8j~#qMt@~R2z%k=<v{`h2ml0v0)X(G?E<Et{}3QTX`@O4q2mtpBsJmO
zdEpoq6z2AkW-d({Vnu=7ifEi|@m^XDAW72MZrkJ0@PC$yThGsJKEAd$j4Igkiv6C3
zFaPxCp;RQVczzRm<-39(nXKh8*`azwGPhrd9`eqrydIHtXn%vK)(4~$3?L$S&GMn6
z-j8+q`;toZ%B7QHUAi*GMhd6qX?#esc49C*5Mnf2m+PiZN`i6jD%iWYcHW*ehAT4Q
z)@T=44(cAQx(_PZV6s8Jwfc8Ji1)&Kv6P<wju*)TN&k$7<h=S&SRtDzwProcbSnUr
z<3-Ah@jGQpBYz>UPINh4lcv5{^XkO3V*Y~!>xM`TdvK78XO0)M(Erz%gEx><6cB|Y
z`J#bm;G7jzicbG`Tck+~&Q$Z#%0NX4F4uVW;A=bf4wFz3=Vx+sM@uaOA}+E$W9+Mq
zudK1`%KBIkYPVqPAHl?b4P6r@;J=g%!^RmnsA0O@n}1v<zdiQb**aS|q=iZPVQfH?
zb>mA1`e0YVz?$q3YE2JGuX)rl;gd{?0J3xc?f8G)4O&I%l&-Aj6|%G+_0`y9Hc71N
zOB%NJ*)F`aSkX<s=pb*>oJ185v_vtgVXj>3eLiMLu!ml(iv;U75?0zaq~Kk!r`K6U
z1|nGoJbw{j2&dqey4t*#t-Om%i&5cPfz166=){p>MRW257v2;1fn}{;^D;K#e_UH$
z_*S=MDi@*8RQ<7i4%v`5skrTY1`DM&&~)WWPWQKY{<Md@K@LB{C}D69jqB#qwawB!
zhRR$9V;xR4?W2{8qP5y`T1QrXU08)#GWYR`jBn=`<%w}*Ipg6t9buF<ZH<jZJR-F*
zB`_lf2`Yw2hW8Bt2^BFG1Qb^TJXKK(J|i81j|C5gIfAFbonA08Fd;Ar1_dh)0|FWa
o00b1-juR(uGgyJhR<g0M3wYjYkkD!b2>mNz<*XPkkOBe-0KF+oCIA2c

delta 1746
zcmV;@1}*vB4&4rrU4N*UJJa5u%;o|D2mpYB1HhIt9;Ut*!<Qo?7F_=1zCkO)U?)95
z3m^1Epb*J1P#>b<nUbsqV5+G}KAp&7&f35!MxF1fDjM->S&2$KYT=|$fo78zN2RDS
z|8)6)oJ*<|1P`^Ji9*;{HxS!Eu^#IVir5g0>$Lv9T6?qmlz%^(h~eq+n~0{JMjZGk
zLc~8?TlYiZsDZuOc{H;COcZ}Y$c6d{-o;|UPh=uph+U^oWPckYv+f4O7~bF!td&bw
zrk7AV-?E~j&&tXyqY^VDKQz>ayM9~<zUe5PAM8}!d%3qk1iiJO6Ik}=!i+dvPpzk+
zDp=PZF1+jU*ndVKH4q&ATVF?wyOQUz%8>U#W4_J3S+8Su3xq?RA}9u^0E{ndL=f|Z
z+)p+?M0;Ci*jZB{CjP=y!TY}VYY**vx^6K7K3%{(F~SYq1q?j@OBevW>i26x_Vdnh
zdkO7q#wTVxHTF*S>cUIE+O+n1GawTaiaK+SjJ8U2<bQHq$k7^@Sh#&Yq7;6m0QBg)
zsGQoY;jt?4o8kii?E_nhcP>hl4UH1=8)m6#a&Dlb+x`#$PVd;B!)aQ-BidDvO(+<{
zD}958bx&b2r>{p6&1BUp5;4ZuvwZss^&II{OHo@B2ng>KSBDLY%^_*wVvXHW3#&%o
zYsnS9h=2dpOn0-L;)crXvvD*iLed40H&KGS6NtZ9zOGI&fpz{wI7?xlq@++y>(Pfy
z;Vv0+{acHty!mQClQNXN>X4#cDkmsxO<s*S$o{Vc0L9WSlHWa1(O@djG}t8TZ4*`G
zGJfVD2bf9sY1YQObZH@x;V`DJR!$fLRS{$OseeLeVSap(Vdfc~gPo)>v><%4r`w$O
zk%|TtLn^{Xo7NCK2gb*WV`rN|4%Z5#N9d^WoSkj?tfY_}XwDD_E;}Kk&1sKcj*P}#
zYFiEco63eqH?1810fBM1u1|V=6PkB5X%;#K(?$Fbwu1WsFD_A}E43Cccl=5DJM1}K
zPk;A<?)a^1zh)~`s}n;lL>aa1!lt^bbitxTi%@If6eg|WRwvM)?WaDH8>eH`ht-g$
zKbfNt8o)4P))zt2MZmQy)pAd1k&ds5dNpa3F7I;l*ONqRr&+RC>-?<@6ah_)NLG`*
zjf_A&a;|y9%jKckR(jB3DD0^^Ua!n0*H@GE<;Aq@>ZTbv?)6Xwp5B#)mBw1sYVUT5
zS;{>K0UJsVR~!LF3*7)d;snbFJ`}5JU^X->4czpmi&lZUP|JI>4R+2SLHt!|;O)PF
zp_Hr0RTZjtuahkVMt}AYw<6$n)P4d22ml0v0)Wq{W~;7`Z(}nsmqF*kQqc7g0}b2m
zTBbc$I#ywmEsQ>^3w=}jQ<DfRp^77LAOl%8d-C6W8Y?81;Y^F2ey9%rJ#&M!!#D7e
z3bX&xK<8r*7=~t8U3i)VA`FVW(DR6l6uzr)PkLq@58I8ubbq36alBh~=L+c1Isb=j
z*To@UK~^Em5``Tsg;h7w&k$dEW^_Xa2l9KYIItDi#wB|ZVF>#n8kunHF<gd?4?tyO
zrpP2mivM&*bdsT7Nel_e?4;6kq}($aK5)4!{E>b>Q5bqN=DzRpz0tEy%@(p4D|Q4S
z{=k~B3MB_nwSR*;2n>E>jOo>AP-B*EnjA#3?C=MC^taL*eQ$Apc}23pP)7y&Soq@s
z@2<FCQ&<vMjHSCLJmhoxz^%UBX>I~9?2{}Z=I|J>B*IOeL&beGF8?ZEPCMhwzUm{Z
zah7K_`*c5)A(Cnjy)m_68Wr1=R3VfF3C0bD<^lyLAAj7I=hR3ldwy0Xrdj6r1%YIz
zsNe^pcU|q!G6p^(?~Bvol<<=~5qSb=XfzH_ceZh43sla)#d>7cuu5R5YSBO&EY{)*
zojTQS^na$f&O8hH;uUkNS%&zPm;0e%y*t7!4698uDOtKy&`EZAMLIHGDFZ%Da=!{0
zpXyplJAZYh^A*f1Wn4+(+-AiQqs!fsKZfU02XKWo`Evb3S0&4+ZMv9_uO6K++G47w
zlhoJJnv0g_kSWJ@Ri$6N8Br3P{=1wfP6LQx&25b5y=7#%(9FjwpL6{TX*iYIE-g9K
zP7rOlBuS=9X=pt$x+(_GpHSzrorXOaii!b@)o*LYfg&dWLX)?%^uTc)>pX<yHmD*o
zB`_lf2`Yw2hW8Bt2^BFG1QakgZvCh?T4BTWSo=`R&_+GoJC!goFd;Ar1_dh)0|FWa
o00b20#!Tv(OOXmgshslhhUqCx6Za$p2-?Q?GWntffdT>u05^j@5&!@I

diff --git a/test/slash-ca/slash.priv b/test/slash-ca/slash.priv
index 91cf27a..deb68cd 100644
--- a/test/slash-ca/slash.priv
+++ b/test/slash-ca/slash.priv
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXQIBAAKBgQDGvUstaalxpzmvku/qAqFNopTCrHwRu88r0Mzq1GrIIY3moADQ
-KqDfLxEbv6qbqinyrBWBkjuiNWD5dwrDMT44ifFlYsHTXPk1VmRGcWmCgpDbxkL+
-mQPnU2aBrdik4tLlSyVJYMjm2N7lJAOEaObCOC7AayJ09igehHXaISI/RQIDAQAB
-AoGBAL6LsW+KFhbNAYbv96zC9srLrZt06sPJ8NkOqdog7XySh03ubLkplfJGWz3i
-p332SZ/NFBWWEiz0xtSIKT56kS7MetNnhTD7kR0JTC2K2kJVR5MPHfvCjsS/Qwof
-e+7nB998CIdjJnk35be1gIdawTsBlU+B0MySyJFNPSYKiP1BAkEA8y3gMIeHtNZn
-aBV6kSDm7JbktfAVWjXRrJ0/qDhbg/bKe2s3w9S9dn0m0B3RhgAu2y6wstxq3rMx
-TjNI8uXN1QJBANE3oFIQm022rozN13aAvJrQFdyS3R5QxCO92ULKkh1nu3n2KkFD
-6nxiJPNurkw0A6PKphWchSQkowGFsR6Hs7ECQGbrfpvrcHMH3yH9HS+5JiLxxgB+
-iPryFjihIOT4XTsfwxizCxn1uu4gD8I7LIczIqGfRCefBBgW7QI00GYE/rUCQDVj
-kJHgkwEd4SUlUhp3d6m5+Bo1kB+wVJ0aUVrt/qNqWTkiTF4jSq87DFrin6/qhhNC
-H2fcbU1v2/kDeNNlpcECQQCTAy/EmVqcZB1n2M1vZXc4OvVRoojd+g8vp+nAryK4
-vqXWE/Y6zI/vLXH/gYzNFvuCgdS1s7q7ixGn9OhuR19Y
+MIICXgIBAAKBgQDluI75hMEoE1TGyj7XTjElxLx9LKCj3QmkuNco7/nSVu3jXkEW
+SUSptfNLQ+nnWZ4MlPtL0x21BqFZA5YGV/P8T/Q/oX8fTyFnLc2FTWAmujrbpQHP
+knUaEO9CRiJjK7DuoWwsEjRClbRuB297zrTdQH9RFzJ8UbBt4bi0ckNp1QIDAQAB
+AoGBAN9xbxBhAoh6lSFvI0TFd6SnAjg3KmF45KJmcFIPac4gY++ehGyrA7CXnHh/
+LIqtbsAKQYx1YxXrxxEQHeM5tcTEGyyQl3BN1hAnNviY0IQ95B2yrk3O7nkPpIuT
++id1QCouCQFto/gG3/Z8Yw4CQAkl/CvTDwL5U59+GgvH/bsBAkEA95k+EQ+GVFvS
+I7xW0kSKjvPopyFwG8G6viBhNvGHhWTrXCnGsPSEcbKOkMH6G0c6NJ+FOHR3dgqc
+JciB8vIddQJBAO2EBa98tcTLzpMWHzaRP6oPErTVpfyTKiC9LhU7XbAlQNN3jZnW
+Ay/zZN0WBhvyZ/72MKQfTQoDa2KRxmVqruECQQDVgYZc7dc27Uri1+jCPqqApOEt
+JY9n0AG5K3DJETN8ms691aRpOSDwbjmzqCGE3kHZ2OjnCr9swa9ugV1VYuR1AkBI
+aCX/kIotO2B3UJglX3REGKJARJ18eTSvlFyXFmkCSOkRTnH5gten55BJIeys2mI/
+xLehYPVwZwh2nTAZPMOhAkEA1w0VCC4WP58r8V79BXXmAPwL9HgeOFmNYn89XO4+
+tyv3MA3BTaS4nYeAL1/QcRHURvuRV3Pl4TmFDeCwdov9Gg==
 -----END RSA PRIVATE KEY-----
diff --git a/test/subca-ca/index.txt b/test/subca-ca/index.txt
index 747fea2..e07f2f0 100644
--- a/test/subca-ca/index.txt
+++ b/test/subca-ca/index.txt
@@ -1 +1 @@
-V	380307165244Z		0176	unknown	/C=UG/L=Tropic/O=Utopia/OU=Relaxation/CN=the subca CA
+V	380503172313Z		0176	unknown	/C=UG/L=Tropic/O=Utopia/OU=Relaxation/CN=the subca CA
diff --git a/test/subca-ca/req_conf.cnf b/test/subca-ca/req_conf.cnf
index 938048d..2e7632f 100644
--- a/test/subca-ca/req_conf.cnf
+++ b/test/subca-ca/req_conf.cnf
@@ -71,6 +71,18 @@ nsCertType		= server
 nsComment		= "OpenSSL Generated Server Certificate"
 subjectAltName 		= DNS:*.hoo.org,DNS:joo.haa.org,IP:123.124.220.1,DNS:g*a.e*.com
 
+[ ca_altname2 ]
+# This is OK for an SSL server.
+nsCertType		= server
+nsComment		= "OpenSSL Generated Server Certificate"
+subjectAltName		= $ENV::DNS_HOSTNAME
+
+[ ca_altname3 ]
+# This is OK for an SSL server.
+nsCertType		= server
+nsComment		= "OpenSSL Generated Server Certificate"
+subjectAltName 		= email:john.doe@foo.bar
+
 [ ca_client ]
 # For normal client use this is typical
 nsCertType 		= client, email
diff --git a/test/subca-ca/subca.cert b/test/subca-ca/subca.cert
index 6ce651e..253a090 100644
--- a/test/subca-ca/subca.cert
+++ b/test/subca-ca/subca.cert
@@ -5,59 +5,59 @@ Certificate:
         Signature Algorithm: md5WithRSAEncryption
         Issuer: C=UG, L=Tropic, O=Utopia, OU=Relaxation, CN=the root CA
         Validity
-            Not Before: Oct 20 16:52:44 2010 GMT
-            Not After : Mar  7 16:52:44 2038 GMT
+            Not Before: Dec 16 17:23:13 2010 GMT
+            Not After : May  3 17:23:13 2038 GMT
         Subject: C=UG, L=Tropic, O=Utopia, OU=Relaxation, CN=the subca CA
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
             RSA Public Key: (1024 bit)
                 Modulus (1024 bit):
-                    00:ae:7b:19:ab:bc:2a:0d:07:8d:9e:70:5b:8c:b4:
-                    05:6d:7e:15:88:78:77:7c:5d:a2:10:7d:73:9c:84:
-                    79:70:97:8c:44:1f:e1:be:49:37:45:b2:58:21:aa:
-                    75:5b:89:0f:4f:a4:56:39:ec:1a:18:8f:96:20:50:
-                    0b:db:4f:a3:24:2e:00:c7:1c:0e:b4:c4:16:6f:3c:
-                    ea:33:1d:0d:67:19:2a:20:f6:3e:b7:3d:71:f8:3b:
-                    e7:5e:82:fb:14:2c:a6:d0:79:bc:e0:60:11:8f:0c:
-                    2f:6d:bc:1c:59:31:c7:91:6b:29:d4:2f:76:17:68:
-                    08:b2:5e:cb:bb:9f:f1:68:79
+                    00:a6:02:9e:e7:e5:25:2f:a0:b7:60:7c:a6:99:2d:
+                    32:34:6e:c7:bd:11:c5:ca:ac:fd:65:08:de:d8:4e:
+                    58:b7:19:d6:d7:53:67:9f:3c:76:ab:65:a1:db:5f:
+                    4f:83:cc:5e:b3:14:73:c0:58:06:4e:10:96:c2:71:
+                    20:f0:c3:43:d5:82:ea:f4:bc:ce:d3:a1:17:7f:b1:
+                    2e:a5:2a:cd:67:36:a1:00:28:39:fe:29:95:c8:b9:
+                    d2:60:35:0f:96:ec:6b:00:d4:1d:ae:73:8f:e5:47:
+                    42:95:16:f1:9f:0a:f6:a0:f5:5a:cb:85:81:15:b2:
+                    3c:21:ab:4d:cc:b1:52:52:dd
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Basic Constraints: 
                 CA:TRUE
             X509v3 Subject Key Identifier: 
-                DA:89:2A:7E:DC:67:B9:4C:A1:87:95:1A:4F:00:2A:C3:AC:0D:C2:4D
+                72:E2:1C:DF:FA:13:48:67:BA:80:EF:59:BC:ED:EC:15:77:61:AF:CC
             X509v3 Authority Key Identifier: 
-                keyid:58:14:D8:8D:4E:ED:3C:03:7A:26:E8:2F:16:24:1C:47:A4:71:61:85
+                keyid:D2:E1:04:7E:8D:73:54:53:49:C5:53:AD:1E:84:D9:8A:00:0B:6A:6F
                 DirName:/C=UG/L=Tropic/O=Utopia/OU=Relaxation/CN=the root CA
-                serial:BC:A6:0B:11:45:3A:D1:61
+                serial:A3:51:C2:F8:DD:7F:B9:9A
 
             X509v3 Key Usage: critical
                 Certificate Sign, CRL Sign
     Signature Algorithm: md5WithRSAEncryption
-        9f:56:45:e3:34:63:ad:30:8a:69:f2:b1:5c:76:42:32:78:b8:
-        f0:d3:fb:66:be:fd:2d:69:ab:ec:e2:92:29:00:c7:51:98:7c:
-        a4:4b:27:d3:07:97:76:f1:f4:15:44:4f:a3:ae:94:00:d9:c3:
-        5a:0d:4e:3b:ee:92:90:a0:e6:c1:d7:a4:7b:d0:52:83:18:cd:
-        b1:3c:cc:02:a3:76:54:1b:b7:5f:81:7c:a9:4c:84:8f:db:c8:
-        5a:4b:23:39:26:30:0f:9d:ec:e0:5f:cb:3f:79:92:4f:83:67:
-        2a:fe:a7:c1:8b:e0:bb:1a:cd:d1:10:aa:f5:f2:68:65:44:cb:
-        f5:fd
+        77:fb:7d:ed:41:72:9a:44:a3:aa:c1:fd:45:09:67:2a:46:a9:
+        d9:72:5d:9a:d8:e3:0d:fe:2b:c7:62:4c:14:04:45:0f:34:a8:
+        39:a0:e0:b9:70:74:74:e1:99:da:6a:e7:e8:cc:07:56:b9:a6:
+        38:24:46:74:e1:a9:55:02:c0:5a:cf:78:9b:d7:95:76:2f:68:
+        36:87:1b:8a:97:80:77:24:5b:6f:db:ec:a3:fc:88:50:3d:be:
+        f0:e1:ac:6d:1f:02:61:63:d4:8d:88:98:ca:de:0a:da:0e:36:
+        19:ea:a6:1c:c1:fa:7c:d1:30:bc:d2:ee:6e:10:15:17:44:fb:
+        53:52
 -----BEGIN CERTIFICATE-----
 MIIC/DCCAmWgAwIBAgICAXYwDQYJKoZIhvcNAQEEBQAwWjELMAkGA1UEBhMCVUcx
 DzANBgNVBAcTBlRyb3BpYzEPMA0GA1UEChMGVXRvcGlhMRMwEQYDVQQLEwpSZWxh
-eGF0aW9uMRQwEgYDVQQDEwt0aGUgcm9vdCBDQTAeFw0xMDEwMjAxNjUyNDRaFw0z
-ODAzMDcxNjUyNDRaMFsxCzAJBgNVBAYTAlVHMQ8wDQYDVQQHEwZUcm9waWMxDzAN
+eGF0aW9uMRQwEgYDVQQDEwt0aGUgcm9vdCBDQTAeFw0xMDEyMTYxNzIzMTNaFw0z
+ODA1MDMxNzIzMTNaMFsxCzAJBgNVBAYTAlVHMQ8wDQYDVQQHEwZUcm9waWMxDzAN
 BgNVBAoTBlV0b3BpYTETMBEGA1UECxMKUmVsYXhhdGlvbjEVMBMGA1UEAxMMdGhl
-IHN1YmNhIENBMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCuexmrvCoNB42e
-cFuMtAVtfhWIeHd8XaIQfXOchHlwl4xEH+G+STdFslghqnVbiQ9PpFY57BoYj5Yg
-UAvbT6MkLgDHHA60xBZvPOozHQ1nGSog9j63PXH4O+degvsULKbQebzgYBGPDC9t
-vBxZMceRaynUL3YXaAiyXsu7n/FoeQIDAQABo4HPMIHMMAwGA1UdEwQFMAMBAf8w
-HQYDVR0OBBYEFNqJKn7cZ7lMoYeVGk8AKsOsDcJNMIGMBgNVHSMEgYQwgYGAFFgU
-2I1O7TwDeiboLxYkHEekcWGFoV6kXDBaMQswCQYDVQQGEwJVRzEPMA0GA1UEBxMG
+IHN1YmNhIENBMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCmAp7n5SUvoLdg
+fKaZLTI0bse9EcXKrP1lCN7YTli3GdbXU2efPHarZaHbX0+DzF6zFHPAWAZOEJbC
+cSDww0PVgur0vM7ToRd/sS6lKs1nNqEAKDn+KZXIudJgNQ+W7GsA1B2uc4/lR0KV
+FvGfCvag9VrLhYEVsjwhq03MsVJS3QIDAQABo4HPMIHMMAwGA1UdEwQFMAMBAf8w
+HQYDVR0OBBYEFHLiHN/6E0hnuoDvWbzt7BV3Ya/MMIGMBgNVHSMEgYQwgYGAFNLh
+BH6Nc1RTScVTrR6E2YoAC2pvoV6kXDBaMQswCQYDVQQGEwJVRzEPMA0GA1UEBxMG
 VHJvcGljMQ8wDQYDVQQKEwZVdG9waWExEzARBgNVBAsTClJlbGF4YXRpb24xFDAS
-BgNVBAMTC3RoZSByb290IENBggkAvKYLEUU60WEwDgYDVR0PAQH/BAQDAgEGMA0G
-CSqGSIb3DQEBBAUAA4GBAJ9WReM0Y60wimnysVx2QjJ4uPDT+2a+/S1pq+zikikA
-x1GYfKRLJ9MHl3bx9BVET6OulADZw1oNTjvukpCg5sHXpHvQUoMYzbE8zAKjdlQb
-t1+BfKlMhI/byFpLIzkmMA+d7OBfyz95kk+DZyr+p8GL4LsazdEQqvXyaGVEy/X9
+BgNVBAMTC3RoZSByb290IENBggkAo1HC+N1/uZowDgYDVR0PAQH/BAQDAgEGMA0G
+CSqGSIb3DQEBBAUAA4GBAHf7fe1BcppEo6rB/UUJZypGqdlyXZrY4w3+K8diTBQE
+RQ80qDmg4LlwdHThmdpq5+jMB1a5pjgkRnThqVUCwFrPeJvXlXYvaDaHG4qXgHck
+W2/b7KP8iFA9vvDhrG0fAmFj1I2ImMreCtoONhnqphzB+nzRMLzS7m4QFRdE+1NS
 -----END CERTIFICATE-----
diff --git a/test/subca-ca/subca.p12 b/test/subca-ca/subca.p12
index 279f7fdbe24edeccebd9ace72ba5c5191d331283..9b7b347b10ef6e8da1f9d702bf9008d890689d04 100644
GIT binary patch
delta 1658
zcmV-=28H?k4gC#}U4KsC>xYD2zLNq12mpYB17LXR{UTH4%Qp3BO41+MZh$>E9>_so
z(mlj8t&o_aE7mxh*Jc*yv>@Y(M=t_CByssr!t2v(A{+0dm$#Tf9_?iqyu-kcYOV_S
z#h;EzbZESN!O@{+!X0kjDVUkR^Y^Pp4Ux*B6E~Y)HOQ9#X@3b}-5Nl(>TB94{T0iu
z?_xc;1Js}a44WVN;lSLwDXx(VsZwy6S1<{N*T_ftAW&=e2UmiNitkj*GC!Be<~k0$
zJN^Af`zhg+Hj4Gezn5N51h>Gq#oyVQiC>wGG+)tbU|F|h?ltu3_oeA;Lk8#lf+`Pn
zNkjiyf%Cf2@_$bh{&J6#+m3gz!%1XpK8v<i#zLaV$NF7Nri)p-1Otw|9`}n}m055-
z+|ACa6;D7IEUfG}93dei05^R_<8wl>zK1@83JqQ{L8<4_h{0NIFXSc-&eN=*;-t~M
zs#8BhAv%tV_?bQg*5q|6Zi2<s;Ot>SJ~)?FPcNfJZGSy(kZAY)6|p^yiuZ80CpcUc
zKpJ0aQbZUo4;QJJ8)5DS1K)_;Al$J5IY&DHo8qZ5RI5Mb{4&9)n!Qo8LpjDPR@JY&
zgwl*&dVmTj>EFSoG-TnS29Gcj%FE6|ar%@SVs`CRVnMknwYz>%&C?h2XH0S`0)AF3
zub{190)H7v6FfCT*z#^Er9`NyIcZ|~@)080oSW=G2yCRtf}dICy-Uuc>>^-e<BLJ}
z4XkithFks9BS9ovJE@s*f~|%J%|2Rhn^e3w4&Tu`!#Hzwt<t09?>Krv&lF`K{*t%q
zeaRy!Eu+?XEwr(WFwXIQ@{?H{`y7YsCg}g#;(t-yu3J+mFy^bc0p_yF_|?$VBU(Te
zqtE?}%bK)il-fM47f;`J(&D7If?qdzMSuQGmZgXxToncv;78k{N%UF%5JUd<j^N29
z?a=tES#$)~`9P<tn(9D(>y;W$kEcdS*?gzaOHwL3*>gwW71mGA^Mgc<v)pQvA`k1{
zB7f4^8v5+_6%sX#vev;SFS_@{8)zZ62DB4nVDo)>_ysmf-i;sF%k|R!Ai@=8v*J+V
zoJ6^~S<ZHsCU!)oONoHDFQm2S&4DdhQoU9rEiu?;;{+|foaHXYdh|t2WHGWI>Snom
z%Aj#$`)bh8DHLmcLY4|YFoFX41_>&LNR!qBJ%3;Z52;m)xSRq42ml0v0)YJ>qlxhQ
zP2$3Otj0R~6P7GD!n{9BSf$`1T{e|x?KUD<Hp^UitbDF-uzpu|j-@}_(-RD${|wP|
zZIdUPN5HA^gk{{aAGH4$+t0!h#Q$YM-{<2uCZnB@cp<-%(RcNGm<G%H=5N~i3Ri6i
zBY%71V{pR^28Up`gXT&TKmh0RO|PNUFIg+`c9FDVRoV8vsJ>h(jEnnIrC|IMhfS}I
z(%3%{;~1FaY5|OH*MXz_{adG|9$0zIQF@K}O@8fOLqayi@4lvWXuCW2n}atrk<cU5
z-xz1QA(%#o0vf&H^>t5VMG-))QM{#41%H0XhpN%ty&Df&|Ej#On!2x=i+x$;9(6>D
zxLR~<qeVB&L}Gl50iTg!IuxOw5i$aRQJcosld^$1T3K?(r-nlu#|{akF2qMhT?k7J
zkM$Moa-KVPtYW|DXNlHe@AB(PzAy$;u)nk$J2#nb?sebyL`IN2%R<qVP2C?Y2Y&;b
z$HOPYj`W8M-?Tjk3b>~k04hFji_F{C=X|ZR^~>;)^B=rjdgfhnAADO#NxRvM6nA8C
z;?cimyf%QU(ueU@J^8-?rWG#f9H;HIgg6Zd^c%T8QqkhLt6S^HQvgLnERXQo@`Eki
z<NL%wVChiH!f^JhFHKvMN&C(O>3>?+<AIfG>~&1+6jKXmLY=kWI64m(L#nx(K~VWF
zaQ3#Xp|joHro~7WXHR#+LP0BW#92({8_f4YMR(;<5^o={8KzlrW`kT_-$BQ>G|L9`
zu{u*khKDQ2#_6`O={eKyzrd4;bUsQquh#~CmUI-}QcR&u6Ae6t*^VlaMQ_@>w!ln*
zGzuO7Na4P&PnUr$y=50MB`_lf2`Yw2hW8Bt2^BFG1QZ8a_d9f2i*yS_2y}3{B_qI^
zh_f&;Fd;Ar1_dh)0|FWa00b2H(vf?K?GGg~Wi?FaeO1{s^0*rW2x8il;5DSklmY?>
E06Jqdq5uE@

delta 1658
zcmV-=28H?k4gC#}U4MRSUoMYcHc|ot2mpYB17KRjHLacsX>PID%YBk4tq%%5w$ppq
z_Ro(+EkR17+D6V-vUzcsr`*Rw;A))`{#EG)R7C@hYV?GDYCHl6=tuw{YDwf`F1II#
z_LGO#4VpGbNLwmm_+WNs3ihsc6O~&`CYyLpqyUSN5t<yV!+*n28Zyx7kl{MR9tobQ
z`Q~zqGAoa$C;5ud>Lk$U*7<c1>ukYZmx-Ct2aD{7YI|8wk3pQG+;)@sDhX~)I+vs<
zo=!wvm5Vaf-r$8F!>+WJO?$gUp!S?f8LQek;MA2L`E%WAX{p#T<=X}8dimnRE!2F>
znQr5GMy5bj7JmsBErQY!Z`cFwd=gN-;v}ZoRX0-P35#mOGzxv!s>i}m!jd`l6SN33
zZpB@P=%+mL2u9t-2+-L`eFcqcb$)WaE`33Fg906gl(|_}rM(4Pn|T{uExK1pug12x
zrPb!L@HHZk`GN8_^%jke^Zo4`a~D3qQU>==;qx)RKY!$rABg~S8IxwX5`vi(Hxu1j
z2Trha3Z_(hc;z|F?W_7A8+~(E^2USPcO9o4D9b9q<B^4wXon-|ZQAR+S&Os^a-0=a
z`XpPmvhHz_Q;zqq%=?y{E&;r?2Ck6_>8J>;JU+4$yqanX>q|mYWDxX7#{^DAPV?CU
z+!rheTz_y$1-0+|7)`@bFtNB{Q$E&AV4-_d_l{HIzv;@R9wKTu+zSsq;*1B&a7A;&
z6YX>!x_~=Qcgnf9AdmrOOXDMlMxAcCfq5LLo?2)nmK*;F?cPR>l=Yzxf;c^BC(3m|
z5R}V}&FrN>w<-@7hA4UUe%u0_v!9Wj0n)<-b$@s=XWISn8czi7E-F&Nz6Y8FT~FPR
zUd*hQOn&MtLC@aw_;Z0_RcphR?~%d$ezZTXDKM-NE}{q12*4;KG91SL36j2i(<l#y
z2YaxYR$57L)Li%c{-au`UaebF<ZUjz7g^*CDNR-`;ojl{4*O7w&`&a%&GwFV?wAiR
z@_+oAAFnPw=!aM<?}3g!OQk$>XwT@aqU~6<sK=wox&X`><~3yxukJ~8*bWrfOq|<J
z3B*|kQSR+;m61f(98aH|L0hAEP62KS1O#r$(3%OC>fR^unBF13^E64!u+QaCAYKZo
z63In7g|Rmf5R;K@rL^trFoFX41_>&LNR!qBJ%42F;DrhgHz@)F2ml0v0)TLh>n$fn
zTldgJ=^T$sKB(OUN*Ys+IKuD`UuYj+$6Nz4VOrrG)>Y9R`}K^xBhi;sx+eWkd<U*=
z)6*$^=)>P~##cLb3tHy~+2Q=K3rXjJl^irTGJ#uc=WBkwUnEd>(R5C|i>q4vWuJ3z
zlYa~ws)t({v1{^DY&Q}bW}~5`bHiH$G<DA4OSo@ct4YL0#{XbL(d+-2fku7roHzky
zi1d6fg7Y#?(R0MCK^!uD3{;k@rp+G&Oxll8pU4A0HQ~0o0pnM1{AR##<?~<h!%=!L
zMsgE7G)=SvkL!FWM3uySjH6{|aQz|<=6^x5)rYT3z^0@c21l5Cu!*|a?qDtVk?K1C
ziBkWlYEPsULyOus?B+8ob|)qMT|X$!z_#5x05^^DIMK6Uq8C99V&6j7RMOb7(0mKu
zsEdzsZAO6EppAh3am74(^k}^<dr<wldI6$ArwJgnjLPcnYvB}kutrMg+GGteXn(wE
z>`a-e!tNd_MV*)Xm|vcc?dV3dUfZx6mg9x6%w0Jj0%Zrw2Hm5~&y_G7!Jfvb4`?ZY
zsu-s*&n82dr17PQ4&5)CANv<?a-AaypB-t|6k=Q5S)F@W&->EWj}dds&V+CQejR{h
zBMo<L^!M0iMr)<YnHjD~aQM*t8-FH^_QPxksmHAP;{2(_t<Yb3WEdOFbXQ#&%*3pl
zp18{-14zk6$68QZiW_&;!)jzzVd&!jDxeb~r7(PB|0tL#e5sKi5!?1wFO1wq`S??1
zr&lYQupLFqWHh!Y^q)^0W{lU2=dk|%SwF;*7|eUl*7W9dUB=_fEeGb}({Hj#)*ReF
zPn4lGj|de?0#Lo-aD$~WB`_lf2`Yw2hW8Bt2^BFG1QY>G`C2Wu3OR-bxWh?<$IL&#
za0W0jFd;Ar1_dh)0|FWa00b0tCWpT`(ze(%i>86WSY*aLgT@F12-!lUCj5Rrn*ss|
E0CPAY$p8QV

diff --git a/test/subca-ca/subca.priv b/test/subca-ca/subca.priv
index 6093ed8..858f6e4 100644
--- a/test/subca-ca/subca.priv
+++ b/test/subca-ca/subca.priv
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXQIBAAKBgQCuexmrvCoNB42ecFuMtAVtfhWIeHd8XaIQfXOchHlwl4xEH+G+
-STdFslghqnVbiQ9PpFY57BoYj5YgUAvbT6MkLgDHHA60xBZvPOozHQ1nGSog9j63
-PXH4O+degvsULKbQebzgYBGPDC9tvBxZMceRaynUL3YXaAiyXsu7n/FoeQIDAQAB
-AoGBAJ6/G4UXpr7CD4SGv5TNuV58Z8UJrdS2MByGt2hBU2gwSgs1YqNJZAOClxLS
-TwJgOlEAuP7sJHYSNcnialc4JrnklxnAV9Zw34FhVnYjGEMRexDXOl0HALUVpZyM
-m13ld3y0nqr7U3Hxf5N99z95VmP1oCuR6EcSrIrwBX1L6od9AkEA1Hs8ehgK71DR
-98MUHeO6+IcypZ8+raJlp5Eqtx0E686vPZkizzucC9jCOgH26sfUpH1zPlbLNxIm
-B4/s6KUktwJBANI3bleCiIdgNVzr6MuFRCKIleM/sHj62oEo2/3yDBtjKkfTFB/J
-GABwejSMib95tvZ5m+Bf4N26uwQFsVFRjE8CQGL7reaqwJ1PpyCmbf6mkfko8j0Z
-fBdjKbvv8lgvWpWHSTeG2SJ1AHK8XW6sb5xbzwF5t2/4+t4CxFiNga23EO0CQF22
-mFoqtvKi0Sc7g+w23MkIWsmT+vfz3LT3ohrzbLJI4vBiCPaijzCi89e5Ty8s84Ot
-cu/zzisKs5R3dTTrRcECQQCTquffaPTmJzcPr6LSHeuU+1QkbFCZfPDLZT3L5NSh
-fBFwtnbdrZoMaeNtizvHjk/kfN69gguKKF808N3F/7hj
+MIICXAIBAAKBgQCmAp7n5SUvoLdgfKaZLTI0bse9EcXKrP1lCN7YTli3GdbXU2ef
+PHarZaHbX0+DzF6zFHPAWAZOEJbCcSDww0PVgur0vM7ToRd/sS6lKs1nNqEAKDn+
+KZXIudJgNQ+W7GsA1B2uc4/lR0KVFvGfCvag9VrLhYEVsjwhq03MsVJS3QIDAQAB
+AoGAGFHv96cBMJ4J30/DlFMjtLy59D/jSxLWuHN5OhUYOBLH/5mPZ6uS8v8bnCi1
+XGiXQwLvBjGfEtapT2kFW2Av0p4zsAnJ9D1emH5aFD67YXI5vW4PR0R/Lu58SI6a
+p5y3aNsxCMmORAsXTfj2C3r/ntCuwUXITP2mUbL8pa2ofz0CQQDZWD9DNRdfDb4W
+xQGparH30jxhlkUMxhjnddMnt0pAKxFjWXQQ80EI1mZRDk9gpb14okaEq+dRtkdR
+3piJ/a2DAkEAw4kafeTETUSbbACRKmr+5skDuKYWY4nei7JNCP45HkpmIdFSEtvY
+ftwkhuhJGtW7q4AuEIyU2QI7DRYg67twHwJAVy4+sgapyUcJ6Lg9YmeZ235JGhvc
+trL/alioylWLQxIDd4Z6OBJbE+BsSjcjP/E7fxgYkT8jGnOzR/Ox3CgVYQJBAJoB
+yI3TuxEoskl0gOGp+C6JsJakqgmoM1JQEwC8SvyimKKWHVChO3lfpp1jIwExymif
+wqhiMXJioWQDQ9angP0CQB+PR9qES3nqqfRn8iCqcxNnmxALGqS2cxmDFxeQqEAL
+0mGmZtNxswQr/9BipCHbf5KehNeDuVvMANk1ip00pyc=
 -----END RSA PRIVATE KEY-----
diff --git a/test/subca-ca/subca.req b/test/subca-ca/subca.req
index b0538b2..e6c16a7 100644
--- a/test/subca-ca/subca.req
+++ b/test/subca-ca/subca.req
@@ -1,11 +1,11 @@
 -----BEGIN CERTIFICATE REQUEST-----
 MIIBmzCCAQQCAQAwWzELMAkGA1UEBhMCVUcxDzANBgNVBAcTBlRyb3BpYzEPMA0G
 A1UEChMGVXRvcGlhMRMwEQYDVQQLEwpSZWxheGF0aW9uMRUwEwYDVQQDEwx0aGUg
-c3ViY2EgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAK57Gau8Kg0HjZ5w
-W4y0BW1+FYh4d3xdohB9c5yEeXCXjEQf4b5JN0WyWCGqdVuJD0+kVjnsGhiPliBQ
-C9tPoyQuAMccDrTEFm886jMdDWcZKiD2Prc9cfg7516C+xQsptB5vOBgEY8ML228
-HFkxx5FrKdQvdhdoCLJey7uf8Wh5AgMBAAGgADANBgkqhkiG9w0BAQUFAAOBgQB7
-uInwZesojatHXyJ+42q7jh9YPCV7rHtUYFT4nUcKUcw+nPdBWAu2e8mUFDgLuO85
-sEGycf4ldlLI0EZUDPpsB5eR1jl8b4Z5qa4TZi46sQl1TW10lts61k12OjHw5DHm
-uSioZ9ZnH9njsZ+XjkYjW8a+hwA4k2J2w7Bgtx2RTA==
+c3ViY2EgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAKYCnuflJS+gt2B8
+ppktMjRux70Rxcqs/WUI3thOWLcZ1tdTZ588dqtlodtfT4PMXrMUc8BYBk4QlsJx
+IPDDQ9WC6vS8ztOhF3+xLqUqzWc2oQAoOf4plci50mA1D5bsawDUHa5zj+VHQpUW
+8Z8K9qD1WsuFgRWyPCGrTcyxUlLdAgMBAAGgADANBgkqhkiG9w0BAQUFAAOBgQCk
+MpGCwnIPP/A4U7v6GjNIeaD7SS1yTz8v7Sak7ZqQAgHQubQoOVeMrlWzrIqVbQiZ
+g4JM7fjRObd0XSOwaUpMXmlB/O3+WLBsFELudfWslyEaHv0Wkgom+aZP9DRb/lVz
+Kg6OaBIApp/5bwATPZxk+9Zo4W6d7LF6tHayHsgJhw==
 -----END CERTIFICATE REQUEST-----
diff --git a/test/subsubca-ca/index.txt b/test/subsubca-ca/index.txt
index a033096..c3bfea0 100644
--- a/test/subsubca-ca/index.txt
+++ b/test/subsubca-ca/index.txt
@@ -1 +1 @@
-V	380307165245Z		0176	unknown	/C=UG/L=Tropic/O=Utopia/OU=Relaxation/CN=the subsubca CA
+V	380503172313Z		0176	unknown	/C=UG/L=Tropic/O=Utopia/OU=Relaxation/CN=the subsubca CA
diff --git a/test/subsubca-ca/req_conf.cnf b/test/subsubca-ca/req_conf.cnf
index 03be195..62ee717 100644
--- a/test/subsubca-ca/req_conf.cnf
+++ b/test/subsubca-ca/req_conf.cnf
@@ -71,6 +71,18 @@ nsCertType		= server
 nsComment		= "OpenSSL Generated Server Certificate"
 subjectAltName 		= DNS:*.hoo.org,DNS:joo.haa.org,IP:123.124.220.1,DNS:g*a.e*.com
 
+[ ca_altname2 ]
+# This is OK for an SSL server.
+nsCertType		= server
+nsComment		= "OpenSSL Generated Server Certificate"
+subjectAltName		= $ENV::DNS_HOSTNAME
+
+[ ca_altname3 ]
+# This is OK for an SSL server.
+nsCertType		= server
+nsComment		= "OpenSSL Generated Server Certificate"
+subjectAltName 		= email:john.doe@foo.bar
+
 [ ca_client ]
 # For normal client use this is typical
 nsCertType 		= client, email
diff --git a/test/subsubca-ca/subsubca.cert b/test/subsubca-ca/subsubca.cert
index 0ed0875..fcd5892 100644
--- a/test/subsubca-ca/subsubca.cert
+++ b/test/subsubca-ca/subsubca.cert
@@ -5,59 +5,59 @@ Certificate:
         Signature Algorithm: md5WithRSAEncryption
         Issuer: C=UG, L=Tropic, O=Utopia, OU=Relaxation, CN=the subca CA
         Validity
-            Not Before: Oct 20 16:52:45 2010 GMT
-            Not After : Mar  7 16:52:45 2038 GMT
+            Not Before: Dec 16 17:23:13 2010 GMT
+            Not After : May  3 17:23:13 2038 GMT
         Subject: C=UG, L=Tropic, O=Utopia, OU=Relaxation, CN=the subsubca CA
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
             RSA Public Key: (1024 bit)
                 Modulus (1024 bit):
-                    00:c6:85:92:7f:9b:9b:65:2a:af:65:26:41:5f:c5:
-                    66:a2:05:39:4e:dd:25:19:92:ea:e1:25:bb:e2:a1:
-                    ec:6c:78:bb:c3:df:e4:14:35:6d:3b:f5:fe:5c:c4:
-                    55:c6:13:c4:0c:c5:5d:da:7b:58:f0:51:2d:f4:1c:
-                    0d:5e:de:1e:14:7e:28:b3:3b:ae:20:24:c2:5c:c9:
-                    b6:61:10:2b:05:8e:59:a3:4d:9a:86:1d:dc:e7:60:
-                    05:7a:e8:49:8c:92:65:f2:31:eb:22:37:c1:ca:4a:
-                    c4:37:4e:20:f7:d5:ea:fe:0b:8f:f5:9a:22:ad:8c:
-                    3b:b0:22:03:4a:ea:93:4a:53
+                    00:b9:e2:be:89:f7:d4:ea:b1:90:2a:13:c3:18:59:
+                    fa:05:cd:52:73:09:18:7d:a8:a1:85:2c:c2:4b:58:
+                    f8:c2:fd:2d:20:97:d0:df:39:be:15:7b:26:72:a1:
+                    4b:cc:62:03:0c:2b:9b:7d:d1:f0:a4:66:36:d4:48:
+                    8b:ca:61:73:61:b3:c3:9e:0a:5a:54:d5:43:ad:88:
+                    2a:0f:85:41:f0:d6:09:8d:d4:9a:f2:10:4e:41:d8:
+                    d2:88:cd:07:78:ea:60:67:28:e1:4f:9e:3d:24:8b:
+                    64:31:fd:d3:d3:4c:bb:c8:42:49:15:69:f6:06:14:
+                    00:6d:b7:df:1d:c2:44:88:7d
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Basic Constraints: 
                 CA:TRUE
             X509v3 Subject Key Identifier: 
-                F9:3E:18:68:E7:2C:A1:13:40:69:1C:16:06:BB:12:BA:F1:24:5A:84
+                43:B2:E1:9F:EB:C5:ED:9C:C6:76:EF:EC:B4:D1:D3:95:AF:67:45:AD
             X509v3 Authority Key Identifier: 
-                keyid:DA:89:2A:7E:DC:67:B9:4C:A1:87:95:1A:4F:00:2A:C3:AC:0D:C2:4D
+                keyid:72:E2:1C:DF:FA:13:48:67:BA:80:EF:59:BC:ED:EC:15:77:61:AF:CC
                 DirName:/C=UG/L=Tropic/O=Utopia/OU=Relaxation/CN=the root CA
                 serial:01:76
 
             X509v3 Key Usage: critical
                 Certificate Sign, CRL Sign
     Signature Algorithm: md5WithRSAEncryption
-        75:59:34:61:36:36:c7:72:b9:c3:5d:10:e9:8a:59:18:1b:96:
-        d7:9e:8b:d5:1e:62:08:da:c2:25:5a:31:36:f7:8c:f9:a6:62:
-        dd:a5:4a:08:da:00:53:f7:a9:aa:35:46:82:f0:ba:66:38:22:
-        84:45:4e:3e:f3:e1:3c:40:2b:29:94:87:01:ff:69:bf:56:24:
-        6d:00:cb:13:33:8b:d6:34:c6:76:a6:4e:0d:46:82:74:51:16:
-        d1:32:18:cc:78:65:13:03:f3:36:5b:b9:78:8e:a9:b4:6e:8f:
-        49:58:22:16:95:8a:93:ca:14:5e:33:fa:67:02:ea:d9:a6:0d:
-        57:1b
+        32:3b:67:ad:10:b0:a0:6c:82:39:c9:30:fb:c3:63:20:ff:66:
+        11:38:13:58:3a:36:b4:ec:f8:55:9f:c4:05:34:04:9d:f1:5e:
+        6a:95:71:79:9f:4d:42:6c:a7:ba:f2:e0:fe:cc:42:7e:85:49:
+        56:94:5c:2f:e5:5b:27:ff:52:16:1b:a6:f5:4f:9e:88:67:96:
+        6d:b0:71:07:73:d2:08:35:a0:8b:f5:5f:a6:9d:8f:ee:20:49:
+        4f:01:39:17:e6:76:4a:43:9c:cd:9c:87:33:c2:5b:ac:8b:f9:
+        24:4b:6b:1f:08:ef:99:e3:1a:16:1f:0f:1a:f4:1a:96:91:5c:
+        69:d0
 -----BEGIN CERTIFICATE-----
 MIIC9zCCAmCgAwIBAgICAXYwDQYJKoZIhvcNAQEEBQAwWzELMAkGA1UEBhMCVUcx
 DzANBgNVBAcTBlRyb3BpYzEPMA0GA1UEChMGVXRvcGlhMRMwEQYDVQQLEwpSZWxh
-eGF0aW9uMRUwEwYDVQQDEwx0aGUgc3ViY2EgQ0EwHhcNMTAxMDIwMTY1MjQ1WhcN
-MzgwMzA3MTY1MjQ1WjBeMQswCQYDVQQGEwJVRzEPMA0GA1UEBxMGVHJvcGljMQ8w
+eGF0aW9uMRUwEwYDVQQDEwx0aGUgc3ViY2EgQ0EwHhcNMTAxMjE2MTcyMzEzWhcN
+MzgwNTAzMTcyMzEzWjBeMQswCQYDVQQGEwJVRzEPMA0GA1UEBxMGVHJvcGljMQ8w
 DQYDVQQKEwZVdG9waWExEzARBgNVBAsTClJlbGF4YXRpb24xGDAWBgNVBAMTD3Ro
-ZSBzdWJzdWJjYSBDQTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAxoWSf5ub
-ZSqvZSZBX8VmogU5Tt0lGZLq4SW74qHsbHi7w9/kFDVtO/X+XMRVxhPEDMVd2ntY
-8FEt9BwNXt4eFH4oszuuICTCXMm2YRArBY5Zo02ahh3c52AFeuhJjJJl8jHrIjfB
-ykrEN04g99Xq/guP9ZoirYw7sCIDSuqTSlMCAwEAAaOBxjCBwzAMBgNVHRMEBTAD
-AQH/MB0GA1UdDgQWBBT5Phho5yyhE0BpHBYGuxK68SRahDCBgwYDVR0jBHwweoAU
-2okqftxnuUyhh5UaTwAqw6wNwk2hXqRcMFoxCzAJBgNVBAYTAlVHMQ8wDQYDVQQH
+ZSBzdWJzdWJjYSBDQTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAueK+iffU
+6rGQKhPDGFn6Bc1ScwkYfaihhSzCS1j4wv0tIJfQ3zm+FXsmcqFLzGIDDCubfdHw
+pGY21EiLymFzYbPDngpaVNVDrYgqD4VB8NYJjdSa8hBOQdjSiM0HeOpgZyjhT549
+JItkMf3T00y7yEJJFWn2BhQAbbffHcJEiH0CAwEAAaOBxjCBwzAMBgNVHRMEBTAD
+AQH/MB0GA1UdDgQWBBRDsuGf68XtnMZ27+y00dOVr2dFrTCBgwYDVR0jBHwweoAU
+cuIc3/oTSGe6gO9ZvO3sFXdhr8yhXqRcMFoxCzAJBgNVBAYTAlVHMQ8wDQYDVQQH
 EwZUcm9waWMxDzANBgNVBAoTBlV0b3BpYTETMBEGA1UECxMKUmVsYXhhdGlvbjEU
 MBIGA1UEAxMLdGhlIHJvb3QgQ0GCAgF2MA4GA1UdDwEB/wQEAwIBBjANBgkqhkiG
-9w0BAQQFAAOBgQB1WTRhNjbHcrnDXRDpilkYG5bXnovVHmII2sIlWjE294z5pmLd
-pUoI2gBT96mqNUaC8LpmOCKERU4+8+E8QCsplIcB/2m/ViRtAMsTM4vWNMZ2pk4N
-RoJ0URbRMhjMeGUTA/M2W7l4jqm0bo9JWCIWlYqTyhReM/pnAurZpg1XGw==
+9w0BAQQFAAOBgQAyO2etELCgbII5yTD7w2Mg/2YROBNYOja07PhVn8QFNASd8V5q
+lXF5n01CbKe68uD+zEJ+hUlWlFwv5Vsn/1IWG6b1T56IZ5ZtsHEHc9IINaCL9V+m
+nY/uIElPATkX5nZKQ5zNnIczwlusi/kkS2sfCO+Z4xoWHw8a9BqWkVxp0A==
 -----END CERTIFICATE-----
diff --git a/test/subsubca-ca/subsubca.p12 b/test/subsubca-ca/subsubca.p12
index 22999062f1aa62493ce16c9238c0161583d75e72..becb15bda9ce4b645a80fd7a9e8ff04ec4344ec8 100644
GIT binary patch
delta 1658
zcmV-=28H?c4fPF>U4MzELHMrM5G4Wv2mpYB16Wq@tK+MXyDbs>_NdMLV$`>cl-!R9
zFr<K<0O9HH(6y~msLBebG?!-A{QEI)GoQ9DVmO`-z}0kD#$@ks`1>~iP{apmgsi!F
zGmcW{-PHG_!1FpSyP8P7ut0AFZH}5Mfz!-8g6ZrDBx*8`Ab-XV^+<pG2DL1Z9CbwF
zA_D*=6I{Lp=0dUz%{o|1D(K%!Gy-wnocgr}NF?f9))@oq;_)GYI&VvoXM!%4q*x!z
zuASy$QFOF(vU}wJ<%7uigf0RJ90Kb~Ock*YovdMQoKMKtWfkuK(+W<^G_{7ZV01^n
zUKQdHi^;n2DSwj@C29EnzKNr6tNax*sGRJ+LT;(KHTQ!vgV4kORWmo*FRV;%eoVj9
z@qO$TIL0>s7Cw?S?mg&zm6$Z_eDGtO-xg2%mvRm{54>Yc%4K*10%r0e)^6baU-AFW
z8AMjx+jAH}CDD;By3J(1d*DDi0{nzQYcwYnH<t(6%71A)Smi9Iw5I2=8hiL+3`=>Z
zKn5&SFu7&kuttBNJO?N;3=B04#RXmi*CG<^W#DT0Z#JoQl2WRim1UqL?BV(I)@nle
zP#1>>WJ~$tWVR}847l-4{kySW@9f|>rt#AzYo}ggdY}gv^Q2Orrs}(&F<!}!CzYU^
zADN@RgMT6buv}Q(4(No~_O5$QuLJzp=2_wPMlokxCFVEBm?Md}IiprDBBPv)DL3?O
zdoHrA?J!?k(30=*-A};uJxIEA0SNf;5`La{^OmIXCCYnOYpy~u+;32dLYyhWJ0H_v
zF$j~{=<@GTjm|!g{sUR+<dd)$1eC1`4SJ<T-G3CmixAT$%UVGO@#9PG!f550J7`;*
zlm<k$4gr1EkjqNk-3*uPu2#5bJ-h_>waCwZ3(0gY^LBJThyb`1oAB2k_02h%>f8aJ
zv%b!iB|puWQ%6ln-L5ChchOR2@8#~pK1Cp%I;ie@$at$`*M0%x^6mwl)>oOn*D`lc
zgn!y;Xyp%PVEO=K#0js86OviQ`yR7YEJUWzv8{ry>D!Fgx0LF3MY#=s!DpQy+_{Uc
zG`0D+rpN1~fO@}T#Y+i>>MILd2mrO&=L)W0)u%I?_oyFOiKQ8Ik$9@kwr)j41z745
zQ{~<%(q2NiFoFX41_>&LNQU<f0S5t~f|J$*HGlslF#03XCItcl2ml0v0)X<v??WV>
zLA14%v6k)|1BKB{v5&@Cz<8FA9Gkzf1EoW)sUc?|h>)8W?YNK*9t}Bn$8bsYc}?in
zkITaTM_(w=IU!vY3@pGy+e=Vh(|140T|9@p+D0VHyQ-pO0H1S{MV6?Fh<?sJZRsnF
z?SJdJn=l+xYWa_mA|DXm=*GAlrtYS@4V5mS%xJBJbAnf|0ZSg-!IU2VCaYB{=*ik{
zk0hN%m}yFtngSbeBp3a-3@O;LN9`fC6~8$>=zm&iSAIgaHobSjCA9&FIS&AE6T~gz
z&!SraS1QQ%<lkneiqqMQF?_%DP3NDNcYj1^i3kgc<Xne%$N}AkR}qA=X)mniQW~Lq
zvfh6b4mQMVTD%bntmcW<5&6Uay#<@@L>1dPP|14E?i7!iOkcPKBh73R{S-Ye+%}^0
zWQU<C5@oNl_xutr`~L7I?inEvEA9oUPD-ins}bj$tGk!3hUe4~H;k<fnpaTYnSU+Y
zz7#$_Fu+>BTJ-m`D97uyf~yPSR^>p;J{vgTwwsVO0}-?BK56%@7rW`UGO9F&$U(#F
z9JkaCFMih_iuKErd^>9Gwr@FB2c~j|I=@o%jwkNg>H~??6U&4<AMe^A_L(_n<<D=^
z*dZ9BH;6)|%0`a0PlyA{_|Y_r@_)Er3ScOJMN&;t?737k-br4Sg)a>=gYC3LubnJ)
zkr=u|ytNu=dq|&nP;j0_&Dy*@m@9d<vcAnkZBid&2J_LFUndb%podDR*z<LG<!l)7
z`i2AtAXqwJDr`0yO(KjUTvo&?(A{Pbk>E=;hpo$8rAu%G!CZR@4-*FgByVVnvQ=I;
z$kDKOiDqO0b+Fw?ph-C~B`_lf2`Yw2hW8Bt2^BFG1QgAOQD@hMWC0jW6s=D8;<J&;
zyNWO|Fd;Ar1_dh)0|FWa00b0HY4dR<>V;cXnynd0R!VlE;}t9f2%18o?5GN6G6Dh!
E001&2(*OVf

delta 1658
zcmV-=28H?c4fPF>U4N91O0-DVzu^J`2mpYB16aYzztV9-g>dCkLS88)kZNAVU8d8K
zK&va*`{yLeJqmJ>c$wIXm+5VHdNRc6-aU5gc_+F*a|gWjuhkQD5BH=j^a+#Q@G)z`
zs6{;_d!nhFl-RKn1||tVLKqfk@-cTJ(vF{t`Y_&Qe)eszaev|GpgW^F8TB$<zrh+_
znZrtM2yQ@bmnS{+l{cJ)7io3;y&xH_g=4@@cHg{eJcYjsM``&gB0sri6KX|w;^>mw
zu4Yx(AYtgxS9RNDBNF0fmxish{8H-;H5tO#qDi6@{m<*hKNz^E7h$@FNjA98Mno`N
z_F^S6l-nocD1W+Xuk)8lOLll|U?jQB$wtaHVRb7@{!P0p*9u<+$`p*)*U0~DYw0lk
zfK4AgF&aNA2$h?ad|rx-KOyufQg<ent}aC99s`?&e?M6(mquZ3pik^26aO{B!w<}k
z4rJ#}mxNE&ZU1lc6Qi8XzmciOFY}g({*7hO@Gh%RxPM4&N8$~)=WHC+dx=BEok{JR
zMbu=Yk^}>rXEm{Cp<M<_O>Q=GtQ|XO1h%aZ-y+plE9X0_c^Y#>ugMu+eICL6J;;3@
zXHy|*^bg=u26q}%<na_UTNA(8)eVZCv>q^fu7!>fQ0ta;UvHx7>7$hLy)C&MLx|IG
z?&R35AAdGOfA2FqFQSypI&}aNN!t{qmwTrWD;)k9NDv2)f-3p~!F#!qUPTHguL@Tx
z4M-~i6s<h}V|$2_38LTiDSG9-KO~&_38rK;z;e|U>)Tl3ASF_zHaP=~8Y5o(+K#}0
zBUm?B4eEAjajg7I=LtxiNQ`OXXeZG)(!(*_^MBSt`Z>b`&-kRH22KX>P1wUBuB(?9
zQ6vKxex+`ZBIvYC#}lvs9BJG5wy^KRBcBmHSL}Mzkh|kxKYxHk+MRTvj{9cqk;n<T
zUJFU=xrBpByNZ#XI`=T_X*nslSVL+4>AZRMf+`kZXo*bJZ<B%kgebimY_ze$%i<0-
zfqyKQm?!?_a>Cq@$%vjI1ag`LQ`cbwSl{Vy>JfQPaEbCMI3KjP04Z+2+gH#^^WAD6
zCibXzPq%fRvM%2#Cg<UI{HIiCyGJ^Tu(aH(IBagm&#gkMxYLV8Fq)-ia(0d++T_Tx
z6?!TUcYj3pFoFX41_>&LNQU<f0S5t~f|J$*HGficpx%@z{apeA2ml0v0)TyyvfK_W
z4^D?7G~)6MS7{)^4o`@+{^Oo`WH!y#9|SGoYVw2gAn@LAu`t}a53~95<{>n&@+|hk
z3%6=5Cp6w>b%V-tN)N$>bgEiyg_2ZHqB0cFaOqwMmNSaX?>aQQRf^~Uo;YRJ3V4r2
z!G8{Yv|ZTCq8x7-K31p)8FGM?FXd|0OD1X2S1-@MJ5!;Z&M5L?9`q!@;i>?8Ta|aC
z5dm;*PEbEc@yKC9e%i@>Oe}YPfw09(YFc{6Vf8VrhQBl|prRpAxJ^d5()^lNl*I`o
zm6F06Y=nrn^=@u3CuNnmSU^i0#d*Yd1%D5BW6wkE5o3eennTGPwgT8N;M@+T*flll
zW)??Sy#oZakcV^D#&{zT&)L$!-eb4d4N&)S#VU+C<p@5aqOk)b{(_>JX#R`^d6T2C
zg%N57D-Wep=!a*&5O?Re?-Q7>`F`$TVqc}TNthvFkpEO;$3kkXw>%*Tj_YH}9)AHI
z!sqJxrXt!>8X7N)1YS5&Vg>$E5@4*GvtRl8hF?e8DCFgfF1wWMq{C-ixQNJ4xoRjt
zfJR2G&K9{NDDxw06)cFtSgH2r9U7zRqZ5d8*gMP(x#n#!9nX%I%U^NMPz8_U3@M$(
zrZo{Dt7g4-_y6cMr&?30FKApO-G2g-2CcBc_Fwo@Awlew=l|;Iu$c*H*^;cZB%0R)
zWXpy?k$LER!>Q9Cf=AxGiUnfru${!I^^_2jdG6`Incv84fl9$SaB}xfdS*l+NaWkr
z2w`D?6!ftm3J;=5&0t30W%KxTR|v+ZcYUIYyEyp_9vNh2ctRs*2qJcE?r&d<s=QiQ
zVC*^pH5<ghmK{ya$o8BuB`_lf2`Yw2hW8Bt2^BFG1QfOxLM{}O*^%MC8@SZ9*RJ4e
zyY4VCFd;Ar1_dh)0|FWa00a~iQ_?No)0zD$PX0w(<S%l&W&x-K2rS@LxejW!#{vQf
E0L~5?-v9sr

diff --git a/test/subsubca-ca/subsubca.priv b/test/subsubca-ca/subsubca.priv
index a8e65fd..352bd04 100644
--- a/test/subsubca-ca/subsubca.priv
+++ b/test/subsubca-ca/subsubca.priv
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXQIBAAKBgQDGhZJ/m5tlKq9lJkFfxWaiBTlO3SUZkurhJbvioexseLvD3+QU
-NW079f5cxFXGE8QMxV3ae1jwUS30HA1e3h4UfiizO64gJMJcybZhECsFjlmjTZqG
-HdznYAV66EmMkmXyMesiN8HKSsQ3TiD31er+C4/1miKtjDuwIgNK6pNKUwIDAQAB
-AoGAYw/+RZ0hkv8U3PWVA7RefZT7vuXNgJB2knkg43uHna01jQ2pI4hxhM1A64ux
-fZEZcIIATmjkva7Uro5dAaz29sI9rfBo64Eo/oH8GowEMYPcB6b8wF3QApNmNLpV
-FamjU7H452fDYiCeRLzvJFm6uy3Tl5SC6G7dFuuAOKlSpkkCQQD+vaK0X5Iye10s
-YlRhTLgY8dibU/ud5RJ3E1q7w49H0PoTg29mJFdEHMWdtDH7hI/a9YfklTfkmlr/
-SX4Q56u1AkEAx4DLM+x+Ui6z8PFJd36z2UttRMwjopqq0sFLH0Gglg9RlTzYTVCw
-Q7+tSEggrMcZdnZclKXGHPHcdkPwrMYy5wJBAIdrGg5W6+oIKIzKrN6YoRkpn6Na
-7tyOBNXmJQrBt+5OilJLQbIDyZw8y1S9kQCLBMo6UgZSyMauw4cIc4rbDS0CQC5Y
-zFw2r6317ZWm6FNbWvq7HBpkdk7bMZ4ei44qV90kl+ZcqT9k5F4I1H+7SeP5qP+t
-RZq+3ERzJ61N4UayELcCQQCRX3rm4CqFo3pV+soJP70ZK2VkuJu+sS9+KHARjA7U
-jNmU2OppG47b1U4Hvzp5wgHFoB9bs2pu8Ae0taKT7AAB
+MIICXQIBAAKBgQC54r6J99TqsZAqE8MYWfoFzVJzCRh9qKGFLMJLWPjC/S0gl9Df
+Ob4VeyZyoUvMYgMMK5t90fCkZjbUSIvKYXNhs8OeClpU1UOtiCoPhUHw1gmN1Jry
+EE5B2NKIzQd46mBnKOFPnj0ki2Qx/dPTTLvIQkkVafYGFABtt98dwkSIfQIDAQAB
+AoGACLRqkdFuQhNQmffU8gX8pFrqGoL5h6Dm93KSIq8m7xKmE1moqVtt4FmlAkc1
+YnvQgrhkDq9PIpO6y5QeH7sSiRNAWO8iMSuGlsGCv5BqWz6T7qcSSM0k7r7VVdtC
+J0xvuTeJJx5zuAHPlBb5gW+B7m9BMBXhkwCZk99EbTBOhmECQQDsDznUQbljz0Ny
+klbzbtWppG6JLXmUr6VssRcvMgFVJHrch1+L/zMPS1w+ZERu0orTAGaswiJ5zCgj
++7Luj8BlAkEAyZaDc6VNeVDbL74rQFXDF8bdeuVZKqVgd3fjLY6EoT50U36AlCHg
+rJh3xs9eEW5KmUXmyb5Ir8KfGD4icffKOQJBAJMWma4Mlfv/NcO6M7vToAbokoef
+claXa7hiUFP0EKiA5p1rLLoK9kHdb0jhKVL0ldQMN+4FuX2zHH/vYfsMT5ECQDgV
+aOLutVwwE5r3xF60vX9K82lyj1kfA3SZZRnSkbGuh3yHMEyGFFTQYlpsbNZaoeR8
+nxW3m89STSLYforIjnkCQQDh36p1GeYIVQJ4j6xveOPIG/wb4bj0FqymhsDldtxi
+zl6IPPGlzlKyNYp+PLFjJ87FXoPWXa/xYWNZlE8yF2nD
 -----END RSA PRIVATE KEY-----
diff --git a/test/subsubca-ca/subsubca.req b/test/subsubca-ca/subsubca.req
index ee46f1b..6d02083 100644
--- a/test/subsubca-ca/subsubca.req
+++ b/test/subsubca-ca/subsubca.req
@@ -1,11 +1,11 @@
 -----BEGIN CERTIFICATE REQUEST-----
 MIIBnjCCAQcCAQAwXjELMAkGA1UEBhMCVUcxDzANBgNVBAcTBlRyb3BpYzEPMA0G
 A1UEChMGVXRvcGlhMRMwEQYDVQQLEwpSZWxheGF0aW9uMRgwFgYDVQQDEw90aGUg
-c3Vic3ViY2EgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMaFkn+bm2Uq
-r2UmQV/FZqIFOU7dJRmS6uElu+Kh7Gx4u8Pf5BQ1bTv1/lzEVcYTxAzFXdp7WPBR
-LfQcDV7eHhR+KLM7riAkwlzJtmEQKwWOWaNNmoYd3OdgBXroSYySZfIx6yI3wcpK
-xDdOIPfV6v4Lj/WaIq2MO7AiA0rqk0pTAgMBAAGgADANBgkqhkiG9w0BAQUFAAOB
-gQA6ra/yc+Dm0XuZbiQvknjBAnfDN18eB8am/g9p1xUeqJUHtecPShfl7Yzm9hEb
-aQRv3fVO9D+bAemYOiuZdAqSfOoSQ1f7xA/8eBypnkv9a4ZPPzNuKgjeWSiuJFQe
-d/JddnqkQW/LKC8cPw6yWOk0IdetRskwuQSQFD3rqPpkPw==
+c3Vic3ViY2EgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBALnivon31Oqx
+kCoTwxhZ+gXNUnMJGH2ooYUswktY+ML9LSCX0N85vhV7JnKhS8xiAwwrm33R8KRm
+NtRIi8phc2Gzw54KWlTVQ62IKg+FQfDWCY3UmvIQTkHY0ojNB3jqYGco4U+ePSSL
+ZDH909NMu8hCSRVp9gYUAG233x3CRIh9AgMBAAGgADANBgkqhkiG9w0BAQUFAAOB
+gQBN3GWZgt/lPxp6arW8azlqgMwrFqay++JhWLzJZHSCIbJYQweYlf3hD69ykfYP
+xxqG5+K9T81dJqHSEWgvXysK8yJAIcFUigV2Fdd6ggwUKvRLzBe6rS7b0imV32mP
+BF/IVWQXScyQWCpp15ktKXdUY6QkygYeeMnf4Scf2tTlgg==
 -----END CERTIFICATE REQUEST-----
diff --git a/test/trusted-ca/req_conf.cnf b/test/trusted-ca/req_conf.cnf
index 259c701..8e7c6f7 100644
--- a/test/trusted-ca/req_conf.cnf
+++ b/test/trusted-ca/req_conf.cnf
@@ -71,6 +71,18 @@ nsCertType		= server
 nsComment		= "OpenSSL Generated Server Certificate"
 subjectAltName 		= DNS:*.hoo.org,DNS:joo.haa.org,IP:123.124.220.1,DNS:g*a.e*.com
 
+[ ca_altname2 ]
+# This is OK for an SSL server.
+nsCertType		= server
+nsComment		= "OpenSSL Generated Server Certificate"
+subjectAltName		= $ENV::DNS_HOSTNAME
+
+[ ca_altname3 ]
+# This is OK for an SSL server.
+nsCertType		= server
+nsComment		= "OpenSSL Generated Server Certificate"
+subjectAltName 		= email:john.doe@foo.bar
+
 [ ca_client ]
 # For normal client use this is typical
 nsCertType 		= client, email
diff --git a/test/trusted-ca/trusted.cert b/test/trusted-ca/trusted.cert
index 9633019..91b88d0 100644
--- a/test/trusted-ca/trusted.cert
+++ b/test/trusted-ca/trusted.cert
@@ -1,19 +1,19 @@
 -----BEGIN CERTIFICATE-----
-MIIDCzCCAnSgAwIBAgIJAOouQ4VpKHjTMA0GCSqGSIb3DQEBBQUAMF0xCzAJBgNV
+MIIDCzCCAnSgAwIBAgIJAJuFJ8UKay74MA0GCSqGSIb3DQEBBQUAMF0xCzAJBgNV
 BAYTAlVHMQ8wDQYDVQQHEwZUcm9waWMxDzANBgNVBAoTBlV0b3BpYTETMBEGA1UE
-CxMKUmVsYXhhdGlvbjEXMBUGA1UEAxMOdGhlIHRydXN0ZWQgQ0EwHhcNMTAxMDIw
-MTY1MjE2WhcNMzgwMzA3MTY1MjE2WjBdMQswCQYDVQQGEwJVRzEPMA0GA1UEBxMG
+CxMKUmVsYXhhdGlvbjEXMBUGA1UEAxMOdGhlIHRydXN0ZWQgQ0EwHhcNMTAxMjE2
+MTcyMzA5WhcNMzgwNTAzMTcyMzA5WjBdMQswCQYDVQQGEwJVRzEPMA0GA1UEBxMG
 VHJvcGljMQ8wDQYDVQQKEwZVdG9waWExEzARBgNVBAsTClJlbGF4YXRpb24xFzAV
 BgNVBAMTDnRoZSB0cnVzdGVkIENBMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKB
-gQC+Jzh/JpR5dKWz48VxkhZJ2vs93BX3VvRjUbxx4MjTtlSL6nu782cudl7w8MPY
-jhuwA2T6jbWLH0zxk8mcjFIRIHQXzcCUqo4Mkq5BtH3+2a89ETwvLNgKX0Gf2F9S
-yOh0d6vhlbEOdNFbTKQLVMsjWEKMCj5L+VZeadxn9LJiNQIDAQABo4HSMIHPMAwG
-A1UdEwQFMAMBAf8wHQYDVR0OBBYEFOA+Gh96ypaxx45JD1tHvDvXSfBJMIGPBgNV
-HSMEgYcwgYSAFOA+Gh96ypaxx45JD1tHvDvXSfBJoWGkXzBdMQswCQYDVQQGEwJV
+gQDZdPzKqIcYF1MYCcE/VZ63Pz8xJB8NcsLDK/VkWKGVGx6PTnanJ7I9k46ruTkb
+i362cmIj70qDNZzVlkaPJJ9ncwedhDvxcxofSVzqetI38RsHYBeLFm011W7wsVl3
+FeMbRRBUkcHSULSNU09lxvzSj3sbTqN8BiQWwKsfmCFH8QIDAQABo4HSMIHPMAwG
+A1UdEwQFMAMBAf8wHQYDVR0OBBYEFJO6Gw2Fwc+luvR2I+eCL4VngvNpMIGPBgNV
+HSMEgYcwgYSAFJO6Gw2Fwc+luvR2I+eCL4VngvNpoWGkXzBdMQswCQYDVQQGEwJV
 RzEPMA0GA1UEBxMGVHJvcGljMQ8wDQYDVQQKEwZVdG9waWExEzARBgNVBAsTClJl
-bGF4YXRpb24xFzAVBgNVBAMTDnRoZSB0cnVzdGVkIENBggkA6i5DhWkoeNMwDgYD
-VR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBBQUAA4GBAHkb4skFvgFfR03v7V7sKWll
-l292pFON7Zpqa/nwOX7yrIJzz+nFzz9QU3wsUuFdLNMP42usPFWUt8cwV4QMkxdj
-p+iV2sEMJxNcQwZJdC5EeW0J+RIXnkNarDAev4Hlx0Af/4e5mUkJCAj4YG/frJbK
-TF+PsdS5cfC86kEH3mB1
+bGF4YXRpb24xFzAVBgNVBAMTDnRoZSB0cnVzdGVkIENBggkAm4UnxQprLvgwDgYD
+VR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBBQUAA4GBANBi+lIoIhlKOLs1Wbxfu+Mv
+0vxde/ZIWjJ6KTTfXpvhshimKPwVfv+kppJA6wdVtVe7Zx5Jwc9Wt/p6lWD6htoI
+8p6k9GCk2sT5DcVlErxi1hIwps+RbkuJVPpwQZFpCdpKyOTcfJvhXlbO27ZI6Qyw
+dfTq0+pVfIgUoBVG9Rw/
 -----END CERTIFICATE-----
diff --git a/test/trusted-ca/trusted.p12 b/test/trusted-ca/trusted.p12
index 6f673548ef3d028ff266cead8669d31f5017514b..62a90c34bff5d029b2ef3935f605a2623cf3b915 100644
GIT binary patch
delta 1658
zcmV-=28H>B4uuYoU4P^_Z@XOxQPctg2mpYB18C<MA|6_&bvY&DCW*iwPX(?;5do11
z_kz(sCF7Lm^i1OEWDB{DIvV=-ryoEHs?jMnK#Bc*%P&r&^OmNH0ibw1DMgt2{GL&S
zRvP0$_Rn9~&-jI%xN_swg^t34grREMQ*e-U{pW57BqSg?8h>NP;`|J2vKC&WJ|J#u
zm}!dF4nU$IJFtS393IK57AJlA)$<NxY^~WoO%D`_(lk6WJBfV-NF!rjXn&L0sS_!o
zJ|8%v7L2G{Flv$#VOY%yNuW4$U~qPJJS8S$Gpa&HSu)eu<*NZNrFErakZWnpzg07~
zCNvfg!EI(F%YUqUa5OM6+U7qd2VwT5od9F)F0NN4^mgp>yoj|Z<{Dbv5g!=f44t;w
zT7+8oCEhUwNQ$YJ=CwRazbc!qfiMN@rVAQFzfp)td7s4Wlp2ut*|fxt*zdvwI>?MG
zYpsz;f_^986_@k&gFBY~qJld0q;#52B7P3ha&0Nd41ZBYK2=2K;2^XJKHEx-Uf;tW
zG;rl>jpp$tPm3m;!gX?>=^B)fWi?n`t-9<Y4~Y&g0Ev1Ba(n%EDdupGdvm-h8dgST
ztr97uaD?W`D%X$Am2IEWCBhk|DWY(KUNaTEf#a`tm4^Kqox<MxO}$FLIKI?SON{_$
zpfh>h`hN~yGJpoR9FSNuN$seza+qLCA)1A>a%NA)yZ@o-i37xS1KZLs(@_AxDwH}s
zbiDiln?+|BHM8kB#CEp0)?G$0ZG|#Y)n$9Ao|pAXG1oDX`KONC^loPe#{g{o-iwA^
z$`*Qs?5PM2{{_@8i==mu&R<?5Qzj3bUR0AnHGk8``Auq+sE<D9eRJO2-FE18DUkOf
zBmNj)j`2^XXB>pnqSKQ~!zb2Xw=KA0dousz<_>PPhndhSp6l@KwXqBIJ(1boUf(bU
zS=OeBTIx-iA>M_bFd|j={md3M3;HD|(|*W>J;rVgMF@NB)q_7BL`*=*vJJ(TnX4sl
zTYr(#rLl;4D?nLc?KSaHVY#kM)F9X^hDJ?nzQ67^z>g4gPDLqkDPkmjp6eZr5(^6I
z6ihE{W7}j?sk91Y=Ijl!+nx!JN8_u5sxuAylLC-d7-b7EYTpl{GTz@wg`7Tmq|5uF
zTF&&MpeOF2YNP@^HiqT=@0!gh@N8-FFq75;MStYPK_qvIZhQg)2ml0v0)Vg35W_4O
z(O51Y*hz4f=$xA|vaY^aQ$GX&2iB~8i%!l%AtMJC#JYykieAU`B%OsOMl7=oeKUHw
zw)ab$wE}ReWRU#10oX$%4mB<jW-tFzU<LWT(3Pg~F?JM2Q!|_uu2Q6wsLL>_g?bh8
zWPdw;sJKqRDC4JFKY2=u@O>{AHqZV+3~UBZ{=#e2n6M<jK9!c@(gdyH^dw9VU;b>(
zv_5RBO(+4a3!{SSCO1v2$&RQPghK><b_?+c4zo+3_hy{%gpjyn`i5O-sUZq}mksW@
zRLnW=fvUFoShBc#tyLsor-qW7AA$g7f`9sLZf%zrCR7pHMmq@+K_Pi!-&6;f(Ez4-
z19hLd#nDub1XU4P+3%gQLWp+GHj8NJcU^UOBDN!Te;a3vV4E~a8$R%YUs=cu;sK%<
zHLcD?QB}i{mmo1zm#Ubu;8z4e1$^e!<4p`T_^#J{W)REtS@9uGfemY#{#{X?a(^qD
z+pA`Nl1LQpfCZhX8iI8GLhHb397*t=DlzH|<~G?_pGZi7|6$WX(mOPothV43B1{2+
zgkm=`zo_rJ4B+{L?;gXanHaA(bPmj0x*S;w^yk&$rXo@lG<Da<I^RN_XfDV9&u!dU
z4)wHu+}8t{piASE{Bw+Ks&iE6%73RS#SO2~O3g-WuRuF6M7=r6Ldi+_8H+aKJ#ab5
zn?A<;#Sa`04e3J)-CXGR_2nr1x}?qe$BrkkQ-$*YFo{uD3NFL<c%y79LXTD@qPLW{
zTRrONE%@^#xu7|)zcnkGg=3$(ai+0U%mQTXg>0el2fz_4$%pVkV@Ui*xo=BQOHXlj
zfNX#%G%?{JHv;KNRX(IKB`_lf2`Yw2hW8Bt2^BFG1QdJ?)tM$OPbBg_Pj;pS$!gM5
zSk5ppFd;Ar1_dh)0|FWa00b2DNlV`)&r2h=rxhWk!E+d3OsPo(2x1?y^LCwmxB>zQ
E07gm;G5`Po

delta 1658
zcmV-=28H>B4uuYoU4IW-{d2|%3zGr@2mpYB18AD+PoXi9VZ|(b@Xyw8?*%>+GSCCr
zDBjyeQ+Qb33>Wporq3o_>QmmDkXvngqcgXgV%N-^TB^xg!i)iO8I*^+T%Wk3vE{C|
zIHnBUAtl&2)p1YXxwpj6ruWf^KgaiFW=Rz3in5;^qpBT4mw%!KV~&H7jP9Ts7q<`v
z)CUK+9p)#@O8xmuC8Wp#lB7mcsntJ&DP~fq@1u#KzDs44x&cr1y%pZje%`B=d{hSM
z+`I~+V!yxTP*z3hZWnTQstF3ql>wtD_3u43hP5DK7JNzjyTX*4jT#R+JjU~hIL>;8
z85hM8-Lp>;dw=iilkw3yj{QWCQfR7w`537D?S+bcGH%pO*qH0$E#v1cTjTXZ`SzAQ
zkd^mKC-vb|pY>}wkEN%4*?c-;rp4yExbb>>uPs|D52lkna|UC}aRMF=%KXU<qCi=i
zx9m2bv$%N5u;0&cnbDyK-TT@&Py6E+CS+OLSFxO>bANBVQ@RzvtU3g=i7C&ILpq#2
ziL{RTN!Mm$tU+I+y%nj~g^>%fZeTxE^y$zrc^N1D1Rl{Cu{zvSolioaKDT1J5!mcf
zY(^W-0fw|SZJ^o@)@C-F3QGCoVn9S0IU0j<9(G?Uu*Ymh^cetT)3K8{J-D`3^xJoM
z<yP0-&3})NE@8Of*>p%bgckyR4PcRF9#EsN_77ry;H3h_)=I!>Wt418s&&h<Dx6KK
z^S?o(1_I&8PFyYfjYTS$97BaFu}~|<kjtRnS9f}vbYw*i+%gPE1L*c2Rzw6K`0dgs
z7pGS|k|auO&jJwx7^ikzaEKv7CjS?9P&tV~YJcS?II4T1iWV)I8?${{8pQ8UcgTfh
zKrp4R@O;+|bD-^U+l{_DW!7Ks@e@y4EF!BV4)8_^q*wm!G)*H;x=4snk4dqVdk65e
z5)BDIO*-WW;qP@1c(*UnEsfAaA7g=E^Q;z7Xv12)t@#Rt;S1DhI+q1o1X3WB3TiXB
z3V*&#gFtUK!Y!{X8#6C&7x_BK<rxO9yaGpoTp>rIIZ&<`t>cmO(z)jc3lVYS<FD#P
z<oe+Y<oz8%=B@yGBX7t%2}__Pv=)j-bkGFjIAaEQh>Hs$6%S`ItX{4UGcbt&m?L@&
zE0z3CCV3F&IT6t&+q&UvddTv0fVk~;Fq75;MSoL_<3RE^e-;7)2ml0v0)X<QP~C<J
zW0J&)R1GLBn}2PUH4PqLVeL$Q4pumOhfodHygU?T0*oDQK<sdmFeqz4bFbFUSjixs
zybwZxQ$t&8H<}9pU}0n1dn!8cAMyH9x48BLLv&vw3KS3nB+}76$8r$QT2M5KvL8%h
z1AoA4lMhKxK&lpD=(s_zsZ4Qd>`fhy8WvVyU{Oh?XX_XOQp`YzZ8BehHF(!zF(mOc
zUq=~9B=P#Cf7JV2&|DUbrb!XVKe?~?x{R%7vIIZY3lpNEK4^2h8^@pjMndDCgZWdq
zqE+FC)g5qM%E#-t1HF>)Mbbt+A3Rw?5`XYXu-cXFsjkXBz~SJ-`e@W)SScLO$;u!)
z`NU51r<}BW?wN1UB75gf-aq39SM_(hVn`TnY0~xj%9tAxbkWoj)18D+kUSw<6(shw
z5A=`l|4xk)wQ*kW2*#*zK8GVgme@dSBDhaO-P9i+3BFm2{V65xz`!Lyew(b`jDLx^
z<a9pGlMRi+L>04T^IJ}TL&|f^waW<>Q?a6MCeHN2UnTVk!_QvAm!WGu6(DCEn59z=
z$aa($fz@kp(K7%ZmX+_FdP(3z!meq(0GIwfdG(I~!hicPGa@?Cmhcd@gOS}Ml+R3-
z8N~&dP&u?VzXN|$+}s@-af=PMOn)13DL3%{jg`#Olk?RsCg;)u@13NLX4)wX0-}YW
zlFtv%?KkmSV&<fjA}3yA6SE$pp7AT<P&ajkv<T`Rw3tA%3=btCQ&7Bxs$s0}EuM(U
z(>XE=BoOJxrzHwVBVYDQdkxI`1qiA6^HdV87m#IqNfWtF9^8dVbpiO(d~cyvd2;aG
z#t>43`5|eTgnmgQMiekHB`_lf2`Yw2hW8Bt2^BFG1Qd`_?*h|PWCs0lpr_d^F^uV2
z+V(IpFd;Ar1_dh)0|FWa00b0%-%~$eOuG2Ne9JmnPdbM3L;w#22pd5aYMwx9t^xuG
E0As)ip8x;=

diff --git a/test/trusted-ca/trusted.priv b/test/trusted-ca/trusted.priv
index 09a3643..02ced14 100644
--- a/test/trusted-ca/trusted.priv
+++ b/test/trusted-ca/trusted.priv
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXAIBAAKBgQC+Jzh/JpR5dKWz48VxkhZJ2vs93BX3VvRjUbxx4MjTtlSL6nu7
-82cudl7w8MPYjhuwA2T6jbWLH0zxk8mcjFIRIHQXzcCUqo4Mkq5BtH3+2a89ETwv
-LNgKX0Gf2F9SyOh0d6vhlbEOdNFbTKQLVMsjWEKMCj5L+VZeadxn9LJiNQIDAQAB
-AoGAe9ZdI+nDPkoqdDo9ZxZl75lukD3aDGgT5u7fVCa5g6+15h1CkggVxZuPf0i9
-szXxcDL1u3s4pS8wVBAUeCCmfKLxbUw37FVr8REi962cCqIWLf5O0v+wjevwf37y
-7KF5qwppm3hgyOLbY42aKDljWXPlVL985Ird4fMUl3O2ASECQQDrfzz5X+Dfvcq/
-PVd1hzecMB/SpW9GetC6ZawlDcLioTKD91+bSmd3RfuU4kpnx6iSF9yItl7Runqa
-UlAW/yy5AkEAzrVb0wt8UiBbd4QIHlMak1Eb9T8hE31b1FxXmzEzEoL+lQXlJJVS
-L+JFLsnhxgXzo1Ts7rPTURzJpdBvNPS7XQJBAKoP7ZlsirkoluR5yNHfvuH0wtZc
-j7oG8Prad3EeufDtVcyE9K7xETzJ9f8zV2YQggRWZPT5Ngogr28IKDwjNEkCQGfW
-nywjhu5SpuAhCVsCcEU055CJh/ocbTb+tFuXmYphF7aQ4Y1BHapERnC8pZgugTe5
-f9RhrXP/vCR50oONtVkCQBVYV3aJO3oz63kGCGnRJoxu+CGu/PauCKCXjbHSksNy
-xojBtyuLuR51Mg3n7iIZpJrE7+Yk/POwSpbC+ZGTtUQ=
+MIICXAIBAAKBgQDZdPzKqIcYF1MYCcE/VZ63Pz8xJB8NcsLDK/VkWKGVGx6PTnan
+J7I9k46ruTkbi362cmIj70qDNZzVlkaPJJ9ncwedhDvxcxofSVzqetI38RsHYBeL
+Fm011W7wsVl3FeMbRRBUkcHSULSNU09lxvzSj3sbTqN8BiQWwKsfmCFH8QIDAQAB
+AoGBAMDwj6qwRM0XRN67KP8s1Jn6P/M1/WdNP4kz45KZISTO3xp/n79H9Vm1Jo0u
+1oCeEFuIuZLwqcgpNXI813YCJHteXrTx12B5iMroBQ2hmm2plgkcok2dS3NQDnGc
+3LeiWaljgLJV+MFA/5cRdP39jFo84gJvsf2XbSkbDPzeTmsRAkEA7S+VjWG8Xxol
+65B1nozOaXMoKW1hVFxKHb5bF9p2cmkRLXv9ILnhQohwvPx0XQUuejuNicrB9Mzm
+M6XYQk5z1wJBAOq0x0eKgsU9yLktqGBUfWTpfk9tYVr4mS43b6uSUZjRGwcs1o7d
+5Ew+oyj204kpkSECxCjRabS73XJ9ihBEKXcCQB+NKunJzJMiGVVCvELBHFwus3L/
+V+ku9bULM3by2rrRezV/vuZxk6OUHtslAh21qL8d2PAxhqeX8i+Aqkn3wbUCQHAv
+5SlfHc7mD3HkTx1shVuc+FFC+UwglCexO+GI2RPwr7ioSA6WJbAEKL1F7iscAVEE
+H3tbTemj+t/k/f90dVUCQH+ns8UJYRLIhuEW0vF5D1LYNFEtAMly96iCRUChciAF
+lV8ve1NcgfvujhQPLC5Sj8pNj/omVwUCFNZNaiQf/9o=
 -----END RSA PRIVATE KEY-----
-- 
1.8.2.3