more TLS tests

2026-09-25 04:09:31 +03:00 · 2024-11-29 14:29:02 +01:00
parent 2e59d560a5
commit a027d49a4e
22 changed files with 1525 additions and 121 deletions
@@ -68,6 +68,7 @@ openssl ca \
        -passin 'pass:masterword' \
        -config ca.conf

+
 rm client-of-rca-csr.pem

 # Setup ICA directory structure
@@ -101,7 +102,8 @@ openssl ca \
        -extensions v3_intermediate_ca \
        -out ica-signed-cert.pem \
        -passin 'pass:masterword' \
-        -config ca.conf
+        -config ca.conf \
+        -outform PEM

 rm ica-csr.pem

@@ -136,12 +138,15 @@ openssl ca \
        -section ICA_default \
        -out client-of-ica-signed-cert.pem \
        -passin 'pass:icaword' \
-        -config ca.conf
+        -config ca.conf \
+        -outform PEM

 rm client-of-ica-csr.pem

+cat rca-signed-cert.pem ica-signed-cert.pem client-of-ica-signed-cert.pem > client-of-ica-chain.pem

-
+# Check result
+openssl verify -verbose -CAfile rca-signed-cert.pem client-of-ica-chain.pem

 # create 2nd ICA client private key
 openssl genpkey \
@@ -167,6 +172,12 @@ openssl ca \
        -section ICA_default \
        -out client2-of-ica-signed-cert.pem \
        -passin 'pass:icaword' \
-        -config ca.conf
+        -config ca.conf \
+        -outform PEM

 rm client2-of-ica-csr.pem
+
+cat rca-signed-cert.pem ica-signed-cert.pem client2-of-ica-signed-cert.pem > client2-of-ica-chain.pem
+
+# Check result
+openssl verify -verbose -CAfile rca-signed-cert.pem client2-of-ica-chain.pem
@@ -30,7 +30,8 @@ check_PROGRAMS = \

 if MHD_ENABLE_HTTPS
 check_PROGRAMS += \
-  test_tls
+  test_tls \
+  test_cert_tls
 endif

 TESTS = $(check_PROGRAMS)
@@ -59,8 +60,28 @@ test_tls_SOURCES = \
 test_tls_LDADD = \
  libmhdt.la

+test_cert_tls_SOURCES = \
+  test_cert_tls.c
+test_cert_tls_LDADD = \
+  libmhdt.la

 test_postprocessor_SOURCES = \
  test_postprocessor.c
 test_postprocessor_LDADD = \
  libmhdt.la
+
+EXTRA_DIST = \
+  data/client2-of-ica-chain.pem \
+  data/client2-of-ica-private-key.pem \
+  data/client2-of-ica-signed-cert.pem \
+  data/client-of-ica-chain.pem \
+  data/client-of-ica-private-key.pem \
+  data/client-of-ica-signed-cert.pem \
+  data/client-of-rca-private-key.pem \
+  data/client-of-rca-signed-cert.pem \
+  data/ica-chain.pem \
+  data/ica-private-key.pem \
+  data/ica-signed-cert.pem \
+  data/rca-private-key.pem \
+  data/rca-signed-cert.pem \
+  data/rca-unsigned-cert.pem
@@ -0,0 +1,177 @@
+-----BEGIN CERTIFICATE-----
+MIIDjTCCAnWgAwIBAgIUKkxAx2lVnvYcaNqBpJmTgXh1/VgwDQYJKoZIhvcNAQEL
+BQAwVjELMAkGA1UEBhMCVVMxFjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxDzANBgNV
+BAcMBkJvc3RvbjENMAsGA1UECgwEUm9vdDEPMA0GA1UEAwwGY2EuZ251MB4XDTI0
+MTEyOTEyNDUyOFoXDTM0MTEyNzEyNDUyOFowVjELMAkGA1UEBhMCVVMxFjAUBgNV
+BAgMDU1hc3NhY2h1c2V0dHMxDzANBgNVBAcMBkJvc3RvbjENMAsGA1UECgwEUm9v
+dDEPMA0GA1UEAwwGY2EuZ251MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
+AQEA23YSrcGIBgZf9bbzTnmYFy+4tM82kUhsVFKxWCNEMdKmhaeVvXogyd6Evq4P
+NvBGdUABDtHp4pSEijrxWbn8sxddTznoT/8IOuHI0/PtwXYP/sHQ/HzekEUVKN2Z
+NMbMUzQfaJyiIV5TrZlaBwHjQ+sRs8E56C3cQjkwuyjll2zDsEfmEnPimZRAL3kb
+wW8VFfBcR2Id+a9xKjwlnB4eXQFAgYINoRgCtUOUxSeFgNnwkOUSqDknO6Xi47YZ
+EdLlHyUnv5eX547xUkrYhfQuQwaqpGrjHf3GFoysN8P9kd2f1qsJKtQcUbF9DDeZ
+6ya47X/LBO8QflMsVjb1V3oz9QIDAQABo1MwUTAdBgNVHQ4EFgQUsvdZoX3RxdN6
+wrONr31SOA9Qbc4wHwYDVR0jBBgwFoAUsvdZoX3RxdN6wrONr31SOA9Qbc4wDwYD
+VR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAS3PyV7crGk9brqU90aML
+2TWkjgzFb3/nASnpvVYiqyiV4neGiEjtDy7eVlqP6GlD2pYcVodY+ly9wNlo85/h
+YfgCFFl37tMG7PpRac2qBqaSn1DpwsCb08LjRrOvoaRffWUikSoZmsYDlaCgl9nT
+pGtIrz0BSoyu5mHalIZTVQOrbkNBNK6ZgnYy2iWuiLa5Z1xzKpsRBRaKJc1pcQE/
+QVbPdCiyGQMPEVn/KHxitlycFoee/fA+izXVdstVwfig2DoMvrlGZvEkN1ER3Yz4
+QPJ6HzOsBQL1F+YhnMCQfc2rpcwxAWf8JMy6jsCq42KGq53tkWqHyQ6Zu2SiLRYk
+CA==
+-----END CERTIFICATE-----
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 4097 (0x1001)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=Massachusetts, L=Boston, O=Root, CN=ca.gnu
+        Validity
+            Not Before: Nov 27 20:51:19 2024 GMT
+            Not After : Nov 27 20:51:19 2025 GMT
+        Subject: C=US, ST=Massachusetts, O=ICA, CN=ica.gnu
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:d5:1f:d7:1a:46:9a:70:ed:6a:88:af:be:80:04:
+                    42:32:26:cf:c4:d8:11:05:21:3f:b3:ef:29:d9:a3:
+                    39:37:b7:89:d5:64:9a:cc:c1:f4:9c:0a:8b:41:cb:
+                    09:7e:ab:16:62:24:6b:69:ea:ba:78:a2:97:a3:e4:
+                    0a:06:c2:2e:14:31:20:15:61:74:7d:70:5d:e8:9f:
+                    33:63:4b:08:81:8b:8f:5a:19:af:92:99:c6:c5:a2:
+                    a4:16:f9:1c:fd:bb:03:f4:2a:1e:98:f2:b2:c1:20:
+                    69:0e:96:ea:3e:dc:b5:91:40:1f:aa:51:a6:a4:09:
+                    06:2f:d9:be:b0:e3:4e:d4:27:2c:b3:74:b2:90:08:
+                    09:d6:cb:7a:4f:f0:dd:43:99:ef:22:24:94:04:c0:
+                    70:48:ba:d8:c4:4f:64:89:bf:7a:a3:74:27:d6:1f:
+                    a7:ab:04:20:e6:99:c8:8f:2f:14:99:02:d1:eb:ce:
+                    2b:0f:ba:5e:b4:80:22:7b:ef:3c:0a:90:a4:97:7b:
+                    4c:19:5f:d4:5e:d7:21:32:3f:3e:05:8a:67:01:d9:
+                    39:f5:7e:39:a7:cf:64:c1:4a:d7:b5:c2:f4:a2:c0:
+                    a4:ef:9f:25:96:96:95:bb:bc:44:27:7f:eb:dd:43:
+                    b4:28:4a:70:f6:21:83:0f:59:cb:98:69:57:8f:ca:
+                    a8:93
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                14:FA:DA:77:F8:45:92:B7:7C:38:FC:74:CA:26:74:2B:B7:D4:36:75
+            X509v3 Authority Key Identifier: 
+                1A:03:C0:AD:5C:3D:FE:76:38:FC:20:8C:B2:73:5C:A3:44:1D:0F:EC
+            X509v3 Basic Constraints: critical
+                CA:TRUE, pathlen:0
+            X509v3 Key Usage: critical
+                Digital Signature, Certificate Sign, CRL Sign
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        00:f7:92:a1:7e:cb:38:f6:62:28:fc:86:ea:7d:64:2a:0e:3d:
+        95:e9:86:d1:00:29:42:5f:97:27:60:31:33:6b:b1:40:9e:d0:
+        20:fd:c9:a1:19:21:41:91:6d:d0:97:af:0a:9f:e9:55:b8:fe:
+        66:20:c6:42:31:9b:8e:08:8e:ea:cb:86:17:e9:12:49:43:de:
+        03:74:a2:19:77:7e:4f:ef:f6:3c:7e:d3:ed:47:fd:24:9b:d5:
+        cc:29:4a:cf:30:d9:40:bc:73:d9:d6:5f:f1:75:48:f8:00:06:
+        2c:a3:84:f0:9d:0c:51:14:40:d0:9d:4b:7c:79:20:93:b9:2f:
+        29:f6:39:ae:36:4f:08:45:65:43:f7:4e:5d:88:84:da:fd:46:
+        a3:14:2e:cb:b9:fa:80:b4:a6:bf:db:72:91:0d:05:a5:82:f6:
+        f9:6c:81:8b:2b:d9:13:5c:cd:d5:da:4b:31:5e:f0:4d:9a:a7:
+        2e:cb:73:6e:7e:07:7c:4a:cc:9a:12:f0:cb:86:34:50:73:c6:
+        2c:40:23:73:ed:7f:f5:c9:61:8e:85:8b:37:fc:33:20:af:fd:
+        6d:4a:cc:3f:60:22:7b:ef:c4:9c:51:d6:f3:de:7c:06:40:a8:
+        4f:ea:38:07:b5:df:4f:b0:56:22:af:50:3d:6b:eb:46:42:7b:
+        a1:3b:1b:df
+-----BEGIN CERTIFICATE-----
+MIIDfTCCAmWgAwIBAgICEAEwDQYJKoZIhvcNAQELBQAwVjELMAkGA1UEBhMCVVMx
+FjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxDzANBgNVBAcMBkJvc3RvbjENMAsGA1UE
+CgwEUm9vdDEPMA0GA1UEAwwGY2EuZ251MB4XDTI0MTEyNzIwNTExOVoXDTI1MTEy
+NzIwNTExOVowRTELMAkGA1UEBhMCVVMxFjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMx
+DDAKBgNVBAoMA0lDQTEQMA4GA1UEAwwHaWNhLmdudTCCASIwDQYJKoZIhvcNAQEB
+BQADggEPADCCAQoCggEBANUf1xpGmnDtaoivvoAEQjImz8TYEQUhP7PvKdmjOTe3
+idVkmszB9JwKi0HLCX6rFmIka2nquniil6PkCgbCLhQxIBVhdH1wXeifM2NLCIGL
+j1oZr5KZxsWipBb5HP27A/QqHpjyssEgaQ6W6j7ctZFAH6pRpqQJBi/ZvrDjTtQn
+LLN0spAICdbLek/w3UOZ7yIklATAcEi62MRPZIm/eqN0J9Yfp6sEIOaZyI8vFJkC
+0evOKw+6XrSAInvvPAqQpJd7TBlf1F7XITI/PgWKZwHZOfV+OafPZMFK17XC9KLA
+pO+fJZaWlbu8RCd/691DtChKcPYhgw9Zy5hpV4/KqJMCAwEAAaNmMGQwHQYDVR0O
+BBYEFBT62nf4RZK3fDj8dMomdCu31DZ1MB8GA1UdIwQYMBaAFBoDwK1cPf52OPwg
+jLJzXKNEHQ/sMBIGA1UdEwEB/wQIMAYBAf8CAQAwDgYDVR0PAQH/BAQDAgGGMA0G
+CSqGSIb3DQEBCwUAA4IBAQAA95Khfss49mIo/IbqfWQqDj2V6YbRAClCX5cnYDEz
+a7FAntAg/cmhGSFBkW3Ql68Kn+lVuP5mIMZCMZuOCI7qy4YX6RJJQ94DdKIZd35P
+7/Y8ftPtR/0km9XMKUrPMNlAvHPZ1l/xdUj4AAYso4TwnQxRFEDQnUt8eSCTuS8p
+9jmuNk8IRWVD905diITa/UajFC7LufqAtKa/23KRDQWlgvb5bIGLK9kTXM3V2ksx
+XvBNmqcuy3Nufgd8SsyaEvDLhjRQc8YsQCNz7X/1yWGOhYs3/DMgr/1tSsw/YCJ7
+78ScUdbz3nwGQKhP6jgHtd9PsFYir1A9a+tGQnuhOxvf
+-----END CERTIFICATE-----
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 4096 (0x1000)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=Massachusetts, O=ICA, CN=ica.gnu
+        Validity
+            Not Before: Nov 27 20:51:19 2024 GMT
+            Not After : Nov 27 20:51:19 2025 GMT
+        Subject: C=US, ST=Massachusetts, O=ICA-Client, CN=client.ica.gnu
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:c6:7e:66:d3:87:a7:86:39:a4:62:81:c8:55:b0:
+                    7e:80:5a:a8:cc:c1:4e:81:c1:99:34:b3:26:6b:73:
+                    8b:88:b3:0e:5b:40:1d:12:3b:49:08:d0:2f:47:00:
+                    2d:5d:71:c4:34:af:d3:c4:cc:8d:25:d7:54:8d:47:
+                    99:20:ce:90:54:d7:e8:63:92:fe:01:01:32:f1:20:
+                    b5:00:13:c9:76:8f:6d:3f:98:d2:6c:f9:a9:02:f3:
+                    2a:b9:0d:d2:71:ee:fc:30:f7:7b:c8:2c:36:e5:96:
+                    9b:ca:3f:b2:3e:16:2a:9b:53:c1:05:3a:2e:19:54:
+                    21:31:c0:82:a8:95:07:fd:a7:6c:bb:97:83:4a:27:
+                    75:da:04:2c:89:2a:13:a6:a0:b4:be:bc:c3:40:24:
+                    88:59:29:d8:94:74:ee:de:c8:72:92:5d:76:b2:c7:
+                    8f:43:b4:37:2a:75:60:c1:d3:aa:75:b2:e7:f4:ab:
+                    42:19:8f:26:f4:ca:75:d4:fe:ab:00:6b:ff:4c:97:
+                    ea:4a:ca:74:5e:a5:bc:4a:d9:7e:55:ce:51:5e:c1:
+                    f2:8e:5f:6f:38:bf:ed:e1:6d:71:a5:98:5e:9e:93:
+                    22:70:14:ac:ed:90:49:be:db:e3:c6:5a:fe:7e:4b:
+                    69:d3:79:37:53:b0:2a:10:48:b7:b5:ea:02:4a:81:
+                    ff:6b
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                A0:8F:2B:91:B7:06:F8:CB:F0:2A:A3:A5:FC:77:A7:ED:46:63:FB:29
+            X509v3 Authority Key Identifier: 
+                14:FA:DA:77:F8:45:92:B7:7C:38:FC:74:CA:26:74:2B:B7:D4:36:75
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        9a:b4:2b:13:bf:b1:39:0f:70:bc:c1:ed:df:7e:28:91:01:11:
+        07:a1:93:eb:08:58:4a:59:b6:73:80:33:f6:19:05:65:b5:ad:
+        38:f2:f8:17:34:f1:06:89:5f:a1:0a:dd:c5:32:cc:f9:36:52:
+        59:e8:33:7b:e4:e2:47:93:88:4d:f0:e0:b9:ff:d2:9e:35:ee:
+        11:60:60:43:76:f9:41:1c:8a:96:7c:40:37:e7:b6:5f:f6:d1:
+        de:24:6e:d5:21:77:ae:8c:4a:ca:ca:5a:72:4c:8d:cf:b6:7e:
+        4d:46:00:da:b7:07:ad:7f:b1:41:90:27:32:da:86:de:19:b9:
+        33:1b:98:82:b4:a4:16:de:50:24:64:e9:62:96:25:c9:55:78:
+        9e:58:97:8c:08:6b:5b:49:7d:e5:e2:0a:8e:4e:02:78:64:12:
+        c9:31:2d:80:24:53:c0:b8:c6:8f:c8:bc:76:92:61:c2:9a:1c:
+        ed:ed:21:dd:d3:9a:3b:af:ba:b4:77:66:45:97:f1:02:ae:67:
+        7c:65:d7:c8:d8:58:38:c2:ef:59:07:1b:f5:20:c7:ea:5a:38:
+        63:de:f9:8c:fc:b3:9f:e4:40:89:19:fd:21:bc:e6:e1:08:fb:
+        33:a4:f9:69:d8:a4:58:f9:ad:5f:fa:d3:4a:8d:e8:98:45:56:
+        c3:cf:35:f8
+-----BEGIN CERTIFICATE-----
+MIIDVjCCAj6gAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwRTELMAkGA1UEBhMCVVMx
+FjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxDDAKBgNVBAoMA0lDQTEQMA4GA1UEAwwH
+aWNhLmdudTAeFw0yNDExMjcyMDUxMTlaFw0yNTExMjcyMDUxMTlaMFMxCzAJBgNV
+BAYTAlVTMRYwFAYDVQQIDA1NYXNzYWNodXNldHRzMRMwEQYDVQQKDApJQ0EtQ2xp
+ZW50MRcwFQYDVQQDDA5jbGllbnQuaWNhLmdudTCCASIwDQYJKoZIhvcNAQEBBQAD
+ggEPADCCAQoCggEBAMZ+ZtOHp4Y5pGKByFWwfoBaqMzBToHBmTSzJmtzi4izDltA
+HRI7SQjQL0cALV1xxDSv08TMjSXXVI1HmSDOkFTX6GOS/gEBMvEgtQATyXaPbT+Y
+0mz5qQLzKrkN0nHu/DD3e8gsNuWWm8o/sj4WKptTwQU6LhlUITHAgqiVB/2nbLuX
+g0onddoELIkqE6agtL68w0AkiFkp2JR07t7IcpJddrLHj0O0Nyp1YMHTqnWy5/Sr
+QhmPJvTKddT+qwBr/0yX6krKdF6lvErZflXOUV7B8o5fbzi/7eFtcaWYXp6TInAU
+rO2QSb7b48Za/n5LadN5N1OwKhBIt7XqAkqB/2sCAwEAAaNCMEAwHQYDVR0OBBYE
+FKCPK5G3BvjL8Cqjpfx3p+1GY/spMB8GA1UdIwQYMBaAFBT62nf4RZK3fDj8dMom
+dCu31DZ1MA0GCSqGSIb3DQEBCwUAA4IBAQCatCsTv7E5D3C8we3ffiiRAREHoZPr
+CFhKWbZzgDP2GQVlta048vgXNPEGiV+hCt3FMsz5NlJZ6DN75OJHk4hN8OC5/9Ke
+Ne4RYGBDdvlBHIqWfEA357Zf9tHeJG7VIXeujErKylpyTI3Ptn5NRgDatwetf7FB
+kCcy2obeGbkzG5iCtKQW3lAkZOliliXJVXieWJeMCGtbSX3l4gqOTgJ4ZBLJMS2A
+JFPAuMaPyLx2kmHCmhzt7SHd05o7r7q0d2ZFl/ECrmd8ZdfI2Fg4wu9ZBxv1IMfq
+Wjhj3vmM/LOf5ECJGf0hvObhCPszpPlp2KRY+a1f+tNKjeiYRVbDzzX4
+-----END CERTIFICATE-----
@@ -0,0 +1,30 @@
+-----BEGIN ENCRYPTED PRIVATE KEY-----
+MIIFNTBfBgkqhkiG9w0BBQ0wUjAxBgkqhkiG9w0BBQwwJAQQbu9pCdBFD4BDSuo1
+boPjnwICCAAwDAYIKoZIhvcNAgkFADAdBglghkgBZQMEAQIEEEz85m3KfzHpo1UA
+DojW/PIEggTQdO0kdvMZyDcpJBYImhaFNv/aptKjqHVjPHoVdCxq96F2IKCkdGhE
+IdLxjre1fb33wAlK2hgyg0GXexlfdp7044aZytzD+gwWgNilZn4dBL88En2DI9WR
+nbaz8AGlVy7lSudDnB93WRErXIcR6jKs+3XQ+GQkKchEfZloo+MBXM3QT1dhhNbH
+x+lxxzCSfKHS6OFvJQRfxvSOf4yeFgK2knzThb/OfXRJyKvQfGlz9PtMUkOatyJU
+sZNc0lwo4gLYW2OvccrNUNYuKqEuOtHIBQe0+iFHwvqxb4J0jROT6LOzhqZaEsjy
+BAKphT30WwCnwXC56nBU/oUfcr4eaj0XnvenThvp8Qn1cK7K3BaE5flPR9VKhdjD
+nbVdlSURLFCnAJsTAPp7cKmgwqH62k/MgqX1ZMLnMpLbpATVgrHakjN6tKONdWf
+sGJMmVlU7XsOh/tMjZSxs1SUdQU0h1rbtyPSlGiBygd8+c09xNzApmwHWjGQGEgf
+mkOa8BLz9bObTWPaSDLXK52FFjErwaxdXnOT9v4YOZVzEr3fRImOlj0Z4apsfmTv
+krcKZLOl1NMxAiLnY6Cm8lHiMnrwgHvQ4ZGKH4N7n/pTO8Ol47rrkIxXxDDTZRAP
+B27dfzmYHaQuDjEedm7HexuwaBDIbRyFP+k4VVXuWG0nyRW+t/hQESUIFBwjiVXR
+4MKO42+XuoAB740wDDIMFHlBJ91AZnKuAFcA1JWPx/eOGx7kFB0GYlfzDuCVBbXz
+Z/5iphHTQrq0c0HP/iQ+RiUE+tXHTR8vbt8NnzwK3CV0DKT1zDBXf5DGDTLpWb8D
+soBjDwGECNED3fdpgfwaQZfQQtFpNQh7U7prTykGXKcfLCH1iGbhHLUgZu/L7shk
+ZWjRuMOXbjSS67jlYJiCkzCFaJmicMi9LTOHaQaXCr40ddtY4EXcRWkk5p36YIQp
+4HMoKTxoVaHJhQmHL8LY4YGrkdyrx1rBkr1kgATFJGAEiB+/Joq8T1czt0JmsuAW
+kTGKHKt2Di2fAhDdoozTU/1YCsjNLzNvLZwUtv03ToD5i7qLH7OfYJ5UeAMKBCW2
+EdE7mJoPzRz+mLWBnvs+rlVqRbXbizHvRnPahWkTYvHe4jmYNUMLGg5ZI0iCxwrE
+9c4Kly7nFMrKhRndipcL80jDKdUjO2QqS1oglyIlcfSLgl7Vi0WavstpQbaDUUuI
+WZVmJMBhLWpNVEJa8WVO2g5mKNge/d8sh/pzP4pGRUzjABZVGFb+DvL5Vf1nnOoO
+CLPzl/orbgZU3zC0x4mfogZNSSmUQiL2TFBnd5OlSx8xAgtUrudDeR0hZ0D91W4R
+U5joiWUZvzFhr3LvO/oR2uewWpWKQo0/7YsGPI091KPRjcnqSPsOAFU0jOWkOHJp
+16MyxppSh51BJa7cAWfMQXAQhEuxDZXdZR5iftJpF7JqPp02ekQUsBcHHXmeuRU5
+Xzf30DcJAN8L8OucBT1OXH51cDpI+O+JCgfQUvwd25vswrWmLJVcDCvFn3jW6GHf
+1CQflR4ChNnzoESxJ2qMGSkSNp6RMjKnFwGrKkIb7NG3txYMNjp3vg26n9Byd7+V
+fG/KqpYcHs3QxMVGfCB05uqyUn95ZD3OlCF5LY1pluTGCkrpbgmnEjg=
+-----END ENCRYPTED PRIVATE KEY-----
@@ -0,0 +1,75 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 4096 (0x1000)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=Massachusetts, O=ICA, CN=ica.gnu
+        Validity
+            Not Before: Nov 27 20:51:19 2024 GMT
+            Not After : Nov 27 20:51:19 2025 GMT
+        Subject: C=US, ST=Massachusetts, O=ICA-Client, CN=client.ica.gnu
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:c6:7e:66:d3:87:a7:86:39:a4:62:81:c8:55:b0:
+                    7e:80:5a:a8:cc:c1:4e:81:c1:99:34:b3:26:6b:73:
+                    8b:88:b3:0e:5b:40:1d:12:3b:49:08:d0:2f:47:00:
+                    2d:5d:71:c4:34:af:d3:c4:cc:8d:25:d7:54:8d:47:
+                    99:20:ce:90:54:d7:e8:63:92:fe:01:01:32:f1:20:
+                    b5:00:13:c9:76:8f:6d:3f:98:d2:6c:f9:a9:02:f3:
+                    2a:b9:0d:d2:71:ee:fc:30:f7:7b:c8:2c:36:e5:96:
+                    9b:ca:3f:b2:3e:16:2a:9b:53:c1:05:3a:2e:19:54:
+                    21:31:c0:82:a8:95:07:fd:a7:6c:bb:97:83:4a:27:
+                    75:da:04:2c:89:2a:13:a6:a0:b4:be:bc:c3:40:24:
+                    88:59:29:d8:94:74:ee:de:c8:72:92:5d:76:b2:c7:
+                    8f:43:b4:37:2a:75:60:c1:d3:aa:75:b2:e7:f4:ab:
+                    42:19:8f:26:f4:ca:75:d4:fe:ab:00:6b:ff:4c:97:
+                    ea:4a:ca:74:5e:a5:bc:4a:d9:7e:55:ce:51:5e:c1:
+                    f2:8e:5f:6f:38:bf:ed:e1:6d:71:a5:98:5e:9e:93:
+                    22:70:14:ac:ed:90:49:be:db:e3:c6:5a:fe:7e:4b:
+                    69:d3:79:37:53:b0:2a:10:48:b7:b5:ea:02:4a:81:
+                    ff:6b
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                A0:8F:2B:91:B7:06:F8:CB:F0:2A:A3:A5:FC:77:A7:ED:46:63:FB:29
+            X509v3 Authority Key Identifier: 
+                14:FA:DA:77:F8:45:92:B7:7C:38:FC:74:CA:26:74:2B:B7:D4:36:75
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        9a:b4:2b:13:bf:b1:39:0f:70:bc:c1:ed:df:7e:28:91:01:11:
+        07:a1:93:eb:08:58:4a:59:b6:73:80:33:f6:19:05:65:b5:ad:
+        38:f2:f8:17:34:f1:06:89:5f:a1:0a:dd:c5:32:cc:f9:36:52:
+        59:e8:33:7b:e4:e2:47:93:88:4d:f0:e0:b9:ff:d2:9e:35:ee:
+        11:60:60:43:76:f9:41:1c:8a:96:7c:40:37:e7:b6:5f:f6:d1:
+        de:24:6e:d5:21:77:ae:8c:4a:ca:ca:5a:72:4c:8d:cf:b6:7e:
+        4d:46:00:da:b7:07:ad:7f:b1:41:90:27:32:da:86:de:19:b9:
+        33:1b:98:82:b4:a4:16:de:50:24:64:e9:62:96:25:c9:55:78:
+        9e:58:97:8c:08:6b:5b:49:7d:e5:e2:0a:8e:4e:02:78:64:12:
+        c9:31:2d:80:24:53:c0:b8:c6:8f:c8:bc:76:92:61:c2:9a:1c:
+        ed:ed:21:dd:d3:9a:3b:af:ba:b4:77:66:45:97:f1:02:ae:67:
+        7c:65:d7:c8:d8:58:38:c2:ef:59:07:1b:f5:20:c7:ea:5a:38:
+        63:de:f9:8c:fc:b3:9f:e4:40:89:19:fd:21:bc:e6:e1:08:fb:
+        33:a4:f9:69:d8:a4:58:f9:ad:5f:fa:d3:4a:8d:e8:98:45:56:
+        c3:cf:35:f8
+-----BEGIN CERTIFICATE-----
+MIIDVjCCAj6gAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwRTELMAkGA1UEBhMCVVMx
+FjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxDDAKBgNVBAoMA0lDQTEQMA4GA1UEAwwH
+aWNhLmdudTAeFw0yNDExMjcyMDUxMTlaFw0yNTExMjcyMDUxMTlaMFMxCzAJBgNV
+BAYTAlVTMRYwFAYDVQQIDA1NYXNzYWNodXNldHRzMRMwEQYDVQQKDApJQ0EtQ2xp
+ZW50MRcwFQYDVQQDDA5jbGllbnQuaWNhLmdudTCCASIwDQYJKoZIhvcNAQEBBQAD
+ggEPADCCAQoCggEBAMZ+ZtOHp4Y5pGKByFWwfoBaqMzBToHBmTSzJmtzi4izDltA
+HRI7SQjQL0cALV1xxDSv08TMjSXXVI1HmSDOkFTX6GOS/gEBMvEgtQATyXaPbT+Y
+0mz5qQLzKrkN0nHu/DD3e8gsNuWWm8o/sj4WKptTwQU6LhlUITHAgqiVB/2nbLuX
+g0onddoELIkqE6agtL68w0AkiFkp2JR07t7IcpJddrLHj0O0Nyp1YMHTqnWy5/Sr
+QhmPJvTKddT+qwBr/0yX6krKdF6lvErZflXOUV7B8o5fbzi/7eFtcaWYXp6TInAU
+rO2QSb7b48Za/n5LadN5N1OwKhBIt7XqAkqB/2sCAwEAAaNCMEAwHQYDVR0OBBYE
+FKCPK5G3BvjL8Cqjpfx3p+1GY/spMB8GA1UdIwQYMBaAFBT62nf4RZK3fDj8dMom
+dCu31DZ1MA0GCSqGSIb3DQEBCwUAA4IBAQCatCsTv7E5D3C8we3ffiiRAREHoZPr
+CFhKWbZzgDP2GQVlta048vgXNPEGiV+hCt3FMsz5NlJZ6DN75OJHk4hN8OC5/9Ke
+Ne4RYGBDdvlBHIqWfEA357Zf9tHeJG7VIXeujErKylpyTI3Ptn5NRgDatwetf7FB
+kCcy2obeGbkzG5iCtKQW3lAkZOliliXJVXieWJeMCGtbSX3l4gqOTgJ4ZBLJMS2A
+JFPAuMaPyLx2kmHCmhzt7SHd05o7r7q0d2ZFl/ECrmd8ZdfI2Fg4wu9ZBxv1IMfq
+Wjhj3vmM/LOf5ECJGf0hvObhCPszpPlp2KRY+a1f+tNKjeiYRVbDzzX4
+-----END CERTIFICATE-----
@@ -0,0 +1,17 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIICpDCCAYwCAQAwXzELMAkGA1UEBhMCVVMxFjAUBgNVBAgMDU1hc3NhY2h1c2V0
+dHMxDzANBgNVBAcMBkJvc3RvbjEPMA0GA1UECgwGQ2xpZW50MRYwFAYDVQQDDA1j
+bGllbnQuY2EuZ251MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvpbW
+hjGKQ8gXjLI0irfHeKLQSr0z+rcY7CIwYPx6AkzaFrFqqBJhZhvHBihMhU7d+p/G
+NJqvKUSUZYEvWujI2jIqwStUewUb4yllQR0YKS7VzF11KOF75F7WEtNhAYSpbBcB
+sxrhuOnw9bQKJ5wsvQGorb0esiGy9jPFdnpux4eD1xAJ2xt5zsuoWcsGWZ23CQJv
+oAEBWmJW/VtJeQ1axvf9sP6bPkRiqvOHdx5I7kTaDRUDhSEYopunHP4dBjJ007nh
+9b181P0GbCaHLGKRFCx5rmgfemIpILbqzWNLqyHOev+WZqH9cjQHbKN3CLaOtc+X
+S7894m7Kw9mbUl9nQwIDAQABoAAwDQYJKoZIhvcNAQELBQADggEBAEsVXFr54RMQ
+yrgO2Nac3jC/04qljxcSRY4XF4XL7oMEy0WfzHNX9t8qCSK4cKTzxvq2zhOxMT/E
+gBOgy6sBxtldrYJA1cVuSLf5RD5KdPoHM7dqSHWpW2Ii01RIglO1R7RvAAT/A9I4
+LXp4Kv5dGdzQNpMUmembT7s+k1at0+u5u8Vtyh8KhYIrPr5PxZcz222Ii0mQV2WY
+h6M+jdaGsQGZB7wFNQocl8LAmrKIJYE5/eJLFOb7ZxsVOhMOkaezlv2WI9rEOVMs
+La2dLJzWNx3nYXvsP98siAchgw6lffP+PuvHczW4WNKQ5X0lH5HbHcdy1bm/3xiZ
+bpBMZjUCEyw=
+-----END CERTIFICATE REQUEST-----
@@ -0,0 +1,30 @@
+-----BEGIN ENCRYPTED PRIVATE KEY-----
+MIIFNTBfBgkqhkiG9w0BBQ0wUjAxBgkqhkiG9w0BBQwwJAQQsqWoEOIi7jq+VEW6
+Fl2i8AICCAAwDAYIKoZIhvcNAgkFADAdBglghkgBZQMEAQIEELQO7YW/6Hi5yQFu
+/oyhhCEEggTQue0jpR9VOOuXtxtLTbDMMMiaqi/vbkyBAg7wtP5J0XgVg66H93TA
+qMIfBmRESuAdE9taBuq68sCaTK2vjM0rSPI/SeY+nYPrbppF7mG/FrpCxO/l/57T
+P1I4rbuPkMnhd4d0tg2CAyQ7s3tSXtyCrUtLs8RO8oAraVT0wzzkjtjn7EvVJVuC
+HSb4nyFZEZmup5JO2tLB/izcP1voOA1O10f9tgAQQgCPiW1WDl5uxkwe0Be1GgWz
+DJrBkOE/XK85XcCkFZX5yvJVKNiFYyQPlLVTfb4mrx3SMUpKsuLdQhohnNvflxWo
+ltlgJhJUU9lN+xN/5D9h+Tct8nF5E0O2rc1igFNCg2fi8lQzyue4TnKp6ukbVdPX
+/7amuwynHeGdvkA4qwU2c+VGSy42tPzO1sKB+M5i+djnteTjp3mq7vvjFWzVXZJ0
+xBjaCf11dQVOr5/bYfpBsRW2tv7eIg2//IFQHy5nHr3kHRPMl4LLf+8bz3GF5ouM
+g17psyX85ruIMPOBjFyDGKYYjE3Ly2JgAij7IGE177DqLtfgsiEvuhXZwGR4NSG0
+DDPdk95/8H8TJkEFsKuI1CRsjBpuMEBqpvqALUXYrhjsaTo0GOtOW8GXAt81ISTI
+E1QWgpwK0mAUkkShdCSfCy1A/ZcBxbx2iKQA1jFofrqnyqlaWv9NVVqj1IOAmr4i
+zREFqLbAMLUW74s8RCNsmAfhmPYlcROImzMD2WN3ezWxwbNfrzeuy5pXz6naowpi
+I3jTaSWLh/KnolTiFOnAOBolYc88BuOXtqGxrJw0ow638jR9nIDeep2eOqzxvKDn
+PhG9QhM1OC7FrfQ7ic0tmqW951BkbcafYqPObqMXUWIFDmW+OnlIOnNcRIuhY4pe
+F3yym2uGgmto/MHiQmknyJDm+qqV1JpPaxFjp7KISnjCxaU3WS7CeDe9NPOc9CSx
+/U+zSUnqOLZ7ze6QkUDZ4NPqJVJ6OmAWD0QE/4DkDDgiJybSk+WHTu4TneF5xZBr
+Y2WctZNMfGML5a1GoPWxvP+rYV6SY4l9AP+41twTyawvyT/ynWLOIBQPs9Un3xXx
+A+wTvl6jQXF7VN1HrSZKHRqTFDy82xhrUHquL8rwV10yCMKLwNf4xMQk4ZhxXL3s
+n39baqkakv62/XE+dgAx1yOVgPoF4X4nMFfLEeEqml8M6j4vVGXrmWySZokpgNyM
+J7j3HWf0SXIHGvRSnVYkOA/dG5dKDubYl5sJ1raKdLfdpmo9P9rrAn/Pn8UXo3Ve
+lzDN1ZXL62Nx4jwVEv55Uq+sm4PYwnV88sfhC8N2B35yxiogIulKc5GhP4VqEkbQ
+mh3zZGsXN/dgpLgl1yLqwyF8OshOK1fE2WCY0AgghK7RKe5lxbPyW1Fh3LYYKtIF
+e532j600NJ1iutMkuFGWMCQlZ7O+GNGlKyHl8TdgghSB+bjSUeuaGJfGxP6KMqZ5
+lKSPhHlqtdCcKpag92PhqWtqMv+taduhx6rW1Zwjd410DDc1Zm1oCsdoKenPYpCn
+xH+glIypum+0lg9qxhDjrrXAlIjWu1+ZV/RB8eT8O9be1UMGjzQ37yT2ztAeKYpy
+Av3WW7qeA8PJQu6Vp+34pQgCjmxSbwhIMQqP92lGmBSpIPsp/wLTZKk=
+-----END ENCRYPTED PRIVATE KEY-----
@@ -0,0 +1,76 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 4096 (0x1000)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=Massachusetts, L=Boston, O=Root, CN=ca.gnu
+        Validity
+            Not Before: Nov 29 12:47:17 2024 GMT
+            Not After : Nov 29 12:47:17 2025 GMT
+        Subject: C=US, ST=Massachusetts, O=Client, CN=client.ca.gnu
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:be:96:d6:86:31:8a:43:c8:17:8c:b2:34:8a:b7:
+                    c7:78:a2:d0:4a:bd:33:fa:b7:18:ec:22:30:60:fc:
+                    7a:02:4c:da:16:b1:6a:a8:12:61:66:1b:c7:06:28:
+                    4c:85:4e:dd:fa:9f:c6:34:9a:af:29:44:94:65:81:
+                    2f:5a:e8:c8:da:32:2a:c1:2b:54:7b:05:1b:e3:29:
+                    65:41:1d:18:29:2e:d5:cc:5d:75:28:e1:7b:e4:5e:
+                    d6:12:d3:61:01:84:a9:6c:17:01:b3:1a:e1:b8:e9:
+                    f0:f5:b4:0a:27:9c:2c:bd:01:a8:ad:bd:1e:b2:21:
+                    b2:f6:33:c5:76:7a:6e:c7:87:83:d7:10:09:db:1b:
+                    79:ce:cb:a8:59:cb:06:59:9d:b7:09:02:6f:a0:01:
+                    01:5a:62:56:fd:5b:49:79:0d:5a:c6:f7:fd:b0:fe:
+                    9b:3e:44:62:aa:f3:87:77:1e:48:ee:44:da:0d:15:
+                    03:85:21:18:a2:9b:a7:1c:fe:1d:06:32:74:d3:b9:
+                    e1:f5:bd:7c:d4:fd:06:6c:26:87:2c:62:91:14:2c:
+                    79:ae:68:1f:7a:62:29:20:b6:ea:cd:63:4b:ab:21:
+                    ce:7a:ff:96:66:a1:fd:72:34:07:6c:a3:77:08:b6:
+                    8e:b5:cf:97:4b:bf:3d:e2:6e:ca:c3:d9:9b:52:5f:
+                    67:43
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                7D:AD:67:F3:E1:9C:7E:76:DE:AA:2B:C4:E2:8C:4C:F9:92:C8:62:04
+            X509v3 Authority Key Identifier: 
+                B2:F7:59:A1:7D:D1:C5:D3:7A:C2:B3:8D:AF:7D:52:38:0F:50:6D:CE
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        5a:d8:e8:7a:a1:52:cd:0f:e6:7d:6c:9b:6e:d4:70:2f:bd:1c:
+        91:43:52:40:36:99:04:de:c8:27:21:97:29:64:bf:ad:51:d2:
+        6e:76:71:89:14:7d:f7:4e:81:49:14:88:e7:c8:67:ad:3a:f6:
+        fd:e7:1e:6a:dd:27:cf:32:40:87:27:54:a0:e2:2c:dd:ce:19:
+        f3:8a:b8:ef:1c:60:3e:e0:fa:07:18:9e:f7:9f:f9:f1:c1:5e:
+        4e:e8:a2:d3:88:bf:b6:ef:2d:80:42:d9:69:90:a9:bd:5a:7e:
+        63:54:b0:f1:46:eb:10:72:5c:dc:17:e7:f2:85:ff:eb:47:09:
+        69:03:64:4e:72:bf:1d:7a:45:de:8b:84:ce:aa:c5:14:78:d3:
+        f8:0b:bc:2e:a1:c6:3d:71:eb:68:38:72:b1:05:dc:a5:7c:72:
+        12:61:f6:a9:3d:c0:1d:3d:df:01:f1:e9:d7:75:a9:6a:37:6d:
+        a5:48:ed:eb:53:e1:bd:d0:ec:eb:92:62:b9:90:bb:cb:05:da:
+        70:8e:33:f5:fc:bd:a3:50:a9:8e:47:82:01:66:11:51:5c:74:
+        cc:4d:a2:c4:de:56:75:8d:01:c1:e8:47:13:c1:d7:8c:ec:67:
+        84:6a:aa:a8:9a:d9:0c:9b:11:df:ab:51:a7:27:6b:b7:de:47:
+        18:99:d5:2b
+-----BEGIN CERTIFICATE-----
+MIIDYjCCAkqgAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwVjELMAkGA1UEBhMCVVMx
+FjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxDzANBgNVBAcMBkJvc3RvbjENMAsGA1UE
+CgwEUm9vdDEPMA0GA1UEAwwGY2EuZ251MB4XDTI0MTEyOTEyNDcxN1oXDTI1MTEy
+OTEyNDcxN1owTjELMAkGA1UEBhMCVVMxFjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMx
+DzANBgNVBAoMBkNsaWVudDEWMBQGA1UEAwwNY2xpZW50LmNhLmdudTCCASIwDQYJ
+KoZIhvcNAQEBBQADggEPADCCAQoCggEBAL6W1oYxikPIF4yyNIq3x3ii0Eq9M/q3
+GOwiMGD8egJM2haxaqgSYWYbxwYoTIVO3fqfxjSarylElGWBL1royNoyKsErVHsF
+G+MpZUEdGCku1cxddSjhe+Re1hLTYQGEqWwXAbMa4bjp8PW0CiecLL0BqK29HrIh
+svYzxXZ6bseHg9cQCdsbec7LqFnLBlmdtwkCb6ABAVpiVv1bSXkNWsb3/bD+mz5E
+Yqrzh3ceSO5E2g0VA4UhGKKbpxz+HQYydNO54fW9fNT9BmwmhyxikRQsea5oH3pi
+KSC26s1jS6shznr/lmah/XI0B2yjdwi2jrXPl0u/PeJuysPZm1JfZ0MCAwEAAaNC
+MEAwHQYDVR0OBBYEFH2tZ/PhnH523qorxOKMTPmSyGIEMB8GA1UdIwQYMBaAFLL3
+WaF90cXTesKzja99UjgPUG3OMA0GCSqGSIb3DQEBCwUAA4IBAQBa2Oh6oVLND+Z9
+bJtu1HAvvRyRQ1JANpkE3sgnIZcpZL+tUdJudnGJFH33ToFJFIjnyGetOvb95x5q
+3SfPMkCHJ1Sg4izdzhnzirjvHGA+4PoHGJ73n/nxwV5O6KLTiL+27y2AQtlpkKm9
+Wn5jVLDxRusQclzcF+fyhf/rRwlpA2ROcr8dekXei4TOqsUUeNP4C7wuocY9ceto
+OHKxBdylfHISYfapPcAdPd8B8enXdalqN22lSO3rU+G90OzrkmK5kLvLBdpwjjP1
+/L2jUKmOR4IBZhFRXHTMTaLE3lZ1jQHB6EcTwdeM7GeEaqqomtkMmxHfq1GnJ2u3
+3kcYmdUr
+-----END CERTIFICATE-----
@@ -0,0 +1,177 @@
+-----BEGIN CERTIFICATE-----
+MIIDjTCCAnWgAwIBAgIUKkxAx2lVnvYcaNqBpJmTgXh1/VgwDQYJKoZIhvcNAQEL
+BQAwVjELMAkGA1UEBhMCVVMxFjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxDzANBgNV
+BAcMBkJvc3RvbjENMAsGA1UECgwEUm9vdDEPMA0GA1UEAwwGY2EuZ251MB4XDTI0
+MTEyOTEyNDUyOFoXDTM0MTEyNzEyNDUyOFowVjELMAkGA1UEBhMCVVMxFjAUBgNV
+BAgMDU1hc3NhY2h1c2V0dHMxDzANBgNVBAcMBkJvc3RvbjENMAsGA1UECgwEUm9v
+dDEPMA0GA1UEAwwGY2EuZ251MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
+AQEA23YSrcGIBgZf9bbzTnmYFy+4tM82kUhsVFKxWCNEMdKmhaeVvXogyd6Evq4P
+NvBGdUABDtHp4pSEijrxWbn8sxddTznoT/8IOuHI0/PtwXYP/sHQ/HzekEUVKN2Z
+NMbMUzQfaJyiIV5TrZlaBwHjQ+sRs8E56C3cQjkwuyjll2zDsEfmEnPimZRAL3kb
+wW8VFfBcR2Id+a9xKjwlnB4eXQFAgYINoRgCtUOUxSeFgNnwkOUSqDknO6Xi47YZ
+EdLlHyUnv5eX547xUkrYhfQuQwaqpGrjHf3GFoysN8P9kd2f1qsJKtQcUbF9DDeZ
+6ya47X/LBO8QflMsVjb1V3oz9QIDAQABo1MwUTAdBgNVHQ4EFgQUsvdZoX3RxdN6
+wrONr31SOA9Qbc4wHwYDVR0jBBgwFoAUsvdZoX3RxdN6wrONr31SOA9Qbc4wDwYD
+VR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAS3PyV7crGk9brqU90aML
+2TWkjgzFb3/nASnpvVYiqyiV4neGiEjtDy7eVlqP6GlD2pYcVodY+ly9wNlo85/h
+YfgCFFl37tMG7PpRac2qBqaSn1DpwsCb08LjRrOvoaRffWUikSoZmsYDlaCgl9nT
+pGtIrz0BSoyu5mHalIZTVQOrbkNBNK6ZgnYy2iWuiLa5Z1xzKpsRBRaKJc1pcQE/
+QVbPdCiyGQMPEVn/KHxitlycFoee/fA+izXVdstVwfig2DoMvrlGZvEkN1ER3Yz4
+QPJ6HzOsBQL1F+YhnMCQfc2rpcwxAWf8JMy6jsCq42KGq53tkWqHyQ6Zu2SiLRYk
+CA==
+-----END CERTIFICATE-----
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 4097 (0x1001)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=Massachusetts, L=Boston, O=Root, CN=ca.gnu
+        Validity
+            Not Before: Nov 27 20:51:19 2024 GMT
+            Not After : Nov 27 20:51:19 2025 GMT
+        Subject: C=US, ST=Massachusetts, O=ICA, CN=ica.gnu
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:d5:1f:d7:1a:46:9a:70:ed:6a:88:af:be:80:04:
+                    42:32:26:cf:c4:d8:11:05:21:3f:b3:ef:29:d9:a3:
+                    39:37:b7:89:d5:64:9a:cc:c1:f4:9c:0a:8b:41:cb:
+                    09:7e:ab:16:62:24:6b:69:ea:ba:78:a2:97:a3:e4:
+                    0a:06:c2:2e:14:31:20:15:61:74:7d:70:5d:e8:9f:
+                    33:63:4b:08:81:8b:8f:5a:19:af:92:99:c6:c5:a2:
+                    a4:16:f9:1c:fd:bb:03:f4:2a:1e:98:f2:b2:c1:20:
+                    69:0e:96:ea:3e:dc:b5:91:40:1f:aa:51:a6:a4:09:
+                    06:2f:d9:be:b0:e3:4e:d4:27:2c:b3:74:b2:90:08:
+                    09:d6:cb:7a:4f:f0:dd:43:99:ef:22:24:94:04:c0:
+                    70:48:ba:d8:c4:4f:64:89:bf:7a:a3:74:27:d6:1f:
+                    a7:ab:04:20:e6:99:c8:8f:2f:14:99:02:d1:eb:ce:
+                    2b:0f:ba:5e:b4:80:22:7b:ef:3c:0a:90:a4:97:7b:
+                    4c:19:5f:d4:5e:d7:21:32:3f:3e:05:8a:67:01:d9:
+                    39:f5:7e:39:a7:cf:64:c1:4a:d7:b5:c2:f4:a2:c0:
+                    a4:ef:9f:25:96:96:95:bb:bc:44:27:7f:eb:dd:43:
+                    b4:28:4a:70:f6:21:83:0f:59:cb:98:69:57:8f:ca:
+                    a8:93
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                14:FA:DA:77:F8:45:92:B7:7C:38:FC:74:CA:26:74:2B:B7:D4:36:75
+            X509v3 Authority Key Identifier: 
+                1A:03:C0:AD:5C:3D:FE:76:38:FC:20:8C:B2:73:5C:A3:44:1D:0F:EC
+            X509v3 Basic Constraints: critical
+                CA:TRUE, pathlen:0
+            X509v3 Key Usage: critical
+                Digital Signature, Certificate Sign, CRL Sign
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        00:f7:92:a1:7e:cb:38:f6:62:28:fc:86:ea:7d:64:2a:0e:3d:
+        95:e9:86:d1:00:29:42:5f:97:27:60:31:33:6b:b1:40:9e:d0:
+        20:fd:c9:a1:19:21:41:91:6d:d0:97:af:0a:9f:e9:55:b8:fe:
+        66:20:c6:42:31:9b:8e:08:8e:ea:cb:86:17:e9:12:49:43:de:
+        03:74:a2:19:77:7e:4f:ef:f6:3c:7e:d3:ed:47:fd:24:9b:d5:
+        cc:29:4a:cf:30:d9:40:bc:73:d9:d6:5f:f1:75:48:f8:00:06:
+        2c:a3:84:f0:9d:0c:51:14:40:d0:9d:4b:7c:79:20:93:b9:2f:
+        29:f6:39:ae:36:4f:08:45:65:43:f7:4e:5d:88:84:da:fd:46:
+        a3:14:2e:cb:b9:fa:80:b4:a6:bf:db:72:91:0d:05:a5:82:f6:
+        f9:6c:81:8b:2b:d9:13:5c:cd:d5:da:4b:31:5e:f0:4d:9a:a7:
+        2e:cb:73:6e:7e:07:7c:4a:cc:9a:12:f0:cb:86:34:50:73:c6:
+        2c:40:23:73:ed:7f:f5:c9:61:8e:85:8b:37:fc:33:20:af:fd:
+        6d:4a:cc:3f:60:22:7b:ef:c4:9c:51:d6:f3:de:7c:06:40:a8:
+        4f:ea:38:07:b5:df:4f:b0:56:22:af:50:3d:6b:eb:46:42:7b:
+        a1:3b:1b:df
+-----BEGIN CERTIFICATE-----
+MIIDfTCCAmWgAwIBAgICEAEwDQYJKoZIhvcNAQELBQAwVjELMAkGA1UEBhMCVVMx
+FjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxDzANBgNVBAcMBkJvc3RvbjENMAsGA1UE
+CgwEUm9vdDEPMA0GA1UEAwwGY2EuZ251MB4XDTI0MTEyNzIwNTExOVoXDTI1MTEy
+NzIwNTExOVowRTELMAkGA1UEBhMCVVMxFjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMx
+DDAKBgNVBAoMA0lDQTEQMA4GA1UEAwwHaWNhLmdudTCCASIwDQYJKoZIhvcNAQEB
+BQADggEPADCCAQoCggEBANUf1xpGmnDtaoivvoAEQjImz8TYEQUhP7PvKdmjOTe3
+idVkmszB9JwKi0HLCX6rFmIka2nquniil6PkCgbCLhQxIBVhdH1wXeifM2NLCIGL
+j1oZr5KZxsWipBb5HP27A/QqHpjyssEgaQ6W6j7ctZFAH6pRpqQJBi/ZvrDjTtQn
+LLN0spAICdbLek/w3UOZ7yIklATAcEi62MRPZIm/eqN0J9Yfp6sEIOaZyI8vFJkC
+0evOKw+6XrSAInvvPAqQpJd7TBlf1F7XITI/PgWKZwHZOfV+OafPZMFK17XC9KLA
+pO+fJZaWlbu8RCd/691DtChKcPYhgw9Zy5hpV4/KqJMCAwEAAaNmMGQwHQYDVR0O
+BBYEFBT62nf4RZK3fDj8dMomdCu31DZ1MB8GA1UdIwQYMBaAFBoDwK1cPf52OPwg
+jLJzXKNEHQ/sMBIGA1UdEwEB/wQIMAYBAf8CAQAwDgYDVR0PAQH/BAQDAgGGMA0G
+CSqGSIb3DQEBCwUAA4IBAQAA95Khfss49mIo/IbqfWQqDj2V6YbRAClCX5cnYDEz
+a7FAntAg/cmhGSFBkW3Ql68Kn+lVuP5mIMZCMZuOCI7qy4YX6RJJQ94DdKIZd35P
+7/Y8ftPtR/0km9XMKUrPMNlAvHPZ1l/xdUj4AAYso4TwnQxRFEDQnUt8eSCTuS8p
+9jmuNk8IRWVD905diITa/UajFC7LufqAtKa/23KRDQWlgvb5bIGLK9kTXM3V2ksx
+XvBNmqcuy3Nufgd8SsyaEvDLhjRQc8YsQCNz7X/1yWGOhYs3/DMgr/1tSsw/YCJ7
+78ScUdbz3nwGQKhP6jgHtd9PsFYir1A9a+tGQnuhOxvf
+-----END CERTIFICATE-----
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 4097 (0x1001)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=Massachusetts, O=ICA, CN=ica.gnu
+        Validity
+            Not Before: Nov 27 20:51:19 2024 GMT
+            Not After : Nov 27 20:51:19 2025 GMT
+        Subject: C=US, ST=Massachusetts, O=ICA-Client, CN=other.ica.gnu
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:9d:83:3b:b3:8c:a9:c6:2c:61:c5:c6:ba:78:c7:
+                    0a:bd:31:e6:33:cb:27:39:18:0b:84:ca:ac:95:f2:
+                    d1:ac:7a:c2:6d:7a:b0:c0:e0:7b:07:53:33:4a:73:
+                    95:e4:ce:7b:dc:7c:c0:cf:39:67:69:32:2c:29:07:
+                    ef:cc:d2:42:c2:3d:35:bc:6c:86:1a:fa:22:65:37:
+                    84:92:8d:f3:a8:05:61:8f:06:13:bc:29:78:48:5e:
+                    10:59:9f:0c:c6:50:d4:13:26:6d:8e:74:cc:92:b2:
+                    f2:07:0e:3c:6d:29:93:44:6a:4e:94:8f:20:17:e0:
+                    84:58:a5:68:7f:67:bf:cc:61:62:7c:9c:7f:11:48:
+                    86:5d:21:35:04:c8:9e:43:ea:10:13:70:ec:94:6e:
+                    9b:fa:5c:6a:e9:28:de:cd:1f:e8:50:db:0e:8b:bf:
+                    06:8f:4b:41:42:25:10:05:3c:c0:90:4d:e9:8d:3b:
+                    cc:ba:66:2f:d7:d0:51:06:7d:d3:ec:2d:c1:af:08:
+                    44:40:a8:ad:00:83:99:71:aa:13:d4:7c:ad:eb:8f:
+                    97:56:f4:42:25:f8:04:49:b7:04:d4:42:cb:c5:84:
+                    aa:c1:b9:6e:eb:b8:e9:40:91:ef:12:2f:35:42:4b:
+                    24:a2:e2:84:b4:36:0b:a3:4c:a2:50:f1:54:af:3d:
+                    20:2d
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                FA:DA:58:04:3E:83:3F:E7:6D:70:67:98:F4:91:3B:C2:93:64:CE:B9
+            X509v3 Authority Key Identifier: 
+                14:FA:DA:77:F8:45:92:B7:7C:38:FC:74:CA:26:74:2B:B7:D4:36:75
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        65:ea:4d:a3:36:29:53:f4:fc:06:3c:24:04:f6:82:c3:ff:d5:
+        b7:b4:9a:ea:aa:d5:40:6d:6d:11:a2:05:ca:68:1d:91:9f:54:
+        63:8a:b6:9f:1b:a2:0a:38:4d:f7:d9:24:68:bc:0b:4d:82:5d:
+        e1:6b:28:2f:27:ae:44:35:83:68:00:0b:b2:37:6c:4c:59:0e:
+        c3:2d:71:25:46:98:47:36:a8:c5:f3:36:2a:65:0e:7f:10:71:
+        3b:82:35:2e:5b:59:d0:3f:c0:ef:b5:f3:c1:33:76:0d:e3:9a:
+        00:2a:24:f0:f9:ba:57:01:d4:1d:c4:60:48:81:42:5f:81:02:
+        59:10:4f:f7:56:fd:5b:b9:eb:95:e8:9d:22:88:5c:37:e2:56:
+        2b:e6:73:42:c5:05:4c:3f:3e:fa:05:b9:b4:e5:e8:21:1b:88:
+        e1:20:0e:02:f1:70:e3:f6:23:f6:5c:12:92:cd:16:da:04:b2:
+        b6:d9:b4:34:db:46:0a:ac:4d:b1:01:ee:d3:14:ef:92:84:9d:
+        3c:f3:f7:75:6a:da:ae:7d:a9:c1:10:36:6f:84:ea:c1:07:89:
+        c1:d0:78:43:34:00:22:16:5e:df:82:37:64:c9:e9:8f:5b:d3:
+        9b:bb:f2:ea:ea:59:24:00:77:27:27:20:41:38:f9:7b:d6:87:
+        6a:80:55:6c
+-----BEGIN CERTIFICATE-----
+MIIDVTCCAj2gAwIBAgICEAEwDQYJKoZIhvcNAQELBQAwRTELMAkGA1UEBhMCVVMx
+FjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxDDAKBgNVBAoMA0lDQTEQMA4GA1UEAwwH
+aWNhLmdudTAeFw0yNDExMjcyMDUxMTlaFw0yNTExMjcyMDUxMTlaMFIxCzAJBgNV
+BAYTAlVTMRYwFAYDVQQIDA1NYXNzYWNodXNldHRzMRMwEQYDVQQKDApJQ0EtQ2xp
+ZW50MRYwFAYDVQQDDA1vdGhlci5pY2EuZ251MIIBIjANBgkqhkiG9w0BAQEFAAOC
+AQ8AMIIBCgKCAQEAnYM7s4ypxixhxca6eMcKvTHmM8snORgLhMqslfLRrHrCbXqw
+wOB7B1MzSnOV5M573HzAzzlnaTIsKQfvzNJCwj01vGyGGvoiZTeEko3zqAVhjwYT
+vCl4SF4QWZ8MxlDUEyZtjnTMkrLyBw48bSmTRGpOlI8gF+CEWKVof2e/zGFifJx/
+EUiGXSE1BMieQ+oQE3DslG6b+lxq6SjezR/oUNsOi78Gj0tBQiUQBTzAkE3pjTvM
+umYv19BRBn3T7C3BrwhEQKitAIOZcaoT1Hyt64+XVvRCJfgESbcE1ELLxYSqwblu
+67jpQJHvEi81QkskouKEtDYLo0yiUPFUrz0gLQIDAQABo0IwQDAdBgNVHQ4EFgQU
+tpYBD6DP+dtcGeY9JE7wpNkzrkwHwYDVR0jBBgwFoAUFPrad/hFkrd8OPx0yiZ0
+K7fUNnUwDQYJKoZIhvcNAQELBQADggEBAGXqTaM2KVP0/AY8JAT2gsP/1be0muqq
+1UBtbRGiBcpoHZGfVGOKtp8bogo4TffZJGi8C02CXeFrKC8nrkQ1g2gAC7I3bExZ
+DsMtcSVGmEc2qMXzNiplDn8QcTuCNS5bWdA/wO+188Ezdg3jmgAqJPD5ulcB1B3E
+YEiBQl+BAlkQT/dW/Vu565XonSKIXDfiVivmc0LFBUw/PvoFubTl6CEbiOEgDgLx
+cOP2I/ZcEpLNFtoEsrbZtDTbRgqsTbEB7tMU75KEnTzz93Vq2q59qcEQNm+E6sEH
+icHQeEM0ACIWXt+CN2TJ6Y9b05u78urqWSQAdycnIEE4+XvWh2qAVWw=
+-----END CERTIFICATE-----
@@ -0,0 +1,30 @@
+-----BEGIN ENCRYPTED PRIVATE KEY-----
+MIIFNTBfBgkqhkiG9w0BBQ0wUjAxBgkqhkiG9w0BBQwwJAQQkyJb2L+l2SHwm4ED
+6dl5KwICCAAwDAYIKoZIhvcNAgkFADAdBglghkgBZQMEAQIEEDYMO1EA4Ga2ohoO
+04BLnI4EggTQCHrtD/9rHU5GPZAZArzSAjSlkPauOSVDBZjRFbZwyiiEVGArciTv
+JHiY8z53hikrkggTuepSf/SwG4g6R/u5+hdmy9caRE5LhF+luVYY/CI4X8uli7eR
+8yTpPTZbG7oOfuv8eh1YJeAi0KRtPWgFqM/d2yi5iwXIfNIGM8rvdSFTwGZUauz9
+Hnjo0oxpN4GfPHn4aeB35Jpf295QBmWAam7O81xcINosHn+ena7UiDJRa8ayoepx
+skdPyYJq54VwDkyJ4letgUFYj4DEfoaGAnehO6S4eD/lDDxuQA108V0vUK/lrAJP
+jOWPCfdzua2pjtF7EOV8zdj+akqqhHhPdA3Tmc5UW5+yU/i5dJFyk7TqysLL5NGR
+pCCI8ZDCnERtJ9AoHprpkYkzRAnXu5KxKU7TNeg2tbEwxGC4XTg077a7tfa4oQOc
+sUaY4+y7Vm3J81N1vUqvLoEbpQUOTBt15j0yLfVj8X6SI5QIOUWFBR80MGtvX1T+
+mAsMDVaUTSg5snWuQEqgiz4Auvu4S0EPXQksGQSX1ALsMuoYmn0CTDPuHTBA4OMS
+XVYD26sDxQfY5P7xrM/0iZN4Or0+rFHYCaP49lDbblo6+fGx7vqR7Fok6HxUnYPw
+qDlkRpM45JfAYgnOLAePugToVRWBR9qsfmDHjkUeA5VIKOySMr5SAF/L68yjzmj4
+GzEJ7ZaXzQ5PL3T3/gFGxQUI2EW6Pq0CFDC6QaDG0Fhl7T3hoHLxTw+4ii5SSB71
+16J3MYThILaFRgKweKfb52VmNj9DsTES0JIxC+K0AkauSpyNjMza9WOFwuewHN+w
+p+CimbuRvPKvTuPUhS7LxZUqC5CQyeK/fNhp79W/Cl4uEDzwWZRyNUzSs7BbZDbC
+f9auQTJ0rzwDZZeR9eajVhxwJFcmEchrb8ZKBf0+ELphSGtyLBaDcbUHBI51eIub
+nJHcG92T2OPmYnZpD6REfhE4tjmKIAqtRd7RGq0qEhwLjihR6lU0upt3r6K/q0mb
+nPqxBIuo7rVY1Vl4MshjoQd25ZSGYCY4aYT4cnmoY1maNJ0RujNbsz1qsmG8URuO
+NL3UlmqnTLv62b0mIbz5vjMIr7i9YPkg/mCqr/nZYJGEy0RJBa48ae4f+BLh2CqQ
+05BIByVrknhgCP5NXwg4vgeU0nuXbr5Y8w9qqYv4MRwSquylsP6AxaTPzsx47xwr
+kPzrIxEHMllG2uS7jilh5rQvTorBPeop7y5IKbQQnjI99wcDubCWHHNbfCsBATz6
+gTxpOmyX+NSdhx5u12rAp+yQpDATBhHXwYm2/JqlyZ86JZmK7HR0qggK+01OpcG2
+0rPqawP6QbVo+wJ0TJoghOq+9mJtS1pt1ldZQijMCPoe+Latw29PyGjPVGgWP9dM
+QiA0Sm3Z+WXlz6vM0ZPsM+KtjqAZYQJzjQH7c2k9G6NKEpbgseUlwZKgtRPc4/ba
+nagBvARgZ771olhTkN2ysWSCjTWijLLQPopM2T8bbTzo4RsVmmsjPAYpDRBqY+5U
+aJlBboG10/Bkzal7XZIX6dkZ8a7oKW0h6bmO5Byr+uGVVQeuNnrJxRHJWUA6H8S9
+mzC+T2Irg9TvuQZX9PvrTLgyNpGuCCcDlJessUJ5oEaEiGCGBuoRHYA=
+-----END ENCRYPTED PRIVATE KEY-----
@@ -0,0 +1,75 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 4097 (0x1001)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=Massachusetts, O=ICA, CN=ica.gnu
+        Validity
+            Not Before: Nov 27 20:51:19 2024 GMT
+            Not After : Nov 27 20:51:19 2025 GMT
+        Subject: C=US, ST=Massachusetts, O=ICA-Client, CN=other.ica.gnu
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:9d:83:3b:b3:8c:a9:c6:2c:61:c5:c6:ba:78:c7:
+                    0a:bd:31:e6:33:cb:27:39:18:0b:84:ca:ac:95:f2:
+                    d1:ac:7a:c2:6d:7a:b0:c0:e0:7b:07:53:33:4a:73:
+                    95:e4:ce:7b:dc:7c:c0:cf:39:67:69:32:2c:29:07:
+                    ef:cc:d2:42:c2:3d:35:bc:6c:86:1a:fa:22:65:37:
+                    84:92:8d:f3:a8:05:61:8f:06:13:bc:29:78:48:5e:
+                    10:59:9f:0c:c6:50:d4:13:26:6d:8e:74:cc:92:b2:
+                    f2:07:0e:3c:6d:29:93:44:6a:4e:94:8f:20:17:e0:
+                    84:58:a5:68:7f:67:bf:cc:61:62:7c:9c:7f:11:48:
+                    86:5d:21:35:04:c8:9e:43:ea:10:13:70:ec:94:6e:
+                    9b:fa:5c:6a:e9:28:de:cd:1f:e8:50:db:0e:8b:bf:
+                    06:8f:4b:41:42:25:10:05:3c:c0:90:4d:e9:8d:3b:
+                    cc:ba:66:2f:d7:d0:51:06:7d:d3:ec:2d:c1:af:08:
+                    44:40:a8:ad:00:83:99:71:aa:13:d4:7c:ad:eb:8f:
+                    97:56:f4:42:25:f8:04:49:b7:04:d4:42:cb:c5:84:
+                    aa:c1:b9:6e:eb:b8:e9:40:91:ef:12:2f:35:42:4b:
+                    24:a2:e2:84:b4:36:0b:a3:4c:a2:50:f1:54:af:3d:
+                    20:2d
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                FA:DA:58:04:3E:83:3F:E7:6D:70:67:98:F4:91:3B:C2:93:64:CE:B9
+            X509v3 Authority Key Identifier: 
+                14:FA:DA:77:F8:45:92:B7:7C:38:FC:74:CA:26:74:2B:B7:D4:36:75
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        65:ea:4d:a3:36:29:53:f4:fc:06:3c:24:04:f6:82:c3:ff:d5:
+        b7:b4:9a:ea:aa:d5:40:6d:6d:11:a2:05:ca:68:1d:91:9f:54:
+        63:8a:b6:9f:1b:a2:0a:38:4d:f7:d9:24:68:bc:0b:4d:82:5d:
+        e1:6b:28:2f:27:ae:44:35:83:68:00:0b:b2:37:6c:4c:59:0e:
+        c3:2d:71:25:46:98:47:36:a8:c5:f3:36:2a:65:0e:7f:10:71:
+        3b:82:35:2e:5b:59:d0:3f:c0:ef:b5:f3:c1:33:76:0d:e3:9a:
+        00:2a:24:f0:f9:ba:57:01:d4:1d:c4:60:48:81:42:5f:81:02:
+        59:10:4f:f7:56:fd:5b:b9:eb:95:e8:9d:22:88:5c:37:e2:56:
+        2b:e6:73:42:c5:05:4c:3f:3e:fa:05:b9:b4:e5:e8:21:1b:88:
+        e1:20:0e:02:f1:70:e3:f6:23:f6:5c:12:92:cd:16:da:04:b2:
+        b6:d9:b4:34:db:46:0a:ac:4d:b1:01:ee:d3:14:ef:92:84:9d:
+        3c:f3:f7:75:6a:da:ae:7d:a9:c1:10:36:6f:84:ea:c1:07:89:
+        c1:d0:78:43:34:00:22:16:5e:df:82:37:64:c9:e9:8f:5b:d3:
+        9b:bb:f2:ea:ea:59:24:00:77:27:27:20:41:38:f9:7b:d6:87:
+        6a:80:55:6c
+-----BEGIN CERTIFICATE-----
+MIIDVTCCAj2gAwIBAgICEAEwDQYJKoZIhvcNAQELBQAwRTELMAkGA1UEBhMCVVMx
+FjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxDDAKBgNVBAoMA0lDQTEQMA4GA1UEAwwH
+aWNhLmdudTAeFw0yNDExMjcyMDUxMTlaFw0yNTExMjcyMDUxMTlaMFIxCzAJBgNV
+BAYTAlVTMRYwFAYDVQQIDA1NYXNzYWNodXNldHRzMRMwEQYDVQQKDApJQ0EtQ2xp
+ZW50MRYwFAYDVQQDDA1vdGhlci5pY2EuZ251MIIBIjANBgkqhkiG9w0BAQEFAAOC
+AQ8AMIIBCgKCAQEAnYM7s4ypxixhxca6eMcKvTHmM8snORgLhMqslfLRrHrCbXqw
+wOB7B1MzSnOV5M573HzAzzlnaTIsKQfvzNJCwj01vGyGGvoiZTeEko3zqAVhjwYT
+vCl4SF4QWZ8MxlDUEyZtjnTMkrLyBw48bSmTRGpOlI8gF+CEWKVof2e/zGFifJx/
+EUiGXSE1BMieQ+oQE3DslG6b+lxq6SjezR/oUNsOi78Gj0tBQiUQBTzAkE3pjTvM
+umYv19BRBn3T7C3BrwhEQKitAIOZcaoT1Hyt64+XVvRCJfgESbcE1ELLxYSqwblu
+67jpQJHvEi81QkskouKEtDYLo0yiUPFUrz0gLQIDAQABo0IwQDAdBgNVHQ4EFgQU
+tpYBD6DP+dtcGeY9JE7wpNkzrkwHwYDVR0jBBgwFoAUFPrad/hFkrd8OPx0yiZ0
+K7fUNnUwDQYJKoZIhvcNAQELBQADggEBAGXqTaM2KVP0/AY8JAT2gsP/1be0muqq
+1UBtbRGiBcpoHZGfVGOKtp8bogo4TffZJGi8C02CXeFrKC8nrkQ1g2gAC7I3bExZ
+DsMtcSVGmEc2qMXzNiplDn8QcTuCNS5bWdA/wO+188Ezdg3jmgAqJPD5ulcB1B3E
+YEiBQl+BAlkQT/dW/Vu565XonSKIXDfiVivmc0LFBUw/PvoFubTl6CEbiOEgDgLx
+cOP2I/ZcEpLNFtoEsrbZtDTbRgqsTbEB7tMU75KEnTzz93Vq2q59qcEQNm+E6sEH
+icHQeEM0ACIWXt+CN2TJ6Y9b05u78urqWSQAdycnIEE4+XvWh2qAVWw=
+-----END CERTIFICATE-----
@@ -0,0 +1,102 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 4097 (0x1001)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=Massachusetts, L=Boston, O=Root, CN=ca.gnu
+        Validity
+            Not Before: Nov 27 20:51:19 2024 GMT
+            Not After : Nov 27 20:51:19 2025 GMT
+        Subject: C=US, ST=Massachusetts, O=ICA, CN=ica.gnu
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:d5:1f:d7:1a:46:9a:70:ed:6a:88:af:be:80:04:
+                    42:32:26:cf:c4:d8:11:05:21:3f:b3:ef:29:d9:a3:
+                    39:37:b7:89:d5:64:9a:cc:c1:f4:9c:0a:8b:41:cb:
+                    09:7e:ab:16:62:24:6b:69:ea:ba:78:a2:97:a3:e4:
+                    0a:06:c2:2e:14:31:20:15:61:74:7d:70:5d:e8:9f:
+                    33:63:4b:08:81:8b:8f:5a:19:af:92:99:c6:c5:a2:
+                    a4:16:f9:1c:fd:bb:03:f4:2a:1e:98:f2:b2:c1:20:
+                    69:0e:96:ea:3e:dc:b5:91:40:1f:aa:51:a6:a4:09:
+                    06:2f:d9:be:b0:e3:4e:d4:27:2c:b3:74:b2:90:08:
+                    09:d6:cb:7a:4f:f0:dd:43:99:ef:22:24:94:04:c0:
+                    70:48:ba:d8:c4:4f:64:89:bf:7a:a3:74:27:d6:1f:
+                    a7:ab:04:20:e6:99:c8:8f:2f:14:99:02:d1:eb:ce:
+                    2b:0f:ba:5e:b4:80:22:7b:ef:3c:0a:90:a4:97:7b:
+                    4c:19:5f:d4:5e:d7:21:32:3f:3e:05:8a:67:01:d9:
+                    39:f5:7e:39:a7:cf:64:c1:4a:d7:b5:c2:f4:a2:c0:
+                    a4:ef:9f:25:96:96:95:bb:bc:44:27:7f:eb:dd:43:
+                    b4:28:4a:70:f6:21:83:0f:59:cb:98:69:57:8f:ca:
+                    a8:93
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                14:FA:DA:77:F8:45:92:B7:7C:38:FC:74:CA:26:74:2B:B7:D4:36:75
+            X509v3 Authority Key Identifier: 
+                1A:03:C0:AD:5C:3D:FE:76:38:FC:20:8C:B2:73:5C:A3:44:1D:0F:EC
+            X509v3 Basic Constraints: critical
+                CA:TRUE, pathlen:0
+            X509v3 Key Usage: critical
+                Digital Signature, Certificate Sign, CRL Sign
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        00:f7:92:a1:7e:cb:38:f6:62:28:fc:86:ea:7d:64:2a:0e:3d:
+        95:e9:86:d1:00:29:42:5f:97:27:60:31:33:6b:b1:40:9e:d0:
+        20:fd:c9:a1:19:21:41:91:6d:d0:97:af:0a:9f:e9:55:b8:fe:
+        66:20:c6:42:31:9b:8e:08:8e:ea:cb:86:17:e9:12:49:43:de:
+        03:74:a2:19:77:7e:4f:ef:f6:3c:7e:d3:ed:47:fd:24:9b:d5:
+        cc:29:4a:cf:30:d9:40:bc:73:d9:d6:5f:f1:75:48:f8:00:06:
+        2c:a3:84:f0:9d:0c:51:14:40:d0:9d:4b:7c:79:20:93:b9:2f:
+        29:f6:39:ae:36:4f:08:45:65:43:f7:4e:5d:88:84:da:fd:46:
+        a3:14:2e:cb:b9:fa:80:b4:a6:bf:db:72:91:0d:05:a5:82:f6:
+        f9:6c:81:8b:2b:d9:13:5c:cd:d5:da:4b:31:5e:f0:4d:9a:a7:
+        2e:cb:73:6e:7e:07:7c:4a:cc:9a:12:f0:cb:86:34:50:73:c6:
+        2c:40:23:73:ed:7f:f5:c9:61:8e:85:8b:37:fc:33:20:af:fd:
+        6d:4a:cc:3f:60:22:7b:ef:c4:9c:51:d6:f3:de:7c:06:40:a8:
+        4f:ea:38:07:b5:df:4f:b0:56:22:af:50:3d:6b:eb:46:42:7b:
+        a1:3b:1b:df
+-----BEGIN CERTIFICATE-----
+MIIDfTCCAmWgAwIBAgICEAEwDQYJKoZIhvcNAQELBQAwVjELMAkGA1UEBhMCVVMx
+FjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxDzANBgNVBAcMBkJvc3RvbjENMAsGA1UE
+CgwEUm9vdDEPMA0GA1UEAwwGY2EuZ251MB4XDTI0MTEyNzIwNTExOVoXDTI1MTEy
+NzIwNTExOVowRTELMAkGA1UEBhMCVVMxFjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMx
+DDAKBgNVBAoMA0lDQTEQMA4GA1UEAwwHaWNhLmdudTCCASIwDQYJKoZIhvcNAQEB
+BQADggEPADCCAQoCggEBANUf1xpGmnDtaoivvoAEQjImz8TYEQUhP7PvKdmjOTe3
+idVkmszB9JwKi0HLCX6rFmIka2nquniil6PkCgbCLhQxIBVhdH1wXeifM2NLCIGL
+j1oZr5KZxsWipBb5HP27A/QqHpjyssEgaQ6W6j7ctZFAH6pRpqQJBi/ZvrDjTtQn
+LLN0spAICdbLek/w3UOZ7yIklATAcEi62MRPZIm/eqN0J9Yfp6sEIOaZyI8vFJkC
+0evOKw+6XrSAInvvPAqQpJd7TBlf1F7XITI/PgWKZwHZOfV+OafPZMFK17XC9KLA
+pO+fJZaWlbu8RCd/691DtChKcPYhgw9Zy5hpV4/KqJMCAwEAAaNmMGQwHQYDVR0O
+BBYEFBT62nf4RZK3fDj8dMomdCu31DZ1MB8GA1UdIwQYMBaAFBoDwK1cPf52OPwg
+jLJzXKNEHQ/sMBIGA1UdEwEB/wQIMAYBAf8CAQAwDgYDVR0PAQH/BAQDAgGGMA0G
+CSqGSIb3DQEBCwUAA4IBAQAA95Khfss49mIo/IbqfWQqDj2V6YbRAClCX5cnYDEz
+a7FAntAg/cmhGSFBkW3Ql68Kn+lVuP5mIMZCMZuOCI7qy4YX6RJJQ94DdKIZd35P
+7/Y8ftPtR/0km9XMKUrPMNlAvHPZ1l/xdUj4AAYso4TwnQxRFEDQnUt8eSCTuS8p
+9jmuNk8IRWVD905diITa/UajFC7LufqAtKa/23KRDQWlgvb5bIGLK9kTXM3V2ksx
+XvBNmqcuy3Nufgd8SsyaEvDLhjRQc8YsQCNz7X/1yWGOhYs3/DMgr/1tSsw/YCJ7
+78ScUdbz3nwGQKhP6jgHtd9PsFYir1A9a+tGQnuhOxvf
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDjTCCAnWgAwIBAgIUKMfxjtTv4pQhDgO7XhYH2psGmw4wDQYJKoZIhvcNAQEL
+BQAwVjELMAkGA1UEBhMCVVMxFjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxDzANBgNV
+BAcMBkJvc3RvbjENMAsGA1UECgwEUm9vdDEPMA0GA1UEAwwGY2EuZ251MB4XDTI0
+MTEyNzIwNTExOVoXDTM0MTEyNTIwNTExOVowVjELMAkGA1UEBhMCVVMxFjAUBgNV
+BAgMDU1hc3NhY2h1c2V0dHMxDzANBgNVBAcMBkJvc3RvbjENMAsGA1UECgwEUm9v
+dDEPMA0GA1UEAwwGY2EuZ251MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
+AQEAyLov3+OByx5stGOVpSdFT7/9jjCvocEHWVRMTFdWQLDUTKjS7FypFNzAuXUC
+ydO7I5sgvITy9Awg/vRTafuCVP0WtFdO1Jphw4Q3go+uNRVGAhBHV5SegPqkv0u6
+Cb2kZzW88klhyRS8x/41xwJeSXmFHva0VsAy9b0K7UFTDtCKBT+Rb6TRcuYeFI7p
+2fr9OUACg+OtwvYFgKptS+NhwQeq3EIx7SVOHQg3FO2DJlr1EX+k4ItTYX7qLn6R
+ebrsZX1SitJ5BMmLCOOoj6NSziqEo4HFeU0A9fXmPJ3QAx1zuef8qah4wYk+cuxr
+QKVMPRqUvtzgYM7SL/A3Qh6cKwIDAQABo1MwUTAdBgNVHQ4EFgQUGgPArVw9/nY4
+/CCMsnNco0QdD+wwHwYDVR0jBBgwFoAUGgPArVw9/nY4/CCMsnNco0QdD+wwDwYD
+VR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAhIf5Q6P83PBOUN3XFSK7
+uZJPOEBkixcbzS6pBZ/9YYGSNfB2dtO1NEiTDkdDC2YwP4wf1hCDiIvIn9Um+PzV
+jYQjIDMK4oOFmigpbFbjyPHDYHLHmWLFtHA9V2ISE1O8TGxw7wQSpqBKoibAuaT6
+Balg5J7Rhs1em6SEmfEvgOzuVWU9g1nOlmJqTwshPQeq+uPZOzjaC5ofiq7Wr8rj
+GDuZE2HBN/sL8Ojxx9N0vfMctw3Xl26x3j9paH8PgKBp72wplIa3i8r7zfX999P
+SwvOIqwTtQu3nED2hwz/EjNPGhFlXdUiM3sSvxgGY8PeyR5M6dxQggVxMxUa++Nx
+bQ==
+-----END CERTIFICATE-----
@@ -0,0 +1,30 @@
+-----BEGIN ENCRYPTED PRIVATE KEY-----
+MIIFNTBfBgkqhkiG9w0BBQ0wUjAxBgkqhkiG9w0BBQwwJAQQG6NQCpC9z6zVuH2J
+OMZ4zwICCAAwDAYIKoZIhvcNAgkFADAdBglghkgBZQMEAQIEEDtjScSlInWJLzgO
+I26tLt0EggTQzMsJQwKJH/wHs+R66zgDh6kSXY5hvrxxpK/5GWBT7fALIchkeEzR
+YSyp7uqrcii9ljL8hx4g1VojSPpRRGx7WjTWMxVQu1xmdOqR76ptCy23i93NjLrQ
+7gvhAkNH7SKPYFOZfUHgBIFEHYDjzqK50Moac6OAdWAGQXQkN0vJ3Xg6MDhzdxuW
+AXREqeLLC2UJ60FYdEVkohp2+F1DafHMj3Tqo4mZAvZFRJc2DJ48GroTaAb3tZSr
+nWgWeJe4YG4gbrDcyBZQEoWJP4QwDSpEr4VBXDFKWS85m+vqhiTqRYBCQJLJbkfb
+XV6nXxwT8X8AcE5nSb/ofRcw0hLRjYmJyAo2fdkVg92iyy2jCDxBgEeS8oanOrFL
+oZol1LzKwHycQPYroyNelpGFq950PKsQo2kxehHlEPWQe8ViUkxlwlbM95v5Y76J
+IwfSBWc39N5MHu8w1TJVmg7LA0V8Akfi+sblXq8OaypAxkUiVeyW7UH6azKQzLk
+o75A/iisscMJvA7F5PsfMU3iqlch8gRKwqFig9yVPE5OwB+M365DJM+VZyuKcNCb
+Gu7vW05M+HvdSM3osqEToBUrzhFcy+T3xOybWFMMG4oPXkYTOx4VgxQQSa5g34ec
+MvFLyMu2KRWohXO3+jPiYvMZWeWYVPvOetAEQpWIAVNav41TcIenMF14PlwvKPm5
+7NnynduUmQIgaQE3NmwAXrb5yLIoVHvmKaAvAXykL1Uc0etLexHTxup/RLO4WLJS
+d44zTjvXna+aQ8boutP4DvUKXLsvtgaEIAtOgMVOq/rrrfL/lAPl/JFAZvWwc2gS
+2Y4qCWNjmqRyF8eFS3n603zzjju7iTEpghOxdO01DVg0IezEG9+LQz89VmI3hMPQ
+unOmtooFkfH3b5+E96X8megWaTk5pCi1/q+uoI1urTbvEf3oOsja3UA/yRGLG1LI
+hbc4jasGAb/7j7q9LWcGNPSZPzdnQk2zt7rPBbwyZIrdgwyRAmffC1zD/C7KsqKV
+1SlEmg4mFNwD2QeW+5MImfESTKZw5lEn7HNZUFBBXd0padM8EN4x9EpRebV2gVo7
+MUt8tcX/Nam9LSilxoQ8AlyoBjvs+lj2ZBgRMwva82iYNYQ2FuzIaptInCNrmx4b
+lP4mT/65TeMO1dyeeud+qqwJN64+BOHWAODA4cmwTtvNA4LDQuH8Uf+mnFqvHCd
+xBd1rVPFM3MG9M1Boq7XDMsi01oEaiw7vu97VCINZvTspbOwoo351sVXrpEcadwo
+9DAizyge4df4WI9uWTorycoyYMkaZKA9DoNUBikl1F7bX+yy45wFpY5yOwvsi9jd
+EHSGcyxtgCszR3sK33Ozxgsr1EXWOCZCaAFVcwhR1dNogqdgDFnuCHsilGCANlIz
+piDjBrHaYb4BI33FCUlYgwr6WHnF+utVDBMUQZ6Pj+vYjtKEwLCo+XyebvGHSeNi
+D40MP9q9xHyu5cshd06cV88O8zE4Ys8HRPVJcC2qQJPS903D0uxP04NRoBZbXCAc
+SyDm4MVsz2ovMJ9KIn+Nz7gDP2XCOFLqi1xPBhn5pI5BV303i8PKVnu9b+lw0Tai
+lS8lYFV/LQmFU8H1dd6LuEKB7jQxqzRxP1Dc2KaaEQUENSk4PEmPiXw=
+-----END ENCRYPTED PRIVATE KEY-----
@@ -0,0 +1,80 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 4097 (0x1001)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=Massachusetts, L=Boston, O=Root, CN=ca.gnu
+        Validity
+            Not Before: Nov 27 20:51:19 2024 GMT
+            Not After : Nov 27 20:51:19 2025 GMT
+        Subject: C=US, ST=Massachusetts, O=ICA, CN=ica.gnu
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:d5:1f:d7:1a:46:9a:70:ed:6a:88:af:be:80:04:
+                    42:32:26:cf:c4:d8:11:05:21:3f:b3:ef:29:d9:a3:
+                    39:37:b7:89:d5:64:9a:cc:c1:f4:9c:0a:8b:41:cb:
+                    09:7e:ab:16:62:24:6b:69:ea:ba:78:a2:97:a3:e4:
+                    0a:06:c2:2e:14:31:20:15:61:74:7d:70:5d:e8:9f:
+                    33:63:4b:08:81:8b:8f:5a:19:af:92:99:c6:c5:a2:
+                    a4:16:f9:1c:fd:bb:03:f4:2a:1e:98:f2:b2:c1:20:
+                    69:0e:96:ea:3e:dc:b5:91:40:1f:aa:51:a6:a4:09:
+                    06:2f:d9:be:b0:e3:4e:d4:27:2c:b3:74:b2:90:08:
+                    09:d6:cb:7a:4f:f0:dd:43:99:ef:22:24:94:04:c0:
+                    70:48:ba:d8:c4:4f:64:89:bf:7a:a3:74:27:d6:1f:
+                    a7:ab:04:20:e6:99:c8:8f:2f:14:99:02:d1:eb:ce:
+                    2b:0f:ba:5e:b4:80:22:7b:ef:3c:0a:90:a4:97:7b:
+                    4c:19:5f:d4:5e:d7:21:32:3f:3e:05:8a:67:01:d9:
+                    39:f5:7e:39:a7:cf:64:c1:4a:d7:b5:c2:f4:a2:c0:
+                    a4:ef:9f:25:96:96:95:bb:bc:44:27:7f:eb:dd:43:
+                    b4:28:4a:70:f6:21:83:0f:59:cb:98:69:57:8f:ca:
+                    a8:93
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                14:FA:DA:77:F8:45:92:B7:7C:38:FC:74:CA:26:74:2B:B7:D4:36:75
+            X509v3 Authority Key Identifier: 
+                1A:03:C0:AD:5C:3D:FE:76:38:FC:20:8C:B2:73:5C:A3:44:1D:0F:EC
+            X509v3 Basic Constraints: critical
+                CA:TRUE, pathlen:0
+            X509v3 Key Usage: critical
+                Digital Signature, Certificate Sign, CRL Sign
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        00:f7:92:a1:7e:cb:38:f6:62:28:fc:86:ea:7d:64:2a:0e:3d:
+        95:e9:86:d1:00:29:42:5f:97:27:60:31:33:6b:b1:40:9e:d0:
+        20:fd:c9:a1:19:21:41:91:6d:d0:97:af:0a:9f:e9:55:b8:fe:
+        66:20:c6:42:31:9b:8e:08:8e:ea:cb:86:17:e9:12:49:43:de:
+        03:74:a2:19:77:7e:4f:ef:f6:3c:7e:d3:ed:47:fd:24:9b:d5:
+        cc:29:4a:cf:30:d9:40:bc:73:d9:d6:5f:f1:75:48:f8:00:06:
+        2c:a3:84:f0:9d:0c:51:14:40:d0:9d:4b:7c:79:20:93:b9:2f:
+        29:f6:39:ae:36:4f:08:45:65:43:f7:4e:5d:88:84:da:fd:46:
+        a3:14:2e:cb:b9:fa:80:b4:a6:bf:db:72:91:0d:05:a5:82:f6:
+        f9:6c:81:8b:2b:d9:13:5c:cd:d5:da:4b:31:5e:f0:4d:9a:a7:
+        2e:cb:73:6e:7e:07:7c:4a:cc:9a:12:f0:cb:86:34:50:73:c6:
+        2c:40:23:73:ed:7f:f5:c9:61:8e:85:8b:37:fc:33:20:af:fd:
+        6d:4a:cc:3f:60:22:7b:ef:c4:9c:51:d6:f3:de:7c:06:40:a8:
+        4f:ea:38:07:b5:df:4f:b0:56:22:af:50:3d:6b:eb:46:42:7b:
+        a1:3b:1b:df
+-----BEGIN CERTIFICATE-----
+MIIDfTCCAmWgAwIBAgICEAEwDQYJKoZIhvcNAQELBQAwVjELMAkGA1UEBhMCVVMx
+FjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxDzANBgNVBAcMBkJvc3RvbjENMAsGA1UE
+CgwEUm9vdDEPMA0GA1UEAwwGY2EuZ251MB4XDTI0MTEyNzIwNTExOVoXDTI1MTEy
+NzIwNTExOVowRTELMAkGA1UEBhMCVVMxFjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMx
+DDAKBgNVBAoMA0lDQTEQMA4GA1UEAwwHaWNhLmdudTCCASIwDQYJKoZIhvcNAQEB
+BQADggEPADCCAQoCggEBANUf1xpGmnDtaoivvoAEQjImz8TYEQUhP7PvKdmjOTe3
+idVkmszB9JwKi0HLCX6rFmIka2nquniil6PkCgbCLhQxIBVhdH1wXeifM2NLCIGL
+j1oZr5KZxsWipBb5HP27A/QqHpjyssEgaQ6W6j7ctZFAH6pRpqQJBi/ZvrDjTtQn
+LLN0spAICdbLek/w3UOZ7yIklATAcEi62MRPZIm/eqN0J9Yfp6sEIOaZyI8vFJkC
+0evOKw+6XrSAInvvPAqQpJd7TBlf1F7XITI/PgWKZwHZOfV+OafPZMFK17XC9KLA
+pO+fJZaWlbu8RCd/691DtChKcPYhgw9Zy5hpV4/KqJMCAwEAAaNmMGQwHQYDVR0O
+BBYEFBT62nf4RZK3fDj8dMomdCu31DZ1MB8GA1UdIwQYMBaAFBoDwK1cPf52OPwg
+jLJzXKNEHQ/sMBIGA1UdEwEB/wQIMAYBAf8CAQAwDgYDVR0PAQH/BAQDAgGGMA0G
+CSqGSIb3DQEBCwUAA4IBAQAA95Khfss49mIo/IbqfWQqDj2V6YbRAClCX5cnYDEz
+a7FAntAg/cmhGSFBkW3Ql68Kn+lVuP5mIMZCMZuOCI7qy4YX6RJJQ94DdKIZd35P
+7/Y8ftPtR/0km9XMKUrPMNlAvHPZ1l/xdUj4AAYso4TwnQxRFEDQnUt8eSCTuS8p
+9jmuNk8IRWVD905diITa/UajFC7LufqAtKa/23KRDQWlgvb5bIGLK9kTXM3V2ksx
+XvBNmqcuy3Nufgd8SsyaEvDLhjRQc8YsQCNz7X/1yWGOhYs3/DMgr/1tSsw/YCJ7
+78ScUdbz3nwGQKhP6jgHtd9PsFYir1A9a+tGQnuhOxvf
+-----END CERTIFICATE-----
@@ -0,0 +1,30 @@
+-----BEGIN ENCRYPTED PRIVATE KEY-----
+MIIFJDBWBgkqhkiG9w0BBQ0wSTAxBgkqhkiG9w0BBQwwJAQQJ1VSHi+akaaVYO3O
+H7I0EAICCAAwDAYIKoZIhvcNAgkFADAUBggqhkiG9w0DBwQIZlNzQR1bh4IEggTI
+8U86bfGmyAXXSi/R/l3G8ziZFyHrRE5Q/Q3uUW/jyUpe+S0gMRPqwW3V542ForbH
+IH/Aa+KVxlwmsq0jlheCQewj9qZMQGuqa3iTl/OfCcuGMfsuQs2HsutoDMdEYuBI
+6yOqNIrRvSHunZILLDpKz/AmCO6JnRiAwiSqPBixE5M+cm1qc7dy024REiW9l9K6
+Hth9A0iYc94CUyUfHFj4CEkCNqk533Z2Ktkk3RQJnx5ORQG0iBJvoFiVODFKnoAk
+Ge2HNrJH3bVvhQ+p8A/L4VmnWUCfcTyqgzo887WXRxORya6gcWWtrcEJGUbLh8sL
+/mXFYj/0kEllIY+fHOmSx94I3GwBkQKER/CeOCIp+C392Pujgzrz23pdq20uIt3d
+FCgbnIB+5IwOwQcqCkTYa1+Y5qCa6eFLgd8PXGTDyFwP4BHfG6WT/ctHQFi8vnXV
+D1S726do1mA6CFE3DYmi45sf+Te2Xb346xk1GTSWtxGh9y4FblFDAWva4oTuvxPR
+IDseBhXBsIqnOy1gb/5cGj0SIOQzqR1qlg4igv3UZFC8cVl+fNnngDBiX+nTYQVm
+rDyxTzcX9txPSNpLyYRdNHwLGpzZAMoN46bUFnxt0cvRWN6MA7j1r0TYWBZKJ7b7
+Yt/SuYsqSE0UJQEJz4QcQnlxu3qu4HJl7dOlto3fa42MWTkOcNr9XinHmKCZ9oYZ
+PYNTggRGMXlqm66KmHWDqXqw9CeufprHq15SIJJR8v4SlvEZr+YlYQeHRI4E+FDA
+mEFZy/U3ZL7ZHSDsEvpeBzIJkWxHobt57BIxYHE8KN0ZIz/mJZTxljacblFWnJRb
+AUXTfrRZn3lGX+4WA6Biilwyxb71slCKaiz28C55Hnj1UwoUF8vNA3G2FGAX5Wk0
+m3J2SoCHtJQYc/3lEC7zR9i3/F/7vgRxZMUWt/y6KRYq8ZnoQl3Eo2yvJYX/z7I6
+JyqexAx3OvA+frN3rbO/o/k6w9333Smi0QxZzDM9tHn1BAgAtmyC1lizzKn7hDYK
+o/eaPeatILbS0a/bHJBbP/R53keVr0hJ3MWK2nb/DV5Dl9j4Z6sHpo3P9L+Kq06y
+G9q7NhBd7cxGq4AkCp+eSjqTvwgOX1PtAry00TUmzisLz8gIYutwJqbfZGL8WpR/
+/wnLQXuM/tPLdQNy+PZeTQnPFwWQeZz4VgkMRhHV2xDw0mpzE+cdD204+YjHVdMH
+D4MNrDlUmKM0OVoYgXd9YyLKzYVgW95GvY1X0SxTlIUuDiRv/SqRsurPFkSG457d
+zmTUny1NRsnbv9bTXqt1Xewqsylyu02N1dZvjIzBnYMVYXl0r4aej1VNEXozQtWO
+YRfWaZ29dXwZqUzd83ETQvhI4mZbwAlHbqm/CoyY6Vw4Am8hGa7II134lz2b3tkr
+F1zBkvzzl6+HXewGOEjm+YorDMtfADiU/hkkykWq01NG3QSwk7jaKieb5Rlou53d
+IXJQBw0KW5UrgbIFqMjpSZz1jdALBKsV+dw0wvCQ8BVXZm3zZpsV+0E4Z0sdj3TI
+UbkFqQ6GpoxB25UUUlLZhBbtKy7dheuPBk0HowitYlo1kLVA/JiFB4qbdf5X/9Tm
+XRkN+T0orEgy7rBQa7dJN9bdLj+dS5q8
+-----END ENCRYPTED PRIVATE KEY-----
@@ -0,0 +1,22 @@
+-----BEGIN CERTIFICATE-----
+MIIDjTCCAnWgAwIBAgIUKkxAx2lVnvYcaNqBpJmTgXh1/VgwDQYJKoZIhvcNAQEL
+BQAwVjELMAkGA1UEBhMCVVMxFjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxDzANBgNV
+BAcMBkJvc3RvbjENMAsGA1UECgwEUm9vdDEPMA0GA1UEAwwGY2EuZ251MB4XDTI0
+MTEyOTEyNDUyOFoXDTM0MTEyNzEyNDUyOFowVjELMAkGA1UEBhMCVVMxFjAUBgNV
+BAgMDU1hc3NhY2h1c2V0dHMxDzANBgNVBAcMBkJvc3RvbjENMAsGA1UECgwEUm9v
+dDEPMA0GA1UEAwwGY2EuZ251MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
+AQEA23YSrcGIBgZf9bbzTnmYFy+4tM82kUhsVFKxWCNEMdKmhaeVvXogyd6Evq4P
+NvBGdUABDtHp4pSEijrxWbn8sxddTznoT/8IOuHI0/PtwXYP/sHQ/HzekEUVKN2Z
+NMbMUzQfaJyiIV5TrZlaBwHjQ+sRs8E56C3cQjkwuyjll2zDsEfmEnPimZRAL3kb
+wW8VFfBcR2Id+a9xKjwlnB4eXQFAgYINoRgCtUOUxSeFgNnwkOUSqDknO6Xi47YZ
+EdLlHyUnv5eX547xUkrYhfQuQwaqpGrjHf3GFoysN8P9kd2f1qsJKtQcUbF9DDeZ
+6ya47X/LBO8QflMsVjb1V3oz9QIDAQABo1MwUTAdBgNVHQ4EFgQUsvdZoX3RxdN6
+wrONr31SOA9Qbc4wHwYDVR0jBBgwFoAUsvdZoX3RxdN6wrONr31SOA9Qbc4wDwYD
+VR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAS3PyV7crGk9brqU90aML
+2TWkjgzFb3/nASnpvVYiqyiV4neGiEjtDy7eVlqP6GlD2pYcVodY+ly9wNlo85/h
+YfgCFFl37tMG7PpRac2qBqaSn1DpwsCb08LjRrOvoaRffWUikSoZmsYDlaCgl9nT
+pGtIrz0BSoyu5mHalIZTVQOrbkNBNK6ZgnYy2iWuiLa5Z1xzKpsRBRaKJc1pcQE/
+QVbPdCiyGQMPEVn/KHxitlycFoee/fA+izXVdstVwfig2DoMvrlGZvEkN1ER3Yz4
+QPJ6HzOsBQL1F+YhnMCQfc2rpcwxAWf8JMy6jsCq42KGq53tkWqHyQ6Zu2SiLRYk
+CA==
+-----END CERTIFICATE-----
@@ -0,0 +1,22 @@
+-----BEGIN CERTIFICATE-----
+MIIDjTCCAnWgAwIBAgIUQ8fTQSauZKYRtUl+c6qD0vNnP+kwDQYJKoZIhvcNAQEL
+BQAwVjELMAkGA1UEBhMCVVMxFjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxDzANBgNV
+BAcMBkJvc3RvbjENMAsGA1UECgwEUm9vdDEPMA0GA1UEAwwGY2EuZ251MB4XDTI0
+MTEyNzIwNDkxN1oXDTM0MTEyNTIwNDkxN1owVjELMAkGA1UEBhMCVVMxFjAUBgNV
+BAgMDU1hc3NhY2h1c2V0dHMxDzANBgNVBAcMBkJvc3RvbjENMAsGA1UECgwEUm9v
+dDEPMA0GA1UEAwwGY2EuZ251MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
+AQEAub/XkUgCMwKRDTaKfv8xrIYPC3eMOq4C2P5ATxBTgpgz0pSTeqTztS5RPCCs
+eUGr109QSUweapLsVjP2mOR0r1VIaePDbxCIHpQzwDaPco5/QRCyInpjJuAXKuJH
+deWAiiMUSg+llgPfMZqLAIsDf9zDBhK1/UOGblkGqPX7qMqkiR4Ti05+59Zpl7Ht
+UFi0Y7psTiRsnrf33wfFJ8MVWlEluonaVUXdHUVRPyb5ubpbGhouA8mDl0+Y4WyA
+NDpx+LDo7xJsfx6vMTsvUYxYtE/FHO4ezCl37VZo1t4CDPUiYeVBRKhkqwhGslzl
+hqJniO/uw7OCzjnNSm/lReugsQIDAQABo1MwUTAdBgNVHQ4EFgQUjS1b20tXuB4J
+XMvKEi4VUCTcQM8wHwYDVR0jBBgwFoAUjS1b20tXuB4JXMvKEi4VUCTcQM8wDwYD
+VR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAN9gRx8fina3ZHgjEnIlj
+wEAR20zqennDhJxG6unuE+uoKZe4whnlsEFgDdulU8hXlWn3PcWNwE21JGo8ePKW
+2wvKY0Oj24cDXU+/ZQDbBASWY0GdiFs8z3kGBFn0V3OfjSDRYdypBTSwU23X7mKD
+tDjBMgGUc1MaIWf3bXFA+zzumPP0IJ+XeXURwbxfi4bgFHmttSjfkle0srUEZ1do
+w0DDM5ptFkLllfArw8PuAmK79iVkoVZSE76sDc1/FRaLdBtOExd5UCosFrgP1WR5
+ZqPXlqGbIom1GBCLh19V5v/KP3594yPMGiaRE/fp9155mMbF9vnphTISy9pkMCgz
+uw==
+-----END CERTIFICATE-----
@@ -29,6 +29,7 @@
 #include <fcntl.h>
 #include <unistd.h>
 #include <errno.h>
+#include <curl/curl.h>

 /**
 * A semaphore.
@@ -419,6 +420,7 @@ cleanup:
                              &res));
    if (! cctxs[i].status)
      ret = false;
+    curl_slist_free_all (cctxs[i].pc.hosts);
  }
  test_check (0 == close (p[0]));
  test_check (0 == close (p[1]));
@@ -481,7 +483,7 @@ MHDT_test (MHDT_ServerSetup ss_cb,
           void *ss_cb_cls,
           MHDT_ServerRunner run_cb,
           void *run_cb_cls,
-           const struct MHDT_Phase *phases)
+           struct MHDT_Phase *phases)
 {
  struct ServerContext ctx = {
    .run_cb = run_cb,
@@ -574,17 +576,23 @@ MHDT_test (MHDT_ServerSetup ss_cb,
  }
  for (i = 0; NULL != phases[i].label; i++)
  {
+    struct MHDT_Phase *pi = &phases[i];
+    struct MHDT_PhaseContext *pc
+      = pi->use_tls
+      ? &pc_https
+      : &pc_http;
+    pc->phase = &phases[i];
+    pc->hosts = NULL;
    fprintf (stderr,
             "Running test phase '%s'\n",
-             phases[i].label);
-    if (! run_client_phase (&phases[i],
-                            phases[i].use_tls
-                            ? &pc_https
-                            : &pc_http))
+             pi->label);
+    if (! run_client_phase (pi,
+                            pc))
    {
      res = 1;
      goto cleanup;
    }
+    pc->hosts = NULL;
    /* client is done with phase */
    semaphore_up (&ctx.client_sem);
    /* wait for server to have moved to new phase */
@@ -622,3 +630,63 @@ cleanup:
  test_check (0 == close (p[1]));
  return res;
 }
+
+
+char *
+MHDT_load_pem (const char *name)
+{
+  char path[256];
+  int fd;
+  struct stat s;
+  char *buf;
+
+  snprintf (path,
+            sizeof (path),
+            "data/%s.pem",
+            name);
+  fd = open (path,
+             O_RDONLY);
+  if (-1 == fd)
+  {
+    fprintf (stderr,
+             "Failed to open %s: %s\n",
+             path,
+             strerror (errno));
+    return NULL;
+  }
+  if (0 !=
+      fstat (fd,
+             &s))
+  {
+    fprintf (stderr,
+             "Failed to fstat %s: %s\n",
+             path,
+             strerror (errno));
+    (void) close (fd);
+    return NULL;
+  }
+  buf = malloc (s.st_size + 1);
+  if (NULL == buf)
+  {
+    fprintf (stderr,
+             "Failed to malloc(): %s\n",
+             strerror (errno));
+    (void) close (fd);
+    return NULL;
+  }
+  if (-1 ==
+      read (fd,
+            buf,
+            s.st_size))
+  {
+    fprintf (stderr,
+             "Failed to read %s: %s\n",
+             path,
+             strerror (errno));
+    free (buf);
+    (void) close (fd);
+    return NULL;
+  }
+  (void) close (fd);
+  return buf;
+}
@@ -35,6 +35,14 @@
 #endif
 #include "microhttpd2.h"

+
+/**
+ * A phase defines some server and client-side
+ * behaviors to execute.
+ */
+struct MHDT_Phase;
+
+
 /**
 * Information about the current phase.
 */
@@ -45,10 +53,22 @@ struct MHDT_PhaseContext
   */
  const char *base_url;

+  /**
+   * Data structure to keep around during the request because
+   * Curl.
+   */
+  struct curl_slist *hosts;
+
  /**
   * Specific client we are running.
   */
  unsigned int client_id;
+
+  /**
+   * More details about the phase we are running.
+   */
+  struct MHDT_Phase *phase;
+
 };


@@ -62,7 +82,102 @@ struct MHDT_PhaseContext
 */
 typedef const char *
 (*MHDT_ClientLogic)(const void *cls,
-                    const struct MHDT_PhaseContext *pc);
+                    struct MHDT_PhaseContext *pc);
+
+
+struct MHDT_Phase
+{
+
+  /**
+   * Name of the phase, for debugging/logging.
+   */
+  const char *label;
+
+  /**
+   * Logic for the MHD server for this phase.
+   */
+  MHD_RequestCallback server_cb;
+
+  /**
+   * Closure for @e server_cb.
+   */
+  void *server_cb_cls;
+
+  /**
+   * Logic for the CURL client for this phase.
+   */
+  MHDT_ClientLogic client_cb;
+
+  /**
+   * Closure for @e client_cb.
+   */
+  const void *client_cb_cls;
+
+  /**
+   * How long is the phase allowed to run at most before
+   * timing out. 0 for no timeout.
+   */
+  unsigned int timeout_ms;
+
+  /**
+   * How many clients should be run in parallel.
+   * 0 to run just one client.
+   */
+  unsigned int num_clients;
+
+  /**
+   * Set to true if clients should setup the connection to use TLS.
+   */
+  bool use_tls;
+
+  /**
+   * Set to true if clients should check server cert.
+   */
+  bool check_server_cert;
+
+  /**
+   * Client certificate to present to the server, NULL for none.
+   */
+  const char *client_cert;
+
+  /**
+   * Client private key to use, NULL for none.
+   */
+  const char *client_priv;
+
+  /**
+   * Server certificate to present to the client, NULL for default.
+   */
+  const char *server_cert;
+
+  /**
+   * Server private key to use, NULL for default.
+   */
+  const char *server_priv;
+};
+
+
+/**
+ * Load PEM file from data/ folder and return data in it.
+ *
+ * @param name name of PEM file to load
+ * @return NULL on error
+ */
+char *
+MHDT_load_pem (const char *name);
+
+
+/**
+ * Run request against the root URL of the
+ * hostname given in @a cls.
+ *
+ * @param cls closure with hostname to use
+ * @param pc context for the client
+ * @return error message, NULL on success
+ */
+const char *
+MHDT_client_get_host (const void *cls,
+                      struct MHDT_PhaseContext *pc);


 /**
@@ -75,7 +190,7 @@ typedef const char *
 */
 const char *
 MHDT_client_get_root (const void *cls,
-                      const struct MHDT_PhaseContext *pc);
+                      struct MHDT_PhaseContext *pc);


 /**
@@ -90,7 +205,7 @@ MHDT_client_get_root (const void *cls,
 */
 const char *
 MHDT_client_get_with_query (const void *cls,
-                            const struct MHDT_PhaseContext *pc);
+                            struct MHDT_PhaseContext *pc);


 /**
@@ -104,7 +219,7 @@ MHDT_client_get_with_query (const void *cls,
 */
 const char *
 MHDT_client_set_header (const void *cls,
-                        const struct MHDT_PhaseContext *pc);
+                        struct MHDT_PhaseContext *pc);


 /**
@@ -119,7 +234,7 @@ MHDT_client_set_header (const void *cls,
 */
 const char *
 MHDT_client_expect_header (const void *cls,
-                           const struct MHDT_PhaseContext *pc);
+                           struct MHDT_PhaseContext *pc);


 /**
@@ -132,7 +247,7 @@ MHDT_client_expect_header (const void *cls,
 */
 const char *
 MHDT_client_put_data (const void *cls,
-                      const struct MHDT_PhaseContext *pc);
+                      struct MHDT_PhaseContext *pc);


 /**
@@ -145,7 +260,7 @@ MHDT_client_put_data (const void *cls,
 */
 const char *
 MHDT_client_chunk_data (const void *cls,
-                        const struct MHDT_PhaseContext *pc);
+                        struct MHDT_PhaseContext *pc);


 /**
@@ -257,58 +372,7 @@ struct MHDT_PostInstructions
 const char *
 MHDT_client_do_post (
  const void *cls,
-  const struct MHDT_PhaseContext *pc);
-
-
-/**
- * A phase defines some server and client-side
- * behaviors to execute.
- */
-struct MHDT_Phase
-{
-
-  /**
-   * Name of the phase, for debugging/logging.
-   */
-  const char *label;
-
-  /**
-   * Logic for the MHD server for this phase.
-   */
-  MHD_RequestCallback server_cb;
-
-  /**
-   * Closure for @e server_cb.
-   */
-  void *server_cb_cls;
-
-  /**
-   * Logic for the CURL client for this phase.
-   */
-  MHDT_ClientLogic client_cb;
-
-  /**
-   * Closure for @e client_cb.
-   */
-  const void *client_cb_cls;
-
-  /**
-   * How long is the phase allowed to run at most before
-   * timing out. 0 for no timeout.
-   */
-  unsigned int timeout_ms;
-
-  /**
-   * How many clients should be run in parallel.
-   * 0 to run just one client.
-   */
-  unsigned int num_clients;
-
-  /**
-   * Set to true if clients should setup the connection to use TLS.
-   */
-  bool use_tls;
-};
+  struct MHDT_PhaseContext *pc);


 /**
@@ -650,6 +714,6 @@ MHDT_test (MHDT_ServerSetup ss_cb,
           void *ss_cb_cls,
           MHDT_ServerRunner run_cb,
           void *run_cb_cls,
-           const struct MHDT_Phase *phases);
+           struct MHDT_Phase *phases);

 #endif
@@ -231,11 +231,13 @@ check_status (CURL *c,
 *
 * @param[in,out] c curl handle to manipulate
 * @param base_url base URL to set
- * @return true on success, false on failure (@a c will be cleaned up in this case)
+ * @param[in,out] pc phase context with further options
+ * @return NULL on success, error message on failure (@a c will be cleaned up in this case)
 */
-static bool
+static const char *
 set_url (CURL *c,
-         const char *base_url)
+         const char *base_url,
+         struct MHDT_PhaseContext *pc)
 {
  if (CURLE_OK !=
      curl_easy_setopt (c,
@@ -243,7 +245,7 @@ set_url (CURL *c,
                        base_url))
  {
    curl_easy_cleanup (c);
-    return false;
+    return "Failed to set URL";
  }
  if (CURLE_OK !=
      curl_easy_setopt (c,
@@ -251,48 +253,152 @@ set_url (CURL *c,
                        1))
  {
    curl_easy_cleanup (c);
-    return false;
+    return "Failed to set verbosity";
+  }
+  {
+    /* Force curl to do the request to 127.0.0.1 regardless of
+       hostname */
+    const char *host;
+    const char *end;
+    char ri[1024];
+
+    if (0 == strncasecmp (base_url,
+                          "https://",
+                          strlen ("https://")))
+      host = &base_url[strlen ("https://")];
+    else
+      host = &base_url[strlen ("http://")];
+    end = strchr (host, '/');
+    if (NULL == end)
+      end = host + strlen (host);
+    snprintf (ri,
+              sizeof (ri),
+              "%.*s:127.0.0.1",
+              (int) (end - host),
+              host);
+    pc->hosts = curl_slist_append (NULL,
+                                   ri);
+    if (CURLE_OK !=
+        curl_easy_setopt (c,
+                          CURLOPT_RESOLVE,
+                          pc->hosts))
+    {
+      curl_easy_cleanup (c);
+      return "Failed to override DNS";
+    }
  }
  if (0 == strncasecmp (base_url,
                        "https://",
                        strlen ("https://")))
  {
-    /* disable certificate checking */
-    if ( (CURLE_OK !=
-          curl_easy_setopt (c,
-                            CURLOPT_SSL_VERIFYPEER,
-                            0L)) ||
-         (CURLE_OK !=
-          curl_easy_setopt (c,
-                            CURLOPT_SSL_VERIFYHOST,
-                            0L)) )
+    struct MHDT_Phase *phase = pc->phase;
+
+    if (phase->check_server_cert)
    {
-      curl_easy_cleanup (c);
-      return false;
+      if (CURLE_OK !=
+          curl_easy_setopt (c,
+                            CURLOPT_CAINFO,
+                            "data/rca-signed-cert.pem"))
+      {
+        curl_easy_cleanup (c);
+        return "Failed to override root CA";
+      }
+    }
+    else
+    {
+      /* disable certificate checking */
+      if ( (CURLE_OK !=
+            curl_easy_setopt (c,
+                              CURLOPT_SSL_VERIFYPEER,
+                              0L)) ||
+           (CURLE_OK !=
+            curl_easy_setopt (c,
+                              CURLOPT_SSL_VERIFYHOST,
+                              0L)) )
+      {
+        curl_easy_cleanup (c);
+        return "Failed to disable X509 server certificate checks";
+      }
+    }
+    if (NULL != phase->client_cert)
+    {
+      if (CURLE_OK !=
+          curl_easy_setopt (c,
+                            CURLOPT_SSLCERT,
+                            phase->client_cert))
+      {
+        curl_easy_cleanup (c);
+        return "Failed to set client certificate";
+      }
    }
  }
-  return true;
+  return NULL;
+}
+
+
+const char *
+MHDT_client_get_host (const void *cls,
+                      struct MHDT_PhaseContext *pc)
+{
+  const char *host = cls;
+  const char *err;
+  size_t alen = strlen (host);
+  CURL *c;
+  size_t blen = strlen (pc->base_url);
+  char u[alen + blen + 1];
+  const char *slash = strchr (pc->base_url,
+                              '/');
+  const char *colon;
+
+  if (NULL == slash)
+    return "'/' missing in base URL";
+  colon = strchr (slash,
+                  ':');
+  if (NULL == colon)
+    return "':' missing in base URL";
+  snprintf (u,
+            sizeof (u),
+            "https://%s%s",
+            host,
+            colon);
+  c = curl_easy_init ();
+  if (NULL == c)
+    return "Failed to initialize Curl handle";
+  err = set_url (c,
+                 u,
+                 pc);
+  if (NULL != err)
+    return err;
+  PERFORM_REQUEST (c);
+  CHECK_STATUS (c,
+                MHD_HTTP_STATUS_OK);
+  curl_easy_cleanup (c);
+  return NULL;
 }


 const char *
 MHDT_client_get_root (
  const void *cls,
-  const struct MHDT_PhaseContext *pc)
+  struct MHDT_PhaseContext *pc)
 {
  const char *text = cls;
  CURL *c;
+  const char *err;
  DECLARE_WB (text);

  c = curl_easy_init ();
  if (NULL == c)
    return "Failed to initialize Curl handle";
-  if (! set_url (c,
-                 pc->base_url))
-    return "Failed to set URL for curl request";
+  err = set_url (c,
+                 pc->base_url,
+                 pc);
+  if (NULL != err)
+    return err;
  SETUP_WB (c);
  PERFORM_REQUEST (c);
-  CHECK_STATUS (c, MHD_HTTP_STATUS_OK);
+  CHECK_STATUS (c,
+                MHD_HTTP_STATUS_OK);
  curl_easy_cleanup (c);
  CHECK_WB (text);
  return NULL;
@@ -302,9 +408,10 @@ MHDT_client_get_root (
 const char *
 MHDT_client_get_with_query (
  const void *cls,
-  const struct MHDT_PhaseContext *pc)
+  struct MHDT_PhaseContext *pc)
 {
  const char *args = cls;
+  const char *err;
  size_t alen = strlen (args);
  CURL *c;
  size_t blen = strlen (pc->base_url);
@@ -320,9 +427,11 @@ MHDT_client_get_with_query (
  c = curl_easy_init ();
  if (NULL == c)
    return "Failed to initialize Curl handle";
-  if (! set_url (c,
-                 u))
-    return "Failed to set URL for curl request";
+  err = set_url (c,
+                 u,
+                 pc);
+  if (NULL != err)
+    return err;
  PERFORM_REQUEST (c);
  CHECK_STATUS (c,
                MHD_HTTP_STATUS_NO_CONTENT);
@@ -334,9 +443,10 @@ MHDT_client_get_with_query (
 const char *
 MHDT_client_set_header (
  const void *cls,
-  const struct MHDT_PhaseContext *pc)
+  struct MHDT_PhaseContext *pc)
 {
  const char *hdr = cls;
+  const char *err;
  CURL *c;
  CURLcode res;
  struct curl_slist *slist;
@@ -344,9 +454,11 @@ MHDT_client_set_header (
  c = curl_easy_init ();
  if (NULL == c)
    return "Failed to initialize Curl handle";
-  if (! set_url (c,
-                 pc->base_url))
-    return "Failed to set URL for curl request";
+  err = set_url (c,
+                 pc->base_url,
+                 pc);
+  if (NULL != err)
+    return err;
  slist = curl_slist_append (NULL,
                             hdr);
  if (CURLE_OK !=
@@ -374,10 +486,11 @@ MHDT_client_set_header (

 const char *
 MHDT_client_expect_header (const void *cls,
-                           const struct MHDT_PhaseContext *pc)
+                           struct MHDT_PhaseContext *pc)
 {
 #ifdef HAVE_LIBCRUL_NEW_HDR_API
  const char *hdr = cls;
+  const char *err;
  size_t hlen = strlen (hdr) + 1;
  char key[hlen];
  const char *colon = strchr (hdr, ':');
@@ -395,9 +508,11 @@ MHDT_client_expect_header (const void *cls,
  c = curl_easy_init ();
  if (NULL == c)
    return "Failed to initialize Curl handle";
-  if (! set_url (c,
-                 pc->base_url))
-    return "Failed to set URL for curl request";
+  err = set_url (c,
+                 pc->base_url,
+                 pc);
+  if (NULL != err)
+    return err;
  PERFORM_REQUEST (c);
  CHECK_STATUS (c,
                MHD_HTTP_STATUS_NO_CONTENT);
@@ -499,9 +614,10 @@ read_cb (void *ptr,
 const char *
 MHDT_client_put_data (
  const void *cls,
-  const struct MHDT_PhaseContext *pc)
+  struct MHDT_PhaseContext *pc)
 {
  const char *text = cls;
+  const char *err;
  struct ReadBuffer rb = {
    .buf = text,
    .len = strlen (text)
@@ -511,9 +627,11 @@ MHDT_client_put_data (
  c = curl_easy_init ();
  if (NULL == c)
    return "Failed to initialize Curl handle";
-  if (! set_url (c,
-                 pc->base_url))
-    return "Failed to set URL for curl request";
+  err = set_url (c,
+                 pc->base_url,
+                 pc);
+  if (NULL != err)
+    return err;
  if (CURLE_OK !=
      curl_easy_setopt (c,
                        CURLOPT_UPLOAD,
@@ -557,9 +675,10 @@ MHDT_client_put_data (
 const char *
 MHDT_client_chunk_data (
  const void *cls,
-  const struct MHDT_PhaseContext *pc)
+  struct MHDT_PhaseContext *pc)
 {
  const char *text = cls;
+  const char *err;
  struct ReadBuffer rb = {
    .buf = text,
    .len = strlen (text),
@@ -570,9 +689,11 @@ MHDT_client_chunk_data (
  c = curl_easy_init ();
  if (NULL == c)
    return "Failed to initialize Curl handle";
-  if (! set_url (c,
-                 pc->base_url))
-    return "Failed to set URL for curl request";
+  err = set_url (c,
+                 pc->base_url,
+                 pc);
+  if (NULL != err)
+    return err;
  if (CURLE_OK !=
      curl_easy_setopt (c,
                        CURLOPT_UPLOAD,
@@ -608,9 +729,10 @@ MHDT_client_chunk_data (
 const char *
 MHDT_client_do_post (
  const void *cls,
-  const struct MHDT_PhaseContext *pc)
+  struct MHDT_PhaseContext *pc)
 {
  const struct MHDT_PostInstructions *pi = cls;
+  const char *err;
  CURL *c;
  struct curl_slist *request_hdr = NULL;

@@ -626,9 +748,11 @@ MHDT_client_do_post (
  c = curl_easy_init ();
  if (NULL == c)
    return "Failed to initialize Curl handle";
-  if (! set_url (c,
-                 pc->base_url))
-    return "Failed to set URL for curl request";
+  err = set_url (c,
+                 pc->base_url,
+                 pc);
+  if (NULL != err)
+    return err;
  if (CURLE_OK !=
      curl_easy_setopt (c,
                        CURLOPT_POST,
@@ -0,0 +1,144 @@
+/*
+  This file is part of GNU libmicrohttpd
+  Copyright (C) 2016, 2024 Christian Grothoff & Evgeny Grin (Karlson2k)
+
+  GNU libmicrohttpd is free software; you can redistribute it and/or
+  modify it under the terms of the GNU Lesser General Public
+  License as published by the Free Software Foundation; either
+  version 2.1 of the License, or (at your option) any later version.
+
+  GNU libmicrohttpd is distributed in the hope that it will be useful,
+  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+  Lesser General Public License for more details.
+
+  You should have received a copy of the GNU Lesser General Public
+  License along with this library; if not, write to the Free Software
+  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+
+*/
+
+/**
+ * @file test_tls.c
+ * @brief  test with client against TLS server
+ * @author Christian Grothoff
+ */
+#include "libtest.h"
+
+
+int
+main (int argc, char *argv[])
+{
+  char *client_of_rca_private_key
+    = MHDT_load_pem ("client-of-rca-private-key");
+  char *client_of_rca_signed_cert
+    = MHDT_load_pem ("client-of-rca-signed-cert");
+  char *client_of_ica_private_key
+    = MHDT_load_pem ("client-of-ica-private-key");
+  char *client_of_ica_signed_cert
+    = MHDT_load_pem ("client-of-ica-signed-cert");
+  char *client_of_ica_chain
+    = MHDT_load_pem ("client-of-ica-chain");
+  struct MHD_DaemonOptionAndValue rca_options[] = {
+    MHD_D_OPTION_POLL_SYSCALL (MHD_SPS_AUTO),
+    MHD_D_OPTION_WM_WORKER_THREADS (1),
+    MHD_D_OPTION_TLS (MHD_TLS_BACKEND_ANY),
+    MHD_D_OPTION_TLS_CERT_KEY (client_of_rca_signed_cert,
+                               client_of_rca_private_key,
+                               "clientword"),
+    MHD_D_OPTION_TERMINATE ()
+  };
+  struct MHD_DaemonOptionAndValue ica_options[] = {
+    MHD_D_OPTION_POLL_SYSCALL (MHD_SPS_AUTO),
+    MHD_D_OPTION_WM_WORKER_THREADS (1),
+    MHD_D_OPTION_TLS (MHD_TLS_BACKEND_ANY),
+    MHD_D_OPTION_TLS_CERT_KEY (client_of_ica_chain,
+                               client_of_ica_private_key,
+                               "iclientword"),
+    MHD_D_OPTION_TERMINATE ()
+  };
+  struct ServerType
+  {
+    const char *label;
+    MHDT_ServerSetup server_setup;
+    void *server_setup_cls;
+    MHDT_ServerRunner server_runner;
+    void *server_runner_cls;
+    struct MHDT_Phase phase;
+  } configs[] = {
+    {
+      .label = "rca_server",
+      .server_setup = &MHDT_server_setup_minimal,
+      .server_setup_cls = rca_options,
+      .server_runner = &MHDT_server_run_minimal,
+      .phase = {
+        .label = "simple RCA get",
+        .server_cb = &MHDT_server_reply_text,
+        .server_cb_cls = (void *) "Hello world",
+        .client_cb = &MHDT_client_get_host,
+        .client_cb_cls = "client.ca.gnu",
+        .timeout_ms = 2500,
+        .use_tls = true,
+        .check_server_cert = true
+      }
+
+
+    },
+    {
+      .label = "ica_server",
+      .server_setup = &MHDT_server_setup_minimal,
+      .server_setup_cls = ica_options,
+      .server_runner = &MHDT_server_run_minimal,
+      .phase = {
+        .label = "simple ICA get",
+        .server_cb = &MHDT_server_reply_text,
+        .server_cb_cls = (void *) "Hello world",
+        .client_cb = &MHDT_client_get_host,
+        .client_cb_cls = "client.ica.gnu",
+        .timeout_ms = 2500,
+        .use_tls = true,
+        .check_server_cert = true
+      }
+
+
+    },
+    {
+      .label = "END"
+    }
+  };
+  unsigned int i;
+  int ret = 0;
+
+  (void) argc; /* Unused. Silence compiler warning. */
+  (void) argv; /* Unused. Silence compiler warning. */
+
+  for (i = 0; NULL != configs[i].server_setup; i++)
+  {
+    struct ServerType *st = &configs[i];
+    struct MHDT_Phase phases[2] = {
+      st->phase
+    };
+    fprintf (stderr,
+             "Running TLS tests with server setup '%s'\n",
+             st->label);
+    ret = MHDT_test (st->server_setup,
+                     st->server_setup_cls,
+                     st->server_runner,
+                     st->server_runner_cls,
+                     phases);
+    if (0 != ret)
+    {
+      fprintf (stderr,
+               "Test failed with server of type '%s' (%u)\n",
+               st->label,
+               i);
+      break;
+    }
+  }
+  free (client_of_rca_signed_cert);
+  free (client_of_rca_private_key);
+  free (client_of_ica_chain);
+  free (client_of_ica_signed_cert);
+  free (client_of_ica_private_key);
+  return ret;
+}
@@ -294,14 +294,13 @@ main (int argc, char *argv[])
    },
  };
  unsigned int i;
+  int ret = 0;

  (void) argc; /* Unused. Silence compiler warning. */
  (void) argv; /* Unused. Silence compiler warning. */

  for (i = 0; NULL != configs[i].server_setup; i++)
  {
-    int ret;
-
    fprintf (stderr,
             "Running TLS tests with server setup '%s'\n",
             configs[i].label);
@@ -316,8 +315,8 @@ main (int argc, char *argv[])
               "Test failed with server of type '%s' (%u)\n",
               configs[i].label,
               i);
-      return ret;
+      break;
    }
  }
-  return 0;
+  return ret;
 }