From 17f0e16ecc8bd1323cb25c1919f37beab7c9607d Mon Sep 17 00:00:00 2001
From: Vijo Cherian <codervijo@gmail.com>
Date: Tue, 9 May 2017 16:45:13 -0700
Subject: [PATCH] Removed all uses of temp files. Added needed files to GIT

---
 tests/Test-https-badcerts.px   |  59 ++-----------
 tests/Test-https-clientcert.px |  64 ++------------
 tests/Test-https-pfs.px        |   1 -
 tests/Test-https-selfsigned.px |  19 +----
 tests/Test-https-tlsv1.px      |   1 -
 tests/Test-https-tlsv1x.px     |   1 -
 tests/Test-https-weboftrust.px |  69 +++------------
 tests/certs/client.crt         | 148 ++++++++++++++++++++++++++++++++
 tests/certs/client.key         |  51 +++++++++++
 tests/certs/expired.crt        | 149 +++++++++++++++++++++++++++++++++
 tests/certs/expired.key        |  51 +++++++++++
 tests/certs/interca.crt        |  41 +++++++++
 tests/certs/interca.key        |  51 +++++++++++
 tests/certs/invalid.crt        | 149 +++++++++++++++++++++++++++++++++
 tests/certs/invalid.key        |  51 +++++++++++
 tests/certs/selfsigned.crt     |  33 ++++++++
 tests/certs/selfsigned.key     |  52 ++++++++++++
 tests/certs/user.crt           | 148 ++++++++++++++++++++++++++++++++
 tests/certs/user.key           |  51 +++++++++++
 19 files changed, 1001 insertions(+), 188 deletions(-)
 mode change 100755 => 100644 tests/Test-https-badcerts.px
 create mode 100644 tests/certs/client.crt
 create mode 100644 tests/certs/client.key
 create mode 100644 tests/certs/expired.crt
 create mode 100644 tests/certs/expired.key
 create mode 100644 tests/certs/interca.crt
 create mode 100644 tests/certs/interca.key
 create mode 100644 tests/certs/invalid.crt
 create mode 100644 tests/certs/invalid.key
 create mode 100644 tests/certs/selfsigned.crt
 create mode 100644 tests/certs/selfsigned.key
 create mode 100644 tests/certs/user.crt
 create mode 100644 tests/certs/user.key

diff --git a/tests/Test-https-badcerts.px b/tests/Test-https-badcerts.px
old mode 100755
new mode 100644
index 90e48cea..e21577e3
--- a/tests/Test-https-badcerts.px
+++ b/tests/Test-https-badcerts.px
@@ -6,10 +6,8 @@ use POSIX;
 use Socket;
 use WgetFeature qw(https ssl/openssl);
 use SSLTest;
-use File::Remove 'remove';
 
 ###############################################################################
-my @tempfiles;
 
 # code, msg, headers, content
 my %urls = (
@@ -38,10 +36,9 @@ if (@ARGV) {
 }
 $srcdir = Cwd::abs_path("$srcdir");
 
-my $cdir = $ENV{'PWD'};
 # HOSTALIASES env variable allows us to create hosts file alias.
 my $testhostname = "WgetTestingServer";
-$ENV{'HOSTALIASES'} = "$cdir/certs/wgethosts";
+$ENV{'HOSTALIASES'} = "$srcdir/certs/wgethosts";
 
 my $addr = gethostbyname($testhostname);
 unless ($addr)
@@ -55,45 +52,13 @@ unless (inet_ntoa($addr) =~ "127.0.0.1")
     exit 77;
 }
 
-# Create certindex
-push (@tempfiles, "$cdir/certindex");
-open  CERTID, ">", "$cdir/certindex" or
-      warn "Cannot overwrite file $cdir/certindex";
-close CERTID;
-
-# Create certserial
-push (@tempfiles, "$cdir/certserial");
-open  CERTSN, ">", "$cdir/certserial" or
-      warn "Cannot overwrite file $cdir/certserial";
-print CERTSN "1122";
-close CERTSN;
-
-# Create crlnumber
-push (@tempfiles, "$cdir/crlnumber");
-open  CRLN, ">", "$cdir/crlnumber" or
-      warn "Cannot overwrite file $cdir/crlnumber";
-print CRLN "1122";
-close CRLN;
-
 my $caconf     = "$srcdir/certs/rootca.conf";
 my $cacrt      = "$srcdir/certs/test-ca-cert.pem";
 my $cakey      = "$srcdir/certs/test-ca-key.pem";
 
-# Prepare expired server certificate
-my $servercrt  = "$cdir/tmpserver3.crt";
-my $serverkey  = "$cdir/tmpserver3.key";
-my $servercsr  = "$cdir/tmpserver3.csr";
-my $enddate    = strftime "%y%m%d%H%M%S%z", localtime(time-86400);
-my $startdate  = strftime "%y%m%d%H%M%S%z", localtime(time+86400);
-my $serversubj = "/C=US/ST=CA/L=Server Mystery Spot/O=Serv/CN=".
-                 "$testhostname/emailAddress=servertester";
-my $servercmd  = "openssl genrsa -out $serverkey 4096 && openssl req -new".
-                 " -sha256 -key $serverkey -out $servercsr -days 365 ".
-                 " -subj \"$serversubj\" &&".
-                 "openssl ca -batch -config $caconf -notext ".
-                 "-enddate $enddate -in $servercsr".
-                 " -out $servercrt";
-system($servercmd);
+# Use expired server certificate
+my $servercrt  = "$srcdir/certs/expired.crt";
+my $serverkey  = "$srcdir/certs/expired.key";
 
 my $servercheck =`(openssl x509 -noout -modulus -in $servercrt | openssl md5 ;
                    openssl rsa  -noout -modulus -in $serverkey | openssl md5) |
@@ -133,14 +98,9 @@ if ($sslsock->run() == 0)
 }
 print "Test successful.\n";
 
-system("/bin/rm $servercrt $serverkey $servercsr");
-$servercmd  = "openssl genrsa -out $serverkey 4096 && openssl req -new".
-              " -sha256 -key $serverkey -out $servercsr -days 365 ".
-              " -subj \"$serversubj\" &&".
-              "openssl ca -batch -config $caconf -notext ".
-              " -startdate $startdate -in $servercsr".
-              " -out $servercrt";
-system($servercmd);
+# Use certificate that is not yet valid
+$servercrt  = "$srcdir/certs/invalid.crt";
+$serverkey  = "$srcdir/certs/invalid.key";
 
 $servercheck =`(openssl x509 -noout -modulus -in $servercrt | openssl md5 ;
                 openssl rsa  -noout -modulus -in $serverkey | openssl md5) |
@@ -177,8 +137,3 @@ else
   exit -1;
 }
 # vim: et ts=4 sw=4
-
-END {
-    print "remove(@tempfiles);";
-    remove(@tempfiles);
-}
diff --git a/tests/Test-https-clientcert.px b/tests/Test-https-clientcert.px
index a011b42b..36365a52 100755
--- a/tests/Test-https-clientcert.px
+++ b/tests/Test-https-clientcert.px
@@ -5,10 +5,8 @@ use warnings;
 use Socket;
 use WgetFeature qw(https);
 use SSLTest;
-use File::Remove 'remove';
 
 ###############################################################################
-my @tempfiles;
 
 # code, msg, headers, content
 my %urls = (
@@ -37,7 +35,6 @@ if (@ARGV) {
 }
 $srcdir = Cwd::abs_path("$srcdir");
 
-my $cdir = $ENV{'PWD'};
 # HOSTALIASES env variable allows us to create hosts file alias.
 my $testhostname = "WgetTestingServer";
 $ENV{'HOSTALIASES'} = "$srcdir/certs/wgethosts";
@@ -54,47 +51,13 @@ unless (inet_ntoa($addr) =~ "127.0.0.1")
     exit 77;
 }
 
-# Create certindex
-my $certindex = "$cdir/certindex";
-push (@tempfiles, $certindex);
-open  CERTID, ">", $certindex or
-      warn "Cannot overwrite file $certindex";
-close CERTID;
-
-# Create certserial
-my $certserial = "$cdir/certserial";
-push (@tempfiles, $certserial);
-open  CERTSN, ">", $certserial or
-      warn "Cannot overwrite file $certserial";
-print CERTSN "1122";
-close CERTSN;
-
-# Create crlnumber
-my $crlnumber = "$cdir/crlnumber";
-push (@tempfiles, $crlnumber);
-open  CRLN, ">", $crlnumber or
-      warn "Cannot overwrite file $crlnumber";
-close CRLN;
-
-my $caconf     = "$srcdir/certs/rootca.conf";
 my $cacrt      = "$srcdir/certs/test-ca-cert.pem";
 my $cakey      = "$srcdir/certs/test-ca-key.pem";
 
 # Prepare server certificate
-my $servercrt  = "$cdir/tmpserver$$.crt";
-my $serverkey  = "$cdir/tmpserver$$.key";
-my $servercsr  = "$cdir/tmpserver$$.csr";
-push (@tempfiles, , $servercrt, $serverkey, $servercsr);
+my $servercrt  = "$srcdir/certs/server.crt";
+my $serverkey  = "$srcdir/certs/server.key";
 
-my $serversubj = "/C=US/ST=CA/L=Server Mystery Spot/O=Serv/CN=".
-                 "$testhostname/emailAddress=servertester";
-my $servercmd  = "openssl genrsa -out $serverkey 4096 && openssl req -new".
-                 " -sha256 -key $serverkey -out $servercsr -days 365 ".
-                 " -subj \"$serversubj\" &&".
-                 "openssl ca -batch -config $caconf -notext -in $servercsr".
-                 " -out $servercrt";
-
-system($servercmd);
 my $servercheck =`(openssl x509 -noout -modulus -in $servercrt | openssl md5 ;
                    openssl rsa  -noout -modulus -in $serverkey | openssl md5) |
                    uniq | wc -l`;
@@ -104,25 +67,15 @@ unless(-e $servercrt && -e $serverkey && $servercheck == 1)
     exit 77; # skip
 }
 
-# Prepare client certificate
-my $clientcert     = "$cdir/client.crt";
-my $clientkey      = "$cdir/client.key";
-my $clientcsr      = "$cdir/client.csr";
-push (@tempfiles, , $clientcert, $clientkey, $clientcsr);
-my $clientsubj     = "/C=US/ST=CA/L=Client Mystery Spot/O=Client/CN=".
-                     "Client Tester/emailAddress=clienttester";
-my $clientcertcmd  = "openssl genrsa  -out $clientkey 4096 &&".
-                     " openssl req -new -key $clientkey -out $clientcsr".
-                     "  -subj \"$clientsubj\" &&".
-                     " openssl ca -config $caconf -in $clientcsr ".
-                     "  -out $clientcert -batch";
+# Use client certificate
+my $clientcert     = "$srcdir/certs/client.crt";
+my $clientkey      = "$srcdir/certs/client.key";
 
-system($clientcertcmd);
 my $clientcheck=`(openssl x509 -noout -modulus -in $clientcert | openssl md5 ;
                   openssl rsa -noout -modulus -in $clientkey | openssl md5) |
                   uniq | wc -l`;
 
-# Check if  signed certificate and key are made correctly.
+# Check if client certificate and key are made correctly.
 unless(-e $clientcert && -e $clientkey && $clientcheck == 1)
 {
     exit 77; # skip
@@ -178,8 +131,3 @@ my $retryssl = SSLTest->new(cmdline  => $cmdline,
                            sslport   => $port);
 exit $retryssl->run();
 # vim: et ts=4 sw=4
-
-END {
-    print "remove(@tempfiles);\n";
-    remove(@tempfiles);
-}
diff --git a/tests/Test-https-pfs.px b/tests/Test-https-pfs.px
index e29bae71..1fb1c0a3 100755
--- a/tests/Test-https-pfs.px
+++ b/tests/Test-https-pfs.px
@@ -35,7 +35,6 @@ if (@ARGV) {
 }
 $srcdir = Cwd::abs_path("$srcdir");
 
-my $cdir = $ENV{'PWD'};
 # HOSTALIASES env variable allows us to create hosts file alias.
 my $testhostname = "WgetTestingServer";
 $ENV{'HOSTALIASES'} = "$srcdir/certs/wgethosts";
diff --git a/tests/Test-https-selfsigned.px b/tests/Test-https-selfsigned.px
index a2e60dc2..a0e6ac30 100755
--- a/tests/Test-https-selfsigned.px
+++ b/tests/Test-https-selfsigned.px
@@ -5,10 +5,8 @@ use warnings;
 use Socket;
 use WgetFeature qw(https);
 use SSLTest;
-use File::Remove 'remove';
 
 ###############################################################################
-my @tempfiles;
 
 # code, msg, headers, content
 my %urls = (
@@ -37,7 +35,6 @@ if (@ARGV) {
 }
 $srcdir = Cwd::abs_path("$srcdir");
 
-my $cdir = $ENV{'PWD'};
 # HOSTALIASES env variable allows us to create hosts file alias.
 my $testhostname = "WgetTestingServer";
 $ENV{'HOSTALIASES'} = "$srcdir/certs/wgethosts";
@@ -55,14 +52,9 @@ unless (inet_ntoa($addr) =~ "127.0.0.1")
 }
 
 # Prepare self-signed certificates
-my $certfile="$cdir/tmpsscert.pem";
-my $keyfile="$cdir/tmpsskey.pem";
-push (@tempfiles, $certfile, $keyfile);
-my $certsubj="/C=US/ST=CA/L=Mystery Spot/O=Dis/CN=$testhostname/emailAddress=tester";
-my $sscertcmd="openssl req -x509 -nodes -newkey rsa:4096 -keyout $keyfile ".
-              " -out $certfile -days 365 -subj \"$certsubj\"";
+my $certfile="$srcdir/certs/selfsigned.crt";
+my $keyfile="$srcdir/certs/selfsigned.key";
 
-system($sscertcmd);
 my $sscheck=`(openssl x509 -noout -modulus -in $certfile | openssl md5 ;
               openssl rsa  -noout -modulus -in $keyfile | openssl md5) |
               uniq|wc -l`;
@@ -119,9 +111,4 @@ my $retryssl = SSLTest->new(cmdline  => $cmdline,
                            lhostname => $testhostname,
                            sslport   => $port);
 exit $retryssl->run();
-# vim: et ts=4 sw=4
-
-END {
-    print "remove(@tempfiles);\n";
-    remove(@tempfiles);
-}
+# vim: et ts=4 sw=4
\ No newline at end of file
diff --git a/tests/Test-https-tlsv1.px b/tests/Test-https-tlsv1.px
index d6d49737..32ff63ae 100755
--- a/tests/Test-https-tlsv1.px
+++ b/tests/Test-https-tlsv1.px
@@ -35,7 +35,6 @@ if (@ARGV) {
 }
 $srcdir = Cwd::abs_path("$srcdir");
 
-my $cdir = $ENV{'PWD'};
 # HOSTALIASES env variable allows us to create hosts file alias.
 my $testhostname = "WgetTestingServer";
 $ENV{'HOSTALIASES'} = "$srcdir/certs/wgethosts";
diff --git a/tests/Test-https-tlsv1x.px b/tests/Test-https-tlsv1x.px
index f7cba0d7..080a9de6 100755
--- a/tests/Test-https-tlsv1x.px
+++ b/tests/Test-https-tlsv1x.px
@@ -36,7 +36,6 @@ if (@ARGV) {
 }
 $srcdir = Cwd::abs_path("$srcdir");
 
-my $cdir = $ENV{'PWD'};
 # HOSTALIASES env variable allows us to create hosts file alias.
 my $testhostname = "WgetTestingServer";
 $ENV{'HOSTALIASES'} = "$srcdir/certs/wgethosts";
diff --git a/tests/Test-https-weboftrust.px b/tests/Test-https-weboftrust.px
index dd659d15..efc4d409 100755
--- a/tests/Test-https-weboftrust.px
+++ b/tests/Test-https-weboftrust.px
@@ -5,10 +5,8 @@ use warnings;
 use Socket;
 use WgetFeature qw(https);
 use SSLTest;
-use File::Remove 'remove';
 
 ###############################################################################
-my @tempfiles;
 
 # code, msg, headers, content
 my %urls = (
@@ -37,7 +35,6 @@ if (@ARGV) {
 }
 $srcdir = Cwd::abs_path("$srcdir");
 
-my $cdir = $ENV{'PWD'};
 # HOSTALIASES env variable allows us to create hosts file alias.
 my $testhostname = "WgetTestingServer";
 $ENV{'HOSTALIASES'} = "$srcdir/certs/wgethosts";
@@ -54,53 +51,23 @@ unless (inet_ntoa($addr) =~ "127.0.0.1")
     exit 77;
 }
 
-# Create certindex
-push (@tempfiles, "$cdir/certindex");
-open  CERTID, ">", "$cdir/certindex" or
-      warn "Cannot overwrite file $cdir/certindex";
-close CERTID;
-
-# Create certserial
-push (@tempfiles, "$cdir/certserial");
-open  CERTSN, ">", "$cdir/certserial" or
-      warn "Cannot overwrite file $cdir/certserial";
-print CERTSN "1122";
-close CERTSN;
-
-# Create crlnumber
-push (@tempfiles, "$cdir/crlnumber");
-open  CRLN, ">", "$cdir/crlnumber" or
-      warn "Cannot overwrite file $cdir/crlnumber";
-close CRLN;
-
-# Create Intermediate CA
+# Use Intermediate CA
 my $caconf   = "$srcdir/certs/rootca.conf";
-my $icrtfile = "$cdir/interca.crt";
-my $ikeyfile = "$cdir/interca.key";
-my $icsrfile = "$cdir/interca.csr";
-push (@tempfiles, $icrtfile, $ikeyfile, $icsrfile);
-my $icasubj  = "/C=US/ST=CA/L=Intermediate Mystery Spot/O=Int/CN=".
-               "ica-$testhostname/emailAddress=icatester";
-my $icacmd   = "openssl genrsa -out $ikeyfile 4096 && openssl req -new".
-               " -sha256 -key $ikeyfile -out $icsrfile -days 365 ".
-               " -subj \"$icasubj\" &&".
-               "openssl ca -batch -config $caconf -notext -in $icsrfile".
-               " -out $icrtfile";
+my $icrtfile = "$srcdir/certs/interca.crt";
+my $ikeyfile = "$srcdir/certs/interca.key";
 
-system($icacmd);
 my $icacheck=`(openssl x509 -noout -modulus -in $icrtfile | openssl md5 ;
                openssl rsa  -noout -modulus -in $ikeyfile | openssl md5) |
                uniq | wc -l`;
-# Check if certificate and key are made correctly.
+# Check if certificate and key are correct.
 unless(-e $icrtfile && -e $ikeyfile && $icacheck == 1)
 {
     exit 77; # skip
 }
 
 # Now create web of trust - Root CA + Intermediate CA
-push (@tempfiles, "$cdir/wotca.pem");
-open  WOT, ">", "$cdir/wotca.pem" or
-      die "Cannot overwrite file $cdir/wotca";
+open  WOT, ">", "$srcdir/wotca.pem" or
+      die "Cannot overwrite file $srcdir/wotca";
 open  ICA, "<", $icrtfile or die "Cannot read file $icrtfile";
 while (<ICA>)
 {
@@ -118,21 +85,10 @@ print WOT "\n";
 close RCA;
 close WOT;
 
-# Create Test certificate using intermediate CA
-my $icaconf = "$srcdir/certs/interca.conf";
-my $usrcrt  = "$cdir/user.crt";
-my $usrkey  = "$cdir/user.key";
-my $usrcsr  = "$cdir/user.csr";
-push (@tempfiles, $usrcrt, $usrkey, $usrcsr);
-my $usrsubj = "/C=US/ST=CA/L=User Mystery Spot/O=Int/CN=$testhostname/".
-              "emailAddress=usertester";
-my $usrcmd  = "openssl genrsa -out $usrkey 4096 && ".
-              "openssl req -new -sha256 -key $usrkey -out $usrcsr -days".
-              " 365 -subj \"$usrsubj\" && ".
-              "openssl ca -batch -config $icaconf -notext -in $usrcsr ".
-              "-out $usrcrt";
+# User certificate using intermediate CA
+my $usrcrt  = "$srcdir/certs/user.crt";
+my $usrkey  = "$srcdir/certs/user.key";
 
-system($usrcmd);
 my $usrcheck=`(openssl x509 -noout -modulus -in $usrcrt | openssl md5 ;
                openssl rsa -noout -modulus -in $usrkey | openssl md5) |
                uniq | wc -l`;
@@ -171,7 +127,7 @@ if ($sslsock->run() == 0)
 
 # Retry the test with --no-check-certificate. expect success
 $port    = 31443;
-$cmdline = $WgetTest::WGETPATH . " --ca-certificate=$cdir/wotca.pem".
+$cmdline = $WgetTest::WGETPATH . " --ca-certificate=$srcdir/wotca.pem".
                                  " https://$testhostname:$port/somefile.txt";
 
 $expected_error_code = 0;
@@ -187,8 +143,3 @@ my $retryssl = SSLTest->new(cmdline  => $cmdline,
                            sslport   => $port);
 exit $retryssl->run();
 # vim: et ts=4 sw=4
-
-END {
-    print "remove(@tempfiles);\n";
-    remove(@tempfiles);
-}
diff --git a/tests/certs/client.crt b/tests/certs/client.crt
new file mode 100644
index 00000000..a2b58a9f
--- /dev/null
+++ b/tests/certs/client.crt
@@ -0,0 +1,148 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 4386 (0x1122)
+    Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, ST=CA, L=San Jose, O=Wget Testing Department, OU=Testing, CN=WgetTesting/emailAddress=bugs-wget@gnu.org
+        Validity
+            Not Before: May  9 21:08:52 2017 GMT
+            Not After : May  9 21:08:52 2019 GMT
+        Subject: CN=., ST=CA, C=US, O=Client
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (4096 bit)
+                Modulus:
+                    00:c8:e0:0f:fd:d5:96:99:1d:f5:8e:4a:d7:84:85:
+                    fc:48:8b:e4:cf:78:27:22:ea:1b:b4:4e:f0:a2:05:
+                    29:78:37:43:42:17:fe:8d:98:4b:4b:8a:f6:b2:92:
+                    23:2c:f2:af:c8:9d:36:57:03:90:82:00:02:0c:f8:
+                    33:14:f2:5c:5f:cc:8f:f8:14:b5:df:a8:e3:0d:d1:
+                    bf:5a:f2:8d:24:37:66:1a:31:99:7e:f7:8d:8e:86:
+                    fd:ea:a6:73:60:84:dc:1c:d9:28:87:92:9f:cf:c4:
+                    8e:9f:2b:ce:c3:8a:20:ce:8d:5b:66:fe:78:f1:bd:
+                    7b:57:b1:ad:bc:db:8c:0a:a8:92:c1:92:5d:6f:b9:
+                    5f:7f:c7:62:4d:59:60:48:8e:1f:a3:02:2f:79:26:
+                    68:6f:ed:0a:95:07:c8:e5:9a:93:ba:cb:af:c7:a9:
+                    06:a7:99:b4:ce:1f:26:b7:d5:f6:bd:b4:b2:ad:14:
+                    fe:df:8c:41:94:d4:d2:41:18:43:fe:19:0e:43:67:
+                    10:8a:ac:f1:47:1c:5a:71:ed:d7:76:aa:67:81:67:
+                    1d:6f:77:db:c1:93:ee:36:ec:34:6f:c8:97:73:57:
+                    09:dc:9a:b8:54:35:ae:a3:91:2a:5d:f3:e4:70:77:
+                    7c:bc:0d:d8:f5:a2:f0:2d:b2:ba:3e:b6:ce:8a:30:
+                    16:ea:6d:20:b8:ac:dd:eb:3c:a5:62:c5:7d:3a:ef:
+                    df:64:83:a7:ab:a1:c3:65:7a:54:fc:a4:26:0f:64:
+                    a5:83:ed:29:8f:05:ef:aa:2f:98:af:87:98:87:34:
+                    a7:31:55:09:75:37:7d:70:c3:44:14:c4:05:b2:f8:
+                    6b:6b:25:b4:55:d5:fe:29:3f:ab:f0:d1:e6:3f:dc:
+                    e9:c6:83:5d:f5:4a:ca:34:e0:3d:52:a4:dd:86:09:
+                    e5:3e:b3:9e:f3:79:99:af:b1:6b:7e:6e:c8:0d:04:
+                    28:fa:38:59:94:71:3c:d2:39:84:a5:56:41:ae:8c:
+                    63:2d:5c:9b:79:ce:f0:a6:69:6c:74:b7:36:e9:87:
+                    67:ad:5b:61:6f:d2:53:d4:7a:94:e1:26:29:d0:56:
+                    02:f5:6e:15:dc:a9:0b:e6:37:2a:32:9c:35:f3:72:
+                    2d:3d:e2:d4:25:48:a9:d0:c9:7b:cb:1a:4d:c1:44:
+                    5c:57:ab:75:65:ae:06:b2:40:b6:55:a8:2e:fb:fa:
+                    6e:0b:75:eb:86:02:ea:63:fe:9a:74:9d:02:4b:60:
+                    95:ef:53:04:13:87:07:6a:52:64:ba:e6:40:09:ab:
+                    a9:50:a3:12:ce:75:51:35:af:37:34:60:6a:e9:d7:
+                    3c:00:2b:4a:92:75:48:f3:4a:26:13:08:04:d0:47:
+                    05:a1:07
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+            X509v3 Subject Key Identifier: 
+                41:CD:E0:FB:C1:87:D6:77:38:B5:A3:94:8A:D0:5B:5C:87:70:32:E9
+            X509v3 Authority Key Identifier: 
+                keyid:17:ED:93:43:8F:A7:A6:00:75:D4:E8:B6:82:0D:88:37:7E:C0:6D:08
+
+            X509v3 Key Usage: 
+                Digital Signature, Key Encipherment, Certificate Sign, CRL Sign
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication
+            X509v3 CRL Distribution Points: 
+
+                Full Name:
+                  URI:http://test.wgettest.org/Bogus.crl
+
+                Full Name:
+                  URI:http://test.wgettest.org/Bogus.crl
+
+            X509v3 Subject Alternative Name: 
+                DNS:WgetTestingServer
+            Authority Information Access: 
+                CA Issuers - URI:http://test.wgettest.com/Bogus.crt
+                CA Issuers - URI:http://test.wgettest.com/Bogus.crt
+                OCSP - URI:http://test.wgettest.com/ocsp/
+                OCSP - URI:http://test.wgettest.com/ocsp/
+
+    Signature Algorithm: sha1WithRSAEncryption
+         46:a4:f3:c2:63:cf:c3:76:84:aa:a3:ba:27:32:25:15:54:e6:
+         69:d2:2f:7c:c9:68:88:01:10:8c:0d:4e:f7:3c:cc:e5:7f:e6:
+         87:55:e9:80:69:e0:05:cb:40:84:65:cc:4d:35:f3:a0:6a:95:
+         28:08:cb:95:16:9c:2b:d2:15:5b:d7:43:81:e1:ff:7e:e0:0f:
+         d7:25:01:f5:3d:d5:0f:88:15:1b:59:5f:6f:31:75:03:19:2b:
+         24:5a:d4:b4:e8:1a:19:81:c9:c6:b9:e2:b2:cb:dc:fd:b3:fc:
+         18:ec:76:68:2d:9e:78:41:31:0b:c0:f2:ca:70:93:66:6b:97:
+         cf:b8:8e:69:3e:86:63:7b:12:40:8f:1b:de:25:2a:a7:97:83:
+         4f:a1:7e:0b:07:15:bb:42:e9:a0:a8:80:17:c2:75:a9:35:e6:
+         57:bf:09:83:71:b5:51:3b:95:37:79:d6:8b:4e:96:86:22:d3:
+         54:53:ac:af:ea:ec:0c:58:4c:18:11:4d:77:35:ae:40:7c:6d:
+         5d:c5:36:46:19:fa:d9:83:76:cf:e6:70:69:3a:32:a3:0c:4f:
+         6f:28:18:0d:6a:d3:47:b4:e8:e3:77:a8:90:0d:74:08:f1:4e:
+         68:45:27:fc:22:57:ad:63:92:7c:fd:bf:44:ad:ec:be:12:42:
+         49:b9:e0:23:2c:95:98:f2:d3:07:a3:00:6a:4f:eb:3d:8b:6d:
+         c6:0a:ef:1e:c8:71:1b:d2:3b:2e:81:86:5b:36:05:6a:f4:3f:
+         25:cc:4a:d1:a4:d9:f6:8e:6d:a2:db:54:1e:c5:1b:dd:44:e3:
+         fc:0b:8b:8c:84:7d:e0:bf:1b:d4:53:3e:ab:31:fd:f4:25:1f:
+         29:b9:55:f0:92:0e:fe:ab:46:cc:a1:50:96:10:6a:d9:c0:cd:
+         6d:c1:e9:86:77:7e:ef:93:bf:be:03:21:87:d9:dc:36:53:41:
+         f6:a6:6c:f2:23:ee:be:34:4a:2e:95:29:09:7d:8f:1a:10:d2:
+         ff:a5:6b:26:93:e1:83:da:be:22:fd:7f:14:f2:1c:03:f5:64:
+         f8:75:00:f0:da:5e:78:e3:07:90:a0:4a:16:1c:31:70:09:b5:
+         46:4d:71:42:64:19:b0:53:ce:27:f7:9a:34:5d:c4:df:7d:06:
+         bf:af:8e:c2:9a:19:c1:f9:90:36:eb:41:0c:2c:3d:51:22:bb:
+         18:eb:ed:0b:5c:92:15:60:79:42:be:c1:f6:f1:46:29:c9:6c:
+         0a:ba:f9:4c:46:44:1e:32:7d:83:df:55:b1:31:1f:c2:db:22:
+         a4:bd:2d:79:d1:ca:a1:80:12:ce:5a:26:68:54:8b:d3:f4:8b:
+         cf:45:d3:57:92:70:b6:7c
+-----BEGIN CERTIFICATE-----
+MIIHDjCCBPagAwIBAgICESIwDQYJKoZIhvcNAQEFBQAwgZkxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTERMA8GA1UEBwwIU2FuIEpvc2UxIDAeBgNVBAoMF1dnZXQg
+VGVzdGluZyBEZXBhcnRtZW50MRAwDgYDVQQLDAdUZXN0aW5nMRQwEgYDVQQDDAtX
+Z2V0VGVzdGluZzEgMB4GCSqGSIb3DQEJARYRYnVncy13Z2V0QGdudS5vcmcwHhcN
+MTcwNTA5MjEwODUyWhcNMTkwNTA5MjEwODUyWjA3MQowCAYDVQQDDAEuMQswCQYD
+VQQIDAJDQTELMAkGA1UEBhMCVVMxDzANBgNVBAoMBkNsaWVudDCCAiIwDQYJKoZI
+hvcNAQEBBQADggIPADCCAgoCggIBAMjgD/3Vlpkd9Y5K14SF/EiL5M94JyLqG7RO
+8KIFKXg3Q0IX/o2YS0uK9rKSIyzyr8idNlcDkIIAAgz4MxTyXF/Mj/gUtd+o4w3R
+v1ryjSQ3ZhoxmX73jY6G/eqmc2CE3BzZKIeSn8/Ejp8rzsOKIM6NW2b+ePG9e1ex
+rbzbjAqoksGSXW+5X3/HYk1ZYEiOH6MCL3kmaG/tCpUHyOWak7rLr8epBqeZtM4f
+JrfV9r20sq0U/t+MQZTU0kEYQ/4ZDkNnEIqs8UccWnHt13aqZ4FnHW9328GT7jbs
+NG/Il3NXCdyauFQ1rqORKl3z5HB3fLwN2PWi8C2yuj62zoowFuptILis3es8pWLF
+fTrv32SDp6uhw2V6VPykJg9kpYPtKY8F76ovmK+HmIc0pzFVCXU3fXDDRBTEBbL4
+a2sltFXV/ik/q/DR5j/c6caDXfVKyjTgPVKk3YYJ5T6znvN5ma+xa35uyA0EKPo4
+WZRxPNI5hKVWQa6MYy1cm3nO8KZpbHS3NumHZ61bYW/SU9R6lOEmKdBWAvVuFdyp
+C+Y3KjKcNfNyLT3i1CVIqdDJe8saTcFEXFerdWWuBrJAtlWoLvv6bgt164YC6mP+
+mnSdAktgle9TBBOHB2pSZLrmQAmrqVCjEs51UTWvNzRgaunXPAArSpJ1SPNKJhMI
+BNBHBaEHAgMBAAGjggG/MIIBuzAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBRB
+zeD7wYfWdzi1o5SK0Ftch3Ay6TAfBgNVHSMEGDAWgBQX7ZNDj6emAHXU6LaCDYg3
+fsBtCDALBgNVHQ8EBAMCAaYwEwYDVR0lBAwwCgYIKwYBBQUHAwEwXQYDVR0fBFYw
+VDAooCagJIYiaHR0cDovL3Rlc3Qud2dldHRlc3Qub3JnL0JvZ3VzLmNybDAooCag
+JIYiaHR0cDovL3Rlc3Qud2dldHRlc3Qub3JnL0JvZ3VzLmNybDAcBgNVHREEFTAT
+ghFXZ2V0VGVzdGluZ1NlcnZlcjCByAYIKwYBBQUHAQEEgbswgbgwLgYIKwYBBQUH
+MAKGImh0dHA6Ly90ZXN0LndnZXR0ZXN0LmNvbS9Cb2d1cy5jcnQwLgYIKwYBBQUH
+MAKGImh0dHA6Ly90ZXN0LndnZXR0ZXN0LmNvbS9Cb2d1cy5jcnQwKgYIKwYBBQUH
+MAGGHmh0dHA6Ly90ZXN0LndnZXR0ZXN0LmNvbS9vY3NwLzAqBggrBgEFBQcwAYYe
+aHR0cDovL3Rlc3Qud2dldHRlc3QuY29tL29jc3AvMA0GCSqGSIb3DQEBBQUAA4IC
+AQBGpPPCY8/DdoSqo7onMiUVVOZp0i98yWiIARCMDU73PMzlf+aHVemAaeAFy0CE
+ZcxNNfOgapUoCMuVFpwr0hVb10OB4f9+4A/XJQH1PdUPiBUbWV9vMXUDGSskWtS0
+6BoZgcnGueKyy9z9s/wY7HZoLZ54QTELwPLKcJNma5fPuI5pPoZjexJAjxveJSqn
+l4NPoX4LBxW7QumgqIAXwnWpNeZXvwmDcbVRO5U3edaLTpaGItNUU6yv6uwMWEwY
+EU13Na5AfG1dxTZGGfrZg3bP5nBpOjKjDE9vKBgNatNHtOjjd6iQDXQI8U5oRSf8
+IletY5J8/b9Erey+EkJJueAjLJWY8tMHowBqT+s9i23GCu8eyHEb0jsugYZbNgVq
+9D8lzErRpNn2jm2i21QexRvdROP8C4uMhH3gvxvUUz6rMf30JR8puVXwkg7+q0bM
+oVCWEGrZwM1twemGd37vk7++AyGH2dw2U0H2pmzyI+6+NEoulSkJfY8aENL/pWsm
+k+GD2r4i/X8U8hwD9WT4dQDw2l544weQoEoWHDFwCbVGTXFCZBmwU84n95o0XcTf
+fQa/r47CmhnB+ZA260EMLD1RIrsY6+0LXJIVYHlCvsH28UYpyWwKuvlMRkQeMn2D
+31WxMR/C2yKkvS150cqhgBLOWiZoVIvT9IvPRdNXknC2fA==
+-----END CERTIFICATE-----
diff --git a/tests/certs/client.key b/tests/certs/client.key
new file mode 100644
index 00000000..31d556be
--- /dev/null
+++ b/tests/certs/client.key
@@ -0,0 +1,51 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIJKQIBAAKCAgEAyOAP/dWWmR31jkrXhIX8SIvkz3gnIuobtE7wogUpeDdDQhf+
+jZhLS4r2spIjLPKvyJ02VwOQggACDPgzFPJcX8yP+BS136jjDdG/WvKNJDdmGjGZ
+fveNjob96qZzYITcHNkoh5Kfz8SOnyvOw4ogzo1bZv548b17V7GtvNuMCqiSwZJd
+b7lff8diTVlgSI4fowIveSZob+0KlQfI5ZqTusuvx6kGp5m0zh8mt9X2vbSyrRT+
+34xBlNTSQRhD/hkOQ2cQiqzxRxxace3XdqpngWcdb3fbwZPuNuw0b8iXc1cJ3Jq4
+VDWuo5EqXfPkcHd8vA3Y9aLwLbK6PrbOijAW6m0guKzd6zylYsV9Ou/fZIOnq6HD
+ZXpU/KQmD2Slg+0pjwXvqi+Yr4eYhzSnMVUJdTd9cMNEFMQFsvhrayW0VdX+KT+r
+8NHmP9zpxoNd9UrKNOA9UqTdhgnlPrOe83mZr7Frfm7IDQQo+jhZlHE80jmEpVZB
+roxjLVybec7wpmlsdLc26YdnrVthb9JT1HqU4SYp0FYC9W4V3KkL5jcqMpw183It
+PeLUJUip0Ml7yxpNwURcV6t1Za4GskC2Vagu+/puC3XrhgLqY/6adJ0CS2CV71ME
+E4cHalJkuuZACaupUKMSznVRNa83NGBq6dc8ACtKknVI80omEwgE0EcFoQcCAwEA
+AQKCAgADk7HVNEt1OIpZ2U1TJ8uhQxR0+U/BGGgb4tf4Gp1tbZZ+A81dmhulIblY
+3q9PqpakvN/t1rtpBTUEJBtMwTAR6KObqErAy9IXOeftZ6pJvc7Mopt4HlJf+lll
+J0egrVz6CoflOiAsY/SiMvaAluIUq4G4KMngjB45JonQdhxdSDksxz1wst1XeiZu
++Ct1v0oi7fQIdT2g2Ji6pKPYKtN8nQnpRUJAE8WbcgSPe3jkUeZonJoZQvcb/los
+HJGBYdLWMmyh+4hkWsXlh3WxwEENldd5V6oLHWY9hiE86FaCEEe1rO+hWD9e3EPj
+3mbv9cC73IdDgH5EYg1c9oZhAZA23lvH1u8yFpfPAOdvl0X2T6rSmd0zWrrWpKem
+yoghSaW9rpWsM6rwI/B+gZlgwQQHLcRVrNJuXW7kTqRQnD+y9EM8HNddkNjmI6Op
+z135xRR4JNX15b1CCgiVWoHO/o/U/ivMRo4zjaoASxUB50TX9C+HTVY75Sr7tSAb
+v9/+8TWrCWJVXrCg/SddPF1DfBrpSPR77wa/zoD9IY7MHwnrmgdDt5I59Faa0KDF
+F1E0RLsVUUS8byLNcb26KpWUJQRi6ILr8KDQ+iVbk6QE/TqVQ5oxwmaa7dRdAL5s
+ao8gKU8XiGezbXFtN22adTEGIUPBAxGBcuEr8CYqlX1Gz0YvmQKCAQEA6wpdT6OZ
+s4bYuuMJiXxSwSSmXuqslP6JDSWliqznsJJnfn2Dy4+d945DRAE24IDgzJdrPtWv
+MfgRFJOG7Gri+7eVlLR7H+zfKnge/lOsdmVdBCrTiqTNt0XhAKZAEAq9j+4/5GMF
+bj9Mt9LUN12YgmVnWIfLgGDfQA0B5sTUjQwaSImAv4s24MLXW+sE8Jzq+k3C5u44
+oWqmU1LEBGqXVamtlM8xIRKghWVofeAVKjkGdUBrPptIEwYMAWub40Q2I9G7w5cF
+PGSFn51R8ahLOGICE42n3Aus0N6iDsNvDc2EdlR0NIKT0sbkya/sy9jgDLg1UhkG
+LJblXa5OXCDmWwKCAQEA2snBNmRuiczN43VzRgTVS840Ri46Hhx1BGaKRwNmGiTK
+4p/TLSnL1MgjdBLs/M678srxTSCzQX1YuV6G3p708ez+Q1IwHAuWiwBc7bmHHgxj
+v4gimIrPux+cMtOEmyxUL8s9leqZflGqoc3UILNNq9QcrVITcEkwCNqdpDk9vmii
+l54bjwuyad7IyFe7txIzLzNib5bbrK+t/R10RuvHKPaAeLDa1kDvwyOQa5ImRHWt
+yg1Kj63lVBwXJv+K6d+Z/NFMgT7fVJk70j6WcKfEcufyYdKzhkj+ai1wJzeQplu4
++x2YFS9ygonISPge+55LJ3PCLj0g0MIhPK+BI32nxQKCAQEA4HUDa1x3GeT68G6E
+2xEpDl3rq9U8fwUc6Ls8/dPlZtBJmZhP1oQOfS0Uu8rVF0y8YWVw+46hQnz+AsJo
+JTpmDbDiXiKFOpXBARO5tXM+zco7LBGh91MvSYioOTCLGUbIhL0nsvmFZCV7JElo
+dH8jd9NTAE6eXrkkOkyxtineOdyG9SKrG0DdZYNsmtEz5HxWQjckm9h/qFbrA8OU
+ggsw/pONuwCqkETzmrCfOyZVz/6pVivwvtcX22L48BpNwpmPgmF2iHCehXAR074v
+VTI8s1mVVgr/dLqJjOYvqR2l3m6Xw1EfsE3K0Y0zTBB/eKRiQoNgGEjhho+L9wzQ
+tFaO5QKCAQEAmYvCh5PQZ/FOBXYmIlu9/eeHlEFZFEzQavgzz0a5X1u273lPUYDl
+xj13dDzcCUhlay22T3TFmQ6JN/75FD/mk+rJPyHtFaGkU4U7srLj+tijIIZAEWJK
+C39RtfHwPJ7NroUqgY4VjyttXwT+/LwZpJ/GSHUzozgZ9/zFab2qcXkpstKJcMi6
+u8ZYjxHTcdXaCiQ7zyjGntjkeKE1O5i5OyxUWV91FayZGBBbiMMXDDCyePz++PsH
+2RGlxf7N1PjSLzYMRSCEx/CKpTC7j/CN1D6oQrMGvxV3R7j/3uYGJFp25fWNCEE2
+Uhq0b1GDHP+oqtV4z86iux+jB937+ZZ0KQKCAQBetr8pywp3jftYVhGU9+VZxYc/
+2vM5+WEdOqJAoHwXed5AMHReycKUmbDilWbswXyiBDGmIokoMKP09JMXfCbHMTkX
+LZCsxFGUpzAGg7sHI1NLTqWGU+fOmtzg7SJ77tZqJj1zzmgLX54oQ9qx53V6StWV
+Zw7YxkRbnLQ+LZU0HyYb11v5oh1CnWUoGINMkV6Bhv+jPCzUP/vs4/JgOFqhwjlN
+GVX0ewFGykinTK34ia9TI1Updgb3FWt3i9+twwAis1nnnuHt19tdi22BPwAuyFPx
+hsf5t4Kcm8xibjeHzQMLqP4v2arW09zsg5kDTQHoQDcUajJ+cdbpY2PeosfN
+-----END RSA PRIVATE KEY-----
diff --git a/tests/certs/expired.crt b/tests/certs/expired.crt
new file mode 100644
index 00000000..189fbf7d
--- /dev/null
+++ b/tests/certs/expired.crt
@@ -0,0 +1,149 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 4386 (0x1122)
+    Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, ST=CA, L=San Jose, O=Wget Testing Department, OU=Testing, CN=WgetTesting/emailAddress=bugs-wget@gnu.org
+        Validity
+            Not Before: May  9 23:18:01 2017 GMT
+            Not After : May  8 16:03:42 2017
+        Subject: CN=WgetTestingServer, ST=CA, C=US/emailAddress=servertester, O=Serv
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (4096 bit)
+                Modulus:
+                    00:ae:3f:e9:b2:ec:0e:04:a5:e6:e0:07:c0:80:ef:
+                    e2:50:58:de:31:02:08:a5:33:3e:58:68:41:13:76:
+                    64:cb:84:35:1a:1f:31:6c:4b:ad:11:da:0c:27:40:
+                    c4:ff:0e:32:13:56:dd:0b:4c:eb:9e:6c:ee:67:3f:
+                    16:57:d3:4c:5c:df:13:fe:15:38:f4:dd:04:8b:b5:
+                    dc:06:9c:5b:11:bb:93:88:5e:a0:48:c2:3d:74:d3:
+                    2b:20:53:8f:91:fa:7d:3a:97:35:54:d2:36:95:9e:
+                    81:24:66:b8:eb:91:9e:a2:4e:9b:34:c2:6c:b0:52:
+                    c9:1b:8c:c8:13:37:a1:d6:48:6a:90:7b:ad:22:9e:
+                    58:01:7c:87:44:5f:97:69:a9:bd:96:74:b7:0e:eb:
+                    8e:4a:f8:19:e4:e2:4d:80:31:e5:19:5a:cc:cc:00:
+                    9c:94:3d:b2:27:26:5c:9c:50:35:92:2c:3b:77:38:
+                    f8:4c:99:99:89:9e:82:1f:f6:da:40:4d:d3:bf:60:
+                    f9:a3:23:cc:b8:fe:bb:e7:48:e2:5d:e8:8f:bc:16:
+                    1a:1f:8c:10:fe:92:b9:de:80:00:6f:45:db:24:01:
+                    68:4a:b6:ce:16:2f:07:b2:bc:61:ff:94:77:76:ca:
+                    d6:8d:f4:f1:ea:10:7b:df:59:ac:1b:75:69:b9:3f:
+                    50:dc:f5:f3:28:b1:9a:c0:a1:67:45:87:88:1c:db:
+                    4a:53:05:47:7e:cb:a7:ef:de:ed:84:af:e0:48:4d:
+                    0c:2a:e2:9f:66:3e:20:40:a5:4b:ef:7b:ff:fd:50:
+                    8d:2c:87:27:a3:94:0c:16:44:bc:21:54:84:0b:86:
+                    34:fd:9b:53:06:9d:31:81:27:e7:4e:28:0c:69:5d:
+                    fd:10:4e:6e:02:20:91:6b:58:5b:2d:c9:f7:b7:e2:
+                    64:7c:a9:ab:e0:a3:2b:05:f5:33:11:11:db:52:39:
+                    b3:a2:74:58:8a:5b:e0:ac:78:14:4c:ec:c0:e4:1f:
+                    6b:6f:f5:72:36:bb:15:53:4c:59:7e:07:d0:46:ad:
+                    88:cc:49:c5:ef:a8:0a:35:68:e5:5d:45:6d:d3:fe:
+                    0e:60:eb:d8:96:25:e4:50:7e:e2:66:af:e3:dd:fa:
+                    0f:98:2b:9e:ef:e7:f4:f0:27:e7:23:a2:7c:e2:82:
+                    2a:fd:d6:18:ee:bc:0d:fc:a0:7d:8e:7c:b4:05:a4:
+                    8e:6f:4d:1e:c8:70:4c:2e:b4:36:74:68:c3:bc:61:
+                    f6:f8:b2:bb:dc:b2:2f:e9:90:82:cf:0e:09:bf:89:
+                    3d:30:7e:0c:71:76:d0:fa:5b:4b:70:fe:0b:c5:ce:
+                    03:1f:c4:b8:13:f2:e6:dd:b4:86:4f:81:56:41:e8:
+                    04:ea:43
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+            X509v3 Subject Key Identifier: 
+                79:4B:2E:34:36:F0:56:99:AF:B8:D3:E3:6D:26:CF:18:12:59:7A:4E
+            X509v3 Authority Key Identifier: 
+                keyid:17:ED:93:43:8F:A7:A6:00:75:D4:E8:B6:82:0D:88:37:7E:C0:6D:08
+
+            X509v3 Key Usage: 
+                Digital Signature, Key Encipherment, Certificate Sign, CRL Sign
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication
+            X509v3 CRL Distribution Points: 
+
+                Full Name:
+                  URI:http://test.wgettest.org/Bogus.crl
+
+                Full Name:
+                  URI:http://test.wgettest.org/Bogus.crl
+
+            X509v3 Subject Alternative Name: 
+                DNS:WgetTestingServer
+            Authority Information Access: 
+                CA Issuers - URI:http://test.wgettest.com/Bogus.crt
+                CA Issuers - URI:http://test.wgettest.com/Bogus.crt
+                OCSP - URI:http://test.wgettest.com/ocsp/
+                OCSP - URI:http://test.wgettest.com/ocsp/
+
+    Signature Algorithm: sha1WithRSAEncryption
+         54:0d:c4:43:cb:0d:9e:0e:33:00:c8:03:cd:f8:cc:96:5b:8e:
+         78:35:87:91:ee:4d:8e:9e:84:07:c8:4a:82:cc:6b:34:5a:0a:
+         25:45:ad:e6:ef:3e:6d:78:5d:9e:28:07:8a:c8:42:8a:b6:62:
+         de:8a:08:02:e8:b2:64:6e:a5:7b:ad:90:b0:4a:c8:ca:65:d4:
+         e8:cf:5a:3e:e0:45:2b:c3:6c:a8:2f:d7:5d:aa:e0:53:f6:54:
+         d1:76:5e:9e:02:6e:0c:a4:b8:73:8f:7f:8d:e3:a7:54:f6:5b:
+         d2:f8:25:61:a5:2c:ce:ab:41:dc:b1:ca:86:cc:5b:a3:cc:7a:
+         90:44:dd:54:69:b0:f7:e1:19:6b:94:09:9e:44:5d:e5:f3:97:
+         99:d1:9d:2b:4d:b4:e1:3e:2a:3e:73:d3:9c:e5:97:9f:02:50:
+         06:31:28:86:d4:48:44:96:59:9a:18:ad:c3:61:28:79:e8:d9:
+         f0:fb:8b:d5:54:70:66:ab:87:c9:3f:40:ac:1a:c1:74:55:89:
+         ab:e1:8e:6d:d8:69:fb:04:8b:2f:69:16:21:fa:ec:b5:af:39:
+         8a:e2:48:bd:f4:64:c7:15:c8:21:3e:3a:02:b1:55:ff:02:60:
+         09:8f:ae:03:8b:2c:1f:eb:ef:20:1b:59:ca:00:e7:4c:8b:8f:
+         91:22:3e:ac:84:96:54:15:53:5d:fb:23:c5:53:f4:75:1c:68:
+         3b:5a:e4:f6:26:40:7c:be:cc:af:a0:4a:7e:2f:64:8d:a6:ba:
+         f3:bb:e2:e3:a6:94:07:ca:4b:bc:3b:1c:75:70:23:10:f2:71:
+         95:86:ac:bf:36:db:a4:56:ba:bb:7e:63:82:ba:ca:3a:a4:36:
+         cb:cb:7f:47:53:d6:92:8d:ef:8b:75:24:7b:49:89:a5:f6:73:
+         f9:f2:dd:66:77:fe:1e:93:80:b0:37:b5:47:16:ec:97:f8:d2:
+         69:9b:f4:11:f3:bc:3a:b9:3e:4a:08:29:67:ea:38:36:41:6e:
+         58:f7:fb:2b:6f:31:d6:6c:1f:ce:6f:12:ea:bd:6c:00:06:f4:
+         65:6b:fa:8a:0a:13:a4:19:67:91:a3:3b:6c:2c:25:89:6a:83:
+         95:ce:43:2d:6e:7c:ec:4d:5e:7b:59:57:7f:97:ae:79:67:50:
+         e1:7c:42:7e:95:f5:54:4f:ef:88:70:25:9d:b5:2c:74:7f:f8:
+         c5:d6:f9:8a:72:a2:e6:08:8d:50:05:e9:72:4d:d0:dd:70:8b:
+         d7:6a:27:af:82:b8:47:dd:83:15:0c:a5:d3:77:fe:13:16:f3:
+         e0:a4:34:29:98:58:a4:29:94:85:92:e0:26:b6:14:f5:a6:82:
+         b7:7c:45:22:0d:aa:40:c6
+-----BEGIN CERTIFICATE-----
+MIIHPTCCBSWgAwIBAgICESIwDQYJKoZIhvcNAQEFBQAwgZkxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTERMA8GA1UEBwwIU2FuIEpvc2UxIDAeBgNVBAoMF1dnZXQg
+VGVzdGluZyBEZXBhcnRtZW50MRAwDgYDVQQLDAdUZXN0aW5nMRQwEgYDVQQDDAtX
+Z2V0VGVzdGluZzEgMB4GCSqGSIb3DQEJARYRYnVncy13Z2V0QGdudS5vcmcwIhcN
+MTcwNTA5MjMxODAxWhcRMTcwNTA4MTYwMzQyLTA3MDAwYjEaMBgGA1UEAwwRV2dl
+dFRlc3RpbmdTZXJ2ZXIxCzAJBgNVBAgMAkNBMQswCQYDVQQGEwJVUzEbMBkGCSqG
+SIb3DQEJARYMc2VydmVydGVzdGVyMQ0wCwYDVQQKDARTZXJ2MIICIjANBgkqhkiG
+9w0BAQEFAAOCAg8AMIICCgKCAgEArj/psuwOBKXm4AfAgO/iUFjeMQIIpTM+WGhB
+E3Zky4Q1Gh8xbEutEdoMJ0DE/w4yE1bdC0zrnmzuZz8WV9NMXN8T/hU49N0Ei7Xc
+BpxbEbuTiF6gSMI9dNMrIFOPkfp9Opc1VNI2lZ6BJGa465Geok6bNMJssFLJG4zI
+Ezeh1khqkHutIp5YAXyHRF+Xaam9lnS3DuuOSvgZ5OJNgDHlGVrMzACclD2yJyZc
+nFA1kiw7dzj4TJmZiZ6CH/baQE3Tv2D5oyPMuP6750jiXeiPvBYaH4wQ/pK53oAA
+b0XbJAFoSrbOFi8Hsrxh/5R3dsrWjfTx6hB731msG3VpuT9Q3PXzKLGawKFnRYeI
+HNtKUwVHfsun797thK/gSE0MKuKfZj4gQKVL73v//VCNLIcno5QMFkS8IVSEC4Y0
+/ZtTBp0xgSfnTigMaV39EE5uAiCRa1hbLcn3t+JkfKmr4KMrBfUzERHbUjmzonRY
+ilvgrHgUTOzA5B9rb/VyNrsVU0xZfgfQRq2IzEnF76gKNWjlXUVt0/4OYOvYliXk
+UH7iZq/j3foPmCue7+f08CfnI6J84oIq/dYY7rwN/KB9jny0BaSOb00eyHBMLrQ2
+dGjDvGH2+LK73LIv6ZCCzw4Jv4k9MH4McXbQ+ltLcP4Lxc4DH8S4E/Lm3bSGT4FW
+QegE6kMCAwEAAaOCAb8wggG7MA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFHlL
+LjQ28FaZr7jT420mzxgSWXpOMB8GA1UdIwQYMBaAFBftk0OPp6YAddTotoINiDd+
+wG0IMAsGA1UdDwQEAwIBpjATBgNVHSUEDDAKBggrBgEFBQcDATBdBgNVHR8EVjBU
+MCigJqAkhiJodHRwOi8vdGVzdC53Z2V0dGVzdC5vcmcvQm9ndXMuY3JsMCigJqAk
+hiJodHRwOi8vdGVzdC53Z2V0dGVzdC5vcmcvQm9ndXMuY3JsMBwGA1UdEQQVMBOC
+EVdnZXRUZXN0aW5nU2VydmVyMIHIBggrBgEFBQcBAQSBuzCBuDAuBggrBgEFBQcw
+AoYiaHR0cDovL3Rlc3Qud2dldHRlc3QuY29tL0JvZ3VzLmNydDAuBggrBgEFBQcw
+AoYiaHR0cDovL3Rlc3Qud2dldHRlc3QuY29tL0JvZ3VzLmNydDAqBggrBgEFBQcw
+AYYeaHR0cDovL3Rlc3Qud2dldHRlc3QuY29tL29jc3AvMCoGCCsGAQUFBzABhh5o
+dHRwOi8vdGVzdC53Z2V0dGVzdC5jb20vb2NzcC8wDQYJKoZIhvcNAQEFBQADggIB
+AFQNxEPLDZ4OMwDIA834zJZbjng1h5HuTY6ehAfISoLMazRaCiVFrebvPm14XZ4o
+B4rIQoq2Yt6KCALosmRupXutkLBKyMpl1OjPWj7gRSvDbKgv112q4FP2VNF2Xp4C
+bgykuHOPf43jp1T2W9L4JWGlLM6rQdyxyobMW6PMepBE3VRpsPfhGWuUCZ5EXeXz
+l5nRnStNtOE+Kj5z05zll58CUAYxKIbUSESWWZoYrcNhKHno2fD7i9VUcGarh8k/
+QKwawXRViavhjm3YafsEiy9pFiH67LWvOYriSL30ZMcVyCE+OgKxVf8CYAmPrgOL
+LB/r7yAbWcoA50yLj5EiPqyEllQVU137I8VT9HUcaDta5PYmQHy+zK+gSn4vZI2m
+uvO74uOmlAfKS7w7HHVwIxDycZWGrL8226RWurt+Y4K6yjqkNsvLf0dT1pKN74t1
+JHtJiaX2c/ny3WZ3/h6TgLA3tUcW7Jf40mmb9BHzvDq5PkoIKWfqODZBblj3+ytv
+MdZsH85vEuq9bAAG9GVr+ooKE6QZZ5GjO2wsJYlqg5XOQy1ufOxNXntZV3+Xrnln
+UOF8Qn6V9VRP74hwJZ21LHR/+MXW+YpyouYIjVAF6XJN0N1wi9dqJ6+CuEfdgxUM
+pdN3/hMW8+CkNCmYWKQplIWS4Ca2FPWmgrd8RSINqkDG
+-----END CERTIFICATE-----
diff --git a/tests/certs/expired.key b/tests/certs/expired.key
new file mode 100644
index 00000000..a8e87a6d
--- /dev/null
+++ b/tests/certs/expired.key
@@ -0,0 +1,51 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIJKQIBAAKCAgEArj/psuwOBKXm4AfAgO/iUFjeMQIIpTM+WGhBE3Zky4Q1Gh8x
+bEutEdoMJ0DE/w4yE1bdC0zrnmzuZz8WV9NMXN8T/hU49N0Ei7XcBpxbEbuTiF6g
+SMI9dNMrIFOPkfp9Opc1VNI2lZ6BJGa465Geok6bNMJssFLJG4zIEzeh1khqkHut
+Ip5YAXyHRF+Xaam9lnS3DuuOSvgZ5OJNgDHlGVrMzACclD2yJyZcnFA1kiw7dzj4
+TJmZiZ6CH/baQE3Tv2D5oyPMuP6750jiXeiPvBYaH4wQ/pK53oAAb0XbJAFoSrbO
+Fi8Hsrxh/5R3dsrWjfTx6hB731msG3VpuT9Q3PXzKLGawKFnRYeIHNtKUwVHfsun
+797thK/gSE0MKuKfZj4gQKVL73v//VCNLIcno5QMFkS8IVSEC4Y0/ZtTBp0xgSfn
+TigMaV39EE5uAiCRa1hbLcn3t+JkfKmr4KMrBfUzERHbUjmzonRYilvgrHgUTOzA
+5B9rb/VyNrsVU0xZfgfQRq2IzEnF76gKNWjlXUVt0/4OYOvYliXkUH7iZq/j3foP
+mCue7+f08CfnI6J84oIq/dYY7rwN/KB9jny0BaSOb00eyHBMLrQ2dGjDvGH2+LK7
+3LIv6ZCCzw4Jv4k9MH4McXbQ+ltLcP4Lxc4DH8S4E/Lm3bSGT4FWQegE6kMCAwEA
+AQKCAgBuDY/coZp49Q9Mj5jV1qxpcrdi3JX5QNQvoij30d73axje1rSwYVt92umy
+IQZK0Pxvmn0hlgN6m/I243GJJrskLQDDiUPf43frhYDh6/7YxE/54Un6qjOGhZjH
+Yf9bg4l0Z+wXFm3DMcj+5KIGpoI6oMsGF4XuF1tNOy1iddCRNkuX1YUUSE3tImmM
+lZNb+Qj07eJwWfYVA33XQdcREHJSATc34WsDdbP/Zgs37rDnEWi9dA3e02RVtvcY
+mSBfXMhQJz+D+ihi7wBeo3nVNf0SHiOBqUVSg/lAvjeID+bIZtsn1S10dV+3U6PR
+eEO7k4DPR9VCsAaMmmZJMW8EwSigWyj9zJRiHiJGdmdAKEcR/hYwNafNmCByeuHb
+TYoSE6ngEZhSxc7OmuYBCFR8mlCAt0jmtVBn3a3CGPjIb5Awoa3xAVTXRgW2iUpt
+gISWhx14710LUAr9WxpnhGSL6//ynPlzPde+0yjGqVW7ut+wOj3NL7OUbneSnmmb
+rG4i+FvSFlKj+BI7j5G2SuKXxu7fTT8hGdRb1QCgYaXEuU4AwiQ4lCqsMRN5u0lX
+QX4hlWOebvqcCPpFQTDajA2tQQzCec1Auv8FIWZTVXHc4a+fSOuv9O7pWZlAOf/J
+NDghY1GWjxmX1Qha8JRlWHE0m8LkowS93L3Ce0rO00kjMdB8AQKCAQEA1S+jtRT1
+2BsXrTHiFOq8RpO7oL5GstG2on6kjSQ/pGaajZBC8wkZ6C8lHQ/9xYeZ6oKMpeE8
+l4lmymhMk8IvQNyQhBiNNZlHaePIpmVEcU9gRzPmbbpzgHY5PgPxEknv6Hs6HwQv
+7k86xJd+pN828D1sXZyu1ehwjpiOQ0HqZY4Qhac7yw+efuV4krchVaw0075YemcD
+7SU/5cRgH3PAV9WUt/fhowYuotV2McAyoDgmU8Ni2WAgwYtd4Ia4R3dhx3cC78Ae
+qqnp9WtF2U6YE8ie7DIzPIr/tJruMQvONpnffUFavEOR2fcKombWPdhPzO8IwiTa
+4p5OfZcGt4fjYwKCAQEA0T53fnBToJlvgZZQDa0badiVrGWiDEG9D4gYbEEuDXYg
+IKDJXCjIDy+SJn3YRqPtgq/YmUT9++FpOB7RCi8rj5mZXWndLm+Xa7shZDxzl8fU
+9Ryf2GP5ogGkgQ4OiS+qgNF3znSYFYNRTzHscN++y7xPmoRE6NspOSfewft9pGcF
+ffmUK3b6uEo2lbcCAZFjcjChdUV137/FqUb8v4B/prH+GTQcfCFYx6CZQ4CtAQyB
+FplpSffAcxmnYND6VbtISdierraiclc6+Yql4TeVwWW2GRMGIQU8d6m2yDPwKdl7
+v3swK0Mw73jgyViooVbYcQw6x37TESf3VCY0ZIRDoQKCAQEAwFaS5LVcePU4j1IK
+H8UIyMRQ692/+2Wp2UFZRN4HbVQE7OPTA2KatRiT63yaALUu8J2IN8DW4gFddBBV
+xpnT+DkHSaa9ADaib67LQRTsgy6SNqtkomst+iCv1HvJ7C44/Q7wiTtF40QoSWZF
+JIsfDfDc7DiIpQVpR73r3FKEH8vkrDENiU82OFbgSb5fnOQZZVC+kvCOYk7RL4PV
+FYthZd2Up8ZFFMhnGxJr6Mb25gbCzZ/idyx7YSNUN1ZUvGXBGi0NwTEcee2C36FB
+C6YVHwRKHd/Myjq+KTv+2tFD449AS8nDC0gLNxPjzFHryTB4DvU6ea62rO8W8cho
+jv1S8QKCAQEAkt+YHOZXrRlGjd2mn5Ls9SUUGojUcGoMfUR4cDRoUQajkoOKE+iE
+VTR9EAuxrhQO+XbZQOyOoykcJEptTQrDNu8IGevfV2L5FKOr0qIkOVwJfWv0P34d
+kbw5bmUhiuYsdnOR9xccUa11e3N9ldVYJcYu0jUZ8aE0lGwKDnurO6Uc08pGWSQQ
+5R8ipYBqJhOZjGPaUWjKTp5b7nBnpTxbXfT+eU582BzIJofyTNGbnmraibRxlXwU
+WDafqHPH5DmrijpFWDnWWRAl01ehDC9qLPBqG7ugx7jXMt+r72eVoqqIFGYx74wg
+Y1ej4XEcHPPKxb9h2vqIyTgWgbi3ef7lQQKCAQArPFevYXs5gSEEwA1XjksfsIr1
+iKJ2UYpHE3R78bL2BtaFAdf6xR06RSZRp3nvBkB3K/Tc0l0i7/tTNrBIkvV6CO/x
+Pk+cn1w2ppILmvdE0uL8oJR2vpRtcOGDpbKov4J/pu6ddPKIfPaT/mfcUqbsYKOe
+E1dhQ+ssJKatGWNrCilWXk+ua+D8Kf0dGIuXfKAggQUfB8AP0zGvYYdT5FhKQ4iW
+EBa+CKa8HX4irRc2a9YWzosOGPnwFIhyuF9HXaQdaC69rDwkh0UpWVUR/o47csiS
+irMWAUfgNHmzBnRH0IOk3IIKDZv+ZFrXMPW6MtufhTBOb7p5Roy2YP+aVGNI
+-----END RSA PRIVATE KEY-----
diff --git a/tests/certs/interca.crt b/tests/certs/interca.crt
new file mode 100644
index 00000000..6cbf0ceb
--- /dev/null
+++ b/tests/certs/interca.crt
@@ -0,0 +1,41 @@
+-----BEGIN CERTIFICATE-----
+MIIHOTCCBSGgAwIBAgICESMwDQYJKoZIhvcNAQEFBQAwgZkxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTERMA8GA1UEBwwIU2FuIEpvc2UxIDAeBgNVBAoMF1dnZXQg
+VGVzdGluZyBEZXBhcnRtZW50MRAwDgYDVQQLDAdUZXN0aW5nMRQwEgYDVQQDDAtX
+Z2V0VGVzdGluZzEgMB4GCSqGSIb3DQEJARYRYnVncy13Z2V0QGdudS5vcmcwHhcN
+MTcwNTA5MjEyNDMwWhcNMTkwNTA5MjEyNDMwWjBiMR4wHAYDVQQDDBVpY2Etd2dl
+dFRlc3RpbmdTZXJ2ZXIxCzAJBgNVBAgMAkNBMQswCQYDVQQGEwJVUzEYMBYGCSqG
+SIb3DQEJARYJaWNhdGVzdGVyMQwwCgYDVQQKDANJbnQwggIiMA0GCSqGSIb3DQEB
+AQUAA4ICDwAwggIKAoICAQCpFc5lZraIIP8PVVbnwSrE11p2kjVgzDPwIJ/bDYGd
+60VEMc2ehVOMtj3lFbAUu4nb6j7IbAGB4bUqg4BUVfRodvd2f1WsfAfhf3AUnpI0
+c+ytK8HuXSfv3s44+/iQJftLE0kTADZf9iV/GxdEbhwQXBWku0xU/mxRH4zxDGwZ
+6gurQ96Md6DVUgnZsnRgrukQikr9C5e8cbKj7FHLZgq9E+NlGppmKi8qGTUXK17L
+cLBEP04glOnMuRQKB6SCIoX+VCiw33hWYfzIiXDKFqcj0liYANyLbM9TiFITGyTj
+Jr+Ne1Lac0HlNd8vNeP6IPBjViNZ8Iw3GYly1i8li4THzo8VpXBkJlwOLEYSq9Hr
+ZJ0QzUbyzVTLdhlCBhFme17Z9PxQyBr+2A0Lp+r/oKdr+KfMYZN3tzV3YozSw5d6
+4uV2Nz9pVCmLjR8UAV6cJqJILAxCQRVs4Qs7Ko3mGWKWi3T5xxvFy8gQrNHg7+IN
+g+0OhsIkfHTGsfW7WGukGhfmispi6sjrbNABRws8Vlr7JcVNFS4uu4H3cVCZ3Rde
+9IduNYs0gqss4SYMAxKAz0/M7OCY8Z9obh7zIdsG1A2S07cv9OMsjgPhLiO/i4HF
+RriQtYR5sWZKkmZgmS68aJuh/JLijlF/m2HLbI5gSlgwuSAtKUj2C68mTrXZJ3Xl
+IwIDAQABo4IBvzCCAbswDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUJNB884gq
+c/+HoMtp4GsuFr1O1eYwHwYDVR0jBBgwFoAUF+2TQ4+npgB11Oi2gg2IN37AbQgw
+CwYDVR0PBAQDAgGmMBMGA1UdJQQMMAoGCCsGAQUFBwMBMF0GA1UdHwRWMFQwKKAm
+oCSGImh0dHA6Ly90ZXN0LndnZXR0ZXN0Lm9yZy9Cb2d1cy5jcmwwKKAmoCSGImh0
+dHA6Ly90ZXN0LndnZXR0ZXN0Lm9yZy9Cb2d1cy5jcmwwHAYDVR0RBBUwE4IRV2dl
+dFRlc3RpbmdTZXJ2ZXIwgcgGCCsGAQUFBwEBBIG7MIG4MC4GCCsGAQUFBzAChiJo
+dHRwOi8vdGVzdC53Z2V0dGVzdC5jb20vQm9ndXMuY3J0MC4GCCsGAQUFBzAChiJo
+dHRwOi8vdGVzdC53Z2V0dGVzdC5jb20vQm9ndXMuY3J0MCoGCCsGAQUFBzABhh5o
+dHRwOi8vdGVzdC53Z2V0dGVzdC5jb20vb2NzcC8wKgYIKwYBBQUHMAGGHmh0dHA6
+Ly90ZXN0LndnZXR0ZXN0LmNvbS9vY3NwLzANBgkqhkiG9w0BAQUFAAOCAgEAqUa7
+cQLhjXCAHiMT9V5+hzB/ngriEKC456htspq9RC/FWnYXZ+au89FehFunjy5qzbSz
+q7N97rCD2drSwn4B6uBymmIxU6iARmtcsPrfhgXHdvhuVop6yuXspoaU7+g1WMXi
+t0RGBx0FahYlggt8a7HnMu3Qz6v8llDeA3U2BCe5ui7mWTauj3bFv/pLW3sigvm0
+Cr3aBHpkIzfHU5D6EC3fKNXQNQruXCCIcBayNiaX+FJcK18sU8tRewiWo/VvffHi
+J89/oHvZnXkteT/mEyeAbjkPkNrmNQTmG69t/x4NdxNDe5ZrEpbEPE/6S5z+YP1T
+bXG7OeES2/+K3Fprwv/oCoeQdv3bBh4IcRhhE7KpEGnJOLfV1a5aRpVCz/0C30xk
+x5GYo0a+AkPAW3zYTaKQXIKDJLpAU6QJ13WaEjVS1EYnUE2o3XEjyZPJVL1y7VSd
+1gdk5MEto6RsVH6EmJBBaSiiAj6d1GbkmNku73FiUvRGk39WbGN9qfjrMPvGhAcL
+0GrIg5oQLOf0f6sdIU3TJkARNSmgSoLV+RatIEgKI+/i6FxlRdBPoGopPJkrh/gS
+stf93A7rFKWmYNKZOMhWXxyv14lwWhBi0bW9QfzavJse047v9X3UvRki06uWXH2t
+H51/0uT9gISqZ1CKDpnez4wrjACuKmfI9D2p6J4=
+-----END CERTIFICATE-----
diff --git a/tests/certs/interca.key b/tests/certs/interca.key
new file mode 100644
index 00000000..7a271721
--- /dev/null
+++ b/tests/certs/interca.key
@@ -0,0 +1,51 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIJKAIBAAKCAgEAqRXOZWa2iCD/D1VW58EqxNdadpI1YMwz8CCf2w2BnetFRDHN
+noVTjLY95RWwFLuJ2+o+yGwBgeG1KoOAVFX0aHb3dn9VrHwH4X9wFJ6SNHPsrSvB
+7l0n797OOPv4kCX7SxNJEwA2X/YlfxsXRG4cEFwVpLtMVP5sUR+M8QxsGeoLq0Pe
+jHeg1VIJ2bJ0YK7pEIpK/QuXvHGyo+xRy2YKvRPjZRqaZiovKhk1Fytey3CwRD9O
+IJTpzLkUCgekgiKF/lQosN94VmH8yIlwyhanI9JYmADci2zPU4hSExsk4ya/jXtS
+2nNB5TXfLzXj+iDwY1YjWfCMNxmJctYvJYuEx86PFaVwZCZcDixGEqvR62SdEM1G
+8s1Uy3YZQgYRZnte2fT8UMga/tgNC6fq/6Cna/inzGGTd7c1d2KM0sOXeuLldjc/
+aVQpi40fFAFenCaiSCwMQkEVbOELOyqN5hlilot0+ccbxcvIEKzR4O/iDYPtDobC
+JHx0xrH1u1hrpBoX5orKYurI62zQAUcLPFZa+yXFTRUuLruB93FQmd0XXvSHbjWL
+NIKrLOEmDAMSgM9PzOzgmPGfaG4e8yHbBtQNktO3L/TjLI4D4S4jv4uBxUa4kLWE
+ebFmSpJmYJkuvGibofyS4o5Rf5thy2yOYEpYMLkgLSlI9guvJk612Sd15SMCAwEA
+AQKCAgA4Wi4pmWvoPqcDIzwNjVGFvQhHUD89/ZCpzRW52eyDBzBUpAyVcnYABZTn
+Tq0am848XvuBrI1sDh9lBeK1ONh2IIAlHBcfn065FtHx7U9o7+HHbTf7C00OIsG0
+ODYFRMNVqB3ImV+F5/FjRVIh2li8ExSbjFjKUukiuFMu2ycEE/7Dm6EGS7BsqCTk
+SxeCSYkfnBeV8lEl2vbgrxgro9ycW46D2bPvrMt/SltpV2kGgI4ekMKnFTo+oshM
+93MadAsYUlAlcrUWhR3McBIJKDeYNriUIGVgimkmu94uw/MtSXK54oogiB1EGQpD
+H8DVUjkLwl+R0BvLGVW30i5wYulja2wJuYbY146+jxPkohpGQv7lChLnXN4HsJio
+W5TVqPii5EXKYm1LzuwIQba7EdvVLjA4I+b//qIADtEWA0sQZLiWLSk2/58WMjix
+pTbPhAy3xTTebCwz+mxMjZVQ3V2KHVvGUWq0x4rje/yF0mKIFt1CjUgTiUQ8DGSV
+MZhiqt6hV4ipo2/GUQLBzxiEr7H89vjsXnUBUb0BQCh6Ykg1P3hfoShxs62kEqtu
+b7huQhHL2ch3Cfb2gZ7S9UpO2TjnPpDyhyapJ/MmtTiHIhsts1DYEPLq4+n9FdC2
+FQYkRhR1OCtA+Tw1W4LvTu+57EgMMOdDJK1k+/j6+cV+9vRKEQKCAQEA19kMib0J
+lCTagMtVxPDfhWdAueREKTrEGBSyReWJHUqoR4AV34BxsL6fr+8BDpgs6GMTqSWk
+YTBz7KgyjSBQh2KgNwMAE89uIez4I8nTq5M92ZfqEZ98bn6ls3A4fwZeZ/wwrVd9
+OVeH54qrINV/wFyLRu9CIkyPXLia39cobotTZXu2d/tQaFG7JXkE4zj2dl6e0zyG
+Q5XE+GtAJYWpSPYd5N/J3eFEdoJDWFygM+WSHaYEE+iFbENyiWmDd3O/mHVqovub
+rFM/SMsWqfSK5MZVEpFSXPFIlRKLsZ2FiO6Dorei0NAp1VUriDELH0EVzoxErHhu
+S+2aN5WlYaFfnQKCAQEAyInb8T364UOHzUyz+IsDaxHOkGu8r1ZKDL5YJUg8wGMl
+LEUiyQJGf+RcSiI9tsH47XcptHpAIV745wedFzS2s6NWlAQCkdUKxIrtvA4bB7PV
+TJwy2uDCKtzzrSYul1rjpXoyIEt3Q4Ryd8gpa9eeRgWPkq48d6YOTcDw3C+i8VFo
+MyMzO8U3bj8vNR3/kE8id67XDWV7qfEtszhxVjYhgL7GyrP2ZeFsFNnrdp09tY0W
+aRGkzQw67Yq3tEDNCuNgtF/tNyr0l8DSjiGLqoIkh5wSH/MVz0crM4aPMaNvsTsb
+/+JQlrJF6EUVo1mwcqH87I2gGisQTP0rkxmhTsIbvwKCAQBKWRr2fsTD4IXbAy8B
+7S4w10X2Qegwg2t0F/zoEo5OJp8cMcRW/fkrNh3vDdZBXq1pRmdJRgv+5h+oDq+K
+6OyUFaa2DDSEnliDGwrF2Qkt+kO9pZQcieDkdn9A9ZCgQGNYUge6TX52t+26FYuo
+faHJcpcO0e7nvZNMDtJZ89SbbyZEuH47ibdCl5Rs7eh/E+nhD+qJPDnLIdV89ARe
+aFHNLelSIrt3z9YzM99aml0cQyE3US3qZZc/mWPkbRG5nYcLTrZyeVQ/4VTVEA84
+b2FAOAipoqDKHtovbvnrLiUG65EwBSzx3CHst6+M88eu9k46nRoyhjEHukn6h3M1
+084JAoIBAB7uBFpE8PjlbYCgn/Fpn3FYIb/sngF9EZa9lOLLLXOO1yDo2OCf1TfM
+hN96QIJ7kGUvx+LqKBH9j+4yImx92OAEBUp3A95yOWLu+pPSqSCa//786GsR12C9
+C2hdRzpY7luLaUfJ2+8x8mW/HYRgkSzDls1Myk658eLUK1IKltsZbzTT7Qb+9/mt
+DR7oLY6YZfyHnuuWB2jCpgXKYtClMK2mvwpsj0hPaFge9E4rGmVyCU7TRdPKWxxg
+FM1cYUOYpkWrte6YVXlCaDc7vUrjH7c6vyDmYSrDE0qzKkrBpmxzbXId+cgEXvvg
+C+JR5wEHMvdZMKRYl/8H3Tym61Y2YgkCggEBAI6yQmYwqL9ELqFfWxuqSQfiEoPA
+tENwVIhwhbGKje/FgNotgC+EjToQzBfZDVudOlnRyOTjgxfeZ5mtsdH9sJ278L7I
+mZmZezmAC1GPE4Ev8GZjpFYqcx0GYGy2pvlNea2Rt8Xnw2B+GDGPTf299djeRgS1
+Xnd0j9ltxTsmiOxF1AMYuMeg57jcUAAG0N81SrOASYc7P7DKpn8PGUim9szNccXy
+jcWEJb9WRLuGfrMTwf4gpb7mShod9A4B5TziF9FNxR5u7MMW8NItMRndqI+/2ylP
+e3MAV+ZhxtLs/sWOwcJk/rwhvRsbadzKhEiZPDYDDZ10oWWsCdeawp0VZEk=
+-----END RSA PRIVATE KEY-----
diff --git a/tests/certs/invalid.crt b/tests/certs/invalid.crt
new file mode 100644
index 00000000..fab1054e
--- /dev/null
+++ b/tests/certs/invalid.crt
@@ -0,0 +1,149 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 4387 (0x1123)
+    Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, ST=CA, L=San Jose, O=Wget Testing Department, OU=Testing, CN=WgetTesting/emailAddress=bugs-wget@gnu.org
+        Validity
+            Not Before: May  4 16:30:14 2037
+            Not After : May  9 23:30:46 2019 GMT
+        Subject: CN=WgetTestingServer, ST=CA, C=US/emailAddress=servertester, O=Serv
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (4096 bit)
+                Modulus:
+                    00:a4:53:f9:34:0a:65:4f:8f:f3:c5:6f:9f:84:5c:
+                    66:72:d7:7e:6c:c4:c1:ed:08:48:78:29:d4:6e:58:
+                    7c:17:23:41:58:e7:39:82:e4:78:d2:07:c2:38:26:
+                    33:14:1f:9f:02:9a:14:af:25:5f:da:1d:1e:aa:12:
+                    13:eb:e2:c5:ef:ec:6b:6d:0f:c9:97:94:e9:dd:08:
+                    a6:7c:68:87:a4:c2:28:f3:08:dd:50:de:6a:ba:35:
+                    80:c0:ee:82:16:62:5c:cc:79:48:f1:a8:4d:5a:fd:
+                    f1:dc:90:a9:17:84:61:6a:27:57:75:30:f2:e3:6d:
+                    6f:29:0d:5e:09:df:c7:5c:4e:c9:b5:66:43:b3:1f:
+                    b4:41:cf:c7:da:5b:29:6b:db:ef:ef:a9:69:4b:a5:
+                    6c:67:82:e2:df:00:10:f1:49:f2:b2:80:9f:d0:a5:
+                    98:5f:d7:33:d2:07:92:69:e6:73:fa:c7:34:38:f2:
+                    22:f6:f1:e6:6f:d1:2d:d1:ce:47:29:97:78:24:0c:
+                    ef:d6:69:99:9d:e8:2c:d3:70:8b:34:eb:85:ac:b3:
+                    3b:93:4f:fa:44:fd:c4:6d:9a:91:c5:58:f1:7b:05:
+                    b4:68:8e:4c:5b:89:2a:4f:b4:4c:97:88:ef:66:9c:
+                    67:34:17:96:c4:10:ff:4a:19:b3:bd:da:56:88:57:
+                    07:7a:21:1e:89:2b:22:ff:58:63:e1:48:6c:62:98:
+                    19:4a:52:45:1c:cc:21:70:f8:aa:42:9d:c6:0d:85:
+                    4c:5e:b0:99:34:8e:23:cf:ed:0b:0e:72:8a:1a:17:
+                    c4:45:19:fa:1c:17:0f:ae:05:54:8a:73:b4:78:14:
+                    6e:ab:00:63:e4:8c:c7:b6:fa:88:0e:0e:09:e7:3f:
+                    39:32:b9:0e:73:95:8f:ad:55:20:a1:0a:aa:04:33:
+                    c0:ba:c1:93:4e:67:42:c3:db:fa:5e:3d:7a:6c:0b:
+                    ec:c1:82:b6:2e:b2:8c:bb:44:f8:88:1f:36:d4:e5:
+                    2b:74:4c:ea:b2:31:a3:d5:cb:34:22:c5:03:62:5a:
+                    66:28:2d:34:36:85:a0:d7:b0:1f:e0:d6:01:ec:24:
+                    60:c9:ed:83:bd:1d:0c:e7:74:1e:3c:2c:8c:6d:25:
+                    df:83:bd:b7:67:6a:37:c8:6c:75:53:7f:80:06:02:
+                    b7:72:05:a1:71:a6:bb:09:ea:ba:51:99:31:e4:c4:
+                    d8:16:c0:55:af:69:ae:75:ee:82:36:1c:56:f6:f3:
+                    a7:d9:41:2a:31:a5:6b:5c:67:bb:b8:b6:5f:9e:58:
+                    5c:85:5c:02:ae:03:22:ea:e1:58:56:aa:8b:73:72:
+                    d6:c1:3c:1f:c2:e0:77:d3:45:0f:dc:ba:0c:e6:20:
+                    01:45:63
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+            X509v3 Subject Key Identifier: 
+                06:80:9F:BB:A8:BB:3C:83:2E:8B:20:2A:07:77:E7:92:0C:56:5E:40
+            X509v3 Authority Key Identifier: 
+                keyid:17:ED:93:43:8F:A7:A6:00:75:D4:E8:B6:82:0D:88:37:7E:C0:6D:08
+
+            X509v3 Key Usage: 
+                Digital Signature, Key Encipherment, Certificate Sign, CRL Sign
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication
+            X509v3 CRL Distribution Points: 
+
+                Full Name:
+                  URI:http://test.wgettest.org/Bogus.crl
+
+                Full Name:
+                  URI:http://test.wgettest.org/Bogus.crl
+
+            X509v3 Subject Alternative Name: 
+                DNS:WgetTestingServer
+            Authority Information Access: 
+                CA Issuers - URI:http://test.wgettest.com/Bogus.crt
+                CA Issuers - URI:http://test.wgettest.com/Bogus.crt
+                OCSP - URI:http://test.wgettest.com/ocsp/
+                OCSP - URI:http://test.wgettest.com/ocsp/
+
+    Signature Algorithm: sha1WithRSAEncryption
+         8e:3b:2c:cc:f7:c5:c8:6e:3b:e6:30:12:26:2d:ab:d8:2e:16:
+         e1:57:cf:ff:3c:c4:c9:83:79:29:fc:68:53:24:a2:97:44:2f:
+         a9:8d:1d:de:a4:2c:5c:e5:d5:e5:f8:21:aa:93:fc:fc:52:62:
+         9b:a5:89:e1:17:66:fd:4f:94:41:73:5d:a2:b8:1a:0b:14:20:
+         79:09:fd:86:2e:97:c2:a8:0a:61:2c:07:f2:2e:92:54:ec:24:
+         2d:19:65:47:0b:7d:81:83:e4:7f:09:75:b3:5c:bb:72:d1:5c:
+         9b:8e:e9:a1:b5:32:e3:cc:35:97:17:22:59:79:fa:22:10:0e:
+         6e:5e:b9:3b:07:69:2a:00:9c:3f:63:c4:b0:68:9e:33:e8:16:
+         39:65:77:6a:9e:f0:1c:ff:b7:ce:62:3a:cc:d6:85:ef:0e:bc:
+         73:8f:ba:b4:06:e7:62:94:4f:89:cb:7f:57:76:b4:10:48:5e:
+         43:cb:16:09:2b:f7:c3:49:c1:c9:94:b2:2e:2e:7f:f6:64:83:
+         b7:d8:5e:ca:64:e3:a5:7f:79:12:e4:04:c7:70:df:16:71:3f:
+         50:74:39:a0:38:9b:3e:7c:4b:6f:08:59:70:ec:d0:aa:f5:c5:
+         18:11:de:c7:7a:5e:82:cf:a1:60:41:7a:5d:8c:de:dc:9e:6e:
+         8d:5b:b6:c8:72:bd:13:f8:01:2f:2d:13:82:e0:cd:b8:41:6c:
+         62:d3:1e:c8:b3:a7:89:f8:74:5f:17:ec:28:07:82:68:28:32:
+         fa:21:16:2f:c1:72:bf:95:78:4d:19:da:d2:46:10:8c:b3:81:
+         c9:59:0f:45:fc:d5:b4:85:22:c7:23:b2:3e:be:25:33:b1:fb:
+         70:7e:8c:ff:59:8f:6b:6d:9f:24:ba:9c:9b:f7:0c:bd:4a:df:
+         69:b8:f4:47:14:8c:72:82:87:e6:b0:28:bf:0c:41:0e:23:ce:
+         e4:6f:25:68:ef:11:eb:78:6d:67:ac:9d:ef:38:0c:fb:32:c2:
+         c3:e1:4c:f3:c6:d1:5a:78:ce:c7:3c:8a:95:9c:8c:a2:82:1b:
+         8d:ac:6a:14:fd:dc:5d:11:86:4f:e0:ea:ae:00:0c:2d:13:ca:
+         c9:26:85:a4:cb:6b:13:52:7c:a7:f7:3b:27:2e:a4:f0:49:50:
+         ca:08:a3:d3:4d:09:35:86:2f:af:65:f3:20:e2:2d:3c:b0:da:
+         66:c7:f0:bb:a3:22:89:9c:94:d7:4a:89:38:8f:90:72:ba:a3:
+         03:c3:9a:9e:93:d7:b1:8b:eb:2c:10:7e:7a:d3:7a:00:5d:34:
+         8f:ab:6c:a6:27:a4:29:9b:8c:9c:e7:c9:21:77:4b:db:63:be:
+         63:ed:e5:6d:ee:39:1a:23
+-----BEGIN CERTIFICATE-----
+MIIHPTCCBSWgAwIBAgICESMwDQYJKoZIhvcNAQEFBQAwgZkxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTERMA8GA1UEBwwIU2FuIEpvc2UxIDAeBgNVBAoMF1dnZXQg
+VGVzdGluZyBEZXBhcnRtZW50MRAwDgYDVQQLDAdUZXN0aW5nMRQwEgYDVQQDDAtX
+Z2V0VGVzdGluZzEgMB4GCSqGSIb3DQEJARYRYnVncy13Z2V0QGdudS5vcmcwIhcR
+MzcwNTA0MTYzMDE0LTA3MDAXDTE5MDUwOTIzMzA0NlowYjEaMBgGA1UEAwwRV2dl
+dFRlc3RpbmdTZXJ2ZXIxCzAJBgNVBAgMAkNBMQswCQYDVQQGEwJVUzEbMBkGCSqG
+SIb3DQEJARYMc2VydmVydGVzdGVyMQ0wCwYDVQQKDARTZXJ2MIICIjANBgkqhkiG
+9w0BAQEFAAOCAg8AMIICCgKCAgEApFP5NAplT4/zxW+fhFxmctd+bMTB7QhIeCnU
+blh8FyNBWOc5guR40gfCOCYzFB+fApoUryVf2h0eqhIT6+LF7+xrbQ/Jl5Tp3Qim
+fGiHpMIo8wjdUN5qujWAwO6CFmJczHlI8ahNWv3x3JCpF4RhaidXdTDy421vKQ1e
+Cd/HXE7JtWZDsx+0Qc/H2lspa9vv76lpS6VsZ4Li3wAQ8UnysoCf0KWYX9cz0geS
+aeZz+sc0OPIi9vHmb9Et0c5HKZd4JAzv1mmZnegs03CLNOuFrLM7k0/6RP3EbZqR
+xVjxewW0aI5MW4kqT7RMl4jvZpxnNBeWxBD/ShmzvdpWiFcHeiEeiSsi/1hj4Uhs
+YpgZSlJFHMwhcPiqQp3GDYVMXrCZNI4jz+0LDnKKGhfERRn6HBcPrgVUinO0eBRu
+qwBj5IzHtvqIDg4J5z85MrkOc5WPrVUgoQqqBDPAusGTTmdCw9v6Xj16bAvswYK2
+LrKMu0T4iB821OUrdEzqsjGj1cs0IsUDYlpmKC00NoWg17Af4NYB7CRgye2DvR0M
+53QePCyMbSXfg723Z2o3yGx1U3+ABgK3cgWhcaa7Ceq6UZkx5MTYFsBVr2mude6C
+NhxW9vOn2UEqMaVrXGe7uLZfnlhchVwCrgMi6uFYVqqLc3LWwTwfwuB300UP3LoM
+5iABRWMCAwEAAaOCAb8wggG7MA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFAaA
+n7uouzyDLosgKgd355IMVl5AMB8GA1UdIwQYMBaAFBftk0OPp6YAddTotoINiDd+
+wG0IMAsGA1UdDwQEAwIBpjATBgNVHSUEDDAKBggrBgEFBQcDATBdBgNVHR8EVjBU
+MCigJqAkhiJodHRwOi8vdGVzdC53Z2V0dGVzdC5vcmcvQm9ndXMuY3JsMCigJqAk
+hiJodHRwOi8vdGVzdC53Z2V0dGVzdC5vcmcvQm9ndXMuY3JsMBwGA1UdEQQVMBOC
+EVdnZXRUZXN0aW5nU2VydmVyMIHIBggrBgEFBQcBAQSBuzCBuDAuBggrBgEFBQcw
+AoYiaHR0cDovL3Rlc3Qud2dldHRlc3QuY29tL0JvZ3VzLmNydDAuBggrBgEFBQcw
+AoYiaHR0cDovL3Rlc3Qud2dldHRlc3QuY29tL0JvZ3VzLmNydDAqBggrBgEFBQcw
+AYYeaHR0cDovL3Rlc3Qud2dldHRlc3QuY29tL29jc3AvMCoGCCsGAQUFBzABhh5o
+dHRwOi8vdGVzdC53Z2V0dGVzdC5jb20vb2NzcC8wDQYJKoZIhvcNAQEFBQADggIB
+AI47LMz3xchuO+YwEiYtq9guFuFXz/88xMmDeSn8aFMkopdEL6mNHd6kLFzl1eX4
+IaqT/PxSYpulieEXZv1PlEFzXaK4GgsUIHkJ/YYul8KoCmEsB/IuklTsJC0ZZUcL
+fYGD5H8JdbNcu3LRXJuO6aG1MuPMNZcXIll5+iIQDm5euTsHaSoAnD9jxLBonjPo
+Fjlld2qe8Bz/t85iOszWhe8OvHOPurQG52KUT4nLf1d2tBBIXkPLFgkr98NJwcmU
+si4uf/Zkg7fYXspk46V/eRLkBMdw3xZxP1B0OaA4mz58S28IWXDs0Kr1xRgR3sd6
+XoLPoWBBel2M3tyebo1btshyvRP4AS8tE4LgzbhBbGLTHsizp4n4dF8X7CgHgmgo
+MvohFi/Bcr+VeE0Z2tJGEIyzgclZD0X81bSFIscjsj6+JTOx+3B+jP9Zj2ttnyS6
+nJv3DL1K32m49EcUjHKCh+awKL8MQQ4jzuRvJWjvEet4bWesne84DPsywsPhTPPG
+0Vp4zsc8ipWcjKKCG42sahT93F0Rhk/g6q4ADC0TyskmhaTLaxNSfKf3OycupPBJ
+UMoIo9NNCTWGL69l8yDiLTyw2mbH8LujIomclNdKiTiPkHK6owPDmp6T17GL6ywQ
+fnrTegBdNI+rbKYnpCmbjJznySF3S9tjvmPt5W3uORoj
+-----END CERTIFICATE-----
diff --git a/tests/certs/invalid.key b/tests/certs/invalid.key
new file mode 100644
index 00000000..aa42f52b
--- /dev/null
+++ b/tests/certs/invalid.key
@@ -0,0 +1,51 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIJKQIBAAKCAgEApFP5NAplT4/zxW+fhFxmctd+bMTB7QhIeCnUblh8FyNBWOc5
+guR40gfCOCYzFB+fApoUryVf2h0eqhIT6+LF7+xrbQ/Jl5Tp3QimfGiHpMIo8wjd
+UN5qujWAwO6CFmJczHlI8ahNWv3x3JCpF4RhaidXdTDy421vKQ1eCd/HXE7JtWZD
+sx+0Qc/H2lspa9vv76lpS6VsZ4Li3wAQ8UnysoCf0KWYX9cz0geSaeZz+sc0OPIi
+9vHmb9Et0c5HKZd4JAzv1mmZnegs03CLNOuFrLM7k0/6RP3EbZqRxVjxewW0aI5M
+W4kqT7RMl4jvZpxnNBeWxBD/ShmzvdpWiFcHeiEeiSsi/1hj4UhsYpgZSlJFHMwh
+cPiqQp3GDYVMXrCZNI4jz+0LDnKKGhfERRn6HBcPrgVUinO0eBRuqwBj5IzHtvqI
+Dg4J5z85MrkOc5WPrVUgoQqqBDPAusGTTmdCw9v6Xj16bAvswYK2LrKMu0T4iB82
+1OUrdEzqsjGj1cs0IsUDYlpmKC00NoWg17Af4NYB7CRgye2DvR0M53QePCyMbSXf
+g723Z2o3yGx1U3+ABgK3cgWhcaa7Ceq6UZkx5MTYFsBVr2mude6CNhxW9vOn2UEq
+MaVrXGe7uLZfnlhchVwCrgMi6uFYVqqLc3LWwTwfwuB300UP3LoM5iABRWMCAwEA
+AQKCAgApR4rvXrkqbl/vNeYdatS1fpqcmiSY9Z62yNM7UPEDIvEUcylITzpmkFpi
+nn3wTS01ix0tDjdw5CXC1T254MKWTY6C3BdpA5hn1Pd1gxCn+7orqwtleCnZUv1f
++col81maZ9FCG2QrOmWaYaCIbtHFx9I5dy1coi3tYxU/Z7592rDi56iUA5/VdGug
+14ulM5+nVahEv25m5kM1f5/B7TCRVKxQznhjgvzagtptzd1OnuHoeDL+U6/uYN6g
+uK+5q/obHEDXXLmhKCSyjK/7gDqZMoEBtXKKCDFi0xRRPdGTdNBn/28BA4jkcsdW
+vahd32YxeMd/w0FODPzQ8VsRbsNKrI0QgRtsiiHCfxiXro18DCeYhB61cH35CsA3
+6VPLY8Ry/dv+8T8JO7kpN9Q/187bEOizLUyaxrwjSE1RcPXFeHltSKyiR/P4yuaW
+hQoqXX7UcFIGAo6MolA6RG7Y5EyCYxfUQ0UjawQ9NBSMi947tg2sb2apNYiYxTan
+q7GLsJMYdPF6+ekqDWvpIVcK1jtxLUA0vJ6ExycsqcBII8KJ8oZ1jf0GxMfiGihy
+pI6cw419swQntgKOK8xC/anBMUQb0H76TZBkTKj8SVceb3h5OouHNmrSSwP1Ijdw
+mfQg29sgxcANnkjFbfSL+jBOgSK9JwQ86lkr1hdLqmNU+k6VkQKCAQEA1UW6Fmo3
+d1kJ6hEwwBrdi+HEp3A3FIvfuzFCK3WC7RCq1MPx54PBFpGZhfuO2kOw3ZFK9mv6
+Xzz/lSLMPULtFWZCDiI29YEoH8TQtjzGkYi5A/uCoqOLqus8ZsWS1L7Pn8+VJjcj
++mrDgdYE1eM3XVOeAPj1t9VZa67jVzmzBvanP7tUomfHLSphKzGGgAg3JeogSZEv
+vxHftJRgkMovgpUkQaRn6vs7xgFNqmSFjDgYlCzkbwhfEg+6HLo+AN1Sd+hQi8UH
+qZ5ayuGsuBqDFtNOZ3gkQgpySsztPLZEHu/3tAiJv8j4guplhSuTdoMpH6ZvN4Pw
+0tE9Vg6swkaHWwKCAQEAxT//fEk6/Lt21hcK24li2Bbry5JVyOJa2ZrVP3CfGCy0
+C+YNLlkAl7E0z1bcGMOzVWzYXhusr8wT/ZmP42BPjapb5uD7RYgw05x61aqrizNR
+0SFJ0B+8lWKN6PXM0KWn4/7CA5nyVrXw/6aqVGqTR4UHhaXYZO5B2eMsuSZU7db9
+6C45693JYNp5mq9ReqKIoh+CYjN1VT4p9kW2DPH26JBjlX36QPGGQDO68s+dIuAo
+g5UplWGCcS1kFUUe8jxj0+IH+Tciy/hExu1Xe3weeidRpIeLBPR3YdtsHcvUaqfV
+9zUKFk/7z94DFEvR99wiarsqqTc2mVHcna8Fqv0gmQKCAQBxEki4vZOuqPxCpt6L
+2zJ+iTIz+6CYOhhiLJmCZQkHGwEXUNOeBRKIHqWgjWCNg7nvnqp5v4G8oKB4tzxF
+dogwAkkfKTCuNM3LGhP1qn80haJh5CS8iazw70rUygcw2AFIH0xaOH3QtG33Fjr2
+E0M1LbHlnhjYYDrKhqxtgF/UX00I0w7qE89buM5PkjBXDQQADAMWPe1shdNu8APK
+gAd0WhIg40NdJ9nm/qXooubTEqKlXK+31l5hOwlXVb6twqmIfRjHIa0QVq6YRdHG
+wfeiUGGPJflDMjqqQb+9ony3Uk6nmqc9kRWAgzlTw2ipOpzA9QKeEkvJ2bmFOL6L
+Oc1lAoIBAQDCoaqcXboJxYS2LZh2FbNl3AAhKCzjgo74pzICXkNt3DZwgzjAYewW
+wjGE4YVeHkTnZvZ8rbwQ30NeelcjmlYFSHNUdu0ZqA/dzkraaITKXwI9ZCZsadRw
+ZwX2OAw4WS036JpSaWZZrz+1UyRBFcRrztUkSAglV3+82s+3hh5JbVmu72YR2g+q
+NQnG23V/l79Qkdzav0HoseU/73t6fIsQ4eCRkvQLfwbkdObkTn4T+rGfXODiWIwY
+1xwpbMHjbjlmymLpw0DfmQNscqde3pNIH2INAf3oDr153sRpBkZ8U03qlvh0Gco0
+SzIopcPyWdHQFQ08WZHTaZZSNXBXT1wJAoIBAQDKhLc2JTzoiTH4wqUQRqBRVBfR
+LSbFtnigNPwrRlFvoID0X/u/bbSSRB1ziyYIh8gucGI6G8KgrCo5yy6+RB4t9YOK
+mhhNo5pa3VYjEzYX69pxXKD5AzNY5CbHAYcNkZoowSfnIEdYok6qrz8sVl5rsmWL
+5Ry5Z+cxHLC9PFyh7hNmEqacO1qKThMHLcJ4pNPrkCEjN2/IWtlWL6mHPI8/0RjO
+JVb8w9EoY+uv16C/Pa1FGJjsweli7EkJ9P55HYWoni3a1o6OpQ+g7BsON7drWf3R
+GAywLAaC9jUxvkedPDUFhRMI+xnAIUZwzk+8nNtINrewiO96Ec4OcQohZcOx
+-----END RSA PRIVATE KEY-----
diff --git a/tests/certs/selfsigned.crt b/tests/certs/selfsigned.crt
new file mode 100644
index 00000000..41e24e95
--- /dev/null
+++ b/tests/certs/selfsigned.crt
@@ -0,0 +1,33 @@
+-----BEGIN CERTIFICATE-----
+MIIFtzCCA5+gAwIBAgIJANAKYgHn6Nk9MA0GCSqGSIb3DQEBCwUAMHIxCzAJBgNV
+BAYTAlVTMQswCQYDVQQIDAJDQTEVMBMGA1UEBwwMTXlzdGVyeSBTcG90MQwwCgYD
+VQQKDANEaXMxGjAYBgNVBAMMEVdnZXRUZXN0aW5nU2VydmVyMRUwEwYJKoZIhvcN
+AQkBFgZ0ZXN0ZXIwHhcNMTcwNTA5MjI0OTQ0WhcNMTgwNTA5MjI0OTQ0WjByMQsw
+CQYDVQQGEwJVUzELMAkGA1UECAwCQ0ExFTATBgNVBAcMDE15c3RlcnkgU3BvdDEM
+MAoGA1UECgwDRGlzMRowGAYDVQQDDBFXZ2V0VGVzdGluZ1NlcnZlcjEVMBMGCSqG
+SIb3DQEJARYGdGVzdGVyMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA
+2Zc7ZtsoPrlnQLTfMTrfuH7ghL6OrNVPAGpHQ4N+ddJwkF52lQXbeo9JO+09HF7s
+VFnxTG2+0Ld98kcvY3Ylco1Sxl18Bdjzv13sIJtgh7HyuRJ6Ryq2LZGWLKPBaGq1
+G2bBO4nUmsJLjj/1KqKxjk38iJ3Sf02nh8MhRGr8OHFSTMf9pPKW6hibXbsMUVyQ
+2u2RUXbvEtR1rkInWAVhEo97Row0+Z1+ZiqINOcBgpQl0sWh204dZqqi/y3uBbLQ
+3MkenioCb/udLdPRsileVhhwnrq6/0M/YhghMyI9Y+ajQ90h6tM10iyrILYzMCLx
+FB+3iReEJVX7Sy9qaqLJmTttxD7yqReCAxsrdDp1ZmrkQWLRAqBRdZo8RahkfdTu
+wa/fNuwuFFnMC8w/UgCWgDOEH85n4asRNlufYz+GXTsYybiH3klkAe9o09/Cm+zk
+pcX+zcHUkw6aZLC4VbKHNfyKDbWqTMzS66C2Ln4g9p8Zk0KJIvcmVG9uz/zjVIwM
+BWrbEawjMuejy+HUNcaV9CoaBFquwRJd4hlsE6FEryo3k1hEtDancobXl0XLsylU
+SMKMPr6PHjdxt+PdUhL79VNUJT2k35LqLKvtWZAuTOOcfjm0uXSDUC4GvW+onD7L
+n0XB/m4Gqm55EPLnDJgFYdEylvozglg+hSuoywab6NkCAwEAAaNQME4wHQYDVR0O
+BBYEFJF+Iyz8/pwx50cqFXckWIXoat/AMB8GA1UdIwQYMBaAFJF+Iyz8/pwx50cq
+FXckWIXoat/AMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQELBQADggIBAGRKLYCQ
+W+pdPOF0ojwrufYNbF2qryjJU7OzT7HbdrQOFZ+vcegi5rpZXOsFENTh0gdbI+M3
+FwxDIdyF7CvaRS1uMoTboqaqAzTy+gVVW/6d+UdOdHhJTpduhtQi3gtNvqzdkUpl
+01rX+Da6/jy4kPZfJap3mFPQLVvqVmcvJEcgHVOyB5/23RWS6TSEX35O3De9pnha
+XLqliFBQ/Sqj/2vZmkHBEXdNRfwfw1dHIcxmg25YTb6tyvrKURpXN6suDJEO+M6h
+9IVRv9qCNtvVHpo/xUxwjf7ZBHnGdcGl8AaAoIhRF7JTTGoRX7VAR+DLa5jHMAE2
+BmXzt+HHPMXZiQtzcUUcWc7+a740F8kM03CUMcz8sB4xzovGsZTLJ64afRFP1yaf
++1H7efbrogVjtpGzreWhJ8I5UXO/AoMjwUgyjjHb51KVRn6VrQfDHtw/hrIZVryI
+y8wOH0qzMK2JhB2oh1JvmjhtGxkWlqDztttfglYJENuMf8m/DxsmkSPksSnm8GkA
+El/GdocnZhl8vl8PcqzJ0nNn6EOTiZe+urGxG0r50ckVD+km/J7b56i+Gow46UH3
+Kkp69X9FHDfh3akaeU5chRfH99A/ehtdalD/W5Dy/hA9giA19foPUo6wKBE5unqz
+bfjzK+eNfIkER5JDL6hZQICdjiqa2+IzUnG8
+-----END CERTIFICATE-----
diff --git a/tests/certs/selfsigned.key b/tests/certs/selfsigned.key
new file mode 100644
index 00000000..d6d4a592
--- /dev/null
+++ b/tests/certs/selfsigned.key
@@ -0,0 +1,52 @@
+-----BEGIN PRIVATE KEY-----
+MIIJQgIBADANBgkqhkiG9w0BAQEFAASCCSwwggkoAgEAAoICAQDZlztm2yg+uWdA
+tN8xOt+4fuCEvo6s1U8AakdDg3510nCQXnaVBdt6j0k77T0cXuxUWfFMbb7Qt33y
+Ry9jdiVyjVLGXXwF2PO/Xewgm2CHsfK5EnpHKrYtkZYso8FoarUbZsE7idSawkuO
+P/UqorGOTfyIndJ/TaeHwyFEavw4cVJMx/2k8pbqGJtduwxRXJDa7ZFRdu8S1HWu
+QidYBWESj3tGjDT5nX5mKog05wGClCXSxaHbTh1mqqL/Le4FstDcyR6eKgJv+50t
+09GyKV5WGHCeurr/Qz9iGCEzIj1j5qND3SHq0zXSLKsgtjMwIvEUH7eJF4QlVftL
+L2pqosmZO23EPvKpF4IDGyt0OnVmauRBYtECoFF1mjxFqGR91O7Br9827C4UWcwL
+zD9SAJaAM4QfzmfhqxE2W59jP4ZdOxjJuIfeSWQB72jT38Kb7OSlxf7NwdSTDppk
+sLhVsoc1/IoNtapMzNLroLYufiD2nxmTQoki9yZUb27P/ONUjAwFatsRrCMy56PL
+4dQ1xpX0KhoEWq7BEl3iGWwToUSvKjeTWES0NqdyhteXRcuzKVRIwow+vo8eN3G3
+491SEvv1U1QlPaTfkuosq+1ZkC5M45x+ObS5dINQLga9b6icPsufRcH+bgaqbnkQ
+8ucMmAVh0TKW+jOCWD6FK6jLBpvo2QIDAQABAoICABF+ZCs30XuBgnikUhFuL1Bw
++vIRM/1XRPu+j64w4zjry1sADT6b8vJelL+5qiEezJdXh9viMuYq6nhRGtE/TXFx
+RUdnerIpqCcpkPNqKo+eUeppPuV73Ju7SbybCdCwS5FBaKW1xh8PIe303GwqGmZb
+hMMjFSpg/ugeWw1aIJ8VFU3RAmaBjnqRseQORsY/z/GaCgXnrv7vj+qLrQgZnp1U
+Zc/dM+EhtWjXYI4ISInMCWJxuzqbhCed7m7frXRN1Rb7IHgM3pdMPm3RytktFEWN
+v3gzgRdGu9DSKdEnnpHqmBO7sp9jjb8xEi0WGPV0ybcZebMO7fPmfsajsEWUguql
+8kAwq6DkoQXPm8uMHoYaJhs14X2cJhITLccVWccCF7DO52y/KrL/k6QICnqTLtZq
+mdzwdOLCKXews0IeK3Ut/VEEi/+pMpAjdmxnSEv8lPKyLE8moOoxU/xdegUffn+j
+BwmtqFamdP817MzypPbfujR/muuM4+XNMTt8t81WvQtL7/7ZID3NUN4m+XgtJy++
+noi8etnANgT2jMATvzNIAAh3utbcP8mA7HGF7FT7tyqYkOd/1VxlY4kYl7d6Au1S
+75qmiAd8c+yBOS/y2E34HrrPuIcEdttyOhvhAiHJZuJ7akkAk0uLPJ25RK0qCYzl
+sO5rtWaqBfBCS3fts6gRAoIBAQDy0Aw0RrxZxB0XZHb9Xl/whUASFwxlSn2whVSV
+4eFL/bhpWhrKXsAwQ9HsI5q1vPOZIlzssVUnjAdN8tTiMiwGmgv33PJNnZBs8opy
+upTpbBpk97D847phzkJqCkuAmLaYEpOovVBBDN7xhgzu7ZcT+lLiSDCtQGIwgI+O
+TxhDJOLapLYs65ujVPSs4rO0DYh9cC4t4CwJv8JS7D3e1xnrnL2RA5RrrLgfphxU
+SQzrRyo3eXgjHC67KkeBBSi978IAE3NFBzyo945us/KxePXhIU0KlWmH0gHDNNcv
+0D6x4kod3UgDxep4aJnYZQKEfNI7xZo1zCkrFmwQE4s9HWSNAoIBAQDlaIKysObZ
+iYBXjw8fWhA2DImAsgS6C/Y/uBhS2EzDTtxaYV4VTTUNwijiwXY0F2sz/1kkk3WU
+LJ5bH2wjoRZEQu5xRvhdCJnullwxxVqvRj6O/W2SKkincbrpOukIzDCC/pvhlg0T
+P603bDz9J7xoCgIlfihG6adezS4eDtC8z4U+FnJgBUJcIZWTHx+CdSMMN/twmsc4
+VyGkgMa45EcC4JT53bysSkaKFKWh+2Pri3n+x/M403cBEW+zHh89UWtaAnn+UN6a
+S5TOahOj9JukJEZk8HB6R0u9rkfaZZ12uTzyBdP2T+ck8S2AUy5uvkzdAFfuojdv
+4nXlU1sJHRB9AoIBAE269G03x8wkz/tRGhZ6Q9RHk/82ia1Tb3E2/aENsoYVLxfq
+1HC8bGIHFAi4TSqo1oLLUVwkWNJULXJyrlvLG/TxE6vBe4AFVNrLui6INGuVQ83W
+zT3n2R6+XNx9dzYvrSR5rfNyx2JLsIM5GqLSRG8Mz8PIwGx2E/ja7xnrkCTOhiDg
+YcF3m1dqNvmxiT22p18grmfZP7/PN3I8VoIj8hRPFRB7SOQ/YqIfFyqUSCJ5obYo
+mKEEwKECI+nVsPk866oCkAAlFPIybdJaoPLXej8b3gHpWuM0A4RuQgT4cVmYy4lL
+8WXj0e/B7J4tl+S54MNpurhGJ1e30dhDqWtjIXECggEBAKVMNtB2swAQGY/9ntHi
+XUf0pKc8njdIIzkqdyxKepVIH3JoMhh7Nz0gp8Er0PYb4bznwt2d+ty3gar66zqI
++bhZ2eF5V8ABUJkfcnLSV1Nv8+eoJ+ln2k38nscrEXqrVlEtEDjtm6JBAZirvw5S
+MWltvLozOuZNubGPeiliV3mUtddU6TjS0Uv9Tv9hL50athQ5yk0K2X15Gt6jg4z5
+v0kNdYrNAQPLySP5WJdswkSYjWDNxi0uAdOdMrUHgU73ebizjB95OcxHpYNN37UF
+rZgKI0bcEM+qy6JzD4cILPu84XMqS95xGIX/2d9bEFvvdwbPFoz2CafurzB8bV4V
+uSkCggEAQRL390lx9uI4csLTTCUSa3Fl4BVPseqKlyadoxyzTMDyxAPxktw0vzht
+OyQdLssTVjL/0cHEBMnDawddk5L+1UF7izwhZinVtTGDvn5TC2elk+bJ1aWMQ5qg
+yUPdFbeLypmRlDUU8lJxppHcmrMY7/eAmOYAJTXn7Ygk030S6Hv1npSCtpyT1Stv
+CMtiE8bDaTv7qN2RJjPcvZ9xMB9GFcIdVpw8pf5jXQeci6kOR1FPW1j9DOSMAdf4
+0xPly00agfZxG/kkmL2rBrTGOJLYI8tgGpjPciJaSJ4NArFzxJbDG1DFw6GNKzBU
+qNaPYEH/kYsrfWzp/w1WMUpPdbl5iQ==
+-----END PRIVATE KEY-----
diff --git a/tests/certs/user.crt b/tests/certs/user.crt
new file mode 100644
index 00000000..f1a6d8cd
--- /dev/null
+++ b/tests/certs/user.crt
@@ -0,0 +1,148 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 4388 (0x1124)
+    Signature Algorithm: sha1WithRSAEncryption
+        Issuer: CN=ica-wgetTestingServer, ST=CA, C=US/emailAddress=icatester, O=Int
+        Validity
+            Not Before: May  9 21:30:44 2017 GMT
+            Not After : May  9 21:30:44 2019 GMT
+        Subject: CN=WgetTestingServer, ST=CA, C=US/emailAddress=usertester, O=Int
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (4096 bit)
+                Modulus:
+                    00:b9:ed:5a:89:c5:8e:20:a2:8d:c6:ee:0c:62:f6:
+                    9a:65:4d:da:3a:04:27:b8:23:cf:8c:1a:5f:1c:79:
+                    09:1a:e5:eb:57:82:f3:48:66:b2:74:bb:95:a4:00:
+                    87:5a:27:88:57:7e:ee:80:87:ec:d2:ca:89:86:53:
+                    0d:79:f6:9c:66:e0:19:ad:78:61:8b:20:9b:3e:da:
+                    b4:42:3b:bd:b8:62:f1:0e:40:26:73:f2:e5:eb:6e:
+                    89:de:d7:26:63:11:cf:bc:30:8a:7d:ea:e1:a1:9c:
+                    9e:bc:e8:5c:8a:50:7f:c8:cf:8c:8c:09:e2:ae:1b:
+                    3f:18:1d:54:7e:6a:a8:ed:a9:04:9e:fc:fc:48:47:
+                    a7:d5:a3:de:f3:ac:63:4f:40:ee:27:de:02:0d:f8:
+                    6c:fb:98:dc:73:f1:c6:bc:48:7f:fb:f4:3c:8f:7a:
+                    57:7d:ac:76:51:d7:8a:c7:7b:81:65:37:ed:cb:99:
+                    f2:c8:6b:8d:88:10:9f:ea:e1:23:58:14:40:0a:bf:
+                    67:f7:8b:e9:cf:56:dd:f8:5c:2e:35:86:a7:fb:20:
+                    e0:8f:3c:bb:20:f6:c3:c3:e9:9d:91:67:15:65:50:
+                    ba:d9:6a:75:1e:93:a2:cd:66:ed:d0:58:bf:bd:1a:
+                    7f:ed:de:25:ff:03:fa:82:ab:41:52:34:8c:3d:6b:
+                    ae:9b:6a:3e:05:2b:3f:87:88:0d:8c:a4:04:0a:cc:
+                    b1:f6:0c:02:3b:0c:98:47:6c:1f:a4:0e:d3:ce:ef:
+                    5f:e8:e0:23:64:84:04:64:ad:d0:18:44:b0:93:7c:
+                    43:f5:5a:2f:8d:d6:43:ed:fa:a1:e8:da:42:e2:cb:
+                    56:c5:28:e7:c6:1c:b0:04:3b:23:57:76:7d:20:b4:
+                    30:b1:9c:69:54:7c:45:db:1b:7f:8e:83:a9:89:7c:
+                    59:32:30:9b:70:7e:bc:b3:33:96:89:33:c9:6c:fe:
+                    79:b9:06:ed:6b:e5:70:65:9f:ad:35:e0:13:0c:27:
+                    17:4b:70:67:e3:95:f3:a0:90:b6:fb:06:4a:33:21:
+                    4f:7b:c4:ba:a2:b3:47:bd:cb:3d:88:3e:46:31:27:
+                    e3:83:f8:8f:25:54:83:a9:63:a3:1b:33:82:7c:ea:
+                    78:2d:60:10:fe:54:a8:d5:cf:a1:c4:e6:8b:0e:a5:
+                    98:5d:f7:1d:6c:36:35:58:72:9a:81:06:a7:ed:7d:
+                    3a:ae:99:62:4f:af:d2:88:c9:ad:32:b0:55:aa:ce:
+                    ee:0e:5d:70:2a:84:a8:ef:66:a5:a4:3c:c4:f1:96:
+                    e7:e4:05:7c:8d:c1:a5:ac:7f:54:3c:bd:b3:7e:1d:
+                    31:ad:d5:c2:73:60:db:23:c6:29:9b:d3:f9:4f:d6:
+                    7d:f7:ed
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+            X509v3 Subject Key Identifier: 
+                6F:00:AE:EF:A0:15:4C:5C:1E:A7:B4:6C:8F:5F:1F:DD:EE:C6:6C:11
+            X509v3 Authority Key Identifier: 
+                keyid:24:D0:7C:F3:88:2A:73:FF:87:A0:CB:69:E0:6B:2E:16:BD:4E:D5:E6
+
+            X509v3 Key Usage: 
+                Digital Signature, Key Encipherment
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication
+            X509v3 CRL Distribution Points: 
+
+                Full Name:
+                  URI:http://intertest.wgettest.org/Bogus.crl
+
+                Full Name:
+                  URI:http://intertest.wgettest.org/Bogus.crl
+
+            X509v3 Subject Alternative Name: 
+                DNS:WgetTestingServer
+            Authority Information Access: 
+                CA Issuers - URI:http://intertest.wgettest.com/Bogus.crt
+                CA Issuers - URI:http://intertest.wgettest.com/Bogus.crt
+                OCSP - URI:http://intertest.wgettest.com/ocsp/
+                OCSP - URI:http://intertest.wgettest.com/ocsp/
+
+    Signature Algorithm: sha1WithRSAEncryption
+         4b:e0:19:75:65:2d:0c:fe:d4:b6:3d:a1:02:8f:3d:89:a6:6b:
+         12:c6:ee:e3:79:a0:b4:af:fa:15:97:be:35:f7:06:00:39:ba:
+         f9:30:e4:55:d9:98:fc:a5:b7:54:22:52:71:3a:35:d4:3b:9e:
+         00:1e:5e:bb:8b:4f:21:bd:c7:df:7d:65:4c:cc:32:4e:ab:51:
+         95:e2:59:b4:09:c2:78:8d:bf:ac:3b:d9:ca:9e:dc:39:ac:95:
+         d2:91:f9:28:31:cd:93:54:db:7a:f3:c8:a2:76:df:a0:b3:8a:
+         e1:00:31:a5:ba:f3:3e:3f:2e:b8:7b:cb:bb:a3:61:83:5f:6a:
+         ee:37:88:2f:89:a5:b6:79:ef:3c:c1:e7:cd:0b:5f:51:d4:de:
+         ab:85:97:f5:8c:8d:d6:59:1e:e6:db:a3:ab:1d:1d:5f:fd:ba:
+         70:39:97:a1:0f:b4:6d:cc:1d:5d:49:41:9c:12:9e:b3:19:de:
+         64:ab:83:2f:f3:bf:6f:26:14:e4:be:1a:50:9a:78:22:99:c0:
+         39:35:ff:b1:45:ea:d3:8f:0d:ed:3d:c2:b0:77:71:26:12:4a:
+         f0:81:83:d7:c9:f2:0c:e8:c2:7b:9b:96:7b:06:ab:e5:ef:ac:
+         e6:34:58:ed:d3:9b:a3:b9:9e:7e:78:16:6e:ba:21:d3:48:01:
+         bc:3e:5f:6e:56:63:cc:4a:f4:e0:12:5e:8b:68:73:b7:3a:0e:
+         1d:cd:44:15:6e:5c:f4:fd:8e:02:f2:a4:37:ce:08:da:5c:86:
+         26:57:65:30:5a:13:29:08:ab:0f:f6:a6:ab:99:de:f0:c5:bf:
+         15:a1:30:ea:23:ca:af:0a:8b:a4:58:8d:12:4f:52:27:fc:52:
+         dc:6d:9a:66:0f:43:c7:28:29:92:92:da:e7:9c:5c:fb:29:e6:
+         31:06:81:a9:8c:51:86:d2:a2:08:bd:76:fb:61:4b:8e:49:48:
+         9a:ca:a3:04:6c:dd:59:32:e1:41:f3:09:0b:9b:c0:60:64:34:
+         87:21:cf:33:bf:17:14:c2:d5:05:0c:4d:21:8a:4d:5e:13:bf:
+         32:c7:59:bb:48:de:82:15:8e:24:93:4c:c8:8e:e7:12:86:af:
+         69:5c:5c:d8:a0:90:80:64:74:84:bb:ce:2e:e9:11:06:96:ed:
+         52:3a:ba:1f:48:a2:13:14:d1:26:e8:a2:13:6d:2e:ec:ad:28:
+         f5:74:da:d7:7e:5e:eb:eb:4b:8d:3d:73:c1:ac:38:20:52:e6:
+         c5:72:fa:7e:e0:6c:fa:21:25:42:f8:fe:3a:1d:0a:4b:c1:ee:
+         3b:36:61:b9:58:ec:09:4a:4d:4f:51:e5:7c:af:b4:1b:8d:28:
+         45:e1:67:d1:2c:72:47:7d
+-----BEGIN CERTIFICATE-----
+MIIHHDCCBQSgAwIBAgICESQwDQYJKoZIhvcNAQEFBQAwYjEeMBwGA1UEAwwVaWNh
+LXdnZXRUZXN0aW5nU2VydmVyMQswCQYDVQQIDAJDQTELMAkGA1UEBhMCVVMxGDAW
+BgkqhkiG9w0BCQEWCWljYXRlc3RlcjEMMAoGA1UECgwDSW50MB4XDTE3MDUwOTIx
+MzA0NFoXDTE5MDUwOTIxMzA0NFowXzEaMBgGA1UEAwwRV2dldFRlc3RpbmdTZXJ2
+ZXIxCzAJBgNVBAgMAkNBMQswCQYDVQQGEwJVUzEZMBcGCSqGSIb3DQEJARYKdXNl
+cnRlc3RlcjEMMAoGA1UECgwDSW50MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIIC
+CgKCAgEAue1aicWOIKKNxu4MYvaaZU3aOgQnuCPPjBpfHHkJGuXrV4LzSGaydLuV
+pACHWieIV37ugIfs0sqJhlMNefacZuAZrXhhiyCbPtq0Qju9uGLxDkAmc/Ll626J
+3tcmYxHPvDCKferhoZyevOhcilB/yM+MjAnirhs/GB1Ufmqo7akEnvz8SEen1aPe
+86xjT0DuJ94CDfhs+5jcc/HGvEh/+/Q8j3pXfax2UdeKx3uBZTfty5nyyGuNiBCf
+6uEjWBRACr9n94vpz1bd+FwuNYan+yDgjzy7IPbDw+mdkWcVZVC62Wp1HpOizWbt
+0Fi/vRp/7d4l/wP6gqtBUjSMPWuum2o+BSs/h4gNjKQECsyx9gwCOwyYR2wfpA7T
+zu9f6OAjZIQEZK3QGESwk3xD9VovjdZD7fqh6NpC4stWxSjnxhywBDsjV3Z9ILQw
+sZxpVHxF2xt/joOpiXxZMjCbcH68szOWiTPJbP55uQbta+VwZZ+tNeATDCcXS3Bn
+45XzoJC2+wZKMyFPe8S6orNHvcs9iD5GMSfjg/iPJVSDqWOjGzOCfOp4LWAQ/lSo
+1c+hxOaLDqWYXfcdbDY1WHKagQan7X06rpliT6/SiMmtMrBVqs7uDl1wKoSo72al
+pDzE8Zbn5AV8jcGlrH9UPL2zfh0xrdXCc2DbI8Ypm9P5T9Z99+0CAwEAAaOCAd0w
+ggHZMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFG8Aru+gFUxcHqe0bI9fH93u
+xmwRMB8GA1UdIwQYMBaAFCTQfPOIKnP/h6DLaeBrLha9TtXmMAsGA1UdDwQEAwIF
+oDATBgNVHSUEDDAKBggrBgEFBQcDATBnBgNVHR8EYDBeMC2gK6AphidodHRwOi8v
+aW50ZXJ0ZXN0LndnZXR0ZXN0Lm9yZy9Cb2d1cy5jcmwwLaAroCmGJ2h0dHA6Ly9p
+bnRlcnRlc3Qud2dldHRlc3Qub3JnL0JvZ3VzLmNybDAcBgNVHREEFTATghFXZ2V0
+VGVzdGluZ1NlcnZlcjCB3AYIKwYBBQUHAQEEgc8wgcwwMwYIKwYBBQUHMAKGJ2h0
+dHA6Ly9pbnRlcnRlc3Qud2dldHRlc3QuY29tL0JvZ3VzLmNydDAzBggrBgEFBQcw
+AoYnaHR0cDovL2ludGVydGVzdC53Z2V0dGVzdC5jb20vQm9ndXMuY3J0MC8GCCsG
+AQUFBzABhiNodHRwOi8vaW50ZXJ0ZXN0LndnZXR0ZXN0LmNvbS9vY3NwLzAvBggr
+BgEFBQcwAYYjaHR0cDovL2ludGVydGVzdC53Z2V0dGVzdC5jb20vb2NzcC8wDQYJ
+KoZIhvcNAQEFBQADggIBAEvgGXVlLQz+1LY9oQKPPYmmaxLG7uN5oLSv+hWXvjX3
+BgA5uvkw5FXZmPylt1QiUnE6NdQ7ngAeXruLTyG9x999ZUzMMk6rUZXiWbQJwniN
+v6w72cqe3DmsldKR+SgxzZNU23rzyKJ236CziuEAMaW68z4/Lrh7y7ujYYNfau43
+iC+JpbZ57zzB580LX1HU3quFl/WMjdZZHubbo6sdHV/9unA5l6EPtG3MHV1JQZwS
+nrMZ3mSrgy/zv28mFOS+GlCaeCKZwDk1/7FF6tOPDe09wrB3cSYSSvCBg9fJ8gzo
+wnublnsGq+XvrOY0WO3Tm6O5nn54Fm66IdNIAbw+X25WY8xK9OASXotoc7c6Dh3N
+RBVuXPT9jgLypDfOCNpchiZXZTBaEykIqw/2pquZ3vDFvxWhMOojyq8Ki6RYjRJP
+Uif8UtxtmmYPQ8coKZKS2uecXPsp5jEGgamMUYbSogi9dvthS45JSJrKowRs3Vky
+4UHzCQubwGBkNIchzzO/FxTC1QUMTSGKTV4TvzLHWbtI3oIVjiSTTMiO5xKGr2lc
+XNigkIBkdIS7zi7pEQaW7VI6uh9IohMU0SboohNtLuytKPV02td+XuvrS409c8Gs
+OCBS5sVy+n7gbPohJUL4/jodCkvB7js2YblY7AlKTU9R5XyvtBuNKEXhZ9Esckd9
+-----END CERTIFICATE-----
diff --git a/tests/certs/user.key b/tests/certs/user.key
new file mode 100644
index 00000000..5980ffe0
--- /dev/null
+++ b/tests/certs/user.key
@@ -0,0 +1,51 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIJKAIBAAKCAgEAue1aicWOIKKNxu4MYvaaZU3aOgQnuCPPjBpfHHkJGuXrV4Lz
+SGaydLuVpACHWieIV37ugIfs0sqJhlMNefacZuAZrXhhiyCbPtq0Qju9uGLxDkAm
+c/Ll626J3tcmYxHPvDCKferhoZyevOhcilB/yM+MjAnirhs/GB1Ufmqo7akEnvz8
+SEen1aPe86xjT0DuJ94CDfhs+5jcc/HGvEh/+/Q8j3pXfax2UdeKx3uBZTfty5ny
+yGuNiBCf6uEjWBRACr9n94vpz1bd+FwuNYan+yDgjzy7IPbDw+mdkWcVZVC62Wp1
+HpOizWbt0Fi/vRp/7d4l/wP6gqtBUjSMPWuum2o+BSs/h4gNjKQECsyx9gwCOwyY
+R2wfpA7Tzu9f6OAjZIQEZK3QGESwk3xD9VovjdZD7fqh6NpC4stWxSjnxhywBDsj
+V3Z9ILQwsZxpVHxF2xt/joOpiXxZMjCbcH68szOWiTPJbP55uQbta+VwZZ+tNeAT
+DCcXS3Bn45XzoJC2+wZKMyFPe8S6orNHvcs9iD5GMSfjg/iPJVSDqWOjGzOCfOp4
+LWAQ/lSo1c+hxOaLDqWYXfcdbDY1WHKagQan7X06rpliT6/SiMmtMrBVqs7uDl1w
+KoSo72alpDzE8Zbn5AV8jcGlrH9UPL2zfh0xrdXCc2DbI8Ypm9P5T9Z99+0CAwEA
+AQKCAgBzBQnwlx1wxP8OZK+W/VXQe9QX9gAYY1b/JkVWmO3wDPKFZcZZMOcPXgiZ
+t5YESNaIwkaLjwsL8C4ZwgFhRRXGcraP4Rv+9MH1pVjEbK7Whab4mOjw7AAeoHh8
+Of9OZHNtyV2zvf2te/WbiefNzTTwJq2c6HSqHsLuiR5/Qj6VH+1y6bCsil+iw8im
+WCvrmJB8a1Q8DkZlc1BWDelTC0rZtGNOo3HCllFwGfaJp7cJxgq+3NMb96VL2nUD
+2hmCYKypuXV4575R/Tw+a9BOXqpGqjUhh4GASAgdh8VpcSsETWf6Hmir7MtXZGiU
+boLXWrBvl/FLjMuJ0KYNU+K6EIaoIqb0PDbxfmo+nmQD/a/JSF3sYOUiqMJd34VC
+PYWpO+tDXSbtfHxJdP0/YBEKsvIU1kNYO8TE2zT8wl+AZJ2yz71p7VlQGN/24jnJ
+qTNY8HJ0TXgBZVBHsrgOlwTVWmuUcqIpVkrVO99iVO9C5EwqZey8CmGsJp+FfBpG
+pwVd99N7qi1q/VhBMERbeawDAjdKwU4IWFREB4ryTDw1+tVdCo3vXPYT+kRgPHW/
+mP1sG1kRkxYlrrGspx0o2wIHS/DUouxijJ0hC9UYoKINpvjSC+3Kijkl5cULtrO3
+Py6qeZPgoAK7iMtIVUwkxMZ3KNP7y7NoOIsP5L/dX+L311tG5QKCAQEA2woTdkZE
+un8wlGAsvBxSBzqD0l9otKQ297BLrqgnvIOqs02AF4sekaYdB2jIE/eMftZm7bjL
+4na4F7SGpKhMumJhaJUPa22fChcLHjWg082PoGHQM0Mf1Syyup+uLa2qFF+YAxHe
+aK9UO9Fi+cK5L0JeEY3ft0EkP1IELn+TfTnOCTeoMFy9K3ypaYW4td6aEIdhSMxf
+1am+5BB1Zu1NRsNiPWK3TOKeOqnFm0E3IhXLPjmd9RIDRDmvOXcLuRc3a5TC7zEG
+MuBD1deYFZSwJHIa/ykReW/fQRiqzYa+zZCpzwLx2Daz1RAqmibUEmCL9ldxh3vJ
+Dt8x3B6+UydYQwKCAQEA2Uzq+Y7sh1SNWKxlR94UDvBC6Cbz7vJWy5zcs8vV3YNn
+jNi+/tXdAWpmTxGgW8bxa8iwpfGNKQmMVLQDmoSRk9s5KsVomtLkEkTdtIRyrdjh
+NKjSmy0ECyfeGU/1KflHBpw+DRwVVxEhoFhum88FcDoihD9CKzPMr2d5RMmsPtCS
+WpldQKbhoIAEOWnXyIsEU090m9u9jKKfDU5lUGXD7Gl4bMhe2umPJN0Cj6MrOmhj
+kvc3V7bqlC3ikYbOI4r8oFT0sbo9XWl0caRmtqwvpPXQOQ6XLbFkLcNKRubMWSvs
+OcznU4o0PJiujO1Ue1sBz4/BwM1Dq4dYkur0qGpEDwKCAQBkuzaGDvyuc62onq4T
++EY08tEKnzvszxRERjwX31ce18JZ4QtGSIFPZAA3lxVkMVTYQ8tkCbcht40jwa6l
+7IwUrwey69ICipA4OK6xPuJuZTtm+3SfDoCGLZ8oOiUE9ref1PJ4fvA0XmUzeTC2
+QbmeJTxTgFZg1UFRKWuo4py2Wy4IiSL80rlgVV0nnQp8ARoC/e9cZjiwbvbNtU/4
+fKssHtCAAHThk9pGiirJIm2zbChivmaI/Lap2olduQSYIzgmbmxTSc1a+k3X+uUD
+D7UNnbgSnhVeLneSXUC3cf8vVBbzj5we3dFH675b0/11Uhcru70HHIMzJqusWisW
+3KI3AoIBAQCJmsDNyekUhcGAXqNAUGyJTTJBSrF8JfA6vhmwraq/vH+tXHAOdiWe
+yN8CwRm4JJIq/AqI+x611vsLhHcnuT1q0Q8xe5MTP+r3eq6eqqToXAe4zhOX+niu
+C9AEXXLV4qpMkFJnANquqQWPQZDBj+ZUvCuxbVGchA/hH3hWzBMMMA4N20KHN2Z3
+ublzFgh0UTwq+YzRSeSNk0l/Jp7Xu6nHIr8EvBn9LJvd7yq5BM3SDdrIbU6ZeBay
+QSBRoXkWXuQ9L69IgLRtW+NGN6JnmUAOiS8Tgp7Pa58Rr7JwlaTf7wWHUK9IYqNT
+oCggzAWMnAPYiaNbUWDB1VKMrsbBg5GXAoIBAHzDXgiVAXkvMKIrVk+QOj5/mV5s
+bggtYtUCrs5bEBHdBvykPdMWjLiVpNhHniIXCp8jc1Cvc1gJiFTo2oJIVvPHVQvr
+9xd0dEtcXYjusLrbzijd5KefelkQeZbo1EX3p4wFVOcYjuR4EHLHQN9xe5fb5Hne
+e97CtK/P9SLKOF9Lwy3oqjZkRk1sgY9DWzYMNj/VHhCFbF1rodlQJx9ThBXYat9L
+gOmUK1AJrCkQEPTbcL5GERL/pG821OeZ6hd94zBzk/gddU0Fgwp5E1IsIhxe1Wp5
+D+yzH9HJ7Hm0ileMcAi9dvvvGPV8CXIc/7rVtVwxmTKZBHiN3DpFOMgOFrE=
+-----END RSA PRIVATE KEY-----