New release s390-tools-2.43.1

Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>

CHANGELOG.md

@@ -1,6 +1,38 @@
 Release history for s390-tools (MIT version)
 --------------------------------------------
 
+* __v2.43.1 (2026-07-22)__
+
+  For Linux kernel version: 7.1
+
+  Changes of existing tools:
+  - dasdfmt: Check disk type before prompting for blocksize
+  - iucvterm/ts-shell: Introduce config parameter to specify iucvconn binary
+  - iucvterm/ts-shell: Introduce pager config to replace env variable
+  - pv: Add root CA organization pinning to certificate verification
+  - zdump/ngdump: Use OpenSSL's SHA256 to compute digest of dump image
+
+  Bug Fixes:
+  - 95sel-ebc: Add udev-settle dependency
+  - 95sel-ebc: Add umount to boot service
+  - 95sel-ebc: Harden boot mount service
+  - fdasd: Fix memory leak in yes_no() function
+  - iucvterm/iucvtty: Ensure PTY and server fd's are closed at exec
+  - iucvterm/iucvtty: Prevent connection stalls when receiving TERM env
+  - iucvterm/iucvtty: Validate TERM environment name
+  - libkmipclient: Protect from symlink-following attacks
+  - libkmipclient: Various bugfixes
+  - libseckey: Protect from symlink-following attacks
+  - libseckey: Various bugfixes
+  - mon_procd: Fix possible static buffer overflow
+  - osasnmpd: Fix SNMP non-compliance
+  - zdev: Harden against invalid udev, import, firmware, or hypervisor data
+  - zipl-editenv: Check in-bootmap environment block validity
+  - zipl/boot: Check in-bootmap environment block syntax
+  - zipl: Check keyword duplications in BLS entries
+  - zipl: Fix bugs in mirror support
+  - zkey: Protect from symlink-following attacks
+
 * __v2.43.0 (2026-06-25)__
 
   For Linux kernel version: 7.1

cmsfs-fuse/cmsfs-fuse.c

@@ -713,7 +713,7 @@ static int readdir_entry(struct fst_entry *fst, off_t addr)
  */
 static inline int strip_right(const char *str, int size)
 {
-	while (str[size - 1] == 0x20)
+	while (size > 0 && str[size - 1] == 0x20)
 		size--;
 	return size;
 }

common.mak

@@ -33,7 +33,7 @@ endif
 # "make DISTRELEASE=%{release}" and "make install DISTRELEASE=%{release}"
 VERSION            := 2
 RELEASE            := 43
-PATCHLEVEL         := 0
+PATCHLEVEL         := 1
 DISTRELEASE        := build-$(shell date +%Y%m%d)
 S390_TOOLS_RELEASE := $(VERSION).$(RELEASE).$(PATCHLEVEL)-$(DISTRELEASE)
 export S390_TOOLS_RELEASE

dasdfmt/dasdfmt.c

@@ -1566,6 +1566,8 @@ int main(int argc, char *argv[])
 	g.ese = dasd_sys_ese(g.dev_node);
 	eval_format_mode();
 
+	check_disk();
+
 	/* Either let the user specify the blksize or get it from the kernel */
 	if (!g.blksize_specified) {
 		if (!(mode == FULL ||
@@ -1587,8 +1589,6 @@ int main(int argc, char *argv[])
 			error("VOLSER not found on device %s", g.dev_path);
 	}
 
-	check_disk();
-
 	if (check_param(str, ERR_LENGTH, &format_params) < 0)
 		error("%s", str);
 

fdasd/fdasd.c

@@ -387,20 +387,28 @@ static int yes_no(char *question_str)
 	ssize_t bytes_read;
 	char *answer;
 	size_t size;
+	int rc;
 
 	size = 0;
 	answer = NULL;
 	while (1) {
 		printf("%s (y/n): ", question_str);
 		bytes_read = getline(&answer, &size, stdin);
-		if (bytes_read < 0)
-			return -1;
-		if (answer[0] == 'y')
-			return 0;
-		if (answer[0] == 'n')
-			return 1;
+		if (bytes_read < 0) {
+			rc = -1;
+			break;
+		}
+		if (answer[0] == 'y') {
+			rc = 0;
+			break;
+		}
+		if (answer[0] == 'n') {
+			rc = 1;
+			break;
+		}
 	}
 	free(answer);
+	return rc;
 }
 
 static char *fdasd_partition_type(char *dsname)

hmcdrvfs/hmcdrvfs.c

@@ -514,7 +514,7 @@ static int hmcdrv_path_copy(struct hmcdrv_fuse_file *fp, char *dest)
 	char *src = HMCDRV_FUSE_PATH(fp);
 	int len = 0;
 
-	while ((len < (HMCDRV_FUSE_MAXPATH - 1)) &&
+	while ((len < (HMCDRV_FUSE_MAXPATH - 2)) &&
 	       (*src != '\0')) {
 
 		*dest = *src;

iucvterm/bin/ts-shell.in

@@ -14,14 +14,19 @@ use strict;
 use warnings;
 use File::Basename;
 use Getopt::Long qw(:config no_ignore_case);
+use Scalar::Util qw(tainted);
 use Term::ReadLine;
 use POSIX;
 
+$ENV{'PERL5LIB'} = "";
+$ENV{'PERL5OPT'} = "";
+$ENV{'PERLLIB'} = "";
+$ENV{'PERL_USE_UNSAFE_INC'} = "";
+delete @ENV{qw(IFS CDPATH ENV BASH_ENV)};
 
 $ENV{'PERL_RL'} = " o=0";   # use best avail. readline
 $ENV{'PATH'} = "/bin:/sbin:/usr/bin:/usr/sbin";
 $ENV{'LESSSECURE'} = 1;     # let less run in "secure" mode
-$ENV{'PAGER'} = $ENV{'PAGER'} || "/usr/bin/less";
 my $ts_shell = fileparse($0, qr/\.[^.]+/);
 $SIG{__WARN__} = sub { print STDERR "$ts_shell: $_[0]"; };
 $SIG{__DIE__}  = sub { print STDERR "$ts_shell: $_[0]"; exit 255; };
@@ -36,6 +41,7 @@ my %config = (
 	'auditdir'	=>	"@var_path@/log/ts-shell",
 	'iucvconn'	=>	"@iucvconn_path@/iucvconn",
 	'prompt'	=>	getpwuid($>) . '@'."$ts_shell> ",
+	'pager'		=>	"/usr/bin/less",
 	# runtime options
 	'rl'		=>	undef,		# terminal readline (rl)
 	'user'		=>	getpwuid($>),	# user name
@@ -65,6 +71,7 @@ sub cmd_list(\%);
 sub rl_cmd_completion($$$);
 sub list_regex_match($);
 sub updateConfiguration(\%$);
+sub checkConfiguration(\%);
 sub loadAuthorization(\%);
 sub readFile($$);
 sub log_debug($);
@@ -103,6 +110,7 @@ sub main()
 			  "$config{conffile} failed: $!";
 		exit 3;
 	}
+	checkConfiguration(%config);
 
 	# load list of systems the ts-shell is allowed to use; and
 	# hash the systems names in uppercase
@@ -185,11 +193,50 @@ sub updateConfiguration(\%$)
 {
 	my ($cfg, $line) = @_;
 	my ($option, $value) = split /\s*=\s*/, $line;
-	
+
 	$cfg->{sysfile}   = $value if $option =~ /^ts-systems$/;
 	$cfg->{authfile}  = $value if $option =~ /^ts-authorization$/;
 	$cfg->{auditdir}  = $value if $option =~ /^transcript-directory$/;
 	$cfg->{auditfile} = $value if $option =~ /^transcript-systems$/;
+	$cfg->{pager}     = $value if $option =~ /^pager$/;
+	$cfg->{iucvconn}  = $value if $option =~ /^iucvconn$/;
+}
+
+# checkConfiguration() - Validate and untaint configuration values
+#
+# Called once after readFile() has finished populating %cfg from
+# ts-shell.conf.  Validates each security-sensitive path and untaints
+# it via a regex capture so Perl taint mode permits later filesystem use.
+#
+# %cfg:	Hash reference to terminal server configuration
+#
+sub checkConfiguration(\%)
+{
+	my $cfg = shift;
+
+	# Validate pager to untaint for later use
+	unless ($cfg->{pager} =~ m#^(/[\w./-]+)$#) {
+		log_error "Invalid pager configuration";
+		exit 6;
+	}
+	$cfg->{pager} = $1;
+
+	# Validate iucvconn path to untaint for later use
+	unless ($cfg->{iucvconn} =~ m#^(/[\w./-]+)$#) {
+		log_error "Invalid iucvconn configuration";
+		exit 7;
+	}
+	$cfg->{iucvconn} = $1;
+
+	# Validate transcript-directory to untaint for later use
+	unless ($cfg->{auditdir} =~ m#^(/[\w./-]+)$#) {
+		log_error "Invalid transcript-directory configuration";
+		exit 8;
+	}
+	$cfg->{auditdir} = $1;
+
+	# Untaint user name (tainted by getpwuid) for use in filesystem paths
+	($cfg->{user}) = ($cfg->{user} =~ /^([\w.-]+)$/);
 }
 
 # loadAuthorization() - Load system authorizations from file
@@ -205,7 +252,7 @@ sub loadAuthorization(\%)
 {
 	my $cfg = shift();
 
-	return 0 unless open(AUTH, "<$cfg->{authfile}");
+	return 0 unless open(AUTH, "<", $cfg->{authfile});
 
 	AUTH_ENT: while (<AUTH>) {
 		chomp;
@@ -217,13 +264,13 @@ sub loadAuthorization(\%)
 		my ($key, $val) = split /\s*=\s*/;
 
 		# read authorization configuration for user and its groups
-		if ($key =~ /^$cfg->{user}$/) {
+		if ($key =~ /^\Q$cfg->{user}\E$/) {
 			$authorized = 1;
 			log_debug "Found user: $key";
 
 		} elsif ($key =~ /^@(\S+)$/) {
 			my $group = $1;
-			$authorized = 1 if grep {/^${group}$/} @{$cfg->{groups}};
+			$authorized = 1 if grep {/^\Q${group}\E$/} @{$cfg->{groups}};
 			log_debug "Found group: $key" if $authorized;
 		}
 
@@ -303,7 +350,7 @@ sub readFile($$)
 {
 	my ($file, $sub) = @_;
 
-	return 0 unless open(CONF, "<$file");
+	return 0 unless open(CONF, "<", "$file");
 	while (<CONF>) {
 		chomp;
 		next if /^#/;		# ignore comments
@@ -392,7 +439,15 @@ sub get_auditlog_file($$$)
 		}
 	}
 
-	$$filepath  = "$cfg->{auditdir}/$cfg->{user}/" . uc $guest . "_";
+	# validate and sanitize guest directory
+	$guest = uc $guest;
+	unless ($guest =~ /^([A-Z0-9@#\$_-]{1,8})$/) {
+		log_error "Creating session file path failed for guest: $guest";
+		return 0;     # return error
+	}
+
+	# construct the file path
+	$$filepath  = "$cfg->{auditdir}/$cfg->{user}/" . $guest . "_";
 	$$filepath .= strftime '%F-%H%M%S', localtime;
 
 	log_debug "Session transcript file: $$filepath";
@@ -416,7 +471,7 @@ sub cmd_connect($\%)
 	}
 
 	my ($guest, $srv) = split /\s+/, $params;
-	$service = $srv if $srv && $srv =~ /\w{1,8}/;
+	$service = $srv if $srv && $srv =~ /^\w{1,8}$/;
 
 	# check authorization:
 	# The auth_func contract is to return a code, that must be one of:
@@ -482,7 +537,7 @@ sub cmd_service($\%)
 		return;
 	}
 
-	if ($new =~ /\w{1,8}/) {
+	if ($new =~ /^\w{1,8}$/) {
 		$cfg->{service} = $new;
 		# push new service for cmd completion
 		unless (grep /$new/, @{$cfg->{services}}) {
@@ -545,7 +600,7 @@ sub pager($)
 {
 	my $eval = shift();
 
-	unless (open(PAGER, "|$ENV{'PAGER'}")) {
+	unless (open(PAGER, '|-', "$config{'pager'}")) {
 		eval &$eval;
 		return;
 	}

iucvterm/doc/ts-shell.1

@@ -1,9 +1,8 @@
+.\" SPDX-License-Identifier: MIT
+.\"
 .\" ts-shell.1
 .\"
-.\"
-.\" Copyright IBM Corp. 2008, 2017
-.\" s390-tools is free software; you can redistribute it and/or modify
-.\" it under the terms of the MIT license. See LICENSE for details.
+.\" Copyright IBM Corp.
 .\" ----------------------------------------------------------------------
 .TH "ts-shell" "1" "March 2009" "s390-tools" "Terminal Server over IUCV"
 .
@@ -269,6 +268,10 @@ session transcripts are saved.
 
 See section "Configure terminal session transcripts" for details.
 .
+.TP
+.BR pager " = " \fI/usr/bin/less\fP
+Specifies the path to a pager program to paginate output of ts-shell commands.
+.
 .RE
 .
 .
@@ -542,14 +545,6 @@ Directory for saving terminal session transcripts.
 .
 .SH "ENVIRONMENT"
 .TP
-.B PAGER
-The \fBPAGER\fP environment variable designates a program used as pager for the
-\fBlist\fP command of the terminal server shell.
-If \fBPAGER\fP is not set or empty,
-.BR less (1)
-is used.
-.
-.TP
 .B LESSSECURE
 \fBts-shell\fP sets this variable to run
 .BR less (1)

iucvterm/etc/ts-shell.conf.in

@@ -2,6 +2,12 @@
 #
 # See ts-shell(1) manual page for file format syntax.
 
+# Generic settings
+# ----------------
+
+# pager
+#	binary to paginate output (default: less)
+#pager = /usr/bin/less
 
 # System and authorization settings
 # ---------------------------------

iucvterm/include/iucvterm/functions.h

@@ -21,6 +21,9 @@
 /* Message buffer: message header + 4096 bytes of data */
 #define MSG_BUFFER_SIZE		(MSG_DATA_OFFSET + (4096))
 
+/* Message data sizes */
+#define MAX_TERM_SIZE		256
+
 /* Error macros */
 #define print_error(s)		program_error(PRG_COMPONENT, (s))
 #define iucvtty_error(m)					\
@@ -55,13 +58,14 @@ extern int iucvtty_read_data(int, struct iucvtty_msg *, size_t);
 
 extern int iucvtty_read_msg(int, struct iucvtty_msg *, size_t, size_t *);
 extern int iucvtty_write_msg(int, struct iucvtty_msg *);
-extern void iucvtty_skip_msg_residual(int, size_t *);
+extern void iucvtty_skip_msg_chunk(int, size_t *);
 
 extern ssize_t __write(int, const void*, size_t);
 
 extern int strmatch(const char *, const char *);
 extern int is_regex_valid(const char *);
 extern int is_client_allowed(const char *, const struct iucvterm_cfg *);
+extern int is_term_valid(const char *term, size_t len);
 extern void userid_cpy(char [9], const char [8]);
 
 extern void iucv_msg_error(const char *, uint32_t);

iucvterm/include/iucvterm/proto.h

@@ -86,7 +86,7 @@ static inline struct iucvtty_msg *msg_alloc(uint8_t type, uint16_t size)
 {
 	struct iucvtty_msg *m;
 
-	m = malloc(size + MSG_DATA_OFFSET);
+	m = calloc(1, size + MSG_DATA_OFFSET);
 	if (m != NULL) {
 		m->version = MSG_VERSION;
 		m->type    = type;

iucvterm/src/functions.c

@@ -8,6 +8,8 @@
  * s390-tools is free software; you can redistribute it and/or modify
  * it under the terms of the MIT license. See LICENSE for details.
  */
+#include <assert.h>
+#include <ctype.h>
 #include <errno.h>
 #include <regex.h>
 #include <stdio.h>
@@ -36,7 +38,7 @@
  * @len:	Buffer length
  *
  * Write @len number of bytes from the buffer @buf to the file
- * descriptor @fd. The routines handles EINTR and partially writes.
+ * descriptor @fd. The routine handles EINTR and partial writes.
  * Returns the error code from the underlying write(2) syscall.
  */
 ssize_t __write(int fd, const void *buf, size_t len)
@@ -55,6 +57,33 @@ ssize_t __write(int fd, const void *buf, size_t len)
 	return written;
 }
 
+/**
+ * __read() - Read data
+ * @fd:		File descriptor
+ * @buf:	Pointer to data buffer
+ * @len:	Buffer size
+ *
+ * Read up to @len number of bytes from file descriptor @fd and stores them
+ * in the buffer to which @buf points.
+ * The routine handles EINTR and partial reads and returns the error code
+ * from the underlying read(2) syscall.
+ */
+ssize_t __read(int fd, void *buf, size_t len)
+{
+	ssize_t rc;
+	size_t count = 0;
+
+	while (count < len) {
+		rc = read(fd, buf + count, len - count);
+		if (rc == -1 && errno == EINTR)
+			continue;
+		if (rc <= 0)
+			return rc;
+		count += rc;
+	}
+	return count;
+}
+
 #ifdef __DEBUG__
 static void __dump_msg(int fd, const struct iucvtty_msg *m, char dir)
 {
@@ -116,14 +145,16 @@ int iucvtty_tx_termenv(int dest, char *dflt)
 
 	len = 0;
 	if (term != NULL)
-		len = 1 + strlen(term);
+		len = MIN(1 + strlen(term), (size_t)MAX_TERM_SIZE);
 
 	/* Note: The server console tool waits for terminal environment
 	 *       information: the message is sent even if it is empty */
 	msg = msg_alloc(MSG_TYPE_TERMENV, len);
 	if (msg == NULL)
 		return -1;
-	msg_cpy_from(msg, term, len);
+	msg->datalen = len;
+	if (msg->datalen)
+		snprintf((char *)msg->data, msg->datalen, "%s", term);
 	rc = iucvtty_write_msg(dest, msg);
 	msg_free(msg);
 
@@ -146,12 +177,14 @@ int iucvtty_rx_termenv(int fd, void *buf, size_t len)
 		return -1;
 	skip = 0;
 	rc = iucvtty_read_msg(fd, msg, msg_size(msg), &skip);
-	iucvtty_skip_msg_residual(fd, &skip);
+	iucvtty_skip_msg_chunk(fd, &skip);
 	if (!rc) {
-		if (msg->datalen == 0)
+		if (msg->datalen == 0) {
 			memset(buf, 0, MIN(1u, len));
-		else
+		} else {
 			msg_cpy_to(msg, buf, len);
+			memset(buf + MIN(msg->datalen, len - 1), 0, 1);
+		}
 	}
 	msg_free(msg);
 	return rc;
@@ -262,93 +295,175 @@ int iucvtty_copy_data(int dest, struct iucvtty_msg *msg)
 }
 
 /**
- * iucvtty_skip_msg_residual() - Skip (receive & forget) count number of bytes
+ * iucvtty_skip_msg_chunk() - Skip (receive & forget) count number of bytes
  * @fd:		File descriptor
- * @residual:	Residual of an iucv tty message received by iucvtty_read_msg()
+ * @chunk:	Remaining chunk from a previous iucvtty_read_msg() call
  *
  * See iucvtty_read_msg() for an explanation when to use this routine.
- * Note: The @residual parameter shall not be NULL.
+ * Note: The @chunk parameter must not be NULL.
  */
-void iucvtty_skip_msg_residual(int fd, size_t *residual)
+void iucvtty_skip_msg_chunk(int fd, size_t *chunk)
 {
-	char b;
-	size_t  i;
+	int r;
+	char buf[256];
 
-	if (*residual <= 0)
+	if (*chunk <= 0)
 		return;
-	for (i = 0; i < *residual; i++)
-		if (read(fd, &b, 1) <= 0)
+
+	while (*chunk) {
+		r = __read(fd, buf, MIN(sizeof(buf), *chunk));
+		if (r <= 0)
 			break;
-	*residual = 0;
+		*chunk -= r;
+	}
+
+	*chunk = 0;
+}
+
+/**
+ * iucvtty_read_msg_chunk() - Read IUCV message chunk
+ * @fd:	      File descriptor to read from
+ * @msg:      Pointer to IUCV message buffer
+ * @msglen:     IUCV message buffer size (including message header)
+ * @chunk:    Size of chunk data to read
+ *
+ * Stores new message data and calculates next chunk size if not all data
+ * could be read.  Returns zero on success, non-zero otherwise.
+ */
+static int iucvtty_read_msg_chunk(int fd, struct iucvtty_msg *msg,
+				  size_t msglen, size_t *chunk)
+{
+	ssize_t r;
+	size_t datalen;
+
+	/* Calculate message data length to read */
+	datalen = MIN(msglen - MSG_DATA_OFFSET, *chunk);
+
+	for (;;) {
+		r = read(fd, msg->data, datalen);
+		if (r == -1 && errno == EINTR)
+			continue;
+		if (r <= 0)
+			return -1;
+		break;
+	}
+
+	/* Update message and re-calculate next chunk */
+	msg->datalen = r;
+	*chunk -= r;
+
+	return 0;
+}
+
+/**
+ * validate_msg() - Perform sanity checks on a received message
+ * @msg:	IUCV message buffer
+ *
+ * Returns zero if the message is valid; otherwise non-zero
+ */
+static int validate_msg(struct iucvtty_msg *msg)
+{
+	switch (msg->type) {
+	case MSG_TYPE_DATA:
+		/* The datalen ranges from 0 to its maximum of 0xffff
+		 * which is the maximum of the type definition of uint16_t.
+		 *
+		 * Consider the datalen value as valid.
+		 */
+		break;
+	case MSG_TYPE_ERROR:
+		if (msg->datalen != sizeof(uint32_t))
+			return 1;
+		break;
+	case MSG_TYPE_TERMENV:
+		if (msg->datalen > MAX_TERM_SIZE)
+			return 1;
+		break;
+	case MSG_TYPE_TERMIOS:	/* ignored */
+		break;
+	case MSG_TYPE_WINSIZE:
+		if (msg->datalen != sizeof(struct winsize))
+			return 1;
+		break;
+	default:
+		/* Invalid message type */
+		return 1;
+	}
+
+	return 0;
 }
 
 /**
  * iucvtty_read_msg() - Read/Receive an IUCV message
  * @fd:		File descriptor to read from
  * @msg:	Pointer to IUCV message buffer
- * @len:	IUCV message data len
- * @residual:	Status to be used by next call
+ * @msglen:	IUCV message buffer size (MUST BE > MSG_DATA_OFFSET)
+ * @chunk:	Size of remaining data; must be passed on next call
  *
- * The function reads up to @len bytes from file descriptor @fd.
- * If the received message is larger than @len bytes, the @residual value
- * is set to the number of bytes remaining.
- * The function shall then be re-called to create a new message and receive
- * the next chunk of size @residual; or the remaining characters must be
- * skipped using the iucvtty_skip_msg() routine.
- * Note: The @len parameter shall be greater than MSG_DATA_OFFSET.
- *       The @residual parameter shall not be NULL.
+ * The function reads up to @len bytes from file descriptor @fd.  If the
+ * received message is larger than @len bytes, the @chunk value is set to
+ * the number of remaining bytes.  The function shall then be re-called to
+ * create a new message and receive the outstanding data.  Alternatively,
+ * call iucvtty_skip_msg_chunk() to discard remaining data.
+ *
+ * NOTE: The @len parameter must be greater than MSG_DATA_OFFSET!
+ *       The @chunk parameter must not be NULL.
  */
 int iucvtty_read_msg(int fd, struct iucvtty_msg *msg,
-		     size_t len, size_t *residual)
+		     size_t msglen, size_t *chunk)
 {
 	int rc;
 	ssize_t r;		/* number of bytes read from fd */
 
-	if (*residual)
-		len = MIN(len - MSG_DATA_OFFSET, *residual);
+	/* Ensure message buffer size can hold data and can be processed */
+	assert(msglen > MSG_DATA_OFFSET);
+	assert(chunk != NULL);
 
-	while (1) {
-		if (*residual) {
-			r = read(fd, msg->data, len);
-			if (r > 0)
-				msg->datalen = r;
-		} else
-			r = read(fd, msg, len);
+	/* Read pending message data */
+	if (*chunk)
+		return iucvtty_read_msg_chunk(fd, msg, msglen, chunk);
 
-		if (r == -1 && errno == EINTR)
-			continue;
-		if (r <= 0) {
-			rc = -1;
-			goto out_read_error;
-		}
-
-		break;	/* exit loop for a successful read */
+	/* Read message header of new message */
+	r = __read(fd, msg, MSG_DATA_OFFSET);
+	if (r <= 0) {
+		rc = -1;
+		goto out_read_error;
 	}
+
 #ifdef __DEBUG__
-	if (!*residual)
-		__dump_msg(fd, msg, 'R');
+	__dump_msg(fd, msg, 'R');
 #endif
 
-	/* (re)calculate next chunk */
-	if (*residual)
-		*residual -= msg->datalen;
-	else
-		if (msg->datalen > (r - MSG_DATA_OFFSET)) {
-			/* calculate pending msg data and update datalen */
-			*residual = msg->datalen - (r - MSG_DATA_OFFSET);
-			msg->datalen = r - MSG_DATA_OFFSET;
-		}
-
-	/* check for a sane message */
+	/* Check message header */
 	if (msg->version != MSG_VERSION) {
 		fprintf(stderr, _("%s: %s\n"),
 			PRG_COMPONENT, _("The version of the received data "
-					 "message is not supported\n"));
+					 "message is not supported"));
+		fprintf(stderr, "MSG: msg->version=%u msg->type=%u msg->datalen=%u\n",
+			msg->version, msg->type, msg->datalen);
 		rc = -2;
 		goto out_read_error;
 	}
 
-	rc = 0;
+	/* Check for an empty message */
+	if (!msg->datalen)
+		return 0;
+
+	/* Check message type and data length */
+	if (validate_msg(msg)) {
+		fprintf(stderr, _("%s: %s\n"),
+			PRG_COMPONENT, _("The received message is invalid"));
+		fprintf(stderr, "MSG: msg->version=%u msg->type=%u msg->datalen=%u\n",
+			msg->version, msg->type, msg->datalen);
+		rc = -3;
+		goto out_read_error;
+	}
+
+	/* Process the new message as a one chunk */
+	*chunk = msg->datalen;
+	msg->datalen = 0;
+	rc = iucvtty_read_msg_chunk(fd, msg, msglen, chunk);
+
 out_read_error:
 	return rc;
 }
@@ -501,6 +616,31 @@ int is_client_allowed(const char *client, const struct iucvterm_cfg *cfg)
 	return strmatch(client, cfg->client_re);
 }
 
+/**
+ * is_term_valid() - Validate TERM environment value
+ * @term:	Terminal environment name to validate
+ * @len:	Maximum number of characters to validate
+ */
+int is_term_valid(const char *term, size_t len)
+{
+	const char *c;
+
+	if (term == NULL || *term == '\0')
+		return 0;
+
+	for (c = term; *c != '\0'; c++) {
+		if ((size_t)(c - term) >= len)
+			return 0;
+		if (!isalnum((unsigned char)*c) &&
+		    *c != '.' &&
+		    *c != '_' &&
+		    *c != '-')
+			return 0;
+	}
+
+	return 1;
+}
+
 /**
  * userid_cpy() - Copy z/VM user ID and skip trailing spaces.
  * @dest:	Destination buffer

iucvterm/src/iucvtty.c

@@ -17,6 +17,7 @@
 #include <string.h>
 #include <sys/select.h>
 #include <sys/socket.h>
+#include <sys/time.h>
 #include <sys/types.h>
 #include <sys/wait.h>
 #include <syslog.h>
@@ -32,7 +33,6 @@
 
 #define SYSLOG_IDENT		"iucvtty"
 #define PRG_COMPONENT           SYSLOG_IDENT
-#define TERM_BUFSIZE		256
 #define TERM_DEFAULT		"linux"
 
 
@@ -63,12 +63,46 @@ static int exec_login_prog(char *cmd[])
 	return rc;
 }
 
+/**
+ * receive_term_env() - receive terminal environment with timeout
+ * @term:     Terminal environment variable
+ * @len:      Maximum characters for the terminal environment variable
+ */
+static void receive_term_env(int client, char *term, size_t len)
+{
+	struct timeval tv = { .tv_sec = 0, .tv_usec = 0};
+
+	/* Set a temporary timeout of 10s to time out a stalling
+	 * client connection. Use SO_RCVTIMEO to set the timeout.
+	 * Using those hard coded values directly is safe as
+	 * SO_RCVTIMEO is not being used in other parts of iucvtty.
+	 */
+	tv.tv_sec = 10;
+	setsockopt(client, SOL_SOCKET, SO_RCVTIMEO, &tv, sizeof(tv));
+
+	memset(term, 0, len);
+	if (iucvtty_rx_termenv(client, term, len))
+		snprintf(term, len, "%s", TERM_DEFAULT);
+
+	tv.tv_sec = 0;
+	setsockopt(client, SOL_SOCKET, SO_RCVTIMEO, &tv, sizeof(tv));
+
+	if (!is_term_valid(term, len)) {
+		print_error("Ignoring received TERM env due to invalid character(s)");
+		snprintf(term, len, "%s", TERM_DEFAULT);
+	}
+}
+
 /**
  * iucvtty_worker() - Handle an incoming client connection
  * @client:	Client file descriptor
  * @master:	PTY master file descriptor
  * @slave:	PTY slave file descriptor
  * @cfg:	IUCV TTY configuration structure.
+ *
+ * Unlike the HVC IUCV terminal device driver, iucvtty expects to
+ * receive the TERM environment first.  This is necessary to correctly
+ * set up the login program.
  */
 static int iucvtty_worker(int client, int master, int slave,
 			  const struct iucvterm_cfg *cfg)
@@ -78,15 +112,14 @@ static int iucvtty_worker(int client, int master, int slave,
 	pid_t child;
 	fd_set set;
 	size_t chunk;
-	char term_env[TERM_BUFSIZE];
+	char term_env[MAX_TERM_SIZE];
 
 
 	/* flush pending terminal data */
 	tcflush(master, TCIOFLUSH);
 
-	/* read terminal parameters from client */
-	if (iucvtty_rx_termenv(client, term_env, TERM_BUFSIZE))
-		sprintf(term_env, TERM_DEFAULT);
+	/* read and validate terminal parameters from client */
+	receive_term_env(client, term_env, sizeof(term_env));
 
 	/* start login program */
 	child = fork();
@@ -113,6 +146,9 @@ static int iucvtty_worker(int client, int master, int slave,
 		exit(3);	/* we only reach here if exec has failed */
 	}
 
+	/* Close slave fd to properly handle SIGHUP for the child process */
+	close(slave);
+
 	/* setup buffers */
 	msg = malloc(MSG_BUFFER_SIZE);
 	if (msg == NULL) {
@@ -226,8 +262,13 @@ int main(int argc, char *argv[])
 	}
 
 	/* set close-on-exec for file descriptors */
-	fcntl(master, F_SETFD, FD_CLOEXEC);
-	fcntl(server, F_SETFD, FD_CLOEXEC);
+	if (fcntl(master, F_SETFD, FD_CLOEXEC) ||
+	    fcntl(server, F_SETFD, FD_CLOEXEC)) {
+		print_error("Setting file controls failed");
+		close(server);
+		rc = 1;
+		goto exit_on_error;
+	}
 
 	/* syslog */
 	openlog(SYSLOG_IDENT, LOG_PID, LOG_AUTHPRIV);
@@ -240,6 +281,7 @@ int main(int argc, char *argv[])
 	client = accept(server, (struct sockaddr *) &caddr, &len);
 	if (client == -1) {
 		print_error("An incoming connection could not be accepted");
+		close(server);
 		rc = 2;
 		goto exit_on_error;
 	}
@@ -256,10 +298,14 @@ int main(int argc, char *argv[])
 	} else { /* client is allowed to connect */
 		syslog(LOG_INFO, "Accepted client connection from %s",
 			client_host);
-		/* set close-on-exec for client socket */
-		fcntl(client, F_SETFD, FD_CLOEXEC);
 		/* close server socket */
 		close(server);
+		/* set close-on-exec for client socket */
+		if (fcntl(client, F_SETFD, FD_CLOEXEC)) {
+			print_error("Setting file controls failed");
+			rc = 4;
+			goto exit_on_error;
+		}
 
 		/* setup signal handler to notify shutdown signal */
 		sigemptyset(&sigact.sa_mask);

iucvterm/test/test_functions.c

@@ -13,7 +13,6 @@
 #include <stdlib.h>
 #include <string.h>
 #include <sys/ioctl.h>
-#include <termio.h>
 #include <unistd.h>
 
 #include "iucvterm/functions.h"
@@ -114,7 +113,7 @@ static int __testReadWriteMessage_nochunks(int sv[2])
 		if (iucvtty_read_msg(sv[1], msg[1], 6 + MSG_DATA_OFFSET, &residual))
 			return 2;
 		assert(0 == memcmp(msg[1]->data, data, msg[1]->datalen));
-		iucvtty_skip_msg_residual(sv[1], &residual);
+		iucvtty_skip_msg_chunk(sv[1], &residual);
 		assert(0 == residual);
 		/*printf("datalen=%u data='%s'\n",
 			msg[1]->datalen, msg[1]->data);*/
@@ -144,7 +143,7 @@ static int __testReadWriteMessage(int sv[2])
 	/* read msg */
 	if (iucvtty_read_msg(sv[1], msg[1], BUF_SIZE, &chunk))
 		return 2;
-	iucvtty_skip_msg_residual(sv[1], &chunk);
+	iucvtty_skip_msg_chunk(sv[1], &chunk);
 
 	/* compare msg */
 	if (__msgcmp(msg[0], msg[1]))

libekmfweb/ekmfweb.c

@@ -233,7 +233,7 @@ static int _ekmf_extract_pubkey(const char *cert, const char *pub_key_pem,
 		goto out;
 	}
 
-	fp = fopen(pub_key_pem, "w");
+	fp = fopen_nofollow(pub_key_pem, "w");
 	if (fp == NULL) {
 		rc = -errno;
 		pr_verbose(verbose, "File '%s': %s", pub_key_pem,
@@ -458,7 +458,7 @@ retry:
 			 out);
 
 	if (server_cert_pem != NULL) {
-		fp = fopen(server_cert_pem, "w");
+		fp = fopen_nofollow(server_cert_pem, "w");
 		if (fp == NULL) {
 			rc = -errno;
 			pr_verbose(verbose, "File '%s': %s", server_cert_pem,
@@ -495,7 +495,7 @@ retry:
 			 */
 			if (ci->num_of_certs > 1 && ca_bundle_pem != NULL &&
 			    do_verify == 0) {
-				fp = fopen(ca_bundle_pem, "w");
+				fp = fopen_nofollow(ca_bundle_pem, "w");
 				if (fp == NULL) {
 					rc = -errno;
 					pr_verbose(verbose, "File '%s': %s",
@@ -1415,7 +1415,7 @@ int ekmf_login(const struct ekmf_config *config, CURL **curl_handle,
 	while (*tok == ' ')
 		tok++;
 
-	fp = fopen(config->login_token, "w");
+	fp = fopen_nofollow(config->login_token, "w");
 	if (fp == NULL) {
 		rc = -errno;
 		pr_verbose(verbose, "Failed to open file %s: '%s'",
@@ -1739,7 +1739,7 @@ int ekmf_get_settings(const struct ekmf_config *config, CURL **curl_handle,
 	if (xts_key2_template != NULL) {
 		*xts_key2_template = _ekmf_find_setting(response_obj,
 					SETTING_ID_XTS_KEY2_TEMPLATE, verbose);
-		if (*identity_template == NULL) {
+		if (*xts_key2_template  == NULL) {
 			if (error_msg != NULL) {
 				if (asprintf(error_msg, "The EKMF Web setting "
 					     "'XTS Key Template Name (Key 2)' "
@@ -1882,8 +1882,9 @@ int ekmf_check_feature(const struct ekmf_config *config, CURL **curl_handle,
 		pr_verbose(verbose, "Feature '%s' is not installed",
 			   FEATURE_ID_PERVASIVE_ENCRYPTION);
 		rc = -ENOTSUP;
-		if (asprintf(error_msg, "EKMF Web feature "
-			     "'Pervasive Encryption' is not installed.")) {
+		if (error_msg != NULL &&
+		    asprintf(error_msg, "EKMF Web feature "
+			     "'Pervasive Encryption' is not installed.") < 0) {
 			pr_verbose(verbose, "asprintf failed");
 			rc = -ENOMEM;
 		}
@@ -1925,7 +1926,7 @@ static int _ekmf_build_party_info(const char *key_uuid, const char *timestamp,
 
 	if (*party_info_length < (size_t)EVP_MD_size(md)) {
 		pr_verbose(verbose, "Party info buffer is too small");
-		return -ERANGE;
+		rc = -ERANGE;
 		goto out;
 	}
 
@@ -2219,6 +2220,11 @@ static int _ekmf_import_key(unsigned char *req_sess_key,
 	unsigned char *party_info = NULL;
 	int rc;
 
+	if (resp_party_info_length > SIZE_MAX - req_party_info_length) {
+		rc = -EINVAL;
+		goto out;
+	}
+
 	party_info_length = req_party_info_length + resp_party_info_length;
 	party_info = malloc(party_info_length);
 	if (party_info == NULL) {
@@ -4547,8 +4553,9 @@ out:
  */
 static char *_ekmf_base64_encode(const unsigned char *data, size_t data_size)
 {
-	int outlen, len;
+	size_t outlen;
 	char *out;
+	int len;
 
 	outlen = (data_size / 3) * 4;
 	if (data_size % 3 > 0)
@@ -4559,7 +4566,7 @@ static char *_ekmf_base64_encode(const unsigned char *data, size_t data_size)
 		return NULL;
 
 	len = EVP_EncodeBlock((unsigned char *)out, data, data_size);
-	if (len != outlen) {
+	if (len < 0 || (size_t)len != outlen) {
 		free(out);
 		return NULL;
 	}
@@ -4596,7 +4603,7 @@ static int _ekmf_build_key_material(const unsigned char *certificate,
 			 "JSON object", verbose, out);
 
 	payload = _ekmf_base64_encode(certificate, certificate_size);
-	JSON_CHECK_ERROR(*keymat_obj == NULL, rc, -EIO,
+	JSON_CHECK_ERROR(payload == NULL, rc, -EIO,
 			 "Failed to base64 encode the certificate",
 			 verbose, out);
 

libekmfweb/utilities.c

@@ -9,9 +9,11 @@
 #include <stdlib.h>
 #include <string.h>
 #include <errno.h>
+#include <fcntl.h>
 #include <stdbool.h>
 #include <sys/stat.h>
 #include <sys/time.h>
+#include <unistd.h>
 
 #include <openssl/evp.h>
 #include <openssl/pem.h>
@@ -104,7 +106,7 @@ int decode_base64url(unsigned char *output, size_t *outlen,
 
 	len = EVP_DecodeBlock((unsigned char *)padded_output,
 			      (unsigned char *)padded_input, padded_inlen);
-	if (len != (int)padded_inlen * 3 / 4) {
+	if ((size_t)len != padded_inlen * 3 / 4) {
 		rc = -EIO;
 		goto out;
 	}
@@ -364,9 +366,9 @@ out:
 		*payload_obj = pld;
 	else
 		json_object_put(pld);
-	if (signature != NULL && rc != 0) {
-		free(signature);
-		signature = NULL;
+	if (signature != NULL && *signature != NULL && rc != 0) {
+		free(*signature);
+		*signature = NULL;
 		*signature_len = 0;
 	}
 	if (json != NULL)
@@ -1035,7 +1037,7 @@ int clone_tag_def_list(const struct ekmf_tag_def_list *src,
 		if (src->tag_defs[i].description != NULL) {
 			dest->tag_defs[i].description =
 					strdup(src->tag_defs[i].description);
-			if (dest->tag_defs[i].description != NULL) {
+			if (dest->tag_defs[i].description == NULL) {
 				rc = -ENOMEM;
 				goto out;
 			}
@@ -1931,7 +1933,7 @@ int write_key_blob(const char *filename, unsigned char *key_blob,
 	if (filename == NULL || key_blob == NULL || key_blob_len == 0)
 		return -EINVAL;
 
-	fp = fopen(filename, "w");
+	fp = fopen_nofollow(filename, "w");
 	if (fp == NULL)
 		return -errno;
 
@@ -2052,7 +2054,7 @@ int write_x509_certificate(const char *pem_filename, X509 *cert)
 	if (pem_filename == NULL || cert == NULL)
 		return -EINVAL;
 
-	fp = fopen(pem_filename, "w");
+	fp = fopen_nofollow(pem_filename, "w");
 	if (fp == NULL)
 		return -errno;
 
@@ -2086,7 +2088,7 @@ int write_x509_request(const char *pem_filename, X509_REQ *req, bool new_hdr)
 	if (pem_filename == NULL || req == NULL)
 		return -EINVAL;
 
-	fp = fopen(pem_filename, "w");
+	fp = fopen_nofollow(pem_filename, "w");
 	if (fp == NULL)
 		return -errno;
 
@@ -2154,7 +2156,7 @@ int write_public_key(const char *pem_filename, EVP_PKEY *pkey)
 	if (pem_filename == NULL || pkey == NULL)
 		return -EINVAL;
 
-	fp = fopen(pem_filename, "w");
+	fp = fopen_nofollow(pem_filename, "w");
 	if (fp == NULL)
 		return -errno;
 
@@ -2606,3 +2608,33 @@ int json_object_object_add_ex(struct json_object *obj, const char *const key,
 	return 0;
 }
 #endif
+
+FILE *fopen_nofollow(const char *path, const char *mode)
+{
+	int flags = O_NOFOLLOW;
+	int fd;
+	FILE *fp;
+
+	/* Determine flags based on mode */
+	if (mode[0] == 'r')
+		flags |= (mode[1] == '+') ? O_RDWR : O_RDONLY;
+	else if (mode[0] == 'w')
+		flags |= O_CREAT | O_TRUNC |
+				((mode[1] == '+') ? O_RDWR : O_WRONLY);
+	else if (mode[0] == 'a')
+		flags |= O_CREAT | O_APPEND |
+				((mode[1] == '+') ? O_RDWR : O_WRONLY);
+	else
+		return NULL;
+
+	fd = open(path, flags, 0600);
+	if (fd < 0)
+		return NULL;
+
+	fp = fdopen(fd, mode);
+	if (fp == NULL) {
+		close(fd);
+		return NULL;
+	}
+	return fp;
+}

libekmfweb/utilities.h

@@ -124,4 +124,6 @@ int json_object_object_add_ex(struct json_object *obj, const char *const key,
 			      const unsigned int opts);
 #endif
 
+FILE *fopen_nofollow(const char *path, const char *mode);
+
 #endif

libkmipclient/https.c

@@ -735,7 +735,8 @@ int kmip_connection_https_perform(struct kmip_connection *conn,
 	switch (conn->config.encoding) {
 	case KMIP_ENCODING_TTLV:
 		rc = kmip_decode_ttlv(write_cb.ttlv.resp_mem_bio, NULL,
-				      response, debug);
+				      response, KMIP_DECODE_MAX_NESTING_LEVEL,
+				      debug);
 		if (rc != 0) {
 			kmip_debug(debug, "kmip_decode_ttlv failed");
 			goto out;
@@ -750,7 +751,7 @@ int kmip_connection_https_perform(struct kmip_connection *conn,
 		}
 
 		rc = kmip_decode_json(write_cb.json.resp_obj, NULL, response,
-				      debug);
+				      KMIP_DECODE_MAX_NESTING_LEVEL, debug);
 		if (rc != 0) {
 			kmip_debug(debug, "kmip_decode_json failed");
 			goto out;
@@ -768,7 +769,8 @@ int kmip_connection_https_perform(struct kmip_connection *conn,
 
 		rc = kmip_decode_xml(xmlDocGetRootElement(
 						write_cb.xml.ctx->myDoc),
-				     NULL, response, debug);
+				     NULL, response,
+				     KMIP_DECODE_MAX_NESTING_LEVEL, debug);
 		if (rc != 0) {
 			kmip_debug(debug, "kmip_decode_xml failed");
 			goto out;

libkmipclient/json.c

@@ -27,12 +27,16 @@
  * @param parent            the parent node or NULL if no parent exists.
  * @param node              On return: the decoded node. The newly allocated
  *                          node has a reference count of 1.
+ * @param max_nesting_level the maximum nesting levels of structures within the
+ *                          KMIP node. If the nesting level is reached, E2BIG
+ *                          is returned.
  * @param debug             if true, debug messages are printed
  *
  * @returns 0 in case of success, or a negative errno value
  */
 int kmip_decode_json(const json_object *obj, struct kmip_node *parent,
-		     struct kmip_node **node, bool debug)
+		     struct kmip_node **node, size_t max_nesting_level,
+		     bool debug)
 {
 	json_object *tag_obj, *type_obj, *value_obj, *name_obj;
 	enum kmip_tag tag, v1_attr_tag = 0;
@@ -42,6 +46,9 @@ int kmip_decode_json(const json_object *obj, struct kmip_node *parent,
 	int rc, num, i;
 	int64_t int64;
 
+	if (max_nesting_level == 0)
+		return -E2BIG;
+
 	if (obj == NULL || node == NULL)
 		return -EINVAL;
 
@@ -82,7 +89,7 @@ int kmip_decode_json(const json_object *obj, struct kmip_node *parent,
 			rc = -EBADMSG;
 			goto out;
 		}
-		n->name = strdup(json_object_get_string(tag_obj));
+		n->name = strdup(json_object_get_string(name_obj));
 	}
 
 	type_obj = json_object_object_get(obj, KMIP_JSON_TYPE);
@@ -138,7 +145,7 @@ int kmip_decode_json(const json_object *obj, struct kmip_node *parent,
 			for (i = 0; i < num; i++) {
 				rc = kmip_decode_json(
 					json_object_array_get_idx(value_obj, i),
-					n, &e, debug);
+					n, &e, max_nesting_level - 1, debug);
 				if (rc != 0) {
 					kmip_debug(debug, "Failed to parse "
 						   "array element %d", i);
@@ -614,6 +621,10 @@ int kmip_encode_json(const struct kmip_node *node, json_object **obj,
 
 	case KMIP_TYPE_DATE_TIME:
 		tm = gmtime((time_t *)&node->date_time_value);
+		if (tm == NULL) {
+			rc = -EINVAL;
+			goto out;
+		}
 		strftime(outstr, sizeof(outstr), KMIP_ISO8601_TIMESTAMP_UTC,
 			 tm);
 		memb_obj = json_object_new_string(outstr);

libkmipclient/key.c

@@ -426,8 +426,14 @@ int kmip_get_key_value(const struct kmip_node *node,
 	/* Must be a KMIP v1.x attribute then */
 	kmip_node_free(attr);
 
-	if (num_attrs != NULL)
-		*num_attrs = kmip_node_get_structure_element_count(node) - 1;
+	if (num_attrs != NULL) {
+		*num_attrs = kmip_node_get_structure_element_count(node);
+		if (*num_attrs == 0) {
+			rc = -EBADMSG;
+			goto error;
+		}
+		(*num_attrs)--;
+	}
 
 	if (v2_attr == NULL)
 		return 0;

libkmipclient/kmip.c

@@ -258,7 +258,7 @@ int kmip_node_add_structure_elements(struct kmip_node *node,
  *
  * @param node              the KMIP node
  *
- * @returns the number of elements, or -1 if  the node is not of type structure
+ * @returns the number of elements, or 0 if  the node is not of type structure
  */
 unsigned int kmip_node_get_structure_element_count(const struct kmip_node *node)
 {
@@ -266,10 +266,10 @@ unsigned int kmip_node_get_structure_element_count(const struct kmip_node *node)
 	unsigned int i;
 
 	if (node == NULL)
-		return -1;
+		return 0;
 
 	if (node->type != KMIP_TYPE_STRUCTURE)
-		return -1;
+		return 0;
 
 	element = node->structure_value;
 	for (i = 0; element != NULL; i++)
@@ -319,7 +319,7 @@ struct kmip_node *kmip_node_get_structure_element_by_index(
  * @param node              the KMIP node
  * @param tag               the tag to find
  *
- * @returns the number of elements, or -1 if  the node is not of type structure
+ * @returns the number of elements, or 0 if  the node is not of type structure
  */
 unsigned int kmip_node_get_structure_element_by_tag_count(
 					const struct kmip_node *node,
@@ -329,10 +329,10 @@ unsigned int kmip_node_get_structure_element_by_tag_count(
 	unsigned int i;
 
 	if (node == NULL)
-		return -1;
+		return 0;
 
 	if (node->type != KMIP_TYPE_STRUCTURE)
-		return -1;
+		return 0;
 
 	element = node->structure_value;
 	for (i = 0; element != NULL; element = element->next) {
@@ -897,7 +897,7 @@ struct kmip_node *kmip_node_clone(const struct kmip_node *node)
 	case KMIP_TYPE_TEXT_STRING:
 		if (node->text_value != NULL) {
 			clone->text_value = strdup(node->text_value);
-			if (node->text_value == NULL)
+			if (clone->text_value == NULL)
 				goto error;
 			clone->length = strlen(clone->text_value);
 		}
@@ -1489,7 +1489,7 @@ retry:
 		}
 
 		if (i == 0 && server_cert_pem != NULL) {
-			fp = fopen(server_cert_pem, "w");
+			fp = fopen_nofollow(server_cert_pem, "w");
 			if (fp == NULL) {
 				rc = -errno;
 				kmip_debug(debug, "Failed to open %s for write",
@@ -1507,7 +1507,7 @@ retry:
 			fp = NULL;
 
 			if (server_pubkey_pem != NULL) {
-				fp = fopen(server_pubkey_pem, "w");
+				fp = fopen_nofollow(server_pubkey_pem, "w");
 				if (fp == NULL) {
 					rc = -errno;
 					kmip_debug(debug, "Failed to open %s "
@@ -1533,7 +1533,7 @@ retry:
 
 		if (i > 0 && cert_chain_pem != NULL) {
 			if (fp == NULL)
-				fp = fopen(cert_chain_pem, "w");
+				fp = fopen_nofollow(cert_chain_pem, "w");
 			if (fp == NULL) {
 				rc = -errno;
 				kmip_debug(debug, "Failed to open %s for write",

libkmipclient/kmip.h

@@ -94,19 +94,23 @@ int kmip_connection_https_perform(struct kmip_connection *connection,
 				  bool debug);
 void kmip_connection_https_term(struct kmip_connection *connection);
 
-/* KIMP decoding and encoding internal functions */
+/* KIMP decoding and encoding internal functions and definitions */
+#define KMIP_DECODE_MAX_NESTING_LEVEL	32
+
 int kmip_decode_ttlv(BIO *bio, size_t *size, struct kmip_node **node,
-		     bool debug);
+		     size_t max_nesting_level, bool debug);
 int kmip_encode_ttlv(struct kmip_node *node, BIO *bio, size_t *size,
 		     bool debug);
 
 int kmip_decode_json(const json_object *obj, struct kmip_node *parent,
-		     struct kmip_node **node, bool debug);
+		     struct kmip_node **node, size_t max_nesting_level,
+		     bool debug);
 int kmip_encode_json(const struct kmip_node *node, json_object **obj,
 		     bool debug);
 
 int kmip_decode_xml(const xmlNode *xml, struct kmip_node *parent,
-		    struct kmip_node **node, bool debug);
+		    struct kmip_node **node, size_t max_nesting_level,
+		    bool debug);
 int kmip_encode_xml(const struct kmip_node *node, xmlNode **xml, bool debug);
 
 #endif

libkmipclient/response.c

@@ -686,14 +686,20 @@ int kmip_get_get_attribute_list_response_payload(const struct kmip_node *node,
 
 	if (kmip_node_get_tag(node) != KMIP_TAG_RESPONSE_PAYLOAD)
 		return -EBADMSG;
+	if (kmip_node_get_type(node) != KMIP_TYPE_STRUCTURE)
+		return -EBADMSG;
 
 	if (unique_id != NULL)
 		*unique_id = kmip_node_get_structure_element_by_tag(node,
 						KMIP_TAG_UNIQUE_IDENTIFIER, 0);
 
-	if (num_attr_refs != NULL)
+	if (num_attr_refs != NULL) {
 		*num_attr_refs =
-			kmip_node_get_structure_element_count(node) - 1;
+			kmip_node_get_structure_element_count(node);
+		if (*num_attr_refs == 0)
+			return -EBADMSG;
+		(*num_attr_refs)--;
+	}
 
 	if (attr_ref == NULL)
 		return 0;
@@ -766,6 +772,8 @@ int kmip_get_get_attributes_response_payload(const struct kmip_node *node,
 
 	if (kmip_node_get_tag(node) != KMIP_TAG_RESPONSE_PAYLOAD)
 		return -EBADMSG;
+	if (kmip_node_get_type(node) != KMIP_TYPE_STRUCTURE)
+		return -EBADMSG;
 
 	if (unique_id != NULL)
 		*unique_id = kmip_node_get_structure_element_by_tag(node,
@@ -798,8 +806,12 @@ int kmip_get_get_attributes_response_payload(const struct kmip_node *node,
 	/* Must be a KMIP v1.x attribute then */
 	kmip_node_free(attr);
 
-	if (num_attrs != NULL)
-		*num_attrs = kmip_node_get_structure_element_count(node) - 1;
+	if (num_attrs != NULL) {
+		*num_attrs = kmip_node_get_structure_element_count(node);
+		if (*num_attrs == 0)
+			return -EBADMSG;
+		(*num_attrs)--;
+	}
 
 	if (v2_attr == NULL)
 		return 0;

libkmipclient/tls.c

@@ -493,7 +493,8 @@ int kmip_connection_tls_perform(struct kmip_connection *conn,
 	kmip_debug(debug, "%lu bytes sent", size);
 
 	/* receive the response */
-	rc = kmip_decode_ttlv(conn->plain_tls.bio, NULL, response, debug);
+	rc = kmip_decode_ttlv(conn->plain_tls.bio, NULL, response,
+			      KMIP_DECODE_MAX_NESTING_LEVEL, debug);
 	if (rc != 0 || *response == NULL) {
 		kmip_debug(debug, "kmip_decode_ttlv failed");
 		goto out;

libkmipclient/ttlv.c

@@ -28,12 +28,15 @@
  *                          as many bytes as needed.
  * @param node              On return: the decoded node. The newly allocated
  *                          node has a reference count of 1.
+ * @param max_nesting_level the maximum nesting levels of structures within the
+ *                          KMIP node. If the nesting level is reached, E2BIG
+ *                          is returned.
  * @param debug             if true, debug messages are printed
  *
  * @returns 0 in case of success, or a negative errno value
  */
 int kmip_decode_ttlv(BIO *bio, size_t *size, struct kmip_node **node,
-		     bool debug)
+		     size_t max_nesting_level, bool debug)
 {
 	unsigned char padding[KMIP_TTLV_BLOCK_LENGTH];
 	unsigned char ttlv[KMIP_TTLV_HEADER_LENGTH];
@@ -44,6 +47,9 @@ int kmip_decode_ttlv(BIO *bio, size_t *size, struct kmip_node **node,
 	uint64_t int64;
 	int rc;
 
+	if (max_nesting_level == 0)
+		return -E2BIG;
+
 	if (bio == NULL || node == NULL)
 		return -EINVAL;
 
@@ -73,18 +79,18 @@ int kmip_decode_ttlv(BIO *bio, size_t *size, struct kmip_node **node,
 	n->ref_count = 1;
 
 	/* Tag: 3-byte binary unsigned integer, transmitted big endian */
-	n->tag |= (uint32_t)(ttlv[0] << 16);
-	n->tag |= (uint32_t)(ttlv[1] << 8);
-	n->tag |= (uint32_t)(ttlv[2]);
+	n->tag |= (uint32_t)ttlv[0] << 16;
+	n->tag |= (uint32_t)ttlv[1] << 8;
+	n->tag |= (uint32_t)ttlv[2];
 
 	/* Type: 1 byte containing a coded value that indicates the data type */
 	n->type = ttlv[3];
 
 	/* Length: 32-bit binary integer, transmitted big-endian */
-	n->length |= (uint32_t)(ttlv[4] << 24);
-	n->length |= (uint32_t)(ttlv[5] << 16);
-	n->length |= (uint32_t)(ttlv[6] << 8);
-	n->length |= (uint32_t)(ttlv[7]);
+	n->length |= (uint32_t)ttlv[4] << 24;
+	n->length |= (uint32_t)ttlv[5] << 16;
+	n->length |= (uint32_t)ttlv[6] << 8;
+	n->length |= (uint32_t)ttlv[7];
 
 	kmip_debug(debug, "tag: 0x%x type: 0x%x, length: %u", n->tag, n->type,
 		   n->length);
@@ -98,6 +104,11 @@ int kmip_decode_ttlv(BIO *bio, size_t *size, struct kmip_node **node,
 	case KMIP_TYPE_TEXT_STRING:
 	case KMIP_TYPE_BYTE_STRING:
 		value_len = n->length;
+		if (value_len > INT_MAX) {
+			rc = -EMSGSIZE;
+			goto out;
+		}
+
 		value = calloc(1, value_len + 1);
 		if (value == NULL) {
 			kmip_debug(debug, "calloc failed");
@@ -160,14 +171,22 @@ int kmip_decode_ttlv(BIO *bio, size_t *size, struct kmip_node **node,
 			rc = -EIO;
 			goto out;
 		}
-		if (size != NULL)
+
+		if (size != NULL) {
+			if (*size < pad_len) {
+				rc = -EMSGSIZE;
+				goto out;
+			}
+
 			*size -= pad_len;
+		}
 	}
 
 	switch (n->type) {
 	case KMIP_TYPE_STRUCTURE:
 		while (value_len > 0) {
-			rc = kmip_decode_ttlv(bio, &value_len, &e, debug);
+			rc = kmip_decode_ttlv(bio, &value_len, &e,
+					      max_nesting_level - 1, debug);
 			if (rc != 0) {
 				kmip_debug(debug, "kmip_decode_ttlv failed: "
 					   "rc: %d", rc);
@@ -263,7 +282,7 @@ out:
 static int kmip_node_get_length(struct kmip_node *node, size_t *length)
 {
 	struct kmip_node *element;
-	size_t len;
+	size_t len, prev_len;
 	int rc;
 
 	if (node == NULL || length == NULL)
@@ -278,10 +297,13 @@ static int kmip_node_get_length(struct kmip_node *node, size_t *length)
 			if (rc != 0)
 				return rc;
 
+			prev_len = *length;
 			*length += KMIP_TTLV_HEADER_LENGTH + len;
 			if ((len % KMIP_TTLV_BLOCK_LENGTH) != 0)
 				*length += KMIP_TTLV_BLOCK_LENGTH -
 						(len % KMIP_TTLV_BLOCK_LENGTH);
+			if (*length < prev_len)
+				return -EOVERFLOW;
 
 			element = element->next;
 		}

libkmipclient/utils.c

@@ -12,9 +12,11 @@
 
 #include <errno.h>
 #include <err.h>
+#include <fcntl.h>
 #include <stdarg.h>
 #include <string.h>
 #include <strings.h>
+#include <unistd.h>
 
 #include "utils.h"
 #include "names.h"
@@ -72,6 +74,8 @@ int kmip_parse_decimal_uint(const char *str, uint64_t *val)
 
 	if (str == NULL)
 		return -EINVAL;
+	if (str[0] == '-')
+		return -EBADMSG;
 
 	errno = 0;
 	v = strtoull(str, &endptr, 10);
@@ -164,13 +168,16 @@ int kmip_parse_hex(const char *str, bool has_prefix, unsigned char **val,
  * Format a hex string from the byte array specified in val. The caller must
  * free the returned str.
  */
-int kmip_format_hex(const unsigned char *val, uint32_t length, bool prefix,
+int kmip_format_hex(const unsigned char *val, size_t length, bool prefix,
 		    char **str)
 {
-	uint32_t str_len, i;
+	size_t str_len, i;
 	char tmp[4];
 	char *ret;
 
+	if (length > (SIZE_MAX - ((prefix ? 2 : 0) + 1)) / 2)
+		return -EINVAL;
+
 	str_len = length * 2 + (prefix ? 2 : 0) + 1;
 	ret = calloc(1, str_len);
 	if (ret == NULL)
@@ -220,14 +227,18 @@ int kmip_parse_bignum(const char *str, bool has_prefix, BIGNUM **bn)
 int kmip_format_bignum(const BIGNUM *bn, bool prefix, char **str)
 {
 	unsigned char *buf;
-	uint32_t len;
+	uint32_t len, prev_len;
 	int rc;
 
 	len = kmip_encode_bignum_length(bn);
 	/* BIG INTEGERS must be a multiple of 8 bytes long */
-	if ((len % KMIP_BIG_INTEGER_BLOCK_LENGTH) != 0)
+	if ((len % KMIP_BIG_INTEGER_BLOCK_LENGTH) != 0) {
+		prev_len = len;
 		len += KMIP_BIG_INTEGER_BLOCK_LENGTH -
 				(len % KMIP_BIG_INTEGER_BLOCK_LENGTH);
+		if (len < prev_len)
+			return -EOVERFLOW;
+	}
 
 	buf = malloc(len);
 	if (buf == NULL)
@@ -402,10 +413,10 @@ int kmip_parse_mask(enum kmip_tag tag, const char *str, char separator,
 	return rc;
 }
 
-static int kmip_append_string(char **str, int *str_len, char separator,
+static int kmip_append_string(char **str, size_t *str_len, char separator,
 			      const char *append)
 {
-	int new_len;
+	size_t new_len;
 	char *tmp;
 
 	if (str == NULL || str_len == NULL)
@@ -422,6 +433,9 @@ static int kmip_append_string(char **str, int *str_len, char separator,
 	if (append != NULL)
 		new_len += strlen(append);
 
+	if (new_len < *str_len)
+		return -EOVERFLOW;
+
 	tmp = realloc(*str, new_len);
 	if (tmp == NULL)
 		return -ENOMEM;
@@ -446,8 +460,9 @@ int kmip_format_mask(enum kmip_tag tag, int32_t value, char separator,
 		     char **str)
 {
 	const struct kmip_enum *info;
-	int rc = 0, i, s_len = 0;
 	char *s = NULL, *tmp;
+	size_t s_len = 0;
+	int rc = 0, i;
 
 	info = kmip_enum_info_by_tag(tag);
 	if (info == NULL || value == 0)
@@ -726,3 +741,32 @@ enum kmip_tag kmip_find_v1_attribute_name_tag(struct kmip_node *parent)
 	return 0;
 }
 
+FILE *fopen_nofollow(const char *path, const char *mode)
+{
+	int flags = O_NOFOLLOW;
+	int fd;
+	FILE *fp;
+
+	/* Determine flags based on mode */
+	if (mode[0] == 'r')
+		flags |= (mode[1] == '+') ? O_RDWR : O_RDONLY;
+	else if (mode[0] == 'w')
+		flags |= O_CREAT | O_TRUNC |
+				((mode[1] == '+') ? O_RDWR : O_WRONLY);
+	else if (mode[0] == 'a')
+		flags |= O_CREAT | O_APPEND |
+				((mode[1] == '+') ? O_RDWR : O_WRONLY);
+	else
+		return NULL;
+
+	fd = open(path, flags, 0600);
+	if (fd < 0)
+		return NULL;
+
+	fp = fdopen(fd, mode);
+	if (fp == NULL) {
+		close(fd);
+		return NULL;
+	}
+	return fp;
+}

libkmipclient/utils.h

@@ -38,7 +38,7 @@ int kmip_parse_decimal_uint(const char *str, uint64_t *val);
 int kmip_parse_hex_int(const char *str, int64_t *val);
 int kmip_parse_hex(const char *str, bool has_prefix, unsigned char **val,
 		   uint32_t *length);
-int kmip_format_hex(const unsigned char *val, uint32_t length, bool prefix,
+int kmip_format_hex(const unsigned char *val, size_t length, bool prefix,
 		    char **str);
 
 int kmip_parse_bignum(const char *str, bool has_prefix, BIGNUM **bn);
@@ -58,4 +58,6 @@ void kmip_node_dump(struct kmip_node *node, bool debug);
 
 enum kmip_tag kmip_find_v1_attribute_name_tag(struct kmip_node *parent);
 
+FILE *fopen_nofollow(const char *path, const char *mode);
+
 #endif

libkmipclient/xml.c

@@ -28,12 +28,16 @@
  * @param parent            the parent node or NULL if no parent exists.
  * @param node              On return: the decoded node.The newly allocated
  *                          node has a reference count of 1.
+ * @param max_nesting_level the maximum nesting levels of structures within the
+ *                          KMIP node. If the nesting level is reached, E2BIG
+ *                          is returned.
  * @param debug             if true, debug messages are printed
  *
  * @returns 0 in case of success, or a negative errno value
  */
 int kmip_decode_xml(const xmlNode *xml, struct kmip_node *parent,
-		    struct kmip_node **node, bool debug)
+		    struct kmip_node **node, size_t max_nesting_level,
+		    bool debug)
 {
 	char *tag_attr = NULL, *name_attr = NULL, *type_attr = NULL;
 	enum kmip_tag tag, v1_attr_tag = 0;
@@ -44,6 +48,9 @@ int kmip_decode_xml(const xmlNode *xml, struct kmip_node *parent,
 	int64_t int64;
 	int rc = 0, i;
 
+	if (max_nesting_level == 0)
+		return -E2BIG;
+
 	if (xml == NULL || node == NULL)
 		return -EINVAL;
 
@@ -122,7 +129,8 @@ int kmip_decode_xml(const xmlNode *xml, struct kmip_node *parent,
 			if (child->type != XML_ELEMENT_NODE)
 				continue;
 
-			rc = kmip_decode_xml(child, n, &e, debug);
+			rc = kmip_decode_xml(child, n, &e,
+					     max_nesting_level - 1, debug);
 			if (rc != 0) {
 				kmip_debug(debug, "Failed to parse child "
 					   "element %d", i);
@@ -452,6 +460,10 @@ int kmip_encode_xml(const struct kmip_node *node, xmlNode **xml, bool debug)
 
 	case KMIP_TYPE_DATE_TIME:
 		tm = gmtime((time_t *)&node->date_time_value);
+		if (tm == NULL) {
+			rc = -EINVAL;
+			goto out;
+		}
 		strftime(tmp_str, sizeof(tmp_str), KMIP_ISO8601_TIMESTAMP_UTC,
 			 tm);
 		attr = xmlSetProp(ret_xml, (xmlChar *)KMIP_XML_VALUE,

libseckey/sk_cca.c

@@ -258,7 +258,9 @@ static int sk_cca_get_library_functions(const struct sk_ext_cca_lib *cca_lib,
  *
  * @param cca_lib           the CCA library structure
  * @param curve_nid         the nid specifying the curve.
- * @param key_token         a buffer to store the generated key token
+ * @param key_token         a buffer to store the generated key token. If NULL,
+ *                          the required buffer size is returned in
+ *                          key_token_length (size query).
  * @param key_token_length  On entry: the size of the buffer
  *                          On return: the size of the key token
  * @param debug             if true, debug messages are printed
@@ -286,7 +288,7 @@ int SK_CCA_generate_ec_key_pair(const struct sk_ext_cca_lib *cca_lib,
 	long param1 = 0;
 	int rc;
 
-	if (cca_lib == NULL || key_token == NULL || key_token_length == NULL)
+	if (cca_lib == NULL || key_token_length == NULL)
 		return -EINVAL;
 
 	if (key_token == NULL) {
@@ -384,7 +386,9 @@ int SK_CCA_generate_ec_key_pair(const struct sk_ext_cca_lib *cca_lib,
  *                          3, 5, 17, 257, or 65537. Specify zero to choose the
  *                          exponent by random (only possible for modulus_bits
  *                          up to 2048).
- * @param key_token         a buffer to store the generated key token
+ * @param key_token         a buffer to store the generated key token. If NULL,
+ *                          the required buffer size is returned in
+ *                          key_token_length (size query).
  * @param key_token_length  On entry: the size of the buffer
  *                          On return: the size of the key token
  * @param debug             if true, debug messages are printed
@@ -412,7 +416,7 @@ int SK_CCA_generate_rsa_key_pair(const struct sk_ext_cca_lib *cca_lib,
 	long param1 = 0;
 	int rc;
 
-	if (cca_lib == NULL || key_token == NULL || key_token_length == NULL)
+	if (cca_lib == NULL || key_token_length == NULL)
 		return -EINVAL;
 
 	if (key_token == NULL) {
@@ -459,7 +463,7 @@ int SK_CCA_generate_rsa_key_pair(const struct sk_ext_cca_lib *cca_lib,
 	case 257:
 		key_value_structure.public_exp_length = 2;
 		key_value_structure.public_exponent[0] = 0x01;
-		key_value_structure.public_exponent[0] = 0x01;
+		key_value_structure.public_exponent[1] = 0x01;
 		break;
 	case 65537:
 		key_value_structure.public_exp_length = 3;
@@ -560,6 +564,11 @@ static const void *sk_cca_get_pka_section(const unsigned char *key_token,
 	section_hdr = (struct cca_section_header *)&key_token[ofs];
 
 	while (section_hdr->section_identifier != section_id) {
+		if (section_hdr->section_length <
+					sizeof(struct cca_section_header))  {
+			sk_debug(debug, "ERROR: invalid section length");
+			return NULL;
+		}
 		ofs += section_hdr->section_length;
 		if (ofs >= token_hdr->token_length) {
 			sk_debug(debug, "ERROR: section %u not found",
@@ -1385,7 +1394,7 @@ static int sk_cca_get_public_from_rsa_key(const unsigned char *key_token,
 		return -EINVAL;
 	}
 	if (rsa_pub_section->section_header.section_length <
-				sizeof(struct cca_ec_pub_key_section)) {
+				sizeof(struct cca_rsa_pub_key_section)) {
 		sk_debug(debug, "ERROR: invalid RSA public key section length");
 		return -EINVAL;
 	}

libseckey/sk_ep11.c

@@ -195,7 +195,7 @@ static int sk_ep11_generate_key_pair(const struct sk_ext_ep11_lib *ep11_lib,
 	CK_RV rv;
 	int rc;
 
-	if (ep11_lib == NULL || key_token == NULL || key_token_length == NULL)
+	if (ep11_lib == NULL || key_token_length == NULL)
 		return -EINVAL;
 
 	if (key_token == NULL) {
@@ -262,7 +262,9 @@ static int sk_ep11_generate_key_pair(const struct sk_ext_ep11_lib *ep11_lib,
  *
  * @param ep11_lib          the Ep11 library structure
  * @param curve_nid         the nid specifying the curve.
- * @param key_token         a buffer to store the generated key token
+ * @param key_token         a buffer to store the generated key token. If NULL,
+ *                          the required buffer size is returned in
+ *                          key_token_length (size query).
  * @param key_token_length  On entry: the size of the buffer
  *                          On return: the size of the key token
  * @param debug             if true, debug messages are printed
@@ -292,7 +294,7 @@ int SK_EP11_generate_ec_key_pair(const struct sk_ext_ep11_lib *ep11_lib,
 	const struct sk_ec_curve_info *curve;
 	int rc;
 
-	if (ep11_lib == NULL || key_token == NULL || key_token_length == NULL)
+	if (ep11_lib == NULL || key_token_length == NULL)
 		return -EINVAL;
 
 	sk_debug(debug, "curve_nid: %d", curve_nid);
@@ -331,7 +333,9 @@ int SK_EP11_generate_ec_key_pair(const struct sk_ext_ep11_lib *ep11_lib,
  *                          3, 5, 17, 257, or 65537. Specify zero to choose the
  *                          exponent by random.
  * @param x9_31             if true, generate a X9.31 RSA key
- * @param key_token         a buffer to store the generated key token
+ * @param key_token         a buffer to store the generated key token. If NULL,
+ *                          the required buffer size is returned in
+ *                          key_token_length (size query).
  * @param key_token_length  On entry: the size of the buffer
  *                          On return: the size of the key token
  * @param debug             if true, debug messages are printed
@@ -365,7 +369,7 @@ int SK_EP11_generate_rsa_key_pair(const struct sk_ext_ep11_lib *ep11_lib,
 	CK_ULONG priv_tmpl_num = sizeof(priv_tmpl) / sizeof(CK_ATTRIBUTE);
 	int rc;
 
-	if (ep11_lib == NULL || key_token == NULL || key_token_length == NULL)
+	if (ep11_lib == NULL || key_token_length == NULL)
 		return -EINVAL;
 
 	sk_debug(debug, "modulus_bits: %lu pub_exp: %u x9_31: %d",
@@ -413,6 +417,8 @@ static unsigned char sk_ep11_parse_der_tag(const unsigned char *data,
 		if (num > sizeof(size_t))
 			return 0;
 		*value_len = data[2];
+		if (data_len < 2 + num)
+			return 0;
 		for (i = 1; i < num; i++) {
 			*value_len <<= 8;
 			*value_len |= data[2 + i];
@@ -498,6 +504,8 @@ static int sk_ep11_parse_spki(const unsigned char *spki, size_t spki_len,
 				    pub_key, pub_key_len);
 	if (tag != 0x03) /* BITSTRING */
 		return -EINVAL;
+	if (*pub_key_len == 0)
+		return -EINVAL;
 
 	/* skip unsused-bits byte */
 	(*pub_key)++;
@@ -555,7 +563,7 @@ int SK_EP11_get_key_type(const unsigned char *key_token,
 		return -EINVAL;
 
 	spki_size = key_token_length - hdr->len;
-	if (spki_size <= 0)
+	if (spki_size == 0)
 		return -EINVAL;
 
 	rc = sk_ep11_parse_spki(key_token + hdr->len, spki_size,
@@ -702,7 +710,7 @@ static int sk_ep11_rsa_sign(const unsigned char *key_token,
 	case RSA_X931_PADDING:
 		mech.mechanism = CKM_RSA_X9_31;
 
-		if ((hdr->flags && PKEY_TYPE_EP11_FLAG_X9_31) == 0) {
+		if ((hdr->flags & PKEY_TYPE_EP11_FLAG_X9_31) == 0) {
 			sk_debug(debug, "ERROR: no RSA X9.31 key");
 			return -EINVAL;
 		}
@@ -1375,7 +1383,7 @@ int SK_EP11_get_public_from_secure_key(const unsigned char *key_token,
 		return -EINVAL;
 
 	spki_size = key_token_length - hdr->len;
-	if (spki_size <= 0)
+	if (spki_size == 0)
 		return -EINVAL;
 
 	rc = sk_ep11_parse_spki(key_token + hdr->len, spki_size,

libseckey/sk_pkeymeth.c

@@ -698,6 +698,7 @@ static int sk_pkey_meth_setup_pkey(EVP_PKEY *pkey,
 	struct sk_pkey_data *data;
 	EC_KEY *ec;
 	RSA *rsa;
+	int rc;
 
 	if (pkey == NULL || secure_key == NULL || secure_key_size == 0 ||
 	    funcs == NULL)
@@ -733,12 +734,14 @@ static int sk_pkey_meth_setup_pkey(EVP_PKEY *pkey,
 		ec = EVP_PKEY_get0_EC_KEY(pkey);
 		if (ec == NULL) {
 			sk_debug(debug, "EVP_PKEY_get0_EC_KEY failed");
-			return -EIO;
+			rc = -EIO;
+			goto error;
 		}
 
 		if (!EC_KEY_set_ex_data(ec, sk_pkey_data_ec_index, data)) {
 			sk_debug(debug, "EC_KEY_set_ex_data failed");
-			return -EIO;
+			rc = -EIO;
+			goto error;
 		}
 		break;
 	case EVP_PKEY_RSA:
@@ -746,17 +749,29 @@ static int sk_pkey_meth_setup_pkey(EVP_PKEY *pkey,
 		rsa = EVP_PKEY_get0_RSA(pkey);
 		if (rsa == NULL) {
 			sk_debug(debug, "EVP_PKEY_get0_RSA failed");
-			return -EIO;
+			rc = -EIO;
+			goto error;
 		}
 
 		if (!RSA_set_ex_data(rsa, sk_pkey_data_rsa_index, data)) {
 			sk_debug(debug, "RSA_set_ex_data failed");
-			return -EIO;
+			rc = -EIO;
+			goto error;
 		}
 		break;
+	default:
+		rc = -EIO;
+		goto error;
 	}
 
 	return 0;
+
+error:
+	if (data != NULL) {
+		OPENSSL_free(data->key_blob);
+		OPENSSL_free(data);
+	}
+	return rc;
 }
 
 /**
@@ -796,13 +811,13 @@ int SK_OPENSSL_init(bool debug)
 		return -EIO;
 	}
 	sk_pkey_meth_default_method_rsa = EVP_PKEY_meth_find(EVP_PKEY_RSA);
-	if (sk_pkey_meth_default_method_ec == NULL) {
+	if (sk_pkey_meth_default_method_rsa == NULL) {
 		sk_debug(debug, "ERROR: EVP_PKEY_meth_find(RSA) failed");
 	return -EIO;
 	}
 	sk_pkey_meth_default_method_rsa_pss =
 					EVP_PKEY_meth_find(EVP_PKEY_RSA_PSS);
-	if (sk_pkey_meth_default_method_ec == NULL) {
+	if (sk_pkey_meth_default_method_rsa_pss == NULL) {
 		sk_debug(debug, "ERROR: EVP_PKEY_meth_find(RSA-PSS) failed");
 		return -EIO;
 	}

libseckey/sk_utilities.c

@@ -10,10 +10,12 @@
 #include <string.h>
 #include <err.h>
 #include <errno.h>
+#include <fcntl.h>
 #include <stdarg.h>
 #include <stdbool.h>
 #include <sys/stat.h>
 #include <sys/time.h>
+#include <unistd.h>
 
 #include <openssl/evp.h>
 #include <openssl/sha.h>
@@ -811,6 +813,35 @@ out:
 	return rc;
 }
 
+static inline FILE *fopen_nofollow(const char *path, const char *mode)
+{
+	int flags = O_NOFOLLOW;
+	int fd;
+	FILE *fp;
+
+	/* Determine flags based on mode */
+	if (mode[0] == 'r')
+		flags |= (mode[1] == '+') ? O_RDWR : O_RDONLY;
+	else if (mode[0] == 'w')
+		flags |= O_CREAT | O_TRUNC |
+				((mode[1] == '+') ? O_RDWR : O_WRONLY);
+	else if (mode[0] == 'a')
+		flags |= O_CREAT | O_APPEND |
+				((mode[1] == '+') ? O_RDWR : O_WRONLY);
+	else
+		return NULL;
+
+	fd = open(path, flags, 0600);
+	if (fd < 0)
+		return NULL;
+
+	fp = fdopen(fd, mode);
+	if (fp == NULL) {
+		close(fd);
+		return NULL;
+	}
+	return fp;
+}
 
 /**
  * Reads a X.509 certificate from the specified PEM file.
@@ -863,7 +894,7 @@ int SK_UTIL_write_x509_certificate(const char *pem_filename, X509 *cert)
 	if (pem_filename == NULL || cert == NULL)
 		return -EINVAL;
 
-	fp = fopen(pem_filename, "w");
+	fp = fopen_nofollow(pem_filename, "w");
 	if (fp == NULL)
 		return -errno;
 
@@ -898,7 +929,7 @@ int SK_UTIL_write_x509_request(const char *pem_filename, X509_REQ *req,
 	if (pem_filename == NULL || req == NULL)
 		return -EINVAL;
 
-	fp = fopen(pem_filename, "w");
+	fp = fopen_nofollow(pem_filename, "w");
 	if (fp == NULL)
 		return -errno;
 
@@ -982,7 +1013,7 @@ int SK_UTIL_write_key_blob(const char *filename, unsigned char *key_blob,
 	if (filename == NULL || key_blob == NULL || key_blob_len == 0)
 		return -EINVAL;
 
-	fp = fopen(filename, "w");
+	fp = fopen_nofollow(filename, "w");
 	if (fp == NULL)
 		return -errno;
 
@@ -1047,7 +1078,7 @@ int SK_UTIL_write_public_key(const char *pem_filename, EVP_PKEY *pkey)
 	if (pem_filename == NULL || pkey == NULL)
 		return -EINVAL;
 
-	fp = fopen(pem_filename, "w");
+	fp = fopen_nofollow(pem_filename, "w");
 	if (fp == NULL)
 		return -errno;
 

mon_tools/mon_procd.c

@@ -742,6 +742,8 @@ static int read_cmdline(struct task_t *task)
 			buf[i] = ' ';
 	}
 	name_lens.cmdline_len = num;
+	if (name_lens.cmdline_len > MAX_CMD_LEN)
+		name_lens.cmdline_len = MAX_CMD_LEN;
 	cmdlnlenp = mon_record + sizeof(struct monwrite_hdr);
 	cmdlnlenp += sizeof(struct procd_hdr);
 	cmdlnlenp += sizeof(struct task_t);

osasnmpd/ibmOSAMibDefs.h

@@ -44,7 +44,20 @@
 #define MAX_GET_DATA  4094  /* maximum GET response data length */
 #define GET_AREA_LEN  MAX_GET_DATA + 512  /* size for GET command area length */
 #define TIME_BUF_SIZE 128   /* buffer size for date and time string */
-#define MAX_OID_STR_LEN   MAX_OID_LEN * 5 /* max OID string size */
+
+/*
+ * Define maximum SNMP OID string size.
+ * An OID can have up to 128 sub-ids and each sub-id can have up to 10
+ * digits. When converted to string, this means 1 character for the
+ * period separator and 10 characters for the digits themselves. At
+ * the end of OID string, we need one more character for the null
+ * terminator. The unsigned long data type, which can have up to 20
+ * digits is used to represent a sub-id. This means each sub-id
+ * string now needs 20+1 characters instead of 10+1 in-order to avoid
+ * compiler warnings.
+ */
+#define MAX_OID_STR_LEN (MAX_OID_LEN * 21) + 1
+
 /* definitions for 2.6 qeth */
 #define QETH_SYSFILE "/sys/bus/ccwgroup/drivers/qeth/notifier_register"
 #define SIOC_QETH_ADP_SET_SNMP_CONTROL	(SIOCDEVPRIVATE + 5)

osasnmpd/ibmOSAMibUtil.c

@@ -110,7 +110,7 @@ int str_to_oid_conv ( char* uc_oid, oid* ul_oid )
  *********************************************************************/
 int oid_to_str_conv (oid* ul_oid, size_t length, char* uc_oid )
 {
-  #define MAX_CHARS 50           /* size of buffer */
+  #define MAX_CHARS 22           /* size of buffer */
   int i;
   short  valid = TRUE;
   char   buffer[MAX_CHARS];      /* buffer used for conversion */
@@ -125,9 +125,9 @@ int oid_to_str_conv (oid* ul_oid, size_t length, char* uc_oid )
         {
           /* convert and append OID digit to return string */ 
           if (i == 0)       
-            sprintf( buffer, "%lu", ul_oid[i] );
+            snprintf( buffer, sizeof(buffer), "%lu", ul_oid[i] );
           else 
-            sprintf( buffer, ".%lu", ul_oid[i] );   
+            snprintf( buffer, sizeof(buffer), ".%lu", ul_oid[i] );
          
           strcat( uc_oid, buffer ); 
         } /* end for */

rust/Cargo.lock

@@ -367,7 +367,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -917,7 +917,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -958,6 +958,7 @@ dependencies = [
  "s390_pv_core",
  "serde",
  "serde_test",
+ "testing_logger",
  "thiserror",
  "zerocopy",
 ]
@@ -1118,7 +1119,7 @@ dependencies = [
  "getrandom 0.4.2",
  "once_cell",
  "rustix",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -1128,7 +1129,16 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "230a1b821ccbd75b185820a1f1ff7b14d21da1e442e22c0863ea5f08771a8874"
 dependencies = [
  "rustix",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "testing_logger"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d92b727cb45d33ae956f7f46b966b25f1bc712092aeef9dba5ac798fc89f720"
+dependencies = [
+ "log",
 ]
 
 [[package]]

rust/pv/Cargo.toml

@@ -29,3 +29,4 @@ pv_core = { path = "../pv_core", package = "s390_pv_core", version = "0.12.0" }
 
 [dev-dependencies]
 serde_test = "1.0.177"
+testing_logger = "0.1.1"

rust/pv/src/crypto.rs

@@ -548,10 +548,167 @@ pub(crate) fn verify_signature<T: HasPublic>(
 
 #[cfg(test)]
 mod tests {
+    use std::sync::Arc;
+    use std::thread;
+
     use super::*;
     use crate::test_utils::*;
     use crate::{get_test_asset, PvCoreError};
 
+    /// Test that deterministic RNG contexts are thread-local and don't interfere.
+    ///
+    /// Per OpenSSL documentation (RAND_get0_primary(3)):
+    /// "The public and private DRBG are thread-local instances, which are used by
+    /// RAND_bytes() and RAND_priv_bytes(), respectively."
+    ///
+    /// Reference: <https://docs.openssl.org/3.1/man3/RAND_get0_primary/>
+    ///
+    /// Note: RAND_set0_public() and RAND_set0_private() require OpenSSL >= 3.1.
+    #[test]
+    fn test_deterministic_rng_thread_isolation() {
+        use std::sync::Barrier;
+
+        use openssl::rand::rand_bytes;
+
+        // Barriers to synchronize: thread1 installs → thread2 installs → both generate → both
+        // complete
+        let barrier_after_t1_install = Arc::new(Barrier::new(2));
+        let barrier_after_t2_install = Arc::new(Barrier::new(2));
+        let barrier_after_rand_bytes = Arc::new(Barrier::new(2));
+
+        let barrier1_clone = Arc::clone(&barrier_after_t1_install);
+        let barrier2_clone = Arc::clone(&barrier_after_t2_install);
+        let barrier3_clone = Arc::clone(&barrier_after_rand_bytes);
+
+        // Thread 1: Install deterministic RNG with specific entropy
+        let thread1 = thread::spawn(move || {
+            let entropy = [0x42u8; 4096];
+            let nonce = [0x24u8; 48];
+
+            // Install thread-local deterministic RNG
+            let _rng = DeterministicTestRandGuard::install(&entropy, &nonce).unwrap();
+
+            // Signal thread2 that we've installed our RNG
+            barrier1_clone.wait();
+
+            // Wait for thread2 to install its RNG
+            barrier2_clone.wait();
+
+            // Now generate bytes while thread2 also has its RNG installed
+            let mut buf = [0u8; 32];
+            rand_bytes(&mut buf).unwrap();
+
+            // Wait for thread2 to also complete rand_bytes
+            barrier3_clone.wait();
+
+            buf
+        });
+
+        // Thread 2: Install different deterministic RNG after thread1
+        let thread2 = thread::spawn(move || {
+            // Wait for thread1 to install its RNG first
+            barrier_after_t1_install.wait();
+
+            // Now install our own thread-local deterministic RNG with different entropy
+            let entropy = [0xAAu8; 4096];
+            let nonce = [0x55u8; 48];
+            let _rng = DeterministicTestRandGuard::install(&entropy, &nonce).unwrap();
+
+            // Signal thread1 that we've installed our RNG
+            barrier_after_t2_install.wait();
+
+            // Generate bytes with our different entropy (concurrently with thread1)
+            let mut buf = [0u8; 32];
+            rand_bytes(&mut buf).unwrap();
+
+            // Wait for thread1 to also complete rand_bytes
+            barrier_after_rand_bytes.wait();
+
+            buf
+        });
+
+        let t1_buf = thread1.join().unwrap();
+        let t2_buf = thread2.join().unwrap();
+
+        // Expected deterministic values for thread 1 (entropy=0x42, nonce=0x24)
+        let expected_t1: [u8; 32] = [
+            66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66,
+            66, 66, 66, 66, 66, 66, 66, 66, 66, 66,
+        ];
+
+        // Expected deterministic values for thread 2 (entropy=0xAA, nonce=0x55)
+        let expected_t2: [u8; 32] = [
+            170, 170, 170, 170, 170, 170, 170, 170, 170, 170, 170, 170, 170, 170, 170, 170, 170,
+            170, 170, 170, 170, 170, 170, 170, 170, 170, 170, 170, 170, 170, 170, 170,
+        ];
+
+        // Verify each thread produced its expected deterministic output
+        assert_eq!(
+            t1_buf, expected_t1,
+            "Thread 1 should produce deterministic output"
+        );
+        assert_eq!(
+            t2_buf, expected_t2,
+            "Thread 2 should produce deterministic output"
+        );
+
+        // Also verify they are different (proves thread-local isolation)
+        assert_ne!(
+            t1_buf, t2_buf,
+            "Different thread-local entropy should produce different output"
+        );
+    }
+
+    /// Test that the original RNG is properly restored after DeterministicTestRandGuard is dropped
+    #[test]
+    fn test_deterministic_rng_restoration() {
+        use openssl::rand::rand_bytes;
+
+        // Generate random bytes with system RNG before installing deterministic RNG
+        let mut before_buf = [0u8; 32];
+        rand_bytes(&mut before_buf).unwrap();
+
+        let deterministic_buf = {
+            let entropy = [0x42u8; 4096];
+            let nonce = [0x24u8; 48];
+
+            // Install deterministic RNG
+            let _rng = DeterministicTestRandGuard::install(&entropy, &nonce).unwrap();
+
+            // Generate deterministic bytes
+            let mut buf = [0u8; 32];
+            rand_bytes(&mut buf).unwrap();
+
+            // Expected deterministic output
+            let expected: [u8; 32] = [
+                66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66,
+                66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66,
+            ];
+            assert_eq!(buf, expected, "Should produce deterministic output");
+
+            buf
+            // _rng is dropped here, should restore original RNG
+        };
+
+        // Generate random bytes again with restored system RNG
+        let mut after_buf = [0u8; 32];
+        rand_bytes(&mut after_buf).unwrap();
+
+        // The system RNG should produce different random values each time
+        // (extremely unlikely to match the deterministic output)
+        assert_ne!(
+            after_buf, deterministic_buf,
+            "After restoration, system RNG should produce different random values"
+        );
+
+        // Also verify that before and after are different (system RNG produces random values)
+        // Note: This could theoretically fail with probability 1/2^256, but that's negligible
+        assert_ne!(
+            before_buf, after_buf,
+            "System RNG should produce different random values on each call"
+        );
+    }
+
     #[test]
     fn sign_ec() {
         let (ec_key, _) = get_test_keys();

rust/pv/src/error.rs

@@ -94,7 +94,7 @@ pub enum Error {
     BinArcbInvVersion(u32),
 
     #[error(
-        "The attestation request encrypted sice is to0 small {0}. Request probably tampered with."
+        "The attestation request encrypted sice is too small {0}. Request probably tampered with."
     )]
     BinArcbSeaSmall(u32),
 
@@ -173,8 +173,16 @@ pub enum HkdVerifyErrorType {
     IssuerMismatch,
     #[error("No CRL distribution points found")]
     NoCrlDP,
+    #[error("CRL distribution point uses unsupported protocol (only HTTP/HTTPS allowed)")]
+    InvalidCrlProtocol,
     #[error("The IBM Z signing key could not be verified. Error occurred at level {1}")]
     IbmSignInvalid(#[source] openssl::x509::X509VerifyResult, u32),
+    #[error("Too many redirections during CRL download")]
+    TooManyRedirectionsCrlDownload,
+    #[error("CRL download exceeds maximum file size of {} MiB", .0 / (1024 * 1024))]
+    CrlDownloadTooLarge(u64),
+    #[error("CRL download failed")]
+    CrlDownloadFailed,
 }
 
 macro_rules! bail_hkd_verify {

rust/pv/src/openssl_extensions/ml_kem.rs

@@ -2,7 +2,7 @@
 //
 // Copyright IBM Corp.
 
-#![expect(unused)]
+#![cfg_attr(not(test), expect(unused))]
 
 use std::ffi::CStr;
 use std::ptr::NonNull;

rust/pv/src/req/request.rs

@@ -79,7 +79,7 @@ impl<'a> BinReqValues<'a> {
         let rql = hdr.rql.get() as usize;
         let sea = hdr.sea.get() as usize;
 
-        if rql < req.len() || sea + Self::TAG_LEN > rql {
+        if req.len() < rql || sea + Self::TAG_LEN > rql {
             return Err(Error::BinRequestSmall);
         }
         let aad_size = rql - sea - Self::TAG_LEN;
@@ -262,4 +262,18 @@ mod tests {
         ];
         assert_eq!(hdr_bin, &hdr_bin_exp);
     }
+
+    #[test]
+    fn bin_req_values_buffer_too_small() {
+        // Create a valid header with request length set to 200 bytes
+        let hdr = RequestHdr::new(0x200, 200, [0x11; 12], 1, 32, Some(TEST_MAGIC));
+        let hdr_bin = hdr.as_bytes();
+
+        // Create a buffer that's smaller than the declared request length (48
+        // bytes)
+        let small_buffer = Vec::from(hdr_bin);
+
+        let result = BinReqValues::get(&small_buffer);
+        assert!(matches!(result, Err(Error::BinRequestSmall)));
+    }
 }

rust/pv/src/test_utils.rs

@@ -1,11 +1,14 @@
 // SPDX-License-Identifier: MIT
 //
-// Copyright IBM Corp. 2023
+// Copyright IBM Corp.
 
 // DO NOT USE ANY OF THESE ITEMS IN PRODUCTION CODE
 // USED FOR INTERNAL UNIT AND FVT TESTING ONLY!!!
+use std::ffi::c_void;
 use std::fs;
+use std::mem::{size_of, ManuallyDrop};
 use std::path::{Path, PathBuf};
+use std::ptr::NonNull;
 
 use openssl::bn::BigNum;
 use openssl::ec::{EcGroup, EcKey};
@@ -118,3 +121,379 @@ fn get_keypair(pub_coords: &[u8], priv_num: &[u8]) -> Result<PKey<Private>, Erro
     key.check_key()?;
     PKey::from_ec_key(key)
 }
+
+// To regenerate these bindings, run:
+// bindgen bindgen_wrapper.h -o bindgen_output.rs \
+//   --allowlist-function "RAND_get0_public" \
+//   --allowlist-function "RAND_get0_private" --allowlist-function "EVP_RAND_fetch" \
+//   --allowlist-function "EVP_RAND_free" --allowlist-function "EVP_RAND_CTX_new" \
+//   --allowlist-function "EVP_RAND_CTX_free" --allowlist-function "EVP_RAND_CTX_up_ref" \
+//   --allowlist-function "EVP_RAND_instantiate" --allowlist-function "RAND_set0_public" \
+//   --allowlist-function "RAND_set0_private" --allowlist-type "OSSL_PARAM"
+// where bindgen_wrapper.h contains:
+//   #include <openssl/provider.h>
+//   #include <openssl/rand.h>
+//   #include <openssl/evp.h>
+//   #include <openssl/params.h>
+mod ffi {
+    use std::ffi::{c_char, c_int, c_uchar, c_uint, c_void};
+
+    #[repr(C)]
+    pub struct OsslParam {
+        pub key: *const c_char,
+        pub data_type: c_uint,
+        pub data: *mut c_void,
+        pub data_size: usize,
+        pub return_size: usize,
+    }
+
+    pub enum OsslLibCtx {}
+    pub enum OsslProvider {}
+    pub enum EvpRand {}
+    pub enum EvpRandCtx {}
+
+    unsafe extern "C" {
+        pub fn RAND_get0_public(ctx: *mut OsslLibCtx) -> *mut EvpRandCtx;
+        pub fn RAND_get0_private(ctx: *mut OsslLibCtx) -> *mut EvpRandCtx;
+        pub fn EVP_RAND_fetch(
+            libctx: *mut OsslLibCtx,
+            algorithm: *const c_char,
+            properties: *const c_char,
+        ) -> *mut EvpRand;
+        pub fn EVP_RAND_free(rand: *mut EvpRand);
+        pub fn EVP_RAND_CTX_new(rand: *mut EvpRand, parent: *mut EvpRandCtx) -> *mut EvpRandCtx;
+        pub fn EVP_RAND_CTX_free(ctx: *mut EvpRandCtx);
+        pub fn EVP_RAND_CTX_up_ref(ctx: *mut EvpRandCtx) -> c_int;
+        pub fn EVP_RAND_instantiate(
+            ctx: *mut EvpRandCtx,
+            strength: c_uint,
+            prediction_resistance: c_int,
+            pstr: *const c_uchar,
+            pstr_len: usize,
+            params: *const OsslParam,
+        ) -> c_int;
+        pub fn RAND_set0_public(ctx: *mut OsslLibCtx, rand: *mut EvpRandCtx) -> c_int;
+        pub fn RAND_set0_private(ctx: *mut OsslLibCtx, rand: *mut EvpRandCtx) -> c_int;
+    }
+}
+
+// Constants for OSSL_PARAM construction
+const OSSL_PARAM_OCTET_STRING: u32 = 5;
+const OSSL_PARAM_UNSIGNED_INTEGER: u32 = 2;
+const OSSL_PARAM_END: u32 = 0;
+
+fn ossl_param_end() -> ffi::OsslParam {
+    ffi::OsslParam {
+        key: std::ptr::null(),
+        data_type: OSSL_PARAM_END,
+        data: std::ptr::null_mut(),
+        data_size: 0,
+        return_size: 0,
+    }
+}
+
+fn ossl_param_octet_string(name: &'static [u8], data: &mut [u8]) -> ffi::OsslParam {
+    // SAFETY: Constructing OSSL_PARAM for octet string.
+    // - name is a static null-terminated C string, valid for 'static
+    // - data is a valid mutable slice, pointer remains valid during param usage
+    // - Pointer casts are safe as they preserve alignment and validity
+    ffi::OsslParam {
+        key: name.as_ptr().cast(),
+        data_type: OSSL_PARAM_OCTET_STRING,
+        data: data.as_mut_ptr().cast(),
+        data_size: data.len(),
+        return_size: data.len(),
+    }
+}
+
+fn ossl_param_uint(name: &'static [u8], value: &mut u32) -> ffi::OsslParam {
+    // SAFETY: Constructing OSSL_PARAM for unsigned integer.
+    // - name is a static null-terminated C string, valid for 'static
+    // - value is a valid mutable reference, pointer remains valid during param usage
+    // - Pointer cast to c_void is safe as it preserves alignment and validity
+    ffi::OsslParam {
+        key: name.as_ptr().cast(),
+        data_type: OSSL_PARAM_UNSIGNED_INTEGER,
+        data: (value as *mut u32).cast::<c_void>(),
+        data_size: size_of::<u32>(),
+        return_size: size_of::<u32>(),
+    }
+}
+
+#[derive(Debug)]
+struct FetchedRand(NonNull<ffi::EvpRand>);
+
+impl FetchedRand {
+    const TEST_RAND_NAME: &'static [u8] = b"TEST-RAND\0";
+
+    fn fetch_test_rand() -> Result<Self, ErrorStack> {
+        // SAFETY: Calling OpenSSL C API with valid parameters.
+        // - null_mut() is valid for optional OSSL_LIB_CTX parameter
+        // - Self::TEST_RAND_NAME is a valid null-terminated C string
+        // - null() is valid for optional properties parameter
+        // - Returns null on error, which we handle via NonNull::new
+        let rand = unsafe {
+            ffi::EVP_RAND_fetch(
+                std::ptr::null_mut(),
+                Self::TEST_RAND_NAME.as_ptr().cast(),
+                std::ptr::null(),
+            )
+        };
+        NonNull::new(rand).map(Self).ok_or_else(ErrorStack::get)
+    }
+
+    fn as_ptr(&self) -> *mut ffi::EvpRand {
+        self.0.as_ptr()
+    }
+}
+
+impl Drop for FetchedRand {
+    fn drop(&mut self) {
+        // SAFETY: self.0 is a valid non-null EVP_RAND pointer that we own.
+        // This is the only place we call free, preventing double-free.
+        unsafe {
+            ffi::EVP_RAND_free(self.0.as_ptr());
+        }
+    }
+}
+
+#[derive(Debug)]
+struct RandCtx(NonNull<ffi::EvpRandCtx>);
+
+impl RandCtx {
+    fn new(rand: &FetchedRand) -> Result<Self, ErrorStack> {
+        // SAFETY: Calling OpenSSL C API with valid parameters.
+        // - rand.as_ptr() is a valid non-null EVP_RAND pointer
+        // - null_mut() is valid for optional parent parameter
+        // - Returns null on error, which we handle via NonNull::new
+        let ctx = unsafe { ffi::EVP_RAND_CTX_new(rand.as_ptr(), std::ptr::null_mut()) };
+        NonNull::new(ctx).map(Self).ok_or_else(ErrorStack::get)
+    }
+
+    fn up_ref(ptr: *mut ffi::EvpRandCtx) -> Result<Self, ErrorStack> {
+        let ptr = NonNull::new(ptr).ok_or_else(ErrorStack::get)?;
+        // SAFETY: ptr is a valid non-null EVP_RAND_CTX pointer.
+        // EVP_RAND_CTX_up_ref increments the reference count.
+        // Returns 1 on success, 0 on failure.
+        let rc = unsafe { ffi::EVP_RAND_CTX_up_ref(ptr.as_ptr()) };
+        if rc == 1 {
+            Ok(Self(ptr))
+        } else {
+            Err(ErrorStack::get())
+        }
+    }
+
+    fn current_public() -> Result<Option<Self>, ErrorStack> {
+        // SAFETY: RAND_get0_public returns a borrowed pointer (no ownership transfer).
+        // Returns null if no public RNG is set, which we handle.
+        let ptr = unsafe { ffi::RAND_get0_public(std::ptr::null_mut()) };
+        if ptr.is_null() {
+            Ok(None)
+        } else {
+            Self::up_ref(ptr).map(Some)
+        }
+    }
+
+    fn current_private() -> Result<Option<Self>, ErrorStack> {
+        // SAFETY: RAND_get0_private returns a borrowed pointer (no ownership transfer).
+        // Returns null if no private RNG is set, which we handle.
+        let ptr = unsafe { ffi::RAND_get0_private(std::ptr::null_mut()) };
+        if ptr.is_null() {
+            Ok(None)
+        } else {
+            Self::up_ref(ptr).map(Some)
+        }
+    }
+
+    fn as_ptr(&self) -> *mut ffi::EvpRandCtx {
+        self.0.as_ptr()
+    }
+
+    fn instantiate_test_rand(&self, entropy: &[u8], nonce: &[u8]) -> Result<(), ErrorStack> {
+        // See https://docs.openssl.org/3.1/man7/EVP_RAND-TEST-RAND/#description
+        // for the available parameters.
+        const TEST_ENTROPY_PARAM: &[u8] = b"test_entropy\0";
+        const TEST_NONCE_PARAM: &[u8] = b"test_nonce\0";
+        const STRENGTH_PARAM: &[u8] = b"strength\0";
+
+        let mut entropy = entropy.to_vec();
+        let mut nonce = nonce.to_vec();
+        let mut strength = 256u32;
+        let params = [
+            ossl_param_uint(STRENGTH_PARAM, &mut strength),
+            ossl_param_octet_string(TEST_ENTROPY_PARAM, &mut entropy),
+            ossl_param_octet_string(TEST_NONCE_PARAM, &mut nonce),
+            ossl_param_end(),
+        ];
+
+        // SAFETY: Calling OpenSSL C API with valid parameters.
+        // - self.as_ptr() is a valid non-null EVP_RAND_CTX pointer
+        // - strength is a valid u32 value
+        // - prediction_resistance=0 is valid
+        // - pstr=null and pstr_len=0 indicate no personalization string
+        // - params points to a valid array of OSSL_PARAM with proper terminator
+        // - All mutable references in params remain valid for the call duration
+        let rc = unsafe {
+            ffi::EVP_RAND_instantiate(
+                self.as_ptr(),
+                strength,
+                0,
+                std::ptr::null(),
+                0,
+                params.as_ptr(),
+            )
+        };
+        if rc == 1 {
+            Ok(())
+        } else {
+            Err(ErrorStack::get())
+        }
+    }
+
+    fn install_as_public(self) -> Result<InstalledRandCtx, ErrorStack> {
+        // SAFETY: Calling OpenSSL C API to transfer ownership.
+        // - self.as_ptr() is a valid non-null EVP_RAND_CTX pointer
+        // - RAND_set0_public takes ownership of the context on success (rc==1)
+        // - We wrap in ManuallyDrop to prevent double-free since OpenSSL now owns it
+        let rc = unsafe { ffi::RAND_set0_public(std::ptr::null_mut(), self.as_ptr()) };
+        if rc == 1 {
+            Ok(InstalledRandCtx(ManuallyDrop::new(self)))
+        } else {
+            Err(ErrorStack::get())
+        }
+    }
+
+    fn install_as_private(self) -> Result<InstalledRandCtx, ErrorStack> {
+        // SAFETY: Calling OpenSSL C API to transfer ownership.
+        // - self.as_ptr() is a valid non-null EVP_RAND_CTX pointer
+        // - RAND_set0_private takes ownership of the context on success (rc==1)
+        // - We wrap in ManuallyDrop to prevent double-free since OpenSSL now owns it
+        let rc = unsafe { ffi::RAND_set0_private(std::ptr::null_mut(), self.as_ptr()) };
+        if rc == 1 {
+            Ok(InstalledRandCtx(ManuallyDrop::new(self)))
+        } else {
+            Err(ErrorStack::get())
+        }
+    }
+}
+
+impl Drop for RandCtx {
+    fn drop(&mut self) {
+        // SAFETY: self.0 is a valid non-null EVP_RAND_CTX pointer that we own.
+        // This is only called when ownership was NOT transferred to OpenSSL.
+        // InstalledRandCtx uses ManuallyDrop to prevent this from running after transfer.
+        unsafe {
+            ffi::EVP_RAND_CTX_free(self.0.as_ptr());
+        }
+    }
+}
+
+#[derive(Debug)]
+struct InstalledRandCtx(ManuallyDrop<RandCtx>);
+
+impl Drop for InstalledRandCtx {
+    fn drop(&mut self) {
+        // SAFETY: Ownership of the EVP_RAND_CTX was transferred to OpenSSL
+        // via RAND_set0_public/private, so we must not call EVP_RAND_CTX_free.
+        // ManuallyDrop prevents RandCtx::drop from running automatically.
+    }
+}
+
+#[derive(Debug)]
+struct PreviousRandCtx(Option<RandCtx>);
+
+impl PreviousRandCtx {
+    fn capture_public() -> Result<Self, ErrorStack> {
+        RandCtx::current_public().map(Self)
+    }
+
+    fn capture_private() -> Result<Self, ErrorStack> {
+        RandCtx::current_private().map(Self)
+    }
+
+    fn restore_public(&mut self) {
+        let Some(ctx) = self.0.take() else {
+            return;
+        };
+        // SAFETY: Restoring previously captured RNG context.
+        // - ctx.as_ptr() is a valid non-null EVP_RAND_CTX pointer
+        // - RAND_set0_public takes ownership of the context
+        // - We forget ctx to prevent double-free since OpenSSL now owns it
+        // - Ignoring return value as restoration is best-effort during cleanup
+        let _ = unsafe { ffi::RAND_set0_public(std::ptr::null_mut(), ctx.as_ptr()) };
+        std::mem::forget(ctx);
+    }
+
+    fn restore_private(&mut self) {
+        let Some(ctx) = self.0.take() else {
+            return;
+        };
+        // SAFETY: Restoring previously captured RNG context.
+        // - ctx.as_ptr() is a valid non-null EVP_RAND_CTX pointer
+        // - RAND_set0_private takes ownership of the context
+
+        // - We forget ctx to prevent double-free since OpenSSL now owns it
+        // - Ignoring return value as restoration is best-effort during cleanup
+        let _ = unsafe { ffi::RAND_set0_private(std::ptr::null_mut(), ctx.as_ptr()) };
+        std::mem::forget(ctx);
+    }
+}
+
+#[derive(Debug)]
+pub struct DeterministicTestRandGuard {
+    previous_public: PreviousRandCtx,
+    previous_private: PreviousRandCtx,
+    _public: InstalledRandCtx,
+    _private: InstalledRandCtx,
+}
+
+impl DeterministicTestRandGuard {
+    /// Install OpenSSL >= 3 TEST-RAND as the thread-local public/private RNG for deterministic
+    /// tests.
+    ///
+    /// The supplied entropy is consumed across generate calls. The nonce is replayed for each
+    /// nonce request. Per OpenSSL documentation, the public and private DRBG instances are
+    /// thread-local, so each thread can safely install its own deterministic RNG without
+    /// affecting other threads.
+    ///
+    /// # Thread Safety
+    ///
+    /// From OpenSSL documentation (RAND_get0_primary(3)):
+    /// > "The public and private DRBG are thread-local instances, which are used by
+    /// > RAND_bytes() and RAND_priv_bytes(), respectively."
+    ///
+    /// Reference: <https://docs.openssl.org/3.1/man3/RAND_get0_primary/>
+    ///
+    /// **Note:** RAND_set0_public() and RAND_set0_private() require OpenSSL >= 3.1.
+    ///
+    /// # Errors
+    ///
+    /// Returns an OpenSSL error if the TEST-RAND provider cannot be configured.
+    pub fn install(entropy: &[u8], nonce: &[u8]) -> Result<Self, ErrorStack> {
+        let previous_public = PreviousRandCtx::capture_public()?;
+        let previous_private = PreviousRandCtx::capture_private()?;
+        let rand = FetchedRand::fetch_test_rand()?;
+
+        let public = RandCtx::new(&rand)?;
+        public.instantiate_test_rand(entropy, nonce)?;
+        let public = public.install_as_public()?;
+
+        let private = RandCtx::new(&rand)?;
+        private.instantiate_test_rand(entropy, nonce)?;
+        let private = private.install_as_private()?;
+
+        Ok(Self {
+            previous_public,
+            previous_private,
+            _public: public,
+            _private: private,
+        })
+    }
+}
+
+impl Drop for DeterministicTestRandGuard {
+    fn drop(&mut self) {
+        self.previous_private.restore_private();
+        self.previous_public.restore_public();
+    }
+}

rust/pv/src/verify.rs

@@ -2,18 +2,14 @@
 //
 // Copyright IBM Corp. 2023
 
-use core::slice;
 use std::path::Path;
 
-#[cfg(not(test))]
-use helper::download_first_crl_from_x509;
+use helper::{download_first_crl_from_x509, StoreSetupMode};
 use log::{debug, trace};
 use openssl::error::ErrorStack;
 use openssl::stack::Stack;
 use openssl::x509::store::X509Store;
 use openssl::x509::{CrlStatus, X509NameRef, X509Ref, X509StoreContext, X509StoreContextRef, X509};
-#[cfg(test)]
-use test::download_first_crl_from_x509;
 
 use crate::error::bail_hkd_verify;
 use crate::misc::{read_certs, read_file};
@@ -184,26 +180,51 @@ impl CertVerifier {
         Q: AsRef<Path>,
         R: AsRef<Path>,
     {
-        let mut store = helper::store_setup(root_ca_path, crl_paths, cert_paths)?;
         let mut untr_certs = Vec::with_capacity(cert_paths.len());
         for path in cert_paths {
             let mut crt = read_certs(&read_file(path, "certificate")?)?;
-            if !offline {
-                for c in &crt {
-                    if let Some(crl) = download_first_crl_from_x509(c)? {
-                        crl.iter().try_for_each(|c| store.add_crl(c))?;
-                    }
-                }
-            }
             untr_certs.append(&mut crt);
         }
+        let (ibm_z_sign_key, chain) = helper::extract_ibm_sign_key(untr_certs.clone())?;
+        let root_ca_verification = match root_ca_path {
+            Some(_) => helper::RootCaVerification::SkipPinning,
+            None => helper::RootCaVerification::RootCaOrganizationPinning("DigiCert"),
+        };
 
-        // remove the IBM signing certificate from chain.
-        // We have to verify them separately as they are not marked as intermediate certs
-        let (ibm_z_sign_key, chain) = helper::extract_ibm_sign_key(untr_certs)?;
+        // Two-round verification:
+        //
+        // Round 1: Verify chain without CRL checks before downloading files
+        // from URLs from (yet) untrusted certificates.
+        let store_builder = helper::store_setup(
+            root_ca_path.as_ref(),
+            crl_paths,
+            cert_paths,
+            StoreSetupMode::WithoutCrlCheck,
+        )?;
+        helper::verify_chain(
+            &store_builder.build(),
+            &chain,
+            &[&ibm_z_sign_key],
+            &root_ca_verification,
+        )?;
 
-        let store = store.build();
-        helper::verify_chain(&store, &chain, slice::from_ref(&ibm_z_sign_key))?;
+        // Round 2: Download CRLs and verify again, but this time with CRL checks
+        let mut store_builder = helper::store_setup(
+            root_ca_path,
+            crl_paths,
+            cert_paths,
+            StoreSetupMode::WithCrlCheck,
+        )?;
+        if !offline {
+            for cert in &untr_certs {
+                if let Some(crls) = download_first_crl_from_x509(cert)? {
+                    crls.iter().try_for_each(|c| store_builder.add_crl(c))?;
+                }
+            }
+        }
+
+        let store = store_builder.build();
+        helper::verify_chain(&store, &chain, &[&ibm_z_sign_key], &root_ca_verification)?;
 
         Ok(Self {
             store,

rust/pv/src/verify/test.rs

@@ -4,45 +4,27 @@
 
 #![cfg(test)]
 
-use std::path::Path;
-
 use openssl::stack::Stack;
-use openssl::x509::X509Crl;
 
 use super::helper::*;
 use super::{helper, *};
 use crate::test_utils::*;
-use crate::utils::read_crls;
+use crate::verify::helper::StoreSetupMode;
 use crate::Error;
 use crate::HkdVerifyErrorType::*;
 
-// Mock function
-pub fn download_first_crl_from_x509(cert: &X509Ref) -> Result<Option<Vec<X509Crl>>> {
-    fn mock_download<P: AsRef<Path>>(path: P) -> Result<Vec<X509Crl>> {
-        read_crls(std::fs::read(path)?)
-    }
-
-    for dist_point in x509_dist_points(cert) {
-        {
-            let path = get_cert_asset_path(&dist_point);
-            let crls = if let Ok(buf) = mock_download(&path) {
-                buf
-            } else {
-                continue;
-            };
-            return Ok(Some(crls));
-        }
-    }
-    Ok(None)
-}
-
 #[test]
 fn store_setup() {
     let ibm_path = get_cert_asset_path("ibm.crt");
     let inter_path = get_cert_asset_path("inter.crt");
     let crls: [String; 0] = [];
 
-    let store = helper::store_setup(None::<String>, &crls, &[&ibm_path, &inter_path]);
+    let store = helper::store_setup(
+        None::<String>,
+        &crls,
+        &[&ibm_path, &inter_path],
+        StoreSetupMode::WithCrlCheck,
+    );
     assert!(store.is_ok());
 }
 
@@ -65,20 +47,51 @@ fn verify_chain_offline() {
     let root_crt = get_cert_asset_path("root_ca.chained.crt");
     let certs: [String; 0] = [];
 
-    let store = helper::store_setup(Some(&root_crt), &[&inter_crl], &certs)
-        .unwrap()
-        .build();
+    let store = helper::store_setup(
+        Some(&root_crt),
+        &[&inter_crl],
+        &certs,
+        StoreSetupMode::WithCrlCheck,
+    )
+    .unwrap()
+    .build();
 
     let mut sk = Stack::<X509>::new().unwrap();
     sk.push(inter_crt).unwrap();
-    assert!(verify_chain(&store, &sk, &[ibm_crt]).is_ok());
+    assert!(verify_chain(
+        &store,
+        &sk,
+        &[&ibm_crt],
+        &RootCaVerification::RootCaOrganizationPinning(
+            "International Business Machines Corporationn"
+        )
+    )
+    .is_err());
+    assert!(verify_chain(
+        &store,
+        &sk,
+        &[&ibm_crt],
+        &RootCaVerification::RootCaOrganizationPinning("International")
+    )
+    .is_err());
+    assert!(verify_chain(
+        &store,
+        &sk,
+        &[&ibm_crt],
+        &RootCaVerification::RootCaOrganizationPinning(
+            "International Business Machines Corporation"
+        )
+    )
+    .is_ok());
+
+    assert!(verify_chain(&store, &sk, &[&ibm_crt], &RootCaVerification::SkipPinning).is_ok());
 }
 
 #[test]
 fn dist_points() {
     let crt = load_gen_cert("ibm.crt");
     let res = x509_dist_points(&crt);
-    let exp = vec!["inter_ca.crl"];
+    let exp = vec!["http://inter_ca.crl"];
     assert_eq!(res, exp);
 }
 

rust/pv/tests/assets/cert/fake_host.crt

@@ -1,29 +1,29 @@
 -----BEGIN CERTIFICATE-----
-MIIE/TCCAuWgAwIBAgIUWT/F3gP9fOTTq3yOMVskcXM8vOAwDQYJKoZIhvcNAQEN
+MIIFBDCCAuygAwIBAgIUD2bTT6yk21U+ojAQnf3iw5w2EEowDQYJKoZIhvcNAQEN
 BQAwgcwxCzAJBgNVBAYTAlVTMTQwMgYDVQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2lu
 ZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFs
 IEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMREwDwYDVQQIDAhOZXcgWW9y
 azEVMBMGA1UEBwwMUG91Z2hrZWVwc2llMScwJQYDVQQLDB5JQk0gWiBIb3N0IEtl
-eSBTaWduaW5nIFNlcnZpY2UwIBcNMjQwMzIxMTQ1MjM5WhgPMjM4ODEyMjMxNDUy
-MzlaMIG2MQswCQYDVQQGEwJVUzE0MDIGA1UECgwrSW50ZXJuYXRpb25hbCBCdXNp
+eSBTaWduaW5nIFNlcnZpY2UwIBcNMjYwNzAyMDg0NzQ4WhgPMjM5MTA0MDUwODQ3
+NDhaMIG2MQswCQYDVQQGEwJVUzE0MDIGA1UECgwrSW50ZXJuYXRpb25hbCBCdXNp
 bmVzcyBNYWNoaW5lcyBDb3Jwb3JhdGlvbjE0MDIGA1UEAwwrSW50ZXJuYXRpb25h
 bCBCdXNpbmVzcyBNYWNoaW5lcyBDb3Jwb3JhdGlvbjERMA8GA1UECAwITmV3IFlv
 cmsxDzANBgNVBAcMBkFybW9uazEXMBUGA1UECwwOSUJNIFogSG9zdCBLZXkwgZsw
-EAYHKoZIzj0CAQYFK4EEACMDgYYABAAT1zpBNemPCT0tEx2S9qnlPxyBgxKl6BSX
-ghqf3MfOqQKIUdKEbxP0nr2QtIR/MwvBp4YhjxZ9AZtzVtXbQrULTAGlKK4qcf1I
-W1rYZ5S0b4dmvh2HbIv9wZLWKaZ/ovnvAJk949WDCbBzC3Dy1E3zCaYPefLHHNve
-dWX8RtFUhnTqm6NxMG8wHQYDVR0fBBYwFDASoBCgDoYMZmFrZV9pYm0uY3J0MA4G
-A1UdDwEB/wQEAwIDCDAfBgNVHSMEGDAWgBSQCOxEmGwiupA2ER7srMBydGO1aTAd
-BgNVHQ4EFgQUUl5SPIEseFNeneyuOidsw06L7gQwDQYJKoZIhvcNAQENBQADggIB
-AFAg/hFlaBT+WNlUmVJlAd6FYr6vvRjJiKxcNBZ5wElzxA5OjuGX6pLYiNkzXSy2
-N/4nQ3a8fr04IB9Uhx5ncMzSKVkG+4mbN3xmR7f6zZuFWV/T9Aom3LIbQ5KYR2wW
-EvX8b2xbvd74rKAgavq/iuFRn8skQJGgQk9J2YEApOW9wkoFQRgziuu55Cw5GT+f
-w9rKgAFTN33ZwfWs86ELJlDOY0aX5373WGccuEKm8y+l2UVLlly125eezz84RSh7
-5j0VUTjK4ZqpSD8yiPxN+vocV+nY52cgWxrVf7g7wlPunxXWX4rxR0z/mEVDDBAC
-y7cAxsa4HtmJexuZbjEh8TEgDZXDA24BuFXqtkwqnUpv8KghyKb0KgTQecP9rRhL
-b2iHdQrALnddMzJzp7Tn+jsR2A2G0lLLsIuIRFR/1eAxecgTMoxXV8N0SJHn6emH
-Uwif1Qr5JVw4UOFSLW3MT3f70hY5hMzrxowOapcYhyR0vbhGFrF1YI8YmAuk2m4P
-Dfd5Za5cnfVJiAdNBnNPtV/5wiViX1VJGCrIxgDN6B2VE0VQLp2gKwpsSmhqN4CA
-qHzAi3Yj3F8vQ2mWQeuABWLAJrIoxXpVYQvTf4uij0ARZRbajQXx+LZnAUsCi5eZ
-LaYrTVn8NzHlGQocUWljG06GaLY8GNqKPQrZD/+6hIYK
+EAYHKoZIzj0CAQYFK4EEACMDgYYABAGXMdZTHQ6O1boDC7ncHiILfFqHBRkOaEPs
+NTntrxSdyWj7CCAa/VkUKVxq3CnyXqbUv8V/fNncU/ibw0o1m/T3SABExiXKfuKl
+1rUm99FfFeZO2uuIcg0pzbGf+opPttIyR+zp1LLbF3eDo0PEovBLT1J1s6iUIbx8
+hyfMwUG5JmxdiKN4MHYwJAYDVR0fBB0wGzAZoBegFYYTaHR0cDovL2Zha2VfaWJt
+LmNydDAOBgNVHQ8BAf8EBAMCAwgwHwYDVR0jBBgwFoAUVpyIVzghY6i5zPVTHvRO
+xxIW8SswHQYDVR0OBBYEFGWsrMjwzRKXSrSBTPdYPTSU6aHnMA0GCSqGSIb3DQEB
+DQUAA4ICAQAZ9mWLrrIFk65OJIk6UuX3wwRo824+rsU0TSATzTqRNVb4Ie0KUhMK
+V3JbLG16PKk/1k/U6t9h+hZp9O8e3netj5rpxUxQVdMXbUdF4FSxNr1MrY0tWynf
+U121bdsDLAgaZlBtl+DRgltH/ApDNnyVetAT7LpOwdmssnPhFytD5//kE4+s54Fy
+GsB+aKgvZDHjFgIUkcTYvuB3eTK3J3jrEv8QJYB/Pp3233yMnsSbrE3XLRafJtqQ
+77Vi7U8/i9aC9XpDPjTC76sH4nPpby0M85+RnDe+wuV98c7oAd+HcBvxlb80dIbu
+jhzXXC6i9teR9PqjJo32T+Pn+gmZlQf1ddXzrYxFa/4mVnVw6IjQfs8NsZRVios7
+7vxxm4sLWIJ5s+2gp+jEsV0I+KY/54KLBpJ4XkPRgVhkZRgKieeaFhdknyKOPIPP
+dlCbt4e4ivGnbtwO5BnLxq/ek+DuHAsSp+dE4z7MtOKsL5HYgKEqTOV0H1UdjXH9
+ezAUwrrAaMc5cSk5ksnA/LOmGd4fZNhD9r6m/Dwtk3PY6DrESEIh/IXYEcurdNtu
+vj/Lhscv3AT5DZ7IRbBpHKtNPGezFvcLM18rK+pqHJyoFg77PhKJEUDqRbpbq+VM
+vFWV/aTqd6rNPpkVwlI1p3I3BculIlmKPaUc9qhsAlQXHWnBAzvSSg==
 -----END CERTIFICATE-----

rust/pv/tests/assets/cert/fake_host.key

@@ -1,8 +1,8 @@
 -----BEGIN PRIVATE KEY-----
-MIHuAgEAMBAGByqGSM49AgEGBSuBBAAjBIHWMIHTAgEBBEIAXR6FCIgd+fjhO/WJ
-KwLTP01mBDtYkWbVE71jshjLLpZHunRpsYKbQKCwaDmMYLRrQnTxPgZH1PVKzguI
-7M7n9zyhgYkDgYYABAAT1zpBNemPCT0tEx2S9qnlPxyBgxKl6BSXghqf3MfOqQKI
-UdKEbxP0nr2QtIR/MwvBp4YhjxZ9AZtzVtXbQrULTAGlKK4qcf1IW1rYZ5S0b4dm
-vh2HbIv9wZLWKaZ/ovnvAJk949WDCbBzC3Dy1E3zCaYPefLHHNvedWX8RtFUhnTq
-mw==
+MIHuAgEAMBAGByqGSM49AgEGBSuBBAAjBIHWMIHTAgEBBEIBoV15DZCYEBy2dx5Q
+7PjcNBni/J3FXBka2MZdy402KKrrW6mZI554n4IlpNeyL9Tb4bMp4glYdDsoHLp/
+jbZ4K4ChgYkDgYYABAGXMdZTHQ6O1boDC7ncHiILfFqHBRkOaEPsNTntrxSdyWj7
+CCAa/VkUKVxq3CnyXqbUv8V/fNncU/ibw0o1m/T3SABExiXKfuKl1rUm99FfFeZO
+2uuIcg0pzbGf+opPttIyR+zp1LLbF3eDo0PEovBLT1J1s6iUIbx8hyfMwUG5Jmxd
+iA==
 -----END PRIVATE KEY-----

rust/pv/tests/assets/cert/fake_ibm.crl

@@ -3,18 +3,18 @@ MIIDVTCCAT0CAQEwDQYJKoZIhvcNAQENBQAwgcwxCzAJBgNVBAYTAlVTMTQwMgYD
 VQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9u
 MTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFsIEJ1c2luZXNzIE1hY2hpbmVzIENvcnBv
 cmF0aW9uMREwDwYDVQQIDAhOZXcgWW9yazEVMBMGA1UEBwwMUG91Z2hrZWVwc2ll
-MScwJQYDVQQLDB5JQk0gWiBIb3N0IEtleSBTaWduaW5nIFNlcnZpY2UXDTI0MDMx
-MTE1NTIzOVoYDzIzODgxMjIzMTU1MjM5WjAVMBMCAgIrFw0yNDAzMjAxNTUyMzla
-oCMwITAfBgNVHSMEGDAWgBSQCOxEmGwiupA2ER7srMBydGO1aTANBgkqhkiG9w0B
-AQ0FAAOCAgEAsRE3oW/VAx2JPESuWDZVbKIX9n26BZUZ2mdmUocRmn7KQ6CAi0Ac
-L5YRUvYt7kmGo6BSA6rUa0TMoMBtFzfIJ6HQZzEoA/LOkIKMfNHsFFzpIJxghPYJ
-PfPkXoLpAOBcLDrYWr1bJ3mkvrd6Tuyx02wJEhVmTcF8W/18AFRPuEVg/u3vJmeQ
-yMdwQZG42kEslvhCTO688vozYeX+dXO1/AXamzYQZyEWk2cBQ28DIc5eg39Tq77N
-89xqWNK/FWKkF4USn9psiBJQpKEjq+P1jTgdpuN3IGv618hlxS455eGyJrbiTxjD
-osWGShI+ZVznnqw98aX558hnNWHic+5JVvdJAwNaMMuNNkApFdz328z9dPtcUAZT
-7mNcKAuY1NcqdxKTPwkGWfmZm+WndGwKLwpshBhF/ImiAb/UiDrLh0jGbQ/FDE3j
-DtWs4k8eXIibtzGhgjfewdXO66jw5Z55FajcOPgja3uw2g2KEhJ+/VP1YtCvCpkm
-NX0liKgKLzUGDCbzyrH7QD16T633ebLbak3CtNMMlxZRQO8DQDbDsEKybCG62f/w
-OmM+QmL7lRFcXDbtVNxBSQKaDBDlNaEGEjM8phz166g+UMD7M6xJjmwJx/G/QvUd
-98YQfMEIt8IlrIbIfHXnAlj4SJwWNfOw+SN0dCqD5CDEYzYVtZgrNXY=
+MScwJQYDVQQLDB5JQk0gWiBIb3N0IEtleSBTaWduaW5nIFNlcnZpY2UXDTI2MDYy
+MjEwNDc0OFoYDzIzOTEwNDA1MTA0NzQ4WjAVMBMCAgIrFw0yNjA3MDExMDQ3NDha
+oCMwITAfBgNVHSMEGDAWgBRWnIhXOCFjqLnM9VMe9E7HEhbxKzANBgkqhkiG9w0B
+AQ0FAAOCAgEAQIp0vuCpPifq82vs30SfcTn0ppIeM2s7TSpGL8AVC0+56x8RXl+O
+1QUw4gOWtlO4m7legzGbCu1Wh3gXFb+6nUhWhT0egtAneoNDXRSHGXdo0nWAoH3J
+XUN/PaipGvDIEZF/UnehYoRrLG307CgJBQkCErFVvI6XJxqGtc6wgsQM2a5A72zV
+jlPEAbCsj5k+y7XzJ+vFVA531IHjdtYrEVMh2T0dN821n/yCwwecuMP4semlqYx0
+xJNm2y4whvyQnDpg4YIfLw5LUc9otvztLYW8h3Si34TO0ApJ6TpEdBdFx23jm/jJ
+VbfM+g2wFoqsW621BiHn9S1KYD0ENSsbaG6BVRm/CTbPNYw6AdgZS1ggZ+a30NCn
+ktg6wxVmXK0I3fzgTcOnaspr/rxkBjDi16sfob9yUuaBuTBOgMO0suq7BEFIl97Q
+tpkVVz9mb53Ixt/ZuF6QpB4DqOyksS8YehBJc9nOGMknOxcS1zYrWJzVJyyrKrlB
+3VHQ4aYE0WsmP+dpX/QE+gj9/Mp6cvTywVSjW/d9zGOyrSvS/ViU1qsMWrr2iy23
+tIOaWRVJBi0TX8S8om4ACgi/qwYGTAcH32Hde0nKy07Bm7JJjGUtJbfLzkM/2rjW
+qvmPlmmPWJxMyVYoY9+mamuDd2jRtJyoULrE5hCIupFKVV7Di8RQJJc=
 -----END X509 CRL-----

rust/pv/tests/assets/cert/fake_ibm.crt

@@ -1,38 +1,38 @@
 -----BEGIN CERTIFICATE-----
-MIIGrTCCBJWgAwIBAgIUMCRfNPXX7mCzJea1P3mCUDqZdB0wDQYJKoZIhvcNAQEL
+MIIGtDCCBJygAwIBAgIUJvPxAmw0HNfQtDlcHDQQXvh5AegwDQYJKoZIhvcNAQEL
 BQAwgbUxCzAJBgNVBAYTAlVTMTQwMgYDVQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2lu
 ZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFs
 IEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMREwDwYDVQQIDAhOZXcgWW9y
-azEPMA0GA1UEBwwGQXJtb25rMRYwFAYDVQQLDA1JQk0gWiBSb290IENBMCAXDTI0
-MDMyMTE0NTIzOVoYDzIzODgxMjIzMTQ1MjM5WjCBzDELMAkGA1UEBhMCVVMxNDAy
+azEPMA0GA1UEBwwGQXJtb25rMRYwFAYDVQQLDA1JQk0gWiBSb290IENBMCAXDTI2
+MDcwMjA4NDc0OFoYDzIzOTEwNDA1MDg0NzQ4WjCBzDELMAkGA1UEBhMCVVMxNDAy
 BgNVBAoMK0ludGVybmF0aW9uYWwgQnVzaW5lc3MgTWFjaGluZXMgQ29ycG9yYXRp
 b24xNDAyBgNVBAMMK0ludGVybmF0aW9uYWwgQnVzaW5lc3MgTWFjaGluZXMgQ29y
 cG9yYXRpb24xETAPBgNVBAgMCE5ldyBZb3JrMRUwEwYDVQQHDAxQb3VnaGtlZXBz
 aWUxJzAlBgNVBAsMHklCTSBaIEhvc3QgS2V5IFNpZ25pbmcgU2VydmljZTCCAiIw
-DQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBALIvcLAKt2DM5rTc1nOhyVT2EbNy
-CA1Sy+l1mSloBRVqjyk464mvlqq9p/CDO1e6tWiFhdEFChuTYzzDOxHazLjPc2Y5
-U+r0QYYY8KK6jLQDj4crChPMJoJ0HZbmlWe/3uMl7lmrVMyHgqqOftQ52etBCGDn
-d/RV7U4OC+MJ01ePYUcABxPh3APA+DDV5eZ2b1k74JzLvXa+SGA82MPDQYc70Waf
-CcsfCw04Adnc968CEUbNQYxdfXZfL0Uvi44bohuaB5b07KY4cCetdMaBIuowgVsa
-d3Zo3pI/vaj8nlAIVmYNbG4aVmItG2q+3K8Zt11A1WXMCfVBfzg4aHAmEPJzVD+s
-u0maCTrRwRfKudHU+FFI36x4aqauNj0jAoQtuACYLS+69z6G0MKHd50jQXYiGwKP
-LaTI+mWJ2+GBPMZpRFKyFlAXTFBFCIpZopAdfhgCMkbb212cARGD9N55xjx0F5u5
-kuXWhyF/0Zq7IdXdBlR9/0uc2I0z2P2RpQ1x1TExjqZoEt6WrpYuWPHtKqeLV1zu
-PonIPZFsKXJDtxoJhvhk/Aivv0329faKxqtIlH1W7b2BrrkC1UYh4+w9f/CVG2tD
-FRkXDEdgyknFsGarHSIGtrIr4vRGAh2p6a+7lNnb9GgpGshFIaOnXf1SXFLgdBwb
-mEPx8pjT7Fnu01HxAgMBAAGjgZkwgZYwIQYDVR0fBBowGDAWoBSgEoYQZmFrZV9y
-b290X2NhLmNybDAMBgNVHRMBAf8EAjAAMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUE
-DDAKBggrBgEFBQcDAzAfBgNVHSMEGDAWgBQsIzqwsaKXaQyBeov7u8c7q8IEdzAd
-BgNVHQ4EFgQUkAjsRJhsIrqQNhEe7KzAcnRjtWkwDQYJKoZIhvcNAQELBQADggIB
-AL+JmoykUGjMygjv23qdStop7VI2ekieYBKJANlq1eEoICLW0yIw9B57pxR6iFpS
-ClulV5vU4GvXlOAP7mTJJQWeuU5Z+sn9s+nLMkwZQj6QBpYwVru3SWx7H4XojRkk
-bVhN7hTrfXfQAkTLuol9PHNrGiTNGKRultBg6votpMSyd2wWgli7nt0QUydhquEL
-2kROaUlHRLo9cKttyy6MIypWlneGx9KC3X/UMoZgxCygpCDQycIp1oU53ZlHO4AZ
-7WeJ/FjEM2PIy6EiBnhrfmRimDjghPM8c8OIMx7fVjc5yS7KnryZ8HuzIeO6CPL+
-/9+bJASuSAHmAZN3qKmiVUVfYhcbU+hKuCS2HRNkRhE/fZidp3K02OqSiRegiPRC
-TIcIXJ/SZ8M345yjGekAJ/M7RGIoirbdLYmpOpvHDg0qMlKFsCdpqasivPFjtLpX
-M1hvu9Ahz2HteKhm7WV9tOQ2lzMdqFDNTbxhhGzy7NJf+20zooTZCDwlNlo5JmKl
-Bg/Tns0rE5ZN2j5iVvv32Bp5CrY8oy8Xq8NJitaEb4JQKSLIya++rot+OTnX7inc
-LzsAwru4YgT+jGnHxEQslPcLMjuLdgZZGyXlKit+8KyslwaAb5Yv5e2rP90gYFFG
-5ZxgKxI1NfJZXgPXjrnDv/FPJZe+agqlTJ0RYCJeSmCu
+DQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAMtoJlBLo+ORDwoG70k/If7AVRY4
+T5Roj6BXTN1rj4vsDgZP0oSNKdxxFaKj1C9ua1uBGjvH9nqsWdZxoyr1YqFoQ5SH
+9DYwuF9XuNlwP0/a2fINI9Tlq64oLSNBymKuYSi7b2Z+JNluVmEk/3x1JbcccUCV
+fxFWbM/oideuGRTuDocFVgkcoMhxOhBwWKo24eZUpbZhW7IIQ31KOiY14FyQEBxQ
+dvb1XqnstW3pUnJgPT10HGbgGDHpkAhPaPQfm/xCbr+AJ/mSVc9BwEOi3aVq8MiG
+FZ0WdS7SO7vHTuk6Qilf9jVZgub6yoZKuAT1NX6txykFYgd6pcqGXV5ut5HqE78W
+06+S8AgtemAcUBfypqVamqzRBTbVfIK7u3aSFiEwrqe8usSjZALwEIcwYndRFRfU
+93Ao9mo288n9FIo+DHSn/zZy1Sz3DM8qHOEoTbAjLL0hOAkGKYY8M2y4rtgYixMn
+yOVbibCiqE11UjYvbA3nHanhy0N3Zy0wlx1G5jwgdlwvCMYTr0quEIuAYniK07ay
+vXJapKLgcsswFILqme4kaUDDcQ+HZCxxhPU4l1Dpf0Or7ZEwPD/b2BsJhjDE0hOq
+xThWwVa/lC2Jv0jQD6zrMPHF46M6xIbSzZjltBGd3gsGlE6jsbuntG1AzFoNLy/Y
+eHZ0/xdLooYxdzj3AgMBAAGjgaAwgZ0wKAYDVR0fBCEwHzAdoBugGYYXaHR0cDov
+L2Zha2Vfcm9vdF9jYS5jcmwwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCB4Aw
+EwYDVR0lBAwwCgYIKwYBBQUHAwMwHwYDVR0jBBgwFoAUDz/nhP/+DIPql2WnuHiB
+w1W1pCowHQYDVR0OBBYEFFaciFc4IWOoucz1Ux70TscSFvErMA0GCSqGSIb3DQEB
+CwUAA4ICAQBSA1tvg+3k76JJ2hNoNglEvbrfFCXu5Vfx+fQm/WKmUs7AYdz48v30
+U8YrCYqhGr+k7XBlaUE2M0Y5TpK0oir7JlBGhV1Nnze/XcORqP6NKkq3FMqLHltW
+yo28ApfsTYNAtbPBwfM7pw9bOHQX2Ztvp7KTEFoQmayKYsgYif+ML+rp13iEAIjg
+C9matOkWBWe0DHvvYyxuiaytlE8ZG6HuIGP4h60tkYovC8VI6JOz8gESDrDIYMJm
+JVUMeSSWJD2bmiWq1i9uDyg+XBfS8Cu0dx4RNqLGSMyMkPMVl+x7ULLPmpM+FMi9
+rSx6nukfshW4Jy9nCj6S3brE7PCCBxVGhRyfTFoZrcD2EeP4Kybi1+L5eyRxZc6H
+DiUm/lR+ls8qliT3nc4RTRMDGcu+qrvBGNvfGm0Pn/FnJblSUIQmm0X3oVh695n5
+1Gl0m3uX0bGr5IuZxxGBPD4uPRmpW/KiGVMXR6Xfibu+nPGuLWdeM90hw+oT/jZv
+DeNHSnepZZ8WM1AKPJJZNHr7RD5lTbfU1HPlpnCtuOfZ7Ef3Ku3CXXGMPMrLgDsd
+r1M5Gn504FfwJG/fRCu7DTQfMgFrKaccT6hbi6/vuB+MCyiTWedxuJT2in5yRL6U
+z246h/s0flCtrg4AYGwv6PN/lf5Awwas3iX2Lr/0tsVSNmie5FWrTQ==
 -----END CERTIFICATE-----

rust/pv/tests/assets/cert/fake_ibm.key

@@ -1,52 +1,52 @@
 -----BEGIN PRIVATE KEY-----
-MIIJQQIBADANBgkqhkiG9w0BAQEFAASCCSswggknAgEAAoICAQCyL3CwCrdgzOa0
-3NZzoclU9hGzcggNUsvpdZkpaAUVao8pOOuJr5aqvafwgztXurVohYXRBQobk2M8
-wzsR2sy4z3NmOVPq9EGGGPCiuoy0A4+HKwoTzCaCdB2W5pVnv97jJe5Zq1TMh4Kq
-jn7UOdnrQQhg53f0Ve1ODgvjCdNXj2FHAAcT4dwDwPgw1eXmdm9ZO+Ccy712vkhg
-PNjDw0GHO9FmnwnLHwsNOAHZ3PevAhFGzUGMXX12Xy9FL4uOG6IbmgeW9OymOHAn
-rXTGgSLqMIFbGnd2aN6SP72o/J5QCFZmDWxuGlZiLRtqvtyvGbddQNVlzAn1QX84
-OGhwJhDyc1Q/rLtJmgk60cEXyrnR1PhRSN+seGqmrjY9IwKELbgAmC0vuvc+htDC
-h3edI0F2IhsCjy2kyPplidvhgTzGaURSshZQF0xQRQiKWaKQHX4YAjJG29tdnAER
-g/TeecY8dBebuZLl1ochf9GauyHV3QZUff9LnNiNM9j9kaUNcdUxMY6maBLelq6W
-Lljx7Sqni1dc7j6JyD2RbClyQ7caCYb4ZPwIr79N9vX2isarSJR9Vu29ga65AtVG
-IePsPX/wlRtrQxUZFwxHYMpJxbBmqx0iBrayK+L0RgIdqemvu5TZ2/RoKRrIRSGj
-p139UlxS4HQcG5hD8fKY0+xZ7tNR8QIDAQABAoICAA3bS5edFbqk5JIPFGxEmhwN
-0L2UMhUbKblbiFAkgzSxpzVs9EAuU/iuLAezpONDJUVeENR64FjZot+ATTErwzzi
-ARbjgWelnAzaFqiI+lUra7d2vN9iQmJltkFcaCT70lD2y6zUepE3Po2V7D4Dy7MU
-SRsEFRt+rSgjRoBe7L0D7OwxD9vXdh0ingpqL+k2r50QX3zCCVdZH9bAFJlQr2Fd
-YQDqgD/4B4t9HgO7v9Uvw3kukBji0lVovIvUUTV5Z6de2JVAMcERZYNoZUrkkvsE
-T6LukXi3WgukglLIZmVR6KoiBBsh2DLlUBsCgbXqOYy6dH3omqOkdsi/9js2cp3O
-6waEBmtrH4qmOzXOnmdchg5zNs5eKVwpsrMc04sS74Xr/CWlUPlMsbL4lV3sdAsW
-jL/iJO/3VSUwPHPfIbQgt7AJrkP31ESDSGNN5ac4er/ltcmB1r2MI5kuPgWL2psh
-ILNFViwarwzPFHLJyiAYSW44p7kzvltoPyOfNyO5ekgeJKuYUfZiNyKYRwrStO4X
-FsukIbYLnPa3ZIb3C0RVBx+lTUU+eyGd/rt/rWFA3Lnvbx4r3FdcYj2DnRM1ukgK
-1QnmqUbWpRQ2wFZsdOPtMva2AUOurzv7Fze83ZyaijAmLnphnpUjqPbj2RYVWzwv
-R7FUHThkc+uzcWhcOnVbAoIBAQDXRKxscm8eurBSQwPx64Td7tmPqvkzANFG9Flv
-GC1FnwP/UpKXkEQe2cMu4hvVAnS3awVAfPkRvyPZDJbL5jjvDdLtXbCtbnZEEriI
-TqT2UU0cnRxUybVesU+cT95PAWiEEvxFTHxOlv2rtKx0fZrd/ft530V3U7UeH7fk
-lZbpEGqmbZn3hGt2UNAXItwi6FT1OjGmOXfBVZUOUSOTDeEX8Dtx+H81ReXTRslA
-QXRruHDZX7x8Tw8YWL5Cq0eCPv5+Bm2DxLkzk616C7icv3qrJQS7u/nijg+qGec4
-aKqFGy+Gvc12cGUt6FoWG+6zS+NAihawxind+V/JYnIt1ulLAoIBAQDT5oPaWE1b
-Vkm2RqVscq5dnKT+ImmIyUfM7lC6Ff6tf7CyxPumHwrMRnqfas8L5KnvgVQi33rn
-OJ5SXoTSJDvU42eqFXD4fAKpsIwbxYi+pY2RPH+PxYNtMvWTMmKZnrqVowFAUHyG
-f6yTIHqIZcy4Ll8wrq+Z2ZNQZAMtllXHLgdlFxDcReGmWvhtEtF2yc36DalQPWuS
-XvC4Zf1ja37Mslst42MdYNBi9QxE4CKVIaDWnF1Yh5xq8i0DIbJt37xpweXtkT9R
-Z6Fefc+hx7A/A5i8bSK6QQsrdL3CokZHY2dbYqDSNlD+21QgEI7wK6ivkS7XkUD/
-fSVIRD7SWYgzAoIBAAoI4ny/rNxi2XtMMm/hibUKwEuJLcqp3BeRpmWeW+Xl7rrF
-L54vFG3XutiBo8h/L8+pBnqmGLoyDcq9Yn4owjiqjU2RU34SKyMrODzqZZgx3AVc
-cYimSnUakNp5gqRuLWASvn3Aff7v3O1XI77eaAy3HTTmKofQeB3qXpkiPAGrST1u
-2IGIQ7YlOD4L2vUpnWQ9DTlxblqt0Z/0OlNNj1OdWDgM3GkwU/FQWGtNYc7vrxsC
-8ndc/Bgnct8Kuu+gXh6j0BEXZ4a2+Jw61aVA68f0ls7liVV9R8+nG3cusdw4kzOV
-v3Eo9h54uVJUhQEIpZRJm5sr8aGuUT/C/g2S+hcCggEAW91HtFUr1DkoY7lk5gsh
-xLuwW+yXTBHW6uU2YjY+3wDInfgAERjMGZtEdfBcKo/LjGXJEAVKxwsouBT6CBBl
-T/n2ayo4e8FndiFv3GpayiwDn79WngHG5IR/Kn1hea/yvASa+kLqeXTIYFBoTtGz
-WvXflr9kqZJF50g0iILwVRWDZzQEvzochX5SzRancJQ0k/9wM7Us+ZvnSEoO/BcS
-NbPtC4vU4FukfAI4e3OgCn81t1S6szK3gTXUhdMKA9BHYqIJCGE7zhLbRpfMeBqW
-MfthL+8wawbfzMsjqUmopjJWEKxFhFy/6H01j2EeVsjWrKaIZDQ4tYqPqzDK+26N
-OQKCAQAV5336ahvQ504soqkNpOiVplH0Ksl3r3/WuO1xr/Hq4A8YXbPFeSFkztxg
-kjZABH6c7rV3/8NHJx86MAxXCAlLTIkR5aXmPrBI+EYm/fle9q/AbK+ppq3IUHVF
-KXpost8YysCRlel2QrhkTln5PJd4oN2xoMWKPHEuc+mhxBMQdq30JtmlVRfm9JaN
-ba3PoW9ecZG5eLP7pZi+AW+KfsaSg9U54jZToYVWeTnTzd7LD70hstun9E+FZAyh
-lrTkZuq578ltOuUWwDgKOly0bCAO+q6KMdb7pbPxbtqtdNGbFpXaChLcKB8lwa+8
-vpiaRjhZtk5MLPJs9mTHq1STrzL9
+MIIJRAIBADANBgkqhkiG9w0BAQEFAASCCS4wggkqAgEAAoICAQDLaCZQS6PjkQ8K
+Bu9JPyH+wFUWOE+UaI+gV0zda4+L7A4GT9KEjSnccRWio9QvbmtbgRo7x/Z6rFnW
+caMq9WKhaEOUh/Q2MLhfV7jZcD9P2tnyDSPU5auuKC0jQcpirmEou29mfiTZblZh
+JP98dSW3HHFAlX8RVmzP6InXrhkU7g6HBVYJHKDIcToQcFiqNuHmVKW2YVuyCEN9
+SjomNeBckBAcUHb29V6p7LVt6VJyYD09dBxm4Bgx6ZAIT2j0H5v8Qm6/gCf5klXP
+QcBDot2lavDIhhWdFnUu0ju7x07pOkIpX/Y1WYLm+sqGSrgE9TV+rccpBWIHeqXK
+hl1ebreR6hO/FtOvkvAILXpgHFAX8qalWpqs0QU21XyCu7t2khYhMK6nvLrEo2QC
+8BCHMGJ3URUX1PdwKPZqNvPJ/RSKPgx0p/82ctUs9wzPKhzhKE2wIyy9ITgJBimG
+PDNsuK7YGIsTJ8jlW4mwoqhNdVI2L2wN5x2p4ctDd2ctMJcdRuY8IHZcLwjGE69K
+rhCLgGJ4itO2sr1yWqSi4HLLMBSC6pnuJGlAw3EPh2QscYT1OJdQ6X9Dq+2RMDw/
+29gbCYYwxNITqsU4VsFWv5Qtib9I0A+s6zDxxeOjOsSG0s2Y5bQRnd4LBpROo7G7
+p7RtQMxaDS8v2Hh2dP8XS6KGMXc49wIDAQABAoICAAh8r4CRL2Tq5AxAjtJpEnON
+Nd+n+NYR6NBBZEEm4EXv0wP7Z6bFNxZuF3+CQ3O5MTyPrfcJmGS09Uin1C2SMIvY
+jF1RsORj8wVzZRCZiOK9mHNrje+vp5KsNXnvoFCuwvoOnA7UO5hg7LS/9PMN9kVm
+J+mQc01XZFHme33m00AW0L9cfyMBMUo7wzb1YRW1FYblSEbMWCWdB6feJX/7poFm
+N23fA5+5TDpd2JId9qU0E8oRIrA+MHRAsRRPr+rjuL/1S6as474bl33+2dVYodPp
+muNbCOLVkY0jE3/5yHadyi3sxZqjQf1+QF4LFxOJ4bIH8TPqeBUkzm8dXR74Equu
+UAVKnZKBlOImZEUjh7fdaOt2RpUJJD/B3UQSx1TcjbiZD9F+IzcpjgMWpgWBr8Ky
+MFVoMUqtpTZgA3M325ILyFHPYA7F/l/gKPuH2+Ro5B2a+AFo0ASAHOzWWpV92/TU
+8kDk3qTp/iI2At9KYoi8AD6MR2WlNt5BdBKUmC3UhRr3uodkz+Nh1HhY3PBnpQ3u
+nMwICujo3rAb42kudJclCK4kWOaCboMqH75dRp85EOOY4Bzy4fQsOudM9/knJvYO
+uucUV+GlPca4Usi6LIx6DotnL4VhQwhbogudfXTKCN/R5reKv75u+UHdpisc5z4q
+qDsN4cgAeMxumlTf4rTZAoIBAQD56rmm53U9IdNVwxjEfo+ZeZHX7Ov7irURnziy
++ThcdiE5VPledhoj3nPfNKCVo2JSFEMtJIoz9ZPkKDs2r6KIQlYK/opLUJfVOm7y
+fBLiYmzFgscFYxGGseHgmoecVcXgb3GSDC716l1fCCz7GiM8xf5lK8JIk/aJAqTZ
+fbV3zA24Y7lWqE0rhAu6/kzlTNeQNc1h+f12uYG99HwRFH4RfgxQ7G3SffMMhQ50
+xR0KpaqwMwvJ4p1sYOsCHlS2HK7591eiWxnJ2IRa43EkEgwtnWaEsFa9mB9v59dR
+J+PgRwd+MaMSntPdBSxHyPLU5nlftGQcSzJhRjwAFkqRK2pJAoIBAQDQW5zCRecv
+/nHzJ1ZXOS2etUGlaDZZ4BevRCKR30Brlp+zKDLXuAXYNYBmRpCMrboM5x+YQ7iC
+2HxVtrS1YBfADage6SkJZ9qYB0yeebHhUs49usb9IcBkIz/hAta+3+ktMYGOSnik
+h5LpRplolp4by8jGznol4GzfMh2lbwbZLBxClDFY+3yJoMR3F+4h/h+VHOQ6cOO1
+YYMZdRTDLn2+rZU+WWcbuzZCVaOsPRsxWbzmzNHizQSxXCXRshYrtQmddAGFihdU
+jvOeW+mqaek15MY3C3uM0fyXeXk0T8kyZPSE0ytiiuC00mWhKzU7CuWyE5u+uEzm
+eeg5RHn0r4k/AoIBAQCDC+cPstzSEnOby/KnzmmEI7ArFkvjmac6t0/m4TIBodvo
+ETu1oZ4xYstFpnXyITtEKOXUvQ1PE53aDJKIKW7Dnm051KE1vuvu3nYg5piMZun8
+Y4fytjERfSMhQEaN3pglCKr31zWks6EEXOghP2Js0rGD4X89yYCD9YP1m6pVSAWF
+w50C6LuWbuYrxn8R2cpLDztD/e8/mySCM7n+xs0YZQ0WPfOUZYDV9stOxbFlzNsF
+C69JzG+ZzfRNJxRqbf3+iwlD1BtgsQ0uD4dbT69dF+US/NhvEF6jsmFAZ/dguj4e
+mO6Wq/wSME040xEqPDQ20AOSpoejZE3ACfBN0QMpAoIBAQCHIwQXFNOPU06A0IC1
+bcZi61i6eU7XF/sEmAJ77fqQTU8jGe1v8FEKHBk9PINAWuUSvUzGqxWe994ckbW+
+9aYx0Cm8cqlFCnDCrelJ19BBPj2518x8HUn1KM+jlv3FKuDHiRZoPXDl9XCZkEqr
+hRTjHlcIap7atiam1JBZ3hro/C0QGaGv/tyVPwpt2719mp7NTcHRDasC1036Uu+2
+cA7qfxcPK1kuqUvV1kmjyrY6WeOlJi7zFNn4VrXIveKXUoH792ONQzVCiL0FdsOk
+3bB+XfUZen8VpJRZglXUUfNClivpgjTfYwe+/78euzF5K+Yyi3k2R77ItUSi8ADR
+bJBtAoIBAQCz8KcQp6q2YP1ciVimtYi5DNwtU6+OJL0g42YhbGxucTsIhDT4VS+o
+m7CcpAiYMxv7cChCoWvGsihlk9ZA6w3MUSCg4Nv6Rr22ReP4m7M15mUklj9QMFqZ
+V52e0zE8MZhq/qQyOXuLSX1TfWeqW7bKiJB63/LF0iQNWiUMFE0DS9fGmwd4L/2E
+GXm/jAtN3b8uHGBoW59mP19HZ6/aXywhndss/uQdw9V48LO1LdUtDBmkzkecjU/6
+5PDWPfzAKJhyP3jZcLAWkXnKD1YPqRsRnfEB0Y4Bkg1gXBNPfWjbhTKpJuiazIFs
+Lt5nZ3XPsdhCctZyYGqQjq5YsoGNU1yr
 -----END PRIVATE KEY-----

rust/pv/tests/assets/cert/fake_inter_ca.crl

@@ -3,18 +3,18 @@ MIIDRjCCAS4CAQEwDQYJKoZIhvcNAQENBQAwgb0xCzAJBgNVBAYTAlVTMTQwMgYD
 VQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9u
 MTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFsIEJ1c2luZXNzIE1hY2hpbmVzIENvcnBv
 cmF0aW9uMREwDwYDVQQIDAhOZXcgWW9yazEPMA0GA1UEBwwGQXJtb25rMR4wHAYD
-VQQLDBVJQk0gWiBJbnRlcm1lZGlhdGUgQ0EXDTI0MDMxMTE1NTIzOFoYDzIzODgx
-MjIzMTU1MjM4WjAVMBMCAgG8Fw0yNDAzMjAxNTUyMzhaoCMwITAfBgNVHSMEGDAW
-gBSMe9JFoed6PvsUVY3z4MU6KhnKCjANBgkqhkiG9w0BAQ0FAAOCAgEATjy3crOb
-zDvF2CiBxmDMvOK8E/fhQ1BSUOB2qc/OiqK6zb1Q2MFvni945+Q+TwbHJqWBfU2z
-QHuhOQHUQQNnIvMPXgjJuT32eF2Y7J4weaQOHNjrt1dwE6TPC1DLNUzibbjKr5x1
-/scmCiXWYxjeLvS7aTACNaD1UmUxyroK6h4oc968ofdPURK54sAiddY+VBA4KW4B
-WlAjxGSErZk0DIg5SXakSQbTkz8+pLnrqqtmvwQXk92lyfrwsSiZhHlcfBrJ6+mp
-1Mho9H5r97mO/LRRV+2CRShqTElxVORbW3Q2ku6RGJHEUB7AssIeKBtEma8yfUff
-S2bX0P82ETUCT3CPZK29QJ8eaxxH+PaRnyiT/W8vWuo+BRw8XqQ2AsM22vVCPP61
-mg6VNsPJkJ8UaUF/S41aGMS21HNGk4Ik0iv0wiuu3q2rcFwGuuWB/gRUfSuPfFSO
-K5sEf47dBPB5kMZCSEkX1RvHPWAYwd6g8GgVdlQEt/IIX4ChoASES5JNhDFar7tg
-6h72VhfTtwEkGqg/z8vI1zP1Qzl2bZ773B/k/TAJ3j6N1JXiHUKioL1hAnA9glrj
-3hnZQEQSewPf8opPe/l7UEQNXGlamYic5WRsm8xbN1KL6HARLqxkiC7K8SS6U99s
-T7L2jh4egE5kyM4lLOFYfEugj4s6Soq6XuU=
+VQQLDBVJQk0gWiBJbnRlcm1lZGlhdGUgQ0EXDTI2MDYyMjEwNDc0N1oYDzIzOTEw
+NDA1MTA0NzQ3WjAVMBMCAgG8Fw0yNjA3MDExMDQ3NDdaoCMwITAfBgNVHSMEGDAW
+gBRBgPq0WBDRF/Zb2D4wpASJVmNL5TANBgkqhkiG9w0BAQ0FAAOCAgEAhEMl0/XK
+3bLp1PMsjB4QrgfAqm8DV5I2WXxrHc0anooAlEqIPEGea5FO4UkL0oxz3Ffxo09O
+Blh9xwAZOOfvjp1mkRucpd2QEdznOlIikL9NXWNMM7Bm9Lljla8pdBrIZQSrBAoi
+WC3StSccD88Evoua87YH98MyO2md4zeDfDdICzZTrYqWWRhbghiJ/vPQwFY/SM+4
+uGp47egoxt8lTMNpPbqBV9+ptZvarvICIQmlRTU4ncWKVb2LmNYJ7zJXeJqEqtsX
+Ti/fIhnZd26IHXfmEp2VNJOp9ODZATiSCZ9od90y/Dhbi2ZmR3hFTU/VrKgzeqzb
+Qbi+dLKvaVf4HGWVxOUuSY9279W3aLkCbP5iL9qGtjE6hL0XncCDR0ifADTN7zye
+1o/OcZr7VT4V6a4dBm/5kNJh3RB8fcLGgrn1Rfa+2GSniFOCMjZCjdMlGHq4WmPb
+yvOLLF2AD8P7PwLxMJ28Elbg9TN7OiV19ALB5ZgEFoBwan4zIWtkekw+pafEqQma
+cDGx197fUf39bYWxGSpALsP3pptNrTsNmUNdhJuLxO2kq5jFQMXRq+yl5VG7JTms
+b/VhB86fOt16hHZQto3gKvd0wXvjCRGiYvOJLjbDQG3e8ghTCGU+40CwWhdC0q0A
+5k1z1ruYUj1mI0+TMGkz5MbyJ3dmgh3JTmQ=
 -----END X509 CRL-----

rust/pv/tests/assets/cert/fake_inter_ca.crt

@@ -1,37 +1,38 @@
 -----BEGIN CERTIFICATE-----
-MIIGjDCCBHSgAwIBAgIUKp3mjstxJ9gXt3S7lpKjri2dEUwwDQYJKoZIhvcNAQEL
+MIIGkzCCBHugAwIBAgIUd+Tu7LLVqsmeGQbJ5IAjvORmZzAwDQYJKoZIhvcNAQEL
 BQAwgbUxCzAJBgNVBAYTAlVTMTQwMgYDVQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2lu
 ZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFs
 IEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMREwDwYDVQQIDAhOZXcgWW9y
-azEPMA0GA1UEBwwGQXJtb25rMRYwFAYDVQQLDA1JQk0gWiBSb290IENBMCAXDTI0
-MDMyMTE0NTIzOFoYDzIzODgxMjIzMTQ1MjM4WjCBvTELMAkGA1UEBhMCVVMxNDAy
+azEPMA0GA1UEBwwGQXJtb25rMRYwFAYDVQQLDA1JQk0gWiBSb290IENBMCAXDTI2
+MDcwMjA4NDc0N1oYDzIzOTEwNDA1MDg0NzQ3WjCBvTELMAkGA1UEBhMCVVMxNDAy
 BgNVBAoMK0ludGVybmF0aW9uYWwgQnVzaW5lc3MgTWFjaGluZXMgQ29ycG9yYXRp
 b24xNDAyBgNVBAMMK0ludGVybmF0aW9uYWwgQnVzaW5lc3MgTWFjaGluZXMgQ29y
 cG9yYXRpb24xETAPBgNVBAgMCE5ldyBZb3JrMQ8wDQYDVQQHDAZBcm1vbmsxHjAc
 BgNVBAsMFUlCTSBaIEludGVybWVkaWF0ZSBDQTCCAiIwDQYJKoZIhvcNAQEBBQAD
-ggIPADCCAgoCggIBAK+kNJHAUL4dcMnjElivyuzkO2UwTUlJcKQCBmWRHYQjRbP5
-akJx8SZ+wI0Spo00hG4sV2BxA83J+Yrked53DEzlR+RxojA16vXzlUO8c9KH2dJQ
-E17PgZnu7/hECmQcT69ZJAOh78ILEXRYk+2ixSTaZRTtchJdzfXIQ0633O2Mi/7z
-z5idQmQeXbitC3QIZeNzwitl2FLXPIw6MUnktOKNjQSNxMr9AU8q1cfOoICJQs0J
-wYVpby0dv1z0f2N21JJywaeAImHa2h58sSX6uqwOXtzdwcPlr2+iJ09YwHM8uO0D
-rtPx3bLHfkvbpMd5cCKjSeFozP1nVnlKJUmAZ8UXk4MAFKCtuLv2/InA8MkclZmX
-1IzBbvYDOw7AnsAN2VQYZSgM8vCmnRCzpTmtvb3ysSo32sTUjGW44giuRtGqh5Ct
-LeRpZZVm6zDFY6cjpr34+3Vc4pys81d3Dq+Sos4YVPXhTKW3I1VtFIdCeNyey7hv
-epjna6/JvOzQuwK90+t9VmZk7jTY2WOUNXJhzDTeDku/aTMIeXUZrAxg3pOvl/wf
-SN5i4Gauhl7URDx3nI0jc4Y2u9NGFi0TYJMCRVVLknAcre5cDKFyf9ts1gDyxTDc
-+orszCE3ZQzXZeEY6aiQPihhL1YDk5SkkTI6XHmUqLW3HFlfg2aFH/oI+VGBAgMB
-AAGjgYcwgYQwIQYDVR0fBBowGDAWoBSgEoYQZmFrZV9yb290X2NhLmNybDAPBgNV
-HRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAfBgNVHSMEGDAWgBQsIzqwsaKX
-aQyBeov7u8c7q8IEdzAdBgNVHQ4EFgQUjHvSRaHnej77FFWN8+DFOioZygowDQYJ
-KoZIhvcNAQELBQADggIBAD4GmfmI5R6cy/Sp37buyO53azgw4RvVclIy/2qSPHVX
-Os0pPPIIXLsbJMy7M6rDvKx/thZ27BDwms5dNuDynZ494XjqTmwzbBr+qEIzCNpa
-QiX0MHf9JqFq5hkcZihfJ8PZL9JWIjiRfMI6AERd1pU1QJI/G8ha1vAkPfcA7GvH
-NBBwKBm63iHYhp+zmnEEh85lpj4pEq+hOLK+mJxu55BodbNiBlBGu4EbalZlwXFp
-7lGHLPkxuXZndrlrm8Lk+hi558NgNFxqz6qYtUc7txajViU2xFjEkTcQ0FKNiFpV
-eHn5TNjwh4QucnWc7wI9hcDoADrekTEr8mUKrJXgxaBLIXEShC0ZDBnJsEwW4xbg
-GQD9qXyo0h8cYx2NngvL+9Ee3rzdYAaSfAnZOU0xxrqZt+2dstNqi3pLKdS6RpA/
-3Dt3cAnf0mQQSUP6oZQpfdSEJ9uggT9h+kgJz5RGOQfEELKA5RxHtTe7249J3vDv
-hoy0Uy6+w3Ji5AQdn3G5uUGxLsBh/uS1dl8hq4gihrpPbKVJHVxqPL0HCx7DyhRw
-hx53GXhGIgZN7QSGTrB5iz9YyzejsnysS0Um+figkxtC1atqhVkqzMDZBHUwRPfy
-wq8PREXoRITJHfSkg01bInRFMMNWDQuPwSHDX9OYNqpkXzlV8/ao9Rx6JOtiG0a8
+ggIPADCCAgoCggIBAJ9fTVNzE5e2H+WuvbNQZYItoFGBM6jnz0D9OMxonCN+nliF
+8+7h4tIZzaw/8UMIE+6gFjSXNL2ZGJqH0QOQg20eoqWPY3q8BZ/FYzLih0NpluV4
+PNuBRw/lG/vcDVk/ozCYvd1YKXkcPcQC6zFarWeojs3FsflEbQ5zr8LzGjoNmSEx
+uCJt4UMAVrzZbld2m/lkV91UVw9ldUFxvSafyyS9FcKgOIlPiLWq5pfwqt9Ns9ir
+K+S421JaFo39dzMYWaDQkCLI2imT4mv2hDLeS5nin6ERD/9w7ZBEQEdLLchHRaQO
+nZYIx0qjLsxPTHxJKj9UIuz8dkGywFNF7+QAXtozr73tCu6Z1dUkDn7sk9rfyGto
+2r0USqOHGfmqQSnybhKstX5YpSFAXh4NJUYbnZ0JgttlvlYALImHdC+HuBl73mSL
+Dz+tkQ8W6U2kAMWT7M0LmXmuj+iTyzFGqg1/1URm4GStRdqVSgmp6D1jgwMDmeRP
+9kyUCfiNXESfnIpuMtJzlUP37dgYtLU+TEvoxsX24Ea7K8mJ1Op9VoiI53GZbGX3
+NdeUYpFvy5EJAy9N9KvIWeVttzy43ZRB7OayLqW/FWDga2CUTGzTcEeTfqQReGV0
+b/8ZW/5SYCcocKKNp/bDC6DqvIx8SOoQ/AxkLHLVVLCzq6uXYQItMpnM39/FAgMB
+AAGjgY4wgYswKAYDVR0fBCEwHzAdoBugGYYXaHR0cDovL2Zha2Vfcm9vdF9jYS5j
+cmwwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwHwYDVR0jBBgwFoAU
+Dz/nhP/+DIPql2WnuHiBw1W1pCowHQYDVR0OBBYEFEGA+rRYENEX9lvYPjCkBIlW
+Y0vlMA0GCSqGSIb3DQEBCwUAA4ICAQDca7YS2ZH1bjXMLCS1fJ7cBt680O34rppR
+fosnvg4eI10G0cTJb2khXQlH5vvDfEWr2wz71TvgygsN0n0tEAcbU2J2Fgy7J5Eb
+zv+lkPNcYf2bwRaMAxi9ARxlZSoz5IcLzDyD+BcTLAGsMFymD29Ofs4ej8x/t613
+KZ5lCiJ0f+UUuNZ/U2e9dAhr8m2XI4vzhmQyx2NO2GfXSQ3YconoAflK5QbVYaXt
+QQiz1oz4LOMN5y5zRbg1MekF1XFITsGan4rs4Zl2EDZ2rge67Yn2RMvmLyPUxRTY
++WX4nhRiIPM8dyIQb9tqSjTDhlLanWm//Qb2qYW3PNtAAtADF4opFBysX/yJEJWM
+BIxKyvL9S8TdlIIlG4D6Yigu/n7j1vB6aRdtpUzrKMqoktkw8xtV3HIs+uS1XPoT
+xyL4xC8hWePMmsIvvTpxBtEEZSCXYMFp56QvR82Lv25ORfcLCZ0B+CA41AUiHhvp
+1Vloi6e9d6fMI1aOpWtiC3+tJYu98LAylGBBq8bec1h0rejpe7Qe7uPOeBL+SFKD
+i6mQw7fdbv8Bs8+wjYqvfSe9G7BPvaccyC+GnzbP8ElrpTPVfLT0eQpdtftxdCH+
+Y46lz8y4ixMG99vF6TQ37ca4Cz52Pw+IN5JESkWEDphqO1++YkytP2og9dw24Ktg
+ZLaX284IyQ==
 -----END CERTIFICATE-----

rust/pv/tests/assets/cert/fake_inter_ca.key

@@ -1,52 +1,52 @@
 -----BEGIN PRIVATE KEY-----
-MIIJQQIBADANBgkqhkiG9w0BAQEFAASCCSswggknAgEAAoICAQCvpDSRwFC+HXDJ
-4xJYr8rs5DtlME1JSXCkAgZlkR2EI0Wz+WpCcfEmfsCNEqaNNIRuLFdgcQPNyfmK
-5HnedwxM5UfkcaIwNer185VDvHPSh9nSUBNez4GZ7u/4RApkHE+vWSQDoe/CCxF0
-WJPtosUk2mUU7XISXc31yENOt9ztjIv+88+YnUJkHl24rQt0CGXjc8IrZdhS1zyM
-OjFJ5LTijY0EjcTK/QFPKtXHzqCAiULNCcGFaW8tHb9c9H9jdtSScsGngCJh2toe
-fLEl+rqsDl7c3cHD5a9voidPWMBzPLjtA67T8d2yx35L26THeXAio0nhaMz9Z1Z5
-SiVJgGfFF5ODABSgrbi79vyJwPDJHJWZl9SMwW72AzsOwJ7ADdlUGGUoDPLwpp0Q
-s6U5rb298rEqN9rE1IxluOIIrkbRqoeQrS3kaWWVZuswxWOnI6a9+Pt1XOKcrPNX
-dw6vkqLOGFT14UyltyNVbRSHQnjcnsu4b3qY52uvybzs0LsCvdPrfVZmZO402Nlj
-lDVyYcw03g5Lv2kzCHl1GawMYN6Tr5f8H0jeYuBmroZe1EQ8d5yNI3OGNrvTRhYt
-E2CTAkVVS5JwHK3uXAyhcn/bbNYA8sUw3PqK7MwhN2UM12XhGOmokD4oYS9WA5OU
-pJEyOlx5lKi1txxZX4NmhR/6CPlRgQIDAQABAoICAAzvUnVE5NVZaPHfPH3GRXMc
-bEDblad+5nIXmZW/gf1WFScnyDLoPf6MIV1KSTR3MIUGFDG8pO9x70QSpyRyXzgm
-/vxEf5GeGOV/yKduQJfZrBmMTt7huH1H/slpZlwAx0AGOCwhz/y58LFBKDS9Ethv
-0nef9HGEkbtG4ikRCo6+dd1i4nAObcIeh9+ms8QZ7bn6T4t/YrbYFcQMcY6L7qPM
-EZ1rHNnnl8H3KTr/nSuWIDKmJCexb+/yQ8JiWaLPMKCv3ZHasn2DHuLVozylKjvr
-S4JnvOIyvzChEBTMeBDMgSBoT+bZJi7pOOR4gpozl+XfIVzdqVIEmxZP1u7iq1GV
-0jS/NwIAiZyp0e4YC+joS81AaskqoiTnk59inipWgtXaqz9peSd5hDA2u4mfSCVY
-aKHEDv3dUYyc++JTr0qjAlxuu0SJjPZMTeIbMoVX+7RTwEHyQoiHzNLzBXo5yGm8
-b29oOqA4DePMt9+J/h3xuiUH9SmYxTkSX6oGZAJC2qEELGFbpN61zLSjJOlv+wfC
-Nmpd8O88q6dSG9Tk2o2xeLRXAEulEtmIwjr0x8S10pieJ+ZhoaHAyIRWnbVfwj78
-pKLdpd8MPToTS4f98nkkVfbmc7ymVdz4JhnYTco4aqmtai/8yVUzzIjOLfJ6bp1s
-N9okI+1fKgTVlyNj40opAoIBAQDeZqJLT9DTAhxZqa+ZUYc/ztoKiT1JLXDZDWhO
-J2MVqFdTs7sAw/NhVx7Buf2VBmRBZ8jW/izrING228bCkpIvF8Kf5Fz5busJcJB5
-E2xhnIKRVrnw30JCxF0dGCqpfA79GyhfSsAdcx8ou0TUAgznvYHz6BvdYL8VuGuB
-YQ5uJNSykrtHsZBwsk143VrwmUyL/HEiq/btVJ5vRLKtbR59+KOzqgZKTgjDZDm9
-8HwA8Nw45GqFdXUIHJwCwbK0+YE9qW/QCLDtx3wct+E1fs0C6TuMfLrh5khHUa6P
-EZKLzkTRm7VHYrFFSGQBQBQ9mMalEttkrHmnHwfd5PAgCGH5AoIBAQDKLSVff0GB
-5uadXXcRMRrhA+crUud8RUi9BEXdcUJR4fLosJl6dEBkhrC9pxVpfczAL5zXaqFg
-Z4R3AinWB7trIGC1MaVc1CZenBtiVsPHNzOkqeZdcpK/WZcqJ/6AiDrXWYDu5N2n
-hsff3Wtp2QqqhrrsP9pZnyrikAYeBvtuys28wpe4L8fZhwyRNry2jziIlmomtHyX
-vr1xjfwQyVNno0RpppgAdul3RqBUV1HCpL7pndhfwWRCnW7fVDawYqSpIXUHjW8E
-3+RgpHh0/YtLNinRKe2cDYorgxF02B1YCcSignh1msIbuJcH1MI7N2C0C2atiGYE
-eSK+R12HcM3JAoIBAHaHXJemwjSzO0jOFrgvq1VmeO6ElhUaErqbWqvMchJo1aHW
-eCPAS0XlmI7HAU8bSPNSzMdIT8hAhYRfPV8VnrNahm+Q1bxaUQmG5Hii0XB0aWHs
-Rs0JL9dFsBqBdrs9Uv+yKaIfxKPtZv3eUKBtN1OKvGexnKgvl6eL0j/x6i7pkjJZ
-4VYkXEazwHZaAs2X5iP1Npaz77YtEwNaKaAkN8wLZ7OpOhD/5cu87sk8Edqug7AO
-jHb0UpswJDWT5hptn2OtmdnVx/XyC0OC/JP2MG0MwJ/vGeqrQHpCHjZBt0irdiIA
-SmzxPGkgW6wO6rqpYbU4h5TwFyXqc9be3Ns1nIECggEAYZUIxN8XLyvTg4DpR1L8
-Nj88BJ0vPbvzL8gwMIHKENuN8uHKMmCJ8/tOsztCCni9qsVQXmkJGw7b0NUqfDOf
-MkWeZ9Zeij+bhW6ziPN361+pfYDDv7bdPZ5wZ9iF7mPSgr6gjK3KjmFvd43Xmm83
-xrbg4cawDTHV8SSyzytvkDoyszj5Id1uCIA2gKB61WKrVsHC2oui11so9PYjA7co
-mo0jKBtQomjCpt9f41WCEQCTZQ7asN0XF1AFg6WR//CcqUWMxuhs/V1TTZIU0eLO
-qK6r4FjsZrXiSr4oXs0w3J1aW1W97oWTyu19eDooxYwlEMGv/XIoS2BsdIrdidHY
-gQKCAQBrA0X+AwT9xgEwYaXnA9RINBPSnzruv1giHHAmY9iS0V6BNJUzlJDyASdT
-7drV0YRY7bKCguZYNVZh3o259OXNsAOStd9yiyFzZr6bAVvTVXIkrB040Rd1xptC
-yl+kxYEfDeENkCR6h8JkFDupG4xF0PT70sE1sUGgFg3585nWzhN/s6xC9vxtBNHc
-R+a1UmoH8pYSONttldtW7g2kB5uuQTU0lZVSHDj9B8z0Twj3b6+kQlXt0ielrVV2
-TSVZcmbIyyEYBDcAxOCvHN+rzKbP7H+7JqHVgnbe12pnVoN7WVMbR2v3F4pK+0aA
-M9Wd2js5nPPh0AN3Px1643vFYcAQ
+MIIJQwIBADANBgkqhkiG9w0BAQEFAASCCS0wggkpAgEAAoICAQCfX01TcxOXth/l
+rr2zUGWCLaBRgTOo589A/TjMaJwjfp5YhfPu4eLSGc2sP/FDCBPuoBY0lzS9mRia
+h9EDkINtHqKlj2N6vAWfxWMy4odDaZbleDzbgUcP5Rv73A1ZP6MwmL3dWCl5HD3E
+AusxWq1nqI7NxbH5RG0Oc6/C8xo6DZkhMbgibeFDAFa82W5Xdpv5ZFfdVFcPZXVB
+cb0mn8skvRXCoDiJT4i1quaX8KrfTbPYqyvkuNtSWhaN/XczGFmg0JAiyNopk+Jr
+9oQy3kuZ4p+hEQ//cO2QREBHSy3IR0WkDp2WCMdKoy7MT0x8SSo/VCLs/HZBssBT
+Re/kAF7aM6+97QrumdXVJA5+7JPa38hraNq9FEqjhxn5qkEp8m4SrLV+WKUhQF4e
+DSVGG52dCYLbZb5WACyJh3Qvh7gZe95kiw8/rZEPFulNpADFk+zNC5l5ro/ok8sx
+RqoNf9VEZuBkrUXalUoJqeg9Y4MDA5nkT/ZMlAn4jVxEn5yKbjLSc5VD9+3YGLS1
+PkxL6MbF9uBGuyvJidTqfVaIiOdxmWxl9zXXlGKRb8uRCQMvTfSryFnlbbc8uN2U
+Qezmsi6lvxVg4GtglExs03BHk36kEXhldG//GVv+UmAnKHCijaf2wwug6ryMfEjq
+EPwMZCxy1VSws6url2ECLTKZzN/fxQIDAQABAoICAAh2H11gXThvT3c61VCJYrJM
+KNha8zqzAAJzz0mu/ic2SELr7b0PmiLMgupzxKPp8GD5d+RX6NFuKOu/bT3ytL+c
+4kbG+6GfDO9kI/WmKEdQelX5kcWXsgWqhNdU4hKMeeYRHfd8AEuxT6gx/Xmz1kQM
+I3TSW7Yfx2h+hOTlUk2lvi0QfjW5vr13baN+KckT/4j4pl+WZD7phJWya7f6wObU
+8SxRpF7J7bizd6W2feP4NKW6xMxScjaHmO31+JeqYcvTduuZ3Vdaxik0P+WRftMP
+QKllBgPqY3qG3SDL4YTiH9Trf7thAO+6BTiMt0NcARW2qloJt1+alXJ2Ypuo12BJ
+0T7tMoCaQZfTxcd+XHJqQMcMtoVX0iEJeIXVWxIMFwlo+mEiOfuFs6HjPJe5emdB
+bNsKyEzqt461v79lqMuiS3V7+ytCFa1NBkuww1GR50SWcrkHB8k5lpwe6HFe7K0/
+znlmjkL/RUOioPZs38sGmQ6KWqJ+2/RENJ4MRzfoB/9oqgQK9fl9ddi5dGj00uu/
+b79/OJdfWLvoNH5f2JQKa821DkcJaM8upqwy2hocpBdAsLggCcUxNSwSoE0fUEdY
+EYLutuLgDMtD7yZTJFa1mWVTLX9ropAhA/3AIQJqINj7HtPKYTK7vIHGcoDSX/nf
+R6o9a8SiIWdE7K2Luw5hAoIBAQDf7L/BgA/pHNIzJd0xNaPhqhECyAs/eawYUED1
+2JOGDQWFWoSX1XCaw3KF6/9ThxMd9fLVtTf90m5qBrpNKGO/nRJb+kv6yOWr3CJi
+HRy42M8D4Hrl6j01Fyfu8wSM2cKuIHpEHxyIAKLyq8/odrfQMJSau/iHScDmmRVG
+7dTBqDku42QCzfqOcUOO0xPWYQeKv9nk94nJF0rLdoRov5BQsL+dTXayCSR6ECKL
+ZUJplIt4uwy3zuiPHp6simfUl9FZk0I8sADgRucVhwpda2FJbvLMioBbPgQF20Nv
+GSSq7JKyfO4NEp6nICPgwBDEl5JigAxlrxRy8NkTTJZxF1J1AoIBAQC2M260lDES
+7eensej6UJVWGUEXDLG7i7UP1it9H/o24oEkR9/+ms8Xx4G2Dg4DovlSzZUL1cjr
+ePBPKqRlej3XGk5voa5WHtcTA2eVZRaTIoYWyEzmiCXE6M9wUhuliuOmTZEXB/Kn
+oBP9axHIbnw+62qbDzmjI64OgpGJz2ZOaSnwdVhc3LugmujjvOBto1Hf7p7egu3o
+GEjrRRnEoisBTeex8JymLWKNV3S0s5hywzzpGPSvvCrjyYiGdWLAf37Ek4UTD/oj
+qEf/I/f+Xit/9rEwKw1IN2DICmgJoODee3J8zG8D/x6BrBDVF7pfVGhuTZh9XhvE
+PNmndVZIbQ4RAoIBAQCZabYmd/pul1RbvoFAiaNxo/ZrlWo/XrjNH46h4HORz7IM
+nutgqtau8WCw5/LR4yTxzeNFDxcBSv5inaFd42ITkSVW5rDPbHwNto/H8HIRIlkS
+KuWIR2cPzIGLb+uaJEcAzTd3HGmLtAPvhk620T8131KwgD/RUHJcilzNb3voAbzL
+pvaKBVy34lmKrIpWwbtNEAvUltNLdi3EH7qvmS7iWXWt67h6WVEoX42LOyC4/RBg
+8qXP+G3UQAIt69UfDbRcTkt/EIZJIcqIMTCkuEC68sxd3jX6TQ6shIA6yVsZz2Lh
+7j2ZrzwK/DYYcP4L8lxUJ65WrBCyftf6JOqdKIFRAoIBAQChHRnn1KMQeg8+2rOJ
+pXhoiixklXUUwpV5S4lpO72miuRnkKciHQLDpEevFP6PeK2/6srBjGn+zxKw7qQw
+l8fXTgvN6sqenObSiVAvaxRrRzwLKVPXBs1fMf88814/JHHpvO1v0DdiwsrqbKNs
++UYk3UeHlg8Bk6t2aT8I/b0Z2SSc3Scl9opzmogV2g8a5DCiM/+IA38cnVzdrlz6
+4+vjW2BmmL3stHVRRuSMZcOIt9xEwyybuWizxKJVQ7fvQM54RXqHQLmQjl4b31KM
+O/l7TkmgrnEwSsfqHEmjOf+evMqgUKZagl4XjG/V/wVvBtTRtQwC0BT9klFlIv0J
+TmYBAoIBABl/rnKHgvLdjyuMcYk//K/Xm8dI0wxl8oKxei9TUiYGWTUXxF+vmQQu
+kFNxy2JgryZlDF6MMgeEODA8/I+OFqmeY2Cts3jx1jqbKL2gI+B6YT3WPJgV/Bnl
+gF6JMA1OS83XxObv42zIZFXY9iBbss6WlhPkyvr67DW330QWe3JuC4aQ7c3Kdxin
+oSVmjpoCacaJ4bDa/L7Bo0l0DsXWbGyT0LU+B2duTLjFNF/pyyhuqjczbORWyEwV
+t32Wj4HJBljglfr+pkWc/rjX+0noFTO9UFXdoL7WB1xGJMK+rH5FLOV9qtVYt0uG
+xToCDsY72xtSlqKcRx1Jyo5xXSPvd68=
 -----END PRIVATE KEY-----

rust/pv/tests/assets/cert/fake_root_ca.crl

@@ -3,18 +3,18 @@ MIIDPjCCASYCAQEwDQYJKoZIhvcNAQENBQAwgbUxCzAJBgNVBAYTAlVTMTQwMgYD
 VQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9u
 MTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFsIEJ1c2luZXNzIE1hY2hpbmVzIENvcnBv
 cmF0aW9uMREwDwYDVQQIDAhOZXcgWW9yazEPMA0GA1UEBwwGQXJtb25rMRYwFAYD
-VQQLDA1JQk0gWiBSb290IENBFw0yNDAzMTExNTUyMzhaGA8yMzg4MTIyMzE1NTIz
-OFowFTATAgIBTRcNMjQwMzIwMTU1MjM4WqAjMCEwHwYDVR0jBBgwFoAULCM6sLGi
-l2kMgXqL+7vHO6vCBHcwDQYJKoZIhvcNAQENBQADggIBAJB5ERfMQEZ5Pdc3A8+d
-gDiY53VEdA0Zd8MDv+j+Mgu1qn7IW2rpE313yVHieclZ65ReEtb825St8UBJtjiZ
-9Vd4lK9FUQKKCblCYNrEbu9cvqNeHDGxldQPUkEoz+z5kielcEwD6RUsK5fSYe3Y
-6E3jc9mMHw7xWCSiolvNr5y6AUymfu22v41qgfaB0yNe5uz6vRgRoiy+OTP3Z7oc
-ls7o73F9O4k6QYdba8us4v0TSwZAAPO16TsHhmyHcBe3w23UIusTU/c+6A++hGdU
-TNUW3OZl+hv+4BcnClrVBDfWiExOMNzIhH9hzlXQ2qNPNqz2ymlH8Wgpf1TBYJ8m
-xe8EuGGrDFuewa45kA8uxuHCiSLCsBowDEXXkswaSF4E4yzYZqcNDcLOedK7vG9G
-+zXYHOpLsZMyfgauxjuWtwR/ma+ub85CHy+eUC2waI+Mk0Uk0Lr5y0Jdp8ztxakp
-UlVHYNU/Q+kwHfmKztkOsedomOf1/8IvzE930ZB8rv0G8ok2HXYvA3+r3lcDSG/V
-7+yq3HcJezw0XCDtc5mv8dWI6pUv8siWFKok+hlkZpeSXgtqRhF2rzI8yz+lk5Cr
-5yCWroPI0T44o2RzjfGZAViRH0nnYF1GoBORSZORppubcjmiTy46OFG/fiWKGKV1
-sngAoQ4TCDQzId0zwGLtUCHu
+VQQLDA1JQk0gWiBSb290IENBFw0yNjA2MjIxMDQ3NDZaGA8yMzkxMDQwNTEwNDc0
+NlowFTATAgIBTRcNMjYwNzAxMTA0NzQ2WqAjMCEwHwYDVR0jBBgwFoAUDz/nhP/+
+DIPql2WnuHiBw1W1pCowDQYJKoZIhvcNAQENBQADggIBAMZqebVQ5uXrSOjIbzH8
+RJCo9JjUH3XQJaKQrZW8QWpZKzY2rpLU1Ag6C8jM8qHAEPpkaLbwcpZUOV3g4AEw
+K5ezIe8VVJK7aHH96XYoIuYVXmohk0M39IEf14sIB5BkCX8aDC8dFekyZf23Uv/T
+zwjl7RDc4MAaeV4zKGZ0TBAOT9w1Rfek/U4jwQfvuOvY1Mw5wn7SJrrfE4waaPwK
+Nklpd6VsxvMgmLKV7BU3rEwndkbtkAWyWJw2F1L6p93ZNUBILDFc5o2f5qnLp6Yj
+qvEZmWUWO7+Y0qNdsOjljmX0XfuWhLuWB2zq6LceR1hr52XABvJAFIDuFnelfgeh
+c1rXpZThZSNwNhTVcZr4eLIJ/uR3UtIdl5uTkWY8Gsm3jaC9IoPADlSN+fOMV9eR
+1u0q2XBj0DafadDjeAevxM9xw8S/ToklqgYPRQSA3nq38EVE8c7Klkv9x/Ar2U3M
+5GGeDIphX93dzi7j1VAWw0fuylY8Bg69NJ9+889K+shDzIL3xBbXEC8RhmiHFi3H
+We2O2dtrVb62gUd/WgSTxu3OG3mqWPwPU94zK38zPyndDF41YGp70ur7wHkFPcfJ
+0WopCMqdEWBrUc8ZPZ1EBw9cAd44i+hVQB4x7qzNCmHJWi2942kpGv1vJ+IfUr9/
+0MtaUK+nInHcSPuyxhdlb6BE
 -----END X509 CRL-----

rust/pv/tests/assets/cert/fake_root_ca.crt

@@ -1,37 +1,37 @@
 -----BEGIN CERTIFICATE-----
-MIIGXzCCBEegAwIBAgIUC2OH79tloDOfMBeyDBA84epTMKYwDQYJKoZIhvcNAQEL
+MIIGXzCCBEegAwIBAgIULbCWZUfOIiRXCiGx8jr2mhqjQrswDQYJKoZIhvcNAQEL
 BQAwgbUxCzAJBgNVBAYTAlVTMTQwMgYDVQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2lu
 ZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFs
 IEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMREwDwYDVQQIDAhOZXcgWW9y
-azEPMA0GA1UEBwwGQXJtb25rMRYwFAYDVQQLDA1JQk0gWiBSb290IENBMCAXDTI0
-MDMyMTE0NTIzOFoYDzIzODgxMjIzMTQ1MjM4WjCBtTELMAkGA1UEBhMCVVMxNDAy
+azEPMA0GA1UEBwwGQXJtb25rMRYwFAYDVQQLDA1JQk0gWiBSb290IENBMCAXDTI2
+MDcwMjA4NDc0NloYDzIzOTEwNDA1MDg0NzQ2WjCBtTELMAkGA1UEBhMCVVMxNDAy
 BgNVBAoMK0ludGVybmF0aW9uYWwgQnVzaW5lc3MgTWFjaGluZXMgQ29ycG9yYXRp
 b24xNDAyBgNVBAMMK0ludGVybmF0aW9uYWwgQnVzaW5lc3MgTWFjaGluZXMgQ29y
 cG9yYXRpb24xETAPBgNVBAgMCE5ldyBZb3JrMQ8wDQYDVQQHDAZBcm1vbmsxFjAU
 BgNVBAsMDUlCTSBaIFJvb3QgQ0EwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIK
-AoICAQDK+jIoIZVYyEq7ZrxfKv/TQQWCgI5C8BewYkB+/rt8NY0fn/aAZbvJdnDX
-cQCLpCeETDi7C2hGujnZQN68otr2GpJVQ/kgKnM8yU/p9yBSUan9Zo/195a9YytF
-6Ys/Yc0HApoPtB3t85NHNjAvhzdcBKWMb+/2FiJ61gdnrO/zORnxp/BejxTMyB6r
-0mhhVX4wwdl5vfkX/qS3TL0rajEz0V+SwneDiIomoVJCnco40Km1M20qU5L7EpNH
-IMEP00hcj40zO0jJ8cGDNoKgTHsZPovYfFmWITVOFvaPcKaloUU67dYEg0fv3ypX
-aYHRszcd794VOWQ85r/mlFSSELwoUrVH7G0t6wnzOawW2kk7ZYndbo+Z1ZFb1Ul+
-iVwUAHzx/ylmOORJNM4JGiYyC5+1481MLeB+37+V3TJaBe4IoKqVo/OCBsaPt7x1
-rMpZLw4gXj3A0Hh8gi0z5HDkKolMSawuU8dpFeI0GN+4hJN9DNQh0OTGLEfzeo+1
-lNzsF+jGT9B0tApWhBq/QTyHXvJREVx32hPd/1X6bVbd9mik0bexg6bVpZVNG1sn
-7GsVO2wq5OWKe3UtSh8wJcjGdW38fPAB46oIBQ7x0HGdp/KFiBTWxrexLThMFvYL
-wPtWedj8ntgOBoH5MJgL1XkVYP+1EQYaBJNfswvF4CrvPRCtCwIDAQABo2MwYTAP
-BgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAfBgNVHSMEGDAWgBQsIzqw
-saKXaQyBeov7u8c7q8IEdzAdBgNVHQ4EFgQULCM6sLGil2kMgXqL+7vHO6vCBHcw
-DQYJKoZIhvcNAQELBQADggIBALZNLMgm7RqIKY++Blc2qeIDrwlx1U/PPN/PsZsN
-cQR48Bq+vQ4cV9hOcZC3jfRbkkDho8jxVTXdEOcpDyU4zNSLG1+b1FNRvqjq2L+d
-ow190dYqvfgbdNFo8V6kLdRFe5aCLhHTWGLTbl0vvkc99h1Lt9ZXr6LzhFwbXSGr
-Q/qJoLZFVBwJZmfZY3VmL661sBcTmzDDGJxg00fg+1jCIk2Ot3dn+7jQ8g6HYMQv
-8GrqGKcFia8fXcTTmcH+Swr8rps1MYypjkpX/zVHsFuENdqZNkqU+OLTaifkrBuO
-6evTTjEOcDzMFs5Uipjvq7XOBg5rz9BKRXrjDMdI4CmUzMR272lToNw7lHqqNDKi
-nxAzPjPWVwXQTu2LFY3NwubWkPAVsd6FsHKzQHlq97N4sj+vp6vctaEUgFS4pUlL
-tbjw6AtQA72z4uIpcAzE2ctTj831QeQSZGKBUpeNPjuK/NjytXQm8MvW7LI2OgaI
-H5B9+KE9KjqijpNiiOoidYVwFRrZniIQii06qXwQUgz2gGIzYPER9+3PijrtOY+t
-K/vS6NohUYb16PhbbvzFktSGBtvp1kUF4fB2NJh0z6OiZXVEHlCYEDTv78RS36iU
-PXijR+rALi20P4Sg6picuvmt2epfSMQ4ynNxPhbSG7wMp+Zp5tOrZcmg4jN0Yt56
-tACH
+AoICAQDgdpk9Tu3dKO1O2orgftU2GkgARccHONa/NqnTcqaw5vbgWU8CiC99ejvC
+z5ER0R3xldjU3uTh2UXgQCY2Qf51lsYNx7CgjFVzTaoJ9FhD96mEIYtMWPMoF1SR
+mxxeGQCJHfMtB3ammatkXKV8ia9GlGQFtQU6Mh0CmNZelrvs7zXvYRMfW4oQX1zb
+9s4n1E+gxErTRw+PlK2LmOPO7AAMrrGn2sbxaoqJijMWOysekYZaNfaKkOOzyuXn
+fa8bcG6qAQWmQX56aUYTiwPNtyovFvUancgDg4bP5hD4hEsl2NRSQZQggt663NWK
+ALQBbL6qeJDI+WlAf83TbDVV8wGPuwGKE79+ES+TnT0GhhanEJ2J2swm3IcEVuya
+pEay0NAfoEfuzgyYYerekeAvqHbvRIxFjR1Hh5QvkGjmmr376E4CkeyXaqjFSl6o
+XamS0gSVfvnT/jYm9SGVFafA38ZGx2iEOMtybwJM+frp5F6DqwRG/dKgJ0W4nW/N
+E2iB2JJhVR9iaR973d/4G5vL5WVFUGv3b6VyZZAPftSzPoqPqGEaKGaHprECPUDQ
+fR1wdLYUuQfqgVnj1sKWT8YWNNc+11idVU/hPF3Yu9dSPVaEdYIQiQ0NNqnhneO/
+IVsOz4xBbh++frq8H16k0xqkOJuC6mCZaU4YxWy8SZ7jukyCywIDAQABo2MwYTAP
+BgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAfBgNVHSMEGDAWgBQPP+eE
+//4Mg+qXZae4eIHDVbWkKjAdBgNVHQ4EFgQUDz/nhP/+DIPql2WnuHiBw1W1pCow
+DQYJKoZIhvcNAQELBQADggIBADxbNKDguPbfyhUOmrXcOPdzNWGvr51Cm0OZLOod
+nUcP9rkmEZYMZkmAGYCMkiK/HCd22iOXyHW+OYvq7zdLlaWuMfE6wxwWZ8bK3NQC
+3w0HPyAOcxknvGnHLnmi4+sKz+ZwVn816EgYv2iytVdfjclVK0Zvoa6COc0C085e
+kWe0hWFuqbVRzmtqoQauwxU9+rfY21/GtiZbkOiAo6VP9qqfrq3hDBoF/WT2gGVT
+GPuz6j+m2D2ai2s1rWLJfLfcSIySZ67tMmg3lL/8FrxLVmZ15XjuX8Y1M4XhjdV3
+G+9XSeuvyqWBrN1l99U3BvAVozqI0rEx7PqH8dpirwuYWRrJM7bZbuOvdVAT3wpE
+ypfXOkjVmTCkvJH2wrupywiVIu7vANJ6poV4zo+f6GJvM8iv2z8S3NmM7vt7NFFX
+1Q6HFmlAgAW5SRQ49ClKZAftW5fiOCwkpWsRY6REeKz/bF4anm0vVZpPutM1BYRx
+yw4xZihWcfxipzeX+HRuxYZIpuQaUnTKWl9QgCxKzUwNitSL/bp1uI/H+TgRR29w
+6ns+M9ZufO7oiuAPBAjw1TTQ8f4C+8qxJIxqKZxqk9TkmDK2+hLkbdBx1hcIBJHY
+ClfQLQOBEL1l3nZd2wnZRkdaVPKj235CB05PTeAlrmYHGmhAKhmBpV2eY0J8EFf5
+STAx
 -----END CERTIFICATE-----

rust/pv/tests/assets/cert/fake_root_ca.key

@@ -1,52 +1,52 @@
 -----BEGIN PRIVATE KEY-----
-MIIJQwIBADANBgkqhkiG9w0BAQEFAASCCS0wggkpAgEAAoICAQDK+jIoIZVYyEq7
-ZrxfKv/TQQWCgI5C8BewYkB+/rt8NY0fn/aAZbvJdnDXcQCLpCeETDi7C2hGujnZ
-QN68otr2GpJVQ/kgKnM8yU/p9yBSUan9Zo/195a9YytF6Ys/Yc0HApoPtB3t85NH
-NjAvhzdcBKWMb+/2FiJ61gdnrO/zORnxp/BejxTMyB6r0mhhVX4wwdl5vfkX/qS3
-TL0rajEz0V+SwneDiIomoVJCnco40Km1M20qU5L7EpNHIMEP00hcj40zO0jJ8cGD
-NoKgTHsZPovYfFmWITVOFvaPcKaloUU67dYEg0fv3ypXaYHRszcd794VOWQ85r/m
-lFSSELwoUrVH7G0t6wnzOawW2kk7ZYndbo+Z1ZFb1Ul+iVwUAHzx/ylmOORJNM4J
-GiYyC5+1481MLeB+37+V3TJaBe4IoKqVo/OCBsaPt7x1rMpZLw4gXj3A0Hh8gi0z
-5HDkKolMSawuU8dpFeI0GN+4hJN9DNQh0OTGLEfzeo+1lNzsF+jGT9B0tApWhBq/
-QTyHXvJREVx32hPd/1X6bVbd9mik0bexg6bVpZVNG1sn7GsVO2wq5OWKe3UtSh8w
-JcjGdW38fPAB46oIBQ7x0HGdp/KFiBTWxrexLThMFvYLwPtWedj8ntgOBoH5MJgL
-1XkVYP+1EQYaBJNfswvF4CrvPRCtCwIDAQABAoICABhe0JAvnWYwK4OIouwCQP5f
-pjEJt7WjF2pewZj92LY3GnSbmNXIYTL1J43rzBb4D06RIEFE7gY1QdDV5b2xsqct
-1Y1V60lzZKv9t7yYUVHQ6vS5JbvF4wa7gMHqIoU/ptrv8wjDpXxLwc52W8ljwL/U
-Rv7aScNlhkpH/FJJr0hSqMzHpH1AofdcZ7eq5vbDdF1CSRbsOkYpQCRJ8G86rCGp
-QoJfxZ24p8ME8i18EyrzKA0mLuCQHED3n/tARtiG6P9ECmiw9jJY9n+x7HPL+v5d
-m3N9//ud4m/ieJlhpdXpIQ4hlDqtJdalGB5aqp2U7kndN5rwwxo/fPb1ru8YAfSB
-TK+5ikIn1lfzkiRoTVAmZubXqSSi1xiudqwL28euIDn0f93aiEInHO7Vx2o4vpgQ
-MJ3Hg5XaGygUAR+ZSnQ7lcv4kKMpSeqYuZSRRLs/RZ2Kw3jCYpyQyr1Ii8qH3H9S
-hUqZqUZK4splagRureExDkFrGvo5cBsmMGZqNfG8Ix9imEC4kRhhraIcmziwY2Ca
-mKqGH+sGpcvHX6vmDe7wZb4fo+Mkkacext42t8dtkPT3nEJhsR0xqmcgvyt6yP5t
-y4mv2hGeDEsclpWNfuug0DeOwXjClATZVrP4baL4rGrP6AGFDiRz0PbWmaJwMLDZ
-D+06rj6nO9Ibu/t5tkWRAoIBAQDw2JSTzLEdrkX4cTaHE7pLWY2BQuiIXdYOdXbW
-jkPytSgqHfpTckCDl8UJWMBzo87xDb5Q9Hmsa37Mj5HIz+lGxLPukuhiRUnu/XJQ
-AxzLXBBmdIsb0Rha1kChNASPHXo2Ozi9OsWB9UC65P+U1cGmE882A/Y4p5ak7C+q
-iQk+IRgSqKrLIIHFG0h6Zi0f+DlXMtsNQ7mjDk62WjWzneS/NPwN99VwGacGqI99
-IOhJIKfhpbIXMg2Wo0Xj3HwaHWccK10Va/x8jvjunX9V0px19yCPnMsMWTZ0WN9F
-CRbeD8zCuwasjQkBkqiqMyShk/gs4K6J9TMc5tprB2xB7+f3AoIBAQDXv6WWdsRa
-NuuMrzJ94ZLESUIHBg/u1uGJgvtckpKAm25SnEB2C4d8u09zey0BsXsxBKLJ/HAp
-Nci07/dKkDlmG6+SkVhcIsEAokw2EFWG/+EQJ1Bd2gbX9RXQv3O2sda/2h3QB8Vu
-BUmvK8nwpFaD5eqrIeFxBhao4vHon80Bv1L1F+QVfbjOgV5eS146VU7Gl7b/LuMk
-yx3I4HwWqNbQUGTnVfC6wprae9G1Tamui+PnCPMdVSP972gxMNfhqkt04BN2j2A5
-/Lat2VdL100W2XFzLEQmfD4sAlsJQ/jTcGhDb9Brxlf9kQYt1r+a8igcJQqoz8yr
-1wLabN6FKuaNAoIBAHALwit0ad2uCt1HBiAXPG77jYpaL0XpqcD2QsAUVWYfgzz8
-z01s9LiDreXoRThHN+oLA8QzyDs/kzDlheQPXa5PqonODJBTPc8SV9EDcazl+rc/
-dswNHbB8xnp4cbqG8ykxqfbW1bXc/C02hfSe8UUrKBYwB6dZyAqX2qESuZsO2F0t
-3K89Q0IIrFJNIKcj2sFHZoMoQ7+o01OgaiVSym1t3+k7qC9Lr9m4J3EGEyqaJ6Ah
-btW9snanJMeZ9p5LmYGQZvClWUQ1W3ffC7NIlQOIYbyOLCRliKDeC5jZXqsWXKMn
-UTaLMmpp6U+tFViaNzXhnTGPQiUq/OgX/vQ6AQcCggEBALGJyY+ZyFacnxU0Do68
-E3Rm/GifOnlGZm4sVQCGtPwT66MbZYg+UI357ZWQJSchj8h0kik5DGs9ER6j4ZGA
-QVufKMmpxVZ8WupUo/ZRVrAy3FfYoi+4/Ky1x+/xvBz5F0jlCmdoHbU9sLbvh8v4
-0CDWEFgnF0dUxUzRBFRzO9ZWRMPflxeAT5XPq4JY7v99t8eAjVxMjyp14tqssDBN
-XAgsP/yGIgTto1RrU9SoRhuWjkJOgREAQQ/z9H+WO/A9nL5ermV/8qWFKibBlS6Z
-y5wj71HheWtaDidVAOkNADOuan4kAxTNMRc+QiFyeFXfM9aFPNJRvZEi6/wmXq6i
-8PkCggEBAMK0qSiZ0kBgTqgYhpKqCwEUgEueTC3EloZQ6CHV1vTEfsyM3gEQ2A5r
-8+viQf1RD4UloCWfOF1CA9SqgtXAAIQyGVAATjG7sbUNAK7jac9UdZOS8QSkcJMS
-UIHXndlct/vijnNe/htGCcu+C2KCJz1lfW07DB8WOoyP/5e7es7e0RGjGgGdRdu2
-MyCXJ3lG0heiVUp2d+5R80UAZQdlHuzo9sItxSUbsO639Q1c+Cew/cM6YPxdcTGo
-LWnAsG3yJZgR3pipS9/GqISY725c8QJijYMG3GFUBD6pMCdD46Kl/rfjUsYK3Aoe
-2lXPecP5/ilaLLUhs7SijqHzcKiNL80=
+MIIJRAIBADANBgkqhkiG9w0BAQEFAASCCS4wggkqAgEAAoICAQDgdpk9Tu3dKO1O
+2orgftU2GkgARccHONa/NqnTcqaw5vbgWU8CiC99ejvCz5ER0R3xldjU3uTh2UXg
+QCY2Qf51lsYNx7CgjFVzTaoJ9FhD96mEIYtMWPMoF1SRmxxeGQCJHfMtB3ammatk
+XKV8ia9GlGQFtQU6Mh0CmNZelrvs7zXvYRMfW4oQX1zb9s4n1E+gxErTRw+PlK2L
+mOPO7AAMrrGn2sbxaoqJijMWOysekYZaNfaKkOOzyuXnfa8bcG6qAQWmQX56aUYT
+iwPNtyovFvUancgDg4bP5hD4hEsl2NRSQZQggt663NWKALQBbL6qeJDI+WlAf83T
+bDVV8wGPuwGKE79+ES+TnT0GhhanEJ2J2swm3IcEVuyapEay0NAfoEfuzgyYYere
+keAvqHbvRIxFjR1Hh5QvkGjmmr376E4CkeyXaqjFSl6oXamS0gSVfvnT/jYm9SGV
+FafA38ZGx2iEOMtybwJM+frp5F6DqwRG/dKgJ0W4nW/NE2iB2JJhVR9iaR973d/4
+G5vL5WVFUGv3b6VyZZAPftSzPoqPqGEaKGaHprECPUDQfR1wdLYUuQfqgVnj1sKW
+T8YWNNc+11idVU/hPF3Yu9dSPVaEdYIQiQ0NNqnhneO/IVsOz4xBbh++frq8H16k
+0xqkOJuC6mCZaU4YxWy8SZ7jukyCywIDAQABAoICAEp6X69NjLRo25DiB9mki/dX
+MhPRE1CMpgitSR1NegzRnhHj4Ej9ShCu6bxipgaM5gweheNgD/72Wm6lqmgvbpCy
+1gWFgFBNMB9Bok2KQ21N9HPQs4lCLHBdiWSE3J1GW3yjsOf8hXyTGaED8q8Hel6H
+Z0bTgSgFr8WIU/zvs+xSlQlYIwGxHHcBRW0BD/d8RW2ZJCDFf97K3OioctJaUUvj
+/TOubnt1OAGaFwhl2pFahQNSy3q/x6YFCVLNy7fljvqeuzKmoaJZYvSiGEF+aKNW
+UT6jItYzopxCANiNAOhOcWjXtKAy/FdxZfNT92ZPoFYtChF9XFSX84IW8f2SU64v
+cwOnQg6Ph4S5MflYaNOZuQj97NsffyF0q8pfKelP8D7jsafpgm0EFmj4fbQgkawb
+p2I4bMtrAc07AKAiRR17/oAN61iAamn8ZQO9VtzDeWGfE3xleUPr0425xEzp1s/L
+abvVXXBNHaSwTDNyqPd1cxVUx+651b1QIw1Cf+xqzN8i39WPCFYqNNiB+VO6uuaY
+vh5m0VUVh9M+oSFR01Nn8gpd+CsEmVWj3gCuTRppjvbfhsMhoUUb6Q61R7378FyJ
+ScgCWADT1J2SBcGBOfQUajbv5brVaD9xR049soHK2bxmxm5pLieTFjbqODoQmvfA
+1sKH83L/nE0PtltPSA51AoIBAQD9UYuc/7NBioWEOoIo7JkehKWIJHxXoa89B8mv
+7vNWe+MmBVtq7dUhLSyKIbFebsp8tpAlZmarsSM41dWjfVKA+TKsLIwPBcTidHFF
+JmyhEW2X8xpeB0xHqytLPfQ8ToDh0yqflz/XhY17JGfnhyp8/TzALuOUu+arVS6j
+TvwXN2Bnfnf9fVpyhek2dM7oaSO4yeG+WmPzrqMs2W1QRNnvffLsFsO+wnD33qwl
+5U01APZ3dDyDVtqxtzG8tJuD/a7sqdv7UG51BbGOJ9US502wqTi+Xy2pWjr81KHL
+q9A+nAuTV76BTNGMRASlcT/h8SF6llF8ouCx0zT65Px4T/fvAoIBAQDi1twgQnm+
+i0+4pK722leosBoVKzA+yYy9lRSKjSGA9lKfWVSwxhjx9D4r/uHDl3XrSDQ7qs0z
+e97rhZXI9D++Y7WuUf7YtxYy/EpW9uhPi4PdPfTTD+TFfxtOIVHNVxXA1cW6aTsj
+UoKq2dSjdAcgSFVJWCObx7xwUC3oy61umlKyjeRdctmDGM5pwR4yqospNcCE1lgy
+EwwM/W8clXRSj5mMBGjIhkQHaTX3bbfLAfVbwecYpHzQU8foRE3b21cSOpGHrNmh
+rEBdPKQ4rgFPs2hwkfOxdrPEWah8eOD+ZK3bpIJpLUavpKWlwfg9M33FBHNeXMp5
+MXySIAAjLeblAoIBAQCSDKba8M3P9uZ90yHiKG8rmjy53pdWCuE25buR1Mm1Th4r
+eKE5aEAeLaZlSYGyuVvDRZqcBYsiaDGvfhH7fbDIrWRawiBKNQBLs+jufnXY82xl
+VAMavUhsdbKzYdfjwTsreA02EAT95IEqw1WotlR31aVmBGKwCRm4JJeMDmjnlcTe
+Rps1qkUwjCZmgDge5Sd0Tej6T7Ea+NAZdo5A3kFshAg/t+xJml95eYd1HdxCt/hh
+7MFK1BOorL9fVh3nnqZwyooLPldA3vR8ylhd2r//H8GYeNWhs2UZChryi2+3+U3v
+OIKcl8alAT5QiJfVU6oCvJHksx+rRuNf2A/76dc/AoIBAQCDwIoQTqwJqT6/nx9k
+j4MUnlw36WLXRRdy0dEhfEF2dxucJDWViynX9qXZxev5P9KkusZj1ZvkCFF8+JT8
+KCmR+rX+ru9Xjlfdez3ubvCVqxIHAcJeiL+2mlIQujeaDbe7zi5PTGml5XmxpF3m
+JjExZfHrbL8Z7xQbI+bWbN6p/AaGYPW/9UIy68iQEjPo97dmUysjvJ9zTi7UqKrN
+rlzmyzNC6Ri3R4zhxREsSlTTG6sYBXKllHxOQCs/U9TpGufi1ZPLevDY/4RO4zb7
+GM34Lds+bvddHvXg2LaMvWTpPS7iARYh4sNIp1fzA8ucOHkXYrNjnn+Xjs+sy9to
+k3OlAoIBAQDahnpOqeMkP/veEOzVcq6HDcwsA+DoPqBTTcLcR9DTBDzsCwKgpF46
+3K9S1IUZASSJ5q3QbVhXoUbfm68zr6l9HSsQhWRe/L3/aJUbGnIodPdfzXLplhNb
+XTTdmGgx/LZNFpr7UN08GSKsf6ane89QDTREXK/JogS/aFZ97Cda9gmL3u6SbVDi
+JGLM2msgbDws/z+5WFbCzbgMiYkdtkpw8okh/lRZeEsBm+pEzBsze/bF9glabYMr
+xRJDVuT8hR6C1si5mbx9GAoYyyFktkg8sFyZLalQLKfEHgBLnlt1br1B2/6S1+s9
+DFiJLuJwaQVArPexRziXnDrbb0bQkBe2
 -----END PRIVATE KEY-----

rust/pv/tests/assets/cert/fake_root_ca_valid.crl

@@ -3,18 +3,18 @@ MIIDPjCCASYCAQEwDQYJKoZIhvcNAQENBQAwgbUxCzAJBgNVBAYTAlVTMTQwMgYD
 VQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9u
 MTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFsIEJ1c2luZXNzIE1hY2hpbmVzIENvcnBv
 cmF0aW9uMREwDwYDVQQIDAhOZXcgWW9yazEPMA0GA1UEBwwGQXJtb25rMRYwFAYD
-VQQLDA1JQk0gWiBSb290IENBFw0yNDAzMTExNTUyMzhaGA8yMzg4MTIyMzE1NTIz
-OFowFTATAgIBTRcNMjQwMzIwMTU1MjM4WqAjMCEwHwYDVR0jBBgwFoAU1p7a8iaQ
-sGamSdR9585yWIW36CowDQYJKoZIhvcNAQENBQADggIBAMcBN8PztJELdCo6fQvw
-C9ZU41AmBZsMdIoacgacupt94gHf8SAO1Ric46j3KERpA0mWKAx6RH1s3OX2qN/C
-YSrVPIZ076Cn9EMVdK9w9hqt6SYHoot9CwPutF6BBG5O2uN6eAsEM21B5Tr6xTZ/
-SUj3fO3+QsePDL84BRfU5vtZcGj1BkULopWwibG82ayEUlbY3J8OPjK5YKuHtxJd
-lI4yfkmrEPwHEm8bwI6lhaIxrtTjoVgoolw+FqtVdVdU6O254AUKwxN88bHoA/sk
-BOr13AoHXiKEBaEJhocTLJRfvUZVRYGll43ELsy60XEH51W27/uULnC92vBkp4Q1
-5hPwSD0RHKfMwsLKqoJaWX1CxfdttapCfriehMXJlv46GPmq6cLIEbbHzJKsyJhN
-4mW8Uiwn1aM5EhMauSLuuwNp8QRo4rmQzUstxwn4O/3HzTcjVWbn0XvBXa2S5HtD
-2kyWwN/qck1N9aXYk/sf2A2py2ECDuXc/Kvh1kDi6ZSaKA0VSS1FX62HvdqZKQb5
-ZmyoQUpg8yv0hholaZd9Jye0pwww/K8CFddsyUMRYDSj0+qiw4pgx6KK3ElKnHeH
-uq+iLxDLWTqrWQw6k0I92B9gSlNKR3Z6Zq2UTxo6hB7IYgZv5nxx3BRxnTm6aH6a
-pIoxgnFnbNnyUIRAkOCHbFqy
+VQQLDA1JQk0gWiBSb290IENBFw0yNjA2MjIxMDQ3NDZaGA8yMzkxMDQwNTEwNDc0
+NlowFTATAgIBTRcNMjYwNzAxMTA0NzQ2WqAjMCEwHwYDVR0jBBgwFoAUIlsT6zAF
+eYbpsFsGeGMQDoofNl4wDQYJKoZIhvcNAQENBQADggIBACnVIJGdrqX0b2vUQ9Oc
+DTfN6KMlmt5mKD9c7c24OPOVo7y1lGEGcanGsZ8/0mZ7G5dIqWU0yxXnMD1U3cbm
+nKGHkor/gyvP6hdozFUWIc5EVebDJvnIfj4L0kEVFE+wUO3iqtNnbQjvBo90iq9W
+j+TTD+QQAMGKQyi3AwEL6nVrOZiUwjaJCdaV41zXxn7hiyfN89T4xM/f1TnRZ+xw
+5ELqGN77PBWaEWf3XyLIbxt/2xJL03zmV8cEHmdPG37i/p82mcYxqkwRlU6iCJeQ
+CQ39GNQd9avGm5+cUchAmdZf+tQLVcKsKqjZ7Cq0yihxKoYwOngeOZswF3NueGIP
+jXi3jnA8f0vr1uDilleYkIs5At9IAMq2oA8czKelcIIqQLiTaj03m6u0ehb4VWmA
+T9LWR6RtuBS0d2Lx8cYapzU0tnnU9mOemixljqLqnURmhfI2yRuh9f2FuzD2n5Pv
+H4WHpc2a2Uoz4ub+v93j1ZScDCb+xTmOJ6HfJ2V6A8FYIaD21X1n8n4yc+WeV4Ta
+aBqoWI3TihzwJGvc67Zjfdkt7KhUZ6heJZHRrPVKWbDIVL7NVFnx53ANkOZ18pWt
+IzJb2xWQlP3u9e1JX4yqVw75woZxQKE3v60F0UGofamRB375lGDYrsufD5Sz1XOl
+Cwl/78PBFBOkcvgVCubeR9cU
 -----END X509 CRL-----

rust/pv/tests/assets/cert/gen/create_certs.py

@@ -12,7 +12,7 @@ from cryptography.x509.oid import NameOID
 ONE_DAY = datetime.timedelta(1, 0, 0)
 
 
-def createEcKeyPair(curve=ec.SECP521R1):
+def createEcKeyPair(curve=ec.SECP521R1()):
     return ec.generate_private_key(curve=curve, backend=default_backend())
 
 
@@ -72,8 +72,8 @@ def createCert(
     pub_key=None,
 ):
     sha = hashes.SHA256
-    not_before = not_before or datetime.datetime.utcnow()
-    not_after = not_after or datetime.datetime.utcnow() + datetime.timedelta(
+    not_before = not_before or datetime.datetime.now(datetime.UTC)
+    not_after = not_after or datetime.datetime.now(datetime.UTC) + datetime.timedelta(
         days=365 * 365
     )
     crl_dp = None
@@ -216,7 +216,7 @@ def getPrivKey(path, create_priv_key):
 
 
 if __name__ == "__main__":
-    MOCKUP_CRL_DIST = ""
+    MOCKUP_CRL_DIST = "http://"
 
     # create root CA
     root_ca_subject = x509.Name(

rust/pv/tests/assets/cert/host.crt

@@ -1,29 +1,29 @@
 -----BEGIN CERTIFICATE-----
-MIIE+DCCAuCgAwIBAgIUBSLhuGTvxPbggG70ISL2R6DDGZcwDQYJKoZIhvcNAQEN
+MIIE/zCCAuegAwIBAgIURQZKxfTuf0H43V0uJcBaFGTxwfMwDQYJKoZIhvcNAQEN
 BQAwgcwxCzAJBgNVBAYTAlVTMTQwMgYDVQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2lu
 ZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFs
 IEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMREwDwYDVQQIDAhOZXcgWW9y
 azEVMBMGA1UEBwwMUG91Z2hrZWVwc2llMScwJQYDVQQLDB5JQk0gWiBIb3N0IEtl
-eSBTaWduaW5nIFNlcnZpY2UwIBcNMjQwMzIxMTQ1MjM5WhgPMjM4ODEyMjMxNDUy
-MzlaMIG2MQswCQYDVQQGEwJVUzE0MDIGA1UECgwrSW50ZXJuYXRpb25hbCBCdXNp
+eSBTaWduaW5nIFNlcnZpY2UwIBcNMjYwNzAyMDg0NzQ4WhgPMjM5MTA0MDUwODQ3
+NDhaMIG2MQswCQYDVQQGEwJVUzE0MDIGA1UECgwrSW50ZXJuYXRpb25hbCBCdXNp
 bmVzcyBNYWNoaW5lcyBDb3Jwb3JhdGlvbjE0MDIGA1UEAwwrSW50ZXJuYXRpb25h
 bCBCdXNpbmVzcyBNYWNoaW5lcyBDb3Jwb3JhdGlvbjERMA8GA1UECAwITmV3IFlv
 cmsxDzANBgNVBAcMBkFybW9uazEXMBUGA1UECwwOSUJNIFogSG9zdCBLZXkwgZsw
-EAYHKoZIzj0CAQYFK4EEACMDgYYABAHGO0MnpQa6Q2IxgqV7AGwd3OwBnYOJjYJF
-hzrwY+wQacmJjWeNyHahBCxu4bM8vDr70SF5vZFrWpcWpc9JTY5AagFCFDqIfSvL
-J6lKJuCog5RfMsWJpG2j/MnK7MxG+Ph0R+ItmLFbWFxCV5YOT43olhwYZr/pd9qH
-PAD96UEDM8JanKNsMGowGAYDVR0fBBEwDzANoAugCYYHaWJtLmNybDAOBgNVHQ8B
-Af8EBAMCAwgwHwYDVR0jBBgwFoAUw4weXbTWAZisD86gZSugZ6V1FNkwHQYDVR0O
-BBYEFL4m5UxVbUdEl9yg4sjiWKO/EAxyMA0GCSqGSIb3DQEBDQUAA4ICAQBwaPG5
-Mg3iKtxR6ncteH+YmtMHW4/wB/341pTKFsKBYsMNWuCC5AKbNrshCNbFbctqhLrB
-LmEpmza3/Pk6izO4AozHNl0tRec/HnQr2gonfI48HBDRiV2f40x0gJG9gGCiJy7o
-6iKZDYUnjfnhXVC67RwLMEiIKbeOAWQ9hHqegUjYdaaIlhyiHLMuWMceidvG76nN
-2eyJUNEouT4+UvquD2oqSitB3ZLhWRqPOQn57ME1b0QYF240PN8r21YtzPmSI+s/
-ej04EcQZrlJId6GtU7YwD1767hVw84v/QjPbMqnYQbxX8n3IvOf541rQ0UdjBFc9
-UhbnSn32IGFrRlL1y3MPBF6hLPcpW4P0QrUijc6gZ+x6SNFho8n+dk53F7RvMi1l
-SLgJl7x8pUeqBn5QKMcYYsZG39oZmQj4xHjAABx2hRWayDscvROiQpvLHRtLVmk7
-+hq4Q/jalc2cNHZSwLX6Tv5P+8waTnXg8YNEHeAAgcw1lD+uw5HgusjGD4USE7Hq
-Q6EDGzC+Ny3u2+35XWbNaKWVthtKAIcZ9B4LjdJXeQFGcOMr6yV5rKfOFQwXo8bS
-rNy57tiva8KM2weSfRil4f146Rsb3TJzUdlkaN+NVIY0YImiC+rR0qa6Iv6JCio1
-F2lu8m/aRHQQF5J5fD7ge6v7F2D6K3qT9tTlrw==
+EAYHKoZIzj0CAQYFK4EEACMDgYYABADmnrO8fwhFRmvTAeT91LiGJatTUNRhTr+S
+Pf9glpJGFemv1amiV89qBYij6IuYJDhSYAQNllegWfntvzDbCOhDvAH0SY9Ivhd7
+7nA20M0Z9FuUNaFBRAkUB8VhVPC+lMM7i/0QA3FCWQEP1V28oXSyIOO7SF77GAb8
+U8dobSvrGtb7dKNzMHEwHwYDVR0fBBgwFjAUoBKgEIYOaHR0cDovL2libS5jcmww
+DgYDVR0PAQH/BAQDAgMIMB8GA1UdIwQYMBaAFP4r9a6YMGLiFEhK51N4O3+mmIbt
+MB0GA1UdDgQWBBTLpumJYUrj5XZpdF8A3HUH8Iz3yjANBgkqhkiG9w0BAQ0FAAOC
+AgEAPoZhxpmjEf2mv+Gqwt0z0yG/J3/R2UVO5tHw5L/WWgr8zKWtdVPca9fIFFiT
+bRam+m59hDVZ1nIg0SGmxEfsdJmxfk2h3cI9IJDF3CfELKmfUaVISL1zykdSBzIG
+J4PO3WmUo3W/F41OzaRiSqY4I+8gOXwZmX4bTAFFNYQ9KI9JEJbY5ZM7oKd9Ts57
+lPDWgKf9luN3Teuw+8tj+3G3lzfZ8hO7RThNLi2qr8t0VPecps7ZwNLR+AXLs0F8
+Olx3IIhe7REHZnMqTaVJVlHPUi4REpoI7A3jT6S8AnNsEVjxsIbmJtwJEwwlVMU2
+E3e046RhNUqyHY5ahBPrgBUVadO0/b8QDW+vLAwbm5yr6E//h7Ygit8grA2l2LtS
+vuMEOnsLec1vTcDaeTtDpDJePP6naAc/ZXM+N1riebOYleKlsCylSAEZsoHT0unu
+jRCSTtr5YlWHIP7cQbn9YS8gmvMFU+M+0iNsKqs85o3hbcqchRm8DcLGiDD+FC4k
+2soTE2K3OaVsfYvfxUcA8vvGOeO13gZplpdL0iw+r1aMm7jhiljf6buF8ZwvsAVC
+o1N7uHuOr7Z3hONSbw4GWHFkWy82SIlbM3xNL3geDl7TX3VZFR4OTeIXSskuVOSg
+tLwBY1/RM2ZkDnraxi0XDfNJZRiFK4WVZz/tJSGgrF0YT4M=
 -----END CERTIFICATE-----

rust/pv/tests/assets/cert/host.key

@@ -1,8 +1,8 @@
 -----BEGIN PRIVATE KEY-----
-MIHuAgEAMBAGByqGSM49AgEGBSuBBAAjBIHWMIHTAgEBBEIA8rPNC6rxZR+GxSxb
-qWRreFGnWRQGd22nHWKAvQmrA5GlXTtWQMoL8il9Jb1OnrQPPo620nQpzA1GXo4U
-BUqgYoShgYkDgYYABAHGO0MnpQa6Q2IxgqV7AGwd3OwBnYOJjYJFhzrwY+wQacmJ
-jWeNyHahBCxu4bM8vDr70SF5vZFrWpcWpc9JTY5AagFCFDqIfSvLJ6lKJuCog5Rf
-MsWJpG2j/MnK7MxG+Ph0R+ItmLFbWFxCV5YOT43olhwYZr/pd9qHPAD96UEDM8Ja
-nA==
+MIHuAgEAMBAGByqGSM49AgEGBSuBBAAjBIHWMIHTAgEBBEIA0FE54XL97lOXcJa0
+hM+jtHL3zaUQ1up5GOlzcU/4YJ1zGvyXuhOPoC0+tO+Tm6FyVpr5kuYvnix+ixRP
+Kbq0q6ihgYkDgYYABADmnrO8fwhFRmvTAeT91LiGJatTUNRhTr+SPf9glpJGFemv
+1amiV89qBYij6IuYJDhSYAQNllegWfntvzDbCOhDvAH0SY9Ivhd77nA20M0Z9FuU
+NaFBRAkUB8VhVPC+lMM7i/0QA3FCWQEP1V28oXSyIOO7SF77GAb8U8dobSvrGtb7
+dA==
 -----END PRIVATE KEY-----

rust/pv/tests/assets/cert/host2.crt

@@ -1,29 +1,29 @@
 -----BEGIN CERTIFICATE-----
-MIIE+DCCAuCgAwIBAgIUC3KzCH9KUb8ZaY6J/97gqebLoIYwDQYJKoZIhvcNAQEN
+MIIE/zCCAuegAwIBAgIUZ2LzT6AgSHsm2Y0wV0byf4dkroswDQYJKoZIhvcNAQEN
 BQAwgcwxCzAJBgNVBAYTAlVTMTQwMgYDVQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2lu
 ZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFs
 IEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMREwDwYDVQQIDAhOZXcgWW9y
 azEVMBMGA1UEBwwMUG91Z2hrZWVwc2llMScwJQYDVQQLDB5JQk0gWiBIb3N0IEtl
-eSBTaWduaW5nIFNlcnZpY2UwIBcNMjQwMzIxMTQ1MjM5WhgPMjM4ODEyMjMxNDUy
-MzlaMIG2MQswCQYDVQQGEwJVUzE0MDIGA1UECgwrSW50ZXJuYXRpb25hbCBCdXNp
+eSBTaWduaW5nIFNlcnZpY2UwIBcNMjYwNzAyMDg0NzQ4WhgPMjM5MTA0MDUwODQ3
+NDhaMIG2MQswCQYDVQQGEwJVUzE0MDIGA1UECgwrSW50ZXJuYXRpb25hbCBCdXNp
 bmVzcyBNYWNoaW5lcyBDb3Jwb3JhdGlvbjE0MDIGA1UEAwwrSW50ZXJuYXRpb25h
 bCBCdXNpbmVzcyBNYWNoaW5lcyBDb3Jwb3JhdGlvbjERMA8GA1UECAwITmV3IFlv
 cmsxDzANBgNVBAcMBkFybW9uazEXMBUGA1UECwwOSUJNIFogSG9zdCBLZXkwgZsw
-EAYHKoZIzj0CAQYFK4EEACMDgYYABAE3KDrdCdVeBV34NicA8AoP7hItcwxgXHOQ
-F+V02N6b5AR7w3YDHE/JSzSoZZIYiqdy8SmeD5GtwHLV8tLQ8xnadgHT0BesGS02
-w0H5foGzzZOHZW3AfbdH4MpssR4Bf1jqL0jw6eV+oiMStDuZ44zri7PFjvVByt6M
-oeSvh5qAXCQG/6NsMGowGAYDVR0fBBEwDzANoAugCYYHaWJtLmNybDAOBgNVHQ8B
-Af8EBAMCAwgwHwYDVR0jBBgwFoAUw4weXbTWAZisD86gZSugZ6V1FNkwHQYDVR0O
-BBYEFL8FyjCu1iRcjwx4pzfo+VIQ5NdbMA0GCSqGSIb3DQEBDQUAA4ICAQASxSXu
-RxNw/kSwqedNq9jOTHb5FATNykBIVSuXS9BB2qkjcTVDXNnlsSBrPL/CumRp/TFD
-5VsB2rLhESmUrpghQrODeFvyFE52yVhxvcNCyjz7yIQZvc4qofMQMsg3o0rSqp2s
-lu1PUbcrL2aCG1yxB3isObVqiWaiRdnPxL8aX3Qt6BszlwWUgaFoaH0uZxlgVGKV
-C+dXrn5WkNRVd2ouHSLQE6fIUYIf/TrV+AKu804IEoFRIvMUCqQRUHsj5toKhfDb
-6tl/Xd+EiPCYbnhR2J01I08yxMExvYXfXapY7JJjlWTHKFKaxLoqv++NZRM1bW6s
-uyLWP735Qb+0AmhZ6TfeJM7H77LpQK0WCylaNVJWWjXt9UsnNdirCbp/jpKF8bnG
-2PkjBHKruvCakqw1bDq8eDv9In1Ki+Um4gp7OfjYvcN8zxvGQofgj++UaCy982iX
-WSq14iUyrRDVu8zWghL/F1lUx7ab8UV+OrmZuCALVHZ76YVdwmJXGYll1OBbJbgL
-5xze6p77vKzbgNyABWmR6TlHq/nFDhj9kKirpQaI7WHyOtsGpc7sqd0tT+CeOhNf
-l3xXyFPb6N58aSC2cY0W0Nq6X/mWIgMqHY9lzYLmoLBFFZlIjqWzwyVcajmjrtaK
-rlfs0e9f9DvVV8bMTXFMUBlWrmYDrROKpYLqhg==
+EAYHKoZIzj0CAQYFK4EEACMDgYYABAE69tLPv1D4DIFTgQo+P57ZABDoxe6x5Rjy
++NYiRi/Nfir11CxVGQDaYDfUFsb4peQJz6haxqXfXmm4MWlIbdWa1gHMf3GQl/xt
+IGGbJURxnBIR3rj2pqd0DqbONj8blnQTCWLSHsLsgyI6WWK4RHd9ZtER0UQDxoQc
+c8Htsuh1+SKo6qNzMHEwHwYDVR0fBBgwFjAUoBKgEIYOaHR0cDovL2libS5jcmww
+DgYDVR0PAQH/BAQDAgMIMB8GA1UdIwQYMBaAFP4r9a6YMGLiFEhK51N4O3+mmIbt
+MB0GA1UdDgQWBBTjTQZrKFQ5geqc4+9zl31SO5w4DTANBgkqhkiG9w0BAQ0FAAOC
+AgEAFvvK0+jphYgn93vZDB06EG7wH4EsEe6dDmG8E2N+SCbjWigTYElemKOl5ION
+i3G1Wluc2SEN2gHX4MRnHQNE7bxUAX8IhbKNW0+xcQX3BOT/mPbWsrrHkvkBTzO0
+wQPIUVtGjRe1igL4b/Pv29fWsphOjHm1ZyqIr9V5Qk0hhOWsQ8i4zspTks0OGSml
+OPIY4iB/DyvUWcwsI5ZhdyK1l0ZKKS8zxWWKT4BgRtR4WGFUArkb+7fWYpIl91CE
+xE+TVTIhjuTyajZG1/wPtzI3TrQPjB5LKv5OvqroLMamuMeQG+CydFEOUb7z05Zk
+f4PU6ryvB2hPAwnzqKtf+TNWimiuqPM06pEZRSpUKcoXzJiNIweICkoOllQDrx4m
+g5pvjVT23FeDuEQWLiB9XMFmx46Thv1AGkP+gKbaLIjkxrfWEomEoY6/6VDeFjFl
+FxEYSvnazQ5K5tBQ2rA46OvpdpbIifI+x1aaP45snKQ/wvoeRfXySV9B5S/ESzrM
+xVgAY++/lteSzvUJaC+ZVKkvjIIznxNHnHG8GrFKPFZqoUS10zGKiYve9yXQITK2
+n32heLzy+SM4Qcso43f+3n0R0KrdjOn3peXakfNEFaGkJQvMdeYQpZkALDHXpbGi
+TA4C4qSTGP89TrEpGWpuAKuMHP5Vqf7y/EDr8Y4xP1TPRFo=
 -----END CERTIFICATE-----

rust/pv/tests/assets/cert/host2.key

@@ -1,8 +1,8 @@
 -----BEGIN PRIVATE KEY-----
-MIHuAgEAMBAGByqGSM49AgEGBSuBBAAjBIHWMIHTAgEBBEIAQNfN5BLLLAdhlwGk
-Ve8w2t+9x4LWR9st6CLCYHnTgc2gr4+HqgcMwmNuj3cA8ENBvIShUnHkX2E+9CyP
-3W1ZN8OhgYkDgYYABAE3KDrdCdVeBV34NicA8AoP7hItcwxgXHOQF+V02N6b5AR7
-w3YDHE/JSzSoZZIYiqdy8SmeD5GtwHLV8tLQ8xnadgHT0BesGS02w0H5foGzzZOH
-ZW3AfbdH4MpssR4Bf1jqL0jw6eV+oiMStDuZ44zri7PFjvVByt6MoeSvh5qAXCQG
-/w==
+MIHuAgEAMBAGByqGSM49AgEGBSuBBAAjBIHWMIHTAgEBBEIBLVCOgktjIJCL3ZpC
+vX2xQjXVWPiWaWxbx9OGPQArsCwbAtJ+Oa7TDaJRRi0EHEJIs72ZPhozNRYppQoe
+IQPiqWyhgYkDgYYABAE69tLPv1D4DIFTgQo+P57ZABDoxe6x5Rjy+NYiRi/Nfir1
+1CxVGQDaYDfUFsb4peQJz6haxqXfXmm4MWlIbdWa1gHMf3GQl/xtIGGbJURxnBIR
+3rj2pqd0DqbONj8blnQTCWLSHsLsgyI6WWK4RHd9ZtER0UQDxoQcc8Htsuh1+SKo
+6g==
 -----END PRIVATE KEY-----

rust/pv/tests/assets/cert/host_armonk.crt

@@ -1,29 +1,29 @@
 -----BEGIN CERTIFICATE-----
-MIIE+TCCAuGgAwIBAgIUWlKUd1HKU8R7cjv5NJdWhHzhT5cwDQYJKoZIhvcNAQEN
+MIIFADCCAuigAwIBAgIUU+2QY0/U0dID7GqyyHWsrN6astkwDQYJKoZIhvcNAQEN
 BQAwgcYxCzAJBgNVBAYTAlVTMTQwMgYDVQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2lu
 ZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFs
 IEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMREwDwYDVQQIDAhOZXcgWW9y
 azEPMA0GA1UEBwwGQXJtb25rMScwJQYDVQQLDB5JQk0gWiBIb3N0IEtleSBTaWdu
-aW5nIFNlcnZpY2UwIBcNMjQwMzIxMTQ1MjM5WhgPMjM4ODEyMjMxNDUyMzlaMIG2
+aW5nIFNlcnZpY2UwIBcNMjYwNzAyMDg0NzQ4WhgPMjM5MTA0MDUwODQ3NDhaMIG2
 MQswCQYDVQQGEwJVUzE0MDIGA1UECgwrSW50ZXJuYXRpb25hbCBCdXNpbmVzcyBN
 YWNoaW5lcyBDb3Jwb3JhdGlvbjE0MDIGA1UEAwwrSW50ZXJuYXRpb25hbCBCdXNp
 bmVzcyBNYWNoaW5lcyBDb3Jwb3JhdGlvbjERMA8GA1UECAwITmV3IFlvcmsxDzAN
 BgNVBAcMBkFybW9uazEXMBUGA1UECwwOSUJNIFogSG9zdCBLZXkwgZswEAYHKoZI
-zj0CAQYFK4EEACMDgYYABAHGO0MnpQa6Q2IxgqV7AGwd3OwBnYOJjYJFhzrwY+wQ
-acmJjWeNyHahBCxu4bM8vDr70SF5vZFrWpcWpc9JTY5AagFCFDqIfSvLJ6lKJuCo
-g5RfMsWJpG2j/MnK7MxG+Ph0R+ItmLFbWFxCV5YOT43olhwYZr/pd9qHPAD96UED
-M8JanKNzMHEwHwYDVR0fBBgwFjAUoBKgEIYOaWJtX2FybW9uay5jcmwwDgYDVR0P
-AQH/BAQDAgMIMB8GA1UdIwQYMBaAFMOMHl201gGYrA/OoGUroGeldRTZMB0GA1Ud
-DgQWBBS+JuVMVW1HRJfcoOLI4lijvxAMcjANBgkqhkiG9w0BAQ0FAAOCAgEACPbD
-hFuibNamlcpnVG7mgnO56RB/K5otOCGS0hbR3OFUGY1ZDQ++M44OF/b+eNYHgjsr
-ER4r2cne3qBjOArFj/toEDGM2l/DFWDnpOvh1ZItJjpQe07OGn+KpTLf/ZB0Q5D7
-jV/ddjJ0GGyxessjfUvmCT4BVWn1bXKJFSgujic7lgMf8WBGwW+WW3eZecYsh/Cn
-rHWfQYqtvzB1uM89bwZwN+lvHz/QHTreAShDAiCY9M31cemvUvC58z8jPKngFhuf
-C7ZMUXbzu2jYWo3EowzvcRpO1KqlLfNHjGLbaBaZWP2ocK2IUTrsAbr7PTdcAqjX
-TRIds4JlbidA8OziEXFTcM2xShS6WISsO+9JXk5Xxc3+xscjSamHTMwRm2LaKjrr
-d8mOxMs4/5547CBsBFMqu98tiD18K0yqdJiJJRDDOvqVeCvDE6y/pzKaSHIIyA0P
-ATnjQzvgqbcwLrdoJ4WNdTpZieoisUR0oMAKUViPwd0xStzNX6K89PSd5c0Bqbhj
-TwCpaT+DfcvlWk4wqEa9rLn+Su1SUfMSD2dITynLW0UexiKPHZ5epOPu5ho6cOk/
-fe/N1cX7SyOjhErWLwqr974YM0EPiR6f5lNooYXMPbatq8lcG0gpEg5pggHhsLiY
-LGfvu2jQJKGnrBYM3IcRGUsc+VZ6CNTJjaIIbGg=
+zj0CAQYFK4EEACMDgYYABADmnrO8fwhFRmvTAeT91LiGJatTUNRhTr+SPf9glpJG
+Femv1amiV89qBYij6IuYJDhSYAQNllegWfntvzDbCOhDvAH0SY9Ivhd77nA20M0Z
+9FuUNaFBRAkUB8VhVPC+lMM7i/0QA3FCWQEP1V28oXSyIOO7SF77GAb8U8dobSvr
+Gtb7dKN6MHgwJgYDVR0fBB8wHTAboBmgF4YVaHR0cDovL2libV9hcm1vbmsuY3Js
+MA4GA1UdDwEB/wQEAwIDCDAfBgNVHSMEGDAWgBT+K/WumDBi4hRISudTeDt/ppiG
+7TAdBgNVHQ4EFgQUy6bpiWFK4+V2aXRfANx1B/CM98owDQYJKoZIhvcNAQENBQAD
+ggIBACFCebna0DLGqzp3DYY3bdOIuCD5qCfYHxEB0OCMeOsFT3Fev+nDKijJ9vqI
+F9yCKE9ddWNygNZ3GDMFss1GjYcMeCecvy8nr3xiR02V1vLZxjlgd0qwSGUOg+jE
+trumFLoURc4xB6gu9F6vaN6fW7mlYJtOjHLtcKf226WkYYFgsrD0nhzGYosqeFRQ
+JMfLQAmqfCU1z2CwADWK8SVZvAqOY8cdtrXnrvO4fM+lDmx7ZhGeAfChq8bo5EJP
+pSjOjlgZx+m0teCJgmWvRIeq1IM5ntaZ6/BArMxlhUYuA/g9AvW6xnHuFT1yy00z
+DXe1aTjbBS2/jo3Iaow99Qf20bthm9h+kpaNyaBkSgWrZewhYc7TfyWRKQ72x4Ob
+VQ0nzpt5uRSTXv+BGFk8MzDj20pxxa3C6j1skfEp3Us1Z5VJjkXf9v2039bOehEv
+SV2w01sFeuqMLbyiL6eXKIItn/SMy6Vq9muwdr0XUwlyp4Hmwiws9cJC0b7Rie7M
+7TiNLIviCRumV2JM4As6zS4pI/ljBXEaKi16SQnOERNYJx6QzQy8Uv7HKREHXa7P
+12cfpjA4Xw1RhrLpd9B9ZQL7AS52cWiKqNI26pR0pOuf5EEN3oour0byVoYN7FQs
+ypmaGcd2dEJoytW0QnxVrcpjtU4OX6YMFGfkBifsTSNy/lWz
 -----END CERTIFICATE-----

rust/pv/tests/assets/cert/host_crt_expired.crt

@@ -1,29 +1,29 @@
 -----BEGIN CERTIFICATE-----
-MIIE9jCCAt6gAwIBAgIUSpwJMAovpO3Z9SuY7Zw+/pv3bLEwDQYJKoZIhvcNAQEN
+MIIE/TCCAuWgAwIBAgIUJI5RArOzzLAWps20JDkSDSb8YD8wDQYJKoZIhvcNAQEN
 BQAwgcwxCzAJBgNVBAYTAlVTMTQwMgYDVQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2lu
 ZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFs
 IEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMREwDwYDVQQIDAhOZXcgWW9y
 azEVMBMGA1UEBwwMUG91Z2hrZWVwc2llMScwJQYDVQQLDB5JQk0gWiBIb3N0IEtl
-eSBTaWduaW5nIFNlcnZpY2UwHhcNMjIwMzIyMTU1MjM5WhcNMjMwMzIyMTU1MjM5
+eSBTaWduaW5nIFNlcnZpY2UwHhcNMjQwNzAyMTA0NzQ4WhcNMjUwNzAyMTA0NzQ4
 WjCBtjELMAkGA1UEBhMCVVMxNDAyBgNVBAoMK0ludGVybmF0aW9uYWwgQnVzaW5l
 c3MgTWFjaGluZXMgQ29ycG9yYXRpb24xNDAyBgNVBAMMK0ludGVybmF0aW9uYWwg
 QnVzaW5lc3MgTWFjaGluZXMgQ29ycG9yYXRpb24xETAPBgNVBAgMCE5ldyBZb3Jr
 MQ8wDQYDVQQHDAZBcm1vbmsxFzAVBgNVBAsMDklCTSBaIEhvc3QgS2V5MIGbMBAG
-ByqGSM49AgEGBSuBBAAjA4GGAAQBxjtDJ6UGukNiMYKlewBsHdzsAZ2DiY2CRYc6
-8GPsEGnJiY1njch2oQQsbuGzPLw6+9Eheb2Ra1qXFqXPSU2OQGoBQhQ6iH0ryyep
-SibgqIOUXzLFiaRto/zJyuzMRvj4dEfiLZixW1hcQleWDk+N6JYcGGa/6XfahzwA
-/elBAzPCWpyjbDBqMBgGA1UdHwQRMA8wDaALoAmGB2libS5jcmwwDgYDVR0PAQH/
-BAQDAgMIMB8GA1UdIwQYMBaAFMOMHl201gGYrA/OoGUroGeldRTZMB0GA1UdDgQW
-BBS+JuVMVW1HRJfcoOLI4lijvxAMcjANBgkqhkiG9w0BAQ0FAAOCAgEAd9NdTLDK
-fWPdOg78c+CaG2XVnIzBy6niur4vM1DPJYbwabTYbpJM2jtevMo3h96jCd6AfHzv
-cFZ1BzpYsWtjbDFhiqowmKnlFlOIoIDXCaG7vBvDWc4iWGG9PHMWEouSQWxg77bZ
-A8l7+K0VdRWYCqwxxClK8oK3PqGyGqELRDWwlBb0kRi9XRmB+2BjOdZOQvmGka/R
-l8hZWHTs+SPHZ+ySiJn55/w7gN/LCJs1XX70jPrzu01lDPTqVIrGKBtWBMKFKR7g
-A4r3EThfj85Xq1T45rvD0ozlkyVmdMtSk3z+fKCt5+qEHAu52kq2Ps7xQviAYkIK
-f+yNf1a/Ly79QoqEibRXuKMk/oWoqv7f5vT5HqoWEWZFIYbdbYTBIwkw3mHwZRZx
-CcyiukHw2W/ZwM6p60gXWZwrQxwVkdhxWnAHrAToL6O8M9Fk4aVWUkFNjqVUjTWS
-HLCxv8mCPujXIneqXyiJOpAPKu2kjmoFwfisjevNUmO5EqUHUba98Ne7rdiWweP3
-nwcBBKIQ2MVZ/lPqfPtqFOHqBzCbqozVw1HzE2/ImnYsK8SGqwBnSJyTt+WjM/8S
-4ulkjVDIwWFwUkOWjM2yorp3u2tFJF2sMv+3AR3mp6aDjF7sCzYpLaZag6oDmwOF
-nR+VwEbTC8gnl21swWSjtUC8I0EidfxzCpc=
+ByqGSM49AgEGBSuBBAAjA4GGAAQA5p6zvH8IRUZr0wHk/dS4hiWrU1DUYU6/kj3/
+YJaSRhXpr9WpolfPagWIo+iLmCQ4UmAEDZZXoFn57b8w2wjoQ7wB9EmPSL4Xe+5w
+NtDNGfRblDWhQUQJFAfFYVTwvpTDO4v9EANxQlkBD9VdvKF0siDju0he+xgG/FPH
+aG0r6xrW+3SjczBxMB8GA1UdHwQYMBYwFKASoBCGDmh0dHA6Ly9pYm0uY3JsMA4G
+A1UdDwEB/wQEAwIDCDAfBgNVHSMEGDAWgBT+K/WumDBi4hRISudTeDt/ppiG7TAd
+BgNVHQ4EFgQUy6bpiWFK4+V2aXRfANx1B/CM98owDQYJKoZIhvcNAQENBQADggIB
+ABb7ufyi/LVMefLjFCfUpf0iiCuUq81DYKLI5AZ0Gs+Oip0OM0FfADCz2Gyrm1VR
+97wK1DLRJ4fFFEE5EOL+pNVGjMGUAwmhcR1xPAhV2AJ7jD/xYNZmdnFjQE060S1n
+NFOZP9WLyf4jf+aFUTKxpmfRej2Js3WziqRYYEGODmoatIeZtcMc1/IZnxAxntww
+sDl8jFCnnzUPJELMh0ADFBFNUpfnlXKG3W66rMKzKAHAcl96rpWWBOEZ0i/1oGuz
+l1/P8DzlJhqR+VJMeX7Ume9z0/ZUy3Zy4puXAcflrx8r+vH4BDCJsebuEjJAvgHz
+uRor3WgOj+3w3do+pYX0eqaMCCJ15o0X9TWnR89mUqYav7TeHiim06vnpLSgmK19
+1Lvj91l0ua3BSgqWAQe8rwBxvFOg9oC5Kc+GsCPunJb69lUskaS88foA8PZ5c/34
+tSMj3jXcGAXY86qxAfDjejWR+sF7uVW3Fqr/RKJ12TzPYVnwvzvio6BeHey6Eyg/
+4EWHjymQwfPpyIYpKp0nYvE/PfqT46sFtVA74Z3nw/WxDHUmo7l70X+LfU/TYi3+
+qUyomwxSBTuWxUtBcNiTfMk/8yuTv8D38RLdpMUuE9Xbfd4DLO9OSgMLrkJmPvLc
+r8Km9zHV0N5/KA5EyewrPBsClDOwN15bqncbk+RG8hUL
 -----END CERTIFICATE-----

rust/pv/tests/assets/cert/host_invalid_signing_key.crt

@@ -1,29 +1,29 @@
 -----BEGIN CERTIFICATE-----
-MIIFAzCCAuugAwIBAgIUELm+ubD3lNPrFxtCj86wMh7lYEcwDQYJKoZIhvcNAQEN
+MIIFCzCCAvOgAwIBAgIUfBiRwLX9KVgvBmm8F3oCdB+ai2AwDQYJKoZIhvcNAQEN
 BQAwgckxCzAJBgNVBAYTAlVTMTQwMgYDVQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2lu
 ZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFs
 IEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMREwDwYDVQQIDAhOZXcgWW9y
 azEVMBMGA1UEBwwMUG91Z2hrZWVwc2llMSQwIgYDVQQLDBtLZXkgU2lnbmluZyBT
-ZXJ2aWNlIEludmFsaWQwIBcNMjQwMzIxMTQ1MjM5WhgPMjM4ODEyMjMxNDUyMzla
+ZXJ2aWNlIEludmFsaWQwIBcNMjYwNzAyMDg0NzQ4WhgPMjM5MTA0MDUwODQ3NDha
 MIG2MQswCQYDVQQGEwJVUzE0MDIGA1UECgwrSW50ZXJuYXRpb25hbCBCdXNpbmVz
 cyBNYWNoaW5lcyBDb3Jwb3JhdGlvbjE0MDIGA1UEAwwrSW50ZXJuYXRpb25hbCBC
 dXNpbmVzcyBNYWNoaW5lcyBDb3Jwb3JhdGlvbjERMA8GA1UECAwITmV3IFlvcmsx
 DzANBgNVBAcMBkFybW9uazEXMBUGA1UECwwOSUJNIFogSG9zdCBLZXkwgZswEAYH
-KoZIzj0CAQYFK4EEACMDgYYABAB/2mDXj/QP7fcpxLTNfFfuh/X1Y/RS8XK+Y4v+
-0nisTQhe3MK8BZ7D0bcB872s8EJCYZ1OYr5O2epQgv2hbk4T1wCGKe+Pjf2QHTts
-wXMpPf87R3etF+zWR+CYH+5N5uQhjW9Ueeq7wve3A61e+Atz7IzTKVlM29kT0XvI
-sYtazn6usqN6MHgwJgYDVR0fBB8wHTAboBmgF4YVaWJtX3dyb25nX3N1YmplY3Qu
-Y3JsMA4GA1UdDwEB/wQEAwIDCDAfBgNVHSMEGDAWgBTXVfLQH2D0KccIHhK6M5MR
-TITvtDAdBgNVHQ4EFgQUWdGEEpvjFJ4SNUillC09iBfcTEUwDQYJKoZIhvcNAQEN
-BQADggIBACfZ7+KtT0Hl4Y/JBwCtUqCRRt4kCM5rXqORswkJ6RNmx1OtBHPlkUEI
-E5HrE0dZlaECfqMkOBxhbBqOSpoL/xjz1gDHILWXEbWchuFnU4EAgYvJS7nLAHHO
-swJCEP8VDM3y5lUWni8sXs6ro/H5tAkm260+xbn0BFF99l+M124ZUawB+tDg7E9b
-MNG0eWtfeiZzWBBhoxhQoD03gFADWxTU1EK4JgCl7frsj4PjK7TMKTV/Gd/Bd5l0
-KreFW5orupd3YBqDeUYI6p1l9+uThottwrA4z/POygxvhqgoqNA/+evMWX3wxNza
-ComAmWffB5EJQFEKcpdASwEhyjBMap15GdJVBFGYzXAlksQz7k1fr4h0ebuYtcpb
-dvcDyeIxjsg5XiP32494wogLUjHioi5mwIrGn8/9V6JLRGfKBHnmejHBR/cbMpuv
-rpl0ZZks3bicmBVTKFyj1ORRGX1cXsbtCbPBJEmBeR5IOFYBeaQHrqTcaEBz4lWe
-K2OT6ebcqtsCzDSmjsoeAX/CWRVaIzLzMc9SqE8lZ68ajXjbt/59I7EBeOenttO5
-mg9mokwDqoeM0bXyT3qdT4s9fhy0BPgnBqJHKIc9afzV79Iz1uJ/E+TZJ+tzhbAU
-n4fFxIHOdbyaOLCLT0+O74FZCQq8FUUnL9QVY5dXTH2458IUiD20
+KoZIzj0CAQYFK4EEACMDgYYABADRQ0Xq0/NUVMVazLQK2oZ7TbJdL+ZtXeQawN/9
+j70DUpufvfbFLflnfjCD7dWoMGZlAV+pfrIRB3fI4YKvzGWdEwA/PgEDYpxS0onE
+XtdAvveL+3+Bb8f3s68z8+UH+fDtIKZRLen8yDvEua0WpPGPoE8Xga5ZOoAJHWeO
+RVsPGypz36OBgTB/MC0GA1UdHwQmMCQwIqAgoB6GHGh0dHA6Ly9pYm1fd3Jvbmdf
+c3ViamVjdC5jcmwwDgYDVR0PAQH/BAQDAgMIMB8GA1UdIwQYMBaAFGI+YnrDs4Q2
+f3a0zSucoJYGJqYnMB0GA1UdDgQWBBTefgLJvMQh0wA+A1PQV2yFHVV7vTANBgkq
+hkiG9w0BAQ0FAAOCAgEAQflAXs9mWGhK5WXVYzSx44S+C+U6eab3N9NCoYQXOv14
+z96bxRi+J8yB91cZ5Z+Px4gtdzZihNx8fIoGN7aHwNzfBuRhCYxCOGRwN35MnIk5
+sKXpvZ2hVIvM7SQ4HMujJPjfUesKNWXBGTILe+nXf9KIruznd0VcFtbAEkpN0t5v
+z/L7zpWOI6R9lYGgaEzfHn2Bw8lm28rLP0u0QrOfUcJiNcnVvhUfdfHvBLzchOF4
+A3mIO8gl1VRNacxmB9ZqpVML2hck17oXm2wmF8oAsXMPjOBk4uv/DrK5EZufByB3
+yaQaL3gunxBiEQs7vAzxVN3IpoHuXWzeWm39ttgVKDRu2URUhRILS6sK4Xar0Xoi
+CPvf5tOsdkTn2+OzS9iDl5JiHVGkJTVa8qAd/wDZ1Zq2SrECJM8gObp0Aom/JH0z
+/NlJs+W/CCMwDhV4hVyJ/2Io54AaOEeFiLaBtwR/Tgm16B87pAwgRqmWbVUIJbIr
+Vv5hz6s3SS/w/KnjfgzZt/amQnEOLEqFDUCFb1iPPX7yor40nJU99b9GxknuOtzG
+1zMxJj+9OMm3BT+2F2+BYF010uJG4d8CmbOf6nKn8x6QBQN/sUfqk3pMnVdx3Lg4
+BTScZcuPVEZ2hqAHOiVu7U544vALW1HLQCcN7iB2T7DIjIYsY4dhjkgQwezoZ3A=
 -----END CERTIFICATE-----

rust/pv/tests/assets/cert/host_invalid_signing_key.key

@@ -1,8 +1,8 @@
 -----BEGIN PRIVATE KEY-----
-MIHuAgEAMBAGByqGSM49AgEGBSuBBAAjBIHWMIHTAgEBBEIB48Wl8pvlD/o6F7YG
-sFfCXNQRbKbppIrywEBkfNG0VzfXazBOLD41bcdPEBh1111kSYgn46uUVxjabyLp
-BgQthf2hgYkDgYYABAB/2mDXj/QP7fcpxLTNfFfuh/X1Y/RS8XK+Y4v+0nisTQhe
-3MK8BZ7D0bcB872s8EJCYZ1OYr5O2epQgv2hbk4T1wCGKe+Pjf2QHTtswXMpPf87
-R3etF+zWR+CYH+5N5uQhjW9Ueeq7wve3A61e+Atz7IzTKVlM29kT0XvIsYtazn6u
-sg==
+MIHuAgEAMBAGByqGSM49AgEGBSuBBAAjBIHWMIHTAgEBBEIBTCcA3Wwdesq/meh+
+lZDOSRex3E2nJawTEFuCoOCI/6Pqf1jw/LjkfzVcRM85vQ/E+MVH+j3mL28nlYNW
+Mxl8VqOhgYkDgYYABADRQ0Xq0/NUVMVazLQK2oZ7TbJdL+ZtXeQawN/9j70DUpuf
+vfbFLflnfjCD7dWoMGZlAV+pfrIRB3fI4YKvzGWdEwA/PgEDYpxS0onEXtdAvveL
++3+Bb8f3s68z8+UH+fDtIKZRLen8yDvEua0WpPGPoE8Xga5ZOoAJHWeORVsPGypz
+3w==
 -----END PRIVATE KEY-----

rust/pv/tests/assets/cert/host_rev.crt

@@ -1,29 +1,29 @@
 -----BEGIN CERTIFICATE-----
-MIIE+DCCAuCgAwIBAgIUMi8utJhRyr5bbvABnCn/Q9/vJ0kwDQYJKoZIhvcNAQEN
+MIIE/zCCAuegAwIBAgIUCpd1IYj2RH4Kc0Pi6+ZzfdZv7n0wDQYJKoZIhvcNAQEN
 BQAwgcwxCzAJBgNVBAYTAlVTMTQwMgYDVQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2lu
 ZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFs
 IEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMREwDwYDVQQIDAhOZXcgWW9y
 azEVMBMGA1UEBwwMUG91Z2hrZWVwc2llMScwJQYDVQQLDB5JQk0gWiBIb3N0IEtl
-eSBTaWduaW5nIFNlcnZpY2UwIBcNMjQwMzIxMTQ1MjM5WhgPMjM4ODEyMjMxNDUy
-MzlaMIG2MQswCQYDVQQGEwJVUzE0MDIGA1UECgwrSW50ZXJuYXRpb25hbCBCdXNp
+eSBTaWduaW5nIFNlcnZpY2UwIBcNMjYwNzAyMDg0NzQ4WhgPMjM5MTA0MDUwODQ3
+NDhaMIG2MQswCQYDVQQGEwJVUzE0MDIGA1UECgwrSW50ZXJuYXRpb25hbCBCdXNp
 bmVzcyBNYWNoaW5lcyBDb3Jwb3JhdGlvbjE0MDIGA1UEAwwrSW50ZXJuYXRpb25h
 bCBCdXNpbmVzcyBNYWNoaW5lcyBDb3Jwb3JhdGlvbjERMA8GA1UECAwITmV3IFlv
 cmsxDzANBgNVBAcMBkFybW9uazEXMBUGA1UECwwOSUJNIFogSG9zdCBLZXkwgZsw
-EAYHKoZIzj0CAQYFK4EEACMDgYYABAHkrwf4hZ7M5ahoYHT0u1Xgl28qxURcdNmW
-kYDA5u1Y2mGXQq85BakAOyfxl/FF/cBrLm0eLVFpePumqgPna3El1gAs9p2SFwN7
-4MmcLhbwPmGnWmzVrOh9cNS988XYf01E74966r4MKpAGxSNPKDwu4doXFVAYRH/w
-tcgbjlk+Qi3c96NsMGowGAYDVR0fBBEwDzANoAugCYYHaWJtLmNybDAOBgNVHQ8B
-Af8EBAMCAwgwHwYDVR0jBBgwFoAUw4weXbTWAZisD86gZSugZ6V1FNkwHQYDVR0O
-BBYEFG+41urs6GhYzOrJD/MJDWMSrUlvMA0GCSqGSIb3DQEBDQUAA4ICAQAnowYb
-R1qgnpH5FLgkj3LndAAfFmJMlTrNcmtafjaLZHUmxxO1tFjb7vvGgu9LggwwSRoN
-y0Qsu0mywXd/ntEuWDyD735aGtUE9xnmluoj4ILBnln195VuvUoWYjCy0XsGZg6G
-UL8bOaZgbvXQWDcdXfpYnM9C5Uj4mB3LFDdasd7nDv2F9vZlHNkd0uGmZvBco3SX
-GNFETOaY5HjU3jLlCmD74p7G9e//+153R2aXEww3SVVJyRowO7SpwH88DNjl2a6A
-OLWoA3oRrX4rDQI66LYv0RZMDCTvzY+HxOQHXeswosA8D96GhpClb1X0wLZUp6gR
-pLzVzaE8RFnSg52jzjI3ehFIoSK0x9R1KPzKbYDh7Q8Sc5sOSe6r9Q01BdpBOUjp
-iTKhgbUEbcIwcaKLIGeSBe0+Yh1uQpqBtOPectUp9bz+hEUDzG6QMS5VFxAGuZWY
-2iA97jxHsUBEgMBZha7z/hQ68Pst+KaIV/24By8lKm0rWpLSKOXVAW1lWZrlpIcx
-Le8+dmy9/JFJXmmN/pmAEVVsK5dYtVXt6ikVi+LPr/7fCfvt2zk88wiUp8iz5jgQ
-pNYT8MPOMf+yzzoqPXjGmrT5znuHnCg0OSh0u8NILWQPQl8M6KNiI8lzcVBy6Djq
-fmnQlaxP1Ey+wrznWmBu5zesU8uMyRTxIfnEzg==
+EAYHKoZIzj0CAQYFK4EEACMDgYYABAFOncuQfjViGAC/g8Nt6B+11h18++MD1+bO
+LgZwk94C5u8gntb0I20QqeMFFuqmNMouFk6amimv64J6dNnaFXVh/QHOTTjZugyt
+p2WB2SpySjRIbtOsG3HFrAeSDJNr+a87NcMzq+s6aRdv5krVrKcSkpQrPnxVYV2Y
+oc1zEdsEyw6M0aNzMHEwHwYDVR0fBBgwFjAUoBKgEIYOaHR0cDovL2libS5jcmww
+DgYDVR0PAQH/BAQDAgMIMB8GA1UdIwQYMBaAFP4r9a6YMGLiFEhK51N4O3+mmIbt
+MB0GA1UdDgQWBBRSJBCuVdARV15CwCDKg4XUkfQfITANBgkqhkiG9w0BAQ0FAAOC
+AgEALhMxuxt6kmvhBUVbxkwBS+6W19SOPhyIGbgWpiZabF2WcapQUYDwWqovswZ6
+YIR1H19rEThXUArpMUy2PFk89zum1WLdK5j3URNRptyCFOTP+485fIpkPnDURIQ7
+PWcTAL1pPmVZpXyNWem+Yolwmkt8vA5tGAopnbp5gcvoN+bfiDr7kwOUd958p2yr
+xwDqaRBxzYCniLV38wrcVVMK0fWS7L8SmV0cprh4FBhsDdLLFgZAiM/Bex97soPo
+nBRHLinB1I6VoRVWikBkCnTsD/i9ofqoFRcvZRNcnWgM3eNi5e+zoBKBSvLW+xcS
+9sjNkbneWgTg0cKGqkkXwG4gccf4G2K4s6x64lo6Tkukp7q7uAvN6KVj6r2D8ATQ
+09TAgRd6EbMbZCXC4kFZweCbpCoNubypXIuCCL5uZyftT2Ji+r/WFE6X23tUChu0
+7B4kNyipl15tNQvMc/6AEZ30C+QlPd+q9EyFJfajKriOqrwrfqFutfOVqKkFC6Mx
+WSvTR8R/kwLvXfSgwWDfeBesULnOs8GryrSQIlzoT2eUxeB+J4qxtHavIH9Z8vBV
+anT+TdboVO8GrWtgXBr38WtY8xEsvMcYMxzHZ2GcJ6V3qDE+4EcbPl/FuwFck+gJ
+3feiz9/iV1ajuVgLhvX11JmR65sbQQrLPFHm+vm7Xv0n0fU=
 -----END CERTIFICATE-----

rust/pv/tests/assets/cert/host_rev.key

@@ -1,8 +1,8 @@
 -----BEGIN PRIVATE KEY-----
-MIHuAgEAMBAGByqGSM49AgEGBSuBBAAjBIHWMIHTAgEBBEIBLz0ExeBJrxd5gA7C
-YFJLVuNd4CPNc/jsOLIMnIbLHSegdOtQn9tief97k5rZdz/MQzWp7rCmsLUYw/fM
-ktUQjJKhgYkDgYYABAHkrwf4hZ7M5ahoYHT0u1Xgl28qxURcdNmWkYDA5u1Y2mGX
-Qq85BakAOyfxl/FF/cBrLm0eLVFpePumqgPna3El1gAs9p2SFwN74MmcLhbwPmGn
-WmzVrOh9cNS988XYf01E74966r4MKpAGxSNPKDwu4doXFVAYRH/wtcgbjlk+Qi3c
-9w==
+MIHuAgEAMBAGByqGSM49AgEGBSuBBAAjBIHWMIHTAgEBBEIAK7ON/fwW9+CMylco
+dAlDMVp0PeEPci/5GxVkb33rkUVct7wRXceSKg5N19L6+o7d3iyKt1G4Qm8L5cgq
+FsdQxYahgYkDgYYABAFOncuQfjViGAC/g8Nt6B+11h18++MD1+bOLgZwk94C5u8g
+ntb0I20QqeMFFuqmNMouFk6amimv64J6dNnaFXVh/QHOTTjZugytp2WB2SpySjRI
+btOsG3HFrAeSDJNr+a87NcMzq+s6aRdv5krVrKcSkpQrPnxVYV2Yoc1zEdsEyw6M
+0Q==
 -----END PRIVATE KEY-----

rust/pv/tests/assets/cert/host_uri_na.crt

@@ -1,29 +1,29 @@
 -----BEGIN CERTIFICATE-----
-MIIE/TCCAuWgAwIBAgIUPRltRSFZSbucmw20u9TN7WHxG8UwDQYJKoZIhvcNAQEN
+MIIFBDCCAuygAwIBAgIUNuVS85z9zeYfWs6GLZLJ20TLASYwDQYJKoZIhvcNAQEN
 BQAwgcwxCzAJBgNVBAYTAlVTMTQwMgYDVQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2lu
 ZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFs
 IEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMREwDwYDVQQIDAhOZXcgWW9y
 azEVMBMGA1UEBwwMUG91Z2hrZWVwc2llMScwJQYDVQQLDB5JQk0gWiBIb3N0IEtl
-eSBTaWduaW5nIFNlcnZpY2UwIBcNMjQwMzIxMTQ1MjM5WhgPMjM4ODEyMjMxNDUy
-MzlaMIG2MQswCQYDVQQGEwJVUzE0MDIGA1UECgwrSW50ZXJuYXRpb25hbCBCdXNp
+eSBTaWduaW5nIFNlcnZpY2UwIBcNMjYwNzAyMDg0NzQ4WhgPMjM5MTA0MDUwODQ3
+NDhaMIG2MQswCQYDVQQGEwJVUzE0MDIGA1UECgwrSW50ZXJuYXRpb25hbCBCdXNp
 bmVzcyBNYWNoaW5lcyBDb3Jwb3JhdGlvbjE0MDIGA1UEAwwrSW50ZXJuYXRpb25h
 bCBCdXNpbmVzcyBNYWNoaW5lcyBDb3Jwb3JhdGlvbjERMA8GA1UECAwITmV3IFlv
 cmsxDzANBgNVBAcMBkFybW9uazEXMBUGA1UECwwOSUJNIFogSG9zdCBLZXkwgZsw
-EAYHKoZIzj0CAQYFK4EEACMDgYYABAHGO0MnpQa6Q2IxgqV7AGwd3OwBnYOJjYJF
-hzrwY+wQacmJjWeNyHahBCxu4bM8vDr70SF5vZFrWpcWpc9JTY5AagFCFDqIfSvL
-J6lKJuCog5RfMsWJpG2j/MnK7MxG+Ph0R+ItmLFbWFxCV5YOT43olhwYZr/pd9qH
-PAD96UEDM8JanKNxMG8wHQYDVR0fBBYwFDASoBCgDoYMbm90YXZhaWxhYmxlMA4G
-A1UdDwEB/wQEAwIDCDAfBgNVHSMEGDAWgBTDjB5dtNYBmKwPzqBlK6BnpXUU2TAd
-BgNVHQ4EFgQUviblTFVtR0SX3KDiyOJYo78QDHIwDQYJKoZIhvcNAQENBQADggIB
-AGlM/E6RfiQV8si38/IieHw2TsZDNKluXA/edGN4d9i5ztIB+G57IgvAR9GBeRTB
-AxANycBGOWy+VXsUij3UgpoK3NiZJ+XvgFYqx0ZVUX3uPmU6R0Ko5cHGmSEVV6KS
-5ToGLqSZdftybGt9NYKg+LGxzIhT15tgUENkOrFVRSlKVn1zAP+sa2vOEtH5aX6S
-ins3hHQBuhGKSR/z2I5IzEVhnx0FJxpFO32QBdmXUdgjlHcpiIy1BaQRTca/U4iJ
-Q+fnzn5UP5v29ftr/PRh0W9rPVeS8ge+vuPC1eriRL4WWnkMFm0QljERqhg48NWk
-zT8mnVn0E3vQ2Y71FKg85ov0Sza8/OpBgAgnoyCDUIp8YD7BrU1viLEoqLtlvsoH
-l/+mU/CnCe5749C6OBppKhdrIRSG8bh6mIeco1ALDNIaqGoUtdhib0f+YKeCc0zC
-MFjvoSranndvwO+z/qdL7Feay8uAjgq1GPNuj/xaEbzrZz0yF2viMXfK62kgwq+W
-ebg2D1FHVuKXQ2q3IXmwcyLOEUScUcEYDsM5eDenoScgIE2FfHvoGOdJVLsQ9U+8
-2HTb7ntvbc6ANCTcnt51s5/PfD7UaHeJiSxRpU6rjxnqKZ2mEjbF/Ha8AjImQrrd
-jpjNgH6H5p7ZQqc/4DGa/Q2B/rfvmn5bAgOhicEKMzm1
+EAYHKoZIzj0CAQYFK4EEACMDgYYABADmnrO8fwhFRmvTAeT91LiGJatTUNRhTr+S
+Pf9glpJGFemv1amiV89qBYij6IuYJDhSYAQNllegWfntvzDbCOhDvAH0SY9Ivhd7
+7nA20M0Z9FuUNaFBRAkUB8VhVPC+lMM7i/0QA3FCWQEP1V28oXSyIOO7SF77GAb8
+U8dobSvrGtb7dKN4MHYwJAYDVR0fBB0wGzAZoBegFYYTaHR0cDovL25vdGF2YWls
+YWJsZTAOBgNVHQ8BAf8EBAMCAwgwHwYDVR0jBBgwFoAU/iv1rpgwYuIUSErnU3g7
+f6aYhu0wHQYDVR0OBBYEFMum6YlhSuPldml0XwDcdQfwjPfKMA0GCSqGSIb3DQEB
+DQUAA4ICAQAgTk83UQt1kM6rk4/HZ6o/pJ5coLDfmZYtOxQ6OmoDzy5ok59iTDsk
+rZIjNSnX95iKsobwYbF9K4yp4d3urJjSIq1kVKnsK++fYeRmT6G3rAyF1kZaL5CX
+dWnm3qE7/p/SSmwK9Me3IoNEzPVCVroBKOUeFTuxnTQyXQUXx4ItEQTpj02g0XxK
+PvPs8rYy7LGAGUwQqcBpBN61XvNX9DCUa45iyzCEcgFC3gMlBm/Cr0Um+W1Rh0Lw
+ULq0Zn8ZlgOLS4EXTim9R14RWVUh7EafunYG8Lxh2uoZAQo7QFaxz1/9SJdlhWpQ
+NsxK4hEDjqM8xcKXf+gRPKXMkFTjgMmH11U6CuKnB1URDb8oy/pLlJkJR8BcnR3v
+BWoezep9j8LiKj9Jv5P8EM9CAev+VdjG9ftnME/e2V4/3yfZnKj5uw1Dow/9fR08
+XRL7svrNSPcBM6uPq0vqZzADGizoMGmg0D47Stb9NgMi844i6lTCFPeVu7r9OWhx
++nI4ikeIKgbZNiMUl1SUEbqkWtCHK4EF1/NE3K6M64ATVlONCC4oU/ko6YtFZVk/
+zVTVGUf7FawrkrUbojVim4t5YyBL5rtoU5AyvMhgokpIP9bpWQHQhwAWZAmnKXBu
+1kBL2+8uLUmsHcnuZ1H+f3y5l2XMH/WYj5bcbhMoOUm6vY7FhXKOgQ==
 -----END CERTIFICATE-----

rust/pv/tests/assets/cert/ibm.chained.crt

@@ -3,57 +3,57 @@ MIIDfDCCAWQCAQEwDQYJKoZIhvcNAQENBQAwgcwxCzAJBgNVBAYTAlVTMTQwMgYD
 VQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9u
 MTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFsIEJ1c2luZXNzIE1hY2hpbmVzIENvcnBv
 cmF0aW9uMREwDwYDVQQIDAhOZXcgWW9yazEVMBMGA1UEBwwMUG91Z2hrZWVwc2ll
-MScwJQYDVQQLDB5JQk0gWiBIb3N0IEtleSBTaWduaW5nIFNlcnZpY2UXDTI0MDMx
-MTE1NTIzOVoYDzIzODgxMjIzMTU1MjM5WjA8MBMCAgIrFw0yNDAzMjAxNTUyMzla
-MCUCFDIvLrSYUcq+W27wAZwp/0Pf7ydJFw0yNDAzMjAxNTUyMzlaoCMwITAfBgNV
-HSMEGDAWgBTDjB5dtNYBmKwPzqBlK6BnpXUU2TANBgkqhkiG9w0BAQ0FAAOCAgEA
-hMmvyXLOtDG7faP93ZqMh061Qms/at5uYz/eAA9CGfS4E+hq2uQaic6gEMWf5NkH
-9xRWB1UM9sLR5Ai/Fn+MqsbeXK+1ommOfYx0KL6J8JihHAlQpGYJXu683dxIB3LL
-ijZ+od5pes5ZIRKtMNaO4+meDG6e5guXDeFNyJaNYqFXOJcy8OIL4O3T840qY1aY
-YcHZs/sNwC/hSAloTeUQ6S+ga/EplzSDumz5VrRsEhVd3wScM1FNeqwMvA4VPUIa
-NOtZJNLJBLhfmetTeO/wb/y3Ekp8sXAf8UJqABczJODSaGc2RwULmxJd2Q5lESpX
-RkfvObqTWgpzpyV/1OhZYDUlXJqiADYnyAsQL8WV2uFQ5fRG7baVDiNYn4uE92Of
-FN7jXmT+7UcHSO5L0VqHS6Ia6j2NammKlbhsAw7dU3uxEgCJvBYlWSY+z9Fs+O1B
-hNU42fL5W7JnoGfqG+LqfDdbG0MG+GMo1rDDcvrEK73F41w7mLmZhfYAZY26xU6Q
-XyLcrG4YfR6FCyOs53zwrKKG9x3ETqY3S0DSSOKTnuvIGZBCSOxGpqdb7pQax6IJ
-PqsM+IzFC1C0Ol0eX1ee734rCHfNP6XEM7ucjBweNUJRrU0Q5CrGGJzEQz0ym/JN
-81f/kQJJosSSc1+j8iDiaKkUgcQ1DWWZLYZgvCkwZcY=
+MScwJQYDVQQLDB5JQk0gWiBIb3N0IEtleSBTaWduaW5nIFNlcnZpY2UXDTI2MDYy
+MjEwNDc0OFoYDzIzOTEwNDA1MTA0NzQ4WjA8MBMCAgIrFw0yNjA3MDExMDQ3NDha
+MCUCFAqXdSGI9kR+CnND4uvmc33Wb+59Fw0yNjA3MDExMDQ3NDhaoCMwITAfBgNV
+HSMEGDAWgBT+K/WumDBi4hRISudTeDt/ppiG7TANBgkqhkiG9w0BAQ0FAAOCAgEA
+fxBxN6giXdLaG5lWLbigI78WQoEzOxWeYbzUpqmn+QFd9YiJCNMaGz2XWl/MBZEl
+gmpHNOEzOM5Ze5dRfbLDAzBBFghNGrDDQURMw0ASZfHX6WsL7MOoBqTeg4xbFESk
+dXT9YCH/wS5sn5YgkKDh2jqHQya8c4TtWfuWYW/Anyo8wVhgcYAnAiSJZgSUciq5
+964Ci2v4pifpQBbpx1MAaOgU7kkY59v+AHhWfxJ7whJra8DA+v6XEim7Y/uABW0N
+Yzp+rcSZdDanFq5OC8YE9Kn0c7bHvFi0bDf/AmOB9D64OHc3PRQInubN7aNaQ89N
+T+wgFhN2yMSuh4YB+RJ3C1aouGszzC275vYEcc2Iw2OdQQkTu7dhhV+pEfvkhh4x
+myBgJKEBqidXDAe1SjGtNP+G0pF6XcQDc3lkSsw+btW1YjQIbv7uayuDfz7aqbh8
+vPdP5QKWocPkIOL8sv4JFiETfVWqVMH42vE+ixC3+enunLxqJAUxqMZSfKuCtPYb
+PhnSuZZ+rTfXpFfYZMMUTMhrx618+uttcQGosdYNv9e4YSR8pLvIPFef/wfWqpLL
+Yy8xYSGOUJ9f8vfh0aIkcRiLbjSgnyJeSlQVRnF0w4FeTjm3QeY2gcdMzaIo3oyH
+G23dJvzGq19Y5h4ShZoACuasTIKtaxLm0gjwCYBWZO8=
 -----END X509 CRL-----
 -----BEGIN CERTIFICATE-----
-MIIGsTCCBJmgAwIBAgIUMwTHYM3peBjwVRi6iICr6FVn0cMwDQYJKoZIhvcNAQEL
+MIIGuDCCBKCgAwIBAgIUMX4D3d8lY30ZIeB/PpAi4vEPvfcwDQYJKoZIhvcNAQEL
 BQAwgb0xCzAJBgNVBAYTAlVTMTQwMgYDVQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2lu
 ZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFs
 IEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMREwDwYDVQQIDAhOZXcgWW9y
 azEPMA0GA1UEBwwGQXJtb25rMR4wHAYDVQQLDBVJQk0gWiBJbnRlcm1lZGlhdGUg
-Q0EwIBcNMjQwMzIxMTQ1MjM4WhgPMjM4ODEyMjMxNDUyMzhaMIHMMQswCQYDVQQG
+Q0EwIBcNMjYwNzAyMDg0NzQ4WhgPMjM5MTA0MDUwODQ3NDhaMIHMMQswCQYDVQQG
 EwJVUzE0MDIGA1UECgwrSW50ZXJuYXRpb25hbCBCdXNpbmVzcyBNYWNoaW5lcyBD
 b3Jwb3JhdGlvbjE0MDIGA1UEAwwrSW50ZXJuYXRpb25hbCBCdXNpbmVzcyBNYWNo
 aW5lcyBDb3Jwb3JhdGlvbjERMA8GA1UECAwITmV3IFlvcmsxFTATBgNVBAcMDFBv
 dWdoa2VlcHNpZTEnMCUGA1UECwweSUJNIFogSG9zdCBLZXkgU2lnbmluZyBTZXJ2
-aWNlMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAxNqcFB9GSj+nC1PV
-OTIAvzTuo3X7bTbohEPrIDDsEcGyVzQtfagI9vkxhhGLhXxIXrkwEI4u75DeLBdq
-ZR3KFJ3QD+jHW12EWNpmSYu272CEAJeb/SBJaFbh40WbY1BsTP+3zI5QMwVTmCH5
-QqODD+GU0fDSo9Gti0yX4rxOY+54jDC77AhSlU55rYruBoIXVe4CcPUpqzZLgqB2
-cTJ5g7lokGqc6w9pveCznVYGPfcdDt+ePGssOvrfBOJnn6N44tTRAG623BrpctXi
-t3IAhG60y6CqF29BjV0RKOv09nOBiph2a3lAiKYrpAt92BETFB7KSQManUrrvWOD
-mYEcoVkzvrVrB3WnCcHs6lsjQg1FcNrGcDzV9SmX0BIhM+fasxZyHWc08pr3NrRn
-Eks7lRqY+TS8DAeZYJt/2M0Jr32d6Bh+WdyGFFUj6sBPtCaC2VnSkxOgKXeWf/c5
-EUXIQT2YXEkNK9CP8Kqs8IerEIpfceelQReA5QcvNruaJNktWLKJgYTrdLdfOP0u
-s+9JJHWcFH3tv5906CA+Tlm53Dk6SaRc/DB7lu94yTkcSOpxXZnximZi0GcPZYmZ
-TaswE7d8HCPLhks/RkZSV2764Kl08xle65APiWZ4dM24uSyu75Izb4hrwgIA4qyM
-dDVQnI3cu6utmKUPyHoJtH26dr0CAwEAAaOBlTCBkjAdBgNVHR8EFjAUMBKgEKAO
-hgxpbnRlcl9jYS5jcmwwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCB4AwEwYD
-VR0lBAwwCgYIKwYBBQUHAwMwHwYDVR0jBBgwFoAU+f7h8O2ttBHtwI4OZnpD9wU0
-9GYwHQYDVR0OBBYEFMOMHl201gGYrA/OoGUroGeldRTZMA0GCSqGSIb3DQEBCwUA
-A4ICAQBfBZZ7ZPkRjRgk+0/7CGam2AAv/GSuma8lOnJ6IpBEUL0D01reRe9NO1Y5
-iXasGZ80e95oC7WtePt1LS2I5rOOb3No0iHcUTm5lZV2M/ObAOwraQLXePCRVgU/
-OQzNhtRoCpqgL80/1Ne+MTHj1yZp2GRKXOdMd39KZoG92JU/h556GQ6reN6WKNs+
-wbFG+JKiRnfvPsul6J5lG4QuObCAZXa0fhcQNUHyWjCGIhMa8AuhkDDlIEOBV1Vx
-T/ixdoFhDIoz0xExFidR5uqYXKZlgzcMZ4JT7x0Vs/YsOIg9z5PNkyjt8Kjrxvqs
-NZ1eYuNNxdXxdJZ2x04y8AzLkLRYntOCks5nEamQtzv0ice1Jg52qNJnMm0Y0U9o
-7BjlWy/pp8dBfIA+FyxsIs62hAE6Z/vuJa1VuWJblrT1MFM48Bh64p1m5uDXAZ9w
-Oy7n6YDpzWKWqn6XNV6FoDSkkwaOwB6bPaqAP1ZvP3BmVhednyYRYY21M2aOmxos
-7rpaW1FHgYV96Dm60rL7XRtOEYZNPSIPDO/Ro1oWs3EFwjLLAWtlK1HdMswlnVDX
-6M+LNCRZA3foNi6xvf7CvPkshtQe3FOfiw/OiPBsYsYREC+90Ml/oeTIsyCaOF6n
-5+dpjCBeOUaxzfeQI4WCrLG6+iQZNXWgBkW/PHaPZTldRWzvdQ==
+aWNlMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEArwM7pHOyjneIEu8d
+n/W8nHZYL3LOLSP4K7LDa3s2bxIOa4oFh/C0Q8RIBslyIq0bK6ggVmXBHiKirXlo
+jQvACF9hqOCx0kFwXNF4CGFQ+gA/z0bs17LJbENPa9nWqpoQ6FbDlMM9RyevAQtu
+FKPPO6KlCKBCVBGbfzzqBZNogfmq3hsjEtL+2jUpIT4WfUiDi6Azjx0hGhmAQ97N
+01KyjcZd4GuevsxFq9seuogYkEG7TmLgRGpNKRT8NhZFi+mKJP/bXvYZEb/SaGUo
+gHiA3O3R0S8EQEnVsfB1ASMdpVoI0wV6XO8JKEguZZBUF1roZEPmq6CChpNpdvGu
+oOTCgsNhAsVRjz70TTZQii0ktemREOqUmFMXSNeKwPlEz5jNSHLiuJksk+dIw33Y
+LBEMTxx0ckqZKJGK/DbsjKfoeMdioRl1fMy0B2a3TYprp5linnYmoXSl2B0gbdlE
+A37LgEkTtBVOw++fxlDZN8FsB6VyP161CwBA0LjGuGHcghNvEQi0QS+dFbc/9j9A
+tRr92+cvxIezi2F6s1dcKxjTuAzdXeEliw2C37NE87zG8s5uX4VeVOuCZQ3VmueU
+my5zplN1oJDFNQWfjayEOurnde0T73tFTnpagYhpXwxOKTSUSzEsmh/57TlasY0L
+zlh6k4a4jvfj26Ve+y+NMAqrznkCAwEAAaOBnDCBmTAkBgNVHR8EHTAbMBmgF6AV
+hhNodHRwOi8vaW50ZXJfY2EuY3JsMAwGA1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQD
+AgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMDMB8GA1UdIwQYMBaAFHvgduY20uw75WX7
+Feb/jSCXuAmoMB0GA1UdDgQWBBT+K/WumDBi4hRISudTeDt/ppiG7TANBgkqhkiG
+9w0BAQsFAAOCAgEANPj1emmO06HnGnZCRnsTldd1f+ghOtIZxTxKB3dSBVJNafv/
+jNh4rRvKyQ6osY2uG/tydxOhHxr7XMP1Fca98iJvrdM4Ox5XwtoltesBzB16zZFJ
+/ekzAF+ttISRlMrOlS6q+Yph+cSBnG2VMlPiEfyvW6fkT+OQIwPT5t4wvYB1eN4T
+9/6iSDaV0P8n/7S2itIXjl3TzhhRN6RFeC0TGfbPasCHKKkA/l9wwm6Hijfb3SXG
+ke+r+lTz/A6S/3tstuYmZiXyxHsfsI07C77uy23rReF+imyR2Tl7et/+Xaw3Lvp9
+b8WZvGWHlXmQlQVLfZzKcvOB4Xnd0wzUENVGiqTGgPxTPAWR+Zwf16iUzkEemUSp
+/NERtCKuWImGaycoyPWUXGVDz8novJLHjYv+BLJMskrCunUpxXjbXdDOTZN1VSo1
+IPxlQU3oCe29N98N6P5/HjjhJa8i7iQr8xTSGpz58IzKztuBLSXIcKCS9nTV3EOV
+LTpK40TjrIGSOrgUFc6VumkufTx5Lm4ZYMcWi3qJJoDvtv5tCoBV5a5l+v9kBAom
+AqTBRH6QpBvIEjeEghAntiAE8CI8K+T4W9O8LHVm4LkuK5AAYenx8axnN0BDhLg6
+tglhS202ez9SLjRN6Hb8uw5CS61O56gzwPvEf1vyQAhZa1KPIof++GzjHAk=
 -----END CERTIFICATE-----

rust/pv/tests/assets/cert/ibm.crl

@@ -3,19 +3,19 @@ MIIDfDCCAWQCAQEwDQYJKoZIhvcNAQENBQAwgcwxCzAJBgNVBAYTAlVTMTQwMgYD
 VQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9u
 MTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFsIEJ1c2luZXNzIE1hY2hpbmVzIENvcnBv
 cmF0aW9uMREwDwYDVQQIDAhOZXcgWW9yazEVMBMGA1UEBwwMUG91Z2hrZWVwc2ll
-MScwJQYDVQQLDB5JQk0gWiBIb3N0IEtleSBTaWduaW5nIFNlcnZpY2UXDTI0MDMx
-MTE1NTIzOVoYDzIzODgxMjIzMTU1MjM5WjA8MBMCAgIrFw0yNDAzMjAxNTUyMzla
-MCUCFDIvLrSYUcq+W27wAZwp/0Pf7ydJFw0yNDAzMjAxNTUyMzlaoCMwITAfBgNV
-HSMEGDAWgBTDjB5dtNYBmKwPzqBlK6BnpXUU2TANBgkqhkiG9w0BAQ0FAAOCAgEA
-hMmvyXLOtDG7faP93ZqMh061Qms/at5uYz/eAA9CGfS4E+hq2uQaic6gEMWf5NkH
-9xRWB1UM9sLR5Ai/Fn+MqsbeXK+1ommOfYx0KL6J8JihHAlQpGYJXu683dxIB3LL
-ijZ+od5pes5ZIRKtMNaO4+meDG6e5guXDeFNyJaNYqFXOJcy8OIL4O3T840qY1aY
-YcHZs/sNwC/hSAloTeUQ6S+ga/EplzSDumz5VrRsEhVd3wScM1FNeqwMvA4VPUIa
-NOtZJNLJBLhfmetTeO/wb/y3Ekp8sXAf8UJqABczJODSaGc2RwULmxJd2Q5lESpX
-RkfvObqTWgpzpyV/1OhZYDUlXJqiADYnyAsQL8WV2uFQ5fRG7baVDiNYn4uE92Of
-FN7jXmT+7UcHSO5L0VqHS6Ia6j2NammKlbhsAw7dU3uxEgCJvBYlWSY+z9Fs+O1B
-hNU42fL5W7JnoGfqG+LqfDdbG0MG+GMo1rDDcvrEK73F41w7mLmZhfYAZY26xU6Q
-XyLcrG4YfR6FCyOs53zwrKKG9x3ETqY3S0DSSOKTnuvIGZBCSOxGpqdb7pQax6IJ
-PqsM+IzFC1C0Ol0eX1ee734rCHfNP6XEM7ucjBweNUJRrU0Q5CrGGJzEQz0ym/JN
-81f/kQJJosSSc1+j8iDiaKkUgcQ1DWWZLYZgvCkwZcY=
+MScwJQYDVQQLDB5JQk0gWiBIb3N0IEtleSBTaWduaW5nIFNlcnZpY2UXDTI2MDYy
+MjEwNDc0OFoYDzIzOTEwNDA1MTA0NzQ4WjA8MBMCAgIrFw0yNjA3MDExMDQ3NDha
+MCUCFAqXdSGI9kR+CnND4uvmc33Wb+59Fw0yNjA3MDExMDQ3NDhaoCMwITAfBgNV
+HSMEGDAWgBT+K/WumDBi4hRISudTeDt/ppiG7TANBgkqhkiG9w0BAQ0FAAOCAgEA
+fxBxN6giXdLaG5lWLbigI78WQoEzOxWeYbzUpqmn+QFd9YiJCNMaGz2XWl/MBZEl
+gmpHNOEzOM5Ze5dRfbLDAzBBFghNGrDDQURMw0ASZfHX6WsL7MOoBqTeg4xbFESk
+dXT9YCH/wS5sn5YgkKDh2jqHQya8c4TtWfuWYW/Anyo8wVhgcYAnAiSJZgSUciq5
+964Ci2v4pifpQBbpx1MAaOgU7kkY59v+AHhWfxJ7whJra8DA+v6XEim7Y/uABW0N
+Yzp+rcSZdDanFq5OC8YE9Kn0c7bHvFi0bDf/AmOB9D64OHc3PRQInubN7aNaQ89N
+T+wgFhN2yMSuh4YB+RJ3C1aouGszzC275vYEcc2Iw2OdQQkTu7dhhV+pEfvkhh4x
+myBgJKEBqidXDAe1SjGtNP+G0pF6XcQDc3lkSsw+btW1YjQIbv7uayuDfz7aqbh8
+vPdP5QKWocPkIOL8sv4JFiETfVWqVMH42vE+ixC3+enunLxqJAUxqMZSfKuCtPYb
+PhnSuZZ+rTfXpFfYZMMUTMhrx618+uttcQGosdYNv9e4YSR8pLvIPFef/wfWqpLL
+Yy8xYSGOUJ9f8vfh0aIkcRiLbjSgnyJeSlQVRnF0w4FeTjm3QeY2gcdMzaIo3oyH
+G23dJvzGq19Y5h4ShZoACuasTIKtaxLm0gjwCYBWZO8=
 -----END X509 CRL-----

rust/pv/tests/assets/cert/ibm.crt

@@ -1,38 +1,38 @@
 -----BEGIN CERTIFICATE-----
-MIIGsTCCBJmgAwIBAgIUMwTHYM3peBjwVRi6iICr6FVn0cMwDQYJKoZIhvcNAQEL
+MIIGuDCCBKCgAwIBAgIUMX4D3d8lY30ZIeB/PpAi4vEPvfcwDQYJKoZIhvcNAQEL
 BQAwgb0xCzAJBgNVBAYTAlVTMTQwMgYDVQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2lu
 ZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFs
 IEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMREwDwYDVQQIDAhOZXcgWW9y
 azEPMA0GA1UEBwwGQXJtb25rMR4wHAYDVQQLDBVJQk0gWiBJbnRlcm1lZGlhdGUg
-Q0EwIBcNMjQwMzIxMTQ1MjM4WhgPMjM4ODEyMjMxNDUyMzhaMIHMMQswCQYDVQQG
+Q0EwIBcNMjYwNzAyMDg0NzQ4WhgPMjM5MTA0MDUwODQ3NDhaMIHMMQswCQYDVQQG
 EwJVUzE0MDIGA1UECgwrSW50ZXJuYXRpb25hbCBCdXNpbmVzcyBNYWNoaW5lcyBD
 b3Jwb3JhdGlvbjE0MDIGA1UEAwwrSW50ZXJuYXRpb25hbCBCdXNpbmVzcyBNYWNo
 aW5lcyBDb3Jwb3JhdGlvbjERMA8GA1UECAwITmV3IFlvcmsxFTATBgNVBAcMDFBv
 dWdoa2VlcHNpZTEnMCUGA1UECwweSUJNIFogSG9zdCBLZXkgU2lnbmluZyBTZXJ2
-aWNlMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAxNqcFB9GSj+nC1PV
-OTIAvzTuo3X7bTbohEPrIDDsEcGyVzQtfagI9vkxhhGLhXxIXrkwEI4u75DeLBdq
-ZR3KFJ3QD+jHW12EWNpmSYu272CEAJeb/SBJaFbh40WbY1BsTP+3zI5QMwVTmCH5
-QqODD+GU0fDSo9Gti0yX4rxOY+54jDC77AhSlU55rYruBoIXVe4CcPUpqzZLgqB2
-cTJ5g7lokGqc6w9pveCznVYGPfcdDt+ePGssOvrfBOJnn6N44tTRAG623BrpctXi
-t3IAhG60y6CqF29BjV0RKOv09nOBiph2a3lAiKYrpAt92BETFB7KSQManUrrvWOD
-mYEcoVkzvrVrB3WnCcHs6lsjQg1FcNrGcDzV9SmX0BIhM+fasxZyHWc08pr3NrRn
-Eks7lRqY+TS8DAeZYJt/2M0Jr32d6Bh+WdyGFFUj6sBPtCaC2VnSkxOgKXeWf/c5
-EUXIQT2YXEkNK9CP8Kqs8IerEIpfceelQReA5QcvNruaJNktWLKJgYTrdLdfOP0u
-s+9JJHWcFH3tv5906CA+Tlm53Dk6SaRc/DB7lu94yTkcSOpxXZnximZi0GcPZYmZ
-TaswE7d8HCPLhks/RkZSV2764Kl08xle65APiWZ4dM24uSyu75Izb4hrwgIA4qyM
-dDVQnI3cu6utmKUPyHoJtH26dr0CAwEAAaOBlTCBkjAdBgNVHR8EFjAUMBKgEKAO
-hgxpbnRlcl9jYS5jcmwwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCB4AwEwYD
-VR0lBAwwCgYIKwYBBQUHAwMwHwYDVR0jBBgwFoAU+f7h8O2ttBHtwI4OZnpD9wU0
-9GYwHQYDVR0OBBYEFMOMHl201gGYrA/OoGUroGeldRTZMA0GCSqGSIb3DQEBCwUA
-A4ICAQBfBZZ7ZPkRjRgk+0/7CGam2AAv/GSuma8lOnJ6IpBEUL0D01reRe9NO1Y5
-iXasGZ80e95oC7WtePt1LS2I5rOOb3No0iHcUTm5lZV2M/ObAOwraQLXePCRVgU/
-OQzNhtRoCpqgL80/1Ne+MTHj1yZp2GRKXOdMd39KZoG92JU/h556GQ6reN6WKNs+
-wbFG+JKiRnfvPsul6J5lG4QuObCAZXa0fhcQNUHyWjCGIhMa8AuhkDDlIEOBV1Vx
-T/ixdoFhDIoz0xExFidR5uqYXKZlgzcMZ4JT7x0Vs/YsOIg9z5PNkyjt8Kjrxvqs
-NZ1eYuNNxdXxdJZ2x04y8AzLkLRYntOCks5nEamQtzv0ice1Jg52qNJnMm0Y0U9o
-7BjlWy/pp8dBfIA+FyxsIs62hAE6Z/vuJa1VuWJblrT1MFM48Bh64p1m5uDXAZ9w
-Oy7n6YDpzWKWqn6XNV6FoDSkkwaOwB6bPaqAP1ZvP3BmVhednyYRYY21M2aOmxos
-7rpaW1FHgYV96Dm60rL7XRtOEYZNPSIPDO/Ro1oWs3EFwjLLAWtlK1HdMswlnVDX
-6M+LNCRZA3foNi6xvf7CvPkshtQe3FOfiw/OiPBsYsYREC+90Ml/oeTIsyCaOF6n
-5+dpjCBeOUaxzfeQI4WCrLG6+iQZNXWgBkW/PHaPZTldRWzvdQ==
+aWNlMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEArwM7pHOyjneIEu8d
+n/W8nHZYL3LOLSP4K7LDa3s2bxIOa4oFh/C0Q8RIBslyIq0bK6ggVmXBHiKirXlo
+jQvACF9hqOCx0kFwXNF4CGFQ+gA/z0bs17LJbENPa9nWqpoQ6FbDlMM9RyevAQtu
+FKPPO6KlCKBCVBGbfzzqBZNogfmq3hsjEtL+2jUpIT4WfUiDi6Azjx0hGhmAQ97N
+01KyjcZd4GuevsxFq9seuogYkEG7TmLgRGpNKRT8NhZFi+mKJP/bXvYZEb/SaGUo
+gHiA3O3R0S8EQEnVsfB1ASMdpVoI0wV6XO8JKEguZZBUF1roZEPmq6CChpNpdvGu
+oOTCgsNhAsVRjz70TTZQii0ktemREOqUmFMXSNeKwPlEz5jNSHLiuJksk+dIw33Y
+LBEMTxx0ckqZKJGK/DbsjKfoeMdioRl1fMy0B2a3TYprp5linnYmoXSl2B0gbdlE
+A37LgEkTtBVOw++fxlDZN8FsB6VyP161CwBA0LjGuGHcghNvEQi0QS+dFbc/9j9A
+tRr92+cvxIezi2F6s1dcKxjTuAzdXeEliw2C37NE87zG8s5uX4VeVOuCZQ3VmueU
+my5zplN1oJDFNQWfjayEOurnde0T73tFTnpagYhpXwxOKTSUSzEsmh/57TlasY0L
+zlh6k4a4jvfj26Ve+y+NMAqrznkCAwEAAaOBnDCBmTAkBgNVHR8EHTAbMBmgF6AV
+hhNodHRwOi8vaW50ZXJfY2EuY3JsMAwGA1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQD
+AgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMDMB8GA1UdIwQYMBaAFHvgduY20uw75WX7
+Feb/jSCXuAmoMB0GA1UdDgQWBBT+K/WumDBi4hRISudTeDt/ppiG7TANBgkqhkiG
+9w0BAQsFAAOCAgEANPj1emmO06HnGnZCRnsTldd1f+ghOtIZxTxKB3dSBVJNafv/
+jNh4rRvKyQ6osY2uG/tydxOhHxr7XMP1Fca98iJvrdM4Ox5XwtoltesBzB16zZFJ
+/ekzAF+ttISRlMrOlS6q+Yph+cSBnG2VMlPiEfyvW6fkT+OQIwPT5t4wvYB1eN4T
+9/6iSDaV0P8n/7S2itIXjl3TzhhRN6RFeC0TGfbPasCHKKkA/l9wwm6Hijfb3SXG
+ke+r+lTz/A6S/3tstuYmZiXyxHsfsI07C77uy23rReF+imyR2Tl7et/+Xaw3Lvp9
+b8WZvGWHlXmQlQVLfZzKcvOB4Xnd0wzUENVGiqTGgPxTPAWR+Zwf16iUzkEemUSp
+/NERtCKuWImGaycoyPWUXGVDz8novJLHjYv+BLJMskrCunUpxXjbXdDOTZN1VSo1
+IPxlQU3oCe29N98N6P5/HjjhJa8i7iQr8xTSGpz58IzKztuBLSXIcKCS9nTV3EOV
+LTpK40TjrIGSOrgUFc6VumkufTx5Lm4ZYMcWi3qJJoDvtv5tCoBV5a5l+v9kBAom
+AqTBRH6QpBvIEjeEghAntiAE8CI8K+T4W9O8LHVm4LkuK5AAYenx8axnN0BDhLg6
+tglhS202ez9SLjRN6Hb8uw5CS61O56gzwPvEf1vyQAhZa1KPIof++GzjHAk=
 -----END CERTIFICATE-----

rust/pv/tests/assets/cert/ibm.key

@@ -1,52 +1,52 @@
 -----BEGIN PRIVATE KEY-----
-MIIJQwIBADANBgkqhkiG9w0BAQEFAASCCS0wggkpAgEAAoICAQDE2pwUH0ZKP6cL
-U9U5MgC/NO6jdfttNuiEQ+sgMOwRwbJXNC19qAj2+TGGEYuFfEheuTAQji7vkN4s
-F2plHcoUndAP6MdbXYRY2mZJi7bvYIQAl5v9IEloVuHjRZtjUGxM/7fMjlAzBVOY
-IflCo4MP4ZTR8NKj0a2LTJfivE5j7niMMLvsCFKVTnmtiu4GghdV7gJw9SmrNkuC
-oHZxMnmDuWiQapzrD2m94LOdVgY99x0O3548ayw6+t8E4mefo3ji1NEAbrbcGuly
-1eK3cgCEbrTLoKoXb0GNXREo6/T2c4GKmHZreUCIpiukC33YERMUHspJAxqdSuu9
-Y4OZgRyhWTO+tWsHdacJwezqWyNCDUVw2sZwPNX1KZfQEiEz59qzFnIdZzTymvc2
-tGcSSzuVGpj5NLwMB5lgm3/YzQmvfZ3oGH5Z3IYUVSPqwE+0JoLZWdKTE6Apd5Z/
-9zkRRchBPZhcSQ0r0I/wqqzwh6sQil9x56VBF4DlBy82u5ok2S1YsomBhOt0t184
-/S6z70kkdZwUfe2/n3ToID5OWbncOTpJpFz8MHuW73jJORxI6nFdmfGKZmLQZw9l
-iZlNqzATt3wcI8uGSz9GRlJXbvrgqXTzGV7rkA+JZnh0zbi5LK7vkjNviGvCAgDi
-rIx0NVCcjdy7q62YpQ/Iegm0fbp2vQIDAQABAoICACjHosq2WeDaw9egY80H80ip
-BgC92bqbw9pWmZhfGiBpkHDpQb1EuKq1H9HGw7EA+JsK4Q6k7cs6JxRaO3O8Epdn
-w+jvz5C5VEf14ne85kY7p8zZm3p6HErtqLjkvBZ8XBstZF2PY8TWByW+b/0ik22Q
-TTyal4BRWRLA6LwTR2gDSFy+Yce5R6ZfjexqGfomLABkoIPW/e1Wf5kNdcvoaWzk
-1WkJdP1rAXxQ1tSys/NVRGNG5uhcSVrkipvf7RiQjGPtM2jUBrSdLJxZ+7AGAV5t
-8q02WNYm+Zz32SyxiNsfPYhBIlMMWNaWGfdPXCANFXc3E6/BYVuRYDmpKmN78DqN
-XrSCsJOahg7A9f2JIVKmreC/WmHi0+eL0fCcMHK95CN415mYLagg1bLhOwu0cdjq
-peSx3+xlEWENDm0B4mYQaPDylHht++Giswg9VpZeIPstgvNARoiCgRCOiR3mXVBg
-ZX+BpH45RSZ0hqdhkssiwP3iOQH0xYe1kEvzcaCeNrGc8cZy4dOcZjYso1XNZEQY
-vnUzAfo0TasiMES/RiNuy7Zf0oTP1UV7QootsqPQrZCFf3eixC91pq4Lh2URUseo
-4yOOI1URBWU5U2RuykzYWsqs/xB+CfJy6dhn6jCjm5lZFt1/wEKj5+7JZbZWkH8A
-G2HHxKIQWz5d2KjbQBkxAoIBAQDwUtb6mrJ/JBvMubdR2Tkyog9lT7qeR848ZZqS
-ybGEuT1Ohhd7vtjiIQzMLX7s6XIUoSE3AWFJJzqFrr0f1HkwShBNlvF77We3jski
-p7u4bsJ91mjHBWl/bAKW9s3YA6PRakk8k215mwORf+trhFkcOJ63DHIPxBnPDQEI
-VBBMvp5ogHHIh5wTql+c4OpdEb5s0PuesKFzjdzKtvPashaP3ebt2nM8Nai86UKQ
-WTcZxMLk36XSLFcW2vZlmlkQ7q8gMM3BIliR2ofmB0AlPBwOY/gUHG+tIBbuQWoX
-tw4DJPY3Y9uWRqAcWOkSbQpAEOUVzyK5nrwXwnH7vOA9HOiZAoIBAQDRsd7x3NGL
-Gp8oY8XULwIrZfyQmsk+nozBNuo2Q40qoXBoReIUF212UMMYc2iX8bMo1jBCzmnl
-3m2BA6aVbpxwlp14Ybe78F8ucQN6Dx5wmT7QyDYxdKyMAYOnOHWdW1ic1y2HjKY3
-vinswhuI93C4Dkf4mxFtP+aWT3RpQxS7DsztBTKux7fACoU+OKQxrmZTkPSVhuEE
-DXIov09q3awEvB/R+dDzGj6NXwxQ+Kr3yLl137RvVWcvrObyysKLfnVx+Of0Kol/
-6VD82BBWDcgveu62JPSZ8ckY4eQbi3yl5mOAbL3vre+AQYuDiuOo2NiPOsAimGaz
-kv9gXZQ1leHFAoIBAQDsGHYavN+fCFpHRixSvJT0qUF2xl0QInr52teAXaWIPnN8
-MT/g0h1ACjgIXqnTFYR9v85hu3lX5LIZoxEptBNa3Wgm0aNrnE/IhP4UjbRd/HIW
-Lg3BeA+snu/sX4raLLlDgqdwW2WxkhhvWLxvZBYnI3jJW/CyjHTOdHgPNobM3nfB
-Mm6WEqPCrh5AgLW9uTDatnR78gqq+zNt806eC1ce/2FfSrzq6cxbys0aAoufRS4y
-q4S8ddMZIQPvzTKy78ocVdXNZ3Cb2ZSo53adHfByMsQE/eq4qk3cw2b25V9et3Er
-+W5AtCGXt8FB2N25Et/8DQKQWOFwdhaEuYmSgFQBAoIBAEgmEBRdqsdWyI4oDggc
-iH2QIJ9McpOWD83m7Bzxjx+s3jUyXkAVc3czAH1oMAOfiMozL/W8eZk6t6idLfLa
-VP80A0hJLuN+J/GdttmHXCzXvVIuoN7RSxD88GRXu7gBlvKX4rVxwjsJtfkdLEYr
-BOB/IWo7SHqzcs4i1mXlS7u0svOWR0L1upZbyE6JRI1HeTOle1H7T26Khc3ZTSTy
-0l3qsHQZpTgPvpf7rQwrEwAgUxdoefeYheFUdz3wX5GJWDV3s69B939IMrJcUPqa
-0Vbs0DdhbbuOAmgKSOblTmTyaSflwlA2I2KYqrz+y6frvE9DopoEn8mHeVCZwgXR
-5RUCggEBAMv2kXszsi3rgnlpFObRRnjyE5g5U3As1ii6FzUHm/aurUYqAZyMMnE+
-RdKX1zBUfTUXqijSpl7avZrf7DVTWR42kiCJM7PM0lrcFUcYFCIs0x7Qk2j3YIpm
-17vOFMpkZyYdWIniw3ihmWQTM3s3qTfdAbZPztnSInnjp+aXzU/tbfsmOmROcLY7
-V0xYNWeMs+P1axoEC7zGmhCAaN/A+zDY34VLHGDrR4dVKCnFUQFoRwqfE6PtICFL
-4fvdbbhwmU3sxY48y8ws/JyMfWachcFg/zbHVRR/K4j0sGfJB2NKu49jCcwPFaFT
-jLfytXEfbNWBGcgHySC4HUwnpUVxN44=
+MIIJQgIBADANBgkqhkiG9w0BAQEFAASCCSwwggkoAgEAAoICAQCvAzukc7KOd4gS
+7x2f9bycdlgvcs4tI/grssNrezZvEg5rigWH8LRDxEgGyXIirRsrqCBWZcEeIqKt
+eWiNC8AIX2Go4LHSQXBc0XgIYVD6AD/PRuzXsslsQ09r2daqmhDoVsOUwz1HJ68B
+C24Uo887oqUIoEJUEZt/POoFk2iB+areGyMS0v7aNSkhPhZ9SIOLoDOPHSEaGYBD
+3s3TUrKNxl3ga56+zEWr2x66iBiQQbtOYuBEak0pFPw2FkWL6Yok/9te9hkRv9Jo
+ZSiAeIDc7dHRLwRASdWx8HUBIx2lWgjTBXpc7wkoSC5lkFQXWuhkQ+aroIKGk2l2
+8a6g5MKCw2ECxVGPPvRNNlCKLSS16ZEQ6pSYUxdI14rA+UTPmM1IcuK4mSyT50jD
+fdgsEQxPHHRySpkokYr8NuyMp+h4x2KhGXV8zLQHZrdNimunmWKediahdKXYHSBt
+2UQDfsuASRO0FU7D75/GUNk3wWwHpXI/XrULAEDQuMa4YdyCE28RCLRBL50Vtz/2
+P0C1Gv3b5y/Eh7OLYXqzV1wrGNO4DN1d4SWLDYLfs0TzvMbyzm5fhV5U64JlDdWa
+55SbLnOmU3WgkMU1BZ+NrIQ66ud17RPve0VOelqBiGlfDE4pNJRLMSyaH/ntOVqx
+jQvOWHqThriO9+PbpV77L40wCqvOeQIDAQABAoICAD91KaQYe27i8okDALfmb2xA
+EPurYgzGFQ8rM2Z+d59QacAefKDs60ADJKapVmQyZj6vKIKLRLm7j0bdVcaGsyuW
+AiAs0O1O4wIUxbQsLSNpAboTmn8fiZ9izKJri0WytVy5URNYs5hgUDlNvq1nNBYI
+hFSbX1GCTOKW4LgC2gr+zzDXoCEMNnJCglZWX+svZtsyzF8hDcab5oE1gWYVfz6e
+5Z0hCJ9gDAcjXYH/JQDxhIwImA7WiIHT5Rtree4gUQHXb+B/1Vk1N4K44zWp+/ef
+l8uEg8MXwo9Rg+tUo0Q4YCi7vMGDvstHWONksMkDIm5wnGwwuAM54izJtysJp2kO
+Px6urUgQIUBV4U+neLlK1QzjZMwsF2S+5copMVO5q97OPpCueYmv/YdxBfliaDFE
+z/X3GagxPpoo2E15OdiTQrgxDh6d4hjl/VZQTDWJS/2lNpl0VgNEMisQj3ftOHBq
+a1gN5DEii5ibeBQVMw64NrqmnVcPpeQRrfBJMz5BMazv3u4mohWEnHFTzj43EaQ6
+roB57XCvvyL46avVFQ45jQOb4W6ItEN5YCjTjT3I0TLEQjIn0sOrg0IEiIldh1cD
+xgSXeVDxXCcFBpTnB4EIE8rl0wungvRFcUi+/GElW4tCLk6FfKv5dBtIJE+CosYp
+f9PIaQBj8oQtvHDeteAdAoIBAQDq7/QtDO56sZA7LNiJjZext7+6DuiDQzxmYZUO
+4KQm2CF96CWVN640fBzIOHLKGcr6S0rOnWCITnL6YGF5fnW2fIvQ36WnhHoGKg7C
+1Cbdy4zEXYQu9ajSjgTBo2hPOxLks+i6wPiy3c/P3UlVIs5nIyoi702MUJzYJwQh
+A0SfFoQ+EsBVeA5Q7n/sh9gpqt5nc4hhPTpvS+uL7Qgn/vJ3hiXemgMIy8IqtKHF
+crwgQQHW4+P4CV6ITFbNo61crDkbIKogEzSL771Ihs+k6c7hxIeIaRMUsJ53ZBKh
+abh451sIEFYc6y9YkJ/dyMFzmY0sBrpIa80OYZ3mFOuZvq5fAoIBAQC+s/KZC0vv
+agXDJ9t5Hm4a6KZ0FVmeK1KlmSgiaqqvh6vaINzMtca1np/EAyIP/6Fkm0EGzGB3
+DGMQEkdpaid3jU7uvBaZNu8kQ2HGQtbY2tUM/5YiwcgKRg8hJR7ILpnlp0S4arSu
+cBNHKGLCF4SDA7zZAVRMGZ4HaCBWfGdeIfNjX2ON268xd07/sufEJ4HJ3hfMHsoQ
+v27n23ZWbBY2jowmCrPlRVxdoxhuLTCi1VgFUfvkEXKznQHe8SJ/vBDkzt3XDRKe
+4pVUr4qbCijMn6phIkMw2PpzVF7j8qCGcwE6YmFAkdK+f3JvSQA2+jQgQwFhWFqj
+J0qwovnYzYInAoIBAQCR1VtDr7hFDv2RzfeoAu170qy/qMtp142hm8c0EfuzZQv9
+JOJXatXHHJedLXULwND/Z0dLU+N9GP1EMBmxme8l1M/RW1Jv1ssMEoVRKPHrUZPS
+vJ31rGYcNS38qRtxuyCyOH8plemK1idOR3Vi1JU87lYUk2kWxV9myWlFuMqa2hZC
+lc8v/rMcR7++qmBjFP6zRsMMYT5pob3YAM3ETfxidzIAqKdjiV/AtJmKf/sJJnEm
+3BVBfUdh4cksIwLU+M8F6NPRzzoZ9zoO0CgKnVvfRug+o8LFYBEt2T+7VG2/FxWp
+vsJFdzPPjQ6/VAPJZzJ7dr2hgNErsSqbjLbmm7ePAoIBAGiB3uHmIfALLys6zXi7
+p2VRt96H0LvwS/N6UldCE1XsSM5aEgaRW1sumalmeiVAVub2ehVKrVawUB1/luj7
+BrPqmaYVJ2FBjJ5X2t42xNzEV9suuc1EWubea+4jFJJpj2ceWneh6nBp9Paa+Dwb
+fT/7LWPS6apmo4a1lnsu48rfWi1MGhekm4bFNmLEXWTOrb692la/TMcO0a14RIqp
+4yZ0yfMTDHEJqMub1IiUdUHXHsyTmDHtKemqklrl1J0hqDRr9YCjpl+yFln5dUDv
+uVoh6dIfX6kGT4Iia3oJ/dSQc8zWGyuyfkZtO34nCFoYlbZUYg5ByDH/F1xjg/4+
+6SMCggEAWwBjczqvo/jc2KvgAnWdL++gT43HNqJKp1kE+ZzUDzE/3z9JLYrjHhEO
+5nepvXNxlKbkx+vfprv2gw3Re6Pxh/V13cpyqYI3vIZVGE4a2FbEcAAMirM3no7d
+0Nt20YSJsTtHAWWJz+gzheLcVNnqNoyEgdvnOqE8nf5buBprTU0dhM9Sc9zhbpIV
+Vzqb/Vj7Ydg6hRLth1DUz7DYCzDkvA6A6AU8CGkC3PkC+Cs3QljzdSXUM7WVfO9F
+3InBeIzg4d1zIHKrOLwfd8A0G6+B45p6lj9L9eZeRDQwoKwksL+Tiv0HwPoR+JFn
+meMmo+SiPFHNx/11nVJQtALWRl/fDg==
 -----END PRIVATE KEY-----

rust/pv/tests/assets/cert/ibm_armonk.crl

@@ -3,19 +3,19 @@ MIIDdjCCAV4CAQEwDQYJKoZIhvcNAQENBQAwgcYxCzAJBgNVBAYTAlVTMTQwMgYD
 VQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9u
 MTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFsIEJ1c2luZXNzIE1hY2hpbmVzIENvcnBv
 cmF0aW9uMREwDwYDVQQIDAhOZXcgWW9yazEPMA0GA1UEBwwGQXJtb25rMScwJQYD
-VQQLDB5JQk0gWiBIb3N0IEtleSBTaWduaW5nIFNlcnZpY2UXDTI0MDMxMTE1NTIz
-OVoYDzIzODgxMjIzMTU1MjM5WjA8MBMCAgIrFw0yNDAzMjAxNTUyMzlaMCUCFDIv
-LrSYUcq+W27wAZwp/0Pf7ydJFw0yNDAzMjAxNTUyMzlaoCMwITAfBgNVHSMEGDAW
-gBTDjB5dtNYBmKwPzqBlK6BnpXUU2TANBgkqhkiG9w0BAQ0FAAOCAgEAgvfpzZbh
-/utz4zq6/KQdFW25wK9tqPkwFut9vdsOAGMkRRcX699Rk3Km1TpgBVGRKAlsQKfS
-IMq1FtNwbKMv+ycZHXDewk/i7dd2A0eUNzbDxD/WJ7mBdUHJtzkvIKwBmU7SkwdM
-yBRA20H8xKioveDrms+MM3a4oLNRzkZI/FWkSqjCDh9lI6igZNt3J29vkcdIlu+P
-Maa7Cpwh1ELrQbwE3NVgbr172D9qzQ+/NiRlM/Hla/lqGELcUgwVgkNMBFEMo7iK
-XsWy9WQ+/0RExo7n09jk9D4tCyAizGae72Xai8IJQD4tSVNpv6ZtNHZBBKQhkjGy
-PXGM8tHC91Tr8E9CSVVOrtxVit5htxjnTkJLg/9XnoAkxGNbUFbvCm+zIOzkmlJ4
-Drvvt9W4tVfkcfILHKmy4PG/0JU/tAygpr2Hk39e/Lcym64O9gz2g0pU4On/qD6e
-91Q4822RIYLDK/IO3H30CbO25nBChZ4z6KBMWXHG8mTJ5m1IbwZTPxBlL8t47P9v
-2ce2XDkcPzYpk/wqJ4xxQYhuhV9RaJreEnnqCZ9ER7L+heoJcCZcnr56wT4mNd/a
-Kfdm0Oxm8CFCMj1djVJQ7+ghsOY3RAehQ75m2Od5BRM+Vv3gYtkzPWTkWjDUn3us
-2KwZvR+lNaIVXPlQqBlIWJvehWZexLzTkA0=
+VQQLDB5JQk0gWiBIb3N0IEtleSBTaWduaW5nIFNlcnZpY2UXDTI2MDYyMjEwNDc0
+OFoYDzIzOTEwNDA1MTA0NzQ4WjA8MBMCAgIrFw0yNjA3MDExMDQ3NDhaMCUCFAqX
+dSGI9kR+CnND4uvmc33Wb+59Fw0yNjA3MDExMDQ3NDhaoCMwITAfBgNVHSMEGDAW
+gBT+K/WumDBi4hRISudTeDt/ppiG7TANBgkqhkiG9w0BAQ0FAAOCAgEArdsPgHp0
+2QcU9se9qMZW5UMvO3WfKMXVzU39pY+fwx+HHWXTN1YwkUh1iZBrL107yFIZxQtB
+uLRnv0fNQZwejOfSW/r8VYDlu4oppgUUx2gA/NwHOBkqyEBMUZKqi6IZ/J+CPwr7
+rkzh7KlHHgFOXN0cpsddWVBm9IejeRlK/cpJpW4pRkoGCFPuLyOPh1qq6mj9zR6c
+j7ANFv08CpSxz8IJKdUi6WpjZVzHFWgNGMRFaGDumX6yjruzNz+Hl9Nj8jfiZV+w
+O0WFAe5uchVY9N3I/3P5+DxNdspymEVVpUmEemNIpjGI6CdhiC/DJBdNxF4LY95C
+nDiosjPfqKis3GGay4R7S5Ila2+kyZ2CcJl9aaw3zZ7x2uek+tES5vYFDjwTkwf2
+GHbvhkNol5Dm3Gw1yroboyH75KIdOXZjn7BBnJuTMiyl6v7mvqhR23eFykZhq8DQ
+ctexTcxn+KKQcdD0tsNCwYiQiNu2BUt3UKI7Z0gcKr7SNMD37aibCxPlwLBfA4O4
+2egxOQkoUETreTvOjNNDfG+Cy8qxNv/HwS3wcUoHLpcWvGqZvHvk7acCtyU+2u1a
+MOWThJNhDuii1wCG660VMJY8NbIPlBwYTtUosgTQWKxe77pUL1GB4vg4vAtHgAao
+3Vz3eKWkwuSeWB0ldDL35iUdpQSajna2eYA=
 -----END X509 CRL-----

rust/pv/tests/assets/cert/ibm_armonk.crt

@@ -1,38 +1,38 @@
 -----BEGIN CERTIFICATE-----
-MIIGqzCCBJOgAwIBAgIUWYLchAxfdv8uD28Im9DK+Lo8pokwDQYJKoZIhvcNAQEL
+MIIGsjCCBJqgAwIBAgIUJ8JotdjE8Uc0Yx/fkGYfEBXIAoEwDQYJKoZIhvcNAQEL
 BQAwgb0xCzAJBgNVBAYTAlVTMTQwMgYDVQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2lu
 ZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFs
 IEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMREwDwYDVQQIDAhOZXcgWW9y
 azEPMA0GA1UEBwwGQXJtb25rMR4wHAYDVQQLDBVJQk0gWiBJbnRlcm1lZGlhdGUg
-Q0EwIBcNMjQwMzIxMTQ1MjM4WhgPMjM4ODEyMjMxNDUyMzhaMIHGMQswCQYDVQQG
+Q0EwIBcNMjYwNzAyMDg0NzQ4WhgPMjM5MTA0MDUwODQ3NDhaMIHGMQswCQYDVQQG
 EwJVUzE0MDIGA1UECgwrSW50ZXJuYXRpb25hbCBCdXNpbmVzcyBNYWNoaW5lcyBD
 b3Jwb3JhdGlvbjE0MDIGA1UEAwwrSW50ZXJuYXRpb25hbCBCdXNpbmVzcyBNYWNo
 aW5lcyBDb3Jwb3JhdGlvbjERMA8GA1UECAwITmV3IFlvcmsxDzANBgNVBAcMBkFy
 bW9uazEnMCUGA1UECwweSUJNIFogSG9zdCBLZXkgU2lnbmluZyBTZXJ2aWNlMIIC
-IjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAxNqcFB9GSj+nC1PVOTIAvzTu
-o3X7bTbohEPrIDDsEcGyVzQtfagI9vkxhhGLhXxIXrkwEI4u75DeLBdqZR3KFJ3Q
-D+jHW12EWNpmSYu272CEAJeb/SBJaFbh40WbY1BsTP+3zI5QMwVTmCH5QqODD+GU
-0fDSo9Gti0yX4rxOY+54jDC77AhSlU55rYruBoIXVe4CcPUpqzZLgqB2cTJ5g7lo
-kGqc6w9pveCznVYGPfcdDt+ePGssOvrfBOJnn6N44tTRAG623BrpctXit3IAhG60
-y6CqF29BjV0RKOv09nOBiph2a3lAiKYrpAt92BETFB7KSQManUrrvWODmYEcoVkz
-vrVrB3WnCcHs6lsjQg1FcNrGcDzV9SmX0BIhM+fasxZyHWc08pr3NrRnEks7lRqY
-+TS8DAeZYJt/2M0Jr32d6Bh+WdyGFFUj6sBPtCaC2VnSkxOgKXeWf/c5EUXIQT2Y
-XEkNK9CP8Kqs8IerEIpfceelQReA5QcvNruaJNktWLKJgYTrdLdfOP0us+9JJHWc
-FH3tv5906CA+Tlm53Dk6SaRc/DB7lu94yTkcSOpxXZnximZi0GcPZYmZTaswE7d8
-HCPLhks/RkZSV2764Kl08xle65APiWZ4dM24uSyu75Izb4hrwgIA4qyMdDVQnI3c
-u6utmKUPyHoJtH26dr0CAwEAAaOBlTCBkjAdBgNVHR8EFjAUMBKgEKAOhgxpbnRl
-cl9jYS5jcmwwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAww
-CgYIKwYBBQUHAwMwHwYDVR0jBBgwFoAU+f7h8O2ttBHtwI4OZnpD9wU09GYwHQYD
-VR0OBBYEFMOMHl201gGYrA/OoGUroGeldRTZMA0GCSqGSIb3DQEBCwUAA4ICAQC5
-dH5QKZHynK7vGHOtol3brWgAWKkUVj+uqok/AUyGF5hkcXI2AVmu5nWV16Z6/c0b
-rD37YMPCCnZorQQg5g3c3H9In3NzTYWj1q2YT13yQ5PaD56vkwfPQKlmY2kMb/v8
-Y5Ho2LFjhKKOpzP77CsYMs9ZdXs6VKGZ5dSmOAOvJ4AcGaRPs3jXVz3EZFgc+ytK
-705mWrAgTYI3xcemxBTwILWAVCoqqirWrDNd3jicQo4Ks/H07RtLuVNY8kXUJEN9
-UMG7Ggzc/rTlvV/PUsJaQl8lunPDdbUBLsXE1iWaaAxmRTTQaDX8Ygq8NFZgGSrk
-E/dnJXcnJyV/5GH22Ho4JVVtADkP1wh3TKcojiDfM2WlzatSOMPdeISsUQ/D+VSm
-GuSOxPkS0wj5XUpoJz2bKvXNMH1Mdp9sMfOlkMe47iTmU5gK4PJMoj2NZ7zW9u6p
-pYXQz9LhdwoTJZBJXVYSA1q+sIIy8u3vFXEeN88FuoY8yS8t8qjwGEcKP1oojFxV
-ibj9cv87Vcd+tgXAqwkjxGQVbDZPBlL6OWCYoEluqWGnbUD1mUp2y8K99ZlzoT44
-i2ipEFyZmVPrmwgKRlz1UYDIsQvtvVw91Oi+DRNP1u+9D++Mnz2itGixHh1Hob25
-nQl1/SS4PfgMlYscbHYOfLAzOnW02FvrJZgQAQUpgg==
+IjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEArwM7pHOyjneIEu8dn/W8nHZY
+L3LOLSP4K7LDa3s2bxIOa4oFh/C0Q8RIBslyIq0bK6ggVmXBHiKirXlojQvACF9h
+qOCx0kFwXNF4CGFQ+gA/z0bs17LJbENPa9nWqpoQ6FbDlMM9RyevAQtuFKPPO6Kl
+CKBCVBGbfzzqBZNogfmq3hsjEtL+2jUpIT4WfUiDi6Azjx0hGhmAQ97N01KyjcZd
+4GuevsxFq9seuogYkEG7TmLgRGpNKRT8NhZFi+mKJP/bXvYZEb/SaGUogHiA3O3R
+0S8EQEnVsfB1ASMdpVoI0wV6XO8JKEguZZBUF1roZEPmq6CChpNpdvGuoOTCgsNh
+AsVRjz70TTZQii0ktemREOqUmFMXSNeKwPlEz5jNSHLiuJksk+dIw33YLBEMTxx0
+ckqZKJGK/DbsjKfoeMdioRl1fMy0B2a3TYprp5linnYmoXSl2B0gbdlEA37LgEkT
+tBVOw++fxlDZN8FsB6VyP161CwBA0LjGuGHcghNvEQi0QS+dFbc/9j9AtRr92+cv
+xIezi2F6s1dcKxjTuAzdXeEliw2C37NE87zG8s5uX4VeVOuCZQ3VmueUmy5zplN1
+oJDFNQWfjayEOurnde0T73tFTnpagYhpXwxOKTSUSzEsmh/57TlasY0Lzlh6k4a4
+jvfj26Ve+y+NMAqrznkCAwEAAaOBnDCBmTAkBgNVHR8EHTAbMBmgF6AVhhNodHRw
+Oi8vaW50ZXJfY2EuY3JsMAwGA1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgeAMBMG
+A1UdJQQMMAoGCCsGAQUFBwMDMB8GA1UdIwQYMBaAFHvgduY20uw75WX7Feb/jSCX
+uAmoMB0GA1UdDgQWBBT+K/WumDBi4hRISudTeDt/ppiG7TANBgkqhkiG9w0BAQsF
+AAOCAgEAV+lqzXJXlThDenbwKNHpjdckZJOLccCjtTCAHCFXvlkVh57U5naKnFk+
+njyvTJ48JurznI9PptAT8qCYKOVtTqwzb/IMnxyVA8d+g8BCfwMZ/ge+W0k5xi1g
+xIiNIkNpShOkPJ3N8EqfnoD8++owv1c0e/+LxTQi20C47QOCQ5u0bE849g5ho4cR
+383+LoBtG7jb74zyPc583h2/k6uRJuNk3zSs1qh5X2YgtKsPaufq5a3wrXyJ2I6u
+CcGjntPQfYhLd9gUDA5g2ZJU5I1wVLvLsw2WBRivZjWzUSa46aN7w8BBIyNvVbMx
+3SkSHA1o3FiOLIhCxbguTAmycveYoZzFhtAvhlRXo0S0aUSRww+5Kgmlx+2bauoM
+pCOWh0S7Q/h5LdOAVWQmLoOfSDvCqBgPMUij+kPydsz+vUMYVwPC+CueWs/kVA+s
+6lwDnAJqnO6FVrswgPWAT21ugzCMvJ7gakojHg+Qxhg9t7GCaijBTWDsqouEnSAv
+7tw6WfuEkpIQmuJQ0Biwyd1NwPjrXVHPAHdUTbZytN3cXnwFQsrMhIHRsm+nG8Nf
+793FdgD1CLjExFD6ocXtBl5hV76DF8xOM8ShmCfnliq4jdnGJnTv32oZfMy09aZT
+zMSJeoxd6+0ulpVQLvhwo0WWvutFs5H96cC6O7DS4gat8ZV2ApQ=
 -----END CERTIFICATE-----

rust/pv/tests/assets/cert/ibm_expired.crt

@@ -1,38 +1,38 @@
 -----BEGIN CERTIFICATE-----
-MIIGrzCCBJegAwIBAgIUU5pxAXMrXmWzioXpyoQoipFwsH4wDQYJKoZIhvcNAQEL
+MIIGtjCCBJ6gAwIBAgIUDakgLiiy/Zuno9U9rdut4DGbWPwwDQYJKoZIhvcNAQEL
 BQAwgb0xCzAJBgNVBAYTAlVTMTQwMgYDVQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2lu
 ZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFs
 IEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMREwDwYDVQQIDAhOZXcgWW9y
 azEPMA0GA1UEBwwGQXJtb25rMR4wHAYDVQQLDBVJQk0gWiBJbnRlcm1lZGlhdGUg
-Q0EwHhcNMjIwMzIyMTU1MjM4WhcNMjMwMzIyMTU1MjM4WjCBzDELMAkGA1UEBhMC
+Q0EwHhcNMjQwNzAyMTA0NzQ4WhcNMjUwNzAyMTA0NzQ4WjCBzDELMAkGA1UEBhMC
 VVMxNDAyBgNVBAoMK0ludGVybmF0aW9uYWwgQnVzaW5lc3MgTWFjaGluZXMgQ29y
 cG9yYXRpb24xNDAyBgNVBAMMK0ludGVybmF0aW9uYWwgQnVzaW5lc3MgTWFjaGlu
 ZXMgQ29ycG9yYXRpb24xETAPBgNVBAgMCE5ldyBZb3JrMRUwEwYDVQQHDAxQb3Vn
 aGtlZXBzaWUxJzAlBgNVBAsMHklCTSBaIEhvc3QgS2V5IFNpZ25pbmcgU2Vydmlj
-ZTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAMTanBQfRko/pwtT1Tky
-AL807qN1+2026IRD6yAw7BHBslc0LX2oCPb5MYYRi4V8SF65MBCOLu+Q3iwXamUd
-yhSd0A/ox1tdhFjaZkmLtu9ghACXm/0gSWhW4eNFm2NQbEz/t8yOUDMFU5gh+UKj
-gw/hlNHw0qPRrYtMl+K8TmPueIwwu+wIUpVOea2K7gaCF1XuAnD1Kas2S4KgdnEy
-eYO5aJBqnOsPab3gs51WBj33HQ7fnjxrLDr63wTiZ5+jeOLU0QButtwa6XLV4rdy
-AIRutMugqhdvQY1dESjr9PZzgYqYdmt5QIimK6QLfdgRExQeykkDGp1K671jg5mB
-HKFZM761awd1pwnB7OpbI0INRXDaxnA81fUpl9ASITPn2rMWch1nNPKa9za0ZxJL
-O5UamPk0vAwHmWCbf9jNCa99negYflnchhRVI+rAT7QmgtlZ0pMToCl3ln/3ORFF
-yEE9mFxJDSvQj/CqrPCHqxCKX3HnpUEXgOUHLza7miTZLViyiYGE63S3Xzj9LrPv
-SSR1nBR97b+fdOggPk5Zudw5OkmkXPwwe5bveMk5HEjqcV2Z8YpmYtBnD2WJmU2r
-MBO3fBwjy4ZLP0ZGUldu+uCpdPMZXuuQD4lmeHTNuLksru+SM2+Ia8ICAOKsjHQ1
-UJyN3LurrZilD8h6CbR9una9AgMBAAGjgZUwgZIwHQYDVR0fBBYwFDASoBCgDoYM
-aW50ZXJfY2EuY3JsMAwGA1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgeAMBMGA1Ud
-JQQMMAoGCCsGAQUFBwMDMB8GA1UdIwQYMBaAFPn+4fDtrbQR7cCODmZ6Q/cFNPRm
-MB0GA1UdDgQWBBTDjB5dtNYBmKwPzqBlK6BnpXUU2TANBgkqhkiG9w0BAQsFAAOC
-AgEAo+WGpxIz8s0UY8gOlCYeGr6SRYbgH7bcFVaV2fJf2eacv/YSaryc4PNwFnO4
-+e/LvE8908xq57Kl0xpCzp4bO941/aJkJuyr59TOe1nhcH0z0Yik9Dt1zRxxy0XO
-uVUSYuYEmKlWNgsWAGCmcHAz+wQxn2qjpD8k/GAe8Rr7O7r/EnSt6HvVKt3dl+zx
-rv88gKKJKWrbn7zn4/c/E3XG9RxunCsYGtOfUfk8tGeWtemoGNmXlCLCmKR4JKjk
-mEEM16veHHdD5k9MPj6YQH/jh1pDOD11o8GlOd/rEQCpFWeg23Z0uEq5j+qr1FI7
-Fjk4HvTtwGU7QXn+QV9bSjhE6svdWVbmADwb3Z/UU//UzgEAZDPb/n4cC95vk/Lt
-Wwq5MzHBIyeHladxzLE7LuVA9dmkv7dnST7L5ZAqQYcT5c7vxkrTHD53ZTojPMD2
-Lmd3ZIcRIdFbPChY/+ajuBaNpi+gBwQaQ0J4b70fKW7oUxOpgSjh12ACNOYmVRWb
-sCzSiIaxkD0pvIYLgNXcY2CekuWxO+4DLGNGPPAHeovue0yRgNKTC14AHsLWh04c
-aWdomQToTHFxJcoVk2LiE5nwg5Xu8BoNuMag1jl/ZQVsl4LrL4bItwplWdH/bSyi
-9VFeSwPGTiNverBtv/aF4q7O6JWB7/zUh2GqYQcILcaIy4E=
+ZTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAK8DO6Rzso53iBLvHZ/1
+vJx2WC9yzi0j+Cuyw2t7Nm8SDmuKBYfwtEPESAbJciKtGyuoIFZlwR4ioq15aI0L
+wAhfYajgsdJBcFzReAhhUPoAP89G7NeyyWxDT2vZ1qqaEOhWw5TDPUcnrwELbhSj
+zzuipQigQlQRm3886gWTaIH5qt4bIxLS/to1KSE+Fn1Ig4ugM48dIRoZgEPezdNS
+so3GXeBrnr7MRavbHrqIGJBBu05i4ERqTSkU/DYWRYvpiiT/2172GRG/0mhlKIB4
+gNzt0dEvBEBJ1bHwdQEjHaVaCNMFelzvCShILmWQVBda6GRD5quggoaTaXbxrqDk
+woLDYQLFUY8+9E02UIotJLXpkRDqlJhTF0jXisD5RM+YzUhy4riZLJPnSMN92CwR
+DE8cdHJKmSiRivw27Iyn6HjHYqEZdXzMtAdmt02Ka6eZYp52JqF0pdgdIG3ZRAN+
+y4BJE7QVTsPvn8ZQ2TfBbAelcj9etQsAQNC4xrhh3IITbxEItEEvnRW3P/Y/QLUa
+/dvnL8SHs4therNXXCsY07gM3V3hJYsNgt+zRPO8xvLObl+FXlTrgmUN1ZrnlJsu
+c6ZTdaCQxTUFn42shDrq53XtE+97RU56WoGIaV8MTik0lEsxLJof+e05WrGNC85Y
+epOGuI7349ulXvsvjTAKq855AgMBAAGjgZwwgZkwJAYDVR0fBB0wGzAZoBegFYYT
+aHR0cDovL2ludGVyX2NhLmNybDAMBgNVHRMBAf8EAjAAMA4GA1UdDwEB/wQEAwIH
+gDATBgNVHSUEDDAKBggrBgEFBQcDAzAfBgNVHSMEGDAWgBR74HbmNtLsO+Vl+xXm
+/40gl7gJqDAdBgNVHQ4EFgQU/iv1rpgwYuIUSErnU3g7f6aYhu0wDQYJKoZIhvcN
+AQELBQADggIBADiZzHAU75igew+ovjsVjbHNsAyIJdVBrob+zUj6lFTzFx2ulxZP
+BjUvNqHtpUz+SFEV9TpVNw9yM+FeSs2j52BLjbcqYPtQ/nrhwXovCU9cmBPMt+SZ
+jJI29MWB4ibt+e+dVyhD1poduK8IGlYhuyTDzddfA25yecXOD/T35J1nf9ub/laK
+kt6lzUczv9moucH0AaPcuxyDQS8XXPwUup+ErB7V4sQSnkMX3YNDz6PdSglx941k
+nWZD2pJRIGqFcpdJGt1a5rWN69rX5z4UAnCIbxu8uX3rOFQ8DrXPiL2Q51JaBP48
+vJjxAdmeHxsnIol93RWo4WSibsX7gZGrZC66saBnXUpq3a7TjLCsvggZaPJDmfJi
+D2QCWD808EOnPo0JCLId3bHevodNm0Iw25pZLqCkqZQj6VMLs9Ecw2Q0sfQj9d5U
+rOQr+kTWX0Aceg06q1m5etPipoXvdOXRSfkCpL1a1LDQDwsss1H34xICSGxWNiUX
+3Xsg8Zj7NS9ikcVqsCCx/TY0jj9XjNUMx50JdYoEoVQ3FJjaS1EDaFGAgSRuZZZk
+t3joL3SnF9COcFDCYEqLhU/MyEGg74ndbb38B11DEM31gEjr1tM8Svn2Em/ALqdk
+JpE6OKkzWEJT1x19ZPJS5Pt5BZoHU/A0ynXz0We5j8bmAB8e4I9TmTJO
 -----END CERTIFICATE-----

rust/pv/tests/assets/cert/ibm_invalid_hash.crl

@@ -3,18 +3,18 @@ MIIDVzCCAT8CAQEwDQYJKoZIhvcNAQENBQAwgcwxCzAJBgNVBAYTAlVTMTQwMgYD
 VQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9u
 MTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFsIEJ1c2luZXNzIE1hY2hpbmVzIENvcnBv
 cmF0aW9uMREwDwYDVQQIDAhOZXcgWW9yazEVMBMGA1UEBwwMUG91Z2hrZWVwc2ll
-MScwJQYDVQQLDB5JQk0gWiBIb3N0IEtleSBTaWduaW5nIFNlcnZpY2UXDTI0MDMx
-MTE1NTIzOVoYDzIzODgxMjIzMTU1MjM5WjA8MBMCAgIrFw0yNDAzMjAxNTUyMzla
-MCUCFAUi4bhk78T24IBu9CEi9kegwxmXFw0yNDAzMjAxNTUyMzlaMA0GCSqGSIb3
-DQEBDQUAA4ICAQCH2paQrJTqVzDjBOixREnhV0Ned2SHHwuIxZPeA1LrA1MR8KeY
-RCNiBxaOg2fkIe7WbPbiFVmosRq1kMjOJrgajvI6CG4is5F37KhW+Q/8siNcc8y3
-oiu+b8O5wp7vfUq9f4bxh78ytS+cHJpxHLoYzlp1f6aha2x2kUqDQzEf3ghIXEAN
-y0Jlmn2OqeZ/cCnWG+QF8Yb9OMlnR6rTpwk4ml0TvMa1/LhBUMj7vva0BmXuTunW
-eEr/wxmTMyJsRKNXgqRDLil+hnNzIP7HOmofyad9dyHv73gOkmu1GizwSB/AEVoB
-J5N/LUeCh4cG3YJYYpw7HaAHUnka2SDiuL3MD7VD5ONXiwcZIplT7I9vJHaBimoz
-kUTr3BkzFHas+KiPuGLm25Pxc0G8mVZl0jzoIJe0JS4bi+NCqeQ3C5s4WOZ476Bs
-5PSWbkJ8GwUxtXciOxHVKvgnBkc55bng2VEJlRLDfERdcTa1yobvJBRNZ8J/gDu5
-aWvRJs+cQ+1Bj4oq3ejV+Be5UFEVEFfQd4wFixvZcr781aDhYg744Ig0n3oZE0pg
-ye9V55q5yra6K1eertb63y1WvIrpfvNBM5p7mFbYBc5vnoH44mAhwbsCL5Mkjcxp
-0XjPSUsE9OyORtN92YLrZztEXIZmjw7otzQCQmcj/0ri3X+M1RLUTh+BVQ==
+MScwJQYDVQQLDB5JQk0gWiBIb3N0IEtleSBTaWduaW5nIFNlcnZpY2UXDTI2MDYy
+MjEwNDc0OFoYDzIzOTEwNDA1MTA0NzQ4WjA8MBMCAgIrFw0yNjA3MDExMDQ3NDha
+MCUCFEUGSsX07n9B+N1dLiXAWhRk8cHzFw0yNjA3MDExMDQ3NDhaMA0GCSqGSIb3
+DQEBDQUAA4ICAQBKbXQAoFRPW3jaXbgeIAfplMvM0UEMrd/YotBOFNFymE5C1Twx
+euVj0VQ7yfhmmnBOx9Cm+rUay9MBF9mJb+Bf1JdLCUNb/2OmPIHqwkX3JHGxtFlC
+tE0Uwee+VlRXlG2ASCxhZ46snQaa3MkTgcfFVLr+RK4QkW/7II1bGbkU4XNMoSLb
+VuUla+loKUVikA3Uxw+y17QJUlW8dWrGGhWVINDggK8drlv4NS3BGyp+DrV71plA
+sO2Bte4PlnFjIwp96xlXThKEtB3E29T2n8E2QRU5hqyP+YaD4FJc7qfiLzJxlhtC
+bQuVWeFtpAd9o3ArUhYZyVwRtXRdeU0PzE+uPbInT8ZJotF4iZsx3xIu7f3SEJUx
+QTrv8cYjsQBViAbx5WiZdz4hLnzZjo13hcjtHuvQ4f7TGFKH8M/caYZlvuzwDQnN
+hRtffqYF8b1bx63yQhxlHzKc169TC6/+SCwd2t3zahh+YImjFGPxKrCiwtwHZMjT
+0ZT50PMpkn1PWtfZZZMc0f8ny57AJXF73znAnYs3olNvMYsJajcmhHOMIcTjKflG
+V2AvMOuIb63nOtPHPTxB36TlSe5mE27vDxoMN7aoFXrvtMeYC/6kpcgLbAbkxtZN
+fhC/hxB/8r2EuByMGxi39tqU1QF2Ey4EIXSzferg3Joen22kVHnrx2W5Iw==
 -----END X509 CRL-----

rust/pv/tests/assets/cert/ibm_outdated_early.crl

@@ -3,18 +3,18 @@ MIIDQDCCASgCAQEwDQYJKoZIhvcNAQENBQAwgcwxCzAJBgNVBAYTAlVTMTQwMgYD
 VQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9u
 MTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFsIEJ1c2luZXNzIE1hY2hpbmVzIENvcnBv
 cmF0aW9uMREwDwYDVQQIDAhOZXcgWW9yazEVMBMGA1UEBwwMUG91Z2hrZWVwc2ll
-MScwJQYDVQQLDB5JQk0gWiBIb3N0IEtleSBTaWduaW5nIFNlcnZpY2UYDzMwMjMw
-NzIzMTU1MjM5WhgPMzAyNDA3MjIxNTUyMzlaoCMwITAfBgNVHSMEGDAWgBTDjB5d
-tNYBmKwPzqBlK6BnpXUU2TANBgkqhkiG9w0BAQ0FAAOCAgEATxMm63G11oaOvRm9
-nb20MXyXaqejudryJLcKSAUNNcvVpfj4zO4iG7Eiipq5svrEHmb8aNELKb7eHVY0
-uT5V1hd3xELkQqVS8rxcD2rQfoE8B3kkeuKtgI0yxC4rkrt8recajh8au/FSoknq
-Ts1CKsc0ghFo01gIv4fgWC7eWFrfw51T/bZW4AN1QsAT0wEqcYjuDTZpwXU+8JsB
-czQ1wWoKJPCAbh6ZOd8R/DEywffWSVjS+8hrmIc6TAwfu7SOBSvDLh7kKZeEgZ6Y
-lwp1R9EcRBYLlyclg4E7w/WL2DY426Lo+0aSIWcFwGbU3kWwFNXCKIpYvVQZ4QPT
-2lZfuRVMe1ZgRdPRz5wkiEYYIGFoe3cOC16jHGi+Vs9JQX/EgoRiy/YYxZdckuxA
-961S5h4bbYyB9aNH1vNn9Kp2r8oDGD6xucXM9cTXDsXvLLSFUxcFqoOdixYqFzX+
-EsZM5A33pMq5zKLkRD8JI2lP7nT0wdyaDjuH4ION7y90tJiq1Q1GPfmJ6+mp/3/I
-QF1Mh8axL59Rgz/KrzszP4+kn3NuhvKQOjL3QDo5TSXEmsdjERFHsmOuTwB9E4iH
-EIBu7bz9GfVMDUL8LSOK8Tq9Gj9Zzy8kYe2BuwNOTTDzQAUnPZK/m6p1wm/K3vjL
-2pjdFJmfRBtPNSRXL2hY2MYdZDk=
+MScwJQYDVQQLDB5JQk0gWiBIb3N0IEtleSBTaWduaW5nIFNlcnZpY2UYDzMwMjUx
+MTAyMTA0NzQ4WhgPMzAyNjExMDIxMDQ3NDhaoCMwITAfBgNVHSMEGDAWgBT+K/Wu
+mDBi4hRISudTeDt/ppiG7TANBgkqhkiG9w0BAQ0FAAOCAgEAYeAy0pax5jvpmqv3
+uE2na8vzXGWNVcTJKNF4o1k5jKGUACQnstTR8TnInHoMLBnpIAeKU1NDSN5gFsuW
+n8DJ28qBZttN3I24g7WFTudit8Sf0xyLgsFv9NERSPgZinxmf8U1qjlN/0yc01jr
+9CdqnEwFfAHr5vRlEC8m+NlNzWG4s6k7jqVqbwCftS4un/Nsu04UpE6PX23WJfDz
+FqzCbx97c5mRyFO4Ytn/tf/1H4BhVAtfotyH/QYyngK+C5avL8JO1glcwW0XDCBC
+R7CdHjYnqOhX2YC6Rn6i1WoOKK/HwCoebFWIU+F/RyDLpxq3ilA+8MU1apbEpglb
+NFfcfyvO2YQE/+9FdnH2VV2hhfNaEal3XEdSh7xINNCWWS5OJDRyL82oFSKJp4te
+2nEPJsSunv9s2lCjwHkowzA0VIwHktZAt+0OhGsqSCjRbU0BH0JD440uTA9ELkz+
+cxra2DFYgbwqnpxjdsuosOk7F4TWAdhRipH1eSMTKY0rLOfRGSGbAf7fC2Uh2SW3
+oQ8dNCuU0qb1pj2SPwuLtS0Q4nwmOqho6xFW4Jc38wTKWeRwmI2mBRQuBWzkwrkB
+wC0ZoL/ZyDg/MBpopiVLzjFlQw7VYUaTyVLZ0ZCOsauk01cC8XGLRz1he5W78JQb
+AF50RpPHtXaeHvLNROKzW1owy9Q=
 -----END X509 CRL-----

rust/pv/tests/assets/cert/ibm_outdated_late.crl

@@ -3,18 +3,18 @@ MIIDPDCCASQCAQEwDQYJKoZIhvcNAQENBQAwgcwxCzAJBgNVBAYTAlVTMTQwMgYD
 VQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9u
 MTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFsIEJ1c2luZXNzIE1hY2hpbmVzIENvcnBv
 cmF0aW9uMREwDwYDVQQIDAhOZXcgWW9yazEVMBMGA1UEBwwMUG91Z2hrZWVwc2ll
-MScwJQYDVQQLDB5JQk0gWiBIb3N0IEtleSBTaWduaW5nIFNlcnZpY2UXDTIyMDMy
-MjE1NTIzOVoXDTIzMDMyMjE1NTIzOVqgIzAhMB8GA1UdIwQYMBaAFMOMHl201gGY
-rA/OoGUroGeldRTZMA0GCSqGSIb3DQEBDQUAA4ICAQAGD8ryV/GUC+s4qfqchMZA
-QYYOBcV7lS9i8zFrdB7UJuhCL/gXzrmldFsi6hW95PBNBtADT75UQ4JzNNVKYXWe
-wTbEOG54N7Ff4LdbbCRNjqpyOkqQgRWZOgiTeHSeiNLU+P98HZVKFIfiOS6Rs6zB
-5UNdYwCGz9kkeiR7xSpp0z86jI8WSxHR6e7CH78Ax/9dpGAyKYYj8LY0l7igxlIL
-yRgu0S81VsprcHKuGp5wcnabOWO7lEUCTFbYa7Cgc1+avUl1vaCmMqUsvydurCU+
-BCN8Zhc7noOXm0AE+58r9yy30aW9n+NUmP7uX6Eibb5NXtVZRVe83Ltk2Rbi9HRM
-hkcO0X37mXu+jcqw714i/r0mUsfGtC54IRMCgyIgWJ3TDdJ9ORo0rkrYRXVzKHdb
-0nqXEsrYecaCNcnx8iygC2YEwAN9WH8cvvLTJQcL+j57xcJVqOSbhXTEE5LfiHpa
-DO+dc9A+THZNO+o8GEZ3teTxylOVctiO9CkUkICmVZ9VDA73qOzHI8DJxpCAwT0I
-whm1QfCROAXYFW9enTuCGDZGPoyTf+tVrAGLmCWLewBV6W3z+7OBfNomktuI4Z0+
-opvwIJwYX3emeZ/5gDuYmwnvNYkC0GRQ/994430b/4Rssv32SCjToJ+Ko5pz4x18
-YUtbQcKxpJzRDSkccck83A==
+MScwJQYDVQQLDB5JQk0gWiBIb3N0IEtleSBTaWduaW5nIFNlcnZpY2UXDTI0MDcw
+MjEwNDc0OFoXDTI1MDcwMjEwNDc0OFqgIzAhMB8GA1UdIwQYMBaAFP4r9a6YMGLi
+FEhK51N4O3+mmIbtMA0GCSqGSIb3DQEBDQUAA4ICAQBKQgBu84t7JNb8EJLt6MBH
+zjDSgKBVaSFFoeT1iDcmfRaDJL5Wt2OFRQ9i9CePkxB4Y5jeFN4V4aXwVhGpwt4j
+UNhASV69endYv0CYL3km2i0i/jzt3rDGZdVCoGPURf38psNQxtqvgDZZstBnB3pl
+hC+w2dYzvhVj4vg1qPnFo4wFy8rQRRiwHAzdc+2FtOgRuWKrxF3RW/l5pfah//Fc
+wyiADMaR75A0jGZH3GrywqED+umgQpiHSCQWOD5vz50CFcmtALCPNCGmugcp63QX
+917Y1CMX6cPxoJDymRvxo9HRf2cUKqdckFau23mCArKT/8Xqy/ywG2joLrvXba6m
+8MminRSxnnC734GzeUd9Xxi4gFCiGT6fHtOMMYJVqQvHFu/XunuB9E0KRrygwyaW
+B9S9jh8aQD8lNQkGn7D6ZJCKDA/EJ3TbM8gzeFm3PcWL2ILVF/q37uNIDZqD68y2
+VRqCES092LtQobCKWRAonakquEuoxXQs0IQwEZPvfqgKrdRn7CamfUrUeTavruwa
+EBonHXB/54AzCDQAfg+w52khRtp+KneuEpX7ziNOAcyXs6E3sIxUNpxyb1gamNz9
+hmIXox4SNp4BSUt/j0vIl8sh4gqIWhBQRQbwxfkfM8YA2VCMw9LDzlB32DqzQVRz
+m3ODFR/ovfHNzVrl92490g==
 -----END X509 CRL-----

rust/pv/tests/assets/cert/ibm_rev.crt

@@ -1,38 +1,38 @@
 -----BEGIN CERTIFICATE-----
-MIIGsTCCBJmgAwIBAgIUXvZ6XWXXrTAFn66B61xZNya2iYMwDQYJKoZIhvcNAQEL
+MIIGuDCCBKCgAwIBAgIUVcsO/MQH8Fo8eO68XR0BBOE2ZPYwDQYJKoZIhvcNAQEL
 BQAwgb0xCzAJBgNVBAYTAlVTMTQwMgYDVQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2lu
 ZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFs
 IEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMREwDwYDVQQIDAhOZXcgWW9y
 azEPMA0GA1UEBwwGQXJtb25rMR4wHAYDVQQLDBVJQk0gWiBJbnRlcm1lZGlhdGUg
-Q0EwIBcNMjQwMzIxMTQ1MjM4WhgPMjM4ODEyMjMxNDUyMzhaMIHMMQswCQYDVQQG
+Q0EwIBcNMjYwNzAyMDg0NzQ4WhgPMjM5MTA0MDUwODQ3NDhaMIHMMQswCQYDVQQG
 EwJVUzE0MDIGA1UECgwrSW50ZXJuYXRpb25hbCBCdXNpbmVzcyBNYWNoaW5lcyBD
 b3Jwb3JhdGlvbjE0MDIGA1UEAwwrSW50ZXJuYXRpb25hbCBCdXNpbmVzcyBNYWNo
 aW5lcyBDb3Jwb3JhdGlvbjERMA8GA1UECAwITmV3IFlvcmsxFTATBgNVBAcMDFBv
 dWdoa2VlcHNpZTEnMCUGA1UECwweSUJNIFogSG9zdCBLZXkgU2lnbmluZyBTZXJ2
-aWNlMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAxNqcFB9GSj+nC1PV
-OTIAvzTuo3X7bTbohEPrIDDsEcGyVzQtfagI9vkxhhGLhXxIXrkwEI4u75DeLBdq
-ZR3KFJ3QD+jHW12EWNpmSYu272CEAJeb/SBJaFbh40WbY1BsTP+3zI5QMwVTmCH5
-QqODD+GU0fDSo9Gti0yX4rxOY+54jDC77AhSlU55rYruBoIXVe4CcPUpqzZLgqB2
-cTJ5g7lokGqc6w9pveCznVYGPfcdDt+ePGssOvrfBOJnn6N44tTRAG623BrpctXi
-t3IAhG60y6CqF29BjV0RKOv09nOBiph2a3lAiKYrpAt92BETFB7KSQManUrrvWOD
-mYEcoVkzvrVrB3WnCcHs6lsjQg1FcNrGcDzV9SmX0BIhM+fasxZyHWc08pr3NrRn
-Eks7lRqY+TS8DAeZYJt/2M0Jr32d6Bh+WdyGFFUj6sBPtCaC2VnSkxOgKXeWf/c5
-EUXIQT2YXEkNK9CP8Kqs8IerEIpfceelQReA5QcvNruaJNktWLKJgYTrdLdfOP0u
-s+9JJHWcFH3tv5906CA+Tlm53Dk6SaRc/DB7lu94yTkcSOpxXZnximZi0GcPZYmZ
-TaswE7d8HCPLhks/RkZSV2764Kl08xle65APiWZ4dM24uSyu75Izb4hrwgIA4qyM
-dDVQnI3cu6utmKUPyHoJtH26dr0CAwEAAaOBlTCBkjAdBgNVHR8EFjAUMBKgEKAO
-hgxpbnRlcl9jYS5jcmwwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCB4AwEwYD
-VR0lBAwwCgYIKwYBBQUHAwMwHwYDVR0jBBgwFoAU+f7h8O2ttBHtwI4OZnpD9wU0
-9GYwHQYDVR0OBBYEFMOMHl201gGYrA/OoGUroGeldRTZMA0GCSqGSIb3DQEBCwUA
-A4ICAQBlx15n00tEAP8moDUehCtLLJx7CCG/V7gcldTZACXpOYkcuRcKW9GlXqQv
-N30rTZpIZv3XIQEhhWhMJ3dqJRC0l2CbNlrIcM9t5p7GrYS/I/HGamKIU09jfud2
-1/FimjvBOQKr583vTLL0kr3Aosd3S8jHGA7Clal/85SntQN0kDxnceo01aCUhnxg
-Lkrd2+N0wPYGW5DZR6jk4Y/GiOO+q/ANO+tm4szT8RNwC5sNectpaI+ZRNlUHCdM
-DtZO5HkBADQ7PdZ2x51gliS5l9w7obFY62TG6LgtKFJgqEhqsHMIp+/OwmKbpP/p
-urUDJFCZGWD+lBkaxyy+VsPlvddU7gnXSm0wXoCxpXerRwWFb9/Kc5Q+kQB4nCkv
-bHm/zAkhjoRSjWYPcLL3F/9P858W9QlkhNdcoq73EIuc3FHUMdQUm+rjxGxfO76h
-fXoR2uBGlESO+gKL2iC9E7KKB+o07hdmafEnE8mGTRcGmVPp8e5SS7LfN8lfHez+
-3gBo2/lW1+2wBmBNIeBkkBpUI69DmNZvMliGNl/3LAIR/slQ6ZYXR/2dLeyhqwRt
-QSj5e6Jw2fg3ekG11R98OGoP3ZC/N1dTTh82O571ZBGxIWA6zPDrWj7tX0oW+JK0
-Of23BiH+4sex36HshqiyZ/faq4AtO62uII5mRQzlAwE2QdXI1g==
+aWNlMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEArwM7pHOyjneIEu8d
+n/W8nHZYL3LOLSP4K7LDa3s2bxIOa4oFh/C0Q8RIBslyIq0bK6ggVmXBHiKirXlo
+jQvACF9hqOCx0kFwXNF4CGFQ+gA/z0bs17LJbENPa9nWqpoQ6FbDlMM9RyevAQtu
+FKPPO6KlCKBCVBGbfzzqBZNogfmq3hsjEtL+2jUpIT4WfUiDi6Azjx0hGhmAQ97N
+01KyjcZd4GuevsxFq9seuogYkEG7TmLgRGpNKRT8NhZFi+mKJP/bXvYZEb/SaGUo
+gHiA3O3R0S8EQEnVsfB1ASMdpVoI0wV6XO8JKEguZZBUF1roZEPmq6CChpNpdvGu
+oOTCgsNhAsVRjz70TTZQii0ktemREOqUmFMXSNeKwPlEz5jNSHLiuJksk+dIw33Y
+LBEMTxx0ckqZKJGK/DbsjKfoeMdioRl1fMy0B2a3TYprp5linnYmoXSl2B0gbdlE
+A37LgEkTtBVOw++fxlDZN8FsB6VyP161CwBA0LjGuGHcghNvEQi0QS+dFbc/9j9A
+tRr92+cvxIezi2F6s1dcKxjTuAzdXeEliw2C37NE87zG8s5uX4VeVOuCZQ3VmueU
+my5zplN1oJDFNQWfjayEOurnde0T73tFTnpagYhpXwxOKTSUSzEsmh/57TlasY0L
+zlh6k4a4jvfj26Ve+y+NMAqrznkCAwEAAaOBnDCBmTAkBgNVHR8EHTAbMBmgF6AV
+hhNodHRwOi8vaW50ZXJfY2EuY3JsMAwGA1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQD
+AgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMDMB8GA1UdIwQYMBaAFHvgduY20uw75WX7
+Feb/jSCXuAmoMB0GA1UdDgQWBBT+K/WumDBi4hRISudTeDt/ppiG7TANBgkqhkiG
+9w0BAQsFAAOCAgEAoZUAXsNymHomPOnSXNZB6btIiESEsJnjZwqzPM0Pe1irRDFn
+JJKa/TEFsAFDddRpY01gLZZhDk9Ps+pwajRDTV49hFPt5dEtNeSLZWM2eYP9249D
+ntBeq1VvmCkFXw10CfjrDMov/cuTX9vC66j+wFhjffgJXUJaGJ1mPZkDdBVUN80r
+EtunvqilGXM5EsVQaehoWuz+xKezj2527KUmprcTrmPviGrKbSE5BRXAo1kTHQ2J
+9utZWmocQ3z9LEv5DrF1nM6Mrd1lJpG99yXRvEbCVr6EyU7nvS33ZDIYRDiDuTKV
+EoyEV+jHFKIN+2RO5Dnr7PAnBfjVu15DtyVYKXdCt6Yz7C6GChXPayKPjeYANhVI
+0Hpx9vhfHwKreHzFMjNdsNpKjZ+zG+QFNkIVnLbSmGLyVSgYZd0rY9Se9WplEChj
+2ogNByzz6UUW4Fei6fTPvVw3yt2kkRVmqPUnuguKeGlFm8rOU46I4wyrD96GkH0Q
+NQimEQtHwAX52ZgDcJv/xMDDrxek6fv+BEHRo5bw0pgfbB4lW9irYa3scxOrlMVp
+4Exo4ZJ2D0pbGnPavrJLBLR4DlLegX911HV02Npr3Cu+7WA936QCJOReuKfby3wc
+m6DbB0p0A4WIcPFjNyFh2InYICcuwWoDWn5fKe038IL8elgvJvpqEcXEygg=
 -----END CERTIFICATE-----

rust/pv/tests/assets/cert/ibm_wrong_issuer.crl

@@ -3,17 +3,17 @@ MIIDCTCB8gIBATANBgkqhkiG9w0BAQ0FADCBvTELMAkGA1UEBhMCVVMxNDAyBgNV
 BAoMK0ludGVybmF0aW9uYWwgQnVzaW5lc3MgTWFjaGluZXMgQ29ycG9yYXRpb24x
 NDAyBgNVBAMMK0ludGVybmF0aW9uYWwgQnVzaW5lc3MgTWFjaGluZXMgQ29ycG9y
 YXRpb24xETAPBgNVBAgMCE5ldyBZb3JrMQ8wDQYDVQQHDAZBcm1vbmsxHjAcBgNV
-BAsMFUlCTSBaIEludGVybWVkaWF0ZSBDQRcNMjQwMzExMTU1MjM5WhgPMjM4ODEy
-MjMxNTUyMzlaMA0GCSqGSIb3DQEBDQUAA4ICAQC1oMFXyJ2mAz0el6drt4KtH38d
-FfDvsjc6hTgiPbmQW4NmLuSKnNLOyOulsRaV7Kl7hxQpd+Gyimqbtb1ObeqLvnyb
-W5kX90k94l8M/laZT1mZm39AGR8xW8HDtuJgwliI7RujX6iWuyrJCxM4qpAHe0Jw
-GGQd7ZlzEZ/4xMsZV0lPSsA9CPUn4HyZ2FWj3DJjfXloEOu+krcpmvmL3EROUi/h
-F6bsViKRmoQoe5GJFLdG4eVSgc9+ejaM23n8C0tmAhz7FKOYOqU7pS9+hvCyJ2Ul
-c8S3V7hzTlz1G4AJAeSJtCnV/hkpt+yj0eQa0Q92I0NZY3UWT8dOMZUxpHO91Th5
-4nfaF6FVSO/AQcpr4FPElYObp+RigqWf44v3vrriHTYi9QntKaNZq5XLgx8EkgBx
-1dTM7mDJ9W21ZWGEbRtLRaKt71RVsVKVLh5CPQrFEzENOTuy66QD26LNC2BfE3TJ
-tsMgjm14Fm1mC91roj7sOsO3MUl4YKh6cdKFtfryWr5Du+7x9/6vjabuay/BopC9
-BF/q8ITHh5Shs0h9OpOeunGFbcTnYOSgOpDLwC4++hur8p0BzClJkt2Z4yZGuKe+
-lh66PA/UkHtC3E8NDxVRkd+NsejSJUzRR0+1ruEoDEGP4jZKL83UpOFjIWGlIBsM
-2gwwqV/LJsywfW1kFg==
+BAsMFUlCTSBaIEludGVybWVkaWF0ZSBDQRcNMjYwNjIyMTA0NzQ4WhgPMjM5MTA0
+MDUxMDQ3NDhaMA0GCSqGSIb3DQEBDQUAA4ICAQAFwmSuaTaF4COW7Ge+C/SIp2Eb
+2oOMQIJlczoi+1SoI+M2TmOcUXdbYeG6lZb+3YL+ez9X4Vay+b1HQDCb7+HwlmyZ
+rzrXxhdr/yqr6wQsXklJxoMpCJ/H+rjGETlkKxOhVQ0+Q79FodHBIe2YPOdOPY+a
+/pC3zOqYGJ+sHvussBfEvL7jgIOBejuRcpNQKX7USHtCAWuegK3zuiWDPsQjnQ8W
+HOAvksZm6QCVCh1IoXjPnFMW5Nki7Q0IFLtpgSbfDEXF4jU25c9TTSl2sRyfofW+
++6W6tM8TTQNbebGgYC3FyOkh+rG5jj+jURHvjCDOJD1YbYpUz/azi9dil1KxSkNx
+/ZRH7qe2K34s8EFTpz2MYBua+lnqiOJ7KeHq8wcoHW/bNmzg4oRmwjaHpoX3/2UU
+ea9jrV1Ibtf7wP/XXS6AGEsSPs4IZxs4LOwVqLnjgucpXVJetVxjkk33kKgDk3gg
+FtNuCxD6Al1amCnjm9BOJM05kdJCuvr+m2Z0Vb7rEpdGhM7ngX1iPXA+Uy93S0hW
+s93P39HJuv4PKL/Cy3KhRehEM04Rdb5vfmL7RADdbILjg3weUCKijPfLC58rUBbY
+ApO3miOP0UdR0hA44x0hcL6Y2NTavkgRRsT+FLWIr+McbO1//zErmR+VDHM3880O
+pFGVx3Bd1vIpMaDGxw==
 -----END X509 CRL-----

rust/pv/tests/assets/cert/ibm_wrong_subject.crl

@@ -3,18 +3,18 @@ MIIDUjCCAToCAQEwDQYJKoZIhvcNAQENBQAwgckxCzAJBgNVBAYTAlVTMTQwMgYD
 VQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9u
 MTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFsIEJ1c2luZXNzIE1hY2hpbmVzIENvcnBv
 cmF0aW9uMREwDwYDVQQIDAhOZXcgWW9yazEVMBMGA1UEBwwMUG91Z2hrZWVwc2ll
-MSQwIgYDVQQLDBtLZXkgU2lnbmluZyBTZXJ2aWNlIEludmFsaWQXDTI0MDMxMTE1
-NTIzOVoYDzIzODgxMjIzMTU1MjM5WjAVMBMCAgIrFw0yNDAzMjAxNTUyMzlaoCMw
-ITAfBgNVHSMEGDAWgBTXVfLQH2D0KccIHhK6M5MRTITvtDANBgkqhkiG9w0BAQ0F
-AAOCAgEAkHC9VxzSFGrY4NWoMLkunjaRQ5qmc4+3PFDiZLaGQua5QMJixMo+QIp4
-RfCLAkvI4VzMdoJXhl4+sV0mocn1HWDBxFUwfsvV4h84o8bEUK+bizrFsEoN58R0
-J3yfbikgj4P7WFQdU7p7bbAkmoKejt5+gu5etV2royIh2mjckCN7WnYzvhfRUBYz
-v+93R1usMMQIVId6l6k4DuBqaFyip8AKXVoXj4KbmwXZ8n+ILd5gWV3WKYo/ffCh
-h2g+jaS8JS8CYqtVGEb7F0zQwdPe1tHA/SBFBCNVqzHos+yET1m0Cn1zoYPvkEu9
-U2OVK5tqffEyrkN8hRm7LT2NIYji/z4VOIY/sGA1SPO7HNzoheAyHR7u9ortGMYv
-2Q69SEqtA7N6kMX3y/dL95sI/E3EJp5Z27jMMP7+aJ53F/5xmIqkZarA0ETuBic/
-KlNjG0WJilUMH7D7emTxksTdZOC8OKjg6gPY5GhVmlQ/LRvJQtoXqC84UQV2ul8R
-chvU55EUB67247g/WAusCjutISXnKQ4RGPaH9eOu1yN7StiXtJyiZ8R14ZihhC82
-ZzxjfDDk6ATR87bkAeDYJvubLJkVtUyUK0vgklNsyA+hwbdr5E5Q7IaRW2Bk/tnt
-K9ANhMjaerwcR20aOmA7pVuMGXU2MhFIleQzl+Yfv8N1CDECw3Y=
+MSQwIgYDVQQLDBtLZXkgU2lnbmluZyBTZXJ2aWNlIEludmFsaWQXDTI2MDYyMjEw
+NDc0OFoYDzIzOTEwNDA1MTA0NzQ4WjAVMBMCAgIrFw0yNjA3MDExMDQ3NDhaoCMw
+ITAfBgNVHSMEGDAWgBRiPmJ6w7OENn92tM0rnKCWBiamJzANBgkqhkiG9w0BAQ0F
+AAOCAgEAxzw31qFdu5pkjbgW0sfk63CrrQBu4XOK3ANzgFqU+vqNk7rlxcdK1OXa
+mVSYEeD0ZusxW7ZCfmtmRee4VANJqP9vs7FNWSYRB557dzRGEzNKEvIEMVBiO0io
+6gHWbQphSGOKAm/+Ct04WFPg7AIZJUeJsaF227CAoSaNgvuwP9ZG1R9Rx25lJgiq
+Fp6MJSWJ9OEHAmhIaN1wvUjkLIX/0GUqRs7oYbKNi69mxveUWGOb+EiJnodMG7VT
+n+cRyNmp1MTwKSawS2NUY1ehLE3zyb4krJArLeRf9QVrdeOmicP2gn7uq2RjqAxv
+TWKlJCvFaew7NiZdODrk5O2QjDxV2l2EnP2L7h31UY9z1JwTs+hIwCfffI7222Ui
+ZL6vItbfYxgQUnXPinZ0Ec7ajTkUG4QWUoX0BZp3vs7kN2JvYEYXROJLZz3J2lRm
+M8+FZsg1cf513tjO2qUnsqFI9wW/VuzA94166G0FleYXx3AnmyVN/9wO8LfxO3md
+7ocQqanqtTyW8qUWUhKLX6xBOOzK/SsZFQHJa063GUkWqRjx16CuIxr816acArFo
+cpybwt66OlS1W66SIxXiGGpHQIJGDVVZ93c+A3zgfgn5Q314tr5hRiuke24EgW5a
+nLr9cOnCh0VnyQVjMkgD53gwPBM67s+yLDRDSR8eQELnLpT4i28=
 -----END X509 CRL-----

rust/pv/tests/assets/cert/ibm_wrong_subject.crt

@@ -1,38 +1,38 @@
 -----BEGIN CERTIFICATE-----
-MIIGrjCCBJagAwIBAgIUOJ2eXoc9SJ1pRCC4x452LX35eNowDQYJKoZIhvcNAQEL
+MIIGtTCCBJ2gAwIBAgIUSL9f9dwAnzkvJiWIXhCGJCQMhqIwDQYJKoZIhvcNAQEL
 BQAwgb0xCzAJBgNVBAYTAlVTMTQwMgYDVQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2lu
 ZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFs
 IEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMREwDwYDVQQIDAhOZXcgWW9y
 azEPMA0GA1UEBwwGQXJtb25rMR4wHAYDVQQLDBVJQk0gWiBJbnRlcm1lZGlhdGUg
-Q0EwIBcNMjQwMzIxMTQ1MjM5WhgPMjM4ODEyMjMxNDUyMzlaMIHJMQswCQYDVQQG
+Q0EwIBcNMjYwNzAyMDg0NzQ4WhgPMjM5MTA0MDUwODQ3NDhaMIHJMQswCQYDVQQG
 EwJVUzE0MDIGA1UECgwrSW50ZXJuYXRpb25hbCBCdXNpbmVzcyBNYWNoaW5lcyBD
 b3Jwb3JhdGlvbjE0MDIGA1UEAwwrSW50ZXJuYXRpb25hbCBCdXNpbmVzcyBNYWNo
 aW5lcyBDb3Jwb3JhdGlvbjERMA8GA1UECAwITmV3IFlvcmsxFTATBgNVBAcMDFBv
 dWdoa2VlcHNpZTEkMCIGA1UECwwbS2V5IFNpZ25pbmcgU2VydmljZSBJbnZhbGlk
-MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAw7LcEUPdhr0FKp+muH7w
-Bj5Mbktl4e4kpIMqc2OaTxtwM4RDUDpLwy9X4PuEpGYEgOwOQYyd6udfInpjVVTy
-JBnwxdfpgHfsdqamkrZDqjGWHeSw4332D8gGMNFLmbCuHEzVmr1XLYQFVYMTuWex
-VFvL9ctA4gv5xO9f6oL7fVE7X420qb7IzntrxJHKsQA/IheJkZHYvPpBLs9Xlwje
-tb5OwyhdbTIsfR4V3vHdQ3shwD9TFbc+6MTDryWZThlDDUA8f+iO+euAe6QjLDnL
-JgLwnXd4EmGyePDhBM8oSex5o3/vzJVmJkpb40pvloOG11qlXGaqJxOLH2jjsNKx
-iC4l7oAHP0tXIw5f8hn+pk5vQNIcIHguXIT65ZR0IFRE9tjciLOtxndEn976jmqN
-Qu6Ajx5DiImwzp4wHjJOoVWmKCM9BklFRhwJvZ2xTmBGvC20jX0OgEaCeWV+E7UK
-2pzfGwwkWdXC7ihIszhGNP/lLlE3IflS0MHSxtie5fUrwuoZ+bVkKYClkLYeKrBT
-MLfszTuWg+rJfGmCwvYWGG9gcIRc1T3EuOiNpN4YJ5HZyD4rSI82fSzbrAtAPWPk
-6iVdmo9Ban0pQhMzyH2Gu07OnvBpmH2ADLzFpugjWafW157//GCNVgjrKVN/JbuC
-0nne/OTbQgCO1mFOy6RI1RcCAwEAAaOBlTCBkjAdBgNVHR8EFjAUMBKgEKAOhgxp
-bnRlcl9jYS5jcmwwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0l
-BAwwCgYIKwYBBQUHAwMwHwYDVR0jBBgwFoAU+f7h8O2ttBHtwI4OZnpD9wU09GYw
-HQYDVR0OBBYEFNdV8tAfYPQpxwgeErozkxFMhO+0MA0GCSqGSIb3DQEBCwUAA4IC
-AQATY32D+AMy1/x1WLGbQcvEkcT5+UEGp82FEVamXy4eM+zctzemEufjSszEpRod
-N5UgiNGDjuD5ttZSc37XHwtOwqZv2V0tu2jclxQQCswPjLhkecpIwSFJW9Y7IQPo
-+4FKry6q+vyo0sLA+pIhTT+OHK8ijy9PQEx9YOHgr0HTTTG8UZ/6oqx70lvx9KcA
-x9PhFb5TWaOhOds+v7NEPxslwrMRQ4jOz92bGeBjSXBzxwohoKKWcLWIy5ktJsFS
-PhVztHa+on4AXdDJVifU4lYIPTRZBX491EnIpEaZtyEED319SNlj691+5SgDNHRw
-Ysk+xcVYy8RmL84qfTNce+t2eEr0vjnkUqVNt6ps3UvkK2jvlehBlfPW/Dy/r/Er
-q1KNvc1Uiza3ryf2dAMDWL2VBIKMZb+d88cEuLHIgmCXrxtcyxCBTWCK6t4cnKsQ
-J82B4XQ9IRCCJDTjGEQLxsjYt9jwHeUIK0l/sseBeohxMfDptfRQ8hWt7c5SvvNy
-xRGJ1adli7LiJ3+gnPcyO+D+3DPtKtgY4y8Aed5P3oDOQGNdUznSP2qexUpT9GO0
-fJaRI8Bc3Kj1zLkS+mtYHeOBu5eyLhR0fSBpKr3/3RoKj2/NI3SvlBbJ6dD5jQBs
-4qEi8T70wjhDqITPyqZV4auy/0/h89JXDB/qAg162p8EJA==
+MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA1hVHYoOAt+WL528IalA2
+/PwAdkHRnMUH9cJwy+05dZDyammisM+6BIcYpo5hInxt/c6CF8W4Qnef+NE/+4UJ
+n7Kw3jmBBvjlWBLOx/oGdSZW8m6DEHJQVoIpnfdoipg3jA1ICH6py/N7sUBIVTpb
+tl/An3kr+uBf/CCHTWw6Q8TturL4eDwC4/GTb5R11TFGQ9DXc529WbHdAjXyFEqX
+ps9SL4BKJcG8rIppCxFfkOl0m0dDfW828GYfzMerVXOTGifEkv1o1pIEyxYBqf1T
+03Z1kWibLsFZN4mdwfQx9Uqwy+z9y+VN5iq+HGPBSDL+xBcNVFJ3qy3+GR8i+dYB
+l42HazSuKLzxFIhF2LDARKng/1c0XGHhW0iJ85u1EUt6jX2KF7jBd8aEWrJIddJ+
+blHSYj6GDmfya5psZzxhvkdxj/HkMKtztx6BZWCuSJasiy8KC/vstAiO+mwVGZwf
+nND2CCdJ/nTLY2geRoEyfwEKcGHDwzrmsYxyuhFRmOoElRHNezm354t9GDhSamAX
+H7E/Q84P2F17CYEYDdm6GJuvpJVMypcBKyHh86mWIdy7K20XsXPEzL5kiq2KCMz3
+Y2JS3SLcVPBsWTLYSlWtO5SPS26zMj9wzePuF7oSqqewWMGcilJp2DDThN375743
+U8b+7OTz1slfUg2MJEFtuvsCAwEAAaOBnDCBmTAkBgNVHR8EHTAbMBmgF6AVhhNo
+dHRwOi8vaW50ZXJfY2EuY3JsMAwGA1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgeA
+MBMGA1UdJQQMMAoGCCsGAQUFBwMDMB8GA1UdIwQYMBaAFHvgduY20uw75WX7Feb/
+jSCXuAmoMB0GA1UdDgQWBBRiPmJ6w7OENn92tM0rnKCWBiamJzANBgkqhkiG9w0B
+AQsFAAOCAgEApZajx7qyvnNtX1llUcnBGQj4oaCpN3SM6Z4kb9/nNE8tRJql4R7Y
+t2DxDlKk363+bIrdrxk6LrwmIHjw3bkGdeEYqct2HdEcNfZcYfaLl2qQ7J+9Flj0
+rQcZhl4xXbi0BN49GzisD7dZ1STxv0zEcf2J19PnsueJmLq/hEO/59DFBSK98Rz4
+DHcA9hELeRN2ZOMKZOGQlmKnCuSdh1nCxD8QH7QleA4qaVBW77kCA+tNzpWzhwPv
+JNG//PPDH3O6Wd+kcWgYyTYzUVySctTz+l1HJspcCoW9gLkp7izqsf8D5BHWXlxH
+FkPT3cUvxJzaTCS9BV7Se4527OA9snchYzedFsjqIOZ5oBUcxx8istmwQ6uoJU5v
+OL5r1BtXBXkoD4Cb1bKntuW3uKaDgiVhem1tHoE9fiimlG7SoiNTyfpuF0PsLX+e
+nVc2PErQUTlvADZm9GpQeINwYYD2WRXDIbgT5DFJoIVZFsysvT1+EwzKNLKpk85f
+5CAqvv0A4FXUqwBQV0yz0VViH6wI+/7ZPILLtTg97gZUgVyItnv5pxkoRrBjZvTz
+pSgZUAZhOmY7u3uIjQP6YU1JK4ymSK1oRSFJmrE9a30H1Aden7MAd9cEFoHXKwAf
+Ekf4Q/3b5+twe/5grmdtWKhdb7xyefFkByJucynX9Ke8dYBtVY2EoHo=
 -----END CERTIFICATE-----

rust/pv/tests/assets/cert/ibm_wrong_subject.key

@@ -1,52 +1,52 @@
 -----BEGIN PRIVATE KEY-----
-MIIJQgIBADANBgkqhkiG9w0BAQEFAASCCSwwggkoAgEAAoICAQDDstwRQ92GvQUq
-n6a4fvAGPkxuS2Xh7iSkgypzY5pPG3AzhENQOkvDL1fg+4SkZgSA7A5BjJ3q518i
-emNVVPIkGfDF1+mAd+x2pqaStkOqMZYd5LDjffYPyAYw0UuZsK4cTNWavVcthAVV
-gxO5Z7FUW8v1y0DiC/nE71/qgvt9UTtfjbSpvsjOe2vEkcqxAD8iF4mRkdi8+kEu
-z1eXCN61vk7DKF1tMix9HhXe8d1DeyHAP1MVtz7oxMOvJZlOGUMNQDx/6I7564B7
-pCMsOcsmAvCdd3gSYbJ48OEEzyhJ7Hmjf+/MlWYmSlvjSm+Wg4bXWqVcZqonE4sf
-aOOw0rGILiXugAc/S1cjDl/yGf6mTm9A0hwgeC5chPrllHQgVET22NyIs63Gd0Sf
-3vqOao1C7oCPHkOIibDOnjAeMk6hVaYoIz0GSUVGHAm9nbFOYEa8LbSNfQ6ARoJ5
-ZX4TtQranN8bDCRZ1cLuKEizOEY0/+UuUTch+VLQwdLG2J7l9SvC6hn5tWQpgKWQ
-th4qsFMwt+zNO5aD6sl8aYLC9hYYb2BwhFzVPcS46I2k3hgnkdnIPitIjzZ9LNus
-C0A9Y+TqJV2aj0FqfSlCEzPIfYa7Ts6e8GmYfYAMvMWm6CNZp9bXnv/8YI1WCOsp
-U38lu4LSed785NtCAI7WYU7LpEjVFwIDAQABAoICAAqhxnv3pGrkDQpORygB2Xd1
-XgCl/wCByCLZ7236bNE8a+GYn3GV4TTW9x7Fe2TVGAyLBpFAGvo+nLgKTyg9J7SX
-ZjHRc6Gjokil8CnLVizCaeXw3T1WxA4Cb3eqf0F3zFXERNyVyc0yvXlyWBl8DTHI
-lPGjG8DMJsMwwBTFDfW2epPL5pNMRquVH/s7cnggS83F2pb6hfxqWi05XYhaloLo
-Nm463KyIi8s2XbjRihRW9bP0nMZywKuzuO/kioooLDDlmwPV9iKUzVOqTLDj6OoF
-Qd5ENdVF0oTojUkOGiG+A7PCyRvjx/tvkcNs8VgLiEFd7trwxvC9ipLnx2r9X2Cu
-zi8iQJ901lz6cj5tR5VBttM2MaLFtELTa4HDmVMf6cNuMNZO8eULNmV2EX5K/L5b
-JD9Y1fhctQr2+pEvhgela+hi4XC/jZ/HBxDg2gg1lzt7MNjODi/fISz/zGexGQW0
-R9KElISntcpsyG8bqH2LQFQ7XzgAF1qrUC8Z9KFONGRGGZViH/K/aeH00PqCEwG/
-kv5MH+JgS+Rb2AM6HT6SK4rchAkpINPDIsD//dh4vdEfPQ/ysICf3yqACSYgu0cl
-kaTyNQE/Oga1tDOAbC8YlxPRmFHCybz8gXG4iyfFaXLGaZB+UXwZCMKOBsWbid4v
-l+1wRY/EcEuxgU6itVv9AoIBAQDo38kPbhvcT7I56++EKVuEfCzwAnXV/kttXRQk
-QQP9b7C6ZVsEgHz9/sNWzwrp0+28JXMZIggAt0kE783hitDlh7mRIUqjYoU6FcKs
-J3qaHR/Dn5TeDFlMeXmbDOsXPLRDTFdvX9+We6gbAUY1NjbK/CS+fOIigzw/jplS
-DIPxpsPLQ79/lUvr842Fn9HAIoPWq6bhMW4qibh8clJInMO9VTz4TF0FnmkPgl3Y
-R63h5zngQiOAtWCIleN/9F4G7VvrDqYHAHX54vL5Vz+dgtsynJIcpQlIJ5Z6w4hU
-q04aHuxDBkNPNRfTUIo/Jb1ghxK0m8JEZb9FE5TmZ2PDH0l9AoIBAQDXIfwjSYez
-fahZtDCis9skiaRBz2Vw+EUruXyEShER2mPaW2Of/cxAjE+cRPC4aGuseHs+4TWR
-CMnLU8lsrrw80HhdRjd11Gvr/o5qlqgxnw3zNSWQzwld+QcyxpzOgIxIR4kFV+1z
-VoG5PO+vARhcZH2tXrrWdjnCTchaMV74Sffb8bHD0p0PfcAg3CdSzMhynnMGp3wN
-PBZXqk0T+C9isaXKxL8HcDJxgcJHEyEZp9ygQtzQo1BPluVTWPJRQQvP6VLNyNl2
-NISvmYJSwRQ3yuqEvWE4eSge9kaNp2eUrUz5O3t1NyOa4qioVPnlCH7Glaj6nyNS
-Ler2dszcqz0jAoIBAQCnY9SeZsNYBWFTCSjNkvzZqniSvPH+tB97qSBFPwajMZmT
-Ii/eeI1f9bRrvb9WfKOyTikBs9iUyyqNheIzcRjfJERa8dc4wiSJsAKSxH34MV8X
-uqnDQpUdx2OF9C84MMZSaZmf0QZioNghMTVKIoIYPk4bLqFNtY+lD9ddhumA1iJ/
-BV+tUZ+VJyhfGJYoyaaCtDfsPx+1K/GUYoiK8UQx4AdHY3yqAUf7gfX69OskKpUL
-gf8LEVUmWLeCziCYUh10RL9K4SXsTRnh6Lkte1Ycdzb/qBGX7/zWmZ5xXgFx/TBO
-rT3MvZk2p/n3kiUiMXVcpWlqyMhH2t95DnBDXUXxAoIBABcS0Q0j1MceghDk75Zz
-vdxEWvan/NRJ/Hk9EqrJmt0UVENWK/A78000/1DeYAcXQ/0iiu1qkCk3DRWererX
-Lt9C6LXwUwBzQQP1sGakM/PmgEOGfrnySqnmjKwYezb2uJUD/yEwlgoZzB4G+BoH
-/wnhyUzv7RAVbAp39zYdN3dfz5KqcIt1Kl0/+nxLwHfz+Me6UNH04qw0tpy+ajfr
-FYH7VbHSuj5c/TwJU8H1vkYXJ+WUZkSGT5XJtFzlHFA0rsSk3LmvggtYhKaky0J+
-7OEzBUYpXaUF8ZSoi1akDsr2b1wH0iz3Nf1ls/sh6g9zgs1fvdjreolU3W+DvGMq
-hosCggEAWvrHup9KFfS7QznGOLjOdil+HT8TqbVjFa51S7gd5A2B3XpC2mDk9XPO
-uxvUjXxuH18hRlLHP2uERlIsOl37iPJ2jY4C1SUQb9xNmSarfUKwsgDhJKBfPNIC
-LXmXQgs/gcL+Sm/l6Az4slsV/9xg1Sp4EG/3bBM8i4VRRcpKZqwttZ/pArzYNrYp
-LbZeRCm34iPDAelganc4cX/wzlXa36j0Eh0PHd1SvQhKb9lcxtbV4EFhxD9qC1VF
-URy6m7FJrA0r5Hrh4SuSagOpbPCJTeXP0Ysvx/tsl7DR1kIpGkMGhYHMScbKjGwe
-ZAbU3ynucdvh2dgqN4agS//dmuRo0A==
+MIIJQgIBADANBgkqhkiG9w0BAQEFAASCCSwwggkoAgEAAoICAQDWFUdig4C35Yvn
+bwhqUDb8/AB2QdGcxQf1wnDL7Tl1kPJqaaKwz7oEhximjmEifG39zoIXxbhCd5/4
+0T/7hQmfsrDeOYEG+OVYEs7H+gZ1JlbyboMQclBWgimd92iKmDeMDUgIfqnL83ux
+QEhVOlu2X8CfeSv64F/8IIdNbDpDxO26svh4PALj8ZNvlHXVMUZD0Ndznb1Zsd0C
+NfIUSpemz1IvgEolwbysimkLEV+Q6XSbR0N9bzbwZh/Mx6tVc5MaJ8SS/WjWkgTL
+FgGp/VPTdnWRaJsuwVk3iZ3B9DH1SrDL7P3L5U3mKr4cY8FIMv7EFw1UUnerLf4Z
+HyL51gGXjYdrNK4ovPEUiEXYsMBEqeD/VzRcYeFbSInzm7URS3qNfYoXuMF3xoRa
+skh10n5uUdJiPoYOZ/JrmmxnPGG+R3GP8eQwq3O3HoFlYK5IlqyLLwoL++y0CI76
+bBUZnB+c0PYIJ0n+dMtjaB5GgTJ/AQpwYcPDOuaxjHK6EVGY6gSVEc17Obfni30Y
+OFJqYBcfsT9Dzg/YXXsJgRgN2boYm6+klUzKlwErIeHzqZYh3LsrbRexc8TMvmSK
+rYoIzPdjYlLdItxU8GxZMthKVa07lI9LbrMyP3DN4+4XuhKqp7BYwZyKUmnYMNOE
+3fvnvjdTxv7s5PPWyV9SDYwkQW26+wIDAQABAoICAFGbmfMxSuOPMuY9urkAK/4D
+OE/cJkH7D948yU/LdfBdmTM8YoLBJNluAFUZiGijgzBRxOC4A9X+kPJCHgBMxg7l
+CKwlwow8W/zXapDrvANzYoiW3QprcTmQ87leYzEV9nLCa1elpSd0gQ3gAdLPZL+g
+P6brA3tmheBwK/O1En7b9n2JlNMMmVN4Nuo9by+eUXkvhrnxgwlKloOtucLHbojt
+lhg6cMl00W36czF/ZW0xuTwqDc2mlAxO+cdPw/3WiVhamYIo7IqC7iXWlTrOMWK2
+UPnlpOZNWSulH4ichGDLoJqUFGlh13CqkX7z/e1+VwS7/t5Kc4jDBw5fgq83R7Jh
+tV5ZHX+2VqqWjmaJh6Uj1lXDBqSqL2ODJbzCcUQ8flXKZ8ixgcpAyjiEeGcbQ+YN
+0hULzbkKAEHd2cAuS7gdEnacopYjVPpjs6r5qDZs6ojcwgNPXycvRIaA7MAVI/nA
+Pa40sX92nTzdvYh5NNB2oPffzZfmUW1HwAwFWAZnH9Db7HMZbWmdHDymSoWBtS6V
+zLqNkGV8m0tkI1CR80fl1XGKZHQhYNqwAnROwFKKG9bFVRwYrGDdLKLdNcrBtwAc
+uSou8jaCvmgZwMCF/j+eWNo783EbA4hLEv1UC6lFMcmUxqUUaWChElZs9duyGyTo
+nGlz5x2lDqjIYZWCUHE5AoIBAQD44RBQb/z8XWAo9XVjrzEkzJcuhca8ztpapRsT
+wvGSxmnxs84ZZLvQNoJXhv5SLN+iSc+UMuFXhYn+JowsuitkoujadT98v33ACr5z
+aPwcRIWnfmrcvf9zgYmThbToBaIddenOzn2xsP9+uY/PEnAOsF9YCqV5Si9cvSsE
+BXO5w2Y3oaHN5Npn0S8AsXumLzffmW1v0AirfV0vLFUnnYtCVYA1y8J805QUk4Y+
+L9ndfBzRltY//9qVy4MOQxfHp2epIwTkzHI/ZRClCs+SXYnFCgmRAvkDT6XGW0Tl
+O/5payBxd9NUvmXD8wjrVIaBwuVwOXkd0oPD5HjeU0rfH0zzAoIBAQDcNVlAj6sf
+BCMm+FU+HTznOjZ6F3PBCUjGPrwnn0Ig+7kCUGmR+XeaN9dfu0bXQBu4a+hmQ/so
+e459SMKtclsja4UIt2WnE4vQ32GoYdTGRD2hN0OCi2aXgSoa5yEs/z2L4BbHhhoh
+YqC/15evdpAzMlaWf8VexibsWJf6dSGlhWIce5JzVeG2Kqkm1O8SfvIkpY1NhXIJ
+PNJEFxHrmDYiWM+tPohKfmDKGpv9pqan8Q/bF+ka0AXShtH1lROW6sDUoZBLv4sB
+xEtLHEW4lwjEZHSLnfEpbqCXJ0E+jGsnmRHcIgLTE+lO80r6i96kNDY6WkQkATWM
+e7dFYgiekLvZAoIBAFPN1WSAkTuZZavlG2Y5s96kVbQAr+8b6ELlnbyFxDqcPUh6
+N0gtt2BhOnqmpjSdj6BiIlfQ2jhSayj9ae4Vsk7s3GPTX1FuWbW06HSMQXhzSl4g
+H3O9Nqt6Tw0x1LzcSL6K2fQdbA3Nf/r4GQitOLZ5hWFsFFRHOrOLr1RnUZSXy2+o
+KYffK/wRYDZnjS9kbvgH/eXMs16rlBkyYGo6jo4DpGx49EB8LjzPgECodEA0bq/U
+jsh2KvCN2s+OoA9Gu40kkZ1Jip72NSid/09V1/JVcus1iQwoYbXtPcHC9eQhgocy
+xiKfCj11NOepSrGfIwsrDzGPlXb9FAYpHekL7SkCggEBAKeAoRp97iGSqRaMkXLF
+FL2iRywJyNAOOuApej/9YXTrZSiAeD1EcJjLXzV/o/w51Jws4MNhdJuvmIxuGz+K
+HA9OSwx9TIKRWKoSMRu/BvWllOebvOuBFBGse5WpOFAc+vj6BPnSZO/+MN6cpNIg
+MsHuyXSDTmOwAI2JOlmWXXilhCK8UIMQ0bcarj5OfGgqThBYKarNFhg2vo5yqfv2
+dT8dJSPXzB42EXPKV9vStzRKJtB2WKc/kx431V+j/RmwCevz1Wn5EkjOwqMop1Qo
+9s9Exm4pPvdQIjG392YXs66UPcSfzlw26iJW6DK60ClBWfp7DRgCH3Rz6s2JK5tJ
+5skCggEAViNpAe9AtCFOaUsdMjI2du3+zpXcYKPvrP0dmrVk7BnJJcY0vYKO1eHm
+xyjR/OV2euteGmvIIRkMP2q/vTPvhczYbTcMORyMJpLjCF6DXLOeTl72OGs4O1YU
+R13VAh+6MK+rKjYqD82EM6jdaYlTiseN9ZOyKpbnQtpkAbYz39ovhD+pQpwcS09W
+/Vqz+jgswAAhwbN2dtpxzjZq40WGF565AHGOQgfIMAeHi0enSke39GWjQCuBA/Fx
+p+XWzjzjRMezg3lFJRgW+CvjKFD0C7FhnRQo3dY+0yUO9ymTf2lVDcb8MtvgvDq0
+0LUoxRotIbxrAsulb6FScaVr5deJZw==
 -----END PRIVATE KEY-----

rust/pv/tests/assets/cert/inter_ca.chained.crt

@@ -1,58 +1,59 @@
 -----BEGIN CERTIFICATE-----
-MIIGhjCCBG6gAwIBAgIUOkSdvHg4/HXtknNMhIFkuPv/ghMwDQYJKoZIhvcNAQEL
+MIIGjjCCBHagAwIBAgIUCDzM1lrz6C9oAnkKuZp/VOUNe4AwDQYJKoZIhvcNAQEL
 BQAwgbUxCzAJBgNVBAYTAlVTMTQwMgYDVQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2lu
 ZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFs
 IEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMREwDwYDVQQIDAhOZXcgWW9y
-azEPMA0GA1UEBwwGQXJtb25rMRYwFAYDVQQLDA1JQk0gWiBSb290IENBMCAXDTI0
-MDMyMTE0NTIzOFoYDzIzODgxMjIzMTQ1MjM4WjCBvTELMAkGA1UEBhMCVVMxNDAy
+azEPMA0GA1UEBwwGQXJtb25rMRYwFAYDVQQLDA1JQk0gWiBSb290IENBMCAXDTI2
+MDcwMjA4NDc0N1oYDzIzOTEwNDA1MDg0NzQ3WjCBvTELMAkGA1UEBhMCVVMxNDAy
 BgNVBAoMK0ludGVybmF0aW9uYWwgQnVzaW5lc3MgTWFjaGluZXMgQ29ycG9yYXRp
 b24xNDAyBgNVBAMMK0ludGVybmF0aW9uYWwgQnVzaW5lc3MgTWFjaGluZXMgQ29y
 cG9yYXRpb24xETAPBgNVBAgMCE5ldyBZb3JrMQ8wDQYDVQQHDAZBcm1vbmsxHjAc
 BgNVBAsMFUlCTSBaIEludGVybWVkaWF0ZSBDQTCCAiIwDQYJKoZIhvcNAQEBBQAD
-ggIPADCCAgoCggIBAMheyYWl/STLJ0iwlrqNRyURatdeC8oDpKFdpglYHAs/jo3s
-fWNySCnaw6NCe0vxFLpqcK8VMNFRGu/XhR/kZ1YR3V4mLwF1Wa5v7a7J9swq50Fk
-CsLtaU5vq/h6rIpy0NLnmN5KgqChrMh9IwZ+Mc8sqc/0BFFJsuCCGu0TNlGVOhmN
-AbdS3s7wEUwT023CKn47G3pVqeaErEB9honz1I71g5/jNKGe5CLCV35ExzsrzU43
-atyJ0jgh15PYCXDTdsRccSmEs2S6Xh2o4ZhlqioWB+tKxGsdxq8Ri4soy6yyooOz
-T/3X5CHpKxiI2P9z38Pr9egPcNPPVMGDhzwHz7p3iBPg0RcWd5VP2nimLJsdGWK0
-bkU7zlQ3R2NelSIW9Hr8MVASihmELvX+AcC6KhTpHHhf3CTPgcAfV2fE9U84Xl2i
-shmoEsUQTUx97qKUOKRfY6o+WMBnVkzlqWj+s52ndiT+0KNLTDtvlejEFf1VSF43
-IkS9UJK+XxxEnvIBzNKI5EbWlG5Z38/nKv6pjTXFi3aZR4cdmI/0XfAjLTkrTBaW
-lkguEjt+/cxPYJOqt50ldI9kle8XTu/HibmcbU2wYIF21CBjE/hLk/KY3FQlnTFL
-y7x3bM0CuTfJ8Noy59f3l56fwPOpaQWqhqO+UoFkbFlbROAiVxfb8KlyZPdNAgMB
-AAGjgYEwfzAcBgNVHR8EFTATMBGgD6ANhgtyb290X2NhLmNybDAPBgNVHRMBAf8E
-BTADAQH/MA4GA1UdDwEB/wQEAwIBBjAfBgNVHSMEGDAWgBTWntryJpCwZqZJ1H3n
-znJYhbfoKjAdBgNVHQ4EFgQU+f7h8O2ttBHtwI4OZnpD9wU09GYwDQYJKoZIhvcN
-AQELBQADggIBAE8gulfly5+EC8DX3K02qEYPoQwVbVhD0wGrlAhgJiakDvPlX6/K
-vSe/1nNRG87jXvXdDiuJ6F4iKZpeJndzvx/8ZEmllyyxDwb3UOmylwW/o3/Uh6fY
-kiVBfW6uNNB0BfDKcXDDZgKjTg3kLT5z8m4u8rPoIPFkLFl9AuAq82Ll6NQ+xZFP
-lZ3K6HN+ntVnIGP4XkOgEYPxjJO3yTGle8VBqLfo/JKwbZtKfNXxSAMRXiP02SQg
-D9yshxkonQYWog2hHz8oDuQQNbzaAFlxnY914av/XwxP8TwEfGNchNtAtrlGRlx8
-PjMfp3Mnbz71yp+L2We2/A7njIPbEcn0FIBedpNyyBON5Cd6Xqx18otmMTtUILZ3
-SUKeYmLp8soVMEmmnWz6y1a4bCKwo6hA8oSoq5ydIeWy/jI9v7DF0S/qZTz3c2Q1
-a3aniuug2FRAxuU/8fSlMrE4672d3505SbHUblhy9XzQ4+sWjkDtYnY89kyY4BTu
-W5n6JlVoewZGOjlJ9/6mV6BVLQ74IeiytWtdH5uOQ1wroi5Kq+EroGgFmPSQCIvN
-XNDvBCNFN/O1+/eVZd6JNx6NMO7DrWql3GFMtJE8u/SWXA9vit3pfmeDrosZ4SDg
-ZPt7+JfzITUh2UMaPsQsPF8G8/tYmxDbELE5LjFcQ24ps362rG+q2rfA
+ggIPADCCAgoCggIBAMMEHFtcZUDEgJ1ZU31tH7ptwM24dInKrJWp0xLmsWAjUvRM
+WhcVxP9o00xdKNFtsrBre7CqQCL7/Zr2apnPUEBcFc07GTBSnwxxtXLFWjN7e4tQ
+3wNFQI0Y387KIqJ+9Vv8sN7nYUf8ZeB2duO0tHdy3Pff8TvljbMnSEVqWpG0E1VL
+fTp46s2xhMveg4UAy5W/vt+OoKR7P6XA0t0W5Go72sL3DOAJWBYa9PWLXDrGXm+W
+uMcGNU75aSWBzdppPAuulEzn+rnaTi9QVb1EO02XIlzal8a8vaMjc1XHuEuXtO9z
+aiA2i50sVOUP3McB0KEZkL6LRGl2mBSJcaZoybw5cUoGN836oiKBNxIxWPNhRkDv
+OV5vtaLwMxEF+JZEi+k7bat6d9qzwxQ6FlpGKl8RdJybY8S8jGPJx5donPq5e1iP
+tY8JL9wO/0YDDP7DKEkKu/sZOFggMDPrDqCvPdrmGBTQvlsCRVHV44A1WIMTaBW7
+SXSDsNtCZhw5DCdRR6B2O91RE5L4SPR55f5uy4lD0YwwuJxBCX/7x34qXaUdKXxS
+QotgDH8iwX8YqM+q1UgyuFShEqzb9rfPDb4n9po/YDJBuJuhhxdH0POfa/VJeEnE
+k6f8HI89I2toy7tiAv7M2TT70PpD8n3juLlhrb38SjRCP8DVIbFWuDP0OZdXAgMB
+AAGjgYkwgYYwIwYDVR0fBBwwGjAYoBagFIYSaHR0cDovL3Jvb3RfY2EuY3JsMA8G
+A1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB8GA1UdIwQYMBaAFCJbE+sw
+BXmG6bBbBnhjEA6KHzZeMB0GA1UdDgQWBBR74HbmNtLsO+Vl+xXm/40gl7gJqDAN
+BgkqhkiG9w0BAQsFAAOCAgEAWnVqPdny2zGtBmgOUFq1Bnn0HO45uaDXl8oodyQY
+9KNF4oBGKYtY+lyosn/t/754p6QDaslynuABtmX/ugf46fQ1PJsssFrIAAOT+X2D
+NSZbOMBKdk6BwibirEDhEW6YlSBkDznOyH3WNeCPOdLH2qZz7EAKUI0eIt2j6pI+
+b2UitHF9wBYRdCCCV+39srr2QTLo3xWp2w8ifDu4UfLB2yTKYqVH+z8Ppcp+ipCK
++djqxi8OoiTtdsI74+19I+rC13d7sYHIdk0mA7cavSYwVt2GcO6UDP7mb/Ot7v0t
+sd2IEvFInv82DNNvvQt0u4Q14CQb36GF/Sg2BOTbelCnQ3tfpHEsKkAFZYjKRtNO
+gMfy/aHBkRN5AQ0zERuKiVqIf/sB+tAEnJex6Qm8qSO65u2ZrnNlc+lxc8n0rklx
+LVkX7PALBQGT3xmdySbXhod8yUW14/G3anrKhJoSic/0SoaqG2p9lq2eVgQEvijV
+Y60mM2D15ibAZU6lpxtSI6yAsNXmJVwJHh/aJ9tjPs85xoZPH+k1NvGE0/fzLuLn
+mtT7mdvWaPDMyPkJPejI+/K8M1Ga1J4ESjDH5VwvTzP19lu1BvGgYeuZXb1QNOzW
+u9FplVhpKmdKETnCvp/5HoVQ1zR+jeWg0VN8ebPQ2FSwOx4J7UkHS/g+zR/+KOvq
+fi8=
 -----END CERTIFICATE-----
 -----BEGIN X509 CRL-----
 MIIDbTCCAVUCAQEwDQYJKoZIhvcNAQENBQAwgb0xCzAJBgNVBAYTAlVTMTQwMgYD
 VQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9u
 MTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFsIEJ1c2luZXNzIE1hY2hpbmVzIENvcnBv
 cmF0aW9uMREwDwYDVQQIDAhOZXcgWW9yazEPMA0GA1UEBwwGQXJtb25rMR4wHAYD
-VQQLDBVJQk0gWiBJbnRlcm1lZGlhdGUgQ0EXDTI0MDMxMTE1NTIzOFoYDzIzODgx
-MjIzMTU1MjM4WjA8MBMCAgG8Fw0yNDAzMjAxNTUyMzhaMCUCFF72el1l160wBZ+u
-getcWTcmtomDFw0yNDAzMjAxNTUyMzhaoCMwITAfBgNVHSMEGDAWgBT5/uHw7a20
-Ee3Ajg5mekP3BTT0ZjANBgkqhkiG9w0BAQ0FAAOCAgEAbGRxfJj3wsZ9iUsYTO3W
-7+hNbZ+nRaokZT1UgprzDTMmQKWp5HRyvAsTtzxeJZ4NDEqP2mg8imvmSUSnLSmR
-pdq7vUdk7lKvdV++fZo4XIRF/pqv7+8Nz8iZvxINGhFaJDUUPPQSFcLm00JIUMzn
-9nh5JkCkKFuk34DgHDR3Zn+nM6R+gAuaDsBgv3xnU6PKVW796JPbz3yrN9fma9Pw
-P27ICXVyOH2oH7p/E7oNB/J0YxKcD5bjaFkzVHsMExCzeyGTA56qtdN2O1Oxiw2z
-L1Yitj1c+2/P29vhCw0IuxKjduL15Qu5Px5BT+B6V3cVUPbn9fYlDjSFAHxyrGno
-X3QnVzCChVoHuS+Og/QwEx6AcTSEbl4E47XQK0gr1cG7ayOZoDO3rqGQ+eO6kREM
-LpX2lHPofzMBk9lGPfAZX41pXUlshT0irrwFbIt3OTGfvU5x2wAjCap1InzvFS9J
-4vEFHcLeHAi5ztlnYNIkB9/kja3ogpSCbcO6WoveJeHCTsXk5K4qIOSvoLYEdRE1
-Pn2EJStyULZW9Sv1JH2puyZ2d2Y7cl6DqCZ5D4tFsyFFsMUNlBJQSxKoPDYnGsi8
-DOTxrwhdxG/mSwn/NoYjZdC0Y+NJyBs1RvLvBZLdgzWS8I+uvyuwTfn27tP7GT6Z
-8hmLPBMvUOyczXdMD6b1mfQ=
+VQQLDBVJQk0gWiBJbnRlcm1lZGlhdGUgQ0EXDTI2MDYyMjEwNDc0OFoYDzIzOTEw
+NDA1MTA0NzQ4WjA8MBMCAgG8Fw0yNjA3MDExMDQ3NDhaMCUCFFXLDvzEB/BaPHju
+vF0dAQThNmT2Fw0yNjA3MDExMDQ3NDhaoCMwITAfBgNVHSMEGDAWgBR74HbmNtLs
+O+Vl+xXm/40gl7gJqDANBgkqhkiG9w0BAQ0FAAOCAgEATyTCJ3GLM8MOgH/pSY+p
+qp6+HGx//Be6UMTyokQez+17P96B4/nbX439MCeRj4+rx9XhJjd2u1ipPqYuFgjR
+hQKQIm0Y8U4Y2oO2S4JDos7BCYVhzuP3xfCAwBXqrOKlSpw1lB0CcGtBBukOwHFp
+HmlbUvwQ9pHt+7l2zGalHDf9X/vhJWApP231Fk539P3bJy96DuN7zf/Q0Qe41GQL
+/OAHPGdjemp7ogBvDXRsHtkb1KckzLpK/Gqmlnf0jmRHH4gyzDLn4Rn7w7t/jKWk
+k4wVD2m/yYxt3F5Oe8NTq639HLvAH6GK9IEAaf92wkwK1xeThUdz9u9SZTs6shi2
++pfARAFNQ1KMdT6HlQ9kugFwU8qqVMveaBmXVIb8MJyS3lwogdAjTbOTZ2+SYYh7
+p8ftB8VkkchkJhKOt/KLnkTJHTRUY0fSZAZHnRqTprD+HTbBjZ601O6DltB2vbJd
+uEBikTVj5ILyQQmRpWLvdV56KQ79KyIU0agZIjEvt6nKPJEDk4UNbbTUxBdgZG/0
+E31m6IhvwSwrconhkeo/fRUUCrKP00rjDvX8b7MtpJo8lK4cXi8o+7i4863zXfMX
+3291JeYTci6C6QhbsFiYLYD4N7jBHpFz/rZ/SBUrraKKx1DAK72Mlqb2eaeR8uRy
+QrxQAKxlgCZ0rOapeJKOKZ0=
 -----END X509 CRL-----

rust/pv/tests/assets/cert/inter_ca.crl

@@ -3,19 +3,19 @@ MIIDbTCCAVUCAQEwDQYJKoZIhvcNAQENBQAwgb0xCzAJBgNVBAYTAlVTMTQwMgYD
 VQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9u
 MTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFsIEJ1c2luZXNzIE1hY2hpbmVzIENvcnBv
 cmF0aW9uMREwDwYDVQQIDAhOZXcgWW9yazEPMA0GA1UEBwwGQXJtb25rMR4wHAYD
-VQQLDBVJQk0gWiBJbnRlcm1lZGlhdGUgQ0EXDTI0MDMxMTE1NTIzOFoYDzIzODgx
-MjIzMTU1MjM4WjA8MBMCAgG8Fw0yNDAzMjAxNTUyMzhaMCUCFF72el1l160wBZ+u
-getcWTcmtomDFw0yNDAzMjAxNTUyMzhaoCMwITAfBgNVHSMEGDAWgBT5/uHw7a20
-Ee3Ajg5mekP3BTT0ZjANBgkqhkiG9w0BAQ0FAAOCAgEAbGRxfJj3wsZ9iUsYTO3W
-7+hNbZ+nRaokZT1UgprzDTMmQKWp5HRyvAsTtzxeJZ4NDEqP2mg8imvmSUSnLSmR
-pdq7vUdk7lKvdV++fZo4XIRF/pqv7+8Nz8iZvxINGhFaJDUUPPQSFcLm00JIUMzn
-9nh5JkCkKFuk34DgHDR3Zn+nM6R+gAuaDsBgv3xnU6PKVW796JPbz3yrN9fma9Pw
-P27ICXVyOH2oH7p/E7oNB/J0YxKcD5bjaFkzVHsMExCzeyGTA56qtdN2O1Oxiw2z
-L1Yitj1c+2/P29vhCw0IuxKjduL15Qu5Px5BT+B6V3cVUPbn9fYlDjSFAHxyrGno
-X3QnVzCChVoHuS+Og/QwEx6AcTSEbl4E47XQK0gr1cG7ayOZoDO3rqGQ+eO6kREM
-LpX2lHPofzMBk9lGPfAZX41pXUlshT0irrwFbIt3OTGfvU5x2wAjCap1InzvFS9J
-4vEFHcLeHAi5ztlnYNIkB9/kja3ogpSCbcO6WoveJeHCTsXk5K4qIOSvoLYEdRE1
-Pn2EJStyULZW9Sv1JH2puyZ2d2Y7cl6DqCZ5D4tFsyFFsMUNlBJQSxKoPDYnGsi8
-DOTxrwhdxG/mSwn/NoYjZdC0Y+NJyBs1RvLvBZLdgzWS8I+uvyuwTfn27tP7GT6Z
-8hmLPBMvUOyczXdMD6b1mfQ=
+VQQLDBVJQk0gWiBJbnRlcm1lZGlhdGUgQ0EXDTI2MDYyMjEwNDc0OFoYDzIzOTEw
+NDA1MTA0NzQ4WjA8MBMCAgG8Fw0yNjA3MDExMDQ3NDhaMCUCFFXLDvzEB/BaPHju
+vF0dAQThNmT2Fw0yNjA3MDExMDQ3NDhaoCMwITAfBgNVHSMEGDAWgBR74HbmNtLs
+O+Vl+xXm/40gl7gJqDANBgkqhkiG9w0BAQ0FAAOCAgEATyTCJ3GLM8MOgH/pSY+p
+qp6+HGx//Be6UMTyokQez+17P96B4/nbX439MCeRj4+rx9XhJjd2u1ipPqYuFgjR
+hQKQIm0Y8U4Y2oO2S4JDos7BCYVhzuP3xfCAwBXqrOKlSpw1lB0CcGtBBukOwHFp
+HmlbUvwQ9pHt+7l2zGalHDf9X/vhJWApP231Fk539P3bJy96DuN7zf/Q0Qe41GQL
+/OAHPGdjemp7ogBvDXRsHtkb1KckzLpK/Gqmlnf0jmRHH4gyzDLn4Rn7w7t/jKWk
+k4wVD2m/yYxt3F5Oe8NTq639HLvAH6GK9IEAaf92wkwK1xeThUdz9u9SZTs6shi2
++pfARAFNQ1KMdT6HlQ9kugFwU8qqVMveaBmXVIb8MJyS3lwogdAjTbOTZ2+SYYh7
+p8ftB8VkkchkJhKOt/KLnkTJHTRUY0fSZAZHnRqTprD+HTbBjZ601O6DltB2vbJd
+uEBikTVj5ILyQQmRpWLvdV56KQ79KyIU0agZIjEvt6nKPJEDk4UNbbTUxBdgZG/0
+E31m6IhvwSwrconhkeo/fRUUCrKP00rjDvX8b7MtpJo8lK4cXi8o+7i4863zXfMX
+3291JeYTci6C6QhbsFiYLYD4N7jBHpFz/rZ/SBUrraKKx1DAK72Mlqb2eaeR8uRy
+QrxQAKxlgCZ0rOapeJKOKZ0=
 -----END X509 CRL-----

rust/pv/tests/assets/cert/inter_ca.crt

@@ -1,37 +1,38 @@
 -----BEGIN CERTIFICATE-----
-MIIGhjCCBG6gAwIBAgIUOkSdvHg4/HXtknNMhIFkuPv/ghMwDQYJKoZIhvcNAQEL
+MIIGjjCCBHagAwIBAgIUCDzM1lrz6C9oAnkKuZp/VOUNe4AwDQYJKoZIhvcNAQEL
 BQAwgbUxCzAJBgNVBAYTAlVTMTQwMgYDVQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2lu
 ZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFs
 IEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMREwDwYDVQQIDAhOZXcgWW9y
-azEPMA0GA1UEBwwGQXJtb25rMRYwFAYDVQQLDA1JQk0gWiBSb290IENBMCAXDTI0
-MDMyMTE0NTIzOFoYDzIzODgxMjIzMTQ1MjM4WjCBvTELMAkGA1UEBhMCVVMxNDAy
+azEPMA0GA1UEBwwGQXJtb25rMRYwFAYDVQQLDA1JQk0gWiBSb290IENBMCAXDTI2
+MDcwMjA4NDc0N1oYDzIzOTEwNDA1MDg0NzQ3WjCBvTELMAkGA1UEBhMCVVMxNDAy
 BgNVBAoMK0ludGVybmF0aW9uYWwgQnVzaW5lc3MgTWFjaGluZXMgQ29ycG9yYXRp
 b24xNDAyBgNVBAMMK0ludGVybmF0aW9uYWwgQnVzaW5lc3MgTWFjaGluZXMgQ29y
 cG9yYXRpb24xETAPBgNVBAgMCE5ldyBZb3JrMQ8wDQYDVQQHDAZBcm1vbmsxHjAc
 BgNVBAsMFUlCTSBaIEludGVybWVkaWF0ZSBDQTCCAiIwDQYJKoZIhvcNAQEBBQAD
-ggIPADCCAgoCggIBAMheyYWl/STLJ0iwlrqNRyURatdeC8oDpKFdpglYHAs/jo3s
-fWNySCnaw6NCe0vxFLpqcK8VMNFRGu/XhR/kZ1YR3V4mLwF1Wa5v7a7J9swq50Fk
-CsLtaU5vq/h6rIpy0NLnmN5KgqChrMh9IwZ+Mc8sqc/0BFFJsuCCGu0TNlGVOhmN
-AbdS3s7wEUwT023CKn47G3pVqeaErEB9honz1I71g5/jNKGe5CLCV35ExzsrzU43
-atyJ0jgh15PYCXDTdsRccSmEs2S6Xh2o4ZhlqioWB+tKxGsdxq8Ri4soy6yyooOz
-T/3X5CHpKxiI2P9z38Pr9egPcNPPVMGDhzwHz7p3iBPg0RcWd5VP2nimLJsdGWK0
-bkU7zlQ3R2NelSIW9Hr8MVASihmELvX+AcC6KhTpHHhf3CTPgcAfV2fE9U84Xl2i
-shmoEsUQTUx97qKUOKRfY6o+WMBnVkzlqWj+s52ndiT+0KNLTDtvlejEFf1VSF43
-IkS9UJK+XxxEnvIBzNKI5EbWlG5Z38/nKv6pjTXFi3aZR4cdmI/0XfAjLTkrTBaW
-lkguEjt+/cxPYJOqt50ldI9kle8XTu/HibmcbU2wYIF21CBjE/hLk/KY3FQlnTFL
-y7x3bM0CuTfJ8Noy59f3l56fwPOpaQWqhqO+UoFkbFlbROAiVxfb8KlyZPdNAgMB
-AAGjgYEwfzAcBgNVHR8EFTATMBGgD6ANhgtyb290X2NhLmNybDAPBgNVHRMBAf8E
-BTADAQH/MA4GA1UdDwEB/wQEAwIBBjAfBgNVHSMEGDAWgBTWntryJpCwZqZJ1H3n
-znJYhbfoKjAdBgNVHQ4EFgQU+f7h8O2ttBHtwI4OZnpD9wU09GYwDQYJKoZIhvcN
-AQELBQADggIBAE8gulfly5+EC8DX3K02qEYPoQwVbVhD0wGrlAhgJiakDvPlX6/K
-vSe/1nNRG87jXvXdDiuJ6F4iKZpeJndzvx/8ZEmllyyxDwb3UOmylwW/o3/Uh6fY
-kiVBfW6uNNB0BfDKcXDDZgKjTg3kLT5z8m4u8rPoIPFkLFl9AuAq82Ll6NQ+xZFP
-lZ3K6HN+ntVnIGP4XkOgEYPxjJO3yTGle8VBqLfo/JKwbZtKfNXxSAMRXiP02SQg
-D9yshxkonQYWog2hHz8oDuQQNbzaAFlxnY914av/XwxP8TwEfGNchNtAtrlGRlx8
-PjMfp3Mnbz71yp+L2We2/A7njIPbEcn0FIBedpNyyBON5Cd6Xqx18otmMTtUILZ3
-SUKeYmLp8soVMEmmnWz6y1a4bCKwo6hA8oSoq5ydIeWy/jI9v7DF0S/qZTz3c2Q1
-a3aniuug2FRAxuU/8fSlMrE4672d3505SbHUblhy9XzQ4+sWjkDtYnY89kyY4BTu
-W5n6JlVoewZGOjlJ9/6mV6BVLQ74IeiytWtdH5uOQ1wroi5Kq+EroGgFmPSQCIvN
-XNDvBCNFN/O1+/eVZd6JNx6NMO7DrWql3GFMtJE8u/SWXA9vit3pfmeDrosZ4SDg
-ZPt7+JfzITUh2UMaPsQsPF8G8/tYmxDbELE5LjFcQ24ps362rG+q2rfA
+ggIPADCCAgoCggIBAMMEHFtcZUDEgJ1ZU31tH7ptwM24dInKrJWp0xLmsWAjUvRM
+WhcVxP9o00xdKNFtsrBre7CqQCL7/Zr2apnPUEBcFc07GTBSnwxxtXLFWjN7e4tQ
+3wNFQI0Y387KIqJ+9Vv8sN7nYUf8ZeB2duO0tHdy3Pff8TvljbMnSEVqWpG0E1VL
+fTp46s2xhMveg4UAy5W/vt+OoKR7P6XA0t0W5Go72sL3DOAJWBYa9PWLXDrGXm+W
+uMcGNU75aSWBzdppPAuulEzn+rnaTi9QVb1EO02XIlzal8a8vaMjc1XHuEuXtO9z
+aiA2i50sVOUP3McB0KEZkL6LRGl2mBSJcaZoybw5cUoGN836oiKBNxIxWPNhRkDv
+OV5vtaLwMxEF+JZEi+k7bat6d9qzwxQ6FlpGKl8RdJybY8S8jGPJx5donPq5e1iP
+tY8JL9wO/0YDDP7DKEkKu/sZOFggMDPrDqCvPdrmGBTQvlsCRVHV44A1WIMTaBW7
+SXSDsNtCZhw5DCdRR6B2O91RE5L4SPR55f5uy4lD0YwwuJxBCX/7x34qXaUdKXxS
+QotgDH8iwX8YqM+q1UgyuFShEqzb9rfPDb4n9po/YDJBuJuhhxdH0POfa/VJeEnE
+k6f8HI89I2toy7tiAv7M2TT70PpD8n3juLlhrb38SjRCP8DVIbFWuDP0OZdXAgMB
+AAGjgYkwgYYwIwYDVR0fBBwwGjAYoBagFIYSaHR0cDovL3Jvb3RfY2EuY3JsMA8G
+A1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB8GA1UdIwQYMBaAFCJbE+sw
+BXmG6bBbBnhjEA6KHzZeMB0GA1UdDgQWBBR74HbmNtLsO+Vl+xXm/40gl7gJqDAN
+BgkqhkiG9w0BAQsFAAOCAgEAWnVqPdny2zGtBmgOUFq1Bnn0HO45uaDXl8oodyQY
+9KNF4oBGKYtY+lyosn/t/754p6QDaslynuABtmX/ugf46fQ1PJsssFrIAAOT+X2D
+NSZbOMBKdk6BwibirEDhEW6YlSBkDznOyH3WNeCPOdLH2qZz7EAKUI0eIt2j6pI+
+b2UitHF9wBYRdCCCV+39srr2QTLo3xWp2w8ifDu4UfLB2yTKYqVH+z8Ppcp+ipCK
++djqxi8OoiTtdsI74+19I+rC13d7sYHIdk0mA7cavSYwVt2GcO6UDP7mb/Ot7v0t
+sd2IEvFInv82DNNvvQt0u4Q14CQb36GF/Sg2BOTbelCnQ3tfpHEsKkAFZYjKRtNO
+gMfy/aHBkRN5AQ0zERuKiVqIf/sB+tAEnJex6Qm8qSO65u2ZrnNlc+lxc8n0rklx
+LVkX7PALBQGT3xmdySbXhod8yUW14/G3anrKhJoSic/0SoaqG2p9lq2eVgQEvijV
+Y60mM2D15ibAZU6lpxtSI6yAsNXmJVwJHh/aJ9tjPs85xoZPH+k1NvGE0/fzLuLn
+mtT7mdvWaPDMyPkJPejI+/K8M1Ga1J4ESjDH5VwvTzP19lu1BvGgYeuZXb1QNOzW
+u9FplVhpKmdKETnCvp/5HoVQ1zR+jeWg0VN8ebPQ2FSwOx4J7UkHS/g+zR/+KOvq
+fi8=
 -----END CERTIFICATE-----

rust/pv/tests/assets/cert/inter_ca.invalid_date.crl

@@ -3,18 +3,18 @@ MIIDRDCCASwCAQEwDQYJKoZIhvcNAQENBQAwgb0xCzAJBgNVBAYTAlVTMTQwMgYD
 VQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9u
 MTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFsIEJ1c2luZXNzIE1hY2hpbmVzIENvcnBv
 cmF0aW9uMREwDwYDVQQIDAhOZXcgWW9yazEPMA0GA1UEBwwGQXJtb25rMR4wHAYD
-VQQLDBVJQk0gWiBJbnRlcm1lZGlhdGUgQ0EXDTI0MDMxOTE1NTIzOFoXDTI0MDMy
-MDE1NTIzOFowFTATAgIBvBcNMjQwMzIwMTU1MjM4WqAjMCEwHwYDVR0jBBgwFoAU
-+f7h8O2ttBHtwI4OZnpD9wU09GYwDQYJKoZIhvcNAQENBQADggIBACgakUDSN7qq
-ATkeMC0PpwymGBu6i3Jd641BKDhwe0yG9rDa1ppm1W9z/z64LrzKSSeXJ8Hc07wP
-E94ODXqouo0WlGK4HnxGJ2QwHPJG69bYfcJREQw0Df/dTjlatyIc95QSsmChKixu
-3goFe1laa421bUDIFr111Zv+4DV/LDoPZSQvRe0xHvouZNAQ0rQ8T4gVJkU6w/dW
-636DvyXpW6/LyBTH4Nf4PHWjP6PTgzOW8+yX0RwCpHegwAA0ehEJZ8HAvW7VQWA3
-uDdfB8j9uxyKQeeIkYLkK/Ds5P0nN8Kd/6OKGlF+9mRCpEQ0n3tgQa1q7tn9blVL
-9yu3mmTbRB3YTRUCy/B7Wc8AwYE+k56wZoYpa7GI7mRYe7Vwhs6PeFmJLcZ3ByOl
-1eeR6yIRzSbS50rVNOeaez4o0hjGEj82OJpK1THtB8pnCCIE5eZ8NI37WZGcPvMU
-KbNC+JjX+rlcnK7NTdS7eQZjcKOYVuDZ0lW5n+TaXKTLL24tuA+oV1SbRZOZN7QE
-5/31A/1dCg2NDLKLNsSlq3A2DAJE5SOMSNCq4V+WGp36LAlKlNvYfHrcRxBEM6bp
-Qa4xCrcUINJ9x51wd0h5+5DilGdpoukSNwnSbMTBG7degdh2DGT4MqJ2Y1+puL9n
-7EmMLPMyTYK/tB4ZsbgV/z05Dyngi3Ut
+VQQLDBVJQk0gWiBJbnRlcm1lZGlhdGUgQ0EXDTI2MDYzMDEwNDc0OFoXDTI2MDcw
+MTEwNDc0OFowFTATAgIBvBcNMjYwNzAxMTA0NzQ4WqAjMCEwHwYDVR0jBBgwFoAU
+e+B25jbS7DvlZfsV5v+NIJe4CagwDQYJKoZIhvcNAQENBQADggIBACggya7AnmSP
+30JB6tB8edgPMKmSDVkYXJUt/JJmnjrCNgYO1VTyhCAwsQRql8u5FeCCPRfxoFSo
+dI+RhQRBd+6MBAfJRMy3iozPw0VvwblLk6REVAIWG4ZR+4jqzmbIhEDx/a3tmEV1
+qYnECGrLuMgYDtKrGiX3Kth6vwdQQiThvVA+SBeHw/x6EWbVbmjcaQDSl9EGrCGs
+uLZM414h+1gFwphUq/kwwC9PL0vHhqC7hx94hIHTdMd27E6yQ2k+FNicmC2zxg5m
+090YdfjWjn4gf/RTNvj7WJoIp6YZqvCWgh2jSdleNk4cjX9ml8klNA7Dds3XzL6c
+WovB8lILPjfMHrXVDjnlggj6IpN6uCYroQX34GzOueGZ+9dwLjU427YA4sauR063
+JUwdHXT6hQ/a1t67zS4SQ5VrvT+sKB9iEHCyUy2r9hSMQh4v0lQesHdTWnwmG46F
++wJ5wOKY1epf8d28WZIABYR5ZxnL6brEuygaJ2Vxph1ngHfQdIZ++3BGNmkZ/1Vd
+gFbxhAJ3FP3/1E/KtDjfAsnSdPxo3WYZ45cw8sE2N2o7M/r5YUaQinSElc/6KLpA
+JdjYRdxXuVwwSMzERukyc0QvECdTNrHlRzFS/xyeVq2MIEniBEI5M8gWNdBGi5X5
+yugUqOEnGN463TvqBQwjhP8/1tUcqQ2c
 -----END X509 CRL-----

rust/pv/tests/assets/cert/inter_ca.invalid_signer.crl

@@ -3,18 +3,18 @@ MIIDRjCCAS4CAQEwDQYJKoZIhvcNAQENBQAwgb0xCzAJBgNVBAYTAlVTMTQwMgYD
 VQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9u
 MTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFsIEJ1c2luZXNzIE1hY2hpbmVzIENvcnBv
 cmF0aW9uMREwDwYDVQQIDAhOZXcgWW9yazEPMA0GA1UEBwwGQXJtb25rMR4wHAYD
-VQQLDBVJQk0gWiBJbnRlcm1lZGlhdGUgQ0EXDTI0MDMxMTE1NTIzOFoYDzIzODgx
-MjIzMTU1MjM4WjAVMBMCAgG8Fw0yNDAzMjAxNTUyMzhaoCMwITAfBgNVHSMEGDAW
-gBTWntryJpCwZqZJ1H3nznJYhbfoKjANBgkqhkiG9w0BAQ0FAAOCAgEAFSRriQnY
-3LIc9AHCGYZM+BFfaDnQCiwUx2PuYownMGOyDOu8xjBBIgNgLsNsqVLBQqP/tOdz
-9WpIQd2VXbj8o2UaHZullRbJNJoNHzuC0KsdYuvZVooJ46nJONCo6RwsapiLlXnf
-Y/c//Ynqmk8xBZZpB4pAZKKq0D3eoeNFPJGWSwRa5AfQx5qpbikntK6khIBb8c+4
-NfK6VMpEsHZQUG25fdLIpDOV2nnhRd2Xbcu/THFeCV2VnI8yoormOeiJznRJq1bv
-C4+jmW4NUAvFUFbcBRDpuq8LTIQUYuQYs018aCOqTTpMTTV5Q1iWuTZtAbO91UJp
-APEtEJH+/Wd/xB5ABk19bMiyxbCQeoLci7US0YEzASeGLH3Z59swwMvkGUhc2UvE
-Jtpx0unupgdA3lCpa/nDYwuFYCqmZ1kKHYtELC7WUldzd8K/J8XkNF4UIreTTD/0
-kLC3UZEKuoIj3Lv4GrnWKcIdQ51jUMdbTUeIdWFzjqdxFq4i6oqgWA5Hjcr3yDcM
-ATjxVDLxeLC+fJf6/SQu+7dOWKPKzIS8BcufmZpkRoxrt5qmgoJHuceps5pdfa0B
-dy8xEb9FnGNSuLec1rcUPPFgCioSgDFoQiU0aoToW/kDVTA6/PHFh6TD6Qynmc4K
-PtMu/kCMWULgMi68svcnA7NxpoKAsCnQH6c=
+VQQLDBVJQk0gWiBJbnRlcm1lZGlhdGUgQ0EXDTI2MDYyMjEwNDc0OFoYDzIzOTEw
+NDA1MTA0NzQ4WjAVMBMCAgG8Fw0yNjA3MDExMDQ3NDhaoCMwITAfBgNVHSMEGDAW
+gBQiWxPrMAV5humwWwZ4YxAOih82XjANBgkqhkiG9w0BAQ0FAAOCAgEAahxdgkY2
+33bXzjVzL8GcLAUQnzuvjhyxpi8hoDUj95dFnawWmAbI6RC1hMd3ws2dytiEOR4b
+YdfySTyuIJYAk4kCyica5pFPuaEaBzq9znR+NXS5YJjIPCNrAcEl1v8cjp2C6tp7
+9oZe8X3GQIyVGaSLf1MmtkrV6xzvfFKPzM1PyIKdyT0TS3mlkIdmalydSbTRdujw
+SiEkGXft/96S8GbnpCZCVJDjpkrVk9Xs5LrVms8ewjRWLYnibUMnwR2xjan7Jju8
+7zZcgnpCg5axBSQpGGpQghHrczWvJRvpaJ8581mBSOGOluYYpBLzPd92B5aL/qA8
+YCuDiznjG3ZA1FvXOUWa4S923q0hF4x+UsZnXZ2aZ1t5hM3IIfKFhNu9rymzqnyD
+kNKrXRSJyvLQex2o80FxCppACrBPEG7MbbPQa8vr0xGCHL35Uw6QA8EVZ8ybDSMj
+A0JeDNYqfZLYg/4V95Kq9jdGrxK1+82E3kaOuD1rQyHG14LGyFCRy9owDNrZK4Ud
+SughvJd4ZUyAIvADb/HZ/TmUgJCTmNWtlkekDiDxd/jkaAwDW2XtOFEnX5or6nFR
+1C6FpKCwUiUxFU0R7ZfBj3lTog9jP22X3sBdIlXX77YQkcRlbLUoIRk8h6Nlv/Vb
+cEgb5B2KiTZT77iTabcEHwHpiZcO3naajG0=
 -----END X509 CRL-----

rust/pv/tests/assets/cert/inter_ca.key

@@ -1,52 +1,52 @@
 -----BEGIN PRIVATE KEY-----
-MIIJQwIBADANBgkqhkiG9w0BAQEFAASCCS0wggkpAgEAAoICAQDIXsmFpf0kyydI
-sJa6jUclEWrXXgvKA6ShXaYJWBwLP46N7H1jckgp2sOjQntL8RS6anCvFTDRURrv
-14Uf5GdWEd1eJi8BdVmub+2uyfbMKudBZArC7WlOb6v4eqyKctDS55jeSoKgoazI
-fSMGfjHPLKnP9ARRSbLgghrtEzZRlToZjQG3Ut7O8BFME9Ntwip+Oxt6VanmhKxA
-fYaJ89SO9YOf4zShnuQiwld+RMc7K81ON2rcidI4IdeT2Alw03bEXHEphLNkul4d
-qOGYZaoqFgfrSsRrHcavEYuLKMussqKDs0/91+Qh6SsYiNj/c9/D6/XoD3DTz1TB
-g4c8B8+6d4gT4NEXFneVT9p4piybHRlitG5FO85UN0djXpUiFvR6/DFQEooZhC71
-/gHAuioU6Rx4X9wkz4HAH1dnxPVPOF5dorIZqBLFEE1Mfe6ilDikX2OqPljAZ1ZM
-5alo/rOdp3Yk/tCjS0w7b5XoxBX9VUheNyJEvVCSvl8cRJ7yAczSiORG1pRuWd/P
-5yr+qY01xYt2mUeHHZiP9F3wIy05K0wWlpZILhI7fv3MT2CTqredJXSPZJXvF07v
-x4m5nG1NsGCBdtQgYxP4S5PymNxUJZ0xS8u8d2zNArk3yfDaMufX95een8DzqWkF
-qoajvlKBZGxZW0TgIlcX2/CpcmT3TQIDAQABAoICAB9LwM2tbLHdwkvF+zD1ppZZ
-V1b+szgxI/ppSmj8uFqgaXds5/PLso5JA1QhaukkZVCtld6e4HJdKOgrwTkHP4Wv
-wiP1slNXvTNz+4uYs4HVtKufwNeL5e4Qnqtvm7n/L3M1pciYmjkVL4vcEceul8CM
-cRSQQEljCburzqFXZh1NgdbiUZGM8cygLg90LEqhMGppeIP908zzzYTAJm6vJTTU
-D6Q+RGb3DpqIQMqx2u14zLcqDDiYlTtbu9R1gpn7CXqnlqw9tBhoTJF04pGfVXn/
-2WpMkgvKCZGoG6PXciKN/zizXevf19vdE7RgEYaq1lk/ZngBy2Vl5Y7ZKJr9fFoU
-hdZq+w8UroAAzRIiLrbnGCt0+tK3rBC/DvtffNjvwjvphGaxKiz1pZdegZ4TsO+y
-zd+Aa6Gb/XCf5TIakFaYXPTpKj0UMi/TVKshblC9JWr3cuL3EoGJe4XtqxS0cGiT
-llLDTbiS4eSAM6S6Mek55jsD8KCGBrROp+A0Wc7nUinWfKXThJYvzOm4E0gSlvbN
-Fg9LqlbK47vbtSyAmfNcdl+C5oHVwE5p5AkZV8hNQOVusfs0aLufvWC+NCGLyJ/d
-wuMmFmx2XkrkhD+BsuhP1grkSjJLpKfufCzP9NBKXRzDMReiOI40AjL5Rm9ZVOc4
-99B1CuyCiWG4BPUVlj3ZAoIBAQDs0nMc6lOY2VVkAYe6B5SmF94nMUzmegcIC4Hi
-oP0+4X8M2GfAiOKAb9QaMgrNnjOOeomYMUtfUhueRkXhvt5ssmalYCTLAuskApJ0
-UM34UfpY3P3V3i69hOSdpPje6bsorTMOWheNiMz5XKTWaVnk27Ou2fAuChHuLbmC
-ApeMEYd/VgbwgdtOpLaJGPt0cQ1FhbSsoac4tHMLwN9GpVegts/WZZb0bzjXDLEY
-RcfxcYCO0FJvfaIyfr/JEnw0CsLrkDdIVcsG+QiebygxV0CiDzCeHUgd0uLNq+X6
-fXqqQh8KUMHVHuFwGpEljpxvHqXQFq5SaEYqq7m9tGTcrHS5AoIBAQDYmKgHWG9a
-lz+usrwoxuHkzPJ+lpqslEVNs60nPf3aI6+bYjsOI7MNT7QkGQXdQ/aErWqzAali
-566f3sUsDz2z/jaMGZYElqgF5sQdIAFTihPS5fkX7mcF5Nqst2tQz1rogEwWgJ14
-XSQFCogASkxTEjD+/1kmuaSsc0NuOSkh4Wcxohla/7GQaiWnTBLnZ9axobLmmT76
-vf4mGqAWmNNenHRkUY+ZoYF1xLpR/60OKzQTdUrL5NZB3bL4n3+ViOI0JE3VZYRQ
-PP3/tTr/NwwhTbkxpw/pNhbFIItPM1fzmfieGfgZlqmj5EXgwtGG2qlFPgR+9tWw
-uJwf4bHUerU1AoIBAQDDXRj5UZWFEkUPKvP80yQdoLLzQgheWWxThqqven9v0DYv
-MpbkjgfMTHR856th1JBTiWLY2lGDYQjHmNEtWXfD06g55QZ1MwMnwbdvnPlNUNNl
-W2lLdO66CVdPdTiZK9fpxnfH7ype5+uwCm0xM9ekpFmmdMNeN5BzG+VdCyZZtlxA
-/4baAUYZqmeq0aEefeSk5ZgWkYSRkssVdxa6AMw5GJZ8F3JgUyBgx2eQzoAS/b9A
-ETrwHoQfg9BS35z2kaobCe2RDrVeGzKxAKH3kjMPfdhtl1pWwBG5+YTPD5SRv9o7
-eENuvPrcsA3tHaiPQoknEI7eDIdVzDR9+sL6CIqBAoIBAQCcY90vMJN2fa7lnPhv
-GOsSIUkWTffwlD5WFF3577DTSOEK+KpbUzt9aQdQ6SBq2x+sPOrFxXVgjJhxppAH
-eBm9VNhd4DuJpJ49ZJpFzU4n25LkvFhXBzQr9UpPW0CJYK7rIXfO557LwbS4TxpT
-21GwyXnHJOhiJbjZK4CMnYkthWrVU42rPuQeugXl/e/IVhmWuIJMLmpi8bwIF0Fw
-D3jO33jK1nkxHIQ1XI6LlmiFynwXcKFJBzoM5N7M1Z1xgxyROYVZh6s5pFBhyaGH
-lV+UzGHjkBTU9tEKFK2Byji/E3WH8ohJMZfbVn9+Aiz3ifqenGDyq5cvupxACN41
-5UPhAoIBAC51vwgPKuFNXU/pipkRMr7S+Ew7N5rVij3dJhcaq0RMNm24zneKZoC2
-7b7zKd92zYV4RgviUZEiSmiGXbEvVkNrSZ0BESRt8C7dfqDZx8E3+LMH2Fz2Q3CJ
-EJjEGiQuDQuyx2ICs5ETvIFzxy0A+uRbsrjJHbikizvPbX6qY1F9q4m3GAxU1mlv
-Nj548F/eL13gCUVPfmcbkDXKXDjeMydogPqcH20/d+88Cl5puFV1KwBptmJ/2WVP
-fcVKpeLL1DvWsd9UikzYuLXP3tGs47aPPKqX20lQoZWW+su6uWXi62WuOSPckHF0
-/y+kPmf1RQh8JbiNv7ddFdj4eUReLOo=
+MIIJQgIBADANBgkqhkiG9w0BAQEFAASCCSwwggkoAgEAAoICAQDDBBxbXGVAxICd
+WVN9bR+6bcDNuHSJyqyVqdMS5rFgI1L0TFoXFcT/aNNMXSjRbbKwa3uwqkAi+/2a
+9mqZz1BAXBXNOxkwUp8McbVyxVoze3uLUN8DRUCNGN/OyiKifvVb/LDe52FH/GXg
+dnbjtLR3ctz33/E75Y2zJ0hFalqRtBNVS306eOrNsYTL3oOFAMuVv77fjqCkez+l
+wNLdFuRqO9rC9wzgCVgWGvT1i1w6xl5vlrjHBjVO+Wklgc3aaTwLrpRM5/q52k4v
+UFW9RDtNlyJc2pfGvL2jI3NVx7hLl7Tvc2ogNoudLFTlD9zHAdChGZC+i0RpdpgU
+iXGmaMm8OXFKBjfN+qIigTcSMVjzYUZA7zleb7Wi8DMRBfiWRIvpO22renfas8MU
+OhZaRipfEXScm2PEvIxjyceXaJz6uXtYj7WPCS/cDv9GAwz+wyhJCrv7GThYIDAz
+6w6grz3a5hgU0L5bAkVR1eOANViDE2gVu0l0g7DbQmYcOQwnUUegdjvdUROS+Ej0
+eeX+bsuJQ9GMMLicQQl/+8d+Kl2lHSl8UkKLYAx/IsF/GKjPqtVIMrhUoRKs2/a3
+zw2+J/aaP2AyQbiboYcXR9Dzn2v1SXhJxJOn/ByPPSNraMu7YgL+zNk0+9D6Q/J9
+47i5Ya29/Eo0Qj/A1SGxVrgz9DmXVwIDAQABAoICAE0h1hlojP+1+OzDRNtqCs+Q
+015Ko4VQbTxww/RI3EUbE5dej49r49PlYRVmD1vuGGvgxzZT0DRGGMNuzTDyp1od
+Ud4vjsHnG9MvMkYnuop8P5wVq28+t85W1UaT+mjs8Bym8EnpmDeBo8XI9TMQ6QQJ
+oU5E+8PmAkqmsdYKv7G7WJ420lwLMUuT9+MuqjQz4VHkWhlP70e/G6hygLRDdqpx
+7A+K6UO/TmDH3rUznpH8naNjKMhHM1R+H1Ffas0FLGOudCeK5UcXCi96hb7rOs1w
+hn3VU4yeYB8jSV3XNZRod37x1jrReBz9SMKkqHzpwdvGIdLLgI56AqK0zge0kH05
+1XxVIPPRlJGpwckMPOBqwOiNUDOWbWSq6CxhVbtc52ugbKBM5p5tuY7KeLw0uSoJ
+FgSXt6HEQ49IqmVAuocfkbznQojy404HInb3dncSPBChcxEqVVRq1EemTxHr+6eI
+bpTp5JnlBfD5IfdWgOUj+XFIwaD0UbL4fRNkg3hTXEVAcVuzaZ95Lu14R/uYn8Y+
+xGbAcEOfUg3MHNKaAUPE1KavoeENCLS3tdVyv/4lLkiN3mO62PaAA9uhzoJ2+hYh
+zvaQz/Dks6c05Fal1Gb9dDG+q/scosk5YGTkP5YWGy4MQJpW/PMDP8d7RG4ySN7G
+a4i2flIbfW27Tg8+FjqxAoIBAQDuntWo45MlUVVjJ6/F06F/CZs+CVPMC9W3O/L0
++nHgUALIfTgBBU2kYUfP8eo9QeicTPRTYqIJ8QfZK9+VWE11O7pgTM2sR8lgRQca
+EommPskYkVGnZVp1d4Vf9gBHDpTeVD+Dwo6bA4Bl5ECYqeaTGb24wmeSu9Jw9akU
+ToHOKLi2VFkHrhkGt5G75fW+aahzqtSBGdyWB55SPFc4bI5VeN6L7dYBRmVK5A7o
+UkOcqI7rWgeZrb7QIDHR9xsvqW/wpkfS7BiecI6t/r81LGonEcmE3p1tK4yqMtQ5
+w7EX8kwAF/n0z+15TpkId2eI97jH2wTFxpw/1+Ho6ttd8Wf/AoIBAQDROEGicIkR
+JD9aDah2JfWEAVZ+NZfLB6TdlS6+AJMd5em/yH6tu4/uP2UM5/qc0da85RNP1YH7
+4oBpCpazC2WD6+cj8tJvQ4l1c2ctB90w3thA5wOUlViqDYXvxszg+Wxyn7j4oE7K
+ympUYkgwlc5RXmZeK1fm3f2RO97JsZ5z0RCwbCHnE3S4lp+d5ewuLmUg6X/8bUdF
+lRWjjW+0WG91CDuGHEoB3wVdpuQANQnOjFjs6cQiEBwl/IzThKyTGtXT71oa06Uv
+5pDkNn3pacaXHXR1Qiny1v9kar8EjycU1IBv33m0nULfGIYz7yAun4MQUvK/X77P
+qTjAPZLGpBCpAoIBAGS2u31eGEQe8Qg5vvGjYj1pQ5HKhAjSUfDVp7UIY7oGazZN
+y656m4uu142IEJKsV85omJL9RWEmz2Y1I1g4ffDmNcLhh8mYPwGYAOhbPKfjRiNN
+aoZZu/VqbevTu8hB+klgi7JEEsaQksfur+j/hOc/bRknTGndRnQQ6707aYQnIdcr
+AKzCKaPxJNyGsdMda1DuoGShEr5sFsGk4DdbcjPXIS80Qiglmykh2rzpw8nCRxhE
+1oJhl/DmNcDmKB5UyH9s31HB/p4Y6c+8ft2lkmRNGJ4xC4cBY4yOiY6b7wopZTSA
+6ioO/K8/ok21gAiKbf5Ejd4f9uDncF1Liy06b+cCggEATRvoxM+pFNJBLxV9kx3m
+YOKFWDq0WTXWA3yqH4jir9A+2FoypiFMqMhgm+MbsJR+Clx7Q58zKvyNyykF5bM7
+lOVq6Qrjl/JSRSFlU2lkklBvb2w1G5v3c6VMSdUBSaFj4NMRP0EGCSOVEMiwRofP
+5JlgLTDYUtRaUh64u6lk9taEyiDwVdQL3sRUy8Mjytl6mCi27PfxnqmVshO8qcE2
+QvHnzkO62vmxZpTNz2280Y1UcOyvRsadOTrdRE/Pst/fEx9SHDUI2qClohabTV2Y
+vbUzaMwb3c5zjjTxdeK0yq6PL6wzlOeo78SAIb/uIoDTsz5/DR1im/KIYgHPiLqL
+EQKCAQEAoShA6T5VesnV9E4C32XFljVgzeu1zbxpbKnSZTk8YnnQ9rQDWu9gh4jj
+znoTAIzUcuQT90Zr09B8rJh9uTryfeP8yvw7fIokf2PH/QoG4XcGHEqGzW/0Fmko
+lviHJM9xRe4prz9aEkvSDSMcFbocfC5aUaRHRMbG54npxubFeNQJ3O5/6+/GUW57
+lzHk3DvVn/h7D/CwrwftxdCYXExtW+a57MvEcZjQSeMOtwwQu/TdpewlSg2YYz9K
+Rj5H34KB978ZYtfpC7EUE1bNz8tpNj0UEWLt56HdDUzeG9yawg5m2yGYJ6nYqLGl
+4zITJiUTtD1PRwtUylJJTN3WGfP5LQ==
 -----END PRIVATE KEY-----

rust/pv/tests/assets/cert/root_ca.chained.crt

@@ -1,57 +1,57 @@
 -----BEGIN CERTIFICATE-----
-MIIGXzCCBEegAwIBAgIUd6BiIEGe+cX502NGGPVuMHrV0ucwDQYJKoZIhvcNAQEL
+MIIGXzCCBEegAwIBAgIUOZ3S0s+lk0gcTX0dTjgx6qOOQGYwDQYJKoZIhvcNAQEL
 BQAwgbUxCzAJBgNVBAYTAlVTMTQwMgYDVQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2lu
 ZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFs
 IEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMREwDwYDVQQIDAhOZXcgWW9y
-azEPMA0GA1UEBwwGQXJtb25rMRYwFAYDVQQLDA1JQk0gWiBSb290IENBMCAXDTI0
-MDMyMTE0NTIzN1oYDzIzODgxMjIzMTQ1MjM3WjCBtTELMAkGA1UEBhMCVVMxNDAy
+azEPMA0GA1UEBwwGQXJtb25rMRYwFAYDVQQLDA1JQk0gWiBSb290IENBMCAXDTI2
+MDcwMjA4NDc0NloYDzIzOTEwNDA1MDg0NzQ2WjCBtTELMAkGA1UEBhMCVVMxNDAy
 BgNVBAoMK0ludGVybmF0aW9uYWwgQnVzaW5lc3MgTWFjaGluZXMgQ29ycG9yYXRp
 b24xNDAyBgNVBAMMK0ludGVybmF0aW9uYWwgQnVzaW5lc3MgTWFjaGluZXMgQ29y
 cG9yYXRpb24xETAPBgNVBAgMCE5ldyBZb3JrMQ8wDQYDVQQHDAZBcm1vbmsxFjAU
 BgNVBAsMDUlCTSBaIFJvb3QgQ0EwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIK
-AoICAQDMw/UE5XNiZpjuCRtyq4A9PDBuJJgyUl14xvN8lcsLHGK9b/WkQdDxUXsN
-QbvS2HVkg2X6AGHwixk/3U0mzgzImZhmh3i0IbFn7L2eqpuvgP82BJpveq58Sjsk
-OHYuG2JqSv63reKtK8pLXtKZnSV9vFUAwxWSuqA68FLwDgjGMK/Iy3Hh+cwnpffn
-IMqJ70Nlxc7z4KKO4nrO/+rIQSqe0UpjEEaK4Eb3YXWWontaah3/sw+uAbVncJMV
-+AacHQzi130sJJeLe4p+8DD9EYX112DEj6WFrHpyEqhsGXvLO7uJRzMqJ1WVz47x
-j8wK+GPm66KCeOM+wm65u49vNHDotlQzoclIzLDiegQo/3ob5YRTFNDJzbNN6AAE
-zF8K7f8t2TNYeWgPOmXLEVmFalOSNTZ5sLrJipsYs7uT7CT1orW3PvM16v+knigJ
-NuryIdr/+hFgRh7Sr4U/6H6fDuZGJXgZeUSNM7S1UI0iFTZyKAP/3EQrhRWlIROs
-ql9rFnH0LWaPcmk66Yyhq6Va0dmLBSjGPWAHLguKyHkMvhJfMd/1miGfz9Rz9LbE
-6CqOK8sf6EQNWTgmpTdXgjmR9dvMk3ki2aar0u+IamzfIx3y0OPSlpaO8mFMucZe
-3iaeG/l84sUR93NgVI2dCdtEinCQviudV+QwRdLzZQQNM5zLzwIDAQABo2MwYTAP
-BgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAfBgNVHSMEGDAWgBTWntry
-JpCwZqZJ1H3nznJYhbfoKjAdBgNVHQ4EFgQU1p7a8iaQsGamSdR9585yWIW36Cow
-DQYJKoZIhvcNAQELBQADggIBAHw/+RKyDRBsvWksX4ji95W+4uo292psPzpeusjw
-Ztl25D4jssgjNbEiNwyYgV9e9BCse9hOkFwAE6ogwBAel7POX8XjizaJcwSs/GaC
-2ORQ/KYRpMsypENZ4HZQbc8j9ROqTDD45B+9/5nAA6le/7wd0yS8hbum/b78vAN1
-98Ja8wfQIq1PE0heFELSRR2hAmcGkxIo1tBqP/CnAzOpBZ2ovPJ75oeGlnpk/ATY
-rUJPTY0UPGp9ZSq/l+t88onDewjCblMMMBeJSEklP2CFlE1jGx3QJtnThiJ9WQKG
-TMakgaAERrcvXs6Lx2GFuk7kCOJsWJtvT6CJVCUtEBHNGY3GqyQwNrE3OEVQ6CFb
-CNNarrRKlArBISExLY3xn0CcuWr8GewsIvwzmJBX+u2Xs0s7RYFc4S4s/SbRLqi4
-Gn77E7dG711nKHXwDxYOuDAL0MNBT4aDephQK+rF7GlHMLTUPWKYCwmjh2vzmRWJ
-fZkojybvX6g8+7fKmwTUn5LXlcnmjv9KYN8LgfHSQhvRaGtGph0X8mVH3eCs4MGG
-OUU6p9wdPS3MDBHRzn0MXEhq25r+xT829lcHdoxkMVorVDTDD7hOm3HBsF/LOh6c
-/sA1LZnnfy+YZt+Gn5cE5CSK3ddmzRbrB+ZHWbJahegJktWq2rrnw9ipfRln7DJF
-fsHf
+AoICAQDcNWY+U3kxVigsbY3bQJvd3l/rVzCLxGV9fuMtGqq+skxTWP8LRSTYy8ns
+DOWrevxyqbNyf2dM4fP2MmwwJtzBW5nwJINXiIEYxloT4TnXUrvphEM4A6m/xH/z
+9IbLOzeWiLcZR6Ipd9vXPVZIFdoyqNLckIE5tIkivoAnrH6BjzJ529LxI62WL+T6
+KzFEuV7PqKpFvBoBpD3X9GbcoZxT9d8WUO6XNVR+gFkJExZ+W9f3DWyXeWARLLJT
+t9VSrCizPdx8jh9yaHSEvO63E8k0I8+Jm+AufsA1fM+dtuvDxmFmQLu5zSwrRyOe
+STfsGVPmd9JV7z51HsvDVle480poHOW0iGdgdcz4r0dkoATC8m7zR/C/H3ClF+ex
+oiOri5Wm4eWRhDDrs7Hv+65D50cKui7wuUbL8MdqAdpoAeu5pIYLc5mZBLCraJ3G
+4YLa9IN8/dMZ5gebEe/0BotY0fkM7kdD69X7JX9HBhqesBqS3JdZqLHbB8kjM9Bg
+spNUBGX7E+qcNLZyQeMA5wQG+nnb28MVRqinDja8o/1N5u0C2h8THTUfMToYkeqq
+7MwMNSAbLsS2zwJY5U9gQbk6WM3TGrF2csHNSfojGDq+cLGVKBW6UwW9kbkLnmMc
+5P47mJ7CwRwTvOM7rw6v3pQf7SLc2IuDjXXisTLzP+JUmaZqGQIDAQABo2MwYTAP
+BgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAfBgNVHSMEGDAWgBQiWxPr
+MAV5humwWwZ4YxAOih82XjAdBgNVHQ4EFgQUIlsT6zAFeYbpsFsGeGMQDoofNl4w
+DQYJKoZIhvcNAQELBQADggIBANN2hSCmKcm5P7WC8xKULsfWff1gvLKfnCvhuAnZ
+tBIxWNsosZWvCFv7tIXpbAiwcbzlqYOPR3QzauS3B1FaNTITUGYqYLrgWzPs5Y7z
+LFmaZruhGuEA0oigCWnF8UiZ+1P9qQPiNziEpxq73cKGq7xjIAVoWW1chXVxeF7z
+HEQ3n0dKjGrbJrnSgE4o+uhoJUrGMKnYZx7lyKCdfVURM4n0kq8etkKxcFq6e3yG
+yQFPjvAeqrme3eahQcetzbmFlq51xyOv3uvv9jcA6kBJ1X1FCtECUPQxD1YeFX7s
+f89Ohyr7LiP3+aq5fRsXAMsi9eJDMxcU40HHwWFrr/mhAihLI4RLDLBxD/B/47YT
+4/c2YK5IHTTZRj95yEzKXlOhxMiMdWRTlzQCHgv/R7dE1VrVMuoIiwwtJOpkaOSW
+6WR5PrAAujtJNseGRpJyw5RCYivbb7hVmX3mot93ZaeGRU2yl1Ke61voUojHV2ZD
+OH1ddIZhpSw6fx5sc5qCVgw13l9nSAt8Cjnh6C2mvPogVwkBXYw7xt8HGxUwBele
+Sv2Pd328vYyUQAaEqj+TJNH2PS9OGQnlkNtV5Fpo64aVynUtjW4EgTWbL0wSXCHO
+YtmWoKgqJB6gzU+1tCKw8xLJMSoJyptY2xbq5QVfUR6wIqe26NNEaXnks/i5HzoY
+ohwp
 -----END CERTIFICATE-----
 -----BEGIN X509 CRL-----
 MIIDPjCCASYCAQEwDQYJKoZIhvcNAQENBQAwgbUxCzAJBgNVBAYTAlVTMTQwMgYD
 VQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9u
 MTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFsIEJ1c2luZXNzIE1hY2hpbmVzIENvcnBv
 cmF0aW9uMREwDwYDVQQIDAhOZXcgWW9yazEPMA0GA1UEBwwGQXJtb25rMRYwFAYD
-VQQLDA1JQk0gWiBSb290IENBFw0yNDAzMTExNTUyMzdaGA8yMzg4MTIyMzE1NTIz
-N1owFTATAgIBTRcNMjQwMzIwMTU1MjM3WqAjMCEwHwYDVR0jBBgwFoAU1p7a8iaQ
-sGamSdR9585yWIW36CowDQYJKoZIhvcNAQENBQADggIBAIs4Y7Qsk2TAJQqdNQeM
-3Gjx2fYFHbliDRVQPU5OP19ppeUzFGRL/SRplCH4rvEj4bBwQZcsNdmzxYyFbWcz
-lU38l5/mgkLkPdHzRnbPmVraWqKzuvNrTQ3Lj5VcgOJ95UAOwOIg2jWZlkIAUgO/
-cayWJK7l0gOIDCKSyuI6haM5D6wNAwfyKZ4WkBgYulCeqRmsMePvsj/WYL1tcR6Y
-1WSN6FtvLn9u2vqrJ879BEH5RDQSkCXsxBqKFnOpLf/gpRYhRp+3JpSACXOzy1wr
-8KxlvZ/14UOhz4x8VZ9GJTzLydzLPIhNTwcl1PJyD3pOhASxfdSXuR8f3jJvAGv5
-kaj9uO23sKU4PzLfr/DPFkhKsp+vShoSGtnZjj7ewYW9Y/PY0D9TX8CWIcwKuJ8U
-XTWRj9s/FLTlqfrbJXvSaRd0rihGQI+mSwar5cnBuxULgw4V35YmTiY8wCf3+k9c
-tGRRUj5A2fVs9NWWTReBatoou8Rnuraz6ctqwFsxJQSGS1JpfECznGq2wKqLstKn
-WCMEAKehcGqLlSco7Hg2qRNgDw5AAC058drRf9L70geV4Tf00iXjK19aHSJ1wH+p
-7hUcTCiQ7413ztC7HawqsRW3Yzszucj+6vqF8ZYMh+9oEzzWJEt/piKakIwbxwKk
-cf5JE3KE7X+LQS3p4+sw/wP4
+VQQLDA1JQk0gWiBSb290IENBFw0yNjA2MjIxMDQ3NDZaGA8yMzkxMDQwNTEwNDc0
+NlowFTATAgIBTRcNMjYwNzAxMTA0NzQ2WqAjMCEwHwYDVR0jBBgwFoAUIlsT6zAF
+eYbpsFsGeGMQDoofNl4wDQYJKoZIhvcNAQENBQADggIBACnVIJGdrqX0b2vUQ9Oc
+DTfN6KMlmt5mKD9c7c24OPOVo7y1lGEGcanGsZ8/0mZ7G5dIqWU0yxXnMD1U3cbm
+nKGHkor/gyvP6hdozFUWIc5EVebDJvnIfj4L0kEVFE+wUO3iqtNnbQjvBo90iq9W
+j+TTD+QQAMGKQyi3AwEL6nVrOZiUwjaJCdaV41zXxn7hiyfN89T4xM/f1TnRZ+xw
+5ELqGN77PBWaEWf3XyLIbxt/2xJL03zmV8cEHmdPG37i/p82mcYxqkwRlU6iCJeQ
+CQ39GNQd9avGm5+cUchAmdZf+tQLVcKsKqjZ7Cq0yihxKoYwOngeOZswF3NueGIP
+jXi3jnA8f0vr1uDilleYkIs5At9IAMq2oA8czKelcIIqQLiTaj03m6u0ehb4VWmA
+T9LWR6RtuBS0d2Lx8cYapzU0tnnU9mOemixljqLqnURmhfI2yRuh9f2FuzD2n5Pv
+H4WHpc2a2Uoz4ub+v93j1ZScDCb+xTmOJ6HfJ2V6A8FYIaD21X1n8n4yc+WeV4Ta
+aBqoWI3TihzwJGvc67Zjfdkt7KhUZ6heJZHRrPVKWbDIVL7NVFnx53ANkOZ18pWt
+IzJb2xWQlP3u9e1JX4yqVw75woZxQKE3v60F0UGofamRB375lGDYrsufD5Sz1XOl
+Cwl/78PBFBOkcvgVCubeR9cU
 -----END X509 CRL-----

rust/pv/tests/assets/cert/root_ca.crl

@@ -3,18 +3,18 @@ MIIDPjCCASYCAQEwDQYJKoZIhvcNAQENBQAwgbUxCzAJBgNVBAYTAlVTMTQwMgYD
 VQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9u
 MTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFsIEJ1c2luZXNzIE1hY2hpbmVzIENvcnBv
 cmF0aW9uMREwDwYDVQQIDAhOZXcgWW9yazEPMA0GA1UEBwwGQXJtb25rMRYwFAYD
-VQQLDA1JQk0gWiBSb290IENBFw0yNDAzMTExNTUyMzdaGA8yMzg4MTIyMzE1NTIz
-N1owFTATAgIBTRcNMjQwMzIwMTU1MjM3WqAjMCEwHwYDVR0jBBgwFoAU1p7a8iaQ
-sGamSdR9585yWIW36CowDQYJKoZIhvcNAQENBQADggIBAIs4Y7Qsk2TAJQqdNQeM
-3Gjx2fYFHbliDRVQPU5OP19ppeUzFGRL/SRplCH4rvEj4bBwQZcsNdmzxYyFbWcz
-lU38l5/mgkLkPdHzRnbPmVraWqKzuvNrTQ3Lj5VcgOJ95UAOwOIg2jWZlkIAUgO/
-cayWJK7l0gOIDCKSyuI6haM5D6wNAwfyKZ4WkBgYulCeqRmsMePvsj/WYL1tcR6Y
-1WSN6FtvLn9u2vqrJ879BEH5RDQSkCXsxBqKFnOpLf/gpRYhRp+3JpSACXOzy1wr
-8KxlvZ/14UOhz4x8VZ9GJTzLydzLPIhNTwcl1PJyD3pOhASxfdSXuR8f3jJvAGv5
-kaj9uO23sKU4PzLfr/DPFkhKsp+vShoSGtnZjj7ewYW9Y/PY0D9TX8CWIcwKuJ8U
-XTWRj9s/FLTlqfrbJXvSaRd0rihGQI+mSwar5cnBuxULgw4V35YmTiY8wCf3+k9c
-tGRRUj5A2fVs9NWWTReBatoou8Rnuraz6ctqwFsxJQSGS1JpfECznGq2wKqLstKn
-WCMEAKehcGqLlSco7Hg2qRNgDw5AAC058drRf9L70geV4Tf00iXjK19aHSJ1wH+p
-7hUcTCiQ7413ztC7HawqsRW3Yzszucj+6vqF8ZYMh+9oEzzWJEt/piKakIwbxwKk
-cf5JE3KE7X+LQS3p4+sw/wP4
+VQQLDA1JQk0gWiBSb290IENBFw0yNjA2MjIxMDQ3NDZaGA8yMzkxMDQwNTEwNDc0
+NlowFTATAgIBTRcNMjYwNzAxMTA0NzQ2WqAjMCEwHwYDVR0jBBgwFoAUIlsT6zAF
+eYbpsFsGeGMQDoofNl4wDQYJKoZIhvcNAQENBQADggIBACnVIJGdrqX0b2vUQ9Oc
+DTfN6KMlmt5mKD9c7c24OPOVo7y1lGEGcanGsZ8/0mZ7G5dIqWU0yxXnMD1U3cbm
+nKGHkor/gyvP6hdozFUWIc5EVebDJvnIfj4L0kEVFE+wUO3iqtNnbQjvBo90iq9W
+j+TTD+QQAMGKQyi3AwEL6nVrOZiUwjaJCdaV41zXxn7hiyfN89T4xM/f1TnRZ+xw
+5ELqGN77PBWaEWf3XyLIbxt/2xJL03zmV8cEHmdPG37i/p82mcYxqkwRlU6iCJeQ
+CQ39GNQd9avGm5+cUchAmdZf+tQLVcKsKqjZ7Cq0yihxKoYwOngeOZswF3NueGIP
+jXi3jnA8f0vr1uDilleYkIs5At9IAMq2oA8czKelcIIqQLiTaj03m6u0ehb4VWmA
+T9LWR6RtuBS0d2Lx8cYapzU0tnnU9mOemixljqLqnURmhfI2yRuh9f2FuzD2n5Pv
+H4WHpc2a2Uoz4ub+v93j1ZScDCb+xTmOJ6HfJ2V6A8FYIaD21X1n8n4yc+WeV4Ta
+aBqoWI3TihzwJGvc67Zjfdkt7KhUZ6heJZHRrPVKWbDIVL7NVFnx53ANkOZ18pWt
+IzJb2xWQlP3u9e1JX4yqVw75woZxQKE3v60F0UGofamRB375lGDYrsufD5Sz1XOl
+Cwl/78PBFBOkcvgVCubeR9cU
 -----END X509 CRL-----

rust/pv/tests/assets/cert/root_ca.crt

@@ -1,37 +1,37 @@
 -----BEGIN CERTIFICATE-----
-MIIGXzCCBEegAwIBAgIUd6BiIEGe+cX502NGGPVuMHrV0ucwDQYJKoZIhvcNAQEL
+MIIGXzCCBEegAwIBAgIUOZ3S0s+lk0gcTX0dTjgx6qOOQGYwDQYJKoZIhvcNAQEL
 BQAwgbUxCzAJBgNVBAYTAlVTMTQwMgYDVQQKDCtJbnRlcm5hdGlvbmFsIEJ1c2lu
 ZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMTQwMgYDVQQDDCtJbnRlcm5hdGlvbmFs
 IEJ1c2luZXNzIE1hY2hpbmVzIENvcnBvcmF0aW9uMREwDwYDVQQIDAhOZXcgWW9y
-azEPMA0GA1UEBwwGQXJtb25rMRYwFAYDVQQLDA1JQk0gWiBSb290IENBMCAXDTI0
-MDMyMTE0NTIzN1oYDzIzODgxMjIzMTQ1MjM3WjCBtTELMAkGA1UEBhMCVVMxNDAy
+azEPMA0GA1UEBwwGQXJtb25rMRYwFAYDVQQLDA1JQk0gWiBSb290IENBMCAXDTI2
+MDcwMjA4NDc0NloYDzIzOTEwNDA1MDg0NzQ2WjCBtTELMAkGA1UEBhMCVVMxNDAy
 BgNVBAoMK0ludGVybmF0aW9uYWwgQnVzaW5lc3MgTWFjaGluZXMgQ29ycG9yYXRp
 b24xNDAyBgNVBAMMK0ludGVybmF0aW9uYWwgQnVzaW5lc3MgTWFjaGluZXMgQ29y
 cG9yYXRpb24xETAPBgNVBAgMCE5ldyBZb3JrMQ8wDQYDVQQHDAZBcm1vbmsxFjAU
 BgNVBAsMDUlCTSBaIFJvb3QgQ0EwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIK
-AoICAQDMw/UE5XNiZpjuCRtyq4A9PDBuJJgyUl14xvN8lcsLHGK9b/WkQdDxUXsN
-QbvS2HVkg2X6AGHwixk/3U0mzgzImZhmh3i0IbFn7L2eqpuvgP82BJpveq58Sjsk
-OHYuG2JqSv63reKtK8pLXtKZnSV9vFUAwxWSuqA68FLwDgjGMK/Iy3Hh+cwnpffn
-IMqJ70Nlxc7z4KKO4nrO/+rIQSqe0UpjEEaK4Eb3YXWWontaah3/sw+uAbVncJMV
-+AacHQzi130sJJeLe4p+8DD9EYX112DEj6WFrHpyEqhsGXvLO7uJRzMqJ1WVz47x
-j8wK+GPm66KCeOM+wm65u49vNHDotlQzoclIzLDiegQo/3ob5YRTFNDJzbNN6AAE
-zF8K7f8t2TNYeWgPOmXLEVmFalOSNTZ5sLrJipsYs7uT7CT1orW3PvM16v+knigJ
-NuryIdr/+hFgRh7Sr4U/6H6fDuZGJXgZeUSNM7S1UI0iFTZyKAP/3EQrhRWlIROs
-ql9rFnH0LWaPcmk66Yyhq6Va0dmLBSjGPWAHLguKyHkMvhJfMd/1miGfz9Rz9LbE
-6CqOK8sf6EQNWTgmpTdXgjmR9dvMk3ki2aar0u+IamzfIx3y0OPSlpaO8mFMucZe
-3iaeG/l84sUR93NgVI2dCdtEinCQviudV+QwRdLzZQQNM5zLzwIDAQABo2MwYTAP
-BgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAfBgNVHSMEGDAWgBTWntry
-JpCwZqZJ1H3nznJYhbfoKjAdBgNVHQ4EFgQU1p7a8iaQsGamSdR9585yWIW36Cow
-DQYJKoZIhvcNAQELBQADggIBAHw/+RKyDRBsvWksX4ji95W+4uo292psPzpeusjw
-Ztl25D4jssgjNbEiNwyYgV9e9BCse9hOkFwAE6ogwBAel7POX8XjizaJcwSs/GaC
-2ORQ/KYRpMsypENZ4HZQbc8j9ROqTDD45B+9/5nAA6le/7wd0yS8hbum/b78vAN1
-98Ja8wfQIq1PE0heFELSRR2hAmcGkxIo1tBqP/CnAzOpBZ2ovPJ75oeGlnpk/ATY
-rUJPTY0UPGp9ZSq/l+t88onDewjCblMMMBeJSEklP2CFlE1jGx3QJtnThiJ9WQKG
-TMakgaAERrcvXs6Lx2GFuk7kCOJsWJtvT6CJVCUtEBHNGY3GqyQwNrE3OEVQ6CFb
-CNNarrRKlArBISExLY3xn0CcuWr8GewsIvwzmJBX+u2Xs0s7RYFc4S4s/SbRLqi4
-Gn77E7dG711nKHXwDxYOuDAL0MNBT4aDephQK+rF7GlHMLTUPWKYCwmjh2vzmRWJ
-fZkojybvX6g8+7fKmwTUn5LXlcnmjv9KYN8LgfHSQhvRaGtGph0X8mVH3eCs4MGG
-OUU6p9wdPS3MDBHRzn0MXEhq25r+xT829lcHdoxkMVorVDTDD7hOm3HBsF/LOh6c
-/sA1LZnnfy+YZt+Gn5cE5CSK3ddmzRbrB+ZHWbJahegJktWq2rrnw9ipfRln7DJF
-fsHf
+AoICAQDcNWY+U3kxVigsbY3bQJvd3l/rVzCLxGV9fuMtGqq+skxTWP8LRSTYy8ns
+DOWrevxyqbNyf2dM4fP2MmwwJtzBW5nwJINXiIEYxloT4TnXUrvphEM4A6m/xH/z
+9IbLOzeWiLcZR6Ipd9vXPVZIFdoyqNLckIE5tIkivoAnrH6BjzJ529LxI62WL+T6
+KzFEuV7PqKpFvBoBpD3X9GbcoZxT9d8WUO6XNVR+gFkJExZ+W9f3DWyXeWARLLJT
+t9VSrCizPdx8jh9yaHSEvO63E8k0I8+Jm+AufsA1fM+dtuvDxmFmQLu5zSwrRyOe
+STfsGVPmd9JV7z51HsvDVle480poHOW0iGdgdcz4r0dkoATC8m7zR/C/H3ClF+ex
+oiOri5Wm4eWRhDDrs7Hv+65D50cKui7wuUbL8MdqAdpoAeu5pIYLc5mZBLCraJ3G
+4YLa9IN8/dMZ5gebEe/0BotY0fkM7kdD69X7JX9HBhqesBqS3JdZqLHbB8kjM9Bg
+spNUBGX7E+qcNLZyQeMA5wQG+nnb28MVRqinDja8o/1N5u0C2h8THTUfMToYkeqq
+7MwMNSAbLsS2zwJY5U9gQbk6WM3TGrF2csHNSfojGDq+cLGVKBW6UwW9kbkLnmMc
+5P47mJ7CwRwTvOM7rw6v3pQf7SLc2IuDjXXisTLzP+JUmaZqGQIDAQABo2MwYTAP
+BgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAfBgNVHSMEGDAWgBQiWxPr
+MAV5humwWwZ4YxAOih82XjAdBgNVHQ4EFgQUIlsT6zAFeYbpsFsGeGMQDoofNl4w
+DQYJKoZIhvcNAQELBQADggIBANN2hSCmKcm5P7WC8xKULsfWff1gvLKfnCvhuAnZ
+tBIxWNsosZWvCFv7tIXpbAiwcbzlqYOPR3QzauS3B1FaNTITUGYqYLrgWzPs5Y7z
+LFmaZruhGuEA0oigCWnF8UiZ+1P9qQPiNziEpxq73cKGq7xjIAVoWW1chXVxeF7z
+HEQ3n0dKjGrbJrnSgE4o+uhoJUrGMKnYZx7lyKCdfVURM4n0kq8etkKxcFq6e3yG
+yQFPjvAeqrme3eahQcetzbmFlq51xyOv3uvv9jcA6kBJ1X1FCtECUPQxD1YeFX7s
+f89Ohyr7LiP3+aq5fRsXAMsi9eJDMxcU40HHwWFrr/mhAihLI4RLDLBxD/B/47YT
+4/c2YK5IHTTZRj95yEzKXlOhxMiMdWRTlzQCHgv/R7dE1VrVMuoIiwwtJOpkaOSW
+6WR5PrAAujtJNseGRpJyw5RCYivbb7hVmX3mot93ZaeGRU2yl1Ke61voUojHV2ZD
+OH1ddIZhpSw6fx5sc5qCVgw13l9nSAt8Cjnh6C2mvPogVwkBXYw7xt8HGxUwBele
+Sv2Pd328vYyUQAaEqj+TJNH2PS9OGQnlkNtV5Fpo64aVynUtjW4EgTWbL0wSXCHO
+YtmWoKgqJB6gzU+1tCKw8xLJMSoJyptY2xbq5QVfUR6wIqe26NNEaXnks/i5HzoY
+ohwp
 -----END CERTIFICATE-----

rust/pv/tests/assets/cert/root_ca.key

@@ -1,52 +1,52 @@
 -----BEGIN PRIVATE KEY-----
-MIIJQgIBADANBgkqhkiG9w0BAQEFAASCCSwwggkoAgEAAoICAQDMw/UE5XNiZpju
-CRtyq4A9PDBuJJgyUl14xvN8lcsLHGK9b/WkQdDxUXsNQbvS2HVkg2X6AGHwixk/
-3U0mzgzImZhmh3i0IbFn7L2eqpuvgP82BJpveq58SjskOHYuG2JqSv63reKtK8pL
-XtKZnSV9vFUAwxWSuqA68FLwDgjGMK/Iy3Hh+cwnpffnIMqJ70Nlxc7z4KKO4nrO
-/+rIQSqe0UpjEEaK4Eb3YXWWontaah3/sw+uAbVncJMV+AacHQzi130sJJeLe4p+
-8DD9EYX112DEj6WFrHpyEqhsGXvLO7uJRzMqJ1WVz47xj8wK+GPm66KCeOM+wm65
-u49vNHDotlQzoclIzLDiegQo/3ob5YRTFNDJzbNN6AAEzF8K7f8t2TNYeWgPOmXL
-EVmFalOSNTZ5sLrJipsYs7uT7CT1orW3PvM16v+knigJNuryIdr/+hFgRh7Sr4U/
-6H6fDuZGJXgZeUSNM7S1UI0iFTZyKAP/3EQrhRWlIROsql9rFnH0LWaPcmk66Yyh
-q6Va0dmLBSjGPWAHLguKyHkMvhJfMd/1miGfz9Rz9LbE6CqOK8sf6EQNWTgmpTdX
-gjmR9dvMk3ki2aar0u+IamzfIx3y0OPSlpaO8mFMucZe3iaeG/l84sUR93NgVI2d
-CdtEinCQviudV+QwRdLzZQQNM5zLzwIDAQABAoICAADiwh8UzQR6dCPndy5uTn41
-UfJQBzaEg7H/jlMWJMw2AblXECV3QWuh0hnzFFhrpkpahSjpMoNDXscXcnt9/bEq
-dO3QnTWORcGw1PsoOscuFCyMJYzg53tTKOFVuzEk3i6eh26M+oOMQnJEBT4z31Ml
-auq3bVL2qrXGj11JekE9Oa1xL9tt5LOxNJrT2fxxxAVfLy9/48Qhd62Ijt/x5DjO
-p/c4vU1hff0Y91TA/C6eceXGxQUYLcw2QPSh34lyWLlsfDaiK+OnE6jL6jJWDpHL
-Ljh7dJhY8CipKwBYtd/hsMR9wdtnUyf0P2aNHDFZ9LitgUT2N+lwFuGHza2J+QkO
-sJndo0bNZCRbcfyaATpqQK50fLHpSOkIaA0uNf8IPsgRHnC9oHimIM70/VB4xN5K
-8UJb02rVvAWsV2ZJEzhBXt3ivMwH6d+HKVerkjdhuKxUSO0x4ZfArZI0md6M2Etf
-b2UbMOyyTknWiJcYD65151rThGeyKRSW1GalvrwWwcAAWyabf61a681brpY0t/u4
-aZXBdg41DiZ8bnheK706+l7hpCt/Zg3d+HPVtG8xWreFZzWMPNAmuVcdqtEOqdhe
-aW6xDR/7ekdVjtzFboTVuq12JvMgucfXoYjqNA1TxvXIdl1eSWZzEnfXhDxDezpI
-ZUXfR1jdmyEucFXAlkjVAoIBAQD094bU92/iTkV3ySqDqd1a9gdfMw9ewi18TzWM
-fCtE+dWgvXE1RmzRmHaeKjElJaeAAc/ggXen1ecJmCRsD1wjItyP1/j/IzY/7yzK
-KtLV3w3oArENFwZKa3HeaHsapwladJBVC0CpaRnfO52VKDa/1gvDQsojOkDhngCH
-MKfRd5x4c4+WOuvTpfyQASLXJcurlIhabCa/MGIvhMRXcspGkkttZqxhLGoioAmS
-VcKhje8UuDLnBxCFrmIOVl5Hf8wT4TfOYWq6J5F/v/32dq8Rdf/W8KRIq0N5JDnC
-xFKGkm8QEFxNuSzzfykMcEhKGYXAYFKGIBRhM+nNGuFyqMB7AoIBAQDV/Oguqp74
-4inMMQTP8i3aYlASfU/l2OkNQE7JbxIClf52TzOCPy8v86FjIyx2iYPv2osI3RGi
-yVdDIYPXOBEQZQV7eHS3kuO5/lFw6psQVjMf0qdE9hGuZx3MnXQgol7mUEDS7Rjc
-e1YSkYPpdSd2y1Gsb84iZcbBgBPZsdjy81ZBrfP8bo3BVBtqQIngWCXvM3gWmBH/
-duNxtpvNBFruX2ZwaKcRJjfZ7V6iy2fzEYH84FPyiwj/COCtSfDgkFjCmEa2jepQ
-+5r1VXFjeWwonfYeiwZ/WlIGDKhHNZG4XCni05CA2ZejDLmI3IKaMjukWNI49hhS
-ypLJj5n9a8O9AoIBAHrPfbFXO6hhRUKAf+fySR9JKPj5SENhZhxkOZxsw+SYvBkR
-4Kes3vFVVmKFFI5jCk6KmgUb4zkpa+LLe7cRHEghOiKDTDndFV2IMxRH09uVMAuZ
-DdpaKLU2mKfACbea9n164sFAGvLT1jysTpxwxMH4NX13BpASrGRwKiOcqQXCyZc5
-mErgz0oUdUJcz3K9aBZlKNbsUaCYSSE5lpWg3vfycA4w40r0UWF6ilHq3ODRn4Lr
-tdlNGWNrwY0ej7WYxF9TEf9Np4wcOj2pq1Dcv3gpiFHh4vrrobAiETMr6ZO95iBP
-k3cD1x1cKuApipRbp0qC/9xuSMlSlWxWhaBOKfECggEAb0NdBka4+fe+e+lQ8z6d
-ENvlfnehv4UVSEqTrLEP0EBlWua7hZGM24X1+DIlwEyoSWJ8wFMSBG5j7QfUIWeJ
-l9ivDRAIwBqkReUyO2AA2HG5i2Zgir7XWrNLD0UfSIikh2RbEFEviBSpIGaBDDZa
-Gq6E/P/1UnVQ7vPFXn/WqhxUUTo9jpd9JXSx/IEqL3gl4UYFvtm7IfWTNWEZiXQm
-Q6NfBDumAoi4qZt+hW710bDcwbtyar5YIyNejzvO/zSOsj+zJOCNYSYx4DZZCrvr
-vQLFIgRvkHBKDdMu/DeiWRWywbn3fMemzKSlI8BkOAC+eimkxPFQnFuwDxWXn+kU
-kQKCAQEA0EkmMxpI8eC47YeHXKBiACMsRiyiItXal7TAwy/ZQMg/nxrDB85f5L8B
-Zucw2UsA40/5EN/L6n10iaWBQzz7q3TcI15MmIzoBA7Bh9IJI9Oz1+oeOn01b9u0
-7cb+5Shh9Tmu2G4Z/9LE7wB8q9sU/BtJns6owFbGHL9q6ndtl7YVQ7uVzUQjNQph
-qp2DvA8qZYBkNRNZwYAMOJaAO8uhDBSR2wm9XiZ3Q9kar0Tx6sR9WK2pjZTE3okJ
-RUqzQS0EXQ2XLepP3rhYtjAjtlnx9K3jniIHciyFV2rW0SaGH4VvE/nRvCM12q/8
-p+5MT0G3vVdRQM0Poco3B8DElAoMTQ==
+MIIJQQIBADANBgkqhkiG9w0BAQEFAASCCSswggknAgEAAoICAQDcNWY+U3kxVigs
+bY3bQJvd3l/rVzCLxGV9fuMtGqq+skxTWP8LRSTYy8nsDOWrevxyqbNyf2dM4fP2
+MmwwJtzBW5nwJINXiIEYxloT4TnXUrvphEM4A6m/xH/z9IbLOzeWiLcZR6Ipd9vX
+PVZIFdoyqNLckIE5tIkivoAnrH6BjzJ529LxI62WL+T6KzFEuV7PqKpFvBoBpD3X
+9GbcoZxT9d8WUO6XNVR+gFkJExZ+W9f3DWyXeWARLLJTt9VSrCizPdx8jh9yaHSE
+vO63E8k0I8+Jm+AufsA1fM+dtuvDxmFmQLu5zSwrRyOeSTfsGVPmd9JV7z51HsvD
+Vle480poHOW0iGdgdcz4r0dkoATC8m7zR/C/H3ClF+exoiOri5Wm4eWRhDDrs7Hv
++65D50cKui7wuUbL8MdqAdpoAeu5pIYLc5mZBLCraJ3G4YLa9IN8/dMZ5gebEe/0
+BotY0fkM7kdD69X7JX9HBhqesBqS3JdZqLHbB8kjM9BgspNUBGX7E+qcNLZyQeMA
+5wQG+nnb28MVRqinDja8o/1N5u0C2h8THTUfMToYkeqq7MwMNSAbLsS2zwJY5U9g
+Qbk6WM3TGrF2csHNSfojGDq+cLGVKBW6UwW9kbkLnmMc5P47mJ7CwRwTvOM7rw6v
+3pQf7SLc2IuDjXXisTLzP+JUmaZqGQIDAQABAoICAEDiAwQuODFPP3sHtJp7iPFw
+ijafdBBah8TYVDt/9ftGMbMFL/C0KM0wDojcq/dAv41Rbyw3WcqPcQCDjtkJOlZG
+lS7qs0BhWhhgqT3eSNqm5/NAI0Yn3iZA0aqhy+2pvxE9qyVps+AgDsh2rCuFNMtk
+buzKLyk/hoCUPNJzwrqN5MN+/8JJTuZHqmIDw/qJ2+O3wKPXbpo5OHee7YfonlUm
+xtqecg5fikvTqWhBFYmZqiKC9BIVkza8QrbkHZjEXSGjAoo4ng9ps5tAx91tmQUh
+4A6dvQo2EpAv/ERuFz2SADTOsgFm8LK3vUjwLegE9nGbsH/dhDuiHUuq7yHxnWRP
+3GOJdxOvOKCBVMIrZVY5wxC7xNOKgiyP3t2CqrM84ejDH30d06PMATuHHnnu/Tlx
+2t3vqmpGUD5uU3LS5YLIqS+t2gHjU92yo9AeTURJu+UK3CvF28zL8cBymSftVdp2
+mIaVxR3T8DGyCFDBHIq9BN9ABNHxvmcsJ4/uUk76s+EeD6oxTRBaO4UN/5gClIUR
+jRWSbSzgfRabHy0Y1HtQiib+aBtDMs3y8px8DWXAhwU3vaJsMnRch4QcgQ67YfA+
+G5VWaaYy5gHqa1UtPUkIu0N32INvA15ajXsemkCKQinUQp5cjxXPVZrIG2bfSzmC
+bX/6zp6llBvvujaY+qN5AoIBAQDynKPvpw/orpIilI7XQ5epDLOeV5v8Ga4sEv2I
+neC0H7kju3vIHfxHZwbZgBd673EyTBYeywYkpyh7taVUmrEnrRo3GgnK2Nw30UaC
+cMtF6Uce/vcyyPtiJpV+hcJrn/xUXRywruLDAPiOda7zQh0309slyjZz1ZTVqF9j
+PtvZrMbP9RolsNvE5j6is6UZ7PfKoOuzP/bqjC436U2kveacYnBUAaKwF4x9x4O6
+WxlbcTI6d7jlyqWQEuEuqdHrFLdLyYIezu7nTqvlTDmm0hNO3xGs46i9bjxsYd6e
+6GBxwkO4twrzZ9JyjzdwgnIvR/pYiE3rEvt1cgo0ctZI99Y7AoIBAQDoXET95ZsN
+w6TpshKiLqCFNeIHHyAfyl58vdsiuG/SbyVHDohrieKsk8eI3zmieFAtOmHExRY0
+/CjUybhU6XG49O/580zDI8KyCcskN0e4kcuCfPkf6GObjG7i5KYyMj/6Jm6hot8Z
+T/asioRwpsXbSH0YIQV0lG9/SjwKp0+PM/hKNMTWKFOnYtmh+2cEyfxM7BV77vfQ
+K/XafQyxoZKW6b5hYZmS5iGgDFuiaiMOHoOUCnbSDv4ylUkrcDJphl1FxifLCjhX
+vjNlIlV6iOgJQRpbJk6IGsytbumjNqqLIXyI5+Bc6VYdFfCtn1xOOgJShr5rfirs
+R1+DyLYWHve7AoIBAGY2nk7KiMZUPhc5lZCV1qCPTGGKsZody6af/ZcARPo+X0bx
+py3hjDcc7eLWt43AsWUqbytcB+OLVWABYH1rivWXVXMfkj6W7PjLP7SXBt0WcjNZ
+4hXQXTC15sfeXNHxHmMAs6SwmbLkhtOmOyYblam+pRafwh89Pa5ieIWcpw1nYH+e
+2PxGLeEfzAXKP+XTU3ZYI9VqPoIEuzgtH9wncbAzPPX3lm4wDa20UAhEd0NyRmIh
+rJGLtgMkISECxQEQwkS4ygxmzHpBR+ScH7Hr0dyp2I2JgL8GYYicFynF51QmL1f0
+LjXsaNqBAi9xld/bqFqCWqmOXsjVWf1M4IDvgZ8CggEATYEZcib4BStRArJnDLnI
+ySYj8oQrTu9NfQZG5dnnUqXIJV9vmY8wkKfqUnlC3DKNa8ihe+TRd3L0m6V9WrVT
+PYJV2WWSITT4aDJkE/xsa+AVpbzRzBbTwrqg8gWaefvQ4zuWg0u0ZtkJSpwZeQnn
+zTDsqPO6whwQ5MB6LoOIQhfvpbDcRyLEZHzQYvtcbXiCM5Y7xE79Ue6X3vz/EvD1
+2Gi3G/xWIW2poZz9o7sLXlZHRUYIRCDEIVMySM7vwcsTqYZjF5KdIIdM1VsScADi
+hNO2Wtj4MOXfh6oLPGmrkSTmSTQu3k7mbmU3FnKlc2JeC/Dt6yT2ZEGaVnbIZbCG
+qQKCAQAoGWIoFp8QCaufav05EDOEvU9HwL1SH4IuIB+vw/PmWwtOlVmdDk0FGAz9
+x4QJLlPcafKsrSNM2eDCCTolKmqmhtrPqH8Bp2LCsbhYF1EM2kwurDMLcatdMf2T
+tnEVhVM4UTaJIXxPwm/bRImKNVbsbASbjOatVggyTadr26K2J1butMz3eHKxL8lA
+8Sfop2JAZO2L7f5Ib6vj1LOEkk9XvzoSMCiUQsJsjCOvQTq3O5X/jZkDGspKhQj4
+2J+6qbU8tuIFo1Aa34/i2Mvh1rj1pkAdc2LdcXHjVC21I2Chx/X4AFn4zE+1o7ZG
+1FmOUmpy2Kb7HcQVqf1EA+Q8YuSG
 -----END PRIVATE KEY-----

rust/pvebc/95sel-ebc/boot-mount.sh

@@ -26,6 +26,6 @@ else
 fi
 
 echo "Mounting ${block_dev} to ${mntp}"
-mount --options ro "${block_dev}" "${mntp}"
+mount -t ext4 --options ro,nodev,nosuid,noexec "${block_dev}" "${mntp}"
 
 exit 0

rust/pvebc/95sel-ebc/pvebc-wrapper.sh

@@ -20,6 +20,12 @@ if [[ $(cat $SYSFS) -ne 1 ]]; then
 fi
 echo "Running in SEL guest."
 
+# Check SICS existence
+if [[ ! -d "${SICS}" ]]; then
+	echo "${SICS} does not exist"
+	exit 1
+fi
+
 # Copy EBC resources from /boot/sics to tmpfs for security
 # This protects against host injection attacks by moving resources to UV-protected RAM
 echo "Copying EBC resources from $SICS to $EBC_TMPFS"

rust/pvebc/95sel-ebc/sel-ebc-boot-mount.service

@@ -9,11 +9,15 @@ DefaultDependencies=no
 # Make absolutely sure this only runs in initramfs
 ConditionPathExists=/etc/initrd-release
 ConditionKernelCommandLine=rd.sel-ebc
+Requires=systemd-udev-settle.service
+After=systemd-udev-settle.service
+After=systemd-udevd.service
 
 [Service]
 Type=oneshot
 ExecStart=/bin/bash /etc/sel-ebc/boot-mount.sh
 RemainAfterExit=yes
+ExecStop=/usr/bin/umount /boot
 # On failure immediately abort boot
 FailureAction=poweroff-immediate
 

rust/pvebc/95sel-ebc/sel-ebc-paes-enforce.service

@@ -4,7 +4,8 @@ Description=Enforce PAES encrypted root fs for SEL guests
 # Ensure this runs before the handoff to the real root, if that's required:
 After=cryptsetup.target
 After=initrd-root-device.target
-Before=sysroot.mount
+After=sysroot.mount
+Before=initrd-switch-root.service
 
 # Initramfs requirement
 DefaultDependencies=no

rust/pvebc/95sel-ebc/sel-ebc-pvebc.service

@@ -17,7 +17,6 @@ After=sel-ebc-boot-mount.service
 DefaultDependencies=no
 # Make absolutely sure this only runs in initramfs
 ConditionPathExists=/etc/initrd-release
-AssertPathIsDirectory=/boot/sics
 ConditionKernelCommandLine=rd.sel-ebc
 
 [Service]

scripts/pvics

@@ -1051,6 +1051,7 @@ convert() {
 	local pvimg_cmd pv_cmd ble_array b
 
 	# initialize
+	kernel_parameter=""
 	image=${IMAGE}
 	ble=${C_BOOT_LOADER_ENTRY}
 	kernel_parameter_file="${TEMP_DIR}/kernel_parameter"
@@ -1097,6 +1098,9 @@ convert() {
 		kernel_parameter+="$(grep -E "^options" "${f}" | cut -d ' ' -f 2-) ${sel_kernel_parameter}"
 		break
 	done
+	if [[ -z "${kernel_parameter}" ]]; then
+		log_error "No boot loader entry with title \"${ble}\" found"
+	fi
 	if [[ "${NO_EBC}" != "true" ]]; then
 		if [[ $(echo "${kernel_parameter}" | grep "root=LABEL=root") == "" \
 			&& $? == "1" \