Release 2.9

Signed-off-by: Michał Trojnara <Michal.Trojnara@stunnel.org>
Changed error output to stderr instead of stdout
2025-07-02 19:22:47 -05:00 · 2024-06-29 20:16:47 +02:00 · 2024-06-05 16:54:21 +02:00 · 2024-06-04 13:25:51 +02:00 · 2024-06-03 14:16:39 +02:00 · 2024-06-03 14:16:39 +02:00
65 changed files with 11756 additions and 2803 deletions
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@ -7,7 +7,7 @@ on:
 env:
  # Customize the CMake build type here (Release, Debug, RelWithDebInfo, etc.)
  BUILD_TYPE: Release
-  version: osslsigncode-2.8
+  version: osslsigncode-2.9

 jobs:
  build:
@ -15,6 +15,12 @@ jobs:
      fail-fast: false
      matrix:
        include:
+          - id: ubuntu-24.04
+            triplet: x64-linux
+            compiler: gcc
+            os: ubuntu-24.04
+            generator: Unix Makefiles
+            vcpkg_root:
          - id: ubuntu-22.04
            triplet: x64-linux
            compiler: gcc
@ -72,11 +78,11 @@ jobs:
      VCPKG_ROOT: ${{matrix.vcpkg_root}}

    steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4

    - name: Cache the vcpkg archives
      if: matrix.cache != ''
-      uses: actions/cache@v3
+      uses: actions/cache@v4
      with:
        path: ${{matrix.cache}}
        key: ${{matrix.id}}-${{hashFiles('vcpkg.json')}}
@ -105,7 +111,8 @@ jobs:
      if: runner.os == 'Linux'
      run: |
        sudo apt-get update
-        sudo apt-get install -y libssl-dev libcurl4-openssl-dev faketime
+        sudo apt-get remove needrestart || echo Ignored
+        sudo apt-get install -y libssl-dev zlib1g-dev python3-cryptography

    - name: Install brew dependencies (macOS)
      if: runner.os == 'macOS'
@ -120,18 +127,30 @@ jobs:

    - name: Setup the oldest supported version of cmake (macOS)
      if: runner.os == 'macOS'
-      uses: jwlawson/actions-setup-cmake@v1.12
+      uses: jwlawson/actions-setup-cmake@v2.0
      with:
        cmake-version: '3.17.0'

-    - name: Show OpenSSL version
-      run: openssl version -a
+    - name: Install python3 cryptography module (macOS)
+      if: runner.os == 'macOS'
+      run: |
+        python3.8 -m ensurepip
+        python3.8 -m pip install --upgrade pip
+        python3.8 -m pip install cryptography
+
+    - name: Install python3 cryptography module (Windows)
+      if: runner.os == 'Windows'
+      run: |
+        C:/hostedtoolcache/windows/Python/3.12.3/x64/python3.exe -m ensurepip
+        C:/hostedtoolcache/windows/Python/3.12.3/x64/python.exe -m pip install --upgrade pip
+        C:/hostedtoolcache/windows/Python/3.12.3/x64/python.exe -m pip install cryptography

    - name: Configure CMake
      run: cmake
        -G "${{matrix.generator}}"
        -S ${{github.workspace}}
        -B ${{github.workspace}}/build
+        -DCMAKE_OSX_ARCHITECTURES=arm64
        -DCMAKE_BUILD_TYPE=${{env.BUILD_TYPE}}
        -DCMAKE_INSTALL_PREFIX=${{github.workspace}}/dist
        -DVCPKG_TARGET_TRIPLET=${{matrix.triplet}}
@ -141,24 +160,13 @@ jobs:
        --build ${{github.workspace}}/build
        --config ${{env.BUILD_TYPE}}

-    - name: Start HTTP server (macOS)
+    - name: Show python version (macOS)
      working-directory: ${{github.workspace}}/build
      if: runner.os == 'macOS'
      run: |
        python3.8 --version
-        python3.8 ./Testing/server_http.py --port 19254
-        while test ! -s ./Testing/logs/port.log; do sleep 1; done
-
-    - name: Start HTTP server (Windows)
-      working-directory: ${{github.workspace}}\build
-      if: runner.os == 'Windows'
-      run: |
-        python.exe --version
-        $Args = '.\Testing\server_http.pyw --port 19254'
-        $File = '.\Testing\logs\port.log'
-        Start-Process -FilePath pythonw.exe -ArgumentList $Args
-        while(-not(Test-Path -Path $File -PathType Leaf) -or [String]::IsNullOrWhiteSpace((Get-Content $File))) {Start-Sleep -Seconds 1}
-        Get-Content '.\Testing\logs\server.log'
+        python3.8 -c "import sys; print(sys.executable)"
+        python3.8 -c "import cryptography; print(f'Python3 cryptography version {cryptography.__version__}')"

    - name: List files (Linux/macOS)
      if: runner.os != 'Windows'
@ -173,7 +181,7 @@ jobs:
      run: ctest -C ${{env.BUILD_TYPE}}

    - name: Upload the errors
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
      if: failure()
      with:
        name: errors-${{matrix.id}}
@ -187,7 +195,7 @@ jobs:
      run: cmake --install ${{github.workspace}}/build

    - name: Upload the executables
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
      with:
        name: ${{env.version}}-${{matrix.id}}
        path: ${{github.workspace}}/dist
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@ -25,11 +25,11 @@ jobs:

    steps:
    - name: Checkout repository
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4

    # Initializes the CodeQL tools for scanning.
    - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2
+      uses: github/codeql-action/init@v3
      with:
        languages: ${{ matrix.language }}

@ -43,7 +43,7 @@ jobs:
    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
    # If this step fails, then you should remove it and run the build manually (see below)
    - name: Autobuild
-      uses: github/codeql-action/autobuild@v2
+      uses: github/codeql-action/autobuild@v3

    # ℹ️ Command-line programs to run using the OS shell.
    # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@ -56,4 +56,4 @@ jobs:
    #   ./location_of_script_within_repo/buildscript.sh

    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2
+      uses: github/codeql-action/analyze@v3
--- a/.github/workflows/coverity.yml
+++ b/.github/workflows/coverity.yml
@ -10,7 +10,7 @@ jobs:
    env:
      token: ${{secrets.COVERITY_SCAN_TOKEN}}
    steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
      if: env.token
    - name: Get ready for scanning
      if: env.token
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@ -3,14 +3,14 @@ cmake_minimum_required(VERSION 3.17)

 # autodetect vcpkg CMAKE_TOOLCHAIN_FILE if VCPKG_ROOT is defined
 # this needs to be configured before the project() directive
-if(DEFINED ENV{VCPKG_ROOT} AND NOT $ENV{VCPKG_ROOT} STREQUAL "" AND NOT DEFINED CMAKE_TOOLCHAIN_FILE)
+if((CMAKE_GENERATOR MATCHES "Ninja") AND DEFINED ENV{VCPKG_ROOT} AND NOT $ENV{VCPKG_ROOT} STREQUAL "" AND NOT DEFINED CMAKE_TOOLCHAIN_FILE)
    set(CMAKE_TOOLCHAIN_FILE "$ENV{VCPKG_ROOT}/scripts/buildsystems/vcpkg.cmake" CACHE STRING "")
-endif(DEFINED ENV{VCPKG_ROOT} AND NOT $ENV{VCPKG_ROOT} STREQUAL "" AND NOT DEFINED CMAKE_TOOLCHAIN_FILE)
+endif((CMAKE_GENERATOR MATCHES "Ninja") AND DEFINED ENV{VCPKG_ROOT} AND NOT $ENV{VCPKG_ROOT} STREQUAL "" AND NOT DEFINED CMAKE_TOOLCHAIN_FILE)
 set(BUILTIN_SOCKET ON CACHE BOOL "") # for static Python

 # configure basic project information
 project(osslsigncode
-    VERSION 2.8
+    VERSION 2.9
    DESCRIPTION "OpenSSL based Authenticode signing for PE, CAB, CAT and MSI files"
    HOMEPAGE_URL "https://github.com/mtrojnar/osslsigncode"
    LANGUAGES C)
@ -29,7 +29,9 @@ set(CMAKE_C_STANDARD_REQUIRED ON)

 # load CMake library modules
 include(FindOpenSSL)
-include(FindCURL)
+if(OPENSSL_VERSION VERSION_LESS "3.0.0")
+    include(FindCURL)
+endif(OPENSSL_VERSION VERSION_LESS "3.0.0")
 include(FindZLIB)

 # load CMake project modules
@ -64,6 +66,7 @@ target_include_directories(osslsigncode PRIVATE ${OPENSSL_INCLUDE_DIR})
 target_link_libraries(osslsigncode PRIVATE ${OPENSSL_LIBRARIES})

 # set cURL includes/libraries
+if(OPENSSL_VERSION VERSION_LESS "3.0.0")
 if(CURL_FOUND)
    target_compile_definitions(osslsigncode PRIVATE ENABLE_CURL=1)
    target_include_directories(osslsigncode PRIVATE ${CURL_INCLUDE_DIRS})
@ -72,6 +75,7 @@ if(CURL_FOUND)
 else(CURL_FOUND)
    message(STATUS "cURL support disabled (library not found)")
 endif(CURL_FOUND)
+endif(OPENSSL_VERSION VERSION_LESS "3.0.0")

 if(NOT ZLIB_FOUND)
    message(FATAL_ERROR "Zlib library not found")
@ -79,6 +83,11 @@ endif(NOT ZLIB_FOUND)
 target_include_directories(osslsigncode PRIVATE ${ZLIB_INCLUDE_DIR})
 target_link_libraries(osslsigncode PRIVATE ${ZLIB_LIBRARIES})

+if(NOT UNIX)
+# https://learn.microsoft.com/en-us/windows/win32/api/winsock2/nf-winsock2-shutdown
+target_link_libraries(osslsigncode PRIVATE Ws2_32.lib crypt32.lib)
+endif(NOT UNIX)
+
 # add paths to linker search and installed rpath
 set_target_properties(osslsigncode PROPERTIES INSTALL_RPATH_USE_LINK_PATH TRUE)

--- a/4
+++ b/4
@ -2,7 +2,7 @@
 FROM alpine:latest AS builder

 # Install build dependencies
-RUN apk add --no-cache build-base cmake openssl-dev curl-dev
+RUN apk add --no-cache build-base cmake openssl-dev zlib-dev

 # Copy osslsigncode source code into the image
 COPY . /source
@ -23,7 +23,7 @@ FROM alpine:latest
 COPY --from=builder /usr/local/bin/osslsigncode /usr/local/bin/osslsigncode

 # Install necessary runtime libraries (latest version)
-RUN apk add --no-cache libcrypto3 libcurl
+RUN apk add --no-cache libcrypto3

 # Set working directory
 WORKDIR /workdir
--- a/INSTALL.W32.md
+++ b/INSTALL.W32.md
@ -3,50 +3,40 @@
 ### Building osslsigncode source with MSYS2 MinGW 64-bit and MSYS2 packages:

 1) Download and install MSYS2 from https://msys2.github.io/ and follow installation instructions.
-   Once up and running install even mingw-w64-x86_64-gcc, mingw-w64-x86_64-curl.
+   Once up and running install the following packages:
 ```
-  pacman -S mingw-w64-x86_64-gcc mingw-w64-x86_64-curl
+  pacman -S make mingw-w64-x86_64-gcc mingw-w64-x86_64-cmake mingw-w64-x86_64-openssl mingw-w64-x86_64-python-cryptography
 ```
-   mingw-w64-x86_64-openssl and mingw-w64-x86_64-zlib packages are installed with dependencies.
+   mingw-w64-x86_64-zlib package is installed with dependencies.

 2) Run "MSYS2 MinGW 64-bit" and build 64-bit Windows executables.
 ```
  cd osslsigncode-folder
-  x86_64-w64-mingw32-gcc *.c -o osslsigncode.exe \
-    -lcrypto -lssl -lcurl \
-    -D 'PACKAGE_STRING="osslsigncode x.y"' \
-    -D 'PACKAGE_BUGREPORT="Your.Email@example.com"' \
-    -D ENABLE_CURL
+  mkdir build && cd build && cmake -S .. -DCMAKE_BUILD_TYPE=Release -G "MSYS Makefiles"
+  cmake --build . --verbose
 ```

-3) Run "Command prompt" and include "c:\msys64\mingw64\bin" folder as part of the path.
+3) Make tests.
+```
+  ctest
+```
+
+4) Run "Command prompt" and include "c:\msys64\mingw64\bin" folder as part of the path.
 ```
  path=%path%;c:\msys64\mingw64\bin
-  cd osslsigncode-folder
  osslsigncode.exe -v
-  osslsigncode 2.4, using:
-        OpenSSL 1.1.1g  21 Apr 2020 (Library: OpenSSL 1.1.1g  21 Apr 2020)
-        libcurl/7.70.0 OpenSSL/1.1.1g (Schannel) zlib/1.2.11 brotli/1.0.7 libidn2/2.3.0
-        libpsl/0.21.0 (+libidn2/2.3.0) libssh2/1.9.0 nghttp2/1.40.0
+  osslsigncode 2.8, using:
+        OpenSSL 3.2.0 23 Nov 2023 (Library: OpenSSL 3.2.0 23 Nov 2023)
+  No default -CAfile location detected
 ```

-
-### Building OpenSSL, Curl and osslsigncode sources with MSYS2 MinGW 64-bit:
+### Building OpenSSL and osslsigncode sources with MSYS2 MinGW 64-bit:

 1) Download and install MSYS2 from https://msys2.github.io/ and follow installation instructions.
   Once up and running install even: perl make autoconf automake libtool pkg-config.
 ```
  pacman -S perl make autoconf automake libtool pkg-config
 ```
-   Make sure there are no curl, brotli, libpsl, libidn2 and nghttp2 packages installed:
-```
-  pacman -R mingw-w64-x86_64-curl \
-    mingw-w64-x86_64-brotli \
-    mingw-w64-x86_64-libpsl \
-    mingw-w64-x86_64-libidn2 \
-    mingw-w64-x86_64-nghttp2
-```
-
   Run "MSYS2 MinGW 64-bit" in the administrator mode.

 2) Build and install OpenSSL.
@ -55,46 +45,30 @@
  ./config --prefix='C:/OpenSSL' --openssldir='C:/OpenSSL'
  make && make install
 ```
- 3) Build and install curl.
-```
-  cd curl-(version)
-  ./buildconf
-  ./configure --prefix='C:/curl' --with-ssl='C:/OpenSSL' \
-    --disable-ftp --disable-tftp --disable-file --disable-dict \
-    --disable-telnet --disable-imap --disable-smb --disable-smtp \
-    --disable-gopher --disable-pop --disable-pop3 --disable-rtsp \
-    --disable-ldap --disable-ldaps --disable-unix-sockets \
-    --disable-pthreads --without-zstd --without-zlib
-  make && make install
-```

-3) Build 64-bit Windows executables.
+3) Configure a CMake project.
 ```
-  cd osslsigncode-folder
-  x86_64-w64-mingw32-gcc *.c -o osslsigncode.exe \
-    -L 'C:/OpenSSL/lib/' -lcrypto -lssl \
-    -I 'C:/OpenSSL/include/' \
-    -L 'C:/curl/lib' -lcurl \
-    -I 'C:/curl/include' \
-    -D 'PACKAGE_STRING="osslsigncode x.y"' \
-    -D 'PACKAGE_BUGREPORT="Your.Email@example.com"' \
-    -D ENABLE_CURL
+  mkdir build && cd build && cmake -S .. -DCMAKE_BUILD_TYPE=Release -G "MSYS Makefiles" -DCMAKE_PREFIX_PATH="C:\OpenSSL"
 ```

 4) Run "Command prompt" and copy required libraries.
 ```
  cd osslsigncode-folder
-  copy C:\OpenSSL\bin\libssl-1_1-x64.dll
-  copy C:\OpenSSL\bin\libcrypto-1_1-x64.dll
-  copy C:\curl\bin\libcurl-4.dll
-
-  osslsigncode.exe -v
-  osslsigncode 2.4, using:
-        OpenSSL 1.1.1k  25 Mar 2021 (Library: OpenSSL 1.1.1k  25 Mar 2021)
-        libcurl/7.78.0 OpenSSL/1.1.1k
+  copy C:\OpenSSL\bin\libssl-3-x64.dll
+  copy C:\OpenSSL\bin\libcrypto-3-x64.dll
 ```

-### Building OpenSSL, Curl and osslsigncode sources with Microsoft Visual Studio:
+5) Build 64-bit Windows executables.
+```
+  cmake --build . --verbose
+```
+
+6) Make tests.
+```
+  ctest
+```
+
+### Building OpenSSL and osslsigncode sources with Microsoft Visual Studio:

 1) Install and integrate vcpkg: https://vcpkg.io/en/getting-started.html

--- a/NEWS.md
+++ b/NEWS.md
@ -1,5 +1,22 @@
 # osslsigncode change log

+### 2.9 (2024.06.29)
+
+- added a 64 bit long pseudo-random NONCE in the TSA request
+- missing NID_pkcs9_signingTime is no longer an error
+- added support for PEM-encoded CRLs
+- fixed the APPX central directory sorting order
+- added a special "-" file name to read the passphrase from stdin
+  (by Steve McIntyre)
+- used native HTTP client with OpenSSL 3.x, removing libcurl dependency
+- added '-login' option to force a login to PKCS11 engines
+  (by Brad Hughes)
+- added the "-ignore-crl" option to disable fetching and verifying
+  CRL Distribution Points
+- changed error output to stderr instead of stdout
+- various testing framework improvements
+- various memory corruption fixes
+
 ### 2.8 (2024.03.03)

 - Microsoft PowerShell signing sponsored by Cisco Systems, Inc.
--- a/appx.c
+++ b/appx.c
@ -153,6 +153,8 @@ typedef struct zipCentralDirectoryEntry_struct {
    struct zipCentralDirectoryEntry_struct *next;
 } ZIP_CENTRAL_DIRECTORY_ENTRY;

+DEFINE_STACK_OF(ZIP_CENTRAL_DIRECTORY_ENTRY)
+
 /* Zip64 end of central directory record */
 typedef struct {
    uint64_t eocdrSize;
@ -301,6 +303,7 @@ static int zipInflate(uint8_t *dest, uint64_t *destLen, uint8_t *source, uLong *
 static int zipDeflate(uint8_t *dest, uint64_t *destLen, uint8_t *source, uLong sourceLen);
 static ZIP_FILE *openZip(const char *filename);
 static void freeZip(ZIP_FILE *zip);
+static ZIP_FILE *zipSortCentralDirectory(ZIP_FILE *zip);
 static void zipPrintCentralDirectory(ZIP_FILE *zip);
 static int zipReadCentralDirectory(ZIP_FILE *zip, FILE *file);
 static ZIP_CENTRAL_DIRECTORY_ENTRY *zipReadNextCentralDirectoryEntry(FILE *file);
@ -439,7 +442,7 @@ static PKCS7 *appx_pkcs7_contents_get(FILE_FORMAT_CTX *ctx, BIO *hash, const EVP
    /* Create and append a new signature content types entry */
    entry = zipGetCDEntryByName(ctx->appx_ctx->zip, CONTENT_TYPES_FILENAME);
    if (!entry) {
-        printf("Not a valid .appx file: content types file missing\n");
+        fprintf(stderr, "Not a valid .appx file: content types file missing\n");
        return NULL; /* FAILED */
    }
    if (!appx_append_ct_signature_entry(ctx->appx_ctx->zip, entry)) {
@ -480,7 +483,7 @@ static int appx_verify_digests(FILE_FORMAT_CTX *ctx, PKCS7 *p7)
        if (idc) {
            BIO *hashes;
            if (!appx_extract_hashes(ctx, idc)) {
-                printf("Failed to extract hashes from the signature\n");
+                fprintf(stderr, "Failed to extract hashes from the signature\n");
                SpcIndirectDataContent_free(idc);
                return 0; /* FAILED */
            }
@ -491,7 +494,7 @@ static int appx_verify_digests(FILE_FORMAT_CTX *ctx, PKCS7 *p7)
            }
            BIO_free_all(hashes);
            if (!appx_compare_hashes(ctx)) {
-                printf("Signature hash verification failed\n");
+                fprintf(stderr, "Signature hash verification failed\n");
                SpcIndirectDataContent_free(idc);
                return 0; /* FAILED */
            }
@ -515,7 +518,7 @@ static PKCS7 *appx_pkcs7_extract(FILE_FORMAT_CTX *ctx)

    /* Check if the signature exists */
    if (!zipEntryExist(ctx->appx_ctx->zip, APP_SIGNATURE_FILENAME)) {
-        printf("%s does not exist\n", APP_SIGNATURE_FILENAME);
+        fprintf(stderr, "%s does not exist\n", APP_SIGNATURE_FILENAME);
        return NULL; /* FAILED */
    }
    dataSize = zipReadFileDataByName(&data, ctx->appx_ctx->zip, APP_SIGNATURE_FILENAME);
@ -524,7 +527,7 @@ static PKCS7 *appx_pkcs7_extract(FILE_FORMAT_CTX *ctx)
    }
    /* P7X format is just 0x504B4358 (PKCX) followed by PKCS#7 data in the DER format */
    if (memcmp(data, PKCX_SIGNATURE, 4)) {
-        printf("Invalid PKCX header\n");
+        fprintf(stderr, "Invalid PKCX header\n");
        OPENSSL_free(data);
        return NULL; /* FAILED */
    }
@ -553,7 +556,7 @@ static int appx_remove_pkcs7(FILE_FORMAT_CTX *ctx, BIO *hash, BIO *outdata)
    (void)hash;

    if (!entry) {
-        printf("Not a valid .appx file: content types file missing\n");
+        fprintf(stderr, "Not a valid .appx file: content types file missing\n");
        return 1; /* FAILED */
    }
    /* read signature data */
@ -563,17 +566,17 @@ static int appx_remove_pkcs7(FILE_FORMAT_CTX *ctx, BIO *hash, BIO *outdata)
    }
    OPENSSL_free(data);
    if (!appx_remove_ct_signature_entry(zip, entry)) {
-        printf("Failed to remove signature entry\n");
+        fprintf(stderr, "Failed to remove signature entry\n");
        return 1; /* FAILED */
    }
    for (entry = zip->centralDirectoryHead; entry != NULL; entry = entry->next) {
        if (noEntries == zip->centralDirectoryRecordCount) {
-            printf("Warning: Corrupted central directory structure\n");
+            fprintf(stderr, "Corrupted central directory structure\n");
            return 1; /* FAILED */
        }
        noEntries++;
        if (!entry->fileName || (entry->fileNameLen == 0)) {
-            printf("Warning: Corrupted file name\n");
+            fprintf(stderr, "Corrupted file name\n");
            return 1; /* FAILED */
        }
        if (strcmp(entry->fileName, APP_SIGNATURE_FILENAME)) {
@ -584,11 +587,11 @@ static int appx_remove_pkcs7(FILE_FORMAT_CTX *ctx, BIO *hash, BIO *outdata)
        }
    }
    if (!get_current_position(outdata, &cdOffset)) {
-        printf("Unable to get offset\n");
+        fprintf(stderr, "Unable to get offset\n");
        return 1; /* FAILED */
    }
    if (!appx_write_central_directory(outdata, zip, 1, cdOffset)) {
-        printf("Unable to write central directory\n");
+        fprintf(stderr, "Unable to write central directory\n");
        return 1; /* FAILED */
    }
    return 0; /* OK */
@ -612,13 +615,13 @@ static int appx_process_data(FILE_FORMAT_CTX *ctx, BIO *hash, BIO *outdata)
    /* Create and append a new signature content types entry */
    entry = zipGetCDEntryByName(ctx->appx_ctx->zip, CONTENT_TYPES_FILENAME);
    if (!entry) {
-        printf("Not a valid .appx file: content types file missing\n");
-        return 1; /* FAILED */
+        fprintf(stderr, "Not a valid .appx file: content types file missing\n");
+        return 0; /* FAILED */
    }
    if (!appx_append_ct_signature_entry(ctx->appx_ctx->zip, entry)) {
-        return 1; /* FAILED */
+        return 0; /* FAILED */
    }
-    return 0; /* OK */
+    return 1; /* OK */
 }

 /*
@ -643,12 +646,12 @@ static PKCS7 *appx_pkcs7_signature_new(FILE_FORMAT_CTX *ctx, BIO *hash)
    }
    p7 = pkcs7_create(ctx);
    if (!p7) {
-        printf("Creating a new signature failed\n");
+        fprintf(stderr, "Creating a new signature failed\n");
        BIO_free_all(hashes);
        return NULL; /* FAILED */
    }
    if (!add_indirect_data_object(p7)) {
-        printf("Adding SPC_INDIRECT_DATA_OBJID failed\n");
+        fprintf(stderr, "Adding SPC_INDIRECT_DATA_OBJID failed\n");
        PKCS7_free(p7);
        BIO_free_all(hashes);
        return NULL; /* FAILED */
@ -656,12 +659,12 @@ static PKCS7 *appx_pkcs7_signature_new(FILE_FORMAT_CTX *ctx, BIO *hash)
    content = spc_indirect_data_content_get(hashes, ctx);
    BIO_free_all(hashes);
    if (!content) {
-        printf("Failed to get spcIndirectDataContent\n");
+        fprintf(stderr, "Failed to get spcIndirectDataContent\n");
        PKCS7_free(p7);
        return NULL; /* FAILED */
    }
    if (!sign_spc_indirect_data_content(p7, content)) {
-        printf("Failed to set signed content\n");
+        fprintf(stderr, "Failed to set signed content\n");
        PKCS7_free(p7);
        ASN1_OCTET_STRING_free(content);
        return NULL; /* FAILED */
@ -689,13 +692,13 @@ static int appx_append_pkcs7(FILE_FORMAT_CTX *ctx, BIO *outdata, PKCS7 *p7)

    for (entry = zip->centralDirectoryHead; entry != NULL;) {
        if (noEntries >= zip->centralDirectoryRecordCount) {
-            printf("Warning: Corrupted central directory structure\n");
+            fprintf(stderr, "Corrupted central directory structure\n");
            return 1; /* FAILED */
        }
        noEntries++;
        last = entry;
        if (!entry->fileName || (entry->fileNameLen == 0)) {
-            printf("Warning: Corrupted file name\n");
+            fprintf(stderr, "Corrupted file name\n");
            return 1; /* FAILED */
        }
        if (strcmp(entry->fileName, APP_SIGNATURE_FILENAME)) {
@ -735,17 +738,17 @@ static int appx_append_pkcs7(FILE_FORMAT_CTX *ctx, BIO *outdata, PKCS7 *p7)
    len += 4;
    if (!zipAppendSignatureFile(outdata, zip, blob, (uint64_t)len)) {
        OPENSSL_free(blob);
-        printf("Failed to append zip file\n");
+        fprintf(stderr, "Failed to append zip file\n");
        return 1; /* FAILED */
    }
    OPENSSL_free(der);
    OPENSSL_free(blob);
    if (!get_current_position(outdata, &cdOffset)) {
-        printf("Unable to get offset\n");
+        fprintf(stderr, "Unable to get offset\n");
        return 1; /* FAILED */
    }
    if (!appx_write_central_directory(outdata, zip, 0, cdOffset)) {
-        printf("Unable to write central directory\n");
+        fprintf(stderr, "Unable to write central directory\n");
        return 1; /* FAILED */
    }
    return 0; /* OK */
@ -808,11 +811,11 @@ static BIO *appx_calculate_hashes(FILE_FORMAT_CTX *ctx)

    if (!ctx->appx_ctx->calculatedBMHash || !ctx->appx_ctx->calculatedCTHash
        || !ctx->appx_ctx->calculatedCDHash || !ctx->appx_ctx->calculatedDataHash) {
-        printf("One or more hashes calculation failed\n");
+        fprintf(stderr, "One or more hashes calculation failed\n");
        return NULL; /* FAILED */
    }
    if (zipEntryExist(ctx->appx_ctx->zip, CODE_INTEGRITY_FILENAME) && !ctx->appx_ctx->calculatedCIHash) {
-        printf("Code integrity file exists, but CI hash calculation failed\n");
+        fprintf(stderr, "Code integrity file exists, but CI hash calculation failed\n");
        return NULL; /* FAILED */
    }
    return appx_hash_blob_get(ctx);
@ -876,13 +879,13 @@ static uint8_t *appx_calc_zip_central_directory_hash(ZIP_FILE *zip, const EVP_MD
    BIO *bhash = BIO_new(BIO_f_md());

    if (!BIO_set_md(bhash, md)) {
-        printf("Unable to set the message digest of BIO\n");
+        fprintf(stderr, "Unable to set the message digest of BIO\n");
        BIO_free_all(bhash);
        return NULL; /* FAILED */
    }
    BIO_push(bhash, BIO_new(BIO_s_null()));
    if (!appx_write_central_directory(bhash, zip, 1, cdOffset)) {
-        printf("Unable to write central directory\n");
+        fprintf(stderr, "Unable to write central directory\n");
        BIO_free_all(bhash);
        return NULL; /* FAILED */
    }
@ -910,11 +913,11 @@ static int appx_write_central_directory(BIO *bio, ZIP_FILE *zip, int removeSigna
        /* the signature file is considered non existent for hashing purposes */
        uint64_t sizeOnDisk = 0;
        if (noEntries > zip->centralDirectoryRecordCount) {
-            printf("Warning: Corrupted central directory structure\n");
+            fprintf(stderr, "Corrupted central directory structure\n");
            return 0; /* FAILED */
        }
        if (!entry->fileName || (entry->fileNameLen == 0)) {
-            printf("Warning: Corrupted file name\n");
+            fprintf(stderr, "Corrupted file name\n");
            return 0; /* FAILED */
        }
        if (removeSignature && !strcmp(entry->fileName, APP_SIGNATURE_FILENAME)) {
@ -1003,7 +1006,7 @@ static uint8_t *appx_calc_zip_data_hash(uint64_t *cdOffset, ZIP_FILE *zip, const
    uint64_t noEntries = 0;

    if (!BIO_set_md(bhash, md)) {
-        printf("Unable to set the message digest of BIO\n");
+        fprintf(stderr, "Unable to set the message digest of BIO\n");
        BIO_free_all(bhash);
        return NULL; /* FAILED */
    }
@ -1013,13 +1016,13 @@ static uint8_t *appx_calc_zip_data_hash(uint64_t *cdOffset, ZIP_FILE *zip, const
        /* the signature file is considered not existent for hashing purposes */
        uint64_t sizeOnDisk = 0;
        if (noEntries >= zip->centralDirectoryRecordCount) {
-            printf("Warning: Corrupted central directory structure\n");
+            fprintf(stderr, "Corrupted central directory structure\n");
            BIO_free_all(bhash);
            return NULL; /* FAILED */
        }
        noEntries++;
        if (!entry->fileName || (entry->fileNameLen == 0)) {
-            printf("Warning: Corrupted file name\n");
+            fprintf(stderr, "Corrupted file name\n");
            BIO_free_all(bhash);
            return NULL; /* FAILED */
        }
@ -1027,7 +1030,7 @@ static uint8_t *appx_calc_zip_data_hash(uint64_t *cdOffset, ZIP_FILE *zip, const
            continue;
        }
        if (!zipRewriteData(zip, entry, bhash, &sizeOnDisk)) {
-            printf("Rewrite data error\n");
+            fprintf(stderr, "Rewrite data error\n");
            BIO_free_all(bhash);
            return NULL; /* FAILED */
        }
@ -1057,7 +1060,7 @@ static int appx_extract_hashes(FILE_FORMAT_CTX *ctx, SpcIndirectDataContent *con
    long d = ASN1_INTEGER_get(si->d);
    long e = ASN1_INTEGER_get(si->e);
    long f = ASN1_INTEGER_get(si->f);
-    BIO *stdbio = BIO_new_fp(stdout, BIO_NOCLOSE);
+    BIO *stdbio = BIO_new_fp(stderr, BIO_NOCLOSE);
    printf("a: 0x%lX b: 0x%lX c: 0x%lX d: 0x%lX e: 0x%lX f: 0x%lX\n", a, b, c, d, e, f);
    printf("string: ");
    ASN1_STRING_print_ex(stdbio, si->string, ASN1_STRFLGS_RFC2253);
@ -1072,11 +1075,11 @@ static int appx_extract_hashes(FILE_FORMAT_CTX *ctx, SpcIndirectDataContent *con

    /* we are expecting at least 4 hashes + 4 byte header */
    if (length < 4 * mdlen + 4) {
-        printf("Hash too short\n");
+        fprintf(stderr, "Hash too short\n");
        return 0; /* FAILED */
    }
    if (memcmp(data, APPX_SIGNATURE, 4)) {
-        printf("Hash signature does not match\n");
+        fprintf(stderr, "Hash signature does not match\n");
        return 0; /* FAILED */
    }
    while (pos + mdlen + 4 <= length) {
@ -1096,29 +1099,29 @@ static int appx_extract_hashes(FILE_FORMAT_CTX *ctx, SpcIndirectDataContent *con
            ctx->appx_ctx->existingCIHash = OPENSSL_malloc((size_t)mdlen);
            memcpy(ctx->appx_ctx->existingCIHash, data + pos + 4, (size_t)mdlen);
        } else {
-            printf("Invalid hash signature\n");
+            fprintf(stderr, "Invalid hash signature\n");
            return 0; /* FAILED */
        }
        pos += mdlen + 4;
    }
    if (!ctx->appx_ctx->existingDataHash) {
-        printf("File hash missing\n");
+        fprintf(stderr, "File hash missing\n");
        return 0; /* FAILED */
    }
    if (!ctx->appx_ctx->existingCDHash) {
-        printf("Central directory hash missing\n");
+        fprintf(stderr, "Central directory hash missing\n");
        return 0; /* FAILED */
    }
    if (!ctx->appx_ctx->existingBMHash) {
-        printf("Block map hash missing\n");
+        fprintf(stderr, "Block map hash missing\n");
        return 0; /* FAILED */
    }
    if (!ctx->appx_ctx->existingCTHash) {
-        printf("Content types hash missing\n");
+        fprintf(stderr, "Content types hash missing\n");
        return 0; /* FAILED */
    }
    if (zipEntryExist(ctx->appx_ctx->zip, CODE_INTEGRITY_FILENAME) && !ctx->appx_ctx->existingCIHash) {
-        printf("Code integrity hash missing\n");
+        fprintf(stderr, "Code integrity hash missing\n");
        return 0; /* FAILED */
    }
    return 1; /* OK */
@ -1139,7 +1142,7 @@ static int appx_compare_hashes(FILE_FORMAT_CTX *ctx)
            return 0; /* FAILED */
        }
    } else {
-        printf("Block map hash missing\n");
+        fprintf(stderr, "Block map hash missing\n");
        return 0; /* FAILED */
    }
    if (ctx->appx_ctx->calculatedCTHash && ctx->appx_ctx->existingCTHash) {
@ -1148,7 +1151,7 @@ static int appx_compare_hashes(FILE_FORMAT_CTX *ctx)
            return 0; /* FAILED */
        }
    } else {
-        printf("Content Types hash missing\n");
+        fprintf(stderr, "Content Types hash missing\n");
        return 0; /* FAILED */
    }
    if (ctx->appx_ctx->calculatedDataHash && ctx->appx_ctx->existingDataHash) {
@ -1157,7 +1160,7 @@ static int appx_compare_hashes(FILE_FORMAT_CTX *ctx)
            return 0; /* FAILED */
        }
    } else {
-        printf("Central Directory hash missing\n");
+        fprintf(stderr, "Central Directory hash missing\n");
        return 0; /* FAILED */
    }
    if (ctx->appx_ctx->calculatedCDHash && ctx->appx_ctx->existingCDHash) {
@ -1166,7 +1169,7 @@ static int appx_compare_hashes(FILE_FORMAT_CTX *ctx)
            return 0; /* FAILED */
        }
    } else {
-        printf("Central Directory hash missing\n");
+        fprintf(stderr, "Central Directory hash missing\n");
        return 0; /* FAILED */
    }
    if (ctx->appx_ctx->calculatedCIHash && ctx->appx_ctx->existingCIHash) {
@ -1177,7 +1180,7 @@ static int appx_compare_hashes(FILE_FORMAT_CTX *ctx)
    } else if (!ctx->appx_ctx->calculatedCIHash && !ctx->appx_ctx->existingCIHash) {
        /* this is fine, CI file is optional -> if it is missing we expect both hashes to be non existent */
    } else {
-        printf("Code Integrity hash missing\n");
+        fprintf(stderr, "Code Integrity hash missing\n");
        return 0; /* FAILED */
    }
    return 1; /* OK */
@ -1202,7 +1205,7 @@ static int appx_remove_ct_signature_entry(ZIP_FILE *zip, ZIP_CENTRAL_DIRECTORY_E
    }
    cpos = strstr((const char *)data, SIGNATURE_CONTENT_TYPES_ENTRY);
    if (!cpos) {
-        printf("Did not find existing signature entry in %s\n", entry->fileName);
+        printf("Warning: Did not find existing signature entry in %s\n", entry->fileName);
        OPENSSL_free(data);
        return 1; /* do not treat as en error */
    }
@ -1240,7 +1243,7 @@ static int appx_append_ct_signature_entry(ZIP_FILE *zip, ZIP_CENTRAL_DIRECTORY_E
    }
    cpos = strstr((const char *)data, SIGNATURE_CONTENT_TYPES_CLOSING_TAG);
    if (!cpos) {
-        printf("%s parsing error\n", entry->fileName);
+        fprintf(stderr, "%s parsing error\n", entry->fileName);
        OPENSSL_free(data);
        return 0; /* FAILED */
    }
@ -1272,24 +1275,24 @@ static const EVP_MD *appx_get_md(ZIP_FILE *zip)

    dataSize = zipReadFileDataByName(&data, zip, BLOCK_MAP_FILENAME);
    if (dataSize <= 0) {
-        printf("Could not read: %s\n", BLOCK_MAP_FILENAME);
+        fprintf(stderr, "Could not read: %s\n", BLOCK_MAP_FILENAME);
        return NULL; /* FAILED */
    }
    start = strstr((const char *)data, HASH_METHOD_TAG);
    if (!start) {
-        printf("Parse error: tag: %s not found in %s\n", HASH_METHOD_TAG, BLOCK_MAP_FILENAME);
+        fprintf(stderr, "Parse error: tag: %s not found in %s\n", HASH_METHOD_TAG, BLOCK_MAP_FILENAME);
        OPENSSL_free(data);
        return NULL; /* FAILED */
    }
    start += strlen(HASH_METHOD_TAG);
    if ((uint8_t *)start >= data + dataSize) {
-        printf("Parse error: data too short in %s\n", BLOCK_MAP_FILENAME);
+        fprintf(stderr, "Parse error: data too short in %s\n", BLOCK_MAP_FILENAME);
        OPENSSL_free(data);
        return NULL; /* FAILED */
    }
    end = strstr((const char *)start, ">");
    if (!end) {
-        printf("Parse error: end of tag not found in %s\n", BLOCK_MAP_FILENAME);
+        fprintf(stderr, "Parse error: end of tag not found in %s\n", BLOCK_MAP_FILENAME);
        OPENSSL_free(data);
        return NULL; /* FAILED */
    }
@ -1303,7 +1306,7 @@ static const EVP_MD *appx_get_md(ZIP_FILE *zip)
        }
    }
    if (!valueStart || !valueEnd || valueEnd <= valueStart) {
-        printf("Parse error: value parse error in %s\n", BLOCK_MAP_FILENAME);
+        fprintf(stderr, "Parse error: value parse error in %s\n", BLOCK_MAP_FILENAME);
        OPENSSL_free(data);
        return NULL; /* FAILED */
    }
@ -1318,7 +1321,7 @@ static const EVP_MD *appx_get_md(ZIP_FILE *zip)
        printf("Hash method is SHA512\n");
        md = EVP_sha512();
    } else {
-        printf("Unsupported hash method\n");
+        fprintf(stderr, "Unsupported hash method\n");
        OPENSSL_free(data);
        return NULL; /* FAILED */
    }
@ -1339,12 +1342,12 @@ static ZIP_CENTRAL_DIRECTORY_ENTRY *zipGetCDEntryByName(ZIP_FILE *zip, const cha

    for (entry = zip->centralDirectoryHead; entry != NULL; entry = entry->next) {
        if (noEntries >= zip->centralDirectoryRecordCount) {
-            printf("Warning: Corrupted central directory structure\n");
+            fprintf(stderr, "Corrupted central directory structure\n");
            return NULL; /* FAILED */
        }
        noEntries++;
        if (!entry->fileName || (entry->fileNameLen == 0)) {
-            printf("Warning: Corrupted file name\n");
+            fprintf(stderr, "Corrupted file name\n");
            return NULL; /* FAILED */
        }
        if (!strcmp(entry->fileName, name)) {
@ -1451,7 +1454,7 @@ static int zipAppendSignatureFile(BIO *bio, ZIP_FILE *zip, uint8_t *data, uint64
    dataToWrite = OPENSSL_malloc(dataSize);
    ret = zipDeflate(dataToWrite, &size, data, dataSize);
    if (ret != Z_OK) {
-        printf("Zip deflate failed: %d\n", ret);
+        fprintf(stderr, "Zip deflate failed: %d\n", ret);
        OPENSSL_free(dataToWrite);
        return 0; /* FAILED */
    }
@ -1489,7 +1492,7 @@ static int zipAppendSignatureFile(BIO *bio, ZIP_FILE *zip, uint8_t *data, uint64
    header.extraFieldLen = 0;

    if (!get_current_position(bio, &offset)) {
-        printf("Unable to get offset\n");
+        fprintf(stderr, "Unable to get offset\n");
        OPENSSL_free(dataToWrite);
        return 0; /* FAILED */
    }
@ -1574,7 +1577,7 @@ static int zipOverrideFileData(ZIP_CENTRAL_DIRECTORY_ENTRY *entry, uint8_t *data
    size = dataSize;
    ret = zipDeflate(entry->overrideData->data, &size, data, dataSize);
    if (ret != Z_OK) {
-        printf("Zip deflate failed: %d\n", ret);
+        fprintf(stderr, "Zip deflate failed: %d\n", ret);
        return 0; /* FAILED */
    }
    entry->overrideData->compressedSize = size;
@ -1596,7 +1599,7 @@ static int zipRewriteData(ZIP_FILE *zip, ZIP_CENTRAL_DIRECTORY_ENTRY *entry, BIO

    memset(&header, 0, sizeof(header));
    if (entry->offsetOfLocalHeader >= (uint64_t)zip->fileSize) {
-        printf("Corrupted relative offset of local header : 0x%08" PRIX64 "\n", entry->offsetOfLocalHeader);
+        fprintf(stderr, "Corrupted relative offset of local header : 0x%08" PRIX64 "\n", entry->offsetOfLocalHeader);
        return 0; /* FAILED */
    }
    if (fseeko(zip->file, (int64_t)entry->offsetOfLocalHeader, SEEK_SET) < 0) {
@ -1617,7 +1620,7 @@ static int zipRewriteData(ZIP_FILE *zip, ZIP_CENTRAL_DIRECTORY_ENTRY *entry, BIO
            return 0; /* FAILED */
        }
        if (entry->compressedSize > (uint64_t)zip->fileSize - entry->offsetOfLocalHeader) {
-            printf("Corrupted compressedSize : 0x%08" PRIX64 "\n", entry->compressedSize);
+            fprintf(stderr, "Corrupted compressedSize : 0x%08" PRIX64 "\n", entry->compressedSize);
            return 0; /* FAILED */
        }
        if (fseeko(zip->file, (int64_t)entry->compressedSize, SEEK_CUR) < 0) {
@ -1721,12 +1724,12 @@ static int zipEntryExist(ZIP_FILE *zip, const char *name)

    for (entry = zip->centralDirectoryHead; entry != NULL; entry = entry->next) {
        if (noEntries >= zip->centralDirectoryRecordCount) {
-            printf("Warning: Corrupted central directory structure\n");
+            fprintf(stderr, "Corrupted central directory structure\n");
            return 0; /* FAILED */
        }
        noEntries++;
        if (!entry->fileName || (entry->fileNameLen == 0)) {
-            printf("Warning: Corrupted file name\n");
+            fprintf(stderr, "Corrupted file name\n");
            return 0; /* FAILED */
        }
        if (!strcmp(entry->fileName, name)) {
@ -1756,7 +1759,7 @@ static u_char *zipCalcDigest(ZIP_FILE *zip, const char *fileName, const EVP_MD *
    }
    bhash = BIO_new(BIO_f_md());
    if (!BIO_set_md(bhash, md)) {
-        printf("Unable to set the message digest of BIO\n");
+        fprintf(stderr, "Unable to set the message digest of BIO\n");
        OPENSSL_free(data);
        BIO_free_all(bhash);
        return NULL; /* FAILED */
@ -1789,12 +1792,12 @@ static size_t zipReadFileDataByName(uint8_t **pData, ZIP_FILE *zip, const char *

    for (entry = zip->centralDirectoryHead; entry != NULL; entry = entry->next) {
        if (noEntries >= zip->centralDirectoryRecordCount) {
-            printf("Warning: Corrupted central directory structure\n");
+            fprintf(stderr, "Corrupted central directory structure\n");
            return 0; /* FAILED */
        }
        noEntries++;
        if (!entry->fileName || (entry->fileNameLen == 0)) {
-            printf("Warning: Corrupted file name\n");
+            fprintf(stderr, "Corrupted file name\n");
            return 0; /* FAILED */
        }
        if (!strcmp(entry->fileName, name)) {
@ -1820,7 +1823,7 @@ static size_t zipReadFileData(ZIP_FILE *zip, uint8_t **pData, ZIP_CENTRAL_DIRECT
    size_t size, dataSize = 0;

    if (entry->offsetOfLocalHeader >= (uint64_t)zip->fileSize) {
-        printf("Corrupted relative offset of local header : 0x%08" PRIX64 "\n", entry->offsetOfLocalHeader);
+        fprintf(stderr, "Corrupted relative offset of local header : 0x%08" PRIX64 "\n", entry->offsetOfLocalHeader);
        return 0; /* FAILED */
    }
    if (fseeko(file, (int64_t)entry->offsetOfLocalHeader, SEEK_SET) < 0) {
@ -1844,7 +1847,7 @@ static size_t zipReadFileData(ZIP_FILE *zip, uint8_t **pData, ZIP_CENTRAL_DIRECT
            || header.compressedSize != compressedSize
            || header.uncompressedSize != uncompressedSize
            || header.compression != entry->compression) {
-            printf("Local header does not match central directory entry\n");
+            fprintf(stderr, "Local header does not match central directory entry\n");
            return 0; /* FAILED */
        }
        /* we don't really need those */
@ -1852,7 +1855,7 @@ static size_t zipReadFileData(ZIP_FILE *zip, uint8_t **pData, ZIP_CENTRAL_DIRECT
        OPENSSL_free(header.extraField);

        if (compressedSize > (uint64_t)zip->fileSize - entry->offsetOfLocalHeader) {
-            printf("Corrupted compressedSize : 0x%08" PRIX64 "\n", entry->compressedSize);
+            fprintf(stderr, "Corrupted compressedSize : 0x%08" PRIX64 "\n", entry->compressedSize);
            return 0; /* FAILED */
        }
        compressedData = OPENSSL_zalloc(compressedSize + 1);
@ -1880,7 +1883,7 @@ static size_t zipReadFileData(ZIP_FILE *zip, uint8_t **pData, ZIP_CENTRAL_DIRECT
        OPENSSL_free(compressedData);

        if (ret != Z_OK) {
-            printf("Data decompresssion failed, zlib error: %d\n", ret);
+            fprintf(stderr, "Data decompresssion failed, zlib error: %d\n", ret);
            OPENSSL_free(uncompressedData);
            return 0; /* FAILED */
        } else {
@ -1892,7 +1895,7 @@ static size_t zipReadFileData(ZIP_FILE *zip, uint8_t **pData, ZIP_CENTRAL_DIRECT
            dataSize = destLen;
        }
    } else {
-        printf("Unsupported compression mode: %d\n", entry->compression);
+        fprintf(stderr, "Unsupported compression mode: %d\n", entry->compression);
        OPENSSL_free(compressedData);
        return 0; /* FAILED */
    }
@ -1917,7 +1920,7 @@ static int zipReadLocalHeader(ZIP_LOCAL_HEADER *header, ZIP_FILE *zip, uint64_t
        return 0; /* FAILED */
    }
    if (memcmp(signature, PKZIP_LH_SIGNATURE, 4)) {
-        printf("The input file is not a valid zip file - local header signature does not match\n");
+        fprintf(stderr, "The input file is not a valid zip file - local header signature does not match\n");
        return 0; /* FAILED */
    }
    /* version needed to extract (2 bytes) */
@ -1969,7 +1972,7 @@ static int zipReadLocalHeader(ZIP_LOCAL_HEADER *header, ZIP_FILE *zip, uint64_t
            return 0; /* FAILED */
        }
        if (compressedSize > (uint64_t)(zip->fileSize - offset)) {
-            printf("Corrupted compressedSize : 0x%08" PRIX64 "\n", compressedSize);
+            fprintf(stderr, "Corrupted compressedSize : 0x%08" PRIX64 "\n", compressedSize);
            return 0; /* FAILED */
        }
        if (fseeko(file, (int64_t)compressedSize, SEEK_CUR) < 0) {
@ -1980,7 +1983,7 @@ static int zipReadLocalHeader(ZIP_LOCAL_HEADER *header, ZIP_FILE *zip, uint64_t
            return 0; /* FAILED */
        }
        if (memcmp(signature, PKZIP_DATA_DESCRIPTOR_SIGNATURE, 4)) {
-            printf("The input file is not a valid zip file - flags indicate data descriptor, but data descriptor signature does not match\n");
+            fprintf(stderr, "The input file is not a valid zip file - flags indicate data descriptor, but data descriptor signature does not match\n");
            OPENSSL_free(header->fileName);
            OPENSSL_free(header->extraField);
            return 0; /* FAILED */
@ -2004,7 +2007,7 @@ static int zipReadLocalHeader(ZIP_LOCAL_HEADER *header, ZIP_FILE *zip, uint64_t
            uint16_t op = bufferGetU16(header->extraField, &pos);

            if (op != ZIP64_HEADER) {
-                printf("Expected zip64 header in local header extra field, got : 0x%X\n", op);
+                fprintf(stderr, "Expected zip64 header in local header extra field, got : 0x%X\n", op);
                OPENSSL_free(header->fileName);
                OPENSSL_free(header->extraField);
                header->fileName = NULL;
@ -2017,7 +2020,7 @@ static int zipReadLocalHeader(ZIP_LOCAL_HEADER *header, ZIP_FILE *zip, uint64_t
                    header->uncompressedSize = bufferGetU64(header->extraField, &pos);
                    header->uncompressedSizeInZip64 = 1;
                } else {
-                    printf("Invalid zip64 local header entry\n");
+                    fprintf(stderr, "Invalid zip64 local header entry\n");
                    OPENSSL_free(header->fileName);
                    OPENSSL_free(header->extraField);
                    header->fileName = NULL;
@ -2030,7 +2033,7 @@ static int zipReadLocalHeader(ZIP_LOCAL_HEADER *header, ZIP_FILE *zip, uint64_t
                    header->compressedSize = bufferGetU64(header->extraField, &pos);
                    header->compressedSizeInZip64 = 1;
                } else {
-                    printf("Invalid zip64 local header entry\n");
+                    fprintf(stderr, "Invalid zip64 local header entry\n");
                    OPENSSL_free(header->fileName);
                    OPENSSL_free(header->extraField);
                    header->fileName = NULL;
@ -2209,7 +2212,7 @@ static ZIP_FILE *openZip(const char *filename)
            return NULL; /* FAILED */
        }
        if (zip->locator.eocdOffset >= (uint64_t)zip->fileSize) {
-            printf("Corrupted end of central directory locator offset : 0x%08" PRIX64 "\n", zip->locator.eocdOffset);
+            fprintf(stderr, "Corrupted end of central directory locator offset : 0x%08" PRIX64 "\n", zip->locator.eocdOffset);
            freeZip(zip);
            return 0; /* FAILED */
        }
@ -2238,13 +2241,13 @@ static ZIP_FILE *openZip(const char *filename)
        zip->centralDirectorySize = zip->eocdr.centralDirectorySize;
        zip->centralDirectoryRecordCount = (uint64_t)zip->eocdr.totalEntries;
        if (zip->centralDirectoryRecordCount > UINT16_MAX) {
-            printf("Corrupted total number of entries in the central directory : 0x%08" PRIX64 "\n", zip->centralDirectoryRecordCount);
+            fprintf(stderr, "Corrupted total number of entries in the central directory : 0x%08" PRIX64 "\n", zip->centralDirectoryRecordCount);
            freeZip(zip);
            return NULL; /* FAILED */
        }
    }
    if (zip->centralDirectoryOffset >= (uint64_t)zip->fileSize) {
-        printf("Corrupted central directory offset : 0x%08" PRIX64 "\n", zip->centralDirectoryOffset);
+        fprintf(stderr, "Corrupted central directory offset : 0x%08" PRIX64 "\n", zip->centralDirectoryOffset);
        freeZip(zip);
        return NULL; /* FAILED */
    }
@ -2252,7 +2255,7 @@ static ZIP_FILE *openZip(const char *filename)
        freeZip(zip);
        return NULL; /* FAILED */
    }
-    return zip;
+    return zipSortCentralDirectory(zip);
 }

 /*
@ -2281,6 +2284,61 @@ static void freeZip(ZIP_FILE *zip)
    OPENSSL_free(zip);
 }

+/*
+ * Offset comparison function.
+ * [in] a_ptr, b_ptr: pointers to ZIP_CENTRAL_DIRECTORY_ENTRY structure
+ * [returns] entries order
+ */
+static int entry_compare(const ZIP_CENTRAL_DIRECTORY_ENTRY *const *a, const ZIP_CENTRAL_DIRECTORY_ENTRY *const *b)
+{
+    return (*a)->offsetOfLocalHeader < (*b)->offsetOfLocalHeader ? -1 : 1;
+}
+
+/*
+ * Sort central directory entries in ascending order by offset.
+ * [in] zip:  ZIP_FILE structure
+ * [returns] pointer to sorted ZIP_FILE structure
+ */
+static ZIP_FILE *zipSortCentralDirectory(ZIP_FILE *zip)
+{
+    uint64_t noEntries = 0;
+    int i;
+    ZIP_CENTRAL_DIRECTORY_ENTRY *entry;
+    STACK_OF(ZIP_CENTRAL_DIRECTORY_ENTRY) *chain = sk_ZIP_CENTRAL_DIRECTORY_ENTRY_new(entry_compare);
+
+    for (entry = zip->centralDirectoryHead; entry != NULL; entry = entry->next) {
+        if (noEntries >= zip->centralDirectoryRecordCount) {
+            fprintf(stderr, "Corrupted central directory structure\n");
+            sk_ZIP_CENTRAL_DIRECTORY_ENTRY_free(chain);
+            freeZip(zip);
+            return NULL; /* FAILED */
+        }
+        noEntries++;
+        if (!sk_ZIP_CENTRAL_DIRECTORY_ENTRY_push(chain, entry)) {
+            fprintf(stderr, "Failed to add central directory entry\n");
+            sk_ZIP_CENTRAL_DIRECTORY_ENTRY_free(chain);
+            freeZip(zip);
+            return NULL; /* FAILED */
+        }
+    }
+    sk_ZIP_CENTRAL_DIRECTORY_ENTRY_sort(chain);
+    zip->centralDirectoryHead = entry = sk_ZIP_CENTRAL_DIRECTORY_ENTRY_value(chain, 0);
+    if (!entry) {
+        fprintf(stderr, "Failed to get sorted central directory entry\n");
+        sk_ZIP_CENTRAL_DIRECTORY_ENTRY_free(chain);
+        freeZip(zip);
+        return NULL; /* FAILED */
+    }
+    for (i=1; i<sk_ZIP_CENTRAL_DIRECTORY_ENTRY_num(chain); i++) {
+        entry->next = sk_ZIP_CENTRAL_DIRECTORY_ENTRY_value(chain, i);
+        entry = entry->next;
+    }
+    entry->next = NULL;
+    sk_ZIP_CENTRAL_DIRECTORY_ENTRY_free(chain);
+
+    return zip;
+}
+
 /*
 * Log additional output.
 * [in] ZIP_FILE structure
@ -2326,7 +2384,7 @@ static int zipReadCentralDirectory(ZIP_FILE *zip, FILE *file)
        } else if (!zip->centralDirectoryHead) {
            zip->centralDirectoryHead = entry;
        } else {
-            printf("Corrupted central directory structure\n");
+            fprintf(stderr, "Corrupted central directory structure\n");
            OPENSSL_free(entry);
            return 0; /* FAILED */
        }
@ -2350,7 +2408,7 @@ static ZIP_CENTRAL_DIRECTORY_ENTRY *zipReadNextCentralDirectoryEntry(FILE *file)
        return NULL; /* FAILED */
    }
    if (memcmp(signature, PKZIP_CD_SIGNATURE, 4)) {
-        printf("The input file is not a valid zip file - could not find Central Directory record\n");
+        fprintf(stderr, "The input file is not a valid zip file - could not find Central Directory record\n");
        return NULL; /* FAILED */
    }
    entry = OPENSSL_zalloc(sizeof(ZIP_CENTRAL_DIRECTORY_ENTRY));
@ -2429,7 +2487,7 @@ static ZIP_CENTRAL_DIRECTORY_ENTRY *zipReadNextCentralDirectoryEntry(FILE *file)
            uint16_t header = bufferGetU16(entry->extraField, &pos);

            if (header != ZIP64_HEADER) {
-                printf("Expected zip64 header in central directory extra field, got : 0x%X\n", header);
+                fprintf(stderr, "Expected zip64 header in central directory extra field, got : 0x%X\n", header);
                freeZipCentralDirectoryEntry(entry);
                return NULL; /* FAILED */
            }
@ -2439,7 +2497,7 @@ static ZIP_CENTRAL_DIRECTORY_ENTRY *zipReadNextCentralDirectoryEntry(FILE *file)
                    entry->uncompressedSize = bufferGetU64(entry->extraField, &pos);
                    entry->uncompressedSizeInZip64 = 1;
                } else {
-                    printf("Invalid zip64 central directory entry\n");
+                    fprintf(stderr, "Invalid zip64 central directory entry\n");
                    freeZipCentralDirectoryEntry(entry);
                    return NULL; /* FAILED */
                }
@ -2449,7 +2507,7 @@ static ZIP_CENTRAL_DIRECTORY_ENTRY *zipReadNextCentralDirectoryEntry(FILE *file)
                    entry->compressedSize = bufferGetU64(entry->extraField, &pos);
                    entry->compressedSizeInZip64 = 1;
                } else {
-                    printf("Invalid zip64 central directory entry\n");
+                    fprintf(stderr, "Invalid zip64 central directory entry\n");
                    freeZipCentralDirectoryEntry(entry);
                    return NULL; /* FAILED */
                }
@ -2459,7 +2517,7 @@ static ZIP_CENTRAL_DIRECTORY_ENTRY *zipReadNextCentralDirectoryEntry(FILE *file)
                    entry->offsetOfLocalHeader = bufferGetU64(entry->extraField, &pos);
                    entry->offsetInZip64 = 1;
                } else {
-                    printf("Invalid zip64 central directory entry\n");
+                    fprintf(stderr, "Invalid zip64 central directory entry\n");
                    freeZipCentralDirectoryEntry(entry);
                    return NULL; /* FAILED */
                }
@ -2469,7 +2527,7 @@ static ZIP_CENTRAL_DIRECTORY_ENTRY *zipReadNextCentralDirectoryEntry(FILE *file)
                    entry->diskNoStart = bufferGetU32(entry->extraField, &pos);
                    entry->diskNoInZip64 = 1;
                } else {
-                    printf("Invalid zip64 central directory entry\n");
+                    fprintf(stderr, "Invalid zip64 central directory entry\n");
                    freeZipCentralDirectoryEntry(entry);
                    return NULL; /* FAILED */
                }
@ -2546,7 +2604,7 @@ static int readZipEOCDR(ZIP_EOCDR *eocdr, FILE *file)
        eocdr->centralDirectoryDiskNumber != eocdr->diskNumber ||
        eocdr->diskEntries != eocdr->totalEntries)
    {
-        printf("The input file is a multipart archive - not supported\n");
+        fprintf(stderr, "The input file is a multipart archive - not supported\n");
        return 0; /* FAILED */
    }
 #endif
@ -2582,7 +2640,7 @@ static int readZip64EOCDLocator(ZIP64_EOCD_LOCATOR *locator, FILE *file)
        return 0; /* FAILED */
    }
    if (memcmp(signature, PKZIP64_EOCD_LOCATOR_SIGNATURE, 4)) {
-        printf("The input file is not a valid zip file - could not find zip64 EOCD locator\n");
+        fprintf(stderr, "The input file is not a valid zip file - could not find zip64 EOCD locator\n");
        return 0; /* FAILED */
    }
    locator->diskWithEOCD = fileGetU32(file);
@ -2611,7 +2669,7 @@ static int readZip64EOCDR(ZIP64_EOCDR *eocdr, FILE *file, uint64_t offset)
        return 0; /* FAILED */
    }
    if (memcmp(signature, PKZIP64_EOCDR_SIGNATURE, 4)) {
-        printf("The input file is not a valid zip file - could not find zip64 End of Central Directory record\n");
+        fprintf(stderr, "The input file is not a valid zip file - could not find zip64 End of Central Directory record\n");
        return 0; /* FAILED */
    }
    /* size of zip64 end of central directory record (8 bytes) */
@ -2636,7 +2694,7 @@ static int readZip64EOCDR(ZIP64_EOCDR *eocdr, FILE *file, uint64_t offset)
    /* zip64 extensible data sector (comment) */
    eocdr->commentLen = eocdr->eocdrSize - 44;
    if (eocdr->commentLen > UINT16_MAX) {
-        printf("Corrupted file comment length : 0x%08" PRIX64 "\n", eocdr->commentLen);
+        fprintf(stderr, "Corrupted file comment length : 0x%08" PRIX64 "\n", eocdr->commentLen);
        return 0; /* FAILED */
    }
    if (eocdr->commentLen > 0) {
@ -2649,7 +2707,7 @@ static int readZip64EOCDR(ZIP64_EOCDR *eocdr, FILE *file, uint64_t offset)
    if (eocdr->diskWithCentralDirectory > 1 || eocdr->diskNumber > 1 ||
        eocdr->diskWithCentralDirectory != eocdr->diskNumber ||
        eocdr->totalEntries != eocdr->diskEntries) {
-        printf("The input file is a multipart archive - not supported\n");
+        fprintf(stderr, "The input file is a multipart archive - not supported\n");
        return 0; /* FAILED */
    }
    return 1; /* OK */
--- a/cab.c
+++ b/cab.c
@ -206,7 +206,7 @@ static u_char *cab_digest_calc(FILE_FORMAT_CTX *ctx, const EVP_MD *md)
    BIO *bhash = BIO_new(BIO_f_md());

    if (!BIO_set_md(bhash, md)) {
-        printf("Unable to set the message digest of BIO\n");
+        fprintf(stderr, "Unable to set the message digest of BIO\n");
        BIO_free_all(bhash);
        return 0;  /* FAILED */
    }
@ -296,7 +296,7 @@ static u_char *cab_digest_calc(FILE_FORMAT_CTX *ctx, const EVP_MD *md)
            nfolders--;
        }
        if (idx != coffFiles) {
-            printf("Corrupt coffFiles value: 0x%08X\n", coffFiles);
+            fprintf(stderr, "Corrupt coffFiles value: 0x%08X\n", coffFiles);
            BIO_free_all(bhash);
            return 0;  /* FAILED */
        }
@ -307,7 +307,7 @@ static u_char *cab_digest_calc(FILE_FORMAT_CTX *ctx, const EVP_MD *md)
    }
    /* (variable) ab - the compressed data bytes */
    if (!bio_hash_data(bhash, ctx->options->indata, idx, fileend)) {
-        printf("Unable to calculate digest\n");
+        fprintf(stderr, "Unable to calculate digest\n");
        BIO_free_all(bhash);
        return 0;  /* FAILED */
    }
@ -343,17 +343,17 @@ static int cab_verify_digests(FILE_FORMAT_CTX *ctx, PKCS7 *p7)
        }
    }
    if (mdtype == -1) {
-        printf("Failed to extract current message digest\n\n");
+        fprintf(stderr, "Failed to extract current message digest\n\n");
        return 0; /* FAILED */
    }
    md = EVP_get_digestbynid(mdtype);
    cmdbuf = cab_digest_calc(ctx, md);
    if (!cmdbuf) {
-        printf("Failed to calculate message digest\n\n");
+        fprintf(stderr, "Failed to calculate message digest\n\n");
        return 0; /* FAILED */
    }
    if (!compare_digests(mdbuf, cmdbuf, mdtype)) {
-        printf("Signature verification: failed\n\n");
+        fprintf(stderr, "Signature verification: failed\n\n");
        OPENSSL_free(cmdbuf);
        return 0; /* FAILED */
    }
@ -396,7 +396,7 @@ static PKCS7 *cab_pkcs7_extract_to_nest(FILE_FORMAT_CTX *ctx)
 */
 static int cab_remove_pkcs7(FILE_FORMAT_CTX *ctx, BIO *hash, BIO *outdata)
 {
-    size_t i, written, len;
+    size_t idx, written, len;
    uint32_t tmp;
    uint16_t nfolders, flags;
    char *buf;
@ -441,29 +441,39 @@ static int cab_remove_pkcs7(FILE_FORMAT_CTX *ctx, BIO *hash, BIO *outdata)
     * u2 iCabinet - number of this cabinet file in a set: 34-35
     */
    BIO_write(outdata, ctx->options->indata + 32, 4);
-    i = cab_write_optional_names(outdata, ctx->options->indata, 60, flags);
+    idx = cab_write_optional_names(outdata, ctx->options->indata, 60, flags);
+    if (idx >= ctx->cab_ctx->fileend) {
+        fprintf(stderr, "Corrupt CAB file - too short\n");
+        OPENSSL_free(buf);
+        return 0; /* FAILED */
+    }
    /*
     * (u8 * cFolders) CFFOLDER - structure contains information about
     * one of the folders or partial folders stored in this cabinet file
     */
    nfolders = GET_UINT16_LE(ctx->options->indata + 26);
+    if (nfolders * 8 >= ctx->cab_ctx->fileend - idx) {
+        fprintf(stderr, "Corrupt cFolders value: 0x%08X\n", nfolders);
+        OPENSSL_free(buf);
+        return 0; /* FAILED */
+    }
    while (nfolders) {
-        tmp = GET_UINT32_LE(ctx->options->indata + i);
+        tmp = GET_UINT32_LE(ctx->options->indata + idx);
        tmp -= 24;
        PUT_UINT32_LE(tmp, buf);
        BIO_write(outdata, buf, 4);
-        BIO_write(outdata, ctx->options->indata + i + 4, 4);
-        i+=8;
+        BIO_write(outdata, ctx->options->indata + idx + 4, 4);
+        idx += 8;
        nfolders--;
    }
    OPENSSL_free(buf);
    /* Write what's left - the compressed data bytes */
-    len = ctx->cab_ctx->fileend - ctx->cab_ctx->siglen - i;
+    len = ctx->cab_ctx->fileend - ctx->cab_ctx->siglen - idx;
    while (len > 0) {
-        if (!BIO_write_ex(outdata, ctx->options->indata + i, len, &written))
+        if (!BIO_write_ex(outdata, ctx->options->indata + idx, len, &written))
            return 1; /* FAILED */
        len -= written;
-        i += written;
+        idx += written;
    }
    return 0; /* OK */
 }
@ -480,12 +490,12 @@ static int cab_process_data(FILE_FORMAT_CTX *ctx, BIO *hash, BIO *outdata)
    /* Strip current signature and modify header */
    if (ctx->cab_ctx->header_size == 20) {
        if (!cab_modify_header(ctx, hash, outdata))
-            return 1; /* FAILED */
+            return 0; /* FAILED */
    } else {
        if (!cab_add_header(ctx, hash, outdata))
-            return 1; /* FAILED */
+            return 0; /* FAILED */
    }
-    return 0; /* OK */
+    return 1; /* OK */
 }

 /*
@ -500,26 +510,26 @@ static PKCS7 *cab_pkcs7_signature_new(FILE_FORMAT_CTX *ctx, BIO *hash)
    PKCS7 *p7 = pkcs7_create(ctx);

    if (!p7) {
-        printf("Creating a new signature failed\n");
+        fprintf(stderr, "Creating a new signature failed\n");
        return NULL; /* FAILED */
    }
    if (ctx->options->jp >= 0 && !cab_add_jp_attribute(p7, ctx->options->jp)) {
-        printf("Adding jp attribute failed\n");
+        fprintf(stderr, "Adding jp attribute failed\n");
        PKCS7_free(p7);
        return NULL; /* FAILED */
    }
    if (!add_indirect_data_object(p7)) {
-        printf("Adding SPC_INDIRECT_DATA_OBJID failed\n");
+        fprintf(stderr, "Adding SPC_INDIRECT_DATA_OBJID failed\n");
        PKCS7_free(p7);
        return NULL; /* FAILED */
    }
    content = spc_indirect_data_content_get(hash, ctx);
    if (!content) {
-        printf("Failed to get spcIndirectDataContent\n");
+        fprintf(stderr, "Failed to get spcIndirectDataContent\n");
        return NULL; /* FAILED */
    }
    if (!sign_spc_indirect_data_content(p7, content)) {
-        printf("Failed to set signed content\n");
+        fprintf(stderr, "Failed to set signed content\n");
        PKCS7_free(p7);
        ASN1_OCTET_STRING_free(content);
        return NULL; /* FAILED */
@ -546,7 +556,7 @@ static int cab_append_pkcs7(FILE_FORMAT_CTX *ctx, BIO *outdata, PKCS7 *p7)

    if (((len = i2d_PKCS7(p7, NULL)) <= 0)
        || (p = OPENSSL_malloc((size_t)len)) == NULL) {
-        printf("i2d_PKCS memory allocation failed: %d\n", len);
+        fprintf(stderr, "i2d_PKCS memory allocation failed: %d\n", len);
        return 1; /* FAILED */
    }
    i2d_PKCS7(p7, &p);
@ -643,19 +653,19 @@ static CAB_CTX *cab_ctx_get(char *indata, uint32_t filesize)
    uint16_t flags;

    if (filesize < 44) {
-        printf("CAB file is too short\n");
+        fprintf(stderr, "CAB file is too short\n");
        return NULL; /* FAILED */
    }
    reserved = GET_UINT32_LE(indata + 4);
    if (reserved) {
-        printf("Reserved1: 0x%08X\n", reserved);
+        fprintf(stderr, "Reserved1: 0x%08X\n", reserved);
        return NULL; /* FAILED */
    }
    /* flags specify bit-mapped values that indicate the presence of optional data */
    flags = GET_UINT16_LE(indata + 30);
    if (flags & FLAG_PREV_CABINET) {
        /* FLAG_NEXT_CABINET works */
-        printf("Multivolume cabinet file is unsupported: flags 0x%04X\n", flags);
+        fprintf(stderr, "Multivolume cabinet file is unsupported: flags 0x%04X\n", flags);
        return NULL; /* FAILED */
    }
    if (flags & FLAG_RESERVE_PRESENT) {
@ -665,12 +675,12 @@ static CAB_CTX *cab_ctx_get(char *indata, uint32_t filesize)
        */
        header_size = GET_UINT32_LE(indata + 36);
        if (header_size != 20) {
-            printf("Additional header size: 0x%08X\n", header_size);
+            fprintf(stderr, "Additional header size: 0x%08X\n", header_size);
            return NULL; /* FAILED */
        }
        reserved = GET_UINT32_LE(indata + 40);
        if (reserved != 0x00100000) {
-            printf("abReserved: 0x%08X\n", reserved);
+            fprintf(stderr, "abReserved: 0x%08X\n", reserved);
            return NULL; /* FAILED */
        }
        /*
@ -685,13 +695,13 @@ static CAB_CTX *cab_ctx_get(char *indata, uint32_t filesize)
        sigpos = GET_UINT32_LE(indata + 44);
        siglen = GET_UINT32_LE(indata + 48);
        if ((sigpos < filesize && sigpos + siglen != filesize) || (sigpos >= filesize)) {
-            printf("Additional data offset:\t%u bytes\nAdditional data size:\t%u bytes\n",
+            fprintf(stderr, "Additional data offset:\t%u bytes\nAdditional data size:\t%u bytes\n",
                sigpos, siglen);
-            printf("File size:\t\t%u bytes\n", filesize);
+            fprintf(stderr, "File size:\t\t%u bytes\n", filesize);
            return NULL; /* FAILED */
        }
        if ((sigpos > 0 && siglen == 0) || (sigpos == 0 && siglen > 0)) {
-            printf("Corrupt signature\n");
+            fprintf(stderr, "Corrupt signature\n");
            return NULL; /* FAILED */
        }
    }
@ -802,7 +812,7 @@ static size_t cab_write_optional_names(BIO *outdata, char *indata, size_t i, uin
 */
 static int cab_modify_header(FILE_FORMAT_CTX *ctx, BIO *hash, BIO *outdata)
 {
-    size_t i, written, len;
+    size_t idx, written, len;
    uint16_t nfolders, flags;
    u_char buf[] = {0x00, 0x00};

@ -840,24 +850,32 @@ static int cab_modify_header(FILE_FORMAT_CTX *ctx, BIO *hash, BIO *outdata)
    /* u4 abReserve: 56-59 */
    BIO_write(hash, ctx->options->indata + 56, 4);

-    i = cab_write_optional_names(outdata, ctx->options->indata, 60, flags);
+    idx = cab_write_optional_names(outdata, ctx->options->indata, 60, flags);
+    if (idx >= ctx->cab_ctx->fileend) {
+        fprintf(stderr, "Corrupt CAB file - too short\n");
+        return 0; /* FAILED */
+    }
    /*
     * (u8 * cFolders) CFFOLDER - structure contains information about
     * one of the folders or partial folders stored in this cabinet file
     */
    nfolders = GET_UINT16_LE(ctx->options->indata + 26);
+    if (nfolders * 8 >= ctx->cab_ctx->fileend - idx) {
+        fprintf(stderr, "Corrupt cFolders value: 0x%08X\n", nfolders);
+        return 0; /* FAILED */
+    }
    while (nfolders) {
-        BIO_write(hash, ctx->options->indata + i, 8);
-        i += 8;
+        BIO_write(hash, ctx->options->indata + idx, 8);
+        idx += 8;
        nfolders--;
    }
    /* Write what's left - the compressed data bytes */
-    len = ctx->cab_ctx->sigpos - i;
+    len = ctx->cab_ctx->sigpos - idx;
    while (len > 0) {
-        if (!BIO_write_ex(hash, ctx->options->indata + i, len, &written))
+        if (!BIO_write_ex(hash, ctx->options->indata + idx, len, &written))
            return 0; /* FAILED */
        len -= written;
-        i += written;
+        idx += written;
    }
    return 1; /* OK */
 }
@ -871,7 +889,7 @@ static int cab_modify_header(FILE_FORMAT_CTX *ctx, BIO *hash, BIO *outdata)
 */
 static int cab_add_header(FILE_FORMAT_CTX *ctx, BIO *hash, BIO *outdata)
 {
-    size_t i, written, len;
+    size_t idx, written, len;
    uint32_t tmp;
    uint16_t nfolders, flags;
    u_char cabsigned[] = {
@ -916,29 +934,39 @@ static int cab_add_header(FILE_FORMAT_CTX *ctx, BIO *hash, BIO *outdata)
    BIO_write(outdata, cabsigned, 20);
    BIO_write(hash, cabsigned+20, 4);

-    i = cab_write_optional_names(outdata, ctx->options->indata, 36, flags);
+    idx = cab_write_optional_names(outdata, ctx->options->indata, 36, flags);
+    if (idx >= ctx->cab_ctx->fileend) {
+        fprintf(stderr, "Corrupt CAB file - too short\n");
+        OPENSSL_free(buf);
+        return 0; /* FAILED */
+    }
    /*
     * (u8 * cFolders) CFFOLDER - structure contains information about
     * one of the folders or partial folders stored in this cabinet file
     */
    nfolders = GET_UINT16_LE(ctx->options->indata + 26);
+    if (nfolders * 8 >= ctx->cab_ctx->fileend - idx) {
+        fprintf(stderr, "Corrupt cFolders value: 0x%08X\n", nfolders);
+        OPENSSL_free(buf);
+        return 0; /* FAILED */
+    }
    while (nfolders) {
-        tmp = GET_UINT32_LE(ctx->options->indata + i);
+        tmp = GET_UINT32_LE(ctx->options->indata + idx);
        tmp += 24;
        PUT_UINT32_LE(tmp, buf);
        BIO_write(hash, buf, 4);
-        BIO_write(hash, ctx->options->indata + i + 4, 4);
-        i += 8;
+        BIO_write(hash, ctx->options->indata + idx + 4, 4);
+        idx += 8;
        nfolders--;
    }
    OPENSSL_free(buf);
    /* Write what's left - the compressed data bytes */
-    len = ctx->cab_ctx->fileend - i;
+    len = ctx->cab_ctx->fileend - idx;
    while (len > 0) {
-        if (!BIO_write_ex(hash, ctx->options->indata + i, len, &written))
+        if (!BIO_write_ex(hash, ctx->options->indata + idx, len, &written))
            return 0; /* FAILED */
        len -= written;
-        i += written;
+        idx += written;
    }
    return 1; /* OK */
 }
@ -951,16 +979,16 @@ static int cab_add_header(FILE_FORMAT_CTX *ctx, BIO *hash, BIO *outdata)
 static int cab_check_file(FILE_FORMAT_CTX *ctx)
 {
    if (!ctx) {
-        printf("Init error\n\n");
+        fprintf(stderr, "Init error\n");
        return 0; /* FAILED */
    }
    if (ctx->cab_ctx->header_size != 20) {
-        printf("No signature found\n\n");
+        fprintf(stderr, "No signature found\n");
        return 0; /* FAILED */
    }
    if (ctx->cab_ctx->sigpos == 0 || ctx->cab_ctx->siglen == 0
        || ctx->cab_ctx->sigpos > ctx->cab_ctx->fileend) {
-        printf("No signature found\n\n");
+        fprintf(stderr, "No signature found\n");
        return 0; /* FAILED */
    }
    return 1; /* OK */
--- a/cat.c
+++ b/cat.c
@ -82,7 +82,7 @@ static FILE_FORMAT_CTX *cat_ctx_new(GLOBAL_OPTIONS *options, BIO *hash, BIO *out
    uint32_t filesize;

    if (options->cmd == CMD_REMOVE || options->cmd==CMD_ATTACH || options->cmd == CMD_EXTRACT_DATA) {
-        printf("Unsupported command\n");
+        fprintf(stderr, "Unsupported command\n");
        return NULL; /* FAILED */
    }
    filesize = get_file_size(options->infile);
@ -158,18 +158,23 @@ static PKCS7 *cat_pkcs7_signature_new(FILE_FORMAT_CTX *ctx, BIO *hash)

    p7 = pkcs7_create(ctx);
    if (!p7) {
-        printf("Creating a new signature failed\n");
+        fprintf(stderr, "Creating a new signature failed\n");
        return NULL; /* FAILED */
    }
    if (!cat_add_ms_ctl_object(p7)) {
-        printf("Adding MS_CTL_OBJID failed\n");
+        fprintf(stderr, "Adding MS_CTL_OBJID failed\n");
+        PKCS7_free(p7);
+        return NULL; /* FAILED */
+    }
+    if (!ctx->cat_ctx->p7 || !ctx->cat_ctx->p7->d.sign || !ctx->cat_ctx->p7->d.sign->contents) {
+        fprintf(stderr, "Failed to get content\n");
        PKCS7_free(p7);
        return NULL; /* FAILED */
    }
    if (!cat_sign_ms_ctl_content(p7, ctx->cat_ctx->p7->d.sign->contents)) {
-        printf("Failed to set signed content\n");
+        fprintf(stderr, "Failed to set signed content\n");
        PKCS7_free(p7);
-        return 0; /* FAILED */
+        return NULL; /* FAILED */
    }
    return p7; /* OK */
 }
@ -280,17 +285,22 @@ static int cat_sign_ms_ctl_content(PKCS7 *p7, PKCS7 *contents)
    u_char *content;
    int seqhdrlen, content_length;

+    if (!contents->d.other || !contents->d.other->value.sequence
+          || !contents->d.other->value.sequence->data) {
+        fprintf(stderr, "Failed to get content value\n");
+        return 0; /* FAILED */
+    }
    seqhdrlen = asn1_simple_hdr_len(contents->d.other->value.sequence->data,
        contents->d.other->value.sequence->length);
    content = contents->d.other->value.sequence->data + seqhdrlen;
    content_length = contents->d.other->value.sequence->length - seqhdrlen;

    if (!pkcs7_sign_content(p7, content, content_length)) {
-        printf("Failed to sign content\n");
+        fprintf(stderr, "Failed to sign content\n");
        return 0; /* FAILED */
    }
    if (!PKCS7_set_content(p7, PKCS7_dup(contents))) {
-        printf("PKCS7_set_content failed\n");
+        fprintf(stderr, "PKCS7_set_content failed\n");
        return 0; /* FAILED */
    }
    return 1; /* OK */
@ -308,7 +318,7 @@ static int cat_list_content(PKCS7 *p7)

    ctlc = ms_ctl_content_get(p7);
    if (!ctlc) {
-        printf("Failed to extract MS_CTL_OBJID data\n");
+        fprintf(stderr, "Failed to extract MS_CTL_OBJID data\n");
        return 1; /* FAILED */
    }
    printf("\nCatalog members:\n");
@ -343,7 +353,7 @@ static int cat_list_content(PKCS7 *p7)
            printf("\n");
    }
    MsCtlContent_free(ctlc);
-    ERR_print_errors_fp(stdout);
+    ERR_print_errors_fp(stderr);
    return 0; /* OK */
 }

@ -372,7 +382,7 @@ static int cat_print_content_member_digest(ASN1_TYPE *content)
    }
    SpcIndirectDataContent_free(idc);
    if (mdtype == -1) {
-        printf("Failed to extract current message digest\n\n");
+        fprintf(stderr, "Failed to extract current message digest\n\n");
        return 0; /* FAILED */
    }
    printf("\tHash algorithm: %s\n", OBJ_nid2sn(mdtype));
@ -451,17 +461,17 @@ static int cat_check_file(FILE_FORMAT_CTX *ctx)
    PKCS7_SIGNER_INFO *si;

    if (!ctx) {
-        printf("Init error\n\n");
+        fprintf(stderr, "Init error\n");
        return 0; /* FAILED */
    }
    signer_info = PKCS7_get_signer_info(ctx->cat_ctx->p7);
    if (!signer_info) {
-        printf("Failed catalog file\n\n");
+        fprintf(stderr, "Failed catalog file\n");
        return 0; /* FAILED */
    }
    si = sk_PKCS7_SIGNER_INFO_value(signer_info, 0);
    if (!si) {
-        printf("No signature found\n\n");
+        fprintf(stderr, "No signature found\n");
        return 0; /* FAILED */
    }
    if (ctx->options->verbose) {
--- a/cmake/CMakeTest.cmake
+++ b/cmake/CMakeTest.cmake
--- a/code_signing_ca.pem
+++ b/code_signing_ca.pem
--- a/get_code_signing_ca.py
+++ b/get_code_signing_ca.py
@ -0,0 +1,41 @@
+#!/usr/bin/python3
+# © 2024 Michal Trojnara
+# This script downloads Microsoft code signing certificates
+# Tor is required for this script to work
+# Redirect the script output to a PEM file
+
+from sys import stderr
+from time import sleep
+from csv import reader
+from requests import get
+from requests.exceptions import RequestException
+from concurrent.futures import ThreadPoolExecutor
+
+def download_cert(hash):
+    for attempt in range(10):
+        if attempt > 0:
+            sleep(10)
+        try:
+            creds = f'{attempt}{hash}:{attempt}{hash}'
+            resp = get(f'https://crt.sh/?d={hash}',
+                proxies=dict(https=f'socks5://{creds}@127.0.0.1:9050'))
+            resp.raise_for_status()
+            print('.', file=stderr, end='')
+            stderr.flush()
+            return resp.content.decode('utf-8')
+        except RequestException as e:
+            print(f'\nAttempt {attempt}: {e}', file=stderr)
+    print('\nGiving up on', hash, file=stderr)
+
+resp = get('https://ccadb-public.secure.force.com/microsoft/IncludedCACertificateReportForMSFTCSV')
+resp.raise_for_status()
+lines = resp.content.decode('utf-8').splitlines()[1:]
+hashes = [row[4] for row in reader(lines)
+    if row[0] != 'Disabled'
+        or row[4] == 'F38406E540D7A9D90CB4A9479299640FFB6DF9E224ECC7A01C0D9558D8DAD77D']
+with ThreadPoolExecutor(max_workers=20) as executor:
+    certs = executor.map(download_cert, hashes)
+for cert in certs:
+    if cert is not None:
+        print(cert)
+print('\nDone', file=stderr)
--- a/helpers.c
+++ b/helpers.c
@ -37,16 +37,16 @@ uint32_t get_file_size(const char *infile)
    ret = stat(infile, &st);
 #endif
    if (ret) {
-        printf("Failed to open file: %s\n", infile);
+        fprintf(stderr, "Failed to open file: %s\n", infile);
        return 0;
    }

    if (st.st_size < 4) {
-        printf("Unrecognized file type - file is too short: %s\n", infile);
+        fprintf(stderr, "Unrecognized file type - file is too short: %s\n", infile);
        return 0;
    }
    if (st.st_size > UINT32_MAX) {
-        printf("Unsupported file - too large: %s\n", infile);
+        fprintf(stderr, "Unsupported file - too large: %s\n", infile);
        return 0;
    }
    return (uint32_t)st.st_size;
@ -86,7 +86,7 @@ char *map_file(const char *infile, const size_t size)
    }
    close(fd);
 #else
-    printf("No file mapping function\n");
+    fprintf(stderr, "No file mapping function\n");
    return NULL;
 #endif /* HAVE_SYS_MMAN_H */
 #endif /* WIN32 */
@ -152,7 +152,7 @@ int data_write_pkcs7(FILE_FORMAT_CTX *ctx, BIO *outdata, PKCS7 *p7)
        ret = !i2d_PKCS7_bio(outdata, p7);
    }
    if (ret) {
-        printf("Unable to write pkcs7 object\n");
+        fprintf(stderr, "Unable to write pkcs7 object\n");
    }
    return ret;
 }
@ -193,9 +193,9 @@ PKCS7 *pkcs7_create(FILE_FORMAT_CTX *ctx)
            }
        }
        if (si == NULL) {
-            printf("Failed to checking the consistency of a private key: %s\n",
+            fprintf(stderr, "Failed to checking the consistency of a private key: %s\n",
                ctx->options->keyfile);
-            printf("          with a public key in any X509 certificate: %s\n\n",
+            fprintf(stderr, "          with a public key in any X509 certificate: %s\n\n",
                ctx->options->certfile);
            return NULL; /* FAILED */
        }
@ -208,7 +208,7 @@ PKCS7 *pkcs7_create(FILE_FORMAT_CTX *ctx)
    }
    if ((ctx->options->desc || ctx->options->url) &&
            !pkcs7_signer_info_add_spc_sp_opus_info(si, ctx)) {
-        printf("Couldn't allocate memory for opus info\n");
+        fprintf(stderr, "Couldn't allocate memory for opus info\n");
        return NULL; /* FAILED */
    }
    if ((ctx->options->nested_number >= 0) &&
@ -218,7 +218,7 @@ PKCS7 *pkcs7_create(FILE_FORMAT_CTX *ctx)
    /* create X509 chain sorted in ascending order by their DER encoding */
    chain = X509_chain_get_sorted(ctx, signer);
    if (chain == NULL) {
-        printf("Failed to create a sorted certificate chain\n");
+        fprintf(stderr, "Failed to create a sorted certificate chain\n");
        return NULL; /* FAILED */
    }
    /* add sorted certificate chain */
@ -278,11 +278,12 @@ int sign_spc_indirect_data_content(PKCS7 *p7, ASN1_OCTET_STRING *content)
    inf = ASN1_get_object(&p, &plen, &tag, &class, len);
    if (inf != V_ASN1_CONSTRUCTED || tag != V_ASN1_SEQUENCE
        || !pkcs7_sign_content(p7, p, (int)plen)) {
-        printf("Failed to sign spcIndirectDataContent\n");
+        fprintf(stderr, "Failed to sign spcIndirectDataContent\n");
        return 0; /* FAILED */
    }
    td7 = PKCS7_new();
    if (!td7) {
+        fprintf(stderr, "PKCS7_new failed\n");
        return 0; /* FAILED */
    }
    td7->type = OBJ_txt2obj(SPC_INDIRECT_DATA_OBJID, 1);
@ -291,7 +292,7 @@ int sign_spc_indirect_data_content(PKCS7 *p7, ASN1_OCTET_STRING *content)
    td7->d.other->value.sequence = ASN1_STRING_new();
    ASN1_STRING_set(td7->d.other->value.sequence, data, len);
    if (!PKCS7_set_content(p7, td7)) {
-        printf("PKCS7_set_content failed\n");
+        fprintf(stderr, "PKCS7_set_content failed\n");
        PKCS7_free(td7);
        return 0; /* FAILED */
    }
@ -388,13 +389,13 @@ int pkcs7_sign_content(PKCS7 *p7, const u_char *data, int len)
    BIO *p7bio;

    if ((p7bio = PKCS7_dataInit(p7, NULL)) == NULL) {
-        printf("PKCS7_dataInit failed\n");
+        fprintf(stderr, "PKCS7_dataInit failed\n");
        return 0; /* FAILED */
    }
    BIO_write(p7bio, data, len);
    (void)BIO_flush(p7bio);
    if (!PKCS7_dataFinal(p7, p7bio)) {
-        printf("PKCS7_dataFinal failed\n");
+        fprintf(stderr, "PKCS7_dataFinal failed\n");
        BIO_free_all(p7bio);
        return 0; /* FAILED */
    }
@ -488,7 +489,7 @@ MsCtlContent *ms_ctl_content_get(PKCS7 *p7)
    const u_char *data;

    if (!is_content_type(p7, MS_CTL_OBJID)) {
-        printf("Failed to find MS_CTL_OBJID\n");
+        fprintf(stderr, "Failed to find MS_CTL_OBJID\n");
        return NULL; /* FAILED */
    }
    value = p7->d.sign->contents->d.other->value.sequence;
--- a/msi.c
+++ b/msi.c
--- a/osslsigncode.c
+++ b/osslsigncode.c
--- a/osslsigncode.h
+++ b/osslsigncode.h
@ -14,6 +14,7 @@
 #define NOCRYPT
 #define WIN32_LEAN_AND_MEAN
 #include <windows.h>
+#include <winsock2.h>
 #endif /* HAVE_WINDOWS_H */

 #ifdef HAVE_CONFIG_H
@ -32,6 +33,7 @@

 #ifndef _WIN32
 #include <unistd.h>
+#include <sys/socket.h>
 #ifdef HAVE_SYS_MMAN_H
 #include <sys/mman.h>
 #endif /* HAVE_SYS_MMAN_H */
@ -63,6 +65,7 @@
 #endif /* OPENSSL_VERSION_NUMBER>=0x30000000L */
 #include <openssl/rand.h>
 #include <openssl/safestack.h>
+#include <openssl/ssl.h>
 #include <openssl/ts.h>
 #include <openssl/x509.h>
 #include <openssl/x509v3.h> /* X509_PURPOSE */
@ -76,6 +79,8 @@
 #include <curl/curl.h>
 #endif /* ENABLE_CURL */

+/* Request nonce length, in bits (must be a multiple of 8). */
+#define NONCE_LENGTH    64
 #define MAX_TS_SERVERS 256

 #if defined (HAVE_TERMIOS_H) || defined (HAVE_GETPASS)
@ -216,9 +221,9 @@
 */
 #define FLAG_RESERVE_PRESENT 0x0004

-#define DO_EXIT_0(x) { printf(x); goto err_cleanup; }
-#define DO_EXIT_1(x, y) { printf(x, y); goto err_cleanup; }
-#define DO_EXIT_2(x, y, z) { printf(x, y, z); goto err_cleanup; }
+#define DO_EXIT_0(x) { fprintf(stderr, x); goto err_cleanup; }
+#define DO_EXIT_1(x, y) { fprintf(stderr, x, y); goto err_cleanup; }
+#define DO_EXIT_2(x, y, z) { fprintf(stderr, x, y, z); goto err_cleanup; }

 /* Default policy if request did not specify it. */
 #define TSA_POLICY1 "1.2.3.4.1"
@ -251,6 +256,7 @@ typedef struct {
    char *p11engine;
    char *p11module;
    char *p11cert;
+    int login;
 #endif /* OPENSSL_NO_ENGINE */
    int askpass;
    char *readpass;
@ -272,11 +278,14 @@ typedef struct {
    int index;
    int ignore_timestamp;
    int ignore_cdp;
+    int ignore_crl;
    int verbose;
    int add_msi_dse;
    char *catalog;
    char *cafile;
    char *crlfile;
+    char *https_cafile;
+    char *https_crlfile;
    char *tsa_cafile;
    char *tsa_crlfile;
    char *leafhash;
@ -478,6 +487,14 @@ typedef struct {

 DECLARE_ASN1_FUNCTIONS(MsCtlContent)

+typedef struct {
+    char *server;
+    const char *port;
+    int use_proxy;
+    int timeout;
+    SSL_CTX *ssl_ctx;
+} HTTP_TLS_Info;
+
 typedef struct file_format_st FILE_FORMAT;

 typedef struct script_ctx_st SCRIPT_CTX;
--- a/pe.c
+++ b/pe.c
@ -251,7 +251,7 @@ static int pe_verify_digests(FILE_FORMAT_CTX *ctx, PKCS7 *p7)
        SpcIndirectDataContent *idc = d2i_SpcIndirectDataContent(NULL, &p, content_val->length);
        if (idc) {
            if (!pe_page_hash_get(&ph, &phlen, &phtype, idc->data)) {
-                printf("Failed to extract a page hash\n\n");
+                fprintf(stderr, "Failed to extract a page hash\n\n");
                SpcIndirectDataContent_free(idc);
                return 0; /* FAILED */
            }
@ -263,25 +263,25 @@ static int pe_verify_digests(FILE_FORMAT_CTX *ctx, PKCS7 *p7)
        }
    }
    if (mdtype == -1) {
-        printf("Failed to extract current message digest\n\n");
+        fprintf(stderr, "Failed to extract current message digest\n\n");
        OPENSSL_free(ph);
        return 0; /* FAILED */
    }
    md = EVP_get_digestbynid(mdtype);
    cmdbuf = pe_digest_calc(ctx, md);
    if (!cmdbuf) {
-        printf("Failed to calculate message digest\n\n");
+        fprintf(stderr, "Failed to calculate message digest\n\n");
        OPENSSL_free(ph);
        return 0; /* FAILED */
    }
    if (!compare_digests(mdbuf, cmdbuf, mdtype)) {
-        printf("Signature verification: failed\n\n");
+        fprintf(stderr, "Signature verification: failed\n\n");
        OPENSSL_free(ph);
        OPENSSL_free(cmdbuf);
        return 0; /* FAILED */
    }
    if (!pe_verify_page_hash(ctx, ph, phlen, phtype)) {
-        printf("Signature verification: failed\n\n");
+        fprintf(stderr, "Signature verification: failed\n\n");
        OPENSSL_free(ph);
        OPENSSL_free(cmdbuf);
        return 0; /* FAILED */
@ -303,11 +303,11 @@ static int pe_verify_indirect_data(FILE_FORMAT_CTX *ctx, SpcAttributeTypeAndOpti
    u_char *ph = NULL;

    if (!pe_page_hash_get(&ph, &phlen, &phtype, obj)) {
-        printf("Failed to extract a page hash\n\n");
+        fprintf(stderr, "Failed to extract a page hash\n\n");
        return 0; /* FAILED */
    }
    if (!pe_verify_page_hash(ctx, ph, phlen, phtype)) {
-        printf("Page hash verification: failed\n\n");
+        fprintf(stderr, "Page hash verification: failed\n\n");
        OPENSSL_free(ph);
        return 0; /* FAILED */
    }
@ -353,7 +353,7 @@ static int pe_remove_pkcs7(FILE_FORMAT_CTX *ctx, BIO *hash, BIO *outdata)
    /* Strip current signature */
    ctx->pe_ctx->fileend = ctx->pe_ctx->sigpos;
    if (!pe_modify_header(ctx, hash, outdata)) {
-        printf("Unable to modify file header\n");
+        fprintf(stderr, "Unable to modify file header\n");
        return 1; /* FAILED */
    }
    return 0; /* OK */
@ -373,10 +373,10 @@ static int pe_process_data(FILE_FORMAT_CTX *ctx, BIO *hash, BIO *outdata)
        ctx->pe_ctx->fileend = ctx->pe_ctx->sigpos;
    }
    if (!pe_modify_header(ctx, hash, outdata)) {
-        printf("Unable to modify file header\n");
-        return 1; /* FAILED */
+        fprintf(stderr, "Unable to modify file header\n");
+        return 0; /* FAILED */
    }
-    return 0; /* OK */
+    return 1; /* OK */
 }

 /*
@ -391,21 +391,21 @@ static PKCS7 *pe_pkcs7_signature_new(FILE_FORMAT_CTX *ctx, BIO *hash)
    PKCS7 *p7 = pkcs7_create(ctx);

    if (!p7) {
-        printf("Creating a new signature failed\n");
+        fprintf(stderr, "Creating a new signature failed\n");
        return NULL; /* FAILED */
    }
    if (!add_indirect_data_object(p7)) {
-        printf("Adding SPC_INDIRECT_DATA_OBJID failed\n");
+        fprintf(stderr, "Adding SPC_INDIRECT_DATA_OBJID failed\n");
        PKCS7_free(p7);
        return NULL; /* FAILED */
    }
    content = spc_indirect_data_content_get(hash, ctx);
    if (!content) {
-        printf("Failed to get spcIndirectDataContent\n");
+        fprintf(stderr, "Failed to get spcIndirectDataContent\n");
        return NULL; /* FAILED */
    }
    if (!sign_spc_indirect_data_content(p7, content)) {
-        printf("Failed to set signed content\n");
+        fprintf(stderr, "Failed to set signed content\n");
        PKCS7_free(p7);
        ASN1_OCTET_STRING_free(content);
        return NULL; /* FAILED */
@ -435,7 +435,7 @@ static int pe_append_pkcs7(FILE_FORMAT_CTX *ctx, BIO *outdata, PKCS7 *p7)

    if (((len = i2d_PKCS7(p7, NULL)) <= 0)
        || (p = OPENSSL_malloc((size_t)len)) == NULL) {
-        printf("i2d_PKCS memory allocation failed: %d\n", len);
+        fprintf(stderr, "i2d_PKCS memory allocation failed: %d\n", len);
        return 1; /* FAILED */
    }
    i2d_PKCS7(p7, &p);
@ -540,7 +540,7 @@ static PE_CTX *pe_ctx_get(char *indata, uint32_t filesize)
    uint16_t magic;

    if (filesize < 64) {
-        printf("Corrupt DOS file - too short\n");
+        fprintf(stderr, "Corrupt DOS file - too short\n");
        return NULL; /* FAILED */
    }
    /* SizeOfHeaders field specifies the combined size of an MS-DOS stub, PE header,
@ -549,15 +549,15 @@ static PE_CTX *pe_ctx_get(char *indata, uint32_t filesize)
     * because of a bug when checking section names for compatibility purposes */
    header_size = GET_UINT32_LE(indata + 60);
    if (header_size < 44 || header_size > filesize) {
-        printf("Unexpected SizeOfHeaders field: 0x%08X\n", header_size);
+        fprintf(stderr, "Unexpected SizeOfHeaders field: 0x%08X\n", header_size);
        return NULL; /* FAILED */
    }
    if (filesize < header_size + 176) {
-        printf("Corrupt PE file - too short\n");
+        fprintf(stderr, "Corrupt PE file - too short\n");
        return NULL; /* FAILED */
    }
    if (memcmp(indata + header_size, "PE\0\0", 4)) {
-        printf("Unrecognized DOS file type\n");
+        fprintf(stderr, "Unrecognized DOS file type\n");
        return NULL; /* FAILED */
    }
    /* Magic field identifies the state of the image file. The most common number is
@ -570,7 +570,7 @@ static PE_CTX *pe_ctx_get(char *indata, uint32_t filesize)
    } else if (magic == 0x10b) {
        pe32plus = 0;
    } else {
-        printf("Corrupt PE file - found unknown magic %04X\n", magic);
+        fprintf(stderr, "Corrupt PE file - found unknown magic %04X\n", magic);
        return NULL; /* FAILED */
    }
    /* The image file checksum */
@ -579,7 +579,7 @@ static PE_CTX *pe_ctx_get(char *indata, uint32_t filesize)
     * in the remainder of the optional header. Each describes a location and size. */
    nrvas = GET_UINT32_LE(indata + header_size + 116 + pe32plus * 16);
    if (nrvas < 5) {
-        printf("Can not handle PE files without certificate table resource\n");
+        fprintf(stderr, "Can not handle PE files without certificate table resource\n");
        return NULL; /* FAILED */
    }
    /* Certificate Table field specifies the attribute certificate table address (4 bytes) and size (4 bytes) */
@ -589,7 +589,7 @@ static PE_CTX *pe_ctx_get(char *indata, uint32_t filesize)
       that signature should be last part of file */
    if ((sigpos != 0 || siglen != 0) &&
            (sigpos == 0 || siglen == 0 || sigpos >= filesize || sigpos + siglen != filesize)) {
-        printf("Ignoring PE signature not at the end of the file\n");
+        printf("Warning: Ignoring PE signature not at the end of the file\n");
        sigpos = 0;
        siglen = 0;
    }
@ -617,7 +617,7 @@ static PKCS7 *pe_pkcs7_get_file(char *indata, PE_CTX *pe_ctx)
    uint32_t pos = 0;

    if (pe_ctx->siglen == 0 || pe_ctx->siglen > pe_ctx->fileend) {
-        printf("Corrupted signature length: 0x%08X\n", pe_ctx->siglen);
+        fprintf(stderr, "Corrupted signature length: 0x%08X\n", pe_ctx->siglen);
        return NULL; /* FAILED */
    }
    while (pos < pe_ctx->siglen) {
@ -780,7 +780,7 @@ static BIO *pe_digest_calc_bio(FILE_FORMAT_CTX *ctx, const EVP_MD *md)
    BIO *bhash = BIO_new(BIO_f_md());

    if (!BIO_set_md(bhash, md)) {
-        printf("Unable to set the message digest of BIO\n");
+        fprintf(stderr, "Unable to set the message digest of BIO\n");
        BIO_free_all(bhash);
        return 0; /* FAILED */
    }
@ -805,7 +805,7 @@ static BIO *pe_digest_calc_bio(FILE_FORMAT_CTX *ctx, const EVP_MD *md)
    }
    idx += (uint32_t)written + 8;
    if (!bio_hash_data(bhash, ctx->options->indata, idx, fileend)) {
-        printf("Unable to calculate digest\n");
+        fprintf(stderr, "Unable to calculate digest\n");
        BIO_free_all(bhash);
        return 0;  /* FAILED */
    }
@ -918,7 +918,7 @@ static u_char *pe_page_hash_calc(int *rphlen, FILE_FORMAT_CTX *ctx, int phtype)
     * which immediately follows the headers, can be up to 65535 under Vista and later */
    nsections = GET_UINT16_LE(ctx->options->indata + ctx->pe_ctx->header_size + 6);
    if (nsections == 0) {
-        printf("Corrupted number of sections: 0x%08X\n", nsections);
+        fprintf(stderr, "Corrupted number of sections: 0x%08X\n", nsections);
        return NULL; /* FAILED */
    }
    /* FileAlignment is the alignment factor (in bytes) that is used to align
@ -926,7 +926,7 @@ static u_char *pe_page_hash_calc(int *rphlen, FILE_FORMAT_CTX *ctx, int phtype)
     * of 2 between 512 and 64 K, inclusive. The default is 512. */
    alignment = GET_UINT32_LE(ctx->options->indata + ctx->pe_ctx->header_size + 60);
    if (alignment < 512 || alignment > UINT16_MAX) {
-        printf("Corrupted file alignment factor: 0x%08X\n", alignment);
+        fprintf(stderr, "Corrupted file alignment factor: 0x%08X\n", alignment);
        return NULL; /* FAILED */
    }
    /* SectionAlignment is the alignment (in bytes) of sections when they are
@ -936,14 +936,14 @@ static u_char *pe_page_hash_calc(int *rphlen, FILE_FORMAT_CTX *ctx, int phtype)
     * https://devblogs.microsoft.com/oldnewthing/20210510-00/?p=105200 */
    pagesize = GET_UINT32_LE(ctx->options->indata + ctx->pe_ctx->header_size + 56);
    if (pagesize == 0 || pagesize < alignment || pagesize > 4194304) {
-        printf("Corrupted page size: 0x%08X\n", pagesize);
+        fprintf(stderr, "Corrupted page size: 0x%08X\n", pagesize);
        return NULL; /* FAILED */
    }
    /* SizeOfHeaders is the combined size of an MS-DOS stub, PE header,
     * and section headers rounded up to a multiple of FileAlignment. */
    hdrsize = GET_UINT32_LE(ctx->options->indata + ctx->pe_ctx->header_size + 84);
    if (hdrsize < ctx->pe_ctx->header_size || hdrsize > UINT32_MAX) {
-        printf("Corrupted headers size: 0x%08X\n", hdrsize);
+        fprintf(stderr, "Corrupted headers size: 0x%08X\n", hdrsize);
        return NULL; /* FAILED */
    }
    /* SizeOfOptionalHeader is the size of the optional header, which is
@ -951,7 +951,7 @@ static u_char *pe_page_hash_calc(int *rphlen, FILE_FORMAT_CTX *ctx, int phtype)
     * and can't be bigger than the file */
    opthdr_size = GET_UINT16_LE(ctx->options->indata + ctx->pe_ctx->header_size + 20);
    if (opthdr_size == 0 || opthdr_size > ctx->pe_ctx->fileend) {
-        printf("Corrupted optional header size: 0x%08X\n", opthdr_size);
+        fprintf(stderr, "Corrupted optional header size: 0x%08X\n", opthdr_size);
        return NULL; /* FAILED */
    }
    pphlen = 4 + EVP_MD_size(md);
@ -959,7 +959,7 @@ static u_char *pe_page_hash_calc(int *rphlen, FILE_FORMAT_CTX *ctx, int phtype)

    bhash = BIO_new(BIO_f_md());
    if (!BIO_set_md(bhash, md)) {
-        printf("Unable to set the message digest of BIO\n");
+        fprintf(stderr, "Unable to set the message digest of BIO\n");
        BIO_free_all(bhash);
        return NULL;  /* FAILED */
    }
@ -1006,7 +1006,7 @@ static u_char *pe_page_hash_calc(int *rphlen, FILE_FORMAT_CTX *ctx, int phtype)
            PUT_UINT32_LE(ro + l, res + pi*pphlen);
            bhash = BIO_new(BIO_f_md());
            if (!BIO_set_md(bhash, md)) {
-                printf("Unable to set the message digest of BIO\n");
+                fprintf(stderr, "Unable to set the message digest of BIO\n");
                BIO_free_all(bhash);
                OPENSSL_free(zeroes);
                OPENSSL_free(res);
@ -1099,7 +1099,7 @@ static SpcLink *pe_page_hash_link_get(FILE_FORMAT_CTX *ctx, int phtype)

    ph = pe_page_hash_calc(&phlen, ctx, phtype);
    if (!ph) {
-        printf("Failed to calculate page hash\n");
+        fprintf(stderr, "Failed to calculate page hash\n");
        return NULL; /* FAILED */
    }
    if (ctx->options->verbose)
@ -1170,20 +1170,20 @@ static int pe_check_file(FILE_FORMAT_CTX *ctx)
    uint32_t real_pe_checksum, sum = 0;

    if (!ctx) {
-        printf("Init error\n\n");
+        fprintf(stderr, "Init error\n");
        return 0; /* FAILED */
    }
    real_pe_checksum = pe_calc_realchecksum(ctx);
    if (ctx->pe_ctx->pe_checksum == real_pe_checksum) {
-        printf("PE checksum   : %08X\n\n", real_pe_checksum);
+        printf("PE checksum   : %08X\n", real_pe_checksum);
    } else {
        printf("Current PE checksum   : %08X\n", ctx->pe_ctx->pe_checksum);
        printf("Calculated PE checksum: %08X\n", real_pe_checksum);
-        printf("Warning: invalid PE checksum\n\n");
+        printf("Warning: invalid PE checksum\n");
    }
    if (ctx->pe_ctx->sigpos == 0 || ctx->pe_ctx->siglen == 0
        || ctx->pe_ctx->sigpos > ctx->pe_ctx->fileend) {
-        printf("No signature found\n\n");
+        fprintf(stderr, "No signature found\n");
        return 0; /* FAILED */
    }
    /*
@ -1193,9 +1193,9 @@ static int pe_check_file(FILE_FORMAT_CTX *ctx)
    while (sum < ctx->pe_ctx->siglen) {
        uint32_t len = GET_UINT32_LE(ctx->options->indata + ctx->pe_ctx->sigpos + sum);
        if (ctx->pe_ctx->siglen - len > 8) {
-            printf("Corrupted attribute certificate table\n");
-            printf("Attribute certificate table size  : %08X\n", ctx->pe_ctx->siglen);
-            printf("Attribute certificate entry length: %08X\n\n", len);
+            fprintf(stderr, "Corrupted attribute certificate table\n");
+            fprintf(stderr, "Attribute certificate table size  : %08X\n", ctx->pe_ctx->siglen);
+            fprintf(stderr, "Attribute certificate entry length: %08X\n\n", len);
            return 0; /* FAILED */
        }
        /* quadword align data */
@ -1203,9 +1203,9 @@ static int pe_check_file(FILE_FORMAT_CTX *ctx)
        sum += len;
    }
    if (sum != ctx->pe_ctx->siglen) {
-        printf("Corrupted attribute certificate table\n");
-        printf("Attribute certificate table size  : %08X\n", ctx->pe_ctx->siglen);
-        printf("Sum of the rounded dwLength values: %08X\n\n", sum);
+        fprintf(stderr, "Corrupted attribute certificate table\n");
+        fprintf(stderr, "Attribute certificate table size  : %08X\n", ctx->pe_ctx->siglen);
+        fprintf(stderr, "Sum of the rounded dwLength values: %08X\n\n", sum);
        return 0; /* FAILED */
    }
    return 1; /* OK */
--- a/script.c
+++ b/script.c
@ -243,7 +243,7 @@ static u_char *script_digest_calc(FILE_FORMAT_CTX *ctx, const EVP_MD *md)
    BIO *hash = BIO_new(BIO_f_md());

    if (!BIO_set_md(hash, md)) {
-        printf("Unable to set the message digest of BIO\n");
+        fprintf(stderr, "Unable to set the message digest of BIO\n");
        BIO_free_all(hash);
        return NULL; /* FAILED */
    }
@ -286,7 +286,7 @@ static int script_verify_digests(FILE_FORMAT_CTX *ctx, PKCS7 *p7)
        }
    }
    if (mdtype == -1) {
-        printf("Failed to extract current message digest\n\n");
+        fprintf(stderr, "Failed to extract current message digest\n\n");
        return 0; /* FAILED */
    }
    md = EVP_get_digestbynid(mdtype);
@ -299,7 +299,7 @@ static int script_verify_digests(FILE_FORMAT_CTX *ctx, PKCS7 *p7)
    BIO_free_all(bhash);

    if (!compare_digests(mdbuf, cmdbuf, mdtype)) {
-        printf("Signature verification: failed\n\n");
+        fprintf(stderr, "Signature verification: failed\n\n");
        OPENSSL_free(cmdbuf);
        return 0; /* FAILED */
    }
@ -316,12 +316,10 @@ static PKCS7 *script_pkcs7_extract(FILE_FORMAT_CTX *ctx)
 {
    const char *signature_data = ctx->options->indata + ctx->script_ctx->sigpos;
    size_t signature_len = ctx->script_ctx->fileend - ctx->script_ctx->sigpos;
-    size_t base64_len, der_max_length, der_length;
+    size_t base64_len;
    char *ptr;
    BIO *bio_mem, *bio_b64 = NULL;
    char *base64_data = NULL;
-    char *der_data = NULL;
-    const char *der_tmp;
    char *clean_base64 = NULL;
    int clean_base64_len = 0;
    const char *open_tag = ctx->script_ctx->comment_text->open;
@ -348,7 +346,7 @@ static PKCS7 *script_pkcs7_extract(FILE_FORMAT_CTX *ctx)
    /* allocate memory for cleaned Base64 */
    clean_base64 = OPENSSL_malloc(base64_len);
    if (!clean_base64) {
-        printf("Malloc failed\n");
+        fprintf(stderr, "Malloc failed\n");
        goto cleanup;
    }

@ -357,7 +355,7 @@ static PKCS7 *script_pkcs7_extract(FILE_FORMAT_CTX *ctx)
        /* find the opening tag */
        for(;;) {
            if (ptr + open_tag_len >= base64_data + base64_len) {
-                printf("Signature line too long\n");
+                fprintf(stderr, "Signature line too long\n");
                goto cleanup;
            }
            if (!memcmp(ptr, open_tag, (size_t)open_tag_len)) {
@ -377,7 +375,7 @@ static PKCS7 *script_pkcs7_extract(FILE_FORMAT_CTX *ctx)
        /* copy until the closing tag */
        for(;;) {
            if (ptr + close_tag_len >= base64_data + base64_len) {
-                printf("Signature line too long\n");
+                fprintf(stderr, "Signature line too long\n");
                goto cleanup;
            }
            if (close_tag_len) {
@ -403,26 +401,12 @@ static PKCS7 *script_pkcs7_extract(FILE_FORMAT_CTX *ctx)
    BIO_push(bio_b64, bio_mem);
    BIO_set_flags(bio_b64, BIO_FLAGS_BASE64_NO_NL);

-    /* allocate memory for DER output */
-    der_max_length = BIO_ctrl_pending(bio_b64);
-    der_data = OPENSSL_malloc(der_max_length);
-    if (!der_data)
-        goto cleanup;
-
-    /* decode Base64 to DER */
-    if (!BIO_read_ex(bio_b64, der_data, der_max_length, &der_length))
-        goto cleanup;
-    if (der_length <= 0)
-        goto cleanup;
-
    /* decode DER */
-    der_tmp = der_data;
-    retval = d2i_PKCS7(NULL, (const unsigned char **)&der_tmp, (int)der_length);
+    retval = d2i_PKCS7_bio(bio_b64, NULL);

 cleanup:
    OPENSSL_free(base64_data);
    OPENSSL_free(clean_base64);
-    OPENSSL_free(der_data);
    BIO_free_all(bio_b64);
    return retval;
 }
@ -471,10 +455,10 @@ static int script_process_data(FILE_FORMAT_CTX *ctx, BIO *hash, BIO *outdata)
        ctx->script_ctx->fileend = ctx->script_ctx->sigpos;
    }
    if (!script_write_bio(outdata, ctx->options->indata, ctx->script_ctx->fileend))
-        return 1; /* FAILED */
+        return 0; /* FAILED */
    if (!script_digest_convert(hash, ctx, ctx->script_ctx->fileend))
-        return 1; /* FAILED */
-    return 0; /* OK */
+        return 0; /* FAILED */
+    return 1; /* OK */
 }

 /*
@ -489,21 +473,21 @@ static PKCS7 *script_pkcs7_signature_new(FILE_FORMAT_CTX *ctx, BIO *hash)
    PKCS7 *p7 = pkcs7_create(ctx);

    if (!p7) {
-        printf("Creating a new signature failed\n");
+        fprintf(stderr, "Creating a new signature failed\n");
        return NULL; /* FAILED */
    }
    if (!add_indirect_data_object(p7)) {
-        printf("Adding SPC_INDIRECT_DATA_OBJID failed\n");
+        fprintf(stderr, "Adding SPC_INDIRECT_DATA_OBJID failed\n");
        PKCS7_free(p7);
        return NULL; /* FAILED */
    }
    content = spc_indirect_data_content_get(hash, ctx);
    if (!content) {
-        printf("Failed to get spcIndirectDataContent\n");
+        fprintf(stderr, "Failed to get spcIndirectDataContent\n");
        return NULL; /* FAILED */
    }
    if (!sign_spc_indirect_data_content(p7, content)) {
-        printf("Failed to set signed content\n");
+        fprintf(stderr, "Failed to set signed content\n");
        PKCS7_free(p7);
        ASN1_OCTET_STRING_free(content);
        return NULL; /* FAILED */
@ -800,13 +784,13 @@ static BIO *script_digest_calc_bio(FILE_FORMAT_CTX *ctx, const EVP_MD *md)
        fileend = ctx->script_ctx->fileend;

    if (!BIO_set_md(hash, md)) {
-        printf("Unable to set the message digest of BIO\n");
+        fprintf(stderr, "Unable to set the message digest of BIO\n");
        BIO_free_all(hash);
        return NULL; /* FAILED */
    }
    BIO_push(hash, BIO_new(BIO_s_null()));
    if (!script_digest_convert(hash, ctx, fileend)) {
-        printf("Unable calc a message digest value\n");
+        fprintf(stderr, "Unable calc a message digest value\n");
        BIO_free_all(hash);
        return NULL; /* FAILED */
    }
@ -868,12 +852,12 @@ static int script_write_bio(BIO *bio, char *indata, size_t len)
 static int script_check_file(FILE_FORMAT_CTX *ctx)
 {
    if (!ctx) {
-        printf("Init error\n\n");
+        fprintf(stderr, "Init error\n");
        return 0; /* FAILED */
    }
    if (ctx->script_ctx->sigpos == 0
        || ctx->script_ctx->sigpos > ctx->script_ctx->fileend) {
-        printf("No signature found\n\n");
+        fprintf(stderr, "No signature found\n");
        return 0; /* FAILED */
    }

--- a/tests/.gitignore
+++ b/tests/.gitignore
@ -0,0 +1,2 @@
+__pycache__
+.pylintrc
--- a/tests/certs/CACert.pem
+++ b/tests/certs/CACert.pem
@ -1,22 +0,0 @@
-----BEGIN CERTIFICATE-----
-MIIDoTCCAomgAwIBAgIUVD6Q+gnrOmJWbEnmfydpUg2JNmswDQYJKoZIhvcNAQEL
-BQAwWDELMAkGA1UEBhMCUEwxFTATBgNVBAoMDG9zc2xzaWduY29kZTEgMB4GA1UE
-CwwXQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxEDAOBgNVBAMMB1Jvb3QgQ0EwHhcN
-MTcwMTAxMDAwMDAwWhcNMzYxMjI3MDAwMDAwWjBYMQswCQYDVQQGEwJQTDEVMBMG
-A1UECgwMb3NzbHNpZ25jb2RlMSAwHgYDVQQLDBdDZXJ0aWZpY2F0aW9uIEF1dGhv
-cml0eTEQMA4GA1UEAwwHUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC
-AQoCggEBAMUvCAWI9LrgtVw9RARZLFb/qB1868H86eyr8oITzXl6u9FSQwvGH1MG
-szRhuD9TJAjy1uIiVPJ7ez2VjKXm2G9lUZMPJQRt50XTGbsGGDi4ITU1W3P+HI5u
-45I0IL14Qv/R8X26lndBzlY4ImoCTAN4KzdfvoGLaMpNvbC1P7a4mlukrumi3WKT
-RAq46Mj5DAqr63NOolWimtTB+h0ZWv+xxngR7cfo+EimvhPB7y3xhY9OJ/27l6mJ
-uQJohz5PmzhZByluMhicTsd2cJEKQb7jnih492okCj6vH/FJmKg+DzXKTyue5Ki4
-2jhzM9v1npyIkd7s/gnZVEsHH6oQIt8CAwEAAaNjMGEwDwYDVR0TAQH/BAUwAwEB
-/zAdBgNVHQ4EFgQUGjxG/vql0oJgItr7HsLaW+koiMgwHwYDVR0jBBgwFoAUGjxG
-/vql0oJgItr7HsLaW+koiMgwDgYDVR0PAQH/BAQDAgGGMA0GCSqGSIb3DQEBCwUA
-A4IBAQAy7AKbO8B8Njseqjy2LAj2sKHCLc1jsQa7izOAtr852NYFAfpBvkqQfxne
-8k5iPKmcJE+Sm4wv3V/lzx2AHEXAPa7BgiAo7yeo9UbrDgRRGw4MirQ/djp44ekv
-KCc54bSE/paUZyEWKr8NbdBy7SZfZ/Dd+XUY2lbm3Mue3AzWl4xp4StoT6oaw6VI
-H6bIhZupond/RWp4jmHHEfvl4T6YLzl5FC+Ec2xBbpk5vAVZgyfrlv+W6V/il/X9
-KTZl5ax4FJAm7vPn6fsgdAM5y24zJUAkeakKFsBYtoVoGg1iiFuMEGwFRn7EZYl1
-8D16qEH+YPLCzujH1PhzjmmAfKl2
-----END CERTIFICATE-----
--- a/tests/certs/CACertCRL.der
+++ b/tests/certs/CACertCRL.der
--- a/tests/certs/CACertCRL.pem
+++ b/tests/certs/CACertCRL.pem
@ -1,13 +0,0 @@
-----BEGIN X509 CRL-----
-MIICBDCB7QIBATANBgkqhkiG9w0BAQsFADBgMQswCQYDVQQGEwJQTDEVMBMGA1UE
-CgwMb3NzbHNpZ25jb2RlMSAwHgYDVQQLDBdDZXJ0aWZpY2F0aW9uIEF1dGhvcml0
-eTEYMBYGA1UEAwwPSW50ZXJtZWRpYXRlIENBFw0xOTAxMDEwMDAwMDBaFw00MzAx
-MDEwMDAwMDBaMCcwJQIUazbrVgbYb+IN803UmJJa0DPHQsAXDTI0MDIyNzE1MzAx
-NFqgMDAuMB8GA1UdIwQYMBaAFGQQ8as5N9zB/bsdyD9BWHdiJ+8pMAsGA1UdFAQE
-AgIQATANBgkqhkiG9w0BAQsFAAOCAQEAV+Ce8WaNN/PXbVT9rOy/TS2EDrM/oFPG
-vwZr2IQDcBtgFV5DpNZRKJo2m4mjPPt1eCjE404U2r6081bvq3PtwSPwezV+uCzF
-dDUafeR0eZhmzxD8M2Jmi5hGp3fQevDrA4+RR33DneYSNfzGx35VN8v/L7/TuA5X
-0PG8b5hL9f3vsVXvFRj6hMkRy5m+gxFfWW/Uw3fXIt9sDLJ+eAKURdqn1c3CEwD6
-bzh0s6dSXT4wp5/l96x8fKAv5hMqDC7KufvwjhhSXdYXDOHDQcv0g5aLo8Ug8dHg
-NJHqbTAAViyGfvsS9/pYb8kHpAWvaADK84tzaMzj7uCDXlCZEjIr7w==
-----END X509 CRL-----
--- a/tests/certs/CACertCRL_crldp.pem
+++ b/tests/certs/CACertCRL_crldp.pem
@ -1,14 +0,0 @@
-----BEGIN X509 CRL-----
-MIICMzCCARsCAQEwDQYJKoZIhvcNAQELBQAwZzELMAkGA1UEBhMCUEwxFTATBgNV
-BAoMDG9zc2xzaWduY29kZTEgMB4GA1UECwwXQ2VydGlmaWNhdGlvbiBBdXRob3Jp
-dHkxHzAdBgNVBAMMFkludGVybWVkaWF0ZSBDQSBDUkwgRFAXDTE5MDEwMTAwMDAw
-MFoXDTQzMDEwMTAwMDAwMFowTjAlAhQcZvYIe2b1FreAKfoi/uGkSGJCthcNMjQw
-MjI3MTUzMDE0WjAlAhRrNutWBthv4g3zTdSYklrQM8dCwBcNMjQwMjI3MTUzMDE0
-WqAwMC4wHwYDVR0jBBgwFoAUFDxiqeJxiJbmZ4erKH0pBIhq7SMwCwYDVR0UBAQC
-AhACMA0GCSqGSIb3DQEBCwUAA4IBAQBZzGXEP4XdKuJ8ANIBGPu1Z+7T+4ln+nu3
-MEPC9BexVAA02YPZx6i4c3cHC87aOL7zsr/K9OeF5MAYzi2QJwsenF4b9QL2rzQV
-sCAb3sY5ImAxN38GTJ+oI+uTeOefNE0wS7pP4phRmYNZwyDhxA2iT76+luoygyth
-NesiGalMFDrJvUM1DADTZGQrz9cQVgFq9WTcta9rdTYqSNctxkbpQaY0hgssH1Sh
-hWlSiFttciA2XVD7Ju/Qv9zN4nCQC0LskgKhqsefsOukpo6jqJ92OmNrrNaERfqs
-Yavzuj6DlcnE46ZxA0y2Du1apz0WDlbcAnsEqfNSDDCid09v+V9a
-----END X509 CRL-----
--- a/tests/certs/CAcross.pem
+++ b/tests/certs/CAcross.pem
@ -1,22 +0,0 @@
-----BEGIN CERTIFICATE-----
-MIIDqTCCApGgAwIBAgIUKFKqG3FwQAmy4HgYyO4mGEiQ8QAwDQYJKoZIhvcNAQEL
-BQAwYDELMAkGA1UEBhMCUEwxFTATBgNVBAoMDG9zc2xzaWduY29kZTEgMB4GA1UE
-CwwXQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxGDAWBgNVBAMMD1RydXN0ZWQgUm9v
-dCBDQTAeFw0xODAxMDEwMDAwMDBaFw0zNzEyMjcwMDAwMDBaMFgxCzAJBgNVBAYT
-AlBMMRUwEwYDVQQKDAxvc3Nsc2lnbmNvZGUxIDAeBgNVBAsMF0NlcnRpZmljYXRp
-b24gQXV0aG9yaXR5MRAwDgYDVQQDDAdSb290IENBMIIBIjANBgkqhkiG9w0BAQEF
-AAOCAQ8AMIIBCgKCAQEAxS8IBYj0uuC1XD1EBFksVv+oHXzrwfzp7KvyghPNeXq7
-0VJDC8YfUwazNGG4P1MkCPLW4iJU8nt7PZWMpebYb2VRkw8lBG3nRdMZuwYYOLgh
-NTVbc/4cjm7jkjQgvXhC/9HxfbqWd0HOVjgiagJMA3grN1++gYtoyk29sLU/tria
-W6Su6aLdYpNECrjoyPkMCqvrc06iVaKa1MH6HRla/7HGeBHtx+j4SKa+E8HvLfGF
-j04n/buXqYm5AmiHPk+bOFkHKW4yGJxOx3ZwkQpBvuOeKHj3aiQKPq8f8UmYqD4P
-NcpPK57kqLjaOHMz2/WenIiR3uz+CdlUSwcfqhAi3wIDAQABo2MwYTAPBgNVHRMB
-Af8EBTADAQH/MB0GA1UdDgQWBBQaPEb++qXSgmAi2vsewtpb6SiIyDAfBgNVHSME
-GDAWgBSzLyt07qrH3+rgkQCvS/YZ3jR+fzAOBgNVHQ8BAf8EBAMCAYYwDQYJKoZI
-hvcNAQELBQADggEBADCY4hadNyzoz0CpdpBcFjyglxOkgcitIAgvoc2N5zwHrkg7
-BgJM1BJmCyki0AhXRKwl7sYbzNHgAhP1pBNjZqO13+cRcqPKvrxpYnsv11HaPS2E
-Ee/8EwHB3JlWlmWd6PHaJV0usRjDOuJnV/I/9mdFfIUcY0aoA36o2CCRJRKcvvVp
-Ztomnvw8IqFTn3GCNK3TRmVf2RYMhsDNQoEEidJENwCCRlcojmk1Ld95T89QsGOR
-cWJAHzyfbMQxRD7kQPZ4B2M8MvU3uD6nsamzvVM7H0UkSNuYLVkpU/wTUR8eQ2LI
-wFyi9JhKP4hF/RBuSzIHpXWO46GvzAO5dXZPLm0=
-----END CERTIFICATE-----
--- a/tests/certs/CAroot.pem
+++ b/tests/certs/CAroot.pem
@ -1,22 +0,0 @@
-----BEGIN CERTIFICATE-----
-MIIDsTCCApmgAwIBAgIUQQOniemvgowXmc2hZSZoIWEF8DUwDQYJKoZIhvcNAQEL
-BQAwYDELMAkGA1UEBhMCUEwxFTATBgNVBAoMDG9zc2xzaWduY29kZTEgMB4GA1UE
-CwwXQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxGDAWBgNVBAMMD1RydXN0ZWQgUm9v
-dCBDQTAeFw0xNzAxMDEwMDAwMDBaFw0zNjEyMjcwMDAwMDBaMGAxCzAJBgNVBAYT
-AlBMMRUwEwYDVQQKDAxvc3Nsc2lnbmNvZGUxIDAeBgNVBAsMF0NlcnRpZmljYXRp
-b24gQXV0aG9yaXR5MRgwFgYDVQQDDA9UcnVzdGVkIFJvb3QgQ0EwggEiMA0GCSqG
-SIb3DQEBAQUAA4IBDwAwggEKAoIBAQCL2tfObRQcJ4fo/jarNfQVmeqjulYkLLNG
-UtYmFSAxkcYbmpfHpsSxnW9sbDZV8Cp6tFa97V7XATCNL/r671lpZjkYEj0NkjBE
-84OI0pkAEwWC5m3+dl3wehu977OcV7cMxNTmAHJwEadXR3jmZV625/lja1QqgkqK
-MqOty2pJNmsRUEogjFoh00eulnapW5u72ovq9IDgjjhdvAClwkTY5jsLTeDwgvfS
-MRjAmef2qExI/l760Bl0xe4XDdROgN90npS/zuKcCkThtvmffiUZsyeel1kto1pF
-zkYGJroWSJl0Jt+dpJHcpSXOXP5M+LnuLV4nl5vqwksdPzswQvuZAgMBAAGjYzBh
-MA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFLMvK3Tuqsff6uCRAK9L9hneNH5/
-MB8GA1UdIwQYMBaAFLMvK3Tuqsff6uCRAK9L9hneNH5/MA4GA1UdDwEB/wQEAwIB
-hjANBgkqhkiG9w0BAQsFAAOCAQEAesmiOEl8OA+T4DDOgjfhY6+pUZDDKpsx//mj
-/1bxr+akfwL3dN5IBq8g8tJJHOLqrl7Lard7onDRnz8GZmpkPvFa87QD2PU2addo
-DAQWdYsDrNMWkAE37Wk7FZ0RyFHiBopRUMspKmx/XwvJf+rhkidjJYxCo317i/Z8
-fWi//wGsI6ogezOsMCxNEcIn2PltGfDiVFklmwsXhyfvGYfctqepu661a/7hFUaP
-uN0iEboTDcQuiWwwEEwMe55L1rjDlpRkGUBah5FteGmVwk0AoT4b+1FVrj9Q6sEa
-Ge6gsrhu2syUF9CErTW/CiV+jONe2ygw4welOBo598QW71w7Vw==
-----END CERTIFICATE-----
--- a/tests/certs/TSA.key
+++ b/tests/certs/TSA.key
@ -1,28 +0,0 @@
-----BEGIN PRIVATE KEY-----
-MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQCplbeNvGrZmTDz
-p48TyvpOX36bGPMfyTVc8ZfAoh0SG86EFc1LHBV2K52dshHYqniQ6lE14jhsRPps
-YRBUFXO7I84Jd5CVcrvBWGuL8wXxjMwIW5buzY4x5oKowlyQGIasNiC8Mgx8TncJ
-kVWE6ekgoP4i1f4PVsFyG8zVNpI5VzHArAemYhvDjuA5jgTisfP8ph2pxUKTzYAI
-SaKm2YkBFvyhhTxtqnXHt8S0NnfDSCedKSzl1caN1TAKSbWoeChb+Tq8rycjPXh/
-/7TkYgxmlSHiQhRcyEaZs54Ud8Q0nsnfRMhEtewr2IACmuKrFnoS+GtY5glPilR5
-ScZ+7A9TAgMBAAECggEABOI/XIzFYMzeg2Rg8DAquQlyc92NE5zPtW0/WxhhizdT
-bPF3EISXh9DdMimCBeH8XxIzWFfSeFaoNFHp1GCf9ckYRuptk8ppz3OKVhOIbxqr
-YNY9UVVCrEFmjJ0Vxj7Be5M9TTEU4mxLVX4FtmDVClubeOxyX/oqcr4uwme0Az6A
-tjBVzl+YEYvZrbhao5d09LVQ3zj1T1EQ+XU5iTTV5Two86FQ6NQ9txe7jxcB8x8S
-BbD/PakmZj+oIdVBp4xnrhCJ3mYdzXy3qHWxq/BtHgS5fY3/tq3xtVSNxw7QJG7j
-CT2Cps3/99Lq2CPi8OkQKgjJwWqCZ0jOwHahEMlWIQKBgQDneq4LH0zfPJIW2zsi
-C7U813hV4NuQXd5EW2bmNe4KKnlrcbt3ZtJv8v3Ff5lMm1i8jDCeaeGhZOi/Ag/z
-aTtM1STFFEQg3QktcSAvS7hXufvAeufSrPOZdpBO51wqZl5wLMp2lsq885R3wnRl
-FtIErdmsLigVMC8RZ++gFNIjMQKBgQC7jJE93wV3j36QA7NAgxNH0AW5p5foWuA8
-gR8MA9cpFI7X7q6hW9HYXw30kD3IzN6UW4U5LT4Pandxx484G1KENcyW2TzeGtpC
-MWBWHF4Mbxb/2pEkQoPk1dZmUxF5hvaGGHQYJn/pnJFavGUoNBlNjaIfgStzd1IO
-68ceo5URwwKBgGjHJjrQmzo9L5968sRRamM04Tp2QsyRQMfOW8B+ztX5LebNn17H
-wx97bRVV0a1UcBFAn81E/iXRCG1VYKT8kCQSIse2ibQaeUoBd+EQtEu5WtRgjcjW
-Epn3ihC9NwHWPo8mJysQzIpE84JWGducPcpyayI97lTQ761AT741Tn0xAoGARtG2
-ioFrhBEoPmNXTZXxMt3HO6qgPvoJ0G8FdTkCBx4fLkSPppiQbb6++0l4Oxm5NpY0
-gTmnRJT0U3+CgjI2/3t9LL0NMeU742DXusxtaw6LxcMXqXSAb2mb0vmtEJG5Bzu2
-ouPuyxz2+idHn13E7Db+MB1Ldgdpcf7wKo6knJcCgYBwbcjW0MwCah3w4N4VLXBX
-Q5wPSw7cRcytHqrrWkT/nTI3fxwd7UW6ZdM0IwGIAwYgBYD5B78KH0aP6BlUmYWu
-8vut6S/MsNyCzHQVbcR9BUK3drByzhysVE3TUQKjCA33v6M/tTixhpyPf+ZZtjlK
-b1+6D1aGpwt+11f9ubd+Nw==
-----END PRIVATE KEY-----
--- a/tests/certs/TSA.pem
+++ b/tests/certs/TSA.pem
@ -1,25 +0,0 @@
-----BEGIN CERTIFICATE-----
-MIIEMzCCAxugAwIBAgIUAQ9lOMiuXUZuKaxzEpwQmCzU7aowDQYJKoZIhvcNAQEL
-BQAwYDELMAkGA1UEBhMCUEwxFTATBgNVBAoMDG9zc2xzaWduY29kZTEkMCIGA1UE
-CwwbVGltZXN0YW1wIEF1dGhvcml0eSBSb290IENBMRQwEgYDVQQDDAtUU0EgUm9v
-dCBDQTAeFw0xODAxMDEwMDAwMDBaFw0zODAxMDEwMDAwMDBaMFUxCzAJBgNVBAYT
-AlBMMRUwEwYDVQQKDAxvc3Nsc2lnbmNvZGUxHDAaBgNVBAsME1RpbWVzdGFtcCBB
-dXRob3JpdHkxETAPBgNVBAMMCFRlc3QgVFNBMIIBIjANBgkqhkiG9w0BAQEFAAOC
-AQ8AMIIBCgKCAQEAqZW3jbxq2Zkw86ePE8r6Tl9+mxjzH8k1XPGXwKIdEhvOhBXN
-SxwVdiudnbIR2Kp4kOpRNeI4bET6bGEQVBVzuyPOCXeQlXK7wVhri/MF8YzMCFuW
-7s2OMeaCqMJckBiGrDYgvDIMfE53CZFVhOnpIKD+ItX+D1bBchvM1TaSOVcxwKwH
-pmIbw47gOY4E4rHz/KYdqcVCk82ACEmiptmJARb8oYU8bap1x7fEtDZ3w0gnnSks
-5dXGjdUwCkm1qHgoW/k6vK8nIz14f/+05GIMZpUh4kIUXMhGmbOeFHfENJ7J30TI
-RLXsK9iAApriqxZ6EvhrWOYJT4pUeUnGfuwPUwIDAQABo4HvMIHsMAwGA1UdEwEB
-/wQCMAAwFgYDVR0lAQH/BAwwCgYIKwYBBQUHAwgwHQYDVR0OBBYEFKryJiH4Y0KO
-x2nCc4cOvih1VzjmMB8GA1UdIwQYMBaAFD8ujz0I9Y7079ZMe9X7cO3/rSj5MC0G
-A1UdHwQmMCQwIqAgoB6GHGh0dHA6Ly8xMjcuMC4wLjE6MTkyNTQvVFNBQ0EwVQYD
-VR0eBE4wTKAYMAqCCHRlc3QuY29tMAqCCHRlc3Qub3JnoTAwCocIAAAAAAAAAAAw
-IocgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwDQYJKoZIhvcNAQEL
-BQADggEBAAhzijhC1kvBV75rxRqj27gtYRG8dNkHc5umzwXyNNMn2tI/kO2Rf+ES
-9RamQE9sfvOgg3UqfXIfRPsC4cBHnjT+ELdqbt4byk3LPtstJGFuLy0iNRNY9f1j
-lBJrldLZNNsIpNMQa0u5h/z4m0CAA8j6ayUvcoR11y2zYHkHlSScTq/s7gSQzXlK
-z4DRiiYif2OEdKVeRCqlDV8AOlhm1+9am74dkfO71aT0G2hko2u19NWZvjc/DqI1
-V+e2g5TDE7V65d9vvf9tA26i0At/VazvnhsgdpgUkwS6mjUvx+gW3i5YJhtXjdAX
-hpE0ajpKT0x/dNa/qCwl/9zc8XxGnPk=
-----END CERTIFICATE-----
--- a/tests/certs/TSACA.pem
+++ b/tests/certs/TSACA.pem
@ -1,22 +0,0 @@
-----BEGIN CERTIFICATE-----
-MIIDkDCCAnigAwIBAgIULFuB5HWsyba6VHu2Ygv2vt4R4/swDQYJKoZIhvcNAQEL
-BQAwYDELMAkGA1UEBhMCUEwxFTATBgNVBAoMDG9zc2xzaWduY29kZTEkMCIGA1UE
-CwwbVGltZXN0YW1wIEF1dGhvcml0eSBSb290IENBMRQwEgYDVQQDDAtUU0EgUm9v
-dCBDQTAeFw0xNzAxMDEwMDAwMDBaFw0zNjEyMjcwMDAwMDBaMGAxCzAJBgNVBAYT
-AlBMMRUwEwYDVQQKDAxvc3Nsc2lnbmNvZGUxJDAiBgNVBAsMG1RpbWVzdGFtcCBB
-dXRob3JpdHkgUm9vdCBDQTEUMBIGA1UEAwwLVFNBIFJvb3QgQ0EwggEiMA0GCSqG
-SIb3DQEBAQUAA4IBDwAwggEKAoIBAQDBo8JJDwVm6UTZvA2g/tOZ3xIbKYXI92Rn
-T/FCCUycsB5tmoSWcmy1AB6UDv7bFMGy4mdbxnErtdytGj+hEIO3O2EBbpBLAmlJ
-CEVNRrz/YbxGoJmeAii9s3jignUpTr/qLMSKkLowuqABZl2XtCp7Q83YlZPkVhFL
-kCAny89cG/QGAUxViN7HB4jWzhcBTTfD4PFvSU1HZNhPM0Y6BCpv2qrof3/tPnQr
-xM2zVZoIonQpf6paga61O9fM4wc1GqxGGwARz6Bxq6w2OxRDsV/biqP9gVUj0XmF
-6o/draf3MkDswOUZyKpujOUIf12ezXJFPWaCRN1Rl0vwV2CyVxkvAgMBAAGjQjBA
-MA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFD8ujz0I9Y7079ZMe9X7cO3/rSj5
-MA4GA1UdDwEB/wQEAwIBBjANBgkqhkiG9w0BAQsFAAOCAQEAtHmPfVgu6Y7uWcpq
-AdawOTZ/2ICOvAMmQ0LcXKmSpgsneHiyAL1Wwe2/XxTwmrpHylOapIIuV3irHCXU
-CxaTMUyZGfXoUWsxnR8bcb5ac/aFKkC3ynE2/IfFyJOQ724cK5FRK1+piVleP4Rx
-C04KQiuxuVLedyvGh5OPU/94ZW2JuuBjImVAO/lUbYhAUSpwueX2lYKSSPLkPfDx
-AsIp55x70iQ+EsgARvseVY2JRzvRnuh66V4P15wn3dIzjtWQ1/t007wMk5Lji5dQ
-iSvdyqULBytBqDtLPLzRuma1KJEPRIamF1j6Or6HaHSVUorRhqI3XuxEUGdO4LxZ
-QepMyA==
-----END CERTIFICATE-----
--- a/tests/certs/TSACertCRL.der
+++ b/tests/certs/TSACertCRL.der
--- a/tests/certs/TSACertCRL.pem
+++ b/tests/certs/TSACertCRL.pem
@ -1,15 +0,0 @@
-----BEGIN X509 CRL-----
-MIICUzCCATsCAQEwDQYJKoZIhvcNAQELBQAwYDELMAkGA1UEBhMCUEwxFTATBgNV
-BAoMDG9zc2xzaWduY29kZTEkMCIGA1UECwwbVGltZXN0YW1wIEF1dGhvcml0eSBS
-b290IENBMRQwEgYDVQQDDAtUU0EgUm9vdCBDQRcNMTkwMTAxMDAwMDAwWhcNNDMw
-MTAxMDAwMDAwWjB1MCUCFA5lCWy+o133yMUTfqtWmkigL1MeFw0yNDAyMjcxNTMw
-MTVaMCUCFBxm9gh7ZvUWt4Ap+iL+4aRIYkK2Fw0yNDAyMjcxNTMwMTRaMCUCFGs2
-61YG2G/iDfNN1JiSWtAzx0LAFw0yNDAyMjcxNTMwMTRaoDAwLjAfBgNVHSMEGDAW
-gBQ/Lo89CPWO9O/WTHvV+3Dt/60o+TALBgNVHRQEBAICEAMwDQYJKoZIhvcNAQEL
-BQADggEBAJ1HK2LepVJyOfqbODFxD6GJo5jr1HEnoaZ1h/iJTZZyDYfRf8d8Y/VG
-Iva00gj2KVy8tOlO0FrUR1Tqk42IjaPld0lXqKl4hkmCUWLpLgual5JcQPHhDUnT
-hiIDvbI5UHGCWeN+unXFRuT9CvtAM+3FOhuL9bBnXwdlOxZPWL8wnYT0jB/HzdKP
-KOWfN7eEXo6tTL8XxRJ5LxjwbrK1eZCdQqL2Rt2W8JTMweeqv9PkNqzYeDAvKc0s
-UCkKj+aNxQlNPy+Tw/MckJK1NE921b8LwuV0uzBrOg0Gr62RnnPGa6Z5YLArczWo
-aZlLVsJuQrOxxyXe/kygCu9lqjaf4CI=
-----END X509 CRL-----
--- a/tests/certs/TSA_revoked.key
+++ b/tests/certs/TSA_revoked.key
@ -1,28 +0,0 @@
-----BEGIN PRIVATE KEY-----
-MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDxU8lwCceWEesm
-HIQu9M8mIznHFWmxFF55E16DseWr1K2FbOKnNv1ddNhUHFhBQChcGPn/CvwfOMR7
-DbCETrty9HUtoK3fCVZQuYIjZwRLZZB2ryLgO4PK+j07Z61yABi7NKBKv8oHISLU
-QcNg7rBAZhmAurKpNu2Gpz/jFpFXwd6O+8xnsYFLT0zyjrq0rEvLmWQd5FBQaVt7
-P+U9GH3GCg0kmdhIXAfdfSnqzj0OMnnzVdnEYrd1mYx+ZA7m0CmVJw330QXWiyax
-wimNHUvlpIiZA8ol17tAybinhPL5nSM/LRZ2PN90EgyX1bv3x/cKCEiOYPSZ7xXV
-mrRGjCtjAgMBAAECggEAHj01fIh9LdzI7lmcZpXebxTy5HNWbw3yWJGIwk/ES6e2
-poViUTmevdsqUD/M/0AezouCp+akePUQCatJdwq2ikz/cdw0bUIqQqs8F1uNOjVb
-yMNhR1+tv/1jNtJi9Wn1r1+ExlkJ46LPTnF/HeJKy4b/oxXB1VpAoSLL6pSlWa1+
-+iEWM+s6xlxyFkeWPq3L3u1QGkuW58KqQae86mR8Mgc0kOVuTCqWpHgNjfxt7tnt
-L/oBE9zEJmS3iZcGh1X5VR4CUQmtrCp7ldNdhSNk5WcNCNSsuIX+B13s658a0sRB
-AnPIX08moB5VHZ/danblny5Zo6SrobWBBcTabwjnYQKBgQD/BHktS70tQj3yBqVL
-xXmaO5ozqMLqF9A2o4EiJ/pF07ecHXmbiGaP9Nf/FJemuU5OHjw8akuxKn2M+DTu
-gHYOHwByA9/SOeAiD8bp/dJNE+2BO2zygoG/adhEV5tLK8IYdz241t8oVZbQLwql
-ZCs1uFab6E/cZEJgSQ0QuC8vtwKBgQDyQc+MX56UFFCP1QpWLIwFVdoPbOj/3cVZ
-FIjQO9rNYNIscS36nISIBh0voubI2xFvO7/s+WS1pD1bOmn6qwsndewFGdmMtjnN
-YguakmHAUmcF33f+gXVzwR91QvGPTjI2Fzd59OwOrZofO1+hajQiBKIP2B9VHJNP
-khspe44JtQKBgFqTTyrMZNOnXHMS8zC3Ydpq4vkILrqQXK6bYiksg9K7QNKdEW0x
-hCQLNZBu0vIvjOVoDcLzihDR46fnHH29eLDJSBI22A9F6RqP+flv4nrn4gptfeOg
-gM7onByh9RE86IJiD7UP9FDSHW+x1Zkqu8Inx/M2Du9bWMv0BkTy9id/AoGBAOEy
-oDcDZCyPPdyW1AcLXhZPmmegfG/tvlhyqEO6gElO6dF6XJ2NBf5UgKkZq6OnUWuv
-hVhK9X2M8aRuhroIalQCYKbVQtB1TQJJVDQaQ1g+wZpKBAfIXGCAdDfTRS5MKIzz
-xBRQw2dZpd3Gmb05NsEwwV4tL+M0rxPW4/0J6B3JAoGAB1vlzPsfKVvV9jwVpfdO
-W2MWAqPF4iI716zLt2F30WNe/42MudQGvMYUEPTYQMu3hhpQk/6UFY2Mfux6+OKk
-zG1khRdlq9BkCczfSVjkUvf4wTUUY5b66i4EpeJ//8OArZEx67LhmW715h/LExzG
-jkdwUMLiaSrpf8KSTL3NxM0=
-----END PRIVATE KEY-----
--- a/tests/certs/TSA_revoked.pem
+++ b/tests/certs/TSA_revoked.pem
@ -1,25 +0,0 @@
-----BEGIN CERTIFICATE-----
-MIIEIjCCAwqgAwIBAgIUDmUJbL6jXffIxRN+q1aaSKAvUx4wDQYJKoZIhvcNAQEL
-BQAwYDELMAkGA1UEBhMCUEwxFTATBgNVBAoMDG9zc2xzaWduY29kZTEkMCIGA1UE
-CwwbVGltZXN0YW1wIEF1dGhvcml0eSBSb290IENBMRQwEgYDVQQDDAtUU0EgUm9v
-dCBDQTAeFw0xODAxMDEwMDAwMDBaFw0zODAxMDEwMDAwMDBaMEQxCzAJBgNVBAYT
-AlBMMRUwEwYDVQQKDAxvc3Nsc2lnbmNvZGUxDDAKBgNVBAsMA1RTQTEQMA4GA1UE
-AwwHUmV2b2tlZDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAPFTyXAJ
-x5YR6yYchC70zyYjOccVabEUXnkTXoOx5avUrYVs4qc2/V102FQcWEFAKFwY+f8K
-/B84xHsNsIROu3L0dS2grd8JVlC5giNnBEtlkHavIuA7g8r6PTtnrXIAGLs0oEq/
-ygchItRBw2DusEBmGYC6sqk27YanP+MWkVfB3o77zGexgUtPTPKOurSsS8uZZB3k
-UFBpW3s/5T0YfcYKDSSZ2EhcB919KerOPQ4yefNV2cRit3WZjH5kDubQKZUnDffR
-BdaLJrHCKY0dS+WkiJkDyiXXu0DJuKeE8vmdIz8tFnY833QSDJfVu/fH9woISI5g
-9JnvFdWatEaMK2MCAwEAAaOB7zCB7DAMBgNVHRMBAf8EAjAAMBYGA1UdJQEB/wQM
-MAoGCCsGAQUFBwMIMB0GA1UdDgQWBBTTuQ7LmtwtVydASwFBXd4xUIEh3jAfBgNV
-HSMEGDAWgBQ/Lo89CPWO9O/WTHvV+3Dt/60o+TAtBgNVHR8EJjAkMCKgIKAehhxo
-dHRwOi8vMTI3LjAuMC4xOjE5MjU0L1RTQUNBMFUGA1UdHgROMEygGDAKggh0ZXN0
-LmNvbTAKggh0ZXN0Lm9yZ6EwMAqHCAAAAAAAAAAAMCKHIAAAAAAAAAAAAAAAAAAA
-AAAAAAAAAAAAAAAAAAAAAAAAMA0GCSqGSIb3DQEBCwUAA4IBAQBMiBltqGRRLmK9
-0RymCJ4oxmX2jwZ4SM7fem39Ozei7NIQIw5nlkPJ7ZWyfQQNFMIujfwJJGzDguax
-mMJHWngzbKjkbdSHnQswxT79RRwenlIKkExck6p2OUT82nGu/6TBIYutMJlITwKF
-5OEmu+WneCvTkvEs0wussIug7E7dV6jJO9/TbwWyrtqU/t9GNRbu/4FIdQ9p9pK9
-BcqaPmjn7IqnLs94THFfMFH0HVkqpLOfa9Wa8uc/C7WyIMTkchXb4U7/8B/hsDj7
-BfKwN/F+IMNw4Rfqytk2JSWuV4pr7MiBweLKBwGgt4DhvfZj32Y/WFNANxtYkE9e
-55mIPqG5
-----END CERTIFICATE-----
--- a/tests/certs/cert.der
+++ b/tests/certs/cert.der
--- a/tests/certs/cert.p12
+++ b/tests/certs/cert.p12
--- a/tests/certs/cert.pem
+++ b/tests/certs/cert.pem
@ -1,46 +0,0 @@
-----BEGIN CERTIFICATE-----
-MIID7jCCAtagAwIBAgIUKiF/FG2pQjlbId3ox+nQHL/tJ4UwDQYJKoZIhvcNAQEL
-BQAwYDELMAkGA1UEBhMCUEwxFTATBgNVBAoMDG9zc2xzaWduY29kZTEgMB4GA1UE
-CwwXQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxGDAWBgNVBAMMD0ludGVybWVkaWF0
-ZSBDQTAeFw0xODAxMDEwMDAwMDBaFw0zNDEyMzEwMDAwMDBaMIGdMQswCQYDVQQG
-EwJQTDEZMBcGA1UECAwQTWF6b3ZpYSBQcm92aW5jZTEPMA0GA1UEBwwGV2Fyc2F3
-MRUwEwYDVQQKDAxvc3Nsc2lnbmNvZGUxDDAKBgNVBAsMA0NTUDEUMBIGA1UEAwwL
-Q2VydGlmaWNhdGUxJzAlBgkqhkiG9w0BCQEWGG9zc2xzaWduY29kZUBleGFtcGxl
-LmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMdBCaytt9xsrUx0
-2Fekq+IrsR2cC1pL9NANN3TbBv8RKt1IefMh8TjA1uPaOYZvz3o2ml9qKGmJ+uxH
-kzLojKbg98bcmxBrkWemLQwmRv1hZIO8D4xiYRd0O0KZizrvwWwlNADzXXWw7iz+
-MPPWkXj2nT5MpOTi3S851SwOc/c9SYCazCP8rMGItKHLO7iCjK3sFwBDI9eaTd2N
-EjqEHadIymHRizeTOaYv34FokQiRgR/zk4flT6+b6DQHxnlbIivV61OP4bBlFtXX
-jC4iGdHLIahhVMlw6ixGqR6910psIp0ST0KM8ly+N+1rPhoNkNSLqkzGUudKo7mV
-t+Cp4EMCAwEAAaNiMGAwCQYDVR0TBAIwADAdBgNVHQ4EFgQU6a4Ta3t0UCTG04bC
-WMCotMPLyWUwHwYDVR0jBBgwFoAUZBDxqzk33MH9ux3IP0FYd2In7ykwEwYDVR0l
-BAwwCgYIKwYBBQUHAwMwDQYJKoZIhvcNAQELBQADggEBAN2Sad4rLRSKWmaRRUCn
-syRO45y7zzvCRApHVSoeBUmtHP+n/OZ3rJTixfluqiGFAqbaXgTN8IantyfqoTjV
-XgCP1qzSM3staLCkeAiZ0/OLW+hyHopP8aXX2ez/hMojB/J1b457+vkuudnNiLx8
-by44nonUnJb3zyxmCSxcBklNP1wlxYjbbq5hFJ/et2/Y5Ct6igYAEMsYZUEUq3e7
-g2GWbqNN/i2tnJyGjDPrNRdOuODuclfIDnYSPn83a40XHn+Hgl9SmoXuSdDutAXC
-b017GsOa7OV3ZPildcIa3d/yk4S3L56SdoY+Py4NIIDmxcjji1e91qCrrFfGYwmg
-TkQ=
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
-MIIDrDCCApSgAwIBAgIUcRGFYn4pUMRoDtFZhU1EOAPdiWwwDQYJKoZIhvcNAQEL
-BQAwWDELMAkGA1UEBhMCUEwxFTATBgNVBAoMDG9zc2xzaWduY29kZTEgMB4GA1UE
-CwwXQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxEDAOBgNVBAMMB1Jvb3QgQ0EwHhcN
-MTgwMTAxMDAwMDAwWhcNMzYwMTAxMDAwMDAwWjBgMQswCQYDVQQGEwJQTDEVMBMG
-A1UECgwMb3NzbHNpZ25jb2RlMSAwHgYDVQQLDBdDZXJ0aWZpY2F0aW9uIEF1dGhv
-cml0eTEYMBYGA1UEAwwPSW50ZXJtZWRpYXRlIENBMIIBIjANBgkqhkiG9w0BAQEF
-AAOCAQ8AMIIBCgKCAQEA5yrw3i+fvxBSODvCoQb+9ibWRozmphJBp57tKv9ZraQ5
-THK+PkCdjNiJuxZn8F1QLsjJo6JqrrXufYln7wixK0Seu4uV6I2TRzcRyJx29D89
-0G9GrTXKn7v8z32QAqCgtwSZ17uWYTFmRAYPllWXcWDONsVyw3UF2nClndL7GMqM
-gDizlwsfg8HmRpZegn82I7Y2DXccm9a7pFHuBHpwenKqfBnMsXo3Jj4Xlr1cLTrh
-+6ksS5YogOsOd9b5Dfz6FaGmmwrlUWHwdi+EzdnSpOnXzmgflF23sZQ0ynsVvmpl
-iD4rXBWnxnQ6Ken3wVPNrA/0ZYGbgSKrcv+/olkh5QIDAQABo2YwZDASBgNVHRMB
-Af8ECDAGAQH/AgEAMB0GA1UdDgQWBBRkEPGrOTfcwf27Hcg/QVh3YifvKTAfBgNV
-HSMEGDAWgBQaPEb++qXSgmAi2vsewtpb6SiIyDAOBgNVHQ8BAf8EBAMCAYYwDQYJ
-KoZIhvcNAQELBQADggEBAL22kK3SDGnr3lhRE7ipptlKalrQKfpght0XEKm5hxCL
-tougN2wtaTEWMwr2YfGJohcKBaGKQ+Bv6WY+EV+hJE4qEUFh6BGqRMtuZdiAbkG+
-EveEMhZWQzgf9rUID+Y9Eg+NfCxlpkdQPjUxUV9OkGIshlxkUP8Y+C0h0xIcwq5v
-hAfNiJAdcw4fUvtLkpEOFoOjThB8zxOu+Cl3xLCcNOMPLdSxd3YXjy6CMuuOk4RB
-gOc8YCyyEvwb9KmARZpMOcQJmucMhs+aC3DF+n71g+agFhDl3Z0QkyyyRjAcD04+
-sAR9C8PbqSCQAdydHbAFViEX6x3oGJ7L6zEDcIS10wg=
-----END CERTIFICATE-----
--- a/tests/certs/cert.spc
+++ b/tests/certs/cert.spc
--- a/tests/certs/cert_crldp.pem
+++ b/tests/certs/cert_crldp.pem
@ -1,47 +0,0 @@
-----BEGIN CERTIFICATE-----
-MIIEPTCCAyWgAwIBAgIUe8Im9GuMCHMi3/FDfLgzoE8vTKgwDQYJKoZIhvcNAQEL
-BQAwZzELMAkGA1UEBhMCUEwxFTATBgNVBAoMDG9zc2xzaWduY29kZTEgMB4GA1UE
-CwwXQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxHzAdBgNVBAMMFkludGVybWVkaWF0
-ZSBDQSBDUkwgRFAwHhcNMTgwMTAxMDAwMDAwWhcNMzQxMjMxMDAwMDAwWjCBqzEL
-MAkGA1UEBhMCUEwxGTAXBgNVBAgMEE1hem92aWEgUHJvdmluY2UxDzANBgNVBAcM
-BldhcnNhdzEVMBMGA1UECgwMb3NzbHNpZ25jb2RlMQwwCgYDVQQLDANDU1AxIjAg
-BgNVBAMMGUNlcnRpZmljYXRlIFg1MDl2MyBDUkwgRFAxJzAlBgkqhkiG9w0BCQEW
-GG9zc2xzaWduY29kZUBleGFtcGxlLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEP
-ADCCAQoCggEBAMdBCaytt9xsrUx02Fekq+IrsR2cC1pL9NANN3TbBv8RKt1IefMh
-8TjA1uPaOYZvz3o2ml9qKGmJ+uxHkzLojKbg98bcmxBrkWemLQwmRv1hZIO8D4xi
-YRd0O0KZizrvwWwlNADzXXWw7iz+MPPWkXj2nT5MpOTi3S851SwOc/c9SYCazCP8
-rMGItKHLO7iCjK3sFwBDI9eaTd2NEjqEHadIymHRizeTOaYv34FokQiRgR/zk4fl
-T6+b6DQHxnlbIivV61OP4bBlFtXXjC4iGdHLIahhVMlw6ixGqR6910psIp0ST0KM
-8ly+N+1rPhoNkNSLqkzGUudKo7mVt+Cp4EMCAwEAAaOBmzCBmDAJBgNVHRMEAjAA
-MB0GA1UdDgQWBBTprhNre3RQJMbThsJYwKi0w8vJZTAfBgNVHSMEGDAWgBQUPGKp
-4nGIluZnh6sofSkEiGrtIzATBgNVHSUEDDAKBggrBgEFBQcDAzA2BgNVHR8ELzAt
-MCugKaAnhiVodHRwOi8vMTI3LjAuMC4xOjE5MjU0L2ludGVybWVkaWF0ZUNBMA0G
-CSqGSIb3DQEBCwUAA4IBAQBlJrcOaJQQ3TuYaVtmH8VbCdF3GQE+255g0Kq4sWoO
-ZgZm6LmRkchuoOXqeZ7aAV6HnGGpZf64ShPSZ3KPt4/UVYkRyS0UihN2ACsGrS4o
-ZjOaaoM2xDxttngKV3lAF4xbx18RvAsx9QIzQhzowaSUBQNuu5W4tne/6h7htuwA
-KNc0go4fqpCqQjNRVeB1IN50BzUrlHu3zQzfH0LDyUTt2gnObLHMl566Ft0azAG9
-emHRM+BOUjKY3ZTjM+JEzpwWgse6e4r+J2fYVYIEtkSfm4ZZnAs5WFWI5o8tqr4b
-ruBN7l6oP6R3ugOtPk7tW4x7OO0QoDnfa418MkBlXeqL
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
-MIIDszCCApugAwIBAgIUN3RBnJCUJ8HmbeNjJZ/6jsXJLGEwDQYJKoZIhvcNAQEL
-BQAwWDELMAkGA1UEBhMCUEwxFTATBgNVBAoMDG9zc2xzaWduY29kZTEgMB4GA1UE
-CwwXQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxEDAOBgNVBAMMB1Jvb3QgQ0EwHhcN
-MTgwMTAxMDAwMDAwWhcNMzYwMTAxMDAwMDAwWjBnMQswCQYDVQQGEwJQTDEVMBMG
-A1UECgwMb3NzbHNpZ25jb2RlMSAwHgYDVQQLDBdDZXJ0aWZpY2F0aW9uIEF1dGhv
-cml0eTEfMB0GA1UEAwwWSW50ZXJtZWRpYXRlIENBIENSTCBEUDCCASIwDQYJKoZI
-hvcNAQEBBQADggEPADCCAQoCggEBAME32IBpxW4FhVuZe1PTarEskVHP233QjZtx
-poC67/lUK44gtFmsxYsMrDYmmny5pfoM/Byxl5/rorEddLqtDe1kd1SpXUvEYxox
-s5rizRd5sZPgkwNoJkSVyNZFwj7gKZHeg6IQHSxNgmTybZ+eZqiNvEveksj3lGpM
-Xrbiew7cXUyIP636GPtYxLyIbwDVP0jScqcA/dmSAqofFVUi0SW3OS1hpyXAmmx8
-hQHJRKPjPgitZVgjwf5X8/eMTa+ca9dRlRFLk7AcbkF6NcbLm+cRo816nO0EBFV4
-Sn2dW9uYqJIfZcpRQ7wbv4fUCghwrk9h3gXrb7AweyK8nyYlmosCAwEAAaNmMGQw
-EgYDVR0TAQH/BAgwBgEB/wIBADAdBgNVHQ4EFgQUFDxiqeJxiJbmZ4erKH0pBIhq
-7SMwHwYDVR0jBBgwFoAUGjxG/vql0oJgItr7HsLaW+koiMgwDgYDVR0PAQH/BAQD
-AgGGMA0GCSqGSIb3DQEBCwUAA4IBAQAlI/1XnGc9WzL53rRascZc1EgWAnej9YFS
-Dax5+nozYTihC8BRxGfSh1FGRVsmFWhZ0z0XogJJC2bZrQ/36+vwoILItcsWHrQr
-rFoZa6s1Uo7ZCd9SfmXjbhMLQgydocCh9YIF66CAkQLwRXc1QIpF7nuZ+rxk0ru1
-uGjjBrFRfdSdzlFnyK6wfFzi6LtYDVgVEHC7zzL9E/cyuGo7qQ++SoOg99HjTVY1
-PS3ea522bRO2bJpYwZJvvbg020DAfm686VXwAadODdBkI2h6U5SwTxp4SkSmq9SI
-mjtERFtnAKD0R2YrX4RzuIckezvwsqLDkQjMnI9XQmv5HWUZimcC
-----END CERTIFICATE-----
--- a/tests/certs/expired.pem
+++ b/tests/certs/expired.pem
@ -1,45 +0,0 @@
-----BEGIN CERTIFICATE-----
-MIID6jCCAtKgAwIBAgIUcgUgRT1Lx8XLdgp7xcWxVl9YBjYwDQYJKoZIhvcNAQEL
-BQAwYDELMAkGA1UEBhMCUEwxFTATBgNVBAoMDG9zc2xzaWduY29kZTEgMB4GA1UE
-CwwXQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxGDAWBgNVBAMMD0ludGVybWVkaWF0
-ZSBDQTAeFw0xODAxMDEwMDAwMDBaFw0xOTAxMDEwMDAwMDBaMIGZMQswCQYDVQQG
-EwJQTDEZMBcGA1UECAwQTWF6b3ZpYSBQcm92aW5jZTEPMA0GA1UEBwwGV2Fyc2F3
-MRUwEwYDVQQKDAxvc3Nsc2lnbmNvZGUxDDAKBgNVBAsMA0NTUDEQMA4GA1UEAwwH
-RXhwaXJlZDEnMCUGCSqGSIb3DQEJARYYb3NzbHNpZ25jb2RlQGV4YW1wbGUuY29t
-MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAx0EJrK233GytTHTYV6Sr
-4iuxHZwLWkv00A03dNsG/xEq3Uh58yHxOMDW49o5hm/PejaaX2ooaYn67EeTMuiM
-puD3xtybEGuRZ6YtDCZG/WFkg7wPjGJhF3Q7QpmLOu/BbCU0APNddbDuLP4w89aR
-ePadPkyk5OLdLznVLA5z9z1JgJrMI/yswYi0ocs7uIKMrewXAEMj15pN3Y0SOoQd
-p0jKYdGLN5M5pi/fgWiRCJGBH/OTh+VPr5voNAfGeVsiK9XrU4/hsGUW1deMLiIZ
-0cshqGFUyXDqLEapHr3XSmwinRJPQozyXL437Ws+Gg2Q1IuqTMZS50qjuZW34Kng
-QwIDAQABo2IwYDAJBgNVHRMEAjAAMB0GA1UdDgQWBBTprhNre3RQJMbThsJYwKi0
-w8vJZTAfBgNVHSMEGDAWgBRkEPGrOTfcwf27Hcg/QVh3YifvKTATBgNVHSUEDDAK
-BggrBgEFBQcDAzANBgkqhkiG9w0BAQsFAAOCAQEA0AxgPkboWfIOMYFOP6kQ4nxY
-jQ+kAH842ALjm/5z20fYPS0k3LiCNS0FfBPzygeWQLwDGcH2QX6Lfec62CeIe9R9
-IAdsX+nNxn9FeIZssfMK3EPgksGUybUNub78mXPrnhCNjYf/GmDY/Cf7jhBtNphK
-6zCPOC0WDrupnLW7r4FyrB1j2CEgaHhiSmlQ+19rqbvcNfaCOMfe7IfiwkvVIzE6
-tQhnudB/HnW3+pWT83n/KQk0F8lu00fahkak/0bPidTe4zOvepabiWYQXKJ9ZXhm
-UW7FHHSM5Vbn2A6zyEht7rcK/gkpHbkckoIi6bDMFMp+K9o3qV7PzZPkaau7fg==
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
-MIIDrDCCApSgAwIBAgIUcRGFYn4pUMRoDtFZhU1EOAPdiWwwDQYJKoZIhvcNAQEL
-BQAwWDELMAkGA1UEBhMCUEwxFTATBgNVBAoMDG9zc2xzaWduY29kZTEgMB4GA1UE
-CwwXQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxEDAOBgNVBAMMB1Jvb3QgQ0EwHhcN
-MTgwMTAxMDAwMDAwWhcNMzYwMTAxMDAwMDAwWjBgMQswCQYDVQQGEwJQTDEVMBMG
-A1UECgwMb3NzbHNpZ25jb2RlMSAwHgYDVQQLDBdDZXJ0aWZpY2F0aW9uIEF1dGhv
-cml0eTEYMBYGA1UEAwwPSW50ZXJtZWRpYXRlIENBMIIBIjANBgkqhkiG9w0BAQEF
-AAOCAQ8AMIIBCgKCAQEA5yrw3i+fvxBSODvCoQb+9ibWRozmphJBp57tKv9ZraQ5
-THK+PkCdjNiJuxZn8F1QLsjJo6JqrrXufYln7wixK0Seu4uV6I2TRzcRyJx29D89
-0G9GrTXKn7v8z32QAqCgtwSZ17uWYTFmRAYPllWXcWDONsVyw3UF2nClndL7GMqM
-gDizlwsfg8HmRpZegn82I7Y2DXccm9a7pFHuBHpwenKqfBnMsXo3Jj4Xlr1cLTrh
-+6ksS5YogOsOd9b5Dfz6FaGmmwrlUWHwdi+EzdnSpOnXzmgflF23sZQ0ynsVvmpl
-iD4rXBWnxnQ6Ken3wVPNrA/0ZYGbgSKrcv+/olkh5QIDAQABo2YwZDASBgNVHRMB
-Af8ECDAGAQH/AgEAMB0GA1UdDgQWBBRkEPGrOTfcwf27Hcg/QVh3YifvKTAfBgNV
-HSMEGDAWgBQaPEb++qXSgmAi2vsewtpb6SiIyDAOBgNVHQ8BAf8EBAMCAYYwDQYJ
-KoZIhvcNAQELBQADggEBAL22kK3SDGnr3lhRE7ipptlKalrQKfpght0XEKm5hxCL
-tougN2wtaTEWMwr2YfGJohcKBaGKQ+Bv6WY+EV+hJE4qEUFh6BGqRMtuZdiAbkG+
-EveEMhZWQzgf9rUID+Y9Eg+NfCxlpkdQPjUxUV9OkGIshlxkUP8Y+C0h0xIcwq5v
-hAfNiJAdcw4fUvtLkpEOFoOjThB8zxOu+Cl3xLCcNOMPLdSxd3YXjy6CMuuOk4RB
-gOc8YCyyEvwb9KmARZpMOcQJmucMhs+aC3DF+n71g+agFhDl3Z0QkyyyRjAcD04+
-sAR9C8PbqSCQAdydHbAFViEX6x3oGJ7L6zEDcIS10wg=
-----END CERTIFICATE-----
--- a/tests/certs/intermediateCA.pem
+++ b/tests/certs/intermediateCA.pem
@ -1,22 +0,0 @@
-----BEGIN CERTIFICATE-----
-MIIDrDCCApSgAwIBAgIUcRGFYn4pUMRoDtFZhU1EOAPdiWwwDQYJKoZIhvcNAQEL
-BQAwWDELMAkGA1UEBhMCUEwxFTATBgNVBAoMDG9zc2xzaWduY29kZTEgMB4GA1UE
-CwwXQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxEDAOBgNVBAMMB1Jvb3QgQ0EwHhcN
-MTgwMTAxMDAwMDAwWhcNMzYwMTAxMDAwMDAwWjBgMQswCQYDVQQGEwJQTDEVMBMG
-A1UECgwMb3NzbHNpZ25jb2RlMSAwHgYDVQQLDBdDZXJ0aWZpY2F0aW9uIEF1dGhv
-cml0eTEYMBYGA1UEAwwPSW50ZXJtZWRpYXRlIENBMIIBIjANBgkqhkiG9w0BAQEF
-AAOCAQ8AMIIBCgKCAQEA5yrw3i+fvxBSODvCoQb+9ibWRozmphJBp57tKv9ZraQ5
-THK+PkCdjNiJuxZn8F1QLsjJo6JqrrXufYln7wixK0Seu4uV6I2TRzcRyJx29D89
-0G9GrTXKn7v8z32QAqCgtwSZ17uWYTFmRAYPllWXcWDONsVyw3UF2nClndL7GMqM
-gDizlwsfg8HmRpZegn82I7Y2DXccm9a7pFHuBHpwenKqfBnMsXo3Jj4Xlr1cLTrh
-+6ksS5YogOsOd9b5Dfz6FaGmmwrlUWHwdi+EzdnSpOnXzmgflF23sZQ0ynsVvmpl
-iD4rXBWnxnQ6Ken3wVPNrA/0ZYGbgSKrcv+/olkh5QIDAQABo2YwZDASBgNVHRMB
-Af8ECDAGAQH/AgEAMB0GA1UdDgQWBBRkEPGrOTfcwf27Hcg/QVh3YifvKTAfBgNV
-HSMEGDAWgBQaPEb++qXSgmAi2vsewtpb6SiIyDAOBgNVHQ8BAf8EBAMCAYYwDQYJ
-KoZIhvcNAQELBQADggEBAL22kK3SDGnr3lhRE7ipptlKalrQKfpght0XEKm5hxCL
-tougN2wtaTEWMwr2YfGJohcKBaGKQ+Bv6WY+EV+hJE4qEUFh6BGqRMtuZdiAbkG+
-EveEMhZWQzgf9rUID+Y9Eg+NfCxlpkdQPjUxUV9OkGIshlxkUP8Y+C0h0xIcwq5v
-hAfNiJAdcw4fUvtLkpEOFoOjThB8zxOu+Cl3xLCcNOMPLdSxd3YXjy6CMuuOk4RB
-gOc8YCyyEvwb9KmARZpMOcQJmucMhs+aC3DF+n71g+agFhDl3Z0QkyyyRjAcD04+
-sAR9C8PbqSCQAdydHbAFViEX6x3oGJ7L6zEDcIS10wg=
-----END CERTIFICATE-----
--- a/tests/certs/intermediateCA_crldp.pem
+++ b/tests/certs/intermediateCA_crldp.pem
@ -1,22 +0,0 @@
-----BEGIN CERTIFICATE-----
-MIIDszCCApugAwIBAgIUN3RBnJCUJ8HmbeNjJZ/6jsXJLGEwDQYJKoZIhvcNAQEL
-BQAwWDELMAkGA1UEBhMCUEwxFTATBgNVBAoMDG9zc2xzaWduY29kZTEgMB4GA1UE
-CwwXQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxEDAOBgNVBAMMB1Jvb3QgQ0EwHhcN
-MTgwMTAxMDAwMDAwWhcNMzYwMTAxMDAwMDAwWjBnMQswCQYDVQQGEwJQTDEVMBMG
-A1UECgwMb3NzbHNpZ25jb2RlMSAwHgYDVQQLDBdDZXJ0aWZpY2F0aW9uIEF1dGhv
-cml0eTEfMB0GA1UEAwwWSW50ZXJtZWRpYXRlIENBIENSTCBEUDCCASIwDQYJKoZI
-hvcNAQEBBQADggEPADCCAQoCggEBAME32IBpxW4FhVuZe1PTarEskVHP233QjZtx
-poC67/lUK44gtFmsxYsMrDYmmny5pfoM/Byxl5/rorEddLqtDe1kd1SpXUvEYxox
-s5rizRd5sZPgkwNoJkSVyNZFwj7gKZHeg6IQHSxNgmTybZ+eZqiNvEveksj3lGpM
-Xrbiew7cXUyIP636GPtYxLyIbwDVP0jScqcA/dmSAqofFVUi0SW3OS1hpyXAmmx8
-hQHJRKPjPgitZVgjwf5X8/eMTa+ca9dRlRFLk7AcbkF6NcbLm+cRo816nO0EBFV4
-Sn2dW9uYqJIfZcpRQ7wbv4fUCghwrk9h3gXrb7AweyK8nyYlmosCAwEAAaNmMGQw
-EgYDVR0TAQH/BAgwBgEB/wIBADAdBgNVHQ4EFgQUFDxiqeJxiJbmZ4erKH0pBIhq
-7SMwHwYDVR0jBBgwFoAUGjxG/vql0oJgItr7HsLaW+koiMgwDgYDVR0PAQH/BAQD
-AgGGMA0GCSqGSIb3DQEBCwUAA4IBAQAlI/1XnGc9WzL53rRascZc1EgWAnej9YFS
-Dax5+nozYTihC8BRxGfSh1FGRVsmFWhZ0z0XogJJC2bZrQ/36+vwoILItcsWHrQr
-rFoZa6s1Uo7ZCd9SfmXjbhMLQgydocCh9YIF66CAkQLwRXc1QIpF7nuZ+rxk0ru1
-uGjjBrFRfdSdzlFnyK6wfFzi6LtYDVgVEHC7zzL9E/cyuGo7qQ++SoOg99HjTVY1
-PS3ea522bRO2bJpYwZJvvbg020DAfm686VXwAadODdBkI2h6U5SwTxp4SkSmq9SI
-mjtERFtnAKD0R2YrX4RzuIckezvwsqLDkQjMnI9XQmv5HWUZimcC
-----END CERTIFICATE-----
--- a/tests/certs/key.der
+++ b/tests/certs/key.der
--- a/tests/certs/key.pem
+++ b/tests/certs/key.pem
@ -1,28 +0,0 @@
-----BEGIN PRIVATE KEY-----
-MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDHQQmsrbfcbK1M
-dNhXpKviK7EdnAtaS/TQDTd02wb/ESrdSHnzIfE4wNbj2jmGb896Nppfaihpifrs
-R5My6Iym4PfG3JsQa5Fnpi0MJkb9YWSDvA+MYmEXdDtCmYs678FsJTQA8111sO4s
-/jDz1pF49p0+TKTk4t0vOdUsDnP3PUmAmswj/KzBiLShyzu4goyt7BcAQyPXmk3d
-jRI6hB2nSMph0Ys3kzmmL9+BaJEIkYEf85OH5U+vm+g0B8Z5WyIr1etTj+GwZRbV
-14wuIhnRyyGoYVTJcOosRqkevddKbCKdEk9CjPJcvjftaz4aDZDUi6pMxlLnSqO5
-lbfgqeBDAgMBAAECggEABtHIBfvwFgA2Mi6xlNZS96utJSlJDi8ZUuGQ61Pvul0Z
-DXfEjLi1q86VzDiUzXAYNsOVpvxYI7yQNPQCKrTg03lRoaG9QOOdl2GNmyPYPCXQ
-Ld4K3jAjyIy21oGwzTSVdyES1ZF+ul9y12FfxYirc+tk2FQBNMA697nP/PEFsQl9
-cMxBB5CIGH7jSI6UIbp99Kd90ScbnE2mLACM3d0s0sRq783P9yJGpM9a71XE/K2p
-CxoRxwqmNRGvI5LrGs1zIF2BSZZgNT71cdfMnAIJBeaoNY7QTKDQlg9xQojE+0if
-is16mMhrHQbIFBSxHDRR4uVdiY4iKDB6Lg2pMGcjUQKBgQDzWI2O8bh+YvaEM9QN
-uUC1LI6oGzj7+wxkIhjXhCX680EFeJk6AQqNfu5VoBN/nrCXxqjNGKhjqDmtzxjD
-y9LYTCJ8rM9eCkrgcdCFkTQNcdNT/zqkHeOIxsoXgsFLhYozWcbiW+8oe9MTrXX/
-m9u9kTHkSjKziof7wxGXu3pAmQKBgQDRnYd+urSG0bulBccqT06pJpQMjYIi6CqQ
-LYEkLlELxOT+EPeEH1ZdgYkDzzgKoO5L/Jp0Ic6kKEQv+o4l+g1gJp6V5wwX81nv
-FJApcg51Yma6WQb6PEJ8HiZ531JQpGZZPmJvRIvEdqw+Dz/dferTApvOlD9s4PfM
-xG4R/EoFOwKBgQCEQdW2IhQWxOycj5qp1syfa1chcKI4+YoThiCgSZdm2/yz34bP
-6q70lk8sxHK0gugRpYwq5ELo3w5yM8OO7uFqY36+6iFOSCPH9rPRVEjJIdsspOQX
-PJNkzD4cJxmtVSf2ns2kSzkhdKMU58rhILF+R0Kpg9YolJsxrySJpgBcyQKBgQCC
-KCTYRiqOhHDVuU7AMNqRIclQOhYSgsLbH8ZOpwvgGPRv5i0rNyIzkZl4ahVMVD1j
-pYhqkAt11yLv/86AOlJP3+sc/Yh+3rZ7Q/N4KMBdlypej6VLgFtwInCVwFumg06i
-H6CToqZ+6YluR53KdMN5HueMUHVJsC9uUJJgTJ3RvQKBgFPi8mgG4zcdoKBhqyq2
-x3VQEe0VYnzBsIz42E/NFpuB4ZwC7j0Uez+QFUj76UKMsoE6fX9/lGNdg/zitRBc
-M21R9HeWuQHSM6nJ/ScK7C0vqQVsGOr/DKGEydvSjkPsyIbCw8qEdOq8idAULEKj
-GlIpzzm+MYzra4yB4VpRw5ES
-----END PRIVATE KEY-----
--- a/tests/certs/key.pvk
+++ b/tests/certs/key.pvk
--- a/tests/certs/keyp.pem
+++ b/tests/certs/keyp.pem
@ -1,30 +0,0 @@
-----BEGIN ENCRYPTED PRIVATE KEY-----
-MIIFHDBOBgkqhkiG9w0BBQ0wQTApBgkqhkiG9w0BBQwwHAQIY7PpABd5xsYCAggA
-MAwGCCqGSIb3DQIJBQAwFAYIKoZIhvcNAwcECC8FH8kZE5H/BIIEyK9LnEmc3VYK
-kqwBBX15exPIRrsmeGkoSSrnHUeLzV0E2CN9bEL1XwJtX6d4YGYHnH7MopV9LPgl
-Fdu2CvWXt5XLOMb3FJ38zZGtNnbYWZLbVlgQANZaTRCZaoWHS57KulgbtbJnn3PQ
-DdYHaCiRh95pgPrdklEs0PhvBe98kR4xGJPoiGn+gJ75Ik4kwW/vJTcQeKbcU4oQ
-MGIVXV66NU+Pc1d3CTYm9hwIys70+J9QtT1aSoENeYr1e+sHgzN7ykDalfAir/dZ
-/E91Zg4RFV4clvvVmoAyXmZFpMxj5pLYGvdjBxTURh+8mdulfJMpKHjJldx7N9+I
-cusGwKVXQcIXI76lxvKo08oENq0C6112+++s6bYtwzuk/Auk+dQ2mn2/gLgs6fsy
-pi1ZKUoO8pdm8N4QzqPsFc2/ny5oSy6A6EKDC/tKoP59r6qJtoYselfypFsWemIo
-F/W0HmZzC5OJMEqUxbKIuH7Xhx0ufs4TytzYMEnUVH0ChLan67VvFIcq4sLoMaW0
-d2jyDdIe4WcmVckJtjudbIhcRsXtoSVB8PYjdHOmI9YZVksPreeKk7stf06V3PBU
-/hsBpzlWu8xO6+cMGrlvoqOov3WAmD1/LW/ITggjLb28r7LnUrYTbj95xZ8Zd8s9
-hx60MZpTJKni/Kfd5yVZw7xZWLHxNWdBbZxlCkvvFN5Ik0FjULLblfIfYa38zwp1
-P6Dbw0wBSNhpsdsGcnkB+YWlzyIJzC99EZqgC3cGmb+9UGuj2bmvzx0hlIY4APCf
-lfiFNXUHxxRZCV/Cp3TXqh3h7t99KvVoIzEIV8iUDMLG7dsnf2Y1z7AQ3cfL8tmC
-qTlKH8QdMn87ntjcU1fynE3X/bL4+Fy8ZWeCWHHPLU2TP6Z7xBkXVB77gm0rK2cU
-lJVZKB3kVemSvu9OennBAiE7yjusqCLyTJo9GlI3H7xM+jHf0CZM149n2yV7w98Z
-Nag2b4iYnbVa1CRcL+4Y5zfA6AwCXvkqKcqyUqK4ZEvd1VnN9L+pTWrxaAxukC5f
-KyKXKd+HdiS2b8fFVYKmpq+lK02zxuIJpLh7JlcztNinm67irwg+7VZczpX46Za1
-waPuAnJ6zA6pVdRKxpXx5AnAh9vlCtlyakREx6NajG7f2nCe6IrznyVQ45jlkmwp
-od0kAjsd/xp0NyvWI5A9ICU+pJ5xqhUGkXPvIxj1IqTFa7k4lYKiKgqeKoyLnzYA
-+R1iQikwewxEahamhjiBH2xPYmZ77EjIF3EtLbpI02fxHR8LjyIBJ/HNnarKqJp0
-HYhLJQ8z7uyAESfXY997UnTtgLQHEX5/6DKYqlNWdzRiIEGfleujHmaAb9kf9Xrr
-r2EVc0E4q2/wvgMHn8GRSv6K7pQC//vNmBuNGCAMBl8t6y1QxDrX+UBn97HGk96Z
-LqRoVM2mz1cS/tiP4+MSB0zqzGbHsk9xoEY0QeRPvjJfGc1skRWwdo8LA8Hf1pi1
-/exyJzHNdxVdxM4CKMnXbTNCxKlhhZhUaWzELNjI5bQ5oQfechEypsFYAQETU5NS
-182MgLMhkxqqcxLHcHIGE1ApZKXhY5siO0k4TTb2Kqxgn2fBUyLQLMVaVrHhZwxg
-XwiQ2Rt3JBHrzPy9wXL8hw==
-----END ENCRYPTED PRIVATE KEY-----
--- a/tests/certs/legacy.p12
+++ b/tests/certs/legacy.p12
--- a/tests/certs/password.txt
+++ b/tests/certs/password.txt
@ -1 +0,0 @@
-passme
--- a/tests/certs/revoked.pem
+++ b/tests/certs/revoked.pem
@ -1,45 +0,0 @@
-----BEGIN CERTIFICATE-----
-MIIDvTCCAqWgAwIBAgIUazbrVgbYb+IN803UmJJa0DPHQsAwDQYJKoZIhvcNAQEL
-BQAwYDELMAkGA1UEBhMCUEwxFTATBgNVBAoMDG9zc2xzaWduY29kZTEgMB4GA1UE
-CwwXQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxGDAWBgNVBAMMD0ludGVybWVkaWF0
-ZSBDQTAeFw0xODAxMDEwMDAwMDBaFw0zNDEyMzEwMDAwMDBaMG0xCzAJBgNVBAYT
-AlBMMRUwEwYDVQQKDAxvc3Nsc2lnbmNvZGUxDDAKBgNVBAsMA0NTUDEQMA4GA1UE
-AwwHUmV2b2tlZDEnMCUGCSqGSIb3DQEJARYYb3NzbHNpZ25jb2RlQGV4YW1wbGUu
-Y29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAx0EJrK233GytTHTY
-V6Sr4iuxHZwLWkv00A03dNsG/xEq3Uh58yHxOMDW49o5hm/PejaaX2ooaYn67EeT
-MuiMpuD3xtybEGuRZ6YtDCZG/WFkg7wPjGJhF3Q7QpmLOu/BbCU0APNddbDuLP4w
-89aRePadPkyk5OLdLznVLA5z9z1JgJrMI/yswYi0ocs7uIKMrewXAEMj15pN3Y0S
-OoQdp0jKYdGLN5M5pi/fgWiRCJGBH/OTh+VPr5voNAfGeVsiK9XrU4/hsGUW1deM
-LiIZ0cshqGFUyXDqLEapHr3XSmwinRJPQozyXL437Ws+Gg2Q1IuqTMZS50qjuZW3
-4KngQwIDAQABo2IwYDAJBgNVHRMEAjAAMB0GA1UdDgQWBBTprhNre3RQJMbThsJY
-wKi0w8vJZTAfBgNVHSMEGDAWgBRkEPGrOTfcwf27Hcg/QVh3YifvKTATBgNVHSUE
-DDAKBggrBgEFBQcDAzANBgkqhkiG9w0BAQsFAAOCAQEAFJjwxpYA2jzrmF1mdKx/
-up8gl6iISsHDc7oLAv63oUYXpFwzpNfvi1TGqYVhntAH2t/1XdA1HKdBp2LDsEnt
-Av66c6HxyNPka26ZGD70+w5q8uHrIOO6MZw0eaLwu9bJI4cLbRXlKwxkGSzXHGYs
-1hGR2YwAiMrqtVMPetlpd62y6qUZc0lEOhjJ6DsIfqSgO8AsdyI7Ao+cDqEZ1I/Q
-Oi1Agn8kz8TtfWKxkX06EoL4DrZCDb1/w0CGQJATq77pKst+zw+B+2EKqlpuG3s/
-FE7RkCjG7bEFIDEK2909BXQNyQJzp7ih9X8QeEx5fnPr9lDfe/75YjRqoHkfmcTC
-Hw==
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
-MIIDrDCCApSgAwIBAgIUcRGFYn4pUMRoDtFZhU1EOAPdiWwwDQYJKoZIhvcNAQEL
-BQAwWDELMAkGA1UEBhMCUEwxFTATBgNVBAoMDG9zc2xzaWduY29kZTEgMB4GA1UE
-CwwXQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxEDAOBgNVBAMMB1Jvb3QgQ0EwHhcN
-MTgwMTAxMDAwMDAwWhcNMzYwMTAxMDAwMDAwWjBgMQswCQYDVQQGEwJQTDEVMBMG
-A1UECgwMb3NzbHNpZ25jb2RlMSAwHgYDVQQLDBdDZXJ0aWZpY2F0aW9uIEF1dGhv
-cml0eTEYMBYGA1UEAwwPSW50ZXJtZWRpYXRlIENBMIIBIjANBgkqhkiG9w0BAQEF
-AAOCAQ8AMIIBCgKCAQEA5yrw3i+fvxBSODvCoQb+9ibWRozmphJBp57tKv9ZraQ5
-THK+PkCdjNiJuxZn8F1QLsjJo6JqrrXufYln7wixK0Seu4uV6I2TRzcRyJx29D89
-0G9GrTXKn7v8z32QAqCgtwSZ17uWYTFmRAYPllWXcWDONsVyw3UF2nClndL7GMqM
-gDizlwsfg8HmRpZegn82I7Y2DXccm9a7pFHuBHpwenKqfBnMsXo3Jj4Xlr1cLTrh
-+6ksS5YogOsOd9b5Dfz6FaGmmwrlUWHwdi+EzdnSpOnXzmgflF23sZQ0ynsVvmpl
-iD4rXBWnxnQ6Ken3wVPNrA/0ZYGbgSKrcv+/olkh5QIDAQABo2YwZDASBgNVHRMB
-Af8ECDAGAQH/AgEAMB0GA1UdDgQWBBRkEPGrOTfcwf27Hcg/QVh3YifvKTAfBgNV
-HSMEGDAWgBQaPEb++qXSgmAi2vsewtpb6SiIyDAOBgNVHQ8BAf8EBAMCAYYwDQYJ
-KoZIhvcNAQELBQADggEBAL22kK3SDGnr3lhRE7ipptlKalrQKfpght0XEKm5hxCL
-tougN2wtaTEWMwr2YfGJohcKBaGKQ+Bv6WY+EV+hJE4qEUFh6BGqRMtuZdiAbkG+
-EveEMhZWQzgf9rUID+Y9Eg+NfCxlpkdQPjUxUV9OkGIshlxkUP8Y+C0h0xIcwq5v
-hAfNiJAdcw4fUvtLkpEOFoOjThB8zxOu+Cl3xLCcNOMPLdSxd3YXjy6CMuuOk4RB
-gOc8YCyyEvwb9KmARZpMOcQJmucMhs+aC3DF+n71g+agFhDl3Z0QkyyyRjAcD04+
-sAR9C8PbqSCQAdydHbAFViEX6x3oGJ7L6zEDcIS10wg=
-----END CERTIFICATE-----
--- a/tests/certs/revoked_crldp.pem
+++ b/tests/certs/revoked_crldp.pem
@ -1,46 +0,0 @@
-----BEGIN CERTIFICATE-----
-MIIEDDCCAvSgAwIBAgIUHGb2CHtm9Ra3gCn6Iv7hpEhiQrYwDQYJKoZIhvcNAQEL
-BQAwZzELMAkGA1UEBhMCUEwxFTATBgNVBAoMDG9zc2xzaWduY29kZTEgMB4GA1UE
-CwwXQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxHzAdBgNVBAMMFkludGVybWVkaWF0
-ZSBDQSBDUkwgRFAwHhcNMTgwMTAxMDAwMDAwWhcNMzQxMjMxMDAwMDAwWjB7MQsw
-CQYDVQQGEwJQTDEVMBMGA1UECgwMb3NzbHNpZ25jb2RlMQwwCgYDVQQLDANDU1Ax
-HjAcBgNVBAMMFVJldm9rZWQgWDUwOXYzIENSTCBEUDEnMCUGCSqGSIb3DQEJARYY
-b3NzbHNpZ25jb2RlQGV4YW1wbGUuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
-MIIBCgKCAQEAx0EJrK233GytTHTYV6Sr4iuxHZwLWkv00A03dNsG/xEq3Uh58yHx
-OMDW49o5hm/PejaaX2ooaYn67EeTMuiMpuD3xtybEGuRZ6YtDCZG/WFkg7wPjGJh
-F3Q7QpmLOu/BbCU0APNddbDuLP4w89aRePadPkyk5OLdLznVLA5z9z1JgJrMI/ys
-wYi0ocs7uIKMrewXAEMj15pN3Y0SOoQdp0jKYdGLN5M5pi/fgWiRCJGBH/OTh+VP
-r5voNAfGeVsiK9XrU4/hsGUW1deMLiIZ0cshqGFUyXDqLEapHr3XSmwinRJPQozy
-XL437Ws+Gg2Q1IuqTMZS50qjuZW34KngQwIDAQABo4GbMIGYMAkGA1UdEwQCMAAw
-HQYDVR0OBBYEFOmuE2t7dFAkxtOGwljAqLTDy8llMB8GA1UdIwQYMBaAFBQ8Yqni
-cYiW5meHqyh9KQSIau0jMBMGA1UdJQQMMAoGCCsGAQUFBwMDMDYGA1UdHwQvMC0w
-K6ApoCeGJWh0dHA6Ly8xMjcuMC4wLjE6MTkyNTQvaW50ZXJtZWRpYXRlQ0EwDQYJ
-KoZIhvcNAQELBQADggEBAJ5WxnDiAiRPr7EvTRD7iaxixAY/2wgASXWekQLpvJ8Y
-/ehaVdZWE8ft76y73F4NC62JfjWgAZHE+we3LSO+eB5kznM+Ctzrf/brR1MorSOu
-iq78uz2pjwmQBpby6uDMii9r1txR62GYiLrZJizE+13AOVKBo5EW0PuwX3wKjk+s
-Z5Mp9y7+GVzCSXwJC4wNMw/ZJZgr+o5D8msMh3UPgxUfT1rZ7THW3IwXao3ZtTXw
-EA6uJoLVNb8FLfAVA1CFL0MlPgyiM2iNs+jIuhF7hPmMc8Je2qAr97ADdLCHWnRv
-Majsbns7OCCFROF2qSQiyzVO5Hn1kiPSP7qmLMak610=
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
-MIIDszCCApugAwIBAgIUN3RBnJCUJ8HmbeNjJZ/6jsXJLGEwDQYJKoZIhvcNAQEL
-BQAwWDELMAkGA1UEBhMCUEwxFTATBgNVBAoMDG9zc2xzaWduY29kZTEgMB4GA1UE
-CwwXQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxEDAOBgNVBAMMB1Jvb3QgQ0EwHhcN
-MTgwMTAxMDAwMDAwWhcNMzYwMTAxMDAwMDAwWjBnMQswCQYDVQQGEwJQTDEVMBMG
-A1UECgwMb3NzbHNpZ25jb2RlMSAwHgYDVQQLDBdDZXJ0aWZpY2F0aW9uIEF1dGhv
-cml0eTEfMB0GA1UEAwwWSW50ZXJtZWRpYXRlIENBIENSTCBEUDCCASIwDQYJKoZI
-hvcNAQEBBQADggEPADCCAQoCggEBAME32IBpxW4FhVuZe1PTarEskVHP233QjZtx
-poC67/lUK44gtFmsxYsMrDYmmny5pfoM/Byxl5/rorEddLqtDe1kd1SpXUvEYxox
-s5rizRd5sZPgkwNoJkSVyNZFwj7gKZHeg6IQHSxNgmTybZ+eZqiNvEveksj3lGpM
-Xrbiew7cXUyIP636GPtYxLyIbwDVP0jScqcA/dmSAqofFVUi0SW3OS1hpyXAmmx8
-hQHJRKPjPgitZVgjwf5X8/eMTa+ca9dRlRFLk7AcbkF6NcbLm+cRo816nO0EBFV4
-Sn2dW9uYqJIfZcpRQ7wbv4fUCghwrk9h3gXrb7AweyK8nyYlmosCAwEAAaNmMGQw
-EgYDVR0TAQH/BAgwBgEB/wIBADAdBgNVHQ4EFgQUFDxiqeJxiJbmZ4erKH0pBIhq
-7SMwHwYDVR0jBBgwFoAUGjxG/vql0oJgItr7HsLaW+koiMgwDgYDVR0PAQH/BAQD
-AgGGMA0GCSqGSIb3DQEBCwUAA4IBAQAlI/1XnGc9WzL53rRascZc1EgWAnej9YFS
-Dax5+nozYTihC8BRxGfSh1FGRVsmFWhZ0z0XogJJC2bZrQ/36+vwoILItcsWHrQr
-rFoZa6s1Uo7ZCd9SfmXjbhMLQgydocCh9YIF66CAkQLwRXc1QIpF7nuZ+rxk0ru1
-uGjjBrFRfdSdzlFnyK6wfFzi6LtYDVgVEHC7zzL9E/cyuGo7qQ++SoOg99HjTVY1
-PS3ea522bRO2bJpYwZJvvbg020DAfm686VXwAadODdBkI2h6U5SwTxp4SkSmq9SI
-mjtERFtnAKD0R2YrX4RzuIckezvwsqLDkQjMnI9XQmv5HWUZimcC
-----END CERTIFICATE-----
--- a/tests/certs/tsa-chain.pem
+++ b/tests/certs/tsa-chain.pem
@ -1,47 +0,0 @@
-----BEGIN CERTIFICATE-----
-MIIEMzCCAxugAwIBAgIUAQ9lOMiuXUZuKaxzEpwQmCzU7aowDQYJKoZIhvcNAQEL
-BQAwYDELMAkGA1UEBhMCUEwxFTATBgNVBAoMDG9zc2xzaWduY29kZTEkMCIGA1UE
-CwwbVGltZXN0YW1wIEF1dGhvcml0eSBSb290IENBMRQwEgYDVQQDDAtUU0EgUm9v
-dCBDQTAeFw0xODAxMDEwMDAwMDBaFw0zODAxMDEwMDAwMDBaMFUxCzAJBgNVBAYT
-AlBMMRUwEwYDVQQKDAxvc3Nsc2lnbmNvZGUxHDAaBgNVBAsME1RpbWVzdGFtcCBB
-dXRob3JpdHkxETAPBgNVBAMMCFRlc3QgVFNBMIIBIjANBgkqhkiG9w0BAQEFAAOC
-AQ8AMIIBCgKCAQEAqZW3jbxq2Zkw86ePE8r6Tl9+mxjzH8k1XPGXwKIdEhvOhBXN
-SxwVdiudnbIR2Kp4kOpRNeI4bET6bGEQVBVzuyPOCXeQlXK7wVhri/MF8YzMCFuW
-7s2OMeaCqMJckBiGrDYgvDIMfE53CZFVhOnpIKD+ItX+D1bBchvM1TaSOVcxwKwH
-pmIbw47gOY4E4rHz/KYdqcVCk82ACEmiptmJARb8oYU8bap1x7fEtDZ3w0gnnSks
-5dXGjdUwCkm1qHgoW/k6vK8nIz14f/+05GIMZpUh4kIUXMhGmbOeFHfENJ7J30TI
-RLXsK9iAApriqxZ6EvhrWOYJT4pUeUnGfuwPUwIDAQABo4HvMIHsMAwGA1UdEwEB
-/wQCMAAwFgYDVR0lAQH/BAwwCgYIKwYBBQUHAwgwHQYDVR0OBBYEFKryJiH4Y0KO
-x2nCc4cOvih1VzjmMB8GA1UdIwQYMBaAFD8ujz0I9Y7079ZMe9X7cO3/rSj5MC0G
-A1UdHwQmMCQwIqAgoB6GHGh0dHA6Ly8xMjcuMC4wLjE6MTkyNTQvVFNBQ0EwVQYD
-VR0eBE4wTKAYMAqCCHRlc3QuY29tMAqCCHRlc3Qub3JnoTAwCocIAAAAAAAAAAAw
-IocgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwDQYJKoZIhvcNAQEL
-BQADggEBAAhzijhC1kvBV75rxRqj27gtYRG8dNkHc5umzwXyNNMn2tI/kO2Rf+ES
-9RamQE9sfvOgg3UqfXIfRPsC4cBHnjT+ELdqbt4byk3LPtstJGFuLy0iNRNY9f1j
-lBJrldLZNNsIpNMQa0u5h/z4m0CAA8j6ayUvcoR11y2zYHkHlSScTq/s7gSQzXlK
-z4DRiiYif2OEdKVeRCqlDV8AOlhm1+9am74dkfO71aT0G2hko2u19NWZvjc/DqI1
-V+e2g5TDE7V65d9vvf9tA26i0At/VazvnhsgdpgUkwS6mjUvx+gW3i5YJhtXjdAX
-hpE0ajpKT0x/dNa/qCwl/9zc8XxGnPk=
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
-MIIDkDCCAnigAwIBAgIULFuB5HWsyba6VHu2Ygv2vt4R4/swDQYJKoZIhvcNAQEL
-BQAwYDELMAkGA1UEBhMCUEwxFTATBgNVBAoMDG9zc2xzaWduY29kZTEkMCIGA1UE
-CwwbVGltZXN0YW1wIEF1dGhvcml0eSBSb290IENBMRQwEgYDVQQDDAtUU0EgUm9v
-dCBDQTAeFw0xNzAxMDEwMDAwMDBaFw0zNjEyMjcwMDAwMDBaMGAxCzAJBgNVBAYT
-AlBMMRUwEwYDVQQKDAxvc3Nsc2lnbmNvZGUxJDAiBgNVBAsMG1RpbWVzdGFtcCBB
-dXRob3JpdHkgUm9vdCBDQTEUMBIGA1UEAwwLVFNBIFJvb3QgQ0EwggEiMA0GCSqG
-SIb3DQEBAQUAA4IBDwAwggEKAoIBAQDBo8JJDwVm6UTZvA2g/tOZ3xIbKYXI92Rn
-T/FCCUycsB5tmoSWcmy1AB6UDv7bFMGy4mdbxnErtdytGj+hEIO3O2EBbpBLAmlJ
-CEVNRrz/YbxGoJmeAii9s3jignUpTr/qLMSKkLowuqABZl2XtCp7Q83YlZPkVhFL
-kCAny89cG/QGAUxViN7HB4jWzhcBTTfD4PFvSU1HZNhPM0Y6BCpv2qrof3/tPnQr
-xM2zVZoIonQpf6paga61O9fM4wc1GqxGGwARz6Bxq6w2OxRDsV/biqP9gVUj0XmF
-6o/draf3MkDswOUZyKpujOUIf12ezXJFPWaCRN1Rl0vwV2CyVxkvAgMBAAGjQjBA
-MA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFD8ujz0I9Y7079ZMe9X7cO3/rSj5
-MA4GA1UdDwEB/wQEAwIBBjANBgkqhkiG9w0BAQsFAAOCAQEAtHmPfVgu6Y7uWcpq
-AdawOTZ/2ICOvAMmQ0LcXKmSpgsneHiyAL1Wwe2/XxTwmrpHylOapIIuV3irHCXU
-CxaTMUyZGfXoUWsxnR8bcb5ac/aFKkC3ynE2/IfFyJOQ724cK5FRK1+piVleP4Rx
-C04KQiuxuVLedyvGh5OPU/94ZW2JuuBjImVAO/lUbYhAUSpwueX2lYKSSPLkPfDx
-AsIp55x70iQ+EsgARvseVY2JRzvRnuh66V4P15wn3dIzjtWQ1/t007wMk5Lji5dQ
-iSvdyqULBytBqDtLPLzRuma1KJEPRIamF1j6Or6HaHSVUorRhqI3XuxEUGdO4LxZ
-QepMyA==
-----END CERTIFICATE-----
--- a/tests/certs/tsa-serial
+++ b/tests/certs/tsa-serial
@ -1 +0,0 @@
-bb7fd13ddf056e0a3e621d3537b25478
--- a/tests/check_cryptography.py
+++ b/tests/check_cryptography.py
@ -0,0 +1,40 @@
+#!/usr/bin/python3
+"""Check cryptography module."""
+
+import sys
+
+try:
+    import cryptography
+    print(cryptography.__version__, end="")
+except ModuleNotFoundError as ierr:
+    print("Module not installed: {}".format(ierr))
+    sys.exit(1)
+except ImportError as ierr:
+    print("Module not found: {}".format(ierr))
+    sys.exit(1)
+
+class UnsupportedVersion(Exception):
+    """Unsupported version"""
+
+def main() -> None:
+    """Check python3-cryptography version"""
+    try:
+        version = tuple(int(num) for num in cryptography.__version__.split('.'))
+        if version < (37, 0, 2):
+            raise UnsupportedVersion("unsupported python3-cryptography version")
+    except UnsupportedVersion as err:
+        print(" {}".format(err), end="")
+        sys.exit(1)
+
+
+if __name__ == '__main__':
+    main()
+
+# pylint: disable=pointless-string-statement
+"""Local Variables:
+    c-basic-offset: 4
+    tab-width: 4
+    indent-tabs-mode: nil
+End:
+    vim: set ts=4 expandtab:
+"""
--- a/tests/client_http.py
+++ b/tests/client_http.py
@ -1,3 +1,4 @@
+#!/usr/bin/python3
 """Implementation of a HTTP client"""

 import os
@ -5,17 +6,17 @@ import sys
 import http.client

 RESULT_PATH = os.getcwd()
-LOGS_PATH = os.path.join(RESULT_PATH, "./Testing/logs/")
-PORT_LOG = os.path.join(LOGS_PATH, "./port.log")


 def main() -> None:
    """Creating a POST Request"""
    ret = 0
    try:
-        with open(PORT_LOG, 'r') as file:
-            port = file.readline()
-        conn = http.client.HTTPConnection('127.0.0.1', port)
+        file_path = os.path.join(RESULT_PATH, "./Testing/logs/url.log")
+        with open(file_path, mode="r", encoding="utf-8") as file:
+            url = file.readline()
+        host, port = url.split(":")
+        conn = http.client.HTTPConnection(host, port)
        conn.request('POST', '/kill_server')
        response = conn.getresponse()
        print("HTTP status code:", response.getcode(), end=', ')
--- a/tests/conf/makecerts.sh
+++ b/tests/conf/makecerts.sh
@ -1,448 +0,0 @@
-#!/bin/bash
-
-result=0
-
-test_result() {
-  if test "$1" -eq 0
-    then
-      printf "Succeeded\n" >> "makecerts.log"
-    else
-      printf "Failed\n" >> "makecerts.log"
-    fi
-}
-
-make_certs() {
-  password=passme
-  result_path=$(pwd)
-  cd $(dirname "$0")
-  script_path=$(pwd)
-  cd "${result_path}"
-  mkdir "tmp/"
-
-################################################################################
-# OpenSSL settings
-################################################################################
-
-  if test -n "$1"
-    then
-      OPENSSL="$1/bin/openssl"
-      export LD_LIBRARY_PATH="$1/lib:$1/lib64"
-    else
-      OPENSSL=openssl
-    fi
-
-  mkdir "CA/" 2>> "makecerts.log" 1>&2
-  touch "CA/index.txt"
-  echo -n "unique_subject = no" > "CA/index.txt.attr"
-  $OPENSSL rand -hex 16 > "CA/serial"
-  $OPENSSL rand -hex 16 > "tmp/tsa-serial"
-  echo 1001 > "CA/crlnumber"
-  date > "makecerts.log"
-  "$OPENSSL" version 2>> "makecerts.log" 1>&2
-  echo -n "$password" > tmp/password.txt
-
-################################################################################
-# Root CA certificates
-################################################################################
-
-  printf "\nGenerate trusted root CA certificate\n" >> "makecerts.log"
- "$OPENSSL" genrsa -out CA/CAroot.key \
-      2>> "makecerts.log" 1>&2
-  test_result $?
-  TZ=GMT faketime -f '@2017-01-01 00:00:00' /bin/bash -c '
-    script_path=$(pwd)
-    OPENSSL="$0"
-    export LD_LIBRARY_PATH="$1"
-    CONF="${script_path}/openssl_root.cnf"
-    "$OPENSSL" req -config "$CONF" -new -x509 -days 7300 -key CA/CAroot.key -out tmp/CAroot.pem \
-        -subj "/C=PL/O=osslsigncode/OU=Certification Authority/CN=Trusted Root CA" \
-        2>> "makecerts.log" 1>&2' "$OPENSSL" "$LD_LIBRARY_PATH"
-  test_result $?
-
-  printf "\nPrepare the Certificate Signing Request (CSR)\n" >> "makecerts.log"
-  "$OPENSSL" genrsa -out CA/CA.key \
-      2>> "makecerts.log" 1>&2
-  TZ=GMT faketime -f '@2017-01-01 00:00:00' /bin/bash -c '
-    script_path=$(pwd)
-    OPENSSL="$0"
-    export LD_LIBRARY_PATH="$1"
-    CONF="${script_path}/openssl_root.cnf"
-    "$OPENSSL" req -config "$CONF" -new -key CA/CA.key -out CA/CACert.csr \
-        -subj "/C=PL/O=osslsigncode/OU=Certification Authority/CN=Root CA" \
-        2>> "makecerts.log" 1>&2' "$OPENSSL" "$LD_LIBRARY_PATH"
-  test_result $?
-
-  printf "\nGenerate Self-signed root CA certificate\n" >> "makecerts.log"
-  TZ=GMT faketime -f '@2017-01-01 00:00:00' /bin/bash -c '
-    script_path=$(pwd)
-    OPENSSL="$0"
-    export LD_LIBRARY_PATH="$1"
-    CONF="${script_path}/openssl_root.cnf"
-    "$OPENSSL" x509 -req -days 7300 -extfile "$CONF" -extensions ca_extensions \
-        -signkey CA/CA.key \
-        -in CA/CACert.csr -out tmp/CACert.pem \
-        2>> "makecerts.log" 1>&2' "$OPENSSL" "$LD_LIBRARY_PATH"
-  test_result $?
-
-  printf "\nGenerate Cross-signed root CA certificate\n" >> "makecerts.log"
-  TZ=GMT faketime -f '@2018-01-01 00:00:00' /bin/bash -c '
-    script_path=$(pwd)
-    OPENSSL="$0"
-    export LD_LIBRARY_PATH="$1"
-    CONF="${script_path}/openssl_root.cnf"
-    "$OPENSSL" x509 -req -days 7300 -extfile "$CONF" -extensions ca_extensions \
-        -CA tmp/CAroot.pem -CAkey CA/CAroot.key -CAserial CA/CAroot.srl \
-        -CAcreateserial -in CA/CACert.csr -out tmp/CAcross.pem \
-        2>> "makecerts.log" 1>&2' "$OPENSSL" "$LD_LIBRARY_PATH"
-  test_result $?
-
-################################################################################
-# Private RSA keys
-################################################################################
-
-  printf "\nGenerate private RSA encrypted key\n" >> "makecerts.log"
-  "$OPENSSL" genrsa -des3 -out CA/private.key -passout pass:"$password" \
-      2>> "makecerts.log" 1>&2
-  test_result $?
-  cat CA/private.key >> tmp/keyp.pem 2>> "makecerts.log"
-  test_result $?
-
-  printf "\nGenerate private RSA decrypted key\n" >> "makecerts.log"
-  "$OPENSSL" rsa -in CA/private.key -passin pass:"$password" -out tmp/key.pem \
-      2>> "makecerts.log" 1>&2
-  test_result $?
-
-  printf "\nConvert the key to DER format\n" >> "makecerts.log"
-  "$OPENSSL" rsa -in tmp/key.pem -outform DER -out tmp/key.der -passout pass:"$password" \
-      2>> "makecerts.log" 1>&2
-  test_result $?
-
-  printf "\nConvert the key to PVK format\n" >> "makecerts.log"
-  "$OPENSSL" rsa -in tmp/key.pem -outform PVK -out tmp/key.pvk -pvk-none \
-      2>> "makecerts.log" 1>&2
-  test_result $?
-
-################################################################################
-# Intermediate CA certificates
-################################################################################
-
-  CONF="${script_path}/openssl_intermediate.cnf"
-
-  printf "\nGenerate intermediate CA certificate\n" >> "makecerts.log"
-  "$OPENSSL" genrsa -out CA/intermediateCA.key \
-        2>> "makecerts.log" 1>&2
-    TZ=GMT faketime -f '@2017-01-01 00:00:00' /bin/bash -c '
-    script_path=$(pwd)
-    OPENSSL="$0"
-    export LD_LIBRARY_PATH="$1"
-    CONF="${script_path}/openssl_intermediate.cnf"
-    "$OPENSSL" req -config "$CONF" -new -key CA/intermediateCA.key -out CA/intermediateCA.csr \
-        -subj "/C=PL/O=osslsigncode/OU=Certification Authority/CN=Intermediate CA" \
-        2>> "makecerts.log" 1>&2' "$OPENSSL" "$LD_LIBRARY_PATH"
-  test_result $?
-  TZ=GMT faketime -f '@2017-01-01 00:00:00' /bin/bash -c '
-    script_path=$(pwd)
-    OPENSSL="$0"
-    export LD_LIBRARY_PATH="$1"
-    CONF="${script_path}/openssl_root.cnf"
-    "$OPENSSL" ca -config "$CONF" -batch -in CA/intermediateCA.csr -out CA/intermediateCA.cer \
-        2>> "makecerts.log" 1>&2' "$OPENSSL" "$LD_LIBRARY_PATH"
-  test_result $?
-  "$OPENSSL" x509 -in CA/intermediateCA.cer -out tmp/intermediateCA.pem \
-      2>> "makecerts.log" 1>&2
-  test_result $?
-
-  printf "\nGenerate a certificate to revoke\n" >> "makecerts.log"
-  "$OPENSSL" req -config "$CONF" -new -key CA/private.key -passin pass:"$password" -out CA/revoked.csr \
-      -subj "/C=PL/O=osslsigncode/OU=CSP/CN=Revoked/emailAddress=osslsigncode@example.com" \
-      2>> "makecerts.log" 1>&2
-  test_result $?
-  "$OPENSSL" ca -config "$CONF" -batch -in CA/revoked.csr -out CA/revoked.cer \
-      2>> "makecerts.log" 1>&2
-  test_result $?
-  "$OPENSSL" x509 -in CA/revoked.cer -out tmp/revoked.pem \
-      2>> "makecerts.log" 1>&2
-  test_result $?
-
-  printf "\nRevoke above certificate\n" >> "makecerts.log"
-  "$OPENSSL" ca -config "$CONF" -revoke CA/revoked.cer \
-      2>> "makecerts.log" 1>&2
-  test_result $?
-
-  printf "\nAttach intermediate certificate to revoked certificate\n" >> "makecerts.log"
-  cat tmp/intermediateCA.pem >> tmp/revoked.pem 2>> "makecerts.log"
-  test_result $?
-
-  printf "\nGenerate CRL file\n" >> "makecerts.log"
-  TZ=GMT faketime -f '@2019-01-01 00:00:00' /bin/bash -c '
-    script_path=$(pwd)
-    OPENSSL="$0"
-    export LD_LIBRARY_PATH="$1"
-    CONF="${script_path}/openssl_intermediate.cnf"
-    "$OPENSSL" ca -config "$CONF" -gencrl -crldays 8766 -out tmp/CACertCRL.pem \
-        2>> "makecerts.log" 1>&2' "$OPENSSL" "$LD_LIBRARY_PATH"
-  test_result $?
-
-  printf "\nGenerate code signing certificate\n" >> "makecerts.log"
-  "$OPENSSL" req -config "$CONF" -new -key CA/private.key -passin pass:"$password" -out CA/cert.csr \
-      -subj "/C=PL/ST=Mazovia Province/L=Warsaw/O=osslsigncode/OU=CSP/CN=Certificate/emailAddress=osslsigncode@example.com" \
-      2>> "makecerts.log" 1>&2
-  test_result $?
-  "$OPENSSL" ca -config "$CONF" -batch -in CA/cert.csr -out CA/cert.cer \
-      2>> "makecerts.log" 1>&2
-  test_result $?
-  "$OPENSSL" x509 -in CA/cert.cer -out tmp/cert.pem \
-      2>> "makecerts.log" 1>&2
-  test_result $?
-
-  printf "\nConvert the certificate to DER format\n" >> "makecerts.log"
-  "$OPENSSL" x509 -in tmp/cert.pem -outform DER -out tmp/cert.der \
-      2>> "makecerts.log" 1>&2
-  test_result $?
-
-  printf "\nAttach intermediate certificate to code signing certificate\n" >> "makecerts.log"
-  cat tmp/intermediateCA.pem >> tmp/cert.pem 2>> "makecerts.log"
-  test_result $?
-
-  printf "\nConvert the certificate to SPC format\n" >> "makecerts.log"
-  "$OPENSSL" crl2pkcs7 -nocrl -certfile tmp/cert.pem -outform DER -out tmp/cert.spc \
-      2>> "makecerts.log" 1>&2
-  test_result $?
-
-  ssl_version=$("$OPENSSL" version)
-  if test "${ssl_version:8:1}" -eq 3
-  then
-    printf "\nConvert the certificate and the key into legacy PKCS#12 container with\
- RC2-40-CBC private key and certificate encryption algorithm\n" >> "makecerts.log"
-    "$OPENSSL" pkcs12 -export -in tmp/cert.pem -inkey tmp/key.pem -out tmp/legacy.p12 -passout pass:"$password" \
-        -keypbe rc2-40-cbc -certpbe rc2-40-cbc -legacy \
-        2>> "makecerts.log" 1>&2
-  else
-    printf "\nConvert the certificate and the key into legacy PKCS#12 container with\
- RC2-40-CBC private key and certificate encryption algorithm\n" >> "makecerts.log"
-    "$OPENSSL" pkcs12 -export -in tmp/cert.pem -inkey tmp/key.pem -out tmp/legacy.p12 -passout pass:"$password" \
-        -keypbe rc2-40-cbc -certpbe rc2-40-cbc \
-        2>> "makecerts.log" 1>&2
-  fi
-  test_result $?
-
-  printf "\nConvert the certificate and the key into a PKCS#12 container with\
-  AES-256-CBC private key and certificate encryption algorithm\n" >> "makecerts.log"
-  "$OPENSSL" pkcs12 -export -in tmp/cert.pem -inkey tmp/key.pem -out tmp/cert.p12 -passout pass:"$password" \
-      -keypbe aes-256-cbc -certpbe aes-256-cbc \
-      2>> "makecerts.log" 1>&2
-  test_result $?
-
-  printf "\nGenerate expired certificate\n" >> "makecerts.log"
-  "$OPENSSL" req -config "$CONF" -new -key CA/private.key -passin pass:"$password" -out CA/expired.csr \
-      -subj "/C=PL/ST=Mazovia Province/L=Warsaw/O=osslsigncode/OU=CSP/CN=Expired/emailAddress=osslsigncode@example.com" \
-      2>> "makecerts.log" 1>&2
-  test_result $?
-  "$OPENSSL" ca -config "$CONF" -enddate "190101000000Z" -batch -in CA/expired.csr -out CA/expired.cer \
-      2>> "makecerts.log" 1>&2
-  test_result $?
-  "$OPENSSL" x509 -in CA/expired.cer -out tmp/expired.pem \
-      2>> "makecerts.log" 1>&2
-  test_result $?
-
-  printf "\nAttach intermediate certificate to expired certificate\n" >> "makecerts.log"
-  cat tmp/intermediateCA.pem >> tmp/expired.pem 2>> "makecerts.log"
-  test_result $?
-
-
-################################################################################
-# Intermediate CA certificates with CRL distribution point
-################################################################################
-
-  CONF="${script_path}/openssl_intermediate_crldp.cnf"
-
-  printf "\nGenerate intermediate CA certificate with CRL distribution point\n" >> "makecerts.log"
-  "$OPENSSL" genrsa -out CA/intermediateCA_crldp.key \
-        2>> "makecerts.log" 1>&2
-    TZ=GMT faketime -f '@2017-01-01 00:00:00' /bin/bash -c '
-    script_path=$(pwd)
-    OPENSSL="$0"
-    export LD_LIBRARY_PATH="$1"
-    CONF="${script_path}/openssl_intermediate_crldp.cnf"
-    "$OPENSSL" req -config "$CONF" -new -key CA/intermediateCA_crldp.key -out CA/intermediateCA_crldp.csr \
-        -subj "/C=PL/O=osslsigncode/OU=Certification Authority/CN=Intermediate CA CRL DP" \
-        2>> "makecerts.log" 1>&2' "$OPENSSL" "$LD_LIBRARY_PATH"
-  test_result $?
-  TZ=GMT faketime -f '@2017-01-01 00:00:00' /bin/bash -c '
-    script_path=$(pwd)
-    OPENSSL="$0"
-    export LD_LIBRARY_PATH="$1"
-    CONF="${script_path}/openssl_root.cnf"
-    "$OPENSSL" ca -config "$CONF" -batch -in CA/intermediateCA_crldp.csr -out CA/intermediateCA_crldp.cer \
-        2>> "makecerts.log" 1>&2' "$OPENSSL" "$LD_LIBRARY_PATH"
-  test_result $?
-  "$OPENSSL" x509 -in CA/intermediateCA_crldp.cer -out tmp/intermediateCA_crldp.pem \
-      2>> "makecerts.log" 1>&2
-  test_result $?
-
-  printf "\nGenerate a certificate with X509v3 CRL Distribution Points extension to revoke\n" >> "makecerts.log"
-  "$OPENSSL" req -config "$CONF" -new -key CA/private.key -passin pass:"$password" -out CA/revoked_crldp.csr \
-      -subj "/C=PL/O=osslsigncode/OU=CSP/CN=Revoked X509v3 CRL DP/emailAddress=osslsigncode@example.com" \
-      2>> "makecerts.log" 1>&2
-  test_result $?
-  "$OPENSSL" ca -config "$CONF" -batch -in CA/revoked_crldp.csr -out CA/revoked_crldp.cer \
-      2>> "makecerts.log" 1>&2
-  test_result $?
-  "$OPENSSL" x509 -in CA/revoked_crldp.cer -out tmp/revoked_crldp.pem \
-      2>> "makecerts.log" 1>&2
-  test_result $?
-
-  printf "\nRevoke above certificate\n" >> "makecerts.log"
-  "$OPENSSL" ca -config "$CONF" -revoke CA/revoked_crldp.cer \
-      2>> "makecerts.log" 1>&2
-  test_result $?
-
-  printf "\nAttach intermediate certificate to revoked certificate\n" >> "makecerts.log"
-  cat tmp/intermediateCA_crldp.pem >> tmp/revoked_crldp.pem 2>> "makecerts.log"
-  test_result $?
-
-  printf "\nGenerate CRL file\n" >> "makecerts.log"
-  TZ=GMT faketime -f '@2019-01-01 00:00:00' /bin/bash -c '
-    script_path=$(pwd)
-    OPENSSL="$0"
-    export LD_LIBRARY_PATH="$1"
-    CONF="${script_path}/openssl_intermediate_crldp.cnf"
-    "$OPENSSL" ca -config "$CONF" -gencrl -crldays 8766 -out tmp/CACertCRL_crldp.pem \
-        2>> "makecerts.log" 1>&2' "$OPENSSL" "$LD_LIBRARY_PATH"
-  test_result $?
-
-  printf "\nConvert CRL file from PEM to DER (for CRL Distribution Points server to use) \n" >> "makecerts.log"
-  "$OPENSSL" crl -in tmp/CACertCRL_crldp.pem -inform PEM -out tmp/CACertCRL.der -outform DER \
-      2>> "makecerts.log" 1>&2
-  test_result $?
-
-  printf "\nGenerate code signing certificate with X509v3 CRL Distribution Points extension\n" >> "makecerts.log"
-  "$OPENSSL" req -config "$CONF" -new -key CA/private.key -passin pass:"$password" -out CA/cert_crldp.csr \
-      -subj "/C=PL/ST=Mazovia Province/L=Warsaw/O=osslsigncode/OU=CSP/CN=Certificate X509v3 CRL DP/emailAddress=osslsigncode@example.com" \
-      2>> "makecerts.log" 1>&2
-  test_result $?
-  "$OPENSSL" ca -config "$CONF" -batch -in CA/cert_crldp.csr -out CA/cert_crldp.cer \
-      2>> "makecerts.log" 1>&2
-  test_result $?
-  "$OPENSSL" x509 -in CA/cert_crldp.cer -out tmp/cert_crldp.pem \
-      2>> "makecerts.log" 1>&2
-  test_result $?
-
-  printf "\nAttach intermediate certificate to code signing certificate\n" >> "makecerts.log"
-  cat tmp/intermediateCA_crldp.pem >> tmp/cert_crldp.pem 2>> "makecerts.log"
-  test_result $?
-
-################################################################################
-# Time Stamp Authority certificates
-################################################################################
-  printf "\nGenerate Root CA TSA certificate\n" >> "makecerts.log"
-  "$OPENSSL" genrsa -out CA/TSACA.key \
-      2>> "makecerts.log" 1>&2
-  TZ=GMT faketime -f '@2017-01-01 00:00:00' /bin/bash -c '
-    script_path=$(pwd)
-    OPENSSL="$0"
-    export LD_LIBRARY_PATH="$1"
-    CONF="${script_path}/openssl_tsa_root.cnf"
-    "$OPENSSL" req -config "$CONF" -new -x509 -days 7300 -key CA/TSACA.key -out tmp/TSACA.pem \
-        2>> "makecerts.log" 1>&2' "$OPENSSL" "$LD_LIBRARY_PATH"
-  test_result $?
-
-  printf "\nGenerate TSA certificate to revoke\n" >> "makecerts.log"
-  CONF="${script_path}/openssl_tsa_root.cnf"
-  "$OPENSSL" req -config "$CONF" -new -nodes -keyout tmp/TSA_revoked.key -out CA/TSA_revoked.csr \
-      -subj "/C=PL/O=osslsigncode/OU=TSA/CN=Revoked/emailAddress=osslsigncode@example.com" \
-      2>> "makecerts.log" 1>&2
-  test_result $?
-  CONF="${script_path}/openssl_tsa_root.cnf"
-  "$OPENSSL" ca -config "$CONF" -batch -in CA/TSA_revoked.csr -out CA/TSA_revoked.cer \
-      2>> "makecerts.log" 1>&2
-  test_result $?
-  "$OPENSSL" x509 -in CA/TSA_revoked.cer -out tmp/TSA_revoked.pem \
-      2>> "makecerts.log" 1>&2
-  test_result $?
-
-  printf "\nRevoke above certificate\n" >> "makecerts.log"
-  "$OPENSSL" ca -config "$CONF" -revoke CA/TSA_revoked.cer \
-      2>> "makecerts.log" 1>&2
-  test_result $?
-
-  printf "\nGenerate TSA CRL file\n" >> "makecerts.log"
-  TZ=GMT faketime -f '@2019-01-01 00:00:00' /bin/bash -c '
-    script_path=$(pwd)
-    OPENSSL="$0"
-    export LD_LIBRARY_PATH="$1"
-    CONF="${script_path}/openssl_tsa_root.cnf"
-    "$OPENSSL" ca -config "$CONF" -gencrl -crldays 8766 -out tmp/TSACertCRL.pem \
-        2>> "makecerts.log" 1>&2' "$OPENSSL" "$LD_LIBRARY_PATH"
-  test_result $?
-
-  printf "\nConvert TSA CRL file from PEM to DER (for CRL Distribution Points server to use)\n" >> "makecerts.log"
-  "$OPENSSL" crl -in tmp/TSACertCRL.pem -inform PEM -out tmp/TSACertCRL.der -outform DER \
-      2>> "makecerts.log" 1>&2
-  test_result $?
-
-  printf "\nGenerate TSA certificate\n" >> "makecerts.log"
-  CONF="${script_path}/openssl_tsa.cnf"
-  "$OPENSSL" req -config "$CONF" -new -nodes -keyout tmp/TSA.key -out CA/TSA.csr \
-      2>> "makecerts.log" 1>&2
-  test_result $?
-  CONF="${script_path}/openssl_tsa_root.cnf"
-  "$OPENSSL" ca -config "$CONF" -batch -in CA/TSA.csr -out CA/TSA.cer \
-      2>> "makecerts.log" 1>&2
-  test_result $?
-  "$OPENSSL" x509 -in CA/TSA.cer -out tmp/TSA.pem \
-      2>> "makecerts.log" 1>&2
-  test_result $?
-
-  printf "\nSave the chain to be included in the TSA response\n" >> "makecerts.log"
-  cat tmp/TSA.pem tmp/TSACA.pem > tmp/tsa-chain.pem 2>> "makecerts.log"
-
-################################################################################
-# Copy new files
-################################################################################
-
-  if test -s tmp/CACert.pem -a -s tmp/CAcross.pem -a -s tmp/CAroot.pem  \
-      -a -s tmp/intermediateCA.pem -a -s tmp/intermediateCA_crldp.pem \
-      -a -s tmp/CACertCRL.pem -a -s tmp/CACertCRL.der \
-      -a -s tmp/TSACertCRL.pem -a -s tmp/TSACertCRL.der \
-      -a -s tmp/key.pem -a -s tmp/keyp.pem -a -s tmp/key.der -a -s tmp/key.pvk \
-      -a -s tmp/cert.pem -a -s tmp/cert.der -a -s tmp/cert.spc \
-      -a -s tmp/cert.p12 -a -s tmp/legacy.p12 -a -s tmp/cert_crldp.pem\
-      -a -s tmp/expired.pem \
-      -a -s tmp/revoked.pem -a -s tmp/revoked_crldp.pem \
-      -a -s tmp/TSA_revoked.pem \
-      -a -s tmp/TSA.pem -a -s tmp/TSA.key -a -s tmp/tsa-chain.pem
-  then
-    mkdir -p "../certs"
-    cp tmp/* ../certs
-    printf "%s" "Keys & certificates successfully generated"
-  else
-    printf "%s" "Error logs ${result_path}/makecerts.log"
-    result=1
-  fi
-
-################################################################################
-# Remove the working directory
-################################################################################
-
-  rm -rf "CA/"
-  rm -rf "tmp/"
-
-  exit "$result"
-}
-
-
-################################################################################
-# Tests requirement and make certs
-################################################################################
-
-if test -n "$(command -v faketime)"
-  then
-    make_certs "$1"
-    result=$?
-  else
-    printf "%s" "faketime not found in \$PATH, please install faketime package"
-    result=1
-  fi
-
-exit "$result"
--- a/tests/conf/openssl_intermediate.cnf
+++ b/tests/conf/openssl_intermediate.cnf
@ -1,73 +0,0 @@
-# OpenSSL intermediate CA configuration file
-
-[ default ]
-name                            = intermediateCA
-default_ca                      = CA_default
-
-[ CA_default ]
-# Directory and file locations
-dir                             = .
-certs                           = $dir/CA
-crl_dir                         = $dir/CA
-new_certs_dir                   = $dir/CA
-database                        = $dir/CA/index.txt
-serial                          = $dir/CA/serial
-rand_serial                     = yes
-private_key                     = $dir/CA/$name.key
-certificate                     = $dir/tmp/$name.pem
-crlnumber                       = $dir/CA/crlnumber
-crl_extensions                  = crl_ext
-default_md                      = sha256
-preserve                        = no
-policy                          = policy_loose
-default_startdate               = 20180101000000Z
-default_enddate                 = 20341231000000Z
-x509_extensions                 = v3_req
-email_in_dn                     = yes
-default_days                    = 2200
-
-[ req ]
-# Options for the `req` tool
-encrypt_key                     = no
-default_bits                    = 2048
-default_md                      = sha256
-string_mask                     = utf8only
-distinguished_name              = req_distinguished_name
-x509_extensions                 = usr_extensions
-
-[ crl_ext ]
-# Extension for CRLs
-authorityKeyIdentifier          = keyid:always
-
-[ usr_extensions ]
-# Extension to add when the -x509 option is used
-basicConstraints                = CA:FALSE
-subjectKeyIdentifier            = hash
-authorityKeyIdentifier          = keyid, issuer
-extendedKeyUsage                = codeSigning
-
-[ v3_req ]
-basicConstraints                = CA:FALSE
-subjectKeyIdentifier            = hash
-authorityKeyIdentifier          = keyid, issuer
-extendedKeyUsage                = codeSigning
-
-[ policy_loose ]
-# Allow the intermediate CA to sign a more diverse range of certificates.
-# See the POLICY FORMAT section of the `ca` man page.
-countryName                     = optional
-stateOrProvinceName             = optional
-localityName                    = optional
-organizationName                = optional
-organizationalUnitName          = optional
-commonName                      = supplied
-emailAddress                    = optional
-
-[ req_distinguished_name ]
-countryName                     = Country Name (2 letter code)
-stateOrProvinceName             = State or Province Name
-localityName                    = Locality Name
-0.organizationName              = Organization Name
-organizationalUnitName          = Organizational Unit Name
-commonName                      = Common Name
-emailAddress                    = Email Address
--- a/tests/conf/openssl_intermediate_crldp.cnf
+++ b/tests/conf/openssl_intermediate_crldp.cnf
@ -1,79 +0,0 @@
-# OpenSSL intermediate CA configuration file
-
-[ default ]
-name                            = intermediateCA
-default_ca                      = CA_default
-crl_url                         = http://127.0.0.1:19254/$name
-
-[ CA_default ]
-# Directory and file locations
-dir                             = .
-certs                           = $dir/CA
-crl_dir                         = $dir/CA
-new_certs_dir                   = $dir/CA
-database                        = $dir/CA/index.txt
-serial                          = $dir/CA/serial
-rand_serial                     = yes
-private_key                     = $dir/CA/$name\_crldp.key
-certificate                     = $dir/tmp/$name\_crldp.pem
-crlnumber                       = $dir/CA/crlnumber
-crl_extensions                  = crl_ext
-default_md                      = sha256
-preserve                        = no
-policy                          = policy_loose
-default_startdate               = 20180101000000Z
-default_enddate                 = 20341231000000Z
-x509_extensions                 = v3_req
-email_in_dn                     = yes
-default_days                    = 2200
-
-[ req ]
-# Options for the `req` tool
-encrypt_key                     = no
-default_bits                    = 2048
-default_md                      = sha256
-string_mask                     = utf8only
-distinguished_name              = req_distinguished_name
-x509_extensions                 = usr_extensions
-
-[ crl_ext ]
-# Extension for CRLs
-authorityKeyIdentifier          = keyid:always
-
-[ usr_extensions ]
-# Extension to add when the -x509 option is used
-basicConstraints                = CA:FALSE
-subjectKeyIdentifier            = hash
-authorityKeyIdentifier          = keyid, issuer
-extendedKeyUsage                = codeSigning
-
-[ v3_req ]
-basicConstraints                = CA:FALSE
-subjectKeyIdentifier            = hash
-authorityKeyIdentifier          = keyid, issuer
-extendedKeyUsage                = codeSigning
-crlDistributionPoints           = @crl_info
-
-[ crl_info ]
-# X509v3 CRL Distribution Points extension
-URI.0                           = $crl_url
-
-[ policy_loose ]
-# Allow the intermediate CA to sign a more diverse range of certificates.
-# See the POLICY FORMAT section of the `ca` man page.
-countryName                     = optional
-stateOrProvinceName             = optional
-localityName                    = optional
-organizationName                = optional
-organizationalUnitName          = optional
-commonName                      = supplied
-emailAddress                    = optional
-
-[ req_distinguished_name ]
-countryName                     = Country Name (2 letter code)
-stateOrProvinceName             = State or Province Name
-localityName                    = Locality Name
-0.organizationName              = Organization Name
-organizationalUnitName          = Organizational Unit Name
-commonName                      = Common Name
-emailAddress                    = Email Address
--- a/tests/conf/openssl_root.cnf
+++ b/tests/conf/openssl_root.cnf
@ -1,65 +0,0 @@
-# OpenSSL root CA configuration file
-
-[ ca ]
-default_ca                      = CA_default
-
-[ CA_default ]
-# Directory and file locations.
-dir                             = .
-certs                           = $dir/CA
-crl_dir                         = $dir/CA
-new_certs_dir                   = $dir/CA
-database                        = $dir/CA/index.txt
-serial                          = $dir/CA/serial
-rand_serial                     = yes
-private_key                     = $dir/CA/CA.key
-certificate                     = $dir/tmp/CACert.pem
-crl_extensions                  = crl_ext
-default_md                      = sha256
-preserve                        = no
-policy                          = policy_match
-default_startdate               = 20180101000000Z
-default_enddate                 = 20360101000000Z
-x509_extensions                 = v3_intermediate_ca
-email_in_dn                     = yes
-default_days                    = 3000
-unique_subject                  = no
-
-[ req ]
-# Options for the `req` tool
-encrypt_key                     = no
-default_bits                    = 2048
-default_md                      = sha256
-string_mask                     = utf8only
-x509_extensions                 = ca_extensions
-distinguished_name              = req_distinguished_name
-
-[ ca_extensions ]
-# Extension to add when the -x509 option is used
-basicConstraints                = critical, CA:true
-subjectKeyIdentifier            = hash
-authorityKeyIdentifier          = keyid:always,issuer
-keyUsage                        = critical, digitalSignature, cRLSign, keyCertSign
-
-[ v3_intermediate_ca ]
-# Extensions for a typical intermediate CA (`man x509v3_config`)
-basicConstraints                = critical, CA:true, pathlen:0
-subjectKeyIdentifier            = hash
-authorityKeyIdentifier          = keyid:always,issuer
-keyUsage                        = critical, digitalSignature, cRLSign, keyCertSign
-
-[ policy_match ]
-countryName                     = match
-organizationName                = match
-organizationalUnitName          = optional
-commonName                      = supplied
-emailAddress                    = optional
-
-[ req_distinguished_name ]
-countryName                     = Country Name (2 letter code)
-stateOrProvinceName             = State or Province Name
-localityName                    = Locality Name
-0.organizationName              = Organization Name
-organizationalUnitName          = Organizational Unit Name
-commonName                      = Common Name
-emailAddress                    = Email Address
--- a/tests/conf/openssl_tsa.cnf
+++ b/tests/conf/openssl_tsa.cnf
@ -44,3 +44,4 @@ ordering                        = yes
 tsa_name                        = yes
 ess_cert_id_chain               = yes
 ess_cert_id_alg                 = sha256
+crypto_device                   = builtin
--- a/tests/conf/openssl_tsa_root.cnf
+++ b/tests/conf/openssl_tsa_root.cnf
@ -1,83 +0,0 @@
-# OpenSSL Root Timestamp Authority configuration file
-
-[ default ]
-name                            = TSACA
-domain_suffix                   = timestampauthority
-crl_url                         = http://127.0.0.1:19254/$name
-name_opt                        = utf8, esc_ctrl, multiline, lname, align
-default_ca                      = CA_default
-
-[ CA_default ]
-dir                             = .
-certs                           = $dir/CA
-crl_dir                         = $dir/CA
-new_certs_dir                   = $dir/CA
-database                        = $dir/CA/index.txt
-serial                          = $dir/CA/serial
-crlnumber                       = $dir/CA/crlnumber
-crl_extensions                  = crl_ext
-rand_serial                     = yes
-private_key                     = $dir/CA/$name.key
-certificate                     = $dir/tmp/$name.pem
-default_md                      = sha256
-default_days                    = 3650
-default_crl_days                = 365
-policy                          = policy_match
-default_startdate               = 20180101000000Z
-default_enddate                 = 20380101000000Z
-unique_subject                  = no
-email_in_dn                     = no
-x509_extensions                 = tsa_extensions
-
-[ policy_match ]
-countryName                     = match
-stateOrProvinceName             = optional
-organizationName                = match
-organizationalUnitName          = optional
-commonName                      = supplied
-emailAddress                    = optional
-
-[ tsa_extensions ]
-basicConstraints                = critical, CA:false
-extendedKeyUsage                = critical, timeStamping
-subjectKeyIdentifier            = hash
-authorityKeyIdentifier          = keyid:always
-crlDistributionPoints           = @crl_info
-nameConstraints                 = @name_constraints
-
-[ crl_info ]
-# X509v3 CRL Distribution Points extension
-URI.0                           = $crl_url
-
-[ crl_ext ]
-# Extension for CRLs
-authorityKeyIdentifier          = keyid:always
-
-[ name_constraints ]
-permitted;DNS.0=test.com
-permitted;DNS.1=test.org
-excluded;IP.0=0.0.0.0/0.0.0.0
-excluded;IP.1=0:0:0:0:0:0:0:0/0:0:0:0:0:0:0:0
-
-[ req ]
-# Options for the `req` tool
-default_bits                    = 2048
-encrypt_key                     = yes
-default_md                      = sha256
-utf8                            = yes
-string_mask                     = utf8only
-prompt                          = no
-distinguished_name              = ca_distinguished_name
-x509_extensions                 = ca_extensions
-
-[ ca_distinguished_name ]
-countryName                     = "PL"
-organizationName                = "osslsigncode"
-organizationalUnitName          = "Timestamp Authority Root CA"
-commonName                      = "TSA Root CA"
-
-[ ca_extensions ]
-# Extension to add when the -x509 option is used
-basicConstraints                = critical, CA:true
-subjectKeyIdentifier            = hash
-keyUsage                        = critical, keyCertSign, cRLSign
--- a/tests/exec.py
+++ b/tests/exec.py
@ -0,0 +1,47 @@
+#!/usr/bin/python3
+"""Implementation of a single ctest script."""
+
+import sys
+from subprocess import Popen, PIPE
+
+
+def parse(value):
+    """Read parameter from file."""
+    prefix = 'FILE '
+    if value.startswith(prefix):
+        with open(value[len(prefix):], mode="r", encoding="utf-8") as file:
+            return file.read().strip()
+    return value
+
+
+def main() -> None:
+    """Run osslsigncode with its options."""
+    if len(sys.argv) > 1:
+        try:
+            params = map(parse, sys.argv[1:])
+            proc = Popen(params, stdout=PIPE, stderr=PIPE, text=True)
+            stdout, stderr = proc.communicate()
+            print(stdout, file=sys.stderr)
+            if stderr:
+                print("Error:\n" + "-" * 58 + "\n" + stderr, file=sys.stderr)
+            sys.exit(proc.returncode)
+        except Exception as err: # pylint: disable=broad-except
+            # all exceptions are critical
+            print(err, file=sys.stderr)
+    else:
+        print("Usage:\n\t{} COMMAND [ARG]...'".format(sys.argv[0]), file=sys.stderr)
+    sys.exit(1)
+
+
+if __name__ == "__main__":
+    main()
+
+
+# pylint: disable=pointless-string-statement
+"""Local Variables:
+    c-basic-offset: 4
+    tab-width: 4
+    indent-tabs-mode: nil
+End:
+    vim: set ts=4 expandtab:
+"""
--- a/tests/make_certificates.py
+++ b/tests/make_certificates.py
@ -0,0 +1,532 @@
+#!/usr/bin/python3
+"""Make test certificates"""
+
+import os
+import datetime
+import cryptography
+from cryptography import x509
+from cryptography.x509.oid import NameOID
+from cryptography.hazmat.primitives import hashes
+from cryptography.hazmat.primitives import serialization
+from cryptography.hazmat.primitives.asymmetric import rsa
+
+RESULT_PATH = os.getcwd()
+CERTS_PATH = os.path.join(RESULT_PATH, "./Testing/certs/")
+
+date_20170101 = datetime.datetime(2017, 1, 1)
+date_20180101 = datetime.datetime(2018, 1, 1)
+date_20190101 = datetime.datetime(2019, 1, 1)
+
+PASSWORD='passme'
+
+
+class X509Extensions():
+    """Base class for X509 Extensions"""
+
+    def __init__(self, unit_name, cdp_port, cdp_name):
+        self.unit_name = unit_name
+        self.port = cdp_port
+        self.name = cdp_name
+
+    def create_x509_name(self, common_name) -> x509.Name:
+        """Return x509.Name"""
+        return x509.Name(
+            [
+                x509.NameAttribute(NameOID.COUNTRY_NAME, "PL"),
+                x509.NameAttribute(NameOID.STATE_OR_PROVINCE_NAME, "Mazovia Province"),
+                x509.NameAttribute(NameOID.LOCALITY_NAME, "Warsaw"),
+                x509.NameAttribute(NameOID.ORGANIZATION_NAME, "osslsigncode"),
+                x509.NameAttribute(NameOID.ORGANIZATIONAL_UNIT_NAME, self.unit_name),
+                x509.NameAttribute(NameOID.COMMON_NAME, common_name)
+            ]
+        )
+
+    def create_x509_crldp(self) -> x509.CRLDistributionPoints:
+        """Return x509.CRLDistributionPoints"""
+        return x509.CRLDistributionPoints(
+            [
+                x509.DistributionPoint(
+                    full_name=[x509.UniformResourceIdentifier(
+                        "http://127.0.0.1:" + str(self.port) + "/" + str(self.name))
+                    ],
+                    relative_name=None,
+                    reasons=None,
+                    crl_issuer=None
+                )
+            ]
+        )
+
+    def create_x509_name_constraints(self) -> x509.NameConstraints:
+        """Return x509.NameConstraints"""
+        return x509.NameConstraints(
+            permitted_subtrees = [x509.DNSName('test.com'), x509.DNSName('test.org')],
+            excluded_subtrees = None
+        )
+
+class IntermediateCACertificate(X509Extensions):
+    """Base class for Intermediate CA certificate"""
+
+    def __init__(self, issuer_cert, issuer_key):
+        self.issuer_cert = issuer_cert
+        self.issuer_key = issuer_key
+        super().__init__("Certification Authority", 0, None)
+
+    def make_cert(self) -> (x509.Certificate, rsa.RSAPrivateKey):
+        """Generate intermediate CA certificate"""
+        key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
+        key_public = key.public_key()
+        authority_key = x509.AuthorityKeyIdentifier.from_issuer_subject_key_identifier(
+            self.issuer_cert.extensions.get_extension_for_class(x509.SubjectKeyIdentifier).value
+        )
+        key_usage = x509.KeyUsage(
+            digital_signature=True,
+            content_commitment=False,
+            key_encipherment=False,
+            data_encipherment=False,
+            key_agreement=False,
+            key_cert_sign=True,
+            crl_sign=True,
+            encipher_only=False,
+            decipher_only=False
+        )
+        cert = (
+            x509.CertificateBuilder()
+            .subject_name(self.create_x509_name("Intermediate CA"))
+            .issuer_name(self.issuer_cert.subject)
+            .public_key(key_public)
+            .serial_number(x509.random_serial_number())
+            .not_valid_before(date_20180101)
+            .not_valid_after(date_20180101 + datetime.timedelta(days=7300))
+            .add_extension(x509.BasicConstraints(ca=True, path_length=0), critical=True)
+            .add_extension(x509.SubjectKeyIdentifier.from_public_key(key_public), critical=False)
+            .add_extension(authority_key, critical=False)
+            .add_extension(key_usage, critical=True)
+            .sign(self.issuer_key, hashes.SHA256())
+        )
+        file_path=os.path.join(CERTS_PATH, "intermediateCA.pem")
+        with open(file_path, mode="wb") as file:
+            file.write(cert.public_bytes(encoding=serialization.Encoding.PEM))
+
+        return cert, key
+
+
+class RootCACertificate(X509Extensions):
+    """Base class for Root CA certificate"""
+
+    def __init__(self):
+        self.key_usage = x509.KeyUsage(
+            digital_signature=True,
+            content_commitment=False,
+            key_encipherment=False,
+            data_encipherment=False,
+            key_agreement=False,
+            key_cert_sign=True,
+            crl_sign=True,
+            encipher_only=False,
+            decipher_only=False
+        )
+        super().__init__("Certification Authority", 0, None)
+
+    def make_cert(self) -> (x509.Certificate, rsa.RSAPrivateKey):
+        """Generate CA certificates"""
+        ca_root, root_key = self.make_ca_cert("Trusted Root CA", "CAroot.pem")
+        ca_cert, ca_key = self.make_ca_cert("Root CA", "CACert.pem")
+        self.make_cross_cert(ca_root, root_key, ca_cert, ca_key)
+        return ca_cert, ca_key
+
+    def make_ca_cert(self, common_name, file_name) -> None:
+        """Generate self-signed root CA certificate"""
+        ca_key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
+        ca_public = ca_key.public_key()
+        authority_key = x509.AuthorityKeyIdentifier.from_issuer_public_key(ca_public)
+        name = self.create_x509_name(common_name)
+        ca_cert = (
+            x509.CertificateBuilder()
+            .subject_name(name)
+            .issuer_name(name)
+            .public_key(ca_public)
+            .serial_number(x509.random_serial_number())
+            .not_valid_before(date_20170101)
+            .not_valid_after(date_20170101 + datetime.timedelta(days=7300))
+            .add_extension(x509.BasicConstraints(ca=True, path_length=None), critical=True)
+            .add_extension(x509.SubjectKeyIdentifier.from_public_key(ca_public), critical=False)
+            .add_extension(authority_key, critical=False)
+            .add_extension(self.key_usage, critical=True)
+            .sign(ca_key, hashes.SHA256())
+        )
+        file_path=os.path.join(CERTS_PATH, file_name)
+        with open(file_path, mode="wb") as file:
+            file.write(ca_cert.public_bytes(encoding=serialization.Encoding.PEM))
+        return ca_cert, ca_key
+
+    def make_cross_cert(self, ca_root, root_key, ca_cert, ca_key) -> None:
+        """Generate cross-signed root CA certificate"""
+        ca_public = ca_key.public_key()
+        authority_key = x509.AuthorityKeyIdentifier.from_issuer_subject_key_identifier(
+            ca_root.extensions.get_extension_for_class(x509.SubjectKeyIdentifier).value
+        )
+        ca_cross = (
+            x509.CertificateBuilder()
+            .subject_name(ca_cert.subject)
+            .issuer_name(ca_root.subject)
+            .public_key(ca_public)
+            .serial_number(ca_cert.serial_number)
+            .not_valid_before(date_20180101)
+            .not_valid_after(date_20180101 + datetime.timedelta(days=7300))
+            .add_extension(x509.BasicConstraints(ca=True, path_length=None), critical=True)
+            .add_extension(x509.SubjectKeyIdentifier.from_public_key(ca_public), critical=False)
+            .add_extension(authority_key, critical=False)
+            .add_extension(self.key_usage, critical=True)
+            .sign(root_key, hashes.SHA256())
+        )
+        file_path=os.path.join(CERTS_PATH, "CAcross.pem")
+        with open(file_path, mode="wb") as file:
+            file.write(ca_cross.public_bytes(encoding=serialization.Encoding.PEM))
+
+    def write_key(self, key, file_name) -> None:
+        """Write a private RSA key"""
+        # Write password
+        file_path = os.path.join(CERTS_PATH, "password.txt")
+        with open(file_path, mode="w", encoding="utf-8") as file:
+            file.write("{}".format(PASSWORD))
+
+        # Write encrypted key in PEM format
+        file_path = os.path.join(CERTS_PATH, file_name + "p.pem")
+        with open(file_path, mode="wb") as file:
+            file.write(key.private_bytes(
+                encoding=serialization.Encoding.PEM,
+                format=serialization.PrivateFormat.PKCS8,
+                encryption_algorithm=serialization.BestAvailableEncryption(PASSWORD.encode())
+            )
+        )
+        # Write decrypted key in PEM format
+        file_path = os.path.join(CERTS_PATH, file_name + ".pem")
+        with open(file_path, mode="wb") as file:
+            file.write(key.private_bytes(
+                encoding=serialization.Encoding.PEM,
+                format=serialization.PrivateFormat.PKCS8,
+                encryption_algorithm=serialization.NoEncryption()
+            )
+        )
+        # Write the key in DER format
+        file_path = os.path.join(CERTS_PATH, file_name + ".der")
+        with open(file_path, mode="wb") as file:
+            file.write(key.private_bytes(
+                encoding=serialization.Encoding.DER,
+                format=serialization.PrivateFormat.PKCS8,
+                encryption_algorithm=serialization.NoEncryption()
+            )
+        )
+
+
+class TSARootCACertificate(X509Extensions):
+    """Base class for TSA certificates"""
+
+    def __init__(self):
+        super().__init__("Timestamp Authority Root CA", 0, None)
+
+    def make_cert(self) -> (x509.Certificate, rsa.RSAPrivateKey):
+        """Generate a Time Stamp Authority certificate"""
+        ca_key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
+        ca_public = ca_key.public_key()
+        authority_key = x509.AuthorityKeyIdentifier.from_issuer_public_key(ca_public)
+        name = self.create_x509_name("TSA Root CA")
+        key_usage = x509.KeyUsage(
+            digital_signature=False,
+            content_commitment=False,
+            key_encipherment=False,
+            data_encipherment=False,
+            key_agreement=False,
+            key_cert_sign=True,
+            crl_sign=True,
+            encipher_only=False,
+            decipher_only=False
+        )
+        ca_cert = (
+            x509.CertificateBuilder()
+            .subject_name(name)
+            .issuer_name(name)
+            .public_key(ca_public)
+            .serial_number(x509.random_serial_number())
+            .not_valid_before(date_20170101)
+            .not_valid_after(date_20170101 + datetime.timedelta(days=7300))
+            .add_extension(x509.BasicConstraints(ca=True, path_length=None), critical=True)
+            .add_extension(x509.SubjectKeyIdentifier.from_public_key(ca_public), critical=False)
+            .add_extension(authority_key, critical=False)
+            .add_extension(key_usage, critical=True)
+            .sign(ca_key, hashes.SHA256())
+        )
+        file_path=os.path.join(CERTS_PATH, "TSACA.pem")
+        with open(file_path, mode="wb") as file:
+            file.write(ca_cert.public_bytes(encoding=serialization.Encoding.PEM))
+
+        return ca_cert, ca_key
+
+    def write_key(self, key, file_name) -> None:
+        """Write decrypted private RSA key into PEM format"""
+        file_path = os.path.join(CERTS_PATH, file_name + ".key")
+        with open(file_path, mode="wb") as file:
+            file.write(key.private_bytes(
+                encoding=serialization.Encoding.PEM,
+                format=serialization.PrivateFormat.PKCS8,
+                encryption_algorithm=serialization.NoEncryption()
+            )
+        )
+
+
+class Certificate(X509Extensions):
+    """Base class for a leaf certificate"""
+
+    def __init__(self, issuer_cert, issuer_key, unit_name, common_name, cdp_port, cdp_name):
+        #pylint: disable=too-many-arguments
+        self.issuer_cert = issuer_cert
+        self.issuer_key = issuer_key
+        self.common_name = common_name
+        super().__init__(unit_name, cdp_port, cdp_name)
+
+    def make_cert(self, public_key, not_before, days) -> x509.Certificate:
+        """Generate a leaf certificate"""
+        authority_key = x509.AuthorityKeyIdentifier.from_issuer_subject_key_identifier(
+            self.issuer_cert.extensions.get_extension_for_class(x509.SubjectKeyIdentifier).value
+        )
+        extended_key_usage = x509.ExtendedKeyUsage(
+            [x509.oid.ExtendedKeyUsageOID.CODE_SIGNING]
+        )
+        cert = (
+            x509.CertificateBuilder()
+            .subject_name(self.create_x509_name(self.common_name))
+            .issuer_name(self.issuer_cert.subject)
+            .public_key(public_key)
+            .serial_number(x509.random_serial_number())
+            .not_valid_before(not_before)
+            .not_valid_after(not_before + datetime.timedelta(days=days))
+            .add_extension(x509.BasicConstraints(ca=False, path_length=None), critical=False)
+            .add_extension(x509.SubjectKeyIdentifier.from_public_key(public_key), critical=False)
+            .add_extension(authority_key, critical=False)
+            .add_extension(extended_key_usage, critical=False)
+            .add_extension(self.create_x509_crldp(), critical=False)
+            .sign(self.issuer_key, hashes.SHA256())
+        )
+        # Write PEM file and attach intermediate certificate
+        file_path = os.path.join(CERTS_PATH, self.common_name + ".pem")
+        with open(file_path, mode="wb") as file:
+            file.write(cert.public_bytes(encoding=serialization.Encoding.PEM))
+            file.write(self.issuer_cert.public_bytes(encoding=serialization.Encoding.PEM))
+
+        return cert
+
+    def revoke_cert(self, serial_number, file_name) -> None:
+        """Revoke a certificate"""
+        revoked = (
+            x509.RevokedCertificateBuilder()
+            .serial_number(serial_number)
+            .revocation_date(date_20190101)
+            .add_extension(x509.CRLReason(x509.ReasonFlags.superseded), critical=False)
+            .build()
+        )
+        # Generate CRL
+        authority_key = x509.AuthorityKeyIdentifier.from_issuer_subject_key_identifier(
+            self.issuer_cert.extensions.get_extension_for_class(x509.SubjectKeyIdentifier).value
+        )
+        crl = (
+            x509.CertificateRevocationListBuilder()
+            .issuer_name(self.issuer_cert.subject)
+            .last_update(date_20190101)
+            .next_update(date_20190101 + datetime.timedelta(days=7300))
+            .add_extension(authority_key, critical=False)
+            .add_extension(x509.CRLNumber(4097), critical=False)
+            .add_revoked_certificate(revoked)
+            .sign(self.issuer_key, hashes.SHA256())
+        )
+        # Write CRL file
+        file_path = os.path.join(CERTS_PATH, file_name + ".pem")
+        with open(file_path, mode="wb") as file:
+            file.write(crl.public_bytes(encoding=serialization.Encoding.PEM))
+
+        file_path = os.path.join(CERTS_PATH, file_name + ".der")
+        with open(file_path, mode="wb") as file:
+            file.write(crl.public_bytes(encoding=serialization.Encoding.DER))
+
+
+class LeafCACertificate(Certificate):
+    """Base class for a leaf certificate"""
+
+    def __init__(self, issuer_cert, issuer_key, common, cdp_port):
+        super().__init__(issuer_cert, issuer_key, "CSP", common, cdp_port, "intermediateCA")
+
+
+class LeafTSACertificate(Certificate):
+    """Base class for a TSA leaf certificate"""
+
+    def __init__(self, issuer_cert, issuer_key, common, cdp_port):
+        self.issuer_cert = issuer_cert
+        self.issuer_key = issuer_key
+        self.common_name = common
+        super().__init__(issuer_cert, issuer_key, "Timestamp Root CA", common, cdp_port, "TSACA")
+
+    def make_cert(self, public_key, not_before, days) -> x509.Certificate:
+        """Generate a TSA leaf certificate"""
+
+        authority_key = x509.AuthorityKeyIdentifier.from_issuer_subject_key_identifier(
+            self.issuer_cert.extensions.get_extension_for_class(x509.SubjectKeyIdentifier).value
+        )
+
+        # The TSA signing certificate must have exactly one extended key usage
+        # assigned to it: timeStamping. The extended key usage must also be critical,
+        # otherwise the certificate is going to be refused.
+        extended_key_usage = x509.ExtendedKeyUsage(
+            [x509.oid.ExtendedKeyUsageOID.TIME_STAMPING]
+        )
+        cert = (
+            x509.CertificateBuilder()
+            .subject_name(self.create_x509_name(self.common_name))
+            .issuer_name(self.issuer_cert.subject)
+            .public_key(public_key)
+            .serial_number(x509.random_serial_number())
+            .not_valid_before(not_before)
+            .not_valid_after(not_before + datetime.timedelta(days=days))
+            .add_extension(x509.BasicConstraints(ca=False, path_length=None), critical=True)
+            .add_extension(x509.SubjectKeyIdentifier.from_public_key(public_key), critical=False)
+            .add_extension(authority_key, critical=False)
+            .add_extension(extended_key_usage, critical=True)
+            .add_extension(self.create_x509_crldp(), critical=False)
+            .add_extension(self.create_x509_name_constraints(), critical=False)
+            .sign(self.issuer_key, hashes.SHA256())
+        )
+        # Write PEM file and attach intermediate certificate
+        file_path = os.path.join(CERTS_PATH, self.common_name + ".pem")
+        with open(file_path, mode="wb") as file:
+            file.write(cert.public_bytes(encoding=serialization.Encoding.PEM))
+            file.write(self.issuer_cert.public_bytes(encoding=serialization.Encoding.PEM))
+
+        return cert
+
+
+class CertificateMaker():
+    """Base class for test certificates"""
+
+    def __init__(self, cdp_port, logs):
+        self.cdp_port = cdp_port
+        self.logs = logs
+
+    def make_certs(self) -> None:
+        """Make test certificates"""
+        try:
+            self.make_ca_certs()
+            self.make_tsa_certs()
+            logs = os.path.join(CERTS_PATH, "./cert.log")
+            with open(logs, mode="w", encoding="utf-8") as file:
+                file.write("Test certificates generation succeeded")
+        except Exception as err: # pylint: disable=broad-except
+            with open(self.logs, mode="a", encoding="utf-8") as file:
+                file.write("Error: {}".format(err))
+
+    def make_ca_certs(self):
+        """Make test certificates"""
+
+        # Generate root CA certificate
+        root = RootCACertificate()
+        ca_cert, ca_key = root.make_cert()
+
+        # Generate intermediate root CA certificate
+        intermediate = IntermediateCACertificate(ca_cert, ca_key)
+        issuer_cert, issuer_key = intermediate.make_cert()
+
+        # Generate private RSA key
+        private_key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
+        public_key = private_key.public_key()
+        root.write_key(key=private_key, file_name="key")
+
+        # Generate expired certificate
+        expired = LeafCACertificate(issuer_cert, issuer_key, "expired", self.cdp_port)
+        expired.make_cert(public_key, date_20180101, 365)
+
+        # Generate revoked certificate
+        revoked = LeafCACertificate(issuer_cert, issuer_key, "revoked", self.cdp_port)
+        cert = revoked.make_cert(public_key, date_20180101, 5840)
+        revoked.revoke_cert(cert.serial_number, "CACertCRL")
+
+        # Generate code signing certificate
+        signer = LeafCACertificate(issuer_cert, issuer_key, "cert", self.cdp_port)
+        cert = signer.make_cert(public_key, date_20180101, 5840)
+
+        # Write a certificate and a key into PKCS#12 container
+        self.write_pkcs12_container(
+            cert=cert,
+            key=private_key,
+            issuer=issuer_cert
+        )
+
+        # Write DER file and attach intermediate certificate
+        file_path = os.path.join(CERTS_PATH, "cert.der")
+        with open(file_path, mode="wb") as file:
+            file.write(cert.public_bytes(encoding=serialization.Encoding.DER))
+
+    def make_tsa_certs(self):
+        """Make test TSA certificates"""
+
+        # Time Stamp Authority certificate
+        root = TSARootCACertificate()
+        issuer_cert, issuer_key = root.make_cert()
+
+        # Generate private RSA key
+        private_key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
+        public_key = private_key.public_key()
+        root.write_key(key=private_key, file_name="TSA")
+
+        # Generate revoked TSA certificate
+        revoked = LeafTSACertificate(issuer_cert, issuer_key, "TSA_revoked", self.cdp_port)
+        cert = revoked.make_cert(public_key, date_20180101, 7300)
+        revoked.revoke_cert(cert.serial_number, "TSACertCRL")
+
+        # Generate TSA certificate
+        signer = LeafTSACertificate(issuer_cert, issuer_key, "TSA", self.cdp_port)
+        cert = signer.make_cert(public_key, date_20180101, 7300)
+
+        # Save the chain to be included in the TSA response
+        file_path = os.path.join(CERTS_PATH, "tsa-chain.pem")
+        with open(file_path, mode="wb") as file:
+            file.write(cert.public_bytes(encoding=serialization.Encoding.PEM))
+            file.write(issuer_cert.public_bytes(encoding=serialization.Encoding.PEM))
+
+
+    def write_pkcs12_container(self, cert, key, issuer) -> None:
+        """Write a certificate and a key into a PKCS#12 container"""
+
+        # Set an encryption algorithm
+        if cryptography.__version__ >= "38.0.0":
+            # For OpenSSL legacy mode use the default algorithm for certificate
+            # and private key encryption: DES-EDE3-CBC (vel 3DES_CBC)
+            # pylint: disable=no-member
+            encryption = (
+                serialization.PrivateFormat.PKCS12.encryption_builder()
+                .key_cert_algorithm(serialization.pkcs12.PBES.PBESv1SHA1And3KeyTripleDESCBC)
+                .kdf_rounds(5000)
+                .build(PASSWORD.encode())
+            )
+        else:
+            encryption = serialization.BestAvailableEncryption(PASSWORD.encode())
+
+        # Generate PKCS#12 struct
+        pkcs12 = serialization.pkcs12.serialize_key_and_certificates(
+            name=b'certificate',
+            key=key,
+            cert=cert,
+            cas=(issuer,),
+            encryption_algorithm=encryption
+        )
+
+        # Write into a PKCS#12 container
+        file_path = os.path.join(CERTS_PATH, "cert.p12")
+        with open(file_path, mode="wb") as file:
+            file.write(pkcs12)
+
+
+# pylint: disable=pointless-string-statement
+"""Local Variables:
+    c-basic-offset: 4
+    tab-width: 4
+    indent-tabs-mode: nil
+End:
+    vim: set ts=4 expandtab:
+"""
--- a/tests/server_http.py
+++ b/tests/server_http.py
@ -1,3 +1,4 @@
+#!/usr/bin/python3
 """Implementation of a HTTP server"""

 import argparse
@ -8,6 +9,7 @@ import threading
 from urllib.parse import urlparse
 from http.server import SimpleHTTPRequestHandler, HTTPServer
 from socketserver import ThreadingMixIn
+from make_certificates import CertificateMaker

 RESULT_PATH = os.getcwd()
 FILES_PATH = os.path.join(RESULT_PATH, "./Testing/files/")
@ -16,11 +18,9 @@ CONF_PATH = os.path.join(RESULT_PATH, "./Testing/conf/")
 LOGS_PATH = os.path.join(RESULT_PATH, "./Testing/logs/")
 REQUEST = os.path.join(FILES_PATH, "./jreq.tsq")
 RESPONS = os.path.join(FILES_PATH, "./jresp.tsr")
-CACRL = os.path.join(CERTS_PATH, "./CACertCRL.der")
-TSACRL = os.path.join(CERTS_PATH, "./TSACertCRL.der")
 OPENSSL_CONF = os.path.join(CONF_PATH, "./openssl_tsa.cnf")
-PORT_LOG = os.path.join(LOGS_PATH, "./port.log")
-
+SERVER_LOG = os.path.join(LOGS_PATH, "./server.log")
+URL_LOG = os.path.join(LOGS_PATH, "./url.log")

 OPENSSL_TS = ["openssl", "ts",
    "-reply", "-config", OPENSSL_CONF,
@ -28,9 +28,12 @@ OPENSSL_TS = ["openssl", "ts",
    "-queryfile", REQUEST,
    "-out", RESPONS]

+
 class ThreadingHTTPServer(ThreadingMixIn, HTTPServer):
+    """This variant of HTTPServer creates a new thread for every connection"""
    daemon_threads = True

+
 class RequestHandler(SimpleHTTPRequestHandler):
    """Handle the HTTP POST request that arrive at the server"""

@ -44,15 +47,17 @@ class RequestHandler(SimpleHTTPRequestHandler):
        try:
            url = urlparse(self.path)
            self.send_response(200)
-            self.send_header("Content-type", "application/crl")
+            self.send_header("Content-type", "application/pkix-crl")
            self.end_headers()
            resp_data = b''
            # Read the file and send the contents
            if url.path == "/intermediateCA":
-                with open(CACRL, 'rb') as file:
+                file_path = os.path.join(CERTS_PATH, "./CACertCRL.der")
+                with open(file_path, 'rb') as file:
                    resp_data = file.read()
            if url.path == "/TSACA":
-                with open(TSACRL, 'rb') as file:
+                file_path = os.path.join(CERTS_PATH, "./TSACertCRL.der")
+                with open(file_path, 'rb') as file:
                    resp_data = file.read()
            self.wfile.write(resp_data)
        except Exception as err: # pylint: disable=broad-except
@ -65,8 +70,8 @@ class RequestHandler(SimpleHTTPRequestHandler):
            url = urlparse(self.path)
            self.send_response(200)
            if url.path == "/kill_server":
-                self.log_message(f"Deleting file: {PORT_LOG}")
-                os.remove(f"{PORT_LOG}")
+                self.log_message(f"Deleting file: {URL_LOG}")
+                os.remove(f"{URL_LOG}")
                self.send_header('Content-type', 'text/plain')
                self.end_headers()
                self.wfile.write(bytes('Shutting down HTTP server', 'utf-8'))
@ -76,8 +81,7 @@ class RequestHandler(SimpleHTTPRequestHandler):
                post_data = self.rfile.read(content_length)
                with open(REQUEST, mode="wb") as file:
                    file.write(post_data)
-                openssl = subprocess.run(OPENSSL_TS,
-                    check=True, universal_newlines=True)
+                openssl = subprocess.run(OPENSSL_TS, check=True, universal_newlines=True)
                openssl.check_returncode()
                self.send_header("Content-type", "application/timestamp-reply")
                self.end_headers()
@ -85,6 +89,7 @@ class RequestHandler(SimpleHTTPRequestHandler):
                with open(RESPONS, mode="rb") as file:
                    resp_data = file.read()
                self.wfile.write(resp_data)
+
        except Exception as err: # pylint: disable=broad-except
            print("HTTP POST request error: {}".format(err))

@ -108,7 +113,8 @@ class HttpServerThread():


 def main() -> None:
-    """Start HTTP server"""
+    """Start HTTP server, make test certificates."""
+
    ret = 0
    parser = argparse.ArgumentParser()
    parser.add_argument(
@ -121,11 +127,16 @@ def main() -> None:
    try:
        server = HttpServerThread()
        port = server.start_server(args.port)
-        with open(PORT_LOG, mode="w") as file:
-            file.write("{}".format(port))
+        with open(URL_LOG, mode="w", encoding="utf-8") as file:
+            file.write("127.0.0.1:{}".format(port))
+        tests = CertificateMaker(port, SERVER_LOG)
+        tests.make_certs()
    except OSError as err:
        print("OSError: {}".format(err))
        ret = err.errno
+    except Exception as err: # pylint: disable=broad-except
+        print("Error: {}".format(err))
+        ret = 1
    finally:
        sys.exit(ret)

@ -135,6 +146,9 @@ if __name__ == '__main__':
        fpid = os.fork()
        if fpid > 0:
            sys.exit(0)
+        with open(SERVER_LOG, mode='w', encoding='utf-8') as log:
+            os.dup2(log.fileno(), sys.stdout.fileno())
+            os.dup2(log.fileno(), sys.stderr.fileno())
    except OSError as ferr:
        print("Fork #1 failed: {} {}".format(ferr.errno, ferr.strerror))
        sys.exit(1)
--- a/tests/server_http.pyw
+++ b/tests/server_http.pyw
@ -1,11 +1,14 @@
+#!/usr/bin/python3
 """Windows: Implementation of a HTTP server"""

+import argparse
 import os
 import subprocess
 import sys
 import threading
 from urllib.parse import urlparse
 from http.server import SimpleHTTPRequestHandler, ThreadingHTTPServer
+from make_certificates import CertificateMaker

 RESULT_PATH = os.getcwd()
 FILES_PATH = os.path.join(RESULT_PATH, "./Testing/files/")
@ -14,11 +17,9 @@ CONF_PATH = os.path.join(RESULT_PATH, "./Testing/conf/")
 LOGS_PATH = os.path.join(RESULT_PATH, "./Testing/logs/")
 REQUEST = os.path.join(FILES_PATH, "./jreq.tsq")
 RESPONS = os.path.join(FILES_PATH, "./jresp.tsr")
-CACRL = os.path.join(CERTS_PATH, "./CACertCRL.der")
-TSACRL = os.path.join(CERTS_PATH, "./TSACertCRL.der")
 OPENSSL_CONF = os.path.join(CONF_PATH, "./openssl_tsa.cnf")
 SERVER_LOG = os.path.join(LOGS_PATH, "./server.log")
-PORT_LOG = os.path.join(LOGS_PATH, "./port.log")
+URL_LOG = os.path.join(LOGS_PATH, "./url.log")


 OPENSSL_TS = ["openssl", "ts",
@ -41,15 +42,17 @@ class RequestHandler(SimpleHTTPRequestHandler):
        try:
            url = urlparse(self.path)
            self.send_response(200)
-            self.send_header("Content-type", "application/crl")
+            self.send_header("Content-type", "application/pkix-crl")
            self.end_headers()
            resp_data = b''
            # Read the file and send the contents
            if url.path == "/intermediateCA":
-                with open(CACRL, 'rb') as file:
+                file_path = os.path.join(CERTS_PATH, "./CACertCRL.der")
+                with open(file_path, 'rb') as file:
                    resp_data = file.read()
            if url.path == "/TSACA":
-                with open(TSACRL, 'rb') as file:
+                file_path = os.path.join(CERTS_PATH, "./TSACertCRL.der")
+                with open(file_path, 'rb') as file:
                    resp_data = file.read()
            self.wfile.write(resp_data)
        except Exception as err: # pylint: disable=broad-except
@ -62,8 +65,8 @@ class RequestHandler(SimpleHTTPRequestHandler):
            url = urlparse(self.path)
            self.send_response(200)
            if url.path == "/kill_server":
-                self.log_message(f"Deleting file: {PORT_LOG}")
-                os.remove(f"{PORT_LOG}")
+                self.log_message(f"Deleting file: {URL_LOG}")
+                os.remove(f"{URL_LOG}")
                self.send_header('Content-type', 'text/plain')
                self.end_headers()
                self.wfile.write(bytes('Shutting down HTTP server', 'utf-8'))
@ -94,9 +97,9 @@ class HttpServerThread():
        self.server = None
        self.server_thread = None

-    def start_server(self) -> (int):
+    def start_server(self, port) -> (int):
        """Starting HTTP server on 127.0.0.1 and a random available port for binding"""
-        self.server = ThreadingHTTPServer(('127.0.0.1', 19254), RequestHandler)
+        self.server = ThreadingHTTPServer(('127.0.0.1', port), RequestHandler)
        self.server_thread = threading.Thread(target=self.server.serve_forever)
        self.server_thread.start()
        hostname, port = self.server.server_address[:2]
@ -106,14 +109,25 @@ class HttpServerThread():

 def main() -> None:
    """Start HTTP server"""
+
    ret = 0
+    parser = argparse.ArgumentParser()
+    parser.add_argument(
+        "--port",
+        type=int,
+        default=0,
+        help="port number"
+    )
+    args = parser.parse_args()
    try:
        sys.stdout = open(SERVER_LOG, "w")
        sys.stderr = open(SERVER_LOG, "a")
        server = HttpServerThread()
-        port = server.start_server()
-        with open(PORT_LOG, mode="w") as file:
-            file.write("{}".format(port))
+        port = server.start_server(args.port)
+        with open(URL_LOG, mode="w") as file:
+            file.write("127.0.0.1:{}".format(port))
+        tests = CertificateMaker(port, SERVER_LOG)
+        tests.make_certs()
    except OSError as err:
        print("OSError: {}".format(err))
        ret = err.errno
--- a/tests/start_server.py
+++ b/tests/start_server.py
@ -0,0 +1,108 @@
+#!/usr/bin/python3
+"""Wait for all tests certificate, compute leafhash"""
+
+import argparse
+import binascii
+import hashlib
+import os
+import pathlib
+import platform
+import subprocess
+import sys
+import time
+
+RESULT_PATH = os.getcwd()
+CERTS_PATH = os.path.join(RESULT_PATH, "./Testing/certs/")
+LOGS_PATH = os.path.join(RESULT_PATH, "./Testing/logs/")
+SERVER_LOG = os.path.join(LOGS_PATH, "./server.log")
+if platform.system() == 'Windows':
+    DEFAULT_PYTHON = "C:/Program Files/Python/Python311/pythonw.exe"
+    DEFAULT_PROG =  os.path.join(RESULT_PATH, "./Testing/server_http.pyw")
+else:
+    DEFAULT_PYTHON = "/usr/bin/python3"
+    DEFAULT_PROG =  os.path.join(RESULT_PATH, "./Testing/server_http.py")
+
+
+def compute_sha256(file_name) -> str:
+    """Compute a SHA256 hash of the leaf certificate (in DER form)"""
+
+    sha256_hash = hashlib.sha256()
+    file_path = os.path.join(CERTS_PATH, file_name)
+    with open(file_path, mode="rb") as file:
+        for bajt in iter(lambda: file.read(4096),b""):
+            sha256_hash.update(bajt)
+    return sha256_hash.hexdigest()
+
+def clear_catalog(certs_path) -> None:
+    """"Clear a test certificates catalog."""
+
+    if os.path.exists(certs_path):
+        #Remove old test certificates
+        for root, _, files in os.walk(certs_path):
+            for file in files:
+                os.remove(os.path.join(root, file))
+    else:
+        os.mkdir(certs_path)
+
+    # Generate 16 random bytes and convert to hex
+    random_hex = binascii.b2a_hex(os.urandom(16)).decode()
+    serial = os.path.join(certs_path, "./tsa-serial")
+    with open(serial, mode="w", encoding="utf-8") as file:
+        file.write(random_hex)
+
+def main() -> None:
+    """Wait for all tests certificate, compute leafhash"""
+
+    parser = argparse.ArgumentParser()
+    parser.add_argument(
+        "--exe",
+        type=pathlib.Path,
+        default=DEFAULT_PYTHON,
+        help=f"the path to the python3 executable to use"
+        f"(default: {DEFAULT_PYTHON})",
+    )
+    parser.add_argument(
+        "--script",
+        type=pathlib.Path,
+        default=DEFAULT_PROG,
+        help=f"the path to the python script to run"
+        f"(default: {DEFAULT_PROG})",
+    )
+    args = parser.parse_args()
+    try:
+        clear_catalog(CERTS_PATH)
+        #pylint: disable=consider-using-with
+        subprocess.Popen([str(args.exe), str(args.script)])
+
+        cert_log = os.path.join(CERTS_PATH, "./cert.log")
+        while not (os.path.exists(cert_log) and os.path.getsize(cert_log) > 0):
+            time.sleep(1)
+
+        leafhash = compute_sha256("cert.der")
+        file_path = os.path.join(CERTS_PATH, "./leafhash.txt")
+        with open(file_path, mode="w", encoding="utf-8") as file:
+            file.write("SHA256:{}".format(leafhash))
+
+    except OSError as err:
+        with open(SERVER_LOG, mode="w", encoding="utf-8") as file:
+            file.write("OSError: {}".format(err))
+        sys.exit(1)
+
+    except Exception as err: # pylint: disable=broad-except
+        with open(SERVER_LOG, mode="w", encoding="utf-8") as file:
+            file.write("Error: {}".format(err))
+        sys.exit(1)
+
+
+if __name__ == "__main__":
+    main()
+
+
+# pylint: disable=pointless-string-statement
+"""Local Variables:
+    c-basic-offset: 4
+    tab-width: 4
+    indent-tabs-mode: nil
+End:
+    vim: set ts=4 expandtab:
+"""
--- a/vcpkg.json
+++ b/vcpkg.json
@ -3,11 +3,7 @@
    "version-string": "2.4",
    "dependencies": [
        "openssl",
-        "curl",
-        {
-            "name": "python3",
-            "platform": "!(windows & static) & !osx"
-        }
+        "zlib"
    ],
    "builtin-baseline": "9edb1b8e590cc086563301d735cae4b6e732d2d2"
 }
Author	SHA1	Message	Date
Michał Trojnara	76ee550c9d	Release 2.9 Signed-off-by: Michał Trojnara <Michal.Trojnara@stunnel.org>	2024-06-29 20:16:47 +02:00
olszomal	2b3228d549	Changed error output to stderr instead of stdout	2024-06-05 16:54:21 +02:00
Michał Trojnara	bad6e96e0f	Not only include Code Signing certificates	2024-06-04 13:25:51 +02:00
olszomal	3c8c74a8c3	Handled memory reallocation error	2024-06-03 14:16:39 +02:00
olszomal	771014a41e	Fixed uint32_t overflow when attaching a new MSI sector	2024-06-03 14:16:39 +02:00
olszomal	476168e09e	Added the "-ignore-crl" option to disable CRL online verification	2024-06-03 12:16:02 +02:00
olszomal	be4f010535	Fixed to get CAT content value	2024-06-03 08:44:02 +02:00
Michał Trojnara	2c27e2e37d	Fix Ubuntu 24.04 build	2024-06-02 00:07:37 +02:00
Michał Trojnara	b829e7a802	Fix macos build with GitHub Actions	2024-05-31 20:52:03 +02:00
olszomal	d0ae214cb4	Verified number of MSI sectors	2024-05-31 16:47:31 +02:00
olszomal	9b1a6c9fb8	Failed to get CAT content	2024-05-31 16:47:31 +02:00
olszomal	41b662a8fe	Checked cFolders value	2024-05-31 16:47:31 +02:00
olszomal	5232734071	Fix fuzzer error - failed to sort central directory entry	2024-05-29 14:22:26 +02:00
olszomal	996cf20fa9	Fixed msi dirent memory leak	2024-05-29 14:22:26 +02:00
Brad Hughes	825c9dad7c	Add '-login' option to force a login to PKCS11 engines	2024-05-22 19:06:06 +02:00
Małgorzata Olszówka	6e5bef14e9	Rewrite making test certificates (#393 ) Also updates obsolete curl dependencies with zlib.	2024-05-22 18:59:53 +02:00
Michał Trojnara	a53bd2bdb3	Diagnostic formatting improvements	2024-04-18 09:49:55 +02:00
Michał Trojnara	e4d471b885	Code signing CA certificates Based on: https://learn.microsoft.com/en-us/security/trusted-root/participants-list	2024-04-16 16:50:25 +02:00
Michał Trojnara	bcb9737dda	Remove the "openssl version" step from CI We will likely link a different version of OpenSSL anyway, so printing the version of the first OpenSSL command-line executable on the PATH only adds to confusion.	2024-04-15 19:34:50 +02:00
olszomal	7a5389b719	Fixed cmake test cURL support	2024-04-10 17:09:01 +02:00
olszomal	d9f0a8dade	Fixed missing Crypt32.lib when linking openssl statically	2024-04-10 17:09:01 +02:00
olszomal	aa8c8dd720	Type casting of the read() return value	2024-04-10 17:09:01 +02:00
olszomal	16c5e5aa4a	Squashed logically dead code for curl response code for openssl version 3.0.0 and later, CID 1585046	2024-04-10 17:09:01 +02:00
Michał Trojnara	ded1f7aa67	Use native HTTP client with OpenSSL 3.0 or later (#378 ) Co-authored-by: olszomal <Malgorzata.Olszowka@stunnel.org>	2024-04-09 19:33:31 +02:00
Steve McIntyre	6ad2679f17	Read the password from stdin if desired Use the common convention: "-" means to use stdin Signed-off-by: Steve McIntyre <steve.mcintyre@pexip.com>	2024-03-28 21:33:01 +01:00
olszomal	4776f43f04	Improved manual	2024-03-26 18:28:02 +01:00
olszomal	d9db038c65	Sort central directory entries in ascending order by offset	2024-03-20 11:19:46 +01:00
Michał Trojnara	e8ef027776	Simplify base64 decoding in script.c	2024-03-11 12:10:20 +01:00
olszomal	0a0761746f	Fixed memory corruption	2024-03-08 16:59:34 +01:00
olszomal	f51e2a4869	Intercepted X509_V_FLAG_CHECK_SS_SIGNATURE verify error	2024-03-08 16:59:34 +01:00
olszomal	093ed12c66	Supported CRL decoding in DER and PEM format	2024-03-08 16:59:34 +01:00
olszomal	71a046a2d0	Ignore missing PKCS#9 signing time field (NID_pkcs9_signingTime: 1.2.840.113549.1.9.5) in the CMS_ContentInfo structure. Timestamping time for verification is get from embedded content in this CMS_ContentInfo structure.	2024-03-08 16:59:34 +01:00
olszomal	c73f82b558	Set the NONCE field in a TSA request	2024-03-08 16:59:34 +01:00
Michał Trojnara	b294f5d18f	Initial 2.9-dev commit	2024-03-05 16:34:32 +01:00
Michał Trojnara	e07bb7d6b2	Update workflow components	2024-03-05 15:51:29 +01:00