2025-11-11 02:07:51 +01:00 · 2025-11-11 02:07:51 +01:00 · 2f3113f55d
commit 2f3113f55d
parent aa2ff7b2f0
11742 changed files with 1223940 additions and 0 deletions
--- a/unikernel/duniverse/ocaml-x509/tests/testcertificates/intermediate/second/second-any.pem
+++ b/unikernel/duniverse/ocaml-x509/tests/testcertificates/intermediate/second/second-any.pem
@ -0,0 +1,62 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 4 (0x4)
+    Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=AU, ST=Some-State, O=Internet Widgits Pty Ltd, CN=signing CA
+        Validity
+            Not Before: Jun  7 15:12:00 2014 GMT
+            Not After : Jun  4 15:12:00 2024 GMT
+        Subject: C=AU, ST=Some-State, O=Internet Widgits Pty Ltd, CN=second.foobar.com
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (1024 bit)
+                Modulus:
+                    00:e4:13:e7:f0:97:87:62:5f:e2:cc:79:b2:55:77:
+                    d7:c2:b8:b9:d3:51:b9:72:6f:15:13:b5:94:e7:54:
+                    8e:c1:18:37:6c:d8:0b:90:5a:a4:5d:a5:0e:42:74:
+                    4e:7e:ad:e9:34:37:a7:6d:e5:30:c6:41:7b:f8:85:
+                    e9:61:84:cc:d8:80:f2:7f:af:6e:22:bc:2c:ce:27:
+                    1f:4a:fd:36:bc:1c:9d:f5:5f:e9:b4:96:0f:88:31:
+                    8f:a7:6d:38:54:a8:7e:2c:1c:1c:72:8c:2f:0b:0a:
+                    71:6f:d2:d5:c6:ac:e9:e0:e9:7e:72:46:43:a0:00:
+                    60:33:62:d7:7a:ff:1e:7f:77
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            X509v3 Key Usage: 
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Subject Key Identifier: 
+                4A:F7:E8:EB:57:1B:AB:49:41:23:E8:02:64:23:83:23:17:0E:CA:05
+            X509v3 Authority Key Identifier: 
+                keyid:70:46:49:1B:C2:71:2E:C0:50:D3:4B:18:58:8A:C4:10:1C:AE:B3:59
+
+            X509v3 Extended Key Usage: 
+                Any Extended Key Usage
+    Signature Algorithm: sha1WithRSAEncryption
+         5f:3b:4b:a3:70:1a:82:3e:9c:bb:cb:16:95:f3:b2:ef:3a:a6:
+         09:1d:1c:b9:cb:ce:56:82:29:98:41:b8:c5:58:cb:35:27:45:
+         9d:2e:f5:41:e1:a0:7c:5f:ee:2d:0c:9c:9b:42:31:61:27:fb:
+         5f:d6:ce:a6:dc:c6:9b:b2:d1:3b:72:1e:b3:f1:20:73:7f:86:
+         8a:1d:44:c8:d7:bc:f2:92:4a:2c:48:97:b5:12:63:99:f3:90:
+         e5:79:bf:68:fe:11:34:1d:ac:75:80:d2:22:7f:53:2d:70:50:
+         d2:a0:fc:7b:b9:8f:b3:5e:6c:70:b8:55:0b:52:d5:84:b7:7c:
+         84:9b
+-----BEGIN CERTIFICATE-----
+MIICnzCCAgigAwIBAgIBBDANBgkqhkiG9w0BAQUFADBaMQswCQYDVQQGEwJBVTET
+MBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwYSW50ZXJuZXQgV2lkZ2l0cyBQ
+dHkgTHRkMRMwEQYDVQQDDApzaWduaW5nIENBMB4XDTE0MDYwNzE1MTIwMFoXDTI0
+MDYwNDE1MTIwMFowYTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUx
+ITAfBgNVBAoMGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDEaMBgGA1UEAwwRc2Vj
+b25kLmZvb2Jhci5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAOQT5/CX
+h2Jf4sx5slV318K4udNRuXJvFRO1lOdUjsEYN2zYC5BapF2lDkJ0Tn6t6TQ3p23l
+MMZBe/iF6WGEzNiA8n+vbiK8LM4nH0r9NrwcnfVf6bSWD4gxj6dtOFSofiwcHHKM
+LwsKcW/S1cas6eDpfnJGQ6AAYDNi13r/Hn93AgMBAAGjbjBsMAwGA1UdEwEB/wQC
+MAAwCwYDVR0PBAQDAgXgMB0GA1UdDgQWBBRK9+jrVxurSUEj6AJkI4MjFw7KBTAf
+BgNVHSMEGDAWgBRwRkkbwnEuwFDTSxhYisQQHK6zWTAPBgNVHSUECDAGBgRVHSUA
+MA0GCSqGSIb3DQEBBQUAA4GBAF87S6NwGoI+nLvLFpXzsu86pgkdHLnLzlaCKZhB
+uMVYyzUnRZ0u9UHhoHxf7i0MnJtCMWEn+1/Wzqbcxpuy0TtyHrPxIHN/hoodRMjX
+vPKSSixIl7USY5nzkOV5v2j+ETQdrHWA0iJ/Uy1wUNKg/Hu5j7NebHC4VQtS1YS3
+fISb
+-----END CERTIFICATE-----
--- a/unikernel/duniverse/ocaml-x509/tests/testcertificates/intermediate/second/second-bc-true.pem
+++ b/unikernel/duniverse/ocaml-x509/tests/testcertificates/intermediate/second/second-bc-true.pem
@ -0,0 +1,59 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 2 (0x2)
+    Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=AU, ST=Some-State, O=Internet Widgits Pty Ltd, CN=signing CA
+        Validity
+            Not Before: Jun  7 15:09:33 2014 GMT
+            Not After : Jun  4 15:09:33 2024 GMT
+        Subject: C=AU, ST=Some-State, O=Internet Widgits Pty Ltd, CN=second.foobar.com
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (1024 bit)
+                Modulus:
+                    00:e4:13:e7:f0:97:87:62:5f:e2:cc:79:b2:55:77:
+                    d7:c2:b8:b9:d3:51:b9:72:6f:15:13:b5:94:e7:54:
+                    8e:c1:18:37:6c:d8:0b:90:5a:a4:5d:a5:0e:42:74:
+                    4e:7e:ad:e9:34:37:a7:6d:e5:30:c6:41:7b:f8:85:
+                    e9:61:84:cc:d8:80:f2:7f:af:6e:22:bc:2c:ce:27:
+                    1f:4a:fd:36:bc:1c:9d:f5:5f:e9:b4:96:0f:88:31:
+                    8f:a7:6d:38:54:a8:7e:2c:1c:1c:72:8c:2f:0b:0a:
+                    71:6f:d2:d5:c6:ac:e9:e0:e9:7e:72:46:43:a0:00:
+                    60:33:62:d7:7a:ff:1e:7f:77
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+            X509v3 Key Usage: 
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Subject Key Identifier: 
+                4A:F7:E8:EB:57:1B:AB:49:41:23:E8:02:64:23:83:23:17:0E:CA:05
+            X509v3 Authority Key Identifier: 
+                keyid:70:46:49:1B:C2:71:2E:C0:50:D3:4B:18:58:8A:C4:10:1C:AE:B3:59
+
+    Signature Algorithm: sha1WithRSAEncryption
+         5d:9d:36:2b:33:c8:43:c8:78:13:10:c7:a8:7f:ac:60:f6:19:
+         46:36:24:8b:8e:db:20:00:b5:f8:c7:a5:ac:49:56:a6:e1:e6:
+         dd:fd:07:10:44:2b:aa:42:f5:76:56:81:86:3d:74:53:03:24:
+         e0:9a:6e:d7:e6:3c:d7:31:87:82:2a:72:fc:67:8f:0e:5a:3b:
+         05:c9:5c:52:61:6d:a0:4d:78:ba:8d:97:a5:4c:e1:a6:07:43:
+         61:81:c5:94:84:37:47:91:aa:13:b6:57:19:af:57:8d:82:8a:
+         50:eb:cc:07:76:cb:1b:35:c3:db:98:2d:ab:d6:cf:d2:c3:a8:
+         e5:1b
+-----BEGIN CERTIFICATE-----
+MIICkTCCAfqgAwIBAgIBAjANBgkqhkiG9w0BAQUFADBaMQswCQYDVQQGEwJBVTET
+MBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwYSW50ZXJuZXQgV2lkZ2l0cyBQ
+dHkgTHRkMRMwEQYDVQQDDApzaWduaW5nIENBMB4XDTE0MDYwNzE1MDkzM1oXDTI0
+MDYwNDE1MDkzM1owYTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUx
+ITAfBgNVBAoMGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDEaMBgGA1UEAwwRc2Vj
+b25kLmZvb2Jhci5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAOQT5/CX
+h2Jf4sx5slV318K4udNRuXJvFRO1lOdUjsEYN2zYC5BapF2lDkJ0Tn6t6TQ3p23l
+MMZBe/iF6WGEzNiA8n+vbiK8LM4nH0r9NrwcnfVf6bSWD4gxj6dtOFSofiwcHHKM
+LwsKcW/S1cas6eDpfnJGQ6AAYDNi13r/Hn93AgMBAAGjYDBeMA8GA1UdEwEB/wQF
+MAMBAf8wCwYDVR0PBAQDAgXgMB0GA1UdDgQWBBRK9+jrVxurSUEj6AJkI4MjFw7K
+BTAfBgNVHSMEGDAWgBRwRkkbwnEuwFDTSxhYisQQHK6zWTANBgkqhkiG9w0BAQUF
+AAOBgQBdnTYrM8hDyHgTEMeof6xg9hlGNiSLjtsgALX4x6WsSVam4ebd/QcQRCuq
+QvV2VoGGPXRTAyTgmm7X5jzXMYeCKnL8Z48OWjsFyVxSYW2gTXi6jZelTOGmB0Nh
+gcWUhDdHkaoTtlcZr1eNgopQ68wHdssbNcPbmC2r1s/Sw6jlGw==
+-----END CERTIFICATE-----
--- a/unikernel/duniverse/ocaml-x509/tests/testcertificates/intermediate/second/second-no-cn.pem
+++ b/unikernel/duniverse/ocaml-x509/tests/testcertificates/intermediate/second/second-no-cn.pem
@ -0,0 +1,59 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 10 (0xa)
+    Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=AU, ST=Some-State, O=Internet Widgits Pty Ltd, CN=signing CA
+        Validity
+            Not Before: Jun  7 20:19:45 2014 GMT
+            Not After : Jun  4 20:19:45 2024 GMT
+        Subject: C=AU, ST=Some-State, O=Internet Widgits Pty Ltd
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (1024 bit)
+                Modulus:
+                    00:e4:13:e7:f0:97:87:62:5f:e2:cc:79:b2:55:77:
+                    d7:c2:b8:b9:d3:51:b9:72:6f:15:13:b5:94:e7:54:
+                    8e:c1:18:37:6c:d8:0b:90:5a:a4:5d:a5:0e:42:74:
+                    4e:7e:ad:e9:34:37:a7:6d:e5:30:c6:41:7b:f8:85:
+                    e9:61:84:cc:d8:80:f2:7f:af:6e:22:bc:2c:ce:27:
+                    1f:4a:fd:36:bc:1c:9d:f5:5f:e9:b4:96:0f:88:31:
+                    8f:a7:6d:38:54:a8:7e:2c:1c:1c:72:8c:2f:0b:0a:
+                    71:6f:d2:d5:c6:ac:e9:e0:e9:7e:72:46:43:a0:00:
+                    60:33:62:d7:7a:ff:1e:7f:77
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            X509v3 Key Usage: 
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Subject Key Identifier: 
+                4A:F7:E8:EB:57:1B:AB:49:41:23:E8:02:64:23:83:23:17:0E:CA:05
+            X509v3 Authority Key Identifier: 
+                keyid:70:46:49:1B:C2:71:2E:C0:50:D3:4B:18:58:8A:C4:10:1C:AE:B3:59
+
+    Signature Algorithm: sha1WithRSAEncryption
+         86:ff:aa:35:31:07:ab:76:8d:44:3a:a6:63:40:ce:ac:13:56:
+         c0:90:12:e1:23:af:0d:b9:16:88:48:7b:a1:00:85:6c:b8:32:
+         4d:ed:04:dc:32:05:e9:27:77:e1:1b:16:0b:8e:dc:23:fb:cd:
+         fc:c7:63:27:35:bd:69:4d:45:ae:ab:b9:06:bb:a1:5e:b5:7e:
+         89:72:cc:fe:3e:90:3c:09:bc:e1:1c:b0:bf:c6:d2:40:61:a7:
+         d6:20:9b:cd:e9:f5:d6:09:f3:1e:ee:6b:6e:d2:31:6e:0d:15:
+         8d:dd:9d:f7:8e:d9:96:df:42:7e:e2:0f:0d:37:f4:a8:ef:79:
+         c1:88
+-----BEGIN CERTIFICATE-----
+MIICcjCCAdugAwIBAgIBCjANBgkqhkiG9w0BAQUFADBaMQswCQYDVQQGEwJBVTET
+MBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwYSW50ZXJuZXQgV2lkZ2l0cyBQ
+dHkgTHRkMRMwEQYDVQQDDApzaWduaW5nIENBMB4XDTE0MDYwNzIwMTk0NVoXDTI0
+MDYwNDIwMTk0NVowRTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUx
+ITAfBgNVBAoMGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDCBnzANBgkqhkiG9w0B
+AQEFAAOBjQAwgYkCgYEA5BPn8JeHYl/izHmyVXfXwri501G5cm8VE7WU51SOwRg3
+bNgLkFqkXaUOQnROfq3pNDenbeUwxkF7+IXpYYTM2IDyf69uIrwszicfSv02vByd
+9V/ptJYPiDGPp204VKh+LBwccowvCwpxb9LVxqzp4Ol+ckZDoABgM2LXev8ef3cC
+AwEAAaNdMFswDAYDVR0TAQH/BAIwADALBgNVHQ8EBAMCBeAwHQYDVR0OBBYEFEr3
+6OtXG6tJQSPoAmQjgyMXDsoFMB8GA1UdIwQYMBaAFHBGSRvCcS7AUNNLGFiKxBAc
+rrNZMA0GCSqGSIb3DQEBBQUAA4GBAIb/qjUxB6t2jUQ6pmNAzqwTVsCQEuEjrw25
+FohIe6EAhWy4Mk3tBNwyBeknd+EbFguO3CP7zfzHYyc1vWlNRa6ruQa7oV61foly
+zP4+kDwJvOEcsL/G0kBhp9Ygm83p9dYJ8x7ua27SMW4NFY3dnfeO2ZbfQn7iDw03
+9KjvecGI
+-----END CERTIFICATE-----
--- a/unikernel/duniverse/ocaml-x509/tests/testcertificates/intermediate/second/second-nonrepud.pem
+++ b/unikernel/duniverse/ocaml-x509/tests/testcertificates/intermediate/second/second-nonrepud.pem
@ -0,0 +1,59 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 5 (0x5)
+    Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=AU, ST=Some-State, O=Internet Widgits Pty Ltd, CN=signing CA
+        Validity
+            Not Before: Jun  7 15:12:35 2014 GMT
+            Not After : Jun  4 15:12:35 2024 GMT
+        Subject: C=AU, ST=Some-State, O=Internet Widgits Pty Ltd, CN=second.foobar.com
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (1024 bit)
+                Modulus:
+                    00:e4:13:e7:f0:97:87:62:5f:e2:cc:79:b2:55:77:
+                    d7:c2:b8:b9:d3:51:b9:72:6f:15:13:b5:94:e7:54:
+                    8e:c1:18:37:6c:d8:0b:90:5a:a4:5d:a5:0e:42:74:
+                    4e:7e:ad:e9:34:37:a7:6d:e5:30:c6:41:7b:f8:85:
+                    e9:61:84:cc:d8:80:f2:7f:af:6e:22:bc:2c:ce:27:
+                    1f:4a:fd:36:bc:1c:9d:f5:5f:e9:b4:96:0f:88:31:
+                    8f:a7:6d:38:54:a8:7e:2c:1c:1c:72:8c:2f:0b:0a:
+                    71:6f:d2:d5:c6:ac:e9:e0:e9:7e:72:46:43:a0:00:
+                    60:33:62:d7:7a:ff:1e:7f:77
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            X509v3 Key Usage: 
+                Non Repudiation
+            X509v3 Subject Key Identifier: 
+                4A:F7:E8:EB:57:1B:AB:49:41:23:E8:02:64:23:83:23:17:0E:CA:05
+            X509v3 Authority Key Identifier: 
+                keyid:70:46:49:1B:C2:71:2E:C0:50:D3:4B:18:58:8A:C4:10:1C:AE:B3:59
+
+    Signature Algorithm: sha1WithRSAEncryption
+         a4:9d:d9:79:78:68:e8:e3:2f:ac:3b:25:6c:f3:05:8d:ab:08:
+         3a:ff:a9:85:4e:c2:77:df:38:56:50:d3:7a:77:1f:fd:53:f6:
+         eb:f0:43:2f:39:61:d0:f6:1b:c8:3b:30:a4:53:c2:a4:eb:02:
+         02:ec:11:ee:d6:4c:e9:d5:25:2e:15:ce:e3:c5:9a:04:e3:00:
+         45:34:c5:26:69:b4:89:51:fa:41:f5:0a:5e:60:23:b7:ef:f7:
+         3e:c9:7a:94:57:31:b1:86:58:31:34:df:25:56:03:a2:3e:c9:
+         3f:db:43:58:39:c7:1a:a5:1f:d8:49:cc:09:96:da:0b:e7:21:
+         b6:06
+-----BEGIN CERTIFICATE-----
+MIICjjCCAfegAwIBAgIBBTANBgkqhkiG9w0BAQUFADBaMQswCQYDVQQGEwJBVTET
+MBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwYSW50ZXJuZXQgV2lkZ2l0cyBQ
+dHkgTHRkMRMwEQYDVQQDDApzaWduaW5nIENBMB4XDTE0MDYwNzE1MTIzNVoXDTI0
+MDYwNDE1MTIzNVowYTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUx
+ITAfBgNVBAoMGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDEaMBgGA1UEAwwRc2Vj
+b25kLmZvb2Jhci5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAOQT5/CX
+h2Jf4sx5slV318K4udNRuXJvFRO1lOdUjsEYN2zYC5BapF2lDkJ0Tn6t6TQ3p23l
+MMZBe/iF6WGEzNiA8n+vbiK8LM4nH0r9NrwcnfVf6bSWD4gxj6dtOFSofiwcHHKM
+LwsKcW/S1cas6eDpfnJGQ6AAYDNi13r/Hn93AgMBAAGjXTBbMAwGA1UdEwEB/wQC
+MAAwCwYDVR0PBAQDAgZAMB0GA1UdDgQWBBRK9+jrVxurSUEj6AJkI4MjFw7KBTAf
+BgNVHSMEGDAWgBRwRkkbwnEuwFDTSxhYisQQHK6zWTANBgkqhkiG9w0BAQUFAAOB
+gQCkndl5eGjo4y+sOyVs8wWNqwg6/6mFTsJ33zhWUNN6dx/9U/br8EMvOWHQ9hvI
+OzCkU8Kk6wIC7BHu1kzp1SUuFc7jxZoE4wBFNMUmabSJUfpB9QpeYCO37/c+yXqU
+VzGxhlgxNN8lVgOiPsk/20NYOccapR/YScwJltoL5yG2Bg==
+-----END CERTIFICATE-----
--- a/unikernel/duniverse/ocaml-x509/tests/testcertificates/intermediate/second/second-subj-wild.pem
+++ b/unikernel/duniverse/ocaml-x509/tests/testcertificates/intermediate/second/second-subj-wild.pem
@ -0,0 +1,62 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 9 (0x9)
+    Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=AU, ST=Some-State, O=Internet Widgits Pty Ltd, CN=signing CA
+        Validity
+            Not Before: Jun  7 15:15:26 2014 GMT
+            Not After : Jun  4 15:15:26 2024 GMT
+        Subject: C=AU, ST=Some-State, O=Internet Widgits Pty Ltd, CN=second.foobar.com
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (1024 bit)
+                Modulus:
+                    00:e4:13:e7:f0:97:87:62:5f:e2:cc:79:b2:55:77:
+                    d7:c2:b8:b9:d3:51:b9:72:6f:15:13:b5:94:e7:54:
+                    8e:c1:18:37:6c:d8:0b:90:5a:a4:5d:a5:0e:42:74:
+                    4e:7e:ad:e9:34:37:a7:6d:e5:30:c6:41:7b:f8:85:
+                    e9:61:84:cc:d8:80:f2:7f:af:6e:22:bc:2c:ce:27:
+                    1f:4a:fd:36:bc:1c:9d:f5:5f:e9:b4:96:0f:88:31:
+                    8f:a7:6d:38:54:a8:7e:2c:1c:1c:72:8c:2f:0b:0a:
+                    71:6f:d2:d5:c6:ac:e9:e0:e9:7e:72:46:43:a0:00:
+                    60:33:62:d7:7a:ff:1e:7f:77
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            X509v3 Key Usage: 
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Subject Key Identifier: 
+                4A:F7:E8:EB:57:1B:AB:49:41:23:E8:02:64:23:83:23:17:0E:CA:05
+            X509v3 Authority Key Identifier: 
+                keyid:70:46:49:1B:C2:71:2E:C0:50:D3:4B:18:58:8A:C4:10:1C:AE:B3:59
+
+            X509v3 Subject Alternative Name: 
+                DNS:*.foobar.com, DNS:foo.foobar.com
+    Signature Algorithm: sha1WithRSAEncryption
+         c8:c4:d0:4a:98:c8:d1:92:54:da:e0:a8:71:05:4e:76:e0:51:
+         5f:5f:c0:3f:38:9d:d4:d2:ea:68:c1:61:4c:67:74:22:19:54:
+         a1:1d:cf:2a:41:69:2a:2b:82:e8:f6:ca:54:4f:c2:bd:5a:0e:
+         f0:e1:c8:12:5f:9a:75:c0:d2:23:66:ea:dd:a7:2f:a6:7e:ae:
+         38:7e:14:2a:f4:d1:90:26:91:cb:0a:9a:5d:de:d6:25:bd:97:
+         34:c0:4f:8e:3b:3c:fc:7b:ee:c7:6c:6f:80:e6:a9:4f:6d:87:
+         94:d8:6d:cf:be:92:5b:7e:23:e5:eb:55:cb:5c:9b:27:bf:78:
+         ce:0d
+-----BEGIN CERTIFICATE-----
+MIICuTCCAiKgAwIBAgIBCTANBgkqhkiG9w0BAQUFADBaMQswCQYDVQQGEwJBVTET
+MBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwYSW50ZXJuZXQgV2lkZ2l0cyBQ
+dHkgTHRkMRMwEQYDVQQDDApzaWduaW5nIENBMB4XDTE0MDYwNzE1MTUyNloXDTI0
+MDYwNDE1MTUyNlowYTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUx
+ITAfBgNVBAoMGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDEaMBgGA1UEAwwRc2Vj
+b25kLmZvb2Jhci5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAOQT5/CX
+h2Jf4sx5slV318K4udNRuXJvFRO1lOdUjsEYN2zYC5BapF2lDkJ0Tn6t6TQ3p23l
+MMZBe/iF6WGEzNiA8n+vbiK8LM4nH0r9NrwcnfVf6bSWD4gxj6dtOFSofiwcHHKM
+LwsKcW/S1cas6eDpfnJGQ6AAYDNi13r/Hn93AgMBAAGjgYcwgYQwDAYDVR0TAQH/
+BAIwADALBgNVHQ8EBAMCBeAwHQYDVR0OBBYEFEr36OtXG6tJQSPoAmQjgyMXDsoF
+MB8GA1UdIwQYMBaAFHBGSRvCcS7AUNNLGFiKxBAcrrNZMCcGA1UdEQQgMB6CDCou
+Zm9vYmFyLmNvbYIOZm9vLmZvb2Jhci5jb20wDQYJKoZIhvcNAQEFBQADgYEAyMTQ
+SpjI0ZJU2uCocQVOduBRX1/APzid1NLqaMFhTGd0IhlUoR3PKkFpKiuC6PbKVE/C
+vVoO8OHIEl+adcDSI2bq3acvpn6uOH4UKvTRkCaRywqaXd7WJb2XNMBPjjs8/Hvu
+x2xvgOapT22HlNhtz76SW34j5etVy1ybJ794zg0=
+-----END CERTIFICATE-----
--- a/unikernel/duniverse/ocaml-x509/tests/testcertificates/intermediate/second/second-subj.pem
+++ b/unikernel/duniverse/ocaml-x509/tests/testcertificates/intermediate/second/second-subj.pem
@ -0,0 +1,62 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 8 (0x8)
+    Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=AU, ST=Some-State, O=Internet Widgits Pty Ltd, CN=signing CA
+        Validity
+            Not Before: Jun  7 15:15:01 2014 GMT
+            Not After : Jun  4 15:15:01 2024 GMT
+        Subject: C=AU, ST=Some-State, O=Internet Widgits Pty Ltd, CN=second.foobar.com
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (1024 bit)
+                Modulus:
+                    00:e4:13:e7:f0:97:87:62:5f:e2:cc:79:b2:55:77:
+                    d7:c2:b8:b9:d3:51:b9:72:6f:15:13:b5:94:e7:54:
+                    8e:c1:18:37:6c:d8:0b:90:5a:a4:5d:a5:0e:42:74:
+                    4e:7e:ad:e9:34:37:a7:6d:e5:30:c6:41:7b:f8:85:
+                    e9:61:84:cc:d8:80:f2:7f:af:6e:22:bc:2c:ce:27:
+                    1f:4a:fd:36:bc:1c:9d:f5:5f:e9:b4:96:0f:88:31:
+                    8f:a7:6d:38:54:a8:7e:2c:1c:1c:72:8c:2f:0b:0a:
+                    71:6f:d2:d5:c6:ac:e9:e0:e9:7e:72:46:43:a0:00:
+                    60:33:62:d7:7a:ff:1e:7f:77
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            X509v3 Key Usage: 
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Subject Key Identifier: 
+                4A:F7:E8:EB:57:1B:AB:49:41:23:E8:02:64:23:83:23:17:0E:CA:05
+            X509v3 Authority Key Identifier: 
+                keyid:70:46:49:1B:C2:71:2E:C0:50:D3:4B:18:58:8A:C4:10:1C:AE:B3:59
+
+            X509v3 Subject Alternative Name: 
+                DNS:foobar.com, DNS:foo.foobar.com
+    Signature Algorithm: sha1WithRSAEncryption
+         77:a1:83:7f:ed:4f:5c:a5:86:55:11:2a:6e:89:0c:07:be:0e:
+         1e:5a:b8:94:7f:0d:74:ef:e1:b4:e4:72:68:96:95:2b:00:a2:
+         29:a2:4e:16:cd:e8:04:fc:e7:ac:73:04:9a:fc:2a:5d:c2:59:
+         aa:92:0f:7c:fb:25:39:f9:b9:ed:d2:1a:04:93:8f:e0:d2:41:
+         eb:81:8d:c6:89:b0:54:de:1d:24:e6:6d:3b:a7:e2:80:61:32:
+         98:22:4d:a1:fb:61:5c:ed:15:87:ba:26:5e:91:53:54:47:a9:
+         76:b8:4b:bb:00:53:5b:c6:3c:8c:a4:80:d0:13:fa:b0:3c:d4:
+         0f:44
+-----BEGIN CERTIFICATE-----
+MIICtzCCAiCgAwIBAgIBCDANBgkqhkiG9w0BAQUFADBaMQswCQYDVQQGEwJBVTET
+MBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwYSW50ZXJuZXQgV2lkZ2l0cyBQ
+dHkgTHRkMRMwEQYDVQQDDApzaWduaW5nIENBMB4XDTE0MDYwNzE1MTUwMVoXDTI0
+MDYwNDE1MTUwMVowYTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUx
+ITAfBgNVBAoMGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDEaMBgGA1UEAwwRc2Vj
+b25kLmZvb2Jhci5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAOQT5/CX
+h2Jf4sx5slV318K4udNRuXJvFRO1lOdUjsEYN2zYC5BapF2lDkJ0Tn6t6TQ3p23l
+MMZBe/iF6WGEzNiA8n+vbiK8LM4nH0r9NrwcnfVf6bSWD4gxj6dtOFSofiwcHHKM
+LwsKcW/S1cas6eDpfnJGQ6AAYDNi13r/Hn93AgMBAAGjgYUwgYIwDAYDVR0TAQH/
+BAIwADALBgNVHQ8EBAMCBeAwHQYDVR0OBBYEFEr36OtXG6tJQSPoAmQjgyMXDsoF
+MB8GA1UdIwQYMBaAFHBGSRvCcS7AUNNLGFiKxBAcrrNZMCUGA1UdEQQeMByCCmZv
+b2Jhci5jb22CDmZvby5mb29iYXIuY29tMA0GCSqGSIb3DQEBBQUAA4GBAHehg3/t
+T1ylhlURKm6JDAe+Dh5auJR/DXTv4bTkcmiWlSsAoimiThbN6AT856xzBJr8Kl3C
+WaqSD3z7JTn5ue3SGgSTj+DSQeuBjcaJsFTeHSTmbTun4oBhMpgiTaH7YVztFYe6
+Jl6RU1RHqXa4S7sAU1vGPIykgNAT+rA81A9E
+-----END CERTIFICATE-----
--- a/unikernel/duniverse/ocaml-x509/tests/testcertificates/intermediate/second/second-subjaltemail.pem
+++ b/unikernel/duniverse/ocaml-x509/tests/testcertificates/intermediate/second/second-subjaltemail.pem
@ -0,0 +1,62 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 11 (0xb)
+    Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=AU, ST=Some-State, O=Internet Widgits Pty Ltd, CN=signing CA
+        Validity
+            Not Before: Jun  7 20:27:58 2014 GMT
+            Not After : Jun  4 20:27:58 2024 GMT
+        Subject: C=AU, ST=Some-State, O=Internet Widgits Pty Ltd, CN=second.foobar.com
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (1024 bit)
+                Modulus:
+                    00:e4:13:e7:f0:97:87:62:5f:e2:cc:79:b2:55:77:
+                    d7:c2:b8:b9:d3:51:b9:72:6f:15:13:b5:94:e7:54:
+                    8e:c1:18:37:6c:d8:0b:90:5a:a4:5d:a5:0e:42:74:
+                    4e:7e:ad:e9:34:37:a7:6d:e5:30:c6:41:7b:f8:85:
+                    e9:61:84:cc:d8:80:f2:7f:af:6e:22:bc:2c:ce:27:
+                    1f:4a:fd:36:bc:1c:9d:f5:5f:e9:b4:96:0f:88:31:
+                    8f:a7:6d:38:54:a8:7e:2c:1c:1c:72:8c:2f:0b:0a:
+                    71:6f:d2:d5:c6:ac:e9:e0:e9:7e:72:46:43:a0:00:
+                    60:33:62:d7:7a:ff:1e:7f:77
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            X509v3 Key Usage: 
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Subject Key Identifier: 
+                4A:F7:E8:EB:57:1B:AB:49:41:23:E8:02:64:23:83:23:17:0E:CA:05
+            X509v3 Authority Key Identifier: 
+                keyid:70:46:49:1B:C2:71:2E:C0:50:D3:4B:18:58:8A:C4:10:1C:AE:B3:59
+
+            X509v3 Subject Alternative Name: 
+                email:foobar.com
+    Signature Algorithm: sha1WithRSAEncryption
+         37:e6:be:0f:75:4a:b8:c2:e1:7f:e2:70:31:41:12:41:cc:05:
+         72:8f:ce:8c:2c:c2:1e:78:03:bb:61:f5:9a:76:cf:36:bb:66:
+         cf:4c:f1:33:ba:9d:a7:7e:20:92:7c:bb:9c:01:53:ba:c9:13:
+         2c:6e:c4:bf:04:ee:76:bc:eb:d3:87:e8:05:5c:62:f1:0e:7c:
+         51:12:25:c8:4f:e6:8e:46:c1:15:2a:55:fb:e4:8a:e3:04:7f:
+         9f:86:1d:03:e1:25:b4:6b:9a:bd:b6:02:ba:07:d4:82:04:06:
+         fb:fd:7d:9b:7b:37:96:f2:04:0e:a4:f3:43:6c:9a:f1:fb:1f:
+         4b:bc
+-----BEGIN CERTIFICATE-----
+MIICpTCCAg6gAwIBAgIBCzANBgkqhkiG9w0BAQUFADBaMQswCQYDVQQGEwJBVTET
+MBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwYSW50ZXJuZXQgV2lkZ2l0cyBQ
+dHkgTHRkMRMwEQYDVQQDDApzaWduaW5nIENBMB4XDTE0MDYwNzIwMjc1OFoXDTI0
+MDYwNDIwMjc1OFowYTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUx
+ITAfBgNVBAoMGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDEaMBgGA1UEAwwRc2Vj
+b25kLmZvb2Jhci5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAOQT5/CX
+h2Jf4sx5slV318K4udNRuXJvFRO1lOdUjsEYN2zYC5BapF2lDkJ0Tn6t6TQ3p23l
+MMZBe/iF6WGEzNiA8n+vbiK8LM4nH0r9NrwcnfVf6bSWD4gxj6dtOFSofiwcHHKM
+LwsKcW/S1cas6eDpfnJGQ6AAYDNi13r/Hn93AgMBAAGjdDByMAwGA1UdEwEB/wQC
+MAAwCwYDVR0PBAQDAgXgMB0GA1UdDgQWBBRK9+jrVxurSUEj6AJkI4MjFw7KBTAf
+BgNVHSMEGDAWgBRwRkkbwnEuwFDTSxhYisQQHK6zWTAVBgNVHREEDjAMgQpmb29i
+YXIuY29tMA0GCSqGSIb3DQEBBQUAA4GBADfmvg91SrjC4X/icDFBEkHMBXKPzows
+wh54A7th9Zp2zza7Zs9M8TO6nad+IJJ8u5wBU7rJEyxuxL8E7na869OH6AVcYvEO
+fFESJchP5o5GwRUqVfvkiuMEf5+GHQPhJbRrmr22AroH1IIEBvv9fZt7N5byBA6k
+80NsmvH7H0u8
+-----END CERTIFICATE-----
--- a/unikernel/duniverse/ocaml-x509/tests/testcertificates/intermediate/second/second-time.pem
+++ b/unikernel/duniverse/ocaml-x509/tests/testcertificates/intermediate/second/second-time.pem
@ -0,0 +1,62 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 3 (0x3)
+    Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=AU, ST=Some-State, O=Internet Widgits Pty Ltd, CN=signing CA
+        Validity
+            Not Before: Jun  7 15:11:22 2014 GMT
+            Not After : Jun  4 15:11:22 2024 GMT
+        Subject: C=AU, ST=Some-State, O=Internet Widgits Pty Ltd, CN=second.foobar.com
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (1024 bit)
+                Modulus:
+                    00:e4:13:e7:f0:97:87:62:5f:e2:cc:79:b2:55:77:
+                    d7:c2:b8:b9:d3:51:b9:72:6f:15:13:b5:94:e7:54:
+                    8e:c1:18:37:6c:d8:0b:90:5a:a4:5d:a5:0e:42:74:
+                    4e:7e:ad:e9:34:37:a7:6d:e5:30:c6:41:7b:f8:85:
+                    e9:61:84:cc:d8:80:f2:7f:af:6e:22:bc:2c:ce:27:
+                    1f:4a:fd:36:bc:1c:9d:f5:5f:e9:b4:96:0f:88:31:
+                    8f:a7:6d:38:54:a8:7e:2c:1c:1c:72:8c:2f:0b:0a:
+                    71:6f:d2:d5:c6:ac:e9:e0:e9:7e:72:46:43:a0:00:
+                    60:33:62:d7:7a:ff:1e:7f:77
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            X509v3 Key Usage: 
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Subject Key Identifier: 
+                4A:F7:E8:EB:57:1B:AB:49:41:23:E8:02:64:23:83:23:17:0E:CA:05
+            X509v3 Authority Key Identifier: 
+                keyid:70:46:49:1B:C2:71:2E:C0:50:D3:4B:18:58:8A:C4:10:1C:AE:B3:59
+
+            X509v3 Extended Key Usage: 
+                Time Stamping
+    Signature Algorithm: sha1WithRSAEncryption
+         2e:95:20:c3:be:29:0f:f7:3c:eb:e3:02:e1:11:18:21:88:6f:
+         16:d8:e1:04:4b:d8:56:80:4f:e2:78:c0:35:10:b4:0f:11:0d:
+         3d:96:0a:77:aa:56:be:27:7c:53:4c:c4:e7:f2:42:9a:3f:c0:
+         e5:8c:5e:9b:ff:c9:c2:13:d1:57:4a:9c:53:86:c2:c7:04:fa:
+         0b:8d:ac:52:0a:d8:e3:5d:d5:a6:f3:c0:67:db:de:43:0b:fd:
+         21:2a:7d:67:bd:de:f5:48:5a:f3:a5:d4:ed:18:4a:37:f9:c4:
+         6f:6e:7c:ff:b4:4e:db:5a:7b:6d:92:79:68:5d:ce:74:a0:b9:
+         96:38
+-----BEGIN CERTIFICATE-----
+MIICozCCAgygAwIBAgIBAzANBgkqhkiG9w0BAQUFADBaMQswCQYDVQQGEwJBVTET
+MBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwYSW50ZXJuZXQgV2lkZ2l0cyBQ
+dHkgTHRkMRMwEQYDVQQDDApzaWduaW5nIENBMB4XDTE0MDYwNzE1MTEyMloXDTI0
+MDYwNDE1MTEyMlowYTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUx
+ITAfBgNVBAoMGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDEaMBgGA1UEAwwRc2Vj
+b25kLmZvb2Jhci5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAOQT5/CX
+h2Jf4sx5slV318K4udNRuXJvFRO1lOdUjsEYN2zYC5BapF2lDkJ0Tn6t6TQ3p23l
+MMZBe/iF6WGEzNiA8n+vbiK8LM4nH0r9NrwcnfVf6bSWD4gxj6dtOFSofiwcHHKM
+LwsKcW/S1cas6eDpfnJGQ6AAYDNi13r/Hn93AgMBAAGjcjBwMAwGA1UdEwEB/wQC
+MAAwCwYDVR0PBAQDAgXgMB0GA1UdDgQWBBRK9+jrVxurSUEj6AJkI4MjFw7KBTAf
+BgNVHSMEGDAWgBRwRkkbwnEuwFDTSxhYisQQHK6zWTATBgNVHSUEDDAKBggrBgEF
+BQcDCDANBgkqhkiG9w0BAQUFAAOBgQAulSDDvikP9zzr4wLhERghiG8W2OEES9hW
+gE/ieMA1ELQPEQ09lgp3qla+J3xTTMTn8kKaP8DljF6b/8nCE9FXSpxThsLHBPoL
+jaxSCtjjXdWm88Bn295DC/0hKn1nvd71SFrzpdTtGEo3+cRvbnz/tE7bWnttknlo
+Xc50oLmWOA==
+-----END CERTIFICATE-----
--- a/unikernel/duniverse/ocaml-x509/tests/testcertificates/intermediate/second/second-unknown-noncrit.pem
+++ b/unikernel/duniverse/ocaml-x509/tests/testcertificates/intermediate/second/second-unknown-noncrit.pem
@ -0,0 +1,62 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 7 (0x7)
+    Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=AU, ST=Some-State, O=Internet Widgits Pty Ltd, CN=signing CA
+        Validity
+            Not Before: Jun  7 15:14:08 2014 GMT
+            Not After : Jun  4 15:14:08 2024 GMT
+        Subject: C=AU, ST=Some-State, O=Internet Widgits Pty Ltd, CN=second.foobar.com
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (1024 bit)
+                Modulus:
+                    00:e4:13:e7:f0:97:87:62:5f:e2:cc:79:b2:55:77:
+                    d7:c2:b8:b9:d3:51:b9:72:6f:15:13:b5:94:e7:54:
+                    8e:c1:18:37:6c:d8:0b:90:5a:a4:5d:a5:0e:42:74:
+                    4e:7e:ad:e9:34:37:a7:6d:e5:30:c6:41:7b:f8:85:
+                    e9:61:84:cc:d8:80:f2:7f:af:6e:22:bc:2c:ce:27:
+                    1f:4a:fd:36:bc:1c:9d:f5:5f:e9:b4:96:0f:88:31:
+                    8f:a7:6d:38:54:a8:7e:2c:1c:1c:72:8c:2f:0b:0a:
+                    71:6f:d2:d5:c6:ac:e9:e0:e9:7e:72:46:43:a0:00:
+                    60:33:62:d7:7a:ff:1e:7f:77
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            X509v3 Key Usage: 
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Subject Key Identifier: 
+                4A:F7:E8:EB:57:1B:AB:49:41:23:E8:02:64:23:83:23:17:0E:CA:05
+            X509v3 Authority Key Identifier: 
+                keyid:70:46:49:1B:C2:71:2E:C0:50:D3:4B:18:58:8A:C4:10:1C:AE:B3:59
+
+            1.2.3.4: 
+                ..Some random data
+    Signature Algorithm: sha1WithRSAEncryption
+         ad:f0:9c:da:6a:61:bd:5f:bd:bb:43:4c:c9:31:ca:07:6c:b0:
+         49:1f:9d:f0:72:b7:58:f8:91:a3:c5:d3:9a:46:c7:c7:ad:50:
+         7f:2c:05:c0:e2:ba:82:a7:22:2b:33:3a:60:87:dd:c7:18:01:
+         52:13:c4:da:63:88:65:cf:a2:a2:db:7f:83:85:11:94:12:82:
+         d2:d5:91:01:40:7c:9b:8a:a7:33:e7:e0:ab:39:de:b6:ee:56:
+         49:50:f8:b5:e7:f0:50:3e:96:e1:ea:5d:5b:00:26:c3:1b:13:
+         bc:12:da:35:b7:33:f0:cc:bc:ca:b1:1a:79:69:b3:34:22:35:
+         31:7f
+-----BEGIN CERTIFICATE-----
+MIICqTCCAhKgAwIBAgIBBzANBgkqhkiG9w0BAQUFADBaMQswCQYDVQQGEwJBVTET
+MBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwYSW50ZXJuZXQgV2lkZ2l0cyBQ
+dHkgTHRkMRMwEQYDVQQDDApzaWduaW5nIENBMB4XDTE0MDYwNzE1MTQwOFoXDTI0
+MDYwNDE1MTQwOFowYTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUx
+ITAfBgNVBAoMGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDEaMBgGA1UEAwwRc2Vj
+b25kLmZvb2Jhci5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAOQT5/CX
+h2Jf4sx5slV318K4udNRuXJvFRO1lOdUjsEYN2zYC5BapF2lDkJ0Tn6t6TQ3p23l
+MMZBe/iF6WGEzNiA8n+vbiK8LM4nH0r9NrwcnfVf6bSWD4gxj6dtOFSofiwcHHKM
+LwsKcW/S1cas6eDpfnJGQ6AAYDNi13r/Hn93AgMBAAGjeDB2MAwGA1UdEwEB/wQC
+MAAwCwYDVR0PBAQDAgXgMB0GA1UdDgQWBBRK9+jrVxurSUEj6AJkI4MjFw7KBTAf
+BgNVHSMEGDAWgBRwRkkbwnEuwFDTSxhYisQQHK6zWTAZBgMqAwQEEgwQU29tZSBy
+YW5kb20gZGF0YTANBgkqhkiG9w0BAQUFAAOBgQCt8JzaamG9X727Q0zJMcoHbLBJ
+H53wcrdY+JGjxdOaRsfHrVB/LAXA4rqCpyIrMzpgh93HGAFSE8TaY4hlz6Ki23+D
+hRGUEoLS1ZEBQHybiqcz5+CrOd627lZJUPi15/BQPpbh6l1bACbDGxO8Eto1tzPw
+zLzKsRp5abM0IjUxfw==
+-----END CERTIFICATE-----
--- a/unikernel/duniverse/ocaml-x509/tests/testcertificates/intermediate/second/second-unknown.pem
+++ b/unikernel/duniverse/ocaml-x509/tests/testcertificates/intermediate/second/second-unknown.pem
@ -0,0 +1,62 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 6 (0x6)
+    Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=AU, ST=Some-State, O=Internet Widgits Pty Ltd, CN=signing CA
+        Validity
+            Not Before: Jun  7 15:13:35 2014 GMT
+            Not After : Jun  4 15:13:35 2024 GMT
+        Subject: C=AU, ST=Some-State, O=Internet Widgits Pty Ltd, CN=second.foobar.com
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (1024 bit)
+                Modulus:
+                    00:e4:13:e7:f0:97:87:62:5f:e2:cc:79:b2:55:77:
+                    d7:c2:b8:b9:d3:51:b9:72:6f:15:13:b5:94:e7:54:
+                    8e:c1:18:37:6c:d8:0b:90:5a:a4:5d:a5:0e:42:74:
+                    4e:7e:ad:e9:34:37:a7:6d:e5:30:c6:41:7b:f8:85:
+                    e9:61:84:cc:d8:80:f2:7f:af:6e:22:bc:2c:ce:27:
+                    1f:4a:fd:36:bc:1c:9d:f5:5f:e9:b4:96:0f:88:31:
+                    8f:a7:6d:38:54:a8:7e:2c:1c:1c:72:8c:2f:0b:0a:
+                    71:6f:d2:d5:c6:ac:e9:e0:e9:7e:72:46:43:a0:00:
+                    60:33:62:d7:7a:ff:1e:7f:77
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            X509v3 Key Usage: 
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Subject Key Identifier: 
+                4A:F7:E8:EB:57:1B:AB:49:41:23:E8:02:64:23:83:23:17:0E:CA:05
+            X509v3 Authority Key Identifier: 
+                keyid:70:46:49:1B:C2:71:2E:C0:50:D3:4B:18:58:8A:C4:10:1C:AE:B3:59
+
+            1.2.3.4: critical
+                ..Some random data
+    Signature Algorithm: sha1WithRSAEncryption
+         22:43:ed:d2:8f:20:da:b4:31:1d:54:54:80:d4:b7:3b:c8:db:
+         81:30:1b:29:c3:e7:76:6c:7c:c1:1d:86:97:d7:98:99:e7:99:
+         87:25:11:30:9e:63:e2:4e:b2:a3:c9:97:aa:b0:a6:9c:73:76:
+         c3:a0:15:b2:05:3e:3f:92:38:aa:62:26:78:56:85:c0:bb:1e:
+         39:fa:f7:c8:40:25:9c:f9:c0:ce:70:b9:8a:b0:56:35:f7:54:
+         91:b5:b6:33:85:f2:18:ae:f4:ca:a4:d9:a8:41:34:4a:7b:23:
+         5d:41:77:87:6d:f9:65:07:62:6d:50:5a:f1:14:13:a3:c8:2f:
+         7a:3d
+-----BEGIN CERTIFICATE-----
+MIICrDCCAhWgAwIBAgIBBjANBgkqhkiG9w0BAQUFADBaMQswCQYDVQQGEwJBVTET
+MBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwYSW50ZXJuZXQgV2lkZ2l0cyBQ
+dHkgTHRkMRMwEQYDVQQDDApzaWduaW5nIENBMB4XDTE0MDYwNzE1MTMzNVoXDTI0
+MDYwNDE1MTMzNVowYTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUx
+ITAfBgNVBAoMGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDEaMBgGA1UEAwwRc2Vj
+b25kLmZvb2Jhci5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAOQT5/CX
+h2Jf4sx5slV318K4udNRuXJvFRO1lOdUjsEYN2zYC5BapF2lDkJ0Tn6t6TQ3p23l
+MMZBe/iF6WGEzNiA8n+vbiK8LM4nH0r9NrwcnfVf6bSWD4gxj6dtOFSofiwcHHKM
+LwsKcW/S1cas6eDpfnJGQ6AAYDNi13r/Hn93AgMBAAGjezB5MAwGA1UdEwEB/wQC
+MAAwCwYDVR0PBAQDAgXgMB0GA1UdDgQWBBRK9+jrVxurSUEj6AJkI4MjFw7KBTAf
+BgNVHSMEGDAWgBRwRkkbwnEuwFDTSxhYisQQHK6zWTAcBgMqAwQBAf8EEgwQU29t
+ZSByYW5kb20gZGF0YTANBgkqhkiG9w0BAQUFAAOBgQAiQ+3SjyDatDEdVFSA1Lc7
+yNuBMBspw+d2bHzBHYaX15iZ55mHJREwnmPiTrKjyZeqsKacc3bDoBWyBT4/kjiq
+YiZ4VoXAux45+vfIQCWc+cDOcLmKsFY191SRtbYzhfIYrvTKpNmoQTRKeyNdQXeH
+bfllB2JtUFrxFBOjyC96PQ==
+-----END CERTIFICATE-----
--- a/unikernel/duniverse/ocaml-x509/tests/testcertificates/intermediate/second/second.key
+++ b/unikernel/duniverse/ocaml-x509/tests/testcertificates/intermediate/second/second.key
@ -0,0 +1,16 @@
+-----BEGIN PRIVATE KEY-----
+MIICdgIBADANBgkqhkiG9w0BAQEFAASCAmAwggJcAgEAAoGBAOQT5/CXh2Jf4sx5
+slV318K4udNRuXJvFRO1lOdUjsEYN2zYC5BapF2lDkJ0Tn6t6TQ3p23lMMZBe/iF
+6WGEzNiA8n+vbiK8LM4nH0r9NrwcnfVf6bSWD4gxj6dtOFSofiwcHHKMLwsKcW/S
+1cas6eDpfnJGQ6AAYDNi13r/Hn93AgMBAAECgYB4qOtIhfGSoqWKhUtKGfekRTPR
+zudr2cZtwd9/rmVDVDtmMrmTadCQ1hRAJeWs8PZxsIu8AMcX62bZaIa6F5aCZ7IU
+Jwwd9rt6o9pbBh2lcBO+iy+oCwFv7BImP6jFH7ODC7DYrwich2iEWIqNbhoLD8+7
+0B9klyIlpc39fbL+2QJBAPH+cGq330uE8GVWyw3A8GVnkMrrcKKG+EAXMp0cCdSe
+YhoGPURk/Uww78GKfCmRFAVkNRQj4fJ+sIc16+nTf4sCQQDxR0Zk5T7sH2A9N2da
+Al6q/523sA5AkF/wJ9xmcT5HfZ/xFx0R96TSHR6SplbvXALUeQTWTmbuHkInraxi
+Sz1FAkEAk34I9oJrTpQQETP9PrzByIx+667kT6sD08xPxQI526VNFZ+H6A/FcpLB
+Dq1hT9Rk54RT9ZqJNEuTPFXZHAMUUQJAXe5rn1gIORC1/N8W41nM1TGSizKFOel7
+EBnUmiU4I8jqfYeMD7SjfBFOF7WeXq0phOJgWbZIKCerhZr9Y377KQJAdYo+p8B8
+uwp+Yq/9S+JrXtwLYOFYDm5lPykGp1rHZKzJdU6hYMednsSZ0FWZn2M5l0lhgPPs
+mPVCW2CSvF+p9Q==
+-----END PRIVATE KEY-----
--- a/unikernel/duniverse/ocaml-x509/tests/testcertificates/intermediate/second/second.pem
+++ b/unikernel/duniverse/ocaml-x509/tests/testcertificates/intermediate/second/second.pem
@ -0,0 +1,59 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 1 (0x1)
+    Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=AU, ST=Some-State, O=Internet Widgits Pty Ltd, CN=signing CA
+        Validity
+            Not Before: Jun  7 14:46:24 2014 GMT
+            Not After : Jun  4 14:46:24 2024 GMT
+        Subject: C=AU, ST=Some-State, O=Internet Widgits Pty Ltd, CN=second.foobar.com
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (1024 bit)
+                Modulus:
+                    00:e4:13:e7:f0:97:87:62:5f:e2:cc:79:b2:55:77:
+                    d7:c2:b8:b9:d3:51:b9:72:6f:15:13:b5:94:e7:54:
+                    8e:c1:18:37:6c:d8:0b:90:5a:a4:5d:a5:0e:42:74:
+                    4e:7e:ad:e9:34:37:a7:6d:e5:30:c6:41:7b:f8:85:
+                    e9:61:84:cc:d8:80:f2:7f:af:6e:22:bc:2c:ce:27:
+                    1f:4a:fd:36:bc:1c:9d:f5:5f:e9:b4:96:0f:88:31:
+                    8f:a7:6d:38:54:a8:7e:2c:1c:1c:72:8c:2f:0b:0a:
+                    71:6f:d2:d5:c6:ac:e9:e0:e9:7e:72:46:43:a0:00:
+                    60:33:62:d7:7a:ff:1e:7f:77
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            X509v3 Key Usage: 
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Subject Key Identifier: 
+                4A:F7:E8:EB:57:1B:AB:49:41:23:E8:02:64:23:83:23:17:0E:CA:05
+            X509v3 Authority Key Identifier: 
+                keyid:70:46:49:1B:C2:71:2E:C0:50:D3:4B:18:58:8A:C4:10:1C:AE:B3:59
+
+    Signature Algorithm: sha1WithRSAEncryption
+         ba:87:d8:55:8c:17:44:eb:c3:5b:9e:9a:d2:c7:78:d9:b0:00:
+         6e:a0:be:68:ed:a6:70:06:46:5b:79:f6:39:1b:d2:be:2d:d1:
+         22:4b:28:a7:4d:f5:53:f1:e1:10:c0:fd:11:47:cd:b0:0f:57:
+         c0:4f:dc:c8:09:0d:77:01:2c:21:e4:37:99:69:81:cb:87:d1:
+         64:60:9e:92:56:9b:27:36:e9:e4:d8:5f:86:60:a8:d9:8f:0e:
+         75:b1:1a:ef:d7:3a:9b:59:04:2c:e4:7f:16:73:09:b1:86:91:
+         03:23:37:25:f3:4c:0a:77:3d:e1:f7:0e:29:35:c1:64:4d:e2:
+         62:bb
+-----BEGIN CERTIFICATE-----
+MIICjjCCAfegAwIBAgIBATANBgkqhkiG9w0BAQUFADBaMQswCQYDVQQGEwJBVTET
+MBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwYSW50ZXJuZXQgV2lkZ2l0cyBQ
+dHkgTHRkMRMwEQYDVQQDDApzaWduaW5nIENBMB4XDTE0MDYwNzE0NDYyNFoXDTI0
+MDYwNDE0NDYyNFowYTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUx
+ITAfBgNVBAoMGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDEaMBgGA1UEAwwRc2Vj
+b25kLmZvb2Jhci5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAOQT5/CX
+h2Jf4sx5slV318K4udNRuXJvFRO1lOdUjsEYN2zYC5BapF2lDkJ0Tn6t6TQ3p23l
+MMZBe/iF6WGEzNiA8n+vbiK8LM4nH0r9NrwcnfVf6bSWD4gxj6dtOFSofiwcHHKM
+LwsKcW/S1cas6eDpfnJGQ6AAYDNi13r/Hn93AgMBAAGjXTBbMAwGA1UdEwEB/wQC
+MAAwCwYDVR0PBAQDAgXgMB0GA1UdDgQWBBRK9+jrVxurSUEj6AJkI4MjFw7KBTAf
+BgNVHSMEGDAWgBRwRkkbwnEuwFDTSxhYisQQHK6zWTANBgkqhkiG9w0BAQUFAAOB
+gQC6h9hVjBdE68NbnprSx3jZsABuoL5o7aZwBkZbefY5G9K+LdEiSyinTfVT8eEQ
+wP0RR82wD1fAT9zICQ13ASwh5DeZaYHLh9FkYJ6SVpsnNunk2F+GYKjZjw51sRrv
+1zqbWQQs5H8WcwmxhpEDIzcl80wKdz3h9w4pNcFkTeJiuw==
+-----END CERTIFICATE-----