Add newtype of CodeUnits (#6241)

Corresponds to RustPython/rustpython.github.io#81.

.github/workflows/cron-ci.yaml

@@ -1,6 +1,6 @@
 on:
   schedule:
-    - cron: '0 0 * * 6'
+    - cron: "0 0 * * 6"
   workflow_dispatch:
   push:
     paths:
@@ -34,7 +34,7 @@ jobs:
         run: python scripts/cargo-llvm-cov.py
         continue-on-error: true
       - name: Run cargo-llvm-cov with Python test suite.
-        run: cargo llvm-cov --no-report run -- -m test -u all --slowest --fail-env-changed 
+        run: cargo llvm-cov --no-report run -- -m test -u all --slowest --fail-env-changed
         continue-on-error: true
       - name: Prepare code coverage data
         run: cargo llvm-cov report --lcov --output-path='codecov.lcov'
@@ -109,6 +109,23 @@ jobs:
           rm ./_data/whats_left/modules.csv
           echo -e "module" > ./_data/whats_left/modules.csv
           cat ./_data/whats_left.temp | grep "(entire module)" | cut -d ' ' -f 1 | sort >> ./_data/whats_left/modules.csv
+          awk -f - ./_data/whats_left.temp > ./_data/whats_left/builtin_items.csv <<'EOF'
+          BEGIN {
+              OFS=","
+              print "builtin,name,is_inherited"
+          }
+          /^# builtin items/ { in_section=1; next }
+          /^$/ { if (in_section) exit }
+          in_section {
+              split($1, a, ".")
+              rest = ""
+              idx = index($0, " ")
+              if (idx > 0) {
+                  rest = substr($0, idx+1)
+              }
+              print a[1], $1, rest
+          }
+          EOF
           git add -A
           if git -c user.name="Github Actions" -c user.email="actions@github.com" commit -m "Update what is left results" --author="$GITHUB_ACTOR"; then
             git push

.github/workflows/release.yml

@@ -83,7 +83,7 @@ jobs:
         if: runner.os == 'Windows'
 
       - name: Upload Binary Artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: rustpython-release-${{ runner.os }}-${{ matrix.platform.target }}
           path: target/rustpython-release-${{ runner.os }}-${{ matrix.platform.target }}*
@@ -105,7 +105,7 @@ jobs:
         run: cp target/wasm32-wasip1/release/rustpython.wasm target/rustpython-release-wasm32-wasip1.wasm
 
       - name: Upload Binary Artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: rustpython-release-wasm32-wasip1
           path: target/rustpython-release-wasm32-wasip1.wasm
@@ -145,7 +145,7 @@ jobs:
     needs: [build, build-wasm]
     steps:
       - name: Download Binary Artifacts
-        uses: actions/download-artifact@v5
+        uses: actions/download-artifact@v6
         with:
           path: bin
           pattern: rustpython-*

Cargo.lock

@@ -1825,6 +1825,7 @@ version = "0.11.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1fd6780a80ae0c52cc120a26a1a42c1ae51b247a253e4e06113d23d2c2edd078"
 dependencies = [
+ "phf_macros",
  "phf_shared",
 ]
 
@@ -1848,6 +1849,19 @@ dependencies = [
  "rand 0.8.5",
 ]
 
+[[package]]
+name = "phf_macros"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f84ac04429c13a7ff43785d75ad27569f2951ce0ffd30a3321230db2fc727216"
+dependencies = [
+ "phf_generator",
+ "phf_shared",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
 [[package]]
 name = "phf_shared"
 version = "0.11.3"
@@ -2573,6 +2587,7 @@ dependencies = [
  "page_size",
  "parking_lot",
  "paste",
+ "phf",
  "pymath",
  "rand_core 0.9.3",
  "rustix",

Lib/ctypes/__init__.py

@@ -299,9 +299,7 @@ def create_unicode_buffer(init, size=None):
         return buf
     elif isinstance(init, int):
         _sys.audit("ctypes.create_unicode_buffer", None, init)
-        # XXX: RUSTPYTHON
-        # buftype = c_wchar * init
-        buftype = c_wchar.__mul__(init)
+        buftype = c_wchar * init
         buf = buftype()
         return buf
     raise TypeError(init)

Lib/ssl.py

@@ -18,9 +18,10 @@ Functions:
                           seconds past the Epoch (the time values
                           returned from time.time())
 
-  fetch_server_certificate (HOST, PORT) -- fetch the certificate provided
-                          by the server running on HOST at port PORT.  No
-                          validation of the certificate is performed.
+  get_server_certificate (addr, ssl_version, ca_certs, timeout) -- Retrieve the
+                          certificate from the server at the specified
+                          address and return it as a PEM-encoded string
+
 
 Integer constants:
 
@@ -94,21 +95,22 @@ import sys
 import os
 from collections import namedtuple
 from enum import Enum as _Enum, IntEnum as _IntEnum, IntFlag as _IntFlag
+from enum import _simple_enum
 
 import _ssl             # if we can't import it, let the error propagate
 
 from _ssl import OPENSSL_VERSION_NUMBER, OPENSSL_VERSION_INFO, OPENSSL_VERSION
-from _ssl import _SSLContext, SSLSession, MemoryBIO
+from _ssl import _SSLContext, MemoryBIO, SSLSession
 from _ssl import (
     SSLError, SSLZeroReturnError, SSLWantReadError, SSLWantWriteError,
     SSLSyscallError, SSLEOFError, SSLCertVerificationError
     )
 from _ssl import txt2obj as _txt2obj, nid2obj as _nid2obj
-from _ssl import RAND_status, RAND_add, RAND_bytes, RAND_pseudo_bytes
+from _ssl import RAND_status, RAND_add, RAND_bytes
 try:
     from _ssl import RAND_egd
 except ImportError:
-    # LibreSSL does not provide RAND_egd
+    # RAND_egd is not supported on some platforms
     pass
 
 
@@ -118,7 +120,6 @@ from _ssl import (
 )
 from _ssl import _DEFAULT_CIPHERS, _OPENSSL_API_VERSION
 
-
 _IntEnum._convert_(
     '_SSLMethod', __name__,
     lambda name: name.startswith('PROTOCOL_') and name != 'PROTOCOL_SSLv23',
@@ -155,7 +156,8 @@ _PROTOCOL_NAMES = {value: name for name, value in _SSLMethod.__members__.items()
 _SSLv2_IF_EXISTS = getattr(_SSLMethod, 'PROTOCOL_SSLv2', None)
 
 
-class TLSVersion(_IntEnum):
+@_simple_enum(_IntEnum)
+class TLSVersion:
     MINIMUM_SUPPORTED = _ssl.PROTO_MINIMUM_SUPPORTED
     SSLv3 = _ssl.PROTO_SSLv3
     TLSv1 = _ssl.PROTO_TLSv1
@@ -165,7 +167,8 @@ class TLSVersion(_IntEnum):
     MAXIMUM_SUPPORTED = _ssl.PROTO_MAXIMUM_SUPPORTED
 
 
-class _TLSContentType(_IntEnum):
+@_simple_enum(_IntEnum)
+class _TLSContentType:
     """Content types (record layer)
 
     See RFC 8446, section B.1
@@ -179,7 +182,8 @@ class _TLSContentType(_IntEnum):
     INNER_CONTENT_TYPE = 0x101
 
 
-class _TLSAlertType(_IntEnum):
+@_simple_enum(_IntEnum)
+class _TLSAlertType:
     """Alert types for TLSContentType.ALERT messages
 
     See RFC 8466, section B.2
@@ -220,7 +224,8 @@ class _TLSAlertType(_IntEnum):
     NO_APPLICATION_PROTOCOL = 120
 
 
-class _TLSMessageType(_IntEnum):
+@_simple_enum(_IntEnum)
+class _TLSMessageType:
     """Message types (handshake protocol)
 
     See RFC 8446, section B.3
@@ -250,10 +255,10 @@ class _TLSMessageType(_IntEnum):
 
 
 if sys.platform == "win32":
-    from _ssl import enum_certificates #, enum_crls
+    from _ssl import enum_certificates, enum_crls
 
-from socket import socket, AF_INET, SOCK_STREAM, create_connection
-from socket import SOL_SOCKET, SO_TYPE
+from socket import socket, SOCK_STREAM, create_connection
+from socket import SOL_SOCKET, SO_TYPE, _GLOBAL_DEFAULT_TIMEOUT
 import socket as _socket
 import base64        # for DER-to-PEM translation
 import errno
@@ -275,7 +280,7 @@ CertificateError = SSLCertVerificationError
 def _dnsname_match(dn, hostname):
     """Matching according to RFC 6125, section 6.4.3
 
-    - Hostnames are compared lower case.
+    - Hostnames are compared lower-case.
     - For IDNA, both dn and hostname must be encoded as IDN A-label (ACE).
     - Partial wildcards like 'www*.example.org', multiple wildcards, sole
       wildcard or wildcards in labels other then the left-most label are not
@@ -363,68 +368,11 @@ def _ipaddress_match(cert_ipaddress, host_ip):
     (section 1.7.2 - "Out of Scope").
     """
     # OpenSSL may add a trailing newline to a subjectAltName's IP address,
-    # commonly woth IPv6 addresses. Strip off trailing \n.
+    # commonly with IPv6 addresses. Strip off trailing \n.
     ip = _inet_paton(cert_ipaddress.rstrip())
     return ip == host_ip
 
 
-def match_hostname(cert, hostname):
-    """Verify that *cert* (in decoded format as returned by
-    SSLSocket.getpeercert()) matches the *hostname*.  RFC 2818 and RFC 6125
-    rules are followed.
-
-    The function matches IP addresses rather than dNSNames if hostname is a
-    valid ipaddress string. IPv4 addresses are supported on all platforms.
-    IPv6 addresses are supported on platforms with IPv6 support (AF_INET6
-    and inet_pton).
-
-    CertificateError is raised on failure. On success, the function
-    returns nothing.
-    """
-    if not cert:
-        raise ValueError("empty or no certificate, match_hostname needs a "
-                         "SSL socket or SSL context with either "
-                         "CERT_OPTIONAL or CERT_REQUIRED")
-    try:
-        host_ip = _inet_paton(hostname)
-    except ValueError:
-        # Not an IP address (common case)
-        host_ip = None
-    dnsnames = []
-    san = cert.get('subjectAltName', ())
-    for key, value in san:
-        if key == 'DNS':
-            if host_ip is None and _dnsname_match(value, hostname):
-                return
-            dnsnames.append(value)
-        elif key == 'IP Address':
-            if host_ip is not None and _ipaddress_match(value, host_ip):
-                return
-            dnsnames.append(value)
-    if not dnsnames:
-        # The subject is only checked when there is no dNSName entry
-        # in subjectAltName
-        for sub in cert.get('subject', ()):
-            for key, value in sub:
-                # XXX according to RFC 2818, the most specific Common Name
-                # must be used.
-                if key == 'commonName':
-                    if _dnsname_match(value, hostname):
-                        return
-                    dnsnames.append(value)
-    if len(dnsnames) > 1:
-        raise CertificateError("hostname %r "
-            "doesn't match either of %s"
-            % (hostname, ', '.join(map(repr, dnsnames))))
-    elif len(dnsnames) == 1:
-        raise CertificateError("hostname %r "
-            "doesn't match %r"
-            % (hostname, dnsnames[0]))
-    else:
-        raise CertificateError("no appropriate commonName or "
-            "subjectAltName fields were found")
-
-
 DefaultVerifyPaths = namedtuple("DefaultVerifyPaths",
     "cafile capath openssl_cafile_env openssl_cafile openssl_capath_env "
     "openssl_capath")
@@ -479,7 +427,14 @@ class SSLContext(_SSLContext):
     sslsocket_class = None  # SSLSocket is assigned later.
     sslobject_class = None  # SSLObject is assigned later.
 
-    def __new__(cls, protocol=PROTOCOL_TLS, *args, **kwargs):
+    def __new__(cls, protocol=None, *args, **kwargs):
+        if protocol is None:
+            warnings.warn(
+                "ssl.SSLContext() without protocol argument is deprecated.",
+                category=DeprecationWarning,
+                stacklevel=2
+            )
+            protocol = PROTOCOL_TLS
         self = _SSLContext.__new__(cls, protocol)
         return self
 
@@ -518,6 +473,11 @@ class SSLContext(_SSLContext):
         )
 
     def set_npn_protocols(self, npn_protocols):
+        warnings.warn(
+            "ssl NPN is deprecated, use ALPN instead",
+            DeprecationWarning,
+            stacklevel=2
+        )
         protos = bytearray()
         for protocol in npn_protocols:
             b = bytes(protocol, 'ascii')
@@ -553,18 +513,17 @@ class SSLContext(_SSLContext):
         self._set_alpn_protocols(protos)
 
     def _load_windows_store_certs(self, storename, purpose):
-        certs = bytearray()
         try:
             for cert, encoding, trust in enum_certificates(storename):
                 # CA certs are never PKCS#7 encoded
                 if encoding == "x509_asn":
                     if trust is True or purpose.oid in trust:
-                        certs.extend(cert)
+                        try:
+                            self.load_verify_locations(cadata=cert)
+                        except SSLError as exc:
+                            warnings.warn(f"Bad certificate in Windows certificate store: {exc!s}")
         except PermissionError:
             warnings.warn("unable to enumerate Windows certificate store")
-        if certs:
-            self.load_verify_locations(cadata=certs)
-        return certs
 
     def load_default_certs(self, purpose=Purpose.SERVER_AUTH):
         if not isinstance(purpose, _ASN1Object):
@@ -734,12 +693,25 @@ def create_default_context(purpose=Purpose.SERVER_AUTH, *, cafile=None,
     # SSLContext sets OP_NO_SSLv2, OP_NO_SSLv3, OP_NO_COMPRESSION,
     # OP_CIPHER_SERVER_PREFERENCE, OP_SINGLE_DH_USE and OP_SINGLE_ECDH_USE
     # by default.
-    context = SSLContext(PROTOCOL_TLS)
-
     if purpose == Purpose.SERVER_AUTH:
         # verify certs and host name in client mode
+        context = SSLContext(PROTOCOL_TLS_CLIENT)
         context.verify_mode = CERT_REQUIRED
         context.check_hostname = True
+    elif purpose == Purpose.CLIENT_AUTH:
+        context = SSLContext(PROTOCOL_TLS_SERVER)
+    else:
+        raise ValueError(purpose)
+
+    # `VERIFY_X509_PARTIAL_CHAIN` makes OpenSSL's chain building behave more
+    # like RFC 3280 and 5280, which specify that chain building stops with the
+    # first trust anchor, even if that anchor is not self-signed.
+    #
+    # `VERIFY_X509_STRICT` makes OpenSSL more conservative about the
+    # certificates it accepts, including "disabling workarounds for
+    # some broken certificates."
+    context.verify_flags |= (_ssl.VERIFY_X509_PARTIAL_CHAIN |
+                             _ssl.VERIFY_X509_STRICT)
 
     if cafile or capath or cadata:
         context.load_verify_locations(cafile, capath, cadata)
@@ -755,7 +727,7 @@ def create_default_context(purpose=Purpose.SERVER_AUTH, *, cafile=None,
             context.keylog_filename = keylogfile
     return context
 
-def _create_unverified_context(protocol=PROTOCOL_TLS, *, cert_reqs=CERT_NONE,
+def _create_unverified_context(protocol=None, *, cert_reqs=CERT_NONE,
                            check_hostname=False, purpose=Purpose.SERVER_AUTH,
                            certfile=None, keyfile=None,
                            cafile=None, capath=None, cadata=None):
@@ -772,10 +744,18 @@ def _create_unverified_context(protocol=PROTOCOL_TLS, *, cert_reqs=CERT_NONE,
     # SSLContext sets OP_NO_SSLv2, OP_NO_SSLv3, OP_NO_COMPRESSION,
     # OP_CIPHER_SERVER_PREFERENCE, OP_SINGLE_DH_USE and OP_SINGLE_ECDH_USE
     # by default.
-    context = SSLContext(protocol)
+    if purpose == Purpose.SERVER_AUTH:
+        # verify certs and host name in client mode
+        if protocol is None:
+            protocol = PROTOCOL_TLS_CLIENT
+    elif purpose == Purpose.CLIENT_AUTH:
+        if protocol is None:
+            protocol = PROTOCOL_TLS_SERVER
+    else:
+        raise ValueError(purpose)
 
-    if not check_hostname:
-        context.check_hostname = False
+    context = SSLContext(protocol)
+    context.check_hostname = check_hostname
     if cert_reqs is not None:
         context.verify_mode = cert_reqs
     if check_hostname:
@@ -905,19 +885,46 @@ class SSLObject:
         """
         return self._sslobj.getpeercert(binary_form)
 
+    def get_verified_chain(self):
+        """Returns verified certificate chain provided by the other
+        end of the SSL channel as a list of DER-encoded bytes.
+
+        If certificate verification was disabled method acts the same as
+        ``SSLSocket.get_unverified_chain``.
+        """
+        chain = self._sslobj.get_verified_chain()
+
+        if chain is None:
+            return []
+
+        return [cert.public_bytes(_ssl.ENCODING_DER) for cert in chain]
+
+    def get_unverified_chain(self):
+        """Returns raw certificate chain provided by the other
+        end of the SSL channel as a list of DER-encoded bytes.
+        """
+        chain = self._sslobj.get_unverified_chain()
+
+        if chain is None:
+            return []
+
+        return [cert.public_bytes(_ssl.ENCODING_DER) for cert in chain]
+
     def selected_npn_protocol(self):
         """Return the currently selected NPN protocol as a string, or ``None``
         if a next protocol was not negotiated or if NPN is not supported by one
         of the peers."""
-        if _ssl.HAS_NPN:
-            return self._sslobj.selected_npn_protocol()
+        warnings.warn(
+            "ssl NPN is deprecated, use ALPN instead",
+            DeprecationWarning,
+            stacklevel=2
+        )
 
     def selected_alpn_protocol(self):
         """Return the currently selected ALPN protocol as a string, or ``None``
         if a next protocol was not negotiated or if ALPN is not supported by one
         of the peers."""
-        if _ssl.HAS_ALPN:
-            return self._sslobj.selected_alpn_protocol()
+        return self._sslobj.selected_alpn_protocol()
 
     def cipher(self):
         """Return the currently selected cipher as a 3-tuple ``(name,
@@ -996,38 +1003,67 @@ class SSLSocket(socket):
         if context.check_hostname and not server_hostname:
             raise ValueError("check_hostname requires server_hostname")
 
+        sock_timeout = sock.gettimeout()
         kwargs = dict(
             family=sock.family, type=sock.type, proto=sock.proto,
             fileno=sock.fileno()
         )
         self = cls.__new__(cls, **kwargs)
         super(SSLSocket, self).__init__(**kwargs)
-        self.settimeout(sock.gettimeout())
         sock.detach()
-
-        self._context = context
-        self._session = session
-        self._closed = False
-        self._sslobj = None
-        self.server_side = server_side
-        self.server_hostname = context._encode_hostname(server_hostname)
-        self.do_handshake_on_connect = do_handshake_on_connect
-        self.suppress_ragged_eofs = suppress_ragged_eofs
-
-        # See if we are connected
+        # Now SSLSocket is responsible for closing the file descriptor.
         try:
-            self.getpeername()
-        except OSError as e:
-            if e.errno != errno.ENOTCONN:
-                raise
-            connected = False
-        else:
-            connected = True
+            self._context = context
+            self._session = session
+            self._closed = False
+            self._sslobj = None
+            self.server_side = server_side
+            self.server_hostname = context._encode_hostname(server_hostname)
+            self.do_handshake_on_connect = do_handshake_on_connect
+            self.suppress_ragged_eofs = suppress_ragged_eofs
 
-        self._connected = connected
-        if connected:
-            # create the SSL object
+            # See if we are connected
             try:
+                self.getpeername()
+            except OSError as e:
+                if e.errno != errno.ENOTCONN:
+                    raise
+                connected = False
+                blocking = self.getblocking()
+                self.setblocking(False)
+                try:
+                    # We are not connected so this is not supposed to block, but
+                    # testing revealed otherwise on macOS and Windows so we do
+                    # the non-blocking dance regardless. Our raise when any data
+                    # is found means consuming the data is harmless.
+                    notconn_pre_handshake_data = self.recv(1)
+                except OSError as e:
+                    # EINVAL occurs for recv(1) on non-connected on unix sockets.
+                    if e.errno not in (errno.ENOTCONN, errno.EINVAL):
+                        raise
+                    notconn_pre_handshake_data = b''
+                self.setblocking(blocking)
+                if notconn_pre_handshake_data:
+                    # This prevents pending data sent to the socket before it was
+                    # closed from escaping to the caller who could otherwise
+                    # presume it came through a successful TLS connection.
+                    reason = "Closed before TLS handshake with data in recv buffer."
+                    notconn_pre_handshake_data_error = SSLError(e.errno, reason)
+                    # Add the SSLError attributes that _ssl.c always adds.
+                    notconn_pre_handshake_data_error.reason = reason
+                    notconn_pre_handshake_data_error.library = None
+                    try:
+                        raise notconn_pre_handshake_data_error
+                    finally:
+                        # Explicitly break the reference cycle.
+                        notconn_pre_handshake_data_error = None
+            else:
+                connected = True
+
+            self.settimeout(sock_timeout)  # Must come after setblocking() calls.
+            self._connected = connected
+            if connected:
+                # create the SSL object
                 self._sslobj = self._context._wrap_socket(
                     self, server_side, self.server_hostname,
                     owner=self, session=self._session,
@@ -1038,9 +1074,12 @@ class SSLSocket(socket):
                         # non-blocking
                         raise ValueError("do_handshake_on_connect should not be specified for non-blocking sockets")
                     self.do_handshake()
-            except (OSError, ValueError):
+        except:
+            try:
                 self.close()
-                raise
+            except OSError:
+                pass
+            raise
         return self
 
     @property
@@ -1123,13 +1162,33 @@ class SSLSocket(socket):
         self._check_connected()
         return self._sslobj.getpeercert(binary_form)
 
+    @_sslcopydoc
+    def get_verified_chain(self):
+        chain = self._sslobj.get_verified_chain()
+
+        if chain is None:
+            return []
+
+        return [cert.public_bytes(_ssl.ENCODING_DER) for cert in chain]
+
+    @_sslcopydoc
+    def get_unverified_chain(self):
+        chain = self._sslobj.get_unverified_chain()
+
+        if chain is None:
+            return []
+
+        return [cert.public_bytes(_ssl.ENCODING_DER) for cert in chain]
+
     @_sslcopydoc
     def selected_npn_protocol(self):
         self._checkClosed()
-        if self._sslobj is None or not _ssl.HAS_NPN:
-            return None
-        else:
-            return self._sslobj.selected_npn_protocol()
+        warnings.warn(
+            "ssl NPN is deprecated, use ALPN instead",
+            DeprecationWarning,
+            stacklevel=2
+        )
+        return None
 
     @_sslcopydoc
     def selected_alpn_protocol(self):
@@ -1229,10 +1288,14 @@ class SSLSocket(socket):
 
     def recv_into(self, buffer, nbytes=None, flags=0):
         self._checkClosed()
-        if buffer and (nbytes is None):
-            nbytes = len(buffer)
-        elif nbytes is None:
-            nbytes = 1024
+        if nbytes is None:
+            if buffer is not None:
+                with memoryview(buffer) as view:
+                    nbytes = view.nbytes
+                if not nbytes:
+                    nbytes = 1024
+            else:
+                nbytes = 1024
         if self._sslobj is not None:
             if flags != 0:
                 raise ValueError(
@@ -1382,32 +1445,6 @@ SSLContext.sslsocket_class = SSLSocket
 SSLContext.sslobject_class = SSLObject
 
 
-def wrap_socket(sock, keyfile=None, certfile=None,
-                server_side=False, cert_reqs=CERT_NONE,
-                ssl_version=PROTOCOL_TLS, ca_certs=None,
-                do_handshake_on_connect=True,
-                suppress_ragged_eofs=True,
-                ciphers=None):
-
-    if server_side and not certfile:
-        raise ValueError("certfile must be specified for server-side "
-                         "operations")
-    if keyfile and not certfile:
-        raise ValueError("certfile must be specified")
-    context = SSLContext(ssl_version)
-    context.verify_mode = cert_reqs
-    if ca_certs:
-        context.load_verify_locations(ca_certs)
-    if certfile:
-        context.load_cert_chain(certfile, keyfile)
-    if ciphers:
-        context.set_ciphers(ciphers)
-    return context.wrap_socket(
-        sock=sock, server_side=server_side,
-        do_handshake_on_connect=do_handshake_on_connect,
-        suppress_ragged_eofs=suppress_ragged_eofs
-    )
-
 # some utility functions
 
 def cert_time_to_seconds(cert_time):
@@ -1466,11 +1503,14 @@ def PEM_cert_to_DER_cert(pem_cert_string):
     d = pem_cert_string.strip()[len(PEM_HEADER):-len(PEM_FOOTER)]
     return base64.decodebytes(d.encode('ASCII', 'strict'))
 
-def get_server_certificate(addr, ssl_version=PROTOCOL_TLS, ca_certs=None):
+def get_server_certificate(addr, ssl_version=PROTOCOL_TLS_CLIENT,
+                           ca_certs=None, timeout=_GLOBAL_DEFAULT_TIMEOUT):
     """Retrieve the certificate from the server at the specified address,
     and return it as a PEM-encoded string.
     If 'ca_certs' is specified, validate the server cert against it.
-    If 'ssl_version' is specified, use it in the connection attempt."""
+    If 'ssl_version' is specified, use it in the connection attempt.
+    If 'timeout' is specified, use it in the connection attempt.
+    """
 
     host, port = addr
     if ca_certs is not None:
@@ -1480,8 +1520,8 @@ def get_server_certificate(addr, ssl_version=PROTOCOL_TLS, ca_certs=None):
     context = _create_stdlib_context(ssl_version,
                                      cert_reqs=cert_reqs,
                                      cafile=ca_certs)
-    with  create_connection(addr) as sock:
-        with context.wrap_socket(sock) as sslsock:
+    with create_connection(addr, timeout=timeout) as sock:
+        with context.wrap_socket(sock, server_hostname=host) as sslsock:
             dercert = sslsock.getpeercert(True)
     return DER_cert_to_PEM_cert(dercert)
 

Lib/test/certdata/allsans.pem

@@ -0,0 +1,167 @@
+-----BEGIN PRIVATE KEY-----
+MIIG/QIBADANBgkqhkiG9w0BAQEFAASCBucwggbjAgEAAoIBgQCczEVv5D2UDtn6
+DMmZ/uCWCLyL+K5xTZp/5j3cyISoaTuU1Ku3kD97eLgpHj4Fgk5ZJi21zsQqepCj
+jAhBk6tj6RYUcnMbb8MuxUkQMEDW+5LfSyp+HCaetlHosWdhEDqX4kpJ5ajBwNRt
+07mxQExtC4kcno0ut9rG5XzLN29XpCpRHlFFrntOgQAEoiz9/fc8qaTgb37RgGYP
+Qsxh7PcRDRe4ZGx1l06Irr8Y+2W50zWCfkwCS3DaLDOKIjSOfPHNqmfcfsTpzrj8
+330cdPklrMIuiBv+iGklCjkPZJiEhxvY2k6ERM4HAxxuPCivrH5MCeMNYvBVUcLr
+GROm7JRXRllI/XubwwoAaAb+y+dZtCZ9AnzHIb+nyKiJxWAjzjR+QPL6jHrVWBVA
+WTc83YP5FvxUXMfY3sVv9tNSCV3cpYOW5+iXcQzLuczXnOLRYk7p9wkb0/hk9KuK
+4BMA90eBhvFMCFgHJ1/xJg2nFmBHPo/xbcwPG/ma5T/McA8mAlECAwEAAQKCAYAB
+m29nxPNjod5Wm4xydWQYbZj/J0qkcyru/i1qpqyDbGa1sRNcg5A/A/8BPuPcWxhR
+/hvwVeD5XX2/i2cnQuv6D3DQP1cSNCxQPanwzknP2k7IVqUmG0RDErPWuoDIhCnR
+ljp0NPQsnj0fLhEkcbgG0xwx7KceUDigGsiTbatIvvBHGhQzrmTpqlVVdtMWvGRt
+HQEJYuMuIw6IwALHyy3CITv5wh/Bec5OhNoFF8iUZceR4ZkGWf8bYWIa25xlzH6K
+4rhOOh1G2ObHHTjhZq4mGXTHY1MEkAxXKWlR3DJc0Lh5E1UETSI6WBHWRb08iwQ5
+AkLOPyMpt08xHFWbJqywvlxenpri+gjY3xbXqGNhyDYWHZqlQmJVnzxoUOuuHi2R
+dO86IckUc4Thjbm7a6AilL9t8juNZvyeQUVgtVi25uPkm/cK6r5vo8y4UOUU41EN
+NOathlF69gh93il4t6zJW9jPV2WENv1H/vhKUWKW6cabX3vy4rANwy3q4V//GDEC
+gcEAuniGCHaEdSjV2sUHyt/yrCLbU6+eLTfNk6AQyXJk6Wrvj6g3gx90ewEq5i/C
+ukmSKDslr9pupq8Z/UNfYHZfJfpwEsYvIZ8DdFSd62/h66DhIoEn1v3Lwt+aexgX
+yGJHF0BG9JA2CU5Z5NGjlnQYqQBobO9uZMq62l15Ig1MAMHGL0ZYVvOqGZD7XvtC
+4UnclK5kjp51Vd5rydEQxyi5qkyLl9Q6T0FQXOphGIOd8ifYeUGe7YC72cFPevdx
+wDXZAoHBANdDVvCMrjmzdrS6td39/2nHTeerFPbsOe2LIQYzqjeEe6GWqd2NL9NZ
+bk3/cAuVgbWtdvSQQhhmSqOC7JZic4hbZb3lK6v/sr4F/Zu0CfAu80swWFMeS7vq
+eQeYzN4w4dKpJArvU3ll7N9AlZhdlYkbPf0WdeOIjZawdAOxNtNe0O+j+5MsXR59
+qkULatumhcKUnqxFCiVHzy21CVJtRzrtu6oGoSdFbmG82eSJ1rPXiuuDnCyzjyMW
+iClYRM4NOQKBwERnO/vUxihYT4LOLlqcpl/A9aYQUT0TMGWMHTxYq2343WJceeiu
+3ELXHc6NDKjbnjMF54BH57lbmHQQh+dR5PuAkCZC7z0tIM5G0Bty0nRmcs/+gwfZ
+2Cpnbjrjjq3iZ2O/H4hNcpUdWdqXkKP7eKReUvBLMLrmp369NVdpe0z3yGTFMFjN
+T8PLLHsePt14A+PCyX6L4E0cp3vEJpx4cwtmwvpyTuWN9xXuoKmmdoVDWqS4jr1f
+MQnjYO2h4ed5mQKBwGVttWli4DUP+r7tuwP+ynptDqg6VIaEiEcFZ2okre+63QYm
+l6NtAzvyx6a41XKf355bPdG+p2YXzNN+vTue6BE3/5iagxloQjCHYhgbnRMvDDRB
+c1y2ybihoqWRufZ30fARAoqkehCZliMbq2E/t1YDIBJAowuzLAP04LVcqxitdIV2
+HvQZ00aqr7AY0SDuNdiZbqp9XWpzi4td4iaUlxuNKP/UX9rBPGGROpoU2LWkujB+
+svfdI3TFCSNyE/mDAQKBwQCP++WZKxExrSFRk3W+TcHKHZb2pusfoPWE7WH6EnDW
+dkTZpa3PZaf0xgeglmNBv4Paxw2eMPsIhyNv62XY/6GbY6VJWRyx/s+NsazeP4ji
+xUOufnwTePjYw6x0pcl6BknZrHn8LCJU741h0yTum8cDdNfRKdc0AMy0gVXk4ZTG
+2cAtbEcWb3J+a5kYf6mp5yx3BNwtewkGZhc2VuQ9mQNbMmOOS/pHQQTRWcxsQwyt
+GPAhMKawjrL1KFmu7vIqDSw=
+-----END PRIVATE KEY-----
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            cb:2d:80:99:5a:69:52:5f
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=XY, O=Python Software Foundation CA, CN=our-ca-server
+        Validity
+            Not Before: Aug 29 14:23:16 2018 GMT
+            Not After : Oct 28 14:23:16 2037 GMT
+        Subject: C=XY, L=Castle Anthrax, O=Python Software Foundation, CN=allsans
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (3072 bit)
+                Modulus:
+                    00:9c:cc:45:6f:e4:3d:94:0e:d9:fa:0c:c9:99:fe:
+                    e0:96:08:bc:8b:f8:ae:71:4d:9a:7f:e6:3d:dc:c8:
+                    84:a8:69:3b:94:d4:ab:b7:90:3f:7b:78:b8:29:1e:
+                    3e:05:82:4e:59:26:2d:b5:ce:c4:2a:7a:90:a3:8c:
+                    08:41:93:ab:63:e9:16:14:72:73:1b:6f:c3:2e:c5:
+                    49:10:30:40:d6:fb:92:df:4b:2a:7e:1c:26:9e:b6:
+                    51:e8:b1:67:61:10:3a:97:e2:4a:49:e5:a8:c1:c0:
+                    d4:6d:d3:b9:b1:40:4c:6d:0b:89:1c:9e:8d:2e:b7:
+                    da:c6:e5:7c:cb:37:6f:57:a4:2a:51:1e:51:45:ae:
+                    7b:4e:81:00:04:a2:2c:fd:fd:f7:3c:a9:a4:e0:6f:
+                    7e:d1:80:66:0f:42:cc:61:ec:f7:11:0d:17:b8:64:
+                    6c:75:97:4e:88:ae:bf:18:fb:65:b9:d3:35:82:7e:
+                    4c:02:4b:70:da:2c:33:8a:22:34:8e:7c:f1:cd:aa:
+                    67:dc:7e:c4:e9:ce:b8:fc:df:7d:1c:74:f9:25:ac:
+                    c2:2e:88:1b:fe:88:69:25:0a:39:0f:64:98:84:87:
+                    1b:d8:da:4e:84:44:ce:07:03:1c:6e:3c:28:af:ac:
+                    7e:4c:09:e3:0d:62:f0:55:51:c2:eb:19:13:a6:ec:
+                    94:57:46:59:48:fd:7b:9b:c3:0a:00:68:06:fe:cb:
+                    e7:59:b4:26:7d:02:7c:c7:21:bf:a7:c8:a8:89:c5:
+                    60:23:ce:34:7e:40:f2:fa:8c:7a:d5:58:15:40:59:
+                    37:3c:dd:83:f9:16:fc:54:5c:c7:d8:de:c5:6f:f6:
+                    d3:52:09:5d:dc:a5:83:96:e7:e8:97:71:0c:cb:b9:
+                    cc:d7:9c:e2:d1:62:4e:e9:f7:09:1b:d3:f8:64:f4:
+                    ab:8a:e0:13:00:f7:47:81:86:f1:4c:08:58:07:27:
+                    5f:f1:26:0d:a7:16:60:47:3e:8f:f1:6d:cc:0f:1b:
+                    f9:9a:e5:3f:cc:70:0f:26:02:51
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Alternative Name: 
+                DNS:allsans, othername: 1.2.3.4::some other identifier, othername: 1.3.6.1.5.2.2::<unsupported>, email:user@example.org, DNS:www.example.org, DirName:/C=XY/L=Castle Anthrax/O=Python Software Foundation/CN=dirname example, URI:https://www.python.org/, IP Address:127.0.0.1, IP Address:0:0:0:0:0:0:0:1, Registered ID:1.2.3.4.5
+            X509v3 Key Usage: critical
+                Digital Signature, Key Encipherment
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, TLS Web Client Authentication
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            X509v3 Subject Key Identifier: 
+                31:5E:C0:5E:2F:47:FF:8B:92:F9:EE:3D:B1:87:D0:53:75:3B:B1:48
+            X509v3 Authority Key Identifier: 
+                keyid:F3:EC:94:8E:F2:8E:30:C4:8E:68:C2:BF:8E:6A:19:C0:C1:9F:76:65
+                DirName:/C=XY/O=Python Software Foundation CA/CN=our-ca-server
+                serial:CB:2D:80:99:5A:69:52:5B
+            Authority Information Access: 
+                CA Issuers - URI:http://testca.pythontest.net/testca/pycacert.cer
+                OCSP - URI:http://testca.pythontest.net/testca/ocsp/
+            X509v3 CRL Distribution Points: 
+                Full Name:
+                  URI:http://testca.pythontest.net/testca/revocation.crl
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        72:42:a6:fc:ee:3c:21:47:05:33:e8:8c:6b:27:07:4a:ed:e2:
+        81:47:96:79:43:ff:0f:ef:5a:06:aa:4c:01:70:5b:21:c4:b7:
+        5d:17:29:c8:10:02:c3:08:7b:8c:86:56:9e:e9:7c:6e:a8:b6:
+        26:13:9e:1e:1f:93:66:85:67:63:9e:08:fb:55:39:56:82:f5:
+        be:0c:38:1e:eb:c4:54:b2:a7:7b:18:55:bb:00:87:43:50:50:
+        bb:e1:29:10:cf:3d:c9:07:c7:d2:5d:b6:45:68:1f:d6:de:00:
+        96:3e:29:73:f6:22:70:21:a2:ba:68:28:94:ec:37:bc:a7:00:
+        70:58:4e:d1:48:ae:ef:8d:11:a4:6e:10:2f:92:83:07:e2:76:
+        ac:bf:4f:bb:d6:9f:47:9e:a4:02:03:16:f8:a8:0a:3d:67:17:
+        31:44:0e:68:d0:d3:24:d5:e7:bf:67:30:8f:88:97:92:0a:1e:
+        d7:74:df:7e:7b:4c:c6:d9:c3:84:92:2b:a0:89:11:08:4c:dd:
+        32:49:df:36:23:d4:63:56:e4:f1:68:5a:6f:a0:c3:3c:e2:36:
+        ee:f3:46:60:78:4d:76:a5:5a:4a:61:c6:f8:ae:18:68:c2:8d:
+        0e:2f:76:50:bb:be:b9:56:f1:04:5c:ac:ad:d7:d6:a4:1e:45:
+        45:52:f4:10:a2:0f:9b:e3:d9:73:17:b6:52:42:a6:5b:c9:e9:
+        8d:60:74:68:d0:1f:7a:ce:01:8e:9e:55:cb:cf:64:c1:cc:9a:
+        72:aa:b4:5f:b5:55:13:41:10:51:a0:2c:a5:5b:43:12:ca:cc:
+        b7:c4:ac:f2:6f:72:fd:0d:50:6a:d6:81:c1:91:93:21:fe:de:
+        9a:be:e5:3c:2a:98:95:a1:42:f8:f2:5c:75:c6:f1:fd:11:b1:
+        22:26:33:5b:43:63:21:06:61:d2:cd:04:f3:30:c6:a8:3f:17:
+        d3:05:a3:87:45:2e:52:1e:51:88:e3:59:4c:78:51:b0:7b:b4:
+        58:d9:27:22:6e:8c
+-----BEGIN CERTIFICATE-----
+MIIHDTCCBXWgAwIBAgIJAMstgJlaaVJfMA0GCSqGSIb3DQEBCwUAME0xCzAJBgNV
+BAYTAlhZMSYwJAYDVQQKDB1QeXRob24gU29mdHdhcmUgRm91bmRhdGlvbiBDQTEW
+MBQGA1UEAwwNb3VyLWNhLXNlcnZlcjAeFw0xODA4MjkxNDIzMTZaFw0zNzEwMjgx
+NDIzMTZaMF0xCzAJBgNVBAYTAlhZMRcwFQYDVQQHDA5DYXN0bGUgQW50aHJheDEj
+MCEGA1UECgwaUHl0aG9uIFNvZnR3YXJlIEZvdW5kYXRpb24xEDAOBgNVBAMMB2Fs
+bHNhbnMwggGiMA0GCSqGSIb3DQEBAQUAA4IBjwAwggGKAoIBgQCczEVv5D2UDtn6
+DMmZ/uCWCLyL+K5xTZp/5j3cyISoaTuU1Ku3kD97eLgpHj4Fgk5ZJi21zsQqepCj
+jAhBk6tj6RYUcnMbb8MuxUkQMEDW+5LfSyp+HCaetlHosWdhEDqX4kpJ5ajBwNRt
+07mxQExtC4kcno0ut9rG5XzLN29XpCpRHlFFrntOgQAEoiz9/fc8qaTgb37RgGYP
+Qsxh7PcRDRe4ZGx1l06Irr8Y+2W50zWCfkwCS3DaLDOKIjSOfPHNqmfcfsTpzrj8
+330cdPklrMIuiBv+iGklCjkPZJiEhxvY2k6ERM4HAxxuPCivrH5MCeMNYvBVUcLr
+GROm7JRXRllI/XubwwoAaAb+y+dZtCZ9AnzHIb+nyKiJxWAjzjR+QPL6jHrVWBVA
+WTc83YP5FvxUXMfY3sVv9tNSCV3cpYOW5+iXcQzLuczXnOLRYk7p9wkb0/hk9KuK
+4BMA90eBhvFMCFgHJ1/xJg2nFmBHPo/xbcwPG/ma5T/McA8mAlECAwEAAaOCAt4w
+ggLaMIIBMAYDVR0RBIIBJzCCASOCB2FsbHNhbnOgHgYDKgMEoBcMFXNvbWUgb3Ro
+ZXIgaWRlbnRpZmllcqA1BgYrBgEFAgKgKzApoBAbDktFUkJFUk9TLlJFQUxNoRUw
+E6ADAgEBoQwwChsIdXNlcm5hbWWBEHVzZXJAZXhhbXBsZS5vcmeCD3d3dy5leGFt
+cGxlLm9yZ6RnMGUxCzAJBgNVBAYTAlhZMRcwFQYDVQQHDA5DYXN0bGUgQW50aHJh
+eDEjMCEGA1UECgwaUHl0aG9uIFNvZnR3YXJlIEZvdW5kYXRpb24xGDAWBgNVBAMM
+D2Rpcm5hbWUgZXhhbXBsZYYXaHR0cHM6Ly93d3cucHl0aG9uLm9yZy+HBH8AAAGH
+EAAAAAAAAAAAAAAAAAAAAAGIBCoDBAUwDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQW
+MBQGCCsGAQUFBwMBBggrBgEFBQcDAjAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBQx
+XsBeL0f/i5L57j2xh9BTdTuxSDB9BgNVHSMEdjB0gBTz7JSO8o4wxI5owr+OahnA
+wZ92ZaFRpE8wTTELMAkGA1UEBhMCWFkxJjAkBgNVBAoMHVB5dGhvbiBTb2Z0d2Fy
+ZSBGb3VuZGF0aW9uIENBMRYwFAYDVQQDDA1vdXItY2Etc2VydmVyggkAyy2AmVpp
+UlswgYMGCCsGAQUFBwEBBHcwdTA8BggrBgEFBQcwAoYwaHR0cDovL3Rlc3RjYS5w
+eXRob250ZXN0Lm5ldC90ZXN0Y2EvcHljYWNlcnQuY2VyMDUGCCsGAQUFBzABhilo
+dHRwOi8vdGVzdGNhLnB5dGhvbnRlc3QubmV0L3Rlc3RjYS9vY3NwLzBDBgNVHR8E
+PDA6MDigNqA0hjJodHRwOi8vdGVzdGNhLnB5dGhvbnRlc3QubmV0L3Rlc3RjYS9y
+ZXZvY2F0aW9uLmNybDANBgkqhkiG9w0BAQsFAAOCAYEAckKm/O48IUcFM+iMaycH
+Su3igUeWeUP/D+9aBqpMAXBbIcS3XRcpyBACwwh7jIZWnul8bqi2JhOeHh+TZoVn
+Y54I+1U5VoL1vgw4HuvEVLKnexhVuwCHQ1BQu+EpEM89yQfH0l22RWgf1t4Alj4p
+c/YicCGiumgolOw3vKcAcFhO0Uiu740RpG4QL5KDB+J2rL9Pu9afR56kAgMW+KgK
+PWcXMUQOaNDTJNXnv2cwj4iXkgoe13TffntMxtnDhJIroIkRCEzdMknfNiPUY1bk
+8Whab6DDPOI27vNGYHhNdqVaSmHG+K4YaMKNDi92ULu+uVbxBFysrdfWpB5FRVL0
+EKIPm+PZcxe2UkKmW8npjWB0aNAfes4Bjp5Vy89kwcyacqq0X7VVE0EQUaAspVtD
+EsrMt8Ss8m9y/Q1QataBwZGTIf7emr7lPCqYlaFC+PJcdcbx/RGxIiYzW0NjIQZh
+0s0E8zDGqD8X0wWjh0UuUh5RiONZTHhRsHu0WNknIm6M
+-----END CERTIFICATE-----

Lib/test/certdata/badcert.pem

@@ -0,0 +1,36 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIICXwIBAAKBgQC8ddrhm+LutBvjYcQlnH21PPIseJ1JVG2HMmN2CmZk2YukO+9L
+opdJhTvbGfEj0DQs1IE8M+kTUyOmuKfVrFMKwtVeCJphrAnhoz7TYOuLBSqt7lVH
+fhi/VwovESJlaBOp+WMnfhcduPEYHYx/6cnVapIkZnLt30zu2um+DzA9jQIDAQAB
+AoGBAK0FZpaKj6WnJZN0RqhhK+ggtBWwBnc0U/ozgKz2j1s3fsShYeiGtW6CK5nU
+D1dZ5wzhbGThI7LiOXDvRucc9n7vUgi0alqPQ/PFodPxAN/eEYkmXQ7W2k7zwsDA
+IUK0KUhktQbLu8qF/m8qM86ba9y9/9YkXuQbZ3COl5ahTZrhAkEA301P08RKv3KM
+oXnGU2UHTuJ1MAD2hOrPxjD4/wxA/39EWG9bZczbJyggB4RHu0I3NOSFjAm3HQm0
+ANOu5QK9owJBANgOeLfNNcF4pp+UikRFqxk5hULqRAWzVxVrWe85FlPm0VVmHbb/
+loif7mqjU8o1jTd/LM7RD9f2usZyE2psaw8CQQCNLhkpX3KO5kKJmS9N7JMZSc4j
+oog58yeYO8BBqKKzpug0LXuQultYv2K4veaIO04iL9VLe5z9S/Q1jaCHBBuXAkEA
+z8gjGoi1AOp6PBBLZNsncCvcV/0aC+1se4HxTNo2+duKSDnbq+ljqOM+E7odU+Nq
+ewvIWOG//e8fssd0mq3HywJBAJ8l/c8GVmrpFTx8r/nZ2Pyyjt3dH1widooDXYSV
+q6Gbf41Llo5sYAtmxdndTLASuHKecacTgZVhy0FryZpLKrU=
+-----END RSA PRIVATE KEY-----
+-----BEGIN CERTIFICATE-----
+Just bad cert data
+-----END CERTIFICATE-----
+-----BEGIN RSA PRIVATE KEY-----
+MIICXwIBAAKBgQC8ddrhm+LutBvjYcQlnH21PPIseJ1JVG2HMmN2CmZk2YukO+9L
+opdJhTvbGfEj0DQs1IE8M+kTUyOmuKfVrFMKwtVeCJphrAnhoz7TYOuLBSqt7lVH
+fhi/VwovESJlaBOp+WMnfhcduPEYHYx/6cnVapIkZnLt30zu2um+DzA9jQIDAQAB
+AoGBAK0FZpaKj6WnJZN0RqhhK+ggtBWwBnc0U/ozgKz2j1s3fsShYeiGtW6CK5nU
+D1dZ5wzhbGThI7LiOXDvRucc9n7vUgi0alqPQ/PFodPxAN/eEYkmXQ7W2k7zwsDA
+IUK0KUhktQbLu8qF/m8qM86ba9y9/9YkXuQbZ3COl5ahTZrhAkEA301P08RKv3KM
+oXnGU2UHTuJ1MAD2hOrPxjD4/wxA/39EWG9bZczbJyggB4RHu0I3NOSFjAm3HQm0
+ANOu5QK9owJBANgOeLfNNcF4pp+UikRFqxk5hULqRAWzVxVrWe85FlPm0VVmHbb/
+loif7mqjU8o1jTd/LM7RD9f2usZyE2psaw8CQQCNLhkpX3KO5kKJmS9N7JMZSc4j
+oog58yeYO8BBqKKzpug0LXuQultYv2K4veaIO04iL9VLe5z9S/Q1jaCHBBuXAkEA
+z8gjGoi1AOp6PBBLZNsncCvcV/0aC+1se4HxTNo2+duKSDnbq+ljqOM+E7odU+Nq
+ewvIWOG//e8fssd0mq3HywJBAJ8l/c8GVmrpFTx8r/nZ2Pyyjt3dH1widooDXYSV
+q6Gbf41Llo5sYAtmxdndTLASuHKecacTgZVhy0FryZpLKrU=
+-----END RSA PRIVATE KEY-----
+-----BEGIN CERTIFICATE-----
+Just bad cert data
+-----END CERTIFICATE-----

Lib/test/certdata/badkey.pem

@@ -0,0 +1,40 @@
+-----BEGIN RSA PRIVATE KEY-----
+Bad Key, though the cert should be OK
+-----END RSA PRIVATE KEY-----
+-----BEGIN CERTIFICATE-----
+MIICpzCCAhCgAwIBAgIJAP+qStv1cIGNMA0GCSqGSIb3DQEBBQUAMIGJMQswCQYD
+VQQGEwJVUzERMA8GA1UECBMIRGVsYXdhcmUxEzARBgNVBAcTCldpbG1pbmd0b24x
+IzAhBgNVBAoTGlB5dGhvbiBTb2Z0d2FyZSBGb3VuZGF0aW9uMQwwCgYDVQQLEwNT
+U0wxHzAdBgNVBAMTFnNvbWVtYWNoaW5lLnB5dGhvbi5vcmcwHhcNMDcwODI3MTY1
+NDUwWhcNMTMwMjE2MTY1NDUwWjCBiTELMAkGA1UEBhMCVVMxETAPBgNVBAgTCERl
+bGF3YXJlMRMwEQYDVQQHEwpXaWxtaW5ndG9uMSMwIQYDVQQKExpQeXRob24gU29m
+dHdhcmUgRm91bmRhdGlvbjEMMAoGA1UECxMDU1NMMR8wHQYDVQQDExZzb21lbWFj
+aGluZS5weXRob24ub3JnMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC8ddrh
+m+LutBvjYcQlnH21PPIseJ1JVG2HMmN2CmZk2YukO+9LopdJhTvbGfEj0DQs1IE8
+M+kTUyOmuKfVrFMKwtVeCJphrAnhoz7TYOuLBSqt7lVHfhi/VwovESJlaBOp+WMn
+fhcduPEYHYx/6cnVapIkZnLt30zu2um+DzA9jQIDAQABoxUwEzARBglghkgBhvhC
+AQEEBAMCBkAwDQYJKoZIhvcNAQEFBQADgYEAF4Q5BVqmCOLv1n8je/Jw9K669VXb
+08hyGzQhkemEBYQd6fzQ9A/1ZzHkJKb1P6yreOLSEh4KcxYPyrLRC1ll8nr5OlCx
+CMhKkTnR6qBsdNV0XtdU2+N25hqW+Ma4ZeqsN/iiJVCGNOZGnvQuvCAGWF8+J/f/
+iHkC6gGdBJhogs4=
+-----END CERTIFICATE-----
+-----BEGIN RSA PRIVATE KEY-----
+Bad Key, though the cert should be OK
+-----END RSA PRIVATE KEY-----
+-----BEGIN CERTIFICATE-----
+MIICpzCCAhCgAwIBAgIJAP+qStv1cIGNMA0GCSqGSIb3DQEBBQUAMIGJMQswCQYD
+VQQGEwJVUzERMA8GA1UECBMIRGVsYXdhcmUxEzARBgNVBAcTCldpbG1pbmd0b24x
+IzAhBgNVBAoTGlB5dGhvbiBTb2Z0d2FyZSBGb3VuZGF0aW9uMQwwCgYDVQQLEwNT
+U0wxHzAdBgNVBAMTFnNvbWVtYWNoaW5lLnB5dGhvbi5vcmcwHhcNMDcwODI3MTY1
+NDUwWhcNMTMwMjE2MTY1NDUwWjCBiTELMAkGA1UEBhMCVVMxETAPBgNVBAgTCERl
+bGF3YXJlMRMwEQYDVQQHEwpXaWxtaW5ndG9uMSMwIQYDVQQKExpQeXRob24gU29m
+dHdhcmUgRm91bmRhdGlvbjEMMAoGA1UECxMDU1NMMR8wHQYDVQQDExZzb21lbWFj
+aGluZS5weXRob24ub3JnMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC8ddrh
+m+LutBvjYcQlnH21PPIseJ1JVG2HMmN2CmZk2YukO+9LopdJhTvbGfEj0DQs1IE8
+M+kTUyOmuKfVrFMKwtVeCJphrAnhoz7TYOuLBSqt7lVHfhi/VwovESJlaBOp+WMn
+fhcduPEYHYx/6cnVapIkZnLt30zu2um+DzA9jQIDAQABoxUwEzARBglghkgBhvhC
+AQEEBAMCBkAwDQYJKoZIhvcNAQEFBQADgYEAF4Q5BVqmCOLv1n8je/Jw9K669VXb
+08hyGzQhkemEBYQd6fzQ9A/1ZzHkJKb1P6yreOLSEh4KcxYPyrLRC1ll8nr5OlCx
+CMhKkTnR6qBsdNV0XtdU2+N25hqW+Ma4ZeqsN/iiJVCGNOZGnvQuvCAGWF8+J/f/
+iHkC6gGdBJhogs4=
+-----END CERTIFICATE-----

Lib/test/certdata/capath/4e1295a3.0

@@ -0,0 +1,14 @@
+-----BEGIN CERTIFICATE-----
+MIICLDCCAdYCAQAwDQYJKoZIhvcNAQEEBQAwgaAxCzAJBgNVBAYTAlBUMRMwEQYD
+VQQIEwpRdWVlbnNsYW5kMQ8wDQYDVQQHEwZMaXNib2ExFzAVBgNVBAoTDk5ldXJv
+bmlvLCBMZGEuMRgwFgYDVQQLEw9EZXNlbnZvbHZpbWVudG8xGzAZBgNVBAMTEmJy
+dXR1cy5uZXVyb25pby5wdDEbMBkGCSqGSIb3DQEJARYMc2FtcG9AaWtpLmZpMB4X
+DTk2MDkwNTAzNDI0M1oXDTk2MTAwNTAzNDI0M1owgaAxCzAJBgNVBAYTAlBUMRMw
+EQYDVQQIEwpRdWVlbnNsYW5kMQ8wDQYDVQQHEwZMaXNib2ExFzAVBgNVBAoTDk5l
+dXJvbmlvLCBMZGEuMRgwFgYDVQQLEw9EZXNlbnZvbHZpbWVudG8xGzAZBgNVBAMT
+EmJydXR1cy5uZXVyb25pby5wdDEbMBkGCSqGSIb3DQEJARYMc2FtcG9AaWtpLmZp
+MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAL7+aty3S1iBA/+yxjxv4q1MUTd1kjNw
+L4lYKbpzzlmC5beaQXeQ2RmGMTXU+mDvuqItjVHOK3DvPK7lTcSGftUCAwEAATAN
+BgkqhkiG9w0BAQQFAANBAFqPEKFjk6T6CKTHvaQeEAsX0/8YHPHqH/9AnhSjrwuX
+9EBc0n6bVGhN7XaXd6sJ7dym9sbsWxb+pJdurnkxjx4=
+-----END CERTIFICATE-----

Lib/test/certdata/capath/5ed36f99.0

@@ -0,0 +1,41 @@
+-----BEGIN CERTIFICATE-----
+MIIHPTCCBSWgAwIBAgIBADANBgkqhkiG9w0BAQQFADB5MRAwDgYDVQQKEwdSb290
+IENBMR4wHAYDVQQLExVodHRwOi8vd3d3LmNhY2VydC5vcmcxIjAgBgNVBAMTGUNB
+IENlcnQgU2lnbmluZyBBdXRob3JpdHkxITAfBgkqhkiG9w0BCQEWEnN1cHBvcnRA
+Y2FjZXJ0Lm9yZzAeFw0wMzAzMzAxMjI5NDlaFw0zMzAzMjkxMjI5NDlaMHkxEDAO
+BgNVBAoTB1Jvb3QgQ0ExHjAcBgNVBAsTFWh0dHA6Ly93d3cuY2FjZXJ0Lm9yZzEi
+MCAGA1UEAxMZQ0EgQ2VydCBTaWduaW5nIEF1dGhvcml0eTEhMB8GCSqGSIb3DQEJ
+ARYSc3VwcG9ydEBjYWNlcnQub3JnMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIIC
+CgKCAgEAziLA4kZ97DYoB1CW8qAzQIxL8TtmPzHlawI229Z89vGIj053NgVBlfkJ
+8BLPRoZzYLdufujAWGSuzbCtRRcMY/pnCujW0r8+55jE8Ez64AO7NV1sId6eINm6
+zWYyN3L69wj1x81YyY7nDl7qPv4coRQKFWyGhFtkZip6qUtTefWIonvuLwphK42y
+fk1WpRPs6tqSnqxEQR5YYGUFZvjARL3LlPdCfgv3ZWiYUQXw8wWRBB0bF4LsyFe7
+w2t6iPGwcswlWyCR7BYCEo8y6RcYSNDHBS4CMEK4JZwFaz+qOqfrU0j36NK2B5jc
+G8Y0f3/JHIJ6BVgrCFvzOKKrF11myZjXnhCLotLddJr3cQxyYN/Nb5gznZY0dj4k
+epKwDpUeb+agRThHqtdB7Uq3EvbXG4OKDy7YCbZZ16oE/9KTfWgu3YtLq1i6L43q
+laegw1SJpfvbi1EinbLDvhG+LJGGi5Z4rSDTii8aP8bQUWWHIbEZAWV/RRyH9XzQ
+QUxPKZgh/TMfdQwEUfoZd9vUFBzugcMd9Zi3aQaRIt0AUMyBMawSB3s42mhb5ivU
+fslfrejrckzzAeVLIL+aplfKkQABi6F1ITe1Yw1nPkZPcCBnzsXWWdsC4PDSy826
+YreQQejdIOQpvGQpQsgi3Hia/0PsmBsJUUtaWsJx8cTLc6nloQsCAwEAAaOCAc4w
+ggHKMB0GA1UdDgQWBBQWtTIb1Mfz4OaO873SsDrusjkY0TCBowYDVR0jBIGbMIGY
+gBQWtTIb1Mfz4OaO873SsDrusjkY0aF9pHsweTEQMA4GA1UEChMHUm9vdCBDQTEe
+MBwGA1UECxMVaHR0cDovL3d3dy5jYWNlcnQub3JnMSIwIAYDVQQDExlDQSBDZXJ0
+IFNpZ25pbmcgQXV0aG9yaXR5MSEwHwYJKoZIhvcNAQkBFhJzdXBwb3J0QGNhY2Vy
+dC5vcmeCAQAwDwYDVR0TAQH/BAUwAwEB/zAyBgNVHR8EKzApMCegJaAjhiFodHRw
+czovL3d3dy5jYWNlcnQub3JnL3Jldm9rZS5jcmwwMAYJYIZIAYb4QgEEBCMWIWh0
+dHBzOi8vd3d3LmNhY2VydC5vcmcvcmV2b2tlLmNybDA0BglghkgBhvhCAQgEJxYl
+aHR0cDovL3d3dy5jYWNlcnQub3JnL2luZGV4LnBocD9pZD0xMDBWBglghkgBhvhC
+AQ0ESRZHVG8gZ2V0IHlvdXIgb3duIGNlcnRpZmljYXRlIGZvciBGUkVFIGhlYWQg
+b3ZlciB0byBodHRwOi8vd3d3LmNhY2VydC5vcmcwDQYJKoZIhvcNAQEEBQADggIB
+ACjH7pyCArpcgBLKNQodgW+JapnM8mgPf6fhjViVPr3yBsOQWqy1YPaZQwGjiHCc
+nWKdpIevZ1gNMDY75q1I08t0AoZxPuIrA2jxNGJARjtT6ij0rPtmlVOKTV39O9lg
+18p5aTuxZZKmxoGCXJzN600BiqXfEVWqFcofN8CCmHBh22p8lqOOLlQ+TyGpkO/c
+gr/c6EWtTZBzCDyUZbAEmXZ/4rzCahWqlwQ3JNgelE5tDlG+1sSPypZt90Pf6DBl
+Jzt7u0NDY8RD97LsaMzhGY4i+5jhe1o+ATc7iwiwovOVThrLm82asduycPAtStvY
+sONvRUgzEv/+PDIqVPfE94rwiCPCR/5kenHA0R6mY7AHfqQv0wGP3J8rtsYIqQ+T
+SCX8Ev2fQtzzxD72V7DX3WnRBnc0CkvSyqD/HMaMyRa+xMwyN2hzXwj7UfdJUzYF
+CpUCTPJ5GhD22Dp1nPMd8aINcGeGG7MW9S/lpOt5hvk9C8JzC6WZrG/8Z7jlLwum
+GCSNe9FINSkYQKyTYOGWhlC0elnYjyELn8+CkcY7v2vcB5G5l1YjqrZslMZIBjzk
+zk6q5PYvCdxTby78dOs6Y5nCpqyJvKeyRKANihDjbPIky/qbn3BHLt4Ui9SyIAmW
+omTxJBzcoTWcFbLUvFUufQb1nA5V9FrWk9p2rSVzTMVD
+-----END CERTIFICATE-----

Lib/test/certdata/capath/6e88d7b8.0

@@ -0,0 +1,14 @@
+-----BEGIN CERTIFICATE-----
+MIICLDCCAdYCAQAwDQYJKoZIhvcNAQEEBQAwgaAxCzAJBgNVBAYTAlBUMRMwEQYD
+VQQIEwpRdWVlbnNsYW5kMQ8wDQYDVQQHEwZMaXNib2ExFzAVBgNVBAoTDk5ldXJv
+bmlvLCBMZGEuMRgwFgYDVQQLEw9EZXNlbnZvbHZpbWVudG8xGzAZBgNVBAMTEmJy
+dXR1cy5uZXVyb25pby5wdDEbMBkGCSqGSIb3DQEJARYMc2FtcG9AaWtpLmZpMB4X
+DTk2MDkwNTAzNDI0M1oXDTk2MTAwNTAzNDI0M1owgaAxCzAJBgNVBAYTAlBUMRMw
+EQYDVQQIEwpRdWVlbnNsYW5kMQ8wDQYDVQQHEwZMaXNib2ExFzAVBgNVBAoTDk5l
+dXJvbmlvLCBMZGEuMRgwFgYDVQQLEw9EZXNlbnZvbHZpbWVudG8xGzAZBgNVBAMT
+EmJydXR1cy5uZXVyb25pby5wdDEbMBkGCSqGSIb3DQEJARYMc2FtcG9AaWtpLmZp
+MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAL7+aty3S1iBA/+yxjxv4q1MUTd1kjNw
+L4lYKbpzzlmC5beaQXeQ2RmGMTXU+mDvuqItjVHOK3DvPK7lTcSGftUCAwEAATAN
+BgkqhkiG9w0BAQQFAANBAFqPEKFjk6T6CKTHvaQeEAsX0/8YHPHqH/9AnhSjrwuX
+9EBc0n6bVGhN7XaXd6sJ7dym9sbsWxb+pJdurnkxjx4=
+-----END CERTIFICATE-----

Lib/test/certdata/capath/99d0fa06.0

@@ -0,0 +1,41 @@
+-----BEGIN CERTIFICATE-----
+MIIHPTCCBSWgAwIBAgIBADANBgkqhkiG9w0BAQQFADB5MRAwDgYDVQQKEwdSb290
+IENBMR4wHAYDVQQLExVodHRwOi8vd3d3LmNhY2VydC5vcmcxIjAgBgNVBAMTGUNB
+IENlcnQgU2lnbmluZyBBdXRob3JpdHkxITAfBgkqhkiG9w0BCQEWEnN1cHBvcnRA
+Y2FjZXJ0Lm9yZzAeFw0wMzAzMzAxMjI5NDlaFw0zMzAzMjkxMjI5NDlaMHkxEDAO
+BgNVBAoTB1Jvb3QgQ0ExHjAcBgNVBAsTFWh0dHA6Ly93d3cuY2FjZXJ0Lm9yZzEi
+MCAGA1UEAxMZQ0EgQ2VydCBTaWduaW5nIEF1dGhvcml0eTEhMB8GCSqGSIb3DQEJ
+ARYSc3VwcG9ydEBjYWNlcnQub3JnMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIIC
+CgKCAgEAziLA4kZ97DYoB1CW8qAzQIxL8TtmPzHlawI229Z89vGIj053NgVBlfkJ
+8BLPRoZzYLdufujAWGSuzbCtRRcMY/pnCujW0r8+55jE8Ez64AO7NV1sId6eINm6
+zWYyN3L69wj1x81YyY7nDl7qPv4coRQKFWyGhFtkZip6qUtTefWIonvuLwphK42y
+fk1WpRPs6tqSnqxEQR5YYGUFZvjARL3LlPdCfgv3ZWiYUQXw8wWRBB0bF4LsyFe7
+w2t6iPGwcswlWyCR7BYCEo8y6RcYSNDHBS4CMEK4JZwFaz+qOqfrU0j36NK2B5jc
+G8Y0f3/JHIJ6BVgrCFvzOKKrF11myZjXnhCLotLddJr3cQxyYN/Nb5gznZY0dj4k
+epKwDpUeb+agRThHqtdB7Uq3EvbXG4OKDy7YCbZZ16oE/9KTfWgu3YtLq1i6L43q
+laegw1SJpfvbi1EinbLDvhG+LJGGi5Z4rSDTii8aP8bQUWWHIbEZAWV/RRyH9XzQ
+QUxPKZgh/TMfdQwEUfoZd9vUFBzugcMd9Zi3aQaRIt0AUMyBMawSB3s42mhb5ivU
+fslfrejrckzzAeVLIL+aplfKkQABi6F1ITe1Yw1nPkZPcCBnzsXWWdsC4PDSy826
+YreQQejdIOQpvGQpQsgi3Hia/0PsmBsJUUtaWsJx8cTLc6nloQsCAwEAAaOCAc4w
+ggHKMB0GA1UdDgQWBBQWtTIb1Mfz4OaO873SsDrusjkY0TCBowYDVR0jBIGbMIGY
+gBQWtTIb1Mfz4OaO873SsDrusjkY0aF9pHsweTEQMA4GA1UEChMHUm9vdCBDQTEe
+MBwGA1UECxMVaHR0cDovL3d3dy5jYWNlcnQub3JnMSIwIAYDVQQDExlDQSBDZXJ0
+IFNpZ25pbmcgQXV0aG9yaXR5MSEwHwYJKoZIhvcNAQkBFhJzdXBwb3J0QGNhY2Vy
+dC5vcmeCAQAwDwYDVR0TAQH/BAUwAwEB/zAyBgNVHR8EKzApMCegJaAjhiFodHRw
+czovL3d3dy5jYWNlcnQub3JnL3Jldm9rZS5jcmwwMAYJYIZIAYb4QgEEBCMWIWh0
+dHBzOi8vd3d3LmNhY2VydC5vcmcvcmV2b2tlLmNybDA0BglghkgBhvhCAQgEJxYl
+aHR0cDovL3d3dy5jYWNlcnQub3JnL2luZGV4LnBocD9pZD0xMDBWBglghkgBhvhC
+AQ0ESRZHVG8gZ2V0IHlvdXIgb3duIGNlcnRpZmljYXRlIGZvciBGUkVFIGhlYWQg
+b3ZlciB0byBodHRwOi8vd3d3LmNhY2VydC5vcmcwDQYJKoZIhvcNAQEEBQADggIB
+ACjH7pyCArpcgBLKNQodgW+JapnM8mgPf6fhjViVPr3yBsOQWqy1YPaZQwGjiHCc
+nWKdpIevZ1gNMDY75q1I08t0AoZxPuIrA2jxNGJARjtT6ij0rPtmlVOKTV39O9lg
+18p5aTuxZZKmxoGCXJzN600BiqXfEVWqFcofN8CCmHBh22p8lqOOLlQ+TyGpkO/c
+gr/c6EWtTZBzCDyUZbAEmXZ/4rzCahWqlwQ3JNgelE5tDlG+1sSPypZt90Pf6DBl
+Jzt7u0NDY8RD97LsaMzhGY4i+5jhe1o+ATc7iwiwovOVThrLm82asduycPAtStvY
+sONvRUgzEv/+PDIqVPfE94rwiCPCR/5kenHA0R6mY7AHfqQv0wGP3J8rtsYIqQ+T
+SCX8Ev2fQtzzxD72V7DX3WnRBnc0CkvSyqD/HMaMyRa+xMwyN2hzXwj7UfdJUzYF
+CpUCTPJ5GhD22Dp1nPMd8aINcGeGG7MW9S/lpOt5hvk9C8JzC6WZrG/8Z7jlLwum
+GCSNe9FINSkYQKyTYOGWhlC0elnYjyELn8+CkcY7v2vcB5G5l1YjqrZslMZIBjzk
+zk6q5PYvCdxTby78dOs6Y5nCpqyJvKeyRKANihDjbPIky/qbn3BHLt4Ui9SyIAmW
+omTxJBzcoTWcFbLUvFUufQb1nA5V9FrWk9p2rSVzTMVD
+-----END CERTIFICATE-----

Lib/test/certdata/capath/b1930218.0

@@ -0,0 +1,27 @@
+-----BEGIN CERTIFICATE-----
+MIIEgDCCAuigAwIBAgIJAMstgJlaaVJbMA0GCSqGSIb3DQEBCwUAME0xCzAJBgNV
+BAYTAlhZMSYwJAYDVQQKDB1QeXRob24gU29mdHdhcmUgRm91bmRhdGlvbiBDQTEW
+MBQGA1UEAwwNb3VyLWNhLXNlcnZlcjAeFw0xODA4MjkxNDIzMTZaFw0zNzEwMjgx
+NDIzMTZaME0xCzAJBgNVBAYTAlhZMSYwJAYDVQQKDB1QeXRob24gU29mdHdhcmUg
+Rm91bmRhdGlvbiBDQTEWMBQGA1UEAwwNb3VyLWNhLXNlcnZlcjCCAaIwDQYJKoZI
+hvcNAQEBBQADggGPADCCAYoCggGBANCgm7G5O3nuMS+4URwBde0JWUysyL9qCvh6
+CPAl4yV7avjE2KqgYAclsM9zcQVSaL8Gk64QYZa8s2mBGn0Z/CCGj5poG+3N4mxh
+Z8dOVepDBiEb6bm+hF/C2uuJiOBCpkVJKtC5a4yTyUQ7yvw8lH/dcMWt2Es73B74
+VUu1J4b437CDz/cWN78TFzTUyVXtaxbJf60gTvAe2Ru/jbrNypbvHmnLUWZhSA3o
+eaNZYdQQjeANOwuFttWFEt2lB8VL+iP6VDn3lwvJREceVnc8PBMBC2131hS6RPRT
+NVbZPbk+NV/bM5pPWrk4RMkySf5m9h8al6rKTEr2uF5Af/sLHfhbodz4wC7QbUn1
+0kbUkFf+koE0ri04u6gXDOHlP+L3JgVUUPVksxxuRP9vqbQDlukOwojYclKQmcZB
+D0aQWbg+b9Linh02gpXTWIoS8+LYDSBRI/CQLZo+fSaGsqfX+ShgA+N3x4gEyf6J
+d3AQT8Ogijv0q0J74xSS2K4W1qHefQIDAQABo2MwYTAdBgNVHQ4EFgQU8+yUjvKO
+MMSOaMK/jmoZwMGfdmUwHwYDVR0jBBgwFoAU8+yUjvKOMMSOaMK/jmoZwMGfdmUw
+DwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAYYwDQYJKoZIhvcNAQELBQAD
+ggGBAIsAVHKzjevzrzSf1mDq3oQ/jASPGaa+AmfEY8V040c3WYOUBvFFGegHL9ZO
+S0+oPccHByeS9H5zT4syGZRGeiXE2cQnsBFjOmCLheFzTzQ7a6Q0jEmOzc9PsmUn
+QRmw/IAxePJzapt9cTRQ/Hio2gW0nFs6mXprXe870+k7MwESZc9eB9gZr9VT6vAQ
+rMS2Jjw0LnTuZN0dNnWJRACwDf0vswHMGosCzWzogILKv4LXAJ3YNhXSBzf8bHMd
+2qgc6CCOMnr+bScW5Fhs6z7w/iRSKXG4lntTS0UgVUBehhvsyUaRku6sk2WRLpS2
+tqzoozSJpBoSDU1EpVLti5HuL6avpJUl+c7HW6cA05PKtDxdTfexPMxttEW+gu0Y
+kMiG0XVRUARM6E/S1lCqdede/6F7Jxkca0ksbE1rY8w7cwDzmSbQgofTqTactD25
+SGiokvAnjgzNFXZChIDJP6N+tN3X+Kx2umCXPFofTt5x7gk5EN0x1WhXXRrlQroO
+aOZF0w==
+-----END CERTIFICATE-----

Lib/test/certdata/capath/ceff1710.0

@@ -0,0 +1,27 @@
+-----BEGIN CERTIFICATE-----
+MIIEgDCCAuigAwIBAgIJAMstgJlaaVJbMA0GCSqGSIb3DQEBCwUAME0xCzAJBgNV
+BAYTAlhZMSYwJAYDVQQKDB1QeXRob24gU29mdHdhcmUgRm91bmRhdGlvbiBDQTEW
+MBQGA1UEAwwNb3VyLWNhLXNlcnZlcjAeFw0xODA4MjkxNDIzMTZaFw0zNzEwMjgx
+NDIzMTZaME0xCzAJBgNVBAYTAlhZMSYwJAYDVQQKDB1QeXRob24gU29mdHdhcmUg
+Rm91bmRhdGlvbiBDQTEWMBQGA1UEAwwNb3VyLWNhLXNlcnZlcjCCAaIwDQYJKoZI
+hvcNAQEBBQADggGPADCCAYoCggGBANCgm7G5O3nuMS+4URwBde0JWUysyL9qCvh6
+CPAl4yV7avjE2KqgYAclsM9zcQVSaL8Gk64QYZa8s2mBGn0Z/CCGj5poG+3N4mxh
+Z8dOVepDBiEb6bm+hF/C2uuJiOBCpkVJKtC5a4yTyUQ7yvw8lH/dcMWt2Es73B74
+VUu1J4b437CDz/cWN78TFzTUyVXtaxbJf60gTvAe2Ru/jbrNypbvHmnLUWZhSA3o
+eaNZYdQQjeANOwuFttWFEt2lB8VL+iP6VDn3lwvJREceVnc8PBMBC2131hS6RPRT
+NVbZPbk+NV/bM5pPWrk4RMkySf5m9h8al6rKTEr2uF5Af/sLHfhbodz4wC7QbUn1
+0kbUkFf+koE0ri04u6gXDOHlP+L3JgVUUPVksxxuRP9vqbQDlukOwojYclKQmcZB
+D0aQWbg+b9Linh02gpXTWIoS8+LYDSBRI/CQLZo+fSaGsqfX+ShgA+N3x4gEyf6J
+d3AQT8Ogijv0q0J74xSS2K4W1qHefQIDAQABo2MwYTAdBgNVHQ4EFgQU8+yUjvKO
+MMSOaMK/jmoZwMGfdmUwHwYDVR0jBBgwFoAU8+yUjvKOMMSOaMK/jmoZwMGfdmUw
+DwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAYYwDQYJKoZIhvcNAQELBQAD
+ggGBAIsAVHKzjevzrzSf1mDq3oQ/jASPGaa+AmfEY8V040c3WYOUBvFFGegHL9ZO
+S0+oPccHByeS9H5zT4syGZRGeiXE2cQnsBFjOmCLheFzTzQ7a6Q0jEmOzc9PsmUn
+QRmw/IAxePJzapt9cTRQ/Hio2gW0nFs6mXprXe870+k7MwESZc9eB9gZr9VT6vAQ
+rMS2Jjw0LnTuZN0dNnWJRACwDf0vswHMGosCzWzogILKv4LXAJ3YNhXSBzf8bHMd
+2qgc6CCOMnr+bScW5Fhs6z7w/iRSKXG4lntTS0UgVUBehhvsyUaRku6sk2WRLpS2
+tqzoozSJpBoSDU1EpVLti5HuL6avpJUl+c7HW6cA05PKtDxdTfexPMxttEW+gu0Y
+kMiG0XVRUARM6E/S1lCqdede/6F7Jxkca0ksbE1rY8w7cwDzmSbQgofTqTactD25
+SGiokvAnjgzNFXZChIDJP6N+tN3X+Kx2umCXPFofTt5x7gk5EN0x1WhXXRrlQroO
+aOZF0w==
+-----END CERTIFICATE-----

Lib/test/certdata/cert3.pem

@@ -0,0 +1,34 @@
+-----BEGIN CERTIFICATE-----
+MIIF8TCCBFmgAwIBAgIJAMstgJlaaVJcMA0GCSqGSIb3DQEBCwUAME0xCzAJBgNV
+BAYTAlhZMSYwJAYDVQQKDB1QeXRob24gU29mdHdhcmUgRm91bmRhdGlvbiBDQTEW
+MBQGA1UEAwwNb3VyLWNhLXNlcnZlcjAeFw0xODA4MjkxNDIzMTZaFw0zNzEwMjgx
+NDIzMTZaMF8xCzAJBgNVBAYTAlhZMRcwFQYDVQQHDA5DYXN0bGUgQW50aHJheDEj
+MCEGA1UECgwaUHl0aG9uIFNvZnR3YXJlIEZvdW5kYXRpb24xEjAQBgNVBAMMCWxv
+Y2FsaG9zdDCCAaIwDQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGBAKAqKHEL7aDt
+3swl8hQF8VaK4zDGDRaF3E/IZTMwCN7FsQ4ejSiOe3E90f0phHCIpEpv2OebNenY
+IpOGoFgkh62r/cthmnhu8Mn+FUIv17iOq7WX7B30OSqEpnr1voLX93XYkAq8LlMh
+P79vsSCVhTwow3HZY7krEgl5WlfryOfj1i1TODSFPRCJePh66BsOTUvV/33GC+Qd
+pVZVDGLowU1Ycmr/FdRvwT+F39Dehp03UFcxaX0/joPhH5gYpBB1kWTAQmxuqKMW
+9ZZs6hrPtMXF/yfSrrXrzTdpct9paKR8RcufOcS8qju/ISK+1P/LXg2b5KJHedLo
+TTIO3yCZ4d1odyuZBP7JDrI05gMJx95gz6sG685Qc+52MzLSTwr/Qg+MOjQoBy0o
+8fRRVvIMEwoN0ZDb4uFEUuwZceUP1vTk/GGpNQt7ct4ropn6K4Zta3BUtovlLjZa
+IIBhc1KETUqjRDvC6ACKmlcJ/5pY/dbH1lOux+IMFsh+djmaV90b3QIDAQABo4IB
+wDCCAbwwFAYDVR0RBA0wC4IJbG9jYWxob3N0MA4GA1UdDwEB/wQEAwIFoDAdBgNV
+HSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDAYDVR0TAQH/BAIwADAdBgNVHQ4E
+FgQUP7HpT6C+MGY+ChjID0caTzRqD0IwfQYDVR0jBHYwdIAU8+yUjvKOMMSOaMK/
+jmoZwMGfdmWhUaRPME0xCzAJBgNVBAYTAlhZMSYwJAYDVQQKDB1QeXRob24gU29m
+dHdhcmUgRm91bmRhdGlvbiBDQTEWMBQGA1UEAwwNb3VyLWNhLXNlcnZlcoIJAMst
+gJlaaVJbMIGDBggrBgEFBQcBAQR3MHUwPAYIKwYBBQUHMAKGMGh0dHA6Ly90ZXN0
+Y2EucHl0aG9udGVzdC5uZXQvdGVzdGNhL3B5Y2FjZXJ0LmNlcjA1BggrBgEFBQcw
+AYYpaHR0cDovL3Rlc3RjYS5weXRob250ZXN0Lm5ldC90ZXN0Y2Evb2NzcC8wQwYD
+VR0fBDwwOjA4oDagNIYyaHR0cDovL3Rlc3RjYS5weXRob250ZXN0Lm5ldC90ZXN0
+Y2EvcmV2b2NhdGlvbi5jcmwwDQYJKoZIhvcNAQELBQADggGBAMo0usXQzycxMtYN
+JzC42xfftzmnu7E7hsQx/fur22MazJCruU6rNEkMXow+cKOnay+nmiV7AVoYlkh2
++DZ4dPq8fWh/5cqmnXvccr2jJVEXaOjp1wKGLH0WfLXcRLIK4/fJM6NRNoO81HDN
+hJGfBrot0gUKZcPZVQmouAlpu5OGwrfCkHR8v/BdvA5jE4zr+g/x+uUScE0M64wu
+okJCAAQP/PkfQZxjePBmk7KPLuiTHFDLLX+2uldvUmLXOQsJgqumU03MBT4Z8NTA
+zqmtEM65ceSP8lo8Zbrcy+AEkCulFaZ92tyjtbe8oN4wTmTLFw06oFLSZzuiOgDV
+OaphdVKf/pvA6KBpr6izox0KQFIE5z3AAJZfKzMGDDD20xhy7jjQZNMAhjfsT+k4
+SeYB/6KafNxq08uoulj7w4Z4R/EGpkXnU96ZHYHmvGN0RnxwI1cpYHCazG8AjsK/
+anN9brBi5twTGrn+D8LRBqF5Yn+2MKkD0EdXJdtIENHP+32sPQ==
+-----END CERTIFICATE-----

Lib/test/certdata/ffdh3072.pem

@@ -0,0 +1,41 @@
+    DH Parameters: (3072 bit)
+        prime:
+            00:ff:ff:ff:ff:ff:ff:ff:ff:ad:f8:54:58:a2:bb:
+            4a:9a:af:dc:56:20:27:3d:3c:f1:d8:b9:c5:83:ce:
+            2d:36:95:a9:e1:36:41:14:64:33:fb:cc:93:9d:ce:
+            24:9b:3e:f9:7d:2f:e3:63:63:0c:75:d8:f6:81:b2:
+            02:ae:c4:61:7a:d3:df:1e:d5:d5:fd:65:61:24:33:
+            f5:1f:5f:06:6e:d0:85:63:65:55:3d:ed:1a:f3:b5:
+            57:13:5e:7f:57:c9:35:98:4f:0c:70:e0:e6:8b:77:
+            e2:a6:89:da:f3:ef:e8:72:1d:f1:58:a1:36:ad:e7:
+            35:30:ac:ca:4f:48:3a:79:7a:bc:0a:b1:82:b3:24:
+            fb:61:d1:08:a9:4b:b2:c8:e3:fb:b9:6a:da:b7:60:
+            d7:f4:68:1d:4f:42:a3:de:39:4d:f4:ae:56:ed:e7:
+            63:72:bb:19:0b:07:a7:c8:ee:0a:6d:70:9e:02:fc:
+            e1:cd:f7:e2:ec:c0:34:04:cd:28:34:2f:61:91:72:
+            fe:9c:e9:85:83:ff:8e:4f:12:32:ee:f2:81:83:c3:
+            fe:3b:1b:4c:6f:ad:73:3b:b5:fc:bc:2e:c2:20:05:
+            c5:8e:f1:83:7d:16:83:b2:c6:f3:4a:26:c1:b2:ef:
+            fa:88:6b:42:38:61:1f:cf:dc:de:35:5b:3b:65:19:
+            03:5b:bc:34:f4:de:f9:9c:02:38:61:b4:6f:c9:d6:
+            e6:c9:07:7a:d9:1d:26:91:f7:f7:ee:59:8c:b0:fa:
+            c1:86:d9:1c:ae:fe:13:09:85:13:92:70:b4:13:0c:
+            93:bc:43:79:44:f4:fd:44:52:e2:d7:4d:d3:64:f2:
+            e2:1e:71:f5:4b:ff:5c:ae:82:ab:9c:9d:f6:9e:e8:
+            6d:2b:c5:22:36:3a:0d:ab:c5:21:97:9b:0d:ea:da:
+            1d:bf:9a:42:d5:c4:48:4e:0a:bc:d0:6b:fa:53:dd:
+            ef:3c:1b:20:ee:3f:d5:9d:7c:25:e4:1d:2b:66:c6:
+            2e:37:ff:ff:ff:ff:ff:ff:ff:ff
+        generator: 2 (0x2)
+        recommended-private-length: 276 bits
+-----BEGIN DH PARAMETERS-----
+MIIBjAKCAYEA//////////+t+FRYortKmq/cViAnPTzx2LnFg84tNpWp4TZBFGQz
++8yTnc4kmz75fS/jY2MMddj2gbICrsRhetPfHtXV/WVhJDP1H18GbtCFY2VVPe0a
+87VXE15/V8k1mE8McODmi3fipona8+/och3xWKE2rec1MKzKT0g6eXq8CrGCsyT7
+YdEIqUuyyOP7uWrat2DX9GgdT0Kj3jlN9K5W7edjcrsZCwenyO4KbXCeAvzhzffi
+7MA0BM0oNC9hkXL+nOmFg/+OTxIy7vKBg8P+OxtMb61zO7X8vC7CIAXFjvGDfRaD
+ssbzSibBsu/6iGtCOGEfz9zeNVs7ZRkDW7w09N75nAI4YbRvydbmyQd62R0mkff3
+7lmMsPrBhtkcrv4TCYUTknC0EwyTvEN5RPT9RFLi103TZPLiHnH1S/9croKrnJ32
+nuhtK8UiNjoNq8Uhl5sN6todv5pC1cRITgq80Gv6U93vPBsg7j/VnXwl5B0rZsYu
+N///////////AgECAgIBFA==
+-----END DH PARAMETERS-----

Lib/test/certdata/idnsans.pem

@@ -0,0 +1,166 @@
+-----BEGIN PRIVATE KEY-----
+MIIG/AIBADANBgkqhkiG9w0BAQEFAASCBuYwggbiAgEAAoIBgQCp6zt40WB3K7yj
+BGugnRuqI3ApftThZWDIpvW0cVmN0nqQxsO6CCnS4dS7SYhGFiIqWjNVc2WG0gv7
+nC5DFguqbndNZk9/SjX8EOxKz4ANjd61WnTkDO5Tbiiyd+TuEBxhmbEF69bF9dtd
+1Sgo8jmM7j+aa6ClYh/49bx+blJDF76EGSrmB1q+obMeZURhPXNBeoiqKR83x5Hc
+LTJYMocvb6m8uABwuSka13Gb3QGu06p5ldK6TDK38HsoOy6MFO5F1PrkakG/eBHO
+jcBOGPfNmTwWOqvwlcQWykr4QspWS+yTzdkgZ+mxar/yQuq7wuYSNaEfGH5yoYtV
+WIgKwwZRDPqpSQuVe+J+MWLPQ6RTM+rXIHVzHtPk1f8DrgN+hSepJy/sVBBEQCzj
+nyB+scn76ETWch3iyVoMj3oVOGs0b4XTDMmUw/DmEt5TDah7TqE3G+fpBIbgMSjx
+MzUQZl27izmM9nQCJRAosNoNwXqlM754K9WcY6gT8kkcj1CfTmMCAwEAAQKCAYAz
+9ZdHkDsf5fN2pAznXfOOOOz8+2hMjmwkn42GAp1gdWr+Z5GFiyaC8oTTSp6N1AnZ
+iqCk8jcrHYMFi1JIOG8TzFjWBcGsinxsmp4vGDmvq2Ddcw5IiD2+rHJsdKZAOBP9
+snpD9cTE3zQYAu0XbE617krrxRqoSBO/1SExRjoIgzPCgFGyarBQl/DGjC/3Tku2
+y6oL4qxFqdTMD9QTzUuycUJlz5xu2+gaaaQ3hcMUe2xnZq28Qz3FKpf2ivZmZqWf
+4+AIe0lRosmFoLAFjIyyuGCkWZ2t9KDIZV0OOS4+DvVOC/Um9r4VojeikripCGKY
+2FzkkuQP3jz6pJ1UxCDg7YXZdR2IbcS18F1OYmLViU8oLDR6T01s0Npmp39dDazf
+A4U+WyV3o1ydiSpwAiN8pJadmr5BHrCSmawV8ztW5yholufrO+FR5ze2+QG99txm
+6l7lUI8Nz01lYG6D10MjaQ9INk2WSjBPVNbfsTl73/hR76/319ctfOINRMHilJ0C
+gcEAvFgTdc5Qf9E7xEZE5UtpSTPvZ24DxQ7hmGW3pTs6+Nw4ccknnW0lLkWvY4Sf
+gXl4TyTTUhe6PAN3UHzbjN2vdsTmAVUlnkNH40ymF8FgRGFNDuvuCZvf5ZWNddSl
+6Vu/e5TFPDAqS8rGnl23DgXhlT+3Y0/mrftWoigdOxgximLAsmmqp/tANGi9jqE1
+3L0BN+xKqMMKSXkMtuzJHuini8MaWQgQcW/4czh4ArdesMzuVrstOD8947XHreY9
+pesVAoHBAOb0y/AFEdR+mhk/cfqjTzsNU2sS9yHlzMVgecF8BA26xcfAwg4d47VS
++LK8fV6KC4hHk4uQWjQzCG2PYXBbFT52xeJ3EC8DwWxJP09b4HV/1mWxXl5htjnr
+dfyTmXKvEe5ZBpKGWc8i7s7jBi7R5EpgIfc586iNRyjYAk60dyG0iP13SurRvXBg
+ID25VR4wABl3HQ3Hhv61dqC9FPrdHZQJdysfUqNrAFniWsSR2eyG5i4S1uHa3G+i
+MzBTOuBRlwKBwBNXUBhG6YlWqTaMqMKLLfKwfKM4bvargost1uAG5xVrN/inWYQX
+EzxfN5WWpvKa0Ln/5BuICD3ldTk0uS8MDNq7eYslfUl1S0qSMnQ6DXK4MzuXCsi9
+0w42f2JcRfVi0JUWP/LgV1eVKTRWF1g/Tl0PP/vY1q2DI/BfAjFxWJUHcxZfN4Es
+kflP0Dd3YpqaZieiAkC2VrYY0i9uvXCJH7uAe5Is+9NKVk8uu1Q8FGM/iDIr4obm
+J6rcnfbDsAz7yQKBwGtIbW9qO3UU9ioiQaTmtYg90XEclzXk1HEfNo+9NvjVuMfo
+b3w1QDBbgXEtg6MlxuOgNBaRkIVM625ROzcA6GZir9tZ6Wede/z8LW+Ew0hxgLsu
+YCLBiu9uxBj2y0HttwubySTJSfChToNGC/o1v7EY5M492kSCk/qSFMhQpkI+5Z+w
+CVn44eHQlUl2zOY/79vka9eZxsiMrLVP/+3kRrgciYG7hByrOLeIIRfMlIl9xHDE
+iZLSorEsjFC3aNMIswKBwFELC2fvlziW9rECQcGXnvc1DPmZcxm1ATFZ93FpKleF
+TjLIWSdst0PmO8CSIuEZ2ZXPoK9CMJyQG+kt3k7IgZ1xKXg9y6ThwbznurXp1jaW
+NjEnYtFMBK9Ur3oaAsrG2XwZ2PMvnI/Yp8tciGvjJlzSM8gHJ9BL8Yf+3gIJi/0D
+KtaF9ha9J/SDDZdEiLIQ4LvSqYmlUgsCgiUvY3SVwCh8xDfBWD1hKw9vUiZu5cnJ
+81hAHFgeD4f+C8fLols/sA==
+-----END PRIVATE KEY-----
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            cb:2d:80:99:5a:69:52:60
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=XY, O=Python Software Foundation CA, CN=our-ca-server
+        Validity
+            Not Before: Aug 29 14:23:16 2018 GMT
+            Not After : Oct 28 14:23:16 2037 GMT
+        Subject: C=XY, L=Castle Anthrax, O=Python Software Foundation, CN=idnsans
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (3072 bit)
+                Modulus:
+                    00:a9:eb:3b:78:d1:60:77:2b:bc:a3:04:6b:a0:9d:
+                    1b:aa:23:70:29:7e:d4:e1:65:60:c8:a6:f5:b4:71:
+                    59:8d:d2:7a:90:c6:c3:ba:08:29:d2:e1:d4:bb:49:
+                    88:46:16:22:2a:5a:33:55:73:65:86:d2:0b:fb:9c:
+                    2e:43:16:0b:aa:6e:77:4d:66:4f:7f:4a:35:fc:10:
+                    ec:4a:cf:80:0d:8d:de:b5:5a:74:e4:0c:ee:53:6e:
+                    28:b2:77:e4:ee:10:1c:61:99:b1:05:eb:d6:c5:f5:
+                    db:5d:d5:28:28:f2:39:8c:ee:3f:9a:6b:a0:a5:62:
+                    1f:f8:f5:bc:7e:6e:52:43:17:be:84:19:2a:e6:07:
+                    5a:be:a1:b3:1e:65:44:61:3d:73:41:7a:88:aa:29:
+                    1f:37:c7:91:dc:2d:32:58:32:87:2f:6f:a9:bc:b8:
+                    00:70:b9:29:1a:d7:71:9b:dd:01:ae:d3:aa:79:95:
+                    d2:ba:4c:32:b7:f0:7b:28:3b:2e:8c:14:ee:45:d4:
+                    fa:e4:6a:41:bf:78:11:ce:8d:c0:4e:18:f7:cd:99:
+                    3c:16:3a:ab:f0:95:c4:16:ca:4a:f8:42:ca:56:4b:
+                    ec:93:cd:d9:20:67:e9:b1:6a:bf:f2:42:ea:bb:c2:
+                    e6:12:35:a1:1f:18:7e:72:a1:8b:55:58:88:0a:c3:
+                    06:51:0c:fa:a9:49:0b:95:7b:e2:7e:31:62:cf:43:
+                    a4:53:33:ea:d7:20:75:73:1e:d3:e4:d5:ff:03:ae:
+                    03:7e:85:27:a9:27:2f:ec:54:10:44:40:2c:e3:9f:
+                    20:7e:b1:c9:fb:e8:44:d6:72:1d:e2:c9:5a:0c:8f:
+                    7a:15:38:6b:34:6f:85:d3:0c:c9:94:c3:f0:e6:12:
+                    de:53:0d:a8:7b:4e:a1:37:1b:e7:e9:04:86:e0:31:
+                    28:f1:33:35:10:66:5d:bb:8b:39:8c:f6:74:02:25:
+                    10:28:b0:da:0d:c1:7a:a5:33:be:78:2b:d5:9c:63:
+                    a8:13:f2:49:1c:8f:50:9f:4e:63
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Alternative Name: 
+                DNS:idnsans, DNS:xn--knig-5qa.idn.pythontest.net, DNS:xn--knigsgsschen-lcb0w.idna2003.pythontest.net, DNS:xn--knigsgchen-b4a3dun.idna2008.pythontest.net, DNS:xn--nxasmq6b.idna2003.pythontest.net, DNS:xn--nxasmm1c.idna2008.pythontest.net
+            X509v3 Key Usage: critical
+                Digital Signature, Key Encipherment
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, TLS Web Client Authentication
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            X509v3 Subject Key Identifier: 
+                5B:93:42:58:B0:B4:18:CC:41:4C:15:EB:42:33:66:77:4C:71:2F:42
+            X509v3 Authority Key Identifier: 
+                keyid:F3:EC:94:8E:F2:8E:30:C4:8E:68:C2:BF:8E:6A:19:C0:C1:9F:76:65
+                DirName:/C=XY/O=Python Software Foundation CA/CN=our-ca-server
+                serial:CB:2D:80:99:5A:69:52:5B
+            Authority Information Access: 
+                CA Issuers - URI:http://testca.pythontest.net/testca/pycacert.cer
+                OCSP - URI:http://testca.pythontest.net/testca/ocsp/
+            X509v3 CRL Distribution Points: 
+                Full Name:
+                  URI:http://testca.pythontest.net/testca/revocation.crl
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        5f:d8:9b:dc:22:55:80:47:e1:9b:04:3e:46:53:9b:e5:a7:4a:
+        8f:eb:53:01:39:d5:04:f6:cf:dc:48:84:8a:a9:c3:a5:35:22:
+        2f:ab:74:77:ec:a6:fd:b1:e6:e6:74:82:38:54:0b:27:36:e6:
+        ec:3d:fe:92:1a:b2:7a:35:0d:a3:e5:7c:ff:e5:5b:1a:28:4b:
+        29:1f:99:1b:3e:11:e9:e2:e0:d7:da:06:4f:e3:7b:8c:ad:30:
+        f4:39:24:e8:ad:2a:0e:71:74:ab:ed:62:e9:9f:85:7e:6a:b0:
+        bb:53:b4:d7:6b:b8:da:54:15:5c:9a:41:cf:61:f1:ab:67:d6:
+        27:5c:0c:a3:d7:41:e7:27:3e:58:89:d6:1f:3f:2a:52:cc:13:
+        0b:4b:e6:d6:ba:a0:c7:fd:e3:17:a4:b8:da:cc:cb:88:70:21:
+        3b:70:df:09:40:6c:e7:02:81:08:80:b0:36:77:fb:44:c5:cf:
+        bf:19:54:7c:d1:4e:1f:a2:44:9e:d8:56:0e:bf:4b:0b:e0:84:
+        6f:bc:f6:c6:7f:35:7a:17:ca:83:b3:82:c6:4e:d3:f3:d8:30:
+        05:fd:6d:3c:8a:ab:63:55:6f:c5:18:ba:66:fe:e2:35:04:2b:
+        ae:76:34:f0:56:18:e8:54:db:83:b2:1b:93:0a:25:81:81:f0:
+        25:ca:0a:95:be:8e:2f:05:3f:6c:e7:de:d1:7c:b8:a3:71:7c:
+        6f:8a:05:c3:69:eb:6f:e6:76:8c:11:e1:59:0b:12:53:07:42:
+        84:e8:89:ee:ab:7d:28:81:48:e8:79:d5:cf:a2:05:a4:fd:72:
+        2c:7d:b4:1c:08:90:4e:0d:10:05:d1:9a:c0:69:4c:0a:14:39:
+        17:fb:4d:5b:f6:42:bb:46:27:23:0f:5e:57:5b:b8:ae:9b:a3:
+        0e:23:59:41:63:41:a4:f1:69:df:b3:a3:5c:10:d5:63:30:74:
+        a8:3c:0c:8e:1c:6b:10:e1:13:27:02:26:9b:fd:88:93:7e:91:
+        9c:f9:c2:07:27:a4
+-----BEGIN CERTIFICATE-----
+MIIGvTCCBSWgAwIBAgIJAMstgJlaaVJgMA0GCSqGSIb3DQEBCwUAME0xCzAJBgNV
+BAYTAlhZMSYwJAYDVQQKDB1QeXRob24gU29mdHdhcmUgRm91bmRhdGlvbiBDQTEW
+MBQGA1UEAwwNb3VyLWNhLXNlcnZlcjAeFw0xODA4MjkxNDIzMTZaFw0zNzEwMjgx
+NDIzMTZaMF0xCzAJBgNVBAYTAlhZMRcwFQYDVQQHDA5DYXN0bGUgQW50aHJheDEj
+MCEGA1UECgwaUHl0aG9uIFNvZnR3YXJlIEZvdW5kYXRpb24xEDAOBgNVBAMMB2lk
+bnNhbnMwggGiMA0GCSqGSIb3DQEBAQUAA4IBjwAwggGKAoIBgQCp6zt40WB3K7yj
+BGugnRuqI3ApftThZWDIpvW0cVmN0nqQxsO6CCnS4dS7SYhGFiIqWjNVc2WG0gv7
+nC5DFguqbndNZk9/SjX8EOxKz4ANjd61WnTkDO5Tbiiyd+TuEBxhmbEF69bF9dtd
+1Sgo8jmM7j+aa6ClYh/49bx+blJDF76EGSrmB1q+obMeZURhPXNBeoiqKR83x5Hc
+LTJYMocvb6m8uABwuSka13Gb3QGu06p5ldK6TDK38HsoOy6MFO5F1PrkakG/eBHO
+jcBOGPfNmTwWOqvwlcQWykr4QspWS+yTzdkgZ+mxar/yQuq7wuYSNaEfGH5yoYtV
+WIgKwwZRDPqpSQuVe+J+MWLPQ6RTM+rXIHVzHtPk1f8DrgN+hSepJy/sVBBEQCzj
+nyB+scn76ETWch3iyVoMj3oVOGs0b4XTDMmUw/DmEt5TDah7TqE3G+fpBIbgMSjx
+MzUQZl27izmM9nQCJRAosNoNwXqlM754K9WcY6gT8kkcj1CfTmMCAwEAAaOCAo4w
+ggKKMIHhBgNVHREEgdkwgdaCB2lkbnNhbnOCH3huLS1rbmlnLTVxYS5pZG4ucHl0
+aG9udGVzdC5uZXSCLnhuLS1rbmlnc2dzc2NoZW4tbGNiMHcuaWRuYTIwMDMucHl0
+aG9udGVzdC5uZXSCLnhuLS1rbmlnc2djaGVuLWI0YTNkdW4uaWRuYTIwMDgucHl0
+aG9udGVzdC5uZXSCJHhuLS1ueGFzbXE2Yi5pZG5hMjAwMy5weXRob250ZXN0Lm5l
+dIIkeG4tLW54YXNtbTFjLmlkbmEyMDA4LnB5dGhvbnRlc3QubmV0MA4GA1UdDwEB
+/wQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDAYDVR0TAQH/
+BAIwADAdBgNVHQ4EFgQUW5NCWLC0GMxBTBXrQjNmd0xxL0IwfQYDVR0jBHYwdIAU
+8+yUjvKOMMSOaMK/jmoZwMGfdmWhUaRPME0xCzAJBgNVBAYTAlhZMSYwJAYDVQQK
+DB1QeXRob24gU29mdHdhcmUgRm91bmRhdGlvbiBDQTEWMBQGA1UEAwwNb3VyLWNh
+LXNlcnZlcoIJAMstgJlaaVJbMIGDBggrBgEFBQcBAQR3MHUwPAYIKwYBBQUHMAKG
+MGh0dHA6Ly90ZXN0Y2EucHl0aG9udGVzdC5uZXQvdGVzdGNhL3B5Y2FjZXJ0LmNl
+cjA1BggrBgEFBQcwAYYpaHR0cDovL3Rlc3RjYS5weXRob250ZXN0Lm5ldC90ZXN0
+Y2Evb2NzcC8wQwYDVR0fBDwwOjA4oDagNIYyaHR0cDovL3Rlc3RjYS5weXRob250
+ZXN0Lm5ldC90ZXN0Y2EvcmV2b2NhdGlvbi5jcmwwDQYJKoZIhvcNAQELBQADggGB
+AF/Ym9wiVYBH4ZsEPkZTm+WnSo/rUwE51QT2z9xIhIqpw6U1Ii+rdHfspv2x5uZ0
+gjhUCyc25uw9/pIasno1DaPlfP/lWxooSykfmRs+Eeni4NfaBk/je4ytMPQ5JOit
+Kg5xdKvtYumfhX5qsLtTtNdruNpUFVyaQc9h8atn1idcDKPXQecnPliJ1h8/KlLM
+EwtL5ta6oMf94xekuNrMy4hwITtw3wlAbOcCgQiAsDZ3+0TFz78ZVHzRTh+iRJ7Y
+Vg6/SwvghG+89sZ/NXoXyoOzgsZO0/PYMAX9bTyKq2NVb8UYumb+4jUEK652NPBW
+GOhU24OyG5MKJYGB8CXKCpW+ji8FP2zn3tF8uKNxfG+KBcNp62/mdowR4VkLElMH
+QoToie6rfSiBSOh51c+iBaT9cix9tBwIkE4NEAXRmsBpTAoUORf7TVv2QrtGJyMP
+XldbuK6bow4jWUFjQaTxad+zo1wQ1WMwdKg8DI4caxDhEycCJpv9iJN+kZz5wgcn
+pA==
+-----END CERTIFICATE-----

Lib/test/certdata/keycert.passwd.pem

@@ -0,0 +1,69 @@
+-----BEGIN ENCRYPTED PRIVATE KEY-----
+MIIHbTBXBgkqhkiG9w0BBQ0wSjApBgkqhkiG9w0BBQwwHAQIc17oH9riZswCAggA
+MAwGCCqGSIb3DQIJBQAwHQYJYIZIAWUDBAEqBBDwi0Mkj59S0hplpnDSNHwPBIIH
+EFGdZuO4Cwzg0bspLhE1UpBN5cBq1rKbf4PyVtCczIqJt3KjO3H5I4KdQd9zihkN
+A1qzMiqVZOnQZw1eWFXMdyWuCgvNe1S/PRLWY3iZfnuZ9gZXQvyMEHy4JU7pe2Ib
+GNm9mzadzJtGv0YZ05Kkza20zRlOxC/cgaNUV6TPeTSwW9CR2bylxw0lTFKBph+o
+uFGcAzhqQuw9vsURYJf1f1iE7bQsnWU2kKmb9cx6kaUXiGJpkUMUraBL/rShoHa0
+eet6saiFnK3XGMCIK0mhS9s92CIQV5H9oQQPo/7s6MOoUHjC/gFoWBXoIDOcN9aR
+ngybosCLtofY2m14WcHXvu4NJnfnKStx73K3dy3ZLr2iyjnsqGD1OhqGEWOVG/ho
+QiZEhZ+9sOnqWI2OuMhMoQJNvrLj7AY4QbdkahdjNvLjDAQSuMI2uSUDFDNfkQdy
+hqF/iiEM28PmSHCapgCpzR4+VfEfXBoyBCqs973asa9qhrorfnBVxXnvsqmKNLGH
+dymtEPei9scpoftE5T9TPqQj46446bXk23Xpg8QIFa8InQC2Y+yZqqlqvzCAbN6S
+Qcq1DcTSAMnbmBXVu9hPmJYIYOlBMHL8JGbsGrkVOhLiiIou4w3G+DyAvIwPj6j9
+BHLqa7HgUnUEC+zL4azVHOSMqmDsOiF3w9fkBWNSkOyNoZpe+gBjbxq7sp+GjAJv
+1CemRC3LSoNzLcjRG2IEGs1jlEHSSfijvwlE4lEy3JVc+QK8BOkKXXDVhY1SQHcS
+pniEnj95RFVmAujdFDBoUgySyxK/y6Ju/tHPpSTG9VMNbJTKTdBWAVWWHVJzBFhR
+0Ug62VrBK7fmfUdH1b37aIxqsPND2De6WLm0RX+7r3XPDJ7hm+baKCchI5CvnG19
+ky8InhMbU4qV+9LceMETmNKKDkhKl4Zx/Y3nab7DG9s/RZfrTdCHojc9Va/t0Ykp
+qlVrvdj/893CdI78SW3VjWBJGWfKMyT16hBMY3TPz6ulbFXk6Pul/KcLLWslghS+
+GKZjyBe96UwfH4C7WjuIB+zo+De3Wr8xOCdJR5zwEutBMM+L/Wul8B6wIEGS71kB
+TN/CAoeIgHLQFbcw4YE80dllTnSEsqF+ahVTTcCt3iLUaOgeTUxteMbXY9+nekSX
+x8aUcvkMhbU9omdEowFr5/HIMKXo4UXat4fIGgh2pG8v8fA46hZXkhWUh/PhbnQw
+StXzn4fA13erqVI679kHMmOIQebv4oqdcwkImrH5fEsACNjQbkYZF5fD4z+1GHkA
+e2eGqejVT+OV14I8qfx9oqs2f8aqijH8fYLU0TymE7p53DYZy4WvDwk22I4rMzoQ
+sGkOZwfKUYpdBI2t6tEf1ROBjoNG0E2Onq+5iooibN08rKXKAQMWsK+2vNHNHwBW
+49vRheQNnRqSuLY+b7QAjA0KuRWo9YptCbnXyF/Aw64jMfAGjggDLoaZfALGZk3n
+P+ZoL9xc7rYRpIca44BeYI6AhHFcWWIOX7Sm69FvmyHlfsgTAXVgY1lQPuGy68Au
+PHSkgUyydDtkrfb2W2gJuqD/+h+9X2z+o/+nETYPCZm3sH5xvTY/DTcTx9kTpXxx
+YQBaFTt12eVX7wZVr5K3u9M371rg+SeXC2SzL4T6APHD52cxbA1jgM0JFh3KJTuk
+fADxIzM1NdzYQ45J6i2w+/Fh4VPnXZ0oiUSwE094XTBlvhI6zHgar2Q0Qx1P51vB
+odd9XzyDLULuIzei0DYjTIg0KhE+wAGq1I5qtiMhmy5TdCKKNA9WGb1Pq38zpyjU
+wGmztzSzCEjfLyhChaUObVRRxEfD5ioxKer/fczOhKQe8FXmGy5u/04tVmmEyNOO
+JkkDtZy+UbKuJ257QnY72wPjgtHNy+S4Iv7zHUbNJNhxk+xBlRcmRNWCEM20LBSO
+Tj4S9gyan+gH2+WFxy8FaENUhM+vHFEeJcjQIBFBeWICmSmdkh/r0YK1UVJ9NLfR
+l0HiKm3lKg+kNCexTAPLMt2rGZ4PAKVnhVaxtuHMYYDpl2GYmyH73B9BfcPdA/Zx
+GUBmd9hwcLz9SuUg+fjHcogZRRRlcZlKhw3zUCsqHSCQXZCQm7mBlG/5C/7cM7wQ
+IRtsNospLStOg51gv21ClQ+uWx30XEcwmnIfVoLl1vMaguuf1u5u3dWBD/UgmqiP
+1Ym8jv0BF/AS+u/CtUpwe7ZWxFT0vbyi10xxIF7O07fwFa+5dME3ycZwcyiE95K1
+ftcHlGOIhuVBMSNZXC4I9LM+7IWy+hanUcK+v5RvwBDSJV3fnAOdfrka1L/HyEEb
+x/FYKEiU/TAjXDw2NtZ2itpADTSG5KbdJSwPr01Ak7aE+QYe7TIKJhBDZXGQlqq8
+1wv77zyv7V5Xq2cxSEKgSqzB9fhYZCASe8+HWlV2T+Sd
+-----END ENCRYPTED PRIVATE KEY-----
+-----BEGIN CERTIFICATE-----
+MIIEgzCCAuugAwIBAgIUU+FIM/dUbCklbdDwNPd2xemDAEwwDQYJKoZIhvcNAQEL
+BQAwXzELMAkGA1UEBhMCWFkxFzAVBgNVBAcMDkNhc3RsZSBBbnRocmF4MSMwIQYD
+VQQKDBpQeXRob24gU29mdHdhcmUgRm91bmRhdGlvbjESMBAGA1UEAwwJbG9jYWxo
+b3N0MB4XDTIzMTEyNTA0MjEzNloXDTQzMDEyNDA0MjEzNlowXzELMAkGA1UEBhMC
+WFkxFzAVBgNVBAcMDkNhc3RsZSBBbnRocmF4MSMwIQYDVQQKDBpQeXRob24gU29m
+dHdhcmUgRm91bmRhdGlvbjESMBAGA1UEAwwJbG9jYWxob3N0MIIBojANBgkqhkiG
+9w0BAQEFAAOCAY8AMIIBigKCAYEAzXTIl1su11AGu6sDPsoxqcRGyAX0yjxIcswF
+vj+eW/fBs2GcBby95VEOKpJPKRYYB7fAEAjAKK59zFdsDX/ynxPZLqyLQocBkFVq
+tclhCRZu//KZND+uQuHSx3PjGkSvK/nrGjg5T0bkM4SFeb0YdLb+0aDTKGozUC82
+oBAilNcrFz1VXpEF0qUe9QeKQhyd0MaW5T1oSn+U3RAj2MXm3TGExyZeaicpIM5O
+HFlnwUxsYSDZo0jUj342MbPOZh8szZDWi042jdtSA3i8uMSplEf4O8ZPmX0JCtrz
+fVjRVdaKXIjrhMNWB8K44q6AeyhqJcVHtOmPYoHDm0qIjcrurt0LZaGhmCuKimNd
+njcPxW0VQmDIS/mO5+s24SK+Mpznm5q/clXEwyD8FbrtrzV5cHCE8eNkxjuQjkmi
+wW9uadK1s54tDwRWMl6DRWRyxoF0an885UQWmbsgEB5aRmEx2L0JeD0/q6Iw1Nta
+As8DG4AaWuYMrgZXz7XvyiMq3IxVAgMBAAGjNzA1MBQGA1UdEQQNMAuCCWxvY2Fs
+aG9zdDAdBgNVHQ4EFgQUl2wd7iWE1JTZUVq2yFBKGm9N36owDQYJKoZIhvcNAQEL
+BQADggGBAF0f5x6QXFbgdyLOyeAPD/1DDxNjM68fJSmNM/6vxHJeDFzK0Pja+iJo
+xv54YiS9F2tiKPpejk4ujvLQgvrYrTQvliIE+7fUT0dV74wZKPdLphftT9uEo1dH
+TeIld+549fqcfZCJfVPE2Ka4vfyMGij9hVfY5FoZL1Xpnq/ZGYyWZNAPbkG292p8
+KrfLZm/0fFYAhq8tG/6DX7+2btxeX4MP/49tzskcYWgOjlkknyhJ76aMG9BJ1D7F
+/TIEh5ihNwRTmyt023RBz/xWiN4xBLyIlpQ6d5ECKmFNFr0qnEui6UovfCHUF6lZ
+qcAQ5VFQQ2CayNlVmQ+UGmWIqANlacYWBt7Q6VqpGg24zTMec1/Pqd6X07ScSfrm
+MAtywrWrU7p1aEkN5lBa4n/XKZHGYMjor/YcMdF5yjdSrZr274YYO1pafmTFwRwH
+5o16c8WPc0aPvTFbkGIFT5ddxYstw+QwsBtLKE2lJ4Qfmxt0Ew/0L7xkbK1BaCOo
+EGD2IF7VDQ==
+-----END CERTIFICATE-----

Lib/test/certdata/keycert.pem

@@ -0,0 +1,67 @@
+-----BEGIN PRIVATE KEY-----
+MIIG/QIBADANBgkqhkiG9w0BAQEFAASCBucwggbjAgEAAoIBgQDNdMiXWy7XUAa7
+qwM+yjGpxEbIBfTKPEhyzAW+P55b98GzYZwFvL3lUQ4qkk8pFhgHt8AQCMAorn3M
+V2wNf/KfE9kurItChwGQVWq1yWEJFm7/8pk0P65C4dLHc+MaRK8r+esaODlPRuQz
+hIV5vRh0tv7RoNMoajNQLzagECKU1ysXPVVekQXSpR71B4pCHJ3QxpblPWhKf5Td
+ECPYxebdMYTHJl5qJykgzk4cWWfBTGxhINmjSNSPfjYxs85mHyzNkNaLTjaN21ID
+eLy4xKmUR/g7xk+ZfQkK2vN9WNFV1opciOuEw1YHwrjiroB7KGolxUe06Y9igcOb
+SoiNyu6u3QtloaGYK4qKY12eNw/FbRVCYMhL+Y7n6zbhIr4ynOebmr9yVcTDIPwV
+uu2vNXlwcITx42TGO5COSaLBb25p0rWzni0PBFYyXoNFZHLGgXRqfzzlRBaZuyAQ
+HlpGYTHYvQl4PT+rojDU21oCzwMbgBpa5gyuBlfPte/KIyrcjFUCAwEAAQKCAYAO
+M1r0+TCy4Z1hhceu5JdLql0RELZTbxi71IW2GVwW87gv75hy3hGLAs/1mdC+YIBP
+MkBka1JqzWq0/7rgcP5CSAMsInFqqv2s7fZ286ERGXuZFbnInnkrNsQUlJo3E9W+
+tqKtGIM/i0EVHX0DRdJlqMtSjmjh43tB+M1wAUV+n6OjEtJue5wZK+AIpBmGicdP
+qZY+6IBnm8tcfzPXFRCoq7ZHdIu0jxnc4l2MQJK3DdL04KoiStOkSl8xDsI+lTtq
+D3qa41LE0TY8X2jJ/w6KK3cUeK7F4DQYs+kfCKWMVPpn0/5u6TbC1F7gLvkrseph
+7cIgrruNNs9iKacnR1w3U72R+hNxHsNfo4RGHFa192p/Mfc+kiBd5RNR/M9oHdeq
+U6T/+KM+QyF5dDOyonY0QjwfAcEx+ZsV72nj8AerjM907I6dgHo/9YZ2S1Dt/xuG
+ntD+76GDzmrOvXmmpF0DsTn+Wql7AC4uzaOjv6PVziqz03pR61RpjPDemyJEWMkC
+gcEA7BkGGX3enBENs3X6BYFoeXfGO/hV7/aNpA6ykLzw657dqwy2b6bWLiIaqZdZ
+u0oiY6+SpOtavkZBFTq4bTVD58FHL0n73Yvvaft507kijpYBrxyDOfTJOETv+dVG
+XiY8AUSAE6GjPi0ebuYIVUxoDnMeWDuRJNvTck4byn1hJ1aVlEhwXNxt/nAjq48s
+5QDuR6Z9F8lqEACRYCHSMQYFm35c7c1pPsHJnElX8a7eZ9lT7HGPXHaf/ypMkOzo
+dvJNAoHBAN7GhDomff/kSgQLyzmqKqQowTZlyihnReapygwr8YpNcqKDqq6VlnfH
+Jl1+qtSMSVI0csmccwJWkz1WtSjDsvY+oMdv4gUK3028vQAMQZo+Sh7OElFPFET3
+UmL+Nh73ACPgpiommsdLZQPcIqpWNT5NzO+Jm5xa+U9ToVZgQ7xjrqee5NUiMutr
+r7UWAz7vDWu3x7bzYRRdUJxU18NogGbFGWJ1KM0c67GUXu2E7wBQdjVdS78UWs+4
+XBxKQkG2KQKBwQCtO+M82x122BB8iGkulvhogBjlMd8klnzxTpN5HhmMWWH+uvI1
+1G29Jer4WwRNJyU6jb4E4mgPyw7AG/jssLOlniy0Jw32TlIaKpoGXwZbJvgPW9Vx
+tgnbDsIiR3o9ZMKMj42GWgike4ikCIc+xzRmvdMbHIHwUJfCfEtp9TtPGPnh9pDz
+og3XLsMNg52GXnt3+VI6HOCE41XH+qj2rZt5r2tSVXEOyjQ7R5mOzSeFfXJVwDFX
+v/a/zHKnuB0OAdUCgcBLrxPTEaqy2eMPdtZHM/mipbnmejRw/4zu7XYYJoG7483z
+SlodT/K7pKvzDYqKBVMPm4P33K/x9mm1aBTJ0ZqmL+a9etRFtEjjByEKuB89gLX7
+uzTb7MrNF10lBopqgK3KgpLRNSZWWNXrtskMJ5eVICdkpdJ5Dyst+RKR3siEYzU9
++yxxAFpeQsqB8gWORva/RsOR8yNjIMS3J9fZqlIdGA8ktPr0nEOyo96QQR5VdACE
+5rpKI2cqtM6OSegynOkCgcAnr2Xzjef6tdcrxrQrq0DjEFTMoCAxQRa6tuF/NYHV
+AK70Y4hBNX84Bvym4hmfbMUEuOCJU+QHQf/iDQrHXPhtX3X2/t8M+AlIzmwLKf2o
+VwCYnZ8SqiwSaWVg+GANWLh0JuKn/ZYyR8urR79dAXFfp0UK+N39vIxNoBisBf+F
+G8mca7zx3UtK2eOW8WgGHz+Y20VZy0m/nkNekd1ZTXoSGhL+iN4XsTRn1YQIn69R
+kNdcwhtZZ3dpChUdf+w/LIc=
+-----END PRIVATE KEY-----
+-----BEGIN CERTIFICATE-----
+MIIEgzCCAuugAwIBAgIUU+FIM/dUbCklbdDwNPd2xemDAEwwDQYJKoZIhvcNAQEL
+BQAwXzELMAkGA1UEBhMCWFkxFzAVBgNVBAcMDkNhc3RsZSBBbnRocmF4MSMwIQYD
+VQQKDBpQeXRob24gU29mdHdhcmUgRm91bmRhdGlvbjESMBAGA1UEAwwJbG9jYWxo
+b3N0MB4XDTIzMTEyNTA0MjEzNloXDTQzMDEyNDA0MjEzNlowXzELMAkGA1UEBhMC
+WFkxFzAVBgNVBAcMDkNhc3RsZSBBbnRocmF4MSMwIQYDVQQKDBpQeXRob24gU29m
+dHdhcmUgRm91bmRhdGlvbjESMBAGA1UEAwwJbG9jYWxob3N0MIIBojANBgkqhkiG
+9w0BAQEFAAOCAY8AMIIBigKCAYEAzXTIl1su11AGu6sDPsoxqcRGyAX0yjxIcswF
+vj+eW/fBs2GcBby95VEOKpJPKRYYB7fAEAjAKK59zFdsDX/ynxPZLqyLQocBkFVq
+tclhCRZu//KZND+uQuHSx3PjGkSvK/nrGjg5T0bkM4SFeb0YdLb+0aDTKGozUC82
+oBAilNcrFz1VXpEF0qUe9QeKQhyd0MaW5T1oSn+U3RAj2MXm3TGExyZeaicpIM5O
+HFlnwUxsYSDZo0jUj342MbPOZh8szZDWi042jdtSA3i8uMSplEf4O8ZPmX0JCtrz
+fVjRVdaKXIjrhMNWB8K44q6AeyhqJcVHtOmPYoHDm0qIjcrurt0LZaGhmCuKimNd
+njcPxW0VQmDIS/mO5+s24SK+Mpznm5q/clXEwyD8FbrtrzV5cHCE8eNkxjuQjkmi
+wW9uadK1s54tDwRWMl6DRWRyxoF0an885UQWmbsgEB5aRmEx2L0JeD0/q6Iw1Nta
+As8DG4AaWuYMrgZXz7XvyiMq3IxVAgMBAAGjNzA1MBQGA1UdEQQNMAuCCWxvY2Fs
+aG9zdDAdBgNVHQ4EFgQUl2wd7iWE1JTZUVq2yFBKGm9N36owDQYJKoZIhvcNAQEL
+BQADggGBAF0f5x6QXFbgdyLOyeAPD/1DDxNjM68fJSmNM/6vxHJeDFzK0Pja+iJo
+xv54YiS9F2tiKPpejk4ujvLQgvrYrTQvliIE+7fUT0dV74wZKPdLphftT9uEo1dH
+TeIld+549fqcfZCJfVPE2Ka4vfyMGij9hVfY5FoZL1Xpnq/ZGYyWZNAPbkG292p8
+KrfLZm/0fFYAhq8tG/6DX7+2btxeX4MP/49tzskcYWgOjlkknyhJ76aMG9BJ1D7F
+/TIEh5ihNwRTmyt023RBz/xWiN4xBLyIlpQ6d5ECKmFNFr0qnEui6UovfCHUF6lZ
+qcAQ5VFQQ2CayNlVmQ+UGmWIqANlacYWBt7Q6VqpGg24zTMec1/Pqd6X07ScSfrm
+MAtywrWrU7p1aEkN5lBa4n/XKZHGYMjor/YcMdF5yjdSrZr274YYO1pafmTFwRwH
+5o16c8WPc0aPvTFbkGIFT5ddxYstw+QwsBtLKE2lJ4Qfmxt0Ew/0L7xkbK1BaCOo
+EGD2IF7VDQ==
+-----END CERTIFICATE-----

Lib/test/certdata/keycert2.pem

@@ -0,0 +1,67 @@
+-----BEGIN PRIVATE KEY-----
+MIIG/gIBADANBgkqhkiG9w0BAQEFAASCBugwggbkAgEAAoIBgQCyAUXjczgUEn7m
+mOwDMi/++wDRxqJAJ2f7F9ADxTuOm+EtdpfYr4mBn8Uz9e3I+ZheG5y3QZ1ddBYA
+9YTfcUL0on8UXLOOBVZCetxsQXoSAuDMPV0IXeEgtZZDXe7STqKSQeYk7Cz+VtHe
+lZ8j7oOOcx5sJgpbaD+OGJnPoAdB8l8nQfxqAG45sW4P6gfLKoJLviKctDe5pvgi
+JC8tvytg/IhESKeefLZ4ix2dNjj2GNUaL+khU6UEuM1kJHcPVjPoYc+y8fop/qhQ
+0ithBhO2OvJ+YmOFdCE67SyCwU3p8zJpN+XkwbHttgmNg4OSs7H6V7E52/CsTNTA
+SthBHXtxqaM+vjbGARrz2Fpc/n+LwRt7MGIR0gVtntTgnP0HoeHskhAIeDtaPrZ6
+zHdl3aDwgAecVebTEBT5YPboz+X1lWdOrRD2JW3bqXSRIN3E4qz5IMuNx3VvhpSR
+eFZzR6QIbxQqzO/Vp93Ivy8hPZ6WMgfSYWs7CGtu4NP79PJfdMsCAwEAAQKCAYAc
+e3yp2NlbyNvaXRTCrCim5ZXrexuiJUwLjvNfbxNJDeM5iZThfLEFd0GwP0U1l86M
+HGH2pr6d4gHVVHPW5wIeL9Qit3SZoHv9djhH8DAuqpw6wgTdXlw0BipNjD23FBMK
+URYYyVuntM+vDITi1Hrjc8Ml7e5RUvx8aa5O3R3cLQKRvwq7EWeRvrTMQhfOJ/ai
+VQGnzmRuRevFVsHf0YuI4M+TEYcUooL2BdiOu8rggfezUYA9r2sjtshSok0UvKeb
+79pNzWmg9EWVeFk+A0HQpyLq+3EVyB5UZ3CZRkT0XhEm1B7mpKrtcGMjaumNAam7
+jkhidGdhT/PV9BB1TttcqwTf+JH9P9sSpY9ZTA1LkkeWe9Rwqpxjjssqxxl6Xnds
++wUfuovVvHuBinsO+5PLE5UQByn21WcIBNnPCAMvALy/68T7z8+ATJ+I2CqBXuM2
+z5663hNrvdCu93PpK4j/k/1l3NTrthaorbnPhkmNYHQkBicpAfFQywrv6enD+30C
+gcEA7Vlw76og4oxI7SSD6gTfo85OqTLp2CUZhNNxzYiUOOssRnGHBKsGZ8p0OhLN
+vk9/SgbeHL5jsmnyd8ZuYWmsOQHRWgg1zO3S25iuq+VAo4cL/7IynoJ0RP5xP0Pw
+QD+xJLZQp0XuLUtXnlc6dM5Hg7tOTthOP9UxA1i57lzpYfkRnKmSeWi+4IDJymOt
+WoWnEK7Yr7qSg6aScLWRyIvAPVmKF9LToSFaTq0eOD0GIwAQxqNbIwN3U0UJ5Ruc
+KRBVAoHBAL/+DNGqnEzhhWS6zqZp2eH90YR+b3R4yOK4PROm2AVA3h1GhIAiWX68
+PvKYZK9dZ9EdAswlFf9PVQYIXUraR3az0UiIywnNMri+kO1ZxwofGvljrOfRRLg0
+B46wuHi6dVgTWzjTl503G9+FpAYNHv184xsr1tne0pf2TKEnN7oyQciCV8qtr8vV
+HrL46uaD0w1fcXIXbO3F/7ErLsvsgLzKfxR5BeQo6Fq0GmzD+lCmzVNirtfl2CZj
+2ukROXUQnwKBwQDR1CqFlm/wGHk4PPnp31ke5XqhFoOpNFM1HAEV5VK0ZyQDOsZU
+mCXXiCHsXUdKodk0RpIB80cMKaHTxbc7o0JAO50q7OszOmUZAggZq1jTuMYgzRb3
+DvlfLVpMxfEVu7kNbagr2STRIjRZpV/md569lM+L4Kp8wCrOfJgTZExm8txhFYCK
+mNF2hCThKfHNfy7NDuY9pMF2ZcI8pig1lWbkVc5BdX7miifeOinnKfvM4XfzQ+OE
+NsI8+WHgC+KoYukCgcBwrOpdCmHchOZCbZfl9m1Wwh16QrGqi1BqLnI53EsfGijA
+yaftgzs+s7/FpEZC3PCWuw3vPTyhr69YcQQ/b8dNFM8YYJ+4SuMfpUds5Kl5eTPd
+dO/+xMQtzus4hOJeiB9h50o8GYH7VGJZVhcjLgQoBGlMgvf+uVSitnvWgCumbORK
+hqR7YF+xoov3wToquubcDE2KBdF54h/jnFJEf7I2GilmnHgmpRNoWBbCCmoXdy09
+aMbwEgY+0Y+iBOfRmkUCgcEAoHJLw7VnZQGQQL4l3lnoGU9o06RPkNbpda9G/Ptz
+v+K7DXmHiLFVDszvZaPVreohuc0tKdrT0cZpZ21h0GQD4B6JX66R/y6CCAr0QpdA
+pFZO9sc5ky6RJ4xZCoCsNJzORNUb36cagEzBWExb7Jz2v6gNa044K5bs3CVv5h15
+rJtTxZNn/gcnIk+gt//67WUnKLS4PR5PVCCqYhSbhFwx/OvVTJmflIBUinAclf2Q
+M4mhHOfwBicqYzzEYbOE9Vk9
+-----END PRIVATE KEY-----
+-----BEGIN CERTIFICATE-----
+MIIEjDCCAvSgAwIBAgIUQ2S3jJ5nve5k5956sgsrWY3vw9MwDQYJKoZIhvcNAQEL
+BQAwYjELMAkGA1UEBhMCWFkxFzAVBgNVBAcMDkNhc3RsZSBBbnRocmF4MSMwIQYD
+VQQKDBpQeXRob24gU29mdHdhcmUgRm91bmRhdGlvbjEVMBMGA1UEAwwMZmFrZWhv
+c3RuYW1lMB4XDTIzMTEyNTA0MjEzN1oXDTQzMDEyNDA0MjEzN1owYjELMAkGA1UE
+BhMCWFkxFzAVBgNVBAcMDkNhc3RsZSBBbnRocmF4MSMwIQYDVQQKDBpQeXRob24g
+U29mdHdhcmUgRm91bmRhdGlvbjEVMBMGA1UEAwwMZmFrZWhvc3RuYW1lMIIBojAN
+BgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAsgFF43M4FBJ+5pjsAzIv/vsA0cai
+QCdn+xfQA8U7jpvhLXaX2K+JgZ/FM/XtyPmYXhuct0GdXXQWAPWE33FC9KJ/FFyz
+jgVWQnrcbEF6EgLgzD1dCF3hILWWQ13u0k6ikkHmJOws/lbR3pWfI+6DjnMebCYK
+W2g/jhiZz6AHQfJfJ0H8agBuObFuD+oHyyqCS74inLQ3uab4IiQvLb8rYPyIREin
+nny2eIsdnTY49hjVGi/pIVOlBLjNZCR3D1Yz6GHPsvH6Kf6oUNIrYQYTtjryfmJj
+hXQhOu0sgsFN6fMyaTfl5MGx7bYJjYODkrOx+lexOdvwrEzUwErYQR17camjPr42
+xgEa89haXP5/i8EbezBiEdIFbZ7U4Jz9B6Hh7JIQCHg7Wj62esx3Zd2g8IAHnFXm
+0xAU+WD26M/l9ZVnTq0Q9iVt26l0kSDdxOKs+SDLjcd1b4aUkXhWc0ekCG8UKszv
+1afdyL8vIT2eljIH0mFrOwhrbuDT+/TyX3TLAgMBAAGjOjA4MBcGA1UdEQQQMA6C
+DGZha2Vob3N0bmFtZTAdBgNVHQ4EFgQU5wVOIuQD/Jxmam/97g91+igosWQwDQYJ
+KoZIhvcNAQELBQADggGBAFv5gW5x4ET5NXEw6vILlOtwxwplEbU/x6eUVR/AXtEz
+jtq9zIk2svX/JIzSLRQnjJmb/nCDCeNcFMkkgIiB64I3yMJT9n50fO4EhSGEaITZ
+vYAw0/U6QXw+B1VS1ijNA44X2zvC+aw1q9W+0SKtvnu7l16TQ654ey0Qh9hOF1HS
+AZQ46593T9gaZMeexz4CShoBZ80oFOJezfNhyT3FK6tzXNbkVoJDhlLvr/ep81GG
+mABUGtKQYYMhuSSp0TDvf7jnXxtQcZI5lQOxZp0fnWUcK4gMVJqFVicwY8NiOhAG
+6TlvXYP4COLAvGmqBB+xUhekIS0jVzaMyek+hKK0sT/OE+W/fR5V9YT5QlHFJCf5
+IUIfDCpBZrBpsOTwsUm8eL0krLiBjYf0HgH5oFBc7aF4w1kuUJjlsJ68bzO9mLEF
+HXDaOWbe00+7BMMDnyuEyLN8KaAGiN8x0NQRX+nTAjCdPs6E0NftcXtznWBID6tA
+j5m7qjsoGurj6TlDsBJb1A==
+-----END CERTIFICATE-----

Lib/test/certdata/keycert3.pem

@@ -0,0 +1,161 @@
+-----BEGIN PRIVATE KEY-----
+MIIG/gIBADANBgkqhkiG9w0BAQEFAASCBugwggbkAgEAAoIBgQCgKihxC+2g7d7M
+JfIUBfFWiuMwxg0WhdxPyGUzMAjexbEOHo0ojntxPdH9KYRwiKRKb9jnmzXp2CKT
+hqBYJIetq/3LYZp4bvDJ/hVCL9e4jqu1l+wd9DkqhKZ69b6C1/d12JAKvC5TIT+/
+b7EglYU8KMNx2WO5KxIJeVpX68jn49YtUzg0hT0QiXj4eugbDk1L1f99xgvkHaVW
+VQxi6MFNWHJq/xXUb8E/hd/Q3oadN1BXMWl9P46D4R+YGKQQdZFkwEJsbqijFvWW
+bOoaz7TFxf8n0q616803aXLfaWikfEXLnznEvKo7vyEivtT/y14Nm+SiR3nS6E0y
+Dt8gmeHdaHcrmQT+yQ6yNOYDCcfeYM+rBuvOUHPudjMy0k8K/0IPjDo0KActKPH0
+UVbyDBMKDdGQ2+LhRFLsGXHlD9b05PxhqTULe3LeK6KZ+iuGbWtwVLaL5S42WiCA
+YXNShE1Ko0Q7wugAippXCf+aWP3Wx9ZTrsfiDBbIfnY5mlfdG90CAwEAAQKCAYAA
+ogoE4FoxD5+YyPGa+KcKg4QAVlgI5cCIJC+aMy9lyfw4JRDDv0RnnynsSTS3ySJ1
+FNoTmD5vTSZd1ONfVc2fdxWKrzkQDsgu1C07VLsShKXTEuWg/K0ZKOsLg1scY0Qc
+GB4BnNrGA1SgKg3WJiEfqr2S/pvxSGVK2krsHAdwOytGhJStSHWEUjbDLKEsMjNG
+AHOBCL5VSXS00aM55NeWuanCGH36l/J4kMvgpHB9wJE1twFGuHCUvtgEHtzPH9fQ
+plmI0QDREm6UE6Qh01lxmwx3Xc5ASBURmxs+bxpk94BPRpj8/eF2HPiJalrkJksj
+Xk3QQ7k23v6XnmHKV3QqpjUgJTdbuMoTrVMu14cIH6FtXfwVhtthPnCI8rk5Lh8N
+cqLC7HT+NE1JyygzuMToOHMmSJTQ8L6BTIaRCZjvGTPYaZfFgeMHvvhAJtP5zAcc
+xQzyCyNBU8RdPGT8tJTyDUIRs20poqe7dKrPEIocKJX7tvNSI2QxkQ96Adxo1gEC
+gcEAvI8m6QCDGgDWI8yTH9EvZQwq+tF8I+WMC+jbPuDwKg5ZKC7VjRO//9JzPY+c
+TxmLnQu64OkECHbu7pswDBbtnPMbodF9inYEY5RkfufEjEMJGEdkoBJWnNx78EkV
+bcffWik0wXwdt6jd1CAnjmS9qaPz0T1NV8m5rQQn5JUYXlC9eB2kOojZYLbZBl3g
+xUSRbIqHC7h8HuyAU26EPiprHsIxrOpbxABFOdvo2optr50U7X10Eqb4mRQ4z22W
+ojJdAoHBANlzJjjEgGVB9W50pJqkTw8wXiTUG8AmhqrVvqEttLPcWpK6QwRkRC+i
+5N1iUObf/kOlun2gNfHF6gM68Ja9wb2eGvE5sApq9hPpyYF0LS3g8BbJ9GOs6NU9
+BfM1CkPrDCdc4kzlUpDibvc6Fc9raCqvrZRlKEukqQS8dumVdb74IaPsP6q8sZMz
+jibOk0eUrbx2c5vEnd0W8zMeNCuCwO1oXbfenPp/GLX9ZRlolWS/3cQoZYOSQc9J
+lFQYkxL3gQKBwQCy3Pwk9AZoqTh4dvtsqArUSImQqRygFIQXXAh1ifxneHrcYijS
+jVSIwEHuuIamhe3oyBK6fG8F9IPLtUwLe8hkJDwm8Misiiy5pS77LrFD9+btr/Nk
+4GBmpcOveDQqkflt1j6j9y9dY4MhUGsVaLx86fhDmGoAh2tpEtMgwsl91gsUoNGD
+cQL6+he+MVkg510nX/Sgipy63M8R1Xj+W1CHueBTTXBE6ZjBPLiSbdOETXZnnaR4
+eQjCdOs64JKOQ0UCgcBZ4kFAYel48aTT/Z801QphCus/afX2nXY5E5Vy5oO1fTZr
+RFcDb7bHwhu8bzFl3d0qdUz7NMhXoimzIB/nD5UQHlSgtenQxJnnbVIAEtfCCSL1
+KJG+yfCMhGb7O0d8/6HMe5aHlptkjFS2GOp/DLTIQEoN9yqK6gt7i7PTphY/1C2D
+ptpCZzE32a2+2NEEW67dIlFzZ/ihNSVeUfPasHezKtricECPQw4h3BZ4RETMmoq+
+1LvxgPl3B8EqaeYRhwECgcEAjjp/0hu/ukQhiNeR5a9p1ECBFP8qFh6Cpo0Az/DT
+1kX0qU8tnT3cYYhwbVGwLxn2HVRdLrbjMj/t88W/LM2IaQ162m7TvvBMxNmr058y
+sW/LADp5YWWsY70EJ8AfaTmdQriqKsNiLLpNdgcm1bkwHJ1CNlvEpDs1OOI3cCGi
+BEuUmeKxpRhwCaZeaR5tREmbD70My+BMDTDLfrXoKqzl4JrRua4jFTpHeZaFdkkh
+gDq3K6+KpVREQFEhyOtIB2kk
+-----END PRIVATE KEY-----
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            cb:2d:80:99:5a:69:52:5c
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=XY, O=Python Software Foundation CA, CN=our-ca-server
+        Validity
+            Not Before: Aug 29 14:23:16 2018 GMT
+            Not After : Oct 28 14:23:16 2037 GMT
+        Subject: C=XY, L=Castle Anthrax, O=Python Software Foundation, CN=localhost
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (3072 bit)
+                Modulus:
+                    00:a0:2a:28:71:0b:ed:a0:ed:de:cc:25:f2:14:05:
+                    f1:56:8a:e3:30:c6:0d:16:85:dc:4f:c8:65:33:30:
+                    08:de:c5:b1:0e:1e:8d:28:8e:7b:71:3d:d1:fd:29:
+                    84:70:88:a4:4a:6f:d8:e7:9b:35:e9:d8:22:93:86:
+                    a0:58:24:87:ad:ab:fd:cb:61:9a:78:6e:f0:c9:fe:
+                    15:42:2f:d7:b8:8e:ab:b5:97:ec:1d:f4:39:2a:84:
+                    a6:7a:f5:be:82:d7:f7:75:d8:90:0a:bc:2e:53:21:
+                    3f:bf:6f:b1:20:95:85:3c:28:c3:71:d9:63:b9:2b:
+                    12:09:79:5a:57:eb:c8:e7:e3:d6:2d:53:38:34:85:
+                    3d:10:89:78:f8:7a:e8:1b:0e:4d:4b:d5:ff:7d:c6:
+                    0b:e4:1d:a5:56:55:0c:62:e8:c1:4d:58:72:6a:ff:
+                    15:d4:6f:c1:3f:85:df:d0:de:86:9d:37:50:57:31:
+                    69:7d:3f:8e:83:e1:1f:98:18:a4:10:75:91:64:c0:
+                    42:6c:6e:a8:a3:16:f5:96:6c:ea:1a:cf:b4:c5:c5:
+                    ff:27:d2:ae:b5:eb:cd:37:69:72:df:69:68:a4:7c:
+                    45:cb:9f:39:c4:bc:aa:3b:bf:21:22:be:d4:ff:cb:
+                    5e:0d:9b:e4:a2:47:79:d2:e8:4d:32:0e:df:20:99:
+                    e1:dd:68:77:2b:99:04:fe:c9:0e:b2:34:e6:03:09:
+                    c7:de:60:cf:ab:06:eb:ce:50:73:ee:76:33:32:d2:
+                    4f:0a:ff:42:0f:8c:3a:34:28:07:2d:28:f1:f4:51:
+                    56:f2:0c:13:0a:0d:d1:90:db:e2:e1:44:52:ec:19:
+                    71:e5:0f:d6:f4:e4:fc:61:a9:35:0b:7b:72:de:2b:
+                    a2:99:fa:2b:86:6d:6b:70:54:b6:8b:e5:2e:36:5a:
+                    20:80:61:73:52:84:4d:4a:a3:44:3b:c2:e8:00:8a:
+                    9a:57:09:ff:9a:58:fd:d6:c7:d6:53:ae:c7:e2:0c:
+                    16:c8:7e:76:39:9a:57:dd:1b:dd
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Alternative Name: 
+                DNS:localhost
+            X509v3 Key Usage: critical
+                Digital Signature, Key Encipherment
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, TLS Web Client Authentication
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            X509v3 Subject Key Identifier: 
+                3F:B1:E9:4F:A0:BE:30:66:3E:0A:18:C8:0F:47:1A:4F:34:6A:0F:42
+            X509v3 Authority Key Identifier: 
+                keyid:F3:EC:94:8E:F2:8E:30:C4:8E:68:C2:BF:8E:6A:19:C0:C1:9F:76:65
+                DirName:/C=XY/O=Python Software Foundation CA/CN=our-ca-server
+                serial:CB:2D:80:99:5A:69:52:5B
+            Authority Information Access: 
+                CA Issuers - URI:http://testca.pythontest.net/testca/pycacert.cer
+                OCSP - URI:http://testca.pythontest.net/testca/ocsp/
+            X509v3 CRL Distribution Points: 
+                Full Name:
+                  URI:http://testca.pythontest.net/testca/revocation.crl
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        ca:34:ba:c5:d0:cf:27:31:32:d6:0d:27:30:b8:db:17:df:b7:
+        39:a7:bb:b1:3b:86:c4:31:fd:fb:ab:db:63:1a:cc:90:ab:b9:
+        4e:ab:34:49:0c:5e:8c:3e:70:a3:a7:6b:2f:a7:9a:25:7b:01:
+        5a:18:96:48:76:f8:36:78:74:fa:bc:7d:68:7f:e5:ca:a6:9d:
+        7b:dc:72:bd:a3:25:51:17:68:e8:e9:d7:02:86:2c:7d:16:7c:
+        b5:dc:44:b2:0a:e3:f7:c9:33:a3:51:36:83:bc:d4:70:cd:84:
+        91:9f:06:ba:2d:d2:05:0a:65:c3:d9:55:09:a8:b8:09:69:bb:
+        93:86:c2:b7:c2:90:74:7c:bf:f0:5d:bc:0e:63:13:8c:eb:fa:
+        0f:f1:fa:e5:12:70:4d:0c:eb:8c:2e:a2:42:42:00:04:0f:fc:
+        f9:1f:41:9c:63:78:f0:66:93:b2:8f:2e:e8:93:1c:50:cb:2d:
+        7f:b6:ba:57:6f:52:62:d7:39:0b:09:82:ab:a6:53:4d:cc:05:
+        3e:19:f0:d4:c0:ce:a9:ad:10:ce:b9:71:e4:8f:f2:5a:3c:65:
+        ba:dc:cb:e0:04:90:2b:a5:15:a6:7d:da:dc:a3:b5:b7:bc:a0:
+        de:30:4e:64:cb:17:0d:3a:a0:52:d2:67:3b:a2:3a:00:d5:39:
+        aa:61:75:52:9f:fe:9b:c0:e8:a0:69:af:a8:b3:a3:1d:0a:40:
+        52:04:e7:3d:c0:00:96:5f:2b:33:06:0c:30:f6:d3:18:72:ee:
+        38:d0:64:d3:00:86:37:ec:4f:e9:38:49:e6:01:ff:a2:9a:7c:
+        dc:6a:d3:cb:a8:ba:58:fb:c3:86:78:47:f1:06:a6:45:e7:53:
+        de:99:1d:81:e6:bc:63:74:46:7c:70:23:57:29:60:70:9a:cc:
+        6f:00:8e:c2:bf:6a:73:7d:6e:b0:62:e6:dc:13:1a:b9:fe:0f:
+        c2:d1:06:a1:79:62:7f:b6:30:a9:03:d0:47:57:25:db:48:10:
+        d1:cf:fb:7d:ac:3d
+-----BEGIN CERTIFICATE-----
+MIIF8TCCBFmgAwIBAgIJAMstgJlaaVJcMA0GCSqGSIb3DQEBCwUAME0xCzAJBgNV
+BAYTAlhZMSYwJAYDVQQKDB1QeXRob24gU29mdHdhcmUgRm91bmRhdGlvbiBDQTEW
+MBQGA1UEAwwNb3VyLWNhLXNlcnZlcjAeFw0xODA4MjkxNDIzMTZaFw0zNzEwMjgx
+NDIzMTZaMF8xCzAJBgNVBAYTAlhZMRcwFQYDVQQHDA5DYXN0bGUgQW50aHJheDEj
+MCEGA1UECgwaUHl0aG9uIFNvZnR3YXJlIEZvdW5kYXRpb24xEjAQBgNVBAMMCWxv
+Y2FsaG9zdDCCAaIwDQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGBAKAqKHEL7aDt
+3swl8hQF8VaK4zDGDRaF3E/IZTMwCN7FsQ4ejSiOe3E90f0phHCIpEpv2OebNenY
+IpOGoFgkh62r/cthmnhu8Mn+FUIv17iOq7WX7B30OSqEpnr1voLX93XYkAq8LlMh
+P79vsSCVhTwow3HZY7krEgl5WlfryOfj1i1TODSFPRCJePh66BsOTUvV/33GC+Qd
+pVZVDGLowU1Ycmr/FdRvwT+F39Dehp03UFcxaX0/joPhH5gYpBB1kWTAQmxuqKMW
+9ZZs6hrPtMXF/yfSrrXrzTdpct9paKR8RcufOcS8qju/ISK+1P/LXg2b5KJHedLo
+TTIO3yCZ4d1odyuZBP7JDrI05gMJx95gz6sG685Qc+52MzLSTwr/Qg+MOjQoBy0o
+8fRRVvIMEwoN0ZDb4uFEUuwZceUP1vTk/GGpNQt7ct4ropn6K4Zta3BUtovlLjZa
+IIBhc1KETUqjRDvC6ACKmlcJ/5pY/dbH1lOux+IMFsh+djmaV90b3QIDAQABo4IB
+wDCCAbwwFAYDVR0RBA0wC4IJbG9jYWxob3N0MA4GA1UdDwEB/wQEAwIFoDAdBgNV
+HSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDAYDVR0TAQH/BAIwADAdBgNVHQ4E
+FgQUP7HpT6C+MGY+ChjID0caTzRqD0IwfQYDVR0jBHYwdIAU8+yUjvKOMMSOaMK/
+jmoZwMGfdmWhUaRPME0xCzAJBgNVBAYTAlhZMSYwJAYDVQQKDB1QeXRob24gU29m
+dHdhcmUgRm91bmRhdGlvbiBDQTEWMBQGA1UEAwwNb3VyLWNhLXNlcnZlcoIJAMst
+gJlaaVJbMIGDBggrBgEFBQcBAQR3MHUwPAYIKwYBBQUHMAKGMGh0dHA6Ly90ZXN0
+Y2EucHl0aG9udGVzdC5uZXQvdGVzdGNhL3B5Y2FjZXJ0LmNlcjA1BggrBgEFBQcw
+AYYpaHR0cDovL3Rlc3RjYS5weXRob250ZXN0Lm5ldC90ZXN0Y2Evb2NzcC8wQwYD
+VR0fBDwwOjA4oDagNIYyaHR0cDovL3Rlc3RjYS5weXRob250ZXN0Lm5ldC90ZXN0
+Y2EvcmV2b2NhdGlvbi5jcmwwDQYJKoZIhvcNAQELBQADggGBAMo0usXQzycxMtYN
+JzC42xfftzmnu7E7hsQx/fur22MazJCruU6rNEkMXow+cKOnay+nmiV7AVoYlkh2
++DZ4dPq8fWh/5cqmnXvccr2jJVEXaOjp1wKGLH0WfLXcRLIK4/fJM6NRNoO81HDN
+hJGfBrot0gUKZcPZVQmouAlpu5OGwrfCkHR8v/BdvA5jE4zr+g/x+uUScE0M64wu
+okJCAAQP/PkfQZxjePBmk7KPLuiTHFDLLX+2uldvUmLXOQsJgqumU03MBT4Z8NTA
+zqmtEM65ceSP8lo8Zbrcy+AEkCulFaZ92tyjtbe8oN4wTmTLFw06oFLSZzuiOgDV
+OaphdVKf/pvA6KBpr6izox0KQFIE5z3AAJZfKzMGDDD20xhy7jjQZNMAhjfsT+k4
+SeYB/6KafNxq08uoulj7w4Z4R/EGpkXnU96ZHYHmvGN0RnxwI1cpYHCazG8AjsK/
+anN9brBi5twTGrn+D8LRBqF5Yn+2MKkD0EdXJdtIENHP+32sPQ==
+-----END CERTIFICATE-----

Lib/test/certdata/keycert4.pem

@@ -0,0 +1,161 @@
+-----BEGIN PRIVATE KEY-----
+MIIG/QIBADANBgkqhkiG9w0BAQEFAASCBucwggbjAgEAAoIBgQDGKA1zZDjeNPh2
+J9WHVXXMUf8h5N4/bHCM3CbIaZ1dShkCgfmFWmOtruEihgbfRYaSWZAwCmVAQGjm
+gvUfgOIgsFfM8yO+zDByPhza7XvWPZfEe7mNRFe5ZlYntbeM/vuWCM4VzwDq/mqF
+TFxNRmwInqE7hx0WnfCoQWe9N41hJyl1K0OjADb+SjlpJ0/UJ63hsB+dowGjaaBv
+J8HduQcRqNg8s6FcyJJ8Mjss1uRMFK2j9QrmgbA61XuIPCxzc3J57mW8FN2KsR8D
+2HOhe9nsTGlxp+O5Cudf/RBWB443xcoyduwRXOFTdEAU45MS4tKGP2hzezuxMFQn
+LKARXVW4/gFxZk7kU8TweZUS6LAYPfYJnlfteb6z37LAbtoDvzKUKBEDf/nmoa7C
+uKxSPC5HIKhLbjU/6kuPglSVEfJPJWu2bZJDAkFL85Ot3gPs10EX2lMUy0Jt3tf+
+TaQjEvFZhpKN8KAdYj3eVgOfzIBbQyjotHJjFe9Jkq4q7RoI+ncCAwEAAQKCAYAH
+tRsdRh1Z7JmHOasy+tPDsvhVuWLHMaYlScvAYhJh/W65YSKd56+zFKINlX3fYcp5
+Fz67Yy+uWahXVE2QgFou3KX0u+9ucRiLFXfYheWL3xSMXJgRee0LI/T7tRe7uAHu
+CnoURqKCulIqzLOO1efx1eKasXmVuhEtmjhVpcmDGv8SChSKTIjzgOjqT7QGE9Xq
+eSRhq7mulpq9zWq+/369yG+0SvPs60vTxNovDIaBn/RHSW5FjeDss5QnmYMh/ukN
+dggoKllQlkTzHSxHmKrIJuryZC+bsqvEPUFXN0NMUYcZRvt1lwdjzq/A+w4gDDZG
+7QqAzYMYQZMw9PJeHqu4mxfUX5hJWuAwG5I2eV3kBRheoFw7MxP0tw40fPlFU+Zh
+pRXbKwhMAlIHi0D8NyMn3hkVPyToWVVY3vHRknBB/52RqRq3MjqEFaAZfp0nFkiF
+ytv3Dd5aeBb1vraOIREyhxIxE/qY8CtZC+6JI8CpufLmFXB412WPwl0OrVpWYfEC
+gcEA486zOI46xRDgDw0jqTpOFHzh+3VZ8UoPoiqCjKzJGnrh2EeLvTsXX/GZOj0m
+5zl6RHEGFjm5vKCh2C72Vj/m+AFVy7V9iJRzTYzP8So/3paaqo7ZaROTa6uStxdD
+VPnY1uIgVQz9w5coN4dmr+RLBpFvvWaHp1wuC08YIWxcC9HSTQpbi1EP5eo08fOk
+8reNkDEHxihDGHr1xW0z0qJqK1IVyLP7wDkmapudMZjkjqJSGJwwefV4qyGMTV2b
+suW1AoHBAN6t9n6LBH553MF5iUrNJYxXh/SCom4Zft9aD6W4bZV/xL4XPpKBB4HX
+aWdeI0iYZU9U+CZ88tBoQCt+JMrJ9cz03ENOvA/MBMREwbZ2hKmQgnoDZsV0vNry
+6UsxeQmeNpGQFUz9foVJQVRdQCceN2YEABdehV1HZoSBbuGZkzqGJXrWwaf/ZhpB
+dPYGUGOsczoD2/QLuWy2M7f7v0Ews6Heww3zipWzvdxKE0IpyVs30ZwVi8CRQiWU
+bEcleXP6+wKBwAi3xEwJxV39Q1XQHuk+/fXywYMp/oMpXmfKUKypgBivUy0/r61S
+MZbOXBrKdE6s+GzeFmmLU/xP+WGYinzKfUBIbMwa6e7sH218UgjcoQ0Xnlugk9ld
+kmqwajDvhvgdh5rRlIMsuBlgE33shJV+mxBpSGlrHw3cjTaJlFbTGsKpCO9B0jcG
+pyEZUWVg+ZMASz6VYcLHj6nEKtufTjhlVsLJpWPE34F/rmSuB9n6C+UZeSLP91rz
+dea2pfPf/TFfcQKBwF4DSj9Qx/vxzS7t9fXbuM+QoPitMpCTOQppRpPr0nA8uj6b
+J7LIwPejj3+xsenTVWpx8DanqAgvC3CRWE05iQoYEupj0mhE9Xo7oSE81nOUbFHB
+H+GbkKRLzA0P/Q7/egBouWWA3Kq/K9LHb+9UBYWPiM5U/K9OFs04rCyZHxylSCud
+gbNA08Wf/xZjwgri4t8KhBF75bQtFJbHtY57Vkuv9d/tA4SCl1Tq/UiAxd86KMfi
+HNeXPDsLd89t1eIOgwKBwQDJkqwZXkhwkhoNuHRdzPO/1f5FyKpQxFs+x+OBulzG
+zuwVKIawsLlUR4TBtF7PChOSZSH50VZaBI5kVti79kEtfNjfAzg4kleHrY8jQ/eq
+HludZ3nmiPqqlbH4MH8NWczPEjee6z4ODROsAe31pz3S8YQK7KVoEuSf0+usJ894
+FtzS5wl6POAXTo2QeSNg9zTbb6JjVYcq6KCTnflDm4YEvFKI+ARqAXQHxm05wEOe
+DbKC6hxxQbDaNOvXEAda8wU=
+-----END PRIVATE KEY-----
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            cb:2d:80:99:5a:69:52:5d
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=XY, O=Python Software Foundation CA, CN=our-ca-server
+        Validity
+            Not Before: Aug 29 14:23:16 2018 GMT
+            Not After : Oct 28 14:23:16 2037 GMT
+        Subject: C=XY, L=Castle Anthrax, O=Python Software Foundation, CN=fakehostname
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (3072 bit)
+                Modulus:
+                    00:c6:28:0d:73:64:38:de:34:f8:76:27:d5:87:55:
+                    75:cc:51:ff:21:e4:de:3f:6c:70:8c:dc:26:c8:69:
+                    9d:5d:4a:19:02:81:f9:85:5a:63:ad:ae:e1:22:86:
+                    06:df:45:86:92:59:90:30:0a:65:40:40:68:e6:82:
+                    f5:1f:80:e2:20:b0:57:cc:f3:23:be:cc:30:72:3e:
+                    1c:da:ed:7b:d6:3d:97:c4:7b:b9:8d:44:57:b9:66:
+                    56:27:b5:b7:8c:fe:fb:96:08:ce:15:cf:00:ea:fe:
+                    6a:85:4c:5c:4d:46:6c:08:9e:a1:3b:87:1d:16:9d:
+                    f0:a8:41:67:bd:37:8d:61:27:29:75:2b:43:a3:00:
+                    36:fe:4a:39:69:27:4f:d4:27:ad:e1:b0:1f:9d:a3:
+                    01:a3:69:a0:6f:27:c1:dd:b9:07:11:a8:d8:3c:b3:
+                    a1:5c:c8:92:7c:32:3b:2c:d6:e4:4c:14:ad:a3:f5:
+                    0a:e6:81:b0:3a:d5:7b:88:3c:2c:73:73:72:79:ee:
+                    65:bc:14:dd:8a:b1:1f:03:d8:73:a1:7b:d9:ec:4c:
+                    69:71:a7:e3:b9:0a:e7:5f:fd:10:56:07:8e:37:c5:
+                    ca:32:76:ec:11:5c:e1:53:74:40:14:e3:93:12:e2:
+                    d2:86:3f:68:73:7b:3b:b1:30:54:27:2c:a0:11:5d:
+                    55:b8:fe:01:71:66:4e:e4:53:c4:f0:79:95:12:e8:
+                    b0:18:3d:f6:09:9e:57:ed:79:be:b3:df:b2:c0:6e:
+                    da:03:bf:32:94:28:11:03:7f:f9:e6:a1:ae:c2:b8:
+                    ac:52:3c:2e:47:20:a8:4b:6e:35:3f:ea:4b:8f:82:
+                    54:95:11:f2:4f:25:6b:b6:6d:92:43:02:41:4b:f3:
+                    93:ad:de:03:ec:d7:41:17:da:53:14:cb:42:6d:de:
+                    d7:fe:4d:a4:23:12:f1:59:86:92:8d:f0:a0:1d:62:
+                    3d:de:56:03:9f:cc:80:5b:43:28:e8:b4:72:63:15:
+                    ef:49:92:ae:2a:ed:1a:08:fa:77
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Alternative Name: 
+                DNS:fakehostname
+            X509v3 Key Usage: critical
+                Digital Signature, Key Encipherment
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, TLS Web Client Authentication
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            X509v3 Subject Key Identifier: 
+                1C:70:14:B0:20:DD:08:76:A4:3B:56:59:FA:5F:34:F8:36:66:E8:56
+            X509v3 Authority Key Identifier: 
+                keyid:F3:EC:94:8E:F2:8E:30:C4:8E:68:C2:BF:8E:6A:19:C0:C1:9F:76:65
+                DirName:/C=XY/O=Python Software Foundation CA/CN=our-ca-server
+                serial:CB:2D:80:99:5A:69:52:5B
+            Authority Information Access: 
+                CA Issuers - URI:http://testca.pythontest.net/testca/pycacert.cer
+                OCSP - URI:http://testca.pythontest.net/testca/ocsp/
+            X509v3 CRL Distribution Points: 
+                Full Name:
+                  URI:http://testca.pythontest.net/testca/revocation.crl
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        75:14:e5:68:45:8d:ed:6c:f1:27:1e:0e:f3:35:ae:0e:60:c1:
+        65:36:62:b8:07:78:e1:b9:8d:7a:50:70:af:06:c9:d4:ee:50:
+        ef:d2:76:b2:a2:b6:cb:dc:a6:18:b5:3d:d2:f7:eb:0e:ec:b7:
+        95:cd:2e:b1:36:6f:a8:9f:b8:4d:ff:ce:8a:c4:8e:62:37:32:
+        80:3e:05:4a:4d:39:87:69:09:00:e8:40:64:d2:9d:f9:1f:9f:
+        ab:67:1f:f9:c6:84:ba:7e:17:6c:8b:8d:08:ee:fb:8a:d7:cd:
+        06:25:72:9f:4e:1a:c2:71:e1:1b:cf:a2:d7:1c:05:12:95:d6:
+        49:4b:e9:95:95:89:cf:68:18:46:a3:ea:0d:9d:8e:ca:1c:28:
+        55:49:6b:c0:4b:58:f5:42:b9:0a:ec:0e:6e:21:a4:ff:60:c0:
+        1b:6e:40:72:d0:a5:c5:b5:db:4e:87:67:3a:31:70:cb:32:84:
+        70:a9:e2:ff:e0:f2:db:cd:03:b4:85:45:d3:07:cc:0f:c7:49:
+        d8:c2:17:eb:73:f7:4a:c0:d9:8c:59:ef:c0:0a:ce:13:0b:84:
+        c9:aa:0d:11:14:b4:e5:74:aa:ec:18:de:5f:26:18:98:4a:76:
+        f0:7f:cd:e6:c4:b5:58:03:03:f5:10:01:5d:8f:63:88:ba:65:
+        d7:b4:7f:5a:1a:51:0e:ed:e5:68:fa:18:03:72:15:a1:ec:27:
+        1f:ea:ac:24:46:18:6e:f1:97:db:4a:f4:d6:a1:91:a0:8c:b0:
+        2f:be:87:3b:44:b0:8d:2a:89:85:5f:f2:d9:e3:2e:66:b2:88:
+        98:04:2c:96:32:38:99:19:a9:83:fd:94:0c:dd:63:d4:1b:60:
+        9d:43:98:35:ac:b4:23:38:de:7f:85:52:57:a0:37:df:a5:cf:
+        be:54:2c:3c:50:27:2b:d4:54:a9:9d:a3:d4:a5:b3:c0:ea:3d:
+        0e:e2:70:6b:fb:cb:a5:56:05:ec:64:72:f0:1a:db:64:01:cb:
+        5d:27:c4:a1:c4:63
+-----BEGIN CERTIFICATE-----
+MIIF9zCCBF+gAwIBAgIJAMstgJlaaVJdMA0GCSqGSIb3DQEBCwUAME0xCzAJBgNV
+BAYTAlhZMSYwJAYDVQQKDB1QeXRob24gU29mdHdhcmUgRm91bmRhdGlvbiBDQTEW
+MBQGA1UEAwwNb3VyLWNhLXNlcnZlcjAeFw0xODA4MjkxNDIzMTZaFw0zNzEwMjgx
+NDIzMTZaMGIxCzAJBgNVBAYTAlhZMRcwFQYDVQQHDA5DYXN0bGUgQW50aHJheDEj
+MCEGA1UECgwaUHl0aG9uIFNvZnR3YXJlIEZvdW5kYXRpb24xFTATBgNVBAMMDGZh
+a2Vob3N0bmFtZTCCAaIwDQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGBAMYoDXNk
+ON40+HYn1YdVdcxR/yHk3j9scIzcJshpnV1KGQKB+YVaY62u4SKGBt9FhpJZkDAK
+ZUBAaOaC9R+A4iCwV8zzI77MMHI+HNrte9Y9l8R7uY1EV7lmVie1t4z++5YIzhXP
+AOr+aoVMXE1GbAieoTuHHRad8KhBZ703jWEnKXUrQ6MANv5KOWknT9QnreGwH52j
+AaNpoG8nwd25BxGo2DyzoVzIknwyOyzW5EwUraP1CuaBsDrVe4g8LHNzcnnuZbwU
+3YqxHwPYc6F72exMaXGn47kK51/9EFYHjjfFyjJ27BFc4VN0QBTjkxLi0oY/aHN7
+O7EwVCcsoBFdVbj+AXFmTuRTxPB5lRLosBg99gmeV+15vrPfssBu2gO/MpQoEQN/
++eahrsK4rFI8LkcgqEtuNT/qS4+CVJUR8k8la7ZtkkMCQUvzk63eA+zXQRfaUxTL
+Qm3e1/5NpCMS8VmGko3woB1iPd5WA5/MgFtDKOi0cmMV70mSrirtGgj6dwIDAQAB
+o4IBwzCCAb8wFwYDVR0RBBAwDoIMZmFrZWhvc3RuYW1lMA4GA1UdDwEB/wQEAwIF
+oDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDAYDVR0TAQH/BAIwADAd
+BgNVHQ4EFgQUHHAUsCDdCHakO1ZZ+l80+DZm6FYwfQYDVR0jBHYwdIAU8+yUjvKO
+MMSOaMK/jmoZwMGfdmWhUaRPME0xCzAJBgNVBAYTAlhZMSYwJAYDVQQKDB1QeXRo
+b24gU29mdHdhcmUgRm91bmRhdGlvbiBDQTEWMBQGA1UEAwwNb3VyLWNhLXNlcnZl
+coIJAMstgJlaaVJbMIGDBggrBgEFBQcBAQR3MHUwPAYIKwYBBQUHMAKGMGh0dHA6
+Ly90ZXN0Y2EucHl0aG9udGVzdC5uZXQvdGVzdGNhL3B5Y2FjZXJ0LmNlcjA1Bggr
+BgEFBQcwAYYpaHR0cDovL3Rlc3RjYS5weXRob250ZXN0Lm5ldC90ZXN0Y2Evb2Nz
+cC8wQwYDVR0fBDwwOjA4oDagNIYyaHR0cDovL3Rlc3RjYS5weXRob250ZXN0Lm5l
+dC90ZXN0Y2EvcmV2b2NhdGlvbi5jcmwwDQYJKoZIhvcNAQELBQADggGBAHUU5WhF
+je1s8SceDvM1rg5gwWU2YrgHeOG5jXpQcK8GydTuUO/SdrKitsvcphi1PdL36w7s
+t5XNLrE2b6ifuE3/zorEjmI3MoA+BUpNOYdpCQDoQGTSnfkfn6tnH/nGhLp+F2yL
+jQju+4rXzQYlcp9OGsJx4RvPotccBRKV1klL6ZWVic9oGEaj6g2djsocKFVJa8BL
+WPVCuQrsDm4hpP9gwBtuQHLQpcW1206HZzoxcMsyhHCp4v/g8tvNA7SFRdMHzA/H
+SdjCF+tz90rA2YxZ78AKzhMLhMmqDREUtOV0quwY3l8mGJhKdvB/zebEtVgDA/UQ
+AV2PY4i6Zde0f1oaUQ7t5Wj6GANyFaHsJx/qrCRGGG7xl9tK9NahkaCMsC++hztE
+sI0qiYVf8tnjLmayiJgELJYyOJkZqYP9lAzdY9QbYJ1DmDWstCM43n+FUlegN9+l
+z75ULDxQJyvUVKmdo9Sls8DqPQ7icGv7y6VWBexkcvAa22QBy10nxKHEYw==
+-----END CERTIFICATE-----

Lib/test/certdata/keycertecc.pem

@@ -0,0 +1,103 @@
+-----BEGIN PRIVATE KEY-----
+MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDDRUbCeT3hMph4Y/ahL
+1sy9Qfy4DYotuAP06UetzG6syv+EoQ02kX3xvazqwiJDrEyhZANiAAQef97STEPn
+4Nk6C153VEx24MNkJUcmLe771u6lr3Q8Em3J/YPaA1i9Ys7KZA3WvoKBPoWaaikn
+4yLQbd/6YE6AAjMuaThlR1/cqH5QnmS3DXHUjmxnLjWy/dZl0CJG1qo=
+-----END PRIVATE KEY-----
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            cb:2d:80:99:5a:69:52:5e
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=XY, O=Python Software Foundation CA, CN=our-ca-server
+        Validity
+            Not Before: Aug 29 14:23:16 2018 GMT
+            Not After : Oct 28 14:23:16 2037 GMT
+        Subject: C=XY, L=Castle Anthrax, O=Python Software Foundation, CN=localhost-ecc
+        Subject Public Key Info:
+            Public Key Algorithm: id-ecPublicKey
+                Public-Key: (384 bit)
+                pub:
+                    04:1e:7f:de:d2:4c:43:e7:e0:d9:3a:0b:5e:77:54:
+                    4c:76:e0:c3:64:25:47:26:2d:ee:fb:d6:ee:a5:af:
+                    74:3c:12:6d:c9:fd:83:da:03:58:bd:62:ce:ca:64:
+                    0d:d6:be:82:81:3e:85:9a:6a:29:27:e3:22:d0:6d:
+                    df:fa:60:4e:80:02:33:2e:69:38:65:47:5f:dc:a8:
+                    7e:50:9e:64:b7:0d:71:d4:8e:6c:67:2e:35:b2:fd:
+                    d6:65:d0:22:46:d6:aa
+                ASN1 OID: secp384r1
+                NIST CURVE: P-384
+        X509v3 extensions:
+            X509v3 Subject Alternative Name: 
+                DNS:localhost-ecc
+            X509v3 Key Usage: critical
+                Digital Signature, Key Encipherment
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, TLS Web Client Authentication
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            X509v3 Subject Key Identifier: 
+                45:ED:32:14:6D:51:A2:3B:B0:80:55:E0:A6:9B:74:4C:A5:56:88:B1
+            X509v3 Authority Key Identifier: 
+                keyid:F3:EC:94:8E:F2:8E:30:C4:8E:68:C2:BF:8E:6A:19:C0:C1:9F:76:65
+                DirName:/C=XY/O=Python Software Foundation CA/CN=our-ca-server
+                serial:CB:2D:80:99:5A:69:52:5B
+            Authority Information Access: 
+                CA Issuers - URI:http://testca.pythontest.net/testca/pycacert.cer
+                OCSP - URI:http://testca.pythontest.net/testca/ocsp/
+            X509v3 CRL Distribution Points: 
+                Full Name:
+                  URI:http://testca.pythontest.net/testca/revocation.crl
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        07:e4:91:0b:d3:ed:4b:52:7f:50:68:c7:8d:80:48:9f:b7:4a:
+        13:66:bf:9d:4c:2d:18:19:68:a0:da:3b:12:85:05:16:fa:8d:
+        9c:58:c6:81:b3:96:ba:11:62:65:d3:76:f1:1c:ab:95:e4:d8:
+        2a:e0:1f:7b:c5:20:2e:7c:8f:de:87:7a:2b:52:54:ca:d1:41:
+        b0:5e:20:72:df:44:00:4a:69:1a:ef:10:63:52:13:ed:49:02:
+        ee:dc:9d:f3:c8:ba:c4:01:81:5a:a9:1c:15:12:b6:21:de:44:
+        a5:fd:7e:f9:22:d1:3e:ee:22:dd:31:55:32:4e:41:68:27:c5:
+        95:1b:7e:6b:18:74:f9:22:d6:b7:b9:31:72:51:a0:5a:2c:ff:
+        62:76:e9:a0:55:8d:78:33:52:4a:58:b2:f4:4b:0c:43:82:2f:
+        a9:84:68:05:dd:11:47:70:24:fe:5c:92:fd:17:21:63:bb:fa:
+        93:fa:54:54:05:72:48:ed:81:48:ab:95:fc:6d:a8:62:96:f9:
+        3b:e2:71:18:05:3e:76:bb:df:95:17:7b:81:4b:1f:7f:e1:67:
+        76:c4:07:cb:65:a7:f2:cf:e6:b4:fb:75:7c:ee:df:a1:f5:34:
+        20:2b:48:fd:2e:49:ff:f3:a6:3b:00:49:6c:88:79:ed:9c:16:
+        2a:04:72:e2:93:e4:7e:3f:2a:dd:30:47:9a:99:84:2a:b9:c4:
+        40:31:a6:68:f3:20:d1:75:f1:1e:c8:18:64:5b:f8:4c:ce:9a:
+        3c:57:2c:e3:63:64:29:0a:c2:b6:8e:20:01:55:9f:fe:10:ba:
+        12:42:38:0a:9b:53:01:a5:b4:08:76:ec:e8:a6:fc:69:2c:f7:
+        7f:5e:0f:44:07:55:e1:7c:2e:58:e5:d6:fc:6f:c2:4d:83:65:
+        bd:f3:32:e3:14:48:22:8d:80:18:ea:44:f8:24:79:ff:ff:c6:
+        04:c2:e9:90:34:40:d6:59:3f:59:1e:4a:9a:58:60:ce:ab:f9:
+        76:0e:ef:f7:05:17
+-----BEGIN CERTIFICATE-----
+MIIEyzCCAzOgAwIBAgIJAMstgJlaaVJeMA0GCSqGSIb3DQEBCwUAME0xCzAJBgNV
+BAYTAlhZMSYwJAYDVQQKDB1QeXRob24gU29mdHdhcmUgRm91bmRhdGlvbiBDQTEW
+MBQGA1UEAwwNb3VyLWNhLXNlcnZlcjAeFw0xODA4MjkxNDIzMTZaFw0zNzEwMjgx
+NDIzMTZaMGMxCzAJBgNVBAYTAlhZMRcwFQYDVQQHDA5DYXN0bGUgQW50aHJheDEj
+MCEGA1UECgwaUHl0aG9uIFNvZnR3YXJlIEZvdW5kYXRpb24xFjAUBgNVBAMMDWxv
+Y2FsaG9zdC1lY2MwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAQef97STEPn4Nk6C153
+VEx24MNkJUcmLe771u6lr3Q8Em3J/YPaA1i9Ys7KZA3WvoKBPoWaaikn4yLQbd/6
+YE6AAjMuaThlR1/cqH5QnmS3DXHUjmxnLjWy/dZl0CJG1qqjggHEMIIBwDAYBgNV
+HREEETAPgg1sb2NhbGhvc3QtZWNjMA4GA1UdDwEB/wQEAwIFoDAdBgNVHSUEFjAU
+BggrBgEFBQcDAQYIKwYBBQUHAwIwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQURe0y
+FG1RojuwgFXgppt0TKVWiLEwfQYDVR0jBHYwdIAU8+yUjvKOMMSOaMK/jmoZwMGf
+dmWhUaRPME0xCzAJBgNVBAYTAlhZMSYwJAYDVQQKDB1QeXRob24gU29mdHdhcmUg
+Rm91bmRhdGlvbiBDQTEWMBQGA1UEAwwNb3VyLWNhLXNlcnZlcoIJAMstgJlaaVJb
+MIGDBggrBgEFBQcBAQR3MHUwPAYIKwYBBQUHMAKGMGh0dHA6Ly90ZXN0Y2EucHl0
+aG9udGVzdC5uZXQvdGVzdGNhL3B5Y2FjZXJ0LmNlcjA1BggrBgEFBQcwAYYpaHR0
+cDovL3Rlc3RjYS5weXRob250ZXN0Lm5ldC90ZXN0Y2Evb2NzcC8wQwYDVR0fBDww
+OjA4oDagNIYyaHR0cDovL3Rlc3RjYS5weXRob250ZXN0Lm5ldC90ZXN0Y2EvcmV2
+b2NhdGlvbi5jcmwwDQYJKoZIhvcNAQELBQADggGBAAfkkQvT7UtSf1Box42ASJ+3
+ShNmv51MLRgZaKDaOxKFBRb6jZxYxoGzlroRYmXTdvEcq5Xk2CrgH3vFIC58j96H
+eitSVMrRQbBeIHLfRABKaRrvEGNSE+1JAu7cnfPIusQBgVqpHBUStiHeRKX9fvki
+0T7uIt0xVTJOQWgnxZUbfmsYdPki1re5MXJRoFos/2J26aBVjXgzUkpYsvRLDEOC
+L6mEaAXdEUdwJP5ckv0XIWO7+pP6VFQFckjtgUirlfxtqGKW+TvicRgFPna735UX
+e4FLH3/hZ3bEB8tlp/LP5rT7dXzu36H1NCArSP0uSf/zpjsASWyIee2cFioEcuKT
+5H4/Kt0wR5qZhCq5xEAxpmjzINF18R7IGGRb+EzOmjxXLONjZCkKwraOIAFVn/4Q
+uhJCOAqbUwGltAh27Oim/Gks939eD0QHVeF8Lljl1vxvwk2DZb3zMuMUSCKNgBjq
+RPgkef//xgTC6ZA0QNZZP1keSppYYM6r+XYO7/cFFw==
+-----END CERTIFICATE-----

Lib/test/certdata/leaf-missing-aki.ca.pem

@@ -0,0 +1,13 @@
+# Taken from x509-limbo's `rfc5280::aki::leaf-missing-aki` testcase.
+# See: https://x509-limbo.com/testcases/rfc5280/#rfc5280akileaf-missing-aki
+-----BEGIN CERTIFICATE-----
+MIIBkDCCATWgAwIBAgIUGjIb/aYm9u9fBh2o4GAYRJwk5XIwCgYIKoZIzj0EAwIw
+GjEYMBYGA1UEAwwPeDUwOS1saW1iby1yb290MCAXDTcwMDEwMTAwMDAwMVoYDzI5
+NjkwNTAzMDAwMDAxWjAaMRgwFgYDVQQDDA94NTA5LWxpbWJvLXJvb3QwWTATBgcq
+hkjOPQIBBggqhkjOPQMBBwNCAARUzBhjMOkO911U65Fvs4YmL1YPNj63P9Fa+g9U
+KrUqiIy8WjaDXdIe8g8Zj0TalpbU1gYCs3atteMxgIp6qxwHo1cwVTAPBgNVHRMB
+Af8EBTADAQH/MAsGA1UdDwQEAwICBDAWBgNVHREEDzANggtleGFtcGxlLmNvbTAd
+BgNVHQ4EFgQUcv1fyqgezMGzmo+lhmUkdUuAbIowCgYIKoZIzj0EAwIDSQAwRgIh
+AIOErPSRlWpnyMub9UgtPF/lSzdvnD4Q8KjLQppHx6oPAiEA373p4L/HvUbs0xg8
+6/pLyn0RT02toKKJcMV3ChohLtM=
+-----END CERTIFICATE-----

Lib/test/certdata/leaf-missing-aki.keycert.pem

@@ -0,0 +1,18 @@
+# Taken from x509-limbo's `rfc5280::aki::leaf-missing-aki` testcase.
+# See: https://x509-limbo.com/testcases/rfc5280/#rfc5280akileaf-missing-aki
+-----BEGIN EC PRIVATE KEY-----
+MHcCAQEEIF5Re+/FP3rg+7c1odKEQPXhb9V65kXnlZIWHDG9gKrLoAoGCCqGSM49
+AwEHoUQDQgAE1WAQMdC7ims7T9lpK9uzaCuKqHb/oNMbGjh1f10pOHv3Z+oAvsqF
+Sv3hGzreu69YLy01afA6sUCf1AA/95dKkg==
+-----END EC PRIVATE KEY-----
+-----BEGIN CERTIFICATE-----
+MIIBjjCCATWgAwIBAgIUVlBgclml+OXlrWzZfcgYCiNm96UwCgYIKoZIzj0EAwIw
+GjEYMBYGA1UEAwwPeDUwOS1saW1iby1yb290MCAXDTcwMDEwMTAwMDAwMVoYDzI5
+NjkwNTAzMDAwMDAxWjAWMRQwEgYDVQQDDAtleGFtcGxlLmNvbTBZMBMGByqGSM49
+AgEGCCqGSM49AwEHA0IABNVgEDHQu4prO0/ZaSvbs2griqh2/6DTGxo4dX9dKTh7
+92fqAL7KhUr94Rs63ruvWC8tNWnwOrFAn9QAP/eXSpKjWzBZMB0GA1UdDgQWBBS3
+yYRQQwo3syjGVQ8Yw7/XRZHbpzALBgNVHQ8EBAMCB4AwEwYDVR0lBAwwCgYIKwYB
+BQUHAwEwFgYDVR0RBA8wDYILZXhhbXBsZS5jb20wCgYIKoZIzj0EAwIDRwAwRAIg
+BVq7lw4Y5MPEyisPhowMWd4KnERupdM5qeImDO+dD7ICIE/ksd6Wz1b8rMAfllNV
+yiYst9lfwTd2SkFgdDNUDFud
+-----END CERTIFICATE-----

Lib/test/certdata/make_ssl_certs.py

@@ -0,0 +1,315 @@
+"""Make the custom certificate and private key files used by test_ssl
+and friends."""
+
+import os
+import pprint
+import shutil
+import tempfile
+from subprocess import *
+
+startdate = "20180829142316Z"
+enddate = "20371028142316Z"
+
+req_template = """
+    [ default ]
+    base_url               = http://testca.pythontest.net/testca
+
+    [req]
+    distinguished_name     = req_distinguished_name
+    prompt                 = no
+
+    [req_distinguished_name]
+    C                      = XY
+    L                      = Castle Anthrax
+    O                      = Python Software Foundation
+    CN                     = {hostname}
+
+    [req_x509_extensions_nosan]
+
+    [req_x509_extensions_simple]
+    subjectAltName         = @san
+
+    [req_x509_extensions_full]
+    subjectAltName         = @san
+    keyUsage               = critical,keyEncipherment,digitalSignature
+    extendedKeyUsage       = serverAuth,clientAuth
+    basicConstraints       = critical,CA:false
+    subjectKeyIdentifier   = hash
+    authorityKeyIdentifier = keyid:always,issuer:always
+    authorityInfoAccess    = @issuer_ocsp_info
+    crlDistributionPoints  = @crl_info
+
+    [ issuer_ocsp_info ]
+    caIssuers;URI.0        = $base_url/pycacert.cer
+    OCSP;URI.0             = $base_url/ocsp/
+
+    [ crl_info ]
+    URI.0                  = $base_url/revocation.crl
+
+    [san]
+    DNS.1 = {hostname}
+    {extra_san}
+
+    [dir_sect]
+    C                      = XY
+    L                      = Castle Anthrax
+    O                      = Python Software Foundation
+    CN                     = dirname example
+
+    [princ_name]
+    realm = EXP:0, GeneralString:KERBEROS.REALM
+    principal_name = EXP:1, SEQUENCE:principal_seq
+
+    [principal_seq]
+    name_type = EXP:0, INTEGER:1
+    name_string = EXP:1, SEQUENCE:principals
+
+    [principals]
+    princ1 = GeneralString:username
+
+    [ ca ]
+    default_ca      = CA_default
+
+    [ CA_default ]
+    dir = cadir
+    database  = $dir/index.txt
+    crlnumber = $dir/crl.txt
+    default_md = sha256
+    startdate = {startdate}
+    default_startdate = {startdate}
+    enddate = {enddate}
+    default_enddate = {enddate}
+    default_days = 7000
+    default_crl_days = 7000
+    certificate = pycacert.pem
+    private_key = pycakey.pem
+    serial    = $dir/serial
+    RANDFILE  = $dir/.rand
+    policy          = policy_match
+
+    [ policy_match ]
+    countryName             = match
+    stateOrProvinceName     = optional
+    organizationName        = match
+    organizationalUnitName  = optional
+    commonName              = supplied
+    emailAddress            = optional
+
+    [ policy_anything ]
+    countryName   = optional
+    stateOrProvinceName = optional
+    localityName    = optional
+    organizationName  = optional
+    organizationalUnitName  = optional
+    commonName    = supplied
+    emailAddress    = optional
+
+
+    [ v3_ca ]
+
+    subjectKeyIdentifier=hash
+    authorityKeyIdentifier=keyid:always,issuer
+    basicConstraints = critical, CA:true
+    keyUsage = critical, digitalSignature, keyCertSign, cRLSign
+
+    """
+
+here = os.path.abspath(os.path.dirname(__file__))
+
+
+def make_cert_key(hostname, sign=False, extra_san='',
+                  ext='req_x509_extensions_full', key='rsa:3072'):
+    print("creating cert for " + hostname)
+    tempnames = []
+    for i in range(3):
+        with tempfile.NamedTemporaryFile(delete=False) as f:
+            tempnames.append(f.name)
+    req_file, cert_file, key_file = tempnames
+    try:
+        req = req_template.format(
+            hostname=hostname,
+            extra_san=extra_san,
+            startdate=startdate,
+            enddate=enddate
+        )
+        with open(req_file, 'w') as f:
+            f.write(req)
+        args = ['req', '-new', '-nodes', '-days', '7000',
+                '-newkey', key, '-keyout', key_file,
+                '-extensions', ext,
+                '-config', req_file]
+        if sign:
+            with tempfile.NamedTemporaryFile(delete=False) as f:
+                tempnames.append(f.name)
+                reqfile = f.name
+            args += ['-out', reqfile ]
+
+        else:
+            args += ['-x509', '-out', cert_file ]
+        check_call(['openssl'] + args)
+
+        if sign:
+            args = [
+                'ca',
+                '-config', req_file,
+                '-extensions', ext,
+                '-out', cert_file,
+                '-outdir', 'cadir',
+                '-policy', 'policy_anything',
+                '-batch', '-infiles', reqfile
+            ]
+            check_call(['openssl'] + args)
+
+
+        with open(cert_file, 'r') as f:
+            cert = f.read()
+        with open(key_file, 'r') as f:
+            key = f.read()
+        return cert, key
+    finally:
+        for name in tempnames:
+            os.remove(name)
+
+TMP_CADIR = 'cadir'
+
+def unmake_ca():
+    shutil.rmtree(TMP_CADIR)
+
+def make_ca():
+    os.mkdir(TMP_CADIR)
+    with open(os.path.join('cadir','index.txt'),'a+') as f:
+        pass # empty file
+    with open(os.path.join('cadir','crl.txt'),'a+') as f:
+        f.write("00")
+    with open(os.path.join('cadir','index.txt.attr'),'w+') as f:
+        f.write('unique_subject = no')
+    # random start value for serial numbers
+    with open(os.path.join('cadir','serial'), 'w') as f:
+        f.write('CB2D80995A69525B\n')
+
+    with tempfile.NamedTemporaryFile("w") as t:
+        req = req_template.format(
+            hostname='our-ca-server',
+            extra_san='',
+            startdate=startdate,
+            enddate=enddate
+        )
+        t.write(req)
+        t.flush()
+        with tempfile.NamedTemporaryFile() as f:
+            args = ['req', '-config', t.name, '-new',
+                    '-nodes',
+                    '-newkey', 'rsa:3072',
+                    '-keyout', 'pycakey.pem',
+                    '-out', f.name,
+                    '-subj', '/C=XY/L=Castle Anthrax/O=Python Software Foundation CA/CN=our-ca-server']
+            check_call(['openssl'] + args)
+            args = ['ca', '-config', t.name,
+                    '-out', 'pycacert.pem', '-batch', '-outdir', TMP_CADIR,
+                    '-keyfile', 'pycakey.pem',
+                    '-selfsign', '-extensions', 'v3_ca', '-infiles', f.name ]
+            check_call(['openssl'] + args)
+            args = ['ca', '-config', t.name, '-gencrl', '-out', 'revocation.crl']
+            check_call(['openssl'] + args)
+
+    # capath hashes depend on subject!
+    check_call([
+        'openssl', 'x509', '-in', 'pycacert.pem', '-out', 'capath/ceff1710.0'
+    ])
+    shutil.copy('capath/ceff1710.0', 'capath/b1930218.0')
+
+
+def print_cert(path):
+    import _ssl
+    pprint.pprint(_ssl._test_decode_cert(path))
+
+
+if __name__ == '__main__':
+    os.chdir(here)
+    cert, key = make_cert_key('localhost', ext='req_x509_extensions_simple')
+    with open('ssl_cert.pem', 'w') as f:
+        f.write(cert)
+    with open('ssl_key.pem', 'w') as f:
+        f.write(key)
+    print("password protecting ssl_key.pem in ssl_key.passwd.pem")
+    check_call(['openssl','pkey','-in','ssl_key.pem','-out','ssl_key.passwd.pem','-aes256','-passout','pass:somepass'])
+    check_call(['openssl','pkey','-in','ssl_key.pem','-out','keycert.passwd.pem','-aes256','-passout','pass:somepass'])
+
+    with open('keycert.pem', 'w') as f:
+        f.write(key)
+        f.write(cert)
+
+    with open('keycert.passwd.pem', 'a+') as f:
+        f.write(cert)
+
+    # For certificate matching tests
+    make_ca()
+    cert, key = make_cert_key('fakehostname', ext='req_x509_extensions_simple')
+    with open('keycert2.pem', 'w') as f:
+        f.write(key)
+        f.write(cert)
+
+    cert, key = make_cert_key('localhost', sign=True)
+    with open('keycert3.pem', 'w') as f:
+        f.write(key)
+        f.write(cert)
+
+    check_call(['openssl', 'x509', '-outform', 'pem', '-in', 'keycert3.pem', '-out', 'cert3.pem'])
+
+    cert, key = make_cert_key('fakehostname', sign=True)
+    with open('keycert4.pem', 'w') as f:
+        f.write(key)
+        f.write(cert)
+
+    cert, key = make_cert_key(
+        'localhost-ecc', sign=True, key='param:secp384r1.pem'
+    )
+    with open('keycertecc.pem', 'w') as f:
+        f.write(key)
+        f.write(cert)
+
+    extra_san = [
+        'otherName.1 = 1.2.3.4;UTF8:some other identifier',
+        'otherName.2 = 1.3.6.1.5.2.2;SEQUENCE:princ_name',
+        'email.1 = user@example.org',
+        'DNS.2 = www.example.org',
+        # GEN_X400
+        'dirName.1 = dir_sect',
+        # GEN_EDIPARTY
+        'URI.1 = https://www.python.org/',
+        'IP.1 = 127.0.0.1',
+        'IP.2 = ::1',
+        'RID.1 = 1.2.3.4.5',
+    ]
+
+    cert, key = make_cert_key('allsans', sign=True, extra_san='\n'.join(extra_san))
+    with open('allsans.pem', 'w') as f:
+        f.write(key)
+        f.write(cert)
+
+    extra_san = [
+        # könig (king)
+        'DNS.2 = xn--knig-5qa.idn.pythontest.net',
+        # königsgäßchen (king's alleyway)
+        'DNS.3 = xn--knigsgsschen-lcb0w.idna2003.pythontest.net',
+        'DNS.4 = xn--knigsgchen-b4a3dun.idna2008.pythontest.net',
+        # βόλοσ (marble)
+        'DNS.5 = xn--nxasmq6b.idna2003.pythontest.net',
+        'DNS.6 = xn--nxasmm1c.idna2008.pythontest.net',
+    ]
+
+    # IDN SANS, signed
+    cert, key = make_cert_key('idnsans', sign=True, extra_san='\n'.join(extra_san))
+    with open('idnsans.pem', 'w') as f:
+        f.write(key)
+        f.write(cert)
+
+    cert, key = make_cert_key('nosan', sign=True, ext='req_x509_extensions_nosan')
+    with open('nosan.pem', 'w') as f:
+        f.write(key)
+        f.write(cert)
+
+    unmake_ca()
+    print("update Lib/test/test_ssl.py and Lib/test/test_asyncio/utils.py")
+    print_cert('keycert.pem')
+    print_cert('keycert3.pem')

Lib/test/certdata/nokia.pem

@@ -0,0 +1,31 @@
+# Certificate for projects.developer.nokia.com:443 (see issue 13034)
+-----BEGIN CERTIFICATE-----
+MIIFLDCCBBSgAwIBAgIQLubqdkCgdc7lAF9NfHlUmjANBgkqhkiG9w0BAQUFADCB
+vDELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQL
+ExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTswOQYDVQQLEzJUZXJtcyBvZiB1c2Ug
+YXQgaHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL3JwYSAoYykxMDE2MDQGA1UEAxMt
+VmVyaVNpZ24gQ2xhc3MgMyBJbnRlcm5hdGlvbmFsIFNlcnZlciBDQSAtIEczMB4X
+DTExMDkyMTAwMDAwMFoXDTEyMDkyMDIzNTk1OVowcTELMAkGA1UEBhMCRkkxDjAM
+BgNVBAgTBUVzcG9vMQ4wDAYDVQQHFAVFc3BvbzEOMAwGA1UEChQFTm9raWExCzAJ
+BgNVBAsUAkJJMSUwIwYDVQQDFBxwcm9qZWN0cy5kZXZlbG9wZXIubm9raWEuY29t
+MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCr92w1bpHYSYxUEx8N/8Iddda2
+lYi+aXNtQfV/l2Fw9Ykv3Ipw4nLeGTj18FFlAZgMdPRlgrzF/NNXGw/9l3/qKdow
+CypkQf8lLaxb9Ze1E/KKmkRJa48QTOqvo6GqKuTI6HCeGlG1RxDb8YSKcQWLiytn
+yj3Wp4MgRQO266xmMQIDAQABo4IB9jCCAfIwQQYDVR0RBDowOIIccHJvamVjdHMu
+ZGV2ZWxvcGVyLm5va2lhLmNvbYIYcHJvamVjdHMuZm9ydW0ubm9raWEuY29tMAkG
+A1UdEwQCMAAwCwYDVR0PBAQDAgWgMEEGA1UdHwQ6MDgwNqA0oDKGMGh0dHA6Ly9T
+VlJJbnRsLUczLWNybC52ZXJpc2lnbi5jb20vU1ZSSW50bEczLmNybDBEBgNVHSAE
+PTA7MDkGC2CGSAGG+EUBBxcDMCowKAYIKwYBBQUHAgEWHGh0dHBzOi8vd3d3LnZl
+cmlzaWduLmNvbS9ycGEwKAYDVR0lBCEwHwYJYIZIAYb4QgQBBggrBgEFBQcDAQYI
+KwYBBQUHAwIwcgYIKwYBBQUHAQEEZjBkMCQGCCsGAQUFBzABhhhodHRwOi8vb2Nz
+cC52ZXJpc2lnbi5jb20wPAYIKwYBBQUHMAKGMGh0dHA6Ly9TVlJJbnRsLUczLWFp
+YS52ZXJpc2lnbi5jb20vU1ZSSW50bEczLmNlcjBuBggrBgEFBQcBDARiMGChXqBc
+MFowWDBWFglpbWFnZS9naWYwITAfMAcGBSsOAwIaBBRLa7kolgYMu9BSOJsprEsH
+iyEFGDAmFiRodHRwOi8vbG9nby52ZXJpc2lnbi5jb20vdnNsb2dvMS5naWYwDQYJ
+KoZIhvcNAQEFBQADggEBACQuPyIJqXwUyFRWw9x5yDXgMW4zYFopQYOw/ItRY522
+O5BsySTh56BWS6mQB07XVfxmYUGAvRQDA5QHpmY8jIlNwSmN3s8RKo+fAtiNRlcL
+x/mWSfuMs3D/S6ev3D6+dpEMZtjrhOdctsarMKp8n/hPbwhAbg5hVjpkW5n8vz2y
+0KxvvkA1AxpLwpVv7OlK17ttzIHw8bp9HTlHBU5s8bKz4a565V/a5HI0CSEv/+0y
+ko4/ghTnZc1CkmUngKKeFMSah/mT/xAh8XnE2l1AazFa8UKuYki1e+ArHaGZc4ix
+UYOtiRphwfuYQhRZ7qX9q2MMkCMI65XNK/SaFrAbbG0=
+-----END CERTIFICATE-----

Lib/test/certdata/nosan.pem

@@ -0,0 +1,131 @@
+-----BEGIN PRIVATE KEY-----
+MIIG/gIBADANBgkqhkiG9w0BAQEFAASCBugwggbkAgEAAoIBgQC99xEYPTwFN/ji
+i0lm11ckEGhcxciSsIgTgior54CLgQy7JXllTYmAWFTTg2zNBvDMexGI0h+xtZ4q
+1Renghgt33N3Y6CT3v/L7JkE1abQbFveKW/ydlxH0+jLlsENSWjySwC80+f9L3bX
+TcD8T4Fu9Uty2Rg1a/Eyekng5RmfkmLNgxfnX5R5nWhh0Aia7h3Ax2zCALfxqZIm
+fxwavEgHsW/yZi+T+eoJwe0i7a6LaUoLqsPV9ZhagziNDaappPHH42NW39WlRhx1
+UjtiRm2Jihnzxcfs+90zLXSp5pxo/cE9Ia4d8ieq3Rxd/XgjlF6FXXFJjwfL36Dw
+ehy8m3PKKAuO+fyMgPPPMQb7oaRy/MBG0NayRreTwyKILS2zafIW/iKpgICbxrWJ
+r/H1b3S6PBKYUE2uQs0/ZPnRjjh0VeNnue7JcRoNbe27I2d56KUBsVEPdokjU59v
+NYi6Se+ViZXtUbM1u/I0kvDMprAiobwtJFYgcE86N1lFJjHSwDMCAwEAAQKCAYBb
+lvnJBA0iPwBiyeFUElNTcg2/XST9hNu2/DU1AeM6X7gxqznCnAXFudD8Qgt9NvF2
+xYeIvjbFydk+sYs8Gj9qLqhPUdukMAqI2cRVTmWla/lHPhdZgbOwdf1x23es3k4Z
+NAxg/pKFwhK8cCKyA+tWAjKkZwODDk42ljt0kUEvbLbye1hVGAJQOJKRRmo/uLrj
+rcNELnCBtc5ffT2hrlHUU7qz1ozt/brXhYa+JnbXhKZMxcKyMD2KtmXXrFNEy99o
+jXbrpDCos82bzQfPDo8IpCbVbEd2J00aFmrNjQWhZuXX5dXflrujW4J0nzeHrZ78
+rNAz2/YuZ543BTB3XbogeFuLC5RqBgAMmw2WJ96Oa/UG8nZNvEw54N5r6dhfXj6A
+VlJFLVwlfBQdAdaM3P4uZ6WECrH3EerQa27qyUdRrcDaGPLt7wG9FmMivnW1KQsy
+5ow/gM0CsxFj2xNoGw1S5jtclbgSy8HNJaBsNk4XMQ+ORABZdG1MTTE+GMSjD/EC
+gcEA+6JYiZEo+QrvItIZYB6Go4suu/F8df1pEjJlxwp2GmObitRhtV6r9g9IySFv
+5SL7ZxARr4aQxvM7fNp57p9ssmkBtY0ofMjJAxhvs4T37bAcGK/2xCegNSmbqh24
+FAWpRDMgE5PjtuWC5jTvSOYFeUxwI/cu0HxWdxJl2dPUSL1nI2jP+ok3pZobEQk9
+E2+MlHpKmU+s/lAkuQiP+AW9a4M+ZJNWxocJjmtwj4OjJXPm7GddA/5x622DxFe6
+4K2vAoHBAMFC0An25bwGoFrCV/96s45K4qZcZcJ660+aK3xXaq6/8KfiusJnWds2
+nc0B6jYjKs8A7yTAGXke6fmyVsoLosZiXsbpW2m16g8jL79Tc85O9oDNmDIGk1uT
+tRLZc2BvmHmy/dNrdbT/EHC3FKNWQVqWc2sHhPeB6F3hIEXDSUO/GB0njMZNXrPJ
+547RlhN0xCLb3vTzzGHwNmwfI81YjV/XI4vpJjq1YceN8Xyd1r5ZOFfU8woIACO3
+I4dvBQ1avQKBwQCLDs9wzohfAFzg2Exvos7y6AKemDgYmD8NcE5wbWaQ9MTLNsz8
+RuIu64lkpRbKAMf/z5CGeI3fdCFGwRGq/e06tu7b3rMmKmtzS3jHM08zyiPsvKlZ
+AzD00BaXLy8/2VUOPFaYmxy3QSRShaRKm9sgik5agcocKuo5iTBB7V8eB5VMqyps
+IJJg8MXOZ1WaPQXqM56wFKjcLXvtyT6OaNWh6Xh8ajQFKDDuxI8CsFNjaiaONBzi
+DSX1XaL4ySab7T8CgcEAsI+7xP6+EDP1mDVpc8zD8kHUI6zSgwUNqiHtjKHIo3JU
+CO2JNkZ5v158eGlBcshaOdheozKlkxR9KlSWGezbf2crs4pKq585AS9iVeeGK3vU
+lQRAAaQkSEv/6AKl9/q8UKMIZnkMhploibGZt0f8WSiOtb+e6QjUI8CjXVj2vF//
+RdN2N01EMflKBh7Qf2H0NuytGxkJJojxD4K7kMVQE7lXjmEpPgWsGUZC01jYcfrN
+EOFKUWXRys9sNDVnZjX5AoHAFRyOC1BlmVEtcOsgzum4+JEDWvRnO1hP1tm68eTZ
+ijB/XppDtVESpq3+1+gx2YOmzlUNEhKlcn6eHPWEJwdVxJ87Gdh03rIV/ZQUKe46
+3+j6l/5coN4WfCBloy4b+Tcj+ZTL4sKaLm33RoD2UEWS5mmItfZuoEFQB958h3JD
+1Ka1tgsLnuYGjcrg+ALvbM5nQlefzPqPJh0C8UV3Ny/4Gd02YgHw7Yoe4m6OUqQv
+hctFUL/gjIGg9PVqTWzVVKaI
+-----END PRIVATE KEY-----
+Certificate:
+    Data:
+        Version: 1 (0x0)
+        Serial Number:
+            cb:2d:80:99:5a:69:52:61
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=XY, O=Python Software Foundation CA, CN=our-ca-server
+        Validity
+            Not Before: Aug 29 14:23:16 2018 GMT
+            Not After : Oct 28 14:23:16 2037 GMT
+        Subject: C=XY, L=Castle Anthrax, O=Python Software Foundation, CN=nosan
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (3072 bit)
+                Modulus:
+                    00:bd:f7:11:18:3d:3c:05:37:f8:e2:8b:49:66:d7:
+                    57:24:10:68:5c:c5:c8:92:b0:88:13:82:2a:2b:e7:
+                    80:8b:81:0c:bb:25:79:65:4d:89:80:58:54:d3:83:
+                    6c:cd:06:f0:cc:7b:11:88:d2:1f:b1:b5:9e:2a:d5:
+                    17:a7:82:18:2d:df:73:77:63:a0:93:de:ff:cb:ec:
+                    99:04:d5:a6:d0:6c:5b:de:29:6f:f2:76:5c:47:d3:
+                    e8:cb:96:c1:0d:49:68:f2:4b:00:bc:d3:e7:fd:2f:
+                    76:d7:4d:c0:fc:4f:81:6e:f5:4b:72:d9:18:35:6b:
+                    f1:32:7a:49:e0:e5:19:9f:92:62:cd:83:17:e7:5f:
+                    94:79:9d:68:61:d0:08:9a:ee:1d:c0:c7:6c:c2:00:
+                    b7:f1:a9:92:26:7f:1c:1a:bc:48:07:b1:6f:f2:66:
+                    2f:93:f9:ea:09:c1:ed:22:ed:ae:8b:69:4a:0b:aa:
+                    c3:d5:f5:98:5a:83:38:8d:0d:a6:a9:a4:f1:c7:e3:
+                    63:56:df:d5:a5:46:1c:75:52:3b:62:46:6d:89:8a:
+                    19:f3:c5:c7:ec:fb:dd:33:2d:74:a9:e6:9c:68:fd:
+                    c1:3d:21:ae:1d:f2:27:aa:dd:1c:5d:fd:78:23:94:
+                    5e:85:5d:71:49:8f:07:cb:df:a0:f0:7a:1c:bc:9b:
+                    73:ca:28:0b:8e:f9:fc:8c:80:f3:cf:31:06:fb:a1:
+                    a4:72:fc:c0:46:d0:d6:b2:46:b7:93:c3:22:88:2d:
+                    2d:b3:69:f2:16:fe:22:a9:80:80:9b:c6:b5:89:af:
+                    f1:f5:6f:74:ba:3c:12:98:50:4d:ae:42:cd:3f:64:
+                    f9:d1:8e:38:74:55:e3:67:b9:ee:c9:71:1a:0d:6d:
+                    ed:bb:23:67:79:e8:a5:01:b1:51:0f:76:89:23:53:
+                    9f:6f:35:88:ba:49:ef:95:89:95:ed:51:b3:35:bb:
+                    f2:34:92:f0:cc:a6:b0:22:a1:bc:2d:24:56:20:70:
+                    4f:3a:37:59:45:26:31:d2:c0:33
+                Exponent: 65537 (0x10001)
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        7e:dd:64:64:92:6c:b9:41:ce:f3:e3:f8:e6:9f:c8:5b:32:39:
+        8c:03:5b:5e:7e:b3:23:ca:6c:d1:99:2f:53:af:9d:3c:84:cd:
+        c6:ce:0a:ee:94:de:ff:a7:06:81:7e:e2:38:a5:05:39:58:22:
+        dc:13:83:53:e7:f8:16:cb:93:dc:cf:4b:e6:1b:9f:9e:71:ef:
+        ee:ba:ea:b6:68:5c:32:22:7e:54:4f:46:a6:0b:11:8f:ef:05:
+        6e:d3:0b:d0:a8:be:95:23:a2:e4:e7:a8:a2:a4:7d:98:52:86:
+        a4:15:fb:74:7a:9a:89:23:43:20:26:3a:56:9e:a3:6e:54:02:
+        76:4e:25:9c:a1:8c:03:99:e5:eb:a6:61:b4:9c:2a:b1:ed:eb:
+        94:f9:14:aa:a4:c3:f0:f7:7a:03:a3:b1:f8:c0:83:79:ab:8a:
+        93:7f:0a:95:08:50:ff:55:19:ac:28:a2:c8:9f:a6:77:72:a3:
+        da:37:a9:ff:f3:57:70:c8:65:d9:55:14:84:b4:b3:78:86:82:
+        da:84:2c:48:19:51:ec:9d:20:b1:4d:18:fb:82:9f:7b:a7:80:
+        22:69:25:83:4d:bf:ac:31:64:f5:39:11:f1:ed:53:fb:67:ab:
+        91:86:c5:4d:87:e8:6b:fe:9a:84:fe:6a:92:6b:62:c1:ae:d2:
+        f0:cb:06:6e:f3:50:f4:8d:6d:fa:7d:6a:1c:64:c3:98:91:da:
+        c9:8c:a9:79:e5:48:4c:a2:de:42:28:e8:0e:9f:52:6a:a4:e0:
+        c7:ac:11:9c:ba:5d:d6:84:93:56:28:f1:6d:83:aa:62:b2:b7:
+        56:c6:64:d9:96:4e:97:ab:4e:8f:ba:f6:ab:b9:17:52:98:32:
+        7f:b5:12:fa:39:d7:34:2a:f3:ed:40:90:6f:66:7b:b6:c1:9d:
+        b9:53:d0:e3:e9:69:8c:cf:7a:fd:08:0a:62:47:d4:ce:72:f7:
+        6f:80:b4:1d:18:7a:ba:a2:a9:45:49:ef:9c:0b:99:89:03:ab:
+        5f:7a:9d:c5:77:b7
+-----BEGIN CERTIFICATE-----
+MIIEJDCCAowCCQDLLYCZWmlSYTANBgkqhkiG9w0BAQsFADBNMQswCQYDVQQGEwJY
+WTEmMCQGA1UECgwdUHl0aG9uIFNvZnR3YXJlIEZvdW5kYXRpb24gQ0ExFjAUBgNV
+BAMMDW91ci1jYS1zZXJ2ZXIwHhcNMTgwODI5MTQyMzE2WhcNMzcxMDI4MTQyMzE2
+WjBbMQswCQYDVQQGEwJYWTEXMBUGA1UEBwwOQ2FzdGxlIEFudGhyYXgxIzAhBgNV
+BAoMGlB5dGhvbiBTb2Z0d2FyZSBGb3VuZGF0aW9uMQ4wDAYDVQQDDAVub3NhbjCC
+AaIwDQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGBAL33ERg9PAU3+OKLSWbXVyQQ
+aFzFyJKwiBOCKivngIuBDLsleWVNiYBYVNODbM0G8Mx7EYjSH7G1nirVF6eCGC3f
+c3djoJPe/8vsmQTVptBsW94pb/J2XEfT6MuWwQ1JaPJLALzT5/0vdtdNwPxPgW71
+S3LZGDVr8TJ6SeDlGZ+SYs2DF+dflHmdaGHQCJruHcDHbMIAt/GpkiZ/HBq8SAex
+b/JmL5P56gnB7SLtrotpSguqw9X1mFqDOI0Npqmk8cfjY1bf1aVGHHVSO2JGbYmK
+GfPFx+z73TMtdKnmnGj9wT0hrh3yJ6rdHF39eCOUXoVdcUmPB8vfoPB6HLybc8oo
+C475/IyA888xBvuhpHL8wEbQ1rJGt5PDIogtLbNp8hb+IqmAgJvGtYmv8fVvdLo8
+EphQTa5CzT9k+dGOOHRV42e57slxGg1t7bsjZ3nopQGxUQ92iSNTn281iLpJ75WJ
+le1RszW78jSS8MymsCKhvC0kViBwTzo3WUUmMdLAMwIDAQABMA0GCSqGSIb3DQEB
+CwUAA4IBgQB+3WRkkmy5Qc7z4/jmn8hbMjmMA1tefrMjymzRmS9Tr508hM3Gzgru
+lN7/pwaBfuI4pQU5WCLcE4NT5/gWy5Pcz0vmG5+ece/uuuq2aFwyIn5UT0amCxGP
+7wVu0wvQqL6VI6Lk56iipH2YUoakFft0epqJI0MgJjpWnqNuVAJ2TiWcoYwDmeXr
+pmG0nCqx7euU+RSqpMPw93oDo7H4wIN5q4qTfwqVCFD/VRmsKKLIn6Z3cqPaN6n/
+81dwyGXZVRSEtLN4hoLahCxIGVHsnSCxTRj7gp97p4AiaSWDTb+sMWT1ORHx7VP7
+Z6uRhsVNh+hr/pqE/mqSa2LBrtLwywZu81D0jW36fWocZMOYkdrJjKl55UhMot5C
+KOgOn1JqpODHrBGcul3WhJNWKPFtg6pisrdWxmTZlk6Xq06PuvaruRdSmDJ/tRL6
+Odc0KvPtQJBvZnu2wZ25U9Dj6WmMz3r9CApiR9TOcvdvgLQdGHq6oqlFSe+cC5mJ
+A6tfep3Fd7c=
+-----END CERTIFICATE-----

Lib/test/certdata/nullbytecert.pem

@@ -0,0 +1,90 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 0 (0x0)
+    Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, ST=Oregon, L=Beaverton, O=Python Software Foundation, OU=Python Core Development, CN=null.python.org\x00example.org/emailAddress=python-dev@python.org
+        Validity
+            Not Before: Aug  7 13:11:52 2013 GMT
+            Not After : Aug  7 13:12:52 2013 GMT
+        Subject: C=US, ST=Oregon, L=Beaverton, O=Python Software Foundation, OU=Python Core Development, CN=null.python.org\x00example.org/emailAddress=python-dev@python.org
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:b5:ea:ed:c9:fb:46:7d:6f:3b:76:80:dd:3a:f3:
+                    03:94:0b:a7:a6:db:ec:1d:df:ff:23:74:08:9d:97:
+                    16:3f:a3:a4:7b:3e:1b:0e:96:59:25:03:a7:26:e2:
+                    88:a9:cf:79:cd:f7:04:56:b0:ab:79:32:6e:59:c1:
+                    32:30:54:eb:58:a8:cb:91:f0:42:a5:64:27:cb:d4:
+                    56:31:88:52:ad:cf:bd:7f:f0:06:64:1f:cc:27:b8:
+                    a3:8b:8c:f3:d8:29:1f:25:0b:f5:46:06:1b:ca:02:
+                    45:ad:7b:76:0a:9c:bf:bb:b9:ae:0d:16:ab:60:75:
+                    ae:06:3e:9c:7c:31:dc:92:2f:29:1a:e0:4b:0c:91:
+                    90:6c:e9:37:c5:90:d7:2a:d7:97:15:a3:80:8f:5d:
+                    7b:49:8f:54:30:d4:97:2c:1c:5b:37:b5:ab:69:30:
+                    68:43:d3:33:78:4b:02:60:f5:3c:44:80:a1:8f:e7:
+                    f0:0f:d1:5e:87:9e:46:cf:62:fc:f9:bf:0c:65:12:
+                    f1:93:c8:35:79:3f:c8:ec:ec:47:f5:ef:be:44:d5:
+                    ae:82:1e:2d:9a:9f:98:5a:67:65:e1:74:70:7c:cb:
+                    d3:c2:ce:0e:45:49:27:dc:e3:2d:d4:fb:48:0e:2f:
+                    9e:77:b8:14:46:c0:c4:36:ca:02:ae:6a:91:8c:da:
+                    2f:85
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            X509v3 Subject Key Identifier:
+                88:5A:55:C0:52:FF:61:CD:52:A3:35:0F:EA:5A:9C:24:38:22:F7:5C
+            X509v3 Key Usage:
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Subject Alternative Name:
+                *************************************************************
+                WARNING: The values for DNS, email and URI are WRONG. OpenSSL
+                         doesn't print the text after a NULL byte.
+                *************************************************************
+                DNS:altnull.python.org, email:null@python.org, URI:http://null.python.org, IP Address:192.0.2.1, IP Address:2001:DB8:0:0:0:0:0:1
+    Signature Algorithm: sha1WithRSAEncryption
+         ac:4f:45:ef:7d:49:a8:21:70:8e:88:59:3e:d4:36:42:70:f5:
+         a3:bd:8b:d7:a8:d0:58:f6:31:4a:b1:a4:a6:dd:6f:d9:e8:44:
+         3c:b6:0a:71:d6:7f:b1:08:61:9d:60:ce:75:cf:77:0c:d2:37:
+         86:02:8d:5e:5d:f9:0f:71:b4:16:a8:c1:3d:23:1c:f1:11:b3:
+         56:6e:ca:d0:8d:34:94:e6:87:2a:99:f2:ae:ae:cc:c2:e8:86:
+         de:08:a8:7f:c5:05:fa:6f:81:a7:82:e6:d0:53:9d:34:f4:ac:
+         3e:40:fe:89:57:7a:29:a4:91:7e:0b:c6:51:31:e5:10:2f:a4:
+         60:76:cd:95:51:1a:be:8b:a1:b0:fd:ad:52:bd:d7:1b:87:60:
+         d2:31:c7:17:c4:18:4f:2d:08:25:a3:a7:4f:b7:92:ca:e2:f5:
+         25:f1:54:75:81:9d:b3:3d:61:a2:f7:da:ed:e1:c6:6f:2c:60:
+         1f:d8:6f:c5:92:05:ab:c9:09:62:49:a9:14:ad:55:11:cc:d6:
+         4a:19:94:99:97:37:1d:81:5f:8b:cf:a3:a8:96:44:51:08:3d:
+         0b:05:65:12:eb:b6:70:80:88:48:72:4f:c6:c2:da:cf:cd:8e:
+         5b:ba:97:2f:60:b4:96:56:49:5e:3a:43:76:63:04:be:2a:f6:
+         c1:ca:a9:94
+-----BEGIN CERTIFICATE-----
+MIIE2DCCA8CgAwIBAgIBADANBgkqhkiG9w0BAQUFADCBxTELMAkGA1UEBhMCVVMx
+DzANBgNVBAgMBk9yZWdvbjESMBAGA1UEBwwJQmVhdmVydG9uMSMwIQYDVQQKDBpQ
+eXRob24gU29mdHdhcmUgRm91bmRhdGlvbjEgMB4GA1UECwwXUHl0aG9uIENvcmUg
+RGV2ZWxvcG1lbnQxJDAiBgNVBAMMG251bGwucHl0aG9uLm9yZwBleGFtcGxlLm9y
+ZzEkMCIGCSqGSIb3DQEJARYVcHl0aG9uLWRldkBweXRob24ub3JnMB4XDTEzMDgw
+NzEzMTE1MloXDTEzMDgwNzEzMTI1MlowgcUxCzAJBgNVBAYTAlVTMQ8wDQYDVQQI
+DAZPcmVnb24xEjAQBgNVBAcMCUJlYXZlcnRvbjEjMCEGA1UECgwaUHl0aG9uIFNv
+ZnR3YXJlIEZvdW5kYXRpb24xIDAeBgNVBAsMF1B5dGhvbiBDb3JlIERldmVsb3Bt
+ZW50MSQwIgYDVQQDDBtudWxsLnB5dGhvbi5vcmcAZXhhbXBsZS5vcmcxJDAiBgkq
+hkiG9w0BCQEWFXB5dGhvbi1kZXZAcHl0aG9uLm9yZzCCASIwDQYJKoZIhvcNAQEB
+BQADggEPADCCAQoCggEBALXq7cn7Rn1vO3aA3TrzA5QLp6bb7B3f/yN0CJ2XFj+j
+pHs+Gw6WWSUDpybiiKnPec33BFawq3kyblnBMjBU61ioy5HwQqVkJ8vUVjGIUq3P
+vX/wBmQfzCe4o4uM89gpHyUL9UYGG8oCRa17dgqcv7u5rg0Wq2B1rgY+nHwx3JIv
+KRrgSwyRkGzpN8WQ1yrXlxWjgI9de0mPVDDUlywcWze1q2kwaEPTM3hLAmD1PESA
+oY/n8A/RXoeeRs9i/Pm/DGUS8ZPINXk/yOzsR/XvvkTVroIeLZqfmFpnZeF0cHzL
+08LODkVJJ9zjLdT7SA4vnne4FEbAxDbKAq5qkYzaL4UCAwEAAaOB0DCBzTAMBgNV
+HRMBAf8EAjAAMB0GA1UdDgQWBBSIWlXAUv9hzVKjNQ/qWpwkOCL3XDALBgNVHQ8E
+BAMCBeAwgZAGA1UdEQSBiDCBhYIeYWx0bnVsbC5weXRob24ub3JnAGV4YW1wbGUu
+Y29tgSBudWxsQHB5dGhvbi5vcmcAdXNlckBleGFtcGxlLm9yZ4YpaHR0cDovL251
+bGwucHl0aG9uLm9yZwBodHRwOi8vZXhhbXBsZS5vcmeHBMAAAgGHECABDbgAAAAA
+AAAAAAAAAAEwDQYJKoZIhvcNAQEFBQADggEBAKxPRe99SaghcI6IWT7UNkJw9aO9
+i9eo0Fj2MUqxpKbdb9noRDy2CnHWf7EIYZ1gznXPdwzSN4YCjV5d+Q9xtBaowT0j
+HPERs1ZuytCNNJTmhyqZ8q6uzMLoht4IqH/FBfpvgaeC5tBTnTT0rD5A/olXeimk
+kX4LxlEx5RAvpGB2zZVRGr6LobD9rVK91xuHYNIxxxfEGE8tCCWjp0+3ksri9SXx
+VHWBnbM9YaL32u3hxm8sYB/Yb8WSBavJCWJJqRStVRHM1koZlJmXNx2BX4vPo6iW
+RFEIPQsFZRLrtnCAiEhyT8bC2s/Njlu6ly9gtJZWSV46Q3ZjBL4q9sHKqZQ=
+-----END CERTIFICATE-----

Lib/test/certdata/pycacert.pem

@@ -0,0 +1,102 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            cb:2d:80:99:5a:69:52:5b
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=XY, O=Python Software Foundation CA, CN=our-ca-server
+        Validity
+            Not Before: Aug 29 14:23:16 2018 GMT
+            Not After : Oct 28 14:23:16 2037 GMT
+        Subject: C=XY, O=Python Software Foundation CA, CN=our-ca-server
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (3072 bit)
+                Modulus:
+                    00:d0:a0:9b:b1:b9:3b:79:ee:31:2f:b8:51:1c:01:
+                    75:ed:09:59:4c:ac:c8:bf:6a:0a:f8:7a:08:f0:25:
+                    e3:25:7b:6a:f8:c4:d8:aa:a0:60:07:25:b0:cf:73:
+                    71:05:52:68:bf:06:93:ae:10:61:96:bc:b3:69:81:
+                    1a:7d:19:fc:20:86:8f:9a:68:1b:ed:cd:e2:6c:61:
+                    67:c7:4e:55:ea:43:06:21:1b:e9:b9:be:84:5f:c2:
+                    da:eb:89:88:e0:42:a6:45:49:2a:d0:b9:6b:8c:93:
+                    c9:44:3b:ca:fc:3c:94:7f:dd:70:c5:ad:d8:4b:3b:
+                    dc:1e:f8:55:4b:b5:27:86:f8:df:b0:83:cf:f7:16:
+                    37:bf:13:17:34:d4:c9:55:ed:6b:16:c9:7f:ad:20:
+                    4e:f0:1e:d9:1b:bf:8d:ba:cd:ca:96:ef:1e:69:cb:
+                    51:66:61:48:0d:e8:79:a3:59:61:d4:10:8d:e0:0d:
+                    3b:0b:85:b6:d5:85:12:dd:a5:07:c5:4b:fa:23:fa:
+                    54:39:f7:97:0b:c9:44:47:1e:56:77:3c:3c:13:01:
+                    0b:6d:77:d6:14:ba:44:f4:53:35:56:d9:3d:b9:3e:
+                    35:5f:db:33:9a:4f:5a:b9:38:44:c9:32:49:fe:66:
+                    f6:1f:1a:97:aa:ca:4c:4a:f6:b8:5e:40:7f:fb:0b:
+                    1d:f8:5b:a1:dc:f8:c0:2e:d0:6d:49:f5:d2:46:d4:
+                    90:57:fe:92:81:34:ae:2d:38:bb:a8:17:0c:e1:e5:
+                    3f:e2:f7:26:05:54:50:f5:64:b3:1c:6e:44:ff:6f:
+                    a9:b4:03:96:e9:0e:c2:88:d8:72:52:90:99:c6:41:
+                    0f:46:90:59:b8:3e:6f:d2:e2:9e:1d:36:82:95:d3:
+                    58:8a:12:f3:e2:d8:0d:20:51:23:f0:90:2d:9a:3e:
+                    7d:26:86:b2:a7:d7:f9:28:60:03:e3:77:c7:88:04:
+                    c9:fe:89:77:70:10:4f:c3:a0:8a:3b:f4:ab:42:7b:
+                    e3:14:92:d8:ae:16:d6:a1:de:7d
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                F3:EC:94:8E:F2:8E:30:C4:8E:68:C2:BF:8E:6A:19:C0:C1:9F:76:65
+            X509v3 Authority Key Identifier: 
+                F3:EC:94:8E:F2:8E:30:C4:8E:68:C2:BF:8E:6A:19:C0:C1:9F:76:65
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+            X509v3 Key Usage: critical
+                Digital Signature, Certificate Sign, CRL Sign
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        8b:00:54:72:b3:8d:eb:f3:af:34:9f:d6:60:ea:de:84:3f:8c:
+        04:8f:19:a6:be:02:67:c4:63:c5:74:e3:47:37:59:83:94:06:
+        f1:45:19:e8:07:2f:d6:4e:4b:4f:a8:3d:c7:07:07:27:92:f4:
+        7e:73:4f:8b:32:19:94:46:7a:25:c4:d9:c4:27:b0:11:63:3a:
+        60:8b:85:e1:73:4f:34:3b:6b:a4:34:8c:49:8e:cd:cf:4f:b2:
+        65:27:41:19:b0:fc:80:31:78:f2:73:6a:9b:7d:71:34:50:fc:
+        78:a8:da:05:b4:9c:5b:3a:99:7a:6b:5d:ef:3b:d3:e9:3b:33:
+        01:12:65:cf:5e:07:d8:19:af:d5:53:ea:f0:10:ac:c4:b6:26:
+        3c:34:2e:74:ee:64:dd:1d:36:75:89:44:00:b0:0d:fd:2f:b3:
+        01:cc:1a:8b:02:cd:6c:e8:80:82:ca:bf:82:d7:00:9d:d8:36:
+        15:d2:07:37:fc:6c:73:1d:da:a8:1c:e8:20:8e:32:7a:fe:6d:
+        27:16:e4:58:6c:eb:3e:f0:fe:24:52:29:71:b8:96:7b:53:4b:
+        45:20:55:40:5e:86:1b:ec:c9:46:91:92:ee:ac:93:65:91:2e:
+        94:b6:b6:ac:e8:a3:34:89:a4:1a:12:0d:4d:44:a5:52:ed:8b:
+        91:ee:2f:a6:af:a4:95:25:f9:ce:c7:5b:a7:00:d3:93:ca:b4:
+        3c:5d:4d:f7:b1:3c:cc:6d:b4:45:be:82:ed:18:90:c8:86:d1:
+        75:51:50:04:4c:e8:4f:d2:d6:50:aa:75:e7:5e:ff:a1:7b:27:
+        19:1c:6b:49:2c:6c:4d:6b:63:cc:3b:73:00:f3:99:26:d0:82:
+        87:d3:a9:36:9c:b4:3d:b9:48:68:a8:92:f0:27:8e:0c:cd:15:
+        76:42:84:80:c9:3f:a3:7e:b4:dd:d7:f8:ac:76:ba:60:97:3c:
+        5a:1f:4e:de:71:ee:09:39:10:dd:31:d5:68:57:5d:1a:e5:42:
+        ba:0e:68:e6:45:d3
+-----BEGIN CERTIFICATE-----
+MIIEgDCCAuigAwIBAgIJAMstgJlaaVJbMA0GCSqGSIb3DQEBCwUAME0xCzAJBgNV
+BAYTAlhZMSYwJAYDVQQKDB1QeXRob24gU29mdHdhcmUgRm91bmRhdGlvbiBDQTEW
+MBQGA1UEAwwNb3VyLWNhLXNlcnZlcjAeFw0xODA4MjkxNDIzMTZaFw0zNzEwMjgx
+NDIzMTZaME0xCzAJBgNVBAYTAlhZMSYwJAYDVQQKDB1QeXRob24gU29mdHdhcmUg
+Rm91bmRhdGlvbiBDQTEWMBQGA1UEAwwNb3VyLWNhLXNlcnZlcjCCAaIwDQYJKoZI
+hvcNAQEBBQADggGPADCCAYoCggGBANCgm7G5O3nuMS+4URwBde0JWUysyL9qCvh6
+CPAl4yV7avjE2KqgYAclsM9zcQVSaL8Gk64QYZa8s2mBGn0Z/CCGj5poG+3N4mxh
+Z8dOVepDBiEb6bm+hF/C2uuJiOBCpkVJKtC5a4yTyUQ7yvw8lH/dcMWt2Es73B74
+VUu1J4b437CDz/cWN78TFzTUyVXtaxbJf60gTvAe2Ru/jbrNypbvHmnLUWZhSA3o
+eaNZYdQQjeANOwuFttWFEt2lB8VL+iP6VDn3lwvJREceVnc8PBMBC2131hS6RPRT
+NVbZPbk+NV/bM5pPWrk4RMkySf5m9h8al6rKTEr2uF5Af/sLHfhbodz4wC7QbUn1
+0kbUkFf+koE0ri04u6gXDOHlP+L3JgVUUPVksxxuRP9vqbQDlukOwojYclKQmcZB
+D0aQWbg+b9Linh02gpXTWIoS8+LYDSBRI/CQLZo+fSaGsqfX+ShgA+N3x4gEyf6J
+d3AQT8Ogijv0q0J74xSS2K4W1qHefQIDAQABo2MwYTAdBgNVHQ4EFgQU8+yUjvKO
+MMSOaMK/jmoZwMGfdmUwHwYDVR0jBBgwFoAU8+yUjvKOMMSOaMK/jmoZwMGfdmUw
+DwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAYYwDQYJKoZIhvcNAQELBQAD
+ggGBAIsAVHKzjevzrzSf1mDq3oQ/jASPGaa+AmfEY8V040c3WYOUBvFFGegHL9ZO
+S0+oPccHByeS9H5zT4syGZRGeiXE2cQnsBFjOmCLheFzTzQ7a6Q0jEmOzc9PsmUn
+QRmw/IAxePJzapt9cTRQ/Hio2gW0nFs6mXprXe870+k7MwESZc9eB9gZr9VT6vAQ
+rMS2Jjw0LnTuZN0dNnWJRACwDf0vswHMGosCzWzogILKv4LXAJ3YNhXSBzf8bHMd
+2qgc6CCOMnr+bScW5Fhs6z7w/iRSKXG4lntTS0UgVUBehhvsyUaRku6sk2WRLpS2
+tqzoozSJpBoSDU1EpVLti5HuL6avpJUl+c7HW6cA05PKtDxdTfexPMxttEW+gu0Y
+kMiG0XVRUARM6E/S1lCqdede/6F7Jxkca0ksbE1rY8w7cwDzmSbQgofTqTactD25
+SGiokvAnjgzNFXZChIDJP6N+tN3X+Kx2umCXPFofTt5x7gk5EN0x1WhXXRrlQroO
+aOZF0w==
+-----END CERTIFICATE-----

Lib/test/certdata/pycakey.pem

@@ -0,0 +1,40 @@
+-----BEGIN PRIVATE KEY-----
+MIIG/gIBADANBgkqhkiG9w0BAQEFAASCBugwggbkAgEAAoIBgQDQoJuxuTt57jEv
+uFEcAXXtCVlMrMi/agr4egjwJeMle2r4xNiqoGAHJbDPc3EFUmi/BpOuEGGWvLNp
+gRp9Gfwgho+aaBvtzeJsYWfHTlXqQwYhG+m5voRfwtrriYjgQqZFSSrQuWuMk8lE
+O8r8PJR/3XDFrdhLO9we+FVLtSeG+N+wg8/3Fje/Exc01MlV7WsWyX+tIE7wHtkb
+v426zcqW7x5py1FmYUgN6HmjWWHUEI3gDTsLhbbVhRLdpQfFS/oj+lQ595cLyURH
+HlZ3PDwTAQttd9YUukT0UzVW2T25PjVf2zOaT1q5OETJMkn+ZvYfGpeqykxK9rhe
+QH/7Cx34W6Hc+MAu0G1J9dJG1JBX/pKBNK4tOLuoFwzh5T/i9yYFVFD1ZLMcbkT/
+b6m0A5bpDsKI2HJSkJnGQQ9GkFm4Pm/S4p4dNoKV01iKEvPi2A0gUSPwkC2aPn0m
+hrKn1/koYAPjd8eIBMn+iXdwEE/DoIo79KtCe+MUktiuFtah3n0CAwEAAQKCAYAD
+iUK0/k2ZRqXJHXKBKy8rWjYMHCj3lvMM/M3g+tYWS7i88w00cIJ1geM006FDSf8i
+LxjatvFd2OCg9ay+w8LSbvrJJGGbeXAQjo1v7ePRPttAPWphQ8RCS+8NAKhJcNJu
+UzapZ13WJKfL2HLw1+VbziORXjMlLKRnAVDkzHMZO70C5MEQ0EIX+C6zrmBOl2HH
+du6LPy8crSaDQg8YxFCI7WWnvRKp+Gp8aIfYnR+7ifT1qr5o9sEUw8GAReyooJ3a
+yJ9uBUbcelO8fNjEABf9xjx+jOmOVsQfig2KuBEi0qXlQSpilZfUdYJhtNke9ADu
+Hui6MBn04D4RIzeKXV+OLjiLwqkJyNlPuxJ2EGpIHNMcx3gpjXIApAwc47BQwLKJ
+VhMWMXS0EWhCLtEzf5UrbMNX+Io3J7noEUu6jxmJV1BKhrnlYeoo4JryN0DUpkSb
+rOAOJLOkpfj7+gvqmWI4MT6SQXSr6BK+3m4J5bVSq4pej9uG5NR3Utghi5hF7DEC
+gcEA3cYNPYPFSTj9YAR3GUZvwUPVL3ZEFcwjrIeg87JhuZOH/hSQ33SgeEoAtaqL
+cLbimj7YzUYx3FOUCp/7yK/bAF1dhAbFab1yZE46Qv2Vi4e+/KEBBftqxyJl5KyV
+vc/HE1dXZGZIO1X5Z5MX8nO3rz/YayiozYVmMibrbHxgTEDC4BrbWtPJQNkflWEb
+FXNjkm0s2+J3kFANpL94NUKMGtArxQV3hWydGN8wS3Fn7LDnHDoM5mOt/naeKRES
+fwwpAoHBAPDTKsKs2LEe4YFzO1EClycDelppjxh5pHSnzTWSq40aKx533SG4aLyI
+DmghzoA3OmY0xpAy1WpT9FeiDNbYpiFCH3qBkArQR2QCu+WGUQ9tDoeN0C2Dje4e
+Yix49BjcGSWzSNvh+tU9PzRc/9eVBMAQuaCm3yNEL+Z7hFTzkrCWK23+jP/OzIIC
+XhnKdOveIYVAjlVgv8CoWIy3xhwXyqPAcstcPmlv9sDAYn37Ot7rGIS7e0WyQxvg
+gxnOxFzKNQKBwQDOPOn/NNV5HKh0bHKdbKVs4zoT4zW515etUIvbVR4QSCSFonZ/
+d6PreVZjmvAFp+3fZ2aSrx6bOJZJszGhFfjhw/G9X9aiWO1SXnVL6yrxERIJOWkM
+ORy5h0GegOjYFauaTvUUhxHRLEi9i0sPy5EcRpFqReuFBPNe3Fa/EoMzJl6TriYj
+tyRHTCNU9XMMZbxJZYH8EgUCjY/Cj9SoIvTL0p+Bn23hBHqrsJLm9dWhhXnHBC0O
+68/Y/lJi+l9rCtECgcEAt6PfTJovl0j8HxF23vyBtK9TQtSR2NERlh9LPZn9lViq
+Hs66YndT7sg1bDSzWlRDBSMjc1xAH5erkJOzBLYqYNwiUvGvnH9coSfwjkMRVxkL
+ZlS+taZGuZiTtmP5h2d3CaegXIQDGU5d/xkXwxYQjEF0u8vkBel+OVxg+cLPTjcF
+IRhl/r98dXtGtJYM+LvnhcxHfVWMg2YcOBn/SPbfgGVFZEuQECjf2fYaZQUJzGkr
+xjOM+gXIZN6cOjbQyA0tAoHADgR5/bMbcf6Jk0w56c/khFZz/pusne5cjXw5a6qq
+fClAqnqjGBpkRxs7HoCR3aje0Pd0pCS93a6Wiqneo4x4HDrpo+pWR2KGAAF4MeO3
+3K94hncmiLAiZo8iqULLKCqJW2EGB2b7QzGpY7jCPiI1g80KuYPesf4ZohSfrr1w
+DoqGoNrcIVdVmUgX47lLqIiWarbbDRY0Am9j58dovmNINYr5wCYGbeh2RuUmHr4u
+E2bb0CdekSHf05HPiF9QpK1z
+-----END PRIVATE KEY-----

Lib/test/certdata/revocation.crl

@@ -0,0 +1,14 @@
+-----BEGIN X509 CRL-----
+MIICJjCBjwIBATANBgkqhkiG9w0BAQsFADBNMQswCQYDVQQGEwJYWTEmMCQGA1UE
+CgwdUHl0aG9uIFNvZnR3YXJlIEZvdW5kYXRpb24gQ0ExFjAUBgNVBAMMDW91ci1j
+YS1zZXJ2ZXIXDTIzMTEyNTA0MjEzNloXDTQzMDEyNDA0MjEzNlqgDjAMMAoGA1Ud
+FAQDAgEAMA0GCSqGSIb3DQEBCwUAA4IBgQDMZ4XLQlzUrqBbszEq9I/nXK3jN8/p
+VZ2aScU2le0ySJqIthe0yXEYuoFu+I4ZULyNkCA79baStIl8/Lt48DOHfBVv8SVx
+ZqF7/fdUZBCLJV1kuhuSSknbtNmja5NI4/lcRRXrodRWDMcOmqlKbAC6RMQz/gMG
+vpewGPX1oj5AQnqqd9spKtHbeqeDiyyWYr9ZZFO/433lP7GdsoriTPggYJJMWJvs
+819buE0iGwWf+rTLB51VyGluhcz2pqimej6Ra2cdnYh5IztZlDFR99HywzWhVz/A
+2fwUA91GR7zATerweXVKNd59mcgF4PZWiXmQMwcE0qQOMqMmAqYPLim1mretZsAs
+t1X+nDM0Ak3sKumIjteQF7I6VpSsG4NCtq23G8KpNHnBZVOt0U065lQEvx0ZmB94
+1z7SzjfSZMVXYxBjSXljwuoc1keGpNT5xCmHyrOIxaHsmizzwNESW4dGVLu7/JfK
+w40uGbwH09w4Cfbwuo7w6sRWDWPnlW2mkoc=
+-----END X509 CRL-----

Lib/test/certdata/secp384r1.pem

@@ -0,0 +1,7 @@
+$ openssl genpkey -genparam -algorithm EC -pkeyopt ec_paramgen_curve:secp384r1 -pkeyopt ec_param_enc:named_curve -text
+-----BEGIN EC PARAMETERS-----
+BgUrgQQAIg==
+-----END EC PARAMETERS-----
+ECDSA-Parameters: (384 bit)
+ASN1 OID: secp384r1
+NIST CURVE: P-384

Lib/test/certdata/selfsigned_pythontestdotnet.pem

@@ -0,0 +1,34 @@
+-----BEGIN CERTIFICATE-----
+MIIF9zCCA9+gAwIBAgIUH98b4Fw/DyugC9cV7VK7ZODzHsIwDQYJKoZIhvcNAQEL
+BQAwgYoxCzAJBgNVBAYTAlhZMRcwFQYDVQQIDA5DYXN0bGUgQW50aHJheDEYMBYG
+A1UEBwwPQXJndW1lbnQgQ2xpbmljMSMwIQYDVQQKDBpQeXRob24gU29mdHdhcmUg
+Rm91bmRhdGlvbjEjMCEGA1UEAwwac2VsZi1zaWduZWQucHl0aG9udGVzdC5uZXQw
+HhcNMTkwNTA4MDEwMjQzWhcNMjcwNzI0MDEwMjQzWjCBijELMAkGA1UEBhMCWFkx
+FzAVBgNVBAgMDkNhc3RsZSBBbnRocmF4MRgwFgYDVQQHDA9Bcmd1bWVudCBDbGlu
+aWMxIzAhBgNVBAoMGlB5dGhvbiBTb2Z0d2FyZSBGb3VuZGF0aW9uMSMwIQYDVQQD
+DBpzZWxmLXNpZ25lZC5weXRob250ZXN0Lm5ldDCCAiIwDQYJKoZIhvcNAQEBBQAD
+ggIPADCCAgoCggIBAMKdJlyCThkahwoBb7pl5q64Pe9Fn5jrIvzsveHTc97TpjV2
+RLfICnXKrltPk/ohkVl6K5SUZQZwMVzFubkyxE0nZPHYHlpiKWQxbsYVkYv01rix
+IFdLvaxxbGYke2jwQao31s4o61AdlsfK1SdpHQUynBBMssqI3SB4XPmcA7e+wEEx
+jxjVish4ixA1vuIZOx8yibu+CFCf/geEjoBMF3QPdzULzlrCSw8k/45iZCSoNbvK
+DoL4TVV07PHOxpheDh8ZQmepGvU6pVqhb9m4lgmV0OGWHgozd5Ur9CbTVDmxIEz3
+TSoRtNJK7qtyZdGNqwjksQxgZTjM/d/Lm/BJG99AiOmYOjsl9gbQMZgvQmMAtUsI
+aMJnQuZ6R+KEpW/TR5qSKLWZSG45z/op+tzI2m+cE6HwTRVAWbcuJxcAA55MZjqU
+OOOu3BBYMjS5nf2sQ9uoXsVBFH7i0mQqoW1SLzr9opI8KsWwFxQmO2vBxWYaN+lH
+OmwBZBwyODIsmI1YGXmTp09NxRYz3Qe5GCgFzYowpMrcxUC24iduIdMwwhRM7rKg
+7GtIWMSrFfuI1XCLRmSlhDbhNN6fVg2f8Bo9PdH9ihiIyxSrc+FOUasUYCCJvlSZ
+8hFUlLvcmrZlWuazohm0lsXuMK1JflmQr/DA/uXxP9xzFfRy+RU3jDyxJbRHAgMB
+AAGjUzBRMB0GA1UdDgQWBBSQJyxiPMRK01i+0BsV9zUwDiBaHzAfBgNVHSMEGDAW
+gBSQJyxiPMRK01i+0BsV9zUwDiBaHzAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3
+DQEBCwUAA4ICAQCR+7a7N/m+WLkxPPIA/CB4MOr2Uf8ixTv435Nyv6rXOun0+lTP
+ExSZ0uYQ+L0WylItI3cQHULldDueD+s8TGzxf5woaLKf6tqyr0NYhKs+UeNEzDnN
+9PHQIhX0SZw3XyXGUgPNBfRCg2ZDdtMMdOU4XlQN/IN/9hbYTrueyY7eXq9hmtI9
+1srftAMqr9SR1JP7aHI6DVgrEsZVMTDnfT8WmLSGLlY1HmGfdEn1Ip5sbo9uSkiH
+AEPgPfjYIvR5LqTOMn4KsrlZyBbFIDh9Sl99M1kZzgH6zUGVLCDg1y6Cms69fx/e
+W1HoIeVkY4b4TY7Bk7JsqyNhIuqu7ARaxkdaZWhYaA2YyknwANdFfNpfH+elCLIk
+BUt5S3f4i7DaUePTvKukCZiCq4Oyln7RcOn5If73wCeLB/ZM9Ei1HforyLWP1CN8
+XLfpHaoeoPSWIveI0XHUl65LsPN2UbMbul/F23hwl+h8+BLmyAS680Yhn4zEN6Ku
+B7Po90HoFa1Du3bmx4jsN73UkT/dwMTi6K072FbipnC1904oGlWmLwvAHvrtxxmL
+Pl3pvEaZIu8wa/PNF6Y7J7VIewikIJq6Ta6FrWeFfzMWOj2qA1ZZi6fUaDSNYvuV
+J5quYKCc/O+I/yDDf8wyBbZ/gvUXzUHTMYGG+bFrn1p7XDbYYeEJ6R/xEg==
+-----END CERTIFICATE-----

Lib/test/certdata/ssl_cert.pem

@@ -0,0 +1,27 @@
+-----BEGIN CERTIFICATE-----
+MIIEgzCCAuugAwIBAgIUU+FIM/dUbCklbdDwNPd2xemDAEwwDQYJKoZIhvcNAQEL
+BQAwXzELMAkGA1UEBhMCWFkxFzAVBgNVBAcMDkNhc3RsZSBBbnRocmF4MSMwIQYD
+VQQKDBpQeXRob24gU29mdHdhcmUgRm91bmRhdGlvbjESMBAGA1UEAwwJbG9jYWxo
+b3N0MB4XDTIzMTEyNTA0MjEzNloXDTQzMDEyNDA0MjEzNlowXzELMAkGA1UEBhMC
+WFkxFzAVBgNVBAcMDkNhc3RsZSBBbnRocmF4MSMwIQYDVQQKDBpQeXRob24gU29m
+dHdhcmUgRm91bmRhdGlvbjESMBAGA1UEAwwJbG9jYWxob3N0MIIBojANBgkqhkiG
+9w0BAQEFAAOCAY8AMIIBigKCAYEAzXTIl1su11AGu6sDPsoxqcRGyAX0yjxIcswF
+vj+eW/fBs2GcBby95VEOKpJPKRYYB7fAEAjAKK59zFdsDX/ynxPZLqyLQocBkFVq
+tclhCRZu//KZND+uQuHSx3PjGkSvK/nrGjg5T0bkM4SFeb0YdLb+0aDTKGozUC82
+oBAilNcrFz1VXpEF0qUe9QeKQhyd0MaW5T1oSn+U3RAj2MXm3TGExyZeaicpIM5O
+HFlnwUxsYSDZo0jUj342MbPOZh8szZDWi042jdtSA3i8uMSplEf4O8ZPmX0JCtrz
+fVjRVdaKXIjrhMNWB8K44q6AeyhqJcVHtOmPYoHDm0qIjcrurt0LZaGhmCuKimNd
+njcPxW0VQmDIS/mO5+s24SK+Mpznm5q/clXEwyD8FbrtrzV5cHCE8eNkxjuQjkmi
+wW9uadK1s54tDwRWMl6DRWRyxoF0an885UQWmbsgEB5aRmEx2L0JeD0/q6Iw1Nta
+As8DG4AaWuYMrgZXz7XvyiMq3IxVAgMBAAGjNzA1MBQGA1UdEQQNMAuCCWxvY2Fs
+aG9zdDAdBgNVHQ4EFgQUl2wd7iWE1JTZUVq2yFBKGm9N36owDQYJKoZIhvcNAQEL
+BQADggGBAF0f5x6QXFbgdyLOyeAPD/1DDxNjM68fJSmNM/6vxHJeDFzK0Pja+iJo
+xv54YiS9F2tiKPpejk4ujvLQgvrYrTQvliIE+7fUT0dV74wZKPdLphftT9uEo1dH
+TeIld+549fqcfZCJfVPE2Ka4vfyMGij9hVfY5FoZL1Xpnq/ZGYyWZNAPbkG292p8
+KrfLZm/0fFYAhq8tG/6DX7+2btxeX4MP/49tzskcYWgOjlkknyhJ76aMG9BJ1D7F
+/TIEh5ihNwRTmyt023RBz/xWiN4xBLyIlpQ6d5ECKmFNFr0qnEui6UovfCHUF6lZ
+qcAQ5VFQQ2CayNlVmQ+UGmWIqANlacYWBt7Q6VqpGg24zTMec1/Pqd6X07ScSfrm
+MAtywrWrU7p1aEkN5lBa4n/XKZHGYMjor/YcMdF5yjdSrZr274YYO1pafmTFwRwH
+5o16c8WPc0aPvTFbkGIFT5ddxYstw+QwsBtLKE2lJ4Qfmxt0Ew/0L7xkbK1BaCOo
+EGD2IF7VDQ==
+-----END CERTIFICATE-----

Lib/test/certdata/ssl_key.passwd.pem

@@ -0,0 +1,42 @@
+-----BEGIN ENCRYPTED PRIVATE KEY-----
+MIIHbTBXBgkqhkiG9w0BBQ0wSjApBgkqhkiG9w0BBQwwHAQIsc9l0YPybNICAggA
+MAwGCCqGSIb3DQIJBQAwHQYJYIZIAWUDBAEqBBDxb9ekR9MERvIff73hFLc6BIIH
+ENhkFePApZj7ZqpjBltINRnaZhu8sEfG1/y3ejDBOa5Sq3C/UPykPfJh0IXsraAB
+STZO22UQEDpJzDnf1aLCo2cJpdz4Mr+Uj8OUdPiX83OlhC36gMrkgSYUdhSFQEas
+MLiBnXU6Z5Mv1Lxe7TJrnMyA4A8JYXXu5XVTErJrC0YT6iCPQh7eAoEtml9a/tJM
+OPg6kn58zmzVDp8LAau4Th1yhdD/cUQM09wg2i5JHLeC9akD+CkNlujVoAirLMTh
+xoMXTy2dkv/lIwI9QVx6WE/VKIngBAPIi3Q+YCIm0PaTgWj5U10C8j4t7kW2AEZK
+z82+vDOpLRGLo/ItNCO9F/a9e4PK4xxwFCOfR80tQNhs5gjKnbDz5IQv2p+pUfUX
+u+AIO0rBb3M9Yya1MC2pc5VLAeQ3UF6YPrNyNjoDsQOytY3YtRVyxiKW72QzeUcX
+Vpc3U6u8ZyHhkxK6bMv3dkPHGW1MOBd9/U5z+9lhHOfCGFStIQ9M8N48ZCWEGyty
+oZT3UApxgqiBAi1h14ZyagA2mjsMNtTmmkSa3v26WUfrwnjm7LD1/0Vm+ptBOFH2
+CkP/aAvr8Ie+ehWobXGpqwB6rlOAwdpPrePtEZiZtdt58anmCquRgE5GIYtVz30f
+flRABM8waJ196RDGkNAmDA3p/sqHy4vbsIOMl8faZ3QxvGVZlPbUEwPhiTIetA5Q
+95fT/uIcuBLfpbaN23j/Av3LiJAeABSmGZ+dA+NXC5UMvuX8COyBU0YF2V6ofpIu
+gP3UC7Tn4yV3Pbes81LEDCskaN6qVRil47l0G+dNcEHVkrGKcSaRCN+joBSCbuin
+Rol34ir9azh8DqHRKdVlLlzTmDQcOwmi0Vx0ASgBXx4UI3IfK45gLJVoz6dkUz+3
+GIPrnh5cw2DvIgIApwmuCQUXPbWZwUW0zuyzhtny9W6S72GUE/P5oUCV+kGYBsup
+FNiAyR9+n/xUuzB5HqIosj4rX+M4il4Ovt+KaCO6/COi+YjAO/9EnSttu8OTxsXl
+wvgblsT7Y1d+iUfmIVNGtbc5NX46ktrbGiqgPX7oR7YDy5/+FQlnPS1YL0ThUiAC
+2RbItu6b0uUyfu2jfWaGqy+SiRZ81rLwKPU3vJSEPfooVcJTG49EE006ZC4TvRzu
+fNkId+P+BxvhEpUM4+VKzfzViEPuzR1u/DuwLAavS7nr5qb+zaUq+Fte5vDQmjjC
+fflT8hS0BGpYEGndeZT4k+mZunHgs3NVUQ4/HW0nflf1j6qAn4+yIB79dH9d/ubt
+RyBG29K+rN0TI/kH9BQZfsAcbnmhpT/ud0mJfeHZ0Lknn6mdJ/k4LXN0T1IlLKz3
+cSleOWY3zjKaOsbuju1o5IiVIr+AF/w+M4nzzDX6DDVpBPAt9iUnDGqjh6mJ3QWQ
+CyCJDLNP0X8rZ8va2KOPorIBhmfDwJKEtIoXkb2hqWURTE0chC444QqiMsMXsX6+
+mOmiWGkdBFnEpGITISFTGERCjEfqOgTMweCANpquiLymJXgDURL603N2WexSgwnu
+Gy1Ws1cA+1cT65ZLqjSqayZ6WdQvsKBBAnGW5LbwBhoCkX0vahs5nZiw0KnskP60
+wNMnyxaS1SuDJ65n+vuLUl7WeysRyz10RWliYZFiUE7jIXfWeYGonAo4eyCEeV/f
+HInxxpswsg/na8BGBPMsx2SfBIiIvSIT4VNxHrL3sIfDrnb2HH/ut/oSLBgSKzY5
+DdkPz309kMM5dqnHANAgRrtVhqzLQE3kNGZ9mO/X1FAyXx8eB7NSeB6ysD8CAHvm
+lkyfsGTzVsnuWWpeHqplds0wx5+XouVtFRI5J3RGa39mbpM1hMyIbS0O24CBKW6K
+7n2UunbABwepL1hSa4e01OPdz4Zx/oayOevTtlfVqh68cEEc6ePdzf7z69pjot7B
+eqlNaqa1POOmkuygL+fiP1BAR3rGEoQKXqb+6JjzLM9CnhCQHHPR2UdqukkEYwsa
+bh9CU8AlfAJ19KFDria4JZXtl8LLMLLqWIO8fmQx7VqkEkEkl8jecO8YMaZTzFEb
+bW7QtIZ1qHWH0UIHH3Qlav72NJTKvGIbtp1JNrLdsHcYNcojLZkEeA83UPaiTB2R
+udltVUd016cktRVzLOKrust8kzPq3iSjpoIXFyFqIYHvWxGHgc7qD5gVBlazqSsV
+qudDv+0PCBjLWLjS6HkFI8BfyXd3ME2wvSmTzSSgSh4nVJNNrZ/RVTtQ5MLVcdh0
+sJ3qsq2Pokf61XXjsTiQorX+cgI9zF6zETXHvnLf9FL+G/VSlcLUsQ0wC584qwQt
+OSASYTbM79xgmjRmolZOptcYXGktfi2C4iq6V6zpFJuNMVgzZ+SbaQw9bvzUo2jG
+VMwrTuQQ+fsAyn66WZvtkSGAdp58+3PNq31ZjafJXBzN
+-----END ENCRYPTED PRIVATE KEY-----

Lib/test/certdata/ssl_key.pem

@@ -0,0 +1,40 @@
+-----BEGIN PRIVATE KEY-----
+MIIG/QIBADANBgkqhkiG9w0BAQEFAASCBucwggbjAgEAAoIBgQDNdMiXWy7XUAa7
+qwM+yjGpxEbIBfTKPEhyzAW+P55b98GzYZwFvL3lUQ4qkk8pFhgHt8AQCMAorn3M
+V2wNf/KfE9kurItChwGQVWq1yWEJFm7/8pk0P65C4dLHc+MaRK8r+esaODlPRuQz
+hIV5vRh0tv7RoNMoajNQLzagECKU1ysXPVVekQXSpR71B4pCHJ3QxpblPWhKf5Td
+ECPYxebdMYTHJl5qJykgzk4cWWfBTGxhINmjSNSPfjYxs85mHyzNkNaLTjaN21ID
+eLy4xKmUR/g7xk+ZfQkK2vN9WNFV1opciOuEw1YHwrjiroB7KGolxUe06Y9igcOb
+SoiNyu6u3QtloaGYK4qKY12eNw/FbRVCYMhL+Y7n6zbhIr4ynOebmr9yVcTDIPwV
+uu2vNXlwcITx42TGO5COSaLBb25p0rWzni0PBFYyXoNFZHLGgXRqfzzlRBaZuyAQ
+HlpGYTHYvQl4PT+rojDU21oCzwMbgBpa5gyuBlfPte/KIyrcjFUCAwEAAQKCAYAO
+M1r0+TCy4Z1hhceu5JdLql0RELZTbxi71IW2GVwW87gv75hy3hGLAs/1mdC+YIBP
+MkBka1JqzWq0/7rgcP5CSAMsInFqqv2s7fZ286ERGXuZFbnInnkrNsQUlJo3E9W+
+tqKtGIM/i0EVHX0DRdJlqMtSjmjh43tB+M1wAUV+n6OjEtJue5wZK+AIpBmGicdP
+qZY+6IBnm8tcfzPXFRCoq7ZHdIu0jxnc4l2MQJK3DdL04KoiStOkSl8xDsI+lTtq
+D3qa41LE0TY8X2jJ/w6KK3cUeK7F4DQYs+kfCKWMVPpn0/5u6TbC1F7gLvkrseph
+7cIgrruNNs9iKacnR1w3U72R+hNxHsNfo4RGHFa192p/Mfc+kiBd5RNR/M9oHdeq
+U6T/+KM+QyF5dDOyonY0QjwfAcEx+ZsV72nj8AerjM907I6dgHo/9YZ2S1Dt/xuG
+ntD+76GDzmrOvXmmpF0DsTn+Wql7AC4uzaOjv6PVziqz03pR61RpjPDemyJEWMkC
+gcEA7BkGGX3enBENs3X6BYFoeXfGO/hV7/aNpA6ykLzw657dqwy2b6bWLiIaqZdZ
+u0oiY6+SpOtavkZBFTq4bTVD58FHL0n73Yvvaft507kijpYBrxyDOfTJOETv+dVG
+XiY8AUSAE6GjPi0ebuYIVUxoDnMeWDuRJNvTck4byn1hJ1aVlEhwXNxt/nAjq48s
+5QDuR6Z9F8lqEACRYCHSMQYFm35c7c1pPsHJnElX8a7eZ9lT7HGPXHaf/ypMkOzo
+dvJNAoHBAN7GhDomff/kSgQLyzmqKqQowTZlyihnReapygwr8YpNcqKDqq6VlnfH
+Jl1+qtSMSVI0csmccwJWkz1WtSjDsvY+oMdv4gUK3028vQAMQZo+Sh7OElFPFET3
+UmL+Nh73ACPgpiommsdLZQPcIqpWNT5NzO+Jm5xa+U9ToVZgQ7xjrqee5NUiMutr
+r7UWAz7vDWu3x7bzYRRdUJxU18NogGbFGWJ1KM0c67GUXu2E7wBQdjVdS78UWs+4
+XBxKQkG2KQKBwQCtO+M82x122BB8iGkulvhogBjlMd8klnzxTpN5HhmMWWH+uvI1
+1G29Jer4WwRNJyU6jb4E4mgPyw7AG/jssLOlniy0Jw32TlIaKpoGXwZbJvgPW9Vx
+tgnbDsIiR3o9ZMKMj42GWgike4ikCIc+xzRmvdMbHIHwUJfCfEtp9TtPGPnh9pDz
+og3XLsMNg52GXnt3+VI6HOCE41XH+qj2rZt5r2tSVXEOyjQ7R5mOzSeFfXJVwDFX
+v/a/zHKnuB0OAdUCgcBLrxPTEaqy2eMPdtZHM/mipbnmejRw/4zu7XYYJoG7483z
+SlodT/K7pKvzDYqKBVMPm4P33K/x9mm1aBTJ0ZqmL+a9etRFtEjjByEKuB89gLX7
+uzTb7MrNF10lBopqgK3KgpLRNSZWWNXrtskMJ5eVICdkpdJ5Dyst+RKR3siEYzU9
++yxxAFpeQsqB8gWORva/RsOR8yNjIMS3J9fZqlIdGA8ktPr0nEOyo96QQR5VdACE
+5rpKI2cqtM6OSegynOkCgcAnr2Xzjef6tdcrxrQrq0DjEFTMoCAxQRa6tuF/NYHV
+AK70Y4hBNX84Bvym4hmfbMUEuOCJU+QHQf/iDQrHXPhtX3X2/t8M+AlIzmwLKf2o
+VwCYnZ8SqiwSaWVg+GANWLh0JuKn/ZYyR8urR79dAXFfp0UK+N39vIxNoBisBf+F
+G8mca7zx3UtK2eOW8WgGHz+Y20VZy0m/nkNekd1ZTXoSGhL+iN4XsTRn1YQIn69R
+kNdcwhtZZ3dpChUdf+w/LIc=
+-----END PRIVATE KEY-----

Lib/test/certdata/talos-2019-0758.pem

@@ -0,0 +1,22 @@
+-----BEGIN CERTIFICATE-----
+MIIDqDCCApKgAwIBAgIBAjALBgkqhkiG9w0BAQswHzELMAkGA1UEBhMCVUsxEDAO
+BgNVBAMTB2NvZHktY2EwHhcNMTgwNjE4MTgwMDU4WhcNMjgwNjE0MTgwMDU4WjA7
+MQswCQYDVQQGEwJVSzEsMCoGA1UEAxMjY29kZW5vbWljb24tdm0tMi50ZXN0Lmxh
+bC5jaXNjby5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC63fGB
+J80A9Av1GB0bptslKRIUtJm8EeEu34HkDWbL6AJY0P8WfDtlXjlPaLqFa6sqH6ES
+V48prSm1ZUbDSVL8R6BYVYpOlK8/48xk4pGTgRzv69gf5SGtQLwHy8UPBKgjSZoD
+5a5k5wJXGswhKFFNqyyxqCvWmMnJWxXTt2XDCiWc4g4YAWi4O4+6SeeHVAV9rV7C
+1wxqjzKovVe2uZOHjKEzJbbIU6JBPb6TRfMdRdYOw98n1VXDcKVgdX2DuuqjCzHP
+WhU4Tw050M9NaK3eXp4Mh69VuiKoBGOLSOcS8reqHIU46Reg0hqeL8LIL6OhFHIF
+j7HR6V1X6F+BfRS/AgMBAAGjgdYwgdMwCQYDVR0TBAIwADAdBgNVHQ4EFgQUOktp
+HQjxDXXUg8prleY9jeLKeQ4wTwYDVR0jBEgwRoAUx6zgPygZ0ZErF9sPC4+5e2Io
+UU+hI6QhMB8xCzAJBgNVBAYTAlVLMRAwDgYDVQQDEwdjb2R5LWNhggkA1QEAuwb7
+2s0wCQYDVR0SBAIwADAuBgNVHREEJzAlgiNjb2Rlbm9taWNvbi12bS0yLnRlc3Qu
+bGFsLmNpc2NvLmNvbTAOBgNVHQ8BAf8EBAMCBaAwCwYDVR0fBAQwAjAAMAsGCSqG
+SIb3DQEBCwOCAQEAvqantx2yBlM11RoFiCfi+AfSblXPdrIrHvccepV4pYc/yO6p
+t1f2dxHQb8rWH3i6cWag/EgIZx+HJQvo0rgPY1BFJsX1WnYf1/znZpkUBGbVmlJr
+t/dW1gSkNS6sPsM0Q+7HPgEv8CPDNK5eo7vU2seE0iWOkxSyVUuiCEY9ZVGaLVit
+p0C78nZ35Pdv4I+1cosmHl28+es1WI22rrnmdBpH8J1eY6WvUw2xuZHLeNVN0TzV
+Q3qq53AaCWuLOD1AjESWuUCxMZTK9DPS4JKXTK8RLyDeqOvJGjsSWp3kL0y3GaQ+
+10T1rfkKJub2+m9A9duin1fn6tHc2wSvB7m3DA==
+-----END CERTIFICATE-----

Lib/test/keycert.passwd.pem

@@ -1,50 +0,0 @@
------BEGIN RSA PRIVATE KEY-----
-Proc-Type: 4,ENCRYPTED
-DEK-Info: DES-EDE3-CBC,E74528136B90D2DD
-
-WRHVD2PJXPqjFSHg92HURIsUzvsTE4a9oi0SC5yMBFKNWA5Z933gK3XTifp6jul5
-zpNYi8jBXZ2EqJJBxCuVcefmXSxL0q7CMej25TdIC4BVAFJVveeprHPUFkNB0IM1
-go5Lg4YofYqTCg3OE3k7WvfR3Zg1cRYxksDKO+WNZgWyKBex5X4vjOiyUqDl3GKt
-kQXnkg1VgPV2Vrx93S9XNdELNRTguwf+XG0fkhtYhp/zCto8uKTgy5elK2P/ulGp
-7fe6uj7h/uN9L7EOC6CjRkitywfeBUER739mOcGT4imSFJ9G27TCqPzj2ea3uuaf
-/v1xhkQ4M6lNY/gcRfgVpCXhW43aAQV8XXQRMJTqLmz5Y5hYTKn+Ugq5vJ/ngyRM
-lu1gUJnYYaemBTb4hbm6aBvnYK9mORa891Pmf+vxU9rYuQIdVAhvvXh4KBreSEBI
-1AFy6dFKXl8ZKs6Wrq5wPefmFFkRmZ8OBiiq0fp2ApCRGZw6LsjCgwrRM38JiY7d
-3OdsJpKvRYufgUyuuzUE0xA+E4yMvD48M9pPq2fC8O5giuGL1uEekQWXJuq+6ZRI
-XYKIeSkuQALbX3RAzCPXTUEMtCYXKm/gxrrwJ+Bet4ob2amf3MX0uvWwOuAq++Fk
-J0HFSBxrwvIWOhyQXOPuJdAN8PXA7dWOXfOgOMF0hQYqZCl3T4TiVZJbwVQtg1sN
-dO7oAD5ZPHiKzvveZuB6k1FlBG8j0TyAC+44ChxkPDD3jF4dd6zGe62sDf85p4/d
-W80gxJeD3xnDxG0ePPns+GuKUpUaWS7WvHtDpeFW1JEhvOqf8p1Li9a7RzWVo8ML
-mGTdQgBIYIf6/fk69pFKl0nKtBU75KaunZz4nAmd9bNED4naDurMBg44u5TvODbJ
-vgYIYXIYjNvONbskJatVrrTS8zch2NwVIjCi8L/hecwBXbIXzo1pECpc6BU7sQT8
-+i9sDKBeJcRipzfKZNHvnO19mUZaPCY8+a/f9c21DgKXz+bgLcJbohpSaeGM8Gfc
-aZd3Vp9n3OJ3g2zQR1++HO9v1vR/wLELu6MeydkvMduHLmOPCn54gZ9z51ZNPAwa
-qfFIsH+mLh9ks0H74ssF59uIlstkgB9zmZHv/Q0dK9ZfG/VEH6rSgdETWhZxhoMQ
-Z92jXBEFT0zhI3rrIPNY+XS7eJCQIc1wc84Ea3cRk7SP+S1og3JtAxX56ykUwtkM
-LQ/Dwwa6h1aqD0l2d5x1/BSdavtTuSegISRWQ4iOmSvEdlFP7H4g6RZk/okbLzMD
-Evq5gNc7vlXhVawoQU8JCanJ5ZbbWnIRZfiXxBQS4lpYPKvJt4ML9z/x+82XxcXv
-Z93N2Wep7wWW5OwS2LcQcOgZRDSIPompwo/0pMFGOS+5oort0ZDRHdmmGLjvBcCb
-1KQmKQ4+8brI/3rjRzts6uDLjTGNxSCieNsnqhwHUv9Mg9WDSWupcGa+x27L89x3
-rObf6+3umcFLSjIzU8wuv1hx/e/y98Kv7BDBNYpAr6kVMrLnzYjAfJbBmqlxkzkQ
-IgQzgrk2QZoTdgwR+S374NAMO0AE5IlO+/qa6qp2SORGTDX64I3UNw==
------END RSA PRIVATE KEY-----
------BEGIN CERTIFICATE-----
-MIIDWTCCAkGgAwIBAgIJAPm6B21bar2bMA0GCSqGSIb3DQEBCwUAMF8xCzAJBgNV
-BAYTAlhZMRcwFQYDVQQHDA5DYXN0bGUgQW50aHJheDEjMCEGA1UECgwaUHl0aG9u
-IFNvZnR3YXJlIEZvdW5kYXRpb24xEjAQBgNVBAMMCWxvY2FsaG9zdDAeFw0xODAx
-MTkxOTA5MDZaFw0yODAxMTcxOTA5MDZaMF8xCzAJBgNVBAYTAlhZMRcwFQYDVQQH
-DA5DYXN0bGUgQW50aHJheDEjMCEGA1UECgwaUHl0aG9uIFNvZnR3YXJlIEZvdW5k
-YXRpb24xEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEBBQADggEP
-ADCCAQoCggEBAKvvsX2gEti4shve3iYMc+jE4Se7WHs1Bol2f21H8qNboDOFdeb1
-RKHjmq3exHpajywOUEgne9nKHJY/3f2phR4Y5klqG6liLgiSpVyRlcBGbeT2qEAj
-9oLiLFUXLGfGDds2mTwivQDLJBWi51j7ff5k2Pr58fN5ugYMn24T9FNyn0moT+qj
-SFoBNm58l9jrdkJSlgWfqPlbiMa+mqDn/SFtrwLF2Trbfzu42Sd9UdIzMaSSrzbN
-sGm53pNhCh8KndWUQ8GPP2IsLPoUU4qAtmZuTxCx2S1cXrN9EkmT69tlOH84YfSn
-96Ih9bWRc7M5y5bfVdEVM+fKQl3hBRf05qMCAwEAAaMYMBYwFAYDVR0RBA0wC4IJ
-bG9jYWxob3N0MA0GCSqGSIb3DQEBCwUAA4IBAQAtQ8f37cCEk7/rAcbYR53ce3iK
-Vpihb0U2ni1QjG9Tg9UIExkIGkwTiCm7kwQL+GEStBu9AG/QVrOjeTriRiddhWkk
-ze8kRaI3AC/63t6Vh9Q1x6PESgeE4OtAO9JpJCf4GILglA789Y/b/GF8zJZQxR13
-qpB4ZwWw7gCBhdEW59u6CFeBmfDa58hM8lWvuVoRrTi7bjUeC6PAn5HVMzZSykhu
-4HaUfBp6bKFjuym2+h/VvM1n8C3chjVSmutsLb6ELdD8IK0vPV/yf5+LN256zSsS
-dyUZYd8XwQaioEMKdbhLvnehyzHiWfQIUR3BdhONxoIJhHv/EAo8eCkHHYIF
------END CERTIFICATE-----

Lib/test/keycert.pem

@@ -1,48 +0,0 @@
------BEGIN PRIVATE KEY-----
-MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCr77F9oBLYuLIb
-3t4mDHPoxOEnu1h7NQaJdn9tR/KjW6AzhXXm9USh45qt3sR6Wo8sDlBIJ3vZyhyW
-P939qYUeGOZJahupYi4IkqVckZXARm3k9qhAI/aC4ixVFyxnxg3bNpk8Ir0AyyQV
-oudY+33+ZNj6+fHzeboGDJ9uE/RTcp9JqE/qo0haATZufJfY63ZCUpYFn6j5W4jG
-vpqg5/0hba8Cxdk62387uNknfVHSMzGkkq82zbBpud6TYQofCp3VlEPBjz9iLCz6
-FFOKgLZmbk8QsdktXF6zfRJJk+vbZTh/OGH0p/eiIfW1kXOzOcuW31XRFTPnykJd
-4QUX9OajAgMBAAECggEAHppmXDbuw9Z0FVPg9KLIysioTtsgz6VLiZIm8juZK4x2
-glUh/D7xvWL2uDXrgN+3lh7iGUW13LkFx5SMncbbo9TIwI57Z/XKvcnkVwquve+L
-RfLFVc1Q5lD9lROv2rS86KTaN4LzYz3FKXi6dvMkpPAsUtfEQhMLkmISypQQq/1z
-EJaqo7r85OjN7e0wKazlKZpOzJEa5FQLMVRjTRFhLFNbHXX/tAet2jw+umATKbw8
-hYgiuZ44TwSEd9JeIV/oSYWfI/3HetuYW0ru3caiztRF2NySNu8lcsWgNC7fIku9
-mcHjtSNzs91QN1Qlu7GQvvhpt6OWDirNDCW+49WGaQKBgQDg9SDhfF0jRYslgYbH
-cqO4ggaFdHjrAAYpwnAgvanhFZL/zEqm5G1E7l/e2fCkJ9VOSFO0A208chvwMcr+
-dCjHE2tVdE81aQ2v/Eo83VdS1RcOV4Y75yPH48rMhxPaHvxWD/FFDbf0/P2mtPB7
-SZ3kIeZMkE1wxdaO3AKUbQoozwKBgQDDqYgg7kVtygyICE1mB8Hwp6nUxFTczG7y
-4XcsDqMIrKmw+PbQluvkoHoStxeVrsTloDhkTjIrpmYLyAiazg+PUJdkd6xrfLSj
-VV6X93W0S/1egEb1F1CGFxtk8v/PWH4K76EPL2vxXdxjywz3GWlrL9yDYaB2szzS
-DqgwVMqx7QKBgDCD7UF0Bsoyl13RX3XoPXLvZ+SkR+e2q52Z94C4JskKVBeiwX7Y
-yNAS8M4pBoMArDoj0xmBm69rlKbqtjLGbnzwrTdSzDpim7cWnBQgUFLm7gAD1Elb
-AhZ8BCK0Bw4FnLoa2hfga4oEfdfUMgEE0W5/+SEOBgWKRUmuHUhRc911AoGAY2EN
-YmSDYSM5wDIvVb5k9B3EtevOiqNPSw/XnsoEZtiEC/44JnQxdltIBY93bDBrk5IQ
-cmoBM4h91kgQjshQwOMXMhFSwvmBKmCm/hrTbvMVytTutXfVD3ZXFKwT4DW7N0TF
-ElhsxBh/YzRz7mG62JVjtFt2zDN3ld2Z8YpvtXUCgYEA4EJ4ObS5YyvcXAKHJFo6
-Fxmavyrf8LSm3MFA65uSnFvWukMVqqRMReQc5jvpxHKCis+XvnHzyOfL0gW9ZTi7
-tWGGbBi0TRJCa8BkvgngUZxOxUlMfg/7cVxOIB0TPoUSgxFd/+qVz4GZMvr0dPu7
-eAF7J/8ECVvb0wSPTUI1N3c=
------END PRIVATE KEY-----
------BEGIN CERTIFICATE-----
-MIIDWTCCAkGgAwIBAgIJAPm6B21bar2bMA0GCSqGSIb3DQEBCwUAMF8xCzAJBgNV
-BAYTAlhZMRcwFQYDVQQHDA5DYXN0bGUgQW50aHJheDEjMCEGA1UECgwaUHl0aG9u
-IFNvZnR3YXJlIEZvdW5kYXRpb24xEjAQBgNVBAMMCWxvY2FsaG9zdDAeFw0xODAx
-MTkxOTA5MDZaFw0yODAxMTcxOTA5MDZaMF8xCzAJBgNVBAYTAlhZMRcwFQYDVQQH
-DA5DYXN0bGUgQW50aHJheDEjMCEGA1UECgwaUHl0aG9uIFNvZnR3YXJlIEZvdW5k
-YXRpb24xEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEBBQADggEP
-ADCCAQoCggEBAKvvsX2gEti4shve3iYMc+jE4Se7WHs1Bol2f21H8qNboDOFdeb1
-RKHjmq3exHpajywOUEgne9nKHJY/3f2phR4Y5klqG6liLgiSpVyRlcBGbeT2qEAj
-9oLiLFUXLGfGDds2mTwivQDLJBWi51j7ff5k2Pr58fN5ugYMn24T9FNyn0moT+qj
-SFoBNm58l9jrdkJSlgWfqPlbiMa+mqDn/SFtrwLF2Trbfzu42Sd9UdIzMaSSrzbN
-sGm53pNhCh8KndWUQ8GPP2IsLPoUU4qAtmZuTxCx2S1cXrN9EkmT69tlOH84YfSn
-96Ih9bWRc7M5y5bfVdEVM+fKQl3hBRf05qMCAwEAAaMYMBYwFAYDVR0RBA0wC4IJ
-bG9jYWxob3N0MA0GCSqGSIb3DQEBCwUAA4IBAQAtQ8f37cCEk7/rAcbYR53ce3iK
-Vpihb0U2ni1QjG9Tg9UIExkIGkwTiCm7kwQL+GEStBu9AG/QVrOjeTriRiddhWkk
-ze8kRaI3AC/63t6Vh9Q1x6PESgeE4OtAO9JpJCf4GILglA789Y/b/GF8zJZQxR13
-qpB4ZwWw7gCBhdEW59u6CFeBmfDa58hM8lWvuVoRrTi7bjUeC6PAn5HVMzZSykhu
-4HaUfBp6bKFjuym2+h/VvM1n8C3chjVSmutsLb6ELdD8IK0vPV/yf5+LN256zSsS
-dyUZYd8XwQaioEMKdbhLvnehyzHiWfQIUR3BdhONxoIJhHv/EAo8eCkHHYIF
------END CERTIFICATE-----

Lib/test/keycert2.pem

@@ -1,49 +0,0 @@
------BEGIN PRIVATE KEY-----
-MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQC3ulRNfhbOAey/
-B+wIVYx+d5az7EV4riR6yi/qE6G+bxbTvay2pqySHtDweuaYSh2cVmcasBKKIFJm
-rCD1zR8UmLb5i2XFIina1t3eePCuBZMrvZZwkzlQUSM1AZtjGOO/W0I3FwO6y645
-9xA5PduKI7SMYkH/VL3zE5W1JwMovv6bvNiT+GU5l6mB9ylCTgLpmUqoQhRqz/35
-zCzVyoh+ppDvVcpWYfvXywsXsgQwbAF0QJm8SSFi0TZm5ykv4WE16afQp08yuZS0
-3U4K3MJCa4rxO58edcxBopWYfQ29K3iINM8enRfr5q+u5mAAbALAEEvyFjgLWl/u
-7arxn7bJAgMBAAECggEBAJfMt8KfHzBunrDnVrk8FayYGkfmOzAOkc1yKEx6k/TH
-zFB+Mqlm5MaF95P5t3S0J+r36JBAUdEWC38RUNpF9BwMYYGlDxzlsTdCuGYL/q+J
-o6NMLXQt7/jQUQqGnWAvPFzqhbcGqOo5R2ZVH25sEWv9PDuRI35XAepIkDTwWsfa
-P6UcJJoP+4v9B++fb3sSL4zNwp1BqS4wxR8YTR0t1zQqOxJ5BGPw1J8aBMs1sq5t
-qyosAQAT63kLrdqWotHaM26QxjqEQUMlh12XMWb5GdBXUxbvyGtEabsqskGa/f8B
-RdHE437J8D8l+jxb2mZLzrlaH3dq2tbFGCe1rT8qLRECgYEA5CWIvoD/YnQydLGA
-OlEhCSocqURuqcotg9Ev0nt/C60jkr/NHFLGppz9lhqjIDjixt3sIMGZMFzxRtwM
-pSYal3XiR7rZuHau9iM35yDhpuytEiGbYy1ADakJRzY5jq/Qa8RfPP9Atua5xAeP
-q6DiSnq9vhHv9G+O4MxzHBmrw9sCgYEAziiJWFthcwvuXn3Jv9xFYKEb/06puZAx
-EgQCz/3rPzv5fmGD/sKVo1U/K4z/eA82DNeKG8QRTFJCxT8TCNRxOmGV7HdCYo/B
-4BTNNvbKcdi3l0j75kKoADg+nt5CD5lz6gLG0GrUEnVO1y5HVfCTb3BEAfa36C85
-9i0sfQGiwysCgYEAuus9k8cgdct5oz3iLuVVSark/JGCkT2B+OOkaLChsDFUWeEm
-7TOsaclpwldkmvvAYOplkZjMJ2GelE2pVo1XcAw3LkmaI5WpVyQXoxe/iQGT8qzy
-IFlsh0Scw2lb0tmcyw6CcPk4TiHOxRrkzNrtS9QwLM+JZx0XVHptPPKTVc0CgYAu
-j/VFYY5G/8Dc0qhIjyWUR48dQNUQtkJ/ASzpcT46z/7vznKTjbtiYpSb74KbyUO5
-7sygrM4DYOj3x+Eys1jHiNbly6HQxQtS4x/edCsRP5NntfI+9XsgYZOzKhvdjhki
-F3J0DEzNxnUCIM+311hVaRPTJbgv1srOkTFlIoNydQKBgQC6/OHGaC/OewQqRlRK
-Mg5KZm01/pk4iKrpA5nG7OTAeoa70NzXNtG8J3WnaJ4mWanNwNUOyRMAMrsUAy9q
-EeGqHM5mMFpY4TeVuNLL21lu/x3KYw6mKL3Ctinn+JLAoYoqEy8deZnEA5/tjYlz
-YhFBchnUicjoUN1chdpM6SpV2Q==
------END PRIVATE KEY-----
------BEGIN CERTIFICATE-----
-MIIDYjCCAkqgAwIBAgIJALJXRr8qF6oIMA0GCSqGSIb3DQEBCwUAMGIxCzAJBgNV
-BAYTAlhZMRcwFQYDVQQHDA5DYXN0bGUgQW50aHJheDEjMCEGA1UECgwaUHl0aG9u
-IFNvZnR3YXJlIEZvdW5kYXRpb24xFTATBgNVBAMMDGZha2Vob3N0bmFtZTAeFw0x
-ODAxMTkxOTA5MDZaFw0yODAxMTcxOTA5MDZaMGIxCzAJBgNVBAYTAlhZMRcwFQYD
-VQQHDA5DYXN0bGUgQW50aHJheDEjMCEGA1UECgwaUHl0aG9uIFNvZnR3YXJlIEZv
-dW5kYXRpb24xFTATBgNVBAMMDGZha2Vob3N0bmFtZTCCASIwDQYJKoZIhvcNAQEB
-BQADggEPADCCAQoCggEBALe6VE1+Fs4B7L8H7AhVjH53lrPsRXiuJHrKL+oTob5v
-FtO9rLamrJIe0PB65phKHZxWZxqwEoogUmasIPXNHxSYtvmLZcUiKdrW3d548K4F
-kyu9lnCTOVBRIzUBm2MY479bQjcXA7rLrjn3EDk924ojtIxiQf9UvfMTlbUnAyi+
-/pu82JP4ZTmXqYH3KUJOAumZSqhCFGrP/fnMLNXKiH6mkO9VylZh+9fLCxeyBDBs
-AXRAmbxJIWLRNmbnKS/hYTXpp9CnTzK5lLTdTgrcwkJrivE7nx51zEGilZh9Db0r
-eIg0zx6dF+vmr67mYABsAsAQS/IWOAtaX+7tqvGftskCAwEAAaMbMBkwFwYDVR0R
-BBAwDoIMZmFrZWhvc3RuYW1lMA0GCSqGSIb3DQEBCwUAA4IBAQCZhHhGItpkqhEq
-ntMRd6Hv0GoOJixNvgeMwK4NJSRT/no3OirtUTzccn46h+SWibSa2eVssAV+pAVJ
-HbzkN/DH27A1mMx1zJL1ekcOKA1AF6MXhUnrUGXMqW36YNtzHfXJLrwvpLJ13OQg
-/Kxo4Nw68bGzM+PyRtKU/mpgYyfcvwR+ZSeIDh1fvUZK/IEVCf8ub42GPVs5wPfv
-M+k5aHxWTxeif3K1byTRzxHupYNG2yWO4XEdnBGOuOwzzN4/iQyNcsuQKeuKHGrt
-YvIlG/ri04CQ7xISZCj74yjTZ+/A2bXre2mQXAHqKPumHL7cl34+erzbUaxYxbTE
-u5FcOmLQ
------END CERTIFICATE-----

Lib/test/keycert3.pem

@@ -1,132 +0,0 @@
------BEGIN PRIVATE KEY-----
-MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDgV4G+Zzf2DT5n
-oAisIGFhn/bz7Vn5WiXUqbDsxROJOh/7BtOlduZka0pPhFylGbnxS8l1kEWHRI2T
-6hOoWzumB6ItKiN+T5J30lAvSyo7iwdFoAQ/S5nPXQfhNARQe/NEOhRtpcuNdyx4
-BWdPdPuJQA1ASNJCLwcLOoRxaLbKLvb2V5T5FCAkeNPtRvPuT4gKQItMmiHfAhoV
-C8MZWF/GC0RukHINys5MwqeFexam8CznmQPMYrLdhmKTj3DTivCPoh97EDIFGlgZ
-SCaaYDVQA+aqlo/q2pi52PFwC1KzhNEA7EeOqSwC1NQjwjHuhcnf9WbxrgTq2zh3
-rv5YEW2ZAgMBAAECggEAPfSMtTumPcJskIumuXp7yk02EyliZrWZqwBuBwVqHsS5
-nkbFXnXWrLbgn9MrDsFrE5NdgKUmPnQVMVs8sIr5jyGejSCNCs4I4iRn1pfIgwcj
-K/xEEALd6GGF0pDd/CgvB5GOoLVf4KKf2kmLvWrOKJpSzoUN5A8+v8AaYYOMr4sC
-czbvfGomzEIewEG+Rw9zOVUDlmwyEKPQZ47E7PQ+EEA7oeFdR+1Zj6eT9ndegf8B
-54frySYCLRUCk/sHCpWhaJBtBrcpht7Y8CfY7hiH/7x866fvuLnYPz4YALtUb0wN
-7zUCNS9ol3n4LbjFFKfZtiRjKaCBRzMjK0rz6ydFcQKBgQDyLI3oGbnW73vqcDe/
-6eR0w++fiCAVhfMs3AO/gOaJi2la2JHlJ5u+cIHQIOFwEhn6Zq0AtdmnFx1TS5IQ
-C0MdXI0XoQQw7rEF8EJcvfe85Z0QxENVhzydtdb8QpJfnQGfBfLyQlaaRYzRRHB6
-VdYUHF3EIPVIhbjbghal+Qep/QKBgQDtJlRPHkWwTMevu0J0fYbWN1ywtVTFUR//
-k7VyORSf8yuuSnaQRop4cbcqONxmDKH6Or1fl3NYBsAxtXkkOK1E2OZNo2sfQdRa
-wpA7o7mPHRhztQFpT5vflp+8P6+PEFat8D04eBOhNwrwwfhiPjD4gv5KvN4XutRW
-VWv/2pnmzQKBgHPvHGg2mJ7quvm6ixXW1MWJX1eSBToIjCe3lBvDi5nhIaiZ8Q4w
-7gA3QA3xD7tlDwauzLeAVxgEmsdbcCs6GQEfY3QiYy1Bt4FOSZa4YrcNfSmfq1Rw
-j3Y4rRjKjeQz96i3YlzToT3tecJc7zPBj+DEy6au2H3Fdn+vQURneWHJAoGBANG7
-XES8mRVaUh/wlM1BVsaNH8SIGfiHzqzRjV7/bGYpQTBbWpAuUrhCmaMVtpXqBjav
-TFwGLVRkZAWSYRjPpy2ERenT5SE3rv61o6mbGrifGsj6A82HQmtzYsGx8SmtYXtj
-REF0sKebbmmOooUAS379GrguYJzL9o6D7YfRZNrhAoGAVfb/tiFU4S67DSpYpQey
-ULhgfsFpDByICY6Potsg67gVFf9jIaB83NPTx3u/r6sHFgxFw7lQsuZcgSuWMu7t
-glzOXVIP11Y5sl5CJ5OsfeK1/0umMZF5MWPyAQCx/qrPlZL86vXjt24Y/VaOxsAi
-CZYdyJsjgOrJrWoMbo5ta54=
------END PRIVATE KEY-----
-Certificate:
-    Data:
-        Version: 3 (0x2)
-        Serial Number:
-            82:ed:bf:41:c8:80:91:9c
-    Signature Algorithm: sha1WithRSAEncryption
-        Issuer: C=XY, O=Python Software Foundation CA, CN=our-ca-server
-        Validity
-            Not Before: Jan 19 19:09:06 2018 GMT
-            Not After : Nov 28 19:09:06 2027 GMT
-        Subject: C=XY, L=Castle Anthrax, O=Python Software Foundation, CN=localhost
-        Subject Public Key Info:
-            Public Key Algorithm: rsaEncryption
-                Public-Key: (2048 bit)
-                Modulus:
-                    00:e0:57:81:be:67:37:f6:0d:3e:67:a0:08:ac:20:
-                    61:61:9f:f6:f3:ed:59:f9:5a:25:d4:a9:b0:ec:c5:
-                    13:89:3a:1f:fb:06:d3:a5:76:e6:64:6b:4a:4f:84:
-                    5c:a5:19:b9:f1:4b:c9:75:90:45:87:44:8d:93:ea:
-                    13:a8:5b:3b:a6:07:a2:2d:2a:23:7e:4f:92:77:d2:
-                    50:2f:4b:2a:3b:8b:07:45:a0:04:3f:4b:99:cf:5d:
-                    07:e1:34:04:50:7b:f3:44:3a:14:6d:a5:cb:8d:77:
-                    2c:78:05:67:4f:74:fb:89:40:0d:40:48:d2:42:2f:
-                    07:0b:3a:84:71:68:b6:ca:2e:f6:f6:57:94:f9:14:
-                    20:24:78:d3:ed:46:f3:ee:4f:88:0a:40:8b:4c:9a:
-                    21:df:02:1a:15:0b:c3:19:58:5f:c6:0b:44:6e:90:
-                    72:0d:ca:ce:4c:c2:a7:85:7b:16:a6:f0:2c:e7:99:
-                    03:cc:62:b2:dd:86:62:93:8f:70:d3:8a:f0:8f:a2:
-                    1f:7b:10:32:05:1a:58:19:48:26:9a:60:35:50:03:
-                    e6:aa:96:8f:ea:da:98:b9:d8:f1:70:0b:52:b3:84:
-                    d1:00:ec:47:8e:a9:2c:02:d4:d4:23:c2:31:ee:85:
-                    c9:df:f5:66:f1:ae:04:ea:db:38:77:ae:fe:58:11:
-                    6d:99
-                Exponent: 65537 (0x10001)
-        X509v3 extensions:
-            X509v3 Subject Alternative Name: 
-                DNS:localhost
-            X509v3 Key Usage: critical
-                Digital Signature, Key Encipherment
-            X509v3 Extended Key Usage: 
-                TLS Web Server Authentication, TLS Web Client Authentication
-            X509v3 Basic Constraints: critical
-                CA:FALSE
-            X509v3 Subject Key Identifier: 
-                85:11:BE:16:47:04:D1:30:EE:86:8A:18:70:BE:A8:28:6F:82:3D:CE
-            X509v3 Authority Key Identifier: 
-                keyid:9A:CF:CF:6E:EB:71:3D:DB:3C:F1:AE:88:6B:56:72:03:CB:08:A7:48
-                DirName:/C=XY/O=Python Software Foundation CA/CN=our-ca-server
-                serial:82:ED:BF:41:C8:80:91:9B
-
-            Authority Information Access: 
-                CA Issuers - URI:http://testca.pythontest.net/testca/pycacert.cer
-                OCSP - URI:http://testca.pythontest.net/testca/ocsp/
-
-            X509v3 CRL Distribution Points: 
-
-                Full Name:
-                  URI:http://testca.pythontest.net/testca/revocation.crl
-
-    Signature Algorithm: sha1WithRSAEncryption
-         7f:a1:7e:3e:68:01:b0:32:b8:57:b8:03:68:13:13:b3:e3:f4:
-         70:2f:15:e5:0f:87:b9:fd:e0:12:e3:16:f2:91:53:c7:4e:25:
-         af:ca:cb:a7:d9:9d:57:4d:bf:a2:80:d4:78:aa:04:31:fd:6d:
-         cc:6d:82:43:e9:62:16:0d:0e:26:8b:e7:f1:3d:57:5c:68:02:
-         9c:2b:b6:c9:fd:62:2f:10:85:88:cc:44:a5:e7:a2:3e:89:f2:
-         1f:02:6a:3f:d0:3c:6c:24:2d:bc:51:62:7a:ec:25:c5:86:87:
-         77:35:8f:f9:7e:d0:17:3d:77:56:bf:1a:0c:be:09:78:ee:ea:
-         73:97:65:60:94:91:35:b3:5c:46:8a:5e:6d:94:52:de:48:b7:
-         1f:6c:28:79:7f:ff:08:8d:e4:7d:d0:b9:0b:7c:ae:c4:1d:2a:
-         a1:b3:50:11:82:03:5e:6c:e7:26:fa:05:32:39:07:83:49:b9:
-         a2:fa:04:da:0d:e5:ff:4c:db:97:d0:c3:a7:43:37:4c:16:de:
-         3c:b5:e9:7e:82:d4:b3:10:df:d1:c1:66:72:9c:15:67:19:3b:
-         7b:91:0a:82:07:67:c5:06:03:5f:80:54:08:81:8a:b1:5c:7c:
-         4c:d2:07:38:92:eb:12:f5:71:ae:de:05:15:c8:e1:33:f0:e4:
-         96:0f:0f:1e
------BEGIN CERTIFICATE-----
-MIIE8TCCA9mgAwIBAgIJAILtv0HIgJGcMA0GCSqGSIb3DQEBBQUAME0xCzAJBgNV
-BAYTAlhZMSYwJAYDVQQKDB1QeXRob24gU29mdHdhcmUgRm91bmRhdGlvbiBDQTEW
-MBQGA1UEAwwNb3VyLWNhLXNlcnZlcjAeFw0xODAxMTkxOTA5MDZaFw0yNzExMjgx
-OTA5MDZaMF8xCzAJBgNVBAYTAlhZMRcwFQYDVQQHDA5DYXN0bGUgQW50aHJheDEj
-MCEGA1UECgwaUHl0aG9uIFNvZnR3YXJlIEZvdW5kYXRpb24xEjAQBgNVBAMMCWxv
-Y2FsaG9zdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAOBXgb5nN/YN
-PmegCKwgYWGf9vPtWflaJdSpsOzFE4k6H/sG06V25mRrSk+EXKUZufFLyXWQRYdE
-jZPqE6hbO6YHoi0qI35PknfSUC9LKjuLB0WgBD9Lmc9dB+E0BFB780Q6FG2ly413
-LHgFZ090+4lADUBI0kIvBws6hHFotsou9vZXlPkUICR40+1G8+5PiApAi0yaId8C
-GhULwxlYX8YLRG6Qcg3KzkzCp4V7FqbwLOeZA8xist2GYpOPcNOK8I+iH3sQMgUa
-WBlIJppgNVAD5qqWj+ramLnY8XALUrOE0QDsR46pLALU1CPCMe6Fyd/1ZvGuBOrb
-OHeu/lgRbZkCAwEAAaOCAcAwggG8MBQGA1UdEQQNMAuCCWxvY2FsaG9zdDAOBgNV
-HQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMAwGA1Ud
-EwEB/wQCMAAwHQYDVR0OBBYEFIURvhZHBNEw7oaKGHC+qChvgj3OMH0GA1UdIwR2
-MHSAFJrPz27rcT3bPPGuiGtWcgPLCKdIoVGkTzBNMQswCQYDVQQGEwJYWTEmMCQG
-A1UECgwdUHl0aG9uIFNvZnR3YXJlIEZvdW5kYXRpb24gQ0ExFjAUBgNVBAMMDW91
-ci1jYS1zZXJ2ZXKCCQCC7b9ByICRmzCBgwYIKwYBBQUHAQEEdzB1MDwGCCsGAQUF
-BzAChjBodHRwOi8vdGVzdGNhLnB5dGhvbnRlc3QubmV0L3Rlc3RjYS9weWNhY2Vy
-dC5jZXIwNQYIKwYBBQUHMAGGKWh0dHA6Ly90ZXN0Y2EucHl0aG9udGVzdC5uZXQv
-dGVzdGNhL29jc3AvMEMGA1UdHwQ8MDowOKA2oDSGMmh0dHA6Ly90ZXN0Y2EucHl0
-aG9udGVzdC5uZXQvdGVzdGNhL3Jldm9jYXRpb24uY3JsMA0GCSqGSIb3DQEBBQUA
-A4IBAQB/oX4+aAGwMrhXuANoExOz4/RwLxXlD4e5/eAS4xbykVPHTiWvysun2Z1X
-Tb+igNR4qgQx/W3MbYJD6WIWDQ4mi+fxPVdcaAKcK7bJ/WIvEIWIzESl56I+ifIf
-Amo/0DxsJC28UWJ67CXFhod3NY/5ftAXPXdWvxoMvgl47upzl2VglJE1s1xGil5t
-lFLeSLcfbCh5f/8IjeR90LkLfK7EHSqhs1ARggNebOcm+gUyOQeDSbmi+gTaDeX/
-TNuX0MOnQzdMFt48tel+gtSzEN/RwWZynBVnGTt7kQqCB2fFBgNfgFQIgYqxXHxM
-0gc4kusS9XGu3gUVyOEz8OSWDw8e
------END CERTIFICATE-----

Lib/test/keycert4.pem

@@ -1,132 +0,0 @@
------BEGIN PRIVATE KEY-----
-MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDH/76hZAZH4cSV
-CmVZa5HEqKCjCKrcPwBECs9BS+3ibwN4x9NnFNP+tCeFGgJXl7WGFoeXgg3oK+1p
-FsOWpsRHuF3BdqkCnShSydmT8bLaGHwKeL0cPxJP5T/uW7ezPKW2VWXGMwmwRaRJ
-9dj2VCUu20vDZWSGFr9zjnjoJczBtH3RsVUgpK7euEHuQ5pIM9QSOaCo+5FPR7s7
-1nU7YqbFWtd+NhC8Og1G497B31DQlHciF6BRm6/cNGAmHaAErKUGBFdkGtFPHBn4
-vktoEg9fwxJAZLvGpoTZWrB4HRsRwVTmFdGvK+JXK225xF23AXRXp/snhSuSFeLj
-E5cpyJJ7AgMBAAECggEAQOv527X2e/sDr0XSpHZQuT/r9UBpBlnFIlFH+fBF5k0X
-GWv0ae/O6U1dzs0kmX57xG0n0ry6+vTXeleTYiH8cTOd66EzN9AAOO+hG29IGZf9
-HAEZkkO/FARc/mjzdtFnEYsjIHWM3ZWdwQx3Q28JKu6w51rQiN51g3NqOCGdF/uF
-rE5XPKsKndn+nLHvsNuApFgUYZEwdrozgUueEgRaPTUCNhzotcA9eWoBdA24XNhk
-x8Cm/bZWabXm7gBO75zl3Cu2F21ay+EuwyOZTsx6lZi6YX9/zo1mkO81Zi3tQk50
-NMEI0feLNwsdxTbmOcVJadjOgd+QVghlFyr5HGBWMQKBgQD3AH3rhnAo6tOyNkGN
-+IzIU1MhUS452O7IavykUYO9sM24BVChpRtlI9Dpev4yE/q3BAO3+oWT3cJrN7/3
-iyo1dzAkpGvI65XWfElXFM4nLjEiZzx4W9fiPN91Oucpr0ED6+BZXTtz4gVm0TP/
-TUc2xvTB6EKvIyWmKOYEi0snxQKBgQDPSOjbz9jWOrC9XY7PmtLB6QJDDz7XSGVK
-wzD+gDAPpAwhk58BEokdOhBx2Lwl8zMJi0CRHgH2vNvkRyhvUQ4UFzisrqann/Tw
-klp5sw3iWC6ERC8z9zL7GfHs7sK3mOVeAdK6ffowPM3JrZ2vPusVBdr0MN3oZwki
-CtNXqbY1PwKBgGheQNbAW6wubX0kB9chavtKmhm937Z5v4vYCSC1gOEqUAKt3EAx
-L74wwBmn6rjmUE382EVpCgBM99WuHONQXmlxD1qsTw763LlgkuzE0cckcYaD8L06
-saHa7uDuHrcyYlpx1L5t8q0ol/e19i6uTKUMtGcq6OJwC3yGU4sgAIWxAoGBAMVq
-qiQXm2vFL+jafxYoXUvDMJ1PmskMsTP4HOR2j8+FrOwZnVk3HxGP6HOVOPRn4JbZ
-YiAT1Uj6a+7I+rCyINdvmlGUcTK6fFzW9oZryvBkjcD483/pkktmVWwTpa2YV/Ml
-h16IdsyUTGYlDUYHhXtbPUJOfDpIT4F1j/0wrFGfAoGAO82BcUsehEUQE0xvQLIn
-7QaFtUI5z19WW730jVuEobiYlh9Ka4DPbKMvka8MwyOxEwhk39gZQavmfG6+wZm+
-kjERU23LhHziJGWS2Um4yIhC7myKbWaLzjHEq72dszLpQku4BzE5fT60fxI7cURD
-WGm/Z3Q2weS3ZGIoMj1RNPI=
------END PRIVATE KEY-----
-Certificate:
-    Data:
-        Version: 3 (0x2)
-        Serial Number:
-            82:ed:bf:41:c8:80:91:9d
-    Signature Algorithm: sha1WithRSAEncryption
-        Issuer: C=XY, O=Python Software Foundation CA, CN=our-ca-server
-        Validity
-            Not Before: Jan 19 19:09:06 2018 GMT
-            Not After : Nov 28 19:09:06 2027 GMT
-        Subject: C=XY, L=Castle Anthrax, O=Python Software Foundation, CN=fakehostname
-        Subject Public Key Info:
-            Public Key Algorithm: rsaEncryption
-                Public-Key: (2048 bit)
-                Modulus:
-                    00:c7:ff:be:a1:64:06:47:e1:c4:95:0a:65:59:6b:
-                    91:c4:a8:a0:a3:08:aa:dc:3f:00:44:0a:cf:41:4b:
-                    ed:e2:6f:03:78:c7:d3:67:14:d3:fe:b4:27:85:1a:
-                    02:57:97:b5:86:16:87:97:82:0d:e8:2b:ed:69:16:
-                    c3:96:a6:c4:47:b8:5d:c1:76:a9:02:9d:28:52:c9:
-                    d9:93:f1:b2:da:18:7c:0a:78:bd:1c:3f:12:4f:e5:
-                    3f:ee:5b:b7:b3:3c:a5:b6:55:65:c6:33:09:b0:45:
-                    a4:49:f5:d8:f6:54:25:2e:db:4b:c3:65:64:86:16:
-                    bf:73:8e:78:e8:25:cc:c1:b4:7d:d1:b1:55:20:a4:
-                    ae:de:b8:41:ee:43:9a:48:33:d4:12:39:a0:a8:fb:
-                    91:4f:47:bb:3b:d6:75:3b:62:a6:c5:5a:d7:7e:36:
-                    10:bc:3a:0d:46:e3:de:c1:df:50:d0:94:77:22:17:
-                    a0:51:9b:af:dc:34:60:26:1d:a0:04:ac:a5:06:04:
-                    57:64:1a:d1:4f:1c:19:f8:be:4b:68:12:0f:5f:c3:
-                    12:40:64:bb:c6:a6:84:d9:5a:b0:78:1d:1b:11:c1:
-                    54:e6:15:d1:af:2b:e2:57:2b:6d:b9:c4:5d:b7:01:
-                    74:57:a7:fb:27:85:2b:92:15:e2:e3:13:97:29:c8:
-                    92:7b
-                Exponent: 65537 (0x10001)
-        X509v3 extensions:
-            X509v3 Subject Alternative Name: 
-                DNS:fakehostname
-            X509v3 Key Usage: critical
-                Digital Signature, Key Encipherment
-            X509v3 Extended Key Usage: 
-                TLS Web Server Authentication, TLS Web Client Authentication
-            X509v3 Basic Constraints: critical
-                CA:FALSE
-            X509v3 Subject Key Identifier: 
-                F8:76:79:CB:11:85:F0:46:E5:95:E6:7E:69:CB:12:5E:4E:AA:EC:4D
-            X509v3 Authority Key Identifier: 
-                keyid:9A:CF:CF:6E:EB:71:3D:DB:3C:F1:AE:88:6B:56:72:03:CB:08:A7:48
-                DirName:/C=XY/O=Python Software Foundation CA/CN=our-ca-server
-                serial:82:ED:BF:41:C8:80:91:9B
-
-            Authority Information Access: 
-                CA Issuers - URI:http://testca.pythontest.net/testca/pycacert.cer
-                OCSP - URI:http://testca.pythontest.net/testca/ocsp/
-
-            X509v3 CRL Distribution Points: 
-
-                Full Name:
-                  URI:http://testca.pythontest.net/testca/revocation.crl
-
-    Signature Algorithm: sha1WithRSAEncryption
-         6d:50:8d:fb:ee:4e:93:8b:eb:47:56:ba:38:cc:80:e1:9d:c7:
-         e1:9e:1f:9c:22:0c:d2:08:9b:ed:bf:31:d9:00:ee:af:8c:56:
-         78:92:d1:7c:ba:4e:81:7f:82:1f:f4:68:99:86:91:c6:cb:57:
-         d3:b9:41:12:fa:75:53:fd:22:32:21:50:af:6b:4c:b1:34:36:
-         d1:a8:25:0a:d0:f0:f8:81:7d:69:58:6e:af:e3:d2:c4:32:87:
-         79:d7:cd:ad:0c:56:f3:15:27:10:0c:f9:57:59:53:00:ed:af:
-         5d:4d:07:86:7a:e5:f3:97:88:bc:86:b4:f1:17:46:33:55:28:
-         66:7b:70:d3:a5:12:b9:4f:c7:ed:e6:13:20:2d:f0:9e:ec:17:
-         64:cf:fd:13:14:1b:76:ba:64:ac:c5:51:b6:cd:13:0a:93:b1:
-         fd:43:09:a0:0b:44:6c:77:45:43:0b:e5:ed:70:b2:76:dc:08:
-         4a:5b:73:5f:c1:fc:7f:63:70:f8:b9:ca:3c:98:06:5f:fd:98:
-         d1:e4:e6:61:5f:09:8f:6c:18:86:98:9c:cb:3f:73:7b:3f:38:
-         f5:a7:09:20:ee:a5:63:1c:ff:8b:a6:d1:8c:e8:f4:84:3d:99:
-         38:0f:cc:e0:52:03:f9:18:05:23:76:39:de:52:ce:8e:fb:a6:
-         6e:f5:4f:c3
------BEGIN CERTIFICATE-----
-MIIE9zCCA9+gAwIBAgIJAILtv0HIgJGdMA0GCSqGSIb3DQEBBQUAME0xCzAJBgNV
-BAYTAlhZMSYwJAYDVQQKDB1QeXRob24gU29mdHdhcmUgRm91bmRhdGlvbiBDQTEW
-MBQGA1UEAwwNb3VyLWNhLXNlcnZlcjAeFw0xODAxMTkxOTA5MDZaFw0yNzExMjgx
-OTA5MDZaMGIxCzAJBgNVBAYTAlhZMRcwFQYDVQQHDA5DYXN0bGUgQW50aHJheDEj
-MCEGA1UECgwaUHl0aG9uIFNvZnR3YXJlIEZvdW5kYXRpb24xFTATBgNVBAMMDGZh
-a2Vob3N0bmFtZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMf/vqFk
-BkfhxJUKZVlrkcSooKMIqtw/AEQKz0FL7eJvA3jH02cU0/60J4UaAleXtYYWh5eC
-Degr7WkWw5amxEe4XcF2qQKdKFLJ2ZPxstoYfAp4vRw/Ek/lP+5bt7M8pbZVZcYz
-CbBFpEn12PZUJS7bS8NlZIYWv3OOeOglzMG0fdGxVSCkrt64Qe5Dmkgz1BI5oKj7
-kU9HuzvWdTtipsVa1342ELw6DUbj3sHfUNCUdyIXoFGbr9w0YCYdoASspQYEV2Qa
-0U8cGfi+S2gSD1/DEkBku8amhNlasHgdGxHBVOYV0a8r4lcrbbnEXbcBdFen+yeF
-K5IV4uMTlynIknsCAwEAAaOCAcMwggG/MBcGA1UdEQQQMA6CDGZha2Vob3N0bmFt
-ZTAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMC
-MAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFPh2ecsRhfBG5ZXmfmnLEl5OquxNMH0G
-A1UdIwR2MHSAFJrPz27rcT3bPPGuiGtWcgPLCKdIoVGkTzBNMQswCQYDVQQGEwJY
-WTEmMCQGA1UECgwdUHl0aG9uIFNvZnR3YXJlIEZvdW5kYXRpb24gQ0ExFjAUBgNV
-BAMMDW91ci1jYS1zZXJ2ZXKCCQCC7b9ByICRmzCBgwYIKwYBBQUHAQEEdzB1MDwG
-CCsGAQUFBzAChjBodHRwOi8vdGVzdGNhLnB5dGhvbnRlc3QubmV0L3Rlc3RjYS9w
-eWNhY2VydC5jZXIwNQYIKwYBBQUHMAGGKWh0dHA6Ly90ZXN0Y2EucHl0aG9udGVz
-dC5uZXQvdGVzdGNhL29jc3AvMEMGA1UdHwQ8MDowOKA2oDSGMmh0dHA6Ly90ZXN0
-Y2EucHl0aG9udGVzdC5uZXQvdGVzdGNhL3Jldm9jYXRpb24uY3JsMA0GCSqGSIb3
-DQEBBQUAA4IBAQBtUI377k6Ti+tHVro4zIDhncfhnh+cIgzSCJvtvzHZAO6vjFZ4
-ktF8uk6Bf4If9GiZhpHGy1fTuUES+nVT/SIyIVCva0yxNDbRqCUK0PD4gX1pWG6v
-49LEMod5182tDFbzFScQDPlXWVMA7a9dTQeGeuXzl4i8hrTxF0YzVShme3DTpRK5
-T8ft5hMgLfCe7Bdkz/0TFBt2umSsxVG2zRMKk7H9QwmgC0Rsd0VDC+XtcLJ23AhK
-W3Nfwfx/Y3D4uco8mAZf/ZjR5OZhXwmPbBiGmJzLP3N7Pzj1pwkg7qVjHP+LptGM
-6PSEPZk4D8zgUgP5GAUjdjneUs6O+6Zu9U/D
------END CERTIFICATE-----

Lib/test/keycertecc.pem

@@ -1,96 +0,0 @@
------BEGIN PRIVATE KEY-----
-MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDDe3QWmhZX07HZbntz4
-CFqAOaoYMdYwD7Z3WPNIc2zR7p4D6BMOa7NAWjLV5A7CUw6hZANiAAQ5IVKzLLz4
-LCfcpy6fMOp+jk5KwywsU3upPtjA6E3UetxPcfnnv+gghRyDAYLN2OVqZgLMEmUo
-F1j1SM1QrbhHIuNcVxI9gPPMdumcNFSz/hqxrBRtA/8Z2gywczdNLjc=
------END PRIVATE KEY-----
-Certificate:
-    Data:
-        Version: 3 (0x2)
-        Serial Number:
-            82:ed:bf:41:c8:80:91:9e
-    Signature Algorithm: sha1WithRSAEncryption
-        Issuer: C=XY, O=Python Software Foundation CA, CN=our-ca-server
-        Validity
-            Not Before: Jan 19 19:09:06 2018 GMT
-            Not After : Nov 28 19:09:06 2027 GMT
-        Subject: C=XY, L=Castle Anthrax, O=Python Software Foundation, CN=localhost-ecc
-        Subject Public Key Info:
-            Public Key Algorithm: id-ecPublicKey
-                Public-Key: (384 bit)
-                pub:
-                    04:39:21:52:b3:2c:bc:f8:2c:27:dc:a7:2e:9f:30:
-                    ea:7e:8e:4e:4a:c3:2c:2c:53:7b:a9:3e:d8:c0:e8:
-                    4d:d4:7a:dc:4f:71:f9:e7:bf:e8:20:85:1c:83:01:
-                    82:cd:d8:e5:6a:66:02:cc:12:65:28:17:58:f5:48:
-                    cd:50:ad:b8:47:22:e3:5c:57:12:3d:80:f3:cc:76:
-                    e9:9c:34:54:b3:fe:1a:b1:ac:14:6d:03:ff:19:da:
-                    0c:b0:73:37:4d:2e:37
-                ASN1 OID: secp384r1
-                NIST CURVE: P-384
-        X509v3 extensions:
-            X509v3 Subject Alternative Name: 
-                DNS:localhost-ecc
-            X509v3 Key Usage: critical
-                Digital Signature, Key Encipherment
-            X509v3 Extended Key Usage: 
-                TLS Web Server Authentication, TLS Web Client Authentication
-            X509v3 Basic Constraints: critical
-                CA:FALSE
-            X509v3 Subject Key Identifier: 
-                33:23:0E:15:04:83:2E:3D:BF:DA:81:6D:10:38:80:C3:C2:B0:A4:74
-            X509v3 Authority Key Identifier: 
-                keyid:9A:CF:CF:6E:EB:71:3D:DB:3C:F1:AE:88:6B:56:72:03:CB:08:A7:48
-                DirName:/C=XY/O=Python Software Foundation CA/CN=our-ca-server
-                serial:82:ED:BF:41:C8:80:91:9B
-
-            Authority Information Access: 
-                CA Issuers - URI:http://testca.pythontest.net/testca/pycacert.cer
-                OCSP - URI:http://testca.pythontest.net/testca/ocsp/
-
-            X509v3 CRL Distribution Points: 
-
-                Full Name:
-                  URI:http://testca.pythontest.net/testca/revocation.crl
-
-    Signature Algorithm: sha1WithRSAEncryption
-         3b:6f:97:af:7e:5f:e0:14:34:ed:57:7e:de:ce:c4:85:1e:aa:
-         84:52:94:7c:e5:ce:e9:9c:88:8b:ad:b5:4d:16:ac:af:81:ea:
-         b8:a2:e2:50:2e:cb:e9:11:bd:1b:a6:3f:0c:a2:d7:7b:67:72:
-         b3:43:16:ad:c6:87:ac:6e:ac:47:78:ef:2f:8c:86:e8:9b:d1:
-         43:8c:c1:7a:91:30:e9:14:d6:9f:41:8b:9b:0b:24:9b:78:86:
-         11:8a:fc:2b:cd:c9:13:ee:90:4f:14:33:51:a3:c4:9e:d6:06:
-         48:f5:41:12:af:f0:f2:71:40:78:f5:96:c2:5d:cf:e1:38:ff:
-         bf:10:eb:74:2f:c2:23:21:3e:27:f5:f1:f2:af:2c:62:82:31:
-         00:c8:96:1b:c3:7e:8d:71:89:e7:40:b5:67:1a:33:fb:c0:8b:
-         96:0c:36:78:25:27:82:d8:27:27:52:0f:f7:69:cd:ff:2b:92:
-         10:d3:d2:0a:db:65:ed:af:90:eb:db:76:f3:8a:7a:13:9e:c6:
-         33:57:15:42:06:13:d6:54:49:fa:84:a7:0e:1d:14:72:ca:19:
-         8e:2b:aa:a4:02:54:3c:f6:1c:23:81:7a:59:54:b0:92:65:72:
-         c8:e5:ba:9f:03:4e:30:f2:4d:45:85:e3:35:a8:b1:68:58:b9:
-         3b:20:a3:eb
------BEGIN CERTIFICATE-----
-MIIESzCCAzOgAwIBAgIJAILtv0HIgJGeMA0GCSqGSIb3DQEBBQUAME0xCzAJBgNV
-BAYTAlhZMSYwJAYDVQQKDB1QeXRob24gU29mdHdhcmUgRm91bmRhdGlvbiBDQTEW
-MBQGA1UEAwwNb3VyLWNhLXNlcnZlcjAeFw0xODAxMTkxOTA5MDZaFw0yNzExMjgx
-OTA5MDZaMGMxCzAJBgNVBAYTAlhZMRcwFQYDVQQHDA5DYXN0bGUgQW50aHJheDEj
-MCEGA1UECgwaUHl0aG9uIFNvZnR3YXJlIEZvdW5kYXRpb24xFjAUBgNVBAMMDWxv
-Y2FsaG9zdC1lY2MwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAQ5IVKzLLz4LCfcpy6f
-MOp+jk5KwywsU3upPtjA6E3UetxPcfnnv+gghRyDAYLN2OVqZgLMEmUoF1j1SM1Q
-rbhHIuNcVxI9gPPMdumcNFSz/hqxrBRtA/8Z2gywczdNLjejggHEMIIBwDAYBgNV
-HREEETAPgg1sb2NhbGhvc3QtZWNjMA4GA1UdDwEB/wQEAwIFoDAdBgNVHSUEFjAU
-BggrBgEFBQcDAQYIKwYBBQUHAwIwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQUMyMO
-FQSDLj2/2oFtEDiAw8KwpHQwfQYDVR0jBHYwdIAUms/PbutxPds88a6Ia1ZyA8sI
-p0ihUaRPME0xCzAJBgNVBAYTAlhZMSYwJAYDVQQKDB1QeXRob24gU29mdHdhcmUg
-Rm91bmRhdGlvbiBDQTEWMBQGA1UEAwwNb3VyLWNhLXNlcnZlcoIJAILtv0HIgJGb
-MIGDBggrBgEFBQcBAQR3MHUwPAYIKwYBBQUHMAKGMGh0dHA6Ly90ZXN0Y2EucHl0
-aG9udGVzdC5uZXQvdGVzdGNhL3B5Y2FjZXJ0LmNlcjA1BggrBgEFBQcwAYYpaHR0
-cDovL3Rlc3RjYS5weXRob250ZXN0Lm5ldC90ZXN0Y2Evb2NzcC8wQwYDVR0fBDww
-OjA4oDagNIYyaHR0cDovL3Rlc3RjYS5weXRob250ZXN0Lm5ldC90ZXN0Y2EvcmV2
-b2NhdGlvbi5jcmwwDQYJKoZIhvcNAQEFBQADggEBADtvl69+X+AUNO1Xft7OxIUe
-qoRSlHzlzumciIuttU0WrK+B6rii4lAuy+kRvRumPwyi13tncrNDFq3Gh6xurEd4
-7y+Mhuib0UOMwXqRMOkU1p9Bi5sLJJt4hhGK/CvNyRPukE8UM1GjxJ7WBkj1QRKv
-8PJxQHj1lsJdz+E4/78Q63QvwiMhPif18fKvLGKCMQDIlhvDfo1xiedAtWcaM/vA
-i5YMNnglJ4LYJydSD/dpzf8rkhDT0grbZe2vkOvbdvOKehOexjNXFUIGE9ZUSfqE
-pw4dFHLKGY4rqqQCVDz2HCOBellUsJJlcsjlup8DTjDyTUWF4zWosWhYuTsgo+s=
------END CERTIFICATE-----

Lib/test/ssl_servers.py

@@ -14,7 +14,7 @@ from test.support import socket_helper
 here = os.path.dirname(__file__)
 
 HOST = socket_helper.HOST
-CERTFILE = os.path.join(here, 'keycert.pem')
+CERTFILE = os.path.join(here, 'certdata/keycert.pem')
 
 # This one's based on HTTPServer, which is based on socketserver
 

Lib/test/test_asyncgen.py

@@ -603,8 +603,6 @@ class AsyncGenAsyncioTest(unittest.TestCase):
             await awaitable
         return "completed"
 
-    # TODO: RUSTPYTHON, NameError: name 'anext' is not defined
-    @unittest.expectedFailure
     def test_anext_return_iterator(self):
         class WithIterAnext:
             def __aiter__(self):
@@ -614,8 +612,6 @@ class AsyncGenAsyncioTest(unittest.TestCase):
         result = self.loop.run_until_complete(self.check_anext_returning_iterator(WithIterAnext))
         self.assertEqual(result, "completed")
 
-    # TODO: RUSTPYTHON, NameError: name 'anext' is not defined
-    @unittest.expectedFailure
     def test_anext_return_generator(self):
         class WithGenAnext:
             def __aiter__(self):
@@ -625,8 +621,6 @@ class AsyncGenAsyncioTest(unittest.TestCase):
         result = self.loop.run_until_complete(self.check_anext_returning_iterator(WithGenAnext))
         self.assertEqual(result, "completed")
 
-    # TODO: RUSTPYTHON, NameError: name 'anext' is not defined
-    @unittest.expectedFailure
     def test_anext_await_raises(self):
         class RaisingAwaitable:
             def __await__(self):

Lib/test/test_codeccallbacks.py

@@ -909,8 +909,6 @@ class CodecCallbackTest(unittest.TestCase):
                 self.assertEqual(exc.object, input)
                 self.assertEqual(exc.reason, "surrogates not allowed")
 
-    # TODO: RUSTPYTHON
-    @unittest.expectedFailure
     def test_badregistercall(self):
         # enhance coverage of:
         # Modules/_codecsmodule.c::register_error()

Lib/test/test_contextlib_async.py

@@ -40,8 +40,6 @@ class TestAbstractAsyncContextManager(unittest.IsolatedAsyncioTestCase):
             manager = DefaultAsyncContextManager()
             manager.var = 42
 
-    # TODO: RUSTPYTHON
-    @unittest.expectedFailure
     async def test_async_gen_propagates_generator_exit(self):
         # A regression test for https://bugs.python.org/issue33786.
 
@@ -94,8 +92,6 @@ class TestAbstractAsyncContextManager(unittest.IsolatedAsyncioTestCase):
 
 class AsyncContextManagerTestCase(unittest.IsolatedAsyncioTestCase):
 
-    # TODO: RUSTPYTHON
-    @unittest.expectedFailure
     async def test_contextmanager_plain(self):
         state = []
         @asynccontextmanager
@@ -109,8 +105,6 @@ class AsyncContextManagerTestCase(unittest.IsolatedAsyncioTestCase):
             state.append(x)
         self.assertEqual(state, [1, 42, 999])
 
-    # TODO: RUSTPYTHON
-    @unittest.expectedFailure
     async def test_contextmanager_finally(self):
         state = []
         @asynccontextmanager
@@ -185,8 +179,6 @@ class AsyncContextManagerTestCase(unittest.IsolatedAsyncioTestCase):
                 self.assertEqual(frames[0].name, 'test_contextmanager_traceback')
                 self.assertEqual(frames[0].line, 'raise stop_exc')
 
-    # TODO: RUSTPYTHON
-    @unittest.expectedFailure
     async def test_contextmanager_no_reraise(self):
         @asynccontextmanager
         async def whee():
@@ -196,8 +188,6 @@ class AsyncContextManagerTestCase(unittest.IsolatedAsyncioTestCase):
         # Calling __aexit__ should not result in an exception
         self.assertFalse(await ctx.__aexit__(TypeError, TypeError("foo"), None))
 
-    # TODO: RUSTPYTHON
-    @unittest.expectedFailure
     async def test_contextmanager_trap_yield_after_throw(self):
         @asynccontextmanager
         async def whoo():
@@ -213,8 +203,6 @@ class AsyncContextManagerTestCase(unittest.IsolatedAsyncioTestCase):
             # The "gen" attribute is an implementation detail.
             self.assertFalse(ctx.gen.ag_suspended)
 
-    # TODO: RUSTPYTHON
-    @unittest.expectedFailure
     async def test_contextmanager_trap_no_yield(self):
         @asynccontextmanager
         async def whoo():
@@ -224,8 +212,6 @@ class AsyncContextManagerTestCase(unittest.IsolatedAsyncioTestCase):
         with self.assertRaises(RuntimeError):
             await ctx.__aenter__()
 
-    # TODO: RUSTPYTHON
-    @unittest.expectedFailure
     async def test_contextmanager_trap_second_yield(self):
         @asynccontextmanager
         async def whoo():
@@ -239,8 +225,6 @@ class AsyncContextManagerTestCase(unittest.IsolatedAsyncioTestCase):
             # The "gen" attribute is an implementation detail.
             self.assertFalse(ctx.gen.ag_suspended)
 
-    # TODO: RUSTPYTHON
-    @unittest.expectedFailure
     async def test_contextmanager_non_normalised(self):
         @asynccontextmanager
         async def whoo():
@@ -254,8 +238,6 @@ class AsyncContextManagerTestCase(unittest.IsolatedAsyncioTestCase):
         with self.assertRaises(SyntaxError):
             await ctx.__aexit__(RuntimeError, None, None)
 
-    # TODO: RUSTPYTHON
-    @unittest.expectedFailure
     async def test_contextmanager_except(self):
         state = []
         @asynccontextmanager
@@ -301,8 +283,6 @@ class AsyncContextManagerTestCase(unittest.IsolatedAsyncioTestCase):
                 else:
                     self.fail(f'{stop_exc} was suppressed')
 
-    # TODO: RUSTPYTHON
-    @unittest.expectedFailure
     async def test_contextmanager_wrap_runtimeerror(self):
         @asynccontextmanager
         async def woohoo():
@@ -346,8 +326,6 @@ class AsyncContextManagerTestCase(unittest.IsolatedAsyncioTestCase):
         baz = self._create_contextmanager_attribs()
         self.assertEqual(baz.__doc__, "Whee!")
 
-    # TODO: RUSTPYTHON
-    @unittest.expectedFailure
     @support.requires_docstrings
     async def test_instance_docstring_given_cm_docstring(self):
         baz = self._create_contextmanager_attribs()(None)
@@ -355,8 +333,6 @@ class AsyncContextManagerTestCase(unittest.IsolatedAsyncioTestCase):
         async with baz:
             pass  # suppress warning
 
-    # TODO: RUSTPYTHON
-    @unittest.expectedFailure
     async def test_keywords(self):
         # Ensure no keyword arguments are inhibited
         @asynccontextmanager
@@ -365,8 +341,6 @@ class AsyncContextManagerTestCase(unittest.IsolatedAsyncioTestCase):
         async with woohoo(self=11, func=22, args=33, kwds=44) as target:
             self.assertEqual(target, (11, 22, 33, 44))
 
-    # TODO: RUSTPYTHON
-    @unittest.expectedFailure
     async def test_recursive(self):
         depth = 0
         ncols = 0
@@ -393,8 +367,6 @@ class AsyncContextManagerTestCase(unittest.IsolatedAsyncioTestCase):
         self.assertEqual(ncols, 10)
         self.assertEqual(depth, 0)
 
-    # TODO: RUSTPYTHON
-    @unittest.expectedFailure
     async def test_decorator(self):
         entered = False
 
@@ -413,8 +385,6 @@ class AsyncContextManagerTestCase(unittest.IsolatedAsyncioTestCase):
         await test()
         self.assertFalse(entered)
 
-    # TODO: RUSTPYTHON
-    @unittest.expectedFailure
     async def test_decorator_with_exception(self):
         entered = False
 
@@ -437,8 +407,6 @@ class AsyncContextManagerTestCase(unittest.IsolatedAsyncioTestCase):
             await test()
         self.assertFalse(entered)
 
-    # TODO: RUSTPYTHON
-    @unittest.expectedFailure
     async def test_decorating_method(self):
 
         @asynccontextmanager

Lib/test/test_httplib.py

@@ -22,11 +22,11 @@ from test.support import warnings_helper
 
 here = os.path.dirname(__file__)
 # Self-signed cert file for 'localhost'
-CERT_localhost = os.path.join(here, 'keycert.pem')
+CERT_localhost = os.path.join(here, 'certdata/keycert.pem')
 # Self-signed cert file for 'fakehostname'
-CERT_fakehostname = os.path.join(here, 'keycert2.pem')
+CERT_fakehostname = os.path.join(here, 'certdata/keycert2.pem')
 # Self-signed cert file for self-signed.pythontest.net
-CERT_selfsigned_pythontestdotnet = os.path.join(here, 'selfsigned_pythontestdotnet.pem')
+CERT_selfsigned_pythontestdotnet = os.path.join(here, 'certdata/selfsigned_pythontestdotnet.pem')
 
 # constants for testing chunked encoding
 chunked_start = (
@@ -1733,8 +1733,6 @@ class HTTPSTest(TestCase):
             h.close()
             self.assertIn('text/html', content_type)
 
-    # TODO: RUSTPYTHON
-    @unittest.expectedFailure
     def test_networked_good_cert(self):
         # We feed the server's cert as a validating cert
         import ssl
@@ -1803,8 +1801,6 @@ class HTTPSTest(TestCase):
         self.addCleanup(resp.close)
         self.assertEqual(resp.status, 404)
 
-    # TODO: RUSTPYTHON
-    @unittest.expectedFailure
     def test_local_bad_hostname(self):
         # The (valid) cert doesn't validate the HTTP hostname
         import ssl

Lib/test/test_property.py

@@ -201,7 +201,6 @@ class PropertyTests(unittest.TestCase):
         self.assertIsNone(prop.fdel)
         self.assertAlmostEqual(gettotalrefcount() - refs_before, 0, delta=10)
 
-    @unittest.expectedFailure # TODO: RUSTPYTHON
     def test_property_name(self):
         def getter(self):
             return 42

Lib/test/test_urllib2_localnet.py

@@ -19,9 +19,9 @@ except ImportError:
 
 here = os.path.dirname(__file__)
 # Self-signed cert file for 'localhost'
-CERT_localhost = os.path.join(here, 'keycert.pem')
+CERT_localhost = os.path.join(here, 'certdata', 'keycert.pem')
 # Self-signed cert file for 'fakehostname'
-CERT_fakehostname = os.path.join(here, 'keycert2.pem')
+CERT_fakehostname = os.path.join(here, 'certdata', 'keycert2.pem')
 
 
 # Loopback http server infrastructure
@@ -568,8 +568,6 @@ class TestUrlopen(unittest.TestCase):
         self.assertEqual(data, expected_response)
         self.assertEqual(handler.requests, ["/bizarre", b"get=with_feeling"])
 
-    # TODO: RUSTPYTHON
-    @unittest.expectedFailure
     @unittest.skipIf(os.name == "nt", "TODO: RUSTPYTHON, ValueError: illegal environment variable name")
     def test_https(self):
         handler = self.start_https_server()
@@ -577,8 +575,6 @@ class TestUrlopen(unittest.TestCase):
         data = self.urlopen("https://localhost:%s/bizarre" % handler.port, context=context)
         self.assertEqual(data, b"we care a bit")
 
-    # TODO: RUSTPYTHON
-    @unittest.expectedFailure
     @unittest.skipIf(os.name == "nt", "TODO: RUSTPYTHON, ValueError: illegal environment variable name")
     def test_https_with_cafile(self):
         handler = self.start_https_server(certfile=CERT_localhost)
@@ -606,8 +602,6 @@ class TestUrlopen(unittest.TestCase):
                 self.urlopen("https://localhost:%s/bizarre" % handler.port,
                              cadefault=True)
 
-    # TODO: RUSTPYTHON
-    @unittest.expectedFailure
     @unittest.skipIf(os.name == "nt", "TODO: RUSTPYTHON, ValueError: illegal environment variable name")
     def test_https_sni(self):
         if ssl is None:

common/src/fileutils.rs

@@ -438,3 +438,99 @@ pub mod windows {
         }
     }
 }
+
+// _Py_fopen_obj in cpython (Python/fileutils.c:1757-1835)
+// Open a file using std::fs::File and convert to FILE*
+// Automatically handles path encoding and EINTR retries
+pub fn fopen(path: &std::path::Path, mode: &str) -> std::io::Result<*mut libc::FILE> {
+    use std::ffi::CString;
+    use std::fs::File;
+
+    // Currently only supports read mode
+    // Can be extended to support "wb", "w+b", etc. if needed
+    if mode != "rb" {
+        return Err(std::io::Error::new(
+            std::io::ErrorKind::InvalidInput,
+            format!("unsupported mode: {}", mode),
+        ));
+    }
+
+    // Open file using std::fs::File (handles path encoding and EINTR automatically)
+    let file = File::open(path)?;
+
+    #[cfg(windows)]
+    {
+        use std::os::windows::io::IntoRawHandle;
+
+        // Declare Windows CRT functions
+        unsafe extern "C" {
+            fn _open_osfhandle(handle: isize, flags: libc::c_int) -> libc::c_int;
+            fn _fdopen(fd: libc::c_int, mode: *const libc::c_char) -> *mut libc::FILE;
+        }
+
+        // Convert File handle to CRT file descriptor
+        let handle = file.into_raw_handle();
+        let fd = unsafe { _open_osfhandle(handle as isize, libc::O_RDONLY) };
+        if fd == -1 {
+            return Err(std::io::Error::last_os_error());
+        }
+
+        // Convert fd to FILE*
+        let mode_cstr = CString::new(mode).unwrap();
+        let fp = unsafe { _fdopen(fd, mode_cstr.as_ptr()) };
+        if fp.is_null() {
+            unsafe { libc::close(fd) };
+            return Err(std::io::Error::last_os_error());
+        }
+
+        // Set non-inheritable (Windows needs this explicitly)
+        if let Err(e) = set_inheritable(fd, false) {
+            unsafe { libc::fclose(fp) };
+            return Err(e);
+        }
+
+        Ok(fp)
+    }
+
+    #[cfg(not(windows))]
+    {
+        use std::os::fd::IntoRawFd;
+
+        // Convert File to raw fd
+        let fd = file.into_raw_fd();
+
+        // Convert fd to FILE*
+        let mode_cstr = CString::new(mode).unwrap();
+        let fp = unsafe { libc::fdopen(fd, mode_cstr.as_ptr()) };
+        if fp.is_null() {
+            unsafe { libc::close(fd) };
+            return Err(std::io::Error::last_os_error());
+        }
+
+        // Unix: O_CLOEXEC is already set by File::open, so non-inheritable is automatic
+        Ok(fp)
+    }
+}
+
+// set_inheritable in cpython (Python/fileutils.c:1443-1570)
+// Set the inheritable flag of the specified file descriptor
+// Only used on Windows; Unix automatically sets O_CLOEXEC
+#[cfg(windows)]
+fn set_inheritable(fd: libc::c_int, inheritable: bool) -> std::io::Result<()> {
+    use windows_sys::Win32::Foundation::{
+        HANDLE, HANDLE_FLAG_INHERIT, INVALID_HANDLE_VALUE, SetHandleInformation,
+    };
+
+    let handle = unsafe { libc::get_osfhandle(fd) };
+    if handle == INVALID_HANDLE_VALUE as isize {
+        return Err(std::io::Error::last_os_error());
+    }
+
+    let flags = if inheritable { HANDLE_FLAG_INHERIT } else { 0 };
+    let result = unsafe { SetHandleInformation(handle as HANDLE, HANDLE_FLAG_INHERIT, flags) };
+    if result == 0 {
+        return Err(std::io::Error::last_os_error());
+    }
+
+    Ok(())
+}

compiler/codegen/src/ir.rs

@@ -4,8 +4,8 @@ use crate::{IndexMap, IndexSet, error::InternalError};
 use rustpython_compiler_core::{
     OneIndexed, SourceLocation,
     bytecode::{
-        CodeFlags, CodeObject, CodeUnit, ConstantData, InstrDisplayContext, Instruction, Label,
-        OpArg, PyCodeLocationInfoKind,
+        CodeFlags, CodeObject, CodeUnit, CodeUnits, ConstantData, InstrDisplayContext, Instruction,
+        Label, OpArg, PyCodeLocationInfoKind,
     },
 };
 
@@ -214,7 +214,7 @@ impl CodeInfo {
             qualname: qualname.unwrap_or(obj_name),
 
             max_stackdepth,
-            instructions: instructions.into_boxed_slice(),
+            instructions: CodeUnits::from(instructions),
             locations: locations.into_boxed_slice(),
             constants: constants.into_iter().collect(),
             names: name_cache.into_iter().collect(),

compiler/core/src/bytecode.rs

@@ -1,13 +1,16 @@
 //! Implement python as a virtual machine with bytecode. This module
 //! implements bytecode structure.
 
-use crate::{OneIndexed, SourceLocation};
+use crate::{
+    marshal::MarshalError,
+    {OneIndexed, SourceLocation},
+};
 use bitflags::bitflags;
 use itertools::Itertools;
 use malachite_bigint::BigInt;
 use num_complex::Complex64;
 use rustpython_wtf8::{Wtf8, Wtf8Buf};
-use std::{collections::BTreeSet, fmt, hash, marker::PhantomData, mem};
+use std::{collections::BTreeSet, fmt, hash, marker::PhantomData, mem, ops::Deref};
 
 #[derive(Copy, Clone, Debug, Hash, PartialEq, Eq)]
 #[repr(i8)]
@@ -195,7 +198,7 @@ impl ConstantBag for BasicBag {
 /// a code object. Also a module has a code object.
 #[derive(Clone)]
 pub struct CodeObject<C: Constant = ConstantData> {
-    pub instructions: Box<[CodeUnit]>,
+    pub instructions: CodeUnits,
     pub locations: Box<[SourceLocation]>,
     pub flags: CodeFlags,
     /// Number of positional-only arguments
@@ -257,6 +260,12 @@ impl OpArgByte {
     }
 }
 
+impl From<u8> for OpArgByte {
+    fn from(raw: u8) -> Self {
+        Self(raw)
+    }
+}
+
 impl fmt::Debug for OpArgByte {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
         self.0.fmt(f)
@@ -808,14 +817,14 @@ impl From<Instruction> for u8 {
 }
 
 impl TryFrom<u8> for Instruction {
-    type Error = crate::marshal::MarshalError;
+    type Error = MarshalError;
 
     #[inline]
-    fn try_from(value: u8) -> Result<Self, crate::marshal::MarshalError> {
+    fn try_from(value: u8) -> Result<Self, MarshalError> {
         if value <= u8::from(LAST_INSTRUCTION) {
             Ok(unsafe { std::mem::transmute::<u8, Self>(value) })
         } else {
-            Err(crate::marshal::MarshalError::InvalidBytecode)
+            Err(MarshalError::InvalidBytecode)
         }
     }
 }
@@ -835,6 +844,58 @@ impl CodeUnit {
     }
 }
 
+impl TryFrom<&[u8]> for CodeUnit {
+    type Error = MarshalError;
+
+    fn try_from(value: &[u8]) -> Result<Self, Self::Error> {
+        match value.len() {
+            2 => Ok(Self::new(value[0].try_into()?, value[1].into())),
+            _ => Err(Self::Error::InvalidBytecode),
+        }
+    }
+}
+
+#[derive(Clone)]
+pub struct CodeUnits(Box<[CodeUnit]>);
+
+impl TryFrom<&[u8]> for CodeUnits {
+    type Error = MarshalError;
+
+    fn try_from(value: &[u8]) -> Result<Self, Self::Error> {
+        if !value.len().is_multiple_of(2) {
+            return Err(Self::Error::InvalidBytecode);
+        }
+
+        value.chunks_exact(2).map(CodeUnit::try_from).collect()
+    }
+}
+
+impl<const N: usize> From<[CodeUnit; N]> for CodeUnits {
+    fn from(value: [CodeUnit; N]) -> Self {
+        Self(Box::from(value))
+    }
+}
+
+impl From<Vec<CodeUnit>> for CodeUnits {
+    fn from(value: Vec<CodeUnit>) -> Self {
+        Self(value.into_boxed_slice())
+    }
+}
+
+impl FromIterator<CodeUnit> for CodeUnits {
+    fn from_iter<T: IntoIterator<Item = CodeUnit>>(iter: T) -> Self {
+        Self(iter.into_iter().collect())
+    }
+}
+
+impl Deref for CodeUnits {
+    type Target = [CodeUnit];
+
+    fn deref(&self) -> &Self::Target {
+        &self.0
+    }
+}
+
 use self::Instruction::*;
 
 bitflags! {

compiler/core/src/marshal.rs

@@ -165,19 +165,6 @@ impl<'a> ReadBorrowed<'a> for &'a [u8] {
     }
 }
 
-/// Parses bytecode bytes into CodeUnit instructions.
-/// Each instruction is 2 bytes: opcode and argument.
-pub fn parse_instructions_from_bytes(bytes: &[u8]) -> Result<Box<[CodeUnit]>> {
-    bytes
-        .chunks_exact(2)
-        .map(|cu| {
-            let op = Instruction::try_from(cu[0])?;
-            let arg = OpArgByte(cu[1]);
-            Ok(CodeUnit { op, arg })
-        })
-        .collect()
-}
-
 pub struct Cursor<B> {
     pub data: B,
     pub position: usize,
@@ -197,8 +184,8 @@ pub fn deserialize_code<R: Read, Bag: ConstantBag>(
     bag: Bag,
 ) -> Result<CodeObject<Bag::Constant>> {
     let len = rdr.read_u32()?;
-    let instructions = rdr.read_slice(len * 2)?;
-    let instructions = parse_instructions_from_bytes(instructions)?;
+    let raw_instructions = rdr.read_slice(len * 2)?;
+    let instructions = CodeUnits::try_from(raw_instructions)?;
 
     let len = rdr.read_u32()?;
     let locations = (0..len)

derive-impl/src/pyclass.rs

@@ -308,7 +308,7 @@ fn generate_class_def(
     ident: &Ident,
     name: &str,
     module_name: Option<&str>,
-    base: Option<String>,
+    base: Option<syn::Path>,
     metaclass: Option<String>,
     unhashable: bool,
     attrs: &[Attribute],
@@ -358,7 +358,6 @@ fn generate_class_def(
         Some(quote! { rustpython_vm::builtins::PyTuple })
     } else {
         base.as_ref().map(|typ| {
-            let typ = Ident::new(typ, ident.span());
             quote_spanned! { ident.span() => #typ }
         })
     }
@@ -382,7 +381,6 @@ fn generate_class_def(
     });
 
     let base_or_object = if let Some(base) = base {
-        let base = Ident::new(&base, ident.span());
         quote! { #base }
     } else {
         quote! { ::rustpython_vm::builtins::PyBaseObject }
@@ -551,7 +549,13 @@ pub(crate) fn impl_pyexception(attr: PunctuatedNestedMeta, item: Item) -> Result
             }
         }
     } else {
-        quote! {}
+        quote! {
+            impl ::rustpython_vm::PyPayload for #ident {
+                fn class(_ctx: &::rustpython_vm::vm::Context) -> &'static ::rustpython_vm::Py<::rustpython_vm::builtins::PyType> {
+                    <Self as ::rustpython_vm::class::StaticType>::static_type()
+                }
+            }
+        }
     };
     let impl_pyclass = if class_meta.has_impl()? {
         quote! {
@@ -613,7 +617,7 @@ pub(crate) fn impl_pyexception_impl(attr: PunctuatedNestedMeta, item: Item) -> R
     } else {
         quote! {
             #[pyslot]
-            pub(crate) fn slot_new(
+            pub fn slot_new(
                 cls: ::rustpython_vm::builtins::PyTypeRef,
                 args: ::rustpython_vm::function::FuncArgs,
                 vm: &::rustpython_vm::VirtualMachine,
@@ -634,7 +638,7 @@ pub(crate) fn impl_pyexception_impl(attr: PunctuatedNestedMeta, item: Item) -> R
         quote! {
             #[pyslot]
             #[pymethod(name="__init__")]
-            pub(crate) fn slot_init(
+            pub fn slot_init(
                 zelf: ::rustpython_vm::PyObjectRef,
                 args: ::rustpython_vm::function::FuncArgs,
                 vm: &::rustpython_vm::VirtualMachine,

derive-impl/src/pymodule.rs

@@ -16,6 +16,7 @@ enum AttrName {
     Function,
     Attr,
     Class,
+    Exception,
 }
 
 impl std::fmt::Display for AttrName {
@@ -24,6 +25,7 @@ impl std::fmt::Display for AttrName {
             Self::Function => "pyfunction",
             Self::Attr => "pyattr",
             Self::Class => "pyclass",
+            Self::Exception => "pyexception",
         };
         s.fmt(f)
     }
@@ -37,6 +39,7 @@ impl FromStr for AttrName {
             "pyfunction" => Self::Function,
             "pyattr" => Self::Attr,
             "pyclass" => Self::Class,
+            "pyexception" => Self::Exception,
             s => {
                 return Err(s.to_owned());
             }
@@ -232,7 +235,8 @@ fn module_item_new(
             inner: ContentItemInner { index, attr_name },
             py_attrs,
         }),
-        AttrName::Class => Box::new(ClassItem {
+        // pyexception is treated like pyclass - both define types
+        AttrName::Class | AttrName::Exception => Box::new(ClassItem {
             inner: ContentItemInner { index, attr_name },
             py_attrs,
         }),
@@ -302,13 +306,13 @@ where
             result.push(item_new(i, attr_name, Vec::new()));
         } else {
             match attr_name {
-                AttrName::Class | AttrName::Function => {
+                AttrName::Class | AttrName::Function | AttrName::Exception => {
                     result.push(item_new(i, attr_name, py_attrs.clone()));
                 }
                 _ => {
                     bail_span!(
                         attr,
-                        "#[pyclass] or #[pyfunction] only can follow #[pyattr]",
+                        "#[pyclass], #[pyfunction], or #[pyexception] can follow #[pyattr]",
                     )
                 }
             }

derive-impl/src/util.rs

@@ -187,6 +187,35 @@ impl ItemMetaInner {
         Ok(value)
     }
 
+    pub fn _optional_path(&self, key: &str) -> Result<Option<syn::Path>> {
+        let value = if let Some((_, meta)) = self.meta_map.get(key) {
+            let Meta::NameValue(syn::MetaNameValue { value, .. }) = meta else {
+                bail_span!(
+                    meta,
+                    "#[{}({} = ...)] must be a name-value pair",
+                    self.meta_name(),
+                    key
+                )
+            };
+
+            // Try to parse as a Path (identifier or path like Foo or foo::Bar)
+            match syn::parse2::<syn::Path>(value.to_token_stream()) {
+                Ok(path) => Some(path),
+                Err(_) => {
+                    bail_span!(
+                        value,
+                        "#[{}({} = ...)] must be a valid type path (e.g., PyBaseException)",
+                        self.meta_name(),
+                        key
+                    )
+                }
+            }
+        } else {
+            None
+        };
+        Ok(value)
+    }
+
     pub fn _has_key(&self, key: &str) -> Result<bool> {
         Ok(matches!(self.meta_map.get(key), Some((_, _))))
     }
@@ -384,8 +413,8 @@ impl ClassItemMeta {
         self.inner()._optional_str("ctx")
     }
 
-    pub fn base(&self) -> Result<Option<String>> {
-        self.inner()._optional_str("base")
+    pub fn base(&self) -> Result<Option<syn::Path>> {
+        self.inner()._optional_path("base")
     }
 
     pub fn unhashable(&self) -> Result<bool> {
@@ -446,7 +475,8 @@ impl ClassItemMeta {
 pub(crate) struct ExceptionItemMeta(ClassItemMeta);
 
 impl ItemMeta for ExceptionItemMeta {
-    const ALLOWED_NAMES: &'static [&'static str] = &["name", "base", "unhashable", "ctx", "impl"];
+    const ALLOWED_NAMES: &'static [&'static str] =
+        &["module", "name", "base", "unhashable", "ctx", "impl"];
 
     fn from_inner(inner: ItemMetaInner) -> Self {
         Self(ClassItemMeta(inner))

derive/src/lib.rs

@@ -34,7 +34,7 @@ pub fn derive_from_args(input: TokenStream) -> TokenStream {
 ///     - `IMMUTABLETYPE`: class attributes are immutable.
 /// - `with`: which trait implementations are to be included in the python class.
 /// ```rust, ignore
-/// #[pyclass(module = "my_module", name = "MyClass", base = "BaseClass")]
+/// #[pyclass(module = "my_module", name = "MyClass", base = BaseClass)]
 /// struct MyStruct {
 ///    x: i32,
 /// }

scripts/make_ssl_data_rs.py

@@ -0,0 +1,168 @@
+#!/usr/bin/env python3
+
+"""
+Generate Rust SSL error mapping code from OpenSSL sources.
+
+This is based on CPython's Tools/ssl/make_ssl_data.py but generates
+Rust code instead of C headers.
+
+It takes two arguments:
+- the path to the OpenSSL source tree (e.g. git checkout)
+- the path to the Rust file to be generated (e.g. stdlib/src/ssl/ssl_data.rs)
+- error codes are version specific
+"""
+
+import argparse
+import datetime
+import operator
+import os
+import re
+import sys
+
+
+parser = argparse.ArgumentParser(
+    description="Generate ssl_data.rs from OpenSSL sources"
+)
+parser.add_argument("srcdir", help="OpenSSL source directory")
+parser.add_argument("output", nargs="?", default=None)
+
+
+def _file_search(fname, pat):
+    with open(fname, encoding="utf-8") as f:
+        for line in f:
+            match = pat.search(line)
+            if match is not None:
+                yield match
+
+
+def parse_err_h(args):
+    """Parse err codes, e.g. ERR_LIB_X509: 11"""
+    pat = re.compile(r"#\s*define\W+ERR_LIB_(\w+)\s+(\d+)")
+    lib2errnum = {}
+    for match in _file_search(args.err_h, pat):
+        libname, num = match.groups()
+        lib2errnum[libname] = int(num)
+
+    return lib2errnum
+
+
+def parse_openssl_error_text(args):
+    """Parse error reasons, X509_R_AKID_MISMATCH"""
+    # ignore backslash line continuation for now
+    pat = re.compile(r"^((\w+?)_R_(\w+)):(\d+):")
+    for match in _file_search(args.errtxt, pat):
+        reason, libname, errname, num = match.groups()
+        if "_F_" in reason:
+            # ignore function codes
+            continue
+        num = int(num)
+        yield reason, libname, errname, num
+
+
+def parse_extra_reasons(args):
+    """Parse extra reasons from openssl.ec"""
+    pat = re.compile(r"^R\s+((\w+)_R_(\w+))\s+(\d+)")
+    for match in _file_search(args.errcodes, pat):
+        reason, libname, errname, num = match.groups()
+        num = int(num)
+        yield reason, libname, errname, num
+
+
+def gen_library_codes_rust(args):
+    """Generate Rust phf map for library codes"""
+    yield "// Maps lib_code -> library name"
+    yield '// Example: 20 -> "SSL"'
+    yield "pub static LIBRARY_CODES: phf::Map<u32, &'static str> = phf_map! {"
+
+    # Deduplicate: keep the last one if there are duplicates
+    seen = {}
+    for libname in sorted(args.lib2errnum):
+        lib_num = args.lib2errnum[libname]
+        seen[lib_num] = libname
+
+    for lib_num in sorted(seen.keys()):
+        libname = seen[lib_num]
+        yield f'    {lib_num}u32 => "{libname}",'
+    yield "};"
+    yield ""
+
+
+def gen_error_codes_rust(args):
+    """Generate Rust phf map for error codes"""
+    yield "// Maps encoded (lib, reason) -> error mnemonic"
+    yield '// Example: encode_error_key(20, 134) -> "CERTIFICATE_VERIFY_FAILED"'
+    yield "// Key encoding: (lib << 32) | reason"
+    yield "pub static ERROR_CODES: phf::Map<u64, &'static str> = phf_map! {"
+    for reason, libname, errname, num in args.reasons:
+        if libname not in args.lib2errnum:
+            continue
+        lib_num = args.lib2errnum[libname]
+        # Encode (lib, reason) as single u64
+        key = (lib_num << 32) | num
+        yield f'    {key}u64 => "{errname}",'
+    yield "};"
+    yield ""
+
+
+def main():
+    args = parser.parse_args()
+
+    args.err_h = os.path.join(args.srcdir, "include", "openssl", "err.h")
+    if not os.path.isfile(args.err_h):
+        # Fall back to infile for OpenSSL 3.0.0
+        args.err_h += ".in"
+    args.errcodes = os.path.join(args.srcdir, "crypto", "err", "openssl.ec")
+    args.errtxt = os.path.join(args.srcdir, "crypto", "err", "openssl.txt")
+
+    if not os.path.isfile(args.errtxt):
+        parser.error(f"File {args.errtxt} not found in srcdir\n.")
+
+    # {X509: 11, ...}
+    args.lib2errnum = parse_err_h(args)
+
+    # [('X509_R_AKID_MISMATCH', 'X509', 'AKID_MISMATCH', 110), ...]
+    reasons = []
+    reasons.extend(parse_openssl_error_text(args))
+    reasons.extend(parse_extra_reasons(args))
+    # sort by libname, numeric error code
+    args.reasons = sorted(reasons, key=operator.itemgetter(0, 3))
+
+    lines = [
+        "// File generated by tools/make_ssl_data_rs.py",
+        f"// Generated on {datetime.datetime.now(datetime.timezone.utc).isoformat()}",
+        f"// Source: OpenSSL from {args.srcdir}",
+        "// spell-checker: disable",
+        "",
+        "use phf::phf_map;",
+        "",
+    ]
+    lines.extend(gen_library_codes_rust(args))
+    lines.extend(gen_error_codes_rust(args))
+
+    # Add helper function
+    lines.extend(
+        [
+            "/// Helper function to create encoded key from (lib, reason) pair",
+            "#[inline]",
+            "pub fn encode_error_key(lib: i32, reason: i32) -> u64 {",
+            "    ((lib as u64) << 32) | (reason as u64 & 0xFFFFFFFF)",
+            "}",
+            "",
+        ]
+    )
+
+    if args.output is None:
+        for line in lines:
+            print(line)
+    else:
+        with open(args.output, "w") as output:
+            for line in lines:
+                print(line, file=output)
+
+        print(f"Generated {args.output}")
+        print(f"Found {len(args.lib2errnum)} library codes")
+        print(f"Found {len(args.reasons)} error codes")
+
+
+if __name__ == "__main__":
+    main()

stdlib/Cargo.toml

@@ -40,6 +40,7 @@ num-integer = { workspace = true }
 num-traits = { workspace = true }
 num_enum = { workspace = true }
 parking_lot = { workspace = true }
+phf = { version = "0.11", features = ["macros"] }
 
 memchr = { workspace = true }
 base64 = "0.22"

stdlib/src/socket.rs

@@ -1198,6 +1198,7 @@ mod _socket {
         fn recv_into(
             &self,
             buf: ArgMemoryBuffer,
+            nbytes: OptionalArg<isize>,
             flags: OptionalArg<i32>,
             vm: &VirtualMachine,
         ) -> Result<usize, IoOrPyException> {
@@ -1205,6 +1206,18 @@ mod _socket {
             let sock = self.sock()?;
             let mut buf = buf.borrow_buf_mut();
             let buf = &mut *buf;
+
+            // Handle nbytes parameter
+            let read_len = if let OptionalArg::Present(nbytes) = nbytes {
+                let nbytes = nbytes.to_usize().ok_or_else(|| {
+                    vm.new_value_error("negative buffersize in recv_into".to_owned())
+                })?;
+                nbytes.min(buf.len())
+            } else {
+                buf.len()
+            };
+
+            let buf = &mut buf[..read_len];
             self.sock_op(vm, SelectKind::Read, || {
                 sock.recv_with_flags(unsafe { slice_as_uninit(buf) }, flags)
             })

stdlib/src/ssl/cert.rs

@@ -0,0 +1,232 @@
+pub(super) use ssl_cert::{PySSLCertificate, cert_to_certificate, cert_to_py, obj2txt};
+
+// Certificate type for SSL module
+
+#[pymodule(sub)]
+pub(crate) mod ssl_cert {
+    use crate::{
+        common::ascii,
+        vm::{
+            PyObjectRef, PyPayload, PyResult, VirtualMachine,
+            convert::{ToPyException, ToPyObject},
+            function::{FsPath, OptionalArg},
+        },
+    };
+    use foreign_types_shared::ForeignTypeRef;
+    use openssl::{
+        asn1::Asn1ObjectRef,
+        x509::{self, X509, X509Ref},
+    };
+    use openssl_sys as sys;
+    use std::fmt;
+
+    // Import constants and error converter from _ssl module
+    use crate::ssl::_ssl::{ENCODING_DER, ENCODING_PEM, convert_openssl_error};
+
+    pub(crate) fn obj2txt(obj: &Asn1ObjectRef, no_name: bool) -> Option<String> {
+        let no_name = i32::from(no_name);
+        let ptr = obj.as_ptr();
+        let b = unsafe {
+            let buflen = sys::OBJ_obj2txt(std::ptr::null_mut(), 0, ptr, no_name);
+            assert!(buflen >= 0);
+            if buflen == 0 {
+                return None;
+            }
+            let buflen = buflen as usize;
+            let mut buf = Vec::<u8>::with_capacity(buflen + 1);
+            let ret = sys::OBJ_obj2txt(
+                buf.as_mut_ptr() as *mut libc::c_char,
+                buf.capacity() as _,
+                ptr,
+                no_name,
+            );
+            assert!(ret >= 0);
+            // SAFETY: OBJ_obj2txt initialized the buffer successfully
+            buf.set_len(buflen);
+            buf
+        };
+        let s = String::from_utf8(b)
+            .unwrap_or_else(|e| String::from_utf8_lossy(e.as_bytes()).into_owned());
+        Some(s)
+    }
+
+    #[pyattr]
+    #[pyclass(module = "ssl", name = "Certificate")]
+    #[derive(PyPayload)]
+    pub(crate) struct PySSLCertificate {
+        cert: X509,
+    }
+
+    impl fmt::Debug for PySSLCertificate {
+        fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+            f.pad("Certificate")
+        }
+    }
+
+    #[pyclass]
+    impl PySSLCertificate {
+        #[pymethod]
+        fn public_bytes(
+            &self,
+            format: OptionalArg<i32>,
+            vm: &VirtualMachine,
+        ) -> PyResult<PyObjectRef> {
+            let format = format.unwrap_or(ENCODING_PEM);
+
+            match format {
+                x if x == ENCODING_DER => {
+                    // DER encoding
+                    let der = self
+                        .cert
+                        .to_der()
+                        .map_err(|e| convert_openssl_error(vm, e))?;
+                    Ok(vm.ctx.new_bytes(der).into())
+                }
+                x if x == ENCODING_PEM => {
+                    // PEM encoding
+                    let pem = self
+                        .cert
+                        .to_pem()
+                        .map_err(|e| convert_openssl_error(vm, e))?;
+                    Ok(vm.ctx.new_bytes(pem).into())
+                }
+                _ => Err(vm.new_value_error("Unsupported format".to_owned())),
+            }
+        }
+
+        #[pymethod]
+        fn get_info(&self, vm: &VirtualMachine) -> PyResult {
+            cert_to_dict(vm, &self.cert)
+        }
+    }
+
+    fn name_to_py(vm: &VirtualMachine, name: &x509::X509NameRef) -> PyResult {
+        let list = name
+            .entries()
+            .map(|entry| {
+                let txt = obj2txt(entry.object(), false).to_pyobject(vm);
+                let asn1_str = entry.data();
+                let data_bytes = asn1_str.as_slice();
+                let data = match std::str::from_utf8(data_bytes) {
+                    Ok(s) => vm.ctx.new_str(s.to_owned()),
+                    Err(_) => vm
+                        .ctx
+                        .new_str(String::from_utf8_lossy(data_bytes).into_owned()),
+                };
+                Ok(vm.new_tuple(((txt, data),)).into())
+            })
+            .collect::<Result<_, _>>()?;
+        Ok(vm.ctx.new_tuple(list).into())
+    }
+
+    // Helper to convert X509 to dict (for getpeercert with binary=False)
+    fn cert_to_dict(vm: &VirtualMachine, cert: &X509Ref) -> PyResult {
+        let dict = vm.ctx.new_dict();
+
+        dict.set_item("subject", name_to_py(vm, cert.subject_name())?, vm)?;
+        dict.set_item("issuer", name_to_py(vm, cert.issuer_name())?, vm)?;
+        // X.509 version: OpenSSL uses 0-based (0=v1, 1=v2, 2=v3) but Python uses 1-based (1=v1, 2=v2, 3=v3)
+        dict.set_item("version", vm.new_pyobj(cert.version() + 1), vm)?;
+
+        let serial_num = cert
+            .serial_number()
+            .to_bn()
+            .and_then(|bn| bn.to_hex_str())
+            .map_err(|e| convert_openssl_error(vm, e))?;
+        dict.set_item(
+            "serialNumber",
+            vm.ctx.new_str(serial_num.to_owned()).into(),
+            vm,
+        )?;
+
+        dict.set_item(
+            "notBefore",
+            vm.ctx.new_str(cert.not_before().to_string()).into(),
+            vm,
+        )?;
+        dict.set_item(
+            "notAfter",
+            vm.ctx.new_str(cert.not_after().to_string()).into(),
+            vm,
+        )?;
+
+        if let Some(names) = cert.subject_alt_names() {
+            let san: Vec<PyObjectRef> = names
+                .iter()
+                .map(|gen_name| {
+                    if let Some(email) = gen_name.email() {
+                        vm.new_tuple((ascii!("email"), email)).into()
+                    } else if let Some(dnsname) = gen_name.dnsname() {
+                        vm.new_tuple((ascii!("DNS"), dnsname)).into()
+                    } else if let Some(ip) = gen_name.ipaddress() {
+                        // Parse IP address properly (IPv4 or IPv6)
+                        let ip_str = if ip.len() == 4 {
+                            // IPv4
+                            format!("{}.{}.{}.{}", ip[0], ip[1], ip[2], ip[3])
+                        } else if ip.len() == 16 {
+                            // IPv6 - format with all zeros visible (not compressed)
+                            let ip_addr = std::net::Ipv6Addr::from([
+                                ip[0], ip[1], ip[2], ip[3], ip[4], ip[5], ip[6], ip[7], ip[8],
+                                ip[9], ip[10], ip[11], ip[12], ip[13], ip[14], ip[15],
+                            ]);
+                            let s = ip_addr.segments();
+                            format!(
+                                "{:X}:{:X}:{:X}:{:X}:{:X}:{:X}:{:X}:{:X}",
+                                s[0], s[1], s[2], s[3], s[4], s[5], s[6], s[7]
+                            )
+                        } else {
+                            // Fallback for unexpected length
+                            String::from_utf8_lossy(ip).into_owned()
+                        };
+                        vm.new_tuple((ascii!("IP Address"), ip_str)).into()
+                    } else if let Some(uri) = gen_name.uri() {
+                        vm.new_tuple((ascii!("URI"), uri)).into()
+                    } else {
+                        // Handle DirName, Registered ID, and othername
+                        // Check if this is a directory name
+                        if let Some(dirname) = gen_name.directory_name()
+                            && let Ok(py_name) = name_to_py(vm, dirname)
+                        {
+                            return vm.new_tuple((ascii!("DirName"), py_name)).into();
+                        }
+
+                        // TODO: Handle Registered ID (GEN_RID)
+                        // CPython implementation uses i2t_ASN1_OBJECT to convert OID
+                        // This requires accessing GENERAL_NAME union which is complex in Rust
+                        // For now, we return <unsupported> for unhandled types
+
+                        // For othername and other unsupported types
+                        vm.new_tuple((ascii!("othername"), ascii!("<unsupported>")))
+                            .into()
+                    }
+                })
+                .collect();
+            dict.set_item("subjectAltName", vm.ctx.new_tuple(san).into(), vm)?;
+        };
+
+        Ok(dict.into())
+    }
+
+    // Helper to create Certificate object from X509
+    pub(crate) fn cert_to_certificate(vm: &VirtualMachine, cert: X509) -> PyResult {
+        Ok(PySSLCertificate { cert }.into_ref(&vm.ctx).into())
+    }
+
+    // For getpeercert() - returns bytes or dict depending on binary flag
+    pub(crate) fn cert_to_py(vm: &VirtualMachine, cert: &X509Ref, binary: bool) -> PyResult {
+        if binary {
+            let b = cert.to_der().map_err(|e| convert_openssl_error(vm, e))?;
+            Ok(vm.ctx.new_bytes(b).into())
+        } else {
+            cert_to_dict(vm, cert)
+        }
+    }
+
+    #[pyfunction]
+    pub(crate) fn _test_decode_cert(path: FsPath, vm: &VirtualMachine) -> PyResult {
+        let path = path.to_path_buf(vm)?;
+        let pem = std::fs::read(path).map_err(|e| e.to_pyexception(vm))?;
+        let x509 = X509::from_pem(&pem).map_err(|e| convert_openssl_error(vm, e))?;
+        cert_to_py(vm, &x509, false)
+    }
+}

vm/src/builtins/bool.rs

@@ -77,7 +77,7 @@ impl PyObjectRef {
     }
 }
 
-#[pyclass(name = "bool", module = false, base = "PyInt")]
+#[pyclass(name = "bool", module = false, base = PyInt)]
 pub struct PyBool;
 
 impl PyPayload for PyBool {

vm/src/builtins/builtin_func.rs

@@ -148,7 +148,7 @@ impl Representable for PyNativeFunction {
 impl Unconstructible for PyNativeFunction {}
 
 // `PyCMethodObject` in CPython
-#[pyclass(name = "builtin_method", module = false, base = "PyNativeFunction")]
+#[pyclass(name = "builtin_method", module = false, base = PyNativeFunction)]
 pub struct PyNativeMethod {
     pub(crate) func: PyNativeFunction,
     pub(crate) class: &'static Py<PyType>, // TODO: the actual life is &'self

vm/src/builtins/code.rs

@@ -1,12 +1,10 @@
-/*! Infamous code object. The python class `code`
-
-*/
+//! Infamous code object. The python class `code`
 
 use super::{PyBytesRef, PyStrRef, PyTupleRef, PyType, PyTypeRef};
 use crate::{
     AsObject, Context, Py, PyObject, PyObjectRef, PyPayload, PyResult, VirtualMachine,
     builtins::PyStrInterned,
-    bytecode::{self, AsBag, BorrowedConstant, CodeFlags, CodeUnit, Constant, ConstantBag},
+    bytecode::{self, AsBag, BorrowedConstant, CodeFlags, Constant, ConstantBag},
     class::{PyClassImpl, StaticType},
     convert::ToPyObject,
     frozen,
@@ -15,11 +13,7 @@ use crate::{
 };
 use malachite_bigint::BigInt;
 use num_traits::Zero;
-use rustpython_compiler_core::{
-    OneIndexed,
-    bytecode::PyCodeLocationInfoKind,
-    marshal::{MarshalError, parse_instructions_from_bytes},
-};
+use rustpython_compiler_core::{OneIndexed, bytecode::CodeUnits, bytecode::PyCodeLocationInfoKind};
 use std::{borrow::Borrow, fmt, ops::Deref};
 
 /// State for iterating through code address ranges
@@ -457,7 +451,7 @@ impl Constructor for PyCode {
 
         // Parse and validate bytecode from bytes
         let bytecode_bytes = args.co_code.as_bytes();
-        let instructions = parse_bytecode(bytecode_bytes)
+        let instructions = CodeUnits::try_from(bytecode_bytes)
             .map_err(|e| vm.new_value_error(format!("invalid bytecode: {}", e)))?;
 
         // Convert constants
@@ -925,7 +919,7 @@ impl PyCode {
         let instructions = match co_code {
             OptionalArg::Present(code_bytes) => {
                 // Parse and validate bytecode from bytes
-                parse_bytecode(code_bytes.as_bytes())
+                CodeUnits::try_from(code_bytes.as_bytes())
                     .map_err(|e| vm.new_value_error(format!("invalid bytecode: {}", e)))?
             }
             OptionalArg::Missing => self.code.instructions.clone(),
@@ -1033,19 +1027,6 @@ impl ToPyObject for bytecode::CodeObject {
     }
 }
 
-/// Validates and parses bytecode bytes into CodeUnit instructions.
-/// Returns MarshalError if bytecode is invalid (odd length or contains invalid opcodes).
-/// Note: Returning MarshalError is not necessary at this point because this is not a part of marshalling API.
-/// However, we (temporarily) reuse MarshalError for simplicity.
-fn parse_bytecode(bytecode_bytes: &[u8]) -> Result<Box<[CodeUnit]>, MarshalError> {
-    // Bytecode must have even length (each instruction is 2 bytes)
-    if !bytecode_bytes.len().is_multiple_of(2) {
-        return Err(MarshalError::InvalidBytecode);
-    }
-
-    parse_instructions_from_bytes(bytecode_bytes)
-}
-
 // Helper struct for reading linetable
 struct LineTableReader<'a> {
     data: &'a [u8],

vm/src/builtins/property.rs

@@ -67,20 +67,30 @@ impl GetDescriptor for PyProperty {
 #[pyclass(with(Constructor, Initializer, GetDescriptor), flags(BASETYPE))]
 impl PyProperty {
     // Helper method to get property name
-    fn get_property_name(&self, vm: &VirtualMachine) -> Option<PyObjectRef> {
+    // Returns the name if available, None if not found, or propagates errors
+    fn get_property_name(&self, vm: &VirtualMachine) -> PyResult<Option<PyObjectRef>> {
         // First check if name was set via __set_name__
         if let Some(name) = self.name.read().as_ref() {
-            return Some(name.clone());
+            return Ok(Some(name.clone()));
         }
 
-        // Otherwise try to get __name__ from getter
-        if let Some(getter) = self.getter.read().as_ref()
-            && let Ok(name) = getter.get_attr("__name__", vm)
-        {
-            return Some(name);
-        }
+        let getter = self.getter.read();
+        let Some(getter) = getter.as_ref() else {
+            return Ok(None);
+        };
 
-        None
+        match getter.get_attr("__name__", vm) {
+            Ok(name) => Ok(Some(name)),
+            Err(e) => {
+                // If it's an AttributeError from the getter, return None
+                // Otherwise, propagate the original exception (e.g., RuntimeError)
+                if e.class().is(vm.ctx.exceptions.attribute_error) {
+                    Ok(None)
+                } else {
+                    Err(e)
+                }
+            }
+        }
     }
 
     // Descriptor methods
@@ -143,6 +153,21 @@ impl PyProperty {
         self.deleter.read().clone()
     }
 
+    #[pygetset(name = "__name__")]
+    fn name_getter(&self, vm: &VirtualMachine) -> PyResult {
+        match self.get_property_name(vm)? {
+            Some(name) => Ok(name),
+            None => Err(
+                vm.new_attribute_error("'property' object has no attribute '__name__'".to_owned())
+            ),
+        }
+    }
+
+    #[pygetset(name = "__name__", setter)]
+    fn name_setter(&self, value: PyObjectRef) {
+        *self.name.write() = Some(value);
+    }
+
     fn doc_getter(&self) -> Option<PyObjectRef> {
         self.doc.read().clone()
     }
@@ -288,7 +313,7 @@ impl PyProperty {
         error_type: &str,
         vm: &VirtualMachine,
     ) -> PyResult<String> {
-        let prop_name = self.get_property_name(vm);
+        let prop_name = self.get_property_name(vm)?;
         let obj_type = obj.class();
         let qualname = obj_type.__qualname__(vm);
 

vm/src/builtins/str.rs

@@ -890,10 +890,6 @@ impl PyStr {
         )
     }
 
-    /// Return a str with the given prefix string removed if present.
-    ///
-    /// If the string starts with the prefix string, return string[len(prefix):]
-    /// Otherwise, return a copy of the original string.
     #[pymethod]
     fn removeprefix(&self, pref: PyStrRef) -> Wtf8Buf {
         self.as_wtf8()
@@ -901,10 +897,6 @@ impl PyStr {
             .to_owned()
     }
 
-    /// Return a str with the given suffix string removed if present.
-    ///
-    /// If the string ends with the suffix string, return string[:len(suffix)]
-    /// Otherwise, return a copy of the original string.
     #[pymethod]
     fn removesuffix(&self, suffix: PyStrRef) -> Wtf8Buf {
         self.as_wtf8()
@@ -955,10 +947,6 @@ impl PyStr {
         format(&format_str, &args, vm)
     }
 
-    /// S.format_map(mapping) -> str
-    ///
-    /// Return a formatted version of S, using substitutions from mapping.
-    /// The substitutions are identified by braces ('{' and '}').
     #[pymethod]
     fn format_map(&self, mapping: PyObjectRef, vm: &VirtualMachine) -> PyResult<Wtf8Buf> {
         let format_string =
@@ -989,8 +977,6 @@ impl PyStr {
         Ok(vm.ctx.new_str(s))
     }
 
-    /// Return a titlecased version of the string where words start with an
-    /// uppercase character and the remaining characters are lowercase.
     #[pymethod]
     fn title(&self) -> Wtf8Buf {
         let mut title = Wtf8Buf::with_capacity(self.data.len());
@@ -1066,21 +1052,6 @@ impl PyStr {
         }
     }
 
-    /// Return true if all characters in the string are printable or the string is empty,
-    /// false otherwise.  Nonprintable characters are those characters defined in the
-    /// Unicode character database as `Other` or `Separator`,
-    /// excepting the ASCII space (0x20) which is considered printable.
-    ///
-    /// All characters except those characters defined in the Unicode character
-    /// database as following categories are considered printable.
-    ///   * Cc (Other, Control)
-    ///   * Cf (Other, Format)
-    ///   * Cs (Other, Surrogate)
-    ///   * Co (Other, Private Use)
-    ///   * Cn (Other, Not Assigned)
-    ///   * Zl Separator, Line ('\u2028', LINE SEPARATOR)
-    ///   * Zp Separator, Paragraph ('\u2029', PARAGRAPH SEPARATOR)
-    ///   * Zs (Separator, Space) other than ASCII space('\x20').
     #[pymethod]
     fn isprintable(&self) -> bool {
         self.char_all(|c| c == '\u{0020}' || rustpython_literal::char::is_printable(c))
@@ -1246,8 +1217,6 @@ impl PyStr {
             .to_pyobject(vm))
     }
 
-    /// Return `true` if the sequence is ASCII titlecase and the sequence is not
-    /// empty, `false` otherwise.
     #[pymethod]
     fn istitle(&self) -> bool {
         if self.data.is_empty() {

vm/src/exceptions.rs

@@ -1225,11 +1225,11 @@ pub(super) mod types {
         pub(super) args: PyRwLock<PyTupleRef>,
     }
 
-    #[pyexception(name, base = "PyBaseException", ctx = "system_exit", impl)]
+    #[pyexception(name, base = PyBaseException, ctx = "system_exit", impl)]
     #[derive(Debug)]
     pub struct PySystemExit {}
 
-    #[pyexception(name, base = "PyBaseException", ctx = "base_exception_group")]
+    #[pyexception(name, base = PyBaseException, ctx = "base_exception_group")]
     #[derive(Debug)]
     pub struct PyBaseExceptionGroup {}
 
@@ -1245,23 +1245,23 @@ pub(super) mod types {
         }
     }
 
-    #[pyexception(name, base = "PyBaseExceptionGroup", ctx = "exception_group", impl)]
+    #[pyexception(name, base = PyBaseExceptionGroup, ctx = "exception_group", impl)]
     #[derive(Debug)]
     pub struct PyExceptionGroup {}
 
-    #[pyexception(name, base = "PyBaseException", ctx = "generator_exit", impl)]
+    #[pyexception(name, base = PyBaseException, ctx = "generator_exit", impl)]
     #[derive(Debug)]
     pub struct PyGeneratorExit {}
 
-    #[pyexception(name, base = "PyBaseException", ctx = "keyboard_interrupt", impl)]
+    #[pyexception(name, base = PyBaseException, ctx = "keyboard_interrupt", impl)]
     #[derive(Debug)]
     pub struct PyKeyboardInterrupt {}
 
-    #[pyexception(name, base = "PyBaseException", ctx = "exception_type", impl)]
+    #[pyexception(name, base = PyBaseException, ctx = "exception_type", impl)]
     #[derive(Debug)]
     pub struct PyException {}
 
-    #[pyexception(name, base = "PyException", ctx = "stop_iteration")]
+    #[pyexception(name, base = PyException, ctx = "stop_iteration")]
     #[derive(Debug)]
     pub struct PyStopIteration {}
 
@@ -1279,31 +1279,31 @@ pub(super) mod types {
         }
     }
 
-    #[pyexception(name, base = "PyException", ctx = "stop_async_iteration", impl)]
+    #[pyexception(name, base = PyException, ctx = "stop_async_iteration", impl)]
     #[derive(Debug)]
     pub struct PyStopAsyncIteration {}
 
-    #[pyexception(name, base = "PyException", ctx = "arithmetic_error", impl)]
+    #[pyexception(name, base = PyException, ctx = "arithmetic_error", impl)]
     #[derive(Debug)]
     pub struct PyArithmeticError {}
 
-    #[pyexception(name, base = "PyArithmeticError", ctx = "floating_point_error", impl)]
+    #[pyexception(name, base = PyArithmeticError, ctx = "floating_point_error", impl)]
     #[derive(Debug)]
     pub struct PyFloatingPointError {}
 
-    #[pyexception(name, base = "PyArithmeticError", ctx = "overflow_error", impl)]
+    #[pyexception(name, base = PyArithmeticError, ctx = "overflow_error", impl)]
     #[derive(Debug)]
     pub struct PyOverflowError {}
 
-    #[pyexception(name, base = "PyArithmeticError", ctx = "zero_division_error", impl)]
+    #[pyexception(name, base = PyArithmeticError, ctx = "zero_division_error", impl)]
     #[derive(Debug)]
     pub struct PyZeroDivisionError {}
 
-    #[pyexception(name, base = "PyException", ctx = "assertion_error", impl)]
+    #[pyexception(name, base = PyException, ctx = "assertion_error", impl)]
     #[derive(Debug)]
     pub struct PyAssertionError {}
 
-    #[pyexception(name, base = "PyException", ctx = "attribute_error")]
+    #[pyexception(name, base = PyException, ctx = "attribute_error")]
     #[derive(Debug)]
     pub struct PyAttributeError {}
 
@@ -1330,15 +1330,15 @@ pub(super) mod types {
         }
     }
 
-    #[pyexception(name, base = "PyException", ctx = "buffer_error", impl)]
+    #[pyexception(name, base = PyException, ctx = "buffer_error", impl)]
     #[derive(Debug)]
     pub struct PyBufferError {}
 
-    #[pyexception(name, base = "PyException", ctx = "eof_error", impl)]
+    #[pyexception(name, base = PyException, ctx = "eof_error", impl)]
     #[derive(Debug)]
     pub struct PyEOFError {}
 
-    #[pyexception(name, base = "PyException", ctx = "import_error")]
+    #[pyexception(name, base = PyException, ctx = "import_error")]
     #[derive(Debug)]
     pub struct PyImportError {}
 
@@ -1383,19 +1383,19 @@ pub(super) mod types {
         }
     }
 
-    #[pyexception(name, base = "PyImportError", ctx = "module_not_found_error", impl)]
+    #[pyexception(name, base = PyImportError, ctx = "module_not_found_error", impl)]
     #[derive(Debug)]
     pub struct PyModuleNotFoundError {}
 
-    #[pyexception(name, base = "PyException", ctx = "lookup_error", impl)]
+    #[pyexception(name, base = PyException, ctx = "lookup_error", impl)]
     #[derive(Debug)]
     pub struct PyLookupError {}
 
-    #[pyexception(name, base = "PyLookupError", ctx = "index_error", impl)]
+    #[pyexception(name, base = PyLookupError, ctx = "index_error", impl)]
     #[derive(Debug)]
     pub struct PyIndexError {}
 
-    #[pyexception(name, base = "PyLookupError", ctx = "key_error")]
+    #[pyexception(name, base = PyLookupError, ctx = "key_error")]
     #[derive(Debug)]
     pub struct PyKeyError {}
 
@@ -1415,19 +1415,19 @@ pub(super) mod types {
         }
     }
 
-    #[pyexception(name, base = "PyException", ctx = "memory_error", impl)]
+    #[pyexception(name, base = PyException, ctx = "memory_error", impl)]
     #[derive(Debug)]
     pub struct PyMemoryError {}
 
-    #[pyexception(name, base = "PyException", ctx = "name_error", impl)]
+    #[pyexception(name, base = PyException, ctx = "name_error", impl)]
     #[derive(Debug)]
     pub struct PyNameError {}
 
-    #[pyexception(name, base = "PyNameError", ctx = "unbound_local_error", impl)]
+    #[pyexception(name, base = PyNameError, ctx = "unbound_local_error", impl)]
     #[derive(Debug)]
     pub struct PyUnboundLocalError {}
 
-    #[pyexception(name, base = "PyException", ctx = "os_error")]
+    #[pyexception(name, base = PyException, ctx = "os_error")]
     #[derive(Debug)]
     pub struct PyOSError {}
 
@@ -1450,7 +1450,7 @@ pub(super) mod types {
         }
         #[cfg(not(target_arch = "wasm32"))]
         #[pyslot]
-        fn slot_new(cls: PyTypeRef, args: FuncArgs, vm: &VirtualMachine) -> PyResult {
+        pub fn slot_new(cls: PyTypeRef, args: FuncArgs, vm: &VirtualMachine) -> PyResult {
             // We need this method, because of how `CPython` copies `init`
             // from `BaseException` in `SimpleExtendsException` macro.
             // See: `BaseException_new`
@@ -1465,12 +1465,12 @@ pub(super) mod types {
         }
         #[cfg(target_arch = "wasm32")]
         #[pyslot]
-        fn slot_new(cls: PyTypeRef, args: FuncArgs, vm: &VirtualMachine) -> PyResult {
+        pub fn slot_new(cls: PyTypeRef, args: FuncArgs, vm: &VirtualMachine) -> PyResult {
             PyBaseException::slot_new(cls, args, vm)
         }
         #[pyslot]
         #[pymethod(name = "__init__")]
-        fn slot_init(zelf: PyObjectRef, args: FuncArgs, vm: &VirtualMachine) -> PyResult<()> {
+        pub fn slot_init(zelf: PyObjectRef, args: FuncArgs, vm: &VirtualMachine) -> PyResult<()> {
             let len = args.args.len();
             let mut new_args = args;
             if (3..=5).contains(&len) {
@@ -1558,25 +1558,25 @@ pub(super) mod types {
         }
     }
 
-    #[pyexception(name, base = "PyOSError", ctx = "blocking_io_error", impl)]
+    #[pyexception(name, base = PyOSError, ctx = "blocking_io_error", impl)]
     #[derive(Debug)]
     pub struct PyBlockingIOError {}
 
-    #[pyexception(name, base = "PyOSError", ctx = "child_process_error", impl)]
+    #[pyexception(name, base = PyOSError, ctx = "child_process_error", impl)]
     #[derive(Debug)]
     pub struct PyChildProcessError {}
 
-    #[pyexception(name, base = "PyOSError", ctx = "connection_error", impl)]
+    #[pyexception(name, base = PyOSError, ctx = "connection_error", impl)]
     #[derive(Debug)]
     pub struct PyConnectionError {}
 
-    #[pyexception(name, base = "PyConnectionError", ctx = "broken_pipe_error", impl)]
+    #[pyexception(name, base = PyConnectionError, ctx = "broken_pipe_error", impl)]
     #[derive(Debug)]
     pub struct PyBrokenPipeError {}
 
     #[pyexception(
         name,
-        base = "PyConnectionError",
+        base = PyConnectionError,
         ctx = "connection_aborted_error",
         impl
     )]
@@ -1585,66 +1585,66 @@ pub(super) mod types {
 
     #[pyexception(
         name,
-        base = "PyConnectionError",
+        base = PyConnectionError,
         ctx = "connection_refused_error",
         impl
     )]
     #[derive(Debug)]
     pub struct PyConnectionRefusedError {}
 
-    #[pyexception(name, base = "PyConnectionError", ctx = "connection_reset_error", impl)]
+    #[pyexception(name, base = PyConnectionError, ctx = "connection_reset_error", impl)]
     #[derive(Debug)]
     pub struct PyConnectionResetError {}
 
-    #[pyexception(name, base = "PyOSError", ctx = "file_exists_error", impl)]
+    #[pyexception(name, base = PyOSError, ctx = "file_exists_error", impl)]
     #[derive(Debug)]
     pub struct PyFileExistsError {}
 
-    #[pyexception(name, base = "PyOSError", ctx = "file_not_found_error", impl)]
+    #[pyexception(name, base = PyOSError, ctx = "file_not_found_error", impl)]
     #[derive(Debug)]
     pub struct PyFileNotFoundError {}
 
-    #[pyexception(name, base = "PyOSError", ctx = "interrupted_error", impl)]
+    #[pyexception(name, base = PyOSError, ctx = "interrupted_error", impl)]
     #[derive(Debug)]
     pub struct PyInterruptedError {}
 
-    #[pyexception(name, base = "PyOSError", ctx = "is_a_directory_error", impl)]
+    #[pyexception(name, base = PyOSError, ctx = "is_a_directory_error", impl)]
     #[derive(Debug)]
     pub struct PyIsADirectoryError {}
 
-    #[pyexception(name, base = "PyOSError", ctx = "not_a_directory_error", impl)]
+    #[pyexception(name, base = PyOSError, ctx = "not_a_directory_error", impl)]
     #[derive(Debug)]
     pub struct PyNotADirectoryError {}
 
-    #[pyexception(name, base = "PyOSError", ctx = "permission_error", impl)]
+    #[pyexception(name, base = PyOSError, ctx = "permission_error", impl)]
     #[derive(Debug)]
     pub struct PyPermissionError {}
 
-    #[pyexception(name, base = "PyOSError", ctx = "process_lookup_error", impl)]
+    #[pyexception(name, base = PyOSError, ctx = "process_lookup_error", impl)]
     #[derive(Debug)]
     pub struct PyProcessLookupError {}
 
-    #[pyexception(name, base = "PyOSError", ctx = "timeout_error", impl)]
+    #[pyexception(name, base = PyOSError, ctx = "timeout_error", impl)]
     #[derive(Debug)]
     pub struct PyTimeoutError {}
 
-    #[pyexception(name, base = "PyException", ctx = "reference_error", impl)]
+    #[pyexception(name, base = PyException, ctx = "reference_error", impl)]
     #[derive(Debug)]
     pub struct PyReferenceError {}
 
-    #[pyexception(name, base = "PyException", ctx = "runtime_error", impl)]
+    #[pyexception(name, base = PyException, ctx = "runtime_error", impl)]
     #[derive(Debug)]
     pub struct PyRuntimeError {}
 
-    #[pyexception(name, base = "PyRuntimeError", ctx = "not_implemented_error", impl)]
+    #[pyexception(name, base = PyRuntimeError, ctx = "not_implemented_error", impl)]
     #[derive(Debug)]
     pub struct PyNotImplementedError {}
 
-    #[pyexception(name, base = "PyRuntimeError", ctx = "recursion_error", impl)]
+    #[pyexception(name, base = PyRuntimeError, ctx = "recursion_error", impl)]
     #[derive(Debug)]
     pub struct PyRecursionError {}
 
-    #[pyexception(name, base = "PyException", ctx = "syntax_error")]
+    #[pyexception(name, base = PyException, ctx = "syntax_error")]
     #[derive(Debug)]
     pub struct PySyntaxError {}
 
@@ -1736,7 +1736,7 @@ pub(super) mod types {
 
     #[pyexception(
         name = "_IncompleteInputError",
-        base = "PySyntaxError",
+        base = PySyntaxError,
         ctx = "incomplete_input_error"
     )]
     #[derive(Debug)]
@@ -1756,31 +1756,31 @@ pub(super) mod types {
         }
     }
 
-    #[pyexception(name, base = "PySyntaxError", ctx = "indentation_error", impl)]
+    #[pyexception(name, base = PySyntaxError, ctx = "indentation_error", impl)]
     #[derive(Debug)]
     pub struct PyIndentationError {}
 
-    #[pyexception(name, base = "PyIndentationError", ctx = "tab_error", impl)]
+    #[pyexception(name, base = PyIndentationError, ctx = "tab_error", impl)]
     #[derive(Debug)]
     pub struct PyTabError {}
 
-    #[pyexception(name, base = "PyException", ctx = "system_error", impl)]
+    #[pyexception(name, base = PyException, ctx = "system_error", impl)]
     #[derive(Debug)]
     pub struct PySystemError {}
 
-    #[pyexception(name, base = "PyException", ctx = "type_error", impl)]
+    #[pyexception(name, base = PyException, ctx = "type_error", impl)]
     #[derive(Debug)]
     pub struct PyTypeError {}
 
-    #[pyexception(name, base = "PyException", ctx = "value_error", impl)]
+    #[pyexception(name, base = PyException, ctx = "value_error", impl)]
     #[derive(Debug)]
     pub struct PyValueError {}
 
-    #[pyexception(name, base = "PyValueError", ctx = "unicode_error", impl)]
+    #[pyexception(name, base = PyValueError, ctx = "unicode_error", impl)]
     #[derive(Debug)]
     pub struct PyUnicodeError {}
 
-    #[pyexception(name, base = "PyUnicodeError", ctx = "unicode_decode_error")]
+    #[pyexception(name, base = PyUnicodeError, ctx = "unicode_decode_error")]
     #[derive(Debug)]
     pub struct PyUnicodeDecodeError {}
 
@@ -1831,7 +1831,7 @@ pub(super) mod types {
         }
     }
 
-    #[pyexception(name, base = "PyUnicodeError", ctx = "unicode_encode_error")]
+    #[pyexception(name, base = PyUnicodeError, ctx = "unicode_encode_error")]
     #[derive(Debug)]
     pub struct PyUnicodeEncodeError {}
 
@@ -1882,7 +1882,7 @@ pub(super) mod types {
         }
     }
 
-    #[pyexception(name, base = "PyUnicodeError", ctx = "unicode_translate_error")]
+    #[pyexception(name, base = PyUnicodeError, ctx = "unicode_translate_error")]
     #[derive(Debug)]
     pub struct PyUnicodeTranslateError {}
 
@@ -1930,56 +1930,56 @@ pub(super) mod types {
 
     /// JIT error.
     #[cfg(feature = "jit")]
-    #[pyexception(name, base = "PyException", ctx = "jit_error", impl)]
+    #[pyexception(name, base = PyException, ctx = "jit_error", impl)]
     #[derive(Debug)]
     pub struct PyJitError {}
 
     // Warnings
-    #[pyexception(name, base = "PyException", ctx = "warning", impl)]
+    #[pyexception(name, base = PyException, ctx = "warning", impl)]
     #[derive(Debug)]
     pub struct PyWarning {}
 
-    #[pyexception(name, base = "PyWarning", ctx = "deprecation_warning", impl)]
+    #[pyexception(name, base = PyWarning, ctx = "deprecation_warning", impl)]
     #[derive(Debug)]
     pub struct PyDeprecationWarning {}
 
-    #[pyexception(name, base = "PyWarning", ctx = "pending_deprecation_warning", impl)]
+    #[pyexception(name, base = PyWarning, ctx = "pending_deprecation_warning", impl)]
     #[derive(Debug)]
     pub struct PyPendingDeprecationWarning {}
 
-    #[pyexception(name, base = "PyWarning", ctx = "runtime_warning", impl)]
+    #[pyexception(name, base = PyWarning, ctx = "runtime_warning", impl)]
     #[derive(Debug)]
     pub struct PyRuntimeWarning {}
 
-    #[pyexception(name, base = "PyWarning", ctx = "syntax_warning", impl)]
+    #[pyexception(name, base = PyWarning, ctx = "syntax_warning", impl)]
     #[derive(Debug)]
     pub struct PySyntaxWarning {}
 
-    #[pyexception(name, base = "PyWarning", ctx = "user_warning", impl)]
+    #[pyexception(name, base = PyWarning, ctx = "user_warning", impl)]
     #[derive(Debug)]
     pub struct PyUserWarning {}
 
-    #[pyexception(name, base = "PyWarning", ctx = "future_warning", impl)]
+    #[pyexception(name, base = PyWarning, ctx = "future_warning", impl)]
     #[derive(Debug)]
     pub struct PyFutureWarning {}
 
-    #[pyexception(name, base = "PyWarning", ctx = "import_warning", impl)]
+    #[pyexception(name, base = PyWarning, ctx = "import_warning", impl)]
     #[derive(Debug)]
     pub struct PyImportWarning {}
 
-    #[pyexception(name, base = "PyWarning", ctx = "unicode_warning", impl)]
+    #[pyexception(name, base = PyWarning, ctx = "unicode_warning", impl)]
     #[derive(Debug)]
     pub struct PyUnicodeWarning {}
 
-    #[pyexception(name, base = "PyWarning", ctx = "bytes_warning", impl)]
+    #[pyexception(name, base = PyWarning, ctx = "bytes_warning", impl)]
     #[derive(Debug)]
     pub struct PyBytesWarning {}
 
-    #[pyexception(name, base = "PyWarning", ctx = "resource_warning", impl)]
+    #[pyexception(name, base = PyWarning, ctx = "resource_warning", impl)]
     #[derive(Debug)]
     pub struct PyResourceWarning {}
 
-    #[pyexception(name, base = "PyWarning", ctx = "encoding_warning", impl)]
+    #[pyexception(name, base = PyWarning, ctx = "encoding_warning", impl)]
     #[derive(Debug)]
     pub struct PyEncodingWarning {}
 }

vm/src/protocol/number.rs

@@ -443,117 +443,140 @@ impl<'a> PyNumber<'a> {
 
     // PyNumber_Check
     pub fn check(obj: &PyObject) -> bool {
-        let methods = &obj.class().slots.as_number;
-        methods.int.load().is_some()
-            || methods.index.load().is_some()
-            || methods.float.load().is_some()
-            || obj.downcastable::<PyComplex>()
+        let cls = &obj.class();
+        // TODO: when we finally have a proper slot inheritance, mro_find_map can be removed
+        //    methods.int.load().is_some()
+        //    || methods.index.load().is_some()
+        //    || methods.float.load().is_some()
+        //    || obj.downcastable::<PyComplex>()
+        let has_number = cls
+            .mro_find_map(|x| {
+                let methods = &x.slots.as_number;
+                if methods.int.load().is_some()
+                    || methods.index.load().is_some()
+                    || methods.float.load().is_some()
+                {
+                    Some(())
+                } else {
+                    None
+                }
+            })
+            .is_some();
+        has_number || obj.downcastable::<PyComplex>()
     }
 }
 
 impl PyNumber<'_> {
     // PyIndex_Check
     pub fn is_index(self) -> bool {
-        self.class().slots.as_number.index.load().is_some()
+        self.class()
+            .mro_find_map(|x| x.slots.as_number.index.load())
+            .is_some()
     }
 
     #[inline]
     pub fn int(self, vm: &VirtualMachine) -> Option<PyResult<PyIntRef>> {
-        self.class().slots.as_number.int.load().map(|f| {
-            let ret = f(self, vm)?;
+        self.class()
+            .mro_find_map(|x| x.slots.as_number.int.load())
+            .map(|f| {
+                let ret = f(self, vm)?;
 
-            if let Some(ret) = ret.downcast_ref_if_exact::<PyInt>(vm) {
-                return Ok(ret.to_owned());
-            }
+                if let Some(ret) = ret.downcast_ref_if_exact::<PyInt>(vm) {
+                    return Ok(ret.to_owned());
+                }
 
-            let ret_class = ret.class().to_owned();
-            if let Some(ret) = ret.downcast_ref::<PyInt>() {
-                warnings::warn(
-                    vm.ctx.exceptions.deprecation_warning,
-                    format!(
-                        "__int__ returned non-int (type {ret_class}).  \
+                let ret_class = ret.class().to_owned();
+                if let Some(ret) = ret.downcast_ref::<PyInt>() {
+                    warnings::warn(
+                        vm.ctx.exceptions.deprecation_warning,
+                        format!(
+                            "__int__ returned non-int (type {ret_class}).  \
                     The ability to return an instance of a strict subclass of int \
                     is deprecated, and may be removed in a future version of Python."
-                    ),
-                    1,
-                    vm,
-                )?;
+                        ),
+                        1,
+                        vm,
+                    )?;
 
-                Ok(ret.to_owned())
-            } else {
-                Err(vm.new_type_error(format!(
-                    "{}.__int__ returned non-int(type {})",
-                    self.class(),
-                    ret_class
-                )))
-            }
-        })
+                    Ok(ret.to_owned())
+                } else {
+                    Err(vm.new_type_error(format!(
+                        "{}.__int__ returned non-int(type {})",
+                        self.class(),
+                        ret_class
+                    )))
+                }
+            })
     }
 
     #[inline]
     pub fn index(self, vm: &VirtualMachine) -> Option<PyResult<PyIntRef>> {
-        self.class().slots.as_number.index.load().map(|f| {
-            let ret = f(self, vm)?;
+        self.class()
+            .mro_find_map(|x| x.slots.as_number.index.load())
+            .map(|f| {
+                let ret = f(self, vm)?;
 
-            if let Some(ret) = ret.downcast_ref_if_exact::<PyInt>(vm) {
-                return Ok(ret.to_owned());
-            }
+                if let Some(ret) = ret.downcast_ref_if_exact::<PyInt>(vm) {
+                    return Ok(ret.to_owned());
+                }
 
-            let ret_class = ret.class().to_owned();
-            if let Some(ret) = ret.downcast_ref::<PyInt>() {
-                warnings::warn(
-                    vm.ctx.exceptions.deprecation_warning,
-                    format!(
-                        "__index__ returned non-int (type {ret_class}).  \
+                let ret_class = ret.class().to_owned();
+                if let Some(ret) = ret.downcast_ref::<PyInt>() {
+                    warnings::warn(
+                        vm.ctx.exceptions.deprecation_warning,
+                        format!(
+                            "__index__ returned non-int (type {ret_class}).  \
                     The ability to return an instance of a strict subclass of int \
                     is deprecated, and may be removed in a future version of Python."
-                    ),
-                    1,
-                    vm,
-                )?;
+                        ),
+                        1,
+                        vm,
+                    )?;
 
-                Ok(ret.to_owned())
-            } else {
-                Err(vm.new_type_error(format!(
-                    "{}.__index__ returned non-int(type {})",
-                    self.class(),
-                    ret_class
-                )))
-            }
-        })
+                    Ok(ret.to_owned())
+                } else {
+                    Err(vm.new_type_error(format!(
+                        "{}.__index__ returned non-int(type {})",
+                        self.class(),
+                        ret_class
+                    )))
+                }
+            })
     }
 
     #[inline]
     pub fn float(self, vm: &VirtualMachine) -> Option<PyResult<PyRef<PyFloat>>> {
-        self.class().slots.as_number.float.load().map(|f| {
-            let ret = f(self, vm)?;
+        self.class()
+            .mro_find_map(|x| x.slots.as_number.float.load())
+            .map(|f| {
+                let ret = f(self, vm)?;
 
-            if let Some(ret) = ret.downcast_ref_if_exact::<PyFloat>(vm) {
-                return Ok(ret.to_owned());
-            }
+                if let Some(ret) = ret.downcast_ref_if_exact::<PyFloat>(vm) {
+                    return Ok(ret.to_owned());
+                }
 
-            let ret_class = ret.class().to_owned();
-            if let Some(ret) = ret.downcast_ref::<PyFloat>() {
-                warnings::warn(
-                    vm.ctx.exceptions.deprecation_warning,
-                    format!(
-                        "__float__ returned non-float (type {ret_class}).  \
+                let ret_class = ret.class().to_owned();
+                if let Some(ret) = ret.downcast_ref::<PyFloat>() {
+                    warnings::warn(
+                        vm.ctx.exceptions.deprecation_warning,
+                        format!(
+                            "__float__ returned non-float (type {ret_class}).  \
                     The ability to return an instance of a strict subclass of float \
                     is deprecated, and may be removed in a future version of Python."
-                    ),
-                    1,
-                    vm,
-                )?;
+                        ),
+                        1,
+                        vm,
+                    )?;
 
-                Ok(ret.to_owned())
-            } else {
-                Err(vm.new_type_error(format!(
-                    "{}.__float__ returned non-float(type {})",
-                    self.class(),
-                    ret_class
-                )))
-            }
-        })
+                    Ok(ret.to_owned())
+                } else {
+                    Err(vm.new_type_error(format!(
+                        "{}.__float__ returned non-float(type {})",
+                        self.class(),
+                        ret_class
+                    )))
+                }
+            })
     }
 }
 

vm/src/readline.rs

@@ -76,6 +76,9 @@ mod rustyline_readline {
         repl: rustyline::Editor<H, rustyline::history::DefaultHistory>,
     }
 
+    #[cfg(windows)]
+    const EOF_CHAR: &str = "\u{001A}";
+
     impl<H: Helper> Readline<H> {
         pub fn new(helper: H) -> Self {
             use rustyline::*;
@@ -88,6 +91,16 @@ mod rustyline_readline {
             )
             .expect("failed to initialize line editor");
             repl.set_helper(Some(helper));
+
+            // Bind CTRL + Z to insert EOF character on Windows
+            #[cfg(windows)]
+            {
+                repl.bind_sequence(
+                    KeyEvent::new('z', Modifiers::CTRL),
+                    EventHandler::Simple(Cmd::Insert(1, EOF_CHAR.into())),
+                );
+            }
+
             Self { repl }
         }
 
@@ -115,7 +128,19 @@ mod rustyline_readline {
             use rustyline::error::ReadlineError;
             loop {
                 break match self.repl.readline(prompt) {
-                    Ok(line) => ReadlineResult::Line(line),
+                    Ok(line) => {
+                        // Check for CTRL + Z on Windows
+                        #[cfg(windows)]
+                        {
+                            use std::io::IsTerminal;
+
+                            let trimmed = line.trim_end_matches(&['\r', '\n'][..]);
+                            if trimmed == EOF_CHAR && io::stdin().is_terminal() {
+                                return ReadlineResult::Eof;
+                            }
+                        }
+                        ReadlineResult::Line(line)
+                    }
                     Err(ReadlineError::Interrupted) => ReadlineResult::Interrupt,
                     Err(ReadlineError::Eof) => ReadlineResult::Eof,
                     Err(ReadlineError::Io(e)) => ReadlineResult::Io(e),

vm/src/stdlib/ast/pyast.rs

@@ -77,774 +77,774 @@ macro_rules! impl_node {
     };
 }
 
-#[pyclass(module = "_ast", name = "mod", base = "NodeAst")]
+#[pyclass(module = "_ast", name = "mod", base = NodeAst)]
 pub(crate) struct NodeMod;
 
 #[pyclass(flags(HAS_DICT, BASETYPE))]
 impl NodeMod {}
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "Module", base = "NodeMod")]
+    #[pyclass(module = "_ast", name = "Module", base = NodeMod)]
     pub(crate) struct NodeModModule,
     fields: ["body", "type_ignores"],
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "Interactive", base = "NodeMod")]
+    #[pyclass(module = "_ast", name = "Interactive", base = NodeMod)]
     pub(crate) struct NodeModInteractive,
     fields: ["body"],
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "Expression", base = "NodeMod")]
+    #[pyclass(module = "_ast", name = "Expression", base = NodeMod)]
     pub(crate) struct NodeModExpression,
     fields: ["body"],
 );
 
-#[pyclass(module = "_ast", name = "stmt", base = "NodeAst")]
+#[pyclass(module = "_ast", name = "stmt", base = NodeAst)]
 pub(crate) struct NodeStmt;
 
 #[pyclass(flags(HAS_DICT, BASETYPE))]
 impl NodeStmt {}
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "FunctionType", base = "NodeMod")]
+    #[pyclass(module = "_ast", name = "FunctionType", base = NodeMod)]
     pub(crate) struct NodeModFunctionType,
     fields: ["argtypes", "returns"],
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "FunctionDef", base = "NodeStmt")]
+    #[pyclass(module = "_ast", name = "FunctionDef", base = NodeStmt)]
     pub(crate) struct NodeStmtFunctionDef,
     fields: ["name", "args", "body", "decorator_list", "returns", "type_comment", "type_params"],
     attributes: ["lineno", "col_offset", "end_lineno", "end_col_offset"],
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "AsyncFunctionDef", base = "NodeStmt")]
+    #[pyclass(module = "_ast", name = "AsyncFunctionDef", base = NodeStmt)]
     pub(crate) struct NodeStmtAsyncFunctionDef,
     fields: ["name", "args", "body", "decorator_list", "returns", "type_comment", "type_params"],
     attributes: ["lineno", "col_offset", "end_lineno", "end_col_offset"],
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "ClassDef", base = "NodeStmt")]
+    #[pyclass(module = "_ast", name = "ClassDef", base = NodeStmt)]
     pub(crate) struct NodeStmtClassDef,
     fields: ["name", "bases", "keywords", "body", "decorator_list", "type_params"],
     attributes: ["lineno", "col_offset", "end_lineno", "end_col_offset"],
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "Return", base = "NodeStmt")]
+    #[pyclass(module = "_ast", name = "Return", base = NodeStmt)]
     pub(crate) struct NodeStmtReturn,
     fields: ["value"],
     attributes: ["lineno", "col_offset", "end_lineno", "end_col_offset"],
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "Delete", base = "NodeStmt")]
+    #[pyclass(module = "_ast", name = "Delete", base = NodeStmt)]
     pub(crate) struct NodeStmtDelete,
     fields: ["targets"],
     attributes: ["lineno", "col_offset", "end_lineno", "end_col_offset"],
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "Assign", base = "NodeStmt")]
+    #[pyclass(module = "_ast", name = "Assign", base = NodeStmt)]
     pub(crate) struct NodeStmtAssign,
     fields: ["targets", "value", "type_comment"],
     attributes: ["lineno", "col_offset", "end_lineno", "end_col_offset"],
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "TypeAlias", base = "NodeStmt")]
+    #[pyclass(module = "_ast", name = "TypeAlias", base = NodeStmt)]
     pub(crate) struct NodeStmtTypeAlias,
     fields: ["name", "type_params", "value"],
     attributes: ["lineno", "col_offset", "end_lineno", "end_col_offset"],
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "AugAssign", base = "NodeStmt")]
+    #[pyclass(module = "_ast", name = "AugAssign", base = NodeStmt)]
     pub(crate) struct NodeStmtAugAssign,
     fields: ["target", "op", "value"],
     attributes: ["lineno", "col_offset", "end_lineno", "end_col_offset"],
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "AnnAssign", base = "NodeStmt")]
+    #[pyclass(module = "_ast", name = "AnnAssign", base = NodeStmt)]
     pub(crate) struct NodeStmtAnnAssign,
     fields: ["target", "annotation", "value", "simple"],
     attributes: ["lineno", "col_offset", "end_lineno", "end_col_offset"],
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "For", base = "NodeStmt")]
+    #[pyclass(module = "_ast", name = "For", base = NodeStmt)]
     pub(crate) struct NodeStmtFor,
     fields: ["target", "iter", "body", "orelse", "type_comment"],
     attributes: ["lineno", "col_offset", "end_lineno", "end_col_offset"],
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "AsyncFor", base = "NodeStmt")]
+    #[pyclass(module = "_ast", name = "AsyncFor", base = NodeStmt)]
     pub(crate) struct NodeStmtAsyncFor,
     fields: ["target", "iter", "body", "orelse", "type_comment"],
     attributes: ["lineno", "col_offset", "end_lineno", "end_col_offset"],
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "While", base = "NodeStmt")]
+    #[pyclass(module = "_ast", name = "While", base = NodeStmt)]
     pub(crate) struct NodeStmtWhile,
     fields: ["test", "body", "orelse"],
     attributes: ["lineno", "col_offset", "end_lineno", "end_col_offset"],
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "If", base = "NodeStmt")]
+    #[pyclass(module = "_ast", name = "If", base = NodeStmt)]
     pub(crate) struct NodeStmtIf,
     fields: ["test", "body", "orelse"],
     attributes: ["lineno", "col_offset", "end_lineno", "end_col_offset"],
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "With", base = "NodeStmt")]
+    #[pyclass(module = "_ast", name = "With", base = NodeStmt)]
     pub(crate) struct NodeStmtWith,
     fields: ["items", "body", "type_comment"],
     attributes: ["lineno", "col_offset", "end_lineno", "end_col_offset"],
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "AsyncWith", base = "NodeStmt")]
+    #[pyclass(module = "_ast", name = "AsyncWith", base = NodeStmt)]
     pub(crate) struct NodeStmtAsyncWith,
     fields: ["items", "body", "type_comment"],
     attributes: ["lineno", "col_offset", "end_lineno", "end_col_offset"],
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "Match", base = "NodeStmt")]
+    #[pyclass(module = "_ast", name = "Match", base = NodeStmt)]
     pub(crate) struct NodeStmtMatch,
     fields: ["subject", "cases"],
     attributes: ["lineno", "col_offset", "end_lineno", "end_col_offset"],
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "Raise", base = "NodeStmt")]
+    #[pyclass(module = "_ast", name = "Raise", base = NodeStmt)]
     pub(crate) struct NodeStmtRaise,
     fields: ["exc", "cause"],
     attributes: ["lineno", "col_offset", "end_lineno", "end_col_offset"],
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "Try", base = "NodeStmt")]
+    #[pyclass(module = "_ast", name = "Try", base = NodeStmt)]
     pub(crate) struct NodeStmtTry,
     fields: ["body", "handlers", "orelse", "finalbody"],
     attributes: ["lineno", "col_offset", "end_lineno", "end_col_offset"],
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "TryStar", base = "NodeStmt")]
+    #[pyclass(module = "_ast", name = "TryStar", base = NodeStmt)]
     pub(crate) struct NodeStmtTryStar,
     fields: ["body", "handlers", "orelse", "finalbody"],
     attributes: ["lineno", "col_offset", "end_lineno", "end_col_offset"],
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "Assert", base = "NodeStmt")]
+    #[pyclass(module = "_ast", name = "Assert", base = NodeStmt)]
     pub(crate) struct NodeStmtAssert,
     fields: ["test", "msg"],
     attributes: ["lineno", "col_offset", "end_lineno", "end_col_offset"],
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "Import", base = "NodeStmt")]
+    #[pyclass(module = "_ast", name = "Import", base = NodeStmt)]
     pub(crate) struct NodeStmtImport,
     fields: ["names"],
     attributes: ["lineno", "col_offset", "end_lineno", "end_col_offset"],
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "ImportFrom", base = "NodeStmt")]
+    #[pyclass(module = "_ast", name = "ImportFrom", base = NodeStmt)]
     pub(crate) struct NodeStmtImportFrom,
     fields: ["module", "names", "level"],
     attributes: ["lineno", "col_offset", "end_lineno", "end_col_offset"],
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "Global", base = "NodeStmt")]
+    #[pyclass(module = "_ast", name = "Global", base = NodeStmt)]
     pub(crate) struct NodeStmtGlobal,
     fields: ["names"],
     attributes: ["lineno", "col_offset", "end_lineno", "end_col_offset"],
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "Nonlocal", base = "NodeStmt")]
+    #[pyclass(module = "_ast", name = "Nonlocal", base = NodeStmt)]
     pub(crate) struct NodeStmtNonlocal,
     fields: ["names"],
     attributes: ["lineno", "col_offset", "end_lineno", "end_col_offset"],
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "Expr", base = "NodeStmt")]
+    #[pyclass(module = "_ast", name = "Expr", base = NodeStmt)]
     pub(crate) struct NodeStmtExpr,
     fields: ["value"],
     attributes: ["lineno", "col_offset", "end_lineno", "end_col_offset"],
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "Pass", base = "NodeStmt")]
+    #[pyclass(module = "_ast", name = "Pass", base = NodeStmt)]
     pub(crate) struct NodeStmtPass,
     attributes: ["lineno", "col_offset", "end_lineno", "end_col_offset"],
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "Break", base = "NodeStmt")]
+    #[pyclass(module = "_ast", name = "Break", base = NodeStmt)]
     pub(crate) struct NodeStmtBreak,
     attributes: ["lineno", "col_offset", "end_lineno", "end_col_offset"],
 );
 
-#[pyclass(module = "_ast", name = "expr", base = "NodeAst")]
+#[pyclass(module = "_ast", name = "expr", base = NodeAst)]
 pub(crate) struct NodeExpr;
 
 #[pyclass(flags(HAS_DICT, BASETYPE))]
 impl NodeExpr {}
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "Continue", base = "NodeStmt")]
+    #[pyclass(module = "_ast", name = "Continue", base = NodeStmt)]
     pub(crate) struct NodeStmtContinue,
     attributes: ["lineno", "col_offset", "end_lineno", "end_col_offset"],
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "BoolOp", base = "NodeExpr")]
+    #[pyclass(module = "_ast", name = "BoolOp", base = NodeExpr)]
     pub(crate) struct NodeExprBoolOp,
     fields: ["op", "values"],
     attributes: ["lineno", "col_offset", "end_lineno", "end_col_offset"],
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "NamedExpr", base = "NodeExpr")]
+    #[pyclass(module = "_ast", name = "NamedExpr", base = NodeExpr)]
     pub(crate) struct NodeExprNamedExpr,
     fields: ["target", "value"],
     attributes: ["lineno", "col_offset", "end_lineno", "end_col_offset"],
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "BinOp", base = "NodeExpr")]
+    #[pyclass(module = "_ast", name = "BinOp", base = NodeExpr)]
     pub(crate) struct NodeExprBinOp,
     fields: ["left", "op", "right"],
     attributes: ["lineno", "col_offset", "end_lineno", "end_col_offset"],
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "UnaryOp", base = "NodeExpr")]
+    #[pyclass(module = "_ast", name = "UnaryOp", base = NodeExpr)]
     pub(crate) struct NodeExprUnaryOp,
     fields: ["op", "operand"],
     attributes: ["lineno", "col_offset", "end_lineno", "end_col_offset"],
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "Lambda", base = "NodeExpr")]
+    #[pyclass(module = "_ast", name = "Lambda", base = NodeExpr)]
     pub(crate) struct NodeExprLambda,
     fields: ["args", "body"],
     attributes: ["lineno", "col_offset", "end_lineno", "end_col_offset"],
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "IfExp", base = "NodeExpr")]
+    #[pyclass(module = "_ast", name = "IfExp", base = NodeExpr)]
     pub(crate) struct NodeExprIfExp,
     fields: ["test", "body", "orelse"],
     attributes: ["lineno", "col_offset", "end_lineno", "end_col_offset"],
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "Dict", base = "NodeExpr")]
+    #[pyclass(module = "_ast", name = "Dict", base = NodeExpr)]
     pub(crate) struct NodeExprDict,
     fields: ["keys", "values"],
     attributes: ["lineno", "col_offset", "end_lineno", "end_col_offset"],
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "Set", base = "NodeExpr")]
+    #[pyclass(module = "_ast", name = "Set", base = NodeExpr)]
     pub(crate) struct NodeExprSet,
     fields: ["elts"],
     attributes: ["lineno", "col_offset", "end_lineno", "end_col_offset"],
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "ListComp", base = "NodeExpr")]
+    #[pyclass(module = "_ast", name = "ListComp", base = NodeExpr)]
     pub(crate) struct NodeExprListComp,
     fields: ["elt", "generators"],
     attributes: ["lineno", "col_offset", "end_lineno", "end_col_offset"],
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "SetComp", base = "NodeExpr")]
+    #[pyclass(module = "_ast", name = "SetComp", base = NodeExpr)]
     pub(crate) struct NodeExprSetComp,
     fields: ["elt", "generators"],
     attributes: ["lineno", "col_offset", "end_lineno", "end_col_offset"],
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "DictComp", base = "NodeExpr")]
+    #[pyclass(module = "_ast", name = "DictComp", base = NodeExpr)]
     pub(crate) struct NodeExprDictComp,
     fields: ["key", "value", "generators"],
     attributes: ["lineno", "col_offset", "end_lineno", "end_col_offset"],
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "GeneratorExp", base = "NodeExpr")]
+    #[pyclass(module = "_ast", name = "GeneratorExp", base = NodeExpr)]
     pub(crate) struct NodeExprGeneratorExp,
     fields: ["elt", "generators"],
     attributes: ["lineno", "col_offset", "end_lineno", "end_col_offset"],
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "Await", base = "NodeExpr")]
+    #[pyclass(module = "_ast", name = "Await", base = NodeExpr)]
     pub(crate) struct NodeExprAwait,
     fields: ["value"],
     attributes: ["lineno", "col_offset", "end_lineno", "end_col_offset"],
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "Yield", base = "NodeExpr")]
+    #[pyclass(module = "_ast", name = "Yield", base = NodeExpr)]
     pub(crate) struct NodeExprYield,
     fields: ["value"],
     attributes: ["lineno", "col_offset", "end_lineno", "end_col_offset"],
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "YieldFrom", base = "NodeExpr")]
+    #[pyclass(module = "_ast", name = "YieldFrom", base = NodeExpr)]
     pub(crate) struct NodeExprYieldFrom,
     fields: ["value"],
     attributes: ["lineno", "col_offset", "end_lineno", "end_col_offset"],
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "Compare", base = "NodeExpr")]
+    #[pyclass(module = "_ast", name = "Compare", base = NodeExpr)]
     pub(crate) struct NodeExprCompare,
     fields: ["left", "ops", "comparators"],
     attributes: ["lineno", "col_offset", "end_lineno", "end_col_offset"],
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "Call", base = "NodeExpr")]
+    #[pyclass(module = "_ast", name = "Call", base = NodeExpr)]
     pub(crate) struct NodeExprCall,
     fields: ["func", "args", "keywords"],
     attributes: ["lineno", "col_offset", "end_lineno", "end_col_offset"],
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "FormattedValue", base = "NodeExpr")]
+    #[pyclass(module = "_ast", name = "FormattedValue", base = NodeExpr)]
     pub(crate) struct NodeExprFormattedValue,
     fields: ["value", "conversion", "format_spec"],
     attributes: ["lineno", "col_offset", "end_lineno", "end_col_offset"],
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "JoinedStr", base = "NodeExpr")]
+    #[pyclass(module = "_ast", name = "JoinedStr", base = NodeExpr)]
     pub(crate) struct NodeExprJoinedStr,
     fields: ["values"],
     attributes: ["lineno", "col_offset", "end_lineno", "end_col_offset"],
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "Constant", base = "NodeExpr")]
+    #[pyclass(module = "_ast", name = "Constant", base = NodeExpr)]
     pub(crate) struct NodeExprConstant,
     fields: ["value", "kind"],
     attributes: ["lineno", "col_offset", "end_lineno", "end_col_offset"],
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "Attribute", base = "NodeExpr")]
+    #[pyclass(module = "_ast", name = "Attribute", base = NodeExpr)]
     pub(crate) struct NodeExprAttribute,
     fields: ["value", "attr", "ctx"],
     attributes: ["lineno", "col_offset", "end_lineno", "end_col_offset"],
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "Subscript", base = "NodeExpr")]
+    #[pyclass(module = "_ast", name = "Subscript", base = NodeExpr)]
     pub(crate) struct NodeExprSubscript,
     fields: ["value", "slice", "ctx"],
     attributes: ["lineno", "col_offset", "end_lineno", "end_col_offset"],
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "Starred", base = "NodeExpr")]
+    #[pyclass(module = "_ast", name = "Starred", base = NodeExpr)]
     pub(crate) struct NodeExprStarred,
     fields: ["value", "ctx"],
     attributes: ["lineno", "col_offset", "end_lineno", "end_col_offset"],
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "Name", base = "NodeExpr")]
+    #[pyclass(module = "_ast", name = "Name", base = NodeExpr)]
     pub(crate) struct NodeExprName,
     fields: ["id", "ctx"],
     attributes: ["lineno", "col_offset", "end_lineno", "end_col_offset"],
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "List", base = "NodeExpr")]
+    #[pyclass(module = "_ast", name = "List", base = NodeExpr)]
     pub(crate) struct NodeExprList,
     fields: ["elts", "ctx"],
     attributes: ["lineno", "col_offset", "end_lineno", "end_col_offset"],
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "Tuple", base = "NodeExpr")]
+    #[pyclass(module = "_ast", name = "Tuple", base = NodeExpr)]
     pub(crate) struct NodeExprTuple,
     fields: ["elts", "ctx"],
     attributes: ["lineno", "col_offset", "end_lineno", "end_col_offset"],
 );
 
-#[pyclass(module = "_ast", name = "expr_context", base = "NodeAst")]
+#[pyclass(module = "_ast", name = "expr_context", base = NodeAst)]
 pub(crate) struct NodeExprContext;
 
 #[pyclass(flags(HAS_DICT, BASETYPE))]
 impl NodeExprContext {}
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "Slice", base = "NodeExpr")]
+    #[pyclass(module = "_ast", name = "Slice", base = NodeExpr)]
     pub(crate) struct NodeExprSlice,
     fields: ["lower", "upper", "step"],
     attributes: ["lineno", "col_offset", "end_lineno", "end_col_offset"],
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "Load", base = "NodeExprContext")]
+    #[pyclass(module = "_ast", name = "Load", base = NodeExprContext)]
     pub(crate) struct NodeExprContextLoad,
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "Store", base = "NodeExprContext")]
+    #[pyclass(module = "_ast", name = "Store", base = NodeExprContext)]
     pub(crate) struct NodeExprContextStore,
 );
 
-#[pyclass(module = "_ast", name = "boolop", base = "NodeAst")]
+#[pyclass(module = "_ast", name = "boolop", base = NodeAst)]
 pub(crate) struct NodeBoolOp;
 
 #[pyclass(flags(HAS_DICT, BASETYPE))]
 impl NodeBoolOp {}
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "Del", base = "NodeExprContext")]
+    #[pyclass(module = "_ast", name = "Del", base = NodeExprContext)]
     pub(crate) struct NodeExprContextDel,
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "And", base = "NodeBoolOp")]
+    #[pyclass(module = "_ast", name = "And", base = NodeBoolOp)]
     pub(crate) struct NodeBoolOpAnd,
 );
 
-#[pyclass(module = "_ast", name = "operator", base = "NodeAst")]
+#[pyclass(module = "_ast", name = "operator", base = NodeAst)]
 pub(crate) struct NodeOperator;
 
 #[pyclass(flags(HAS_DICT, BASETYPE))]
 impl NodeOperator {}
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "Or", base = "NodeBoolOp")]
+    #[pyclass(module = "_ast", name = "Or", base = NodeBoolOp)]
     pub(crate) struct NodeBoolOpOr,
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "Add", base = "NodeOperator")]
+    #[pyclass(module = "_ast", name = "Add", base = NodeOperator)]
     pub(crate) struct NodeOperatorAdd,
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "Sub", base = "NodeOperator")]
+    #[pyclass(module = "_ast", name = "Sub", base = NodeOperator)]
     pub(crate) struct NodeOperatorSub,
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "Mult", base = "NodeOperator")]
+    #[pyclass(module = "_ast", name = "Mult", base = NodeOperator)]
     pub(crate) struct NodeOperatorMult,
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "MatMult", base = "NodeOperator")]
+    #[pyclass(module = "_ast", name = "MatMult", base = NodeOperator)]
     pub(crate) struct NodeOperatorMatMult,
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "Div", base = "NodeOperator")]
+    #[pyclass(module = "_ast", name = "Div", base = NodeOperator)]
     pub(crate) struct NodeOperatorDiv,
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "Mod", base = "NodeOperator")]
+    #[pyclass(module = "_ast", name = "Mod", base = NodeOperator)]
     pub(crate) struct NodeOperatorMod,
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "Pow", base = "NodeOperator")]
+    #[pyclass(module = "_ast", name = "Pow", base = NodeOperator)]
     pub(crate) struct NodeOperatorPow,
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "LShift", base = "NodeOperator")]
+    #[pyclass(module = "_ast", name = "LShift", base = NodeOperator)]
     pub(crate) struct NodeOperatorLShift,
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "RShift", base = "NodeOperator")]
+    #[pyclass(module = "_ast", name = "RShift", base = NodeOperator)]
     pub(crate) struct NodeOperatorRShift,
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "BitOr", base = "NodeOperator")]
+    #[pyclass(module = "_ast", name = "BitOr", base = NodeOperator)]
     pub(crate) struct NodeOperatorBitOr,
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "BitXor", base = "NodeOperator")]
+    #[pyclass(module = "_ast", name = "BitXor", base = NodeOperator)]
     pub(crate) struct NodeOperatorBitXor,
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "BitAnd", base = "NodeOperator")]
+    #[pyclass(module = "_ast", name = "BitAnd", base = NodeOperator)]
     pub(crate) struct NodeOperatorBitAnd,
 );
 
-#[pyclass(module = "_ast", name = "unaryop", base = "NodeAst")]
+#[pyclass(module = "_ast", name = "unaryop", base = NodeAst)]
 pub(crate) struct NodeUnaryOp;
 
 #[pyclass(flags(HAS_DICT, BASETYPE))]
 impl NodeUnaryOp {}
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "FloorDiv", base = "NodeOperator")]
+    #[pyclass(module = "_ast", name = "FloorDiv", base = NodeOperator)]
     pub(crate) struct NodeOperatorFloorDiv,
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "Invert", base = "NodeUnaryOp")]
+    #[pyclass(module = "_ast", name = "Invert", base = NodeUnaryOp)]
     pub(crate) struct NodeUnaryOpInvert,
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "Not", base = "NodeUnaryOp")]
+    #[pyclass(module = "_ast", name = "Not", base = NodeUnaryOp)]
     pub(crate) struct NodeUnaryOpNot,
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "UAdd", base = "NodeUnaryOp")]
+    #[pyclass(module = "_ast", name = "UAdd", base = NodeUnaryOp)]
     pub(crate) struct NodeUnaryOpUAdd,
 );
 
-#[pyclass(module = "_ast", name = "cmpop", base = "NodeAst")]
+#[pyclass(module = "_ast", name = "cmpop", base = NodeAst)]
 pub(crate) struct NodeCmpOp;
 
 #[pyclass(flags(HAS_DICT, BASETYPE))]
 impl NodeCmpOp {}
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "USub", base = "NodeUnaryOp")]
+    #[pyclass(module = "_ast", name = "USub", base = NodeUnaryOp)]
     pub(crate) struct NodeUnaryOpUSub,
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "Eq", base = "NodeCmpOp")]
+    #[pyclass(module = "_ast", name = "Eq", base = NodeCmpOp)]
     pub(crate) struct NodeCmpOpEq,
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "NotEq", base = "NodeCmpOp")]
+    #[pyclass(module = "_ast", name = "NotEq", base = NodeCmpOp)]
     pub(crate) struct NodeCmpOpNotEq,
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "Lt", base = "NodeCmpOp")]
+    #[pyclass(module = "_ast", name = "Lt", base = NodeCmpOp)]
     pub(crate) struct NodeCmpOpLt,
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "LtE", base = "NodeCmpOp")]
+    #[pyclass(module = "_ast", name = "LtE", base = NodeCmpOp)]
     pub(crate) struct NodeCmpOpLtE,
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "Gt", base = "NodeCmpOp")]
+    #[pyclass(module = "_ast", name = "Gt", base = NodeCmpOp)]
     pub(crate) struct NodeCmpOpGt,
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "GtE", base = "NodeCmpOp")]
+    #[pyclass(module = "_ast", name = "GtE", base = NodeCmpOp)]
     pub(crate) struct NodeCmpOpGtE,
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "Is", base = "NodeCmpOp")]
+    #[pyclass(module = "_ast", name = "Is", base = NodeCmpOp)]
     pub(crate) struct NodeCmpOpIs,
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "IsNot", base = "NodeCmpOp")]
+    #[pyclass(module = "_ast", name = "IsNot", base = NodeCmpOp)]
     pub(crate) struct NodeCmpOpIsNot,
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "In", base = "NodeCmpOp")]
+    #[pyclass(module = "_ast", name = "In", base = NodeCmpOp)]
     pub(crate) struct NodeCmpOpIn,
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "NotIn", base = "NodeCmpOp")]
+    #[pyclass(module = "_ast", name = "NotIn", base = NodeCmpOp)]
     pub(crate) struct NodeCmpOpNotIn,
 );
 
-#[pyclass(module = "_ast", name = "excepthandler", base = "NodeAst")]
+#[pyclass(module = "_ast", name = "excepthandler", base = NodeAst)]
 pub(crate) struct NodeExceptHandler;
 
 #[pyclass(flags(HAS_DICT, BASETYPE))]
 impl NodeExceptHandler {}
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "comprehension", base = "NodeAst")]
+    #[pyclass(module = "_ast", name = "comprehension", base = NodeAst)]
     pub(crate) struct NodeComprehension,
     fields: ["target", "iter", "ifs", "is_async"],
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "ExceptHandler", base = "NodeExceptHandler")]
+    #[pyclass(module = "_ast", name = "ExceptHandler", base = NodeExceptHandler)]
     pub(crate) struct NodeExceptHandlerExceptHandler,
     fields: ["type", "name", "body"],
     attributes: ["lineno", "col_offset", "end_lineno", "end_col_offset"],
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "arguments", base = "NodeAst")]
+    #[pyclass(module = "_ast", name = "arguments", base = NodeAst)]
     pub(crate) struct NodeArguments,
     fields: ["posonlyargs", "args", "vararg", "kwonlyargs", "kw_defaults", "kwarg", "defaults"],
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "arg", base = "NodeAst")]
+    #[pyclass(module = "_ast", name = "arg", base = NodeAst)]
     pub(crate) struct NodeArg,
     fields: ["arg", "annotation", "type_comment"],
     attributes: ["lineno", "col_offset", "end_lineno", "end_col_offset"],
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "keyword", base = "NodeAst")]
+    #[pyclass(module = "_ast", name = "keyword", base = NodeAst)]
     pub(crate) struct NodeKeyword,
     fields: ["arg", "value"],
     attributes: ["lineno", "col_offset", "end_lineno", "end_col_offset"],
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "alias", base = "NodeAst")]
+    #[pyclass(module = "_ast", name = "alias", base = NodeAst)]
     pub(crate) struct NodeAlias,
     fields: ["name", "asname"],
     attributes: ["lineno", "col_offset", "end_lineno", "end_col_offset"],
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "withitem", base = "NodeAst")]
+    #[pyclass(module = "_ast", name = "withitem", base = NodeAst)]
     pub(crate) struct NodeWithItem,
     fields: ["context_expr", "optional_vars"],
 );
 
-#[pyclass(module = "_ast", name = "pattern", base = "NodeAst")]
+#[pyclass(module = "_ast", name = "pattern", base = NodeAst)]
 pub(crate) struct NodePattern;
 
 #[pyclass(flags(HAS_DICT, BASETYPE))]
 impl NodePattern {}
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "match_case", base = "NodeAst")]
+    #[pyclass(module = "_ast", name = "match_case", base = NodeAst)]
     pub(crate) struct NodeMatchCase,
     fields: ["pattern", "guard", "body"],
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "MatchValue", base = "NodePattern")]
+    #[pyclass(module = "_ast", name = "MatchValue", base = NodePattern)]
     pub(crate) struct NodePatternMatchValue,
     fields: ["value"],
     attributes: ["lineno", "col_offset", "end_lineno", "end_col_offset"],
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "MatchSingleton", base = "NodePattern")]
+    #[pyclass(module = "_ast", name = "MatchSingleton", base = NodePattern)]
     pub(crate) struct NodePatternMatchSingleton,
     fields: ["value"],
     attributes: ["lineno", "col_offset", "end_lineno", "end_col_offset"],
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "MatchSequence", base = "NodePattern")]
+    #[pyclass(module = "_ast", name = "MatchSequence", base = NodePattern)]
     pub(crate) struct NodePatternMatchSequence,
     fields: ["patterns"],
     attributes: ["lineno", "col_offset", "end_lineno", "end_col_offset"],
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "MatchMapping", base = "NodePattern")]
+    #[pyclass(module = "_ast", name = "MatchMapping", base = NodePattern)]
     pub(crate) struct NodePatternMatchMapping,
     fields: ["keys", "patterns", "rest"],
     attributes: ["lineno", "col_offset", "end_lineno", "end_col_offset"],
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "MatchClass", base = "NodePattern")]
+    #[pyclass(module = "_ast", name = "MatchClass", base = NodePattern)]
     pub(crate) struct NodePatternMatchClass,
     fields: ["cls", "patterns", "kwd_attrs", "kwd_patterns"],
     attributes: ["lineno", "col_offset", "end_lineno", "end_col_offset"],
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "MatchStar", base = "NodePattern")]
+    #[pyclass(module = "_ast", name = "MatchStar", base = NodePattern)]
     pub(crate) struct NodePatternMatchStar,
     fields: ["name"],
     attributes: ["lineno", "col_offset", "end_lineno", "end_col_offset"],
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "MatchAs", base = "NodePattern")]
+    #[pyclass(module = "_ast", name = "MatchAs", base = NodePattern)]
     pub(crate) struct NodePatternMatchAs,
     fields: ["pattern", "name"],
     attributes: ["lineno", "col_offset", "end_lineno", "end_col_offset"],
 );
 
-#[pyclass(module = "_ast", name = "type_ignore", base = "NodeAst")]
+#[pyclass(module = "_ast", name = "type_ignore", base = NodeAst)]
 pub(crate) struct NodeTypeIgnore;
 
 #[pyclass(flags(HAS_DICT, BASETYPE))]
 impl NodeTypeIgnore {}
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "MatchOr", base = "NodePattern")]
+    #[pyclass(module = "_ast", name = "MatchOr", base = NodePattern)]
     pub(crate) struct NodePatternMatchOr,
     fields: ["patterns"],
     attributes: ["lineno", "col_offset", "end_lineno", "end_col_offset"],
 );
 
-#[pyclass(module = "_ast", name = "type_param", base = "NodeAst")]
+#[pyclass(module = "_ast", name = "type_param", base = NodeAst)]
 pub(crate) struct NodeTypeParam;
 
 #[pyclass(flags(HAS_DICT, BASETYPE))]
 impl NodeTypeParam {}
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "TypeIgnore", base = "NodeTypeIgnore")]
+    #[pyclass(module = "_ast", name = "TypeIgnore", base = NodeTypeIgnore)]
     pub(crate) struct NodeTypeIgnoreTypeIgnore,
     fields: ["lineno", "tag"],
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "TypeVar", base = "NodeTypeParam")]
+    #[pyclass(module = "_ast", name = "TypeVar", base = NodeTypeParam)]
     pub(crate) struct NodeTypeParamTypeVar,
     fields: ["name", "bound"],
     attributes: ["lineno", "col_offset", "end_lineno", "end_col_offset"],
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "ParamSpec", base = "NodeTypeParam")]
+    #[pyclass(module = "_ast", name = "ParamSpec", base = NodeTypeParam)]
     pub(crate) struct NodeTypeParamParamSpec,
     fields: ["name"],
     attributes: ["lineno", "col_offset", "end_lineno", "end_col_offset"],
 );
 
 impl_node!(
-    #[pyclass(module = "_ast", name = "TypeVarTuple", base = "NodeTypeParam")]
+    #[pyclass(module = "_ast", name = "TypeVarTuple", base = NodeTypeParam)]
     pub(crate) struct NodeTypeParamTypeVarTuple,
     fields: ["name"],
     attributes: ["lineno", "col_offset", "end_lineno", "end_col_offset"],

vm/src/stdlib/builtins.rs

@@ -534,6 +534,22 @@ mod builtins {
         iter_target.get_aiter(vm)
     }
 
+    #[pyfunction]
+    fn anext(
+        aiter: PyObjectRef,
+        default_value: OptionalArg<PyObjectRef>,
+        vm: &VirtualMachine,
+    ) -> PyResult {
+        let awaitable = vm.call_method(&aiter, "__anext__", ())?;
+
+        if default_value.is_missing() {
+            Ok(awaitable)
+        } else {
+            // TODO: Implement CPython like PyAnextAwaitable to properly handle the default value.
+            Ok(awaitable)
+        }
+    }
+
     #[pyfunction]
     fn len(obj: PyObjectRef, vm: &VirtualMachine) -> PyResult<usize> {
         obj.length(vm)

vm/src/stdlib/codecs.rs

@@ -67,10 +67,14 @@ mod _codecs {
     }
 
     #[pyfunction]
-    fn register_error(name: PyStrRef, handler: PyObjectRef, vm: &VirtualMachine) {
+    fn register_error(name: PyStrRef, handler: PyObjectRef, vm: &VirtualMachine) -> PyResult<()> {
+        if !handler.is_callable() {
+            return Err(vm.new_type_error("handler must be callable".to_owned()));
+        }
         vm.state
             .codec_registry
             .register_error(name.as_str().to_owned(), handler);
+        Ok(())
     }
 
     #[pyfunction]

vm/src/stdlib/ctypes/array.rs

@@ -10,7 +10,7 @@ use crossbeam_utils::atomic::AtomicCell;
 use rustpython_common::lock::PyRwLock;
 use rustpython_vm::stdlib::ctypes::base::PyCData;
 
-#[pyclass(name = "PyCArrayType", base = "PyType", module = "_ctypes")]
+#[pyclass(name = "PyCArrayType", base = PyType, module = "_ctypes")]
 #[derive(PyPayload)]
 pub struct PyCArrayType {
     pub(super) inner: PyCArray,
@@ -49,7 +49,7 @@ impl PyCArrayType {}
 
 #[pyclass(
     name = "Array",
-    base = "PyCData",
+    base = PyCData,
     metaclass = "PyCArrayType",
     module = "_ctypes"
 )]

vm/src/stdlib/ctypes/base.rs

@@ -157,7 +157,7 @@ pub struct PyCData {
 #[pyclass]
 impl PyCData {}
 
-#[pyclass(module = "_ctypes", name = "PyCSimpleType", base = "PyType")]
+#[pyclass(module = "_ctypes", name = "PyCSimpleType", base = PyType)]
 pub struct PyCSimpleType {}
 
 #[pyclass(flags(BASETYPE))]
@@ -176,7 +176,7 @@ impl PyCSimpleType {
 #[pyclass(
     module = "_ctypes",
     name = "_SimpleCData",
-    base = "PyCData",
+    base = PyCData,
     metaclass = "PyCSimpleType"
 )]
 #[derive(PyPayload)]

vm/src/stdlib/ctypes/function.rs

@@ -122,7 +122,7 @@ impl Function {
     }
 }
 
-#[pyclass(module = "_ctypes", name = "CFuncPtr", base = "PyCData")]
+#[pyclass(module = "_ctypes", name = "CFuncPtr", base = PyCData)]
 #[derive(PyPayload)]
 pub struct PyCFuncPtr {
     pub name: PyRwLock<String>,

vm/src/stdlib/ctypes/structure.rs

@@ -8,7 +8,7 @@ use rustpython_vm::types::Constructor;
 use std::collections::HashMap;
 use std::fmt::Debug;
 
-#[pyclass(module = "_ctypes", name = "Structure", base = "PyCData")]
+#[pyclass(module = "_ctypes", name = "Structure", base = PyCData)]
 #[derive(PyPayload, Debug)]
 pub struct PyCStructure {
     #[allow(dead_code)]

vm/src/stdlib/ctypes/union.rs

@@ -1,7 +1,7 @@
 use super::base::PyCData;
 
 // TODO: metaclass = "UnionType"
-#[pyclass(module = "_ctypes", name = "Union", base = "PyCData")]
+#[pyclass(module = "_ctypes", name = "Union", base = PyCData)]
 pub struct PyCUnion {}
 
 #[pyclass(flags(BASETYPE, IMMUTABLETYPE))]

vm/src/stdlib/io.rs

@@ -607,7 +607,7 @@ mod _io {
     }
 
     #[pyattr]
-    #[pyclass(name = "_RawIOBase", base = "_IOBase")]
+    #[pyclass(name = "_RawIOBase", base = _IOBase)]
     pub(super) struct _RawIOBase;
 
     #[pyclass(flags(BASETYPE, HAS_DICT))]
@@ -665,7 +665,7 @@ mod _io {
     }
 
     #[pyattr]
-    #[pyclass(name = "_BufferedIOBase", base = "_IOBase")]
+    #[pyclass(name = "_BufferedIOBase", base = _IOBase)]
     struct _BufferedIOBase;
 
     #[pyclass(flags(BASETYPE))]
@@ -728,7 +728,7 @@ mod _io {
 
     // TextIO Base has no public constructor
     #[pyattr]
-    #[pyclass(name = "_TextIOBase", base = "_IOBase")]
+    #[pyclass(name = "_TextIOBase", base = _IOBase)]
     #[derive(Debug, PyPayload)]
     struct _TextIOBase;
 
@@ -1728,7 +1728,7 @@ mod _io {
     }
 
     #[pyattr]
-    #[pyclass(name = "BufferedReader", base = "_BufferedIOBase")]
+    #[pyclass(name = "BufferedReader", base = _BufferedIOBase)]
     #[derive(Debug, Default, PyPayload)]
     struct BufferedReader {
         data: PyThreadMutex<BufferedData>,
@@ -1785,7 +1785,7 @@ mod _io {
     }
 
     #[pyattr]
-    #[pyclass(name = "BufferedWriter", base = "_BufferedIOBase")]
+    #[pyclass(name = "BufferedWriter", base = _BufferedIOBase)]
     #[derive(Debug, Default, PyPayload)]
     struct BufferedWriter {
         data: PyThreadMutex<BufferedData>,
@@ -1818,7 +1818,7 @@ mod _io {
     impl DefaultConstructor for BufferedWriter {}
 
     #[pyattr]
-    #[pyclass(name = "BufferedRandom", base = "_BufferedIOBase")]
+    #[pyclass(name = "BufferedRandom", base = _BufferedIOBase)]
     #[derive(Debug, Default, PyPayload)]
     struct BufferedRandom {
         data: PyThreadMutex<BufferedData>,
@@ -1860,7 +1860,7 @@ mod _io {
     impl DefaultConstructor for BufferedRandom {}
 
     #[pyattr]
-    #[pyclass(name = "BufferedRWPair", base = "_BufferedIOBase")]
+    #[pyclass(name = "BufferedRWPair", base = _BufferedIOBase)]
     #[derive(Debug, Default, PyPayload)]
     struct BufferedRWPair {
         read: BufferedReader,
@@ -2274,7 +2274,7 @@ mod _io {
     }
 
     #[pyattr]
-    #[pyclass(name = "TextIOWrapper", base = "_TextIOBase")]
+    #[pyclass(name = "TextIOWrapper", base = _TextIOBase)]
     #[derive(Debug, Default, PyPayload)]
     struct TextIOWrapper {
         data: PyThreadMutex<Option<TextIOData>>,
@@ -3460,7 +3460,7 @@ mod _io {
     }
 
     #[pyattr]
-    #[pyclass(name = "StringIO", base = "_TextIOBase")]
+    #[pyclass(name = "StringIO", base = _TextIOBase)]
     #[derive(Debug, PyPayload)]
     struct StringIO {
         buffer: PyRwLock<BufferedIO>,
@@ -3605,7 +3605,7 @@ mod _io {
     }
 
     #[pyattr]
-    #[pyclass(name = "BytesIO", base = "_BufferedIOBase")]
+    #[pyclass(name = "BytesIO", base = _BufferedIOBase)]
     #[derive(Debug, PyPayload)]
     struct BytesIO {
         buffer: PyRwLock<BufferedIO>,
@@ -4241,7 +4241,7 @@ mod fileio {
     }
 
     #[pyattr]
-    #[pyclass(module = "io", name, base = "_RawIOBase")]
+    #[pyclass(module = "io", name, base = _RawIOBase)]
     #[derive(Debug, PyPayload)]
     pub(super) struct FileIO {
         fd: AtomicCell<i32>,

vm/src/vm/vm_ops.rs

@@ -160,11 +160,12 @@ impl VirtualMachine {
         let class_a = a.class();
         let class_b = b.class();
 
-        let slot_a = class_a.slots.as_number.left_binary_op(op_slot);
+        // Look up number slots across MRO for inheritance
+        let slot_a = class_a.mro_find_map(|x| x.slots.as_number.left_binary_op(op_slot));
         let mut slot_b = None;
 
         if !class_a.is(class_b) {
-            let slot_bb = class_b.slots.as_number.right_binary_op(op_slot);
+            let slot_bb = class_b.mro_find_map(|x| x.slots.as_number.right_binary_op(op_slot));
             if slot_bb.map(|x| x as usize) != slot_a.map(|x| x as usize) {
                 slot_b = slot_bb;
             }
@@ -230,7 +231,10 @@ impl VirtualMachine {
         iop_slot: PyNumberBinaryOp,
         op_slot: PyNumberBinaryOp,
     ) -> PyResult {
-        if let Some(slot) = a.class().slots.as_number.left_binary_op(iop_slot) {
+        if let Some(slot) = a
+            .class()
+            .mro_find_map(|x| x.slots.as_number.left_binary_op(iop_slot))
+        {
             let x = slot(a, b, self)?;
             if !x.is(&self.ctx.not_implemented) {
                 return Ok(x);
@@ -266,11 +270,12 @@ impl VirtualMachine {
         let class_b = b.class();
         let class_c = c.class();
 
-        let slot_a = class_a.slots.as_number.left_ternary_op(op_slot);
+        // Look up number slots across MRO for inheritance
+        let slot_a = class_a.mro_find_map(|x| x.slots.as_number.left_ternary_op(op_slot));
         let mut slot_b = None;
 
         if !class_a.is(class_b) {
-            let slot_bb = class_b.slots.as_number.right_ternary_op(op_slot);
+            let slot_bb = class_b.mro_find_map(|x| x.slots.as_number.right_ternary_op(op_slot));
             if slot_bb.map(|x| x as usize) != slot_a.map(|x| x as usize) {
                 slot_b = slot_bb;
             }
@@ -299,7 +304,7 @@ impl VirtualMachine {
             }
         }
 
-        if let Some(slot_c) = class_c.slots.as_number.left_ternary_op(op_slot)
+        if let Some(slot_c) = class_c.mro_find_map(|x| x.slots.as_number.left_ternary_op(op_slot))
             && slot_a.is_some_and(|slot_a| !std::ptr::fn_addr_eq(slot_a, slot_c))
             && slot_b.is_some_and(|slot_b| !std::ptr::fn_addr_eq(slot_b, slot_c))
         {
@@ -338,7 +343,10 @@ impl VirtualMachine {
         op_slot: PyNumberTernaryOp,
         op_str: &str,
     ) -> PyResult {
-        if let Some(slot) = a.class().slots.as_number.left_ternary_op(iop_slot) {
+        if let Some(slot) = a
+            .class()
+            .mro_find_map(|x| x.slots.as_number.left_ternary_op(iop_slot))
+        {
             let x = slot(a, b, c, self)?;
             if !x.is(&self.ctx.not_implemented) {
                 return Ok(x);