anchor.diff:       {"4.12.8",  "Invalid Self-Issued inhibitAnyPolicy Test8",    43 },
        {"4.12.9",  "Valid Self-Issued inhibitAnyPolicy Test9",      ok},
        {"4.12.10", "Invalid Self-Issued inhibitAnyPolicy Test10",   43 }].
  -
  -name_constraints() ->
  -    %%{ "4.13",    "Name Constraints" },
  -    [{ "4.13.1",  "Valid DN nameConstraints Test1",                ok},
  -     { "4.13.2",  "Invalid DN nameConstraints Test2",              {bad_cert, name_not_permitted}},
  -     { "4.13.3",  "Invalid DN nameConstraints Test3",              {bad_cert, name_not_permitted}},
  -     { "4.13.4",  "Valid DN nameConstraints Test4",                ok},
  -     { "4.13.5",  "Valid DN nameConstraints Test5",                ok},
  -     { "4.13.6",  "Valid DN nameConstraints Test6",                ok},
  -     { "4.13.7",  "Invalid DN nameConstraints Test7",              {bad_cert, name_not_permitted}},
  -     { "4.13.8",  "Invalid DN nameConstraints Test8",              {bad_cert, name_not_permitted}},
  -     { "4.13.9",  "Invalid DN nameConstraints Test9",              {bad_cert, name_not_permitted}},
  -     { "4.13.10", "Invalid DN nameConstraints Test10",             {bad_cert, name_not_permitted}},
  -     { "4.13.11", "Valid DN nameConstraints Test11",               ok},
  -     { "4.13.12", "Invalid DN nameConstraints Test12",             {bad_cert, name_not_permitted}},
  -     { "4.13.13", "Invalid DN nameConstraints Test13",             {bad_cert, name_not_permitted}},
  -     { "4.13.14", "Valid DN nameConstraints Test14",               ok},
  -     { "4.13.15", "Invalid DN nameConstraints Test15",             {bad_cert, name_not_permitted}},
  -     { "4.13.16", "Invalid DN nameConstraints Test16",             {bad_cert, name_not_permitted}},
  -     { "4.13.17", "Invalid DN nameConstraints Test17",             {bad_cert, name_not_permitted}},
  -     { "4.13.18", "Valid DN nameConstraints Test18",               ok},
  -     { "4.13.19", "Valid Self-Issued DN nameConstraints Test19",   ok},
  -     { "4.13.20", "Invalid Self-Issued DN nameConstraints Test20", {bad_cert, name_not_permitted} },
  -     { "4.13.21", "Valid RFC822 nameConstraints Test21",           ok},
  -     { "4.13.22", "Invalid RFC822 nameConstraints Test22",         {bad_cert, name_not_permitted} },
  -     { "4.13.23", "Valid RFC822 nameConstraints Test23",           ok},
  -     { "4.13.24", "Invalid RFC822 nameConstraints Test24",         {bad_cert, name_not_permitted} },
  -     { "4.13.25", "Valid RFC822 nameConstraints Test25",           ok},
  -     { "4.13.26", "Invalid RFC822 nameConstraints Test26",         {bad_cert, name_not_permitted}},
  -     { "4.13.27", "Valid DN and RFC822 nameConstraints Test27",    ok},
  -     { "4.13.28", "Invalid DN and RFC822 nameConstraints Test28",  {bad_cert, name_not_permitted} },
  -     { "4.13.29", "Invalid DN and RFC822 nameConstraints Test29",  {bad_cert, name_not_permitted} },
  -     { "4.13.30", "Valid DNS nameConstraints Test30",              ok},
  -     { "4.13.31", "Invalid DNS nameConstraints Test31",            {bad_cert, name_not_permitted} },
  -     { "4.13.32", "Valid DNS nameConstraints Test32",              ok},
  -     { "4.13.33", "Invalid DNS nameConstraints Test33",            {bad_cert, name_not_permitted}},
  -     { "4.13.34", "Valid URI nameConstraints Test34",              ok},
  -     { "4.13.35", "Invalid URI nameConstraints Test35",            {bad_cert, name_not_permitted} },
  -     { "4.13.36", "Valid URI nameConstraints Test36",              ok},
  -     { "4.13.37", "Invalid URI nameConstraints Test37",            {bad_cert, name_not_permitted}},
  -     { "4.13.38", "Invalid DNS nameConstraints Test38",            {bad_cert, name_not_permitted} }].
  -distribution_points() ->
  -     %%{ "4.14",    "Distribution Points" },
  -    [{ "4.14.1",  "Valid distributionPoint Test1",                 ok},
  -     { "4.14.2",  "Invalid distributionPoint Test2",               23 },
  -     { "4.14.3",  "Invalid distributionPoint Test3",               44 },
  -     { "4.14.4",  "Valid distributionPoint Test4",                 ok},
  -     { "4.14.5",  "Valid distributionPoint Test5",                 ok},
  -     { "4.14.6",  "Invalid distributionPoint Test6",               23 },
  -     { "4.14.7",  "Valid distributionPoint Test7",                 ok},
  -     { "4.14.8",  "Invalid distributionPoint Test8",               44 },
  -     { "4.14.9",  "Invalid distributionPoint Test9",               44 },
  -     { "4.14.10", "Valid No issuingDistributionPoint Test10",      ok},
  -     { "4.14.11", "Invalid onlyContainsUserCerts CRL Test11",      44 },
  -     { "4.14.12", "Invalid onlyContainsCACerts CRL Test12",        44 },
  -     { "4.14.13", "Valid onlyContainsCACerts CRL Test13",          ok},
  -     { "4.14.14", "Invalid onlyContainsAttributeCerts Test14",     44 },
  -     { "4.14.15", "Invalid onlySomeReasons Test15",                23 },
  -     { "4.14.16", "Invalid onlySomeReasons Test16",                23 },
  -     { "4.14.17", "Invalid onlySomeReasons Test17",                3 },
  -     { "4.14.18", "Valid onlySomeReasons Test18",                  ok},
  -     { "4.14.19", "Valid onlySomeReasons Test19",                  ok},
  -     { "4.14.20", "Invalid onlySomeReasons Test20",                23 },
  -     { "4.14.21", "Invalid onlySomeReasons Test21",                23 },
  -     { "4.14.22", "Valid IDP with indirectCRL Test22",             ok},
  -     { "4.14.23", "Invalid IDP with indirectCRL Test23",           23 },
  -     { "4.14.24", "Valid IDP with indirectCRL Test24",             ok},
  -     { "4.14.25", "Valid IDP with indirectCRL Test25",             ok},
  -     { "4.14.26", "Invalid IDP with indirectCRL Test26",           44 },
  -     { "4.14.27", "Invalid cRLIssuer Test27",                      3 },
  -     { "4.14.28", "Valid cRLIssuer Test28",                        ok},
  -     { "4.14.29", "Valid cRLIssuer Test29",                        ok},
  -
  -     %% Although this test is valid it has a circular dependency. As a result
  -     %% an attempt is made to reursively checks a CRL path and rejected due to
  -     %% a CRL path validation error. PKITS notes suggest this test does not
  -     %% need to be run due to this issue.
  -     { "4.14.30", "Valid cRLIssuer Test30",                                 54 },
  -     { "4.14.31", "Invalid cRLIssuer Test31",                               23 },
  -     { "4.14.32", "Invalid cRLIssuer Test32",                               23 },
  -     { "4.14.33", "Valid cRLIssuer Test33",                                 ok},
  -     { "4.14.34", "Invalid cRLIssuer Test34",                               23 },
  -     { "4.14.35", "Invalid cRLIssuer Test35",                               44 }].
  -delta_crls() ->
  -    %%{ "4.15",    "Delta-CRLs" },
  -    [{ "4.15.1",  "Invalid deltaCRLIndicator No Base Test1",                3 },
  -     { "4.15.2",  "Valid delta-CRL Test2",                                  ok},
  -     { "4.15.3",  "Invalid delta-CRL Test3",                                23 },
  -     { "4.15.4",  "Invalid delta-CRL Test4",                                23 },
  -     { "4.15.5",  "Valid delta-CRL Test5",                                  ok},
  -     { "4.15.6",  "Invalid delta-CRL Test6",                                23 },
  -     { "4.15.7",  "Valid delta-CRL Test7",                                  ok},
  -     { "4.15.8",  "Valid delta-CRL Test8",                                  ok},
  -     { "4.15.9",  "Invalid delta-CRL Test9",                                23 },
  -     { "4.15.10", "Invalid delta-CRL Test10",                               12 }].
  -private_certificate_extensions() ->
  -    %%{ "4.16",    "Private Certificate Extensions" },
  -    [{ "4.16.1",  "Valid Unknown Not Critical Certificate Extension Test1", ok},
  -     { "4.16.2",  "Invalid Unknown Critical Certificate Extension Test2",   
  -       {bad_cert,unknown_critical_extension}}].
  -
  -
  -convert() ->
  -    Tests = [signature_verification(),
  -	     validity_periods(),
  -	     verifying_name_chaining(),
  -	     basic_certificate_revocation_tests(),
  -	     verifying_paths_with_self_issued_certificates(),
  -	     verifying_basic_constraints(),
  -	     key_usage(),
  -	     certificate_policies(),
  -	     require_explicit_policy(),
  -	     policy_mappings(),
  -	     inhibit_policy_mapping(),
  -	     inhibit_any_policy(),
  -	     name_constraints(),	     
  -	     distribution_points(),
  -	     delta_crls(),
  -	     private_certificate_extensions()],    
  -    [convert(Test) || Test <- lists:flatten(Tests)].
  -
  -convert({_,Test,_}) ->
  -    convert1(Test);
  -convert({_,Test,_,_,_,_,_}) ->
  -    convert1(Test).
  -
  -convert1(Test) ->
  -    FName = lists:append(string:tokens(Test, " -")),
  -    File = filename:join(?MIME, "Signed" ++ FName ++ ".eml"),
  -    io:format("Convert ~p~n",[File]),
  -    {ok, Mail} = file:read_file(File),
  -    Base64  = skip_lines(Mail),
  -    %%io:format("~s",[Base64]),
  -    Tmp = base64:mime_decode(Base64),
  -    file:write_file("pkits/smime-pem/tmp-pkcs7.der", Tmp),
  -    Cmd = "openssl pkcs7 -inform der -in pkits/smime-pem/tmp-pkcs7.der"
  -	" -print_certs -out pkits/smime-pem/" ++ FName ++ ".pem",
  -    case os:cmd(Cmd) of
  -	"" -> ok;
  -	Err -> 
  -	    io:format("~s",[Err]),
  -	    erlang:error(bad_cmd)
  -    end.
  -
  -skip_lines(<<"\r\n\r\n", Rest/binary>>) -> Rest;
  -skip_lines(<<"\n\n", Rest/binary>>) -> Rest;
  -skip_lines(<<_:8, Rest/binary>>) ->
  -    skip_lines(Rest).
  -
  -init_per_testcase(_Func, Config) ->    
  -    Datadir = proplists:get_value(data_dir, Config),
  -    put(datadir, Datadir),
  -    Config.
  -
  -end_per_testcase(_Func, Config) ->
  -    %% Nodes = select_nodes(all, Config, ?FILE, ?LINE),
  -    %% rpc:multicall(Nodes, mnesia, lkill, []),
  -    Config.
  -
  -init_per_suite(Config) ->
  -    try crypto:start() of
  -	ok ->
  -	    Config
  -    catch _:_ ->
  -	    {skip, "Crypto did not start"}
  -    end.
  -
  -end_per_suite(_Config) ->
  -    application:stop(crypto).
  -
  -error(Format, Args, File0, Line) ->
  -    File = filename:basename(File0),
  -    Pid = group_leader(),
  -    Pid ! {failed, File, Line},
  -    io:format(Pid, "~s(~p): ERROR"++Format, [File,Line|Args]).
  -
  -warning(Format, Args, File0, Line) ->
  -    File = filename:basename(File0),
  -    io:format("~s(~p): Warning "++Format, [File,Line|Args]).
  
positive.code: -define(NIST5, "2.16.840.1.101.3.2.1.48.5").
  -define(NIST6, "2.16.840.1.101.3.2.1.48.6").
  
  %%
  suite() -> [{ct_hooks,[ts_install_cth]}].
  
  all() -> 
      [signature_verification, validity_periods,
       verifying_name_chaining,
       verifying_paths_with_self_issued_certificates,
       verifying_basic_constraints, key_usage,
       name_constraints, private_certificate_extensions].
  
  groups() -> 
      [].
  
  init_per_group(_GroupName, Config) ->
      Config.
  
negative.code: -compile(export_all).
  
  -include_lib("public_key/include/public_key.hrl").
  
  -define(error(Format,Args), error(Format,Args,?FILE,?LINE)).
  -define(warning(Format,Args), warning(Format,Args,?FILE,?LINE)).
  