anchor.diff:  end_per_group(_GroupName, Config) ->
       Config.
   
  -
  -signature_verification(doc) ->    [""];
  -signature_verification(suite) -> [];
  -signature_verification(Config) when is_list(Config) ->
  -    run(signature_verification()).
  -validity_periods(doc) ->    [""];
  -validity_periods(suite) -> [];
  -validity_periods(Config) when is_list(Config) ->
  -    run(validity_periods()).
  -verifying_name_chaining(doc) ->    [""];
  -verifying_name_chaining(suite) -> [];
  -verifying_name_chaining(Config) when is_list(Config) ->
  -    run(verifying_name_chaining()).
  -basic_certificate_revocation_tests(doc) ->    [""];
  -basic_certificate_revocation_tests(suite) -> [];
  -basic_certificate_revocation_tests(Config) when is_list(Config) ->
  -    run(basic_certificate_revocation_tests()).
  -verifying_paths_with_self_issued_certificates(doc) ->    [""];
  -verifying_paths_with_self_issued_certificates(suite) -> [];
  -verifying_paths_with_self_issued_certificates(Config) when is_list(Config) ->
  -    run(verifying_paths_with_self_issued_certificates()).
  -verifying_basic_constraints(doc) ->    [""];
  -verifying_basic_constraints(suite) -> [];
  -verifying_basic_constraints(Config) when is_list(Config) ->
  -    run(verifying_basic_constraints()).
  -key_usage(doc) ->    [""];
  -key_usage(suite) -> [];
  -key_usage(Config) when is_list(Config) ->
  -    run(key_usage()).
  +init_per_testcase(_Func, Config) ->
  +    Datadir = proplists:get_value(data_dir, Config),
  +    put(datadir, Datadir),
  +    Config.
  +
  +end_per_testcase(_Func, Config) ->
  +    Config.
  +
  +init_per_suite(Config) ->
  +    {skip, "PKIX Conformance test certificates expired 14 of April 2011,"
  +     " new conformance test suite uses new format so skip until PKCS-12 support is implemented"}.
  +    %% try crypto:start() of
  +    %% 	ok ->
  +    %% 	    Config
  +    %% catch _:_ ->
  +    %% 	    {skip, "Crypto did not start"}
  +    %% end.
  +
  +end_per_suite(_Config) ->
  +    application:stop(crypto).
  +
  +%%-----------------------------------------------------------------------------
  +valid_rsa_signature(doc) ->
  +    ["Test rsa signatur verification"];
  +valid_rsa_signature(suite) ->
  +    [];
  +valid_rsa_signature(Config) when is_list(Config) ->
  +    run([{ "4.1.1", "Valid Signatures Test1", ok}]).
  +
  +invalid_rsa_signature(doc) ->
  +    ["Test rsa signatur verification"];
  +invalid_rsa_signature(suite) ->
  +    [];
  +invalid_rsa_signature(Config) when is_list(Config) ->
  +    run([{ "4.1.2", "Invalid CA Signature Test2", {bad_cert,invalid_signature}},
  +	 { "4.1.3", "Invalid EE Signature Test3", {bad_cert,invalid_signature}}]).
  +
  +valid_dsa_signature(doc) ->
  +    ["Test dsa signatur verification"];
  +valid_dsa_signature(suite) ->
  +    [];
  +valid_dsa_signature(Config) when is_list(Config) ->
  +    run([{ "4.1.4", "Valid DSA Signatures Test4", ok},
  +	 { "4.1.5", "Valid DSA Parameter Inheritance Test5", ok}]).
  +
  +invalid_dsa_signature(doc) ->
  +    ["Test dsa signatur verification"];
  +invalid_dsa_signature(suite) ->
  +    [];
  +invalid_dsa_signature(Config) when is_list(Config) ->
  +    run([{ "4.1.6", "Invalid DSA Signature Test6",{bad_cert,invalid_signature}}]).
  +%%-----------------------------------------------------------------------------
  +not_before_invalid(doc) ->
  +    [""];
  +not_before_invalid(suite) ->
  +    [];
  +not_before_invalid(Config) when is_list(Config) ->
  +    run([{ "4.2.1", "Invalid CA notBefore Date Test1",{bad_cert, cert_expired}},
  +	 { "4.2.2", "Invalid EE notBefore Date Test2",{bad_cert, cert_expired}}]).
  +
  +not_before_valid(doc) ->
  +    [""];
  +not_before_valid(suite) ->
  +    [];
  +not_before_valid(Config) when is_list(Config) ->
  +    run([{ "4.2.3", "Valid pre2000 UTC notBefore Date Test3", ok},
  +	 { "4.2.4", "Valid GeneralizedTime notBefore Date Test4", ok}]).
  +
  +not_after_invalid(doc) ->
  +    [""];
  +not_after_invalid(suite) ->
  +    [];
  +not_after_invalid(Config) when is_list(Config) ->
  +    run([{ "4.2.5", "Invalid CA notAfter Date Test5", {bad_cert, cert_expired}},
  +	 { "4.2.6", "Invalid EE notAfter Date Test6", {bad_cert, cert_expired}},
  +	 { "4.2.7", "Invalid pre2000 UTC EE notAfter Date Test7",{bad_cert, cert_expired}}]).
  +
  +not_after_valid(doc) ->
  +    [""];
  +not_after_valid(suite) ->
  +    [];
  +not_after_valid(Config) when is_list(Config) ->
  +    run([{ "4.2.8", "Valid GeneralizedTime notAfter Date Test8", ok}]).
  +%%-----------------------------------------------------------------------------
  +invalid_name_chain(doc) ->
  +    [""];
  +invalid_name_chain(suite) ->
  +    [];
  +invalid_name_chain(Config) when is_list(Config) ->
  +    run([{ "4.3.1", "Invalid Name Chaining EE Test1", {bad_cert, invalid_issuer}},
  +	 { "4.3.2", "Invalid Name Chaining Order Test2", {bad_cert, invalid_issuer}}]).
  +
  +whitespace_name_chain(doc) ->
  +    [""];
  +whitespace_name_chain(suite) ->
  +    [];
  +whitespace_name_chain(Config) when is_list(Config) ->
  +    run([{ "4.3.3", "Valid Name Chaining Whitespace Test3", ok},
  +	 { "4.3.4", "Valid Name Chaining Whitespace Test4", ok}]).
  +
  +capitalization_name_chain(doc) ->
  +    [""];
  +capitalization_name_chain(suite) ->
  +    [];
  +capitalization_name_chain(Config) when is_list(Config) ->
  +    run([{ "4.3.5", "Valid Name Chaining Capitalization Test5",ok}]).
  +
  +uid_name_chain(doc) ->
  +    [""];
  +uid_name_chain(suite) ->
  +    [];
  +uid_name_chain(Config) when is_list(Config) ->
  +    run([{ "4.3.6", "Valid Name Chaining UIDs Test6",ok}]).
  +
  +attrib_name_chain(doc) ->
  +    [""];
  +attrib_name_chain(suite) ->
  +    [];
  +attrib_name_chain(Config) when is_list(Config) ->
  +    run([{ "4.3.7", "Valid RFC3280 Mandatory Attribute Types Test7", ok},
  +	 { "4.3.8", "Valid RFC3280 Optional Attribute Types Test8",  ok}]).
  +
  +string_name_chain(doc) ->
  +    [""];
  +string_name_chain(suite) ->
  +    [];
  +string_name_chain(Config) when is_list(Config) ->
  +    run([{ "4.3.9", "Valid UTF8String Encoded Names Test9", ok},
  +	 { "4.3.10", "Valid Rollover from PrintableString to UTF8String Test10", ok},
  +	 { "4.3.11", "Valid UTF8String Case Insensitive Match Test11", ok}]).
  +
  +%%-----------------------------------------------------------------------------
  +
  +basic_valid(doc) ->
  +    [""];
  +basic_valid(suite) ->
  +    [];
  +basic_valid(Config) when is_list(Config) ->
  +    run([{ "4.5.1",  "Valid Basic Self-Issued Old With New Test1", ok},
  +	 { "4.5.3",  "Valid Basic Self-Issued New With Old Test3", ok},
  +	 { "4.5.4",  "Valid Basic Self-Issued New With Old Test4", ok}
  +	]).
  +
  +basic_invalid(doc) ->
  +    [""];
  +basic_invalid(suite) ->
  +    [];
  +basic_invalid(Config) when is_list(Config) ->
  +    run([{"4.5.2",  "Invalid Basic Self-Issued Old With New Test2",
  +	  {bad_cert, {revoked, keyCompromise}}},
  +	 {"4.5.5",  "Invalid Basic Self-Issued New With Old Test5",
  +	  {bad_cert, {revoked, keyCompromise}}}
  +	]).
  +
  +crl_signing_valid(doc) ->
  +    [""];
  +crl_signing_valid(suite) ->
  +    [];
  +crl_signing_valid(Config) when is_list(Config) ->
  +    run([{ "4.5.6",  "Valid Basic Self-Issued CRL Signing Key Test6", ok}]).
  +
  +crl_signing_invalid(doc) ->
  +    [""];
  +crl_signing_invalid(suite) ->
  +    [];
  +crl_signing_invalid(Config) when is_list(Config) ->
  +    run([{ "4.5.7",  "Invalid Basic Self-Issued CRL Signing Key Test7",
  +	   {bad_cert, {revoked, keyCompromise}}},
  +	 { "4.5.8",  "Invalid Basic Self-Issued CRL Signing Key Test8",
  +	   {bad_cert, invalid_key_usage}}
  +	]).
  +
  +%%-----------------------------------------------------------------------------
  +missing_CRL(doc) ->
  +    [""];
  +missing_CRL(suite) ->
  +    [];
  +missing_CRL(Config) when is_list(Config) ->
  +    run([{ "4.4.1", "Missing CRL Test1",{bad_cert,
  +    revocation_status_undetermined}}]).
  +
  +revoked_CA(doc) ->
  +    [""];
  +revoked_CA(suite) ->
  +    [];
  +revoked_CA(Config) when is_list(Config) ->
  +    run([{ "4.4.2", "Invalid Revoked CA Test2", {bad_cert,
  +    {revoked, keyCompromise}}}]).
  +
  +revoked_peer(doc) ->
  +    [""];
  +revoked_peer(suite) ->
  +    [];
  +revoked_peer(Config) when is_list(Config) ->
  +    run([{ "4.4.3", "Invalid Revoked EE Test3", {bad_cert,
  +    {revoked, keyCompromise}}}]).
  +
  +invalid_CRL_signature(doc) ->
  +    [""];
  +invalid_CRL_signature(suite) ->
  +    [];
  +invalid_CRL_signature(Config) when is_list(Config) ->
  +    run([{ "4.4.4", "Invalid Bad CRL Signature Test4",
  +	   {bad_cert, revocation_status_undetermined}}]).
  +
  +invalid_CRL_issuer(doc) ->
  +    [""];
  +invalid_CRL_issuer(suite) ->
  +    [];
  +invalid_CRL_issuer(Config) when is_list(Config) ->
  +    run({ "4.4.5", "Invalid Bad CRL Issuer Name Test5",
  +	  {bad_cert, revocation_status_undetermined}}).
  +
  +invalid_CRL(doc) ->
  +    [""];
  +invalid_CRL(suite) ->
  +    [];
  +invalid_CRL(Config) when is_list(Config) ->
  +    run([{ "4.4.6", "Invalid Wrong CRL Test6",
  +	   {bad_cert, revocation_status_undetermined}}]).
  +
  +valid_CRL(doc) ->
  +    [""];
  +valid_CRL(suite) ->
  +    [];
  +valid_CRL(Config) when is_list(Config) ->
  +    run([{ "4.4.7", "Valid Two CRLs Test7", ok}]).
  +
  +unknown_CRL_extension(doc) ->
  +    [""];
  +unknown_CRL_extension(suite) ->
  +    [];
  +unknown_CRL_extension(Config) when is_list(Config) ->
  +    run([{ "4.4.8", "Invalid Unknown CRL Entry Extension Test8",
  +	   {bad_cert, {revoked, keyCompromise}}},
  +	 { "4.4.9", "Invalid Unknown CRL Extension Test9",
  +	   {bad_cert, {revoked, keyCompromise}}},
  +	 { "4.4.10", "Invalid Unknown CRL Extension Test10",
  +	   {bad_cert, revocation_status_undetermined}}]).
  +
  +old_CRL(doc) ->
  +    [""];
  +old_CRL(suite) ->
  +    [];
  +old_CRL(Config) when is_list(Config) ->
  +    run([{ "4.4.11", "Invalid Old CRL nextUpdate Test11",
  +	   {bad_cert, revocation_status_undetermined}},
  +	 { "4.4.12", "Invalid pre2000 CRL nextUpdate Test12",
  +	   {bad_cert, revocation_status_undetermined}}]).
  +
  +fresh_CRL(doc) ->
  +    [""];
  +fresh_CRL(suite) ->
  +    [];
  +fresh_CRL(Config) when is_list(Config) ->
  +    run([{ "4.4.13", "Valid GeneralizedTime CRL nextUpdate Test13", ok}]).
  +
  +valid_serial(doc) ->
  +    [""];
  +valid_serial(suite) ->
  +    [];
  +valid_serial(Config) when is_list(Config) ->
  +    run([
  +	 { "4.4.14", "Valid Negative Serial Number Test14",ok},
  +	 { "4.4.16", "Valid Long Serial Number Test16", ok},
  +	 { "4.4.17", "Valid Long Serial Number Test17", ok}
  +	]).
  +
  +invalid_serial(doc) ->
  +    [""];
  +invalid_serial(suite) ->
  +    [];
  +invalid_serial(Config) when is_list(Config) ->
  +    run([{ "4.4.15", "Invalid Negative Serial Number Test15",
  +	   {bad_cert, {revoked, keyCompromise}}},
  +	 { "4.4.18", "Invalid Long Serial Number Test18",
  +	   {bad_cert, {revoked, keyCompromise}}}]).
  +
  +valid_seperate_keys(doc) ->
  +    [""];
  +valid_seperate_keys(suite) ->
  +    [];
  +valid_seperate_keys(Config) when is_list(Config) ->
  +    run([{ "4.4.19", "Valid Separate Certificate and CRL Keys Test19",   ok}]).
  +
  +invalid_separate_keys(doc) ->
  +    [""];
  +invalid_separate_keys(suite) ->
  +    [];
  +invalid_separate_keys(Config) when is_list(Config) ->
  +    run([{ "4.4.20", "Invalid Separate Certificate and CRL Keys Test20",
  +	   {bad_cert, {revoked, keyCompromise}}},
  +	 { "4.4.21", "Invalid Separate Certificate and CRL Keys Test21",
  +	   {bad_cert, revocation_status_undetermined}}
  +	]).
  +%%-----------------------------------------------------------------------------
  +missing_basic_constraints(doc) ->
  +    [""];
  +missing_basic_constraints(suite) ->
  +    [];
  +missing_basic_constraints(Config) when is_list(Config) ->
  +    run([{ "4.6.1",  "Invalid Missing basicConstraints Test1",
  +	   {bad_cert, missing_basic_constraint}},
  +	 { "4.6.2",  "Invalid cA False Test2",
  +	   {bad_cert, missing_basic_constraint}},
  +	 { "4.6.3",  "Invalid cA False Test3",
  +	   {bad_cert, missing_basic_constraint}}]).
  +
  +valid_basic_constraint(doc) ->
  +    [""];
  +valid_basic_constraint(suite) ->
  +    [];
  +valid_basic_constraint(Config) when is_list(Config) ->
  +    run([{"4.6.4", "Valid basicConstraints Not Critical Test4", ok}]).
  +
  +invalid_path_constraints(doc) ->
  +    [""];
  +invalid_path_constraints(suite) ->
  +    [];
  +invalid_path_constraints(Config) when is_list(Config) ->
  +    run([{ "4.6.5", "Invalid pathLenConstraint Test5", {bad_cert, max_path_length_reached}},
  +	 { "4.6.6", "Invalid pathLenConstraint Test6", {bad_cert, max_path_length_reached}},
  +	 { "4.6.9", "Invalid pathLenConstraint Test9", {bad_cert, max_path_length_reached}},
  +	 { "4.6.10", "Invalid pathLenConstraint Test10", {bad_cert, max_path_length_reached}},
  +	 { "4.6.11", "Invalid pathLenConstraint Test11", {bad_cert, max_path_length_reached}},
  +	 { "4.6.12", "Invalid pathLenConstraint Test12", {bad_cert, max_path_length_reached}},
  +	 { "4.6.16", "Invalid Self-Issued pathLenConstraint Test16",
  +	   {bad_cert, max_path_length_reached}}]).
  +
  +valid_path_constraints(doc) ->
  +    [""];
  +valid_path_constraints(suite) ->
  +    [];
  +valid_path_constraints(Config) when is_list(Config) ->
  +    run([{ "4.6.7",  "Valid pathLenConstraint Test7", ok},
  +	 { "4.6.8",  "Valid pathLenConstraint Test8", ok},
  +	 { "4.6.13", "Valid pathLenConstraint Test13", ok},
  +	 { "4.6.14", "Valid pathLenConstraint Test14", ok},
  +	 { "4.6.15", "Valid Self-Issued pathLenConstraint Test15", ok},
  +	 { "4.6.17", "Valid Self-Issued pathLenConstraint Test17", ok}]).
  +
  +%%-----------------------------------------------------------------------------
  +invalid_key_usage(doc) ->
  +    [""];
  +invalid_key_usage(suite) ->
  +    [];
  +invalid_key_usage(Config) when is_list(Config) ->
  +    run([{ "4.7.1",  "Invalid keyUsage Critical keyCertSign False Test1",
  +	   {bad_cert,invalid_key_usage} },
  +	 { "4.7.2",  "Invalid keyUsage Not Critical keyCertSign False Test2",
  +	   {bad_cert,invalid_key_usage}},
  +	{ "4.7.4",  "Invalid keyUsage Critical cRLSign False Test4",
  +	  {bad_cert, revocation_status_undetermined}},
  +	 { "4.7.5",  "Invalid keyUsage Not Critical cRLSign False Test5",
  +	   {bad_cert, revocation_status_undetermined}}
  +	]).
  +
  +valid_key_usage(doc) ->
  +    [""];
  +valid_key_usage(suite) ->
  +    [];
  +valid_key_usage(Config) when is_list(Config) ->
  +    run([{ "4.7.3",  "Valid keyUsage Not Critical Test3", ok}]).
  +
  +%%-----------------------------------------------------------------------------
   certificate_policies(doc) ->    [""];
   certificate_policies(suite) -> [];
   certificate_policies(Config) when is_list(Config) ->
       run(certificate_policies()).
  +%%-----------------------------------------------------------------------------
   require_explicit_policy(doc) ->    [""];
   require_explicit_policy(suite) -> [];
   require_explicit_policy(Config) when is_list(Config) ->
       run(require_explicit_policy()).
  +%%-----------------------------------------------------------------------------
   policy_mappings(doc) ->     [""];
   policy_mappings(suite) -> [];
   policy_mappings(Config) when is_list(Config) ->
       run(policy_mappings()).
  +%%-----------------------------------------------------------------------------
   inhibit_policy_mapping(doc) ->    [""];
   inhibit_policy_mapping(suite) -> [];
   inhibit_policy_mapping(Config) when is_list(Config) ->
       run(inhibit_policy_mapping()).
  +%%-----------------------------------------------------------------------------
   inhibit_any_policy(doc) ->    [""];
   inhibit_any_policy(suite) -> [];
   inhibit_any_policy(Config) when is_list(Config) ->
       run(inhibit_any_policy()).
  -name_constraints(doc) ->    [""];
  -name_constraints(suite) -> [];
  -name_constraints(Config) when is_list(Config) ->
  -    run(name_constraints()).
  -distribution_points(doc) ->    [""];
  -distribution_points(suite) -> [];
  -distribution_points(Config) when is_list(Config) ->
  -    run(distribution_points()).
  -delta_crls(doc) ->    [""];
  -delta_crls(suite) -> [];
  -delta_crls(Config) when is_list(Config) ->
  -    run(delta_crls()).
  -private_certificate_extensions(doc) ->    [""];
  -private_certificate_extensions(suite) -> [];
  -private_certificate_extensions(Config) when is_list(Config) ->
  -    run(private_certificate_extensions()).
  -    
  -run() ->
  -    Tests = 
  -	[signature_verification(),
  -	 validity_periods(),
  -	 verifying_name_chaining(),
  -	 %%basic_certificate_revocation_tests(),
  -	 verifying_paths_with_self_issued_certificates(),
  -	 verifying_basic_constraints(),
  -	 key_usage(),
  -	 %%certificate_policies(),
  -	 %%require_explicit_policy(),
  -	 %%policy_mappings(),
  -	 %%inhibit_policy_mapping(),
  -	 %%inhibit_any_policy(),
  -	 name_constraints(),	     
  -	 %distribution_points(),
  -	 %delta_crls(),
  -	 private_certificate_extensions()
  -	],
  -    run(lists:append(Tests)).
  -
  +%%-----------------------------------------------------------------------------
  +
  +valid_DN_name_constraints(doc) ->
  +    [""];
  +valid_DN_name_constraints(suite) ->
  +    [];
  +valid_DN_name_constraints(Config) when is_list(Config) ->
  +    run([{ "4.13.1",  "Valid DN nameConstraints Test1", ok},
  +	 { "4.13.4",  "Valid DN nameConstraints Test4", ok},
  +	 { "4.13.5",  "Valid DN nameConstraints Test5", ok},
  +	 { "4.13.6",  "Valid DN nameConstraints Test6", ok},
  +	 { "4.13.11", "Valid DN nameConstraints Test11", ok},
  +	 { "4.13.14", "Valid DN nameConstraints Test14", ok},
  +	 { "4.13.18", "Valid DN nameConstraints Test18", ok},
  +	 { "4.13.19", "Valid Self-Issued DN nameConstraints Test19", ok}]).
  +
  +invalid_DN_name_constraints(doc) ->
  +    [""];
  +invalid_DN_name_constraints(suite) ->
  +    [];
  +invalid_DN_name_constraints(Config) when is_list(Config) ->
  +    run([{ "4.13.2", "Invalid DN nameConstraints Test2", {bad_cert, name_not_permitted}},
  +	 { "4.13.3",  "Invalid DN nameConstraints Test3", {bad_cert, name_not_permitted}},
  +	 { "4.13.7",  "Invalid DN nameConstraints Test7", {bad_cert, name_not_permitted}},
  +	 { "4.13.8",  "Invalid DN nameConstraints Test8", {bad_cert, name_not_permitted}},
  +	 { "4.13.9",  "Invalid DN nameConstraints Test9", {bad_cert, name_not_permitted}},
  +	 { "4.13.10", "Invalid DN nameConstraints Test10",{bad_cert, name_not_permitted}},
  +	 { "4.13.12", "Invalid DN nameConstraints Test12",{bad_cert, name_not_permitted}},
  +	 { "4.13.13", "Invalid DN nameConstraints Test13",{bad_cert, name_not_permitted}},
  +	 { "4.13.15", "Invalid DN nameConstraints Test15",{bad_cert, name_not_permitted}},
  +	 { "4.13.16", "Invalid DN nameConstraints Test16",{bad_cert, name_not_permitted}},
  +	 { "4.13.17", "Invalid DN nameConstraints Test17",{bad_cert, name_not_permitted}},
  +	 { "4.13.20", "Invalid Self-Issued DN nameConstraints Test20",
  +	   {bad_cert, name_not_permitted}}]).
  +
  +valid_rfc822_name_constraints(doc) ->
  +    [""];
  +valid_rfc822_name_constraints(suite) ->
  +    [];
  +valid_rfc822_name_constraints(Config) when is_list(Config) ->
  +    run([{ "4.13.21", "Valid RFC822 nameConstraints Test21", ok},
  +	 { "4.13.23", "Valid RFC822 nameConstraints Test23", ok},
  +	 { "4.13.25", "Valid RFC822 nameConstraints Test25", ok}]).
  +
  +
  +invalid_rfc822_name_constraints(doc) ->
  +    [""];
  +invalid_rfc822_name_constraints(suite) ->
  +    [];
  +invalid_rfc822_name_constraints(Config) when is_list(Config) ->
  +    run([{ "4.13.22", "Invalid RFC822 nameConstraints Test22",
  +	   {bad_cert, name_not_permitted}},
  +	 { "4.13.24", "Invalid RFC822 nameConstraints Test24",
  +	   {bad_cert, name_not_permitted}},
  +	 { "4.13.26", "Invalid RFC822 nameConstraints Test26",
  +	   {bad_cert, name_not_permitted}}]).
  +
  +valid_DN_and_rfc822_name_constraints(doc) ->
  +    [""];
  +valid_DN_and_rfc822_name_constraints(suite) ->
  +    [];
  +valid_DN_and_rfc822_name_constraints(Config) when is_list(Config) ->
  +    run([{ "4.13.27", "Valid DN and RFC822 nameConstraints Test27", ok}]).
  +
  +invalid_DN_and_rfc822_name_constraints(doc) ->
  +    [""];
  +invalid_DN_and_rfc822_name_constraints(suite) ->
  +    [];
  +invalid_DN_and_rfc822_name_constraints(Config) when is_list(Config) ->
  +    run([{ "4.13.28", "Invalid DN and RFC822 nameConstraints Test28",
  +	   {bad_cert, name_not_permitted}},
  +	 { "4.13.29", "Invalid DN and RFC822 nameConstraints Test29",
  +	   {bad_cert, name_not_permitted}}]).
  +
  +valid_dns_name_constraints(doc) ->
  +    [""];
  +valid_dns_name_constraints(suite) ->
  +    [];
  +valid_dns_name_constraints(Config) when is_list(Config) ->
  +    run([{ "4.13.30", "Valid DNS nameConstraints Test30", ok},
  +	 { "4.13.32", "Valid DNS nameConstraints Test32", ok}]).
  +
  +invalid_dns_name_constraints(doc) ->
  +    [""];
  +invalid_dns_name_constraints(suite) ->
  +    [];
  +invalid_dns_name_constraints(Config) when is_list(Config) ->
  +    run([{ "4.13.31", "Invalid DNS nameConstraints Test31", {bad_cert, name_not_permitted}},
  +	 { "4.13.33", "Invalid DNS nameConstraints Test33", {bad_cert, name_not_permitted}},
  +	 { "4.13.38", "Invalid DNS nameConstraints Test38", {bad_cert, name_not_permitted}}]).
  +
  +valid_uri_name_constraints(doc) ->
  +    [""];
  +valid_uri_name_constraints(suite) ->
  +    [];
  +valid_uri_name_constraints(Config) when is_list(Config) ->
  +    run([{ "4.13.34", "Valid URI nameConstraints Test34", ok},
  +	 { "4.13.36", "Valid URI nameConstraints Test36", ok}]).
  +
  +invalid_uri_name_constraints(doc) ->
  +    [""];
  +invalid_uri_name_constraints(suite) ->
  +    [];
  +invalid_uri_name_constraints(Config) when is_list(Config) ->
  +    run([{ "4.13.35", "Invalid URI nameConstraints Test35",{bad_cert, name_not_permitted}},
  +	 { "4.13.37", "Invalid URI nameConstraints Test37",{bad_cert, name_not_permitted}}]).
  +
  +%%-----------------------------------------------------------------------------
  +delta_without_crl(doc) ->
  +    [""];
  +delta_without_crl(suite) ->
  +    [];
  +delta_without_crl(Config) when is_list(Config) ->
  +  run([{ "4.15.1",  "Invalid deltaCRLIndicator No Base Test1",{bad_cert,
  +							       revocation_status_undetermined}},
  +       {"4.15.10", "Invalid delta-CRL Test10", {bad_cert,
  +						revocation_status_undetermined}}]).
  +
  +valid_delta_crls(doc) ->
  +    [""];
  +valid_delta_crls(suite) ->
  +    [];
  +valid_delta_crls(Config) when is_list(Config) ->
  +    run([{ "4.15.2",  "Valid delta-CRL Test2", ok},
  +	 { "4.15.5",  "Valid delta-CRL Test5", ok},
  +	 { "4.15.7",  "Valid delta-CRL Test7", ok},
  +	 { "4.15.8",  "Valid delta-CRL Test8", ok}
  +	]).
  +
  +invalid_delta_crls(doc) ->
  +    [""];
  +invalid_delta_crls(suite) ->
  +    [];
  +invalid_delta_crls(Config) when is_list(Config) ->
  +    run([{ "4.15.3",  "Invalid delta-CRL Test3", {bad_cert,{revoked, keyCompromise}}},
  +	 { "4.15.4",  "Invalid delta-CRL Test4", {bad_cert,{revoked, keyCompromise}}},
  +	 { "4.15.6",  "Invalid delta-CRL Test6", {bad_cert,{revoked, keyCompromise}}},
  +	 { "4.15.9",  "Invalid delta-CRL Test9", {bad_cert,{revoked, keyCompromise}}}]).
  +
  +%%-----------------------------------------------------------------------------
  +
  +valid_distribution_points(doc) ->
  +    [""];
  +valid_distribution_points(suite) ->
  +    [];
  +valid_distribution_points(Config) when is_list(Config) ->
  +    run([{ "4.14.1",  "Valid distributionPoint Test1", ok},
  +	 { "4.14.4",  "Valid distributionPoint Test4", ok},
  +	 { "4.14.5",  "Valid distributionPoint Test5", ok},
  +	 { "4.14.7",  "Valid distributionPoint Test7", ok}
  +	]).
  +
  +valid_distribution_points_no_issuing_distribution_point(doc) ->
  +    [""];
  +valid_distribution_points_no_issuing_distribution_point(suite) ->
  +    [];
  +valid_distribution_points_no_issuing_distribution_point(Config) when is_list(Config) ->
  +    run([{ "4.14.10", "Valid No issuingDistributionPoint Test10", ok}
  +	]).
  +
  +invalid_distribution_points(doc) ->
  +    [""];
  +invalid_distribution_points(suite) ->
  +    [];
  +invalid_distribution_points(Config) when is_list(Config) ->
  +    run([{ "4.14.2",  "Invalid distributionPoint Test2", {bad_cert,{revoked, keyCompromise}}},
  +	 { "4.14.3",  "Invalid distributionPoint Test3", {bad_cert,
  +							  revocation_status_undetermined}},
  +	 { "4.14.6",  "Invalid distributionPoint Test6", {bad_cert,{revoked, keyCompromise}}},
  +	 { "4.14.8",  "Invalid distributionPoint Test8", {bad_cert,
  +							  revocation_status_undetermined}},
  +	 { "4.14.9",  "Invalid distributionPoint Test9", {bad_cert,
  +							  revocation_status_undetermined}}
  +	]).
  +
  +valid_only_contains(doc) ->
  +    [""];
  +valid_only_contains(suite) ->
  +    [];
  +valid_only_contains(Config) when is_list(Config) ->
  +    run([{ "4.14.13", "Valid onlyContainsCACerts CRL Test13", ok}]).
  +
  +
  +invalid_only_contains(doc) ->
  +    [""];
  +invalid_only_contains(suite) ->
  +    [];
  +invalid_only_contains(Config) when is_list(Config) ->
  +    run([{ "4.14.11", "Invalid onlyContainsUserCerts CRL Test11",
  +	   {bad_cert, revocation_status_undetermined}},
  +	 { "4.14.12", "Invalid onlyContainsCACerts CRL Test12",
  +	   {bad_cert, revocation_status_undetermined}},
  +	 { "4.14.14", "Invalid onlyContainsAttributeCerts Test14",
  +	   {bad_cert, revocation_status_undetermined}}
  +	]).
  +
  +valid_only_some_reasons(doc) ->
  +    [""];
  +valid_only_some_reasons(suite) ->
  +    [];
  +valid_only_some_reasons(Config) when is_list(Config) ->
  +    run([{ "4.14.18", "Valid onlySomeReasons Test18", ok},
  +	 { "4.14.19", "Valid onlySomeReasons Test19", ok}
  +	]).
  +
  +invalid_only_some_reasons(doc) ->
  +    [""];
  +invalid_only_some_reasons(suite) ->
  +    [];
  +invalid_only_some_reasons(Config) when is_list(Config) ->
  +    run([{ "4.14.15", "Invalid onlySomeReasons Test15",
  +	   {bad_cert,{revoked, keyCompromise}}},
  +	 { "4.14.16", "Invalid onlySomeReasons Test16",
  +	   {bad_cert,{revoked, certificateHold}}},
  +	 { "4.14.17", "Invalid onlySomeReasons Test17",
  +	   {bad_cert, revocation_status_undetermined}},
  +	 { "4.14.20", "Invalid onlySomeReasons Test20",
  +	   {bad_cert,{revoked, keyCompromise}}},
  +	 { "4.14.21", "Invalid onlySomeReasons Test21",
  +	   {bad_cert,{revoked, affiliationChanged}}}
  +	]).
  +
  +valid_indirect_crl(doc) ->
  +    [""];
  +valid_indirect_crl(suite) ->
  +    [];
  +valid_indirect_crl(Config) when is_list(Config) ->
  +    run([{ "4.14.22", "Valid IDP with indirectCRL Test22", ok},
  +	 { "4.14.24", "Valid IDP with indirectCRL Test24", ok},
  +	 { "4.14.25", "Valid IDP with indirectCRL Test25", ok}
  +	]).
  +
  +invalid_indirect_crl(doc) ->
  +    [""];
  +invalid_indirect_crl(suite) ->
  +    [];
  +invalid_indirect_crl(Config) when is_list(Config) ->
  +    run([{ "4.14.23", "Invalid IDP with indirectCRL Test23",
  +	   {bad_cert,{revoked, keyCompromise}}},
  +	 { "4.14.26", "Invalid IDP with indirectCRL Test26",
  +	   {bad_cert, revocation_status_undetermined}}
  +	]).
  +
  +valid_crl_issuer(doc) ->
  +    [""];
  +valid_crl_issuer(suite) ->
  +    [];
  +valid_crl_issuer(Config) when is_list(Config) ->
  +    run([{ "4.14.28", "Valid cRLIssuer Test28", ok}%%,
  +	 %%{ "4.14.29", "Valid cRLIssuer Test29", ok},
  +	 %%{ "4.14.33", "Valid cRLIssuer Test33", ok}
  +	]).
  +
  +invalid_crl_issuer(doc) ->
  +    [""];
  +invalid_crl_issuer(suite) ->
  +    [];
  +invalid_crl_issuer(Config) when is_list(Config) ->
  +    run([
  +	 { "4.14.27", "Invalid cRLIssuer Test27", {bad_cert, revocation_status_undetermined}},
  +	 { "4.14.31", "Invalid cRLIssuer Test31", {bad_cert,{revoked, keyCompromise}}},
  +	 { "4.14.32", "Invalid cRLIssuer Test32", {bad_cert,{revoked, keyCompromise}}},
  +	 { "4.14.34", "Invalid cRLIssuer Test34", {bad_cert,{revoked, keyCompromise}}},
  +	 { "4.14.35", "Invalid cRLIssuer Test35", {bad_cert, revocation_status_undetermined}}
  +	]).
  +
  +
  +%%distribution_points() ->
  +    %%{ "4.14",    "Distribution Points" },
  +%%    [
  +	 %% Although this test is valid it has a circular dependency. As a result
  +	 %% an attempt is made to reursively checks a CRL path and rejected due to
  +	 %% a CRL path validation error. PKITS notes suggest this test does not
  +	 %% need to be run due to this issue.
  +%%	 { "4.14.30", "Valid cRLIssuer Test30", 54 }].
  +
  +
  +%%-----------------------------------------------------------------------------
  +
  +unknown_critical_extension(doc) ->
  +    [""];
  +unknown_critical_extension(suite) ->
  +    [];
  +unknown_critical_extension(Config) when is_list(Config) ->
  +    run([{ "4.16.2",  "Invalid Unknown Critical Certificate Extension Test2",
  +	   {bad_cert,unknown_critical_extension}}]).
  +
  +unknown_not_critical_extension(doc) ->
  +    [""];
  +unknown_not_critical_extension(suite) ->
  +    [];
  +unknown_not_critical_extension(Config) when is_list(Config) ->
  +    run([{ "4.16.1",  "Valid Unknown Not Critical Certificate Extension Test1", ok}]).
  +
  +%%-----------------------------------------------------------------------------
   run(Tests) ->    
       File = file(?CERTS,"TrustAnchorRootCertificate.crt"),
       {ok, TA} = file:read_file(File),
       run(Tests, TA).
   
   run({Chap, Test, Result}, TA) ->
  -    CertChain = sort_chain(read_certs(Test),TA, [], false),    
  -    try public_key:pkix_path_validation(TA, CertChain, []) of	
  -	{Result, _} -> ok;	
  +    CertChain = sort_chain(read_certs(Test),TA, [], false, Chap),
  +    Options = path_validation_options(TA, Chap,Test),
  +    try public_key:pkix_path_validation(TA, CertChain, Options) of
  +	{Result, _} -> ok;
   	{error,Result} when Result =/= ok ->
   	    ok;
  -	{error,Error} when is_integer(Result) ->
  -	    ?warning(" ~p~n  Got ~p expected ~p~n",[Test, Error, Result]);
  -	{error,Error} when Result =/= ok ->
  -	    ?error(" minor ~p~n  Got ~p expected ~p~n",[Test, Error, Result]);
   	{error, Error}  ->
   	    ?error(" ~p ~p~n  Expected ~p got ~p ~n", [Chap, Test, Result, Error]),
   	    fail;
  -	{ok, _} when Result =/= ok ->
  +	{ok, _OK} when Result =/= ok ->
   	    ?error(" ~p ~p~n  Expected ~p got ~p ~n", [Chap, Test, Result, ok]),
   	    fail
       catch Type:Reason ->
  
positive.code:     run(Rest,TA);
  run([],_) -> ok.
  
  
  read_certs(Test) ->
      File = test_file(Test),
      %% io:format("Read ~p ",[File]),
      Ders = erl_make_certs:pem_to_der(File),
      %% io:format("Ders ~p ~n",[length(Ders)]),
      [Cert || {'Certificate', Cert, not_encrypted} <- Ders].
  
  test_file(Test) ->
      file(?CONV, lists:append(string:tokens(Test, " -")) ++ ".pem").
  
negative.code: -define(NIST5, "2.16.840.1.101.3.2.1.48.5").
  -define(NIST6, "2.16.840.1.101.3.2.1.48.6").
  
  -record(verify_state, {
  	  certs_db,
  	  crl_info,
  	  revoke_state}).
  %%
  suite() ->
      [{ct_hooks,[ts_install_cth]}].
  
  all() -> 
      [{group, signature_verification},
       {group, validity_periods},
       {group, verifying_name_chaining},
       {group, verifying_paths_with_self_issued_certificates},
       %%{group, basic_certificate_revocation_tests},
       %%{group, delta_crls},
       %%{group, distribution_points},
       {group, verifying_basic_constraints},
       {group, key_usage},
       {group, name_constraints},
       {group, private_certificate_extensions}].
  
  groups() -> 
      [{signature_verification, [], [valid_rsa_signature,
  				   invalid_rsa_signature, valid_dsa_signature,
  				   invalid_dsa_signature]},
       {validity_periods, [],
        [not_before_invalid, not_before_valid, not_after_invalid, not_after_valid]},
       {verifying_name_chaining, [],
        [invalid_name_chain, whitespace_name_chain, capitalization_name_chain,
         uid_name_chain, attrib_name_chain, string_name_chain]},
       {verifying_paths_with_self_issued_certificates, [],
        [basic_valid, basic_invalid, crl_signing_valid, crl_signing_invalid]},
       %% {basic_certificate_revocation_tests, [],
       %%  [missing_CRL, revoked_CA, revoked_peer, invalid_CRL_signature,
       %%   invalid_CRL_issuer, invalid_CRL, valid_CRL,
       %%   unknown_CRL_extension, old_CRL, fresh_CRL, valid_serial,
       %%   invalid_serial, valid_seperate_keys, invalid_separate_keys]},
       %% {delta_crls, [], [delta_without_crl, valid_delta_crls, invalid_delta_crls]},
       %% {distribution_points, [], [valid_distribution_points,
       %% 				valid_distribution_points_no_issuing_distribution_point,
       %% 				invalid_distribution_points, valid_only_contains,
       %% 				invalid_only_contains, valid_only_some_reasons,
       %% 				invalid_only_some_reasons, valid_indirect_crl,
       %% 				invalid_indirect_crl, valid_crl_issuer, invalid_crl_issuer]},
       {verifying_basic_constraints,[],
        [missing_basic_constraints, valid_basic_constraint, invalid_path_constraints,
         valid_path_constraints]},
       {key_usage, [],
        [invalid_key_usage, valid_key_usage]},
       {name_constraints, [],
        [valid_DN_name_constraints, invalid_DN_name_constraints,
         valid_rfc822_name_constraints,
         invalid_rfc822_name_constraints, valid_DN_and_rfc822_name_constraints,
         invalid_DN_and_rfc822_name_constraints, valid_dns_name_constraints,
         invalid_dns_name_constraints, valid_uri_name_constraints,
         invalid_uri_name_constraints]},
       {private_certificate_extensions, [],
        [unknown_critical_extension, unknown_not_critical_extension]}
      ].
  
  init_per_group(_GroupName, Config) ->
      Config.
  