anchor.diff:  		       Options, pubkey_crl:init_revokation_state()).
   
   %--------------------------------------------------------------------
  --spec pkix_verify_hostname(Cert :: #'OTPCertificate'{} | binary(),
  -			   ReferenceIDs :: [{uri_id | dns_id | ip | srv_id | oid(),  string()}]) -> boolean().
  -
  --spec pkix_verify_hostname(Cert :: #'OTPCertificate'{} | binary(),
  -			   ReferenceIDs :: [{uri_id | dns_id | ip | srv_id | oid(),  string()}],
  -			   Options :: proplists:proplist()) -> boolean().
  +-spec pkix_verify_hostname(#'OTPCertificate'{} | binary(),
  +			   referenceIDs()
  +                          ) -> boolean().
  +
  +-spec pkix_verify_hostname(#'OTPCertificate'{} | binary(),
  +			   referenceIDs(),
  +			   proplists:proplist()) -> boolean().
  +
  +-type referenceIDs() :: [referenceID()] .
  +-type referenceID() :: {uri_id | dns_id | ip | srv_id | oid(),  string()} .
  +
  +-spec pkix_verify_hostname_match_fun(high_level_alg()) -> match_fun() .
  +
  +-type high_level_alg() :: https .
  +-type match_fun() ::  fun((ReferenceID::referenceID() | string(),
  +                           PresentedID::{atom()|oid(),string()}) -> match_fun_result() ) .
  +-type match_fun_result() :: boolean() | default .
   
   %% Description: Validates a hostname to RFC 6125
   %%--------------------------------------------------------------------
  
positive.code: 	 pkix_normalize_name/1,
  	 pkix_path_validation/3,
  	 pkix_verify_hostname/2, pkix_verify_hostname/3,
  	 ssh_decode/2, ssh_encode/2,
  	 ssh_hostkey_fingerprint/1, ssh_hostkey_fingerprint/2,
  	 ssh_curvename2oid/1, oid2ssh_curvename/1,
  
negative.code:     R==P;
  verify_hostname_match_default0(_, _) ->
      false.
  
  
  verify_hostname_match_wildcard(FQDN, Name) ->
      [F1|Fs] = string:tokens(FQDN, "."),
      [N1|Ns] = string:tokens(Name, "."),
      match_wild(F1,N1) andalso Fs==Ns.
  
  
  ok({ok,X}) -> X.
  
  