anchor.diff:  -define(NIST5, "2.16.840.1.101.3.2.1.48.5").
   -define(NIST6, "2.16.840.1.101.3.2.1.48.6").
   
  +-record(verify_state, {
  +	  certs_db,
  +	  crl_info,
  +	  revoke_state}).
   %%
  -suite() -> [{ct_hooks,[ts_install_cth]}].
  +suite() ->
  +    [{ct_hooks,[ts_install_cth]}].
   
   all() -> 
  -    [signature_verification, validity_periods,
  -     verifying_name_chaining,
  -     verifying_paths_with_self_issued_certificates,
  -     verifying_basic_constraints, key_usage,
  -     name_constraints, private_certificate_extensions].
  +    [{group, signature_verification},
  +     {group, validity_periods},
  +     {group, verifying_name_chaining},
  +     {group, verifying_paths_with_self_issued_certificates},
  +     %%{group, basic_certificate_revocation_tests},
  +     %%{group, delta_crls},
  +     %%{group, distribution_points},
  +     {group, verifying_basic_constraints},
  +     {group, key_usage},
  +     {group, name_constraints},
  +     {group, private_certificate_extensions}].
   
   groups() -> 
  -    [].
  +    [{signature_verification, [], [valid_rsa_signature,
  +				   invalid_rsa_signature, valid_dsa_signature,
  +				   invalid_dsa_signature]},
  +     {validity_periods, [],
  +      [not_before_invalid, not_before_valid, not_after_invalid, not_after_valid]},
  +     {verifying_name_chaining, [],
  +      [invalid_name_chain, whitespace_name_chain, capitalization_name_chain,
  +       uid_name_chain, attrib_name_chain, string_name_chain]},
  +     {verifying_paths_with_self_issued_certificates, [],
  +      [basic_valid, basic_invalid, crl_signing_valid, crl_signing_invalid]},
  +     %% {basic_certificate_revocation_tests, [],
  +     %%  [missing_CRL, revoked_CA, revoked_peer, invalid_CRL_signature,
  +     %%   invalid_CRL_issuer, invalid_CRL, valid_CRL,
  +     %%   unknown_CRL_extension, old_CRL, fresh_CRL, valid_serial,
  +     %%   invalid_serial, valid_seperate_keys, invalid_separate_keys]},
  +     %% {delta_crls, [], [delta_without_crl, valid_delta_crls, invalid_delta_crls]},
  +     %% {distribution_points, [], [valid_distribution_points,
  +     %% 				valid_distribution_points_no_issuing_distribution_point,
  +     %% 				invalid_distribution_points, valid_only_contains,
  +     %% 				invalid_only_contains, valid_only_some_reasons,
  +     %% 				invalid_only_some_reasons, valid_indirect_crl,
  +     %% 				invalid_indirect_crl, valid_crl_issuer, invalid_crl_issuer]},
  +     {verifying_basic_constraints,[],
  +      [missing_basic_constraints, valid_basic_constraint, invalid_path_constraints,
  +       valid_path_constraints]},
  +     {key_usage, [],
  +      [invalid_key_usage, valid_key_usage]},
  +     {name_constraints, [],
  +      [valid_DN_name_constraints, invalid_DN_name_constraints,
  +       valid_rfc822_name_constraints,
  +       invalid_rfc822_name_constraints, valid_DN_and_rfc822_name_constraints,
  +       invalid_DN_and_rfc822_name_constraints, valid_dns_name_constraints,
  +       invalid_dns_name_constraints, valid_uri_name_constraints,
  +       invalid_uri_name_constraints]},
  +     {private_certificate_extensions, [],
  +      [unknown_critical_extension, unknown_not_critical_extension]}
  +    ].
   
   init_per_group(_GroupName, Config) ->
       Config.
  
positive.code:      {"4.12.8",  "Invalid Self-Issued inhibitAnyPolicy Test8",    43 },
       {"4.12.9",  "Valid Self-Issued inhibitAnyPolicy Test9",      ok},
       {"4.12.10", "Invalid Self-Issued inhibitAnyPolicy Test10",   43 }].
  
  name_constraints() ->
      %%{ "4.13",    "Name Constraints" },
      [{ "4.13.1",  "Valid DN nameConstraints Test1",                ok},
       { "4.13.2",  "Invalid DN nameConstraints Test2",              {bad_cert, name_not_permitted}},
       { "4.13.3",  "Invalid DN nameConstraints Test3",              {bad_cert, name_not_permitted}},
       { "4.13.4",  "Valid DN nameConstraints Test4",                ok},
       { "4.13.5",  "Valid DN nameConstraints Test5",                ok},
       { "4.13.6",  "Valid DN nameConstraints Test6",                ok},
       { "4.13.7",  "Invalid DN nameConstraints Test7",              {bad_cert, name_not_permitted}},
       { "4.13.8",  "Invalid DN nameConstraints Test8",              {bad_cert, name_not_permitted}},
       { "4.13.9",  "Invalid DN nameConstraints Test9",              {bad_cert, name_not_permitted}},
       { "4.13.10", "Invalid DN nameConstraints Test10",             {bad_cert, name_not_permitted}},
       { "4.13.11", "Valid DN nameConstraints Test11",               ok},
       { "4.13.12", "Invalid DN nameConstraints Test12",             {bad_cert, name_not_permitted}},
       { "4.13.13", "Invalid DN nameConstraints Test13",             {bad_cert, name_not_permitted}},
       { "4.13.14", "Valid DN nameConstraints Test14",               ok},
       { "4.13.15", "Invalid DN nameConstraints Test15",             {bad_cert, name_not_permitted}},
       { "4.13.16", "Invalid DN nameConstraints Test16",             {bad_cert, name_not_permitted}},
       { "4.13.17", "Invalid DN nameConstraints Test17",             {bad_cert, name_not_permitted}},
       { "4.13.18", "Valid DN nameConstraints Test18",               ok},
       { "4.13.19", "Valid Self-Issued DN nameConstraints Test19",   ok},
       { "4.13.20", "Invalid Self-Issued DN nameConstraints Test20", {bad_cert, name_not_permitted} },
       { "4.13.21", "Valid RFC822 nameConstraints Test21",           ok},
       { "4.13.22", "Invalid RFC822 nameConstraints Test22",         {bad_cert, name_not_permitted} },
       { "4.13.23", "Valid RFC822 nameConstraints Test23",           ok},
       { "4.13.24", "Invalid RFC822 nameConstraints Test24",         {bad_cert, name_not_permitted} },
       { "4.13.25", "Valid RFC822 nameConstraints Test25",           ok},
       { "4.13.26", "Invalid RFC822 nameConstraints Test26",         {bad_cert, name_not_permitted}},
       { "4.13.27", "Valid DN and RFC822 nameConstraints Test27",    ok},
       { "4.13.28", "Invalid DN and RFC822 nameConstraints Test28",  {bad_cert, name_not_permitted} },
       { "4.13.29", "Invalid DN and RFC822 nameConstraints Test29",  {bad_cert, name_not_permitted} },
       { "4.13.30", "Valid DNS nameConstraints Test30",              ok},
       { "4.13.31", "Invalid DNS nameConstraints Test31",            {bad_cert, name_not_permitted} },
       { "4.13.32", "Valid DNS nameConstraints Test32",              ok},
       { "4.13.33", "Invalid DNS nameConstraints Test33",            {bad_cert, name_not_permitted}},
       { "4.13.34", "Valid URI nameConstraints Test34",              ok},
       { "4.13.35", "Invalid URI nameConstraints Test35",            {bad_cert, name_not_permitted} },
       { "4.13.36", "Valid URI nameConstraints Test36",              ok},
       { "4.13.37", "Invalid URI nameConstraints Test37",            {bad_cert, name_not_permitted}},
       { "4.13.38", "Invalid DNS nameConstraints Test38",            {bad_cert, name_not_permitted} }].
  distribution_points() ->
       %%{ "4.14",    "Distribution Points" },
      [{ "4.14.1",  "Valid distributionPoint Test1",                 ok},
       { "4.14.2",  "Invalid distributionPoint Test2",               23 },
       { "4.14.3",  "Invalid distributionPoint Test3",               44 },
       { "4.14.4",  "Valid distributionPoint Test4",                 ok},
       { "4.14.5",  "Valid distributionPoint Test5",                 ok},
       { "4.14.6",  "Invalid distributionPoint Test6",               23 },
       { "4.14.7",  "Valid distributionPoint Test7",                 ok},
       { "4.14.8",  "Invalid distributionPoint Test8",               44 },
       { "4.14.9",  "Invalid distributionPoint Test9",               44 },
       { "4.14.10", "Valid No issuingDistributionPoint Test10",      ok},
       { "4.14.11", "Invalid onlyContainsUserCerts CRL Test11",      44 },
       { "4.14.12", "Invalid onlyContainsCACerts CRL Test12",        44 },
       { "4.14.13", "Valid onlyContainsCACerts CRL Test13",          ok},
       { "4.14.14", "Invalid onlyContainsAttributeCerts Test14",     44 },
       { "4.14.15", "Invalid onlySomeReasons Test15",                23 },
       { "4.14.16", "Invalid onlySomeReasons Test16",                23 },
       { "4.14.17", "Invalid onlySomeReasons Test17",                3 },
       { "4.14.18", "Valid onlySomeReasons Test18",                  ok},
       { "4.14.19", "Valid onlySomeReasons Test19",                  ok},
       { "4.14.20", "Invalid onlySomeReasons Test20",                23 },
       { "4.14.21", "Invalid onlySomeReasons Test21",                23 },
       { "4.14.22", "Valid IDP with indirectCRL Test22",             ok},
       { "4.14.23", "Invalid IDP with indirectCRL Test23",           23 },
       { "4.14.24", "Valid IDP with indirectCRL Test24",             ok},
       { "4.14.25", "Valid IDP with indirectCRL Test25",             ok},
       { "4.14.26", "Invalid IDP with indirectCRL Test26",           44 },
       { "4.14.27", "Invalid cRLIssuer Test27",                      3 },
       { "4.14.28", "Valid cRLIssuer Test28",                        ok},
       { "4.14.29", "Valid cRLIssuer Test29",                        ok},
  
       %% Although this test is valid it has a circular dependency. As a result
       %% an attempt is made to reursively checks a CRL path and rejected due to
       %% a CRL path validation error. PKITS notes suggest this test does not
       %% need to be run due to this issue.
       { "4.14.30", "Valid cRLIssuer Test30",                                 54 },
       { "4.14.31", "Invalid cRLIssuer Test31",                               23 },
       { "4.14.32", "Invalid cRLIssuer Test32",                               23 },
       { "4.14.33", "Valid cRLIssuer Test33",                                 ok},
       { "4.14.34", "Invalid cRLIssuer Test34",                               23 },
       { "4.14.35", "Invalid cRLIssuer Test35",                               44 }].
  delta_crls() ->
      %%{ "4.15",    "Delta-CRLs" },
      [{ "4.15.1",  "Invalid deltaCRLIndicator No Base Test1",                3 },
       { "4.15.2",  "Valid delta-CRL Test2",                                  ok},
       { "4.15.3",  "Invalid delta-CRL Test3",                                23 },
       { "4.15.4",  "Invalid delta-CRL Test4",                                23 },
       { "4.15.5",  "Valid delta-CRL Test5",                                  ok},
       { "4.15.6",  "Invalid delta-CRL Test6",                                23 },
       { "4.15.7",  "Valid delta-CRL Test7",                                  ok},
       { "4.15.8",  "Valid delta-CRL Test8",                                  ok},
       { "4.15.9",  "Invalid delta-CRL Test9",                                23 },
       { "4.15.10", "Invalid delta-CRL Test10",                               12 }].
  private_certificate_extensions() ->
      %%{ "4.16",    "Private Certificate Extensions" },
      [{ "4.16.1",  "Valid Unknown Not Critical Certificate Extension Test1", ok},
       { "4.16.2",  "Invalid Unknown Critical Certificate Extension Test2",   
         {bad_cert,unknown_critical_extension}}].
  
  
  convert() ->
      Tests = [signature_verification(),
  	     validity_periods(),
  	     verifying_name_chaining(),
  	     basic_certificate_revocation_tests(),
  	     verifying_paths_with_self_issued_certificates(),
  	     verifying_basic_constraints(),
  	     key_usage(),
  	     certificate_policies(),
  	     require_explicit_policy(),
  	     policy_mappings(),
  	     inhibit_policy_mapping(),
  	     inhibit_any_policy(),
  	     name_constraints(),	     
  	     distribution_points(),
  	     delta_crls(),
  	     private_certificate_extensions()],    
      [convert(Test) || Test <- lists:flatten(Tests)].
  
  convert({_,Test,_}) ->
      convert1(Test);
  convert({_,Test,_,_,_,_,_}) ->
      convert1(Test).
  
  convert1(Test) ->
      FName = lists:append(string:tokens(Test, " -")),
      File = filename:join(?MIME, "Signed" ++ FName ++ ".eml"),
      io:format("Convert ~p~n",[File]),
      {ok, Mail} = file:read_file(File),
      Base64  = skip_lines(Mail),
      %%io:format("~s",[Base64]),
      Tmp = base64:mime_decode(Base64),
      file:write_file("pkits/smime-pem/tmp-pkcs7.der", Tmp),
      Cmd = "openssl pkcs7 -inform der -in pkits/smime-pem/tmp-pkcs7.der"
  	" -print_certs -out pkits/smime-pem/" ++ FName ++ ".pem",
      case os:cmd(Cmd) of
  	"" -> ok;
  	Err -> 
  	    io:format("~s",[Err]),
  	    erlang:error(bad_cmd)
      end.
  
  skip_lines(<<"\r\n\r\n", Rest/binary>>) -> Rest;
  skip_lines(<<"\n\n", Rest/binary>>) -> Rest;
  skip_lines(<<_:8, Rest/binary>>) ->
      skip_lines(Rest).
  
  init_per_testcase(_Func, Config) ->    
      Datadir = proplists:get_value(data_dir, Config),
      put(datadir, Datadir),
      Config.
  
  end_per_testcase(_Func, Config) ->
      %% Nodes = select_nodes(all, Config, ?FILE, ?LINE),
      %% rpc:multicall(Nodes, mnesia, lkill, []),
      Config.
  
  init_per_suite(Config) ->
      try crypto:start() of
  	ok ->
  	    Config
      catch _:_ ->
  	    {skip, "Crypto did not start"}
      end.
  
  end_per_suite(_Config) ->
      application:stop(crypto).
  
  error(Format, Args, File0, Line) ->
      File = filename:basename(File0),
      Pid = group_leader(),
      Pid ! {failed, File, Line},
      io:format(Pid, "~s(~p): ERROR"++Format, [File,Line|Args]).
  
  warning(Format, Args, File0, Line) ->
      File = filename:basename(File0),
      io:format("~s(~p): Warning "++Format, [File,Line|Args]).
  
negative.code: end_per_group(_GroupName, Config) ->
      Config.
  
  init_per_testcase(_Func, Config) ->
      Datadir = proplists:get_value(data_dir, Config),
      put(datadir, Datadir),
      Config.
  
  end_per_testcase(_Func, Config) ->
      Config.
  
  init_per_suite(Config) ->
      {skip, "PKIX Conformance test certificates expired 14 of April 2011,"
       " new conformance test suite uses new format so skip until PKCS-12 support is implemented"}.
      %% try crypto:start() of
      %% 	ok ->
      %% 	    Config
      %% catch _:_ ->
      %% 	    {skip, "Crypto did not start"}
      %% end.
  
  end_per_suite(_Config) ->
      application:stop(crypto).
  
  %%-----------------------------------------------------------------------------
  valid_rsa_signature(doc) ->
      ["Test rsa signatur verification"];
  valid_rsa_signature(suite) ->
      [];
  valid_rsa_signature(Config) when is_list(Config) ->
      run([{ "4.1.1", "Valid Signatures Test1", ok}]).
  
  invalid_rsa_signature(doc) ->
      ["Test rsa signatur verification"];
  invalid_rsa_signature(suite) ->
      [];
  invalid_rsa_signature(Config) when is_list(Config) ->
      run([{ "4.1.2", "Invalid CA Signature Test2", {bad_cert,invalid_signature}},
  	 { "4.1.3", "Invalid EE Signature Test3", {bad_cert,invalid_signature}}]).
  
  valid_dsa_signature(doc) ->
      ["Test dsa signatur verification"];
  valid_dsa_signature(suite) ->
      [];
  valid_dsa_signature(Config) when is_list(Config) ->
      run([{ "4.1.4", "Valid DSA Signatures Test4", ok},
  	 { "4.1.5", "Valid DSA Parameter Inheritance Test5", ok}]).
  
  invalid_dsa_signature(doc) ->
      ["Test dsa signatur verification"];
  invalid_dsa_signature(suite) ->
      [];
  invalid_dsa_signature(Config) when is_list(Config) ->
      run([{ "4.1.6", "Invalid DSA Signature Test6",{bad_cert,invalid_signature}}]).
  %%-----------------------------------------------------------------------------
  not_before_invalid(doc) ->
      [""];
  not_before_invalid(suite) ->
      [];
  not_before_invalid(Config) when is_list(Config) ->
      run([{ "4.2.1", "Invalid CA notBefore Date Test1",{bad_cert, cert_expired}},
  	 { "4.2.2", "Invalid EE notBefore Date Test2",{bad_cert, cert_expired}}]).
  
  not_before_valid(doc) ->
      [""];
  not_before_valid(suite) ->
      [];
  not_before_valid(Config) when is_list(Config) ->
      run([{ "4.2.3", "Valid pre2000 UTC notBefore Date Test3", ok},
  	 { "4.2.4", "Valid GeneralizedTime notBefore Date Test4", ok}]).
  
  not_after_invalid(doc) ->
      [""];
  not_after_invalid(suite) ->
      [];
  not_after_invalid(Config) when is_list(Config) ->
      run([{ "4.2.5", "Invalid CA notAfter Date Test5", {bad_cert, cert_expired}},
  	 { "4.2.6", "Invalid EE notAfter Date Test6", {bad_cert, cert_expired}},
  	 { "4.2.7", "Invalid pre2000 UTC EE notAfter Date Test7",{bad_cert, cert_expired}}]).
  
  not_after_valid(doc) ->
      [""];
  not_after_valid(suite) ->
      [];
  not_after_valid(Config) when is_list(Config) ->
      run([{ "4.2.8", "Valid GeneralizedTime notAfter Date Test8", ok}]).
  %%-----------------------------------------------------------------------------
  invalid_name_chain(doc) ->
      [""];
  invalid_name_chain(suite) ->
      [];
  invalid_name_chain(Config) when is_list(Config) ->
      run([{ "4.3.1", "Invalid Name Chaining EE Test1", {bad_cert, invalid_issuer}},
  	 { "4.3.2", "Invalid Name Chaining Order Test2", {bad_cert, invalid_issuer}}]).
  
  whitespace_name_chain(doc) ->
      [""];
  whitespace_name_chain(suite) ->
      [];
  whitespace_name_chain(Config) when is_list(Config) ->
      run([{ "4.3.3", "Valid Name Chaining Whitespace Test3", ok},
  	 { "4.3.4", "Valid Name Chaining Whitespace Test4", ok}]).
  
  capitalization_name_chain(doc) ->
      [""];
  capitalization_name_chain(suite) ->
      [];
  capitalization_name_chain(Config) when is_list(Config) ->
      run([{ "4.3.5", "Valid Name Chaining Capitalization Test5",ok}]).
  
  uid_name_chain(doc) ->
      [""];
  uid_name_chain(suite) ->
      [];
  uid_name_chain(Config) when is_list(Config) ->
      run([{ "4.3.6", "Valid Name Chaining UIDs Test6",ok}]).
  
  attrib_name_chain(doc) ->
      [""];
  attrib_name_chain(suite) ->
      [];
  attrib_name_chain(Config) when is_list(Config) ->
      run([{ "4.3.7", "Valid RFC3280 Mandatory Attribute Types Test7", ok},
  	 { "4.3.8", "Valid RFC3280 Optional Attribute Types Test8",  ok}]).
  
  string_name_chain(doc) ->
      [""];
  string_name_chain(suite) ->
      [];
  string_name_chain(Config) when is_list(Config) ->
      run([{ "4.3.9", "Valid UTF8String Encoded Names Test9", ok},
  	 { "4.3.10", "Valid Rollover from PrintableString to UTF8String Test10", ok},
  	 { "4.3.11", "Valid UTF8String Case Insensitive Match Test11", ok}]).
  
  %%-----------------------------------------------------------------------------
  
  basic_valid(doc) ->
      [""];
  basic_valid(suite) ->
      [];
  basic_valid(Config) when is_list(Config) ->
      run([{ "4.5.1",  "Valid Basic Self-Issued Old With New Test1", ok},
  	 { "4.5.3",  "Valid Basic Self-Issued New With Old Test3", ok},
  	 { "4.5.4",  "Valid Basic Self-Issued New With Old Test4", ok}
  	]).
  
  basic_invalid(doc) ->
      [""];
  basic_invalid(suite) ->
      [];
  basic_invalid(Config) when is_list(Config) ->
      run([{"4.5.2",  "Invalid Basic Self-Issued Old With New Test2",
  	  {bad_cert, {revoked, keyCompromise}}},
  	 {"4.5.5",  "Invalid Basic Self-Issued New With Old Test5",
  	  {bad_cert, {revoked, keyCompromise}}}
  	]).
  
  crl_signing_valid(doc) ->
      [""];
  crl_signing_valid(suite) ->
      [];
  crl_signing_valid(Config) when is_list(Config) ->
      run([{ "4.5.6",  "Valid Basic Self-Issued CRL Signing Key Test6", ok}]).
  
  crl_signing_invalid(doc) ->
      [""];
  crl_signing_invalid(suite) ->
      [];
  crl_signing_invalid(Config) when is_list(Config) ->
      run([{ "4.5.7",  "Invalid Basic Self-Issued CRL Signing Key Test7",
  	   {bad_cert, {revoked, keyCompromise}}},
  	 { "4.5.8",  "Invalid Basic Self-Issued CRL Signing Key Test8",
  	   {bad_cert, invalid_key_usage}}
  	]).
  
  %%-----------------------------------------------------------------------------
  missing_CRL(doc) ->
      [""];
  missing_CRL(suite) ->
      [];
  missing_CRL(Config) when is_list(Config) ->
      run([{ "4.4.1", "Missing CRL Test1",{bad_cert,
      revocation_status_undetermined}}]).
  
  revoked_CA(doc) ->
      [""];
  revoked_CA(suite) ->
      [];
  revoked_CA(Config) when is_list(Config) ->
      run([{ "4.4.2", "Invalid Revoked CA Test2", {bad_cert,
      {revoked, keyCompromise}}}]).
  
  revoked_peer(doc) ->
      [""];
  revoked_peer(suite) ->
      [];
  revoked_peer(Config) when is_list(Config) ->
      run([{ "4.4.3", "Invalid Revoked EE Test3", {bad_cert,
      {revoked, keyCompromise}}}]).
  
  invalid_CRL_signature(doc) ->
      [""];
  invalid_CRL_signature(suite) ->
      [];
  invalid_CRL_signature(Config) when is_list(Config) ->
      run([{ "4.4.4", "Invalid Bad CRL Signature Test4",
  	   {bad_cert, revocation_status_undetermined}}]).
  
  invalid_CRL_issuer(doc) ->
      [""];
  invalid_CRL_issuer(suite) ->
      [];
  invalid_CRL_issuer(Config) when is_list(Config) ->
      run({ "4.4.5", "Invalid Bad CRL Issuer Name Test5",
  	  {bad_cert, revocation_status_undetermined}}).
  
  invalid_CRL(doc) ->
      [""];
  invalid_CRL(suite) ->
      [];
  invalid_CRL(Config) when is_list(Config) ->
      run([{ "4.4.6", "Invalid Wrong CRL Test6",
  	   {bad_cert, revocation_status_undetermined}}]).
  
  valid_CRL(doc) ->
      [""];
  valid_CRL(suite) ->
      [];
  valid_CRL(Config) when is_list(Config) ->
      run([{ "4.4.7", "Valid Two CRLs Test7", ok}]).
  
  unknown_CRL_extension(doc) ->
      [""];
  unknown_CRL_extension(suite) ->
      [];
  unknown_CRL_extension(Config) when is_list(Config) ->
      run([{ "4.4.8", "Invalid Unknown CRL Entry Extension Test8",
  	   {bad_cert, {revoked, keyCompromise}}},
  	 { "4.4.9", "Invalid Unknown CRL Extension Test9",
  	   {bad_cert, {revoked, keyCompromise}}},
  	 { "4.4.10", "Invalid Unknown CRL Extension Test10",
  	   {bad_cert, revocation_status_undetermined}}]).
  
  old_CRL(doc) ->
      [""];
  old_CRL(suite) ->
      [];
  old_CRL(Config) when is_list(Config) ->
      run([{ "4.4.11", "Invalid Old CRL nextUpdate Test11",
  	   {bad_cert, revocation_status_undetermined}},
  	 { "4.4.12", "Invalid pre2000 CRL nextUpdate Test12",
  	   {bad_cert, revocation_status_undetermined}}]).
  
  fresh_CRL(doc) ->
      [""];
  fresh_CRL(suite) ->
      [];
  fresh_CRL(Config) when is_list(Config) ->
      run([{ "4.4.13", "Valid GeneralizedTime CRL nextUpdate Test13", ok}]).
  
  valid_serial(doc) ->
      [""];
  valid_serial(suite) ->
      [];
  valid_serial(Config) when is_list(Config) ->
      run([
  	 { "4.4.14", "Valid Negative Serial Number Test14",ok},
  	 { "4.4.16", "Valid Long Serial Number Test16", ok},
  	 { "4.4.17", "Valid Long Serial Number Test17", ok}
  	]).
  
  invalid_serial(doc) ->
      [""];
  invalid_serial(suite) ->
      [];
  invalid_serial(Config) when is_list(Config) ->
      run([{ "4.4.15", "Invalid Negative Serial Number Test15",
  	   {bad_cert, {revoked, keyCompromise}}},
  	 { "4.4.18", "Invalid Long Serial Number Test18",
  	   {bad_cert, {revoked, keyCompromise}}}]).
  
  valid_seperate_keys(doc) ->
      [""];
  valid_seperate_keys(suite) ->
      [];
  valid_seperate_keys(Config) when is_list(Config) ->
      run([{ "4.4.19", "Valid Separate Certificate and CRL Keys Test19",   ok}]).
  
  invalid_separate_keys(doc) ->
      [""];
  invalid_separate_keys(suite) ->
      [];
  invalid_separate_keys(Config) when is_list(Config) ->
      run([{ "4.4.20", "Invalid Separate Certificate and CRL Keys Test20",
  	   {bad_cert, {revoked, keyCompromise}}},
  	 { "4.4.21", "Invalid Separate Certificate and CRL Keys Test21",
  	   {bad_cert, revocation_status_undetermined}}
  	]).
  %%-----------------------------------------------------------------------------
  missing_basic_constraints(doc) ->
      [""];
  missing_basic_constraints(suite) ->
      [];
  missing_basic_constraints(Config) when is_list(Config) ->
      run([{ "4.6.1",  "Invalid Missing basicConstraints Test1",
  	   {bad_cert, missing_basic_constraint}},
  	 { "4.6.2",  "Invalid cA False Test2",
  	   {bad_cert, missing_basic_constraint}},
  	 { "4.6.3",  "Invalid cA False Test3",
  	   {bad_cert, missing_basic_constraint}}]).
  
  valid_basic_constraint(doc) ->
      [""];
  valid_basic_constraint(suite) ->
      [];
  valid_basic_constraint(Config) when is_list(Config) ->
      run([{"4.6.4", "Valid basicConstraints Not Critical Test4", ok}]).
  
  invalid_path_constraints(doc) ->
      [""];
  invalid_path_constraints(suite) ->
      [];
  invalid_path_constraints(Config) when is_list(Config) ->
      run([{ "4.6.5", "Invalid pathLenConstraint Test5", {bad_cert, max_path_length_reached}},
  	 { "4.6.6", "Invalid pathLenConstraint Test6", {bad_cert, max_path_length_reached}},
  	 { "4.6.9", "Invalid pathLenConstraint Test9", {bad_cert, max_path_length_reached}},
  	 { "4.6.10", "Invalid pathLenConstraint Test10", {bad_cert, max_path_length_reached}},
  	 { "4.6.11", "Invalid pathLenConstraint Test11", {bad_cert, max_path_length_reached}},
  	 { "4.6.12", "Invalid pathLenConstraint Test12", {bad_cert, max_path_length_reached}},
  	 { "4.6.16", "Invalid Self-Issued pathLenConstraint Test16",
  	   {bad_cert, max_path_length_reached}}]).
  
  valid_path_constraints(doc) ->
      [""];
  valid_path_constraints(suite) ->
      [];
  valid_path_constraints(Config) when is_list(Config) ->
      run([{ "4.6.7",  "Valid pathLenConstraint Test7", ok},
  	 { "4.6.8",  "Valid pathLenConstraint Test8", ok},
  	 { "4.6.13", "Valid pathLenConstraint Test13", ok},
  	 { "4.6.14", "Valid pathLenConstraint Test14", ok},
  	 { "4.6.15", "Valid Self-Issued pathLenConstraint Test15", ok},
  	 { "4.6.17", "Valid Self-Issued pathLenConstraint Test17", ok}]).
  
  %%-----------------------------------------------------------------------------
  invalid_key_usage(doc) ->
      [""];
  invalid_key_usage(suite) ->
      [];
  invalid_key_usage(Config) when is_list(Config) ->
      run([{ "4.7.1",  "Invalid keyUsage Critical keyCertSign False Test1",
  	   {bad_cert,invalid_key_usage} },
  	 { "4.7.2",  "Invalid keyUsage Not Critical keyCertSign False Test2",
  	   {bad_cert,invalid_key_usage}},
  	{ "4.7.4",  "Invalid keyUsage Critical cRLSign False Test4",
  	  {bad_cert, revocation_status_undetermined}},
  	 { "4.7.5",  "Invalid keyUsage Not Critical cRLSign False Test5",
  	   {bad_cert, revocation_status_undetermined}}
  	]).
  
  valid_key_usage(doc) ->
      [""];
  valid_key_usage(suite) ->
      [];
  valid_key_usage(Config) when is_list(Config) ->
      run([{ "4.7.3",  "Valid keyUsage Not Critical Test3", ok}]).
  
  %%-----------------------------------------------------------------------------
  certificate_policies(doc) ->    [""];
  certificate_policies(suite) -> [];
  certificate_policies(Config) when is_list(Config) ->
      run(certificate_policies()).
  %%-----------------------------------------------------------------------------
  require_explicit_policy(doc) ->    [""];
  require_explicit_policy(suite) -> [];
  require_explicit_policy(Config) when is_list(Config) ->
      run(require_explicit_policy()).
  %%-----------------------------------------------------------------------------
  policy_mappings(doc) ->     [""];
  policy_mappings(suite) -> [];
  policy_mappings(Config) when is_list(Config) ->
      run(policy_mappings()).
  %%-----------------------------------------------------------------------------
  inhibit_policy_mapping(doc) ->    [""];
  inhibit_policy_mapping(suite) -> [];
  inhibit_policy_mapping(Config) when is_list(Config) ->
      run(inhibit_policy_mapping()).
  %%-----------------------------------------------------------------------------
  inhibit_any_policy(doc) ->    [""];
  inhibit_any_policy(suite) -> [];
  inhibit_any_policy(Config) when is_list(Config) ->
      run(inhibit_any_policy()).
  %%-----------------------------------------------------------------------------
  
  valid_DN_name_constraints(doc) ->
      [""];
  valid_DN_name_constraints(suite) ->
      [];
  valid_DN_name_constraints(Config) when is_list(Config) ->
      run([{ "4.13.1",  "Valid DN nameConstraints Test1", ok},
  	 { "4.13.4",  "Valid DN nameConstraints Test4", ok},
  	 { "4.13.5",  "Valid DN nameConstraints Test5", ok},
  	 { "4.13.6",  "Valid DN nameConstraints Test6", ok},
  	 { "4.13.11", "Valid DN nameConstraints Test11", ok},
  	 { "4.13.14", "Valid DN nameConstraints Test14", ok},
  	 { "4.13.18", "Valid DN nameConstraints Test18", ok},
  	 { "4.13.19", "Valid Self-Issued DN nameConstraints Test19", ok}]).
  
  invalid_DN_name_constraints(doc) ->
      [""];
  invalid_DN_name_constraints(suite) ->
      [];
  invalid_DN_name_constraints(Config) when is_list(Config) ->
      run([{ "4.13.2", "Invalid DN nameConstraints Test2", {bad_cert, name_not_permitted}},
  	 { "4.13.3",  "Invalid DN nameConstraints Test3", {bad_cert, name_not_permitted}},
  	 { "4.13.7",  "Invalid DN nameConstraints Test7", {bad_cert, name_not_permitted}},
  	 { "4.13.8",  "Invalid DN nameConstraints Test8", {bad_cert, name_not_permitted}},
  	 { "4.13.9",  "Invalid DN nameConstraints Test9", {bad_cert, name_not_permitted}},
  	 { "4.13.10", "Invalid DN nameConstraints Test10",{bad_cert, name_not_permitted}},
  	 { "4.13.12", "Invalid DN nameConstraints Test12",{bad_cert, name_not_permitted}},
  	 { "4.13.13", "Invalid DN nameConstraints Test13",{bad_cert, name_not_permitted}},
  	 { "4.13.15", "Invalid DN nameConstraints Test15",{bad_cert, name_not_permitted}},
  	 { "4.13.16", "Invalid DN nameConstraints Test16",{bad_cert, name_not_permitted}},
  	 { "4.13.17", "Invalid DN nameConstraints Test17",{bad_cert, name_not_permitted}},
  	 { "4.13.20", "Invalid Self-Issued DN nameConstraints Test20",
  	   {bad_cert, name_not_permitted}}]).
  
  valid_rfc822_name_constraints(doc) ->
      [""];
  valid_rfc822_name_constraints(suite) ->
      [];
  valid_rfc822_name_constraints(Config) when is_list(Config) ->
      run([{ "4.13.21", "Valid RFC822 nameConstraints Test21", ok},
  	 { "4.13.23", "Valid RFC822 nameConstraints Test23", ok},
  	 { "4.13.25", "Valid RFC822 nameConstraints Test25", ok}]).
  
  
  invalid_rfc822_name_constraints(doc) ->
      [""];
  invalid_rfc822_name_constraints(suite) ->
      [];
  invalid_rfc822_name_constraints(Config) when is_list(Config) ->
      run([{ "4.13.22", "Invalid RFC822 nameConstraints Test22",
  	   {bad_cert, name_not_permitted}},
  	 { "4.13.24", "Invalid RFC822 nameConstraints Test24",
  	   {bad_cert, name_not_permitted}},
  	 { "4.13.26", "Invalid RFC822 nameConstraints Test26",
  	   {bad_cert, name_not_permitted}}]).
  
  valid_DN_and_rfc822_name_constraints(doc) ->
      [""];
  valid_DN_and_rfc822_name_constraints(suite) ->
      [];
  valid_DN_and_rfc822_name_constraints(Config) when is_list(Config) ->
      run([{ "4.13.27", "Valid DN and RFC822 nameConstraints Test27", ok}]).
  
  invalid_DN_and_rfc822_name_constraints(doc) ->
      [""];
  invalid_DN_and_rfc822_name_constraints(suite) ->
      [];
  invalid_DN_and_rfc822_name_constraints(Config) when is_list(Config) ->
      run([{ "4.13.28", "Invalid DN and RFC822 nameConstraints Test28",
  	   {bad_cert, name_not_permitted}},
  	 { "4.13.29", "Invalid DN and RFC822 nameConstraints Test29",
  	   {bad_cert, name_not_permitted}}]).
  
  valid_dns_name_constraints(doc) ->
      [""];
  valid_dns_name_constraints(suite) ->
      [];
  valid_dns_name_constraints(Config) when is_list(Config) ->
      run([{ "4.13.30", "Valid DNS nameConstraints Test30", ok},
  	 { "4.13.32", "Valid DNS nameConstraints Test32", ok}]).
  
  invalid_dns_name_constraints(doc) ->
      [""];
  invalid_dns_name_constraints(suite) ->
      [];
  invalid_dns_name_constraints(Config) when is_list(Config) ->
      run([{ "4.13.31", "Invalid DNS nameConstraints Test31", {bad_cert, name_not_permitted}},
  	 { "4.13.33", "Invalid DNS nameConstraints Test33", {bad_cert, name_not_permitted}},
  	 { "4.13.38", "Invalid DNS nameConstraints Test38", {bad_cert, name_not_permitted}}]).
  
  valid_uri_name_constraints(doc) ->
      [""];
  valid_uri_name_constraints(suite) ->
      [];
  valid_uri_name_constraints(Config) when is_list(Config) ->
      run([{ "4.13.34", "Valid URI nameConstraints Test34", ok},
  	 { "4.13.36", "Valid URI nameConstraints Test36", ok}]).
  
  invalid_uri_name_constraints(doc) ->
      [""];
  invalid_uri_name_constraints(suite) ->
      [];
  invalid_uri_name_constraints(Config) when is_list(Config) ->
      run([{ "4.13.35", "Invalid URI nameConstraints Test35",{bad_cert, name_not_permitted}},
  	 { "4.13.37", "Invalid URI nameConstraints Test37",{bad_cert, name_not_permitted}}]).
  
  %%-----------------------------------------------------------------------------
  delta_without_crl(doc) ->
      [""];
  delta_without_crl(suite) ->
      [];
  delta_without_crl(Config) when is_list(Config) ->
    run([{ "4.15.1",  "Invalid deltaCRLIndicator No Base Test1",{bad_cert,
  							       revocation_status_undetermined}},
         {"4.15.10", "Invalid delta-CRL Test10", {bad_cert,
  						revocation_status_undetermined}}]).
  
  valid_delta_crls(doc) ->
      [""];
  valid_delta_crls(suite) ->
      [];
  valid_delta_crls(Config) when is_list(Config) ->
      run([{ "4.15.2",  "Valid delta-CRL Test2", ok},
  	 { "4.15.5",  "Valid delta-CRL Test5", ok},
  	 { "4.15.7",  "Valid delta-CRL Test7", ok},
  	 { "4.15.8",  "Valid delta-CRL Test8", ok}
  	]).
  
  invalid_delta_crls(doc) ->
      [""];
  invalid_delta_crls(suite) ->
      [];
  invalid_delta_crls(Config) when is_list(Config) ->
      run([{ "4.15.3",  "Invalid delta-CRL Test3", {bad_cert,{revoked, keyCompromise}}},
  	 { "4.15.4",  "Invalid delta-CRL Test4", {bad_cert,{revoked, keyCompromise}}},
  	 { "4.15.6",  "Invalid delta-CRL Test6", {bad_cert,{revoked, keyCompromise}}},
  	 { "4.15.9",  "Invalid delta-CRL Test9", {bad_cert,{revoked, keyCompromise}}}]).
  
  %%-----------------------------------------------------------------------------
  
  valid_distribution_points(doc) ->
      [""];
  valid_distribution_points(suite) ->
      [];
  valid_distribution_points(Config) when is_list(Config) ->
      run([{ "4.14.1",  "Valid distributionPoint Test1", ok},
  	 { "4.14.4",  "Valid distributionPoint Test4", ok},
  	 { "4.14.5",  "Valid distributionPoint Test5", ok},
  	 { "4.14.7",  "Valid distributionPoint Test7", ok}
  	]).
  
  valid_distribution_points_no_issuing_distribution_point(doc) ->
      [""];
  valid_distribution_points_no_issuing_distribution_point(suite) ->
      [];
  valid_distribution_points_no_issuing_distribution_point(Config) when is_list(Config) ->
      run([{ "4.14.10", "Valid No issuingDistributionPoint Test10", ok}
  	]).
  
  invalid_distribution_points(doc) ->
      [""];
  invalid_distribution_points(suite) ->
      [];
  invalid_distribution_points(Config) when is_list(Config) ->
      run([{ "4.14.2",  "Invalid distributionPoint Test2", {bad_cert,{revoked, keyCompromise}}},
  	 { "4.14.3",  "Invalid distributionPoint Test3", {bad_cert,
  							  revocation_status_undetermined}},
  	 { "4.14.6",  "Invalid distributionPoint Test6", {bad_cert,{revoked, keyCompromise}}},
  	 { "4.14.8",  "Invalid distributionPoint Test8", {bad_cert,
  							  revocation_status_undetermined}},
  	 { "4.14.9",  "Invalid distributionPoint Test9", {bad_cert,
  							  revocation_status_undetermined}}
  	]).
  
  valid_only_contains(doc) ->
      [""];
  valid_only_contains(suite) ->
      [];
  valid_only_contains(Config) when is_list(Config) ->
      run([{ "4.14.13", "Valid onlyContainsCACerts CRL Test13", ok}]).
  
  
  invalid_only_contains(doc) ->
      [""];
  invalid_only_contains(suite) ->
      [];
  invalid_only_contains(Config) when is_list(Config) ->
      run([{ "4.14.11", "Invalid onlyContainsUserCerts CRL Test11",
  	   {bad_cert, revocation_status_undetermined}},
  	 { "4.14.12", "Invalid onlyContainsCACerts CRL Test12",
  	   {bad_cert, revocation_status_undetermined}},
  	 { "4.14.14", "Invalid onlyContainsAttributeCerts Test14",
  	   {bad_cert, revocation_status_undetermined}}
  	]).
  
  valid_only_some_reasons(doc) ->
      [""];
  valid_only_some_reasons(suite) ->
      [];
  valid_only_some_reasons(Config) when is_list(Config) ->
      run([{ "4.14.18", "Valid onlySomeReasons Test18", ok},
  	 { "4.14.19", "Valid onlySomeReasons Test19", ok}
  	]).
  
  invalid_only_some_reasons(doc) ->
      [""];
  invalid_only_some_reasons(suite) ->
      [];
  invalid_only_some_reasons(Config) when is_list(Config) ->
      run([{ "4.14.15", "Invalid onlySomeReasons Test15",
  	   {bad_cert,{revoked, keyCompromise}}},
  	 { "4.14.16", "Invalid onlySomeReasons Test16",
  	   {bad_cert,{revoked, certificateHold}}},
  	 { "4.14.17", "Invalid onlySomeReasons Test17",
  	   {bad_cert, revocation_status_undetermined}},
  	 { "4.14.20", "Invalid onlySomeReasons Test20",
  	   {bad_cert,{revoked, keyCompromise}}},
  	 { "4.14.21", "Invalid onlySomeReasons Test21",
  	   {bad_cert,{revoked, affiliationChanged}}}
  	]).
  
  valid_indirect_crl(doc) ->
      [""];
  valid_indirect_crl(suite) ->
      [];
  valid_indirect_crl(Config) when is_list(Config) ->
      run([{ "4.14.22", "Valid IDP with indirectCRL Test22", ok},
  	 { "4.14.24", "Valid IDP with indirectCRL Test24", ok},
  	 { "4.14.25", "Valid IDP with indirectCRL Test25", ok}
  	]).
  
  invalid_indirect_crl(doc) ->
      [""];
  invalid_indirect_crl(suite) ->
      [];
  invalid_indirect_crl(Config) when is_list(Config) ->
      run([{ "4.14.23", "Invalid IDP with indirectCRL Test23",
  	   {bad_cert,{revoked, keyCompromise}}},
  	 { "4.14.26", "Invalid IDP with indirectCRL Test26",
  	   {bad_cert, revocation_status_undetermined}}
  	]).
  
  valid_crl_issuer(doc) ->
      [""];
  valid_crl_issuer(suite) ->
      [];
  valid_crl_issuer(Config) when is_list(Config) ->
      run([{ "4.14.28", "Valid cRLIssuer Test28", ok}%%,
  	 %%{ "4.14.29", "Valid cRLIssuer Test29", ok},
  	 %%{ "4.14.33", "Valid cRLIssuer Test33", ok}
  	]).
  
  invalid_crl_issuer(doc) ->
      [""];
  invalid_crl_issuer(suite) ->
      [];
  invalid_crl_issuer(Config) when is_list(Config) ->
      run([
  	 { "4.14.27", "Invalid cRLIssuer Test27", {bad_cert, revocation_status_undetermined}},
  	 { "4.14.31", "Invalid cRLIssuer Test31", {bad_cert,{revoked, keyCompromise}}},
  	 { "4.14.32", "Invalid cRLIssuer Test32", {bad_cert,{revoked, keyCompromise}}},
  	 { "4.14.34", "Invalid cRLIssuer Test34", {bad_cert,{revoked, keyCompromise}}},
  	 { "4.14.35", "Invalid cRLIssuer Test35", {bad_cert, revocation_status_undetermined}}
  	]).
  
  
  %%distribution_points() ->
      %%{ "4.14",    "Distribution Points" },
  %%    [
  	 %% Although this test is valid it has a circular dependency. As a result
  	 %% an attempt is made to reursively checks a CRL path and rejected due to
  	 %% a CRL path validation error. PKITS notes suggest this test does not
  	 %% need to be run due to this issue.
  %%	 { "4.14.30", "Valid cRLIssuer Test30", 54 }].
  
  
  %%-----------------------------------------------------------------------------
  
  unknown_critical_extension(doc) ->
      [""];
  unknown_critical_extension(suite) ->
      [];
  unknown_critical_extension(Config) when is_list(Config) ->
      run([{ "4.16.2",  "Invalid Unknown Critical Certificate Extension Test2",
  	   {bad_cert,unknown_critical_extension}}]).
  
  unknown_not_critical_extension(doc) ->
      [""];
  unknown_not_critical_extension(suite) ->
      [];
  unknown_not_critical_extension(Config) when is_list(Config) ->
      run([{ "4.16.1",  "Valid Unknown Not Critical Certificate Extension Test1", ok}]).
  
  %%-----------------------------------------------------------------------------
  run(Tests) ->    
      File = file(?CERTS,"TrustAnchorRootCertificate.crt"),
      {ok, TA} = file:read_file(File),
      run(Tests, TA).
  
  run({Chap, Test, Result}, TA) ->
      CertChain = sort_chain(read_certs(Test),TA, [], false, Chap),
      Options = path_validation_options(TA, Chap,Test),
      try public_key:pkix_path_validation(TA, CertChain, Options) of
  	{Result, _} -> ok;
  	{error,Result} when Result =/= ok ->
  	    ok;
  	{error, Error}  ->
  	    ?error(" ~p ~p~n  Expected ~p got ~p ~n", [Chap, Test, Result, Error]),
  	    fail;
  	{ok, _OK} when Result =/= ok ->
  	    ?error(" ~p ~p~n  Expected ~p got ~p ~n", [Chap, Test, Result, ok]),
  	    fail
      catch Type:Reason ->
  