         XCTAssertNotNil(listener.tlsIdentity)
         XCTAssertEqual(listener.tlsIdentity!.certs.count, 1)
         
+        // Replicator:
+        let auth = ClientCertificateAuthenticator(identity: try tlsIdentity(false)!)
+        let serverCert = listener.tlsIdentity!.certs[0]
+        self.run(target: listener.localURLEndpoint, type: .pushAndPull, continuous: false, auth: auth, serverCert: serverCert, expectedError: CBLErrorTLSClientCertRejected)
+        
+        // Cleanup:
+        try cleanupTLSIdentity(false)
+        try stopListen()
+    }
+    
+    func testClientCertAuthWithRootCerts() throws {
+        if !self.keyChainAccessAllowed { return }
+        
+        // Root Cert:
+        let rootCertData = try dataFromResource(name: "identity/client-ca", ofType: "der")
+        let rootCert = SecCertificateCreateWithData(kCFAllocatorDefault, rootCertData as CFData)!
+        
+        // Listener:
+        let listenerAuth = ListenerCertificateAuthenticator.init(rootCerts: [rootCert])
+        let listener = try listen(tls: true, auth: listenerAuth)
+        
         // Cleanup:
         try TLSIdentity.deleteIdentity(withLabel: clientCertLabel)
         
         // Create client identity:
-        let attrs = [certAttrCommonName: "daniel"]
-        let identity = try TLSIdentity.createIdentity(forServer: false, attributes: attrs, expiration: nil, label: clientCertLabel)
+        let clientCertData = try dataFromResource(name: "identity/client", ofType: "p12")
+        let identity = try TLSIdentity.importIdentity(withData: clientCertData, password: "123", label: clientCertLabel)
         
         // Replicator:
         let auth = ClientCertificateAuthenticator.init(identity: identity)
         let serverCert = listener.tlsIdentity!.certs[0]
-        self.run(target: listener.localURLEndpoint, type: .pushAndPull, continuous: false, auth: auth, serverCert: serverCert, expectedError: CBLErrorTLSClientCertRejected)
+        
+        self.ignoreException {
+            self.run(target: listener.localURLEndpoint, type: .pushAndPull, continuous: false, auth: auth, serverCert: serverCert)
+        }
         
         // Cleanup:
         try TLSIdentity.deleteIdentity(withLabel: clientCertLabel)
         try stopListen()
     }
     
-    func testClientCertAuthWithRootCerts() throws {
+    func testClientCertAuthWithRootCertsError() throws {
         if !self.keyChainAccessAllowed { return }
         
         // Root Cert:

        XCTAssertNil(listener.tlsIdentity)
        
        // User Identity:
        try TLSIdentity.deleteIdentity(withLabel: serverCertLabel);
        let attrs = [certAttrCommonName: "CBL-Server"]
        let identity = try TLSIdentity.createIdentity(forServer: true,
                                                      attributes: attrs,
                                                      expiration: nil,
                                                      label: serverCertLabel)
        config = URLEndpointListenerConfiguration.init(database: self.oDB)
        config.tlsIdentity = identity
        listener = URLEndpointListener.init(config: config)

        let listenerAuth = ListenerCertificateAuthenticator.init(rootCerts: [rootCert])
        let listener = try listen(tls: true, auth: listenerAuth)
        
        // Replicator:
        let auth = ClientCertificateAuthenticator.init(identity: try tlsIdentity(false)!)
        let serverCert = listener.tlsIdentity!.certs[0]
        
        self.ignoreException {
            self.run(target: listener.localURLEndpoint, type: .pushAndPull, continuous: false,
                     auth: auth, serverCert: serverCert, expectedError: CBLErrorTLSClientCertRejected)
        }
        
        // Cleanup:
        try cleanupTLSIdentity(false)
        try stopListen()
    }
    
