anchor.diff:    (cffi:with-pointer-to-vector-data (buf* bytes)
       (cffi:with-foreign-object (buf** :pointer)
         (setf (cffi:mem-ref buf** :pointer) buf*)
  -      (d2i-x509 (cffi:null-pointer) buf** (length bytes)))))
  +      (let ((cert (d2i-x509 (cffi:null-pointer) buf** (length bytes))))
  +        (when (cffi:null-pointer-p cert)
  +          (error 'ssl-error-call :message "d2i-X509 failed" :queue (read-ssl-error-queue)))
  +        cert))))
   
   (defun cert-format-from-path (path)
     ;; or match "pem" type too and raise unknown format error?
  
positive.code: (defun certificate-subject-common-names (cert)
    (let ((i -1)
          (subject-name (x509-get-subject-name cert)))
      (flet ((extract-cn ()
               (setf i (x509-name-get-index-by-nid subject-name +NID-commonName+ i))
               (when (>= i 0)
                 (let* ((entry (x509-name-get-entry subject-name i)))
                   (try-get-asn1-string-data (x509-name-entry-get-data entry) '(#.+v-asn1-utf8string+
                                                                                #.+v-asn1-bmpstring+
                                                                                #.+v-asn1-printablestring+
                                                                                #.+v-asn1-universalstring+
                                                                                #.+v-asn1-teletexstring+))))))
        (loop
          as cn = (extract-cn)
          if cn collect cn
  
negative.code:     (decode-certificate format bytes)))
  
  (defun certificate-alt-names (cert)
    #|
    * The return value is the decoded extension or NULL on
    * error. The actual error can have several different causes,
    * the value of *crit reflects the cause:
    * >= 0, extension found but not decoded (reflects critical value).
    * -1 extension not found.
    * -2 extension occurs more than once.
    |#
    (cffi:with-foreign-object (crit* :int)
      (let ((result (x509-get-ext-d2i cert +NID-subject-alt-name+ crit* (cffi:null-pointer))))
        (if (cffi:null-pointer-p result)
            (let ((crit (cffi:mem-ref crit* :int)))
              (cond
                ((>= crit 0)
                 (error "X509_get_ext_d2i: subject-alt-name extension decoding error"))
                ((= crit -1) ;; extension not found, return NULL
                 result)
                ((= crit -2)
                 (error "X509_get_ext_d2i: subject-alt-name extension occurs more than once"))))
            result))))
  
  (defun certificate-dns-alt-names (cert)
    (let ((altnames (certificate-alt-names cert)))
  