Created common test groups and temporary skipped pkits_SUITE as the

conformance tests suite certificates has expired.

New conformance tests uses another format to save certificates so
we need to implement PKCS-12 support.

CRL tests are commented out as the CRL support is not included
in the main development yet.

1 files changed, 1104 insertions, 368 deletions

diff --git a/lib/public_key/test/pkits_SUITE.erl b/lib/public_key/test/pkits_SUITE.erl
index 660af4e8ab..a325a975e9 100644
--- a/lib/public_key/test/pkits_SUITE.erl
+++ b/lib/public_key/test/pkits_SUITE.erl
@@ -26,7 +26,6 @@
 -compile(export_all).
 
 -include_lib("public_key/include/public_key.hrl").
-%%-include("public_key.hrl").
 
 -define(error(Format,Args), error(Format,Args,?FILE,?LINE)).
 -define(warning(Format,Args), warning(Format,Args,?FILE,?LINE)).
@@ -42,18 +41,65 @@
 -define(NIST5, "2.16.840.1.101.3.2.1.48.5").
 -define(NIST6, "2.16.840.1.101.3.2.1.48.6").
 
+-record(verify_state, {
+	  certs_db,
+	  crl_info,
+	  revoke_state}).
 %%
-suite() -> [{ct_hooks,[ts_install_cth]}].
+suite() ->
+    [{ct_hooks,[ts_install_cth]}].
 
 all() -> 
-    [signature_verification, validity_periods,
-     verifying_name_chaining,
-     verifying_paths_with_self_issued_certificates,
-     verifying_basic_constraints, key_usage,
-     name_constraints, private_certificate_extensions].
+    [{group, signature_verification},
+     {group, validity_periods},
+     {group, verifying_name_chaining},
+     {group, verifying_paths_with_self_issued_certificates},
+     %%{group, basic_certificate_revocation_tests},
+     %%{group, delta_crls},
+     %%{group, distribution_points},
+     {group, verifying_basic_constraints},
+     {group, key_usage},
+     {group, name_constraints},
+     {group, private_certificate_extensions}].
 
 groups() -> 
-    [].
+    [{signature_verification, [], [valid_rsa_signature,
+				   invalid_rsa_signature, valid_dsa_signature,
+				   invalid_dsa_signature]},
+     {validity_periods, [],
+      [not_before_invalid, not_before_valid, not_after_invalid, not_after_valid]},
+     {verifying_name_chaining, [],
+      [invalid_name_chain, whitespace_name_chain, capitalization_name_chain,
+       uid_name_chain, attrib_name_chain, string_name_chain]},
+     {verifying_paths_with_self_issued_certificates, [],
+      [basic_valid, basic_invalid, crl_signing_valid, crl_signing_invalid]},
+     %% {basic_certificate_revocation_tests, [],
+     %%  [missing_CRL, revoked_CA, revoked_peer, invalid_CRL_signature,
+     %%   invalid_CRL_issuer, invalid_CRL, valid_CRL,
+     %%   unknown_CRL_extension, old_CRL, fresh_CRL, valid_serial,
+     %%   invalid_serial, valid_seperate_keys, invalid_separate_keys]},
+     %% {delta_crls, [], [delta_without_crl, valid_delta_crls, invalid_delta_crls]},
+     %% {distribution_points, [], [valid_distribution_points,
+     %% 				valid_distribution_points_no_issuing_distribution_point,
+     %% 				invalid_distribution_points, valid_only_contains,
+     %% 				invalid_only_contains, valid_only_some_reasons,
+     %% 				invalid_only_some_reasons, valid_indirect_crl,
+     %% 				invalid_indirect_crl, valid_crl_issuer, invalid_crl_issuer]},
+     {verifying_basic_constraints,[],
+      [missing_basic_constraints, valid_basic_constraint, invalid_path_constraints,
+       valid_path_constraints]},
+     {key_usage, [],
+      [invalid_key_usage, valid_key_usage]},
+     {name_constraints, [],
+      [valid_DN_name_constraints, invalid_DN_name_constraints,
+       valid_rfc822_name_constraints,
+       invalid_rfc822_name_constraints, valid_DN_and_rfc822_name_constraints,
+       invalid_DN_and_rfc822_name_constraints, valid_dns_name_constraints,
+       invalid_dns_name_constraints, valid_uri_name_constraints,
+       invalid_uri_name_constraints]},
+     {private_certificate_extensions, [],
+      [unknown_critical_extension, unknown_not_critical_extension]}
+    ].
 
 init_per_group(_GroupName, Config) ->
     Config.
@@ -61,112 +107,706 @@ init_per_group(_GroupName, Config) ->
 end_per_group(_GroupName, Config) ->
     Config.
 
+init_per_testcase(_Func, Config) ->
+    Datadir = proplists:get_value(data_dir, Config),
+    put(datadir, Datadir),
+    Config.
+
+end_per_testcase(_Func, Config) ->
+    Config.
+
+init_per_suite(Config) ->
+    {skip, "PKIX Conformance test certificates expired 14 of April 2011,"
+     " new conformance test suite uses new format so skip until PKCS-12 support is implemented"}.
+    %% try crypto:start() of
+    %% 	ok ->
+    %% 	    Config
+    %% catch _:_ ->
+    %% 	    {skip, "Crypto did not start"}
+    %% end.
+
+end_per_suite(_Config) ->
+    application:stop(crypto).
+
+%%-----------------------------------------------------------------------------
+valid_rsa_signature(doc) ->
+    ["Test rsa signatur verification"];
+valid_rsa_signature(suite) ->
+    [];
+valid_rsa_signature(Config) when is_list(Config) ->
+    run([{ "4.1.1", "Valid Signatures Test1", ok}]).
+
+invalid_rsa_signature(doc) ->
+    ["Test rsa signatur verification"];
+invalid_rsa_signature(suite) ->
+    [];
+invalid_rsa_signature(Config) when is_list(Config) ->
+    run([{ "4.1.2", "Invalid CA Signature Test2", {bad_cert,invalid_signature}},
+	 { "4.1.3", "Invalid EE Signature Test3", {bad_cert,invalid_signature}}]).
+
+valid_dsa_signature(doc) ->
+    ["Test dsa signatur verification"];
+valid_dsa_signature(suite) ->
+    [];
+valid_dsa_signature(Config) when is_list(Config) ->
+    run([{ "4.1.4", "Valid DSA Signatures Test4", ok},
+	 { "4.1.5", "Valid DSA Parameter Inheritance Test5", ok}]).
+
+invalid_dsa_signature(doc) ->
+    ["Test dsa signatur verification"];
+invalid_dsa_signature(suite) ->
+    [];
+invalid_dsa_signature(Config) when is_list(Config) ->
+    run([{ "4.1.6", "Invalid DSA Signature Test6",{bad_cert,invalid_signature}}]).
+%%-----------------------------------------------------------------------------
+not_before_invalid(doc) ->
+    [""];
+not_before_invalid(suite) ->
+    [];
+not_before_invalid(Config) when is_list(Config) ->
+    run([{ "4.2.1", "Invalid CA notBefore Date Test1",{bad_cert, cert_expired}},
+	 { "4.2.2", "Invalid EE notBefore Date Test2",{bad_cert, cert_expired}}]).
+
+not_before_valid(doc) ->
+    [""];
+not_before_valid(suite) ->
+    [];
+not_before_valid(Config) when is_list(Config) ->
+    run([{ "4.2.3", "Valid pre2000 UTC notBefore Date Test3", ok},
+	 { "4.2.4", "Valid GeneralizedTime notBefore Date Test4", ok}]).
+
+not_after_invalid(doc) ->
+    [""];
+not_after_invalid(suite) ->
+    [];
+not_after_invalid(Config) when is_list(Config) ->
+    run([{ "4.2.5", "Invalid CA notAfter Date Test5", {bad_cert, cert_expired}},
+	 { "4.2.6", "Invalid EE notAfter Date Test6", {bad_cert, cert_expired}},
+	 { "4.2.7", "Invalid pre2000 UTC EE notAfter Date Test7",{bad_cert, cert_expired}}]).
+
+not_after_valid(doc) ->
+    [""];
+not_after_valid(suite) ->
+    [];
+not_after_valid(Config) when is_list(Config) ->
+    run([{ "4.2.8", "Valid GeneralizedTime notAfter Date Test8", ok}]).
+%%-----------------------------------------------------------------------------
+invalid_name_chain(doc) ->
+    [""];
+invalid_name_chain(suite) ->
+    [];
+invalid_name_chain(Config) when is_list(Config) ->
+    run([{ "4.3.1", "Invalid Name Chaining EE Test1", {bad_cert, invalid_issuer}},
+	 { "4.3.2", "Invalid Name Chaining Order Test2", {bad_cert, invalid_issuer}}]).
+
+whitespace_name_chain(doc) ->
+    [""];
+whitespace_name_chain(suite) ->
+    [];
+whitespace_name_chain(Config) when is_list(Config) ->
+    run([{ "4.3.3", "Valid Name Chaining Whitespace Test3", ok},
+	 { "4.3.4", "Valid Name Chaining Whitespace Test4", ok}]).
+
+capitalization_name_chain(doc) ->
+    [""];
+capitalization_name_chain(suite) ->
+    [];
+capitalization_name_chain(Config) when is_list(Config) ->
+    run([{ "4.3.5", "Valid Name Chaining Capitalization Test5",ok}]).
+
+uid_name_chain(doc) ->
+    [""];
+uid_name_chain(suite) ->
+    [];
+uid_name_chain(Config) when is_list(Config) ->
+    run([{ "4.3.6", "Valid Name Chaining UIDs Test6",ok}]).
+
+attrib_name_chain(doc) ->
+    [""];
+attrib_name_chain(suite) ->
+    [];
+attrib_name_chain(Config) when is_list(Config) ->
+    run([{ "4.3.7", "Valid RFC3280 Mandatory Attribute Types Test7", ok},
+	 { "4.3.8", "Valid RFC3280 Optional Attribute Types Test8",  ok}]).
+
+string_name_chain(doc) ->
+    [""];
+string_name_chain(suite) ->
+    [];
+string_name_chain(Config) when is_list(Config) ->
+    run([{ "4.3.9", "Valid UTF8String Encoded Names Test9", ok},
+	 { "4.3.10", "Valid Rollover from PrintableString to UTF8String Test10", ok},
+	 { "4.3.11", "Valid UTF8String Case Insensitive Match Test11", ok}]).
+
+%%-----------------------------------------------------------------------------
+
+basic_valid(doc) ->
+    [""];
+basic_valid(suite) ->
+    [];
+basic_valid(Config) when is_list(Config) ->
+    run([{ "4.5.1",  "Valid Basic Self-Issued Old With New Test1", ok},
+	 { "4.5.3",  "Valid Basic Self-Issued New With Old Test3", ok},
+	 { "4.5.4",  "Valid Basic Self-Issued New With Old Test4", ok}
+	]).
+
+basic_invalid(doc) ->
+    [""];
+basic_invalid(suite) ->
+    [];
+basic_invalid(Config) when is_list(Config) ->
+    run([{"4.5.2",  "Invalid Basic Self-Issued Old With New Test2",
+	  {bad_cert, {revoked, keyCompromise}}},
+	 {"4.5.5",  "Invalid Basic Self-Issued New With Old Test5",
+	  {bad_cert, {revoked, keyCompromise}}}
+	]).
+
+crl_signing_valid(doc) ->
+    [""];
+crl_signing_valid(suite) ->
+    [];
+crl_signing_valid(Config) when is_list(Config) ->
+    run([{ "4.5.6",  "Valid Basic Self-Issued CRL Signing Key Test6", ok}]).
+
+crl_signing_invalid(doc) ->
+    [""];
+crl_signing_invalid(suite) ->
+    [];
+crl_signing_invalid(Config) when is_list(Config) ->
+    run([{ "4.5.7",  "Invalid Basic Self-Issued CRL Signing Key Test7",
+	   {bad_cert, {revoked, keyCompromise}}},
+	 { "4.5.8",  "Invalid Basic Self-Issued CRL Signing Key Test8",
+	   {bad_cert, invalid_key_usage}}
+	]).
+
+%%-----------------------------------------------------------------------------
+missing_CRL(doc) ->
+    [""];
+missing_CRL(suite) ->
+    [];
+missing_CRL(Config) when is_list(Config) ->
+    run([{ "4.4.1", "Missing CRL Test1",{bad_cert,
+    revocation_status_undetermined}}]).
+
+revoked_CA(doc) ->
+    [""];
+revoked_CA(suite) ->
+    [];
+revoked_CA(Config) when is_list(Config) ->
+    run([{ "4.4.2", "Invalid Revoked CA Test2", {bad_cert,
+    {revoked, keyCompromise}}}]).
+
+revoked_peer(doc) ->
+    [""];
+revoked_peer(suite) ->
+    [];
+revoked_peer(Config) when is_list(Config) ->
+    run([{ "4.4.3", "Invalid Revoked EE Test3", {bad_cert,
+    {revoked, keyCompromise}}}]).
+
+invalid_CRL_signature(doc) ->
+    [""];
+invalid_CRL_signature(suite) ->
+    [];
+invalid_CRL_signature(Config) when is_list(Config) ->
+    run([{ "4.4.4", "Invalid Bad CRL Signature Test4",
+	   {bad_cert, revocation_status_undetermined}}]).
+
+invalid_CRL_issuer(doc) ->
+    [""];
+invalid_CRL_issuer(suite) ->
+    [];
+invalid_CRL_issuer(Config) when is_list(Config) ->
+    run({ "4.4.5", "Invalid Bad CRL Issuer Name Test5",
+	  {bad_cert, revocation_status_undetermined}}).
+
+invalid_CRL(doc) ->
+    [""];
+invalid_CRL(suite) ->
+    [];
+invalid_CRL(Config) when is_list(Config) ->
+    run([{ "4.4.6", "Invalid Wrong CRL Test6",
+	   {bad_cert, revocation_status_undetermined}}]).
+
+valid_CRL(doc) ->
+    [""];
+valid_CRL(suite) ->
+    [];
+valid_CRL(Config) when is_list(Config) ->
+    run([{ "4.4.7", "Valid Two CRLs Test7", ok}]).
+
+unknown_CRL_extension(doc) ->
+    [""];
+unknown_CRL_extension(suite) ->
+    [];
+unknown_CRL_extension(Config) when is_list(Config) ->
+    run([{ "4.4.8", "Invalid Unknown CRL Entry Extension Test8",
+	   {bad_cert, {revoked, keyCompromise}}},
+	 { "4.4.9", "Invalid Unknown CRL Extension Test9",
+	   {bad_cert, {revoked, keyCompromise}}},
+	 { "4.4.10", "Invalid Unknown CRL Extension Test10",
+	   {bad_cert, revocation_status_undetermined}}]).
+
+old_CRL(doc) ->
+    [""];
+old_CRL(suite) ->
+    [];
+old_CRL(Config) when is_list(Config) ->
+    run([{ "4.4.11", "Invalid Old CRL nextUpdate Test11",
+	   {bad_cert, revocation_status_undetermined}},
+	 { "4.4.12", "Invalid pre2000 CRL nextUpdate Test12",
+	   {bad_cert, revocation_status_undetermined}}]).
+
+fresh_CRL(doc) ->
+    [""];
+fresh_CRL(suite) ->
+    [];
+fresh_CRL(Config) when is_list(Config) ->
+    run([{ "4.4.13", "Valid GeneralizedTime CRL nextUpdate Test13", ok}]).
+
+valid_serial(doc) ->
+    [""];
+valid_serial(suite) ->
+    [];
+valid_serial(Config) when is_list(Config) ->
+    run([
+	 { "4.4.14", "Valid Negative Serial Number Test14",ok},
+	 { "4.4.16", "Valid Long Serial Number Test16", ok},
+	 { "4.4.17", "Valid Long Serial Number Test17", ok}
+	]).
+
+invalid_serial(doc) ->
+    [""];
+invalid_serial(suite) ->
+    [];
+invalid_serial(Config) when is_list(Config) ->
+    run([{ "4.4.15", "Invalid Negative Serial Number Test15",
+	   {bad_cert, {revoked, keyCompromise}}},
+	 { "4.4.18", "Invalid Long Serial Number Test18",
+	   {bad_cert, {revoked, keyCompromise}}}]).
+
+valid_seperate_keys(doc) ->
+    [""];
+valid_seperate_keys(suite) ->
+    [];
+valid_seperate_keys(Config) when is_list(Config) ->
+    run([{ "4.4.19", "Valid Separate Certificate and CRL Keys Test19",   ok}]).
+
+invalid_separate_keys(doc) ->
+    [""];
+invalid_separate_keys(suite) ->
+    [];
+invalid_separate_keys(Config) when is_list(Config) ->
+    run([{ "4.4.20", "Invalid Separate Certificate and CRL Keys Test20",
+	   {bad_cert, {revoked, keyCompromise}}},
+	 { "4.4.21", "Invalid Separate Certificate and CRL Keys Test21",
+	   {bad_cert, revocation_status_undetermined}}
+	]).
+%%-----------------------------------------------------------------------------
+missing_basic_constraints(doc) ->
+    [""];
+missing_basic_constraints(suite) ->
+    [];
+missing_basic_constraints(Config) when is_list(Config) ->
+    run([{ "4.6.1",  "Invalid Missing basicConstraints Test1",
+	   {bad_cert, missing_basic_constraint}},
+	 { "4.6.2",  "Invalid cA False Test2",
+	   {bad_cert, missing_basic_constraint}},
+	 { "4.6.3",  "Invalid cA False Test3",
+	   {bad_cert, missing_basic_constraint}}]).
+
+valid_basic_constraint(doc) ->
+    [""];
+valid_basic_constraint(suite) ->
+    [];
+valid_basic_constraint(Config) when is_list(Config) ->
+    run([{"4.6.4", "Valid basicConstraints Not Critical Test4", ok}]).
+
+invalid_path_constraints(doc) ->
+    [""];
+invalid_path_constraints(suite) ->
+    [];
+invalid_path_constraints(Config) when is_list(Config) ->
+    run([{ "4.6.5", "Invalid pathLenConstraint Test5", {bad_cert, max_path_length_reached}},
+	 { "4.6.6", "Invalid pathLenConstraint Test6", {bad_cert, max_path_length_reached}},
+	 { "4.6.9", "Invalid pathLenConstraint Test9", {bad_cert, max_path_length_reached}},
+	 { "4.6.10", "Invalid pathLenConstraint Test10", {bad_cert, max_path_length_reached}},
+	 { "4.6.11", "Invalid pathLenConstraint Test11", {bad_cert, max_path_length_reached}},
+	 { "4.6.12", "Invalid pathLenConstraint Test12", {bad_cert, max_path_length_reached}},
+	 { "4.6.16", "Invalid Self-Issued pathLenConstraint Test16",
+	   {bad_cert, max_path_length_reached}}]).
 
-signature_verification(doc) ->    [""];
-signature_verification(suite) -> [];
-signature_verification(Config) when is_list(Config) ->
-    run(signature_verification()).
-validity_periods(doc) ->    [""];
-validity_periods(suite) -> [];
-validity_periods(Config) when is_list(Config) ->
-    run(validity_periods()).
-verifying_name_chaining(doc) ->    [""];
-verifying_name_chaining(suite) -> [];
-verifying_name_chaining(Config) when is_list(Config) ->
-    run(verifying_name_chaining()).
-basic_certificate_revocation_tests(doc) ->    [""];
-basic_certificate_revocation_tests(suite) -> [];
-basic_certificate_revocation_tests(Config) when is_list(Config) ->
-    run(basic_certificate_revocation_tests()).
-verifying_paths_with_self_issued_certificates(doc) ->    [""];
-verifying_paths_with_self_issued_certificates(suite) -> [];
-verifying_paths_with_self_issued_certificates(Config) when is_list(Config) ->
-    run(verifying_paths_with_self_issued_certificates()).
-verifying_basic_constraints(doc) ->    [""];
-verifying_basic_constraints(suite) -> [];
-verifying_basic_constraints(Config) when is_list(Config) ->
-    run(verifying_basic_constraints()).
-key_usage(doc) ->    [""];
-key_usage(suite) -> [];
-key_usage(Config) when is_list(Config) ->
-    run(key_usage()).
+valid_path_constraints(doc) ->
+    [""];
+valid_path_constraints(suite) ->
+    [];
+valid_path_constraints(Config) when is_list(Config) ->
+    run([{ "4.6.7",  "Valid pathLenConstraint Test7", ok},
+	 { "4.6.8",  "Valid pathLenConstraint Test8", ok},
+	 { "4.6.13", "Valid pathLenConstraint Test13", ok},
+	 { "4.6.14", "Valid pathLenConstraint Test14", ok},
+	 { "4.6.15", "Valid Self-Issued pathLenConstraint Test15", ok},
+	 { "4.6.17", "Valid Self-Issued pathLenConstraint Test17", ok}]).
+
+%%-----------------------------------------------------------------------------
+invalid_key_usage(doc) ->
+    [""];
+invalid_key_usage(suite) ->
+    [];
+invalid_key_usage(Config) when is_list(Config) ->
+    run([{ "4.7.1",  "Invalid keyUsage Critical keyCertSign False Test1",
+	   {bad_cert,invalid_key_usage} },
+	 { "4.7.2",  "Invalid keyUsage Not Critical keyCertSign False Test2",
+	   {bad_cert,invalid_key_usage}},
+	{ "4.7.4",  "Invalid keyUsage Critical cRLSign False Test4",
+	  {bad_cert, revocation_status_undetermined}},
+	 { "4.7.5",  "Invalid keyUsage Not Critical cRLSign False Test5",
+	   {bad_cert, revocation_status_undetermined}}
+	]).
+
+valid_key_usage(doc) ->
+    [""];
+valid_key_usage(suite) ->
+    [];
+valid_key_usage(Config) when is_list(Config) ->
+    run([{ "4.7.3",  "Valid keyUsage Not Critical Test3", ok}]).
+
+%%-----------------------------------------------------------------------------
 certificate_policies(doc) ->    [""];
 certificate_policies(suite) -> [];
 certificate_policies(Config) when is_list(Config) ->
     run(certificate_policies()).
+%%-----------------------------------------------------------------------------
 require_explicit_policy(doc) ->    [""];
 require_explicit_policy(suite) -> [];
 require_explicit_policy(Config) when is_list(Config) ->
     run(require_explicit_policy()).
+%%-----------------------------------------------------------------------------
 policy_mappings(doc) ->     [""];
 policy_mappings(suite) -> [];
 policy_mappings(Config) when is_list(Config) ->
     run(policy_mappings()).
+%%-----------------------------------------------------------------------------
 inhibit_policy_mapping(doc) ->    [""];
 inhibit_policy_mapping(suite) -> [];
 inhibit_policy_mapping(Config) when is_list(Config) ->
     run(inhibit_policy_mapping()).
+%%-----------------------------------------------------------------------------
 inhibit_any_policy(doc) ->    [""];
 inhibit_any_policy(suite) -> [];
 inhibit_any_policy(Config) when is_list(Config) ->
     run(inhibit_any_policy()).
-name_constraints(doc) ->    [""];
-name_constraints(suite) -> [];
-name_constraints(Config) when is_list(Config) ->
-    run(name_constraints()).
-distribution_points(doc) ->    [""];
-distribution_points(suite) -> [];
-distribution_points(Config) when is_list(Config) ->
-    run(distribution_points()).
-delta_crls(doc) ->    [""];
-delta_crls(suite) -> [];
-delta_crls(Config) when is_list(Config) ->
-    run(delta_crls()).
-private_certificate_extensions(doc) ->    [""];
-private_certificate_extensions(suite) -> [];
-private_certificate_extensions(Config) when is_list(Config) ->
-    run(private_certificate_extensions()).
-    
-run() ->
-    Tests = 
-	[signature_verification(),
-	 validity_periods(),
-	 verifying_name_chaining(),
-	 %%basic_certificate_revocation_tests(),
-	 verifying_paths_with_self_issued_certificates(),
-	 verifying_basic_constraints(),
-	 key_usage(),
-	 %%certificate_policies(),
-	 %%require_explicit_policy(),
-	 %%policy_mappings(),
-	 %%inhibit_policy_mapping(),
-	 %%inhibit_any_policy(),
-	 name_constraints(),	     
-	 %distribution_points(),
-	 %delta_crls(),
-	 private_certificate_extensions()
-	],
-    run(lists:append(Tests)).
+%%-----------------------------------------------------------------------------
+
+valid_DN_name_constraints(doc) ->
+    [""];
+valid_DN_name_constraints(suite) ->
+    [];
+valid_DN_name_constraints(Config) when is_list(Config) ->
+    run([{ "4.13.1",  "Valid DN nameConstraints Test1", ok},
+	 { "4.13.4",  "Valid DN nameConstraints Test4", ok},
+	 { "4.13.5",  "Valid DN nameConstraints Test5", ok},
+	 { "4.13.6",  "Valid DN nameConstraints Test6", ok},
+	 { "4.13.11", "Valid DN nameConstraints Test11", ok},
+	 { "4.13.14", "Valid DN nameConstraints Test14", ok},
+	 { "4.13.18", "Valid DN nameConstraints Test18", ok},
+	 { "4.13.19", "Valid Self-Issued DN nameConstraints Test19", ok}]).
+
+invalid_DN_name_constraints(doc) ->
+    [""];
+invalid_DN_name_constraints(suite) ->
+    [];
+invalid_DN_name_constraints(Config) when is_list(Config) ->
+    run([{ "4.13.2", "Invalid DN nameConstraints Test2", {bad_cert, name_not_permitted}},
+	 { "4.13.3",  "Invalid DN nameConstraints Test3", {bad_cert, name_not_permitted}},
+	 { "4.13.7",  "Invalid DN nameConstraints Test7", {bad_cert, name_not_permitted}},
+	 { "4.13.8",  "Invalid DN nameConstraints Test8", {bad_cert, name_not_permitted}},
+	 { "4.13.9",  "Invalid DN nameConstraints Test9", {bad_cert, name_not_permitted}},
+	 { "4.13.10", "Invalid DN nameConstraints Test10",{bad_cert, name_not_permitted}},
+	 { "4.13.12", "Invalid DN nameConstraints Test12",{bad_cert, name_not_permitted}},
+	 { "4.13.13", "Invalid DN nameConstraints Test13",{bad_cert, name_not_permitted}},
+	 { "4.13.15", "Invalid DN nameConstraints Test15",{bad_cert, name_not_permitted}},
+	 { "4.13.16", "Invalid DN nameConstraints Test16",{bad_cert, name_not_permitted}},
+	 { "4.13.17", "Invalid DN nameConstraints Test17",{bad_cert, name_not_permitted}},
+	 { "4.13.20", "Invalid Self-Issued DN nameConstraints Test20",
+	   {bad_cert, name_not_permitted}}]).
+
+valid_rfc822_name_constraints(doc) ->
+    [""];
+valid_rfc822_name_constraints(suite) ->
+    [];
+valid_rfc822_name_constraints(Config) when is_list(Config) ->
+    run([{ "4.13.21", "Valid RFC822 nameConstraints Test21", ok},
+	 { "4.13.23", "Valid RFC822 nameConstraints Test23", ok},
+	 { "4.13.25", "Valid RFC822 nameConstraints Test25", ok}]).
+
+
+invalid_rfc822_name_constraints(doc) ->
+    [""];
+invalid_rfc822_name_constraints(suite) ->
+    [];
+invalid_rfc822_name_constraints(Config) when is_list(Config) ->
+    run([{ "4.13.22", "Invalid RFC822 nameConstraints Test22",
+	   {bad_cert, name_not_permitted}},
+	 { "4.13.24", "Invalid RFC822 nameConstraints Test24",
+	   {bad_cert, name_not_permitted}},
+	 { "4.13.26", "Invalid RFC822 nameConstraints Test26",
+	   {bad_cert, name_not_permitted}}]).
+
+valid_DN_and_rfc822_name_constraints(doc) ->
+    [""];
+valid_DN_and_rfc822_name_constraints(suite) ->
+    [];
+valid_DN_and_rfc822_name_constraints(Config) when is_list(Config) ->
+    run([{ "4.13.27", "Valid DN and RFC822 nameConstraints Test27", ok}]).
+
+invalid_DN_and_rfc822_name_constraints(doc) ->
+    [""];
+invalid_DN_and_rfc822_name_constraints(suite) ->
+    [];
+invalid_DN_and_rfc822_name_constraints(Config) when is_list(Config) ->
+    run([{ "4.13.28", "Invalid DN and RFC822 nameConstraints Test28",
+	   {bad_cert, name_not_permitted}},
+	 { "4.13.29", "Invalid DN and RFC822 nameConstraints Test29",
+	   {bad_cert, name_not_permitted}}]).
+
+valid_dns_name_constraints(doc) ->
+    [""];
+valid_dns_name_constraints(suite) ->
+    [];
+valid_dns_name_constraints(Config) when is_list(Config) ->
+    run([{ "4.13.30", "Valid DNS nameConstraints Test30", ok},
+	 { "4.13.32", "Valid DNS nameConstraints Test32", ok}]).
+
+invalid_dns_name_constraints(doc) ->
+    [""];
+invalid_dns_name_constraints(suite) ->
+    [];
+invalid_dns_name_constraints(Config) when is_list(Config) ->
+    run([{ "4.13.31", "Invalid DNS nameConstraints Test31", {bad_cert, name_not_permitted}},
+	 { "4.13.33", "Invalid DNS nameConstraints Test33", {bad_cert, name_not_permitted}},
+	 { "4.13.38", "Invalid DNS nameConstraints Test38", {bad_cert, name_not_permitted}}]).
+
+valid_uri_name_constraints(doc) ->
+    [""];
+valid_uri_name_constraints(suite) ->
+    [];
+valid_uri_name_constraints(Config) when is_list(Config) ->
+    run([{ "4.13.34", "Valid URI nameConstraints Test34", ok},
+	 { "4.13.36", "Valid URI nameConstraints Test36", ok}]).
+
+invalid_uri_name_constraints(doc) ->
+    [""];
+invalid_uri_name_constraints(suite) ->
+    [];
+invalid_uri_name_constraints(Config) when is_list(Config) ->
+    run([{ "4.13.35", "Invalid URI nameConstraints Test35",{bad_cert, name_not_permitted}},
+	 { "4.13.37", "Invalid URI nameConstraints Test37",{bad_cert, name_not_permitted}}]).
+
+%%-----------------------------------------------------------------------------
+delta_without_crl(doc) ->
+    [""];
+delta_without_crl(suite) ->
+    [];
+delta_without_crl(Config) when is_list(Config) ->
+  run([{ "4.15.1",  "Invalid deltaCRLIndicator No Base Test1",{bad_cert,
+							       revocation_status_undetermined}},
+       {"4.15.10", "Invalid delta-CRL Test10", {bad_cert,
+						revocation_status_undetermined}}]).
+
+valid_delta_crls(doc) ->
+    [""];
+valid_delta_crls(suite) ->
+    [];
+valid_delta_crls(Config) when is_list(Config) ->
+    run([{ "4.15.2",  "Valid delta-CRL Test2", ok},
+	 { "4.15.5",  "Valid delta-CRL Test5", ok},
+	 { "4.15.7",  "Valid delta-CRL Test7", ok},
+	 { "4.15.8",  "Valid delta-CRL Test8", ok}
+	]).
+
+invalid_delta_crls(doc) ->
+    [""];
+invalid_delta_crls(suite) ->
+    [];
+invalid_delta_crls(Config) when is_list(Config) ->
+    run([{ "4.15.3",  "Invalid delta-CRL Test3", {bad_cert,{revoked, keyCompromise}}},
+	 { "4.15.4",  "Invalid delta-CRL Test4", {bad_cert,{revoked, keyCompromise}}},
+	 { "4.15.6",  "Invalid delta-CRL Test6", {bad_cert,{revoked, keyCompromise}}},
+	 { "4.15.9",  "Invalid delta-CRL Test9", {bad_cert,{revoked, keyCompromise}}}]).
+
+%%-----------------------------------------------------------------------------
+
+valid_distribution_points(doc) ->
+    [""];
+valid_distribution_points(suite) ->
+    [];
+valid_distribution_points(Config) when is_list(Config) ->
+    run([{ "4.14.1",  "Valid distributionPoint Test1", ok},
+	 { "4.14.4",  "Valid distributionPoint Test4", ok},
+	 { "4.14.5",  "Valid distributionPoint Test5", ok},
+	 { "4.14.7",  "Valid distributionPoint Test7", ok}
+	]).
+
+valid_distribution_points_no_issuing_distribution_point(doc) ->
+    [""];
+valid_distribution_points_no_issuing_distribution_point(suite) ->
+    [];
+valid_distribution_points_no_issuing_distribution_point(Config) when is_list(Config) ->
+    run([{ "4.14.10", "Valid No issuingDistributionPoint Test10", ok}
+	]).
+
+invalid_distribution_points(doc) ->
+    [""];
+invalid_distribution_points(suite) ->
+    [];
+invalid_distribution_points(Config) when is_list(Config) ->
+    run([{ "4.14.2",  "Invalid distributionPoint Test2", {bad_cert,{revoked, keyCompromise}}},
+	 { "4.14.3",  "Invalid distributionPoint Test3", {bad_cert,
+							  revocation_status_undetermined}},
+	 { "4.14.6",  "Invalid distributionPoint Test6", {bad_cert,{revoked, keyCompromise}}},
+	 { "4.14.8",  "Invalid distributionPoint Test8", {bad_cert,
+							  revocation_status_undetermined}},
+	 { "4.14.9",  "Invalid distributionPoint Test9", {bad_cert,
+							  revocation_status_undetermined}}
+	]).
+
+valid_only_contains(doc) ->
+    [""];
+valid_only_contains(suite) ->
+    [];
+valid_only_contains(Config) when is_list(Config) ->
+    run([{ "4.14.13", "Valid onlyContainsCACerts CRL Test13", ok}]).
 
+
+invalid_only_contains(doc) ->
+    [""];
+invalid_only_contains(suite) ->
+    [];
+invalid_only_contains(Config) when is_list(Config) ->
+    run([{ "4.14.11", "Invalid onlyContainsUserCerts CRL Test11",
+	   {bad_cert, revocation_status_undetermined}},
+	 { "4.14.12", "Invalid onlyContainsCACerts CRL Test12",
+	   {bad_cert, revocation_status_undetermined}},
+	 { "4.14.14", "Invalid onlyContainsAttributeCerts Test14",
+	   {bad_cert, revocation_status_undetermined}}
+	]).
+
+valid_only_some_reasons(doc) ->
+    [""];
+valid_only_some_reasons(suite) ->
+    [];
+valid_only_some_reasons(Config) when is_list(Config) ->
+    run([{ "4.14.18", "Valid onlySomeReasons Test18", ok},
+	 { "4.14.19", "Valid onlySomeReasons Test19", ok}
+	]).
+
+invalid_only_some_reasons(doc) ->
+    [""];
+invalid_only_some_reasons(suite) ->
+    [];
+invalid_only_some_reasons(Config) when is_list(Config) ->
+    run([{ "4.14.15", "Invalid onlySomeReasons Test15",
+	   {bad_cert,{revoked, keyCompromise}}},
+	 { "4.14.16", "Invalid onlySomeReasons Test16",
+	   {bad_cert,{revoked, certificateHold}}},
+	 { "4.14.17", "Invalid onlySomeReasons Test17",
+	   {bad_cert, revocation_status_undetermined}},
+	 { "4.14.20", "Invalid onlySomeReasons Test20",
+	   {bad_cert,{revoked, keyCompromise}}},
+	 { "4.14.21", "Invalid onlySomeReasons Test21",
+	   {bad_cert,{revoked, affiliationChanged}}}
+	]).
+
+valid_indirect_crl(doc) ->
+    [""];
+valid_indirect_crl(suite) ->
+    [];
+valid_indirect_crl(Config) when is_list(Config) ->
+    run([{ "4.14.22", "Valid IDP with indirectCRL Test22", ok},
+	 { "4.14.24", "Valid IDP with indirectCRL Test24", ok},
+	 { "4.14.25", "Valid IDP with indirectCRL Test25", ok}
+	]).
+
+invalid_indirect_crl(doc) ->
+    [""];
+invalid_indirect_crl(suite) ->
+    [];
+invalid_indirect_crl(Config) when is_list(Config) ->
+    run([{ "4.14.23", "Invalid IDP with indirectCRL Test23",
+	   {bad_cert,{revoked, keyCompromise}}},
+	 { "4.14.26", "Invalid IDP with indirectCRL Test26",
+	   {bad_cert, revocation_status_undetermined}}
+	]).
+
+valid_crl_issuer(doc) ->
+    [""];
+valid_crl_issuer(suite) ->
+    [];
+valid_crl_issuer(Config) when is_list(Config) ->
+    run([{ "4.14.28", "Valid cRLIssuer Test28", ok}%%,
+	 %%{ "4.14.29", "Valid cRLIssuer Test29", ok},
+	 %%{ "4.14.33", "Valid cRLIssuer Test33", ok}
+	]).
+
+invalid_crl_issuer(doc) ->
+    [""];
+invalid_crl_issuer(suite) ->
+    [];
+invalid_crl_issuer(Config) when is_list(Config) ->
+    run([
+	 { "4.14.27", "Invalid cRLIssuer Test27", {bad_cert, revocation_status_undetermined}},
+	 { "4.14.31", "Invalid cRLIssuer Test31", {bad_cert,{revoked, keyCompromise}}},
+	 { "4.14.32", "Invalid cRLIssuer Test32", {bad_cert,{revoked, keyCompromise}}},
+	 { "4.14.34", "Invalid cRLIssuer Test34", {bad_cert,{revoked, keyCompromise}}},
+	 { "4.14.35", "Invalid cRLIssuer Test35", {bad_cert, revocation_status_undetermined}}
+	]).
+
+
+%%distribution_points() ->
+    %%{ "4.14",    "Distribution Points" },
+%%    [
+	 %% Although this test is valid it has a circular dependency. As a result
+	 %% an attempt is made to reursively checks a CRL path and rejected due to
+	 %% a CRL path validation error. PKITS notes suggest this test does not
+	 %% need to be run due to this issue.
+%%	 { "4.14.30", "Valid cRLIssuer Test30", 54 }].
+
+
+%%-----------------------------------------------------------------------------
+
+unknown_critical_extension(doc) ->
+    [""];
+unknown_critical_extension(suite) ->
+    [];
+unknown_critical_extension(Config) when is_list(Config) ->
+    run([{ "4.16.2",  "Invalid Unknown Critical Certificate Extension Test2",
+	   {bad_cert,unknown_critical_extension}}]).
+
+unknown_not_critical_extension(doc) ->
+    [""];
+unknown_not_critical_extension(suite) ->
+    [];
+unknown_not_critical_extension(Config) when is_list(Config) ->
+    run([{ "4.16.1",  "Valid Unknown Not Critical Certificate Extension Test1", ok}]).
+
+%%-----------------------------------------------------------------------------
 run(Tests) ->    
     File = file(?CERTS,"TrustAnchorRootCertificate.crt"),
     {ok, TA} = file:read_file(File),
     run(Tests, TA).
 
 run({Chap, Test, Result}, TA) ->
-    CertChain = sort_chain(read_certs(Test),TA, [], false),    
-    try public_key:pkix_path_validation(TA, CertChain, []) of	
-	{Result, _} -> ok;	
+    CertChain = sort_chain(read_certs(Test),TA, [], false, Chap),
+    Options = path_validation_options(TA, Chap,Test),
+    try public_key:pkix_path_validation(TA, CertChain, Options) of
+	{Result, _} -> ok;
 	{error,Result} when Result =/= ok ->
 	    ok;
-	{error,Error} when is_integer(Result) ->
-	    ?warning(" ~p~n  Got ~p expected ~p~n",[Test, Error, Result]);
-	{error,Error} when Result =/= ok ->
-	    ?error(" minor ~p~n  Got ~p expected ~p~n",[Test, Error, Result]);
 	{error, Error}  ->
 	    ?error(" ~p ~p~n  Expected ~p got ~p ~n", [Chap, Test, Result, Error]),
 	    fail;
-	{ok, _} when Result =/= ok ->
+	{ok, _OK} when Result =/= ok ->
 	    ?error(" ~p ~p~n  Expected ~p got ~p ~n", [Chap, Test, Result, ok]),
 	    fail
     catch Type:Reason ->
@@ -181,14 +821,318 @@ run([Test|Rest],TA) ->
     run(Rest,TA);
 run([],_) -> ok.
 
+path_validation_options(TA, Chap, Test) ->
+    case needs_crl_options(Chap) of
+	true ->
+	    crl_options(TA, Test);
+	false ->
+	     Fun =
+		fun(_,{bad_cert, _} = Reason, _) ->
+			{fail, Reason};
+		   (_,{extension, _}, UserState) ->
+			{unknown, UserState};
+		   (_, Valid, UserState) when Valid == valid;
+					      Valid == valid_peer ->
+			{valid, UserState}
+		 end,
+	    [{verify_fun, {Fun, []}}]
+    end.
+
+needs_crl_options("4.4" ++ _) ->
+    true;
+needs_crl_options("4.5" ++ _) ->
+    true;
+needs_crl_options("4.7.4" ++ _) ->
+    true;
+needs_crl_options("4.7.5" ++ _) ->
+    true;
+needs_crl_options("4.14" ++ _) ->
+    true;
+needs_crl_options("4.15" ++ _) ->
+    true;
+needs_crl_options(_) ->
+    false.
+
+crl_options(TA, Test) ->
+     case read_crls(Test) of
+	[] ->
+	    [];
+        CRLs ->
+	    Fun =
+		 fun(_,{bad_cert, _} = Reason, _) ->
+			 {fail, Reason};
+		   (_,{extension,
+		       #'Extension'{extnID = ?'id-ce-cRLDistributionPoints',
+				    extnValue = Value}}, UserState0) ->
+			UserState = update_crls(Value, UserState0),
+			{valid, UserState};
+		   (_,{extension, _}, UserState) ->
+			{unknown, UserState};
+		   (OtpCert, Valid, UserState) when Valid == valid;
+						    Valid == valid_peer ->
+			{ErlCerts, CRLs} = UserState#verify_state.crl_info,
+			CRLInfo0 =
+			    crl_info(OtpCert,
+				     ErlCerts,[{DerCRL, public_key:der_decode('CertificateList',
+									      DerCRL)} || DerCRL <- CRLs],
+				     []),
+			CRLInfo = lists:reverse(CRLInfo0),
+			Certs = UserState#verify_state.certs_db,
+			Fun = fun(DP, CRLtoValidate, Id, CertsDb) ->
+				      trusted_cert_and_path(DP, CRLtoValidate, Id, CertsDb)
+			      end,
+			Ignore = ignore_sign_test_when_building_path(Test),
+			case public_key:pkix_crls_validate(OtpCert, CRLInfo,
+							   [{issuer_fun,{Fun, {Ignore, Certs}}}]) of
+			    valid ->
+				{valid, UserState};
+			    Reason  ->
+				{fail, Reason}
+			end
+		end,
+
+	    Certs = read_certs(Test),
+	    ErlCerts = [public_key:pkix_decode_cert(Cert, otp) || Cert <- Certs],
+
+	    [{verify_fun, {Fun, #verify_state{certs_db = [TA| Certs],
+					      crl_info = {ErlCerts, CRLs}}}}]
+    end.
+
+crl_info(_, _, [], Acc) ->
+    Acc;
+crl_info(OtpCert, Certs, [{_, #'CertificateList'{tbsCertList =
+						     #'TBSCertList'{issuer = Issuer,
+								    crlExtensions = CRLExtensions}}}
+				= CRL | Rest], Acc) ->
+    OtpTBSCert =  OtpCert#'OTPCertificate'.tbsCertificate,
+    Extensions = OtpTBSCert#'OTPTBSCertificate'.extensions,
+    ExtList = pubkey_cert:extensions_list(CRLExtensions),
+    DPs  = case pubkey_cert:select_extension(?'id-ce-cRLDistributionPoints', Extensions) of
+	      #'Extension'{extnValue = Value} ->
+		   lists:map(fun(Point) -> pubkey_cert_records:transform(Point, decode) end, Value);
+	      _ ->
+		  case same_issuer(OtpCert, Issuer) of
+		      true ->
+			  [make_dp(ExtList, asn1_NOVALUE, Issuer)];
+		      false ->
+			  [make_dp(ExtList, Issuer, ignore)]
+		  end
+	   end,
+    DPsCRLs = lists:map(fun(DP) -> {DP, CRL} end, DPs),
+    crl_info(OtpCert, Certs, Rest, DPsCRLs ++ Acc).
+
+ignore_sign_test_when_building_path("Invalid Bad CRL Signature Test4") ->
+    true;
+ignore_sign_test_when_building_path(_) ->
+    false.
+
+same_issuer(OTPCert, Issuer) ->
+    DecIssuer = pubkey_cert_records:transform(Issuer, decode),
+    OTPTBSCert =  OTPCert#'OTPCertificate'.tbsCertificate,
+    CertIssuer =  OTPTBSCert#'OTPTBSCertificate'.issuer,
+    pubkey_cert:is_issuer(DecIssuer, CertIssuer).
+
+make_dp(Extensions, Issuer0, DpInfo) ->
+    {Issuer, Point} = mk_issuer_dp(Issuer0, DpInfo),
+    case pubkey_cert:select_extension('id-ce-cRLReason', Extensions) of
+	#'Extension'{extnValue = Reasons} ->
+	    #'DistributionPoint'{cRLIssuer = Issuer,
+				 reasons = Reasons,
+				 distributionPoint = Point};
+	_ ->
+	    #'DistributionPoint'{cRLIssuer = Issuer,
+				 reasons = [unspecified, keyCompromise,
+					    cACompromise, affiliationChanged, superseded,
+					    cessationOfOperation, certificateHold,
+					    removeFromCRL, privilegeWithdrawn, aACompromise],
+				 distributionPoint = Point}
+    end.
+
+mk_issuer_dp(asn1_NOVALUE, Issuer) ->
+    {asn1_NOVALUE, {fullName, [{directoryName, Issuer}]}};
+mk_issuer_dp(Issuer, _) ->
+    {[{directoryName, Issuer}], asn1_NOVALUE}.
+
+update_crls(_, State) ->
+    State.
+
+trusted_cert_and_path(DP, CRL, Id, {Ignore, CertsList}) ->
+    case crl_issuer(crl_issuer_name(DP), CRL, Id, CertsList, CertsList, Ignore) of
+	{ok, IssuerCert, DerIssuerCert} ->
+	    Certs = [{public_key:pkix_decode_cert(Cert, otp), Cert} || Cert <- CertsList],
+	    CertChain = build_chain(Certs, Certs, IssuerCert, Ignore, [DerIssuerCert]),
+	    {ok, public_key:pkix_decode_cert(hd(CertChain), otp), CertChain};
+	Other ->
+	    Other
+    end.
+
+crl_issuer_name(#'DistributionPoint'{cRLIssuer = asn1_NOVALUE}) ->
+    undefined;
+crl_issuer_name(#'DistributionPoint'{cRLIssuer = [{directoryName, Issuer}]}) ->
+    pubkey_cert_records:transform(Issuer, decode).
+
+build_chain([],_, _, _,Acc) ->
+    Acc;
+
+build_chain([{First, DerFirst}|Certs], All, Cert, Ignore, Acc) ->
+    case public_key:pkix_is_self_signed(Cert) andalso is_test_root(Cert) of
+	true ->
+	    Acc;
+	false ->
+	    case public_key:pkix_is_issuer(Cert, First)
+		%%andalso check_extension_cert_signer(First)
+		andalso is_signer(First, Cert, Ignore)
+	    of
+		true ->
+		    build_chain(All, All, First, Ignore, [DerFirst | Acc]);
+		false ->
+		    build_chain(Certs, All, Cert, Ignore, Acc)
+	    end
+    end.
+
+is_signer(_,_, true) ->
+    true;
+is_signer(Signer, #'OTPCertificate'{} = Cert,_) ->
+    TBSCert = Signer#'OTPCertificate'.tbsCertificate,
+    PublicKeyInfo = TBSCert#'OTPTBSCertificate'.subjectPublicKeyInfo,
+    PublicKey = PublicKeyInfo#'OTPSubjectPublicKeyInfo'.subjectPublicKey,
+    AlgInfo = PublicKeyInfo#'OTPSubjectPublicKeyInfo'.algorithm,
+    PublicKeyParams = AlgInfo#'PublicKeyAlgorithm'.parameters,
+    try pubkey_cert:validate_signature(Cert, public_key:pkix_encode('OTPCertificate',
+								Cert, otp),
+				   PublicKey, PublicKeyParams, true, ?DEFAULT_VERIFYFUN) of
+	true ->
+	    true
+    catch
+	_:_ ->
+	    false
+    end;
+is_signer(Signer, #'CertificateList'{} = CRL, _) ->
+    TBSCert = Signer#'OTPCertificate'.tbsCertificate,
+    PublicKeyInfo = TBSCert#'OTPTBSCertificate'.subjectPublicKeyInfo,
+    PublicKey = PublicKeyInfo#'OTPSubjectPublicKeyInfo'.subjectPublicKey,
+    AlgInfo = PublicKeyInfo#'OTPSubjectPublicKeyInfo'.algorithm,
+    PublicKeyParams = AlgInfo#'PublicKeyAlgorithm'.parameters,
+    pubkey_crl:verify_crl_signature(CRL, public_key:pkix_encode('CertificateList',
+								CRL, plain),
+				    PublicKey, PublicKeyParams).
+
+is_test_root(OtpCert) ->
+    TBSCert = OtpCert#'OTPCertificate'.tbsCertificate,
+    {rdnSequence, AtterList} = TBSCert#'OTPTBSCertificate'.issuer,
+    lists:member([{'AttributeTypeAndValue',{2,5,4,3},{printableString,"Trust Anchor"}}],
+			AtterList).
+
+check_extension_cert_signer(OtpCert) ->
+    TBSCert = OtpCert#'OTPCertificate'.tbsCertificate,
+     Extensions = TBSCert#'OTPTBSCertificate'.extensions,
+     case pubkey_cert:select_extension(?'id-ce-keyUsage', Extensions) of
+	#'Extension'{extnValue = KeyUse} ->
+	     lists:member(keyCertSign, KeyUse);
+	 _ ->
+	     true
+    end.
+
+check_extension_crl_signer(OtpCert) ->
+    TBSCert = OtpCert#'OTPCertificate'.tbsCertificate,
+     Extensions = TBSCert#'OTPTBSCertificate'.extensions,
+     case pubkey_cert:select_extension(?'id-ce-keyUsage', Extensions) of
+	#'Extension'{extnValue = KeyUse} ->
+	     lists:member(cRLSign, KeyUse);
+	 _ ->
+	     true
+    end.
+
+crl_issuer(undefined, CRL, issuer_not_found, _, CertsList, Ignore) ->
+    crl_issuer(CRL, CertsList, Ignore);
+
+crl_issuer(IssuerName, CRL, issuer_not_found, CertsList, CertsList, Ignore) ->
+    crl_issuer(IssuerName, CRL, IssuerName, CertsList, CertsList, Ignore);
+
+crl_issuer(undefined, CRL, Id, [Cert | Rest], All, false) ->
+    ErlCert = public_key:pkix_decode_cert(Cert, otp),
+    TBSCertificate = ErlCert#'OTPCertificate'.tbsCertificate,
+    SerialNumber = TBSCertificate#'OTPTBSCertificate'.serialNumber,
+    Issuer = public_key:pkix_normalize_name(
+		    TBSCertificate#'OTPTBSCertificate'.subject),
+    Bool = is_signer(ErlCert, CRL, false),
+    case {SerialNumber, Issuer} of
+	Id when Bool == true ->
+	    {ok, ErlCert, Cert};
+	_ ->
+	    crl_issuer(undefined, CRL, Id, Rest, All, false)
+    end;
+
+crl_issuer(IssuerName, CRL, Id, [Cert | Rest], All, false) ->
+    ErlCert = public_key:pkix_decode_cert(Cert, otp),
+    TBSCertificate = ErlCert#'OTPCertificate'.tbsCertificate,
+    SerialNumber = TBSCertificate#'OTPTBSCertificate'.serialNumber,
+    %%Issuer = public_key:pkix_normalize_name(
+    %%		    TBSCertificate#'OTPTBSCertificate'.subject),
+    Bool = is_signer(ErlCert, CRL, false),
+    case {SerialNumber, IssuerName} of
+	Id when Bool == true ->
+	    {ok, ErlCert, Cert};
+	{_, IssuerName}  when Bool == true ->
+	    {ok, ErlCert, Cert};
+	_ ->
+	    crl_issuer(IssuerName, CRL, Id, Rest, All, false)
+    end;
+
+crl_issuer(undefined, CRL, _, [], CertsList, Ignore) ->
+    crl_issuer(CRL, CertsList, Ignore);
+crl_issuer(CRLName, CRL, _, [], CertsList, Ignore) ->
+    crl_issuer(CRLName, CRL, CertsList, Ignore).
+
+
+crl_issuer(_, [],_) ->
+    {error, issuer_not_found};
+crl_issuer(CRL, [Cert | Rest], Ignore) ->
+    ErlCert = public_key:pkix_decode_cert(Cert, otp),
+    case public_key:pkix_is_issuer(CRL, ErlCert) andalso
+	check_extension_crl_signer(ErlCert) andalso
+	is_signer(ErlCert, CRL, Ignore)
+    of
+        true ->
+	    {ok, ErlCert,Cert};
+        false ->
+            crl_issuer(CRL, Rest, Ignore)
+    end.
+
+crl_issuer(_,_, [],_) ->
+    {error, issuer_not_found};
+crl_issuer(IssuerName, CRL, [Cert | Rest], Ignore) ->
+    ErlCert = public_key:pkix_decode_cert(Cert, otp),
+    TBSCertificate = ErlCert#'OTPCertificate'.tbsCertificate,
+    Issuer = public_key:pkix_normalize_name(
+		    TBSCertificate#'OTPTBSCertificate'.subject),
+
+    case
+	public_key:pkix_is_issuer(CRL, ErlCert) andalso
+	check_extension_crl_signer(ErlCert) andalso
+	is_signer(ErlCert, CRL, Ignore)
+    of
+        true ->
+	    case  pubkey_cert:is_issuer(Issuer, IssuerName) of
+		true ->
+		    {ok, ErlCert,Cert};
+		false ->
+		    crl_issuer(IssuerName, CRL, Rest, Ignore)
+	    end;
+	false ->
+            crl_issuer(IssuerName, CRL, Rest, Ignore)
+    end.
 
 read_certs(Test) ->
     File = test_file(Test),
-    %% io:format("Read ~p ",[File]),
     Ders = erl_make_certs:pem_to_der(File),
-    %% io:format("Ders ~p ~n",[length(Ders)]),
     [Cert || {'Certificate', Cert, not_encrypted} <- Ders].
 
+read_crls(Test) ->
+    File = test_file(Test),
+    Ders = erl_make_certs:pem_to_der(File),
+    [CRL || {'CertificateList', CRL, not_encrypted} <- Ders].
+
 test_file(Test) ->
     file(?CONV, lists:append(string:tokens(Test, " -")) ++ ".pem").
 
@@ -206,118 +1150,89 @@ file(Sub,File) ->
     end,
     AbsFile.
 
-sort_chain([First|Certs], TA, Try, Found) -> 
+sort_chain(Certs, TA, Acc, Bool, Chap) when Chap == "4.5.3"->
+     [CA, Entity, Self] = do_sort_chain(Certs, TA, Acc, Bool, Chap),
+     [CA, Self, Entity];
+sort_chain(Certs, TA, Acc, Bool, Chap) when Chap == "4.5.4";
+					    Chap == "4.5.5" ->
+     [CA, Entity, _Self] = do_sort_chain(Certs, TA, Acc, Bool, Chap),
+     [CA, Entity];
+
+sort_chain(Certs, TA, Acc, Bool, Chap) when Chap == "4.14.24";
+					    Chap == "4.14.25";
+					    Chap == "4.14.26";
+					    Chap == "4.14.27";
+					    Chap == "4.14.31";
+					    Chap == "4.14.32";
+					    Chap == "4.14.33" ->
+    [_OtherCA, Entity, CA] = do_sort_chain(Certs, TA, Acc, Bool, Chap),
+    [CA, Entity];
+
+sort_chain(Certs, TA, Acc, Bool, Chap) when Chap == "4.14.28";
+					    Chap == "4.14.29" ->
+    [CA, _OtherCA, Entity] = do_sort_chain(Certs, TA, Acc, Bool, Chap),
+    [CA, Entity];
+
+
+sort_chain(Certs, TA, Acc, Bool, Chap) when Chap == "4.14.33" ->
+    [Entity, CA, _OtherCA] = do_sort_chain(Certs, TA, Acc, Bool, Chap),
+    [CA, Entity];
+
+
+sort_chain(Certs, TA, Acc, Bool, Chap) ->
+    do_sort_chain(Certs, TA, Acc, Bool, Chap).
+
+do_sort_chain([First], TA, Try, Found, Chap) when Chap == "4.5.6";
+						  Chap == "4.5.7";
+						  Chap == "4.4.19";
+						  Chap == "4.4.20";
+						  Chap == "4.4.21"->
     case public_key:pkix_is_issuer(First,TA) of
 	true -> 
-	    [First|sort_chain(Certs,First,Try,true)];
+	    [First|do_sort_chain([],First,Try,true, Chap)];
 	false ->
-	    sort_chain(Certs,TA,[First|Try],Found)
+	    do_sort_chain([],TA,[First|Try],Found, Chap)
     end;
-sort_chain([], _, [],_) -> [];
-sort_chain([], Valid, Check, true) ->
-    sort_chain(lists:reverse(Check), Valid, [], false);
-sort_chain([], _Valid, Check, false) ->
+do_sort_chain([First|Certs], TA, Try, Found, Chap) when Chap == "4.5.6";
+							Chap == "4.5.7";
+							Chap == "4.4.19";
+							Chap  == "4.4.20";
+							Chap == "4.4.21"->
+%%    case check_extension_cert_signer(public_key:pkix_decode_cert(First, otp)) of
+%%	true ->
+    case public_key:pkix_is_issuer(First,TA) of
+	true ->
+	    [First|do_sort_chain(Certs,First,Try,true, Chap)];
+	false ->
+	    do_sort_chain(Certs,TA,[First|Try],Found, Chap)
+    end;
+%%	false ->
+%%	    do_sort_chain(Certs, TA, Try, Found, Chap)
+%%   end;
+
+do_sort_chain([First|Certs], TA, Try, Found, Chap) ->
+    case public_key:pkix_is_issuer(First,TA) of
+	true ->
+	    [First|do_sort_chain(Certs,First,Try,true, Chap)];
+	false ->
+	    do_sort_chain(Certs,TA,[First|Try],Found, Chap)
+    end;
+
+do_sort_chain([], _, [],_, _) -> [];
+do_sort_chain([], Valid, Check, true, Chap) ->
+    do_sort_chain(lists:reverse(Check), Valid, [], false, Chap);
+do_sort_chain([], _Valid, Check, false, _) ->
     Check.
 
-signature_verification() ->    
-    %%  "4.1", "Signature Verification" ,
-    [{ "4.1.1", "Valid Signatures Test1",                        ok},
-     { "4.1.2", "Invalid CA Signature Test2",                    {bad_cert,invalid_signature}},
-     { "4.1.3", "Invalid EE Signature Test3",                    {bad_cert,invalid_signature}},
-     { "4.1.4", "Valid DSA Signatures Test4",                    ok},
-     { "4.1.5", "Valid DSA Parameter Inheritance Test5",         ok},
-     { "4.1.6", "Invalid DSA Signature Test6",                   {bad_cert,invalid_signature}}].
-validity_periods() ->
-    %% { "4.2",   "Validity Periods" },
-    [{ "4.2.1", "Invalid CA notBefore Date Test1",               {bad_cert, cert_expired}},
-     { "4.2.2", "Invalid EE notBefore Date Test2",               {bad_cert, cert_expired}},
-     { "4.2.3", "Valid pre2000 UTC notBefore Date Test3",        ok},
-     { "4.2.4", "Valid GeneralizedTime notBefore Date Test4",    ok},
-     { "4.2.5", "Invalid CA notAfter Date Test5",                {bad_cert, cert_expired}},
-     { "4.2.6", "Invalid EE notAfter Date Test6",                {bad_cert, cert_expired}},
-     { "4.2.7", "Invalid pre2000 UTC EE notAfter Date Test7",    {bad_cert, cert_expired}},
-     { "4.2.8", "Valid GeneralizedTime notAfter Date Test8",     ok}].
-verifying_name_chaining() ->
-    %%{ "4.3",   "Verifying Name Chaining" },
-    [{ "4.3.1", "Invalid Name Chaining EE Test1",                {bad_cert, invalid_issuer}},
-     { "4.3.2", "Invalid Name Chaining Order Test2",             {bad_cert, invalid_issuer}},
-     { "4.3.3", "Valid Name Chaining Whitespace Test3",          ok},
-     { "4.3.4", "Valid Name Chaining Whitespace Test4",          ok},
-     { "4.3.5", "Valid Name Chaining Capitalization Test5",      ok},
-     { "4.3.6", "Valid Name Chaining UIDs Test6",                ok},
-     { "4.3.7", "Valid RFC3280 Mandatory Attribute Types Test7", ok},
-     { "4.3.8", "Valid RFC3280 Optional Attribute Types Test8",  ok},
-     { "4.3.9", "Valid UTF8String Encoded Names Test9",          ok},
-     { "4.3.10", "Valid Rollover from PrintableString to UTF8String Test10", ok},
-     { "4.3.11", "Valid UTF8String Case Insensitive Match Test11",           ok}].
-basic_certificate_revocation_tests() ->
-    %%{ "4.4",    "Basic Certificate Revocation Tests" },
-    [{ "4.4.1",  "Missing CRL Test1",                 3 },
-     { "4.4.2", "Invalid Revoked CA Test2",          23 },
-     { "4.4.3", "Invalid Revoked EE Test3",          23 },
-     { "4.4.4", "Invalid Bad CRL Signature Test4",   8 },
-     { "4.4.5", "Invalid Bad CRL Issuer Name Test5", 3 },
-     { "4.4.6", "Invalid Wrong CRL Test6",           3 },
-     { "4.4.7", "Valid Two CRLs Test7",              ok},
-
-     %% The test document suggests these should return certificate revoked...
-     %% Subsquent discussion has concluded they should not due to unhandle
-     %% critical CRL extensions.
-     { "4.4.8", "Invalid Unknown CRL Entry Extension Test8", 36 },
-     { "4.4.9", "Invalid Unknown CRL Extension Test9",       36 },
-
-     { "4.4.10", "Invalid Unknown CRL Extension Test10",             36 },
-     { "4.4.11", "Invalid Old CRL nextUpdate Test11",                12 },
-     { "4.4.12", "Invalid pre2000 CRL nextUpdate Test12",            12 },
-     { "4.4.13", "Valid GeneralizedTime CRL nextUpdate Test13",      ok},
-     { "4.4.14", "Valid Negative Serial Number Test14",              ok},
-     { "4.4.15", "Invalid Negative Serial Number Test15",            23 },
-     { "4.4.16", "Valid Long Serial Number Test16",                  ok},
-     { "4.4.17", "Valid Long Serial Number Test17",                  ok},
-     { "4.4.18", "Invalid Long Serial Number Test18",                23 },
-     { "4.4.19", "Valid Separate Certificate and CRL Keys Test19",   ok},
-     { "4.4.20", "Invalid Separate Certificate and CRL Keys Test20", 23 },
-
-     %% CRL path is revoked so get a CRL path validation error
-     { "4.4.21", "Invalid Separate Certificate and CRL Keys Test21",      54 }].
-verifying_paths_with_self_issued_certificates() ->
-    %%{ "4.5",    "Verifying Paths with Self-Issued Certificates" },
-    [{ "4.5.1",  "Valid Basic Self-Issued Old With New Test1",            ok},
-     %%{ "4.5.2",  "Invalid Basic Self-Issued Old With New Test2",          23 },
-     %%{ "4.5.3",  "Valid Basic Self-Issued New With Old Test3",            ok},
-     %%{ "4.5.4",  "Valid Basic Self-Issued New With Old Test4",            ok},
-     { "4.5.5",  "Invalid Basic Self-Issued New With Old Test5",          23 },
-     %%{ "4.5.6",  "Valid Basic Self-Issued CRL Signing Key Test6",         ok},
-     { "4.5.7",  "Invalid Basic Self-Issued CRL Signing Key Test7",       23 },
-     { "4.5.8",  "Invalid Basic Self-Issued CRL Signing Key Test8",       {bad_cert,invalid_key_usage} }].
-verifying_basic_constraints() ->
-    [%%{ "4.6",    "Verifying Basic Constraints" },
-     { "4.6.1",  "Invalid Missing basicConstraints Test1",                
-       {bad_cert, missing_basic_constraint} },
-     { "4.6.2",  "Invalid cA False Test2",                                {bad_cert, missing_basic_constraint}},
-     { "4.6.3",  "Invalid cA False Test3",                                {bad_cert, missing_basic_constraint}},
-     { "4.6.4",  "Valid basicConstraints Not Critical Test4",             ok},
-     { "4.6.5",  "Invalid pathLenConstraint Test5",                       {bad_cert, max_path_length_reached}},
-     { "4.6.6",  "Invalid pathLenConstraint Test6",                       {bad_cert, max_path_length_reached}},
-     { "4.6.7",  "Valid pathLenConstraint Test7",                         ok},
-     { "4.6.8",  "Valid pathLenConstraint Test8",                         ok},
-     { "4.6.9",  "Invalid pathLenConstraint Test9",                       {bad_cert, max_path_length_reached}},
-     { "4.6.10", "Invalid pathLenConstraint Test10",                      {bad_cert, max_path_length_reached}},
-     { "4.6.11", "Invalid pathLenConstraint Test11",                      {bad_cert, max_path_length_reached}},
-     { "4.6.12", "Invalid pathLenConstraint Test12",                      {bad_cert, max_path_length_reached}},
-     { "4.6.13", "Valid pathLenConstraint Test13",                        ok},
-     { "4.6.14", "Valid pathLenConstraint Test14",                        ok},
-     { "4.6.15", "Valid Self-Issued pathLenConstraint Test15",            ok},
-     { "4.6.16", "Invalid Self-Issued pathLenConstraint Test16",          {bad_cert, max_path_length_reached}},
-     { "4.6.17", "Valid Self-Issued pathLenConstraint Test17",            ok}].
-key_usage() ->
-    %%{ "4.7",    "Key Usage" },
-    [{ "4.7.1",  "Invalid keyUsage Critical keyCertSign False Test1",     {bad_cert,invalid_key_usage} },
-     { "4.7.2",  "Invalid keyUsage Not Critical keyCertSign False Test2", {bad_cert,invalid_key_usage} },
-     { "4.7.3",  "Valid keyUsage Not Critical Test3",                     ok}
-     %%,{ "4.7.4",  "Invalid keyUsage Critical cRLSign False Test4",         35 }
-     %%,{ "4.7.5",  "Invalid keyUsage Not Critical cRLSign False Test5",     35 }
-    ].
+error(Format, Args, File0, Line) ->
+    File = filename:basename(File0),
+    Pid = group_leader(),
+    Pid ! {failed, File, Line},
+    io:format(Pid, "~s(~p): ERROR"++Format, [File,Line|Args]).
+
+warning(Format, Args, File0, Line) ->
+    File = filename:basename(File0),
+    io:format("~s(~p): Warning "++Format, [File,Line|Args]).
 
 %% Certificate policy tests need special handling. They can have several
 %% sub tests and we need to check the outputs are correct.
@@ -425,182 +1340,3 @@ inhibit_any_policy() ->
      {"4.12.8",  "Invalid Self-Issued inhibitAnyPolicy Test8",    43 },
      {"4.12.9",  "Valid Self-Issued inhibitAnyPolicy Test9",      ok},
      {"4.12.10", "Invalid Self-Issued inhibitAnyPolicy Test10",   43 }].
-
-name_constraints() ->
-    %%{ "4.13",    "Name Constraints" },
-    [{ "4.13.1",  "Valid DN nameConstraints Test1",                ok},
-     { "4.13.2",  "Invalid DN nameConstraints Test2",              {bad_cert, name_not_permitted}},
-     { "4.13.3",  "Invalid DN nameConstraints Test3",              {bad_cert, name_not_permitted}},
-     { "4.13.4",  "Valid DN nameConstraints Test4",                ok},
-     { "4.13.5",  "Valid DN nameConstraints Test5",                ok},
-     { "4.13.6",  "Valid DN nameConstraints Test6",                ok},
-     { "4.13.7",  "Invalid DN nameConstraints Test7",              {bad_cert, name_not_permitted}},
-     { "4.13.8",  "Invalid DN nameConstraints Test8",              {bad_cert, name_not_permitted}},
-     { "4.13.9",  "Invalid DN nameConstraints Test9",              {bad_cert, name_not_permitted}},
-     { "4.13.10", "Invalid DN nameConstraints Test10",             {bad_cert, name_not_permitted}},
-     { "4.13.11", "Valid DN nameConstraints Test11",               ok},
-     { "4.13.12", "Invalid DN nameConstraints Test12",             {bad_cert, name_not_permitted}},
-     { "4.13.13", "Invalid DN nameConstraints Test13",             {bad_cert, name_not_permitted}},
-     { "4.13.14", "Valid DN nameConstraints Test14",               ok},
-     { "4.13.15", "Invalid DN nameConstraints Test15",             {bad_cert, name_not_permitted}},
-     { "4.13.16", "Invalid DN nameConstraints Test16",             {bad_cert, name_not_permitted}},
-     { "4.13.17", "Invalid DN nameConstraints Test17",             {bad_cert, name_not_permitted}},
-     { "4.13.18", "Valid DN nameConstraints Test18",               ok},
-     { "4.13.19", "Valid Self-Issued DN nameConstraints Test19",   ok},
-     { "4.13.20", "Invalid Self-Issued DN nameConstraints Test20", {bad_cert, name_not_permitted} },
-     { "4.13.21", "Valid RFC822 nameConstraints Test21",           ok},
-     { "4.13.22", "Invalid RFC822 nameConstraints Test22",         {bad_cert, name_not_permitted} },
-     { "4.13.23", "Valid RFC822 nameConstraints Test23",           ok},
-     { "4.13.24", "Invalid RFC822 nameConstraints Test24",         {bad_cert, name_not_permitted} },
-     { "4.13.25", "Valid RFC822 nameConstraints Test25",           ok},
-     { "4.13.26", "Invalid RFC822 nameConstraints Test26",         {bad_cert, name_not_permitted}},
-     { "4.13.27", "Valid DN and RFC822 nameConstraints Test27",    ok},
-     { "4.13.28", "Invalid DN and RFC822 nameConstraints Test28",  {bad_cert, name_not_permitted} },
-     { "4.13.29", "Invalid DN and RFC822 nameConstraints Test29",  {bad_cert, name_not_permitted} },
-     { "4.13.30", "Valid DNS nameConstraints Test30",              ok},
-     { "4.13.31", "Invalid DNS nameConstraints Test31",            {bad_cert, name_not_permitted} },
-     { "4.13.32", "Valid DNS nameConstraints Test32",              ok},
-     { "4.13.33", "Invalid DNS nameConstraints Test33",            {bad_cert, name_not_permitted}},
-     { "4.13.34", "Valid URI nameConstraints Test34",              ok},
-     { "4.13.35", "Invalid URI nameConstraints Test35",            {bad_cert, name_not_permitted} },
-     { "4.13.36", "Valid URI nameConstraints Test36",              ok},
-     { "4.13.37", "Invalid URI nameConstraints Test37",            {bad_cert, name_not_permitted}},
-     { "4.13.38", "Invalid DNS nameConstraints Test38",            {bad_cert, name_not_permitted} }].
-distribution_points() ->
-     %%{ "4.14",    "Distribution Points" },
-    [{ "4.14.1",  "Valid distributionPoint Test1",                 ok},
-     { "4.14.2",  "Invalid distributionPoint Test2",               23 },
-     { "4.14.3",  "Invalid distributionPoint Test3",               44 },
-     { "4.14.4",  "Valid distributionPoint Test4",                 ok},
-     { "4.14.5",  "Valid distributionPoint Test5",                 ok},
-     { "4.14.6",  "Invalid distributionPoint Test6",               23 },
-     { "4.14.7",  "Valid distributionPoint Test7",                 ok},
-     { "4.14.8",  "Invalid distributionPoint Test8",               44 },
-     { "4.14.9",  "Invalid distributionPoint Test9",               44 },
-     { "4.14.10", "Valid No issuingDistributionPoint Test10",      ok},
-     { "4.14.11", "Invalid onlyContainsUserCerts CRL Test11",      44 },
-     { "4.14.12", "Invalid onlyContainsCACerts CRL Test12",        44 },
-     { "4.14.13", "Valid onlyContainsCACerts CRL Test13",          ok},
-     { "4.14.14", "Invalid onlyContainsAttributeCerts Test14",     44 },
-     { "4.14.15", "Invalid onlySomeReasons Test15",                23 },
-     { "4.14.16", "Invalid onlySomeReasons Test16",                23 },
-     { "4.14.17", "Invalid onlySomeReasons Test17",                3 },
-     { "4.14.18", "Valid onlySomeReasons Test18",                  ok},
-     { "4.14.19", "Valid onlySomeReasons Test19",                  ok},
-     { "4.14.20", "Invalid onlySomeReasons Test20",                23 },
-     { "4.14.21", "Invalid onlySomeReasons Test21",                23 },
-     { "4.14.22", "Valid IDP with indirectCRL Test22",             ok},
-     { "4.14.23", "Invalid IDP with indirectCRL Test23",           23 },
-     { "4.14.24", "Valid IDP with indirectCRL Test24",             ok},
-     { "4.14.25", "Valid IDP with indirectCRL Test25",             ok},
-     { "4.14.26", "Invalid IDP with indirectCRL Test26",           44 },
-     { "4.14.27", "Invalid cRLIssuer Test27",                      3 },
-     { "4.14.28", "Valid cRLIssuer Test28",                        ok},
-     { "4.14.29", "Valid cRLIssuer Test29",                        ok},
-
-     %% Although this test is valid it has a circular dependency. As a result
-     %% an attempt is made to reursively checks a CRL path and rejected due to
-     %% a CRL path validation error. PKITS notes suggest this test does not
-     %% need to be run due to this issue.
-     { "4.14.30", "Valid cRLIssuer Test30",                                 54 },
-     { "4.14.31", "Invalid cRLIssuer Test31",                               23 },
-     { "4.14.32", "Invalid cRLIssuer Test32",                               23 },
-     { "4.14.33", "Valid cRLIssuer Test33",                                 ok},
-     { "4.14.34", "Invalid cRLIssuer Test34",                               23 },
-     { "4.14.35", "Invalid cRLIssuer Test35",                               44 }].
-delta_crls() ->
-    %%{ "4.15",    "Delta-CRLs" },
-    [{ "4.15.1",  "Invalid deltaCRLIndicator No Base Test1",                3 },
-     { "4.15.2",  "Valid delta-CRL Test2",                                  ok},
-     { "4.15.3",  "Invalid delta-CRL Test3",                                23 },
-     { "4.15.4",  "Invalid delta-CRL Test4",                                23 },
-     { "4.15.5",  "Valid delta-CRL Test5",                                  ok},
-     { "4.15.6",  "Invalid delta-CRL Test6",                                23 },
-     { "4.15.7",  "Valid delta-CRL Test7",                                  ok},
-     { "4.15.8",  "Valid delta-CRL Test8",                                  ok},
-     { "4.15.9",  "Invalid delta-CRL Test9",                                23 },
-     { "4.15.10", "Invalid delta-CRL Test10",                               12 }].
-private_certificate_extensions() ->
-    %%{ "4.16",    "Private Certificate Extensions" },
-    [{ "4.16.1",  "Valid Unknown Not Critical Certificate Extension Test1", ok},
-     { "4.16.2",  "Invalid Unknown Critical Certificate Extension Test2",   
-       {bad_cert,unknown_critical_extension}}].
-
-
-convert() ->
-    Tests = [signature_verification(),
-	     validity_periods(),
-	     verifying_name_chaining(),
-	     basic_certificate_revocation_tests(),
-	     verifying_paths_with_self_issued_certificates(),
-	     verifying_basic_constraints(),
-	     key_usage(),
-	     certificate_policies(),
-	     require_explicit_policy(),
-	     policy_mappings(),
-	     inhibit_policy_mapping(),
-	     inhibit_any_policy(),
-	     name_constraints(),	     
-	     distribution_points(),
-	     delta_crls(),
-	     private_certificate_extensions()],    
-    [convert(Test) || Test <- lists:flatten(Tests)].
-
-convert({_,Test,_}) ->
-    convert1(Test);
-convert({_,Test,_,_,_,_,_}) ->
-    convert1(Test).
-
-convert1(Test) ->
-    FName = lists:append(string:tokens(Test, " -")),
-    File = filename:join(?MIME, "Signed" ++ FName ++ ".eml"),
-    io:format("Convert ~p~n",[File]),
-    {ok, Mail} = file:read_file(File),
-    Base64  = skip_lines(Mail),
-    %%io:format("~s",[Base64]),
-    Tmp = base64:mime_decode(Base64),
-    file:write_file("pkits/smime-pem/tmp-pkcs7.der", Tmp),
-    Cmd = "openssl pkcs7 -inform der -in pkits/smime-pem/tmp-pkcs7.der"
-	" -print_certs -out pkits/smime-pem/" ++ FName ++ ".pem",
-    case os:cmd(Cmd) of
-	"" -> ok;
-	Err -> 
-	    io:format("~s",[Err]),
-	    erlang:error(bad_cmd)
-    end.
-
-skip_lines(<<"\r\n\r\n", Rest/binary>>) -> Rest;
-skip_lines(<<"\n\n", Rest/binary>>) -> Rest;
-skip_lines(<<_:8, Rest/binary>>) ->
-    skip_lines(Rest).
-
-init_per_testcase(_Func, Config) ->    
-    Datadir = proplists:get_value(data_dir, Config),
-    put(datadir, Datadir),
-    Config.
-
-end_per_testcase(_Func, Config) ->
-    %% Nodes = select_nodes(all, Config, ?FILE, ?LINE),
-    %% rpc:multicall(Nodes, mnesia, lkill, []),
-    Config.
-
-init_per_suite(Config) ->
-    try crypto:start() of
-	ok ->
-	    Config
-    catch _:_ ->
-	    {skip, "Crypto did not start"}
-    end.
-
-end_per_suite(_Config) ->
-    application:stop(crypto).
-
-error(Format, Args, File0, Line) ->
-    File = filename:basename(File0),
-    Pid = group_leader(),
-    Pid ! {failed, File, Line},
-    io:format(Pid, "~s(~p): ERROR"++Format, [File,Line|Args]).
-
-warning(Format, Args, File0, Line) ->
-    File = filename:basename(File0),
-    io:format("~s(~p): Warning "++Format, [File,Line|Args]).