crypto/tls: Add support for ECDHE-ECDSA

Add support for ECDHE-ECDSA (RFC4492), which uses an ephemeral server
key pair to perform ECDH with ECDSA signatures. Like ECDHE-RSA,
ECDHE-ECDSA also provides PFS.

R=agl
CC=golang-dev
https://golang.org/cl/7006047

diff --git a/src/pkg/crypto/crypto.go b/src/pkg/crypto/crypto.go
index ecefc6572545ef8d20ffc7500e523b60c2e34277..52ec40bc2fc94576c1a3b5ae3728d4fe1e1fe331 100644 (file)
--- a/src/pkg/crypto/crypto.go
+++ b/src/pkg/crypto/crypto.go
@@ -77,5 +77,8 @@ func RegisterHash(h Hash, f func() hash.Hash) {
        hashes[h] = f
 }
 
+// PublicKey represents a public key using an unspecified algorithm.
+type PublicKey interface{}
+
 // PrivateKey represents a private key using an unspecified algorithm.
 type PrivateKey interface{}

diff --git a/src/pkg/crypto/tls/cipher_suites.go b/src/pkg/crypto/tls/cipher_suites.go
index 30975f7f7dc13b4cd604e4b72306f858347bfa8f..8404974f28861ffd7cc43ca718e39e61e0c9f642 100644 (file)
--- a/src/pkg/crypto/tls/cipher_suites.go
+++ b/src/pkg/crypto/tls/cipher_suites.go
@@ -55,8 +55,11 @@ var cipherSuites = []*cipherSuite{
        // Ciphersuite order is chosen so that ECDHE comes before plain RSA
        // and RC4 comes before AES (because of the Lucky13 attack).
        {TLS_ECDHE_RSA_WITH_RC4_128_SHA, 16, 20, 0, ecdheRSAKA, true, cipherRC4, macSHA1},
+       {TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, 16, 20, 0, ecdheECDSAKA, true, cipherRC4, macSHA1},
        {TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, 16, 20, 16, ecdheRSAKA, true, cipherAES, macSHA1},
+       {TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, 16, 20, 16, ecdheECDSAKA, true, cipherAES, macSHA1},
        {TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, 32, 20, 16, ecdheRSAKA, true, cipherAES, macSHA1},
+       {TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, 32, 20, 16, ecdheECDSAKA, true, cipherAES, macSHA1},
        {TLS_RSA_WITH_RC4_128_SHA, 16, 20, 0, rsaKA, false, cipherRC4, macSHA1},
        {TLS_RSA_WITH_AES_128_CBC_SHA, 16, 20, 16, rsaKA, false, cipherAES, macSHA1},
        {TLS_RSA_WITH_AES_256_CBC_SHA, 32, 20, 16, rsaKA, false, cipherAES, macSHA1},
@@ -161,8 +164,16 @@ func rsaKA(version uint16) keyAgreement {
        return rsaKeyAgreement{}
 }
 
+func ecdheECDSAKA(version uint16) keyAgreement {
+       return &ecdheKeyAgreement{
+               sigType: signatureECDSA,
+               version: version,
+       }
+}
+
 func ecdheRSAKA(version uint16) keyAgreement {
-       return &ecdheRSAKeyAgreement{
+       return &ecdheKeyAgreement{
+               sigType: signatureRSA,
                version: version,
        }
 }
@@ -186,12 +197,15 @@ func mutualCipherSuite(have []uint16, want uint16) *cipherSuite {
 // A list of the possible cipher suite ids. Taken from
 // http://www.iana.org/assignments/tls-parameters/tls-parameters.xml
 const (
-       TLS_RSA_WITH_RC4_128_SHA            uint16 = 0x0005
-       TLS_RSA_WITH_3DES_EDE_CBC_SHA       uint16 = 0x000a
-       TLS_RSA_WITH_AES_128_CBC_SHA        uint16 = 0x002f
-       TLS_RSA_WITH_AES_256_CBC_SHA        uint16 = 0x0035
-       TLS_ECDHE_RSA_WITH_RC4_128_SHA      uint16 = 0xc011
-       TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA uint16 = 0xc012
-       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA  uint16 = 0xc013
-       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA  uint16 = 0xc014
+       TLS_RSA_WITH_RC4_128_SHA             uint16 = 0x0005
+       TLS_RSA_WITH_3DES_EDE_CBC_SHA        uint16 = 0x000a
+       TLS_RSA_WITH_AES_128_CBC_SHA         uint16 = 0x002f
+       TLS_RSA_WITH_AES_256_CBC_SHA         uint16 = 0x0035
+       TLS_ECDHE_ECDSA_WITH_RC4_128_SHA     uint16 = 0xc007
+       TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA uint16 = 0xc009
+       TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA uint16 = 0xc00a
+       TLS_ECDHE_RSA_WITH_RC4_128_SHA       uint16 = 0xc011
+       TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA  uint16 = 0xc012
+       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA   uint16 = 0xc013
+       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA   uint16 = 0xc014
 )

diff --git a/src/pkg/crypto/tls/common.go b/src/pkg/crypto/tls/common.go
index 109b5548d06c391a99d0e86b76c5256220b8a8f6..5fe177e3ce205d7d6c03c6d1dec6ebc149a6e18a 100644 (file)
--- a/src/pkg/crypto/tls/common.go
+++ b/src/pkg/crypto/tls/common.go
@@ -9,6 +9,7 @@ import (
        "crypto/rand"
        "crypto/x509"
        "io"
+       "math/big"
        "strings"
        "sync"
        "time"
@@ -98,6 +99,12 @@ const (
        certTypeDSSSign    = 2 // A certificate containing a DSA key
        certTypeRSAFixedDH = 3 // A certificate containing a static DH key
        certTypeDSSFixedDH = 4 // A certificate containing a static DH key
+
+       // See RFC4492 sections 3 and 5.5.
+       certTypeECDSASign      = 64 // A certificate containing an ECDSA-capable public key, signed with ECDSA.
+       certTypeRSAFixedECDH   = 65 // A certificate containing an ECDH-capable public key, signed with RSA.
+       certTypeECDSAFixedECDH = 66 // A certificate containing an ECDH-capable public key, signed with ECDSA.
+
        // Rest of these are reserved by the TLS spec
 )
 
@@ -120,10 +127,11 @@ type signatureAndHash struct {
 }
 
 // supportedSignatureAlgorithms contains the signature and hash algorithms that
-// the code will adverse as supported both in a TLS 1.2 ClientHello and
+// the code can advertise as supported both in a TLS 1.2 ClientHello and
 // CertificateRequest.
 var supportedSignatureAlgorithms = []signatureAndHash{
        {hashSHA256, signatureRSA},
+       {hashSHA256, signatureECDSA},
 }
 
 // ConnectionState records basic TLS details about the connection.
@@ -372,7 +380,7 @@ func (c *Config) BuildNameToCertificate() {
 // A Certificate is a chain of one or more certificates, leaf first.
 type Certificate struct {
        Certificate [][]byte
-       PrivateKey  crypto.PrivateKey // supported types: *rsa.PrivateKey
+       PrivateKey  crypto.PrivateKey // supported types: *rsa.PrivateKey, *ecdsa.PrivateKey
        // OCSPStaple contains an optional OCSP response which will be served
        // to clients that request it.
        OCSPStaple []byte
@@ -395,6 +403,13 @@ type handshakeMessage interface {
        unmarshal([]byte) bool
 }
 
+// TODO(jsing): Make these available to both crypto/x509 and crypto/tls.
+type dsaSignature struct {
+       R, S *big.Int
+}
+
+type ecdsaSignature dsaSignature
+
 var emptyConfig Config
 
 func defaultConfig() *Config {

diff --git a/src/pkg/crypto/tls/handshake_client.go b/src/pkg/crypto/tls/handshake_client.go
index a60e21750bed8f76562de21fe49138a5119b1eb6..01b244be1d56b99b9685a989c830d71fa7505f84 100644 (file)
--- a/src/pkg/crypto/tls/handshake_client.go
+++ b/src/pkg/crypto/tls/handshake_client.go
@@ -6,9 +6,11 @@ package tls
 
 import (
        "bytes"
+       "crypto/ecdsa"
        "crypto/rsa"
        "crypto/subtle"
        "crypto/x509"
+       "encoding/asn1"
        "errors"
        "io"
        "strconv"
@@ -124,7 +126,10 @@ func (c *Conn) clientHandshake() error {
                }
        }
 
-       if _, ok := certs[0].PublicKey.(*rsa.PublicKey); !ok {
+       switch certs[0].PublicKey.(type) {
+       case *rsa.PublicKey, *ecdsa.PublicKey:
+               break
+       default:
                return c.sendAlert(alertUnsupportedCertificate)
        }
 
@@ -187,12 +192,13 @@ func (c *Conn) clientHandshake() error {
 
                finishedHash.Write(certReq.marshal())
 
-               // For now, we only know how to sign challenges with RSA
-               rsaAvail := false
+               var rsaAvail, ecdsaAvail bool
                for _, certType := range certReq.certificateTypes {
-                       if certType == certTypeRSASign {
+                       switch certType {
+                       case certTypeRSASign:
                                rsaAvail = true
-                               break
+                       case certTypeECDSASign:
+                               ecdsaAvail = true
                        }
                }
 
@@ -201,7 +207,7 @@ func (c *Conn) clientHandshake() error {
                // certReq.certificateAuthorities
        findCert:
                for i, chain := range c.config.Certificates {
-                       if !rsaAvail {
+                       if !rsaAvail && !ecdsaAvail {
                                continue
                        }
 
@@ -216,7 +222,10 @@ func (c *Conn) clientHandshake() error {
                                        }
                                }
 
-                               if x509Cert.PublicKeyAlgorithm != x509.RSA {
+                               switch {
+                               case rsaAvail && x509Cert.PublicKeyAlgorithm == x509.RSA:
+                               case ecdsaAvail && x509Cert.PublicKeyAlgorithm == x509.ECDSA:
+                               default:
                                        continue findCert
                                }
 
@@ -271,9 +280,21 @@ func (c *Conn) clientHandshake() error {
        }
 
        if chainToSend != nil {
+               var signed []byte
                certVerify := new(certificateVerifyMsg)
-               digest, hashFunc := finishedHash.hashForClientCertificate()
-               signed, err := rsa.SignPKCS1v15(c.config.rand(), c.config.Certificates[0].PrivateKey.(*rsa.PrivateKey), hashFunc, digest)
+               switch key := c.config.Certificates[0].PrivateKey.(type) {
+               case *ecdsa.PrivateKey:
+                       digest, _ := finishedHash.hashForClientCertificate(signatureECDSA)
+                       r, s, err := ecdsa.Sign(c.config.rand(), key, digest)
+                       if err == nil {
+                               signed, err = asn1.Marshal(ecdsaSignature{r, s})
+                       }
+               case *rsa.PrivateKey:
+                       digest, hashFunc := finishedHash.hashForClientCertificate(signatureRSA)
+                       signed, err = rsa.SignPKCS1v15(c.config.rand(), key, hashFunc, digest)
+               default:
+                       err = errors.New("unknown private key type")
+               }
                if err != nil {
                        return c.sendAlert(alertInternalError)
                }

diff --git a/src/pkg/crypto/tls/handshake_client_test.go b/src/pkg/crypto/tls/handshake_client_test.go
index 1823ef10e9924cf0eb4a722e8dfe4ec86b1feee6..11f28d22e42931e0781976fd03128fa3e1ba18ad 100644 (file)
--- a/src/pkg/crypto/tls/handshake_client_test.go
+++ b/src/pkg/crypto/tls/handshake_client_test.go
@@ -39,16 +39,24 @@ func testClientScript(t *testing.T, name string, clientScript [][]byte, config *
        }
 }
 
-func TestHandshakeClientRC4(t *testing.T) {
+func TestHandshakeClientRSARC4(t *testing.T) {
        var config = *testConfig
        config.CipherSuites = []uint16{TLS_RSA_WITH_RC4_128_SHA}
-       testClientScript(t, "RC4", rc4ClientScript, &config)
+       testClientScript(t, "RSA-RC4", rsaRC4ClientScript, &config)
 }
 
-func TestHandshakeClientECDHEAES(t *testing.T) {
+func TestHandshakeClientECDHERSAAES(t *testing.T) {
        var config = *testConfig
        config.CipherSuites = []uint16{TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA}
-       testClientScript(t, "ECDHE-AES", ecdheAESClientScript, &config)
+       testClientScript(t, "ECDHE-RSA-AES", ecdheRSAAESClientScript, &config)
+}
+
+func TestHandshakeClientECDHECDSAAES(t *testing.T) {
+       var config = *testConfig
+       config.CipherSuites = []uint16{TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA}
+       config.Certificates = nil
+       config.BuildNameToCertificate()
+       testClientScript(t, "ECDHE-ECDSA-AES", ecdheECDSAAESClientScript, &config)
 }
 
 func TestLongClientCerticiateChain(t *testing.T) {
@@ -175,7 +183,7 @@ func TestEmptyRecords(t *testing.T) {
 // CSqGSIb3DQEBBQUAA0EAhTZAc8G7GtrUWZ8tonAxRnTsg26oyDxRrzms7EC86CJG
 // HZnWRiok1IsFCEv7NRFukrt3uuQSu/TIXpyBqJdgTA==
 // -----END CERTIFICATE-----
-var rc4ClientScript = [][]byte{
+var rsaRC4ClientScript = [][]byte{
        {
                0x16, 0x03, 0x01, 0x00, 0x4a, 0x01, 0x00, 0x00,
                0x46, 0x03, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
@@ -296,7 +304,7 @@ var rc4ClientScript = [][]byte{
        },
 }
 
-var ecdheAESClientScript = [][]byte{
+var ecdheRSAAESClientScript = [][]byte{
        {
                0x16, 0x03, 0x01, 0x00, 0x4a, 0x01, 0x00, 0x00,
                0x46, 0x03, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
@@ -1811,265 +1819,178 @@ var clientChainCertificateScript = [][]byte{
        },
 }
 
+// $ openssl s_server -tls1_2 -cert server.crt -key server.key \
+//     -cipher ECDHE-RSA-AES128-SHA -port 10443
+// $ go test -test.run "TestRunClient" -connect -ciphersuites=0xc013 \
+//     -minversion=0x0303 -maxversion=0x0303
 var clientTLS12Script = [][]byte{
        {
-               0x16, 0x03, 0x01, 0x00, 0x52, 0x01, 0x00, 0x00,
-               0x4e, 0x03, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00,
+               0x16, 0x03, 0x01, 0x00, 0x54, 0x01, 0x00, 0x00,
+               0x50, 0x03, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00,
                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xc0, 0x13,
-               0x01, 0x00, 0x00, 0x23, 0x00, 0x05, 0x00, 0x05,
+               0x01, 0x00, 0x00, 0x25, 0x00, 0x05, 0x00, 0x05,
                0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0a, 0x00,
                0x08, 0x00, 0x06, 0x00, 0x17, 0x00, 0x18, 0x00,
                0x19, 0x00, 0x0b, 0x00, 0x02, 0x01, 0x00, 0x00,
-               0x0d, 0x00, 0x04, 0x00, 0x02, 0x04, 0x01,
+               0x0d, 0x00, 0x06, 0x00, 0x04, 0x04, 0x01, 0x04,
+               0x03,
        },
        {
                0x16, 0x03, 0x03, 0x00, 0x54, 0x02, 0x00, 0x00,
-               0x50, 0x03, 0x03, 0x51, 0xcd, 0xe6, 0x5e, 0x4c,
-               0x36, 0x2f, 0xe1, 0x38, 0x6c, 0xff, 0x9c, 0xe2,
-               0x0f, 0xbb, 0x04, 0x6d, 0x82, 0xa6, 0x1a, 0x85,
-               0xfa, 0x8c, 0x04, 0xb7, 0xcb, 0xcc, 0x39, 0x02,
-               0xb3, 0x24, 0xff, 0x20, 0xaa, 0x79, 0xb0, 0x04,
-               0x70, 0x39, 0x7a, 0x3b, 0xd7, 0xe0, 0x16, 0x43,
-               0x63, 0xd2, 0x04, 0xc9, 0x4a, 0x49, 0x08, 0xf8,
-               0x1c, 0xf6, 0xba, 0x5f, 0xe2, 0x61, 0x8c, 0xa4,
-               0x3d, 0x81, 0x6a, 0x79, 0xc0, 0x13, 0x00, 0x00,
+               0x50, 0x03, 0x03, 0x51, 0xe5, 0x78, 0x4c, 0x64,
+               0x66, 0xd0, 0xee, 0x0b, 0x8b, 0xfd, 0x9b, 0xe0,
+               0x54, 0x3c, 0x6e, 0x05, 0x04, 0x2f, 0x77, 0x07,
+               0x8c, 0x04, 0xb9, 0xf6, 0xdd, 0xea, 0x1a, 0x7c,
+               0xdf, 0x65, 0x39, 0x20, 0xea, 0xa2, 0xef, 0x53,
+               0x96, 0xf5, 0x0b, 0x8a, 0x47, 0xa0, 0x7c, 0x20,
+               0x53, 0x75, 0xee, 0x87, 0xb9, 0xd3, 0xe2, 0xa6,
+               0x97, 0x64, 0xb9, 0xa6, 0xcc, 0xc0, 0xe5, 0xbf,
+               0x92, 0x1d, 0xee, 0x4d, 0xc0, 0x13, 0x00, 0x00,
                0x08, 0x00, 0x0b, 0x00, 0x04, 0x03, 0x00, 0x01,
-               0x02, 0x16, 0x03, 0x03, 0x03, 0xf5, 0x0b, 0x00,
-               0x03, 0xf1, 0x00, 0x03, 0xee, 0x00, 0x03, 0xeb,
-               0x30, 0x82, 0x03, 0xe7, 0x30, 0x82, 0x02, 0xcf,
+               0x02, 0x16, 0x03, 0x03, 0x02, 0x39, 0x0b, 0x00,
+               0x02, 0x35, 0x00, 0x02, 0x32, 0x00, 0x02, 0x2f,
+               0x30, 0x82, 0x02, 0x2b, 0x30, 0x82, 0x01, 0xd5,
                0xa0, 0x03, 0x02, 0x01, 0x02, 0x02, 0x09, 0x00,
-               0xb9, 0xee, 0xd4, 0xd9, 0x55, 0xa5, 0x9e, 0xb3,
+               0xb1, 0x35, 0x13, 0x65, 0x11, 0x20, 0xc5, 0x92,
                0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86,
                0xf7, 0x0d, 0x01, 0x01, 0x05, 0x05, 0x00, 0x30,
-               0x70, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55,
-               0x04, 0x06, 0x13, 0x02, 0x55, 0x4b, 0x31, 0x16,
-               0x30, 0x14, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x0c,
-               0x0d, 0x4f, 0x70, 0x65, 0x6e, 0x53, 0x53, 0x4c,
-               0x20, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x31, 0x22,
-               0x30, 0x20, 0x06, 0x03, 0x55, 0x04, 0x0b, 0x0c,
-               0x19, 0x46, 0x4f, 0x52, 0x20, 0x54, 0x45, 0x53,
-               0x54, 0x49, 0x4e, 0x47, 0x20, 0x50, 0x55, 0x52,
-               0x50, 0x4f, 0x53, 0x45, 0x53, 0x20, 0x4f, 0x4e,
-               0x4c, 0x59, 0x31, 0x25, 0x30, 0x23, 0x06, 0x03,
-               0x55, 0x04, 0x03, 0x0c, 0x1c, 0x4f, 0x70, 0x65,
-               0x6e, 0x53, 0x53, 0x4c, 0x20, 0x54, 0x65, 0x73,
-               0x74, 0x20, 0x49, 0x6e, 0x74, 0x65, 0x72, 0x6d,
-               0x65, 0x64, 0x69, 0x61, 0x74, 0x65, 0x20, 0x43,
-               0x41, 0x30, 0x1e, 0x17, 0x0d, 0x31, 0x31, 0x31,
-               0x32, 0x30, 0x38, 0x31, 0x34, 0x30, 0x31, 0x34,
-               0x38, 0x5a, 0x17, 0x0d, 0x32, 0x31, 0x31, 0x30,
-               0x31, 0x36, 0x31, 0x34, 0x30, 0x31, 0x34, 0x38,
-               0x5a, 0x30, 0x64, 0x31, 0x0b, 0x30, 0x09, 0x06,
-               0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x55, 0x4b,
-               0x31, 0x16, 0x30, 0x14, 0x06, 0x03, 0x55, 0x04,
-               0x0a, 0x0c, 0x0d, 0x4f, 0x70, 0x65, 0x6e, 0x53,
-               0x53, 0x4c, 0x20, 0x47, 0x72, 0x6f, 0x75, 0x70,
-               0x31, 0x22, 0x30, 0x20, 0x06, 0x03, 0x55, 0x04,
-               0x0b, 0x0c, 0x19, 0x46, 0x4f, 0x52, 0x20, 0x54,
-               0x45, 0x53, 0x54, 0x49, 0x4e, 0x47, 0x20, 0x50,
-               0x55, 0x52, 0x50, 0x4f, 0x53, 0x45, 0x53, 0x20,
-               0x4f, 0x4e, 0x4c, 0x59, 0x31, 0x19, 0x30, 0x17,
-               0x06, 0x03, 0x55, 0x04, 0x03, 0x0c, 0x10, 0x54,
-               0x65, 0x73, 0x74, 0x20, 0x53, 0x65, 0x72, 0x76,
-               0x65, 0x72, 0x20, 0x43, 0x65, 0x72, 0x74, 0x30,
-               0x82, 0x01, 0x22, 0x30, 0x0d, 0x06, 0x09, 0x2a,
-               0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01,
-               0x05, 0x00, 0x03, 0x82, 0x01, 0x0f, 0x00, 0x30,
-               0x82, 0x01, 0x0a, 0x02, 0x82, 0x01, 0x01, 0x00,
-               0xf3, 0x84, 0xf3, 0x92, 0x36, 0xdc, 0xb2, 0x46,
-               0xca, 0x66, 0x7a, 0xe5, 0x29, 0xc5, 0xf3, 0x49,
-               0x28, 0x22, 0xd3, 0xb9, 0xfe, 0xe0, 0xde, 0xe4,
-               0x38, 0xce, 0xee, 0x22, 0x1c, 0xe9, 0x91, 0x3b,
-               0x94, 0xd0, 0x72, 0x2f, 0x87, 0x85, 0x59, 0x4b,
-               0x66, 0xb1, 0xc5, 0xf5, 0x7a, 0x85, 0x5d, 0xc2,
-               0x0f, 0xd3, 0x2e, 0x29, 0x58, 0x36, 0xcc, 0x48,
-               0x6b, 0xa2, 0xa2, 0xb5, 0x26, 0xce, 0x67, 0xe2,
-               0x47, 0xb6, 0xdf, 0x49, 0xd2, 0x3f, 0xfa, 0xa2,
-               0x10, 0xb7, 0xc2, 0x97, 0x44, 0x7e, 0x87, 0x34,
-               0x6d, 0x6d, 0xf2, 0x8b, 0xb4, 0x55, 0x2b, 0xd6,
-               0x21, 0xde, 0x53, 0x4b, 0x90, 0xea, 0xfd, 0xea,
-               0xf9, 0x38, 0x35, 0x2b, 0xf4, 0xe6, 0x9a, 0x0e,
-               0xf6, 0xbb, 0x12, 0xab, 0x87, 0x21, 0xc3, 0x2f,
-               0xbc, 0xf4, 0x06, 0xb8, 0x8f, 0x8e, 0x10, 0x07,
-               0x27, 0x95, 0xe5, 0x42, 0xcb, 0xd1, 0xd5, 0x10,
-               0x8c, 0x92, 0xac, 0xee, 0x0f, 0xdc, 0x23, 0x48,
-               0x89, 0xc9, 0xc6, 0x93, 0x0c, 0x22, 0x02, 0xe7,
-               0x74, 0xe7, 0x25, 0x00, 0xab, 0xf8, 0x0f, 0x5c,
-               0x10, 0xb5, 0x85, 0x3b, 0x66, 0x94, 0xf0, 0xfb,
-               0x4d, 0x57, 0x06, 0x55, 0x21, 0x22, 0x25, 0xdb,
-               0xf3, 0xaa, 0xa9, 0x60, 0xbf, 0x4d, 0xaa, 0x79,
-               0xd1, 0xab, 0x92, 0x48, 0xba, 0x19, 0x8e, 0x12,
-               0xec, 0x68, 0xd9, 0xc6, 0xba, 0xdf, 0xec, 0x5a,
-               0x1c, 0xd8, 0x43, 0xfe, 0xe7, 0x52, 0xc9, 0xcf,
-               0x02, 0xd0, 0xc7, 0x7f, 0xc9, 0x7e, 0xb0, 0x94,
-               0xe3, 0x53, 0x44, 0x58, 0x0b, 0x2e, 0xfd, 0x29,
-               0x74, 0xb5, 0x06, 0x9b, 0x5c, 0x44, 0x8d, 0xfb,
-               0x32, 0x75, 0xa4, 0x3a, 0xa8, 0x67, 0x7b, 0x87,
-               0x32, 0x0a, 0x50, 0x8d, 0xe1, 0xa2, 0x13, 0x4a,
-               0x25, 0xaf, 0xe6, 0x1c, 0xb1, 0x25, 0xbf, 0xb4,
-               0x99, 0xa2, 0x53, 0xd3, 0xa2, 0x02, 0xbf, 0x11,
-               0x02, 0x03, 0x01, 0x00, 0x01, 0xa3, 0x81, 0x8f,
-               0x30, 0x81, 0x8c, 0x30, 0x0c, 0x06, 0x03, 0x55,
-               0x1d, 0x13, 0x01, 0x01, 0xff, 0x04, 0x02, 0x30,
-               0x00, 0x30, 0x0e, 0x06, 0x03, 0x55, 0x1d, 0x0f,
-               0x01, 0x01, 0xff, 0x04, 0x04, 0x03, 0x02, 0x05,
-               0xe0, 0x30, 0x2c, 0x06, 0x09, 0x60, 0x86, 0x48,
-               0x01, 0x86, 0xf8, 0x42, 0x01, 0x0d, 0x04, 0x1f,
-               0x16, 0x1d, 0x4f, 0x70, 0x65, 0x6e, 0x53, 0x53,
-               0x4c, 0x20, 0x47, 0x65, 0x6e, 0x65, 0x72, 0x61,
-               0x74, 0x65, 0x64, 0x20, 0x43, 0x65, 0x72, 0x74,
-               0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x30,
-               0x1d, 0x06, 0x03, 0x55, 0x1d, 0x0e, 0x04, 0x16,
-               0x04, 0x14, 0x82, 0xbc, 0xcf, 0x00, 0x00, 0x13,
-               0xd1, 0xf7, 0x39, 0x25, 0x9a, 0x27, 0xe7, 0xaf,
-               0xd2, 0xef, 0x20, 0x1b, 0x6e, 0xac, 0x30, 0x1f,
-               0x06, 0x03, 0x55, 0x1d, 0x23, 0x04, 0x18, 0x30,
-               0x16, 0x80, 0x14, 0x36, 0xc3, 0x6c, 0x88, 0xe7,
-               0x95, 0xfe, 0xb0, 0xbd, 0xec, 0xce, 0x3e, 0x3d,
-               0x86, 0xab, 0x21, 0x81, 0x87, 0xda, 0xda, 0x30,
+               0x45, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55,
+               0x04, 0x06, 0x13, 0x02, 0x41, 0x55, 0x31, 0x13,
+               0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x08, 0x13,
+               0x0a, 0x53, 0x6f, 0x6d, 0x65, 0x2d, 0x53, 0x74,
+               0x61, 0x74, 0x65, 0x31, 0x21, 0x30, 0x1f, 0x06,
+               0x03, 0x55, 0x04, 0x0a, 0x13, 0x18, 0x49, 0x6e,
+               0x74, 0x65, 0x72, 0x6e, 0x65, 0x74, 0x20, 0x57,
+               0x69, 0x64, 0x67, 0x69, 0x74, 0x73, 0x20, 0x50,
+               0x74, 0x79, 0x20, 0x4c, 0x74, 0x64, 0x30, 0x1e,
+               0x17, 0x0d, 0x31, 0x32, 0x30, 0x34, 0x30, 0x36,
+               0x31, 0x37, 0x31, 0x30, 0x31, 0x33, 0x5a, 0x17,
+               0x0d, 0x31, 0x35, 0x30, 0x34, 0x30, 0x36, 0x31,
+               0x37, 0x31, 0x30, 0x31, 0x33, 0x5a, 0x30, 0x45,
+               0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04,
+               0x06, 0x13, 0x02, 0x41, 0x55, 0x31, 0x13, 0x30,
+               0x11, 0x06, 0x03, 0x55, 0x04, 0x08, 0x13, 0x0a,
+               0x53, 0x6f, 0x6d, 0x65, 0x2d, 0x53, 0x74, 0x61,
+               0x74, 0x65, 0x31, 0x21, 0x30, 0x1f, 0x06, 0x03,
+               0x55, 0x04, 0x0a, 0x13, 0x18, 0x49, 0x6e, 0x74,
+               0x65, 0x72, 0x6e, 0x65, 0x74, 0x20, 0x57, 0x69,
+               0x64, 0x67, 0x69, 0x74, 0x73, 0x20, 0x50, 0x74,
+               0x79, 0x20, 0x4c, 0x74, 0x64, 0x30, 0x5c, 0x30,
                0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7,
-               0x0d, 0x01, 0x01, 0x05, 0x05, 0x00, 0x03, 0x82,
-               0x01, 0x01, 0x00, 0xa9, 0xbd, 0x4d, 0x57, 0x40,
-               0x74, 0xfe, 0x96, 0xe9, 0x2b, 0xd6, 0x78, 0xfd,
-               0xb3, 0x63, 0xcc, 0xf4, 0x0b, 0x4d, 0x12, 0xca,
-               0x5a, 0x74, 0x8d, 0x9b, 0xf2, 0x61, 0xe6, 0xfd,
-               0x06, 0x11, 0x43, 0x84, 0xfc, 0x17, 0xa0, 0xec,
-               0x63, 0x63, 0x36, 0xb9, 0x9e, 0x36, 0x6a, 0xb1,
-               0x02, 0x5a, 0x6a, 0x5b, 0x3f, 0x6a, 0xa1, 0xea,
-               0x05, 0x65, 0xac, 0x7e, 0x40, 0x1a, 0x48, 0x65,
-               0x88, 0xd1, 0x39, 0x4d, 0xd3, 0x4b, 0x77, 0xe9,
-               0xc8, 0xbb, 0x2b, 0x9e, 0x5a, 0xf4, 0x08, 0x34,
-               0x39, 0x47, 0xb9, 0x02, 0x08, 0x31, 0x9a, 0xf1,
-               0xd9, 0x17, 0xc5, 0xe9, 0xa6, 0xa5, 0x96, 0x4b,
-               0x6d, 0x40, 0xa9, 0x5b, 0x65, 0x28, 0xcb, 0xcb,
-               0x00, 0x03, 0x82, 0x63, 0x37, 0xd3, 0xad, 0xb1,
-               0x96, 0x3b, 0x76, 0xf5, 0x17, 0x16, 0x02, 0x7b,
-               0xbd, 0x53, 0x53, 0x46, 0x72, 0x34, 0xd6, 0x08,
-               0x64, 0x9d, 0xbb, 0x43, 0xfb, 0x64, 0xb1, 0x49,
-               0x07, 0x77, 0x09, 0x61, 0x7a, 0x42, 0x17, 0x11,
-               0x30, 0x0c, 0xd9, 0x27, 0x5c, 0xf5, 0x71, 0xb6,
-               0xf0, 0x18, 0x30, 0xf3, 0x7e, 0xf1, 0x85, 0x3f,
-               0x32, 0x7e, 0x4a, 0xaf, 0xb3, 0x10, 0xf7, 0x6c,
-               0xc6, 0x85, 0x4b, 0x2d, 0x27, 0xad, 0x0a, 0x20,
-               0x5c, 0xfb, 0x8d, 0x19, 0x70, 0x34, 0xb9, 0x75,
-               0x5f, 0x7c, 0x87, 0xd5, 0xc3, 0xec, 0x93, 0x13,
-               0x41, 0xfc, 0x73, 0x03, 0xb9, 0x8d, 0x1a, 0xfe,
-               0xf7, 0x26, 0x86, 0x49, 0x03, 0xa9, 0xc5, 0x82,
-               0x3f, 0x80, 0x0d, 0x29, 0x49, 0xb1, 0x8f, 0xed,
-               0x24, 0x1b, 0xfe, 0xcf, 0x58, 0x90, 0x46, 0xe7,
-               0xa8, 0x87, 0xd4, 0x1e, 0x79, 0xef, 0x99, 0x6d,
-               0x18, 0x9f, 0x3e, 0x8b, 0x82, 0x07, 0xc1, 0x43,
-               0xc7, 0xe0, 0x25, 0xb6, 0xf1, 0xd3, 0x00, 0xd7,
-               0x40, 0xab, 0x4b, 0x7f, 0x2b, 0x7a, 0x3e, 0xa6,
-               0x99, 0x4c, 0x54, 0x16, 0x03, 0x03, 0x01, 0x4d,
-               0x0c, 0x00, 0x01, 0x49, 0x03, 0x00, 0x17, 0x41,
-               0x04, 0x8f, 0x92, 0xa0, 0x20, 0xdc, 0x70, 0xce,
-               0xaf, 0x50, 0x44, 0xa8, 0x53, 0x15, 0xbf, 0x74,
-               0x0c, 0xed, 0x60, 0x26, 0xac, 0xb0, 0x07, 0x17,
-               0x59, 0x02, 0x6d, 0x9f, 0x45, 0x57, 0x3b, 0x9c,
-               0x67, 0xae, 0xb8, 0xa6, 0x70, 0xa9, 0x03, 0xb4,
-               0x37, 0x7b, 0xe4, 0x2f, 0x7c, 0x42, 0x4f, 0xaa,
-               0x9a, 0x5d, 0x10, 0x65, 0xc1, 0xa5, 0x33, 0xff,
-               0xc5, 0xdf, 0x24, 0xdb, 0x8f, 0xe2, 0x14, 0xee,
-               0x00, 0x04, 0x01, 0x01, 0x00, 0x76, 0xcf, 0xe6,
-               0x47, 0xcf, 0xc1, 0x58, 0xf5, 0x5d, 0x3a, 0x0b,
-               0xd5, 0x4e, 0xb1, 0x08, 0xa6, 0x03, 0x8b, 0xa3,
-               0x7b, 0x9c, 0xa2, 0x3b, 0x99, 0x7e, 0x42, 0x0d,
-               0x38, 0x6e, 0x9a, 0x5e, 0xf7, 0x45, 0x7f, 0xf3,
-               0x51, 0xa2, 0xe6, 0xae, 0x1c, 0x55, 0x2a, 0x58,
-               0x13, 0x55, 0xa9, 0x93, 0xac, 0x6a, 0x1e, 0xd6,
-               0xd9, 0x98, 0x89, 0x93, 0x16, 0x8f, 0xab, 0xc5,
-               0x65, 0x65, 0x62, 0x68, 0xd8, 0xbf, 0xbd, 0x4e,
-               0x1a, 0x17, 0x24, 0x9c, 0x3c, 0x56, 0xf5, 0x8f,
-               0xda, 0x6e, 0x03, 0xe7, 0xe9, 0xce, 0xe5, 0xb1,
-               0x68, 0xd8, 0x88, 0xdb, 0xde, 0xfe, 0x98, 0xbe,
-               0x9d, 0x1f, 0x86, 0xbf, 0x36, 0xe5, 0xe9, 0x77,
-               0xc3, 0xa6, 0xa3, 0x30, 0x60, 0x9f, 0x36, 0x65,
-               0x4c, 0xe5, 0xb6, 0x3f, 0xf8, 0x15, 0x76, 0xac,
-               0x4f, 0xb5, 0x8a, 0x98, 0xe3, 0xc2, 0xbd, 0x13,
-               0xff, 0x59, 0xfd, 0x22, 0xbf, 0xb3, 0x02, 0xab,
-               0xf1, 0x82, 0xff, 0x4c, 0x41, 0x81, 0x15, 0xa5,
-               0xc7, 0x56, 0x93, 0xc3, 0xb0, 0xd2, 0x70, 0x84,
-               0xb6, 0x27, 0x43, 0x47, 0x38, 0x3a, 0xcf, 0x20,
-               0xa4, 0x97, 0x61, 0xc7, 0xf9, 0xb2, 0x01, 0xea,
-               0x83, 0x72, 0x00, 0x74, 0x3e, 0x41, 0xd0, 0x24,
-               0x32, 0xf7, 0xe1, 0x68, 0xae, 0x06, 0xcb, 0x70,
-               0x06, 0x3a, 0x3a, 0xd3, 0x97, 0x7e, 0xaa, 0x27,
-               0xb7, 0xcc, 0xd3, 0x7f, 0xb2, 0x07, 0x9e, 0x85,
-               0x16, 0x25, 0x28, 0xee, 0xc7, 0x29, 0x09, 0x56,
-               0x94, 0x6c, 0x7e, 0xe4, 0x61, 0x7b, 0xc2, 0xd5,
-               0x03, 0x46, 0x71, 0x69, 0xc0, 0x90, 0x0e, 0x58,
-               0xc6, 0xef, 0xf5, 0x23, 0x03, 0x42, 0x92, 0x1a,
-               0x2f, 0x4b, 0x0a, 0x5d, 0x74, 0x71, 0x28, 0x5a,
-               0x83, 0xf2, 0x00, 0x79, 0x65, 0x89, 0x61, 0x87,
-               0x31, 0xf0, 0x09, 0x89, 0x6a, 0xc4, 0x48, 0xee,
-               0x78, 0xf1, 0x65, 0x3f, 0xe1, 0x16, 0x03, 0x03,
-               0x00, 0x5a, 0x0d, 0x00, 0x00, 0x52, 0x03, 0x01,
-               0x02, 0x40, 0x00, 0x20, 0x06, 0x01, 0x06, 0x02,
-               0x06, 0x03, 0x05, 0x01, 0x05, 0x02, 0x05, 0x03,
-               0x04, 0x01, 0x04, 0x02, 0x04, 0x03, 0x03, 0x01,
-               0x03, 0x02, 0x03, 0x03, 0x02, 0x01, 0x02, 0x02,
-               0x02, 0x03, 0x01, 0x01, 0x00, 0x2a, 0x00, 0x28,
-               0x30, 0x26, 0x31, 0x10, 0x30, 0x0e, 0x06, 0x03,
-               0x55, 0x04, 0x0a, 0x13, 0x07, 0x41, 0x63, 0x6d,
-               0x65, 0x20, 0x43, 0x6f, 0x31, 0x12, 0x30, 0x10,
-               0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x09, 0x31,
-               0x32, 0x37, 0x2e, 0x30, 0x2e, 0x30, 0x2e, 0x31,
-               0x0e, 0x00, 0x00, 0x00,
+               0x0d, 0x01, 0x01, 0x01, 0x05, 0x00, 0x03, 0x4b,
+               0x00, 0x30, 0x48, 0x02, 0x41, 0x00, 0x9f, 0xb3,
+               0xc3, 0x84, 0x27, 0x95, 0xff, 0x12, 0x31, 0x52,
+               0x0f, 0x15, 0xef, 0x46, 0x11, 0xc4, 0xad, 0x80,
+               0xe6, 0x36, 0x5b, 0x0f, 0xdd, 0x80, 0xd7, 0x61,
+               0x8d, 0xe0, 0xfc, 0x72, 0x45, 0x09, 0x34, 0xfe,
+               0x55, 0x66, 0x45, 0x43, 0x4c, 0x68, 0x97, 0x6a,
+               0xfe, 0xa8, 0xa0, 0xa5, 0xdf, 0x5f, 0x78, 0xff,
+               0xee, 0xd7, 0x64, 0xb8, 0x3f, 0x04, 0xcb, 0x6f,
+               0xff, 0x2a, 0xfe, 0xfe, 0xb9, 0xed, 0x02, 0x03,
+               0x01, 0x00, 0x01, 0xa3, 0x81, 0xa7, 0x30, 0x81,
+               0xa4, 0x30, 0x1d, 0x06, 0x03, 0x55, 0x1d, 0x0e,
+               0x04, 0x16, 0x04, 0x14, 0x78, 0xa6, 0x97, 0x9a,
+               0x63, 0xb5, 0xc5, 0xa1, 0xa5, 0x33, 0xba, 0x22,
+               0x7c, 0x23, 0x6e, 0x5b, 0x1b, 0x7a, 0xcc, 0x2b,
+               0x30, 0x75, 0x06, 0x03, 0x55, 0x1d, 0x23, 0x04,
+               0x6e, 0x30, 0x6c, 0x80, 0x14, 0x78, 0xa6, 0x97,
+               0x9a, 0x63, 0xb5, 0xc5, 0xa1, 0xa5, 0x33, 0xba,
+               0x22, 0x7c, 0x23, 0x6e, 0x5b, 0x1b, 0x7a, 0xcc,
+               0x2b, 0xa1, 0x49, 0xa4, 0x47, 0x30, 0x45, 0x31,
+               0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06,
+               0x13, 0x02, 0x41, 0x55, 0x31, 0x13, 0x30, 0x11,
+               0x06, 0x03, 0x55, 0x04, 0x08, 0x13, 0x0a, 0x53,
+               0x6f, 0x6d, 0x65, 0x2d, 0x53, 0x74, 0x61, 0x74,
+               0x65, 0x31, 0x21, 0x30, 0x1f, 0x06, 0x03, 0x55,
+               0x04, 0x0a, 0x13, 0x18, 0x49, 0x6e, 0x74, 0x65,
+               0x72, 0x6e, 0x65, 0x74, 0x20, 0x57, 0x69, 0x64,
+               0x67, 0x69, 0x74, 0x73, 0x20, 0x50, 0x74, 0x79,
+               0x20, 0x4c, 0x74, 0x64, 0x82, 0x09, 0x00, 0xb1,
+               0x35, 0x13, 0x65, 0x11, 0x20, 0xc5, 0x92, 0x30,
+               0x0c, 0x06, 0x03, 0x55, 0x1d, 0x13, 0x04, 0x05,
+               0x30, 0x03, 0x01, 0x01, 0xff, 0x30, 0x0d, 0x06,
+               0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01,
+               0x01, 0x05, 0x05, 0x00, 0x03, 0x41, 0x00, 0x85,
+               0x36, 0x40, 0x73, 0xc1, 0xbb, 0x1a, 0xda, 0xd4,
+               0x59, 0x9f, 0x2d, 0xa2, 0x70, 0x31, 0x46, 0x74,
+               0xec, 0x83, 0x6e, 0xa8, 0xc8, 0x3c, 0x51, 0xaf,
+               0x39, 0xac, 0xec, 0x40, 0xbc, 0xe8, 0x22, 0x46,
+               0x1d, 0x99, 0xd6, 0x46, 0x2a, 0x24, 0xd4, 0x8b,
+               0x05, 0x08, 0x4b, 0xfb, 0x35, 0x11, 0x6e, 0x92,
+               0xbb, 0x77, 0xba, 0xe4, 0x12, 0xbb, 0xf4, 0xc8,
+               0x5e, 0x9c, 0x81, 0xa8, 0x97, 0x60, 0x4c, 0x16,
+               0x03, 0x03, 0x00, 0x8d, 0x0c, 0x00, 0x00, 0x89,
+               0x03, 0x00, 0x17, 0x41, 0x04, 0x39, 0xe9, 0x59,
+               0x24, 0x76, 0xf0, 0x1a, 0xd6, 0x21, 0xa5, 0xbc,
+               0x28, 0xb9, 0xd5, 0x3d, 0xf7, 0xf3, 0xbe, 0x09,
+               0xff, 0xc1, 0x79, 0x33, 0x82, 0xf8, 0xe1, 0x5f,
+               0x1c, 0x34, 0x96, 0x3a, 0x10, 0xf2, 0x2c, 0x69,
+               0xab, 0x57, 0xf6, 0x20, 0xb6, 0x59, 0x1f, 0x8c,
+               0x3e, 0xa2, 0xac, 0x4d, 0xf2, 0x10, 0x58, 0x0b,
+               0x61, 0x27, 0x6c, 0x47, 0xa0, 0x52, 0xc7, 0xe6,
+               0x36, 0xfd, 0xb1, 0xa2, 0x49, 0x04, 0x01, 0x00,
+               0x40, 0x99, 0x7e, 0xf9, 0xed, 0x8b, 0x62, 0x82,
+               0x00, 0xde, 0x5f, 0x2f, 0xb9, 0xf9, 0x9d, 0xa1,
+               0xb0, 0x14, 0x05, 0xc1, 0xdd, 0xa3, 0xb9, 0x08,
+               0xa5, 0x36, 0xb6, 0xfe, 0x8a, 0x5b, 0x2d, 0x6e,
+               0xd8, 0x5a, 0x5c, 0x89, 0x84, 0x85, 0x56, 0x01,
+               0xaf, 0x43, 0xd3, 0x0f, 0x85, 0xd0, 0xb2, 0x35,
+               0x3d, 0x1d, 0xd6, 0x67, 0x52, 0x48, 0xe8, 0x82,
+               0x47, 0xbb, 0x2a, 0x54, 0x4a, 0x55, 0xcd, 0x10,
+               0x54, 0x16, 0x03, 0x03, 0x00, 0x04, 0x0e, 0x00,
+               0x00, 0x00,
        },
        {
-               0x16, 0x03, 0x03, 0x00, 0x07, 0x0b, 0x00, 0x00,
-               0x03, 0x00, 0x00, 0x00, 0x16, 0x03, 0x03, 0x00,
-               0x46, 0x10, 0x00, 0x00, 0x42, 0x41, 0x04, 0x1e,
-               0x18, 0x37, 0xef, 0x0d, 0x19, 0x51, 0x88, 0x35,
-               0x75, 0x71, 0xb5, 0xe5, 0x54, 0x5b, 0x12, 0x2e,
-               0x8f, 0x09, 0x67, 0xfd, 0xa7, 0x24, 0x20, 0x3e,
-               0xb2, 0x56, 0x1c, 0xce, 0x97, 0x28, 0x5e, 0xf8,
-               0x2b, 0x2d, 0x4f, 0x9e, 0xf1, 0x07, 0x9f, 0x6c,
-               0x4b, 0x5b, 0x83, 0x56, 0xe2, 0x32, 0x42, 0xe9,
-               0x58, 0xb6, 0xd7, 0x49, 0xa6, 0xb5, 0x68, 0x1a,
-               0x41, 0x03, 0x56, 0x6b, 0xdc, 0x5a, 0x89, 0x14,
-               0x03, 0x03, 0x00, 0x01, 0x01, 0x16, 0x03, 0x03,
-               0x00, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+               0x16, 0x03, 0x03, 0x00, 0x46, 0x10, 0x00, 0x00,
+               0x42, 0x41, 0x04, 0x1e, 0x18, 0x37, 0xef, 0x0d,
+               0x19, 0x51, 0x88, 0x35, 0x75, 0x71, 0xb5, 0xe5,
+               0x54, 0x5b, 0x12, 0x2e, 0x8f, 0x09, 0x67, 0xfd,
+               0xa7, 0x24, 0x20, 0x3e, 0xb2, 0x56, 0x1c, 0xce,
+               0x97, 0x28, 0x5e, 0xf8, 0x2b, 0x2d, 0x4f, 0x9e,
+               0xf1, 0x07, 0x9f, 0x6c, 0x4b, 0x5b, 0x83, 0x56,
+               0xe2, 0x32, 0x42, 0xe9, 0x58, 0xb6, 0xd7, 0x49,
+               0xa6, 0xb5, 0x68, 0x1a, 0x41, 0x03, 0x56, 0x6b,
+               0xdc, 0x5a, 0x89, 0x14, 0x03, 0x03, 0x00, 0x01,
+               0x01, 0x16, 0x03, 0x03, 0x00, 0x40, 0x00, 0x00,
                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-               0x00, 0x00, 0x1f, 0xb8, 0x47, 0xfb, 0xd2, 0xba,
-               0x62, 0x74, 0x63, 0x54, 0xb8, 0x03, 0x7b, 0xb9,
-               0x05, 0x87, 0x60, 0x6f, 0xb9, 0xfc, 0x79, 0x96,
-               0xce, 0xf0, 0x84, 0x77, 0x23, 0x1b, 0x44, 0x3f,
-               0x33, 0xe8, 0x71, 0x97, 0x9d, 0xd3, 0x7d, 0x43,
-               0x40, 0xd3, 0x95, 0x65, 0x1f, 0x2c, 0x30, 0xfd,
-               0x7f, 0xac,
+               0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x4e, 0xcb,
+               0x97, 0x41, 0x63, 0x39, 0xeb, 0xda, 0x04, 0x39,
+               0xfb, 0x67, 0x1d, 0x6d, 0xf8, 0x58, 0xd1, 0x22,
+               0x35, 0xe3, 0xc3, 0x9d, 0xfc, 0x4e, 0xcc, 0x71,
+               0x93, 0x78, 0x64, 0x39, 0x04, 0xa0, 0xa9, 0x41,
+               0xcf, 0x4c, 0xd6, 0x34, 0xad, 0x5c, 0xc9, 0x7a,
+               0x44, 0xb1, 0x1d, 0x77, 0x52, 0x01,
        },
        {
                0x14, 0x03, 0x03, 0x00, 0x01, 0x01, 0x16, 0x03,
-               0x03, 0x00, 0x40, 0x64, 0x09, 0x6c, 0x06, 0x5a,
-               0x01, 0x24, 0x10, 0xd9, 0x92, 0x66, 0xe6, 0x28,
-               0x43, 0x2f, 0xba, 0x0b, 0x17, 0x61, 0x55, 0x42,
-               0x9d, 0xc3, 0x59, 0xba, 0x57, 0x19, 0x1b, 0x74,
-               0x22, 0x40, 0xc7, 0x13, 0x95, 0x83, 0xe6, 0xf3,
-               0x11, 0x62, 0xe6, 0xde, 0xfc, 0xf3, 0x1a, 0xd1,
-               0x3d, 0xce, 0xd1, 0xf9, 0xeb, 0x2e, 0x13, 0x39,
-               0xa6, 0xdb, 0x04, 0x79, 0xaa, 0x2d, 0xe1, 0xa4,
-               0xd0, 0xf9, 0x36,
+               0x03, 0x00, 0x40, 0x55, 0x75, 0x8a, 0x57, 0xb4,
+               0x53, 0xa2, 0x8f, 0xbf, 0xd3, 0x79, 0x72, 0x1e,
+               0x94, 0x53, 0xb3, 0x03, 0x9d, 0x4d, 0x8a, 0x1f,
+               0xbd, 0x25, 0x79, 0x69, 0x61, 0x65, 0xd7, 0x26,
+               0xad, 0xa6, 0x0e, 0x89, 0x83, 0xc0, 0xbe, 0x46,
+               0x51, 0xe4, 0x38, 0x7b, 0x65, 0x74, 0x6d, 0x24,
+               0xff, 0xd4, 0x9f, 0xcb, 0xfc, 0xd7, 0x03, 0xaa,
+               0x7b, 0x8e, 0x30, 0x09, 0xdb, 0xaa, 0x9d, 0xad,
+               0xcd, 0x56, 0xcf,
        },
        {
                0x17, 0x03, 0x03, 0x00, 0x30, 0x00, 0x00, 0x00,
                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-               0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x88, 0x3d,
-               0xcb, 0x65, 0xc1, 0xac, 0x94, 0xc5, 0x1d, 0x4d,
-               0xc5, 0x1e, 0xd4, 0x17, 0xe3, 0x83, 0xac, 0x14,
-               0x80, 0x92, 0x2d, 0x5b, 0x42, 0x19, 0xcb, 0x51,
-               0xc9, 0x48, 0xdf, 0xf6, 0x27, 0x15, 0x03, 0x03,
+               0x00, 0x00, 0x00, 0x00, 0x00, 0xab, 0x01, 0x46,
+               0xa8, 0xdd, 0x62, 0x73, 0x67, 0x99, 0x01, 0x42,
+               0xb2, 0x9e, 0x22, 0x18, 0xf5, 0x8f, 0x10, 0x97,
+               0xde, 0x58, 0x24, 0x34, 0x36, 0xa2, 0x5d, 0xf4,
+               0x96, 0x2a, 0xed, 0x6c, 0x06, 0x15, 0x03, 0x03,
                0x00, 0x30, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-               0x00, 0x00, 0xf7, 0xc2, 0xed, 0x1a, 0x88, 0xb6,
-               0xb8, 0x26, 0x04, 0x31, 0x89, 0xab, 0x29, 0x34,
-               0xce, 0x84, 0x81, 0x33, 0x64, 0x8e, 0x53, 0xa3,
-               0xaf, 0x8b, 0x5a, 0x50, 0x43, 0xab, 0x77, 0x77,
-               0xa3, 0xc7,
+               0x00, 0x00, 0x9f, 0x7a, 0x9f, 0xab, 0xf5, 0x4e,
+               0x1c, 0x4e, 0xf4, 0xcb, 0x1a, 0x39, 0xae, 0x21,
+               0x85, 0x39, 0xc4, 0x51, 0xac, 0x14, 0xde, 0xa0,
+               0xe7, 0x70, 0x7c, 0x6a, 0x53, 0x54, 0x19, 0xbc,
+               0x2f, 0x32,
        },
 }
 
@@ -2358,3 +2279,208 @@ var testClientChainCertificate = fromHex(
                "77796d5a695731673d3d0a2d2d2d2d2d454e4420" +
                "43455254494649434154452d2d2d2d2d0a",
 )
+
+// Script of interaction with openssl implementation:
+//
+//   openssl s_server -cipher ECDHE-ECDSA-AES128-SHA \
+//     -key server.key -cert server.crt -port 10443
+//
+// The values for this test are obtained by building and running in client mode:
+//   % go test -test.run "TestRunClient" -connect -ciphersuites=0xc009
+// The recorded bytes are written to stdout.
+//
+// The server private key is:
+//
+// -----BEGIN EC PARAMETERS-----
+// BgUrgQQAIw==
+// -----END EC PARAMETERS-----
+// -----BEGIN EC PRIVATE KEY-----
+// MIHcAgEBBEIBmIPpCa0Kyeo9M/nq5mHxeFIGlw+MqakWcvHu3Keo7xK9ZWG7JG3a
+// XfS01efjqSZJvF2DoL+Sly4A5iBn0Me9mdegBwYFK4EEACOhgYkDgYYABADEoe2+
+// mPkLSHM2fsMWVhEi8j1TwztNIT3Na3Xm9rDcmt8mwbyyh/ByMnyzZC8ckLzqaCMQ
+// fv7jJcBIOmngKG3TNwDvBGLdDaCccGKD2IHTZDGqnpcxvZawaMCbI952ZD8aXH/p
+// Eg5YWLZfcN2b2OrV1/XVzLm2nzBmW2aaIOIn5b/+Ow==
+// -----END EC PRIVATE KEY-----
+//
+// and certificate is:
+//
+// -----BEGIN CERTIFICATE-----
+// MIICADCCAWICCQC4vy1HoNLr9DAJBgcqhkjOPQQBMEUxCzAJBgNVBAYTAkFVMRMw
+// EQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0
+// eSBMdGQwHhcNMTIxMTIyMTUwNjMyWhcNMjIxMTIwMTUwNjMyWjBFMQswCQYDVQQG
+// EwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lk
+// Z2l0cyBQdHkgTHRkMIGbMBAGByqGSM49AgEGBSuBBAAjA4GGAAQAxKHtvpj5C0hz
+// Nn7DFlYRIvI9U8M7TSE9zWt15vaw3JrfJsG8sofwcjJ8s2QvHJC86mgjEH7+4yXA
+// SDpp4Cht0zcA7wRi3Q2gnHBig9iB02Qxqp6XMb2WsGjAmyPedmQ/Glx/6RIOWFi2
+// X3Ddm9jq1df11cy5tp8wZltmmiDiJ+W//jswCQYHKoZIzj0EAQOBjAAwgYgCQgGI
+// ok/r4kXFSH0brPXtmJ2uR3DAXhu2L73xtk23YUDTEaLO7gt+kn7/dp3DO36lP876
+// EOJZ7EctfKzaTpcOFaBv0AJCAU38vmcTnC0FDr0/o4wlwTMTgw2UBrvUN3r27HrJ
+// hi7d1xFpf4V8Vt77MXgr5Md4Da7Lvp5ONiQxe2oPOZUSB48q
+// -----END CERTIFICATE-----
+var ecdheECDSAAESClientScript = [][]byte{
+       {
+               0x16, 0x03, 0x01, 0x00, 0x4a, 0x01, 0x00, 0x00,
+               0x46, 0x03, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
+               0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+               0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+               0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+               0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xc0, 0x09,
+               0x01, 0x00, 0x00, 0x1b, 0x00, 0x05, 0x00, 0x05,
+               0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0a, 0x00,
+               0x08, 0x00, 0x06, 0x00, 0x17, 0x00, 0x18, 0x00,
+               0x19, 0x00, 0x0b, 0x00, 0x02, 0x01, 0x00,
+       },
+       {
+               0x16, 0x03, 0x01, 0x00, 0x54, 0x02, 0x00, 0x00,
+               0x50, 0x03, 0x01, 0x50, 0xd7, 0x19, 0xc9, 0x03,
+               0xc2, 0x3a, 0xc6, 0x1f, 0x0a, 0x84, 0x9e, 0xd7,
+               0xf4, 0x7e, 0x07, 0x6d, 0xa8, 0xe4, 0xa9, 0x4f,
+               0x22, 0x50, 0xa2, 0x19, 0x24, 0x44, 0x42, 0x65,
+               0xaa, 0xba, 0x3a, 0x20, 0x90, 0x70, 0xb7, 0xe5,
+               0x57, 0xed, 0xb1, 0xb1, 0x43, 0x4b, 0xa1, 0x4e,
+               0xee, 0x7a, 0x5b, 0x88, 0xf6, 0xa6, 0x73, 0x3b,
+               0xcb, 0xa7, 0xbd, 0x57, 0x50, 0xf2, 0x72, 0x8c,
+               0xbc, 0x45, 0x73, 0xaa, 0xc0, 0x09, 0x00, 0x00,
+               0x08, 0x00, 0x0b, 0x00, 0x04, 0x03, 0x00, 0x01,
+               0x02, 0x16, 0x03, 0x01, 0x02, 0x0e, 0x0b, 0x00,
+               0x02, 0x0a, 0x00, 0x02, 0x07, 0x00, 0x02, 0x04,
+               0x30, 0x82, 0x02, 0x00, 0x30, 0x82, 0x01, 0x62,
+               0x02, 0x09, 0x00, 0xb8, 0xbf, 0x2d, 0x47, 0xa0,
+               0xd2, 0xeb, 0xf4, 0x30, 0x09, 0x06, 0x07, 0x2a,
+               0x86, 0x48, 0xce, 0x3d, 0x04, 0x01, 0x30, 0x45,
+               0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04,
+               0x06, 0x13, 0x02, 0x41, 0x55, 0x31, 0x13, 0x30,
+               0x11, 0x06, 0x03, 0x55, 0x04, 0x08, 0x13, 0x0a,
+               0x53, 0x6f, 0x6d, 0x65, 0x2d, 0x53, 0x74, 0x61,
+               0x74, 0x65, 0x31, 0x21, 0x30, 0x1f, 0x06, 0x03,
+               0x55, 0x04, 0x0a, 0x13, 0x18, 0x49, 0x6e, 0x74,
+               0x65, 0x72, 0x6e, 0x65, 0x74, 0x20, 0x57, 0x69,
+               0x64, 0x67, 0x69, 0x74, 0x73, 0x20, 0x50, 0x74,
+               0x79, 0x20, 0x4c, 0x74, 0x64, 0x30, 0x1e, 0x17,
+               0x0d, 0x31, 0x32, 0x31, 0x31, 0x32, 0x32, 0x31,
+               0x35, 0x30, 0x36, 0x33, 0x32, 0x5a, 0x17, 0x0d,
+               0x32, 0x32, 0x31, 0x31, 0x32, 0x30, 0x31, 0x35,
+               0x30, 0x36, 0x33, 0x32, 0x5a, 0x30, 0x45, 0x31,
+               0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06,
+               0x13, 0x02, 0x41, 0x55, 0x31, 0x13, 0x30, 0x11,
+               0x06, 0x03, 0x55, 0x04, 0x08, 0x13, 0x0a, 0x53,
+               0x6f, 0x6d, 0x65, 0x2d, 0x53, 0x74, 0x61, 0x74,
+               0x65, 0x31, 0x21, 0x30, 0x1f, 0x06, 0x03, 0x55,
+               0x04, 0x0a, 0x13, 0x18, 0x49, 0x6e, 0x74, 0x65,
+               0x72, 0x6e, 0x65, 0x74, 0x20, 0x57, 0x69, 0x64,
+               0x67, 0x69, 0x74, 0x73, 0x20, 0x50, 0x74, 0x79,
+               0x20, 0x4c, 0x74, 0x64, 0x30, 0x81, 0x9b, 0x30,
+               0x10, 0x06, 0x07, 0x2a, 0x86, 0x48, 0xce, 0x3d,
+               0x02, 0x01, 0x06, 0x05, 0x2b, 0x81, 0x04, 0x00,
+               0x23, 0x03, 0x81, 0x86, 0x00, 0x04, 0x00, 0xc4,
+               0xa1, 0xed, 0xbe, 0x98, 0xf9, 0x0b, 0x48, 0x73,
+               0x36, 0x7e, 0xc3, 0x16, 0x56, 0x11, 0x22, 0xf2,
+               0x3d, 0x53, 0xc3, 0x3b, 0x4d, 0x21, 0x3d, 0xcd,
+               0x6b, 0x75, 0xe6, 0xf6, 0xb0, 0xdc, 0x9a, 0xdf,
+               0x26, 0xc1, 0xbc, 0xb2, 0x87, 0xf0, 0x72, 0x32,
+               0x7c, 0xb3, 0x64, 0x2f, 0x1c, 0x90, 0xbc, 0xea,
+               0x68, 0x23, 0x10, 0x7e, 0xfe, 0xe3, 0x25, 0xc0,
+               0x48, 0x3a, 0x69, 0xe0, 0x28, 0x6d, 0xd3, 0x37,
+               0x00, 0xef, 0x04, 0x62, 0xdd, 0x0d, 0xa0, 0x9c,
+               0x70, 0x62, 0x83, 0xd8, 0x81, 0xd3, 0x64, 0x31,
+               0xaa, 0x9e, 0x97, 0x31, 0xbd, 0x96, 0xb0, 0x68,
+               0xc0, 0x9b, 0x23, 0xde, 0x76, 0x64, 0x3f, 0x1a,
+               0x5c, 0x7f, 0xe9, 0x12, 0x0e, 0x58, 0x58, 0xb6,
+               0x5f, 0x70, 0xdd, 0x9b, 0xd8, 0xea, 0xd5, 0xd7,
+               0xf5, 0xd5, 0xcc, 0xb9, 0xb6, 0x9f, 0x30, 0x66,
+               0x5b, 0x66, 0x9a, 0x20, 0xe2, 0x27, 0xe5, 0xbf,
+               0xfe, 0x3b, 0x30, 0x09, 0x06, 0x07, 0x2a, 0x86,
+               0x48, 0xce, 0x3d, 0x04, 0x01, 0x03, 0x81, 0x8c,
+               0x00, 0x30, 0x81, 0x88, 0x02, 0x42, 0x01, 0x88,
+               0xa2, 0x4f, 0xeb, 0xe2, 0x45, 0xc5, 0x48, 0x7d,
+               0x1b, 0xac, 0xf5, 0xed, 0x98, 0x9d, 0xae, 0x47,
+               0x70, 0xc0, 0x5e, 0x1b, 0xb6, 0x2f, 0xbd, 0xf1,
+               0xb6, 0x4d, 0xb7, 0x61, 0x40, 0xd3, 0x11, 0xa2,
+               0xce, 0xee, 0x0b, 0x7e, 0x92, 0x7e, 0xff, 0x76,
+               0x9d, 0xc3, 0x3b, 0x7e, 0xa5, 0x3f, 0xce, 0xfa,
+               0x10, 0xe2, 0x59, 0xec, 0x47, 0x2d, 0x7c, 0xac,
+               0xda, 0x4e, 0x97, 0x0e, 0x15, 0xa0, 0x6f, 0xd0,
+               0x02, 0x42, 0x01, 0x4d, 0xfc, 0xbe, 0x67, 0x13,
+               0x9c, 0x2d, 0x05, 0x0e, 0xbd, 0x3f, 0xa3, 0x8c,
+               0x25, 0xc1, 0x33, 0x13, 0x83, 0x0d, 0x94, 0x06,
+               0xbb, 0xd4, 0x37, 0x7a, 0xf6, 0xec, 0x7a, 0xc9,
+               0x86, 0x2e, 0xdd, 0xd7, 0x11, 0x69, 0x7f, 0x85,
+               0x7c, 0x56, 0xde, 0xfb, 0x31, 0x78, 0x2b, 0xe4,
+               0xc7, 0x78, 0x0d, 0xae, 0xcb, 0xbe, 0x9e, 0x4e,
+               0x36, 0x24, 0x31, 0x7b, 0x6a, 0x0f, 0x39, 0x95,
+               0x12, 0x07, 0x8f, 0x2a, 0x16, 0x03, 0x01, 0x00,
+               0xd6, 0x0c, 0x00, 0x00, 0xd2, 0x03, 0x00, 0x17,
+               0x41, 0x04, 0x33, 0xed, 0xe1, 0x10, 0x3d, 0xe2,
+               0xb0, 0x81, 0x5e, 0x01, 0x1b, 0x00, 0x4a, 0x7d,
+               0xdc, 0xc5, 0x78, 0x02, 0xb1, 0x9a, 0x78, 0x92,
+               0x34, 0xd9, 0x23, 0xcc, 0x01, 0xfb, 0x0c, 0x49,
+               0x1c, 0x4a, 0x59, 0x8a, 0x80, 0x1b, 0x34, 0xf0,
+               0xe8, 0x87, 0x1b, 0x7c, 0xfb, 0x72, 0xf5, 0xea,
+               0xf9, 0xf3, 0xff, 0xa6, 0x3e, 0x4e, 0xac, 0xbc,
+               0xee, 0x14, 0x2b, 0x87, 0xd4, 0x0b, 0xda, 0x19,
+               0x60, 0x2b, 0x00, 0x8b, 0x30, 0x81, 0x88, 0x02,
+               0x42, 0x01, 0x75, 0x46, 0x4f, 0x97, 0x9f, 0xc5,
+               0xf9, 0x4c, 0x38, 0xcf, 0x3b, 0x37, 0x1a, 0x6b,
+               0x53, 0xfc, 0x05, 0x73, 0x7d, 0x98, 0x2c, 0x5b,
+               0x76, 0xd4, 0x37, 0x1f, 0x50, 0x6d, 0xad, 0xc6,
+               0x0f, 0x8f, 0x7b, 0xcc, 0x60, 0x8e, 0x04, 0x00,
+               0x21, 0x80, 0xa8, 0xa5, 0x98, 0xf2, 0x42, 0xf2,
+               0xc3, 0xf6, 0x44, 0x50, 0xc4, 0x7a, 0xae, 0x6f,
+               0x74, 0xa0, 0x7f, 0x07, 0x7a, 0x0b, 0xbb, 0x41,
+               0x9e, 0x3c, 0x0b, 0x02, 0x42, 0x01, 0xbe, 0x64,
+               0xaa, 0x12, 0x03, 0xfb, 0xd8, 0x4f, 0x93, 0xf9,
+               0x92, 0x54, 0x0d, 0x9c, 0x9d, 0x53, 0x88, 0x19,
+               0x69, 0x94, 0xfc, 0xd6, 0xf7, 0x60, 0xcf, 0x70,
+               0x64, 0x15, 0x1b, 0x02, 0x22, 0x56, 0xb0, 0x2c,
+               0xb1, 0x72, 0x4c, 0x9e, 0x7b, 0xf0, 0x53, 0x97,
+               0x43, 0xac, 0x11, 0x62, 0xe5, 0x5a, 0xf1, 0x7e,
+               0x87, 0x8f, 0x5c, 0x43, 0x1d, 0xae, 0x56, 0x28,
+               0xdb, 0x76, 0x15, 0xd8, 0x1c, 0x73, 0xce, 0x16,
+               0x03, 0x01, 0x00, 0x04, 0x0e, 0x00, 0x00, 0x00,
+       },
+       {
+               0x16, 0x03, 0x01, 0x00, 0x46, 0x10, 0x00, 0x00,
+               0x42, 0x41, 0x04, 0x1e, 0x18, 0x37, 0xef, 0x0d,
+               0x19, 0x51, 0x88, 0x35, 0x75, 0x71, 0xb5, 0xe5,
+               0x54, 0x5b, 0x12, 0x2e, 0x8f, 0x09, 0x67, 0xfd,
+               0xa7, 0x24, 0x20, 0x3e, 0xb2, 0x56, 0x1c, 0xce,
+               0x97, 0x28, 0x5e, 0xf8, 0x2b, 0x2d, 0x4f, 0x9e,
+               0xf1, 0x07, 0x9f, 0x6c, 0x4b, 0x5b, 0x83, 0x56,
+               0xe2, 0x32, 0x42, 0xe9, 0x58, 0xb6, 0xd7, 0x49,
+               0xa6, 0xb5, 0x68, 0x1a, 0x41, 0x03, 0x56, 0x6b,
+               0xdc, 0x5a, 0x89, 0x14, 0x03, 0x01, 0x00, 0x01,
+               0x01, 0x16, 0x03, 0x01, 0x00, 0x30, 0x1a, 0x45,
+               0x92, 0x3b, 0xac, 0x8d, 0x91, 0x89, 0xd3, 0x2c,
+               0xf4, 0x3c, 0x5f, 0x70, 0xf1, 0x79, 0xa5, 0x6a,
+               0xcf, 0x97, 0x8f, 0x3f, 0x73, 0x08, 0xca, 0x3f,
+               0x55, 0xb0, 0x28, 0xd1, 0x6f, 0xcd, 0x9b, 0xca,
+               0xb6, 0xb7, 0xd0, 0xa5, 0x21, 0x5b, 0x08, 0xf8,
+               0x42, 0xe2, 0xdf, 0x25, 0x6a, 0x16,
+       },
+       {
+               0x14, 0x03, 0x01, 0x00, 0x01, 0x01, 0x16, 0x03,
+               0x01, 0x00, 0x30, 0x30, 0x83, 0xb6, 0x51, 0x8a,
+               0x85, 0x4a, 0xee, 0xe4, 0xb6, 0xae, 0xf3, 0xc1,
+               0xdc, 0xd2, 0x04, 0xb3, 0xd0, 0x25, 0x47, 0x5f,
+               0xac, 0x83, 0xa3, 0x7d, 0xcf, 0x47, 0x92, 0xed,
+               0x92, 0x6c, 0xd1, 0x6e, 0xfd, 0x63, 0xf5, 0x2d,
+               0x89, 0xd8, 0x04, 0x8c, 0x62, 0x71, 0xae, 0x5e,
+               0x32, 0x48, 0xf8,
+       },
+       {
+               0x17, 0x03, 0x01, 0x00, 0x20, 0xcf, 0x5e, 0xba,
+               0xf4, 0x47, 0x32, 0x35, 0x9b, 0x85, 0xdc, 0xb3,
+               0xff, 0x77, 0x90, 0xd9, 0x2b, 0xbd, 0x59, 0x2a,
+               0x33, 0xe4, 0x6e, 0x9b, 0xfc, 0x1c, 0x73, 0x3f,
+               0x5e, 0x1e, 0xe3, 0xa4, 0xc2, 0x17, 0x03, 0x01,
+               0x00, 0x20, 0x05, 0xdf, 0x2d, 0x9b, 0x29, 0x7f,
+               0x97, 0xcd, 0x49, 0x04, 0x53, 0x22, 0x1a, 0xa1,
+               0xa1, 0xe6, 0x38, 0x3a, 0x56, 0x37, 0x1f, 0xd8,
+               0x3a, 0x12, 0x2c, 0xf0, 0xeb, 0x61, 0x35, 0x76,
+               0xe5, 0xf0, 0x15, 0x03, 0x01, 0x00, 0x20, 0xa5,
+               0x56, 0xb5, 0x49, 0x4b, 0xc2, 0xd4, 0x4c, 0xf6,
+               0x95, 0x15, 0x7d, 0x41, 0x1d, 0x5c, 0x00, 0x0e,
+               0x20, 0xb1, 0x0a, 0xbc, 0xc9, 0x2a, 0x09, 0x17,
+               0xb4, 0xaa, 0x1c, 0x79, 0xda, 0x79, 0x27,
+       },
+}

diff --git a/src/pkg/crypto/tls/handshake_server.go b/src/pkg/crypto/tls/handshake_server.go
index c7ee88de068fbaab23f08209194445540a2ee51b..6c5e96c42ee6caadba381ce478d9b733f0122c6f 100644 (file)
--- a/src/pkg/crypto/tls/handshake_server.go
+++ b/src/pkg/crypto/tls/handshake_server.go
@@ -5,9 +5,12 @@
 package tls
 
 import (
+       "crypto"
+       "crypto/ecdsa"
        "crypto/rsa"
        "crypto/subtle"
        "crypto/x509"
+       "encoding/asn1"
        "errors"
        "io"
 )
@@ -305,7 +308,10 @@ func (hs *serverHandshakeState) doFullHandshake() error {
        if config.ClientAuth >= RequestClientCert {
                // Request a client certificate
                certReq := new(certificateRequestMsg)
-               certReq.certificateTypes = []byte{certTypeRSASign}
+               certReq.certificateTypes = []byte{
+                       byte(certTypeRSASign),
+                       byte(certTypeECDSASign),
+               }
                if c.vers >= VersionTLS12 {
                        certReq.hasSignatureAndHash = true
                        certReq.signatureAndHashes = supportedSignatureAlgorithms
@@ -327,7 +333,7 @@ func (hs *serverHandshakeState) doFullHandshake() error {
        hs.finishedHash.Write(helloDone.marshal())
        c.writeRecord(recordTypeHandshake, helloDone.marshal())
 
-       var pub *rsa.PublicKey // public key for client auth, if any
+       var pub crypto.PublicKey // public key for client auth, if any
 
        msg, err := c.readHandshake()
        if err != nil {
@@ -372,7 +378,7 @@ func (hs *serverHandshakeState) doFullHandshake() error {
 
        // If we received a client cert in response to our certificate request message,
        // the client will send us a certificateVerifyMsg immediately after the
-       // clientKeyExchangeMsg.  This message is a MD5SHA1 digest of all preceding
+       // clientKeyExchangeMsg.  This message is a digest of all preceding
        // handshake-layer messages that is signed using the private key corresponding
        // to the client's certificate. This allows us to verify that the client is in
        // possession of the private key of the certificate.
@@ -386,8 +392,25 @@ func (hs *serverHandshakeState) doFullHandshake() error {
                        return c.sendAlert(alertUnexpectedMessage)
                }
 
-               digest, hashFunc := hs.finishedHash.hashForClientCertificate()
-               err = rsa.VerifyPKCS1v15(pub, hashFunc, digest, certVerify.signature)
+               switch key := pub.(type) {
+               case *ecdsa.PublicKey:
+                       ecdsaSig := new(ecdsaSignature)
+                       if _, err = asn1.Unmarshal(certVerify.signature, ecdsaSig); err != nil {
+                               break
+                       }
+                       if ecdsaSig.R.Sign() <= 0 || ecdsaSig.S.Sign() <= 0 {
+                               err = errors.New("ECDSA signature contained zero or negative values")
+                               break
+                       }
+                       digest, _ := hs.finishedHash.hashForClientCertificate(signatureECDSA)
+                       if !ecdsa.Verify(key, digest, ecdsaSig.R, ecdsaSig.S) {
+                               err = errors.New("ECDSA verification failure")
+                               break
+                       }
+               case *rsa.PublicKey:
+                       digest, hashFunc := hs.finishedHash.hashForClientCertificate(signatureRSA)
+                       err = rsa.VerifyPKCS1v15(key, hashFunc, digest, certVerify.signature)
+               }
                if err != nil {
                        c.sendAlert(alertBadCertificate)
                        return errors.New("could not validate signature of connection nonces: " + err.Error())
@@ -507,7 +530,7 @@ func (hs *serverHandshakeState) sendFinished() error {
 // processCertsFromClient takes a chain of client certificates either from a
 // Certificates message or from a sessionState and verifies them. It returns
 // the public key of the leaf certificate.
-func (hs *serverHandshakeState) processCertsFromClient(certificates [][]byte) (*rsa.PublicKey, error) {
+func (hs *serverHandshakeState) processCertsFromClient(certificates [][]byte) (crypto.PublicKey, error) {
        c := hs.c
 
        hs.certsFromClient = certificates
@@ -554,8 +577,11 @@ func (hs *serverHandshakeState) processCertsFromClient(certificates [][]byte) (*
        }
 
        if len(certs) > 0 {
-               pub, ok := certs[0].PublicKey.(*rsa.PublicKey)
-               if !ok {
+               var pub crypto.PublicKey
+               switch key := certs[0].PublicKey.(type) {
+               case *ecdsa.PublicKey, *rsa.PublicKey:
+                       pub = key
+               default:
                        return nil, c.sendAlert(alertUnsupportedCertificate)
                }
                c.peerCertificates = certs

diff --git a/src/pkg/crypto/tls/handshake_server_test.go b/src/pkg/crypto/tls/handshake_server_test.go
index 6739a3e0fe40f650862a3f9d1ef65a1e51cf1cfc..4f57e506dd7f4822033a10443e58cb44aee4ae16 100644 (file)
--- a/src/pkg/crypto/tls/handshake_server_test.go
+++ b/src/pkg/crypto/tls/handshake_server_test.go
@@ -6,6 +6,8 @@ package tls
 
 import (
        "bytes"
+       "crypto/ecdsa"
+       "crypto/elliptic"
        "crypto/rsa"
        "crypto/x509"
        "encoding/hex"
@@ -41,10 +43,10 @@ func init() {
        testConfig.Time = func() time.Time { return time.Unix(0, 0) }
        testConfig.Rand = zeroSource{}
        testConfig.Certificates = make([]Certificate, 2)
-       testConfig.Certificates[0].Certificate = [][]byte{testCertificate}
-       testConfig.Certificates[0].PrivateKey = testPrivateKey
+       testConfig.Certificates[0].Certificate = [][]byte{testRSACertificate}
+       testConfig.Certificates[0].PrivateKey = testRSAPrivateKey
        testConfig.Certificates[1].Certificate = [][]byte{testSNICertificate}
-       testConfig.Certificates[1].PrivateKey = testPrivateKey
+       testConfig.Certificates[1].PrivateKey = testRSAPrivateKey
        testConfig.BuildNameToCertificate()
        testConfig.CipherSuites = []uint16{TLS_RSA_WITH_RC4_128_SHA}
        testConfig.InsecureSkipVerify = true
@@ -214,22 +216,33 @@ func testServerScript(t *testing.T, name string, serverScript [][]byte, config *
        }
 }
 
-func TestHandshakeServerRC4(t *testing.T) {
-       testServerScript(t, "RC4", rc4ServerScript, testConfig, nil)
+func TestHandshakeServerRSARC4(t *testing.T) {
+       testServerScript(t, "RSA-RC4", rsaRC4ServerScript, testConfig, nil)
 }
 
-func TestHandshakeServer3DES(t *testing.T) {
+func TestHandshakeServerRSA3DES(t *testing.T) {
        des3Config := new(Config)
        *des3Config = *testConfig
        des3Config.CipherSuites = []uint16{TLS_RSA_WITH_3DES_EDE_CBC_SHA}
-       testServerScript(t, "3DES", des3ServerScript, des3Config, nil)
+       testServerScript(t, "RSA-3DES", rsaDES3ServerScript, des3Config, nil)
 }
 
-func TestHandshakeServerAES(t *testing.T) {
+func TestHandshakeServerRSAAES(t *testing.T) {
        aesConfig := new(Config)
        *aesConfig = *testConfig
        aesConfig.CipherSuites = []uint16{TLS_RSA_WITH_AES_128_CBC_SHA}
-       testServerScript(t, "AES", aesServerScript, aesConfig, nil)
+       testServerScript(t, "RSA-AES", rsaAESServerScript, aesConfig, nil)
+}
+
+func TestHandshakeServerECDHEECDSAAES(t *testing.T) {
+       ecdsaConfig := new(Config)
+       *ecdsaConfig = *testConfig
+       ecdsaConfig.Certificates = make([]Certificate, 1)
+       ecdsaConfig.Certificates[0].Certificate = [][]byte{testECDSACertificate}
+       ecdsaConfig.Certificates[0].PrivateKey = testECDSAPrivateKey
+       ecdsaConfig.BuildNameToCertificate()
+       ecdsaConfig.CipherSuites = []uint16{TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA}
+       testServerScript(t, "ECDHE-ECDSA-AES", ecdheECDSAAESServerScript, ecdsaConfig, nil)
 }
 
 func TestHandshakeServerSSLv3(t *testing.T) {
@@ -264,17 +277,32 @@ type clientauthTest struct {
        script     [][]byte
 }
 
-func TestClientAuth(t *testing.T) {
-       for _, cat := range clientauthTests {
+func TestClientAuthRSA(t *testing.T) {
+       for _, cat := range clientauthRSATests {
+               t.Log("running", cat.name)
+               cfg := new(Config)
+               *cfg = *testConfig
+               cfg.ClientAuth = cat.clientauth
+               testServerScript(t, cat.name, cat.script, cfg, cat.peers)
+       }
+}
+
+func TestClientAuthECDSA(t *testing.T) {
+       for _, cat := range clientauthECDSATests {
                t.Log("running", cat.name)
                cfg := new(Config)
                *cfg = *testConfig
+               cfg.Certificates = make([]Certificate, 1)
+               cfg.Certificates[0].Certificate = [][]byte{testECDSACertificate}
+               cfg.Certificates[0].PrivateKey = testECDSAPrivateKey
+               cfg.BuildNameToCertificate()
+               cfg.CipherSuites = []uint16{TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA}
                cfg.ClientAuth = cat.clientauth
                testServerScript(t, cat.name, cat.script, cfg, cat.peers)
        }
 }
 
-func TestTLS11Sesrver(t *testing.T) {
+func TestTLS11Server(t *testing.T) {
        var config = *testConfig
        config.CipherSuites = []uint16{TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA}
        config.MaxVersion = VersionTLS11
@@ -350,10 +378,28 @@ var serve = flag.Bool("serve", false, "run a TLS server on :10443")
 var testCipherSuites = flag.String("ciphersuites",
        "0x"+strconv.FormatInt(int64(TLS_RSA_WITH_RC4_128_SHA), 16),
        "cipher suites to accept in serving mode")
+var testMinVersion = flag.String("minversion",
+       "0x"+strconv.FormatInt(int64(VersionSSL30), 16),
+       "minimum version to negotiate")
+var testMaxVersion = flag.String("maxversion",
+       "0x"+strconv.FormatInt(int64(VersionTLS10), 16),
+       "maximum version to negotiate")
 var testClientAuth = flag.Int("clientauth", 0, "value for tls.Config.ClientAuth")
 
 func GetTestConfig() *Config {
        var config = *testConfig
+
+       minVersion, err := strconv.ParseUint(*testMinVersion, 0, 64)
+       if err != nil {
+               panic(err)
+       }
+       config.MinVersion = uint16(minVersion)
+       maxVersion, err := strconv.ParseUint(*testMaxVersion, 0, 64)
+       if err != nil {
+               panic(err)
+       }
+       config.MaxVersion = uint16(maxVersion)
+
        suites := strings.Split(*testCipherSuites, ",")
        config.CipherSuites = make([]uint16, len(suites))
        for i := range suites {
@@ -364,6 +410,25 @@ func GetTestConfig() *Config {
                config.CipherSuites[i] = uint16(suite)
        }
 
+       ecdsa := false
+       for _, suite := range config.CipherSuites {
+               switch suite {
+               case TLS_ECDHE_ECDSA_WITH_RC4_128_SHA,
+                       TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
+                       TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA:
+                       ecdsa = true
+               }
+       }
+       if ecdsa {
+               config.Certificates = nil
+               if !*connect {
+                       config.Certificates = make([]Certificate, 1)
+                       config.Certificates[0].Certificate = [][]byte{testECDSACertificate}
+                       config.Certificates[0].PrivateKey = testECDSAPrivateKey
+               }
+               config.BuildNameToCertificate()
+       }
+
        config.ClientAuth = ClientAuthType(*testClientAuth)
        return &config
 }
@@ -422,11 +487,13 @@ func fromHex(s string) []byte {
        return b
 }
 
-var testCertificate = fromHex("308202b030820219a00302010202090085b0bba48a7fb8ca300d06092a864886f70d01010505003045310b3009060355040613024155311330110603550408130a536f6d652d53746174653121301f060355040a1318496e7465726e6574205769646769747320507479204c7464301e170d3130303432343039303933385a170d3131303432343039303933385a3045310b3009060355040613024155311330110603550408130a536f6d652d53746174653121301f060355040a1318496e7465726e6574205769646769747320507479204c746430819f300d06092a864886f70d010101050003818d0030818902818100bb79d6f517b5e5bf4610d0dc69bee62b07435ad0032d8a7a4385b71452e7a5654c2c78b8238cb5b482e5de1f953b7e62a52ca533d6fe125c7a56fcf506bffa587b263fb5cd04d3d0c921964ac7f4549f5abfef427100fe1899077f7e887d7df10439c4a22edb51c97ce3c04c3b326601cfafb11db8719a1ddbdb896baeda2d790203010001a381a73081a4301d0603551d0e04160414b1ade2855acfcb28db69ce2369ded3268e18883930750603551d23046e306c8014b1ade2855acfcb28db69ce2369ded3268e188839a149a4473045310b3009060355040613024155311330110603550408130a536f6d652d53746174653121301f060355040a1318496e7465726e6574205769646769747320507479204c746482090085b0bba48a7fb8ca300c0603551d13040530030101ff300d06092a864886f70d010105050003818100086c4524c76bb159ab0c52ccf2b014d7879d7a6475b55a9566e4c52b8eae12661feb4f38b36e60d392fdf74108b52513b1187a24fb301dbaed98b917ece7d73159db95d31d78ea50565cd5825a2d5a5f33c4b6d8c97590968c0f5298b5cd981f89205ff2a01ca31b9694dda9fd57e970e8266d71999b266e3850296c90a7bdd9")
+var testRSACertificate = fromHex("308202b030820219a00302010202090085b0bba48a7fb8ca300d06092a864886f70d01010505003045310b3009060355040613024155311330110603550408130a536f6d652d53746174653121301f060355040a1318496e7465726e6574205769646769747320507479204c7464301e170d3130303432343039303933385a170d3131303432343039303933385a3045310b3009060355040613024155311330110603550408130a536f6d652d53746174653121301f060355040a1318496e7465726e6574205769646769747320507479204c746430819f300d06092a864886f70d010101050003818d0030818902818100bb79d6f517b5e5bf4610d0dc69bee62b07435ad0032d8a7a4385b71452e7a5654c2c78b8238cb5b482e5de1f953b7e62a52ca533d6fe125c7a56fcf506bffa587b263fb5cd04d3d0c921964ac7f4549f5abfef427100fe1899077f7e887d7df10439c4a22edb51c97ce3c04c3b326601cfafb11db8719a1ddbdb896baeda2d790203010001a381a73081a4301d0603551d0e04160414b1ade2855acfcb28db69ce2369ded3268e18883930750603551d23046e306c8014b1ade2855acfcb28db69ce2369ded3268e188839a149a4473045310b3009060355040613024155311330110603550408130a536f6d652d53746174653121301f060355040a1318496e7465726e6574205769646769747320507479204c746482090085b0bba48a7fb8ca300c0603551d13040530030101ff300d06092a864886f70d010105050003818100086c4524c76bb159ab0c52ccf2b014d7879d7a6475b55a9566e4c52b8eae12661feb4f38b36e60d392fdf74108b52513b1187a24fb301dbaed98b917ece7d73159db95d31d78ea50565cd5825a2d5a5f33c4b6d8c97590968c0f5298b5cd981f89205ff2a01ca31b9694dda9fd57e970e8266d71999b266e3850296c90a7bdd9")
+
+var testECDSACertificate = fromHex("3082020030820162020900b8bf2d47a0d2ebf4300906072a8648ce3d04013045310b3009060355040613024155311330110603550408130a536f6d652d53746174653121301f060355040a1318496e7465726e6574205769646769747320507479204c7464301e170d3132313132323135303633325a170d3232313132303135303633325a3045310b3009060355040613024155311330110603550408130a536f6d652d53746174653121301f060355040a1318496e7465726e6574205769646769747320507479204c746430819b301006072a8648ce3d020106052b81040023038186000400c4a1edbe98f90b4873367ec316561122f23d53c33b4d213dcd6b75e6f6b0dc9adf26c1bcb287f072327cb3642f1c90bcea6823107efee325c0483a69e0286dd33700ef0462dd0da09c706283d881d36431aa9e9731bd96b068c09b23de76643f1a5c7fe9120e5858b65f70dd9bd8ead5d7f5d5ccb9b69f30665b669a20e227e5bffe3b300906072a8648ce3d040103818c0030818802420188a24febe245c5487d1bacf5ed989dae4770c05e1bb62fbdf1b64db76140d311a2ceee0b7e927eff769dc33b7ea53fcefa10e259ec472d7cacda4e970e15a06fd00242014dfcbe67139c2d050ebd3fa38c25c13313830d9406bbd4377af6ec7ac9862eddd711697f857c56defb31782be4c7780daecbbe9e4e3624317b6a0f399512078f2a")
 
 var testSNICertificate = fromHex("308201f23082015da003020102020100300b06092a864886f70d01010530283110300e060355040a130741636d6520436f311430120603550403130b736e69746573742e636f6d301e170d3132303431313137343033355a170d3133303431313137343533355a30283110300e060355040a130741636d6520436f311430120603550403130b736e69746573742e636f6d30819d300b06092a864886f70d01010103818d0030818902818100bb79d6f517b5e5bf4610d0dc69bee62b07435ad0032d8a7a4385b71452e7a5654c2c78b8238cb5b482e5de1f953b7e62a52ca533d6fe125c7a56fcf506bffa587b263fb5cd04d3d0c921964ac7f4549f5abfef427100fe1899077f7e887d7df10439c4a22edb51c97ce3c04c3b326601cfafb11db8719a1ddbdb896baeda2d790203010001a3323030300e0603551d0f0101ff0404030200a0300d0603551d0e0406040401020304300f0603551d2304083006800401020304300b06092a864886f70d0101050381810089c6455f1c1f5ef8eb1ab174ee2439059f5c4259bb1a8d86cdb1d056f56a717da40e95ab90f59e8deaf627c157995094db0802266eb34fc6842dea8a4b68d9c1389103ab84fb9e1f85d9b5d23ff2312c8670fbb540148245a4ebafe264d90c8a4cf4f85b0fac12ac2fc4a3154bad52462868af96c62c6525d652b6e31845bdcc")
 
-var testPrivateKey = &rsa.PrivateKey{
+var testRSAPrivateKey = &rsa.PrivateKey{
        PublicKey: rsa.PublicKey{
                N: bigFromString("131650079503776001033793877885499001334664249354723305978524647182322416328664556247316495448366990052837680518067798333412266673813370895702118944398081598789828837447552603077848001020611640547221687072142537202428102790818451901395596882588063427854225330436740647715202971973145151161964464812406232198521"),
                E: 65537,
@@ -438,6 +505,22 @@ var testPrivateKey = &rsa.PrivateKey{
        },
 }
 
+var testECDSAPrivateKey = &ecdsa.PrivateKey{
+       PublicKey: ecdsa.PublicKey{
+               Curve: &elliptic.CurveParams{
+                       P:       bigFromString("6864797660130609714981900799081393217269435300143305409394463459185543183397656052122559640661454554977296311391480858037121987999716643812574028291115057151"),
+                       N:       bigFromString("6864797660130609714981900799081393217269435300143305409394463459185543183397655394245057746333217197532963996371363321113864768612440380340372808892707005449"),
+                       B:       bigFromString("1093849038073734274511112390766805569936207598951683748994586394495953116150735016013708737573759623248592132296706313309438452531591012912142327488478985984"),
+                       Gx:      bigFromString("2661740802050217063228768716723360960729859168756973147706671368418802944996427808491545080627771902352094241225065558662157113545570916814161637315895999846"),
+                       Gy:      bigFromString("3757180025770020463545507224491183603594455134769762486694567779615544477440556316691234405012945539562144444537289428522585666729196580810124344277578376784"),
+                       BitSize: 521,
+               },
+               X: bigFromString("2636411247892461147287360222306590634450676461695221912739908880441342231985950069527906976759812296359387337367668045707086543273113073382714101597903639351"),
+               Y: bigFromString("3204695818431246682253994090650952614555094516658732116404513121125038617915183037601737180082382202488628239201196033284060130040574800684774115478859677243"),
+       },
+       D: bigFromString("5477294338614160138026852784385529180817726002953041720191098180813046231640184669647735805135001309477695746518160084669446643325196003346204701381388769751"),
+}
+
 func loadPEMCert(in string) *x509.Certificate {
        block, _ := pem.Decode([]byte(in))
        if block.Type == "CERTIFICATE" && len(block.Headers) == 0 {
@@ -454,7 +537,7 @@ func loadPEMCert(in string) *x509.Certificate {
 // The values for this test are obtained by building and running in server mode:
 //   % go test -test.run "TestRunServer" -serve
 // The recorded bytes are written to stdout.
-var rc4ServerScript = [][]byte{
+var rsaRC4ServerScript = [][]byte{
        {
                0x16, 0x03, 0x01, 0x00, 0x54, 0x01, 0x00, 0x00,
                0x50, 0x03, 0x01, 0x50, 0x77, 0x3d, 0xbd, 0x32,
@@ -611,7 +694,7 @@ var rc4ServerScript = [][]byte{
        },
 }
 
-var des3ServerScript = [][]byte{
+var rsaDES3ServerScript = [][]byte{
        {
                0x16, 0x03, 0x00, 0x00, 0xc5, 0x01, 0x00, 0x00,
                0xc1, 0x03, 0x03, 0x50, 0xae, 0x5d, 0x38, 0xec,
@@ -820,7 +903,7 @@ var des3ServerScript = [][]byte{
        },
 }
 
-var aesServerScript = [][]byte{
+var rsaAESServerScript = [][]byte{
        {
                0x16, 0x03, 0x00, 0x00, 0xc5, 0x01, 0x00, 0x00,
                0xc1, 0x03, 0x03, 0x50, 0xae, 0x5c, 0xe9, 0x5e,
@@ -1046,6 +1129,216 @@ var aesServerScript = [][]byte{
        },
 }
 
+// Generated using:
+// $ go test -test.run TestRunServer -serve -ciphersuites=0xc00a
+// $ openssl s_client -host 127.0.0.1 -port 10443 -cipher ECDHE-ECDSA-AES256-SHA
+var ecdheECDSAAESServerScript = [][]byte{
+       {
+               0x16, 0x03, 0x01, 0x00, 0xa0, 0x01, 0x00, 0x00,
+               0x9c, 0x03, 0x03, 0x50, 0xd7, 0x18, 0x31, 0x49,
+               0xde, 0x19, 0x8d, 0x08, 0x5c, 0x4b, 0x60, 0x67,
+               0x0f, 0xfe, 0xd0, 0x62, 0xf9, 0x31, 0x48, 0x17,
+               0x9e, 0x50, 0xc1, 0xd8, 0x35, 0x24, 0x0e, 0xa6,
+               0x09, 0x06, 0x51, 0x00, 0x00, 0x04, 0xc0, 0x0a,
+               0x00, 0xff, 0x01, 0x00, 0x00, 0x6f, 0x00, 0x0b,
+               0x00, 0x04, 0x03, 0x00, 0x01, 0x02, 0x00, 0x0a,
+               0x00, 0x34, 0x00, 0x32, 0x00, 0x0e, 0x00, 0x0d,
+               0x00, 0x19, 0x00, 0x0b, 0x00, 0x0c, 0x00, 0x18,
+               0x00, 0x09, 0x00, 0x0a, 0x00, 0x16, 0x00, 0x17,
+               0x00, 0x08, 0x00, 0x06, 0x00, 0x07, 0x00, 0x14,
+               0x00, 0x15, 0x00, 0x04, 0x00, 0x05, 0x00, 0x12,
+               0x00, 0x13, 0x00, 0x01, 0x00, 0x02, 0x00, 0x03,
+               0x00, 0x0f, 0x00, 0x10, 0x00, 0x11, 0x00, 0x23,
+               0x00, 0x00, 0x00, 0x0d, 0x00, 0x22, 0x00, 0x20,
+               0x06, 0x01, 0x06, 0x02, 0x06, 0x03, 0x05, 0x01,
+               0x05, 0x02, 0x05, 0x03, 0x04, 0x01, 0x04, 0x02,
+               0x04, 0x03, 0x03, 0x01, 0x03, 0x02, 0x03, 0x03,
+               0x02, 0x01, 0x02, 0x02, 0x02, 0x03, 0x01, 0x01,
+               0x00, 0x0f, 0x00, 0x01, 0x01,
+       },
+       {
+               0x16, 0x03, 0x01, 0x00, 0x30, 0x02, 0x00, 0x00,
+               0x2c, 0x03, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
+               0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+               0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+               0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+               0x00, 0x00, 0x00, 0x00, 0xc0, 0x0a, 0x00, 0x00,
+               0x04, 0x00, 0x23, 0x00, 0x00, 0x16, 0x03, 0x01,
+               0x02, 0x0e, 0x0b, 0x00, 0x02, 0x0a, 0x00, 0x02,
+               0x07, 0x00, 0x02, 0x04, 0x30, 0x82, 0x02, 0x00,
+               0x30, 0x82, 0x01, 0x62, 0x02, 0x09, 0x00, 0xb8,
+               0xbf, 0x2d, 0x47, 0xa0, 0xd2, 0xeb, 0xf4, 0x30,
+               0x09, 0x06, 0x07, 0x2a, 0x86, 0x48, 0xce, 0x3d,
+               0x04, 0x01, 0x30, 0x45, 0x31, 0x0b, 0x30, 0x09,
+               0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x41,
+               0x55, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55,
+               0x04, 0x08, 0x13, 0x0a, 0x53, 0x6f, 0x6d, 0x65,
+               0x2d, 0x53, 0x74, 0x61, 0x74, 0x65, 0x31, 0x21,
+               0x30, 0x1f, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x13,
+               0x18, 0x49, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x65,
+               0x74, 0x20, 0x57, 0x69, 0x64, 0x67, 0x69, 0x74,
+               0x73, 0x20, 0x50, 0x74, 0x79, 0x20, 0x4c, 0x74,
+               0x64, 0x30, 0x1e, 0x17, 0x0d, 0x31, 0x32, 0x31,
+               0x31, 0x32, 0x32, 0x31, 0x35, 0x30, 0x36, 0x33,
+               0x32, 0x5a, 0x17, 0x0d, 0x32, 0x32, 0x31, 0x31,
+               0x32, 0x30, 0x31, 0x35, 0x30, 0x36, 0x33, 0x32,
+               0x5a, 0x30, 0x45, 0x31, 0x0b, 0x30, 0x09, 0x06,
+               0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x41, 0x55,
+               0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04,
+               0x08, 0x13, 0x0a, 0x53, 0x6f, 0x6d, 0x65, 0x2d,
+               0x53, 0x74, 0x61, 0x74, 0x65, 0x31, 0x21, 0x30,
+               0x1f, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x13, 0x18,
+               0x49, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x65, 0x74,
+               0x20, 0x57, 0x69, 0x64, 0x67, 0x69, 0x74, 0x73,
+               0x20, 0x50, 0x74, 0x79, 0x20, 0x4c, 0x74, 0x64,
+               0x30, 0x81, 0x9b, 0x30, 0x10, 0x06, 0x07, 0x2a,
+               0x86, 0x48, 0xce, 0x3d, 0x02, 0x01, 0x06, 0x05,
+               0x2b, 0x81, 0x04, 0x00, 0x23, 0x03, 0x81, 0x86,
+               0x00, 0x04, 0x00, 0xc4, 0xa1, 0xed, 0xbe, 0x98,
+               0xf9, 0x0b, 0x48, 0x73, 0x36, 0x7e, 0xc3, 0x16,
+               0x56, 0x11, 0x22, 0xf2, 0x3d, 0x53, 0xc3, 0x3b,
+               0x4d, 0x21, 0x3d, 0xcd, 0x6b, 0x75, 0xe6, 0xf6,
+               0xb0, 0xdc, 0x9a, 0xdf, 0x26, 0xc1, 0xbc, 0xb2,
+               0x87, 0xf0, 0x72, 0x32, 0x7c, 0xb3, 0x64, 0x2f,
+               0x1c, 0x90, 0xbc, 0xea, 0x68, 0x23, 0x10, 0x7e,
+               0xfe, 0xe3, 0x25, 0xc0, 0x48, 0x3a, 0x69, 0xe0,
+               0x28, 0x6d, 0xd3, 0x37, 0x00, 0xef, 0x04, 0x62,
+               0xdd, 0x0d, 0xa0, 0x9c, 0x70, 0x62, 0x83, 0xd8,
+               0x81, 0xd3, 0x64, 0x31, 0xaa, 0x9e, 0x97, 0x31,
+               0xbd, 0x96, 0xb0, 0x68, 0xc0, 0x9b, 0x23, 0xde,
+               0x76, 0x64, 0x3f, 0x1a, 0x5c, 0x7f, 0xe9, 0x12,
+               0x0e, 0x58, 0x58, 0xb6, 0x5f, 0x70, 0xdd, 0x9b,
+               0xd8, 0xea, 0xd5, 0xd7, 0xf5, 0xd5, 0xcc, 0xb9,
+               0xb6, 0x9f, 0x30, 0x66, 0x5b, 0x66, 0x9a, 0x20,
+               0xe2, 0x27, 0xe5, 0xbf, 0xfe, 0x3b, 0x30, 0x09,
+               0x06, 0x07, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x04,
+               0x01, 0x03, 0x81, 0x8c, 0x00, 0x30, 0x81, 0x88,
+               0x02, 0x42, 0x01, 0x88, 0xa2, 0x4f, 0xeb, 0xe2,
+               0x45, 0xc5, 0x48, 0x7d, 0x1b, 0xac, 0xf5, 0xed,
+               0x98, 0x9d, 0xae, 0x47, 0x70, 0xc0, 0x5e, 0x1b,
+               0xb6, 0x2f, 0xbd, 0xf1, 0xb6, 0x4d, 0xb7, 0x61,
+               0x40, 0xd3, 0x11, 0xa2, 0xce, 0xee, 0x0b, 0x7e,
+               0x92, 0x7e, 0xff, 0x76, 0x9d, 0xc3, 0x3b, 0x7e,
+               0xa5, 0x3f, 0xce, 0xfa, 0x10, 0xe2, 0x59, 0xec,
+               0x47, 0x2d, 0x7c, 0xac, 0xda, 0x4e, 0x97, 0x0e,
+               0x15, 0xa0, 0x6f, 0xd0, 0x02, 0x42, 0x01, 0x4d,
+               0xfc, 0xbe, 0x67, 0x13, 0x9c, 0x2d, 0x05, 0x0e,
+               0xbd, 0x3f, 0xa3, 0x8c, 0x25, 0xc1, 0x33, 0x13,
+               0x83, 0x0d, 0x94, 0x06, 0xbb, 0xd4, 0x37, 0x7a,
+               0xf6, 0xec, 0x7a, 0xc9, 0x86, 0x2e, 0xdd, 0xd7,
+               0x11, 0x69, 0x7f, 0x85, 0x7c, 0x56, 0xde, 0xfb,
+               0x31, 0x78, 0x2b, 0xe4, 0xc7, 0x78, 0x0d, 0xae,
+               0xcb, 0xbe, 0x9e, 0x4e, 0x36, 0x24, 0x31, 0x7b,
+               0x6a, 0x0f, 0x39, 0x95, 0x12, 0x07, 0x8f, 0x2a,
+               0x16, 0x03, 0x01, 0x01, 0x1a, 0x0c, 0x00, 0x01,
+               0x16, 0x03, 0x00, 0x19, 0x85, 0x04, 0x01, 0x39,
+               0xdc, 0xee, 0x44, 0x17, 0x5e, 0xdb, 0xd7, 0x27,
+               0xaf, 0xb6, 0x56, 0xd9, 0xb4, 0x43, 0x5a, 0x99,
+               0xcf, 0xaa, 0x31, 0x37, 0x0c, 0x6f, 0x3a, 0xa0,
+               0xf8, 0x53, 0xc4, 0x74, 0xd1, 0x91, 0x0a, 0x46,
+               0xf5, 0x38, 0x3b, 0x5c, 0x09, 0xd8, 0x97, 0xdc,
+               0x4b, 0xaa, 0x70, 0x26, 0x48, 0xf2, 0xd6, 0x0b,
+               0x31, 0xc9, 0xf8, 0xd4, 0x98, 0x43, 0xe1, 0x6c,
+               0xd5, 0xc7, 0xb2, 0x8e, 0x0b, 0x01, 0xe6, 0xb6,
+               0x00, 0x28, 0x80, 0x7b, 0xfc, 0x96, 0x8f, 0x0d,
+               0xa2, 0x4f, 0xb0, 0x79, 0xaf, 0xdc, 0x61, 0x28,
+               0x63, 0x33, 0x78, 0xf6, 0x31, 0x39, 0xfd, 0x8a,
+               0xf4, 0x15, 0x18, 0x11, 0xfe, 0xdb, 0xd5, 0x07,
+               0xda, 0x2c, 0xed, 0x49, 0xa0, 0x23, 0xbf, 0xd0,
+               0x3a, 0x38, 0x1d, 0x54, 0xae, 0x1c, 0x7b, 0xea,
+               0x29, 0xee, 0xd0, 0x38, 0xc1, 0x76, 0xa7, 0x7f,
+               0x2a, 0xf4, 0xce, 0x1e, 0xac, 0xcc, 0x94, 0x79,
+               0x90, 0x33, 0x00, 0x8b, 0x30, 0x81, 0x88, 0x02,
+               0x42, 0x00, 0xc6, 0x85, 0x8e, 0x06, 0xb7, 0x04,
+               0x04, 0xe9, 0xcd, 0x9e, 0x3e, 0xcb, 0x66, 0x23,
+               0x95, 0xb4, 0x42, 0x9c, 0x64, 0x81, 0x39, 0x05,
+               0x3f, 0xb5, 0x21, 0xf8, 0x28, 0xaf, 0x60, 0x6b,
+               0x4d, 0x3d, 0xba, 0xa1, 0x4b, 0x5e, 0x77, 0xef,
+               0xe7, 0x59, 0x28, 0xfe, 0x1d, 0xc1, 0x27, 0xa2,
+               0xff, 0xa8, 0xde, 0x33, 0x48, 0xb3, 0xc1, 0x85,
+               0x6a, 0x42, 0x9b, 0xf9, 0x7e, 0x7e, 0x31, 0xc2,
+               0xe5, 0xbd, 0x66, 0x02, 0x42, 0x00, 0xad, 0x7d,
+               0x06, 0x35, 0xab, 0xec, 0x8d, 0xac, 0xd4, 0xba,
+               0x1b, 0x49, 0x5e, 0x05, 0x5f, 0xf0, 0x97, 0x93,
+               0x82, 0xb8, 0x2b, 0x8d, 0x91, 0x98, 0x63, 0x8e,
+               0xb4, 0x14, 0x62, 0xdb, 0x1e, 0xc9, 0x2b, 0x30,
+               0xf8, 0x41, 0x9b, 0xa6, 0xe6, 0xbc, 0xde, 0x0e,
+               0x68, 0x30, 0x22, 0x50, 0xe6, 0x98, 0x97, 0x7b,
+               0x69, 0xf7, 0x93, 0xed, 0xcd, 0x19, 0x2f, 0x44,
+               0x6c, 0x2e, 0xdf, 0x25, 0xee, 0xcc, 0x46, 0x16,
+               0x03, 0x01, 0x00, 0x04, 0x0e, 0x00, 0x00, 0x00,
+       },
+       {
+               0x16, 0x03, 0x01, 0x00, 0x8a, 0x10, 0x00, 0x00,
+               0x86, 0x85, 0x04, 0x00, 0x1c, 0xc5, 0xe8, 0xb3,
+               0x42, 0xb4, 0xad, 0xca, 0x45, 0xcd, 0x42, 0x7b,
+               0xfb, 0x0c, 0xea, 0x32, 0x26, 0xd4, 0x8a, 0xef,
+               0xdf, 0xc9, 0xff, 0xd2, 0xe0, 0x36, 0xea, 0x4e,
+               0xbb, 0x3e, 0xf4, 0x9c, 0x76, 0x4f, 0x44, 0xbd,
+               0x84, 0x72, 0xdd, 0xcb, 0xe5, 0x28, 0x8d, 0x31,
+               0x72, 0x3b, 0xd3, 0xf2, 0x9a, 0x13, 0xfb, 0x8a,
+               0xa7, 0x72, 0xca, 0x21, 0x6c, 0xea, 0xbf, 0xe9,
+               0x8c, 0x0a, 0xcc, 0x8f, 0xd6, 0x00, 0x20, 0x87,
+               0xf3, 0x7d, 0x18, 0xc5, 0xfd, 0x9e, 0xdd, 0x6b,
+               0x06, 0xdc, 0x52, 0xeb, 0x14, 0xc0, 0x67, 0x5a,
+               0x06, 0xd8, 0x98, 0x19, 0x14, 0xe7, 0xd4, 0x36,
+               0x32, 0xee, 0xb7, 0xfa, 0xe2, 0x85, 0x4a, 0x16,
+               0x42, 0x0c, 0xa6, 0x21, 0xcf, 0x1f, 0xae, 0x10,
+               0x8b, 0x28, 0x32, 0x19, 0xa4, 0x0a, 0xd7, 0xce,
+               0xe6, 0xe1, 0x93, 0xfb, 0x5f, 0x08, 0x8b, 0x42,
+               0xa2, 0x20, 0xed, 0x0d, 0x62, 0xca, 0xed, 0x14,
+               0x03, 0x01, 0x00, 0x01, 0x01, 0x16, 0x03, 0x01,
+               0x00, 0x30, 0x2e, 0x33, 0xc0, 0x57, 0x6c, 0xb4,
+               0x1b, 0xd2, 0x63, 0xe8, 0x67, 0x10, 0x2d, 0x87,
+               0x71, 0x6e, 0x19, 0x60, 0xf4, 0xa4, 0x10, 0x52,
+               0x73, 0x2d, 0x09, 0x5e, 0xdb, 0x6c, 0xdc, 0xcf,
+               0x2d, 0xff, 0x03, 0x11, 0x95, 0x76, 0x90, 0xd7,
+               0x87, 0x54, 0x43, 0xed, 0xc2, 0x36, 0x69, 0x14,
+               0x72, 0x4a,
+       },
+       {
+               0x16, 0x03, 0x01, 0x00, 0x72, 0x04, 0x00, 0x00,
+               0x6e, 0x00, 0x00, 0x00, 0x00, 0x00, 0x68, 0x00,
+               0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+               0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x65,
+               0xe8, 0x8b, 0xde, 0xef, 0xba, 0xc5, 0x7e, 0x04,
+               0xab, 0xfd, 0x79, 0x56, 0xf3, 0xe1, 0xa5, 0x3e,
+               0x02, 0xdf, 0x69, 0x6d, 0x1f, 0x41, 0x9f, 0xbc,
+               0x93, 0xe2, 0x6c, 0xf1, 0xb1, 0x38, 0xf5, 0x2b,
+               0x8c, 0x4c, 0xf4, 0x74, 0xe1, 0x79, 0x35, 0x34,
+               0x97, 0x9b, 0xd5, 0xba, 0xfd, 0xf7, 0x2f, 0x2d,
+               0x9e, 0x84, 0x54, 0xee, 0x77, 0x59, 0x23, 0x8f,
+               0xc8, 0x84, 0xb4, 0xd6, 0xea, 0x4c, 0x44, 0x8a,
+               0xc6, 0x9c, 0xf9, 0x9b, 0x27, 0xea, 0x4f, 0x28,
+               0x72, 0x33, 0x12, 0x20, 0x7c, 0xd7, 0x3f, 0x56,
+               0xa6, 0x76, 0xc7, 0x48, 0xe4, 0x2d, 0x6f, 0x14,
+               0x03, 0x01, 0x00, 0x01, 0x01, 0x16, 0x03, 0x01,
+               0x00, 0x30, 0x36, 0xe3, 0xd4, 0xf7, 0xb1, 0x69,
+               0x18, 0x8d, 0x09, 0xba, 0x52, 0x1e, 0xd5, 0x7d,
+               0x2c, 0x15, 0x3a, 0xd6, 0xe3, 0x99, 0x30, 0x2c,
+               0x99, 0x97, 0xbc, 0x19, 0x3c, 0x63, 0xa1, 0x25,
+               0x68, 0xbc, 0x8a, 0x16, 0x47, 0xec, 0xae, 0x13,
+               0xa4, 0x03, 0x96, 0x29, 0x11, 0x92, 0x90, 0x1a,
+               0xc8, 0xa4, 0x17, 0x03, 0x01, 0x00, 0x20, 0xc1,
+               0x10, 0x1d, 0xa6, 0xf1, 0xe2, 0x8a, 0xcc, 0x37,
+               0x7d, 0x8e, 0x05, 0x00, 0xfb, 0xd1, 0x9f, 0xc7,
+               0x11, 0xd2, 0x00, 0xb4, 0x27, 0x0a, 0x25, 0x14,
+               0xd9, 0x79, 0x1b, 0xcb, 0x4d, 0x81, 0x61, 0x17,
+               0x03, 0x01, 0x00, 0x30, 0x5c, 0x7c, 0x2d, 0xc0,
+               0x9e, 0xa6, 0xc4, 0x8e, 0xfd, 0xf4, 0xe2, 0xe5,
+               0xe4, 0xe6, 0x56, 0x9f, 0x7d, 0x4c, 0x4c, 0x2d,
+               0xb7, 0xa9, 0xac, 0xfa, 0x9f, 0x12, 0x7f, 0x2d,
+               0x30, 0x57, 0xe4, 0x8e, 0x30, 0x86, 0x65, 0x59,
+               0xcd, 0x24, 0xda, 0xe2, 0x8a, 0x7b, 0x0c, 0x5e,
+               0x86, 0x05, 0x06, 0x2a, 0x15, 0x03, 0x01, 0x00,
+               0x20, 0xd6, 0xb7, 0x70, 0xf8, 0x47, 0xbc, 0x0f,
+               0xf4, 0x66, 0x98, 0x1b, 0x1e, 0x8a, 0x8c, 0x0b,
+               0xa1, 0x4a, 0x04, 0x29, 0x60, 0x72, 0x8b, 0xc4,
+               0x73, 0xc1, 0xd6, 0x41, 0x72, 0xb7, 0x17, 0x39,
+               0xda,
+       },
+}
+
 var sslv3ServerScript = [][]byte{
        {
                0x16, 0x03, 0x00, 0x00, 0x54, 0x01, 0x00, 0x00,
@@ -1578,38 +1871,115 @@ var serverResumeTest = [][]byte{
        },
 }
 
-var clientauthTests = []clientauthTest{
+var clientauthRSATests = []clientauthTest{
        // Server asks for cert with empty CA list, client doesn't give it.
        // go test -run "TestRunServer" -serve -clientauth 1
        {"RequestClientCert, none given", RequestClientCert, nil, [][]byte{
                {
-                       0x16, 0x03, 0x01, 0x00, 0x54, 0x01, 0x00, 0x00,
-                       0x50, 0x03, 0x01, 0x50, 0x77, 0x43, 0x9e, 0x31,
-                       0xe6, 0x36, 0x5e, 0x5e, 0x24, 0xe4, 0x0d, 0x26,
-                       0x34, 0xa7, 0x1c, 0x2e, 0x59, 0x6d, 0xa5, 0x3e,
-                       0x72, 0xf3, 0xa3, 0x1c, 0xbc, 0xb3, 0x27, 0xaf,
-                       0x92, 0x5b, 0x7d, 0x00, 0x00, 0x28, 0x00, 0x39,
-                       0x00, 0x38, 0x00, 0x35, 0x00, 0x16, 0x00, 0x13,
-                       0x00, 0x0a, 0x00, 0x33, 0x00, 0x32, 0x00, 0x2f,
-                       0x00, 0x05, 0x00, 0x04, 0x00, 0x15, 0x00, 0x12,
-                       0x00, 0x09, 0x00, 0x14, 0x00, 0x11, 0x00, 0x08,
-                       0x00, 0x06, 0x00, 0x03, 0x00, 0xff, 0x02, 0x01,
-                       0x00,
+                       0x16, 0x03, 0x01, 0x01, 0x1e, 0x01, 0x00, 0x01,
+                       0x1a, 0x03, 0x03, 0x51, 0xe5, 0x6c, 0xb5, 0x5a,
+                       0xc2, 0xf5, 0xf0, 0x92, 0x94, 0x8a, 0x64, 0x18,
+                       0xa4, 0x2b, 0x82, 0x07, 0xbc, 0xd9, 0xd9, 0xf9,
+                       0x7b, 0xd2, 0xd0, 0xee, 0xa2, 0x70, 0x4e, 0x23,
+                       0x88, 0x7c, 0x95, 0x00, 0x00, 0x82, 0xc0, 0x30,
+                       0xc0, 0x2c, 0xc0, 0x28, 0xc0, 0x24, 0xc0, 0x14,
+                       0xc0, 0x0a, 0x00, 0xa3, 0x00, 0x9f, 0x00, 0x6b,
+                       0x00, 0x6a, 0x00, 0x39, 0x00, 0x38, 0xc0, 0x32,
+                       0xc0, 0x2e, 0xc0, 0x2a, 0xc0, 0x26, 0xc0, 0x0f,
+                       0xc0, 0x05, 0x00, 0x9d, 0x00, 0x3d, 0x00, 0x35,
+                       0xc0, 0x12, 0xc0, 0x08, 0x00, 0x16, 0x00, 0x13,
+                       0xc0, 0x0d, 0xc0, 0x03, 0x00, 0x0a, 0xc0, 0x2f,
+                       0xc0, 0x2b, 0xc0, 0x27, 0xc0, 0x23, 0xc0, 0x13,
+                       0xc0, 0x09, 0x00, 0xa2, 0x00, 0x9e, 0x00, 0x67,
+                       0x00, 0x40, 0x00, 0x33, 0x00, 0x32, 0xc0, 0x31,
+                       0xc0, 0x2d, 0xc0, 0x29, 0xc0, 0x25, 0xc0, 0x0e,
+                       0xc0, 0x04, 0x00, 0x9c, 0x00, 0x3c, 0x00, 0x2f,
+                       0x00, 0x07, 0xc0, 0x11, 0xc0, 0x07, 0xc0, 0x0c,
+                       0xc0, 0x02, 0x00, 0x05, 0x00, 0x04, 0x00, 0x15,
+                       0x00, 0x12, 0x00, 0x09, 0x00, 0x14, 0x00, 0x11,
+                       0x00, 0x08, 0x00, 0x06, 0x00, 0x03, 0x00, 0xff,
+                       0x01, 0x00, 0x00, 0x6f, 0x00, 0x0b, 0x00, 0x04,
+                       0x03, 0x00, 0x01, 0x02, 0x00, 0x0a, 0x00, 0x34,
+                       0x00, 0x32, 0x00, 0x0e, 0x00, 0x0d, 0x00, 0x19,
+                       0x00, 0x0b, 0x00, 0x0c, 0x00, 0x18, 0x00, 0x09,
+                       0x00, 0x0a, 0x00, 0x16, 0x00, 0x17, 0x00, 0x08,
+                       0x00, 0x06, 0x00, 0x07, 0x00, 0x14, 0x00, 0x15,
+                       0x00, 0x04, 0x00, 0x05, 0x00, 0x12, 0x00, 0x13,
+                       0x00, 0x01, 0x00, 0x02, 0x00, 0x03, 0x00, 0x0f,
+                       0x00, 0x10, 0x00, 0x11, 0x00, 0x23, 0x00, 0x00,
+                       0x00, 0x0d, 0x00, 0x22, 0x00, 0x20, 0x06, 0x01,
+                       0x06, 0x02, 0x06, 0x03, 0x05, 0x01, 0x05, 0x02,
+                       0x05, 0x03, 0x04, 0x01, 0x04, 0x02, 0x04, 0x03,
+                       0x03, 0x01, 0x03, 0x02, 0x03, 0x03, 0x02, 0x01,
+                       0x02, 0x02, 0x02, 0x03, 0x01, 0x01, 0x00, 0x0f,
+                       0x00, 0x01, 0x01,
                },
                {
-                       0x16, 0x03, 0x01, 0x00, 0x2a, 0x02, 0x00, 0x00,
-                       0x26, 0x03, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
+                       0x16, 0x03, 0x01, 0x00, 0x30, 0x02, 0x00, 0x00,
+                       0x2c, 0x03, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
                        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                       0x00, 0x00, 0x00, 0x00, 0x00, 0x05, 0x00, 0x16,
-                       0x03, 0x01, 0x02, 0xbe, 0x0b, 0x00, 0x02, 0xba,
-                       0x00, 0x02, 0xb7, 0x00, 0x02, 0xb4, 0x30, 0x82,
-                       0x02, 0xb0, 0x30, 0x82, 0x02, 0x19, 0xa0, 0x03,
-                       0x02, 0x01, 0x02, 0x02, 0x09, 0x00, 0x85, 0xb0,
-                       0xbb, 0xa4, 0x8a, 0x7f, 0xb8, 0xca, 0x30, 0x0d,
-                       0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d,
-                       0x01, 0x01, 0x05, 0x05, 0x00, 0x30, 0x45, 0x31,
+                       0x00, 0x00, 0x00, 0x00, 0x00, 0x05, 0x00, 0x00,
+                       0x04, 0x00, 0x23, 0x00, 0x00, 0x16, 0x03, 0x01,
+                       0x02, 0xbe, 0x0b, 0x00, 0x02, 0xba, 0x00, 0x02,
+                       0xb7, 0x00, 0x02, 0xb4, 0x30, 0x82, 0x02, 0xb0,
+                       0x30, 0x82, 0x02, 0x19, 0xa0, 0x03, 0x02, 0x01,
+                       0x02, 0x02, 0x09, 0x00, 0x85, 0xb0, 0xbb, 0xa4,
+                       0x8a, 0x7f, 0xb8, 0xca, 0x30, 0x0d, 0x06, 0x09,
+                       0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01,
+                       0x05, 0x05, 0x00, 0x30, 0x45, 0x31, 0x0b, 0x30,
+                       0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02,
+                       0x41, 0x55, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03,
+                       0x55, 0x04, 0x08, 0x13, 0x0a, 0x53, 0x6f, 0x6d,
+                       0x65, 0x2d, 0x53, 0x74, 0x61, 0x74, 0x65, 0x31,
+                       0x21, 0x30, 0x1f, 0x06, 0x03, 0x55, 0x04, 0x0a,
+                       0x13, 0x18, 0x49, 0x6e, 0x74, 0x65, 0x72, 0x6e,
+                       0x65, 0x74, 0x20, 0x57, 0x69, 0x64, 0x67, 0x69,
+                       0x74, 0x73, 0x20, 0x50, 0x74, 0x79, 0x20, 0x4c,
+                       0x74, 0x64, 0x30, 0x1e, 0x17, 0x0d, 0x31, 0x30,
+                       0x30, 0x34, 0x32, 0x34, 0x30, 0x39, 0x30, 0x39,
+                       0x33, 0x38, 0x5a, 0x17, 0x0d, 0x31, 0x31, 0x30,
+                       0x34, 0x32, 0x34, 0x30, 0x39, 0x30, 0x39, 0x33,
+                       0x38, 0x5a, 0x30, 0x45, 0x31, 0x0b, 0x30, 0x09,
+                       0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x41,
+                       0x55, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55,
+                       0x04, 0x08, 0x13, 0x0a, 0x53, 0x6f, 0x6d, 0x65,
+                       0x2d, 0x53, 0x74, 0x61, 0x74, 0x65, 0x31, 0x21,
+                       0x30, 0x1f, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x13,
+                       0x18, 0x49, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x65,
+                       0x74, 0x20, 0x57, 0x69, 0x64, 0x67, 0x69, 0x74,
+                       0x73, 0x20, 0x50, 0x74, 0x79, 0x20, 0x4c, 0x74,
+                       0x64, 0x30, 0x81, 0x9f, 0x30, 0x0d, 0x06, 0x09,
+                       0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01,
+                       0x01, 0x05, 0x00, 0x03, 0x81, 0x8d, 0x00, 0x30,
+                       0x81, 0x89, 0x02, 0x81, 0x81, 0x00, 0xbb, 0x79,
+                       0xd6, 0xf5, 0x17, 0xb5, 0xe5, 0xbf, 0x46, 0x10,
+                       0xd0, 0xdc, 0x69, 0xbe, 0xe6, 0x2b, 0x07, 0x43,
+                       0x5a, 0xd0, 0x03, 0x2d, 0x8a, 0x7a, 0x43, 0x85,
+                       0xb7, 0x14, 0x52, 0xe7, 0xa5, 0x65, 0x4c, 0x2c,
+                       0x78, 0xb8, 0x23, 0x8c, 0xb5, 0xb4, 0x82, 0xe5,
+                       0xde, 0x1f, 0x95, 0x3b, 0x7e, 0x62, 0xa5, 0x2c,
+                       0xa5, 0x33, 0xd6, 0xfe, 0x12, 0x5c, 0x7a, 0x56,
+                       0xfc, 0xf5, 0x06, 0xbf, 0xfa, 0x58, 0x7b, 0x26,
+                       0x3f, 0xb5, 0xcd, 0x04, 0xd3, 0xd0, 0xc9, 0x21,
+                       0x96, 0x4a, 0xc7, 0xf4, 0x54, 0x9f, 0x5a, 0xbf,
+                       0xef, 0x42, 0x71, 0x00, 0xfe, 0x18, 0x99, 0x07,
+                       0x7f, 0x7e, 0x88, 0x7d, 0x7d, 0xf1, 0x04, 0x39,
+                       0xc4, 0xa2, 0x2e, 0xdb, 0x51, 0xc9, 0x7c, 0xe3,
+                       0xc0, 0x4c, 0x3b, 0x32, 0x66, 0x01, 0xcf, 0xaf,
+                       0xb1, 0x1d, 0xb8, 0x71, 0x9a, 0x1d, 0xdb, 0xdb,
+                       0x89, 0x6b, 0xae, 0xda, 0x2d, 0x79, 0x02, 0x03,
+                       0x01, 0x00, 0x01, 0xa3, 0x81, 0xa7, 0x30, 0x81,
+                       0xa4, 0x30, 0x1d, 0x06, 0x03, 0x55, 0x1d, 0x0e,
+                       0x04, 0x16, 0x04, 0x14, 0xb1, 0xad, 0xe2, 0x85,
+                       0x5a, 0xcf, 0xcb, 0x28, 0xdb, 0x69, 0xce, 0x23,
+                       0x69, 0xde, 0xd3, 0x26, 0x8e, 0x18, 0x88, 0x39,
+                       0x30, 0x75, 0x06, 0x03, 0x55, 0x1d, 0x23, 0x04,
+                       0x6e, 0x30, 0x6c, 0x80, 0x14, 0xb1, 0xad, 0xe2,
+                       0x85, 0x5a, 0xcf, 0xcb, 0x28, 0xdb, 0x69, 0xce,
+                       0x23, 0x69, 0xde, 0xd3, 0x26, 0x8e, 0x18, 0x88,
+                       0x39, 0xa1, 0x49, 0xa4, 0x47, 0x30, 0x45, 0x31,
                        0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06,
                        0x13, 0x02, 0x41, 0x55, 0x31, 0x13, 0x30, 0x11,
                        0x06, 0x03, 0x55, 0x04, 0x08, 0x13, 0x0a, 0x53,
@@ -1618,158 +1988,200 @@ var clientauthTests = []clientauthTest{
                        0x04, 0x0a, 0x13, 0x18, 0x49, 0x6e, 0x74, 0x65,
                        0x72, 0x6e, 0x65, 0x74, 0x20, 0x57, 0x69, 0x64,
                        0x67, 0x69, 0x74, 0x73, 0x20, 0x50, 0x74, 0x79,
-                       0x20, 0x4c, 0x74, 0x64, 0x30, 0x1e, 0x17, 0x0d,
-                       0x31, 0x30, 0x30, 0x34, 0x32, 0x34, 0x30, 0x39,
-                       0x30, 0x39, 0x33, 0x38, 0x5a, 0x17, 0x0d, 0x31,
-                       0x31, 0x30, 0x34, 0x32, 0x34, 0x30, 0x39, 0x30,
-                       0x39, 0x33, 0x38, 0x5a, 0x30, 0x45, 0x31, 0x0b,
-                       0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13,
-                       0x02, 0x41, 0x55, 0x31, 0x13, 0x30, 0x11, 0x06,
-                       0x03, 0x55, 0x04, 0x08, 0x13, 0x0a, 0x53, 0x6f,
-                       0x6d, 0x65, 0x2d, 0x53, 0x74, 0x61, 0x74, 0x65,
-                       0x31, 0x21, 0x30, 0x1f, 0x06, 0x03, 0x55, 0x04,
-                       0x0a, 0x13, 0x18, 0x49, 0x6e, 0x74, 0x65, 0x72,
-                       0x6e, 0x65, 0x74, 0x20, 0x57, 0x69, 0x64, 0x67,
-                       0x69, 0x74, 0x73, 0x20, 0x50, 0x74, 0x79, 0x20,
-                       0x4c, 0x74, 0x64, 0x30, 0x81, 0x9f, 0x30, 0x0d,
-                       0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d,
-                       0x01, 0x01, 0x01, 0x05, 0x00, 0x03, 0x81, 0x8d,
-                       0x00, 0x30, 0x81, 0x89, 0x02, 0x81, 0x81, 0x00,
-                       0xbb, 0x79, 0xd6, 0xf5, 0x17, 0xb5, 0xe5, 0xbf,
-                       0x46, 0x10, 0xd0, 0xdc, 0x69, 0xbe, 0xe6, 0x2b,
-                       0x07, 0x43, 0x5a, 0xd0, 0x03, 0x2d, 0x8a, 0x7a,
-                       0x43, 0x85, 0xb7, 0x14, 0x52, 0xe7, 0xa5, 0x65,
-                       0x4c, 0x2c, 0x78, 0xb8, 0x23, 0x8c, 0xb5, 0xb4,
-                       0x82, 0xe5, 0xde, 0x1f, 0x95, 0x3b, 0x7e, 0x62,
-                       0xa5, 0x2c, 0xa5, 0x33, 0xd6, 0xfe, 0x12, 0x5c,
-                       0x7a, 0x56, 0xfc, 0xf5, 0x06, 0xbf, 0xfa, 0x58,
-                       0x7b, 0x26, 0x3f, 0xb5, 0xcd, 0x04, 0xd3, 0xd0,
-                       0xc9, 0x21, 0x96, 0x4a, 0xc7, 0xf4, 0x54, 0x9f,
-                       0x5a, 0xbf, 0xef, 0x42, 0x71, 0x00, 0xfe, 0x18,
-                       0x99, 0x07, 0x7f, 0x7e, 0x88, 0x7d, 0x7d, 0xf1,
-                       0x04, 0x39, 0xc4, 0xa2, 0x2e, 0xdb, 0x51, 0xc9,
-                       0x7c, 0xe3, 0xc0, 0x4c, 0x3b, 0x32, 0x66, 0x01,
-                       0xcf, 0xaf, 0xb1, 0x1d, 0xb8, 0x71, 0x9a, 0x1d,
-                       0xdb, 0xdb, 0x89, 0x6b, 0xae, 0xda, 0x2d, 0x79,
-                       0x02, 0x03, 0x01, 0x00, 0x01, 0xa3, 0x81, 0xa7,
-                       0x30, 0x81, 0xa4, 0x30, 0x1d, 0x06, 0x03, 0x55,
-                       0x1d, 0x0e, 0x04, 0x16, 0x04, 0x14, 0xb1, 0xad,
-                       0xe2, 0x85, 0x5a, 0xcf, 0xcb, 0x28, 0xdb, 0x69,
-                       0xce, 0x23, 0x69, 0xde, 0xd3, 0x26, 0x8e, 0x18,
-                       0x88, 0x39, 0x30, 0x75, 0x06, 0x03, 0x55, 0x1d,
-                       0x23, 0x04, 0x6e, 0x30, 0x6c, 0x80, 0x14, 0xb1,
-                       0xad, 0xe2, 0x85, 0x5a, 0xcf, 0xcb, 0x28, 0xdb,
-                       0x69, 0xce, 0x23, 0x69, 0xde, 0xd3, 0x26, 0x8e,
-                       0x18, 0x88, 0x39, 0xa1, 0x49, 0xa4, 0x47, 0x30,
-                       0x45, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55,
-                       0x04, 0x06, 0x13, 0x02, 0x41, 0x55, 0x31, 0x13,
-                       0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x08, 0x13,
-                       0x0a, 0x53, 0x6f, 0x6d, 0x65, 0x2d, 0x53, 0x74,
-                       0x61, 0x74, 0x65, 0x31, 0x21, 0x30, 0x1f, 0x06,
-                       0x03, 0x55, 0x04, 0x0a, 0x13, 0x18, 0x49, 0x6e,
-                       0x74, 0x65, 0x72, 0x6e, 0x65, 0x74, 0x20, 0x57,
-                       0x69, 0x64, 0x67, 0x69, 0x74, 0x73, 0x20, 0x50,
-                       0x74, 0x79, 0x20, 0x4c, 0x74, 0x64, 0x82, 0x09,
-                       0x00, 0x85, 0xb0, 0xbb, 0xa4, 0x8a, 0x7f, 0xb8,
-                       0xca, 0x30, 0x0c, 0x06, 0x03, 0x55, 0x1d, 0x13,
-                       0x04, 0x05, 0x30, 0x03, 0x01, 0x01, 0xff, 0x30,
-                       0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7,
-                       0x0d, 0x01, 0x01, 0x05, 0x05, 0x00, 0x03, 0x81,
-                       0x81, 0x00, 0x08, 0x6c, 0x45, 0x24, 0xc7, 0x6b,
-                       0xb1, 0x59, 0xab, 0x0c, 0x52, 0xcc, 0xf2, 0xb0,
-                       0x14, 0xd7, 0x87, 0x9d, 0x7a, 0x64, 0x75, 0xb5,
-                       0x5a, 0x95, 0x66, 0xe4, 0xc5, 0x2b, 0x8e, 0xae,
-                       0x12, 0x66, 0x1f, 0xeb, 0x4f, 0x38, 0xb3, 0x6e,
-                       0x60, 0xd3, 0x92, 0xfd, 0xf7, 0x41, 0x08, 0xb5,
-                       0x25, 0x13, 0xb1, 0x18, 0x7a, 0x24, 0xfb, 0x30,
-                       0x1d, 0xba, 0xed, 0x98, 0xb9, 0x17, 0xec, 0xe7,
-                       0xd7, 0x31, 0x59, 0xdb, 0x95, 0xd3, 0x1d, 0x78,
-                       0xea, 0x50, 0x56, 0x5c, 0xd5, 0x82, 0x5a, 0x2d,
-                       0x5a, 0x5f, 0x33, 0xc4, 0xb6, 0xd8, 0xc9, 0x75,
-                       0x90, 0x96, 0x8c, 0x0f, 0x52, 0x98, 0xb5, 0xcd,
-                       0x98, 0x1f, 0x89, 0x20, 0x5f, 0xf2, 0xa0, 0x1c,
-                       0xa3, 0x1b, 0x96, 0x94, 0xdd, 0xa9, 0xfd, 0x57,
-                       0xe9, 0x70, 0xe8, 0x26, 0x6d, 0x71, 0x99, 0x9b,
-                       0x26, 0x6e, 0x38, 0x50, 0x29, 0x6c, 0x90, 0xa7,
-                       0xbd, 0xd9, 0x16, 0x03, 0x01, 0x00, 0x08, 0x0d,
-                       0x00, 0x00, 0x04, 0x01, 0x01, 0x00, 0x00, 0x16,
-                       0x03, 0x01, 0x00, 0x04, 0x0e, 0x00, 0x00, 0x00,
+                       0x20, 0x4c, 0x74, 0x64, 0x82, 0x09, 0x00, 0x85,
+                       0xb0, 0xbb, 0xa4, 0x8a, 0x7f, 0xb8, 0xca, 0x30,
+                       0x0c, 0x06, 0x03, 0x55, 0x1d, 0x13, 0x04, 0x05,
+                       0x30, 0x03, 0x01, 0x01, 0xff, 0x30, 0x0d, 0x06,
+                       0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01,
+                       0x01, 0x05, 0x05, 0x00, 0x03, 0x81, 0x81, 0x00,
+                       0x08, 0x6c, 0x45, 0x24, 0xc7, 0x6b, 0xb1, 0x59,
+                       0xab, 0x0c, 0x52, 0xcc, 0xf2, 0xb0, 0x14, 0xd7,
+                       0x87, 0x9d, 0x7a, 0x64, 0x75, 0xb5, 0x5a, 0x95,
+                       0x66, 0xe4, 0xc5, 0x2b, 0x8e, 0xae, 0x12, 0x66,
+                       0x1f, 0xeb, 0x4f, 0x38, 0xb3, 0x6e, 0x60, 0xd3,
+                       0x92, 0xfd, 0xf7, 0x41, 0x08, 0xb5, 0x25, 0x13,
+                       0xb1, 0x18, 0x7a, 0x24, 0xfb, 0x30, 0x1d, 0xba,
+                       0xed, 0x98, 0xb9, 0x17, 0xec, 0xe7, 0xd7, 0x31,
+                       0x59, 0xdb, 0x95, 0xd3, 0x1d, 0x78, 0xea, 0x50,
+                       0x56, 0x5c, 0xd5, 0x82, 0x5a, 0x2d, 0x5a, 0x5f,
+                       0x33, 0xc4, 0xb6, 0xd8, 0xc9, 0x75, 0x90, 0x96,
+                       0x8c, 0x0f, 0x52, 0x98, 0xb5, 0xcd, 0x98, 0x1f,
+                       0x89, 0x20, 0x5f, 0xf2, 0xa0, 0x1c, 0xa3, 0x1b,
+                       0x96, 0x94, 0xdd, 0xa9, 0xfd, 0x57, 0xe9, 0x70,
+                       0xe8, 0x26, 0x6d, 0x71, 0x99, 0x9b, 0x26, 0x6e,
+                       0x38, 0x50, 0x29, 0x6c, 0x90, 0xa7, 0xbd, 0xd9,
+                       0x16, 0x03, 0x01, 0x00, 0x09, 0x0d, 0x00, 0x00,
+                       0x05, 0x02, 0x01, 0x40, 0x00, 0x00, 0x16, 0x03,
+                       0x01, 0x00, 0x04, 0x0e, 0x00, 0x00, 0x00,
                },
                {
                        0x16, 0x03, 0x01, 0x00, 0x07, 0x0b, 0x00, 0x00,
                        0x03, 0x00, 0x00, 0x00, 0x16, 0x03, 0x01, 0x00,
-                       0x86, 0x10, 0x00, 0x00, 0x82, 0x00, 0x80, 0x04,
-                       0x58, 0x63, 0x26, 0x32, 0x1b, 0x34, 0xbe, 0x10,
-                       0xe4, 0xe4, 0x3e, 0xcd, 0x36, 0x7f, 0xa8, 0xa8,
-                       0xe0, 0x19, 0xe8, 0x94, 0x13, 0xd9, 0x35, 0xc4,
-                       0x71, 0xb4, 0x91, 0xd4, 0xbc, 0x74, 0x57, 0x9f,
-                       0x93, 0xb7, 0x5d, 0x3b, 0x9c, 0xff, 0x5d, 0x79,
-                       0xdb, 0x86, 0xfc, 0xdc, 0x74, 0x1e, 0x0c, 0xc6,
-                       0xe8, 0x93, 0xcf, 0xaf, 0xba, 0x1d, 0xfd, 0x8a,
-                       0xeb, 0xef, 0xbf, 0xfa, 0xa6, 0xe7, 0x53, 0x98,
-                       0x60, 0x4e, 0x0e, 0x60, 0x7d, 0xea, 0x40, 0x8d,
-                       0x1d, 0x8f, 0xa3, 0xc6, 0x83, 0xbc, 0xef, 0xb7,
-                       0x9a, 0x4a, 0xe7, 0x99, 0xee, 0x0b, 0xc7, 0x46,
-                       0x75, 0x45, 0x66, 0xe8, 0x5f, 0x4b, 0x08, 0xa4,
-                       0xc1, 0x36, 0xd0, 0x36, 0x2c, 0xf2, 0x9a, 0x44,
-                       0x1e, 0x5f, 0x22, 0xf4, 0xbe, 0x66, 0x66, 0x17,
-                       0xd8, 0xb6, 0x0a, 0x89, 0xed, 0x22, 0x80, 0xdb,
-                       0xad, 0x05, 0xd1, 0xb5, 0x93, 0xa1, 0x1c, 0x14,
+                       0x86, 0x10, 0x00, 0x00, 0x82, 0x00, 0x80, 0x36,
+                       0xfc, 0xd8, 0xc8, 0xa2, 0x67, 0xc8, 0xc6, 0xf4,
+                       0x28, 0x70, 0xe1, 0x5a, 0x02, 0x8f, 0xef, 0x42,
+                       0xe0, 0xd3, 0xb8, 0xd6, 0x6b, 0xe4, 0xee, 0x5c,
+                       0xcf, 0x42, 0xc4, 0xfa, 0xcd, 0x0f, 0xfe, 0xf4,
+                       0x76, 0x76, 0x47, 0x73, 0xa8, 0x72, 0x8f, 0xa2,
+                       0x56, 0x81, 0x83, 0xb8, 0x84, 0x72, 0x67, 0xdd,
+                       0xbe, 0x05, 0x4b, 0x84, 0xd9, 0xd2, 0xb6, 0xc2,
+                       0xe7, 0x20, 0xac, 0x1f, 0x46, 0x9d, 0x05, 0x47,
+                       0x8e, 0x89, 0xc0, 0x42, 0x57, 0x4a, 0xa2, 0x98,
+                       0xe5, 0x39, 0x4f, 0xc4, 0x27, 0x6d, 0x43, 0xa8,
+                       0x83, 0x76, 0xe6, 0xad, 0xe3, 0x17, 0x68, 0x31,
+                       0xcb, 0x7e, 0xfc, 0xe7, 0x4b, 0x76, 0x3d, 0x3c,
+                       0xfa, 0x77, 0x65, 0xc9, 0x4c, 0x5b, 0xce, 0x5e,
+                       0xf7, 0x8b, 0xa8, 0xa6, 0xdd, 0xb2, 0xef, 0x0b,
+                       0x46, 0x83, 0xdf, 0x0a, 0x8c, 0x22, 0x12, 0x6e,
+                       0xe1, 0x45, 0x54, 0x88, 0xd1, 0xe8, 0xd2, 0x14,
                        0x03, 0x01, 0x00, 0x01, 0x01, 0x16, 0x03, 0x01,
-                       0x00, 0x24, 0x62, 0x6f, 0x3d, 0x30, 0x56, 0x97,
-                       0xde, 0x03, 0x67, 0xa9, 0x63, 0x21, 0xb6, 0xe6,
-                       0x05, 0x69, 0x94, 0xfb, 0x50, 0xc1, 0x99, 0xdd,
-                       0xf6, 0xe8, 0x60, 0xbd, 0xe6, 0xba, 0xe3, 0x50,
-                       0x0a, 0xcd, 0xde, 0x14, 0x16, 0xc4,
+                       0x00, 0x24, 0x30, 0x8c, 0x7d, 0x40, 0xfc, 0x5e,
+                       0x80, 0x9c, 0xc4, 0x7c, 0x62, 0x01, 0xa1, 0x37,
+                       0xcf, 0x1a, 0x75, 0x28, 0x8d, 0xeb, 0x63, 0xcc,
+                       0x02, 0xa6, 0x66, 0xdf, 0x36, 0x01, 0xb3, 0x9d,
+                       0x38, 0x42, 0x16, 0x91, 0xf0, 0x02,
                },
                {
-                       0x14, 0x03, 0x01, 0x00, 0x01, 0x01, 0x16, 0x03,
-                       0x01, 0x00, 0x24, 0xf0, 0x21, 0xf6, 0x84, 0x6a,
-                       0xe3, 0x6b, 0x8a, 0xc5, 0x46, 0x50, 0xca, 0x40,
-                       0xea, 0x4e, 0x82, 0xc1, 0x70, 0x25, 0xd8, 0x7d,
-                       0x60, 0xf5, 0x51, 0x7f, 0x64, 0x03, 0x9f, 0x53,
-                       0xec, 0xfb, 0x57, 0xa9, 0xfc, 0x26, 0x15, 0x17,
-                       0x03, 0x01, 0x00, 0x21, 0xa6, 0xc6, 0x94, 0x2b,
-                       0xa9, 0xcb, 0x93, 0xff, 0xb6, 0xa6, 0xe7, 0xc5,
-                       0x37, 0x86, 0x15, 0x37, 0x57, 0xce, 0xef, 0x54,
-                       0x96, 0x5d, 0x50, 0xa0, 0x50, 0x69, 0x5e, 0x82,
-                       0x61, 0x8d, 0x42, 0xfb, 0x78, 0x15, 0x03, 0x01,
-                       0x00, 0x16, 0x45, 0xd1, 0x86, 0x68, 0x59, 0xc1,
-                       0xaf, 0xac, 0x5c, 0x46, 0x8a, 0x68, 0x69, 0x0c,
-                       0xd7, 0x67, 0xbf, 0xf0, 0x3e, 0xee, 0x45, 0x55,
+                       0x16, 0x03, 0x01, 0x00, 0x72, 0x04, 0x00, 0x00,
+                       0x6e, 0x00, 0x00, 0x00, 0x00, 0x00, 0x68, 0x00,
+                       0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                       0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x65,
+                       0xe8, 0x4b, 0xd1, 0xef, 0xba, 0x96, 0x9a, 0x2a,
+                       0x6c, 0x8c, 0x7e, 0x38, 0x10, 0x46, 0x86, 0x1d,
+                       0x19, 0x1d, 0x62, 0x29, 0x3f, 0x58, 0xfb, 0x6d,
+                       0x89, 0xd2, 0x81, 0x9a, 0x1c, 0xb3, 0x58, 0xb3,
+                       0x19, 0x39, 0x17, 0x47, 0x49, 0xc9, 0xfe, 0x4a,
+                       0x7a, 0x32, 0xac, 0x2c, 0x43, 0xf9, 0xa9, 0xea,
+                       0xec, 0x51, 0x46, 0xf1, 0xb8, 0x59, 0x23, 0x70,
+                       0xce, 0x7c, 0xb9, 0x47, 0x70, 0xa3, 0xc9, 0xae,
+                       0x47, 0x7b, 0x7e, 0xc7, 0xcf, 0x76, 0x12, 0x76,
+                       0x18, 0x90, 0x12, 0xcd, 0xf3, 0xd4, 0x27, 0x81,
+                       0xfc, 0x46, 0x03, 0x3e, 0x05, 0x87, 0x6f, 0x14,
+                       0x03, 0x01, 0x00, 0x01, 0x01, 0x16, 0x03, 0x01,
+                       0x00, 0x24, 0xc3, 0xa0, 0x29, 0xb1, 0x52, 0x82,
+                       0xef, 0x85, 0xa1, 0x64, 0x0f, 0xe4, 0xa3, 0xfb,
+                       0xa7, 0x1d, 0x22, 0x4c, 0xcb, 0xd6, 0x5b, 0x18,
+                       0x61, 0xc7, 0x7c, 0xf2, 0x67, 0x4a, 0xc7, 0x11,
+                       0x9d, 0x8e, 0x0e, 0x15, 0x22, 0xcf, 0x17, 0x03,
+                       0x01, 0x00, 0x21, 0xfd, 0xbb, 0xf1, 0xa9, 0x7c,
+                       0xbf, 0x92, 0xb3, 0xfa, 0x2c, 0x08, 0x6f, 0x22,
+                       0x78, 0x80, 0xf2, 0x2e, 0x86, 0x26, 0x21, 0x36,
+                       0x3f, 0x32, 0xdf, 0xb6, 0x47, 0xa5, 0xf8, 0x27,
+                       0xc1, 0xe9, 0x53, 0x90, 0x15, 0x03, 0x01, 0x00,
+                       0x16, 0xfe, 0xef, 0x2e, 0xa0, 0x5d, 0xe0, 0xce,
+                       0x94, 0x20, 0x56, 0x61, 0x6e, 0xe5, 0x62, 0xce,
+                       0x27, 0x57, 0x3e, 0x30, 0x32, 0x77, 0x53,
                },
        }},
+
        // Server asks for cert with empty CA list, client gives one
        // go test -run "TestRunServer" -serve -clientauth 1
        {"RequestClientCert, client gives it", RequestClientCert, []*x509.Certificate{clientCertificate}, [][]byte{
                {
-                       0x16, 0x03, 0x01, 0x00, 0x54, 0x01, 0x00, 0x00,
-                       0x50, 0x03, 0x01, 0x50, 0x77, 0x43, 0x47, 0xfd,
-                       0x1d, 0xb0, 0x60, 0x4c, 0x25, 0x86, 0x45, 0x4a,
-                       0xe5, 0x3f, 0x80, 0x56, 0x18, 0x91, 0x5c, 0xe2,
-                       0x62, 0xc5, 0x77, 0xc2, 0x92, 0xdd, 0xdc, 0x39,
-                       0x23, 0x1d, 0xc5, 0x00, 0x00, 0x28, 0x00, 0x39,
-                       0x00, 0x38, 0x00, 0x35, 0x00, 0x16, 0x00, 0x13,
-                       0x00, 0x0a, 0x00, 0x33, 0x00, 0x32, 0x00, 0x2f,
-                       0x00, 0x05, 0x00, 0x04, 0x00, 0x15, 0x00, 0x12,
-                       0x00, 0x09, 0x00, 0x14, 0x00, 0x11, 0x00, 0x08,
-                       0x00, 0x06, 0x00, 0x03, 0x00, 0xff, 0x02, 0x01,
-                       0x00,
+                       0x16, 0x03, 0x01, 0x01, 0x1e, 0x01, 0x00, 0x01,
+                       0x1a, 0x03, 0x03, 0x51, 0xe5, 0x74, 0x0e, 0x95,
+                       0x6f, 0x4f, 0x4a, 0xbf, 0xb7, 0xc0, 0x6c, 0xac,
+                       0xd9, 0xfe, 0x7d, 0xd0, 0x51, 0x19, 0x62, 0x62,
+                       0x1c, 0x6e, 0x57, 0x77, 0xd2, 0x31, 0xaf, 0x88,
+                       0xb9, 0xc0, 0x1d, 0x00, 0x00, 0x82, 0xc0, 0x30,
+                       0xc0, 0x2c, 0xc0, 0x28, 0xc0, 0x24, 0xc0, 0x14,
+                       0xc0, 0x0a, 0x00, 0xa3, 0x00, 0x9f, 0x00, 0x6b,
+                       0x00, 0x6a, 0x00, 0x39, 0x00, 0x38, 0xc0, 0x32,
+                       0xc0, 0x2e, 0xc0, 0x2a, 0xc0, 0x26, 0xc0, 0x0f,
+                       0xc0, 0x05, 0x00, 0x9d, 0x00, 0x3d, 0x00, 0x35,
+                       0xc0, 0x12, 0xc0, 0x08, 0x00, 0x16, 0x00, 0x13,
+                       0xc0, 0x0d, 0xc0, 0x03, 0x00, 0x0a, 0xc0, 0x2f,
+                       0xc0, 0x2b, 0xc0, 0x27, 0xc0, 0x23, 0xc0, 0x13,
+                       0xc0, 0x09, 0x00, 0xa2, 0x00, 0x9e, 0x00, 0x67,
+                       0x00, 0x40, 0x00, 0x33, 0x00, 0x32, 0xc0, 0x31,
+                       0xc0, 0x2d, 0xc0, 0x29, 0xc0, 0x25, 0xc0, 0x0e,
+                       0xc0, 0x04, 0x00, 0x9c, 0x00, 0x3c, 0x00, 0x2f,
+                       0x00, 0x07, 0xc0, 0x11, 0xc0, 0x07, 0xc0, 0x0c,
+                       0xc0, 0x02, 0x00, 0x05, 0x00, 0x04, 0x00, 0x15,
+                       0x00, 0x12, 0x00, 0x09, 0x00, 0x14, 0x00, 0x11,
+                       0x00, 0x08, 0x00, 0x06, 0x00, 0x03, 0x00, 0xff,
+                       0x01, 0x00, 0x00, 0x6f, 0x00, 0x0b, 0x00, 0x04,
+                       0x03, 0x00, 0x01, 0x02, 0x00, 0x0a, 0x00, 0x34,
+                       0x00, 0x32, 0x00, 0x0e, 0x00, 0x0d, 0x00, 0x19,
+                       0x00, 0x0b, 0x00, 0x0c, 0x00, 0x18, 0x00, 0x09,
+                       0x00, 0x0a, 0x00, 0x16, 0x00, 0x17, 0x00, 0x08,
+                       0x00, 0x06, 0x00, 0x07, 0x00, 0x14, 0x00, 0x15,
+                       0x00, 0x04, 0x00, 0x05, 0x00, 0x12, 0x00, 0x13,
+                       0x00, 0x01, 0x00, 0x02, 0x00, 0x03, 0x00, 0x0f,
+                       0x00, 0x10, 0x00, 0x11, 0x00, 0x23, 0x00, 0x00,
+                       0x00, 0x0d, 0x00, 0x22, 0x00, 0x20, 0x06, 0x01,
+                       0x06, 0x02, 0x06, 0x03, 0x05, 0x01, 0x05, 0x02,
+                       0x05, 0x03, 0x04, 0x01, 0x04, 0x02, 0x04, 0x03,
+                       0x03, 0x01, 0x03, 0x02, 0x03, 0x03, 0x02, 0x01,
+                       0x02, 0x02, 0x02, 0x03, 0x01, 0x01, 0x00, 0x0f,
+                       0x00, 0x01, 0x01,
                },
                {
-                       0x16, 0x03, 0x01, 0x00, 0x2a, 0x02, 0x00, 0x00,
-                       0x26, 0x03, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
+                       0x16, 0x03, 0x01, 0x00, 0x30, 0x02, 0x00, 0x00,
+                       0x2c, 0x03, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
                        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                       0x00, 0x00, 0x00, 0x00, 0x00, 0x05, 0x00, 0x16,
-                       0x03, 0x01, 0x02, 0xbe, 0x0b, 0x00, 0x02, 0xba,
-                       0x00, 0x02, 0xb7, 0x00, 0x02, 0xb4, 0x30, 0x82,
-                       0x02, 0xb0, 0x30, 0x82, 0x02, 0x19, 0xa0, 0x03,
-                       0x02, 0x01, 0x02, 0x02, 0x09, 0x00, 0x85, 0xb0,
-                       0xbb, 0xa4, 0x8a, 0x7f, 0xb8, 0xca, 0x30, 0x0d,
-                       0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d,
-                       0x01, 0x01, 0x05, 0x05, 0x00, 0x30, 0x45, 0x31,
+                       0x00, 0x00, 0x00, 0x00, 0x00, 0x05, 0x00, 0x00,
+                       0x04, 0x00, 0x23, 0x00, 0x00, 0x16, 0x03, 0x01,
+                       0x02, 0xbe, 0x0b, 0x00, 0x02, 0xba, 0x00, 0x02,
+                       0xb7, 0x00, 0x02, 0xb4, 0x30, 0x82, 0x02, 0xb0,
+                       0x30, 0x82, 0x02, 0x19, 0xa0, 0x03, 0x02, 0x01,
+                       0x02, 0x02, 0x09, 0x00, 0x85, 0xb0, 0xbb, 0xa4,
+                       0x8a, 0x7f, 0xb8, 0xca, 0x30, 0x0d, 0x06, 0x09,
+                       0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01,
+                       0x05, 0x05, 0x00, 0x30, 0x45, 0x31, 0x0b, 0x30,
+                       0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02,
+                       0x41, 0x55, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03,
+                       0x55, 0x04, 0x08, 0x13, 0x0a, 0x53, 0x6f, 0x6d,
+                       0x65, 0x2d, 0x53, 0x74, 0x61, 0x74, 0x65, 0x31,
+                       0x21, 0x30, 0x1f, 0x06, 0x03, 0x55, 0x04, 0x0a,
+                       0x13, 0x18, 0x49, 0x6e, 0x74, 0x65, 0x72, 0x6e,
+                       0x65, 0x74, 0x20, 0x57, 0x69, 0x64, 0x67, 0x69,
+                       0x74, 0x73, 0x20, 0x50, 0x74, 0x79, 0x20, 0x4c,
+                       0x74, 0x64, 0x30, 0x1e, 0x17, 0x0d, 0x31, 0x30,
+                       0x30, 0x34, 0x32, 0x34, 0x30, 0x39, 0x30, 0x39,
+                       0x33, 0x38, 0x5a, 0x17, 0x0d, 0x31, 0x31, 0x30,
+                       0x34, 0x32, 0x34, 0x30, 0x39, 0x30, 0x39, 0x33,
+                       0x38, 0x5a, 0x30, 0x45, 0x31, 0x0b, 0x30, 0x09,
+                       0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x41,
+                       0x55, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55,
+                       0x04, 0x08, 0x13, 0x0a, 0x53, 0x6f, 0x6d, 0x65,
+                       0x2d, 0x53, 0x74, 0x61, 0x74, 0x65, 0x31, 0x21,
+                       0x30, 0x1f, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x13,
+                       0x18, 0x49, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x65,
+                       0x74, 0x20, 0x57, 0x69, 0x64, 0x67, 0x69, 0x74,
+                       0x73, 0x20, 0x50, 0x74, 0x79, 0x20, 0x4c, 0x74,
+                       0x64, 0x30, 0x81, 0x9f, 0x30, 0x0d, 0x06, 0x09,
+                       0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01,
+                       0x01, 0x05, 0x00, 0x03, 0x81, 0x8d, 0x00, 0x30,
+                       0x81, 0x89, 0x02, 0x81, 0x81, 0x00, 0xbb, 0x79,
+                       0xd6, 0xf5, 0x17, 0xb5, 0xe5, 0xbf, 0x46, 0x10,
+                       0xd0, 0xdc, 0x69, 0xbe, 0xe6, 0x2b, 0x07, 0x43,
+                       0x5a, 0xd0, 0x03, 0x2d, 0x8a, 0x7a, 0x43, 0x85,
+                       0xb7, 0x14, 0x52, 0xe7, 0xa5, 0x65, 0x4c, 0x2c,
+                       0x78, 0xb8, 0x23, 0x8c, 0xb5, 0xb4, 0x82, 0xe5,
+                       0xde, 0x1f, 0x95, 0x3b, 0x7e, 0x62, 0xa5, 0x2c,
+                       0xa5, 0x33, 0xd6, 0xfe, 0x12, 0x5c, 0x7a, 0x56,
+                       0xfc, 0xf5, 0x06, 0xbf, 0xfa, 0x58, 0x7b, 0x26,
+                       0x3f, 0xb5, 0xcd, 0x04, 0xd3, 0xd0, 0xc9, 0x21,
+                       0x96, 0x4a, 0xc7, 0xf4, 0x54, 0x9f, 0x5a, 0xbf,
+                       0xef, 0x42, 0x71, 0x00, 0xfe, 0x18, 0x99, 0x07,
+                       0x7f, 0x7e, 0x88, 0x7d, 0x7d, 0xf1, 0x04, 0x39,
+                       0xc4, 0xa2, 0x2e, 0xdb, 0x51, 0xc9, 0x7c, 0xe3,
+                       0xc0, 0x4c, 0x3b, 0x32, 0x66, 0x01, 0xcf, 0xaf,
+                       0xb1, 0x1d, 0xb8, 0x71, 0x9a, 0x1d, 0xdb, 0xdb,
+                       0x89, 0x6b, 0xae, 0xda, 0x2d, 0x79, 0x02, 0x03,
+                       0x01, 0x00, 0x01, 0xa3, 0x81, 0xa7, 0x30, 0x81,
+                       0xa4, 0x30, 0x1d, 0x06, 0x03, 0x55, 0x1d, 0x0e,
+                       0x04, 0x16, 0x04, 0x14, 0xb1, 0xad, 0xe2, 0x85,
+                       0x5a, 0xcf, 0xcb, 0x28, 0xdb, 0x69, 0xce, 0x23,
+                       0x69, 0xde, 0xd3, 0x26, 0x8e, 0x18, 0x88, 0x39,
+                       0x30, 0x75, 0x06, 0x03, 0x55, 0x1d, 0x23, 0x04,
+                       0x6e, 0x30, 0x6c, 0x80, 0x14, 0xb1, 0xad, 0xe2,
+                       0x85, 0x5a, 0xcf, 0xcb, 0x28, 0xdb, 0x69, 0xce,
+                       0x23, 0x69, 0xde, 0xd3, 0x26, 0x8e, 0x18, 0x88,
+                       0x39, 0xa1, 0x49, 0xa4, 0x47, 0x30, 0x45, 0x31,
                        0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06,
                        0x13, 0x02, 0x41, 0x55, 0x31, 0x13, 0x30, 0x11,
                        0x06, 0x03, 0x55, 0x04, 0x08, 0x13, 0x0a, 0x53,
@@ -1778,82 +2190,31 @@ var clientauthTests = []clientauthTest{
                        0x04, 0x0a, 0x13, 0x18, 0x49, 0x6e, 0x74, 0x65,
                        0x72, 0x6e, 0x65, 0x74, 0x20, 0x57, 0x69, 0x64,
                        0x67, 0x69, 0x74, 0x73, 0x20, 0x50, 0x74, 0x79,
-                       0x20, 0x4c, 0x74, 0x64, 0x30, 0x1e, 0x17, 0x0d,
-                       0x31, 0x30, 0x30, 0x34, 0x32, 0x34, 0x30, 0x39,
-                       0x30, 0x39, 0x33, 0x38, 0x5a, 0x17, 0x0d, 0x31,
-                       0x31, 0x30, 0x34, 0x32, 0x34, 0x30, 0x39, 0x30,
-                       0x39, 0x33, 0x38, 0x5a, 0x30, 0x45, 0x31, 0x0b,
-                       0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13,
-                       0x02, 0x41, 0x55, 0x31, 0x13, 0x30, 0x11, 0x06,
-                       0x03, 0x55, 0x04, 0x08, 0x13, 0x0a, 0x53, 0x6f,
-                       0x6d, 0x65, 0x2d, 0x53, 0x74, 0x61, 0x74, 0x65,
-                       0x31, 0x21, 0x30, 0x1f, 0x06, 0x03, 0x55, 0x04,
-                       0x0a, 0x13, 0x18, 0x49, 0x6e, 0x74, 0x65, 0x72,
-                       0x6e, 0x65, 0x74, 0x20, 0x57, 0x69, 0x64, 0x67,
-                       0x69, 0x74, 0x73, 0x20, 0x50, 0x74, 0x79, 0x20,
-                       0x4c, 0x74, 0x64, 0x30, 0x81, 0x9f, 0x30, 0x0d,
-                       0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d,
-                       0x01, 0x01, 0x01, 0x05, 0x00, 0x03, 0x81, 0x8d,
-                       0x00, 0x30, 0x81, 0x89, 0x02, 0x81, 0x81, 0x00,
-                       0xbb, 0x79, 0xd6, 0xf5, 0x17, 0xb5, 0xe5, 0xbf,
-                       0x46, 0x10, 0xd0, 0xdc, 0x69, 0xbe, 0xe6, 0x2b,
-                       0x07, 0x43, 0x5a, 0xd0, 0x03, 0x2d, 0x8a, 0x7a,
-                       0x43, 0x85, 0xb7, 0x14, 0x52, 0xe7, 0xa5, 0x65,
-                       0x4c, 0x2c, 0x78, 0xb8, 0x23, 0x8c, 0xb5, 0xb4,
-                       0x82, 0xe5, 0xde, 0x1f, 0x95, 0x3b, 0x7e, 0x62,
-                       0xa5, 0x2c, 0xa5, 0x33, 0xd6, 0xfe, 0x12, 0x5c,
-                       0x7a, 0x56, 0xfc, 0xf5, 0x06, 0xbf, 0xfa, 0x58,
-                       0x7b, 0x26, 0x3f, 0xb5, 0xcd, 0x04, 0xd3, 0xd0,
-                       0xc9, 0x21, 0x96, 0x4a, 0xc7, 0xf4, 0x54, 0x9f,
-                       0x5a, 0xbf, 0xef, 0x42, 0x71, 0x00, 0xfe, 0x18,
-                       0x99, 0x07, 0x7f, 0x7e, 0x88, 0x7d, 0x7d, 0xf1,
-                       0x04, 0x39, 0xc4, 0xa2, 0x2e, 0xdb, 0x51, 0xc9,
-                       0x7c, 0xe3, 0xc0, 0x4c, 0x3b, 0x32, 0x66, 0x01,
-                       0xcf, 0xaf, 0xb1, 0x1d, 0xb8, 0x71, 0x9a, 0x1d,
-                       0xdb, 0xdb, 0x89, 0x6b, 0xae, 0xda, 0x2d, 0x79,
-                       0x02, 0x03, 0x01, 0x00, 0x01, 0xa3, 0x81, 0xa7,
-                       0x30, 0x81, 0xa4, 0x30, 0x1d, 0x06, 0x03, 0x55,
-                       0x1d, 0x0e, 0x04, 0x16, 0x04, 0x14, 0xb1, 0xad,
-                       0xe2, 0x85, 0x5a, 0xcf, 0xcb, 0x28, 0xdb, 0x69,
-                       0xce, 0x23, 0x69, 0xde, 0xd3, 0x26, 0x8e, 0x18,
-                       0x88, 0x39, 0x30, 0x75, 0x06, 0x03, 0x55, 0x1d,
-                       0x23, 0x04, 0x6e, 0x30, 0x6c, 0x80, 0x14, 0xb1,
-                       0xad, 0xe2, 0x85, 0x5a, 0xcf, 0xcb, 0x28, 0xdb,
-                       0x69, 0xce, 0x23, 0x69, 0xde, 0xd3, 0x26, 0x8e,
-                       0x18, 0x88, 0x39, 0xa1, 0x49, 0xa4, 0x47, 0x30,
-                       0x45, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55,
-                       0x04, 0x06, 0x13, 0x02, 0x41, 0x55, 0x31, 0x13,
-                       0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x08, 0x13,
-                       0x0a, 0x53, 0x6f, 0x6d, 0x65, 0x2d, 0x53, 0x74,
-                       0x61, 0x74, 0x65, 0x31, 0x21, 0x30, 0x1f, 0x06,
-                       0x03, 0x55, 0x04, 0x0a, 0x13, 0x18, 0x49, 0x6e,
-                       0x74, 0x65, 0x72, 0x6e, 0x65, 0x74, 0x20, 0x57,
-                       0x69, 0x64, 0x67, 0x69, 0x74, 0x73, 0x20, 0x50,
-                       0x74, 0x79, 0x20, 0x4c, 0x74, 0x64, 0x82, 0x09,
-                       0x00, 0x85, 0xb0, 0xbb, 0xa4, 0x8a, 0x7f, 0xb8,
-                       0xca, 0x30, 0x0c, 0x06, 0x03, 0x55, 0x1d, 0x13,
-                       0x04, 0x05, 0x30, 0x03, 0x01, 0x01, 0xff, 0x30,
-                       0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7,
-                       0x0d, 0x01, 0x01, 0x05, 0x05, 0x00, 0x03, 0x81,
-                       0x81, 0x00, 0x08, 0x6c, 0x45, 0x24, 0xc7, 0x6b,
-                       0xb1, 0x59, 0xab, 0x0c, 0x52, 0xcc, 0xf2, 0xb0,
-                       0x14, 0xd7, 0x87, 0x9d, 0x7a, 0x64, 0x75, 0xb5,
-                       0x5a, 0x95, 0x66, 0xe4, 0xc5, 0x2b, 0x8e, 0xae,
-                       0x12, 0x66, 0x1f, 0xeb, 0x4f, 0x38, 0xb3, 0x6e,
-                       0x60, 0xd3, 0x92, 0xfd, 0xf7, 0x41, 0x08, 0xb5,
-                       0x25, 0x13, 0xb1, 0x18, 0x7a, 0x24, 0xfb, 0x30,
-                       0x1d, 0xba, 0xed, 0x98, 0xb9, 0x17, 0xec, 0xe7,
-                       0xd7, 0x31, 0x59, 0xdb, 0x95, 0xd3, 0x1d, 0x78,
-                       0xea, 0x50, 0x56, 0x5c, 0xd5, 0x82, 0x5a, 0x2d,
-                       0x5a, 0x5f, 0x33, 0xc4, 0xb6, 0xd8, 0xc9, 0x75,
-                       0x90, 0x96, 0x8c, 0x0f, 0x52, 0x98, 0xb5, 0xcd,
-                       0x98, 0x1f, 0x89, 0x20, 0x5f, 0xf2, 0xa0, 0x1c,
-                       0xa3, 0x1b, 0x96, 0x94, 0xdd, 0xa9, 0xfd, 0x57,
-                       0xe9, 0x70, 0xe8, 0x26, 0x6d, 0x71, 0x99, 0x9b,
-                       0x26, 0x6e, 0x38, 0x50, 0x29, 0x6c, 0x90, 0xa7,
-                       0xbd, 0xd9, 0x16, 0x03, 0x01, 0x00, 0x08, 0x0d,
-                       0x00, 0x00, 0x04, 0x01, 0x01, 0x00, 0x00, 0x16,
-                       0x03, 0x01, 0x00, 0x04, 0x0e, 0x00, 0x00, 0x00,
+                       0x20, 0x4c, 0x74, 0x64, 0x82, 0x09, 0x00, 0x85,
+                       0xb0, 0xbb, 0xa4, 0x8a, 0x7f, 0xb8, 0xca, 0x30,
+                       0x0c, 0x06, 0x03, 0x55, 0x1d, 0x13, 0x04, 0x05,
+                       0x30, 0x03, 0x01, 0x01, 0xff, 0x30, 0x0d, 0x06,
+                       0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01,
+                       0x01, 0x05, 0x05, 0x00, 0x03, 0x81, 0x81, 0x00,
+                       0x08, 0x6c, 0x45, 0x24, 0xc7, 0x6b, 0xb1, 0x59,
+                       0xab, 0x0c, 0x52, 0xcc, 0xf2, 0xb0, 0x14, 0xd7,
+                       0x87, 0x9d, 0x7a, 0x64, 0x75, 0xb5, 0x5a, 0x95,
+                       0x66, 0xe4, 0xc5, 0x2b, 0x8e, 0xae, 0x12, 0x66,
+                       0x1f, 0xeb, 0x4f, 0x38, 0xb3, 0x6e, 0x60, 0xd3,
+                       0x92, 0xfd, 0xf7, 0x41, 0x08, 0xb5, 0x25, 0x13,
+                       0xb1, 0x18, 0x7a, 0x24, 0xfb, 0x30, 0x1d, 0xba,
+                       0xed, 0x98, 0xb9, 0x17, 0xec, 0xe7, 0xd7, 0x31,
+                       0x59, 0xdb, 0x95, 0xd3, 0x1d, 0x78, 0xea, 0x50,
+                       0x56, 0x5c, 0xd5, 0x82, 0x5a, 0x2d, 0x5a, 0x5f,
+                       0x33, 0xc4, 0xb6, 0xd8, 0xc9, 0x75, 0x90, 0x96,
+                       0x8c, 0x0f, 0x52, 0x98, 0xb5, 0xcd, 0x98, 0x1f,
+                       0x89, 0x20, 0x5f, 0xf2, 0xa0, 0x1c, 0xa3, 0x1b,
+                       0x96, 0x94, 0xdd, 0xa9, 0xfd, 0x57, 0xe9, 0x70,
+                       0xe8, 0x26, 0x6d, 0x71, 0x99, 0x9b, 0x26, 0x6e,
+                       0x38, 0x50, 0x29, 0x6c, 0x90, 0xa7, 0xbd, 0xd9,
+                       0x16, 0x03, 0x01, 0x00, 0x09, 0x0d, 0x00, 0x00,
+                       0x05, 0x02, 0x01, 0x40, 0x00, 0x00, 0x16, 0x03,
+                       0x01, 0x00, 0x04, 0x0e, 0x00, 0x00, 0x00,
                },
                {
                        0x16, 0x03, 0x01, 0x01, 0xfb, 0x0b, 0x00, 0x01,
@@ -1921,62 +2282,140 @@ var clientauthTests = []clientauthTest{
                        0x51, 0x8d, 0x10, 0x7e, 0x4f, 0x94, 0x67, 0xdf,
                        0xa3, 0x4e, 0x70, 0x73, 0x8e, 0x90, 0x91, 0x85,
                        0x16, 0x03, 0x01, 0x00, 0x86, 0x10, 0x00, 0x00,
-                       0x82, 0x00, 0x80, 0x81, 0x46, 0x43, 0xf9, 0xe7,
-                       0xda, 0x8c, 0x92, 0x3a, 0x78, 0x1a, 0x86, 0xb3,
-                       0xbe, 0x83, 0x22, 0xb6, 0xaa, 0x57, 0x37, 0x68,
-                       0x9e, 0x54, 0x3f, 0xd3, 0xce, 0x4d, 0x5e, 0x2a,
-                       0xdc, 0xb0, 0x49, 0x02, 0xbb, 0xc0, 0x45, 0x58,
-                       0x79, 0x10, 0xc7, 0x94, 0x60, 0x9f, 0x1b, 0x5f,
-                       0x18, 0x31, 0x37, 0x9c, 0xe0, 0xe6, 0xdf, 0x5e,
-                       0x70, 0x44, 0xf6, 0x8b, 0xdf, 0xf1, 0xf6, 0x43,
-                       0xc8, 0x2f, 0xd1, 0xce, 0xd0, 0xd6, 0x64, 0x4f,
-                       0xe8, 0x2b, 0xfa, 0xd3, 0xd0, 0xd1, 0x2e, 0xaa,
-                       0x9b, 0x1d, 0x13, 0x5c, 0xbe, 0x57, 0x41, 0x6c,
-                       0x5e, 0x8d, 0xea, 0xa9, 0x3c, 0x58, 0xa0, 0x30,
-                       0x92, 0x77, 0x7a, 0xed, 0x64, 0x58, 0xe5, 0x7f,
-                       0x6a, 0x93, 0x89, 0x66, 0x3d, 0x13, 0x16, 0x56,
-                       0xa0, 0xad, 0xdc, 0x68, 0x95, 0x87, 0x81, 0xd0,
-                       0x90, 0x4d, 0x5f, 0xfe, 0x3e, 0x83, 0x15, 0x2e,
-                       0x50, 0x3c, 0xdd, 0x16, 0x03, 0x01, 0x00, 0x86,
-                       0x0f, 0x00, 0x00, 0x82, 0x00, 0x80, 0x2b, 0xf8,
-                       0x56, 0x48, 0xbb, 0x02, 0x37, 0x15, 0x02, 0x74,
-                       0x33, 0x53, 0x65, 0xa7, 0x7c, 0x2f, 0xc6, 0x5d,
-                       0x80, 0x59, 0xc1, 0xc2, 0x3b, 0xa9, 0xde, 0x4e,
-                       0x70, 0x51, 0xd2, 0xde, 0x58, 0x7f, 0xd8, 0xb9,
-                       0xb6, 0x3b, 0xc8, 0xaa, 0xfc, 0x3d, 0x53, 0x2d,
-                       0x61, 0x4d, 0xf5, 0x60, 0x12, 0xc2, 0xa5, 0x39,
-                       0x0c, 0xa7, 0xc6, 0xac, 0x26, 0x4b, 0xf4, 0x5f,
-                       0xe9, 0xf4, 0xf2, 0x73, 0x48, 0xe4, 0x3b, 0xee,
-                       0xf2, 0xee, 0xc0, 0xee, 0xfb, 0x5b, 0x60, 0xc2,
-                       0x74, 0xe6, 0xf6, 0x43, 0x3e, 0xa4, 0xf7, 0x97,
-                       0x3d, 0xfc, 0xe9, 0x44, 0x21, 0x18, 0x46, 0x05,
-                       0x33, 0xf8, 0xfe, 0x35, 0x5b, 0xe6, 0x8f, 0xef,
-                       0x4d, 0x4c, 0x87, 0xf6, 0xb4, 0x6e, 0x6b, 0x39,
-                       0xd8, 0xaa, 0x1b, 0x33, 0xc9, 0x1c, 0x66, 0x48,
-                       0xbe, 0xfa, 0xb5, 0x92, 0x09, 0xfd, 0xb9, 0xb9,
-                       0xca, 0xe6, 0x6d, 0x71, 0xc6, 0x89, 0x14, 0x03,
+                       0x82, 0x00, 0x80, 0x0a, 0x4e, 0x89, 0xdf, 0x3a,
+                       0x3f, 0xf0, 0x4f, 0xef, 0x1a, 0x90, 0xd4, 0x3c,
+                       0xaf, 0x10, 0x57, 0xb0, 0xa1, 0x5f, 0xcd, 0x62,
+                       0x01, 0xe9, 0x0c, 0x36, 0x42, 0xfd, 0xaf, 0x23,
+                       0xf9, 0x14, 0xa6, 0x72, 0x26, 0x4e, 0x01, 0xdb,
+                       0xac, 0xb7, 0x4c, 0xe6, 0xa9, 0x52, 0xe2, 0xec,
+                       0x26, 0x8c, 0x7a, 0x64, 0xf8, 0x0b, 0x4c, 0x2f,
+                       0xa9, 0xcb, 0x75, 0xaf, 0x60, 0xd4, 0xb4, 0xe6,
+                       0xe8, 0xdb, 0x78, 0x78, 0x85, 0xf6, 0x0c, 0x95,
+                       0xcc, 0xb6, 0x55, 0xb9, 0xba, 0x9e, 0x91, 0xbc,
+                       0x66, 0xdb, 0x1e, 0x28, 0xab, 0x73, 0xce, 0x8b,
+                       0xd0, 0xd3, 0xe8, 0xbc, 0xd0, 0x21, 0x28, 0xbd,
+                       0xfb, 0x74, 0x64, 0xde, 0x3b, 0x3b, 0xd3, 0x4c,
+                       0x32, 0x40, 0x82, 0xba, 0x91, 0x1e, 0xe8, 0x47,
+                       0xc2, 0x09, 0xb7, 0x16, 0xaa, 0x25, 0xa9, 0x3c,
+                       0x6c, 0xa7, 0xf8, 0xc9, 0x54, 0x84, 0xc6, 0xf7,
+                       0x56, 0x05, 0xa4, 0x16, 0x03, 0x01, 0x00, 0x86,
+                       0x0f, 0x00, 0x00, 0x82, 0x00, 0x80, 0x4b, 0xab,
+                       0xda, 0xac, 0x2a, 0xb3, 0xe6, 0x34, 0x55, 0xcd,
+                       0xf2, 0x4b, 0x67, 0xe3, 0xd3, 0xff, 0xa3, 0xf4,
+                       0x79, 0x82, 0x01, 0x47, 0x8a, 0xe3, 0x9f, 0x89,
+                       0x70, 0xbe, 0x24, 0x24, 0xb7, 0x69, 0x60, 0xed,
+                       0x55, 0xa0, 0xca, 0x72, 0xb6, 0x4a, 0xbc, 0x1d,
+                       0xe2, 0x3f, 0xb5, 0x31, 0xda, 0x02, 0xf6, 0x37,
+                       0x51, 0xf8, 0x4c, 0x88, 0x2e, 0xb3, 0x8a, 0xe8,
+                       0x7b, 0x4a, 0x90, 0x36, 0xe4, 0xa6, 0x31, 0x95,
+                       0x8b, 0xa0, 0xc6, 0x91, 0x12, 0xb9, 0x35, 0x4e,
+                       0x72, 0xeb, 0x5c, 0xa2, 0xe8, 0x4c, 0x68, 0xf9,
+                       0x69, 0xfa, 0x70, 0x60, 0x6c, 0x7f, 0x32, 0x99,
+                       0xf1, 0xc3, 0x2d, 0xb4, 0x59, 0x58, 0x87, 0xaf,
+                       0x67, 0x62, 0x90, 0xe7, 0x8d, 0xd0, 0xa3, 0x77,
+                       0x33, 0xc2, 0x9b, 0xd5, 0x9c, 0xc7, 0xea, 0x25,
+                       0x98, 0x76, 0x9c, 0xe0, 0x6a, 0x03, 0x3a, 0x10,
+                       0xfd, 0x10, 0x3d, 0x55, 0x53, 0xa0, 0x14, 0x03,
                        0x01, 0x00, 0x01, 0x01, 0x16, 0x03, 0x01, 0x00,
-                       0x24, 0xe3, 0x2b, 0xef, 0x17, 0xd5, 0xa6, 0x4c,
-                       0x2e, 0x10, 0xac, 0x9c, 0xfe, 0x0f, 0x18, 0x43,
-                       0x95, 0x00, 0x81, 0xf7, 0x7c, 0x00, 0x5b, 0x89,
-                       0x52, 0x41, 0xe4, 0x8a, 0x8a, 0x34, 0x31, 0x09,
-                       0x48, 0x7c, 0xc5, 0xc3, 0x83,
+                       0x24, 0xd5, 0x12, 0xfc, 0xb9, 0x5a, 0xe3, 0x27,
+                       0x01, 0xbe, 0xc3, 0x77, 0x17, 0x1a, 0xbb, 0x4f,
+                       0xae, 0xd5, 0xa7, 0xee, 0x56, 0x61, 0x0d, 0x40,
+                       0xf4, 0xa4, 0xb5, 0xcc, 0x76, 0xfd, 0xbd, 0x13,
+                       0x04, 0xe1, 0xb8, 0xc7, 0x36,
                },
                {
-                       0x14, 0x03, 0x01, 0x00, 0x01, 0x01, 0x16, 0x03,
-                       0x01, 0x00, 0x24, 0x24, 0xaa, 0xaa, 0x56, 0x8b,
-                       0x41, 0x87, 0x01, 0xbe, 0x80, 0x05, 0x51, 0x36,
-                       0x08, 0xfc, 0xaf, 0xff, 0x7f, 0xf4, 0x74, 0x84,
-                       0x88, 0xdc, 0xb8, 0x8e, 0x70, 0x6c, 0x22, 0x04,
-                       0xee, 0x45, 0x8d, 0xda, 0xed, 0xc6, 0x05, 0x17,
-                       0x03, 0x01, 0x00, 0x21, 0x91, 0x49, 0x4b, 0xed,
-                       0xa3, 0x41, 0xe9, 0x88, 0x3b, 0xa3, 0x01, 0xee,
-                       0x77, 0x4e, 0x12, 0xb4, 0xcd, 0x5e, 0xcc, 0x45,
-                       0x02, 0x5a, 0x20, 0xd6, 0xe8, 0xac, 0xcb, 0x60,
-                       0xcb, 0x1b, 0xef, 0xf9, 0xc2, 0x15, 0x03, 0x01,
-                       0x00, 0x16, 0xd4, 0xcd, 0x92, 0x3c, 0x10, 0x93,
-                       0x68, 0xc3, 0xdd, 0xaf, 0xe9, 0xcb, 0x5d, 0x94,
-                       0x1a, 0x06, 0x81, 0xa7, 0x78, 0x0f, 0xc3, 0x03,
+                       0x16, 0x03, 0x01, 0x02, 0x67, 0x04, 0x00, 0x02,
+                       0x63, 0x00, 0x00, 0x00, 0x00, 0x02, 0x5d, 0x00,
+                       0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                       0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x65,
+                       0xe8, 0x4b, 0xd1, 0xef, 0xba, 0x1f, 0xe2, 0x69,
+                       0x07, 0x7f, 0x85, 0x2d, 0x4e, 0x2a, 0x2e, 0xbd,
+                       0x05, 0xe9, 0xc1, 0x6c, 0x9e, 0xbf, 0x47, 0x18,
+                       0x91, 0x77, 0xf7, 0xe8, 0xb6, 0x27, 0x37, 0xa6,
+                       0x6b, 0x87, 0x29, 0xbb, 0x3b, 0xe5, 0x68, 0x62,
+                       0x04, 0x3e, 0xad, 0x4d, 0xff, 0xad, 0xf1, 0x22,
+                       0x87, 0x8d, 0xf6, 0x04, 0x3b, 0x59, 0x22, 0xf7,
+                       0xfd, 0x88, 0x0e, 0xa4, 0x09, 0xc0, 0x0d, 0x10,
+                       0x80, 0x10, 0x79, 0xee, 0x70, 0x96, 0xdb, 0x22,
+                       0x8b, 0xb7, 0xac, 0xe0, 0x98, 0xad, 0xe9, 0xe3,
+                       0xcb, 0xea, 0x9f, 0xe6, 0x83, 0x28, 0x7c, 0x7e,
+                       0x4e, 0x9a, 0x8d, 0xd9, 0xf3, 0x86, 0xf4, 0x89,
+                       0x8b, 0x79, 0x8f, 0xbb, 0xe9, 0x74, 0x02, 0x02,
+                       0x14, 0x04, 0xea, 0xba, 0x16, 0x10, 0xa1, 0x85,
+                       0xbe, 0x4e, 0x4e, 0x92, 0xc5, 0x83, 0xf6, 0x1e,
+                       0x1f, 0xd4, 0x25, 0xc2, 0xc2, 0xb9, 0xce, 0x33,
+                       0x63, 0x66, 0x79, 0x1f, 0x54, 0x35, 0xc1, 0xe8,
+                       0x89, 0x34, 0x78, 0x94, 0x36, 0x14, 0xef, 0x01,
+                       0x1f, 0xf1, 0xbd, 0x77, 0x2c, 0x4d, 0xac, 0x5c,
+                       0x5c, 0x4a, 0xc6, 0xed, 0xd8, 0x0e, 0x72, 0x84,
+                       0x83, 0xdc, 0x56, 0x84, 0xc8, 0xf3, 0x89, 0x56,
+                       0xfd, 0x89, 0xc1, 0xc9, 0x9a, 0x29, 0x91, 0x7e,
+                       0x19, 0xe9, 0x8b, 0x5b, 0x11, 0x15, 0x4e, 0x6c,
+                       0xf4, 0x89, 0xe7, 0x6d, 0x68, 0x1e, 0xf9, 0x6c,
+                       0x23, 0x72, 0x05, 0x68, 0x82, 0x60, 0x84, 0x1f,
+                       0x83, 0x20, 0x09, 0x86, 0x10, 0x81, 0xec, 0xec,
+                       0xdc, 0x25, 0x53, 0x20, 0xfa, 0xa9, 0x41, 0x64,
+                       0xd6, 0x20, 0xf3, 0xf4, 0x52, 0xf2, 0x80, 0x62,
+                       0x83, 0xc9, 0x23, 0x66, 0x44, 0x95, 0x5a, 0x99,
+                       0x8a, 0xe1, 0x26, 0x63, 0xc1, 0x8b, 0x31, 0xf9,
+                       0x21, 0x06, 0x77, 0x04, 0x27, 0xf2, 0x0c, 0x63,
+                       0x83, 0x45, 0xa0, 0xa9, 0x7b, 0xcf, 0xdf, 0xd7,
+                       0x56, 0x75, 0xbc, 0xdd, 0x95, 0x36, 0xb1, 0x75,
+                       0x39, 0x05, 0x00, 0x3c, 0x8a, 0x79, 0xd6, 0xe9,
+                       0xf0, 0x4b, 0xdc, 0x51, 0x6b, 0x01, 0x94, 0x16,
+                       0x87, 0x12, 0x92, 0x6c, 0x07, 0xc1, 0xf5, 0x58,
+                       0xb7, 0x2a, 0x81, 0xf5, 0xa0, 0x37, 0x8b, 0xa6,
+                       0x22, 0xfe, 0x28, 0x0a, 0x7e, 0x68, 0xe2, 0xda,
+                       0x6c, 0x53, 0xee, 0x0e, 0x8d, 0x2d, 0x8b, 0x0b,
+                       0xda, 0xf8, 0x99, 0x3e, 0x0e, 0xed, 0x9f, 0xc1,
+                       0x2b, 0xf6, 0xfe, 0xe9, 0x52, 0x38, 0x7b, 0x83,
+                       0x9a, 0x50, 0xa6, 0xd7, 0x49, 0x83, 0x43, 0x7e,
+                       0x82, 0xec, 0xc7, 0x09, 0x3d, 0x3d, 0xb1, 0xee,
+                       0xe8, 0xc5, 0x6a, 0xc3, 0x3d, 0x4b, 0x4c, 0x6a,
+                       0xbb, 0x0b, 0x2c, 0x24, 0x2e, 0xdb, 0x7d, 0x57,
+                       0x87, 0xb4, 0x80, 0xa5, 0xae, 0xff, 0x54, 0xa8,
+                       0xa5, 0x27, 0x69, 0x95, 0xc8, 0xe7, 0x79, 0xc7,
+                       0x89, 0x2a, 0x73, 0x49, 0xcb, 0xf5, 0xc5, 0xbc,
+                       0x4a, 0xe0, 0x73, 0xa9, 0xbc, 0x88, 0x64, 0x96,
+                       0x98, 0xa5, 0x1e, 0xe3, 0x43, 0xc1, 0x7d, 0x78,
+                       0xc7, 0x94, 0x72, 0xd4, 0x2c, 0x6e, 0x85, 0x39,
+                       0x9a, 0xaf, 0xdb, 0xa1, 0xe9, 0xe2, 0xcb, 0x37,
+                       0x04, 0xc6, 0x8c, 0x81, 0xd3, 0x2a, 0xb7, 0xbe,
+                       0x6c, 0x07, 0x1f, 0x5e, 0xd9, 0x00, 0xd2, 0xf7,
+                       0xe1, 0xa7, 0xbc, 0x0c, 0xb6, 0x6d, 0xfb, 0x3f,
+                       0x3d, 0x24, 0xaa, 0xfb, 0x7e, 0xe1, 0xb5, 0x1b,
+                       0xff, 0x38, 0xaa, 0x69, 0x59, 0x38, 0x52, 0x9a,
+                       0x0e, 0x6d, 0xbc, 0xde, 0x4f, 0x13, 0x09, 0x17,
+                       0xc4, 0xa9, 0x05, 0x84, 0xbc, 0x50, 0xef, 0x40,
+                       0xb0, 0x4c, 0x24, 0x32, 0xed, 0x94, 0x2c, 0xdd,
+                       0xda, 0x20, 0x24, 0x67, 0xe2, 0xea, 0x71, 0x3d,
+                       0x4a, 0x04, 0x0d, 0x98, 0x29, 0x20, 0x4c, 0xeb,
+                       0x70, 0xce, 0x45, 0x9e, 0x5a, 0xaf, 0xb6, 0xa3,
+                       0x92, 0xc8, 0x28, 0xf2, 0xe3, 0xe8, 0x8a, 0x5d,
+                       0x0a, 0x33, 0x79, 0x9b, 0x6a, 0xf3, 0x30, 0x01,
+                       0x1d, 0x47, 0xbd, 0x01, 0xcc, 0x4d, 0x71, 0xc0,
+                       0x56, 0xfa, 0xfd, 0x37, 0xed, 0x0f, 0x27, 0xc0,
+                       0xbb, 0xa0, 0xee, 0xc3, 0x79, 0x8b, 0xe7, 0x41,
+                       0x8f, 0xfa, 0x3a, 0xcb, 0x45, 0x3b, 0x85, 0x9f,
+                       0x06, 0x90, 0xb2, 0x51, 0x7a, 0xc3, 0x11, 0x41,
+                       0x4b, 0xe3, 0x26, 0x94, 0x3e, 0xa2, 0xfd, 0x0a,
+                       0xda, 0x50, 0xf6, 0x50, 0x78, 0x19, 0x6c, 0x52,
+                       0xd1, 0x12, 0x76, 0xc2, 0x50, 0x2f, 0x0b, 0xca,
+                       0x33, 0xe5, 0x79, 0x93, 0x14, 0x03, 0x01, 0x00,
+                       0x01, 0x01, 0x16, 0x03, 0x01, 0x00, 0x24, 0x2b,
+                       0x51, 0x42, 0x95, 0x6b, 0xca, 0x9f, 0x42, 0x5d,
+                       0xd2, 0xd9, 0x67, 0xf9, 0x49, 0x30, 0xfd, 0x2a,
+                       0x46, 0xd3, 0x04, 0xf4, 0x86, 0xf9, 0x11, 0x34,
+                       0x82, 0xac, 0xe2, 0xc2, 0x2d, 0xc4, 0xd0, 0xfe,
+                       0xa9, 0xc9, 0x4b, 0x17, 0x03, 0x01, 0x00, 0x21,
+                       0x65, 0x1c, 0xe9, 0x5c, 0xb6, 0xe2, 0x7c, 0x8e,
+                       0x49, 0x12, 0x1b, 0xe6, 0x40, 0xd3, 0x97, 0x21,
+                       0x76, 0x01, 0xe5, 0x80, 0x5e, 0xf3, 0x11, 0x47,
+                       0x25, 0x02, 0x78, 0x8e, 0x6b, 0xae, 0xb3, 0xf3,
+                       0x59, 0x15, 0x03, 0x01, 0x00, 0x16, 0x38, 0xc1,
+                       0x99, 0x2e, 0xf8, 0x6f, 0x45, 0xa4, 0x10, 0x79,
+                       0x5b, 0xc1, 0x47, 0x9a, 0xf6, 0x5c, 0x90, 0xeb,
+                       0xa6, 0xe3, 0x1a, 0x24,
                },
        }},
 }
@@ -2233,49 +2672,46 @@ var tls11ECDHEAESServerScript = [][]byte{
        },
 }
 
+// $ go test -run TestRunServer -serve -clientauth 1 \
+//     -ciphersuites=0xc011 -minversion=0x0303 -maxversion=0x0303
 var tls12ServerScript = [][]byte{
        {
-               0x16, 0x03, 0x01, 0x01, 0x46, 0x01, 0x00, 0x01,
-               0x42, 0x03, 0x03, 0x51, 0xcd, 0xe6, 0xe3, 0xe1,
-               0xb7, 0xb8, 0xf9, 0x20, 0xea, 0xc5, 0x8a, 0xe2,
-               0x8b, 0x07, 0x5a, 0x11, 0x0e, 0x54, 0x3c, 0x4f,
-               0x36, 0x06, 0x64, 0x7b, 0x0e, 0xc4, 0xf8, 0x75,
-               0x99, 0x9d, 0x5a, 0x00, 0x00, 0xd0, 0xc0, 0x30,
+               0x16, 0x03, 0x01, 0x01, 0x1e, 0x01, 0x00, 0x01,
+               0x1a, 0x03, 0x03, 0x51, 0xe5, 0x76, 0x84, 0x0e,
+               0xb9, 0x17, 0xca, 0x08, 0x47, 0xd9, 0xbd, 0xd0,
+               0x94, 0xd1, 0x97, 0xca, 0x5b, 0xe7, 0x20, 0xac,
+               0x8e, 0xbb, 0xc7, 0x29, 0xe9, 0x26, 0xcf, 0x7d,
+               0xb3, 0xdc, 0x99, 0x00, 0x00, 0x82, 0xc0, 0x30,
                0xc0, 0x2c, 0xc0, 0x28, 0xc0, 0x24, 0xc0, 0x14,
-               0xc0, 0x0a, 0xc0, 0x22, 0xc0, 0x21, 0x00, 0xa5,
-               0x00, 0xa3, 0x00, 0xa1, 0x00, 0x9f, 0x00, 0x6b,
-               0x00, 0x6a, 0x00, 0x69, 0x00, 0x68, 0x00, 0x39,
-               0x00, 0x38, 0x00, 0x37, 0x00, 0x36, 0x00, 0x88,
-               0x00, 0x87, 0x00, 0x86, 0x00, 0x85, 0xc0, 0x32,
+               0xc0, 0x0a, 0x00, 0xa3, 0x00, 0x9f, 0x00, 0x6b,
+               0x00, 0x6a, 0x00, 0x39, 0x00, 0x38, 0xc0, 0x32,
                0xc0, 0x2e, 0xc0, 0x2a, 0xc0, 0x26, 0xc0, 0x0f,
                0xc0, 0x05, 0x00, 0x9d, 0x00, 0x3d, 0x00, 0x35,
-               0x00, 0x84, 0xc0, 0x12, 0xc0, 0x08, 0xc0, 0x1c,
-               0xc0, 0x1b, 0x00, 0x16, 0x00, 0x13, 0x00, 0x10,
-               0x00, 0x0d, 0xc0, 0x0d, 0xc0, 0x03, 0x00, 0x0a,
-               0xc0, 0x2f, 0xc0, 0x2b, 0xc0, 0x27, 0xc0, 0x23,
-               0xc0, 0x13, 0xc0, 0x09, 0xc0, 0x1f, 0xc0, 0x1e,
-               0x00, 0xa4, 0x00, 0xa2, 0x00, 0xa0, 0x00, 0x9e,
-               0x00, 0x67, 0x00, 0x40, 0x00, 0x3f, 0x00, 0x3e,
-               0x00, 0x33, 0x00, 0x32, 0x00, 0x31, 0x00, 0x30,
-               0x00, 0x9a, 0x00, 0x99, 0x00, 0x98, 0x00, 0x97,
-               0x00, 0x45, 0x00, 0x44, 0x00, 0x43, 0x00, 0x42,
-               0xc0, 0x31, 0xc0, 0x2d, 0xc0, 0x29, 0xc0, 0x25,
-               0xc0, 0x0e, 0xc0, 0x04, 0x00, 0x9c, 0x00, 0x3c,
-               0x00, 0x2f, 0x00, 0x96, 0x00, 0x41, 0x00, 0x07,
-               0xc0, 0x11, 0xc0, 0x07, 0xc0, 0x0c, 0xc0, 0x02,
-               0x00, 0x05, 0x00, 0x04, 0x00, 0x15, 0x00, 0x12,
-               0x00, 0x0f, 0x00, 0x0c, 0x00, 0x09, 0x00, 0x14,
-               0x00, 0x11, 0x00, 0x0e, 0x00, 0x0b, 0x00, 0x08,
-               0x00, 0x06, 0x00, 0x03, 0x00, 0xff, 0x01, 0x00,
-               0x00, 0x49, 0x00, 0x0b, 0x00, 0x04, 0x03, 0x00,
-               0x01, 0x02, 0x00, 0x0a, 0x00, 0x34, 0x00, 0x32,
-               0x00, 0x0e, 0x00, 0x0d, 0x00, 0x19, 0x00, 0x0b,
-               0x00, 0x0c, 0x00, 0x18, 0x00, 0x09, 0x00, 0x0a,
-               0x00, 0x16, 0x00, 0x17, 0x00, 0x08, 0x00, 0x06,
-               0x00, 0x07, 0x00, 0x14, 0x00, 0x15, 0x00, 0x04,
-               0x00, 0x05, 0x00, 0x12, 0x00, 0x13, 0x00, 0x01,
-               0x00, 0x02, 0x00, 0x03, 0x00, 0x0f, 0x00, 0x10,
-               0x00, 0x11, 0x00, 0x23, 0x00, 0x00, 0x00, 0x0f,
+               0xc0, 0x12, 0xc0, 0x08, 0x00, 0x16, 0x00, 0x13,
+               0xc0, 0x0d, 0xc0, 0x03, 0x00, 0x0a, 0xc0, 0x2f,
+               0xc0, 0x2b, 0xc0, 0x27, 0xc0, 0x23, 0xc0, 0x13,
+               0xc0, 0x09, 0x00, 0xa2, 0x00, 0x9e, 0x00, 0x67,
+               0x00, 0x40, 0x00, 0x33, 0x00, 0x32, 0xc0, 0x31,
+               0xc0, 0x2d, 0xc0, 0x29, 0xc0, 0x25, 0xc0, 0x0e,
+               0xc0, 0x04, 0x00, 0x9c, 0x00, 0x3c, 0x00, 0x2f,
+               0x00, 0x07, 0xc0, 0x11, 0xc0, 0x07, 0xc0, 0x0c,
+               0xc0, 0x02, 0x00, 0x05, 0x00, 0x04, 0x00, 0x15,
+               0x00, 0x12, 0x00, 0x09, 0x00, 0x14, 0x00, 0x11,
+               0x00, 0x08, 0x00, 0x06, 0x00, 0x03, 0x00, 0xff,
+               0x01, 0x00, 0x00, 0x6f, 0x00, 0x0b, 0x00, 0x04,
+               0x03, 0x00, 0x01, 0x02, 0x00, 0x0a, 0x00, 0x34,
+               0x00, 0x32, 0x00, 0x0e, 0x00, 0x0d, 0x00, 0x19,
+               0x00, 0x0b, 0x00, 0x0c, 0x00, 0x18, 0x00, 0x09,
+               0x00, 0x0a, 0x00, 0x16, 0x00, 0x17, 0x00, 0x08,
+               0x00, 0x06, 0x00, 0x07, 0x00, 0x14, 0x00, 0x15,
+               0x00, 0x04, 0x00, 0x05, 0x00, 0x12, 0x00, 0x13,
+               0x00, 0x01, 0x00, 0x02, 0x00, 0x03, 0x00, 0x0f,
+               0x00, 0x10, 0x00, 0x11, 0x00, 0x23, 0x00, 0x00,
+               0x00, 0x0d, 0x00, 0x22, 0x00, 0x20, 0x06, 0x01,
+               0x06, 0x02, 0x06, 0x03, 0x05, 0x01, 0x05, 0x02,
+               0x05, 0x03, 0x04, 0x01, 0x04, 0x02, 0x04, 0x03,
+               0x03, 0x01, 0x03, 0x02, 0x03, 0x03, 0x02, 0x01,
+               0x02, 0x02, 0x02, 0x03, 0x01, 0x01, 0x00, 0x0f,
                0x00, 0x01, 0x01,
        },
        {
@@ -2392,370 +2828,229 @@ var tls12ServerScript = [][]byte{
                0x3a, 0x38, 0x1d, 0x54, 0xae, 0x1c, 0x7b, 0xea,
                0x29, 0xee, 0xd0, 0x38, 0xc1, 0x76, 0xa7, 0x7f,
                0x2a, 0xf4, 0xce, 0x1e, 0xac, 0xcc, 0x94, 0x79,
-               0x90, 0x33, 0x04, 0x01, 0x00, 0x80, 0xac, 0xee,
-               0xef, 0xfa, 0x25, 0x62, 0xee, 0x09, 0x64, 0x9f,
-               0x9b, 0xf9, 0x99, 0x3e, 0xb0, 0x09, 0xb6, 0xfb,
-               0xbd, 0x2a, 0x87, 0x72, 0x56, 0x43, 0xc4, 0x53,
-               0x4c, 0xca, 0x94, 0x09, 0x7e, 0xc7, 0xce, 0xb0,
-               0x2f, 0x7f, 0x21, 0x91, 0xbc, 0x0e, 0x33, 0x74,
-               0x1c, 0xa8, 0x44, 0x51, 0xe5, 0x2f, 0xb5, 0x43,
-               0xad, 0x7a, 0x95, 0xec, 0xd0, 0x4c, 0x6b, 0xb8,
-               0x05, 0x89, 0x29, 0x23, 0x52, 0xe4, 0x89, 0x0d,
-               0x07, 0xbf, 0xe7, 0xf9, 0x76, 0x6c, 0x86, 0xad,
-               0xbd, 0x79, 0x80, 0x2d, 0xfa, 0xb3, 0x08, 0xf0,
-               0xd6, 0x1b, 0xc5, 0x86, 0x41, 0x9a, 0xc5, 0x85,
-               0x68, 0x58, 0x41, 0x9d, 0xa5, 0x14, 0x4b, 0xf5,
-               0xc9, 0x5c, 0xe0, 0x12, 0xf4, 0x33, 0x75, 0x5e,
-               0x05, 0xe7, 0x95, 0xff, 0x25, 0xdf, 0xa8, 0x66,
-               0xc0, 0x5e, 0x00, 0xed, 0x76, 0xe4, 0x3e, 0x2c,
-               0x41, 0x5b, 0x51, 0xca, 0x60, 0x5e, 0x16, 0x03,
-               0x03, 0x00, 0x0c, 0x0d, 0x00, 0x00, 0x08, 0x01,
-               0x01, 0x00, 0x02, 0x04, 0x01, 0x00, 0x00, 0x16,
-               0x03, 0x03, 0x00, 0x04, 0x0e, 0x00, 0x00, 0x00,
+               0x90, 0x33, 0x04, 0x01, 0x00, 0x80, 0x4a, 0xf9,
+               0xf5, 0x0a, 0x61, 0x37, 0x7e, 0x4e, 0x92, 0xb5,
+               0x1c, 0x91, 0x21, 0xb2, 0xb5, 0x17, 0x00, 0xbf,
+               0x01, 0x5f, 0x30, 0xec, 0x62, 0x08, 0xd6, 0x9d,
+               0x1a, 0x08, 0x05, 0x72, 0x8b, 0xf4, 0x49, 0x85,
+               0xa7, 0xbf, 0x3f, 0x75, 0x58, 0x3e, 0x26, 0x82,
+               0xc3, 0x28, 0x07, 0xf9, 0x41, 0x7d, 0x03, 0x14,
+               0x3b, 0xc3, 0x05, 0x64, 0xff, 0x52, 0xf4, 0x75,
+               0x6a, 0x87, 0xcd, 0xdf, 0x93, 0x31, 0x0a, 0x71,
+               0x60, 0x17, 0xc6, 0x33, 0xf0, 0x79, 0xb6, 0x7b,
+               0xd0, 0x9c, 0xa0, 0x5f, 0x74, 0x14, 0x2c, 0x5a,
+               0xb4, 0x3f, 0x39, 0xf5, 0xe4, 0x9f, 0xbe, 0x6d,
+               0x21, 0xd2, 0xa9, 0x42, 0xf7, 0xdc, 0xa6, 0x65,
+               0xb7, 0x6a, 0x7e, 0x2e, 0x14, 0xd3, 0xf6, 0xf3,
+               0x4b, 0x4c, 0x5b, 0x1a, 0x70, 0x7a, 0xbc, 0xb0,
+               0x12, 0xf3, 0x6e, 0x0c, 0xcf, 0x43, 0x22, 0xae,
+               0x5b, 0xba, 0x00, 0xf8, 0xfd, 0xaf, 0x16, 0x03,
+               0x03, 0x00, 0x0f, 0x0d, 0x00, 0x00, 0x0b, 0x02,
+               0x01, 0x40, 0x00, 0x04, 0x04, 0x01, 0x04, 0x03,
+               0x00, 0x00, 0x16, 0x03, 0x03, 0x00, 0x04, 0x0e,
+               0x00, 0x00, 0x00,
        },
        {
-               0x16, 0x03, 0x03, 0x03, 0xf5, 0x0b, 0x00, 0x03,
-               0xf1, 0x00, 0x03, 0xee, 0x00, 0x03, 0xeb, 0x30,
-               0x82, 0x03, 0xe7, 0x30, 0x82, 0x02, 0xcf, 0xa0,
-               0x03, 0x02, 0x01, 0x02, 0x02, 0x09, 0x00, 0xb9,
-               0xee, 0xd4, 0xd9, 0x55, 0xa5, 0x9e, 0xb3, 0x30,
-               0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7,
-               0x0d, 0x01, 0x01, 0x05, 0x05, 0x00, 0x30, 0x70,
-               0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04,
-               0x06, 0x13, 0x02, 0x55, 0x4b, 0x31, 0x16, 0x30,
-               0x14, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x0c, 0x0d,
-               0x4f, 0x70, 0x65, 0x6e, 0x53, 0x53, 0x4c, 0x20,
-               0x47, 0x72, 0x6f, 0x75, 0x70, 0x31, 0x22, 0x30,
-               0x20, 0x06, 0x03, 0x55, 0x04, 0x0b, 0x0c, 0x19,
-               0x46, 0x4f, 0x52, 0x20, 0x54, 0x45, 0x53, 0x54,
-               0x49, 0x4e, 0x47, 0x20, 0x50, 0x55, 0x52, 0x50,
-               0x4f, 0x53, 0x45, 0x53, 0x20, 0x4f, 0x4e, 0x4c,
-               0x59, 0x31, 0x25, 0x30, 0x23, 0x06, 0x03, 0x55,
-               0x04, 0x03, 0x0c, 0x1c, 0x4f, 0x70, 0x65, 0x6e,
-               0x53, 0x53, 0x4c, 0x20, 0x54, 0x65, 0x73, 0x74,
-               0x20, 0x49, 0x6e, 0x74, 0x65, 0x72, 0x6d, 0x65,
-               0x64, 0x69, 0x61, 0x74, 0x65, 0x20, 0x43, 0x41,
-               0x30, 0x1e, 0x17, 0x0d, 0x31, 0x31, 0x31, 0x32,
-               0x30, 0x38, 0x31, 0x34, 0x30, 0x31, 0x34, 0x38,
-               0x5a, 0x17, 0x0d, 0x32, 0x31, 0x31, 0x30, 0x31,
-               0x36, 0x31, 0x34, 0x30, 0x31, 0x34, 0x38, 0x5a,
-               0x30, 0x64, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03,
-               0x55, 0x04, 0x06, 0x13, 0x02, 0x55, 0x4b, 0x31,
-               0x16, 0x30, 0x14, 0x06, 0x03, 0x55, 0x04, 0x0a,
-               0x0c, 0x0d, 0x4f, 0x70, 0x65, 0x6e, 0x53, 0x53,
-               0x4c, 0x20, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x31,
-               0x22, 0x30, 0x20, 0x06, 0x03, 0x55, 0x04, 0x0b,
-               0x0c, 0x19, 0x46, 0x4f, 0x52, 0x20, 0x54, 0x45,
-               0x53, 0x54, 0x49, 0x4e, 0x47, 0x20, 0x50, 0x55,
-               0x52, 0x50, 0x4f, 0x53, 0x45, 0x53, 0x20, 0x4f,
-               0x4e, 0x4c, 0x59, 0x31, 0x19, 0x30, 0x17, 0x06,
-               0x03, 0x55, 0x04, 0x03, 0x0c, 0x10, 0x54, 0x65,
-               0x73, 0x74, 0x20, 0x53, 0x65, 0x72, 0x76, 0x65,
-               0x72, 0x20, 0x43, 0x65, 0x72, 0x74, 0x30, 0x82,
-               0x01, 0x22, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86,
-               0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01, 0x05,
-               0x00, 0x03, 0x82, 0x01, 0x0f, 0x00, 0x30, 0x82,
-               0x01, 0x0a, 0x02, 0x82, 0x01, 0x01, 0x00, 0xf3,
-               0x84, 0xf3, 0x92, 0x36, 0xdc, 0xb2, 0x46, 0xca,
-               0x66, 0x7a, 0xe5, 0x29, 0xc5, 0xf3, 0x49, 0x28,
-               0x22, 0xd3, 0xb9, 0xfe, 0xe0, 0xde, 0xe4, 0x38,
-               0xce, 0xee, 0x22, 0x1c, 0xe9, 0x91, 0x3b, 0x94,
-               0xd0, 0x72, 0x2f, 0x87, 0x85, 0x59, 0x4b, 0x66,
-               0xb1, 0xc5, 0xf5, 0x7a, 0x85, 0x5d, 0xc2, 0x0f,
-               0xd3, 0x2e, 0x29, 0x58, 0x36, 0xcc, 0x48, 0x6b,
-               0xa2, 0xa2, 0xb5, 0x26, 0xce, 0x67, 0xe2, 0x47,
-               0xb6, 0xdf, 0x49, 0xd2, 0x3f, 0xfa, 0xa2, 0x10,
-               0xb7, 0xc2, 0x97, 0x44, 0x7e, 0x87, 0x34, 0x6d,
-               0x6d, 0xf2, 0x8b, 0xb4, 0x55, 0x2b, 0xd6, 0x21,
-               0xde, 0x53, 0x4b, 0x90, 0xea, 0xfd, 0xea, 0xf9,
-               0x38, 0x35, 0x2b, 0xf4, 0xe6, 0x9a, 0x0e, 0xf6,
-               0xbb, 0x12, 0xab, 0x87, 0x21, 0xc3, 0x2f, 0xbc,
-               0xf4, 0x06, 0xb8, 0x8f, 0x8e, 0x10, 0x07, 0x27,
-               0x95, 0xe5, 0x42, 0xcb, 0xd1, 0xd5, 0x10, 0x8c,
-               0x92, 0xac, 0xee, 0x0f, 0xdc, 0x23, 0x48, 0x89,
-               0xc9, 0xc6, 0x93, 0x0c, 0x22, 0x02, 0xe7, 0x74,
-               0xe7, 0x25, 0x00, 0xab, 0xf8, 0x0f, 0x5c, 0x10,
-               0xb5, 0x85, 0x3b, 0x66, 0x94, 0xf0, 0xfb, 0x4d,
-               0x57, 0x06, 0x55, 0x21, 0x22, 0x25, 0xdb, 0xf3,
-               0xaa, 0xa9, 0x60, 0xbf, 0x4d, 0xaa, 0x79, 0xd1,
-               0xab, 0x92, 0x48, 0xba, 0x19, 0x8e, 0x12, 0xec,
-               0x68, 0xd9, 0xc6, 0xba, 0xdf, 0xec, 0x5a, 0x1c,
-               0xd8, 0x43, 0xfe, 0xe7, 0x52, 0xc9, 0xcf, 0x02,
-               0xd0, 0xc7, 0x7f, 0xc9, 0x7e, 0xb0, 0x94, 0xe3,
-               0x53, 0x44, 0x58, 0x0b, 0x2e, 0xfd, 0x29, 0x74,
-               0xb5, 0x06, 0x9b, 0x5c, 0x44, 0x8d, 0xfb, 0x32,
-               0x75, 0xa4, 0x3a, 0xa8, 0x67, 0x7b, 0x87, 0x32,
-               0x0a, 0x50, 0x8d, 0xe1, 0xa2, 0x13, 0x4a, 0x25,
-               0xaf, 0xe6, 0x1c, 0xb1, 0x25, 0xbf, 0xb4, 0x99,
-               0xa2, 0x53, 0xd3, 0xa2, 0x02, 0xbf, 0x11, 0x02,
-               0x03, 0x01, 0x00, 0x01, 0xa3, 0x81, 0x8f, 0x30,
-               0x81, 0x8c, 0x30, 0x0c, 0x06, 0x03, 0x55, 0x1d,
-               0x13, 0x01, 0x01, 0xff, 0x04, 0x02, 0x30, 0x00,
-               0x30, 0x0e, 0x06, 0x03, 0x55, 0x1d, 0x0f, 0x01,
-               0x01, 0xff, 0x04, 0x04, 0x03, 0x02, 0x05, 0xe0,
-               0x30, 0x2c, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01,
-               0x86, 0xf8, 0x42, 0x01, 0x0d, 0x04, 0x1f, 0x16,
-               0x1d, 0x4f, 0x70, 0x65, 0x6e, 0x53, 0x53, 0x4c,
-               0x20, 0x47, 0x65, 0x6e, 0x65, 0x72, 0x61, 0x74,
-               0x65, 0x64, 0x20, 0x43, 0x65, 0x72, 0x74, 0x69,
-               0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x30, 0x1d,
-               0x06, 0x03, 0x55, 0x1d, 0x0e, 0x04, 0x16, 0x04,
-               0x14, 0x82, 0xbc, 0xcf, 0x00, 0x00, 0x13, 0xd1,
-               0xf7, 0x39, 0x25, 0x9a, 0x27, 0xe7, 0xaf, 0xd2,
-               0xef, 0x20, 0x1b, 0x6e, 0xac, 0x30, 0x1f, 0x06,
-               0x03, 0x55, 0x1d, 0x23, 0x04, 0x18, 0x30, 0x16,
-               0x80, 0x14, 0x36, 0xc3, 0x6c, 0x88, 0xe7, 0x95,
-               0xfe, 0xb0, 0xbd, 0xec, 0xce, 0x3e, 0x3d, 0x86,
-               0xab, 0x21, 0x81, 0x87, 0xda, 0xda, 0x30, 0x0d,
-               0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d,
-               0x01, 0x01, 0x05, 0x05, 0x00, 0x03, 0x82, 0x01,
-               0x01, 0x00, 0xa9, 0xbd, 0x4d, 0x57, 0x40, 0x74,
-               0xfe, 0x96, 0xe9, 0x2b, 0xd6, 0x78, 0xfd, 0xb3,
-               0x63, 0xcc, 0xf4, 0x0b, 0x4d, 0x12, 0xca, 0x5a,
-               0x74, 0x8d, 0x9b, 0xf2, 0x61, 0xe6, 0xfd, 0x06,
-               0x11, 0x43, 0x84, 0xfc, 0x17, 0xa0, 0xec, 0x63,
-               0x63, 0x36, 0xb9, 0x9e, 0x36, 0x6a, 0xb1, 0x02,
-               0x5a, 0x6a, 0x5b, 0x3f, 0x6a, 0xa1, 0xea, 0x05,
-               0x65, 0xac, 0x7e, 0x40, 0x1a, 0x48, 0x65, 0x88,
-               0xd1, 0x39, 0x4d, 0xd3, 0x4b, 0x77, 0xe9, 0xc8,
-               0xbb, 0x2b, 0x9e, 0x5a, 0xf4, 0x08, 0x34, 0x39,
-               0x47, 0xb9, 0x02, 0x08, 0x31, 0x9a, 0xf1, 0xd9,
-               0x17, 0xc5, 0xe9, 0xa6, 0xa5, 0x96, 0x4b, 0x6d,
-               0x40, 0xa9, 0x5b, 0x65, 0x28, 0xcb, 0xcb, 0x00,
-               0x03, 0x82, 0x63, 0x37, 0xd3, 0xad, 0xb1, 0x96,
-               0x3b, 0x76, 0xf5, 0x17, 0x16, 0x02, 0x7b, 0xbd,
-               0x53, 0x53, 0x46, 0x72, 0x34, 0xd6, 0x08, 0x64,
-               0x9d, 0xbb, 0x43, 0xfb, 0x64, 0xb1, 0x49, 0x07,
-               0x77, 0x09, 0x61, 0x7a, 0x42, 0x17, 0x11, 0x30,
-               0x0c, 0xd9, 0x27, 0x5c, 0xf5, 0x71, 0xb6, 0xf0,
-               0x18, 0x30, 0xf3, 0x7e, 0xf1, 0x85, 0x3f, 0x32,
-               0x7e, 0x4a, 0xaf, 0xb3, 0x10, 0xf7, 0x6c, 0xc6,
-               0x85, 0x4b, 0x2d, 0x27, 0xad, 0x0a, 0x20, 0x5c,
-               0xfb, 0x8d, 0x19, 0x70, 0x34, 0xb9, 0x75, 0x5f,
-               0x7c, 0x87, 0xd5, 0xc3, 0xec, 0x93, 0x13, 0x41,
-               0xfc, 0x73, 0x03, 0xb9, 0x8d, 0x1a, 0xfe, 0xf7,
-               0x26, 0x86, 0x49, 0x03, 0xa9, 0xc5, 0x82, 0x3f,
-               0x80, 0x0d, 0x29, 0x49, 0xb1, 0x8f, 0xed, 0x24,
-               0x1b, 0xfe, 0xcf, 0x58, 0x90, 0x46, 0xe7, 0xa8,
-               0x87, 0xd4, 0x1e, 0x79, 0xef, 0x99, 0x6d, 0x18,
-               0x9f, 0x3e, 0x8b, 0x82, 0x07, 0xc1, 0x43, 0xc7,
-               0xe0, 0x25, 0xb6, 0xf1, 0xd3, 0x00, 0xd7, 0x40,
-               0xab, 0x4b, 0x7f, 0x2b, 0x7a, 0x3e, 0xa6, 0x99,
-               0x4c, 0x54, 0x16, 0x03, 0x03, 0x00, 0x8a, 0x10,
-               0x00, 0x00, 0x86, 0x85, 0x04, 0x01, 0x82, 0x13,
-               0x67, 0x8e, 0x1c, 0x5a, 0x3e, 0x74, 0x20, 0xa5,
-               0x2d, 0x6f, 0xa3, 0xd0, 0xef, 0x21, 0x0a, 0x06,
-               0xb2, 0xae, 0xaa, 0x5a, 0x23, 0xf6, 0xa0, 0x54,
-               0xa8, 0x3a, 0xc5, 0x02, 0xfc, 0x35, 0x8c, 0xe9,
-               0x0b, 0x81, 0x70, 0x1e, 0x82, 0xfa, 0x48, 0xf6,
-               0xb3, 0x17, 0xef, 0x19, 0x0c, 0xd3, 0x67, 0x36,
-               0xcf, 0xef, 0xa3, 0xcf, 0x34, 0xb3, 0xd0, 0x5f,
-               0x8b, 0x51, 0xcf, 0x33, 0x3d, 0xd6, 0x2e, 0x01,
-               0xf2, 0x46, 0xcc, 0xed, 0x9c, 0x6c, 0xe9, 0x42,
-               0x95, 0xcb, 0x6d, 0x28, 0xe4, 0x62, 0xf9, 0xe2,
-               0xcf, 0x6d, 0xa1, 0xdd, 0xb8, 0x0e, 0x93, 0x55,
-               0x58, 0x0d, 0xe3, 0x50, 0xef, 0x96, 0x9a, 0xec,
-               0xcd, 0x68, 0xb0, 0xc6, 0x0f, 0xe6, 0x73, 0x22,
-               0x95, 0xb9, 0x5e, 0x65, 0x12, 0x76, 0xdb, 0x87,
-               0x72, 0x57, 0xd2, 0x7e, 0x42, 0xe0, 0xf4, 0x92,
-               0x6a, 0x8e, 0x82, 0xaf, 0x68, 0x83, 0xc7, 0xed,
-               0x25, 0x16, 0x03, 0x03, 0x01, 0x08, 0x0f, 0x00,
-               0x01, 0x04, 0x04, 0x01, 0x01, 0x00, 0x53, 0xa2,
-               0x0d, 0xce, 0xe3, 0x2f, 0xdc, 0xb0, 0x6e, 0xe8,
-               0x58, 0x8b, 0x99, 0x63, 0xab, 0xfc, 0xeb, 0xdb,
-               0xf7, 0xba, 0xc3, 0x5c, 0x7b, 0x8b, 0x1f, 0x04,
-               0xa8, 0x13, 0xaf, 0x5f, 0x75, 0x82, 0x29, 0x08,
-               0xa3, 0x20, 0xf1, 0xf3, 0xb8, 0x59, 0xc8, 0xd4,
-               0xd7, 0x55, 0xdd, 0xcc, 0xf3, 0xc1, 0x16, 0x26,
-               0xc8, 0x6d, 0x44, 0x82, 0xbc, 0x98, 0x5e, 0xbc,
-               0x2c, 0x48, 0x0a, 0xb8, 0xaa, 0x43, 0x4d, 0xc2,
-               0x45, 0x27, 0x86, 0x30, 0x88, 0x04, 0x58, 0x1b,
-               0x98, 0x9e, 0x71, 0xb0, 0x95, 0xa6, 0xf7, 0xbc,
-               0x14, 0x3a, 0xbf, 0x98, 0x6e, 0xb9, 0xdf, 0x7e,
-               0x9c, 0xc9, 0xe4, 0x7f, 0x65, 0x25, 0x2a, 0xe7,
-               0x85, 0x9b, 0x81, 0xca, 0xd2, 0x38, 0xc8, 0x45,
-               0x17, 0x3c, 0x6f, 0x73, 0x03, 0x30, 0x7c, 0xa4,
-               0xdd, 0x2d, 0x1a, 0x22, 0x9f, 0x2e, 0x83, 0x64,
-               0x06, 0x7e, 0xf8, 0x64, 0x25, 0x2b, 0xb4, 0x60,
-               0x4b, 0x09, 0x6a, 0x8b, 0x6f, 0x54, 0x42, 0xda,
-               0x16, 0x9b, 0x9d, 0x44, 0xd1, 0x45, 0x9d, 0x7b,
-               0x92, 0xd9, 0x2a, 0x03, 0xfe, 0xa1, 0x4d, 0xba,
-               0x13, 0xa2, 0x74, 0x79, 0x22, 0xf9, 0x60, 0x5c,
-               0x94, 0x59, 0x55, 0x11, 0x8c, 0x7f, 0x7b, 0x83,
-               0x09, 0xe8, 0xe0, 0x10, 0x48, 0x3b, 0xbc, 0x9b,
-               0xfa, 0x14, 0xb0, 0x94, 0x21, 0xf6, 0xe2, 0xdb,
-               0x29, 0xd9, 0x51, 0xaa, 0x47, 0x72, 0x00, 0x23,
-               0x7c, 0xe4, 0x8e, 0xf4, 0x4b, 0x02, 0x03, 0x35,
-               0x26, 0x6c, 0x06, 0x76, 0x0b, 0x5c, 0x5f, 0xe0,
-               0x2b, 0x31, 0xe1, 0x02, 0xe3, 0x4b, 0x86, 0x91,
-               0xbf, 0x23, 0x5d, 0xa8, 0x70, 0xef, 0x5a, 0x57,
-               0xe8, 0xdf, 0xb3, 0x85, 0x0d, 0x4b, 0xf3, 0xe0,
-               0xc2, 0xf0, 0x28, 0xd1, 0x7e, 0x0e, 0xeb, 0xe1,
-               0xb5, 0x13, 0xaf, 0xb4, 0x38, 0x7f, 0x86, 0xd1,
-               0x57, 0xd3, 0x1e, 0x28, 0xd7, 0xdb, 0x14, 0x03,
-               0x03, 0x00, 0x01, 0x01, 0x16, 0x03, 0x03, 0x00,
-               0x24, 0x21, 0xaa, 0xfc, 0x8a, 0x39, 0xb3, 0xcf,
-               0x73, 0x83, 0x8d, 0x9c, 0x8e, 0x1f, 0xac, 0x97,
-               0x21, 0x42, 0xee, 0x25, 0x68, 0xd0, 0x15, 0x43,
-               0xf6, 0x4c, 0x98, 0xf6, 0xf6, 0x96, 0x11, 0x36,
-               0xae, 0xe2, 0xb3, 0x30, 0x94,
+               0x16, 0x03, 0x03, 0x01, 0xfb, 0x0b, 0x00, 0x01,
+               0xf7, 0x00, 0x01, 0xf4, 0x00, 0x01, 0xf1, 0x30,
+               0x82, 0x01, 0xed, 0x30, 0x82, 0x01, 0x58, 0xa0,
+               0x03, 0x02, 0x01, 0x02, 0x02, 0x01, 0x00, 0x30,
+               0x0b, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7,
+               0x0d, 0x01, 0x01, 0x05, 0x30, 0x26, 0x31, 0x10,
+               0x30, 0x0e, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x13,
+               0x07, 0x41, 0x63, 0x6d, 0x65, 0x20, 0x43, 0x6f,
+               0x31, 0x12, 0x30, 0x10, 0x06, 0x03, 0x55, 0x04,
+               0x03, 0x13, 0x09, 0x31, 0x32, 0x37, 0x2e, 0x30,
+               0x2e, 0x30, 0x2e, 0x31, 0x30, 0x1e, 0x17, 0x0d,
+               0x31, 0x31, 0x31, 0x32, 0x30, 0x38, 0x30, 0x37,
+               0x35, 0x35, 0x31, 0x32, 0x5a, 0x17, 0x0d, 0x31,
+               0x32, 0x31, 0x32, 0x30, 0x37, 0x30, 0x38, 0x30,
+               0x30, 0x31, 0x32, 0x5a, 0x30, 0x26, 0x31, 0x10,
+               0x30, 0x0e, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x13,
+               0x07, 0x41, 0x63, 0x6d, 0x65, 0x20, 0x43, 0x6f,
+               0x31, 0x12, 0x30, 0x10, 0x06, 0x03, 0x55, 0x04,
+               0x03, 0x13, 0x09, 0x31, 0x32, 0x37, 0x2e, 0x30,
+               0x2e, 0x30, 0x2e, 0x31, 0x30, 0x81, 0x9c, 0x30,
+               0x0b, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7,
+               0x0d, 0x01, 0x01, 0x01, 0x03, 0x81, 0x8c, 0x00,
+               0x30, 0x81, 0x88, 0x02, 0x81, 0x80, 0x4e, 0xd0,
+               0x7b, 0x31, 0xe3, 0x82, 0x64, 0xd9, 0x59, 0xc0,
+               0xc2, 0x87, 0xa4, 0x5e, 0x1e, 0x8b, 0x73, 0x33,
+               0xc7, 0x63, 0x53, 0xdf, 0x66, 0x92, 0x06, 0x84,
+               0xf6, 0x64, 0xd5, 0x8f, 0xe4, 0x36, 0xa7, 0x1d,
+               0x2b, 0xe8, 0xb3, 0x20, 0x36, 0x45, 0x23, 0xb5,
+               0xe3, 0x95, 0xae, 0xed, 0xe0, 0xf5, 0x20, 0x9c,
+               0x8d, 0x95, 0xdf, 0x7f, 0x5a, 0x12, 0xef, 0x87,
+               0xe4, 0x5b, 0x68, 0xe4, 0xe9, 0x0e, 0x74, 0xec,
+               0x04, 0x8a, 0x7f, 0xde, 0x93, 0x27, 0xc4, 0x01,
+               0x19, 0x7a, 0xbd, 0xf2, 0xdc, 0x3d, 0x14, 0xab,
+               0xd0, 0x54, 0xca, 0x21, 0x0c, 0xd0, 0x4d, 0x6e,
+               0x87, 0x2e, 0x5c, 0xc5, 0xd2, 0xbb, 0x4d, 0x4b,
+               0x4f, 0xce, 0xb6, 0x2c, 0xf7, 0x7e, 0x88, 0xec,
+               0x7c, 0xd7, 0x02, 0x91, 0x74, 0xa6, 0x1e, 0x0c,
+               0x1a, 0xda, 0xe3, 0x4a, 0x5a, 0x2e, 0xde, 0x13,
+               0x9c, 0x4c, 0x40, 0x88, 0x59, 0x93, 0x02, 0x03,
+               0x01, 0x00, 0x01, 0xa3, 0x32, 0x30, 0x30, 0x30,
+               0x0e, 0x06, 0x03, 0x55, 0x1d, 0x0f, 0x01, 0x01,
+               0xff, 0x04, 0x04, 0x03, 0x02, 0x00, 0xa0, 0x30,
+               0x0d, 0x06, 0x03, 0x55, 0x1d, 0x0e, 0x04, 0x06,
+               0x04, 0x04, 0x01, 0x02, 0x03, 0x04, 0x30, 0x0f,
+               0x06, 0x03, 0x55, 0x1d, 0x23, 0x04, 0x08, 0x30,
+               0x06, 0x80, 0x04, 0x01, 0x02, 0x03, 0x04, 0x30,
+               0x0b, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7,
+               0x0d, 0x01, 0x01, 0x05, 0x03, 0x81, 0x81, 0x00,
+               0x36, 0x1f, 0xb3, 0x7a, 0x0c, 0x75, 0xc9, 0x6e,
+               0x37, 0x46, 0x61, 0x2b, 0xd5, 0xbd, 0xc0, 0xa7,
+               0x4b, 0xcc, 0x46, 0x9a, 0x81, 0x58, 0x7c, 0x85,
+               0x79, 0x29, 0xc8, 0xc8, 0xc6, 0x67, 0xdd, 0x32,
+               0x56, 0x45, 0x2b, 0x75, 0xb6, 0xe9, 0x24, 0xa9,
+               0x50, 0x9a, 0xbe, 0x1f, 0x5a, 0xfa, 0x1a, 0x15,
+               0xd9, 0xcc, 0x55, 0x95, 0x72, 0x16, 0x83, 0xb9,
+               0xc2, 0xb6, 0x8f, 0xfd, 0x88, 0x8c, 0x38, 0x84,
+               0x1d, 0xab, 0x5d, 0x92, 0x31, 0x13, 0x4f, 0xfd,
+               0x83, 0x3b, 0xc6, 0x9d, 0xf1, 0x11, 0x62, 0xb6,
+               0x8b, 0xec, 0xab, 0x67, 0xbe, 0xc8, 0x64, 0xb0,
+               0x11, 0x50, 0x46, 0x58, 0x17, 0x6b, 0x99, 0x1c,
+               0xd3, 0x1d, 0xfc, 0x06, 0xf1, 0x0e, 0xe5, 0x96,
+               0xa8, 0x0c, 0xf9, 0x78, 0x20, 0xb7, 0x44, 0x18,
+               0x51, 0x8d, 0x10, 0x7e, 0x4f, 0x94, 0x67, 0xdf,
+               0xa3, 0x4e, 0x70, 0x73, 0x8e, 0x90, 0x91, 0x85,
+               0x16, 0x03, 0x03, 0x00, 0x8a, 0x10, 0x00, 0x00,
+               0x86, 0x85, 0x04, 0x01, 0x5d, 0x3a, 0x92, 0x59,
+               0x7f, 0x9a, 0x22, 0x36, 0x0e, 0x1b, 0x1d, 0x2a,
+               0x05, 0xb7, 0xa4, 0xb6, 0x5d, 0xfc, 0x51, 0x6e,
+               0x15, 0xe5, 0x89, 0x7c, 0xe2, 0xfa, 0x87, 0x38,
+               0x05, 0x79, 0x15, 0x92, 0xb4, 0x8f, 0x88, 0x8f,
+               0x9d, 0x5d, 0xa0, 0xaf, 0xf8, 0xce, 0xf9, 0x6f,
+               0x83, 0xf4, 0x08, 0x69, 0xe4, 0x91, 0xc5, 0xed,
+               0xb9, 0xc5, 0xa8, 0x1f, 0x4b, 0xec, 0xef, 0x91,
+               0xc1, 0xa3, 0x34, 0x24, 0x18, 0x00, 0x2d, 0xcd,
+               0xe6, 0x44, 0xef, 0x5a, 0x3e, 0x52, 0x63, 0x5b,
+               0x36, 0x1f, 0x7e, 0xce, 0x9e, 0xaa, 0xda, 0x8d,
+               0xb5, 0xc9, 0xea, 0xd8, 0x1b, 0xd1, 0x1c, 0x7c,
+               0x07, 0xfc, 0x3c, 0x2d, 0x70, 0x1f, 0xf9, 0x4d,
+               0xcb, 0xaa, 0xad, 0x07, 0xd5, 0x6d, 0xbd, 0xa6,
+               0x61, 0xf3, 0x2f, 0xa3, 0x9c, 0x45, 0x02, 0x4a,
+               0xac, 0x6c, 0xb6, 0x37, 0x95, 0xb1, 0x4a, 0xb5,
+               0x0a, 0x4e, 0x60, 0x67, 0xd7, 0xe0, 0x04, 0x16,
+               0x03, 0x03, 0x00, 0x88, 0x0f, 0x00, 0x00, 0x84,
+               0x04, 0x01, 0x00, 0x80, 0x08, 0x83, 0x53, 0xf0,
+               0xf8, 0x14, 0xf5, 0xc2, 0xd1, 0x8b, 0xf0, 0xa5,
+               0xc1, 0xd8, 0x1a, 0x36, 0x4b, 0x75, 0x77, 0x02,
+               0x19, 0xd8, 0x11, 0x3f, 0x5a, 0x36, 0xfc, 0xe9,
+               0x2b, 0x4b, 0xf9, 0xfe, 0xda, 0x8a, 0x0f, 0x6e,
+               0x3d, 0xd3, 0x52, 0x87, 0xf7, 0x9c, 0x78, 0x39,
+               0xa8, 0xf1, 0xd7, 0xf7, 0x4e, 0x35, 0x33, 0xf9,
+               0xc5, 0x76, 0xa8, 0x12, 0xc4, 0x91, 0x33, 0x1d,
+               0x93, 0x8c, 0xbf, 0xb1, 0x83, 0x00, 0x90, 0xc5,
+               0x52, 0x3e, 0xe0, 0x0a, 0xe8, 0x92, 0x75, 0xdf,
+               0x54, 0x5f, 0x9f, 0x95, 0x76, 0x62, 0xb5, 0x85,
+               0x69, 0xa4, 0x86, 0x85, 0x6c, 0xf3, 0x6b, 0x2a,
+               0x72, 0x7b, 0x4d, 0x42, 0x33, 0x67, 0x4a, 0xce,
+               0xb5, 0xdb, 0x9b, 0xae, 0xc0, 0xb0, 0x10, 0xeb,
+               0x3b, 0xf4, 0xc2, 0x9a, 0x64, 0x47, 0x4c, 0x1e,
+               0xa5, 0x91, 0x7f, 0x6d, 0xd1, 0x03, 0xf5, 0x4a,
+               0x90, 0x69, 0x18, 0xb1, 0x14, 0x03, 0x03, 0x00,
+               0x01, 0x01, 0x16, 0x03, 0x03, 0x00, 0x24, 0x59,
+               0xfc, 0x7e, 0xae, 0xb3, 0xbf, 0xab, 0x4d, 0xdb,
+               0x4e, 0xab, 0xa9, 0x6d, 0x6b, 0x4c, 0x60, 0xb6,
+               0x16, 0xe0, 0xab, 0x7f, 0x52, 0x2d, 0xa1, 0xfc,
+               0xe1, 0x80, 0xd2, 0x8a, 0xa1, 0xe5, 0x8f, 0xa1,
+               0x70, 0x93, 0x23,
        },
        {
-               0x16, 0x03, 0x03, 0x04, 0x61, 0x04, 0x00, 0x04,
-               0x5d, 0x00, 0x00, 0x00, 0x00, 0x04, 0x57, 0x00,
+               0x16, 0x03, 0x03, 0x02, 0x67, 0x04, 0x00, 0x02,
+               0x63, 0x00, 0x00, 0x00, 0x00, 0x02, 0x5d, 0x00,
                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x65,
-               0xea, 0x8b, 0xc5, 0xef, 0xba, 0x79, 0x9b, 0xa7,
-               0x04, 0x72, 0x9c, 0xeb, 0x1a, 0xd7, 0x8a, 0x56,
-               0xba, 0xbc, 0x1a, 0xab, 0xf8, 0xf4, 0x4f, 0x75,
-               0x0a, 0x4e, 0x98, 0xa0, 0x06, 0x00, 0x67, 0x07,
-               0x9e, 0x21, 0x9f, 0x9d, 0xe6, 0x51, 0xcb, 0xec,
-               0x96, 0x31, 0xde, 0x1d, 0x46, 0x60, 0x4a, 0xbd,
-               0xd8, 0x7a, 0x23, 0xa9, 0x3e, 0x59, 0x22, 0xf7,
-               0xfd, 0x8a, 0x14, 0xa4, 0x09, 0xc2, 0x07, 0x10,
-               0x80, 0x13, 0xee, 0xee, 0x70, 0x96, 0xdb, 0x22,
-               0x8b, 0xbf, 0xac, 0x69, 0x7d, 0x7f, 0x39, 0x9c,
-               0xe8, 0x3c, 0xaa, 0x21, 0x83, 0x2f, 0x74, 0x51,
-               0xf8, 0xf4, 0x3a, 0x3e, 0xce, 0x89, 0xf3, 0x8f,
-               0xdb, 0x7d, 0xb5, 0xd8, 0xdf, 0x3e, 0x51, 0x66,
-               0x77, 0x27, 0xfc, 0xd1, 0x21, 0x11, 0x93, 0xc0,
-               0xf3, 0x7c, 0x0d, 0xa6, 0xd2, 0x96, 0xfc, 0x7a,
-               0x29, 0xe9, 0x07, 0xff, 0xa3, 0xf9, 0x85, 0x6c,
-               0x00, 0x2b, 0x22, 0x32, 0x22, 0x76, 0x9f, 0xaf,
-               0xc9, 0x3d, 0x6a, 0x93, 0x23, 0x27, 0xdd, 0x66,
-               0x41, 0xed, 0xbc, 0x5f, 0x58, 0x33, 0xcc, 0x4c,
-               0x3f, 0x3f, 0xad, 0x89, 0xa1, 0x71, 0x07, 0xfe,
-               0xe3, 0xaf, 0x35, 0xc4, 0xb7, 0xae, 0xca, 0x06,
-               0x88, 0xc2, 0x85, 0x96, 0xc4, 0x59, 0xd7, 0x23,
-               0x5f, 0xcf, 0xcb, 0x61, 0x24, 0x04, 0x72, 0x60,
-               0xbd, 0xfa, 0xd7, 0x07, 0x38, 0x5e, 0xbc, 0x7d,
-               0x45, 0x20, 0x58, 0x2c, 0x8c, 0x19, 0xc4, 0x5a,
-               0xd6, 0xd3, 0xf8, 0xd3, 0x7f, 0xee, 0x84, 0xb2,
-               0x3f, 0x4d, 0x96, 0x96, 0xc7, 0xb6, 0x57, 0x68,
-               0xe4, 0x90, 0x4e, 0xc6, 0x52, 0x4b, 0x39, 0x54,
-               0x32, 0x78, 0x59, 0x8e, 0x65, 0xb3, 0xb4, 0x29,
-               0xdf, 0x09, 0x4f, 0x92, 0x35, 0x3d, 0xa1, 0x97,
-               0x0e, 0xb9, 0x3c, 0x6d, 0xd0, 0xf5, 0x6e, 0xb7,
-               0xd5, 0xde, 0xa0, 0x2e, 0xd8, 0xaf, 0x0c, 0x4b,
-               0xb0, 0x16, 0x50, 0xf1, 0xa8, 0xee, 0x16, 0x53,
-               0x0c, 0x15, 0x27, 0x83, 0x65, 0xe1, 0x37, 0x74,
-               0x75, 0xd0, 0xaf, 0x9e, 0xaa, 0xb4, 0x0c, 0x1b,
-               0xb2, 0x75, 0x0d, 0xda, 0xc1, 0xaa, 0xbd, 0xba,
-               0x5d, 0x71, 0xf1, 0x12, 0xa8, 0xa4, 0xb2, 0x37,
-               0xe3, 0xf9, 0xb8, 0x4e, 0x34, 0x46, 0x16, 0x66,
-               0xf7, 0x4e, 0xaa, 0xf0, 0x0f, 0x29, 0x0e, 0x79,
-               0x93, 0x7b, 0xf4, 0x1f, 0xc7, 0x8f, 0x9a, 0x35,
-               0xe0, 0x7d, 0xa4, 0xa4, 0x1e, 0xa3, 0xc9, 0xac,
-               0x61, 0x3e, 0x7a, 0x5e, 0x46, 0x20, 0x61, 0xbc,
-               0x93, 0x38, 0xaf, 0x60, 0x55, 0xc7, 0x11, 0xc1,
-               0xc0, 0x9f, 0x84, 0x52, 0xa0, 0x25, 0x3c, 0xef,
-               0xe4, 0x91, 0x04, 0xa1, 0x67, 0x5d, 0x8b, 0xf9,
-               0xb4, 0x85, 0xb1, 0x90, 0xa0, 0xfa, 0xd5, 0xfc,
-               0xb7, 0x28, 0x58, 0x16, 0x36, 0xe9, 0x7f, 0x46,
-               0x8a, 0x2b, 0xd3, 0x8a, 0x42, 0x00, 0x54, 0xdf,
-               0x8b, 0x5c, 0x31, 0x65, 0xde, 0xf6, 0x80, 0xbd,
-               0x5e, 0x52, 0x67, 0xc4, 0x67, 0x11, 0x91, 0x9b,
-               0x04, 0x4e, 0x9e, 0xdc, 0xe4, 0x00, 0xa3, 0x24,
-               0x71, 0x3d, 0xe4, 0x05, 0x32, 0x96, 0xed, 0x9a,
-               0x07, 0xd7, 0x41, 0x10, 0x6f, 0xee, 0x43, 0xc1,
-               0xea, 0xdb, 0x5c, 0x51, 0x3c, 0x31, 0x48, 0xd5,
-               0xdb, 0x1e, 0x3d, 0x09, 0x23, 0x89, 0x2f, 0x32,
-               0x26, 0xfe, 0x88, 0x1b, 0x83, 0xf2, 0xba, 0x53,
-               0x41, 0x9a, 0x74, 0xfc, 0x97, 0xd3, 0x0d, 0x16,
-               0xb6, 0x8d, 0x55, 0x81, 0x74, 0xa4, 0xa9, 0xd6,
-               0x27, 0x6b, 0xf7, 0x0c, 0x32, 0x99, 0x1a, 0xcf,
-               0x00, 0x4b, 0xd4, 0xde, 0x0c, 0x6d, 0x52, 0xbc,
-               0x4e, 0xac, 0xa9, 0x28, 0x9b, 0x4e, 0x55, 0x47,
-               0xe3, 0x4b, 0x1a, 0xa0, 0xc0, 0x8d, 0xa9, 0xf6,
-               0xcf, 0xcd, 0x0d, 0x44, 0x4c, 0x71, 0x32, 0xf5,
-               0xb2, 0x0c, 0x5a, 0xc8, 0xfa, 0xa8, 0xcf, 0x35,
-               0x68, 0xd8, 0x55, 0xa2, 0xb2, 0x65, 0xe5, 0x55,
-               0x28, 0x2e, 0xc3, 0x69, 0xf8, 0x75, 0x8d, 0x6d,
-               0x5f, 0xfb, 0x44, 0xb1, 0xf0, 0x86, 0xe5, 0xde,
-               0x0f, 0xe7, 0x51, 0x96, 0x7f, 0x00, 0xa2, 0x1e,
-               0xe2, 0x4b, 0x86, 0xe7, 0x4c, 0xdc, 0x95, 0x53,
-               0xc5, 0xaa, 0x5a, 0x05, 0x5c, 0xa0, 0xde, 0xa8,
-               0xc5, 0x6a, 0xb2, 0x09, 0xd4, 0xa0, 0xed, 0xe1,
-               0x85, 0xb9, 0xa3, 0xde, 0x2b, 0x4d, 0xf9, 0x4a,
-               0x72, 0x50, 0x26, 0xae, 0xf9, 0xc7, 0x78, 0x63,
-               0x20, 0xa2, 0xc4, 0x88, 0xbe, 0xc6, 0x29, 0x4b,
-               0xfc, 0x9c, 0x3d, 0x38, 0x6b, 0x60, 0x76, 0xe9,
-               0xf7, 0xaa, 0x28, 0xc4, 0xe1, 0xfc, 0xfe, 0x3a,
-               0xc3, 0x90, 0xb2, 0x2c, 0x7b, 0x10, 0xce, 0xe3,
-               0xe9, 0x81, 0x87, 0x93, 0x26, 0x2f, 0x97, 0x30,
-               0x4b, 0xf7, 0x10, 0x8e, 0x36, 0xf7, 0x00, 0x3e,
-               0xf8, 0xd4, 0x56, 0xa7, 0x37, 0x07, 0x25, 0x19,
-               0x03, 0x38, 0x0b, 0xdd, 0xec, 0x1a, 0x4f, 0xab,
-               0x43, 0xd2, 0x34, 0x65, 0xba, 0x9f, 0x39, 0xfc,
-               0x95, 0x1a, 0xf4, 0xa4, 0xc2, 0x32, 0x19, 0x23,
-               0x04, 0xdb, 0x11, 0x11, 0xbe, 0xd1, 0xf0, 0x81,
-               0x22, 0xd5, 0xd5, 0x32, 0x44, 0xe6, 0x02, 0xb5,
-               0x34, 0x66, 0x37, 0x48, 0x51, 0xd7, 0x62, 0xb4,
-               0xf7, 0x03, 0x38, 0x29, 0x79, 0x8d, 0x88, 0xa1,
-               0x5c, 0xb0, 0xec, 0xf0, 0xc0, 0xd9, 0x81, 0xf4,
-               0x15, 0xe0, 0x0b, 0x79, 0x87, 0xd8, 0x3e, 0x0f,
-               0xc9, 0x64, 0x1a, 0x36, 0x81, 0xee, 0x44, 0xd6,
-               0xea, 0xe3, 0x3f, 0x63, 0x43, 0xac, 0x0a, 0x40,
-               0xe0, 0x35, 0xb3, 0x5e, 0x34, 0xc3, 0x1b, 0xd7,
-               0x92, 0x8b, 0x6d, 0xf3, 0xae, 0x32, 0xaa, 0x05,
-               0xca, 0x56, 0xb8, 0xb8, 0xed, 0xb3, 0xbd, 0x8a,
-               0xdb, 0x31, 0x99, 0x92, 0x21, 0xe4, 0xe0, 0x23,
-               0x78, 0xa6, 0x09, 0xb0, 0xbc, 0xb1, 0xdc, 0xdd,
-               0x62, 0x2f, 0xcb, 0x22, 0x19, 0xf7, 0xe3, 0xc7,
-               0x5d, 0x62, 0x4a, 0xb9, 0x52, 0x33, 0xf7, 0x15,
-               0xb9, 0x99, 0x3f, 0xf8, 0xa1, 0x12, 0xac, 0x93,
-               0x01, 0x4b, 0x1f, 0x2d, 0x59, 0x02, 0xe3, 0x94,
-               0x1a, 0x98, 0x28, 0xb1, 0xfe, 0x79, 0xf5, 0xca,
-               0x8c, 0xfb, 0x89, 0x6b, 0xe3, 0x4d, 0xf7, 0x42,
-               0x4a, 0xfe, 0x00, 0x0b, 0xbc, 0x20, 0xef, 0x37,
-               0x6a, 0xc6, 0xda, 0x80, 0x0e, 0x57, 0x00, 0xf4,
-               0x95, 0x0c, 0x68, 0x47, 0x5f, 0xbc, 0x24, 0xe9,
-               0x4b, 0xa2, 0x34, 0xb9, 0xc0, 0x0f, 0xe7, 0xaf,
-               0xe4, 0x89, 0xee, 0x68, 0x5e, 0xd7, 0x4e, 0x3b,
-               0x1e, 0x5b, 0x68, 0x38, 0x40, 0x49, 0x73, 0xec,
-               0xf8, 0x38, 0xa6, 0x5a, 0x6a, 0xf7, 0x87, 0xe1,
-               0xb6, 0xf6, 0xb7, 0x16, 0x2e, 0xa2, 0xe9, 0x14,
-               0x2b, 0x22, 0x89, 0x26, 0xc7, 0xac, 0xa4, 0xc5,
-               0xec, 0xfd, 0x72, 0xe8, 0x8c, 0x92, 0xdf, 0x14,
-               0x90, 0xcb, 0xbc, 0xfd, 0x90, 0x2a, 0x6c, 0xc5,
-               0x54, 0xad, 0x0c, 0x40, 0x81, 0x64, 0x8e, 0xe8,
-               0xda, 0x07, 0x6e, 0xc2, 0xbb, 0x19, 0x97, 0x0b,
-               0x23, 0x96, 0xe9, 0x17, 0x15, 0x76, 0x09, 0xf3,
-               0xd3, 0x8b, 0xda, 0x8f, 0x3b, 0x6b, 0x08, 0x1d,
-               0x7d, 0x55, 0x0d, 0x5e, 0x14, 0x6e, 0xda, 0x72,
-               0x8f, 0xd3, 0x22, 0xeb, 0xb7, 0x4b, 0x8f, 0xed,
-               0xe9, 0x20, 0x77, 0xc1, 0x7e, 0x2f, 0x89, 0xfd,
-               0xa3, 0xf6, 0x25, 0x68, 0xc1, 0x1f, 0x44, 0xea,
-               0x17, 0x6c, 0x51, 0xcd, 0x00, 0xc5, 0x91, 0xd6,
-               0x46, 0x90, 0x8f, 0x88, 0x8c, 0x2e, 0xde, 0xd5,
-               0x7d, 0x34, 0x9c, 0x16, 0x15, 0xa0, 0x58, 0x7d,
-               0xe5, 0xab, 0xe6, 0xdc, 0x5f, 0xaa, 0x73, 0x34,
-               0xa9, 0x69, 0xe7, 0x07, 0x11, 0x10, 0xa7, 0x58,
-               0x63, 0xad, 0x5c, 0x89, 0x36, 0x9f, 0x1e, 0x35,
-               0x34, 0x79, 0xbc, 0x79, 0x31, 0xcd, 0x2e, 0x06,
-               0x97, 0x4c, 0x39, 0xfb, 0xba, 0xfa, 0x17, 0x77,
-               0x3f, 0x6c, 0xd3, 0x0b, 0x23, 0x37, 0x08, 0xa4,
-               0x5d, 0x3c, 0x04, 0xc1, 0x2a, 0xc2, 0x93, 0x2b,
-               0xc0, 0xec, 0x7d, 0x61, 0x1f, 0xa2, 0x54, 0x92,
-               0xda, 0x86, 0x34, 0x01, 0x40, 0x48, 0x7f, 0xaf,
-               0x88, 0xfd, 0x3a, 0x05, 0x98, 0xd0, 0xb7, 0x81,
-               0x4d, 0x60, 0x76, 0x8b, 0x39, 0x6e, 0x33, 0x97,
-               0x99, 0xfa, 0x93, 0x0f, 0x7b, 0xb3, 0xaf, 0x95,
-               0xb9, 0xdb, 0xa1, 0xcc, 0x8b, 0x32, 0x14, 0x03,
-               0x03, 0x00, 0x01, 0x01, 0x16, 0x03, 0x03, 0x00,
-               0x24, 0x53, 0x06, 0xc3, 0x99, 0xce, 0x22, 0x41,
-               0x0e, 0x81, 0x2d, 0x6b, 0x35, 0xae, 0xd5, 0x7d,
-               0x7e, 0x6b, 0xb4, 0xe9, 0xe9, 0x06, 0xbc, 0x5b,
-               0x3b, 0xf2, 0x77, 0x2e, 0x0c, 0x2b, 0xba, 0x96,
-               0x93, 0xb7, 0x2e, 0x1d, 0x49, 0x17, 0x03, 0x03,
-               0x00, 0x21, 0x41, 0xb5, 0x78, 0xc2, 0xcb, 0x4e,
-               0x52, 0x72, 0x2b, 0xdf, 0x9b, 0xc6, 0x75, 0x24,
-               0xe1, 0x58, 0xb8, 0xe1, 0x78, 0x39, 0xa0, 0xe4,
-               0x74, 0x00, 0xee, 0x6b, 0xb5, 0xbe, 0xe7, 0x48,
-               0xbe, 0x61, 0x69, 0x15, 0x03, 0x03, 0x00, 0x16,
-               0xcc, 0xf1, 0x43, 0x54, 0x49, 0xd3, 0x17, 0xd1,
-               0x7a, 0xc0, 0x40, 0x05, 0xd0, 0x9e, 0x22, 0xbd,
-               0x5b, 0x5c, 0xd9, 0x7f, 0xce, 0x34,
+               0xea, 0x8b, 0xc5, 0xef, 0xba, 0x64, 0xb7, 0x23,
+               0x08, 0x86, 0x4f, 0x37, 0xe0, 0x8f, 0xbd, 0x75,
+               0x71, 0x2b, 0xcb, 0x20, 0x75, 0x11, 0x3b, 0xa2,
+               0x9e, 0x39, 0x3c, 0x03, 0xef, 0x6e, 0x41, 0xd7,
+               0xcf, 0x1a, 0x2c, 0xf2, 0xfe, 0xc2, 0xd3, 0x65,
+               0x59, 0x00, 0x9d, 0x03, 0xb4, 0xf2, 0x20, 0xe4,
+               0x33, 0x80, 0xcd, 0xf6, 0xe4, 0x59, 0x22, 0xf7,
+               0xfd, 0x88, 0x0e, 0xa4, 0x09, 0xc0, 0x0d, 0x10,
+               0x80, 0x10, 0x79, 0xee, 0x70, 0x96, 0xdb, 0x22,
+               0x8b, 0xb7, 0xac, 0xe0, 0x98, 0xad, 0xe9, 0xe3,
+               0xcb, 0xea, 0x9f, 0xe6, 0x83, 0x28, 0x7c, 0x7e,
+               0x4e, 0x9a, 0x8d, 0xd9, 0xf3, 0x86, 0xf4, 0x89,
+               0x8b, 0x79, 0x8f, 0xbb, 0xe9, 0x74, 0x02, 0x02,
+               0x14, 0x04, 0xea, 0xba, 0x16, 0x10, 0xa1, 0x85,
+               0xbe, 0x4e, 0x4e, 0x92, 0xc5, 0x83, 0xf6, 0x1e,
+               0x1f, 0xd4, 0x25, 0xc2, 0xc2, 0xb9, 0xce, 0x33,
+               0x63, 0x66, 0x79, 0x1f, 0x54, 0x35, 0xc1, 0xe8,
+               0x89, 0x34, 0x78, 0x94, 0x36, 0x14, 0xef, 0x01,
+               0x1f, 0xf1, 0xbd, 0x77, 0x2c, 0x4d, 0xac, 0x5c,
+               0x5c, 0x4a, 0xc6, 0xed, 0xd8, 0x0e, 0x72, 0x84,
+               0x83, 0xdc, 0x56, 0x84, 0xc8, 0xf3, 0x89, 0x56,
+               0xfd, 0x89, 0xc1, 0xc9, 0x9a, 0x29, 0x91, 0x7e,
+               0x19, 0xe9, 0x8b, 0x5b, 0x11, 0x15, 0x4e, 0x6c,
+               0xf4, 0x89, 0xe7, 0x6d, 0x68, 0x1e, 0xf9, 0x6c,
+               0x23, 0x72, 0x05, 0x68, 0x82, 0x60, 0x84, 0x1f,
+               0x83, 0x20, 0x09, 0x86, 0x10, 0x81, 0xec, 0xec,
+               0xdc, 0x25, 0x53, 0x20, 0xfa, 0xa9, 0x41, 0x64,
+               0xd6, 0x20, 0xf3, 0xf4, 0x52, 0xf2, 0x80, 0x62,
+               0x83, 0xc9, 0x23, 0x66, 0x44, 0x95, 0x5a, 0x99,
+               0x8a, 0xe1, 0x26, 0x63, 0xc1, 0x8b, 0x31, 0xf9,
+               0x21, 0x06, 0x77, 0x04, 0x27, 0xf2, 0x0c, 0x63,
+               0x83, 0x45, 0xa0, 0xa9, 0x7b, 0xcf, 0xdf, 0xd7,
+               0x56, 0x75, 0xbc, 0xdd, 0x95, 0x36, 0xb1, 0x75,
+               0x39, 0x05, 0x00, 0x3c, 0x8a, 0x79, 0xd6, 0xe9,
+               0xf0, 0x4b, 0xdc, 0x51, 0x6b, 0x01, 0x94, 0x16,
+               0x87, 0x12, 0x92, 0x6c, 0x07, 0xc1, 0xf5, 0x58,
+               0xb7, 0x2a, 0x81, 0xf5, 0xa0, 0x37, 0x8b, 0xa6,
+               0x22, 0xfe, 0x28, 0x0a, 0x7e, 0x68, 0xe2, 0xda,
+               0x6c, 0x53, 0xee, 0x0e, 0x8d, 0x2d, 0x8b, 0x0b,
+               0xda, 0xf8, 0x99, 0x3e, 0x0e, 0xed, 0x9f, 0xc1,
+               0x2b, 0xf6, 0xfe, 0xe9, 0x52, 0x38, 0x7b, 0x83,
+               0x9a, 0x50, 0xa6, 0xd7, 0x49, 0x83, 0x43, 0x7e,
+               0x82, 0xec, 0xc7, 0x09, 0x3d, 0x3d, 0xb1, 0xee,
+               0xe8, 0xc5, 0x6a, 0xc3, 0x3d, 0x4b, 0x4c, 0x6a,
+               0xbb, 0x0b, 0x2c, 0x24, 0x2e, 0xdb, 0x7d, 0x57,
+               0x87, 0xb4, 0x80, 0xa5, 0xae, 0xff, 0x54, 0xa8,
+               0xa5, 0x27, 0x69, 0x95, 0xc8, 0xe7, 0x79, 0xc7,
+               0x89, 0x2a, 0x73, 0x49, 0xcb, 0xf5, 0xc5, 0xbc,
+               0x4a, 0xe0, 0x73, 0xa9, 0xbc, 0x88, 0x64, 0x96,
+               0x98, 0xa5, 0x1e, 0xe3, 0x43, 0xc1, 0x7d, 0x78,
+               0xc7, 0x94, 0x72, 0xd4, 0x2c, 0x6e, 0x85, 0x39,
+               0x9a, 0xaf, 0xdb, 0xa1, 0xe9, 0xe2, 0xcb, 0x37,
+               0x04, 0xc6, 0x8c, 0x81, 0xd3, 0x2a, 0xb7, 0xbe,
+               0x6c, 0x07, 0x1f, 0x5e, 0xd9, 0x00, 0xd2, 0xf7,
+               0xe1, 0xa7, 0xbc, 0x0c, 0xb6, 0x6d, 0xfb, 0x3f,
+               0x3d, 0x24, 0xaa, 0xfb, 0x7e, 0xe1, 0xb5, 0x1b,
+               0xff, 0x38, 0xaa, 0x69, 0x59, 0x38, 0x52, 0x9a,
+               0x0e, 0x6d, 0xbc, 0xde, 0x4f, 0x13, 0x09, 0x17,
+               0xc4, 0xa9, 0x05, 0x84, 0xbc, 0x50, 0xef, 0x40,
+               0xb0, 0x4c, 0x24, 0x32, 0xed, 0x94, 0x2c, 0xdd,
+               0xda, 0x20, 0x24, 0x67, 0xe2, 0xea, 0x71, 0x3d,
+               0x4a, 0x04, 0x0d, 0x98, 0x29, 0x20, 0x4c, 0xeb,
+               0x70, 0xce, 0x45, 0x9e, 0x5a, 0xaf, 0xb6, 0xa3,
+               0x92, 0xc8, 0x28, 0xf2, 0xe3, 0xe8, 0x8a, 0x5d,
+               0x0a, 0x33, 0x79, 0x9b, 0x6a, 0xf3, 0x30, 0x01,
+               0x1d, 0x47, 0xbd, 0x01, 0xcc, 0x4d, 0x71, 0xc0,
+               0x56, 0xfa, 0xfd, 0x37, 0xed, 0x0f, 0x27, 0xc0,
+               0xbb, 0xa0, 0xee, 0xc3, 0x79, 0x8b, 0xe7, 0x41,
+               0x8f, 0xfa, 0x3a, 0xcb, 0x45, 0x3b, 0x85, 0x9f,
+               0x06, 0x90, 0xb2, 0x51, 0xc0, 0x48, 0x10, 0xac,
+               0x2a, 0xec, 0xec, 0x48, 0x7a, 0x19, 0x47, 0xc4,
+               0x2a, 0xeb, 0xb3, 0xa2, 0x07, 0x22, 0x32, 0x78,
+               0xf4, 0x73, 0x5e, 0x92, 0x42, 0x15, 0xa1, 0x90,
+               0x91, 0xd0, 0xeb, 0x12, 0x14, 0x03, 0x03, 0x00,
+               0x01, 0x01, 0x16, 0x03, 0x03, 0x00, 0x24, 0x45,
+               0x4b, 0x80, 0x42, 0x46, 0xde, 0xbb, 0xe7, 0x76,
+               0xd1, 0x33, 0x92, 0xfc, 0x46, 0x17, 0x6d, 0x21,
+               0xf6, 0x0e, 0x16, 0xca, 0x9b, 0x9b, 0x04, 0x65,
+               0x16, 0x40, 0x44, 0x64, 0xbc, 0x58, 0xfa, 0x2a,
+               0x49, 0xe9, 0xed, 0x17, 0x03, 0x03, 0x00, 0x21,
+               0x89, 0x71, 0xcd, 0x56, 0x54, 0xbf, 0x73, 0xde,
+               0xfb, 0x4b, 0x4e, 0xf1, 0x7f, 0xc6, 0x75, 0xa6,
+               0xbd, 0x6b, 0x6c, 0xd9, 0xdc, 0x0c, 0x71, 0xb4,
+               0xb9, 0xbb, 0x6e, 0xfa, 0x9e, 0xc7, 0xc7, 0x4c,
+               0x24, 0x15, 0x03, 0x03, 0x00, 0x16, 0x62, 0xea,
+               0x65, 0x69, 0x68, 0x4a, 0xce, 0xa7, 0x9e, 0xce,
+               0xc0, 0xf1, 0x5c, 0x96, 0xd9, 0x1f, 0x49, 0xac,
+               0x2d, 0x05, 0x89, 0x94,
        },
 }
 
@@ -2796,3 +3091,395 @@ qTdQRYlHRftgnWK1AkANibn9PRYJ7mJyJ9Dyj2QeNcSkSTzrt0tPvUMf4+meJymN
 1Ntu5+S1DLLzfxlaljWG6ylW6DNxujCyuXIV2rvA
 -----END RSA PRIVATE KEY-----
 */
+
+var clientECDSACertificate = loadPEMCert(`
+-----BEGIN CERTIFICATE-----
+MIIB/DCCAV4CCQCaMIRsJjXZFzAJBgcqhkjOPQQBMEUxCzAJBgNVBAYTAkFVMRMw
+EQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0
+eSBMdGQwHhcNMTIxMTE0MTMyNTUzWhcNMjIxMTEyMTMyNTUzWjBBMQswCQYDVQQG
+EwJBVTEMMAoGA1UECBMDTlNXMRAwDgYDVQQHEwdQeXJtb250MRIwEAYDVQQDEwlK
+b2VsIFNpbmcwgZswEAYHKoZIzj0CAQYFK4EEACMDgYYABACVjJF1FMBexFe01MNv
+ja5oHt1vzobhfm6ySD6B5U7ixohLZNz1MLvT/2XMW/TdtWo+PtAd3kfDdq0Z9kUs
+jLzYHQFMH3CQRnZIi4+DzEpcj0B22uCJ7B0rxE4wdihBsmKo+1vx+U56jb0JuK7q
+ixgnTy5w/hOWusPTQBbNZU6sER7m8TAJBgcqhkjOPQQBA4GMADCBiAJCAOAUxGBg
+C3JosDJdYUoCdFzCgbkWqD8pyDbHgf9stlvZcPE4O1BIKJTLCRpS8V3ujfK58PDa
+2RU6+b0DeoeiIzXsAkIBo9SKeDUcSpoj0gq+KxAxnZxfvuiRs9oa9V2jI/Umi0Vw
+jWVim34BmT0Y9hCaOGGbLlfk+syxis7iI6CH8OFnUes=
+-----END CERTIFICATE-----
+`)
+
+/* corresponding key for cert is:
+-----BEGIN EC PARAMETERS-----
+BgUrgQQAIw==
+-----END EC PARAMETERS-----
+-----BEGIN EC PRIVATE KEY-----
+MIHcAgEBBEIBkJN9X4IqZIguiEVKMqeBUP5xtRsEv4HJEtOpOGLELwO53SD78Ew8
+k+wLWoqizS3NpQyMtrU8JFdWfj+C57UNkOugBwYFK4EEACOhgYkDgYYABACVjJF1
+FMBexFe01MNvja5oHt1vzobhfm6ySD6B5U7ixohLZNz1MLvT/2XMW/TdtWo+PtAd
+3kfDdq0Z9kUsjLzYHQFMH3CQRnZIi4+DzEpcj0B22uCJ7B0rxE4wdihBsmKo+1vx
++U56jb0JuK7qixgnTy5w/hOWusPTQBbNZU6sER7m8Q==
+-----END EC PRIVATE KEY-----
+*/
+var clientauthECDSATests = []clientauthTest{
+       // Server asks for cert with empty CA list, client gives one
+       //   go test -run "TestRunServer" -serve \
+       //     -clientauth 1 -ciphersuites=0xc00a
+       //   openssl s_client -host 127.0.0.1 -port 10443 \
+       //     -cipher ECDHE-ECDSA-AES256-SHA -key client.key -cert client.crt
+       {"RequestClientCert, client gives it", RequestClientCert, []*x509.Certificate{clientECDSACertificate}, [][]byte{
+               {
+                       0x16, 0x03, 0x01, 0x00, 0xa0, 0x01, 0x00, 0x00,
+                       0x9c, 0x03, 0x03, 0x51, 0xe5, 0x73, 0xc5, 0xae,
+                       0x51, 0x94, 0xb4, 0xf2, 0xe8, 0xf6, 0x03, 0x0e,
+                       0x3b, 0x34, 0xaf, 0xf0, 0xdc, 0x1b, 0xcc, 0xd8,
+                       0x0c, 0x45, 0x82, 0xd4, 0xd6, 0x76, 0x04, 0x6e,
+                       0x4f, 0x7a, 0x24, 0x00, 0x00, 0x04, 0xc0, 0x0a,
+                       0x00, 0xff, 0x01, 0x00, 0x00, 0x6f, 0x00, 0x0b,
+                       0x00, 0x04, 0x03, 0x00, 0x01, 0x02, 0x00, 0x0a,
+                       0x00, 0x34, 0x00, 0x32, 0x00, 0x0e, 0x00, 0x0d,
+                       0x00, 0x19, 0x00, 0x0b, 0x00, 0x0c, 0x00, 0x18,
+                       0x00, 0x09, 0x00, 0x0a, 0x00, 0x16, 0x00, 0x17,
+                       0x00, 0x08, 0x00, 0x06, 0x00, 0x07, 0x00, 0x14,
+                       0x00, 0x15, 0x00, 0x04, 0x00, 0x05, 0x00, 0x12,
+                       0x00, 0x13, 0x00, 0x01, 0x00, 0x02, 0x00, 0x03,
+                       0x00, 0x0f, 0x00, 0x10, 0x00, 0x11, 0x00, 0x23,
+                       0x00, 0x00, 0x00, 0x0d, 0x00, 0x22, 0x00, 0x20,
+                       0x06, 0x01, 0x06, 0x02, 0x06, 0x03, 0x05, 0x01,
+                       0x05, 0x02, 0x05, 0x03, 0x04, 0x01, 0x04, 0x02,
+                       0x04, 0x03, 0x03, 0x01, 0x03, 0x02, 0x03, 0x03,
+                       0x02, 0x01, 0x02, 0x02, 0x02, 0x03, 0x01, 0x01,
+                       0x00, 0x0f, 0x00, 0x01, 0x01,
+               },
+               {
+                       0x16, 0x03, 0x01, 0x00, 0x30, 0x02, 0x00, 0x00,
+                       0x2c, 0x03, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
+                       0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                       0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                       0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                       0x00, 0x00, 0x00, 0x00, 0xc0, 0x0a, 0x00, 0x00,
+                       0x04, 0x00, 0x23, 0x00, 0x00, 0x16, 0x03, 0x01,
+                       0x02, 0x0e, 0x0b, 0x00, 0x02, 0x0a, 0x00, 0x02,
+                       0x07, 0x00, 0x02, 0x04, 0x30, 0x82, 0x02, 0x00,
+                       0x30, 0x82, 0x01, 0x62, 0x02, 0x09, 0x00, 0xb8,
+                       0xbf, 0x2d, 0x47, 0xa0, 0xd2, 0xeb, 0xf4, 0x30,
+                       0x09, 0x06, 0x07, 0x2a, 0x86, 0x48, 0xce, 0x3d,
+                       0x04, 0x01, 0x30, 0x45, 0x31, 0x0b, 0x30, 0x09,
+                       0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x41,
+                       0x55, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55,
+                       0x04, 0x08, 0x13, 0x0a, 0x53, 0x6f, 0x6d, 0x65,
+                       0x2d, 0x53, 0x74, 0x61, 0x74, 0x65, 0x31, 0x21,
+                       0x30, 0x1f, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x13,
+                       0x18, 0x49, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x65,
+                       0x74, 0x20, 0x57, 0x69, 0x64, 0x67, 0x69, 0x74,
+                       0x73, 0x20, 0x50, 0x74, 0x79, 0x20, 0x4c, 0x74,
+                       0x64, 0x30, 0x1e, 0x17, 0x0d, 0x31, 0x32, 0x31,
+                       0x31, 0x32, 0x32, 0x31, 0x35, 0x30, 0x36, 0x33,
+                       0x32, 0x5a, 0x17, 0x0d, 0x32, 0x32, 0x31, 0x31,
+                       0x32, 0x30, 0x31, 0x35, 0x30, 0x36, 0x33, 0x32,
+                       0x5a, 0x30, 0x45, 0x31, 0x0b, 0x30, 0x09, 0x06,
+                       0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x41, 0x55,
+                       0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04,
+                       0x08, 0x13, 0x0a, 0x53, 0x6f, 0x6d, 0x65, 0x2d,
+                       0x53, 0x74, 0x61, 0x74, 0x65, 0x31, 0x21, 0x30,
+                       0x1f, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x13, 0x18,
+                       0x49, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x65, 0x74,
+                       0x20, 0x57, 0x69, 0x64, 0x67, 0x69, 0x74, 0x73,
+                       0x20, 0x50, 0x74, 0x79, 0x20, 0x4c, 0x74, 0x64,
+                       0x30, 0x81, 0x9b, 0x30, 0x10, 0x06, 0x07, 0x2a,
+                       0x86, 0x48, 0xce, 0x3d, 0x02, 0x01, 0x06, 0x05,
+                       0x2b, 0x81, 0x04, 0x00, 0x23, 0x03, 0x81, 0x86,
+                       0x00, 0x04, 0x00, 0xc4, 0xa1, 0xed, 0xbe, 0x98,
+                       0xf9, 0x0b, 0x48, 0x73, 0x36, 0x7e, 0xc3, 0x16,
+                       0x56, 0x11, 0x22, 0xf2, 0x3d, 0x53, 0xc3, 0x3b,
+                       0x4d, 0x21, 0x3d, 0xcd, 0x6b, 0x75, 0xe6, 0xf6,
+                       0xb0, 0xdc, 0x9a, 0xdf, 0x26, 0xc1, 0xbc, 0xb2,
+                       0x87, 0xf0, 0x72, 0x32, 0x7c, 0xb3, 0x64, 0x2f,
+                       0x1c, 0x90, 0xbc, 0xea, 0x68, 0x23, 0x10, 0x7e,
+                       0xfe, 0xe3, 0x25, 0xc0, 0x48, 0x3a, 0x69, 0xe0,
+                       0x28, 0x6d, 0xd3, 0x37, 0x00, 0xef, 0x04, 0x62,
+                       0xdd, 0x0d, 0xa0, 0x9c, 0x70, 0x62, 0x83, 0xd8,
+                       0x81, 0xd3, 0x64, 0x31, 0xaa, 0x9e, 0x97, 0x31,
+                       0xbd, 0x96, 0xb0, 0x68, 0xc0, 0x9b, 0x23, 0xde,
+                       0x76, 0x64, 0x3f, 0x1a, 0x5c, 0x7f, 0xe9, 0x12,
+                       0x0e, 0x58, 0x58, 0xb6, 0x5f, 0x70, 0xdd, 0x9b,
+                       0xd8, 0xea, 0xd5, 0xd7, 0xf5, 0xd5, 0xcc, 0xb9,
+                       0xb6, 0x9f, 0x30, 0x66, 0x5b, 0x66, 0x9a, 0x20,
+                       0xe2, 0x27, 0xe5, 0xbf, 0xfe, 0x3b, 0x30, 0x09,
+                       0x06, 0x07, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x04,
+                       0x01, 0x03, 0x81, 0x8c, 0x00, 0x30, 0x81, 0x88,
+                       0x02, 0x42, 0x01, 0x88, 0xa2, 0x4f, 0xeb, 0xe2,
+                       0x45, 0xc5, 0x48, 0x7d, 0x1b, 0xac, 0xf5, 0xed,
+                       0x98, 0x9d, 0xae, 0x47, 0x70, 0xc0, 0x5e, 0x1b,
+                       0xb6, 0x2f, 0xbd, 0xf1, 0xb6, 0x4d, 0xb7, 0x61,
+                       0x40, 0xd3, 0x11, 0xa2, 0xce, 0xee, 0x0b, 0x7e,
+                       0x92, 0x7e, 0xff, 0x76, 0x9d, 0xc3, 0x3b, 0x7e,
+                       0xa5, 0x3f, 0xce, 0xfa, 0x10, 0xe2, 0x59, 0xec,
+                       0x47, 0x2d, 0x7c, 0xac, 0xda, 0x4e, 0x97, 0x0e,
+                       0x15, 0xa0, 0x6f, 0xd0, 0x02, 0x42, 0x01, 0x4d,
+                       0xfc, 0xbe, 0x67, 0x13, 0x9c, 0x2d, 0x05, 0x0e,
+                       0xbd, 0x3f, 0xa3, 0x8c, 0x25, 0xc1, 0x33, 0x13,
+                       0x83, 0x0d, 0x94, 0x06, 0xbb, 0xd4, 0x37, 0x7a,
+                       0xf6, 0xec, 0x7a, 0xc9, 0x86, 0x2e, 0xdd, 0xd7,
+                       0x11, 0x69, 0x7f, 0x85, 0x7c, 0x56, 0xde, 0xfb,
+                       0x31, 0x78, 0x2b, 0xe4, 0xc7, 0x78, 0x0d, 0xae,
+                       0xcb, 0xbe, 0x9e, 0x4e, 0x36, 0x24, 0x31, 0x7b,
+                       0x6a, 0x0f, 0x39, 0x95, 0x12, 0x07, 0x8f, 0x2a,
+                       0x16, 0x03, 0x01, 0x01, 0x1a, 0x0c, 0x00, 0x01,
+                       0x16, 0x03, 0x00, 0x19, 0x85, 0x04, 0x01, 0x39,
+                       0xdc, 0xee, 0x44, 0x17, 0x5e, 0xdb, 0xd7, 0x27,
+                       0xaf, 0xb6, 0x56, 0xd9, 0xb4, 0x43, 0x5a, 0x99,
+                       0xcf, 0xaa, 0x31, 0x37, 0x0c, 0x6f, 0x3a, 0xa0,
+                       0xf8, 0x53, 0xc4, 0x74, 0xd1, 0x91, 0x0a, 0x46,
+                       0xf5, 0x38, 0x3b, 0x5c, 0x09, 0xd8, 0x97, 0xdc,
+                       0x4b, 0xaa, 0x70, 0x26, 0x48, 0xf2, 0xd6, 0x0b,
+                       0x31, 0xc9, 0xf8, 0xd4, 0x98, 0x43, 0xe1, 0x6c,
+                       0xd5, 0xc7, 0xb2, 0x8e, 0x0b, 0x01, 0xe6, 0xb6,
+                       0x00, 0x28, 0x80, 0x7b, 0xfc, 0x96, 0x8f, 0x0d,
+                       0xa2, 0x4f, 0xb0, 0x79, 0xaf, 0xdc, 0x61, 0x28,
+                       0x63, 0x33, 0x78, 0xf6, 0x31, 0x39, 0xfd, 0x8a,
+                       0xf4, 0x15, 0x18, 0x11, 0xfe, 0xdb, 0xd5, 0x07,
+                       0xda, 0x2c, 0xed, 0x49, 0xa0, 0x23, 0xbf, 0xd0,
+                       0x3a, 0x38, 0x1d, 0x54, 0xae, 0x1c, 0x7b, 0xea,
+                       0x29, 0xee, 0xd0, 0x38, 0xc1, 0x76, 0xa7, 0x7f,
+                       0x2a, 0xf4, 0xce, 0x1e, 0xac, 0xcc, 0x94, 0x79,
+                       0x90, 0x33, 0x00, 0x8b, 0x30, 0x81, 0x88, 0x02,
+                       0x42, 0x00, 0xc6, 0x85, 0x8e, 0x06, 0xb7, 0x04,
+                       0x04, 0xe9, 0xcd, 0x9e, 0x3e, 0xcb, 0x66, 0x23,
+                       0x95, 0xb4, 0x42, 0x9c, 0x64, 0x81, 0x39, 0x05,
+                       0x3f, 0xb5, 0x21, 0xf8, 0x28, 0xaf, 0x60, 0x6b,
+                       0x4d, 0x3d, 0xba, 0xa1, 0x4b, 0x5e, 0x77, 0xef,
+                       0xe7, 0x59, 0x28, 0xfe, 0x1d, 0xc1, 0x27, 0xa2,
+                       0xff, 0xa8, 0xde, 0x33, 0x48, 0xb3, 0xc1, 0x85,
+                       0x6a, 0x42, 0x9b, 0xf9, 0x7e, 0x7e, 0x31, 0xc2,
+                       0xe5, 0xbd, 0x66, 0x02, 0x42, 0x00, 0xad, 0x7d,
+                       0x06, 0x35, 0xab, 0xec, 0x8d, 0xac, 0xd4, 0xba,
+                       0x1b, 0x49, 0x5e, 0x05, 0x5f, 0xf0, 0x97, 0x93,
+                       0x82, 0xb8, 0x2b, 0x8d, 0x91, 0x98, 0x63, 0x8e,
+                       0xb4, 0x14, 0x62, 0xdb, 0x1e, 0xc9, 0x2b, 0x30,
+                       0xf8, 0x41, 0x9b, 0xa6, 0xe6, 0xbc, 0xde, 0x0e,
+                       0x68, 0x30, 0x21, 0xf4, 0xa8, 0xa9, 0x1b, 0xec,
+                       0x44, 0x4f, 0x5d, 0x02, 0x2f, 0x60, 0x45, 0x60,
+                       0xba, 0xe0, 0x4e, 0xc0, 0xd4, 0x3b, 0x01, 0x16,
+                       0x03, 0x01, 0x00, 0x09, 0x0d, 0x00, 0x00, 0x05,
+                       0x02, 0x01, 0x40, 0x00, 0x00, 0x16, 0x03, 0x01,
+                       0x00, 0x04, 0x0e, 0x00, 0x00, 0x00,
+               },
+               {
+                       0x16, 0x03, 0x01, 0x02, 0x0a, 0x0b, 0x00, 0x02,
+                       0x06, 0x00, 0x02, 0x03, 0x00, 0x02, 0x00, 0x30,
+                       0x82, 0x01, 0xfc, 0x30, 0x82, 0x01, 0x5e, 0x02,
+                       0x09, 0x00, 0x9a, 0x30, 0x84, 0x6c, 0x26, 0x35,
+                       0xd9, 0x17, 0x30, 0x09, 0x06, 0x07, 0x2a, 0x86,
+                       0x48, 0xce, 0x3d, 0x04, 0x01, 0x30, 0x45, 0x31,
+                       0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06,
+                       0x13, 0x02, 0x41, 0x55, 0x31, 0x13, 0x30, 0x11,
+                       0x06, 0x03, 0x55, 0x04, 0x08, 0x13, 0x0a, 0x53,
+                       0x6f, 0x6d, 0x65, 0x2d, 0x53, 0x74, 0x61, 0x74,
+                       0x65, 0x31, 0x21, 0x30, 0x1f, 0x06, 0x03, 0x55,
+                       0x04, 0x0a, 0x13, 0x18, 0x49, 0x6e, 0x74, 0x65,
+                       0x72, 0x6e, 0x65, 0x74, 0x20, 0x57, 0x69, 0x64,
+                       0x67, 0x69, 0x74, 0x73, 0x20, 0x50, 0x74, 0x79,
+                       0x20, 0x4c, 0x74, 0x64, 0x30, 0x1e, 0x17, 0x0d,
+                       0x31, 0x32, 0x31, 0x31, 0x31, 0x34, 0x31, 0x33,
+                       0x32, 0x35, 0x35, 0x33, 0x5a, 0x17, 0x0d, 0x32,
+                       0x32, 0x31, 0x31, 0x31, 0x32, 0x31, 0x33, 0x32,
+                       0x35, 0x35, 0x33, 0x5a, 0x30, 0x41, 0x31, 0x0b,
+                       0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13,
+                       0x02, 0x41, 0x55, 0x31, 0x0c, 0x30, 0x0a, 0x06,
+                       0x03, 0x55, 0x04, 0x08, 0x13, 0x03, 0x4e, 0x53,
+                       0x57, 0x31, 0x10, 0x30, 0x0e, 0x06, 0x03, 0x55,
+                       0x04, 0x07, 0x13, 0x07, 0x50, 0x79, 0x72, 0x6d,
+                       0x6f, 0x6e, 0x74, 0x31, 0x12, 0x30, 0x10, 0x06,
+                       0x03, 0x55, 0x04, 0x03, 0x13, 0x09, 0x4a, 0x6f,
+                       0x65, 0x6c, 0x20, 0x53, 0x69, 0x6e, 0x67, 0x30,
+                       0x81, 0x9b, 0x30, 0x10, 0x06, 0x07, 0x2a, 0x86,
+                       0x48, 0xce, 0x3d, 0x02, 0x01, 0x06, 0x05, 0x2b,
+                       0x81, 0x04, 0x00, 0x23, 0x03, 0x81, 0x86, 0x00,
+                       0x04, 0x00, 0x95, 0x8c, 0x91, 0x75, 0x14, 0xc0,
+                       0x5e, 0xc4, 0x57, 0xb4, 0xd4, 0xc3, 0x6f, 0x8d,
+                       0xae, 0x68, 0x1e, 0xdd, 0x6f, 0xce, 0x86, 0xe1,
+                       0x7e, 0x6e, 0xb2, 0x48, 0x3e, 0x81, 0xe5, 0x4e,
+                       0xe2, 0xc6, 0x88, 0x4b, 0x64, 0xdc, 0xf5, 0x30,
+                       0xbb, 0xd3, 0xff, 0x65, 0xcc, 0x5b, 0xf4, 0xdd,
+                       0xb5, 0x6a, 0x3e, 0x3e, 0xd0, 0x1d, 0xde, 0x47,
+                       0xc3, 0x76, 0xad, 0x19, 0xf6, 0x45, 0x2c, 0x8c,
+                       0xbc, 0xd8, 0x1d, 0x01, 0x4c, 0x1f, 0x70, 0x90,
+                       0x46, 0x76, 0x48, 0x8b, 0x8f, 0x83, 0xcc, 0x4a,
+                       0x5c, 0x8f, 0x40, 0x76, 0xda, 0xe0, 0x89, 0xec,
+                       0x1d, 0x2b, 0xc4, 0x4e, 0x30, 0x76, 0x28, 0x41,
+                       0xb2, 0x62, 0xa8, 0xfb, 0x5b, 0xf1, 0xf9, 0x4e,
+                       0x7a, 0x8d, 0xbd, 0x09, 0xb8, 0xae, 0xea, 0x8b,
+                       0x18, 0x27, 0x4f, 0x2e, 0x70, 0xfe, 0x13, 0x96,
+                       0xba, 0xc3, 0xd3, 0x40, 0x16, 0xcd, 0x65, 0x4e,
+                       0xac, 0x11, 0x1e, 0xe6, 0xf1, 0x30, 0x09, 0x06,
+                       0x07, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x04, 0x01,
+                       0x03, 0x81, 0x8c, 0x00, 0x30, 0x81, 0x88, 0x02,
+                       0x42, 0x00, 0xe0, 0x14, 0xc4, 0x60, 0x60, 0x0b,
+                       0x72, 0x68, 0xb0, 0x32, 0x5d, 0x61, 0x4a, 0x02,
+                       0x74, 0x5c, 0xc2, 0x81, 0xb9, 0x16, 0xa8, 0x3f,
+                       0x29, 0xc8, 0x36, 0xc7, 0x81, 0xff, 0x6c, 0xb6,
+                       0x5b, 0xd9, 0x70, 0xf1, 0x38, 0x3b, 0x50, 0x48,
+                       0x28, 0x94, 0xcb, 0x09, 0x1a, 0x52, 0xf1, 0x5d,
+                       0xee, 0x8d, 0xf2, 0xb9, 0xf0, 0xf0, 0xda, 0xd9,
+                       0x15, 0x3a, 0xf9, 0xbd, 0x03, 0x7a, 0x87, 0xa2,
+                       0x23, 0x35, 0xec, 0x02, 0x42, 0x01, 0xa3, 0xd4,
+                       0x8a, 0x78, 0x35, 0x1c, 0x4a, 0x9a, 0x23, 0xd2,
+                       0x0a, 0xbe, 0x2b, 0x10, 0x31, 0x9d, 0x9c, 0x5f,
+                       0xbe, 0xe8, 0x91, 0xb3, 0xda, 0x1a, 0xf5, 0x5d,
+                       0xa3, 0x23, 0xf5, 0x26, 0x8b, 0x45, 0x70, 0x8d,
+                       0x65, 0x62, 0x9b, 0x7e, 0x01, 0x99, 0x3d, 0x18,
+                       0xf6, 0x10, 0x9a, 0x38, 0x61, 0x9b, 0x2e, 0x57,
+                       0xe4, 0xfa, 0xcc, 0xb1, 0x8a, 0xce, 0xe2, 0x23,
+                       0xa0, 0x87, 0xf0, 0xe1, 0x67, 0x51, 0xeb, 0x16,
+                       0x03, 0x01, 0x00, 0x8a, 0x10, 0x00, 0x00, 0x86,
+                       0x85, 0x04, 0x00, 0xcd, 0x1c, 0xe8, 0x66, 0x5b,
+                       0xa8, 0x9d, 0x83, 0x2f, 0x7e, 0x1d, 0x0b, 0x59,
+                       0x23, 0xbc, 0x30, 0xcf, 0xa3, 0xaf, 0x21, 0xdc,
+                       0xf2, 0x57, 0x49, 0x56, 0x30, 0x25, 0x7c, 0x84,
+                       0x5d, 0xad, 0xaa, 0x9c, 0x7b, 0x2a, 0x95, 0x58,
+                       0x3d, 0x30, 0x87, 0x01, 0x3b, 0xb7, 0xea, 0xcb,
+                       0xc4, 0xa3, 0xeb, 0x22, 0xbf, 0x2d, 0x61, 0x17,
+                       0x8c, 0x9b, 0xe8, 0x1b, 0xb2, 0x87, 0x16, 0x78,
+                       0xd5, 0xfd, 0x8b, 0xdd, 0x00, 0x0f, 0xda, 0x8e,
+                       0xfd, 0x28, 0x36, 0xeb, 0xe4, 0xc5, 0x42, 0x14,
+                       0xc7, 0xbd, 0x29, 0x5e, 0x9a, 0xed, 0x5e, 0xc1,
+                       0xf7, 0xf4, 0xbd, 0xbd, 0x15, 0x9c, 0xe8, 0x44,
+                       0x71, 0xa7, 0xb6, 0xe9, 0xfa, 0x7e, 0x97, 0xcb,
+                       0x96, 0x3e, 0x53, 0x76, 0xfb, 0x11, 0x1f, 0x36,
+                       0x8f, 0x30, 0xfb, 0x71, 0x3a, 0x75, 0x3a, 0x25,
+                       0x7b, 0xa2, 0xc1, 0xf9, 0x3e, 0x58, 0x5f, 0x07,
+                       0x16, 0xed, 0xe1, 0xf7, 0xc1, 0xb1, 0x16, 0x03,
+                       0x01, 0x00, 0x90, 0x0f, 0x00, 0x00, 0x8c, 0x00,
+                       0x8a, 0x30, 0x81, 0x87, 0x02, 0x42, 0x00, 0xb2,
+                       0xd3, 0x91, 0xe6, 0xd5, 0x9b, 0xb2, 0xb8, 0x03,
+                       0xf4, 0x85, 0x4d, 0x43, 0x79, 0x1f, 0xb6, 0x6f,
+                       0x0c, 0xcd, 0x67, 0x5f, 0x5e, 0xca, 0xee, 0xb3,
+                       0xe4, 0xab, 0x1e, 0x58, 0xc3, 0x04, 0xa9, 0x8a,
+                       0xa7, 0xcf, 0xaa, 0x33, 0x88, 0xd5, 0x35, 0xd2,
+                       0x80, 0x8f, 0xfa, 0x1b, 0x3c, 0x3d, 0xf7, 0x80,
+                       0x50, 0xde, 0x80, 0x30, 0x64, 0xee, 0xc0, 0xb3,
+                       0x91, 0x6e, 0x5d, 0x1e, 0xc0, 0xdc, 0x3a, 0x93,
+                       0x02, 0x41, 0x4e, 0xca, 0x98, 0x41, 0x8c, 0x36,
+                       0xf2, 0x12, 0xbf, 0x8e, 0x0f, 0x69, 0x8e, 0xf8,
+                       0x7b, 0x9d, 0xba, 0x9c, 0x5c, 0x48, 0x79, 0xf4,
+                       0xba, 0x3d, 0x06, 0xa5, 0xab, 0x47, 0xe0, 0x1a,
+                       0x45, 0x28, 0x3a, 0x8f, 0xbf, 0x14, 0x24, 0x36,
+                       0xd1, 0x1d, 0x29, 0xdc, 0xde, 0x72, 0x5b, 0x76,
+                       0x41, 0x67, 0xe8, 0xe5, 0x71, 0x4a, 0x77, 0xe9,
+                       0xed, 0x02, 0x19, 0xdd, 0xe4, 0xaa, 0xe9, 0x2d,
+                       0xe7, 0x47, 0x32, 0x14, 0x03, 0x01, 0x00, 0x01,
+                       0x01, 0x16, 0x03, 0x01, 0x00, 0x30, 0xfa, 0xc3,
+                       0xf2, 0x35, 0xd0, 0x6d, 0x32, 0x78, 0x6a, 0xd6,
+                       0xe6, 0x70, 0x5e, 0x00, 0x4c, 0x35, 0xf1, 0xe0,
+                       0x21, 0xcf, 0xc3, 0x78, 0xcd, 0xe0, 0x2b, 0x0b,
+                       0xf4, 0xeb, 0xf9, 0xc0, 0x38, 0xf2, 0x9a, 0x31,
+                       0x55, 0x07, 0x2b, 0x8d, 0x68, 0x40, 0x31, 0x08,
+                       0xaa, 0xe3, 0x16, 0xcf, 0x4b, 0xd4,
+               },
+               {
+                       0x16, 0x03, 0x01, 0x02, 0x76, 0x04, 0x00, 0x02,
+                       0x72, 0x00, 0x00, 0x00, 0x00, 0x02, 0x6c, 0x00,
+                       0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                       0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x65,
+                       0xe8, 0x8b, 0xde, 0xef, 0xba, 0xf9, 0xdb, 0x95,
+                       0x24, 0xa5, 0x49, 0xb3, 0x23, 0xd8, 0x73, 0x88,
+                       0x50, 0x42, 0xed, 0xeb, 0xa3, 0xd8, 0xab, 0x31,
+                       0x9c, 0xd0, 0x00, 0x01, 0xef, 0xc0, 0xbf, 0xab,
+                       0x59, 0x55, 0xb5, 0xb9, 0xef, 0xa5, 0xa6, 0xec,
+                       0x69, 0xed, 0x00, 0x2f, 0x47, 0xdb, 0x75, 0x52,
+                       0x0c, 0xe5, 0x86, 0xb7, 0x02, 0x59, 0x22, 0xf7,
+                       0xfd, 0x8b, 0xff, 0xa4, 0x09, 0xc0, 0x1c, 0x10,
+                       0x80, 0x10, 0x7f, 0x4c, 0x7a, 0x94, 0x40, 0x10,
+                       0x0d, 0xda, 0x8a, 0xe5, 0x4a, 0xbc, 0xd0, 0xc0,
+                       0x4b, 0xa5, 0x33, 0x97, 0xc6, 0xe7, 0x40, 0x7f,
+                       0x7f, 0x8c, 0xf9, 0xf8, 0xc8, 0xb8, 0xfb, 0x8c,
+                       0xdd, 0x28, 0x81, 0xae, 0xfd, 0x37, 0x20, 0x3a,
+                       0x40, 0x37, 0x99, 0xc4, 0x21, 0x01, 0xc4, 0x91,
+                       0xb0, 0x5e, 0x11, 0xc5, 0xa9, 0xfd, 0x9a, 0x02,
+                       0x7e, 0x97, 0x6a, 0x86, 0x89, 0xb8, 0xc1, 0x32,
+                       0x4c, 0x7e, 0x6d, 0x47, 0x61, 0x0e, 0xe3, 0xc2,
+                       0xf0, 0x62, 0x3c, 0xc6, 0x71, 0x4f, 0xbb, 0x47,
+                       0x65, 0xb1, 0xd9, 0x22, 0x79, 0x15, 0xea, 0x1f,
+                       0x4b, 0x2a, 0x8a, 0xa4, 0xc8, 0x73, 0x34, 0xba,
+                       0x83, 0xe4, 0x70, 0x99, 0xc9, 0xcf, 0xbe, 0x64,
+                       0x99, 0xb9, 0xfa, 0xe9, 0xaf, 0x5d, 0xc7, 0x20,
+                       0x26, 0xde, 0xc5, 0x06, 0x12, 0x36, 0x4f, 0x4d,
+                       0xc0, 0xbb, 0x81, 0x5b, 0x5e, 0x38, 0xc3, 0x07,
+                       0x21, 0x04, 0x1a, 0x53, 0x9c, 0x59, 0xac, 0x2d,
+                       0xe6, 0xa5, 0x93, 0xa5, 0x19, 0xc6, 0xb0, 0xf7,
+                       0x56, 0x5d, 0xdf, 0xd1, 0xf4, 0xfd, 0x44, 0x6d,
+                       0xc6, 0xa2, 0x31, 0xa7, 0x35, 0x42, 0x18, 0x50,
+                       0x0c, 0x4f, 0x6e, 0xe3, 0x3b, 0xa3, 0xaa, 0x1c,
+                       0xbe, 0x41, 0x0d, 0xce, 0x6c, 0x62, 0xe1, 0x96,
+                       0x2d, 0xbd, 0x14, 0x31, 0xe3, 0xc4, 0x5b, 0xbf,
+                       0xf6, 0xde, 0xec, 0x42, 0xe8, 0xc7, 0x2a, 0x0b,
+                       0xdb, 0x2d, 0x7c, 0xf0, 0x3f, 0x45, 0x32, 0x45,
+                       0x09, 0x47, 0x09, 0x0f, 0x21, 0x22, 0x45, 0x06,
+                       0x11, 0xb8, 0xf9, 0xe6, 0x67, 0x90, 0x4b, 0x4a,
+                       0xde, 0x81, 0xfb, 0xeb, 0xe7, 0x9a, 0x08, 0x30,
+                       0xcf, 0x51, 0xe1, 0xd9, 0xfa, 0x79, 0xa3, 0xcc,
+                       0x65, 0x1a, 0x83, 0x86, 0xc9, 0x7a, 0x41, 0xf5,
+                       0xdf, 0xa0, 0x7c, 0x44, 0x23, 0x17, 0xf3, 0x62,
+                       0xe8, 0xa9, 0x31, 0x1e, 0x6b, 0x05, 0x4b, 0x4f,
+                       0x9d, 0x91, 0x46, 0x92, 0xa6, 0x25, 0x32, 0xca,
+                       0xa1, 0x75, 0xda, 0xe6, 0x80, 0x3e, 0x7f, 0xd1,
+                       0x26, 0x57, 0x07, 0x42, 0xe4, 0x91, 0xff, 0xbd,
+                       0x44, 0xae, 0x98, 0x5c, 0x1d, 0xdf, 0x11, 0xe3,
+                       0xae, 0x87, 0x5e, 0xb7, 0x69, 0xad, 0x34, 0x7f,
+                       0x3a, 0x07, 0x7c, 0xdf, 0xfc, 0x76, 0x17, 0x8b,
+                       0x62, 0xc8, 0xe1, 0x78, 0x2a, 0xc8, 0xb9, 0x8a,
+                       0xbb, 0x5c, 0xfb, 0x38, 0x74, 0x91, 0x6e, 0x12,
+                       0x0c, 0x1f, 0x8e, 0xe1, 0xc2, 0x01, 0xd8, 0x9d,
+                       0x23, 0x0f, 0xc4, 0x67, 0x5d, 0xe5, 0x67, 0x4b,
+                       0x94, 0x6e, 0x69, 0x72, 0x90, 0x2d, 0x52, 0x78,
+                       0x8e, 0x61, 0xba, 0xdf, 0x4e, 0xf5, 0xdc, 0xfb,
+                       0x73, 0xbe, 0x03, 0x70, 0xd9, 0x01, 0x30, 0xf3,
+                       0xa1, 0xbb, 0x9a, 0x5f, 0xec, 0x9e, 0xed, 0x8d,
+                       0xdd, 0x53, 0xfd, 0x60, 0xc3, 0x2b, 0x7a, 0x00,
+                       0x2c, 0xf9, 0x0a, 0x57, 0x47, 0x45, 0x43, 0xb3,
+                       0x23, 0x01, 0x9c, 0xee, 0x54, 0x4d, 0x58, 0xd3,
+                       0x71, 0x1c, 0xc9, 0xd3, 0x30, 0x9e, 0x14, 0xa5,
+                       0xf3, 0xbf, 0x4d, 0x9b, 0xb7, 0x13, 0x21, 0xae,
+                       0xd2, 0x8d, 0x6e, 0x6f, 0x1c, 0xcc, 0xb2, 0x41,
+                       0xb2, 0x64, 0x56, 0x83, 0xce, 0xd1, 0x0c, 0x79,
+                       0x32, 0x78, 0xef, 0xc5, 0x21, 0xb1, 0xe8, 0xc4,
+                       0x42, 0xa7, 0x8d, 0xc1, 0xfa, 0xa1, 0x9c, 0x3c,
+                       0x21, 0xd8, 0xe9, 0x90, 0xe2, 0x7c, 0x14, 0x26,
+                       0xfe, 0x61, 0x3e, 0xf9, 0x71, 0x1d, 0x5d, 0x49,
+                       0x3b, 0xb1, 0xb8, 0x42, 0xa1, 0xb8, 0x1c, 0x75,
+                       0x7d, 0xee, 0xed, 0xfc, 0xe6, 0x20, 0x2b, 0x9e,
+                       0x10, 0x52, 0xda, 0x56, 0x4d, 0x64, 0x6c, 0x41,
+                       0xc1, 0xf7, 0x60, 0x0c, 0x10, 0x65, 0x6f, 0xd4,
+                       0xe9, 0x9b, 0x0d, 0x83, 0x13, 0xc8, 0x5a, 0xa3,
+                       0x56, 0x2a, 0x42, 0xc6, 0x1c, 0xfe, 0xdb, 0xba,
+                       0x3d, 0x04, 0x12, 0xfd, 0x28, 0xeb, 0x78, 0xdd,
+                       0xbc, 0xc8, 0x0d, 0xa1, 0xce, 0xd4, 0x54, 0xbf,
+                       0xaf, 0xe1, 0x60, 0x0c, 0xa3, 0xc3, 0xc3, 0x62,
+                       0x58, 0xc1, 0x79, 0xa7, 0x95, 0x41, 0x09, 0x24,
+                       0xc6, 0x9a, 0x50, 0x14, 0x03, 0x01, 0x00, 0x01,
+                       0x01, 0x16, 0x03, 0x01, 0x00, 0x30, 0x4d, 0x7b,
+                       0x5f, 0x28, 0x5e, 0x68, 0x6c, 0xa3, 0x65, 0xc7,
+                       0x7e, 0x49, 0x6c, 0xb3, 0x67, 0xbb, 0xd0, 0x75,
+                       0xa2, 0x9e, 0x8c, 0x92, 0x4f, 0x8c, 0x33, 0x14,
+                       0x7c, 0x6c, 0xf1, 0x74, 0x97, 0xc3, 0xe0, 0x10,
+                       0xe9, 0x0d, 0xc2, 0x30, 0x5c, 0x23, 0xee, 0x1d,
+                       0x16, 0x2e, 0xb9, 0x96, 0x2b, 0x2d, 0x17, 0x03,
+                       0x01, 0x00, 0x20, 0xf2, 0xc8, 0xa7, 0x1b, 0x60,
+                       0x46, 0xee, 0xe5, 0x7e, 0xc9, 0x35, 0xb3, 0xf1,
+                       0x7c, 0x32, 0x0c, 0x85, 0x94, 0x59, 0x57, 0x27,
+                       0xb0, 0xbd, 0x52, 0x86, 0x90, 0xf1, 0xb7, 0x4d,
+                       0x1e, 0xc1, 0x16, 0x17, 0x03, 0x01, 0x00, 0x30,
+                       0xff, 0x85, 0x50, 0xdf, 0x3f, 0xfc, 0xa2, 0x61,
+                       0x1a, 0x12, 0xc0, 0x1e, 0x10, 0x32, 0x88, 0x50,
+                       0xa0, 0x2c, 0x80, 0xda, 0x77, 0xea, 0x09, 0x47,
+                       0xe0, 0x85, 0x07, 0x29, 0x45, 0x65, 0x19, 0xa3,
+                       0x8d, 0x99, 0xb8, 0xbf, 0xb6, 0xbc, 0x76, 0xe2,
+                       0x50, 0x24, 0x82, 0x0a, 0xfd, 0xdd, 0x35, 0x09,
+                       0x15, 0x03, 0x01, 0x00, 0x20, 0xe7, 0x36, 0xf6,
+                       0x61, 0xd2, 0x95, 0x3c, 0xb6, 0x65, 0x7b, 0xb2,
+                       0xb8, 0xdf, 0x03, 0x53, 0xeb, 0xf7, 0x16, 0xe0,
+                       0xe0, 0x15, 0x22, 0x71, 0x70, 0x62, 0x73, 0xad,
+                       0xb5, 0x1a, 0x77, 0x44, 0x57,
+               },
+       }},
+}

diff --git a/src/pkg/crypto/tls/key_agreement.go b/src/pkg/crypto/tls/key_agreement.go
index c069c079dffa30bd329ac342f95abb248331836b..f6cbcd4febf5a8ca62dba4b7ad7c3a87260aeceb 100644 (file)
--- a/src/pkg/crypto/tls/key_agreement.go
+++ b/src/pkg/crypto/tls/key_agreement.go
@@ -6,12 +6,14 @@ package tls
 
 import (
        "crypto"
+       "crypto/ecdsa"
        "crypto/elliptic"
        "crypto/md5"
        "crypto/rsa"
        "crypto/sha1"
        "crypto/sha256"
        "crypto/x509"
+       "encoding/asn1"
        "errors"
        "io"
        "math/big"
@@ -83,6 +85,15 @@ func (ka rsaKeyAgreement) generateClientKeyExchange(config *Config, clientHello
        return preMasterSecret, ckx, nil
 }
 
+// sha1Hash calculates a SHA1 hash over the given byte slices.
+func sha1Hash(slices [][]byte) []byte {
+       hsha1 := sha1.New()
+       for _, slice := range slices {
+               hsha1.Write(slice)
+       }
+       return hsha1.Sum(nil)
+}
+
 // md5SHA1Hash implements TLS 1.0's hybrid hash function which consists of the
 // concatenation of an MD5 and SHA1 hash.
 func md5SHA1Hash(slices [][]byte) []byte {
@@ -92,12 +103,7 @@ func md5SHA1Hash(slices [][]byte) []byte {
                hmd5.Write(slice)
        }
        copy(md5sha1, hmd5.Sum(nil))
-
-       hsha1 := sha1.New()
-       for _, slice := range slices {
-               hsha1.Write(slice)
-       }
-       copy(md5sha1[md5.Size:], hsha1.Sum(nil))
+       copy(md5sha1[md5.Size:], sha1Hash(slices))
        return md5sha1
 }
 
@@ -112,24 +118,29 @@ func sha256Hash(slices [][]byte) []byte {
 
 // hashForServerKeyExchange hashes the given slices and returns their digest
 // and the identifier of the hash function used.
-func hashForServerKeyExchange(version uint16, slices ...[]byte) ([]byte, crypto.Hash) {
+func hashForServerKeyExchange(sigType uint8, version uint16, slices ...[]byte) ([]byte, crypto.Hash) {
        if version >= VersionTLS12 {
                return sha256Hash(slices), crypto.SHA256
        }
+       if sigType == signatureECDSA {
+               return sha1Hash(slices), crypto.SHA1
+       }
        return md5SHA1Hash(slices), crypto.MD5SHA1
 }
 
 // ecdheRSAKeyAgreement implements a TLS key agreement where the server
 // generates a ephemeral EC public/private key pair and signs it. The
-// pre-master secret is then calculated using ECDH.
-type ecdheRSAKeyAgreement struct {
+// pre-master secret is then calculated using ECDH. The signature may
+// either be ECDSA or RSA.
+type ecdheKeyAgreement struct {
        version    uint16
+       sigType    uint8
        privateKey []byte
        curve      elliptic.Curve
        x, y       *big.Int
 }
 
-func (ka *ecdheRSAKeyAgreement) generateServerKeyExchange(config *Config, cert *Certificate, clientHello *clientHelloMsg, hello *serverHelloMsg) (*serverKeyExchangeMsg, error) {
+func (ka *ecdheKeyAgreement) generateServerKeyExchange(config *Config, cert *Certificate, clientHello *clientHelloMsg, hello *serverHelloMsg) (*serverKeyExchangeMsg, error) {
        var curveid uint16
 
 Curve:
@@ -170,10 +181,30 @@ Curve:
        serverECDHParams[3] = byte(len(ecdhePublic))
        copy(serverECDHParams[4:], ecdhePublic)
 
-       digest, hashFunc := hashForServerKeyExchange(ka.version, clientHello.random, hello.random, serverECDHParams)
-       sig, err := rsa.SignPKCS1v15(config.rand(), cert.PrivateKey.(*rsa.PrivateKey), hashFunc, digest)
-       if err != nil {
-               return nil, errors.New("failed to sign ECDHE parameters: " + err.Error())
+       digest, hashFunc := hashForServerKeyExchange(ka.sigType, ka.version, clientHello.random, hello.random, serverECDHParams)
+       var sig []byte
+       switch ka.sigType {
+       case signatureECDSA:
+               privKey, ok := cert.PrivateKey.(*ecdsa.PrivateKey)
+               if !ok {
+                       return nil, errors.New("ECDHE ECDSA requires an ECDSA server private key")
+               }
+               r, s, err := ecdsa.Sign(config.rand(), privKey, digest)
+               if err != nil {
+                       return nil, errors.New("failed to sign ECDHE parameters: " + err.Error())
+               }
+               sig, err = asn1.Marshal(ecdsaSignature{r, s})
+       case signatureRSA:
+               privKey, ok := cert.PrivateKey.(*rsa.PrivateKey)
+               if !ok {
+                       return nil, errors.New("ECDHE RSA requires a RSA server private key")
+               }
+               sig, err = rsa.SignPKCS1v15(config.rand(), privKey, hashFunc, digest)
+               if err != nil {
+                       return nil, errors.New("failed to sign ECDHE parameters: " + err.Error())
+               }
+       default:
+               return nil, errors.New("unknown ECDHE signature algorithm")
        }
 
        skx := new(serverKeyExchangeMsg)
@@ -186,7 +217,7 @@ Curve:
        k := skx.key[len(serverECDHParams):]
        if ka.version >= VersionTLS12 {
                k[0] = hashSHA256
-               k[1] = signatureRSA
+               k[1] = ka.sigType
                k = k[2:]
        }
        k[0] = byte(len(sig) >> 8)
@@ -196,7 +227,7 @@ Curve:
        return skx, nil
 }
 
-func (ka *ecdheRSAKeyAgreement) processClientKeyExchange(config *Config, cert *Certificate, ckx *clientKeyExchangeMsg, version uint16) ([]byte, error) {
+func (ka *ecdheKeyAgreement) processClientKeyExchange(config *Config, cert *Certificate, ckx *clientKeyExchangeMsg, version uint16) ([]byte, error) {
        if len(ckx.ciphertext) == 0 || int(ckx.ciphertext[0]) != len(ckx.ciphertext)-1 {
                return nil, errors.New("bad ClientKeyExchange")
        }
@@ -214,7 +245,7 @@ func (ka *ecdheRSAKeyAgreement) processClientKeyExchange(config *Config, cert *C
 
 var errServerKeyExchange = errors.New("invalid ServerKeyExchange")
 
-func (ka *ecdheRSAKeyAgreement) processServerKeyExchange(config *Config, clientHello *clientHelloMsg, serverHello *serverHelloMsg, cert *x509.Certificate, skx *serverKeyExchangeMsg) error {
+func (ka *ecdheKeyAgreement) processServerKeyExchange(config *Config, clientHello *clientHelloMsg, serverHello *serverHelloMsg, cert *x509.Certificate, skx *serverKeyExchangeMsg) error {
        if len(skx.key) < 4 {
                return errServerKeyExchange
        }
@@ -261,11 +292,39 @@ func (ka *ecdheRSAKeyAgreement) processServerKeyExchange(config *Config, clientH
        }
        sig = sig[2:]
 
-       digest, hashFunc := hashForServerKeyExchange(ka.version, clientHello.random, serverHello.random, serverECDHParams)
-       return rsa.VerifyPKCS1v15(cert.PublicKey.(*rsa.PublicKey), hashFunc, digest, sig)
+       digest, hashFunc := hashForServerKeyExchange(ka.sigType, ka.version, clientHello.random, serverHello.random, serverECDHParams)
+       switch ka.sigType {
+       case signatureECDSA:
+               pubKey, ok := cert.PublicKey.(*ecdsa.PublicKey)
+               if !ok {
+                       return errors.New("ECDHE ECDSA requires a ECDSA server public key")
+               }
+               ecdsaSig := new(ecdsaSignature)
+               if _, err := asn1.Unmarshal(sig, ecdsaSig); err != nil {
+                       return err
+               }
+               if ecdsaSig.R.Sign() <= 0 || ecdsaSig.S.Sign() <= 0 {
+                       return errors.New("ECDSA signature contained zero or negative values")
+               }
+               if !ecdsa.Verify(pubKey, digest, ecdsaSig.R, ecdsaSig.S) {
+                       return errors.New("ECDSA verification failure")
+               }
+       case signatureRSA:
+               pubKey, ok := cert.PublicKey.(*rsa.PublicKey)
+               if !ok {
+                       return errors.New("ECDHE RSA requires a RSA server public key")
+               }
+               if err := rsa.VerifyPKCS1v15(pubKey, hashFunc, digest, sig); err != nil {
+                       return err
+               }
+       default:
+               return errors.New("unknown ECDHE signature algorithm")
+       }
+
+       return nil
 }
 
-func (ka *ecdheRSAKeyAgreement) generateClientKeyExchange(config *Config, clientHello *clientHelloMsg, cert *x509.Certificate) ([]byte, *clientKeyExchangeMsg, error) {
+func (ka *ecdheKeyAgreement) generateClientKeyExchange(config *Config, clientHello *clientHelloMsg, cert *x509.Certificate) ([]byte, *clientKeyExchangeMsg, error) {
        if ka.curve == nil {
                return nil, nil, errors.New("missing ServerKeyExchange message")
        }

diff --git a/src/pkg/crypto/tls/prf.go b/src/pkg/crypto/tls/prf.go
index 662b2a1d5c05457fe96a39f71f7f48364e451ef6..b32a75704dcca0acf443911061473d8958339a5d 100644 (file)
--- a/src/pkg/crypto/tls/prf.go
+++ b/src/pkg/crypto/tls/prf.go
@@ -274,11 +274,15 @@ func (h finishedHash) serverSum(masterSecret []byte) []byte {
 
 // hashForClientCertificate returns a digest and hash function identifier
 // suitable for signing by a TLS client certificate.
-func (h finishedHash) hashForClientCertificate() ([]byte, crypto.Hash) {
+func (h finishedHash) hashForClientCertificate(sigType uint8) ([]byte, crypto.Hash) {
        if h.version >= VersionTLS12 {
                digest := h.server.Sum(nil)
                return digest, crypto.SHA256
        }
+       if sigType == signatureECDSA {
+               digest := h.server.Sum(nil)
+               return digest, crypto.SHA1
+       }
 
        digest := make([]byte, 0, 36)
        digest = h.serverMD5.Sum(digest)