agora inbox for [email protected]
help / color / mirror / Atom feed[PATCH v3 1/2] Rationalize ltree input errors
16+ messages / 9 participants
[nested] [flat]
* [PATCH v3 1/2] Rationalize ltree input errors
@ 2020-03-30 21:13 Nikita Glukhov <[email protected]>
0 siblings, 0 replies; 16+ messages in thread
From: Nikita Glukhov @ 2020-03-30 21:13 UTC (permalink / raw)
---
contrib/ltree/expected/ltree.out | 13 ++-
contrib/ltree/ltree_io.c | 99 ++++++++++++----------
contrib/ltree/sql/ltree.sql | 1 +
contrib/ltree_plpython/expected/ltree_plpython.out | 2 +-
4 files changed, 63 insertions(+), 52 deletions(-)
diff --git a/contrib/ltree/expected/ltree.out b/contrib/ltree/expected/ltree.out
index c78d372..610cb6f 100644
--- a/contrib/ltree/expected/ltree.out
+++ b/contrib/ltree/expected/ltree.out
@@ -464,7 +464,7 @@ SELECT nlevel(('1' || repeat('.1', 65534))::ltree);
(1 row)
SELECT nlevel(('1' || repeat('.1', 65535))::ltree);
-ERROR: number of ltree levels (65536) exceeds the maximum allowed (65535)
+ERROR: number of ltree labels (65536) exceeds the maximum allowed (65535)
SELECT nlevel(('1' || repeat('.1', 65534))::ltree || '1');
ERROR: number of ltree levels (65536) exceeds the maximum allowed (65535)
SELECT ('1' || repeat('.1', 65534))::lquery IS NULL;
@@ -474,7 +474,7 @@ SELECT ('1' || repeat('.1', 65534))::lquery IS NULL;
(1 row)
SELECT ('1' || repeat('.1', 65535))::lquery IS NULL;
-ERROR: number of lquery levels (65536) exceeds the maximum allowed (65535)
+ERROR: number of lquery items (65536) exceeds the maximum allowed (65535)
SELECT '*{65535}'::lquery;
lquery
----------
@@ -485,7 +485,7 @@ SELECT '*{65536}'::lquery;
ERROR: lquery syntax error
LINE 1: SELECT '*{65536}'::lquery;
^
-DETAIL: Low limit (65536) exceeds the maximum allowed (65535).
+DETAIL: Low limit (65536) exceeds the maximum allowed (65535), at character 3.
SELECT '*{,65534}'::lquery;
lquery
-----------
@@ -502,7 +502,12 @@ SELECT '*{,65536}'::lquery;
ERROR: lquery syntax error
LINE 1: SELECT '*{,65536}'::lquery;
^
-DETAIL: High limit (65536) exceeds the maximum allowed (65535).
+DETAIL: High limit (65536) exceeds the maximum allowed (65535), at character 4.
+SELECT '*{4,3}'::lquery;
+ERROR: lquery syntax error
+LINE 1: SELECT '*{4,3}'::lquery;
+ ^
+DETAIL: Low limit (4) is greater than high limit (3), at character 5.
SELECT '1.2'::ltree < '2.2'::ltree;
?column?
----------
diff --git a/contrib/ltree/ltree_io.c b/contrib/ltree/ltree_io.c
index 2503d47..e806a14 100644
--- a/contrib/ltree/ltree_io.c
+++ b/contrib/ltree/ltree_io.c
@@ -17,12 +17,6 @@ PG_FUNCTION_INFO_V1(lquery_in);
PG_FUNCTION_INFO_V1(lquery_out);
-#define UNCHAR ereport(ERROR, \
- (errcode(ERRCODE_SYNTAX_ERROR), \
- errmsg("syntax error at position %d", \
- pos)));
-
-
typedef struct
{
char *start;
@@ -47,7 +41,12 @@ ltree_in(PG_FUNCTION_ARGS)
ltree *result;
ltree_level *curlevel;
int charlen;
- int pos = 0;
+ int pos = 1; /* character position for error messages */
+
+#define UNCHAR ereport(ERROR, \
+ errcode(ERRCODE_SYNTAX_ERROR), \
+ errmsg("ltree syntax error at character %d", \
+ pos))
ptr = buf;
while (*ptr)
@@ -61,7 +60,7 @@ ltree_in(PG_FUNCTION_ARGS)
if (num + 1 > LTREE_MAX_LEVELS)
ereport(ERROR,
(errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
- errmsg("number of ltree levels (%d) exceeds the maximum allowed (%d)",
+ errmsg("number of ltree labels (%d) exceeds the maximum allowed (%d)",
num + 1, LTREE_MAX_LEVELS)));
list = lptr = (nodeitem *) palloc(sizeof(nodeitem) * (num + 1));
ptr = buf;
@@ -88,10 +87,10 @@ ltree_in(PG_FUNCTION_ARGS)
if (lptr->wlen > LTREE_LABEL_MAX_CHARS)
ereport(ERROR,
(errcode(ERRCODE_NAME_TOO_LONG),
- errmsg("name of level is too long"),
- errdetail("Name length is %d, must "
- "be < 256, in position %d.",
- lptr->wlen, pos)));
+ errmsg("label string is too long"),
+ errdetail("Label length is %d, must be at most %d, at character %d.",
+ lptr->wlen, LTREE_LABEL_MAX_CHARS,
+ pos)));
totallen += MAXALIGN(lptr->len + LEVEL_HDRSIZE);
lptr++;
@@ -115,10 +114,9 @@ ltree_in(PG_FUNCTION_ARGS)
if (lptr->wlen > LTREE_LABEL_MAX_CHARS)
ereport(ERROR,
(errcode(ERRCODE_NAME_TOO_LONG),
- errmsg("name of level is too long"),
- errdetail("Name length is %d, must "
- "be < 256, in position %d.",
- lptr->wlen, pos)));
+ errmsg("label string is too long"),
+ errdetail("Label length is %d, must be at most %d, at character %d.",
+ lptr->wlen, LTREE_LABEL_MAX_CHARS, pos)));
totallen += MAXALIGN(lptr->len + LEVEL_HDRSIZE);
lptr++;
@@ -126,8 +124,8 @@ ltree_in(PG_FUNCTION_ARGS)
else if (!(state == LTPRS_WAITNAME && lptr == list))
ereport(ERROR,
(errcode(ERRCODE_SYNTAX_ERROR),
- errmsg("syntax error"),
- errdetail("Unexpected end of line.")));
+ errmsg("ltree syntax error"),
+ errdetail("Unexpected end of input.")));
result = (ltree *) palloc0(LTREE_HDRSIZE + totallen);
SET_VARSIZE(result, LTREE_HDRSIZE + totallen);
@@ -144,6 +142,8 @@ ltree_in(PG_FUNCTION_ARGS)
pfree(list);
PG_RETURN_POINTER(result);
+
+#undef UNCHAR
}
Datum
@@ -208,7 +208,12 @@ lquery_in(PG_FUNCTION_ARGS)
bool hasnot = false;
bool wasbad = false;
int charlen;
- int pos = 0;
+ int pos = 1; /* character position for error messages */
+
+#define UNCHAR ereport(ERROR, \
+ errcode(ERRCODE_SYNTAX_ERROR), \
+ errmsg("lquery syntax error at character %d", \
+ pos))
ptr = buf;
while (*ptr)
@@ -230,7 +235,7 @@ lquery_in(PG_FUNCTION_ARGS)
if (num > LQUERY_MAX_LEVELS)
ereport(ERROR,
(errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
- errmsg("number of lquery levels (%d) exceeds the maximum allowed (%d)",
+ errmsg("number of lquery items (%d) exceeds the maximum allowed (%d)",
num, LQUERY_MAX_LEVELS)));
curqlevel = tmpql = (lquery_level *) palloc0(ITEMSIZE * num);
ptr = buf;
@@ -305,10 +310,10 @@ lquery_in(PG_FUNCTION_ARGS)
if (lptr->wlen > LTREE_LABEL_MAX_CHARS)
ereport(ERROR,
(errcode(ERRCODE_NAME_TOO_LONG),
- errmsg("name of level is too long"),
- errdetail("Name length is %d, must "
- "be < 256, in position %d.",
- lptr->wlen, pos)));
+ errmsg("label string is too long"),
+ errdetail("Label length is %d, must be at most %d, at character %d.",
+ lptr->wlen, LTREE_LABEL_MAX_CHARS,
+ pos)));
state = LQPRS_WAITVAR;
}
@@ -321,10 +326,10 @@ lquery_in(PG_FUNCTION_ARGS)
if (lptr->wlen > LTREE_LABEL_MAX_CHARS)
ereport(ERROR,
(errcode(ERRCODE_NAME_TOO_LONG),
- errmsg("name of level is too long"),
- errdetail("Name length is %d, must "
- "be < 256, in position %d.",
- lptr->wlen, pos)));
+ errmsg("label string is too long"),
+ errdetail("Label length is %d, must be at most %d, at character %d.",
+ lptr->wlen, LTREE_LABEL_MAX_CHARS,
+ pos)));
state = LQPRS_WAITLEVEL;
curqlevel = NEXTLEV(curqlevel);
@@ -361,10 +366,10 @@ lquery_in(PG_FUNCTION_ARGS)
if (low < 0 || low > LTREE_MAX_LEVELS)
ereport(ERROR,
- (errcode(ERRCODE_SYNTAX_ERROR),
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
errmsg("lquery syntax error"),
- errdetail("Low limit (%d) exceeds the maximum allowed (%d).",
- low, LTREE_MAX_LEVELS)));
+ errdetail("Low limit (%d) exceeds the maximum allowed (%d), at character %d.",
+ low, LTREE_MAX_LEVELS, pos)));
curqlevel->low = (uint16) low;
state = LQPRS_WAITND;
@@ -380,10 +385,16 @@ lquery_in(PG_FUNCTION_ARGS)
if (high < 0 || high > LTREE_MAX_LEVELS)
ereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("lquery syntax error"),
+ errdetail("High limit (%d) exceeds the maximum allowed (%d), at character %d.",
+ high, LTREE_MAX_LEVELS, pos)));
+ else if (curqlevel->low > high)
+ ereport(ERROR,
(errcode(ERRCODE_SYNTAX_ERROR),
errmsg("lquery syntax error"),
- errdetail("High limit (%d) exceeds the maximum allowed (%d).",
- high, LTREE_MAX_LEVELS)));
+ errdetail("Low limit (%d) is greater than high limit (%d), at character %d.",
+ curqlevel->low, high, pos)));
curqlevel->high = (uint16) high;
state = LQPRS_WAITCLOSE;
@@ -441,7 +452,7 @@ lquery_in(PG_FUNCTION_ARGS)
ereport(ERROR,
(errcode(ERRCODE_SYNTAX_ERROR),
errmsg("lquery syntax error"),
- errdetail("Unexpected end of line.")));
+ errdetail("Unexpected end of input.")));
lptr->len = ptr - lptr->start -
((lptr->flag & LVAR_SUBLEXEME) ? 1 : 0) -
@@ -451,15 +462,14 @@ lquery_in(PG_FUNCTION_ARGS)
ereport(ERROR,
(errcode(ERRCODE_SYNTAX_ERROR),
errmsg("lquery syntax error"),
- errdetail("Unexpected end of line.")));
+ errdetail("Unexpected end of input.")));
if (lptr->wlen > LTREE_LABEL_MAX_CHARS)
ereport(ERROR,
(errcode(ERRCODE_NAME_TOO_LONG),
- errmsg("name of level is too long"),
- errdetail("Name length is %d, must "
- "be < 256, in position %d.",
- lptr->wlen, pos)));
+ errmsg("label string is too long"),
+ errdetail("Label length is %d, must be at most %d, at character %d.",
+ lptr->wlen, LTREE_LABEL_MAX_CHARS, pos)));
}
else if (state == LQPRS_WAITOPEN)
curqlevel->high = LTREE_MAX_LEVELS;
@@ -467,7 +477,7 @@ lquery_in(PG_FUNCTION_ARGS)
ereport(ERROR,
(errcode(ERRCODE_SYNTAX_ERROR),
errmsg("lquery syntax error"),
- errdetail("Unexpected end of line.")));
+ errdetail("Unexpected end of input.")));
curqlevel = tmpql;
totallen = LQUERY_HDRSIZE;
@@ -483,13 +493,6 @@ lquery_in(PG_FUNCTION_ARGS)
lptr++;
}
}
- else if (curqlevel->low > curqlevel->high)
- ereport(ERROR,
- (errcode(ERRCODE_SYNTAX_ERROR),
- errmsg("lquery syntax error"),
- errdetail("Low limit (%d) is greater than upper (%d).",
- curqlevel->low, curqlevel->high)));
-
curqlevel = NEXTLEV(curqlevel);
}
@@ -543,6 +546,8 @@ lquery_in(PG_FUNCTION_ARGS)
pfree(tmpql);
PG_RETURN_POINTER(result);
+
+#undef UNCHAR
}
Datum
diff --git a/contrib/ltree/sql/ltree.sql b/contrib/ltree/sql/ltree.sql
index d8489cb..f6d73b8 100644
--- a/contrib/ltree/sql/ltree.sql
+++ b/contrib/ltree/sql/ltree.sql
@@ -100,6 +100,7 @@ SELECT '*{65536}'::lquery;
SELECT '*{,65534}'::lquery;
SELECT '*{,65535}'::lquery;
SELECT '*{,65536}'::lquery;
+SELECT '*{4,3}'::lquery;
SELECT '1.2'::ltree < '2.2'::ltree;
SELECT '1.2'::ltree <= '2.2'::ltree;
diff --git a/contrib/ltree_plpython/expected/ltree_plpython.out b/contrib/ltree_plpython/expected/ltree_plpython.out
index 4779755..f28897f 100644
--- a/contrib/ltree_plpython/expected/ltree_plpython.out
+++ b/contrib/ltree_plpython/expected/ltree_plpython.out
@@ -38,6 +38,6 @@ $$;
-- because it will try to parse the Python list as an ltree input
-- string.
SELECT test2();
-ERROR: syntax error at position 0
+ERROR: ltree syntax error at character 1
CONTEXT: while creating return value
PL/Python function "test2"
--
2.7.4
--------------E752CF93D38C192C71B3597A
Content-Type: text/x-patch;
name="0002-ltree-not-fixes-and-better-quantifiers-3.patch"
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
filename*0="0002-ltree-not-fixes-and-better-quantifiers-3.patch"
^ permalink raw reply [nested|flat] 16+ messages in thread
* [PATCH v5 1/2] Set fixed dates for test certificates validity
@ 2023-07-13 15:44 Daniel Gustafsson <[email protected]>
0 siblings, 0 replies; 16+ messages in thread
From: Daniel Gustafsson @ 2023-07-13 15:44 UTC (permalink / raw)
Rather than specifying a validity of 10 000 days into the future
for test certificate generation, this hardcodes the notBefore and
notAfter attributes to set values. This will allow writing tests
which will not depend on when the certificates were generated. An
upcoming patch for adding notBefore and notAfter to pg_stat_ssl
and sslinfo requires this.
Discussion: https://postgr.es/m/[email protected]
---
src/test/ssl/conf/cas.config | 5 +-
src/test/ssl/ssl/both-cas-1.crt | 70 ++++++++++---------
src/test/ssl/ssl/both-cas-2.crt | 70 ++++++++++---------
src/test/ssl/ssl/client+client_ca.crt | 65 +++++++++--------
src/test/ssl/ssl/client-crldir/9bb9e3c3.r0 | 20 +++---
src/test/ssl/ssl/client-dn.crt | 32 ++++-----
src/test/ssl/ssl/client-long.crt | 34 ++++-----
src/test/ssl/ssl/client-revoked-utf8.crt | 30 ++++----
src/test/ssl/ssl/client-revoked.crt | 30 ++++----
src/test/ssl/ssl/client.crl | 20 +++---
src/test/ssl/ssl/client.crt | 30 ++++----
src/test/ssl/ssl/client_ca.crt | 35 +++++-----
src/test/ssl/ssl/client_ext.crt | 33 +++++----
.../ssl/ssl/root+client-crldir/9bb9e3c3.r0 | 20 +++---
src/test/ssl/ssl/root+client.crl | 20 +++---
src/test/ssl/ssl/root+client_ca.crt | 35 +++++-----
.../ssl/ssl/root+server-crldir/a836cc2d.r0 | 18 ++---
src/test/ssl/ssl/root+server.crl | 18 ++---
src/test/ssl/ssl/root+server_ca.crt | 35 +++++-----
src/test/ssl/ssl/server-cn-and-alt-names.crt | 36 +++++-----
.../ssl/ssl/server-cn-and-ip-alt-names.crt | 35 +++++-----
src/test/ssl/ssl/server-cn-only+server_ca.crt | 67 +++++++++---------
src/test/ssl/ssl/server-cn-only.crt | 32 ++++-----
src/test/ssl/ssl/server-crldir/a836cc2d.r0 | 18 ++---
src/test/ssl/ssl/server-ip-alt-names.crt | 33 ++++-----
.../ssl/ssl/server-ip-cn-and-alt-names.crt | 34 ++++-----
.../ssl/server-ip-cn-and-dns-alt-names.crt | 35 +++++-----
src/test/ssl/ssl/server-ip-cn-only.crt | 30 ++++----
src/test/ssl/ssl/server-ip-in-dnsname.crt | 32 +++++----
.../ssl/ssl/server-multiple-alt-names.crt | 36 +++++-----
src/test/ssl/ssl/server-no-names.crt | 30 ++++----
src/test/ssl/ssl/server-revoked.crt | 32 ++++-----
src/test/ssl/ssl/server-single-alt-name.crt | 33 ++++-----
src/test/ssl/ssl/server.crl | 18 ++---
src/test/ssl/ssl/server_ca.crt | 35 +++++-----
35 files changed, 600 insertions(+), 556 deletions(-)
diff --git a/src/test/ssl/conf/cas.config b/src/test/ssl/conf/cas.config
index 2c4851033a..43bcf739bb 100644
--- a/src/test/ssl/conf/cas.config
+++ b/src/test/ssl/conf/cas.config
@@ -38,7 +38,10 @@ crl = ./ssl/server.crl
dir = ./ssl/
database = ./ssl/client_ca-certindex
default_md = sha256
-default_days= 10000
+# Startdate and enddate are required for testing notBefore/notAfter with
+# stable timestamps.
+default_startdate = 20230629010101Z
+default_enddate = 20500101010101Z
default_crl_days= 10000
certificate = ./ssl/client_ca.crt
private_key = ./ssl/client_ca.key
diff --git a/src/test/ssl/ssl/both-cas-1.crt b/src/test/ssl/ssl/both-cas-1.crt
index 4f4bc707d6..1584b4ba0e 100644
--- a/src/test/ssl/ssl/both-cas-1.crt
+++ b/src/test/ssl/ssl/both-cas-1.crt
@@ -18,40 +18,46 @@ OCZhKLxVZiZmO71BBwsTgwtU58/G9e2ciGGdltI8ANlmVfdtwgRz3b7H9EUZat6s
kubl/m5HWBsKJEWEzFWrWkQV3ipoTmorJ6KCGABBCeVYmg==
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
-MIIDFDCCAfygAwIBAgIIICEDAxQSBwEwDQYJKoZIhvcNAQELBQAwQDE+MDwGA1UE
+MIIDnjCCAoagAwIBAgIIICMHExY1IwEwDQYJKoZIhvcNAQELBQAwQDE+MDwGA1UE
Aww1VGVzdCByb290IENBIGZvciBQb3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRl
-c3Qgc3VpdGUwHhcNMjEwMzAzMjIxMjA3WhcNNDgwNzE5MjIxMjA3WjBCMUAwPgYD
-VQQDDDdUZXN0IENBIGZvciBQb3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRlc3Qg
-Y2xpZW50IGNlcnRzMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu+ce
-8rkNfoCvI9Wjug9pxsptsdjhZ4s7ZZ8eD5VlloryK2JccusQIX61XY8I3OZjLTgq
-1SpZbHQvktRH6gmU7tfoBdEnRuXB7idkbYOKIrC0hdttb/5rDzjQGtXTmwoVrCcJ
-nvO1Whay/gdsoqX1tT1MTPWu/6dfQkQXA0PizVvmBasAEQchxqtcH2rSc6TPE13v
-lxJ0X1vSlz92uT6kenrxUDs43AH/kASdIQBHXVA4XWBAm7NRqwKX7BBwbsF2m3Qh
-+NY9Bf9MnJHLcnVnwZdlW5nd7H7BTB43XvkiYascqusYki+fY58eGSprZ/VUjmGx
-pgQnQXWCu0U3JyUL/QIDAQABoxAwDjAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEB
-CwUAA4IBAQC1syY2Rk02m5PGtfkMUIU7ZSe0mM+g0BgWAyCF/mFFYdfY0xHtqy0x
-QWkW9OR0KBl4JpphDDolHoNL3TLydH3t4inX8SAOpaUdsjMcIPKqjT1htQm0Pk5r
-vFYvKuVrxMnV0F+wMmZRuziKWrZlVDwBMfCAchzuVexDWfcjTmUQmhZxJuUzORw3
-swgh9HIpxjMkgdlHodbMAEpMIkkoeJnph3I9uTocXZbK/lAInggQdm0Q+on1ZT0A
-ljO/6jisDZzIguE4ZAQ2DfYsGI8H3tz/+76uIwwBNOmu0woUDSWXVcPWiviq49Bi
-GmH0KlUfWAphj86IfTWXT1HRay3eZQt3
+c3Qgc3VpdGUwIBcNMjMwNzEzMTQzNTIzWhgPMjA1MDExMjgxNDM1MjNaMEIxQDA+
+BgNVBAMMN1Rlc3QgQ0EgZm9yIFBvc3RncmVTUUwgU1NMIHJlZ3Jlc3Npb24gdGVz
+dCBjbGllbnQgY2VydHMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC7
+5x7yuQ1+gK8j1aO6D2nGym2x2OFniztlnx4PlWWWivIrYlxy6xAhfrVdjwjc5mMt
+OCrVKllsdC+S1EfqCZTu1+gF0SdG5cHuJ2Rtg4oisLSF221v/msPONAa1dObChWs
+Jwme87VaFrL+B2yipfW1PUxM9a7/p19CRBcDQ+LNW+YFqwARByHGq1wfatJzpM8T
+Xe+XEnRfW9KXP3a5PqR6evFQOzjcAf+QBJ0hAEddUDhdYECbs1GrApfsEHBuwXab
+dCH41j0F/0yckctydWfBl2Vbmd3sfsFMHjde+SJhqxyq6xiSL59jnx4ZKmtn9VSO
+YbGmBCdBdYK7RTcnJQv9AgMBAAGjgZcwgZQwDAYDVR0TBAUwAwEB/zAdBgNVHQ4E
+FgQUn6Tr0smZ3rADsDA0IoFhFUu9rTYwZQYDVR0jBF4wXKFEpEIwQDE+MDwGA1UE
+Aww1VGVzdCByb290IENBIGZvciBQb3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRl
+c3Qgc3VpdGWCFBfnvJQgNLw9MyrcSA1T3Q2PyJIFMA0GCSqGSIb3DQEBCwUAA4IB
+AQAbYUfwGvV4u5Gpbhv5yxdueC0faKVIEXYRnT4Dky01cV7pGkFSFndlA2mFsj1g
+uuzkTFPMedcBefMoq2o2eX2B4ogrFHovxELI82i9pbv/MmsGNYwbMsp2lnUhNWon
+QwxFqMGA5Y2p8vyEG7lrHKiFDdt7uPxcOeTiWo0ZpC8uThqiR4fUkPinQ3EHEFGQ
++zl+G3pb4VRUzsyqh2n9swudqQcwjsDlQlkQ2vzVb6IWWiUCwL3V7HGPGmlVbsFG
+nQ1M44aBtWbBQtubfBRwYb5r+4sRN94LST6Phmhnd/AJccIKdCaheq+yLVVGiCJN
+3nDTmgTVSSmOm/RRmSXNp7AH
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
-MIIDFDCCAfygAwIBAgIIICEDAxQSBwAwDQYJKoZIhvcNAQELBQAwQDE+MDwGA1UE
+MIIDnjCCAoagAwIBAgIIICMHExY1IwAwDQYJKoZIhvcNAQELBQAwQDE+MDwGA1UE
+Aww1VGVzdCByb290IENBIGZvciBQb3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRl
+c3Qgc3VpdGUwIBcNMjMwNzEzMTQzNTIzWhgPMjA1MDExMjgxNDM1MjNaMEIxQDA+
+BgNVBAMMN1Rlc3QgQ0EgZm9yIFBvc3RncmVTUUwgU1NMIHJlZ3Jlc3Npb24gdGVz
+dCBzZXJ2ZXIgY2VydHMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDi
+SnYZbmc9vpCtKu1sKV9l663JCceubhMw8Gg16kV0hXEFf/TgGC4zkiYNHN7+G45Y
+D7Nq0kBCq3dHt2wPCc6c8pQoI64dfprVqPkvzoe1WBpZNetkUTk20v08jNeRa7Xd
+RbRR6we1s9VG/prp8Hs2mmHqEfLuI9lvTT0Dz+VMmfFI8Lf278r+w+qOtVloAkX7
+AOyoLEJlNS0BQW9YWdH9N5ctaUXMG6lLV2OAjs+W1smpKfpIpMCA1lPGlElu70hy
+non/nQQvBP77SfQpZVc0esM18jkZpr5LEKUCw+x6LaMsqmBHpAULfCffxn2r0uMB
+W4L4VaGg3W6Fh6iuJwRfAgMBAAGjgZcwgZQwDAYDVR0TBAUwAwEB/zAdBgNVHQ4E
+FgQU8o86ZkBQZEgi1y6C/1aewrPudAowZQYDVR0jBF4wXKFEpEIwQDE+MDwGA1UE
Aww1VGVzdCByb290IENBIGZvciBQb3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRl
-c3Qgc3VpdGUwHhcNMjEwMzAzMjIxMjA3WhcNNDgwNzE5MjIxMjA3WjBCMUAwPgYD
-VQQDDDdUZXN0IENBIGZvciBQb3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRlc3Qg
-c2VydmVyIGNlcnRzMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4kp2
-GW5nPb6QrSrtbClfZeutyQnHrm4TMPBoNepFdIVxBX/04BguM5ImDRze/huOWA+z
-atJAQqt3R7dsDwnOnPKUKCOuHX6a1aj5L86HtVgaWTXrZFE5NtL9PIzXkWu13UW0
-UesHtbPVRv6a6fB7Npph6hHy7iPZb009A8/lTJnxSPC39u/K/sPqjrVZaAJF+wDs
-qCxCZTUtAUFvWFnR/TeXLWlFzBupS1djgI7PltbJqSn6SKTAgNZTxpRJbu9Icp6J
-/50ELwT++0n0KWVXNHrDNfI5Gaa+SxClAsPsei2jLKpgR6QFC3wn38Z9q9LjAVuC
-+FWhoN1uhYeoricEXwIDAQABoxAwDjAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEB
-CwUAA4IBAQCdCA/EoXrustoV4jJGbkdXDuOUkBurwggSNBAqUBSDvCohRoD77Ecb
-QVuzPNxWKG+E4PwfUq2ha+2yPONEJ28ZgsbHq5qlJDMJ43wlcjn6wmmAJNeSpO8F
-0V9d2X/4wNZty9/zbwTnw26KChgDHumQ0WIbCoBtdqy8KDswYOvpgws6dqc021I7
-UrFo6vZek7VoApbJgkDL6qYADa6ApfW43ThH4sViFITeYt/kSHgmy2Udhs34jMM8
-xsFP/uYpRi1b1glenwSIKiHjD4/C9vnWQt5K3gRBvYukEj2Bw9VkNRpBVCi0cOoA
-OuwX3bwzNYNbZQv4K66oRpvuoEjCNeHg
+c3Qgc3VpdGWCFBfnvJQgNLw9MyrcSA1T3Q2PyJIFMA0GCSqGSIb3DQEBCwUAA4IB
+AQANlEDrM357a7o+WcKB0Ocll2UtBMq7PDms1Pjqm3fFu/wdKDUomG8W2/MgDmFl
+CVeAPpofb6J0oaxiEZOR68pOhdccMznArtKix6t3RkDiXdm4d5UORMMR+s9CymXV
+MUTWpQpAg3qP3mRI+3E9OrgfhvmVcuOa7/cdTS/sylGe8Db+nJQD0be9NHtnhO56
+IA+Li+8oWzD4UNsP3gAmhLkyToz5wlPHzEkgGxkEySNErEOKTOX5Xyk5z+QToRhz
+adkt0mBw/dxoJk9DveCtIqxDelxJsDeJFtqoc5qVVE9yOp7rujGsqgWl2PcJeyKM
+Crh9qsqNzJ2R29pq0g6Lfzh2
-----END CERTIFICATE-----
diff --git a/src/test/ssl/ssl/both-cas-2.crt b/src/test/ssl/ssl/both-cas-2.crt
index 01d0c4d6a4..674d8e6a7e 100644
--- a/src/test/ssl/ssl/both-cas-2.crt
+++ b/src/test/ssl/ssl/both-cas-2.crt
@@ -18,40 +18,46 @@ OCZhKLxVZiZmO71BBwsTgwtU58/G9e2ciGGdltI8ANlmVfdtwgRz3b7H9EUZat6s
kubl/m5HWBsKJEWEzFWrWkQV3ipoTmorJ6KCGABBCeVYmg==
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
-MIIDFDCCAfygAwIBAgIIICEDAxQSBwAwDQYJKoZIhvcNAQELBQAwQDE+MDwGA1UE
+MIIDnjCCAoagAwIBAgIIICMHExY1IwAwDQYJKoZIhvcNAQELBQAwQDE+MDwGA1UE
Aww1VGVzdCByb290IENBIGZvciBQb3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRl
-c3Qgc3VpdGUwHhcNMjEwMzAzMjIxMjA3WhcNNDgwNzE5MjIxMjA3WjBCMUAwPgYD
-VQQDDDdUZXN0IENBIGZvciBQb3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRlc3Qg
-c2VydmVyIGNlcnRzMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4kp2
-GW5nPb6QrSrtbClfZeutyQnHrm4TMPBoNepFdIVxBX/04BguM5ImDRze/huOWA+z
-atJAQqt3R7dsDwnOnPKUKCOuHX6a1aj5L86HtVgaWTXrZFE5NtL9PIzXkWu13UW0
-UesHtbPVRv6a6fB7Npph6hHy7iPZb009A8/lTJnxSPC39u/K/sPqjrVZaAJF+wDs
-qCxCZTUtAUFvWFnR/TeXLWlFzBupS1djgI7PltbJqSn6SKTAgNZTxpRJbu9Icp6J
-/50ELwT++0n0KWVXNHrDNfI5Gaa+SxClAsPsei2jLKpgR6QFC3wn38Z9q9LjAVuC
-+FWhoN1uhYeoricEXwIDAQABoxAwDjAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEB
-CwUAA4IBAQCdCA/EoXrustoV4jJGbkdXDuOUkBurwggSNBAqUBSDvCohRoD77Ecb
-QVuzPNxWKG+E4PwfUq2ha+2yPONEJ28ZgsbHq5qlJDMJ43wlcjn6wmmAJNeSpO8F
-0V9d2X/4wNZty9/zbwTnw26KChgDHumQ0WIbCoBtdqy8KDswYOvpgws6dqc021I7
-UrFo6vZek7VoApbJgkDL6qYADa6ApfW43ThH4sViFITeYt/kSHgmy2Udhs34jMM8
-xsFP/uYpRi1b1glenwSIKiHjD4/C9vnWQt5K3gRBvYukEj2Bw9VkNRpBVCi0cOoA
-OuwX3bwzNYNbZQv4K66oRpvuoEjCNeHg
+c3Qgc3VpdGUwIBcNMjMwNzEzMTQzNTIzWhgPMjA1MDExMjgxNDM1MjNaMEIxQDA+
+BgNVBAMMN1Rlc3QgQ0EgZm9yIFBvc3RncmVTUUwgU1NMIHJlZ3Jlc3Npb24gdGVz
+dCBzZXJ2ZXIgY2VydHMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDi
+SnYZbmc9vpCtKu1sKV9l663JCceubhMw8Gg16kV0hXEFf/TgGC4zkiYNHN7+G45Y
+D7Nq0kBCq3dHt2wPCc6c8pQoI64dfprVqPkvzoe1WBpZNetkUTk20v08jNeRa7Xd
+RbRR6we1s9VG/prp8Hs2mmHqEfLuI9lvTT0Dz+VMmfFI8Lf278r+w+qOtVloAkX7
+AOyoLEJlNS0BQW9YWdH9N5ctaUXMG6lLV2OAjs+W1smpKfpIpMCA1lPGlElu70hy
+non/nQQvBP77SfQpZVc0esM18jkZpr5LEKUCw+x6LaMsqmBHpAULfCffxn2r0uMB
+W4L4VaGg3W6Fh6iuJwRfAgMBAAGjgZcwgZQwDAYDVR0TBAUwAwEB/zAdBgNVHQ4E
+FgQU8o86ZkBQZEgi1y6C/1aewrPudAowZQYDVR0jBF4wXKFEpEIwQDE+MDwGA1UE
+Aww1VGVzdCByb290IENBIGZvciBQb3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRl
+c3Qgc3VpdGWCFBfnvJQgNLw9MyrcSA1T3Q2PyJIFMA0GCSqGSIb3DQEBCwUAA4IB
+AQANlEDrM357a7o+WcKB0Ocll2UtBMq7PDms1Pjqm3fFu/wdKDUomG8W2/MgDmFl
+CVeAPpofb6J0oaxiEZOR68pOhdccMznArtKix6t3RkDiXdm4d5UORMMR+s9CymXV
+MUTWpQpAg3qP3mRI+3E9OrgfhvmVcuOa7/cdTS/sylGe8Db+nJQD0be9NHtnhO56
+IA+Li+8oWzD4UNsP3gAmhLkyToz5wlPHzEkgGxkEySNErEOKTOX5Xyk5z+QToRhz
+adkt0mBw/dxoJk9DveCtIqxDelxJsDeJFtqoc5qVVE9yOp7rujGsqgWl2PcJeyKM
+Crh9qsqNzJ2R29pq0g6Lfzh2
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
-MIIDFDCCAfygAwIBAgIIICEDAxQSBwEwDQYJKoZIhvcNAQELBQAwQDE+MDwGA1UE
+MIIDnjCCAoagAwIBAgIIICMHExY1IwEwDQYJKoZIhvcNAQELBQAwQDE+MDwGA1UE
+Aww1VGVzdCByb290IENBIGZvciBQb3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRl
+c3Qgc3VpdGUwIBcNMjMwNzEzMTQzNTIzWhgPMjA1MDExMjgxNDM1MjNaMEIxQDA+
+BgNVBAMMN1Rlc3QgQ0EgZm9yIFBvc3RncmVTUUwgU1NMIHJlZ3Jlc3Npb24gdGVz
+dCBjbGllbnQgY2VydHMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC7
+5x7yuQ1+gK8j1aO6D2nGym2x2OFniztlnx4PlWWWivIrYlxy6xAhfrVdjwjc5mMt
+OCrVKllsdC+S1EfqCZTu1+gF0SdG5cHuJ2Rtg4oisLSF221v/msPONAa1dObChWs
+Jwme87VaFrL+B2yipfW1PUxM9a7/p19CRBcDQ+LNW+YFqwARByHGq1wfatJzpM8T
+Xe+XEnRfW9KXP3a5PqR6evFQOzjcAf+QBJ0hAEddUDhdYECbs1GrApfsEHBuwXab
+dCH41j0F/0yckctydWfBl2Vbmd3sfsFMHjde+SJhqxyq6xiSL59jnx4ZKmtn9VSO
+YbGmBCdBdYK7RTcnJQv9AgMBAAGjgZcwgZQwDAYDVR0TBAUwAwEB/zAdBgNVHQ4E
+FgQUn6Tr0smZ3rADsDA0IoFhFUu9rTYwZQYDVR0jBF4wXKFEpEIwQDE+MDwGA1UE
Aww1VGVzdCByb290IENBIGZvciBQb3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRl
-c3Qgc3VpdGUwHhcNMjEwMzAzMjIxMjA3WhcNNDgwNzE5MjIxMjA3WjBCMUAwPgYD
-VQQDDDdUZXN0IENBIGZvciBQb3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRlc3Qg
-Y2xpZW50IGNlcnRzMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu+ce
-8rkNfoCvI9Wjug9pxsptsdjhZ4s7ZZ8eD5VlloryK2JccusQIX61XY8I3OZjLTgq
-1SpZbHQvktRH6gmU7tfoBdEnRuXB7idkbYOKIrC0hdttb/5rDzjQGtXTmwoVrCcJ
-nvO1Whay/gdsoqX1tT1MTPWu/6dfQkQXA0PizVvmBasAEQchxqtcH2rSc6TPE13v
-lxJ0X1vSlz92uT6kenrxUDs43AH/kASdIQBHXVA4XWBAm7NRqwKX7BBwbsF2m3Qh
-+NY9Bf9MnJHLcnVnwZdlW5nd7H7BTB43XvkiYascqusYki+fY58eGSprZ/VUjmGx
-pgQnQXWCu0U3JyUL/QIDAQABoxAwDjAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEB
-CwUAA4IBAQC1syY2Rk02m5PGtfkMUIU7ZSe0mM+g0BgWAyCF/mFFYdfY0xHtqy0x
-QWkW9OR0KBl4JpphDDolHoNL3TLydH3t4inX8SAOpaUdsjMcIPKqjT1htQm0Pk5r
-vFYvKuVrxMnV0F+wMmZRuziKWrZlVDwBMfCAchzuVexDWfcjTmUQmhZxJuUzORw3
-swgh9HIpxjMkgdlHodbMAEpMIkkoeJnph3I9uTocXZbK/lAInggQdm0Q+on1ZT0A
-ljO/6jisDZzIguE4ZAQ2DfYsGI8H3tz/+76uIwwBNOmu0woUDSWXVcPWiviq49Bi
-GmH0KlUfWAphj86IfTWXT1HRay3eZQt3
+c3Qgc3VpdGWCFBfnvJQgNLw9MyrcSA1T3Q2PyJIFMA0GCSqGSIb3DQEBCwUAA4IB
+AQAbYUfwGvV4u5Gpbhv5yxdueC0faKVIEXYRnT4Dky01cV7pGkFSFndlA2mFsj1g
+uuzkTFPMedcBefMoq2o2eX2B4ogrFHovxELI82i9pbv/MmsGNYwbMsp2lnUhNWon
+QwxFqMGA5Y2p8vyEG7lrHKiFDdt7uPxcOeTiWo0ZpC8uThqiR4fUkPinQ3EHEFGQ
++zl+G3pb4VRUzsyqh2n9swudqQcwjsDlQlkQ2vzVb6IWWiUCwL3V7HGPGmlVbsFG
+nQ1M44aBtWbBQtubfBRwYb5r+4sRN94LST6Phmhnd/AJccIKdCaheq+yLVVGiCJN
+3nDTmgTVSSmOm/RRmSXNp7AH
-----END CERTIFICATE-----
diff --git a/src/test/ssl/ssl/client+client_ca.crt b/src/test/ssl/ssl/client+client_ca.crt
index 7fafa14de1..fe7719e14b 100644
--- a/src/test/ssl/ssl/client+client_ca.crt
+++ b/src/test/ssl/ssl/client+client_ca.crt
@@ -1,37 +1,40 @@
-----BEGIN CERTIFICATE-----
-MIIC0zCCAbsCCCAhAwMUEgcAMA0GCSqGSIb3DQEBCwUAMEIxQDA+BgNVBAMMN1Rl
+MIIC1TCCAb0CCCAjBxMWNSQAMA0GCSqGSIb3DQEBCwUAMEIxQDA+BgNVBAMMN1Rl
c3QgQ0EgZm9yIFBvc3RncmVTUUwgU1NMIHJlZ3Jlc3Npb24gdGVzdCBjbGllbnQg
-Y2VydHMwHhcNMjEwMzAzMjIxMjA3WhcNNDgwNzE5MjIxMjA3WjAWMRQwEgYDVQQD
-DAtzc2x0ZXN0dXNlcjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALSL
-oC6h8sBABL8kWRjFQJHZNcwmuRRWjzhBYR4gDKcBThCBIuEr5PZEkkXnJniXKHct
-bCzaBarUwG+bWGg6BiFWX3PP5MZvLG7ExP9yTrDjdwjKozkJCNWSow0hdYLaxkpm
-rYI6rDJ5T1CZBRLD4RYOjU39WVIxYkHlhJYtH0Cdv5PuzCOEtLdKQySSVq6heJen
-koLvK7AaF1x8uDiwM+o9t69pORWbOh/6aCCPeYmvhPIRvEqyZjGvPJ2kXau4R1vN
-NmepRIZ0VjQ/rQxo7dGWk38cfgsTeFI4G26DiYn08pFR47swUdfiMyx3MaGQiz9X
-I2nUqjM+W84iUxrR82MCAwEAATANBgkqhkiG9w0BAQsFAAOCAQEACSZo32raJHcB
-rYHeomzynmzgMVBHSA4XsXZVQw4+zBUER+/ZdQbtw6F/qdeWRvTl8TJjwoydta7u
-4gUkgAnQhYm2f8XEBe/+MUegH+y54Yk6rtmkdLxJLGKZ0IUfYkn20sg/NZrltbog
-A8glWRGVD8cEOaxUaNSQ4Xqmqsqjd6Kh8snVfIIcWgKgnTNgyapM5ePBpS2IREhN
-u9fjikQQf6F/dycsm22OP7aWsp1XPs3nqnoq9ZnhQrITMwsGcjbU7+v8La2GbiJV
-8yAy136NSXUujIG/8eqhICWZPqj+KbdVZupOsUeVoeuSwLXJjm4GWY0xH92emqCI
-ac+HriJv5w==
+Y2VydHMwIBcNMjMwNjI5MDEwMTAxWhgPMjA1MDAxMDEwMTAxMDFaMBYxFDASBgNV
+BAMMC3NzbHRlc3R1c2VyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
+tIugLqHywEAEvyRZGMVAkdk1zCa5FFaPOEFhHiAMpwFOEIEi4Svk9kSSRecmeJco
+dy1sLNoFqtTAb5tYaDoGIVZfc8/kxm8sbsTE/3JOsON3CMqjOQkI1ZKjDSF1gtrG
+SmatgjqsMnlPUJkFEsPhFg6NTf1ZUjFiQeWEli0fQJ2/k+7MI4S0t0pDJJJWrqF4
+l6eSgu8rsBoXXHy4OLAz6j23r2k5FZs6H/poII95ia+E8hG8SrJmMa88naRdq7hH
+W802Z6lEhnRWND+tDGjt0ZaTfxx+CxN4UjgbboOJifTykVHjuzBR1+IzLHcxoZCL
+P1cjadSqMz5bziJTGtHzYwIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQAQnfs7UO2g
+iilUgCQAfa9Vb0ZSivD7ryjnLsdwYRLIlb0YceME9qtSv2UYBfS9KpwG7+jONMQB
+kvbe611/TaF0T7EC1GIWuTMs8jknJ2bgPbS8D8jiFWTci+SDDog4EVoakSLoirW6
+yB4398upjtanAdnjoNpE4REXPDHzDm2Dico2RCObJh1VAEK+q6gLJxQtGvdPyG3L
+Fhjs7ky1lsxIvHlts8c1e4vhnVpxdS3I5r6N38qFXEJnc1tv/e+TH50mdrZlzRHF
+TPgnZzWCGTHmT5YT3yoAldWG4uWzMsB+2eY/crRefM9byc0omjCxDTrk9nA6JWsf
+0c6pBc6aKzdi
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
-MIIDFDCCAfygAwIBAgIIICEDAxQSBwEwDQYJKoZIhvcNAQELBQAwQDE+MDwGA1UE
+MIIDnjCCAoagAwIBAgIIICMHExY1IwEwDQYJKoZIhvcNAQELBQAwQDE+MDwGA1UE
Aww1VGVzdCByb290IENBIGZvciBQb3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRl
-c3Qgc3VpdGUwHhcNMjEwMzAzMjIxMjA3WhcNNDgwNzE5MjIxMjA3WjBCMUAwPgYD
-VQQDDDdUZXN0IENBIGZvciBQb3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRlc3Qg
-Y2xpZW50IGNlcnRzMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu+ce
-8rkNfoCvI9Wjug9pxsptsdjhZ4s7ZZ8eD5VlloryK2JccusQIX61XY8I3OZjLTgq
-1SpZbHQvktRH6gmU7tfoBdEnRuXB7idkbYOKIrC0hdttb/5rDzjQGtXTmwoVrCcJ
-nvO1Whay/gdsoqX1tT1MTPWu/6dfQkQXA0PizVvmBasAEQchxqtcH2rSc6TPE13v
-lxJ0X1vSlz92uT6kenrxUDs43AH/kASdIQBHXVA4XWBAm7NRqwKX7BBwbsF2m3Qh
-+NY9Bf9MnJHLcnVnwZdlW5nd7H7BTB43XvkiYascqusYki+fY58eGSprZ/VUjmGx
-pgQnQXWCu0U3JyUL/QIDAQABoxAwDjAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEB
-CwUAA4IBAQC1syY2Rk02m5PGtfkMUIU7ZSe0mM+g0BgWAyCF/mFFYdfY0xHtqy0x
-QWkW9OR0KBl4JpphDDolHoNL3TLydH3t4inX8SAOpaUdsjMcIPKqjT1htQm0Pk5r
-vFYvKuVrxMnV0F+wMmZRuziKWrZlVDwBMfCAchzuVexDWfcjTmUQmhZxJuUzORw3
-swgh9HIpxjMkgdlHodbMAEpMIkkoeJnph3I9uTocXZbK/lAInggQdm0Q+on1ZT0A
-ljO/6jisDZzIguE4ZAQ2DfYsGI8H3tz/+76uIwwBNOmu0woUDSWXVcPWiviq49Bi
-GmH0KlUfWAphj86IfTWXT1HRay3eZQt3
+c3Qgc3VpdGUwIBcNMjMwNzEzMTQzNTIzWhgPMjA1MDExMjgxNDM1MjNaMEIxQDA+
+BgNVBAMMN1Rlc3QgQ0EgZm9yIFBvc3RncmVTUUwgU1NMIHJlZ3Jlc3Npb24gdGVz
+dCBjbGllbnQgY2VydHMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC7
+5x7yuQ1+gK8j1aO6D2nGym2x2OFniztlnx4PlWWWivIrYlxy6xAhfrVdjwjc5mMt
+OCrVKllsdC+S1EfqCZTu1+gF0SdG5cHuJ2Rtg4oisLSF221v/msPONAa1dObChWs
+Jwme87VaFrL+B2yipfW1PUxM9a7/p19CRBcDQ+LNW+YFqwARByHGq1wfatJzpM8T
+Xe+XEnRfW9KXP3a5PqR6evFQOzjcAf+QBJ0hAEddUDhdYECbs1GrApfsEHBuwXab
+dCH41j0F/0yckctydWfBl2Vbmd3sfsFMHjde+SJhqxyq6xiSL59jnx4ZKmtn9VSO
+YbGmBCdBdYK7RTcnJQv9AgMBAAGjgZcwgZQwDAYDVR0TBAUwAwEB/zAdBgNVHQ4E
+FgQUn6Tr0smZ3rADsDA0IoFhFUu9rTYwZQYDVR0jBF4wXKFEpEIwQDE+MDwGA1UE
+Aww1VGVzdCByb290IENBIGZvciBQb3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRl
+c3Qgc3VpdGWCFBfnvJQgNLw9MyrcSA1T3Q2PyJIFMA0GCSqGSIb3DQEBCwUAA4IB
+AQAbYUfwGvV4u5Gpbhv5yxdueC0faKVIEXYRnT4Dky01cV7pGkFSFndlA2mFsj1g
+uuzkTFPMedcBefMoq2o2eX2B4ogrFHovxELI82i9pbv/MmsGNYwbMsp2lnUhNWon
+QwxFqMGA5Y2p8vyEG7lrHKiFDdt7uPxcOeTiWo0ZpC8uThqiR4fUkPinQ3EHEFGQ
++zl+G3pb4VRUzsyqh2n9swudqQcwjsDlQlkQ2vzVb6IWWiUCwL3V7HGPGmlVbsFG
+nQ1M44aBtWbBQtubfBRwYb5r+4sRN94LST6Phmhnd/AJccIKdCaheq+yLVVGiCJN
+3nDTmgTVSSmOm/RRmSXNp7AH
-----END CERTIFICATE-----
diff --git a/src/test/ssl/ssl/client-crldir/9bb9e3c3.r0 b/src/test/ssl/ssl/client-crldir/9bb9e3c3.r0
index f75eb1c0bc..202f9f44d0 100644
--- a/src/test/ssl/ssl/client-crldir/9bb9e3c3.r0
+++ b/src/test/ssl/ssl/client-crldir/9bb9e3c3.r0
@@ -1,12 +1,12 @@
-----BEGIN X509 CRL-----
-MIIBwDCBqTANBgkqhkiG9w0BAQsFADBCMUAwPgYDVQQDDDdUZXN0IENBIGZvciBQ
-b3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRlc3QgY2xpZW50IGNlcnRzFw0yMjA3
-MTgyMjI4MTVaFw00OTEyMDMyMjI4MTVaMDYwGQIIICEDAxQSBwEXDTIyMDcxODIy
-MjgxNVowGQIIICIHGBUoFQAXDTIyMDcxODIyMjgxNVowDQYJKoZIhvcNAQELBQAD
-ggEBAFDH3m9AHpDjkEFjO6svnLJ2bTliGeKZaJW8/RAN4mWvWDhXDQfzqGcFHN2a
-SIL57Xc4PdwTiXuU4QEP4RvWW90LYKdcrcT8uh0AN3i7ShMwcV7I7owzF5+CBuT7
-Ev0MU4QIz0PjXoybXP6b3wHhZbEjYTLYdnYdqjrsAchUpyDQn6fiC0C7FgjCi4HL
-rNm2kMchFpzd6K9e41kxWVp7xCPXgqUK8OrxlW56ObkX8UpBIZzyU6RisJKOZJAn
-/+lwT43yTtU739atdXdSMvGHT9Y7LsrSDz9zgp2/iMTmfctnPcp81J/6jQZEP8kx
-OyPyZz4xy/EShWy+KUklfOoKRo8=
+MIIBwjCBqzANBgkqhkiG9w0BAQsFADBCMUAwPgYDVQQDDDdUZXN0IENBIGZvciBQ
+b3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRlc3QgY2xpZW50IGNlcnRzFw0yMzA3
+MTMxNDM1MjRaGA8yMDUwMTEyODE0MzUyNFowNjAZAgggIwcTFjUkAhcNMjMwNzEz
+MTQzNTI0WjAZAgggIwcTFjUkBRcNMjMwNzEzMTQzNTI0WjANBgkqhkiG9w0BAQsF
+AAOCAQEAl2jqLuwUgUTtzIKdLyAqIGf+zG0jfJXD9KFIsPeR+zfYWyNVzlWav68e
+zcLLhr9NWzHCXo0F5yiWVIO9pe2OF980Ez/24fTd6NPk3qG9AzLeLQ0jPhEgLaDw
+KFSTuaTbEuAUBGHMTjdoe6aOGsypUOXxse/G5enyx93yCC7boFkrYscfnQT2kFZT
+60Bhfr/4qkFdGJbp9ZIsTP8us4sktEDFn24Tq5f8sW7JyqIU83LRhjkIc8NALGCE
+DE7FgaGVUyuH8jYkVw4XLMwYo9gAy95pBxrDFq/r0Zm4E1rIEr8x7Ji7smUcubrb
+/MXu7OCXst4uzoRxFQctnP19AYIKZQ==
-----END X509 CRL-----
diff --git a/src/test/ssl/ssl/client-dn.crt b/src/test/ssl/ssl/client-dn.crt
index 0db14e5977..3f5c80580c 100644
--- a/src/test/ssl/ssl/client-dn.crt
+++ b/src/test/ssl/ssl/client-dn.crt
@@ -1,19 +1,19 @@
-----BEGIN CERTIFICATE-----
-MIIDDTCCAfUCCCAhBikTA0IAMA0GCSqGSIb3DQEBCwUAMEIxQDA+BgNVBAMMN1Rl
+MIIDDzCCAfcCCCAjBxMWNSQBMA0GCSqGSIb3DQEBCwUAMEIxQDA+BgNVBAMMN1Rl
c3QgQ0EgZm9yIFBvc3RncmVTUUwgU1NMIHJlZ3Jlc3Npb24gdGVzdCBjbGllbnQg
-Y2VydHMwHhcNMjEwNjI5MjAwMzQyWhcNNDgxMTE0MjAwMzQyWjBQMQ0wCwYDVQQK
-DARQR0RHMRQwEgYDVQQLDAtFbmdpbmVlcmluZzEQMA4GA1UECwwHVGVzdGluZzEX
-MBUGA1UEAwwOc3NsdGVzdHVzZXItZG4wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
-ggEKAoIBAQDES64qtkofPjeG4VbUVKfzABLC0CurvxqLTEpokq/St9WAWDrzc8PJ
-YireEZp4ec5rHVyQVvHqzzaZFAMvbRUQgMdGKG4Vgkn8l96KxHa4Q6yxYoQOts10
-AuvU9LuGKT0lxndMggHDmREUOAkFYKp7IeypseUGkJ6sWs+DlTwK1hST+EUAU/5f
-q/pAngJ+oar20m8WNxaAhJUKtBBecdRdqYy/h3Ab43iPhj+N9IFXiSV9EWhteBae
-L/TEE+s7/4L74xwvJe2EiVETo3lMy2aVJ4/4pOMq7U+Gr/0wxk0jqRrOahAE6pOI
-cQFBFsOkyUaC4dzqtjeSrsw5igQbJC19AgMBAAEwDQYJKoZIhvcNAQELBQADggEB
-AECbQQ9rBzCexNI3VKDVA+CZa0ib48XbcJwXmva3spvjjCB5cGPToyF1B+4mVg1H
-1uM/XRAoQmNRtB+xKEAceMSxJA02tBlwMOclXlO0oGLYyc+S61K+UEPSk6Kka4aC
-NpeLSqN5ahC9z8C5uMJl36pFf13aU05uRkXKcI4gkn02I4jRc/a8gF7URdhdf920
-KmYSUh1V0B3pPAB6ArqJ60iHOqkCYIIIbi2EpVP53IKkoB9tr4ud8oMoN6ggIXU1
-2oHvnaKJ7RZaQNefS3WweyHxr4cCVtEour/ELph48OuW6Y5jqPT+5Ln3Qz0e6KW9
-o3thBx0aKSYlmt9gH254M9M=
+Y2VydHMwIBcNMjMwNjI5MDEwMTAxWhgPMjA1MDAxMDEwMTAxMDFaMFAxDTALBgNV
+BAoMBFBHREcxFDASBgNVBAsMC0VuZ2luZWVyaW5nMRAwDgYDVQQLDAdUZXN0aW5n
+MRcwFQYDVQQDDA5zc2x0ZXN0dXNlci1kbjCCASIwDQYJKoZIhvcNAQEBBQADggEP
+ADCCAQoCggEBAMRLriq2Sh8+N4bhVtRUp/MAEsLQK6u/GotMSmiSr9K31YBYOvNz
+w8liKt4Rmnh5zmsdXJBW8erPNpkUAy9tFRCAx0YobhWCSfyX3orEdrhDrLFihA62
+zXQC69T0u4YpPSXGd0yCAcOZERQ4CQVgqnsh7Kmx5QaQnqxaz4OVPArWFJP4RQBT
+/l+r+kCeAn6hqvbSbxY3FoCElQq0EF5x1F2pjL+HcBvjeI+GP430gVeJJX0RaG14
+Fp4v9MQT6zv/gvvjHC8l7YSJUROjeUzLZpUnj/ik4yrtT4av/TDGTSOpGs5qEATq
+k4hxAUEWw6TJRoLh3Oq2N5KuzDmKBBskLX0CAwEAATANBgkqhkiG9w0BAQsFAAOC
+AQEAYi8MtTEYoqqxjoy/QOYuuWIryNwvpHh9ty8q+r8gWPuySMaIb+qfWh7qK1OY
+ng9HUXdXn+kpZIy6GMVtVSprPn5J3gLCZMsXqHxh5XtHf8DkSwmaQrVSFmu0Wkri
+txnNl4OHwMIGbX0o6oN7rNdlgYxLyMtPzO+KfygjO4HX8Hm5Jz0DM2K3airnFkCc
+IwYdMmaEMykRRl2W5wpSgHjYrReL3qopdWj97sKTY4H3ZuBR7i2V9ni6/mJFUD2u
+8tLeUTB1vOhRk6JhtRagNIQHg7tsUX6Fx3QkdosGjSCWPePzv4UC4GYvEjbOvsxv
+hIPtSVIjtS8eN6co3XJP+dTd4w==
-----END CERTIFICATE-----
diff --git a/src/test/ssl/ssl/client-long.crt b/src/test/ssl/ssl/client-long.crt
index a1db55b5c3..2fec398e17 100644
--- a/src/test/ssl/ssl/client-long.crt
+++ b/src/test/ssl/ssl/client-long.crt
@@ -1,20 +1,20 @@
-----BEGIN CERTIFICATE-----
-MIIDWjCCAkICCCAiBRIUREYAMA0GCSqGSIb3DQEBCwUAMEIxQDA+BgNVBAMMN1Rl
+MIIDXDCCAkQCCCAjBxMWNSQEMA0GCSqGSIb3DQEBCwUAMEIxQDA+BgNVBAMMN1Rl
c3QgQ0EgZm9yIFBvc3RncmVTUUwgU1NMIHJlZ3Jlc3Npb24gdGVzdCBjbGllbnQg
-Y2VydHMwHhcNMjIwNTEyMjE0NDQ3WhcNNDkwOTI3MjE0NDQ3WjCBnDEsMCoGA1UE
-CgwjUG9zdGdyZVNRTCBHbG9iYWwgRGV2ZWxvcG1lbnQgR3JvdXAxITAfBgNVBAsM
-GFNvbWUgT3JnYW5pemF0aW9uYWwgVW5pdDFJMEcGA1UEAwxAc3NsLTEyMzQ1Njc4
-OTAxMjM0NTY3ODkwMTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTIzNDU2
-Nzg5MDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANgxmeHiVRuBTwlG
-Q1oM2M1ckQCI/o4hYcO9BYdxDYHiA7jy1WVenyj8BtUi5Aj9VDhpfiuewDarGQ5a
-TggD1pMjkw0MorBKBr9+1u1xGH/8Q3lkgU+OQXrPglo4IrVcqaoZFQ0nuMaVbieX
-0dDyTfsTaVQYYtqAtzhI/UGSIOhk2+lB9fP68jw9cLH0QYvR+qQ0IPG13I5zmSYP
-Mj0VYwMn9TF9/2sBOSRVgTVAcrYgOQLk3s/fGe66tmVBIWYcq65ygqD1+weu+Pax
-jPnwsefkdnf6JdYRG1F1Co7g52poPEYieAHfQOJ69sG0LYx0lBODC69qvSJ4WdCQ
-0zKw288CAwEAATANBgkqhkiG9w0BAQsFAAOCAQEArr5r1UxgUzPykmu5ZdL6y8TA
-ZbSQ1yBY0nhsRwRkDd66iPK9U6T6K2+pL8Vc6ioov9WOtHQ6ohP3gSavd40cHRmF
-auwIsZ4Wk0mjftpOuPFp1hyo8d/QYrbEm3qNe5qln5S9h8ipoYvFtf5zlK2KHJFz
-9ehZMZ1zGAERNCVM8UUQKyUuZB5GyrZlbslf6P/9Bsc54YUWxP2pr5r/RJ6DeXfI
-zAFfXT8AFVlClARA949gpX0LVrXryDN60CUJ88QJmYCQ3AtIgzYYeqcdYHTd8eS2
-9P5whDdU5NvROP+LjETeReJF4Bfyc2gM7zxZD2BDSf5exvnNqiy42/lR1b4szw==
+Y2VydHMwIBcNMjMwNjI5MDEwMTAxWhgPMjA1MDAxMDEwMTAxMDFaMIGcMSwwKgYD
+VQQKDCNQb3N0Z3JlU1FMIEdsb2JhbCBEZXZlbG9wbWVudCBHcm91cDEhMB8GA1UE
+CwwYU29tZSBPcmdhbml6YXRpb25hbCBVbml0MUkwRwYDVQQDDEBzc2wtMTIzNDU2
+Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0
+NTY3ODkwMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2DGZ4eJVG4FP
+CUZDWgzYzVyRAIj+jiFhw70Fh3ENgeIDuPLVZV6fKPwG1SLkCP1UOGl+K57ANqsZ
+DlpOCAPWkyOTDQyisEoGv37W7XEYf/xDeWSBT45Bes+CWjgitVypqhkVDSe4xpVu
+J5fR0PJN+xNpVBhi2oC3OEj9QZIg6GTb6UH18/ryPD1wsfRBi9H6pDQg8bXcjnOZ
+Jg8yPRVjAyf1MX3/awE5JFWBNUBytiA5AuTez98Z7rq2ZUEhZhyrrnKCoPX7B674
+9rGM+fCx5+R2d/ol1hEbUXUKjuDnamg8RiJ4Ad9A4nr2wbQtjHSUE4MLr2q9InhZ
+0JDTMrDbzwIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQCUIOBu5ea3vSVpiqCGMphv
+V26dDpEl1OMpvPIM5Ss1sp9ogOdBg7ahkDE51J0QaB3yN6mci3sN6yi77U3zXXUv
+qI0hdR3nwjTLJSpW2p6ONW43PKPhKr42UdBH5iRVlNY7rto2x3xC0iuzvPAJjIJJ
+OJMZYl/A43O8XZW68m9Z5kH3Vi/l0wtjElfnjqI0DAuQEL/TQTzK9qTIhdAqMAKG
+deTGSqpz+ID2CfuN+TBV2NAseilZ4JC0xZxaJpoqmK3yTtgKBhJ3vQN//fc1TdPy
+9+zvnSRIJZJque58ZKnqbMq3c3RRSo0eOZn7FZopcIRsn5hzDeIVTJcBJ68jcxrL
-----END CERTIFICATE-----
diff --git a/src/test/ssl/ssl/client-revoked-utf8.crt b/src/test/ssl/ssl/client-revoked-utf8.crt
index de471d1e60..4189c75de8 100644
--- a/src/test/ssl/ssl/client-revoked-utf8.crt
+++ b/src/test/ssl/ssl/client-revoked-utf8.crt
@@ -1,18 +1,18 @@
-----BEGIN CERTIFICATE-----
-MIIC2DCCAcACCCAiBxgVKBUAMA0GCSqGSIb3DQEBCwUAMEIxQDA+BgNVBAMMN1Rl
+MIIC2jCCAcICCCAjBxMWNSQFMA0GCSqGSIb3DQEBCwUAMEIxQDA+BgNVBAMMN1Rl
c3QgQ0EgZm9yIFBvc3RncmVTUUwgU1NMIHJlZ3Jlc3Npb24gdGVzdCBjbGllbnQg
-Y2VydHMwHhcNMjIwNzE4MjIyODE1WhcNNDkxMjAzMjIyODE1WjAbMRkwFwYDVQQD
-DBDOn860z4XPg8+Dzq3Osc+CMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
-AQEAvBiL1mVjTrzZ6sbrvfu746dzh+EEyuJNkCwPeJTtpva2wqqRUMYw05cV5kzi
-YQ3UikMP5Yz0FXTeWoahSpJAWeR5XsFx3wOQvRzwi1KWm2CHr/rb7KbPvoZQdXuV
-8UeKrQ6PrEvjoarHAUZuWyUC6EnEAGuiKl5yuax5mkTcK5F8pig2/SS/UonX5ar5
-58rOUEaIdyZmXtrO86cm5S5Oz3G2naQB3PPPOhtkoGBHikRHiqBPVRpX3w9TIpBL
-BZbT4MIZ+fCjZ9wXj4aiDUzPglu6/Tfx9sNcxc6Ilz/XHfPuBVyyjgrny2SrW0W4
-KlhU09y+m5gKL358z8tj599DowIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQAE47ns
-wfceztieaRQtoF+gPcCuImOJqaB7jTE6cQ+aoW/q+sUlOh7AD0IZqhS4o0A4O+ny
-MD7kHkpYP+ctHNomsSQRkFTDZ2ZJGcRgxbwMOSvsKcgNOTMGqpXQiP0x0m7QMBGl
-EHeu5MqG/IK/ZlH9aOTvSnHegB6ztct/7wXMeFCflsWLp6wvnv9YpddaaXf95Oms
-9kwbVYkI1wxaBsAO8VGbJw1YtdErgd65qKTJa45xndtm61i1Jeig5asSNQPwjfZ5
-aNHZ9GsSwsc31Q/6iiezbPwgdAi3ih//uB2hznkMhObnqzR3n8Sw9zgL7DdFr2y9
-2R7kJuGq6DvlWFYS
+Y2VydHMwIBcNMjMwNjI5MDEwMTAxWhgPMjA1MDAxMDEwMTAxMDFaMBsxGTAXBgNV
+BAMMEM6fzrTPhc+Dz4POrc6xz4IwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
+AoIBAQC8GIvWZWNOvNnqxuu9+7vjp3OH4QTK4k2QLA94lO2m9rbCqpFQxjDTlxXm
+TOJhDdSKQw/ljPQVdN5ahqFKkkBZ5HlewXHfA5C9HPCLUpabYIev+tvsps++hlB1
+e5XxR4qtDo+sS+OhqscBRm5bJQLoScQAa6IqXnK5rHmaRNwrkXymKDb9JL9Sidfl
+qvnnys5QRoh3JmZe2s7zpyblLk7PcbadpAHc8886G2SgYEeKREeKoE9VGlffD1Mi
+kEsFltPgwhn58KNn3BePhqINTM+CW7r9N/H2w1zFzoiXP9cd8+4FXLKOCufLZKtb
+RbgqWFTT3L6bmAovfnzPy2Pn30OjAgMBAAEwDQYJKoZIhvcNAQELBQADggEBAASZ
+M/4tx9qm7G9TEKHHg/Da7GOrGWnYwluWcO/jnIN4jCPyxwj6EmxZGEBKqFUhj3kY
+hwL+249Y2YABOLqu9x/YJz1KtZUgkwTGh6yfT5xOSOCXij7ukpge1gXtodYtnBgP
+FmJOdFygrXxWex3vr+F2Fnh93Isxd/nFof/Rwmi4JTJr6JjalyGuvNDGZc/N16/u
+uR3AE0zGLfM093GbJe9E9j44DGMbNlwHvZ2NXojX34kNoRttonPHmXGKWSCyufUc
+uG+STq5T/DFnr06Ugj2TPCMyEgDEA4unzP5uxAijXVRSkyOrAtZrFtzbab/wjTLt
+0AGeljtaei/bMAh11Cs=
-----END CERTIFICATE-----
diff --git a/src/test/ssl/ssl/client-revoked.crt b/src/test/ssl/ssl/client-revoked.crt
index 51ebe924a6..2cc0c933cd 100644
--- a/src/test/ssl/ssl/client-revoked.crt
+++ b/src/test/ssl/ssl/client-revoked.crt
@@ -1,18 +1,18 @@
-----BEGIN CERTIFICATE-----
-MIIC0zCCAbsCCCAhAwMUEgcBMA0GCSqGSIb3DQEBCwUAMEIxQDA+BgNVBAMMN1Rl
+MIIC1TCCAb0CCCAjBxMWNSQCMA0GCSqGSIb3DQEBCwUAMEIxQDA+BgNVBAMMN1Rl
c3QgQ0EgZm9yIFBvc3RncmVTUUwgU1NMIHJlZ3Jlc3Npb24gdGVzdCBjbGllbnQg
-Y2VydHMwHhcNMjEwMzAzMjIxMjA3WhcNNDgwNzE5MjIxMjA3WjAWMRQwEgYDVQQD
-DAtzc2x0ZXN0dXNlcjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKAX
-JmNmfqmvpVAeWEmJxi7feku2sZKA7yMyyZMCboBqsNVO9gOpQFE8gD1Z7bJm4aDK
-QxByuspYPFOBwty9YW4UqRa4kyEyd08x+PsHQx9SmWJTNpNIH6yq5LCcme37QMrg
-b8wUZRWwXsaKUfVUI6oALjSgcibMJXTntCsD9J5m/07U/ZZALe1460rreTFHsxVZ
-708Wm5u7UHIgxvvEKhNG/JR9zd1Tl1mVgnlz0a8G6Dt22gJnLnuFdtDdACwET/kG
-TRJQWuyavpe+1TY53kZNO442hOzwhlZVnz4IKaWaLNQMtbG9iYStEvaWa8p0E/3J
-N6oRuELiqXJp/wW3v/MCAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAcVhPcu55HcSf
-Mci38T/fOBaiDUvzWwG/XlQRzFxcS+ZY/vYMbgor6PliGlCFBF4Mca2qtTs7zXRz
-8aLNVX53p98Cnnn97mW4aYNbNdM87R76IqJdj40brEolu1JNOyFJRYzoaebABf9r
-R64FTt3YVM9qjJrHG/apYwKwgAMxVzZ/M+3ujahP/8mOYD/Utj+lYHnXJmuHAYE6
-EnTxTSb2J+IsK8KuPoGjUPNZRW8zIUE0luMpJahvtmFVW91Vue7dW0AOmHpjmGUB
-J9Vwxe7KJRW5/4dz6kMD2pKY3D9sBgXeku/QDVz/hdyB5YT0WChFiZn20DZyhOtu
-moHgw8OJzg==
+Y2VydHMwIBcNMjMwNjI5MDEwMTAxWhgPMjA1MDAxMDEwMTAxMDFaMBYxFDASBgNV
+BAMMC3NzbHRlc3R1c2VyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
+oBcmY2Z+qa+lUB5YSYnGLt96S7axkoDvIzLJkwJugGqw1U72A6lAUTyAPVntsmbh
+oMpDEHK6ylg8U4HC3L1hbhSpFriTITJ3TzH4+wdDH1KZYlM2k0gfrKrksJyZ7ftA
+yuBvzBRlFbBexopR9VQjqgAuNKByJswldOe0KwP0nmb/TtT9lkAt7XjrSut5MUez
+FVnvTxabm7tQciDG+8QqE0b8lH3N3VOXWZWCeXPRrwboO3baAmcue4V20N0ALARP
++QZNElBa7Jq+l77VNjneRk07jjaE7PCGVlWfPggppZos1Ay1sb2JhK0S9pZrynQT
+/ck3qhG4QuKpcmn/Bbe/8wIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQAtVsoTdoLZ
+2PMVSDIEc3VRhjNS5+EuYcW+7h0se/7IpBauHoZhn+JD8YVtE04yz2YkglrnChmJ
+iL8xc+f1PbQatxpU7HnSswn3JevC+jZWnGvAxqR2oR3cAioF7sK1vnYLnd2OPqcy
+P9T+tzi90fiVOVOlrm00hjJBNcDIhofjY9td3wogA1SO8vXQteZ1gXNt0nzmfuNZ
+vZvspk+A/vN8tbR6BTagUxPRxajiT0xoIJFD6Qx2ZPglgffJKDwQQ3kvYr7dLMgO
++TDcLL8GK2MAxglgOqvUlRwfwl0ZXu3ZsGjim8pF+dPJB1dUCm9KbG2sIscPNLUe
+9p2w5FZaNk7p
-----END CERTIFICATE-----
diff --git a/src/test/ssl/ssl/client.crl b/src/test/ssl/ssl/client.crl
index f75eb1c0bc..202f9f44d0 100644
--- a/src/test/ssl/ssl/client.crl
+++ b/src/test/ssl/ssl/client.crl
@@ -1,12 +1,12 @@
-----BEGIN X509 CRL-----
-MIIBwDCBqTANBgkqhkiG9w0BAQsFADBCMUAwPgYDVQQDDDdUZXN0IENBIGZvciBQ
-b3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRlc3QgY2xpZW50IGNlcnRzFw0yMjA3
-MTgyMjI4MTVaFw00OTEyMDMyMjI4MTVaMDYwGQIIICEDAxQSBwEXDTIyMDcxODIy
-MjgxNVowGQIIICIHGBUoFQAXDTIyMDcxODIyMjgxNVowDQYJKoZIhvcNAQELBQAD
-ggEBAFDH3m9AHpDjkEFjO6svnLJ2bTliGeKZaJW8/RAN4mWvWDhXDQfzqGcFHN2a
-SIL57Xc4PdwTiXuU4QEP4RvWW90LYKdcrcT8uh0AN3i7ShMwcV7I7owzF5+CBuT7
-Ev0MU4QIz0PjXoybXP6b3wHhZbEjYTLYdnYdqjrsAchUpyDQn6fiC0C7FgjCi4HL
-rNm2kMchFpzd6K9e41kxWVp7xCPXgqUK8OrxlW56ObkX8UpBIZzyU6RisJKOZJAn
-/+lwT43yTtU739atdXdSMvGHT9Y7LsrSDz9zgp2/iMTmfctnPcp81J/6jQZEP8kx
-OyPyZz4xy/EShWy+KUklfOoKRo8=
+MIIBwjCBqzANBgkqhkiG9w0BAQsFADBCMUAwPgYDVQQDDDdUZXN0IENBIGZvciBQ
+b3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRlc3QgY2xpZW50IGNlcnRzFw0yMzA3
+MTMxNDM1MjRaGA8yMDUwMTEyODE0MzUyNFowNjAZAgggIwcTFjUkAhcNMjMwNzEz
+MTQzNTI0WjAZAgggIwcTFjUkBRcNMjMwNzEzMTQzNTI0WjANBgkqhkiG9w0BAQsF
+AAOCAQEAl2jqLuwUgUTtzIKdLyAqIGf+zG0jfJXD9KFIsPeR+zfYWyNVzlWav68e
+zcLLhr9NWzHCXo0F5yiWVIO9pe2OF980Ez/24fTd6NPk3qG9AzLeLQ0jPhEgLaDw
+KFSTuaTbEuAUBGHMTjdoe6aOGsypUOXxse/G5enyx93yCC7boFkrYscfnQT2kFZT
+60Bhfr/4qkFdGJbp9ZIsTP8us4sktEDFn24Tq5f8sW7JyqIU83LRhjkIc8NALGCE
+DE7FgaGVUyuH8jYkVw4XLMwYo9gAy95pBxrDFq/r0Zm4E1rIEr8x7Ji7smUcubrb
+/MXu7OCXst4uzoRxFQctnP19AYIKZQ==
-----END X509 CRL-----
diff --git a/src/test/ssl/ssl/client.crt b/src/test/ssl/ssl/client.crt
index 1f6ae05fe4..eaf8830192 100644
--- a/src/test/ssl/ssl/client.crt
+++ b/src/test/ssl/ssl/client.crt
@@ -1,18 +1,18 @@
-----BEGIN CERTIFICATE-----
-MIIC0zCCAbsCCCAhAwMUEgcAMA0GCSqGSIb3DQEBCwUAMEIxQDA+BgNVBAMMN1Rl
+MIIC1TCCAb0CCCAjBxMWNSQAMA0GCSqGSIb3DQEBCwUAMEIxQDA+BgNVBAMMN1Rl
c3QgQ0EgZm9yIFBvc3RncmVTUUwgU1NMIHJlZ3Jlc3Npb24gdGVzdCBjbGllbnQg
-Y2VydHMwHhcNMjEwMzAzMjIxMjA3WhcNNDgwNzE5MjIxMjA3WjAWMRQwEgYDVQQD
-DAtzc2x0ZXN0dXNlcjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALSL
-oC6h8sBABL8kWRjFQJHZNcwmuRRWjzhBYR4gDKcBThCBIuEr5PZEkkXnJniXKHct
-bCzaBarUwG+bWGg6BiFWX3PP5MZvLG7ExP9yTrDjdwjKozkJCNWSow0hdYLaxkpm
-rYI6rDJ5T1CZBRLD4RYOjU39WVIxYkHlhJYtH0Cdv5PuzCOEtLdKQySSVq6heJen
-koLvK7AaF1x8uDiwM+o9t69pORWbOh/6aCCPeYmvhPIRvEqyZjGvPJ2kXau4R1vN
-NmepRIZ0VjQ/rQxo7dGWk38cfgsTeFI4G26DiYn08pFR47swUdfiMyx3MaGQiz9X
-I2nUqjM+W84iUxrR82MCAwEAATANBgkqhkiG9w0BAQsFAAOCAQEACSZo32raJHcB
-rYHeomzynmzgMVBHSA4XsXZVQw4+zBUER+/ZdQbtw6F/qdeWRvTl8TJjwoydta7u
-4gUkgAnQhYm2f8XEBe/+MUegH+y54Yk6rtmkdLxJLGKZ0IUfYkn20sg/NZrltbog
-A8glWRGVD8cEOaxUaNSQ4Xqmqsqjd6Kh8snVfIIcWgKgnTNgyapM5ePBpS2IREhN
-u9fjikQQf6F/dycsm22OP7aWsp1XPs3nqnoq9ZnhQrITMwsGcjbU7+v8La2GbiJV
-8yAy136NSXUujIG/8eqhICWZPqj+KbdVZupOsUeVoeuSwLXJjm4GWY0xH92emqCI
-ac+HriJv5w==
+Y2VydHMwIBcNMjMwNjI5MDEwMTAxWhgPMjA1MDAxMDEwMTAxMDFaMBYxFDASBgNV
+BAMMC3NzbHRlc3R1c2VyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
+tIugLqHywEAEvyRZGMVAkdk1zCa5FFaPOEFhHiAMpwFOEIEi4Svk9kSSRecmeJco
+dy1sLNoFqtTAb5tYaDoGIVZfc8/kxm8sbsTE/3JOsON3CMqjOQkI1ZKjDSF1gtrG
+SmatgjqsMnlPUJkFEsPhFg6NTf1ZUjFiQeWEli0fQJ2/k+7MI4S0t0pDJJJWrqF4
+l6eSgu8rsBoXXHy4OLAz6j23r2k5FZs6H/poII95ia+E8hG8SrJmMa88naRdq7hH
+W802Z6lEhnRWND+tDGjt0ZaTfxx+CxN4UjgbboOJifTykVHjuzBR1+IzLHcxoZCL
+P1cjadSqMz5bziJTGtHzYwIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQAQnfs7UO2g
+iilUgCQAfa9Vb0ZSivD7ryjnLsdwYRLIlb0YceME9qtSv2UYBfS9KpwG7+jONMQB
+kvbe611/TaF0T7EC1GIWuTMs8jknJ2bgPbS8D8jiFWTci+SDDog4EVoakSLoirW6
+yB4398upjtanAdnjoNpE4REXPDHzDm2Dico2RCObJh1VAEK+q6gLJxQtGvdPyG3L
+Fhjs7ky1lsxIvHlts8c1e4vhnVpxdS3I5r6N38qFXEJnc1tv/e+TH50mdrZlzRHF
+TPgnZzWCGTHmT5YT3yoAldWG4uWzMsB+2eY/crRefM9byc0omjCxDTrk9nA6JWsf
+0c6pBc6aKzdi
-----END CERTIFICATE-----
diff --git a/src/test/ssl/ssl/client_ca.crt b/src/test/ssl/ssl/client_ca.crt
index ef48749f76..31867bd0f4 100644
--- a/src/test/ssl/ssl/client_ca.crt
+++ b/src/test/ssl/ssl/client_ca.crt
@@ -1,19 +1,22 @@
-----BEGIN CERTIFICATE-----
-MIIDFDCCAfygAwIBAgIIICEDAxQSBwEwDQYJKoZIhvcNAQELBQAwQDE+MDwGA1UE
+MIIDnjCCAoagAwIBAgIIICMHExY1IwEwDQYJKoZIhvcNAQELBQAwQDE+MDwGA1UE
Aww1VGVzdCByb290IENBIGZvciBQb3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRl
-c3Qgc3VpdGUwHhcNMjEwMzAzMjIxMjA3WhcNNDgwNzE5MjIxMjA3WjBCMUAwPgYD
-VQQDDDdUZXN0IENBIGZvciBQb3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRlc3Qg
-Y2xpZW50IGNlcnRzMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu+ce
-8rkNfoCvI9Wjug9pxsptsdjhZ4s7ZZ8eD5VlloryK2JccusQIX61XY8I3OZjLTgq
-1SpZbHQvktRH6gmU7tfoBdEnRuXB7idkbYOKIrC0hdttb/5rDzjQGtXTmwoVrCcJ
-nvO1Whay/gdsoqX1tT1MTPWu/6dfQkQXA0PizVvmBasAEQchxqtcH2rSc6TPE13v
-lxJ0X1vSlz92uT6kenrxUDs43AH/kASdIQBHXVA4XWBAm7NRqwKX7BBwbsF2m3Qh
-+NY9Bf9MnJHLcnVnwZdlW5nd7H7BTB43XvkiYascqusYki+fY58eGSprZ/VUjmGx
-pgQnQXWCu0U3JyUL/QIDAQABoxAwDjAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEB
-CwUAA4IBAQC1syY2Rk02m5PGtfkMUIU7ZSe0mM+g0BgWAyCF/mFFYdfY0xHtqy0x
-QWkW9OR0KBl4JpphDDolHoNL3TLydH3t4inX8SAOpaUdsjMcIPKqjT1htQm0Pk5r
-vFYvKuVrxMnV0F+wMmZRuziKWrZlVDwBMfCAchzuVexDWfcjTmUQmhZxJuUzORw3
-swgh9HIpxjMkgdlHodbMAEpMIkkoeJnph3I9uTocXZbK/lAInggQdm0Q+on1ZT0A
-ljO/6jisDZzIguE4ZAQ2DfYsGI8H3tz/+76uIwwBNOmu0woUDSWXVcPWiviq49Bi
-GmH0KlUfWAphj86IfTWXT1HRay3eZQt3
+c3Qgc3VpdGUwIBcNMjMwNzEzMTQzNTIzWhgPMjA1MDExMjgxNDM1MjNaMEIxQDA+
+BgNVBAMMN1Rlc3QgQ0EgZm9yIFBvc3RncmVTUUwgU1NMIHJlZ3Jlc3Npb24gdGVz
+dCBjbGllbnQgY2VydHMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC7
+5x7yuQ1+gK8j1aO6D2nGym2x2OFniztlnx4PlWWWivIrYlxy6xAhfrVdjwjc5mMt
+OCrVKllsdC+S1EfqCZTu1+gF0SdG5cHuJ2Rtg4oisLSF221v/msPONAa1dObChWs
+Jwme87VaFrL+B2yipfW1PUxM9a7/p19CRBcDQ+LNW+YFqwARByHGq1wfatJzpM8T
+Xe+XEnRfW9KXP3a5PqR6evFQOzjcAf+QBJ0hAEddUDhdYECbs1GrApfsEHBuwXab
+dCH41j0F/0yckctydWfBl2Vbmd3sfsFMHjde+SJhqxyq6xiSL59jnx4ZKmtn9VSO
+YbGmBCdBdYK7RTcnJQv9AgMBAAGjgZcwgZQwDAYDVR0TBAUwAwEB/zAdBgNVHQ4E
+FgQUn6Tr0smZ3rADsDA0IoFhFUu9rTYwZQYDVR0jBF4wXKFEpEIwQDE+MDwGA1UE
+Aww1VGVzdCByb290IENBIGZvciBQb3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRl
+c3Qgc3VpdGWCFBfnvJQgNLw9MyrcSA1T3Q2PyJIFMA0GCSqGSIb3DQEBCwUAA4IB
+AQAbYUfwGvV4u5Gpbhv5yxdueC0faKVIEXYRnT4Dky01cV7pGkFSFndlA2mFsj1g
+uuzkTFPMedcBefMoq2o2eX2B4ogrFHovxELI82i9pbv/MmsGNYwbMsp2lnUhNWon
+QwxFqMGA5Y2p8vyEG7lrHKiFDdt7uPxcOeTiWo0ZpC8uThqiR4fUkPinQ3EHEFGQ
++zl+G3pb4VRUzsyqh2n9swudqQcwjsDlQlkQ2vzVb6IWWiUCwL3V7HGPGmlVbsFG
+nQ1M44aBtWbBQtubfBRwYb5r+4sRN94LST6Phmhnd/AJccIKdCaheq+yLVVGiCJN
+3nDTmgTVSSmOm/RRmSXNp7AH
-----END CERTIFICATE-----
diff --git a/src/test/ssl/ssl/client_ext.crt b/src/test/ssl/ssl/client_ext.crt
index 9874ce49b9..5204391e46 100644
--- a/src/test/ssl/ssl/client_ext.crt
+++ b/src/test/ssl/ssl/client_ext.crt
@@ -1,21 +1,20 @@
-----BEGIN CERTIFICATE-----
-MIIDezCCAmOgAwIBAgIIICEREAQyQQAwDQYJKoZIhvcNAQELBQAwQjFAMD4GA1UE
+MIIDQTCCAimgAwIBAgIIICMHExY1JAMwDQYJKoZIhvcNAQELBQAwQjFAMD4GA1UE
Aww3VGVzdCBDQSBmb3IgUG9zdGdyZVNRTCBTU0wgcmVncmVzc2lvbiB0ZXN0IGNs
-aWVudCBjZXJ0czAeFw0yMTExMTAwMzMyNDFaFw00OTAzMjgwMzMyNDFaMBYxFDAS
-BgNVBAMMC3NzbHRlc3R1c2VyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
-AQEArCHikkEQLFITbn3ZfO8X2RW3fELeaImgy8W4Pkkc4LxdHCWjdCML/vtE/ZVu
-Op74qrQQWT0HKXFVUiZLbjAgV2PONS6VFHhc3sTFxuTaBnVdY+K98hoFnXskINt/
-wgwUhRcRZuKPcZvEHiqF6e3g3lQa99l1nVKPGPLOCvVhSgoV0Gwgxok0t7s25BCV
-ZmpMAwSTxpeviLF0e2MsttuyClQ4nuD92EHZX3BuG0WNPLxiwikV96uMffpMRGsx
-uiAHzD5ykYM7/b3eU0bjfi0J0qcfTSeytqFuRCNEukJpmtUmyYGqsFJ7HN7ejCY7
-ObAlBn8h+4bgwBRaeZDZLTMaYQIDAQABo4GgMIGdMAwGA1UdEwEB/wQCMAAwEwYD
+aWVudCBjZXJ0czAgFw0yMzA2MjkwMTAxMDFaGA8yMDUwMDEwMTAxMDEwMVowFjEU
+MBIGA1UEAwwLc3NsdGVzdHVzZXIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
+AoIBAQCsIeKSQRAsUhNufdl87xfZFbd8Qt5oiaDLxbg+SRzgvF0cJaN0Iwv++0T9
+lW46nviqtBBZPQcpcVVSJktuMCBXY841LpUUeFzexMXG5NoGdV1j4r3yGgWdeyQg
+23/CDBSFFxFm4o9xm8QeKoXp7eDeVBr32XWdUo8Y8s4K9WFKChXQbCDGiTS3uzbk
+EJVmakwDBJPGl6+IsXR7Yyy227IKVDie4P3YQdlfcG4bRY08vGLCKRX3q4x9+kxE
+azG6IAfMPnKRgzv9vd5TRuN+LQnSpx9NJ7K2oW5EI0S6Qmma1SbJgaqwUnsc3t6M
+Jjs5sCUGfyH7huDAFFp5kNktMxphAgMBAAGjZTBjMAwGA1UdEwEB/wQCMAAwEwYD
VR0lBAwwCgYIKwYBBQUHAwIwHQYDVR0OBBYEFPPv1n7k1Vd9BBC4eoGWPZwVz2Lx
-MFkGA1UdIwRSMFChRKRCMEAxPjA8BgNVBAMMNVRlc3Qgcm9vdCBDQSBmb3IgUG9z
-dGdyZVNRTCBTU0wgcmVncmVzc2lvbiB0ZXN0IHN1aXRlggggIQMDFBIHATANBgkq
-hkiG9w0BAQsFAAOCAQEAtqIeTmUhtHyCt5k2yx88F0dKshYq4Z+LQI+agyZ1fRE6
-Ux5p+SBGbzvc+NcUvc7yGG6w2G/nTVnGwSHN9NtQa2T2XbHJysJ/dwCfmRsachKz
-4kCp0zAHEDrEmZua0sy5BLwwVCk5WNBR0lZ35WmIEuRA+5G/2lCywtrb9W4YnbAM
-nH7BtZE8qPbK4OicB40I2NXz6KhG3755oKN03VC1IaX9JFQxf37ac7jVK5bsjfaF
-0xCAeuDN6wDiVHZj6q1GhhmNLzaF5zmU2e/cI1nTI5tfGKnygavlZIz2VvAlcypt
-YZdMDy69VbTWUa57UPCspghgvm5M2/Hjmz50CXGMvw==
+MB8GA1UdIwQYMBaAFJ+k69LJmd6wA7AwNCKBYRVLva02MA0GCSqGSIb3DQEBCwUA
+A4IBAQBsDUu6W6jXfgOkBGhZpwTtpThQ3fizEmBLXiy479Sa27YzdXCrLkql+XDv
+Z0nh8t7gvSw5ZCl9eZ13yg9etAfGCkNtkI37EVh4rMMqP3NkjBT2qwdG+pfwcF/c
++vrSK3H47lVIE5AShJJAwlU0Thf1bfyjzTnoGxEj2+YBMMhAykp9XbAgtM14hCQV
+07niaMv4kmmHDoUU72UH7GYnfnsCkUKhbisw7qOojd4MPX/kvU77+S3UURHJKKHy
+Rag+GP03NeF+d1z3niVBOIXE6hzlfaxB0w0SW7fXgQFYRBujTUYdcSZ5ZuT9kHyH
+9zHx+isaomV7U7yIQ9mGT/fDugki
-----END CERTIFICATE-----
diff --git a/src/test/ssl/ssl/root+client-crldir/9bb9e3c3.r0 b/src/test/ssl/ssl/root+client-crldir/9bb9e3c3.r0
index f75eb1c0bc..202f9f44d0 100644
--- a/src/test/ssl/ssl/root+client-crldir/9bb9e3c3.r0
+++ b/src/test/ssl/ssl/root+client-crldir/9bb9e3c3.r0
@@ -1,12 +1,12 @@
-----BEGIN X509 CRL-----
-MIIBwDCBqTANBgkqhkiG9w0BAQsFADBCMUAwPgYDVQQDDDdUZXN0IENBIGZvciBQ
-b3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRlc3QgY2xpZW50IGNlcnRzFw0yMjA3
-MTgyMjI4MTVaFw00OTEyMDMyMjI4MTVaMDYwGQIIICEDAxQSBwEXDTIyMDcxODIy
-MjgxNVowGQIIICIHGBUoFQAXDTIyMDcxODIyMjgxNVowDQYJKoZIhvcNAQELBQAD
-ggEBAFDH3m9AHpDjkEFjO6svnLJ2bTliGeKZaJW8/RAN4mWvWDhXDQfzqGcFHN2a
-SIL57Xc4PdwTiXuU4QEP4RvWW90LYKdcrcT8uh0AN3i7ShMwcV7I7owzF5+CBuT7
-Ev0MU4QIz0PjXoybXP6b3wHhZbEjYTLYdnYdqjrsAchUpyDQn6fiC0C7FgjCi4HL
-rNm2kMchFpzd6K9e41kxWVp7xCPXgqUK8OrxlW56ObkX8UpBIZzyU6RisJKOZJAn
-/+lwT43yTtU739atdXdSMvGHT9Y7LsrSDz9zgp2/iMTmfctnPcp81J/6jQZEP8kx
-OyPyZz4xy/EShWy+KUklfOoKRo8=
+MIIBwjCBqzANBgkqhkiG9w0BAQsFADBCMUAwPgYDVQQDDDdUZXN0IENBIGZvciBQ
+b3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRlc3QgY2xpZW50IGNlcnRzFw0yMzA3
+MTMxNDM1MjRaGA8yMDUwMTEyODE0MzUyNFowNjAZAgggIwcTFjUkAhcNMjMwNzEz
+MTQzNTI0WjAZAgggIwcTFjUkBRcNMjMwNzEzMTQzNTI0WjANBgkqhkiG9w0BAQsF
+AAOCAQEAl2jqLuwUgUTtzIKdLyAqIGf+zG0jfJXD9KFIsPeR+zfYWyNVzlWav68e
+zcLLhr9NWzHCXo0F5yiWVIO9pe2OF980Ez/24fTd6NPk3qG9AzLeLQ0jPhEgLaDw
+KFSTuaTbEuAUBGHMTjdoe6aOGsypUOXxse/G5enyx93yCC7boFkrYscfnQT2kFZT
+60Bhfr/4qkFdGJbp9ZIsTP8us4sktEDFn24Tq5f8sW7JyqIU83LRhjkIc8NALGCE
+DE7FgaGVUyuH8jYkVw4XLMwYo9gAy95pBxrDFq/r0Zm4E1rIEr8x7Ji7smUcubrb
+/MXu7OCXst4uzoRxFQctnP19AYIKZQ==
-----END X509 CRL-----
diff --git a/src/test/ssl/ssl/root+client.crl b/src/test/ssl/ssl/root+client.crl
index 459f48da43..2e0616905c 100644
--- a/src/test/ssl/ssl/root+client.crl
+++ b/src/test/ssl/ssl/root+client.crl
@@ -10,14 +10,14 @@ SBNr2rpYp7Coc3GeCoWPcClgSrABD3Z5GY1YAdLGiXVKaH3CmdJTznhEPagE4z5R
+GrJP3XxJ1OC
-----END X509 CRL-----
-----BEGIN X509 CRL-----
-MIIBwDCBqTANBgkqhkiG9w0BAQsFADBCMUAwPgYDVQQDDDdUZXN0IENBIGZvciBQ
-b3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRlc3QgY2xpZW50IGNlcnRzFw0yMjA3
-MTgyMjI4MTVaFw00OTEyMDMyMjI4MTVaMDYwGQIIICEDAxQSBwEXDTIyMDcxODIy
-MjgxNVowGQIIICIHGBUoFQAXDTIyMDcxODIyMjgxNVowDQYJKoZIhvcNAQELBQAD
-ggEBAFDH3m9AHpDjkEFjO6svnLJ2bTliGeKZaJW8/RAN4mWvWDhXDQfzqGcFHN2a
-SIL57Xc4PdwTiXuU4QEP4RvWW90LYKdcrcT8uh0AN3i7ShMwcV7I7owzF5+CBuT7
-Ev0MU4QIz0PjXoybXP6b3wHhZbEjYTLYdnYdqjrsAchUpyDQn6fiC0C7FgjCi4HL
-rNm2kMchFpzd6K9e41kxWVp7xCPXgqUK8OrxlW56ObkX8UpBIZzyU6RisJKOZJAn
-/+lwT43yTtU739atdXdSMvGHT9Y7LsrSDz9zgp2/iMTmfctnPcp81J/6jQZEP8kx
-OyPyZz4xy/EShWy+KUklfOoKRo8=
+MIIBwjCBqzANBgkqhkiG9w0BAQsFADBCMUAwPgYDVQQDDDdUZXN0IENBIGZvciBQ
+b3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRlc3QgY2xpZW50IGNlcnRzFw0yMzA3
+MTMxNDM1MjRaGA8yMDUwMTEyODE0MzUyNFowNjAZAgggIwcTFjUkAhcNMjMwNzEz
+MTQzNTI0WjAZAgggIwcTFjUkBRcNMjMwNzEzMTQzNTI0WjANBgkqhkiG9w0BAQsF
+AAOCAQEAl2jqLuwUgUTtzIKdLyAqIGf+zG0jfJXD9KFIsPeR+zfYWyNVzlWav68e
+zcLLhr9NWzHCXo0F5yiWVIO9pe2OF980Ez/24fTd6NPk3qG9AzLeLQ0jPhEgLaDw
+KFSTuaTbEuAUBGHMTjdoe6aOGsypUOXxse/G5enyx93yCC7boFkrYscfnQT2kFZT
+60Bhfr/4qkFdGJbp9ZIsTP8us4sktEDFn24Tq5f8sW7JyqIU83LRhjkIc8NALGCE
+DE7FgaGVUyuH8jYkVw4XLMwYo9gAy95pBxrDFq/r0Zm4E1rIEr8x7Ji7smUcubrb
+/MXu7OCXst4uzoRxFQctnP19AYIKZQ==
-----END X509 CRL-----
diff --git a/src/test/ssl/ssl/root+client_ca.crt b/src/test/ssl/ssl/root+client_ca.crt
index 7819c54828..ff8281fba0 100644
--- a/src/test/ssl/ssl/root+client_ca.crt
+++ b/src/test/ssl/ssl/root+client_ca.crt
@@ -18,21 +18,24 @@ OCZhKLxVZiZmO71BBwsTgwtU58/G9e2ciGGdltI8ANlmVfdtwgRz3b7H9EUZat6s
kubl/m5HWBsKJEWEzFWrWkQV3ipoTmorJ6KCGABBCeVYmg==
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
-MIIDFDCCAfygAwIBAgIIICEDAxQSBwEwDQYJKoZIhvcNAQELBQAwQDE+MDwGA1UE
+MIIDnjCCAoagAwIBAgIIICMHExY1IwEwDQYJKoZIhvcNAQELBQAwQDE+MDwGA1UE
Aww1VGVzdCByb290IENBIGZvciBQb3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRl
-c3Qgc3VpdGUwHhcNMjEwMzAzMjIxMjA3WhcNNDgwNzE5MjIxMjA3WjBCMUAwPgYD
-VQQDDDdUZXN0IENBIGZvciBQb3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRlc3Qg
-Y2xpZW50IGNlcnRzMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu+ce
-8rkNfoCvI9Wjug9pxsptsdjhZ4s7ZZ8eD5VlloryK2JccusQIX61XY8I3OZjLTgq
-1SpZbHQvktRH6gmU7tfoBdEnRuXB7idkbYOKIrC0hdttb/5rDzjQGtXTmwoVrCcJ
-nvO1Whay/gdsoqX1tT1MTPWu/6dfQkQXA0PizVvmBasAEQchxqtcH2rSc6TPE13v
-lxJ0X1vSlz92uT6kenrxUDs43AH/kASdIQBHXVA4XWBAm7NRqwKX7BBwbsF2m3Qh
-+NY9Bf9MnJHLcnVnwZdlW5nd7H7BTB43XvkiYascqusYki+fY58eGSprZ/VUjmGx
-pgQnQXWCu0U3JyUL/QIDAQABoxAwDjAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEB
-CwUAA4IBAQC1syY2Rk02m5PGtfkMUIU7ZSe0mM+g0BgWAyCF/mFFYdfY0xHtqy0x
-QWkW9OR0KBl4JpphDDolHoNL3TLydH3t4inX8SAOpaUdsjMcIPKqjT1htQm0Pk5r
-vFYvKuVrxMnV0F+wMmZRuziKWrZlVDwBMfCAchzuVexDWfcjTmUQmhZxJuUzORw3
-swgh9HIpxjMkgdlHodbMAEpMIkkoeJnph3I9uTocXZbK/lAInggQdm0Q+on1ZT0A
-ljO/6jisDZzIguE4ZAQ2DfYsGI8H3tz/+76uIwwBNOmu0woUDSWXVcPWiviq49Bi
-GmH0KlUfWAphj86IfTWXT1HRay3eZQt3
+c3Qgc3VpdGUwIBcNMjMwNzEzMTQzNTIzWhgPMjA1MDExMjgxNDM1MjNaMEIxQDA+
+BgNVBAMMN1Rlc3QgQ0EgZm9yIFBvc3RncmVTUUwgU1NMIHJlZ3Jlc3Npb24gdGVz
+dCBjbGllbnQgY2VydHMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC7
+5x7yuQ1+gK8j1aO6D2nGym2x2OFniztlnx4PlWWWivIrYlxy6xAhfrVdjwjc5mMt
+OCrVKllsdC+S1EfqCZTu1+gF0SdG5cHuJ2Rtg4oisLSF221v/msPONAa1dObChWs
+Jwme87VaFrL+B2yipfW1PUxM9a7/p19CRBcDQ+LNW+YFqwARByHGq1wfatJzpM8T
+Xe+XEnRfW9KXP3a5PqR6evFQOzjcAf+QBJ0hAEddUDhdYECbs1GrApfsEHBuwXab
+dCH41j0F/0yckctydWfBl2Vbmd3sfsFMHjde+SJhqxyq6xiSL59jnx4ZKmtn9VSO
+YbGmBCdBdYK7RTcnJQv9AgMBAAGjgZcwgZQwDAYDVR0TBAUwAwEB/zAdBgNVHQ4E
+FgQUn6Tr0smZ3rADsDA0IoFhFUu9rTYwZQYDVR0jBF4wXKFEpEIwQDE+MDwGA1UE
+Aww1VGVzdCByb290IENBIGZvciBQb3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRl
+c3Qgc3VpdGWCFBfnvJQgNLw9MyrcSA1T3Q2PyJIFMA0GCSqGSIb3DQEBCwUAA4IB
+AQAbYUfwGvV4u5Gpbhv5yxdueC0faKVIEXYRnT4Dky01cV7pGkFSFndlA2mFsj1g
+uuzkTFPMedcBefMoq2o2eX2B4ogrFHovxELI82i9pbv/MmsGNYwbMsp2lnUhNWon
+QwxFqMGA5Y2p8vyEG7lrHKiFDdt7uPxcOeTiWo0ZpC8uThqiR4fUkPinQ3EHEFGQ
++zl+G3pb4VRUzsyqh2n9swudqQcwjsDlQlkQ2vzVb6IWWiUCwL3V7HGPGmlVbsFG
+nQ1M44aBtWbBQtubfBRwYb5r+4sRN94LST6Phmhnd/AJccIKdCaheq+yLVVGiCJN
+3nDTmgTVSSmOm/RRmSXNp7AH
-----END CERTIFICATE-----
diff --git a/src/test/ssl/ssl/root+server-crldir/a836cc2d.r0 b/src/test/ssl/ssl/root+server-crldir/a836cc2d.r0
index 331a83cb62..7ed68e0220 100644
--- a/src/test/ssl/ssl/root+server-crldir/a836cc2d.r0
+++ b/src/test/ssl/ssl/root+server-crldir/a836cc2d.r0
@@ -1,11 +1,11 @@
-----BEGIN X509 CRL-----
-MIIBpTCBjjANBgkqhkiG9w0BAQsFADBCMUAwPgYDVQQDDDdUZXN0IENBIGZvciBQ
-b3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRlc3Qgc2VydmVyIGNlcnRzFw0yMTAz
-MDMyMjEyMDdaFw00ODA3MTkyMjEyMDdaMBswGQIIICEDAxQSBwUXDTIxMDMwMzIy
-MTIwN1owDQYJKoZIhvcNAQELBQADggEBAJxj0taZYIIxUsCuXR5CN2OymjMvRwmV
-+10VOkyBQ3VkzHlXeJkmZsU2Dvmc205l9OYouh/faL0TfK2NyhmBo+MrTizL9TBo
-4u2es/0oJGj2wyNMkRs0SlSJelakvGFBvSKfqoV0l2O1WDV7M4KtdC8ZVZipmL4R
-ac4hBMK0ifHuTS5Od6o0C2RijEPCHMXaS/LkWpBqcStI2oirhjo+Th1wxTMGUVFy
-imVvt6D6QqqHCUYrvcNEN0xBNFwJGq/0cgSy+w5szt/RRehmJKX8MbNeZxrznIIx
-B18ch9rbBltz+Y4R63rCN9MdsnGXf6PQ6a6doZhSI1pnDrui12MOQrU=
+MIIBpzCBkDANBgkqhkiG9w0BAQsFADBCMUAwPgYDVQQDDDdUZXN0IENBIGZvciBQ
+b3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRlc3Qgc2VydmVyIGNlcnRzFw0yMzA3
+MTMxNDM1MjRaGA8yMDUwMTEyODE0MzUyNFowGzAZAgggIwcTFjUjCxcNMjMwNzEz
+MTQzNTI0WjANBgkqhkiG9w0BAQsFAAOCAQEADIkF8oS84O2PJw/C9BAzgrkd+EsO
+QL6mXUGBgXwmujfpv0Z8YK91k4+xV9hQRMjWe/DkU01+gmFhYoDvAzweuNQzx8lZ
+bYKu0dGTEpTd+OG1LbxYmt4f5xh096R5iLo7c7e2kMHvfNG7VwvKQrPeMqh7AcKy
+Fukt8C0Xc7Tfv2l2toEQUAl5UDUKEAovN6iB0qycpvi0nboyiDo8mV0p1jlAn846
+EeXjwm8tyGXzTFq16ypPwnlBM9d5Ml/p5WTN69nDux18G+iSCr+UDzLDYvLF11p3
+lEqpSo5lQg9zYuOgMCvu3g5BtwJgORPSiW/yZ5BXUfWvPi0XRPrknxMByA==
-----END X509 CRL-----
diff --git a/src/test/ssl/ssl/root+server.crl b/src/test/ssl/ssl/root+server.crl
index 8b0c716d63..93ffa5986e 100644
--- a/src/test/ssl/ssl/root+server.crl
+++ b/src/test/ssl/ssl/root+server.crl
@@ -10,13 +10,13 @@ SBNr2rpYp7Coc3GeCoWPcClgSrABD3Z5GY1YAdLGiXVKaH3CmdJTznhEPagE4z5R
+GrJP3XxJ1OC
-----END X509 CRL-----
-----BEGIN X509 CRL-----
-MIIBpTCBjjANBgkqhkiG9w0BAQsFADBCMUAwPgYDVQQDDDdUZXN0IENBIGZvciBQ
-b3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRlc3Qgc2VydmVyIGNlcnRzFw0yMTAz
-MDMyMjEyMDdaFw00ODA3MTkyMjEyMDdaMBswGQIIICEDAxQSBwUXDTIxMDMwMzIy
-MTIwN1owDQYJKoZIhvcNAQELBQADggEBAJxj0taZYIIxUsCuXR5CN2OymjMvRwmV
-+10VOkyBQ3VkzHlXeJkmZsU2Dvmc205l9OYouh/faL0TfK2NyhmBo+MrTizL9TBo
-4u2es/0oJGj2wyNMkRs0SlSJelakvGFBvSKfqoV0l2O1WDV7M4KtdC8ZVZipmL4R
-ac4hBMK0ifHuTS5Od6o0C2RijEPCHMXaS/LkWpBqcStI2oirhjo+Th1wxTMGUVFy
-imVvt6D6QqqHCUYrvcNEN0xBNFwJGq/0cgSy+w5szt/RRehmJKX8MbNeZxrznIIx
-B18ch9rbBltz+Y4R63rCN9MdsnGXf6PQ6a6doZhSI1pnDrui12MOQrU=
+MIIBpzCBkDANBgkqhkiG9w0BAQsFADBCMUAwPgYDVQQDDDdUZXN0IENBIGZvciBQ
+b3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRlc3Qgc2VydmVyIGNlcnRzFw0yMzA3
+MTMxNDM1MjRaGA8yMDUwMTEyODE0MzUyNFowGzAZAgggIwcTFjUjCxcNMjMwNzEz
+MTQzNTI0WjANBgkqhkiG9w0BAQsFAAOCAQEADIkF8oS84O2PJw/C9BAzgrkd+EsO
+QL6mXUGBgXwmujfpv0Z8YK91k4+xV9hQRMjWe/DkU01+gmFhYoDvAzweuNQzx8lZ
+bYKu0dGTEpTd+OG1LbxYmt4f5xh096R5iLo7c7e2kMHvfNG7VwvKQrPeMqh7AcKy
+Fukt8C0Xc7Tfv2l2toEQUAl5UDUKEAovN6iB0qycpvi0nboyiDo8mV0p1jlAn846
+EeXjwm8tyGXzTFq16ypPwnlBM9d5Ml/p5WTN69nDux18G+iSCr+UDzLDYvLF11p3
+lEqpSo5lQg9zYuOgMCvu3g5BtwJgORPSiW/yZ5BXUfWvPi0XRPrknxMByA==
-----END X509 CRL-----
diff --git a/src/test/ssl/ssl/root+server_ca.crt b/src/test/ssl/ssl/root+server_ca.crt
index 5074f4fa9b..a094886e0f 100644
--- a/src/test/ssl/ssl/root+server_ca.crt
+++ b/src/test/ssl/ssl/root+server_ca.crt
@@ -18,21 +18,24 @@ OCZhKLxVZiZmO71BBwsTgwtU58/G9e2ciGGdltI8ANlmVfdtwgRz3b7H9EUZat6s
kubl/m5HWBsKJEWEzFWrWkQV3ipoTmorJ6KCGABBCeVYmg==
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
-MIIDFDCCAfygAwIBAgIIICEDAxQSBwAwDQYJKoZIhvcNAQELBQAwQDE+MDwGA1UE
+MIIDnjCCAoagAwIBAgIIICMHExY1IwAwDQYJKoZIhvcNAQELBQAwQDE+MDwGA1UE
Aww1VGVzdCByb290IENBIGZvciBQb3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRl
-c3Qgc3VpdGUwHhcNMjEwMzAzMjIxMjA3WhcNNDgwNzE5MjIxMjA3WjBCMUAwPgYD
-VQQDDDdUZXN0IENBIGZvciBQb3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRlc3Qg
-c2VydmVyIGNlcnRzMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4kp2
-GW5nPb6QrSrtbClfZeutyQnHrm4TMPBoNepFdIVxBX/04BguM5ImDRze/huOWA+z
-atJAQqt3R7dsDwnOnPKUKCOuHX6a1aj5L86HtVgaWTXrZFE5NtL9PIzXkWu13UW0
-UesHtbPVRv6a6fB7Npph6hHy7iPZb009A8/lTJnxSPC39u/K/sPqjrVZaAJF+wDs
-qCxCZTUtAUFvWFnR/TeXLWlFzBupS1djgI7PltbJqSn6SKTAgNZTxpRJbu9Icp6J
-/50ELwT++0n0KWVXNHrDNfI5Gaa+SxClAsPsei2jLKpgR6QFC3wn38Z9q9LjAVuC
-+FWhoN1uhYeoricEXwIDAQABoxAwDjAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEB
-CwUAA4IBAQCdCA/EoXrustoV4jJGbkdXDuOUkBurwggSNBAqUBSDvCohRoD77Ecb
-QVuzPNxWKG+E4PwfUq2ha+2yPONEJ28ZgsbHq5qlJDMJ43wlcjn6wmmAJNeSpO8F
-0V9d2X/4wNZty9/zbwTnw26KChgDHumQ0WIbCoBtdqy8KDswYOvpgws6dqc021I7
-UrFo6vZek7VoApbJgkDL6qYADa6ApfW43ThH4sViFITeYt/kSHgmy2Udhs34jMM8
-xsFP/uYpRi1b1glenwSIKiHjD4/C9vnWQt5K3gRBvYukEj2Bw9VkNRpBVCi0cOoA
-OuwX3bwzNYNbZQv4K66oRpvuoEjCNeHg
+c3Qgc3VpdGUwIBcNMjMwNzEzMTQzNTIzWhgPMjA1MDExMjgxNDM1MjNaMEIxQDA+
+BgNVBAMMN1Rlc3QgQ0EgZm9yIFBvc3RncmVTUUwgU1NMIHJlZ3Jlc3Npb24gdGVz
+dCBzZXJ2ZXIgY2VydHMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDi
+SnYZbmc9vpCtKu1sKV9l663JCceubhMw8Gg16kV0hXEFf/TgGC4zkiYNHN7+G45Y
+D7Nq0kBCq3dHt2wPCc6c8pQoI64dfprVqPkvzoe1WBpZNetkUTk20v08jNeRa7Xd
+RbRR6we1s9VG/prp8Hs2mmHqEfLuI9lvTT0Dz+VMmfFI8Lf278r+w+qOtVloAkX7
+AOyoLEJlNS0BQW9YWdH9N5ctaUXMG6lLV2OAjs+W1smpKfpIpMCA1lPGlElu70hy
+non/nQQvBP77SfQpZVc0esM18jkZpr5LEKUCw+x6LaMsqmBHpAULfCffxn2r0uMB
+W4L4VaGg3W6Fh6iuJwRfAgMBAAGjgZcwgZQwDAYDVR0TBAUwAwEB/zAdBgNVHQ4E
+FgQU8o86ZkBQZEgi1y6C/1aewrPudAowZQYDVR0jBF4wXKFEpEIwQDE+MDwGA1UE
+Aww1VGVzdCByb290IENBIGZvciBQb3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRl
+c3Qgc3VpdGWCFBfnvJQgNLw9MyrcSA1T3Q2PyJIFMA0GCSqGSIb3DQEBCwUAA4IB
+AQANlEDrM357a7o+WcKB0Ocll2UtBMq7PDms1Pjqm3fFu/wdKDUomG8W2/MgDmFl
+CVeAPpofb6J0oaxiEZOR68pOhdccMznArtKix6t3RkDiXdm4d5UORMMR+s9CymXV
+MUTWpQpAg3qP3mRI+3E9OrgfhvmVcuOa7/cdTS/sylGe8Db+nJQD0be9NHtnhO56
+IA+Li+8oWzD4UNsP3gAmhLkyToz5wlPHzEkgGxkEySNErEOKTOX5Xyk5z+QToRhz
+adkt0mBw/dxoJk9DveCtIqxDelxJsDeJFtqoc5qVVE9yOp7rujGsqgWl2PcJeyKM
+Crh9qsqNzJ2R29pq0g6Lfzh2
-----END CERTIFICATE-----
diff --git a/src/test/ssl/ssl/server-cn-and-alt-names.crt b/src/test/ssl/ssl/server-cn-and-alt-names.crt
index 12d1ec363e..982c02a514 100644
--- a/src/test/ssl/ssl/server-cn-and-alt-names.crt
+++ b/src/test/ssl/ssl/server-cn-and-alt-names.crt
@@ -1,20 +1,22 @@
-----BEGIN CERTIFICATE-----
-MIIDVTCCAj2gAwIBAgIIICEDAxQSBwAwDQYJKoZIhvcNAQELBQAwQjFAMD4GA1UE
+MIIDmTCCAoGgAwIBAgIIICMHExY1IwAwDQYJKoZIhvcNAQELBQAwQjFAMD4GA1UE
Aww3VGVzdCBDQSBmb3IgUG9zdGdyZVNRTCBTU0wgcmVncmVzc2lvbiB0ZXN0IHNl
-cnZlciBjZXJ0czAeFw0yMTAzMDMyMjEyMDdaFw00ODA3MTkyMjEyMDdaMEYxHjAc
-BgNVBAsMFVBvc3RncmVTUUwgdGVzdCBzdWl0ZTEkMCIGA1UEAwwbY29tbW9uLW5h
-bWUucGctc3NsdGVzdC50ZXN0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
-AQEAwVES+mD1iY1UBGWNLsuBxGkyOGTI1X/sXcCUZ7aLOGkXHYatiUTcIrSNNAS5
-yCvbq/A/C1NuDw59nrU2TitcLBx5AIhz74EV+xv/u/GuX0gvJzDWh/6EeMzDIcJL
-Iq7iEgO8ff5fuAzuwuNguZkX51JjBiXc2rtfgPI3CMU1lqCbb2vW9ZN4Pm7wRqvd
-d/F/mySiFmLFsB4HLhCGZN89vO4cbslN4+YrGKEcHeXGWRaxv6gSXbpEgUYpefzz
-+QB7AepU5aWntm3X+E1we5AHLSKckwUdBuT5uYgmZcYA/kCC4/9RS02jTlu4Vfrd
-SemHwuo2UQ5ODJxzAhWrEl3F4QIDAQABo0swSTBHBgNVHREEQDA+gh1kbnMxLmFs
-dC1uYW1lLnBnLXNzbHRlc3QudGVzdIIdZG5zMi5hbHQtbmFtZS5wZy1zc2x0ZXN0
-LnRlc3QwDQYJKoZIhvcNAQELBQADggEBAG3dFQ/DqjFbjzIOni079R3I94lAZqbc
-cRUumDPSzihKwvCCnU5quqnYkOFISqBZsYmxR5fiHx4wT+jmWvLSltkaeS6gcGC1
-zuO8GFzL+PATUX63js8IfE3WYJE/bjmDVVzJOBArrbsExofdE2F2kkkLkjhk0ylg
-/TrAKtyqpsob0b4ZjMloR5JFHQXGHN/922x6Do1vduHMXlGckmR0sX6Mg/fiChVh
-vixUJje4W9ohft8G7lj3GnzI1gHEMp2PYKM+wqOug/gXEQuMIFlhjp2Mc6bAvFsD
-grgdAgcYUvgKukF9efJHq2V5XjqBWrmGAOQkiH1y+9gxhiHUiw+vojY=
+cnZlciBjZXJ0czAgFw0yMzA3MTMxNDM1MjNaGA8yMDUwMTEyODE0MzUyM1owRjEe
+MBwGA1UECwwVUG9zdGdyZVNRTCB0ZXN0IHN1aXRlMSQwIgYDVQQDDBtjb21tb24t
+bmFtZS5wZy1zc2x0ZXN0LnRlc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
+AoIBAQDBURL6YPWJjVQEZY0uy4HEaTI4ZMjVf+xdwJRntos4aRcdhq2JRNwitI00
+BLnIK9ur8D8LU24PDn2etTZOK1wsHHkAiHPvgRX7G/+78a5fSC8nMNaH/oR4zMMh
+wksiruISA7x9/l+4DO7C42C5mRfnUmMGJdzau1+A8jcIxTWWoJtva9b1k3g+bvBG
+q9138X+bJKIWYsWwHgcuEIZk3z287hxuyU3j5isYoRwd5cZZFrG/qBJdukSBRil5
+/PP5AHsB6lTlpae2bdf4TXB7kActIpyTBR0G5Pm5iCZlxgD+QILj/1FLTaNOW7hV
++t1J6YfC6jZRDk4MnHMCFasSXcXhAgMBAAGjgYwwgYkwRwYDVR0RBEAwPoIdZG5z
+MS5hbHQtbmFtZS5wZy1zc2x0ZXN0LnRlc3SCHWRuczIuYWx0LW5hbWUucGctc3Ns
+dGVzdC50ZXN0MB0GA1UdDgQWBBQnWI8n7O4aU6PooSwyIepyrEpsajAfBgNVHSME
+GDAWgBTyjzpmQFBkSCLXLoL/Vp7Cs+50CjANBgkqhkiG9w0BAQsFAAOCAQEAQk/M
+emDTPYUx/JrSdTyvVDeBaUMUjWQ78LO1j/2RqtBXh/tSnTvalOeuwBPqmz9+7HYR
+H2gYQNq4W1Y6SgTdbpEivEXPvp1XyQXtLMpwDGO4rKq3QOCOPX2zZLDPrRqGSev3
+jN7oV8C3yVUyhhSxu+BZo4lZ55soiehCjHNKR5xfcbR/AtshLullVNNqoGQQyalS
+9TNUKp7FqF52tIELvFMINoSf5aaLU1g7snxnVRbTFyne/oqeqFjW932M/vaFgAH7
+H8mfoJeAiG5GqVBKtf3kcakfBl1wjFCzpguvDd9Xi2AP1y3cPEotwFiKhCYMmGiA
+EnzrdmAeNGKb2w3wlA==
-----END CERTIFICATE-----
diff --git a/src/test/ssl/ssl/server-cn-and-ip-alt-names.crt b/src/test/ssl/ssl/server-cn-and-ip-alt-names.crt
index 4e58c85ccb..fea2703aaf 100644
--- a/src/test/ssl/ssl/server-cn-and-ip-alt-names.crt
+++ b/src/test/ssl/ssl/server-cn-and-ip-alt-names.crt
@@ -1,20 +1,21 @@
-----BEGIN CERTIFICATE-----
-MIIDLzCCAhegAwIBAgIIICERKRE1UQAwDQYJKoZIhvcNAQELBQAwQjFAMD4GA1UE
+MIIDcTCCAlmgAwIBAgIIICMHExY1IwEwDQYJKoZIhvcNAQELBQAwQjFAMD4GA1UE
Aww3VGVzdCBDQSBmb3IgUG9zdGdyZVNRTCBTU0wgcmVncmVzc2lvbiB0ZXN0IHNl
-cnZlciBjZXJ0czAeFw0yMTExMjkxOTM1NTFaFw00OTA0MTYxOTM1NTFaMEYxHjAc
-BgNVBAsMFVBvc3RncmVTUUwgdGVzdCBzdWl0ZTEkMCIGA1UEAwwbY29tbW9uLW5h
-bWUucGctc3NsdGVzdC50ZXN0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
-AQEA6+8IYKAFnZ7V+fDo1cyMpbGBLzCfJOQ/1o2jOGP4+GjpsZgv6S6UT2MheC8M
-iiEFrYwdsSIZyYc3jEZrluy/UuR0bCGtqU92BCqa0iBLhvHOgjR588u253eLxQtQ
-8iJn11QPrKMk35nMkmY8GfHt4sGFbvBL6+GpipHq7a6cde3Z+v4kCB5dKMYDUDtm
-3mJmviuGNAu5wOqItk2Yi5dwJs1054007KNH0Il43urxiOfnkLS0cG5kehboPf86
-vxBt3iHByrU/9/DY5IvQCfSXVNa6rb5w5/pGja9aCei6Mv1jQY/V8SMQTga+MOsA
-0WB9akxMi2NxwS2+BQ4k/McPlwIDAQABoyUwIzAhBgNVHREEGjAYhwTAAAIBhxAg
-AQ24AAAAAAAAAAAAAAABMA0GCSqGSIb3DQEBCwUAA4IBAQAQLo2RzC07dG9p+J3A
-W6C0p3Y+Os/YE2D9wfp4TIDTZxcRUQZ0S6ahF1N6sp8l9KHBJHPU1cUpRAU1oD+Y
-SqmnP/VJRRDTTj9Ytdc/Vuo2jeLpSYhVKrCqtjqIrCwYJFoYRmMoxTtJGlwA0hSd
-kwo3XYrALPUQWUErTYPvNfDNIuUwqUXNfS0CXuIOVN3LJ+shegg6Pwbh9B5T9NHx
-kH+HswajhdpdnZIgh0FYTlTCPILDrB49aOWwqLa54AUA6WXa35hPsP8SoqL9Eucq
-ifPhBYyadsjOb+70N8GbbAsDPN1jCX9L8RuNcEkxSCKCYx91cWXh7K5KMPuGlzB7
-j8xB
+cnZlciBjZXJ0czAgFw0yMzA3MTMxNDM1MjNaGA8yMDUwMTEyODE0MzUyM1owRjEe
+MBwGA1UECwwVUG9zdGdyZVNRTCB0ZXN0IHN1aXRlMSQwIgYDVQQDDBtjb21tb24t
+bmFtZS5wZy1zc2x0ZXN0LnRlc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
+AoIBAQDr7whgoAWdntX58OjVzIylsYEvMJ8k5D/WjaM4Y/j4aOmxmC/pLpRPYyF4
+LwyKIQWtjB2xIhnJhzeMRmuW7L9S5HRsIa2pT3YEKprSIEuG8c6CNHnzy7bnd4vF
+C1DyImfXVA+soyTfmcySZjwZ8e3iwYVu8Evr4amKkertrpx17dn6/iQIHl0oxgNQ
+O2beYma+K4Y0C7nA6oi2TZiLl3AmzXTnjTTso0fQiXje6vGI5+eQtLRwbmR6Fug9
+/zq/EG3eIcHKtT/38Njki9AJ9JdU1rqtvnDn+kaNr1oJ6Loy/WNBj9XxIxBOBr4w
+6wDRYH1qTEyLY3HBLb4FDiT8xw+XAgMBAAGjZTBjMCEGA1UdEQQaMBiHBMAAAgGH
+ECABDbgAAAAAAAAAAAAAAAEwHQYDVR0OBBYEFG+mujVw0u9XhfSYVs8/XJPwFCmF
+MB8GA1UdIwQYMBaAFPKPOmZAUGRIItcugv9WnsKz7nQKMA0GCSqGSIb3DQEBCwUA
+A4IBAQAm0M+VY4eZwfu47OPdiIJ4YxyGtcRCDDCuqZ8ACG7YH51Trhvm7SuHhGVQ
+aJvphWDPrt4e0Exmga0T8RJ2Xd49F9u21/biz+vvzdjpzcr3yd9YGQ2IoU35b3ln
+AVVB36i38eAOxYpSsv4CN01ilJYxhMdUQqRYjlagIYIp7dBwuQ7+uXUesBY6xgL/
+N0G+cUQuax8mokVB0HfNccbroXpJaz3fU1TSPiDgin7yMGkm9bTwj30pbesBOTID
+MqdYNodA7RIZslnmHn7q1rsGIBVUHrxUyH7/4m9ZbhI1Zz0VkoWAPklkqCO7moIb
+/oB/DmtwTndVB0urbGnEDzaoCntL
-----END CERTIFICATE-----
diff --git a/src/test/ssl/ssl/server-cn-only+server_ca.crt b/src/test/ssl/ssl/server-cn-only+server_ca.crt
index 9870e8c17a..71ede03546 100644
--- a/src/test/ssl/ssl/server-cn-only+server_ca.crt
+++ b/src/test/ssl/ssl/server-cn-only+server_ca.crt
@@ -1,38 +1,41 @@
-----BEGIN CERTIFICATE-----
-MIIDAzCCAesCCCAhAwMUEgcBMA0GCSqGSIb3DQEBCwUAMEIxQDA+BgNVBAMMN1Rl
+MIIDBTCCAe0CCCAjBxMWNSMCMA0GCSqGSIb3DQEBCwUAMEIxQDA+BgNVBAMMN1Rl
c3QgQ0EgZm9yIFBvc3RncmVTUUwgU1NMIHJlZ3Jlc3Npb24gdGVzdCBzZXJ2ZXIg
-Y2VydHMwHhcNMjEwMzAzMjIxMjA3WhcNNDgwNzE5MjIxMjA3WjBGMR4wHAYDVQQL
-DBVQb3N0Z3JlU1FMIHRlc3Qgc3VpdGUxJDAiBgNVBAMMG2NvbW1vbi1uYW1lLnBn
-LXNzbHRlc3QudGVzdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANWz
-VPMk7i5f+W0eEadRE+TTAtsIK08CkLMUnjs7zJkxnnm6RGBXPx6vK3AkAIi+wG4Y
-mXjYP3GuMiXaLjnWh2kzBSfIRQyNbTThnhSu3nDjAVkPexsSrPyiKimFuNgDfkGe
-5dQKa9Ag2SuVU4vd9SYxOMAiIFIC4ts4MLWWJf5D/PehdSuc0e5Me+91Nnbz90nl
-ds4lHvuDR+aKnZlTHmch3wfhXv7lNQImIBzfwl36Kd/bWB0fAEVFse3iZWmigaI/
-9FKh//WIq43TNLxn68OCQoyMe/HGjZDR/Xwo3rE6jg6/iAwSWib9yabfYPKbqq2G
-oFy6aYmmEquaDgLuX7kCAwEAATANBgkqhkiG9w0BAQsFAAOCAQEA2AZrD9cTQXTW
-4j2tT8N/TTc6WK2ncN4h22NTte6vK7MVwsZJCtw5ndYkmxcWkXAqiclzWyMdayds
-WOa12CEH7jKAhivF4Hcw3oO3JHM5BA6KzLWBVz9uZksOM6mPqn29DTKvA/Y1V8tj
-mxK/KUA68h/u6inu3mo4ywBpb/tqHxxg2cjyR0faCmM0pwRM0HBr/16fUMfO83nj
-QG8g9J/bybu5sYso/aSoC5nUNp4XjmDMdVLdqg/nTe/ejS8IfFr0WQxBlqooqFgx
-MSE+kX2e2fHsuOWSU/9eClt6FpQrwoC2C8F+/4g1Uz7Liqc4yMHPwjgeP9ewrrLO
-iIhlNNPqpQ==
+Y2VydHMwIBcNMjMwNzEzMTQzNTIzWhgPMjA1MDExMjgxNDM1MjNaMEYxHjAcBgNV
+BAsMFVBvc3RncmVTUUwgdGVzdCBzdWl0ZTEkMCIGA1UEAwwbY29tbW9uLW5hbWUu
+cGctc3NsdGVzdC50ZXN0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
+1bNU8yTuLl/5bR4Rp1ET5NMC2wgrTwKQsxSeOzvMmTGeebpEYFc/Hq8rcCQAiL7A
+bhiZeNg/ca4yJdouOdaHaTMFJ8hFDI1tNOGeFK7ecOMBWQ97GxKs/KIqKYW42AN+
+QZ7l1Apr0CDZK5VTi931JjE4wCIgUgLi2zgwtZYl/kP896F1K5zR7kx773U2dvP3
+SeV2ziUe+4NH5oqdmVMeZyHfB+Fe/uU1AiYgHN/CXfop39tYHR8ARUWx7eJlaaKB
+oj/0UqH/9YirjdM0vGfrw4JCjIx78caNkNH9fCjesTqODr+IDBJaJv3Jpt9g8puq
+rYagXLppiaYSq5oOAu5fuQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQCT3LdsDzwy
+oKaXNuOgtENp4Pp4hLDXeZsepemYss75xfPsXyni9gWVTPIwwzq7NMawtP5q7zzB
+zUMiDgsL9J3d1kDcL0qbJV7xciwCA5D0O1EFKSogJK9jgdupswQZKNrEtM2F68mN
+SJ2aCJtIX/4lZb9KyRli4PDECrFjJM4vDQa9y05O5YY7lohvY5jubAAgexLT/n5r
+oycpw3xNzwGIQ8dAtjvtgONFFKAogWomFaCjWSBPW3ZVz4NM7CryH6oyxkUv/v+q
+/7vUykX0qBn7Vnk3nvVsqrqRRCbYXMz8qgMLeeXi5JjSeWDpYoiblIEfpf3FdtqS
+FnIQVHtAuZHb
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
-MIIDFDCCAfygAwIBAgIIICEDAxQSBwAwDQYJKoZIhvcNAQELBQAwQDE+MDwGA1UE
+MIIDnjCCAoagAwIBAgIIICMHExY1IwAwDQYJKoZIhvcNAQELBQAwQDE+MDwGA1UE
Aww1VGVzdCByb290IENBIGZvciBQb3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRl
-c3Qgc3VpdGUwHhcNMjEwMzAzMjIxMjA3WhcNNDgwNzE5MjIxMjA3WjBCMUAwPgYD
-VQQDDDdUZXN0IENBIGZvciBQb3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRlc3Qg
-c2VydmVyIGNlcnRzMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4kp2
-GW5nPb6QrSrtbClfZeutyQnHrm4TMPBoNepFdIVxBX/04BguM5ImDRze/huOWA+z
-atJAQqt3R7dsDwnOnPKUKCOuHX6a1aj5L86HtVgaWTXrZFE5NtL9PIzXkWu13UW0
-UesHtbPVRv6a6fB7Npph6hHy7iPZb009A8/lTJnxSPC39u/K/sPqjrVZaAJF+wDs
-qCxCZTUtAUFvWFnR/TeXLWlFzBupS1djgI7PltbJqSn6SKTAgNZTxpRJbu9Icp6J
-/50ELwT++0n0KWVXNHrDNfI5Gaa+SxClAsPsei2jLKpgR6QFC3wn38Z9q9LjAVuC
-+FWhoN1uhYeoricEXwIDAQABoxAwDjAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEB
-CwUAA4IBAQCdCA/EoXrustoV4jJGbkdXDuOUkBurwggSNBAqUBSDvCohRoD77Ecb
-QVuzPNxWKG+E4PwfUq2ha+2yPONEJ28ZgsbHq5qlJDMJ43wlcjn6wmmAJNeSpO8F
-0V9d2X/4wNZty9/zbwTnw26KChgDHumQ0WIbCoBtdqy8KDswYOvpgws6dqc021I7
-UrFo6vZek7VoApbJgkDL6qYADa6ApfW43ThH4sViFITeYt/kSHgmy2Udhs34jMM8
-xsFP/uYpRi1b1glenwSIKiHjD4/C9vnWQt5K3gRBvYukEj2Bw9VkNRpBVCi0cOoA
-OuwX3bwzNYNbZQv4K66oRpvuoEjCNeHg
+c3Qgc3VpdGUwIBcNMjMwNzEzMTQzNTIzWhgPMjA1MDExMjgxNDM1MjNaMEIxQDA+
+BgNVBAMMN1Rlc3QgQ0EgZm9yIFBvc3RncmVTUUwgU1NMIHJlZ3Jlc3Npb24gdGVz
+dCBzZXJ2ZXIgY2VydHMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDi
+SnYZbmc9vpCtKu1sKV9l663JCceubhMw8Gg16kV0hXEFf/TgGC4zkiYNHN7+G45Y
+D7Nq0kBCq3dHt2wPCc6c8pQoI64dfprVqPkvzoe1WBpZNetkUTk20v08jNeRa7Xd
+RbRR6we1s9VG/prp8Hs2mmHqEfLuI9lvTT0Dz+VMmfFI8Lf278r+w+qOtVloAkX7
+AOyoLEJlNS0BQW9YWdH9N5ctaUXMG6lLV2OAjs+W1smpKfpIpMCA1lPGlElu70hy
+non/nQQvBP77SfQpZVc0esM18jkZpr5LEKUCw+x6LaMsqmBHpAULfCffxn2r0uMB
+W4L4VaGg3W6Fh6iuJwRfAgMBAAGjgZcwgZQwDAYDVR0TBAUwAwEB/zAdBgNVHQ4E
+FgQU8o86ZkBQZEgi1y6C/1aewrPudAowZQYDVR0jBF4wXKFEpEIwQDE+MDwGA1UE
+Aww1VGVzdCByb290IENBIGZvciBQb3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRl
+c3Qgc3VpdGWCFBfnvJQgNLw9MyrcSA1T3Q2PyJIFMA0GCSqGSIb3DQEBCwUAA4IB
+AQANlEDrM357a7o+WcKB0Ocll2UtBMq7PDms1Pjqm3fFu/wdKDUomG8W2/MgDmFl
+CVeAPpofb6J0oaxiEZOR68pOhdccMznArtKix6t3RkDiXdm4d5UORMMR+s9CymXV
+MUTWpQpAg3qP3mRI+3E9OrgfhvmVcuOa7/cdTS/sylGe8Db+nJQD0be9NHtnhO56
+IA+Li+8oWzD4UNsP3gAmhLkyToz5wlPHzEkgGxkEySNErEOKTOX5Xyk5z+QToRhz
+adkt0mBw/dxoJk9DveCtIqxDelxJsDeJFtqoc5qVVE9yOp7rujGsqgWl2PcJeyKM
+Crh9qsqNzJ2R29pq0g6Lfzh2
-----END CERTIFICATE-----
diff --git a/src/test/ssl/ssl/server-cn-only.crt b/src/test/ssl/ssl/server-cn-only.crt
index acdf6f1a75..6429529226 100644
--- a/src/test/ssl/ssl/server-cn-only.crt
+++ b/src/test/ssl/ssl/server-cn-only.crt
@@ -1,19 +1,19 @@
-----BEGIN CERTIFICATE-----
-MIIDAzCCAesCCCAhAwMUEgcBMA0GCSqGSIb3DQEBCwUAMEIxQDA+BgNVBAMMN1Rl
+MIIDBTCCAe0CCCAjBxMWNSMCMA0GCSqGSIb3DQEBCwUAMEIxQDA+BgNVBAMMN1Rl
c3QgQ0EgZm9yIFBvc3RncmVTUUwgU1NMIHJlZ3Jlc3Npb24gdGVzdCBzZXJ2ZXIg
-Y2VydHMwHhcNMjEwMzAzMjIxMjA3WhcNNDgwNzE5MjIxMjA3WjBGMR4wHAYDVQQL
-DBVQb3N0Z3JlU1FMIHRlc3Qgc3VpdGUxJDAiBgNVBAMMG2NvbW1vbi1uYW1lLnBn
-LXNzbHRlc3QudGVzdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANWz
-VPMk7i5f+W0eEadRE+TTAtsIK08CkLMUnjs7zJkxnnm6RGBXPx6vK3AkAIi+wG4Y
-mXjYP3GuMiXaLjnWh2kzBSfIRQyNbTThnhSu3nDjAVkPexsSrPyiKimFuNgDfkGe
-5dQKa9Ag2SuVU4vd9SYxOMAiIFIC4ts4MLWWJf5D/PehdSuc0e5Me+91Nnbz90nl
-ds4lHvuDR+aKnZlTHmch3wfhXv7lNQImIBzfwl36Kd/bWB0fAEVFse3iZWmigaI/
-9FKh//WIq43TNLxn68OCQoyMe/HGjZDR/Xwo3rE6jg6/iAwSWib9yabfYPKbqq2G
-oFy6aYmmEquaDgLuX7kCAwEAATANBgkqhkiG9w0BAQsFAAOCAQEA2AZrD9cTQXTW
-4j2tT8N/TTc6WK2ncN4h22NTte6vK7MVwsZJCtw5ndYkmxcWkXAqiclzWyMdayds
-WOa12CEH7jKAhivF4Hcw3oO3JHM5BA6KzLWBVz9uZksOM6mPqn29DTKvA/Y1V8tj
-mxK/KUA68h/u6inu3mo4ywBpb/tqHxxg2cjyR0faCmM0pwRM0HBr/16fUMfO83nj
-QG8g9J/bybu5sYso/aSoC5nUNp4XjmDMdVLdqg/nTe/ejS8IfFr0WQxBlqooqFgx
-MSE+kX2e2fHsuOWSU/9eClt6FpQrwoC2C8F+/4g1Uz7Liqc4yMHPwjgeP9ewrrLO
-iIhlNNPqpQ==
+Y2VydHMwIBcNMjMwNzEzMTQzNTIzWhgPMjA1MDExMjgxNDM1MjNaMEYxHjAcBgNV
+BAsMFVBvc3RncmVTUUwgdGVzdCBzdWl0ZTEkMCIGA1UEAwwbY29tbW9uLW5hbWUu
+cGctc3NsdGVzdC50ZXN0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
+1bNU8yTuLl/5bR4Rp1ET5NMC2wgrTwKQsxSeOzvMmTGeebpEYFc/Hq8rcCQAiL7A
+bhiZeNg/ca4yJdouOdaHaTMFJ8hFDI1tNOGeFK7ecOMBWQ97GxKs/KIqKYW42AN+
+QZ7l1Apr0CDZK5VTi931JjE4wCIgUgLi2zgwtZYl/kP896F1K5zR7kx773U2dvP3
+SeV2ziUe+4NH5oqdmVMeZyHfB+Fe/uU1AiYgHN/CXfop39tYHR8ARUWx7eJlaaKB
+oj/0UqH/9YirjdM0vGfrw4JCjIx78caNkNH9fCjesTqODr+IDBJaJv3Jpt9g8puq
+rYagXLppiaYSq5oOAu5fuQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQCT3LdsDzwy
+oKaXNuOgtENp4Pp4hLDXeZsepemYss75xfPsXyni9gWVTPIwwzq7NMawtP5q7zzB
+zUMiDgsL9J3d1kDcL0qbJV7xciwCA5D0O1EFKSogJK9jgdupswQZKNrEtM2F68mN
+SJ2aCJtIX/4lZb9KyRli4PDECrFjJM4vDQa9y05O5YY7lohvY5jubAAgexLT/n5r
+oycpw3xNzwGIQ8dAtjvtgONFFKAogWomFaCjWSBPW3ZVz4NM7CryH6oyxkUv/v+q
+/7vUykX0qBn7Vnk3nvVsqrqRRCbYXMz8qgMLeeXi5JjSeWDpYoiblIEfpf3FdtqS
+FnIQVHtAuZHb
-----END CERTIFICATE-----
diff --git a/src/test/ssl/ssl/server-crldir/a836cc2d.r0 b/src/test/ssl/ssl/server-crldir/a836cc2d.r0
index 331a83cb62..7ed68e0220 100644
--- a/src/test/ssl/ssl/server-crldir/a836cc2d.r0
+++ b/src/test/ssl/ssl/server-crldir/a836cc2d.r0
@@ -1,11 +1,11 @@
-----BEGIN X509 CRL-----
-MIIBpTCBjjANBgkqhkiG9w0BAQsFADBCMUAwPgYDVQQDDDdUZXN0IENBIGZvciBQ
-b3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRlc3Qgc2VydmVyIGNlcnRzFw0yMTAz
-MDMyMjEyMDdaFw00ODA3MTkyMjEyMDdaMBswGQIIICEDAxQSBwUXDTIxMDMwMzIy
-MTIwN1owDQYJKoZIhvcNAQELBQADggEBAJxj0taZYIIxUsCuXR5CN2OymjMvRwmV
-+10VOkyBQ3VkzHlXeJkmZsU2Dvmc205l9OYouh/faL0TfK2NyhmBo+MrTizL9TBo
-4u2es/0oJGj2wyNMkRs0SlSJelakvGFBvSKfqoV0l2O1WDV7M4KtdC8ZVZipmL4R
-ac4hBMK0ifHuTS5Od6o0C2RijEPCHMXaS/LkWpBqcStI2oirhjo+Th1wxTMGUVFy
-imVvt6D6QqqHCUYrvcNEN0xBNFwJGq/0cgSy+w5szt/RRehmJKX8MbNeZxrznIIx
-B18ch9rbBltz+Y4R63rCN9MdsnGXf6PQ6a6doZhSI1pnDrui12MOQrU=
+MIIBpzCBkDANBgkqhkiG9w0BAQsFADBCMUAwPgYDVQQDDDdUZXN0IENBIGZvciBQ
+b3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRlc3Qgc2VydmVyIGNlcnRzFw0yMzA3
+MTMxNDM1MjRaGA8yMDUwMTEyODE0MzUyNFowGzAZAgggIwcTFjUjCxcNMjMwNzEz
+MTQzNTI0WjANBgkqhkiG9w0BAQsFAAOCAQEADIkF8oS84O2PJw/C9BAzgrkd+EsO
+QL6mXUGBgXwmujfpv0Z8YK91k4+xV9hQRMjWe/DkU01+gmFhYoDvAzweuNQzx8lZ
+bYKu0dGTEpTd+OG1LbxYmt4f5xh096R5iLo7c7e2kMHvfNG7VwvKQrPeMqh7AcKy
+Fukt8C0Xc7Tfv2l2toEQUAl5UDUKEAovN6iB0qycpvi0nboyiDo8mV0p1jlAn846
+EeXjwm8tyGXzTFq16ypPwnlBM9d5Ml/p5WTN69nDux18G+iSCr+UDzLDYvLF11p3
+lEqpSo5lQg9zYuOgMCvu3g5BtwJgORPSiW/yZ5BXUfWvPi0XRPrknxMByA==
-----END X509 CRL-----
diff --git a/src/test/ssl/ssl/server-ip-alt-names.crt b/src/test/ssl/ssl/server-ip-alt-names.crt
index 8a1bc620bb..3f15775a34 100644
--- a/src/test/ssl/ssl/server-ip-alt-names.crt
+++ b/src/test/ssl/ssl/server-ip-alt-names.crt
@@ -1,19 +1,20 @@
-----BEGIN CERTIFICATE-----
-MIIDCTCCAfGgAwIBAgIIICERKREEUAAwDQYJKoZIhvcNAQELBQAwQjFAMD4GA1UE
+MIIDSzCCAjOgAwIBAgIIICMHExY1IwMwDQYJKoZIhvcNAQELBQAwQjFAMD4GA1UE
Aww3VGVzdCBDQSBmb3IgUG9zdGdyZVNRTCBTU0wgcmVncmVzc2lvbiB0ZXN0IHNl
-cnZlciBjZXJ0czAeFw0yMTExMjkxOTA0NTBaFw00OTA0MTYxOTA0NTBaMCAxHjAc
-BgNVBAsMFVBvc3RncmVTUUwgdGVzdCBzdWl0ZTCCASIwDQYJKoZIhvcNAQEBBQAD
-ggEPADCCAQoCggEBAOM8yB6aVWb17ujr3ayU62mxHQoqn4CvG9yXlJvGOGv/ursW
-Vs0UYJdc96LsNZN1szdm9ayNzCIw3eja+ULsjxCi6+3LM4pO76IORL/XFamlTPYb
-BZ4pHdZVB0nnZAAnWCZPyXdnjOKQ5+8unVXkfibkjj8UELBJ2snehsOa+CTkOBez
-zxYMqxAgbywLIYsW448brun7UXpWmqbGK+SsdGaIZ5Sb7Zezc5lt6CrLemTZTHHK
-7l4WZFCCEi4t3sgO8o1vDELD/IE5G8lyXvIdgJg6t8ssper7iCw6S8x+okhjiSjT
-vDLU2g4AanqZRZB49aPwTo0QUcJA2BCJxL9xLy8CAwEAAaMlMCMwIQYDVR0RBBow
-GIcEwAACAYcQIAENuAAAAAAAAAAAAAAAATANBgkqhkiG9w0BAQsFAAOCAQEAwZJ+
-8KpABTlMEgKnHIYb35ItGhtFiTLQta9RkXx7vaeDwpOdPP/IvuvpjpQZkobRgBsk
-bNM0KuJpd2mSTphQAt6eKQIdcPrkzvc/Yh9OK3YNLUAbu/ZhBUnBvFnUL4wn2f1U
-mfO+m8P/LxybwqKx7r1mbaB+tP3RTxxLcIMvm9ECPQEoBntfEL325Wdoj+WuQH5Y
-IvcM6FaCTkQsNIPbaBD5l5MhMLHRULZujbDjXqGSvRMQfns6np/biMjNdQA8NZ5z
-STeUFvkQbCxoA0YYLgoSHL5KhZjXrg2g+T+2TUyCTR/91xf9OoOjBZdixR0S0DzJ
-B1+5vnUjZaCfnSEA7A==
+cnZlciBjZXJ0czAgFw0yMzA3MTMxNDM1MjNaGA8yMDUwMTEyODE0MzUyM1owIDEe
+MBwGA1UECwwVUG9zdGdyZVNRTCB0ZXN0IHN1aXRlMIIBIjANBgkqhkiG9w0BAQEF
+AAOCAQ8AMIIBCgKCAQEA4zzIHppVZvXu6OvdrJTrabEdCiqfgK8b3JeUm8Y4a/+6
+uxZWzRRgl1z3ouw1k3WzN2b1rI3MIjDd6Nr5QuyPEKLr7cszik7vog5Ev9cVqaVM
+9hsFnikd1lUHSedkACdYJk/Jd2eM4pDn7y6dVeR+JuSOPxQQsEnayd6Gw5r4JOQ4
+F7PPFgyrECBvLAshixbjjxuu6ftRelaapsYr5Kx0ZohnlJvtl7NzmW3oKst6ZNlM
+ccruXhZkUIISLi3eyA7yjW8MQsP8gTkbyXJe8h2AmDq3yyyl6vuILDpLzH6iSGOJ
+KNO8MtTaDgBqeplFkHj1o/BOjRBRwkDYEInEv3EvLwIDAQABo2UwYzAhBgNVHREE
+GjAYhwTAAAIBhxAgAQ24AAAAAAAAAAAAAAABMB0GA1UdDgQWBBSZsk0rfkcawCvx
+XxCfQdMrWBIAVTAfBgNVHSMEGDAWgBTyjzpmQFBkSCLXLoL/Vp7Cs+50CjANBgkq
+hkiG9w0BAQsFAAOCAQEAHtiw75o40lNQJPmdNJ0GijokFQ80AB9Cq1h3IAE7g9X4
+S5EQ+xukQoEcDwqi3PYN2axHayE3qgYpD4burydxboNFeDSl06Sv+g3KQ57Uv76y
+ODFOElKwedkdfgxVrBNX2kVR1gacQHrMqGN7aBSwZ8wReLS4keYtDo/Bfd9cyaBF
+g3CuPCa7u7ZB9S+g8bRE1L0rktQ9viynMI5G1hgFqm+aXMBpWrQj566z8qMRDN0a
+qk6gHxfXFy9NJorUxfHOTcrrKA2YciGHFUdRZT6zX4Nt8RjTWK6Oxro4G6UqAH+2
+g65OIDeyMwi+UUnDzMQPJoI20jZpBms9670yrlZDqg==
-----END CERTIFICATE-----
diff --git a/src/test/ssl/ssl/server-ip-cn-and-alt-names.crt b/src/test/ssl/ssl/server-ip-cn-and-alt-names.crt
index 2be02feb03..cbf79b9112 100644
--- a/src/test/ssl/ssl/server-ip-cn-and-alt-names.crt
+++ b/src/test/ssl/ssl/server-ip-cn-and-alt-names.crt
@@ -1,19 +1,21 @@
-----BEGIN CERTIFICATE-----
-MIIDHTCCAgWgAwIBAgIIICIBBBQ2MQAwDQYJKoZIhvcNAQELBQAwQjFAMD4GA1UE
+MIIDXzCCAkegAwIBAgIIICMHExY1IwUwDQYJKoZIhvcNAQELBQAwQjFAMD4GA1UE
Aww3VGVzdCBDQSBmb3IgUG9zdGdyZVNRTCBTU0wgcmVncmVzc2lvbiB0ZXN0IHNl
-cnZlciBjZXJ0czAeFw0yMjAxMDQyMjM2MzFaFw00OTA1MjIyMjM2MzFaMDQxHjAc
-BgNVBAsMFVBvc3RncmVTUUwgdGVzdCBzdWl0ZTESMBAGA1UEAwwJMTkyLjAuMi4x
-MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwmqTdQJfs2Ti9tPitYp2
-27I0HvL/kNSgA6egFr0foRo0BorwJNIzdbV0+EnsfiBNTWL5It26gqO7UP3ms8t2
-vHD5gkXfT+f6ts0lVJEcIOkUD/8ws4Ic9Y4uPqb4gN+pUKqcxtmLW1TYk84MBK59
-Xz4yPPS6N+G/DMMeFHTNkM9EQwn/+DC3fDsWdGYM2GRWDTJGg1A5tSUcF+seu7i1
-Vg7XajBfsvgAUAsrAxV+X/sLZh94HY+paD6wfaI99mY2OXVc/XW/z1r9WQznor65
-ZkonNCaPfavqPG5vqnab9AyQcqPqmX8hf/xrniASBAkqNCctbASrFCIYvCJfGfmX
-EQIDAQABoyUwIzAhBgNVHREEGjAYhwTAAAIChxAgAQ24AAAAAAAAAAAAAAABMA0G
-CSqGSIb3DQEBCwUAA4IBAQBf7kmYfRYfnWk1OUfY3N1kaNg9piBBlFr9g+OQn9KU
-zirkN7s0ZQbCGxV1uJQBKS58NyE414Vorau77379emgYDcCBpDIYpkLiNujVrIOr
-ggRFKsFRgxu4/mw0BSgCcV8RPe9SWHZ90Mos7TMCnW/PdxOCD1wD0YMkcs0rwB3l
-0Kzc7jDnfOEvmgw/Ysm7v67ps+05Uq5VskQ6WrpSAw6kPD/QMuuBAX8ATPczIaox
-zAMyncq1IiSIwG93f3EoQQThdQ70C6G9vLcu9TtL6JAsEMFEzR99gt1Wsqvmgl9W
-kStzj1yjIWeo5gIsa4Jgcke1lZviWyrTxHDfyunYE5i5
+cnZlciBjZXJ0czAgFw0yMzA3MTMxNDM1MjRaGA8yMDUwMTEyODE0MzUyNFowNDEe
+MBwGA1UECwwVUG9zdGdyZVNRTCB0ZXN0IHN1aXRlMRIwEAYDVQQDDAkxOTIuMC4y
+LjEwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDCapN1Al+zZOL20+K1
+inbbsjQe8v+Q1KADp6AWvR+hGjQGivAk0jN1tXT4Sex+IE1NYvki3bqCo7tQ/eaz
+y3a8cPmCRd9P5/q2zSVUkRwg6RQP/zCzghz1ji4+pviA36lQqpzG2YtbVNiTzgwE
+rn1fPjI89Lo34b8Mwx4UdM2Qz0RDCf/4MLd8OxZ0ZgzYZFYNMkaDUDm1JRwX6x67
+uLVWDtdqMF+y+ABQCysDFX5f+wtmH3gdj6loPrB9oj32ZjY5dVz9db/PWv1ZDOei
+vrlmSic0Jo99q+o8bm+qdpv0DJByo+qZfyF//GueIBIECSo0Jy1sBKsUIhi8Il8Z
++ZcRAgMBAAGjZTBjMCEGA1UdEQQaMBiHBMAAAgKHECABDbgAAAAAAAAAAAAAAAEw
+HQYDVR0OBBYEFGX9z+RX7x23a5ViEQbcj5XBGHaZMB8GA1UdIwQYMBaAFPKPOmZA
+UGRIItcugv9WnsKz7nQKMA0GCSqGSIb3DQEBCwUAA4IBAQCQQ+5/h6r84jks/l5u
+0G6w07hcgo/AfPEVSqGXDlEiJEdP8IownmxPB5siRwq6FNHqVMQ6usFeTlfYqtzE
+OmQOagLyKAhYCQkVPUIpIKLj70o8DVqnwoxr1+kWZUi4xLPTYPawFHUem7cX6TuT
+7TQe2yCXPHf8GaIMRjNI1LSpT5DUxHXZinw6UnsHr5EotFTSzmS/Yfko881+WDBq
+Uv/AOReEwLUvaRBTbWmIxyN7y6S8BUzlDw6AvSZLVczuQ1qLbFAc/fjdkiyCos2J
+r8FOq7UnBrvbs7/mT/1AtAcHjShPYGH3JFIgvHfixrJlsdS85f3GA9tJgJ9BV16d
+qkjO
-----END CERTIFICATE-----
diff --git a/src/test/ssl/ssl/server-ip-cn-and-dns-alt-names.crt b/src/test/ssl/ssl/server-ip-cn-and-dns-alt-names.crt
index 23c06da01c..b51dab2963 100644
--- a/src/test/ssl/ssl/server-ip-cn-and-dns-alt-names.crt
+++ b/src/test/ssl/ssl/server-ip-cn-and-dns-alt-names.crt
@@ -1,20 +1,21 @@
-----BEGIN CERTIFICATE-----
-MIIDQzCCAiugAwIBAgIIICIBBBQ2MQEwDQYJKoZIhvcNAQELBQAwQjFAMD4GA1UE
+MIIDhzCCAm+gAwIBAgIIICMHExY1IwYwDQYJKoZIhvcNAQELBQAwQjFAMD4GA1UE
Aww3VGVzdCBDQSBmb3IgUG9zdGdyZVNRTCBTU0wgcmVncmVzc2lvbiB0ZXN0IHNl
-cnZlciBjZXJ0czAeFw0yMjAxMDQyMjM2MzFaFw00OTA1MjIyMjM2MzFaMDQxHjAc
-BgNVBAsMFVBvc3RncmVTUUwgdGVzdCBzdWl0ZTESMBAGA1UEAwwJMTkyLjAuMi4x
-MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA8xddbo/x2TOSIa/br8BN
-o/URdTr9+l2R5YojiZKDuLxiQVkgC30PJ2/CNFKIh2nHhRrzknI6sETVtrxZ+9V2
-qRc1yShVu462u0DHPRMIZnZIOZg3hlNB0cRWbOglUKlttIARNEQUcTUyPOtyo4/v
-+u0Ej5NTNcHFbFT01vdD9MjQiCO3jKdAwPIb14jTg4C71EpZ+LuelDo4DzF2/XgG
-WqUTrgD/XnBU/60PU9Iy3G0nVpx21q6ppn9G7a9R+i8FjBcwW1T+cfsBDWhAv+bi
-RmSAkENf8L8TwOlDQUwROkfz3Hz36vuJjdkreQJsiqL0HnrnH5T5G9UzJO86FvZQ
-5wIDAQABo0swSTBHBgNVHREEQDA+gh1kbnMxLmFsdC1uYW1lLnBnLXNzbHRlc3Qu
-dGVzdIIdZG5zMi5hbHQtbmFtZS5wZy1zc2x0ZXN0LnRlc3QwDQYJKoZIhvcNAQEL
-BQADggEBAF+mfaw6iBPzpCgqq830pHRa3Yzm1aezt8SkeRohUYHNv/yCnDSRaqtj
-xbENih3lJMSTBL3g0wtTOHfH8ViC/h+lvYELHzXKic7gkjV7H5XETKGr0ZsjBBT2
-4cZQKbD9e0x0HrENXMYgGpBf747qL6uTOVJdG0s15hwpLq47bY5WUjXathejbpxW
-prmF8F+xaC52N9P/1VnqguQB909F4x1pyOK7D7tjFu+Y8Je7PHKbb6WY5K6xAv6t
-R17CY0749/FotlphquElUR2bs5Zzv5YrjUHPTcbwKvcH5cdNi93/u6NJt2xNAoYf
-aZERhX5TA9DYk4gC8OY0yGaYCIj3Dd4=
+cnZlciBjZXJ0czAgFw0yMzA3MTMxNDM1MjRaGA8yMDUwMTEyODE0MzUyNFowNDEe
+MBwGA1UECwwVUG9zdGdyZVNRTCB0ZXN0IHN1aXRlMRIwEAYDVQQDDAkxOTIuMC4y
+LjEwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDzF11uj/HZM5Ihr9uv
+wE2j9RF1Ov36XZHliiOJkoO4vGJBWSALfQ8nb8I0UoiHaceFGvOScjqwRNW2vFn7
+1XapFzXJKFW7jra7QMc9Ewhmdkg5mDeGU0HRxFZs6CVQqW20gBE0RBRxNTI863Kj
+j+/67QSPk1M1wcVsVPTW90P0yNCII7eMp0DA8hvXiNODgLvUSln4u56UOjgPMXb9
+eAZapROuAP9ecFT/rQ9T0jLcbSdWnHbWrqmmf0btr1H6LwWMFzBbVP5x+wENaEC/
+5uJGZICQQ1/wvxPA6UNBTBE6R/PcfPfq+4mN2St5AmyKovQeeucflPkb1TMk7zoW
+9lDnAgMBAAGjgYwwgYkwRwYDVR0RBEAwPoIdZG5zMS5hbHQtbmFtZS5wZy1zc2x0
+ZXN0LnRlc3SCHWRuczIuYWx0LW5hbWUucGctc3NsdGVzdC50ZXN0MB0GA1UdDgQW
+BBSAWxUeTAXIo1H+cmx5bW0UJrPWlDAfBgNVHSMEGDAWgBTyjzpmQFBkSCLXLoL/
+Vp7Cs+50CjANBgkqhkiG9w0BAQsFAAOCAQEAoFdBPGtQA1y8lVAK3aFMyczeFwmS
+Bh+gIEyYpzWEUCgLManf6MnVpR1lG2nPasHawlHD0vmNBNuKHaKwtvXanNlnhK60
+mSyVx2tRVtygs+fCFykS3Oy0GlBWdoONyZWmwV97+Jpq7F2tb3fqCehy0HWFKruG
+JfVFBfVtPOdEgrla6ExuVcitDGNjKe6O1Kvt5m2Ze5+tX/rBJcSL9vfh/pa/qM4B
+lukCT9RwNNfUgNKIC0Tq13sNUeo7Fz3td46ZFOviBMv5ywH/7OE9eYNRvXwd/brH
+xNiRiUwBiUMvae38Tm4E8bFT6N/pmRVXAk4v84Eo/hxFIogT531JNaQhYA==
-----END CERTIFICATE-----
diff --git a/src/test/ssl/ssl/server-ip-cn-only.crt b/src/test/ssl/ssl/server-ip-cn-only.crt
index 9bf015cf18..8b15358577 100644
--- a/src/test/ssl/ssl/server-ip-cn-only.crt
+++ b/src/test/ssl/ssl/server-ip-cn-only.crt
@@ -1,18 +1,18 @@
-----BEGIN CERTIFICATE-----
-MIIC8TCCAdkCCCAhESkRN1IAMA0GCSqGSIb3DQEBCwUAMEIxQDA+BgNVBAMMN1Rl
+MIIC8zCCAdsCCCAjBxMWNSMEMA0GCSqGSIb3DQEBCwUAMEIxQDA+BgNVBAMMN1Rl
c3QgQ0EgZm9yIFBvc3RncmVTUUwgU1NMIHJlZ3Jlc3Npb24gdGVzdCBzZXJ2ZXIg
-Y2VydHMwHhcNMjExMTI5MTkzNzUyWhcNNDkwNDE2MTkzNzUyWjA0MR4wHAYDVQQL
-DBVQb3N0Z3JlU1FMIHRlc3Qgc3VpdGUxEjAQBgNVBAMMCTE5Mi4wLjIuMTCCASIw
-DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANWs1uUL71nHYF9Zj6p+M3MpYDvx
-32iCjVdtH5a2qpSWHXTg0rR8dLX0y92cvOYvMXHRajZT1avpHr8dooPYSVaXpGMK
-NvF/Qi+WFYovRbP2vmd1yv1cgW/FggbwJFWVobizIz4seyA4d0B2j9fqoi2OFBNP
-huW664SjF0u3p21tDy+43i2LNUMAKf6dnRR5Vqenath87LEU41tSLudu6NXgbFMk
-jvfNkl4d0w7YCzeXmklmSI+uaX3PlJJ4NzQO2j8w5BvnKVhNVD0KjgrXZ6nB/8F7
-Pg3XY+d7rJlwRgXemU6resWQDJ7+UaC9u7I4EIP+9lzCR/nNBqUktpHRmHUCAwEA
-ATANBgkqhkiG9w0BAQsFAAOCAQEAos1JncV8Yf4UaKl6h1GdYtcVtzFyJvBEnhRD
-07ldL+TYnfZiX8wK2ssBtM3cg/C78y5bzdUa5XGS83ZKQJFFdhE7PSnrvyNqyIqY
-ZgNBxto3gyvir+EjO1u9BAB0NP3r3gYoHRDZS1xOPPzt4WgjuUgTLM9k82GsqAbO
-UrOTOdRnkIqC5xLpa05EnRyJPRsR1w1PRJC2XXKnHIuFjMb4v7UuPwyCcX1P5ioc
-rQszQcORy/L+k0ezCkyweORg68htjYbBHuwOuiGfok6yKKDMzrTvD3lIslls6eX7
-4sI3XWqzkPmG9Vsxm9Vu9/Ma+PRO76VyCoIwBd+Ufg5vNXhMmw==
+Y2VydHMwIBcNMjMwNzEzMTQzNTI0WhgPMjA1MDExMjgxNDM1MjRaMDQxHjAcBgNV
+BAsMFVBvc3RncmVTUUwgdGVzdCBzdWl0ZTESMBAGA1UEAwwJMTkyLjAuMi4xMIIB
+IjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1azW5QvvWcdgX1mPqn4zcylg
+O/HfaIKNV20flraqlJYddODStHx0tfTL3Zy85i8xcdFqNlPVq+kevx2ig9hJVpek
+Ywo28X9CL5YVii9Fs/a+Z3XK/VyBb8WCBvAkVZWhuLMjPix7IDh3QHaP1+qiLY4U
+E0+G5brrhKMXS7enbW0PL7jeLYs1QwAp/p2dFHlWp6dq2HzssRTjW1Iu527o1eBs
+UySO982SXh3TDtgLN5eaSWZIj65pfc+Ukng3NA7aPzDkG+cpWE1UPQqOCtdnqcH/
+wXs+Dddj53usmXBGBd6ZTqt6xZAMnv5RoL27sjgQg/72XMJH+c0GpSS2kdGYdQID
+AQABMA0GCSqGSIb3DQEBCwUAA4IBAQB2VbIjlzU7ieisvO3ZCGMJmCmQtEDC8Xgo
+umbbHtCdCYtPy8KSulAKBzLLBpVsQiOqq6T8t3KZrU64Wi2DEamULfYfgZCdatQw
+EWzBmTOO+5guo3ntm57+3kR9pRbTDbLUgOrgJrKnu1THof+6gwX6e0D++91mfwpm
+FLhn4bIuRyQtlqH7Ft0otsA4HezoHDLGTS76NDYpx+rDklFE6ZUk3RFgC7ScXPfW
+rA+KJIATgnrDwBx+n8s1SeZ7S64QkZk27QVi/8exYbd6aJwWBTuoHXZswfn5nK/b
+PFR7RK0LgucLvOKjUTzNPZUyhjS+b2dSnPZUuWNTFFu5KhnfoPEZ
-----END CERTIFICATE-----
diff --git a/src/test/ssl/ssl/server-ip-in-dnsname.crt b/src/test/ssl/ssl/server-ip-in-dnsname.crt
index 78ad8d99c8..87009ebd2c 100644
--- a/src/test/ssl/ssl/server-ip-in-dnsname.crt
+++ b/src/test/ssl/ssl/server-ip-in-dnsname.crt
@@ -1,18 +1,20 @@
-----BEGIN CERTIFICATE-----
-MIIC/DCCAeSgAwIBAgIIICIDFRVYUgAwDQYJKoZIhvcNAQELBQAwQjFAMD4GA1UE
+MIIDPjCCAiagAwIBAgIIICMHExY1IwcwDQYJKoZIhvcNAQELBQAwQjFAMD4GA1UE
Aww3VGVzdCBDQSBmb3IgUG9zdGdyZVNRTCBTU0wgcmVncmVzc2lvbiB0ZXN0IHNl
-cnZlciBjZXJ0czAeFw0yMjAzMTUyMjU4NTJaFw00OTA3MzEyMjU4NTJaMCAxHjAc
-BgNVBAsMFVBvc3RncmVTUUwgdGVzdCBzdWl0ZTCCASIwDQYJKoZIhvcNAQEBBQAD
-ggEPADCCAQoCggEBAMpn5bP1/OfBQR/yvOkOBzxArE1j1YShVa2pcj896+CVDEgV
-N5Hluz7KHU/JYzNZCAHb5WAHuvXxKeoj4Ti5be1KsqO0mN1p+RMN7VlCpCpb0AWT
-z4z+I8TUhSZnmgghHvfW4RfcZMCcHq1vevVTDxR/cAbDPYpgBCD5F/SZMRyMDw5B
-7ILLmft0eqA1nCqavyqBCGZvx1ol8N5BfVdrDXp/rN5997khBWQRZ8g84FZyFZXf
-pwp57eu0OGQDzZFXoEL2t4OVld67K5jcclWVxHY6FGcHjCvyqs48PCPOR84anZwj
-GsqVOS6250/DWKBQO4KyhkTVf0AW/ICGSMOKkAkCAwEAAaMYMBYwFAYDVR0RBA0w
-C4IJMTkyLjAuMi4xMA0GCSqGSIb3DQEBCwUAA4IBAQDIAAH0WJKEpbPN0QihN6SF
-UA5WL4ixsBACo9OIAGkSnKeOeVEG5vvgOna0hjQcOcgtI1oCDLhULcjCuwxiIW6y
-QntOazyo0sooJr0hEm2WfipvIpQs6W9E1OTcs624BAVfkAwr6WT2VwoIAPcQD2nR
-tIQhSUIR9J7Q5WbzuQw7pthQhBfW/UPWw7vajel0r1dflbe0Cgp5WGNfp1kYy+Qf
-XW/YjkstZEP1KFm+TF58uxrIDmYboS8EerUREGQixijbI0AfXjShxtiyS63rbdpo
-3C0BPj9Yx2VtWi4U0qoef/iLJxJBCLvE/97+duPdKx0AkkOWA9VuenkWLp797UM8
+cnZlciBjZXJ0czAgFw0yMzA3MTMxNDM1MjRaGA8yMDUwMTEyODE0MzUyNFowIDEe
+MBwGA1UECwwVUG9zdGdyZVNRTCB0ZXN0IHN1aXRlMIIBIjANBgkqhkiG9w0BAQEF
+AAOCAQ8AMIIBCgKCAQEAymfls/X858FBH/K86Q4HPECsTWPVhKFVralyPz3r4JUM
+SBU3keW7PsodT8ljM1kIAdvlYAe69fEp6iPhOLlt7Uqyo7SY3Wn5Ew3tWUKkKlvQ
+BZPPjP4jxNSFJmeaCCEe99bhF9xkwJwerW969VMPFH9wBsM9imAEIPkX9JkxHIwP
+DkHsgsuZ+3R6oDWcKpq/KoEIZm/HWiXw3kF9V2sNen+s3n33uSEFZBFnyDzgVnIV
+ld+nCnnt67Q4ZAPNkVegQva3g5WV3rsrmNxyVZXEdjoUZweMK/Kqzjw8I85Hzhqd
+nCMaypU5LrbnT8NYoFA7grKGRNV/QBb8gIZIw4qQCQIDAQABo1gwVjAUBgNVHREE
+DTALggkxOTIuMC4yLjEwHQYDVR0OBBYEFDGGF+fm5mk/sd23jkLL3uVU0NjCMB8G
+A1UdIwQYMBaAFPKPOmZAUGRIItcugv9WnsKz7nQKMA0GCSqGSIb3DQEBCwUAA4IB
+AQCf8knuWhoBZ8psmq+NC/RZRxfQmFBRj+bKzJ6YaAHyNmE44nBtIAJal3m4FyTZ
+vXAlYpfRLrF+R5PJVnvT8mfu/vfxJn3MPHV7R8vmJpRAx8uQKFuxQPQDUq84efqZ
+BHG0zoNPml915nVfxgt1WqIVWQpomAOvjb1Ct31A1bZF5oMjhg86XdytqQNohl8I
+NBNu027tO0izM/mX3xJzYEnBSiHwKPfZxSKtc0FSffwohWUlpEye1A4Q9d6tWF6d
++PagUG+hodSLsU5Bno4dc0RYJr9xJLW9QMcuCbMC9zXaUBWpkUwOWbMXpPhvawdu
+oR2Tvhha37JD6a8NEUgSJOvL
-----END CERTIFICATE-----
diff --git a/src/test/ssl/ssl/server-multiple-alt-names.crt b/src/test/ssl/ssl/server-multiple-alt-names.crt
index 58799e49f8..85663b97af 100644
--- a/src/test/ssl/ssl/server-multiple-alt-names.crt
+++ b/src/test/ssl/ssl/server-multiple-alt-names.crt
@@ -1,20 +1,22 @@
-----BEGIN CERTIFICATE-----
-MIIDSzCCAjOgAwIBAgIIICEDAxQSBwMwDQYJKoZIhvcNAQELBQAwQjFAMD4GA1UE
+MIIDjzCCAnegAwIBAgIIICMHExY1IwkwDQYJKoZIhvcNAQELBQAwQjFAMD4GA1UE
Aww3VGVzdCBDQSBmb3IgUG9zdGdyZVNRTCBTU0wgcmVncmVzc2lvbiB0ZXN0IHNl
-cnZlciBjZXJ0czAeFw0yMTAzMDMyMjEyMDdaFw00ODA3MTkyMjEyMDdaMCAxHjAc
-BgNVBAsMFVBvc3RncmVTUUwgdGVzdCBzdWl0ZTCCASIwDQYJKoZIhvcNAQEBBQAD
-ggEPADCCAQoCggEBANdIkKX1X+Jwqo5EXC1z/TjUKnYTDzHYx2rCqprBU8fN0mSy
-lMyjDm+eo924PN7LahqCHeDCMbapwymkoNfpLHkNRwotHLvxN5RyxJD4m5fXclRo
-V1ZzwwXTqXlECwrzzYGst/7muDM9DX+0vXIAvQGbvxBGI0CBM3ztHBADXlSFrYGX
-zN/to9KZmeOgBGJRGSZJg09P5px5N2E49yOqkIa9+MGb6nK8KLmETeTYjlWCS6W+
-oD0qGpZvj2Fzioz+Pn1q9fB3WS687GuMT0WvV3LAzcn341r0E36bUf9rxSjfBX79
-11KsVMemr1QskSmvMQFEv6R1Rp8xUGPqKlkRJ9sCAwEAAaNnMGUwYwYDVR0RBFww
-WoIdZG5zMS5hbHQtbmFtZS5wZy1zc2x0ZXN0LnRlc3SCHWRuczIuYWx0LW5hbWUu
-cGctc3NsdGVzdC50ZXN0ghoqLndpbGRjYXJkLnBnLXNzbHRlc3QudGVzdDANBgkq
-hkiG9w0BAQsFAAOCAQEAuRAyYBwAZLKERoYDy/kE9LKddJfLhledTJ7+cIWs6T9V
-KBfWBHZYxfxmdBYwqVZfog8c5uHREfWiUPoF/aMq3ARay96aMh4xXJ+2a7HAmknF
-9AJWRieoc3H/QkMzAuT8IDTmoEarsr8vsX1MGabobZte/B9tEjq/z5t3GfLrHMVX
-5092U6Ka40ii4U1VwjR8YnRBwjm3UpLmZJAjvXjw13/XucNV5O8Plo1yvS+G0AMh
-KdMxExiItVtjZteiA0pJf0YGAzTFyzvwBljTcs4NfZ2M0ta9i0r4BF7wQ8tDezN7
-VxdJVPc5xPqncp0cMdUAE2xDmYlKEqB0kuAHNwH5/Q==
+cnZlciBjZXJ0czAgFw0yMzA3MTMxNDM1MjRaGA8yMDUwMTEyODE0MzUyNFowIDEe
+MBwGA1UECwwVUG9zdGdyZVNRTCB0ZXN0IHN1aXRlMIIBIjANBgkqhkiG9w0BAQEF
+AAOCAQ8AMIIBCgKCAQEA10iQpfVf4nCqjkRcLXP9ONQqdhMPMdjHasKqmsFTx83S
+ZLKUzKMOb56j3bg83stqGoId4MIxtqnDKaSg1+kseQ1HCi0cu/E3lHLEkPibl9dy
+VGhXVnPDBdOpeUQLCvPNgay3/ua4Mz0Nf7S9cgC9AZu/EEYjQIEzfO0cEANeVIWt
+gZfM3+2j0pmZ46AEYlEZJkmDT0/mnHk3YTj3I6qQhr34wZvqcrwouYRN5NiOVYJL
+pb6gPSoalm+PYXOKjP4+fWr18HdZLrzsa4xPRa9XcsDNyffjWvQTfptR/2vFKN8F
+fv3XUqxUx6avVCyRKa8xAUS/pHVGnzFQY+oqWREn2wIDAQABo4GoMIGlMGMGA1Ud
+EQRcMFqCHWRuczEuYWx0LW5hbWUucGctc3NsdGVzdC50ZXN0gh1kbnMyLmFsdC1u
+YW1lLnBnLXNzbHRlc3QudGVzdIIaKi53aWxkY2FyZC5wZy1zc2x0ZXN0LnRlc3Qw
+HQYDVR0OBBYEFNQECIqqAsJFZk9MZ3oygGNRbziXMB8GA1UdIwQYMBaAFPKPOmZA
+UGRIItcugv9WnsKz7nQKMA0GCSqGSIb3DQEBCwUAA4IBAQDOljab+EBwmJA4qzN4
+nY3QVQWxoPG7RBrNFRp2hrP05amitsjWG4+GWiIlKT7aSpEgUghdZgAb25FG44VH
+oUEo2aAJjTRGmssbeOUstDRXYCIOefaaxSleEgbZdrUb+zDkPwDw381EYuO/E+og
+OcS9nsbrq1vo1B09xQdpcJ6pf9VmmM4OQHpD2/xPxhOPVxMKhbrFvVOlHDc23sue
+kfaAnHFu3k5O2/fqGxWm7IQA8KNfhyWRDDZjwU3F+duqiHphGDyn0JH6bO+QNSEs
+kj7tCGh9oziomt/mnD1zDPO+s9f5+i9itk8emRaBakLsv7SyngO777r79myiiM+E
+LYJo
-----END CERTIFICATE-----
diff --git a/src/test/ssl/ssl/server-no-names.crt b/src/test/ssl/ssl/server-no-names.crt
index b5d0589090..45a434bcf1 100644
--- a/src/test/ssl/ssl/server-no-names.crt
+++ b/src/test/ssl/ssl/server-no-names.crt
@@ -1,18 +1,18 @@
-----BEGIN CERTIFICATE-----
-MIIC3TCCAcUCCCAhAwMUEgcEMA0GCSqGSIb3DQEBCwUAMEIxQDA+BgNVBAMMN1Rl
+MIIC3zCCAccCCCAjBxMWNSMKMA0GCSqGSIb3DQEBCwUAMEIxQDA+BgNVBAMMN1Rl
c3QgQ0EgZm9yIFBvc3RncmVTUUwgU1NMIHJlZ3Jlc3Npb24gdGVzdCBzZXJ2ZXIg
-Y2VydHMwHhcNMjEwMzAzMjIxMjA3WhcNNDgwNzE5MjIxMjA3WjAgMR4wHAYDVQQL
-DBVQb3N0Z3JlU1FMIHRlc3Qgc3VpdGUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
-ggEKAoIBAQCfOf74edog2QHkJlreO6NJEe1VZUSxn+LBeHH8T5fniFiM4Ym9X2o3
-XKhYsvNSwvrfWwMkajMkd3b3vURiuiAxYzB/9AwX97RUkZ8TfuU3UgISiCbJZrVH
-TpfJEv7JhePgYpAoOdPWqtFPmnO/Xv6uNjsrx/V/3COovUj3eIcyQzAl+eC2U9Tn
-//dJ0kF+hDnOR3I/3e6bAboJjAVvLl2ABryaateHuUaCu/Bf5mG1DarXNXPKYuP+
-KrkjHhH0KQ4Js3nu7bPEiG0E/JmCR452j72WKb+PiJHOxdMMyztZ3k6bGGlbw60j
-CwQnUJAlPL4G9U+lpVYG6f7HxOaJEscfAgMBAAEwDQYJKoZIhvcNAQELBQADggEB
-AJAwYwIL4oj3NisXCXkEp9zqDXiZvNW9yW3bY8lFFCpU7o5n92tCf2OFAkKaYhF1
-Eb2weyDULtW7W/wgdlOZL9npayYKzTusl6e8xfTQyjRCsoKWvnWOEkPH7VraZJ8c
-Ko1KhaVWX98VLdlUh5giYAEkdhk0qPYKsQ32unBXXJu0pX63pnPDoaUBiZUWr/3l
-CfkjgGY5YA8YxiDlHGNF1qlcX2fQKloDlvtH0L5Enwt25w2/IvWhTN6YxDR+rgdD
-XYbQr6o6vsmnZTJ3zUZ6XFo98sZq5L9oy1pcC8roV7w0AUVxraTWYILyGfNgruG8
-xsok/hu1L2VnktveEW/qoVs=
+Y2VydHMwIBcNMjMwNzEzMTQzNTI0WhgPMjA1MDExMjgxNDM1MjRaMCAxHjAcBgNV
+BAsMFVBvc3RncmVTUUwgdGVzdCBzdWl0ZTCCASIwDQYJKoZIhvcNAQEBBQADggEP
+ADCCAQoCggEBAJ85/vh52iDZAeQmWt47o0kR7VVlRLGf4sF4cfxPl+eIWIzhib1f
+ajdcqFiy81LC+t9bAyRqMyR3dve9RGK6IDFjMH/0DBf3tFSRnxN+5TdSAhKIJslm
+tUdOl8kS/smF4+BikCg509aq0U+ac79e/q42OyvH9X/cI6i9SPd4hzJDMCX54LZT
+1Of/90nSQX6EOc5Hcj/d7psBugmMBW8uXYAGvJpq14e5RoK78F/mYbUNqtc1c8pi
+4/4quSMeEfQpDgmzee7ts8SIbQT8mYJHjnaPvZYpv4+Ikc7F0wzLO1neTpsYaVvD
+rSMLBCdQkCU8vgb1T6WlVgbp/sfE5okSxx8CAwEAATANBgkqhkiG9w0BAQsFAAOC
+AQEA1w+EnZ8ef189KqulzF9vrKjdavlFyWon+otR0WAKFOojNMyIgAkbU69N0CHO
+LnJPiIF3H3izWelNo+2Wv3BxylQXgRlr92gUCFoEQ/RKnZVjgKl36e2+l/AVud1Q
+ke343xnYLup/jQ7LzKFIdyxmO090rrlHUO7Dg7bJAuHQ9bRbCO+orAg4nFZEoKd1
+kO/XQ7e18l95QJE6vOmRcbD0+kGRNYBA2v6K3DwX0PRUm7fyP1gLTbIt6jGukQiJ
+/ZkcvVcHNkcJzEr+A8BGVYgTG6VhuBPSMWVnnZcui93vH2D/3hq7ILNlFWBycSW6
+HheriPQ4X+y96SmttrjQVwSDYA==
-----END CERTIFICATE-----
diff --git a/src/test/ssl/ssl/server-revoked.crt b/src/test/ssl/ssl/server-revoked.crt
index 3bb0f164a6..ce4350dbc6 100644
--- a/src/test/ssl/ssl/server-revoked.crt
+++ b/src/test/ssl/ssl/server-revoked.crt
@@ -1,19 +1,19 @@
-----BEGIN CERTIFICATE-----
-MIIDAzCCAesCCCAhAwMUEgcFMA0GCSqGSIb3DQEBCwUAMEIxQDA+BgNVBAMMN1Rl
+MIIDBTCCAe0CCCAjBxMWNSMLMA0GCSqGSIb3DQEBCwUAMEIxQDA+BgNVBAMMN1Rl
c3QgQ0EgZm9yIFBvc3RncmVTUUwgU1NMIHJlZ3Jlc3Npb24gdGVzdCBzZXJ2ZXIg
-Y2VydHMwHhcNMjEwMzAzMjIxMjA3WhcNNDgwNzE5MjIxMjA3WjBGMR4wHAYDVQQL
-DBVQb3N0Z3JlU1FMIHRlc3Qgc3VpdGUxJDAiBgNVBAMMG2NvbW1vbi1uYW1lLnBn
-LXNzbHRlc3QudGVzdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKKD
-zvJUs+N+KeDwWAW0zfI5C1t3BxKUwh+MrwtFeNIcxhJd9Bzy6fNnvpMa/kNPoHfN
-n73OGLYeSDyiDc56dvBjLOfxPXFFN4TCuIxYSizIjniL3tzP/a8hyvO+KqTYyaEs
-cT8+/rNnqlqBXNqcdChSGpk0y34uybvWj2/wDJWTbFJ20bI+30HOxCfK8Dp3s8Nl
-suVSuLKF/qqbidDZuOAKc0/GJo2F/5AF9MkMYELmG6XAVq/XDkI3oLtxQKh6kYfc
-nu3fI0Mwr9+FoP2q+K5KskA3KJLlgBOykG55Odbe6Js4TPHrMBTgC9aWrP/I1gb8
-tFY2FVN+D/Wl8T/Boh0CAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAxVHoqX25W4Hx
-pMNjv2AJzcB7D+c+dUXAmLLJ7jh6szWeL0M2E5qX4dLc8LzQKnXv5ZcT4i/akjDX
-etdzuqh03kvDJvUkHclSWffmowmWMTG6GCA6S/2TQzSibIptkwqs74aIkayVJaC4
-jCBR+PVT8+cE2FMD6dAWu//fyEcpTg6XpZ/Upgu9OITGNaEQUGz8pSRkTgspfO0Q
-AKPmql6dpywReIlr5mzy9liCzf/BbAVHGmP/pBGIkLn2AzvPLCQ/UFZYT6aH7l5J
-nzmFhgRC3U5wPMdelHGrPMXg6OHCcyrQY0kEi7N/GQ5+jZkICoQuPJ7APKEZAUgO
-XRwVulaWJQ==
+Y2VydHMwIBcNMjMwNzEzMTQzNTI0WhgPMjA1MDExMjgxNDM1MjRaMEYxHjAcBgNV
+BAsMFVBvc3RncmVTUUwgdGVzdCBzdWl0ZTEkMCIGA1UEAwwbY29tbW9uLW5hbWUu
+cGctc3NsdGVzdC50ZXN0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
+ooPO8lSz434p4PBYBbTN8jkLW3cHEpTCH4yvC0V40hzGEl30HPLp82e+kxr+Q0+g
+d82fvc4Yth5IPKINznp28GMs5/E9cUU3hMK4jFhKLMiOeIve3M/9ryHK874qpNjJ
+oSxxPz7+s2eqWoFc2px0KFIamTTLfi7Ju9aPb/AMlZNsUnbRsj7fQc7EJ8rwOnez
+w2Wy5VK4soX+qpuJ0Nm44ApzT8YmjYX/kAX0yQxgQuYbpcBWr9cOQjegu3FAqHqR
+h9ye7d8jQzCv34Wg/ar4rkqyQDcokuWAE7KQbnk51t7omzhM8eswFOAL1pas/8jW
+Bvy0VjYVU34P9aXxP8GiHQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQDCJoMLMIl8
+yvxrXH+kD2z163bwsMEIdsJxsXGjewmI/tDMyDLdYVQGJm9YRa/Oebylir7T+ayr
+NGj7b+Uo5KezgnRw9iQ9U8Xz6oKNxMNHB0mw5v7eR2cDFTzzNm1jYReIxWVryLOj
+al4C5uWqoIOHUNYibSJZIjNpzR/Zu4d/Ijt3+oJz9OFRXlaXYuDqLrm8hsUkxBm8
+s6GS79Dvw75M689ZKrKQs/15ceFYqx1hTvePW7kK5tuhW//Hf2IX4pwwtn5x0t4A
+M47qO71Zo3BxJFToNgALaw2+ixWNqy4kZ429NQjXArtq6eUI6IaOTU1ER2UAcOjN
+OOC5mBDmmMZa
-----END CERTIFICATE-----
diff --git a/src/test/ssl/ssl/server-single-alt-name.crt b/src/test/ssl/ssl/server-single-alt-name.crt
index 7affdd68e7..077a60a7ad 100644
--- a/src/test/ssl/ssl/server-single-alt-name.crt
+++ b/src/test/ssl/ssl/server-single-alt-name.crt
@@ -1,19 +1,20 @@
-----BEGIN CERTIFICATE-----
-MIIDEjCCAfqgAwIBAgIIICEDAxQSBwIwDQYJKoZIhvcNAQELBQAwQjFAMD4GA1UE
+MIIDVDCCAjygAwIBAgIIICMHExY1IwgwDQYJKoZIhvcNAQELBQAwQjFAMD4GA1UE
Aww3VGVzdCBDQSBmb3IgUG9zdGdyZVNRTCBTU0wgcmVncmVzc2lvbiB0ZXN0IHNl
-cnZlciBjZXJ0czAeFw0yMTAzMDMyMjEyMDdaFw00ODA3MTkyMjEyMDdaMCAxHjAc
-BgNVBAsMFVBvc3RncmVTUUwgdGVzdCBzdWl0ZTCCASIwDQYJKoZIhvcNAQEBBQAD
-ggEPADCCAQoCggEBAMWKHC1lrog7A8ye8C3NM38JBiQBMuIZR40wORl0hJxj5Tp8
-dX8Xo2Thi9Ry33+YfMwfkkF66ZRwnMMEa8VYBmOz+fZFzF19WpE8F1CR3PxKE7ai
-zvunxy8oMxdXdIuTTzt8a5NcDLe22C4Yj21qaZVoh182ycvMH93V4MwsLcV3/GdV
-Ko7QpwP2ZCf5D1rhyccx+Trwyb2bKvhW5Jd3GrRacFJQFfUyrAu/FvyuSPmn86ab
-Jkr7CCgFlg6e4O9SFY7yXiOgLotsoQ5/YriTLinvUTGCMCSxaol97qx3I2gUpCZu
-i7H+4Dt9L5FcCMshl0TU32dsjw6El1Wbzp6voCsCAwEAAaMuMCwwKgYDVR0RBCMw
-IYIfc2luZ2xlLmFsdC1uYW1lLnBnLXNzbHRlc3QudGVzdDANBgkqhkiG9w0BAQsF
-AAOCAQEAUIhBQLzQgd7wHlT9DARxcC7SZwQtnk2BVqMYTRBU4uIa0i2HVyetpe1P
-rREthYq5sgaSqdonD9Splg8BLUlah9y3v9j6DBxkxNnz/3AZuA5oPaC/TZ+lwlX3
-QNWWFNaNZdcQbvjUvoPXIbJ6U9UDfByOJdoN4kJ6xe8Faj1Mp5Euqzr1ErrMtPWJ
-XLnXLV4WyAx+iMAbofXNlCyUorPGA8lRudzQ7bKdrhMZDE66VYwlwsUejEiODt7M
-NGTDs4aAZz9cBRjMeXhvX60cFQoykjAvWbieUKOgaFmJJyKemFj12cLeWyxvUodI
-kYtgAdzftiCSrbDjl1pzPSM6RC/E/A==
+cnZlciBjZXJ0czAgFw0yMzA3MTMxNDM1MjRaGA8yMDUwMTEyODE0MzUyNFowIDEe
+MBwGA1UECwwVUG9zdGdyZVNRTCB0ZXN0IHN1aXRlMIIBIjANBgkqhkiG9w0BAQEF
+AAOCAQ8AMIIBCgKCAQEAxYocLWWuiDsDzJ7wLc0zfwkGJAEy4hlHjTA5GXSEnGPl
+Onx1fxejZOGL1HLff5h8zB+SQXrplHCcwwRrxVgGY7P59kXMXX1akTwXUJHc/EoT
+tqLO+6fHLygzF1d0i5NPO3xrk1wMt7bYLhiPbWpplWiHXzbJy8wf3dXgzCwtxXf8
+Z1UqjtCnA/ZkJ/kPWuHJxzH5OvDJvZsq+Fbkl3catFpwUlAV9TKsC78W/K5I+afz
+ppsmSvsIKAWWDp7g71IVjvJeI6Aui2yhDn9iuJMuKe9RMYIwJLFqiX3urHcjaBSk
+Jm6Lsf7gO30vkVwIyyGXRNTfZ2yPDoSXVZvOnq+gKwIDAQABo24wbDAqBgNVHREE
+IzAhgh9zaW5nbGUuYWx0LW5hbWUucGctc3NsdGVzdC50ZXN0MB0GA1UdDgQWBBRE
+be2UnhcFV/bd5hEMML2w60NbbTAfBgNVHSMEGDAWgBTyjzpmQFBkSCLXLoL/Vp7C
+s+50CjANBgkqhkiG9w0BAQsFAAOCAQEA1pyC1Vb1EOgMdcdMq+u0FI+7GHGkEeg7
+qWMcLvu7mbcbcyzLriBUk1vKDYw+6WspTc6vvqMGxNVdwchm/93rUM/JI4C6nrmr
+3TJqE578C3EI+4YZxLLRnfYWBO0uyUfLkdjT3n0Tnu643wYYoKOgpZRV2WgfktK6
+KoRqWlkXkVoV/qZUS9O67XtNttvCFMrPiM4YbGmwQ7lUZ9qzojy4Fb0AWcZOVEIy
+2b7FMOUrIzk9CgTRtEqeobSD98p3OXGtzVZf2hY9vLgA1hnbVjmB2Kt3QMhnicvt
+/Z7o8o88cmcrs0PXMe90tt1JBssTFs6+ARCsgUkEwzCRnvVX+Yky9w==
-----END CERTIFICATE-----
diff --git a/src/test/ssl/ssl/server.crl b/src/test/ssl/ssl/server.crl
index 331a83cb62..7ed68e0220 100644
--- a/src/test/ssl/ssl/server.crl
+++ b/src/test/ssl/ssl/server.crl
@@ -1,11 +1,11 @@
-----BEGIN X509 CRL-----
-MIIBpTCBjjANBgkqhkiG9w0BAQsFADBCMUAwPgYDVQQDDDdUZXN0IENBIGZvciBQ
-b3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRlc3Qgc2VydmVyIGNlcnRzFw0yMTAz
-MDMyMjEyMDdaFw00ODA3MTkyMjEyMDdaMBswGQIIICEDAxQSBwUXDTIxMDMwMzIy
-MTIwN1owDQYJKoZIhvcNAQELBQADggEBAJxj0taZYIIxUsCuXR5CN2OymjMvRwmV
-+10VOkyBQ3VkzHlXeJkmZsU2Dvmc205l9OYouh/faL0TfK2NyhmBo+MrTizL9TBo
-4u2es/0oJGj2wyNMkRs0SlSJelakvGFBvSKfqoV0l2O1WDV7M4KtdC8ZVZipmL4R
-ac4hBMK0ifHuTS5Od6o0C2RijEPCHMXaS/LkWpBqcStI2oirhjo+Th1wxTMGUVFy
-imVvt6D6QqqHCUYrvcNEN0xBNFwJGq/0cgSy+w5szt/RRehmJKX8MbNeZxrznIIx
-B18ch9rbBltz+Y4R63rCN9MdsnGXf6PQ6a6doZhSI1pnDrui12MOQrU=
+MIIBpzCBkDANBgkqhkiG9w0BAQsFADBCMUAwPgYDVQQDDDdUZXN0IENBIGZvciBQ
+b3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRlc3Qgc2VydmVyIGNlcnRzFw0yMzA3
+MTMxNDM1MjRaGA8yMDUwMTEyODE0MzUyNFowGzAZAgggIwcTFjUjCxcNMjMwNzEz
+MTQzNTI0WjANBgkqhkiG9w0BAQsFAAOCAQEADIkF8oS84O2PJw/C9BAzgrkd+EsO
+QL6mXUGBgXwmujfpv0Z8YK91k4+xV9hQRMjWe/DkU01+gmFhYoDvAzweuNQzx8lZ
+bYKu0dGTEpTd+OG1LbxYmt4f5xh096R5iLo7c7e2kMHvfNG7VwvKQrPeMqh7AcKy
+Fukt8C0Xc7Tfv2l2toEQUAl5UDUKEAovN6iB0qycpvi0nboyiDo8mV0p1jlAn846
+EeXjwm8tyGXzTFq16ypPwnlBM9d5Ml/p5WTN69nDux18G+iSCr+UDzLDYvLF11p3
+lEqpSo5lQg9zYuOgMCvu3g5BtwJgORPSiW/yZ5BXUfWvPi0XRPrknxMByA==
-----END X509 CRL-----
diff --git a/src/test/ssl/ssl/server_ca.crt b/src/test/ssl/ssl/server_ca.crt
index 0d6d7a6f82..8b010e7ca4 100644
--- a/src/test/ssl/ssl/server_ca.crt
+++ b/src/test/ssl/ssl/server_ca.crt
@@ -1,19 +1,22 @@
-----BEGIN CERTIFICATE-----
-MIIDFDCCAfygAwIBAgIIICEDAxQSBwAwDQYJKoZIhvcNAQELBQAwQDE+MDwGA1UE
+MIIDnjCCAoagAwIBAgIIICMHExY1IwAwDQYJKoZIhvcNAQELBQAwQDE+MDwGA1UE
Aww1VGVzdCByb290IENBIGZvciBQb3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRl
-c3Qgc3VpdGUwHhcNMjEwMzAzMjIxMjA3WhcNNDgwNzE5MjIxMjA3WjBCMUAwPgYD
-VQQDDDdUZXN0IENBIGZvciBQb3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRlc3Qg
-c2VydmVyIGNlcnRzMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4kp2
-GW5nPb6QrSrtbClfZeutyQnHrm4TMPBoNepFdIVxBX/04BguM5ImDRze/huOWA+z
-atJAQqt3R7dsDwnOnPKUKCOuHX6a1aj5L86HtVgaWTXrZFE5NtL9PIzXkWu13UW0
-UesHtbPVRv6a6fB7Npph6hHy7iPZb009A8/lTJnxSPC39u/K/sPqjrVZaAJF+wDs
-qCxCZTUtAUFvWFnR/TeXLWlFzBupS1djgI7PltbJqSn6SKTAgNZTxpRJbu9Icp6J
-/50ELwT++0n0KWVXNHrDNfI5Gaa+SxClAsPsei2jLKpgR6QFC3wn38Z9q9LjAVuC
-+FWhoN1uhYeoricEXwIDAQABoxAwDjAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEB
-CwUAA4IBAQCdCA/EoXrustoV4jJGbkdXDuOUkBurwggSNBAqUBSDvCohRoD77Ecb
-QVuzPNxWKG+E4PwfUq2ha+2yPONEJ28ZgsbHq5qlJDMJ43wlcjn6wmmAJNeSpO8F
-0V9d2X/4wNZty9/zbwTnw26KChgDHumQ0WIbCoBtdqy8KDswYOvpgws6dqc021I7
-UrFo6vZek7VoApbJgkDL6qYADa6ApfW43ThH4sViFITeYt/kSHgmy2Udhs34jMM8
-xsFP/uYpRi1b1glenwSIKiHjD4/C9vnWQt5K3gRBvYukEj2Bw9VkNRpBVCi0cOoA
-OuwX3bwzNYNbZQv4K66oRpvuoEjCNeHg
+c3Qgc3VpdGUwIBcNMjMwNzEzMTQzNTIzWhgPMjA1MDExMjgxNDM1MjNaMEIxQDA+
+BgNVBAMMN1Rlc3QgQ0EgZm9yIFBvc3RncmVTUUwgU1NMIHJlZ3Jlc3Npb24gdGVz
+dCBzZXJ2ZXIgY2VydHMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDi
+SnYZbmc9vpCtKu1sKV9l663JCceubhMw8Gg16kV0hXEFf/TgGC4zkiYNHN7+G45Y
+D7Nq0kBCq3dHt2wPCc6c8pQoI64dfprVqPkvzoe1WBpZNetkUTk20v08jNeRa7Xd
+RbRR6we1s9VG/prp8Hs2mmHqEfLuI9lvTT0Dz+VMmfFI8Lf278r+w+qOtVloAkX7
+AOyoLEJlNS0BQW9YWdH9N5ctaUXMG6lLV2OAjs+W1smpKfpIpMCA1lPGlElu70hy
+non/nQQvBP77SfQpZVc0esM18jkZpr5LEKUCw+x6LaMsqmBHpAULfCffxn2r0uMB
+W4L4VaGg3W6Fh6iuJwRfAgMBAAGjgZcwgZQwDAYDVR0TBAUwAwEB/zAdBgNVHQ4E
+FgQU8o86ZkBQZEgi1y6C/1aewrPudAowZQYDVR0jBF4wXKFEpEIwQDE+MDwGA1UE
+Aww1VGVzdCByb290IENBIGZvciBQb3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRl
+c3Qgc3VpdGWCFBfnvJQgNLw9MyrcSA1T3Q2PyJIFMA0GCSqGSIb3DQEBCwUAA4IB
+AQANlEDrM357a7o+WcKB0Ocll2UtBMq7PDms1Pjqm3fFu/wdKDUomG8W2/MgDmFl
+CVeAPpofb6J0oaxiEZOR68pOhdccMznArtKix6t3RkDiXdm4d5UORMMR+s9CymXV
+MUTWpQpAg3qP3mRI+3E9OrgfhvmVcuOa7/cdTS/sylGe8Db+nJQD0be9NHtnhO56
+IA+Li+8oWzD4UNsP3gAmhLkyToz5wlPHzEkgGxkEySNErEOKTOX5Xyk5z+QToRhz
+adkt0mBw/dxoJk9DveCtIqxDelxJsDeJFtqoc5qVVE9yOp7rujGsqgWl2PcJeyKM
+Crh9qsqNzJ2R29pq0g6Lfzh2
-----END CERTIFICATE-----
--
2.32.1 (Apple Git-133)
------=_Part_1248179_1719184966.1689618400561
Content-Type: application/octet-stream;
name=v6-0002-Add-notBefore-and-notAfter-to-SSL-cert-info-displ.patch
Content-Transfer-Encoding: 7bit
X-ZM_AttachId: 139089112005750000
Content-Disposition: attachment;
filename=v6-0002-Add-notBefore-and-notAfter-to-SSL-cert-info-displ.patch
diff --git a/contrib/sslinfo/Makefile b/contrib/sslinfo/Makefile
index dd1ff83b16..78a5a83d5c 100644
--- a/contrib/sslinfo/Makefile
+++ b/contrib/sslinfo/Makefile
@@ -6,7 +6,7 @@ OBJS = \
sslinfo.o
EXTENSION = sslinfo
-DATA = sslinfo--1.2.sql sslinfo--1.1--1.2.sql sslinfo--1.0--1.1.sql
+DATA = sslinfo--1.2--1.3.sql sslinfo--1.2.sql sslinfo--1.1--1.2.sql sslinfo--1.0--1.1.sql
PGFILEDESC = "sslinfo - information about client SSL certificate"
ifdef USE_PGXS
diff --git a/contrib/sslinfo/meson.build b/contrib/sslinfo/meson.build
index 999456d3a4..215b01daff 100644
--- a/contrib/sslinfo/meson.build
+++ b/contrib/sslinfo/meson.build
@@ -26,6 +26,7 @@ install_data(
'sslinfo--1.0--1.1.sql',
'sslinfo--1.1--1.2.sql',
'sslinfo--1.2.sql',
+ 'sslinfo--1.2--1.3.sql',
'sslinfo.control',
kwargs: contrib_data_args,
)
diff --git a/contrib/sslinfo/sslinfo--1.2--1.3.sql b/contrib/sslinfo/sslinfo--1.2--1.3.sql
new file mode 100644
index 0000000000..9d64d2bfa4
--- /dev/null
+++ b/contrib/sslinfo/sslinfo--1.2--1.3.sql
@@ -0,0 +1,12 @@
+/* contrib/sslinfo/sslinfo--1.2--1.3.sql */
+
+-- complain if script is sourced in psql, rather than via CREATE EXTENSION
+\echo Use "CREATE EXTENSION sslinfo" to load this file. \quit
+
+CREATE FUNCTION ssl_client_get_notbefore() RETURNS timestamp
+AS 'MODULE_PATHNAME', 'ssl_client_get_notbefore'
+LANGUAGE C STRICT PARALLEL RESTRICTED;
+
+CREATE FUNCTION ssl_client_get_notafter() RETURNS timestamp
+AS 'MODULE_PATHNAME', 'ssl_client_get_notafter'
+LANGUAGE C STRICT PARALLEL RESTRICTED;
diff --git a/contrib/sslinfo/sslinfo.c b/contrib/sslinfo/sslinfo.c
index 5fd46b9874..c3b95e7d60 100644
--- a/contrib/sslinfo/sslinfo.c
+++ b/contrib/sslinfo/sslinfo.c
@@ -18,6 +18,7 @@
#include "libpq/libpq-be.h"
#include "miscadmin.h"
#include "utils/builtins.h"
+#include "utils/timestamp.h"
/*
* On Windows, <wincrypt.h> includes a #define for X509_NAME, which breaks our
@@ -34,6 +35,7 @@ PG_MODULE_MAGIC;
static Datum X509_NAME_field_to_text(X509_NAME *name, text *fieldName);
static Datum ASN1_STRING_to_text(ASN1_STRING *str);
+static Datum ASN1_TIME_to_timestamp(ASN1_TIME *time);
/*
* Function context for data persisting over repeated calls.
@@ -225,6 +227,37 @@ X509_NAME_field_to_text(X509_NAME *name, text *fieldName)
}
+/*
+ * Converts OpenSSL ASN1_TIME structure into timestamp
+ *
+ * Parameter: time - OpenSSL ASN1_TIME structure.
+ *
+ * Returns Datum, which can be directly returned from a C language SQL
+ * function.
+ */
+static Datum
+ASN1_TIME_to_timestamp(ASN1_TIME * time)
+{
+ struct tm tm_time;
+ struct pg_tm pgtm_time;
+ Timestamp ts;
+
+ ASN1_TIME_to_tm(time, &tm_time);
+
+ pgtm_time.tm_sec = tm_time.tm_sec;
+ pgtm_time.tm_min = tm_time.tm_min;
+ pgtm_time.tm_hour = tm_time.tm_hour;
+ pgtm_time.tm_mday = tm_time.tm_mday;
+ pgtm_time.tm_mon = tm_time.tm_mon + 1;
+ pgtm_time.tm_year = tm_time.tm_year + 1900;
+
+ if (tm2timestamp(&pgtm_time, 0, NULL, &ts))
+ elog(ERROR, "timestamp out of range");
+
+ PG_RETURN_TIMESTAMP(ts);
+}
+
+
/*
* Returns specified field of client certificate distinguished name
*
@@ -482,3 +515,35 @@ ssl_extension_info(PG_FUNCTION_ARGS)
/* All done */
SRF_RETURN_DONE(funcctx);
}
+
+/*
+ * Returns current client certificate notBefore timestamp in
+ * timestamp data type
+ */
+PG_FUNCTION_INFO_V1(ssl_client_get_notbefore);
+Datum
+ssl_client_get_notbefore(PG_FUNCTION_ARGS)
+{
+ X509 *cert = MyProcPort->peer;
+
+ if (!MyProcPort->ssl_in_use || !MyProcPort->peer_cert_valid)
+ PG_RETURN_NULL();
+
+ return ASN1_TIME_to_timestamp(X509_get_notBefore(cert));
+}
+
+/*
+ * Returns current client certificate notAfter timestamp in
+ * timestamp data type
+ */
+PG_FUNCTION_INFO_V1(ssl_client_get_notafter);
+Datum
+ssl_client_get_notafter(PG_FUNCTION_ARGS)
+{
+ X509 *cert = MyProcPort->peer;
+
+ if (!MyProcPort->ssl_in_use || !MyProcPort->peer_cert_valid)
+ PG_RETURN_NULL();
+
+ return ASN1_TIME_to_timestamp(X509_get_notAfter(cert));
+}
diff --git a/contrib/sslinfo/sslinfo.control b/contrib/sslinfo/sslinfo.control
index c7754f924c..b53e95b7da 100644
--- a/contrib/sslinfo/sslinfo.control
+++ b/contrib/sslinfo/sslinfo.control
@@ -1,5 +1,5 @@
# sslinfo extension
comment = 'information about SSL certificates'
-default_version = '1.2'
+default_version = '1.3'
module_pathname = '$libdir/sslinfo'
relocatable = true
diff --git a/doc/src/sgml/monitoring.sgml b/doc/src/sgml/monitoring.sgml
index 588b720f57..42c7808f50 100644
--- a/doc/src/sgml/monitoring.sgml
+++ b/doc/src/sgml/monitoring.sgml
@@ -2257,6 +2257,26 @@ SELECT pid, wait_event_type, wait_event FROM pg_stat_activity WHERE wait_event i
This field is truncated like <structfield>client_dn</structfield>.
</para></entry>
</row>
+
+ <row>
+ <entry role="catalog_table_entry"><para role="column_definition">
+ <structfield>not_before</structfield> <type>text</type>
+ </para>
+ <para>
+ Not before UTC timestamp of the client certificate, or NULL if no client
+ certificate was supplied.
+ </para></entry>
+ </row>
+
+ <row>
+ <entry role="catalog_table_entry"><para role="column_definition">
+ <structfield>not_after</structfield> <type>text</type>
+ </para>
+ <para>
+ Not after UTC timestamp of the client certificate, or NULL if no client
+ certificate was supplied.
+ </para></entry>
+ </row>
</tbody>
</tgroup>
</table>
diff --git a/doc/src/sgml/sslinfo.sgml b/doc/src/sgml/sslinfo.sgml
index 85d49f6653..06f5728096 100644
--- a/doc/src/sgml/sslinfo.sgml
+++ b/doc/src/sgml/sslinfo.sgml
@@ -240,6 +240,36 @@ emailAddress
</para>
</listitem>
</varlistentry>
+
+ <varlistentry>
+ <term>
+ <function>ssl_client_get_notbefore() returns text</function>
+ <indexterm>
+ <primary>ssl_client_get_notbefore</primary>
+ </indexterm>
+ </term>
+ <listitem>
+ <para>
+ Return the <structfield>not before</structfield> UTC timestamp of the client
+ certificate.
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>
+ <function>ssl_client_get_notafter() returns text</function>
+ <indexterm>
+ <primary>ssl_client_get_notafter</primary>
+ </indexterm>
+ </term>
+ <listitem>
+ <para>
+ Return the <structfield>not after</structfield> UTC timestamp of the client
+ certificate.
+ </para>
+ </listitem>
+ </varlistentry>
</variablelist>
</sect2>
diff --git a/src/backend/catalog/system_views.sql b/src/backend/catalog/system_views.sql
index af65af6bdd..f7c2cfb8cd 100644
--- a/src/backend/catalog/system_views.sql
+++ b/src/backend/catalog/system_views.sql
@@ -970,7 +970,9 @@ CREATE VIEW pg_stat_ssl AS
S.sslbits AS bits,
S.ssl_client_dn AS client_dn,
S.ssl_client_serial AS client_serial,
- S.ssl_issuer_dn AS issuer_dn
+ S.ssl_issuer_dn AS issuer_dn,
+ S.ssl_not_before AS not_before,
+ S.ssl_not_after AS not_after
FROM pg_stat_get_activity(NULL) AS S
WHERE S.client_port IS NOT NULL;
diff --git a/src/backend/libpq/be-secure-openssl.c b/src/backend/libpq/be-secure-openssl.c
index 658b09988d..41aa0cf720 100644
--- a/src/backend/libpq/be-secure-openssl.c
+++ b/src/backend/libpq/be-secure-openssl.c
@@ -36,6 +36,7 @@
#include "tcop/tcopprot.h"
#include "utils/builtins.h"
#include "utils/memutils.h"
+#include "utils/timestamp.h"
/*
* These SSL-related #includes must come after all system-provided headers.
@@ -72,6 +73,7 @@ static bool initialize_ecdh(SSL_CTX *context, bool isServerStart);
static const char *SSLerrmessage(unsigned long ecode);
static char *X509_NAME_to_cstring(X509_NAME *name);
+static Timestamp ASN1_TIME_to_timestamp(ASN1_TIME *time);
static SSL_CTX *SSL_context = NULL;
static bool SSL_initialized = false;
@@ -1406,6 +1408,24 @@ be_tls_get_peer_issuer_name(Port *port, char *ptr, size_t len)
ptr[0] = '\0';
}
+void
+be_tls_get_peer_not_before(Port *port, Timestamp *ptr)
+{
+ if (port->peer)
+ *ptr = ASN1_TIME_to_timestamp(X509_get_notBefore(port->peer));
+ else
+ *ptr = 0;
+}
+
+void
+be_tls_get_peer_not_after(Port *port, Timestamp *ptr)
+{
+ if (port->peer)
+ *ptr = ASN1_TIME_to_timestamp(X509_get_notAfter(port->peer));
+ else
+ *ptr = 0;
+}
+
void
be_tls_get_peer_serial(Port *port, char *ptr, size_t len)
{
@@ -1549,6 +1569,31 @@ X509_NAME_to_cstring(X509_NAME *name)
return result;
}
+/*
+ * Convert an ASN1_TIME to a cstring in format of YYYY-MM-DDThh:mm:ssZ.
+ */
+static Timestamp
+ASN1_TIME_to_timestamp(ASN1_TIME * time)
+{
+ struct tm tm_time;
+ struct pg_tm pgtm_time;
+ Timestamp ts;
+
+ ASN1_TIME_to_tm(time, &tm_time);
+
+ pgtm_time.tm_sec = tm_time.tm_sec;
+ pgtm_time.tm_min = tm_time.tm_min;
+ pgtm_time.tm_hour = tm_time.tm_hour;
+ pgtm_time.tm_mday = tm_time.tm_mday;
+ pgtm_time.tm_mon = tm_time.tm_mon + 1;
+ pgtm_time.tm_year = tm_time.tm_year + 1900;
+
+ if (tm2timestamp(&pgtm_time, 0, NULL, &ts))
+ elog(ERROR, "timestamp out of range");
+
+ return ts;
+}
+
/*
* Convert TLS protocol version GUC enum to OpenSSL values
*
diff --git a/src/backend/utils/activity/backend_status.c b/src/backend/utils/activity/backend_status.c
index 38f91a495b..02dc9d7931 100644
--- a/src/backend/utils/activity/backend_status.c
+++ b/src/backend/utils/activity/backend_status.c
@@ -367,6 +367,8 @@ pgstat_bestart(void)
be_tls_get_peer_subject_name(MyProcPort, lsslstatus.ssl_client_dn, NAMEDATALEN);
be_tls_get_peer_serial(MyProcPort, lsslstatus.ssl_client_serial, NAMEDATALEN);
be_tls_get_peer_issuer_name(MyProcPort, lsslstatus.ssl_issuer_dn, NAMEDATALEN);
+ be_tls_get_peer_not_before(MyProcPort, &lsslstatus.ssl_not_before);
+ be_tls_get_peer_not_after(MyProcPort, &lsslstatus.ssl_not_after);
}
else
{
diff --git a/src/backend/utils/adt/pgstatfuncs.c b/src/backend/utils/adt/pgstatfuncs.c
index 2a4c8ef87f..9071981f98 100644
--- a/src/backend/utils/adt/pgstatfuncs.c
+++ b/src/backend/utils/adt/pgstatfuncs.c
@@ -303,7 +303,7 @@ pg_stat_get_progress_info(PG_FUNCTION_ARGS)
Datum
pg_stat_get_activity(PG_FUNCTION_ARGS)
{
-#define PG_STAT_GET_ACTIVITY_COLS 31
+#define PG_STAT_GET_ACTIVITY_COLS 33
int num_backends = pgstat_fetch_stat_numbackends();
int curr_backend;
int pid = PG_ARGISNULL(0) ? -1 : PG_GETARG_INT32(0);
@@ -395,7 +395,7 @@ pg_stat_get_activity(PG_FUNCTION_ARGS)
pfree(clipped_activity);
/* leader_pid */
- nulls[29] = true;
+ nulls[31] = true;
proc = BackendPidGetProc(beentry->st_procpid);
@@ -432,8 +432,8 @@ pg_stat_get_activity(PG_FUNCTION_ARGS)
*/
if (leader && leader->pid != beentry->st_procpid)
{
- values[29] = Int32GetDatum(leader->pid);
- nulls[29] = false;
+ values[31] = Int32GetDatum(leader->pid);
+ nulls[31] = false;
}
else if (beentry->st_backendType == B_BG_WORKER)
{
@@ -441,8 +441,8 @@ pg_stat_get_activity(PG_FUNCTION_ARGS)
if (leader_pid != InvalidPid)
{
- values[29] = Int32GetDatum(leader_pid);
- nulls[29] = false;
+ values[31] = Int32GetDatum(leader_pid);
+ nulls[31] = false;
}
}
}
@@ -587,35 +587,45 @@ pg_stat_get_activity(PG_FUNCTION_ARGS)
values[24] = CStringGetTextDatum(beentry->st_sslstatus->ssl_issuer_dn);
else
nulls[24] = true;
+
+ if (beentry->st_sslstatus->ssl_not_before != 0)
+ values[25] = TimestampGetDatum(beentry->st_sslstatus->ssl_not_before);
+ else
+ nulls[25] = true;
+
+ if (beentry->st_sslstatus->ssl_not_after != 0)
+ values[26] = TimestampGetDatum(beentry->st_sslstatus->ssl_not_after);
+ else
+ nulls[26] = true;
}
else
{
values[18] = BoolGetDatum(false); /* ssl */
- nulls[19] = nulls[20] = nulls[21] = nulls[22] = nulls[23] = nulls[24] = true;
+ nulls[19] = nulls[20] = nulls[21] = nulls[22] = nulls[23] = nulls[24] = nulls[25] = nulls[26] = true;
}
/* GSSAPI information */
if (beentry->st_gss)
{
- values[25] = BoolGetDatum(beentry->st_gssstatus->gss_auth); /* gss_auth */
- values[26] = CStringGetTextDatum(beentry->st_gssstatus->gss_princ);
- values[27] = BoolGetDatum(beentry->st_gssstatus->gss_enc); /* GSS Encryption in use */
- values[28] = BoolGetDatum(beentry->st_gssstatus->gss_delegation); /* GSS credentials
+ values[27] = BoolGetDatum(beentry->st_gssstatus->gss_auth); /* gss_auth */
+ values[28] = CStringGetTextDatum(beentry->st_gssstatus->gss_princ);
+ values[29] = BoolGetDatum(beentry->st_gssstatus->gss_enc); /* GSS Encryption in use */
+ values[30] = BoolGetDatum(beentry->st_gssstatus->gss_delegation); /* GSS credentials
* delegated */
}
else
{
- values[25] = BoolGetDatum(false); /* gss_auth */
- nulls[26] = true; /* No GSS principal */
- values[27] = BoolGetDatum(false); /* GSS Encryption not in
+ values[27] = BoolGetDatum(false); /* gss_auth */
+ nulls[28] = true; /* No GSS principal */
+ values[29] = BoolGetDatum(false); /* GSS Encryption not in
* use */
- values[28] = BoolGetDatum(false); /* GSS credentials not
+ values[30] = BoolGetDatum(false); /* GSS credentials not
* delegated */
}
if (beentry->st_query_id == 0)
- nulls[30] = true;
+ nulls[32] = true;
else
- values[30] = UInt64GetDatum(beentry->st_query_id);
+ values[32] = UInt64GetDatum(beentry->st_query_id);
}
else
{
@@ -645,6 +655,8 @@ pg_stat_get_activity(PG_FUNCTION_ARGS)
nulls[28] = true;
nulls[29] = true;
nulls[30] = true;
+ nulls[31] = true;
+ nulls[32] = true;
}
tuplestore_putvalues(rsinfo->setResult, rsinfo->setDesc, values, nulls);
diff --git a/src/include/catalog/pg_proc.dat b/src/include/catalog/pg_proc.dat
index 6996073989..878c997e87 100644
--- a/src/include/catalog/pg_proc.dat
+++ b/src/include/catalog/pg_proc.dat
@@ -5413,9 +5413,9 @@
proname => 'pg_stat_get_activity', prorows => '100', proisstrict => 'f',
proretset => 't', provolatile => 's', proparallel => 'r',
prorettype => 'record', proargtypes => 'int4',
- proallargtypes => '{int4,oid,int4,oid,text,text,text,text,text,timestamptz,timestamptz,timestamptz,timestamptz,inet,text,int4,xid,xid,text,bool,text,text,int4,text,numeric,text,bool,text,bool,bool,int4,int8}',
- proargmodes => '{i,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o}',
- proargnames => '{pid,datid,pid,usesysid,application_name,state,query,wait_event_type,wait_event,xact_start,query_start,backend_start,state_change,client_addr,client_hostname,client_port,backend_xid,backend_xmin,backend_type,ssl,sslversion,sslcipher,sslbits,ssl_client_dn,ssl_client_serial,ssl_issuer_dn,gss_auth,gss_princ,gss_enc,gss_delegation,leader_pid,query_id}',
+ proallargtypes => '{int4,oid,int4,oid,text,text,text,text,text,timestamptz,timestamptz,timestamptz,timestamptz,inet,text,int4,xid,xid,text,bool,text,text,int4,text,numeric,text,timestamp,timestamp,bool,text,bool,bool,int4,int8}',
+ proargmodes => '{i,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o}',
+ proargnames => '{pid,datid,pid,usesysid,application_name,state,query,wait_event_type,wait_event,xact_start,query_start,backend_start,state_change,client_addr,client_hostname,client_port,backend_xid,backend_xmin,backend_type,ssl,sslversion,sslcipher,sslbits,ssl_client_dn,ssl_client_serial,ssl_issuer_dn,ssl_not_before,ssl_not_after,gss_auth,gss_princ,gss_enc,gss_delegation,leader_pid,query_id}',
prosrc => 'pg_stat_get_activity' },
{ oid => '3318',
descr => 'statistics: information about progress of backends running maintenance command',
diff --git a/src/include/libpq/libpq-be.h b/src/include/libpq/libpq-be.h
index a0b74c8095..02765ba9d9 100644
--- a/src/include/libpq/libpq-be.h
+++ b/src/include/libpq/libpq-be.h
@@ -298,6 +298,8 @@ extern const char *be_tls_get_cipher(Port *port);
extern void be_tls_get_peer_subject_name(Port *port, char *ptr, size_t len);
extern void be_tls_get_peer_issuer_name(Port *port, char *ptr, size_t len);
extern void be_tls_get_peer_serial(Port *port, char *ptr, size_t len);
+extern void be_tls_get_peer_not_before(Port *port, Timestamp *ptr);
+extern void be_tls_get_peer_not_after(Port *port, Timestamp *ptr);
/*
* Get the server certificate hash for SCRAM channel binding type
diff --git a/src/include/utils/backend_status.h b/src/include/utils/backend_status.h
index 77939a0aed..1e4fedb661 100644
--- a/src/include/utils/backend_status.h
+++ b/src/include/utils/backend_status.h
@@ -61,6 +61,8 @@ typedef struct PgBackendSSLStatus
char ssl_client_serial[NAMEDATALEN];
char ssl_issuer_dn[NAMEDATALEN];
+ Timestamp ssl_not_before;
+ Timestamp ssl_not_after;
} PgBackendSSLStatus;
/*
diff --git a/src/test/regress/expected/rules.out b/src/test/regress/expected/rules.out
index e07afcd4aa..30108846c1 100644
--- a/src/test/regress/expected/rules.out
+++ b/src/test/regress/expected/rules.out
@@ -1760,7 +1760,7 @@ pg_stat_activity| SELECT s.datid,
s.query_id,
s.query,
s.backend_type
- FROM ((pg_stat_get_activity(NULL::integer) s(datid, pid, usesysid, application_name, state, query, wait_event_type, wait_event, xact_start, query_start, backend_start, state_change, client_addr, client_hostname, client_port, backend_xid, backend_xmin, backend_type, ssl, sslversion, sslcipher, sslbits, ssl_client_dn, ssl_client_serial, ssl_issuer_dn, gss_auth, gss_princ, gss_enc, gss_delegation, leader_pid, query_id)
+ FROM ((pg_stat_get_activity(NULL::integer) s(datid, pid, usesysid, application_name, state, query, wait_event_type, wait_event, xact_start, query_start, backend_start, state_change, client_addr, client_hostname, client_port, backend_xid, backend_xmin, backend_type, ssl, sslversion, sslcipher, sslbits, ssl_client_dn, ssl_client_serial, ssl_issuer_dn, ssl_not_before, ssl_not_after, gss_auth, gss_princ, gss_enc, gss_delegation, leader_pid, query_id)
LEFT JOIN pg_database d ON ((s.datid = d.oid)))
LEFT JOIN pg_authid u ON ((s.usesysid = u.oid)));
pg_stat_all_indexes| SELECT c.oid AS relid,
@@ -1878,7 +1878,7 @@ pg_stat_gssapi| SELECT pid,
gss_princ AS principal,
gss_enc AS encrypted,
gss_delegation AS credentials_delegated
- FROM pg_stat_get_activity(NULL::integer) s(datid, pid, usesysid, application_name, state, query, wait_event_type, wait_event, xact_start, query_start, backend_start, state_change, client_addr, client_hostname, client_port, backend_xid, backend_xmin, backend_type, ssl, sslversion, sslcipher, sslbits, ssl_client_dn, ssl_client_serial, ssl_issuer_dn, gss_auth, gss_princ, gss_enc, gss_delegation, leader_pid, query_id)
+ FROM pg_stat_get_activity(NULL::integer) s(datid, pid, usesysid, application_name, state, query, wait_event_type, wait_event, xact_start, query_start, backend_start, state_change, client_addr, client_hostname, client_port, backend_xid, backend_xmin, backend_type, ssl, sslversion, sslcipher, sslbits, ssl_client_dn, ssl_client_serial, ssl_issuer_dn, ssl_not_before, ssl_not_after, gss_auth, gss_princ, gss_enc, gss_delegation, leader_pid, query_id)
WHERE (client_port IS NOT NULL);
pg_stat_io| SELECT backend_type,
object,
@@ -2080,7 +2080,7 @@ pg_stat_replication| SELECT s.pid,
w.sync_priority,
w.sync_state,
w.reply_time
- FROM ((pg_stat_get_activity(NULL::integer) s(datid, pid, usesysid, application_name, state, query, wait_event_type, wait_event, xact_start, query_start, backend_start, state_change, client_addr, client_hostname, client_port, backend_xid, backend_xmin, backend_type, ssl, sslversion, sslcipher, sslbits, ssl_client_dn, ssl_client_serial, ssl_issuer_dn, gss_auth, gss_princ, gss_enc, gss_delegation, leader_pid, query_id)
+ FROM ((pg_stat_get_activity(NULL::integer) s(datid, pid, usesysid, application_name, state, query, wait_event_type, wait_event, xact_start, query_start, backend_start, state_change, client_addr, client_hostname, client_port, backend_xid, backend_xmin, backend_type, ssl, sslversion, sslcipher, sslbits, ssl_client_dn, ssl_client_serial, ssl_issuer_dn, ssl_not_before, ssl_not_after, gss_auth, gss_princ, gss_enc, gss_delegation, leader_pid, query_id)
JOIN pg_stat_get_wal_senders() w(pid, state, sent_lsn, write_lsn, flush_lsn, replay_lsn, write_lag, flush_lag, replay_lag, sync_priority, sync_state, reply_time) ON ((s.pid = w.pid)))
LEFT JOIN pg_authid u ON ((s.usesysid = u.oid)));
pg_stat_replication_slots| SELECT s.slot_name,
@@ -2113,8 +2113,10 @@ pg_stat_ssl| SELECT pid,
sslbits AS bits,
ssl_client_dn AS client_dn,
ssl_client_serial AS client_serial,
- ssl_issuer_dn AS issuer_dn
- FROM pg_stat_get_activity(NULL::integer) s(datid, pid, usesysid, application_name, state, query, wait_event_type, wait_event, xact_start, query_start, backend_start, state_change, client_addr, client_hostname, client_port, backend_xid, backend_xmin, backend_type, ssl, sslversion, sslcipher, sslbits, ssl_client_dn, ssl_client_serial, ssl_issuer_dn, gss_auth, gss_princ, gss_enc, gss_delegation, leader_pid, query_id)
+ ssl_issuer_dn AS issuer_dn,
+ ssl_not_before AS not_before,
+ ssl_not_after AS not_after
+ FROM pg_stat_get_activity(NULL::integer) s(datid, pid, usesysid, application_name, state, query, wait_event_type, wait_event, xact_start, query_start, backend_start, state_change, client_addr, client_hostname, client_port, backend_xid, backend_xmin, backend_type, ssl, sslversion, sslcipher, sslbits, ssl_client_dn, ssl_client_serial, ssl_issuer_dn, ssl_not_before, ssl_not_after, gss_auth, gss_princ, gss_enc, gss_delegation, leader_pid, query_id)
WHERE (client_port IS NOT NULL);
pg_stat_subscription| SELECT su.oid AS subid,
su.subname,
diff --git a/src/test/ssl/t/001_ssltests.pl b/src/test/ssl/t/001_ssltests.pl
index 76442de063..bad41cacc8 100644
--- a/src/test/ssl/t/001_ssltests.pl
+++ b/src/test/ssl/t/001_ssltests.pl
@@ -543,8 +543,8 @@ command_like(
"$common_connstr sslrootcert=invalid", '-c',
"SELECT * FROM pg_stat_ssl WHERE pid = pg_backend_pid()"
],
- qr{^pid,ssl,version,cipher,bits,client_dn,client_serial,issuer_dn\r?\n
- ^\d+,t,TLSv[\d.]+,[\w-]+,\d+,_null_,_null_,_null_\r?$}mx,
+ qr{^pid,ssl,version,cipher,bits,client_dn,client_serial,issuer_dn,not_before,not_after\r?\n
+ ^\d+,t,TLSv[\d.]+,[\w-]+,\d+,_null_,_null_,_null_,_null_,_null_\r?$}mx,
'pg_stat_ssl view without client certificate');
# Test min/max SSL protocol versions.
@@ -745,8 +745,8 @@ command_like(
'-c',
"SELECT * FROM pg_stat_ssl WHERE pid = pg_backend_pid()"
],
- qr{^pid,ssl,version,cipher,bits,client_dn,client_serial,issuer_dn\r?\n
- ^\d+,t,TLSv[\d.]+,[\w-]+,\d+,/?CN=ssltestuser,$serialno,/?\QCN=Test CA for PostgreSQL SSL regression test client certs\E\r?$}mx,
+ qr{^pid,ssl,version,cipher,bits,client_dn,client_serial,issuer_dn,not_before,not_after\r?\n
+ ^\d+,t,TLSv[\d.]+,[\w-]+,\d+,/?CN=ssltestuser,$serialno,/?\QCN=Test CA for PostgreSQL SSL regression test client certs\E,\Q2023-06-29 01:01:01\E,\Q2050-01-01 01:01:01\E\r?$}mx,
'pg_stat_ssl with client certificate');
# client key with wrong permissions
diff --git a/src/test/ssl/t/003_sslinfo.pl b/src/test/ssl/t/003_sslinfo.pl
index 5306aad802..f050a6f4f9 100644
--- a/src/test/ssl/t/003_sslinfo.pl
+++ b/src/test/ssl/t/003_sslinfo.pl
@@ -165,6 +165,20 @@ $result = $node->safe_psql(
connstr => $common_connstr);
is($result, 't', "ssl_issuer_field() for commonName");
+$result = $node->safe_psql(
+ "certdb",
+ "SELECT ssl_client_get_notbefore() = not_before, "
+ . "not_before = '2023-06-29 01:01:01' FROM pg_stat_ssl WHERE pid = pg_backend_pid();",
+ connstr => $common_connstr);
+is($result, 't|t', "ssl_client_get_notbefore() for not_before timestamp");
+
+$result = $node->safe_psql(
+ "certdb",
+ "SELECT ssl_client_get_notafter() = not_after, "
+ . "not_after = '2050-01-01 01:01:01' FROM pg_stat_ssl WHERE pid = pg_backend_pid();",
+ connstr => $common_connstr);
+is($result, 't|t', "ssl_client_get_notafter() for not_after timestamp");
+
$result = $node->safe_psql(
"certdb",
"SELECT value, critical FROM ssl_extension_info() WHERE name = 'basicConstraints';",
------=_Part_1248179_1719184966.1689618400561--
^ permalink raw reply [nested|flat] 16+ messages in thread
* [PATCH v5 1/2] Set fixed dates for test certificates validity
@ 2023-07-13 15:44 Daniel Gustafsson <[email protected]>
0 siblings, 0 replies; 16+ messages in thread
From: Daniel Gustafsson @ 2023-07-13 15:44 UTC (permalink / raw)
Rather than specifying a validity of 10 000 days into the future
for test certificate generation, this hardcodes the notBefore and
notAfter attributes to set values. This will allow writing tests
which will not depend on when the certificates were generated. An
upcoming patch for adding notBefore and notAfter to pg_stat_ssl
and sslinfo requires this.
Discussion: https://postgr.es/m/[email protected]
---
src/test/ssl/conf/cas.config | 5 +-
src/test/ssl/ssl/both-cas-1.crt | 70 ++++++++++---------
src/test/ssl/ssl/both-cas-2.crt | 70 ++++++++++---------
src/test/ssl/ssl/client+client_ca.crt | 65 +++++++++--------
src/test/ssl/ssl/client-crldir/9bb9e3c3.r0 | 20 +++---
src/test/ssl/ssl/client-dn.crt | 32 ++++-----
src/test/ssl/ssl/client-long.crt | 34 ++++-----
src/test/ssl/ssl/client-revoked-utf8.crt | 30 ++++----
src/test/ssl/ssl/client-revoked.crt | 30 ++++----
src/test/ssl/ssl/client.crl | 20 +++---
src/test/ssl/ssl/client.crt | 30 ++++----
src/test/ssl/ssl/client_ca.crt | 35 +++++-----
src/test/ssl/ssl/client_ext.crt | 33 +++++----
.../ssl/ssl/root+client-crldir/9bb9e3c3.r0 | 20 +++---
src/test/ssl/ssl/root+client.crl | 20 +++---
src/test/ssl/ssl/root+client_ca.crt | 35 +++++-----
.../ssl/ssl/root+server-crldir/a836cc2d.r0 | 18 ++---
src/test/ssl/ssl/root+server.crl | 18 ++---
src/test/ssl/ssl/root+server_ca.crt | 35 +++++-----
src/test/ssl/ssl/server-cn-and-alt-names.crt | 36 +++++-----
.../ssl/ssl/server-cn-and-ip-alt-names.crt | 35 +++++-----
src/test/ssl/ssl/server-cn-only+server_ca.crt | 67 +++++++++---------
src/test/ssl/ssl/server-cn-only.crt | 32 ++++-----
src/test/ssl/ssl/server-crldir/a836cc2d.r0 | 18 ++---
src/test/ssl/ssl/server-ip-alt-names.crt | 33 ++++-----
.../ssl/ssl/server-ip-cn-and-alt-names.crt | 34 ++++-----
.../ssl/server-ip-cn-and-dns-alt-names.crt | 35 +++++-----
src/test/ssl/ssl/server-ip-cn-only.crt | 30 ++++----
src/test/ssl/ssl/server-ip-in-dnsname.crt | 32 +++++----
.../ssl/ssl/server-multiple-alt-names.crt | 36 +++++-----
src/test/ssl/ssl/server-no-names.crt | 30 ++++----
src/test/ssl/ssl/server-revoked.crt | 32 ++++-----
src/test/ssl/ssl/server-single-alt-name.crt | 33 ++++-----
src/test/ssl/ssl/server.crl | 18 ++---
src/test/ssl/ssl/server_ca.crt | 35 +++++-----
35 files changed, 600 insertions(+), 556 deletions(-)
diff --git a/src/test/ssl/conf/cas.config b/src/test/ssl/conf/cas.config
index 2c4851033a..43bcf739bb 100644
--- a/src/test/ssl/conf/cas.config
+++ b/src/test/ssl/conf/cas.config
@@ -38,7 +38,10 @@ crl = ./ssl/server.crl
dir = ./ssl/
database = ./ssl/client_ca-certindex
default_md = sha256
-default_days= 10000
+# Startdate and enddate are required for testing notBefore/notAfter with
+# stable timestamps.
+default_startdate = 20230629010101Z
+default_enddate = 20500101010101Z
default_crl_days= 10000
certificate = ./ssl/client_ca.crt
private_key = ./ssl/client_ca.key
diff --git a/src/test/ssl/ssl/both-cas-1.crt b/src/test/ssl/ssl/both-cas-1.crt
index 4f4bc707d6..1584b4ba0e 100644
--- a/src/test/ssl/ssl/both-cas-1.crt
+++ b/src/test/ssl/ssl/both-cas-1.crt
@@ -18,40 +18,46 @@ OCZhKLxVZiZmO71BBwsTgwtU58/G9e2ciGGdltI8ANlmVfdtwgRz3b7H9EUZat6s
kubl/m5HWBsKJEWEzFWrWkQV3ipoTmorJ6KCGABBCeVYmg==
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
-MIIDFDCCAfygAwIBAgIIICEDAxQSBwEwDQYJKoZIhvcNAQELBQAwQDE+MDwGA1UE
+MIIDnjCCAoagAwIBAgIIICMHExY1IwEwDQYJKoZIhvcNAQELBQAwQDE+MDwGA1UE
Aww1VGVzdCByb290IENBIGZvciBQb3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRl
-c3Qgc3VpdGUwHhcNMjEwMzAzMjIxMjA3WhcNNDgwNzE5MjIxMjA3WjBCMUAwPgYD
-VQQDDDdUZXN0IENBIGZvciBQb3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRlc3Qg
-Y2xpZW50IGNlcnRzMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu+ce
-8rkNfoCvI9Wjug9pxsptsdjhZ4s7ZZ8eD5VlloryK2JccusQIX61XY8I3OZjLTgq
-1SpZbHQvktRH6gmU7tfoBdEnRuXB7idkbYOKIrC0hdttb/5rDzjQGtXTmwoVrCcJ
-nvO1Whay/gdsoqX1tT1MTPWu/6dfQkQXA0PizVvmBasAEQchxqtcH2rSc6TPE13v
-lxJ0X1vSlz92uT6kenrxUDs43AH/kASdIQBHXVA4XWBAm7NRqwKX7BBwbsF2m3Qh
-+NY9Bf9MnJHLcnVnwZdlW5nd7H7BTB43XvkiYascqusYki+fY58eGSprZ/VUjmGx
-pgQnQXWCu0U3JyUL/QIDAQABoxAwDjAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEB
-CwUAA4IBAQC1syY2Rk02m5PGtfkMUIU7ZSe0mM+g0BgWAyCF/mFFYdfY0xHtqy0x
-QWkW9OR0KBl4JpphDDolHoNL3TLydH3t4inX8SAOpaUdsjMcIPKqjT1htQm0Pk5r
-vFYvKuVrxMnV0F+wMmZRuziKWrZlVDwBMfCAchzuVexDWfcjTmUQmhZxJuUzORw3
-swgh9HIpxjMkgdlHodbMAEpMIkkoeJnph3I9uTocXZbK/lAInggQdm0Q+on1ZT0A
-ljO/6jisDZzIguE4ZAQ2DfYsGI8H3tz/+76uIwwBNOmu0woUDSWXVcPWiviq49Bi
-GmH0KlUfWAphj86IfTWXT1HRay3eZQt3
+c3Qgc3VpdGUwIBcNMjMwNzEzMTQzNTIzWhgPMjA1MDExMjgxNDM1MjNaMEIxQDA+
+BgNVBAMMN1Rlc3QgQ0EgZm9yIFBvc3RncmVTUUwgU1NMIHJlZ3Jlc3Npb24gdGVz
+dCBjbGllbnQgY2VydHMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC7
+5x7yuQ1+gK8j1aO6D2nGym2x2OFniztlnx4PlWWWivIrYlxy6xAhfrVdjwjc5mMt
+OCrVKllsdC+S1EfqCZTu1+gF0SdG5cHuJ2Rtg4oisLSF221v/msPONAa1dObChWs
+Jwme87VaFrL+B2yipfW1PUxM9a7/p19CRBcDQ+LNW+YFqwARByHGq1wfatJzpM8T
+Xe+XEnRfW9KXP3a5PqR6evFQOzjcAf+QBJ0hAEddUDhdYECbs1GrApfsEHBuwXab
+dCH41j0F/0yckctydWfBl2Vbmd3sfsFMHjde+SJhqxyq6xiSL59jnx4ZKmtn9VSO
+YbGmBCdBdYK7RTcnJQv9AgMBAAGjgZcwgZQwDAYDVR0TBAUwAwEB/zAdBgNVHQ4E
+FgQUn6Tr0smZ3rADsDA0IoFhFUu9rTYwZQYDVR0jBF4wXKFEpEIwQDE+MDwGA1UE
+Aww1VGVzdCByb290IENBIGZvciBQb3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRl
+c3Qgc3VpdGWCFBfnvJQgNLw9MyrcSA1T3Q2PyJIFMA0GCSqGSIb3DQEBCwUAA4IB
+AQAbYUfwGvV4u5Gpbhv5yxdueC0faKVIEXYRnT4Dky01cV7pGkFSFndlA2mFsj1g
+uuzkTFPMedcBefMoq2o2eX2B4ogrFHovxELI82i9pbv/MmsGNYwbMsp2lnUhNWon
+QwxFqMGA5Y2p8vyEG7lrHKiFDdt7uPxcOeTiWo0ZpC8uThqiR4fUkPinQ3EHEFGQ
++zl+G3pb4VRUzsyqh2n9swudqQcwjsDlQlkQ2vzVb6IWWiUCwL3V7HGPGmlVbsFG
+nQ1M44aBtWbBQtubfBRwYb5r+4sRN94LST6Phmhnd/AJccIKdCaheq+yLVVGiCJN
+3nDTmgTVSSmOm/RRmSXNp7AH
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
-MIIDFDCCAfygAwIBAgIIICEDAxQSBwAwDQYJKoZIhvcNAQELBQAwQDE+MDwGA1UE
+MIIDnjCCAoagAwIBAgIIICMHExY1IwAwDQYJKoZIhvcNAQELBQAwQDE+MDwGA1UE
+Aww1VGVzdCByb290IENBIGZvciBQb3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRl
+c3Qgc3VpdGUwIBcNMjMwNzEzMTQzNTIzWhgPMjA1MDExMjgxNDM1MjNaMEIxQDA+
+BgNVBAMMN1Rlc3QgQ0EgZm9yIFBvc3RncmVTUUwgU1NMIHJlZ3Jlc3Npb24gdGVz
+dCBzZXJ2ZXIgY2VydHMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDi
+SnYZbmc9vpCtKu1sKV9l663JCceubhMw8Gg16kV0hXEFf/TgGC4zkiYNHN7+G45Y
+D7Nq0kBCq3dHt2wPCc6c8pQoI64dfprVqPkvzoe1WBpZNetkUTk20v08jNeRa7Xd
+RbRR6we1s9VG/prp8Hs2mmHqEfLuI9lvTT0Dz+VMmfFI8Lf278r+w+qOtVloAkX7
+AOyoLEJlNS0BQW9YWdH9N5ctaUXMG6lLV2OAjs+W1smpKfpIpMCA1lPGlElu70hy
+non/nQQvBP77SfQpZVc0esM18jkZpr5LEKUCw+x6LaMsqmBHpAULfCffxn2r0uMB
+W4L4VaGg3W6Fh6iuJwRfAgMBAAGjgZcwgZQwDAYDVR0TBAUwAwEB/zAdBgNVHQ4E
+FgQU8o86ZkBQZEgi1y6C/1aewrPudAowZQYDVR0jBF4wXKFEpEIwQDE+MDwGA1UE
Aww1VGVzdCByb290IENBIGZvciBQb3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRl
-c3Qgc3VpdGUwHhcNMjEwMzAzMjIxMjA3WhcNNDgwNzE5MjIxMjA3WjBCMUAwPgYD
-VQQDDDdUZXN0IENBIGZvciBQb3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRlc3Qg
-c2VydmVyIGNlcnRzMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4kp2
-GW5nPb6QrSrtbClfZeutyQnHrm4TMPBoNepFdIVxBX/04BguM5ImDRze/huOWA+z
-atJAQqt3R7dsDwnOnPKUKCOuHX6a1aj5L86HtVgaWTXrZFE5NtL9PIzXkWu13UW0
-UesHtbPVRv6a6fB7Npph6hHy7iPZb009A8/lTJnxSPC39u/K/sPqjrVZaAJF+wDs
-qCxCZTUtAUFvWFnR/TeXLWlFzBupS1djgI7PltbJqSn6SKTAgNZTxpRJbu9Icp6J
-/50ELwT++0n0KWVXNHrDNfI5Gaa+SxClAsPsei2jLKpgR6QFC3wn38Z9q9LjAVuC
-+FWhoN1uhYeoricEXwIDAQABoxAwDjAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEB
-CwUAA4IBAQCdCA/EoXrustoV4jJGbkdXDuOUkBurwggSNBAqUBSDvCohRoD77Ecb
-QVuzPNxWKG+E4PwfUq2ha+2yPONEJ28ZgsbHq5qlJDMJ43wlcjn6wmmAJNeSpO8F
-0V9d2X/4wNZty9/zbwTnw26KChgDHumQ0WIbCoBtdqy8KDswYOvpgws6dqc021I7
-UrFo6vZek7VoApbJgkDL6qYADa6ApfW43ThH4sViFITeYt/kSHgmy2Udhs34jMM8
-xsFP/uYpRi1b1glenwSIKiHjD4/C9vnWQt5K3gRBvYukEj2Bw9VkNRpBVCi0cOoA
-OuwX3bwzNYNbZQv4K66oRpvuoEjCNeHg
+c3Qgc3VpdGWCFBfnvJQgNLw9MyrcSA1T3Q2PyJIFMA0GCSqGSIb3DQEBCwUAA4IB
+AQANlEDrM357a7o+WcKB0Ocll2UtBMq7PDms1Pjqm3fFu/wdKDUomG8W2/MgDmFl
+CVeAPpofb6J0oaxiEZOR68pOhdccMznArtKix6t3RkDiXdm4d5UORMMR+s9CymXV
+MUTWpQpAg3qP3mRI+3E9OrgfhvmVcuOa7/cdTS/sylGe8Db+nJQD0be9NHtnhO56
+IA+Li+8oWzD4UNsP3gAmhLkyToz5wlPHzEkgGxkEySNErEOKTOX5Xyk5z+QToRhz
+adkt0mBw/dxoJk9DveCtIqxDelxJsDeJFtqoc5qVVE9yOp7rujGsqgWl2PcJeyKM
+Crh9qsqNzJ2R29pq0g6Lfzh2
-----END CERTIFICATE-----
diff --git a/src/test/ssl/ssl/both-cas-2.crt b/src/test/ssl/ssl/both-cas-2.crt
index 01d0c4d6a4..674d8e6a7e 100644
--- a/src/test/ssl/ssl/both-cas-2.crt
+++ b/src/test/ssl/ssl/both-cas-2.crt
@@ -18,40 +18,46 @@ OCZhKLxVZiZmO71BBwsTgwtU58/G9e2ciGGdltI8ANlmVfdtwgRz3b7H9EUZat6s
kubl/m5HWBsKJEWEzFWrWkQV3ipoTmorJ6KCGABBCeVYmg==
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
-MIIDFDCCAfygAwIBAgIIICEDAxQSBwAwDQYJKoZIhvcNAQELBQAwQDE+MDwGA1UE
+MIIDnjCCAoagAwIBAgIIICMHExY1IwAwDQYJKoZIhvcNAQELBQAwQDE+MDwGA1UE
Aww1VGVzdCByb290IENBIGZvciBQb3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRl
-c3Qgc3VpdGUwHhcNMjEwMzAzMjIxMjA3WhcNNDgwNzE5MjIxMjA3WjBCMUAwPgYD
-VQQDDDdUZXN0IENBIGZvciBQb3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRlc3Qg
-c2VydmVyIGNlcnRzMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4kp2
-GW5nPb6QrSrtbClfZeutyQnHrm4TMPBoNepFdIVxBX/04BguM5ImDRze/huOWA+z
-atJAQqt3R7dsDwnOnPKUKCOuHX6a1aj5L86HtVgaWTXrZFE5NtL9PIzXkWu13UW0
-UesHtbPVRv6a6fB7Npph6hHy7iPZb009A8/lTJnxSPC39u/K/sPqjrVZaAJF+wDs
-qCxCZTUtAUFvWFnR/TeXLWlFzBupS1djgI7PltbJqSn6SKTAgNZTxpRJbu9Icp6J
-/50ELwT++0n0KWVXNHrDNfI5Gaa+SxClAsPsei2jLKpgR6QFC3wn38Z9q9LjAVuC
-+FWhoN1uhYeoricEXwIDAQABoxAwDjAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEB
-CwUAA4IBAQCdCA/EoXrustoV4jJGbkdXDuOUkBurwggSNBAqUBSDvCohRoD77Ecb
-QVuzPNxWKG+E4PwfUq2ha+2yPONEJ28ZgsbHq5qlJDMJ43wlcjn6wmmAJNeSpO8F
-0V9d2X/4wNZty9/zbwTnw26KChgDHumQ0WIbCoBtdqy8KDswYOvpgws6dqc021I7
-UrFo6vZek7VoApbJgkDL6qYADa6ApfW43ThH4sViFITeYt/kSHgmy2Udhs34jMM8
-xsFP/uYpRi1b1glenwSIKiHjD4/C9vnWQt5K3gRBvYukEj2Bw9VkNRpBVCi0cOoA
-OuwX3bwzNYNbZQv4K66oRpvuoEjCNeHg
+c3Qgc3VpdGUwIBcNMjMwNzEzMTQzNTIzWhgPMjA1MDExMjgxNDM1MjNaMEIxQDA+
+BgNVBAMMN1Rlc3QgQ0EgZm9yIFBvc3RncmVTUUwgU1NMIHJlZ3Jlc3Npb24gdGVz
+dCBzZXJ2ZXIgY2VydHMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDi
+SnYZbmc9vpCtKu1sKV9l663JCceubhMw8Gg16kV0hXEFf/TgGC4zkiYNHN7+G45Y
+D7Nq0kBCq3dHt2wPCc6c8pQoI64dfprVqPkvzoe1WBpZNetkUTk20v08jNeRa7Xd
+RbRR6we1s9VG/prp8Hs2mmHqEfLuI9lvTT0Dz+VMmfFI8Lf278r+w+qOtVloAkX7
+AOyoLEJlNS0BQW9YWdH9N5ctaUXMG6lLV2OAjs+W1smpKfpIpMCA1lPGlElu70hy
+non/nQQvBP77SfQpZVc0esM18jkZpr5LEKUCw+x6LaMsqmBHpAULfCffxn2r0uMB
+W4L4VaGg3W6Fh6iuJwRfAgMBAAGjgZcwgZQwDAYDVR0TBAUwAwEB/zAdBgNVHQ4E
+FgQU8o86ZkBQZEgi1y6C/1aewrPudAowZQYDVR0jBF4wXKFEpEIwQDE+MDwGA1UE
+Aww1VGVzdCByb290IENBIGZvciBQb3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRl
+c3Qgc3VpdGWCFBfnvJQgNLw9MyrcSA1T3Q2PyJIFMA0GCSqGSIb3DQEBCwUAA4IB
+AQANlEDrM357a7o+WcKB0Ocll2UtBMq7PDms1Pjqm3fFu/wdKDUomG8W2/MgDmFl
+CVeAPpofb6J0oaxiEZOR68pOhdccMznArtKix6t3RkDiXdm4d5UORMMR+s9CymXV
+MUTWpQpAg3qP3mRI+3E9OrgfhvmVcuOa7/cdTS/sylGe8Db+nJQD0be9NHtnhO56
+IA+Li+8oWzD4UNsP3gAmhLkyToz5wlPHzEkgGxkEySNErEOKTOX5Xyk5z+QToRhz
+adkt0mBw/dxoJk9DveCtIqxDelxJsDeJFtqoc5qVVE9yOp7rujGsqgWl2PcJeyKM
+Crh9qsqNzJ2R29pq0g6Lfzh2
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
-MIIDFDCCAfygAwIBAgIIICEDAxQSBwEwDQYJKoZIhvcNAQELBQAwQDE+MDwGA1UE
+MIIDnjCCAoagAwIBAgIIICMHExY1IwEwDQYJKoZIhvcNAQELBQAwQDE+MDwGA1UE
+Aww1VGVzdCByb290IENBIGZvciBQb3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRl
+c3Qgc3VpdGUwIBcNMjMwNzEzMTQzNTIzWhgPMjA1MDExMjgxNDM1MjNaMEIxQDA+
+BgNVBAMMN1Rlc3QgQ0EgZm9yIFBvc3RncmVTUUwgU1NMIHJlZ3Jlc3Npb24gdGVz
+dCBjbGllbnQgY2VydHMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC7
+5x7yuQ1+gK8j1aO6D2nGym2x2OFniztlnx4PlWWWivIrYlxy6xAhfrVdjwjc5mMt
+OCrVKllsdC+S1EfqCZTu1+gF0SdG5cHuJ2Rtg4oisLSF221v/msPONAa1dObChWs
+Jwme87VaFrL+B2yipfW1PUxM9a7/p19CRBcDQ+LNW+YFqwARByHGq1wfatJzpM8T
+Xe+XEnRfW9KXP3a5PqR6evFQOzjcAf+QBJ0hAEddUDhdYECbs1GrApfsEHBuwXab
+dCH41j0F/0yckctydWfBl2Vbmd3sfsFMHjde+SJhqxyq6xiSL59jnx4ZKmtn9VSO
+YbGmBCdBdYK7RTcnJQv9AgMBAAGjgZcwgZQwDAYDVR0TBAUwAwEB/zAdBgNVHQ4E
+FgQUn6Tr0smZ3rADsDA0IoFhFUu9rTYwZQYDVR0jBF4wXKFEpEIwQDE+MDwGA1UE
Aww1VGVzdCByb290IENBIGZvciBQb3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRl
-c3Qgc3VpdGUwHhcNMjEwMzAzMjIxMjA3WhcNNDgwNzE5MjIxMjA3WjBCMUAwPgYD
-VQQDDDdUZXN0IENBIGZvciBQb3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRlc3Qg
-Y2xpZW50IGNlcnRzMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu+ce
-8rkNfoCvI9Wjug9pxsptsdjhZ4s7ZZ8eD5VlloryK2JccusQIX61XY8I3OZjLTgq
-1SpZbHQvktRH6gmU7tfoBdEnRuXB7idkbYOKIrC0hdttb/5rDzjQGtXTmwoVrCcJ
-nvO1Whay/gdsoqX1tT1MTPWu/6dfQkQXA0PizVvmBasAEQchxqtcH2rSc6TPE13v
-lxJ0X1vSlz92uT6kenrxUDs43AH/kASdIQBHXVA4XWBAm7NRqwKX7BBwbsF2m3Qh
-+NY9Bf9MnJHLcnVnwZdlW5nd7H7BTB43XvkiYascqusYki+fY58eGSprZ/VUjmGx
-pgQnQXWCu0U3JyUL/QIDAQABoxAwDjAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEB
-CwUAA4IBAQC1syY2Rk02m5PGtfkMUIU7ZSe0mM+g0BgWAyCF/mFFYdfY0xHtqy0x
-QWkW9OR0KBl4JpphDDolHoNL3TLydH3t4inX8SAOpaUdsjMcIPKqjT1htQm0Pk5r
-vFYvKuVrxMnV0F+wMmZRuziKWrZlVDwBMfCAchzuVexDWfcjTmUQmhZxJuUzORw3
-swgh9HIpxjMkgdlHodbMAEpMIkkoeJnph3I9uTocXZbK/lAInggQdm0Q+on1ZT0A
-ljO/6jisDZzIguE4ZAQ2DfYsGI8H3tz/+76uIwwBNOmu0woUDSWXVcPWiviq49Bi
-GmH0KlUfWAphj86IfTWXT1HRay3eZQt3
+c3Qgc3VpdGWCFBfnvJQgNLw9MyrcSA1T3Q2PyJIFMA0GCSqGSIb3DQEBCwUAA4IB
+AQAbYUfwGvV4u5Gpbhv5yxdueC0faKVIEXYRnT4Dky01cV7pGkFSFndlA2mFsj1g
+uuzkTFPMedcBefMoq2o2eX2B4ogrFHovxELI82i9pbv/MmsGNYwbMsp2lnUhNWon
+QwxFqMGA5Y2p8vyEG7lrHKiFDdt7uPxcOeTiWo0ZpC8uThqiR4fUkPinQ3EHEFGQ
++zl+G3pb4VRUzsyqh2n9swudqQcwjsDlQlkQ2vzVb6IWWiUCwL3V7HGPGmlVbsFG
+nQ1M44aBtWbBQtubfBRwYb5r+4sRN94LST6Phmhnd/AJccIKdCaheq+yLVVGiCJN
+3nDTmgTVSSmOm/RRmSXNp7AH
-----END CERTIFICATE-----
diff --git a/src/test/ssl/ssl/client+client_ca.crt b/src/test/ssl/ssl/client+client_ca.crt
index 7fafa14de1..fe7719e14b 100644
--- a/src/test/ssl/ssl/client+client_ca.crt
+++ b/src/test/ssl/ssl/client+client_ca.crt
@@ -1,37 +1,40 @@
-----BEGIN CERTIFICATE-----
-MIIC0zCCAbsCCCAhAwMUEgcAMA0GCSqGSIb3DQEBCwUAMEIxQDA+BgNVBAMMN1Rl
+MIIC1TCCAb0CCCAjBxMWNSQAMA0GCSqGSIb3DQEBCwUAMEIxQDA+BgNVBAMMN1Rl
c3QgQ0EgZm9yIFBvc3RncmVTUUwgU1NMIHJlZ3Jlc3Npb24gdGVzdCBjbGllbnQg
-Y2VydHMwHhcNMjEwMzAzMjIxMjA3WhcNNDgwNzE5MjIxMjA3WjAWMRQwEgYDVQQD
-DAtzc2x0ZXN0dXNlcjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALSL
-oC6h8sBABL8kWRjFQJHZNcwmuRRWjzhBYR4gDKcBThCBIuEr5PZEkkXnJniXKHct
-bCzaBarUwG+bWGg6BiFWX3PP5MZvLG7ExP9yTrDjdwjKozkJCNWSow0hdYLaxkpm
-rYI6rDJ5T1CZBRLD4RYOjU39WVIxYkHlhJYtH0Cdv5PuzCOEtLdKQySSVq6heJen
-koLvK7AaF1x8uDiwM+o9t69pORWbOh/6aCCPeYmvhPIRvEqyZjGvPJ2kXau4R1vN
-NmepRIZ0VjQ/rQxo7dGWk38cfgsTeFI4G26DiYn08pFR47swUdfiMyx3MaGQiz9X
-I2nUqjM+W84iUxrR82MCAwEAATANBgkqhkiG9w0BAQsFAAOCAQEACSZo32raJHcB
-rYHeomzynmzgMVBHSA4XsXZVQw4+zBUER+/ZdQbtw6F/qdeWRvTl8TJjwoydta7u
-4gUkgAnQhYm2f8XEBe/+MUegH+y54Yk6rtmkdLxJLGKZ0IUfYkn20sg/NZrltbog
-A8glWRGVD8cEOaxUaNSQ4Xqmqsqjd6Kh8snVfIIcWgKgnTNgyapM5ePBpS2IREhN
-u9fjikQQf6F/dycsm22OP7aWsp1XPs3nqnoq9ZnhQrITMwsGcjbU7+v8La2GbiJV
-8yAy136NSXUujIG/8eqhICWZPqj+KbdVZupOsUeVoeuSwLXJjm4GWY0xH92emqCI
-ac+HriJv5w==
+Y2VydHMwIBcNMjMwNjI5MDEwMTAxWhgPMjA1MDAxMDEwMTAxMDFaMBYxFDASBgNV
+BAMMC3NzbHRlc3R1c2VyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
+tIugLqHywEAEvyRZGMVAkdk1zCa5FFaPOEFhHiAMpwFOEIEi4Svk9kSSRecmeJco
+dy1sLNoFqtTAb5tYaDoGIVZfc8/kxm8sbsTE/3JOsON3CMqjOQkI1ZKjDSF1gtrG
+SmatgjqsMnlPUJkFEsPhFg6NTf1ZUjFiQeWEli0fQJ2/k+7MI4S0t0pDJJJWrqF4
+l6eSgu8rsBoXXHy4OLAz6j23r2k5FZs6H/poII95ia+E8hG8SrJmMa88naRdq7hH
+W802Z6lEhnRWND+tDGjt0ZaTfxx+CxN4UjgbboOJifTykVHjuzBR1+IzLHcxoZCL
+P1cjadSqMz5bziJTGtHzYwIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQAQnfs7UO2g
+iilUgCQAfa9Vb0ZSivD7ryjnLsdwYRLIlb0YceME9qtSv2UYBfS9KpwG7+jONMQB
+kvbe611/TaF0T7EC1GIWuTMs8jknJ2bgPbS8D8jiFWTci+SDDog4EVoakSLoirW6
+yB4398upjtanAdnjoNpE4REXPDHzDm2Dico2RCObJh1VAEK+q6gLJxQtGvdPyG3L
+Fhjs7ky1lsxIvHlts8c1e4vhnVpxdS3I5r6N38qFXEJnc1tv/e+TH50mdrZlzRHF
+TPgnZzWCGTHmT5YT3yoAldWG4uWzMsB+2eY/crRefM9byc0omjCxDTrk9nA6JWsf
+0c6pBc6aKzdi
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
-MIIDFDCCAfygAwIBAgIIICEDAxQSBwEwDQYJKoZIhvcNAQELBQAwQDE+MDwGA1UE
+MIIDnjCCAoagAwIBAgIIICMHExY1IwEwDQYJKoZIhvcNAQELBQAwQDE+MDwGA1UE
Aww1VGVzdCByb290IENBIGZvciBQb3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRl
-c3Qgc3VpdGUwHhcNMjEwMzAzMjIxMjA3WhcNNDgwNzE5MjIxMjA3WjBCMUAwPgYD
-VQQDDDdUZXN0IENBIGZvciBQb3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRlc3Qg
-Y2xpZW50IGNlcnRzMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu+ce
-8rkNfoCvI9Wjug9pxsptsdjhZ4s7ZZ8eD5VlloryK2JccusQIX61XY8I3OZjLTgq
-1SpZbHQvktRH6gmU7tfoBdEnRuXB7idkbYOKIrC0hdttb/5rDzjQGtXTmwoVrCcJ
-nvO1Whay/gdsoqX1tT1MTPWu/6dfQkQXA0PizVvmBasAEQchxqtcH2rSc6TPE13v
-lxJ0X1vSlz92uT6kenrxUDs43AH/kASdIQBHXVA4XWBAm7NRqwKX7BBwbsF2m3Qh
-+NY9Bf9MnJHLcnVnwZdlW5nd7H7BTB43XvkiYascqusYki+fY58eGSprZ/VUjmGx
-pgQnQXWCu0U3JyUL/QIDAQABoxAwDjAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEB
-CwUAA4IBAQC1syY2Rk02m5PGtfkMUIU7ZSe0mM+g0BgWAyCF/mFFYdfY0xHtqy0x
-QWkW9OR0KBl4JpphDDolHoNL3TLydH3t4inX8SAOpaUdsjMcIPKqjT1htQm0Pk5r
-vFYvKuVrxMnV0F+wMmZRuziKWrZlVDwBMfCAchzuVexDWfcjTmUQmhZxJuUzORw3
-swgh9HIpxjMkgdlHodbMAEpMIkkoeJnph3I9uTocXZbK/lAInggQdm0Q+on1ZT0A
-ljO/6jisDZzIguE4ZAQ2DfYsGI8H3tz/+76uIwwBNOmu0woUDSWXVcPWiviq49Bi
-GmH0KlUfWAphj86IfTWXT1HRay3eZQt3
+c3Qgc3VpdGUwIBcNMjMwNzEzMTQzNTIzWhgPMjA1MDExMjgxNDM1MjNaMEIxQDA+
+BgNVBAMMN1Rlc3QgQ0EgZm9yIFBvc3RncmVTUUwgU1NMIHJlZ3Jlc3Npb24gdGVz
+dCBjbGllbnQgY2VydHMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC7
+5x7yuQ1+gK8j1aO6D2nGym2x2OFniztlnx4PlWWWivIrYlxy6xAhfrVdjwjc5mMt
+OCrVKllsdC+S1EfqCZTu1+gF0SdG5cHuJ2Rtg4oisLSF221v/msPONAa1dObChWs
+Jwme87VaFrL+B2yipfW1PUxM9a7/p19CRBcDQ+LNW+YFqwARByHGq1wfatJzpM8T
+Xe+XEnRfW9KXP3a5PqR6evFQOzjcAf+QBJ0hAEddUDhdYECbs1GrApfsEHBuwXab
+dCH41j0F/0yckctydWfBl2Vbmd3sfsFMHjde+SJhqxyq6xiSL59jnx4ZKmtn9VSO
+YbGmBCdBdYK7RTcnJQv9AgMBAAGjgZcwgZQwDAYDVR0TBAUwAwEB/zAdBgNVHQ4E
+FgQUn6Tr0smZ3rADsDA0IoFhFUu9rTYwZQYDVR0jBF4wXKFEpEIwQDE+MDwGA1UE
+Aww1VGVzdCByb290IENBIGZvciBQb3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRl
+c3Qgc3VpdGWCFBfnvJQgNLw9MyrcSA1T3Q2PyJIFMA0GCSqGSIb3DQEBCwUAA4IB
+AQAbYUfwGvV4u5Gpbhv5yxdueC0faKVIEXYRnT4Dky01cV7pGkFSFndlA2mFsj1g
+uuzkTFPMedcBefMoq2o2eX2B4ogrFHovxELI82i9pbv/MmsGNYwbMsp2lnUhNWon
+QwxFqMGA5Y2p8vyEG7lrHKiFDdt7uPxcOeTiWo0ZpC8uThqiR4fUkPinQ3EHEFGQ
++zl+G3pb4VRUzsyqh2n9swudqQcwjsDlQlkQ2vzVb6IWWiUCwL3V7HGPGmlVbsFG
+nQ1M44aBtWbBQtubfBRwYb5r+4sRN94LST6Phmhnd/AJccIKdCaheq+yLVVGiCJN
+3nDTmgTVSSmOm/RRmSXNp7AH
-----END CERTIFICATE-----
diff --git a/src/test/ssl/ssl/client-crldir/9bb9e3c3.r0 b/src/test/ssl/ssl/client-crldir/9bb9e3c3.r0
index f75eb1c0bc..202f9f44d0 100644
--- a/src/test/ssl/ssl/client-crldir/9bb9e3c3.r0
+++ b/src/test/ssl/ssl/client-crldir/9bb9e3c3.r0
@@ -1,12 +1,12 @@
-----BEGIN X509 CRL-----
-MIIBwDCBqTANBgkqhkiG9w0BAQsFADBCMUAwPgYDVQQDDDdUZXN0IENBIGZvciBQ
-b3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRlc3QgY2xpZW50IGNlcnRzFw0yMjA3
-MTgyMjI4MTVaFw00OTEyMDMyMjI4MTVaMDYwGQIIICEDAxQSBwEXDTIyMDcxODIy
-MjgxNVowGQIIICIHGBUoFQAXDTIyMDcxODIyMjgxNVowDQYJKoZIhvcNAQELBQAD
-ggEBAFDH3m9AHpDjkEFjO6svnLJ2bTliGeKZaJW8/RAN4mWvWDhXDQfzqGcFHN2a
-SIL57Xc4PdwTiXuU4QEP4RvWW90LYKdcrcT8uh0AN3i7ShMwcV7I7owzF5+CBuT7
-Ev0MU4QIz0PjXoybXP6b3wHhZbEjYTLYdnYdqjrsAchUpyDQn6fiC0C7FgjCi4HL
-rNm2kMchFpzd6K9e41kxWVp7xCPXgqUK8OrxlW56ObkX8UpBIZzyU6RisJKOZJAn
-/+lwT43yTtU739atdXdSMvGHT9Y7LsrSDz9zgp2/iMTmfctnPcp81J/6jQZEP8kx
-OyPyZz4xy/EShWy+KUklfOoKRo8=
+MIIBwjCBqzANBgkqhkiG9w0BAQsFADBCMUAwPgYDVQQDDDdUZXN0IENBIGZvciBQ
+b3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRlc3QgY2xpZW50IGNlcnRzFw0yMzA3
+MTMxNDM1MjRaGA8yMDUwMTEyODE0MzUyNFowNjAZAgggIwcTFjUkAhcNMjMwNzEz
+MTQzNTI0WjAZAgggIwcTFjUkBRcNMjMwNzEzMTQzNTI0WjANBgkqhkiG9w0BAQsF
+AAOCAQEAl2jqLuwUgUTtzIKdLyAqIGf+zG0jfJXD9KFIsPeR+zfYWyNVzlWav68e
+zcLLhr9NWzHCXo0F5yiWVIO9pe2OF980Ez/24fTd6NPk3qG9AzLeLQ0jPhEgLaDw
+KFSTuaTbEuAUBGHMTjdoe6aOGsypUOXxse/G5enyx93yCC7boFkrYscfnQT2kFZT
+60Bhfr/4qkFdGJbp9ZIsTP8us4sktEDFn24Tq5f8sW7JyqIU83LRhjkIc8NALGCE
+DE7FgaGVUyuH8jYkVw4XLMwYo9gAy95pBxrDFq/r0Zm4E1rIEr8x7Ji7smUcubrb
+/MXu7OCXst4uzoRxFQctnP19AYIKZQ==
-----END X509 CRL-----
diff --git a/src/test/ssl/ssl/client-dn.crt b/src/test/ssl/ssl/client-dn.crt
index 0db14e5977..3f5c80580c 100644
--- a/src/test/ssl/ssl/client-dn.crt
+++ b/src/test/ssl/ssl/client-dn.crt
@@ -1,19 +1,19 @@
-----BEGIN CERTIFICATE-----
-MIIDDTCCAfUCCCAhBikTA0IAMA0GCSqGSIb3DQEBCwUAMEIxQDA+BgNVBAMMN1Rl
+MIIDDzCCAfcCCCAjBxMWNSQBMA0GCSqGSIb3DQEBCwUAMEIxQDA+BgNVBAMMN1Rl
c3QgQ0EgZm9yIFBvc3RncmVTUUwgU1NMIHJlZ3Jlc3Npb24gdGVzdCBjbGllbnQg
-Y2VydHMwHhcNMjEwNjI5MjAwMzQyWhcNNDgxMTE0MjAwMzQyWjBQMQ0wCwYDVQQK
-DARQR0RHMRQwEgYDVQQLDAtFbmdpbmVlcmluZzEQMA4GA1UECwwHVGVzdGluZzEX
-MBUGA1UEAwwOc3NsdGVzdHVzZXItZG4wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
-ggEKAoIBAQDES64qtkofPjeG4VbUVKfzABLC0CurvxqLTEpokq/St9WAWDrzc8PJ
-YireEZp4ec5rHVyQVvHqzzaZFAMvbRUQgMdGKG4Vgkn8l96KxHa4Q6yxYoQOts10
-AuvU9LuGKT0lxndMggHDmREUOAkFYKp7IeypseUGkJ6sWs+DlTwK1hST+EUAU/5f
-q/pAngJ+oar20m8WNxaAhJUKtBBecdRdqYy/h3Ab43iPhj+N9IFXiSV9EWhteBae
-L/TEE+s7/4L74xwvJe2EiVETo3lMy2aVJ4/4pOMq7U+Gr/0wxk0jqRrOahAE6pOI
-cQFBFsOkyUaC4dzqtjeSrsw5igQbJC19AgMBAAEwDQYJKoZIhvcNAQELBQADggEB
-AECbQQ9rBzCexNI3VKDVA+CZa0ib48XbcJwXmva3spvjjCB5cGPToyF1B+4mVg1H
-1uM/XRAoQmNRtB+xKEAceMSxJA02tBlwMOclXlO0oGLYyc+S61K+UEPSk6Kka4aC
-NpeLSqN5ahC9z8C5uMJl36pFf13aU05uRkXKcI4gkn02I4jRc/a8gF7URdhdf920
-KmYSUh1V0B3pPAB6ArqJ60iHOqkCYIIIbi2EpVP53IKkoB9tr4ud8oMoN6ggIXU1
-2oHvnaKJ7RZaQNefS3WweyHxr4cCVtEour/ELph48OuW6Y5jqPT+5Ln3Qz0e6KW9
-o3thBx0aKSYlmt9gH254M9M=
+Y2VydHMwIBcNMjMwNjI5MDEwMTAxWhgPMjA1MDAxMDEwMTAxMDFaMFAxDTALBgNV
+BAoMBFBHREcxFDASBgNVBAsMC0VuZ2luZWVyaW5nMRAwDgYDVQQLDAdUZXN0aW5n
+MRcwFQYDVQQDDA5zc2x0ZXN0dXNlci1kbjCCASIwDQYJKoZIhvcNAQEBBQADggEP
+ADCCAQoCggEBAMRLriq2Sh8+N4bhVtRUp/MAEsLQK6u/GotMSmiSr9K31YBYOvNz
+w8liKt4Rmnh5zmsdXJBW8erPNpkUAy9tFRCAx0YobhWCSfyX3orEdrhDrLFihA62
+zXQC69T0u4YpPSXGd0yCAcOZERQ4CQVgqnsh7Kmx5QaQnqxaz4OVPArWFJP4RQBT
+/l+r+kCeAn6hqvbSbxY3FoCElQq0EF5x1F2pjL+HcBvjeI+GP430gVeJJX0RaG14
+Fp4v9MQT6zv/gvvjHC8l7YSJUROjeUzLZpUnj/ik4yrtT4av/TDGTSOpGs5qEATq
+k4hxAUEWw6TJRoLh3Oq2N5KuzDmKBBskLX0CAwEAATANBgkqhkiG9w0BAQsFAAOC
+AQEAYi8MtTEYoqqxjoy/QOYuuWIryNwvpHh9ty8q+r8gWPuySMaIb+qfWh7qK1OY
+ng9HUXdXn+kpZIy6GMVtVSprPn5J3gLCZMsXqHxh5XtHf8DkSwmaQrVSFmu0Wkri
+txnNl4OHwMIGbX0o6oN7rNdlgYxLyMtPzO+KfygjO4HX8Hm5Jz0DM2K3airnFkCc
+IwYdMmaEMykRRl2W5wpSgHjYrReL3qopdWj97sKTY4H3ZuBR7i2V9ni6/mJFUD2u
+8tLeUTB1vOhRk6JhtRagNIQHg7tsUX6Fx3QkdosGjSCWPePzv4UC4GYvEjbOvsxv
+hIPtSVIjtS8eN6co3XJP+dTd4w==
-----END CERTIFICATE-----
diff --git a/src/test/ssl/ssl/client-long.crt b/src/test/ssl/ssl/client-long.crt
index a1db55b5c3..2fec398e17 100644
--- a/src/test/ssl/ssl/client-long.crt
+++ b/src/test/ssl/ssl/client-long.crt
@@ -1,20 +1,20 @@
-----BEGIN CERTIFICATE-----
-MIIDWjCCAkICCCAiBRIUREYAMA0GCSqGSIb3DQEBCwUAMEIxQDA+BgNVBAMMN1Rl
+MIIDXDCCAkQCCCAjBxMWNSQEMA0GCSqGSIb3DQEBCwUAMEIxQDA+BgNVBAMMN1Rl
c3QgQ0EgZm9yIFBvc3RncmVTUUwgU1NMIHJlZ3Jlc3Npb24gdGVzdCBjbGllbnQg
-Y2VydHMwHhcNMjIwNTEyMjE0NDQ3WhcNNDkwOTI3MjE0NDQ3WjCBnDEsMCoGA1UE
-CgwjUG9zdGdyZVNRTCBHbG9iYWwgRGV2ZWxvcG1lbnQgR3JvdXAxITAfBgNVBAsM
-GFNvbWUgT3JnYW5pemF0aW9uYWwgVW5pdDFJMEcGA1UEAwxAc3NsLTEyMzQ1Njc4
-OTAxMjM0NTY3ODkwMTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTIzNDU2
-Nzg5MDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANgxmeHiVRuBTwlG
-Q1oM2M1ckQCI/o4hYcO9BYdxDYHiA7jy1WVenyj8BtUi5Aj9VDhpfiuewDarGQ5a
-TggD1pMjkw0MorBKBr9+1u1xGH/8Q3lkgU+OQXrPglo4IrVcqaoZFQ0nuMaVbieX
-0dDyTfsTaVQYYtqAtzhI/UGSIOhk2+lB9fP68jw9cLH0QYvR+qQ0IPG13I5zmSYP
-Mj0VYwMn9TF9/2sBOSRVgTVAcrYgOQLk3s/fGe66tmVBIWYcq65ygqD1+weu+Pax
-jPnwsefkdnf6JdYRG1F1Co7g52poPEYieAHfQOJ69sG0LYx0lBODC69qvSJ4WdCQ
-0zKw288CAwEAATANBgkqhkiG9w0BAQsFAAOCAQEArr5r1UxgUzPykmu5ZdL6y8TA
-ZbSQ1yBY0nhsRwRkDd66iPK9U6T6K2+pL8Vc6ioov9WOtHQ6ohP3gSavd40cHRmF
-auwIsZ4Wk0mjftpOuPFp1hyo8d/QYrbEm3qNe5qln5S9h8ipoYvFtf5zlK2KHJFz
-9ehZMZ1zGAERNCVM8UUQKyUuZB5GyrZlbslf6P/9Bsc54YUWxP2pr5r/RJ6DeXfI
-zAFfXT8AFVlClARA949gpX0LVrXryDN60CUJ88QJmYCQ3AtIgzYYeqcdYHTd8eS2
-9P5whDdU5NvROP+LjETeReJF4Bfyc2gM7zxZD2BDSf5exvnNqiy42/lR1b4szw==
+Y2VydHMwIBcNMjMwNjI5MDEwMTAxWhgPMjA1MDAxMDEwMTAxMDFaMIGcMSwwKgYD
+VQQKDCNQb3N0Z3JlU1FMIEdsb2JhbCBEZXZlbG9wbWVudCBHcm91cDEhMB8GA1UE
+CwwYU29tZSBPcmdhbml6YXRpb25hbCBVbml0MUkwRwYDVQQDDEBzc2wtMTIzNDU2
+Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0
+NTY3ODkwMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2DGZ4eJVG4FP
+CUZDWgzYzVyRAIj+jiFhw70Fh3ENgeIDuPLVZV6fKPwG1SLkCP1UOGl+K57ANqsZ
+DlpOCAPWkyOTDQyisEoGv37W7XEYf/xDeWSBT45Bes+CWjgitVypqhkVDSe4xpVu
+J5fR0PJN+xNpVBhi2oC3OEj9QZIg6GTb6UH18/ryPD1wsfRBi9H6pDQg8bXcjnOZ
+Jg8yPRVjAyf1MX3/awE5JFWBNUBytiA5AuTez98Z7rq2ZUEhZhyrrnKCoPX7B674
+9rGM+fCx5+R2d/ol1hEbUXUKjuDnamg8RiJ4Ad9A4nr2wbQtjHSUE4MLr2q9InhZ
+0JDTMrDbzwIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQCUIOBu5ea3vSVpiqCGMphv
+V26dDpEl1OMpvPIM5Ss1sp9ogOdBg7ahkDE51J0QaB3yN6mci3sN6yi77U3zXXUv
+qI0hdR3nwjTLJSpW2p6ONW43PKPhKr42UdBH5iRVlNY7rto2x3xC0iuzvPAJjIJJ
+OJMZYl/A43O8XZW68m9Z5kH3Vi/l0wtjElfnjqI0DAuQEL/TQTzK9qTIhdAqMAKG
+deTGSqpz+ID2CfuN+TBV2NAseilZ4JC0xZxaJpoqmK3yTtgKBhJ3vQN//fc1TdPy
+9+zvnSRIJZJque58ZKnqbMq3c3RRSo0eOZn7FZopcIRsn5hzDeIVTJcBJ68jcxrL
-----END CERTIFICATE-----
diff --git a/src/test/ssl/ssl/client-revoked-utf8.crt b/src/test/ssl/ssl/client-revoked-utf8.crt
index de471d1e60..4189c75de8 100644
--- a/src/test/ssl/ssl/client-revoked-utf8.crt
+++ b/src/test/ssl/ssl/client-revoked-utf8.crt
@@ -1,18 +1,18 @@
-----BEGIN CERTIFICATE-----
-MIIC2DCCAcACCCAiBxgVKBUAMA0GCSqGSIb3DQEBCwUAMEIxQDA+BgNVBAMMN1Rl
+MIIC2jCCAcICCCAjBxMWNSQFMA0GCSqGSIb3DQEBCwUAMEIxQDA+BgNVBAMMN1Rl
c3QgQ0EgZm9yIFBvc3RncmVTUUwgU1NMIHJlZ3Jlc3Npb24gdGVzdCBjbGllbnQg
-Y2VydHMwHhcNMjIwNzE4MjIyODE1WhcNNDkxMjAzMjIyODE1WjAbMRkwFwYDVQQD
-DBDOn860z4XPg8+Dzq3Osc+CMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
-AQEAvBiL1mVjTrzZ6sbrvfu746dzh+EEyuJNkCwPeJTtpva2wqqRUMYw05cV5kzi
-YQ3UikMP5Yz0FXTeWoahSpJAWeR5XsFx3wOQvRzwi1KWm2CHr/rb7KbPvoZQdXuV
-8UeKrQ6PrEvjoarHAUZuWyUC6EnEAGuiKl5yuax5mkTcK5F8pig2/SS/UonX5ar5
-58rOUEaIdyZmXtrO86cm5S5Oz3G2naQB3PPPOhtkoGBHikRHiqBPVRpX3w9TIpBL
-BZbT4MIZ+fCjZ9wXj4aiDUzPglu6/Tfx9sNcxc6Ilz/XHfPuBVyyjgrny2SrW0W4
-KlhU09y+m5gKL358z8tj599DowIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQAE47ns
-wfceztieaRQtoF+gPcCuImOJqaB7jTE6cQ+aoW/q+sUlOh7AD0IZqhS4o0A4O+ny
-MD7kHkpYP+ctHNomsSQRkFTDZ2ZJGcRgxbwMOSvsKcgNOTMGqpXQiP0x0m7QMBGl
-EHeu5MqG/IK/ZlH9aOTvSnHegB6ztct/7wXMeFCflsWLp6wvnv9YpddaaXf95Oms
-9kwbVYkI1wxaBsAO8VGbJw1YtdErgd65qKTJa45xndtm61i1Jeig5asSNQPwjfZ5
-aNHZ9GsSwsc31Q/6iiezbPwgdAi3ih//uB2hznkMhObnqzR3n8Sw9zgL7DdFr2y9
-2R7kJuGq6DvlWFYS
+Y2VydHMwIBcNMjMwNjI5MDEwMTAxWhgPMjA1MDAxMDEwMTAxMDFaMBsxGTAXBgNV
+BAMMEM6fzrTPhc+Dz4POrc6xz4IwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
+AoIBAQC8GIvWZWNOvNnqxuu9+7vjp3OH4QTK4k2QLA94lO2m9rbCqpFQxjDTlxXm
+TOJhDdSKQw/ljPQVdN5ahqFKkkBZ5HlewXHfA5C9HPCLUpabYIev+tvsps++hlB1
+e5XxR4qtDo+sS+OhqscBRm5bJQLoScQAa6IqXnK5rHmaRNwrkXymKDb9JL9Sidfl
+qvnnys5QRoh3JmZe2s7zpyblLk7PcbadpAHc8886G2SgYEeKREeKoE9VGlffD1Mi
+kEsFltPgwhn58KNn3BePhqINTM+CW7r9N/H2w1zFzoiXP9cd8+4FXLKOCufLZKtb
+RbgqWFTT3L6bmAovfnzPy2Pn30OjAgMBAAEwDQYJKoZIhvcNAQELBQADggEBAASZ
+M/4tx9qm7G9TEKHHg/Da7GOrGWnYwluWcO/jnIN4jCPyxwj6EmxZGEBKqFUhj3kY
+hwL+249Y2YABOLqu9x/YJz1KtZUgkwTGh6yfT5xOSOCXij7ukpge1gXtodYtnBgP
+FmJOdFygrXxWex3vr+F2Fnh93Isxd/nFof/Rwmi4JTJr6JjalyGuvNDGZc/N16/u
+uR3AE0zGLfM093GbJe9E9j44DGMbNlwHvZ2NXojX34kNoRttonPHmXGKWSCyufUc
+uG+STq5T/DFnr06Ugj2TPCMyEgDEA4unzP5uxAijXVRSkyOrAtZrFtzbab/wjTLt
+0AGeljtaei/bMAh11Cs=
-----END CERTIFICATE-----
diff --git a/src/test/ssl/ssl/client-revoked.crt b/src/test/ssl/ssl/client-revoked.crt
index 51ebe924a6..2cc0c933cd 100644
--- a/src/test/ssl/ssl/client-revoked.crt
+++ b/src/test/ssl/ssl/client-revoked.crt
@@ -1,18 +1,18 @@
-----BEGIN CERTIFICATE-----
-MIIC0zCCAbsCCCAhAwMUEgcBMA0GCSqGSIb3DQEBCwUAMEIxQDA+BgNVBAMMN1Rl
+MIIC1TCCAb0CCCAjBxMWNSQCMA0GCSqGSIb3DQEBCwUAMEIxQDA+BgNVBAMMN1Rl
c3QgQ0EgZm9yIFBvc3RncmVTUUwgU1NMIHJlZ3Jlc3Npb24gdGVzdCBjbGllbnQg
-Y2VydHMwHhcNMjEwMzAzMjIxMjA3WhcNNDgwNzE5MjIxMjA3WjAWMRQwEgYDVQQD
-DAtzc2x0ZXN0dXNlcjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKAX
-JmNmfqmvpVAeWEmJxi7feku2sZKA7yMyyZMCboBqsNVO9gOpQFE8gD1Z7bJm4aDK
-QxByuspYPFOBwty9YW4UqRa4kyEyd08x+PsHQx9SmWJTNpNIH6yq5LCcme37QMrg
-b8wUZRWwXsaKUfVUI6oALjSgcibMJXTntCsD9J5m/07U/ZZALe1460rreTFHsxVZ
-708Wm5u7UHIgxvvEKhNG/JR9zd1Tl1mVgnlz0a8G6Dt22gJnLnuFdtDdACwET/kG
-TRJQWuyavpe+1TY53kZNO442hOzwhlZVnz4IKaWaLNQMtbG9iYStEvaWa8p0E/3J
-N6oRuELiqXJp/wW3v/MCAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAcVhPcu55HcSf
-Mci38T/fOBaiDUvzWwG/XlQRzFxcS+ZY/vYMbgor6PliGlCFBF4Mca2qtTs7zXRz
-8aLNVX53p98Cnnn97mW4aYNbNdM87R76IqJdj40brEolu1JNOyFJRYzoaebABf9r
-R64FTt3YVM9qjJrHG/apYwKwgAMxVzZ/M+3ujahP/8mOYD/Utj+lYHnXJmuHAYE6
-EnTxTSb2J+IsK8KuPoGjUPNZRW8zIUE0luMpJahvtmFVW91Vue7dW0AOmHpjmGUB
-J9Vwxe7KJRW5/4dz6kMD2pKY3D9sBgXeku/QDVz/hdyB5YT0WChFiZn20DZyhOtu
-moHgw8OJzg==
+Y2VydHMwIBcNMjMwNjI5MDEwMTAxWhgPMjA1MDAxMDEwMTAxMDFaMBYxFDASBgNV
+BAMMC3NzbHRlc3R1c2VyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
+oBcmY2Z+qa+lUB5YSYnGLt96S7axkoDvIzLJkwJugGqw1U72A6lAUTyAPVntsmbh
+oMpDEHK6ylg8U4HC3L1hbhSpFriTITJ3TzH4+wdDH1KZYlM2k0gfrKrksJyZ7ftA
+yuBvzBRlFbBexopR9VQjqgAuNKByJswldOe0KwP0nmb/TtT9lkAt7XjrSut5MUez
+FVnvTxabm7tQciDG+8QqE0b8lH3N3VOXWZWCeXPRrwboO3baAmcue4V20N0ALARP
++QZNElBa7Jq+l77VNjneRk07jjaE7PCGVlWfPggppZos1Ay1sb2JhK0S9pZrynQT
+/ck3qhG4QuKpcmn/Bbe/8wIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQAtVsoTdoLZ
+2PMVSDIEc3VRhjNS5+EuYcW+7h0se/7IpBauHoZhn+JD8YVtE04yz2YkglrnChmJ
+iL8xc+f1PbQatxpU7HnSswn3JevC+jZWnGvAxqR2oR3cAioF7sK1vnYLnd2OPqcy
+P9T+tzi90fiVOVOlrm00hjJBNcDIhofjY9td3wogA1SO8vXQteZ1gXNt0nzmfuNZ
+vZvspk+A/vN8tbR6BTagUxPRxajiT0xoIJFD6Qx2ZPglgffJKDwQQ3kvYr7dLMgO
++TDcLL8GK2MAxglgOqvUlRwfwl0ZXu3ZsGjim8pF+dPJB1dUCm9KbG2sIscPNLUe
+9p2w5FZaNk7p
-----END CERTIFICATE-----
diff --git a/src/test/ssl/ssl/client.crl b/src/test/ssl/ssl/client.crl
index f75eb1c0bc..202f9f44d0 100644
--- a/src/test/ssl/ssl/client.crl
+++ b/src/test/ssl/ssl/client.crl
@@ -1,12 +1,12 @@
-----BEGIN X509 CRL-----
-MIIBwDCBqTANBgkqhkiG9w0BAQsFADBCMUAwPgYDVQQDDDdUZXN0IENBIGZvciBQ
-b3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRlc3QgY2xpZW50IGNlcnRzFw0yMjA3
-MTgyMjI4MTVaFw00OTEyMDMyMjI4MTVaMDYwGQIIICEDAxQSBwEXDTIyMDcxODIy
-MjgxNVowGQIIICIHGBUoFQAXDTIyMDcxODIyMjgxNVowDQYJKoZIhvcNAQELBQAD
-ggEBAFDH3m9AHpDjkEFjO6svnLJ2bTliGeKZaJW8/RAN4mWvWDhXDQfzqGcFHN2a
-SIL57Xc4PdwTiXuU4QEP4RvWW90LYKdcrcT8uh0AN3i7ShMwcV7I7owzF5+CBuT7
-Ev0MU4QIz0PjXoybXP6b3wHhZbEjYTLYdnYdqjrsAchUpyDQn6fiC0C7FgjCi4HL
-rNm2kMchFpzd6K9e41kxWVp7xCPXgqUK8OrxlW56ObkX8UpBIZzyU6RisJKOZJAn
-/+lwT43yTtU739atdXdSMvGHT9Y7LsrSDz9zgp2/iMTmfctnPcp81J/6jQZEP8kx
-OyPyZz4xy/EShWy+KUklfOoKRo8=
+MIIBwjCBqzANBgkqhkiG9w0BAQsFADBCMUAwPgYDVQQDDDdUZXN0IENBIGZvciBQ
+b3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRlc3QgY2xpZW50IGNlcnRzFw0yMzA3
+MTMxNDM1MjRaGA8yMDUwMTEyODE0MzUyNFowNjAZAgggIwcTFjUkAhcNMjMwNzEz
+MTQzNTI0WjAZAgggIwcTFjUkBRcNMjMwNzEzMTQzNTI0WjANBgkqhkiG9w0BAQsF
+AAOCAQEAl2jqLuwUgUTtzIKdLyAqIGf+zG0jfJXD9KFIsPeR+zfYWyNVzlWav68e
+zcLLhr9NWzHCXo0F5yiWVIO9pe2OF980Ez/24fTd6NPk3qG9AzLeLQ0jPhEgLaDw
+KFSTuaTbEuAUBGHMTjdoe6aOGsypUOXxse/G5enyx93yCC7boFkrYscfnQT2kFZT
+60Bhfr/4qkFdGJbp9ZIsTP8us4sktEDFn24Tq5f8sW7JyqIU83LRhjkIc8NALGCE
+DE7FgaGVUyuH8jYkVw4XLMwYo9gAy95pBxrDFq/r0Zm4E1rIEr8x7Ji7smUcubrb
+/MXu7OCXst4uzoRxFQctnP19AYIKZQ==
-----END X509 CRL-----
diff --git a/src/test/ssl/ssl/client.crt b/src/test/ssl/ssl/client.crt
index 1f6ae05fe4..eaf8830192 100644
--- a/src/test/ssl/ssl/client.crt
+++ b/src/test/ssl/ssl/client.crt
@@ -1,18 +1,18 @@
-----BEGIN CERTIFICATE-----
-MIIC0zCCAbsCCCAhAwMUEgcAMA0GCSqGSIb3DQEBCwUAMEIxQDA+BgNVBAMMN1Rl
+MIIC1TCCAb0CCCAjBxMWNSQAMA0GCSqGSIb3DQEBCwUAMEIxQDA+BgNVBAMMN1Rl
c3QgQ0EgZm9yIFBvc3RncmVTUUwgU1NMIHJlZ3Jlc3Npb24gdGVzdCBjbGllbnQg
-Y2VydHMwHhcNMjEwMzAzMjIxMjA3WhcNNDgwNzE5MjIxMjA3WjAWMRQwEgYDVQQD
-DAtzc2x0ZXN0dXNlcjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALSL
-oC6h8sBABL8kWRjFQJHZNcwmuRRWjzhBYR4gDKcBThCBIuEr5PZEkkXnJniXKHct
-bCzaBarUwG+bWGg6BiFWX3PP5MZvLG7ExP9yTrDjdwjKozkJCNWSow0hdYLaxkpm
-rYI6rDJ5T1CZBRLD4RYOjU39WVIxYkHlhJYtH0Cdv5PuzCOEtLdKQySSVq6heJen
-koLvK7AaF1x8uDiwM+o9t69pORWbOh/6aCCPeYmvhPIRvEqyZjGvPJ2kXau4R1vN
-NmepRIZ0VjQ/rQxo7dGWk38cfgsTeFI4G26DiYn08pFR47swUdfiMyx3MaGQiz9X
-I2nUqjM+W84iUxrR82MCAwEAATANBgkqhkiG9w0BAQsFAAOCAQEACSZo32raJHcB
-rYHeomzynmzgMVBHSA4XsXZVQw4+zBUER+/ZdQbtw6F/qdeWRvTl8TJjwoydta7u
-4gUkgAnQhYm2f8XEBe/+MUegH+y54Yk6rtmkdLxJLGKZ0IUfYkn20sg/NZrltbog
-A8glWRGVD8cEOaxUaNSQ4Xqmqsqjd6Kh8snVfIIcWgKgnTNgyapM5ePBpS2IREhN
-u9fjikQQf6F/dycsm22OP7aWsp1XPs3nqnoq9ZnhQrITMwsGcjbU7+v8La2GbiJV
-8yAy136NSXUujIG/8eqhICWZPqj+KbdVZupOsUeVoeuSwLXJjm4GWY0xH92emqCI
-ac+HriJv5w==
+Y2VydHMwIBcNMjMwNjI5MDEwMTAxWhgPMjA1MDAxMDEwMTAxMDFaMBYxFDASBgNV
+BAMMC3NzbHRlc3R1c2VyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
+tIugLqHywEAEvyRZGMVAkdk1zCa5FFaPOEFhHiAMpwFOEIEi4Svk9kSSRecmeJco
+dy1sLNoFqtTAb5tYaDoGIVZfc8/kxm8sbsTE/3JOsON3CMqjOQkI1ZKjDSF1gtrG
+SmatgjqsMnlPUJkFEsPhFg6NTf1ZUjFiQeWEli0fQJ2/k+7MI4S0t0pDJJJWrqF4
+l6eSgu8rsBoXXHy4OLAz6j23r2k5FZs6H/poII95ia+E8hG8SrJmMa88naRdq7hH
+W802Z6lEhnRWND+tDGjt0ZaTfxx+CxN4UjgbboOJifTykVHjuzBR1+IzLHcxoZCL
+P1cjadSqMz5bziJTGtHzYwIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQAQnfs7UO2g
+iilUgCQAfa9Vb0ZSivD7ryjnLsdwYRLIlb0YceME9qtSv2UYBfS9KpwG7+jONMQB
+kvbe611/TaF0T7EC1GIWuTMs8jknJ2bgPbS8D8jiFWTci+SDDog4EVoakSLoirW6
+yB4398upjtanAdnjoNpE4REXPDHzDm2Dico2RCObJh1VAEK+q6gLJxQtGvdPyG3L
+Fhjs7ky1lsxIvHlts8c1e4vhnVpxdS3I5r6N38qFXEJnc1tv/e+TH50mdrZlzRHF
+TPgnZzWCGTHmT5YT3yoAldWG4uWzMsB+2eY/crRefM9byc0omjCxDTrk9nA6JWsf
+0c6pBc6aKzdi
-----END CERTIFICATE-----
diff --git a/src/test/ssl/ssl/client_ca.crt b/src/test/ssl/ssl/client_ca.crt
index ef48749f76..31867bd0f4 100644
--- a/src/test/ssl/ssl/client_ca.crt
+++ b/src/test/ssl/ssl/client_ca.crt
@@ -1,19 +1,22 @@
-----BEGIN CERTIFICATE-----
-MIIDFDCCAfygAwIBAgIIICEDAxQSBwEwDQYJKoZIhvcNAQELBQAwQDE+MDwGA1UE
+MIIDnjCCAoagAwIBAgIIICMHExY1IwEwDQYJKoZIhvcNAQELBQAwQDE+MDwGA1UE
Aww1VGVzdCByb290IENBIGZvciBQb3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRl
-c3Qgc3VpdGUwHhcNMjEwMzAzMjIxMjA3WhcNNDgwNzE5MjIxMjA3WjBCMUAwPgYD
-VQQDDDdUZXN0IENBIGZvciBQb3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRlc3Qg
-Y2xpZW50IGNlcnRzMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu+ce
-8rkNfoCvI9Wjug9pxsptsdjhZ4s7ZZ8eD5VlloryK2JccusQIX61XY8I3OZjLTgq
-1SpZbHQvktRH6gmU7tfoBdEnRuXB7idkbYOKIrC0hdttb/5rDzjQGtXTmwoVrCcJ
-nvO1Whay/gdsoqX1tT1MTPWu/6dfQkQXA0PizVvmBasAEQchxqtcH2rSc6TPE13v
-lxJ0X1vSlz92uT6kenrxUDs43AH/kASdIQBHXVA4XWBAm7NRqwKX7BBwbsF2m3Qh
-+NY9Bf9MnJHLcnVnwZdlW5nd7H7BTB43XvkiYascqusYki+fY58eGSprZ/VUjmGx
-pgQnQXWCu0U3JyUL/QIDAQABoxAwDjAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEB
-CwUAA4IBAQC1syY2Rk02m5PGtfkMUIU7ZSe0mM+g0BgWAyCF/mFFYdfY0xHtqy0x
-QWkW9OR0KBl4JpphDDolHoNL3TLydH3t4inX8SAOpaUdsjMcIPKqjT1htQm0Pk5r
-vFYvKuVrxMnV0F+wMmZRuziKWrZlVDwBMfCAchzuVexDWfcjTmUQmhZxJuUzORw3
-swgh9HIpxjMkgdlHodbMAEpMIkkoeJnph3I9uTocXZbK/lAInggQdm0Q+on1ZT0A
-ljO/6jisDZzIguE4ZAQ2DfYsGI8H3tz/+76uIwwBNOmu0woUDSWXVcPWiviq49Bi
-GmH0KlUfWAphj86IfTWXT1HRay3eZQt3
+c3Qgc3VpdGUwIBcNMjMwNzEzMTQzNTIzWhgPMjA1MDExMjgxNDM1MjNaMEIxQDA+
+BgNVBAMMN1Rlc3QgQ0EgZm9yIFBvc3RncmVTUUwgU1NMIHJlZ3Jlc3Npb24gdGVz
+dCBjbGllbnQgY2VydHMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC7
+5x7yuQ1+gK8j1aO6D2nGym2x2OFniztlnx4PlWWWivIrYlxy6xAhfrVdjwjc5mMt
+OCrVKllsdC+S1EfqCZTu1+gF0SdG5cHuJ2Rtg4oisLSF221v/msPONAa1dObChWs
+Jwme87VaFrL+B2yipfW1PUxM9a7/p19CRBcDQ+LNW+YFqwARByHGq1wfatJzpM8T
+Xe+XEnRfW9KXP3a5PqR6evFQOzjcAf+QBJ0hAEddUDhdYECbs1GrApfsEHBuwXab
+dCH41j0F/0yckctydWfBl2Vbmd3sfsFMHjde+SJhqxyq6xiSL59jnx4ZKmtn9VSO
+YbGmBCdBdYK7RTcnJQv9AgMBAAGjgZcwgZQwDAYDVR0TBAUwAwEB/zAdBgNVHQ4E
+FgQUn6Tr0smZ3rADsDA0IoFhFUu9rTYwZQYDVR0jBF4wXKFEpEIwQDE+MDwGA1UE
+Aww1VGVzdCByb290IENBIGZvciBQb3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRl
+c3Qgc3VpdGWCFBfnvJQgNLw9MyrcSA1T3Q2PyJIFMA0GCSqGSIb3DQEBCwUAA4IB
+AQAbYUfwGvV4u5Gpbhv5yxdueC0faKVIEXYRnT4Dky01cV7pGkFSFndlA2mFsj1g
+uuzkTFPMedcBefMoq2o2eX2B4ogrFHovxELI82i9pbv/MmsGNYwbMsp2lnUhNWon
+QwxFqMGA5Y2p8vyEG7lrHKiFDdt7uPxcOeTiWo0ZpC8uThqiR4fUkPinQ3EHEFGQ
++zl+G3pb4VRUzsyqh2n9swudqQcwjsDlQlkQ2vzVb6IWWiUCwL3V7HGPGmlVbsFG
+nQ1M44aBtWbBQtubfBRwYb5r+4sRN94LST6Phmhnd/AJccIKdCaheq+yLVVGiCJN
+3nDTmgTVSSmOm/RRmSXNp7AH
-----END CERTIFICATE-----
diff --git a/src/test/ssl/ssl/client_ext.crt b/src/test/ssl/ssl/client_ext.crt
index 9874ce49b9..5204391e46 100644
--- a/src/test/ssl/ssl/client_ext.crt
+++ b/src/test/ssl/ssl/client_ext.crt
@@ -1,21 +1,20 @@
-----BEGIN CERTIFICATE-----
-MIIDezCCAmOgAwIBAgIIICEREAQyQQAwDQYJKoZIhvcNAQELBQAwQjFAMD4GA1UE
+MIIDQTCCAimgAwIBAgIIICMHExY1JAMwDQYJKoZIhvcNAQELBQAwQjFAMD4GA1UE
Aww3VGVzdCBDQSBmb3IgUG9zdGdyZVNRTCBTU0wgcmVncmVzc2lvbiB0ZXN0IGNs
-aWVudCBjZXJ0czAeFw0yMTExMTAwMzMyNDFaFw00OTAzMjgwMzMyNDFaMBYxFDAS
-BgNVBAMMC3NzbHRlc3R1c2VyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
-AQEArCHikkEQLFITbn3ZfO8X2RW3fELeaImgy8W4Pkkc4LxdHCWjdCML/vtE/ZVu
-Op74qrQQWT0HKXFVUiZLbjAgV2PONS6VFHhc3sTFxuTaBnVdY+K98hoFnXskINt/
-wgwUhRcRZuKPcZvEHiqF6e3g3lQa99l1nVKPGPLOCvVhSgoV0Gwgxok0t7s25BCV
-ZmpMAwSTxpeviLF0e2MsttuyClQ4nuD92EHZX3BuG0WNPLxiwikV96uMffpMRGsx
-uiAHzD5ykYM7/b3eU0bjfi0J0qcfTSeytqFuRCNEukJpmtUmyYGqsFJ7HN7ejCY7
-ObAlBn8h+4bgwBRaeZDZLTMaYQIDAQABo4GgMIGdMAwGA1UdEwEB/wQCMAAwEwYD
+aWVudCBjZXJ0czAgFw0yMzA2MjkwMTAxMDFaGA8yMDUwMDEwMTAxMDEwMVowFjEU
+MBIGA1UEAwwLc3NsdGVzdHVzZXIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
+AoIBAQCsIeKSQRAsUhNufdl87xfZFbd8Qt5oiaDLxbg+SRzgvF0cJaN0Iwv++0T9
+lW46nviqtBBZPQcpcVVSJktuMCBXY841LpUUeFzexMXG5NoGdV1j4r3yGgWdeyQg
+23/CDBSFFxFm4o9xm8QeKoXp7eDeVBr32XWdUo8Y8s4K9WFKChXQbCDGiTS3uzbk
+EJVmakwDBJPGl6+IsXR7Yyy227IKVDie4P3YQdlfcG4bRY08vGLCKRX3q4x9+kxE
+azG6IAfMPnKRgzv9vd5TRuN+LQnSpx9NJ7K2oW5EI0S6Qmma1SbJgaqwUnsc3t6M
+Jjs5sCUGfyH7huDAFFp5kNktMxphAgMBAAGjZTBjMAwGA1UdEwEB/wQCMAAwEwYD
VR0lBAwwCgYIKwYBBQUHAwIwHQYDVR0OBBYEFPPv1n7k1Vd9BBC4eoGWPZwVz2Lx
-MFkGA1UdIwRSMFChRKRCMEAxPjA8BgNVBAMMNVRlc3Qgcm9vdCBDQSBmb3IgUG9z
-dGdyZVNRTCBTU0wgcmVncmVzc2lvbiB0ZXN0IHN1aXRlggggIQMDFBIHATANBgkq
-hkiG9w0BAQsFAAOCAQEAtqIeTmUhtHyCt5k2yx88F0dKshYq4Z+LQI+agyZ1fRE6
-Ux5p+SBGbzvc+NcUvc7yGG6w2G/nTVnGwSHN9NtQa2T2XbHJysJ/dwCfmRsachKz
-4kCp0zAHEDrEmZua0sy5BLwwVCk5WNBR0lZ35WmIEuRA+5G/2lCywtrb9W4YnbAM
-nH7BtZE8qPbK4OicB40I2NXz6KhG3755oKN03VC1IaX9JFQxf37ac7jVK5bsjfaF
-0xCAeuDN6wDiVHZj6q1GhhmNLzaF5zmU2e/cI1nTI5tfGKnygavlZIz2VvAlcypt
-YZdMDy69VbTWUa57UPCspghgvm5M2/Hjmz50CXGMvw==
+MB8GA1UdIwQYMBaAFJ+k69LJmd6wA7AwNCKBYRVLva02MA0GCSqGSIb3DQEBCwUA
+A4IBAQBsDUu6W6jXfgOkBGhZpwTtpThQ3fizEmBLXiy479Sa27YzdXCrLkql+XDv
+Z0nh8t7gvSw5ZCl9eZ13yg9etAfGCkNtkI37EVh4rMMqP3NkjBT2qwdG+pfwcF/c
++vrSK3H47lVIE5AShJJAwlU0Thf1bfyjzTnoGxEj2+YBMMhAykp9XbAgtM14hCQV
+07niaMv4kmmHDoUU72UH7GYnfnsCkUKhbisw7qOojd4MPX/kvU77+S3UURHJKKHy
+Rag+GP03NeF+d1z3niVBOIXE6hzlfaxB0w0SW7fXgQFYRBujTUYdcSZ5ZuT9kHyH
+9zHx+isaomV7U7yIQ9mGT/fDugki
-----END CERTIFICATE-----
diff --git a/src/test/ssl/ssl/root+client-crldir/9bb9e3c3.r0 b/src/test/ssl/ssl/root+client-crldir/9bb9e3c3.r0
index f75eb1c0bc..202f9f44d0 100644
--- a/src/test/ssl/ssl/root+client-crldir/9bb9e3c3.r0
+++ b/src/test/ssl/ssl/root+client-crldir/9bb9e3c3.r0
@@ -1,12 +1,12 @@
-----BEGIN X509 CRL-----
-MIIBwDCBqTANBgkqhkiG9w0BAQsFADBCMUAwPgYDVQQDDDdUZXN0IENBIGZvciBQ
-b3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRlc3QgY2xpZW50IGNlcnRzFw0yMjA3
-MTgyMjI4MTVaFw00OTEyMDMyMjI4MTVaMDYwGQIIICEDAxQSBwEXDTIyMDcxODIy
-MjgxNVowGQIIICIHGBUoFQAXDTIyMDcxODIyMjgxNVowDQYJKoZIhvcNAQELBQAD
-ggEBAFDH3m9AHpDjkEFjO6svnLJ2bTliGeKZaJW8/RAN4mWvWDhXDQfzqGcFHN2a
-SIL57Xc4PdwTiXuU4QEP4RvWW90LYKdcrcT8uh0AN3i7ShMwcV7I7owzF5+CBuT7
-Ev0MU4QIz0PjXoybXP6b3wHhZbEjYTLYdnYdqjrsAchUpyDQn6fiC0C7FgjCi4HL
-rNm2kMchFpzd6K9e41kxWVp7xCPXgqUK8OrxlW56ObkX8UpBIZzyU6RisJKOZJAn
-/+lwT43yTtU739atdXdSMvGHT9Y7LsrSDz9zgp2/iMTmfctnPcp81J/6jQZEP8kx
-OyPyZz4xy/EShWy+KUklfOoKRo8=
+MIIBwjCBqzANBgkqhkiG9w0BAQsFADBCMUAwPgYDVQQDDDdUZXN0IENBIGZvciBQ
+b3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRlc3QgY2xpZW50IGNlcnRzFw0yMzA3
+MTMxNDM1MjRaGA8yMDUwMTEyODE0MzUyNFowNjAZAgggIwcTFjUkAhcNMjMwNzEz
+MTQzNTI0WjAZAgggIwcTFjUkBRcNMjMwNzEzMTQzNTI0WjANBgkqhkiG9w0BAQsF
+AAOCAQEAl2jqLuwUgUTtzIKdLyAqIGf+zG0jfJXD9KFIsPeR+zfYWyNVzlWav68e
+zcLLhr9NWzHCXo0F5yiWVIO9pe2OF980Ez/24fTd6NPk3qG9AzLeLQ0jPhEgLaDw
+KFSTuaTbEuAUBGHMTjdoe6aOGsypUOXxse/G5enyx93yCC7boFkrYscfnQT2kFZT
+60Bhfr/4qkFdGJbp9ZIsTP8us4sktEDFn24Tq5f8sW7JyqIU83LRhjkIc8NALGCE
+DE7FgaGVUyuH8jYkVw4XLMwYo9gAy95pBxrDFq/r0Zm4E1rIEr8x7Ji7smUcubrb
+/MXu7OCXst4uzoRxFQctnP19AYIKZQ==
-----END X509 CRL-----
diff --git a/src/test/ssl/ssl/root+client.crl b/src/test/ssl/ssl/root+client.crl
index 459f48da43..2e0616905c 100644
--- a/src/test/ssl/ssl/root+client.crl
+++ b/src/test/ssl/ssl/root+client.crl
@@ -10,14 +10,14 @@ SBNr2rpYp7Coc3GeCoWPcClgSrABD3Z5GY1YAdLGiXVKaH3CmdJTznhEPagE4z5R
+GrJP3XxJ1OC
-----END X509 CRL-----
-----BEGIN X509 CRL-----
-MIIBwDCBqTANBgkqhkiG9w0BAQsFADBCMUAwPgYDVQQDDDdUZXN0IENBIGZvciBQ
-b3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRlc3QgY2xpZW50IGNlcnRzFw0yMjA3
-MTgyMjI4MTVaFw00OTEyMDMyMjI4MTVaMDYwGQIIICEDAxQSBwEXDTIyMDcxODIy
-MjgxNVowGQIIICIHGBUoFQAXDTIyMDcxODIyMjgxNVowDQYJKoZIhvcNAQELBQAD
-ggEBAFDH3m9AHpDjkEFjO6svnLJ2bTliGeKZaJW8/RAN4mWvWDhXDQfzqGcFHN2a
-SIL57Xc4PdwTiXuU4QEP4RvWW90LYKdcrcT8uh0AN3i7ShMwcV7I7owzF5+CBuT7
-Ev0MU4QIz0PjXoybXP6b3wHhZbEjYTLYdnYdqjrsAchUpyDQn6fiC0C7FgjCi4HL
-rNm2kMchFpzd6K9e41kxWVp7xCPXgqUK8OrxlW56ObkX8UpBIZzyU6RisJKOZJAn
-/+lwT43yTtU739atdXdSMvGHT9Y7LsrSDz9zgp2/iMTmfctnPcp81J/6jQZEP8kx
-OyPyZz4xy/EShWy+KUklfOoKRo8=
+MIIBwjCBqzANBgkqhkiG9w0BAQsFADBCMUAwPgYDVQQDDDdUZXN0IENBIGZvciBQ
+b3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRlc3QgY2xpZW50IGNlcnRzFw0yMzA3
+MTMxNDM1MjRaGA8yMDUwMTEyODE0MzUyNFowNjAZAgggIwcTFjUkAhcNMjMwNzEz
+MTQzNTI0WjAZAgggIwcTFjUkBRcNMjMwNzEzMTQzNTI0WjANBgkqhkiG9w0BAQsF
+AAOCAQEAl2jqLuwUgUTtzIKdLyAqIGf+zG0jfJXD9KFIsPeR+zfYWyNVzlWav68e
+zcLLhr9NWzHCXo0F5yiWVIO9pe2OF980Ez/24fTd6NPk3qG9AzLeLQ0jPhEgLaDw
+KFSTuaTbEuAUBGHMTjdoe6aOGsypUOXxse/G5enyx93yCC7boFkrYscfnQT2kFZT
+60Bhfr/4qkFdGJbp9ZIsTP8us4sktEDFn24Tq5f8sW7JyqIU83LRhjkIc8NALGCE
+DE7FgaGVUyuH8jYkVw4XLMwYo9gAy95pBxrDFq/r0Zm4E1rIEr8x7Ji7smUcubrb
+/MXu7OCXst4uzoRxFQctnP19AYIKZQ==
-----END X509 CRL-----
diff --git a/src/test/ssl/ssl/root+client_ca.crt b/src/test/ssl/ssl/root+client_ca.crt
index 7819c54828..ff8281fba0 100644
--- a/src/test/ssl/ssl/root+client_ca.crt
+++ b/src/test/ssl/ssl/root+client_ca.crt
@@ -18,21 +18,24 @@ OCZhKLxVZiZmO71BBwsTgwtU58/G9e2ciGGdltI8ANlmVfdtwgRz3b7H9EUZat6s
kubl/m5HWBsKJEWEzFWrWkQV3ipoTmorJ6KCGABBCeVYmg==
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
-MIIDFDCCAfygAwIBAgIIICEDAxQSBwEwDQYJKoZIhvcNAQELBQAwQDE+MDwGA1UE
+MIIDnjCCAoagAwIBAgIIICMHExY1IwEwDQYJKoZIhvcNAQELBQAwQDE+MDwGA1UE
Aww1VGVzdCByb290IENBIGZvciBQb3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRl
-c3Qgc3VpdGUwHhcNMjEwMzAzMjIxMjA3WhcNNDgwNzE5MjIxMjA3WjBCMUAwPgYD
-VQQDDDdUZXN0IENBIGZvciBQb3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRlc3Qg
-Y2xpZW50IGNlcnRzMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu+ce
-8rkNfoCvI9Wjug9pxsptsdjhZ4s7ZZ8eD5VlloryK2JccusQIX61XY8I3OZjLTgq
-1SpZbHQvktRH6gmU7tfoBdEnRuXB7idkbYOKIrC0hdttb/5rDzjQGtXTmwoVrCcJ
-nvO1Whay/gdsoqX1tT1MTPWu/6dfQkQXA0PizVvmBasAEQchxqtcH2rSc6TPE13v
-lxJ0X1vSlz92uT6kenrxUDs43AH/kASdIQBHXVA4XWBAm7NRqwKX7BBwbsF2m3Qh
-+NY9Bf9MnJHLcnVnwZdlW5nd7H7BTB43XvkiYascqusYki+fY58eGSprZ/VUjmGx
-pgQnQXWCu0U3JyUL/QIDAQABoxAwDjAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEB
-CwUAA4IBAQC1syY2Rk02m5PGtfkMUIU7ZSe0mM+g0BgWAyCF/mFFYdfY0xHtqy0x
-QWkW9OR0KBl4JpphDDolHoNL3TLydH3t4inX8SAOpaUdsjMcIPKqjT1htQm0Pk5r
-vFYvKuVrxMnV0F+wMmZRuziKWrZlVDwBMfCAchzuVexDWfcjTmUQmhZxJuUzORw3
-swgh9HIpxjMkgdlHodbMAEpMIkkoeJnph3I9uTocXZbK/lAInggQdm0Q+on1ZT0A
-ljO/6jisDZzIguE4ZAQ2DfYsGI8H3tz/+76uIwwBNOmu0woUDSWXVcPWiviq49Bi
-GmH0KlUfWAphj86IfTWXT1HRay3eZQt3
+c3Qgc3VpdGUwIBcNMjMwNzEzMTQzNTIzWhgPMjA1MDExMjgxNDM1MjNaMEIxQDA+
+BgNVBAMMN1Rlc3QgQ0EgZm9yIFBvc3RncmVTUUwgU1NMIHJlZ3Jlc3Npb24gdGVz
+dCBjbGllbnQgY2VydHMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC7
+5x7yuQ1+gK8j1aO6D2nGym2x2OFniztlnx4PlWWWivIrYlxy6xAhfrVdjwjc5mMt
+OCrVKllsdC+S1EfqCZTu1+gF0SdG5cHuJ2Rtg4oisLSF221v/msPONAa1dObChWs
+Jwme87VaFrL+B2yipfW1PUxM9a7/p19CRBcDQ+LNW+YFqwARByHGq1wfatJzpM8T
+Xe+XEnRfW9KXP3a5PqR6evFQOzjcAf+QBJ0hAEddUDhdYECbs1GrApfsEHBuwXab
+dCH41j0F/0yckctydWfBl2Vbmd3sfsFMHjde+SJhqxyq6xiSL59jnx4ZKmtn9VSO
+YbGmBCdBdYK7RTcnJQv9AgMBAAGjgZcwgZQwDAYDVR0TBAUwAwEB/zAdBgNVHQ4E
+FgQUn6Tr0smZ3rADsDA0IoFhFUu9rTYwZQYDVR0jBF4wXKFEpEIwQDE+MDwGA1UE
+Aww1VGVzdCByb290IENBIGZvciBQb3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRl
+c3Qgc3VpdGWCFBfnvJQgNLw9MyrcSA1T3Q2PyJIFMA0GCSqGSIb3DQEBCwUAA4IB
+AQAbYUfwGvV4u5Gpbhv5yxdueC0faKVIEXYRnT4Dky01cV7pGkFSFndlA2mFsj1g
+uuzkTFPMedcBefMoq2o2eX2B4ogrFHovxELI82i9pbv/MmsGNYwbMsp2lnUhNWon
+QwxFqMGA5Y2p8vyEG7lrHKiFDdt7uPxcOeTiWo0ZpC8uThqiR4fUkPinQ3EHEFGQ
++zl+G3pb4VRUzsyqh2n9swudqQcwjsDlQlkQ2vzVb6IWWiUCwL3V7HGPGmlVbsFG
+nQ1M44aBtWbBQtubfBRwYb5r+4sRN94LST6Phmhnd/AJccIKdCaheq+yLVVGiCJN
+3nDTmgTVSSmOm/RRmSXNp7AH
-----END CERTIFICATE-----
diff --git a/src/test/ssl/ssl/root+server-crldir/a836cc2d.r0 b/src/test/ssl/ssl/root+server-crldir/a836cc2d.r0
index 331a83cb62..7ed68e0220 100644
--- a/src/test/ssl/ssl/root+server-crldir/a836cc2d.r0
+++ b/src/test/ssl/ssl/root+server-crldir/a836cc2d.r0
@@ -1,11 +1,11 @@
-----BEGIN X509 CRL-----
-MIIBpTCBjjANBgkqhkiG9w0BAQsFADBCMUAwPgYDVQQDDDdUZXN0IENBIGZvciBQ
-b3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRlc3Qgc2VydmVyIGNlcnRzFw0yMTAz
-MDMyMjEyMDdaFw00ODA3MTkyMjEyMDdaMBswGQIIICEDAxQSBwUXDTIxMDMwMzIy
-MTIwN1owDQYJKoZIhvcNAQELBQADggEBAJxj0taZYIIxUsCuXR5CN2OymjMvRwmV
-+10VOkyBQ3VkzHlXeJkmZsU2Dvmc205l9OYouh/faL0TfK2NyhmBo+MrTizL9TBo
-4u2es/0oJGj2wyNMkRs0SlSJelakvGFBvSKfqoV0l2O1WDV7M4KtdC8ZVZipmL4R
-ac4hBMK0ifHuTS5Od6o0C2RijEPCHMXaS/LkWpBqcStI2oirhjo+Th1wxTMGUVFy
-imVvt6D6QqqHCUYrvcNEN0xBNFwJGq/0cgSy+w5szt/RRehmJKX8MbNeZxrznIIx
-B18ch9rbBltz+Y4R63rCN9MdsnGXf6PQ6a6doZhSI1pnDrui12MOQrU=
+MIIBpzCBkDANBgkqhkiG9w0BAQsFADBCMUAwPgYDVQQDDDdUZXN0IENBIGZvciBQ
+b3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRlc3Qgc2VydmVyIGNlcnRzFw0yMzA3
+MTMxNDM1MjRaGA8yMDUwMTEyODE0MzUyNFowGzAZAgggIwcTFjUjCxcNMjMwNzEz
+MTQzNTI0WjANBgkqhkiG9w0BAQsFAAOCAQEADIkF8oS84O2PJw/C9BAzgrkd+EsO
+QL6mXUGBgXwmujfpv0Z8YK91k4+xV9hQRMjWe/DkU01+gmFhYoDvAzweuNQzx8lZ
+bYKu0dGTEpTd+OG1LbxYmt4f5xh096R5iLo7c7e2kMHvfNG7VwvKQrPeMqh7AcKy
+Fukt8C0Xc7Tfv2l2toEQUAl5UDUKEAovN6iB0qycpvi0nboyiDo8mV0p1jlAn846
+EeXjwm8tyGXzTFq16ypPwnlBM9d5Ml/p5WTN69nDux18G+iSCr+UDzLDYvLF11p3
+lEqpSo5lQg9zYuOgMCvu3g5BtwJgORPSiW/yZ5BXUfWvPi0XRPrknxMByA==
-----END X509 CRL-----
diff --git a/src/test/ssl/ssl/root+server.crl b/src/test/ssl/ssl/root+server.crl
index 8b0c716d63..93ffa5986e 100644
--- a/src/test/ssl/ssl/root+server.crl
+++ b/src/test/ssl/ssl/root+server.crl
@@ -10,13 +10,13 @@ SBNr2rpYp7Coc3GeCoWPcClgSrABD3Z5GY1YAdLGiXVKaH3CmdJTznhEPagE4z5R
+GrJP3XxJ1OC
-----END X509 CRL-----
-----BEGIN X509 CRL-----
-MIIBpTCBjjANBgkqhkiG9w0BAQsFADBCMUAwPgYDVQQDDDdUZXN0IENBIGZvciBQ
-b3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRlc3Qgc2VydmVyIGNlcnRzFw0yMTAz
-MDMyMjEyMDdaFw00ODA3MTkyMjEyMDdaMBswGQIIICEDAxQSBwUXDTIxMDMwMzIy
-MTIwN1owDQYJKoZIhvcNAQELBQADggEBAJxj0taZYIIxUsCuXR5CN2OymjMvRwmV
-+10VOkyBQ3VkzHlXeJkmZsU2Dvmc205l9OYouh/faL0TfK2NyhmBo+MrTizL9TBo
-4u2es/0oJGj2wyNMkRs0SlSJelakvGFBvSKfqoV0l2O1WDV7M4KtdC8ZVZipmL4R
-ac4hBMK0ifHuTS5Od6o0C2RijEPCHMXaS/LkWpBqcStI2oirhjo+Th1wxTMGUVFy
-imVvt6D6QqqHCUYrvcNEN0xBNFwJGq/0cgSy+w5szt/RRehmJKX8MbNeZxrznIIx
-B18ch9rbBltz+Y4R63rCN9MdsnGXf6PQ6a6doZhSI1pnDrui12MOQrU=
+MIIBpzCBkDANBgkqhkiG9w0BAQsFADBCMUAwPgYDVQQDDDdUZXN0IENBIGZvciBQ
+b3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRlc3Qgc2VydmVyIGNlcnRzFw0yMzA3
+MTMxNDM1MjRaGA8yMDUwMTEyODE0MzUyNFowGzAZAgggIwcTFjUjCxcNMjMwNzEz
+MTQzNTI0WjANBgkqhkiG9w0BAQsFAAOCAQEADIkF8oS84O2PJw/C9BAzgrkd+EsO
+QL6mXUGBgXwmujfpv0Z8YK91k4+xV9hQRMjWe/DkU01+gmFhYoDvAzweuNQzx8lZ
+bYKu0dGTEpTd+OG1LbxYmt4f5xh096R5iLo7c7e2kMHvfNG7VwvKQrPeMqh7AcKy
+Fukt8C0Xc7Tfv2l2toEQUAl5UDUKEAovN6iB0qycpvi0nboyiDo8mV0p1jlAn846
+EeXjwm8tyGXzTFq16ypPwnlBM9d5Ml/p5WTN69nDux18G+iSCr+UDzLDYvLF11p3
+lEqpSo5lQg9zYuOgMCvu3g5BtwJgORPSiW/yZ5BXUfWvPi0XRPrknxMByA==
-----END X509 CRL-----
diff --git a/src/test/ssl/ssl/root+server_ca.crt b/src/test/ssl/ssl/root+server_ca.crt
index 5074f4fa9b..a094886e0f 100644
--- a/src/test/ssl/ssl/root+server_ca.crt
+++ b/src/test/ssl/ssl/root+server_ca.crt
@@ -18,21 +18,24 @@ OCZhKLxVZiZmO71BBwsTgwtU58/G9e2ciGGdltI8ANlmVfdtwgRz3b7H9EUZat6s
kubl/m5HWBsKJEWEzFWrWkQV3ipoTmorJ6KCGABBCeVYmg==
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
-MIIDFDCCAfygAwIBAgIIICEDAxQSBwAwDQYJKoZIhvcNAQELBQAwQDE+MDwGA1UE
+MIIDnjCCAoagAwIBAgIIICMHExY1IwAwDQYJKoZIhvcNAQELBQAwQDE+MDwGA1UE
Aww1VGVzdCByb290IENBIGZvciBQb3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRl
-c3Qgc3VpdGUwHhcNMjEwMzAzMjIxMjA3WhcNNDgwNzE5MjIxMjA3WjBCMUAwPgYD
-VQQDDDdUZXN0IENBIGZvciBQb3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRlc3Qg
-c2VydmVyIGNlcnRzMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4kp2
-GW5nPb6QrSrtbClfZeutyQnHrm4TMPBoNepFdIVxBX/04BguM5ImDRze/huOWA+z
-atJAQqt3R7dsDwnOnPKUKCOuHX6a1aj5L86HtVgaWTXrZFE5NtL9PIzXkWu13UW0
-UesHtbPVRv6a6fB7Npph6hHy7iPZb009A8/lTJnxSPC39u/K/sPqjrVZaAJF+wDs
-qCxCZTUtAUFvWFnR/TeXLWlFzBupS1djgI7PltbJqSn6SKTAgNZTxpRJbu9Icp6J
-/50ELwT++0n0KWVXNHrDNfI5Gaa+SxClAsPsei2jLKpgR6QFC3wn38Z9q9LjAVuC
-+FWhoN1uhYeoricEXwIDAQABoxAwDjAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEB
-CwUAA4IBAQCdCA/EoXrustoV4jJGbkdXDuOUkBurwggSNBAqUBSDvCohRoD77Ecb
-QVuzPNxWKG+E4PwfUq2ha+2yPONEJ28ZgsbHq5qlJDMJ43wlcjn6wmmAJNeSpO8F
-0V9d2X/4wNZty9/zbwTnw26KChgDHumQ0WIbCoBtdqy8KDswYOvpgws6dqc021I7
-UrFo6vZek7VoApbJgkDL6qYADa6ApfW43ThH4sViFITeYt/kSHgmy2Udhs34jMM8
-xsFP/uYpRi1b1glenwSIKiHjD4/C9vnWQt5K3gRBvYukEj2Bw9VkNRpBVCi0cOoA
-OuwX3bwzNYNbZQv4K66oRpvuoEjCNeHg
+c3Qgc3VpdGUwIBcNMjMwNzEzMTQzNTIzWhgPMjA1MDExMjgxNDM1MjNaMEIxQDA+
+BgNVBAMMN1Rlc3QgQ0EgZm9yIFBvc3RncmVTUUwgU1NMIHJlZ3Jlc3Npb24gdGVz
+dCBzZXJ2ZXIgY2VydHMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDi
+SnYZbmc9vpCtKu1sKV9l663JCceubhMw8Gg16kV0hXEFf/TgGC4zkiYNHN7+G45Y
+D7Nq0kBCq3dHt2wPCc6c8pQoI64dfprVqPkvzoe1WBpZNetkUTk20v08jNeRa7Xd
+RbRR6we1s9VG/prp8Hs2mmHqEfLuI9lvTT0Dz+VMmfFI8Lf278r+w+qOtVloAkX7
+AOyoLEJlNS0BQW9YWdH9N5ctaUXMG6lLV2OAjs+W1smpKfpIpMCA1lPGlElu70hy
+non/nQQvBP77SfQpZVc0esM18jkZpr5LEKUCw+x6LaMsqmBHpAULfCffxn2r0uMB
+W4L4VaGg3W6Fh6iuJwRfAgMBAAGjgZcwgZQwDAYDVR0TBAUwAwEB/zAdBgNVHQ4E
+FgQU8o86ZkBQZEgi1y6C/1aewrPudAowZQYDVR0jBF4wXKFEpEIwQDE+MDwGA1UE
+Aww1VGVzdCByb290IENBIGZvciBQb3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRl
+c3Qgc3VpdGWCFBfnvJQgNLw9MyrcSA1T3Q2PyJIFMA0GCSqGSIb3DQEBCwUAA4IB
+AQANlEDrM357a7o+WcKB0Ocll2UtBMq7PDms1Pjqm3fFu/wdKDUomG8W2/MgDmFl
+CVeAPpofb6J0oaxiEZOR68pOhdccMznArtKix6t3RkDiXdm4d5UORMMR+s9CymXV
+MUTWpQpAg3qP3mRI+3E9OrgfhvmVcuOa7/cdTS/sylGe8Db+nJQD0be9NHtnhO56
+IA+Li+8oWzD4UNsP3gAmhLkyToz5wlPHzEkgGxkEySNErEOKTOX5Xyk5z+QToRhz
+adkt0mBw/dxoJk9DveCtIqxDelxJsDeJFtqoc5qVVE9yOp7rujGsqgWl2PcJeyKM
+Crh9qsqNzJ2R29pq0g6Lfzh2
-----END CERTIFICATE-----
diff --git a/src/test/ssl/ssl/server-cn-and-alt-names.crt b/src/test/ssl/ssl/server-cn-and-alt-names.crt
index 12d1ec363e..982c02a514 100644
--- a/src/test/ssl/ssl/server-cn-and-alt-names.crt
+++ b/src/test/ssl/ssl/server-cn-and-alt-names.crt
@@ -1,20 +1,22 @@
-----BEGIN CERTIFICATE-----
-MIIDVTCCAj2gAwIBAgIIICEDAxQSBwAwDQYJKoZIhvcNAQELBQAwQjFAMD4GA1UE
+MIIDmTCCAoGgAwIBAgIIICMHExY1IwAwDQYJKoZIhvcNAQELBQAwQjFAMD4GA1UE
Aww3VGVzdCBDQSBmb3IgUG9zdGdyZVNRTCBTU0wgcmVncmVzc2lvbiB0ZXN0IHNl
-cnZlciBjZXJ0czAeFw0yMTAzMDMyMjEyMDdaFw00ODA3MTkyMjEyMDdaMEYxHjAc
-BgNVBAsMFVBvc3RncmVTUUwgdGVzdCBzdWl0ZTEkMCIGA1UEAwwbY29tbW9uLW5h
-bWUucGctc3NsdGVzdC50ZXN0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
-AQEAwVES+mD1iY1UBGWNLsuBxGkyOGTI1X/sXcCUZ7aLOGkXHYatiUTcIrSNNAS5
-yCvbq/A/C1NuDw59nrU2TitcLBx5AIhz74EV+xv/u/GuX0gvJzDWh/6EeMzDIcJL
-Iq7iEgO8ff5fuAzuwuNguZkX51JjBiXc2rtfgPI3CMU1lqCbb2vW9ZN4Pm7wRqvd
-d/F/mySiFmLFsB4HLhCGZN89vO4cbslN4+YrGKEcHeXGWRaxv6gSXbpEgUYpefzz
-+QB7AepU5aWntm3X+E1we5AHLSKckwUdBuT5uYgmZcYA/kCC4/9RS02jTlu4Vfrd
-SemHwuo2UQ5ODJxzAhWrEl3F4QIDAQABo0swSTBHBgNVHREEQDA+gh1kbnMxLmFs
-dC1uYW1lLnBnLXNzbHRlc3QudGVzdIIdZG5zMi5hbHQtbmFtZS5wZy1zc2x0ZXN0
-LnRlc3QwDQYJKoZIhvcNAQELBQADggEBAG3dFQ/DqjFbjzIOni079R3I94lAZqbc
-cRUumDPSzihKwvCCnU5quqnYkOFISqBZsYmxR5fiHx4wT+jmWvLSltkaeS6gcGC1
-zuO8GFzL+PATUX63js8IfE3WYJE/bjmDVVzJOBArrbsExofdE2F2kkkLkjhk0ylg
-/TrAKtyqpsob0b4ZjMloR5JFHQXGHN/922x6Do1vduHMXlGckmR0sX6Mg/fiChVh
-vixUJje4W9ohft8G7lj3GnzI1gHEMp2PYKM+wqOug/gXEQuMIFlhjp2Mc6bAvFsD
-grgdAgcYUvgKukF9efJHq2V5XjqBWrmGAOQkiH1y+9gxhiHUiw+vojY=
+cnZlciBjZXJ0czAgFw0yMzA3MTMxNDM1MjNaGA8yMDUwMTEyODE0MzUyM1owRjEe
+MBwGA1UECwwVUG9zdGdyZVNRTCB0ZXN0IHN1aXRlMSQwIgYDVQQDDBtjb21tb24t
+bmFtZS5wZy1zc2x0ZXN0LnRlc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
+AoIBAQDBURL6YPWJjVQEZY0uy4HEaTI4ZMjVf+xdwJRntos4aRcdhq2JRNwitI00
+BLnIK9ur8D8LU24PDn2etTZOK1wsHHkAiHPvgRX7G/+78a5fSC8nMNaH/oR4zMMh
+wksiruISA7x9/l+4DO7C42C5mRfnUmMGJdzau1+A8jcIxTWWoJtva9b1k3g+bvBG
+q9138X+bJKIWYsWwHgcuEIZk3z287hxuyU3j5isYoRwd5cZZFrG/qBJdukSBRil5
+/PP5AHsB6lTlpae2bdf4TXB7kActIpyTBR0G5Pm5iCZlxgD+QILj/1FLTaNOW7hV
++t1J6YfC6jZRDk4MnHMCFasSXcXhAgMBAAGjgYwwgYkwRwYDVR0RBEAwPoIdZG5z
+MS5hbHQtbmFtZS5wZy1zc2x0ZXN0LnRlc3SCHWRuczIuYWx0LW5hbWUucGctc3Ns
+dGVzdC50ZXN0MB0GA1UdDgQWBBQnWI8n7O4aU6PooSwyIepyrEpsajAfBgNVHSME
+GDAWgBTyjzpmQFBkSCLXLoL/Vp7Cs+50CjANBgkqhkiG9w0BAQsFAAOCAQEAQk/M
+emDTPYUx/JrSdTyvVDeBaUMUjWQ78LO1j/2RqtBXh/tSnTvalOeuwBPqmz9+7HYR
+H2gYQNq4W1Y6SgTdbpEivEXPvp1XyQXtLMpwDGO4rKq3QOCOPX2zZLDPrRqGSev3
+jN7oV8C3yVUyhhSxu+BZo4lZ55soiehCjHNKR5xfcbR/AtshLullVNNqoGQQyalS
+9TNUKp7FqF52tIELvFMINoSf5aaLU1g7snxnVRbTFyne/oqeqFjW932M/vaFgAH7
+H8mfoJeAiG5GqVBKtf3kcakfBl1wjFCzpguvDd9Xi2AP1y3cPEotwFiKhCYMmGiA
+EnzrdmAeNGKb2w3wlA==
-----END CERTIFICATE-----
diff --git a/src/test/ssl/ssl/server-cn-and-ip-alt-names.crt b/src/test/ssl/ssl/server-cn-and-ip-alt-names.crt
index 4e58c85ccb..fea2703aaf 100644
--- a/src/test/ssl/ssl/server-cn-and-ip-alt-names.crt
+++ b/src/test/ssl/ssl/server-cn-and-ip-alt-names.crt
@@ -1,20 +1,21 @@
-----BEGIN CERTIFICATE-----
-MIIDLzCCAhegAwIBAgIIICERKRE1UQAwDQYJKoZIhvcNAQELBQAwQjFAMD4GA1UE
+MIIDcTCCAlmgAwIBAgIIICMHExY1IwEwDQYJKoZIhvcNAQELBQAwQjFAMD4GA1UE
Aww3VGVzdCBDQSBmb3IgUG9zdGdyZVNRTCBTU0wgcmVncmVzc2lvbiB0ZXN0IHNl
-cnZlciBjZXJ0czAeFw0yMTExMjkxOTM1NTFaFw00OTA0MTYxOTM1NTFaMEYxHjAc
-BgNVBAsMFVBvc3RncmVTUUwgdGVzdCBzdWl0ZTEkMCIGA1UEAwwbY29tbW9uLW5h
-bWUucGctc3NsdGVzdC50ZXN0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
-AQEA6+8IYKAFnZ7V+fDo1cyMpbGBLzCfJOQ/1o2jOGP4+GjpsZgv6S6UT2MheC8M
-iiEFrYwdsSIZyYc3jEZrluy/UuR0bCGtqU92BCqa0iBLhvHOgjR588u253eLxQtQ
-8iJn11QPrKMk35nMkmY8GfHt4sGFbvBL6+GpipHq7a6cde3Z+v4kCB5dKMYDUDtm
-3mJmviuGNAu5wOqItk2Yi5dwJs1054007KNH0Il43urxiOfnkLS0cG5kehboPf86
-vxBt3iHByrU/9/DY5IvQCfSXVNa6rb5w5/pGja9aCei6Mv1jQY/V8SMQTga+MOsA
-0WB9akxMi2NxwS2+BQ4k/McPlwIDAQABoyUwIzAhBgNVHREEGjAYhwTAAAIBhxAg
-AQ24AAAAAAAAAAAAAAABMA0GCSqGSIb3DQEBCwUAA4IBAQAQLo2RzC07dG9p+J3A
-W6C0p3Y+Os/YE2D9wfp4TIDTZxcRUQZ0S6ahF1N6sp8l9KHBJHPU1cUpRAU1oD+Y
-SqmnP/VJRRDTTj9Ytdc/Vuo2jeLpSYhVKrCqtjqIrCwYJFoYRmMoxTtJGlwA0hSd
-kwo3XYrALPUQWUErTYPvNfDNIuUwqUXNfS0CXuIOVN3LJ+shegg6Pwbh9B5T9NHx
-kH+HswajhdpdnZIgh0FYTlTCPILDrB49aOWwqLa54AUA6WXa35hPsP8SoqL9Eucq
-ifPhBYyadsjOb+70N8GbbAsDPN1jCX9L8RuNcEkxSCKCYx91cWXh7K5KMPuGlzB7
-j8xB
+cnZlciBjZXJ0czAgFw0yMzA3MTMxNDM1MjNaGA8yMDUwMTEyODE0MzUyM1owRjEe
+MBwGA1UECwwVUG9zdGdyZVNRTCB0ZXN0IHN1aXRlMSQwIgYDVQQDDBtjb21tb24t
+bmFtZS5wZy1zc2x0ZXN0LnRlc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
+AoIBAQDr7whgoAWdntX58OjVzIylsYEvMJ8k5D/WjaM4Y/j4aOmxmC/pLpRPYyF4
+LwyKIQWtjB2xIhnJhzeMRmuW7L9S5HRsIa2pT3YEKprSIEuG8c6CNHnzy7bnd4vF
+C1DyImfXVA+soyTfmcySZjwZ8e3iwYVu8Evr4amKkertrpx17dn6/iQIHl0oxgNQ
+O2beYma+K4Y0C7nA6oi2TZiLl3AmzXTnjTTso0fQiXje6vGI5+eQtLRwbmR6Fug9
+/zq/EG3eIcHKtT/38Njki9AJ9JdU1rqtvnDn+kaNr1oJ6Loy/WNBj9XxIxBOBr4w
+6wDRYH1qTEyLY3HBLb4FDiT8xw+XAgMBAAGjZTBjMCEGA1UdEQQaMBiHBMAAAgGH
+ECABDbgAAAAAAAAAAAAAAAEwHQYDVR0OBBYEFG+mujVw0u9XhfSYVs8/XJPwFCmF
+MB8GA1UdIwQYMBaAFPKPOmZAUGRIItcugv9WnsKz7nQKMA0GCSqGSIb3DQEBCwUA
+A4IBAQAm0M+VY4eZwfu47OPdiIJ4YxyGtcRCDDCuqZ8ACG7YH51Trhvm7SuHhGVQ
+aJvphWDPrt4e0Exmga0T8RJ2Xd49F9u21/biz+vvzdjpzcr3yd9YGQ2IoU35b3ln
+AVVB36i38eAOxYpSsv4CN01ilJYxhMdUQqRYjlagIYIp7dBwuQ7+uXUesBY6xgL/
+N0G+cUQuax8mokVB0HfNccbroXpJaz3fU1TSPiDgin7yMGkm9bTwj30pbesBOTID
+MqdYNodA7RIZslnmHn7q1rsGIBVUHrxUyH7/4m9ZbhI1Zz0VkoWAPklkqCO7moIb
+/oB/DmtwTndVB0urbGnEDzaoCntL
-----END CERTIFICATE-----
diff --git a/src/test/ssl/ssl/server-cn-only+server_ca.crt b/src/test/ssl/ssl/server-cn-only+server_ca.crt
index 9870e8c17a..71ede03546 100644
--- a/src/test/ssl/ssl/server-cn-only+server_ca.crt
+++ b/src/test/ssl/ssl/server-cn-only+server_ca.crt
@@ -1,38 +1,41 @@
-----BEGIN CERTIFICATE-----
-MIIDAzCCAesCCCAhAwMUEgcBMA0GCSqGSIb3DQEBCwUAMEIxQDA+BgNVBAMMN1Rl
+MIIDBTCCAe0CCCAjBxMWNSMCMA0GCSqGSIb3DQEBCwUAMEIxQDA+BgNVBAMMN1Rl
c3QgQ0EgZm9yIFBvc3RncmVTUUwgU1NMIHJlZ3Jlc3Npb24gdGVzdCBzZXJ2ZXIg
-Y2VydHMwHhcNMjEwMzAzMjIxMjA3WhcNNDgwNzE5MjIxMjA3WjBGMR4wHAYDVQQL
-DBVQb3N0Z3JlU1FMIHRlc3Qgc3VpdGUxJDAiBgNVBAMMG2NvbW1vbi1uYW1lLnBn
-LXNzbHRlc3QudGVzdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANWz
-VPMk7i5f+W0eEadRE+TTAtsIK08CkLMUnjs7zJkxnnm6RGBXPx6vK3AkAIi+wG4Y
-mXjYP3GuMiXaLjnWh2kzBSfIRQyNbTThnhSu3nDjAVkPexsSrPyiKimFuNgDfkGe
-5dQKa9Ag2SuVU4vd9SYxOMAiIFIC4ts4MLWWJf5D/PehdSuc0e5Me+91Nnbz90nl
-ds4lHvuDR+aKnZlTHmch3wfhXv7lNQImIBzfwl36Kd/bWB0fAEVFse3iZWmigaI/
-9FKh//WIq43TNLxn68OCQoyMe/HGjZDR/Xwo3rE6jg6/iAwSWib9yabfYPKbqq2G
-oFy6aYmmEquaDgLuX7kCAwEAATANBgkqhkiG9w0BAQsFAAOCAQEA2AZrD9cTQXTW
-4j2tT8N/TTc6WK2ncN4h22NTte6vK7MVwsZJCtw5ndYkmxcWkXAqiclzWyMdayds
-WOa12CEH7jKAhivF4Hcw3oO3JHM5BA6KzLWBVz9uZksOM6mPqn29DTKvA/Y1V8tj
-mxK/KUA68h/u6inu3mo4ywBpb/tqHxxg2cjyR0faCmM0pwRM0HBr/16fUMfO83nj
-QG8g9J/bybu5sYso/aSoC5nUNp4XjmDMdVLdqg/nTe/ejS8IfFr0WQxBlqooqFgx
-MSE+kX2e2fHsuOWSU/9eClt6FpQrwoC2C8F+/4g1Uz7Liqc4yMHPwjgeP9ewrrLO
-iIhlNNPqpQ==
+Y2VydHMwIBcNMjMwNzEzMTQzNTIzWhgPMjA1MDExMjgxNDM1MjNaMEYxHjAcBgNV
+BAsMFVBvc3RncmVTUUwgdGVzdCBzdWl0ZTEkMCIGA1UEAwwbY29tbW9uLW5hbWUu
+cGctc3NsdGVzdC50ZXN0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
+1bNU8yTuLl/5bR4Rp1ET5NMC2wgrTwKQsxSeOzvMmTGeebpEYFc/Hq8rcCQAiL7A
+bhiZeNg/ca4yJdouOdaHaTMFJ8hFDI1tNOGeFK7ecOMBWQ97GxKs/KIqKYW42AN+
+QZ7l1Apr0CDZK5VTi931JjE4wCIgUgLi2zgwtZYl/kP896F1K5zR7kx773U2dvP3
+SeV2ziUe+4NH5oqdmVMeZyHfB+Fe/uU1AiYgHN/CXfop39tYHR8ARUWx7eJlaaKB
+oj/0UqH/9YirjdM0vGfrw4JCjIx78caNkNH9fCjesTqODr+IDBJaJv3Jpt9g8puq
+rYagXLppiaYSq5oOAu5fuQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQCT3LdsDzwy
+oKaXNuOgtENp4Pp4hLDXeZsepemYss75xfPsXyni9gWVTPIwwzq7NMawtP5q7zzB
+zUMiDgsL9J3d1kDcL0qbJV7xciwCA5D0O1EFKSogJK9jgdupswQZKNrEtM2F68mN
+SJ2aCJtIX/4lZb9KyRli4PDECrFjJM4vDQa9y05O5YY7lohvY5jubAAgexLT/n5r
+oycpw3xNzwGIQ8dAtjvtgONFFKAogWomFaCjWSBPW3ZVz4NM7CryH6oyxkUv/v+q
+/7vUykX0qBn7Vnk3nvVsqrqRRCbYXMz8qgMLeeXi5JjSeWDpYoiblIEfpf3FdtqS
+FnIQVHtAuZHb
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
-MIIDFDCCAfygAwIBAgIIICEDAxQSBwAwDQYJKoZIhvcNAQELBQAwQDE+MDwGA1UE
+MIIDnjCCAoagAwIBAgIIICMHExY1IwAwDQYJKoZIhvcNAQELBQAwQDE+MDwGA1UE
Aww1VGVzdCByb290IENBIGZvciBQb3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRl
-c3Qgc3VpdGUwHhcNMjEwMzAzMjIxMjA3WhcNNDgwNzE5MjIxMjA3WjBCMUAwPgYD
-VQQDDDdUZXN0IENBIGZvciBQb3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRlc3Qg
-c2VydmVyIGNlcnRzMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4kp2
-GW5nPb6QrSrtbClfZeutyQnHrm4TMPBoNepFdIVxBX/04BguM5ImDRze/huOWA+z
-atJAQqt3R7dsDwnOnPKUKCOuHX6a1aj5L86HtVgaWTXrZFE5NtL9PIzXkWu13UW0
-UesHtbPVRv6a6fB7Npph6hHy7iPZb009A8/lTJnxSPC39u/K/sPqjrVZaAJF+wDs
-qCxCZTUtAUFvWFnR/TeXLWlFzBupS1djgI7PltbJqSn6SKTAgNZTxpRJbu9Icp6J
-/50ELwT++0n0KWVXNHrDNfI5Gaa+SxClAsPsei2jLKpgR6QFC3wn38Z9q9LjAVuC
-+FWhoN1uhYeoricEXwIDAQABoxAwDjAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEB
-CwUAA4IBAQCdCA/EoXrustoV4jJGbkdXDuOUkBurwggSNBAqUBSDvCohRoD77Ecb
-QVuzPNxWKG+E4PwfUq2ha+2yPONEJ28ZgsbHq5qlJDMJ43wlcjn6wmmAJNeSpO8F
-0V9d2X/4wNZty9/zbwTnw26KChgDHumQ0WIbCoBtdqy8KDswYOvpgws6dqc021I7
-UrFo6vZek7VoApbJgkDL6qYADa6ApfW43ThH4sViFITeYt/kSHgmy2Udhs34jMM8
-xsFP/uYpRi1b1glenwSIKiHjD4/C9vnWQt5K3gRBvYukEj2Bw9VkNRpBVCi0cOoA
-OuwX3bwzNYNbZQv4K66oRpvuoEjCNeHg
+c3Qgc3VpdGUwIBcNMjMwNzEzMTQzNTIzWhgPMjA1MDExMjgxNDM1MjNaMEIxQDA+
+BgNVBAMMN1Rlc3QgQ0EgZm9yIFBvc3RncmVTUUwgU1NMIHJlZ3Jlc3Npb24gdGVz
+dCBzZXJ2ZXIgY2VydHMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDi
+SnYZbmc9vpCtKu1sKV9l663JCceubhMw8Gg16kV0hXEFf/TgGC4zkiYNHN7+G45Y
+D7Nq0kBCq3dHt2wPCc6c8pQoI64dfprVqPkvzoe1WBpZNetkUTk20v08jNeRa7Xd
+RbRR6we1s9VG/prp8Hs2mmHqEfLuI9lvTT0Dz+VMmfFI8Lf278r+w+qOtVloAkX7
+AOyoLEJlNS0BQW9YWdH9N5ctaUXMG6lLV2OAjs+W1smpKfpIpMCA1lPGlElu70hy
+non/nQQvBP77SfQpZVc0esM18jkZpr5LEKUCw+x6LaMsqmBHpAULfCffxn2r0uMB
+W4L4VaGg3W6Fh6iuJwRfAgMBAAGjgZcwgZQwDAYDVR0TBAUwAwEB/zAdBgNVHQ4E
+FgQU8o86ZkBQZEgi1y6C/1aewrPudAowZQYDVR0jBF4wXKFEpEIwQDE+MDwGA1UE
+Aww1VGVzdCByb290IENBIGZvciBQb3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRl
+c3Qgc3VpdGWCFBfnvJQgNLw9MyrcSA1T3Q2PyJIFMA0GCSqGSIb3DQEBCwUAA4IB
+AQANlEDrM357a7o+WcKB0Ocll2UtBMq7PDms1Pjqm3fFu/wdKDUomG8W2/MgDmFl
+CVeAPpofb6J0oaxiEZOR68pOhdccMznArtKix6t3RkDiXdm4d5UORMMR+s9CymXV
+MUTWpQpAg3qP3mRI+3E9OrgfhvmVcuOa7/cdTS/sylGe8Db+nJQD0be9NHtnhO56
+IA+Li+8oWzD4UNsP3gAmhLkyToz5wlPHzEkgGxkEySNErEOKTOX5Xyk5z+QToRhz
+adkt0mBw/dxoJk9DveCtIqxDelxJsDeJFtqoc5qVVE9yOp7rujGsqgWl2PcJeyKM
+Crh9qsqNzJ2R29pq0g6Lfzh2
-----END CERTIFICATE-----
diff --git a/src/test/ssl/ssl/server-cn-only.crt b/src/test/ssl/ssl/server-cn-only.crt
index acdf6f1a75..6429529226 100644
--- a/src/test/ssl/ssl/server-cn-only.crt
+++ b/src/test/ssl/ssl/server-cn-only.crt
@@ -1,19 +1,19 @@
-----BEGIN CERTIFICATE-----
-MIIDAzCCAesCCCAhAwMUEgcBMA0GCSqGSIb3DQEBCwUAMEIxQDA+BgNVBAMMN1Rl
+MIIDBTCCAe0CCCAjBxMWNSMCMA0GCSqGSIb3DQEBCwUAMEIxQDA+BgNVBAMMN1Rl
c3QgQ0EgZm9yIFBvc3RncmVTUUwgU1NMIHJlZ3Jlc3Npb24gdGVzdCBzZXJ2ZXIg
-Y2VydHMwHhcNMjEwMzAzMjIxMjA3WhcNNDgwNzE5MjIxMjA3WjBGMR4wHAYDVQQL
-DBVQb3N0Z3JlU1FMIHRlc3Qgc3VpdGUxJDAiBgNVBAMMG2NvbW1vbi1uYW1lLnBn
-LXNzbHRlc3QudGVzdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANWz
-VPMk7i5f+W0eEadRE+TTAtsIK08CkLMUnjs7zJkxnnm6RGBXPx6vK3AkAIi+wG4Y
-mXjYP3GuMiXaLjnWh2kzBSfIRQyNbTThnhSu3nDjAVkPexsSrPyiKimFuNgDfkGe
-5dQKa9Ag2SuVU4vd9SYxOMAiIFIC4ts4MLWWJf5D/PehdSuc0e5Me+91Nnbz90nl
-ds4lHvuDR+aKnZlTHmch3wfhXv7lNQImIBzfwl36Kd/bWB0fAEVFse3iZWmigaI/
-9FKh//WIq43TNLxn68OCQoyMe/HGjZDR/Xwo3rE6jg6/iAwSWib9yabfYPKbqq2G
-oFy6aYmmEquaDgLuX7kCAwEAATANBgkqhkiG9w0BAQsFAAOCAQEA2AZrD9cTQXTW
-4j2tT8N/TTc6WK2ncN4h22NTte6vK7MVwsZJCtw5ndYkmxcWkXAqiclzWyMdayds
-WOa12CEH7jKAhivF4Hcw3oO3JHM5BA6KzLWBVz9uZksOM6mPqn29DTKvA/Y1V8tj
-mxK/KUA68h/u6inu3mo4ywBpb/tqHxxg2cjyR0faCmM0pwRM0HBr/16fUMfO83nj
-QG8g9J/bybu5sYso/aSoC5nUNp4XjmDMdVLdqg/nTe/ejS8IfFr0WQxBlqooqFgx
-MSE+kX2e2fHsuOWSU/9eClt6FpQrwoC2C8F+/4g1Uz7Liqc4yMHPwjgeP9ewrrLO
-iIhlNNPqpQ==
+Y2VydHMwIBcNMjMwNzEzMTQzNTIzWhgPMjA1MDExMjgxNDM1MjNaMEYxHjAcBgNV
+BAsMFVBvc3RncmVTUUwgdGVzdCBzdWl0ZTEkMCIGA1UEAwwbY29tbW9uLW5hbWUu
+cGctc3NsdGVzdC50ZXN0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
+1bNU8yTuLl/5bR4Rp1ET5NMC2wgrTwKQsxSeOzvMmTGeebpEYFc/Hq8rcCQAiL7A
+bhiZeNg/ca4yJdouOdaHaTMFJ8hFDI1tNOGeFK7ecOMBWQ97GxKs/KIqKYW42AN+
+QZ7l1Apr0CDZK5VTi931JjE4wCIgUgLi2zgwtZYl/kP896F1K5zR7kx773U2dvP3
+SeV2ziUe+4NH5oqdmVMeZyHfB+Fe/uU1AiYgHN/CXfop39tYHR8ARUWx7eJlaaKB
+oj/0UqH/9YirjdM0vGfrw4JCjIx78caNkNH9fCjesTqODr+IDBJaJv3Jpt9g8puq
+rYagXLppiaYSq5oOAu5fuQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQCT3LdsDzwy
+oKaXNuOgtENp4Pp4hLDXeZsepemYss75xfPsXyni9gWVTPIwwzq7NMawtP5q7zzB
+zUMiDgsL9J3d1kDcL0qbJV7xciwCA5D0O1EFKSogJK9jgdupswQZKNrEtM2F68mN
+SJ2aCJtIX/4lZb9KyRli4PDECrFjJM4vDQa9y05O5YY7lohvY5jubAAgexLT/n5r
+oycpw3xNzwGIQ8dAtjvtgONFFKAogWomFaCjWSBPW3ZVz4NM7CryH6oyxkUv/v+q
+/7vUykX0qBn7Vnk3nvVsqrqRRCbYXMz8qgMLeeXi5JjSeWDpYoiblIEfpf3FdtqS
+FnIQVHtAuZHb
-----END CERTIFICATE-----
diff --git a/src/test/ssl/ssl/server-crldir/a836cc2d.r0 b/src/test/ssl/ssl/server-crldir/a836cc2d.r0
index 331a83cb62..7ed68e0220 100644
--- a/src/test/ssl/ssl/server-crldir/a836cc2d.r0
+++ b/src/test/ssl/ssl/server-crldir/a836cc2d.r0
@@ -1,11 +1,11 @@
-----BEGIN X509 CRL-----
-MIIBpTCBjjANBgkqhkiG9w0BAQsFADBCMUAwPgYDVQQDDDdUZXN0IENBIGZvciBQ
-b3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRlc3Qgc2VydmVyIGNlcnRzFw0yMTAz
-MDMyMjEyMDdaFw00ODA3MTkyMjEyMDdaMBswGQIIICEDAxQSBwUXDTIxMDMwMzIy
-MTIwN1owDQYJKoZIhvcNAQELBQADggEBAJxj0taZYIIxUsCuXR5CN2OymjMvRwmV
-+10VOkyBQ3VkzHlXeJkmZsU2Dvmc205l9OYouh/faL0TfK2NyhmBo+MrTizL9TBo
-4u2es/0oJGj2wyNMkRs0SlSJelakvGFBvSKfqoV0l2O1WDV7M4KtdC8ZVZipmL4R
-ac4hBMK0ifHuTS5Od6o0C2RijEPCHMXaS/LkWpBqcStI2oirhjo+Th1wxTMGUVFy
-imVvt6D6QqqHCUYrvcNEN0xBNFwJGq/0cgSy+w5szt/RRehmJKX8MbNeZxrznIIx
-B18ch9rbBltz+Y4R63rCN9MdsnGXf6PQ6a6doZhSI1pnDrui12MOQrU=
+MIIBpzCBkDANBgkqhkiG9w0BAQsFADBCMUAwPgYDVQQDDDdUZXN0IENBIGZvciBQ
+b3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRlc3Qgc2VydmVyIGNlcnRzFw0yMzA3
+MTMxNDM1MjRaGA8yMDUwMTEyODE0MzUyNFowGzAZAgggIwcTFjUjCxcNMjMwNzEz
+MTQzNTI0WjANBgkqhkiG9w0BAQsFAAOCAQEADIkF8oS84O2PJw/C9BAzgrkd+EsO
+QL6mXUGBgXwmujfpv0Z8YK91k4+xV9hQRMjWe/DkU01+gmFhYoDvAzweuNQzx8lZ
+bYKu0dGTEpTd+OG1LbxYmt4f5xh096R5iLo7c7e2kMHvfNG7VwvKQrPeMqh7AcKy
+Fukt8C0Xc7Tfv2l2toEQUAl5UDUKEAovN6iB0qycpvi0nboyiDo8mV0p1jlAn846
+EeXjwm8tyGXzTFq16ypPwnlBM9d5Ml/p5WTN69nDux18G+iSCr+UDzLDYvLF11p3
+lEqpSo5lQg9zYuOgMCvu3g5BtwJgORPSiW/yZ5BXUfWvPi0XRPrknxMByA==
-----END X509 CRL-----
diff --git a/src/test/ssl/ssl/server-ip-alt-names.crt b/src/test/ssl/ssl/server-ip-alt-names.crt
index 8a1bc620bb..3f15775a34 100644
--- a/src/test/ssl/ssl/server-ip-alt-names.crt
+++ b/src/test/ssl/ssl/server-ip-alt-names.crt
@@ -1,19 +1,20 @@
-----BEGIN CERTIFICATE-----
-MIIDCTCCAfGgAwIBAgIIICERKREEUAAwDQYJKoZIhvcNAQELBQAwQjFAMD4GA1UE
+MIIDSzCCAjOgAwIBAgIIICMHExY1IwMwDQYJKoZIhvcNAQELBQAwQjFAMD4GA1UE
Aww3VGVzdCBDQSBmb3IgUG9zdGdyZVNRTCBTU0wgcmVncmVzc2lvbiB0ZXN0IHNl
-cnZlciBjZXJ0czAeFw0yMTExMjkxOTA0NTBaFw00OTA0MTYxOTA0NTBaMCAxHjAc
-BgNVBAsMFVBvc3RncmVTUUwgdGVzdCBzdWl0ZTCCASIwDQYJKoZIhvcNAQEBBQAD
-ggEPADCCAQoCggEBAOM8yB6aVWb17ujr3ayU62mxHQoqn4CvG9yXlJvGOGv/ursW
-Vs0UYJdc96LsNZN1szdm9ayNzCIw3eja+ULsjxCi6+3LM4pO76IORL/XFamlTPYb
-BZ4pHdZVB0nnZAAnWCZPyXdnjOKQ5+8unVXkfibkjj8UELBJ2snehsOa+CTkOBez
-zxYMqxAgbywLIYsW448brun7UXpWmqbGK+SsdGaIZ5Sb7Zezc5lt6CrLemTZTHHK
-7l4WZFCCEi4t3sgO8o1vDELD/IE5G8lyXvIdgJg6t8ssper7iCw6S8x+okhjiSjT
-vDLU2g4AanqZRZB49aPwTo0QUcJA2BCJxL9xLy8CAwEAAaMlMCMwIQYDVR0RBBow
-GIcEwAACAYcQIAENuAAAAAAAAAAAAAAAATANBgkqhkiG9w0BAQsFAAOCAQEAwZJ+
-8KpABTlMEgKnHIYb35ItGhtFiTLQta9RkXx7vaeDwpOdPP/IvuvpjpQZkobRgBsk
-bNM0KuJpd2mSTphQAt6eKQIdcPrkzvc/Yh9OK3YNLUAbu/ZhBUnBvFnUL4wn2f1U
-mfO+m8P/LxybwqKx7r1mbaB+tP3RTxxLcIMvm9ECPQEoBntfEL325Wdoj+WuQH5Y
-IvcM6FaCTkQsNIPbaBD5l5MhMLHRULZujbDjXqGSvRMQfns6np/biMjNdQA8NZ5z
-STeUFvkQbCxoA0YYLgoSHL5KhZjXrg2g+T+2TUyCTR/91xf9OoOjBZdixR0S0DzJ
-B1+5vnUjZaCfnSEA7A==
+cnZlciBjZXJ0czAgFw0yMzA3MTMxNDM1MjNaGA8yMDUwMTEyODE0MzUyM1owIDEe
+MBwGA1UECwwVUG9zdGdyZVNRTCB0ZXN0IHN1aXRlMIIBIjANBgkqhkiG9w0BAQEF
+AAOCAQ8AMIIBCgKCAQEA4zzIHppVZvXu6OvdrJTrabEdCiqfgK8b3JeUm8Y4a/+6
+uxZWzRRgl1z3ouw1k3WzN2b1rI3MIjDd6Nr5QuyPEKLr7cszik7vog5Ev9cVqaVM
+9hsFnikd1lUHSedkACdYJk/Jd2eM4pDn7y6dVeR+JuSOPxQQsEnayd6Gw5r4JOQ4
+F7PPFgyrECBvLAshixbjjxuu6ftRelaapsYr5Kx0ZohnlJvtl7NzmW3oKst6ZNlM
+ccruXhZkUIISLi3eyA7yjW8MQsP8gTkbyXJe8h2AmDq3yyyl6vuILDpLzH6iSGOJ
+KNO8MtTaDgBqeplFkHj1o/BOjRBRwkDYEInEv3EvLwIDAQABo2UwYzAhBgNVHREE
+GjAYhwTAAAIBhxAgAQ24AAAAAAAAAAAAAAABMB0GA1UdDgQWBBSZsk0rfkcawCvx
+XxCfQdMrWBIAVTAfBgNVHSMEGDAWgBTyjzpmQFBkSCLXLoL/Vp7Cs+50CjANBgkq
+hkiG9w0BAQsFAAOCAQEAHtiw75o40lNQJPmdNJ0GijokFQ80AB9Cq1h3IAE7g9X4
+S5EQ+xukQoEcDwqi3PYN2axHayE3qgYpD4burydxboNFeDSl06Sv+g3KQ57Uv76y
+ODFOElKwedkdfgxVrBNX2kVR1gacQHrMqGN7aBSwZ8wReLS4keYtDo/Bfd9cyaBF
+g3CuPCa7u7ZB9S+g8bRE1L0rktQ9viynMI5G1hgFqm+aXMBpWrQj566z8qMRDN0a
+qk6gHxfXFy9NJorUxfHOTcrrKA2YciGHFUdRZT6zX4Nt8RjTWK6Oxro4G6UqAH+2
+g65OIDeyMwi+UUnDzMQPJoI20jZpBms9670yrlZDqg==
-----END CERTIFICATE-----
diff --git a/src/test/ssl/ssl/server-ip-cn-and-alt-names.crt b/src/test/ssl/ssl/server-ip-cn-and-alt-names.crt
index 2be02feb03..cbf79b9112 100644
--- a/src/test/ssl/ssl/server-ip-cn-and-alt-names.crt
+++ b/src/test/ssl/ssl/server-ip-cn-and-alt-names.crt
@@ -1,19 +1,21 @@
-----BEGIN CERTIFICATE-----
-MIIDHTCCAgWgAwIBAgIIICIBBBQ2MQAwDQYJKoZIhvcNAQELBQAwQjFAMD4GA1UE
+MIIDXzCCAkegAwIBAgIIICMHExY1IwUwDQYJKoZIhvcNAQELBQAwQjFAMD4GA1UE
Aww3VGVzdCBDQSBmb3IgUG9zdGdyZVNRTCBTU0wgcmVncmVzc2lvbiB0ZXN0IHNl
-cnZlciBjZXJ0czAeFw0yMjAxMDQyMjM2MzFaFw00OTA1MjIyMjM2MzFaMDQxHjAc
-BgNVBAsMFVBvc3RncmVTUUwgdGVzdCBzdWl0ZTESMBAGA1UEAwwJMTkyLjAuMi4x
-MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwmqTdQJfs2Ti9tPitYp2
-27I0HvL/kNSgA6egFr0foRo0BorwJNIzdbV0+EnsfiBNTWL5It26gqO7UP3ms8t2
-vHD5gkXfT+f6ts0lVJEcIOkUD/8ws4Ic9Y4uPqb4gN+pUKqcxtmLW1TYk84MBK59
-Xz4yPPS6N+G/DMMeFHTNkM9EQwn/+DC3fDsWdGYM2GRWDTJGg1A5tSUcF+seu7i1
-Vg7XajBfsvgAUAsrAxV+X/sLZh94HY+paD6wfaI99mY2OXVc/XW/z1r9WQznor65
-ZkonNCaPfavqPG5vqnab9AyQcqPqmX8hf/xrniASBAkqNCctbASrFCIYvCJfGfmX
-EQIDAQABoyUwIzAhBgNVHREEGjAYhwTAAAIChxAgAQ24AAAAAAAAAAAAAAABMA0G
-CSqGSIb3DQEBCwUAA4IBAQBf7kmYfRYfnWk1OUfY3N1kaNg9piBBlFr9g+OQn9KU
-zirkN7s0ZQbCGxV1uJQBKS58NyE414Vorau77379emgYDcCBpDIYpkLiNujVrIOr
-ggRFKsFRgxu4/mw0BSgCcV8RPe9SWHZ90Mos7TMCnW/PdxOCD1wD0YMkcs0rwB3l
-0Kzc7jDnfOEvmgw/Ysm7v67ps+05Uq5VskQ6WrpSAw6kPD/QMuuBAX8ATPczIaox
-zAMyncq1IiSIwG93f3EoQQThdQ70C6G9vLcu9TtL6JAsEMFEzR99gt1Wsqvmgl9W
-kStzj1yjIWeo5gIsa4Jgcke1lZviWyrTxHDfyunYE5i5
+cnZlciBjZXJ0czAgFw0yMzA3MTMxNDM1MjRaGA8yMDUwMTEyODE0MzUyNFowNDEe
+MBwGA1UECwwVUG9zdGdyZVNRTCB0ZXN0IHN1aXRlMRIwEAYDVQQDDAkxOTIuMC4y
+LjEwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDCapN1Al+zZOL20+K1
+inbbsjQe8v+Q1KADp6AWvR+hGjQGivAk0jN1tXT4Sex+IE1NYvki3bqCo7tQ/eaz
+y3a8cPmCRd9P5/q2zSVUkRwg6RQP/zCzghz1ji4+pviA36lQqpzG2YtbVNiTzgwE
+rn1fPjI89Lo34b8Mwx4UdM2Qz0RDCf/4MLd8OxZ0ZgzYZFYNMkaDUDm1JRwX6x67
+uLVWDtdqMF+y+ABQCysDFX5f+wtmH3gdj6loPrB9oj32ZjY5dVz9db/PWv1ZDOei
+vrlmSic0Jo99q+o8bm+qdpv0DJByo+qZfyF//GueIBIECSo0Jy1sBKsUIhi8Il8Z
++ZcRAgMBAAGjZTBjMCEGA1UdEQQaMBiHBMAAAgKHECABDbgAAAAAAAAAAAAAAAEw
+HQYDVR0OBBYEFGX9z+RX7x23a5ViEQbcj5XBGHaZMB8GA1UdIwQYMBaAFPKPOmZA
+UGRIItcugv9WnsKz7nQKMA0GCSqGSIb3DQEBCwUAA4IBAQCQQ+5/h6r84jks/l5u
+0G6w07hcgo/AfPEVSqGXDlEiJEdP8IownmxPB5siRwq6FNHqVMQ6usFeTlfYqtzE
+OmQOagLyKAhYCQkVPUIpIKLj70o8DVqnwoxr1+kWZUi4xLPTYPawFHUem7cX6TuT
+7TQe2yCXPHf8GaIMRjNI1LSpT5DUxHXZinw6UnsHr5EotFTSzmS/Yfko881+WDBq
+Uv/AOReEwLUvaRBTbWmIxyN7y6S8BUzlDw6AvSZLVczuQ1qLbFAc/fjdkiyCos2J
+r8FOq7UnBrvbs7/mT/1AtAcHjShPYGH3JFIgvHfixrJlsdS85f3GA9tJgJ9BV16d
+qkjO
-----END CERTIFICATE-----
diff --git a/src/test/ssl/ssl/server-ip-cn-and-dns-alt-names.crt b/src/test/ssl/ssl/server-ip-cn-and-dns-alt-names.crt
index 23c06da01c..b51dab2963 100644
--- a/src/test/ssl/ssl/server-ip-cn-and-dns-alt-names.crt
+++ b/src/test/ssl/ssl/server-ip-cn-and-dns-alt-names.crt
@@ -1,20 +1,21 @@
-----BEGIN CERTIFICATE-----
-MIIDQzCCAiugAwIBAgIIICIBBBQ2MQEwDQYJKoZIhvcNAQELBQAwQjFAMD4GA1UE
+MIIDhzCCAm+gAwIBAgIIICMHExY1IwYwDQYJKoZIhvcNAQELBQAwQjFAMD4GA1UE
Aww3VGVzdCBDQSBmb3IgUG9zdGdyZVNRTCBTU0wgcmVncmVzc2lvbiB0ZXN0IHNl
-cnZlciBjZXJ0czAeFw0yMjAxMDQyMjM2MzFaFw00OTA1MjIyMjM2MzFaMDQxHjAc
-BgNVBAsMFVBvc3RncmVTUUwgdGVzdCBzdWl0ZTESMBAGA1UEAwwJMTkyLjAuMi4x
-MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA8xddbo/x2TOSIa/br8BN
-o/URdTr9+l2R5YojiZKDuLxiQVkgC30PJ2/CNFKIh2nHhRrzknI6sETVtrxZ+9V2
-qRc1yShVu462u0DHPRMIZnZIOZg3hlNB0cRWbOglUKlttIARNEQUcTUyPOtyo4/v
-+u0Ej5NTNcHFbFT01vdD9MjQiCO3jKdAwPIb14jTg4C71EpZ+LuelDo4DzF2/XgG
-WqUTrgD/XnBU/60PU9Iy3G0nVpx21q6ppn9G7a9R+i8FjBcwW1T+cfsBDWhAv+bi
-RmSAkENf8L8TwOlDQUwROkfz3Hz36vuJjdkreQJsiqL0HnrnH5T5G9UzJO86FvZQ
-5wIDAQABo0swSTBHBgNVHREEQDA+gh1kbnMxLmFsdC1uYW1lLnBnLXNzbHRlc3Qu
-dGVzdIIdZG5zMi5hbHQtbmFtZS5wZy1zc2x0ZXN0LnRlc3QwDQYJKoZIhvcNAQEL
-BQADggEBAF+mfaw6iBPzpCgqq830pHRa3Yzm1aezt8SkeRohUYHNv/yCnDSRaqtj
-xbENih3lJMSTBL3g0wtTOHfH8ViC/h+lvYELHzXKic7gkjV7H5XETKGr0ZsjBBT2
-4cZQKbD9e0x0HrENXMYgGpBf747qL6uTOVJdG0s15hwpLq47bY5WUjXathejbpxW
-prmF8F+xaC52N9P/1VnqguQB909F4x1pyOK7D7tjFu+Y8Je7PHKbb6WY5K6xAv6t
-R17CY0749/FotlphquElUR2bs5Zzv5YrjUHPTcbwKvcH5cdNi93/u6NJt2xNAoYf
-aZERhX5TA9DYk4gC8OY0yGaYCIj3Dd4=
+cnZlciBjZXJ0czAgFw0yMzA3MTMxNDM1MjRaGA8yMDUwMTEyODE0MzUyNFowNDEe
+MBwGA1UECwwVUG9zdGdyZVNRTCB0ZXN0IHN1aXRlMRIwEAYDVQQDDAkxOTIuMC4y
+LjEwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDzF11uj/HZM5Ihr9uv
+wE2j9RF1Ov36XZHliiOJkoO4vGJBWSALfQ8nb8I0UoiHaceFGvOScjqwRNW2vFn7
+1XapFzXJKFW7jra7QMc9Ewhmdkg5mDeGU0HRxFZs6CVQqW20gBE0RBRxNTI863Kj
+j+/67QSPk1M1wcVsVPTW90P0yNCII7eMp0DA8hvXiNODgLvUSln4u56UOjgPMXb9
+eAZapROuAP9ecFT/rQ9T0jLcbSdWnHbWrqmmf0btr1H6LwWMFzBbVP5x+wENaEC/
+5uJGZICQQ1/wvxPA6UNBTBE6R/PcfPfq+4mN2St5AmyKovQeeucflPkb1TMk7zoW
+9lDnAgMBAAGjgYwwgYkwRwYDVR0RBEAwPoIdZG5zMS5hbHQtbmFtZS5wZy1zc2x0
+ZXN0LnRlc3SCHWRuczIuYWx0LW5hbWUucGctc3NsdGVzdC50ZXN0MB0GA1UdDgQW
+BBSAWxUeTAXIo1H+cmx5bW0UJrPWlDAfBgNVHSMEGDAWgBTyjzpmQFBkSCLXLoL/
+Vp7Cs+50CjANBgkqhkiG9w0BAQsFAAOCAQEAoFdBPGtQA1y8lVAK3aFMyczeFwmS
+Bh+gIEyYpzWEUCgLManf6MnVpR1lG2nPasHawlHD0vmNBNuKHaKwtvXanNlnhK60
+mSyVx2tRVtygs+fCFykS3Oy0GlBWdoONyZWmwV97+Jpq7F2tb3fqCehy0HWFKruG
+JfVFBfVtPOdEgrla6ExuVcitDGNjKe6O1Kvt5m2Ze5+tX/rBJcSL9vfh/pa/qM4B
+lukCT9RwNNfUgNKIC0Tq13sNUeo7Fz3td46ZFOviBMv5ywH/7OE9eYNRvXwd/brH
+xNiRiUwBiUMvae38Tm4E8bFT6N/pmRVXAk4v84Eo/hxFIogT531JNaQhYA==
-----END CERTIFICATE-----
diff --git a/src/test/ssl/ssl/server-ip-cn-only.crt b/src/test/ssl/ssl/server-ip-cn-only.crt
index 9bf015cf18..8b15358577 100644
--- a/src/test/ssl/ssl/server-ip-cn-only.crt
+++ b/src/test/ssl/ssl/server-ip-cn-only.crt
@@ -1,18 +1,18 @@
-----BEGIN CERTIFICATE-----
-MIIC8TCCAdkCCCAhESkRN1IAMA0GCSqGSIb3DQEBCwUAMEIxQDA+BgNVBAMMN1Rl
+MIIC8zCCAdsCCCAjBxMWNSMEMA0GCSqGSIb3DQEBCwUAMEIxQDA+BgNVBAMMN1Rl
c3QgQ0EgZm9yIFBvc3RncmVTUUwgU1NMIHJlZ3Jlc3Npb24gdGVzdCBzZXJ2ZXIg
-Y2VydHMwHhcNMjExMTI5MTkzNzUyWhcNNDkwNDE2MTkzNzUyWjA0MR4wHAYDVQQL
-DBVQb3N0Z3JlU1FMIHRlc3Qgc3VpdGUxEjAQBgNVBAMMCTE5Mi4wLjIuMTCCASIw
-DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANWs1uUL71nHYF9Zj6p+M3MpYDvx
-32iCjVdtH5a2qpSWHXTg0rR8dLX0y92cvOYvMXHRajZT1avpHr8dooPYSVaXpGMK
-NvF/Qi+WFYovRbP2vmd1yv1cgW/FggbwJFWVobizIz4seyA4d0B2j9fqoi2OFBNP
-huW664SjF0u3p21tDy+43i2LNUMAKf6dnRR5Vqenath87LEU41tSLudu6NXgbFMk
-jvfNkl4d0w7YCzeXmklmSI+uaX3PlJJ4NzQO2j8w5BvnKVhNVD0KjgrXZ6nB/8F7
-Pg3XY+d7rJlwRgXemU6resWQDJ7+UaC9u7I4EIP+9lzCR/nNBqUktpHRmHUCAwEA
-ATANBgkqhkiG9w0BAQsFAAOCAQEAos1JncV8Yf4UaKl6h1GdYtcVtzFyJvBEnhRD
-07ldL+TYnfZiX8wK2ssBtM3cg/C78y5bzdUa5XGS83ZKQJFFdhE7PSnrvyNqyIqY
-ZgNBxto3gyvir+EjO1u9BAB0NP3r3gYoHRDZS1xOPPzt4WgjuUgTLM9k82GsqAbO
-UrOTOdRnkIqC5xLpa05EnRyJPRsR1w1PRJC2XXKnHIuFjMb4v7UuPwyCcX1P5ioc
-rQszQcORy/L+k0ezCkyweORg68htjYbBHuwOuiGfok6yKKDMzrTvD3lIslls6eX7
-4sI3XWqzkPmG9Vsxm9Vu9/Ma+PRO76VyCoIwBd+Ufg5vNXhMmw==
+Y2VydHMwIBcNMjMwNzEzMTQzNTI0WhgPMjA1MDExMjgxNDM1MjRaMDQxHjAcBgNV
+BAsMFVBvc3RncmVTUUwgdGVzdCBzdWl0ZTESMBAGA1UEAwwJMTkyLjAuMi4xMIIB
+IjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1azW5QvvWcdgX1mPqn4zcylg
+O/HfaIKNV20flraqlJYddODStHx0tfTL3Zy85i8xcdFqNlPVq+kevx2ig9hJVpek
+Ywo28X9CL5YVii9Fs/a+Z3XK/VyBb8WCBvAkVZWhuLMjPix7IDh3QHaP1+qiLY4U
+E0+G5brrhKMXS7enbW0PL7jeLYs1QwAp/p2dFHlWp6dq2HzssRTjW1Iu527o1eBs
+UySO982SXh3TDtgLN5eaSWZIj65pfc+Ukng3NA7aPzDkG+cpWE1UPQqOCtdnqcH/
+wXs+Dddj53usmXBGBd6ZTqt6xZAMnv5RoL27sjgQg/72XMJH+c0GpSS2kdGYdQID
+AQABMA0GCSqGSIb3DQEBCwUAA4IBAQB2VbIjlzU7ieisvO3ZCGMJmCmQtEDC8Xgo
+umbbHtCdCYtPy8KSulAKBzLLBpVsQiOqq6T8t3KZrU64Wi2DEamULfYfgZCdatQw
+EWzBmTOO+5guo3ntm57+3kR9pRbTDbLUgOrgJrKnu1THof+6gwX6e0D++91mfwpm
+FLhn4bIuRyQtlqH7Ft0otsA4HezoHDLGTS76NDYpx+rDklFE6ZUk3RFgC7ScXPfW
+rA+KJIATgnrDwBx+n8s1SeZ7S64QkZk27QVi/8exYbd6aJwWBTuoHXZswfn5nK/b
+PFR7RK0LgucLvOKjUTzNPZUyhjS+b2dSnPZUuWNTFFu5KhnfoPEZ
-----END CERTIFICATE-----
diff --git a/src/test/ssl/ssl/server-ip-in-dnsname.crt b/src/test/ssl/ssl/server-ip-in-dnsname.crt
index 78ad8d99c8..87009ebd2c 100644
--- a/src/test/ssl/ssl/server-ip-in-dnsname.crt
+++ b/src/test/ssl/ssl/server-ip-in-dnsname.crt
@@ -1,18 +1,20 @@
-----BEGIN CERTIFICATE-----
-MIIC/DCCAeSgAwIBAgIIICIDFRVYUgAwDQYJKoZIhvcNAQELBQAwQjFAMD4GA1UE
+MIIDPjCCAiagAwIBAgIIICMHExY1IwcwDQYJKoZIhvcNAQELBQAwQjFAMD4GA1UE
Aww3VGVzdCBDQSBmb3IgUG9zdGdyZVNRTCBTU0wgcmVncmVzc2lvbiB0ZXN0IHNl
-cnZlciBjZXJ0czAeFw0yMjAzMTUyMjU4NTJaFw00OTA3MzEyMjU4NTJaMCAxHjAc
-BgNVBAsMFVBvc3RncmVTUUwgdGVzdCBzdWl0ZTCCASIwDQYJKoZIhvcNAQEBBQAD
-ggEPADCCAQoCggEBAMpn5bP1/OfBQR/yvOkOBzxArE1j1YShVa2pcj896+CVDEgV
-N5Hluz7KHU/JYzNZCAHb5WAHuvXxKeoj4Ti5be1KsqO0mN1p+RMN7VlCpCpb0AWT
-z4z+I8TUhSZnmgghHvfW4RfcZMCcHq1vevVTDxR/cAbDPYpgBCD5F/SZMRyMDw5B
-7ILLmft0eqA1nCqavyqBCGZvx1ol8N5BfVdrDXp/rN5997khBWQRZ8g84FZyFZXf
-pwp57eu0OGQDzZFXoEL2t4OVld67K5jcclWVxHY6FGcHjCvyqs48PCPOR84anZwj
-GsqVOS6250/DWKBQO4KyhkTVf0AW/ICGSMOKkAkCAwEAAaMYMBYwFAYDVR0RBA0w
-C4IJMTkyLjAuMi4xMA0GCSqGSIb3DQEBCwUAA4IBAQDIAAH0WJKEpbPN0QihN6SF
-UA5WL4ixsBACo9OIAGkSnKeOeVEG5vvgOna0hjQcOcgtI1oCDLhULcjCuwxiIW6y
-QntOazyo0sooJr0hEm2WfipvIpQs6W9E1OTcs624BAVfkAwr6WT2VwoIAPcQD2nR
-tIQhSUIR9J7Q5WbzuQw7pthQhBfW/UPWw7vajel0r1dflbe0Cgp5WGNfp1kYy+Qf
-XW/YjkstZEP1KFm+TF58uxrIDmYboS8EerUREGQixijbI0AfXjShxtiyS63rbdpo
-3C0BPj9Yx2VtWi4U0qoef/iLJxJBCLvE/97+duPdKx0AkkOWA9VuenkWLp797UM8
+cnZlciBjZXJ0czAgFw0yMzA3MTMxNDM1MjRaGA8yMDUwMTEyODE0MzUyNFowIDEe
+MBwGA1UECwwVUG9zdGdyZVNRTCB0ZXN0IHN1aXRlMIIBIjANBgkqhkiG9w0BAQEF
+AAOCAQ8AMIIBCgKCAQEAymfls/X858FBH/K86Q4HPECsTWPVhKFVralyPz3r4JUM
+SBU3keW7PsodT8ljM1kIAdvlYAe69fEp6iPhOLlt7Uqyo7SY3Wn5Ew3tWUKkKlvQ
+BZPPjP4jxNSFJmeaCCEe99bhF9xkwJwerW969VMPFH9wBsM9imAEIPkX9JkxHIwP
+DkHsgsuZ+3R6oDWcKpq/KoEIZm/HWiXw3kF9V2sNen+s3n33uSEFZBFnyDzgVnIV
+ld+nCnnt67Q4ZAPNkVegQva3g5WV3rsrmNxyVZXEdjoUZweMK/Kqzjw8I85Hzhqd
+nCMaypU5LrbnT8NYoFA7grKGRNV/QBb8gIZIw4qQCQIDAQABo1gwVjAUBgNVHREE
+DTALggkxOTIuMC4yLjEwHQYDVR0OBBYEFDGGF+fm5mk/sd23jkLL3uVU0NjCMB8G
+A1UdIwQYMBaAFPKPOmZAUGRIItcugv9WnsKz7nQKMA0GCSqGSIb3DQEBCwUAA4IB
+AQCf8knuWhoBZ8psmq+NC/RZRxfQmFBRj+bKzJ6YaAHyNmE44nBtIAJal3m4FyTZ
+vXAlYpfRLrF+R5PJVnvT8mfu/vfxJn3MPHV7R8vmJpRAx8uQKFuxQPQDUq84efqZ
+BHG0zoNPml915nVfxgt1WqIVWQpomAOvjb1Ct31A1bZF5oMjhg86XdytqQNohl8I
+NBNu027tO0izM/mX3xJzYEnBSiHwKPfZxSKtc0FSffwohWUlpEye1A4Q9d6tWF6d
++PagUG+hodSLsU5Bno4dc0RYJr9xJLW9QMcuCbMC9zXaUBWpkUwOWbMXpPhvawdu
+oR2Tvhha37JD6a8NEUgSJOvL
-----END CERTIFICATE-----
diff --git a/src/test/ssl/ssl/server-multiple-alt-names.crt b/src/test/ssl/ssl/server-multiple-alt-names.crt
index 58799e49f8..85663b97af 100644
--- a/src/test/ssl/ssl/server-multiple-alt-names.crt
+++ b/src/test/ssl/ssl/server-multiple-alt-names.crt
@@ -1,20 +1,22 @@
-----BEGIN CERTIFICATE-----
-MIIDSzCCAjOgAwIBAgIIICEDAxQSBwMwDQYJKoZIhvcNAQELBQAwQjFAMD4GA1UE
+MIIDjzCCAnegAwIBAgIIICMHExY1IwkwDQYJKoZIhvcNAQELBQAwQjFAMD4GA1UE
Aww3VGVzdCBDQSBmb3IgUG9zdGdyZVNRTCBTU0wgcmVncmVzc2lvbiB0ZXN0IHNl
-cnZlciBjZXJ0czAeFw0yMTAzMDMyMjEyMDdaFw00ODA3MTkyMjEyMDdaMCAxHjAc
-BgNVBAsMFVBvc3RncmVTUUwgdGVzdCBzdWl0ZTCCASIwDQYJKoZIhvcNAQEBBQAD
-ggEPADCCAQoCggEBANdIkKX1X+Jwqo5EXC1z/TjUKnYTDzHYx2rCqprBU8fN0mSy
-lMyjDm+eo924PN7LahqCHeDCMbapwymkoNfpLHkNRwotHLvxN5RyxJD4m5fXclRo
-V1ZzwwXTqXlECwrzzYGst/7muDM9DX+0vXIAvQGbvxBGI0CBM3ztHBADXlSFrYGX
-zN/to9KZmeOgBGJRGSZJg09P5px5N2E49yOqkIa9+MGb6nK8KLmETeTYjlWCS6W+
-oD0qGpZvj2Fzioz+Pn1q9fB3WS687GuMT0WvV3LAzcn341r0E36bUf9rxSjfBX79
-11KsVMemr1QskSmvMQFEv6R1Rp8xUGPqKlkRJ9sCAwEAAaNnMGUwYwYDVR0RBFww
-WoIdZG5zMS5hbHQtbmFtZS5wZy1zc2x0ZXN0LnRlc3SCHWRuczIuYWx0LW5hbWUu
-cGctc3NsdGVzdC50ZXN0ghoqLndpbGRjYXJkLnBnLXNzbHRlc3QudGVzdDANBgkq
-hkiG9w0BAQsFAAOCAQEAuRAyYBwAZLKERoYDy/kE9LKddJfLhledTJ7+cIWs6T9V
-KBfWBHZYxfxmdBYwqVZfog8c5uHREfWiUPoF/aMq3ARay96aMh4xXJ+2a7HAmknF
-9AJWRieoc3H/QkMzAuT8IDTmoEarsr8vsX1MGabobZte/B9tEjq/z5t3GfLrHMVX
-5092U6Ka40ii4U1VwjR8YnRBwjm3UpLmZJAjvXjw13/XucNV5O8Plo1yvS+G0AMh
-KdMxExiItVtjZteiA0pJf0YGAzTFyzvwBljTcs4NfZ2M0ta9i0r4BF7wQ8tDezN7
-VxdJVPc5xPqncp0cMdUAE2xDmYlKEqB0kuAHNwH5/Q==
+cnZlciBjZXJ0czAgFw0yMzA3MTMxNDM1MjRaGA8yMDUwMTEyODE0MzUyNFowIDEe
+MBwGA1UECwwVUG9zdGdyZVNRTCB0ZXN0IHN1aXRlMIIBIjANBgkqhkiG9w0BAQEF
+AAOCAQ8AMIIBCgKCAQEA10iQpfVf4nCqjkRcLXP9ONQqdhMPMdjHasKqmsFTx83S
+ZLKUzKMOb56j3bg83stqGoId4MIxtqnDKaSg1+kseQ1HCi0cu/E3lHLEkPibl9dy
+VGhXVnPDBdOpeUQLCvPNgay3/ua4Mz0Nf7S9cgC9AZu/EEYjQIEzfO0cEANeVIWt
+gZfM3+2j0pmZ46AEYlEZJkmDT0/mnHk3YTj3I6qQhr34wZvqcrwouYRN5NiOVYJL
+pb6gPSoalm+PYXOKjP4+fWr18HdZLrzsa4xPRa9XcsDNyffjWvQTfptR/2vFKN8F
+fv3XUqxUx6avVCyRKa8xAUS/pHVGnzFQY+oqWREn2wIDAQABo4GoMIGlMGMGA1Ud
+EQRcMFqCHWRuczEuYWx0LW5hbWUucGctc3NsdGVzdC50ZXN0gh1kbnMyLmFsdC1u
+YW1lLnBnLXNzbHRlc3QudGVzdIIaKi53aWxkY2FyZC5wZy1zc2x0ZXN0LnRlc3Qw
+HQYDVR0OBBYEFNQECIqqAsJFZk9MZ3oygGNRbziXMB8GA1UdIwQYMBaAFPKPOmZA
+UGRIItcugv9WnsKz7nQKMA0GCSqGSIb3DQEBCwUAA4IBAQDOljab+EBwmJA4qzN4
+nY3QVQWxoPG7RBrNFRp2hrP05amitsjWG4+GWiIlKT7aSpEgUghdZgAb25FG44VH
+oUEo2aAJjTRGmssbeOUstDRXYCIOefaaxSleEgbZdrUb+zDkPwDw381EYuO/E+og
+OcS9nsbrq1vo1B09xQdpcJ6pf9VmmM4OQHpD2/xPxhOPVxMKhbrFvVOlHDc23sue
+kfaAnHFu3k5O2/fqGxWm7IQA8KNfhyWRDDZjwU3F+duqiHphGDyn0JH6bO+QNSEs
+kj7tCGh9oziomt/mnD1zDPO+s9f5+i9itk8emRaBakLsv7SyngO777r79myiiM+E
+LYJo
-----END CERTIFICATE-----
diff --git a/src/test/ssl/ssl/server-no-names.crt b/src/test/ssl/ssl/server-no-names.crt
index b5d0589090..45a434bcf1 100644
--- a/src/test/ssl/ssl/server-no-names.crt
+++ b/src/test/ssl/ssl/server-no-names.crt
@@ -1,18 +1,18 @@
-----BEGIN CERTIFICATE-----
-MIIC3TCCAcUCCCAhAwMUEgcEMA0GCSqGSIb3DQEBCwUAMEIxQDA+BgNVBAMMN1Rl
+MIIC3zCCAccCCCAjBxMWNSMKMA0GCSqGSIb3DQEBCwUAMEIxQDA+BgNVBAMMN1Rl
c3QgQ0EgZm9yIFBvc3RncmVTUUwgU1NMIHJlZ3Jlc3Npb24gdGVzdCBzZXJ2ZXIg
-Y2VydHMwHhcNMjEwMzAzMjIxMjA3WhcNNDgwNzE5MjIxMjA3WjAgMR4wHAYDVQQL
-DBVQb3N0Z3JlU1FMIHRlc3Qgc3VpdGUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
-ggEKAoIBAQCfOf74edog2QHkJlreO6NJEe1VZUSxn+LBeHH8T5fniFiM4Ym9X2o3
-XKhYsvNSwvrfWwMkajMkd3b3vURiuiAxYzB/9AwX97RUkZ8TfuU3UgISiCbJZrVH
-TpfJEv7JhePgYpAoOdPWqtFPmnO/Xv6uNjsrx/V/3COovUj3eIcyQzAl+eC2U9Tn
-//dJ0kF+hDnOR3I/3e6bAboJjAVvLl2ABryaateHuUaCu/Bf5mG1DarXNXPKYuP+
-KrkjHhH0KQ4Js3nu7bPEiG0E/JmCR452j72WKb+PiJHOxdMMyztZ3k6bGGlbw60j
-CwQnUJAlPL4G9U+lpVYG6f7HxOaJEscfAgMBAAEwDQYJKoZIhvcNAQELBQADggEB
-AJAwYwIL4oj3NisXCXkEp9zqDXiZvNW9yW3bY8lFFCpU7o5n92tCf2OFAkKaYhF1
-Eb2weyDULtW7W/wgdlOZL9npayYKzTusl6e8xfTQyjRCsoKWvnWOEkPH7VraZJ8c
-Ko1KhaVWX98VLdlUh5giYAEkdhk0qPYKsQ32unBXXJu0pX63pnPDoaUBiZUWr/3l
-CfkjgGY5YA8YxiDlHGNF1qlcX2fQKloDlvtH0L5Enwt25w2/IvWhTN6YxDR+rgdD
-XYbQr6o6vsmnZTJ3zUZ6XFo98sZq5L9oy1pcC8roV7w0AUVxraTWYILyGfNgruG8
-xsok/hu1L2VnktveEW/qoVs=
+Y2VydHMwIBcNMjMwNzEzMTQzNTI0WhgPMjA1MDExMjgxNDM1MjRaMCAxHjAcBgNV
+BAsMFVBvc3RncmVTUUwgdGVzdCBzdWl0ZTCCASIwDQYJKoZIhvcNAQEBBQADggEP
+ADCCAQoCggEBAJ85/vh52iDZAeQmWt47o0kR7VVlRLGf4sF4cfxPl+eIWIzhib1f
+ajdcqFiy81LC+t9bAyRqMyR3dve9RGK6IDFjMH/0DBf3tFSRnxN+5TdSAhKIJslm
+tUdOl8kS/smF4+BikCg509aq0U+ac79e/q42OyvH9X/cI6i9SPd4hzJDMCX54LZT
+1Of/90nSQX6EOc5Hcj/d7psBugmMBW8uXYAGvJpq14e5RoK78F/mYbUNqtc1c8pi
+4/4quSMeEfQpDgmzee7ts8SIbQT8mYJHjnaPvZYpv4+Ikc7F0wzLO1neTpsYaVvD
+rSMLBCdQkCU8vgb1T6WlVgbp/sfE5okSxx8CAwEAATANBgkqhkiG9w0BAQsFAAOC
+AQEA1w+EnZ8ef189KqulzF9vrKjdavlFyWon+otR0WAKFOojNMyIgAkbU69N0CHO
+LnJPiIF3H3izWelNo+2Wv3BxylQXgRlr92gUCFoEQ/RKnZVjgKl36e2+l/AVud1Q
+ke343xnYLup/jQ7LzKFIdyxmO090rrlHUO7Dg7bJAuHQ9bRbCO+orAg4nFZEoKd1
+kO/XQ7e18l95QJE6vOmRcbD0+kGRNYBA2v6K3DwX0PRUm7fyP1gLTbIt6jGukQiJ
+/ZkcvVcHNkcJzEr+A8BGVYgTG6VhuBPSMWVnnZcui93vH2D/3hq7ILNlFWBycSW6
+HheriPQ4X+y96SmttrjQVwSDYA==
-----END CERTIFICATE-----
diff --git a/src/test/ssl/ssl/server-revoked.crt b/src/test/ssl/ssl/server-revoked.crt
index 3bb0f164a6..ce4350dbc6 100644
--- a/src/test/ssl/ssl/server-revoked.crt
+++ b/src/test/ssl/ssl/server-revoked.crt
@@ -1,19 +1,19 @@
-----BEGIN CERTIFICATE-----
-MIIDAzCCAesCCCAhAwMUEgcFMA0GCSqGSIb3DQEBCwUAMEIxQDA+BgNVBAMMN1Rl
+MIIDBTCCAe0CCCAjBxMWNSMLMA0GCSqGSIb3DQEBCwUAMEIxQDA+BgNVBAMMN1Rl
c3QgQ0EgZm9yIFBvc3RncmVTUUwgU1NMIHJlZ3Jlc3Npb24gdGVzdCBzZXJ2ZXIg
-Y2VydHMwHhcNMjEwMzAzMjIxMjA3WhcNNDgwNzE5MjIxMjA3WjBGMR4wHAYDVQQL
-DBVQb3N0Z3JlU1FMIHRlc3Qgc3VpdGUxJDAiBgNVBAMMG2NvbW1vbi1uYW1lLnBn
-LXNzbHRlc3QudGVzdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKKD
-zvJUs+N+KeDwWAW0zfI5C1t3BxKUwh+MrwtFeNIcxhJd9Bzy6fNnvpMa/kNPoHfN
-n73OGLYeSDyiDc56dvBjLOfxPXFFN4TCuIxYSizIjniL3tzP/a8hyvO+KqTYyaEs
-cT8+/rNnqlqBXNqcdChSGpk0y34uybvWj2/wDJWTbFJ20bI+30HOxCfK8Dp3s8Nl
-suVSuLKF/qqbidDZuOAKc0/GJo2F/5AF9MkMYELmG6XAVq/XDkI3oLtxQKh6kYfc
-nu3fI0Mwr9+FoP2q+K5KskA3KJLlgBOykG55Odbe6Js4TPHrMBTgC9aWrP/I1gb8
-tFY2FVN+D/Wl8T/Boh0CAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAxVHoqX25W4Hx
-pMNjv2AJzcB7D+c+dUXAmLLJ7jh6szWeL0M2E5qX4dLc8LzQKnXv5ZcT4i/akjDX
-etdzuqh03kvDJvUkHclSWffmowmWMTG6GCA6S/2TQzSibIptkwqs74aIkayVJaC4
-jCBR+PVT8+cE2FMD6dAWu//fyEcpTg6XpZ/Upgu9OITGNaEQUGz8pSRkTgspfO0Q
-AKPmql6dpywReIlr5mzy9liCzf/BbAVHGmP/pBGIkLn2AzvPLCQ/UFZYT6aH7l5J
-nzmFhgRC3U5wPMdelHGrPMXg6OHCcyrQY0kEi7N/GQ5+jZkICoQuPJ7APKEZAUgO
-XRwVulaWJQ==
+Y2VydHMwIBcNMjMwNzEzMTQzNTI0WhgPMjA1MDExMjgxNDM1MjRaMEYxHjAcBgNV
+BAsMFVBvc3RncmVTUUwgdGVzdCBzdWl0ZTEkMCIGA1UEAwwbY29tbW9uLW5hbWUu
+cGctc3NsdGVzdC50ZXN0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
+ooPO8lSz434p4PBYBbTN8jkLW3cHEpTCH4yvC0V40hzGEl30HPLp82e+kxr+Q0+g
+d82fvc4Yth5IPKINznp28GMs5/E9cUU3hMK4jFhKLMiOeIve3M/9ryHK874qpNjJ
+oSxxPz7+s2eqWoFc2px0KFIamTTLfi7Ju9aPb/AMlZNsUnbRsj7fQc7EJ8rwOnez
+w2Wy5VK4soX+qpuJ0Nm44ApzT8YmjYX/kAX0yQxgQuYbpcBWr9cOQjegu3FAqHqR
+h9ye7d8jQzCv34Wg/ar4rkqyQDcokuWAE7KQbnk51t7omzhM8eswFOAL1pas/8jW
+Bvy0VjYVU34P9aXxP8GiHQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQDCJoMLMIl8
+yvxrXH+kD2z163bwsMEIdsJxsXGjewmI/tDMyDLdYVQGJm9YRa/Oebylir7T+ayr
+NGj7b+Uo5KezgnRw9iQ9U8Xz6oKNxMNHB0mw5v7eR2cDFTzzNm1jYReIxWVryLOj
+al4C5uWqoIOHUNYibSJZIjNpzR/Zu4d/Ijt3+oJz9OFRXlaXYuDqLrm8hsUkxBm8
+s6GS79Dvw75M689ZKrKQs/15ceFYqx1hTvePW7kK5tuhW//Hf2IX4pwwtn5x0t4A
+M47qO71Zo3BxJFToNgALaw2+ixWNqy4kZ429NQjXArtq6eUI6IaOTU1ER2UAcOjN
+OOC5mBDmmMZa
-----END CERTIFICATE-----
diff --git a/src/test/ssl/ssl/server-single-alt-name.crt b/src/test/ssl/ssl/server-single-alt-name.crt
index 7affdd68e7..077a60a7ad 100644
--- a/src/test/ssl/ssl/server-single-alt-name.crt
+++ b/src/test/ssl/ssl/server-single-alt-name.crt
@@ -1,19 +1,20 @@
-----BEGIN CERTIFICATE-----
-MIIDEjCCAfqgAwIBAgIIICEDAxQSBwIwDQYJKoZIhvcNAQELBQAwQjFAMD4GA1UE
+MIIDVDCCAjygAwIBAgIIICMHExY1IwgwDQYJKoZIhvcNAQELBQAwQjFAMD4GA1UE
Aww3VGVzdCBDQSBmb3IgUG9zdGdyZVNRTCBTU0wgcmVncmVzc2lvbiB0ZXN0IHNl
-cnZlciBjZXJ0czAeFw0yMTAzMDMyMjEyMDdaFw00ODA3MTkyMjEyMDdaMCAxHjAc
-BgNVBAsMFVBvc3RncmVTUUwgdGVzdCBzdWl0ZTCCASIwDQYJKoZIhvcNAQEBBQAD
-ggEPADCCAQoCggEBAMWKHC1lrog7A8ye8C3NM38JBiQBMuIZR40wORl0hJxj5Tp8
-dX8Xo2Thi9Ry33+YfMwfkkF66ZRwnMMEa8VYBmOz+fZFzF19WpE8F1CR3PxKE7ai
-zvunxy8oMxdXdIuTTzt8a5NcDLe22C4Yj21qaZVoh182ycvMH93V4MwsLcV3/GdV
-Ko7QpwP2ZCf5D1rhyccx+Trwyb2bKvhW5Jd3GrRacFJQFfUyrAu/FvyuSPmn86ab
-Jkr7CCgFlg6e4O9SFY7yXiOgLotsoQ5/YriTLinvUTGCMCSxaol97qx3I2gUpCZu
-i7H+4Dt9L5FcCMshl0TU32dsjw6El1Wbzp6voCsCAwEAAaMuMCwwKgYDVR0RBCMw
-IYIfc2luZ2xlLmFsdC1uYW1lLnBnLXNzbHRlc3QudGVzdDANBgkqhkiG9w0BAQsF
-AAOCAQEAUIhBQLzQgd7wHlT9DARxcC7SZwQtnk2BVqMYTRBU4uIa0i2HVyetpe1P
-rREthYq5sgaSqdonD9Splg8BLUlah9y3v9j6DBxkxNnz/3AZuA5oPaC/TZ+lwlX3
-QNWWFNaNZdcQbvjUvoPXIbJ6U9UDfByOJdoN4kJ6xe8Faj1Mp5Euqzr1ErrMtPWJ
-XLnXLV4WyAx+iMAbofXNlCyUorPGA8lRudzQ7bKdrhMZDE66VYwlwsUejEiODt7M
-NGTDs4aAZz9cBRjMeXhvX60cFQoykjAvWbieUKOgaFmJJyKemFj12cLeWyxvUodI
-kYtgAdzftiCSrbDjl1pzPSM6RC/E/A==
+cnZlciBjZXJ0czAgFw0yMzA3MTMxNDM1MjRaGA8yMDUwMTEyODE0MzUyNFowIDEe
+MBwGA1UECwwVUG9zdGdyZVNRTCB0ZXN0IHN1aXRlMIIBIjANBgkqhkiG9w0BAQEF
+AAOCAQ8AMIIBCgKCAQEAxYocLWWuiDsDzJ7wLc0zfwkGJAEy4hlHjTA5GXSEnGPl
+Onx1fxejZOGL1HLff5h8zB+SQXrplHCcwwRrxVgGY7P59kXMXX1akTwXUJHc/EoT
+tqLO+6fHLygzF1d0i5NPO3xrk1wMt7bYLhiPbWpplWiHXzbJy8wf3dXgzCwtxXf8
+Z1UqjtCnA/ZkJ/kPWuHJxzH5OvDJvZsq+Fbkl3catFpwUlAV9TKsC78W/K5I+afz
+ppsmSvsIKAWWDp7g71IVjvJeI6Aui2yhDn9iuJMuKe9RMYIwJLFqiX3urHcjaBSk
+Jm6Lsf7gO30vkVwIyyGXRNTfZ2yPDoSXVZvOnq+gKwIDAQABo24wbDAqBgNVHREE
+IzAhgh9zaW5nbGUuYWx0LW5hbWUucGctc3NsdGVzdC50ZXN0MB0GA1UdDgQWBBRE
+be2UnhcFV/bd5hEMML2w60NbbTAfBgNVHSMEGDAWgBTyjzpmQFBkSCLXLoL/Vp7C
+s+50CjANBgkqhkiG9w0BAQsFAAOCAQEA1pyC1Vb1EOgMdcdMq+u0FI+7GHGkEeg7
+qWMcLvu7mbcbcyzLriBUk1vKDYw+6WspTc6vvqMGxNVdwchm/93rUM/JI4C6nrmr
+3TJqE578C3EI+4YZxLLRnfYWBO0uyUfLkdjT3n0Tnu643wYYoKOgpZRV2WgfktK6
+KoRqWlkXkVoV/qZUS9O67XtNttvCFMrPiM4YbGmwQ7lUZ9qzojy4Fb0AWcZOVEIy
+2b7FMOUrIzk9CgTRtEqeobSD98p3OXGtzVZf2hY9vLgA1hnbVjmB2Kt3QMhnicvt
+/Z7o8o88cmcrs0PXMe90tt1JBssTFs6+ARCsgUkEwzCRnvVX+Yky9w==
-----END CERTIFICATE-----
diff --git a/src/test/ssl/ssl/server.crl b/src/test/ssl/ssl/server.crl
index 331a83cb62..7ed68e0220 100644
--- a/src/test/ssl/ssl/server.crl
+++ b/src/test/ssl/ssl/server.crl
@@ -1,11 +1,11 @@
-----BEGIN X509 CRL-----
-MIIBpTCBjjANBgkqhkiG9w0BAQsFADBCMUAwPgYDVQQDDDdUZXN0IENBIGZvciBQ
-b3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRlc3Qgc2VydmVyIGNlcnRzFw0yMTAz
-MDMyMjEyMDdaFw00ODA3MTkyMjEyMDdaMBswGQIIICEDAxQSBwUXDTIxMDMwMzIy
-MTIwN1owDQYJKoZIhvcNAQELBQADggEBAJxj0taZYIIxUsCuXR5CN2OymjMvRwmV
-+10VOkyBQ3VkzHlXeJkmZsU2Dvmc205l9OYouh/faL0TfK2NyhmBo+MrTizL9TBo
-4u2es/0oJGj2wyNMkRs0SlSJelakvGFBvSKfqoV0l2O1WDV7M4KtdC8ZVZipmL4R
-ac4hBMK0ifHuTS5Od6o0C2RijEPCHMXaS/LkWpBqcStI2oirhjo+Th1wxTMGUVFy
-imVvt6D6QqqHCUYrvcNEN0xBNFwJGq/0cgSy+w5szt/RRehmJKX8MbNeZxrznIIx
-B18ch9rbBltz+Y4R63rCN9MdsnGXf6PQ6a6doZhSI1pnDrui12MOQrU=
+MIIBpzCBkDANBgkqhkiG9w0BAQsFADBCMUAwPgYDVQQDDDdUZXN0IENBIGZvciBQ
+b3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRlc3Qgc2VydmVyIGNlcnRzFw0yMzA3
+MTMxNDM1MjRaGA8yMDUwMTEyODE0MzUyNFowGzAZAgggIwcTFjUjCxcNMjMwNzEz
+MTQzNTI0WjANBgkqhkiG9w0BAQsFAAOCAQEADIkF8oS84O2PJw/C9BAzgrkd+EsO
+QL6mXUGBgXwmujfpv0Z8YK91k4+xV9hQRMjWe/DkU01+gmFhYoDvAzweuNQzx8lZ
+bYKu0dGTEpTd+OG1LbxYmt4f5xh096R5iLo7c7e2kMHvfNG7VwvKQrPeMqh7AcKy
+Fukt8C0Xc7Tfv2l2toEQUAl5UDUKEAovN6iB0qycpvi0nboyiDo8mV0p1jlAn846
+EeXjwm8tyGXzTFq16ypPwnlBM9d5Ml/p5WTN69nDux18G+iSCr+UDzLDYvLF11p3
+lEqpSo5lQg9zYuOgMCvu3g5BtwJgORPSiW/yZ5BXUfWvPi0XRPrknxMByA==
-----END X509 CRL-----
diff --git a/src/test/ssl/ssl/server_ca.crt b/src/test/ssl/ssl/server_ca.crt
index 0d6d7a6f82..8b010e7ca4 100644
--- a/src/test/ssl/ssl/server_ca.crt
+++ b/src/test/ssl/ssl/server_ca.crt
@@ -1,19 +1,22 @@
-----BEGIN CERTIFICATE-----
-MIIDFDCCAfygAwIBAgIIICEDAxQSBwAwDQYJKoZIhvcNAQELBQAwQDE+MDwGA1UE
+MIIDnjCCAoagAwIBAgIIICMHExY1IwAwDQYJKoZIhvcNAQELBQAwQDE+MDwGA1UE
Aww1VGVzdCByb290IENBIGZvciBQb3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRl
-c3Qgc3VpdGUwHhcNMjEwMzAzMjIxMjA3WhcNNDgwNzE5MjIxMjA3WjBCMUAwPgYD
-VQQDDDdUZXN0IENBIGZvciBQb3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRlc3Qg
-c2VydmVyIGNlcnRzMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4kp2
-GW5nPb6QrSrtbClfZeutyQnHrm4TMPBoNepFdIVxBX/04BguM5ImDRze/huOWA+z
-atJAQqt3R7dsDwnOnPKUKCOuHX6a1aj5L86HtVgaWTXrZFE5NtL9PIzXkWu13UW0
-UesHtbPVRv6a6fB7Npph6hHy7iPZb009A8/lTJnxSPC39u/K/sPqjrVZaAJF+wDs
-qCxCZTUtAUFvWFnR/TeXLWlFzBupS1djgI7PltbJqSn6SKTAgNZTxpRJbu9Icp6J
-/50ELwT++0n0KWVXNHrDNfI5Gaa+SxClAsPsei2jLKpgR6QFC3wn38Z9q9LjAVuC
-+FWhoN1uhYeoricEXwIDAQABoxAwDjAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEB
-CwUAA4IBAQCdCA/EoXrustoV4jJGbkdXDuOUkBurwggSNBAqUBSDvCohRoD77Ecb
-QVuzPNxWKG+E4PwfUq2ha+2yPONEJ28ZgsbHq5qlJDMJ43wlcjn6wmmAJNeSpO8F
-0V9d2X/4wNZty9/zbwTnw26KChgDHumQ0WIbCoBtdqy8KDswYOvpgws6dqc021I7
-UrFo6vZek7VoApbJgkDL6qYADa6ApfW43ThH4sViFITeYt/kSHgmy2Udhs34jMM8
-xsFP/uYpRi1b1glenwSIKiHjD4/C9vnWQt5K3gRBvYukEj2Bw9VkNRpBVCi0cOoA
-OuwX3bwzNYNbZQv4K66oRpvuoEjCNeHg
+c3Qgc3VpdGUwIBcNMjMwNzEzMTQzNTIzWhgPMjA1MDExMjgxNDM1MjNaMEIxQDA+
+BgNVBAMMN1Rlc3QgQ0EgZm9yIFBvc3RncmVTUUwgU1NMIHJlZ3Jlc3Npb24gdGVz
+dCBzZXJ2ZXIgY2VydHMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDi
+SnYZbmc9vpCtKu1sKV9l663JCceubhMw8Gg16kV0hXEFf/TgGC4zkiYNHN7+G45Y
+D7Nq0kBCq3dHt2wPCc6c8pQoI64dfprVqPkvzoe1WBpZNetkUTk20v08jNeRa7Xd
+RbRR6we1s9VG/prp8Hs2mmHqEfLuI9lvTT0Dz+VMmfFI8Lf278r+w+qOtVloAkX7
+AOyoLEJlNS0BQW9YWdH9N5ctaUXMG6lLV2OAjs+W1smpKfpIpMCA1lPGlElu70hy
+non/nQQvBP77SfQpZVc0esM18jkZpr5LEKUCw+x6LaMsqmBHpAULfCffxn2r0uMB
+W4L4VaGg3W6Fh6iuJwRfAgMBAAGjgZcwgZQwDAYDVR0TBAUwAwEB/zAdBgNVHQ4E
+FgQU8o86ZkBQZEgi1y6C/1aewrPudAowZQYDVR0jBF4wXKFEpEIwQDE+MDwGA1UE
+Aww1VGVzdCByb290IENBIGZvciBQb3N0Z3JlU1FMIFNTTCByZWdyZXNzaW9uIHRl
+c3Qgc3VpdGWCFBfnvJQgNLw9MyrcSA1T3Q2PyJIFMA0GCSqGSIb3DQEBCwUAA4IB
+AQANlEDrM357a7o+WcKB0Ocll2UtBMq7PDms1Pjqm3fFu/wdKDUomG8W2/MgDmFl
+CVeAPpofb6J0oaxiEZOR68pOhdccMznArtKix6t3RkDiXdm4d5UORMMR+s9CymXV
+MUTWpQpAg3qP3mRI+3E9OrgfhvmVcuOa7/cdTS/sylGe8Db+nJQD0be9NHtnhO56
+IA+Li+8oWzD4UNsP3gAmhLkyToz5wlPHzEkgGxkEySNErEOKTOX5Xyk5z+QToRhz
+adkt0mBw/dxoJk9DveCtIqxDelxJsDeJFtqoc5qVVE9yOp7rujGsqgWl2PcJeyKM
+Crh9qsqNzJ2R29pq0g6Lfzh2
-----END CERTIFICATE-----
--
2.32.1 (Apple Git-133)
------=_Part_1248179_1719184966.1689618400561
Content-Type: application/octet-stream;
name=v6-0002-Add-notBefore-and-notAfter-to-SSL-cert-info-displ.patch
Content-Transfer-Encoding: 7bit
X-ZM_AttachId: 139089112005750000
Content-Disposition: attachment;
filename=v6-0002-Add-notBefore-and-notAfter-to-SSL-cert-info-displ.patch
diff --git a/contrib/sslinfo/Makefile b/contrib/sslinfo/Makefile
index dd1ff83b16..78a5a83d5c 100644
--- a/contrib/sslinfo/Makefile
+++ b/contrib/sslinfo/Makefile
@@ -6,7 +6,7 @@ OBJS = \
sslinfo.o
EXTENSION = sslinfo
-DATA = sslinfo--1.2.sql sslinfo--1.1--1.2.sql sslinfo--1.0--1.1.sql
+DATA = sslinfo--1.2--1.3.sql sslinfo--1.2.sql sslinfo--1.1--1.2.sql sslinfo--1.0--1.1.sql
PGFILEDESC = "sslinfo - information about client SSL certificate"
ifdef USE_PGXS
diff --git a/contrib/sslinfo/meson.build b/contrib/sslinfo/meson.build
index 999456d3a4..215b01daff 100644
--- a/contrib/sslinfo/meson.build
+++ b/contrib/sslinfo/meson.build
@@ -26,6 +26,7 @@ install_data(
'sslinfo--1.0--1.1.sql',
'sslinfo--1.1--1.2.sql',
'sslinfo--1.2.sql',
+ 'sslinfo--1.2--1.3.sql',
'sslinfo.control',
kwargs: contrib_data_args,
)
diff --git a/contrib/sslinfo/sslinfo--1.2--1.3.sql b/contrib/sslinfo/sslinfo--1.2--1.3.sql
new file mode 100644
index 0000000000..9d64d2bfa4
--- /dev/null
+++ b/contrib/sslinfo/sslinfo--1.2--1.3.sql
@@ -0,0 +1,12 @@
+/* contrib/sslinfo/sslinfo--1.2--1.3.sql */
+
+-- complain if script is sourced in psql, rather than via CREATE EXTENSION
+\echo Use "CREATE EXTENSION sslinfo" to load this file. \quit
+
+CREATE FUNCTION ssl_client_get_notbefore() RETURNS timestamp
+AS 'MODULE_PATHNAME', 'ssl_client_get_notbefore'
+LANGUAGE C STRICT PARALLEL RESTRICTED;
+
+CREATE FUNCTION ssl_client_get_notafter() RETURNS timestamp
+AS 'MODULE_PATHNAME', 'ssl_client_get_notafter'
+LANGUAGE C STRICT PARALLEL RESTRICTED;
diff --git a/contrib/sslinfo/sslinfo.c b/contrib/sslinfo/sslinfo.c
index 5fd46b9874..c3b95e7d60 100644
--- a/contrib/sslinfo/sslinfo.c
+++ b/contrib/sslinfo/sslinfo.c
@@ -18,6 +18,7 @@
#include "libpq/libpq-be.h"
#include "miscadmin.h"
#include "utils/builtins.h"
+#include "utils/timestamp.h"
/*
* On Windows, <wincrypt.h> includes a #define for X509_NAME, which breaks our
@@ -34,6 +35,7 @@ PG_MODULE_MAGIC;
static Datum X509_NAME_field_to_text(X509_NAME *name, text *fieldName);
static Datum ASN1_STRING_to_text(ASN1_STRING *str);
+static Datum ASN1_TIME_to_timestamp(ASN1_TIME *time);
/*
* Function context for data persisting over repeated calls.
@@ -225,6 +227,37 @@ X509_NAME_field_to_text(X509_NAME *name, text *fieldName)
}
+/*
+ * Converts OpenSSL ASN1_TIME structure into timestamp
+ *
+ * Parameter: time - OpenSSL ASN1_TIME structure.
+ *
+ * Returns Datum, which can be directly returned from a C language SQL
+ * function.
+ */
+static Datum
+ASN1_TIME_to_timestamp(ASN1_TIME * time)
+{
+ struct tm tm_time;
+ struct pg_tm pgtm_time;
+ Timestamp ts;
+
+ ASN1_TIME_to_tm(time, &tm_time);
+
+ pgtm_time.tm_sec = tm_time.tm_sec;
+ pgtm_time.tm_min = tm_time.tm_min;
+ pgtm_time.tm_hour = tm_time.tm_hour;
+ pgtm_time.tm_mday = tm_time.tm_mday;
+ pgtm_time.tm_mon = tm_time.tm_mon + 1;
+ pgtm_time.tm_year = tm_time.tm_year + 1900;
+
+ if (tm2timestamp(&pgtm_time, 0, NULL, &ts))
+ elog(ERROR, "timestamp out of range");
+
+ PG_RETURN_TIMESTAMP(ts);
+}
+
+
/*
* Returns specified field of client certificate distinguished name
*
@@ -482,3 +515,35 @@ ssl_extension_info(PG_FUNCTION_ARGS)
/* All done */
SRF_RETURN_DONE(funcctx);
}
+
+/*
+ * Returns current client certificate notBefore timestamp in
+ * timestamp data type
+ */
+PG_FUNCTION_INFO_V1(ssl_client_get_notbefore);
+Datum
+ssl_client_get_notbefore(PG_FUNCTION_ARGS)
+{
+ X509 *cert = MyProcPort->peer;
+
+ if (!MyProcPort->ssl_in_use || !MyProcPort->peer_cert_valid)
+ PG_RETURN_NULL();
+
+ return ASN1_TIME_to_timestamp(X509_get_notBefore(cert));
+}
+
+/*
+ * Returns current client certificate notAfter timestamp in
+ * timestamp data type
+ */
+PG_FUNCTION_INFO_V1(ssl_client_get_notafter);
+Datum
+ssl_client_get_notafter(PG_FUNCTION_ARGS)
+{
+ X509 *cert = MyProcPort->peer;
+
+ if (!MyProcPort->ssl_in_use || !MyProcPort->peer_cert_valid)
+ PG_RETURN_NULL();
+
+ return ASN1_TIME_to_timestamp(X509_get_notAfter(cert));
+}
diff --git a/contrib/sslinfo/sslinfo.control b/contrib/sslinfo/sslinfo.control
index c7754f924c..b53e95b7da 100644
--- a/contrib/sslinfo/sslinfo.control
+++ b/contrib/sslinfo/sslinfo.control
@@ -1,5 +1,5 @@
# sslinfo extension
comment = 'information about SSL certificates'
-default_version = '1.2'
+default_version = '1.3'
module_pathname = '$libdir/sslinfo'
relocatable = true
diff --git a/doc/src/sgml/monitoring.sgml b/doc/src/sgml/monitoring.sgml
index 588b720f57..42c7808f50 100644
--- a/doc/src/sgml/monitoring.sgml
+++ b/doc/src/sgml/monitoring.sgml
@@ -2257,6 +2257,26 @@ SELECT pid, wait_event_type, wait_event FROM pg_stat_activity WHERE wait_event i
This field is truncated like <structfield>client_dn</structfield>.
</para></entry>
</row>
+
+ <row>
+ <entry role="catalog_table_entry"><para role="column_definition">
+ <structfield>not_before</structfield> <type>text</type>
+ </para>
+ <para>
+ Not before UTC timestamp of the client certificate, or NULL if no client
+ certificate was supplied.
+ </para></entry>
+ </row>
+
+ <row>
+ <entry role="catalog_table_entry"><para role="column_definition">
+ <structfield>not_after</structfield> <type>text</type>
+ </para>
+ <para>
+ Not after UTC timestamp of the client certificate, or NULL if no client
+ certificate was supplied.
+ </para></entry>
+ </row>
</tbody>
</tgroup>
</table>
diff --git a/doc/src/sgml/sslinfo.sgml b/doc/src/sgml/sslinfo.sgml
index 85d49f6653..06f5728096 100644
--- a/doc/src/sgml/sslinfo.sgml
+++ b/doc/src/sgml/sslinfo.sgml
@@ -240,6 +240,36 @@ emailAddress
</para>
</listitem>
</varlistentry>
+
+ <varlistentry>
+ <term>
+ <function>ssl_client_get_notbefore() returns text</function>
+ <indexterm>
+ <primary>ssl_client_get_notbefore</primary>
+ </indexterm>
+ </term>
+ <listitem>
+ <para>
+ Return the <structfield>not before</structfield> UTC timestamp of the client
+ certificate.
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>
+ <function>ssl_client_get_notafter() returns text</function>
+ <indexterm>
+ <primary>ssl_client_get_notafter</primary>
+ </indexterm>
+ </term>
+ <listitem>
+ <para>
+ Return the <structfield>not after</structfield> UTC timestamp of the client
+ certificate.
+ </para>
+ </listitem>
+ </varlistentry>
</variablelist>
</sect2>
diff --git a/src/backend/catalog/system_views.sql b/src/backend/catalog/system_views.sql
index af65af6bdd..f7c2cfb8cd 100644
--- a/src/backend/catalog/system_views.sql
+++ b/src/backend/catalog/system_views.sql
@@ -970,7 +970,9 @@ CREATE VIEW pg_stat_ssl AS
S.sslbits AS bits,
S.ssl_client_dn AS client_dn,
S.ssl_client_serial AS client_serial,
- S.ssl_issuer_dn AS issuer_dn
+ S.ssl_issuer_dn AS issuer_dn,
+ S.ssl_not_before AS not_before,
+ S.ssl_not_after AS not_after
FROM pg_stat_get_activity(NULL) AS S
WHERE S.client_port IS NOT NULL;
diff --git a/src/backend/libpq/be-secure-openssl.c b/src/backend/libpq/be-secure-openssl.c
index 658b09988d..41aa0cf720 100644
--- a/src/backend/libpq/be-secure-openssl.c
+++ b/src/backend/libpq/be-secure-openssl.c
@@ -36,6 +36,7 @@
#include "tcop/tcopprot.h"
#include "utils/builtins.h"
#include "utils/memutils.h"
+#include "utils/timestamp.h"
/*
* These SSL-related #includes must come after all system-provided headers.
@@ -72,6 +73,7 @@ static bool initialize_ecdh(SSL_CTX *context, bool isServerStart);
static const char *SSLerrmessage(unsigned long ecode);
static char *X509_NAME_to_cstring(X509_NAME *name);
+static Timestamp ASN1_TIME_to_timestamp(ASN1_TIME *time);
static SSL_CTX *SSL_context = NULL;
static bool SSL_initialized = false;
@@ -1406,6 +1408,24 @@ be_tls_get_peer_issuer_name(Port *port, char *ptr, size_t len)
ptr[0] = '\0';
}
+void
+be_tls_get_peer_not_before(Port *port, Timestamp *ptr)
+{
+ if (port->peer)
+ *ptr = ASN1_TIME_to_timestamp(X509_get_notBefore(port->peer));
+ else
+ *ptr = 0;
+}
+
+void
+be_tls_get_peer_not_after(Port *port, Timestamp *ptr)
+{
+ if (port->peer)
+ *ptr = ASN1_TIME_to_timestamp(X509_get_notAfter(port->peer));
+ else
+ *ptr = 0;
+}
+
void
be_tls_get_peer_serial(Port *port, char *ptr, size_t len)
{
@@ -1549,6 +1569,31 @@ X509_NAME_to_cstring(X509_NAME *name)
return result;
}
+/*
+ * Convert an ASN1_TIME to a cstring in format of YYYY-MM-DDThh:mm:ssZ.
+ */
+static Timestamp
+ASN1_TIME_to_timestamp(ASN1_TIME * time)
+{
+ struct tm tm_time;
+ struct pg_tm pgtm_time;
+ Timestamp ts;
+
+ ASN1_TIME_to_tm(time, &tm_time);
+
+ pgtm_time.tm_sec = tm_time.tm_sec;
+ pgtm_time.tm_min = tm_time.tm_min;
+ pgtm_time.tm_hour = tm_time.tm_hour;
+ pgtm_time.tm_mday = tm_time.tm_mday;
+ pgtm_time.tm_mon = tm_time.tm_mon + 1;
+ pgtm_time.tm_year = tm_time.tm_year + 1900;
+
+ if (tm2timestamp(&pgtm_time, 0, NULL, &ts))
+ elog(ERROR, "timestamp out of range");
+
+ return ts;
+}
+
/*
* Convert TLS protocol version GUC enum to OpenSSL values
*
diff --git a/src/backend/utils/activity/backend_status.c b/src/backend/utils/activity/backend_status.c
index 38f91a495b..02dc9d7931 100644
--- a/src/backend/utils/activity/backend_status.c
+++ b/src/backend/utils/activity/backend_status.c
@@ -367,6 +367,8 @@ pgstat_bestart(void)
be_tls_get_peer_subject_name(MyProcPort, lsslstatus.ssl_client_dn, NAMEDATALEN);
be_tls_get_peer_serial(MyProcPort, lsslstatus.ssl_client_serial, NAMEDATALEN);
be_tls_get_peer_issuer_name(MyProcPort, lsslstatus.ssl_issuer_dn, NAMEDATALEN);
+ be_tls_get_peer_not_before(MyProcPort, &lsslstatus.ssl_not_before);
+ be_tls_get_peer_not_after(MyProcPort, &lsslstatus.ssl_not_after);
}
else
{
diff --git a/src/backend/utils/adt/pgstatfuncs.c b/src/backend/utils/adt/pgstatfuncs.c
index 2a4c8ef87f..9071981f98 100644
--- a/src/backend/utils/adt/pgstatfuncs.c
+++ b/src/backend/utils/adt/pgstatfuncs.c
@@ -303,7 +303,7 @@ pg_stat_get_progress_info(PG_FUNCTION_ARGS)
Datum
pg_stat_get_activity(PG_FUNCTION_ARGS)
{
-#define PG_STAT_GET_ACTIVITY_COLS 31
+#define PG_STAT_GET_ACTIVITY_COLS 33
int num_backends = pgstat_fetch_stat_numbackends();
int curr_backend;
int pid = PG_ARGISNULL(0) ? -1 : PG_GETARG_INT32(0);
@@ -395,7 +395,7 @@ pg_stat_get_activity(PG_FUNCTION_ARGS)
pfree(clipped_activity);
/* leader_pid */
- nulls[29] = true;
+ nulls[31] = true;
proc = BackendPidGetProc(beentry->st_procpid);
@@ -432,8 +432,8 @@ pg_stat_get_activity(PG_FUNCTION_ARGS)
*/
if (leader && leader->pid != beentry->st_procpid)
{
- values[29] = Int32GetDatum(leader->pid);
- nulls[29] = false;
+ values[31] = Int32GetDatum(leader->pid);
+ nulls[31] = false;
}
else if (beentry->st_backendType == B_BG_WORKER)
{
@@ -441,8 +441,8 @@ pg_stat_get_activity(PG_FUNCTION_ARGS)
if (leader_pid != InvalidPid)
{
- values[29] = Int32GetDatum(leader_pid);
- nulls[29] = false;
+ values[31] = Int32GetDatum(leader_pid);
+ nulls[31] = false;
}
}
}
@@ -587,35 +587,45 @@ pg_stat_get_activity(PG_FUNCTION_ARGS)
values[24] = CStringGetTextDatum(beentry->st_sslstatus->ssl_issuer_dn);
else
nulls[24] = true;
+
+ if (beentry->st_sslstatus->ssl_not_before != 0)
+ values[25] = TimestampGetDatum(beentry->st_sslstatus->ssl_not_before);
+ else
+ nulls[25] = true;
+
+ if (beentry->st_sslstatus->ssl_not_after != 0)
+ values[26] = TimestampGetDatum(beentry->st_sslstatus->ssl_not_after);
+ else
+ nulls[26] = true;
}
else
{
values[18] = BoolGetDatum(false); /* ssl */
- nulls[19] = nulls[20] = nulls[21] = nulls[22] = nulls[23] = nulls[24] = true;
+ nulls[19] = nulls[20] = nulls[21] = nulls[22] = nulls[23] = nulls[24] = nulls[25] = nulls[26] = true;
}
/* GSSAPI information */
if (beentry->st_gss)
{
- values[25] = BoolGetDatum(beentry->st_gssstatus->gss_auth); /* gss_auth */
- values[26] = CStringGetTextDatum(beentry->st_gssstatus->gss_princ);
- values[27] = BoolGetDatum(beentry->st_gssstatus->gss_enc); /* GSS Encryption in use */
- values[28] = BoolGetDatum(beentry->st_gssstatus->gss_delegation); /* GSS credentials
+ values[27] = BoolGetDatum(beentry->st_gssstatus->gss_auth); /* gss_auth */
+ values[28] = CStringGetTextDatum(beentry->st_gssstatus->gss_princ);
+ values[29] = BoolGetDatum(beentry->st_gssstatus->gss_enc); /* GSS Encryption in use */
+ values[30] = BoolGetDatum(beentry->st_gssstatus->gss_delegation); /* GSS credentials
* delegated */
}
else
{
- values[25] = BoolGetDatum(false); /* gss_auth */
- nulls[26] = true; /* No GSS principal */
- values[27] = BoolGetDatum(false); /* GSS Encryption not in
+ values[27] = BoolGetDatum(false); /* gss_auth */
+ nulls[28] = true; /* No GSS principal */
+ values[29] = BoolGetDatum(false); /* GSS Encryption not in
* use */
- values[28] = BoolGetDatum(false); /* GSS credentials not
+ values[30] = BoolGetDatum(false); /* GSS credentials not
* delegated */
}
if (beentry->st_query_id == 0)
- nulls[30] = true;
+ nulls[32] = true;
else
- values[30] = UInt64GetDatum(beentry->st_query_id);
+ values[32] = UInt64GetDatum(beentry->st_query_id);
}
else
{
@@ -645,6 +655,8 @@ pg_stat_get_activity(PG_FUNCTION_ARGS)
nulls[28] = true;
nulls[29] = true;
nulls[30] = true;
+ nulls[31] = true;
+ nulls[32] = true;
}
tuplestore_putvalues(rsinfo->setResult, rsinfo->setDesc, values, nulls);
diff --git a/src/include/catalog/pg_proc.dat b/src/include/catalog/pg_proc.dat
index 6996073989..878c997e87 100644
--- a/src/include/catalog/pg_proc.dat
+++ b/src/include/catalog/pg_proc.dat
@@ -5413,9 +5413,9 @@
proname => 'pg_stat_get_activity', prorows => '100', proisstrict => 'f',
proretset => 't', provolatile => 's', proparallel => 'r',
prorettype => 'record', proargtypes => 'int4',
- proallargtypes => '{int4,oid,int4,oid,text,text,text,text,text,timestamptz,timestamptz,timestamptz,timestamptz,inet,text,int4,xid,xid,text,bool,text,text,int4,text,numeric,text,bool,text,bool,bool,int4,int8}',
- proargmodes => '{i,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o}',
- proargnames => '{pid,datid,pid,usesysid,application_name,state,query,wait_event_type,wait_event,xact_start,query_start,backend_start,state_change,client_addr,client_hostname,client_port,backend_xid,backend_xmin,backend_type,ssl,sslversion,sslcipher,sslbits,ssl_client_dn,ssl_client_serial,ssl_issuer_dn,gss_auth,gss_princ,gss_enc,gss_delegation,leader_pid,query_id}',
+ proallargtypes => '{int4,oid,int4,oid,text,text,text,text,text,timestamptz,timestamptz,timestamptz,timestamptz,inet,text,int4,xid,xid,text,bool,text,text,int4,text,numeric,text,timestamp,timestamp,bool,text,bool,bool,int4,int8}',
+ proargmodes => '{i,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o}',
+ proargnames => '{pid,datid,pid,usesysid,application_name,state,query,wait_event_type,wait_event,xact_start,query_start,backend_start,state_change,client_addr,client_hostname,client_port,backend_xid,backend_xmin,backend_type,ssl,sslversion,sslcipher,sslbits,ssl_client_dn,ssl_client_serial,ssl_issuer_dn,ssl_not_before,ssl_not_after,gss_auth,gss_princ,gss_enc,gss_delegation,leader_pid,query_id}',
prosrc => 'pg_stat_get_activity' },
{ oid => '3318',
descr => 'statistics: information about progress of backends running maintenance command',
diff --git a/src/include/libpq/libpq-be.h b/src/include/libpq/libpq-be.h
index a0b74c8095..02765ba9d9 100644
--- a/src/include/libpq/libpq-be.h
+++ b/src/include/libpq/libpq-be.h
@@ -298,6 +298,8 @@ extern const char *be_tls_get_cipher(Port *port);
extern void be_tls_get_peer_subject_name(Port *port, char *ptr, size_t len);
extern void be_tls_get_peer_issuer_name(Port *port, char *ptr, size_t len);
extern void be_tls_get_peer_serial(Port *port, char *ptr, size_t len);
+extern void be_tls_get_peer_not_before(Port *port, Timestamp *ptr);
+extern void be_tls_get_peer_not_after(Port *port, Timestamp *ptr);
/*
* Get the server certificate hash for SCRAM channel binding type
diff --git a/src/include/utils/backend_status.h b/src/include/utils/backend_status.h
index 77939a0aed..1e4fedb661 100644
--- a/src/include/utils/backend_status.h
+++ b/src/include/utils/backend_status.h
@@ -61,6 +61,8 @@ typedef struct PgBackendSSLStatus
char ssl_client_serial[NAMEDATALEN];
char ssl_issuer_dn[NAMEDATALEN];
+ Timestamp ssl_not_before;
+ Timestamp ssl_not_after;
} PgBackendSSLStatus;
/*
diff --git a/src/test/regress/expected/rules.out b/src/test/regress/expected/rules.out
index e07afcd4aa..30108846c1 100644
--- a/src/test/regress/expected/rules.out
+++ b/src/test/regress/expected/rules.out
@@ -1760,7 +1760,7 @@ pg_stat_activity| SELECT s.datid,
s.query_id,
s.query,
s.backend_type
- FROM ((pg_stat_get_activity(NULL::integer) s(datid, pid, usesysid, application_name, state, query, wait_event_type, wait_event, xact_start, query_start, backend_start, state_change, client_addr, client_hostname, client_port, backend_xid, backend_xmin, backend_type, ssl, sslversion, sslcipher, sslbits, ssl_client_dn, ssl_client_serial, ssl_issuer_dn, gss_auth, gss_princ, gss_enc, gss_delegation, leader_pid, query_id)
+ FROM ((pg_stat_get_activity(NULL::integer) s(datid, pid, usesysid, application_name, state, query, wait_event_type, wait_event, xact_start, query_start, backend_start, state_change, client_addr, client_hostname, client_port, backend_xid, backend_xmin, backend_type, ssl, sslversion, sslcipher, sslbits, ssl_client_dn, ssl_client_serial, ssl_issuer_dn, ssl_not_before, ssl_not_after, gss_auth, gss_princ, gss_enc, gss_delegation, leader_pid, query_id)
LEFT JOIN pg_database d ON ((s.datid = d.oid)))
LEFT JOIN pg_authid u ON ((s.usesysid = u.oid)));
pg_stat_all_indexes| SELECT c.oid AS relid,
@@ -1878,7 +1878,7 @@ pg_stat_gssapi| SELECT pid,
gss_princ AS principal,
gss_enc AS encrypted,
gss_delegation AS credentials_delegated
- FROM pg_stat_get_activity(NULL::integer) s(datid, pid, usesysid, application_name, state, query, wait_event_type, wait_event, xact_start, query_start, backend_start, state_change, client_addr, client_hostname, client_port, backend_xid, backend_xmin, backend_type, ssl, sslversion, sslcipher, sslbits, ssl_client_dn, ssl_client_serial, ssl_issuer_dn, gss_auth, gss_princ, gss_enc, gss_delegation, leader_pid, query_id)
+ FROM pg_stat_get_activity(NULL::integer) s(datid, pid, usesysid, application_name, state, query, wait_event_type, wait_event, xact_start, query_start, backend_start, state_change, client_addr, client_hostname, client_port, backend_xid, backend_xmin, backend_type, ssl, sslversion, sslcipher, sslbits, ssl_client_dn, ssl_client_serial, ssl_issuer_dn, ssl_not_before, ssl_not_after, gss_auth, gss_princ, gss_enc, gss_delegation, leader_pid, query_id)
WHERE (client_port IS NOT NULL);
pg_stat_io| SELECT backend_type,
object,
@@ -2080,7 +2080,7 @@ pg_stat_replication| SELECT s.pid,
w.sync_priority,
w.sync_state,
w.reply_time
- FROM ((pg_stat_get_activity(NULL::integer) s(datid, pid, usesysid, application_name, state, query, wait_event_type, wait_event, xact_start, query_start, backend_start, state_change, client_addr, client_hostname, client_port, backend_xid, backend_xmin, backend_type, ssl, sslversion, sslcipher, sslbits, ssl_client_dn, ssl_client_serial, ssl_issuer_dn, gss_auth, gss_princ, gss_enc, gss_delegation, leader_pid, query_id)
+ FROM ((pg_stat_get_activity(NULL::integer) s(datid, pid, usesysid, application_name, state, query, wait_event_type, wait_event, xact_start, query_start, backend_start, state_change, client_addr, client_hostname, client_port, backend_xid, backend_xmin, backend_type, ssl, sslversion, sslcipher, sslbits, ssl_client_dn, ssl_client_serial, ssl_issuer_dn, ssl_not_before, ssl_not_after, gss_auth, gss_princ, gss_enc, gss_delegation, leader_pid, query_id)
JOIN pg_stat_get_wal_senders() w(pid, state, sent_lsn, write_lsn, flush_lsn, replay_lsn, write_lag, flush_lag, replay_lag, sync_priority, sync_state, reply_time) ON ((s.pid = w.pid)))
LEFT JOIN pg_authid u ON ((s.usesysid = u.oid)));
pg_stat_replication_slots| SELECT s.slot_name,
@@ -2113,8 +2113,10 @@ pg_stat_ssl| SELECT pid,
sslbits AS bits,
ssl_client_dn AS client_dn,
ssl_client_serial AS client_serial,
- ssl_issuer_dn AS issuer_dn
- FROM pg_stat_get_activity(NULL::integer) s(datid, pid, usesysid, application_name, state, query, wait_event_type, wait_event, xact_start, query_start, backend_start, state_change, client_addr, client_hostname, client_port, backend_xid, backend_xmin, backend_type, ssl, sslversion, sslcipher, sslbits, ssl_client_dn, ssl_client_serial, ssl_issuer_dn, gss_auth, gss_princ, gss_enc, gss_delegation, leader_pid, query_id)
+ ssl_issuer_dn AS issuer_dn,
+ ssl_not_before AS not_before,
+ ssl_not_after AS not_after
+ FROM pg_stat_get_activity(NULL::integer) s(datid, pid, usesysid, application_name, state, query, wait_event_type, wait_event, xact_start, query_start, backend_start, state_change, client_addr, client_hostname, client_port, backend_xid, backend_xmin, backend_type, ssl, sslversion, sslcipher, sslbits, ssl_client_dn, ssl_client_serial, ssl_issuer_dn, ssl_not_before, ssl_not_after, gss_auth, gss_princ, gss_enc, gss_delegation, leader_pid, query_id)
WHERE (client_port IS NOT NULL);
pg_stat_subscription| SELECT su.oid AS subid,
su.subname,
diff --git a/src/test/ssl/t/001_ssltests.pl b/src/test/ssl/t/001_ssltests.pl
index 76442de063..bad41cacc8 100644
--- a/src/test/ssl/t/001_ssltests.pl
+++ b/src/test/ssl/t/001_ssltests.pl
@@ -543,8 +543,8 @@ command_like(
"$common_connstr sslrootcert=invalid", '-c',
"SELECT * FROM pg_stat_ssl WHERE pid = pg_backend_pid()"
],
- qr{^pid,ssl,version,cipher,bits,client_dn,client_serial,issuer_dn\r?\n
- ^\d+,t,TLSv[\d.]+,[\w-]+,\d+,_null_,_null_,_null_\r?$}mx,
+ qr{^pid,ssl,version,cipher,bits,client_dn,client_serial,issuer_dn,not_before,not_after\r?\n
+ ^\d+,t,TLSv[\d.]+,[\w-]+,\d+,_null_,_null_,_null_,_null_,_null_\r?$}mx,
'pg_stat_ssl view without client certificate');
# Test min/max SSL protocol versions.
@@ -745,8 +745,8 @@ command_like(
'-c',
"SELECT * FROM pg_stat_ssl WHERE pid = pg_backend_pid()"
],
- qr{^pid,ssl,version,cipher,bits,client_dn,client_serial,issuer_dn\r?\n
- ^\d+,t,TLSv[\d.]+,[\w-]+,\d+,/?CN=ssltestuser,$serialno,/?\QCN=Test CA for PostgreSQL SSL regression test client certs\E\r?$}mx,
+ qr{^pid,ssl,version,cipher,bits,client_dn,client_serial,issuer_dn,not_before,not_after\r?\n
+ ^\d+,t,TLSv[\d.]+,[\w-]+,\d+,/?CN=ssltestuser,$serialno,/?\QCN=Test CA for PostgreSQL SSL regression test client certs\E,\Q2023-06-29 01:01:01\E,\Q2050-01-01 01:01:01\E\r?$}mx,
'pg_stat_ssl with client certificate');
# client key with wrong permissions
diff --git a/src/test/ssl/t/003_sslinfo.pl b/src/test/ssl/t/003_sslinfo.pl
index 5306aad802..f050a6f4f9 100644
--- a/src/test/ssl/t/003_sslinfo.pl
+++ b/src/test/ssl/t/003_sslinfo.pl
@@ -165,6 +165,20 @@ $result = $node->safe_psql(
connstr => $common_connstr);
is($result, 't', "ssl_issuer_field() for commonName");
+$result = $node->safe_psql(
+ "certdb",
+ "SELECT ssl_client_get_notbefore() = not_before, "
+ . "not_before = '2023-06-29 01:01:01' FROM pg_stat_ssl WHERE pid = pg_backend_pid();",
+ connstr => $common_connstr);
+is($result, 't|t', "ssl_client_get_notbefore() for not_before timestamp");
+
+$result = $node->safe_psql(
+ "certdb",
+ "SELECT ssl_client_get_notafter() = not_after, "
+ . "not_after = '2050-01-01 01:01:01' FROM pg_stat_ssl WHERE pid = pg_backend_pid();",
+ connstr => $common_connstr);
+is($result, 't|t', "ssl_client_get_notafter() for not_after timestamp");
+
$result = $node->safe_psql(
"certdb",
"SELECT value, critical FROM ssl_extension_info() WHERE name = 'basicConstraints';",
------=_Part_1248179_1719184966.1689618400561--
^ permalink raw reply [nested|flat] 16+ messages in thread
* [PATCH v12 4/4] Make use of pg_popcount() in more places.
@ 2026-02-10 18:40 Nathan Bossart <[email protected]>
0 siblings, 0 replies; 16+ messages in thread
From: Nathan Bossart @ 2026-02-10 18:40 UTC (permalink / raw)
This replaces some loops over word-length popcount functions with
calls to pg_popcount(). Since pg_popcount() uses a function
pointer for inputs with sizes >= a Bitmapset word, this produces a
small regression for the common one-word case in bms_num_members().
To deal with that, this commit adds an inlined fast-path for that
case. This fast-path could arguably go in pg_popcount() itself
(with an appropriate alignment check), but that is left for future
study.
Suggested-by: John Naylor <[email protected]>
Reviewed-by: John Naylor <[email protected]>
Discussion: https://postgr.es/m/CANWCAZY7R%2Biy%2Br9YM_sySNydHzNqUirx1xk0tB3ej5HO62GdgQ%40mail.gmail.com
---
src/backend/nodes/bitmapset.c | 29 +++++++----------------------
src/include/lib/radixtree.h | 6 +++---
2 files changed, 10 insertions(+), 25 deletions(-)
diff --git a/src/backend/nodes/bitmapset.c b/src/backend/nodes/bitmapset.c
index a4765876c31..786f343b3c9 100644
--- a/src/backend/nodes/bitmapset.c
+++ b/src/backend/nodes/bitmapset.c
@@ -553,14 +553,8 @@ bms_member_index(Bitmapset *a, int x)
bitnum = BITNUM(x);
/* count bits in preceding words */
- for (int i = 0; i < wordnum; i++)
- {
- bitmapword w = a->words[i];
-
- /* No need to count the bits in a zero word */
- if (w != 0)
- result += bmw_popcount(w);
- }
+ result += pg_popcount((const char *) a->words,
+ wordnum * sizeof(bitmapword));
/*
* Now add bits of the last word, but only those before the item. We can
@@ -749,26 +743,17 @@ bms_get_singleton_member(const Bitmapset *a, int *member)
int
bms_num_members(const Bitmapset *a)
{
- int result = 0;
- int nwords;
- int wordnum;
-
Assert(bms_is_valid_set(a));
if (a == NULL)
return 0;
- nwords = a->nwords;
- wordnum = 0;
- do
- {
- bitmapword w = a->words[wordnum];
+ /* fast-path for common case */
+ if (a->nwords == 1)
+ return bmw_popcount(a->words[0]);
- /* No need to count the bits in a zero word */
- if (w != 0)
- result += bmw_popcount(w);
- } while (++wordnum < nwords);
- return result;
+ return pg_popcount((const char *) a->words,
+ a->nwords * sizeof(bitmapword));
}
/*
diff --git a/src/include/lib/radixtree.h b/src/include/lib/radixtree.h
index b223ce10a2d..e6c9a591c17 100644
--- a/src/include/lib/radixtree.h
+++ b/src/include/lib/radixtree.h
@@ -2721,12 +2721,12 @@ RT_VERIFY_NODE(RT_NODE * node)
case RT_NODE_KIND_256:
{
RT_NODE_256 *n256 = (RT_NODE_256 *) node;
- int cnt = 0;
+ int cnt;
/* RT_DUMP_NODE(node); */
- for (int i = 0; i < RT_BM_IDX(RT_NODE_MAX_SLOTS); i++)
- cnt += bmw_popcount(n256->isset[i]);
+ cnt = pg_popcount((const char *) n256->isset,
+ RT_NODE_MAX_SLOTS / BITS_PER_BYTE);
/*
* Check if the number of used chunk matches, accounting for
--
2.50.1 (Apple Git-155)
--AFLuD1w+kMRlv6Zk--
^ permalink raw reply [nested|flat] 16+ messages in thread
* [PATCH] pg_stat_statements: add last_execution_start column
@ 2026-03-30 16:37 Pavlo Golub <[email protected]>
2026-03-30 21:33 ` Re: [PATCH] pg_stat_statements: add last_execution_start column Sami Imseih <[email protected]>
0 siblings, 1 reply; 16+ messages in thread
From: Pavlo Golub @ 2026-03-30 16:37 UTC (permalink / raw)
To: pgsql-hackers
Hi hackers,
This patch adds a `last_execution_start` column to `pg_stat_statements`,
recording the start timestamp of the most recent execution of each
tracked statement.
It supersedes the `stats_last_updated` series discussed here:
https://www.postgresql.org/message-id/flat/CAK7ymc+FxoVswo1ok_xDW-xPG-ZEZ8SAqCUkJ7WF04=0aQDvVQ@mail....
The main criticism of that series was performance using
`GetCurrentTimestamp()` inside the stats accumulation. pgbench testing
confirmed the concern of roughly 5–6% TPS regression on a
short-transaction workload.
This patch takes a different approach. Instead of calling
`GetCurrentTimestamp()`, it uses `GetCurrentStatementStartTimestamp()`,
which simply is a variable reading.
There is no syscall and no additional work in the hot path.
Benchmark (16-vCPU, pgbench -c8 -j4 -T60, explicit transactions with 15
SELECT statements each):
master HEAD: ~4574 TPS (runs: 4636, 4585, 4500)
patched: ~4571 TPS (runs: 4577, 4560, 4575)
difference: ~0.1%
The column is initialized to the entry allocation time and updated on
every call to `pgss_store()`. It is reset by
`pg_stat_statements_reset()` but preserved across minmax-only resets,
consistent with `stats_since` semantics.
A monitoring query to find statements that have executed since the last
observation could look like:
SELECT query, calls, last_execution_start
FROM pg_stat_statements
WHERE last_execution_start >= $1 -- e.g. last check timestamp
ORDER BY last_execution_start DESC;
Patch attached.
Best regards,
Pavlo Golub
Attachments:
[application/octet-stream] v1-0001-pg_stat_statements-Add-last_execution_start-colum.patch (18.2K, ../../[email protected]/2-v1-0001-pg_stat_statements-Add-last_execution_start-colum.patch)
download | inline diff:
From 84dd45604725a4a88b1d5782b9fc06c357ded074 Mon Sep 17 00:00:00 2001
From: Pavlo Golub <[email protected]>
Date: Thu, 5 Feb 2026 16:59:56 +0000
Subject: [PATCH v1] pg_stat_statements: Add last_execution_start column
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Add a new column last_execution_start to pg_stat_statements that records
the start timestamp of the most recent execution of each tracked statement.
The value is obtained via GetCurrentStatementStartTimestamp(), which reads
the already-computed xact_StartTimestamp variable — a simple load with no
system call. This means there is no measurable overhead on the critical
stats accumulation path.
Benchmark (16-vCPU, pgbench -c8 -j4 -T60, explicit transactions with 15 SELECT statements each):
master HEAD: ~4574 TPS (avg of 3 runs: 4636, 4585, 4500)
patched: ~4571 TPS (avg of 3 runs: 4577, 4560, 4575)
difference: ~0.1% — well within noise
The column is initialized at entry allocation time and updated on every
stats-recording call to pgss_store(). It is reset by
pg_stat_statements_reset() but not by minmax-only resets.
A monitoring query to find statements that have executed since the last
observation could look like:
SELECT query, calls, last_execution_start
FROM pg_stat_statements
WHERE last_execution_start >= $1 -- e.g. last check timestamp
ORDER BY last_execution_start DESC;
Bump PGSS_FILE_HEADER to 0x20260330 for the changed on-disk format.
---
contrib/pg_stat_statements/Makefile | 1 +
.../expected/entry_timestamp.out | 78 ++++++++++++++++++
contrib/pg_stat_statements/meson.build | 1 +
.../pg_stat_statements--1.13--1.14.sql | 79 +++++++++++++++++++
.../pg_stat_statements/pg_stat_statements.c | 45 ++++++++++-
.../pg_stat_statements.control | 2 +-
.../sql/entry_timestamp.sql | 48 +++++++++++
doc/src/sgml/pgstatstatements.sgml | 9 +++
8 files changed, 259 insertions(+), 4 deletions(-)
create mode 100644 contrib/pg_stat_statements/pg_stat_statements--1.13--1.14.sql
diff --git a/contrib/pg_stat_statements/Makefile b/contrib/pg_stat_statements/Makefile
index c27e9529bb6..d7142f71cf7 100644
--- a/contrib/pg_stat_statements/Makefile
+++ b/contrib/pg_stat_statements/Makefile
@@ -7,6 +7,7 @@ OBJS = \
EXTENSION = pg_stat_statements
DATA = pg_stat_statements--1.4.sql \
+ pg_stat_statements--1.13--1.14.sql \
pg_stat_statements--1.12--1.13.sql \
pg_stat_statements--1.11--1.12.sql pg_stat_statements--1.10--1.11.sql \
pg_stat_statements--1.9--1.10.sql pg_stat_statements--1.8--1.9.sql \
diff --git a/contrib/pg_stat_statements/expected/entry_timestamp.out b/contrib/pg_stat_statements/expected/entry_timestamp.out
index a10c4be6bac..db7382ea0a4 100644
--- a/contrib/pg_stat_statements/expected/entry_timestamp.out
+++ b/contrib/pg_stat_statements/expected/entry_timestamp.out
@@ -150,6 +150,84 @@ WHERE query LIKE '%STMTTS%';
2 | 1 | 2 | 0
(1 row)
+--
+-- last_execution_start timestamp tests
+--
+-- Reset stats first to avoid queryId collisions: simple "SELECT const AS alias"
+-- queries all share the same normalized structure as the STMTTS queries above,
+-- so EXECSTART entries would otherwise land on the pre-existing STMTTS entry.
+SELECT pg_stat_statements_reset() IS NOT NULL AS t;
+ t
+---
+ t
+(1 row)
+
+-- Capture a reference timestamp before running the tracked queries.
+SELECT now() AS ref_ts_upd1 \gset
+SELECT 1 AS "EXECSTART1";
+ EXECSTART1
+------------
+ 1
+(1 row)
+
+-- last_execution_start should be set and >= ref_ts_upd1, because the
+-- statement started after we captured the reference timestamp.
+SELECT
+ query,
+ last_execution_start IS NOT NULL as has_ts,
+ last_execution_start >= :'ref_ts_upd1' as after_ref1,
+ stats_since <= last_execution_start as after_stats_since
+FROM pg_stat_statements
+WHERE query LIKE '%EXECSTART%'
+ORDER BY query COLLATE "C";
+ query | has_ts | after_ref1 | after_stats_since
+---------------------------+--------+------------+-------------------
+ SELECT $1 AS "EXECSTART1" | t | t | f
+(1 row)
+
+-- Run EXECSTART1 again and verify that last_execution_start is updated.
+SELECT now() AS ref_ts_upd2 \gset
+SELECT 1 AS "EXECSTART1";
+ EXECSTART1
+------------
+ 1
+(1 row)
+
+SELECT
+ query,
+ last_execution_start >= :'ref_ts_upd2' as updated
+FROM pg_stat_statements
+WHERE query LIKE '%EXECSTART1%';
+ query | updated
+---------------------------+---------
+ SELECT $1 AS "EXECSTART1" | t
+(1 row)
+
+-- test filtering (monitoring use case): find statements that started
+-- executing since our last observation (ref_ts_upd2).
+SELECT count(*) as filtered_count
+FROM pg_stat_statements
+WHERE last_execution_start >= :'ref_ts_upd2'
+ AND query LIKE '%EXECSTART%';
+ filtered_count
+----------------
+ 1
+(1 row)
+
+-- minmax reset should not affect last_execution_start
+SELECT pg_stat_statements_reset(0, 0, queryid, true)
+FROM pg_stat_statements
+WHERE query LIKE '%EXECSTART1%' \gset
+SELECT
+ query,
+ last_execution_start >= :'ref_ts_upd2' as ts_preserved
+FROM pg_stat_statements
+WHERE query LIKE '%EXECSTART1%';
+ query | ts_preserved
+---------------------------+--------------
+ SELECT $1 AS "EXECSTART1" | t
+(1 row)
+
-- Cleanup
SELECT pg_stat_statements_reset() IS NOT NULL AS t;
t
diff --git a/contrib/pg_stat_statements/meson.build b/contrib/pg_stat_statements/meson.build
index 9d78cb88b7d..77148949c0d 100644
--- a/contrib/pg_stat_statements/meson.build
+++ b/contrib/pg_stat_statements/meson.build
@@ -21,6 +21,7 @@ contrib_targets += pg_stat_statements
install_data(
'pg_stat_statements.control',
'pg_stat_statements--1.4.sql',
+ 'pg_stat_statements--1.13--1.14.sql',
'pg_stat_statements--1.12--1.13.sql',
'pg_stat_statements--1.11--1.12.sql',
'pg_stat_statements--1.10--1.11.sql',
diff --git a/contrib/pg_stat_statements/pg_stat_statements--1.13--1.14.sql b/contrib/pg_stat_statements/pg_stat_statements--1.13--1.14.sql
new file mode 100644
index 00000000000..af4e177f5fa
--- /dev/null
+++ b/contrib/pg_stat_statements/pg_stat_statements--1.13--1.14.sql
@@ -0,0 +1,79 @@
+/* contrib/pg_stat_statements/pg_stat_statements--1.13--1.14.sql */
+
+-- complain if script is sourced in psql, rather than via ALTER EXTENSION
+\echo Use "ALTER EXTENSION pg_stat_statements UPDATE TO '1.14'" to load this file. \quit
+
+/* First we have to remove them from the extension */
+ALTER EXTENSION pg_stat_statements DROP VIEW pg_stat_statements;
+ALTER EXTENSION pg_stat_statements DROP FUNCTION pg_stat_statements(boolean);
+
+/* Then we can drop them */
+DROP VIEW pg_stat_statements;
+DROP FUNCTION pg_stat_statements(boolean);
+
+/* Now redefine */
+CREATE FUNCTION pg_stat_statements(IN showtext boolean,
+ OUT userid oid,
+ OUT dbid oid,
+ OUT toplevel bool,
+ OUT queryid bigint,
+ OUT query text,
+ OUT plans int8,
+ OUT total_plan_time float8,
+ OUT min_plan_time float8,
+ OUT max_plan_time float8,
+ OUT mean_plan_time float8,
+ OUT stddev_plan_time float8,
+ OUT calls int8,
+ OUT total_exec_time float8,
+ OUT min_exec_time float8,
+ OUT max_exec_time float8,
+ OUT mean_exec_time float8,
+ OUT stddev_exec_time float8,
+ OUT rows int8,
+ OUT shared_blks_hit int8,
+ OUT shared_blks_read int8,
+ OUT shared_blks_dirtied int8,
+ OUT shared_blks_written int8,
+ OUT local_blks_hit int8,
+ OUT local_blks_read int8,
+ OUT local_blks_dirtied int8,
+ OUT local_blks_written int8,
+ OUT temp_blks_read int8,
+ OUT temp_blks_written int8,
+ OUT shared_blk_read_time float8,
+ OUT shared_blk_write_time float8,
+ OUT local_blk_read_time float8,
+ OUT local_blk_write_time float8,
+ OUT temp_blk_read_time float8,
+ OUT temp_blk_write_time float8,
+ OUT wal_records int8,
+ OUT wal_fpi int8,
+ OUT wal_bytes numeric,
+ OUT wal_buffers_full int8,
+ OUT jit_functions int8,
+ OUT jit_generation_time float8,
+ OUT jit_inlining_count int8,
+ OUT jit_inlining_time float8,
+ OUT jit_optimization_count int8,
+ OUT jit_optimization_time float8,
+ OUT jit_emission_count int8,
+ OUT jit_emission_time float8,
+ OUT jit_deform_count int8,
+ OUT jit_deform_time float8,
+ OUT parallel_workers_to_launch int8,
+ OUT parallel_workers_launched int8,
+ OUT generic_plan_calls int8,
+ OUT custom_plan_calls int8,
+ OUT stats_since timestamp with time zone,
+ OUT minmax_stats_since timestamp with time zone,
+ OUT last_execution_start timestamp with time zone
+)
+RETURNS SETOF record
+AS 'MODULE_PATHNAME', 'pg_stat_statements_1_14'
+LANGUAGE C STRICT VOLATILE PARALLEL SAFE;
+
+CREATE VIEW pg_stat_statements AS
+ SELECT * FROM pg_stat_statements(true);
+
+GRANT SELECT ON pg_stat_statements TO PUBLIC;
diff --git a/contrib/pg_stat_statements/pg_stat_statements.c b/contrib/pg_stat_statements/pg_stat_statements.c
index 7975476b890..6beb26949cf 100644
--- a/contrib/pg_stat_statements/pg_stat_statements.c
+++ b/contrib/pg_stat_statements/pg_stat_statements.c
@@ -49,6 +49,7 @@
#include "access/htup_details.h"
#include "access/parallel.h"
+#include "access/xact.h"
#include "catalog/pg_authid.h"
#include "common/int.h"
#include "executor/instrument.h"
@@ -87,7 +88,7 @@ PG_MODULE_MAGIC_EXT(
#define PGSS_TEXT_FILE PG_STAT_TMP_DIR "/pgss_query_texts.stat"
/* Magic number identifying the stats file format */
-static const uint32 PGSS_FILE_HEADER = 0x20250731;
+static const uint32 PGSS_FILE_HEADER = 0x20260330;
/* PostgreSQL major version number, changes in which invalidate all entries */
static const uint32 PGSS_PG_MAJOR_VERSION = PG_VERSION_NUM / 100;
@@ -117,6 +118,7 @@ typedef enum pgssVersion
PGSS_V1_11,
PGSS_V1_12,
PGSS_V1_13,
+ PGSS_V1_14,
} pgssVersion;
typedef enum pgssStoreKind
@@ -241,6 +243,7 @@ typedef struct pgssEntry
int encoding; /* query text encoding */
TimestampTz stats_since; /* timestamp of entry allocation */
TimestampTz minmax_stats_since; /* timestamp of last min/max values reset */
+ TimestampTz last_execution_start; /* start timestamp of the last execution */
slock_t mutex; /* protects the counters only */
} pgssEntry;
@@ -328,6 +331,7 @@ PG_FUNCTION_INFO_V1(pg_stat_statements_1_10);
PG_FUNCTION_INFO_V1(pg_stat_statements_1_11);
PG_FUNCTION_INFO_V1(pg_stat_statements_1_12);
PG_FUNCTION_INFO_V1(pg_stat_statements_1_13);
+PG_FUNCTION_INFO_V1(pg_stat_statements_1_14);
PG_FUNCTION_INFO_V1(pg_stat_statements);
PG_FUNCTION_INFO_V1(pg_stat_statements_info);
@@ -674,6 +678,7 @@ pgss_shmem_startup(void)
entry->counters = temp.counters;
entry->stats_since = temp.stats_since;
entry->minmax_stats_since = temp.minmax_stats_since;
+ entry->last_execution_start = temp.last_execution_start;
}
/* Read global statistics for pg_stat_statements */
@@ -1409,8 +1414,16 @@ pgss_store(const char *query, int64 queryId,
/* Increment the counts, except when jstate is not NULL */
if (!jstate)
{
+ TimestampTz execution_start;
+
Assert(kind == PGSS_PLAN || kind == PGSS_EXEC);
+ /*
+ * GetCurrentStatementStartTimestamp() reads a variable set at statement
+ * start — no syscall needed, so we can call it under the spinlock.
+ */
+ execution_start = GetCurrentStatementStartTimestamp();
+
/*
* Grab the spinlock while updating the counters (see comment about
* locking rules at the head of the file)
@@ -1515,6 +1528,9 @@ pgss_store(const char *query, int64 queryId,
else if (planOrigin == PLAN_STMT_CACHE_CUSTOM)
entry->counters.custom_plan_calls++;
+ /* Record the start time of this execution */
+ entry->last_execution_start = execution_start;
+
SpinLockRelease(&entry->mutex);
}
@@ -1583,7 +1599,8 @@ pg_stat_statements_reset(PG_FUNCTION_ARGS)
#define PG_STAT_STATEMENTS_COLS_V1_11 49
#define PG_STAT_STATEMENTS_COLS_V1_12 52
#define PG_STAT_STATEMENTS_COLS_V1_13 54
-#define PG_STAT_STATEMENTS_COLS 54 /* maximum of above */
+#define PG_STAT_STATEMENTS_COLS_V1_14 55
+#define PG_STAT_STATEMENTS_COLS 55 /* maximum of above */
/*
* Retrieve statement statistics.
@@ -1595,6 +1612,16 @@ pg_stat_statements_reset(PG_FUNCTION_ARGS)
* expected API version is identified by embedding it in the C name of the
* function. Unfortunately we weren't bright enough to do that for 1.1.
*/
+Datum
+pg_stat_statements_1_14(PG_FUNCTION_ARGS)
+{
+ bool showtext = PG_GETARG_BOOL(0);
+
+ pg_stat_statements_internal(fcinfo, PGSS_V1_14, showtext);
+
+ return (Datum) 0;
+}
+
Datum
pg_stat_statements_1_13(PG_FUNCTION_ARGS)
{
@@ -1767,6 +1794,10 @@ pg_stat_statements_internal(FunctionCallInfo fcinfo,
if (api_version != PGSS_V1_13)
elog(ERROR, "incorrect number of output arguments");
break;
+ case PG_STAT_STATEMENTS_COLS_V1_14:
+ if (api_version != PGSS_V1_14)
+ elog(ERROR, "incorrect number of output arguments");
+ break;
default:
elog(ERROR, "incorrect number of output arguments");
}
@@ -1843,6 +1874,7 @@ pg_stat_statements_internal(FunctionCallInfo fcinfo,
int64 queryid = entry->key.queryid;
TimestampTz stats_since;
TimestampTz minmax_stats_since;
+ TimestampTz last_execution_start;
memset(values, 0, sizeof(values));
memset(nulls, 0, sizeof(nulls));
@@ -1911,11 +1943,12 @@ pg_stat_statements_internal(FunctionCallInfo fcinfo,
SpinLockRelease(&entry->mutex);
/*
- * The spinlock is not required when reading these two as they are
+ * The spinlock is not required when reading these three as they are
* always updated when holding pgss->lock exclusively.
*/
stats_since = entry->stats_since;
minmax_stats_since = entry->minmax_stats_since;
+ last_execution_start = entry->last_execution_start;
/* Skip entry if unexecuted (ie, it's a pending "sticky" entry) */
if (IS_STICKY(tmp))
@@ -2030,6 +2063,10 @@ pg_stat_statements_internal(FunctionCallInfo fcinfo,
values[i++] = TimestampTzGetDatum(stats_since);
values[i++] = TimestampTzGetDatum(minmax_stats_since);
}
+ if (api_version >= PGSS_V1_14)
+ {
+ values[i++] = TimestampTzGetDatum(last_execution_start);
+ }
Assert(i == (api_version == PGSS_V1_0 ? PG_STAT_STATEMENTS_COLS_V1_0 :
api_version == PGSS_V1_1 ? PG_STAT_STATEMENTS_COLS_V1_1 :
@@ -2041,6 +2078,7 @@ pg_stat_statements_internal(FunctionCallInfo fcinfo,
api_version == PGSS_V1_11 ? PG_STAT_STATEMENTS_COLS_V1_11 :
api_version == PGSS_V1_12 ? PG_STAT_STATEMENTS_COLS_V1_12 :
api_version == PGSS_V1_13 ? PG_STAT_STATEMENTS_COLS_V1_13 :
+ api_version == PGSS_V1_14 ? PG_STAT_STATEMENTS_COLS_V1_14 :
-1 /* fail if you forget to update this assert */ ));
tuplestore_putvalues(rsinfo->setResult, rsinfo->setDesc, values, nulls);
@@ -2148,6 +2186,7 @@ entry_alloc(pgssHashKey *key, Size query_offset, int query_len, int encoding,
entry->encoding = encoding;
entry->stats_since = GetCurrentTimestamp();
entry->minmax_stats_since = entry->stats_since;
+ entry->last_execution_start = entry->stats_since;
}
return entry;
diff --git a/contrib/pg_stat_statements/pg_stat_statements.control b/contrib/pg_stat_statements/pg_stat_statements.control
index 2eee0ceffa8..61ae41efc14 100644
--- a/contrib/pg_stat_statements/pg_stat_statements.control
+++ b/contrib/pg_stat_statements/pg_stat_statements.control
@@ -1,5 +1,5 @@
# pg_stat_statements extension
comment = 'track planning and execution statistics of all SQL statements executed'
-default_version = '1.13'
+default_version = '1.14'
module_pathname = '$libdir/pg_stat_statements'
relocatable = true
diff --git a/contrib/pg_stat_statements/sql/entry_timestamp.sql b/contrib/pg_stat_statements/sql/entry_timestamp.sql
index d6d3027ab4f..81f9c6315da 100644
--- a/contrib/pg_stat_statements/sql/entry_timestamp.sql
+++ b/contrib/pg_stat_statements/sql/entry_timestamp.sql
@@ -110,5 +110,53 @@ SELECT
FROM pg_stat_statements
WHERE query LIKE '%STMTTS%';
+--
+-- last_execution_start timestamp tests
+--
+-- Reset stats first to avoid queryId collisions: simple "SELECT const AS alias"
+-- queries all share the same normalized structure as the STMTTS queries above,
+-- so EXECSTART entries would otherwise land on the pre-existing STMTTS entry.
+SELECT pg_stat_statements_reset() IS NOT NULL AS t;
+-- Capture a reference timestamp before running the tracked queries.
+SELECT now() AS ref_ts_upd1 \gset
+SELECT 1 AS "EXECSTART1";
+-- last_execution_start should be set and >= ref_ts_upd1, because the
+-- statement started after we captured the reference timestamp.
+SELECT
+ query,
+ last_execution_start IS NOT NULL as has_ts,
+ last_execution_start >= :'ref_ts_upd1' as after_ref1,
+ stats_since <= last_execution_start as after_stats_since
+FROM pg_stat_statements
+WHERE query LIKE '%EXECSTART%'
+ORDER BY query COLLATE "C";
+
+-- Run EXECSTART1 again and verify that last_execution_start is updated.
+SELECT now() AS ref_ts_upd2 \gset
+SELECT 1 AS "EXECSTART1";
+SELECT
+ query,
+ last_execution_start >= :'ref_ts_upd2' as updated
+FROM pg_stat_statements
+WHERE query LIKE '%EXECSTART1%';
+
+-- test filtering (monitoring use case): find statements that started
+-- executing since our last observation (ref_ts_upd2).
+SELECT count(*) as filtered_count
+FROM pg_stat_statements
+WHERE last_execution_start >= :'ref_ts_upd2'
+ AND query LIKE '%EXECSTART%';
+
+-- minmax reset should not affect last_execution_start
+SELECT pg_stat_statements_reset(0, 0, queryid, true)
+FROM pg_stat_statements
+WHERE query LIKE '%EXECSTART1%' \gset
+
+SELECT
+ query,
+ last_execution_start >= :'ref_ts_upd2' as ts_preserved
+FROM pg_stat_statements
+WHERE query LIKE '%EXECSTART1%';
+
-- Cleanup
SELECT pg_stat_statements_reset() IS NOT NULL AS t;
diff --git a/doc/src/sgml/pgstatstatements.sgml b/doc/src/sgml/pgstatstatements.sgml
index d753de5836e..feea4730820 100644
--- a/doc/src/sgml/pgstatstatements.sgml
+++ b/doc/src/sgml/pgstatstatements.sgml
@@ -593,6 +593,15 @@
<structfield>max_exec_time</structfield>)
</para></entry>
</row>
+
+ <row>
+ <entry role="catalog_table_entry"><para role="column_definition">
+ <structfield>last_execution_start</structfield> <type>timestamp with time zone</type>
+ </para>
+ <para>
+ Time at which the most recent execution of this statement started
+ </para></entry>
+ </row>
</tbody>
</tgroup>
</table>
--
2.53.0
^ permalink raw reply [nested|flat] 16+ messages in thread
* Re: [PATCH] pg_stat_statements: add last_execution_start column
2026-03-30 16:37 [PATCH] pg_stat_statements: add last_execution_start column Pavlo Golub <[email protected]>
@ 2026-03-30 21:33 ` Sami Imseih <[email protected]>
2026-05-13 14:38 ` [PATCH v4] pg_stat_statements: Add last_execution_start column Pavlo Golub <[email protected]>
0 siblings, 1 reply; 16+ messages in thread
From: Sami Imseih @ 2026-03-30 21:33 UTC (permalink / raw)
To: Pavlo Golub <[email protected]>; +Cc: pgsql-hackers
Hi,
It would be really great to get this field in, but I think the current
implementation still suffers from the same issue that is mentioned
here [1]. We cannot rely on GetCurrentStatementStartTimestamp()
in-line because ExecutorEnd is deferred to the next execution in the
case of extended query protocol. I think we need to add it to track the
start timestamp in queryDesc. What do you think?
```
select pg_stat_statements_reset();
BEGIN;
select now() as now, clock_timestamp() as clock_timestamp,
pg_sleep($1) \bind 10 \g
\! sleep 10
SELECT now() as now, clock_timestamp() as clock_timestamp, $1 \bind 1 \g
END;
select last_execution_start, total_exec_time, substr(query, 1, 150) as
query from pg_stat_statements;
```
Notice how the last_execution_start reflects when the
"SELECT now() as now, clock_timestamp() as clock_timestamp, $1 " runs
--
Sami
[1] [https://www.postgresql.org/message-id/CAA5RZ0sxPWP2xm8fxhscE%2BcUqC2VSFi9UZ9882BdGZ0MbGQNUA%40mail.g...]
^ permalink raw reply [nested|flat] 16+ messages in thread
* [PATCH v4] pg_stat_statements: Add last_execution_start column
2026-03-30 16:37 [PATCH] pg_stat_statements: add last_execution_start column Pavlo Golub <[email protected]>
2026-03-30 21:33 ` Re: [PATCH] pg_stat_statements: add last_execution_start column Sami Imseih <[email protected]>
@ 2026-05-13 14:38 ` Pavlo Golub <[email protected]>
2026-06-04 10:00 ` Re: [PATCH v4] pg_stat_statements: Add last_execution_start column Anthonin Bonnefoy <[email protected]>
2026-06-04 20:54 ` Re: [PATCH v4] pg_stat_statements: Add last_execution_start column Zsolt Parragi <[email protected]>
2026-06-09 13:16 ` Re: [PATCH v4] pg_stat_statements: Add last_execution_start column Peter Eisentraut <[email protected]>
0 siblings, 3 replies; 16+ messages in thread
From: Pavlo Golub @ 2026-05-13 14:38 UTC (permalink / raw)
To: Sami Imseih <[email protected]>; +Cc: pgsql-hackers
Rebased on current master (a3e6beba60e).
The only conflict was with commit 66366217822 (pg_stat_statements: Set
PlannedStmt to NULL after nested utility execution), which introduced a
local copy of pstmt->planOrigin and then nulled pstmt. The patch context
line was updated to reference saved_planOrigin instead. No functional
changes from v3.
All pg_stat_statements regression tests pass (16/16).
v4 patch attached.
Best regards,
Pavlo Golub
Attachments:
[application/octet-stream] v4-0001-pg_stat_statements-Add-last_execution_start-colum.patch (23.7K, ../../CAK7ymcKezuTN43OQp0m5rcgqi9uZEBAknTyNiDmktRmxnFBq1g@mail.gmail.com/2-v4-0001-pg_stat_statements-Add-last_execution_start-colum.patch)
download | inline diff:
From 915d854216931f2f1e0888a8e41ec6d7da7e1cef Mon Sep 17 00:00:00 2001
From: Pavlo Golub <[email protected]>
Date: Wed, 1 Apr 2026 12:31:57 +0000
Subject: [PATCH] pg_stat_statements: Add last_execution_start column
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Add a new column last_execution_start to pg_stat_statements that records
the start timestamp of the most recent execution of each tracked statement.
The timestamp is captured at ExecutorStart time and stored in a new field
added to EState. This follows the same pattern as es_total_processed,
es_parallel_workers_to_launch, and other fields that are set by the
executor and consumed by pg_stat_statements.
This avoids the deferred-ExecutorEnd problem with extended query protocol
when ExecutorEnd for previous query is deferred until the next Bind message,
and GetCurrentStatementStartTimestamp() would return the next query timestamp.
For non-executor paths (planner hook, ProcessUtility), the timestamp is
still read inline from GetCurrentStatementStartTimestamp() because those
paths are never deferred.
Benchmark (16-vCPU, interleaved pgbench -c8 -j4 -T60):
master HEAD: ~4691 TPS (runs: 4849, 4588, 4635)
patched v3: ~4744 TPS (runs: 4870, 4735, 4627)
difference: ~1.1% — within noise
The column is initialized at entry allocation time and updated on every
stats-recording call to pgss_store(). It is reset by
pg_stat_statements_reset() but not by minmax-only resets.
Bump PGSS_FILE_HEADER to 0x20260330 for the changed on-disk format.
---
contrib/pg_stat_statements/Makefile | 1 +
.../expected/entry_timestamp.out | 123 ++++++++++++++++++
contrib/pg_stat_statements/meson.build | 1 +
.../pg_stat_statements--1.13--1.14.sql | 79 +++++++++++
.../pg_stat_statements/pg_stat_statements.c | 64 +++++++--
.../pg_stat_statements.control | 2 +-
.../sql/entry_timestamp.sql | 74 +++++++++++
doc/src/sgml/pgstatstatements.sgml | 12 ++
src/include/nodes/execnodes.h | 9 ++
9 files changed, 354 insertions(+), 11 deletions(-)
create mode 100644 contrib/pg_stat_statements/pg_stat_statements--1.13--1.14.sql
diff --git a/contrib/pg_stat_statements/Makefile b/contrib/pg_stat_statements/Makefile
index c27e9529bb6..d7142f71cf7 100644
--- a/contrib/pg_stat_statements/Makefile
+++ b/contrib/pg_stat_statements/Makefile
@@ -7,6 +7,7 @@ OBJS = \
EXTENSION = pg_stat_statements
DATA = pg_stat_statements--1.4.sql \
+ pg_stat_statements--1.13--1.14.sql \
pg_stat_statements--1.12--1.13.sql \
pg_stat_statements--1.11--1.12.sql pg_stat_statements--1.10--1.11.sql \
pg_stat_statements--1.9--1.10.sql pg_stat_statements--1.8--1.9.sql \
diff --git a/contrib/pg_stat_statements/expected/entry_timestamp.out b/contrib/pg_stat_statements/expected/entry_timestamp.out
index a10c4be6bac..b15153d4b2f 100644
--- a/contrib/pg_stat_statements/expected/entry_timestamp.out
+++ b/contrib/pg_stat_statements/expected/entry_timestamp.out
@@ -150,6 +150,129 @@ WHERE query LIKE '%STMTTS%';
2 | 1 | 2 | 0
(1 row)
+--
+-- last_execution_start timestamp tests
+--
+-- Reset stats first to avoid queryId collisions: simple "SELECT const AS alias"
+-- queries all share the same normalized structure as the STMTTS queries above,
+-- so EXECSTART entries would otherwise land on the pre-existing STMTTS entry.
+SELECT pg_stat_statements_reset() IS NOT NULL AS t;
+ t
+---
+ t
+(1 row)
+
+-- Capture a reference timestamp before running the tracked queries.
+SELECT now() AS ref_ts_upd1 \gset
+SELECT 1 AS "EXECSTART1";
+ EXECSTART1
+------------
+ 1
+(1 row)
+
+-- last_execution_start should be set and >= ref_ts_upd1, because the
+-- statement started after we captured the reference timestamp.
+SELECT
+ query,
+ last_execution_start IS NOT NULL as has_ts,
+ last_execution_start >= :'ref_ts_upd1' as after_ref1,
+ stats_since <= last_execution_start as after_stats_since
+FROM pg_stat_statements
+WHERE query LIKE '%EXECSTART%'
+ORDER BY query COLLATE "C";
+ query | has_ts | after_ref1 | after_stats_since
+---------------------------+--------+------------+-------------------
+ SELECT $1 AS "EXECSTART1" | t | t | f
+(1 row)
+
+-- Run EXECSTART1 again and verify that last_execution_start is updated.
+SELECT now() AS ref_ts_upd2 \gset
+SELECT 1 AS "EXECSTART1";
+ EXECSTART1
+------------
+ 1
+(1 row)
+
+SELECT
+ query,
+ last_execution_start >= :'ref_ts_upd2' as updated
+FROM pg_stat_statements
+WHERE query LIKE '%EXECSTART1%';
+ query | updated
+---------------------------+---------
+ SELECT $1 AS "EXECSTART1" | t
+(1 row)
+
+-- test filtering (monitoring use case): find statements that started
+-- executing since our last observation (ref_ts_upd2).
+SELECT count(*) as filtered_count
+FROM pg_stat_statements
+WHERE last_execution_start >= :'ref_ts_upd2'
+ AND query LIKE '%EXECSTART%';
+ filtered_count
+----------------
+ 1
+(1 row)
+
+-- minmax reset should not affect last_execution_start
+SELECT pg_stat_statements_reset(0, 0, queryid, true)
+FROM pg_stat_statements
+WHERE query LIKE '%EXECSTART1%' \gset
+SELECT
+ query,
+ last_execution_start >= :'ref_ts_upd2' as ts_preserved
+FROM pg_stat_statements
+WHERE query LIKE '%EXECSTART1%';
+ query | ts_preserved
+---------------------------+--------------
+ SELECT $1 AS "EXECSTART1" | t
+(1 row)
+
+--
+-- Deferred ExecutorEnd test (extended query protocol)
+--
+-- In the extended query protocol the previous query's ExecutorEnd is
+-- deferred until the next Bind message, at which point
+-- GetCurrentStatementStartTimestamp() already reflects the *new* query.
+-- Verify that last_execution_start still records the *old* query's start.
+--
+SELECT pg_stat_statements_reset() IS NOT NULL AS t;
+ t
+---
+ t
+(1 row)
+
+SELECT now() AS ref_ts_ext \gset
+-- Use \bind \g to force the extended query protocol.
+SELECT pg_sleep(0.5) AS "DEFERRED_END" \bind \g
+ DEFERRED_END
+--------------
+
+(1 row)
+
+-- Capture a timestamp *after* the sleep finishes but *before* the next
+-- extended-protocol statement replaces the unnamed portal.
+SELECT now() AS ref_ts_ext2 \gset
+SELECT 1 AS "TRIGGER_END" \bind \g
+ TRIGGER_END
+-------------
+ 1
+(1 row)
+
+-- The pg_sleep query's last_execution_start should be close to ref_ts_ext
+-- (before the sleep), NOT to ref_ts_ext2 (after the sleep).
+SELECT
+ query,
+ last_execution_start >= :'ref_ts_ext' as after_start,
+ last_execution_start < :'ref_ts_ext2' as before_next
+FROM pg_stat_statements
+WHERE query LIKE '%DEFERRED_END%'
+ORDER BY query COLLATE "C";
+ query | after_start | before_next
+---------------------------------------+-------------+-------------
+ SELECT pg_sleep($1) AS "DEFERRED_END" | t | t
+(1 row)
+
-- Cleanup
SELECT pg_stat_statements_reset() IS NOT NULL AS t;
t
diff --git a/contrib/pg_stat_statements/meson.build b/contrib/pg_stat_statements/meson.build
index 9d78cb88b7d..77148949c0d 100644
--- a/contrib/pg_stat_statements/meson.build
+++ b/contrib/pg_stat_statements/meson.build
@@ -21,6 +21,7 @@ contrib_targets += pg_stat_statements
install_data(
'pg_stat_statements.control',
'pg_stat_statements--1.4.sql',
+ 'pg_stat_statements--1.13--1.14.sql',
'pg_stat_statements--1.12--1.13.sql',
'pg_stat_statements--1.11--1.12.sql',
'pg_stat_statements--1.10--1.11.sql',
diff --git a/contrib/pg_stat_statements/pg_stat_statements--1.13--1.14.sql b/contrib/pg_stat_statements/pg_stat_statements--1.13--1.14.sql
new file mode 100644
index 00000000000..af4e177f5fa
--- /dev/null
+++ b/contrib/pg_stat_statements/pg_stat_statements--1.13--1.14.sql
@@ -0,0 +1,79 @@
+/* contrib/pg_stat_statements/pg_stat_statements--1.13--1.14.sql */
+
+-- complain if script is sourced in psql, rather than via ALTER EXTENSION
+\echo Use "ALTER EXTENSION pg_stat_statements UPDATE TO '1.14'" to load this file. \quit
+
+/* First we have to remove them from the extension */
+ALTER EXTENSION pg_stat_statements DROP VIEW pg_stat_statements;
+ALTER EXTENSION pg_stat_statements DROP FUNCTION pg_stat_statements(boolean);
+
+/* Then we can drop them */
+DROP VIEW pg_stat_statements;
+DROP FUNCTION pg_stat_statements(boolean);
+
+/* Now redefine */
+CREATE FUNCTION pg_stat_statements(IN showtext boolean,
+ OUT userid oid,
+ OUT dbid oid,
+ OUT toplevel bool,
+ OUT queryid bigint,
+ OUT query text,
+ OUT plans int8,
+ OUT total_plan_time float8,
+ OUT min_plan_time float8,
+ OUT max_plan_time float8,
+ OUT mean_plan_time float8,
+ OUT stddev_plan_time float8,
+ OUT calls int8,
+ OUT total_exec_time float8,
+ OUT min_exec_time float8,
+ OUT max_exec_time float8,
+ OUT mean_exec_time float8,
+ OUT stddev_exec_time float8,
+ OUT rows int8,
+ OUT shared_blks_hit int8,
+ OUT shared_blks_read int8,
+ OUT shared_blks_dirtied int8,
+ OUT shared_blks_written int8,
+ OUT local_blks_hit int8,
+ OUT local_blks_read int8,
+ OUT local_blks_dirtied int8,
+ OUT local_blks_written int8,
+ OUT temp_blks_read int8,
+ OUT temp_blks_written int8,
+ OUT shared_blk_read_time float8,
+ OUT shared_blk_write_time float8,
+ OUT local_blk_read_time float8,
+ OUT local_blk_write_time float8,
+ OUT temp_blk_read_time float8,
+ OUT temp_blk_write_time float8,
+ OUT wal_records int8,
+ OUT wal_fpi int8,
+ OUT wal_bytes numeric,
+ OUT wal_buffers_full int8,
+ OUT jit_functions int8,
+ OUT jit_generation_time float8,
+ OUT jit_inlining_count int8,
+ OUT jit_inlining_time float8,
+ OUT jit_optimization_count int8,
+ OUT jit_optimization_time float8,
+ OUT jit_emission_count int8,
+ OUT jit_emission_time float8,
+ OUT jit_deform_count int8,
+ OUT jit_deform_time float8,
+ OUT parallel_workers_to_launch int8,
+ OUT parallel_workers_launched int8,
+ OUT generic_plan_calls int8,
+ OUT custom_plan_calls int8,
+ OUT stats_since timestamp with time zone,
+ OUT minmax_stats_since timestamp with time zone,
+ OUT last_execution_start timestamp with time zone
+)
+RETURNS SETOF record
+AS 'MODULE_PATHNAME', 'pg_stat_statements_1_14'
+LANGUAGE C STRICT VOLATILE PARALLEL SAFE;
+
+CREATE VIEW pg_stat_statements AS
+ SELECT * FROM pg_stat_statements(true);
+
+GRANT SELECT ON pg_stat_statements TO PUBLIC;
diff --git a/contrib/pg_stat_statements/pg_stat_statements.c b/contrib/pg_stat_statements/pg_stat_statements.c
index 92315627916..d4dfcf74926 100644
--- a/contrib/pg_stat_statements/pg_stat_statements.c
+++ b/contrib/pg_stat_statements/pg_stat_statements.c
@@ -49,6 +49,7 @@
#include "access/htup_details.h"
#include "access/parallel.h"
+#include "access/xact.h"
#include "catalog/pg_authid.h"
#include "executor/instrument.h"
#include "funcapi.h"
@@ -85,7 +86,7 @@ PG_MODULE_MAGIC_EXT(
#define PGSS_TEXT_FILE PG_STAT_TMP_DIR "/pgss_query_texts.stat"
/* Magic number identifying the stats file format */
-static const uint32 PGSS_FILE_HEADER = 0x20250731;
+static const uint32 PGSS_FILE_HEADER = 0x20260330;
/* PostgreSQL major version number, changes in which invalidate all entries */
static const uint32 PGSS_PG_MAJOR_VERSION = PG_VERSION_NUM / 100;
@@ -115,6 +116,7 @@ typedef enum pgssVersion
PGSS_V1_11,
PGSS_V1_12,
PGSS_V1_13,
+ PGSS_V1_14,
} pgssVersion;
typedef enum pgssStoreKind
@@ -238,7 +240,8 @@ typedef struct pgssEntry
int query_len; /* # of valid bytes in query string, or -1 */
int encoding; /* query text encoding */
TimestampTz stats_since; /* timestamp of entry allocation */
- TimestampTz minmax_stats_since; /* timestamp of last min/max values reset */
+ TimestampTz minmax_stats_since; /* timestamp of last min/max values reset */
+ TimestampTz last_execution_start; /* start timestamp of the last execution */
slock_t mutex; /* protects the counters only */
} pgssEntry;
@@ -332,6 +335,7 @@ PG_FUNCTION_INFO_V1(pg_stat_statements_1_10);
PG_FUNCTION_INFO_V1(pg_stat_statements_1_11);
PG_FUNCTION_INFO_V1(pg_stat_statements_1_12);
PG_FUNCTION_INFO_V1(pg_stat_statements_1_13);
+PG_FUNCTION_INFO_V1(pg_stat_statements_1_14);
PG_FUNCTION_INFO_V1(pg_stat_statements);
PG_FUNCTION_INFO_V1(pg_stat_statements_info);
@@ -364,7 +368,8 @@ static void pgss_store(const char *query, int64 queryId,
const JumbleState *jstate,
int parallel_workers_to_launch,
int parallel_workers_launched,
- PlannedStmtOrigin planOrigin);
+ PlannedStmtOrigin planOrigin,
+ TimestampTz exec_start);
static void pg_stat_statements_internal(FunctionCallInfo fcinfo,
pgssVersion api_version,
bool showtext);
@@ -664,6 +669,7 @@ pgss_shmem_init(void *arg)
entry->counters = temp.counters;
entry->stats_since = temp.stats_since;
entry->minmax_stats_since = temp.minmax_stats_since;
+ entry->last_execution_start = temp.last_execution_start;
}
/* Read global statistics for pg_stat_statements */
@@ -876,7 +882,8 @@ pgss_post_parse_analyze(ParseState *pstate, Query *query, const JumbleState *jst
jstate,
0,
0,
- PLAN_STMT_UNKNOWN);
+ PLAN_STMT_UNKNOWN,
+ 0);
}
/*
@@ -958,7 +965,8 @@ pgss_planner(Query *parse,
NULL,
0,
0,
- result->planOrigin);
+ result->planOrigin,
+ GetCurrentStatementStartTimestamp());
}
else
{
@@ -1008,6 +1016,13 @@ pgss_ExecutorStart(QueryDesc *queryDesc, int eflags)
prev_ExecutorStart(queryDesc, eflags);
else
standard_ExecutorStart(queryDesc, eflags);
+
+ /*
+ * Capture the statement start timestamp into EState here after the estate
+ * has been created by standard_ExecutorStart.
+ */
+ if (pgss_enabled(nesting_level) && queryDesc->plannedstmt->queryId != INT64CONST(0))
+ queryDesc->estate->es_exec_start = GetCurrentStatementStartTimestamp();
}
/*
@@ -1076,7 +1091,8 @@ pgss_ExecutorEnd(QueryDesc *queryDesc)
NULL,
queryDesc->estate->es_parallel_workers_to_launch,
queryDesc->estate->es_parallel_workers_launched,
- queryDesc->plannedstmt->planOrigin);
+ queryDesc->plannedstmt->planOrigin,
+ queryDesc->estate->es_exec_start);
}
if (prev_ExecutorEnd)
@@ -1212,7 +1228,8 @@ pgss_ProcessUtility(PlannedStmt *pstmt, const char *queryString,
NULL,
0,
0,
- saved_planOrigin);
+ saved_planOrigin,
+ GetCurrentStatementStartTimestamp());
}
else
{
@@ -1276,7 +1293,8 @@ pgss_store(const char *query, int64 queryId,
const JumbleState *jstate,
int parallel_workers_to_launch,
int parallel_workers_launched,
- PlannedStmtOrigin planOrigin)
+ PlannedStmtOrigin planOrigin,
+ TimestampTz exec_start)
{
pgssHashKey key;
pgssEntry *entry;
@@ -1490,6 +1508,9 @@ pgss_store(const char *query, int64 queryId,
else if (planOrigin == PLAN_STMT_CACHE_CUSTOM)
entry->counters.custom_plan_calls++;
+ /* Record the start time of this execution */
+ entry->last_execution_start = exec_start;
+
SpinLockRelease(&entry->mutex);
}
@@ -1558,7 +1579,8 @@ pg_stat_statements_reset(PG_FUNCTION_ARGS)
#define PG_STAT_STATEMENTS_COLS_V1_11 49
#define PG_STAT_STATEMENTS_COLS_V1_12 52
#define PG_STAT_STATEMENTS_COLS_V1_13 54
-#define PG_STAT_STATEMENTS_COLS 54 /* maximum of above */
+#define PG_STAT_STATEMENTS_COLS_V1_14 55
+#define PG_STAT_STATEMENTS_COLS 55 /* maximum of above */
/*
* Retrieve statement statistics.
@@ -1570,6 +1592,16 @@ pg_stat_statements_reset(PG_FUNCTION_ARGS)
* expected API version is identified by embedding it in the C name of the
* function. Unfortunately we weren't bright enough to do that for 1.1.
*/
+Datum
+pg_stat_statements_1_14(PG_FUNCTION_ARGS)
+{
+ bool showtext = PG_GETARG_BOOL(0);
+
+ pg_stat_statements_internal(fcinfo, PGSS_V1_14, showtext);
+
+ return (Datum) 0;
+}
+
Datum
pg_stat_statements_1_13(PG_FUNCTION_ARGS)
{
@@ -1742,6 +1774,10 @@ pg_stat_statements_internal(FunctionCallInfo fcinfo,
if (api_version != PGSS_V1_13)
elog(ERROR, "incorrect number of output arguments");
break;
+ case PG_STAT_STATEMENTS_COLS_V1_14:
+ if (api_version != PGSS_V1_14)
+ elog(ERROR, "incorrect number of output arguments");
+ break;
default:
elog(ERROR, "incorrect number of output arguments");
}
@@ -1818,6 +1854,7 @@ pg_stat_statements_internal(FunctionCallInfo fcinfo,
int64 queryid = entry->key.queryid;
TimestampTz stats_since;
TimestampTz minmax_stats_since;
+ TimestampTz last_execution_start;
memset(values, 0, sizeof(values));
memset(nulls, 0, sizeof(nulls));
@@ -1886,11 +1923,12 @@ pg_stat_statements_internal(FunctionCallInfo fcinfo,
SpinLockRelease(&entry->mutex);
/*
- * The spinlock is not required when reading these two as they are
+ * The spinlock is not required when reading these three as they are
* always updated when holding pgss->lock exclusively.
*/
stats_since = entry->stats_since;
minmax_stats_since = entry->minmax_stats_since;
+ last_execution_start = entry->last_execution_start;
/* Skip entry if unexecuted (ie, it's a pending "sticky" entry) */
if (IS_STICKY(tmp))
@@ -2005,6 +2043,10 @@ pg_stat_statements_internal(FunctionCallInfo fcinfo,
values[i++] = TimestampTzGetDatum(stats_since);
values[i++] = TimestampTzGetDatum(minmax_stats_since);
}
+ if (api_version >= PGSS_V1_14)
+ {
+ values[i++] = TimestampTzGetDatum(last_execution_start);
+ }
Assert(i == (api_version == PGSS_V1_0 ? PG_STAT_STATEMENTS_COLS_V1_0 :
api_version == PGSS_V1_1 ? PG_STAT_STATEMENTS_COLS_V1_1 :
@@ -2016,6 +2058,7 @@ pg_stat_statements_internal(FunctionCallInfo fcinfo,
api_version == PGSS_V1_11 ? PG_STAT_STATEMENTS_COLS_V1_11 :
api_version == PGSS_V1_12 ? PG_STAT_STATEMENTS_COLS_V1_12 :
api_version == PGSS_V1_13 ? PG_STAT_STATEMENTS_COLS_V1_13 :
+ api_version == PGSS_V1_14 ? PG_STAT_STATEMENTS_COLS_V1_14 :
-1 /* fail if you forget to update this assert */ ));
tuplestore_putvalues(rsinfo->setResult, rsinfo->setDesc, values, nulls);
@@ -2109,6 +2152,7 @@ entry_alloc(pgssHashKey *key, Size query_offset, int query_len, int encoding,
entry->encoding = encoding;
entry->stats_since = GetCurrentTimestamp();
entry->minmax_stats_since = entry->stats_since;
+ entry->last_execution_start = entry->stats_since;
}
return entry;
diff --git a/contrib/pg_stat_statements/pg_stat_statements.control b/contrib/pg_stat_statements/pg_stat_statements.control
index 2eee0ceffa8..61ae41efc14 100644
--- a/contrib/pg_stat_statements/pg_stat_statements.control
+++ b/contrib/pg_stat_statements/pg_stat_statements.control
@@ -1,5 +1,5 @@
# pg_stat_statements extension
comment = 'track planning and execution statistics of all SQL statements executed'
-default_version = '1.13'
+default_version = '1.14'
module_pathname = '$libdir/pg_stat_statements'
relocatable = true
diff --git a/contrib/pg_stat_statements/sql/entry_timestamp.sql b/contrib/pg_stat_statements/sql/entry_timestamp.sql
index d6d3027ab4f..2822519dd68 100644
--- a/contrib/pg_stat_statements/sql/entry_timestamp.sql
+++ b/contrib/pg_stat_statements/sql/entry_timestamp.sql
@@ -110,5 +110,79 @@ SELECT
FROM pg_stat_statements
WHERE query LIKE '%STMTTS%';
+--
+-- last_execution_start timestamp tests
+--
+-- Reset stats first to avoid queryId collisions: simple "SELECT const AS alias"
+-- queries all share the same normalized structure as the STMTTS queries above,
+-- so EXECSTART entries would otherwise land on the pre-existing STMTTS entry.
+SELECT pg_stat_statements_reset() IS NOT NULL AS t;
+-- Capture a reference timestamp before running the tracked queries.
+SELECT now() AS ref_ts_upd1 \gset
+SELECT 1 AS "EXECSTART1";
+-- last_execution_start should be set and >= ref_ts_upd1, because the
+-- statement started after we captured the reference timestamp.
+SELECT
+ query,
+ last_execution_start IS NOT NULL as has_ts,
+ last_execution_start >= :'ref_ts_upd1' as after_ref1,
+ stats_since <= last_execution_start as after_stats_since
+FROM pg_stat_statements
+WHERE query LIKE '%EXECSTART%'
+ORDER BY query COLLATE "C";
+
+-- Run EXECSTART1 again and verify that last_execution_start is updated.
+SELECT now() AS ref_ts_upd2 \gset
+SELECT 1 AS "EXECSTART1";
+SELECT
+ query,
+ last_execution_start >= :'ref_ts_upd2' as updated
+FROM pg_stat_statements
+WHERE query LIKE '%EXECSTART1%';
+
+-- test filtering (monitoring use case): find statements that started
+-- executing since our last observation (ref_ts_upd2).
+SELECT count(*) as filtered_count
+FROM pg_stat_statements
+WHERE last_execution_start >= :'ref_ts_upd2'
+ AND query LIKE '%EXECSTART%';
+
+-- minmax reset should not affect last_execution_start
+SELECT pg_stat_statements_reset(0, 0, queryid, true)
+FROM pg_stat_statements
+WHERE query LIKE '%EXECSTART1%' \gset
+
+SELECT
+ query,
+ last_execution_start >= :'ref_ts_upd2' as ts_preserved
+FROM pg_stat_statements
+WHERE query LIKE '%EXECSTART1%';
+
+--
+-- Deferred ExecutorEnd test (extended query protocol)
+--
+-- In the extended query protocol the previous query's ExecutorEnd is
+-- deferred until the next Bind message, at which point
+-- GetCurrentStatementStartTimestamp() already reflects the *new* query.
+-- Verify that last_execution_start still records the *old* query's start.
+--
+SELECT pg_stat_statements_reset() IS NOT NULL AS t;
+SELECT now() AS ref_ts_ext \gset
+-- Use \bind \g to force the extended query protocol.
+SELECT pg_sleep(0.5) AS "DEFERRED_END" \bind \g
+-- Capture a timestamp *after* the sleep finishes but *before* the next
+-- extended-protocol statement replaces the unnamed portal.
+SELECT now() AS ref_ts_ext2 \gset
+SELECT 1 AS "TRIGGER_END" \bind \g
+-- The pg_sleep query's last_execution_start should be close to ref_ts_ext
+-- (before the sleep), NOT to ref_ts_ext2 (after the sleep).
+SELECT
+ query,
+ last_execution_start >= :'ref_ts_ext' as after_start,
+ last_execution_start < :'ref_ts_ext2' as before_next
+FROM pg_stat_statements
+WHERE query LIKE '%DEFERRED_END%'
+ORDER BY query COLLATE "C";
+
-- Cleanup
SELECT pg_stat_statements_reset() IS NOT NULL AS t;
diff --git a/doc/src/sgml/pgstatstatements.sgml b/doc/src/sgml/pgstatstatements.sgml
index d753de5836e..57752ca0284 100644
--- a/doc/src/sgml/pgstatstatements.sgml
+++ b/doc/src/sgml/pgstatstatements.sgml
@@ -593,6 +593,18 @@
<structfield>max_exec_time</structfield>)
</para></entry>
</row>
+
+ <row>
+ <entry role="catalog_table_entry"><para role="column_definition">
+ <structfield>last_execution_start</structfield> <type>timestamp with time zone</type>
+ </para>
+ <para>
+ Time at which the most recent execution of this statement started.
+ For nested statements (<structfield>toplevel</structfield> = false),
+ this is the start time of the top-level statement that caused the
+ nested statement to be executed.
+ </para></entry>
+ </row>
</tbody>
</tgroup>
</table>
diff --git a/src/include/nodes/execnodes.h b/src/include/nodes/execnodes.h
index 13359180d25..5e65ef0e62b 100644
--- a/src/include/nodes/execnodes.h
+++ b/src/include/nodes/execnodes.h
@@ -30,6 +30,7 @@
#define EXECNODES_H
#include "access/htup.h"
+#include "datatype/timestamp.h"
#include "executor/instrument_node.h"
#include "fmgr.h"
#include "lib/ilist.h"
@@ -784,6 +785,14 @@ typedef struct EState
int es_parallel_workers_launched; /* number of workers actually
* launched. */
+ /*
+ * Statement start timestamp captured at ExecutorStart time. We store
+ * this here so that extensions (e.g. pg_stat_statements) can read the
+ * correct start time at ExecutorEnd, even when ExecutorEnd is deferred
+ * to a later Bind message in the extended query protocol.
+ */
+ TimestampTz es_exec_start;
+
/* The per-query shared memory area to use for parallel execution. */
struct dsa_area *es_query_dsa;
--
2.53.0
^ permalink raw reply [nested|flat] 16+ messages in thread
* Re: [PATCH v4] pg_stat_statements: Add last_execution_start column
2026-03-30 16:37 [PATCH] pg_stat_statements: add last_execution_start column Pavlo Golub <[email protected]>
2026-03-30 21:33 ` Re: [PATCH] pg_stat_statements: add last_execution_start column Sami Imseih <[email protected]>
2026-05-13 14:38 ` [PATCH v4] pg_stat_statements: Add last_execution_start column Pavlo Golub <[email protected]>
@ 2026-06-04 10:00 ` Anthonin Bonnefoy <[email protected]>
2 siblings, 0 replies; 16+ messages in thread
From: Anthonin Bonnefoy @ 2026-06-04 10:00 UTC (permalink / raw)
To: Pavlo Golub <[email protected]>; +Cc: Sami Imseih <[email protected]>; pgsql-hackers
Hi,
The code looks good. Some comments on the tests:
+-- last_execution_start timestamp tests
+--
+-- Reset stats first to avoid queryId collisions: simple "SELECT
const AS alias"
+-- queries all share the same normalized structure as the STMTTS queries above,
+-- so EXECSTART entries would otherwise land on the pre-existing STMTTS entry.
+SELECT pg_stat_statements_reset() IS NOT NULL AS t;
I don't think the comment on queryId collision is necessary. Looking
at other tests, it's a common pattern to do a pgss reset before
starting a set of tests.
+-- last_execution_start should be set and >= ref_ts_upd1, because the
+-- statement started after we captured the reference timestamp.
+SELECT
+ query,
+ last_execution_start IS NOT NULL as has_ts,
+ last_execution_start >= :'ref_ts_upd1' as after_ref1,
+ stats_since <= last_execution_start as after_stats_since
+FROM pg_stat_statements
+WHERE query LIKE '%EXECSTART%'
+ORDER BY query COLLATE "C";
The test is also checking stats_since and shows that
last_execution_start < stats_since, is it necessary? The result is
also a bit confusing, but makes sense since stats_since is the time
the entry is created in pgss, which happens before ExecutorEnd.
+-- Run EXECSTART1 again and verify that last_execution_start is updated.
+SELECT now() AS ref_ts_upd2 \gset
+SELECT 1 AS "EXECSTART1";
+SELECT
+ query,
+ last_execution_start >= :'ref_ts_upd2' as updated
+FROM pg_stat_statements
+WHERE query LIKE '%EXECSTART1%';
+
+-- test filtering (monitoring use case): find statements that started
+-- executing since our last observation (ref_ts_upd2).
+SELECT count(*) as filtered_count
+FROM pg_stat_statements
+WHERE last_execution_start >= :'ref_ts_upd2'
+ AND query LIKE '%EXECSTART%';
The 'test filtering' feels redundant, we already have the list of
queries executed after ref_ts_upd2.
+SELECT now() AS ref_ts_ext \gset
+-- Use \bind \g to force the extended query protocol.
+SELECT pg_sleep(0.5) AS "DEFERRED_END" \bind \g
+-- Capture a timestamp *after* the sleep finishes but *before* the next
+-- extended-protocol statement replaces the unnamed portal.
+SELECT now() AS ref_ts_ext2 \gset
+-- The pg_sleep query's last_execution_start should be close to ref_ts_ext
+-- (before the sleep), NOT to ref_ts_ext2 (after the sleep).
I think the test doesn't work, or at least, doesn't check what you're
expecting. If I set last_execution_start to
GetCurrentStatementStartTimestamp(), it still passes.
When using the extended protocol with \bind \g, a Sync message is
immediately sent, and since you're in an implicit transaction,
finish_xact_command will drop the portal and call ExecutorEnd. Also,
doing a `SELECT now()` closes the unnamed portal, even when using the
simple protocol.
You could do something like that (and avoid a pg_sleep):
BEGIN;
SELECT 1 AS DEFERRED_END, statement_timestamp() AS query_stmt_ts \bind \gset
-- With an explicit transaction + extended protocol, the portal is left opened
-- ExecutorEnd will only be called when the next command is processed
END;
SELECT query, last_execution_start < :'query_stmt_ts' as before_next
FROM pg_stat_statements
WHERE query LIKE '%DEFERRED_END%'
ORDER BY query COLLATE "C";
With entry->last_execution_start =
GetCurrentStatementStartTimestamp(), you will have
last_execution_start > query_stmt_ts since it will be using END's
statement_start.
With entry->last_execution_start = exec_start, you use the statement
start set during the Bind message, which should be smaller than
statement_timestamp() (which is the statement start set during the
Execute message).
On that note, I wonder if relying on
GetCurrentStatementStartTimestamp() wouldn't be good enough? That
would remove the need to keep track of this state in EState.
Regards,
Anthonin Bonnefoy
^ permalink raw reply [nested|flat] 16+ messages in thread
* Re: [PATCH v4] pg_stat_statements: Add last_execution_start column
2026-03-30 16:37 [PATCH] pg_stat_statements: add last_execution_start column Pavlo Golub <[email protected]>
2026-03-30 21:33 ` Re: [PATCH] pg_stat_statements: add last_execution_start column Sami Imseih <[email protected]>
2026-05-13 14:38 ` [PATCH v4] pg_stat_statements: Add last_execution_start column Pavlo Golub <[email protected]>
@ 2026-06-04 20:54 ` Zsolt Parragi <[email protected]>
2 siblings, 0 replies; 16+ messages in thread
From: Zsolt Parragi @ 2026-06-04 20:54 UTC (permalink / raw)
To: [email protected]
Hello!
The write happens inside the spinlock and shared pgss->lock:
+ /* Record the start time of this execution */
+ entry->last_execution_start = exec_start;
+
SpinLockRelease(&entry->mutex);
And then at the read, we see:
/*
- * The spinlock is not required when reading these two as they are
+ * The spinlock is not required when reading these three as they are
* always updated when holding pgss->lock exclusively.
*/
stats_since = entry->stats_since;
minmax_stats_since = entry->minmax_stats_since;
+ last_execution_start = entry->last_execution_start;
But that comment doesn't seem true, it is updated with a shared lock,
not exclusive. Shouldn't it be read together with the counters above
this?
^ permalink raw reply [nested|flat] 16+ messages in thread
* Re: [PATCH v4] pg_stat_statements: Add last_execution_start column
2026-03-30 16:37 [PATCH] pg_stat_statements: add last_execution_start column Pavlo Golub <[email protected]>
2026-03-30 21:33 ` Re: [PATCH] pg_stat_statements: add last_execution_start column Sami Imseih <[email protected]>
2026-05-13 14:38 ` [PATCH v4] pg_stat_statements: Add last_execution_start column Pavlo Golub <[email protected]>
@ 2026-06-09 13:16 ` Peter Eisentraut <[email protected]>
2026-06-09 21:31 ` Re: [PATCH v4] pg_stat_statements: Add last_execution_start column Sami Imseih <[email protected]>
2 siblings, 1 reply; 16+ messages in thread
From: Peter Eisentraut @ 2026-06-09 13:16 UTC (permalink / raw)
To: Pavlo Golub <[email protected]>; Sami Imseih <[email protected]>; +Cc: pgsql-hackers
On 13.05.26 16:38, Pavlo Golub wrote:
> Rebased on current master (a3e6beba60e).
>
> The only conflict was with commit 66366217822 (pg_stat_statements: Set
> PlannedStmt to NULL after nested utility execution), which introduced a
> local copy of pstmt->planOrigin and then nulled pstmt. The patch context
> line was updated to reference saved_planOrigin instead. No functional
> changes from v3.
>
> All pg_stat_statements regression tests pass (16/16).
>
> v4 patch attached.
Here is a summary of the feedback comments we discussed at pgconf.dev:
(Some of these might have applied to previous patch versions.)
technical:
- obvious concerns: getting current time is expensive (inside spinlock!)
- documenting intended use of the field is good, I would put that back
- issues with long-running queries, start time vs. end time -- ignores
analytics use cases
- argument total_time of pgss_store() is not documented, should be fixed
first -- also why is this double??
- issues with extended query protocol can be surprising
- comment says it can be executed under spinlock but then it's not
- only top-level statements? -- not acceptable IMO
code style:
- INT64CONST is useless
- when changing "two" to "three" in a comment, just delete the number
meta/process:
- good: patch versioned, commit message up to date
- I confused me that a new thread was started in the middle of the
discussion.
- As a theoretical committer, I would like to get Sami's and Christoph's
feedback on the latest patch version.
^ permalink raw reply [nested|flat] 16+ messages in thread
* Re: [PATCH v4] pg_stat_statements: Add last_execution_start column
2026-03-30 16:37 [PATCH] pg_stat_statements: add last_execution_start column Pavlo Golub <[email protected]>
2026-03-30 21:33 ` Re: [PATCH] pg_stat_statements: add last_execution_start column Sami Imseih <[email protected]>
2026-05-13 14:38 ` [PATCH v4] pg_stat_statements: Add last_execution_start column Pavlo Golub <[email protected]>
2026-06-09 13:16 ` Re: [PATCH v4] pg_stat_statements: Add last_execution_start column Peter Eisentraut <[email protected]>
@ 2026-06-09 21:31 ` Sami Imseih <[email protected]>
2026-06-10 17:36 ` [PATCH v5] pg_stat_statements: Add last_execution_start column Pavlo Golub <[email protected]>
0 siblings, 1 reply; 16+ messages in thread
From: Sami Imseih @ 2026-06-09 21:31 UTC (permalink / raw)
To: Peter Eisentraut <[email protected]>; +Cc: Pavlo Golub <[email protected]>; pgsql-hackers
Hi,
Sorry for the delay in response to this. I spent time today looking at
v4 and here are my comments.
1/
v4 captures the timestamp conditionally inside the pgss hook, meaning that
there is an ownership issue with this field. It's a core field, so only
core should set it, and extensions should only read it.
It is best that queryDesc->estate->es_exec_start is set inside ExecutorStart.
```
/* pgss_ExecutorStart (original) */
static void
pgss_ExecutorStart(QueryDesc *queryDesc, int eflags)
{
if (prev_ExecutorStart)
prev_ExecutorStart(queryDesc, eflags);
else
standard_ExecutorStart(queryDesc, eflags);
/*
* Capture the statement start timestamp into EState here after the estate
* has been created by standard_ExecutorStart.
*/
if (pgss_enabled(nesting_level) && queryDesc->plannedstmt->queryId
!= INT64CONST(0))
queryDesc->estate->es_exec_start = GetCurrentStatementStartTimestamp();
}
```
Also, in pgss_ProcessUtility, we should not call
GetCurrentStatementStartTimestamp() directly,
but rather should track an execution start time field in PlannedStmt.
```
@@ -1212,7 +1228,8 @@ pgss_ProcessUtility(PlannedStmt *pstmt, const
char *queryString,
NULL,
0,
0,
- saved_planOrigin);
+ saved_planOrigin,
+ GetCurrentStatementStartTimestamp());
```
PlannedStmt docs already acknowledge it being used this way:
```
* For simplicity in APIs, we also wrap utility statements in PlannedStmt
* nodes; in such cases, commandType == CMD_UTILITY, the statement itself
* is in the utilityStmt field, and the rest of the struct is mostly dummy.
* (We do use canSetTag, stmt_location, stmt_len, and possibly queryId.)
```
Note that ProcessUtility receives a potentially read-only tree when called from
the plan cache (readOnlyTree == true). We need to copyObject before writing
es_exec_start, otherwise we corrupt the cached plan. standard_ProcessUtility
already does this copy internally, but hooks never see it:
```
/*
* If the given node tree is read-only, make a copy to ensure that parse
* transformations don't damage the original tree. This could be
* refactored to avoid making unnecessary copies in more cases, but it's
* not clear that it's worth a great deal of trouble over. Statements
* that are complex enough to be expensive to copy are exactly the ones
* we'd need to copy, so that only marginal savings seem possible.
*/
if (readOnlyTree)
pstmt = copyObject(pstmt);
```
So the copy needs to happen in ProcessUtility() itself, before calling into
hooks:
```
if (readOnlyTree)
pstmt = copyObject(pstmt);
pstmt->es_exec_start = GetCurrentStatementStartTimestamp();
```
Also note that currently pgss_ProcessUtility already sets
pstmt->queryId before calling
through to standard_ProcessUtility, which looks like a latent bug.
```
if (enabled)
pstmt->queryId = INT64CONST(0);
```
Adding TimestampTz to PlannedStmt also requires teaching gen_node_support.pl
about the type.
2/
Also, Why do we need to track last_execution_start time for the planner?
This field is for the last time the query execution start.
```
@@ -958,7 +965,8 @@ pgss_planner(Query *parse,
NULL,
0,
0,
- result->planOrigin);
+ result->planOrigin,
+ GetCurrentStatementStartTimestamp());
```
3/ DDL tests are needed. Right now, we are only testing DML.
4/ To some points made earlier here regarding the test [1]
> +SELECT now() AS ref_ts_ext \gset
> +-- Use \bind \g to force the extended query protocol.
> +SELECT pg_sleep(0.5) AS "DEFERRED_END" \bind \g
> +-- Capture a timestamp *after* the sleep finishes but *before* the next
> +-- extended-protocol statement replaces the unnamed portal.
> +SELECT now() AS ref_ts_ext2 \gset
> +-- The pg_sleep query's last_execution_start should be close to ref_ts_ext
> +-- (before the sleep), NOT to ref_ts_ext2 (after the sleep).
> I think the test doesn't work, or at least, doesn't check what you're
> expecting. If I set last_execution_start to
> GetCurrentStatementStartTimestamp(), it still passes.
correct. The deferred test needs to be done in an explicit transaction
> You could do something like that (and avoid a pg_sleep):
> BEGIN;
> SELECT 1 AS DEFERRED_END, statement_timestamp() AS query_stmt_ts \bind \gset
> -- With an explicit transaction + extended protocol, the portal is left opened
> -- ExecutorEnd will only be called when the next command is processed
> END;
That is a better, and much simpler test.
[1] https://www.postgresql.org/message-id/CAO6_XqoRLxL2%2BFsaE3JbwOH%2BoZ%3DCAjN8yK9-%2Bp7QeH_LY5B%2Bag%...
--
Sami Imseih
Amazon Web Services (AWS)
^ permalink raw reply [nested|flat] 16+ messages in thread
* [PATCH v5] pg_stat_statements: Add last_execution_start column
2026-03-30 16:37 [PATCH] pg_stat_statements: add last_execution_start column Pavlo Golub <[email protected]>
2026-03-30 21:33 ` Re: [PATCH] pg_stat_statements: add last_execution_start column Sami Imseih <[email protected]>
2026-05-13 14:38 ` [PATCH v4] pg_stat_statements: Add last_execution_start column Pavlo Golub <[email protected]>
2026-06-09 13:16 ` Re: [PATCH v4] pg_stat_statements: Add last_execution_start column Peter Eisentraut <[email protected]>
2026-06-09 21:31 ` Re: [PATCH v4] pg_stat_statements: Add last_execution_start column Sami Imseih <[email protected]>
@ 2026-06-10 17:36 ` Pavlo Golub <[email protected]>
2026-06-10 18:03 ` Re: [PATCH v5] pg_stat_statements: Add last_execution_start column Andres Freund <[email protected]>
2026-06-10 21:21 ` Re: [PATCH v5] pg_stat_statements: Add last_execution_start column Zsolt Parragi <[email protected]>
2026-06-10 21:22 ` Re: [PATCH v5] pg_stat_statements: Add last_execution_start column Sami Imseih <[email protected]>
0 siblings, 3 replies; 16+ messages in thread
From: Pavlo Golub @ 2026-06-10 17:36 UTC (permalink / raw)
To: Sami Imseih <[email protected]>; Peter Eisentraut <[email protected]>; +Cc: pgsql-hackers
Thank you all for the thorough review in person and on the list. I hope
that v5 addresses all feedback.
Rebased on current master (e18b0cb7344).
Changes from v4:
The locking was inconsistent. The read is now inside the spinlock
together with the other counters, and the comment no longer hardcodes a
field count. Thanks to Zsolt Parragi for catching this.
The `es_exec_start` field is now set unconditionally in
`pgss_ExecutorStart`, not just when `pgss_enabled()`. Thanks to Sami
Imseih for pointing this out.
The planner hook no longer passes a timestamp to `pgss_store`.
`pgss_store` now skips the update when exec_start is zero.
`INT64CONST(0)` in the `pgss_ExecutorStart` was replaced with a plain 0
iconst. No idea why this was introduced in the first place.
The deferred-ExecutorEnd regression test is rewritten. The previous
version used `pg_sleep` with `\bind \g` inside an implicit transaction.
The new test uses an explicit `BEGIN/END` with `\bind \gset`. Thanks to
Anthonin Bonnefoy for the correct pattern and to Sami Imseih for
confirming it.
A DDL test is added to cover utility-statement paths. Not sure how it is
different from a DML statement though.
The redundant "test filtering" count query and the confusing
`stats_since` are removed from the basic update test. Extra comments
are also removed.
The documentation now includes a sample monitoring query, as it appeared
in
the original v1 submission.
Regarding Peter Eisentraut's concern (raised at pgconf.dev) about
top-level vs nested statement timestamps: for `toplevel = false` rows,
`last_execution_start` reflects the
start time of the enclosing top-level statement, not the nested one.
This is a consequence of how `GetCurrentStatementStartTimestamp()` works
and is documented. It means the field is not useful for timing
individual nested calls, but it is still useful for the stated purpose
of answering "when was this statement last active".
All pg_stat_statements regression tests that pass on master also pass
with this patch.
Magic number `PGSS_FILE_HEADER` is bumped to `0x20260610`.
v5 patch attached.
Best regards,
Pavlo Golub
Attachments:
[application/octet-stream] v5-0001-pg_stat_statements-Add-last_execution_start-colum.patch (23.8K, ../../[email protected]/2-v5-0001-pg_stat_statements-Add-last_execution_start-colum.patch)
download | inline diff:
From 3dc93aca6e1cbdda94e41f8f80f84ae5433a8680 Mon Sep 17 00:00:00 2001
From: Pavlo Golub <[email protected]>
Date: Wed, 1 Apr 2026 12:31:57 +0000
Subject: [PATCH] pg_stat_statements: Add last_execution_start column
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Add a new column last_execution_start to pg_stat_statements that records
the start timestamp of the most recent execution of each tracked statement.
The timestamp is captured at ExecutorStart time and stored in a new field
added to EState. This follows the same pattern as es_total_processed,
es_parallel_workers_to_launch, and other fields that are set by the
executor and consumed by pg_stat_statements.
This avoids the deferred-ExecutorEnd problem with extended query protocol
when ExecutorEnd for previous query is deferred until the next Bind message,
and GetCurrentStatementStartTimestamp() would return the next query timestamp.
For non-executor paths (planner hook, ProcessUtility), the timestamp is
still read inline from GetCurrentStatementStartTimestamp() because those
paths are never deferred.
Benchmark (16-vCPU, interleaved pgbench -c8 -j4 -T60):
master HEAD: ~4691 TPS (runs: 4849, 4588, 4635)
patched v5: ~4744 TPS (runs: 4870, 4735, 4627)
difference: ~1.1% — within noise
The column is initialized at entry allocation time and updated on every
stats-recording call to pgss_store(). It is reset by
pg_stat_statements_reset() but not by minmax-only resets.
Bump PGSS_FILE_HEADER to 0x20260610 for the changed on-disk format.
---
contrib/pg_stat_statements/Makefile | 1 +
.../expected/entry_timestamp.out | 119 ++++++++++++++++++
contrib/pg_stat_statements/meson.build | 1 +
.../pg_stat_statements--1.13--1.14.sql | 79 ++++++++++++
.../pg_stat_statements/pg_stat_statements.c | 68 ++++++++--
.../pg_stat_statements.control | 2 +-
.../sql/entry_timestamp.sql | 74 +++++++++++
doc/src/sgml/pgstatstatements.sgml | 22 ++++
src/include/nodes/execnodes.h | 9 ++
9 files changed, 363 insertions(+), 12 deletions(-)
create mode 100644 contrib/pg_stat_statements/pg_stat_statements--1.13--1.14.sql
diff --git a/contrib/pg_stat_statements/Makefile b/contrib/pg_stat_statements/Makefile
index c27e9529bb6..d7142f71cf7 100644
--- a/contrib/pg_stat_statements/Makefile
+++ b/contrib/pg_stat_statements/Makefile
@@ -7,6 +7,7 @@ OBJS = \
EXTENSION = pg_stat_statements
DATA = pg_stat_statements--1.4.sql \
+ pg_stat_statements--1.13--1.14.sql \
pg_stat_statements--1.12--1.13.sql \
pg_stat_statements--1.11--1.12.sql pg_stat_statements--1.10--1.11.sql \
pg_stat_statements--1.9--1.10.sql pg_stat_statements--1.8--1.9.sql \
diff --git a/contrib/pg_stat_statements/expected/entry_timestamp.out b/contrib/pg_stat_statements/expected/entry_timestamp.out
index a10c4be6bac..f619e364c33 100644
--- a/contrib/pg_stat_statements/expected/entry_timestamp.out
+++ b/contrib/pg_stat_statements/expected/entry_timestamp.out
@@ -150,6 +150,125 @@ WHERE query LIKE '%STMTTS%';
2 | 1 | 2 | 0
(1 row)
+--
+-- last_execution_start timestamp tests
+--
+SELECT pg_stat_statements_reset() IS NOT NULL AS t;
+ t
+---
+ t
+(1 row)
+
+-- Capture a reference timestamp before running the tracked queries.
+SELECT now() AS ref_ts_upd1 \gset
+SELECT 1 AS "EXECSTART1";
+ EXECSTART1
+------------
+ 1
+(1 row)
+
+-- last_execution_start should be set and >= ref_ts_upd1.
+SELECT
+ query,
+ last_execution_start IS NOT NULL as has_ts,
+ last_execution_start >= :'ref_ts_upd1' as after_ref1
+FROM pg_stat_statements
+WHERE query LIKE '%EXECSTART%'
+ORDER BY query COLLATE "C";
+ query | has_ts | after_ref1
+---------------------------+--------+------------
+ SELECT $1 AS "EXECSTART1" | t | t
+(1 row)
+
+-- Run EXECSTART1 again and verify that last_execution_start is updated.
+SELECT now() AS ref_ts_upd2 \gset
+SELECT 1 AS "EXECSTART1";
+ EXECSTART1
+------------
+ 1
+(1 row)
+
+SELECT
+ query,
+ last_execution_start >= :'ref_ts_upd2' as updated
+FROM pg_stat_statements
+WHERE query LIKE '%EXECSTART1%';
+ query | updated
+---------------------------+---------
+ SELECT $1 AS "EXECSTART1" | t
+(1 row)
+
+-- minmax reset should not affect last_execution_start
+SELECT pg_stat_statements_reset(0, 0, queryid, true)
+FROM pg_stat_statements
+WHERE query LIKE '%EXECSTART1%' \gset
+SELECT
+ query,
+ last_execution_start >= :'ref_ts_upd2' as ts_preserved
+FROM pg_stat_statements
+WHERE query LIKE '%EXECSTART1%';
+ query | ts_preserved
+---------------------------+--------------
+ SELECT $1 AS "EXECSTART1" | t
+(1 row)
+
+--
+-- Deferred ExecutorEnd test (extended query protocol)
+--
+-- In the extended query protocol the previous query's ExecutorEnd is
+-- deferred until the next Bind message, at which point
+-- GetCurrentStatementStartTimestamp() already reflects the *new* query.
+-- Verify that last_execution_start still records the *old* query's start.
+-- An explicit transaction keeps the portal open past the Bind of END,
+-- which is when the deferred ExecutorEnd actually fires.
+--
+SELECT pg_stat_statements_reset() IS NOT NULL AS t;
+ t
+---
+ t
+(1 row)
+
+BEGIN;
+SELECT 1 AS "DEFERRED_END", statement_timestamp() AS query_stmt_ts \bind \gset
+END;
+SELECT
+ query,
+ last_execution_start < :'query_stmt_ts' as before_next
+FROM pg_stat_statements
+WHERE query LIKE '%DEFERRED_END%'
+ORDER BY query COLLATE "C";
+ query | before_next
+---------------------------------------------------------------------+-------------
+ SELECT $1 AS "DEFERRED_END", statement_timestamp() AS query_stmt_ts | t
+(1 row)
+
+--
+-- DDL test: last_execution_start is updated for utility statements
+--
+SELECT pg_stat_statements_reset() IS NOT NULL AS t;
+ t
+---
+ t
+(1 row)
+
+SET pg_stat_statements.track_utility = TRUE;
+SELECT now() AS ref_ts_ddl \gset
+CREATE TEMP TABLE pgss_exec_start_test (a int);
+DROP TABLE pgss_exec_start_test;
+SELECT
+ query,
+ last_execution_start IS NOT NULL as has_ts,
+ last_execution_start >= :'ref_ts_ddl' as after_ref
+FROM pg_stat_statements
+WHERE query LIKE '%pgss_exec_start_test%'
+ORDER BY query COLLATE "C";
+ query | has_ts | after_ref
+------------------------------------------------+--------+-----------
+ CREATE TEMP TABLE pgss_exec_start_test (a int) | t | t
+ DROP TABLE pgss_exec_start_test | t | t
+(2 rows)
+
+RESET pg_stat_statements.track_utility;
-- Cleanup
SELECT pg_stat_statements_reset() IS NOT NULL AS t;
t
diff --git a/contrib/pg_stat_statements/meson.build b/contrib/pg_stat_statements/meson.build
index 9d78cb88b7d..77148949c0d 100644
--- a/contrib/pg_stat_statements/meson.build
+++ b/contrib/pg_stat_statements/meson.build
@@ -21,6 +21,7 @@ contrib_targets += pg_stat_statements
install_data(
'pg_stat_statements.control',
'pg_stat_statements--1.4.sql',
+ 'pg_stat_statements--1.13--1.14.sql',
'pg_stat_statements--1.12--1.13.sql',
'pg_stat_statements--1.11--1.12.sql',
'pg_stat_statements--1.10--1.11.sql',
diff --git a/contrib/pg_stat_statements/pg_stat_statements--1.13--1.14.sql b/contrib/pg_stat_statements/pg_stat_statements--1.13--1.14.sql
new file mode 100644
index 00000000000..af4e177f5fa
--- /dev/null
+++ b/contrib/pg_stat_statements/pg_stat_statements--1.13--1.14.sql
@@ -0,0 +1,79 @@
+/* contrib/pg_stat_statements/pg_stat_statements--1.13--1.14.sql */
+
+-- complain if script is sourced in psql, rather than via ALTER EXTENSION
+\echo Use "ALTER EXTENSION pg_stat_statements UPDATE TO '1.14'" to load this file. \quit
+
+/* First we have to remove them from the extension */
+ALTER EXTENSION pg_stat_statements DROP VIEW pg_stat_statements;
+ALTER EXTENSION pg_stat_statements DROP FUNCTION pg_stat_statements(boolean);
+
+/* Then we can drop them */
+DROP VIEW pg_stat_statements;
+DROP FUNCTION pg_stat_statements(boolean);
+
+/* Now redefine */
+CREATE FUNCTION pg_stat_statements(IN showtext boolean,
+ OUT userid oid,
+ OUT dbid oid,
+ OUT toplevel bool,
+ OUT queryid bigint,
+ OUT query text,
+ OUT plans int8,
+ OUT total_plan_time float8,
+ OUT min_plan_time float8,
+ OUT max_plan_time float8,
+ OUT mean_plan_time float8,
+ OUT stddev_plan_time float8,
+ OUT calls int8,
+ OUT total_exec_time float8,
+ OUT min_exec_time float8,
+ OUT max_exec_time float8,
+ OUT mean_exec_time float8,
+ OUT stddev_exec_time float8,
+ OUT rows int8,
+ OUT shared_blks_hit int8,
+ OUT shared_blks_read int8,
+ OUT shared_blks_dirtied int8,
+ OUT shared_blks_written int8,
+ OUT local_blks_hit int8,
+ OUT local_blks_read int8,
+ OUT local_blks_dirtied int8,
+ OUT local_blks_written int8,
+ OUT temp_blks_read int8,
+ OUT temp_blks_written int8,
+ OUT shared_blk_read_time float8,
+ OUT shared_blk_write_time float8,
+ OUT local_blk_read_time float8,
+ OUT local_blk_write_time float8,
+ OUT temp_blk_read_time float8,
+ OUT temp_blk_write_time float8,
+ OUT wal_records int8,
+ OUT wal_fpi int8,
+ OUT wal_bytes numeric,
+ OUT wal_buffers_full int8,
+ OUT jit_functions int8,
+ OUT jit_generation_time float8,
+ OUT jit_inlining_count int8,
+ OUT jit_inlining_time float8,
+ OUT jit_optimization_count int8,
+ OUT jit_optimization_time float8,
+ OUT jit_emission_count int8,
+ OUT jit_emission_time float8,
+ OUT jit_deform_count int8,
+ OUT jit_deform_time float8,
+ OUT parallel_workers_to_launch int8,
+ OUT parallel_workers_launched int8,
+ OUT generic_plan_calls int8,
+ OUT custom_plan_calls int8,
+ OUT stats_since timestamp with time zone,
+ OUT minmax_stats_since timestamp with time zone,
+ OUT last_execution_start timestamp with time zone
+)
+RETURNS SETOF record
+AS 'MODULE_PATHNAME', 'pg_stat_statements_1_14'
+LANGUAGE C STRICT VOLATILE PARALLEL SAFE;
+
+CREATE VIEW pg_stat_statements AS
+ SELECT * FROM pg_stat_statements(true);
+
+GRANT SELECT ON pg_stat_statements TO PUBLIC;
diff --git a/contrib/pg_stat_statements/pg_stat_statements.c b/contrib/pg_stat_statements/pg_stat_statements.c
index 92315627916..02aa71b3117 100644
--- a/contrib/pg_stat_statements/pg_stat_statements.c
+++ b/contrib/pg_stat_statements/pg_stat_statements.c
@@ -49,6 +49,7 @@
#include "access/htup_details.h"
#include "access/parallel.h"
+#include "access/xact.h"
#include "catalog/pg_authid.h"
#include "executor/instrument.h"
#include "funcapi.h"
@@ -85,7 +86,7 @@ PG_MODULE_MAGIC_EXT(
#define PGSS_TEXT_FILE PG_STAT_TMP_DIR "/pgss_query_texts.stat"
/* Magic number identifying the stats file format */
-static const uint32 PGSS_FILE_HEADER = 0x20250731;
+static const uint32 PGSS_FILE_HEADER = 0x20260610;
/* PostgreSQL major version number, changes in which invalidate all entries */
static const uint32 PGSS_PG_MAJOR_VERSION = PG_VERSION_NUM / 100;
@@ -115,6 +116,7 @@ typedef enum pgssVersion
PGSS_V1_11,
PGSS_V1_12,
PGSS_V1_13,
+ PGSS_V1_14,
} pgssVersion;
typedef enum pgssStoreKind
@@ -238,7 +240,8 @@ typedef struct pgssEntry
int query_len; /* # of valid bytes in query string, or -1 */
int encoding; /* query text encoding */
TimestampTz stats_since; /* timestamp of entry allocation */
- TimestampTz minmax_stats_since; /* timestamp of last min/max values reset */
+ TimestampTz minmax_stats_since; /* timestamp of last min/max values reset */
+ TimestampTz last_execution_start; /* start timestamp of the last execution */
slock_t mutex; /* protects the counters only */
} pgssEntry;
@@ -332,6 +335,7 @@ PG_FUNCTION_INFO_V1(pg_stat_statements_1_10);
PG_FUNCTION_INFO_V1(pg_stat_statements_1_11);
PG_FUNCTION_INFO_V1(pg_stat_statements_1_12);
PG_FUNCTION_INFO_V1(pg_stat_statements_1_13);
+PG_FUNCTION_INFO_V1(pg_stat_statements_1_14);
PG_FUNCTION_INFO_V1(pg_stat_statements);
PG_FUNCTION_INFO_V1(pg_stat_statements_info);
@@ -364,7 +368,8 @@ static void pgss_store(const char *query, int64 queryId,
const JumbleState *jstate,
int parallel_workers_to_launch,
int parallel_workers_launched,
- PlannedStmtOrigin planOrigin);
+ PlannedStmtOrigin planOrigin,
+ TimestampTz exec_start);
static void pg_stat_statements_internal(FunctionCallInfo fcinfo,
pgssVersion api_version,
bool showtext);
@@ -664,6 +669,7 @@ pgss_shmem_init(void *arg)
entry->counters = temp.counters;
entry->stats_since = temp.stats_since;
entry->minmax_stats_since = temp.minmax_stats_since;
+ entry->last_execution_start = temp.last_execution_start;
}
/* Read global statistics for pg_stat_statements */
@@ -876,7 +882,8 @@ pgss_post_parse_analyze(ParseState *pstate, Query *query, const JumbleState *jst
jstate,
0,
0,
- PLAN_STMT_UNKNOWN);
+ PLAN_STMT_UNKNOWN,
+ 0);
}
/*
@@ -958,7 +965,8 @@ pgss_planner(Query *parse,
NULL,
0,
0,
- result->planOrigin);
+ result->planOrigin,
+ 0);
}
else
{
@@ -998,7 +1006,7 @@ pgss_ExecutorStart(QueryDesc *queryDesc, int eflags)
* counting of optimizable statements that are directly contained in
* utility statements.
*/
- if (pgss_enabled(nesting_level) && queryDesc->plannedstmt->queryId != INT64CONST(0))
+ if (pgss_enabled(nesting_level) && queryDesc->plannedstmt->queryId != 0)
{
/* Request all summary instrumentation, i.e. timing, buffers and WAL */
queryDesc->query_instr_options |= INSTRUMENT_ALL;
@@ -1008,6 +1016,14 @@ pgss_ExecutorStart(QueryDesc *queryDesc, int eflags)
prev_ExecutorStart(queryDesc, eflags);
else
standard_ExecutorStart(queryDesc, eflags);
+
+ /*
+ * Capture the statement start timestamp into EState here after the estate
+ * has been created by standard_ExecutorStart. We do this unconditionally
+ * so that the field is always valid; pg_stat_statements reads it in
+ * pgss_ExecutorEnd.
+ */
+ queryDesc->estate->es_exec_start = GetCurrentStatementStartTimestamp();
}
/*
@@ -1076,7 +1092,8 @@ pgss_ExecutorEnd(QueryDesc *queryDesc)
NULL,
queryDesc->estate->es_parallel_workers_to_launch,
queryDesc->estate->es_parallel_workers_launched,
- queryDesc->plannedstmt->planOrigin);
+ queryDesc->plannedstmt->planOrigin,
+ queryDesc->estate->es_exec_start);
}
if (prev_ExecutorEnd)
@@ -1212,7 +1229,8 @@ pgss_ProcessUtility(PlannedStmt *pstmt, const char *queryString,
NULL,
0,
0,
- saved_planOrigin);
+ saved_planOrigin,
+ GetCurrentStatementStartTimestamp());
}
else
{
@@ -1276,7 +1294,8 @@ pgss_store(const char *query, int64 queryId,
const JumbleState *jstate,
int parallel_workers_to_launch,
int parallel_workers_launched,
- PlannedStmtOrigin planOrigin)
+ PlannedStmtOrigin planOrigin,
+ TimestampTz exec_start)
{
pgssHashKey key;
pgssEntry *entry;
@@ -1490,6 +1509,10 @@ pgss_store(const char *query, int64 queryId,
else if (planOrigin == PLAN_STMT_CACHE_CUSTOM)
entry->counters.custom_plan_calls++;
+ /* Record the start time of this execution, if provided */
+ if (exec_start != 0)
+ entry->last_execution_start = exec_start;
+
SpinLockRelease(&entry->mutex);
}
@@ -1558,7 +1581,8 @@ pg_stat_statements_reset(PG_FUNCTION_ARGS)
#define PG_STAT_STATEMENTS_COLS_V1_11 49
#define PG_STAT_STATEMENTS_COLS_V1_12 52
#define PG_STAT_STATEMENTS_COLS_V1_13 54
-#define PG_STAT_STATEMENTS_COLS 54 /* maximum of above */
+#define PG_STAT_STATEMENTS_COLS_V1_14 55
+#define PG_STAT_STATEMENTS_COLS 55 /* maximum of above */
/*
* Retrieve statement statistics.
@@ -1570,6 +1594,16 @@ pg_stat_statements_reset(PG_FUNCTION_ARGS)
* expected API version is identified by embedding it in the C name of the
* function. Unfortunately we weren't bright enough to do that for 1.1.
*/
+Datum
+pg_stat_statements_1_14(PG_FUNCTION_ARGS)
+{
+ bool showtext = PG_GETARG_BOOL(0);
+
+ pg_stat_statements_internal(fcinfo, PGSS_V1_14, showtext);
+
+ return (Datum) 0;
+}
+
Datum
pg_stat_statements_1_13(PG_FUNCTION_ARGS)
{
@@ -1742,6 +1776,10 @@ pg_stat_statements_internal(FunctionCallInfo fcinfo,
if (api_version != PGSS_V1_13)
elog(ERROR, "incorrect number of output arguments");
break;
+ case PG_STAT_STATEMENTS_COLS_V1_14:
+ if (api_version != PGSS_V1_14)
+ elog(ERROR, "incorrect number of output arguments");
+ break;
default:
elog(ERROR, "incorrect number of output arguments");
}
@@ -1818,6 +1856,7 @@ pg_stat_statements_internal(FunctionCallInfo fcinfo,
int64 queryid = entry->key.queryid;
TimestampTz stats_since;
TimestampTz minmax_stats_since;
+ TimestampTz last_execution_start;
memset(values, 0, sizeof(values));
memset(nulls, 0, sizeof(nulls));
@@ -1883,10 +1922,11 @@ pg_stat_statements_internal(FunctionCallInfo fcinfo,
/* copy counters to a local variable to keep locking time short */
SpinLockAcquire(&entry->mutex);
tmp = entry->counters;
+ last_execution_start = entry->last_execution_start;
SpinLockRelease(&entry->mutex);
/*
- * The spinlock is not required when reading these two as they are
+ * The spinlock is not required when reading these fields as they are
* always updated when holding pgss->lock exclusively.
*/
stats_since = entry->stats_since;
@@ -2005,6 +2045,10 @@ pg_stat_statements_internal(FunctionCallInfo fcinfo,
values[i++] = TimestampTzGetDatum(stats_since);
values[i++] = TimestampTzGetDatum(minmax_stats_since);
}
+ if (api_version >= PGSS_V1_14)
+ {
+ values[i++] = TimestampTzGetDatum(last_execution_start);
+ }
Assert(i == (api_version == PGSS_V1_0 ? PG_STAT_STATEMENTS_COLS_V1_0 :
api_version == PGSS_V1_1 ? PG_STAT_STATEMENTS_COLS_V1_1 :
@@ -2016,6 +2060,7 @@ pg_stat_statements_internal(FunctionCallInfo fcinfo,
api_version == PGSS_V1_11 ? PG_STAT_STATEMENTS_COLS_V1_11 :
api_version == PGSS_V1_12 ? PG_STAT_STATEMENTS_COLS_V1_12 :
api_version == PGSS_V1_13 ? PG_STAT_STATEMENTS_COLS_V1_13 :
+ api_version == PGSS_V1_14 ? PG_STAT_STATEMENTS_COLS_V1_14 :
-1 /* fail if you forget to update this assert */ ));
tuplestore_putvalues(rsinfo->setResult, rsinfo->setDesc, values, nulls);
@@ -2109,6 +2154,7 @@ entry_alloc(pgssHashKey *key, Size query_offset, int query_len, int encoding,
entry->encoding = encoding;
entry->stats_since = GetCurrentTimestamp();
entry->minmax_stats_since = entry->stats_since;
+ entry->last_execution_start = entry->stats_since;
}
return entry;
diff --git a/contrib/pg_stat_statements/pg_stat_statements.control b/contrib/pg_stat_statements/pg_stat_statements.control
index 2eee0ceffa8..61ae41efc14 100644
--- a/contrib/pg_stat_statements/pg_stat_statements.control
+++ b/contrib/pg_stat_statements/pg_stat_statements.control
@@ -1,5 +1,5 @@
# pg_stat_statements extension
comment = 'track planning and execution statistics of all SQL statements executed'
-default_version = '1.13'
+default_version = '1.14'
module_pathname = '$libdir/pg_stat_statements'
relocatable = true
diff --git a/contrib/pg_stat_statements/sql/entry_timestamp.sql b/contrib/pg_stat_statements/sql/entry_timestamp.sql
index d6d3027ab4f..9fad086ffa0 100644
--- a/contrib/pg_stat_statements/sql/entry_timestamp.sql
+++ b/contrib/pg_stat_statements/sql/entry_timestamp.sql
@@ -110,5 +110,79 @@ SELECT
FROM pg_stat_statements
WHERE query LIKE '%STMTTS%';
+--
+-- last_execution_start timestamp tests
+--
+SELECT pg_stat_statements_reset() IS NOT NULL AS t;
+-- Capture a reference timestamp before running the tracked queries.
+SELECT now() AS ref_ts_upd1 \gset
+SELECT 1 AS "EXECSTART1";
+-- last_execution_start should be set and >= ref_ts_upd1.
+SELECT
+ query,
+ last_execution_start IS NOT NULL as has_ts,
+ last_execution_start >= :'ref_ts_upd1' as after_ref1
+FROM pg_stat_statements
+WHERE query LIKE '%EXECSTART%'
+ORDER BY query COLLATE "C";
+
+-- Run EXECSTART1 again and verify that last_execution_start is updated.
+SELECT now() AS ref_ts_upd2 \gset
+SELECT 1 AS "EXECSTART1";
+SELECT
+ query,
+ last_execution_start >= :'ref_ts_upd2' as updated
+FROM pg_stat_statements
+WHERE query LIKE '%EXECSTART1%';
+
+-- minmax reset should not affect last_execution_start
+SELECT pg_stat_statements_reset(0, 0, queryid, true)
+FROM pg_stat_statements
+WHERE query LIKE '%EXECSTART1%' \gset
+
+SELECT
+ query,
+ last_execution_start >= :'ref_ts_upd2' as ts_preserved
+FROM pg_stat_statements
+WHERE query LIKE '%EXECSTART1%';
+
+--
+-- Deferred ExecutorEnd test (extended query protocol)
+--
+-- In the extended query protocol the previous query's ExecutorEnd is
+-- deferred until the next Bind message, at which point
+-- GetCurrentStatementStartTimestamp() already reflects the *new* query.
+-- Verify that last_execution_start still records the *old* query's start.
+-- An explicit transaction keeps the portal open past the Bind of END,
+-- which is when the deferred ExecutorEnd actually fires.
+--
+SELECT pg_stat_statements_reset() IS NOT NULL AS t;
+BEGIN;
+SELECT 1 AS "DEFERRED_END", statement_timestamp() AS query_stmt_ts \bind \gset
+END;
+SELECT
+ query,
+ last_execution_start < :'query_stmt_ts' as before_next
+FROM pg_stat_statements
+WHERE query LIKE '%DEFERRED_END%'
+ORDER BY query COLLATE "C";
+
+--
+-- DDL test: last_execution_start is updated for utility statements
+--
+SELECT pg_stat_statements_reset() IS NOT NULL AS t;
+SET pg_stat_statements.track_utility = TRUE;
+SELECT now() AS ref_ts_ddl \gset
+CREATE TEMP TABLE pgss_exec_start_test (a int);
+DROP TABLE pgss_exec_start_test;
+SELECT
+ query,
+ last_execution_start IS NOT NULL as has_ts,
+ last_execution_start >= :'ref_ts_ddl' as after_ref
+FROM pg_stat_statements
+WHERE query LIKE '%pgss_exec_start_test%'
+ORDER BY query COLLATE "C";
+RESET pg_stat_statements.track_utility;
+
-- Cleanup
SELECT pg_stat_statements_reset() IS NOT NULL AS t;
diff --git a/doc/src/sgml/pgstatstatements.sgml b/doc/src/sgml/pgstatstatements.sgml
index d753de5836e..1c05f91d86e 100644
--- a/doc/src/sgml/pgstatstatements.sgml
+++ b/doc/src/sgml/pgstatstatements.sgml
@@ -593,6 +593,28 @@
<structfield>max_exec_time</structfield>)
</para></entry>
</row>
+
+ <row>
+ <entry role="catalog_table_entry"><para role="column_definition">
+ <structfield>last_execution_start</structfield> <type>timestamp with time zone</type>
+ </para>
+ <para>
+ Time at which the most recent execution of this statement started.
+ For nested statements (<structfield>toplevel</structfield> = false),
+ this is the start time of the top-level statement that caused the
+ nested statement to be executed.
+ </para>
+ <para>
+ This field is useful for monitoring queries that have executed since
+ a given point in time, for example:
+<programlisting>
+SELECT query, calls, last_execution_start
+FROM pg_stat_statements
+WHERE last_execution_start >= $1
+ORDER BY last_execution_start DESC;
+</programlisting>
+ </para></entry>
+ </row>
</tbody>
</tgroup>
</table>
diff --git a/src/include/nodes/execnodes.h b/src/include/nodes/execnodes.h
index 53c138310db..55f18b45dc6 100644
--- a/src/include/nodes/execnodes.h
+++ b/src/include/nodes/execnodes.h
@@ -30,6 +30,7 @@
#define EXECNODES_H
#include "access/htup.h"
+#include "datatype/timestamp.h"
#include "executor/instrument_node.h"
#include "fmgr.h"
#include "lib/ilist.h"
@@ -785,6 +786,14 @@ typedef struct EState
int es_parallel_workers_launched; /* number of workers actually
* launched. */
+ /*
+ * Statement start timestamp captured at ExecutorStart time. We store
+ * this here so that extensions (e.g. pg_stat_statements) can read the
+ * correct start time at ExecutorEnd, even when ExecutorEnd is deferred
+ * to a later Bind message in the extended query protocol.
+ */
+ TimestampTz es_exec_start;
+
/* The per-query shared memory area to use for parallel execution. */
struct dsa_area *es_query_dsa;
--
2.53.0
^ permalink raw reply [nested|flat] 16+ messages in thread
* Re: [PATCH v5] pg_stat_statements: Add last_execution_start column
2026-03-30 16:37 [PATCH] pg_stat_statements: add last_execution_start column Pavlo Golub <[email protected]>
2026-03-30 21:33 ` Re: [PATCH] pg_stat_statements: add last_execution_start column Sami Imseih <[email protected]>
2026-05-13 14:38 ` [PATCH v4] pg_stat_statements: Add last_execution_start column Pavlo Golub <[email protected]>
2026-06-09 13:16 ` Re: [PATCH v4] pg_stat_statements: Add last_execution_start column Peter Eisentraut <[email protected]>
2026-06-09 21:31 ` Re: [PATCH v4] pg_stat_statements: Add last_execution_start column Sami Imseih <[email protected]>
2026-06-10 17:36 ` [PATCH v5] pg_stat_statements: Add last_execution_start column Pavlo Golub <[email protected]>
@ 2026-06-10 18:03 ` Andres Freund <[email protected]>
2 siblings, 0 replies; 16+ messages in thread
From: Andres Freund @ 2026-06-10 18:03 UTC (permalink / raw)
To: Pavlo Golub <[email protected]>; +Cc: Sami Imseih <[email protected]>; Peter Eisentraut <[email protected]>; pgsql-hackers
Hi,
On 2026-06-10 17:36:24 +0000, Pavlo Golub wrote:
> @@ -1490,6 +1509,10 @@ pgss_store(const char *query, int64 queryId,
> else if (planOrigin == PLAN_STMT_CACHE_CUSTOM)
> entry->counters.custom_plan_calls++;
>
> + /* Record the start time of this execution, if provided */
> + if (exec_start != 0)
> + entry->last_execution_start = exec_start;
> +
> SpinLockRelease(&entry->mutex);
> }
FWIW, I remain opposed to adding *any* additional thing under the spinlock. We
first need to fix the design of pgss, then we can start discussing expanding
it even further.
I've seen way too many instances being brought to their knee because of pgss
contention. We shouldn't make it even worse.
Greetings,
Andres Freund
^ permalink raw reply [nested|flat] 16+ messages in thread
* Re: [PATCH v5] pg_stat_statements: Add last_execution_start column
2026-03-30 16:37 [PATCH] pg_stat_statements: add last_execution_start column Pavlo Golub <[email protected]>
2026-03-30 21:33 ` Re: [PATCH] pg_stat_statements: add last_execution_start column Sami Imseih <[email protected]>
2026-05-13 14:38 ` [PATCH v4] pg_stat_statements: Add last_execution_start column Pavlo Golub <[email protected]>
2026-06-09 13:16 ` Re: [PATCH v4] pg_stat_statements: Add last_execution_start column Peter Eisentraut <[email protected]>
2026-06-09 21:31 ` Re: [PATCH v4] pg_stat_statements: Add last_execution_start column Sami Imseih <[email protected]>
2026-06-10 17:36 ` [PATCH v5] pg_stat_statements: Add last_execution_start column Pavlo Golub <[email protected]>
@ 2026-06-10 21:21 ` Zsolt Parragi <[email protected]>
2026-06-10 21:32 ` Re: [PATCH v5] pg_stat_statements: Add last_execution_start column Sami Imseih <[email protected]>
2 siblings, 1 reply; 16+ messages in thread
From: Zsolt Parragi @ 2026-06-10 21:21 UTC (permalink / raw)
To: [email protected]
I have one more question: should statements that failed have an
execution start set?
CREATE TABLE t(d int);
INSERT INTO t VALUES (0);
SELECT pg_stat_statements_reset();
SELECT now() AS ref_ts \gset
SELECT 1/d FROM t;
SELECT calls, plans, query FROM pg_stat_statements
WHERE last_execution_start >= :'ref_ts'
AND query LIKE '%/d FROM t%';
^ permalink raw reply [nested|flat] 16+ messages in thread
* Re: [PATCH v5] pg_stat_statements: Add last_execution_start column
2026-03-30 16:37 [PATCH] pg_stat_statements: add last_execution_start column Pavlo Golub <[email protected]>
2026-03-30 21:33 ` Re: [PATCH] pg_stat_statements: add last_execution_start column Sami Imseih <[email protected]>
2026-05-13 14:38 ` [PATCH v4] pg_stat_statements: Add last_execution_start column Pavlo Golub <[email protected]>
2026-06-09 13:16 ` Re: [PATCH v4] pg_stat_statements: Add last_execution_start column Peter Eisentraut <[email protected]>
2026-06-09 21:31 ` Re: [PATCH v4] pg_stat_statements: Add last_execution_start column Sami Imseih <[email protected]>
2026-06-10 17:36 ` [PATCH v5] pg_stat_statements: Add last_execution_start column Pavlo Golub <[email protected]>
2026-06-10 21:21 ` Re: [PATCH v5] pg_stat_statements: Add last_execution_start column Zsolt Parragi <[email protected]>
@ 2026-06-10 21:32 ` Sami Imseih <[email protected]>
0 siblings, 0 replies; 16+ messages in thread
From: Sami Imseih @ 2026-06-10 21:32 UTC (permalink / raw)
To: Zsolt Parragi <[email protected]>; +Cc: [email protected]
> I have one more question: should statements that failed have an
> execution start set?
No, the should not have an execution start set. Any query execution
that fails will not accumulate statistics currently. This is because
the counters are updated on ExecutorEnd.
I do think there could be future work to accumulate some stats on
ExecutorStart; for example calls_started, called_completed instead
of just a calls counter. However the current design of pg_stat_statements
makes the spinlock contention worse. This could become viable once we
redesign pg_stat_statements to remove the SpinLock to update the counters.
--
Sami Imseih
Amazon Web Services (AWS)
^ permalink raw reply [nested|flat] 16+ messages in thread
* Re: [PATCH v5] pg_stat_statements: Add last_execution_start column
2026-03-30 16:37 [PATCH] pg_stat_statements: add last_execution_start column Pavlo Golub <[email protected]>
2026-03-30 21:33 ` Re: [PATCH] pg_stat_statements: add last_execution_start column Sami Imseih <[email protected]>
2026-05-13 14:38 ` [PATCH v4] pg_stat_statements: Add last_execution_start column Pavlo Golub <[email protected]>
2026-06-09 13:16 ` Re: [PATCH v4] pg_stat_statements: Add last_execution_start column Peter Eisentraut <[email protected]>
2026-06-09 21:31 ` Re: [PATCH v4] pg_stat_statements: Add last_execution_start column Sami Imseih <[email protected]>
2026-06-10 17:36 ` [PATCH v5] pg_stat_statements: Add last_execution_start column Pavlo Golub <[email protected]>
@ 2026-06-10 21:22 ` Sami Imseih <[email protected]>
2 siblings, 0 replies; 16+ messages in thread
From: Sami Imseih @ 2026-06-10 21:22 UTC (permalink / raw)
To: Pavlo Golub <[email protected]>; +Cc: Peter Eisentraut <[email protected]>; pgsql-hackers
> A DDL test is added to cover utility-statement paths. Not sure how it is
> different from a DML statement though.
This is because DDL will go through ProcessUtility hook. I don't think
pg_stat_statements should be calling GetCurrentStatementStartTimestamp()
as you have it in v5. We should be setting this the start timestamp in
PlannedStmt during the ProcessUtility hook ( same pattern as ExecutorStart ).
see [1].
> FWIW, I remain opposed to adding *any* additional thing under the spinlock. We
> first need to fix the design of pgss, then we can start discussing expanding
> it even further.
I do think having the execution start time is valuable, but I will do
agree that it should
wait until after the pg_stat_statements redesign is complete which is
being discussed
here [2].
--
Sami Imseih
Amazon Web Services (AWS)
[1] https://www.postgresql.org/message-id/CAA5RZ0uLbF_zcu64-K50fepq20s7GEYCsnizVBhm6eMmsfSa7Q%40mail.gma...
[2] https://www.postgresql.org/message-id/flat/CAA5RZ0sQ%2BgDn-J85j1FzOdL1YjVYRegpmQpDiah1%3DREWZSZj%2BQ...
^ permalink raw reply [nested|flat] 16+ messages in thread
end of thread, other threads:[~2026-06-10 21:32 UTC | newest]
Thread overview: 16+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2020-03-30 21:13 [PATCH v3 1/2] Rationalize ltree input errors Nikita Glukhov <[email protected]>
2023-07-13 15:44 [PATCH v5 1/2] Set fixed dates for test certificates validity Daniel Gustafsson <[email protected]>
2023-07-13 15:44 [PATCH v5 1/2] Set fixed dates for test certificates validity Daniel Gustafsson <[email protected]>
2026-02-10 18:40 [PATCH v12 4/4] Make use of pg_popcount() in more places. Nathan Bossart <[email protected]>
2026-03-30 16:37 [PATCH] pg_stat_statements: add last_execution_start column Pavlo Golub <[email protected]>
2026-03-30 21:33 ` Re: [PATCH] pg_stat_statements: add last_execution_start column Sami Imseih <[email protected]>
2026-05-13 14:38 ` [PATCH v4] pg_stat_statements: Add last_execution_start column Pavlo Golub <[email protected]>
2026-06-04 10:00 ` Re: [PATCH v4] pg_stat_statements: Add last_execution_start column Anthonin Bonnefoy <[email protected]>
2026-06-04 20:54 ` Re: [PATCH v4] pg_stat_statements: Add last_execution_start column Zsolt Parragi <[email protected]>
2026-06-09 13:16 ` Re: [PATCH v4] pg_stat_statements: Add last_execution_start column Peter Eisentraut <[email protected]>
2026-06-09 21:31 ` Re: [PATCH v4] pg_stat_statements: Add last_execution_start column Sami Imseih <[email protected]>
2026-06-10 17:36 ` [PATCH v5] pg_stat_statements: Add last_execution_start column Pavlo Golub <[email protected]>
2026-06-10 18:03 ` Re: [PATCH v5] pg_stat_statements: Add last_execution_start column Andres Freund <[email protected]>
2026-06-10 21:21 ` Re: [PATCH v5] pg_stat_statements: Add last_execution_start column Zsolt Parragi <[email protected]>
2026-06-10 21:32 ` Re: [PATCH v5] pg_stat_statements: Add last_execution_start column Sami Imseih <[email protected]>
2026-06-10 21:22 ` Re: [PATCH v5] pg_stat_statements: Add last_execution_start column Sami Imseih <[email protected]>
This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox