484 files changed, 3823 insertions, 2662 deletions
diff --git a/test/aux-fixed/crl.pem b/test/aux-fixed/crl.pem
deleted file mode 100644
index 1cb30e8a2..000000000
--- a/test/aux-fixed/crl.pem
+++ /dev/null
@@ -1,12 +0,0 @@
------BEGIN X509 CRL-----
-MIIBzzCBuAIBATANBgkqhkiG9w0BAQUFADBYMQswCQYDVQQGEwJVSzEdMBsGA1UE
-ChMUVGhlIEV4aW0gTWFpbnRhaW5lcnMxEzARBgNVBAsTClRlc3QgU3VpdGUxFTAT
-BgNVBAMTDFBoaWwgUGVubm9jaxcNMTIwNTE3MTUwMjI0WhcNMjYwNTE0MTUwMjI0
-WjAcMBoCCQCBuZ2uoAz0zRcNMTIwNTE3MTUwMDQ0WqAOMAwwCgYDVR0UBAMCAQIw
-DQYJKoZIhvcNAQEFBQADggEBADuR38p1aAdpHXEN+JZQ7ZnBRAOIZ+ZHb8I4SY9T
-EjnaVhhaI5NpVzan+ETbgAsRxs9gVgvyeVzRbTtY5hWw5Y0DuC53eD8eP5r/uUln
-rxGpy2FQpKTXCAQPOnnXC9jieVu2jkZr++wH3r9MkfCfVJkq72+Bp5DUkzGdbVUa
-7FgbVCGFAb8UmbcZPeeOHrY66gxn7k8Fm9fyBPR8+cVlH6proOnPunYG5mPUmK+J
-3B59/a6Lb6aZwmr+JntjPGPABopb72FDHptXJsTby1ghGd+V7AjvXIEsrbI3JEUI
-4TvT1nxE/4r1f8SATp7eM7pyXhfB6tv1E5UVDMepMWDRsbA=
------END X509 CRL-----
diff --git a/test/aux-fixed/exim-ca/README b/test/aux-fixed/exim-ca/README
index 136f4c97a..98de5d43d 100644..100755
--- a/test/aux-fixed/exim-ca/README
+++ b/test/aux-fixed/exim-ca/README
@@ -1,7 +1,9 @@
 
 The three directories each contain a complete CA with server signing
 certificate, OCSP signing certificate and a selection of server
-certificates under each domain.
+certificates under each domain. The "server1" certificates have
+a CRL distribution point extension; the "server2" ones instead have
+a Authority Key extension/
 
 For each directory there are a number of subdirectories.
 
diff --git a/test/aux-fixed/exim-ca/README.regenerate b/test/aux-fixed/exim-ca/README.regenerate
index aba0a8f08..aba0a8f08 100644..100755
--- a/test/aux-fixed/exim-ca/README.regenerate
+++ b/test/aux-fixed/exim-ca/README.regenerate
diff --git a/test/aux-fixed/exim-ca/example.com/BLANK/CA.pem b/test/aux-fixed/exim-ca/example.com/BLANK/CA.pem
index 8695b3696..ecd523b31 100644
--- a/test/aux-fixed/exim-ca/example.com/BLANK/CA.pem
+++ b/test/aux-fixed/exim-ca/example.com/BLANK/CA.pem
@@ -1,13 +1,13 @@
 -----BEGIN CERTIFICATE-----
-MIIB9jCCAV+gAwIBAgIBATANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+MIIB9jCCAV+gAwIBAgIBQTANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
 cGxlLmNvbTEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwMVoX
 DTM4MDEwMTEyMzQwMVowLTEUMBIGA1UEChMLZXhhbXBsZS5jb20xFTATBgNVBAMT
-DGNsaWNhIENBIHJzYTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA2N3YjbHA
-BEKAiUHwJ0VMAAe/KMOM8slXOAKni4v7Vf6BzbO5B6uaKhDV2n3V0vXwMdAoeBaq
-3s9CHOjDXwjF1qf/p4w3Z2aUIVt/Mb+uEcPUlq0Nr8OLlH11QKbkvFtLxU3sUAoi
-fcaydi1q3tszjPQ0tKlLo6kOzcgi8d47WccCAwEAAaMmMCQwEgYDVR0TAQH/BAgw
-BgEB/wIBATAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADgYEAAzD/Zszo
-X4ieSQQxDOH53VkiAJDs32qso9YzGbQaenuRnVFCuo7rt68cjMcOjzf18/I+iMeH
-nEcdqkfoYB4Z3LXvDaRGZhg/ZOv58muzRnsW2oQI9yFqDwD0FZPtM6Vq0AWXjLuq
-IogOI5fShSo7H5hc3vrkvS7KUhzuv3FKnaQ=
+DGNsaWNhIENBIHJzYTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAyDGCW64u
+Q5CBaKQGpgZVwGjo+VAn2EpwbfCZkhJtnxESiZYigjBH8KaOcAGyuv6jqY3pP64u
+gPe3lRkqwnvnLkj4wYo7d1GpW12yRCN/n7oMUcHLceqeLc8iYy6k1szF+jdlcRPL
+2OXNEy2pgzsPRyWZyCS2xZE86byA4N+/Y5cCAwEAAaMmMCQwEgYDVR0TAQH/BAgw
+BgEB/wIBATAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADgYEAeQnAdtC4
+EWA5tl8hRlOmc7IM6c40MJRB73/Oiul8xcS4l2qRLXUAWJjddxMPrLf4AYmc0vQz
+rcWmvkfdnjqX235D5YaOvfsIKr+YThtbSUvSK/uCGCxmiQHLQIWa7oWnFExIAjFd
+xxxXmvnPPG86dFoAm4AGS6kynXmWc4tvKYI=
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.com/BLANK/Signer.pem b/test/aux-fixed/exim-ca/example.com/BLANK/Signer.pem
index 46a83eb29..25bd38a5f 100644
--- a/test/aux-fixed/exim-ca/example.com/BLANK/Signer.pem
+++ b/test/aux-fixed/exim-ca/example.com/BLANK/Signer.pem
@@ -1,14 +1,14 @@
 -----BEGIN CERTIFICATE-----
-MIICNDCCAZ2gAwIBAgIBAjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+MIICGDCCAYGgAwIBAgIBQjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
 cGxlLmNvbTEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwMVoX
 DTM4MDEwMTEyMzQwMVowNzEUMBIGA1UEChMLZXhhbXBsZS5jb20xHzAdBgNVBAMT
 FmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
-AoGBANlcwo5q84SEtVy5W/xqbYAzOiYUZ0Shp9+ry/Q/X5uhrDF9JSHNWJbXut+8
-ZJGICt0RYVIJCcaa7FUt5hTKEx4fgURr+Hz84ZgwesMxcECHJPq9ylrCqbPkbmFR
-1XUy2MvioMH2lyc/PbV62XXggJhHioStVLRfyVlkS1KvvR+HAgMBAAGjWjBYMA4G
-A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMDIGA1UdHwQrMCkwJ6Al
-oCOGIWh0dHA6Ly9jcmwuZXhhbXBsZS5jb20vbGF0ZXN0LmNybDANBgkqhkiG9w0B
-AQsFAAOBgQBtPJwqu7DiDmFZd58L4xQ6JJhrJzJUDHmT7ikW2tOM58yisCgSnzrR
-xihW+49vUQ9lSGxBHaFwdehAuGTXydnf7/i9i6KA2RZ+Rq12FJFYOhjaIP7Sy1zq
-VXtb+P1eDBQQhz0WgysLVjgGdBiokRv86yY56ficoTQ6EyWzQLCU+A==
+AoGBALFHTtwaKeCfLlDf/wTErhOB6AB9vKHtyDbU6yDB/DrA5DLbug8m1oGGwEIf
+lTY0VBym8/Iu/ExE476gRmPNX/kIQsSNj9LtCIx3JXqLpc8ylw4cuVMOeFtBXNtE
+YKvUPIyWaAvqBbwY1QOyHNeoJ68hBdDPCn3oN2wrCz4if9QHAgMBAAGjPjA8MA4G
+A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMBYGA1UdDgQPBA1BQWJ0
+d0N4Y1hnYjBRMA0GCSqGSIb3DQEBCwUAA4GBAERD495HPM1BxM60EHGYLQgPjJPT
+/cL+nTKyIdv2UvzAnJaSFMMAB43Twy/jvkahsITVuieSU4kpev79KRNLfk+h25pf
+oPjaOfmOQVtHWN9ML8FDs0dLkRhJPuagObx17l/KEPkiK/jLB339fyO1HxaKhymE
+hdqYsdjjnBy/6U5g
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.com/BLANK/cert8.db b/test/aux-fixed/exim-ca/example.com/BLANK/cert8.db
index 5fc8c5baf..7685bc776 100644
--- a/test/aux-fixed/exim-ca/example.com/BLANK/cert8.db
+++ b/test/aux-fixed/exim-ca/example.com/BLANK/cert8.db
diff --git a/test/aux-fixed/exim-ca/example.com/BLANK/key3.db b/test/aux-fixed/exim-ca/example.com/BLANK/key3.db
index 7c95320c9..e25620d62 100644
--- a/test/aux-fixed/exim-ca/example.com/BLANK/key3.db
+++ b/test/aux-fixed/exim-ca/example.com/BLANK/key3.db
diff --git a/test/aux-fixed/exim-ca/example.com/CA/CA.pem b/test/aux-fixed/exim-ca/example.com/CA/CA.pem
index 8695b3696..ecd523b31 100644
--- a/test/aux-fixed/exim-ca/example.com/CA/CA.pem
+++ b/test/aux-fixed/exim-ca/example.com/CA/CA.pem
@@ -1,13 +1,13 @@
 -----BEGIN CERTIFICATE-----
-MIIB9jCCAV+gAwIBAgIBATANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+MIIB9jCCAV+gAwIBAgIBQTANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
 cGxlLmNvbTEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwMVoX
 DTM4MDEwMTEyMzQwMVowLTEUMBIGA1UEChMLZXhhbXBsZS5jb20xFTATBgNVBAMT
-DGNsaWNhIENBIHJzYTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA2N3YjbHA
-BEKAiUHwJ0VMAAe/KMOM8slXOAKni4v7Vf6BzbO5B6uaKhDV2n3V0vXwMdAoeBaq
-3s9CHOjDXwjF1qf/p4w3Z2aUIVt/Mb+uEcPUlq0Nr8OLlH11QKbkvFtLxU3sUAoi
-fcaydi1q3tszjPQ0tKlLo6kOzcgi8d47WccCAwEAAaMmMCQwEgYDVR0TAQH/BAgw
-BgEB/wIBATAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADgYEAAzD/Zszo
-X4ieSQQxDOH53VkiAJDs32qso9YzGbQaenuRnVFCuo7rt68cjMcOjzf18/I+iMeH
-nEcdqkfoYB4Z3LXvDaRGZhg/ZOv58muzRnsW2oQI9yFqDwD0FZPtM6Vq0AWXjLuq
-IogOI5fShSo7H5hc3vrkvS7KUhzuv3FKnaQ=
+DGNsaWNhIENBIHJzYTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAyDGCW64u
+Q5CBaKQGpgZVwGjo+VAn2EpwbfCZkhJtnxESiZYigjBH8KaOcAGyuv6jqY3pP64u
+gPe3lRkqwnvnLkj4wYo7d1GpW12yRCN/n7oMUcHLceqeLc8iYy6k1szF+jdlcRPL
+2OXNEy2pgzsPRyWZyCS2xZE86byA4N+/Y5cCAwEAAaMmMCQwEgYDVR0TAQH/BAgw
+BgEB/wIBATAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADgYEAeQnAdtC4
+EWA5tl8hRlOmc7IM6c40MJRB73/Oiul8xcS4l2qRLXUAWJjddxMPrLf4AYmc0vQz
+rcWmvkfdnjqX235D5YaOvfsIKr+YThtbSUvSK/uCGCxmiQHLQIWa7oWnFExIAjFd
+xxxXmvnPPG86dFoAm4AGS6kynXmWc4tvKYI=
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.com/CA/OCSP.key b/test/aux-fixed/exim-ca/example.com/CA/OCSP.key
index bc3ac3dd6..b039e2ae8 100644
--- a/test/aux-fixed/exim-ca/example.com/CA/OCSP.key
+++ b/test/aux-fixed/exim-ca/example.com/CA/OCSP.key
@@ -1,20 +1,20 @@
 Bag Attributes
     friendlyName: OCSP Signer rsa
-    localKeyID: DF 7B 92 8A 30 65 84 F5 1F 40 C2 E3 04 B8 D5 94 4B 27 A3 0A 
+    localKeyID: E2 FA 33 F3 03 63 BA D3 6A 68 73 26 A7 0F 5A 17 58 37 00 95 
 Key Attributes: <No Attributes>
 -----BEGIN PRIVATE KEY-----
-MIICdwIBADANBgkqhkiG9w0BAQEFAASCAmEwggJdAgEAAoGBANfwT5lSrhpXixJb
-YhRazEgMSNNfUrJ5y1Qyh24hGpwyV6njExis/lSzce77xW/f+g1M9DKa9c971B5+
-bpSoH+b3psJEHQ2lx8I3tBnQMzjAaIJknLNoEyE47gqAT7KmLINS1hIFVgMObg8q
-LvXO1NN4pUKUPNaVb8bMe3hTSWl/AgMBAAECgYALabxN879CTX81ugETPKtQYYnV
-1ijGSHFVOBMitdA0vOUXlGoKzgCRPydrRKuuRThvodzER0ltAnP3JU04lobnssl9
-5hCLEA3YFJ+Xu1Rp3ZijJkUaPpBMxxvojceW/jn9SZYj76AiOVHcToLqmWcQylk7
-pQ9aC+tML8/WWO4I0QJBAP7no1XNczYeygGlVJUlwj+vJhGfkEBflDjcxZsQjzft
-wpoZcFxxmTMZPoesQPxiiLQioLR0sYkPpqXqDpB1K/ECQQDY3dC1flCrlJxV3JYV
-gneZL9oFfdHlFWovR61Mm03qdW4pkqag934WAcJhW5baoCYtisZcwhBu2u0C9KIb
-fRxvAkEAqst6XZtzfufSYpfsvKK4LQOmdlh7xyZDonYK0YOe8tKUebxh1Q8on1xi
-0XVRdcpv3oL1OvSVoEikWLcjWxengQJBAK4QS8aA3kr5ewnHhYc6Mrh3meyyclgG
-+jV8uHI2bTF0k7k2hhvIyiDrxJLUKp7L0BjZvCETepEfkwC+Tab2om0CQHSaLUT8
-TtGDEOIJ+6jWoGOGaHXy2HOPPAP6BKmQ4zndbPM5DXo7DXOZF9Wv2JhCqvtCVXi/
-uTasfeGJOuOrp9U=
+MIICdgIBADANBgkqhkiG9w0BAQEFAASCAmAwggJcAgEAAoGBAK8Sadt5dFFR8Ad5
+McPMCQbqKFV8DQP0QfnMq5IWxZMSGpcbi3RJLe24R+ZZ39tAkGsKNzPT7YgvQIne
+Xa9Cb2t9UucJqu4GXA+3ahOd+pDrnbtJb1f7AI4+KNDAik4sHgxe7yQphugck1bY
+9Rvxk0yGVytfTuNKzjkK1qV2N7bDAgMBAAECgYAqCPJIw5slkVZf/P3xZJKASgWg
+LNZVLjcPGtDRFU2f99dRk8gChjWUX8xHpymkE5b5VG0XsRlVuv60e6Mj2wA0OamS
+Q2rILLIEqL3R0rBhyvcSq8fvjtTFrO10Yl/GL9xm4z7daaqraBuYDlzhSCbc+y5h
+BZwrEzWNvR8sDZzuUQJBANakmIJOj2QmCVxvoXINrxHRrMeAdGucVqCprHNe6+Ny
+3HhSY/L+4uIy49uZyuJc5n2QIE/n0SK6epWhj2Dp7zMCQQDQzfN4vhAtUMX5lain
++QLSgK4wi8f2saQcDPgqpOl12JsghpDHx3XBfYb6Dh4+K6JumVcmc98fc9ZcuVur
+Q1oxAkA/qYYKcB6bh6STJBDwcRqR4Gysp27gU/hloq2hcm/ogDLgBR/b/LlyecGX
+aqAAT6mVaGANEya2dDTTmJ2cEwZ9AkEAk1oTzIyMS/5ph8V2nPtcY4MN6hJqzgv0
+nRsF8sooOtLePmjYOTPoROC55TMbYpJWcahi2S8CMWcEyrDAIS9JsQJAa721f6yV
+ddxPZ33OxHN2egqb0VZ0pwBQWfgoX5jK8fkpof/LclZnXau4x9G+5N8Q80ea0JAJ
+grA/N012n/qfIQ==
 -----END PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.com/CA/OCSP.p12 b/test/aux-fixed/exim-ca/example.com/CA/OCSP.p12
index 877a0865b..53e5ea346 100644
--- a/test/aux-fixed/exim-ca/example.com/CA/OCSP.p12
+++ b/test/aux-fixed/exim-ca/example.com/CA/OCSP.p12
diff --git a/test/aux-fixed/exim-ca/example.com/CA/OCSP.pem b/test/aux-fixed/exim-ca/example.com/CA/OCSP.pem
index 4374c4892..e6f959fdf 100644
--- a/test/aux-fixed/exim-ca/example.com/CA/OCSP.pem
+++ b/test/aux-fixed/exim-ca/example.com/CA/OCSP.pem
@@ -1,14 +1,14 @@
 -----BEGIN CERTIFICATE-----
-MIICDTCCAXagAwIBAgIBAzANBgkqhkiG9w0BAQsFADA3MRQwEgYDVQQKEwtleGFt
+MIICDTCCAXagAwIBAgIBQzANBgkqhkiG9w0BAQsFADA3MRQwEgYDVQQKEwtleGFt
 cGxlLmNvbTEfMB0GA1UEAxMWY2xpY2EgU2lnbmluZyBDZXJ0IHJzYTAeFw0xMjEx
 MDExMjM0MDFaFw0zODAxMDExMjM0MDFaMDYxFDASBgNVBAoTC2V4YW1wbGUuY29t
 MR4wHAYDVQQDExVjbGljYSBPQ1NQIFNpZ25lciByc2EwgZ8wDQYJKoZIhvcNAQEB
-BQADgY0AMIGJAoGBANfwT5lSrhpXixJbYhRazEgMSNNfUrJ5y1Qyh24hGpwyV6nj
-Exis/lSzce77xW/f+g1M9DKa9c971B5+bpSoH+b3psJEHQ2lx8I3tBnQMzjAaIJk
-nLNoEyE47gqAT7KmLINS1hIFVgMObg8qLvXO1NN4pUKUPNaVb8bMe3hTSWl/AgMB
+BQADgY0AMIGJAoGBAK8Sadt5dFFR8Ad5McPMCQbqKFV8DQP0QfnMq5IWxZMSGpcb
+i3RJLe24R+ZZ39tAkGsKNzPT7YgvQIneXa9Cb2t9UucJqu4GXA+3ahOd+pDrnbtJ
+b1f7AI4+KNDAik4sHgxe7yQphugck1bY9Rvxk0yGVytfTuNKzjkK1qV2N7bDAgMB
 AAGjKjAoMA4GA1UdDwEB/wQEAwIHgDAWBgNVHSUBAf8EDDAKBggrBgEFBQcDCTAN
-BgkqhkiG9w0BAQsFAAOBgQCJjBL0Q8ZmS1u+Ch1GQYctaj6ob+3qtYHYURCmXnZB
-dQIL9BIsZ8bPRjs1i7Og1EfsWp7INs2qTsThPa4OWFYLrI55AvI/9ztwjf5i2BKJ
-aS8yVTmxSb+K/6wUOo4frpHtq/xogNSVhuD0b99xk76cSEganrtEE6dClZMJu9o8
-Qg==
+BgkqhkiG9w0BAQsFAAOBgQAMPEaTi7g8PZuliLt1ODdQmheZSoIzY6YVXCVZvJUQ
+3ibb8ANAkrXX343bN5VTtuXNa5K629/Dr2jjZiBOlUDyXxI8Gz7sZpShX1WheQsD
+mfRmCkeZo5iYYwUXNYAmSkymi8IP0n8qFakvhBUxpaAEYRJwZUZx1mtRkt4KzPXi
+9w==
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.com/CA/Signer.key b/test/aux-fixed/exim-ca/example.com/CA/Signer.key
index 76b414e25..d7a3326a3 100644
--- a/test/aux-fixed/exim-ca/example.com/CA/Signer.key
+++ b/test/aux-fixed/exim-ca/example.com/CA/Signer.key
@@ -1,20 +1,20 @@
 Bag Attributes
     friendlyName: Signing Cert rsa
-    localKeyID: 99 41 8D A8 6D 6D BA 5B D5 FF CE 4A 2F 1F CE A0 88 4C 77 87 
+    localKeyID: A1 F3 F4 37 A3 B9 CB 70 4F 22 65 FF 3B D0 08 66 E5 CB 25 2C 
 Key Attributes: <No Attributes>
 -----BEGIN PRIVATE KEY-----
-MIICdQIBADANBgkqhkiG9w0BAQEFAASCAl8wggJbAgEAAoGBANlcwo5q84SEtVy5
-W/xqbYAzOiYUZ0Shp9+ry/Q/X5uhrDF9JSHNWJbXut+8ZJGICt0RYVIJCcaa7FUt
-5hTKEx4fgURr+Hz84ZgwesMxcECHJPq9ylrCqbPkbmFR1XUy2MvioMH2lyc/PbV6
-2XXggJhHioStVLRfyVlkS1KvvR+HAgMBAAECgYA8HZ0LgYXvMTrttbA8q/yz97cN
-4Be9kg4ZXOzQFRTuuLSkjU2PPzlQosKi7XpNC7ihcpSdeTV0cdWKK2MWfdryN4V4
-6PazAXU1scw8IaL1nsLY3B22cyc0I3FAN7KD/DitqHfGvIBxVHBVnY7nCnG5jtkA
-M6YlVsktAhv2PwAiWQJBAP2xKizmPHb5ivcxwBB0CyH5Za3WghPE9EIN4HyBw2m+
-ph3g66KY1DjN/bZWunB4f9DjVOGBQBcSmETjqwPJcv8CQQDbVvw7+9S+FnIuIrA9
-Bs/XovnFsFdN8itIjv1DpruDctUOa3WFHtGBRn816PVeS6ZAMri5TDvPqoThgD1I
-+zt5AkBtSwgKc94Uu4kc2bgO3o91QYaGj+VWMwGv+159BUJ0qgfS03VwhTrYhhYJ
-me+USLV3/pgw1ogP6JjlBNhGN2FtAkBhuTSySPY1Ju0CTyQ0XGeXzJ36DSIosT/F
-mSePz6Z132C7hvcaM2vmbBFbZIqF07Cjo7WXoTZ4xKFlkuw7KuwJAkA1aQipz4g5
-7bRW+8/h0+k9ZlYZlJyaQlIA2lMLJLVu3WPd9e3+8AxIS49I1iJKEDlGwtigPt4x
-uJx/V9ryk+xn
+MIICdQIBADANBgkqhkiG9w0BAQEFAASCAl8wggJbAgEAAoGBALFHTtwaKeCfLlDf
+/wTErhOB6AB9vKHtyDbU6yDB/DrA5DLbug8m1oGGwEIflTY0VBym8/Iu/ExE476g
+RmPNX/kIQsSNj9LtCIx3JXqLpc8ylw4cuVMOeFtBXNtEYKvUPIyWaAvqBbwY1QOy
+HNeoJ68hBdDPCn3oN2wrCz4if9QHAgMBAAECgYAJlnB+mUoLUR1kiyWNqncHrKge
+SEgu/pJfdMoRB9/0uLRR+jqb0ZJN7jqKDCjTuT/7TlECZH9WPwhaKbmxpOY8LwWc
+BK3p6xnjuvgw4DvDUN8U4wQe6bNRcuHaz+X29AeXMjESn5rVhlRtirbFFXUlT6fE
+EouTtGGkjmb2CMPvgQJBAOAV+rOGyuJey8RxHmjQAomwDznw/2PbTZVySTxKLSi9
+5V5xYXGpEKsAfzskNizu9NlccsoIrG8qGtk3h02PLaECQQDKhsP3TnD8YEgTSqkD
+J1yErHOnoN4JYxLUGH/vW/G2fd8NEgY08Qc3mxeUgPr31tkxXeywH3EninZEfEnY
+3xCnAkBqKB9vQxEEMpJnyor0bm51WfGsqk3iuXbEsLKfHCjOnz91AVN/a+9Yg1DC
+7MG5ga5+9nvu2DMQKqszcknn5UdhAkAF+5UuaRLNYcq/RyVXAoKpKK8B9K6aeGLG
+ATNGTuEFExLTwASO68/axKodqPHBAIfJ/YxQZ51gHacAvusvjOdhAkAyGZAo9RxY
+PxM0xAmKKIcXbhNol6AqgpvmNV6HV+JXqJzuIiyzlbPFgfd+JQe6OrxYgfVvmiKv
+wFSymVKzv1Vs
 -----END PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.com/CA/Signer.p12 b/test/aux-fixed/exim-ca/example.com/CA/Signer.p12
index 2d30fe16a..0cd6aaf32 100644
--- a/test/aux-fixed/exim-ca/example.com/CA/Signer.p12
+++ b/test/aux-fixed/exim-ca/example.com/CA/Signer.p12
diff --git a/test/aux-fixed/exim-ca/example.com/CA/Signer.pem b/test/aux-fixed/exim-ca/example.com/CA/Signer.pem
index 46a83eb29..25bd38a5f 100644
--- a/test/aux-fixed/exim-ca/example.com/CA/Signer.pem
+++ b/test/aux-fixed/exim-ca/example.com/CA/Signer.pem
@@ -1,14 +1,14 @@
 -----BEGIN CERTIFICATE-----
-MIICNDCCAZ2gAwIBAgIBAjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+MIICGDCCAYGgAwIBAgIBQjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
 cGxlLmNvbTEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwMVoX
 DTM4MDEwMTEyMzQwMVowNzEUMBIGA1UEChMLZXhhbXBsZS5jb20xHzAdBgNVBAMT
 FmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
-AoGBANlcwo5q84SEtVy5W/xqbYAzOiYUZ0Shp9+ry/Q/X5uhrDF9JSHNWJbXut+8
-ZJGICt0RYVIJCcaa7FUt5hTKEx4fgURr+Hz84ZgwesMxcECHJPq9ylrCqbPkbmFR
-1XUy2MvioMH2lyc/PbV62XXggJhHioStVLRfyVlkS1KvvR+HAgMBAAGjWjBYMA4G
-A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMDIGA1UdHwQrMCkwJ6Al
-oCOGIWh0dHA6Ly9jcmwuZXhhbXBsZS5jb20vbGF0ZXN0LmNybDANBgkqhkiG9w0B
-AQsFAAOBgQBtPJwqu7DiDmFZd58L4xQ6JJhrJzJUDHmT7ikW2tOM58yisCgSnzrR
-xihW+49vUQ9lSGxBHaFwdehAuGTXydnf7/i9i6KA2RZ+Rq12FJFYOhjaIP7Sy1zq
-VXtb+P1eDBQQhz0WgysLVjgGdBiokRv86yY56ficoTQ6EyWzQLCU+A==
+AoGBALFHTtwaKeCfLlDf/wTErhOB6AB9vKHtyDbU6yDB/DrA5DLbug8m1oGGwEIf
+lTY0VBym8/Iu/ExE476gRmPNX/kIQsSNj9LtCIx3JXqLpc8ylw4cuVMOeFtBXNtE
+YKvUPIyWaAvqBbwY1QOyHNeoJ68hBdDPCn3oN2wrCz4if9QHAgMBAAGjPjA8MA4G
+A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMBYGA1UdDgQPBA1BQWJ0
+d0N4Y1hnYjBRMA0GCSqGSIb3DQEBCwUAA4GBAERD495HPM1BxM60EHGYLQgPjJPT
+/cL+nTKyIdv2UvzAnJaSFMMAB43Twy/jvkahsITVuieSU4kpev79KRNLfk+h25pf
+oPjaOfmOQVtHWN9ML8FDs0dLkRhJPuagObx17l/KEPkiK/jLB339fyO1HxaKhymE
+hdqYsdjjnBy/6U5g
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.com/CA/ca.conf b/test/aux-fixed/exim-ca/example.com/CA/ca.conf
index ae7b6b644..eecd87c27 100644
--- a/test/aux-fixed/exim-ca/example.com/CA/ca.conf
+++ b/test/aux-fixed/exim-ca/example.com/CA/ca.conf
@@ -2,17 +2,17 @@
 ; Thu Nov  1 12:34:01 2012
 
 [CA]
-name=Certificate Authority rsa
+bits=1024
 subject=clica CA
+name=Certificate Authority rsa
 org=example.com
-bits=1024
 
 [CLICA]
+sighash=SHA256
 ocsp_signer=OCSP Signer rsa
-signer=Signing Cert rsa
+crl_url=http://crl.example.com/latest.crl
 level=1
-sighash=SHA256
 ocsp_url=http://oscp.example.com/
-crl_url=http://crl.example.com/latest.crl
+signer=Signing Cert rsa
 
 
diff --git a/test/aux-fixed/exim-ca/example.com/CA/cert8.db b/test/aux-fixed/exim-ca/example.com/CA/cert8.db
index 9513a3b2d..b9b624243 100644
--- a/test/aux-fixed/exim-ca/example.com/CA/cert8.db
+++ b/test/aux-fixed/exim-ca/example.com/CA/cert8.db
diff --git a/test/aux-fixed/exim-ca/example.com/CA/crl.Signer b/test/aux-fixed/exim-ca/example.com/CA/crl.Signer
new file mode 100644
index 000000000..7c9b5da32
--- /dev/null
+++ b/test/aux-fixed/exim-ca/example.com/CA/crl.Signer
diff --git a/test/aux-fixed/exim-ca/example.com/CA/crl.Signer.in.txt b/test/aux-fixed/exim-ca/example.com/CA/crl.Signer.in.txt
new file mode 100644
index 000000000..8f00adf1e
--- /dev/null
+++ b/test/aux-fixed/exim-ca/example.com/CA/crl.Signer.in.txt
@@ -0,0 +1 @@
+update=20171217205108Z 
diff --git a/test/aux-fixed/exim-ca/example.com/CA/crl.Signer.pem b/test/aux-fixed/exim-ca/example.com/CA/crl.Signer.pem
new file mode 100644
index 000000000..fb00dc38d
--- /dev/null
+++ b/test/aux-fixed/exim-ca/example.com/CA/crl.Signer.pem
@@ -0,0 +1,7 @@
+-----BEGIN X509 CRL-----
+MIHnMFICAQEwDQYJKoZIhvcNAQELBQAwLTEUMBIGA1UEChMLZXhhbXBsZS5jb20x
+FTATBgNVBAMTDGNsaWNhIENBIHJzYRgPMjAxNzEyMTcyMDUxMDhaMA0GCSqGSIb3
+DQEBCwUAA4GBAKTxaFNLywmLS8lwq8Zovv02EVqND7cRXlJByZJhxutszkDchMq5
+oEFPbxW8+Fc3tZqTMMLq2Fu5tViVzL0ziVVNs2l98wG3ws0PAXeiFYPJ0FgBYdam
+OEkTkAs8SwjUYq7YOVK2pzFK2NJ2f0uld1LfwMmLiYXBiRnIbiUW1fx+
+-----END X509 CRL-----
diff --git a/test/aux-fixed/exim-ca/example.com/CA/crl.chain.pem b/test/aux-fixed/exim-ca/example.com/CA/crl.chain.pem
new file mode 100644
index 000000000..20ba802ee
--- /dev/null
+++ b/test/aux-fixed/exim-ca/example.com/CA/crl.chain.pem
@@ -0,0 +1,16 @@
+-----BEGIN X509 CRL-----
+MIHnMFICAQEwDQYJKoZIhvcNAQELBQAwLTEUMBIGA1UEChMLZXhhbXBsZS5jb20x
+FTATBgNVBAMTDGNsaWNhIENBIHJzYRgPMjAxNzEyMTcyMDUxMDhaMA0GCSqGSIb3
+DQEBCwUAA4GBAKTxaFNLywmLS8lwq8Zovv02EVqND7cRXlJByZJhxutszkDchMq5
+oEFPbxW8+Fc3tZqTMMLq2Fu5tViVzL0ziVVNs2l98wG3ws0PAXeiFYPJ0FgBYdam
+OEkTkAs8SwjUYq7YOVK2pzFK2NJ2f0uld1LfwMmLiYXBiRnIbiUW1fx+
+-----END X509 CRL-----
+-----BEGIN X509 CRL-----
+MIIBITCBiwIBATANBgkqhkiG9w0BAQsFADA3MRQwEgYDVQQKEwtleGFtcGxlLmNv
+bTEfMB0GA1UEAxMWY2xpY2EgU2lnbmluZyBDZXJ0IHJzYRgPMjAxNzEyMTcyMDUx
+MDhaMC0wFAIBZhgPMjAxNzEyMTcyMDUxMDhaMBUCAgDKGA8yMDE3MTIxNzIwNTEw
+OFowDQYJKoZIhvcNAQELBQADgYEAn5ZwGpzxpslUm/7LRkIlajXyzGp+8iTsovc6
+6ibiOtZo0q1gp8AooZDv5lrZkWDVzYOs+eozzI0sOROxpQ4SE81dEwwBy9DlTvQu
+MA7DFDQWYPr3BoK4VRIJwjrHBY8UClt8DwY7O2NwtDHakslLFgq0dFZHKcW9c34T
+3qkrgBk=
+-----END X509 CRL-----
diff --git a/test/aux-fixed/exim-ca/example.com/CA/crl.empty b/test/aux-fixed/exim-ca/example.com/CA/crl.empty
index db811f4e8..84b568977 100644
--- a/test/aux-fixed/exim-ca/example.com/CA/crl.empty
+++ b/test/aux-fixed/exim-ca/example.com/CA/crl.empty
diff --git a/test/aux-fixed/exim-ca/example.com/CA/crl.empty.in.txt b/test/aux-fixed/exim-ca/example.com/CA/crl.empty.in.txt
index 5c3cda501..dc66bdfc9 100644
--- a/test/aux-fixed/exim-ca/example.com/CA/crl.empty.in.txt
+++ b/test/aux-fixed/exim-ca/example.com/CA/crl.empty.in.txt
@@ -1 +1 @@
-update=20171105161901Z 
+update=20171217205106Z 
diff --git a/test/aux-fixed/exim-ca/example.com/CA/crl.empty.pem b/test/aux-fixed/exim-ca/example.com/CA/crl.empty.pem
index c77198919..0c442e975 100644
--- a/test/aux-fixed/exim-ca/example.com/CA/crl.empty.pem
+++ b/test/aux-fixed/exim-ca/example.com/CA/crl.empty.pem
@@ -1,8 +1,8 @@
 -----BEGIN X509 CRL-----
 MIHxMFwCAQEwDQYJKoZIhvcNAQELBQAwNzEUMBIGA1UEChMLZXhhbXBsZS5jb20x
-HzAdBgNVBAMTFmNsaWNhIFNpZ25pbmcgQ2VydCByc2EYDzIwMTcxMTA1MTYxOTAx
-WjANBgkqhkiG9w0BAQsFAAOBgQA3fw/iu8rnPn5It/R8IHmx+65u1PC851Y0N2QV
-AuKfYM9PsoCykxFXC3YVq7pL/PecqTZEsE/aoQx6HuBdfJnLWB5djArqSUua/ENY
-lYabOFfr8ueNQmC+mcqbuATx6pt33JzXNPD13uhTKwFjkx1A7DrlQX/jkqUZe8nH
-HCCDeA==
+HzAdBgNVBAMTFmNsaWNhIFNpZ25pbmcgQ2VydCByc2EYDzIwMTcxMjE3MjA1MTA2
+WjANBgkqhkiG9w0BAQsFAAOBgQAOfOXd2OgzRF9Ftj0Nuh19RRunj9P1InuaLynR
+l6DhlXHRwUD6/YkBGvMgJp27UT/1d67yyGBD4kpEJcgGMeJ6Yq7O7gA+V0tdQcnY
+3rblV3hkzsEkzemfMdF8FnZLZuCyJHxSh7kbmR9dqYHDLF/tiNWt3awTMtXB54fT
+PW09hw==
 -----END X509 CRL-----
diff --git a/test/aux-fixed/exim-ca/example.com/CA/crl.v2 b/test/aux-fixed/exim-ca/example.com/CA/crl.v2
index cc4c5d7c5..21ee927d0 100644
--- a/test/aux-fixed/exim-ca/example.com/CA/crl.v2
+++ b/test/aux-fixed/exim-ca/example.com/CA/crl.v2
diff --git a/test/aux-fixed/exim-ca/example.com/CA/crl.v2.in.txt b/test/aux-fixed/exim-ca/example.com/CA/crl.v2.in.txt
index 20311aa93..7c2dcd446 100644
--- a/test/aux-fixed/exim-ca/example.com/CA/crl.v2.in.txt
+++ b/test/aux-fixed/exim-ca/example.com/CA/crl.v2.in.txt
@@ -1,3 +1,3 @@
-update=20171105161903Z 
-addcert 102 20171105161903Z
-addcert 202 20171105161903Z
+update=20171217205108Z 
+addcert 102 20171217205108Z
+addcert 202 20171217205108Z
diff --git a/test/aux-fixed/exim-ca/example.com/CA/crl.v2.pem b/test/aux-fixed/exim-ca/example.com/CA/crl.v2.pem
index 7840f5d41..2b2f1f434 100644
--- a/test/aux-fixed/exim-ca/example.com/CA/crl.v2.pem
+++ b/test/aux-fixed/exim-ca/example.com/CA/crl.v2.pem
@@ -1,9 +1,9 @@
 -----BEGIN X509 CRL-----
 MIIBITCBiwIBATANBgkqhkiG9w0BAQsFADA3MRQwEgYDVQQKEwtleGFtcGxlLmNv
-bTEfMB0GA1UEAxMWY2xpY2EgU2lnbmluZyBDZXJ0IHJzYRgPMjAxNzExMDUxNjE5
-MDNaMC0wFAIBZhgPMjAxNzExMDUxNjE5MDNaMBUCAgDKGA8yMDE3MTEwNTE2MTkw
-M1owDQYJKoZIhvcNAQELBQADgYEAWSJk6909DsDkqmIg0ZPhJD9Wkvg93KI7xfzr
-P1Jl76DJBDYLfEeCG2tCP0BEK9qiiigLm+4yq03xpWFaNYo9LYwK+vcoqaBDkUy+
-96ODhpGM2+Sd/9X2RQAxKTBQKKv8/OkVrP9fV92Ee1PItdI3FC32Ca7+/HDMfmfV
-lQDNxU8=
+bTEfMB0GA1UEAxMWY2xpY2EgU2lnbmluZyBDZXJ0IHJzYRgPMjAxNzEyMTcyMDUx
+MDhaMC0wFAIBZhgPMjAxNzEyMTcyMDUxMDhaMBUCAgDKGA8yMDE3MTIxNzIwNTEw
+OFowDQYJKoZIhvcNAQELBQADgYEAn5ZwGpzxpslUm/7LRkIlajXyzGp+8iTsovc6
+6ibiOtZo0q1gp8AooZDv5lrZkWDVzYOs+eozzI0sOROxpQ4SE81dEwwBy9DlTvQu
+MA7DFDQWYPr3BoK4VRIJwjrHBY8UClt8DwY7O2NwtDHakslLFgq0dFZHKcW9c34T
+3qkrgBk=
 -----END X509 CRL-----
diff --git a/test/aux-fixed/exim-ca/example.com/CA/index.revoked.txt.attr b/test/aux-fixed/exim-ca/example.com/CA/index.revoked.txt.attr
new file mode 100644
index 000000000..8f7e63a34
--- /dev/null
+++ b/test/aux-fixed/exim-ca/example.com/CA/index.revoked.txt.attr
@@ -0,0 +1 @@
+unique_subject = yes
diff --git a/test/aux-fixed/exim-ca/example.com/CA/index.valid.txt.attr b/test/aux-fixed/exim-ca/example.com/CA/index.valid.txt.attr
new file mode 100644
index 000000000..8f7e63a34
--- /dev/null
+++ b/test/aux-fixed/exim-ca/example.com/CA/index.valid.txt.attr
@@ -0,0 +1 @@
+unique_subject = yes
diff --git a/test/aux-fixed/exim-ca/example.com/CA/key3.db b/test/aux-fixed/exim-ca/example.com/CA/key3.db
index 6565d0cd8..1be48c144 100644
--- a/test/aux-fixed/exim-ca/example.com/CA/key3.db
+++ b/test/aux-fixed/exim-ca/example.com/CA/key3.db
diff --git a/test/aux-fixed/exim-ca/example.com/CA/noise.file b/test/aux-fixed/exim-ca/example.com/CA/noise.file
index bb707059d..210d9f839 100644
--- a/test/aux-fixed/exim-ca/example.com/CA/noise.file
+++ b/test/aux-fixed/exim-ca/example.com/CA/noise.file
@@ -46,7 +46,7 @@ cpuid level	: 22
 wp		: yes
 flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc art arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf tsc_known_freq pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch cpuid_fault epb intel_pt tpr_shadow vnmi flexpriority ept vpid fsgsbase tsc_adjust bmi1 hle avx2 smep bmi2 erms invpcid rtm mpx rdseed adx smap clflushopt xsaveopt xsavec xgetbv1 xsaves dtherm ida arat pln pts hwp hwp_notify hwp_act_window hwp_epp
 bugs		:
-bogomips	: 5431.34
+bogomips	: 5424.00
 clflush size	: 64
 cache_alignment	: 64
 address sizes	: 39 bits physical, 48 bits virtual
@@ -73,7 +73,7 @@ cpuid level	: 22
 wp		: yes
 flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc art arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf tsc_known_freq pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch cpuid_fault epb intel_pt tpr_shadow vnmi flexpriority ept vpid fsgsbase tsc_adjust bmi1 hle avx2 smep bmi2 erms invpcid rtm mpx rdseed adx smap clflushopt xsaveopt xsavec xgetbv1 xsaves dtherm ida arat pln pts hwp hwp_notify hwp_act_window hwp_epp
 bugs		:
-bogomips	: 5431.79
+bogomips	: 5424.00
 clflush size	: 64
 cache_alignment	: 64
 address sizes	: 39 bits physical, 48 bits virtual
@@ -100,7 +100,7 @@ cpuid level	: 22
 wp		: yes
 flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc art arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf tsc_known_freq pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch cpuid_fault epb intel_pt tpr_shadow vnmi flexpriority ept vpid fsgsbase tsc_adjust bmi1 hle avx2 smep bmi2 erms invpcid rtm mpx rdseed adx smap clflushopt xsaveopt xsavec xgetbv1 xsaves dtherm ida arat pln pts hwp hwp_notify hwp_act_window hwp_epp
 bugs		:
-bogomips	: 5431.63
+bogomips	: 5424.00
 clflush size	: 64
 cache_alignment	: 64
 address sizes	: 39 bits physical, 48 bits virtual
@@ -127,7 +127,7 @@ cpuid level	: 22
 wp		: yes
 flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc art arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf tsc_known_freq pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch cpuid_fault epb intel_pt tpr_shadow vnmi flexpriority ept vpid fsgsbase tsc_adjust bmi1 hle avx2 smep bmi2 erms invpcid rtm mpx rdseed adx smap clflushopt xsaveopt xsavec xgetbv1 xsaves dtherm ida arat pln pts hwp hwp_notify hwp_act_window hwp_epp
 bugs		:
-bogomips	: 5434.63
+bogomips	: 5424.00
 clflush size	: 64
 cache_alignment	: 64
 address sizes	: 39 bits physical, 48 bits virtual
@@ -154,7 +154,7 @@ cpuid level	: 22
 wp		: yes
 flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc art arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf tsc_known_freq pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch cpuid_fault epb intel_pt tpr_shadow vnmi flexpriority ept vpid fsgsbase tsc_adjust bmi1 hle avx2 smep bmi2 erms invpcid rtm mpx rdseed adx smap clflushopt xsaveopt xsavec xgetbv1 xsaves dtherm ida arat pln pts hwp hwp_notify hwp_act_window hwp_epp
 bugs		:
-bogomips	: 5432.00
+bogomips	: 5424.00
 clflush size	: 64
 cache_alignment	: 64
 address sizes	: 39 bits physical, 48 bits virtual
@@ -181,7 +181,7 @@ cpuid level	: 22
 wp		: yes
 flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc art arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf tsc_known_freq pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch cpuid_fault epb intel_pt tpr_shadow vnmi flexpriority ept vpid fsgsbase tsc_adjust bmi1 hle avx2 smep bmi2 erms invpcid rtm mpx rdseed adx smap clflushopt xsaveopt xsavec xgetbv1 xsaves dtherm ida arat pln pts hwp hwp_notify hwp_act_window hwp_epp
 bugs		:
-bogomips	: 5431.94
+bogomips	: 5424.00
 clflush size	: 64
 cache_alignment	: 64
 address sizes	: 39 bits physical, 48 bits virtual
@@ -208,85 +208,86 @@ cpuid level	: 22
 wp		: yes
 flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc art arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf tsc_known_freq pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch cpuid_fault epb intel_pt tpr_shadow vnmi flexpriority ept vpid fsgsbase tsc_adjust bmi1 hle avx2 smep bmi2 erms invpcid rtm mpx rdseed adx smap clflushopt xsaveopt xsavec xgetbv1 xsaves dtherm ida arat pln pts hwp hwp_notify hwp_act_window hwp_epp
 bugs		:
-bogomips	: 5431.94
+bogomips	: 5424.00
 clflush size	: 64
 cache_alignment	: 64
 address sizes	: 39 bits physical, 48 bits virtual
 power management:
 
             CPU0       CPU1       CPU2       CPU3       CPU4       CPU5       CPU6       CPU7       
-   0:         70          0          0          0          0          0          0          0  IR-IO-APIC    2-edge      timer
-   1:         39      16476       1416       1089       6857       1983       1674       1959  IR-IO-APIC    1-edge      i8042
-   8:          0          0          1          0          0          0          0          0  IR-IO-APIC    8-edge      rtc0
-   9:        284       4834       2265       1628       7027       2758       1632       1695  IR-IO-APIC    9-fasteoi   acpi
-  12:        273    1626151      37392      40715     288530      39254      36081      51183  IR-IO-APIC   12-edge      i8042
-  16:          1          0          0          0          0          0          0          0  IR-IO-APIC   16-fasteoi   i801_smbus
+   0:         75          0          0          0          0          0          0          0  IR-IO-APIC    2-edge      timer
+   1:      69775       6441       4183       4351       8821       6710       4808       2655  IR-IO-APIC    1-edge      i8042
+   8:          1          0          0          0          0          0          0          0  IR-IO-APIC    8-edge      rtc0
+   9:     116958      16080      12437      10549      27759      16386      11560       7036  IR-IO-APIC    9-fasteoi   acpi
+  12:    5146732     362636     240016     241533     534196     383274     265445     167959  IR-IO-APIC   12-edge      i8042
+  16:          3          0          0          0          0          0          0          0  IR-IO-APIC   16-fasteoi   i801_smbus
  120:          0          0          0          0          0          0          0          0  DMAR-MSI    0-edge      dmar0
  121:          0          0          0          0          0          0          0          0  DMAR-MSI    1-edge      dmar1
- 122:       7136       3040       2312       1908       4546       3822      75945       2347  IR-PCI-MSI 376832-edge      ahci[0000:00:17.0]
- 123:         22          7          1          0          7          3          4          1  IR-PCI-MSI 327680-edge      xhci_hcd
- 124:         89         19         22         25         79         55         27         54  IR-PCI-MSI 2097152-edge      rtsx_pci
- 125:         88         15     127570         11         48         25         19         21  IR-PCI-MSI 520192-edge      enp0s31f6
- 126:          1          1          1          0          3          1          3          6  IR-PCI-MSI 1048576-edge    
- 127:        561        174         98     789459        240        230        184        147  IR-PCI-MSI 32768-edge      i915
- 128:         34         14          0          0          1          0          0          0  IR-PCI-MSI 360448-edge      mei_me
- 129:         22         10          0          1         10          0          0          0  IR-PCI-MSI 1572864-edge      iwlwifi
- 130:         92        103         30         22        194        115         10         45  IR-PCI-MSI 514048-edge      snd_hda_intel:card0
- NMI:          9         12          9         14         10          9          9         10   Non-maskable interrupts
- LOC:     567716     554896     727085    1034643     584080     592635     624369     549045   Local timer interrupts
+ 122:      40662       2645       2048    8326186       3083       2651       2210       2042  IR-PCI-MSI 376832-edge      ahci[0000:00:17.0]
+ 123:         50          3          7          1          9          3          5          0  IR-PCI-MSI 327680-edge      xhci_hcd
+ 124:        269         24         28         20        104        171         22         48  IR-PCI-MSI 2097152-edge      rtsx_pci
+ 125:         38          0          0          0          0         10          0          4  IR-PCI-MSI 360448-edge      mei_me
+ 126:          2          0          3          0          1          2         24          0  IR-PCI-MSI 1048576-edge    
+ 127:       2247         56         54         23    3782852         37         26         18  IR-PCI-MSI 32768-edge      i915
+ 128:         77          0          0          0          2         32          8          1  IR-PCI-MSI 514048-edge      snd_hda_intel:card0
+ 129:         18          2          0          4          8          0          4      24684  IR-PCI-MSI 1572864-edge      iwlwifi
+ 130:        658          1          0          0          0          8          5   13518769  IR-PCI-MSI 520192-edge      enp0s31f6
+ NMI:        607       2649       2621       2523       2484       2424       2424       2470   Non-maskable interrupts
+ LOC:   29014738   29910147   29754034   28953856   29024391   28521696   28469173   28816545   Local timer interrupts
  SPU:          0          0          0          0          0          0          0          0   Spurious interrupts
- PMI:          9         12          9         14         10          9          9         10   Performance monitoring interrupts
- IWI:          0          1          0          0          0          0          2          0   IRQ work interrupts
- RTR:          7          0          0          0          0          0          0          0   APIC ICR read retries
- RES:      85583      31067      11917       8325       7466       6913       6401       5898   Rescheduling interrupts
- CAL:      73161      74171      68752      70655      80169      75209      61391      70903   Function call interrupts
- TLB:      55150      56119      50377      53791      62195      57072      43366      55765   TLB shootdowns
- TRM:          0          0          0          0          0          0          0          0   Thermal event interrupts
+ PMI:        607       2649       2621       2523       2484       2424       2424       2470   Performance monitoring interrupts
+ IWI:          6          4          3          2         10          4          3          1   IRQ work interrupts
+ RTR:         18          0          0          0          0          0          0          0   APIC ICR read retries
+ RES:    7885792    3950261    2715262    2193529    2474046    1957554    1665440    1988038   Rescheduling interrupts
+ CAL:     987291     866818     901402     885321     915800     938469     935939     966681   Function call interrupts
+ TLB:     231525     195523     218511     215448     205511     204323     194087     201607   TLB shootdowns
+ TRM:    1627962    1627962    1627962    1627962    1627962    1627962    1627962    1627962   Thermal event interrupts
  THR:          0          0          0          0          0          0          0          0   Threshold APIC interrupts
  DFR:          0          0          0          0          0          0          0          0   Deferred Error APIC interrupts
  MCE:          0          0          0          0          0          0          0          0   Machine check exceptions
- MCP:         49         49         49         49         49         49         49         49   Machine check polls
+ MCP:        202        200        200        200        200        200        200        200   Machine check polls
+ HYP:          0          0          0          0          0          0          0          0   Hypervisor callback interrupts
  ERR:          0
  MIS:          0
  PIN:          0          0          0          0          0          0          0          0   Posted-interrupt notification event
  NPI:          0          0          0          0          0          0          0          0   Nested posted-interrupt event
  PIW:          0          0          0          0          0          0          0          0   Posted-interrupt wakeup event
-MemTotal:       15852528 kB
-MemFree:        10535936 kB
-MemAvailable:   12484200 kB
-Buffers:          128136 kB
-Cached:          1542420 kB
-SwapCached:            0 kB
-Active:          3134176 kB
-Inactive:        1817128 kB
-Active(anon):    2706712 kB
-Inactive(anon):    79680 kB
-Active(file):     427464 kB
-Inactive(file):  1737448 kB
-Unevictable:          32 kB
-Mlocked:              32 kB
-SwapTotal:       7933948 kB
-SwapFree:        7933948 kB
-Dirty:              3980 kB
+MemTotal:       16293504 kB
+MemFree:          934072 kB
+MemAvailable:   13703496 kB
+Buffers:          452228 kB
+Cached:         12441380 kB
+SwapCached:       101680 kB
+Active:          2599800 kB
+Inactive:       12195432 kB
+Active(anon):    1356304 kB
+Inactive(anon):   588448 kB
+Active(file):    1243496 kB
+Inactive(file): 11606984 kB
+Unevictable:          64 kB
+Mlocked:              64 kB
+SwapTotal:       8212476 kB
+SwapFree:        7376112 kB
+Dirty:             11044 kB
 Writeback:             0 kB
-AnonPages:       2975780 kB
-Mapped:           495468 kB
-Shmem:             80740 kB
-Slab:             143672 kB
-SReclaimable:      74472 kB
-SUnreclaim:        69200 kB
-KernelStack:        9152 kB
-PageTables:        39092 kB
+AnonPages:       1871520 kB
+Mapped:           416280 kB
+Shmem:            289864 kB
+Slab:             351256 kB
+SReclaimable:     257264 kB
+SUnreclaim:        93992 kB
+KernelStack:       12832 kB
+PageTables:        58172 kB
 NFS_Unstable:          0 kB
 Bounce:                0 kB
 WritebackTmp:          0 kB
-CommitLimit:    15860212 kB
-Committed_AS:   11673848 kB
+CommitLimit:    16359228 kB
+Committed_AS:    7879332 kB
 VmallocTotal:   34359738367 kB
 VmallocUsed:           0 kB
 VmallocChunk:          0 kB
 HardwareCorrupted:     0 kB
-AnonHugePages:    966656 kB
+AnonHugePages:         0 kB
 ShmemHugePages:        0 kB
 ShmemPmdMapped:        0 kB
 CmaTotal:              0 kB
@@ -296,15 +297,14 @@ HugePages_Free:        0
 HugePages_Rsvd:        0
 HugePages_Surp:        0
 Hugepagesize:       2048 kB
-DirectMap4k:      202752 kB
-DirectMap2M:     7602176 kB
-DirectMap1G:     9437184 kB
+DirectMap4k:      523752 kB
+DirectMap2M:    16115712 kB
+DirectMap1G:     1048576 kB
 Inter-|   Receive                                                |  Transmit
  face |bytes    packets errs drop fifo frame compressed multicast|bytes    packets errs drop fifo colls carrier compressed
-virbr1:  353867    2838    0    0    0     0          0         0  1474230    3810    0    0    0     0       0          0
-enp0s31f6: 43449731   65089    0    0    0     0          0      2075  6949500   57088    0    0    0     0       0          0
-virbr1-nic:       0       0    0    0    0     0          0         0        0       0    0    0    0     0       0          0
-tun_wizint: 4130741    7381    0    0    0     0          0         0  1092175    8002    0    0    0     0       0          0
-    lo:    5706      74    0    0    0     0          0         0     5706      74    0    0    0     0       0          0
- vnet0:  393599    2838    0    0    0     0          0         0  1609950    6362    0    0    0     0       0          0
-wlp3s0:       0       0    0    0    0     0          0         0        0       0    0    0    0     0       0          0
+enp0s31f6: 9760816648 13664538    0    0    0     0          0      8965 118421394195 83833297    0    0    0     0       0          0
+wlp3s0: 3643580    7768    0    0    0     0          0         0  4732829    8244    0    0    0     0       0          0
+    lo: 9996035   41708    0    0    0     0          0         0  9996035   41708    0    0    0     0       0          0
+virbr0-nic:       0       0    0    0    0     0          0         0        0       0    0    0    0     0       0          0
+  tun0: 20139456   21861    0    0    0     0          0         0  3370846   19686    0    0    0     0       0          0
+virbr0: 47538577  146404    0    0    0     0          0         0 164360816  210422    0    0    0     0       0          0
diff --git a/test/aux-fixed/exim-ca/example.com/expired1.example.com/ca_chain.pem b/test/aux-fixed/exim-ca/example.com/expired1.example.com/ca_chain.pem
index cde036853..c6accd35b 100644
--- a/test/aux-fixed/exim-ca/example.com/expired1.example.com/ca_chain.pem
+++ b/test/aux-fixed/exim-ca/example.com/expired1.example.com/ca_chain.pem
@@ -3,33 +3,33 @@ Bag Attributes
 subject=/O=example.com/CN=clica Signing Cert rsa
 issuer=/O=example.com/CN=clica CA rsa
 -----BEGIN CERTIFICATE-----
-MIICNDCCAZ2gAwIBAgIBAjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+MIICGDCCAYGgAwIBAgIBQjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
 cGxlLmNvbTEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwMVoX
 DTM4MDEwMTEyMzQwMVowNzEUMBIGA1UEChMLZXhhbXBsZS5jb20xHzAdBgNVBAMT
 FmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
-AoGBANlcwo5q84SEtVy5W/xqbYAzOiYUZ0Shp9+ry/Q/X5uhrDF9JSHNWJbXut+8
-ZJGICt0RYVIJCcaa7FUt5hTKEx4fgURr+Hz84ZgwesMxcECHJPq9ylrCqbPkbmFR
-1XUy2MvioMH2lyc/PbV62XXggJhHioStVLRfyVlkS1KvvR+HAgMBAAGjWjBYMA4G
-A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMDIGA1UdHwQrMCkwJ6Al
-oCOGIWh0dHA6Ly9jcmwuZXhhbXBsZS5jb20vbGF0ZXN0LmNybDANBgkqhkiG9w0B
-AQsFAAOBgQBtPJwqu7DiDmFZd58L4xQ6JJhrJzJUDHmT7ikW2tOM58yisCgSnzrR
-xihW+49vUQ9lSGxBHaFwdehAuGTXydnf7/i9i6KA2RZ+Rq12FJFYOhjaIP7Sy1zq
-VXtb+P1eDBQQhz0WgysLVjgGdBiokRv86yY56ficoTQ6EyWzQLCU+A==
+AoGBALFHTtwaKeCfLlDf/wTErhOB6AB9vKHtyDbU6yDB/DrA5DLbug8m1oGGwEIf
+lTY0VBym8/Iu/ExE476gRmPNX/kIQsSNj9LtCIx3JXqLpc8ylw4cuVMOeFtBXNtE
+YKvUPIyWaAvqBbwY1QOyHNeoJ68hBdDPCn3oN2wrCz4if9QHAgMBAAGjPjA8MA4G
+A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMBYGA1UdDgQPBA1BQWJ0
+d0N4Y1hnYjBRMA0GCSqGSIb3DQEBCwUAA4GBAERD495HPM1BxM60EHGYLQgPjJPT
+/cL+nTKyIdv2UvzAnJaSFMMAB43Twy/jvkahsITVuieSU4kpev79KRNLfk+h25pf
+oPjaOfmOQVtHWN9ML8FDs0dLkRhJPuagObx17l/KEPkiK/jLB339fyO1HxaKhymE
+hdqYsdjjnBy/6U5g
 -----END CERTIFICATE-----
 Bag Attributes
     friendlyName: Certificate Authority rsa
 subject=/O=example.com/CN=clica CA rsa
 issuer=/O=example.com/CN=clica CA rsa
 -----BEGIN CERTIFICATE-----
-MIIB9jCCAV+gAwIBAgIBATANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+MIIB9jCCAV+gAwIBAgIBQTANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
 cGxlLmNvbTEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwMVoX
 DTM4MDEwMTEyMzQwMVowLTEUMBIGA1UEChMLZXhhbXBsZS5jb20xFTATBgNVBAMT
-DGNsaWNhIENBIHJzYTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA2N3YjbHA
-BEKAiUHwJ0VMAAe/KMOM8slXOAKni4v7Vf6BzbO5B6uaKhDV2n3V0vXwMdAoeBaq
-3s9CHOjDXwjF1qf/p4w3Z2aUIVt/Mb+uEcPUlq0Nr8OLlH11QKbkvFtLxU3sUAoi
-fcaydi1q3tszjPQ0tKlLo6kOzcgi8d47WccCAwEAAaMmMCQwEgYDVR0TAQH/BAgw
-BgEB/wIBATAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADgYEAAzD/Zszo
-X4ieSQQxDOH53VkiAJDs32qso9YzGbQaenuRnVFCuo7rt68cjMcOjzf18/I+iMeH
-nEcdqkfoYB4Z3LXvDaRGZhg/ZOv58muzRnsW2oQI9yFqDwD0FZPtM6Vq0AWXjLuq
-IogOI5fShSo7H5hc3vrkvS7KUhzuv3FKnaQ=
+DGNsaWNhIENBIHJzYTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAyDGCW64u
+Q5CBaKQGpgZVwGjo+VAn2EpwbfCZkhJtnxESiZYigjBH8KaOcAGyuv6jqY3pP64u
+gPe3lRkqwnvnLkj4wYo7d1GpW12yRCN/n7oMUcHLceqeLc8iYy6k1szF+jdlcRPL
+2OXNEy2pgzsPRyWZyCS2xZE86byA4N+/Y5cCAwEAAaMmMCQwEgYDVR0TAQH/BAgw
+BgEB/wIBATAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADgYEAeQnAdtC4
+EWA5tl8hRlOmc7IM6c40MJRB73/Oiul8xcS4l2qRLXUAWJjddxMPrLf4AYmc0vQz
+rcWmvkfdnjqX235D5YaOvfsIKr+YThtbSUvSK/uCGCxmiQHLQIWa7oWnFExIAjFd
+xxxXmvnPPG86dFoAm4AGS6kynXmWc4tvKYI=
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.com/expired1.example.com/cert8.db b/test/aux-fixed/exim-ca/example.com/expired1.example.com/cert8.db
index 5082e03ed..0cc8c2ec7 100644
--- a/test/aux-fixed/exim-ca/example.com/expired1.example.com/cert8.db
+++ b/test/aux-fixed/exim-ca/example.com/expired1.example.com/cert8.db
diff --git a/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.chain.pem b/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.chain.pem
index f6cdd036b..569d91be7 100644
--- a/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.chain.pem
+++ b/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.chain.pem
@@ -1,35 +1,35 @@
 Bag Attributes
     friendlyName: expired1.example.com
-    localKeyID: 2D F0 80 D5 36 FE D2 A2 89 8B 45 96 53 27 78 75 9A E2 AB 74 
+    localKeyID: 11 3A B7 95 2B 9C 29 53 DE A2 85 E3 4D 03 0B 39 AA 06 23 73 
 subject=/CN=expired1.example.com
 issuer=/O=example.com/CN=clica Signing Cert rsa
 -----BEGIN CERTIFICATE-----
 MIICjTCCAfagAwIBAgIBZzANBgkqhkiG9w0BAQsFADA3MRQwEgYDVQQKEwtleGFt
 cGxlLmNvbTEfMB0GA1UEAxMWY2xpY2EgU2lnbmluZyBDZXJ0IHJzYTAeFw0xMjEx
-MDExMjM0MDFaFw0xMjEyMDExMjM0MDFaMB8xHTAbBgNVBAMTFGV4cGlyZWQxLmV4
-YW1wbGUuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCtHBMZtGtODyg6
-OC4nWNIjICkgfR3e831qmWUhMR671zF0tcywM8yH74jRQJP30nHzvrvkIT11Z540
-yvZzK4mzoZXQm466fwivjUkUK6T5nT76zbc2+mN8pK6s+xG2oxF+w1aeMaldJ9nY
-D1jEPenQL/rq5Sb0kC52wkwSSDI/MQIDAQABo4HAMIG9MA4GA1UdDwEB/wQEAwIE
+MDExMjM0MDNaFw0xMjEyMDExMjM0MDNaMB8xHTAbBgNVBAMTFGV4cGlyZWQxLmV4
+YW1wbGUuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDVGSR3x/dy3K1D
+9ksiSdVXCeWMLkH3MbKzc6vGq7/kKoNNh85Zu9EnftbwY0jyBUSnhyi8sq6VTT3b
+NK4aLcTCvinzlEIaM5HFD/h/dsLBTPuwVo9FhsJtgGwI0c0ZktyNOQl9SsHqOkWz
+AJiFqzo+3As4Q3xWwWpdhtXTaOPAkwIDAQABo4HAMIG9MA4GA1UdDwEB/wQEAwIE
 8DAgBgNVHSUBAf8EFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwMgYDVR0fBCswKTAn
 oCWgI4YhaHR0cDovL2NybC5leGFtcGxlLmNvbS9sYXRlc3QuY3JsMDQGCCsGAQUF
 BwEBBCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29zY3AuZXhhbXBsZS5jb20vMB8G
 A1UdEQQYMBaCFGV4cGlyZWQxLmV4YW1wbGUuY29tMA0GCSqGSIb3DQEBCwUAA4GB
-AHBdui6MIhv8xE3jegdB+3d/UaC9iZJhrhxFfD3eirbvdA2IOfpglHoora5Ll/WB
-CgKC8NkwYf7kdTPM0T0hSjy9nlollFTxk0BaS7xKJdOjwDHVAIR1xpnw3wC/jIK6
-U42/WCIXJG1VsbpwI7zohfcfL+1OsJ4SvKYGMR9Tpbqb
+AELflNznRRAJHrDXTjLsHl7IC0N5eS3j4/cckAA0hsvQfuwoQu15A6301WyfS8vQ
+JBg/rHzX4ZkSVovQ0ximDRgPsZ0Ytj7zz4kfLnVOEHzVDv0boH4UNYMOWziTJFex
+Zl1VQzLlik1oyO/qfo7EysB12RZlm7mshkD/XV0zwkO1
 -----END CERTIFICATE-----
 -----BEGIN CERTIFICATE-----
-MIICNDCCAZ2gAwIBAgIBAjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+MIICGDCCAYGgAwIBAgIBQjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
 cGxlLmNvbTEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwMVoX
 DTM4MDEwMTEyMzQwMVowNzEUMBIGA1UEChMLZXhhbXBsZS5jb20xHzAdBgNVBAMT
 FmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
-AoGBANlcwo5q84SEtVy5W/xqbYAzOiYUZ0Shp9+ry/Q/X5uhrDF9JSHNWJbXut+8
-ZJGICt0RYVIJCcaa7FUt5hTKEx4fgURr+Hz84ZgwesMxcECHJPq9ylrCqbPkbmFR
-1XUy2MvioMH2lyc/PbV62XXggJhHioStVLRfyVlkS1KvvR+HAgMBAAGjWjBYMA4G
-A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMDIGA1UdHwQrMCkwJ6Al
-oCOGIWh0dHA6Ly9jcmwuZXhhbXBsZS5jb20vbGF0ZXN0LmNybDANBgkqhkiG9w0B
-AQsFAAOBgQBtPJwqu7DiDmFZd58L4xQ6JJhrJzJUDHmT7ikW2tOM58yisCgSnzrR
-xihW+49vUQ9lSGxBHaFwdehAuGTXydnf7/i9i6KA2RZ+Rq12FJFYOhjaIP7Sy1zq
-VXtb+P1eDBQQhz0WgysLVjgGdBiokRv86yY56ficoTQ6EyWzQLCU+A==
+AoGBALFHTtwaKeCfLlDf/wTErhOB6AB9vKHtyDbU6yDB/DrA5DLbug8m1oGGwEIf
+lTY0VBym8/Iu/ExE476gRmPNX/kIQsSNj9LtCIx3JXqLpc8ylw4cuVMOeFtBXNtE
+YKvUPIyWaAvqBbwY1QOyHNeoJ68hBdDPCn3oN2wrCz4if9QHAgMBAAGjPjA8MA4G
+A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMBYGA1UdDgQPBA1BQWJ0
+d0N4Y1hnYjBRMA0GCSqGSIb3DQEBCwUAA4GBAERD495HPM1BxM60EHGYLQgPjJPT
+/cL+nTKyIdv2UvzAnJaSFMMAB43Twy/jvkahsITVuieSU4kpev79KRNLfk+h25pf
+oPjaOfmOQVtHWN9ML8FDs0dLkRhJPuagObx17l/KEPkiK/jLB339fyO1HxaKhymE
+hdqYsdjjnBy/6U5g
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.key b/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.key
index d770088a3..fd67faff1 100644
--- a/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.key
+++ b/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.key
@@ -1,21 +1,22 @@
 Bag Attributes
     friendlyName: expired1.example.com
-    localKeyID: 2D F0 80 D5 36 FE D2 A2 89 8B 45 96 53 27 78 75 9A E2 AB 74 
+    localKeyID: 11 3A B7 95 2B 9C 29 53 DE A2 85 E3 4D 03 0B 39 AA 06 23 73 
 Key Attributes: <No Attributes>
 -----BEGIN ENCRYPTED PRIVATE KEY-----
-MIICxjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQI1UyiYnYKO9UCAggA
-MBQGCCqGSIb3DQMHBAjWD6vdWh3+PwSCAoByLQ9hJ+2ANh1Z88M4f7pVMVnGk0yr
-qxX/IjoB9H8KnweVCtXP38T6Wuhm5JEVXOK1HWA/5A37mfLyk7YHvvYWcH7CmLMa
-ssMOlDmCBXZWwnSseeZyvuJedsXIm6VDc8JNPeshVTkXEAmaA7wu5Vr3Tggg/tIh
-S2XBReFIZWa4+ibGGj7n3z5TsDQMIufZKAtl4WdrwDnUBGrQ5gt5TpXrtdHsYsHA
-cVrt5XFDMytSPVgiL3X46p5/b3MCUBivyKvvRzDz5LmcJ3iGERnfFoUKiASJPoPp
-YBx91ehwq2tC+ciQFGOcQ2yt8F45yiMwgHYQK3McDf3NbScylfuTzDU+BA19HPBC
-yE2taZAwYmqfihXiZQ3t20kT2n7CbdZBYJJsyKnc+K32AYofspKzZEU4ypqcTJ4+
-4HDAgCwzKuUrMvbKUFyQw+OkaD8e7Vl8q/X6yYtwPviWDO893cigFCYiPcPYaqBc
-snzL+T7zjw7x5rtQ2IPqx3jfjX7hDbQvvK3ZEWTxqkUrx4JeLGHIK5kNE5DHK6G7
-0jjuNzYN57BuzYKzO5Nd/N6vstyITTEpEWz2jTOXqWgr1lF3isy3yKcVETL/tUd8
-nDltQvN4kzqbvW9f1VtD+pKBhyuBv077FXw3RbHukIjaIDSg+fSjukm5vbEpx+ms
-JuB2Jx/VSOfUH303Q+lbz1Q2X1Ikn6d7oF7hTrvz6dts0bqtbXxB3+2RY+c3RPhE
-wfTzyqKQVCwifbEXC4aMKRZruhzWpw6H0GEvOfSXgc9O7ntm8B20pCka4tr58R+6
-iB5S+2vmsjCGC0PSUjpCj0jkPmnw1fDP7W9bg23w0CtMKQRw2xrxMIiG
+MIIC1DBOBgkqhkiG9w0BBQ0wQTApBgkqhkiG9w0BBQwwHAQIgkIbOgBN9YECAggA
+MAwGCCqGSIb3DQIJBQAwFAYIKoZIhvcNAwcECLGsir1I4gLUBIICgCrulaO7xBkc
+GYBbg1ga7mNDUyadIvk4590APLip3on48zzw0NMFSEFMcmxmbFAffjqPlit2jqfy
+3bYxP1qWAUCn8lizPSsvl0ZUaetD/RezM1JV0a5W/JDxdX3DgDOcnFRXZdyzCz/W
+vx8G69btfgMr/xTkBEpcYK0x2YTBGrRGqW8YqgjP5wcS3gJrAZgnYLFdXmNDp4Wc
+QcysKmtCTrlG9awBaTlf5CyF1wwHWpKmS2rGuBMLY1zr7N0+EICKlfLJ612ON2Iv
+2IkpiwEpYtR2mo6lW6ULjBc5Ah1CwxkqFyIGk/zxJnYGGoVgYobNK0Hl9yTNSjSU
+TXG3zMOoaHr6+W6rK1xAXlArkP0GAW2Jfc/6SQMiNuqxczSrgeDC05mp9uH4p7ly
+lKPSWJupzMi7PUF3dmYyR1578uEykbRpOOSH1tL/KUduGlesqJi3XzGH1M6Ajhwk
+xXfxiO8zEsCbtlSkAiiiXEFx8pzPz7eUhG9PGLt+/HN/DeM9bEIFQgvuWwq0Qa3u
+aS9gfj65C2wxUVqycq+6LG+8lSeoFjmKlQNNK/o2f56skfo1JpFR7Zy50C4oLV14
+8TbfofPUQnDVuqnuEP3LMIGNDlf3W8aip6CiCd1C3c7AgO/rbhF323ZjpbpxmrSW
+uQZAIu/avmVdtKUi+k7twb6jaecbVW3KUg9LnwAFHBzwRhy239FxUIZ3z7+9IOoe
+gZXF1OnaQo9U9lRmFPmkjGCIv5RkgGZ7G4+Ing0m2hDbaFa45RJn1+x51msB1V8y
+TwErRlYvWpFW2HI3SoEqr8axD4AWWCGHl7o9j8DV1AsV7L1B9DSPLdVfUH2vPafD
+k9MfD+MTcEs=
 -----END ENCRYPTED PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.dated.resp b/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.dated.resp
index 76a1b88cf..58215459e 100644
--- a/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.dated.resp
+++ b/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.dated.resp
diff --git a/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.good.resp b/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.good.resp
index 9ef0b4f54..1753432dc 100644
--- a/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.good.resp
+++ b/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.good.resp
diff --git a/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.req b/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.req
index 9e192919d..cc85143a1 100644
--- a/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.req
+++ b/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.req
diff --git a/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.revoked.resp b/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.revoked.resp
index fbcc60ed9..8eb6640f3 100644
--- a/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.revoked.resp
+++ b/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.revoked.resp
diff --git a/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.signer.dated.resp b/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.signer.dated.resp
index a1b7a417c..24552969a 100644
--- a/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.signer.dated.resp
+++ b/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.signer.dated.resp
diff --git a/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.signer.good.resp b/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.signer.good.resp
index 2dbb36d65..47b413510 100644
--- a/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.signer.good.resp
+++ b/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.signer.good.resp
diff --git a/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.signer.revoked.resp b/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.signer.revoked.resp
index d9f4b0110..4a0093761 100644
--- a/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.signer.revoked.resp
+++ b/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.signer.revoked.resp
diff --git a/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.signernocert.dated.resp b/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.signernocert.dated.resp
index 6524a9d08..81a380556 100644
--- a/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.signernocert.dated.resp
+++ b/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.signernocert.dated.resp
diff --git a/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.signernocert.good.resp b/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.signernocert.good.resp
index acdbc9ee9..461bd62d5 100644
--- a/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.signernocert.good.resp
+++ b/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.signernocert.good.resp
diff --git a/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.signernocert.revoked.resp b/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.signernocert.revoked.resp
index 7cab7b15b..084867c14 100644
--- a/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.signernocert.revoked.resp
+++ b/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.signernocert.revoked.resp
diff --git a/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.p12 b/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.p12
index db7574a05..9e3d49c35 100644
--- a/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.p12
+++ b/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.p12
diff --git a/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.pem b/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.pem
index b74a2ff05..94c607094 100644
--- a/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.pem
+++ b/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.pem
@@ -1,21 +1,21 @@
 Bag Attributes
     friendlyName: expired1.example.com
-    localKeyID: 2D F0 80 D5 36 FE D2 A2 89 8B 45 96 53 27 78 75 9A E2 AB 74 
+    localKeyID: 11 3A B7 95 2B 9C 29 53 DE A2 85 E3 4D 03 0B 39 AA 06 23 73 
 subject=/CN=expired1.example.com
 issuer=/O=example.com/CN=clica Signing Cert rsa
 -----BEGIN CERTIFICATE-----
 MIICjTCCAfagAwIBAgIBZzANBgkqhkiG9w0BAQsFADA3MRQwEgYDVQQKEwtleGFt
 cGxlLmNvbTEfMB0GA1UEAxMWY2xpY2EgU2lnbmluZyBDZXJ0IHJzYTAeFw0xMjEx
-MDExMjM0MDFaFw0xMjEyMDExMjM0MDFaMB8xHTAbBgNVBAMTFGV4cGlyZWQxLmV4
-YW1wbGUuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCtHBMZtGtODyg6
-OC4nWNIjICkgfR3e831qmWUhMR671zF0tcywM8yH74jRQJP30nHzvrvkIT11Z540
-yvZzK4mzoZXQm466fwivjUkUK6T5nT76zbc2+mN8pK6s+xG2oxF+w1aeMaldJ9nY
-D1jEPenQL/rq5Sb0kC52wkwSSDI/MQIDAQABo4HAMIG9MA4GA1UdDwEB/wQEAwIE
+MDExMjM0MDNaFw0xMjEyMDExMjM0MDNaMB8xHTAbBgNVBAMTFGV4cGlyZWQxLmV4
+YW1wbGUuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDVGSR3x/dy3K1D
+9ksiSdVXCeWMLkH3MbKzc6vGq7/kKoNNh85Zu9EnftbwY0jyBUSnhyi8sq6VTT3b
+NK4aLcTCvinzlEIaM5HFD/h/dsLBTPuwVo9FhsJtgGwI0c0ZktyNOQl9SsHqOkWz
+AJiFqzo+3As4Q3xWwWpdhtXTaOPAkwIDAQABo4HAMIG9MA4GA1UdDwEB/wQEAwIE
 8DAgBgNVHSUBAf8EFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwMgYDVR0fBCswKTAn
 oCWgI4YhaHR0cDovL2NybC5leGFtcGxlLmNvbS9sYXRlc3QuY3JsMDQGCCsGAQUF
 BwEBBCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29zY3AuZXhhbXBsZS5jb20vMB8G
 A1UdEQQYMBaCFGV4cGlyZWQxLmV4YW1wbGUuY29tMA0GCSqGSIb3DQEBCwUAA4GB
-AHBdui6MIhv8xE3jegdB+3d/UaC9iZJhrhxFfD3eirbvdA2IOfpglHoora5Ll/WB
-CgKC8NkwYf7kdTPM0T0hSjy9nlollFTxk0BaS7xKJdOjwDHVAIR1xpnw3wC/jIK6
-U42/WCIXJG1VsbpwI7zohfcfL+1OsJ4SvKYGMR9Tpbqb
+AELflNznRRAJHrDXTjLsHl7IC0N5eS3j4/cckAA0hsvQfuwoQu15A6301WyfS8vQ
+JBg/rHzX4ZkSVovQ0ximDRgPsZ0Ytj7zz4kfLnVOEHzVDv0boH4UNYMOWziTJFex
+Zl1VQzLlik1oyO/qfo7EysB12RZlm7mshkD/XV0zwkO1
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.unlocked.key b/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.unlocked.key
index 223bc5ce1..7d6c85dd3 100644
--- a/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.unlocked.key
+++ b/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.unlocked.key
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXQIBAAKBgQCtHBMZtGtODyg6OC4nWNIjICkgfR3e831qmWUhMR671zF0tcyw
-M8yH74jRQJP30nHzvrvkIT11Z540yvZzK4mzoZXQm466fwivjUkUK6T5nT76zbc2
-+mN8pK6s+xG2oxF+w1aeMaldJ9nYD1jEPenQL/rq5Sb0kC52wkwSSDI/MQIDAQAB
-AoGAAQboAucHG/ELFA1Xq/QWJKjNyNuOw2ikyqHn769GHc2RBYtukD0LOzAFZ8Uy
-TrrfSJe0SNr80/PhasuP2rvcMHbtM0ajvsnUPlF+wRezWlj8ibKMfH8vw5gW95G2
-3+ZI3wf5uoesaSGNb6ITEnHxcIfpR1SXOyhIf9OOmJGtoAECQQDZI1iwHZhZIxND
-LgnVyD7xLhv1aVIeR9ahOccaa7+AWySVkwK8udiw9NmbApbLAku4au9GC9jLBwWj
-KuZYNitBAkEAzBd4jUWGxiOreVViywiuVVwCNjU9CtEgUMhZUEpNSS8qNr7MDEiI
-90+rjOSVmnyJ5gqwHnkJIIH4dYBuIJTH8QJBAM1KPspbYLM9lzOXrlLBfMi3SFWw
-2qOoVcKehqBzKF3pTeBgWmEl8Dn1dFq6iuiqZf6Yk1oNT008eVb380mJBUECQH0x
-4Kd4gOZGt0dk04eMubRvDoRGQD3EbzhezjrseWBtaE3Q2MaoMCzVWHzDM+pifwz4
-fXUT9j9Uux8JO4UM/2ECQQDVOjqxjLlRoX67D3G3k8ObBOMT0tufK0ekfJvdgQzc
-rLsc9QZXGoeOSEoaf4AQxByy6J4QnjVW66G+UhItPxRB
+MIICWwIBAAKBgQDVGSR3x/dy3K1D9ksiSdVXCeWMLkH3MbKzc6vGq7/kKoNNh85Z
+u9EnftbwY0jyBUSnhyi8sq6VTT3bNK4aLcTCvinzlEIaM5HFD/h/dsLBTPuwVo9F
+hsJtgGwI0c0ZktyNOQl9SsHqOkWzAJiFqzo+3As4Q3xWwWpdhtXTaOPAkwIDAQAB
+AoGAJn7PPrAp/F7vEerpMb2Cw6FvDT7B/eTFcnN/4XjfRlmDtLrGxSEPrIHWVECr
+ScU33MemzUe+EAyPEw1WMjZ4Z51Df/gqX/9pJkvQAhlJUE1ebiuQ9zoG1oBTuIUN
+iCzBw6XMriv6IyokFSi5pylPezKJsTD4syn9OVq1woEQfGkCQQDw2NKGJRyrQaHW
+pTRZOU5129K9DjEmmT12Wcv4GH0477AKPAj5Dwk18r5D3wj7m5RQcwdPHOi1jjVL
+l1xgmH/lAkEA4oFjOujaSnd/pLNpXDbgpqwPdp9mb9CbSb9bu8yWEwBsqfDlVKeL
+k54GsFagidnyWzmozItzyIQkbVfTG90HFwJAe6qpdo3Jybm6ks9jMMk3G1dTPxXx
+cONQZtu22t4gNkMEfkzTQqdQ0G2i+pCkOSVqo2BdCWdLqiWqAfVnToYfbQJAHp/5
+57QmF51yn7U2UKaG12I6MQK6WfHtnRoHcCvoOqd7CbstdrW0lH/wTZVY3WqfbyAr
+p4RPYlQjjLksLP9EfwJAAIYdNAfxGFyQBIZDfvHrtbgqvh5vMfvlywRLeTXKtD69
+GC2ICZ6YXUQpvMb7KZ5FcRMeT/kyFxm49dAWTCHC0Q==
 -----END RSA PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.com/expired1.example.com/key3.db b/test/aux-fixed/exim-ca/example.com/expired1.example.com/key3.db
index e3f1e846d..5726b1a39 100644
--- a/test/aux-fixed/exim-ca/example.com/expired1.example.com/key3.db
+++ b/test/aux-fixed/exim-ca/example.com/expired1.example.com/key3.db
diff --git a/test/aux-fixed/exim-ca/example.com/expired2.example.com/ca_chain.pem b/test/aux-fixed/exim-ca/example.com/expired2.example.com/ca_chain.pem
index cde036853..c6accd35b 100644
--- a/test/aux-fixed/exim-ca/example.com/expired2.example.com/ca_chain.pem
+++ b/test/aux-fixed/exim-ca/example.com/expired2.example.com/ca_chain.pem
@@ -3,33 +3,33 @@ Bag Attributes
 subject=/O=example.com/CN=clica Signing Cert rsa
 issuer=/O=example.com/CN=clica CA rsa
 -----BEGIN CERTIFICATE-----
-MIICNDCCAZ2gAwIBAgIBAjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+MIICGDCCAYGgAwIBAgIBQjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
 cGxlLmNvbTEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwMVoX
 DTM4MDEwMTEyMzQwMVowNzEUMBIGA1UEChMLZXhhbXBsZS5jb20xHzAdBgNVBAMT
 FmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
-AoGBANlcwo5q84SEtVy5W/xqbYAzOiYUZ0Shp9+ry/Q/X5uhrDF9JSHNWJbXut+8
-ZJGICt0RYVIJCcaa7FUt5hTKEx4fgURr+Hz84ZgwesMxcECHJPq9ylrCqbPkbmFR
-1XUy2MvioMH2lyc/PbV62XXggJhHioStVLRfyVlkS1KvvR+HAgMBAAGjWjBYMA4G
-A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMDIGA1UdHwQrMCkwJ6Al
-oCOGIWh0dHA6Ly9jcmwuZXhhbXBsZS5jb20vbGF0ZXN0LmNybDANBgkqhkiG9w0B
-AQsFAAOBgQBtPJwqu7DiDmFZd58L4xQ6JJhrJzJUDHmT7ikW2tOM58yisCgSnzrR
-xihW+49vUQ9lSGxBHaFwdehAuGTXydnf7/i9i6KA2RZ+Rq12FJFYOhjaIP7Sy1zq
-VXtb+P1eDBQQhz0WgysLVjgGdBiokRv86yY56ficoTQ6EyWzQLCU+A==
+AoGBALFHTtwaKeCfLlDf/wTErhOB6AB9vKHtyDbU6yDB/DrA5DLbug8m1oGGwEIf
+lTY0VBym8/Iu/ExE476gRmPNX/kIQsSNj9LtCIx3JXqLpc8ylw4cuVMOeFtBXNtE
+YKvUPIyWaAvqBbwY1QOyHNeoJ68hBdDPCn3oN2wrCz4if9QHAgMBAAGjPjA8MA4G
+A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMBYGA1UdDgQPBA1BQWJ0
+d0N4Y1hnYjBRMA0GCSqGSIb3DQEBCwUAA4GBAERD495HPM1BxM60EHGYLQgPjJPT
+/cL+nTKyIdv2UvzAnJaSFMMAB43Twy/jvkahsITVuieSU4kpev79KRNLfk+h25pf
+oPjaOfmOQVtHWN9ML8FDs0dLkRhJPuagObx17l/KEPkiK/jLB339fyO1HxaKhymE
+hdqYsdjjnBy/6U5g
 -----END CERTIFICATE-----
 Bag Attributes
     friendlyName: Certificate Authority rsa
 subject=/O=example.com/CN=clica CA rsa
 issuer=/O=example.com/CN=clica CA rsa
 -----BEGIN CERTIFICATE-----
-MIIB9jCCAV+gAwIBAgIBATANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+MIIB9jCCAV+gAwIBAgIBQTANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
 cGxlLmNvbTEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwMVoX
 DTM4MDEwMTEyMzQwMVowLTEUMBIGA1UEChMLZXhhbXBsZS5jb20xFTATBgNVBAMT
-DGNsaWNhIENBIHJzYTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA2N3YjbHA
-BEKAiUHwJ0VMAAe/KMOM8slXOAKni4v7Vf6BzbO5B6uaKhDV2n3V0vXwMdAoeBaq
-3s9CHOjDXwjF1qf/p4w3Z2aUIVt/Mb+uEcPUlq0Nr8OLlH11QKbkvFtLxU3sUAoi
-fcaydi1q3tszjPQ0tKlLo6kOzcgi8d47WccCAwEAAaMmMCQwEgYDVR0TAQH/BAgw
-BgEB/wIBATAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADgYEAAzD/Zszo
-X4ieSQQxDOH53VkiAJDs32qso9YzGbQaenuRnVFCuo7rt68cjMcOjzf18/I+iMeH
-nEcdqkfoYB4Z3LXvDaRGZhg/ZOv58muzRnsW2oQI9yFqDwD0FZPtM6Vq0AWXjLuq
-IogOI5fShSo7H5hc3vrkvS7KUhzuv3FKnaQ=
+DGNsaWNhIENBIHJzYTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAyDGCW64u
+Q5CBaKQGpgZVwGjo+VAn2EpwbfCZkhJtnxESiZYigjBH8KaOcAGyuv6jqY3pP64u
+gPe3lRkqwnvnLkj4wYo7d1GpW12yRCN/n7oMUcHLceqeLc8iYy6k1szF+jdlcRPL
+2OXNEy2pgzsPRyWZyCS2xZE86byA4N+/Y5cCAwEAAaMmMCQwEgYDVR0TAQH/BAgw
+BgEB/wIBATAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADgYEAeQnAdtC4
+EWA5tl8hRlOmc7IM6c40MJRB73/Oiul8xcS4l2qRLXUAWJjddxMPrLf4AYmc0vQz
+rcWmvkfdnjqX235D5YaOvfsIKr+YThtbSUvSK/uCGCxmiQHLQIWa7oWnFExIAjFd
+xxxXmvnPPG86dFoAm4AGS6kynXmWc4tvKYI=
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.com/expired2.example.com/cert8.db b/test/aux-fixed/exim-ca/example.com/expired2.example.com/cert8.db
index b1949366c..d9c92b857 100644
--- a/test/aux-fixed/exim-ca/example.com/expired2.example.com/cert8.db
+++ b/test/aux-fixed/exim-ca/example.com/expired2.example.com/cert8.db
diff --git a/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.chain.pem b/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.chain.pem
index e1f627620..6d0c80150 100644
--- a/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.chain.pem
+++ b/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.chain.pem
@@ -1,35 +1,35 @@
 Bag Attributes
     friendlyName: expired2.example.com
-    localKeyID: D7 25 3D B0 CD 84 B6 A0 91 23 8D 39 0C 9F E3 D8 A0 D6 E6 35 
+    localKeyID: 2E CF 5F 43 53 BA 8C E9 2F 62 95 52 FD E6 1B A1 1F CB B7 DA 
 subject=/CN=expired2.example.com
 issuer=/O=example.com/CN=clica Signing Cert rsa
 -----BEGIN CERTIFICATE-----
 MIICjjCCAfegAwIBAgICAMswDQYJKoZIhvcNAQELBQAwNzEUMBIGA1UEChMLZXhh
 bXBsZS5jb20xHzAdBgNVBAMTFmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwHhcNMTIx
-MTAxMTIzNDAyWhcNMTIxMjAxMTIzNDAyWjAfMR0wGwYDVQQDExRleHBpcmVkMi5l
-eGFtcGxlLmNvbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEApen5xbyDM2wZ
-HlNaaYAjXzrDC/qwnlhffLVl0l+/+fMx83Yf9yn/MoB+RHxK2Zl8W3BHu+WmlJan
-MLK7q3Tv1X6hYQLR16CluTpLQswUK5Sxc/TdH0k8b+vR9uwDPQ7NVQ4LGnWwEMxN
-zGw1jWiGSg9fL13WKU9fCScIkQVe42cCAwEAAaOBwDCBvTAOBgNVHQ8BAf8EBAMC
+MTAxMTIzNDA2WhcNMTIxMjAxMTIzNDA2WjAfMR0wGwYDVQQDExRleHBpcmVkMi5l
+eGFtcGxlLmNvbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAyUlBWmdTM96y
+ac0i8r1M520NAWSe7mqaefQ8ikDjcL8OOLFBm6WWZ2Twux5/OnIybzTJ2WKm58fa
+TOlEiw5GsnhnjMTi9zHhEUdJn2/Gz/0oaGfkXu1QsHIP0SjfEGUy1lvg/EhXnPz4
+XGixIZyhQLqOiOrx2BhFqGVZ9FYzO4UCAwEAAaOBwDCBvTAOBgNVHQ8BAf8EBAMC
 BPAwIAYDVR0lAQH/BBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMDIGA1UdHwQrMCkw
 J6AloCOGIWh0dHA6Ly9jcmwuZXhhbXBsZS5jb20vbGF0ZXN0LmNybDA0BggrBgEF
 BQcBAQQoMCYwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vc2NwLmV4YW1wbGUuY29tLzAf
 BgNVHREEGDAWghRleHBpcmVkMi5leGFtcGxlLmNvbTANBgkqhkiG9w0BAQsFAAOB
-gQDGjEY07fjC0JYOYgwOhBXOMJkrTa8Hh4FvXMBB+Rt2VsRf5thkkcKl9Wi1BadE
-os+7qAhS2PHxtmM3aWilxC/esEe7w6bqSv5VT2qSAzOp/q+LGNOB/vDeR+tr04Jx
-o3AhBqpoy9FL3zue1VYYqZn2myvMsWQ0fqwRQAd/h7RQhQ==
+gQBNavRiDJHQwrHch2BJLP7BCtAPshqO9aJNicnXVDE5f7MKc6wjcjgoMNn25Y8w
+WlT+3LGZuvT9QUfC3XSUzafiYDzaI+KxBMQWlztTyoxV0Ug2tVoN65WgiIKgAIwC
+LjP5yVh9q3dsoEpBQ0OGpw7t5Jd4z5isDVdAxQ7LIPpu2w==
 -----END CERTIFICATE-----
 -----BEGIN CERTIFICATE-----
-MIICNDCCAZ2gAwIBAgIBAjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+MIICGDCCAYGgAwIBAgIBQjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
 cGxlLmNvbTEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwMVoX
 DTM4MDEwMTEyMzQwMVowNzEUMBIGA1UEChMLZXhhbXBsZS5jb20xHzAdBgNVBAMT
 FmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
-AoGBANlcwo5q84SEtVy5W/xqbYAzOiYUZ0Shp9+ry/Q/X5uhrDF9JSHNWJbXut+8
-ZJGICt0RYVIJCcaa7FUt5hTKEx4fgURr+Hz84ZgwesMxcECHJPq9ylrCqbPkbmFR
-1XUy2MvioMH2lyc/PbV62XXggJhHioStVLRfyVlkS1KvvR+HAgMBAAGjWjBYMA4G
-A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMDIGA1UdHwQrMCkwJ6Al
-oCOGIWh0dHA6Ly9jcmwuZXhhbXBsZS5jb20vbGF0ZXN0LmNybDANBgkqhkiG9w0B
-AQsFAAOBgQBtPJwqu7DiDmFZd58L4xQ6JJhrJzJUDHmT7ikW2tOM58yisCgSnzrR
-xihW+49vUQ9lSGxBHaFwdehAuGTXydnf7/i9i6KA2RZ+Rq12FJFYOhjaIP7Sy1zq
-VXtb+P1eDBQQhz0WgysLVjgGdBiokRv86yY56ficoTQ6EyWzQLCU+A==
+AoGBALFHTtwaKeCfLlDf/wTErhOB6AB9vKHtyDbU6yDB/DrA5DLbug8m1oGGwEIf
+lTY0VBym8/Iu/ExE476gRmPNX/kIQsSNj9LtCIx3JXqLpc8ylw4cuVMOeFtBXNtE
+YKvUPIyWaAvqBbwY1QOyHNeoJ68hBdDPCn3oN2wrCz4if9QHAgMBAAGjPjA8MA4G
+A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMBYGA1UdDgQPBA1BQWJ0
+d0N4Y1hnYjBRMA0GCSqGSIb3DQEBCwUAA4GBAERD495HPM1BxM60EHGYLQgPjJPT
+/cL+nTKyIdv2UvzAnJaSFMMAB43Twy/jvkahsITVuieSU4kpev79KRNLfk+h25pf
+oPjaOfmOQVtHWN9ML8FDs0dLkRhJPuagObx17l/KEPkiK/jLB339fyO1HxaKhymE
+hdqYsdjjnBy/6U5g
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.key b/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.key
index 29fd9aebc..a8942ef1c 100644
--- a/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.key
+++ b/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.key
@@ -1,21 +1,22 @@
 Bag Attributes
     friendlyName: expired2.example.com
-    localKeyID: D7 25 3D B0 CD 84 B6 A0 91 23 8D 39 0C 9F E3 D8 A0 D6 E6 35 
+    localKeyID: 2E CF 5F 43 53 BA 8C E9 2F 62 95 52 FD E6 1B A1 1F CB B7 DA 
 Key Attributes: <No Attributes>
 -----BEGIN ENCRYPTED PRIVATE KEY-----
-MIICxjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQImZNS2klCPs4CAggA
-MBQGCCqGSIb3DQMHBAhII6fkFNt8pwSCAoD0/XaFALLxjx8IJE5txE8nJBFbLuLi
-K1iL5ahVQ9UbPcDp+Ysjh4ME9b+tX/n0lZIc2Bhj7mUgLWQ2l5E8SjcZkWD4EkwF
-DzRm6/VvKIWZAx2Izc/fklbgBC4Ua8juXELF10sdJ9a9aixb6ur7a0c92VBdDiWb
-NKAJ38yeEuYKQbQuyC+HbI1wzOGWNzFAwlkOm/uHJr3+rA/l3KWGg/ok3yRLUoth
-q6HQ1f3T5ZRKzLE3oacjRgSsvo+1wNwpAtUcasUdQmqwmkoBbwfPJpNOFNxMWmz1
-z/eu8grSlVVmBhVOywAHhowzN4B+qRYWt19laYcUK9dQDdix6enCdf23loZIwF+M
-8bdajFdHcvpQ+7UW7Z94oa2/Lq/sGUxUMQtjO6Tr0sywoNCPIyS6YfvZ8TuAiazF
-xW/enLYQr2GbZ9abkKBtSxGBaPOzrcuNB82ja9TYS/f+Dn1q1fABUj1XzKuDJCWP
-PmdTdphnA/M9hie7ceDFkAKZZi1S/m3KZjQWg3mJYdgXBNlZSoL5lnEtoIAqdg6y
-6PS5aK7DOClEEGd2v/8I4awT4SxtQOlNdwGfgtsw8rdOwaUEZSeXJHPPMUu+6iPD
-if1xj5Pw1KBkcYePQRX5JBEOC0IZ0OtmxvWWbJ4uK5Ng7W+1mgf2PUCWwtOYtQvL
-Kxxgk/9/kolu3Txg0FcSYU8fZKoKaSJl+CP41fK7GONiduHc8Ok33jZShdcw5E2k
-k90hk3l6yp6hdUnAyzbY8DnSWPRHnoy/ZkHcwUvwr2u9p/PXKwK4cSyRKgKTsusP
-uAM4Ifxj+AKCRR75LxBy6BrSTLZzFtV5SmvdjDKGc3kPiSjulSjCm860
+MIIC1DBOBgkqhkiG9w0BBQ0wQTApBgkqhkiG9w0BBQwwHAQILtiYmswfV5wCAggA
+MAwGCCqGSIb3DQIJBQAwFAYIKoZIhvcNAwcECJCv2ZpdgYbsBIICgJRWLJSp/sRa
+X5GinSqjXfa4IBVtGXeYBuisP1XtWBb0/dP2L0bxgg5TTpxfPTXJPY2VeBDLyh7a
+xTz5i8v0TnGVy7fJeDjwhfJw3fQy/s/XAFhNeu4zSwtzvU+FGcHgXdywvS+Riq4F
+jKgoNnv86wWN/gbSYi3Dx7wapHSNIjwUqaKPbp6DQbr60V/QLU1gYYK7L/7xb4T4
+PvPc11SytPHGi6AVQJQC7Vc6l317sVHwYA7r0ES7x0v5EPBDsgw6pfZvg9Dufn7q
+sylw9qZ/FOwP8wPMmPOMe2QTTOXMmcZsshB4yCRnPubFT6LlARnjGPmPH+NNOtYY
+ywARDO3ZjYFmCvM3zyCHfrCbV9rR6wQIGfAmVrLiNbVv/FWdJGIZ/cbDgAuvoTUE
+j5qRdb7O6hhXRQjmHpiIK07tE/V4MdcAwlizfxSMsdrBVh5K1LTd6ZAUaLzDyXHs
+UdFSVhdYOAHryEzNtVGAMbJf0zT8CxYxQboCOCffoVvI7Fb4sK6syDtXAZZFJKdR
+1GJULr2IGxdppS5BXHZ9egezRpKombVECkctEnjgKGQmiK20Zs7wHUcnh9S97C3l
+oF9UXieisHTDY7SegBu8ufU55vCi8TSD5AtMMkyGCPU68YDEPcvD6YKeJQ3R1opO
+5n7z9c+QWT61L8pIjBADxSxV9VP023q0fc4HODLWBjpxDgw1lvkAaoxQFTNFu8nx
+AIX+MN+9jrHS+2ZJrfcHJRug8A7SCrc7/is8H3RlenvXiseJIUXaFec0Y4ug5ZTi
+1DTdhC7U9DmHFOsvgxEyDgxFpPV5/2CHLQyNREiTqs2jg2a8sTxF3J8p2FVKbD/6
+G/1U0JXS5H4=
 -----END ENCRYPTED PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.dated.resp b/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.dated.resp
index 48a7985f6..608b267ec 100644
--- a/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.dated.resp
+++ b/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.dated.resp
diff --git a/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.good.resp b/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.good.resp
index 0243f9dbe..02615500f 100644
--- a/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.good.resp
+++ b/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.good.resp
diff --git a/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.req b/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.req
index 63246620f..4529ac728 100644
--- a/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.req
+++ b/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.req
diff --git a/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.revoked.resp b/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.revoked.resp
index 0243f9dbe..02615500f 100644
--- a/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.revoked.resp
+++ b/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.revoked.resp
diff --git a/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.signer.dated.resp b/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.signer.dated.resp
index b6ec943ea..2de3cf922 100644
--- a/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.signer.dated.resp
+++ b/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.signer.dated.resp
diff --git a/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.signer.good.resp b/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.signer.good.resp
index d151d8546..3c5017150 100644
--- a/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.signer.good.resp
+++ b/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.signer.good.resp
diff --git a/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.signer.revoked.resp b/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.signer.revoked.resp
index d151d8546..3c5017150 100644
--- a/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.signer.revoked.resp
+++ b/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.signer.revoked.resp
diff --git a/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.signernocert.dated.resp b/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.signernocert.dated.resp
index 69f266075..7c1bd8c3c 100644
--- a/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.signernocert.dated.resp
+++ b/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.signernocert.dated.resp
diff --git a/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.signernocert.good.resp b/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.signernocert.good.resp
index 5da2d5fb6..ee478a865 100644
--- a/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.signernocert.good.resp
+++ b/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.signernocert.good.resp
diff --git a/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.signernocert.revoked.resp b/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.signernocert.revoked.resp
index 5da2d5fb6..ee478a865 100644
--- a/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.signernocert.revoked.resp
+++ b/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.signernocert.revoked.resp
diff --git a/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.p12 b/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.p12
index c75c7daf6..816258f90 100644
--- a/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.p12
+++ b/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.p12
diff --git a/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.pem b/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.pem
index edf8f941d..19910a050 100644
--- a/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.pem
+++ b/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.pem
@@ -1,21 +1,21 @@
 Bag Attributes
     friendlyName: expired2.example.com
-    localKeyID: D7 25 3D B0 CD 84 B6 A0 91 23 8D 39 0C 9F E3 D8 A0 D6 E6 35 
+    localKeyID: 2E CF 5F 43 53 BA 8C E9 2F 62 95 52 FD E6 1B A1 1F CB B7 DA 
 subject=/CN=expired2.example.com
 issuer=/O=example.com/CN=clica Signing Cert rsa
 -----BEGIN CERTIFICATE-----
 MIICjjCCAfegAwIBAgICAMswDQYJKoZIhvcNAQELBQAwNzEUMBIGA1UEChMLZXhh
 bXBsZS5jb20xHzAdBgNVBAMTFmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwHhcNMTIx
-MTAxMTIzNDAyWhcNMTIxMjAxMTIzNDAyWjAfMR0wGwYDVQQDExRleHBpcmVkMi5l
-eGFtcGxlLmNvbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEApen5xbyDM2wZ
-HlNaaYAjXzrDC/qwnlhffLVl0l+/+fMx83Yf9yn/MoB+RHxK2Zl8W3BHu+WmlJan
-MLK7q3Tv1X6hYQLR16CluTpLQswUK5Sxc/TdH0k8b+vR9uwDPQ7NVQ4LGnWwEMxN
-zGw1jWiGSg9fL13WKU9fCScIkQVe42cCAwEAAaOBwDCBvTAOBgNVHQ8BAf8EBAMC
+MTAxMTIzNDA2WhcNMTIxMjAxMTIzNDA2WjAfMR0wGwYDVQQDExRleHBpcmVkMi5l
+eGFtcGxlLmNvbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAyUlBWmdTM96y
+ac0i8r1M520NAWSe7mqaefQ8ikDjcL8OOLFBm6WWZ2Twux5/OnIybzTJ2WKm58fa
+TOlEiw5GsnhnjMTi9zHhEUdJn2/Gz/0oaGfkXu1QsHIP0SjfEGUy1lvg/EhXnPz4
+XGixIZyhQLqOiOrx2BhFqGVZ9FYzO4UCAwEAAaOBwDCBvTAOBgNVHQ8BAf8EBAMC
 BPAwIAYDVR0lAQH/BBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMDIGA1UdHwQrMCkw
 J6AloCOGIWh0dHA6Ly9jcmwuZXhhbXBsZS5jb20vbGF0ZXN0LmNybDA0BggrBgEF
 BQcBAQQoMCYwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vc2NwLmV4YW1wbGUuY29tLzAf
 BgNVHREEGDAWghRleHBpcmVkMi5leGFtcGxlLmNvbTANBgkqhkiG9w0BAQsFAAOB
-gQDGjEY07fjC0JYOYgwOhBXOMJkrTa8Hh4FvXMBB+Rt2VsRf5thkkcKl9Wi1BadE
-os+7qAhS2PHxtmM3aWilxC/esEe7w6bqSv5VT2qSAzOp/q+LGNOB/vDeR+tr04Jx
-o3AhBqpoy9FL3zue1VYYqZn2myvMsWQ0fqwRQAd/h7RQhQ==
+gQBNavRiDJHQwrHch2BJLP7BCtAPshqO9aJNicnXVDE5f7MKc6wjcjgoMNn25Y8w
+WlT+3LGZuvT9QUfC3XSUzafiYDzaI+KxBMQWlztTyoxV0Ug2tVoN65WgiIKgAIwC
+LjP5yVh9q3dsoEpBQ0OGpw7t5Jd4z5isDVdAxQ7LIPpu2w==
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.unlocked.key b/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.unlocked.key
index 0509284ac..7d72da0b5 100644
--- a/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.unlocked.key
+++ b/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.unlocked.key
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXQIBAAKBgQCl6fnFvIMzbBkeU1ppgCNfOsML+rCeWF98tWXSX7/58zHzdh/3
-Kf8ygH5EfErZmXxbcEe75aaUlqcwsrurdO/VfqFhAtHXoKW5OktCzBQrlLFz9N0f
-STxv69H27AM9Ds1VDgsadbAQzE3MbDWNaIZKD18vXdYpT18JJwiRBV7jZwIDAQAB
-AoGABY+IeAif6xbJ5rrLcnLBfL0W8W1XAw+aL69SuNDNud5dQ7gnTRziuToWQUxb
-I9zhjpz+Qn1pblx4QQkUgiQar6LLMgW4ZpJBCKQd7AGdzirSUqUgY2IwRUam+9Jr
-NkBLiUlPcQ9GbEDUBSZ/JQJCIMrtCUAc//uERHgNF3prJ3UCQQDUX3gedmnKvMQY
-+YLRIYEfFo6ASUfTEs0Dt2A4p8ICLNXa2rVsE09dAqUyepUYa6geXXRxEPeEsLUg
-xYGK+ZAbAkEAx/9D3k45moQYt+S0NE/fPcd673mAGV8i8d0cr2QG9zTpoIszmHH6
-kqJkh0JmOuBLOP7pldqR8Vibqj1JsXMmpQJBALrLri+9H5g/KIx/Cl1ABv59LKIR
-0qcJJmJabLvocnDPVtrE/EYvReMdbIhV4cY1Cw6KTN0We1+uveIxVpwSnnkCQH9D
-gQVqE5+uZShHgSA0nyLp1+GhGBGNB2iOwh0dco1F/1Boo9li1gcPDRdA+lqGtXc8
-RplT70B7mPqYa1depf0CQQDT02pzQYCGet7u/NKyJi1Cc3UFx6FnielEL96zmtWT
-EbYXb7aoazRiRttYiYGauU8NebHaTWAHaTFf+EVzfJLz
+MIICXQIBAAKBgQDJSUFaZ1Mz3rJpzSLyvUznbQ0BZJ7uapp59DyKQONwvw44sUGb
+pZZnZPC7Hn86cjJvNMnZYqbnx9pM6USLDkayeGeMxOL3MeERR0mfb8bP/ShoZ+Re
+7VCwcg/RKN8QZTLWW+D8SFec/PhcaLEhnKFAuo6I6vHYGEWoZVn0VjM7hQIDAQAB
+AoGABGHMoy30LQEoY67EV8IAwloIqjLZVenqtoR3a/AZM3tpURkky0Fp2pLjPcOe
+c/SH/g1JZqrj5NBgQ4PhiuBy8AZRm1b8XA+aDikshWumVefchjt3dpZwltdPLYw1
+B+Y5YCaDIAN8conQ+GBNhGE26e8QaksOcwzY7zLMFE1QCkkCQQDxMSbZFGB/6/87
+x80aRkPX2LALl2nG7HMhgd6SGifAHwLVTKCtkRgqyXnQZ5Yt39iQ0hMMgctfS5Yj
+4JSFB+IpAkEA1aTl1lRYK9A9j2ZDKf1UiEdnnoUE9QRUTLz7zidZ6InHQUVFHHbw
+EnZDZH8SRtMkyp8DzVkywMjmTIyCsMQR/QJAXVLVYz1dMWIROgJPPBFgAs6XH4UQ
+qqWmzpo/kmyIYPAe2oVxznbL0RJwDdFm7I0mcLK4KCi4lkDa8TrefLLWMQJBAKPk
+Oti/nWAHAKKYHWAB0a41sLy/aH0ZlB3GQBj2wRcNUsi0ff8HEsXm6W4XuQqSAUBa
+2gzWp4OS2nDQvZUi5HUCQQCshGdN0wTB/Opx4ja0TY/P+zoxNfOLX5TbaDdF4Uit
+BEbAk7yaLQ9vZXBSgpxXkr2oAxsltaRLmc1GQRtDrayG
 -----END RSA PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.com/expired2.example.com/key3.db b/test/aux-fixed/exim-ca/example.com/expired2.example.com/key3.db
index 2768cbd5f..b92d5066e 100644
--- a/test/aux-fixed/exim-ca/example.com/expired2.example.com/key3.db
+++ b/test/aux-fixed/exim-ca/example.com/expired2.example.com/key3.db
diff --git a/test/aux-fixed/exim-ca/example.com/revoked1.example.com/ca_chain.pem b/test/aux-fixed/exim-ca/example.com/revoked1.example.com/ca_chain.pem
index cde036853..c6accd35b 100644
--- a/test/aux-fixed/exim-ca/example.com/revoked1.example.com/ca_chain.pem
+++ b/test/aux-fixed/exim-ca/example.com/revoked1.example.com/ca_chain.pem
@@ -3,33 +3,33 @@ Bag Attributes
 subject=/O=example.com/CN=clica Signing Cert rsa
 issuer=/O=example.com/CN=clica CA rsa
 -----BEGIN CERTIFICATE-----
-MIICNDCCAZ2gAwIBAgIBAjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+MIICGDCCAYGgAwIBAgIBQjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
 cGxlLmNvbTEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwMVoX
 DTM4MDEwMTEyMzQwMVowNzEUMBIGA1UEChMLZXhhbXBsZS5jb20xHzAdBgNVBAMT
 FmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
-AoGBANlcwo5q84SEtVy5W/xqbYAzOiYUZ0Shp9+ry/Q/X5uhrDF9JSHNWJbXut+8
-ZJGICt0RYVIJCcaa7FUt5hTKEx4fgURr+Hz84ZgwesMxcECHJPq9ylrCqbPkbmFR
-1XUy2MvioMH2lyc/PbV62XXggJhHioStVLRfyVlkS1KvvR+HAgMBAAGjWjBYMA4G
-A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMDIGA1UdHwQrMCkwJ6Al
-oCOGIWh0dHA6Ly9jcmwuZXhhbXBsZS5jb20vbGF0ZXN0LmNybDANBgkqhkiG9w0B
-AQsFAAOBgQBtPJwqu7DiDmFZd58L4xQ6JJhrJzJUDHmT7ikW2tOM58yisCgSnzrR
-xihW+49vUQ9lSGxBHaFwdehAuGTXydnf7/i9i6KA2RZ+Rq12FJFYOhjaIP7Sy1zq
-VXtb+P1eDBQQhz0WgysLVjgGdBiokRv86yY56ficoTQ6EyWzQLCU+A==
+AoGBALFHTtwaKeCfLlDf/wTErhOB6AB9vKHtyDbU6yDB/DrA5DLbug8m1oGGwEIf
+lTY0VBym8/Iu/ExE476gRmPNX/kIQsSNj9LtCIx3JXqLpc8ylw4cuVMOeFtBXNtE
+YKvUPIyWaAvqBbwY1QOyHNeoJ68hBdDPCn3oN2wrCz4if9QHAgMBAAGjPjA8MA4G
+A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMBYGA1UdDgQPBA1BQWJ0
+d0N4Y1hnYjBRMA0GCSqGSIb3DQEBCwUAA4GBAERD495HPM1BxM60EHGYLQgPjJPT
+/cL+nTKyIdv2UvzAnJaSFMMAB43Twy/jvkahsITVuieSU4kpev79KRNLfk+h25pf
+oPjaOfmOQVtHWN9ML8FDs0dLkRhJPuagObx17l/KEPkiK/jLB339fyO1HxaKhymE
+hdqYsdjjnBy/6U5g
 -----END CERTIFICATE-----
 Bag Attributes
     friendlyName: Certificate Authority rsa
 subject=/O=example.com/CN=clica CA rsa
 issuer=/O=example.com/CN=clica CA rsa
 -----BEGIN CERTIFICATE-----
-MIIB9jCCAV+gAwIBAgIBATANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+MIIB9jCCAV+gAwIBAgIBQTANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
 cGxlLmNvbTEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwMVoX
 DTM4MDEwMTEyMzQwMVowLTEUMBIGA1UEChMLZXhhbXBsZS5jb20xFTATBgNVBAMT
-DGNsaWNhIENBIHJzYTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA2N3YjbHA
-BEKAiUHwJ0VMAAe/KMOM8slXOAKni4v7Vf6BzbO5B6uaKhDV2n3V0vXwMdAoeBaq
-3s9CHOjDXwjF1qf/p4w3Z2aUIVt/Mb+uEcPUlq0Nr8OLlH11QKbkvFtLxU3sUAoi
-fcaydi1q3tszjPQ0tKlLo6kOzcgi8d47WccCAwEAAaMmMCQwEgYDVR0TAQH/BAgw
-BgEB/wIBATAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADgYEAAzD/Zszo
-X4ieSQQxDOH53VkiAJDs32qso9YzGbQaenuRnVFCuo7rt68cjMcOjzf18/I+iMeH
-nEcdqkfoYB4Z3LXvDaRGZhg/ZOv58muzRnsW2oQI9yFqDwD0FZPtM6Vq0AWXjLuq
-IogOI5fShSo7H5hc3vrkvS7KUhzuv3FKnaQ=
+DGNsaWNhIENBIHJzYTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAyDGCW64u
+Q5CBaKQGpgZVwGjo+VAn2EpwbfCZkhJtnxESiZYigjBH8KaOcAGyuv6jqY3pP64u
+gPe3lRkqwnvnLkj4wYo7d1GpW12yRCN/n7oMUcHLceqeLc8iYy6k1szF+jdlcRPL
+2OXNEy2pgzsPRyWZyCS2xZE86byA4N+/Y5cCAwEAAaMmMCQwEgYDVR0TAQH/BAgw
+BgEB/wIBATAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADgYEAeQnAdtC4
+EWA5tl8hRlOmc7IM6c40MJRB73/Oiul8xcS4l2qRLXUAWJjddxMPrLf4AYmc0vQz
+rcWmvkfdnjqX235D5YaOvfsIKr+YThtbSUvSK/uCGCxmiQHLQIWa7oWnFExIAjFd
+xxxXmvnPPG86dFoAm4AGS6kynXmWc4tvKYI=
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.com/revoked1.example.com/cert8.db b/test/aux-fixed/exim-ca/example.com/revoked1.example.com/cert8.db
index 90c6e822f..b76538765 100644
--- a/test/aux-fixed/exim-ca/example.com/revoked1.example.com/cert8.db
+++ b/test/aux-fixed/exim-ca/example.com/revoked1.example.com/cert8.db
diff --git a/test/aux-fixed/exim-ca/example.com/revoked1.example.com/key3.db b/test/aux-fixed/exim-ca/example.com/revoked1.example.com/key3.db
index f4d6ffc16..e2cf707b4 100644
--- a/test/aux-fixed/exim-ca/example.com/revoked1.example.com/key3.db
+++ b/test/aux-fixed/exim-ca/example.com/revoked1.example.com/key3.db
diff --git a/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.chain.pem b/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.chain.pem
index b25f19a6a..af15d75e9 100644
--- a/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.chain.pem
+++ b/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.chain.pem
@@ -1,35 +1,35 @@
 Bag Attributes
     friendlyName: revoked1.example.com
-    localKeyID: 4C C0 73 49 E2 6D E5 D1 73 F1 0A 72 4B 0F 9F 07 88 2E E2 A4 
+    localKeyID: 98 A6 67 6B 44 FD 94 63 18 18 7F 6A 7A D2 3D DF 66 C0 6E 88 
 subject=/CN=revoked1.example.com
 issuer=/O=example.com/CN=clica Signing Cert rsa
 -----BEGIN CERTIFICATE-----
 MIICjTCCAfagAwIBAgIBZjANBgkqhkiG9w0BAQsFADA3MRQwEgYDVQQKEwtleGFt
 cGxlLmNvbTEfMB0GA1UEAxMWY2xpY2EgU2lnbmluZyBDZXJ0IHJzYTAeFw0xMjEx
-MDExMjM0MDFaFw0zNzEyMDExMjM0MDFaMB8xHTAbBgNVBAMTFHJldm9rZWQxLmV4
-YW1wbGUuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDWGeoiTtjQGgld
-+qA53Ah8LKoHUUf68bUK2LApL/QX385PUGx4s5D9nWRrJcyUjWDa6Dcq5a2KzamD
-JNIrzknF0kvPgY0wNtWhuxHMKfKWL/1cPGqXe2tW1RQRWZ9+NnfQT1zJJGe7bhgm
-MxKc/u7bw5g3rS6mijIBTj0NIwLSxwIDAQABo4HAMIG9MA4GA1UdDwEB/wQEAwIE
+MDExMjM0MDNaFw0zNzEyMDExMjM0MDNaMB8xHTAbBgNVBAMTFHJldm9rZWQxLmV4
+YW1wbGUuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDDsdwu9PSYjL1f
+WC5eLgCXa0bq1Jc50NieHN5ydpxB3Zys2ti34lNqQEqFmkWwTy6CfMUUvqncqvhC
+FPdOHAvRkKrDteXpYRU40YgZy8Tf+/x27CvGpZ2Wohruvwrts5F1ChqDi6hObl9S
+p0kerRHLoe98CDqLW+CxmvmchNgCfwIDAQABo4HAMIG9MA4GA1UdDwEB/wQEAwIE
 8DAgBgNVHSUBAf8EFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwMgYDVR0fBCswKTAn
 oCWgI4YhaHR0cDovL2NybC5leGFtcGxlLmNvbS9sYXRlc3QuY3JsMDQGCCsGAQUF
 BwEBBCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29zY3AuZXhhbXBsZS5jb20vMB8G
 A1UdEQQYMBaCFHJldm9rZWQxLmV4YW1wbGUuY29tMA0GCSqGSIb3DQEBCwUAA4GB
-AMK62ueK6c1CLviNLweAAmUedPoDq+60UsXHgJdapLd3SPTbOnON90e252gkLBcF
-cx/HssJUysJic+r3qKrSPRDtT4KK1j2fx/KIEDgyr8/u4F5R7UcK+WyiA/IVX1y5
-8Z0iNPzOTKGTAAlnnF+nZTvoOQS0Y93N9IVNFWLjrqTV
+AJMKgKfXkftMHP9bwQ5WWJGcNbmkpYP9PnsJGn0M/3G6SVcY9GxQyKSDw4GmoVaR
+Kr+JEZFL+UNwbVobW10/29rvXn8nBlPowFW7YS/XxdM0WMA6w+ZMoekeU+7DpBAq
+SArj3U1kCBnK1jb71O7Aj1cVQXT9UMxRx+SMWC0zLFC8
 -----END CERTIFICATE-----
 -----BEGIN CERTIFICATE-----
-MIICNDCCAZ2gAwIBAgIBAjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+MIICGDCCAYGgAwIBAgIBQjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
 cGxlLmNvbTEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwMVoX
 DTM4MDEwMTEyMzQwMVowNzEUMBIGA1UEChMLZXhhbXBsZS5jb20xHzAdBgNVBAMT
 FmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
-AoGBANlcwo5q84SEtVy5W/xqbYAzOiYUZ0Shp9+ry/Q/X5uhrDF9JSHNWJbXut+8
-ZJGICt0RYVIJCcaa7FUt5hTKEx4fgURr+Hz84ZgwesMxcECHJPq9ylrCqbPkbmFR
-1XUy2MvioMH2lyc/PbV62XXggJhHioStVLRfyVlkS1KvvR+HAgMBAAGjWjBYMA4G
-A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMDIGA1UdHwQrMCkwJ6Al
-oCOGIWh0dHA6Ly9jcmwuZXhhbXBsZS5jb20vbGF0ZXN0LmNybDANBgkqhkiG9w0B
-AQsFAAOBgQBtPJwqu7DiDmFZd58L4xQ6JJhrJzJUDHmT7ikW2tOM58yisCgSnzrR
-xihW+49vUQ9lSGxBHaFwdehAuGTXydnf7/i9i6KA2RZ+Rq12FJFYOhjaIP7Sy1zq
-VXtb+P1eDBQQhz0WgysLVjgGdBiokRv86yY56ficoTQ6EyWzQLCU+A==
+AoGBALFHTtwaKeCfLlDf/wTErhOB6AB9vKHtyDbU6yDB/DrA5DLbug8m1oGGwEIf
+lTY0VBym8/Iu/ExE476gRmPNX/kIQsSNj9LtCIx3JXqLpc8ylw4cuVMOeFtBXNtE
+YKvUPIyWaAvqBbwY1QOyHNeoJ68hBdDPCn3oN2wrCz4if9QHAgMBAAGjPjA8MA4G
+A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMBYGA1UdDgQPBA1BQWJ0
+d0N4Y1hnYjBRMA0GCSqGSIb3DQEBCwUAA4GBAERD495HPM1BxM60EHGYLQgPjJPT
+/cL+nTKyIdv2UvzAnJaSFMMAB43Twy/jvkahsITVuieSU4kpev79KRNLfk+h25pf
+oPjaOfmOQVtHWN9ML8FDs0dLkRhJPuagObx17l/KEPkiK/jLB339fyO1HxaKhymE
+hdqYsdjjnBy/6U5g
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.key b/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.key
index d1d3f0ea5..6f00126a2 100644
--- a/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.key
+++ b/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.key
@@ -1,21 +1,22 @@
 Bag Attributes
     friendlyName: revoked1.example.com
-    localKeyID: 4C C0 73 49 E2 6D E5 D1 73 F1 0A 72 4B 0F 9F 07 88 2E E2 A4 
+    localKeyID: 98 A6 67 6B 44 FD 94 63 18 18 7F 6A 7A D2 3D DF 66 C0 6E 88 
 Key Attributes: <No Attributes>
 -----BEGIN ENCRYPTED PRIVATE KEY-----
-MIICxjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQIde1ywCSD4GcCAggA
-MBQGCCqGSIb3DQMHBAg4DHTMV0XGBQSCAoC1KXNuYDr6cKKrifCTLM2Ig/tKxl5v
-dgxEKjzyyFu9elepe+DM/DJFzt3kK16SL257va54hubh1ics6GfHTmVVSKk7P2dg
-tG9ERb1/IU+S1Ybn3zyVF1yzLXS2+2eIsiA2YlqwI3HHs8QVbQA23ZTzSVoGjZJF
-xZHPIovabqk+8waN0aqGkySdy7DVMMpI0zmpZ+v+eTkox9hxZ35eekBO297qlL9G
-+q9RXJxG0K32s33imDsz9laRlbU2o953Eto08YfiZr498L8ZIXlfGeaTBsZGiF3+
-R5vT9KgoImdg04gVqeP1I2t1oVEcqyljxxHzTlIdsNKXKVw7G3iX183HC1iyRc9O
-e3b3GzBrRsgu6lM/PphPKzOtzct+Pzv/RypMWEodbfRmGAibWXbNeFX0TjTCT/zt
-cpqD0m6oErjFvPmB4tDR+8BrDr1WbVUT60ZTPV/EFpcazY07/MvyjLbNX/v3lvrg
-fJnlh3E3P/m0CsopbdzaLcIBvLbdLnGxN1Q+pJjwJupsDO8PX/kbIg8nTaTP0ZK9
-XPG+whtccwaehBB1yC/21UJ/SQJa3eJwieaOEKkt6DXzsnOAUXaTNaWrGs7bDS58
-n/BioHG76HJVJorJ+nblE66kFsicxOdMAL6dP+l7bsup4RjwjlCGBpknwt2Vnhm2
-Kyn17WhZqsl01dyTGwy67qbQG5L7YEIckoRyl5pKS3l0z5xZV8q7qDMIuO63zre+
-j3yhSu2NROvYSkZAoDSIo+4hq7X9G4cqSx6CycR6xfo0vnFVu0Yu9nJKURzLKNdi
-xjxEYdjY/9R5R1ji+YB1rNALLdAQMHLIyFZuC54rqWA/Ta+V9E5047zO
+MIIC1DBOBgkqhkiG9w0BBQ0wQTApBgkqhkiG9w0BBQwwHAQIraAmh5Hz5MgCAggA
+MAwGCCqGSIb3DQIJBQAwFAYIKoZIhvcNAwcECLd0uIVgUYBaBIICgKC+Bq3xDcih
+xIw795zCFmwYE96dbTkfFa+I/6O74TdzoVzl+udw56MLnLVeen+KHTxJsA2Eiv2J
+Uil02vnLbB/VeXDGPSvPwu7CxWc5GdXmrkXS6gttNmAhuqcy0cOmH1Gx/e4qk7Nr
+WFgAANNj07FBmmEvcDQz0YtEYf/t4tioZo7xoO+tg9cMgRufrp04f1p6MlV1FOjB
+ZLCEPHetvBM2s2LL7F1X5cve7pWvFprOAoz3aaLvpwYdNy4Wk8/xSf9cl2VDomSs
+I2csRRT2JFcRlGQaSbhrtecDlNTEfXfClhwIMuwbfXsRcb7aRxKkdkSa1GDbMkDn
+IJah0z/3G+zBuCVNH9geB7ybxCrcdLRgScLse6be3BA59LUl3bhP0YvLj3cYc8dY
+HlRWJxyStMwz4+bg4xa7c1KsSt9utd/Fbzz8C/c9tyZDWNzeXoZgneb0Jmemk4o8
++L+dXqujWKHJqsI3pSl5Amv/QjHFjh6bg/j8VgDe8qxhkx7TR1/VxfCj4NAp6IgI
+m8onSmPqwahEzLW6DoLvqCbmpBKbXsZTcBRE5ZbE/bZd32K9o2dbYMvB6SiXU39D
+R79marfIwIhma8qYmmhTLXoAhuK9s2ZouvSfSAdS0Jy80I9HATKtz7/gvZlg8aA8
+lAVC5MnMgBciRBDAWgco7uHIWL69L/O6J+NmkFA1Ql2N95nOFJaAQC92G6pVsPCJ
+FICkRQrBCSnkcEjwX/BhHdP5CkGUZLs83brJOQzYNI6EFsBnl+xK4BwO/y5mezlI
+K6BXqoJZ2xJ3R8wBzKi8hPBYk66aKew8vDmWQq3AU+Skla/8yavQQfP+H1uhuSri
+323Zh+Oa3S8=
 -----END ENCRYPTED PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.dated.resp b/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.dated.resp
index 486bc4fed..534b77a3a 100644
--- a/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.dated.resp
+++ b/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.dated.resp
diff --git a/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.good.resp b/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.good.resp
index 84739bc4f..0d755f471 100644
--- a/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.good.resp
+++ b/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.good.resp
diff --git a/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.req b/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.req
index 5eca96c9b..71e01eb2e 100644
--- a/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.req
+++ b/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.req
diff --git a/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.revoked.resp b/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.revoked.resp
index 305958559..780041741 100644
--- a/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.revoked.resp
+++ b/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.revoked.resp
diff --git a/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.signer.dated.resp b/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.signer.dated.resp
index db49977dc..18204f14e 100644
--- a/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.signer.dated.resp
+++ b/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.signer.dated.resp
diff --git a/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.signer.good.resp b/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.signer.good.resp
index c2c5d68b6..8c42fc2a6 100644
--- a/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.signer.good.resp
+++ b/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.signer.good.resp
diff --git a/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.signer.revoked.resp b/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.signer.revoked.resp
index f9b913e46..856afb1fd 100644
--- a/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.signer.revoked.resp
+++ b/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.signer.revoked.resp
diff --git a/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.signernocert.dated.resp b/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.signernocert.dated.resp
index 3990794fc..63b5b00fe 100644
--- a/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.signernocert.dated.resp
+++ b/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.signernocert.dated.resp
diff --git a/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.signernocert.good.resp b/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.signernocert.good.resp
index 6f2e84d1f..26803cf28 100644
--- a/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.signernocert.good.resp
+++ b/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.signernocert.good.resp
diff --git a/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.signernocert.revoked.resp b/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.signernocert.revoked.resp
index 8e288b063..9606ef38a 100644
--- a/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.signernocert.revoked.resp
+++ b/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.signernocert.revoked.resp
diff --git a/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.p12 b/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.p12
index 134885c8c..bb0372652 100644
--- a/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.p12
+++ b/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.p12
diff --git a/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.pem b/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.pem
index 835876efd..df215d277 100644
--- a/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.pem
+++ b/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.pem
@@ -1,21 +1,21 @@
 Bag Attributes
     friendlyName: revoked1.example.com
-    localKeyID: 4C C0 73 49 E2 6D E5 D1 73 F1 0A 72 4B 0F 9F 07 88 2E E2 A4 
+    localKeyID: 98 A6 67 6B 44 FD 94 63 18 18 7F 6A 7A D2 3D DF 66 C0 6E 88 
 subject=/CN=revoked1.example.com
 issuer=/O=example.com/CN=clica Signing Cert rsa
 -----BEGIN CERTIFICATE-----
 MIICjTCCAfagAwIBAgIBZjANBgkqhkiG9w0BAQsFADA3MRQwEgYDVQQKEwtleGFt
 cGxlLmNvbTEfMB0GA1UEAxMWY2xpY2EgU2lnbmluZyBDZXJ0IHJzYTAeFw0xMjEx
-MDExMjM0MDFaFw0zNzEyMDExMjM0MDFaMB8xHTAbBgNVBAMTFHJldm9rZWQxLmV4
-YW1wbGUuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDWGeoiTtjQGgld
-+qA53Ah8LKoHUUf68bUK2LApL/QX385PUGx4s5D9nWRrJcyUjWDa6Dcq5a2KzamD
-JNIrzknF0kvPgY0wNtWhuxHMKfKWL/1cPGqXe2tW1RQRWZ9+NnfQT1zJJGe7bhgm
-MxKc/u7bw5g3rS6mijIBTj0NIwLSxwIDAQABo4HAMIG9MA4GA1UdDwEB/wQEAwIE
+MDExMjM0MDNaFw0zNzEyMDExMjM0MDNaMB8xHTAbBgNVBAMTFHJldm9rZWQxLmV4
+YW1wbGUuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDDsdwu9PSYjL1f
+WC5eLgCXa0bq1Jc50NieHN5ydpxB3Zys2ti34lNqQEqFmkWwTy6CfMUUvqncqvhC
+FPdOHAvRkKrDteXpYRU40YgZy8Tf+/x27CvGpZ2Wohruvwrts5F1ChqDi6hObl9S
+p0kerRHLoe98CDqLW+CxmvmchNgCfwIDAQABo4HAMIG9MA4GA1UdDwEB/wQEAwIE
 8DAgBgNVHSUBAf8EFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwMgYDVR0fBCswKTAn
 oCWgI4YhaHR0cDovL2NybC5leGFtcGxlLmNvbS9sYXRlc3QuY3JsMDQGCCsGAQUF
 BwEBBCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29zY3AuZXhhbXBsZS5jb20vMB8G
 A1UdEQQYMBaCFHJldm9rZWQxLmV4YW1wbGUuY29tMA0GCSqGSIb3DQEBCwUAA4GB
-AMK62ueK6c1CLviNLweAAmUedPoDq+60UsXHgJdapLd3SPTbOnON90e252gkLBcF
-cx/HssJUysJic+r3qKrSPRDtT4KK1j2fx/KIEDgyr8/u4F5R7UcK+WyiA/IVX1y5
-8Z0iNPzOTKGTAAlnnF+nZTvoOQS0Y93N9IVNFWLjrqTV
+AJMKgKfXkftMHP9bwQ5WWJGcNbmkpYP9PnsJGn0M/3G6SVcY9GxQyKSDw4GmoVaR
+Kr+JEZFL+UNwbVobW10/29rvXn8nBlPowFW7YS/XxdM0WMA6w+ZMoekeU+7DpBAq
+SArj3U1kCBnK1jb71O7Aj1cVQXT9UMxRx+SMWC0zLFC8
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.unlocked.key b/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.unlocked.key
index f0fdba7ba..80aba4907 100644
--- a/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.unlocked.key
+++ b/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.unlocked.key
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXQIBAAKBgQDWGeoiTtjQGgld+qA53Ah8LKoHUUf68bUK2LApL/QX385PUGx4
-s5D9nWRrJcyUjWDa6Dcq5a2KzamDJNIrzknF0kvPgY0wNtWhuxHMKfKWL/1cPGqX
-e2tW1RQRWZ9+NnfQT1zJJGe7bhgmMxKc/u7bw5g3rS6mijIBTj0NIwLSxwIDAQAB
-AoGAFPW/HT7qn98+QoQm/z/iWF6HaL77obGomSUi6qCGSd4M4WizFDmNr+s8KcP7
-qSFfTx7246a0XIdxmTEK630lbWAMc6uIpk1ylHQ+MrtIthhwXMN9Pe6SOoVYVrlD
-IjjW/xywRN2Bv4C7LO++vwijZC0y+LKPOZgGvgu+8JFPy+0CQQDulW422AGwE3dx
-brQ3DIVoue0JVGAqOoWXDbrRpFzMb/E0rXejI1dypjRhcE2ZCu9Q0cnNqE7sTRTK
-SgnY8NVVAkEA5br2wtUf+46W2VmW1I9zFYnkJ6m2egnuJsnA93pJiRrUkCJBMswt
-RFhIGouq0MWUE4aco8SxdqiD3CJ/kxMHqwJBAMAHnD8eWzVqZa/yJ7FLLbHePFBP
-DlvO4Kl1DpIgVeTikOUSXgH7ty37YpuutXZiG78UK/aQ6n09iWdMcmKfbUUCQD9w
-nAg9trFPNRUcimx0mMFP7POPCFc3Os73VBSDbp8wC5cp/ns6qx1+i5rZCvjQNw4V
-VFhdTuyHqLI3zKce0DUCQQDMd2vUyYNolhTjUOg+ojj0JGr1AmTpRqBbVd3Qu84r
-LjyF3YKaiD18Y4dtzQfCWNzyhkKd4k4nVaY1cygxSqEF
+MIICXAIBAAKBgQDDsdwu9PSYjL1fWC5eLgCXa0bq1Jc50NieHN5ydpxB3Zys2ti3
+4lNqQEqFmkWwTy6CfMUUvqncqvhCFPdOHAvRkKrDteXpYRU40YgZy8Tf+/x27CvG
+pZ2Wohruvwrts5F1ChqDi6hObl9Sp0kerRHLoe98CDqLW+CxmvmchNgCfwIDAQAB
+AoGABkmdqHM9tJ+4/z+Ruybr5UbmGr9v3cSvC7gjvDZsDisKUKd2FRppfF11HNZ4
+bLzD4soSzvgn9FYYmeRF5Irpej4yZk8phVyAkeokpM3AeSI0ogwa0eEo8BqcSTo8
+0F7/jmrFJWfIY/De0NS3OY3s6kJjnFRh9RzTRMsS8FXAXRECQQDk1bfVpoKr+pqH
+YAefcgpuPVqFs1K8sA4V7tPbFt5cLt08V7NSBwZ+BKfs/kjvcwbU+bQK4oQVB2hc
+4z0M+wVnAkEA2u0EOrirzPtc6pHjw4gEhXeX1R8YhvWQ3qKKWmeQmac7uwKeq8Za
+34ZuKI48k4nBCQjnJ5O+UQ4thZtovuaTKQJANS6SNd4n2k44oaOowd6gG/S4WABQ
+BzgnXeOOawmKjgP6OK7tJvApCxqL6GFElBm4icCqnij8p2J8V7IcGysvmwJBAKxc
+AIFu1Su8FqpDE+vkkZK21l4fbkMK4PS3SW/lq62dQWR5qoyYzQDAqMfbPAv4X3cK
+gFrjceoE3IgdE7mAdQkCQAK+y9a8tqc9rfWWygTMqEDpaksb6gX9iCe3M0obvQGv
+CjmrSihgH4Ax4/9pyzhzoMaktyt47NCEq5Y6mghOiV8=
 -----END RSA PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.com/revoked2.example.com/ca_chain.pem b/test/aux-fixed/exim-ca/example.com/revoked2.example.com/ca_chain.pem
index cde036853..c6accd35b 100644
--- a/test/aux-fixed/exim-ca/example.com/revoked2.example.com/ca_chain.pem
+++ b/test/aux-fixed/exim-ca/example.com/revoked2.example.com/ca_chain.pem
@@ -3,33 +3,33 @@ Bag Attributes
 subject=/O=example.com/CN=clica Signing Cert rsa
 issuer=/O=example.com/CN=clica CA rsa
 -----BEGIN CERTIFICATE-----
-MIICNDCCAZ2gAwIBAgIBAjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+MIICGDCCAYGgAwIBAgIBQjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
 cGxlLmNvbTEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwMVoX
 DTM4MDEwMTEyMzQwMVowNzEUMBIGA1UEChMLZXhhbXBsZS5jb20xHzAdBgNVBAMT
 FmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
-AoGBANlcwo5q84SEtVy5W/xqbYAzOiYUZ0Shp9+ry/Q/X5uhrDF9JSHNWJbXut+8
-ZJGICt0RYVIJCcaa7FUt5hTKEx4fgURr+Hz84ZgwesMxcECHJPq9ylrCqbPkbmFR
-1XUy2MvioMH2lyc/PbV62XXggJhHioStVLRfyVlkS1KvvR+HAgMBAAGjWjBYMA4G
-A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMDIGA1UdHwQrMCkwJ6Al
-oCOGIWh0dHA6Ly9jcmwuZXhhbXBsZS5jb20vbGF0ZXN0LmNybDANBgkqhkiG9w0B
-AQsFAAOBgQBtPJwqu7DiDmFZd58L4xQ6JJhrJzJUDHmT7ikW2tOM58yisCgSnzrR
-xihW+49vUQ9lSGxBHaFwdehAuGTXydnf7/i9i6KA2RZ+Rq12FJFYOhjaIP7Sy1zq
-VXtb+P1eDBQQhz0WgysLVjgGdBiokRv86yY56ficoTQ6EyWzQLCU+A==
+AoGBALFHTtwaKeCfLlDf/wTErhOB6AB9vKHtyDbU6yDB/DrA5DLbug8m1oGGwEIf
+lTY0VBym8/Iu/ExE476gRmPNX/kIQsSNj9LtCIx3JXqLpc8ylw4cuVMOeFtBXNtE
+YKvUPIyWaAvqBbwY1QOyHNeoJ68hBdDPCn3oN2wrCz4if9QHAgMBAAGjPjA8MA4G
+A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMBYGA1UdDgQPBA1BQWJ0
+d0N4Y1hnYjBRMA0GCSqGSIb3DQEBCwUAA4GBAERD495HPM1BxM60EHGYLQgPjJPT
+/cL+nTKyIdv2UvzAnJaSFMMAB43Twy/jvkahsITVuieSU4kpev79KRNLfk+h25pf
+oPjaOfmOQVtHWN9ML8FDs0dLkRhJPuagObx17l/KEPkiK/jLB339fyO1HxaKhymE
+hdqYsdjjnBy/6U5g
 -----END CERTIFICATE-----
 Bag Attributes
     friendlyName: Certificate Authority rsa
 subject=/O=example.com/CN=clica CA rsa
 issuer=/O=example.com/CN=clica CA rsa
 -----BEGIN CERTIFICATE-----
-MIIB9jCCAV+gAwIBAgIBATANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+MIIB9jCCAV+gAwIBAgIBQTANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
 cGxlLmNvbTEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwMVoX
 DTM4MDEwMTEyMzQwMVowLTEUMBIGA1UEChMLZXhhbXBsZS5jb20xFTATBgNVBAMT
-DGNsaWNhIENBIHJzYTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA2N3YjbHA
-BEKAiUHwJ0VMAAe/KMOM8slXOAKni4v7Vf6BzbO5B6uaKhDV2n3V0vXwMdAoeBaq
-3s9CHOjDXwjF1qf/p4w3Z2aUIVt/Mb+uEcPUlq0Nr8OLlH11QKbkvFtLxU3sUAoi
-fcaydi1q3tszjPQ0tKlLo6kOzcgi8d47WccCAwEAAaMmMCQwEgYDVR0TAQH/BAgw
-BgEB/wIBATAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADgYEAAzD/Zszo
-X4ieSQQxDOH53VkiAJDs32qso9YzGbQaenuRnVFCuo7rt68cjMcOjzf18/I+iMeH
-nEcdqkfoYB4Z3LXvDaRGZhg/ZOv58muzRnsW2oQI9yFqDwD0FZPtM6Vq0AWXjLuq
-IogOI5fShSo7H5hc3vrkvS7KUhzuv3FKnaQ=
+DGNsaWNhIENBIHJzYTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAyDGCW64u
+Q5CBaKQGpgZVwGjo+VAn2EpwbfCZkhJtnxESiZYigjBH8KaOcAGyuv6jqY3pP64u
+gPe3lRkqwnvnLkj4wYo7d1GpW12yRCN/n7oMUcHLceqeLc8iYy6k1szF+jdlcRPL
+2OXNEy2pgzsPRyWZyCS2xZE86byA4N+/Y5cCAwEAAaMmMCQwEgYDVR0TAQH/BAgw
+BgEB/wIBATAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADgYEAeQnAdtC4
+EWA5tl8hRlOmc7IM6c40MJRB73/Oiul8xcS4l2qRLXUAWJjddxMPrLf4AYmc0vQz
+rcWmvkfdnjqX235D5YaOvfsIKr+YThtbSUvSK/uCGCxmiQHLQIWa7oWnFExIAjFd
+xxxXmvnPPG86dFoAm4AGS6kynXmWc4tvKYI=
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.com/revoked2.example.com/cert8.db b/test/aux-fixed/exim-ca/example.com/revoked2.example.com/cert8.db
index 59574bcc2..b17492281 100644
--- a/test/aux-fixed/exim-ca/example.com/revoked2.example.com/cert8.db
+++ b/test/aux-fixed/exim-ca/example.com/revoked2.example.com/cert8.db
diff --git a/test/aux-fixed/exim-ca/example.com/revoked2.example.com/key3.db b/test/aux-fixed/exim-ca/example.com/revoked2.example.com/key3.db
index 7ae7ae479..81156c7b4 100644
--- a/test/aux-fixed/exim-ca/example.com/revoked2.example.com/key3.db
+++ b/test/aux-fixed/exim-ca/example.com/revoked2.example.com/key3.db
diff --git a/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.chain.pem b/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.chain.pem
index e084d258f..4e1f49364 100644
--- a/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.chain.pem
+++ b/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.chain.pem
@@ -1,35 +1,35 @@
 Bag Attributes
     friendlyName: revoked2.example.com
-    localKeyID: 7E 85 5C 51 34 1E 3A D0 E3 21 36 59 EF 77 71 6C C2 DC D5 42 
+    localKeyID: 74 A8 5D 76 70 26 D5 BF 09 D2 76 28 56 4A 09 63 C1 3E 74 38 
 subject=/CN=revoked2.example.com
 issuer=/O=example.com/CN=clica Signing Cert rsa
 -----BEGIN CERTIFICATE-----
 MIICjjCCAfegAwIBAgICAMowDQYJKoZIhvcNAQELBQAwNzEUMBIGA1UEChMLZXhh
 bXBsZS5jb20xHzAdBgNVBAMTFmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwHhcNMTIx
-MTAxMTIzNDAyWhcNMzcxMjAxMTIzNDAyWjAfMR0wGwYDVQQDExRyZXZva2VkMi5l
-eGFtcGxlLmNvbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAv457HTnG6tQp
-fQeayAQ6Coz7JiuYkLEqRanlL2R6qdvWENPIkr3LAeXjZBb3la0lEgg1ouwL4RL4
-yYEHMnwt99jXethIG+JZS6SYVTaopm9gOWk1HpacaMFTMZgwv52R1cgCUm/Uth50
-1Be7C8lWgPSR03KfkdmBxYLuSUyPfg8CAwEAAaOBwDCBvTAOBgNVHQ8BAf8EBAMC
+MTAxMTIzNDA1WhcNMzcxMjAxMTIzNDA1WjAfMR0wGwYDVQQDExRyZXZva2VkMi5l
+eGFtcGxlLmNvbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAwWnQq5CGPVEE
+nyli+ZdX0j40iMHy1f74fR3hvZS2mzoVPfJK5/QGK6yQ653Oaos1Vxtm8m/RbIQh
+GN+ozzFTbFvVrFjGzDFrwq8DJiPDYeq2IobRJJ5yn7Uux6v6A0mBpqfrVVYjQlPH
+GBD5TPCN0mNkfI1NZlm3mWVoy2lxU7UCAwEAAaOBwDCBvTAOBgNVHQ8BAf8EBAMC
 BPAwIAYDVR0lAQH/BBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMDIGA1UdHwQrMCkw
 J6AloCOGIWh0dHA6Ly9jcmwuZXhhbXBsZS5jb20vbGF0ZXN0LmNybDA0BggrBgEF
 BQcBAQQoMCYwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vc2NwLmV4YW1wbGUuY29tLzAf
 BgNVHREEGDAWghRyZXZva2VkMi5leGFtcGxlLmNvbTANBgkqhkiG9w0BAQsFAAOB
-gQCEiOCabF5VLQs0vTdIV0JVYNZKYFDpOI8sLar23Xxhf0RN9fBTiAQnXPCw7ZHy
-Tcy8Sc63lYuXqOQos9GM3ejsAtevrol2xZoYcnWvigZUHRX+p5kwN9E4mGkVLO14
-raobs9XhLSIlPDcEXW15cuHa66Mq5xWuAZ9wUMvwCyoFRQ==
+gQCqNJnznvo85tNaulsd7UtAriF/WafbhQp0i41bnD4gMxQ6mHHVgEmeIDqY3jjg
+B7GG3O7sqp7JeQa+yRrD4OxEVIxBQLFIsfwwxxaklGom9wh6MjHzgyW3K7EAYi/V
+CSgzHvGoQ2g+VmeyXdFLmriszi5M0fMizgbeA96h2KoJlg==
 -----END CERTIFICATE-----
 -----BEGIN CERTIFICATE-----
-MIICNDCCAZ2gAwIBAgIBAjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+MIICGDCCAYGgAwIBAgIBQjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
 cGxlLmNvbTEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwMVoX
 DTM4MDEwMTEyMzQwMVowNzEUMBIGA1UEChMLZXhhbXBsZS5jb20xHzAdBgNVBAMT
 FmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
-AoGBANlcwo5q84SEtVy5W/xqbYAzOiYUZ0Shp9+ry/Q/X5uhrDF9JSHNWJbXut+8
-ZJGICt0RYVIJCcaa7FUt5hTKEx4fgURr+Hz84ZgwesMxcECHJPq9ylrCqbPkbmFR
-1XUy2MvioMH2lyc/PbV62XXggJhHioStVLRfyVlkS1KvvR+HAgMBAAGjWjBYMA4G
-A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMDIGA1UdHwQrMCkwJ6Al
-oCOGIWh0dHA6Ly9jcmwuZXhhbXBsZS5jb20vbGF0ZXN0LmNybDANBgkqhkiG9w0B
-AQsFAAOBgQBtPJwqu7DiDmFZd58L4xQ6JJhrJzJUDHmT7ikW2tOM58yisCgSnzrR
-xihW+49vUQ9lSGxBHaFwdehAuGTXydnf7/i9i6KA2RZ+Rq12FJFYOhjaIP7Sy1zq
-VXtb+P1eDBQQhz0WgysLVjgGdBiokRv86yY56ficoTQ6EyWzQLCU+A==
+AoGBALFHTtwaKeCfLlDf/wTErhOB6AB9vKHtyDbU6yDB/DrA5DLbug8m1oGGwEIf
+lTY0VBym8/Iu/ExE476gRmPNX/kIQsSNj9LtCIx3JXqLpc8ylw4cuVMOeFtBXNtE
+YKvUPIyWaAvqBbwY1QOyHNeoJ68hBdDPCn3oN2wrCz4if9QHAgMBAAGjPjA8MA4G
+A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMBYGA1UdDgQPBA1BQWJ0
+d0N4Y1hnYjBRMA0GCSqGSIb3DQEBCwUAA4GBAERD495HPM1BxM60EHGYLQgPjJPT
+/cL+nTKyIdv2UvzAnJaSFMMAB43Twy/jvkahsITVuieSU4kpev79KRNLfk+h25pf
+oPjaOfmOQVtHWN9ML8FDs0dLkRhJPuagObx17l/KEPkiK/jLB339fyO1HxaKhymE
+hdqYsdjjnBy/6U5g
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.key b/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.key
index 348d76186..327c4a312 100644
--- a/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.key
+++ b/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.key
@@ -1,21 +1,22 @@
 Bag Attributes
     friendlyName: revoked2.example.com
-    localKeyID: 7E 85 5C 51 34 1E 3A D0 E3 21 36 59 EF 77 71 6C C2 DC D5 42 
+    localKeyID: 74 A8 5D 76 70 26 D5 BF 09 D2 76 28 56 4A 09 63 C1 3E 74 38 
 Key Attributes: <No Attributes>
 -----BEGIN ENCRYPTED PRIVATE KEY-----
-MIICxjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQIxsl/hF+kYl4CAggA
-MBQGCCqGSIb3DQMHBAiCbdpohZr9+ASCAoCzG+J1yg/PB+jphh1qXT84lTBK4G1m
-v46KcDdsWM12ZdTTZZVLFpgoux1diGwOJ0DEwbXudXVjc6pXfmJphgOvhfF2RWcl
-kN8VDPslm5AHDNyMzxK9gMkjsTItyBkpAn3KZeGrllnitJGrXb5oyUG5wC/8QrH2
-vfip7bZr0QpwdmHCy5dGrKFbhq1M5wHu3jtXeUlvvOoWCHJbg2BZx9VD/Xc6ytE6
-eJPe4J2seeYMzNI8t6MwSPvnwIzC8rEcO5nteWBJdWetucC4w3OWWU4/2iIV9SvP
-/YBT9wHpstWVYTxLYnIE/59vXUGZEJXsgHvLGaYH2VFziDuCk+N4oGko9FrTMYHV
-2LmdfamGLKq3qtfTbqemJ4XEehBghGiMDxHca8CqBX4EF0QI32AxZarhCGaUBGuF
-NWWD4Qyv2Q8J+C6amCCl1ht9sfIvjH9a+hOH/h7Cy2gvEHPNiwN8ppbfdIxxvdDO
-gF+8gA3RtcOMnEMHUi2mRgiT5cVG2+0D17X6rBwYvOBIjZQZB0CKBuNWzdcbWNeG
-jmwuMbEAnSN85pcxIf559VQ8151CxpZ4E166eEOXe3dQ0A2GGwS+Up7BgdYyFpub
-U7FRHwJTuGCZ1ecFAekPnDYGMloOg/adXmuDLpuFdYAy0rftfzY1NljEYx/77HsR
-mmZD7Hs0NqJNRaaC2WWfzc9SNG4ru9msOWCP8kKAEvVQDa9keel8qbkK/d/RDLvI
-b4chuUejqeZ0oOfw7FK24VIrmXRJnuDGfb/J7ryIJctDhSe1e4RIHoTnqUTWg09B
-c4nuMBSB85ghoP2aXX9aab/V19yhQ0UnCU3RqUJlfvpWGmhJYoMSwc0I
+MIIC1DBOBgkqhkiG9w0BBQ0wQTApBgkqhkiG9w0BBQwwHAQI1zwihuvGBhsCAggA
+MAwGCCqGSIb3DQIJBQAwFAYIKoZIhvcNAwcECK1nd9++uvUtBIICgBlpfub4yRmW
+udFwK3GM6yk42ovS/NcBCzZGk/Gwv3z/dgzCwhsBhQ7AByHxi0u2XhCJMdWGS48f
+wwlmAWjpy2okDR92QDALMoUj6ud1HvZiqlDXdx61hbWaCiICw3QlzTo/A0d6hRMR
+BPxJ1P8Ky4Pb+GCoQRI1RzAP93AK2bkT9m8PLUxKnQpUdnP8o5ni5cO5l2t+FYsv
+7+cRn1PKGq08F3oO1bcrPf9Mm/6V+Tyl6vaIB36NlqZBq+zG05tRWFIl4KZl5vcj
+z2X0GUIiql6ZWL+2Q/qzsYxQLkIwD8w/hX2hhKteP/hlcSsGXL+utw0WR2OFFHOg
+RdFeiPTEaaCTsLURV2UOfBaHEkns60fxs7wgqbfPDB4CGTyeb/ZV8C3L4f98Disb
+vs9cH/cPTsj71RU2TOZEtGPjWyjnwv1fxkCDRmaNATioxrkbx9LZRvNXosOdwCvy
+WUU6sWzfYYWP+YYaLDwbQH8sPph2/3gsIBziCR1BognOuBr7RQsrNtMXcCaRNiYG
+HJAampXZh+DePYa5k8RZeCE6nCbQQXK9CkJgqCPxqcuATiPT2wmq+feOikizTEwr
+lD8aGz2AwWYZChK/fdIfhGRY8a/Bnwyff5thox0lpXTuVIdIGFl8Gf47NpvbQbY3
+mINJgCczw8IWf29ZtRGpBg78BM0SAIG7yluRm1HJBSzD02WE/fisp1DcvAj9Ywxp
+EDYH6DAJt3vnum96BDY1szk3DPd86EiWDkeOsoK0+bLaBKdFoqbYe98rWK+4s0xV
+3o8r+SfD/4zv/08OifNk57KPkBS3VTvqcwjNY68b413TLJoS9CeRNTMJdf2g6rYe
+WvNaQf3EW/w=
 -----END ENCRYPTED PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.dated.resp b/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.dated.resp
index 862739b47..c97771ac9 100644
--- a/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.dated.resp
+++ b/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.dated.resp
diff --git a/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.good.resp b/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.good.resp
index db6f0e980..8fdbb9c89 100644
--- a/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.good.resp
+++ b/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.good.resp
diff --git a/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.req b/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.req
index 2072ac479..56dcf0dba 100644
--- a/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.req
+++ b/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.req
diff --git a/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.revoked.resp b/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.revoked.resp
index db6f0e980..8fdbb9c89 100644
--- a/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.revoked.resp
+++ b/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.revoked.resp
diff --git a/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.signer.dated.resp b/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.signer.dated.resp
index 77c7a2f78..11049662b 100644
--- a/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.signer.dated.resp
+++ b/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.signer.dated.resp
diff --git a/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.signer.good.resp b/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.signer.good.resp
index cb0de9731..294e1f759 100644
--- a/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.signer.good.resp
+++ b/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.signer.good.resp
diff --git a/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.signer.revoked.resp b/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.signer.revoked.resp
index cb0de9731..294e1f759 100644
--- a/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.signer.revoked.resp
+++ b/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.signer.revoked.resp
diff --git a/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.signernocert.dated.resp b/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.signernocert.dated.resp
index eced7fefd..7f08f2c52 100644
--- a/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.signernocert.dated.resp
+++ b/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.signernocert.dated.resp
diff --git a/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.signernocert.good.resp b/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.signernocert.good.resp
index 843eb9130..07c290099 100644
--- a/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.signernocert.good.resp
+++ b/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.signernocert.good.resp
diff --git a/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.signernocert.revoked.resp b/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.signernocert.revoked.resp
index 843eb9130..07c290099 100644
--- a/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.signernocert.revoked.resp
+++ b/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.signernocert.revoked.resp
diff --git a/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.p12 b/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.p12
index 2d32de43e..702852cd1 100644
--- a/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.p12
+++ b/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.p12
diff --git a/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.pem b/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.pem
index 05cb86845..8bcc0dbf0 100644
--- a/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.pem
+++ b/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.pem
@@ -1,21 +1,21 @@
 Bag Attributes
     friendlyName: revoked2.example.com
-    localKeyID: 7E 85 5C 51 34 1E 3A D0 E3 21 36 59 EF 77 71 6C C2 DC D5 42 
+    localKeyID: 74 A8 5D 76 70 26 D5 BF 09 D2 76 28 56 4A 09 63 C1 3E 74 38 
 subject=/CN=revoked2.example.com
 issuer=/O=example.com/CN=clica Signing Cert rsa
 -----BEGIN CERTIFICATE-----
 MIICjjCCAfegAwIBAgICAMowDQYJKoZIhvcNAQELBQAwNzEUMBIGA1UEChMLZXhh
 bXBsZS5jb20xHzAdBgNVBAMTFmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwHhcNMTIx
-MTAxMTIzNDAyWhcNMzcxMjAxMTIzNDAyWjAfMR0wGwYDVQQDExRyZXZva2VkMi5l
-eGFtcGxlLmNvbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAv457HTnG6tQp
-fQeayAQ6Coz7JiuYkLEqRanlL2R6qdvWENPIkr3LAeXjZBb3la0lEgg1ouwL4RL4
-yYEHMnwt99jXethIG+JZS6SYVTaopm9gOWk1HpacaMFTMZgwv52R1cgCUm/Uth50
-1Be7C8lWgPSR03KfkdmBxYLuSUyPfg8CAwEAAaOBwDCBvTAOBgNVHQ8BAf8EBAMC
+MTAxMTIzNDA1WhcNMzcxMjAxMTIzNDA1WjAfMR0wGwYDVQQDExRyZXZva2VkMi5l
+eGFtcGxlLmNvbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAwWnQq5CGPVEE
+nyli+ZdX0j40iMHy1f74fR3hvZS2mzoVPfJK5/QGK6yQ653Oaos1Vxtm8m/RbIQh
+GN+ozzFTbFvVrFjGzDFrwq8DJiPDYeq2IobRJJ5yn7Uux6v6A0mBpqfrVVYjQlPH
+GBD5TPCN0mNkfI1NZlm3mWVoy2lxU7UCAwEAAaOBwDCBvTAOBgNVHQ8BAf8EBAMC
 BPAwIAYDVR0lAQH/BBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMDIGA1UdHwQrMCkw
 J6AloCOGIWh0dHA6Ly9jcmwuZXhhbXBsZS5jb20vbGF0ZXN0LmNybDA0BggrBgEF
 BQcBAQQoMCYwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vc2NwLmV4YW1wbGUuY29tLzAf
 BgNVHREEGDAWghRyZXZva2VkMi5leGFtcGxlLmNvbTANBgkqhkiG9w0BAQsFAAOB
-gQCEiOCabF5VLQs0vTdIV0JVYNZKYFDpOI8sLar23Xxhf0RN9fBTiAQnXPCw7ZHy
-Tcy8Sc63lYuXqOQos9GM3ejsAtevrol2xZoYcnWvigZUHRX+p5kwN9E4mGkVLO14
-raobs9XhLSIlPDcEXW15cuHa66Mq5xWuAZ9wUMvwCyoFRQ==
+gQCqNJnznvo85tNaulsd7UtAriF/WafbhQp0i41bnD4gMxQ6mHHVgEmeIDqY3jjg
+B7GG3O7sqp7JeQa+yRrD4OxEVIxBQLFIsfwwxxaklGom9wh6MjHzgyW3K7EAYi/V
+CSgzHvGoQ2g+VmeyXdFLmriszi5M0fMizgbeA96h2KoJlg==
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.unlocked.key b/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.unlocked.key
index 097ade916..6890906de 100644
--- a/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.unlocked.key
+++ b/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.unlocked.key
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXAIBAAKBgQC/jnsdOcbq1Cl9B5rIBDoKjPsmK5iQsSpFqeUvZHqp29YQ08iS
-vcsB5eNkFveVrSUSCDWi7AvhEvjJgQcyfC332Nd62Egb4llLpJhVNqimb2A5aTUe
-lpxowVMxmDC/nZHVyAJSb9S2HnTUF7sLyVaA9JHTcp+R2YHFgu5JTI9+DwIDAQAB
-AoGADyC5zlQQG97c1pfxfFcBHRuHK2Yz//FN4lSJhKr4bk5YjdmmicLdXm1WU5g7
-aKGqP3il1mkH2Hg+wkMjW179OOZKHihJc9p4Pq+A9fOUuCGjuC/2kP22XjpEOlfa
-p11855B529/gu3ZzLutmquryKwq6N7KjwLdi0FuanN0ZzekCQQDjZDWReujtC8eF
-0SFsAxe4QhEnG2vQ8WO1J7s6UceroE7z8HgrCYCgtK15wfJ0yM0CuTcB9KWRqemR
-PEoZMcFFAkEA16gbbZD2ryCla7WareBAGiHPPey9Szb7+yYS5OLymJ4p62Uc+StD
-pRcvo8fRnNi4od6O+hnVKI6NZNhGJMZVQwJABiCfKOps+GZG3B5EjkqPCxIMsEcW
-4qx+iVUmwG2Pudo6BmzGcDJzWuFDg3JsfCUlERu4lb7n70Lq3lUHkiI7GQJAdMYb
-a/3GBdhYmnUwt5wpOb06+d4aNgMk+L6KFpRpJojmTAdpY+awb1GZw0as0xBrEYNw
-yi54xMhD+eo+OSWH/wJBALWEww0MZgdci3eje6m27lB4tNNOpTfHRGsO3ZHinj3W
-fOHlOvsB//6IEOHkrglt48Tm1C7h05svpOQTav/toDQ=
+MIICXAIBAAKBgQDBadCrkIY9UQSfKWL5l1fSPjSIwfLV/vh9HeG9lLabOhU98krn
+9AYrrJDrnc5qizVXG2byb9FshCEY36jPMVNsW9WsWMbMMWvCrwMmI8Nh6rYihtEk
+nnKftS7Hq/oDSYGmp+tVViNCU8cYEPlM8I3SY2R8jU1mWbeZZWjLaXFTtQIDAQAB
+AoGALffQOHZo8TnIN2vGsjteDAHsynQOGv42YMYxWLV3kP0E/2wOkYJV1Rt2dglT
+fc8IJmPE2+nnhDsDAr5liJjYkoY1peWF3tliD9sj9NhwBGJLk09m2LTR2mH0MgbI
+fElXOQl4AwaDM5S0/s3hNb0SsH+C3Vr02Chd7UKnhixI1CECQQDyrCvWiZd7bXXr
+4dwrAXkK8An5mWua8GkR7LxkNhDAPqWPx7HiTo7oLm+PIlsJjjToV8hgTb5s+rGA
+DU5B1vpnAkEAzAkW3+ztuL1Tg495GjS/ayXbGXnbiKkDsNMBgGTVcrhhdgB1U2Ik
+wuR3jDoGT4WBkd9kqd9kH+qzjjxx6nqngwJAEPdkoT1BcAm5IuLJp+AUfGVH7UGC
+unRwhCZPDZqSFT7MCH9nunDPoQAOIK3AO6zLmir5AXKuC6SDYHaNsCC9pQJADiZf
+OL5UqigvH4OWsXORBtxEOpsR14NpJx0rEH1ttBwHXkif2l2HESEJDWeEwoUOvFAS
+yhkc932uYCHfAJTrAwJBAMAjR1npUbf2REnClP6VYJ6qhtfw2xgPdWiQfvVtyt+J
+r8tjpScHlghDvLFKzCFov4+QZGIaZGX0dR087hWhqAI=
 -----END RSA PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.com/server1.example.com/ca_chain.pem b/test/aux-fixed/exim-ca/example.com/server1.example.com/ca_chain.pem
index cde036853..c6accd35b 100644
--- a/test/aux-fixed/exim-ca/example.com/server1.example.com/ca_chain.pem
+++ b/test/aux-fixed/exim-ca/example.com/server1.example.com/ca_chain.pem
@@ -3,33 +3,33 @@ Bag Attributes
 subject=/O=example.com/CN=clica Signing Cert rsa
 issuer=/O=example.com/CN=clica CA rsa
 -----BEGIN CERTIFICATE-----
-MIICNDCCAZ2gAwIBAgIBAjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+MIICGDCCAYGgAwIBAgIBQjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
 cGxlLmNvbTEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwMVoX
 DTM4MDEwMTEyMzQwMVowNzEUMBIGA1UEChMLZXhhbXBsZS5jb20xHzAdBgNVBAMT
 FmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
-AoGBANlcwo5q84SEtVy5W/xqbYAzOiYUZ0Shp9+ry/Q/X5uhrDF9JSHNWJbXut+8
-ZJGICt0RYVIJCcaa7FUt5hTKEx4fgURr+Hz84ZgwesMxcECHJPq9ylrCqbPkbmFR
-1XUy2MvioMH2lyc/PbV62XXggJhHioStVLRfyVlkS1KvvR+HAgMBAAGjWjBYMA4G
-A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMDIGA1UdHwQrMCkwJ6Al
-oCOGIWh0dHA6Ly9jcmwuZXhhbXBsZS5jb20vbGF0ZXN0LmNybDANBgkqhkiG9w0B
-AQsFAAOBgQBtPJwqu7DiDmFZd58L4xQ6JJhrJzJUDHmT7ikW2tOM58yisCgSnzrR
-xihW+49vUQ9lSGxBHaFwdehAuGTXydnf7/i9i6KA2RZ+Rq12FJFYOhjaIP7Sy1zq
-VXtb+P1eDBQQhz0WgysLVjgGdBiokRv86yY56ficoTQ6EyWzQLCU+A==
+AoGBALFHTtwaKeCfLlDf/wTErhOB6AB9vKHtyDbU6yDB/DrA5DLbug8m1oGGwEIf
+lTY0VBym8/Iu/ExE476gRmPNX/kIQsSNj9LtCIx3JXqLpc8ylw4cuVMOeFtBXNtE
+YKvUPIyWaAvqBbwY1QOyHNeoJ68hBdDPCn3oN2wrCz4if9QHAgMBAAGjPjA8MA4G
+A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMBYGA1UdDgQPBA1BQWJ0
+d0N4Y1hnYjBRMA0GCSqGSIb3DQEBCwUAA4GBAERD495HPM1BxM60EHGYLQgPjJPT
+/cL+nTKyIdv2UvzAnJaSFMMAB43Twy/jvkahsITVuieSU4kpev79KRNLfk+h25pf
+oPjaOfmOQVtHWN9ML8FDs0dLkRhJPuagObx17l/KEPkiK/jLB339fyO1HxaKhymE
+hdqYsdjjnBy/6U5g
 -----END CERTIFICATE-----
 Bag Attributes
     friendlyName: Certificate Authority rsa
 subject=/O=example.com/CN=clica CA rsa
 issuer=/O=example.com/CN=clica CA rsa
 -----BEGIN CERTIFICATE-----
-MIIB9jCCAV+gAwIBAgIBATANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+MIIB9jCCAV+gAwIBAgIBQTANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
 cGxlLmNvbTEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwMVoX
 DTM4MDEwMTEyMzQwMVowLTEUMBIGA1UEChMLZXhhbXBsZS5jb20xFTATBgNVBAMT
-DGNsaWNhIENBIHJzYTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA2N3YjbHA
-BEKAiUHwJ0VMAAe/KMOM8slXOAKni4v7Vf6BzbO5B6uaKhDV2n3V0vXwMdAoeBaq
-3s9CHOjDXwjF1qf/p4w3Z2aUIVt/Mb+uEcPUlq0Nr8OLlH11QKbkvFtLxU3sUAoi
-fcaydi1q3tszjPQ0tKlLo6kOzcgi8d47WccCAwEAAaMmMCQwEgYDVR0TAQH/BAgw
-BgEB/wIBATAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADgYEAAzD/Zszo
-X4ieSQQxDOH53VkiAJDs32qso9YzGbQaenuRnVFCuo7rt68cjMcOjzf18/I+iMeH
-nEcdqkfoYB4Z3LXvDaRGZhg/ZOv58muzRnsW2oQI9yFqDwD0FZPtM6Vq0AWXjLuq
-IogOI5fShSo7H5hc3vrkvS7KUhzuv3FKnaQ=
+DGNsaWNhIENBIHJzYTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAyDGCW64u
+Q5CBaKQGpgZVwGjo+VAn2EpwbfCZkhJtnxESiZYigjBH8KaOcAGyuv6jqY3pP64u
+gPe3lRkqwnvnLkj4wYo7d1GpW12yRCN/n7oMUcHLceqeLc8iYy6k1szF+jdlcRPL
+2OXNEy2pgzsPRyWZyCS2xZE86byA4N+/Y5cCAwEAAaMmMCQwEgYDVR0TAQH/BAgw
+BgEB/wIBATAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADgYEAeQnAdtC4
+EWA5tl8hRlOmc7IM6c40MJRB73/Oiul8xcS4l2qRLXUAWJjddxMPrLf4AYmc0vQz
+rcWmvkfdnjqX235D5YaOvfsIKr+YThtbSUvSK/uCGCxmiQHLQIWa7oWnFExIAjFd
+xxxXmvnPPG86dFoAm4AGS6kynXmWc4tvKYI=
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.com/server1.example.com/cert8.db b/test/aux-fixed/exim-ca/example.com/server1.example.com/cert8.db
index 8a9e724da..9e9795309 100644
--- a/test/aux-fixed/exim-ca/example.com/server1.example.com/cert8.db
+++ b/test/aux-fixed/exim-ca/example.com/server1.example.com/cert8.db
diff --git a/test/aux-fixed/exim-ca/example.com/server1.example.com/fullchain.pem b/test/aux-fixed/exim-ca/example.com/server1.example.com/fullchain.pem
index 73a429b46..29d231359 100644
--- a/test/aux-fixed/exim-ca/example.com/server1.example.com/fullchain.pem
+++ b/test/aux-fixed/exim-ca/example.com/server1.example.com/fullchain.pem
@@ -1,58 +1,58 @@
 Bag Attributes
     friendlyName: server1.example.com
-    localKeyID: 68 38 70 91 66 B0 26 4D FC 76 CF 59 D5 A5 27 13 36 F5 B7 71 
+    localKeyID: 1A 46 FC DC B1 BE 7D 7F DA EA 76 75 69 D2 3A 50 3E 58 94 0F 
 subject=/CN=server1.example.com
 issuer=/O=example.com/CN=clica Signing Cert rsa
 -----BEGIN CERTIFICATE-----
 MIIC3zCCAkigAwIBAgIBZTANBgkqhkiG9w0BAQsFADA3MRQwEgYDVQQKEwtleGFt
 cGxlLmNvbTEfMB0GA1UEAxMWY2xpY2EgU2lnbmluZyBDZXJ0IHJzYTAeFw0xMjEx
-MDExMjM0MDFaFw0zNzEyMDExMjM0MDFaMB4xHDAaBgNVBAMTE3NlcnZlcjEuZXhh
-bXBsZS5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBALlFAifASi7qE45T
-XoRxVVlxMIINSa5ZYyGBSoLbQKLv1RsPGvxrKrJqJz8ofI136t91H5nWhHF8Bf5s
-V+1sAdfj3jhz0Qz/HJDGXTmU/3562nyyFyTXqhV2n/NJLCwfHOs7vWk7rR3R2R/p
-lTjXvUKU91aSRy0luEDhvxq/PosZAgMBAAGjggESMIIBDjAOBgNVHQ8BAf8EBAMC
+MDExMjM0MDJaFw0zNzEyMDExMjM0MDJaMB4xHDAaBgNVBAMTE3NlcnZlcjEuZXhh
+bXBsZS5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAM8u6xFkINzVzn/a
+tZNmSSSPeC3DbFmcPKYy62lqRQf0rDP/SbiNe4yYmoHynTguN5+/A3pie0+bdwVS
+8NyTH4cUCO/8RBIMfIaI+xusFXPtTrTNf8OtravljL7rF0kUbG4vLTARgpSxtpnR
+fLX51qVWRF7sR7NsNmp13z511UgRAgMBAAGjggESMIIBDjAOBgNVHQ8BAf8EBAMC
 BPAwIAYDVR0lAQH/BBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMDIGA1UdHwQrMCkw
 J6AloCOGIWh0dHA6Ly9jcmwuZXhhbXBsZS5jb20vbGF0ZXN0LmNybDA0BggrBgEF
 BQcBAQQoMCYwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vc2NwLmV4YW1wbGUuY29tLzBw
-BgNVHREEaTBngiJhbHRlcm5hdGVuYW1lMi5zZXJ2ZXIxLmV4YW1wbGUuY29tghNz
-ZXJ2ZXIxLmV4YW1wbGUuY29tgiFhbHRlcm5hdGVuYW1lLnNlcnZlcjEuZXhhbXBs
-ZS5jb22CCSoudGVzdC5leDANBgkqhkiG9w0BAQsFAAOBgQB6zTAn0nyd/scSF7rq
-9DiRwk5akqjirevjFh0RDKyiPtB0E3Eu3E3CNax+bqqsnVl8qJzFGfQFlqaj4wzg
-DEsFzjpQMqB+skObhcYaZNLB++T350AGUdvoUN4ToOzG77h1XNu9jlILwWZNReBx
-sth3GIF5TCnewLmrm6oUHmrdnw==
+BgNVHREEaTBnggkqLnRlc3QuZXiCE3NlcnZlcjEuZXhhbXBsZS5jb22CIWFsdGVy
+bmF0ZW5hbWUuc2VydmVyMS5leGFtcGxlLmNvbYIiYWx0ZXJuYXRlbmFtZTIuc2Vy
+dmVyMS5leGFtcGxlLmNvbTANBgkqhkiG9w0BAQsFAAOBgQBKp0xZ4RomCgCdCDhw
+Inmj1+koPd+rLefivbNk9xuGV9huAV9+m8ovNNlAYqy204rTXa6Lhusdb0v4WWOp
+UToJMT8jGNhJReP/z6w3r6EFID0MlQoDNaMN36WioGrk4/FBMtJ81rd+kvxh98Lw
+ttQaEZsB3WehiI2pRFSRscQP1A==
 -----END CERTIFICATE-----
 Bag Attributes
     friendlyName: Signing Cert rsa
 subject=/O=example.com/CN=clica Signing Cert rsa
 issuer=/O=example.com/CN=clica CA rsa
 -----BEGIN CERTIFICATE-----
-MIICNDCCAZ2gAwIBAgIBAjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+MIICGDCCAYGgAwIBAgIBQjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
 cGxlLmNvbTEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwMVoX
 DTM4MDEwMTEyMzQwMVowNzEUMBIGA1UEChMLZXhhbXBsZS5jb20xHzAdBgNVBAMT
 FmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
-AoGBANlcwo5q84SEtVy5W/xqbYAzOiYUZ0Shp9+ry/Q/X5uhrDF9JSHNWJbXut+8
-ZJGICt0RYVIJCcaa7FUt5hTKEx4fgURr+Hz84ZgwesMxcECHJPq9ylrCqbPkbmFR
-1XUy2MvioMH2lyc/PbV62XXggJhHioStVLRfyVlkS1KvvR+HAgMBAAGjWjBYMA4G
-A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMDIGA1UdHwQrMCkwJ6Al
-oCOGIWh0dHA6Ly9jcmwuZXhhbXBsZS5jb20vbGF0ZXN0LmNybDANBgkqhkiG9w0B
-AQsFAAOBgQBtPJwqu7DiDmFZd58L4xQ6JJhrJzJUDHmT7ikW2tOM58yisCgSnzrR
-xihW+49vUQ9lSGxBHaFwdehAuGTXydnf7/i9i6KA2RZ+Rq12FJFYOhjaIP7Sy1zq
-VXtb+P1eDBQQhz0WgysLVjgGdBiokRv86yY56ficoTQ6EyWzQLCU+A==
+AoGBALFHTtwaKeCfLlDf/wTErhOB6AB9vKHtyDbU6yDB/DrA5DLbug8m1oGGwEIf
+lTY0VBym8/Iu/ExE476gRmPNX/kIQsSNj9LtCIx3JXqLpc8ylw4cuVMOeFtBXNtE
+YKvUPIyWaAvqBbwY1QOyHNeoJ68hBdDPCn3oN2wrCz4if9QHAgMBAAGjPjA8MA4G
+A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMBYGA1UdDgQPBA1BQWJ0
+d0N4Y1hnYjBRMA0GCSqGSIb3DQEBCwUAA4GBAERD495HPM1BxM60EHGYLQgPjJPT
+/cL+nTKyIdv2UvzAnJaSFMMAB43Twy/jvkahsITVuieSU4kpev79KRNLfk+h25pf
+oPjaOfmOQVtHWN9ML8FDs0dLkRhJPuagObx17l/KEPkiK/jLB339fyO1HxaKhymE
+hdqYsdjjnBy/6U5g
 -----END CERTIFICATE-----
 Bag Attributes
     friendlyName: Certificate Authority rsa
 subject=/O=example.com/CN=clica CA rsa
 issuer=/O=example.com/CN=clica CA rsa
 -----BEGIN CERTIFICATE-----
-MIIB9jCCAV+gAwIBAgIBATANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+MIIB9jCCAV+gAwIBAgIBQTANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
 cGxlLmNvbTEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwMVoX
 DTM4MDEwMTEyMzQwMVowLTEUMBIGA1UEChMLZXhhbXBsZS5jb20xFTATBgNVBAMT
-DGNsaWNhIENBIHJzYTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA2N3YjbHA
-BEKAiUHwJ0VMAAe/KMOM8slXOAKni4v7Vf6BzbO5B6uaKhDV2n3V0vXwMdAoeBaq
-3s9CHOjDXwjF1qf/p4w3Z2aUIVt/Mb+uEcPUlq0Nr8OLlH11QKbkvFtLxU3sUAoi
-fcaydi1q3tszjPQ0tKlLo6kOzcgi8d47WccCAwEAAaMmMCQwEgYDVR0TAQH/BAgw
-BgEB/wIBATAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADgYEAAzD/Zszo
-X4ieSQQxDOH53VkiAJDs32qso9YzGbQaenuRnVFCuo7rt68cjMcOjzf18/I+iMeH
-nEcdqkfoYB4Z3LXvDaRGZhg/ZOv58muzRnsW2oQI9yFqDwD0FZPtM6Vq0AWXjLuq
-IogOI5fShSo7H5hc3vrkvS7KUhzuv3FKnaQ=
+DGNsaWNhIENBIHJzYTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAyDGCW64u
+Q5CBaKQGpgZVwGjo+VAn2EpwbfCZkhJtnxESiZYigjBH8KaOcAGyuv6jqY3pP64u
+gPe3lRkqwnvnLkj4wYo7d1GpW12yRCN/n7oMUcHLceqeLc8iYy6k1szF+jdlcRPL
+2OXNEy2pgzsPRyWZyCS2xZE86byA4N+/Y5cCAwEAAaMmMCQwEgYDVR0TAQH/BAgw
+BgEB/wIBATAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADgYEAeQnAdtC4
+EWA5tl8hRlOmc7IM6c40MJRB73/Oiul8xcS4l2qRLXUAWJjddxMPrLf4AYmc0vQz
+rcWmvkfdnjqX235D5YaOvfsIKr+YThtbSUvSK/uCGCxmiQHLQIWa7oWnFExIAjFd
+xxxXmvnPPG86dFoAm4AGS6kynXmWc4tvKYI=
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.com/server1.example.com/key3.db b/test/aux-fixed/exim-ca/example.com/server1.example.com/key3.db
index e2e3ace41..a61212af7 100644
--- a/test/aux-fixed/exim-ca/example.com/server1.example.com/key3.db
+++ b/test/aux-fixed/exim-ca/example.com/server1.example.com/key3.db
diff --git a/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.chain.pem b/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.chain.pem
index 24f29d1a7..ceea00514 100644
--- a/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.chain.pem
+++ b/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.chain.pem
@@ -1,37 +1,37 @@
 Bag Attributes
     friendlyName: server1.example.com
-    localKeyID: 68 38 70 91 66 B0 26 4D FC 76 CF 59 D5 A5 27 13 36 F5 B7 71 
+    localKeyID: 1A 46 FC DC B1 BE 7D 7F DA EA 76 75 69 D2 3A 50 3E 58 94 0F 
 subject=/CN=server1.example.com
 issuer=/O=example.com/CN=clica Signing Cert rsa
 -----BEGIN CERTIFICATE-----
 MIIC3zCCAkigAwIBAgIBZTANBgkqhkiG9w0BAQsFADA3MRQwEgYDVQQKEwtleGFt
 cGxlLmNvbTEfMB0GA1UEAxMWY2xpY2EgU2lnbmluZyBDZXJ0IHJzYTAeFw0xMjEx
-MDExMjM0MDFaFw0zNzEyMDExMjM0MDFaMB4xHDAaBgNVBAMTE3NlcnZlcjEuZXhh
-bXBsZS5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBALlFAifASi7qE45T
-XoRxVVlxMIINSa5ZYyGBSoLbQKLv1RsPGvxrKrJqJz8ofI136t91H5nWhHF8Bf5s
-V+1sAdfj3jhz0Qz/HJDGXTmU/3562nyyFyTXqhV2n/NJLCwfHOs7vWk7rR3R2R/p
-lTjXvUKU91aSRy0luEDhvxq/PosZAgMBAAGjggESMIIBDjAOBgNVHQ8BAf8EBAMC
+MDExMjM0MDJaFw0zNzEyMDExMjM0MDJaMB4xHDAaBgNVBAMTE3NlcnZlcjEuZXhh
+bXBsZS5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAM8u6xFkINzVzn/a
+tZNmSSSPeC3DbFmcPKYy62lqRQf0rDP/SbiNe4yYmoHynTguN5+/A3pie0+bdwVS
+8NyTH4cUCO/8RBIMfIaI+xusFXPtTrTNf8OtravljL7rF0kUbG4vLTARgpSxtpnR
+fLX51qVWRF7sR7NsNmp13z511UgRAgMBAAGjggESMIIBDjAOBgNVHQ8BAf8EBAMC
 BPAwIAYDVR0lAQH/BBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMDIGA1UdHwQrMCkw
 J6AloCOGIWh0dHA6Ly9jcmwuZXhhbXBsZS5jb20vbGF0ZXN0LmNybDA0BggrBgEF
 BQcBAQQoMCYwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vc2NwLmV4YW1wbGUuY29tLzBw
-BgNVHREEaTBngiJhbHRlcm5hdGVuYW1lMi5zZXJ2ZXIxLmV4YW1wbGUuY29tghNz
-ZXJ2ZXIxLmV4YW1wbGUuY29tgiFhbHRlcm5hdGVuYW1lLnNlcnZlcjEuZXhhbXBs
-ZS5jb22CCSoudGVzdC5leDANBgkqhkiG9w0BAQsFAAOBgQB6zTAn0nyd/scSF7rq
-9DiRwk5akqjirevjFh0RDKyiPtB0E3Eu3E3CNax+bqqsnVl8qJzFGfQFlqaj4wzg
-DEsFzjpQMqB+skObhcYaZNLB++T350AGUdvoUN4ToOzG77h1XNu9jlILwWZNReBx
-sth3GIF5TCnewLmrm6oUHmrdnw==
+BgNVHREEaTBnggkqLnRlc3QuZXiCE3NlcnZlcjEuZXhhbXBsZS5jb22CIWFsdGVy
+bmF0ZW5hbWUuc2VydmVyMS5leGFtcGxlLmNvbYIiYWx0ZXJuYXRlbmFtZTIuc2Vy
+dmVyMS5leGFtcGxlLmNvbTANBgkqhkiG9w0BAQsFAAOBgQBKp0xZ4RomCgCdCDhw
+Inmj1+koPd+rLefivbNk9xuGV9huAV9+m8ovNNlAYqy204rTXa6Lhusdb0v4WWOp
+UToJMT8jGNhJReP/z6w3r6EFID0MlQoDNaMN36WioGrk4/FBMtJ81rd+kvxh98Lw
+ttQaEZsB3WehiI2pRFSRscQP1A==
 -----END CERTIFICATE-----
 -----BEGIN CERTIFICATE-----
-MIICNDCCAZ2gAwIBAgIBAjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+MIICGDCCAYGgAwIBAgIBQjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
 cGxlLmNvbTEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwMVoX
 DTM4MDEwMTEyMzQwMVowNzEUMBIGA1UEChMLZXhhbXBsZS5jb20xHzAdBgNVBAMT
 FmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
-AoGBANlcwo5q84SEtVy5W/xqbYAzOiYUZ0Shp9+ry/Q/X5uhrDF9JSHNWJbXut+8
-ZJGICt0RYVIJCcaa7FUt5hTKEx4fgURr+Hz84ZgwesMxcECHJPq9ylrCqbPkbmFR
-1XUy2MvioMH2lyc/PbV62XXggJhHioStVLRfyVlkS1KvvR+HAgMBAAGjWjBYMA4G
-A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMDIGA1UdHwQrMCkwJ6Al
-oCOGIWh0dHA6Ly9jcmwuZXhhbXBsZS5jb20vbGF0ZXN0LmNybDANBgkqhkiG9w0B
-AQsFAAOBgQBtPJwqu7DiDmFZd58L4xQ6JJhrJzJUDHmT7ikW2tOM58yisCgSnzrR
-xihW+49vUQ9lSGxBHaFwdehAuGTXydnf7/i9i6KA2RZ+Rq12FJFYOhjaIP7Sy1zq
-VXtb+P1eDBQQhz0WgysLVjgGdBiokRv86yY56ficoTQ6EyWzQLCU+A==
+AoGBALFHTtwaKeCfLlDf/wTErhOB6AB9vKHtyDbU6yDB/DrA5DLbug8m1oGGwEIf
+lTY0VBym8/Iu/ExE476gRmPNX/kIQsSNj9LtCIx3JXqLpc8ylw4cuVMOeFtBXNtE
+YKvUPIyWaAvqBbwY1QOyHNeoJ68hBdDPCn3oN2wrCz4if9QHAgMBAAGjPjA8MA4G
+A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMBYGA1UdDgQPBA1BQWJ0
+d0N4Y1hnYjBRMA0GCSqGSIb3DQEBCwUAA4GBAERD495HPM1BxM60EHGYLQgPjJPT
+/cL+nTKyIdv2UvzAnJaSFMMAB43Twy/jvkahsITVuieSU4kpev79KRNLfk+h25pf
+oPjaOfmOQVtHWN9ML8FDs0dLkRhJPuagObx17l/KEPkiK/jLB339fyO1HxaKhymE
+hdqYsdjjnBy/6U5g
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.key b/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.key
index 92aaeef74..4b892580b 100644
--- a/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.key
+++ b/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.key
@@ -1,21 +1,22 @@
 Bag Attributes
     friendlyName: server1.example.com
-    localKeyID: 68 38 70 91 66 B0 26 4D FC 76 CF 59 D5 A5 27 13 36 F5 B7 71 
+    localKeyID: 1A 46 FC DC B1 BE 7D 7F DA EA 76 75 69 D2 3A 50 3E 58 94 0F 
 Key Attributes: <No Attributes>
 -----BEGIN ENCRYPTED PRIVATE KEY-----
-MIICxjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQIHHll4kyNluoCAggA
-MBQGCCqGSIb3DQMHBAiqfjrDuLu0ngSCAoASeOAmvBbKOFWqco4j31ohBkskyIo1
-lHZiUJzeVc+6FVyrLgikBELx2/P4+xpVQD1eyEBSIE42aT9M1kZ18mxWwNIOIrzx
-40lP+AY5Pc1ATUdLSe9Zx1LR9tgMJFBDBvUYuH0dzkYzXdYntfk549dlyAaISSN2
-JEHcva3+DfMt39YHGjDCk59QMHbKJv0hBjhtZJ3Wy/Djys6pDnfPa7rXm+mE/xgP
-1T02A6g3b29BgHykpxwL1gqrrOVoWfDkRDUbQeDNha+B1hGvoioUg88ncTC414pq
-w5UkHUEPsU0rRWnEL6OOcGojNc5vFXNypD5lAsX9DBTyZ0IagJmpJwAb6eXkZm01
-yu3ZHFOakHeaumBbjGXpCyvyfYmMQ6ZEWhySZe6sdZANN11tDk276+i/qqCRSKnr
-XXFyNQn+8trT7v5Jwy9CXpFUviPgRd7xAjLrvItMWpzK+0heMJimsDORXNnHlkOs
-vPJQa+nIzQ2isr7ZF1noarbOcjNYJvkPK3yuoG/oZQXtFWz84/QxGLnRmryP2aTj
-GLgU/xBEBkm1GjhlWzkNQE8t7XVm47MX9i+MzuuManUMTDA7hRqAAzKc4m1Lx801
-ju7yJl9TKcVXVyx/n0/SV4u7DM0y5UotuunEwn2WB8mTOvIwX3Wqyc8kw4m2wEDG
-GcsuH6jvN3ATJ1sWwpnExNEzJiY50idzgSI6Oamf8fCKiJRyjJ5/LX5w9QpdH4G8
-yrypanaU6S/Sn7zBVASY8UGtWtV9J8HJFuZgtWhdm3F6cnAeQszDZHD5FPxYfv/E
-R/dp+6VuUDlnGAwW0ukNGdaNYm7ym3ZtkGknN7tn81cDCAf7f7XpFodI
+MIIC1DBOBgkqhkiG9w0BBQ0wQTApBgkqhkiG9w0BBQwwHAQIHovK/g+qWjMCAggA
+MAwGCCqGSIb3DQIJBQAwFAYIKoZIhvcNAwcECP4xkWIBKyMBBIICgFMvujBX4+EH
+jtl12JEPSL3dUJk9mAhjmpQLW8Sgzvft288oUFUtcTS0C8dcYCT6OQlksB2bmi1d
+7W60zIwIR/sLC+C44CQU7jeRoPhRowMSt+jaqjzvbkdAPfS2zjCHpFov7vrmv76b
+IbufOVoS0d1Th9IDJBUyQEISbzA+hlF8otlnOHuvOr/X8SLlEOPukE06sC2ur7EN
+Y/zTAfRzYgPkesVctseUrYHTHeZJodR4HkVZKUsE0o63rtlpgUwb5Hhmu1Q6junc
+jhzliKIbKx5lUhdGfrkl340TE+fSMURpVSCEdoLSEJ3a51E58dUAtYUJ2W2R1e23
+s5p1F5PIW0ew51Ro5Cp7FC0h5BSr6wWNaFdNgoLntyqGPgGwjy+hgznfMnrtkqg3
+bHRjSHSHfLmUdQxNTu8+2ZJfUnoA2kQ/076Wp6hk5U9isYhdt5H2C+Wm4vNW7YjL
+N3L+qHzY+8j/MnFcqFHqDHbukcAsoJNuCVnTrQq8T11NbnZWyxH5Mf1GX3M/bPWq
+ocB8LLyHqNfvVLzxs8lBIL/E6A3Vi+sjVznqpb0dZK90aJpPODJ7G/Yi03u/JJea
+kTtqSsbgaBnU3OMlN85L8T5HX63oEzKyco3MtwwsblxOpC5+472nKHhszITpN2Tb
+PwukhYl8z2qkMqnWV8XDYvV3ZCLR0SCpsOkEQfBGZ/s1Qyd1bg1t13U942w0CGqw
+hK4tX30V/8V3AOWPe6tiXezm31uVDR7qSwnAS1rT66EJVrw5ebiAWhShw2Caj1EN
+ItUGRr0uAIsuQWXd98OlkfzLthnkHXahOCp+y/47cpM/tTkfcisJzZAf5z1FYhEv
+NK5HIqffIQE=
 -----END ENCRYPTED PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.dated.resp b/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.dated.resp
index fba3a5451..2a5c85ee8 100644
--- a/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.dated.resp
+++ b/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.dated.resp
diff --git a/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.good.resp b/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.good.resp
index 5d1bde4ae..cd4558291 100644
--- a/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.good.resp
+++ b/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.good.resp
diff --git a/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.req b/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.req
index 136f595ff..c5e8cd643 100644
--- a/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.req
+++ b/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.req
diff --git a/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.revoked.resp b/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.revoked.resp
index 68738ea96..de0e711b3 100644
--- a/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.revoked.resp
+++ b/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.revoked.resp
diff --git a/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.signer.dated.resp b/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.signer.dated.resp
index a3c75feae..1c103e71a 100644
--- a/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.signer.dated.resp
+++ b/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.signer.dated.resp
diff --git a/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.signer.good.resp b/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.signer.good.resp
index e2b192e16..2952c69b2 100644
--- a/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.signer.good.resp
+++ b/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.signer.good.resp
diff --git a/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.signer.revoked.resp b/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.signer.revoked.resp
index 8df84c747..030f38245 100644
--- a/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.signer.revoked.resp
+++ b/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.signer.revoked.resp
diff --git a/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.signernocert.dated.resp b/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.signernocert.dated.resp
index 3563a96a7..52435cc4f 100644
--- a/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.signernocert.dated.resp
+++ b/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.signernocert.dated.resp
diff --git a/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.signernocert.good.resp b/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.signernocert.good.resp
index e10a9e747..11b3d44ad 100644
--- a/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.signernocert.good.resp
+++ b/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.signernocert.good.resp
diff --git a/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.signernocert.revoked.resp b/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.signernocert.revoked.resp
index 3914b9bc8..5d3f0f97b 100644
--- a/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.signernocert.revoked.resp
+++ b/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.signernocert.revoked.resp
diff --git a/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.p12 b/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.p12
index c445f0d1f..d54e84908 100644
--- a/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.p12
+++ b/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.p12
diff --git a/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.pem b/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.pem
index 9ba919c3c..36f82a125 100644
--- a/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.pem
+++ b/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.pem
@@ -1,23 +1,23 @@
 Bag Attributes
     friendlyName: server1.example.com
-    localKeyID: 68 38 70 91 66 B0 26 4D FC 76 CF 59 D5 A5 27 13 36 F5 B7 71 
+    localKeyID: 1A 46 FC DC B1 BE 7D 7F DA EA 76 75 69 D2 3A 50 3E 58 94 0F 
 subject=/CN=server1.example.com
 issuer=/O=example.com/CN=clica Signing Cert rsa
 -----BEGIN CERTIFICATE-----
 MIIC3zCCAkigAwIBAgIBZTANBgkqhkiG9w0BAQsFADA3MRQwEgYDVQQKEwtleGFt
 cGxlLmNvbTEfMB0GA1UEAxMWY2xpY2EgU2lnbmluZyBDZXJ0IHJzYTAeFw0xMjEx
-MDExMjM0MDFaFw0zNzEyMDExMjM0MDFaMB4xHDAaBgNVBAMTE3NlcnZlcjEuZXhh
-bXBsZS5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBALlFAifASi7qE45T
-XoRxVVlxMIINSa5ZYyGBSoLbQKLv1RsPGvxrKrJqJz8ofI136t91H5nWhHF8Bf5s
-V+1sAdfj3jhz0Qz/HJDGXTmU/3562nyyFyTXqhV2n/NJLCwfHOs7vWk7rR3R2R/p
-lTjXvUKU91aSRy0luEDhvxq/PosZAgMBAAGjggESMIIBDjAOBgNVHQ8BAf8EBAMC
+MDExMjM0MDJaFw0zNzEyMDExMjM0MDJaMB4xHDAaBgNVBAMTE3NlcnZlcjEuZXhh
+bXBsZS5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAM8u6xFkINzVzn/a
+tZNmSSSPeC3DbFmcPKYy62lqRQf0rDP/SbiNe4yYmoHynTguN5+/A3pie0+bdwVS
+8NyTH4cUCO/8RBIMfIaI+xusFXPtTrTNf8OtravljL7rF0kUbG4vLTARgpSxtpnR
+fLX51qVWRF7sR7NsNmp13z511UgRAgMBAAGjggESMIIBDjAOBgNVHQ8BAf8EBAMC
 BPAwIAYDVR0lAQH/BBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMDIGA1UdHwQrMCkw
 J6AloCOGIWh0dHA6Ly9jcmwuZXhhbXBsZS5jb20vbGF0ZXN0LmNybDA0BggrBgEF
 BQcBAQQoMCYwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vc2NwLmV4YW1wbGUuY29tLzBw
-BgNVHREEaTBngiJhbHRlcm5hdGVuYW1lMi5zZXJ2ZXIxLmV4YW1wbGUuY29tghNz
-ZXJ2ZXIxLmV4YW1wbGUuY29tgiFhbHRlcm5hdGVuYW1lLnNlcnZlcjEuZXhhbXBs
-ZS5jb22CCSoudGVzdC5leDANBgkqhkiG9w0BAQsFAAOBgQB6zTAn0nyd/scSF7rq
-9DiRwk5akqjirevjFh0RDKyiPtB0E3Eu3E3CNax+bqqsnVl8qJzFGfQFlqaj4wzg
-DEsFzjpQMqB+skObhcYaZNLB++T350AGUdvoUN4ToOzG77h1XNu9jlILwWZNReBx
-sth3GIF5TCnewLmrm6oUHmrdnw==
+BgNVHREEaTBnggkqLnRlc3QuZXiCE3NlcnZlcjEuZXhhbXBsZS5jb22CIWFsdGVy
+bmF0ZW5hbWUuc2VydmVyMS5leGFtcGxlLmNvbYIiYWx0ZXJuYXRlbmFtZTIuc2Vy
+dmVyMS5leGFtcGxlLmNvbTANBgkqhkiG9w0BAQsFAAOBgQBKp0xZ4RomCgCdCDhw
+Inmj1+koPd+rLefivbNk9xuGV9huAV9+m8ovNNlAYqy204rTXa6Lhusdb0v4WWOp
+UToJMT8jGNhJReP/z6w3r6EFID0MlQoDNaMN36WioGrk4/FBMtJ81rd+kvxh98Lw
+ttQaEZsB3WehiI2pRFSRscQP1A==
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.unlocked.key b/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.unlocked.key
index 1aee1ff42..b21104ead 100644
--- a/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.unlocked.key
+++ b/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.unlocked.key
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXQIBAAKBgQC5RQInwEou6hOOU16EcVVZcTCCDUmuWWMhgUqC20Ci79UbDxr8
-ayqyaic/KHyNd+rfdR+Z1oRxfAX+bFftbAHX4944c9EM/xyQxl05lP9+etp8shck
-16oVdp/zSSwsHxzrO71pO60d0dkf6ZU4171ClPdWkkctJbhA4b8avz6LGQIDAQAB
-AoGADsP/C8+ppJCM9h293Ydcz9qTYky7JRVEWczAn/+SaLSoQtZS28WSFb3Gb/mt
-kjwkRiKYXf3jTgTI7iyQsMBCwIvM00VLAbQE3t3BjBhYNBztXHgCGOGD36kFCQJk
-nKLGC+TdEdhlqWpvVcdUzcHsY1n8o54IoBQaTnR6wJdcyyMCQQDkRoUO3ehedl8J
-h5dVn87qmKZAaKdCj+0zv1+fIEXn8DlBGzKxNkjdjZAEekuIcqqHODc8duFO2NlL
-fwE//nXDAkEAz8VcSyGTCO+STV5BSCP5c5P4ovoIRAXuWaJJ7bfwicrbtZfgpfOe
-U0Cppqayp75U2wsvP2MCaFbHmsQFbdUB8wJBAJ+qD4Ehh1ki9EBHHXufRmviD063
-pF2zK5bpQSmcuiiLZpB6RI+cx4RncpcfLtumUE457LCW+epbVEkw8R/gjF8CQQCU
-WN06A6HhKnTyas7/vDfazxci/pUyRG3Xb+mLIt9K8x2Gfgd3VgeAd9Xp2HINFPev
-Yj/86SuJ5hQkq7sYnZMDAkBgqwXIJ6N5W2jH+d06aBhi1ChZ+JmeUqhzZOV4eT+h
-ya+PwKiQrPJo6EOCciHq2wJiIw5ADShZXi7+IdA2g4yp
+MIICXAIBAAKBgQDPLusRZCDc1c5/2rWTZkkkj3gtw2xZnDymMutpakUH9Kwz/0m4
+jXuMmJqB8p04LjefvwN6YntPm3cFUvDckx+HFAjv/EQSDHyGiPsbrBVz7U60zX/D
+ra2r5Yy+6xdJFGxuLy0wEYKUsbaZ0Xy1+dalVkRe7EezbDZqdd8+ddVIEQIDAQAB
+AoGAFIt9BkuiZ0kRF072Bt4I7nCxr1a72wOqD1BpABo91S+h7JgUqec8c1vl+nE3
+aPegTsgvd/E7HtD2U6ypXjN9V9yHh96fe/gGjxXUbCE5ls3jGnAMW6GtcHf+x+OL
+02LNfCD3lUljtbZA1TFOvj8FJ6RrJchfzSz1vyvnchvmu4cCQQDyL0/SS74Gv5Ou
+Xec4EGSd/DQCeke88nf0SIWBR2bpfLrf1Ur0shVXsIL1Jh9YvFaKQMionb4peRDo
+FNxA6F5XAkEA2wB4RhhKe5BnyTc9uWFBQLzk0NHu244xMAb+lQQqXG41o6PHlT+D
+KuPOup8ZjOK2kkmGiiONOTkZpeZ0zJA71wJAYjooQN4xm6EWL/GsN0QG20EQgzS/
+ZfZeCrljVLT2G5tYXDKxbR/RojhYVT/6FM6GtxphiGo6V63f2pGjZ7wXjwJADxxn
+MB749LGwF5gyMBpf0EG4YBg8LPYQusmgw1N4QMxx8wqX+NpbCJiTaRkVQD1cb5eX
+KuztD6e691GBeaPyHQJBAN8BYcR2XoIiIQvCrJH5PJgusTICbdMftI6EvlzkwoSD
+EatfQIaWWE+tceqK3csGDb4NkiIAFogFSK1LGRzBjnw=
 -----END RSA PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.com/server1_ec.example.com/ca_chain.pem b/test/aux-fixed/exim-ca/example.com/server1_ec.example.com/ca_chain.pem
index cde036853..c6accd35b 100644
--- a/test/aux-fixed/exim-ca/example.com/server1_ec.example.com/ca_chain.pem
+++ b/test/aux-fixed/exim-ca/example.com/server1_ec.example.com/ca_chain.pem
@@ -3,33 +3,33 @@ Bag Attributes
 subject=/O=example.com/CN=clica Signing Cert rsa
 issuer=/O=example.com/CN=clica CA rsa
 -----BEGIN CERTIFICATE-----
-MIICNDCCAZ2gAwIBAgIBAjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+MIICGDCCAYGgAwIBAgIBQjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
 cGxlLmNvbTEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwMVoX
 DTM4MDEwMTEyMzQwMVowNzEUMBIGA1UEChMLZXhhbXBsZS5jb20xHzAdBgNVBAMT
 FmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
-AoGBANlcwo5q84SEtVy5W/xqbYAzOiYUZ0Shp9+ry/Q/X5uhrDF9JSHNWJbXut+8
-ZJGICt0RYVIJCcaa7FUt5hTKEx4fgURr+Hz84ZgwesMxcECHJPq9ylrCqbPkbmFR
-1XUy2MvioMH2lyc/PbV62XXggJhHioStVLRfyVlkS1KvvR+HAgMBAAGjWjBYMA4G
-A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMDIGA1UdHwQrMCkwJ6Al
-oCOGIWh0dHA6Ly9jcmwuZXhhbXBsZS5jb20vbGF0ZXN0LmNybDANBgkqhkiG9w0B
-AQsFAAOBgQBtPJwqu7DiDmFZd58L4xQ6JJhrJzJUDHmT7ikW2tOM58yisCgSnzrR
-xihW+49vUQ9lSGxBHaFwdehAuGTXydnf7/i9i6KA2RZ+Rq12FJFYOhjaIP7Sy1zq
-VXtb+P1eDBQQhz0WgysLVjgGdBiokRv86yY56ficoTQ6EyWzQLCU+A==
+AoGBALFHTtwaKeCfLlDf/wTErhOB6AB9vKHtyDbU6yDB/DrA5DLbug8m1oGGwEIf
+lTY0VBym8/Iu/ExE476gRmPNX/kIQsSNj9LtCIx3JXqLpc8ylw4cuVMOeFtBXNtE
+YKvUPIyWaAvqBbwY1QOyHNeoJ68hBdDPCn3oN2wrCz4if9QHAgMBAAGjPjA8MA4G
+A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMBYGA1UdDgQPBA1BQWJ0
+d0N4Y1hnYjBRMA0GCSqGSIb3DQEBCwUAA4GBAERD495HPM1BxM60EHGYLQgPjJPT
+/cL+nTKyIdv2UvzAnJaSFMMAB43Twy/jvkahsITVuieSU4kpev79KRNLfk+h25pf
+oPjaOfmOQVtHWN9ML8FDs0dLkRhJPuagObx17l/KEPkiK/jLB339fyO1HxaKhymE
+hdqYsdjjnBy/6U5g
 -----END CERTIFICATE-----
 Bag Attributes
     friendlyName: Certificate Authority rsa
 subject=/O=example.com/CN=clica CA rsa
 issuer=/O=example.com/CN=clica CA rsa
 -----BEGIN CERTIFICATE-----
-MIIB9jCCAV+gAwIBAgIBATANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+MIIB9jCCAV+gAwIBAgIBQTANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
 cGxlLmNvbTEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwMVoX
 DTM4MDEwMTEyMzQwMVowLTEUMBIGA1UEChMLZXhhbXBsZS5jb20xFTATBgNVBAMT
-DGNsaWNhIENBIHJzYTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA2N3YjbHA
-BEKAiUHwJ0VMAAe/KMOM8slXOAKni4v7Vf6BzbO5B6uaKhDV2n3V0vXwMdAoeBaq
-3s9CHOjDXwjF1qf/p4w3Z2aUIVt/Mb+uEcPUlq0Nr8OLlH11QKbkvFtLxU3sUAoi
-fcaydi1q3tszjPQ0tKlLo6kOzcgi8d47WccCAwEAAaMmMCQwEgYDVR0TAQH/BAgw
-BgEB/wIBATAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADgYEAAzD/Zszo
-X4ieSQQxDOH53VkiAJDs32qso9YzGbQaenuRnVFCuo7rt68cjMcOjzf18/I+iMeH
-nEcdqkfoYB4Z3LXvDaRGZhg/ZOv58muzRnsW2oQI9yFqDwD0FZPtM6Vq0AWXjLuq
-IogOI5fShSo7H5hc3vrkvS7KUhzuv3FKnaQ=
+DGNsaWNhIENBIHJzYTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAyDGCW64u
+Q5CBaKQGpgZVwGjo+VAn2EpwbfCZkhJtnxESiZYigjBH8KaOcAGyuv6jqY3pP64u
+gPe3lRkqwnvnLkj4wYo7d1GpW12yRCN/n7oMUcHLceqeLc8iYy6k1szF+jdlcRPL
+2OXNEy2pgzsPRyWZyCS2xZE86byA4N+/Y5cCAwEAAaMmMCQwEgYDVR0TAQH/BAgw
+BgEB/wIBATAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADgYEAeQnAdtC4
+EWA5tl8hRlOmc7IM6c40MJRB73/Oiul8xcS4l2qRLXUAWJjddxMPrLf4AYmc0vQz
+rcWmvkfdnjqX235D5YaOvfsIKr+YThtbSUvSK/uCGCxmiQHLQIWa7oWnFExIAjFd
+xxxXmvnPPG86dFoAm4AGS6kynXmWc4tvKYI=
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.com/server1_ec.example.com/cert8.db b/test/aux-fixed/exim-ca/example.com/server1_ec.example.com/cert8.db
index 9c31e2c70..29b64a508 100644
--- a/test/aux-fixed/exim-ca/example.com/server1_ec.example.com/cert8.db
+++ b/test/aux-fixed/exim-ca/example.com/server1_ec.example.com/cert8.db
diff --git a/test/aux-fixed/exim-ca/example.com/server1_ec.example.com/key3.db b/test/aux-fixed/exim-ca/example.com/server1_ec.example.com/key3.db
index 5a863771b..a9ea832c1 100644
--- a/test/aux-fixed/exim-ca/example.com/server1_ec.example.com/key3.db
+++ b/test/aux-fixed/exim-ca/example.com/server1_ec.example.com/key3.db
diff --git a/test/aux-fixed/exim-ca/example.com/server1_ec.example.com/server1_ec.example.com.chain.pem b/test/aux-fixed/exim-ca/example.com/server1_ec.example.com/server1_ec.example.com.chain.pem
index 5821da3a6..eed87f9d2 100644
--- a/test/aux-fixed/exim-ca/example.com/server1_ec.example.com/server1_ec.example.com.chain.pem
+++ b/test/aux-fixed/exim-ca/example.com/server1_ec.example.com/server1_ec.example.com.chain.pem
@@ -1,36 +1,36 @@
 Bag Attributes
     friendlyName: server1_ec.example.com
-    localKeyID: F3 51 92 80 EE 0E 15 CF 66 DD 08 F5 3B 25 04 72 96 18 B5 3C 
+    localKeyID: E0 17 8A CF 74 D6 61 D1 12 31 3B F5 E9 F0 FE 3A C9 78 81 A0 
 subject=/CN=server1_ec.example.com
 issuer=/O=example.com/CN=clica Signing Cert rsa
 -----BEGIN CERTIFICATE-----
 MIICrjCCAhegAwIBAgICBE0wDQYJKoZIhvcNAQELBQAwNzEUMBIGA1UEChMLZXhh
 bXBsZS5jb20xHzAdBgNVBAMTFmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwHhcNMTIx
-MTAxMTIzNDA0WhcNMzcxMjAxMTIzNDA0WjAhMR8wHQYDVQQDDBZzZXJ2ZXIxX2Vj
-LmV4YW1wbGUuY29tMIGbMBAGByqGSM49AgEGBSuBBAAjA4GGAAQBSrVQcxLe6HON
-7ZWl3ImT2edPxEqzGZYbZrEPsv+AjOdoFwlEeyW1otKLM8N0nAWDU7NukAA+Y+eV
-87AuYHs+sTMALjgmY+PxNrCy3eqe0FNxg+O4zN5fY+V2KLkuK9i2weChU6GKz6VI
-t6vW+joSxsew+P7lL96AOntFZ8xN3xl4StCjgeIwgd8wDgYDVR0PAQH/BAQDAgTw
+MTAxMTIzNDE5WhcNMzcxMjAxMTIzNDE5WjAhMR8wHQYDVQQDDBZzZXJ2ZXIxX2Vj
+LmV4YW1wbGUuY29tMIGbMBAGByqGSM49AgEGBSuBBAAjA4GGAAQB1ubm7y2hpf8A
+PpGOAfdu4qNIXh8QpXT3wrmwg+LssCjXKvCNZtlA9bluYGSkVK8o7QXLIKxrWb4x
+eKRW0w1Bhm8BnKtC2znA3Rw7TRErRF7MelYgI1BTqeIZIzewdokg8iHVpP2h0XL+
+Verdwojs1jNNvyGz9Bqt3+J7hddg3rYOsGejgeIwgd8wDgYDVR0PAQH/BAQDAgTw
 MCAGA1UdJQEB/wQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAyBgNVHR8EKzApMCeg
 JaAjhiFodHRwOi8vY3JsLmV4YW1wbGUuY29tL2xhdGVzdC5jcmwwNAYIKwYBBQUH
 AQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb3NjcC5leGFtcGxlLmNvbS8wQQYD
-VR0RBDowOIIJKi50ZXN0LmV4ghNzZXJ2ZXIxLmV4YW1wbGUuY29tghZzZXJ2ZXIx
-X2VjLmV4YW1wbGUuY29tMA0GCSqGSIb3DQEBCwUAA4GBABnqbnB1EKQisMe/a1D7
-oHulTvJoHlg9HI3ROcvxCWn3gKKiZ8JpRyIXneDNNZpCz8B5MWJfwijONA+aL+oG
-5wjYL9IgnqsUzklUXD2rN6epWLaLICsNxQoPVGcq1xMt4FkKdvk3I/0ulLjCYTPo
-kBVn+I2iCYu9gm0l9U+p8bbw
+VR0RBDowOIIWc2VydmVyMV9lYy5leGFtcGxlLmNvbYIJKi50ZXN0LmV4ghNzZXJ2
+ZXIxLmV4YW1wbGUuY29tMA0GCSqGSIb3DQEBCwUAA4GBAAHH8k1i49be/X2e66xq
+wk69K2dtWEliPC56lIAPQqev2P9MD1ZyuuL3l4A90qGooZcqf7cSUw2ie8Uh1HrX
+d4WcfkrUXBNAfgN0HGnkJU214JewxRFD58k+qntSshR9x6GePi6Zva2QkyB9YpjF
+suLsTzCsqaDZmTWgMbgLPlOY
 -----END CERTIFICATE-----
 -----BEGIN CERTIFICATE-----
-MIICNDCCAZ2gAwIBAgIBAjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+MIICGDCCAYGgAwIBAgIBQjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
 cGxlLmNvbTEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwMVoX
 DTM4MDEwMTEyMzQwMVowNzEUMBIGA1UEChMLZXhhbXBsZS5jb20xHzAdBgNVBAMT
 FmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
-AoGBANlcwo5q84SEtVy5W/xqbYAzOiYUZ0Shp9+ry/Q/X5uhrDF9JSHNWJbXut+8
-ZJGICt0RYVIJCcaa7FUt5hTKEx4fgURr+Hz84ZgwesMxcECHJPq9ylrCqbPkbmFR
-1XUy2MvioMH2lyc/PbV62XXggJhHioStVLRfyVlkS1KvvR+HAgMBAAGjWjBYMA4G
-A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMDIGA1UdHwQrMCkwJ6Al
-oCOGIWh0dHA6Ly9jcmwuZXhhbXBsZS5jb20vbGF0ZXN0LmNybDANBgkqhkiG9w0B
-AQsFAAOBgQBtPJwqu7DiDmFZd58L4xQ6JJhrJzJUDHmT7ikW2tOM58yisCgSnzrR
-xihW+49vUQ9lSGxBHaFwdehAuGTXydnf7/i9i6KA2RZ+Rq12FJFYOhjaIP7Sy1zq
-VXtb+P1eDBQQhz0WgysLVjgGdBiokRv86yY56ficoTQ6EyWzQLCU+A==
+AoGBALFHTtwaKeCfLlDf/wTErhOB6AB9vKHtyDbU6yDB/DrA5DLbug8m1oGGwEIf
+lTY0VBym8/Iu/ExE476gRmPNX/kIQsSNj9LtCIx3JXqLpc8ylw4cuVMOeFtBXNtE
+YKvUPIyWaAvqBbwY1QOyHNeoJ68hBdDPCn3oN2wrCz4if9QHAgMBAAGjPjA8MA4G
+A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMBYGA1UdDgQPBA1BQWJ0
+d0N4Y1hnYjBRMA0GCSqGSIb3DQEBCwUAA4GBAERD495HPM1BxM60EHGYLQgPjJPT
+/cL+nTKyIdv2UvzAnJaSFMMAB43Twy/jvkahsITVuieSU4kpev79KRNLfk+h25pf
+oPjaOfmOQVtHWN9ML8FDs0dLkRhJPuagObx17l/KEPkiK/jLB339fyO1HxaKhymE
+hdqYsdjjnBy/6U5g
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.com/server1_ec.example.com/server1_ec.example.com.key b/test/aux-fixed/exim-ca/example.com/server1_ec.example.com/server1_ec.example.com.key
index 78989a870..459491706 100644
--- a/test/aux-fixed/exim-ca/example.com/server1_ec.example.com/server1_ec.example.com.key
+++ b/test/aux-fixed/exim-ca/example.com/server1_ec.example.com/server1_ec.example.com.key
@@ -1,13 +1,13 @@
 Bag Attributes
     friendlyName: server1_ec.example.com
-    localKeyID: F3 51 92 80 EE 0E 15 CF 66 DD 08 F5 3B 25 04 72 96 18 B5 3C 
+    localKeyID: E0 17 8A CF 74 D6 61 D1 12 31 3B F5 E9 F0 FE 3A C9 78 81 A0 
 Key Attributes: <No Attributes>
 -----BEGIN ENCRYPTED PRIVATE KEY-----
-MIIBPTBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQIlcwjFE5MPHkCAggA
-MBQGCCqGSIb3DQMHBAi+ikbijJKLjASB+LizSd30D7Y5KjItwF/PHonzaf3/HhKV
-umjASvrpYlvy8U71q5CGYVyzGZZ01qZ9UibWCFBvD311nO/MU4gikRSCDCwGhFrH
-yLuGpOsp5pEN7aZACFvDChtyb+SAmINOxmeGtITaQrd39fK0jvbNJDPlc/NIpVPR
-BLddi8+Qr4L+qM3QZi93aZSfBJiPwEIwUKsfhxEEVVcKlF7Uh2uV8lHpwIP1KHAY
-07Acl/Z/k6yPL6/9a9+x92sSYM8ysMc2oOuIlv9bsjhOh1OvuNZ02DCSG4yE5PUt
-Uq1dOg/vqBGfBWoJ4PB+QnCcMf9avHV2C2uJJsNys8jx
+MIIBSzBOBgkqhkiG9w0BBQ0wQTApBgkqhkiG9w0BBQwwHAQIh79X+VfzLosCAggA
+MAwGCCqGSIb3DQIJBQAwFAYIKoZIhvcNAwcECH5VbzTpNflHBIH4t6hSXTWYY3sB
+D+Sp/1NdSB+3zrb+G8iXzt5H8a5dEiUwjaXSS8l1+Xw7SpppLLuqrv1v73Fwsi6z
+EDS0M0bMJz/wPq/xM8LkT2ohOS4p+bsy90/46SiSXSSrXKnGkEe9sDzaoLcE+//J
+7xIpOnLFPtqsJ39+aIdjeiqbGYHcSMi0AYpycB+6KHZipPOanvdxhkb/lSQNXCYD
+T24PW8WDctE8iuVCMTrJomX5FLXiCH/W9m6citmprvDo1eewdQFHeAQ6ZwYTAz2Y
+Rj0lqOg6LlbGLnVFl4E3jHvO3gBpSBqbWbWg6c59QPHDNQ9NiqHQwDHjmT1R1dw=
 -----END ENCRYPTED PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.com/server1_ec.example.com/server1_ec.example.com.p12 b/test/aux-fixed/exim-ca/example.com/server1_ec.example.com/server1_ec.example.com.p12
index 47ada66bf..21dccc088 100644
--- a/test/aux-fixed/exim-ca/example.com/server1_ec.example.com/server1_ec.example.com.p12
+++ b/test/aux-fixed/exim-ca/example.com/server1_ec.example.com/server1_ec.example.com.p12
diff --git a/test/aux-fixed/exim-ca/example.com/server1_ec.example.com/server1_ec.example.com.pem b/test/aux-fixed/exim-ca/example.com/server1_ec.example.com/server1_ec.example.com.pem
index 97e86943a..2c518e681 100644
--- a/test/aux-fixed/exim-ca/example.com/server1_ec.example.com/server1_ec.example.com.pem
+++ b/test/aux-fixed/exim-ca/example.com/server1_ec.example.com/server1_ec.example.com.pem
@@ -1,22 +1,22 @@
 Bag Attributes
     friendlyName: server1_ec.example.com
-    localKeyID: F3 51 92 80 EE 0E 15 CF 66 DD 08 F5 3B 25 04 72 96 18 B5 3C 
+    localKeyID: E0 17 8A CF 74 D6 61 D1 12 31 3B F5 E9 F0 FE 3A C9 78 81 A0 
 subject=/CN=server1_ec.example.com
 issuer=/O=example.com/CN=clica Signing Cert rsa
 -----BEGIN CERTIFICATE-----
 MIICrjCCAhegAwIBAgICBE0wDQYJKoZIhvcNAQELBQAwNzEUMBIGA1UEChMLZXhh
 bXBsZS5jb20xHzAdBgNVBAMTFmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwHhcNMTIx
-MTAxMTIzNDA0WhcNMzcxMjAxMTIzNDA0WjAhMR8wHQYDVQQDDBZzZXJ2ZXIxX2Vj
-LmV4YW1wbGUuY29tMIGbMBAGByqGSM49AgEGBSuBBAAjA4GGAAQBSrVQcxLe6HON
-7ZWl3ImT2edPxEqzGZYbZrEPsv+AjOdoFwlEeyW1otKLM8N0nAWDU7NukAA+Y+eV
-87AuYHs+sTMALjgmY+PxNrCy3eqe0FNxg+O4zN5fY+V2KLkuK9i2weChU6GKz6VI
-t6vW+joSxsew+P7lL96AOntFZ8xN3xl4StCjgeIwgd8wDgYDVR0PAQH/BAQDAgTw
+MTAxMTIzNDE5WhcNMzcxMjAxMTIzNDE5WjAhMR8wHQYDVQQDDBZzZXJ2ZXIxX2Vj
+LmV4YW1wbGUuY29tMIGbMBAGByqGSM49AgEGBSuBBAAjA4GGAAQB1ubm7y2hpf8A
+PpGOAfdu4qNIXh8QpXT3wrmwg+LssCjXKvCNZtlA9bluYGSkVK8o7QXLIKxrWb4x
+eKRW0w1Bhm8BnKtC2znA3Rw7TRErRF7MelYgI1BTqeIZIzewdokg8iHVpP2h0XL+
+Verdwojs1jNNvyGz9Bqt3+J7hddg3rYOsGejgeIwgd8wDgYDVR0PAQH/BAQDAgTw
 MCAGA1UdJQEB/wQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAyBgNVHR8EKzApMCeg
 JaAjhiFodHRwOi8vY3JsLmV4YW1wbGUuY29tL2xhdGVzdC5jcmwwNAYIKwYBBQUH
 AQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb3NjcC5leGFtcGxlLmNvbS8wQQYD
-VR0RBDowOIIJKi50ZXN0LmV4ghNzZXJ2ZXIxLmV4YW1wbGUuY29tghZzZXJ2ZXIx
-X2VjLmV4YW1wbGUuY29tMA0GCSqGSIb3DQEBCwUAA4GBABnqbnB1EKQisMe/a1D7
-oHulTvJoHlg9HI3ROcvxCWn3gKKiZ8JpRyIXneDNNZpCz8B5MWJfwijONA+aL+oG
-5wjYL9IgnqsUzklUXD2rN6epWLaLICsNxQoPVGcq1xMt4FkKdvk3I/0ulLjCYTPo
-kBVn+I2iCYu9gm0l9U+p8bbw
+VR0RBDowOIIWc2VydmVyMV9lYy5leGFtcGxlLmNvbYIJKi50ZXN0LmV4ghNzZXJ2
+ZXIxLmV4YW1wbGUuY29tMA0GCSqGSIb3DQEBCwUAA4GBAAHH8k1i49be/X2e66xq
+wk69K2dtWEliPC56lIAPQqev2P9MD1ZyuuL3l4A90qGooZcqf7cSUw2ie8Uh1HrX
+d4WcfkrUXBNAfgN0HGnkJU214JewxRFD58k+qntSshR9x6GePi6Zva2QkyB9YpjF
+suLsTzCsqaDZmTWgMbgLPlOY
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.com/server1_ec.example.com/server1_ec.example.com.unlocked.key b/test/aux-fixed/exim-ca/example.com/server1_ec.example.com/server1_ec.example.com.unlocked.key
index a0fd598b5..a400a3713 100644
--- a/test/aux-fixed/exim-ca/example.com/server1_ec.example.com/server1_ec.example.com.unlocked.key
+++ b/test/aux-fixed/exim-ca/example.com/server1_ec.example.com/server1_ec.example.com.unlocked.key
@@ -1,7 +1,7 @@
 -----BEGIN EC PRIVATE KEY-----
-MIHcAgEBBEIBPUPiTROKyPZXKuNddLWl8ngGLh7mZnD37RZdNf5iGZn86fGM9tWT
-eCs+sA1FGbyLLVt+SXGOR0iS0V5zguTqpLigBwYFK4EEACOhgYkDgYYABAFKtVBz
-Et7oc43tlaXciZPZ50/ESrMZlhtmsQ+y/4CM52gXCUR7JbWi0oszw3ScBYNTs26Q
-AD5j55XzsC5gez6xMwAuOCZj4/E2sLLd6p7QU3GD47jM3l9j5XYouS4r2LbB4KFT
-oYrPpUi3q9b6OhLGx7D4/uUv3oA6e0VnzE3fGXhK0A==
+MIHcAgEBBEIBHFhFJ4s3N0FlAYZzwzUyOmLWKvRy93rhN41JhR/fpgAY4pZW+JPd
+SfQJbQBbc3yXHfuGp8vJrrK7qj9Bc/yd+UqgBwYFK4EEACOhgYkDgYYABAHW5ubv
+LaGl/wA+kY4B927io0heHxCldPfCubCD4uywKNcq8I1m2UD1uW5gZKRUryjtBcsg
+rGtZvjF4pFbTDUGGbwGcq0LbOcDdHDtNEStEXsx6ViAjUFOp4hkjN7B2iSDyIdWk
+/aHRcv5V6t3CiOzWM02/IbP0Gq3f4nuF12Detg6wZw==
 -----END EC PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.com/server2.example.com/ca_chain.pem b/test/aux-fixed/exim-ca/example.com/server2.example.com/ca_chain.pem
index cde036853..c6accd35b 100644
--- a/test/aux-fixed/exim-ca/example.com/server2.example.com/ca_chain.pem
+++ b/test/aux-fixed/exim-ca/example.com/server2.example.com/ca_chain.pem
@@ -3,33 +3,33 @@ Bag Attributes
 subject=/O=example.com/CN=clica Signing Cert rsa
 issuer=/O=example.com/CN=clica CA rsa
 -----BEGIN CERTIFICATE-----
-MIICNDCCAZ2gAwIBAgIBAjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+MIICGDCCAYGgAwIBAgIBQjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
 cGxlLmNvbTEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwMVoX
 DTM4MDEwMTEyMzQwMVowNzEUMBIGA1UEChMLZXhhbXBsZS5jb20xHzAdBgNVBAMT
 FmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
-AoGBANlcwo5q84SEtVy5W/xqbYAzOiYUZ0Shp9+ry/Q/X5uhrDF9JSHNWJbXut+8
-ZJGICt0RYVIJCcaa7FUt5hTKEx4fgURr+Hz84ZgwesMxcECHJPq9ylrCqbPkbmFR
-1XUy2MvioMH2lyc/PbV62XXggJhHioStVLRfyVlkS1KvvR+HAgMBAAGjWjBYMA4G
-A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMDIGA1UdHwQrMCkwJ6Al
-oCOGIWh0dHA6Ly9jcmwuZXhhbXBsZS5jb20vbGF0ZXN0LmNybDANBgkqhkiG9w0B
-AQsFAAOBgQBtPJwqu7DiDmFZd58L4xQ6JJhrJzJUDHmT7ikW2tOM58yisCgSnzrR
-xihW+49vUQ9lSGxBHaFwdehAuGTXydnf7/i9i6KA2RZ+Rq12FJFYOhjaIP7Sy1zq
-VXtb+P1eDBQQhz0WgysLVjgGdBiokRv86yY56ficoTQ6EyWzQLCU+A==
+AoGBALFHTtwaKeCfLlDf/wTErhOB6AB9vKHtyDbU6yDB/DrA5DLbug8m1oGGwEIf
+lTY0VBym8/Iu/ExE476gRmPNX/kIQsSNj9LtCIx3JXqLpc8ylw4cuVMOeFtBXNtE
+YKvUPIyWaAvqBbwY1QOyHNeoJ68hBdDPCn3oN2wrCz4if9QHAgMBAAGjPjA8MA4G
+A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMBYGA1UdDgQPBA1BQWJ0
+d0N4Y1hnYjBRMA0GCSqGSIb3DQEBCwUAA4GBAERD495HPM1BxM60EHGYLQgPjJPT
+/cL+nTKyIdv2UvzAnJaSFMMAB43Twy/jvkahsITVuieSU4kpev79KRNLfk+h25pf
+oPjaOfmOQVtHWN9ML8FDs0dLkRhJPuagObx17l/KEPkiK/jLB339fyO1HxaKhymE
+hdqYsdjjnBy/6U5g
 -----END CERTIFICATE-----
 Bag Attributes
     friendlyName: Certificate Authority rsa
 subject=/O=example.com/CN=clica CA rsa
 issuer=/O=example.com/CN=clica CA rsa
 -----BEGIN CERTIFICATE-----
-MIIB9jCCAV+gAwIBAgIBATANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+MIIB9jCCAV+gAwIBAgIBQTANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
 cGxlLmNvbTEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwMVoX
 DTM4MDEwMTEyMzQwMVowLTEUMBIGA1UEChMLZXhhbXBsZS5jb20xFTATBgNVBAMT
-DGNsaWNhIENBIHJzYTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA2N3YjbHA
-BEKAiUHwJ0VMAAe/KMOM8slXOAKni4v7Vf6BzbO5B6uaKhDV2n3V0vXwMdAoeBaq
-3s9CHOjDXwjF1qf/p4w3Z2aUIVt/Mb+uEcPUlq0Nr8OLlH11QKbkvFtLxU3sUAoi
-fcaydi1q3tszjPQ0tKlLo6kOzcgi8d47WccCAwEAAaMmMCQwEgYDVR0TAQH/BAgw
-BgEB/wIBATAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADgYEAAzD/Zszo
-X4ieSQQxDOH53VkiAJDs32qso9YzGbQaenuRnVFCuo7rt68cjMcOjzf18/I+iMeH
-nEcdqkfoYB4Z3LXvDaRGZhg/ZOv58muzRnsW2oQI9yFqDwD0FZPtM6Vq0AWXjLuq
-IogOI5fShSo7H5hc3vrkvS7KUhzuv3FKnaQ=
+DGNsaWNhIENBIHJzYTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAyDGCW64u
+Q5CBaKQGpgZVwGjo+VAn2EpwbfCZkhJtnxESiZYigjBH8KaOcAGyuv6jqY3pP64u
+gPe3lRkqwnvnLkj4wYo7d1GpW12yRCN/n7oMUcHLceqeLc8iYy6k1szF+jdlcRPL
+2OXNEy2pgzsPRyWZyCS2xZE86byA4N+/Y5cCAwEAAaMmMCQwEgYDVR0TAQH/BAgw
+BgEB/wIBATAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADgYEAeQnAdtC4
+EWA5tl8hRlOmc7IM6c40MJRB73/Oiul8xcS4l2qRLXUAWJjddxMPrLf4AYmc0vQz
+rcWmvkfdnjqX235D5YaOvfsIKr+YThtbSUvSK/uCGCxmiQHLQIWa7oWnFExIAjFd
+xxxXmvnPPG86dFoAm4AGS6kynXmWc4tvKYI=
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.com/server2.example.com/cert8.db b/test/aux-fixed/exim-ca/example.com/server2.example.com/cert8.db
index ff0d142d7..7e56c3d67 100644
--- a/test/aux-fixed/exim-ca/example.com/server2.example.com/cert8.db
+++ b/test/aux-fixed/exim-ca/example.com/server2.example.com/cert8.db
diff --git a/test/aux-fixed/exim-ca/example.com/server2.example.com/fullchain.pem b/test/aux-fixed/exim-ca/example.com/server2.example.com/fullchain.pem
new file mode 100644
index 000000000..907769db0
--- /dev/null
+++ b/test/aux-fixed/exim-ca/example.com/server2.example.com/fullchain.pem
@@ -0,0 +1,57 @@
+Bag Attributes
+    friendlyName: server2.example.com
+    localKeyID: 77 8B 89 22 47 D2 AB D3 65 BA 15 30 A5 01 41 AF 05 2E 27 1E 
+subject=/CN=server2.example.com
+issuer=/O=example.com/CN=clica Signing Cert rsa
+-----BEGIN CERTIFICATE-----
+MIICszCCAhygAwIBAgICAMkwDQYJKoZIhvcNAQELBQAwNzEUMBIGA1UEChMLZXhh
+bXBsZS5jb20xHzAdBgNVBAMTFmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwHhcNMTIx
+MTAxMTIzNDA0WhcNMzcxMjAxMTIzNDA0WjAeMRwwGgYDVQQDExNzZXJ2ZXIyLmV4
+YW1wbGUuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCf6MdoozlJCZPw
+dIHXdFHddXJfZ5xn2e6XoMmSjqOrOJYIIFKdgtlrMhtTVU1VLlK6V7H8142r78YQ
+4RKcj9QhTuQJxrrVtVuRt38Zy4RW0/+ujMcXoV8nV7Yt1c1z/tIJ4afSapAnAAm5
+wVdIbUhUeM/K5Wozm1gV5OCtNZPa4QIDAQABo4HmMIHjMA4GA1UdDwEB/wQEAwIE
+8DAgBgNVHSUBAf8EFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwTgYDVR0jBEcwRYAN
+QUFidHdDeGNYZ2IwUaExpC8wLTEUMBIGA1UEChMLZXhhbXBsZS5jb20xFTATBgNV
+BAMTDGNsaWNhIENBIHJzYYIBQjA0BggrBgEFBQcBAQQoMCYwJAYIKwYBBQUHMAGG
+GGh0dHA6Ly9vc2NwLmV4YW1wbGUuY29tLzApBgNVHREEIjAgghNzZXJ2ZXIyLmV4
+YW1wbGUuY29tggkqLnRlc3QuZXgwDQYJKoZIhvcNAQELBQADgYEAgAA5TLssFua+
+7lS39p+J/nFieS+QV5UHVGcv6RKWQRvFm93eaC3l16c1x+qx2ZUSQEkMBz0MdN9X
+0bYEX4NcFf6af7c1fez4t02sduqMRIqG4EI4eP9oigmDRBBntP2kXKTqkUHnjqd5
+N/bi+N6dD5aFGCIsXAavAYWUYsFpjS4=
+-----END CERTIFICATE-----
+Bag Attributes
+    friendlyName: Signing Cert rsa
+subject=/O=example.com/CN=clica Signing Cert rsa
+issuer=/O=example.com/CN=clica CA rsa
+-----BEGIN CERTIFICATE-----
+MIICGDCCAYGgAwIBAgIBQjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+cGxlLmNvbTEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwMVoX
+DTM4MDEwMTEyMzQwMVowNzEUMBIGA1UEChMLZXhhbXBsZS5jb20xHzAdBgNVBAMT
+FmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
+AoGBALFHTtwaKeCfLlDf/wTErhOB6AB9vKHtyDbU6yDB/DrA5DLbug8m1oGGwEIf
+lTY0VBym8/Iu/ExE476gRmPNX/kIQsSNj9LtCIx3JXqLpc8ylw4cuVMOeFtBXNtE
+YKvUPIyWaAvqBbwY1QOyHNeoJ68hBdDPCn3oN2wrCz4if9QHAgMBAAGjPjA8MA4G
+A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMBYGA1UdDgQPBA1BQWJ0
+d0N4Y1hnYjBRMA0GCSqGSIb3DQEBCwUAA4GBAERD495HPM1BxM60EHGYLQgPjJPT
+/cL+nTKyIdv2UvzAnJaSFMMAB43Twy/jvkahsITVuieSU4kpev79KRNLfk+h25pf
+oPjaOfmOQVtHWN9ML8FDs0dLkRhJPuagObx17l/KEPkiK/jLB339fyO1HxaKhymE
+hdqYsdjjnBy/6U5g
+-----END CERTIFICATE-----
+Bag Attributes
+    friendlyName: Certificate Authority rsa
+subject=/O=example.com/CN=clica CA rsa
+issuer=/O=example.com/CN=clica CA rsa
+-----BEGIN CERTIFICATE-----
+MIIB9jCCAV+gAwIBAgIBQTANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+cGxlLmNvbTEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwMVoX
+DTM4MDEwMTEyMzQwMVowLTEUMBIGA1UEChMLZXhhbXBsZS5jb20xFTATBgNVBAMT
+DGNsaWNhIENBIHJzYTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAyDGCW64u
+Q5CBaKQGpgZVwGjo+VAn2EpwbfCZkhJtnxESiZYigjBH8KaOcAGyuv6jqY3pP64u
+gPe3lRkqwnvnLkj4wYo7d1GpW12yRCN/n7oMUcHLceqeLc8iYy6k1szF+jdlcRPL
+2OXNEy2pgzsPRyWZyCS2xZE86byA4N+/Y5cCAwEAAaMmMCQwEgYDVR0TAQH/BAgw
+BgEB/wIBATAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADgYEAeQnAdtC4
+EWA5tl8hRlOmc7IM6c40MJRB73/Oiul8xcS4l2qRLXUAWJjddxMPrLf4AYmc0vQz
+rcWmvkfdnjqX235D5YaOvfsIKr+YThtbSUvSK/uCGCxmiQHLQIWa7oWnFExIAjFd
+xxxXmvnPPG86dFoAm4AGS6kynXmWc4tvKYI=
+-----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.com/server2.example.com/key3.db b/test/aux-fixed/exim-ca/example.com/server2.example.com/key3.db
index f038ea5c8..cadb6eff9 100644
--- a/test/aux-fixed/exim-ca/example.com/server2.example.com/key3.db
+++ b/test/aux-fixed/exim-ca/example.com/server2.example.com/key3.db
diff --git a/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.chain.pem b/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.chain.pem
index 82b640ff3..dc9a7593c 100644
--- a/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.chain.pem
+++ b/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.chain.pem
@@ -1,35 +1,36 @@
 Bag Attributes
     friendlyName: server2.example.com
-    localKeyID: 0D 9E 77 6B 02 AF DE FB 02 31 58 89 27 D3 05 CA 81 F0 03 66 
+    localKeyID: 77 8B 89 22 47 D2 AB D3 65 BA 15 30 A5 01 41 AF 05 2E 27 1E 
 subject=/CN=server2.example.com
 issuer=/O=example.com/CN=clica Signing Cert rsa
 -----BEGIN CERTIFICATE-----
-MIICjDCCAfWgAwIBAgICAMkwDQYJKoZIhvcNAQELBQAwNzEUMBIGA1UEChMLZXhh
+MIICszCCAhygAwIBAgICAMkwDQYJKoZIhvcNAQELBQAwNzEUMBIGA1UEChMLZXhh
 bXBsZS5jb20xHzAdBgNVBAMTFmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwHhcNMTIx
-MTAxMTIzNDAxWhcNMzcxMjAxMTIzNDAxWjAeMRwwGgYDVQQDExNzZXJ2ZXIyLmV4
-YW1wbGUuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC5xczcpFPcohZh
-Legf/wzSJvwj/dVkXg0MEyVulbMS+sgCwwSO6uGykJVc6ZKUnGqFyv5Icp1zG9Y9
-/joYefiXN5K1n/3NrtsET+6AJDWzZYz/AyRGd07xLwEw+Ip0/bqqNaxpc07L1qAA
-Bcwz2lcSeKsIDbYC9znSdEzuNUFmGQIDAQABo4G/MIG8MA4GA1UdDwEB/wQEAwIE
-8DAgBgNVHSUBAf8EFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwMgYDVR0fBCswKTAn
-oCWgI4YhaHR0cDovL2NybC5leGFtcGxlLmNvbS9sYXRlc3QuY3JsMDQGCCsGAQUF
-BwEBBCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29zY3AuZXhhbXBsZS5jb20vMB4G
-A1UdEQQXMBWCE3NlcnZlcjIuZXhhbXBsZS5jb20wDQYJKoZIhvcNAQELBQADgYEA
-GQz0ggxKkEXx50eX/uWtlC7+JFwsJLBhU/nGBmOLxzHhptrRBLiqLYr8Chj92eZN
-nDr1HUY0jIC8PcPDjpgz1rs+6HOy3F++t7u+x1x89MQ2DUjCqqyjiM/PzuKsdU4V
-TVXsu8R4x8YSjCfXeKJAlOL4rPy2wU3wXRhzCf4Et4E=
+MTAxMTIzNDA0WhcNMzcxMjAxMTIzNDA0WjAeMRwwGgYDVQQDExNzZXJ2ZXIyLmV4
+YW1wbGUuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCf6MdoozlJCZPw
+dIHXdFHddXJfZ5xn2e6XoMmSjqOrOJYIIFKdgtlrMhtTVU1VLlK6V7H8142r78YQ
+4RKcj9QhTuQJxrrVtVuRt38Zy4RW0/+ujMcXoV8nV7Yt1c1z/tIJ4afSapAnAAm5
+wVdIbUhUeM/K5Wozm1gV5OCtNZPa4QIDAQABo4HmMIHjMA4GA1UdDwEB/wQEAwIE
+8DAgBgNVHSUBAf8EFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwTgYDVR0jBEcwRYAN
+QUFidHdDeGNYZ2IwUaExpC8wLTEUMBIGA1UEChMLZXhhbXBsZS5jb20xFTATBgNV
+BAMTDGNsaWNhIENBIHJzYYIBQjA0BggrBgEFBQcBAQQoMCYwJAYIKwYBBQUHMAGG
+GGh0dHA6Ly9vc2NwLmV4YW1wbGUuY29tLzApBgNVHREEIjAgghNzZXJ2ZXIyLmV4
+YW1wbGUuY29tggkqLnRlc3QuZXgwDQYJKoZIhvcNAQELBQADgYEAgAA5TLssFua+
+7lS39p+J/nFieS+QV5UHVGcv6RKWQRvFm93eaC3l16c1x+qx2ZUSQEkMBz0MdN9X
+0bYEX4NcFf6af7c1fez4t02sduqMRIqG4EI4eP9oigmDRBBntP2kXKTqkUHnjqd5
+N/bi+N6dD5aFGCIsXAavAYWUYsFpjS4=
 -----END CERTIFICATE-----
 -----BEGIN CERTIFICATE-----
-MIICNDCCAZ2gAwIBAgIBAjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+MIICGDCCAYGgAwIBAgIBQjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
 cGxlLmNvbTEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwMVoX
 DTM4MDEwMTEyMzQwMVowNzEUMBIGA1UEChMLZXhhbXBsZS5jb20xHzAdBgNVBAMT
 FmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
-AoGBANlcwo5q84SEtVy5W/xqbYAzOiYUZ0Shp9+ry/Q/X5uhrDF9JSHNWJbXut+8
-ZJGICt0RYVIJCcaa7FUt5hTKEx4fgURr+Hz84ZgwesMxcECHJPq9ylrCqbPkbmFR
-1XUy2MvioMH2lyc/PbV62XXggJhHioStVLRfyVlkS1KvvR+HAgMBAAGjWjBYMA4G
-A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMDIGA1UdHwQrMCkwJ6Al
-oCOGIWh0dHA6Ly9jcmwuZXhhbXBsZS5jb20vbGF0ZXN0LmNybDANBgkqhkiG9w0B
-AQsFAAOBgQBtPJwqu7DiDmFZd58L4xQ6JJhrJzJUDHmT7ikW2tOM58yisCgSnzrR
-xihW+49vUQ9lSGxBHaFwdehAuGTXydnf7/i9i6KA2RZ+Rq12FJFYOhjaIP7Sy1zq
-VXtb+P1eDBQQhz0WgysLVjgGdBiokRv86yY56ficoTQ6EyWzQLCU+A==
+AoGBALFHTtwaKeCfLlDf/wTErhOB6AB9vKHtyDbU6yDB/DrA5DLbug8m1oGGwEIf
+lTY0VBym8/Iu/ExE476gRmPNX/kIQsSNj9LtCIx3JXqLpc8ylw4cuVMOeFtBXNtE
+YKvUPIyWaAvqBbwY1QOyHNeoJ68hBdDPCn3oN2wrCz4if9QHAgMBAAGjPjA8MA4G
+A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMBYGA1UdDgQPBA1BQWJ0
+d0N4Y1hnYjBRMA0GCSqGSIb3DQEBCwUAA4GBAERD495HPM1BxM60EHGYLQgPjJPT
+/cL+nTKyIdv2UvzAnJaSFMMAB43Twy/jvkahsITVuieSU4kpev79KRNLfk+h25pf
+oPjaOfmOQVtHWN9ML8FDs0dLkRhJPuagObx17l/KEPkiK/jLB339fyO1HxaKhymE
+hdqYsdjjnBy/6U5g
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.key b/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.key
index 3b100bdbd..d58ef339b 100644
--- a/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.key
+++ b/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.key
@@ -1,21 +1,22 @@
 Bag Attributes
     friendlyName: server2.example.com
-    localKeyID: 0D 9E 77 6B 02 AF DE FB 02 31 58 89 27 D3 05 CA 81 F0 03 66 
+    localKeyID: 77 8B 89 22 47 D2 AB D3 65 BA 15 30 A5 01 41 AF 05 2E 27 1E 
 Key Attributes: <No Attributes>
 -----BEGIN ENCRYPTED PRIVATE KEY-----
-MIICxjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQISj8NfM4dQjsCAggA
-MBQGCCqGSIb3DQMHBAhAlCJYloV1gwSCAoCMamEc/QOzHYxmYK/+Qw9dFFXN52MT
-kpSO+pDm1MKb8lIm8IECdl4vth1uAcW9wj8g1u1sMPxXFlf95Pv2AyTGqQmG2lWU
-Z7yvrxBT/2KE1PuRQZOBkySuXQjZ8qOgw8tzr5bdunucDd7fyB3UXELIJd6bbLwY
-MwZ8X7lP/TWglgemfEYL06D7w6oZA22eM5lRuUfvhhdnM0E0SNO6T48lNtCXeFMG
-qU9wNgYpSlUoHaak/wITZC648NFablVtvxiQ9QVYblON+OPt1mOtFo3MTTTb7JQC
-NAITVl2OGcGJeDI6qTCDNRe6YKX80JkSNPkDsHzTchwpxPoIYA4rkxyAbVmPD2zd
-q0KmLZshoMeMXsh3GPqh3XB42lwK5GVVWUqD2d/RezMGsEO5GyxLsBnG+w9Bl8iz
-kDtIgy8eUgtWBRryb8QLaYbzpnV3TbGx9dRnoOWxivPe0VHNAvB63kSYIY2ja3yc
-iNX0B00x14Ec1dzfqG2k/xdewwuTyy0vfs6wkNKfBTloztop6LdInSzOJayc6B0L
-tRGA/l+IlR9MnKEYLE4v57kWc6Sdk/w4Ou+9EFyAy/IXFBDT8PXeJH4huYvuc6ZI
-2taUdSNoIf2OPvGoWp9x5g88lmLEMWCq3qa/UH9PpRApq77mCNfW+aiupmdhHEZF
-AE5kdzYZ4btAO3WhHNho1k3YZmbfa56lrCjKUusOjcrhRNwmkzQBX78FXUZd8hSh
-LnxKsVhIat4u4Ypa/XP+pdU6I2h+peeUF3wa0jqPZoNLTuA2aK0INxPVBmBEJY9u
-WTxYtjixUvAgegTgU0n3ck9LW3AjjjMi0rcZU6GyYV0sYxSvrJY3D06z
+MIIC1DBOBgkqhkiG9w0BBQ0wQTApBgkqhkiG9w0BBQwwHAQI1vLqrptV+aUCAggA
+MAwGCCqGSIb3DQIJBQAwFAYIKoZIhvcNAwcECJxH1i8CWr89BIICgD5oxp9UMxgO
+FsJc3rds07IfU7tPIpm4sIpDbp9kyr/hpnYj4BtXt9wuQ+fxDJ1rPnUldj9wsCcF
+Zuxcy2cWiKR2gKPMWHWIu2cTLdbBekMOl3FwFMio/KECI8uo5YFSM7falvW40nkC
+iieGVsa+w2NTBWsAPHL+82DydqIYl0xDa0H7In3LTHU4Hw3M0ndL7HNJzKnQ8Dqg
+tCCK/bqZT1TaNLXCHDm4qSXLVxntlcrZJ4yYovG92l7oMOzSwu5Ctm7CHO4WRD9+
+dWPToCqZ4BM4+DkxVTCZns6ux1eOyhUMJp1vxieK2NRrDvlyqoNDTl+p+cbwPnWp
+wzYsnrZP5BlwqOYGtU34+/LDcU10OYnL9wfj+F2RBKcC10HcdfWv4uC6hjdUamL8
+OhrLjusyoz+XlUZK4DnelRrzVBRSJphghmXDXQ3qi8PP4wNwphLJzBU5lfEqiSL1
+nW7zadhrDY+9AX3deR+k17MzWEz9nTYul0UN/CZtD6RXsixA3IdAlCo0lKneV2EJ
+44lopW4LkyWurh81fH7whANq3WA8pr28NT872CyVXIXOOYAYTez1WsSiPVpMpuKQ
+6kSV+FryNaRshAa29KS74wr6XHnC5BmNwQbdxXD1hyFpQujiRzw9EucFU317Hu+A
+DicwhimMyG4TiLI3fyGyHw2jGHPIavQXjQUG3XgyXrQNCOJoL8EoX6CVuFw5dwnG
+8UYPcBPFfEHU/GoCroBysosSDJjf4O4XsGR98tiL2lUQlYlT1BrfQwguC0Z7FqI/
+7HdBwn0iwnGOQFrbRXIUYhQqnmmUSCPaysAD6K2cSBViJZsfeY+fOU4j85CylUgs
+9/P/d9N76g4=
 -----END ENCRYPTED PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.dated.resp b/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.dated.resp
index 3519ae5b0..df711b4ca 100644
--- a/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.dated.resp
+++ b/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.dated.resp
diff --git a/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.good.resp b/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.good.resp
index d0693f144..455d073eb 100644
--- a/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.good.resp
+++ b/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.good.resp
diff --git a/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.req b/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.req
index b47ce8b4d..ebd9c2fc7 100644
--- a/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.req
+++ b/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.req
diff --git a/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.revoked.resp b/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.revoked.resp
index d0693f144..455d073eb 100644
--- a/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.revoked.resp
+++ b/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.revoked.resp
diff --git a/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.signer.dated.resp b/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.signer.dated.resp
index 7724fda3f..61e13218e 100644
--- a/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.signer.dated.resp
+++ b/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.signer.dated.resp
diff --git a/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.signer.good.resp b/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.signer.good.resp
index 8ade2db36..7a0789ef0 100644
--- a/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.signer.good.resp
+++ b/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.signer.good.resp
diff --git a/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.signer.revoked.resp b/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.signer.revoked.resp
index 8ade2db36..7a0789ef0 100644
--- a/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.signer.revoked.resp
+++ b/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.signer.revoked.resp
diff --git a/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.signernocert.dated.resp b/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.signernocert.dated.resp
index 5123b172b..7b818f7c7 100644
--- a/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.signernocert.dated.resp
+++ b/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.signernocert.dated.resp
diff --git a/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.signernocert.good.resp b/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.signernocert.good.resp
index 6eabdffa4..60feb64ea 100644
--- a/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.signernocert.good.resp
+++ b/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.signernocert.good.resp
diff --git a/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.signernocert.revoked.resp b/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.signernocert.revoked.resp
index 6eabdffa4..60feb64ea 100644
--- a/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.signernocert.revoked.resp
+++ b/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.signernocert.revoked.resp
diff --git a/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.p12 b/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.p12
index ce12e54fe..03273d4e5 100644
--- a/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.p12
+++ b/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.p12
diff --git a/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.pem b/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.pem
index b820bf8f5..825b4c4d4 100644
--- a/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.pem
+++ b/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.pem
@@ -1,21 +1,22 @@
 Bag Attributes
     friendlyName: server2.example.com
-    localKeyID: 0D 9E 77 6B 02 AF DE FB 02 31 58 89 27 D3 05 CA 81 F0 03 66 
+    localKeyID: 77 8B 89 22 47 D2 AB D3 65 BA 15 30 A5 01 41 AF 05 2E 27 1E 
 subject=/CN=server2.example.com
 issuer=/O=example.com/CN=clica Signing Cert rsa
 -----BEGIN CERTIFICATE-----
-MIICjDCCAfWgAwIBAgICAMkwDQYJKoZIhvcNAQELBQAwNzEUMBIGA1UEChMLZXhh
+MIICszCCAhygAwIBAgICAMkwDQYJKoZIhvcNAQELBQAwNzEUMBIGA1UEChMLZXhh
 bXBsZS5jb20xHzAdBgNVBAMTFmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwHhcNMTIx
-MTAxMTIzNDAxWhcNMzcxMjAxMTIzNDAxWjAeMRwwGgYDVQQDExNzZXJ2ZXIyLmV4
-YW1wbGUuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC5xczcpFPcohZh
-Legf/wzSJvwj/dVkXg0MEyVulbMS+sgCwwSO6uGykJVc6ZKUnGqFyv5Icp1zG9Y9
-/joYefiXN5K1n/3NrtsET+6AJDWzZYz/AyRGd07xLwEw+Ip0/bqqNaxpc07L1qAA
-Bcwz2lcSeKsIDbYC9znSdEzuNUFmGQIDAQABo4G/MIG8MA4GA1UdDwEB/wQEAwIE
-8DAgBgNVHSUBAf8EFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwMgYDVR0fBCswKTAn
-oCWgI4YhaHR0cDovL2NybC5leGFtcGxlLmNvbS9sYXRlc3QuY3JsMDQGCCsGAQUF
-BwEBBCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29zY3AuZXhhbXBsZS5jb20vMB4G
-A1UdEQQXMBWCE3NlcnZlcjIuZXhhbXBsZS5jb20wDQYJKoZIhvcNAQELBQADgYEA
-GQz0ggxKkEXx50eX/uWtlC7+JFwsJLBhU/nGBmOLxzHhptrRBLiqLYr8Chj92eZN
-nDr1HUY0jIC8PcPDjpgz1rs+6HOy3F++t7u+x1x89MQ2DUjCqqyjiM/PzuKsdU4V
-TVXsu8R4x8YSjCfXeKJAlOL4rPy2wU3wXRhzCf4Et4E=
+MTAxMTIzNDA0WhcNMzcxMjAxMTIzNDA0WjAeMRwwGgYDVQQDExNzZXJ2ZXIyLmV4
+YW1wbGUuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCf6MdoozlJCZPw
+dIHXdFHddXJfZ5xn2e6XoMmSjqOrOJYIIFKdgtlrMhtTVU1VLlK6V7H8142r78YQ
+4RKcj9QhTuQJxrrVtVuRt38Zy4RW0/+ujMcXoV8nV7Yt1c1z/tIJ4afSapAnAAm5
+wVdIbUhUeM/K5Wozm1gV5OCtNZPa4QIDAQABo4HmMIHjMA4GA1UdDwEB/wQEAwIE
+8DAgBgNVHSUBAf8EFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwTgYDVR0jBEcwRYAN
+QUFidHdDeGNYZ2IwUaExpC8wLTEUMBIGA1UEChMLZXhhbXBsZS5jb20xFTATBgNV
+BAMTDGNsaWNhIENBIHJzYYIBQjA0BggrBgEFBQcBAQQoMCYwJAYIKwYBBQUHMAGG
+GGh0dHA6Ly9vc2NwLmV4YW1wbGUuY29tLzApBgNVHREEIjAgghNzZXJ2ZXIyLmV4
+YW1wbGUuY29tggkqLnRlc3QuZXgwDQYJKoZIhvcNAQELBQADgYEAgAA5TLssFua+
+7lS39p+J/nFieS+QV5UHVGcv6RKWQRvFm93eaC3l16c1x+qx2ZUSQEkMBz0MdN9X
+0bYEX4NcFf6af7c1fez4t02sduqMRIqG4EI4eP9oigmDRBBntP2kXKTqkUHnjqd5
+N/bi+N6dD5aFGCIsXAavAYWUYsFpjS4=
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.unlocked.key b/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.unlocked.key
index c16d834bd..8ca80238b 100644
--- a/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.unlocked.key
+++ b/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.unlocked.key
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXQIBAAKBgQC5xczcpFPcohZhLegf/wzSJvwj/dVkXg0MEyVulbMS+sgCwwSO
-6uGykJVc6ZKUnGqFyv5Icp1zG9Y9/joYefiXN5K1n/3NrtsET+6AJDWzZYz/AyRG
-d07xLwEw+Ip0/bqqNaxpc07L1qAABcwz2lcSeKsIDbYC9znSdEzuNUFmGQIDAQAB
-AoGAEXVcVlP/KZn1/nYA/ZjLjKhrQ7qkJkWMdlkKSIU7CgqVZ2UKdZ/vTAe4cb3l
-r5+vhxlXollbIKk6DiNpNEmqKerZKzH7n7VGnWRZsqeIQKVafO8+zchh6yKNmWWB
-Vpr0iyzPruv4bX5mnlMyzCBR/p6ThYqzGvwJIyCY1EupZoECQQDnGO3hnpDZeNW+
-goZ3rHYlZYVDbb4IUOg/sDFQ+AKUbeSU6Iz+XgpZt9dxqLBPha75jbqIAM/p9EhH
-BBqmACRxAkEAzcqKI0Ic/673dD1BfTJ8PP1bqrEg2Gn/7+jL/BXJz4tH1kPvQjdl
-uBdOCVj0A0TRVGEsgqWK34t8uIeYJHyQKQJAHOW2IUdVr4v3lln1/JL5NxXpwxO+
-9oU/dW9Py2Mn122ibqhhsRELVEqzywef/GGoDpaVY5pOZV/hhdfSiT1tUQJBAKNG
-SDVTNijSjDiohTYtAQ9uwPT71iB+cXbKUFWwf87wJc3lVoZF56mYq+yUq/2P8zms
-Y6FAcJ+OTyUlR9vjDIkCQQDPIe6ggdYsOjRZewUscxmGKEZCHiJcqWIzD2aURknx
-DHKbxu5n3tZlhBoaK0OxJCoNDWLF/cE5PYJpBhGatJLR
+MIICXAIBAAKBgQCf6MdoozlJCZPwdIHXdFHddXJfZ5xn2e6XoMmSjqOrOJYIIFKd
+gtlrMhtTVU1VLlK6V7H8142r78YQ4RKcj9QhTuQJxrrVtVuRt38Zy4RW0/+ujMcX
+oV8nV7Yt1c1z/tIJ4afSapAnAAm5wVdIbUhUeM/K5Wozm1gV5OCtNZPa4QIDAQAB
+AoGADnBIzRhr3D3qpzwF20vr9mib5qRm2XOymOtSOBL8EUI/PcWZYBKICidQk1Iw
+9N+FZcD0V8Woy50PT8fa09sixqib80PAeMQe+AwblNQ3BXz7VEZZKbzUdv5SynnC
+oYqWp8dToWPG1aNvF054ZRA5Uy2LIB1+Vpv7X0QCIXQruE8CQQDM4L8U8QBjU2mK
+5/fsurGSY1nqI9qUvo104LPLrTqmtSnQKai+0Nh7/Mp0vIK9nC1Gz9mha1KTBSW5
+Qbvk9DtbAkEAx8+DYUS9C/WtTuQj+i2+bzHPRiWwmeOZZdFEdTyctNXYegnHqnum
+PRHxVHKlTMKGB73lmfrZ7HxqTYVP1AtjcwJBAKCaNXAHFBTImF2pRbIvD2//rcZb
+YMdlMKJEWuz42JdCQIrLfVpHgMyA93vXIm3cdami2akt5kcVq+KzYsUxpy0CQErE
+KIoeGYs/G+GYVqoHsemTvtalxcZftwe1XaNs0cqM9lr8C92MNTFG5IHQAHCPnW2K
+Lj8G8cKe73wgdTWIKWcCQG5RXlsOUfUIEQTxgE5lbQhcMshnOpkJDOHzHoJmuXpn
+SRKwVq+2PXkuw+sAeXxPiKwhOvFbXBL3bwkhibhpxs0=
 -----END RSA PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.net/BLANK/CA.pem b/test/aux-fixed/exim-ca/example.net/BLANK/CA.pem
index b48d20d40..8b2c0a5da 100644
--- a/test/aux-fixed/exim-ca/example.net/BLANK/CA.pem
+++ b/test/aux-fixed/exim-ca/example.net/BLANK/CA.pem
@@ -1,13 +1,13 @@
 -----BEGIN CERTIFICATE-----
-MIIB9jCCAV+gAwIBAgIBATANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
-cGxlLm5ldDEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwM1oX
-DTM4MDEwMTEyMzQwM1owLTEUMBIGA1UEChMLZXhhbXBsZS5uZXQxFTATBgNVBAMT
-DGNsaWNhIENBIHJzYTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA3kwC9CHz
-JH7sEDkHMdZRq8+XpV7l/hEqfv2gPvT3mak46dWrI/T3pJOqyNvUZV/LJ/gx/0uw
-9pmCg6Y5zNCN0qAGY4rSS/sbEOLYIw5wJbFnYfHtTwe3ZAdG+5WqKMBF2lHNBM3b
-PUB/kweoLhNLwserKHwMDC3sksfrwH29rpMCAwEAAaMmMCQwEgYDVR0TAQH/BAgw
-BgEB/wIBATAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADgYEAzXt6KHIB
-qOJfZECgwhAWipxVR0BXek0hAfyTWl7q18+mWKYydQW0Z2VMN4Bq/ZUlOg+EM8NU
-1n9PJ4+I2QgAwVVXN4+cz7zgZ6XRZc1OkE98NyK504bVpJpan1gsx3I5GLJUgP2t
-B/WwqoFO+ANhT2margZSM6avJfaIh8gEass=
+MIIB9jCCAV+gAwIBAgIBQTANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+cGxlLm5ldDEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQxNFoX
+DTM4MDEwMTEyMzQxNFowLTEUMBIGA1UEChMLZXhhbXBsZS5uZXQxFTATBgNVBAMT
+DGNsaWNhIENBIHJzYTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAs89Jw+yK
+ohiMwcSLAciqgj5CtxYRsoW1AmQrhD3QwE6es0RBjTGp5SNjjPlRxCZ5T+dQQXR1
+RirvSKH+isbd1ENIbS9dPgaR2mFUYwcSxUIRrXn4mkxZ/QtpTVOoY184lFAPhTrW
+et4o+wE9OI2e75RD5GdAyB/52paGplt+K38CAwEAAaMmMCQwEgYDVR0TAQH/BAgw
+BgEB/wIBATAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADgYEAOcXFUXls
+ChTDzMe2y+qv1YlOZbkf43S9je72ATYXzS7/eT8I4sAq/CFdgmn+lw5kHJlgxCag
+BPwuLYHW55r69WI1IwQHrJXaavyPSkonVgK+ZssEcQmqbgNj8oV5ZnyzYnNZv0VU
+nMl1n6nCl1xdUwPwhhdssGXEoX8OF5iMw4U=
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.net/BLANK/Signer.pem b/test/aux-fixed/exim-ca/example.net/BLANK/Signer.pem
index 34c6c36f2..6513c9044 100644
--- a/test/aux-fixed/exim-ca/example.net/BLANK/Signer.pem
+++ b/test/aux-fixed/exim-ca/example.net/BLANK/Signer.pem
@@ -1,14 +1,14 @@
 -----BEGIN CERTIFICATE-----
-MIICNDCCAZ2gAwIBAgIBAjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
-cGxlLm5ldDEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwM1oX
-DTM4MDEwMTEyMzQwM1owNzEUMBIGA1UEChMLZXhhbXBsZS5uZXQxHzAdBgNVBAMT
+MIICGDCCAYGgAwIBAgIBQjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+cGxlLm5ldDEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQxNFoX
+DTM4MDEwMTEyMzQxNFowNzEUMBIGA1UEChMLZXhhbXBsZS5uZXQxHzAdBgNVBAMT
 FmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
-AoGBALMuDick/uNCkK8zWtdko5eynjJq0y8NVNlhSFkbwfjbxOQycuyMhMlYNnvs
-ESWZTV5ckpsvoDrFQLFk6ZB7RVYHUoOHNfANm8JWC9GR5zqbquibA/MMQ4h2Xlkz
-zQz12AzPpouZUyYs1+SjwlgfBRVhtxApDR2bPEDzI6s9VUdXAgMBAAGjWjBYMA4G
-A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMDIGA1UdHwQrMCkwJ6Al
-oCOGIWh0dHA6Ly9jcmwuZXhhbXBsZS5uZXQvbGF0ZXN0LmNybDANBgkqhkiG9w0B
-AQsFAAOBgQDCXkPeCURjOJwCBgbLERuNghPiWLqHPopm1idM2A032jDgbRXD9/DP
-1xOPgSLEW59EiJac0RNae0D2KyhnG90NZLccXK0a9Uu1iaAmdcJ7s4a0x0ZH9Kza
-hqz0cr4oStUOHxG/AtPKuhZ9PkZ7GDSPDW0k/z64WYCm1fqSWkbVig==
+AoGBAKFOi+80c9pb3UidQJd+TQ9j9lmOlw3HlhRxYNadHL2jZ98OHrwlDB1JgToy
+PruZ9yLq26a7c6sLYqEvpHulS6ACUqYaqu9kKb8m4l7xlheoyLT/jkZjq4Z0owp8
+PhzYl4p3M23rQzNSXcHCxcwu+6KPJ8FgrdNuB2RmHU2M27wRAgMBAAGjPjA8MA4G
+A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMBYGA1UdDgQPBA1BQWJ0
+d0N4Y1hnYjBRMA0GCSqGSIb3DQEBCwUAA4GBAAUlBd0/XrkhQ6Gm8s44uOU/gSAe
+Ap8baRLuhTrrvzd+nPDBN0YbwVUMwd9TbY4MsmDy+GhE9/V8i8OydEshl2iE15+E
+JX2DJEmNd7RMfWb6EIZVuzFFDWRszxA14YdNvDXjwS6BYmsSWJsNH4P/eTRrTCJi
+C53ODVdhE6yCQs1m
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.net/BLANK/cert8.db b/test/aux-fixed/exim-ca/example.net/BLANK/cert8.db
index f412e95da..d93fbfc5a 100644
--- a/test/aux-fixed/exim-ca/example.net/BLANK/cert8.db
+++ b/test/aux-fixed/exim-ca/example.net/BLANK/cert8.db
diff --git a/test/aux-fixed/exim-ca/example.net/BLANK/key3.db b/test/aux-fixed/exim-ca/example.net/BLANK/key3.db
index d1a9ad944..78fa4ffbf 100644
--- a/test/aux-fixed/exim-ca/example.net/BLANK/key3.db
+++ b/test/aux-fixed/exim-ca/example.net/BLANK/key3.db
diff --git a/test/aux-fixed/exim-ca/example.net/CA/CA.pem b/test/aux-fixed/exim-ca/example.net/CA/CA.pem
index b48d20d40..8b2c0a5da 100644
--- a/test/aux-fixed/exim-ca/example.net/CA/CA.pem
+++ b/test/aux-fixed/exim-ca/example.net/CA/CA.pem
@@ -1,13 +1,13 @@
 -----BEGIN CERTIFICATE-----
-MIIB9jCCAV+gAwIBAgIBATANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
-cGxlLm5ldDEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwM1oX
-DTM4MDEwMTEyMzQwM1owLTEUMBIGA1UEChMLZXhhbXBsZS5uZXQxFTATBgNVBAMT
-DGNsaWNhIENBIHJzYTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA3kwC9CHz
-JH7sEDkHMdZRq8+XpV7l/hEqfv2gPvT3mak46dWrI/T3pJOqyNvUZV/LJ/gx/0uw
-9pmCg6Y5zNCN0qAGY4rSS/sbEOLYIw5wJbFnYfHtTwe3ZAdG+5WqKMBF2lHNBM3b
-PUB/kweoLhNLwserKHwMDC3sksfrwH29rpMCAwEAAaMmMCQwEgYDVR0TAQH/BAgw
-BgEB/wIBATAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADgYEAzXt6KHIB
-qOJfZECgwhAWipxVR0BXek0hAfyTWl7q18+mWKYydQW0Z2VMN4Bq/ZUlOg+EM8NU
-1n9PJ4+I2QgAwVVXN4+cz7zgZ6XRZc1OkE98NyK504bVpJpan1gsx3I5GLJUgP2t
-B/WwqoFO+ANhT2margZSM6avJfaIh8gEass=
+MIIB9jCCAV+gAwIBAgIBQTANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+cGxlLm5ldDEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQxNFoX
+DTM4MDEwMTEyMzQxNFowLTEUMBIGA1UEChMLZXhhbXBsZS5uZXQxFTATBgNVBAMT
+DGNsaWNhIENBIHJzYTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAs89Jw+yK
+ohiMwcSLAciqgj5CtxYRsoW1AmQrhD3QwE6es0RBjTGp5SNjjPlRxCZ5T+dQQXR1
+RirvSKH+isbd1ENIbS9dPgaR2mFUYwcSxUIRrXn4mkxZ/QtpTVOoY184lFAPhTrW
+et4o+wE9OI2e75RD5GdAyB/52paGplt+K38CAwEAAaMmMCQwEgYDVR0TAQH/BAgw
+BgEB/wIBATAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADgYEAOcXFUXls
+ChTDzMe2y+qv1YlOZbkf43S9je72ATYXzS7/eT8I4sAq/CFdgmn+lw5kHJlgxCag
+BPwuLYHW55r69WI1IwQHrJXaavyPSkonVgK+ZssEcQmqbgNj8oV5ZnyzYnNZv0VU
+nMl1n6nCl1xdUwPwhhdssGXEoX8OF5iMw4U=
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.net/CA/OCSP.key b/test/aux-fixed/exim-ca/example.net/CA/OCSP.key
index f7b826f74..2d9720449 100644
--- a/test/aux-fixed/exim-ca/example.net/CA/OCSP.key
+++ b/test/aux-fixed/exim-ca/example.net/CA/OCSP.key
@@ -1,20 +1,20 @@
 Bag Attributes
     friendlyName: OCSP Signer rsa
-    localKeyID: 53 BB 1F 68 6E BB 81 B7 1F CD FD 8C B0 08 7A D9 61 BC 81 79 
+    localKeyID: 62 C4 3D B8 CA D1 AA 6D 04 AB 53 AC 8C A3 27 B1 3F D5 40 55 
 Key Attributes: <No Attributes>
 -----BEGIN PRIVATE KEY-----
-MIICdQIBADANBgkqhkiG9w0BAQEFAASCAl8wggJbAgEAAoGBAKmmzvfGqq47MB1y
-7DsxXEYhlmLV+i0IN96elKWG9f0aExsitasvaxErD0lBijwHk4efsajdadla5Chf
-0J8RZn0eBQL7k5e6jiXvmKcvFDA0M5gXRLuh7CUjJWh6hMRRoMWaCc5DcdalL0EF
-OEhkm5PlVH2UgOvJCC6anG8UTeDXAgMBAAECgYAf56wCsw0ESUNKNoOwuh61Xbmv
-irhK4cHIDyC7ZH88gzvWnZd2wysqhmOQjk/V7ELVfbXmoQU4CDziTuqoD5irXmUe
-T02zYAaFYvMEQkLW9QiiKmQHpuhf5GUsEvxYe8qmpuVtCoygWCl0SppUxGRDpStS
-KCx87FTvWSJDBE3H+QJBAOInRyeXjKaUl0eYUySOuiAXl23amZpxVN+7gvjn9ewr
-TcWYkAsQF3yyA6n6PEYYe+FugSf+XhLcSpMRuvcGjNMCQQDACpV/R/JIjEC26AWq
-yWXhRV+1Wo3PZebInYsxDf9PBgtaeYLY8mrf65XhXgGC1Zg5bOgERMzL1pzOE78B
-3YltAkAIW5c/mVQzW85zcOextCygvv5zqt5+XK3cTtu6QyhNgBQxtz+riP61Nwb3
-oy3TEViSrjjLt5TWcZm38bHNK0rNAkAK2Q400GWZP4LwUg7v5MyCex666dCU5Jay
-wmN4c+f2GMtPYwnHI3pyB6bBwkOnllUw+Tvp8dD3urnE0ky52D/JAkAbX1GzRGNj
-HPICsVvPLUiLHFQHTjmkItJzkLqfN5rT6WFpGnmuAWw/f0QbjWx53ob2bRBEN17P
-5aANr4UJMFMd
+MIICdgIBADANBgkqhkiG9w0BAQEFAASCAmAwggJcAgEAAoGBALftYoVnXB0Ntc8L
++QFPfvndGjDy2YDm/5px+S+3149TTdDiQubE4sxJTcL8IXmU5SgA3/A4yL+poebM
+dRGVap4eMSCOdpAEURRAidhkYQrr2iiPpgU5WG30Q4Ae+14ZB/Dp9jXy/Rrjv6HJ
+aPUaYTy7iTRo6hxvXxdm1lpvHCz7AgMBAAECgYAGmeLO/HOtU0Pdg+lEQ8ZAGF6Z
+t82RfnHLIgRE75sxRuTkaDUiQZoNUHkVqaVXsoTlnsNOUtYShLBi9oJ3VPrw41RF
+x/sbwtAl8O55Ps4mHOS87ERsVwJBIL4luBXe6nuUJN3tA6UUo1y6t1AxVdcKQXuw
+WO0JnB33oNTDuo7UgQJBAOmVxKpFQeGeM0F1bu5jap2UrzMSrK78OwLmif+vHRlv
+sYFSfUXaEnw7RSrgtBNWb7tUw5i6RusrbRLpLVHOjzsCQQDJk7puqL26RasNYIf9
+bWyaV2qF0u0R6HoQH1IaBYJAOie68B1cvkpM1fhQYlT0Fm+iEM755xJaMy9mD0ph
+jn1BAkA+wvARtAQso/4vo2cIBIxcBNxCQ81EQx9z+w+vNJUEBZ/TGJ/ySdLXsHE4
+QSIBZCMnWXIosjxl6cgn4aE8rtyLAkAq5EVCMKOWVCauhQDKuxLl0H35FcWeDuKS
+Nafpo4xwkC9OBrOovVDgApOAvzumaHO+f2cbI8Dy8ns+czh3g7NBAkEAltBUuf9J
+M8pYnjy9NJL0zbJA2RrrWmMxcTOuYnAHlOzjKYqSjdigU9dAZB4HzNJMlML28tFs
+WZhVV9Y4ZxUvuQ==
 -----END PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.net/CA/OCSP.p12 b/test/aux-fixed/exim-ca/example.net/CA/OCSP.p12
index 7d604b43e..7b1763930 100644
--- a/test/aux-fixed/exim-ca/example.net/CA/OCSP.p12
+++ b/test/aux-fixed/exim-ca/example.net/CA/OCSP.p12
diff --git a/test/aux-fixed/exim-ca/example.net/CA/OCSP.pem b/test/aux-fixed/exim-ca/example.net/CA/OCSP.pem
index dd807941b..bb5fd8608 100644
--- a/test/aux-fixed/exim-ca/example.net/CA/OCSP.pem
+++ b/test/aux-fixed/exim-ca/example.net/CA/OCSP.pem
@@ -1,14 +1,14 @@
 -----BEGIN CERTIFICATE-----
-MIICDTCCAXagAwIBAgIBAzANBgkqhkiG9w0BAQsFADA3MRQwEgYDVQQKEwtleGFt
+MIICDTCCAXagAwIBAgIBQzANBgkqhkiG9w0BAQsFADA3MRQwEgYDVQQKEwtleGFt
 cGxlLm5ldDEfMB0GA1UEAxMWY2xpY2EgU2lnbmluZyBDZXJ0IHJzYTAeFw0xMjEx
-MDExMjM0MDNaFw0zODAxMDExMjM0MDNaMDYxFDASBgNVBAoTC2V4YW1wbGUubmV0
+MDExMjM0MTRaFw0zODAxMDExMjM0MTRaMDYxFDASBgNVBAoTC2V4YW1wbGUubmV0
 MR4wHAYDVQQDExVjbGljYSBPQ1NQIFNpZ25lciByc2EwgZ8wDQYJKoZIhvcNAQEB
-BQADgY0AMIGJAoGBAKmmzvfGqq47MB1y7DsxXEYhlmLV+i0IN96elKWG9f0aExsi
-tasvaxErD0lBijwHk4efsajdadla5Chf0J8RZn0eBQL7k5e6jiXvmKcvFDA0M5gX
-RLuh7CUjJWh6hMRRoMWaCc5DcdalL0EFOEhkm5PlVH2UgOvJCC6anG8UTeDXAgMB
+BQADgY0AMIGJAoGBALftYoVnXB0Ntc8L+QFPfvndGjDy2YDm/5px+S+3149TTdDi
+QubE4sxJTcL8IXmU5SgA3/A4yL+poebMdRGVap4eMSCOdpAEURRAidhkYQrr2iiP
+pgU5WG30Q4Ae+14ZB/Dp9jXy/Rrjv6HJaPUaYTy7iTRo6hxvXxdm1lpvHCz7AgMB
 AAGjKjAoMA4GA1UdDwEB/wQEAwIHgDAWBgNVHSUBAf8EDDAKBggrBgEFBQcDCTAN
-BgkqhkiG9w0BAQsFAAOBgQAlUlo3jGxtQ0d/SLb7UN1j73P6ZY0cDxkSHASza/6x
-4cnDXBiD3qdHugdYHKED/OOMxm8XK49wDj9c6s9GZy9hP9AOn/EPqTQxJge/IjXL
-P7B2fE9Zz+Dg5m3kMqyBzrB/oTXOD3t9CbRJCECawofQ+5/ANXFnVB8eWuPggw7R
-Jg==
+BgkqhkiG9w0BAQsFAAOBgQBe5cUVti0qB57EzmjbPpAlNQfO0mTNBauVY9LPBWIJ
+LItwQ0IZ4FtI+RqHdfmdREpl9Lac+qJ9xfOu/jnpGxMXiCrJ3LhR6M0chRvp0QgP
+0Hrsi1fhwLOaPLPo4uZHsIAiWMyGGJBD6k3g+pNfPp59z/PavNPH6m9ksqEPdzPw
+AQ==
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.net/CA/Signer.key b/test/aux-fixed/exim-ca/example.net/CA/Signer.key
index ae0a3f706..62d9269ee 100644
--- a/test/aux-fixed/exim-ca/example.net/CA/Signer.key
+++ b/test/aux-fixed/exim-ca/example.net/CA/Signer.key
@@ -1,20 +1,20 @@
 Bag Attributes
     friendlyName: Signing Cert rsa
-    localKeyID: 75 B1 07 68 61 48 3B 2E BF D9 57 2E 67 F1 ED 1E E4 00 97 1D 
+    localKeyID: 5A 0C 9A 97 E5 60 5D 52 7C D5 94 4C EF 06 96 C2 76 76 98 57 
 Key Attributes: <No Attributes>
 -----BEGIN PRIVATE KEY-----
-MIICdwIBADANBgkqhkiG9w0BAQEFAASCAmEwggJdAgEAAoGBALMuDick/uNCkK8z
-Wtdko5eynjJq0y8NVNlhSFkbwfjbxOQycuyMhMlYNnvsESWZTV5ckpsvoDrFQLFk
-6ZB7RVYHUoOHNfANm8JWC9GR5zqbquibA/MMQ4h2XlkzzQz12AzPpouZUyYs1+Sj
-wlgfBRVhtxApDR2bPEDzI6s9VUdXAgMBAAECgYAYIRAb2mIOxaSJS2+kyPM01wNx
-w6v7zp5KBc1B3riQ5DuQBXEvhL7PBHeV2ZT3jLz8A5hkmJXJxE1xdibz433THXTG
-71l+rNfZzNlmDjFpVI+Rwe8wqiNb5gi98jU5sSJHuW235el/TBps4yXgfMz4ZErN
-S7Lh7l6hhXOCVmzG6QJBAO6j9rnVC2heNzRnPz1o4j3a/8cvFanGzYkGTi89CbyP
-1ZVxgY855OyPiR7KwkIhHtnxB++42dMmrfKudpEuwgkCQQDANsxhsUynfNjG51Vp
-uj5giqzmMcGhUL1/URxorLt3Am3p6vmpSpMxS01NzYzwJvpO4rA3lWVZhdkyLLlH
-epZfAkEA11JQY3qsUV55Vyo1sHY7dO5uTU3ZsRe1CocK8qqTZ3UslSwWZ6IoQZ59
-bbArOTnjOWi27YEP4eqLl2X9i5/x6QJAB2cU3/5QEXNBdgeaxoOhu14b4pGv/2J4
-qdqZ2X4tihvR19xw2RBCMvfPdlugPe+CXF9mof1i9dutzbzjNdmGyQJBAOlnPy02
-myqvM9YoP6tbgwPJxN/9g5tne20Ji4F4u8gZC4vvk4oEbdV+OUkA07gIZL0KWkKi
-14t8FjtLaie2nk8=
+MIICdgIBADANBgkqhkiG9w0BAQEFAASCAmAwggJcAgEAAoGBAKFOi+80c9pb3Uid
+QJd+TQ9j9lmOlw3HlhRxYNadHL2jZ98OHrwlDB1JgToyPruZ9yLq26a7c6sLYqEv
+pHulS6ACUqYaqu9kKb8m4l7xlheoyLT/jkZjq4Z0owp8PhzYl4p3M23rQzNSXcHC
+xcwu+6KPJ8FgrdNuB2RmHU2M27wRAgMBAAECgYA36Evq3+CplX5oLQyWlTFrPKfF
+GX00SvEy66r3J2QvPCQDtNalOiftPK07+O8yQWZdJU51BvJLnboVCLi3HC7N3QOK
+aDAXgBGzIGG3DzccIybOc4pur52PkuCmVSM0Qq3tSx6sxPmEWacBgWaiFGGu15AM
+o/OhlI+mfP1RK4jIYwJBANXq4uNiGIACfHOUpQxcD8yQL16E92/CJqE4LyMemG7U
+eHzfYdLDlhlOPlZTgcf8NycnzYkiruXLYzmewtBvyisCQQDBCiEoQWviGwTNhSvV
+aZlLmbo6uzDweKyq7RyBHB7RacOwHQ9/ZigMiHtSQKxXZBhNOnXM2EyOfKDMsttm
+RCCzAkAhV64rsPOOqFSLk2Sya3sO8H5hpioHImTxBhfayn8J71YkaJEPz+qKYTa4
+L+XvrPFPyhVwRZarPKtnpMZKxNHnAkEAmnQVZZU60bXWmO6FzQLqAeBlblqaZL3Z
+QgXn+bHbQqlCRuZpoQDG6IhHS9+tRVs0So6M9LLYRmWXb1FoVKIMGwJALCHxYw/a
+EUsckc2aw+mI3nVKr2hkJRRbn2px0uWSzXY6i76EMw/X58SKsTQDGxX6oZFRQGW0
+TITUGwqrFxFV0A==
 -----END PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.net/CA/Signer.p12 b/test/aux-fixed/exim-ca/example.net/CA/Signer.p12
index 8bdf74131..02367d9eb 100644
--- a/test/aux-fixed/exim-ca/example.net/CA/Signer.p12
+++ b/test/aux-fixed/exim-ca/example.net/CA/Signer.p12
diff --git a/test/aux-fixed/exim-ca/example.net/CA/Signer.pem b/test/aux-fixed/exim-ca/example.net/CA/Signer.pem
index 34c6c36f2..6513c9044 100644
--- a/test/aux-fixed/exim-ca/example.net/CA/Signer.pem
+++ b/test/aux-fixed/exim-ca/example.net/CA/Signer.pem
@@ -1,14 +1,14 @@
 -----BEGIN CERTIFICATE-----
-MIICNDCCAZ2gAwIBAgIBAjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
-cGxlLm5ldDEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwM1oX
-DTM4MDEwMTEyMzQwM1owNzEUMBIGA1UEChMLZXhhbXBsZS5uZXQxHzAdBgNVBAMT
+MIICGDCCAYGgAwIBAgIBQjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+cGxlLm5ldDEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQxNFoX
+DTM4MDEwMTEyMzQxNFowNzEUMBIGA1UEChMLZXhhbXBsZS5uZXQxHzAdBgNVBAMT
 FmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
-AoGBALMuDick/uNCkK8zWtdko5eynjJq0y8NVNlhSFkbwfjbxOQycuyMhMlYNnvs
-ESWZTV5ckpsvoDrFQLFk6ZB7RVYHUoOHNfANm8JWC9GR5zqbquibA/MMQ4h2Xlkz
-zQz12AzPpouZUyYs1+SjwlgfBRVhtxApDR2bPEDzI6s9VUdXAgMBAAGjWjBYMA4G
-A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMDIGA1UdHwQrMCkwJ6Al
-oCOGIWh0dHA6Ly9jcmwuZXhhbXBsZS5uZXQvbGF0ZXN0LmNybDANBgkqhkiG9w0B
-AQsFAAOBgQDCXkPeCURjOJwCBgbLERuNghPiWLqHPopm1idM2A032jDgbRXD9/DP
-1xOPgSLEW59EiJac0RNae0D2KyhnG90NZLccXK0a9Uu1iaAmdcJ7s4a0x0ZH9Kza
-hqz0cr4oStUOHxG/AtPKuhZ9PkZ7GDSPDW0k/z64WYCm1fqSWkbVig==
+AoGBAKFOi+80c9pb3UidQJd+TQ9j9lmOlw3HlhRxYNadHL2jZ98OHrwlDB1JgToy
+PruZ9yLq26a7c6sLYqEvpHulS6ACUqYaqu9kKb8m4l7xlheoyLT/jkZjq4Z0owp8
+PhzYl4p3M23rQzNSXcHCxcwu+6KPJ8FgrdNuB2RmHU2M27wRAgMBAAGjPjA8MA4G
+A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMBYGA1UdDgQPBA1BQWJ0
+d0N4Y1hnYjBRMA0GCSqGSIb3DQEBCwUAA4GBAAUlBd0/XrkhQ6Gm8s44uOU/gSAe
+Ap8baRLuhTrrvzd+nPDBN0YbwVUMwd9TbY4MsmDy+GhE9/V8i8OydEshl2iE15+E
+JX2DJEmNd7RMfWb6EIZVuzFFDWRszxA14YdNvDXjwS6BYmsSWJsNH4P/eTRrTCJi
+C53ODVdhE6yCQs1m
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.net/CA/ca.conf b/test/aux-fixed/exim-ca/example.net/CA/ca.conf
index 2ebcda676..09e83063d 100644
--- a/test/aux-fixed/exim-ca/example.net/CA/ca.conf
+++ b/test/aux-fixed/exim-ca/example.net/CA/ca.conf
@@ -1,18 +1,18 @@
 ; Config::Simple 4.59
-; Thu Nov  1 12:34:03 2012
+; Thu Nov  1 12:34:14 2012
+
+[CA]
+org=example.net
+name=Certificate Authority rsa
+bits=1024
+subject=clica CA
 
 [CLICA]
-sighash=SHA256
+signer=Signing Cert rsa
 crl_url=http://crl.example.net/latest.crl
-level=1
 ocsp_url=http://oscp.example.net/
+sighash=SHA256
 ocsp_signer=OCSP Signer rsa
-signer=Signing Cert rsa
-
-[CA]
-subject=clica CA
-name=Certificate Authority rsa
-bits=1024
-org=example.net
+level=1
 
 
diff --git a/test/aux-fixed/exim-ca/example.net/CA/cert8.db b/test/aux-fixed/exim-ca/example.net/CA/cert8.db
index 372f1132f..5aa6b374c 100644
--- a/test/aux-fixed/exim-ca/example.net/CA/cert8.db
+++ b/test/aux-fixed/exim-ca/example.net/CA/cert8.db
diff --git a/test/aux-fixed/exim-ca/example.net/CA/crl.Signer b/test/aux-fixed/exim-ca/example.net/CA/crl.Signer
new file mode 100644
index 000000000..5fdfdb5e7
--- /dev/null
+++ b/test/aux-fixed/exim-ca/example.net/CA/crl.Signer
diff --git a/test/aux-fixed/exim-ca/example.net/CA/crl.Signer.in.txt b/test/aux-fixed/exim-ca/example.net/CA/crl.Signer.in.txt
new file mode 100644
index 000000000..8f00adf1e
--- /dev/null
+++ b/test/aux-fixed/exim-ca/example.net/CA/crl.Signer.in.txt
@@ -0,0 +1 @@
+update=20171217205108Z 
diff --git a/test/aux-fixed/exim-ca/example.net/CA/crl.Signer.pem b/test/aux-fixed/exim-ca/example.net/CA/crl.Signer.pem
new file mode 100644
index 000000000..6f4ab63ab
--- /dev/null
+++ b/test/aux-fixed/exim-ca/example.net/CA/crl.Signer.pem
@@ -0,0 +1,7 @@
+-----BEGIN X509 CRL-----
+MIHnMFICAQEwDQYJKoZIhvcNAQELBQAwLTEUMBIGA1UEChMLZXhhbXBsZS5uZXQx
+FTATBgNVBAMTDGNsaWNhIENBIHJzYRgPMjAxNzEyMTcyMDUxMDhaMA0GCSqGSIb3
+DQEBCwUAA4GBAGWZ1eVxdihOylK+Mts4bHZn1mIy4brvfqJk9kwwblJ0tJj0u7PD
+32XxwBxOgDOW9KCYC+xL2ObsUe8aRax8c8bpLzLrDm1DOMNqL7WULOeoid4UWLZf
+Qd+NclW3/1aa9oUa2RJJ45rIfTDRB7c3wr+0YkD7cX9oMtJ3IgGctR7s
+-----END X509 CRL-----
diff --git a/test/aux-fixed/exim-ca/example.net/CA/crl.empty b/test/aux-fixed/exim-ca/example.net/CA/crl.empty
index bbca4d630..565cd2016 100644
--- a/test/aux-fixed/exim-ca/example.net/CA/crl.empty
+++ b/test/aux-fixed/exim-ca/example.net/CA/crl.empty
diff --git a/test/aux-fixed/exim-ca/example.net/CA/crl.empty.in.txt b/test/aux-fixed/exim-ca/example.net/CA/crl.empty.in.txt
index 5c3cda501..dc66bdfc9 100644
--- a/test/aux-fixed/exim-ca/example.net/CA/crl.empty.in.txt
+++ b/test/aux-fixed/exim-ca/example.net/CA/crl.empty.in.txt
@@ -1 +1 @@
-update=20171105161901Z 
+update=20171217205106Z 
diff --git a/test/aux-fixed/exim-ca/example.net/CA/crl.empty.pem b/test/aux-fixed/exim-ca/example.net/CA/crl.empty.pem
index a71c9c797..a1ec2e518 100644
--- a/test/aux-fixed/exim-ca/example.net/CA/crl.empty.pem
+++ b/test/aux-fixed/exim-ca/example.net/CA/crl.empty.pem
@@ -1,8 +1,8 @@
 -----BEGIN X509 CRL-----
 MIHxMFwCAQEwDQYJKoZIhvcNAQELBQAwNzEUMBIGA1UEChMLZXhhbXBsZS5uZXQx
-HzAdBgNVBAMTFmNsaWNhIFNpZ25pbmcgQ2VydCByc2EYDzIwMTcxMTA1MTYxOTAx
-WjANBgkqhkiG9w0BAQsFAAOBgQA0kBwok3/EQWTCJ8zQRDz1Gjm1BL+E2cb/8DFg
-wIXTVWUkKqL8SsmufLrY8cb5qrCzFnhklOxaXC4vUB305qiMmfrECsXaGKn1udYQ
-90CLyLO5rJQzp6gpFp8Xe5W6Tx7ftfSQFaft63Knb+kT1BgzvWt4kZYeB36Om7v6
-fwtmXA==
+HzAdBgNVBAMTFmNsaWNhIFNpZ25pbmcgQ2VydCByc2EYDzIwMTcxMjE3MjA1MTA2
+WjANBgkqhkiG9w0BAQsFAAOBgQAFrYL7zpUpEIizo66Gus5y9BeRPUeHFOc5YVL1
+sii6FqIrDtBJZjUvf+11ED5sdVrJN2T3rxbDPpm6NyBHjW7Tz69Tx1FjyMpRhkTC
+XKMCZIjysxYiteO7dcHgpJ4jHxO6UHd61CCOQKbX79oRF4Sfa2ABAxcWBsO0Ce/C
+/bUP1Q==
 -----END X509 CRL-----
diff --git a/test/aux-fixed/exim-ca/example.net/CA/crl.v2 b/test/aux-fixed/exim-ca/example.net/CA/crl.v2
index 46ff265e0..24335b8cc 100644
--- a/test/aux-fixed/exim-ca/example.net/CA/crl.v2
+++ b/test/aux-fixed/exim-ca/example.net/CA/crl.v2
diff --git a/test/aux-fixed/exim-ca/example.net/CA/crl.v2.in.txt b/test/aux-fixed/exim-ca/example.net/CA/crl.v2.in.txt
index 20311aa93..7c2dcd446 100644
--- a/test/aux-fixed/exim-ca/example.net/CA/crl.v2.in.txt
+++ b/test/aux-fixed/exim-ca/example.net/CA/crl.v2.in.txt
@@ -1,3 +1,3 @@
-update=20171105161903Z 
-addcert 102 20171105161903Z
-addcert 202 20171105161903Z
+update=20171217205108Z 
+addcert 102 20171217205108Z
+addcert 202 20171217205108Z
diff --git a/test/aux-fixed/exim-ca/example.net/CA/crl.v2.pem b/test/aux-fixed/exim-ca/example.net/CA/crl.v2.pem
index 555c14759..4c30664c5 100644
--- a/test/aux-fixed/exim-ca/example.net/CA/crl.v2.pem
+++ b/test/aux-fixed/exim-ca/example.net/CA/crl.v2.pem
@@ -1,9 +1,9 @@
 -----BEGIN X509 CRL-----
 MIIBITCBiwIBATANBgkqhkiG9w0BAQsFADA3MRQwEgYDVQQKEwtleGFtcGxlLm5l
-dDEfMB0GA1UEAxMWY2xpY2EgU2lnbmluZyBDZXJ0IHJzYRgPMjAxNzExMDUxNjE5
-MDNaMC0wFAIBZhgPMjAxNzExMDUxNjE5MDNaMBUCAgDKGA8yMDE3MTEwNTE2MTkw
-M1owDQYJKoZIhvcNAQELBQADgYEAljNKSLoRFHBtaoS6FNgra+O+ssbZzFpWOtK4
-l30UXD5ZmDTb70XrOZ8mQ2LbhJxMQSHoKYiSJw7gFu48CwjcVCd6UPDzRs9DRIM+
-lHqWU8DrsADTYnSBJSD4kPxK+HX9iw7KX5UZVeFOdj++p6JEG4ijEOOOkPeJ6C/9
-NCu2bns=
+dDEfMB0GA1UEAxMWY2xpY2EgU2lnbmluZyBDZXJ0IHJzYRgPMjAxNzEyMTcyMDUx
+MDhaMC0wFAIBZhgPMjAxNzEyMTcyMDUxMDhaMBUCAgDKGA8yMDE3MTIxNzIwNTEw
+OFowDQYJKoZIhvcNAQELBQADgYEAaKKqlVNZJTNZ2EjUoAB3C8SO2sXomGeNrJZl
+xvm/9QkGbxDOcjjpWEBJ8ffcg97m/sT9WY9dseofUN1sAzm2xoNB+VJkLFBbhJH0
+rqJZLCTUh9LG0c7IY3/Rrb/AEUVl/5+XvDdtc+QJo8ywY+oVB7ccW1iEvjtzfg1G
+n25kDno=
 -----END X509 CRL-----
diff --git a/test/aux-fixed/exim-ca/example.net/CA/index.revoked.txt.attr b/test/aux-fixed/exim-ca/example.net/CA/index.revoked.txt.attr
new file mode 100644
index 000000000..8f7e63a34
--- /dev/null
+++ b/test/aux-fixed/exim-ca/example.net/CA/index.revoked.txt.attr
@@ -0,0 +1 @@
+unique_subject = yes
diff --git a/test/aux-fixed/exim-ca/example.net/CA/index.valid.txt.attr b/test/aux-fixed/exim-ca/example.net/CA/index.valid.txt.attr
new file mode 100644
index 000000000..8f7e63a34
--- /dev/null
+++ b/test/aux-fixed/exim-ca/example.net/CA/index.valid.txt.attr
@@ -0,0 +1 @@
+unique_subject = yes
diff --git a/test/aux-fixed/exim-ca/example.net/CA/key3.db b/test/aux-fixed/exim-ca/example.net/CA/key3.db
index c392363b6..9ac925099 100644
--- a/test/aux-fixed/exim-ca/example.net/CA/key3.db
+++ b/test/aux-fixed/exim-ca/example.net/CA/key3.db
diff --git a/test/aux-fixed/exim-ca/example.net/CA/noise.file b/test/aux-fixed/exim-ca/example.net/CA/noise.file
index bce75de82..8cd258c7b 100644
--- a/test/aux-fixed/exim-ca/example.net/CA/noise.file
+++ b/test/aux-fixed/exim-ca/example.net/CA/noise.file
@@ -46,7 +46,7 @@ cpuid level	: 22
 wp		: yes
 flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc art arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf tsc_known_freq pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch cpuid_fault epb intel_pt tpr_shadow vnmi flexpriority ept vpid fsgsbase tsc_adjust bmi1 hle avx2 smep bmi2 erms invpcid rtm mpx rdseed adx smap clflushopt xsaveopt xsavec xgetbv1 xsaves dtherm ida arat pln pts hwp hwp_notify hwp_act_window hwp_epp
 bugs		:
-bogomips	: 5431.34
+bogomips	: 5424.00
 clflush size	: 64
 cache_alignment	: 64
 address sizes	: 39 bits physical, 48 bits virtual
@@ -73,7 +73,7 @@ cpuid level	: 22
 wp		: yes
 flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc art arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf tsc_known_freq pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch cpuid_fault epb intel_pt tpr_shadow vnmi flexpriority ept vpid fsgsbase tsc_adjust bmi1 hle avx2 smep bmi2 erms invpcid rtm mpx rdseed adx smap clflushopt xsaveopt xsavec xgetbv1 xsaves dtherm ida arat pln pts hwp hwp_notify hwp_act_window hwp_epp
 bugs		:
-bogomips	: 5431.79
+bogomips	: 5424.00
 clflush size	: 64
 cache_alignment	: 64
 address sizes	: 39 bits physical, 48 bits virtual
@@ -100,7 +100,7 @@ cpuid level	: 22
 wp		: yes
 flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc art arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf tsc_known_freq pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch cpuid_fault epb intel_pt tpr_shadow vnmi flexpriority ept vpid fsgsbase tsc_adjust bmi1 hle avx2 smep bmi2 erms invpcid rtm mpx rdseed adx smap clflushopt xsaveopt xsavec xgetbv1 xsaves dtherm ida arat pln pts hwp hwp_notify hwp_act_window hwp_epp
 bugs		:
-bogomips	: 5431.63
+bogomips	: 5424.00
 clflush size	: 64
 cache_alignment	: 64
 address sizes	: 39 bits physical, 48 bits virtual
@@ -127,7 +127,7 @@ cpuid level	: 22
 wp		: yes
 flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc art arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf tsc_known_freq pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch cpuid_fault epb intel_pt tpr_shadow vnmi flexpriority ept vpid fsgsbase tsc_adjust bmi1 hle avx2 smep bmi2 erms invpcid rtm mpx rdseed adx smap clflushopt xsaveopt xsavec xgetbv1 xsaves dtherm ida arat pln pts hwp hwp_notify hwp_act_window hwp_epp
 bugs		:
-bogomips	: 5434.63
+bogomips	: 5424.00
 clflush size	: 64
 cache_alignment	: 64
 address sizes	: 39 bits physical, 48 bits virtual
@@ -154,7 +154,7 @@ cpuid level	: 22
 wp		: yes
 flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc art arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf tsc_known_freq pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch cpuid_fault epb intel_pt tpr_shadow vnmi flexpriority ept vpid fsgsbase tsc_adjust bmi1 hle avx2 smep bmi2 erms invpcid rtm mpx rdseed adx smap clflushopt xsaveopt xsavec xgetbv1 xsaves dtherm ida arat pln pts hwp hwp_notify hwp_act_window hwp_epp
 bugs		:
-bogomips	: 5432.00
+bogomips	: 5424.00
 clflush size	: 64
 cache_alignment	: 64
 address sizes	: 39 bits physical, 48 bits virtual
@@ -181,7 +181,7 @@ cpuid level	: 22
 wp		: yes
 flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc art arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf tsc_known_freq pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch cpuid_fault epb intel_pt tpr_shadow vnmi flexpriority ept vpid fsgsbase tsc_adjust bmi1 hle avx2 smep bmi2 erms invpcid rtm mpx rdseed adx smap clflushopt xsaveopt xsavec xgetbv1 xsaves dtherm ida arat pln pts hwp hwp_notify hwp_act_window hwp_epp
 bugs		:
-bogomips	: 5431.94
+bogomips	: 5424.00
 clflush size	: 64
 cache_alignment	: 64
 address sizes	: 39 bits physical, 48 bits virtual
@@ -208,85 +208,86 @@ cpuid level	: 22
 wp		: yes
 flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc art arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf tsc_known_freq pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch cpuid_fault epb intel_pt tpr_shadow vnmi flexpriority ept vpid fsgsbase tsc_adjust bmi1 hle avx2 smep bmi2 erms invpcid rtm mpx rdseed adx smap clflushopt xsaveopt xsavec xgetbv1 xsaves dtherm ida arat pln pts hwp hwp_notify hwp_act_window hwp_epp
 bugs		:
-bogomips	: 5431.94
+bogomips	: 5424.00
 clflush size	: 64
 cache_alignment	: 64
 address sizes	: 39 bits physical, 48 bits virtual
 power management:
 
             CPU0       CPU1       CPU2       CPU3       CPU4       CPU5       CPU6       CPU7       
-   0:         70          0          0          0          0          0          0          0  IR-IO-APIC    2-edge      timer
-   1:         39      16476       1416       1089       6857       1983       1674       1959  IR-IO-APIC    1-edge      i8042
-   8:          0          0          1          0          0          0          0          0  IR-IO-APIC    8-edge      rtc0
-   9:        284       4834       2265       1628       7027       2758       1632       1695  IR-IO-APIC    9-fasteoi   acpi
-  12:        273    1626151      37392      40715     288530      39254      36081      51183  IR-IO-APIC   12-edge      i8042
-  16:          1          0          0          0          0          0          0          0  IR-IO-APIC   16-fasteoi   i801_smbus
+   0:         75          0          0          0          0          0          0          0  IR-IO-APIC    2-edge      timer
+   1:      69775       6441       4183       4351       8821       6710       4808       2655  IR-IO-APIC    1-edge      i8042
+   8:          1          0          0          0          0          0          0          0  IR-IO-APIC    8-edge      rtc0
+   9:     116958      16080      12437      10549      27759      16386      11560       7036  IR-IO-APIC    9-fasteoi   acpi
+  12:    5146732     362636     240016     241533     534196     383274     265445     167959  IR-IO-APIC   12-edge      i8042
+  16:          3          0          0          0          0          0          0          0  IR-IO-APIC   16-fasteoi   i801_smbus
  120:          0          0          0          0          0          0          0          0  DMAR-MSI    0-edge      dmar0
  121:          0          0          0          0          0          0          0          0  DMAR-MSI    1-edge      dmar1
- 122:       7136       3040       2312       1908       4546       3822      75943       2347  IR-PCI-MSI 376832-edge      ahci[0000:00:17.0]
- 123:         22          7          1          0          7          3          4          1  IR-PCI-MSI 327680-edge      xhci_hcd
- 124:         89         19         22         25         79         55         27         54  IR-PCI-MSI 2097152-edge      rtsx_pci
- 125:         88         15     127558         11         48         25         19         21  IR-PCI-MSI 520192-edge      enp0s31f6
- 126:          1          1          1          0          3          1          3          6  IR-PCI-MSI 1048576-edge    
- 127:        561        174         98     789305        240        230        184        147  IR-PCI-MSI 32768-edge      i915
- 128:         34         14          0          0          1          0          0          0  IR-PCI-MSI 360448-edge      mei_me
- 129:         22         10          0          1         10          0          0          0  IR-PCI-MSI 1572864-edge      iwlwifi
- 130:         92        103         30         22        194        115         10         45  IR-PCI-MSI 514048-edge      snd_hda_intel:card0
- NMI:          9         12          9         14         10          9          9         10   Non-maskable interrupts
- LOC:     567497     554673     726762    1034458     583903     592347     624108     548791   Local timer interrupts
+ 122:      40662       2645       2048    8326184       3083       2651       2210       2042  IR-PCI-MSI 376832-edge      ahci[0000:00:17.0]
+ 123:         50          3          7          1          9          3          5          0  IR-PCI-MSI 327680-edge      xhci_hcd
+ 124:        269         24         28         20        104        171         22         48  IR-PCI-MSI 2097152-edge      rtsx_pci
+ 125:         38          0          0          0          0         10          0          4  IR-PCI-MSI 360448-edge      mei_me
+ 126:          2          0          3          0          1          2         24          0  IR-PCI-MSI 1048576-edge    
+ 127:       2247         56         54         23    3782468         37         26         18  IR-PCI-MSI 32768-edge      i915
+ 128:         77          0          0          0          2         32          8          1  IR-PCI-MSI 514048-edge      snd_hda_intel:card0
+ 129:         18          2          0          4          8          0          4      24684  IR-PCI-MSI 1572864-edge      iwlwifi
+ 130:        658          1          0          0          0          8          5   13518768  IR-PCI-MSI 520192-edge      enp0s31f6
+ NMI:        607       2649       2621       2522       2484       2424       2424       2470   Non-maskable interrupts
+ LOC:   29013600   29908567   29752721   28952298   29023548   28520116   28468408   28815966   Local timer interrupts
  SPU:          0          0          0          0          0          0          0          0   Spurious interrupts
- PMI:          9         12          9         14         10          9          9         10   Performance monitoring interrupts
- IWI:          0          1          0          0          0          0          2          0   IRQ work interrupts
- RTR:          7          0          0          0          0          0          0          0   APIC ICR read retries
- RES:      85573      31055      11911       8316       7459       6910       6400       5898   Rescheduling interrupts
- CAL:      73161      74171      68752      70655      80168      75208      61391      70903   Function call interrupts
- TLB:      55150      56119      50377      53791      62195      57072      43366      55765   TLB shootdowns
- TRM:          0          0          0          0          0          0          0          0   Thermal event interrupts
+ PMI:        607       2649       2621       2522       2484       2424       2424       2470   Performance monitoring interrupts
+ IWI:          6          4          3          2         10          4          3          1   IRQ work interrupts
+ RTR:         18          0          0          0          0          0          0          0   APIC ICR read retries
+ RES:    7885527    3950261    2715187    2193513    2473698    1957554    1665356    1987982   Rescheduling interrupts
+ CAL:     987291     866818     901402     885321     915798     938469     935939     966681   Function call interrupts
+ TLB:     231525     195523     218511     215448     205509     204323     194087     201607   TLB shootdowns
+ TRM:    1627777    1627777    1627777    1627777    1627777    1627777    1627777    1627777   Thermal event interrupts
  THR:          0          0          0          0          0          0          0          0   Threshold APIC interrupts
  DFR:          0          0          0          0          0          0          0          0   Deferred Error APIC interrupts
  MCE:          0          0          0          0          0          0          0          0   Machine check exceptions
- MCP:         49         49         49         49         49         49         49         49   Machine check polls
+ MCP:        202        200        200        200        200        200        200        200   Machine check polls
+ HYP:          0          0          0          0          0          0          0          0   Hypervisor callback interrupts
  ERR:          0
  MIS:          0
  PIN:          0          0          0          0          0          0          0          0   Posted-interrupt notification event
  NPI:          0          0          0          0          0          0          0          0   Nested posted-interrupt event
  PIW:          0          0          0          0          0          0          0          0   Posted-interrupt wakeup event
-MemTotal:       15852528 kB
-MemFree:        10535328 kB
-MemAvailable:   12483184 kB
-Buffers:          128136 kB
-Cached:          1542012 kB
-SwapCached:            0 kB
-Active:          3133856 kB
-Inactive:        1816836 kB
-Active(anon):    2706508 kB
-Inactive(anon):    79680 kB
-Active(file):     427348 kB
-Inactive(file):  1737156 kB
-Unevictable:          32 kB
-Mlocked:              32 kB
-SwapTotal:       7933948 kB
-SwapFree:        7933948 kB
-Dirty:              3596 kB
-Writeback:             0 kB
-AnonPages:       2975520 kB
-Mapped:           495452 kB
-Shmem:             80740 kB
-Slab:             143660 kB
-SReclaimable:      74472 kB
-SUnreclaim:        69188 kB
-KernelStack:        9188 kB
-PageTables:        38964 kB
+MemTotal:       16293504 kB
+MemFree:          934856 kB
+MemAvailable:   13704060 kB
+Buffers:          452228 kB
+Cached:         12441152 kB
+SwapCached:       101680 kB
+Active:          2599816 kB
+Inactive:       12195548 kB
+Active(anon):    1356404 kB
+Inactive(anon):   588700 kB
+Active(file):    1243412 kB
+Inactive(file): 11606848 kB
+Unevictable:          64 kB
+Mlocked:              64 kB
+SwapTotal:       8212476 kB
+SwapFree:        7376112 kB
+Dirty:             10832 kB
+Writeback:             4 kB
+AnonPages:       1871576 kB
+Mapped:           415968 kB
+Shmem:            290116 kB
+Slab:             351256 kB
+SReclaimable:     257264 kB
+SUnreclaim:        93992 kB
+KernelStack:       12848 kB
+PageTables:        58588 kB
 NFS_Unstable:          0 kB
 Bounce:                0 kB
 WritebackTmp:          0 kB
-CommitLimit:    15860212 kB
-Committed_AS:   11692028 kB
+CommitLimit:    16359228 kB
+Committed_AS:    7868784 kB
 VmallocTotal:   34359738367 kB
 VmallocUsed:           0 kB
 VmallocChunk:          0 kB
 HardwareCorrupted:     0 kB
-AnonHugePages:    966656 kB
+AnonHugePages:         0 kB
 ShmemHugePages:        0 kB
 ShmemPmdMapped:        0 kB
 CmaTotal:              0 kB
@@ -296,15 +297,14 @@ HugePages_Free:        0
 HugePages_Rsvd:        0
 HugePages_Surp:        0
 Hugepagesize:       2048 kB
-DirectMap4k:      202752 kB
-DirectMap2M:     7602176 kB
-DirectMap1G:     9437184 kB
+DirectMap4k:      523752 kB
+DirectMap2M:    16115712 kB
+DirectMap1G:     1048576 kB
 Inter-|   Receive                                                |  Transmit
  face |bytes    packets errs drop fifo frame compressed multicast|bytes    packets errs drop fifo colls carrier compressed
-virbr1:  353867    2838    0    0    0     0          0         0  1474230    3810    0    0    0     0       0          0
-enp0s31f6: 43448732   65083    0    0    0     0          0      2074  6948879   57082    0    0    0     0       0          0
-virbr1-nic:       0       0    0    0    0     0          0         0        0       0    0    0    0     0       0          0
-tun_wizint: 4130741    7381    0    0    0     0          0         0  1092175    8002    0    0    0     0       0          0
-    lo:    5706      74    0    0    0     0          0         0     5706      74    0    0    0     0       0          0
- vnet0:  393599    2838    0    0    0     0          0         0  1609950    6362    0    0    0     0       0          0
-wlp3s0:       0       0    0    0    0     0          0         0        0       0    0    0    0     0       0          0
+enp0s31f6: 9760816648 13664538    0    0    0     0          0      8965 118421394195 83833297    0    0    0     0       0          0
+wlp3s0: 3643580    7768    0    0    0     0          0         0  4732829    8244    0    0    0     0       0          0
+    lo: 9996035   41708    0    0    0     0          0         0  9996035   41708    0    0    0     0       0          0
+virbr0-nic:       0       0    0    0    0     0          0         0        0       0    0    0    0     0       0          0
+  tun0: 20139456   21861    0    0    0     0          0         0  3370846   19686    0    0    0     0       0          0
+virbr0: 47538577  146404    0    0    0     0          0         0 164360816  210422    0    0    0     0       0          0
diff --git a/test/aux-fixed/exim-ca/example.net/expired1.example.net/ca_chain.pem b/test/aux-fixed/exim-ca/example.net/expired1.example.net/ca_chain.pem
index fef1020ef..3beef64e5 100644
--- a/test/aux-fixed/exim-ca/example.net/expired1.example.net/ca_chain.pem
+++ b/test/aux-fixed/exim-ca/example.net/expired1.example.net/ca_chain.pem
@@ -3,33 +3,33 @@ Bag Attributes
 subject=/O=example.net/CN=clica Signing Cert rsa
 issuer=/O=example.net/CN=clica CA rsa
 -----BEGIN CERTIFICATE-----
-MIICNDCCAZ2gAwIBAgIBAjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
-cGxlLm5ldDEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwM1oX
-DTM4MDEwMTEyMzQwM1owNzEUMBIGA1UEChMLZXhhbXBsZS5uZXQxHzAdBgNVBAMT
+MIICGDCCAYGgAwIBAgIBQjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+cGxlLm5ldDEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQxNFoX
+DTM4MDEwMTEyMzQxNFowNzEUMBIGA1UEChMLZXhhbXBsZS5uZXQxHzAdBgNVBAMT
 FmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
-AoGBALMuDick/uNCkK8zWtdko5eynjJq0y8NVNlhSFkbwfjbxOQycuyMhMlYNnvs
-ESWZTV5ckpsvoDrFQLFk6ZB7RVYHUoOHNfANm8JWC9GR5zqbquibA/MMQ4h2Xlkz
-zQz12AzPpouZUyYs1+SjwlgfBRVhtxApDR2bPEDzI6s9VUdXAgMBAAGjWjBYMA4G
-A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMDIGA1UdHwQrMCkwJ6Al
-oCOGIWh0dHA6Ly9jcmwuZXhhbXBsZS5uZXQvbGF0ZXN0LmNybDANBgkqhkiG9w0B
-AQsFAAOBgQDCXkPeCURjOJwCBgbLERuNghPiWLqHPopm1idM2A032jDgbRXD9/DP
-1xOPgSLEW59EiJac0RNae0D2KyhnG90NZLccXK0a9Uu1iaAmdcJ7s4a0x0ZH9Kza
-hqz0cr4oStUOHxG/AtPKuhZ9PkZ7GDSPDW0k/z64WYCm1fqSWkbVig==
+AoGBAKFOi+80c9pb3UidQJd+TQ9j9lmOlw3HlhRxYNadHL2jZ98OHrwlDB1JgToy
+PruZ9yLq26a7c6sLYqEvpHulS6ACUqYaqu9kKb8m4l7xlheoyLT/jkZjq4Z0owp8
+PhzYl4p3M23rQzNSXcHCxcwu+6KPJ8FgrdNuB2RmHU2M27wRAgMBAAGjPjA8MA4G
+A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMBYGA1UdDgQPBA1BQWJ0
+d0N4Y1hnYjBRMA0GCSqGSIb3DQEBCwUAA4GBAAUlBd0/XrkhQ6Gm8s44uOU/gSAe
+Ap8baRLuhTrrvzd+nPDBN0YbwVUMwd9TbY4MsmDy+GhE9/V8i8OydEshl2iE15+E
+JX2DJEmNd7RMfWb6EIZVuzFFDWRszxA14YdNvDXjwS6BYmsSWJsNH4P/eTRrTCJi
+C53ODVdhE6yCQs1m
 -----END CERTIFICATE-----
 Bag Attributes
     friendlyName: Certificate Authority rsa
 subject=/O=example.net/CN=clica CA rsa
 issuer=/O=example.net/CN=clica CA rsa
 -----BEGIN CERTIFICATE-----
-MIIB9jCCAV+gAwIBAgIBATANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
-cGxlLm5ldDEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwM1oX
-DTM4MDEwMTEyMzQwM1owLTEUMBIGA1UEChMLZXhhbXBsZS5uZXQxFTATBgNVBAMT
-DGNsaWNhIENBIHJzYTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA3kwC9CHz
-JH7sEDkHMdZRq8+XpV7l/hEqfv2gPvT3mak46dWrI/T3pJOqyNvUZV/LJ/gx/0uw
-9pmCg6Y5zNCN0qAGY4rSS/sbEOLYIw5wJbFnYfHtTwe3ZAdG+5WqKMBF2lHNBM3b
-PUB/kweoLhNLwserKHwMDC3sksfrwH29rpMCAwEAAaMmMCQwEgYDVR0TAQH/BAgw
-BgEB/wIBATAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADgYEAzXt6KHIB
-qOJfZECgwhAWipxVR0BXek0hAfyTWl7q18+mWKYydQW0Z2VMN4Bq/ZUlOg+EM8NU
-1n9PJ4+I2QgAwVVXN4+cz7zgZ6XRZc1OkE98NyK504bVpJpan1gsx3I5GLJUgP2t
-B/WwqoFO+ANhT2margZSM6avJfaIh8gEass=
+MIIB9jCCAV+gAwIBAgIBQTANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+cGxlLm5ldDEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQxNFoX
+DTM4MDEwMTEyMzQxNFowLTEUMBIGA1UEChMLZXhhbXBsZS5uZXQxFTATBgNVBAMT
+DGNsaWNhIENBIHJzYTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAs89Jw+yK
+ohiMwcSLAciqgj5CtxYRsoW1AmQrhD3QwE6es0RBjTGp5SNjjPlRxCZ5T+dQQXR1
+RirvSKH+isbd1ENIbS9dPgaR2mFUYwcSxUIRrXn4mkxZ/QtpTVOoY184lFAPhTrW
+et4o+wE9OI2e75RD5GdAyB/52paGplt+K38CAwEAAaMmMCQwEgYDVR0TAQH/BAgw
+BgEB/wIBATAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADgYEAOcXFUXls
+ChTDzMe2y+qv1YlOZbkf43S9je72ATYXzS7/eT8I4sAq/CFdgmn+lw5kHJlgxCag
+BPwuLYHW55r69WI1IwQHrJXaavyPSkonVgK+ZssEcQmqbgNj8oV5ZnyzYnNZv0VU
+nMl1n6nCl1xdUwPwhhdssGXEoX8OF5iMw4U=
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.net/expired1.example.net/cert8.db b/test/aux-fixed/exim-ca/example.net/expired1.example.net/cert8.db
index 9d88971c0..bee4de063 100644
--- a/test/aux-fixed/exim-ca/example.net/expired1.example.net/cert8.db
+++ b/test/aux-fixed/exim-ca/example.net/expired1.example.net/cert8.db
diff --git a/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.chain.pem b/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.chain.pem
index 415238ac0..74e2dc7b9 100644
--- a/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.chain.pem
+++ b/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.chain.pem
@@ -1,35 +1,35 @@
 Bag Attributes
     friendlyName: expired1.example.net
-    localKeyID: F8 8C 05 1E F2 1C 44 26 76 14 77 28 6F 4B C8 10 A6 E5 E1 A0 
+    localKeyID: 01 11 9A C0 58 86 76 AD 43 C8 AD 6E B7 D8 88 6A 00 8D 27 AB 
 subject=/CN=expired1.example.net
 issuer=/O=example.net/CN=clica Signing Cert rsa
 -----BEGIN CERTIFICATE-----
 MIICjTCCAfagAwIBAgIBZzANBgkqhkiG9w0BAQsFADA3MRQwEgYDVQQKEwtleGFt
 cGxlLm5ldDEfMB0GA1UEAxMWY2xpY2EgU2lnbmluZyBDZXJ0IHJzYTAeFw0xMjEx
-MDExMjM0MDNaFw0xMjEyMDExMjM0MDNaMB8xHTAbBgNVBAMTFGV4cGlyZWQxLmV4
-YW1wbGUubmV0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC6sferp1lp0jW/
-rpTqM3glt5VEOHO3w5a4nvEplLqNbZSUNAqgMhw1nXsYA0xfCeS0zCaEvuK9U58Q
-jxddvQxGEbtF1wFWPHa0P3HuEuZpQxstgr+Dmjh2v2C8cu6gA/8/0AM/JEQ1pPMj
-wXAGaCRtkUhY7RW+X4t9sgjjrH68hwIDAQABo4HAMIG9MA4GA1UdDwEB/wQEAwIE
+MDExMjM0MTVaFw0xMjEyMDExMjM0MTVaMB8xHTAbBgNVBAMTFGV4cGlyZWQxLmV4
+YW1wbGUubmV0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCwzxfp2vYw5w96
+4Eq57WBMZdmZZ4B27eqMV2gGS7fINlWoUqR6JsClfrBJ5A60LjsvPF2ccr9uyG6r
+mLlarc0kXBREXRpZdmcxX04MS7lu/1TnGem170ZzldtTXV/Z7UHukvDID+tYV2X2
+aTQblO2JbE1+9F2tXILc9TSX9fbBNQIDAQABo4HAMIG9MA4GA1UdDwEB/wQEAwIE
 8DAgBgNVHSUBAf8EFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwMgYDVR0fBCswKTAn
 oCWgI4YhaHR0cDovL2NybC5leGFtcGxlLm5ldC9sYXRlc3QuY3JsMDQGCCsGAQUF
 BwEBBCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29zY3AuZXhhbXBsZS5uZXQvMB8G
 A1UdEQQYMBaCFGV4cGlyZWQxLmV4YW1wbGUubmV0MA0GCSqGSIb3DQEBCwUAA4GB
-ACLOp0fuRcZP3yahPxZ0zOX73LmUCS3NAksjvmwBUMR0jvI+454qu9XkxfsKJ8pJ
-4bK+gJinpd2U6j+UXeU46aQ5x1ilJvMBE2EiOINRgQZB+5OC7ihn73uW4B0OLU1V
-DiEUk8LeYjWAks6AnxHJfbihkxoe8+aNdORFiSp3lmNd
+ABHsEhKoJeK909uBPQLCZVVVGiHybCGkoXbf3iLR8lQsEHrHi1B2Jh4b8UbHH/Co
+PmDmpRpbpQOjawMDQIRZxr5NJlBFSDHC9XN1LfIarevXrqmHz4YnuelWxR3dZ+mx
+joeBCLnshd8U80WmsVesPlNWnG8XCRdZ0QylvBpd1Ufp
 -----END CERTIFICATE-----
 -----BEGIN CERTIFICATE-----
-MIICNDCCAZ2gAwIBAgIBAjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
-cGxlLm5ldDEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwM1oX
-DTM4MDEwMTEyMzQwM1owNzEUMBIGA1UEChMLZXhhbXBsZS5uZXQxHzAdBgNVBAMT
+MIICGDCCAYGgAwIBAgIBQjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+cGxlLm5ldDEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQxNFoX
+DTM4MDEwMTEyMzQxNFowNzEUMBIGA1UEChMLZXhhbXBsZS5uZXQxHzAdBgNVBAMT
 FmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
-AoGBALMuDick/uNCkK8zWtdko5eynjJq0y8NVNlhSFkbwfjbxOQycuyMhMlYNnvs
-ESWZTV5ckpsvoDrFQLFk6ZB7RVYHUoOHNfANm8JWC9GR5zqbquibA/MMQ4h2Xlkz
-zQz12AzPpouZUyYs1+SjwlgfBRVhtxApDR2bPEDzI6s9VUdXAgMBAAGjWjBYMA4G
-A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMDIGA1UdHwQrMCkwJ6Al
-oCOGIWh0dHA6Ly9jcmwuZXhhbXBsZS5uZXQvbGF0ZXN0LmNybDANBgkqhkiG9w0B
-AQsFAAOBgQDCXkPeCURjOJwCBgbLERuNghPiWLqHPopm1idM2A032jDgbRXD9/DP
-1xOPgSLEW59EiJac0RNae0D2KyhnG90NZLccXK0a9Uu1iaAmdcJ7s4a0x0ZH9Kza
-hqz0cr4oStUOHxG/AtPKuhZ9PkZ7GDSPDW0k/z64WYCm1fqSWkbVig==
+AoGBAKFOi+80c9pb3UidQJd+TQ9j9lmOlw3HlhRxYNadHL2jZ98OHrwlDB1JgToy
+PruZ9yLq26a7c6sLYqEvpHulS6ACUqYaqu9kKb8m4l7xlheoyLT/jkZjq4Z0owp8
+PhzYl4p3M23rQzNSXcHCxcwu+6KPJ8FgrdNuB2RmHU2M27wRAgMBAAGjPjA8MA4G
+A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMBYGA1UdDgQPBA1BQWJ0
+d0N4Y1hnYjBRMA0GCSqGSIb3DQEBCwUAA4GBAAUlBd0/XrkhQ6Gm8s44uOU/gSAe
+Ap8baRLuhTrrvzd+nPDBN0YbwVUMwd9TbY4MsmDy+GhE9/V8i8OydEshl2iE15+E
+JX2DJEmNd7RMfWb6EIZVuzFFDWRszxA14YdNvDXjwS6BYmsSWJsNH4P/eTRrTCJi
+C53ODVdhE6yCQs1m
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.key b/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.key
index 9f728c279..bda96e53c 100644
--- a/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.key
+++ b/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.key
@@ -1,21 +1,22 @@
 Bag Attributes
     friendlyName: expired1.example.net
-    localKeyID: F8 8C 05 1E F2 1C 44 26 76 14 77 28 6F 4B C8 10 A6 E5 E1 A0 
+    localKeyID: 01 11 9A C0 58 86 76 AD 43 C8 AD 6E B7 D8 88 6A 00 8D 27 AB 
 Key Attributes: <No Attributes>
 -----BEGIN ENCRYPTED PRIVATE KEY-----
-MIICxjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQIpeL9csmvxjwCAggA
-MBQGCCqGSIb3DQMHBAjpXC1GIppx0gSCAoDrhHT1p1greqAUV6QPgJNPoPkAEXTY
-uslD8u6wtwZTcZBFumAfx1KXwVK/rNAVo74ZrDawvMsUDk+THtNRe8K7LS22NxUj
-VEAfsgvm5XmmT7TQjJQIcJZ6H8bBqSEFW353n4lkKaaIzQezTCsPsFdR4TmTDE6v
-LsqtTCCbe0l58JJhZpALkhFc3Bx/qitwQKHE/YzATAw1bokzq7S/TZFCqm5/Rkj7
-/yA/CpmKwOpD8hY8rgkzAY+AYLjC6/ID2d14xPVi6WMQa1pBufoWXFZcKI5eGzd7
-WgLPiiFhgJTtyucyxUUNJJ0lr0oV/J1LDurG70qcPiomkLFVda0pWW0oDIxDe39b
-nOREDh/uHFhSEvOk+izF8tS641iJWcRrcz6fjHu0Sp8heLGnEz8UpZsZ5aSgtPM8
-3VVRTYVWya/8N5EG0mUXdj1sB1augi0spAd9D1PxiKCE0LR9xZWQOm5ewq/ybUl7
-jWF7DS9pZYiTBhN3lzlmSQlm5RVxlCDwaZjdJwzhJgpg0RQgwQFhln0jYjD4jKKz
-dInjaz7NunXbhlrQQmYte2oWantUKWm5TgR526N5HHsrbbznci0r+Umq7d5PR70P
-xfbE6FFWCxZ1AuYCp4iGoUAr7xUo5SIh26OjnLHytDRPPXFSyZLsupMGfWtiy6Wc
-7cArmFIBeYj/B8IfCobTp+W7O5sAxRW/7UBiK1q2jr8/v3+Y1jSD9JbWRgk97AHw
-xI5v7I1L/1mmAHLuNEopvuyYSy0EdajW3VecoNHhTKyZURxlQ1M3oMGnn5gwRg2g
-YRECXyC/FzyyquWhaIJ2iTgdyBG6wZKVwkMpeP9IdcEi26pRE6vmLeIn
+MIIC1DBOBgkqhkiG9w0BBQ0wQTApBgkqhkiG9w0BBQwwHAQIsdmFOA4pkusCAggA
+MAwGCCqGSIb3DQIJBQAwFAYIKoZIhvcNAwcECOwDCiGC5J1ZBIICgNkR92fHe4t/
+TnXkRaqoFcs/AOgsCc4NN9jqpuhcFU6vbzT0vR32//DNgTXdwDYFQJ8/Ff/ST96v
+o+/MqVNsaUXEd9cowKSRKLDaBI8HlfSFToQnBoCLNAzSDo4FD7iOKke7jUe3Aqfv
+cydn4xxdEQxlKC1UzTjsl9MgNdV3P61kGVDaFYcXGWsDJGoLsLbOZIurlL3In8hU
+68vsznk55hXioTocYJWHadhcgJULYd2inJx0yS7+S+aGzGzhSxf8Yen861zutNlw
+Hl61CJs+fzyxBXpZHb+JfEh2vIlCU+HFhdTCCaNU3lP7w8WacYWvM995jW1KsdAz
+RsJvFFLa9UTnhAou1FRiHuHD/XObF9sOUsvoqUuGjtbQG27FPPLAVG+H2Fc/fr+g
+7qLNMvpcnZaOipTF67iPdFUDuJy8wpnBMlvXkMKiWqhMG2Tv5fBhFR2ozoYasFah
+aSDhchL2Wpc+uwxA8sz+EsNnmkFDyc8LFLikPRUS3jn9PPDio1PLqlXBbSHlx3xh
+4ci75ho0gEqpmE8nfoNtzMh+QZadpg63iOn1Rcw2YqGnDRaJQyGqEJucUY15KtTz
++WOzVw55joukpgdiOuEL3dsR0mYJsDkq5oAD+FxNK9KzYXeNDKoCVNxc9HgXFRDX
+eQLQVZeBzorHnrwB0rBWc0CoSFq1ENwa+9Ij0Emd41Eeo/8nxEisW0nt+ezjEUdK
+ZwcFbdzUdLh6mU5y4acNDTNZ+oiEZ66lXK3sVGkcoleyhj7Y4J40ys3X7LfqWkq1
+BLoOQ7rt1NwWjLneSoUS9PzH1FoM5VAP3zkbZMywXsj6rpj2TMV5xIk3Ke+pLLtd
+gQMv6zy52N0=
 -----END ENCRYPTED PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.dated.resp b/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.dated.resp
index 0490e88db..3b3a2a794 100644
--- a/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.dated.resp
+++ b/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.dated.resp
diff --git a/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.good.resp b/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.good.resp
index 57bca6af0..a8b4ff4d9 100644
--- a/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.good.resp
+++ b/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.good.resp
diff --git a/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.req b/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.req
index 3a4818c5e..63ca00468 100644
--- a/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.req
+++ b/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.req
diff --git a/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.revoked.resp b/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.revoked.resp
index dfa138b8e..d7592fc07 100644
--- a/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.revoked.resp
+++ b/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.revoked.resp
diff --git a/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.signer.dated.resp b/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.signer.dated.resp
index 8d12019c9..170190efa 100644
--- a/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.signer.dated.resp
+++ b/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.signer.dated.resp
diff --git a/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.signer.good.resp b/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.signer.good.resp
index 8cb087fa8..51ba5582f 100644
--- a/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.signer.good.resp
+++ b/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.signer.good.resp
diff --git a/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.signer.revoked.resp b/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.signer.revoked.resp
index a34cdc96f..95ce1a7ff 100644
--- a/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.signer.revoked.resp
+++ b/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.signer.revoked.resp
diff --git a/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.signernocert.dated.resp b/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.signernocert.dated.resp
index 36aac9603..523c369db 100644
--- a/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.signernocert.dated.resp
+++ b/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.signernocert.dated.resp
diff --git a/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.signernocert.good.resp b/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.signernocert.good.resp
index ee8fe3bcd..8fa0c98ca 100644
--- a/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.signernocert.good.resp
+++ b/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.signernocert.good.resp
diff --git a/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.signernocert.revoked.resp b/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.signernocert.revoked.resp
index 44a9709c2..8fb99762a 100644
--- a/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.signernocert.revoked.resp
+++ b/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.signernocert.revoked.resp
diff --git a/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.p12 b/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.p12
index 8b22edc22..66ef77e21 100644
--- a/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.p12
+++ b/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.p12
diff --git a/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.pem b/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.pem
index a598ab08b..d07da34e5 100644
--- a/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.pem
+++ b/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.pem
@@ -1,21 +1,21 @@
 Bag Attributes
     friendlyName: expired1.example.net
-    localKeyID: F8 8C 05 1E F2 1C 44 26 76 14 77 28 6F 4B C8 10 A6 E5 E1 A0 
+    localKeyID: 01 11 9A C0 58 86 76 AD 43 C8 AD 6E B7 D8 88 6A 00 8D 27 AB 
 subject=/CN=expired1.example.net
 issuer=/O=example.net/CN=clica Signing Cert rsa
 -----BEGIN CERTIFICATE-----
 MIICjTCCAfagAwIBAgIBZzANBgkqhkiG9w0BAQsFADA3MRQwEgYDVQQKEwtleGFt
 cGxlLm5ldDEfMB0GA1UEAxMWY2xpY2EgU2lnbmluZyBDZXJ0IHJzYTAeFw0xMjEx
-MDExMjM0MDNaFw0xMjEyMDExMjM0MDNaMB8xHTAbBgNVBAMTFGV4cGlyZWQxLmV4
-YW1wbGUubmV0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC6sferp1lp0jW/
-rpTqM3glt5VEOHO3w5a4nvEplLqNbZSUNAqgMhw1nXsYA0xfCeS0zCaEvuK9U58Q
-jxddvQxGEbtF1wFWPHa0P3HuEuZpQxstgr+Dmjh2v2C8cu6gA/8/0AM/JEQ1pPMj
-wXAGaCRtkUhY7RW+X4t9sgjjrH68hwIDAQABo4HAMIG9MA4GA1UdDwEB/wQEAwIE
+MDExMjM0MTVaFw0xMjEyMDExMjM0MTVaMB8xHTAbBgNVBAMTFGV4cGlyZWQxLmV4
+YW1wbGUubmV0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCwzxfp2vYw5w96
+4Eq57WBMZdmZZ4B27eqMV2gGS7fINlWoUqR6JsClfrBJ5A60LjsvPF2ccr9uyG6r
+mLlarc0kXBREXRpZdmcxX04MS7lu/1TnGem170ZzldtTXV/Z7UHukvDID+tYV2X2
+aTQblO2JbE1+9F2tXILc9TSX9fbBNQIDAQABo4HAMIG9MA4GA1UdDwEB/wQEAwIE
 8DAgBgNVHSUBAf8EFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwMgYDVR0fBCswKTAn
 oCWgI4YhaHR0cDovL2NybC5leGFtcGxlLm5ldC9sYXRlc3QuY3JsMDQGCCsGAQUF
 BwEBBCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29zY3AuZXhhbXBsZS5uZXQvMB8G
 A1UdEQQYMBaCFGV4cGlyZWQxLmV4YW1wbGUubmV0MA0GCSqGSIb3DQEBCwUAA4GB
-ACLOp0fuRcZP3yahPxZ0zOX73LmUCS3NAksjvmwBUMR0jvI+454qu9XkxfsKJ8pJ
-4bK+gJinpd2U6j+UXeU46aQ5x1ilJvMBE2EiOINRgQZB+5OC7ihn73uW4B0OLU1V
-DiEUk8LeYjWAks6AnxHJfbihkxoe8+aNdORFiSp3lmNd
+ABHsEhKoJeK909uBPQLCZVVVGiHybCGkoXbf3iLR8lQsEHrHi1B2Jh4b8UbHH/Co
+PmDmpRpbpQOjawMDQIRZxr5NJlBFSDHC9XN1LfIarevXrqmHz4YnuelWxR3dZ+mx
+joeBCLnshd8U80WmsVesPlNWnG8XCRdZ0QylvBpd1Ufp
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.unlocked.key b/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.unlocked.key
index 5c3ed79d0..7f468ecfa 100644
--- a/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.unlocked.key
+++ b/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.unlocked.key
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXAIBAAKBgQC6sferp1lp0jW/rpTqM3glt5VEOHO3w5a4nvEplLqNbZSUNAqg
-Mhw1nXsYA0xfCeS0zCaEvuK9U58QjxddvQxGEbtF1wFWPHa0P3HuEuZpQxstgr+D
-mjh2v2C8cu6gA/8/0AM/JEQ1pPMjwXAGaCRtkUhY7RW+X4t9sgjjrH68hwIDAQAB
-AoGAPpJZLPnYuOPQSd8sX9ZCRXnjGEtHVWbDRDtZHpOPdsksTAOpMAm7dKjEUccB
-OLUrJwFpQ4JqogO9wyICNdOfoeWqQijRwwibqpVD9lGgpDz2ERiw/WafF83BhmPz
-IfO7Pk811ZisMjKAW++GOCodnHzk3MzVVkHSWM/dvaHJrokCQQDk8mgCqWF1mOPj
-q3c4HeLKW8ch54/EL7c3F50SPsdQAT2rs7qggBLPoQs1HnZchjIKfXbdjZspcRDf
-tP1uCfP7AkEA0MF0v3h2oaflZXo5BLrSF+RPcbsDJLvnBVy8bwQuusLt3mEnXOBL
-u98desC7FUJihJjpDqH8sKXDhRuHzFDn5QJBALx0dP1L47djJKMxby84Goirx1y3
-OXYqOMwWmep81p+aheMiTIr1IYbbb1hIPPGoXOSZphB1EbWpJlSerMW5V6UCQCaj
-R9qQj1SIYNsRbjBD69LkPRgNxx0rciz55x6dJZEHt0MrtD9qfFn/h9NKjNX4fYeR
-TcGZlc2UQMYIPHBCoUkCQEE6JDrkpyFB8++TEO6fovwL1FYY6cvThB6dfHgsJNng
-zcmVCXyqZsp+UVWeCsn1gTYk58E6ABr9dFfE+kMnYXA=
+MIICXAIBAAKBgQCwzxfp2vYw5w964Eq57WBMZdmZZ4B27eqMV2gGS7fINlWoUqR6
+JsClfrBJ5A60LjsvPF2ccr9uyG6rmLlarc0kXBREXRpZdmcxX04MS7lu/1TnGem1
+70ZzldtTXV/Z7UHukvDID+tYV2X2aTQblO2JbE1+9F2tXILc9TSX9fbBNQIDAQAB
+AoGAAxmgEwO5u4uTNZwKkC40BfLm0oeowXnhDTsYTrzAiRXaATykHj4t54wl0PRB
+a77AK+jBJwj+B6+8/QZAmoq5ZSluJc7iZN0Ma3p3Mc/bhygFTNRFaY2ajfHiD0Iu
+lX2K7CBxhFHimmCldjGe5IhPzObd+QIpTpVi397DrJtUaSECQQDlJEinubLoxNNV
+LVLrHV1/SfTKBoXXBUkszGtLGhUeWAwgOQKloAIV57C3Ctik/nn2Hm845KGaMqhw
+yNnZDfjxAkEAxYh98Ln516WAqc1uOJbDVkfYJDZ1cYtXcuHIoJ8Wsoc4hE7ZOF0O
+dtGbP6GkP3XGN8QFB/kdKO+/8tJ/IZsshQJBAIhB0j6Cq4PE/xJIeGU9OgrmNH0p
+8c6R4xiTmj23jdVUcCl9HTjV9EeIVcoS1g8PEAEtyd+f/QTPmOAwX3K131ECQC/8
+raO6emCR+0TE/D7RGVkvkOmTNUrFMBRfl2611zy9rtQtl4Wiza290/pMWWt1QBcy
+DorWUOgt/jKOQoY2fUUCQEvPP9mHzvrzjWGCm4jTuw6WvhK+M+o1XCPujMNhVN0M
+YFCKPt2RqLZenWvdTxouJ5OVw7TsqxRrsbJiPpXzpjo=
 -----END RSA PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.net/expired1.example.net/key3.db b/test/aux-fixed/exim-ca/example.net/expired1.example.net/key3.db
index 5c5a91092..af75b1c8d 100644
--- a/test/aux-fixed/exim-ca/example.net/expired1.example.net/key3.db
+++ b/test/aux-fixed/exim-ca/example.net/expired1.example.net/key3.db
diff --git a/test/aux-fixed/exim-ca/example.net/expired2.example.net/ca_chain.pem b/test/aux-fixed/exim-ca/example.net/expired2.example.net/ca_chain.pem
index fef1020ef..3beef64e5 100644
--- a/test/aux-fixed/exim-ca/example.net/expired2.example.net/ca_chain.pem
+++ b/test/aux-fixed/exim-ca/example.net/expired2.example.net/ca_chain.pem
@@ -3,33 +3,33 @@ Bag Attributes
 subject=/O=example.net/CN=clica Signing Cert rsa
 issuer=/O=example.net/CN=clica CA rsa
 -----BEGIN CERTIFICATE-----
-MIICNDCCAZ2gAwIBAgIBAjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
-cGxlLm5ldDEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwM1oX
-DTM4MDEwMTEyMzQwM1owNzEUMBIGA1UEChMLZXhhbXBsZS5uZXQxHzAdBgNVBAMT
+MIICGDCCAYGgAwIBAgIBQjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+cGxlLm5ldDEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQxNFoX
+DTM4MDEwMTEyMzQxNFowNzEUMBIGA1UEChMLZXhhbXBsZS5uZXQxHzAdBgNVBAMT
 FmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
-AoGBALMuDick/uNCkK8zWtdko5eynjJq0y8NVNlhSFkbwfjbxOQycuyMhMlYNnvs
-ESWZTV5ckpsvoDrFQLFk6ZB7RVYHUoOHNfANm8JWC9GR5zqbquibA/MMQ4h2Xlkz
-zQz12AzPpouZUyYs1+SjwlgfBRVhtxApDR2bPEDzI6s9VUdXAgMBAAGjWjBYMA4G
-A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMDIGA1UdHwQrMCkwJ6Al
-oCOGIWh0dHA6Ly9jcmwuZXhhbXBsZS5uZXQvbGF0ZXN0LmNybDANBgkqhkiG9w0B
-AQsFAAOBgQDCXkPeCURjOJwCBgbLERuNghPiWLqHPopm1idM2A032jDgbRXD9/DP
-1xOPgSLEW59EiJac0RNae0D2KyhnG90NZLccXK0a9Uu1iaAmdcJ7s4a0x0ZH9Kza
-hqz0cr4oStUOHxG/AtPKuhZ9PkZ7GDSPDW0k/z64WYCm1fqSWkbVig==
+AoGBAKFOi+80c9pb3UidQJd+TQ9j9lmOlw3HlhRxYNadHL2jZ98OHrwlDB1JgToy
+PruZ9yLq26a7c6sLYqEvpHulS6ACUqYaqu9kKb8m4l7xlheoyLT/jkZjq4Z0owp8
+PhzYl4p3M23rQzNSXcHCxcwu+6KPJ8FgrdNuB2RmHU2M27wRAgMBAAGjPjA8MA4G
+A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMBYGA1UdDgQPBA1BQWJ0
+d0N4Y1hnYjBRMA0GCSqGSIb3DQEBCwUAA4GBAAUlBd0/XrkhQ6Gm8s44uOU/gSAe
+Ap8baRLuhTrrvzd+nPDBN0YbwVUMwd9TbY4MsmDy+GhE9/V8i8OydEshl2iE15+E
+JX2DJEmNd7RMfWb6EIZVuzFFDWRszxA14YdNvDXjwS6BYmsSWJsNH4P/eTRrTCJi
+C53ODVdhE6yCQs1m
 -----END CERTIFICATE-----
 Bag Attributes
     friendlyName: Certificate Authority rsa
 subject=/O=example.net/CN=clica CA rsa
 issuer=/O=example.net/CN=clica CA rsa
 -----BEGIN CERTIFICATE-----
-MIIB9jCCAV+gAwIBAgIBATANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
-cGxlLm5ldDEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwM1oX
-DTM4MDEwMTEyMzQwM1owLTEUMBIGA1UEChMLZXhhbXBsZS5uZXQxFTATBgNVBAMT
-DGNsaWNhIENBIHJzYTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA3kwC9CHz
-JH7sEDkHMdZRq8+XpV7l/hEqfv2gPvT3mak46dWrI/T3pJOqyNvUZV/LJ/gx/0uw
-9pmCg6Y5zNCN0qAGY4rSS/sbEOLYIw5wJbFnYfHtTwe3ZAdG+5WqKMBF2lHNBM3b
-PUB/kweoLhNLwserKHwMDC3sksfrwH29rpMCAwEAAaMmMCQwEgYDVR0TAQH/BAgw
-BgEB/wIBATAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADgYEAzXt6KHIB
-qOJfZECgwhAWipxVR0BXek0hAfyTWl7q18+mWKYydQW0Z2VMN4Bq/ZUlOg+EM8NU
-1n9PJ4+I2QgAwVVXN4+cz7zgZ6XRZc1OkE98NyK504bVpJpan1gsx3I5GLJUgP2t
-B/WwqoFO+ANhT2margZSM6avJfaIh8gEass=
+MIIB9jCCAV+gAwIBAgIBQTANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+cGxlLm5ldDEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQxNFoX
+DTM4MDEwMTEyMzQxNFowLTEUMBIGA1UEChMLZXhhbXBsZS5uZXQxFTATBgNVBAMT
+DGNsaWNhIENBIHJzYTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAs89Jw+yK
+ohiMwcSLAciqgj5CtxYRsoW1AmQrhD3QwE6es0RBjTGp5SNjjPlRxCZ5T+dQQXR1
+RirvSKH+isbd1ENIbS9dPgaR2mFUYwcSxUIRrXn4mkxZ/QtpTVOoY184lFAPhTrW
+et4o+wE9OI2e75RD5GdAyB/52paGplt+K38CAwEAAaMmMCQwEgYDVR0TAQH/BAgw
+BgEB/wIBATAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADgYEAOcXFUXls
+ChTDzMe2y+qv1YlOZbkf43S9je72ATYXzS7/eT8I4sAq/CFdgmn+lw5kHJlgxCag
+BPwuLYHW55r69WI1IwQHrJXaavyPSkonVgK+ZssEcQmqbgNj8oV5ZnyzYnNZv0VU
+nMl1n6nCl1xdUwPwhhdssGXEoX8OF5iMw4U=
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.net/expired2.example.net/cert8.db b/test/aux-fixed/exim-ca/example.net/expired2.example.net/cert8.db
index 065d431b1..fe554f736 100644
--- a/test/aux-fixed/exim-ca/example.net/expired2.example.net/cert8.db
+++ b/test/aux-fixed/exim-ca/example.net/expired2.example.net/cert8.db
diff --git a/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.chain.pem b/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.chain.pem
index 5247d5038..0232c2a20 100644
--- a/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.chain.pem
+++ b/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.chain.pem
@@ -1,35 +1,35 @@
 Bag Attributes
     friendlyName: expired2.example.net
-    localKeyID: C6 68 7F 28 99 08 18 A8 DF E7 DA 8E D1 60 FC 31 84 CE 22 4B 
+    localKeyID: 1F D1 DE 25 84 FE BC C7 63 D6 EB 9E 69 1A 15 06 C8 4E 6E 41 
 subject=/CN=expired2.example.net
 issuer=/O=example.net/CN=clica Signing Cert rsa
 -----BEGIN CERTIFICATE-----
 MIICjjCCAfegAwIBAgICAMswDQYJKoZIhvcNAQELBQAwNzEUMBIGA1UEChMLZXhh
 bXBsZS5uZXQxHzAdBgNVBAMTFmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwHhcNMTIx
-MTAxMTIzNDA0WhcNMTIxMjAxMTIzNDA0WjAfMR0wGwYDVQQDExRleHBpcmVkMi5l
-eGFtcGxlLm5ldDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAlZdym0qw/GF7
-n4Vq0Mp/Mg+/OLcbQUczPFRqxebHkZMMYgFYg6GttP8NoAFdnQhfNeNKSE7cuNKa
-jvUw9H5kEkjsrxHmciNcjM18slFm0VoJRhNs9wJSyB47e0gJnC0FM7txUq+UdiLS
-R5PF8xU1OTymmgP+6Itd9f8kx85ipRsCAwEAAaOBwDCBvTAOBgNVHQ8BAf8EBAMC
+MTAxMTIzNDE3WhcNMTIxMjAxMTIzNDE3WjAfMR0wGwYDVQQDExRleHBpcmVkMi5l
+eGFtcGxlLm5ldDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA78bAlofh/mTJ
+krU0npKSLZvgKcA0f55xIT9h1NEkf399IT0PoFAYGBjar7PraKot4mMvw8E4gcer
+yx1F+SCFu7l7me1ErpmqsEMcD4fKwvzm2Uc98I0XGOIFgq0BP2fIH6cNrdESEE9v
+4E1otkCn+/g/kxiqYw3DH0LeZizyiacCAwEAAaOBwDCBvTAOBgNVHQ8BAf8EBAMC
 BPAwIAYDVR0lAQH/BBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMDIGA1UdHwQrMCkw
 J6AloCOGIWh0dHA6Ly9jcmwuZXhhbXBsZS5uZXQvbGF0ZXN0LmNybDA0BggrBgEF
 BQcBAQQoMCYwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vc2NwLmV4YW1wbGUubmV0LzAf
 BgNVHREEGDAWghRleHBpcmVkMi5leGFtcGxlLm5ldDANBgkqhkiG9w0BAQsFAAOB
-gQCpO1ztM/B+QWkJWCTaFrBLOJ44ZQEN0jhKb0JVZ9wlW3T6d9cN6a58ptjBvsc3
-EmbB1iBaKGLiPRlZKzfiPBMN6djS1/VGDxXiwiTklI41Atd4p7mnoWA5fRp+b4pN
-dgj+FC2LTfl0s03MMe1xhO8kAL1lU7ueJDkHhicOsHkEjg==
+gQBhduzCnRpc61IE5jaIAsC0xYS35fjk+g+Ef6kgcRNUKnSIwJhlzbP9PSRmB1bm
+MJMO9Stbm8Bh+AU9YoZX9tUCqr4Vlj3LLKVbz3l4EP1In2wAhqUavY+owo0XW7P2
+7Xa+CZyFHuuftiaeSDzI57Up/Ue1p8AB9wbSlqaxGVhuGQ==
 -----END CERTIFICATE-----
 -----BEGIN CERTIFICATE-----
-MIICNDCCAZ2gAwIBAgIBAjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
-cGxlLm5ldDEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwM1oX
-DTM4MDEwMTEyMzQwM1owNzEUMBIGA1UEChMLZXhhbXBsZS5uZXQxHzAdBgNVBAMT
+MIICGDCCAYGgAwIBAgIBQjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+cGxlLm5ldDEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQxNFoX
+DTM4MDEwMTEyMzQxNFowNzEUMBIGA1UEChMLZXhhbXBsZS5uZXQxHzAdBgNVBAMT
 FmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
-AoGBALMuDick/uNCkK8zWtdko5eynjJq0y8NVNlhSFkbwfjbxOQycuyMhMlYNnvs
-ESWZTV5ckpsvoDrFQLFk6ZB7RVYHUoOHNfANm8JWC9GR5zqbquibA/MMQ4h2Xlkz
-zQz12AzPpouZUyYs1+SjwlgfBRVhtxApDR2bPEDzI6s9VUdXAgMBAAGjWjBYMA4G
-A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMDIGA1UdHwQrMCkwJ6Al
-oCOGIWh0dHA6Ly9jcmwuZXhhbXBsZS5uZXQvbGF0ZXN0LmNybDANBgkqhkiG9w0B
-AQsFAAOBgQDCXkPeCURjOJwCBgbLERuNghPiWLqHPopm1idM2A032jDgbRXD9/DP
-1xOPgSLEW59EiJac0RNae0D2KyhnG90NZLccXK0a9Uu1iaAmdcJ7s4a0x0ZH9Kza
-hqz0cr4oStUOHxG/AtPKuhZ9PkZ7GDSPDW0k/z64WYCm1fqSWkbVig==
+AoGBAKFOi+80c9pb3UidQJd+TQ9j9lmOlw3HlhRxYNadHL2jZ98OHrwlDB1JgToy
+PruZ9yLq26a7c6sLYqEvpHulS6ACUqYaqu9kKb8m4l7xlheoyLT/jkZjq4Z0owp8
+PhzYl4p3M23rQzNSXcHCxcwu+6KPJ8FgrdNuB2RmHU2M27wRAgMBAAGjPjA8MA4G
+A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMBYGA1UdDgQPBA1BQWJ0
+d0N4Y1hnYjBRMA0GCSqGSIb3DQEBCwUAA4GBAAUlBd0/XrkhQ6Gm8s44uOU/gSAe
+Ap8baRLuhTrrvzd+nPDBN0YbwVUMwd9TbY4MsmDy+GhE9/V8i8OydEshl2iE15+E
+JX2DJEmNd7RMfWb6EIZVuzFFDWRszxA14YdNvDXjwS6BYmsSWJsNH4P/eTRrTCJi
+C53ODVdhE6yCQs1m
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.key b/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.key
index bda73e53b..2ae8e3a2c 100644
--- a/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.key
+++ b/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.key
@@ -1,21 +1,22 @@
 Bag Attributes
     friendlyName: expired2.example.net
-    localKeyID: C6 68 7F 28 99 08 18 A8 DF E7 DA 8E D1 60 FC 31 84 CE 22 4B 
+    localKeyID: 1F D1 DE 25 84 FE BC C7 63 D6 EB 9E 69 1A 15 06 C8 4E 6E 41 
 Key Attributes: <No Attributes>
 -----BEGIN ENCRYPTED PRIVATE KEY-----
-MIICxjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQIFKoStEDfs1gCAggA
-MBQGCCqGSIb3DQMHBAhNSq4RJSvU7wSCAoDRULMeVsx9fTuxmEvZaNIfTD8l5Osn
-ce+LR14anKy91ou8mY4JhngN48E5WGhxo2Uq3rxvyVAoqxb7mDoqTJvjUWpAR0Aw
-f3hAMmfXEwGyvm0ABbmAOnmkNT86djmKPfpwE/oKo1fVr+3Hl9SRkxPtVxVUj1Ue
-Ql2KhU44Abq8G2ExY909HZXrPo9Za2YOBtrDesmdfJkxKurd3F/1+UdfTSUAOOQH
-C9wst1SO5xdyCdx3w3PvDrzcLWeR8c1bva3HQopgnJdWUxlnU0G2dxj6sYfJrc6D
-tdr58jDzfqNRrDsVGw/nFXulSp1SmMDyhnjW7oROah5l26Uvsw9btOhZjmwdbTz4
-rzdz3eGk5hAV7mezZrIbFF8JdEzmIb5guDD5IOIzEEP/jP9hxe1ZvveV1a1s0jPy
-18CHn435wFilRLUdQT5U9x6vuy/hsp7CrSyFPZ9lD6dUpe5SZz1omvXPEy8lky6T
-bXGN5Ug1R+u4BQHzXO4uj1xnF+BKSUJCW9HdUzG4ASLeR+ZUhg65l1LCG++/2ZD1
-HjGU+mSmJ6ob8X9//W3cTyHPMLrTgtfrrTnPCVAwdLyW4oMdVnonIZlpysRA8tmK
-ATp2I1QiXrCGkgJeDFT3hQ0Is6Em+TNzWQrNsEak4qAtRcpvoW+zE9mUW7a3zCXn
-nXg9kfBYvY5GmpPpWkTPLqSUeHqoKnEg9361PZ4Zwpxa5eX79jLqHMDzrWdmbkG2
-6//wNVND0+eMhznyB2RRr9uUjEGmlU3piVmASvJ1Ahe88zIi/9VDl4/FGJFzUHoh
-OpIphHp1w9rkvgBtOa9rEObGL6KEbd+jgaWrt1evMiq5mnGJaApjiqul
+MIIC1DBOBgkqhkiG9w0BBQ0wQTApBgkqhkiG9w0BBQwwHAQIQcqIYMGCluoCAggA
+MAwGCCqGSIb3DQIJBQAwFAYIKoZIhvcNAwcECFYA3JEf+IWpBIICgEwno96LeVBk
+C7Bf33v0eoWENsPV6Yqbon9fAivIC68RcKSmzB379CWsu0VTPLBGlHRylqhVceEc
+P/PKybLQ34NqPtHmQnmTolz7dSy8IKPmVp6XgiPpE4xHV2lggebxG3vwa5l6zZwu
+KOhX4UPZcYNfXZUAGWbDKH8Pauc6o1H3XIFVly2BkBpEq/G+wo0UIhh2xnZB+9nY
+yFLKbwd0y5+2ty/mjGPanrvIUTKLoGHFDHYTNDKjHuwqVbY4s2Jpf+cwniozRIL4
+BLK5SL0lz8dA8RMb5RjJBN1KFR35TIqtRsyT05AzeWAQRgqDK9p9KnZfaubj90Ao
+Eq/MygUzRcIiS5ppHf3MX+mgljynFP2wOUt05/oaHfzJ1PC2fs7q/G7K0VJ/dRkT
+qWZpJ4yqJKeW0O6R9+5AeytsKphMbasXobzk7yTVjk9IK2c96cNQxNhE9IsXKWc3
+x7/Y1wLPtO8kjuBy6VfrgTerT2+Haht33UBjEyHS/zvVZwigdRBXOfcwyFRLh7iH
+6WKSDGu63z0QVnk38hZcV7dyvfdYenD6lVvTZltPDGIy2Jxj7kLJnJMsjq9N6oJc
+ZZOEtYvgE2nEaWVnpLjG1k+jkGtFRqwW7U1RRJ/VPKeHrQoPNDkR3DBcnclPqC0A
+72bXtbrwuNHz5d0mLnaP1ucvgqWrQaoLYV/2rSZWo0JWOX0zBYFhgJATY1PrpQfX
+HFEElSpgvAwWUjDFS27Xo6+/TNvAlyMcIj1X2Oc1WwyOrtfzVl9iL+3f5wjV3yrt
+4R3eHibmNkSnMwSe/Sq67YBVCXkSoKcXoGRTstKdkfYO8Hx7h3YLIyq4gLJQQom8
+C6jFeuOWcGc=
 -----END ENCRYPTED PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.dated.resp b/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.dated.resp
index 6d478aac1..896a20bc4 100644
--- a/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.dated.resp
+++ b/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.dated.resp
diff --git a/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.good.resp b/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.good.resp
index fa196e54e..f4c8b4ddf 100644
--- a/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.good.resp
+++ b/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.good.resp
diff --git a/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.req b/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.req
index 1ef5e1e01..a8739820e 100644
--- a/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.req
+++ b/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.req
diff --git a/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.revoked.resp b/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.revoked.resp
index fa196e54e..f4c8b4ddf 100644
--- a/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.revoked.resp
+++ b/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.revoked.resp
diff --git a/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.signer.dated.resp b/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.signer.dated.resp
index 21001bfa1..01ce2baa8 100644
--- a/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.signer.dated.resp
+++ b/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.signer.dated.resp
diff --git a/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.signer.good.resp b/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.signer.good.resp
index c7b3e820e..a16d36ab8 100644
--- a/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.signer.good.resp
+++ b/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.signer.good.resp
diff --git a/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.signer.revoked.resp b/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.signer.revoked.resp
index c7b3e820e..a16d36ab8 100644
--- a/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.signer.revoked.resp
+++ b/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.signer.revoked.resp
diff --git a/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.signernocert.dated.resp b/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.signernocert.dated.resp
index 6f4b6027c..bd6a2cb58 100644
--- a/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.signernocert.dated.resp
+++ b/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.signernocert.dated.resp
diff --git a/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.signernocert.good.resp b/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.signernocert.good.resp
index 1708125dc..bf54667ae 100644
--- a/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.signernocert.good.resp
+++ b/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.signernocert.good.resp
diff --git a/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.signernocert.revoked.resp b/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.signernocert.revoked.resp
index 1708125dc..bf54667ae 100644
--- a/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.signernocert.revoked.resp
+++ b/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.signernocert.revoked.resp
diff --git a/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.p12 b/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.p12
index c38a9af5a..18ccf5c0a 100644
--- a/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.p12
+++ b/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.p12
diff --git a/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.pem b/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.pem
index eb4f41bd2..5e8873497 100644
--- a/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.pem
+++ b/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.pem
@@ -1,21 +1,21 @@
 Bag Attributes
     friendlyName: expired2.example.net
-    localKeyID: C6 68 7F 28 99 08 18 A8 DF E7 DA 8E D1 60 FC 31 84 CE 22 4B 
+    localKeyID: 1F D1 DE 25 84 FE BC C7 63 D6 EB 9E 69 1A 15 06 C8 4E 6E 41 
 subject=/CN=expired2.example.net
 issuer=/O=example.net/CN=clica Signing Cert rsa
 -----BEGIN CERTIFICATE-----
 MIICjjCCAfegAwIBAgICAMswDQYJKoZIhvcNAQELBQAwNzEUMBIGA1UEChMLZXhh
 bXBsZS5uZXQxHzAdBgNVBAMTFmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwHhcNMTIx
-MTAxMTIzNDA0WhcNMTIxMjAxMTIzNDA0WjAfMR0wGwYDVQQDExRleHBpcmVkMi5l
-eGFtcGxlLm5ldDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAlZdym0qw/GF7
-n4Vq0Mp/Mg+/OLcbQUczPFRqxebHkZMMYgFYg6GttP8NoAFdnQhfNeNKSE7cuNKa
-jvUw9H5kEkjsrxHmciNcjM18slFm0VoJRhNs9wJSyB47e0gJnC0FM7txUq+UdiLS
-R5PF8xU1OTymmgP+6Itd9f8kx85ipRsCAwEAAaOBwDCBvTAOBgNVHQ8BAf8EBAMC
+MTAxMTIzNDE3WhcNMTIxMjAxMTIzNDE3WjAfMR0wGwYDVQQDExRleHBpcmVkMi5l
+eGFtcGxlLm5ldDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA78bAlofh/mTJ
+krU0npKSLZvgKcA0f55xIT9h1NEkf399IT0PoFAYGBjar7PraKot4mMvw8E4gcer
+yx1F+SCFu7l7me1ErpmqsEMcD4fKwvzm2Uc98I0XGOIFgq0BP2fIH6cNrdESEE9v
+4E1otkCn+/g/kxiqYw3DH0LeZizyiacCAwEAAaOBwDCBvTAOBgNVHQ8BAf8EBAMC
 BPAwIAYDVR0lAQH/BBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMDIGA1UdHwQrMCkw
 J6AloCOGIWh0dHA6Ly9jcmwuZXhhbXBsZS5uZXQvbGF0ZXN0LmNybDA0BggrBgEF
 BQcBAQQoMCYwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vc2NwLmV4YW1wbGUubmV0LzAf
 BgNVHREEGDAWghRleHBpcmVkMi5leGFtcGxlLm5ldDANBgkqhkiG9w0BAQsFAAOB
-gQCpO1ztM/B+QWkJWCTaFrBLOJ44ZQEN0jhKb0JVZ9wlW3T6d9cN6a58ptjBvsc3
-EmbB1iBaKGLiPRlZKzfiPBMN6djS1/VGDxXiwiTklI41Atd4p7mnoWA5fRp+b4pN
-dgj+FC2LTfl0s03MMe1xhO8kAL1lU7ueJDkHhicOsHkEjg==
+gQBhduzCnRpc61IE5jaIAsC0xYS35fjk+g+Ef6kgcRNUKnSIwJhlzbP9PSRmB1bm
+MJMO9Stbm8Bh+AU9YoZX9tUCqr4Vlj3LLKVbz3l4EP1In2wAhqUavY+owo0XW7P2
+7Xa+CZyFHuuftiaeSDzI57Up/Ue1p8AB9wbSlqaxGVhuGQ==
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.unlocked.key b/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.unlocked.key
index 89d27555a..1615e324e 100644
--- a/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.unlocked.key
+++ b/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.unlocked.key
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXAIBAAKBgQCVl3KbSrD8YXufhWrQyn8yD784txtBRzM8VGrF5seRkwxiAViD
-oa20/w2gAV2dCF8140pITty40pqO9TD0fmQSSOyvEeZyI1yMzXyyUWbRWglGE2z3
-AlLIHjt7SAmcLQUzu3FSr5R2ItJHk8XzFTU5PKaaA/7oi131/yTHzmKlGwIDAQAB
-AoGABUU5t3jxNWMl3N/xfHu18YiWfyQMZMdiaby7qk9QNrPMmuNbQAABQ8A8tad2
-qeKyoA5q/pMwuZ5J7cF7wRF26xQ2WlladjWLSPgCYn1fHJTj7jtfYHeKMMmdbtOw
-ZBrBDQ4b2GvMGP59LHjuO4Ud5DTy3sopCQY5a1oYxiZTeSECQQDF1V3CUPHVTTy7
-I5fY+Rt1HL4fG5CkV3N5jkRAWnmElpstFF9KooWG7LZJBnU0v6R8Kw3fQp+kRsmh
-RFBYXFprAkEAwZL8o2xOTTqbNZDQ4SJvRP3sl1dLNozBpol3NeSZDTIxUWU1EbwU
-d0p2yElA+FyZbRl0vxYuJ3UESQTqbDLsEQJAUL4wsipPSXtomgiA5TFmn3nHrvKV
-Kj33B1mlSY6johXF57Q04EVMsjDShSN5mrnM7FC2LLUIawfpK0Sydh3bWQJBALpf
-hgTmk2FCCwwA2UvZ9p3LiY6RCqaD0TNB6VgnN8D/0YIX2oevuVi9hi4CcZ5usX3c
-Y45Tka6FuNGA/R+dy7ECQGYdoHCbptExaOs/ET7qwI6nHXkmbk8HcTrlKtFm39xd
-+3MDN12RJLmWDpt2OS4mEzQiH7Cn70IbuBzKsObklNY=
+MIICXAIBAAKBgQDvxsCWh+H+ZMmStTSekpItm+ApwDR/nnEhP2HU0SR/f30hPQ+g
+UBgYGNqvs+toqi3iYy/DwTiBx6vLHUX5IIW7uXuZ7USumaqwQxwPh8rC/ObZRz3w
+jRcY4gWCrQE/Z8gfpw2t0RIQT2/gTWi2QKf7+D+TGKpjDcMfQt5mLPKJpwIDAQAB
+AoGAIyR44EHU2E7ipvidWGBtwaGG8+znxOHuqCDSBeRhT7kvwx9f8ER3mOXg/L+H
+UTUgDyjaZ1ElJwr3ct2SKTagYt/dikP2vLDR44Jfu8pq+HoXp9ZhgNcueyTK3x6d
+LLWT6ysNWniAp2I1unX9NAFrlzjikVB4Ii2i61i6X7/TRIECQQD/6BlMFIkLuqlr
+FDj2FYCWGDAeqjhYpMZYEljI+21+6cxaqpcIPaWKUXDN585cKCjh7TitJXrbn/K7
+viNfRHKDAkEA790lni0k7TYhT6D5sTnNSGKUmZ3C6x5lW08Gq7DNAN+6GGt4bEhE
+UKNtn0gRAjfP1zvDzzGuwiKCEmqEoNMTDQJBAM8J2p2g55ejtzm4rLT7hILqotPM
+Z7Xf6dCLV2WTdWz+fqTD61lxdqLHbPpJlr0ciKbwo7AB6LoTV/DozflfiT0CQD49
+1nsbH8/mEfLFxMU2SIyV+BV8mI3GT2rIMOTwdeHaLEIV8SO4BPIf1lxUqQU4Ulh5
+i7ACJmT96164AT5yRykCQCppsr15yTY26dmBbNHfyJlGNchHwfQFzXZSNsbORPAJ
+g9rSecR2JjWuhYo3jcUp0tJ4xBcZ37XHxUygx0uLPBk=
 -----END RSA PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.net/expired2.example.net/key3.db b/test/aux-fixed/exim-ca/example.net/expired2.example.net/key3.db
index 9447851c0..e9abaca46 100644
--- a/test/aux-fixed/exim-ca/example.net/expired2.example.net/key3.db
+++ b/test/aux-fixed/exim-ca/example.net/expired2.example.net/key3.db
diff --git a/test/aux-fixed/exim-ca/example.net/revoked1.example.net/ca_chain.pem b/test/aux-fixed/exim-ca/example.net/revoked1.example.net/ca_chain.pem
index fef1020ef..3beef64e5 100644
--- a/test/aux-fixed/exim-ca/example.net/revoked1.example.net/ca_chain.pem
+++ b/test/aux-fixed/exim-ca/example.net/revoked1.example.net/ca_chain.pem
@@ -3,33 +3,33 @@ Bag Attributes
 subject=/O=example.net/CN=clica Signing Cert rsa
 issuer=/O=example.net/CN=clica CA rsa
 -----BEGIN CERTIFICATE-----
-MIICNDCCAZ2gAwIBAgIBAjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
-cGxlLm5ldDEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwM1oX
-DTM4MDEwMTEyMzQwM1owNzEUMBIGA1UEChMLZXhhbXBsZS5uZXQxHzAdBgNVBAMT
+MIICGDCCAYGgAwIBAgIBQjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+cGxlLm5ldDEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQxNFoX
+DTM4MDEwMTEyMzQxNFowNzEUMBIGA1UEChMLZXhhbXBsZS5uZXQxHzAdBgNVBAMT
 FmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
-AoGBALMuDick/uNCkK8zWtdko5eynjJq0y8NVNlhSFkbwfjbxOQycuyMhMlYNnvs
-ESWZTV5ckpsvoDrFQLFk6ZB7RVYHUoOHNfANm8JWC9GR5zqbquibA/MMQ4h2Xlkz
-zQz12AzPpouZUyYs1+SjwlgfBRVhtxApDR2bPEDzI6s9VUdXAgMBAAGjWjBYMA4G
-A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMDIGA1UdHwQrMCkwJ6Al
-oCOGIWh0dHA6Ly9jcmwuZXhhbXBsZS5uZXQvbGF0ZXN0LmNybDANBgkqhkiG9w0B
-AQsFAAOBgQDCXkPeCURjOJwCBgbLERuNghPiWLqHPopm1idM2A032jDgbRXD9/DP
-1xOPgSLEW59EiJac0RNae0D2KyhnG90NZLccXK0a9Uu1iaAmdcJ7s4a0x0ZH9Kza
-hqz0cr4oStUOHxG/AtPKuhZ9PkZ7GDSPDW0k/z64WYCm1fqSWkbVig==
+AoGBAKFOi+80c9pb3UidQJd+TQ9j9lmOlw3HlhRxYNadHL2jZ98OHrwlDB1JgToy
+PruZ9yLq26a7c6sLYqEvpHulS6ACUqYaqu9kKb8m4l7xlheoyLT/jkZjq4Z0owp8
+PhzYl4p3M23rQzNSXcHCxcwu+6KPJ8FgrdNuB2RmHU2M27wRAgMBAAGjPjA8MA4G
+A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMBYGA1UdDgQPBA1BQWJ0
+d0N4Y1hnYjBRMA0GCSqGSIb3DQEBCwUAA4GBAAUlBd0/XrkhQ6Gm8s44uOU/gSAe
+Ap8baRLuhTrrvzd+nPDBN0YbwVUMwd9TbY4MsmDy+GhE9/V8i8OydEshl2iE15+E
+JX2DJEmNd7RMfWb6EIZVuzFFDWRszxA14YdNvDXjwS6BYmsSWJsNH4P/eTRrTCJi
+C53ODVdhE6yCQs1m
 -----END CERTIFICATE-----
 Bag Attributes
     friendlyName: Certificate Authority rsa
 subject=/O=example.net/CN=clica CA rsa
 issuer=/O=example.net/CN=clica CA rsa
 -----BEGIN CERTIFICATE-----
-MIIB9jCCAV+gAwIBAgIBATANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
-cGxlLm5ldDEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwM1oX
-DTM4MDEwMTEyMzQwM1owLTEUMBIGA1UEChMLZXhhbXBsZS5uZXQxFTATBgNVBAMT
-DGNsaWNhIENBIHJzYTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA3kwC9CHz
-JH7sEDkHMdZRq8+XpV7l/hEqfv2gPvT3mak46dWrI/T3pJOqyNvUZV/LJ/gx/0uw
-9pmCg6Y5zNCN0qAGY4rSS/sbEOLYIw5wJbFnYfHtTwe3ZAdG+5WqKMBF2lHNBM3b
-PUB/kweoLhNLwserKHwMDC3sksfrwH29rpMCAwEAAaMmMCQwEgYDVR0TAQH/BAgw
-BgEB/wIBATAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADgYEAzXt6KHIB
-qOJfZECgwhAWipxVR0BXek0hAfyTWl7q18+mWKYydQW0Z2VMN4Bq/ZUlOg+EM8NU
-1n9PJ4+I2QgAwVVXN4+cz7zgZ6XRZc1OkE98NyK504bVpJpan1gsx3I5GLJUgP2t
-B/WwqoFO+ANhT2margZSM6avJfaIh8gEass=
+MIIB9jCCAV+gAwIBAgIBQTANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+cGxlLm5ldDEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQxNFoX
+DTM4MDEwMTEyMzQxNFowLTEUMBIGA1UEChMLZXhhbXBsZS5uZXQxFTATBgNVBAMT
+DGNsaWNhIENBIHJzYTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAs89Jw+yK
+ohiMwcSLAciqgj5CtxYRsoW1AmQrhD3QwE6es0RBjTGp5SNjjPlRxCZ5T+dQQXR1
+RirvSKH+isbd1ENIbS9dPgaR2mFUYwcSxUIRrXn4mkxZ/QtpTVOoY184lFAPhTrW
+et4o+wE9OI2e75RD5GdAyB/52paGplt+K38CAwEAAaMmMCQwEgYDVR0TAQH/BAgw
+BgEB/wIBATAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADgYEAOcXFUXls
+ChTDzMe2y+qv1YlOZbkf43S9je72ATYXzS7/eT8I4sAq/CFdgmn+lw5kHJlgxCag
+BPwuLYHW55r69WI1IwQHrJXaavyPSkonVgK+ZssEcQmqbgNj8oV5ZnyzYnNZv0VU
+nMl1n6nCl1xdUwPwhhdssGXEoX8OF5iMw4U=
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.net/revoked1.example.net/cert8.db b/test/aux-fixed/exim-ca/example.net/revoked1.example.net/cert8.db
index b5a81a847..032179c75 100644
--- a/test/aux-fixed/exim-ca/example.net/revoked1.example.net/cert8.db
+++ b/test/aux-fixed/exim-ca/example.net/revoked1.example.net/cert8.db
diff --git a/test/aux-fixed/exim-ca/example.net/revoked1.example.net/key3.db b/test/aux-fixed/exim-ca/example.net/revoked1.example.net/key3.db
index e6ebd8e85..b9ef70b86 100644
--- a/test/aux-fixed/exim-ca/example.net/revoked1.example.net/key3.db
+++ b/test/aux-fixed/exim-ca/example.net/revoked1.example.net/key3.db
diff --git a/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.chain.pem b/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.chain.pem
index 4e5064d0f..b3220e2aa 100644
--- a/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.chain.pem
+++ b/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.chain.pem
@@ -1,35 +1,35 @@
 Bag Attributes
     friendlyName: revoked1.example.net
-    localKeyID: 57 06 4E 14 FC DC 71 C6 63 79 23 6B 37 E6 62 C4 FC DE 8A 12 
+    localKeyID: 39 28 04 F7 9B 40 F5 6F 6D F7 72 3D 22 52 17 63 86 D7 09 5B 
 subject=/CN=revoked1.example.net
 issuer=/O=example.net/CN=clica Signing Cert rsa
 -----BEGIN CERTIFICATE-----
 MIICjTCCAfagAwIBAgIBZjANBgkqhkiG9w0BAQsFADA3MRQwEgYDVQQKEwtleGFt
 cGxlLm5ldDEfMB0GA1UEAxMWY2xpY2EgU2lnbmluZyBDZXJ0IHJzYTAeFw0xMjEx
-MDExMjM0MDNaFw0zNzEyMDExMjM0MDNaMB8xHTAbBgNVBAMTFHJldm9rZWQxLmV4
-YW1wbGUubmV0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQClVUp0vfMtcek7
-PsuUAGg48vVKkml3MA71SPxgfjTb3RZFrIaezkF4AJBeT3l4VHNMU7tDqSnvqOgT
-CH2+32Ezjqbod5KtRMLstKUk1h9YZyWZTvqGTHXb+uVzRe8TQZTs8XIcNdPjTXTe
-g0Pd4tQzioM7+Outj0M3V+dK+BYh8QIDAQABo4HAMIG9MA4GA1UdDwEB/wQEAwIE
+MDExMjM0MTVaFw0zNzEyMDExMjM0MTVaMB8xHTAbBgNVBAMTFHJldm9rZWQxLmV4
+YW1wbGUubmV0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDC/MjDGXrdS86L
+zBBqkdktHEvcc8c62zjdFIbpr45sltqx3o2GstMnTHCkRs48qBj+V1/vYXYoDT2T
+qJhFDbIR0AoHcin1BTqGl62xrKN/31C8K7e0EnbGZytVvguhLBhv7Pymvn9YKUaC
+zo5yoWj+jxr6PjP5mh1pTWZMulUm/QIDAQABo4HAMIG9MA4GA1UdDwEB/wQEAwIE
 8DAgBgNVHSUBAf8EFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwMgYDVR0fBCswKTAn
 oCWgI4YhaHR0cDovL2NybC5leGFtcGxlLm5ldC9sYXRlc3QuY3JsMDQGCCsGAQUF
 BwEBBCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29zY3AuZXhhbXBsZS5uZXQvMB8G
 A1UdEQQYMBaCFHJldm9rZWQxLmV4YW1wbGUubmV0MA0GCSqGSIb3DQEBCwUAA4GB
-AH9kBPA4F7u2PcjLNm+AYRWQv2bnOBLmrL/qBpfwFxJ0Ptt/bkPW8TpvQJwjxc+o
-gnCwZVL5RIUr+Q6UFar1UKPC+fPC0m5BuXDZNTXShlQdUrNoIvvqNjvBNFiKJVLj
-bALzz44mI44mpEAJiuiQcDdVFcD7s3o0knDxvy8ReBCr
+ADFL2kIImEaICoOAOxTsP/pQViyEDQNomaGnfRtqM9QREFIqzjIr15H+ZC6e0MQx
+blu6sp/IdDvbNBLpLzAdLuaukVwvR16uYw3Tb/5C5UbjGv4rTgEQghcoDRQxL6Yy
+ze9qOw8hT28ENT7OzHGXoR5LFdpIelZyrHIZxf7e3Ir1
 -----END CERTIFICATE-----
 -----BEGIN CERTIFICATE-----
-MIICNDCCAZ2gAwIBAgIBAjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
-cGxlLm5ldDEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwM1oX
-DTM4MDEwMTEyMzQwM1owNzEUMBIGA1UEChMLZXhhbXBsZS5uZXQxHzAdBgNVBAMT
+MIICGDCCAYGgAwIBAgIBQjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+cGxlLm5ldDEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQxNFoX
+DTM4MDEwMTEyMzQxNFowNzEUMBIGA1UEChMLZXhhbXBsZS5uZXQxHzAdBgNVBAMT
 FmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
-AoGBALMuDick/uNCkK8zWtdko5eynjJq0y8NVNlhSFkbwfjbxOQycuyMhMlYNnvs
-ESWZTV5ckpsvoDrFQLFk6ZB7RVYHUoOHNfANm8JWC9GR5zqbquibA/MMQ4h2Xlkz
-zQz12AzPpouZUyYs1+SjwlgfBRVhtxApDR2bPEDzI6s9VUdXAgMBAAGjWjBYMA4G
-A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMDIGA1UdHwQrMCkwJ6Al
-oCOGIWh0dHA6Ly9jcmwuZXhhbXBsZS5uZXQvbGF0ZXN0LmNybDANBgkqhkiG9w0B
-AQsFAAOBgQDCXkPeCURjOJwCBgbLERuNghPiWLqHPopm1idM2A032jDgbRXD9/DP
-1xOPgSLEW59EiJac0RNae0D2KyhnG90NZLccXK0a9Uu1iaAmdcJ7s4a0x0ZH9Kza
-hqz0cr4oStUOHxG/AtPKuhZ9PkZ7GDSPDW0k/z64WYCm1fqSWkbVig==
+AoGBAKFOi+80c9pb3UidQJd+TQ9j9lmOlw3HlhRxYNadHL2jZ98OHrwlDB1JgToy
+PruZ9yLq26a7c6sLYqEvpHulS6ACUqYaqu9kKb8m4l7xlheoyLT/jkZjq4Z0owp8
+PhzYl4p3M23rQzNSXcHCxcwu+6KPJ8FgrdNuB2RmHU2M27wRAgMBAAGjPjA8MA4G
+A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMBYGA1UdDgQPBA1BQWJ0
+d0N4Y1hnYjBRMA0GCSqGSIb3DQEBCwUAA4GBAAUlBd0/XrkhQ6Gm8s44uOU/gSAe
+Ap8baRLuhTrrvzd+nPDBN0YbwVUMwd9TbY4MsmDy+GhE9/V8i8OydEshl2iE15+E
+JX2DJEmNd7RMfWb6EIZVuzFFDWRszxA14YdNvDXjwS6BYmsSWJsNH4P/eTRrTCJi
+C53ODVdhE6yCQs1m
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.key b/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.key
index c67310cb7..a0ac068bf 100644
--- a/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.key
+++ b/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.key
@@ -1,21 +1,22 @@
 Bag Attributes
     friendlyName: revoked1.example.net
-    localKeyID: 57 06 4E 14 FC DC 71 C6 63 79 23 6B 37 E6 62 C4 FC DE 8A 12 
+    localKeyID: 39 28 04 F7 9B 40 F5 6F 6D F7 72 3D 22 52 17 63 86 D7 09 5B 
 Key Attributes: <No Attributes>
 -----BEGIN ENCRYPTED PRIVATE KEY-----
-MIICxjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQIf9OSVB86sHICAggA
-MBQGCCqGSIb3DQMHBAiqIV68HjGNLwSCAoAdEXi9V8dcsC6EEfsQYOTicEAzPxhv
-lGIqP+vwr9q2By1bV/L4gZEHX7ok+ZVTaf5YsRQONNhxaiZzoKoyb3cfWMg9kaH/
-jOctkpCHzt5g6denofUtx2Qir9ktmu1bIy015yT2kNdEBR8RIgyWkYkbcuPqnfJU
-4g9c0t7Pa6yBkSau8ilLd+USV/BRLW9f2HxMtWmZTNWcK3mpsALamp7Wabka/S0G
-fhJawgdhqvDQXd/f5byKykQ7lqTR1s33eipa1EOEFmwDePHzS5SDnZ5wze+FfOsF
-9SZSdUjuRv85hV0jJg1XgeoV0Ax8Fo+35xRvIEQswkzV08/9i4A3cHskaya7jMGX
-l9bs+/rZWHsbIIp5SFrFIqbIvWreebH2rmgyKjk94GbioiijnY8xRHE98wG4lGB4
-51NPMKmnM1D+wXsqDgR5tkz9/U1V5bX7VvDr+4mfm9X9YbUiUy9VBfWa88bqou3T
-cRtPyEX7gx6dtgsAl4QUCycdsPpG+PjbtRwZq2Ox0MxS4bsmYpvowWCk+cZNzsXq
-FdSqiqG661AzEVqUlgU1MuPH10HCpy1mTICr638Gq7pQrHhR475QowZ+yvxL+VdU
-FuC3s+7RBebWzyswuALv5zOC41TqynAFVnoV8yKxFutdvi9DlvScyXKZ+0wb2hJe
-Je1GXLsGqZ1ArPrLtxrcA7MuSfM+IVHO3jL0qCOM76IV8Mbm874ubkyTnIL6FPon
-4G5ZZ10KAwRolBTrPwbyC058s+XxyumGLVgZ0FfVqF1MIU7G8hgreQ4vyXsiOT5p
-bkv01MyCdnUZQO4XlT2lndRnL9xrQIIsjLZYHjDkkmXmO6sVBu2bWiMT
+MIIC1DBOBgkqhkiG9w0BBQ0wQTApBgkqhkiG9w0BBQwwHAQIhx9aJ+TiNIQCAggA
+MAwGCCqGSIb3DQIJBQAwFAYIKoZIhvcNAwcECPE14MZqoXYGBIICgKA1y27TAjxn
+OoKp8K2NHxEeHNjJR7q7L9PshVgBVI0puDA9n8893xsQ/ESTRarEoAlWjhucQ8+x
+fpAXiWh1AxDEYVlW2q0IKxXbe0u241i7QyCDBvYQuLJBTWv7OLsR7JqlzLwanvpC
+YKlNjMg+0IAglwyNeanAC3GyHbR01P6GK6bXKchDgsm2O5iTxEFYTZrXY2SYXXJ0
+FA/5hAh9BraeDPFslwdb8vjGjtBnKTHknXb0RFw6uHoc18++iplqqKN71NIGoTVA
+/1IuaZLB8mEYYdJMUpYGFYDxi0kHT9o4kYJQWJs+pjnOIuorf/XTT5l9InrGTBjS
+atIZAAhX6BG7xPijUpfxhu2Xjsfl28hssU7nE+50DaEkrUy5O/3VyiwlZvjqQ4Y7
+e+xIFTUoGJw9Noyl8fVaJFwXXGXhJ84/qAA8gKsekerVsVf5jpzN12G+Db0cH+L8
+NBS5SLioWLNyQslYc+DDB6k4G3u0XVOT0iLX8rLsKljqkpNaq/0dn/H7PYLcqt5X
+qAgGvblE5RqDpMtMN1o8G8CS9r2HIXGMfuD2NcbfuFpRlM6QygSVIH7OBMelHAhV
+Cvl5NXrRU+8pPqek1gqiAjpoRdGXgav7hLYe018jUdNpr0vJKM0jBXqQ8MERV701
+avOLD7qTuy8mrsIDcBdJE9Mtl7ZaquDlLNFAeFF9VIhmYz/afN5iKvxDAiRm6DFL
+Z1hGYUqLOhU8wxiHsGK3rp9f34Xz1S1Jb8vss2r31z/inIX1OUvzJGpFJc5hUU7k
+xFjI+4Z+jUkalpSBmzQ6EY5HR2dkEwP0Sicbnmnd2Pex8wVL/D83D/FlZ5OMYRu4
+O9HWMXlkYXk=
 -----END ENCRYPTED PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.dated.resp b/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.dated.resp
index df02cbb38..5803ebbab 100644
--- a/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.dated.resp
+++ b/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.dated.resp
diff --git a/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.good.resp b/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.good.resp
index 7d9b8a383..15e26b294 100644
--- a/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.good.resp
+++ b/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.good.resp
diff --git a/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.req b/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.req
index 0fdc79a07..6bbb37f4c 100644
--- a/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.req
+++ b/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.req
diff --git a/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.revoked.resp b/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.revoked.resp
index ae516388e..c0b8ec694 100644
--- a/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.revoked.resp
+++ b/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.revoked.resp
diff --git a/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.signer.dated.resp b/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.signer.dated.resp
index ef8dd3045..8f375b104 100644
--- a/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.signer.dated.resp
+++ b/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.signer.dated.resp
diff --git a/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.signer.good.resp b/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.signer.good.resp
index af17e90e3..dd70b243c 100644
--- a/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.signer.good.resp
+++ b/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.signer.good.resp
diff --git a/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.signer.revoked.resp b/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.signer.revoked.resp
index 0f88626f6..4d7c6e9ff 100644
--- a/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.signer.revoked.resp
+++ b/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.signer.revoked.resp
diff --git a/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.signernocert.dated.resp b/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.signernocert.dated.resp
index 2e5c57439..0d134545a 100644
--- a/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.signernocert.dated.resp
+++ b/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.signernocert.dated.resp
diff --git a/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.signernocert.good.resp b/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.signernocert.good.resp
index 7fd640deb..c4f3d01d2 100644
--- a/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.signernocert.good.resp
+++ b/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.signernocert.good.resp
diff --git a/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.signernocert.revoked.resp b/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.signernocert.revoked.resp
index 2aa919492..aa98b18ba 100644
--- a/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.signernocert.revoked.resp
+++ b/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.signernocert.revoked.resp
diff --git a/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.p12 b/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.p12
index 86bcddae0..094e804f0 100644
--- a/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.p12
+++ b/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.p12
diff --git a/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.pem b/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.pem
index f938b6878..e2c0eb4a2 100644
--- a/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.pem
+++ b/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.pem
@@ -1,21 +1,21 @@
 Bag Attributes
     friendlyName: revoked1.example.net
-    localKeyID: 57 06 4E 14 FC DC 71 C6 63 79 23 6B 37 E6 62 C4 FC DE 8A 12 
+    localKeyID: 39 28 04 F7 9B 40 F5 6F 6D F7 72 3D 22 52 17 63 86 D7 09 5B 
 subject=/CN=revoked1.example.net
 issuer=/O=example.net/CN=clica Signing Cert rsa
 -----BEGIN CERTIFICATE-----
 MIICjTCCAfagAwIBAgIBZjANBgkqhkiG9w0BAQsFADA3MRQwEgYDVQQKEwtleGFt
 cGxlLm5ldDEfMB0GA1UEAxMWY2xpY2EgU2lnbmluZyBDZXJ0IHJzYTAeFw0xMjEx
-MDExMjM0MDNaFw0zNzEyMDExMjM0MDNaMB8xHTAbBgNVBAMTFHJldm9rZWQxLmV4
-YW1wbGUubmV0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQClVUp0vfMtcek7
-PsuUAGg48vVKkml3MA71SPxgfjTb3RZFrIaezkF4AJBeT3l4VHNMU7tDqSnvqOgT
-CH2+32Ezjqbod5KtRMLstKUk1h9YZyWZTvqGTHXb+uVzRe8TQZTs8XIcNdPjTXTe
-g0Pd4tQzioM7+Outj0M3V+dK+BYh8QIDAQABo4HAMIG9MA4GA1UdDwEB/wQEAwIE
+MDExMjM0MTVaFw0zNzEyMDExMjM0MTVaMB8xHTAbBgNVBAMTFHJldm9rZWQxLmV4
+YW1wbGUubmV0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDC/MjDGXrdS86L
+zBBqkdktHEvcc8c62zjdFIbpr45sltqx3o2GstMnTHCkRs48qBj+V1/vYXYoDT2T
+qJhFDbIR0AoHcin1BTqGl62xrKN/31C8K7e0EnbGZytVvguhLBhv7Pymvn9YKUaC
+zo5yoWj+jxr6PjP5mh1pTWZMulUm/QIDAQABo4HAMIG9MA4GA1UdDwEB/wQEAwIE
 8DAgBgNVHSUBAf8EFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwMgYDVR0fBCswKTAn
 oCWgI4YhaHR0cDovL2NybC5leGFtcGxlLm5ldC9sYXRlc3QuY3JsMDQGCCsGAQUF
 BwEBBCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29zY3AuZXhhbXBsZS5uZXQvMB8G
 A1UdEQQYMBaCFHJldm9rZWQxLmV4YW1wbGUubmV0MA0GCSqGSIb3DQEBCwUAA4GB
-AH9kBPA4F7u2PcjLNm+AYRWQv2bnOBLmrL/qBpfwFxJ0Ptt/bkPW8TpvQJwjxc+o
-gnCwZVL5RIUr+Q6UFar1UKPC+fPC0m5BuXDZNTXShlQdUrNoIvvqNjvBNFiKJVLj
-bALzz44mI44mpEAJiuiQcDdVFcD7s3o0knDxvy8ReBCr
+ADFL2kIImEaICoOAOxTsP/pQViyEDQNomaGnfRtqM9QREFIqzjIr15H+ZC6e0MQx
+blu6sp/IdDvbNBLpLzAdLuaukVwvR16uYw3Tb/5C5UbjGv4rTgEQghcoDRQxL6Yy
+ze9qOw8hT28ENT7OzHGXoR5LFdpIelZyrHIZxf7e3Ir1
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.unlocked.key b/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.unlocked.key
index fee960ce4..3ea7070ff 100644
--- a/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.unlocked.key
+++ b/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.unlocked.key
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXAIBAAKBgQClVUp0vfMtcek7PsuUAGg48vVKkml3MA71SPxgfjTb3RZFrIae
-zkF4AJBeT3l4VHNMU7tDqSnvqOgTCH2+32Ezjqbod5KtRMLstKUk1h9YZyWZTvqG
-THXb+uVzRe8TQZTs8XIcNdPjTXTeg0Pd4tQzioM7+Outj0M3V+dK+BYh8QIDAQAB
-AoGAEaS5Mh2eMJSWJOQl4fisJp2o1wkqV5WJlxvvkNWPCwJ8MLnBUPumSWnX/jSB
-fDmY50WNN6J7DvAJuhQ/JQoeC3BN8tIAjbgxFEa3hDAnO7qPhire0R56qhnBbx97
-hBvc1w87mUb1qvTX3LZHMv3k7R+oYlA3ManFGfe+2XKY5/ECQQDOx9Ntet4jngjf
-MaXPC75Pe3fbqHzm6mU31Lecx57jYehlm7MLZfgOtwNjFLFAG2e4GXLdQnNKJNQF
-00NrXqC5AkEAzK/eEi2P57qQu0vEEzkNYB9PdOBvrQ8P2jmwN0O1p+T2XAbbIWiR
-kuIAIJltHEAhTHEgMdod6Ys4umpx2Zc++QJBAK1rwdJr3aoZfG9UAC+pNa8LafZ7
-VGWF5+XvLR77/DHPh0zQTFUe6+/LZbfPPuj5Ev+/uCoA9RgV0wwfpseB0WECQDID
-IqKUaV34ctagq5b60K7U16g6Em9Zh8kNYWYPcDpGsn9H2ZDvKOqXt+o/Mq69aKVx
-2qjzn21p7AF4crr0vpkCQGNfEwTDUbdYMv0nuVF1J/GBCAcaUwzF/LUAUU0HjCRl
-ANzfeChglO4b/4UZQWrtJr8Ut2GFFxad7ClzI/9xnqc=
+MIICXAIBAAKBgQDC/MjDGXrdS86LzBBqkdktHEvcc8c62zjdFIbpr45sltqx3o2G
+stMnTHCkRs48qBj+V1/vYXYoDT2TqJhFDbIR0AoHcin1BTqGl62xrKN/31C8K7e0
+EnbGZytVvguhLBhv7Pymvn9YKUaCzo5yoWj+jxr6PjP5mh1pTWZMulUm/QIDAQAB
+AoGAD9Rm1hP0+g9D8ux7rrMtfvCLpheOJpSSjrwyYblbZixvD76iHbvZ0Zhukp+e
+8aSx9sAQLUZryb+dbqXiysRcXtp0UQ5x6T8cY8ucecMQ3iQO2sjUeZW6h/qR+dF8
+MAXZ74WdU0hDapNTLwoWviahYUq2/pYGVu0vJtnJAr6dKZ8CQQDw3XEH7ngIXhBe
++KBpCoOoDP/dBikITtVn1fBFXHdLqHT57tDOQsRs5v97JZ1H1PSTz1Qyy7Tc5w28
+NCs5AkAfAkEAzz1a+rnCRf2YEidM5szR7PlbLUO/PEl9/u1BUHWLZ9AreMZv1R0k
+JMvBhsJwAAiH8bTpVWOONfSCcp/6TxJFYwJAMj2eZA8jzmsAcy7dFsvwpk7/17R/
+PpJjBSOk2HLvF0LuE2vy9fMLUcPlKmSwJ9mNon8uiuHeue0f+k/PbDbB9QJBAJpG
+vrfwGaQpCVBaWXFoAM89QpcL3A1xWI6y6PCQ0NrTqckbUJ2COCn8VXGQxfgAYdOa
+LioXFwMrpwDV/21l2KkCQDA6xvH3OJRwEWdba5B/02OeezOHeXsOLHk6YXt+5A6v
+rsknC1n/CkHk8UvMNnO6ZPIkoLm8bfFsCdxuDRIcs+M=
 -----END RSA PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.net/revoked2.example.net/ca_chain.pem b/test/aux-fixed/exim-ca/example.net/revoked2.example.net/ca_chain.pem
index fef1020ef..3beef64e5 100644
--- a/test/aux-fixed/exim-ca/example.net/revoked2.example.net/ca_chain.pem
+++ b/test/aux-fixed/exim-ca/example.net/revoked2.example.net/ca_chain.pem
@@ -3,33 +3,33 @@ Bag Attributes
 subject=/O=example.net/CN=clica Signing Cert rsa
 issuer=/O=example.net/CN=clica CA rsa
 -----BEGIN CERTIFICATE-----
-MIICNDCCAZ2gAwIBAgIBAjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
-cGxlLm5ldDEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwM1oX
-DTM4MDEwMTEyMzQwM1owNzEUMBIGA1UEChMLZXhhbXBsZS5uZXQxHzAdBgNVBAMT
+MIICGDCCAYGgAwIBAgIBQjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+cGxlLm5ldDEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQxNFoX
+DTM4MDEwMTEyMzQxNFowNzEUMBIGA1UEChMLZXhhbXBsZS5uZXQxHzAdBgNVBAMT
 FmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
-AoGBALMuDick/uNCkK8zWtdko5eynjJq0y8NVNlhSFkbwfjbxOQycuyMhMlYNnvs
-ESWZTV5ckpsvoDrFQLFk6ZB7RVYHUoOHNfANm8JWC9GR5zqbquibA/MMQ4h2Xlkz
-zQz12AzPpouZUyYs1+SjwlgfBRVhtxApDR2bPEDzI6s9VUdXAgMBAAGjWjBYMA4G
-A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMDIGA1UdHwQrMCkwJ6Al
-oCOGIWh0dHA6Ly9jcmwuZXhhbXBsZS5uZXQvbGF0ZXN0LmNybDANBgkqhkiG9w0B
-AQsFAAOBgQDCXkPeCURjOJwCBgbLERuNghPiWLqHPopm1idM2A032jDgbRXD9/DP
-1xOPgSLEW59EiJac0RNae0D2KyhnG90NZLccXK0a9Uu1iaAmdcJ7s4a0x0ZH9Kza
-hqz0cr4oStUOHxG/AtPKuhZ9PkZ7GDSPDW0k/z64WYCm1fqSWkbVig==
+AoGBAKFOi+80c9pb3UidQJd+TQ9j9lmOlw3HlhRxYNadHL2jZ98OHrwlDB1JgToy
+PruZ9yLq26a7c6sLYqEvpHulS6ACUqYaqu9kKb8m4l7xlheoyLT/jkZjq4Z0owp8
+PhzYl4p3M23rQzNSXcHCxcwu+6KPJ8FgrdNuB2RmHU2M27wRAgMBAAGjPjA8MA4G
+A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMBYGA1UdDgQPBA1BQWJ0
+d0N4Y1hnYjBRMA0GCSqGSIb3DQEBCwUAA4GBAAUlBd0/XrkhQ6Gm8s44uOU/gSAe
+Ap8baRLuhTrrvzd+nPDBN0YbwVUMwd9TbY4MsmDy+GhE9/V8i8OydEshl2iE15+E
+JX2DJEmNd7RMfWb6EIZVuzFFDWRszxA14YdNvDXjwS6BYmsSWJsNH4P/eTRrTCJi
+C53ODVdhE6yCQs1m
 -----END CERTIFICATE-----
 Bag Attributes
     friendlyName: Certificate Authority rsa
 subject=/O=example.net/CN=clica CA rsa
 issuer=/O=example.net/CN=clica CA rsa
 -----BEGIN CERTIFICATE-----
-MIIB9jCCAV+gAwIBAgIBATANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
-cGxlLm5ldDEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwM1oX
-DTM4MDEwMTEyMzQwM1owLTEUMBIGA1UEChMLZXhhbXBsZS5uZXQxFTATBgNVBAMT
-DGNsaWNhIENBIHJzYTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA3kwC9CHz
-JH7sEDkHMdZRq8+XpV7l/hEqfv2gPvT3mak46dWrI/T3pJOqyNvUZV/LJ/gx/0uw
-9pmCg6Y5zNCN0qAGY4rSS/sbEOLYIw5wJbFnYfHtTwe3ZAdG+5WqKMBF2lHNBM3b
-PUB/kweoLhNLwserKHwMDC3sksfrwH29rpMCAwEAAaMmMCQwEgYDVR0TAQH/BAgw
-BgEB/wIBATAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADgYEAzXt6KHIB
-qOJfZECgwhAWipxVR0BXek0hAfyTWl7q18+mWKYydQW0Z2VMN4Bq/ZUlOg+EM8NU
-1n9PJ4+I2QgAwVVXN4+cz7zgZ6XRZc1OkE98NyK504bVpJpan1gsx3I5GLJUgP2t
-B/WwqoFO+ANhT2margZSM6avJfaIh8gEass=
+MIIB9jCCAV+gAwIBAgIBQTANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+cGxlLm5ldDEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQxNFoX
+DTM4MDEwMTEyMzQxNFowLTEUMBIGA1UEChMLZXhhbXBsZS5uZXQxFTATBgNVBAMT
+DGNsaWNhIENBIHJzYTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAs89Jw+yK
+ohiMwcSLAciqgj5CtxYRsoW1AmQrhD3QwE6es0RBjTGp5SNjjPlRxCZ5T+dQQXR1
+RirvSKH+isbd1ENIbS9dPgaR2mFUYwcSxUIRrXn4mkxZ/QtpTVOoY184lFAPhTrW
+et4o+wE9OI2e75RD5GdAyB/52paGplt+K38CAwEAAaMmMCQwEgYDVR0TAQH/BAgw
+BgEB/wIBATAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADgYEAOcXFUXls
+ChTDzMe2y+qv1YlOZbkf43S9je72ATYXzS7/eT8I4sAq/CFdgmn+lw5kHJlgxCag
+BPwuLYHW55r69WI1IwQHrJXaavyPSkonVgK+ZssEcQmqbgNj8oV5ZnyzYnNZv0VU
+nMl1n6nCl1xdUwPwhhdssGXEoX8OF5iMw4U=
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.net/revoked2.example.net/cert8.db b/test/aux-fixed/exim-ca/example.net/revoked2.example.net/cert8.db
index ca5847ed9..62d64bb63 100644
--- a/test/aux-fixed/exim-ca/example.net/revoked2.example.net/cert8.db
+++ b/test/aux-fixed/exim-ca/example.net/revoked2.example.net/cert8.db
diff --git a/test/aux-fixed/exim-ca/example.net/revoked2.example.net/key3.db b/test/aux-fixed/exim-ca/example.net/revoked2.example.net/key3.db
index bed8d0958..69d7c9c82 100644
--- a/test/aux-fixed/exim-ca/example.net/revoked2.example.net/key3.db
+++ b/test/aux-fixed/exim-ca/example.net/revoked2.example.net/key3.db
diff --git a/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.chain.pem b/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.chain.pem
index cd6072437..9e20dd40d 100644
--- a/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.chain.pem
+++ b/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.chain.pem
@@ -1,35 +1,35 @@
 Bag Attributes
     friendlyName: revoked2.example.net
-    localKeyID: 9D 94 B3 78 78 92 F0 B8 83 21 D7 C0 CB 0E 1B 33 EF 39 B6 17 
+    localKeyID: 83 13 41 37 13 F9 8B 48 BF 7A 19 2E AF 2C C3 CE 41 AE BF 29 
 subject=/CN=revoked2.example.net
 issuer=/O=example.net/CN=clica Signing Cert rsa
 -----BEGIN CERTIFICATE-----
 MIICjjCCAfegAwIBAgICAMowDQYJKoZIhvcNAQELBQAwNzEUMBIGA1UEChMLZXhh
 bXBsZS5uZXQxHzAdBgNVBAMTFmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwHhcNMTIx
-MTAxMTIzNDA0WhcNMzcxMjAxMTIzNDA0WjAfMR0wGwYDVQQDExRyZXZva2VkMi5l
-eGFtcGxlLm5ldDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA3Se+qbZkX/Fl
-i5PBS0yDe8c7so0Ze+yVeuM0NBZY0h0K6ahKb8NuFQ7jpL7BtQRlFGoU2foVLdLd
-/zSg5802qaTsuDISGnLxX0Fpr1gm+OvQkGdJt8eeVZEpNLph8zvp3eFtG8HE9l6R
-QbsEDTnJGHYlHNscnW1CMB3p6NyzMXkCAwEAAaOBwDCBvTAOBgNVHQ8BAf8EBAMC
+MTAxMTIzNDE3WhcNMzcxMjAxMTIzNDE3WjAfMR0wGwYDVQQDExRyZXZva2VkMi5l
+eGFtcGxlLm5ldDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAv+zvAcvxTw7G
+L/0U4pF2Q9ozF+fT4icIhPfn4nJ26TpNNEPzGaZcBHE1uoYF26eRBKkPuI9jZLKK
+aI4r/stZJHLdPRcar6jo9UOWfkh8cFkL+sZIoDu9B70arwjbYFQ+SpL/MDXGCP7/
+QMU+UM07wiNhYwpI5wk7FGxSWBIiACUCAwEAAaOBwDCBvTAOBgNVHQ8BAf8EBAMC
 BPAwIAYDVR0lAQH/BBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMDIGA1UdHwQrMCkw
 J6AloCOGIWh0dHA6Ly9jcmwuZXhhbXBsZS5uZXQvbGF0ZXN0LmNybDA0BggrBgEF
 BQcBAQQoMCYwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vc2NwLmV4YW1wbGUubmV0LzAf
 BgNVHREEGDAWghRyZXZva2VkMi5leGFtcGxlLm5ldDANBgkqhkiG9w0BAQsFAAOB
-gQBomN+m0L4SwIi+CoZOyIQTjKiKZU2XuripqrazQflD4hJoWqFxod6gGrrLBhSS
-481+/zt26E0+49e9f6rU4FLnkjt6rr2hoJk8Sw9/MRUQ54HroEq3Gk6fPJjIlZd6
-DXp1rbYTRkJKLZcdDtDjUqENU750mQfLIl7zQ9CGweKZpA==
+gQCA1RX+/cyPFYaT5X8jBtWpkdUMpJUiZFVWr7RW5iAJm6F6SwHPIA9vkVtaOZfA
+TM89+p8SiAR7cKAdC6NGd6yer5HT/15r4YZY8t9cEB1JmXvmOtof+qjBGTmm9pJJ
+eT1LNAS1PPiBYPh5U+JEC1rgB2TR8GkZ064pnWAtyKCJWw==
 -----END CERTIFICATE-----
 -----BEGIN CERTIFICATE-----
-MIICNDCCAZ2gAwIBAgIBAjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
-cGxlLm5ldDEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwM1oX
-DTM4MDEwMTEyMzQwM1owNzEUMBIGA1UEChMLZXhhbXBsZS5uZXQxHzAdBgNVBAMT
+MIICGDCCAYGgAwIBAgIBQjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+cGxlLm5ldDEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQxNFoX
+DTM4MDEwMTEyMzQxNFowNzEUMBIGA1UEChMLZXhhbXBsZS5uZXQxHzAdBgNVBAMT
 FmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
-AoGBALMuDick/uNCkK8zWtdko5eynjJq0y8NVNlhSFkbwfjbxOQycuyMhMlYNnvs
-ESWZTV5ckpsvoDrFQLFk6ZB7RVYHUoOHNfANm8JWC9GR5zqbquibA/MMQ4h2Xlkz
-zQz12AzPpouZUyYs1+SjwlgfBRVhtxApDR2bPEDzI6s9VUdXAgMBAAGjWjBYMA4G
-A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMDIGA1UdHwQrMCkwJ6Al
-oCOGIWh0dHA6Ly9jcmwuZXhhbXBsZS5uZXQvbGF0ZXN0LmNybDANBgkqhkiG9w0B
-AQsFAAOBgQDCXkPeCURjOJwCBgbLERuNghPiWLqHPopm1idM2A032jDgbRXD9/DP
-1xOPgSLEW59EiJac0RNae0D2KyhnG90NZLccXK0a9Uu1iaAmdcJ7s4a0x0ZH9Kza
-hqz0cr4oStUOHxG/AtPKuhZ9PkZ7GDSPDW0k/z64WYCm1fqSWkbVig==
+AoGBAKFOi+80c9pb3UidQJd+TQ9j9lmOlw3HlhRxYNadHL2jZ98OHrwlDB1JgToy
+PruZ9yLq26a7c6sLYqEvpHulS6ACUqYaqu9kKb8m4l7xlheoyLT/jkZjq4Z0owp8
+PhzYl4p3M23rQzNSXcHCxcwu+6KPJ8FgrdNuB2RmHU2M27wRAgMBAAGjPjA8MA4G
+A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMBYGA1UdDgQPBA1BQWJ0
+d0N4Y1hnYjBRMA0GCSqGSIb3DQEBCwUAA4GBAAUlBd0/XrkhQ6Gm8s44uOU/gSAe
+Ap8baRLuhTrrvzd+nPDBN0YbwVUMwd9TbY4MsmDy+GhE9/V8i8OydEshl2iE15+E
+JX2DJEmNd7RMfWb6EIZVuzFFDWRszxA14YdNvDXjwS6BYmsSWJsNH4P/eTRrTCJi
+C53ODVdhE6yCQs1m
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.key b/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.key
index 762dfd421..961ac327b 100644
--- a/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.key
+++ b/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.key
@@ -1,21 +1,22 @@
 Bag Attributes
     friendlyName: revoked2.example.net
-    localKeyID: 9D 94 B3 78 78 92 F0 B8 83 21 D7 C0 CB 0E 1B 33 EF 39 B6 17 
+    localKeyID: 83 13 41 37 13 F9 8B 48 BF 7A 19 2E AF 2C C3 CE 41 AE BF 29 
 Key Attributes: <No Attributes>
 -----BEGIN ENCRYPTED PRIVATE KEY-----
-MIICxjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQIsyCJhTC8O8oCAggA
-MBQGCCqGSIb3DQMHBAgbxjkbvtYrXwSCAoB4294psQBogCZpAG8qJhEpCNl7jtD7
-Y7dZTMcifXZUzJhuWk68qIOAoPdxswrszif/+mry+ebEVPIKFRSdXudYoghI44bM
-BKm8eX6zy1EMZDJk5u1A/+U3ny21xS7avh4jHzzBWgDc3qXuE2oaTms4BNg2L++L
-Xj/6UA0+t3ieXRbTaDRehofuSZN6yWbCBpf/xpjOPiy6O0hsGdzSv228ok3RJNcH
-j83dtsQrDQqRKhx1ElfVgE68QuR+6LGYtjaxXi28SEKVdIA1JDDvTQyxw9l+cyzm
-awbVmYX4kzTP49VBe8y0QhVlZ4qKIIfsXz8Z7lSJxnYgoRqgXtjaqZ02YkKZhBfe
-EHXkofxtgDpIHs/vHQRtFwkHI7hPnTrKYCUkQzAysVVGMbfcqtfqTB4Cg8onrJHt
-vOXyKhDePYEt7D2JK/hJM+Dr5SbAeBOFD31ZYOxp4/dgT3kKuy3f7SKebAw+wgTZ
-qiGYAN9VLyyjqGs+PB8AtuMlyUCyOELZEJpedTp3bqun1C4zamvgZezXNN+87mUT
-uLVmEfAQ97Wkr1HwFq5QQ17bgEM58gwgGjGHySaLrjfeGqOIxT4/3LXTLYwnbR7Y
-lF+2frBjGxWxgljxuKwimUr/OQ/2HnBB24i7A5N2IVzDkGarxd2v6bkgQElxsNAc
-XwDZvP7wIzp3vpb3beWPG37t70PR+eWAJYNyGMRupPDJnXvnY05o0Gn2dKYPeGsI
-s21+elEFUMYvv3CCf8q+AfF5yXVkJC9/DOKIQR8kTHOlOPRJdhdE0NDUU0/2f+nY
-83Uvgrppv+N7Y6ADFTf73KlOTnn5MQStavXoduJYL1s//+T/BAImh4oe
+MIIC1DBOBgkqhkiG9w0BBQ0wQTApBgkqhkiG9w0BBQwwHAQIhxAelQVibiQCAggA
+MAwGCCqGSIb3DQIJBQAwFAYIKoZIhvcNAwcECN5FtKyn7wy2BIICgBPO92WTZxGt
+qAKlvORgY01WBoGNYwx5Ug/7uBwbzgHILdEGz3ZYfVffFmk+zZKlvDn2iKLtMCpb
+CE24ir9hKr+2EtXw1HDG0Zg5Ucb5xAZNMKBGh0oV8ay/g48gDTgFaSVsi40FxrlT
+S1Hzgj/ERDClFIzdMofUpkTveOzdJrp5zGHrHjBgPyF4dD+HAfvei3SODw6n0wiE
+QtCiMTofoc6M1HZEkgbUuK5iqKAYcYP9BiST1F5y5Hxae554jXOdZVrn2MyLvhvW
+h6eXYPBHbJY7SLlm8g68A6dr7Esau4lX6Ui5IVqC0RSdLnlHFT8wcaNOohvqOi5C
+1uS0UjEVujKvJDQ7i6OcU4mEL83PEMaEpgu+SprwpZpl3lXOM5RVf2MN6UQZ6iOU
+2VM0FYfrxNE+W7DVJrIJ2m4r7Ai7bSch+yjEbL1dGHcsO5npU+T8skUoyVnXZPNb
+2mq50Pg2L5bEWMQGOHmsaAwdl79mgpsqIIbG6zjUmAT71kl+TIETyacwil2du/Ur
+fcsvwryNxFOj/ERnaTDS2KyZLf+P8yvmRTVZbklp1Gjr6S518Pz/ipL+NLQyWrNz
+rmk215lccXau46f+5NTumEYSDk1FxbpmZm7wekkf7fh/waJGIwnx/feBz84V+vEt
+Rd63dzRWwpqV57n3hcb7SMO2Z4PnPTjfZwXGe1QZK77LrJzL45yS449l8koRBkoO
+ZsKAFa2I3P93UlXHb9e/287WFJodtMCBcRsYtu+Nr6tuesmCTnZoKI1x4Rl1MZOF
+nwSQZosOZIHbAGIvfz3NUGTp8YDb6/Tqp/XUhNNxiSZgsXIA6Ff8CujVbycesppu
+yyg3Ayoqpko=
 -----END ENCRYPTED PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.dated.resp b/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.dated.resp
index 7a098d604..96436ec30 100644
--- a/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.dated.resp
+++ b/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.dated.resp
diff --git a/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.good.resp b/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.good.resp
index 2e7255f88..12cde5746 100644
--- a/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.good.resp
+++ b/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.good.resp
diff --git a/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.req b/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.req
index 018d3b2e4..23c7dde58 100644
--- a/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.req
+++ b/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.req
diff --git a/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.revoked.resp b/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.revoked.resp
index 2e7255f88..12cde5746 100644
--- a/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.revoked.resp
+++ b/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.revoked.resp
diff --git a/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.signer.dated.resp b/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.signer.dated.resp
index 6d4f33027..1710c9bb8 100644
--- a/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.signer.dated.resp
+++ b/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.signer.dated.resp
diff --git a/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.signer.good.resp b/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.signer.good.resp
index 758da1405..925cc25da 100644
--- a/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.signer.good.resp
+++ b/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.signer.good.resp
diff --git a/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.signer.revoked.resp b/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.signer.revoked.resp
index 758da1405..925cc25da 100644
--- a/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.signer.revoked.resp
+++ b/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.signer.revoked.resp
diff --git a/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.signernocert.dated.resp b/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.signernocert.dated.resp
index f41b3d2a5..92114ae78 100644
--- a/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.signernocert.dated.resp
+++ b/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.signernocert.dated.resp
diff --git a/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.signernocert.good.resp b/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.signernocert.good.resp
index 9705c9547..a93d470b9 100644
--- a/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.signernocert.good.resp
+++ b/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.signernocert.good.resp
diff --git a/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.signernocert.revoked.resp b/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.signernocert.revoked.resp
index 9705c9547..a93d470b9 100644
--- a/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.signernocert.revoked.resp
+++ b/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.signernocert.revoked.resp
diff --git a/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.p12 b/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.p12
index 2b6f862d1..cc133b88c 100644
--- a/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.p12
+++ b/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.p12
diff --git a/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.pem b/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.pem
index 15393cf86..ebf8460cf 100644
--- a/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.pem
+++ b/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.pem
@@ -1,21 +1,21 @@
 Bag Attributes
     friendlyName: revoked2.example.net
-    localKeyID: 9D 94 B3 78 78 92 F0 B8 83 21 D7 C0 CB 0E 1B 33 EF 39 B6 17 
+    localKeyID: 83 13 41 37 13 F9 8B 48 BF 7A 19 2E AF 2C C3 CE 41 AE BF 29 
 subject=/CN=revoked2.example.net
 issuer=/O=example.net/CN=clica Signing Cert rsa
 -----BEGIN CERTIFICATE-----
 MIICjjCCAfegAwIBAgICAMowDQYJKoZIhvcNAQELBQAwNzEUMBIGA1UEChMLZXhh
 bXBsZS5uZXQxHzAdBgNVBAMTFmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwHhcNMTIx
-MTAxMTIzNDA0WhcNMzcxMjAxMTIzNDA0WjAfMR0wGwYDVQQDExRyZXZva2VkMi5l
-eGFtcGxlLm5ldDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA3Se+qbZkX/Fl
-i5PBS0yDe8c7so0Ze+yVeuM0NBZY0h0K6ahKb8NuFQ7jpL7BtQRlFGoU2foVLdLd
-/zSg5802qaTsuDISGnLxX0Fpr1gm+OvQkGdJt8eeVZEpNLph8zvp3eFtG8HE9l6R
-QbsEDTnJGHYlHNscnW1CMB3p6NyzMXkCAwEAAaOBwDCBvTAOBgNVHQ8BAf8EBAMC
+MTAxMTIzNDE3WhcNMzcxMjAxMTIzNDE3WjAfMR0wGwYDVQQDExRyZXZva2VkMi5l
+eGFtcGxlLm5ldDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAv+zvAcvxTw7G
+L/0U4pF2Q9ozF+fT4icIhPfn4nJ26TpNNEPzGaZcBHE1uoYF26eRBKkPuI9jZLKK
+aI4r/stZJHLdPRcar6jo9UOWfkh8cFkL+sZIoDu9B70arwjbYFQ+SpL/MDXGCP7/
+QMU+UM07wiNhYwpI5wk7FGxSWBIiACUCAwEAAaOBwDCBvTAOBgNVHQ8BAf8EBAMC
 BPAwIAYDVR0lAQH/BBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMDIGA1UdHwQrMCkw
 J6AloCOGIWh0dHA6Ly9jcmwuZXhhbXBsZS5uZXQvbGF0ZXN0LmNybDA0BggrBgEF
 BQcBAQQoMCYwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vc2NwLmV4YW1wbGUubmV0LzAf
 BgNVHREEGDAWghRyZXZva2VkMi5leGFtcGxlLm5ldDANBgkqhkiG9w0BAQsFAAOB
-gQBomN+m0L4SwIi+CoZOyIQTjKiKZU2XuripqrazQflD4hJoWqFxod6gGrrLBhSS
-481+/zt26E0+49e9f6rU4FLnkjt6rr2hoJk8Sw9/MRUQ54HroEq3Gk6fPJjIlZd6
-DXp1rbYTRkJKLZcdDtDjUqENU750mQfLIl7zQ9CGweKZpA==
+gQCA1RX+/cyPFYaT5X8jBtWpkdUMpJUiZFVWr7RW5iAJm6F6SwHPIA9vkVtaOZfA
+TM89+p8SiAR7cKAdC6NGd6yer5HT/15r4YZY8t9cEB1JmXvmOtof+qjBGTmm9pJJ
+eT1LNAS1PPiBYPh5U+JEC1rgB2TR8GkZ064pnWAtyKCJWw==
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.unlocked.key b/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.unlocked.key
index adec37e32..4dfba30d9 100644
--- a/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.unlocked.key
+++ b/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.unlocked.key
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXAIBAAKBgQDdJ76ptmRf8WWLk8FLTIN7xzuyjRl77JV64zQ0FljSHQrpqEpv
-w24VDuOkvsG1BGUUahTZ+hUt0t3/NKDnzTappOy4MhIacvFfQWmvWCb469CQZ0m3
-x55VkSk0umHzO+nd4W0bwcT2XpFBuwQNOckYdiUc2xydbUIwHeno3LMxeQIDAQAB
-AoGAG5Ysm2DsDme/QfTxZKIruJH2qWQebK3rS4Px7BlphPQoe1MJzf0zyx6rWM6O
-vTTKIwzEgxhF8gxessnu1Ftt2OoPPBkSjEW96fK6U0zdyBQbCjLmHA2gGOeo7wLL
-mp1pVMAXZofrn2aJYC4rXrJ7EYrge3GoqoympofijIpOobECQQD6v4IEQgA8lytu
-Kv17vrRcgkSkEkofePe2+J/8L5QJPry/TPWeLG9KasZ1SppUZkM66CffAGAQEHvi
-C21RUXWdAkEA4cmP+w/5Ypg3P+4+5cyaTcKHEzd2Drqo7ANXV78Go3+AqX7beVzc
-0GxKn4S/94ZX6RkfYYE5WIWfXH8tgxPyjQJAO5kzNQHe/ofLydasAzKTuf04hWrX
-dV2SO0oi9JT2cbAYurt3Ec5r8Vspqo0921unFSRC/c0gCBFy8IpYxGBBPQJAMrr8
-C7fyG5IBz+5y2WUYQmJzwQCUGQkdjTHO/Rshnbi3Kt4i5+jSgE3kkmTcUPwxYmFP
-qLPFM7uKK9kzW6EuvQJBAIYFifaV0eG2nrhOoWW5Kgelqw3aXn3qvhnIRwXU/4xB
-gihTV/prnLLPWx/+AqlXFEeHGC/lOQmZSkClu56JIW0=
+MIICXAIBAAKBgQC/7O8By/FPDsYv/RTikXZD2jMX59PiJwiE9+ficnbpOk00Q/MZ
+plwEcTW6hgXbp5EEqQ+4j2Nksopojiv+y1kkct09FxqvqOj1Q5Z+SHxwWQv6xkig
+O70HvRqvCNtgVD5Kkv8wNcYI/v9AxT5QzTvCI2FjCkjnCTsUbFJYEiIAJQIDAQAB
+AoGABVQTKKYcW3kKCJAKseWe9nBK5dmCWO+DfYmSbweFhKEhPpe6WpZzTI5GExkg
+dYI39PyqmpGkjUmlrRRxZUAJB/0faDuKML4AfgKw/qF17Tgjs0UXMmP+xWhH5owD
+OQfR3WQZbiKvPJzv+jw0KeCI/xInGf9utXx+vCWLFxdK8wECQQD62MPqpagGmsT5
+HVI/FRR1radVglC16CZxcqo5hpsWzv6wa5/XYDbbcVDiZ96smg8Mk+yMRNykGb9u
+co3gL0elAkEAw95LUEaPT2a9GpCfjlrzwyjxnU9saMEyMIdUqxA+lgTUJ/c3Jmr8
+HNvKA0hmWenc2vtPKZFiF28MNjC+HI5ugQJBAOWqPz3/66YYX82BVgMhprjThEha
+5tCVu1TVWhsPLcGlRTR7ZT5I/hDOX/LajNpUtwCaEtKeXbD1TfqucU1XnG0CQBNq
+FUz/sXTNWjEn5KjXmxHdHRXaqYQ4oiDtSRcrpQh5sg3EE1Nbh2HU51Er+/ktlRaf
+klksb+yitTMp4a4y8AECQBuU3uviAEyPZ3/H2g3sk3z7OAfxrJ+yDBa7bxVCNqKD
+Iji6lm8nd5T3TqYx0Sb8NDKFr/7xkmyT4l+M/ooymrE=
 -----END RSA PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.net/server1.example.net/ca_chain.pem b/test/aux-fixed/exim-ca/example.net/server1.example.net/ca_chain.pem
index fef1020ef..3beef64e5 100644
--- a/test/aux-fixed/exim-ca/example.net/server1.example.net/ca_chain.pem
+++ b/test/aux-fixed/exim-ca/example.net/server1.example.net/ca_chain.pem
@@ -3,33 +3,33 @@ Bag Attributes
 subject=/O=example.net/CN=clica Signing Cert rsa
 issuer=/O=example.net/CN=clica CA rsa
 -----BEGIN CERTIFICATE-----
-MIICNDCCAZ2gAwIBAgIBAjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
-cGxlLm5ldDEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwM1oX
-DTM4MDEwMTEyMzQwM1owNzEUMBIGA1UEChMLZXhhbXBsZS5uZXQxHzAdBgNVBAMT
+MIICGDCCAYGgAwIBAgIBQjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+cGxlLm5ldDEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQxNFoX
+DTM4MDEwMTEyMzQxNFowNzEUMBIGA1UEChMLZXhhbXBsZS5uZXQxHzAdBgNVBAMT
 FmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
-AoGBALMuDick/uNCkK8zWtdko5eynjJq0y8NVNlhSFkbwfjbxOQycuyMhMlYNnvs
-ESWZTV5ckpsvoDrFQLFk6ZB7RVYHUoOHNfANm8JWC9GR5zqbquibA/MMQ4h2Xlkz
-zQz12AzPpouZUyYs1+SjwlgfBRVhtxApDR2bPEDzI6s9VUdXAgMBAAGjWjBYMA4G
-A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMDIGA1UdHwQrMCkwJ6Al
-oCOGIWh0dHA6Ly9jcmwuZXhhbXBsZS5uZXQvbGF0ZXN0LmNybDANBgkqhkiG9w0B
-AQsFAAOBgQDCXkPeCURjOJwCBgbLERuNghPiWLqHPopm1idM2A032jDgbRXD9/DP
-1xOPgSLEW59EiJac0RNae0D2KyhnG90NZLccXK0a9Uu1iaAmdcJ7s4a0x0ZH9Kza
-hqz0cr4oStUOHxG/AtPKuhZ9PkZ7GDSPDW0k/z64WYCm1fqSWkbVig==
+AoGBAKFOi+80c9pb3UidQJd+TQ9j9lmOlw3HlhRxYNadHL2jZ98OHrwlDB1JgToy
+PruZ9yLq26a7c6sLYqEvpHulS6ACUqYaqu9kKb8m4l7xlheoyLT/jkZjq4Z0owp8
+PhzYl4p3M23rQzNSXcHCxcwu+6KPJ8FgrdNuB2RmHU2M27wRAgMBAAGjPjA8MA4G
+A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMBYGA1UdDgQPBA1BQWJ0
+d0N4Y1hnYjBRMA0GCSqGSIb3DQEBCwUAA4GBAAUlBd0/XrkhQ6Gm8s44uOU/gSAe
+Ap8baRLuhTrrvzd+nPDBN0YbwVUMwd9TbY4MsmDy+GhE9/V8i8OydEshl2iE15+E
+JX2DJEmNd7RMfWb6EIZVuzFFDWRszxA14YdNvDXjwS6BYmsSWJsNH4P/eTRrTCJi
+C53ODVdhE6yCQs1m
 -----END CERTIFICATE-----
 Bag Attributes
     friendlyName: Certificate Authority rsa
 subject=/O=example.net/CN=clica CA rsa
 issuer=/O=example.net/CN=clica CA rsa
 -----BEGIN CERTIFICATE-----
-MIIB9jCCAV+gAwIBAgIBATANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
-cGxlLm5ldDEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwM1oX
-DTM4MDEwMTEyMzQwM1owLTEUMBIGA1UEChMLZXhhbXBsZS5uZXQxFTATBgNVBAMT
-DGNsaWNhIENBIHJzYTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA3kwC9CHz
-JH7sEDkHMdZRq8+XpV7l/hEqfv2gPvT3mak46dWrI/T3pJOqyNvUZV/LJ/gx/0uw
-9pmCg6Y5zNCN0qAGY4rSS/sbEOLYIw5wJbFnYfHtTwe3ZAdG+5WqKMBF2lHNBM3b
-PUB/kweoLhNLwserKHwMDC3sksfrwH29rpMCAwEAAaMmMCQwEgYDVR0TAQH/BAgw
-BgEB/wIBATAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADgYEAzXt6KHIB
-qOJfZECgwhAWipxVR0BXek0hAfyTWl7q18+mWKYydQW0Z2VMN4Bq/ZUlOg+EM8NU
-1n9PJ4+I2QgAwVVXN4+cz7zgZ6XRZc1OkE98NyK504bVpJpan1gsx3I5GLJUgP2t
-B/WwqoFO+ANhT2margZSM6avJfaIh8gEass=
+MIIB9jCCAV+gAwIBAgIBQTANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+cGxlLm5ldDEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQxNFoX
+DTM4MDEwMTEyMzQxNFowLTEUMBIGA1UEChMLZXhhbXBsZS5uZXQxFTATBgNVBAMT
+DGNsaWNhIENBIHJzYTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAs89Jw+yK
+ohiMwcSLAciqgj5CtxYRsoW1AmQrhD3QwE6es0RBjTGp5SNjjPlRxCZ5T+dQQXR1
+RirvSKH+isbd1ENIbS9dPgaR2mFUYwcSxUIRrXn4mkxZ/QtpTVOoY184lFAPhTrW
+et4o+wE9OI2e75RD5GdAyB/52paGplt+K38CAwEAAaMmMCQwEgYDVR0TAQH/BAgw
+BgEB/wIBATAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADgYEAOcXFUXls
+ChTDzMe2y+qv1YlOZbkf43S9je72ATYXzS7/eT8I4sAq/CFdgmn+lw5kHJlgxCag
+BPwuLYHW55r69WI1IwQHrJXaavyPSkonVgK+ZssEcQmqbgNj8oV5ZnyzYnNZv0VU
+nMl1n6nCl1xdUwPwhhdssGXEoX8OF5iMw4U=
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.net/server1.example.net/cert8.db b/test/aux-fixed/exim-ca/example.net/server1.example.net/cert8.db
index 4743f74b1..7c9062aa3 100644
--- a/test/aux-fixed/exim-ca/example.net/server1.example.net/cert8.db
+++ b/test/aux-fixed/exim-ca/example.net/server1.example.net/cert8.db
diff --git a/test/aux-fixed/exim-ca/example.net/server1.example.net/fullchain.pem b/test/aux-fixed/exim-ca/example.net/server1.example.net/fullchain.pem
index adefd178a..c041cb9a7 100644
--- a/test/aux-fixed/exim-ca/example.net/server1.example.net/fullchain.pem
+++ b/test/aux-fixed/exim-ca/example.net/server1.example.net/fullchain.pem
@@ -1,58 +1,58 @@
 Bag Attributes
     friendlyName: server1.example.net
-    localKeyID: 50 2F A4 71 29 E1 8A B0 EC 68 30 74 B4 8C 03 81 45 2F F7 17 
+    localKeyID: 69 72 E2 63 A7 B5 AC 27 40 75 52 26 F2 25 F0 8C F1 5C 91 38 
 subject=/CN=server1.example.net
 issuer=/O=example.net/CN=clica Signing Cert rsa
 -----BEGIN CERTIFICATE-----
 MIIC3zCCAkigAwIBAgIBZTANBgkqhkiG9w0BAQsFADA3MRQwEgYDVQQKEwtleGFt
 cGxlLm5ldDEfMB0GA1UEAxMWY2xpY2EgU2lnbmluZyBDZXJ0IHJzYTAeFw0xMjEx
-MDExMjM0MDNaFw0zNzEyMDExMjM0MDNaMB4xHDAaBgNVBAMTE3NlcnZlcjEuZXhh
-bXBsZS5uZXQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBANp87d14zXozAbdw
-wD0AfnhqecV/D5GidUy4QnTVfSBMWjDkcjd7rajPnRHiM+NQFLkY5DKXuqpqZ0+W
-kH5dJrs2ZE5abmyfOzHUwai5IGVUIvOnBH4pXPLBcDQ6IAOEhpsaQaauHn/NpP7r
-X8n8WB/S3zmRk5Q92K/maQ8cgRt9AgMBAAGjggESMIIBDjAOBgNVHQ8BAf8EBAMC
+MDExMjM0MTRaFw0zNzEyMDExMjM0MTRaMB4xHDAaBgNVBAMTE3NlcnZlcjEuZXhh
+bXBsZS5uZXQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBANVH7zIGC44d585t
+XcyXnYDjwyhLki3hraCHa6IFcyuuysiUrGISJGwl0/49+msC/9KIvCWg8kjE/oWz
+C/ex/aCAi2YwLZGuT4xszWhTIz5weYmi5oVloyITl9GeNPXoylLPmnhHW7JfmbH6
+OvNcL+y211KO1yCVKxwe3vUzahfbAgMBAAGjggESMIIBDjAOBgNVHQ8BAf8EBAMC
 BPAwIAYDVR0lAQH/BBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMDIGA1UdHwQrMCkw
 J6AloCOGIWh0dHA6Ly9jcmwuZXhhbXBsZS5uZXQvbGF0ZXN0LmNybDA0BggrBgEF
 BQcBAQQoMCYwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vc2NwLmV4YW1wbGUubmV0LzBw
-BgNVHREEaTBngiFhbHRlcm5hdGVuYW1lLnNlcnZlcjEuZXhhbXBsZS5uZXSCImFs
-dGVybmF0ZW5hbWUyLnNlcnZlcjEuZXhhbXBsZS5uZXSCE3NlcnZlcjEuZXhhbXBs
-ZS5uZXSCCSoudGVzdC5leDANBgkqhkiG9w0BAQsFAAOBgQCv5vsWzpkMj5OL+V3g
-bgXzhu0K05aOK5pv85sT4UGZpqrhLSTDjGvd5kFXLQwUH36CAzrqJOOV3vrWugrR
-/iR6VRcwqjq9Z2jT+XeSF6Immo5rnKjOl9Mor5mBwAHVW8Ojk2Ce3ww06AodpqaD
-yNB7Kmo3G2o63vGcVUg9gB+ohg==
+BgNVHREEaTBnggkqLnRlc3QuZXiCImFsdGVybmF0ZW5hbWUyLnNlcnZlcjEuZXhh
+bXBsZS5uZXSCE3NlcnZlcjEuZXhhbXBsZS5uZXSCIWFsdGVybmF0ZW5hbWUuc2Vy
+dmVyMS5leGFtcGxlLm5ldDANBgkqhkiG9w0BAQsFAAOBgQA1xBe2Q+dkcSIc36qk
+lx23XeGIpH+9XfwuRcwyHniQJwl0JBLGwRjPUgk9n5I7xleNjGEujxVNMKDJtZ9F
+4sQ+CebdmzAxKKHU3vW+x9cIPctk64fqoMt5t0SD0+d1Zw8NmdEyneHTAcvSysXn
+SHwjpa/Qpi2r3xxNrtu+9BN6UQ==
 -----END CERTIFICATE-----
 Bag Attributes
     friendlyName: Signing Cert rsa
 subject=/O=example.net/CN=clica Signing Cert rsa
 issuer=/O=example.net/CN=clica CA rsa
 -----BEGIN CERTIFICATE-----
-MIICNDCCAZ2gAwIBAgIBAjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
-cGxlLm5ldDEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwM1oX
-DTM4MDEwMTEyMzQwM1owNzEUMBIGA1UEChMLZXhhbXBsZS5uZXQxHzAdBgNVBAMT
+MIICGDCCAYGgAwIBAgIBQjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+cGxlLm5ldDEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQxNFoX
+DTM4MDEwMTEyMzQxNFowNzEUMBIGA1UEChMLZXhhbXBsZS5uZXQxHzAdBgNVBAMT
 FmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
-AoGBALMuDick/uNCkK8zWtdko5eynjJq0y8NVNlhSFkbwfjbxOQycuyMhMlYNnvs
-ESWZTV5ckpsvoDrFQLFk6ZB7RVYHUoOHNfANm8JWC9GR5zqbquibA/MMQ4h2Xlkz
-zQz12AzPpouZUyYs1+SjwlgfBRVhtxApDR2bPEDzI6s9VUdXAgMBAAGjWjBYMA4G
-A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMDIGA1UdHwQrMCkwJ6Al
-oCOGIWh0dHA6Ly9jcmwuZXhhbXBsZS5uZXQvbGF0ZXN0LmNybDANBgkqhkiG9w0B
-AQsFAAOBgQDCXkPeCURjOJwCBgbLERuNghPiWLqHPopm1idM2A032jDgbRXD9/DP
-1xOPgSLEW59EiJac0RNae0D2KyhnG90NZLccXK0a9Uu1iaAmdcJ7s4a0x0ZH9Kza
-hqz0cr4oStUOHxG/AtPKuhZ9PkZ7GDSPDW0k/z64WYCm1fqSWkbVig==
+AoGBAKFOi+80c9pb3UidQJd+TQ9j9lmOlw3HlhRxYNadHL2jZ98OHrwlDB1JgToy
+PruZ9yLq26a7c6sLYqEvpHulS6ACUqYaqu9kKb8m4l7xlheoyLT/jkZjq4Z0owp8
+PhzYl4p3M23rQzNSXcHCxcwu+6KPJ8FgrdNuB2RmHU2M27wRAgMBAAGjPjA8MA4G
+A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMBYGA1UdDgQPBA1BQWJ0
+d0N4Y1hnYjBRMA0GCSqGSIb3DQEBCwUAA4GBAAUlBd0/XrkhQ6Gm8s44uOU/gSAe
+Ap8baRLuhTrrvzd+nPDBN0YbwVUMwd9TbY4MsmDy+GhE9/V8i8OydEshl2iE15+E
+JX2DJEmNd7RMfWb6EIZVuzFFDWRszxA14YdNvDXjwS6BYmsSWJsNH4P/eTRrTCJi
+C53ODVdhE6yCQs1m
 -----END CERTIFICATE-----
 Bag Attributes
     friendlyName: Certificate Authority rsa
 subject=/O=example.net/CN=clica CA rsa
 issuer=/O=example.net/CN=clica CA rsa
 -----BEGIN CERTIFICATE-----
-MIIB9jCCAV+gAwIBAgIBATANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
-cGxlLm5ldDEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwM1oX
-DTM4MDEwMTEyMzQwM1owLTEUMBIGA1UEChMLZXhhbXBsZS5uZXQxFTATBgNVBAMT
-DGNsaWNhIENBIHJzYTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA3kwC9CHz
-JH7sEDkHMdZRq8+XpV7l/hEqfv2gPvT3mak46dWrI/T3pJOqyNvUZV/LJ/gx/0uw
-9pmCg6Y5zNCN0qAGY4rSS/sbEOLYIw5wJbFnYfHtTwe3ZAdG+5WqKMBF2lHNBM3b
-PUB/kweoLhNLwserKHwMDC3sksfrwH29rpMCAwEAAaMmMCQwEgYDVR0TAQH/BAgw
-BgEB/wIBATAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADgYEAzXt6KHIB
-qOJfZECgwhAWipxVR0BXek0hAfyTWl7q18+mWKYydQW0Z2VMN4Bq/ZUlOg+EM8NU
-1n9PJ4+I2QgAwVVXN4+cz7zgZ6XRZc1OkE98NyK504bVpJpan1gsx3I5GLJUgP2t
-B/WwqoFO+ANhT2margZSM6avJfaIh8gEass=
+MIIB9jCCAV+gAwIBAgIBQTANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+cGxlLm5ldDEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQxNFoX
+DTM4MDEwMTEyMzQxNFowLTEUMBIGA1UEChMLZXhhbXBsZS5uZXQxFTATBgNVBAMT
+DGNsaWNhIENBIHJzYTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAs89Jw+yK
+ohiMwcSLAciqgj5CtxYRsoW1AmQrhD3QwE6es0RBjTGp5SNjjPlRxCZ5T+dQQXR1
+RirvSKH+isbd1ENIbS9dPgaR2mFUYwcSxUIRrXn4mkxZ/QtpTVOoY184lFAPhTrW
+et4o+wE9OI2e75RD5GdAyB/52paGplt+K38CAwEAAaMmMCQwEgYDVR0TAQH/BAgw
+BgEB/wIBATAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADgYEAOcXFUXls
+ChTDzMe2y+qv1YlOZbkf43S9je72ATYXzS7/eT8I4sAq/CFdgmn+lw5kHJlgxCag
+BPwuLYHW55r69WI1IwQHrJXaavyPSkonVgK+ZssEcQmqbgNj8oV5ZnyzYnNZv0VU
+nMl1n6nCl1xdUwPwhhdssGXEoX8OF5iMw4U=
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.net/server1.example.net/key3.db b/test/aux-fixed/exim-ca/example.net/server1.example.net/key3.db
index 2dcef1d2a..7386326f8 100644
--- a/test/aux-fixed/exim-ca/example.net/server1.example.net/key3.db
+++ b/test/aux-fixed/exim-ca/example.net/server1.example.net/key3.db
diff --git a/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.chain.pem b/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.chain.pem
index 2321af905..153ae400d 100644
--- a/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.chain.pem
+++ b/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.chain.pem
@@ -1,37 +1,37 @@
 Bag Attributes
     friendlyName: server1.example.net
-    localKeyID: 50 2F A4 71 29 E1 8A B0 EC 68 30 74 B4 8C 03 81 45 2F F7 17 
+    localKeyID: 69 72 E2 63 A7 B5 AC 27 40 75 52 26 F2 25 F0 8C F1 5C 91 38 
 subject=/CN=server1.example.net
 issuer=/O=example.net/CN=clica Signing Cert rsa
 -----BEGIN CERTIFICATE-----
 MIIC3zCCAkigAwIBAgIBZTANBgkqhkiG9w0BAQsFADA3MRQwEgYDVQQKEwtleGFt
 cGxlLm5ldDEfMB0GA1UEAxMWY2xpY2EgU2lnbmluZyBDZXJ0IHJzYTAeFw0xMjEx
-MDExMjM0MDNaFw0zNzEyMDExMjM0MDNaMB4xHDAaBgNVBAMTE3NlcnZlcjEuZXhh
-bXBsZS5uZXQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBANp87d14zXozAbdw
-wD0AfnhqecV/D5GidUy4QnTVfSBMWjDkcjd7rajPnRHiM+NQFLkY5DKXuqpqZ0+W
-kH5dJrs2ZE5abmyfOzHUwai5IGVUIvOnBH4pXPLBcDQ6IAOEhpsaQaauHn/NpP7r
-X8n8WB/S3zmRk5Q92K/maQ8cgRt9AgMBAAGjggESMIIBDjAOBgNVHQ8BAf8EBAMC
+MDExMjM0MTRaFw0zNzEyMDExMjM0MTRaMB4xHDAaBgNVBAMTE3NlcnZlcjEuZXhh
+bXBsZS5uZXQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBANVH7zIGC44d585t
+XcyXnYDjwyhLki3hraCHa6IFcyuuysiUrGISJGwl0/49+msC/9KIvCWg8kjE/oWz
+C/ex/aCAi2YwLZGuT4xszWhTIz5weYmi5oVloyITl9GeNPXoylLPmnhHW7JfmbH6
+OvNcL+y211KO1yCVKxwe3vUzahfbAgMBAAGjggESMIIBDjAOBgNVHQ8BAf8EBAMC
 BPAwIAYDVR0lAQH/BBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMDIGA1UdHwQrMCkw
 J6AloCOGIWh0dHA6Ly9jcmwuZXhhbXBsZS5uZXQvbGF0ZXN0LmNybDA0BggrBgEF
 BQcBAQQoMCYwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vc2NwLmV4YW1wbGUubmV0LzBw
-BgNVHREEaTBngiFhbHRlcm5hdGVuYW1lLnNlcnZlcjEuZXhhbXBsZS5uZXSCImFs
-dGVybmF0ZW5hbWUyLnNlcnZlcjEuZXhhbXBsZS5uZXSCE3NlcnZlcjEuZXhhbXBs
-ZS5uZXSCCSoudGVzdC5leDANBgkqhkiG9w0BAQsFAAOBgQCv5vsWzpkMj5OL+V3g
-bgXzhu0K05aOK5pv85sT4UGZpqrhLSTDjGvd5kFXLQwUH36CAzrqJOOV3vrWugrR
-/iR6VRcwqjq9Z2jT+XeSF6Immo5rnKjOl9Mor5mBwAHVW8Ojk2Ce3ww06AodpqaD
-yNB7Kmo3G2o63vGcVUg9gB+ohg==
+BgNVHREEaTBnggkqLnRlc3QuZXiCImFsdGVybmF0ZW5hbWUyLnNlcnZlcjEuZXhh
+bXBsZS5uZXSCE3NlcnZlcjEuZXhhbXBsZS5uZXSCIWFsdGVybmF0ZW5hbWUuc2Vy
+dmVyMS5leGFtcGxlLm5ldDANBgkqhkiG9w0BAQsFAAOBgQA1xBe2Q+dkcSIc36qk
+lx23XeGIpH+9XfwuRcwyHniQJwl0JBLGwRjPUgk9n5I7xleNjGEujxVNMKDJtZ9F
+4sQ+CebdmzAxKKHU3vW+x9cIPctk64fqoMt5t0SD0+d1Zw8NmdEyneHTAcvSysXn
+SHwjpa/Qpi2r3xxNrtu+9BN6UQ==
 -----END CERTIFICATE-----
 -----BEGIN CERTIFICATE-----
-MIICNDCCAZ2gAwIBAgIBAjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
-cGxlLm5ldDEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwM1oX
-DTM4MDEwMTEyMzQwM1owNzEUMBIGA1UEChMLZXhhbXBsZS5uZXQxHzAdBgNVBAMT
+MIICGDCCAYGgAwIBAgIBQjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+cGxlLm5ldDEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQxNFoX
+DTM4MDEwMTEyMzQxNFowNzEUMBIGA1UEChMLZXhhbXBsZS5uZXQxHzAdBgNVBAMT
 FmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
-AoGBALMuDick/uNCkK8zWtdko5eynjJq0y8NVNlhSFkbwfjbxOQycuyMhMlYNnvs
-ESWZTV5ckpsvoDrFQLFk6ZB7RVYHUoOHNfANm8JWC9GR5zqbquibA/MMQ4h2Xlkz
-zQz12AzPpouZUyYs1+SjwlgfBRVhtxApDR2bPEDzI6s9VUdXAgMBAAGjWjBYMA4G
-A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMDIGA1UdHwQrMCkwJ6Al
-oCOGIWh0dHA6Ly9jcmwuZXhhbXBsZS5uZXQvbGF0ZXN0LmNybDANBgkqhkiG9w0B
-AQsFAAOBgQDCXkPeCURjOJwCBgbLERuNghPiWLqHPopm1idM2A032jDgbRXD9/DP
-1xOPgSLEW59EiJac0RNae0D2KyhnG90NZLccXK0a9Uu1iaAmdcJ7s4a0x0ZH9Kza
-hqz0cr4oStUOHxG/AtPKuhZ9PkZ7GDSPDW0k/z64WYCm1fqSWkbVig==
+AoGBAKFOi+80c9pb3UidQJd+TQ9j9lmOlw3HlhRxYNadHL2jZ98OHrwlDB1JgToy
+PruZ9yLq26a7c6sLYqEvpHulS6ACUqYaqu9kKb8m4l7xlheoyLT/jkZjq4Z0owp8
+PhzYl4p3M23rQzNSXcHCxcwu+6KPJ8FgrdNuB2RmHU2M27wRAgMBAAGjPjA8MA4G
+A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMBYGA1UdDgQPBA1BQWJ0
+d0N4Y1hnYjBRMA0GCSqGSIb3DQEBCwUAA4GBAAUlBd0/XrkhQ6Gm8s44uOU/gSAe
+Ap8baRLuhTrrvzd+nPDBN0YbwVUMwd9TbY4MsmDy+GhE9/V8i8OydEshl2iE15+E
+JX2DJEmNd7RMfWb6EIZVuzFFDWRszxA14YdNvDXjwS6BYmsSWJsNH4P/eTRrTCJi
+C53ODVdhE6yCQs1m
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.key b/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.key
index 0e5f497dd..b61bd5f75 100644
--- a/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.key
+++ b/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.key
@@ -1,21 +1,22 @@
 Bag Attributes
     friendlyName: server1.example.net
-    localKeyID: 50 2F A4 71 29 E1 8A B0 EC 68 30 74 B4 8C 03 81 45 2F F7 17 
+    localKeyID: 69 72 E2 63 A7 B5 AC 27 40 75 52 26 F2 25 F0 8C F1 5C 91 38 
 Key Attributes: <No Attributes>
 -----BEGIN ENCRYPTED PRIVATE KEY-----
-MIICxjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQIF5UpLi3LhbgCAggA
-MBQGCCqGSIb3DQMHBAia5QVJXajfbgSCAoAgeXf3jyr8o71Ul/fOMeq2Ye2cUkx6
-4ymZg/Pnjj/vkOPCMsByOADVDGf2NVza8pUqU2FFiGxetfMSM/VzimsANaLr5pdP
-eM4bitqaLCJEP7cJq+Zs+0cvkpPf4Mv9RpZKso7B/ChEhEdvU5YevfY2FVt7ZQIk
-Jna2XnNSI9uuAxQrC11rkbbaq3/5grv0bIB/5K8Ut4ViVNI7hPlK2nTPizyIhOkk
-vGdphf1Z3uvoW7uYuud5r6NJf0Cf2n41CTKQ6zNZ/HH8igysPrej/GGIO5a8FmSt
-cHraE6tSw5MbCNtcyGq43pWVvBDeHp4uCcghPpXAnfkR/svrgnxDrDVniZ6VMA78
-7QL8o6VnsuUJONjWh9GeVusM+qZH6/9s5rg7l6gNlPlMpIqZqiDOx6pDXhoOddHW
-yEiHysguCHZa04O8zqYkhx7cPE2VNgJm6sYC0CwyJFC0KgrxMGgjPGY+MEqMWX8v
-qrqPOrPURFlHmFEndFdInK9sA1LW1rDw1M1t4IdNliC90EPwauXSpWzzkNo3Ygt+
-3iTAPScE67z19DY4pbrRLs6uF7emI9pi84lCTDVbby2ZkB18e5vn6kHE8M5dfkdd
-8qcsFU9bBuI4wu1S9CJxXeT30JjFOu6Y2Jb2erimIQe+JS/D+CkNuYx9gGuCEedn
-Yn6CM+CxjuxxMQX1nu+Cap1vAbFYfETZcdxtbIwpqPVLHXi0/F5CJMj/XNwQ1rUD
-x8L76n7kaYMOiNfmgKwXWEOJ4Bx2bteRK0OdnsrhABmjc0ENmX4y/WNF4YVg2Yml
-wHn3xhuoJkNoMjCNWOFB8GYELc09aLzRnOXQChRqAmEZY9JBUAFE6xvi
+MIIC1DBOBgkqhkiG9w0BBQ0wQTApBgkqhkiG9w0BBQwwHAQIAbzDXwulWlMCAggA
+MAwGCCqGSIb3DQIJBQAwFAYIKoZIhvcNAwcECN2IMycEH5NFBIICgEUhEFp2nkX8
+1GbVBN3BR1N0DVolwJ7Ae8bjDAHiTfhd33DEwBELm16Hg2fNWkx6aJBREs9mY6qP
+xWoscuDGyBDV9G/yfN8Ekv/JgIyUSmlaE8MOFJmYSJOtcb1gRZkFvj2R8JGqY3EB
+9LOp54k7jtt6gpE92sfUp2iGLTHL4gD+Zmrj0mMZJDKThmrABMj+VDl/0P6rW/mE
+KIZdPP6awKLrR+Rv2mOqcArqbgOj4SInPy6oW5eFMp3V25BeWulrVBZqXs9RuGwx
+1fo6qb5SC/zkjrbGQ6exRzq7JY5Cl377hC6ubtQpLqzXpNPi92HaYYhvpsEWreZP
+frviHIaK8FJ4JSsiCruBOPPWzKyzn5Z+NT3aZGjmtV6Nfey12tNqiLfdptrQm9pH
+W88sRmOxMgnaTYCOcYldM67Lkx5Jopa4poYTh5wvyWrQ4hBvQ2JdT6uwE9Uzkd+W
+0zBfxauoULiuoyQXMeHUZ75E8OG0k0rUOi/gscec7q8VavX8NwNlFVpCytskUfUM
+ajBJ7SdZ+iO040wbVWU6q+d0X0zRgoKDlNcSCPL05wsYUWXthqBl828wCM70V6II
+tF2ghNInveu6vYSuv9+LSvyo/mlACXllScGEo8LYP8fiNrCJVrZ+i3GYKSeYypDZ
+PihMmSIjBaeSKcTgrK93NneV8M1q4pDITJ/IoZz3aeYhwfR87CAfprGakb9uOzLP
+3Rl2qXIvKMG5XyQmeu2rq7EUGzTUbdAG1ABPrgGw1L7rkGWS6Db1L2pMdQrb9YlE
+I2tPgfgKl2ilAGpiWs0DddflJTXJ9tKeqoVPl6NXRt4Eau9cSowA1wR6k/5lb2Xv
+cDLQUQdx8Dk=
 -----END ENCRYPTED PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.dated.resp b/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.dated.resp
index 6704e1343..9a6190ec2 100644
--- a/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.dated.resp
+++ b/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.dated.resp
diff --git a/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.good.resp b/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.good.resp
index db2cf4eae..3631938fc 100644
--- a/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.good.resp
+++ b/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.good.resp
diff --git a/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.req b/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.req
index 6bbcfb8d4..0da0bcfa5 100644
--- a/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.req
+++ b/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.req
diff --git a/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.revoked.resp b/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.revoked.resp
index 17cd00182..6c9b48f38 100644
--- a/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.revoked.resp
+++ b/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.revoked.resp
diff --git a/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.signer.dated.resp b/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.signer.dated.resp
index abbda91f9..c7330841b 100644
--- a/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.signer.dated.resp
+++ b/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.signer.dated.resp
diff --git a/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.signer.good.resp b/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.signer.good.resp
index 0e2c4c0ea..71832d971 100644
--- a/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.signer.good.resp
+++ b/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.signer.good.resp
diff --git a/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.signer.revoked.resp b/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.signer.revoked.resp
index 48561ad02..b9dcb6ea7 100644
--- a/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.signer.revoked.resp
+++ b/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.signer.revoked.resp
diff --git a/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.signernocert.dated.resp b/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.signernocert.dated.resp
index f03b4ff2f..1c6dca31d 100644
--- a/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.signernocert.dated.resp
+++ b/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.signernocert.dated.resp
diff --git a/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.signernocert.good.resp b/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.signernocert.good.resp
index b11114ea4..878cd6770 100644
--- a/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.signernocert.good.resp
+++ b/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.signernocert.good.resp
diff --git a/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.signernocert.revoked.resp b/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.signernocert.revoked.resp
index a8cc12542..da33f385e 100644
--- a/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.signernocert.revoked.resp
+++ b/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.signernocert.revoked.resp
diff --git a/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.p12 b/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.p12
index 6b5c704a0..80b0e100e 100644
--- a/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.p12
+++ b/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.p12
diff --git a/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.pem b/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.pem
index 57c62b1a7..48d293188 100644
--- a/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.pem
+++ b/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.pem
@@ -1,23 +1,23 @@
 Bag Attributes
     friendlyName: server1.example.net
-    localKeyID: 50 2F A4 71 29 E1 8A B0 EC 68 30 74 B4 8C 03 81 45 2F F7 17 
+    localKeyID: 69 72 E2 63 A7 B5 AC 27 40 75 52 26 F2 25 F0 8C F1 5C 91 38 
 subject=/CN=server1.example.net
 issuer=/O=example.net/CN=clica Signing Cert rsa
 -----BEGIN CERTIFICATE-----
 MIIC3zCCAkigAwIBAgIBZTANBgkqhkiG9w0BAQsFADA3MRQwEgYDVQQKEwtleGFt
 cGxlLm5ldDEfMB0GA1UEAxMWY2xpY2EgU2lnbmluZyBDZXJ0IHJzYTAeFw0xMjEx
-MDExMjM0MDNaFw0zNzEyMDExMjM0MDNaMB4xHDAaBgNVBAMTE3NlcnZlcjEuZXhh
-bXBsZS5uZXQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBANp87d14zXozAbdw
-wD0AfnhqecV/D5GidUy4QnTVfSBMWjDkcjd7rajPnRHiM+NQFLkY5DKXuqpqZ0+W
-kH5dJrs2ZE5abmyfOzHUwai5IGVUIvOnBH4pXPLBcDQ6IAOEhpsaQaauHn/NpP7r
-X8n8WB/S3zmRk5Q92K/maQ8cgRt9AgMBAAGjggESMIIBDjAOBgNVHQ8BAf8EBAMC
+MDExMjM0MTRaFw0zNzEyMDExMjM0MTRaMB4xHDAaBgNVBAMTE3NlcnZlcjEuZXhh
+bXBsZS5uZXQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBANVH7zIGC44d585t
+XcyXnYDjwyhLki3hraCHa6IFcyuuysiUrGISJGwl0/49+msC/9KIvCWg8kjE/oWz
+C/ex/aCAi2YwLZGuT4xszWhTIz5weYmi5oVloyITl9GeNPXoylLPmnhHW7JfmbH6
+OvNcL+y211KO1yCVKxwe3vUzahfbAgMBAAGjggESMIIBDjAOBgNVHQ8BAf8EBAMC
 BPAwIAYDVR0lAQH/BBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMDIGA1UdHwQrMCkw
 J6AloCOGIWh0dHA6Ly9jcmwuZXhhbXBsZS5uZXQvbGF0ZXN0LmNybDA0BggrBgEF
 BQcBAQQoMCYwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vc2NwLmV4YW1wbGUubmV0LzBw
-BgNVHREEaTBngiFhbHRlcm5hdGVuYW1lLnNlcnZlcjEuZXhhbXBsZS5uZXSCImFs
-dGVybmF0ZW5hbWUyLnNlcnZlcjEuZXhhbXBsZS5uZXSCE3NlcnZlcjEuZXhhbXBs
-ZS5uZXSCCSoudGVzdC5leDANBgkqhkiG9w0BAQsFAAOBgQCv5vsWzpkMj5OL+V3g
-bgXzhu0K05aOK5pv85sT4UGZpqrhLSTDjGvd5kFXLQwUH36CAzrqJOOV3vrWugrR
-/iR6VRcwqjq9Z2jT+XeSF6Immo5rnKjOl9Mor5mBwAHVW8Ojk2Ce3ww06AodpqaD
-yNB7Kmo3G2o63vGcVUg9gB+ohg==
+BgNVHREEaTBnggkqLnRlc3QuZXiCImFsdGVybmF0ZW5hbWUyLnNlcnZlcjEuZXhh
+bXBsZS5uZXSCE3NlcnZlcjEuZXhhbXBsZS5uZXSCIWFsdGVybmF0ZW5hbWUuc2Vy
+dmVyMS5leGFtcGxlLm5ldDANBgkqhkiG9w0BAQsFAAOBgQA1xBe2Q+dkcSIc36qk
+lx23XeGIpH+9XfwuRcwyHniQJwl0JBLGwRjPUgk9n5I7xleNjGEujxVNMKDJtZ9F
+4sQ+CebdmzAxKKHU3vW+x9cIPctk64fqoMt5t0SD0+d1Zw8NmdEyneHTAcvSysXn
+SHwjpa/Qpi2r3xxNrtu+9BN6UQ==
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.unlocked.key b/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.unlocked.key
index 1795c9aa2..e6eaf2ec5 100644
--- a/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.unlocked.key
+++ b/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.unlocked.key
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXAIBAAKBgQDafO3deM16MwG3cMA9AH54annFfw+RonVMuEJ01X0gTFow5HI3
-e62oz50R4jPjUBS5GOQyl7qqamdPlpB+XSa7NmROWm5snzsx1MGouSBlVCLzpwR+
-KVzywXA0OiADhIabGkGmrh5/zaT+61/J/Fgf0t85kZOUPdiv5mkPHIEbfQIDAQAB
-AoGAWGGJ3PmFcQWaD6jp8qM1BaPYn2XvF9PWTFMK+vTzOTH5l+aJN11t2agmGvpc
-T/rwbxGdGcQby9zf7qdyytMGm5uS05HHkOtayKc8V2xSEsPpwY6xGnXklT9wHEl8
-IkCTHNtEBchIMSPvTMhY12JsHi4LXeerkwJt6VlhDwENchcCQQD/jhYZWSNChAic
-WBoEHCjeUPUae+6EI5AEzxjgHBczAaAGGxVUcBaNPVLdECPKVzkVLC8R8RL1SbVO
-3y0g18ibAkEA2t5R+TLPPwZB/AF9+b4Eig4t16jsb2wZvOkluga+0JOrRzS9ATBc
-L18TXrNieKzKsmLjJdQ9RbXpUYKbj8OxxwJAfWibvaq5m+2xUBAIDFZJU/gEoA+L
-V/sftMxwl6IRXG2CuxxVVk9/MaaTYHqIJcax84rwOmzEcezO9bqdqc1a2wJAKQmG
-VTMxqJ+Dv7yH4ku+jiQadFU3/6xFJyaP7FFXdcQ6WR+KUK7AmiE5gIgh7n53gvsH
-nBAvbOKu3JmgkVQgAQJBAN3Vx7RLrLr2BjJiCBNflSU1dUOaqa/IybkHX29or5kH
-IvATeI8ptmiphSil/uy79c6jzYuyiuRtrgnUh/WrKeM=
+MIICWwIBAAKBgQDVR+8yBguOHefObV3Ml52A48MoS5It4a2gh2uiBXMrrsrIlKxi
+EiRsJdP+PfprAv/SiLwloPJIxP6Fswv3sf2ggItmMC2Rrk+MbM1oUyM+cHmJouaF
+ZaMiE5fRnjT16MpSz5p4R1uyX5mx+jrzXC/sttdSjtcglSscHt71M2oX2wIDAQAB
+AoGAWJNW3gYPr3ZxClR2U50V3uz4ZFg6Pc7Pbm8/PpsX0Sj286V3EAWr1bRCHgD8
+aovk1blOtivo41rYv4rz6eskQs13LOCOPd203m7UeoZsrogs3he/nRWxfftAssqg
+Vm/rLxdGDxEAUPJq+u579qCsQgSl7jm7ncCk4objSJpbrt0CQQDsFYZGKQgMcTNa
+FbAIuRH2gT75gdtAibIW3I4qCm5tJOFVRClJKHhtveLMVxC9PKBA5bDx0fPT/XqJ
+24HmI8IXAkEA50X0O6YXRMrHLeHXDFvNXgH1TI6QXtEZ5i361+OU0pUGh9ZvSD9o
+QGgLkahWLGsIF2q8Wi4UlYxuBHRDOlkG3QJAQqgxKU4cf6bWoPDOqyfV8ou7hCcu
+CKLYLaxIV4Zqd1aaaMC+B3Htzs52YsuSZlvfw3MW6rAk8A35s0LPAnPGMQJAEk+6
+n8Jt0zeO/7YC9eqK3yeeiXo8OhWqTExVsSRG00mTY8v5sam7kmXqjJTchdXPpTMB
+SM6fOJwO1fFypTsJTQJAZEWb3kE/YxtbUSgI48//mTmk2esou3ZLiEB8ZZsrsZVJ
+Ej6uUH+oqUk4xO1O8pM4gkgJCH9GSVlfvNvp3VgQcQ==
 -----END RSA PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.net/server2.example.net/ca_chain.pem b/test/aux-fixed/exim-ca/example.net/server2.example.net/ca_chain.pem
index fef1020ef..3beef64e5 100644
--- a/test/aux-fixed/exim-ca/example.net/server2.example.net/ca_chain.pem
+++ b/test/aux-fixed/exim-ca/example.net/server2.example.net/ca_chain.pem
@@ -3,33 +3,33 @@ Bag Attributes
 subject=/O=example.net/CN=clica Signing Cert rsa
 issuer=/O=example.net/CN=clica CA rsa
 -----BEGIN CERTIFICATE-----
-MIICNDCCAZ2gAwIBAgIBAjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
-cGxlLm5ldDEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwM1oX
-DTM4MDEwMTEyMzQwM1owNzEUMBIGA1UEChMLZXhhbXBsZS5uZXQxHzAdBgNVBAMT
+MIICGDCCAYGgAwIBAgIBQjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+cGxlLm5ldDEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQxNFoX
+DTM4MDEwMTEyMzQxNFowNzEUMBIGA1UEChMLZXhhbXBsZS5uZXQxHzAdBgNVBAMT
 FmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
-AoGBALMuDick/uNCkK8zWtdko5eynjJq0y8NVNlhSFkbwfjbxOQycuyMhMlYNnvs
-ESWZTV5ckpsvoDrFQLFk6ZB7RVYHUoOHNfANm8JWC9GR5zqbquibA/MMQ4h2Xlkz
-zQz12AzPpouZUyYs1+SjwlgfBRVhtxApDR2bPEDzI6s9VUdXAgMBAAGjWjBYMA4G
-A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMDIGA1UdHwQrMCkwJ6Al
-oCOGIWh0dHA6Ly9jcmwuZXhhbXBsZS5uZXQvbGF0ZXN0LmNybDANBgkqhkiG9w0B
-AQsFAAOBgQDCXkPeCURjOJwCBgbLERuNghPiWLqHPopm1idM2A032jDgbRXD9/DP
-1xOPgSLEW59EiJac0RNae0D2KyhnG90NZLccXK0a9Uu1iaAmdcJ7s4a0x0ZH9Kza
-hqz0cr4oStUOHxG/AtPKuhZ9PkZ7GDSPDW0k/z64WYCm1fqSWkbVig==
+AoGBAKFOi+80c9pb3UidQJd+TQ9j9lmOlw3HlhRxYNadHL2jZ98OHrwlDB1JgToy
+PruZ9yLq26a7c6sLYqEvpHulS6ACUqYaqu9kKb8m4l7xlheoyLT/jkZjq4Z0owp8
+PhzYl4p3M23rQzNSXcHCxcwu+6KPJ8FgrdNuB2RmHU2M27wRAgMBAAGjPjA8MA4G
+A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMBYGA1UdDgQPBA1BQWJ0
+d0N4Y1hnYjBRMA0GCSqGSIb3DQEBCwUAA4GBAAUlBd0/XrkhQ6Gm8s44uOU/gSAe
+Ap8baRLuhTrrvzd+nPDBN0YbwVUMwd9TbY4MsmDy+GhE9/V8i8OydEshl2iE15+E
+JX2DJEmNd7RMfWb6EIZVuzFFDWRszxA14YdNvDXjwS6BYmsSWJsNH4P/eTRrTCJi
+C53ODVdhE6yCQs1m
 -----END CERTIFICATE-----
 Bag Attributes
     friendlyName: Certificate Authority rsa
 subject=/O=example.net/CN=clica CA rsa
 issuer=/O=example.net/CN=clica CA rsa
 -----BEGIN CERTIFICATE-----
-MIIB9jCCAV+gAwIBAgIBATANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
-cGxlLm5ldDEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwM1oX
-DTM4MDEwMTEyMzQwM1owLTEUMBIGA1UEChMLZXhhbXBsZS5uZXQxFTATBgNVBAMT
-DGNsaWNhIENBIHJzYTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA3kwC9CHz
-JH7sEDkHMdZRq8+XpV7l/hEqfv2gPvT3mak46dWrI/T3pJOqyNvUZV/LJ/gx/0uw
-9pmCg6Y5zNCN0qAGY4rSS/sbEOLYIw5wJbFnYfHtTwe3ZAdG+5WqKMBF2lHNBM3b
-PUB/kweoLhNLwserKHwMDC3sksfrwH29rpMCAwEAAaMmMCQwEgYDVR0TAQH/BAgw
-BgEB/wIBATAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADgYEAzXt6KHIB
-qOJfZECgwhAWipxVR0BXek0hAfyTWl7q18+mWKYydQW0Z2VMN4Bq/ZUlOg+EM8NU
-1n9PJ4+I2QgAwVVXN4+cz7zgZ6XRZc1OkE98NyK504bVpJpan1gsx3I5GLJUgP2t
-B/WwqoFO+ANhT2margZSM6avJfaIh8gEass=
+MIIB9jCCAV+gAwIBAgIBQTANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+cGxlLm5ldDEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQxNFoX
+DTM4MDEwMTEyMzQxNFowLTEUMBIGA1UEChMLZXhhbXBsZS5uZXQxFTATBgNVBAMT
+DGNsaWNhIENBIHJzYTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAs89Jw+yK
+ohiMwcSLAciqgj5CtxYRsoW1AmQrhD3QwE6es0RBjTGp5SNjjPlRxCZ5T+dQQXR1
+RirvSKH+isbd1ENIbS9dPgaR2mFUYwcSxUIRrXn4mkxZ/QtpTVOoY184lFAPhTrW
+et4o+wE9OI2e75RD5GdAyB/52paGplt+K38CAwEAAaMmMCQwEgYDVR0TAQH/BAgw
+BgEB/wIBATAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADgYEAOcXFUXls
+ChTDzMe2y+qv1YlOZbkf43S9je72ATYXzS7/eT8I4sAq/CFdgmn+lw5kHJlgxCag
+BPwuLYHW55r69WI1IwQHrJXaavyPSkonVgK+ZssEcQmqbgNj8oV5ZnyzYnNZv0VU
+nMl1n6nCl1xdUwPwhhdssGXEoX8OF5iMw4U=
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.net/server2.example.net/cert8.db b/test/aux-fixed/exim-ca/example.net/server2.example.net/cert8.db
index 5ee0f8149..b9471a4bc 100644
--- a/test/aux-fixed/exim-ca/example.net/server2.example.net/cert8.db
+++ b/test/aux-fixed/exim-ca/example.net/server2.example.net/cert8.db
diff --git a/test/aux-fixed/exim-ca/example.net/server2.example.net/fullchain.pem b/test/aux-fixed/exim-ca/example.net/server2.example.net/fullchain.pem
new file mode 100644
index 000000000..9d67ce107
--- /dev/null
+++ b/test/aux-fixed/exim-ca/example.net/server2.example.net/fullchain.pem
@@ -0,0 +1,57 @@
+Bag Attributes
+    friendlyName: server2.example.net
+    localKeyID: 54 FB 5C D7 4D A7 32 31 72 D2 2B 6B A2 EB 32 81 4E 5A 1B F3 
+subject=/CN=server2.example.net
+issuer=/O=example.net/CN=clica Signing Cert rsa
+-----BEGIN CERTIFICATE-----
+MIICszCCAhygAwIBAgICAMkwDQYJKoZIhvcNAQELBQAwNzEUMBIGA1UEChMLZXhh
+bXBsZS5uZXQxHzAdBgNVBAMTFmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwHhcNMTIx
+MTAxMTIzNDE2WhcNMzcxMjAxMTIzNDE2WjAeMRwwGgYDVQQDExNzZXJ2ZXIyLmV4
+YW1wbGUubmV0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDZlzAAFO0CinxW
+9W0WATpMYpFYgiqZd2z2+nucbslOuJDsLHqKn5sJSL1pXnZP50CIXKuYfLK0GS+i
+7UqXdalTbZ/Y4CH5kLDSfrKJLqkgB+gbTHIsEhwGC+5Z2M7NXlk6rzxQavQ3Dp+h
+yuyfDc/C5V+asL9+S9Q+aKnwBltgJQIDAQABo4HmMIHjMA4GA1UdDwEB/wQEAwIE
+8DAgBgNVHSUBAf8EFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwTgYDVR0jBEcwRYAN
+QUFidHdDeGNYZ2IwUaExpC8wLTEUMBIGA1UEChMLZXhhbXBsZS5jb20xFTATBgNV
+BAMTDGNsaWNhIENBIHJzYYIBQjA0BggrBgEFBQcBAQQoMCYwJAYIKwYBBQUHMAGG
+GGh0dHA6Ly9vc2NwLmV4YW1wbGUubmV0LzApBgNVHREEIjAgggkqLnRlc3QuZXiC
+E3NlcnZlcjIuZXhhbXBsZS5uZXQwDQYJKoZIhvcNAQELBQADgYEACduCkaIWVVeW
+mI9SWw1iMf3gIxMSx/hK/CFcthAfGwcq7Klpe3k0iDHqTAzJrgIOoiBRo/bKn2s/
+Ta3ykS24YF7SdkFWPE22XZiQ1qoSH5ShVg1M6+jo31Cbtl1bO4sPiNcxzlgFDvmt
+RD7zGZ+em4e8hzZhB4Np8dOec6H9bz8=
+-----END CERTIFICATE-----
+Bag Attributes
+    friendlyName: Signing Cert rsa
+subject=/O=example.net/CN=clica Signing Cert rsa
+issuer=/O=example.net/CN=clica CA rsa
+-----BEGIN CERTIFICATE-----
+MIICGDCCAYGgAwIBAgIBQjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+cGxlLm5ldDEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQxNFoX
+DTM4MDEwMTEyMzQxNFowNzEUMBIGA1UEChMLZXhhbXBsZS5uZXQxHzAdBgNVBAMT
+FmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
+AoGBAKFOi+80c9pb3UidQJd+TQ9j9lmOlw3HlhRxYNadHL2jZ98OHrwlDB1JgToy
+PruZ9yLq26a7c6sLYqEvpHulS6ACUqYaqu9kKb8m4l7xlheoyLT/jkZjq4Z0owp8
+PhzYl4p3M23rQzNSXcHCxcwu+6KPJ8FgrdNuB2RmHU2M27wRAgMBAAGjPjA8MA4G
+A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMBYGA1UdDgQPBA1BQWJ0
+d0N4Y1hnYjBRMA0GCSqGSIb3DQEBCwUAA4GBAAUlBd0/XrkhQ6Gm8s44uOU/gSAe
+Ap8baRLuhTrrvzd+nPDBN0YbwVUMwd9TbY4MsmDy+GhE9/V8i8OydEshl2iE15+E
+JX2DJEmNd7RMfWb6EIZVuzFFDWRszxA14YdNvDXjwS6BYmsSWJsNH4P/eTRrTCJi
+C53ODVdhE6yCQs1m
+-----END CERTIFICATE-----
+Bag Attributes
+    friendlyName: Certificate Authority rsa
+subject=/O=example.net/CN=clica CA rsa
+issuer=/O=example.net/CN=clica CA rsa
+-----BEGIN CERTIFICATE-----
+MIIB9jCCAV+gAwIBAgIBQTANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+cGxlLm5ldDEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQxNFoX
+DTM4MDEwMTEyMzQxNFowLTEUMBIGA1UEChMLZXhhbXBsZS5uZXQxFTATBgNVBAMT
+DGNsaWNhIENBIHJzYTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAs89Jw+yK
+ohiMwcSLAciqgj5CtxYRsoW1AmQrhD3QwE6es0RBjTGp5SNjjPlRxCZ5T+dQQXR1
+RirvSKH+isbd1ENIbS9dPgaR2mFUYwcSxUIRrXn4mkxZ/QtpTVOoY184lFAPhTrW
+et4o+wE9OI2e75RD5GdAyB/52paGplt+K38CAwEAAaMmMCQwEgYDVR0TAQH/BAgw
+BgEB/wIBATAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADgYEAOcXFUXls
+ChTDzMe2y+qv1YlOZbkf43S9je72ATYXzS7/eT8I4sAq/CFdgmn+lw5kHJlgxCag
+BPwuLYHW55r69WI1IwQHrJXaavyPSkonVgK+ZssEcQmqbgNj8oV5ZnyzYnNZv0VU
+nMl1n6nCl1xdUwPwhhdssGXEoX8OF5iMw4U=
+-----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.net/server2.example.net/key3.db b/test/aux-fixed/exim-ca/example.net/server2.example.net/key3.db
index 8e7bc550b..4762cb2cf 100644
--- a/test/aux-fixed/exim-ca/example.net/server2.example.net/key3.db
+++ b/test/aux-fixed/exim-ca/example.net/server2.example.net/key3.db
diff --git a/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.chain.pem b/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.chain.pem
index 4fcf7ad88..470ac8c5e 100644
--- a/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.chain.pem
+++ b/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.chain.pem
@@ -1,35 +1,36 @@
 Bag Attributes
     friendlyName: server2.example.net
-    localKeyID: D2 9B A9 F4 48 0F EB D4 1A CA 1B 29 7A 49 FB 09 0B AA 4D 02 
+    localKeyID: 54 FB 5C D7 4D A7 32 31 72 D2 2B 6B A2 EB 32 81 4E 5A 1B F3 
 subject=/CN=server2.example.net
 issuer=/O=example.net/CN=clica Signing Cert rsa
 -----BEGIN CERTIFICATE-----
-MIICjDCCAfWgAwIBAgICAMkwDQYJKoZIhvcNAQELBQAwNzEUMBIGA1UEChMLZXhh
+MIICszCCAhygAwIBAgICAMkwDQYJKoZIhvcNAQELBQAwNzEUMBIGA1UEChMLZXhh
 bXBsZS5uZXQxHzAdBgNVBAMTFmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwHhcNMTIx
-MTAxMTIzNDA0WhcNMzcxMjAxMTIzNDA0WjAeMRwwGgYDVQQDExNzZXJ2ZXIyLmV4
-YW1wbGUubmV0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJyy5Qho3LBb3L
-EbQZgsrtkPAqRXRhTME03lUdXHmtEkhGGe4zCrZ7RemAJADhR8aguhAebrVYno5e
-nZ+KS8CvE8z6eBJqQ5VhaKkb3JvCb5PyoWyXm3tMPufYtJ/1C13VT5cupGW4rJg0
-BEsRqlWl3qbfHmhgyDd1VWgLn6+X9wIDAQABo4G/MIG8MA4GA1UdDwEB/wQEAwIE
-8DAgBgNVHSUBAf8EFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwMgYDVR0fBCswKTAn
-oCWgI4YhaHR0cDovL2NybC5leGFtcGxlLm5ldC9sYXRlc3QuY3JsMDQGCCsGAQUF
-BwEBBCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29zY3AuZXhhbXBsZS5uZXQvMB4G
-A1UdEQQXMBWCE3NlcnZlcjIuZXhhbXBsZS5uZXQwDQYJKoZIhvcNAQELBQADgYEA
-YfsNBKmjTjfIZw0vSzK7pq+ouXe9KAlCDZU/mgKMp0be6RYd9BRvAn4R2J452W2h
-AtBVl6vRqaqpMzsUIfwPe1lOb3at/ESz7CwtERTAfHPj6STDXLDyAF2Eg0B7xf1W
-9ag0Vwa1/6UPAALHQ5juuKAFsZSDVms2uz0x1oh9y+I=
+MTAxMTIzNDE2WhcNMzcxMjAxMTIzNDE2WjAeMRwwGgYDVQQDExNzZXJ2ZXIyLmV4
+YW1wbGUubmV0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDZlzAAFO0CinxW
+9W0WATpMYpFYgiqZd2z2+nucbslOuJDsLHqKn5sJSL1pXnZP50CIXKuYfLK0GS+i
+7UqXdalTbZ/Y4CH5kLDSfrKJLqkgB+gbTHIsEhwGC+5Z2M7NXlk6rzxQavQ3Dp+h
+yuyfDc/C5V+asL9+S9Q+aKnwBltgJQIDAQABo4HmMIHjMA4GA1UdDwEB/wQEAwIE
+8DAgBgNVHSUBAf8EFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwTgYDVR0jBEcwRYAN
+QUFidHdDeGNYZ2IwUaExpC8wLTEUMBIGA1UEChMLZXhhbXBsZS5jb20xFTATBgNV
+BAMTDGNsaWNhIENBIHJzYYIBQjA0BggrBgEFBQcBAQQoMCYwJAYIKwYBBQUHMAGG
+GGh0dHA6Ly9vc2NwLmV4YW1wbGUubmV0LzApBgNVHREEIjAgggkqLnRlc3QuZXiC
+E3NlcnZlcjIuZXhhbXBsZS5uZXQwDQYJKoZIhvcNAQELBQADgYEACduCkaIWVVeW
+mI9SWw1iMf3gIxMSx/hK/CFcthAfGwcq7Klpe3k0iDHqTAzJrgIOoiBRo/bKn2s/
+Ta3ykS24YF7SdkFWPE22XZiQ1qoSH5ShVg1M6+jo31Cbtl1bO4sPiNcxzlgFDvmt
+RD7zGZ+em4e8hzZhB4Np8dOec6H9bz8=
 -----END CERTIFICATE-----
 -----BEGIN CERTIFICATE-----
-MIICNDCCAZ2gAwIBAgIBAjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
-cGxlLm5ldDEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwM1oX
-DTM4MDEwMTEyMzQwM1owNzEUMBIGA1UEChMLZXhhbXBsZS5uZXQxHzAdBgNVBAMT
+MIICGDCCAYGgAwIBAgIBQjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+cGxlLm5ldDEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQxNFoX
+DTM4MDEwMTEyMzQxNFowNzEUMBIGA1UEChMLZXhhbXBsZS5uZXQxHzAdBgNVBAMT
 FmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
-AoGBALMuDick/uNCkK8zWtdko5eynjJq0y8NVNlhSFkbwfjbxOQycuyMhMlYNnvs
-ESWZTV5ckpsvoDrFQLFk6ZB7RVYHUoOHNfANm8JWC9GR5zqbquibA/MMQ4h2Xlkz
-zQz12AzPpouZUyYs1+SjwlgfBRVhtxApDR2bPEDzI6s9VUdXAgMBAAGjWjBYMA4G
-A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMDIGA1UdHwQrMCkwJ6Al
-oCOGIWh0dHA6Ly9jcmwuZXhhbXBsZS5uZXQvbGF0ZXN0LmNybDANBgkqhkiG9w0B
-AQsFAAOBgQDCXkPeCURjOJwCBgbLERuNghPiWLqHPopm1idM2A032jDgbRXD9/DP
-1xOPgSLEW59EiJac0RNae0D2KyhnG90NZLccXK0a9Uu1iaAmdcJ7s4a0x0ZH9Kza
-hqz0cr4oStUOHxG/AtPKuhZ9PkZ7GDSPDW0k/z64WYCm1fqSWkbVig==
+AoGBAKFOi+80c9pb3UidQJd+TQ9j9lmOlw3HlhRxYNadHL2jZ98OHrwlDB1JgToy
+PruZ9yLq26a7c6sLYqEvpHulS6ACUqYaqu9kKb8m4l7xlheoyLT/jkZjq4Z0owp8
+PhzYl4p3M23rQzNSXcHCxcwu+6KPJ8FgrdNuB2RmHU2M27wRAgMBAAGjPjA8MA4G
+A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMBYGA1UdDgQPBA1BQWJ0
+d0N4Y1hnYjBRMA0GCSqGSIb3DQEBCwUAA4GBAAUlBd0/XrkhQ6Gm8s44uOU/gSAe
+Ap8baRLuhTrrvzd+nPDBN0YbwVUMwd9TbY4MsmDy+GhE9/V8i8OydEshl2iE15+E
+JX2DJEmNd7RMfWb6EIZVuzFFDWRszxA14YdNvDXjwS6BYmsSWJsNH4P/eTRrTCJi
+C53ODVdhE6yCQs1m
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.key b/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.key
index 94275d88d..14752e7bd 100644
--- a/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.key
+++ b/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.key
@@ -1,21 +1,22 @@
 Bag Attributes
     friendlyName: server2.example.net
-    localKeyID: D2 9B A9 F4 48 0F EB D4 1A CA 1B 29 7A 49 FB 09 0B AA 4D 02 
+    localKeyID: 54 FB 5C D7 4D A7 32 31 72 D2 2B 6B A2 EB 32 81 4E 5A 1B F3 
 Key Attributes: <No Attributes>
 -----BEGIN ENCRYPTED PRIVATE KEY-----
-MIICxjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQIB9bHTJXCqmUCAggA
-MBQGCCqGSIb3DQMHBAi6w8GSieGl9QSCAoAZsxqDNKfVkeE7n0BKx6DmbVE1ZpS2
-bnVSmvRxkevnEmevvplRPzpVEt2zHCQ3kBaUFk+SFf3dZVJ97veK94knyKhQ+mFQ
-QUpa2D840yDIJHeXyYc5zNo6oPOMHI4khd2B8Wmfaht1N+EUY+He4rpdYFX4KHhR
-HGxhnPwT5F48AaDZ8LyG92Q9onffGcMFXnO1GC/8zYvsff89K9udmMn749plYXRE
-ISZpF1e73Mn3Cr/rPk6YUX39K+pg8SqcKd2cT8VqOVnkw6EB4XxmfEsXX796Zif1
-qDxKtYguVbOzE3vJKQP2WM1nRh0rPttNyB3O3MyCF5R6h2Gyw7EtPvFUquGqbw94
-SAUOCFAUbP965xQfhMvXKAO30p2dJxqRFZp4hKsrnpx0AnxgaXKN2EvRLtzCSolS
-/nphNhLCqcZZmFQliL/TbHN4r9xdCpvqTnsByVFCWsdVVrW+ThgO69OAx7j+rVG0
-JC9kJzVnl6WAYA68DiyRVxr5L+2bTQq9ehBmkUT4RikU1X2cTNgc7DdbWp+/gna5
-9LfBfZ6NwDXssbQJLDlE7YTgfLU423q/fDtODDZgqg3dVqayOGqLOZfQD45wIqzW
-9owGO1Ncbtp2duYWIHYzAJIlrWuwkBHlqfk2AZcmId+T5y9cgGHaWeB/4OWScFgq
-8ZAo7USCv8TSCvJB+zKiOzvT+oMzYs7gWAZZVlpaBbeCbnNpDtp2ItvKe+ScCBtc
-dGwLbDGwt9rC3GkUF7+IsCgpq6xQjIa4NU0o42MqjQw5z3qkxnEgO36Iy6xu96JA
-I1qQ8aOqaEaFnhxDWh5TTUb0nortQn7KmEsPpdg1lhoV3Q3Y3DQfzZ1J
+MIIC1DBOBgkqhkiG9w0BBQ0wQTApBgkqhkiG9w0BBQwwHAQICL4dpOTDtE8CAggA
+MAwGCCqGSIb3DQIJBQAwFAYIKoZIhvcNAwcECLs4fMvRcBTgBIICgFL8H95N3zcg
+mRjJ7gKfh9LXdVjROyvnjlEHR2ZwYWjPcet2DS0uLY9OWNZSEl12moXFTzYrqx9v
+uoaCfYhkRZlfzrfIar6v1qsyptJPLRsKY6/FrI8/7OBpXkyQZfPTa0y4lkJpurjE
+PfX3ZVxHDJqG4Kv0+PaBpMa0qOgcMqlFtRDC53jFDSsPw4lmqwTN0T8Upc3Fc4qj
+qOCT7ctjioQEM1ih7r5eRLqP7fzLujHto6INf8cgCAMT8mCyoAS4YBbMKIxAyf6F
+yKoAyr4Ka0/I7xGfkok2IIYvxbUtsaDxrd3OV+bPJ5jzCmVZq6l8Z5KaZGHfsma2
+hd6WKgZnYilXB4Ym1bZIWyETZSZ+BlSFR95ynu8os221rXJkDSa+d5d/1ewrwGXX
+c9l7xzYj1UoML0ClAxY1vr/bHGppBU/7WXgSgAHeLyp3dW5ciBrpzVJYfG+9NUt9
+t6s35dJOI1MhL2QgEH4h6c074xcARIYIa+s1CQVSYCjN2juzf6F80PfSpIwjJo96
+2wNnIn3C9sPJRoE0eVUwmhjSRp07ipv5pLiHGwPiVuaRJwx1zZRwS26bDccSAmuW
+Q/7NANZCE0j99GouR+mW71obFl3uQx8+Uforv0P32oJtLxIzCOCYQpltbTDJvSC6
+1St8ehS6+ynHI4EXM4+LjpS4WqXAd/ASpLSj63KyFBAKQsuoTJ6IlVv4Xlihzyfo
+8t55mfbYOoJyl9R0NFj4QM8dGGqOzOBCOGxLaYS8Qgt1QyLoJ2sc24fuyAajnSeV
+RuY6JNAHINrwkJcI6Yn5E+YWXhSx57/WzSQbK+C5nRl0FG2Y90u3xnTQYZPbLu3G
+Dg+Aqo+a0sc=
 -----END ENCRYPTED PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.dated.resp b/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.dated.resp
index d3f0f45b3..407b29489 100644
--- a/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.dated.resp
+++ b/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.dated.resp
diff --git a/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.good.resp b/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.good.resp
index 475f38e03..fd508a072 100644
--- a/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.good.resp
+++ b/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.good.resp
diff --git a/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.req b/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.req
index b0f894083..b2e215977 100644
--- a/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.req
+++ b/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.req
diff --git a/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.revoked.resp b/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.revoked.resp
index 475f38e03..fd508a072 100644
--- a/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.revoked.resp
+++ b/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.revoked.resp
diff --git a/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.signer.dated.resp b/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.signer.dated.resp
index 9b8ca8936..21f83075a 100644
--- a/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.signer.dated.resp
+++ b/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.signer.dated.resp
diff --git a/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.signer.good.resp b/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.signer.good.resp
index a6cb1068c..56cc9fec0 100644
--- a/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.signer.good.resp
+++ b/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.signer.good.resp
diff --git a/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.signer.revoked.resp b/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.signer.revoked.resp
index a6cb1068c..56cc9fec0 100644
--- a/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.signer.revoked.resp
+++ b/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.signer.revoked.resp
diff --git a/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.signernocert.dated.resp b/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.signernocert.dated.resp
index d5f1d2bd4..089811ea5 100644
--- a/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.signernocert.dated.resp
+++ b/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.signernocert.dated.resp
diff --git a/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.signernocert.good.resp b/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.signernocert.good.resp
index 56825b59a..c0970a73f 100644
--- a/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.signernocert.good.resp
+++ b/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.signernocert.good.resp
diff --git a/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.signernocert.revoked.resp b/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.signernocert.revoked.resp
index 56825b59a..c0970a73f 100644
--- a/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.signernocert.revoked.resp
+++ b/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.signernocert.revoked.resp
diff --git a/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.p12 b/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.p12
index 21aa30fbe..8396e2e53 100644
--- a/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.p12
+++ b/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.p12
diff --git a/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.pem b/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.pem
index f0cfdc467..6daba765c 100644
--- a/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.pem
+++ b/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.pem
@@ -1,21 +1,22 @@
 Bag Attributes
     friendlyName: server2.example.net
-    localKeyID: D2 9B A9 F4 48 0F EB D4 1A CA 1B 29 7A 49 FB 09 0B AA 4D 02 
+    localKeyID: 54 FB 5C D7 4D A7 32 31 72 D2 2B 6B A2 EB 32 81 4E 5A 1B F3 
 subject=/CN=server2.example.net
 issuer=/O=example.net/CN=clica Signing Cert rsa
 -----BEGIN CERTIFICATE-----
-MIICjDCCAfWgAwIBAgICAMkwDQYJKoZIhvcNAQELBQAwNzEUMBIGA1UEChMLZXhh
+MIICszCCAhygAwIBAgICAMkwDQYJKoZIhvcNAQELBQAwNzEUMBIGA1UEChMLZXhh
 bXBsZS5uZXQxHzAdBgNVBAMTFmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwHhcNMTIx
-MTAxMTIzNDA0WhcNMzcxMjAxMTIzNDA0WjAeMRwwGgYDVQQDExNzZXJ2ZXIyLmV4
-YW1wbGUubmV0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJyy5Qho3LBb3L
-EbQZgsrtkPAqRXRhTME03lUdXHmtEkhGGe4zCrZ7RemAJADhR8aguhAebrVYno5e
-nZ+KS8CvE8z6eBJqQ5VhaKkb3JvCb5PyoWyXm3tMPufYtJ/1C13VT5cupGW4rJg0
-BEsRqlWl3qbfHmhgyDd1VWgLn6+X9wIDAQABo4G/MIG8MA4GA1UdDwEB/wQEAwIE
-8DAgBgNVHSUBAf8EFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwMgYDVR0fBCswKTAn
-oCWgI4YhaHR0cDovL2NybC5leGFtcGxlLm5ldC9sYXRlc3QuY3JsMDQGCCsGAQUF
-BwEBBCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29zY3AuZXhhbXBsZS5uZXQvMB4G
-A1UdEQQXMBWCE3NlcnZlcjIuZXhhbXBsZS5uZXQwDQYJKoZIhvcNAQELBQADgYEA
-YfsNBKmjTjfIZw0vSzK7pq+ouXe9KAlCDZU/mgKMp0be6RYd9BRvAn4R2J452W2h
-AtBVl6vRqaqpMzsUIfwPe1lOb3at/ESz7CwtERTAfHPj6STDXLDyAF2Eg0B7xf1W
-9ag0Vwa1/6UPAALHQ5juuKAFsZSDVms2uz0x1oh9y+I=
+MTAxMTIzNDE2WhcNMzcxMjAxMTIzNDE2WjAeMRwwGgYDVQQDExNzZXJ2ZXIyLmV4
+YW1wbGUubmV0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDZlzAAFO0CinxW
+9W0WATpMYpFYgiqZd2z2+nucbslOuJDsLHqKn5sJSL1pXnZP50CIXKuYfLK0GS+i
+7UqXdalTbZ/Y4CH5kLDSfrKJLqkgB+gbTHIsEhwGC+5Z2M7NXlk6rzxQavQ3Dp+h
+yuyfDc/C5V+asL9+S9Q+aKnwBltgJQIDAQABo4HmMIHjMA4GA1UdDwEB/wQEAwIE
+8DAgBgNVHSUBAf8EFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwTgYDVR0jBEcwRYAN
+QUFidHdDeGNYZ2IwUaExpC8wLTEUMBIGA1UEChMLZXhhbXBsZS5jb20xFTATBgNV
+BAMTDGNsaWNhIENBIHJzYYIBQjA0BggrBgEFBQcBAQQoMCYwJAYIKwYBBQUHMAGG
+GGh0dHA6Ly9vc2NwLmV4YW1wbGUubmV0LzApBgNVHREEIjAgggkqLnRlc3QuZXiC
+E3NlcnZlcjIuZXhhbXBsZS5uZXQwDQYJKoZIhvcNAQELBQADgYEACduCkaIWVVeW
+mI9SWw1iMf3gIxMSx/hK/CFcthAfGwcq7Klpe3k0iDHqTAzJrgIOoiBRo/bKn2s/
+Ta3ykS24YF7SdkFWPE22XZiQ1qoSH5ShVg1M6+jo31Cbtl1bO4sPiNcxzlgFDvmt
+RD7zGZ+em4e8hzZhB4Np8dOec6H9bz8=
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.unlocked.key b/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.unlocked.key
index 6a6b032fb..28f85e154 100644
--- a/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.unlocked.key
+++ b/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.unlocked.key
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXQIBAAKBgQDJyy5Qho3LBb3LEbQZgsrtkPAqRXRhTME03lUdXHmtEkhGGe4z
-CrZ7RemAJADhR8aguhAebrVYno5enZ+KS8CvE8z6eBJqQ5VhaKkb3JvCb5PyoWyX
-m3tMPufYtJ/1C13VT5cupGW4rJg0BEsRqlWl3qbfHmhgyDd1VWgLn6+X9wIDAQAB
-AoGAXpuZ3TsYY2UPtJNaQtOlXHglgUwK4ktgEe9jLF7c1R3LMMKbgOa241jFvsQi
-fXxvTY+uWvZAo4nC6e0wjWAyt42LG7zyxeB6U20MA1IXhsOP0kDcC8grqcJ7f6dB
-o3xXm3AElUKbNQC6s2KGPL18VXUjwD4JGN75Q6brvVnKOCECQQDkOC3tQXXgjX21
-AfchkpajQwCKHsg5o6/YbiahGEQradrZIy8wBV/KvQm6l7k766wpTHJl9moXVieb
-e8oFGP4fAkEA4luEI6YW5yuEQkvf+fuu6dbBINU6cVxJHYd1XXz4XGtsbUm+1zQC
-VUCxxJRoWOA6URzbyK5LVynEgGOhdKp7KQJAVKeaMaXUieUyOhBukV+EzS6vZoyg
-jPDw64GAhsUvlEMB0QXCHTgBHn0cvMBHD7kN9YvL65KKK/njW0OB3n401QJBAKX/
-URdHjRI4YoSv2fAcd3h7CiSG2pYZhHEITrShmg1Epj47T53IQVG94N/1qdRLk9i6
-Hh+8Wfnw4m75IYVKJIkCQQDdEuPXVKYWrzEkgmM1+gGjjGRrBgrrMQ39hza+jq7C
-vYZM+Ulld9tBSaCmn3g3BYw+RNGGgxb46IZCS25RWQKW
+MIICXAIBAAKBgQDZlzAAFO0CinxW9W0WATpMYpFYgiqZd2z2+nucbslOuJDsLHqK
+n5sJSL1pXnZP50CIXKuYfLK0GS+i7UqXdalTbZ/Y4CH5kLDSfrKJLqkgB+gbTHIs
+EhwGC+5Z2M7NXlk6rzxQavQ3Dp+hyuyfDc/C5V+asL9+S9Q+aKnwBltgJQIDAQAB
+AoGAXA6R2UcBKzUJ/ARjvY6RaqW9FnQjr8AOEsPQrlNUygBeF/2Nbr6t6hSjRkQX
+zCBrdgW295GyTW3mcIjyKPg3xXNOvxtR3N5NSOXJw49ar8VOExOqIrcfP9nsxQ+l
+H/UsF9xJ8cqx3blHtpHNn00JQ7jGfjIkYXCEPSVRozUJt7UCQQD3BXworsSQIAs6
+XatW0Y7/cHNtiidL98AyBtHzUwAYeEusy3+6u+jbK0FWWM+PqPWSayHPM3juSQ0Q
+yDK8d+YvAkEA4X/ZyzVrPA+P+tKM7zCSAKrD80gEwytFiSEk5c4Ww5C6MaZyv0XP
+LtWJJi3jSDB9VHxTNH1kBZXG2JvLphRd6wJAOlu+YHIhmBcp7+kPQJyTlv9/FaLs
+88KdUnRQB5dVT3KkFjehfoFEWvsWHYsvxjXZhnTu8N+tM0Zo4s0ZR3NgGwJBAM83
+DC0W3n6nklgbqRSXXmMsiLoDQRUTq2dSxLRECFkXonHDkYhAnx1bbhdebY/FtzWu
+tUrzurkDJGGh8Kah6pcCQGQls2OPc3yjoWIyhtladn6IXu/4XxNb5M4Hjdxd/nO2
+ljQsvEEer93DE8wILdAFys2pCXdTngjwLvdqypsYcMY=
 -----END RSA PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.org/BLANK/CA.pem b/test/aux-fixed/exim-ca/example.org/BLANK/CA.pem
index 5336e837a..499940547 100644
--- a/test/aux-fixed/exim-ca/example.org/BLANK/CA.pem
+++ b/test/aux-fixed/exim-ca/example.org/BLANK/CA.pem
@@ -1,13 +1,13 @@
 -----BEGIN CERTIFICATE-----
-MIIB9jCCAV+gAwIBAgIBATANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
-cGxlLm9yZzEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwMloX
-DTM4MDEwMTEyMzQwMlowLTEUMBIGA1UEChMLZXhhbXBsZS5vcmcxFTATBgNVBAMT
-DGNsaWNhIENBIHJzYTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAsOI8xlyV
-2kpju6cf0E8/c0QwaOBvUGzkTdCau/DyQrwFPToVpVW8mzDQUOnoUXLl92EJa4Td
-a4uN/uyiyTcjUQWrlZKdFn9HaLB7+rLUox6fZF06jsWgC0Qfr3HHWsrMINn6bucC
-9/eZag5ADPyO5XYnCW4pIFnuFVQ+w3Qr060CAwEAAaMmMCQwEgYDVR0TAQH/BAgw
-BgEB/wIBATAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADgYEALAPJGCfj
-ldkldb3pxmUf8V2luI38AVKNZokjATe3tyv7ikhb2g20BRi92fMHOqfAMUfoJKAu
-lT5vLep0SUETmAXdr3+WfFeZu2KZ9t5lhxyUGnHhxDc3k8TzobZSpFS9+ZnR/4GY
-TwGhx36iRUIFRZ/PUQrkRniedLSkO+H+Xko=
+MIIB9jCCAV+gAwIBAgIBQTANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+cGxlLm9yZzEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwOFoX
+DTM4MDEwMTEyMzQwOFowLTEUMBIGA1UEChMLZXhhbXBsZS5vcmcxFTATBgNVBAMT
+DGNsaWNhIENBIHJzYTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAw4JFjAQr
+oK/87+wzLtvmEa5eQc7oZPrzziKz8EnH8bT2chPEUO1rt+7O9yxWZGyH7JkSw399
+bBu9Kw5xsxqvWrXYUQ0OPj1tuf8/tXc1FCtCYSLVp2vV2It+xfqQdoFHUxgK0dSz
+sYCPYPpaPag/x7h3lWfvhZfMxdDMOSBR6VMCAwEAAaMmMCQwEgYDVR0TAQH/BAgw
+BgEB/wIBATAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADgYEAJ+FVy3d0
+Bz1nk9xcA8rTGhx4sITmI0R1ccjOMlghQErpJx2pYEZ79osrZyOAIuOGSA/g1JFf
+n4llCc6vTbKjR/VUR8wWPmMttDK08YU0Nt9QJNHH1Okl/lpVQxDvHuMQMZ4tP8hJ
+Mu1lg0IENm5gyQ2y91p3m5YNX2kI7SiViUg=
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.org/BLANK/Signer.pem b/test/aux-fixed/exim-ca/example.org/BLANK/Signer.pem
index 0939297fe..6f2d4d15c 100644
--- a/test/aux-fixed/exim-ca/example.org/BLANK/Signer.pem
+++ b/test/aux-fixed/exim-ca/example.org/BLANK/Signer.pem
@@ -1,14 +1,14 @@
 -----BEGIN CERTIFICATE-----
-MIICNDCCAZ2gAwIBAgIBAjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
-cGxlLm9yZzEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwMloX
-DTM4MDEwMTEyMzQwMlowNzEUMBIGA1UEChMLZXhhbXBsZS5vcmcxHzAdBgNVBAMT
+MIICGDCCAYGgAwIBAgIBQjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+cGxlLm9yZzEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwOFoX
+DTM4MDEwMTEyMzQwOFowNzEUMBIGA1UEChMLZXhhbXBsZS5vcmcxHzAdBgNVBAMT
 FmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
-AoGBAJXe07nxVSZPJ3rVBHQp+m5gWb5/JkzXwcWKEvcmMnJzo2ydVfHBBRmTpzpS
-ST3js2awNbhEdOU7AeBtAvyOtwlT/yp6SHhOlI8PlgLwL9/xedeC0Ex412VOeaV/
-LRbvj0j+WutuglAFXfD5IlwnRoDUB1Q51JFtYZxlxvOqbLb9AgMBAAGjWjBYMA4G
-A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMDIGA1UdHwQrMCkwJ6Al
-oCOGIWh0dHA6Ly9jcmwuZXhhbXBsZS5vcmcvbGF0ZXN0LmNybDANBgkqhkiG9w0B
-AQsFAAOBgQCf9uWkJrIlu9DvKwiiRj6/vMFydd9kLq11COjAovfD6+VbRLeX1lpC
-XpHDhUlrAKOV/5Virl+iXao5YnfnCm1oud0jRGcG8x1JPqUKW3REch4vR0wkjaBS
-5eI7DiydPL1yts588Z6gLjHZBaR0cuXS4e1k9rcXuBC9tZjv7rYskQ==
+AoGBAKvNwx4xa7WCNqEVZytf9wBSqEyyJGZrzauZyQleeD564JHoYpfqgi/WiTje
+bOF+sPAK9x+o+sBYwUu227LUaYgotqqcbhY8kr5lnUQt8il52dstsqcVKpwPG1uQ
+vmTv5J5W9WjF38aHEpFHJL1l8SmC7Og318AbGNuY2b5VmVFbAgMBAAGjPjA8MA4G
+A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMBYGA1UdDgQPBA1BQWJ0
+d0N4Y1hnYjBRMA0GCSqGSIb3DQEBCwUAA4GBAGtwA01/eJwFs17LhHpVC+LTlxFO
+NC8rQCNXWLlt6S9v+ueuO+E5k5s1TXnQ9iB9eZbMXz6tGEuiiS5zDhUTf2kLt55U
+b2pjpDg4doh9h778ss+Yz5ASKg0vqQ0E9yHY1FzJBqxcPHl2BnkcCml9fDW9oI0v
+tzM43Bo0kuWzn62i
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.org/BLANK/cert8.db b/test/aux-fixed/exim-ca/example.org/BLANK/cert8.db
index 85733eb3c..f0cf58987 100644
--- a/test/aux-fixed/exim-ca/example.org/BLANK/cert8.db
+++ b/test/aux-fixed/exim-ca/example.org/BLANK/cert8.db
diff --git a/test/aux-fixed/exim-ca/example.org/BLANK/key3.db b/test/aux-fixed/exim-ca/example.org/BLANK/key3.db
index 9211ef024..a2503fc90 100644
--- a/test/aux-fixed/exim-ca/example.org/BLANK/key3.db
+++ b/test/aux-fixed/exim-ca/example.org/BLANK/key3.db
diff --git a/test/aux-fixed/exim-ca/example.org/CA/CA.pem b/test/aux-fixed/exim-ca/example.org/CA/CA.pem
index 5336e837a..499940547 100644
--- a/test/aux-fixed/exim-ca/example.org/CA/CA.pem
+++ b/test/aux-fixed/exim-ca/example.org/CA/CA.pem
@@ -1,13 +1,13 @@
 -----BEGIN CERTIFICATE-----
-MIIB9jCCAV+gAwIBAgIBATANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
-cGxlLm9yZzEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwMloX
-DTM4MDEwMTEyMzQwMlowLTEUMBIGA1UEChMLZXhhbXBsZS5vcmcxFTATBgNVBAMT
-DGNsaWNhIENBIHJzYTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAsOI8xlyV
-2kpju6cf0E8/c0QwaOBvUGzkTdCau/DyQrwFPToVpVW8mzDQUOnoUXLl92EJa4Td
-a4uN/uyiyTcjUQWrlZKdFn9HaLB7+rLUox6fZF06jsWgC0Qfr3HHWsrMINn6bucC
-9/eZag5ADPyO5XYnCW4pIFnuFVQ+w3Qr060CAwEAAaMmMCQwEgYDVR0TAQH/BAgw
-BgEB/wIBATAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADgYEALAPJGCfj
-ldkldb3pxmUf8V2luI38AVKNZokjATe3tyv7ikhb2g20BRi92fMHOqfAMUfoJKAu
-lT5vLep0SUETmAXdr3+WfFeZu2KZ9t5lhxyUGnHhxDc3k8TzobZSpFS9+ZnR/4GY
-TwGhx36iRUIFRZ/PUQrkRniedLSkO+H+Xko=
+MIIB9jCCAV+gAwIBAgIBQTANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+cGxlLm9yZzEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwOFoX
+DTM4MDEwMTEyMzQwOFowLTEUMBIGA1UEChMLZXhhbXBsZS5vcmcxFTATBgNVBAMT
+DGNsaWNhIENBIHJzYTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAw4JFjAQr
+oK/87+wzLtvmEa5eQc7oZPrzziKz8EnH8bT2chPEUO1rt+7O9yxWZGyH7JkSw399
+bBu9Kw5xsxqvWrXYUQ0OPj1tuf8/tXc1FCtCYSLVp2vV2It+xfqQdoFHUxgK0dSz
+sYCPYPpaPag/x7h3lWfvhZfMxdDMOSBR6VMCAwEAAaMmMCQwEgYDVR0TAQH/BAgw
+BgEB/wIBATAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADgYEAJ+FVy3d0
+Bz1nk9xcA8rTGhx4sITmI0R1ccjOMlghQErpJx2pYEZ79osrZyOAIuOGSA/g1JFf
+n4llCc6vTbKjR/VUR8wWPmMttDK08YU0Nt9QJNHH1Okl/lpVQxDvHuMQMZ4tP8hJ
+Mu1lg0IENm5gyQ2y91p3m5YNX2kI7SiViUg=
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.org/CA/OCSP.key b/test/aux-fixed/exim-ca/example.org/CA/OCSP.key
index e36360781..bd61342f5 100644
--- a/test/aux-fixed/exim-ca/example.org/CA/OCSP.key
+++ b/test/aux-fixed/exim-ca/example.org/CA/OCSP.key
@@ -1,20 +1,20 @@
 Bag Attributes
     friendlyName: OCSP Signer rsa
-    localKeyID: 40 A2 82 95 E6 C7 D6 28 0E 8F 21 64 5E DA 33 D4 7A 73 03 83 
+    localKeyID: 8E A1 79 AD 6B 18 83 8F 55 9C 07 C1 3E 70 00 F9 52 F4 A4 AA 
 Key Attributes: <No Attributes>
 -----BEGIN PRIVATE KEY-----
-MIICdgIBADANBgkqhkiG9w0BAQEFAASCAmAwggJcAgEAAoGBALiViJBUHorb4RG/
-jrgpS3iOJlZ6ayVLd8IL+YslLSO4a5acRCSepJfkTrik3nzLe/ZXWz3VfbUd0AJr
-WDCL7rtYx0LsxiqZ1WVBGziil5wU7egskcXBpDVjGFBnYXqqRDrTDIvAvf5kCY8i
-JnI4YnAZTOI4mL1qYsGXtIAy6rjhAgMBAAECgYAIqGrpaiislret33BQTw+NLg26
-TK+t5iZN4cXosuu1Gzdgrx+7H/3Uag8PNhyBegHsghhzhAoLbsSM+IAAdu/RoWf7
-r1DaNji7IG+UX2xOtaGhyokF//pD2KDNc1cAFYQNTZUzoA9W9PNKr6SdCDjzQs3Z
-3IBF5S42MtZqwTOjKQJBAN9gHu646DjhsRX7eFvSa043wx5+choccbxA7Meq8yn3
-ss2b/qPYUTq5ih2TrIjnYXVQ7RHQHotZPB7K0KOcDmsCQQDTiwa8jLc2kVJ32TrH
-oTPyJ552Rep5Cdxk/zClLAA2gJiKekcNqPbsKj28gw88Dqu5tfKfsZpAzEeXgh7a
-OdDjAkEAkkm4+E5QhzAHcYYHBNuBOvB58HaO81q9gbRjXUAvj8SQbOdElLkOOY9Z
-TJVx4RbnVJVzLL9HwarnHKNmkD+bkQJAApKVQWPAsqQvyY9VvKnENPSwY6XUBSbO
-jFfiIpAXbJJByKVWCd99KUAWQh2h6MwQ4JBK5BBH3PPfBwOpFmRPmwJAP0qZl67D
-TCFly6SwuTmElJd2q9sVEXMNp6fp30MZlzndIY9jv9qu3EWVNYDAtbTkorTnF/Pw
-SMafmDVqhKEEjw==
+MIICdgIBADANBgkqhkiG9w0BAQEFAASCAmAwggJcAgEAAoGBANQh/oM4NmwlJyu0
+9bXHxnitR5k6t9WdVWYzTJ9bynjoqPWTfTH/mo7iznLUrOXNaGZ3OT6xHLiJGtp+
+2ePiD++DcGJgB4EnnNpiLL8EUPuD0X8iOI5x07UzQHP19krjsSwKqDWfdLMQTk+O
+RTcPW+/62nSMF55FSwooqkoIMwllAgMBAAECgYBe/34/+1t74MOC8j4bEwURo9/t
+gfszoYrOAukscGni7aZEm7E0Q9hOZsm3aQCoxO0c/gVXyu8mwNeSw74GLIWflzy5
+wSOAT8NzPZzyDWOkwAYdLF7dgwVaxATwWlNtAQs92DnV5SGFkKokArweGeyR9v9m
+NTVAk5G9+1akLJ9uXQJBAPZe0yIgh3HqUW7k67WXN/NvzFgvOW4WS7DLV5OxdAV5
+fJwuP59gE1YistL5DslMapKGH6B8Vr816tpux1hp8UcCQQDcbJa8V9Dit4Y1+xP7
+l9KxIKS3JJdeV8T2g7EcYGQk5QxXO8JIwzE4A5q8OJFYjjEf63myxBgpWYC118w9
+/mXzAkBVUPsee1NMMI+orl+tz8MRayrBcwEZTWFCxPf77ly2NJ7hWuavY07u6i8w
+/gyPywWw3f9/zO8hYiOFJw2jYXSrAkBAgXq/VYeowYKCS572cuDSuzXY7tlpX5Ah
+gDqVjlPgRDOPV8qslorR1KQ0zu0iGEKiD7xGp4JWn32+OY/o2IknAkEAnjIMK0CQ
+T2MkwIyUvSM7KYFFHlqj8CxNfX6+6yQqcBd+xV970BZs3Y9AkidgGBkotmSydnQe
+0NhRj4RzqjjETg==
 -----END PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.org/CA/OCSP.p12 b/test/aux-fixed/exim-ca/example.org/CA/OCSP.p12
index fac3ec48e..845f17631 100644
--- a/test/aux-fixed/exim-ca/example.org/CA/OCSP.p12
+++ b/test/aux-fixed/exim-ca/example.org/CA/OCSP.p12
diff --git a/test/aux-fixed/exim-ca/example.org/CA/OCSP.pem b/test/aux-fixed/exim-ca/example.org/CA/OCSP.pem
index 32d446240..961de931f 100644
--- a/test/aux-fixed/exim-ca/example.org/CA/OCSP.pem
+++ b/test/aux-fixed/exim-ca/example.org/CA/OCSP.pem
@@ -1,14 +1,14 @@
 -----BEGIN CERTIFICATE-----
-MIICDTCCAXagAwIBAgIBAzANBgkqhkiG9w0BAQsFADA3MRQwEgYDVQQKEwtleGFt
+MIICDTCCAXagAwIBAgIBQzANBgkqhkiG9w0BAQsFADA3MRQwEgYDVQQKEwtleGFt
 cGxlLm9yZzEfMB0GA1UEAxMWY2xpY2EgU2lnbmluZyBDZXJ0IHJzYTAeFw0xMjEx
-MDExMjM0MDJaFw0zODAxMDExMjM0MDJaMDYxFDASBgNVBAoTC2V4YW1wbGUub3Jn
+MDExMjM0MDhaFw0zODAxMDExMjM0MDhaMDYxFDASBgNVBAoTC2V4YW1wbGUub3Jn
 MR4wHAYDVQQDExVjbGljYSBPQ1NQIFNpZ25lciByc2EwgZ8wDQYJKoZIhvcNAQEB
-BQADgY0AMIGJAoGBALiViJBUHorb4RG/jrgpS3iOJlZ6ayVLd8IL+YslLSO4a5ac
-RCSepJfkTrik3nzLe/ZXWz3VfbUd0AJrWDCL7rtYx0LsxiqZ1WVBGziil5wU7egs
-kcXBpDVjGFBnYXqqRDrTDIvAvf5kCY8iJnI4YnAZTOI4mL1qYsGXtIAy6rjhAgMB
+BQADgY0AMIGJAoGBANQh/oM4NmwlJyu09bXHxnitR5k6t9WdVWYzTJ9bynjoqPWT
+fTH/mo7iznLUrOXNaGZ3OT6xHLiJGtp+2ePiD++DcGJgB4EnnNpiLL8EUPuD0X8i
+OI5x07UzQHP19krjsSwKqDWfdLMQTk+ORTcPW+/62nSMF55FSwooqkoIMwllAgMB
 AAGjKjAoMA4GA1UdDwEB/wQEAwIHgDAWBgNVHSUBAf8EDDAKBggrBgEFBQcDCTAN
-BgkqhkiG9w0BAQsFAAOBgQBJRBZ/AnWUjALF5lLFmikzKRZ/HYBL9NhNAFqiXfe5
-bJSUaPZQARdnAy/o7g01pSM4sDLQvvlkzntzxJTduXd0JvBcNKylexSg50hOSp1M
-XxFuJLAnP2b3N6qhAvGvwEgI/fwUK9jYKRYBbJnGWxJophW6uFaAYQnctSeqrew0
-/g==
+BgkqhkiG9w0BAQsFAAOBgQBdQH1764yjd709o2r/hmxCyVshZRW83BtI20uys/e9
+eWbp3VSHWbPuuNkjMBIuYMXSSD9C+Psv+IQ8V0jYyWbhLC7+j02fFBsRXr5/BIKj
+L9PM/q3/FLm+dLrq00M/o0yg9jX+1ALU3NhNe7DUjO9ncFoUxkiKorf1XptZ81Ab
++g==
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.org/CA/Signer.key b/test/aux-fixed/exim-ca/example.org/CA/Signer.key
index 45a71f094..51b15d3dc 100644
--- a/test/aux-fixed/exim-ca/example.org/CA/Signer.key
+++ b/test/aux-fixed/exim-ca/example.org/CA/Signer.key
@@ -1,20 +1,20 @@
 Bag Attributes
     friendlyName: Signing Cert rsa
-    localKeyID: 57 22 42 CA 16 F3 3D D7 FE 71 12 9C 02 B5 FE A6 36 46 4F BC 
+    localKeyID: 83 92 A6 8E 10 1E B8 76 A6 DE E9 A7 BB EC 9C 44 19 0C 29 A3 
 Key Attributes: <No Attributes>
 -----BEGIN PRIVATE KEY-----
-MIICdgIBADANBgkqhkiG9w0BAQEFAASCAmAwggJcAgEAAoGBAJXe07nxVSZPJ3rV
-BHQp+m5gWb5/JkzXwcWKEvcmMnJzo2ydVfHBBRmTpzpSST3js2awNbhEdOU7AeBt
-AvyOtwlT/yp6SHhOlI8PlgLwL9/xedeC0Ex412VOeaV/LRbvj0j+WutuglAFXfD5
-IlwnRoDUB1Q51JFtYZxlxvOqbLb9AgMBAAECgYAfeOAoe5QAi/3D7yjUxh33gNdH
-yEbAO0zPUVwDN6u/WiZXAEFUl86c3ONwvWfxDbiWV2mojQOpQbd2rB3E8KliA0/Z
-d2hi8jMNXCX0IHwgwo/rCNIQ86TeiyN/6gWUKIjH/+/ll0lgfma0Noe+Sab3Q1R5
-RS7TP+OauhdKWfJshwJBAMe0Cv3BXdbMsaUI+D5o/HvlVjmEsBhHBNldStRcuka9
-F+Tft59eTdXfl3RZxbtywctCbjEzaeqDu0JWYU+SLjsCQQDAHoCuvp8hbKJFDeM+
-BpfjWikL9xAhBn3KoRnlr+PcVqHY2mJyy5UJkjkXodEN6fUtU1YAS1tzhfx867tW
-oEQnAkBm/3P/xqBobbBdpw+p2KoIGJNtHQNZsh9NIHG8r4qfe118fOoOtyu72BMc
-PkTeVeSfucZtd8/z1TdakoSj7ogLAkEAljbDUt5EufOgpPGI3jR1ihQyx+IzQD89
-F7QC9a4jMWKjRVTraOp463TjIvEo7gIh64CfW7eQF7GJi3sdjUvePQJAWyeVm67R
-OGIjTsTgut0/fviuEB1nWtXg5sh8LsEymg1jVOxKMc8oN8TFOAGBVplHOjMUhxZI
-ngDQZEDpSs5+9A==
+MIICdwIBADANBgkqhkiG9w0BAQEFAASCAmEwggJdAgEAAoGBAKvNwx4xa7WCNqEV
+Zytf9wBSqEyyJGZrzauZyQleeD564JHoYpfqgi/WiTjebOF+sPAK9x+o+sBYwUu2
+27LUaYgotqqcbhY8kr5lnUQt8il52dstsqcVKpwPG1uQvmTv5J5W9WjF38aHEpFH
+JL1l8SmC7Og318AbGNuY2b5VmVFbAgMBAAECgYAyPvBkwTFuGVIe1GKjBeL4XjRI
+kgUhS0AQgt6P9egW5dsN8Tf8lCJVGVpynmKbpHDdE2fpA4Oqg4qsuSMR7xuZstHW
+AIWjF2feAe96xG78w5OkjzxJEcnfA+0FSJs5yF2QSt/nEaahAfhBhZZgo4kweKN5
+tDPofvHrUnB8vttIsQJBAOCFBo7P2rPCwDfBUo3z+9WntUKFVvAfU6J9PPONMNvs
+4ZGYjalXnZtgYBtvFn/ZNnhrgWn7ETJyQFijMB4tbuMCQQDD5ImQGbrfakrmegT+
+JQdyvtdpeeTaRr9rDfLxpovtgqW5ug6Nb8acQz+H5WJh14S/QcEY0p3a0k3+RpE3
+kWUpAkEAx1p2gzHd4AVJhXgbZD3CW2hJEqKwmg9GxJ1tFFhGjNBdTVjmV/ma0M6X
+J2TQ1n441l2mkELEd0VpCwsC+5idvwJASTUjY8L533ytuSxoqUHVYsCHaFexexFt
+f+iankyLhpuIq7worBrVspg/Kd5DwiT06zT7oPc1Hw3xL9HXe1jO4QJBAKTt0EOi
+dYyPR6vB+NxigHUzIXJfkibRMYOSzC9e8SkLCDif2uEA4+zeNWpcj7zTUYh3zdGr
+O34iyBA7P+OhnMA=
 -----END PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.org/CA/Signer.p12 b/test/aux-fixed/exim-ca/example.org/CA/Signer.p12
index 37f7f7e79..924aa9a16 100644
--- a/test/aux-fixed/exim-ca/example.org/CA/Signer.p12
+++ b/test/aux-fixed/exim-ca/example.org/CA/Signer.p12
diff --git a/test/aux-fixed/exim-ca/example.org/CA/Signer.pem b/test/aux-fixed/exim-ca/example.org/CA/Signer.pem
index 0939297fe..6f2d4d15c 100644
--- a/test/aux-fixed/exim-ca/example.org/CA/Signer.pem
+++ b/test/aux-fixed/exim-ca/example.org/CA/Signer.pem
@@ -1,14 +1,14 @@
 -----BEGIN CERTIFICATE-----
-MIICNDCCAZ2gAwIBAgIBAjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
-cGxlLm9yZzEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwMloX
-DTM4MDEwMTEyMzQwMlowNzEUMBIGA1UEChMLZXhhbXBsZS5vcmcxHzAdBgNVBAMT
+MIICGDCCAYGgAwIBAgIBQjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+cGxlLm9yZzEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwOFoX
+DTM4MDEwMTEyMzQwOFowNzEUMBIGA1UEChMLZXhhbXBsZS5vcmcxHzAdBgNVBAMT
 FmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
-AoGBAJXe07nxVSZPJ3rVBHQp+m5gWb5/JkzXwcWKEvcmMnJzo2ydVfHBBRmTpzpS
-ST3js2awNbhEdOU7AeBtAvyOtwlT/yp6SHhOlI8PlgLwL9/xedeC0Ex412VOeaV/
-LRbvj0j+WutuglAFXfD5IlwnRoDUB1Q51JFtYZxlxvOqbLb9AgMBAAGjWjBYMA4G
-A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMDIGA1UdHwQrMCkwJ6Al
-oCOGIWh0dHA6Ly9jcmwuZXhhbXBsZS5vcmcvbGF0ZXN0LmNybDANBgkqhkiG9w0B
-AQsFAAOBgQCf9uWkJrIlu9DvKwiiRj6/vMFydd9kLq11COjAovfD6+VbRLeX1lpC
-XpHDhUlrAKOV/5Virl+iXao5YnfnCm1oud0jRGcG8x1JPqUKW3REch4vR0wkjaBS
-5eI7DiydPL1yts588Z6gLjHZBaR0cuXS4e1k9rcXuBC9tZjv7rYskQ==
+AoGBAKvNwx4xa7WCNqEVZytf9wBSqEyyJGZrzauZyQleeD564JHoYpfqgi/WiTje
+bOF+sPAK9x+o+sBYwUu227LUaYgotqqcbhY8kr5lnUQt8il52dstsqcVKpwPG1uQ
+vmTv5J5W9WjF38aHEpFHJL1l8SmC7Og318AbGNuY2b5VmVFbAgMBAAGjPjA8MA4G
+A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMBYGA1UdDgQPBA1BQWJ0
+d0N4Y1hnYjBRMA0GCSqGSIb3DQEBCwUAA4GBAGtwA01/eJwFs17LhHpVC+LTlxFO
+NC8rQCNXWLlt6S9v+ueuO+E5k5s1TXnQ9iB9eZbMXz6tGEuiiS5zDhUTf2kLt55U
+b2pjpDg4doh9h778ss+Yz5ASKg0vqQ0E9yHY1FzJBqxcPHl2BnkcCml9fDW9oI0v
+tzM43Bo0kuWzn62i
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.org/CA/ca.conf b/test/aux-fixed/exim-ca/example.org/CA/ca.conf
index 84a452b99..bdcb3250f 100644
--- a/test/aux-fixed/exim-ca/example.org/CA/ca.conf
+++ b/test/aux-fixed/exim-ca/example.org/CA/ca.conf
@@ -1,18 +1,18 @@
 ; Config::Simple 4.59
-; Thu Nov  1 12:34:02 2012
+; Thu Nov  1 12:34:08 2012
+
+[CA]
+org=example.org
+name=Certificate Authority rsa
+subject=clica CA
+bits=1024
 
 [CLICA]
-ocsp_signer=OCSP Signer rsa
 signer=Signing Cert rsa
 sighash=SHA256
-crl_url=http://crl.example.org/latest.crl
-ocsp_url=http://oscp.example.org/
 level=1
-
-[CA]
-org=example.org
-bits=1024
-subject=clica CA
-name=Certificate Authority rsa
+ocsp_url=http://oscp.example.org/
+ocsp_signer=OCSP Signer rsa
+crl_url=http://crl.example.org/latest.crl
 
 
diff --git a/test/aux-fixed/exim-ca/example.org/CA/cert8.db b/test/aux-fixed/exim-ca/example.org/CA/cert8.db
index 0df961e63..1a73502be 100644
--- a/test/aux-fixed/exim-ca/example.org/CA/cert8.db
+++ b/test/aux-fixed/exim-ca/example.org/CA/cert8.db
diff --git a/test/aux-fixed/exim-ca/example.org/CA/crl.Signer b/test/aux-fixed/exim-ca/example.org/CA/crl.Signer
new file mode 100644
index 000000000..ea4346e9e
--- /dev/null
+++ b/test/aux-fixed/exim-ca/example.org/CA/crl.Signer
diff --git a/test/aux-fixed/exim-ca/example.org/CA/crl.Signer.in.txt b/test/aux-fixed/exim-ca/example.org/CA/crl.Signer.in.txt
new file mode 100644
index 000000000..8f00adf1e
--- /dev/null
+++ b/test/aux-fixed/exim-ca/example.org/CA/crl.Signer.in.txt
@@ -0,0 +1 @@
+update=20171217205108Z 
diff --git a/test/aux-fixed/exim-ca/example.org/CA/crl.Signer.pem b/test/aux-fixed/exim-ca/example.org/CA/crl.Signer.pem
new file mode 100644
index 000000000..c26ea229a
--- /dev/null
+++ b/test/aux-fixed/exim-ca/example.org/CA/crl.Signer.pem
@@ -0,0 +1,7 @@
+-----BEGIN X509 CRL-----
+MIHnMFICAQEwDQYJKoZIhvcNAQELBQAwLTEUMBIGA1UEChMLZXhhbXBsZS5vcmcx
+FTATBgNVBAMTDGNsaWNhIENBIHJzYRgPMjAxNzEyMTcyMDUxMDhaMA0GCSqGSIb3
+DQEBCwUAA4GBAEYHLxfKEuWn1m3X8VPNpfg86Bu0MKqMHdSQzlOcUyxayMyrC2Iu
+0ZcpDQ4fg0HJ/R1qcf7BwEXRE5PHXIQp88DJHgzUOPwvkdqkTjBfn3bdFkqSbOS1
+g99dqNxeyLTehd4tmPVMY4t0GfQ4SEky54g+7p3K2bWvNEBRFWY+9vAy
+-----END X509 CRL-----
diff --git a/test/aux-fixed/exim-ca/example.org/CA/crl.empty b/test/aux-fixed/exim-ca/example.org/CA/crl.empty
index 96d946c0a..4e5ff44b6 100644
--- a/test/aux-fixed/exim-ca/example.org/CA/crl.empty
+++ b/test/aux-fixed/exim-ca/example.org/CA/crl.empty
diff --git a/test/aux-fixed/exim-ca/example.org/CA/crl.empty.in.txt b/test/aux-fixed/exim-ca/example.org/CA/crl.empty.in.txt
index 5c3cda501..dc66bdfc9 100644
--- a/test/aux-fixed/exim-ca/example.org/CA/crl.empty.in.txt
+++ b/test/aux-fixed/exim-ca/example.org/CA/crl.empty.in.txt
@@ -1 +1 @@
-update=20171105161901Z 
+update=20171217205106Z 
diff --git a/test/aux-fixed/exim-ca/example.org/CA/crl.empty.pem b/test/aux-fixed/exim-ca/example.org/CA/crl.empty.pem
index efa2cc268..1d75d92ab 100644
--- a/test/aux-fixed/exim-ca/example.org/CA/crl.empty.pem
+++ b/test/aux-fixed/exim-ca/example.org/CA/crl.empty.pem
@@ -1,8 +1,8 @@
 -----BEGIN X509 CRL-----
 MIHxMFwCAQEwDQYJKoZIhvcNAQELBQAwNzEUMBIGA1UEChMLZXhhbXBsZS5vcmcx
-HzAdBgNVBAMTFmNsaWNhIFNpZ25pbmcgQ2VydCByc2EYDzIwMTcxMTA1MTYxOTAx
-WjANBgkqhkiG9w0BAQsFAAOBgQA8uBZdwLbNPmVSCrUO9zYyV1CW5pY/2qUKN0/A
-iJWf9MZj7dqGZ3itIG/APWCscJA4pEwPiV7sZEm6SzhLDfddEmcmfuu88etso945
-JXG/MC5SVf1RCih5e39Dp13PYwuDVbbGsrhc/K8GW4cZX7GUEa2Ce9O53TIfgP+D
-717JDQ==
+HzAdBgNVBAMTFmNsaWNhIFNpZ25pbmcgQ2VydCByc2EYDzIwMTcxMjE3MjA1MTA2
+WjANBgkqhkiG9w0BAQsFAAOBgQAD6koYS1ciWJWf9E1VErTJg1UkjIQ0SUPOAp6o
+cPjbKVXIxgPLSXowf89FB5RCQcLJznLQV2bzDWOaBAx6TijEsE9NjA+DPF83byGr
+j6om22/395FQEP0WuoIw9O3Gn+SekE+7IBxtMExR/oiJygLy2qSxhgxiPm7HiANG
+4TNxgA==
 -----END X509 CRL-----
diff --git a/test/aux-fixed/exim-ca/example.org/CA/crl.v2 b/test/aux-fixed/exim-ca/example.org/CA/crl.v2
index b83c8b71a..b17fe8ae0 100644
--- a/test/aux-fixed/exim-ca/example.org/CA/crl.v2
+++ b/test/aux-fixed/exim-ca/example.org/CA/crl.v2
diff --git a/test/aux-fixed/exim-ca/example.org/CA/crl.v2.in.txt b/test/aux-fixed/exim-ca/example.org/CA/crl.v2.in.txt
index 20311aa93..7c2dcd446 100644
--- a/test/aux-fixed/exim-ca/example.org/CA/crl.v2.in.txt
+++ b/test/aux-fixed/exim-ca/example.org/CA/crl.v2.in.txt
@@ -1,3 +1,3 @@
-update=20171105161903Z 
-addcert 102 20171105161903Z
-addcert 202 20171105161903Z
+update=20171217205108Z 
+addcert 102 20171217205108Z
+addcert 202 20171217205108Z
diff --git a/test/aux-fixed/exim-ca/example.org/CA/crl.v2.pem b/test/aux-fixed/exim-ca/example.org/CA/crl.v2.pem
index ab3ec93af..1d2e2f814 100644
--- a/test/aux-fixed/exim-ca/example.org/CA/crl.v2.pem
+++ b/test/aux-fixed/exim-ca/example.org/CA/crl.v2.pem
@@ -1,9 +1,9 @@
 -----BEGIN X509 CRL-----
 MIIBITCBiwIBATANBgkqhkiG9w0BAQsFADA3MRQwEgYDVQQKEwtleGFtcGxlLm9y
-ZzEfMB0GA1UEAxMWY2xpY2EgU2lnbmluZyBDZXJ0IHJzYRgPMjAxNzExMDUxNjE5
-MDNaMC0wFAIBZhgPMjAxNzExMDUxNjE5MDNaMBUCAgDKGA8yMDE3MTEwNTE2MTkw
-M1owDQYJKoZIhvcNAQELBQADgYEAYXKPoFWC81FyBxDjPGFfHqAtAJT2fSiPFUWj
-Cqx2UVGi1xTbaFLGH48bdSgkAl5E6LK9fWRSlBXxSGJjOuB6LMs/WvNDdb+SPZd+
-vggXSPh4pOrWuImMczoyb1MCBvLcLrdA3/A/Z/U/sep6GKIj8llUuSxM9kjjokPy
-XIyXQwk=
+ZzEfMB0GA1UEAxMWY2xpY2EgU2lnbmluZyBDZXJ0IHJzYRgPMjAxNzEyMTcyMDUx
+MDhaMC0wFAIBZhgPMjAxNzEyMTcyMDUxMDhaMBUCAgDKGA8yMDE3MTIxNzIwNTEw
+OFowDQYJKoZIhvcNAQELBQADgYEALlKpDn1wXQ4xFhTT4REKpe2o0AsxJVZgu8ox
+Xlh/0BeFBOy63mGXofjMxROa5Omrwqz8x78IP4SBeyQlVjEsXSKxdyB960stfTfb
+Bd8KSzeWMxdYlbQUpstSKDXgOqfKB8HZPEAT3FqdbleBndFwrWW3ia8Z7POMt32z
+SX0Qo7o=
 -----END X509 CRL-----
diff --git a/test/aux-fixed/exim-ca/example.org/CA/index.revoked.txt.attr b/test/aux-fixed/exim-ca/example.org/CA/index.revoked.txt.attr
new file mode 100644
index 000000000..8f7e63a34
--- /dev/null
+++ b/test/aux-fixed/exim-ca/example.org/CA/index.revoked.txt.attr
@@ -0,0 +1 @@
+unique_subject = yes
diff --git a/test/aux-fixed/exim-ca/example.org/CA/index.valid.txt.attr b/test/aux-fixed/exim-ca/example.org/CA/index.valid.txt.attr
new file mode 100644
index 000000000..8f7e63a34
--- /dev/null
+++ b/test/aux-fixed/exim-ca/example.org/CA/index.valid.txt.attr
@@ -0,0 +1 @@
+unique_subject = yes
diff --git a/test/aux-fixed/exim-ca/example.org/CA/key3.db b/test/aux-fixed/exim-ca/example.org/CA/key3.db
index 7e3d6b685..ef6a2c4d1 100644
--- a/test/aux-fixed/exim-ca/example.org/CA/key3.db
+++ b/test/aux-fixed/exim-ca/example.org/CA/key3.db
diff --git a/test/aux-fixed/exim-ca/example.org/CA/noise.file b/test/aux-fixed/exim-ca/example.org/CA/noise.file
index ffe9102b5..0f9a1627b 100644
--- a/test/aux-fixed/exim-ca/example.org/CA/noise.file
+++ b/test/aux-fixed/exim-ca/example.org/CA/noise.file
@@ -46,7 +46,7 @@ cpuid level	: 22
 wp		: yes
 flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc art arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf tsc_known_freq pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch cpuid_fault epb intel_pt tpr_shadow vnmi flexpriority ept vpid fsgsbase tsc_adjust bmi1 hle avx2 smep bmi2 erms invpcid rtm mpx rdseed adx smap clflushopt xsaveopt xsavec xgetbv1 xsaves dtherm ida arat pln pts hwp hwp_notify hwp_act_window hwp_epp
 bugs		:
-bogomips	: 5431.34
+bogomips	: 5424.00
 clflush size	: 64
 cache_alignment	: 64
 address sizes	: 39 bits physical, 48 bits virtual
@@ -73,7 +73,7 @@ cpuid level	: 22
 wp		: yes
 flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc art arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf tsc_known_freq pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch cpuid_fault epb intel_pt tpr_shadow vnmi flexpriority ept vpid fsgsbase tsc_adjust bmi1 hle avx2 smep bmi2 erms invpcid rtm mpx rdseed adx smap clflushopt xsaveopt xsavec xgetbv1 xsaves dtherm ida arat pln pts hwp hwp_notify hwp_act_window hwp_epp
 bugs		:
-bogomips	: 5431.79
+bogomips	: 5424.00
 clflush size	: 64
 cache_alignment	: 64
 address sizes	: 39 bits physical, 48 bits virtual
@@ -100,7 +100,7 @@ cpuid level	: 22
 wp		: yes
 flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc art arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf tsc_known_freq pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch cpuid_fault epb intel_pt tpr_shadow vnmi flexpriority ept vpid fsgsbase tsc_adjust bmi1 hle avx2 smep bmi2 erms invpcid rtm mpx rdseed adx smap clflushopt xsaveopt xsavec xgetbv1 xsaves dtherm ida arat pln pts hwp hwp_notify hwp_act_window hwp_epp
 bugs		:
-bogomips	: 5431.63
+bogomips	: 5424.00
 clflush size	: 64
 cache_alignment	: 64
 address sizes	: 39 bits physical, 48 bits virtual
@@ -127,7 +127,7 @@ cpuid level	: 22
 wp		: yes
 flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc art arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf tsc_known_freq pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch cpuid_fault epb intel_pt tpr_shadow vnmi flexpriority ept vpid fsgsbase tsc_adjust bmi1 hle avx2 smep bmi2 erms invpcid rtm mpx rdseed adx smap clflushopt xsaveopt xsavec xgetbv1 xsaves dtherm ida arat pln pts hwp hwp_notify hwp_act_window hwp_epp
 bugs		:
-bogomips	: 5434.63
+bogomips	: 5424.00
 clflush size	: 64
 cache_alignment	: 64
 address sizes	: 39 bits physical, 48 bits virtual
@@ -154,7 +154,7 @@ cpuid level	: 22
 wp		: yes
 flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc art arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf tsc_known_freq pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch cpuid_fault epb intel_pt tpr_shadow vnmi flexpriority ept vpid fsgsbase tsc_adjust bmi1 hle avx2 smep bmi2 erms invpcid rtm mpx rdseed adx smap clflushopt xsaveopt xsavec xgetbv1 xsaves dtherm ida arat pln pts hwp hwp_notify hwp_act_window hwp_epp
 bugs		:
-bogomips	: 5432.00
+bogomips	: 5424.00
 clflush size	: 64
 cache_alignment	: 64
 address sizes	: 39 bits physical, 48 bits virtual
@@ -181,7 +181,7 @@ cpuid level	: 22
 wp		: yes
 flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc art arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf tsc_known_freq pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch cpuid_fault epb intel_pt tpr_shadow vnmi flexpriority ept vpid fsgsbase tsc_adjust bmi1 hle avx2 smep bmi2 erms invpcid rtm mpx rdseed adx smap clflushopt xsaveopt xsavec xgetbv1 xsaves dtherm ida arat pln pts hwp hwp_notify hwp_act_window hwp_epp
 bugs		:
-bogomips	: 5431.94
+bogomips	: 5424.00
 clflush size	: 64
 cache_alignment	: 64
 address sizes	: 39 bits physical, 48 bits virtual
@@ -208,85 +208,86 @@ cpuid level	: 22
 wp		: yes
 flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc art arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf tsc_known_freq pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch cpuid_fault epb intel_pt tpr_shadow vnmi flexpriority ept vpid fsgsbase tsc_adjust bmi1 hle avx2 smep bmi2 erms invpcid rtm mpx rdseed adx smap clflushopt xsaveopt xsavec xgetbv1 xsaves dtherm ida arat pln pts hwp hwp_notify hwp_act_window hwp_epp
 bugs		:
-bogomips	: 5431.94
+bogomips	: 5424.00
 clflush size	: 64
 cache_alignment	: 64
 address sizes	: 39 bits physical, 48 bits virtual
 power management:
 
             CPU0       CPU1       CPU2       CPU3       CPU4       CPU5       CPU6       CPU7       
-   0:         70          0          0          0          0          0          0          0  IR-IO-APIC    2-edge      timer
-   1:         39      16476       1416       1089       6857       1983       1674       1959  IR-IO-APIC    1-edge      i8042
-   8:          0          0          1          0          0          0          0          0  IR-IO-APIC    8-edge      rtc0
-   9:        284       4834       2265       1628       7027       2758       1632       1695  IR-IO-APIC    9-fasteoi   acpi
-  12:        273    1626151      37392      40715     288530      39254      36081      51183  IR-IO-APIC   12-edge      i8042
-  16:          1          0          0          0          0          0          0          0  IR-IO-APIC   16-fasteoi   i801_smbus
+   0:         75          0          0          0          0          0          0          0  IR-IO-APIC    2-edge      timer
+   1:      69767       6441       4183       4351       8821       6710       4808       2655  IR-IO-APIC    1-edge      i8042
+   8:          1          0          0          0          0          0          0          0  IR-IO-APIC    8-edge      rtc0
+   9:     116952      16080      12437      10549      27759      16386      11560       7036  IR-IO-APIC    9-fasteoi   acpi
+  12:    5146732     362636     240016     241533     534196     383274     265445     167959  IR-IO-APIC   12-edge      i8042
+  16:          3          0          0          0          0          0          0          0  IR-IO-APIC   16-fasteoi   i801_smbus
  120:          0          0          0          0          0          0          0          0  DMAR-MSI    0-edge      dmar0
  121:          0          0          0          0          0          0          0          0  DMAR-MSI    1-edge      dmar1
- 122:       7136       3040       2312       1908       4546       3822      75927       2347  IR-PCI-MSI 376832-edge      ahci[0000:00:17.0]
- 123:         22          7          1          0          7          3          4          1  IR-PCI-MSI 327680-edge      xhci_hcd
- 124:         89         19         22         25         79         55         27         54  IR-PCI-MSI 2097152-edge      rtsx_pci
- 125:         88         15     127557         11         48         25         19         21  IR-PCI-MSI 520192-edge      enp0s31f6
- 126:          1          1          1          0          3          1          3          6  IR-PCI-MSI 1048576-edge    
- 127:        561        174         98     789036        240        230        184        147  IR-PCI-MSI 32768-edge      i915
- 128:         34         14          0          0          1          0          0          0  IR-PCI-MSI 360448-edge      mei_me
- 129:         22         10          0          1         10          0          0          0  IR-PCI-MSI 1572864-edge      iwlwifi
- 130:         92        103         30         22        194        115         10         45  IR-PCI-MSI 514048-edge      snd_hda_intel:card0
- NMI:          9         12          9         14         10          9          9         10   Non-maskable interrupts
- LOC:     567091     554090     726169    1033887     583159     591752     623530     548535   Local timer interrupts
+ 122:      40662       2645       2048    8326162       3083       2651       2210       2042  IR-PCI-MSI 376832-edge      ahci[0000:00:17.0]
+ 123:         50          3          7          1          9          3          5          0  IR-PCI-MSI 327680-edge      xhci_hcd
+ 124:        269         24         28         20        104        171         22         48  IR-PCI-MSI 2097152-edge      rtsx_pci
+ 125:         38          0          0          0          0         10          0          4  IR-PCI-MSI 360448-edge      mei_me
+ 126:          2          0          3          0          1          2         24          0  IR-PCI-MSI 1048576-edge    
+ 127:       2247         56         54         23    3781445         37         26         18  IR-PCI-MSI 32768-edge      i915
+ 128:         77          0          0          0          2         32          8          1  IR-PCI-MSI 514048-edge      snd_hda_intel:card0
+ 129:         18          2          0          4          8          0          4      24684  IR-PCI-MSI 1572864-edge      iwlwifi
+ 130:        658          1          0          0          0          8          5   13518732  IR-PCI-MSI 520192-edge      enp0s31f6
+ NMI:        607       2648       2620       2522       2484       2423       2424       2470   Non-maskable interrupts
+ LOC:   29009682   29903290   29748276   28947320   29021017   28514836   28466147   28814163   Local timer interrupts
  SPU:          0          0          0          0          0          0          0          0   Spurious interrupts
- PMI:          9         12          9         14         10          9          9         10   Performance monitoring interrupts
- IWI:          0          1          0          0          0          0          2          0   IRQ work interrupts
- RTR:          7          0          0          0          0          0          0          0   APIC ICR read retries
- RES:      85537      31040      11902       8295       7457       6904       6399       5894   Rescheduling interrupts
- CAL:      73161      74171      68751      70654      80168      75208      61391      70903   Function call interrupts
- TLB:      55150      56119      50377      53791      62195      57072      43366      55765   TLB shootdowns
- TRM:          0          0          0          0          0          0          0          0   Thermal event interrupts
+ PMI:        607       2648       2620       2522       2484       2423       2424       2470   Performance monitoring interrupts
+ IWI:          6          4          3          2         10          4          3          1   IRQ work interrupts
+ RTR:         18          0          0          0          0          0          0          0   APIC ICR read retries
+ RES:    7884861    3950261    2714667    2193280    2472671    1957554    1665074    1987836   Rescheduling interrupts
+ CAL:     987280     866818     901402     885321     915796     938469     935939     966658   Function call interrupts
+ TLB:     231515     195523     218511     215448     205507     204323     194087     201584   TLB shootdowns
+ TRM:    1627310    1627310    1627310    1627310    1627310    1627310    1627310    1627310   Thermal event interrupts
  THR:          0          0          0          0          0          0          0          0   Threshold APIC interrupts
  DFR:          0          0          0          0          0          0          0          0   Deferred Error APIC interrupts
  MCE:          0          0          0          0          0          0          0          0   Machine check exceptions
- MCP:         49         49         49         49         49         49         49         49   Machine check polls
+ MCP:        202        200        200        200        200        200        200        200   Machine check polls
+ HYP:          0          0          0          0          0          0          0          0   Hypervisor callback interrupts
  ERR:          0
  MIS:          0
  PIN:          0          0          0          0          0          0          0          0   Posted-interrupt notification event
  NPI:          0          0          0          0          0          0          0          0   Nested posted-interrupt event
  PIW:          0          0          0          0          0          0          0          0   Posted-interrupt wakeup event
-MemTotal:       15852528 kB
-MemFree:        10535556 kB
-MemAvailable:   12483484 kB
-Buffers:          128136 kB
-Cached:          1542080 kB
-SwapCached:            0 kB
-Active:          3133764 kB
-Inactive:        1816968 kB
-Active(anon):    2706480 kB
-Inactive(anon):    79680 kB
-Active(file):     427284 kB
-Inactive(file):  1737288 kB
-Unevictable:          32 kB
-Mlocked:              32 kB
-SwapTotal:       7933948 kB
-SwapFree:        7933948 kB
-Dirty:              2536 kB
-Writeback:             0 kB
-AnonPages:       2975436 kB
-Mapped:           494980 kB
-Shmem:             80740 kB
-Slab:             143696 kB
-SReclaimable:      74480 kB
-SUnreclaim:        69216 kB
-KernelStack:        9184 kB
-PageTables:        38812 kB
+MemTotal:       16293504 kB
+MemFree:          935960 kB
+MemAvailable:   13705244 kB
+Buffers:          452216 kB
+Cached:         12441244 kB
+SwapCached:       101680 kB
+Active:          2599204 kB
+Inactive:       12195644 kB
+Active(anon):    1355808 kB
+Inactive(anon):   588700 kB
+Active(file):    1243396 kB
+Inactive(file): 11606944 kB
+Unevictable:          64 kB
+Mlocked:              64 kB
+SwapTotal:       8212476 kB
+SwapFree:        7376112 kB
+Dirty:              9740 kB
+Writeback:             4 kB
+AnonPages:       1871100 kB
+Mapped:           415996 kB
+Shmem:            290116 kB
+Slab:             351256 kB
+SReclaimable:     257264 kB
+SUnreclaim:        93992 kB
+KernelStack:       12848 kB
+PageTables:        58476 kB
 NFS_Unstable:          0 kB
 Bounce:                0 kB
 WritebackTmp:          0 kB
-CommitLimit:    15860212 kB
-Committed_AS:   11690812 kB
+CommitLimit:    16359228 kB
+Committed_AS:    7879004 kB
 VmallocTotal:   34359738367 kB
 VmallocUsed:           0 kB
 VmallocChunk:          0 kB
 HardwareCorrupted:     0 kB
-AnonHugePages:    966656 kB
+AnonHugePages:         0 kB
 ShmemHugePages:        0 kB
 ShmemPmdMapped:        0 kB
 CmaTotal:              0 kB
@@ -296,15 +297,14 @@ HugePages_Free:        0
 HugePages_Rsvd:        0
 HugePages_Surp:        0
 Hugepagesize:       2048 kB
-DirectMap4k:      202752 kB
-DirectMap2M:     7602176 kB
-DirectMap1G:     9437184 kB
+DirectMap4k:      523752 kB
+DirectMap2M:    16115712 kB
+DirectMap1G:     1048576 kB
 Inter-|   Receive                                                |  Transmit
  face |bytes    packets errs drop fifo frame compressed multicast|bytes    packets errs drop fifo colls carrier compressed
-virbr1:  353867    2838    0    0    0     0          0         0  1474230    3810    0    0    0     0       0          0
-enp0s31f6: 43448732   65083    0    0    0     0          0      2074  6948879   57082    0    0    0     0       0          0
-virbr1-nic:       0       0    0    0    0     0          0         0        0       0    0    0    0     0       0          0
-tun_wizint: 4130741    7381    0    0    0     0          0         0  1092175    8002    0    0    0     0       0          0
-    lo:    5706      74    0    0    0     0          0         0     5706      74    0    0    0     0       0          0
- vnet0:  393599    2838    0    0    0     0          0         0  1609950    6362    0    0    0     0       0          0
-wlp3s0:       0       0    0    0    0     0          0         0        0       0    0    0    0     0       0          0
+enp0s31f6: 9760813034 13664519    0    0    0     0          0      8964 118421391088 83833279    0    0    0     0       0          0
+wlp3s0: 3643580    7768    0    0    0     0          0         0  4732829    8244    0    0    0     0       0          0
+    lo: 9996035   41708    0    0    0     0          0         0  9996035   41708    0    0    0     0       0          0
+virbr0-nic:       0       0    0    0    0     0          0         0        0       0    0    0    0     0       0          0
+  tun0: 20139404   21860    0    0    0     0          0         0  3370846   19686    0    0    0     0       0          0
+virbr0: 47538577  146404    0    0    0     0          0         0 164360816  210422    0    0    0     0       0          0
diff --git a/test/aux-fixed/exim-ca/example.org/expired1.example.org/ca_chain.pem b/test/aux-fixed/exim-ca/example.org/expired1.example.org/ca_chain.pem
index f262d8f92..c9cf7dcd9 100644
--- a/test/aux-fixed/exim-ca/example.org/expired1.example.org/ca_chain.pem
+++ b/test/aux-fixed/exim-ca/example.org/expired1.example.org/ca_chain.pem
@@ -3,33 +3,33 @@ Bag Attributes
 subject=/O=example.org/CN=clica Signing Cert rsa
 issuer=/O=example.org/CN=clica CA rsa
 -----BEGIN CERTIFICATE-----
-MIICNDCCAZ2gAwIBAgIBAjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
-cGxlLm9yZzEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwMloX
-DTM4MDEwMTEyMzQwMlowNzEUMBIGA1UEChMLZXhhbXBsZS5vcmcxHzAdBgNVBAMT
+MIICGDCCAYGgAwIBAgIBQjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+cGxlLm9yZzEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwOFoX
+DTM4MDEwMTEyMzQwOFowNzEUMBIGA1UEChMLZXhhbXBsZS5vcmcxHzAdBgNVBAMT
 FmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
-AoGBAJXe07nxVSZPJ3rVBHQp+m5gWb5/JkzXwcWKEvcmMnJzo2ydVfHBBRmTpzpS
-ST3js2awNbhEdOU7AeBtAvyOtwlT/yp6SHhOlI8PlgLwL9/xedeC0Ex412VOeaV/
-LRbvj0j+WutuglAFXfD5IlwnRoDUB1Q51JFtYZxlxvOqbLb9AgMBAAGjWjBYMA4G
-A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMDIGA1UdHwQrMCkwJ6Al
-oCOGIWh0dHA6Ly9jcmwuZXhhbXBsZS5vcmcvbGF0ZXN0LmNybDANBgkqhkiG9w0B
-AQsFAAOBgQCf9uWkJrIlu9DvKwiiRj6/vMFydd9kLq11COjAovfD6+VbRLeX1lpC
-XpHDhUlrAKOV/5Virl+iXao5YnfnCm1oud0jRGcG8x1JPqUKW3REch4vR0wkjaBS
-5eI7DiydPL1yts588Z6gLjHZBaR0cuXS4e1k9rcXuBC9tZjv7rYskQ==
+AoGBAKvNwx4xa7WCNqEVZytf9wBSqEyyJGZrzauZyQleeD564JHoYpfqgi/WiTje
+bOF+sPAK9x+o+sBYwUu227LUaYgotqqcbhY8kr5lnUQt8il52dstsqcVKpwPG1uQ
+vmTv5J5W9WjF38aHEpFHJL1l8SmC7Og318AbGNuY2b5VmVFbAgMBAAGjPjA8MA4G
+A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMBYGA1UdDgQPBA1BQWJ0
+d0N4Y1hnYjBRMA0GCSqGSIb3DQEBCwUAA4GBAGtwA01/eJwFs17LhHpVC+LTlxFO
+NC8rQCNXWLlt6S9v+ueuO+E5k5s1TXnQ9iB9eZbMXz6tGEuiiS5zDhUTf2kLt55U
+b2pjpDg4doh9h778ss+Yz5ASKg0vqQ0E9yHY1FzJBqxcPHl2BnkcCml9fDW9oI0v
+tzM43Bo0kuWzn62i
 -----END CERTIFICATE-----
 Bag Attributes
     friendlyName: Certificate Authority rsa
 subject=/O=example.org/CN=clica CA rsa
 issuer=/O=example.org/CN=clica CA rsa
 -----BEGIN CERTIFICATE-----
-MIIB9jCCAV+gAwIBAgIBATANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
-cGxlLm9yZzEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwMloX
-DTM4MDEwMTEyMzQwMlowLTEUMBIGA1UEChMLZXhhbXBsZS5vcmcxFTATBgNVBAMT
-DGNsaWNhIENBIHJzYTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAsOI8xlyV
-2kpju6cf0E8/c0QwaOBvUGzkTdCau/DyQrwFPToVpVW8mzDQUOnoUXLl92EJa4Td
-a4uN/uyiyTcjUQWrlZKdFn9HaLB7+rLUox6fZF06jsWgC0Qfr3HHWsrMINn6bucC
-9/eZag5ADPyO5XYnCW4pIFnuFVQ+w3Qr060CAwEAAaMmMCQwEgYDVR0TAQH/BAgw
-BgEB/wIBATAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADgYEALAPJGCfj
-ldkldb3pxmUf8V2luI38AVKNZokjATe3tyv7ikhb2g20BRi92fMHOqfAMUfoJKAu
-lT5vLep0SUETmAXdr3+WfFeZu2KZ9t5lhxyUGnHhxDc3k8TzobZSpFS9+ZnR/4GY
-TwGhx36iRUIFRZ/PUQrkRniedLSkO+H+Xko=
+MIIB9jCCAV+gAwIBAgIBQTANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+cGxlLm9yZzEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwOFoX
+DTM4MDEwMTEyMzQwOFowLTEUMBIGA1UEChMLZXhhbXBsZS5vcmcxFTATBgNVBAMT
+DGNsaWNhIENBIHJzYTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAw4JFjAQr
+oK/87+wzLtvmEa5eQc7oZPrzziKz8EnH8bT2chPEUO1rt+7O9yxWZGyH7JkSw399
+bBu9Kw5xsxqvWrXYUQ0OPj1tuf8/tXc1FCtCYSLVp2vV2It+xfqQdoFHUxgK0dSz
+sYCPYPpaPag/x7h3lWfvhZfMxdDMOSBR6VMCAwEAAaMmMCQwEgYDVR0TAQH/BAgw
+BgEB/wIBATAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADgYEAJ+FVy3d0
+Bz1nk9xcA8rTGhx4sITmI0R1ccjOMlghQErpJx2pYEZ79osrZyOAIuOGSA/g1JFf
+n4llCc6vTbKjR/VUR8wWPmMttDK08YU0Nt9QJNHH1Okl/lpVQxDvHuMQMZ4tP8hJ
+Mu1lg0IENm5gyQ2y91p3m5YNX2kI7SiViUg=
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.org/expired1.example.org/cert8.db b/test/aux-fixed/exim-ca/example.org/expired1.example.org/cert8.db
index 21f26241e..373627491 100644
--- a/test/aux-fixed/exim-ca/example.org/expired1.example.org/cert8.db
+++ b/test/aux-fixed/exim-ca/example.org/expired1.example.org/cert8.db
diff --git a/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.chain.pem b/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.chain.pem
index 6d101731c..cc9c7a5f7 100644
--- a/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.chain.pem
+++ b/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.chain.pem
@@ -1,35 +1,35 @@
 Bag Attributes
     friendlyName: expired1.example.org
-    localKeyID: C0 42 EE F9 5E E5 53 45 FD 79 A4 AC 05 EC 40 D5 63 4D 07 CE 
+    localKeyID: 90 42 F6 BB C9 D1 AC 51 79 53 4E E0 F2 44 CD B0 FD 03 25 A6 
 subject=/CN=expired1.example.org
 issuer=/O=example.org/CN=clica Signing Cert rsa
 -----BEGIN CERTIFICATE-----
 MIICjTCCAfagAwIBAgIBZzANBgkqhkiG9w0BAQsFADA3MRQwEgYDVQQKEwtleGFt
 cGxlLm9yZzEfMB0GA1UEAxMWY2xpY2EgU2lnbmluZyBDZXJ0IHJzYTAeFw0xMjEx
-MDExMjM0MDJaFw0xMjEyMDExMjM0MDJaMB8xHTAbBgNVBAMTFGV4cGlyZWQxLmV4
-YW1wbGUub3JnMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCueZ0F7/IW0RMT
-3iSkesPfszC/A1LWajEbbJEWxRGME3LvwfMHuayw7WP5dIfi3SGD+mmc0awR2Iio
-bEgNsuba3x3H8J9np91boXmjSwyutq4KoqXEaS3sXvcj7FGTvskfNikIEJ4eFTKp
-XjiA+PwR2Ri2VFsnxuk7f/5aoHd8HwIDAQABo4HAMIG9MA4GA1UdDwEB/wQEAwIE
+MDExMjM0MTBaFw0xMjEyMDExMjM0MTBaMB8xHTAbBgNVBAMTFGV4cGlyZWQxLmV4
+YW1wbGUub3JnMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDF9YzUTezJJ8uz
+6B6rG+H8o72xbwqFhLpEUUXjcHR5jvQu4U5ITpX5ojFg0PV7cH4kJtAfVrijcHwe
+XtxYNB4XgrV1/9ndFu0NHLgdsS+C1Tu3h2b4jdcjyN/DXfRd3tIZOcYxaOhHgAz8
+zpb/TClKxDmP5UDmNmeMS/IZXXOOBwIDAQABo4HAMIG9MA4GA1UdDwEB/wQEAwIE
 8DAgBgNVHSUBAf8EFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwMgYDVR0fBCswKTAn
 oCWgI4YhaHR0cDovL2NybC5leGFtcGxlLm9yZy9sYXRlc3QuY3JsMDQGCCsGAQUF
 BwEBBCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29zY3AuZXhhbXBsZS5vcmcvMB8G
 A1UdEQQYMBaCFGV4cGlyZWQxLmV4YW1wbGUub3JnMA0GCSqGSIb3DQEBCwUAA4GB
-ADbKFUEs8pzPVlv1YaitfHIH3SXKUIxc2UfCB4y51Y1K6DCYMBUMG9vJjdhFaWj0
-ViMRJIlnYnCUXiEKyPvJNuAU1+C9W7/S349qF42X8+TdflF9fxLXjXms62tzezFh
-kJ2Ouwf+rNdj+5dQOLzlngRMSspVR1mf/4xmHepdqBZP
+ADiojtPPZXV9BMA0dh4i40Lws8MZpnm2to3OlTW4ekGhHB303SZtauGzHiP16kQd
+36f+5aVYB9c05lYznKiaCymdMUTzuvMBosUA9iYRs0yXJw6IeRpVOPks9FzEhDyv
+bXRF8cAqfrjWggfukQ7v22EiFDP42DEfeDKb+5Lal5UA
 -----END CERTIFICATE-----
 -----BEGIN CERTIFICATE-----
-MIICNDCCAZ2gAwIBAgIBAjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
-cGxlLm9yZzEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwMloX
-DTM4MDEwMTEyMzQwMlowNzEUMBIGA1UEChMLZXhhbXBsZS5vcmcxHzAdBgNVBAMT
+MIICGDCCAYGgAwIBAgIBQjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+cGxlLm9yZzEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwOFoX
+DTM4MDEwMTEyMzQwOFowNzEUMBIGA1UEChMLZXhhbXBsZS5vcmcxHzAdBgNVBAMT
 FmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
-AoGBAJXe07nxVSZPJ3rVBHQp+m5gWb5/JkzXwcWKEvcmMnJzo2ydVfHBBRmTpzpS
-ST3js2awNbhEdOU7AeBtAvyOtwlT/yp6SHhOlI8PlgLwL9/xedeC0Ex412VOeaV/
-LRbvj0j+WutuglAFXfD5IlwnRoDUB1Q51JFtYZxlxvOqbLb9AgMBAAGjWjBYMA4G
-A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMDIGA1UdHwQrMCkwJ6Al
-oCOGIWh0dHA6Ly9jcmwuZXhhbXBsZS5vcmcvbGF0ZXN0LmNybDANBgkqhkiG9w0B
-AQsFAAOBgQCf9uWkJrIlu9DvKwiiRj6/vMFydd9kLq11COjAovfD6+VbRLeX1lpC
-XpHDhUlrAKOV/5Virl+iXao5YnfnCm1oud0jRGcG8x1JPqUKW3REch4vR0wkjaBS
-5eI7DiydPL1yts588Z6gLjHZBaR0cuXS4e1k9rcXuBC9tZjv7rYskQ==
+AoGBAKvNwx4xa7WCNqEVZytf9wBSqEyyJGZrzauZyQleeD564JHoYpfqgi/WiTje
+bOF+sPAK9x+o+sBYwUu227LUaYgotqqcbhY8kr5lnUQt8il52dstsqcVKpwPG1uQ
+vmTv5J5W9WjF38aHEpFHJL1l8SmC7Og318AbGNuY2b5VmVFbAgMBAAGjPjA8MA4G
+A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMBYGA1UdDgQPBA1BQWJ0
+d0N4Y1hnYjBRMA0GCSqGSIb3DQEBCwUAA4GBAGtwA01/eJwFs17LhHpVC+LTlxFO
+NC8rQCNXWLlt6S9v+ueuO+E5k5s1TXnQ9iB9eZbMXz6tGEuiiS5zDhUTf2kLt55U
+b2pjpDg4doh9h778ss+Yz5ASKg0vqQ0E9yHY1FzJBqxcPHl2BnkcCml9fDW9oI0v
+tzM43Bo0kuWzn62i
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.key b/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.key
index f233cea98..46678dc74 100644
--- a/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.key
+++ b/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.key
@@ -1,21 +1,22 @@
 Bag Attributes
     friendlyName: expired1.example.org
-    localKeyID: C0 42 EE F9 5E E5 53 45 FD 79 A4 AC 05 EC 40 D5 63 4D 07 CE 
+    localKeyID: 90 42 F6 BB C9 D1 AC 51 79 53 4E E0 F2 44 CD B0 FD 03 25 A6 
 Key Attributes: <No Attributes>
 -----BEGIN ENCRYPTED PRIVATE KEY-----
-MIICxjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQItFoLVVYqyWMCAggA
-MBQGCCqGSIb3DQMHBAh2qL3MfztfBASCAoBeZgesYzG4byPUr9CZhwVLl7dQR3J/
-ftFIzD67jpGmyXG8eHz4PvxYzq3767Vn0ZGdLkZGY8XfZ7nwJZxrCa7UAYFkLFIT
-6O3iVL+BEoHABASMS5lFzeEoK7wZW0OP4DzEiXDb+AG2GcPAPv6Dzp4ctflzhj4h
-p3RKDBI0xj76YlQFX9SKpFd/dOCIa5KTIVigp9R4IbnSmgw3THckGNH25GtVeEp3
-jdDxmQjMMDgwP13HQz2A3d7dTSU4TzS3y/1QZ53Fenj7T3B/nalNWeeBJh6J+A1F
-eAJeyBVVvulbN+3/ju881m2VTYTjluTL8oEMww8FrWb7Dje4moeKTDOfzVa0hR8r
-Q5hFlbudhAG/vqNZWxvsSi3JJ9sUJqaXvPWXeKg9kBB1m1UxsF/VuvEmi60U15JJ
-rpD8MFKEztaD7JsBhu7kEKmZ4fxokFF9pJCWqPSWuEvyi2dGxfupAu34kubJMXi5
-FPnq7p9KPHqVkZ8cc1vEwmgVLi9MnYQcARbKB56BlyiJAXWU5e6UYlka3pchEp+O
-fCGa61zdeTFvEVPhtyQa8Bx7/OB2pgAOJJ3Pa9lBaFTTsUQF9CL9kuXVl4ZBo0k4
-xMyYKpbN9goSe25QKtEDeZIhuBB9myf/FKwwo0SKO+K0392rEthTiUvjA6FJ3DhK
-iEO24YZc5rNNX3qYnqFcmPSdcx/+/UvTCY2M6Q7dU1dcrAvM3JYfiU0T2ympgUjd
-tfef74DRRmlCt5OWKT/9sIq++CWvrKE7Pz4UqvGxWP7VszVu16DRP9S8bYTAU1iX
-JhUErfXvfsC7A8GTEXVG+UpPdUs94+qvWUILscWZP6L0+4IqOTe5wsfy
+MIIC1DBOBgkqhkiG9w0BBQ0wQTApBgkqhkiG9w0BBQwwHAQIZQtWztc7lo0CAggA
+MAwGCCqGSIb3DQIJBQAwFAYIKoZIhvcNAwcECFFLUbCqhj3eBIICgITbQ441dxkl
+xvMcRvv5T2DIQge76FnPKY+0bUYb7dsB1uZZQ3mKcD6GRiPFR4/x0F6KMzpMoL8Y
+225xxu3sdQwtjVivMVsPSuRHDJmqX0uUjv27oD1NOAfQOZiZlFu4x9h7odsA00ML
+1ryw5BUbvz4hfBsDRBTU2yzB/0fCm0qgMb5ak2aHqiR21Ad8ha14Y/1E0LXnGmbK
+b27eWqzuegRGSij5V4COhY17QB2nKhqmi1Y3uVC7KSuSBWNpz1fFpN+UpNZXJwAp
+iyWqHpl8rD/juJ3BKCzvhM1fOFkBkm8YWxb2KJMCILnRu9ucOy7ZpLeyBEn1Jua+
+Z47kGqoNauKLMMOZFBreRrudvH1yqtI1SxZJLftCMQ8yAH4eDxLrw7bxc4LJ14No
+0oZiW3SHcwNU03GZ3wQCg5SggKeRJOeymkMQsYqkdySyn1IV83051V/1oMMsWluf
+A1oxp8u2l5mvMFJ/B9CiIwTFOcUW6QvL9F+/bpKSUVbTqVhF5ndZLbZBDe7GMwZs
+cieGYGZiqzz5WxK5Im+BP1IChPAKvkr5Sd4UZv+vrY0IsLjX9BT9yGrRQPnVy73S
+NAym0O4y8snl2MUzTn6+XFvsW7xTh5CnmKKkDxsORdwb25Rw2wqN+94BubBH3IrV
+mjOlHCUeomx7VAouR6xiZmJi33gFHfTkvg5GpDhWNjMqMB7yNNWUfvNF4v4lEVI0
+J6dFwTlXJOOBV3teqBz2cz4h16Tdd5KZHV4WvZr5nanKO/QZCvmfzUdl/QpeLhsL
+ZPfY6xJTGhK/Hpg+8pbQgkbdxWHp3YgnJ4jwQy6wMX26Whwe7/xhdm8eQvmx1c0h
+XkNwMqOpjeg=
 -----END ENCRYPTED PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.dated.resp b/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.dated.resp
index e8206f793..810da1db3 100644
--- a/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.dated.resp
+++ b/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.dated.resp
diff --git a/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.good.resp b/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.good.resp
index cf8ae53c5..522e30ff9 100644
--- a/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.good.resp
+++ b/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.good.resp
diff --git a/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.req b/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.req
index d7bebd8cc..394654548 100644
--- a/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.req
+++ b/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.req
diff --git a/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.revoked.resp b/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.revoked.resp
index 70e580919..05accc2de 100644
--- a/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.revoked.resp
+++ b/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.revoked.resp
diff --git a/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.signer.dated.resp b/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.signer.dated.resp
index 6eee696dc..94742bc15 100644
--- a/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.signer.dated.resp
+++ b/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.signer.dated.resp
diff --git a/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.signer.good.resp b/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.signer.good.resp
index feb1b3138..6a886604e 100644
--- a/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.signer.good.resp
+++ b/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.signer.good.resp
diff --git a/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.signer.revoked.resp b/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.signer.revoked.resp
index 9c58b1936..3d046615b 100644
--- a/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.signer.revoked.resp
+++ b/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.signer.revoked.resp
diff --git a/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.signernocert.dated.resp b/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.signernocert.dated.resp
index 4ac3df37a..887a3787f 100644
--- a/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.signernocert.dated.resp
+++ b/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.signernocert.dated.resp
diff --git a/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.signernocert.good.resp b/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.signernocert.good.resp
index 60260bfc7..c3e16699d 100644
--- a/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.signernocert.good.resp
+++ b/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.signernocert.good.resp
diff --git a/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.signernocert.revoked.resp b/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.signernocert.revoked.resp
index 8287809c0..cf05fae11 100644
--- a/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.signernocert.revoked.resp
+++ b/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.signernocert.revoked.resp
diff --git a/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.p12 b/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.p12
index 3620be97d..61da138b2 100644
--- a/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.p12
+++ b/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.p12
diff --git a/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.pem b/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.pem
index 401056644..8f782a59d 100644
--- a/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.pem
+++ b/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.pem
@@ -1,21 +1,21 @@
 Bag Attributes
     friendlyName: expired1.example.org
-    localKeyID: C0 42 EE F9 5E E5 53 45 FD 79 A4 AC 05 EC 40 D5 63 4D 07 CE 
+    localKeyID: 90 42 F6 BB C9 D1 AC 51 79 53 4E E0 F2 44 CD B0 FD 03 25 A6 
 subject=/CN=expired1.example.org
 issuer=/O=example.org/CN=clica Signing Cert rsa
 -----BEGIN CERTIFICATE-----
 MIICjTCCAfagAwIBAgIBZzANBgkqhkiG9w0BAQsFADA3MRQwEgYDVQQKEwtleGFt
 cGxlLm9yZzEfMB0GA1UEAxMWY2xpY2EgU2lnbmluZyBDZXJ0IHJzYTAeFw0xMjEx
-MDExMjM0MDJaFw0xMjEyMDExMjM0MDJaMB8xHTAbBgNVBAMTFGV4cGlyZWQxLmV4
-YW1wbGUub3JnMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCueZ0F7/IW0RMT
-3iSkesPfszC/A1LWajEbbJEWxRGME3LvwfMHuayw7WP5dIfi3SGD+mmc0awR2Iio
-bEgNsuba3x3H8J9np91boXmjSwyutq4KoqXEaS3sXvcj7FGTvskfNikIEJ4eFTKp
-XjiA+PwR2Ri2VFsnxuk7f/5aoHd8HwIDAQABo4HAMIG9MA4GA1UdDwEB/wQEAwIE
+MDExMjM0MTBaFw0xMjEyMDExMjM0MTBaMB8xHTAbBgNVBAMTFGV4cGlyZWQxLmV4
+YW1wbGUub3JnMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDF9YzUTezJJ8uz
+6B6rG+H8o72xbwqFhLpEUUXjcHR5jvQu4U5ITpX5ojFg0PV7cH4kJtAfVrijcHwe
+XtxYNB4XgrV1/9ndFu0NHLgdsS+C1Tu3h2b4jdcjyN/DXfRd3tIZOcYxaOhHgAz8
+zpb/TClKxDmP5UDmNmeMS/IZXXOOBwIDAQABo4HAMIG9MA4GA1UdDwEB/wQEAwIE
 8DAgBgNVHSUBAf8EFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwMgYDVR0fBCswKTAn
 oCWgI4YhaHR0cDovL2NybC5leGFtcGxlLm9yZy9sYXRlc3QuY3JsMDQGCCsGAQUF
 BwEBBCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29zY3AuZXhhbXBsZS5vcmcvMB8G
 A1UdEQQYMBaCFGV4cGlyZWQxLmV4YW1wbGUub3JnMA0GCSqGSIb3DQEBCwUAA4GB
-ADbKFUEs8pzPVlv1YaitfHIH3SXKUIxc2UfCB4y51Y1K6DCYMBUMG9vJjdhFaWj0
-ViMRJIlnYnCUXiEKyPvJNuAU1+C9W7/S349qF42X8+TdflF9fxLXjXms62tzezFh
-kJ2Ouwf+rNdj+5dQOLzlngRMSspVR1mf/4xmHepdqBZP
+ADiojtPPZXV9BMA0dh4i40Lws8MZpnm2to3OlTW4ekGhHB303SZtauGzHiP16kQd
+36f+5aVYB9c05lYznKiaCymdMUTzuvMBosUA9iYRs0yXJw6IeRpVOPks9FzEhDyv
+bXRF8cAqfrjWggfukQ7v22EiFDP42DEfeDKb+5Lal5UA
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.unlocked.key b/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.unlocked.key
index fe037ffb7..4206ee002 100644
--- a/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.unlocked.key
+++ b/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.unlocked.key
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXAIBAAKBgQCueZ0F7/IW0RMT3iSkesPfszC/A1LWajEbbJEWxRGME3LvwfMH
-uayw7WP5dIfi3SGD+mmc0awR2IiobEgNsuba3x3H8J9np91boXmjSwyutq4KoqXE
-aS3sXvcj7FGTvskfNikIEJ4eFTKpXjiA+PwR2Ri2VFsnxuk7f/5aoHd8HwIDAQAB
-AoGABY6WCQ8KtN3/2jgkY/YNBbOdWoLD6/8B2rprJ0CA6JHjV+44zAbb5d60ZR49
-sw9moTTOkadpRZWR9LCjiDF/LMKVkX+X17R8q3f9Jn54xeaJH0OOwJxMJ+RUTcDN
-Z18HE8UYCoptiSf5oEYHQ8cfGBj+C+G2uELoIJsvyuVsXLECQQDlkKQVN42pD3+X
-fFxRIkXtGrYmZEAA9ukiFnD9+pGxqfXx6JZdl9UkGi/+hCdz+VAfcM6q1Xt2XmWo
-ML0Uf4+dAkEAwpD5CMh/7w9GftWlDM+gjYSONV2Kkvb4DvwUVrDtESemBBdHx3S3
-TNHM5XGStNEj/mah8qBUteF7alr5N64T6wJBAMMPAbzddUr/VkTbcH2oB46OMdOx
-PwkSw8kpFF1Z+U3iwo4IOSvRhVOlxL4YgIV0g/YTHifeOYe8cdhVgXPXZ6kCQHUr
-bv2uGPUzYsXBDWtgohR3bliO44PLvOjxP6JRXALHuL+f8XcZP8XAVr8aHTpM9Hsg
-/Ygqq7j4eCU9cfXpHE8CQBbekvmT3gQ0SrbUHKNzW1/5OvvgaYx6Dm5VvkzhquRA
-FoLvXHuCAe+/rsPE2LF08ewSvAZOQcKUOSZjIHxYAdc=
+MIICXAIBAAKBgQDF9YzUTezJJ8uz6B6rG+H8o72xbwqFhLpEUUXjcHR5jvQu4U5I
+TpX5ojFg0PV7cH4kJtAfVrijcHweXtxYNB4XgrV1/9ndFu0NHLgdsS+C1Tu3h2b4
+jdcjyN/DXfRd3tIZOcYxaOhHgAz8zpb/TClKxDmP5UDmNmeMS/IZXXOOBwIDAQAB
+AoGAKUopuSCVynE0Ak7gkrUKolzu1IMCMU45YcWH68QJb09bbCnPX7KQgpSLcxOy
+mDAjB1xXHapDccelA9qqX/Vi7wsBOEhSGxaRgmP9H7tO7pJjgr4bs+Rlv1bR3foI
+1qyxHMGUqCVx3t/mvE+Vp18tBpbd7UFMkJtKvPVPWsy2nNECQQD6cRm/uU4kTg8j
+cROWfv9tyrmeob/HmtfC/3zGEmExfcnYDiH8qyLHqAK0RKTHgYZO4i1J50DH5zCn
+8yuJFnvXAkEAylpEOzaVgjIz8oadxkCF7SNE1rL2TrPcPqLhYW9g0G3krSM3c54G
+np0QFVJwTUUMT0bYon0lhfX9+1ryNei5UQJBAK4n1GYU8JgiiDh3O83eBrZM0YPU
+q06dCQmbLSN4SIpoFOLgARZ507fPyAGf8o6iLcnRUvkfjVb2GEnSuiWcswUCQAyb
+URLrVKc233ulnWDDllRu1RQXNDc1B2yzkx0R5lM19YA/6G2Ak+L/4AekCjEWMy0h
+Oc/twg+1gqxNPzfSlvECQBOPfF/dU47YThXaSzU1IYve08aapgXtxdhYqawbVHQM
+m7DH4qvsCgTU7Ct13/CdIxoXtmTpQqBlfy3v97F88k0=
 -----END RSA PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.org/expired1.example.org/key3.db b/test/aux-fixed/exim-ca/example.org/expired1.example.org/key3.db
index 80d66e771..590c5c695 100644
--- a/test/aux-fixed/exim-ca/example.org/expired1.example.org/key3.db
+++ b/test/aux-fixed/exim-ca/example.org/expired1.example.org/key3.db
diff --git a/test/aux-fixed/exim-ca/example.org/expired2.example.org/ca_chain.pem b/test/aux-fixed/exim-ca/example.org/expired2.example.org/ca_chain.pem
index f262d8f92..c9cf7dcd9 100644
--- a/test/aux-fixed/exim-ca/example.org/expired2.example.org/ca_chain.pem
+++ b/test/aux-fixed/exim-ca/example.org/expired2.example.org/ca_chain.pem
@@ -3,33 +3,33 @@ Bag Attributes
 subject=/O=example.org/CN=clica Signing Cert rsa
 issuer=/O=example.org/CN=clica CA rsa
 -----BEGIN CERTIFICATE-----
-MIICNDCCAZ2gAwIBAgIBAjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
-cGxlLm9yZzEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwMloX
-DTM4MDEwMTEyMzQwMlowNzEUMBIGA1UEChMLZXhhbXBsZS5vcmcxHzAdBgNVBAMT
+MIICGDCCAYGgAwIBAgIBQjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+cGxlLm9yZzEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwOFoX
+DTM4MDEwMTEyMzQwOFowNzEUMBIGA1UEChMLZXhhbXBsZS5vcmcxHzAdBgNVBAMT
 FmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
-AoGBAJXe07nxVSZPJ3rVBHQp+m5gWb5/JkzXwcWKEvcmMnJzo2ydVfHBBRmTpzpS
-ST3js2awNbhEdOU7AeBtAvyOtwlT/yp6SHhOlI8PlgLwL9/xedeC0Ex412VOeaV/
-LRbvj0j+WutuglAFXfD5IlwnRoDUB1Q51JFtYZxlxvOqbLb9AgMBAAGjWjBYMA4G
-A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMDIGA1UdHwQrMCkwJ6Al
-oCOGIWh0dHA6Ly9jcmwuZXhhbXBsZS5vcmcvbGF0ZXN0LmNybDANBgkqhkiG9w0B
-AQsFAAOBgQCf9uWkJrIlu9DvKwiiRj6/vMFydd9kLq11COjAovfD6+VbRLeX1lpC
-XpHDhUlrAKOV/5Virl+iXao5YnfnCm1oud0jRGcG8x1JPqUKW3REch4vR0wkjaBS
-5eI7DiydPL1yts588Z6gLjHZBaR0cuXS4e1k9rcXuBC9tZjv7rYskQ==
+AoGBAKvNwx4xa7WCNqEVZytf9wBSqEyyJGZrzauZyQleeD564JHoYpfqgi/WiTje
+bOF+sPAK9x+o+sBYwUu227LUaYgotqqcbhY8kr5lnUQt8il52dstsqcVKpwPG1uQ
+vmTv5J5W9WjF38aHEpFHJL1l8SmC7Og318AbGNuY2b5VmVFbAgMBAAGjPjA8MA4G
+A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMBYGA1UdDgQPBA1BQWJ0
+d0N4Y1hnYjBRMA0GCSqGSIb3DQEBCwUAA4GBAGtwA01/eJwFs17LhHpVC+LTlxFO
+NC8rQCNXWLlt6S9v+ueuO+E5k5s1TXnQ9iB9eZbMXz6tGEuiiS5zDhUTf2kLt55U
+b2pjpDg4doh9h778ss+Yz5ASKg0vqQ0E9yHY1FzJBqxcPHl2BnkcCml9fDW9oI0v
+tzM43Bo0kuWzn62i
 -----END CERTIFICATE-----
 Bag Attributes
     friendlyName: Certificate Authority rsa
 subject=/O=example.org/CN=clica CA rsa
 issuer=/O=example.org/CN=clica CA rsa
 -----BEGIN CERTIFICATE-----
-MIIB9jCCAV+gAwIBAgIBATANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
-cGxlLm9yZzEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwMloX
-DTM4MDEwMTEyMzQwMlowLTEUMBIGA1UEChMLZXhhbXBsZS5vcmcxFTATBgNVBAMT
-DGNsaWNhIENBIHJzYTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAsOI8xlyV
-2kpju6cf0E8/c0QwaOBvUGzkTdCau/DyQrwFPToVpVW8mzDQUOnoUXLl92EJa4Td
-a4uN/uyiyTcjUQWrlZKdFn9HaLB7+rLUox6fZF06jsWgC0Qfr3HHWsrMINn6bucC
-9/eZag5ADPyO5XYnCW4pIFnuFVQ+w3Qr060CAwEAAaMmMCQwEgYDVR0TAQH/BAgw
-BgEB/wIBATAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADgYEALAPJGCfj
-ldkldb3pxmUf8V2luI38AVKNZokjATe3tyv7ikhb2g20BRi92fMHOqfAMUfoJKAu
-lT5vLep0SUETmAXdr3+WfFeZu2KZ9t5lhxyUGnHhxDc3k8TzobZSpFS9+ZnR/4GY
-TwGhx36iRUIFRZ/PUQrkRniedLSkO+H+Xko=
+MIIB9jCCAV+gAwIBAgIBQTANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+cGxlLm9yZzEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwOFoX
+DTM4MDEwMTEyMzQwOFowLTEUMBIGA1UEChMLZXhhbXBsZS5vcmcxFTATBgNVBAMT
+DGNsaWNhIENBIHJzYTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAw4JFjAQr
+oK/87+wzLtvmEa5eQc7oZPrzziKz8EnH8bT2chPEUO1rt+7O9yxWZGyH7JkSw399
+bBu9Kw5xsxqvWrXYUQ0OPj1tuf8/tXc1FCtCYSLVp2vV2It+xfqQdoFHUxgK0dSz
+sYCPYPpaPag/x7h3lWfvhZfMxdDMOSBR6VMCAwEAAaMmMCQwEgYDVR0TAQH/BAgw
+BgEB/wIBATAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADgYEAJ+FVy3d0
+Bz1nk9xcA8rTGhx4sITmI0R1ccjOMlghQErpJx2pYEZ79osrZyOAIuOGSA/g1JFf
+n4llCc6vTbKjR/VUR8wWPmMttDK08YU0Nt9QJNHH1Okl/lpVQxDvHuMQMZ4tP8hJ
+Mu1lg0IENm5gyQ2y91p3m5YNX2kI7SiViUg=
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.org/expired2.example.org/cert8.db b/test/aux-fixed/exim-ca/example.org/expired2.example.org/cert8.db
index df32fcc24..c06d33761 100644
--- a/test/aux-fixed/exim-ca/example.org/expired2.example.org/cert8.db
+++ b/test/aux-fixed/exim-ca/example.org/expired2.example.org/cert8.db
diff --git a/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.chain.pem b/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.chain.pem
index 6f578b3e3..022d98d34 100644
--- a/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.chain.pem
+++ b/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.chain.pem
@@ -1,35 +1,35 @@
 Bag Attributes
     friendlyName: expired2.example.org
-    localKeyID: BB AD 3B 61 9B C1 5F B5 67 B4 E6 DC D0 B0 CD DA DF 58 AF 9A 
+    localKeyID: DA 3D 04 40 EB 61 0E B3 5C 24 FC 91 A5 82 4E F9 D9 5A B0 A2 
 subject=/CN=expired2.example.org
 issuer=/O=example.org/CN=clica Signing Cert rsa
 -----BEGIN CERTIFICATE-----
 MIICjjCCAfegAwIBAgICAMswDQYJKoZIhvcNAQELBQAwNzEUMBIGA1UEChMLZXhh
 bXBsZS5vcmcxHzAdBgNVBAMTFmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwHhcNMTIx
-MTAxMTIzNDAzWhcNMTIxMjAxMTIzNDAzWjAfMR0wGwYDVQQDExRleHBpcmVkMi5l
-eGFtcGxlLm9yZzCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAuC3gS3mRxtQs
-p4mpWah7L1G1/XIVVKxVRhfI2UGEOsSKZNOP5R0qZoknOR9aMKIlNLlG3N50yzbi
-1MnPpZspxORknzmixiLWk8JcB2sAHWkFeZiCzlEQRAfAc3ky1tPNq+SvYOKRtP4Q
-WmMioidONvkk6BXVoIkzK2UlH3xCmp0CAwEAAaOBwDCBvTAOBgNVHQ8BAf8EBAMC
+MTAxMTIzNDEyWhcNMTIxMjAxMTIzNDEyWjAfMR0wGwYDVQQDExRleHBpcmVkMi5l
+eGFtcGxlLm9yZzCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAwkHfZPWmAF8c
+dvzGIebqJGpq63Bx2WqsIKf08kSB3S/MQb/Pvel2qx05Tyo2P4i4rDY1kPKVnEho
+s00Oeyg2tSwUJDL2ZsPB221hwAyhZ59RjIY1t+gmn0EoiD3nhJQTODjYrvVkUN/w
+Ynx7q/eWbbJZT0nQbdLEHSUujtBeSFsCAwEAAaOBwDCBvTAOBgNVHQ8BAf8EBAMC
 BPAwIAYDVR0lAQH/BBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMDIGA1UdHwQrMCkw
 J6AloCOGIWh0dHA6Ly9jcmwuZXhhbXBsZS5vcmcvbGF0ZXN0LmNybDA0BggrBgEF
 BQcBAQQoMCYwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vc2NwLmV4YW1wbGUub3JnLzAf
 BgNVHREEGDAWghRleHBpcmVkMi5leGFtcGxlLm9yZzANBgkqhkiG9w0BAQsFAAOB
-gQBNWz+6NypcliTvDdbksywD8VXNkGaK4FjJeb9nSqFWaAQdIT9sBeHQEusBWdJv
-cfX/Ik2JHtjCpuGCcfK0thQllovsY5dXrSW92F6VBuQvls+ETsNnRqJKz3CtJ9mO
-mC/FGMXIStcSIH931F7afUyw66QLJILUqXcot8HZtn/lUg==
+gQAU45FpwbYgAbq7og3APeDAVAtnNaySEndCceDkeZor/uAsxaYvYDfuVdZrMvEk
+kOtFe/+U+uz+pUthwCe/38PHMXa4TYZrvK4qJ0kDEaeR/XCp+6ek02i6sgi5A7iU
+POMVniBAvjspiafuizQ1gBVwZaA4mbOGJMyN2SbEcv0J0w==
 -----END CERTIFICATE-----
 -----BEGIN CERTIFICATE-----
-MIICNDCCAZ2gAwIBAgIBAjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
-cGxlLm9yZzEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwMloX
-DTM4MDEwMTEyMzQwMlowNzEUMBIGA1UEChMLZXhhbXBsZS5vcmcxHzAdBgNVBAMT
+MIICGDCCAYGgAwIBAgIBQjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+cGxlLm9yZzEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwOFoX
+DTM4MDEwMTEyMzQwOFowNzEUMBIGA1UEChMLZXhhbXBsZS5vcmcxHzAdBgNVBAMT
 FmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
-AoGBAJXe07nxVSZPJ3rVBHQp+m5gWb5/JkzXwcWKEvcmMnJzo2ydVfHBBRmTpzpS
-ST3js2awNbhEdOU7AeBtAvyOtwlT/yp6SHhOlI8PlgLwL9/xedeC0Ex412VOeaV/
-LRbvj0j+WutuglAFXfD5IlwnRoDUB1Q51JFtYZxlxvOqbLb9AgMBAAGjWjBYMA4G
-A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMDIGA1UdHwQrMCkwJ6Al
-oCOGIWh0dHA6Ly9jcmwuZXhhbXBsZS5vcmcvbGF0ZXN0LmNybDANBgkqhkiG9w0B
-AQsFAAOBgQCf9uWkJrIlu9DvKwiiRj6/vMFydd9kLq11COjAovfD6+VbRLeX1lpC
-XpHDhUlrAKOV/5Virl+iXao5YnfnCm1oud0jRGcG8x1JPqUKW3REch4vR0wkjaBS
-5eI7DiydPL1yts588Z6gLjHZBaR0cuXS4e1k9rcXuBC9tZjv7rYskQ==
+AoGBAKvNwx4xa7WCNqEVZytf9wBSqEyyJGZrzauZyQleeD564JHoYpfqgi/WiTje
+bOF+sPAK9x+o+sBYwUu227LUaYgotqqcbhY8kr5lnUQt8il52dstsqcVKpwPG1uQ
+vmTv5J5W9WjF38aHEpFHJL1l8SmC7Og318AbGNuY2b5VmVFbAgMBAAGjPjA8MA4G
+A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMBYGA1UdDgQPBA1BQWJ0
+d0N4Y1hnYjBRMA0GCSqGSIb3DQEBCwUAA4GBAGtwA01/eJwFs17LhHpVC+LTlxFO
+NC8rQCNXWLlt6S9v+ueuO+E5k5s1TXnQ9iB9eZbMXz6tGEuiiS5zDhUTf2kLt55U
+b2pjpDg4doh9h778ss+Yz5ASKg0vqQ0E9yHY1FzJBqxcPHl2BnkcCml9fDW9oI0v
+tzM43Bo0kuWzn62i
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.key b/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.key
index 7cf237255..562f475b1 100644
--- a/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.key
+++ b/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.key
@@ -1,21 +1,22 @@
 Bag Attributes
     friendlyName: expired2.example.org
-    localKeyID: BB AD 3B 61 9B C1 5F B5 67 B4 E6 DC D0 B0 CD DA DF 58 AF 9A 
+    localKeyID: DA 3D 04 40 EB 61 0E B3 5C 24 FC 91 A5 82 4E F9 D9 5A B0 A2 
 Key Attributes: <No Attributes>
 -----BEGIN ENCRYPTED PRIVATE KEY-----
-MIICxjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQIhR31sug2jNUCAggA
-MBQGCCqGSIb3DQMHBAjmdQ9DQshYOASCAoB/PWWnLSUdq0gZinlHkq5wBMm1yEwT
-xxYLoGurDsSDN6j7fbHW/ZDTfHAMrf9ecXfODIPn2wntOF8SDifq5YZDH4+zaHvR
-Rsz/2I5/xQ/+WlDOXrxpNPC2NqkK0N5R/VXfAWCSs1MaE19w56tYuPuzBtRtcw5x
-Ln2uJkjJl1SWh1TOiIfpc2Ld+7g6IpTR44JLz9k7GNtJWFUg/NDYGMy9vEDLQv4e
-lPPmol8ipjR1GXymv22abNi9aL6RND6olOnUZQk1Gr9ugMxAUEAOWFhsrtY6+Ul0
-dPAhgOsmXlUuwDIpewRw++gbkr4+rIKgWveHG8uZy+Z+sjlgqjqb85onnWCGU9xz
-HtarbkvVp2FKa8frAF6bCG7yRaImIFBnyNJQn1qYQtfJuu60RmrKYLhvM2rGTqKX
-V7BQ72GrJ4VeG77I1uvYKNwiSELYaWrKnTIZR/KhJJVCN1/XNSXJzb+zpZDIo2xW
-seyvfsoKIX+RXtOjtx9OhBT24DREiz1F7pV12e0q4z8VUMxpV16fmVA8SH+3v251
-5TTRksGSbFm43z45WWnylOhzJj+bkSOPoRGPBTDU9/Xvem8ni2ZCAoPxBewkLs99
-JsYHsjPGclynF9Lglsb3plN2unhPwH+kIsJ6hi4RMRJAzsWV0LWtRx49UBEinnDM
-1udwIzveVAaZzcM3qC4oQf7L1yHjBdj+eh6sj017uAPdptIDLjsCT789zJUj0qUq
-kEia++A+ks0qhhuBCPMUrkxEwF7V5x5aBCYwLLES5gtD9xn3ruYrZVnXGtIRAK4Z
-YZu3G+qVXwjBlbECSmnVSgR/dC31+c2s/F4TBjQ0pKlxt272agIdNjBE
+MIIC1DBOBgkqhkiG9w0BBQ0wQTApBgkqhkiG9w0BBQwwHAQIcVdYq6H0HFsCAggA
+MAwGCCqGSIb3DQIJBQAwFAYIKoZIhvcNAwcECK/0P0ReP0OjBIICgKmZQ2lAk8Hd
+5VVPzzbrgFWdh7GUp174PVaoWwHK6zmTNfGjhke5ydmSxVpZl0d+HroW4ExUsBNW
+/cTKCjKM/8Cq240F5y4r9ntm0B9/LJYp6A4hGk6m5Tl7WBPgpDOLPLytJ0E3YULu
+0nslg/rk+K6sfbIzau248ouULWZZSvTpppUfQWtJy2PNTg67AoyWNlZ+kC2t8oOu
+XfhmyhoA9xbKKVIyFNDUS/6XmAHpZ5P0b7RH3eDyAevnfqZX+RHBJNuI+0QxjBNk
+E5deJmDqsRh8g2pDpro09Z1UIooeOaXebeKqlRlidw3n7BOPLDs+1tms29T3huH5
+bCKLbkv/tw/LSZkunt0yMRhHo3n+lf4pVpBwxy0LQARUcOlkO5evc4DaE6hAxX5u
+78HNItoNgxF02bSSjEZHJMjxgQAkYZKoF461P3I2QGjvalpvlodq1gAl2DnsPsZc
+uzGDO2zp0YTNaFpgxT9AWaQkP3k3tj9zNz7Oy5N9kgtk8Fs3vEFA9fTOjg7YSvgD
+zidBttYYSIrOPi1OJHMmT5gXI7oDVv59vqyTsRybGriN8lwYJbsA0vfGhhezdBdY
+1EQXFk9k8T2E8MM8+8enqFW5qCdvXN7k1EyN0GBLD7A/gNQmiNb/LUriDL5WCF5j
+AtnX3jHOvJwgD7BhBUYoNLu/rGwLee3lVcvdekJt1LCEN2B5S6WU83BMtwfDVvup
+LzmiuzMVUtPSsu3Kp4sCqBJpiRbEUtF/pHsjEWu4x/t2pMobGD8pVx40lMO5U+m9
+liPEGIZqANmkLTDBVNvKlVWhN/d/IoMH5I3bBYrtWym41UIiNYKUZzzA6Mh9dWgj
+2W3LG7/KvtE=
 -----END ENCRYPTED PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.dated.resp b/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.dated.resp
index 6db1fb1a0..d9a44da42 100644
--- a/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.dated.resp
+++ b/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.dated.resp
diff --git a/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.good.resp b/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.good.resp
index 8d8d1d62f..cd490d2ef 100644
--- a/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.good.resp
+++ b/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.good.resp
diff --git a/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.req b/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.req
index 359deeb9f..302fcc660 100644
--- a/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.req
+++ b/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.req
diff --git a/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.revoked.resp b/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.revoked.resp
index 8d8d1d62f..cd490d2ef 100644
--- a/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.revoked.resp
+++ b/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.revoked.resp
diff --git a/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.signer.dated.resp b/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.signer.dated.resp
index 297300c72..f5878d52b 100644
--- a/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.signer.dated.resp
+++ b/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.signer.dated.resp
diff --git a/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.signer.good.resp b/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.signer.good.resp
index 3e4d296fe..1f4cb4d36 100644
--- a/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.signer.good.resp
+++ b/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.signer.good.resp
diff --git a/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.signer.revoked.resp b/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.signer.revoked.resp
index 3e4d296fe..1f4cb4d36 100644
--- a/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.signer.revoked.resp
+++ b/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.signer.revoked.resp
diff --git a/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.signernocert.dated.resp b/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.signernocert.dated.resp
index 23c7542ec..b33dd2b01 100644
--- a/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.signernocert.dated.resp
+++ b/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.signernocert.dated.resp
diff --git a/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.signernocert.good.resp b/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.signernocert.good.resp
index 089e56efa..52c294a6d 100644
--- a/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.signernocert.good.resp
+++ b/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.signernocert.good.resp
diff --git a/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.signernocert.revoked.resp b/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.signernocert.revoked.resp
index 089e56efa..52c294a6d 100644
--- a/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.signernocert.revoked.resp
+++ b/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.signernocert.revoked.resp
diff --git a/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.p12 b/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.p12
index 05237d5d0..af2e064a4 100644
--- a/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.p12
+++ b/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.p12
diff --git a/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.pem b/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.pem
index b40e4a1fb..2d8eabb09 100644
--- a/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.pem
+++ b/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.pem
@@ -1,21 +1,21 @@
 Bag Attributes
     friendlyName: expired2.example.org
-    localKeyID: BB AD 3B 61 9B C1 5F B5 67 B4 E6 DC D0 B0 CD DA DF 58 AF 9A 
+    localKeyID: DA 3D 04 40 EB 61 0E B3 5C 24 FC 91 A5 82 4E F9 D9 5A B0 A2 
 subject=/CN=expired2.example.org
 issuer=/O=example.org/CN=clica Signing Cert rsa
 -----BEGIN CERTIFICATE-----
 MIICjjCCAfegAwIBAgICAMswDQYJKoZIhvcNAQELBQAwNzEUMBIGA1UEChMLZXhh
 bXBsZS5vcmcxHzAdBgNVBAMTFmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwHhcNMTIx
-MTAxMTIzNDAzWhcNMTIxMjAxMTIzNDAzWjAfMR0wGwYDVQQDExRleHBpcmVkMi5l
-eGFtcGxlLm9yZzCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAuC3gS3mRxtQs
-p4mpWah7L1G1/XIVVKxVRhfI2UGEOsSKZNOP5R0qZoknOR9aMKIlNLlG3N50yzbi
-1MnPpZspxORknzmixiLWk8JcB2sAHWkFeZiCzlEQRAfAc3ky1tPNq+SvYOKRtP4Q
-WmMioidONvkk6BXVoIkzK2UlH3xCmp0CAwEAAaOBwDCBvTAOBgNVHQ8BAf8EBAMC
+MTAxMTIzNDEyWhcNMTIxMjAxMTIzNDEyWjAfMR0wGwYDVQQDExRleHBpcmVkMi5l
+eGFtcGxlLm9yZzCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAwkHfZPWmAF8c
+dvzGIebqJGpq63Bx2WqsIKf08kSB3S/MQb/Pvel2qx05Tyo2P4i4rDY1kPKVnEho
+s00Oeyg2tSwUJDL2ZsPB221hwAyhZ59RjIY1t+gmn0EoiD3nhJQTODjYrvVkUN/w
+Ynx7q/eWbbJZT0nQbdLEHSUujtBeSFsCAwEAAaOBwDCBvTAOBgNVHQ8BAf8EBAMC
 BPAwIAYDVR0lAQH/BBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMDIGA1UdHwQrMCkw
 J6AloCOGIWh0dHA6Ly9jcmwuZXhhbXBsZS5vcmcvbGF0ZXN0LmNybDA0BggrBgEF
 BQcBAQQoMCYwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vc2NwLmV4YW1wbGUub3JnLzAf
 BgNVHREEGDAWghRleHBpcmVkMi5leGFtcGxlLm9yZzANBgkqhkiG9w0BAQsFAAOB
-gQBNWz+6NypcliTvDdbksywD8VXNkGaK4FjJeb9nSqFWaAQdIT9sBeHQEusBWdJv
-cfX/Ik2JHtjCpuGCcfK0thQllovsY5dXrSW92F6VBuQvls+ETsNnRqJKz3CtJ9mO
-mC/FGMXIStcSIH931F7afUyw66QLJILUqXcot8HZtn/lUg==
+gQAU45FpwbYgAbq7og3APeDAVAtnNaySEndCceDkeZor/uAsxaYvYDfuVdZrMvEk
+kOtFe/+U+uz+pUthwCe/38PHMXa4TYZrvK4qJ0kDEaeR/XCp+6ek02i6sgi5A7iU
+POMVniBAvjspiafuizQ1gBVwZaA4mbOGJMyN2SbEcv0J0w==
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.unlocked.key b/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.unlocked.key
index 37f00cb47..3a7912b04 100644
--- a/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.unlocked.key
+++ b/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.unlocked.key
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXAIBAAKBgQC4LeBLeZHG1CynialZqHsvUbX9chVUrFVGF8jZQYQ6xIpk04/l
-HSpmiSc5H1owoiU0uUbc3nTLNuLUyc+lmynE5GSfOaLGItaTwlwHawAdaQV5mILO
-URBEB8BzeTLW082r5K9g4pG0/hBaYyKiJ042+SToFdWgiTMrZSUffEKanQIDAQAB
-AoGABlqm01PFYLuvMrSAIDS80zwZcD4AWGR9qKZnan9lJXXkZGgcHcZs0Q7ISKM5
-RFZDvFbsB/CwzNX+62JvBIKe5ToSgpF2DxBeIiMCIqDYeD2RYEcozGaV1KIjxpMJ
-ZZlwTKcgx0f53QbNK0jpfJu/7kS4afFmjp3iPDVxqSIkMqECQQDgAd08lz5Jd61/
-X7OLK9HVYHD44WbgYnSQcg/oYoOxPw5Rr5VPc2ZSoemITs0uZtsbc+y2Qb2TDbJC
-zuHV5foVAkEA0nvSLsru8rXpanhZbKtMXXQjZaaphQh6cCBzxyonHABlQNzgNZQs
-ZpGk0MbAkK0o12MCMBSB4OCCV3QuDBzoaQJBANu22GIq0qxK14D8xGU4KMuKmaRz
-qW1jBIP9bL75icQbXhcfCmtwfCeGqkHJURU3S6gEr2Qg3SnUoElJFFeyB/UCQBtS
-XU8bona47EqYwqrbdXcwCyQ3xQtytUn2vHCe5SK6XmpUAXqS+Ex8HVPIaNie0Y1b
-2b3Z+53wJpsphoyl9/kCQExmOpZ5BaPGbzJ0MfJ+j9JBXs8mvQ/PEwNZc6COagvX
-WlV64tajDOtGMZt2l5Hy/0Y0gxbyINm5jEb3boG6NQw=
+MIICXAIBAAKBgQDCQd9k9aYAXxx2/MYh5uokamrrcHHZaqwgp/TyRIHdL8xBv8+9
+6XarHTlPKjY/iLisNjWQ8pWcSGizTQ57KDa1LBQkMvZmw8HbbWHADKFnn1GMhjW3
+6CafQSiIPeeElBM4ONiu9WRQ3/BifHur95ZtsllPSdBt0sQdJS6O0F5IWwIDAQAB
+AoGAWLp63eQAL1JCL600mL6e+wQqkyC4t9ysA3yD+vbEtHGFJBEHRBDztaPzDdBT
+mACMjYhzPiI3qPs/64oKT8Gl/p2//7rw/+38sobcqivU/QzCg8Yf1w0MXCfyAWrX
+2MW52h06Zcdtgj0wgve9RZZ/XX6vHOzH4wTXqJDkWsXLDL0CQQDrYSLdWoQlZBeC
+hO5yYchYcT6sy5xzJ3lTRzxCl2BMO0dOdaPjbDiT3IxUwi3WLrr2Eq2m2vrnHxJe
+/AGD6hI1AkEA00Z9LkfTC6fRJrHuH52dLwukHucfjNPdXfuOkaNQMc7nKUyzeTcL
+d6xoQWd55jMvRgsjcJbOOnD8n945Ns1CTwJABpGmbHELQRPjCBR3px+NfNJkQmRI
+UHpoi2dwihc5a8c3vTvRQBaUGaRNEkx9BP4234kz6XUxDWQzmg0Eac8NhQJBAJcY
+9HHi4CaX0FbSLbDisgVxV+DZ/pBi/RA31lCF8daNWHkK59gq68KcxLrx3BYsSQTY
+9nGRCNB2+dUDwvtUdLUCQAoDw9afh+nVP0bBW76BtVVwWdEv2XiCRVQ2mcZnOs3l
+JSadG/8K0Ex8HfiLvel5Vtag3jYvp2e/3+pD2jd5Kjg=
 -----END RSA PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.org/expired2.example.org/key3.db b/test/aux-fixed/exim-ca/example.org/expired2.example.org/key3.db
index 72fa289f2..f70fe48ea 100644
--- a/test/aux-fixed/exim-ca/example.org/expired2.example.org/key3.db
+++ b/test/aux-fixed/exim-ca/example.org/expired2.example.org/key3.db
diff --git a/test/aux-fixed/exim-ca/example.org/revoked1.example.org/ca_chain.pem b/test/aux-fixed/exim-ca/example.org/revoked1.example.org/ca_chain.pem
index f262d8f92..c9cf7dcd9 100644
--- a/test/aux-fixed/exim-ca/example.org/revoked1.example.org/ca_chain.pem
+++ b/test/aux-fixed/exim-ca/example.org/revoked1.example.org/ca_chain.pem
@@ -3,33 +3,33 @@ Bag Attributes
 subject=/O=example.org/CN=clica Signing Cert rsa
 issuer=/O=example.org/CN=clica CA rsa
 -----BEGIN CERTIFICATE-----
-MIICNDCCAZ2gAwIBAgIBAjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
-cGxlLm9yZzEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwMloX
-DTM4MDEwMTEyMzQwMlowNzEUMBIGA1UEChMLZXhhbXBsZS5vcmcxHzAdBgNVBAMT
+MIICGDCCAYGgAwIBAgIBQjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+cGxlLm9yZzEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwOFoX
+DTM4MDEwMTEyMzQwOFowNzEUMBIGA1UEChMLZXhhbXBsZS5vcmcxHzAdBgNVBAMT
 FmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
-AoGBAJXe07nxVSZPJ3rVBHQp+m5gWb5/JkzXwcWKEvcmMnJzo2ydVfHBBRmTpzpS
-ST3js2awNbhEdOU7AeBtAvyOtwlT/yp6SHhOlI8PlgLwL9/xedeC0Ex412VOeaV/
-LRbvj0j+WutuglAFXfD5IlwnRoDUB1Q51JFtYZxlxvOqbLb9AgMBAAGjWjBYMA4G
-A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMDIGA1UdHwQrMCkwJ6Al
-oCOGIWh0dHA6Ly9jcmwuZXhhbXBsZS5vcmcvbGF0ZXN0LmNybDANBgkqhkiG9w0B
-AQsFAAOBgQCf9uWkJrIlu9DvKwiiRj6/vMFydd9kLq11COjAovfD6+VbRLeX1lpC
-XpHDhUlrAKOV/5Virl+iXao5YnfnCm1oud0jRGcG8x1JPqUKW3REch4vR0wkjaBS
-5eI7DiydPL1yts588Z6gLjHZBaR0cuXS4e1k9rcXuBC9tZjv7rYskQ==
+AoGBAKvNwx4xa7WCNqEVZytf9wBSqEyyJGZrzauZyQleeD564JHoYpfqgi/WiTje
+bOF+sPAK9x+o+sBYwUu227LUaYgotqqcbhY8kr5lnUQt8il52dstsqcVKpwPG1uQ
+vmTv5J5W9WjF38aHEpFHJL1l8SmC7Og318AbGNuY2b5VmVFbAgMBAAGjPjA8MA4G
+A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMBYGA1UdDgQPBA1BQWJ0
+d0N4Y1hnYjBRMA0GCSqGSIb3DQEBCwUAA4GBAGtwA01/eJwFs17LhHpVC+LTlxFO
+NC8rQCNXWLlt6S9v+ueuO+E5k5s1TXnQ9iB9eZbMXz6tGEuiiS5zDhUTf2kLt55U
+b2pjpDg4doh9h778ss+Yz5ASKg0vqQ0E9yHY1FzJBqxcPHl2BnkcCml9fDW9oI0v
+tzM43Bo0kuWzn62i
 -----END CERTIFICATE-----
 Bag Attributes
     friendlyName: Certificate Authority rsa
 subject=/O=example.org/CN=clica CA rsa
 issuer=/O=example.org/CN=clica CA rsa
 -----BEGIN CERTIFICATE-----
-MIIB9jCCAV+gAwIBAgIBATANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
-cGxlLm9yZzEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwMloX
-DTM4MDEwMTEyMzQwMlowLTEUMBIGA1UEChMLZXhhbXBsZS5vcmcxFTATBgNVBAMT
-DGNsaWNhIENBIHJzYTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAsOI8xlyV
-2kpju6cf0E8/c0QwaOBvUGzkTdCau/DyQrwFPToVpVW8mzDQUOnoUXLl92EJa4Td
-a4uN/uyiyTcjUQWrlZKdFn9HaLB7+rLUox6fZF06jsWgC0Qfr3HHWsrMINn6bucC
-9/eZag5ADPyO5XYnCW4pIFnuFVQ+w3Qr060CAwEAAaMmMCQwEgYDVR0TAQH/BAgw
-BgEB/wIBATAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADgYEALAPJGCfj
-ldkldb3pxmUf8V2luI38AVKNZokjATe3tyv7ikhb2g20BRi92fMHOqfAMUfoJKAu
-lT5vLep0SUETmAXdr3+WfFeZu2KZ9t5lhxyUGnHhxDc3k8TzobZSpFS9+ZnR/4GY
-TwGhx36iRUIFRZ/PUQrkRniedLSkO+H+Xko=
+MIIB9jCCAV+gAwIBAgIBQTANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+cGxlLm9yZzEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwOFoX
+DTM4MDEwMTEyMzQwOFowLTEUMBIGA1UEChMLZXhhbXBsZS5vcmcxFTATBgNVBAMT
+DGNsaWNhIENBIHJzYTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAw4JFjAQr
+oK/87+wzLtvmEa5eQc7oZPrzziKz8EnH8bT2chPEUO1rt+7O9yxWZGyH7JkSw399
+bBu9Kw5xsxqvWrXYUQ0OPj1tuf8/tXc1FCtCYSLVp2vV2It+xfqQdoFHUxgK0dSz
+sYCPYPpaPag/x7h3lWfvhZfMxdDMOSBR6VMCAwEAAaMmMCQwEgYDVR0TAQH/BAgw
+BgEB/wIBATAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADgYEAJ+FVy3d0
+Bz1nk9xcA8rTGhx4sITmI0R1ccjOMlghQErpJx2pYEZ79osrZyOAIuOGSA/g1JFf
+n4llCc6vTbKjR/VUR8wWPmMttDK08YU0Nt9QJNHH1Okl/lpVQxDvHuMQMZ4tP8hJ
+Mu1lg0IENm5gyQ2y91p3m5YNX2kI7SiViUg=
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.org/revoked1.example.org/cert8.db b/test/aux-fixed/exim-ca/example.org/revoked1.example.org/cert8.db
index 611eb8a73..3b50f3224 100644
--- a/test/aux-fixed/exim-ca/example.org/revoked1.example.org/cert8.db
+++ b/test/aux-fixed/exim-ca/example.org/revoked1.example.org/cert8.db
diff --git a/test/aux-fixed/exim-ca/example.org/revoked1.example.org/key3.db b/test/aux-fixed/exim-ca/example.org/revoked1.example.org/key3.db
index 6525b877c..b684fa666 100644
--- a/test/aux-fixed/exim-ca/example.org/revoked1.example.org/key3.db
+++ b/test/aux-fixed/exim-ca/example.org/revoked1.example.org/key3.db
diff --git a/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.chain.pem b/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.chain.pem
index fb82c3630..7dc806ee8 100644
--- a/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.chain.pem
+++ b/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.chain.pem
@@ -1,35 +1,35 @@
 Bag Attributes
     friendlyName: revoked1.example.org
-    localKeyID: 27 6D 8F 54 63 7F A4 DA F5 52 64 C8 BB 3A 42 49 78 4F 50 38 
+    localKeyID: 9F D2 C9 4E A1 16 99 C2 3D 76 75 5F 81 F6 83 11 42 E4 BD AA 
 subject=/CN=revoked1.example.org
 issuer=/O=example.org/CN=clica Signing Cert rsa
 -----BEGIN CERTIFICATE-----
 MIICjTCCAfagAwIBAgIBZjANBgkqhkiG9w0BAQsFADA3MRQwEgYDVQQKEwtleGFt
 cGxlLm9yZzEfMB0GA1UEAxMWY2xpY2EgU2lnbmluZyBDZXJ0IHJzYTAeFw0xMjEx
-MDExMjM0MDJaFw0zNzEyMDExMjM0MDJaMB8xHTAbBgNVBAMTFHJldm9rZWQxLmV4
-YW1wbGUub3JnMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDKeZLx6cvfgQqG
-2GCqCtIPzKd3WI/iZ5QLIbQCxVwx0R6O12kUPALt0c1cWNgYuTr6PZob7jshFAX0
-/L0i4mMLFA7yOY+ykCllZ5vUSqXm40RNoA3PNdYPBFCy3AUfPDdqtXkIm4CQVub+
-r2UC6lDNn+T/QGVNQC8/ddn+tUdi0QIDAQABo4HAMIG9MA4GA1UdDwEB/wQEAwIE
+MDExMjM0MDlaFw0zNzEyMDExMjM0MDlaMB8xHTAbBgNVBAMTFHJldm9rZWQxLmV4
+YW1wbGUub3JnMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCxCdpAKtYBb5Bm
+4ikR0lwpZikY5FIzbKE/Eu18W89AR8WkG4eGR+g5doZynkqM5f9Mb6VD7XpfvFKk
+Alpl8/gPhap0wgYG7PZ9oXaif115z/nuzetkdnGMp4PJLBeKdvPN54pOxJ0h4PfH
+j+BJqr/m+EdpQh2ktQSXh5fOcSAFwQIDAQABo4HAMIG9MA4GA1UdDwEB/wQEAwIE
 8DAgBgNVHSUBAf8EFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwMgYDVR0fBCswKTAn
 oCWgI4YhaHR0cDovL2NybC5leGFtcGxlLm9yZy9sYXRlc3QuY3JsMDQGCCsGAQUF
 BwEBBCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29zY3AuZXhhbXBsZS5vcmcvMB8G
 A1UdEQQYMBaCFHJldm9rZWQxLmV4YW1wbGUub3JnMA0GCSqGSIb3DQEBCwUAA4GB
-AIxvZgTdJEcdez/AsP/RrWPPW13ceqq82D/UGCWfiBynDwvlEObWB3ec0h2Mccza
-sRiVwtexp7ssNUH2GCNM6B6rUrEOHGwZ6SHAesOZZnOCiRC039G6gzCWfcOhKQ/N
-YJN3nAJXWR2sH0uYi5OSey/aifbL7PxbbjU70JOotDq+
+AFj9B7rrOGYWqLvl7KaDtkpJDdT0Ll36dssJzxnvx7/0Bwjxy70oi0YPy0RATdL9
+q8Y0hrFculsSbhaJg54sk+V86dFASqPRmZUr0wNFrk0hs6b664rRxtTxt3ptc6M+
+ONFWldcmvrsvnC/O1TUfPbFZzvrwjapTJyezaFzv2uWa
 -----END CERTIFICATE-----
 -----BEGIN CERTIFICATE-----
-MIICNDCCAZ2gAwIBAgIBAjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
-cGxlLm9yZzEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwMloX
-DTM4MDEwMTEyMzQwMlowNzEUMBIGA1UEChMLZXhhbXBsZS5vcmcxHzAdBgNVBAMT
+MIICGDCCAYGgAwIBAgIBQjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+cGxlLm9yZzEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwOFoX
+DTM4MDEwMTEyMzQwOFowNzEUMBIGA1UEChMLZXhhbXBsZS5vcmcxHzAdBgNVBAMT
 FmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
-AoGBAJXe07nxVSZPJ3rVBHQp+m5gWb5/JkzXwcWKEvcmMnJzo2ydVfHBBRmTpzpS
-ST3js2awNbhEdOU7AeBtAvyOtwlT/yp6SHhOlI8PlgLwL9/xedeC0Ex412VOeaV/
-LRbvj0j+WutuglAFXfD5IlwnRoDUB1Q51JFtYZxlxvOqbLb9AgMBAAGjWjBYMA4G
-A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMDIGA1UdHwQrMCkwJ6Al
-oCOGIWh0dHA6Ly9jcmwuZXhhbXBsZS5vcmcvbGF0ZXN0LmNybDANBgkqhkiG9w0B
-AQsFAAOBgQCf9uWkJrIlu9DvKwiiRj6/vMFydd9kLq11COjAovfD6+VbRLeX1lpC
-XpHDhUlrAKOV/5Virl+iXao5YnfnCm1oud0jRGcG8x1JPqUKW3REch4vR0wkjaBS
-5eI7DiydPL1yts588Z6gLjHZBaR0cuXS4e1k9rcXuBC9tZjv7rYskQ==
+AoGBAKvNwx4xa7WCNqEVZytf9wBSqEyyJGZrzauZyQleeD564JHoYpfqgi/WiTje
+bOF+sPAK9x+o+sBYwUu227LUaYgotqqcbhY8kr5lnUQt8il52dstsqcVKpwPG1uQ
+vmTv5J5W9WjF38aHEpFHJL1l8SmC7Og318AbGNuY2b5VmVFbAgMBAAGjPjA8MA4G
+A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMBYGA1UdDgQPBA1BQWJ0
+d0N4Y1hnYjBRMA0GCSqGSIb3DQEBCwUAA4GBAGtwA01/eJwFs17LhHpVC+LTlxFO
+NC8rQCNXWLlt6S9v+ueuO+E5k5s1TXnQ9iB9eZbMXz6tGEuiiS5zDhUTf2kLt55U
+b2pjpDg4doh9h778ss+Yz5ASKg0vqQ0E9yHY1FzJBqxcPHl2BnkcCml9fDW9oI0v
+tzM43Bo0kuWzn62i
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.key b/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.key
index 88b64d0ff..592d069af 100644
--- a/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.key
+++ b/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.key
@@ -1,21 +1,22 @@
 Bag Attributes
     friendlyName: revoked1.example.org
-    localKeyID: 27 6D 8F 54 63 7F A4 DA F5 52 64 C8 BB 3A 42 49 78 4F 50 38 
+    localKeyID: 9F D2 C9 4E A1 16 99 C2 3D 76 75 5F 81 F6 83 11 42 E4 BD AA 
 Key Attributes: <No Attributes>
 -----BEGIN ENCRYPTED PRIVATE KEY-----
-MIICxjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQIoExh6ojG6u8CAggA
-MBQGCCqGSIb3DQMHBAgf4iFQHuI4XASCAoCPI1ItB5BFCIf5IyU1CTjbtm7bR79s
-70Q1bE0MTWMZlBhgBdqrNXfBklEBkq1xm2bv3h7TCblZd+VGvQyX45p1bYeTq3FO
-S0j+xt2YbLqKmYhKjix912ZOkpk84tWx6RYRz4uR178WHvfKBkxkOmCGIiHQteQj
-N9j7ZDfKJjm+eftEa1Wz+97sDowWNo4s8iNXuxfvLPwWVCKQtWrB2naoCnokhgFv
-SQNdNRTAPyDegMDR73DU4WEWou0Z7SaqV2/VDmQLtFGkl3kWMSH5eVYJoekyHR/A
-jjcTqz3ISNoMhjJk7u4ZMgImn2cvH7nYiRKO4UVqT/ln8DjUok39uw/l6CgdcLym
-2bEquC2MVMLSbltSgF1qMTciQEcXzD9mqCs3tkAby5posO4B1G5iIBRmY3xtiAVE
-LlK8mRi+0MosPSik+sQvVr0gAFxJYnXMM4x8Fso4iRDf0BY2KbaQ+RaCVgHN9iyl
-/QJu/OBtd7syFczUe7s8IClEna5cHfgiJOdb3DNVL76BOda9h4eHYDih4eiKLVx7
-HRbeHcNAOxYaz8xR1U/rMPCw8lVmqVXwrqPllYsmksfqbM5bDYv4+rOz0iVxjZqH
-kNtnjpsR0WWVXEi6pMXs5HJ2qHxczNvOsYJlxJjpcDOTnUKmV4HV0ML4GU287Vhy
-wJUBp7k4NacXKxsFKwF8BOZrqG4410iNpcpSu25oQ4upwb4tBwT6Xn4TKDAY63fx
-uK3MSfv07AH3mVyKmdmFvg76Hrjn7CvD0yi8/F/wSN+ori4ieJTZRo4UHrhcojjP
-aa4tUnoCdHPJIieBk4VJNqQpHVoXvQDRdQTcsrchrsYER3Fn12eXtUr8
+MIIC1DBOBgkqhkiG9w0BBQ0wQTApBgkqhkiG9w0BBQwwHAQISr+AmHXalqICAggA
+MAwGCCqGSIb3DQIJBQAwFAYIKoZIhvcNAwcECBOAIDMHldz+BIICgKtKjSf67T/1
+EUlJp0XNXzGytbI8E5sj+WMQwJPIE0rcRFuUS+BfEnrNaXITuBmJgczomiITr2Ab
+vSK3r3+jSvjqmlpIEq87lI3/8fxZSY7WpKLtsh/tUyU8L4FGHBlP+kapiayH1KiQ
+nRd3i9cB7W/2TL0QPAewJ1gIFPCeSfUAWY306Xx520JUAeGbzT439edYFjMlkQZC
+xOMfTDYOFCJ8IynULx/4ZIwMLxdcVL+AzyOKTh18649uOodmH/24/AppvQXvl4Hi
+BnUjI5IS7WtWA0b7kpPj9D8ckVBT9MgtW08ktBKyp+bkF3cA8ehdf2yiDFTFuOMK
+3g/F2ik3pd+KRERAcajbuNFk3EshRLI6IjVpgf+lhfN0h83kI2j+9abDD1HanL9c
+JhITe8pFl/UCKA5BQO0tEsHMbbaRRwzagaby4AvE4cZAKhGciXmeAPc9rCE7o969
+F0hgzaSeLLsx6gDR4x2LJRVEbil49i48pOKUAWoR5etALECX6KN1YJhozbHLA5rB
+nErxsYsD+ghMUOz+lmYfZ62s/MTp72PZwubfXgugJE8+gGg7XzFB+asQi6mK8Oj5
+w2lvGVpsP/kXx98Fe8zVR3g/ZUPLVLDQBOXCvYbPn+18SxWHTHsS4Lb2pdRIdkJd
+V3RIvbA7xSOhaknrZIrsImdjMppnQvLxUmzQetbP245rqzEAEKblE0oI6KMgZ8uW
+yi2weYgXAsZw9UgOTyhNwZL+cHijozJ7EZFwwZXeubIK3xxO5LX0mWisJW2dzw6N
+49NH9CANR7zl+8LXb/M1d+lPyU82vOfpq5IGyWJtySXelbK3YwRgRHKDEOO5U/g+
+Bt68KLGXW3w=
 -----END ENCRYPTED PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.dated.resp b/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.dated.resp
index 5d60d6bbc..7d9b36cf7 100644
--- a/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.dated.resp
+++ b/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.dated.resp
diff --git a/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.good.resp b/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.good.resp
index dcf4cb0fd..ca45f4aac 100644
--- a/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.good.resp
+++ b/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.good.resp
diff --git a/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.req b/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.req
index f78d2f561..4cc8c0cf1 100644
--- a/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.req
+++ b/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.req
diff --git a/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.revoked.resp b/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.revoked.resp
index 892d80b52..ceb798d9f 100644
--- a/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.revoked.resp
+++ b/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.revoked.resp
diff --git a/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.signer.dated.resp b/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.signer.dated.resp
index 4c38f33a2..87c362905 100644
--- a/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.signer.dated.resp
+++ b/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.signer.dated.resp
diff --git a/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.signer.good.resp b/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.signer.good.resp
index 5790e5ee2..5a9da21bb 100644
--- a/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.signer.good.resp
+++ b/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.signer.good.resp
diff --git a/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.signer.revoked.resp b/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.signer.revoked.resp
index 143e1c864..ae2be1630 100644
--- a/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.signer.revoked.resp
+++ b/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.signer.revoked.resp
diff --git a/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.signernocert.dated.resp b/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.signernocert.dated.resp
index 3e1c4ca8d..d675e9154 100644
--- a/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.signernocert.dated.resp
+++ b/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.signernocert.dated.resp
diff --git a/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.signernocert.good.resp b/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.signernocert.good.resp
index d39b0e6f6..19dc1e41e 100644
--- a/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.signernocert.good.resp
+++ b/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.signernocert.good.resp
diff --git a/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.signernocert.revoked.resp b/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.signernocert.revoked.resp
index 2f29f04ea..841a6c0fa 100644
--- a/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.signernocert.revoked.resp
+++ b/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.signernocert.revoked.resp
diff --git a/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.p12 b/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.p12
index 20a77d2c8..8e869142d 100644
--- a/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.p12
+++ b/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.p12
diff --git a/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.pem b/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.pem
index 91b8ca3e6..0ec9f4eb7 100644
--- a/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.pem
+++ b/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.pem
@@ -1,21 +1,21 @@
 Bag Attributes
     friendlyName: revoked1.example.org
-    localKeyID: 27 6D 8F 54 63 7F A4 DA F5 52 64 C8 BB 3A 42 49 78 4F 50 38 
+    localKeyID: 9F D2 C9 4E A1 16 99 C2 3D 76 75 5F 81 F6 83 11 42 E4 BD AA 
 subject=/CN=revoked1.example.org
 issuer=/O=example.org/CN=clica Signing Cert rsa
 -----BEGIN CERTIFICATE-----
 MIICjTCCAfagAwIBAgIBZjANBgkqhkiG9w0BAQsFADA3MRQwEgYDVQQKEwtleGFt
 cGxlLm9yZzEfMB0GA1UEAxMWY2xpY2EgU2lnbmluZyBDZXJ0IHJzYTAeFw0xMjEx
-MDExMjM0MDJaFw0zNzEyMDExMjM0MDJaMB8xHTAbBgNVBAMTFHJldm9rZWQxLmV4
-YW1wbGUub3JnMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDKeZLx6cvfgQqG
-2GCqCtIPzKd3WI/iZ5QLIbQCxVwx0R6O12kUPALt0c1cWNgYuTr6PZob7jshFAX0
-/L0i4mMLFA7yOY+ykCllZ5vUSqXm40RNoA3PNdYPBFCy3AUfPDdqtXkIm4CQVub+
-r2UC6lDNn+T/QGVNQC8/ddn+tUdi0QIDAQABo4HAMIG9MA4GA1UdDwEB/wQEAwIE
+MDExMjM0MDlaFw0zNzEyMDExMjM0MDlaMB8xHTAbBgNVBAMTFHJldm9rZWQxLmV4
+YW1wbGUub3JnMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCxCdpAKtYBb5Bm
+4ikR0lwpZikY5FIzbKE/Eu18W89AR8WkG4eGR+g5doZynkqM5f9Mb6VD7XpfvFKk
+Alpl8/gPhap0wgYG7PZ9oXaif115z/nuzetkdnGMp4PJLBeKdvPN54pOxJ0h4PfH
+j+BJqr/m+EdpQh2ktQSXh5fOcSAFwQIDAQABo4HAMIG9MA4GA1UdDwEB/wQEAwIE
 8DAgBgNVHSUBAf8EFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwMgYDVR0fBCswKTAn
 oCWgI4YhaHR0cDovL2NybC5leGFtcGxlLm9yZy9sYXRlc3QuY3JsMDQGCCsGAQUF
 BwEBBCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29zY3AuZXhhbXBsZS5vcmcvMB8G
 A1UdEQQYMBaCFHJldm9rZWQxLmV4YW1wbGUub3JnMA0GCSqGSIb3DQEBCwUAA4GB
-AIxvZgTdJEcdez/AsP/RrWPPW13ceqq82D/UGCWfiBynDwvlEObWB3ec0h2Mccza
-sRiVwtexp7ssNUH2GCNM6B6rUrEOHGwZ6SHAesOZZnOCiRC039G6gzCWfcOhKQ/N
-YJN3nAJXWR2sH0uYi5OSey/aifbL7PxbbjU70JOotDq+
+AFj9B7rrOGYWqLvl7KaDtkpJDdT0Ll36dssJzxnvx7/0Bwjxy70oi0YPy0RATdL9
+q8Y0hrFculsSbhaJg54sk+V86dFASqPRmZUr0wNFrk0hs6b664rRxtTxt3ptc6M+
+ONFWldcmvrsvnC/O1TUfPbFZzvrwjapTJyezaFzv2uWa
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.unlocked.key b/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.unlocked.key
index 0db850532..f3ef1b06b 100644
--- a/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.unlocked.key
+++ b/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.unlocked.key
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXAIBAAKBgQDKeZLx6cvfgQqG2GCqCtIPzKd3WI/iZ5QLIbQCxVwx0R6O12kU
-PALt0c1cWNgYuTr6PZob7jshFAX0/L0i4mMLFA7yOY+ykCllZ5vUSqXm40RNoA3P
-NdYPBFCy3AUfPDdqtXkIm4CQVub+r2UC6lDNn+T/QGVNQC8/ddn+tUdi0QIDAQAB
-AoGAAtRnTethI/RDJVEjAWAJ1q/a8PjN9/wlGPEQDuWFt+ou2xBedv/YtaH+lKlm
-3xTq+AIs5BzfUC4eCty5DaKsKijZ6TfIjJr3557uKieFxvDD4qhTvQYd8ActA8ry
-LKF/c/rQSAaG0AcAOGYzt8T3sDcmFK+J3rSs/wHDYtrEtQ0CQQDuMV48z9gYKNxn
-Hm4869hsGc1qUf319TPmX/YfKmcqwYOQwbL4HCWA2OvSfLjOJ38nYDHjNJzIUFDY
-wAFo21ylAkEA2ZyfCwu4+GIyK24SgA/frwuLWpZKFMaoop8nqG/Jyq06JpOOhhz3
-YmN9QhnK4pKUscfECYip+vhun2n8skJ5vQJAYiU9a1lI9UuA5YyIZ9nWJ1TKa1C1
-kC8k33wS8eyK7fcmuvLVR55xZZH8OZLioy9rGVJtu+zl3TQa2/Thn88jcQJAD0Rz
-zByYb6TEDFP+rElw0iEnN8XPkMGXV0F/UMv3Bmc86zPzDem+WYLNaPPSTi8mi4qO
-cHTMKDWB3WFcP012qQJBAJm1ylDMwcttP3b1yEKkW25uXGYJqLsYsLx+tPrgAsiP
-QleA68sgn/R26yQBichKZS6enLIsDK0QQVr/JTkjOyU=
+MIICXAIBAAKBgQCxCdpAKtYBb5Bm4ikR0lwpZikY5FIzbKE/Eu18W89AR8WkG4eG
+R+g5doZynkqM5f9Mb6VD7XpfvFKkAlpl8/gPhap0wgYG7PZ9oXaif115z/nuzetk
+dnGMp4PJLBeKdvPN54pOxJ0h4PfHj+BJqr/m+EdpQh2ktQSXh5fOcSAFwQIDAQAB
+AoGAJuQwMtp2KtiUU1WpigW5Q0rzCknWGP/rKE0DKMeObuOVcmity/zt8fmsrW9C
+l1NLU0JPfu2jbXaUfP0bWLxQqNKxaPSmHYEXN31Ilx9dM22nPuXdyGVlI2GjefVQ
+dK7w/eTa3FpLgdQ3vurHN6GP4GrNrXsit91B6N7+5B4mS4UCQQDb+no/pSkcwP0w
+vmIupn96yrmgDC5SoIkOM/t/lOiDNAVgaLPc4vc+/qM8bJYimrosXG7bKyq+zkk8
+3BjMcKMrAkEAzgdT0xrkwyB0tqKWDvP9ZM1mV85rzR9KyDjIl5L5TjWWq9q5c3Tj
+PrTuAxPH3CdYPg43Sgx5ErhJQu5wJw00wwJARi6ixB2AgWD9JokHMBUExPtav7pD
+KS94qqRhD/JFQF7ffEPLZqSu91UsZUHLoJy22yJeZ+RczeVorlcWPluNYwJATwOE
+ZFvWC/dwi3KDNizgqz4S1+30bfBoT61nUKovLo1iwXna0aqsVCozdb6qUYZNU09E
+aQOrk0BV6HNlU7S+3QJBALr4WfTObOeANJwXD4neyiaKNTynfQ+R5mnDt7t7W7xg
+gCKiFMgvmRgKJiEe6h82UCUAAbqxBPtyBIVzmHfeShI=
 -----END RSA PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.org/revoked2.example.org/ca_chain.pem b/test/aux-fixed/exim-ca/example.org/revoked2.example.org/ca_chain.pem
index f262d8f92..c9cf7dcd9 100644
--- a/test/aux-fixed/exim-ca/example.org/revoked2.example.org/ca_chain.pem
+++ b/test/aux-fixed/exim-ca/example.org/revoked2.example.org/ca_chain.pem
@@ -3,33 +3,33 @@ Bag Attributes
 subject=/O=example.org/CN=clica Signing Cert rsa
 issuer=/O=example.org/CN=clica CA rsa
 -----BEGIN CERTIFICATE-----
-MIICNDCCAZ2gAwIBAgIBAjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
-cGxlLm9yZzEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwMloX
-DTM4MDEwMTEyMzQwMlowNzEUMBIGA1UEChMLZXhhbXBsZS5vcmcxHzAdBgNVBAMT
+MIICGDCCAYGgAwIBAgIBQjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+cGxlLm9yZzEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwOFoX
+DTM4MDEwMTEyMzQwOFowNzEUMBIGA1UEChMLZXhhbXBsZS5vcmcxHzAdBgNVBAMT
 FmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
-AoGBAJXe07nxVSZPJ3rVBHQp+m5gWb5/JkzXwcWKEvcmMnJzo2ydVfHBBRmTpzpS
-ST3js2awNbhEdOU7AeBtAvyOtwlT/yp6SHhOlI8PlgLwL9/xedeC0Ex412VOeaV/
-LRbvj0j+WutuglAFXfD5IlwnRoDUB1Q51JFtYZxlxvOqbLb9AgMBAAGjWjBYMA4G
-A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMDIGA1UdHwQrMCkwJ6Al
-oCOGIWh0dHA6Ly9jcmwuZXhhbXBsZS5vcmcvbGF0ZXN0LmNybDANBgkqhkiG9w0B
-AQsFAAOBgQCf9uWkJrIlu9DvKwiiRj6/vMFydd9kLq11COjAovfD6+VbRLeX1lpC
-XpHDhUlrAKOV/5Virl+iXao5YnfnCm1oud0jRGcG8x1JPqUKW3REch4vR0wkjaBS
-5eI7DiydPL1yts588Z6gLjHZBaR0cuXS4e1k9rcXuBC9tZjv7rYskQ==
+AoGBAKvNwx4xa7WCNqEVZytf9wBSqEyyJGZrzauZyQleeD564JHoYpfqgi/WiTje
+bOF+sPAK9x+o+sBYwUu227LUaYgotqqcbhY8kr5lnUQt8il52dstsqcVKpwPG1uQ
+vmTv5J5W9WjF38aHEpFHJL1l8SmC7Og318AbGNuY2b5VmVFbAgMBAAGjPjA8MA4G
+A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMBYGA1UdDgQPBA1BQWJ0
+d0N4Y1hnYjBRMA0GCSqGSIb3DQEBCwUAA4GBAGtwA01/eJwFs17LhHpVC+LTlxFO
+NC8rQCNXWLlt6S9v+ueuO+E5k5s1TXnQ9iB9eZbMXz6tGEuiiS5zDhUTf2kLt55U
+b2pjpDg4doh9h778ss+Yz5ASKg0vqQ0E9yHY1FzJBqxcPHl2BnkcCml9fDW9oI0v
+tzM43Bo0kuWzn62i
 -----END CERTIFICATE-----
 Bag Attributes
     friendlyName: Certificate Authority rsa
 subject=/O=example.org/CN=clica CA rsa
 issuer=/O=example.org/CN=clica CA rsa
 -----BEGIN CERTIFICATE-----
-MIIB9jCCAV+gAwIBAgIBATANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
-cGxlLm9yZzEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwMloX
-DTM4MDEwMTEyMzQwMlowLTEUMBIGA1UEChMLZXhhbXBsZS5vcmcxFTATBgNVBAMT
-DGNsaWNhIENBIHJzYTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAsOI8xlyV
-2kpju6cf0E8/c0QwaOBvUGzkTdCau/DyQrwFPToVpVW8mzDQUOnoUXLl92EJa4Td
-a4uN/uyiyTcjUQWrlZKdFn9HaLB7+rLUox6fZF06jsWgC0Qfr3HHWsrMINn6bucC
-9/eZag5ADPyO5XYnCW4pIFnuFVQ+w3Qr060CAwEAAaMmMCQwEgYDVR0TAQH/BAgw
-BgEB/wIBATAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADgYEALAPJGCfj
-ldkldb3pxmUf8V2luI38AVKNZokjATe3tyv7ikhb2g20BRi92fMHOqfAMUfoJKAu
-lT5vLep0SUETmAXdr3+WfFeZu2KZ9t5lhxyUGnHhxDc3k8TzobZSpFS9+ZnR/4GY
-TwGhx36iRUIFRZ/PUQrkRniedLSkO+H+Xko=
+MIIB9jCCAV+gAwIBAgIBQTANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+cGxlLm9yZzEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwOFoX
+DTM4MDEwMTEyMzQwOFowLTEUMBIGA1UEChMLZXhhbXBsZS5vcmcxFTATBgNVBAMT
+DGNsaWNhIENBIHJzYTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAw4JFjAQr
+oK/87+wzLtvmEa5eQc7oZPrzziKz8EnH8bT2chPEUO1rt+7O9yxWZGyH7JkSw399
+bBu9Kw5xsxqvWrXYUQ0OPj1tuf8/tXc1FCtCYSLVp2vV2It+xfqQdoFHUxgK0dSz
+sYCPYPpaPag/x7h3lWfvhZfMxdDMOSBR6VMCAwEAAaMmMCQwEgYDVR0TAQH/BAgw
+BgEB/wIBATAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADgYEAJ+FVy3d0
+Bz1nk9xcA8rTGhx4sITmI0R1ccjOMlghQErpJx2pYEZ79osrZyOAIuOGSA/g1JFf
+n4llCc6vTbKjR/VUR8wWPmMttDK08YU0Nt9QJNHH1Okl/lpVQxDvHuMQMZ4tP8hJ
+Mu1lg0IENm5gyQ2y91p3m5YNX2kI7SiViUg=
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.org/revoked2.example.org/cert8.db b/test/aux-fixed/exim-ca/example.org/revoked2.example.org/cert8.db
index a536c9e54..e8296f575 100644
--- a/test/aux-fixed/exim-ca/example.org/revoked2.example.org/cert8.db
+++ b/test/aux-fixed/exim-ca/example.org/revoked2.example.org/cert8.db
diff --git a/test/aux-fixed/exim-ca/example.org/revoked2.example.org/key3.db b/test/aux-fixed/exim-ca/example.org/revoked2.example.org/key3.db
index f0d8932d8..a5a7acdee 100644
--- a/test/aux-fixed/exim-ca/example.org/revoked2.example.org/key3.db
+++ b/test/aux-fixed/exim-ca/example.org/revoked2.example.org/key3.db
diff --git a/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.chain.pem b/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.chain.pem
index d624b4c39..48c395b5a 100644
--- a/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.chain.pem
+++ b/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.chain.pem
@@ -1,35 +1,35 @@
 Bag Attributes
     friendlyName: revoked2.example.org
-    localKeyID: D0 14 76 0E D8 FB A2 5B 61 59 4C C9 F2 FC B4 9D 6D 80 46 6A 
+    localKeyID: DB B2 47 5D 13 7D 4D 46 2D 82 3E 57 1D 3F B8 57 1E 5B 9D 76 
 subject=/CN=revoked2.example.org
 issuer=/O=example.org/CN=clica Signing Cert rsa
 -----BEGIN CERTIFICATE-----
 MIICjjCCAfegAwIBAgICAMowDQYJKoZIhvcNAQELBQAwNzEUMBIGA1UEChMLZXhh
 bXBsZS5vcmcxHzAdBgNVBAMTFmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwHhcNMTIx
-MTAxMTIzNDAzWhcNMzcxMjAxMTIzNDAzWjAfMR0wGwYDVQQDExRyZXZva2VkMi5l
-eGFtcGxlLm9yZzCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA6eEsn9l+YWNJ
-57x5be0XgFrpjoYgjYodEWTkPXDfN3yARk8hS5aG+2gKrwo56O7HiZIU6k3Jd6VL
-WNeCsuMvSttiOe/SRHOZCs/WOEaeJq0Z6jMH5U/6n2sneLTrJ1FuYHg6rOAoRQgN
-R/Urz83nRgI87eM5Hwke9wUjX1FjqoUCAwEAAaOBwDCBvTAOBgNVHQ8BAf8EBAMC
+MTAxMTIzNDExWhcNMzcxMjAxMTIzNDExWjAfMR0wGwYDVQQDExRyZXZva2VkMi5l
+eGFtcGxlLm9yZzCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAx8h2Y68mT7T9
+m+uR2wAtlYF/SW2H0FssMxIn7KIruc7CHyYqHKZ3bL40kgSUqztQcu6DRrgYCSCv
+6oYlN4z4S+pSTb3KyDUXS8hBVzG63N0+1v6lsQhtUR9M7VBH90HF3Von86VnUCM9
+iKkd+i3FExNn4bVAS9oLC8v9dvT8HnkCAwEAAaOBwDCBvTAOBgNVHQ8BAf8EBAMC
 BPAwIAYDVR0lAQH/BBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMDIGA1UdHwQrMCkw
 J6AloCOGIWh0dHA6Ly9jcmwuZXhhbXBsZS5vcmcvbGF0ZXN0LmNybDA0BggrBgEF
 BQcBAQQoMCYwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vc2NwLmV4YW1wbGUub3JnLzAf
 BgNVHREEGDAWghRyZXZva2VkMi5leGFtcGxlLm9yZzANBgkqhkiG9w0BAQsFAAOB
-gQBhVWKH0uNU8a7ujHtLc//8YCFLpVFQJUln8FeXDdEEYpmb5VbFW8w0jmdz0nQI
-F5z3iaz51G+1JwWEpLen6ijCpr1ry1G8ZyDy/R+mHGyEU8uyYIfiOokL43trcobn
-YgRE9agT/hbkPhLu0SxXLsuGhjZPNDsIHDlwEwxROG+JCA==
+gQB0qObKsqYgIiuQW332sOq782QjwHmtxl0qFEsjZfaRuGlP6GP68uYeAoqug1Dn
+kfcqn1CsOizDIIqWDZLGi15UMrQ4EMbsrOJMIY1sDsg88ijILgyDAqBC7HGOP2S/
+YUaf4+vfeSkT8lDknsnhXsQCqqIaV5J0ch3vJ9f0ayy1Og==
 -----END CERTIFICATE-----
 -----BEGIN CERTIFICATE-----
-MIICNDCCAZ2gAwIBAgIBAjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
-cGxlLm9yZzEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwMloX
-DTM4MDEwMTEyMzQwMlowNzEUMBIGA1UEChMLZXhhbXBsZS5vcmcxHzAdBgNVBAMT
+MIICGDCCAYGgAwIBAgIBQjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+cGxlLm9yZzEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwOFoX
+DTM4MDEwMTEyMzQwOFowNzEUMBIGA1UEChMLZXhhbXBsZS5vcmcxHzAdBgNVBAMT
 FmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
-AoGBAJXe07nxVSZPJ3rVBHQp+m5gWb5/JkzXwcWKEvcmMnJzo2ydVfHBBRmTpzpS
-ST3js2awNbhEdOU7AeBtAvyOtwlT/yp6SHhOlI8PlgLwL9/xedeC0Ex412VOeaV/
-LRbvj0j+WutuglAFXfD5IlwnRoDUB1Q51JFtYZxlxvOqbLb9AgMBAAGjWjBYMA4G
-A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMDIGA1UdHwQrMCkwJ6Al
-oCOGIWh0dHA6Ly9jcmwuZXhhbXBsZS5vcmcvbGF0ZXN0LmNybDANBgkqhkiG9w0B
-AQsFAAOBgQCf9uWkJrIlu9DvKwiiRj6/vMFydd9kLq11COjAovfD6+VbRLeX1lpC
-XpHDhUlrAKOV/5Virl+iXao5YnfnCm1oud0jRGcG8x1JPqUKW3REch4vR0wkjaBS
-5eI7DiydPL1yts588Z6gLjHZBaR0cuXS4e1k9rcXuBC9tZjv7rYskQ==
+AoGBAKvNwx4xa7WCNqEVZytf9wBSqEyyJGZrzauZyQleeD564JHoYpfqgi/WiTje
+bOF+sPAK9x+o+sBYwUu227LUaYgotqqcbhY8kr5lnUQt8il52dstsqcVKpwPG1uQ
+vmTv5J5W9WjF38aHEpFHJL1l8SmC7Og318AbGNuY2b5VmVFbAgMBAAGjPjA8MA4G
+A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMBYGA1UdDgQPBA1BQWJ0
+d0N4Y1hnYjBRMA0GCSqGSIb3DQEBCwUAA4GBAGtwA01/eJwFs17LhHpVC+LTlxFO
+NC8rQCNXWLlt6S9v+ueuO+E5k5s1TXnQ9iB9eZbMXz6tGEuiiS5zDhUTf2kLt55U
+b2pjpDg4doh9h778ss+Yz5ASKg0vqQ0E9yHY1FzJBqxcPHl2BnkcCml9fDW9oI0v
+tzM43Bo0kuWzn62i
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.key b/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.key
index 6120e5d72..354c53a43 100644
--- a/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.key
+++ b/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.key
@@ -1,21 +1,22 @@
 Bag Attributes
     friendlyName: revoked2.example.org
-    localKeyID: D0 14 76 0E D8 FB A2 5B 61 59 4C C9 F2 FC B4 9D 6D 80 46 6A 
+    localKeyID: DB B2 47 5D 13 7D 4D 46 2D 82 3E 57 1D 3F B8 57 1E 5B 9D 76 
 Key Attributes: <No Attributes>
 -----BEGIN ENCRYPTED PRIVATE KEY-----
-MIICxjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQItJ3O9PoZq0UCAggA
-MBQGCCqGSIb3DQMHBAjwM4/9qvXIHgSCAoAIOS9hz8tWX52arrf/7NlYPABpLsDQ
-PHFmvb1V1wMKfIFOqq4LZ28fbhckyTutznCZCyBae74ywxxCgGEpjK75RUyI/whm
-hyVnJ6oTXrTOn9OwD4O5ElGsR5x0UdDxKPBiMdwYyDbNvaYZ+alMA7FEH9WiKVmW
-0k2uxTcjGa+EC+s3XUrxdiB7d3tncAT/kS3BCt5Rer10iGtta+bKr8toWMd3v9NP
-MGJxwaHKDP+DxX8q1Jqw4Y2w4sK4ScY7tkPOTTr48hzGeJAhyiMqr0zqGvmzWucc
-CRDDyYxm8QQ69n/xVRFUHf1z81v1gJKxr4SHaD1nbuPVrT6ZFkcDT5aR4lJ7Lo2P
-LU4U1o24zzelNrJM5sEz5er1e9T2jFfOHe+3JF8wh4s7cgIee0IPwY28WFUmGQ6k
-ovlTHFF6fVmIj59zz3IvirJnx8oyAs5mPJJgrIZ/Ov7r8/+t2LGyy21toPHJ7356
-MnK62wM0Mbb8xzzcXYFDZeaN7Wcmu9sKnGWfplj8Qi1sBGBLGLL4BGhKEU6xzjvX
-VfckyYfmwMRIaql+UphIjNH1Ik5A3iGMDxe1m9cWYLbrHnNbIg2xxz7tsBv5v3Dl
-bCNRWCF8k/MRdMOBoMqdWNCxIKKJPLmh/v796sC9xW+rBMWphAYjFX2aeaXLa+iQ
-XfMH8nEQIXMKxUfgEjOnBySixGY2hJScpAhozJZN85W4yMW2uvqlSnI17C5cB5Sg
-mt+Au3UdaCqNDP89cAC59vokrdAl7vP1ikRWXlU3LZZMggfMaNLx4beoGazgbyP6
-FYiqBuG0INDlRyDuuL6qJB39Sj9N0C+b+29W1RQEUuEfgQ8z638P+y3s
+MIIC1DBOBgkqhkiG9w0BBQ0wQTApBgkqhkiG9w0BBQwwHAQIhJix4vG7ViUCAggA
+MAwGCCqGSIb3DQIJBQAwFAYIKoZIhvcNAwcECAabxIYxJLdoBIICgF2TsEce9Krr
+yKZGNYWyzB6v7jOpuTIJNUguM0+dKVdUL7jWfe7AustU8fwbU6XqCQgDHhX9fvLX
+s1e5ALyxxo+hiFjjHzm+3XZ9QOms8GHU1xhU46Tc99O33IEqvj/xb96l1ZjB+90F
+ptFuglnHKc7VbA/Qh4F7Zx09HdzUvxicduRHGiVPQbQKPuFbnluwUVsI12H6SAXC
+XuytrKRuSvY+zaUfjaPmcedf87jiQq2QIfimYhJfpN/a/DvmorqenJXnQpum8OsW
+EoHSN0lfu7x20qoSibuXs23CQw651B7pHukeetAwDYDPXPhaYqg8rKxyaB1DbQ3v
+1ujCZ2yenQRM9q0TsQhoS5WXWKi50n8RPFnDcKjuwtU9rLf0ue+CxU20Sb+Xie/L
+o0vDnNIG3eFBn80KQaLwkwFZdX2lq27JmK8RLBeGNwf0H6xQOzlUbna7kqPJq2mR
+SMOntENCO2LUrW2M/2Uwbdh3ev6hpmQhWy0C++slbcolAIFCmJlCdJxZRa7YQuqV
+Oiw2b2R3gT2WjTq5afEL+raSV1lNBgjDajt8fJlyKAAJqIlRyBN7iKCavOPOysiw
+5oyq9WnssYz9BqiFyv+7nbLGJopsoZS2UEpGm/0pCw2jzVpDlGWRPhYz+EJIEtt/
+KO6oh+9nU1yL8f7/gXoVTUQIvEPRRkaPRlIV44W6TO1pL9F+dhpU5VmJeuNmJZQN
+PKt55FmQBq7ytaFT+IvASiAVqPRjaazsXnGjYjETG1mrgE/S0t41mNbg5vtINptF
+bpQN3arsgnDT8JeiKjPIsAGin1liXvF5WhYo00dd52qWMGJBL0ZCqfZpV8hRZGR7
+1tRW6aPDZaQ=
 -----END ENCRYPTED PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.dated.resp b/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.dated.resp
index be5dda167..7be250f3c 100644
--- a/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.dated.resp
+++ b/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.dated.resp
diff --git a/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.good.resp b/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.good.resp
index 30b36d6a1..be000b145 100644
--- a/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.good.resp
+++ b/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.good.resp
diff --git a/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.req b/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.req
index 8dcb4ccba..98f41d95c 100644
--- a/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.req
+++ b/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.req
diff --git a/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.revoked.resp b/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.revoked.resp
index 30b36d6a1..be000b145 100644
--- a/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.revoked.resp
+++ b/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.revoked.resp
diff --git a/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.signer.dated.resp b/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.signer.dated.resp
index 73dc39004..0d0512244 100644
--- a/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.signer.dated.resp
+++ b/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.signer.dated.resp
diff --git a/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.signer.good.resp b/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.signer.good.resp
index 2167187bf..8ac381b95 100644
--- a/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.signer.good.resp
+++ b/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.signer.good.resp
diff --git a/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.signer.revoked.resp b/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.signer.revoked.resp
index 2167187bf..8ac381b95 100644
--- a/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.signer.revoked.resp
+++ b/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.signer.revoked.resp
diff --git a/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.signernocert.dated.resp b/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.signernocert.dated.resp
index 14d796979..ea5053243 100644
--- a/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.signernocert.dated.resp
+++ b/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.signernocert.dated.resp
diff --git a/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.signernocert.good.resp b/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.signernocert.good.resp
index 1cdcd52a2..7785d7f89 100644
--- a/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.signernocert.good.resp
+++ b/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.signernocert.good.resp
diff --git a/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.signernocert.revoked.resp b/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.signernocert.revoked.resp
index 1cdcd52a2..7785d7f89 100644
--- a/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.signernocert.revoked.resp
+++ b/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.signernocert.revoked.resp
diff --git a/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.p12 b/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.p12
index 2a75bf424..b37b35bce 100644
--- a/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.p12
+++ b/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.p12
diff --git a/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.pem b/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.pem
index 1237215e9..c8384afe0 100644
--- a/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.pem
+++ b/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.pem
@@ -1,21 +1,21 @@
 Bag Attributes
     friendlyName: revoked2.example.org
-    localKeyID: D0 14 76 0E D8 FB A2 5B 61 59 4C C9 F2 FC B4 9D 6D 80 46 6A 
+    localKeyID: DB B2 47 5D 13 7D 4D 46 2D 82 3E 57 1D 3F B8 57 1E 5B 9D 76 
 subject=/CN=revoked2.example.org
 issuer=/O=example.org/CN=clica Signing Cert rsa
 -----BEGIN CERTIFICATE-----
 MIICjjCCAfegAwIBAgICAMowDQYJKoZIhvcNAQELBQAwNzEUMBIGA1UEChMLZXhh
 bXBsZS5vcmcxHzAdBgNVBAMTFmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwHhcNMTIx
-MTAxMTIzNDAzWhcNMzcxMjAxMTIzNDAzWjAfMR0wGwYDVQQDExRyZXZva2VkMi5l
-eGFtcGxlLm9yZzCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA6eEsn9l+YWNJ
-57x5be0XgFrpjoYgjYodEWTkPXDfN3yARk8hS5aG+2gKrwo56O7HiZIU6k3Jd6VL
-WNeCsuMvSttiOe/SRHOZCs/WOEaeJq0Z6jMH5U/6n2sneLTrJ1FuYHg6rOAoRQgN
-R/Urz83nRgI87eM5Hwke9wUjX1FjqoUCAwEAAaOBwDCBvTAOBgNVHQ8BAf8EBAMC
+MTAxMTIzNDExWhcNMzcxMjAxMTIzNDExWjAfMR0wGwYDVQQDExRyZXZva2VkMi5l
+eGFtcGxlLm9yZzCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAx8h2Y68mT7T9
+m+uR2wAtlYF/SW2H0FssMxIn7KIruc7CHyYqHKZ3bL40kgSUqztQcu6DRrgYCSCv
+6oYlN4z4S+pSTb3KyDUXS8hBVzG63N0+1v6lsQhtUR9M7VBH90HF3Von86VnUCM9
+iKkd+i3FExNn4bVAS9oLC8v9dvT8HnkCAwEAAaOBwDCBvTAOBgNVHQ8BAf8EBAMC
 BPAwIAYDVR0lAQH/BBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMDIGA1UdHwQrMCkw
 J6AloCOGIWh0dHA6Ly9jcmwuZXhhbXBsZS5vcmcvbGF0ZXN0LmNybDA0BggrBgEF
 BQcBAQQoMCYwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vc2NwLmV4YW1wbGUub3JnLzAf
 BgNVHREEGDAWghRyZXZva2VkMi5leGFtcGxlLm9yZzANBgkqhkiG9w0BAQsFAAOB
-gQBhVWKH0uNU8a7ujHtLc//8YCFLpVFQJUln8FeXDdEEYpmb5VbFW8w0jmdz0nQI
-F5z3iaz51G+1JwWEpLen6ijCpr1ry1G8ZyDy/R+mHGyEU8uyYIfiOokL43trcobn
-YgRE9agT/hbkPhLu0SxXLsuGhjZPNDsIHDlwEwxROG+JCA==
+gQB0qObKsqYgIiuQW332sOq782QjwHmtxl0qFEsjZfaRuGlP6GP68uYeAoqug1Dn
+kfcqn1CsOizDIIqWDZLGi15UMrQ4EMbsrOJMIY1sDsg88ijILgyDAqBC7HGOP2S/
+YUaf4+vfeSkT8lDknsnhXsQCqqIaV5J0ch3vJ9f0ayy1Og==
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.unlocked.key b/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.unlocked.key
index ed58c27aa..0421ec516 100644
--- a/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.unlocked.key
+++ b/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.unlocked.key
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXQIBAAKBgQDp4Syf2X5hY0nnvHlt7ReAWumOhiCNih0RZOQ9cN83fIBGTyFL
-lob7aAqvCjno7seJkhTqTcl3pUtY14Ky4y9K22I579JEc5kKz9Y4Rp4mrRnqMwfl
-T/qfayd4tOsnUW5geDqs4ChFCA1H9SvPzedGAjzt4zkfCR73BSNfUWOqhQIDAQAB
-AoGAKVwkld0y3BqgsH5UdBPsZsrNCGMgYR92XgPbWCE8nFWkYqquPu2PD+k5kHRs
-wsxtVZ8Tm07nzMSaw0qTZrrF+y6p8X12rXAz/C/nQ5iMAwF0/KJec2o8VeoVd2+Y
-2PxK1owBv25Ku/2gUosTvk/siwf+PWtBwIeGEVM0MBpjxwECQQD57xwU6WpPs2aN
-OJTSAQHfJhCNFrxtv0hbMU0sAlqnj7XlAeGnoABpuMkd6tZoDCrQkyDT8ksl49IC
-aXB8pHEBAkEA745QsDQMixLz/ExUr8fu+ygjG01BwyRqGVAstxLU/7Wj9/HAzLnO
-Z2wWdsPVmCHpbvEZW+AxV+q1CcLd0M/1hQJBALH5fvm1LSsMCR7PB8pzRS3uISMW
-6Z8M8y1c8iNAmeVwBIrKyDFhUmn2V+Ch9YOqBmL4IgxLIRAeJtHo210mjAECQHjX
-7dQ1LW6qrPHE/6N81A1Wff8zxczO/cavLx9bHJ+x3XkiNwQPZxO87sgSmhkYYk1Y
-ylYSjlGvUIwQBR1lCpECQQCA6JqiYrdNHbFHJcpgJ9BJRyVs1EPg8ra4Oa75qn1h
-xS/7/RGMsCeMXNVwzJyzo4gM+fDejI/OZQZXxFHUY6dE
+MIICXAIBAAKBgQDHyHZjryZPtP2b65HbAC2VgX9JbYfQWywzEifsoiu5zsIfJioc
+pndsvjSSBJSrO1By7oNGuBgJIK/qhiU3jPhL6lJNvcrINRdLyEFXMbrc3T7W/qWx
+CG1RH0ztUEf3QcXdWifzpWdQIz2IqR36LcUTE2fhtUBL2gsLy/129PweeQIDAQAB
+AoGAHZ6qctASgYnHefj8mHgXyg03hnbvRmRmErJT6gEHM5akcELTxoiltyEiIS39
+rr9uB4Q2QWNk6OGIQ2CdHvXPEArqolzA5XBxVhpgEp1/U5tuMZkHz1df0C8Dqe3Y
+xMS3/12Ndt15xCzM/v6poccVK9lYFUYACw+cHCx/8oFdkSMCQQD52eNc/CdTbcW5
+2tiEB4Cr8WtiiQGMyt9wWNhZVldKfXJ6YBgxJvGbmktZB7MokW74uZ5Lb4oo1XI7
+PkuBq7vTAkEAzLMisOveU6h7U9VFUcO4BJ+OYcGKqIMx8QkbtYuowMOZsPrXOh0M
+FqhREaDWaGmWkx1F5qOOjH2Lvlmg5ZeJAwJBAPkyBaAXas2+PaiKCstchEx6RKWJ
+in83VLXEFzy7beLAze4aa+aSNgYBVUdd86Xxr+HpmGUawYzKnt1R25NgirsCQHta
+c8xTxv146SDCw2wbWlgG4qFMJUeZD85lo7oKOB45gPNipbJScMdylK/f0XTINEHh
+AQ+UfkFxInYJwui4IYsCQBGgTluLfY1W/U6Y1WuEKEUGeeEFrHVQZQBi0BflnBxW
+PD00/7UEodbhI/Zuel4YFg0g0sQcXIwXM0nC3MsmrIU=
 -----END RSA PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.org/server1.example.org/ca_chain.pem b/test/aux-fixed/exim-ca/example.org/server1.example.org/ca_chain.pem
index f262d8f92..c9cf7dcd9 100644
--- a/test/aux-fixed/exim-ca/example.org/server1.example.org/ca_chain.pem
+++ b/test/aux-fixed/exim-ca/example.org/server1.example.org/ca_chain.pem
@@ -3,33 +3,33 @@ Bag Attributes
 subject=/O=example.org/CN=clica Signing Cert rsa
 issuer=/O=example.org/CN=clica CA rsa
 -----BEGIN CERTIFICATE-----
-MIICNDCCAZ2gAwIBAgIBAjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
-cGxlLm9yZzEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwMloX
-DTM4MDEwMTEyMzQwMlowNzEUMBIGA1UEChMLZXhhbXBsZS5vcmcxHzAdBgNVBAMT
+MIICGDCCAYGgAwIBAgIBQjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+cGxlLm9yZzEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwOFoX
+DTM4MDEwMTEyMzQwOFowNzEUMBIGA1UEChMLZXhhbXBsZS5vcmcxHzAdBgNVBAMT
 FmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
-AoGBAJXe07nxVSZPJ3rVBHQp+m5gWb5/JkzXwcWKEvcmMnJzo2ydVfHBBRmTpzpS
-ST3js2awNbhEdOU7AeBtAvyOtwlT/yp6SHhOlI8PlgLwL9/xedeC0Ex412VOeaV/
-LRbvj0j+WutuglAFXfD5IlwnRoDUB1Q51JFtYZxlxvOqbLb9AgMBAAGjWjBYMA4G
-A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMDIGA1UdHwQrMCkwJ6Al
-oCOGIWh0dHA6Ly9jcmwuZXhhbXBsZS5vcmcvbGF0ZXN0LmNybDANBgkqhkiG9w0B
-AQsFAAOBgQCf9uWkJrIlu9DvKwiiRj6/vMFydd9kLq11COjAovfD6+VbRLeX1lpC
-XpHDhUlrAKOV/5Virl+iXao5YnfnCm1oud0jRGcG8x1JPqUKW3REch4vR0wkjaBS
-5eI7DiydPL1yts588Z6gLjHZBaR0cuXS4e1k9rcXuBC9tZjv7rYskQ==
+AoGBAKvNwx4xa7WCNqEVZytf9wBSqEyyJGZrzauZyQleeD564JHoYpfqgi/WiTje
+bOF+sPAK9x+o+sBYwUu227LUaYgotqqcbhY8kr5lnUQt8il52dstsqcVKpwPG1uQ
+vmTv5J5W9WjF38aHEpFHJL1l8SmC7Og318AbGNuY2b5VmVFbAgMBAAGjPjA8MA4G
+A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMBYGA1UdDgQPBA1BQWJ0
+d0N4Y1hnYjBRMA0GCSqGSIb3DQEBCwUAA4GBAGtwA01/eJwFs17LhHpVC+LTlxFO
+NC8rQCNXWLlt6S9v+ueuO+E5k5s1TXnQ9iB9eZbMXz6tGEuiiS5zDhUTf2kLt55U
+b2pjpDg4doh9h778ss+Yz5ASKg0vqQ0E9yHY1FzJBqxcPHl2BnkcCml9fDW9oI0v
+tzM43Bo0kuWzn62i
 -----END CERTIFICATE-----
 Bag Attributes
     friendlyName: Certificate Authority rsa
 subject=/O=example.org/CN=clica CA rsa
 issuer=/O=example.org/CN=clica CA rsa
 -----BEGIN CERTIFICATE-----
-MIIB9jCCAV+gAwIBAgIBATANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
-cGxlLm9yZzEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwMloX
-DTM4MDEwMTEyMzQwMlowLTEUMBIGA1UEChMLZXhhbXBsZS5vcmcxFTATBgNVBAMT
-DGNsaWNhIENBIHJzYTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAsOI8xlyV
-2kpju6cf0E8/c0QwaOBvUGzkTdCau/DyQrwFPToVpVW8mzDQUOnoUXLl92EJa4Td
-a4uN/uyiyTcjUQWrlZKdFn9HaLB7+rLUox6fZF06jsWgC0Qfr3HHWsrMINn6bucC
-9/eZag5ADPyO5XYnCW4pIFnuFVQ+w3Qr060CAwEAAaMmMCQwEgYDVR0TAQH/BAgw
-BgEB/wIBATAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADgYEALAPJGCfj
-ldkldb3pxmUf8V2luI38AVKNZokjATe3tyv7ikhb2g20BRi92fMHOqfAMUfoJKAu
-lT5vLep0SUETmAXdr3+WfFeZu2KZ9t5lhxyUGnHhxDc3k8TzobZSpFS9+ZnR/4GY
-TwGhx36iRUIFRZ/PUQrkRniedLSkO+H+Xko=
+MIIB9jCCAV+gAwIBAgIBQTANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+cGxlLm9yZzEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwOFoX
+DTM4MDEwMTEyMzQwOFowLTEUMBIGA1UEChMLZXhhbXBsZS5vcmcxFTATBgNVBAMT
+DGNsaWNhIENBIHJzYTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAw4JFjAQr
+oK/87+wzLtvmEa5eQc7oZPrzziKz8EnH8bT2chPEUO1rt+7O9yxWZGyH7JkSw399
+bBu9Kw5xsxqvWrXYUQ0OPj1tuf8/tXc1FCtCYSLVp2vV2It+xfqQdoFHUxgK0dSz
+sYCPYPpaPag/x7h3lWfvhZfMxdDMOSBR6VMCAwEAAaMmMCQwEgYDVR0TAQH/BAgw
+BgEB/wIBATAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADgYEAJ+FVy3d0
+Bz1nk9xcA8rTGhx4sITmI0R1ccjOMlghQErpJx2pYEZ79osrZyOAIuOGSA/g1JFf
+n4llCc6vTbKjR/VUR8wWPmMttDK08YU0Nt9QJNHH1Okl/lpVQxDvHuMQMZ4tP8hJ
+Mu1lg0IENm5gyQ2y91p3m5YNX2kI7SiViUg=
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.org/server1.example.org/cert8.db b/test/aux-fixed/exim-ca/example.org/server1.example.org/cert8.db
index 3626f0b68..68746c6a7 100644
--- a/test/aux-fixed/exim-ca/example.org/server1.example.org/cert8.db
+++ b/test/aux-fixed/exim-ca/example.org/server1.example.org/cert8.db
diff --git a/test/aux-fixed/exim-ca/example.org/server1.example.org/fullchain.pem b/test/aux-fixed/exim-ca/example.org/server1.example.org/fullchain.pem
index b24f726e8..50df1b6d7 100644
--- a/test/aux-fixed/exim-ca/example.org/server1.example.org/fullchain.pem
+++ b/test/aux-fixed/exim-ca/example.org/server1.example.org/fullchain.pem
@@ -1,58 +1,58 @@
 Bag Attributes
     friendlyName: server1.example.org
-    localKeyID: 3B 5C 4E 1E 72 62 AE 31 20 9A E4 E3 FF 16 93 6D 9B D7 95 39 
+    localKeyID: 2B 8F A4 9B A7 D8 B5 4E 29 AC DD 14 26 74 78 D5 5D 45 EE FB 
 subject=/CN=server1.example.org
 issuer=/O=example.org/CN=clica Signing Cert rsa
 -----BEGIN CERTIFICATE-----
 MIIC3zCCAkigAwIBAgIBZTANBgkqhkiG9w0BAQsFADA3MRQwEgYDVQQKEwtleGFt
 cGxlLm9yZzEfMB0GA1UEAxMWY2xpY2EgU2lnbmluZyBDZXJ0IHJzYTAeFw0xMjEx
-MDExMjM0MDJaFw0zNzEyMDExMjM0MDJaMB4xHDAaBgNVBAMTE3NlcnZlcjEuZXhh
-bXBsZS5vcmcwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBALQR4qm/kntqDomp
-Xnl7DvuQ7Mx3KzXoyvtqncdQnZ2R0P5FECp5ou9UjX0twezyZtUmoHhPfpTUDkOe
-7GPz8jNhT8XQun2UHnUblfeDL96am9hr0iiSaB3tYxJ3hWZ78O/2J1GvVQNWmBXS
-kCoQUVJVmXN/yTVMR21qxFhGcmb7AgMBAAGjggESMIIBDjAOBgNVHQ8BAf8EBAMC
+MDExMjM0MDlaFw0zNzEyMDExMjM0MDlaMB4xHDAaBgNVBAMTE3NlcnZlcjEuZXhh
+bXBsZS5vcmcwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAL0Ywr6PBHFvVzhP
+yxeGwAH2qZjiJ3QAwAKVF/zVQqS90q4IGln8Rzt6ds6WFt6ftcCI0ZQ2Kg9e4jak
+FTz2ag6v1+AkMe29C8t+zVXZuXsEOu14KQsu4iN4XvmXSPyxLhcUi4tFDDBfUome
+1SqG+3MPrXttDyPQwf8WDVvOmAA7AgMBAAGjggESMIIBDjAOBgNVHQ8BAf8EBAMC
 BPAwIAYDVR0lAQH/BBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMDIGA1UdHwQrMCkw
 J6AloCOGIWh0dHA6Ly9jcmwuZXhhbXBsZS5vcmcvbGF0ZXN0LmNybDA0BggrBgEF
 BQcBAQQoMCYwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vc2NwLmV4YW1wbGUub3JnLzBw
-BgNVHREEaTBnghNzZXJ2ZXIxLmV4YW1wbGUub3JngiFhbHRlcm5hdGVuYW1lLnNl
-cnZlcjEuZXhhbXBsZS5vcmeCCSoudGVzdC5leIIiYWx0ZXJuYXRlbmFtZTIuc2Vy
-dmVyMS5leGFtcGxlLm9yZzANBgkqhkiG9w0BAQsFAAOBgQAnF12Xe/y99pELMeNx
-JGTLm0HWhBydqfKBy0OhUoUrDl7jzMZFad7GkLDgtqR2WDF4p9/inE/ZDupw2jHI
-T4O9mtt5JsT0B4OuzPAF5iL3BgFh7xq3eWifOydk2HbXN4fdvFdi1k6sdV3OFfQe
-f04Khku2+5mfjEvZXT407FiV2w==
+BgNVHREEaTBngiFhbHRlcm5hdGVuYW1lLnNlcnZlcjEuZXhhbXBsZS5vcmeCCSou
+dGVzdC5leIIiYWx0ZXJuYXRlbmFtZTIuc2VydmVyMS5leGFtcGxlLm9yZ4ITc2Vy
+dmVyMS5leGFtcGxlLm9yZzANBgkqhkiG9w0BAQsFAAOBgQA4XtC8Xfh+5q1Xl1oc
+U4ebmYB9soSATYXpQtudXvXOMywlLVtHtuCETeVIWN6mE6KDXQAuOZIurjo1nCVs
+QVAFAKZGw5Uw5MZbNuLkTNEoJqwFNaDH27Ej3fkjuYNmxaD1YPhGnFOlaWBV+pVt
+FkvDF8LJUxxuoZVh011d2bd1jg==
 -----END CERTIFICATE-----
 Bag Attributes
     friendlyName: Signing Cert rsa
 subject=/O=example.org/CN=clica Signing Cert rsa
 issuer=/O=example.org/CN=clica CA rsa
 -----BEGIN CERTIFICATE-----
-MIICNDCCAZ2gAwIBAgIBAjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
-cGxlLm9yZzEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwMloX
-DTM4MDEwMTEyMzQwMlowNzEUMBIGA1UEChMLZXhhbXBsZS5vcmcxHzAdBgNVBAMT
+MIICGDCCAYGgAwIBAgIBQjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+cGxlLm9yZzEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwOFoX
+DTM4MDEwMTEyMzQwOFowNzEUMBIGA1UEChMLZXhhbXBsZS5vcmcxHzAdBgNVBAMT
 FmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
-AoGBAJXe07nxVSZPJ3rVBHQp+m5gWb5/JkzXwcWKEvcmMnJzo2ydVfHBBRmTpzpS
-ST3js2awNbhEdOU7AeBtAvyOtwlT/yp6SHhOlI8PlgLwL9/xedeC0Ex412VOeaV/
-LRbvj0j+WutuglAFXfD5IlwnRoDUB1Q51JFtYZxlxvOqbLb9AgMBAAGjWjBYMA4G
-A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMDIGA1UdHwQrMCkwJ6Al
-oCOGIWh0dHA6Ly9jcmwuZXhhbXBsZS5vcmcvbGF0ZXN0LmNybDANBgkqhkiG9w0B
-AQsFAAOBgQCf9uWkJrIlu9DvKwiiRj6/vMFydd9kLq11COjAovfD6+VbRLeX1lpC
-XpHDhUlrAKOV/5Virl+iXao5YnfnCm1oud0jRGcG8x1JPqUKW3REch4vR0wkjaBS
-5eI7DiydPL1yts588Z6gLjHZBaR0cuXS4e1k9rcXuBC9tZjv7rYskQ==
+AoGBAKvNwx4xa7WCNqEVZytf9wBSqEyyJGZrzauZyQleeD564JHoYpfqgi/WiTje
+bOF+sPAK9x+o+sBYwUu227LUaYgotqqcbhY8kr5lnUQt8il52dstsqcVKpwPG1uQ
+vmTv5J5W9WjF38aHEpFHJL1l8SmC7Og318AbGNuY2b5VmVFbAgMBAAGjPjA8MA4G
+A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMBYGA1UdDgQPBA1BQWJ0
+d0N4Y1hnYjBRMA0GCSqGSIb3DQEBCwUAA4GBAGtwA01/eJwFs17LhHpVC+LTlxFO
+NC8rQCNXWLlt6S9v+ueuO+E5k5s1TXnQ9iB9eZbMXz6tGEuiiS5zDhUTf2kLt55U
+b2pjpDg4doh9h778ss+Yz5ASKg0vqQ0E9yHY1FzJBqxcPHl2BnkcCml9fDW9oI0v
+tzM43Bo0kuWzn62i
 -----END CERTIFICATE-----
 Bag Attributes
     friendlyName: Certificate Authority rsa
 subject=/O=example.org/CN=clica CA rsa
 issuer=/O=example.org/CN=clica CA rsa
 -----BEGIN CERTIFICATE-----
-MIIB9jCCAV+gAwIBAgIBATANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
-cGxlLm9yZzEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwMloX
-DTM4MDEwMTEyMzQwMlowLTEUMBIGA1UEChMLZXhhbXBsZS5vcmcxFTATBgNVBAMT
-DGNsaWNhIENBIHJzYTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAsOI8xlyV
-2kpju6cf0E8/c0QwaOBvUGzkTdCau/DyQrwFPToVpVW8mzDQUOnoUXLl92EJa4Td
-a4uN/uyiyTcjUQWrlZKdFn9HaLB7+rLUox6fZF06jsWgC0Qfr3HHWsrMINn6bucC
-9/eZag5ADPyO5XYnCW4pIFnuFVQ+w3Qr060CAwEAAaMmMCQwEgYDVR0TAQH/BAgw
-BgEB/wIBATAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADgYEALAPJGCfj
-ldkldb3pxmUf8V2luI38AVKNZokjATe3tyv7ikhb2g20BRi92fMHOqfAMUfoJKAu
-lT5vLep0SUETmAXdr3+WfFeZu2KZ9t5lhxyUGnHhxDc3k8TzobZSpFS9+ZnR/4GY
-TwGhx36iRUIFRZ/PUQrkRniedLSkO+H+Xko=
+MIIB9jCCAV+gAwIBAgIBQTANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+cGxlLm9yZzEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwOFoX
+DTM4MDEwMTEyMzQwOFowLTEUMBIGA1UEChMLZXhhbXBsZS5vcmcxFTATBgNVBAMT
+DGNsaWNhIENBIHJzYTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAw4JFjAQr
+oK/87+wzLtvmEa5eQc7oZPrzziKz8EnH8bT2chPEUO1rt+7O9yxWZGyH7JkSw399
+bBu9Kw5xsxqvWrXYUQ0OPj1tuf8/tXc1FCtCYSLVp2vV2It+xfqQdoFHUxgK0dSz
+sYCPYPpaPag/x7h3lWfvhZfMxdDMOSBR6VMCAwEAAaMmMCQwEgYDVR0TAQH/BAgw
+BgEB/wIBATAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADgYEAJ+FVy3d0
+Bz1nk9xcA8rTGhx4sITmI0R1ccjOMlghQErpJx2pYEZ79osrZyOAIuOGSA/g1JFf
+n4llCc6vTbKjR/VUR8wWPmMttDK08YU0Nt9QJNHH1Okl/lpVQxDvHuMQMZ4tP8hJ
+Mu1lg0IENm5gyQ2y91p3m5YNX2kI7SiViUg=
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.org/server1.example.org/key3.db b/test/aux-fixed/exim-ca/example.org/server1.example.org/key3.db
index 75dc94562..e1d0167e9 100644
--- a/test/aux-fixed/exim-ca/example.org/server1.example.org/key3.db
+++ b/test/aux-fixed/exim-ca/example.org/server1.example.org/key3.db
diff --git a/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.chain.pem b/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.chain.pem
index 64f599f2d..d70f40df4 100644
--- a/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.chain.pem
+++ b/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.chain.pem
@@ -1,37 +1,37 @@
 Bag Attributes
     friendlyName: server1.example.org
-    localKeyID: 3B 5C 4E 1E 72 62 AE 31 20 9A E4 E3 FF 16 93 6D 9B D7 95 39 
+    localKeyID: 2B 8F A4 9B A7 D8 B5 4E 29 AC DD 14 26 74 78 D5 5D 45 EE FB 
 subject=/CN=server1.example.org
 issuer=/O=example.org/CN=clica Signing Cert rsa
 -----BEGIN CERTIFICATE-----
 MIIC3zCCAkigAwIBAgIBZTANBgkqhkiG9w0BAQsFADA3MRQwEgYDVQQKEwtleGFt
 cGxlLm9yZzEfMB0GA1UEAxMWY2xpY2EgU2lnbmluZyBDZXJ0IHJzYTAeFw0xMjEx
-MDExMjM0MDJaFw0zNzEyMDExMjM0MDJaMB4xHDAaBgNVBAMTE3NlcnZlcjEuZXhh
-bXBsZS5vcmcwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBALQR4qm/kntqDomp
-Xnl7DvuQ7Mx3KzXoyvtqncdQnZ2R0P5FECp5ou9UjX0twezyZtUmoHhPfpTUDkOe
-7GPz8jNhT8XQun2UHnUblfeDL96am9hr0iiSaB3tYxJ3hWZ78O/2J1GvVQNWmBXS
-kCoQUVJVmXN/yTVMR21qxFhGcmb7AgMBAAGjggESMIIBDjAOBgNVHQ8BAf8EBAMC
+MDExMjM0MDlaFw0zNzEyMDExMjM0MDlaMB4xHDAaBgNVBAMTE3NlcnZlcjEuZXhh
+bXBsZS5vcmcwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAL0Ywr6PBHFvVzhP
+yxeGwAH2qZjiJ3QAwAKVF/zVQqS90q4IGln8Rzt6ds6WFt6ftcCI0ZQ2Kg9e4jak
+FTz2ag6v1+AkMe29C8t+zVXZuXsEOu14KQsu4iN4XvmXSPyxLhcUi4tFDDBfUome
+1SqG+3MPrXttDyPQwf8WDVvOmAA7AgMBAAGjggESMIIBDjAOBgNVHQ8BAf8EBAMC
 BPAwIAYDVR0lAQH/BBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMDIGA1UdHwQrMCkw
 J6AloCOGIWh0dHA6Ly9jcmwuZXhhbXBsZS5vcmcvbGF0ZXN0LmNybDA0BggrBgEF
 BQcBAQQoMCYwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vc2NwLmV4YW1wbGUub3JnLzBw
-BgNVHREEaTBnghNzZXJ2ZXIxLmV4YW1wbGUub3JngiFhbHRlcm5hdGVuYW1lLnNl
-cnZlcjEuZXhhbXBsZS5vcmeCCSoudGVzdC5leIIiYWx0ZXJuYXRlbmFtZTIuc2Vy
-dmVyMS5leGFtcGxlLm9yZzANBgkqhkiG9w0BAQsFAAOBgQAnF12Xe/y99pELMeNx
-JGTLm0HWhBydqfKBy0OhUoUrDl7jzMZFad7GkLDgtqR2WDF4p9/inE/ZDupw2jHI
-T4O9mtt5JsT0B4OuzPAF5iL3BgFh7xq3eWifOydk2HbXN4fdvFdi1k6sdV3OFfQe
-f04Khku2+5mfjEvZXT407FiV2w==
+BgNVHREEaTBngiFhbHRlcm5hdGVuYW1lLnNlcnZlcjEuZXhhbXBsZS5vcmeCCSou
+dGVzdC5leIIiYWx0ZXJuYXRlbmFtZTIuc2VydmVyMS5leGFtcGxlLm9yZ4ITc2Vy
+dmVyMS5leGFtcGxlLm9yZzANBgkqhkiG9w0BAQsFAAOBgQA4XtC8Xfh+5q1Xl1oc
+U4ebmYB9soSATYXpQtudXvXOMywlLVtHtuCETeVIWN6mE6KDXQAuOZIurjo1nCVs
+QVAFAKZGw5Uw5MZbNuLkTNEoJqwFNaDH27Ej3fkjuYNmxaD1YPhGnFOlaWBV+pVt
+FkvDF8LJUxxuoZVh011d2bd1jg==
 -----END CERTIFICATE-----
 -----BEGIN CERTIFICATE-----
-MIICNDCCAZ2gAwIBAgIBAjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
-cGxlLm9yZzEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwMloX
-DTM4MDEwMTEyMzQwMlowNzEUMBIGA1UEChMLZXhhbXBsZS5vcmcxHzAdBgNVBAMT
+MIICGDCCAYGgAwIBAgIBQjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+cGxlLm9yZzEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwOFoX
+DTM4MDEwMTEyMzQwOFowNzEUMBIGA1UEChMLZXhhbXBsZS5vcmcxHzAdBgNVBAMT
 FmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
-AoGBAJXe07nxVSZPJ3rVBHQp+m5gWb5/JkzXwcWKEvcmMnJzo2ydVfHBBRmTpzpS
-ST3js2awNbhEdOU7AeBtAvyOtwlT/yp6SHhOlI8PlgLwL9/xedeC0Ex412VOeaV/
-LRbvj0j+WutuglAFXfD5IlwnRoDUB1Q51JFtYZxlxvOqbLb9AgMBAAGjWjBYMA4G
-A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMDIGA1UdHwQrMCkwJ6Al
-oCOGIWh0dHA6Ly9jcmwuZXhhbXBsZS5vcmcvbGF0ZXN0LmNybDANBgkqhkiG9w0B
-AQsFAAOBgQCf9uWkJrIlu9DvKwiiRj6/vMFydd9kLq11COjAovfD6+VbRLeX1lpC
-XpHDhUlrAKOV/5Virl+iXao5YnfnCm1oud0jRGcG8x1JPqUKW3REch4vR0wkjaBS
-5eI7DiydPL1yts588Z6gLjHZBaR0cuXS4e1k9rcXuBC9tZjv7rYskQ==
+AoGBAKvNwx4xa7WCNqEVZytf9wBSqEyyJGZrzauZyQleeD564JHoYpfqgi/WiTje
+bOF+sPAK9x+o+sBYwUu227LUaYgotqqcbhY8kr5lnUQt8il52dstsqcVKpwPG1uQ
+vmTv5J5W9WjF38aHEpFHJL1l8SmC7Og318AbGNuY2b5VmVFbAgMBAAGjPjA8MA4G
+A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMBYGA1UdDgQPBA1BQWJ0
+d0N4Y1hnYjBRMA0GCSqGSIb3DQEBCwUAA4GBAGtwA01/eJwFs17LhHpVC+LTlxFO
+NC8rQCNXWLlt6S9v+ueuO+E5k5s1TXnQ9iB9eZbMXz6tGEuiiS5zDhUTf2kLt55U
+b2pjpDg4doh9h778ss+Yz5ASKg0vqQ0E9yHY1FzJBqxcPHl2BnkcCml9fDW9oI0v
+tzM43Bo0kuWzn62i
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.key b/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.key
index a0dee8784..4649a58dd 100644
--- a/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.key
+++ b/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.key
@@ -1,21 +1,22 @@
 Bag Attributes
     friendlyName: server1.example.org
-    localKeyID: 3B 5C 4E 1E 72 62 AE 31 20 9A E4 E3 FF 16 93 6D 9B D7 95 39 
+    localKeyID: 2B 8F A4 9B A7 D8 B5 4E 29 AC DD 14 26 74 78 D5 5D 45 EE FB 
 Key Attributes: <No Attributes>
 -----BEGIN ENCRYPTED PRIVATE KEY-----
-MIICxjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQIrIU9gOA7NeYCAggA
-MBQGCCqGSIb3DQMHBAiloTRVYesP1wSCAoAYe5MrxSpkot5DvFkMxEJBNPBcvm86
-vc3SW9WC4eoC7pQAWKMAmAb/wiT6h4KwSkYQa/b+3RviE1uSHNXIZBycc3y2rTJR
-77fLKwzQ2dx81CN+39csGEsp/vVHzQfRzPCjsaSIuba8+8CHFKOZn5kYZTCdzYFu
-6F/c+Ts3a06A8Ep9oRDX6KTHT5QaPQegAgSHNAs5fwaxYiJP476il1N9D2pN2iBG
-KjbSzzn8QyDqXvVDT6zYSrljzHXjcWteVDKURZFFfz0CIXLyNeB7nbJMYXueEO0+
-LBspE9LMCvapDhR8EebOCTXMoOrmzoKl550KDKVDGm+B2Da79owHrf2JTaAkK6xn
-46XhXG0BZQcvvz97LYiUjI9AJZytFy9V8hBCyTsL2Y3QDgfihndwnk5B+Dc57PHa
-rmF+/b9kO7DbTAiD2IDh5JszewLejS6aqycZKuJoV71c+t4jhvuZMvgtxNLIFxzQ
-u6uWbu7V2y0Moe9u7Ha1My1pv+/nQ6Y3s3gz9xXzb7kK/Rb9n50tsJhAKLQ1btUj
-3lU47PiL2hkRzH50eLKb81LW7+zCSC6u3B39BUKn2Xf86TN7r5AvRsF+A3dEisFT
-+qvk202FduE9Js/jpaJH4qpxLYOdWikwmmxtQNRNzZzVKGs/uczcga0xqeQ1itlA
-BoNKg0QRT1yV6u2gF4w0alXH6nL1+quzqmFcoAiaQULqM0E3wSwoep43pQFC+cBY
-+5wj3ASo79dTHiZcgjdWLBjtdFG/+PukQV9Cl+oIuD2SOBt4n/P90jSKqu3P1JJn
-UK8/1jeyY53ZGsNbfPZHBRIDQ0IV7x60/VX8z0P0h8FLzftRGGC+wotK
+MIIC1DBOBgkqhkiG9w0BBQ0wQTApBgkqhkiG9w0BBQwwHAQI1ZychNpgIw0CAggA
+MAwGCCqGSIb3DQIJBQAwFAYIKoZIhvcNAwcECB9HLhqNuvwMBIICgCy+Rdz2K6A3
+TBzWi7pPXZCebMtYRY5OcB6VdewbePbspcDYq57QIfbecHvSaJfsxrYet2lVXiAX
+QlE1b8Cs7sDExzq60GlMD4c6fMSsl76DgRZlNUyZ5F2qMIlouHB1Ey5yf71PsvhR
+G0OcoLmUsF4sAQX1jKdYr0sGknG0PPu4BVhao5BDeF/XlhWCgNOUq4EpuCEFLrqR
+VqXQLZgmbk/9G64Pz6de9lRhlx7YjpGKteKOXPapdW3qLGNNe+1LFwfoJ36AWOZG
+J7gChtXsuVMIvCIcpVgHHjm7ka0yCSJHm5jNE7u+v5pU+77QqbZXEe95zq4gtKxA
+YCM7U8wBPF5dUTBPi2BYAOtFTV8xyfLruUU3/uyHsP4rIpcsusZUc0Jp46ygaoit
+tIRc9uOYgIhqxzdjeGKB8wt46z7qSr2YEull7MRvH64+6Ou9oRsCXahCA8WEdivt
+Y62uEyu4n7Ap83X5/3Ul55rKlabBFyZ6HDtdmIL5L9CxqNpU4fBB0UuC+k8HraWr
+o3aH8/xbrPLDSvqcBiL2yEFgRjjEdOLbOAplgi6dxwiXF+DF78TWM3i68OBxZ5lp
+ALcXfo0Wlb8fZYwumlq5O6X5YTShPzZbINFQBA3woUnhzldAJJ0uVypYSicj2r1+
+DDrM4Qw71IRto1goyIxfqr6+cnJMU3UkA+pm+ySENBTFRsDSC9QauSCg3O33clqs
+F/q97+orB2ETAmMx6b43Vqxd/OnJ9L+1hZaom0Zg0RsfdeaemzuAfMmjNUmi0lA7
+IykOyvGQhESksedbyYUEOLm5fjj35oJhEBwVQoFdUGHXGW6DCwlQbC6vme36kp+e
+wbX4sa0yBPs=
 -----END ENCRYPTED PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.dated.resp b/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.dated.resp
index 071e6520b..63188e8a2 100644
--- a/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.dated.resp
+++ b/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.dated.resp
diff --git a/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.good.resp b/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.good.resp
index 689ed6aa7..72424214d 100644
--- a/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.good.resp
+++ b/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.good.resp
diff --git a/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.req b/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.req
index 63596191a..5699cb407 100644
--- a/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.req
+++ b/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.req
diff --git a/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.revoked.resp b/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.revoked.resp
index f6fc0dcbf..cfd76f56c 100644
--- a/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.revoked.resp
+++ b/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.revoked.resp
diff --git a/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.signer.dated.resp b/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.signer.dated.resp
index 4c5cba3c9..e301785cb 100644
--- a/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.signer.dated.resp
+++ b/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.signer.dated.resp
diff --git a/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.signer.good.resp b/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.signer.good.resp
index 83cec5b92..02fa79d85 100644
--- a/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.signer.good.resp
+++ b/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.signer.good.resp
diff --git a/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.signer.revoked.resp b/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.signer.revoked.resp
index 45f9e3481..fc80841bc 100644
--- a/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.signer.revoked.resp
+++ b/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.signer.revoked.resp
diff --git a/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.signernocert.dated.resp b/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.signernocert.dated.resp
index 92a200a47..f79d51bf4 100644
--- a/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.signernocert.dated.resp
+++ b/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.signernocert.dated.resp
diff --git a/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.signernocert.good.resp b/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.signernocert.good.resp
index 9394d01dc..498eac541 100644
--- a/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.signernocert.good.resp
+++ b/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.signernocert.good.resp
diff --git a/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.signernocert.revoked.resp b/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.signernocert.revoked.resp
index 0492e5e39..2e278380e 100644
--- a/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.signernocert.revoked.resp
+++ b/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.signernocert.revoked.resp
diff --git a/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.p12 b/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.p12
index 8a868135a..f0e9e98e2 100644
--- a/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.p12
+++ b/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.p12
diff --git a/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.pem b/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.pem
index d95f41a7a..94e267c72 100644
--- a/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.pem
+++ b/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.pem
@@ -1,23 +1,23 @@
 Bag Attributes
     friendlyName: server1.example.org
-    localKeyID: 3B 5C 4E 1E 72 62 AE 31 20 9A E4 E3 FF 16 93 6D 9B D7 95 39 
+    localKeyID: 2B 8F A4 9B A7 D8 B5 4E 29 AC DD 14 26 74 78 D5 5D 45 EE FB 
 subject=/CN=server1.example.org
 issuer=/O=example.org/CN=clica Signing Cert rsa
 -----BEGIN CERTIFICATE-----
 MIIC3zCCAkigAwIBAgIBZTANBgkqhkiG9w0BAQsFADA3MRQwEgYDVQQKEwtleGFt
 cGxlLm9yZzEfMB0GA1UEAxMWY2xpY2EgU2lnbmluZyBDZXJ0IHJzYTAeFw0xMjEx
-MDExMjM0MDJaFw0zNzEyMDExMjM0MDJaMB4xHDAaBgNVBAMTE3NlcnZlcjEuZXhh
-bXBsZS5vcmcwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBALQR4qm/kntqDomp
-Xnl7DvuQ7Mx3KzXoyvtqncdQnZ2R0P5FECp5ou9UjX0twezyZtUmoHhPfpTUDkOe
-7GPz8jNhT8XQun2UHnUblfeDL96am9hr0iiSaB3tYxJ3hWZ78O/2J1GvVQNWmBXS
-kCoQUVJVmXN/yTVMR21qxFhGcmb7AgMBAAGjggESMIIBDjAOBgNVHQ8BAf8EBAMC
+MDExMjM0MDlaFw0zNzEyMDExMjM0MDlaMB4xHDAaBgNVBAMTE3NlcnZlcjEuZXhh
+bXBsZS5vcmcwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAL0Ywr6PBHFvVzhP
+yxeGwAH2qZjiJ3QAwAKVF/zVQqS90q4IGln8Rzt6ds6WFt6ftcCI0ZQ2Kg9e4jak
+FTz2ag6v1+AkMe29C8t+zVXZuXsEOu14KQsu4iN4XvmXSPyxLhcUi4tFDDBfUome
+1SqG+3MPrXttDyPQwf8WDVvOmAA7AgMBAAGjggESMIIBDjAOBgNVHQ8BAf8EBAMC
 BPAwIAYDVR0lAQH/BBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMDIGA1UdHwQrMCkw
 J6AloCOGIWh0dHA6Ly9jcmwuZXhhbXBsZS5vcmcvbGF0ZXN0LmNybDA0BggrBgEF
 BQcBAQQoMCYwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vc2NwLmV4YW1wbGUub3JnLzBw
-BgNVHREEaTBnghNzZXJ2ZXIxLmV4YW1wbGUub3JngiFhbHRlcm5hdGVuYW1lLnNl
-cnZlcjEuZXhhbXBsZS5vcmeCCSoudGVzdC5leIIiYWx0ZXJuYXRlbmFtZTIuc2Vy
-dmVyMS5leGFtcGxlLm9yZzANBgkqhkiG9w0BAQsFAAOBgQAnF12Xe/y99pELMeNx
-JGTLm0HWhBydqfKBy0OhUoUrDl7jzMZFad7GkLDgtqR2WDF4p9/inE/ZDupw2jHI
-T4O9mtt5JsT0B4OuzPAF5iL3BgFh7xq3eWifOydk2HbXN4fdvFdi1k6sdV3OFfQe
-f04Khku2+5mfjEvZXT407FiV2w==
+BgNVHREEaTBngiFhbHRlcm5hdGVuYW1lLnNlcnZlcjEuZXhhbXBsZS5vcmeCCSou
+dGVzdC5leIIiYWx0ZXJuYXRlbmFtZTIuc2VydmVyMS5leGFtcGxlLm9yZ4ITc2Vy
+dmVyMS5leGFtcGxlLm9yZzANBgkqhkiG9w0BAQsFAAOBgQA4XtC8Xfh+5q1Xl1oc
+U4ebmYB9soSATYXpQtudXvXOMywlLVtHtuCETeVIWN6mE6KDXQAuOZIurjo1nCVs
+QVAFAKZGw5Uw5MZbNuLkTNEoJqwFNaDH27Ej3fkjuYNmxaD1YPhGnFOlaWBV+pVt
+FkvDF8LJUxxuoZVh011d2bd1jg==
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.unlocked.key b/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.unlocked.key
index e23439735..0c197d54a 100644
--- a/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.unlocked.key
+++ b/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.unlocked.key
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXQIBAAKBgQC0EeKpv5J7ag6JqV55ew77kOzMdys16Mr7ap3HUJ2dkdD+RRAq
-eaLvVI19LcHs8mbVJqB4T36U1A5Dnuxj8/IzYU/F0Lp9lB51G5X3gy/empvYa9Io
-kmgd7WMSd4Vme/Dv9idRr1UDVpgV0pAqEFFSVZlzf8k1TEdtasRYRnJm+wIDAQAB
-AoGADNrMAg81f07ya7xmDKkOyEGvzebh9E7CktEpI03repCqyUQX49hcG9a+5QVL
-t0UUtzmzMfOG10wOGqCxQm9rRkYH7/xWevSdI7IkNkxK610YMHQ1FTf3TJlD7Q2N
-h7pyIEGmGluVsrc7kpqXksGLj3HlIH+H5RmparK+DhZaIxkCQQDgrYN69iSlE0wl
-jLmjKrCApuGpXF2vN50VBOWzmubIjKVuBgmEW9JAqnREdWwV1DgK2ZRm8g+q4YqY
-W/qOMJdTAkEAzSxeD+u6hNR6uOuyc81+3W95ydhYKuyfINdN0P05eJPUkju15TRT
-bNwoUUZ4bMcxI6035Xc37j/BRVRuOPFEuQJBAJ8F8NOtOE6mk/TX3+S/KGJGu94V
-hDGqWUIxTyuKbeJwuf5fw4itPOmMO/LgcXoZ1PjI+6LJnZFDRceFAph1iAUCQQCl
-99vnGRL6XD8h01e5oWOckI5+HsnDf0GB+WhzREP3K+5qlG6hiGBr0PO0O0MzCzbO
-21I6BuRxj5UyFghLe6/RAkBgiKuhaKsfeZ/k2SqNjDjDKgXCyKbRug4JRytjPBob
-yt2O8FZTdsUAQ/50mQAdh2Y6YA9xwkKS93/tg++hfL6h
+MIICXQIBAAKBgQC9GMK+jwRxb1c4T8sXhsAB9qmY4id0AMAClRf81UKkvdKuCBpZ
+/Ec7enbOlhben7XAiNGUNioPXuI2pBU89moOr9fgJDHtvQvLfs1V2bl7BDrteCkL
+LuIjeF75l0j8sS4XFIuLRQwwX1KJntUqhvtzD617bQ8j0MH/Fg1bzpgAOwIDAQAB
+AoGAAUA0LZGBnIR5hbhVZhLwmzK3/XhlfWlx27KDxZrdhXxx88++6OB30idluMka
+Xp+c0qi1Bi9ziMV+ZpEgSNZybiKEPdZRyisrfxTX7BCy6x0oaBeDThf2v4PRQcny
+FomzcRBGBZrDZHxjhUSNWTeRxHAStXpMq8aFGcvQ35oUssECQQDxh7dJPFclCppc
+dLQeY70fh0RFV0cyMj7uhB9IrJsJqgLm8Tc2PLvHjrtity5Z/74ooLnDDH4uc077
+rwTNk/tBAkEAyGzjIqKfxWEBsKouNZY4rlwc/gbZ+Ty/4t2+IvvDg4FD4o20Jdff
+BQLmswrtwYOG7zsVhCC4ayou0tARWNRIewJAbJU98h+9cbqlkMEqpKrkQENYju/g
+4xExt5sQUWS/woV7DoYM80Y0iU+CsKt3nCBcRfmT6bs5Evrl3EJfn2hSwQJBAL8H
+CXX5ik6WJwY7Lc/lXiDRqtBzt03WmQ2iS5cMX0z357wHU6y+E9Ky8S+1Ouc2dWWO
+6vMEPMHncrl7lw0TSAECQQCWHeLVxNxBGk4AzsJDHUAzVQALFUaKksT8TtUagBnJ
+qqgoHMMlSBpFeoO6hGcEYF3Z39I8mxFZ1kv+n+tonkzK
 -----END RSA PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.org/server2.example.org/ca_chain.pem b/test/aux-fixed/exim-ca/example.org/server2.example.org/ca_chain.pem
index f262d8f92..c9cf7dcd9 100644
--- a/test/aux-fixed/exim-ca/example.org/server2.example.org/ca_chain.pem
+++ b/test/aux-fixed/exim-ca/example.org/server2.example.org/ca_chain.pem
@@ -3,33 +3,33 @@ Bag Attributes
 subject=/O=example.org/CN=clica Signing Cert rsa
 issuer=/O=example.org/CN=clica CA rsa
 -----BEGIN CERTIFICATE-----
-MIICNDCCAZ2gAwIBAgIBAjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
-cGxlLm9yZzEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwMloX
-DTM4MDEwMTEyMzQwMlowNzEUMBIGA1UEChMLZXhhbXBsZS5vcmcxHzAdBgNVBAMT
+MIICGDCCAYGgAwIBAgIBQjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+cGxlLm9yZzEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwOFoX
+DTM4MDEwMTEyMzQwOFowNzEUMBIGA1UEChMLZXhhbXBsZS5vcmcxHzAdBgNVBAMT
 FmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
-AoGBAJXe07nxVSZPJ3rVBHQp+m5gWb5/JkzXwcWKEvcmMnJzo2ydVfHBBRmTpzpS
-ST3js2awNbhEdOU7AeBtAvyOtwlT/yp6SHhOlI8PlgLwL9/xedeC0Ex412VOeaV/
-LRbvj0j+WutuglAFXfD5IlwnRoDUB1Q51JFtYZxlxvOqbLb9AgMBAAGjWjBYMA4G
-A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMDIGA1UdHwQrMCkwJ6Al
-oCOGIWh0dHA6Ly9jcmwuZXhhbXBsZS5vcmcvbGF0ZXN0LmNybDANBgkqhkiG9w0B
-AQsFAAOBgQCf9uWkJrIlu9DvKwiiRj6/vMFydd9kLq11COjAovfD6+VbRLeX1lpC
-XpHDhUlrAKOV/5Virl+iXao5YnfnCm1oud0jRGcG8x1JPqUKW3REch4vR0wkjaBS
-5eI7DiydPL1yts588Z6gLjHZBaR0cuXS4e1k9rcXuBC9tZjv7rYskQ==
+AoGBAKvNwx4xa7WCNqEVZytf9wBSqEyyJGZrzauZyQleeD564JHoYpfqgi/WiTje
+bOF+sPAK9x+o+sBYwUu227LUaYgotqqcbhY8kr5lnUQt8il52dstsqcVKpwPG1uQ
+vmTv5J5W9WjF38aHEpFHJL1l8SmC7Og318AbGNuY2b5VmVFbAgMBAAGjPjA8MA4G
+A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMBYGA1UdDgQPBA1BQWJ0
+d0N4Y1hnYjBRMA0GCSqGSIb3DQEBCwUAA4GBAGtwA01/eJwFs17LhHpVC+LTlxFO
+NC8rQCNXWLlt6S9v+ueuO+E5k5s1TXnQ9iB9eZbMXz6tGEuiiS5zDhUTf2kLt55U
+b2pjpDg4doh9h778ss+Yz5ASKg0vqQ0E9yHY1FzJBqxcPHl2BnkcCml9fDW9oI0v
+tzM43Bo0kuWzn62i
 -----END CERTIFICATE-----
 Bag Attributes
     friendlyName: Certificate Authority rsa
 subject=/O=example.org/CN=clica CA rsa
 issuer=/O=example.org/CN=clica CA rsa
 -----BEGIN CERTIFICATE-----
-MIIB9jCCAV+gAwIBAgIBATANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
-cGxlLm9yZzEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwMloX
-DTM4MDEwMTEyMzQwMlowLTEUMBIGA1UEChMLZXhhbXBsZS5vcmcxFTATBgNVBAMT
-DGNsaWNhIENBIHJzYTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAsOI8xlyV
-2kpju6cf0E8/c0QwaOBvUGzkTdCau/DyQrwFPToVpVW8mzDQUOnoUXLl92EJa4Td
-a4uN/uyiyTcjUQWrlZKdFn9HaLB7+rLUox6fZF06jsWgC0Qfr3HHWsrMINn6bucC
-9/eZag5ADPyO5XYnCW4pIFnuFVQ+w3Qr060CAwEAAaMmMCQwEgYDVR0TAQH/BAgw
-BgEB/wIBATAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADgYEALAPJGCfj
-ldkldb3pxmUf8V2luI38AVKNZokjATe3tyv7ikhb2g20BRi92fMHOqfAMUfoJKAu
-lT5vLep0SUETmAXdr3+WfFeZu2KZ9t5lhxyUGnHhxDc3k8TzobZSpFS9+ZnR/4GY
-TwGhx36iRUIFRZ/PUQrkRniedLSkO+H+Xko=
+MIIB9jCCAV+gAwIBAgIBQTANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+cGxlLm9yZzEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwOFoX
+DTM4MDEwMTEyMzQwOFowLTEUMBIGA1UEChMLZXhhbXBsZS5vcmcxFTATBgNVBAMT
+DGNsaWNhIENBIHJzYTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAw4JFjAQr
+oK/87+wzLtvmEa5eQc7oZPrzziKz8EnH8bT2chPEUO1rt+7O9yxWZGyH7JkSw399
+bBu9Kw5xsxqvWrXYUQ0OPj1tuf8/tXc1FCtCYSLVp2vV2It+xfqQdoFHUxgK0dSz
+sYCPYPpaPag/x7h3lWfvhZfMxdDMOSBR6VMCAwEAAaMmMCQwEgYDVR0TAQH/BAgw
+BgEB/wIBATAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADgYEAJ+FVy3d0
+Bz1nk9xcA8rTGhx4sITmI0R1ccjOMlghQErpJx2pYEZ79osrZyOAIuOGSA/g1JFf
+n4llCc6vTbKjR/VUR8wWPmMttDK08YU0Nt9QJNHH1Okl/lpVQxDvHuMQMZ4tP8hJ
+Mu1lg0IENm5gyQ2y91p3m5YNX2kI7SiViUg=
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.org/server2.example.org/cert8.db b/test/aux-fixed/exim-ca/example.org/server2.example.org/cert8.db
index 4a75d00e1..fdb4d69bb 100644
--- a/test/aux-fixed/exim-ca/example.org/server2.example.org/cert8.db
+++ b/test/aux-fixed/exim-ca/example.org/server2.example.org/cert8.db
diff --git a/test/aux-fixed/exim-ca/example.org/server2.example.org/fullchain.pem b/test/aux-fixed/exim-ca/example.org/server2.example.org/fullchain.pem
new file mode 100644
index 000000000..f0053bd15
--- /dev/null
+++ b/test/aux-fixed/exim-ca/example.org/server2.example.org/fullchain.pem
@@ -0,0 +1,57 @@
+Bag Attributes
+    friendlyName: server2.example.org
+    localKeyID: 47 5B FC F4 25 CB 73 1B B7 F6 A3 FC 30 38 7A 68 BC CC F8 36 
+subject=/CN=server2.example.org
+issuer=/O=example.org/CN=clica Signing Cert rsa
+-----BEGIN CERTIFICATE-----
+MIICszCCAhygAwIBAgICAMkwDQYJKoZIhvcNAQELBQAwNzEUMBIGA1UEChMLZXhh
+bXBsZS5vcmcxHzAdBgNVBAMTFmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwHhcNMTIx
+MTAxMTIzNDExWhcNMzcxMjAxMTIzNDExWjAeMRwwGgYDVQQDExNzZXJ2ZXIyLmV4
+YW1wbGUub3JnMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC70Nv1NGdZdi8F
+z6rvHHUc2xgq0KiMqjlW78JzKFmN5wgTReCtwHwlRA/32vOyGy1CjDzKzPaRVFCW
+zczMymPoWXFRTctjm1Rd1CMDRCfkzcM4xrYbGW0x442KbR3lmR26tyx7QGU63hSn
+U9+7krRwZOa8YX6PKqD4mSt8H40XZwIDAQABo4HmMIHjMA4GA1UdDwEB/wQEAwIE
+8DAgBgNVHSUBAf8EFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwTgYDVR0jBEcwRYAN
+QUFidHdDeGNYZ2IwUaExpC8wLTEUMBIGA1UEChMLZXhhbXBsZS5jb20xFTATBgNV
+BAMTDGNsaWNhIENBIHJzYYIBQjA0BggrBgEFBQcBAQQoMCYwJAYIKwYBBQUHMAGG
+GGh0dHA6Ly9vc2NwLmV4YW1wbGUub3JnLzApBgNVHREEIjAgghNzZXJ2ZXIyLmV4
+YW1wbGUub3JnggkqLnRlc3QuZXgwDQYJKoZIhvcNAQELBQADgYEAA9xxXPwknAZ8
+X9oVnp6Fi4CPb+GUxm1CLDsOhWwdshzhQ9m+pa1Y1BSDIqxS9ZZ2o7J1OG7ZP5K3
+H7P4vFC4mEfHX5LsVBclVDzIjgzTbBCjDslwZwh5tS+l68brqRGgtPoFEpIJNZ17
+8/GHhJrBr04AOWFaa11qPKAHtWcGzoA=
+-----END CERTIFICATE-----
+Bag Attributes
+    friendlyName: Signing Cert rsa
+subject=/O=example.org/CN=clica Signing Cert rsa
+issuer=/O=example.org/CN=clica CA rsa
+-----BEGIN CERTIFICATE-----
+MIICGDCCAYGgAwIBAgIBQjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+cGxlLm9yZzEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwOFoX
+DTM4MDEwMTEyMzQwOFowNzEUMBIGA1UEChMLZXhhbXBsZS5vcmcxHzAdBgNVBAMT
+FmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
+AoGBAKvNwx4xa7WCNqEVZytf9wBSqEyyJGZrzauZyQleeD564JHoYpfqgi/WiTje
+bOF+sPAK9x+o+sBYwUu227LUaYgotqqcbhY8kr5lnUQt8il52dstsqcVKpwPG1uQ
+vmTv5J5W9WjF38aHEpFHJL1l8SmC7Og318AbGNuY2b5VmVFbAgMBAAGjPjA8MA4G
+A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMBYGA1UdDgQPBA1BQWJ0
+d0N4Y1hnYjBRMA0GCSqGSIb3DQEBCwUAA4GBAGtwA01/eJwFs17LhHpVC+LTlxFO
+NC8rQCNXWLlt6S9v+ueuO+E5k5s1TXnQ9iB9eZbMXz6tGEuiiS5zDhUTf2kLt55U
+b2pjpDg4doh9h778ss+Yz5ASKg0vqQ0E9yHY1FzJBqxcPHl2BnkcCml9fDW9oI0v
+tzM43Bo0kuWzn62i
+-----END CERTIFICATE-----
+Bag Attributes
+    friendlyName: Certificate Authority rsa
+subject=/O=example.org/CN=clica CA rsa
+issuer=/O=example.org/CN=clica CA rsa
+-----BEGIN CERTIFICATE-----
+MIIB9jCCAV+gAwIBAgIBQTANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+cGxlLm9yZzEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwOFoX
+DTM4MDEwMTEyMzQwOFowLTEUMBIGA1UEChMLZXhhbXBsZS5vcmcxFTATBgNVBAMT
+DGNsaWNhIENBIHJzYTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAw4JFjAQr
+oK/87+wzLtvmEa5eQc7oZPrzziKz8EnH8bT2chPEUO1rt+7O9yxWZGyH7JkSw399
+bBu9Kw5xsxqvWrXYUQ0OPj1tuf8/tXc1FCtCYSLVp2vV2It+xfqQdoFHUxgK0dSz
+sYCPYPpaPag/x7h3lWfvhZfMxdDMOSBR6VMCAwEAAaMmMCQwEgYDVR0TAQH/BAgw
+BgEB/wIBATAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADgYEAJ+FVy3d0
+Bz1nk9xcA8rTGhx4sITmI0R1ccjOMlghQErpJx2pYEZ79osrZyOAIuOGSA/g1JFf
+n4llCc6vTbKjR/VUR8wWPmMttDK08YU0Nt9QJNHH1Okl/lpVQxDvHuMQMZ4tP8hJ
+Mu1lg0IENm5gyQ2y91p3m5YNX2kI7SiViUg=
+-----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.org/server2.example.org/key3.db b/test/aux-fixed/exim-ca/example.org/server2.example.org/key3.db
index d791d5020..52d8c28d1 100644
--- a/test/aux-fixed/exim-ca/example.org/server2.example.org/key3.db
+++ b/test/aux-fixed/exim-ca/example.org/server2.example.org/key3.db
diff --git a/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.chain.pem b/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.chain.pem
index 331a661a1..c41ce4250 100644
--- a/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.chain.pem
+++ b/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.chain.pem
@@ -1,35 +1,36 @@
 Bag Attributes
     friendlyName: server2.example.org
-    localKeyID: F2 22 5F 3C 18 C2 87 76 E0 B3 30 CE 6A 44 7B 4F 15 9B 58 3A 
+    localKeyID: 47 5B FC F4 25 CB 73 1B B7 F6 A3 FC 30 38 7A 68 BC CC F8 36 
 subject=/CN=server2.example.org
 issuer=/O=example.org/CN=clica Signing Cert rsa
 -----BEGIN CERTIFICATE-----
-MIICjDCCAfWgAwIBAgICAMkwDQYJKoZIhvcNAQELBQAwNzEUMBIGA1UEChMLZXhh
+MIICszCCAhygAwIBAgICAMkwDQYJKoZIhvcNAQELBQAwNzEUMBIGA1UEChMLZXhh
 bXBsZS5vcmcxHzAdBgNVBAMTFmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwHhcNMTIx
-MTAxMTIzNDAyWhcNMzcxMjAxMTIzNDAyWjAeMRwwGgYDVQQDExNzZXJ2ZXIyLmV4
-YW1wbGUub3JnMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC5BlHN8UOr/LlK
-VpPJZWRtbucPRiAUWJJp5leYn+/zbAXYPNoRbV+eaUPUTkOaLbcEQk7GWw7qFPzD
-K3voal1kELERvlr4OONx6/sYuDpF64zFHW4PXhSgo+sYiM/tEkIC2cyxr82iVX4d
-S45OgYpBzGDvv9aiai871VJMd9O2kwIDAQABo4G/MIG8MA4GA1UdDwEB/wQEAwIE
-8DAgBgNVHSUBAf8EFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwMgYDVR0fBCswKTAn
-oCWgI4YhaHR0cDovL2NybC5leGFtcGxlLm9yZy9sYXRlc3QuY3JsMDQGCCsGAQUF
-BwEBBCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29zY3AuZXhhbXBsZS5vcmcvMB4G
-A1UdEQQXMBWCE3NlcnZlcjIuZXhhbXBsZS5vcmcwDQYJKoZIhvcNAQELBQADgYEA
-bTzC8dtmbbqFpn6huub316XONZIeRKPhGY9Rb1UsUCD7KtMvUkArGmz7p39VS0iE
-+ffBvvtggteJGs8xZ79a3110Y7Bx0ASIt1wa4+vaVAu/Ujx3r1vLDZYwq+Dl3fAq
-1oaFvoD9ANg+FYcjiybT96eKTCT1IXuKs86aTj2jAeo=
+MTAxMTIzNDExWhcNMzcxMjAxMTIzNDExWjAeMRwwGgYDVQQDExNzZXJ2ZXIyLmV4
+YW1wbGUub3JnMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC70Nv1NGdZdi8F
+z6rvHHUc2xgq0KiMqjlW78JzKFmN5wgTReCtwHwlRA/32vOyGy1CjDzKzPaRVFCW
+zczMymPoWXFRTctjm1Rd1CMDRCfkzcM4xrYbGW0x442KbR3lmR26tyx7QGU63hSn
+U9+7krRwZOa8YX6PKqD4mSt8H40XZwIDAQABo4HmMIHjMA4GA1UdDwEB/wQEAwIE
+8DAgBgNVHSUBAf8EFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwTgYDVR0jBEcwRYAN
+QUFidHdDeGNYZ2IwUaExpC8wLTEUMBIGA1UEChMLZXhhbXBsZS5jb20xFTATBgNV
+BAMTDGNsaWNhIENBIHJzYYIBQjA0BggrBgEFBQcBAQQoMCYwJAYIKwYBBQUHMAGG
+GGh0dHA6Ly9vc2NwLmV4YW1wbGUub3JnLzApBgNVHREEIjAgghNzZXJ2ZXIyLmV4
+YW1wbGUub3JnggkqLnRlc3QuZXgwDQYJKoZIhvcNAQELBQADgYEAA9xxXPwknAZ8
+X9oVnp6Fi4CPb+GUxm1CLDsOhWwdshzhQ9m+pa1Y1BSDIqxS9ZZ2o7J1OG7ZP5K3
+H7P4vFC4mEfHX5LsVBclVDzIjgzTbBCjDslwZwh5tS+l68brqRGgtPoFEpIJNZ17
+8/GHhJrBr04AOWFaa11qPKAHtWcGzoA=
 -----END CERTIFICATE-----
 -----BEGIN CERTIFICATE-----
-MIICNDCCAZ2gAwIBAgIBAjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
-cGxlLm9yZzEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwMloX
-DTM4MDEwMTEyMzQwMlowNzEUMBIGA1UEChMLZXhhbXBsZS5vcmcxHzAdBgNVBAMT
+MIICGDCCAYGgAwIBAgIBQjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+cGxlLm9yZzEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwOFoX
+DTM4MDEwMTEyMzQwOFowNzEUMBIGA1UEChMLZXhhbXBsZS5vcmcxHzAdBgNVBAMT
 FmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
-AoGBAJXe07nxVSZPJ3rVBHQp+m5gWb5/JkzXwcWKEvcmMnJzo2ydVfHBBRmTpzpS
-ST3js2awNbhEdOU7AeBtAvyOtwlT/yp6SHhOlI8PlgLwL9/xedeC0Ex412VOeaV/
-LRbvj0j+WutuglAFXfD5IlwnRoDUB1Q51JFtYZxlxvOqbLb9AgMBAAGjWjBYMA4G
-A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMDIGA1UdHwQrMCkwJ6Al
-oCOGIWh0dHA6Ly9jcmwuZXhhbXBsZS5vcmcvbGF0ZXN0LmNybDANBgkqhkiG9w0B
-AQsFAAOBgQCf9uWkJrIlu9DvKwiiRj6/vMFydd9kLq11COjAovfD6+VbRLeX1lpC
-XpHDhUlrAKOV/5Virl+iXao5YnfnCm1oud0jRGcG8x1JPqUKW3REch4vR0wkjaBS
-5eI7DiydPL1yts588Z6gLjHZBaR0cuXS4e1k9rcXuBC9tZjv7rYskQ==
+AoGBAKvNwx4xa7WCNqEVZytf9wBSqEyyJGZrzauZyQleeD564JHoYpfqgi/WiTje
+bOF+sPAK9x+o+sBYwUu227LUaYgotqqcbhY8kr5lnUQt8il52dstsqcVKpwPG1uQ
+vmTv5J5W9WjF38aHEpFHJL1l8SmC7Og318AbGNuY2b5VmVFbAgMBAAGjPjA8MA4G
+A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMBYGA1UdDgQPBA1BQWJ0
+d0N4Y1hnYjBRMA0GCSqGSIb3DQEBCwUAA4GBAGtwA01/eJwFs17LhHpVC+LTlxFO
+NC8rQCNXWLlt6S9v+ueuO+E5k5s1TXnQ9iB9eZbMXz6tGEuiiS5zDhUTf2kLt55U
+b2pjpDg4doh9h778ss+Yz5ASKg0vqQ0E9yHY1FzJBqxcPHl2BnkcCml9fDW9oI0v
+tzM43Bo0kuWzn62i
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.key b/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.key
index 176b96a29..5d2143e14 100644
--- a/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.key
+++ b/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.key
@@ -1,21 +1,22 @@
 Bag Attributes
     friendlyName: server2.example.org
-    localKeyID: F2 22 5F 3C 18 C2 87 76 E0 B3 30 CE 6A 44 7B 4F 15 9B 58 3A 
+    localKeyID: 47 5B FC F4 25 CB 73 1B B7 F6 A3 FC 30 38 7A 68 BC CC F8 36 
 Key Attributes: <No Attributes>
 -----BEGIN ENCRYPTED PRIVATE KEY-----
-MIICxjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQIZ9OUsRRqLWsCAggA
-MBQGCCqGSIb3DQMHBAhLcG8uKTZ3cwSCAoCNCH+f1FjSvVfEsR3oPurIEmH2bJ0B
-O7qrhXO0E8twk3rvoJQjzqzmAy7DE/EwOo+iAybViX3PqzXkDMDIdHxvuv+oKZEI
-nH412oib3mv36wfLF2YFNQIz499gJi/O7GqAYQmYwnD9e+DafyI5zY/9HW30IL9C
-gKsPKY1T+kMVE45yzPx2mxAnxlxuGHTX6MJ+t7vIaUNG1X6m0uxvwIx+kSnN3EBW
-FWkXxZ8Dw6KfSDfFmL1YtL22VD9DxUx15Pp3jz/fCzP6JySRlysUGo9waWNDtXCy
-x6XVDxiIl9zxb8BQrvUniFegod5FIpIJLJkTLgarqgJLejizHJRzM5j/sw+IfNPo
-Cg+U6WZhGWDn1p+A5WJNXtJasycvxXNswtZsdkxSAC/0dHKuMQcwZfe2EAAsVLWc
-umU0XGUvOuh17gA70Rarr9WO1JMBaEuQFv1DxCbAha+jg0lXoA3bbfW9i2cUjSu0
-T7rtWVi7uXQCSMYcCDdMV4ICYGiCOru+EHIBsHgLtXFneUuVZoBGxy0lqrKI89Jl
-XtUmDRYZQ0wYwYcRptL0/rfC1N5TT+O6FfF54R/SggNwMPWJ1gRdJA5N78oKxBNT
-fbKUB5ZvX92zCbyuUwDnKdNHvcHKgU3DHLdaN3cIZv+g5XlPv8XaBIfpjiUT0adn
-NUexZ7FwfQo73Q4pgVzANDe2AfWn1hGPAfrtjQL4NipkiAs5Q5bMDXGWzJsz9GUl
-LQi65XBQDuwOG8j7boDXXYgLmBO6Q/u35Z+RQ4VscsnbN9IBiTAX5AYs42sup9sa
-X/OVtz5KlxL99BJYyq5MhoJyXfRudqN1hygTjwZL80sVpT9U+N89ylfY
+MIIC1DBOBgkqhkiG9w0BBQ0wQTApBgkqhkiG9w0BBQwwHAQIbipttOeyKOICAggA
+MAwGCCqGSIb3DQIJBQAwFAYIKoZIhvcNAwcECH4Sr0ESzFsuBIICgCHzNfmYOZH/
+iEYIEL/LAj2di76rJJQvUyKv2pfXpZlQyVFShRlOgzIjfsM1zjWNuwfkCNW0s9N1
+OX5CwIoPSCKTNs6A2H5cnTrMrnD6B7LlppbBwKtmCZyIAgAM8GvmkltVX8tr1+q9
+9i7zOZgfkVb1YICwKbceNJw4U6kWrIOBqZd9IVc11Dafyw1K01g1H+/dm/gP4kNh
+WOLDkeetXyZnLym/FPAE7VHR47FlC91VlMrgskIfHVYZnGQTLQRGJRHg6JauKulI
+AQOukDPpcMWxsGfHqhu+Djb7HDYx/KVIL+JrlCeKuMx2Er61q7WvRPS8XM97FkHF
+RkH7jNjRNUgFnZ1/UxbYm/jjJ3Y8mBmE7sHdYK1erSyln1k6/aEnGT4STEVCzLqP
+MVUa8EZQN2o0lnx5JoEbmCgQY4uPXy+1BDupnN0Prh/hHXWtPSsHOljOGIhwB6EQ
+u3lV+0OZ+s8Ve7C142bk4cOo+QASs4KR1YbYhgOc3L5/63xS8VgXjTpNcdd0MI6E
+V40OrfF8XSBB0w5bm9U5SibfHf/kY4EhOcZ7o2q2Qjz/yY/T0f081B+i9i49/36n
+bTcaoZtRcVV7xZPRu/SOe9lnMSzpC0POmzN/vLLhuYpJgZdQP0hl8TKqb1PAtSVn
+kns9rTnDp47ESJDPfkdbK/+ssfyC5RzSgKI7snumIHXdmx3bhdfaFj9GEiR6fjSR
+sWJTi3N2WJ9AlehxTtsspZ9Oe8tBDNGj8E/Y/cXbZu64d9B5ZNpBdhRL8CkYNaVK
+Sji8cGL0HGLFNbaC0it+lo6IsxLyynUnZ3KtyTkgbOP0KqwIBjcki2uJK3VDPOFV
+W2XgFtkXJBk=
 -----END ENCRYPTED PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.dated.resp b/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.dated.resp
index 5026d12bd..869c68828 100644
--- a/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.dated.resp
+++ b/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.dated.resp
diff --git a/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.good.resp b/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.good.resp
index 9b13288ec..fc65cf884 100644
--- a/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.good.resp
+++ b/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.good.resp
diff --git a/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.req b/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.req
index 771fbc644..1e47dbae9 100644
--- a/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.req
+++ b/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.req
diff --git a/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.revoked.resp b/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.revoked.resp
index 9b13288ec..fc65cf884 100644
--- a/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.revoked.resp
+++ b/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.revoked.resp
diff --git a/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.signer.dated.resp b/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.signer.dated.resp
index b349d3d1c..797095234 100644
--- a/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.signer.dated.resp
+++ b/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.signer.dated.resp
diff --git a/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.signer.good.resp b/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.signer.good.resp
index d1d340efd..58e49b81c 100644
--- a/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.signer.good.resp
+++ b/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.signer.good.resp
diff --git a/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.signer.revoked.resp b/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.signer.revoked.resp
index d1d340efd..58e49b81c 100644
--- a/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.signer.revoked.resp
+++ b/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.signer.revoked.resp
diff --git a/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.signernocert.dated.resp b/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.signernocert.dated.resp
index ae782e40c..f7a1bc0ca 100644
--- a/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.signernocert.dated.resp
+++ b/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.signernocert.dated.resp
diff --git a/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.signernocert.good.resp b/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.signernocert.good.resp
index 132bb9193..4a470f476 100644
--- a/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.signernocert.good.resp
+++ b/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.signernocert.good.resp
diff --git a/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.signernocert.revoked.resp b/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.signernocert.revoked.resp
index 132bb9193..4a470f476 100644
--- a/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.signernocert.revoked.resp
+++ b/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.signernocert.revoked.resp
diff --git a/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.p12 b/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.p12
index 48264feec..819aeb2bd 100644
--- a/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.p12
+++ b/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.p12
diff --git a/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.pem b/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.pem
index 109ba95b7..6d9e39f70 100644
--- a/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.pem
+++ b/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.pem
@@ -1,21 +1,22 @@
 Bag Attributes
     friendlyName: server2.example.org
-    localKeyID: F2 22 5F 3C 18 C2 87 76 E0 B3 30 CE 6A 44 7B 4F 15 9B 58 3A 
+    localKeyID: 47 5B FC F4 25 CB 73 1B B7 F6 A3 FC 30 38 7A 68 BC CC F8 36 
 subject=/CN=server2.example.org
 issuer=/O=example.org/CN=clica Signing Cert rsa
 -----BEGIN CERTIFICATE-----
-MIICjDCCAfWgAwIBAgICAMkwDQYJKoZIhvcNAQELBQAwNzEUMBIGA1UEChMLZXhh
+MIICszCCAhygAwIBAgICAMkwDQYJKoZIhvcNAQELBQAwNzEUMBIGA1UEChMLZXhh
 bXBsZS5vcmcxHzAdBgNVBAMTFmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwHhcNMTIx
-MTAxMTIzNDAyWhcNMzcxMjAxMTIzNDAyWjAeMRwwGgYDVQQDExNzZXJ2ZXIyLmV4
-YW1wbGUub3JnMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC5BlHN8UOr/LlK
-VpPJZWRtbucPRiAUWJJp5leYn+/zbAXYPNoRbV+eaUPUTkOaLbcEQk7GWw7qFPzD
-K3voal1kELERvlr4OONx6/sYuDpF64zFHW4PXhSgo+sYiM/tEkIC2cyxr82iVX4d
-S45OgYpBzGDvv9aiai871VJMd9O2kwIDAQABo4G/MIG8MA4GA1UdDwEB/wQEAwIE
-8DAgBgNVHSUBAf8EFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwMgYDVR0fBCswKTAn
-oCWgI4YhaHR0cDovL2NybC5leGFtcGxlLm9yZy9sYXRlc3QuY3JsMDQGCCsGAQUF
-BwEBBCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29zY3AuZXhhbXBsZS5vcmcvMB4G
-A1UdEQQXMBWCE3NlcnZlcjIuZXhhbXBsZS5vcmcwDQYJKoZIhvcNAQELBQADgYEA
-bTzC8dtmbbqFpn6huub316XONZIeRKPhGY9Rb1UsUCD7KtMvUkArGmz7p39VS0iE
-+ffBvvtggteJGs8xZ79a3110Y7Bx0ASIt1wa4+vaVAu/Ujx3r1vLDZYwq+Dl3fAq
-1oaFvoD9ANg+FYcjiybT96eKTCT1IXuKs86aTj2jAeo=
+MTAxMTIzNDExWhcNMzcxMjAxMTIzNDExWjAeMRwwGgYDVQQDExNzZXJ2ZXIyLmV4
+YW1wbGUub3JnMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC70Nv1NGdZdi8F
+z6rvHHUc2xgq0KiMqjlW78JzKFmN5wgTReCtwHwlRA/32vOyGy1CjDzKzPaRVFCW
+zczMymPoWXFRTctjm1Rd1CMDRCfkzcM4xrYbGW0x442KbR3lmR26tyx7QGU63hSn
+U9+7krRwZOa8YX6PKqD4mSt8H40XZwIDAQABo4HmMIHjMA4GA1UdDwEB/wQEAwIE
+8DAgBgNVHSUBAf8EFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwTgYDVR0jBEcwRYAN
+QUFidHdDeGNYZ2IwUaExpC8wLTEUMBIGA1UEChMLZXhhbXBsZS5jb20xFTATBgNV
+BAMTDGNsaWNhIENBIHJzYYIBQjA0BggrBgEFBQcBAQQoMCYwJAYIKwYBBQUHMAGG
+GGh0dHA6Ly9vc2NwLmV4YW1wbGUub3JnLzApBgNVHREEIjAgghNzZXJ2ZXIyLmV4
+YW1wbGUub3JnggkqLnRlc3QuZXgwDQYJKoZIhvcNAQELBQADgYEAA9xxXPwknAZ8
+X9oVnp6Fi4CPb+GUxm1CLDsOhWwdshzhQ9m+pa1Y1BSDIqxS9ZZ2o7J1OG7ZP5K3
+H7P4vFC4mEfHX5LsVBclVDzIjgzTbBCjDslwZwh5tS+l68brqRGgtPoFEpIJNZ17
+8/GHhJrBr04AOWFaa11qPKAHtWcGzoA=
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.unlocked.key b/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.unlocked.key
index d4fc65314..9cc6efaa2 100644
--- a/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.unlocked.key
+++ b/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.unlocked.key
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICWwIBAAKBgQC5BlHN8UOr/LlKVpPJZWRtbucPRiAUWJJp5leYn+/zbAXYPNoR
-bV+eaUPUTkOaLbcEQk7GWw7qFPzDK3voal1kELERvlr4OONx6/sYuDpF64zFHW4P
-XhSgo+sYiM/tEkIC2cyxr82iVX4dS45OgYpBzGDvv9aiai871VJMd9O2kwIDAQAB
-AoGABBhWNispVsSkqzcIVVRHqT5jocxpCFo/f1WIScn8axRQes05/FnB3IUy6Z+D
-0oVBgDghezVnupmVUJKFTwsPnw40/yKkcBxKCJPNzs/WhQjdJs1a2HW3uQISFnQs
-kMe7cwW+nv5ku1iN7QlRTmW7hSTKptdwX8TusvHorwnqNVUCQQDjHjfF6gK2GnpI
-YwF5OIdcCHkfzok7UUb6ONA8HUfOYe3uly2cXKq8Ar67/Ae7v/PSz05KR+aHr3zj
-RMFShkhvAkEA0I3C012AGrffDBjSCTTy/7trwggKDTLw3SBojR0T31LBfhzD3/RS
-h7JUi837DRtsioEEXcgOhEIsFgjJmyeeHQJAGvRhJioJvFcUIDcv25Ur625OAcpf
-WxzgUZ4giKHo/cN9m41xqlcNJFcnD+Rvfobfhyt3XTV/VKctKUPltceeHQJADt4M
-RYUk3MK+493hG0brC9AQnoR0MvyurxTgXy7ze7gqkxL5471HJOVRoaXNf+G0mysX
-ZJgecM9G1UtLFAR/AQJARcXGcLgixR6dPcw7ZAB1uUaVx5YBmxa+gxqYdTYUEJou
-zUS2ot33BFwNLFJ8vBWCoFNVD8tm+8CxwbWLK9+rFA==
+MIICXQIBAAKBgQC70Nv1NGdZdi8Fz6rvHHUc2xgq0KiMqjlW78JzKFmN5wgTReCt
+wHwlRA/32vOyGy1CjDzKzPaRVFCWzczMymPoWXFRTctjm1Rd1CMDRCfkzcM4xrYb
+GW0x442KbR3lmR26tyx7QGU63hSnU9+7krRwZOa8YX6PKqD4mSt8H40XZwIDAQAB
+AoGAF776cHAluPvmShfNhtnUPMe+sHsdNFu5UDKUJTcuy3AwZy9ojs9NYvDODApU
+0Wn6OPW+Ie30Jr/ASLDQefwE0X3HyatJB42glxsfJEc2Oslqib+Ip0K8JRRQYWZe
+1OprThsbE+q3Un0SNFEaCnVbwEl12W3Te9WSMdRuocNdQmECQQD5C5neFlDBC6mz
+4RJW8i3+uewMVW3RCC7ro+MCqTajtY22vJba150eXzC2Wl6g9OPtmJttP4k2l7OS
+ccEcSfMZAkEAwQ+I/4j9o1jultOpq7IZcCVwv/z7xra0es18cqq19tJBMdVSRHTs
+pM7wrIZtVmY1vGIfHEIvYeZQgAHF04cufwJAKGErJ4kyurorX9EEajiGIKEAltdb
+IONUyDwgWJQbGdwcCB73zq/a98uzWD26zhomwqVVvhbpJoLeSMZM60tKMQJBALzO
+kZ++/LaseaF93RhyNBiONSc9pYngEr9qiMOnmg+J7oJq6mrSosBHNe60BOgTS4gx
+udUsESTAVofps+u778cCQQD2bET8jaH8K2gYvKLXpIARxYZ3thWV78CO5XwjtcVD
+QBsRU3aY+GLtncGBvYyD6CjRAEnjV71toYW0QupLwul9
 -----END RSA PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example_ec.com/BLANK/CA.pem b/test/aux-fixed/exim-ca/example_ec.com/BLANK/CA.pem
index 515af39b6..f0268a6eb 100644
--- a/test/aux-fixed/exim-ca/example_ec.com/BLANK/CA.pem
+++ b/test/aux-fixed/exim-ca/example_ec.com/BLANK/CA.pem
@@ -1,13 +1,13 @@
 -----BEGIN CERTIFICATE-----
-MIIB+zCCAVygAwIBAgIBATAKBggqhkjOPQQDAjAvMRcwFQYDVQQKDA5leGFtcGxl
-X2VjLmNvbTEUMBIGA1UEAxMLY2xpY2EgQ0EgZWMwHhcNMTIxMTAxMTIzNDA0WhcN
-MzgwMTAxMTIzNDA0WjAvMRcwFQYDVQQKDA5leGFtcGxlX2VjLmNvbTEUMBIGA1UE
-AxMLY2xpY2EgQ0EgZWMwgZswEAYHKoZIzj0CAQYFK4EEACMDgYYABAHm9U9VOWgT
-kXnFOEy1kfkVx0n/XZygNm1Z+WnyU3Nt/c7b8m/Xwv4/VZO9bYm9dENOjT5+FHZ6
-MyJVIZVsYIfmlgG7BGeHDUzgLkmm30rM+QKU8pMNIMUggwY3CtV7tdeX/T/dtayh
-uxB2oyHvv2jGLIi1P8d4k87/9JWjvhfIjS6ImqMmMCQwEgYDVR0TAQH/BAgwBgEB
-/wIBATAOBgNVHQ8BAf8EBAMCAQYwCgYIKoZIzj0EAwIDgYwAMIGIAkIBEFmSdl+a
-k48M4+Ntzzkt+U0CfFIsW86KpYe0BcYjrNUVOUGu7s7RmFgMjYmGrWNCCJ2PNL9x
-eXwyFQMITjEvYy0CQgGl5U/yWaqe/PGKEQmyvhlcXF6ylv4iJES2SFlyhdqEFqrT
-biYVM/zSvSn2K3B3c/JHA4L21LcUjAPi8cphpgVIEQ==
+MIIB+zCCAVygAwIBAgIBQTAKBggqhkjOPQQDAjAvMRcwFQYDVQQKDA5leGFtcGxl
+X2VjLmNvbTEUMBIGA1UEAxMLY2xpY2EgQ0EgZWMwHhcNMTIxMTAxMTIzNDIwWhcN
+MzgwMTAxMTIzNDIwWjAvMRcwFQYDVQQKDA5leGFtcGxlX2VjLmNvbTEUMBIGA1UE
+AxMLY2xpY2EgQ0EgZWMwgZswEAYHKoZIzj0CAQYFK4EEACMDgYYABAAXQLXIfCeo
+dnmboScyJ5dutaJijb0+oh2RbMyC6wf+05xD0aR1ioteDwz+BL6tIAd8m/8ILrfh
+LpQbdCjS7k+0BwE1EqYUBN8WYWC59RcaA0CmhDaDybQYTlj1gZtBtA2H3wagWHrZ
+hKiZzX2xUfaTNHokyMRDzOA0FGkKj3djDMc9xaMmMCQwEgYDVR0TAQH/BAgwBgEB
+/wIBATAOBgNVHQ8BAf8EBAMCAQYwCgYIKoZIzj0EAwIDgYwAMIGIAkIBJxJzvmFu
+PGMjQKq8PANizWysjs/wS/RJC+GLLI117h3F2o/+eEK8vrQWqA6dxpOuXL17N48p
+PDvrjw1xwuW/PYsCQgD29BcHYyxgEnbvHdsKhD27J1y3ruVjYH64KhNzM/hmwnve
+wIMlDH5gu/t7HjKVJyEv2NpUvGPWtIaMupIHtwAMlQ==
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example_ec.com/BLANK/Signer.pem b/test/aux-fixed/exim-ca/example_ec.com/BLANK/Signer.pem
index e5e865cbe..6941a5ec0 100644
--- a/test/aux-fixed/exim-ca/example_ec.com/BLANK/Signer.pem
+++ b/test/aux-fixed/exim-ca/example_ec.com/BLANK/Signer.pem
@@ -1,14 +1,14 @@
 -----BEGIN CERTIFICATE-----
-MIICOTCCAZqgAwIBAgIBAjAKBggqhkjOPQQDAjAvMRcwFQYDVQQKDA5leGFtcGxl
-X2VjLmNvbTEUMBIGA1UEAxMLY2xpY2EgQ0EgZWMwHhcNMTIxMTAxMTIzNDA0WhcN
-MzgwMTAxMTIzNDA0WjA5MRcwFQYDVQQKDA5leGFtcGxlX2VjLmNvbTEeMBwGA1UE
+MIICHDCCAX6gAwIBAgIBQjAKBggqhkjOPQQDAjAvMRcwFQYDVQQKDA5leGFtcGxl
+X2VjLmNvbTEUMBIGA1UEAxMLY2xpY2EgQ0EgZWMwHhcNMTIxMTAxMTIzNDIwWhcN
+MzgwMTAxMTIzNDIwWjA5MRcwFQYDVQQKDA5leGFtcGxlX2VjLmNvbTEeMBwGA1UE
 AxMVY2xpY2EgU2lnbmluZyBDZXJ0IGVjMIGbMBAGByqGSM49AgEGBSuBBAAjA4GG
-AAQB3RMF5qTA8Mhf1/DtiauE272gyO6MJmiYGJn16gwbUU4J8PIXHXDKH5O5Y99z
-0xYrhX+eLTuNvTA0O8O1DkLGpeQAyo65/kRq+B6zWhCIXkl1/Tqqx6WM3kF0xHfb
-7xKeorKtz8cToLXFw5SscZNVv32S9rnKTxwif3+7dgaC1eVKWjyjWjBYMA4GA1Ud
-DwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMDIGA1UdHwQrMCkwJ6AloCOG
-IWh0dHA6Ly9jcmwuZXhhbXBsZS5jb20vbGF0ZXN0LmNybDAKBggqhkjOPQQDAgOB
-jAAwgYgCQgC7QqFcSVRN5pZoaHw6Z1no0QjnpzcGHEO/kI7XNg2q+u41Xk96DE85
-jTs+ryef/GJ9scPeShvxOOaXlutP7RKL9wJCAaa6Un0wubdhy5djZ3Qv09kRt/XT
-jLkY6s1aiotpl5mX+puxLRutrLML1w3ZACe2Ippibv3Puvg2I3eaJyVjg76q
+AAQAw20Nx/YXlmEa0JcVzx0RJJR0Q0WJAI0r6IaTktmSGBaI7xjWAz+FQnOmhnTT
+f6fmr6Y30JkXMx0a1jbT8xbkabMA1cwE3+sPGmJb5U8u7LSQLtoBqGu/wJcJzgxh
+Hjfu6dWTvQy9XGwJ9zfUYO6OCqxOCwPDUwclf6ATkR/+CYNKtQKjPjA8MA4GA1Ud
+DwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMBYGA1UdDgQPBA1BQWJ0d0N4
+Y1hnYjBRMAoGCCqGSM49BAMCA4GLADCBhwJCAJu3rvJkTBkF1a2NSnfBMsohguO1
+1WcdT7ltCQDPRPWkZGWSpgEWoUG2TRQxFh2pOO6J/NPWiny7u+ZwBExF2sZ1AkEq
+dxwepzCXqpqKoICJiX1F2974SRgmDNfSmzNG0X/d2d0Z2X15va5vK0oBH8rvIlmw
+mdV3uhlmoNhmqUHEuqKUhA==
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example_ec.com/BLANK/cert8.db b/test/aux-fixed/exim-ca/example_ec.com/BLANK/cert8.db
index 4e07781d4..61e31f072 100644
--- a/test/aux-fixed/exim-ca/example_ec.com/BLANK/cert8.db
+++ b/test/aux-fixed/exim-ca/example_ec.com/BLANK/cert8.db
diff --git a/test/aux-fixed/exim-ca/example_ec.com/BLANK/key3.db b/test/aux-fixed/exim-ca/example_ec.com/BLANK/key3.db
index 793190674..ab4379d1f 100644
--- a/test/aux-fixed/exim-ca/example_ec.com/BLANK/key3.db
+++ b/test/aux-fixed/exim-ca/example_ec.com/BLANK/key3.db
diff --git a/test/aux-fixed/exim-ca/example_ec.com/CA/CA.pem b/test/aux-fixed/exim-ca/example_ec.com/CA/CA.pem
index 515af39b6..f0268a6eb 100644
--- a/test/aux-fixed/exim-ca/example_ec.com/CA/CA.pem
+++ b/test/aux-fixed/exim-ca/example_ec.com/CA/CA.pem
@@ -1,13 +1,13 @@
 -----BEGIN CERTIFICATE-----
-MIIB+zCCAVygAwIBAgIBATAKBggqhkjOPQQDAjAvMRcwFQYDVQQKDA5leGFtcGxl
-X2VjLmNvbTEUMBIGA1UEAxMLY2xpY2EgQ0EgZWMwHhcNMTIxMTAxMTIzNDA0WhcN
-MzgwMTAxMTIzNDA0WjAvMRcwFQYDVQQKDA5leGFtcGxlX2VjLmNvbTEUMBIGA1UE
-AxMLY2xpY2EgQ0EgZWMwgZswEAYHKoZIzj0CAQYFK4EEACMDgYYABAHm9U9VOWgT
-kXnFOEy1kfkVx0n/XZygNm1Z+WnyU3Nt/c7b8m/Xwv4/VZO9bYm9dENOjT5+FHZ6
-MyJVIZVsYIfmlgG7BGeHDUzgLkmm30rM+QKU8pMNIMUggwY3CtV7tdeX/T/dtayh
-uxB2oyHvv2jGLIi1P8d4k87/9JWjvhfIjS6ImqMmMCQwEgYDVR0TAQH/BAgwBgEB
-/wIBATAOBgNVHQ8BAf8EBAMCAQYwCgYIKoZIzj0EAwIDgYwAMIGIAkIBEFmSdl+a
-k48M4+Ntzzkt+U0CfFIsW86KpYe0BcYjrNUVOUGu7s7RmFgMjYmGrWNCCJ2PNL9x
-eXwyFQMITjEvYy0CQgGl5U/yWaqe/PGKEQmyvhlcXF6ylv4iJES2SFlyhdqEFqrT
-biYVM/zSvSn2K3B3c/JHA4L21LcUjAPi8cphpgVIEQ==
+MIIB+zCCAVygAwIBAgIBQTAKBggqhkjOPQQDAjAvMRcwFQYDVQQKDA5leGFtcGxl
+X2VjLmNvbTEUMBIGA1UEAxMLY2xpY2EgQ0EgZWMwHhcNMTIxMTAxMTIzNDIwWhcN
+MzgwMTAxMTIzNDIwWjAvMRcwFQYDVQQKDA5leGFtcGxlX2VjLmNvbTEUMBIGA1UE
+AxMLY2xpY2EgQ0EgZWMwgZswEAYHKoZIzj0CAQYFK4EEACMDgYYABAAXQLXIfCeo
+dnmboScyJ5dutaJijb0+oh2RbMyC6wf+05xD0aR1ioteDwz+BL6tIAd8m/8ILrfh
+LpQbdCjS7k+0BwE1EqYUBN8WYWC59RcaA0CmhDaDybQYTlj1gZtBtA2H3wagWHrZ
+hKiZzX2xUfaTNHokyMRDzOA0FGkKj3djDMc9xaMmMCQwEgYDVR0TAQH/BAgwBgEB
+/wIBATAOBgNVHQ8BAf8EBAMCAQYwCgYIKoZIzj0EAwIDgYwAMIGIAkIBJxJzvmFu
+PGMjQKq8PANizWysjs/wS/RJC+GLLI117h3F2o/+eEK8vrQWqA6dxpOuXL17N48p
+PDvrjw1xwuW/PYsCQgD29BcHYyxgEnbvHdsKhD27J1y3ruVjYH64KhNzM/hmwnve
+wIMlDH5gu/t7HjKVJyEv2NpUvGPWtIaMupIHtwAMlQ==
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example_ec.com/CA/OCSP.key b/test/aux-fixed/exim-ca/example_ec.com/CA/OCSP.key
new file mode 100644
index 000000000..170a27bb4
--- /dev/null
+++ b/test/aux-fixed/exim-ca/example_ec.com/CA/OCSP.key
@@ -0,0 +1,12 @@
+Bag Attributes
+    friendlyName: OCSP Signer ec
+    localKeyID: BC D3 C4 37 52 87 1A C3 A8 63 06 2D 55 80 03 A5 3A C6 83 E0 
+Key Attributes: <No Attributes>
+-----BEGIN PRIVATE KEY-----
+MIHuAgEAMBAGByqGSM49AgEGBSuBBAAjBIHWMIHTAgEBBEIBy3XpuL9qUDls6t3P
+iapcTXtlxgZba66o5X7zU6xusnPlNmpQUHzzQS+g1wXC6QMn+wy/EzD3SE+QqxXN
+ZJBQIQihgYkDgYYABAAdYRQlRVlZgKT0o9gJUDkDjM+ixLwCZHn7FcoC7U/DVq6n
+UPJP1IjGMyVMO7/PBRCrAVgBnro2X8UmGSEKpTsV5QGYaE2xnHczPpzYxRU9HKJ0
+X7BSCDeDCfuSK0W0TNVIEty56PrDedL/BDEixHOEiggt4vfyxFFzyALgTQvkdbQ8
+gQ==
+-----END PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example_ec.com/CA/OCSP.p12 b/test/aux-fixed/exim-ca/example_ec.com/CA/OCSP.p12
new file mode 100644
index 000000000..bf832fbc5
--- /dev/null
+++ b/test/aux-fixed/exim-ca/example_ec.com/CA/OCSP.p12
diff --git a/test/aux-fixed/exim-ca/example_ec.com/CA/OCSP.pem b/test/aux-fixed/exim-ca/example_ec.com/CA/OCSP.pem
index 7ec75d2e4..5795374a5 100644
--- a/test/aux-fixed/exim-ca/example_ec.com/CA/OCSP.pem
+++ b/test/aux-fixed/exim-ca/example_ec.com/CA/OCSP.pem
@@ -1,14 +1,14 @@
 -----BEGIN CERTIFICATE-----
-MIICEjCCAXOgAwIBAgIBAzAKBggqhkjOPQQDAjA5MRcwFQYDVQQKDA5leGFtcGxl
+MIICEDCCAXOgAwIBAgIBQzAKBggqhkjOPQQDAjA5MRcwFQYDVQQKDA5leGFtcGxl
 X2VjLmNvbTEeMBwGA1UEAxMVY2xpY2EgU2lnbmluZyBDZXJ0IGVjMB4XDTEyMTEw
-MTEyMzQwNFoXDTM4MDEwMTEyMzQwNFowODEXMBUGA1UECgwOZXhhbXBsZV9lYy5j
+MTEyMzQyMFoXDTM4MDEwMTEyMzQyMFowODEXMBUGA1UECgwOZXhhbXBsZV9lYy5j
 b20xHTAbBgNVBAMTFGNsaWNhIE9DU1AgU2lnbmVyIGVjMIGbMBAGByqGSM49AgEG
-BSuBBAAjA4GGAAQAJynCmmornvQ63iMqF0W+P5TRPMw0O53ePt6N20Tl41dod1IK
-LQsK7x15ylstBH3yJZKxIRLasdASeUMBAqMvTqsB7Ltvh9GoIWQls/K4tu6gTjfc
-0i9maAEsXUx4MfK+tEcZe4Z7bhUqthxRUULbq9MRFsh3+dFr9SheK9zdbJCdmzCj
+BSuBBAAjA4GGAAQAHWEUJUVZWYCk9KPYCVA5A4zPosS8AmR5+xXKAu1Pw1aup1Dy
+T9SIxjMlTDu/zwUQqwFYAZ66Nl/FJhkhCqU7FeUBmGhNsZx3Mz6c2MUVPRyidF+w
+Ugg3gwn7kitFtEzVSBLcuej6w3nS/wQxIsRzhIoILeL38sRRc8gC4E0L5HW0PIGj
 KjAoMA4GA1UdDwEB/wQEAwIHgDAWBgNVHSUBAf8EDDAKBggrBgEFBQcDCTAKBggq
-hkjOPQQDAgOBjAAwgYgCQgFCPxemEF+1AqOGRumb3Znk2x/xBMAQ1H3iqRwsaiCm
-Ai01OHvff7b6O15nQljA/RWoU60pZ3ugva1t5SIvkAuwTwJCAcIbZORgJ9Lt2Zj4
-BObSUFgEbsI1OM6rKrI85+ITFyy2lRk+VSuoQMctK3aw4xuMuerEp+1O6YuWNflF
-/SUBW7uU
+hkjOPQQDAgOBigAwgYYCQTbWMszoda9R/XXyM95MExJSXbWeyKQM2J260YguzZEo
+hfL/+hUFIsPur5ni7+0JFfEabOj6vIiK2hm0cKcc5I0YAkFOw6ZjsDlPtGtQ+NMU
+1598oZuBl0V1JlBkQbNmRUUN/vbO0ixvD6e52NeGt0oPsrD6gA8mUjqjlO/p+/Pt
+um9xmg==
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example_ec.com/CA/Signer.pem b/test/aux-fixed/exim-ca/example_ec.com/CA/Signer.pem
index e5e865cbe..6941a5ec0 100644
--- a/test/aux-fixed/exim-ca/example_ec.com/CA/Signer.pem
+++ b/test/aux-fixed/exim-ca/example_ec.com/CA/Signer.pem
@@ -1,14 +1,14 @@
 -----BEGIN CERTIFICATE-----
-MIICOTCCAZqgAwIBAgIBAjAKBggqhkjOPQQDAjAvMRcwFQYDVQQKDA5leGFtcGxl
-X2VjLmNvbTEUMBIGA1UEAxMLY2xpY2EgQ0EgZWMwHhcNMTIxMTAxMTIzNDA0WhcN
-MzgwMTAxMTIzNDA0WjA5MRcwFQYDVQQKDA5leGFtcGxlX2VjLmNvbTEeMBwGA1UE
+MIICHDCCAX6gAwIBAgIBQjAKBggqhkjOPQQDAjAvMRcwFQYDVQQKDA5leGFtcGxl
+X2VjLmNvbTEUMBIGA1UEAxMLY2xpY2EgQ0EgZWMwHhcNMTIxMTAxMTIzNDIwWhcN
+MzgwMTAxMTIzNDIwWjA5MRcwFQYDVQQKDA5leGFtcGxlX2VjLmNvbTEeMBwGA1UE
 AxMVY2xpY2EgU2lnbmluZyBDZXJ0IGVjMIGbMBAGByqGSM49AgEGBSuBBAAjA4GG
-AAQB3RMF5qTA8Mhf1/DtiauE272gyO6MJmiYGJn16gwbUU4J8PIXHXDKH5O5Y99z
-0xYrhX+eLTuNvTA0O8O1DkLGpeQAyo65/kRq+B6zWhCIXkl1/Tqqx6WM3kF0xHfb
-7xKeorKtz8cToLXFw5SscZNVv32S9rnKTxwif3+7dgaC1eVKWjyjWjBYMA4GA1Ud
-DwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMDIGA1UdHwQrMCkwJ6AloCOG
-IWh0dHA6Ly9jcmwuZXhhbXBsZS5jb20vbGF0ZXN0LmNybDAKBggqhkjOPQQDAgOB
-jAAwgYgCQgC7QqFcSVRN5pZoaHw6Z1no0QjnpzcGHEO/kI7XNg2q+u41Xk96DE85
-jTs+ryef/GJ9scPeShvxOOaXlutP7RKL9wJCAaa6Un0wubdhy5djZ3Qv09kRt/XT
-jLkY6s1aiotpl5mX+puxLRutrLML1w3ZACe2Ippibv3Puvg2I3eaJyVjg76q
+AAQAw20Nx/YXlmEa0JcVzx0RJJR0Q0WJAI0r6IaTktmSGBaI7xjWAz+FQnOmhnTT
+f6fmr6Y30JkXMx0a1jbT8xbkabMA1cwE3+sPGmJb5U8u7LSQLtoBqGu/wJcJzgxh
+Hjfu6dWTvQy9XGwJ9zfUYO6OCqxOCwPDUwclf6ATkR/+CYNKtQKjPjA8MA4GA1Ud
+DwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMBYGA1UdDgQPBA1BQWJ0d0N4
+Y1hnYjBRMAoGCCqGSM49BAMCA4GLADCBhwJCAJu3rvJkTBkF1a2NSnfBMsohguO1
+1WcdT7ltCQDPRPWkZGWSpgEWoUG2TRQxFh2pOO6J/NPWiny7u+ZwBExF2sZ1AkEq
+dxwepzCXqpqKoICJiX1F2974SRgmDNfSmzNG0X/d2d0Z2X15va5vK0oBH8rvIlmw
+mdV3uhlmoNhmqUHEuqKUhA==
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example_ec.com/CA/ca.conf b/test/aux-fixed/exim-ca/example_ec.com/CA/ca.conf
index b13709f72..3b92e93ae 100644
--- a/test/aux-fixed/exim-ca/example_ec.com/CA/ca.conf
+++ b/test/aux-fixed/exim-ca/example_ec.com/CA/ca.conf
@@ -1,18 +1,18 @@
 ; Config::Simple 4.59
-; Thu Nov  1 12:34:04 2012
-
-[CA]
-subject=clica CA
-org=example_ec.com
-name=Certificate Authority ec
-bits=1024
+; Thu Nov  1 12:34:20 2012
 
 [CLICA]
-ocsp_signer=OCSP Signer ec
 signer=Signing Cert ec
 crl_url=http://crl.example.com/latest.crl
-sighash=SHA256
 level=1
+sighash=SHA256
+ocsp_signer=OCSP Signer ec
 ocsp_url=http://oscp.example.com/
 
+[CA]
+org=example_ec.com
+name=Certificate Authority ec
+bits=1024
+subject=clica CA
+
 
diff --git a/test/aux-fixed/exim-ca/example_ec.com/CA/cert8.db b/test/aux-fixed/exim-ca/example_ec.com/CA/cert8.db
index 4b0f5a88f..4def9efbf 100644
--- a/test/aux-fixed/exim-ca/example_ec.com/CA/cert8.db
+++ b/test/aux-fixed/exim-ca/example_ec.com/CA/cert8.db
diff --git a/test/aux-fixed/exim-ca/example_ec.com/CA/index.valid.txt b/test/aux-fixed/exim-ca/example_ec.com/CA/index.valid.txt
new file mode 100644
index 000000000..4dc4d2d63
--- /dev/null
+++ b/test/aux-fixed/exim-ca/example_ec.com/CA/index.valid.txt
@@ -0,0 +1 @@
+V	130110200751Z		65	unknown	CN=server1.example_ec.com
diff --git a/test/aux-fixed/exim-ca/example_ec.com/CA/key3.db b/test/aux-fixed/exim-ca/example_ec.com/CA/key3.db
index 0c53c21d8..501f8b190 100644
--- a/test/aux-fixed/exim-ca/example_ec.com/CA/key3.db
+++ b/test/aux-fixed/exim-ca/example_ec.com/CA/key3.db
diff --git a/test/aux-fixed/exim-ca/example_ec.com/CA/noise.file b/test/aux-fixed/exim-ca/example_ec.com/CA/noise.file
index 0627cdd21..2115608e5 100644
--- a/test/aux-fixed/exim-ca/example_ec.com/CA/noise.file
+++ b/test/aux-fixed/exim-ca/example_ec.com/CA/noise.file
@@ -46,7 +46,7 @@ cpuid level	: 22
 wp		: yes
 flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc art arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf tsc_known_freq pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch cpuid_fault epb intel_pt tpr_shadow vnmi flexpriority ept vpid fsgsbase tsc_adjust bmi1 hle avx2 smep bmi2 erms invpcid rtm mpx rdseed adx smap clflushopt xsaveopt xsavec xgetbv1 xsaves dtherm ida arat pln pts hwp hwp_notify hwp_act_window hwp_epp
 bugs		:
-bogomips	: 5431.34
+bogomips	: 5424.00
 clflush size	: 64
 cache_alignment	: 64
 address sizes	: 39 bits physical, 48 bits virtual
@@ -73,7 +73,7 @@ cpuid level	: 22
 wp		: yes
 flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc art arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf tsc_known_freq pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch cpuid_fault epb intel_pt tpr_shadow vnmi flexpriority ept vpid fsgsbase tsc_adjust bmi1 hle avx2 smep bmi2 erms invpcid rtm mpx rdseed adx smap clflushopt xsaveopt xsavec xgetbv1 xsaves dtherm ida arat pln pts hwp hwp_notify hwp_act_window hwp_epp
 bugs		:
-bogomips	: 5431.79
+bogomips	: 5424.00
 clflush size	: 64
 cache_alignment	: 64
 address sizes	: 39 bits physical, 48 bits virtual
@@ -100,7 +100,7 @@ cpuid level	: 22
 wp		: yes
 flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc art arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf tsc_known_freq pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch cpuid_fault epb intel_pt tpr_shadow vnmi flexpriority ept vpid fsgsbase tsc_adjust bmi1 hle avx2 smep bmi2 erms invpcid rtm mpx rdseed adx smap clflushopt xsaveopt xsavec xgetbv1 xsaves dtherm ida arat pln pts hwp hwp_notify hwp_act_window hwp_epp
 bugs		:
-bogomips	: 5431.63
+bogomips	: 5424.00
 clflush size	: 64
 cache_alignment	: 64
 address sizes	: 39 bits physical, 48 bits virtual
@@ -127,7 +127,7 @@ cpuid level	: 22
 wp		: yes
 flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc art arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf tsc_known_freq pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch cpuid_fault epb intel_pt tpr_shadow vnmi flexpriority ept vpid fsgsbase tsc_adjust bmi1 hle avx2 smep bmi2 erms invpcid rtm mpx rdseed adx smap clflushopt xsaveopt xsavec xgetbv1 xsaves dtherm ida arat pln pts hwp hwp_notify hwp_act_window hwp_epp
 bugs		:
-bogomips	: 5434.63
+bogomips	: 5424.00
 clflush size	: 64
 cache_alignment	: 64
 address sizes	: 39 bits physical, 48 bits virtual
@@ -154,7 +154,7 @@ cpuid level	: 22
 wp		: yes
 flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc art arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf tsc_known_freq pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch cpuid_fault epb intel_pt tpr_shadow vnmi flexpriority ept vpid fsgsbase tsc_adjust bmi1 hle avx2 smep bmi2 erms invpcid rtm mpx rdseed adx smap clflushopt xsaveopt xsavec xgetbv1 xsaves dtherm ida arat pln pts hwp hwp_notify hwp_act_window hwp_epp
 bugs		:
-bogomips	: 5432.00
+bogomips	: 5424.00
 clflush size	: 64
 cache_alignment	: 64
 address sizes	: 39 bits physical, 48 bits virtual
@@ -181,7 +181,7 @@ cpuid level	: 22
 wp		: yes
 flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc art arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf tsc_known_freq pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch cpuid_fault epb intel_pt tpr_shadow vnmi flexpriority ept vpid fsgsbase tsc_adjust bmi1 hle avx2 smep bmi2 erms invpcid rtm mpx rdseed adx smap clflushopt xsaveopt xsavec xgetbv1 xsaves dtherm ida arat pln pts hwp hwp_notify hwp_act_window hwp_epp
 bugs		:
-bogomips	: 5431.94
+bogomips	: 5424.00
 clflush size	: 64
 cache_alignment	: 64
 address sizes	: 39 bits physical, 48 bits virtual
@@ -208,85 +208,86 @@ cpuid level	: 22
 wp		: yes
 flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc art arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf tsc_known_freq pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch cpuid_fault epb intel_pt tpr_shadow vnmi flexpriority ept vpid fsgsbase tsc_adjust bmi1 hle avx2 smep bmi2 erms invpcid rtm mpx rdseed adx smap clflushopt xsaveopt xsavec xgetbv1 xsaves dtherm ida arat pln pts hwp hwp_notify hwp_act_window hwp_epp
 bugs		:
-bogomips	: 5431.94
+bogomips	: 5424.00
 clflush size	: 64
 cache_alignment	: 64
 address sizes	: 39 bits physical, 48 bits virtual
 power management:
 
             CPU0       CPU1       CPU2       CPU3       CPU4       CPU5       CPU6       CPU7       
-   0:         70          0          0          0          0          0          0          0  IR-IO-APIC    2-edge      timer
-   1:         39      16476       1416       1089       6857       1983       1674       1959  IR-IO-APIC    1-edge      i8042
-   8:          0          0          1          0          0          0          0          0  IR-IO-APIC    8-edge      rtc0
-   9:        284       4834       2265       1628       7027       2758       1632       1695  IR-IO-APIC    9-fasteoi   acpi
-  12:        273    1626151      37392      40715     288530      39254      36081      51183  IR-IO-APIC   12-edge      i8042
-  16:          1          0          0          0          0          0          0          0  IR-IO-APIC   16-fasteoi   i801_smbus
+   0:         75          0          0          0          0          0          0          0  IR-IO-APIC    2-edge      timer
+   1:      69775       6441       4183       4351       8821       6710       4808       2655  IR-IO-APIC    1-edge      i8042
+   8:          1          0          0          0          0          0          0          0  IR-IO-APIC    8-edge      rtc0
+   9:     116964      16080      12437      10549      27759      16386      11560       7036  IR-IO-APIC    9-fasteoi   acpi
+  12:    5146732     362636     240016     241533     534196     383274     265445     167959  IR-IO-APIC   12-edge      i8042
+  16:          3          0          0          0          0          0          0          0  IR-IO-APIC   16-fasteoi   i801_smbus
  120:          0          0          0          0          0          0          0          0  DMAR-MSI    0-edge      dmar0
  121:          0          0          0          0          0          0          0          0  DMAR-MSI    1-edge      dmar1
- 122:       7136       3040       2312       1908       4546       3822      75951       2347  IR-PCI-MSI 376832-edge      ahci[0000:00:17.0]
- 123:         22          7          1          0          7          3          4          1  IR-PCI-MSI 327680-edge      xhci_hcd
- 124:         89         19         22         25         79         55         27         54  IR-PCI-MSI 2097152-edge      rtsx_pci
- 125:         88         15     127583         11         48         25         19         21  IR-PCI-MSI 520192-edge      enp0s31f6
- 126:          1          1          1          0          3          1          3          6  IR-PCI-MSI 1048576-edge    
- 127:        561        174         98     789487        240        230        184        147  IR-PCI-MSI 32768-edge      i915
- 128:         34         14          0          0          1          0          0          0  IR-PCI-MSI 360448-edge      mei_me
- 129:         22         10          0          1         10          0          0          0  IR-PCI-MSI 1572864-edge      iwlwifi
- 130:         92        103         30         22        194        115         10         45  IR-PCI-MSI 514048-edge      snd_hda_intel:card0
- NMI:          9         12          9         14         10          9          9         10   Non-maskable interrupts
- LOC:     567811     554960     727313    1034780     584239     592851     624459     549121   Local timer interrupts
+ 122:      40662       2645       2048    8326198       3083       2651       2210       2042  IR-PCI-MSI 376832-edge      ahci[0000:00:17.0]
+ 123:         50          3          7          1          9          3          5          0  IR-PCI-MSI 327680-edge      xhci_hcd
+ 124:        269         24         28         20        104        171         22         48  IR-PCI-MSI 2097152-edge      rtsx_pci
+ 125:         38          0          0          0          0         10          0          4  IR-PCI-MSI 360448-edge      mei_me
+ 126:          2          0          3          0          1          2         24          0  IR-PCI-MSI 1048576-edge    
+ 127:       2247         56         54         23    3783066         37         26         18  IR-PCI-MSI 32768-edge      i915
+ 128:         77          0          0          0          2         32          8          1  IR-PCI-MSI 514048-edge      snd_hda_intel:card0
+ 129:         18          2          0          4          8          0          4      24684  IR-PCI-MSI 1572864-edge      iwlwifi
+ 130:        658          1          0          0          0          8          5   13518769  IR-PCI-MSI 520192-edge      enp0s31f6
+ NMI:        607       2649       2621       2523       2485       2424       2424       2470   Non-maskable interrupts
+ LOC:   29015073   29911050   29754937   28954670   29025214   28522599   28469458   28816918   Local timer interrupts
  SPU:          0          0          0          0          0          0          0          0   Spurious interrupts
- PMI:          9         12          9         14         10          9          9         10   Performance monitoring interrupts
- IWI:          0          1          0          0          0          0          2          0   IRQ work interrupts
- RTR:          7          0          0          0          0          0          0          0   APIC ICR read retries
- RES:      85589      31076      11918       8326       7466       6913       6401       5898   Rescheduling interrupts
- CAL:      73161      74171      68752      70655      80169      75209      61391      70903   Function call interrupts
- TLB:      55150      56119      50377      53791      62195      57072      43366      55765   TLB shootdowns
- TRM:          0          0          0          0          0          0          0          0   Thermal event interrupts
+ PMI:        607       2649       2621       2523       2485       2424       2424       2470   Performance monitoring interrupts
+ IWI:          6          4          3          2         10          4          3          1   IRQ work interrupts
+ RTR:         18          0          0          0          0          0          0          0   APIC ICR read retries
+ RES:    7886120    3950261    2715262    2193596    2474058    1957554    1665522    1988059   Rescheduling interrupts
+ CAL:     987292     866818     901402     885321     915800     938469     935941     966681   Function call interrupts
+ TLB:     231525     195523     218511     215448     205511     204323     194089     201607   TLB shootdowns
+ TRM:    1628003    1628003    1628003    1628003    1628003    1628003    1628003    1628003   Thermal event interrupts
  THR:          0          0          0          0          0          0          0          0   Threshold APIC interrupts
  DFR:          0          0          0          0          0          0          0          0   Deferred Error APIC interrupts
  MCE:          0          0          0          0          0          0          0          0   Machine check exceptions
- MCP:         49         49         49         49         49         49         49         49   Machine check polls
+ MCP:        202        200        200        200        200        200        200        200   Machine check polls
+ HYP:          0          0          0          0          0          0          0          0   Hypervisor callback interrupts
  ERR:          0
  MIS:          0
  PIN:          0          0          0          0          0          0          0          0   Posted-interrupt notification event
  NPI:          0          0          0          0          0          0          0          0   Nested posted-interrupt event
  PIW:          0          0          0          0          0          0          0          0   Posted-interrupt wakeup event
-MemTotal:       15852528 kB
-MemFree:        10535240 kB
-MemAvailable:   12483528 kB
-Buffers:          128136 kB
-Cached:          1542444 kB
-SwapCached:            0 kB
-Active:          3134032 kB
-Inactive:        1817100 kB
-Active(anon):    2706516 kB
-Inactive(anon):    79680 kB
-Active(file):     427516 kB
-Inactive(file):  1737420 kB
-Unevictable:          32 kB
-Mlocked:              32 kB
-SwapTotal:       7933948 kB
-SwapFree:        7933948 kB
-Dirty:              4304 kB
-Writeback:             0 kB
-AnonPages:       2975608 kB
-Mapped:           495648 kB
-Shmem:             80740 kB
-Slab:             143688 kB
-SReclaimable:      74472 kB
-SUnreclaim:        69216 kB
-KernelStack:        9224 kB
-PageTables:        39488 kB
+MemTotal:       16293504 kB
+MemFree:          932716 kB
+MemAvailable:   13702560 kB
+Buffers:          452240 kB
+Cached:         12442300 kB
+SwapCached:       101680 kB
+Active:          2600080 kB
+Inactive:       12196736 kB
+Active(anon):    1356440 kB
+Inactive(anon):   589480 kB
+Active(file):    1243640 kB
+Inactive(file): 11607256 kB
+Unevictable:          64 kB
+Mlocked:              64 kB
+SwapTotal:       8212476 kB
+SwapFree:        7376112 kB
+Dirty:             11472 kB
+Writeback:            40 kB
+AnonPages:       1871864 kB
+Mapped:           415980 kB
+Shmem:            290896 kB
+Slab:             351292 kB
+SReclaimable:     257268 kB
+SUnreclaim:        94024 kB
+KernelStack:       12920 kB
+PageTables:        58508 kB
 NFS_Unstable:          0 kB
 Bounce:                0 kB
 WritebackTmp:          0 kB
-CommitLimit:    15860212 kB
-Committed_AS:   11681028 kB
+CommitLimit:    16359228 kB
+Committed_AS:    7890372 kB
 VmallocTotal:   34359738367 kB
 VmallocUsed:           0 kB
 VmallocChunk:          0 kB
 HardwareCorrupted:     0 kB
-AnonHugePages:    966656 kB
+AnonHugePages:         0 kB
 ShmemHugePages:        0 kB
 ShmemPmdMapped:        0 kB
 CmaTotal:              0 kB
@@ -296,15 +297,14 @@ HugePages_Free:        0
 HugePages_Rsvd:        0
 HugePages_Surp:        0
 Hugepagesize:       2048 kB
-DirectMap4k:      202752 kB
-DirectMap2M:     7602176 kB
-DirectMap1G:     9437184 kB
+DirectMap4k:      523752 kB
+DirectMap2M:    16115712 kB
+DirectMap1G:     1048576 kB
 Inter-|   Receive                                                |  Transmit
  face |bytes    packets errs drop fifo frame compressed multicast|bytes    packets errs drop fifo colls carrier compressed
-virbr1:  353867    2838    0    0    0     0          0         0  1474230    3810    0    0    0     0       0          0
-enp0s31f6: 43450858   65096    0    0    0     0          0      2075  6950121   57094    0    0    0     0       0          0
-virbr1-nic:       0       0    0    0    0     0          0         0        0       0    0    0    0     0       0          0
-tun_wizint: 4130741    7381    0    0    0     0          0         0  1092175    8002    0    0    0     0       0          0
-    lo:    5706      74    0    0    0     0          0         0     5706      74    0    0    0     0       0          0
- vnet0:  393599    2838    0    0    0     0          0         0  1610002    6363    0    0    0     0       0          0
-wlp3s0:       0       0    0    0    0     0          0         0        0       0    0    0    0     0       0          0
+enp0s31f6: 9760816648 13664538    0    0    0     0          0      8965 118421394195 83833297    0    0    0     0       0          0
+wlp3s0: 3643580    7768    0    0    0     0          0         0  4732829    8244    0    0    0     0       0          0
+    lo: 9996035   41708    0    0    0     0          0         0  9996035   41708    0    0    0     0       0          0
+virbr0-nic:       0       0    0    0    0     0          0         0        0       0    0    0    0     0       0          0
+  tun0: 20139456   21861    0    0    0     0          0         0  3370846   19686    0    0    0     0       0          0
+virbr0: 47538577  146404    0    0    0     0          0         0 164360816  210422    0    0    0     0       0          0
diff --git a/test/aux-fixed/exim-ca/example_ec.com/server1.example_ec.com/ca_chain.pem b/test/aux-fixed/exim-ca/example_ec.com/server1.example_ec.com/ca_chain.pem
index 6dc10caf8..3f4a5a533 100644
--- a/test/aux-fixed/exim-ca/example_ec.com/server1.example_ec.com/ca_chain.pem
+++ b/test/aux-fixed/exim-ca/example_ec.com/server1.example_ec.com/ca_chain.pem
@@ -3,33 +3,33 @@ Bag Attributes
 subject=/O=example_ec.com/CN=clica Signing Cert ec
 issuer=/O=example_ec.com/CN=clica CA ec
 -----BEGIN CERTIFICATE-----
-MIICOTCCAZqgAwIBAgIBAjAKBggqhkjOPQQDAjAvMRcwFQYDVQQKDA5leGFtcGxl
-X2VjLmNvbTEUMBIGA1UEAxMLY2xpY2EgQ0EgZWMwHhcNMTIxMTAxMTIzNDA0WhcN
-MzgwMTAxMTIzNDA0WjA5MRcwFQYDVQQKDA5leGFtcGxlX2VjLmNvbTEeMBwGA1UE
+MIICHDCCAX6gAwIBAgIBQjAKBggqhkjOPQQDAjAvMRcwFQYDVQQKDA5leGFtcGxl
+X2VjLmNvbTEUMBIGA1UEAxMLY2xpY2EgQ0EgZWMwHhcNMTIxMTAxMTIzNDIwWhcN
+MzgwMTAxMTIzNDIwWjA5MRcwFQYDVQQKDA5leGFtcGxlX2VjLmNvbTEeMBwGA1UE
 AxMVY2xpY2EgU2lnbmluZyBDZXJ0IGVjMIGbMBAGByqGSM49AgEGBSuBBAAjA4GG
-AAQB3RMF5qTA8Mhf1/DtiauE272gyO6MJmiYGJn16gwbUU4J8PIXHXDKH5O5Y99z
-0xYrhX+eLTuNvTA0O8O1DkLGpeQAyo65/kRq+B6zWhCIXkl1/Tqqx6WM3kF0xHfb
-7xKeorKtz8cToLXFw5SscZNVv32S9rnKTxwif3+7dgaC1eVKWjyjWjBYMA4GA1Ud
-DwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMDIGA1UdHwQrMCkwJ6AloCOG
-IWh0dHA6Ly9jcmwuZXhhbXBsZS5jb20vbGF0ZXN0LmNybDAKBggqhkjOPQQDAgOB
-jAAwgYgCQgC7QqFcSVRN5pZoaHw6Z1no0QjnpzcGHEO/kI7XNg2q+u41Xk96DE85
-jTs+ryef/GJ9scPeShvxOOaXlutP7RKL9wJCAaa6Un0wubdhy5djZ3Qv09kRt/XT
-jLkY6s1aiotpl5mX+puxLRutrLML1w3ZACe2Ippibv3Puvg2I3eaJyVjg76q
+AAQAw20Nx/YXlmEa0JcVzx0RJJR0Q0WJAI0r6IaTktmSGBaI7xjWAz+FQnOmhnTT
+f6fmr6Y30JkXMx0a1jbT8xbkabMA1cwE3+sPGmJb5U8u7LSQLtoBqGu/wJcJzgxh
+Hjfu6dWTvQy9XGwJ9zfUYO6OCqxOCwPDUwclf6ATkR/+CYNKtQKjPjA8MA4GA1Ud
+DwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMBYGA1UdDgQPBA1BQWJ0d0N4
+Y1hnYjBRMAoGCCqGSM49BAMCA4GLADCBhwJCAJu3rvJkTBkF1a2NSnfBMsohguO1
+1WcdT7ltCQDPRPWkZGWSpgEWoUG2TRQxFh2pOO6J/NPWiny7u+ZwBExF2sZ1AkEq
+dxwepzCXqpqKoICJiX1F2974SRgmDNfSmzNG0X/d2d0Z2X15va5vK0oBH8rvIlmw
+mdV3uhlmoNhmqUHEuqKUhA==
 -----END CERTIFICATE-----
 Bag Attributes
     friendlyName: Certificate Authority ec
 subject=/O=example_ec.com/CN=clica CA ec
 issuer=/O=example_ec.com/CN=clica CA ec
 -----BEGIN CERTIFICATE-----
-MIIB+zCCAVygAwIBAgIBATAKBggqhkjOPQQDAjAvMRcwFQYDVQQKDA5leGFtcGxl
-X2VjLmNvbTEUMBIGA1UEAxMLY2xpY2EgQ0EgZWMwHhcNMTIxMTAxMTIzNDA0WhcN
-MzgwMTAxMTIzNDA0WjAvMRcwFQYDVQQKDA5leGFtcGxlX2VjLmNvbTEUMBIGA1UE
-AxMLY2xpY2EgQ0EgZWMwgZswEAYHKoZIzj0CAQYFK4EEACMDgYYABAHm9U9VOWgT
-kXnFOEy1kfkVx0n/XZygNm1Z+WnyU3Nt/c7b8m/Xwv4/VZO9bYm9dENOjT5+FHZ6
-MyJVIZVsYIfmlgG7BGeHDUzgLkmm30rM+QKU8pMNIMUggwY3CtV7tdeX/T/dtayh
-uxB2oyHvv2jGLIi1P8d4k87/9JWjvhfIjS6ImqMmMCQwEgYDVR0TAQH/BAgwBgEB
-/wIBATAOBgNVHQ8BAf8EBAMCAQYwCgYIKoZIzj0EAwIDgYwAMIGIAkIBEFmSdl+a
-k48M4+Ntzzkt+U0CfFIsW86KpYe0BcYjrNUVOUGu7s7RmFgMjYmGrWNCCJ2PNL9x
-eXwyFQMITjEvYy0CQgGl5U/yWaqe/PGKEQmyvhlcXF6ylv4iJES2SFlyhdqEFqrT
-biYVM/zSvSn2K3B3c/JHA4L21LcUjAPi8cphpgVIEQ==
+MIIB+zCCAVygAwIBAgIBQTAKBggqhkjOPQQDAjAvMRcwFQYDVQQKDA5leGFtcGxl
+X2VjLmNvbTEUMBIGA1UEAxMLY2xpY2EgQ0EgZWMwHhcNMTIxMTAxMTIzNDIwWhcN
+MzgwMTAxMTIzNDIwWjAvMRcwFQYDVQQKDA5leGFtcGxlX2VjLmNvbTEUMBIGA1UE
+AxMLY2xpY2EgQ0EgZWMwgZswEAYHKoZIzj0CAQYFK4EEACMDgYYABAAXQLXIfCeo
+dnmboScyJ5dutaJijb0+oh2RbMyC6wf+05xD0aR1ioteDwz+BL6tIAd8m/8ILrfh
+LpQbdCjS7k+0BwE1EqYUBN8WYWC59RcaA0CmhDaDybQYTlj1gZtBtA2H3wagWHrZ
+hKiZzX2xUfaTNHokyMRDzOA0FGkKj3djDMc9xaMmMCQwEgYDVR0TAQH/BAgwBgEB
+/wIBATAOBgNVHQ8BAf8EBAMCAQYwCgYIKoZIzj0EAwIDgYwAMIGIAkIBJxJzvmFu
+PGMjQKq8PANizWysjs/wS/RJC+GLLI117h3F2o/+eEK8vrQWqA6dxpOuXL17N48p
+PDvrjw1xwuW/PYsCQgD29BcHYyxgEnbvHdsKhD27J1y3ruVjYH64KhNzM/hmwnve
+wIMlDH5gu/t7HjKVJyEv2NpUvGPWtIaMupIHtwAMlQ==
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example_ec.com/server1.example_ec.com/cert8.db b/test/aux-fixed/exim-ca/example_ec.com/server1.example_ec.com/cert8.db
index 62ecafcdb..8774b5d05 100644
--- a/test/aux-fixed/exim-ca/example_ec.com/server1.example_ec.com/cert8.db
+++ b/test/aux-fixed/exim-ca/example_ec.com/server1.example_ec.com/cert8.db
diff --git a/test/aux-fixed/exim-ca/example_ec.com/server1.example_ec.com/fullchain.pem b/test/aux-fixed/exim-ca/example_ec.com/server1.example_ec.com/fullchain.pem
index 43648ad2a..2efc0c0ab 100644
--- a/test/aux-fixed/exim-ca/example_ec.com/server1.example_ec.com/fullchain.pem
+++ b/test/aux-fixed/exim-ca/example_ec.com/server1.example_ec.com/fullchain.pem
@@ -1,59 +1,59 @@
 Bag Attributes
     friendlyName: server1.example_ec.com
-    localKeyID: E8 57 D2 D2 59 FF E7 C8 FE 43 26 2F ED 44 08 9F 53 83 10 A4 
+    localKeyID: C0 8B 08 6B D5 CF 5D 2E E2 2F 0A 08 B7 B7 71 96 91 D0 F8 30 
 subject=/CN=server1.example_ec.com
 issuer=/O=example_ec.com/CN=clica Signing Cert ec
 -----BEGIN CERTIFICATE-----
-MIIDADCCAmGgAwIBAgICCDUwCgYIKoZIzj0EAwIwOTEXMBUGA1UECgwOZXhhbXBs
+MIIC/zCCAmGgAwIBAgICCDUwCgYIKoZIzj0EAwIwOTEXMBUGA1UECgwOZXhhbXBs
 ZV9lYy5jb20xHjAcBgNVBAMTFWNsaWNhIFNpZ25pbmcgQ2VydCBlYzAeFw0xMjEx
-MDExMjM0MDRaFw0zNzEyMDExMjM0MDRaMCExHzAdBgNVBAMMFnNlcnZlcjEuZXhh
-bXBsZV9lYy5jb20wgZswEAYHKoZIzj0CAQYFK4EEACMDgYYABAC5lSGys4Q+gTlp
-k5mJq6PEBwhXhPCpK2tWOtjjpxFdLABLnmojns6MiGwSWDgzjQLt09XnLkxJz0+V
-+2nDzdPB4gBeTmn1HP8P97jPuCwWRWPZdDV+xXlXlhFjMM/em0BS3k3Ub4M7hR9l
-SG8yUP7xTbbROb1ogXYcTVbWvBLLSUXdJaOCASwwggEoMA4GA1UdDwEB/wQEAwIE
+MDExMjM0MjBaFw0zNzEyMDExMjM0MjBaMCExHzAdBgNVBAMMFnNlcnZlcjEuZXhh
+bXBsZV9lYy5jb20wgZswEAYHKoZIzj0CAQYFK4EEACMDgYYABABgtAjdg51cTCVW
+Jf8pJI+4k4L2N8bPUBLkeihUJN4q9aCkPPn9vV2bgJB0UHhQLSgt4yAYaCFnMpB4
++wM1B0N57AEIUQDu5LCqokagPMgJKAxiJyEHemcFqCqtLlWnvkNqS1bM214WvX7r
+nhyBQ4PvNvEY5SlEZuQsIZL1kYM6lLRXo6OCASwwggEoMA4GA1UdDwEB/wQEAwIE
 8DAgBgNVHSUBAf8EFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwMgYDVR0fBCswKTAn
 oCWgI4YhaHR0cDovL2NybC5leGFtcGxlLmNvbS9sYXRlc3QuY3JsMDQGCCsGAQUF
 BwEBBCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29zY3AuZXhhbXBsZS5jb20vMIGJ
-BgNVHREEgYEwf4IWc2VydmVyMS5leGFtcGxlX2VjLmNvbYIhYWx0ZXJuYXRlbmFt
-ZS5zZXJ2ZXIxLmV4YW1wbGUuY29tgiJhbHRlcm5hdGVuYW1lMi5zZXJ2ZXIxLmV4
-YW1wbGUuY29tggkqLnRlc3QuZXiCE3NlcnZlcjEuZXhhbXBsZS5jb20wCgYIKoZI
-zj0EAwIDgYwAMIGIAkIAxsS/7bWclQDD4cR+PMtp0taiCGB9DZjOhqw2Z1hXUTXv
-Ak6FFdB9oNV+axXE8OzFE/xZwzI/7VKXb/TAHGN/lfkCQgDCI0B/b2OTUk5hfB+r
-4Vi/N/clg9lkJ6DlzoMcGV92dGsW1HQ4BYG7uABCaGCRwSmIs2VEy5jA0F5hAggQ
-8fjLQA==
+BgNVHREEgYEwf4ITc2VydmVyMS5leGFtcGxlLmNvbYIiYWx0ZXJuYXRlbmFtZTIu
+c2VydmVyMS5leGFtcGxlLmNvbYIhYWx0ZXJuYXRlbmFtZS5zZXJ2ZXIxLmV4YW1w
+bGUuY29tggkqLnRlc3QuZXiCFnNlcnZlcjEuZXhhbXBsZV9lYy5jb20wCgYIKoZI
+zj0EAwIDgYsAMIGHAkIBx9EGz2ocLlfqVFWXKF4hppY1v54q9i0nA+2xCEsp4Lb/
+Z9gSZMvqru5Xu6FWrQ/loTv4CmE+SjWRnfjUU+VSoqsCQUyZmyJfRhZr8G7x1I7d
+Vulk/xvy3d8XhoajVS0s2g5xpyMfUknOEhaSNaMXUZW/8ZjbW2BjbNoZQxVwS6h0
+aIrz
 -----END CERTIFICATE-----
 Bag Attributes
     friendlyName: Signing Cert ec
 subject=/O=example_ec.com/CN=clica Signing Cert ec
 issuer=/O=example_ec.com/CN=clica CA ec
 -----BEGIN CERTIFICATE-----
-MIICOTCCAZqgAwIBAgIBAjAKBggqhkjOPQQDAjAvMRcwFQYDVQQKDA5leGFtcGxl
-X2VjLmNvbTEUMBIGA1UEAxMLY2xpY2EgQ0EgZWMwHhcNMTIxMTAxMTIzNDA0WhcN
-MzgwMTAxMTIzNDA0WjA5MRcwFQYDVQQKDA5leGFtcGxlX2VjLmNvbTEeMBwGA1UE
+MIICHDCCAX6gAwIBAgIBQjAKBggqhkjOPQQDAjAvMRcwFQYDVQQKDA5leGFtcGxl
+X2VjLmNvbTEUMBIGA1UEAxMLY2xpY2EgQ0EgZWMwHhcNMTIxMTAxMTIzNDIwWhcN
+MzgwMTAxMTIzNDIwWjA5MRcwFQYDVQQKDA5leGFtcGxlX2VjLmNvbTEeMBwGA1UE
 AxMVY2xpY2EgU2lnbmluZyBDZXJ0IGVjMIGbMBAGByqGSM49AgEGBSuBBAAjA4GG
-AAQB3RMF5qTA8Mhf1/DtiauE272gyO6MJmiYGJn16gwbUU4J8PIXHXDKH5O5Y99z
-0xYrhX+eLTuNvTA0O8O1DkLGpeQAyo65/kRq+B6zWhCIXkl1/Tqqx6WM3kF0xHfb
-7xKeorKtz8cToLXFw5SscZNVv32S9rnKTxwif3+7dgaC1eVKWjyjWjBYMA4GA1Ud
-DwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMDIGA1UdHwQrMCkwJ6AloCOG
-IWh0dHA6Ly9jcmwuZXhhbXBsZS5jb20vbGF0ZXN0LmNybDAKBggqhkjOPQQDAgOB
-jAAwgYgCQgC7QqFcSVRN5pZoaHw6Z1no0QjnpzcGHEO/kI7XNg2q+u41Xk96DE85
-jTs+ryef/GJ9scPeShvxOOaXlutP7RKL9wJCAaa6Un0wubdhy5djZ3Qv09kRt/XT
-jLkY6s1aiotpl5mX+puxLRutrLML1w3ZACe2Ippibv3Puvg2I3eaJyVjg76q
+AAQAw20Nx/YXlmEa0JcVzx0RJJR0Q0WJAI0r6IaTktmSGBaI7xjWAz+FQnOmhnTT
+f6fmr6Y30JkXMx0a1jbT8xbkabMA1cwE3+sPGmJb5U8u7LSQLtoBqGu/wJcJzgxh
+Hjfu6dWTvQy9XGwJ9zfUYO6OCqxOCwPDUwclf6ATkR/+CYNKtQKjPjA8MA4GA1Ud
+DwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMBYGA1UdDgQPBA1BQWJ0d0N4
+Y1hnYjBRMAoGCCqGSM49BAMCA4GLADCBhwJCAJu3rvJkTBkF1a2NSnfBMsohguO1
+1WcdT7ltCQDPRPWkZGWSpgEWoUG2TRQxFh2pOO6J/NPWiny7u+ZwBExF2sZ1AkEq
+dxwepzCXqpqKoICJiX1F2974SRgmDNfSmzNG0X/d2d0Z2X15va5vK0oBH8rvIlmw
+mdV3uhlmoNhmqUHEuqKUhA==
 -----END CERTIFICATE-----
 Bag Attributes
     friendlyName: Certificate Authority ec
 subject=/O=example_ec.com/CN=clica CA ec
 issuer=/O=example_ec.com/CN=clica CA ec
 -----BEGIN CERTIFICATE-----
-MIIB+zCCAVygAwIBAgIBATAKBggqhkjOPQQDAjAvMRcwFQYDVQQKDA5leGFtcGxl
-X2VjLmNvbTEUMBIGA1UEAxMLY2xpY2EgQ0EgZWMwHhcNMTIxMTAxMTIzNDA0WhcN
-MzgwMTAxMTIzNDA0WjAvMRcwFQYDVQQKDA5leGFtcGxlX2VjLmNvbTEUMBIGA1UE
-AxMLY2xpY2EgQ0EgZWMwgZswEAYHKoZIzj0CAQYFK4EEACMDgYYABAHm9U9VOWgT
-kXnFOEy1kfkVx0n/XZygNm1Z+WnyU3Nt/c7b8m/Xwv4/VZO9bYm9dENOjT5+FHZ6
-MyJVIZVsYIfmlgG7BGeHDUzgLkmm30rM+QKU8pMNIMUggwY3CtV7tdeX/T/dtayh
-uxB2oyHvv2jGLIi1P8d4k87/9JWjvhfIjS6ImqMmMCQwEgYDVR0TAQH/BAgwBgEB
-/wIBATAOBgNVHQ8BAf8EBAMCAQYwCgYIKoZIzj0EAwIDgYwAMIGIAkIBEFmSdl+a
-k48M4+Ntzzkt+U0CfFIsW86KpYe0BcYjrNUVOUGu7s7RmFgMjYmGrWNCCJ2PNL9x
-eXwyFQMITjEvYy0CQgGl5U/yWaqe/PGKEQmyvhlcXF6ylv4iJES2SFlyhdqEFqrT
-biYVM/zSvSn2K3B3c/JHA4L21LcUjAPi8cphpgVIEQ==
+MIIB+zCCAVygAwIBAgIBQTAKBggqhkjOPQQDAjAvMRcwFQYDVQQKDA5leGFtcGxl
+X2VjLmNvbTEUMBIGA1UEAxMLY2xpY2EgQ0EgZWMwHhcNMTIxMTAxMTIzNDIwWhcN
+MzgwMTAxMTIzNDIwWjAvMRcwFQYDVQQKDA5leGFtcGxlX2VjLmNvbTEUMBIGA1UE
+AxMLY2xpY2EgQ0EgZWMwgZswEAYHKoZIzj0CAQYFK4EEACMDgYYABAAXQLXIfCeo
+dnmboScyJ5dutaJijb0+oh2RbMyC6wf+05xD0aR1ioteDwz+BL6tIAd8m/8ILrfh
+LpQbdCjS7k+0BwE1EqYUBN8WYWC59RcaA0CmhDaDybQYTlj1gZtBtA2H3wagWHrZ
+hKiZzX2xUfaTNHokyMRDzOA0FGkKj3djDMc9xaMmMCQwEgYDVR0TAQH/BAgwBgEB
+/wIBATAOBgNVHQ8BAf8EBAMCAQYwCgYIKoZIzj0EAwIDgYwAMIGIAkIBJxJzvmFu
+PGMjQKq8PANizWysjs/wS/RJC+GLLI117h3F2o/+eEK8vrQWqA6dxpOuXL17N48p
+PDvrjw1xwuW/PYsCQgD29BcHYyxgEnbvHdsKhD27J1y3ruVjYH64KhNzM/hmwnve
+wIMlDH5gu/t7HjKVJyEv2NpUvGPWtIaMupIHtwAMlQ==
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example_ec.com/server1.example_ec.com/key3.db b/test/aux-fixed/exim-ca/example_ec.com/server1.example_ec.com/key3.db
index 69b354714..14f05dbd7 100644
--- a/test/aux-fixed/exim-ca/example_ec.com/server1.example_ec.com/key3.db
+++ b/test/aux-fixed/exim-ca/example_ec.com/server1.example_ec.com/key3.db
diff --git a/test/aux-fixed/exim-ca/example_ec.com/server1.example_ec.com/server1.example_ec.com.chain.pem b/test/aux-fixed/exim-ca/example_ec.com/server1.example_ec.com/server1.example_ec.com.chain.pem
index e167da08e..f6558807d 100644
--- a/test/aux-fixed/exim-ca/example_ec.com/server1.example_ec.com/server1.example_ec.com.chain.pem
+++ b/test/aux-fixed/exim-ca/example_ec.com/server1.example_ec.com/server1.example_ec.com.chain.pem
@@ -1,38 +1,38 @@
 Bag Attributes
     friendlyName: server1.example_ec.com
-    localKeyID: E8 57 D2 D2 59 FF E7 C8 FE 43 26 2F ED 44 08 9F 53 83 10 A4 
+    localKeyID: C0 8B 08 6B D5 CF 5D 2E E2 2F 0A 08 B7 B7 71 96 91 D0 F8 30 
 subject=/CN=server1.example_ec.com
 issuer=/O=example_ec.com/CN=clica Signing Cert ec
 -----BEGIN CERTIFICATE-----
-MIIDADCCAmGgAwIBAgICCDUwCgYIKoZIzj0EAwIwOTEXMBUGA1UECgwOZXhhbXBs
+MIIC/zCCAmGgAwIBAgICCDUwCgYIKoZIzj0EAwIwOTEXMBUGA1UECgwOZXhhbXBs
 ZV9lYy5jb20xHjAcBgNVBAMTFWNsaWNhIFNpZ25pbmcgQ2VydCBlYzAeFw0xMjEx
-MDExMjM0MDRaFw0zNzEyMDExMjM0MDRaMCExHzAdBgNVBAMMFnNlcnZlcjEuZXhh
-bXBsZV9lYy5jb20wgZswEAYHKoZIzj0CAQYFK4EEACMDgYYABAC5lSGys4Q+gTlp
-k5mJq6PEBwhXhPCpK2tWOtjjpxFdLABLnmojns6MiGwSWDgzjQLt09XnLkxJz0+V
-+2nDzdPB4gBeTmn1HP8P97jPuCwWRWPZdDV+xXlXlhFjMM/em0BS3k3Ub4M7hR9l
-SG8yUP7xTbbROb1ogXYcTVbWvBLLSUXdJaOCASwwggEoMA4GA1UdDwEB/wQEAwIE
+MDExMjM0MjBaFw0zNzEyMDExMjM0MjBaMCExHzAdBgNVBAMMFnNlcnZlcjEuZXhh
+bXBsZV9lYy5jb20wgZswEAYHKoZIzj0CAQYFK4EEACMDgYYABABgtAjdg51cTCVW
+Jf8pJI+4k4L2N8bPUBLkeihUJN4q9aCkPPn9vV2bgJB0UHhQLSgt4yAYaCFnMpB4
++wM1B0N57AEIUQDu5LCqokagPMgJKAxiJyEHemcFqCqtLlWnvkNqS1bM214WvX7r
+nhyBQ4PvNvEY5SlEZuQsIZL1kYM6lLRXo6OCASwwggEoMA4GA1UdDwEB/wQEAwIE
 8DAgBgNVHSUBAf8EFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwMgYDVR0fBCswKTAn
 oCWgI4YhaHR0cDovL2NybC5leGFtcGxlLmNvbS9sYXRlc3QuY3JsMDQGCCsGAQUF
 BwEBBCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29zY3AuZXhhbXBsZS5jb20vMIGJ
-BgNVHREEgYEwf4IWc2VydmVyMS5leGFtcGxlX2VjLmNvbYIhYWx0ZXJuYXRlbmFt
-ZS5zZXJ2ZXIxLmV4YW1wbGUuY29tgiJhbHRlcm5hdGVuYW1lMi5zZXJ2ZXIxLmV4
-YW1wbGUuY29tggkqLnRlc3QuZXiCE3NlcnZlcjEuZXhhbXBsZS5jb20wCgYIKoZI
-zj0EAwIDgYwAMIGIAkIAxsS/7bWclQDD4cR+PMtp0taiCGB9DZjOhqw2Z1hXUTXv
-Ak6FFdB9oNV+axXE8OzFE/xZwzI/7VKXb/TAHGN/lfkCQgDCI0B/b2OTUk5hfB+r
-4Vi/N/clg9lkJ6DlzoMcGV92dGsW1HQ4BYG7uABCaGCRwSmIs2VEy5jA0F5hAggQ
-8fjLQA==
+BgNVHREEgYEwf4ITc2VydmVyMS5leGFtcGxlLmNvbYIiYWx0ZXJuYXRlbmFtZTIu
+c2VydmVyMS5leGFtcGxlLmNvbYIhYWx0ZXJuYXRlbmFtZS5zZXJ2ZXIxLmV4YW1w
+bGUuY29tggkqLnRlc3QuZXiCFnNlcnZlcjEuZXhhbXBsZV9lYy5jb20wCgYIKoZI
+zj0EAwIDgYsAMIGHAkIBx9EGz2ocLlfqVFWXKF4hppY1v54q9i0nA+2xCEsp4Lb/
+Z9gSZMvqru5Xu6FWrQ/loTv4CmE+SjWRnfjUU+VSoqsCQUyZmyJfRhZr8G7x1I7d
+Vulk/xvy3d8XhoajVS0s2g5xpyMfUknOEhaSNaMXUZW/8ZjbW2BjbNoZQxVwS6h0
+aIrz
 -----END CERTIFICATE-----
 -----BEGIN CERTIFICATE-----
-MIICNDCCAZ2gAwIBAgIBAjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
+MIICGDCCAYGgAwIBAgIBQjANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKEwtleGFt
 cGxlLmNvbTEVMBMGA1UEAxMMY2xpY2EgQ0EgcnNhMB4XDTEyMTEwMTEyMzQwMVoX
 DTM4MDEwMTEyMzQwMVowNzEUMBIGA1UEChMLZXhhbXBsZS5jb20xHzAdBgNVBAMT
 FmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
-AoGBANlcwo5q84SEtVy5W/xqbYAzOiYUZ0Shp9+ry/Q/X5uhrDF9JSHNWJbXut+8
-ZJGICt0RYVIJCcaa7FUt5hTKEx4fgURr+Hz84ZgwesMxcECHJPq9ylrCqbPkbmFR
-1XUy2MvioMH2lyc/PbV62XXggJhHioStVLRfyVlkS1KvvR+HAgMBAAGjWjBYMA4G
-A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMDIGA1UdHwQrMCkwJ6Al
-oCOGIWh0dHA6Ly9jcmwuZXhhbXBsZS5jb20vbGF0ZXN0LmNybDANBgkqhkiG9w0B
-AQsFAAOBgQBtPJwqu7DiDmFZd58L4xQ6JJhrJzJUDHmT7ikW2tOM58yisCgSnzrR
-xihW+49vUQ9lSGxBHaFwdehAuGTXydnf7/i9i6KA2RZ+Rq12FJFYOhjaIP7Sy1zq
-VXtb+P1eDBQQhz0WgysLVjgGdBiokRv86yY56ficoTQ6EyWzQLCU+A==
+AoGBALFHTtwaKeCfLlDf/wTErhOB6AB9vKHtyDbU6yDB/DrA5DLbug8m1oGGwEIf
+lTY0VBym8/Iu/ExE476gRmPNX/kIQsSNj9LtCIx3JXqLpc8ylw4cuVMOeFtBXNtE
+YKvUPIyWaAvqBbwY1QOyHNeoJ68hBdDPCn3oN2wrCz4if9QHAgMBAAGjPjA8MA4G
+A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMBYGA1UdDgQPBA1BQWJ0
+d0N4Y1hnYjBRMA0GCSqGSIb3DQEBCwUAA4GBAERD495HPM1BxM60EHGYLQgPjJPT
+/cL+nTKyIdv2UvzAnJaSFMMAB43Twy/jvkahsITVuieSU4kpev79KRNLfk+h25pf
+oPjaOfmOQVtHWN9ML8FDs0dLkRhJPuagObx17l/KEPkiK/jLB339fyO1HxaKhymE
+hdqYsdjjnBy/6U5g
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example_ec.com/server1.example_ec.com/server1.example_ec.com.key b/test/aux-fixed/exim-ca/example_ec.com/server1.example_ec.com/server1.example_ec.com.key
index 750aaa2c9..8d4bdac49 100644
--- a/test/aux-fixed/exim-ca/example_ec.com/server1.example_ec.com/server1.example_ec.com.key
+++ b/test/aux-fixed/exim-ca/example_ec.com/server1.example_ec.com/server1.example_ec.com.key
@@ -1,13 +1,13 @@
 Bag Attributes
     friendlyName: server1.example_ec.com
-    localKeyID: E8 57 D2 D2 59 FF E7 C8 FE 43 26 2F ED 44 08 9F 53 83 10 A4 
+    localKeyID: C0 8B 08 6B D5 CF 5D 2E E2 2F 0A 08 B7 B7 71 96 91 D0 F8 30 
 Key Attributes: <No Attributes>
 -----BEGIN ENCRYPTED PRIVATE KEY-----
-MIIBPTBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQIKzAztvM6FmICAggA
-MBQGCCqGSIb3DQMHBAiIeJLKyMqpiASB+PtDhx67fl/D/0nYcutWx5s5Ue9g8f/V
-zvQyZmGku0pc/c1aDpOdJ5z//YyMMyMeMngcntIcjmexR+bp5sEYUPorUz2IFMRv
-gHBHPHq3L7W8sb9fKdSotFNA1N1fRl52zPBI1WTfYL4Oj69efkO4ohn3GLq5gd6M
-lWMjdFlFjGa/7uiN8HVji2VEMXC17f/tLiz0rMiE3yOHwUwoBv3WPx3FT5rQRnDO
-rr6NrebQ4MRyHP8c8yMhM2L0q24CRIorPB76VxGwzjmDudfHsjZ0bND7NWFstPGL
-Hms4MRqCk0FSjrNEcZAXUQxxNi7sIuU6D1AbwWLnakq/
+MIIBSzBOBgkqhkiG9w0BBQ0wQTApBgkqhkiG9w0BBQwwHAQIknS3YlrTLAQCAggA
+MAwGCCqGSIb3DQIJBQAwFAYIKoZIhvcNAwcECE6j/3EHWtp4BIH4In1m3nH7OsdI
+BE2V4m02juya2M//+pYWyjFjvYgb+qA7r6BkAarbIebHQPsF567TOorU3N/eAqes
+b8ieyw7xuw3zvsjOeNZVrtcovl2Fu7/XW77XB3dN8pcrM1t0dwPSdsoIF0asStrH
+6Ql50oYYx+3QMy3fHB/YBKHhW7kViYOKXkafIE/VAmZrejOqaFDVAdrue9E1zJSi
+BhPNND87i5a+jXnq2pzG0VTYQJ2aUyTBV7gzUzKVXCZUUQMfwkPbn6FEcJNDB2sV
+IkQnjMeCqsD+jRpW7jPT9Y9+8hj5pUxgQpgcOkM/0GQopG4Jt3Uc+Jv6oZfNPAk=
 -----END ENCRYPTED PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example_ec.com/server1.example_ec.com/server1.example_ec.com.ocsp.good.resp b/test/aux-fixed/exim-ca/example_ec.com/server1.example_ec.com/server1.example_ec.com.ocsp.good.resp
new file mode 100644
index 000000000..276c8b26d
--- /dev/null
+++ b/test/aux-fixed/exim-ca/example_ec.com/server1.example_ec.com/server1.example_ec.com.ocsp.good.resp
diff --git a/test/aux-fixed/exim-ca/example_ec.com/server1.example_ec.com/server1.example_ec.com.ocsp.req b/test/aux-fixed/exim-ca/example_ec.com/server1.example_ec.com/server1.example_ec.com.ocsp.req
new file mode 100644
index 000000000..f60d3923c
--- /dev/null
+++ b/test/aux-fixed/exim-ca/example_ec.com/server1.example_ec.com/server1.example_ec.com.ocsp.req
diff --git a/test/aux-fixed/exim-ca/example_ec.com/server1.example_ec.com/server1.example_ec.com.p12 b/test/aux-fixed/exim-ca/example_ec.com/server1.example_ec.com/server1.example_ec.com.p12
index 24e25a9aa..1952284f1 100644
--- a/test/aux-fixed/exim-ca/example_ec.com/server1.example_ec.com/server1.example_ec.com.p12
+++ b/test/aux-fixed/exim-ca/example_ec.com/server1.example_ec.com/server1.example_ec.com.p12
diff --git a/test/aux-fixed/exim-ca/example_ec.com/server1.example_ec.com/server1.example_ec.com.pem b/test/aux-fixed/exim-ca/example_ec.com/server1.example_ec.com/server1.example_ec.com.pem
index 662294f05..7de3ec2c6 100644
--- a/test/aux-fixed/exim-ca/example_ec.com/server1.example_ec.com/server1.example_ec.com.pem
+++ b/test/aux-fixed/exim-ca/example_ec.com/server1.example_ec.com/server1.example_ec.com.pem
@@ -1,24 +1,24 @@
 Bag Attributes
     friendlyName: server1.example_ec.com
-    localKeyID: E8 57 D2 D2 59 FF E7 C8 FE 43 26 2F ED 44 08 9F 53 83 10 A4 
+    localKeyID: C0 8B 08 6B D5 CF 5D 2E E2 2F 0A 08 B7 B7 71 96 91 D0 F8 30 
 subject=/CN=server1.example_ec.com
 issuer=/O=example_ec.com/CN=clica Signing Cert ec
 -----BEGIN CERTIFICATE-----
-MIIDADCCAmGgAwIBAgICCDUwCgYIKoZIzj0EAwIwOTEXMBUGA1UECgwOZXhhbXBs
+MIIC/zCCAmGgAwIBAgICCDUwCgYIKoZIzj0EAwIwOTEXMBUGA1UECgwOZXhhbXBs
 ZV9lYy5jb20xHjAcBgNVBAMTFWNsaWNhIFNpZ25pbmcgQ2VydCBlYzAeFw0xMjEx
-MDExMjM0MDRaFw0zNzEyMDExMjM0MDRaMCExHzAdBgNVBAMMFnNlcnZlcjEuZXhh
-bXBsZV9lYy5jb20wgZswEAYHKoZIzj0CAQYFK4EEACMDgYYABAC5lSGys4Q+gTlp
-k5mJq6PEBwhXhPCpK2tWOtjjpxFdLABLnmojns6MiGwSWDgzjQLt09XnLkxJz0+V
-+2nDzdPB4gBeTmn1HP8P97jPuCwWRWPZdDV+xXlXlhFjMM/em0BS3k3Ub4M7hR9l
-SG8yUP7xTbbROb1ogXYcTVbWvBLLSUXdJaOCASwwggEoMA4GA1UdDwEB/wQEAwIE
+MDExMjM0MjBaFw0zNzEyMDExMjM0MjBaMCExHzAdBgNVBAMMFnNlcnZlcjEuZXhh
+bXBsZV9lYy5jb20wgZswEAYHKoZIzj0CAQYFK4EEACMDgYYABABgtAjdg51cTCVW
+Jf8pJI+4k4L2N8bPUBLkeihUJN4q9aCkPPn9vV2bgJB0UHhQLSgt4yAYaCFnMpB4
++wM1B0N57AEIUQDu5LCqokagPMgJKAxiJyEHemcFqCqtLlWnvkNqS1bM214WvX7r
+nhyBQ4PvNvEY5SlEZuQsIZL1kYM6lLRXo6OCASwwggEoMA4GA1UdDwEB/wQEAwIE
 8DAgBgNVHSUBAf8EFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwMgYDVR0fBCswKTAn
 oCWgI4YhaHR0cDovL2NybC5leGFtcGxlLmNvbS9sYXRlc3QuY3JsMDQGCCsGAQUF
 BwEBBCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29zY3AuZXhhbXBsZS5jb20vMIGJ
-BgNVHREEgYEwf4IWc2VydmVyMS5leGFtcGxlX2VjLmNvbYIhYWx0ZXJuYXRlbmFt
-ZS5zZXJ2ZXIxLmV4YW1wbGUuY29tgiJhbHRlcm5hdGVuYW1lMi5zZXJ2ZXIxLmV4
-YW1wbGUuY29tggkqLnRlc3QuZXiCE3NlcnZlcjEuZXhhbXBsZS5jb20wCgYIKoZI
-zj0EAwIDgYwAMIGIAkIAxsS/7bWclQDD4cR+PMtp0taiCGB9DZjOhqw2Z1hXUTXv
-Ak6FFdB9oNV+axXE8OzFE/xZwzI/7VKXb/TAHGN/lfkCQgDCI0B/b2OTUk5hfB+r
-4Vi/N/clg9lkJ6DlzoMcGV92dGsW1HQ4BYG7uABCaGCRwSmIs2VEy5jA0F5hAggQ
-8fjLQA==
+BgNVHREEgYEwf4ITc2VydmVyMS5leGFtcGxlLmNvbYIiYWx0ZXJuYXRlbmFtZTIu
+c2VydmVyMS5leGFtcGxlLmNvbYIhYWx0ZXJuYXRlbmFtZS5zZXJ2ZXIxLmV4YW1w
+bGUuY29tggkqLnRlc3QuZXiCFnNlcnZlcjEuZXhhbXBsZV9lYy5jb20wCgYIKoZI
+zj0EAwIDgYsAMIGHAkIBx9EGz2ocLlfqVFWXKF4hppY1v54q9i0nA+2xCEsp4Lb/
+Z9gSZMvqru5Xu6FWrQ/loTv4CmE+SjWRnfjUU+VSoqsCQUyZmyJfRhZr8G7x1I7d
+Vulk/xvy3d8XhoajVS0s2g5xpyMfUknOEhaSNaMXUZW/8ZjbW2BjbNoZQxVwS6h0
+aIrz
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example_ec.com/server1.example_ec.com/server1.example_ec.com.unlocked.key b/test/aux-fixed/exim-ca/example_ec.com/server1.example_ec.com/server1.example_ec.com.unlocked.key
index 31e377b8f..a568297a1 100644
--- a/test/aux-fixed/exim-ca/example_ec.com/server1.example_ec.com/server1.example_ec.com.unlocked.key
+++ b/test/aux-fixed/exim-ca/example_ec.com/server1.example_ec.com/server1.example_ec.com.unlocked.key
@@ -1,7 +1,7 @@
 -----BEGIN EC PRIVATE KEY-----
-MIHcAgEBBEIAzKUWe3GrwZUvhQ9/DJ2Fpek5/WH8LoZ5Z68VxoqcHJc8v7S0+VmZ
-wXG07OlzqaBLd17DwweW7wNXjY393zWGFHagBwYFK4EEACOhgYkDgYYABAC5lSGy
-s4Q+gTlpk5mJq6PEBwhXhPCpK2tWOtjjpxFdLABLnmojns6MiGwSWDgzjQLt09Xn
-LkxJz0+V+2nDzdPB4gBeTmn1HP8P97jPuCwWRWPZdDV+xXlXlhFjMM/em0BS3k3U
-b4M7hR9lSG8yUP7xTbbROb1ogXYcTVbWvBLLSUXdJQ==
+MIHcAgEBBEIB3UGJ/6oisU7pHhxz99/n9IIb96iUAItm2n/rUMqFX55MbhOkQfAc
+necalYgGMsVQ8ThKEcfCHWkIYpzf2KI+8hGgBwYFK4EEACOhgYkDgYYABABgtAjd
+g51cTCVWJf8pJI+4k4L2N8bPUBLkeihUJN4q9aCkPPn9vV2bgJB0UHhQLSgt4yAY
+aCFnMpB4+wM1B0N57AEIUQDu5LCqokagPMgJKAxiJyEHemcFqCqtLlWnvkNqS1bM
+214WvX7rnhyBQ4PvNvEY5SlEZuQsIZL1kYM6lLRXow==
 -----END EC PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/genall b/test/aux-fixed/exim-ca/genall
index 09823704e..e81e2f385 100755
--- a/test/aux-fixed/exim-ca/genall
+++ b/test/aux-fixed/exim-ca/genall
@@ -4,9 +4,9 @@
 set -e
 
 # Debugging.  Set V for clica verbosity.
-#set -x
-V=
-#V='-v'
+set -x
+#V=
+V='-v'
 
 clica --help >/dev/null 2>&1
 
@@ -34,7 +34,9 @@ do
 	-8 alternatename.server1.example.$tld,alternatename2.server1.example.$tld,*.test.ex
     clica $V -D $idir -p password -s 102 -S revoked1.$iname -m 301
     clica $V -D $idir -p password -s 103 -S expired1.$iname -m 1
-    clica $V -D $idir -p password -s 201 -S  server2.$iname -m 301
+
+    clica $V -D $idir -p password -s 201 -S  server2.$iname -m 301 \
+	-3 'CN=clica CA rsa,O=example.com' -8 '*.test.ex'
     clica $V -D $idir -p password -s 202 -S revoked2.$iname -m 301
     clica $V -D $idir -p password -s 203 -S expired2.$iname -m 1
 
@@ -43,11 +45,14 @@ do
     # openssl seems to generate a file (ca_chain.pam) in an order it
     # cannot then use (the key applies to the first cert in the file?).
     # Generate a shuffled one.
-    cd $idir/server1.$iname
-        openssl pkcs12 -in server1.$iname.p12 -passin file:pwdfile -cacerts -out cacerts.pem -nokeys
-        cat server1.$iname.pem cacerts.pem > fullchain.pem
+    for n in 1 2
+    do
+      cd $idir/server$n.$iname
+        openssl pkcs12 -in server$n.$iname.p12 -passin file:pwdfile -cacerts -out cacerts.pem -nokeys
+        cat server$n.$iname.pem cacerts.pem > fullchain.pem
         rm cacerts.pem
-    cd ../..
+      cd ../..
+    done
 
 ####
 
@@ -101,26 +106,30 @@ EOF
     # Now create all the ocsp requests and responses
     IVALID="-index $CADIR/index.valid.txt"
     IREVOKED="-index $CADIR/index.revoked.txt"
+
+    echo "unique_subject = yes" > $CADIR/index.valid.txt.attr
+    echo "unique_subject = yes" > $CADIR/index.revoked.txt.attr
+
     for server in server1 revoked1 expired1 server2 revoked2 expired2
     do
 	SPFX=$idir/$server.$iname/$server.$iname
-	openssl ocsp -issuer $CADIR/Signer.pem -cert $SPFX.pem -no_nonce -sha256 -reqout $SPFX.ocsp.req
+	openssl ocsp -issuer $CADIR/Signer.pem -sha256 -cert $SPFX.pem -no_nonce -reqout $SPFX.ocsp.req
 	REQIN="-reqin $SPFX.ocsp.req"
 
 	OGENCOMMON="-rsigner $CADIR/OCSP.pem -rkey $CADIR/OCSP.key -CA $CADIR/Signer.pem -noverify"
-	openssl ocsp $IVALID   $OGENCOMMON -ndays 3652 -sha256 $REQIN -respout $SPFX.ocsp.good.resp
-	openssl ocsp $IVALID   $OGENCOMMON -ndays 30   -sha256 $REQIN -respout $SPFX.ocsp.dated.resp
-	openssl ocsp $IREVOKED $OGENCOMMON -ndays 3652 -sha256 $REQIN -respout $SPFX.ocsp.revoked.resp
+	openssl ocsp $IVALID   $OGENCOMMON -ndays 3652 $REQIN -respout $SPFX.ocsp.good.resp
+	openssl ocsp $IVALID   $OGENCOMMON -ndays 30   $REQIN -respout $SPFX.ocsp.dated.resp
+	openssl ocsp $IREVOKED $OGENCOMMON -ndays 3652 $REQIN -respout $SPFX.ocsp.revoked.resp
 
 	OGENCOMMON="-rsigner $CADIR/Signer.pem -rkey $CADIR/Signer.key -CA $CADIR/Signer.pem -noverify"
-	openssl ocsp $IVALID   $OGENCOMMON -ndays 3652 -sha256 $REQIN -respout $SPFX.ocsp.signer.good.resp
-	openssl ocsp $IVALID   $OGENCOMMON -ndays 30   -sha256 $REQIN -respout $SPFX.ocsp.signer.dated.resp
-	openssl ocsp $IREVOKED $OGENCOMMON -ndays 3652 -sha256 $REQIN -respout $SPFX.ocsp.signer.revoked.resp
+	openssl ocsp $IVALID   $OGENCOMMON -ndays 3652 $REQIN -respout $SPFX.ocsp.signer.good.resp
+	openssl ocsp $IVALID   $OGENCOMMON -ndays 30   $REQIN -respout $SPFX.ocsp.signer.dated.resp
+	openssl ocsp $IREVOKED $OGENCOMMON -ndays 3652 $REQIN -respout $SPFX.ocsp.signer.revoked.resp
 
 	OGENCOMMON="-rsigner $CADIR/Signer.pem -rkey $CADIR/Signer.key -CA $CADIR/Signer.pem -resp_no_certs -noverify"
-	openssl ocsp $IVALID   $OGENCOMMON -ndays 3652 -sha256 $REQIN -respout $SPFX.ocsp.signernocert.good.resp
-	openssl ocsp $IVALID   $OGENCOMMON -ndays 30   -sha256 $REQIN -respout $SPFX.ocsp.signernocert.dated.resp
-	openssl ocsp $IREVOKED $OGENCOMMON -ndays 3652 -sha256 $REQIN -respout $SPFX.ocsp.signernocert.revoked.resp
+	openssl ocsp $IVALID   $OGENCOMMON -ndays 3652 $REQIN -respout $SPFX.ocsp.signernocert.good.resp
+	openssl ocsp $IVALID   $OGENCOMMON -ndays 30   $REQIN -respout $SPFX.ocsp.signernocert.dated.resp
+	openssl ocsp $IREVOKED $OGENCOMMON -ndays 3652 $REQIN -respout $SPFX.ocsp.signernocert.revoked.resp
     done
 ####
 done
@@ -180,9 +189,41 @@ do
 	SDIR=$idir/$server.$iname
 	SPFX=$SDIR/$server.$iname
 	openssl ec -in $SPFX.key -passin file:$SDIR/pwdfile -out $SPFX.unlocked.key
-	cat $SPFX.pem example.$tld/CA/Signer.pem >$SPFX.chain.pem
+	cat $SPFX.pem $idir/CA/Signer.pem >$SPFX.chain.pem
     done
 
+####
+    # create OCSP reqs & resps
+    CADIR=$idir/CA
+    #give ourselves an OSCP key to work with
+    pk12util -o $CADIR/OCSP.p12 -n 'OCSP Signer ec' -d $CADIR -K password -W password
+    openssl pkcs12 -in $CADIR/OCSP.p12 -passin pass:password -passout pass:password -nodes -nocerts -out $CADIR/OCSP.key
+
+    # create some index files for the ocsp responder to work with
+# tab-sep
+# 0: Revoked/Expired/Valid letter
+# 1: Expiry date (ASN1_UTCTIME)
+# 2: Revocation date
+# 3: Serial no. (unique)
+# 4: file
+# 5: DN, index
+
+    cat >$CADIR/index.valid.txt <<EOF
+V	130110200751Z		65	unknown	CN=server1.$iname
+EOF
+
+    # Now create all the ocsp requests and responses
+    IVALID="-index $CADIR/index.valid.txt"
+    for server in server1
+    do
+	SPFX=$idir/$server.$iname/$server.$iname
+	openssl ocsp -issuer $CADIR/Signer.pem -sha256 -cert $SPFX.pem -no_nonce -reqout $SPFX.ocsp.req
+	REQIN="-reqin $SPFX.ocsp.req"
+
+	OGENCOMMON="-rsigner $CADIR/OCSP.pem -rkey $CADIR/OCSP.key -CA $CADIR/Signer.pem -noverify"
+	openssl ocsp $IVALID   $OGENCOMMON -ndays 3652 $REQIN -respout $SPFX.ocsp.good.resp
+    done
+####
 done
 
 ###############################################################################
@@ -197,28 +238,36 @@ read junk
 
 # Create CRL files in .der and .pem
 # empty versions, and ones with the revoked servers
+DATENOW=`date -u +%Y%m%d%H%M%SZ`
 for tld in com org net
 do
     CADIR=example.$tld/CA
     CRLIN=$CADIR/crl.empty.in.txt
-    DATENOW=`date -u +%Y%m%d%H%M%SZ`
     echo "update=$DATENOW " >$CRLIN
     crlutil -G -d $CADIR -f $CADIR/pwdfile \
 	-n 'Signing Cert rsa' -c $CRLIN -o $CADIR/crl.empty
     openssl crl -in $CADIR/crl.empty -inform der -out $CADIR/crl.empty.pem
 done
 sleep 2
+DATENOW=`date -u +%Y%m%d%H%M%SZ`
 for tld in com org net
 do
     CADIR=example.$tld/CA
     CRLIN=$CADIR/crl.v2.in.txt
-    DATENOW=`date -u +%Y%m%d%H%M%SZ`
     echo "update=$DATENOW " >$CRLIN
     echo "addcert 102 $DATENOW" >>$CRLIN
     echo "addcert 202 $DATENOW" >>$CRLIN
     crlutil -G -d $CADIR -f $CADIR/pwdfile \
 	-n 'Signing Cert rsa' -c $CRLIN -o $CADIR/crl.v2
     openssl crl -in $CADIR/crl.v2 -inform der -out $CADIR/crl.v2.pem
+
+    CRLIN=$CADIR/crl.Signer.in.txt
+    echo "update=$DATENOW " >$CRLIN
+    crlutil -G -d $CADIR -f $CADIR/pwdfile \
+	-n 'Certificate Authority rsa' -c $CRLIN -o $CADIR/crl.Signer
+    openssl crl -in $CADIR/crl.Signer -inform der -out $CADIR/crl.Signer.pem
+
+    cat $CADIR/crl.Signer.pem $CADIR/crl.v2.pem > $CADIR/crl.chain.pem
 done
 
 # Finally, a single certificate-directory
diff --git a/test/confs/2014 b/test/confs/2014
index f9e2e6a22..a50a875cf 100644
--- a/test/confs/2014
+++ b/test/confs/2014
@@ -22,7 +22,7 @@ tls_privatekey = DIR/aux-fixed/cert1
 
 tls_verify_hosts = HOSTIPV4
 tls_try_verify_hosts = *
-tls_verify_certificates = DIR/aux-fixed/cert2
+tls_verify_certificates = DIR/aux-fixed/exim-ca/example.com/server1.example.com/ca_chain.pem
 tls_crl = CRL
 
 
@@ -31,7 +31,7 @@ tls_crl = CRL
 begin acl
 
 check_recipient:
-  deny     message = certificate not verified: peerdn=$tls_peerdn
+  deny     message = certificate not verified: peerdn=$tls_in_peerdn
          ! verify = certificate
   accept
 
@@ -53,7 +53,7 @@ begin transports
 local_delivery:
   driver = appendfile
   file = DIR/test-mail/$local_part
-  headers_add = TLS: cipher=$tls_cipher peerdn=$tls_peerdn
+  headers_add = TLS: cipher=$tls_cipher peerdn=$tls_in_peerdn
   user = CALLER
 
 # End
diff --git a/test/confs/2114 b/test/confs/2114
index 398e2135d..557479dc9 100644
--- a/test/confs/2114
+++ b/test/confs/2114
@@ -22,7 +22,7 @@ tls_privatekey = DIR/aux-fixed/cert1
 
 tls_verify_hosts = HOSTIPV4
 tls_try_verify_hosts = *
-tls_verify_certificates = DIR/aux-fixed/cert2
+tls_verify_certificates = DIR/aux-fixed/exim-ca/example.com/server1.example.com/ca_chain.pem
 tls_crl = CRL
 
 
diff --git a/test/confs/3700 b/test/confs/3700
index 94bd26ebd..00a17b497 100644
--- a/test/confs/3700
+++ b/test/confs/3700
@@ -9,6 +9,7 @@ log_selector = +received_recipients +outgoing_port
 
 # ----- Main settings -----
 
+acl_smtp_auth = log_call
 acl_smtp_mail = check_authd
 acl_smtp_rcpt = check_authd
 queue_only
@@ -27,6 +28,9 @@ tls_verify_certificates = DIR/aux-fixed/cert2
 
 begin acl
 
+log_call:
+  accept   logwrite = Auth ACL called, after smtp cmd "$smtp_command"
+
 check_authd:
   deny     message = authentication required
           !authenticated = *
diff --git a/test/confs/4504 b/test/confs/4504
new file mode 120000
index 000000000..da89833c9
--- /dev/null
+++ b/test/confs/4504
@@ -0,0 +1 @@
+4503
+\ No newline at end of file
diff --git a/test/confs/5652 b/test/confs/5652
new file mode 100644
index 000000000..13c8d8617
--- /dev/null
+++ b/test/confs/5652
@@ -0,0 +1,83 @@
+# Exim test configuration 5652
+# OCSP stapling, server, multiple certs
+
+.include DIR/aux-var/tls_conf_prefix
+
+primary_hostname = server1.example.com
+
+# ----- Main settings -----
+
+acl_smtp_mail = check_mail
+acl_smtp_rcpt = check_recipient
+
+log_selector = +tls_peerdn
+
+queue_only
+queue_run_in_order
+
+tls_advertise_hosts = *
+
+CADIR = DIR/aux-fixed/exim-ca
+DRSA = CADIR/example.com
+DECDSA = CADIR/example_ec.com
+
+tls_certificate = DRSA/server1.example.com/server1.example.com.pem \
+	      : DECDSA/server1.example_ec.com/server1.example_ec.com.pem
+tls_privatekey =  DRSA/server1.example.com/server1.example.com.unlocked.key \
+	      : DECDSA/server1.example_ec.com/server1.example_ec.com.unlocked.key
+tls_ocsp_file =   DRSA/server1.example.com/server1.example.com.ocsp.good.resp \
+	      : DECDSA/server1.example_ec.com/server1.example_ec.com.ocsp.good.resp
+
+
+
+# ------ ACL ------
+
+begin acl
+
+check_mail:
+  accept   logwrite = acl_mail: ocsp in status: $tls_in_ocsp \
+    (${listextract {${eval:$tls_in_ocsp+1}} \
+		{notreq:notresp:vfynotdone:failed:verified}})
+
+check_recipient:
+  accept
+
+
+# ----- Routers -----
+
+begin routers
+
+client:
+  driver = manualroute
+  condition = ${if !eq {SERVER}{server}}
+  route_list = * 127.0.0.1
+  self = send
+  transport = remote_delivery
+  errors_to = ""
+
+srvr:
+  driver = accept
+  retry_use_local_part
+  transport = local_delivery
+
+
+# ----- Transports -----
+
+begin transports
+
+remote_delivery:
+  driver =			smtp
+  port =			PORT_D
+  hosts_require_tls =		*
+  tls_require_ciphers =		OPT
+  hosts_require_ocsp =		*
+  tls_verify_certificates =	CERT
+  tls_verify_cert_hostnames =	:
+
+local_delivery:
+  driver = appendfile
+  file = DIR/test-mail/$local_part
+  headers_add = TLS: cipher=$tls_cipher peerdn=$tls_peerdn
+  user = CALLER
+
+# End
diff --git a/test/confs/5820 b/test/confs/5820
index 6c2f26ce0..d4dce2f85 100644
--- a/test/confs/5820
+++ b/test/confs/5820
@@ -1,19 +1,22 @@
-# Exim test configuration 5800
-# DANE
+# Exim test configuration 5820
+# DANE/GnuTLS
 
 SERVER=
 
-.include DIR/aux-var/std_conf_prefix
+.include DIR/aux-var/tls_conf_prefix
 
 primary_hostname = myhost.test.ex
 
 # ----- Main settings -----
 
-acl_smtp_rcpt = accept
+.ifndef OPT
+acl_smtp_rcpt = accept logwrite = "rcpt ACL"
+.else
+acl_smtp_rcpt = accept verify = recipient/callout
+.endif
 
-log_selector =  +tls_peerdn
+log_selector =  +received_recipients +tls_peerdn +tls_certificate_verified
 
-queue_only
 queue_run_in_order
 
 tls_advertise_hosts = *
@@ -21,23 +24,33 @@ tls_advertise_hosts = *
 tls_dhparam = historic
 
 # Set certificate only if server
+CDIR1 = DIR/aux-fixed/exim-ca/example.net/server1.example.net
+CDIR2 = DIR/aux-fixed/exim-ca/example.com/server1.example.com
 
-tls_certificate = ${if eq {SERVER}{server}{DIR/aux-fixed/cert1}fail}
-tls_privatekey = ${if eq {SERVER}{server}{DIR/aux-fixed/cert1}fail}
 
-#tls_verify_hosts = *
-#tls_verify_certificates = ${if eq {SERVER}{server}{DIR/aux-fixed/cert2}fail}
+tls_certificate = ${if eq {SERVER}{server} \
+	{${if or {{eq {DETAILS}{ta}} {eq {DETAILS}{ca}} {eq {DETAILS}{ee}}} \
+		{CDIR2/fullchain.pem}\
+		{CDIR1/fullchain.pem}}}\
+	fail}
 
+tls_privatekey = ${if eq {SERVER}{server} \
+	{${if or {{eq {DETAILS}{ta}} {eq {DETAILS}{ca}} {eq {DETAILS}{ee}}} \
+		{CDIR2/server1.example.com.unlocked.key}\
+		{CDIR1/server1.example.net.unlocked.key}}}\
+	fail}
 
 # ----- Routers -----
 
 begin routers
 
 client:
-  driver = accept
-  condition = ${if eq {SERVER}{server}{no}{yes}}
-  retry_use_local_part
+  driver = dnslookup
+  condition = ${if eq {SERVER}{}}
+  dnssec_request_domains = *
+  self = send
   transport = send_to_server
+  errors_to = ""
 
 server:
   driver = redirect
@@ -51,11 +64,14 @@ begin transports
 send_to_server:
   driver = smtp
   allow_localhost
-  hosts = 127.0.0.1
-  port = PORT_D
-#  tls_certificate = DIR/aux-fixed/cert2
-#  tls_privatekey = DIR/aux-fixed/cert2
-#  tls_verify_certificates = DIR/aux-fixed/cert2
+  port = ${if match {$host}{\Ntest.ex$\N} {PORT_D}{25}}
+
+  hosts_try_dane =     *
+  hosts_require_dane = HOSTIPV4
+  tls_verify_cert_hostnames = ${if eq {OPT}{no_certname} {}{*}}
+  tls_try_verify_hosts = thishost.test.ex
+  tls_verify_certificates = CDIR2/ca_chain.pem
+
 
 
 # ----- Retry -----
diff --git a/test/confs/5840 b/test/confs/5840
index 01c114252..10ca2111b 100644
--- a/test/confs/5840
+++ b/test/confs/5840
@@ -1,5 +1,5 @@
 # Exim test configuration 5840
-# DANE
+# DANE/OpenSSL
 
 SERVER=
 
@@ -10,7 +10,7 @@ primary_hostname = myhost.test.ex
 # ----- Main settings -----
 
 .ifndef OPT
-acl_smtp_rcpt = accept
+acl_smtp_rcpt = accept logwrite = "rcpt ACL"
 .else
 acl_smtp_rcpt = accept verify = recipient/callout
 .endif
@@ -22,20 +22,28 @@ queue_run_in_order
 tls_advertise_hosts = *
 
 # Set certificate only if server
-CDIR1 = DIR/aux-fixed
+CDIR1 = DIR/aux-fixed/exim-ca/example.net/server1.example.net
 CDIR2 = DIR/aux-fixed/exim-ca/example.com/server1.example.com
 
+.ifdef CERT
+tls_certificate = CERT
+.else
 tls_certificate = ${if eq {SERVER}{server} \
-	{${if or {{eq {DETAILS}{ta}} {eq {DETAILS}{ca}}} \
+	{${if or {{eq {DETAILS}{ta}} {eq {DETAILS}{ca}} {eq {DETAILS}{ee}}} \
 		{CDIR2/fullchain.pem}\
-		{CDIR1/cert1}}}\
+		{CDIR1/fullchain.pem}}}\
 	fail}
+.endif
 
+.ifdef ALLOW
+tls_privatekey = ALLOW
+.else
 tls_privatekey = ${if eq {SERVER}{server} \
-	{${if or {{eq {DETAILS}{ta}} {eq {DETAILS}{ca}}} \
+	{${if or {{eq {DETAILS}{ta}} {eq {DETAILS}{ca}} {eq {DETAILS}{ee}}} \
 		{CDIR2/server1.example.com.unlocked.key}\
-		{CDIR1/cert1}}}\
+		{CDIR1/server1.example.net.unlocked.key}}}\
 	fail}
+.endif
 
 # ----- Routers -----
 
diff --git a/test/confs/5860 b/test/confs/5860
index 81eb5a16d..df9115129 100644
--- a/test/confs/5860
+++ b/test/confs/5860
@@ -19,20 +19,10 @@ queue_run_in_order
 tls_advertise_hosts = *
 
 # Set certificate only if server
-CDIR1 = DIR/aux-fixed
 CDIR2 = DIR/aux-fixed/exim-ca/example.com/server1.example.com
 
-tls_certificate = ${if eq {SERVER}{server} \
-	{${if eq {DETAILS}{ta} \
-		{CDIR2/fullchain.pem}\
-		{CDIR1/cert1}}}\
-	fail}
-
-tls_privatekey = ${if eq {SERVER}{server} \
-	{${if eq {DETAILS}{ta} \
-		{CDIR2/server1.example.com.unlocked.key}\
-		{CDIR1/cert1}}}\
-	fail}
+tls_certificate = ${if eq {SERVER}{server} {CDIR2/fullchain.pem} fail}
+tls_privatekey = ${if eq {SERVER}{server} {CDIR2/server1.example.com.unlocked.key} fail}
 
 
 begin acl
diff --git a/test/dnszones-src/db.test.ex b/test/dnszones-src/db.test.ex
index df1ce4a83..0b8e3f1f4 100644
--- a/test/dnszones-src/db.test.ex
+++ b/test/dnszones-src/db.test.ex
@@ -419,27 +419,29 @@ DNSSEC l-sec   A 127.0.0.1
 AA a-aa        A V4NET.0.0.100
 
 ; ------- Testing DANE ------------
+; Since these refer to certs in the exim-ca tree, they must be regenerated any time that tree is.
+;
 
 ; full suite dns chain, sha512
 ;
-; openssl x509 -in aux-fixed/cert1 -noout -pubkey \
+; openssl x509 -in aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.pem -noout -pubkey \
 ; | openssl pkey -pubin -outform DER \
 ; | openssl dgst -sha512 \
 ; | awk '{print $2}'
 ;
 DNSSEC mxdane512ee          MX  1  dane512ee
 DNSSEC dane512ee            A      HOSTIPV4
-DNSSEC _1225._tcp.dane512ee TLSA  3 1 2 3d5eb81b1dfc3f93c1fa8819e3fb3fdb41bb590441d5f3811db17772f4bc6de29bdd7c4f4b723750dda871b99379192b3f979f03db1252c4f08b03ef7176528d
+DNSSEC _1225._tcp.dane512ee TLSA  3 1 2 69e8a5ddf24df2c51dc503959d26e621be4ce3853f71890512de3ae3390c5749ef3368dd4d274669b0653da8c3663f12ca092cd98e5e242e4de57ee6aa01cde1
 
 ; A-only, sha256
 ;
-; openssl x509 -in aux-fixed/cert1 -noout -pubkey \
+; openssl x509 -in aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.pem -noout -pubkey \
 ; | openssl pkey -pubin -outform DER \
 ; | openssl dgst -sha256 \
 ; | awk '{print $2}'
 ;
 DNSSEC dane256ee            A      HOSTIPV4
-DNSSEC _1225._tcp.dane256ee TLSA  3 1 1 2bb55f418bb03411a5007cecbfcd3ec1c94404312c0d53a44bb2166b32654db3
+DNSSEC _1225._tcp.dane256ee TLSA  3 1 1 827664533176a58b3578e0e91d77d79d036d3a97f023d82baeefa8b8e13b44f8
 
 ; full MX, sha256, TA-mode
 ;
@@ -448,7 +450,24 @@ DNSSEC _1225._tcp.dane256ee TLSA  3 1 1 2bb55f418bb03411a5007cecbfcd3ec1c9440431
 ;
 DNSSEC mxdane256ta          MX  1  dane256ta
 DNSSEC dane256ta            A      HOSTIPV4
-DNSSEC _1225._tcp.dane256ta TLSA 2 0 1 9a7831821c66655d94d48babf8b826c19a0fea391091e4308bbae8fdb5c8e989
+DNSSEC _1225._tcp.dane256ta TLSA 2 0 1 cb0fa6a633e52c787657f5ca0da1030800223cac459577b9b6a55ac9733348e5
+
+
+; full MX, sha256, TA-mode, cert-key-only
+; Indicates a trust-anchor for a chain involving an Authority Key ID extension
+; linkage, as this excites a bug in OpenSSL 1.0.2 which the DANE code has to
+; work around, while synthesizing a selfsigned parent for it.
+; As it happens it is also an intermediate cert in the CA-rooted chain, as this
+; was initially thought ot be a factor.
+;
+; openssl x509 -in aux-fixed/exim-ca/example.com/CA/Signer.pem -noout -pubkey \
+; | openssl pkey -pubin -outform DER \
+; | openssl dgst -sha256 \
+; | awk '{print $2}'
+;
+DNSSEC mxdane256tak          MX  1  dane256tak
+DNSSEC dane256tak            A      HOSTIPV4
+DNSSEC _1225._tcp.dane256tak TLSA 2 1 1 73e279c0f5f5a9ee9851bbbc39023603d7b266acfd0764419c3b07cc380b79f9
 
 
 ; A multiple-return MX where all TLSA lookups defer
@@ -470,6 +489,27 @@ DNSSEC dane.no.2            A       127.0.0.1
 DNSSEC danebroken1          A       127.0.0.1
 _1225._tcp.danebroken1      CNAME   test.fail.dns.
 
+; a broken dane config (or under attack) where the TLSA record is wrong
+; (127.0.0.1 for merely dane-requested, but having gotten the TLSA it is supposedly definitive)
+DNSSEC danebroken2          A       127.0.0.1
+DNSSEC _1225._tcp.danebroken2 TLSA 2 0 1 cb0fa60000000000000000000000000000000000000000000000000000000000
+
+; a broken dane config (or under attack) where the TLSA record is correct but not DNSSEC-assured
+; (record copied from dane256ee above)
+; 3 for dane-requested, 4 for dane-required
+DNSSEC danebroken3          A       127.0.0.1
+_1225._tcp.danebroken3 TLSA 2 0 1 827664533176a58b3578e0e91d77d79d036d3a97f023d82baeefa8b8e13b44f8
+DNSSEC danebroken4          A       HOSTIPV4
+_1225._tcp.danebroken4 TLSA 2 0 1 827664533176a58b3578e0e91d77d79d036d3a97f023d82baeefa8b8e13b44f8
+
+; a broken dane config (or under attack) where the address record is correct but not DNSSEC-assured
+; (TLSA record copied from dane256ee above)
+; 5 for dane-requested, 6 for dane-required
+danebroken5          A       127.0.0.1
+DNSSEC _1225._tcp.danebroken5 TLSA 2 0 1 827664533176a58b3578e0e91d77d79d036d3a97f023d82baeefa8b8e13b44f8
+danebroken6          A       HOSTIPV4
+DNSSEC _1225._tcp.danebroken6 TLSA 2 0 1 827664533176a58b3578e0e91d77d79d036d3a97f023d82baeefa8b8e13b44f8
+
 ; a good dns config saying there is no dane support, by securely returning NOXDOMAIN for TLSA lookups
 ; 3 for dane-required, 4 for merely requested
 ; the TLSA data here is dummy; ignored
@@ -505,5 +545,7 @@ ses._domainkey TXT "v=DKIM1; n=halfkilo; p=MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAL6eA
 ses_sha1._domainkey TXT "v=DKIM1; h=sha1; p=MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAL6eAQxd9didJ0/+05iDwJOqT6ly826Vi8aGPecsBiYK5/tAT97fxXk+dPWMZp9kQxtknEzYjYjAydzf+HQ2yJMCAwEAAQ=="
 ses_sha256._domainkey TXT "v=DKIM1; h=sha256; p=MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAL6eAQxd9didJ0/+05iDwJOqT6ly826Vi8aGPecsBiYK5/tAT97fxXk+dPWMZp9kQxtknEzYjYjAydzf+HQ2yJMCAwEAAQ=="
 
+sel2._domainkey TXT "v=spf1 mx a include:spf.nl2go.com -all"
+sel2._domainkey TXT "v=DKIM1; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDXRFf+VhT+lCgFhhSkinZKcFNeRzjYdW8vT29Rbb3NadvTFwAd+cVLPFwZL8H5tUD/7JbUPqNTCPxmpgIL+V5T4tEZMorHatvvUM2qfcpQ45IfsZ+YdhbIiAslHCpy4xNxIR3zylgqRUF4+Dtsaqy3a5LhwMiKCLrnzhXk1F1hxwIDAQAB"
 
 ; End
diff --git a/test/log/2002 b/test/log/2002
index b5ed68f3d..9099a1c01 100644
--- a/test/log/2002
+++ b/test/log/2002
@@ -27,19 +27,19 @@
 1999-03-02 09:44:33 SN  <CN=server2.example.com>
 1999-03-02 09:44:33 IN  <O=example.com,CN=clica Signing Cert rsa>
 1999-03-02 09:44:33 IN/O <example.com>
-1999-03-02 09:44:33 NB/r <Nov  1 12:34:01 2012 GMT>
-1999-03-02 09:44:33 NB   <Nov  1 12:34:01 2012 GMT>
-1999-03-02 09:44:33 NB/i <1351773241>
-1999-03-02 09:44:33 NA/i <2143283641>
-1999-03-02 09:44:33 NA   <Dec  1 12:34:01 2037 GMT>
+1999-03-02 09:44:33 NB/r <Nov  1 12:34:04 2012 GMT>
+1999-03-02 09:44:33 NB   <Nov  1 12:34:04 2012 GMT>
+1999-03-02 09:44:33 NB/i <1351773244>
+1999-03-02 09:44:33 NA/i <2143283644>
+1999-03-02 09:44:33 NA   <Dec  1 12:34:04 2037 GMT>
 1999-03-02 09:44:33 SA  <RSA-SHA256>
-1999-03-02 09:44:33 SG  <19 0c f4 82 0c 4a 90 45 f1 e7 47 97 fe e5 ad 94 2e fe 24 5c 2c 24 b0 61 53 f9 c6 06 63 8b c7 31 e1 a6 da d1 04 b8 aa 2d 8a fc 0a 18 fd d9 e6 4d 9c 3a f5 1d 46 34 8c 80 bc 3d c3 c3 8e 98 33 d6 bb 3e e8 73 b2 dc 5f be b7 bb be c7 5c 7c f4 c4 36 0d 48 c2 aa ac a3 88 cf cf ce e2 ac 75 4e 15 4d 55 ec bb c4 78 c7 c6 12 8c 27 d7 78 a2 40 94 e2 f8 ac fc b6 c1 4d f0 5d 18 73 09 fe 04 b7 81>
-1999-03-02 09:44:33 SAN <DNS=server2.example.com>
-1999-03-02 09:44:33 CRU <http://crl.example.com/latest.crl>
-1999-03-02 09:44:33 md5    fingerprint 7A3C37D07696CADBC539AB02A8A0C82A
-1999-03-02 09:44:33 sha1   fingerprint 0D9E776B02AFDEFB0231588927D305CA81F00366
-1999-03-02 09:44:33 sha256 fingerprint 3B8118604CE886FD44668735B467D32CA1A03C9EBA610F6EF54BB8CCA223F12F
-1999-03-02 09:44:33 der_b64 MIICjDCCAfWgAwIBAgICAMkwDQYJKoZIhvcNAQELBQAwNzEUMBIGA1UEChMLZXhhbXBsZS5jb20xHzAdBgNVBAMTFmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwHhcNMTIxMTAxMTIzNDAxWhcNMzcxMjAxMTIzNDAxWjAeMRwwGgYDVQQDExNzZXJ2ZXIyLmV4YW1wbGUuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC5xczcpFPcohZhLegf/wzSJvwj/dVkXg0MEyVulbMS+sgCwwSO6uGykJVc6ZKUnGqFyv5Icp1zG9Y9/joYefiXN5K1n/3NrtsET+6AJDWzZYz/AyRGd07xLwEw+Ip0/bqqNaxpc07L1qAABcwz2lcSeKsIDbYC9znSdEzuNUFmGQIDAQABo4G/MIG8MA4GA1UdDwEB/wQEAwIE8DAgBgNVHSUBAf8EFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwMgYDVR0fBCswKTAnoCWgI4YhaHR0cDovL2NybC5leGFtcGxlLmNvbS9sYXRlc3QuY3JsMDQGCCsGAQUFBwEBBCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29zY3AuZXhhbXBsZS5jb20vMB4GA1UdEQQXMBWCE3NlcnZlcjIuZXhhbXBsZS5jb20wDQYJKoZIhvcNAQELBQADgYEAGQz0ggxKkEXx50eX/uWtlC7+JFwsJLBhU/nGBmOLxzHhptrRBLiqLYr8Chj92eZNnDr1HUY0jIC8PcPDjpgz1rs+6HOy3F++t7u+x1x89MQ2DUjCqqyjiM/PzuKsdU4VTVXsu8R4x8YSjCfXeKJAlOL4rPy2wU3wXRhzCf4Et4E=
+1999-03-02 09:44:33 SG  <80 00 39 4c bb 2c 16 e6 be ee 54 b7 f6 9f 89 fe 71 62 79 2f 90 57 95 07 54 67 2f e9 12 96 41 1b c5 9b dd de 68 2d e5 d7 a7 35 c7 ea b1 d9 95 12 40 49 0c 07 3d 0c 74 df 57 d1 b6 04 5f 83 5c 15 fe 9a 7f b7 35 7d ec f8 b7 4d ac 76 ea 8c 44 8a 86 e0 42 38 78 ff 68 8a 09 83 44 10 67 b4 fd a4 5c a4 ea 91 41 e7 8e a7 79 37 f6 e2 f8 de 9d 0f 96 85 18 22 2c 5c 06 af 01 85 94 62 c1 69 8d 2e>
+1999-03-02 09:44:33 SAN <DNS=server2.example.com\nDNS=*.test.ex>
+1999-03-02 09:44:33 (no CRU)
+1999-03-02 09:44:33 md5    fingerprint 313E07141F2FF0CBC0A76EB57CA49D58
+1999-03-02 09:44:33 sha1   fingerprint 778B892247D2ABD365BA1530A50141AF052E271E
+1999-03-02 09:44:33 sha256 fingerprint 05F3012D41AE8A8173BE3AE71F7F9B3535391CACF77003B723F14B21064F6648
+1999-03-02 09:44:33 der_b64 MIICszCCAhygAwIBAgICAMkwDQYJKoZIhvcNAQELBQAwNzEUMBIGA1UEChMLZXhhbXBsZS5jb20xHzAdBgNVBAMTFmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwHhcNMTIxMTAxMTIzNDA0WhcNMzcxMjAxMTIzNDA0WjAeMRwwGgYDVQQDExNzZXJ2ZXIyLmV4YW1wbGUuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCf6MdoozlJCZPwdIHXdFHddXJfZ5xn2e6XoMmSjqOrOJYIIFKdgtlrMhtTVU1VLlK6V7H8142r78YQ4RKcj9QhTuQJxrrVtVuRt38Zy4RW0/+ujMcXoV8nV7Yt1c1z/tIJ4afSapAnAAm5wVdIbUhUeM/K5Wozm1gV5OCtNZPa4QIDAQABo4HmMIHjMA4GA1UdDwEB/wQEAwIE8DAgBgNVHSUBAf8EFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwTgYDVR0jBEcwRYANQUFidHdDeGNYZ2IwUaExpC8wLTEUMBIGA1UEChMLZXhhbXBsZS5jb20xFTATBgNVBAMTDGNsaWNhIENBIHJzYYIBQjA0BggrBgEFBQcBAQQoMCYwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vc2NwLmV4YW1wbGUuY29tLzApBgNVHREEIjAgghNzZXJ2ZXIyLmV4YW1wbGUuY29tggkqLnRlc3QuZXgwDQYJKoZIhvcNAQELBQADgYEAgAA5TLssFua+7lS39p+J/nFieS+QV5UHVGcv6RKWQRvFm93eaC3l16c1x+qx2ZUSQEkMBz0MdN9X0bYEX4NcFf6af7c1fez4t02sduqMRIqG4EI4eP9oigmDRBBntP2kXKTqkUHnjqd5N/bi+N6dD5aFGCIsXAavAYWUYsFpjS4=
 1999-03-02 09:44:33 10HmaZ-0005vi-00 <= CALLER@test.ex H=[ip4.ip4.ip4.ip4] P=smtps X=TLS1.x:ke_RSA_AES_256_CBC_SHAnnn:256 CV=yes DN="CN=server2.example.com" S=sss
 1999-03-02 09:44:33 Our cert SN: <CN=server1.example.com>
 1999-03-02 09:44:33 Peer did not present a cert
diff --git a/test/log/2014 b/test/log/2014
index 163507dea..85f9d31de 100644
--- a/test/log/2014
+++ b/test/log/2014
@@ -3,8 +3,8 @@
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 TLS error on connection from (rhu1.barb) [ip4.ip4.ip4.ip4] (gnutls_handshake): The peer did not send any certificate.
 1999-03-02 09:44:33 H=(rhu2tls.barb) [127.0.0.1] X=TLS1.x:ke_RSA_AES_256_CBC_SHAnnn:256 CV=no F=<userx@test.ex> rejected RCPT <userx@test.ex>: certificate not verified: peerdn=
-1999-03-02 09:44:33 TLS error on connection from (rhu5.barb) [ip4.ip4.ip4.ip4] (certificate verification failed): certificate invalid
-1999-03-02 09:44:33 H=[127.0.0.1] X=TLS1.x:ke_RSA_AES_256_CBC_SHAnnn:256 CV=no DN="C=UK,O=The Exim Maintainers,OU=Test Suite,CN=Phil Pennock" F=<userx@test.ex> rejected RCPT <userx@test.ex>: certificate not verified: peerdn=C=UK,O=The Exim Maintainers,OU=Test Suite,CN=Phil Pennock
+1999-03-02 09:44:33 TLS error on connection from (rhu5.barb) [ip4.ip4.ip4.ip4] (gnutls_handshake): The peer did not send any certificate.
+1999-03-02 09:44:33 H=[127.0.0.1] X=TLS1.x:ke_RSA_AES_256_CBC_SHAnnn:256 CV=no F=<userx@test.ex> rejected RCPT <userx@test.ex>: certificate not verified: peerdn=
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 TLS error on connection from (rhu7.barb) [ip4.ip4.ip4.ip4] (certificate verification failed): certificate revoked
-1999-03-02 09:44:33 H=[127.0.0.1] X=TLS1.x:ke_RSA_AES_256_CBC_SHAnnn:256 CV=no DN="C=UK,O=The Exim Maintainers,OU=Test Suite,CN=Phil Pennock" F=<userx@test.ex> rejected RCPT <userx@test.ex>: certificate not verified: peerdn=C=UK,O=The Exim Maintainers,OU=Test Suite,CN=Phil Pennock
+1999-03-02 09:44:33 H=[127.0.0.1] X=TLS1.x:ke_RSA_AES_256_CBC_SHAnnn:256 CV=no DN="CN=revoked1.example.com" F=<userx@test.ex> rejected RCPT <userx@test.ex>: certificate not verified: peerdn=CN=revoked1.example.com
diff --git a/test/log/2102 b/test/log/2102
index 1f254e3f8..aca6f79b5 100644
--- a/test/log/2102
+++ b/test/log/2102
@@ -25,20 +25,20 @@
 1999-03-02 09:44:33 SN  <CN=server2.example.com>
 1999-03-02 09:44:33 IN  <CN=clica Signing Cert rsa,O=example.com>
 1999-03-02 09:44:33 IN/O <example.com>
-1999-03-02 09:44:33 NB/r <Nov  1 12:34:01 2012 GMT>
-1999-03-02 09:44:33 NB   <Nov  1 12:34:01 2012 +0000>
-1999-03-02 09:44:33 NB/i <1351773241>
-1999-03-02 09:44:33 NA/i <2143283641>
-1999-03-02 09:44:33 NA   <Dec  1 12:34:01 2037 +0000>
+1999-03-02 09:44:33 NB/r <Nov  1 12:34:04 2012 GMT>
+1999-03-02 09:44:33 NB   <Nov  1 12:34:04 2012 +0000>
+1999-03-02 09:44:33 NB/i <1351773244>
+1999-03-02 09:44:33 NA/i <2143283644>
+1999-03-02 09:44:33 NA   <Dec  1 12:34:04 2037 +0000>
 1999-03-02 09:44:33 SA  <sha256WithRSAEncryption>
-1999-03-02 09:44:33 SG  <         19:0c:f4:82:0c:4a:90:45:f1:e7:47:97:fe:e5:ad:94:2e:fe:\n         24:5c:2c:24:b0:61:53:f9:c6:06:63:8b:c7:31:e1:a6:da:d1:\n         04:b8:aa:2d:8a:fc:0a:18:fd:d9:e6:4d:9c:3a:f5:1d:46:34:\n         8c:80:bc:3d:c3:c3:8e:98:33:d6:bb:3e:e8:73:b2:dc:5f:be:\n         b7:bb:be:c7:5c:7c:f4:c4:36:0d:48:c2:aa:ac:a3:88:cf:cf:\n         ce:e2:ac:75:4e:15:4d:55:ec:bb:c4:78:c7:c6:12:8c:27:d7:\n         78:a2:40:94:e2:f8:ac:fc:b6:c1:4d:f0:5d:18:73:09:fe:04:\n         b7:81\n>
-1999-03-02 09:44:33 SAN <DNS=server2.example.com>
+1999-03-02 09:44:33 SG  <         80:00:39:4c:bb:2c:16:e6:be:ee:54:b7:f6:9f:89:fe:71:62:\n         79:2f:90:57:95:07:54:67:2f:e9:12:96:41:1b:c5:9b:dd:de:\n         68:2d:e5:d7:a7:35:c7:ea:b1:d9:95:12:40:49:0c:07:3d:0c:\n         74:df:57:d1:b6:04:5f:83:5c:15:fe:9a:7f:b7:35:7d:ec:f8:\n         b7:4d:ac:76:ea:8c:44:8a:86:e0:42:38:78:ff:68:8a:09:83:\n         44:10:67:b4:fd:a4:5c:a4:ea:91:41:e7:8e:a7:79:37:f6:e2:\n         f8:de:9d:0f:96:85:18:22:2c:5c:06:af:01:85:94:62:c1:69:\n         8d:2e\n>
+1999-03-02 09:44:33 SAN <DNS=*.test.ex\nDNS=server2.example.com>
 1999-03-02 09:44:33 OCU <http://oscp.example.com/>
-1999-03-02 09:44:33 CRU <http://crl.example.com/latest.crl>
-1999-03-02 09:44:33 md5    fingerprint 7A3C37D07696CADBC539AB02A8A0C82A
-1999-03-02 09:44:33 sha1   fingerprint 0D9E776B02AFDEFB0231588927D305CA81F00366
-1999-03-02 09:44:33 sha256 fingerprint 3B8118604CE886FD44668735B467D32CA1A03C9EBA610F6EF54BB8CCA223F12F
-1999-03-02 09:44:33 der_b64 MIICjDCCAfWgAwIBAgICAMkwDQYJKoZIhvcNAQELBQAwNzEUMBIGA1UEChMLZXhhbXBsZS5jb20xHzAdBgNVBAMTFmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwHhcNMTIxMTAxMTIzNDAxWhcNMzcxMjAxMTIzNDAxWjAeMRwwGgYDVQQDExNzZXJ2ZXIyLmV4YW1wbGUuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC5xczcpFPcohZhLegf/wzSJvwj/dVkXg0MEyVulbMS+sgCwwSO6uGykJVc6ZKUnGqFyv5Icp1zG9Y9/joYefiXN5K1n/3NrtsET+6AJDWzZYz/AyRGd07xLwEw+Ip0/bqqNaxpc07L1qAABcwz2lcSeKsIDbYC9znSdEzuNUFmGQIDAQABo4G/MIG8MA4GA1UdDwEB/wQEAwIE8DAgBgNVHSUBAf8EFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwMgYDVR0fBCswKTAnoCWgI4YhaHR0cDovL2NybC5leGFtcGxlLmNvbS9sYXRlc3QuY3JsMDQGCCsGAQUFBwEBBCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29zY3AuZXhhbXBsZS5jb20vMB4GA1UdEQQXMBWCE3NlcnZlcjIuZXhhbXBsZS5jb20wDQYJKoZIhvcNAQELBQADgYEAGQz0ggxKkEXx50eX/uWtlC7+JFwsJLBhU/nGBmOLxzHhptrRBLiqLYr8Chj92eZNnDr1HUY0jIC8PcPDjpgz1rs+6HOy3F++t7u+x1x89MQ2DUjCqqyjiM/PzuKsdU4VTVXsu8R4x8YSjCfXeKJAlOL4rPy2wU3wXRhzCf4Et4E=
+1999-03-02 09:44:33 (no CRU)
+1999-03-02 09:44:33 md5    fingerprint 313E07141F2FF0CBC0A76EB57CA49D58
+1999-03-02 09:44:33 sha1   fingerprint 778B892247D2ABD365BA1530A50141AF052E271E
+1999-03-02 09:44:33 sha256 fingerprint 05F3012D41AE8A8173BE3AE71F7F9B3535391CACF77003B723F14B21064F6648
+1999-03-02 09:44:33 der_b64 MIICszCCAhygAwIBAgICAMkwDQYJKoZIhvcNAQELBQAwNzEUMBIGA1UEChMLZXhhbXBsZS5jb20xHzAdBgNVBAMTFmNsaWNhIFNpZ25pbmcgQ2VydCByc2EwHhcNMTIxMTAxMTIzNDA0WhcNMzcxMjAxMTIzNDA0WjAeMRwwGgYDVQQDExNzZXJ2ZXIyLmV4YW1wbGUuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCf6MdoozlJCZPwdIHXdFHddXJfZ5xn2e6XoMmSjqOrOJYIIFKdgtlrMhtTVU1VLlK6V7H8142r78YQ4RKcj9QhTuQJxrrVtVuRt38Zy4RW0/+ujMcXoV8nV7Yt1c1z/tIJ4afSapAnAAm5wVdIbUhUeM/K5Wozm1gV5OCtNZPa4QIDAQABo4HmMIHjMA4GA1UdDwEB/wQEAwIE8DAgBgNVHSUBAf8EFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwTgYDVR0jBEcwRYANQUFidHdDeGNYZ2IwUaExpC8wLTEUMBIGA1UEChMLZXhhbXBsZS5jb20xFTATBgNVBAMTDGNsaWNhIENBIHJzYYIBQjA0BggrBgEFBQcBAQQoMCYwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vc2NwLmV4YW1wbGUuY29tLzApBgNVHREEIjAgghNzZXJ2ZXIyLmV4YW1wbGUuY29tggkqLnRlc3QuZXgwDQYJKoZIhvcNAQELBQADgYEAgAA5TLssFua+7lS39p+J/nFieS+QV5UHVGcv6RKWQRvFm93eaC3l16c1x+qx2ZUSQEkMBz0MdN9X0bYEX4NcFf6af7c1fez4t02sduqMRIqG4EI4eP9oigmDRBBntP2kXKTqkUHnjqd5N/bi+N6dD5aFGCIsXAavAYWUYsFpjS4=
 1999-03-02 09:44:33 10HmaZ-0005vi-00 <= CALLER@test.ex H=[ip4.ip4.ip4.ip4] P=smtps X=TLSv1:ke-RSA-AES256-SHA:xxx CV=yes DN="/CN=server2.example.com" S=sss
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 Our cert SN: <CN=server1.example_ec.com>
diff --git a/test/log/2114 b/test/log/2114
index 28fc75014..067820db5 100644
--- a/test/log/2114
+++ b/test/log/2114
@@ -3,13 +3,13 @@
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 TLS error on connection from (rhu.barb) [ip4.ip4.ip4.ip4] (SSL_accept): error: <<detail omitted>>
 1999-03-02 09:44:33 H=(rhu.barb) [127.0.0.1] X=TLSv1:ke-RSA-AES256-SHA:xxx CV=no F=<userx@test.ex> rejected RCPT <userx@test.ex>: certificate not verified: peerdn=
-1999-03-02 09:44:33 [ip4.ip4.ip4.ip4] SSL verify error: depth=0 error=self signed certificate cert=/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock
+1999-03-02 09:44:33 [ip4.ip4.ip4.ip4] SSL verify error: depth=0 error=unable to get local issuer certificate cert=/CN=server1.example.net
 1999-03-02 09:44:33 TLS error on connection from (rhu.barb) [ip4.ip4.ip4.ip4] (SSL_accept): error: <<detail omitted>>
-1999-03-02 09:44:33 [127.0.0.1] SSL verify error: depth=0 error=self signed certificate cert=/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock
-1999-03-02 09:44:33 H=[127.0.0.1] X=TLSv1:ke-RSA-AES256-SHA:xxx CV=no DN="/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock" F=<userx@test.ex> rejected RCPT <userx@test.ex>: certificate not verified: peerdn=/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock
+1999-03-02 09:44:33 [127.0.0.1] SSL verify error: depth=0 error=unable to get local issuer certificate cert=/CN=server1.example.net
+1999-03-02 09:44:33 [127.0.0.1] SSL verify error: depth=0 error=unable to verify the first certificate cert=/CN=server1.example.net
+1999-03-02 09:44:33 H=[127.0.0.1] X=TLSv1:ke-RSA-AES256-SHA:xxx CV=no DN="/CN=server1.example.net" F=<userx@test.ex> rejected RCPT <userx@test.ex>: certificate not verified: peerdn=/CN=server1.example.net
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
-1999-03-02 09:44:33 [ip4.ip4.ip4.ip4] SSL verify error: depth=0 error=certificate revoked cert=/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock
+1999-03-02 09:44:33 [ip4.ip4.ip4.ip4] SSL verify error: depth=0 error=certificate revoked cert=/CN=revoked1.example.com
 1999-03-02 09:44:33 TLS error on connection from (rhu.barb) [ip4.ip4.ip4.ip4] (SSL_accept): error: <<detail omitted>>
-1999-03-02 09:44:33 [127.0.0.1] SSL verify error: depth=0 error=self signed certificate cert=/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock
-1999-03-02 09:44:33 [127.0.0.1] SSL verify error: depth=0 error=CRL signature failure cert=/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock
-1999-03-02 09:44:33 H=[127.0.0.1] X=TLSv1:ke-RSA-AES256-SHA:xxx CV=no DN="/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock" F=<userx@test.ex> rejected RCPT <userx@test.ex>: certificate not verified: peerdn=/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock
+1999-03-02 09:44:33 [127.0.0.1] SSL verify error: depth=0 error=certificate revoked cert=/CN=revoked1.example.com
+1999-03-02 09:44:33 H=[127.0.0.1] X=TLSv1:ke-RSA-AES256-SHA:xxx CV=no DN="/CN=revoked1.example.com" F=<userx@test.ex> rejected RCPT <userx@test.ex>: certificate not verified: peerdn=/CN=revoked1.example.com
diff --git a/test/log/3700 b/test/log/3700
index 0558c7f38..82c09850e 100644
--- a/test/log/3700
+++ b/test/log/3700
@@ -9,5 +9,7 @@
 
 ******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225 and for SMTPS on port 1224
+1999-03-02 09:44:33 Auth ACL called, after smtp cmd "STARTTLS"
 1999-03-02 09:44:33 10HmaZ-0005vi-00 <= ok@test.ex H=localhost (myhost.test.ex) [127.0.0.1] P=esmtpsa X=TLS_proto_and_cipher CV=yes A=tls:"Phil Pennock" S=sss id=E10HmaX-0005vi-00@myhost.test.ex for x@y
+1999-03-02 09:44:33 Auth ACL called, after smtp cmd ""
 1999-03-02 09:44:33 10HmbA-0005vi-00 <= ok@test.ex H=localhost (myhost.test.ex) [127.0.0.1] P=esmtpsa X=TLS_proto_and_cipher CV=yes A=tls:"Phil Pennock" S=sss id=E10HmaY-0005vi-00@myhost.test.ex for smtps@y
diff --git a/test/log/4504 b/test/log/4504
new file mode 100644
index 000000000..a4dee26bc
--- /dev/null
+++ b/test/log/4504
@@ -0,0 +1,6 @@
+
+******** SERVER ********
+1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
+1999-03-02 09:44:33 10HmaX-0005vi-00 signer: test.ex bits: 1024
+1999-03-02 09:44:33 10HmaX-0005vi-00 DKIM: d=test.ex s=sel2 c=simple/simple a=rsa-sha512 b=1024 [verification failed - signature did not verify (headers probably modified in transit)]
+1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@bloggs.com H=(xxx) [127.0.0.1] P=smtp S=sss id=qwerty1234@disco-zombie.net
diff --git a/test/log/5652 b/test/log/5652
new file mode 100644
index 000000000..c2f70f714
--- /dev/null
+++ b/test/log/5652
@@ -0,0 +1,16 @@
+1999-03-02 09:44:33 1: Server sends good staple on request, to client requiring RSA auth
+1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@server1.example.com U=CALLER P=local S=sss
+1999-03-02 09:44:33 10HmaX-0005vi-00 => rsa.auth@test.ex R=client T=remote_delivery H=127.0.0.1 [127.0.0.1] X=TLS1.x:ke_RSA_AES_256_CBC_SHAnnn:256 CV=yes DN="CN=server1.example.com" C="250 OK id=10HmaY-0005vi-00"
+1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
+1999-03-02 09:44:33 2: Server sends good staple on request, to client preferring ECDSA auth
+1999-03-02 09:44:33 10HmaZ-0005vi-00 <= CALLER@server1.example.com U=CALLER P=local S=sss
+1999-03-02 09:44:33 10HmaZ-0005vi-00 => ecdsa.auth@test.ex R=client T=remote_delivery H=127.0.0.1 [127.0.0.1] X=TLS1.x:ke_ECDSA_AES_256_CBC_SHAnnn:256 CV=yes DN="CN=server1.example_ec.com" C="250 OK id=10HmbA-0005vi-00"
+1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
+
+******** SERVER ********
+1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
+1999-03-02 09:44:33 acl_mail: ocsp in status: 2 (vfynotdone)
+1999-03-02 09:44:33 10HmaY-0005vi-00 <= <> H=localhost (server1.example.com) [127.0.0.1] P=esmtps X=TLS1.x:ke_RSA_AES_256_CBC_SHAnnn:256 CV=no S=sss id=E10HmaX-0005vi-00@server1.example.com
+1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
+1999-03-02 09:44:33 acl_mail: ocsp in status: 2 (vfynotdone)
+1999-03-02 09:44:33 10HmbA-0005vi-00 <= <> H=localhost (server1.example.com) [127.0.0.1] P=esmtps X=TLS1.x:ke_ECDSA_AES_256_CBC_SHAnnn:256 CV=no S=sss id=E10HmaZ-0005vi-00@server1.example.com
diff --git a/test/log/5710 b/test/log/5710
index a9c5bb211..fe0f6ff46 100644
--- a/test/log/5710
+++ b/test/log/5710
@@ -10,11 +10,11 @@
 1999-03-02 09:44:33 10HmaX-0005vi-00 SN; <CN=server1.example.com>
 1999-03-02 09:44:33 10HmaX-0005vi-00 SNCN<server1.example.com>
 1999-03-02 09:44:33 10HmaX-0005vi-00 IN  <O=example.com,CN=clica Signing Cert rsa>
-1999-03-02 09:44:33 10HmaX-0005vi-00 NB  <Nov  1 12:34:01 2012 GMT>
-1999-03-02 09:44:33 10HmaX-0005vi-00 NA  <Dec  1 12:34:01 2037 GMT>
+1999-03-02 09:44:33 10HmaX-0005vi-00 NB  <Nov  1 12:34:02 2012 GMT>
+1999-03-02 09:44:33 10HmaX-0005vi-00 NA  <Dec  1 12:34:02 2037 GMT>
 1999-03-02 09:44:33 10HmaX-0005vi-00 SA  <RSA-SHA256>
-1999-03-02 09:44:33 10HmaX-0005vi-00 SG  <7a cd 30 27 d2 7c 9d fe c7 12 17 ba ea f4 38 91 c2 4e 5a 92 a8 e2 ad eb e3 16 1d 11 0c ac a2 3e d0 74 13 71 2e dc 4d c2 35 ac 7e 6e aa ac 9d 59 7c a8 9c c5 19 f4 05 96 a6 a3 e3 0c e0 0c 4b 05 ce 3a 50 32 a0 7e b2 43 9b 85 c6 1a 64 d2 c1 fb e4 f7 e7 40 06 51 db e8 50 de 13 a0 ec c6 ef b8 75 5c db bd 8e 52 0b c1 66 4d 45 e0 71 b2 d8 77 18 81 79 4c 29 de c0 b9 ab 9b aa 14 1e 6a dd 9f>
-1999-03-02 09:44:33 10HmaX-0005vi-00 SAN <DNS=alternatename2.server1.example.com\nDNS=server1.example.com\nDNS=alternatename.server1.example.com\nDNS=*.test.ex>
+1999-03-02 09:44:33 10HmaX-0005vi-00 SG  <4a a7 4c 59 e1 1a 26 0a 00 9d 08 38 70 22 79 a3 d7 e9 28 3d df ab 2d e7 e2 bd b3 64 f7 1b 86 57 d8 6e 01 5f 7e 9b ca 2f 34 d9 40 62 ac b6 d3 8a d3 5d ae 8b 86 eb 1d 6f 4b f8 59 63 a9 51 3a 09 31 3f 23 18 d8 49 45 e3 ff cf ac 37 af a1 05 20 3d 0c 95 0a 03 35 a3 0d df a5 a2 a0 6a e4 e3 f1 41 32 d2 7c d6 b7 7e 92 fc 61 f7 c2 f0 b6 d4 1a 11 9b 01 dd 67 a1 88 8d a9 44 54 91 b1 c4 0f d4>
+1999-03-02 09:44:33 10HmaX-0005vi-00 SAN <DNS=*.test.ex\nDNS=server1.example.com\nDNS=alternatename.server1.example.com\nDNS=alternatename2.server1.example.com>
 1999-03-02 09:44:33 10HmaX-0005vi-00 CRU <http://crl.example.com/latest.crl>
 1999-03-02 09:44:33 10HmaX-0005vi-00 TLS session: (certificate verification failed): certificate invalid: delivering unencrypted to H=127.0.0.1 [127.0.0.1] (not in hosts_require_tls)
 1999-03-02 09:44:33 10HmaX-0005vi-00 => bad@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmaZ-0005vi-00"
@@ -32,11 +32,11 @@
 1999-03-02 09:44:33 10HmaY-0005vi-00 SN; <CN=server1.example.com>
 1999-03-02 09:44:33 10HmaY-0005vi-00 SNCN<server1.example.com>
 1999-03-02 09:44:33 10HmaY-0005vi-00 IN  <O=example.com,CN=clica Signing Cert rsa>
-1999-03-02 09:44:33 10HmaY-0005vi-00 NB  <Nov  1 12:34:01 2012 GMT>
-1999-03-02 09:44:33 10HmaY-0005vi-00 NA  <Dec  1 12:34:01 2037 GMT>
+1999-03-02 09:44:33 10HmaY-0005vi-00 NB  <Nov  1 12:34:02 2012 GMT>
+1999-03-02 09:44:33 10HmaY-0005vi-00 NA  <Dec  1 12:34:02 2037 GMT>
 1999-03-02 09:44:33 10HmaY-0005vi-00 SA  <RSA-SHA256>
-1999-03-02 09:44:33 10HmaY-0005vi-00 SG  <7a cd 30 27 d2 7c 9d fe c7 12 17 ba ea f4 38 91 c2 4e 5a 92 a8 e2 ad eb e3 16 1d 11 0c ac a2 3e d0 74 13 71 2e dc 4d c2 35 ac 7e 6e aa ac 9d 59 7c a8 9c c5 19 f4 05 96 a6 a3 e3 0c e0 0c 4b 05 ce 3a 50 32 a0 7e b2 43 9b 85 c6 1a 64 d2 c1 fb e4 f7 e7 40 06 51 db e8 50 de 13 a0 ec c6 ef b8 75 5c db bd 8e 52 0b c1 66 4d 45 e0 71 b2 d8 77 18 81 79 4c 29 de c0 b9 ab 9b aa 14 1e 6a dd 9f>
-1999-03-02 09:44:33 10HmaY-0005vi-00 SAN <DNS=alternatename2.server1.example.com\nDNS=server1.example.com\nDNS=alternatename.server1.example.com\nDNS=*.test.ex>
+1999-03-02 09:44:33 10HmaY-0005vi-00 SG  <4a a7 4c 59 e1 1a 26 0a 00 9d 08 38 70 22 79 a3 d7 e9 28 3d df ab 2d e7 e2 bd b3 64 f7 1b 86 57 d8 6e 01 5f 7e 9b ca 2f 34 d9 40 62 ac b6 d3 8a d3 5d ae 8b 86 eb 1d 6f 4b f8 59 63 a9 51 3a 09 31 3f 23 18 d8 49 45 e3 ff cf ac 37 af a1 05 20 3d 0c 95 0a 03 35 a3 0d df a5 a2 a0 6a e4 e3 f1 41 32 d2 7c d6 b7 7e 92 fc 61 f7 c2 f0 b6 d4 1a 11 9b 01 dd 67 a1 88 8d a9 44 54 91 b1 c4 0f d4>
+1999-03-02 09:44:33 10HmaY-0005vi-00 SAN <DNS=*.test.ex\nDNS=server1.example.com\nDNS=alternatename.server1.example.com\nDNS=alternatename2.server1.example.com>
 1999-03-02 09:44:33 10HmaY-0005vi-00 CRU <http://crl.example.com/latest.crl>
 1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qf
diff --git a/test/log/5720 b/test/log/5720
index 796104207..f358e16fd 100644
--- a/test/log/5720
+++ b/test/log/5720
@@ -13,7 +13,7 @@
 1999-03-02 09:44:33 10HmaX-0005vi-00 NB  <Nov  1 12:34:01 2012 +0000>
 1999-03-02 09:44:33 10HmaX-0005vi-00 NA  <Jan  1 12:34:01 2038 +0000>
 1999-03-02 09:44:33 10HmaX-0005vi-00 SA  <sha256WithRSAEncryption>
-1999-03-02 09:44:33 10HmaX-0005vi-00 SG  <         03:30:ff:66:cc:e8:5f:88:9e:49:04:31:0c:e1:f9:dd:59:22:\n         00:90:ec:df:6a:ac:a3:d6:33:19:b4:1a:7a:7b:91:9d:51:42:\n         ba:8e:eb:b7:af:1c:8c:c7:0e:8f:37:f5:f3:f2:3e:88:c7:87:\n         9c:47:1d:aa:47:e8:60:1e:19:dc:b5:ef:0d:a4:46:66:18:3f:\n         64:eb:f9:f2:6b:b3:46:7b:16:da:84:08:f7:21:6a:0f:00:f4:\n         15:93:ed:33:a5:6a:d0:05:97:8c:bb:aa:22:88:0e:23:97:d2:\n         85:2a:3b:1f:98:5c:de:fa:e4:bd:2e:ca:52:1c:ee:bf:71:4a:\n         9d:a4\n>
+1999-03-02 09:44:33 10HmaX-0005vi-00 SG  <         79:09:c0:76:d0:b8:11:60:39:b6:5f:21:46:53:a6:73:b2:0c:\n         e9:ce:34:30:94:41:ef:7f:ce:8a:e9:7c:c5:c4:b8:97:6a:91:\n         2d:75:00:58:98:dd:77:13:0f:ac:b7:f8:01:89:9c:d2:f4:33:\n         ad:c5:a6:be:47:dd:9e:3a:97:db:7e:43:e5:86:8e:bd:fb:08:\n         2a:bf:98:4e:1b:5b:49:4b:d2:2b:fb:82:18:2c:66:89:01:cb:\n         40:85:9a:ee:85:a7:14:4c:48:02:31:5d:c7:1c:57:9a:f9:cf:\n         3c:6f:3a:74:5a:00:9b:80:06:4b:a9:32:9d:79:96:73:8b:6f:\n         29:82\n>
 1999-03-02 09:44:33 10HmaX-0005vi-00 (no SAN)
 1999-03-02 09:44:33 10HmaX-0005vi-00 (no OCU)
 1999-03-02 09:44:33 10HmaX-0005vi-00 (no CRU)
@@ -35,11 +35,11 @@
 1999-03-02 09:44:33 10HmaY-0005vi-00 SN; <CN=server1.example.com>
 1999-03-02 09:44:33 10HmaY-0005vi-00 SNO <>
 1999-03-02 09:44:33 10HmaY-0005vi-00 IN  <CN=clica Signing Cert rsa,O=example.com>
-1999-03-02 09:44:33 10HmaY-0005vi-00 NB  <Nov  1 12:34:01 2012 +0000>
-1999-03-02 09:44:33 10HmaY-0005vi-00 NA  <Dec  1 12:34:01 2037 +0000>
+1999-03-02 09:44:33 10HmaY-0005vi-00 NB  <Nov  1 12:34:02 2012 +0000>
+1999-03-02 09:44:33 10HmaY-0005vi-00 NA  <Dec  1 12:34:02 2037 +0000>
 1999-03-02 09:44:33 10HmaY-0005vi-00 SA  <sha256WithRSAEncryption>
-1999-03-02 09:44:33 10HmaY-0005vi-00 SG  <         7a:cd:30:27:d2:7c:9d:fe:c7:12:17:ba:ea:f4:38:91:c2:4e:\n         5a:92:a8:e2:ad:eb:e3:16:1d:11:0c:ac:a2:3e:d0:74:13:71:\n         2e:dc:4d:c2:35:ac:7e:6e:aa:ac:9d:59:7c:a8:9c:c5:19:f4:\n         05:96:a6:a3:e3:0c:e0:0c:4b:05:ce:3a:50:32:a0:7e:b2:43:\n         9b:85:c6:1a:64:d2:c1:fb:e4:f7:e7:40:06:51:db:e8:50:de:\n         13:a0:ec:c6:ef:b8:75:5c:db:bd:8e:52:0b:c1:66:4d:45:e0:\n         71:b2:d8:77:18:81:79:4c:29:de:c0:b9:ab:9b:aa:14:1e:6a:\n         dd:9f\n>
-1999-03-02 09:44:33 10HmaY-0005vi-00 SAN <DNS=*.test.ex;DNS=alternatename.server1.example.com;DNS=server1.example.com;DNS=alternatename2.server1.example.com>
+1999-03-02 09:44:33 10HmaY-0005vi-00 SG  <         4a:a7:4c:59:e1:1a:26:0a:00:9d:08:38:70:22:79:a3:d7:e9:\n         28:3d:df:ab:2d:e7:e2:bd:b3:64:f7:1b:86:57:d8:6e:01:5f:\n         7e:9b:ca:2f:34:d9:40:62:ac:b6:d3:8a:d3:5d:ae:8b:86:eb:\n         1d:6f:4b:f8:59:63:a9:51:3a:09:31:3f:23:18:d8:49:45:e3:\n         ff:cf:ac:37:af:a1:05:20:3d:0c:95:0a:03:35:a3:0d:df:a5:\n         a2:a0:6a:e4:e3:f1:41:32:d2:7c:d6:b7:7e:92:fc:61:f7:c2:\n         f0:b6:d4:1a:11:9b:01:dd:67:a1:88:8d:a9:44:54:91:b1:c4:\n         0f:d4\n>
+1999-03-02 09:44:33 10HmaY-0005vi-00 SAN <DNS=alternatename2.server1.example.com;DNS=alternatename.server1.example.com;DNS=server1.example.com;DNS=*.test.ex>
 1999-03-02 09:44:33 10HmaY-0005vi-00 OCU <http://oscp.example.com/>
 1999-03-02 09:44:33 10HmaY-0005vi-00 CRU <http://crl.example.com/latest.crl>
 1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
diff --git a/test/log/5820 b/test/log/5820
new file mode 100644
index 000000000..767e70e68
--- /dev/null
+++ b/test/log/5820
@@ -0,0 +1,107 @@
+1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss for CALLER@dane256ee.test.ex
+1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss for CALLER@mxdane512ee.test.ex
+1999-03-02 09:44:33 Start queue run: pid=pppp -qf
+1999-03-02 09:44:33 10HmaX-0005vi-00 => CALLER@dane256ee.test.ex R=client T=send_to_server H=dane256ee.test.ex [ip4.ip4.ip4.ip4] X=TLS1.x:ke_RSA_AES_256_CBC_SHAnnn:256 CV=dane DN="CN=server1.example.com" C="250 OK id=10HmaZ-0005vi-00"
+1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
+1999-03-02 09:44:33 10HmaY-0005vi-00 => CALLER@mxdane512ee.test.ex R=client T=send_to_server H=dane512ee.test.ex [ip4.ip4.ip4.ip4] X=TLS1.x:ke_RSA_AES_256_CBC_SHAnnn:256 CV=dane DN="CN=server1.example.com" C="250 OK id=10HmbA-0005vi-00"
+1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
+1999-03-02 09:44:33 End queue run: pid=pppp -qf
+1999-03-02 09:44:33 10HmbB-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss for CALLER@mxdane256ta.test.ex
+1999-03-02 09:44:33 10HmbB-0005vi-00 => CALLER@mxdane256ta.test.ex R=client T=send_to_server H=dane256ta.test.ex [ip4.ip4.ip4.ip4] X=TLS1.x:ke_RSA_AES_256_CBC_SHAnnn:256 CV=dane DN="CN=server1.example.com" C="250 OK id=10HmbC-0005vi-00"
+1999-03-02 09:44:33 10HmbB-0005vi-00 Completed
+1999-03-02 09:44:33 10HmbD-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss for CALLER@thishost.test.ex
+1999-03-02 09:44:33 10HmbD-0005vi-00 => CALLER@thishost.test.ex R=client T=send_to_server H=thishost.test.ex [127.0.0.1] X=TLS1.x:ke_RSA_AES_256_CBC_SHAnnn:256 CV=no DN="CN=server1.example.net" C="250 OK id=10HmbE-0005vi-00"
+1999-03-02 09:44:33 10HmbD-0005vi-00 Completed
+1999-03-02 09:44:33 10HmbF-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss for CALLER@thishost.test.ex
+1999-03-02 09:44:33 10HmbF-0005vi-00 => CALLER@thishost.test.ex R=client T=send_to_server H=thishost.test.ex [127.0.0.1] X=TLS1.x:ke_RSA_AES_256_CBC_SHAnnn:256 CV=yes DN="CN=server1.example.com" C="250 OK id=10HmbG-0005vi-00"
+1999-03-02 09:44:33 10HmbF-0005vi-00 Completed
+1999-03-02 09:44:33 Start queue run: pid=pppp -qf
+1999-03-02 09:44:33 End queue run: pid=pppp -qf
+1999-03-02 09:44:33 10HmbH-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss for CALLER@mxdanelazy.test.ex
+1999-03-02 09:44:33 10HmbI-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss for CALLER@dane.no.1.test.ex
+1999-03-02 09:44:33 10HmbJ-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss for CALLER@dane.no.2.test.ex
+1999-03-02 09:44:33 10HmbK-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss for CALLER@danebroken1.test.ex
+1999-03-02 09:44:33 10HmbL-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss for CALLER@dane.no.3.test.ex
+1999-03-02 09:44:33 10HmbM-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss for CALLER@dane.no.4.test.ex
+1999-03-02 09:44:33 Start queue run: pid=pppp -qf
+1999-03-02 09:44:33 10HmbH-0005vi-00 H=danelazy.test.ex [ip4.ip4.ip4.ip4]: DANE error: tlsa lookup DEFER
+1999-03-02 09:44:33 10HmbH-0005vi-00 H=danelazy2.test.ex [127.0.0.1]: DANE error: tlsa lookup DEFER
+1999-03-02 09:44:33 10HmbH-0005vi-00 == CALLER@mxdanelazy.test.ex R=client T=send_to_server defer (-36): DANE error: tlsa lookup DEFER
+1999-03-02 09:44:33 10HmbI-0005vi-00 ** CALLER@dane.no.1.test.ex R=client T=send_to_server: DANE error: tlsa lookup FAIL
+1999-03-02 09:44:33 10HmbI-0005vi-00 CALLER@dane.no.1.test.ex: error ignored
+1999-03-02 09:44:33 10HmbI-0005vi-00 Completed
+1999-03-02 09:44:33 10HmbJ-0005vi-00 => CALLER@dane.no.2.test.ex R=client T=send_to_server H=dane.no.2.test.ex [127.0.0.1] X=TLS1.x:ke_RSA_AES_256_CBC_SHAnnn:256 CV=no DN="CN=server1.example.com" C="250 OK id=10HmbN-0005vi-00"
+1999-03-02 09:44:33 10HmbJ-0005vi-00 Completed
+1999-03-02 09:44:33 10HmbK-0005vi-00 H=danebroken1.test.ex [127.0.0.1]: DANE error: tlsa lookup DEFER
+1999-03-02 09:44:33 10HmbK-0005vi-00 == CALLER@danebroken1.test.ex R=client T=send_to_server defer (-36): DANE error: tlsa lookup DEFER
+1999-03-02 09:44:33 10HmbL-0005vi-00 ** CALLER@dane.no.3.test.ex R=client T=send_to_server: DANE error: tlsa lookup FAIL
+1999-03-02 09:44:33 10HmbL-0005vi-00 CALLER@dane.no.3.test.ex: error ignored
+1999-03-02 09:44:33 10HmbL-0005vi-00 Completed
+1999-03-02 09:44:33 10HmbM-0005vi-00 => CALLER@dane.no.4.test.ex R=client T=send_to_server H=dane.no.4.test.ex [127.0.0.1] X=TLS1.x:ke_RSA_AES_256_CBC_SHAnnn:256 CV=no DN="CN=server1.example.com" C="250 OK id=10HmbO-0005vi-00"
+1999-03-02 09:44:33 10HmbM-0005vi-00 Completed
+1999-03-02 09:44:33 End queue run: pid=pppp -qf
+1999-03-02 09:44:33 10HmbP-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss for CALLER@danebroken2.test.ex
+1999-03-02 09:44:33 10HmbP-0005vi-00 DANE attempt failed; TLS connection to danebroken2.test.ex [127.0.0.1]: (certificate verification failed): Verification failed. CA constrains were violated. 
+1999-03-02 09:44:33 10HmbP-0005vi-00 == CALLER@danebroken2.test.ex R=client T=send_to_server defer (-37) H=danebroken2.test.ex [127.0.0.1]: TLS session: (certificate verification failed): Verification failed. CA constrains were violated. 
+1999-03-02 09:44:33 10HmbQ-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss for CALLER@danebroken3.test.ex
+1999-03-02 09:44:33 10HmbQ-0005vi-00 DANE error: TLSA lookup for danebroken3.test.ex not DNSSEC
+1999-03-02 09:44:33 10HmbQ-0005vi-00 => CALLER@danebroken3.test.ex R=client T=send_to_server H=danebroken3.test.ex [127.0.0.1] X=TLS1.x:ke_RSA_AES_256_CBC_SHAnnn:256 CV=yes DN="CN=server1.example.com" C="250 OK id=10HmbR-0005vi-00"
+1999-03-02 09:44:33 10HmbQ-0005vi-00 Completed
+1999-03-02 09:44:33 10HmbS-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss for CALLER@danebroken4.test.ex
+1999-03-02 09:44:33 10HmbS-0005vi-00 DANE error: TLSA lookup for danebroken4.test.ex not DNSSEC
+1999-03-02 09:44:33 10HmbS-0005vi-00 ** CALLER@danebroken4.test.ex R=client T=send_to_server: DANE error: tlsa lookup FAIL
+1999-03-02 09:44:33 10HmbS-0005vi-00 CALLER@danebroken4.test.ex: error ignored
+1999-03-02 09:44:33 10HmbS-0005vi-00 Completed
+1999-03-02 09:44:33 10HmbT-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss for CALLER@danebroken5.test.ex
+1999-03-02 09:44:33 10HmbT-0005vi-00 => CALLER@danebroken5.test.ex R=client T=send_to_server H=danebroken5.test.ex [127.0.0.1] X=TLS1.x:ke_RSA_AES_256_CBC_SHAnnn:256 CV=yes DN="CN=server1.example.com" C="250 OK id=10HmbU-0005vi-00"
+1999-03-02 09:44:33 10HmbT-0005vi-00 Completed
+1999-03-02 09:44:33 10HmbV-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss for CALLER@danebroken6.test.ex
+1999-03-02 09:44:33 10HmbV-0005vi-00 ** CALLER@danebroken6.test.ex R=client T=send_to_server: DANE error: danebroken6.test.ex lookup not DNSSEC
+1999-03-02 09:44:33 10HmbV-0005vi-00 CALLER@danebroken6.test.ex: error ignored
+1999-03-02 09:44:33 10HmbV-0005vi-00 Completed
+
+******** SERVER ********
+1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
+1999-03-02 09:44:33 "rcpt ACL"
+1999-03-02 09:44:33 10HmaZ-0005vi-00 <= <> H=the.local.host.name (myhost.test.ex) [ip4.ip4.ip4.ip4] P=esmtps X=TLS1.x:ke_RSA_AES_256_CBC_SHAnnn:256 CV=no S=sss id=E10HmaX-0005vi-00@myhost.test.ex for CALLER@dane256ee.test.ex
+1999-03-02 09:44:33 10HmaZ-0005vi-00 => :blackhole: <CALLER@dane256ee.test.ex> R=server
+1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
+1999-03-02 09:44:33 "rcpt ACL"
+1999-03-02 09:44:33 10HmbA-0005vi-00 <= <> H=the.local.host.name (myhost.test.ex) [ip4.ip4.ip4.ip4] P=esmtps X=TLS1.x:ke_RSA_AES_256_CBC_SHAnnn:256 CV=no S=sss id=E10HmaY-0005vi-00@myhost.test.ex for CALLER@mxdane512ee.test.ex
+1999-03-02 09:44:33 10HmbA-0005vi-00 => :blackhole: <CALLER@mxdane512ee.test.ex> R=server
+1999-03-02 09:44:33 10HmbA-0005vi-00 Completed
+1999-03-02 09:44:33 "rcpt ACL"
+1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
+1999-03-02 09:44:33 "rcpt ACL"
+1999-03-02 09:44:33 10HmbC-0005vi-00 <= <> H=the.local.host.name (myhost.test.ex) [ip4.ip4.ip4.ip4] P=esmtps X=TLS1.x:ke_RSA_AES_256_CBC_SHAnnn:256 CV=no S=sss id=E10HmbB-0005vi-00@myhost.test.ex for CALLER@mxdane256ta.test.ex
+1999-03-02 09:44:33 10HmbC-0005vi-00 => :blackhole: <CALLER@mxdane256ta.test.ex> R=server
+1999-03-02 09:44:33 10HmbC-0005vi-00 Completed
+1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
+1999-03-02 09:44:33 "rcpt ACL"
+1999-03-02 09:44:33 10HmbE-0005vi-00 <= <> H=localhost (myhost.test.ex) [127.0.0.1] P=esmtps X=TLS1.x:ke_RSA_AES_256_CBC_SHAnnn:256 CV=no S=sss id=E10HmbD-0005vi-00@myhost.test.ex for CALLER@thishost.test.ex
+1999-03-02 09:44:33 10HmbE-0005vi-00 => :blackhole: <CALLER@thishost.test.ex> R=server
+1999-03-02 09:44:33 10HmbE-0005vi-00 Completed
+1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
+1999-03-02 09:44:33 "rcpt ACL"
+1999-03-02 09:44:33 10HmbG-0005vi-00 <= <> H=localhost (myhost.test.ex) [127.0.0.1] P=esmtps X=TLS1.x:ke_RSA_AES_256_CBC_SHAnnn:256 CV=no S=sss id=E10HmbF-0005vi-00@myhost.test.ex for CALLER@thishost.test.ex
+1999-03-02 09:44:33 10HmbG-0005vi-00 => :blackhole: <CALLER@thishost.test.ex> R=server
+1999-03-02 09:44:33 10HmbG-0005vi-00 Completed
+1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
+1999-03-02 09:44:33 "rcpt ACL"
+1999-03-02 09:44:33 10HmbN-0005vi-00 <= <> H=localhost (myhost.test.ex) [127.0.0.1] P=esmtps X=TLS1.x:ke_RSA_AES_256_CBC_SHAnnn:256 CV=no S=sss id=E10HmbJ-0005vi-00@myhost.test.ex for CALLER@dane.no.2.test.ex
+1999-03-02 09:44:33 10HmbN-0005vi-00 => :blackhole: <CALLER@dane.no.2.test.ex> R=server
+1999-03-02 09:44:33 10HmbN-0005vi-00 Completed
+1999-03-02 09:44:33 "rcpt ACL"
+1999-03-02 09:44:33 10HmbO-0005vi-00 <= <> H=localhost (myhost.test.ex) [127.0.0.1] P=esmtps X=TLS1.x:ke_RSA_AES_256_CBC_SHAnnn:256 CV=no S=sss id=E10HmbM-0005vi-00@myhost.test.ex for CALLER@dane.no.4.test.ex
+1999-03-02 09:44:33 10HmbO-0005vi-00 => :blackhole: <CALLER@dane.no.4.test.ex> R=server
+1999-03-02 09:44:33 10HmbO-0005vi-00 Completed
+1999-03-02 09:44:33 TLS error on connection from localhost [127.0.0.1] (recv): A TLS fatal alert has been received.: Certificate is bad
+1999-03-02 09:44:33 TLS error on connection from localhost [127.0.0.1] (send): The specified session has been invalidated for some reason.
+1999-03-02 09:44:33 "rcpt ACL"
+1999-03-02 09:44:33 10HmbR-0005vi-00 <= <> H=localhost (myhost.test.ex) [127.0.0.1] P=esmtps X=TLS1.x:ke_RSA_AES_256_CBC_SHAnnn:256 CV=no S=sss id=E10HmbQ-0005vi-00@myhost.test.ex for CALLER@danebroken3.test.ex
+1999-03-02 09:44:33 10HmbR-0005vi-00 => :blackhole: <CALLER@danebroken3.test.ex> R=server
+1999-03-02 09:44:33 10HmbR-0005vi-00 Completed
+1999-03-02 09:44:33 "rcpt ACL"
+1999-03-02 09:44:33 10HmbU-0005vi-00 <= <> H=localhost (myhost.test.ex) [127.0.0.1] P=esmtps X=TLS1.x:ke_RSA_AES_256_CBC_SHAnnn:256 CV=no S=sss id=E10HmbT-0005vi-00@myhost.test.ex for CALLER@danebroken5.test.ex
+1999-03-02 09:44:33 10HmbU-0005vi-00 => :blackhole: <CALLER@danebroken5.test.ex> R=server
+1999-03-02 09:44:33 10HmbU-0005vi-00 Completed
diff --git a/test/log/5840 b/test/log/5840
index d824e13e8..2c9a16f0f 100644
--- a/test/log/5840
+++ b/test/log/5840
@@ -1,80 +1,117 @@
 1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss for CALLER@dane256ee.test.ex
 1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss for CALLER@mxdane512ee.test.ex
 1999-03-02 09:44:33 Start queue run: pid=pppp -qf
-1999-03-02 09:44:33 10HmaX-0005vi-00 => CALLER@dane256ee.test.ex R=client T=send_to_server H=dane256ee.test.ex [ip4.ip4.ip4.ip4] X=TLSv1:ke-RSA-AES256-SHA:xxx CV=dane DN="/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock" C="250 OK id=10HmaZ-0005vi-00"
+1999-03-02 09:44:33 10HmaX-0005vi-00 => CALLER@dane256ee.test.ex R=client T=send_to_server H=dane256ee.test.ex [ip4.ip4.ip4.ip4] X=TLSv1:ke-RSA-AES256-SHA:xxx CV=dane DN="/CN=server1.example.com" C="250 OK id=10HmaZ-0005vi-00"
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
-1999-03-02 09:44:33 10HmaY-0005vi-00 => CALLER@mxdane512ee.test.ex R=client T=send_to_server H=dane512ee.test.ex [ip4.ip4.ip4.ip4] X=TLSv1:ke-RSA-AES256-SHA:xxx CV=dane DN="/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock" C="250 OK id=10HmbA-0005vi-00"
+1999-03-02 09:44:33 10HmaY-0005vi-00 => CALLER@mxdane512ee.test.ex R=client T=send_to_server H=dane512ee.test.ex [ip4.ip4.ip4.ip4] X=TLSv1:ke-RSA-AES256-SHA:xxx CV=dane DN="/CN=server1.example.com" C="250 OK id=10HmbA-0005vi-00"
 1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qf
 1999-03-02 09:44:33 10HmbB-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss for CALLER@mxdane256ta.test.ex
-1999-03-02 09:44:33 Start queue run: pid=pppp -qf
 1999-03-02 09:44:33 10HmbB-0005vi-00 => CALLER@mxdane256ta.test.ex R=client T=send_to_server H=dane256ta.test.ex [ip4.ip4.ip4.ip4] X=TLSv1:ke-RSA-AES256-SHA:xxx CV=dane DN="/CN=server1.example.com" C="250 OK id=10HmbC-0005vi-00"
 1999-03-02 09:44:33 10HmbB-0005vi-00 Completed
-1999-03-02 09:44:33 End queue run: pid=pppp -qf
-1999-03-02 09:44:33 10HmbD-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss for CALLER@thishost.test.ex
-1999-03-02 09:44:33 Start queue run: pid=pppp -qf
-1999-03-02 09:44:33 10HmbD-0005vi-00 [127.0.0.1] SSL verify error: depth=0 error=self signed certificate cert=/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock
-1999-03-02 09:44:33 10HmbD-0005vi-00 [127.0.0.1] SSL verify error: certificate name mismatch: DN="/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock" H="thishost.test.ex"
-1999-03-02 09:44:33 10HmbD-0005vi-00 => CALLER@thishost.test.ex R=client T=send_to_server H=thishost.test.ex [127.0.0.1] X=TLSv1:ke-RSA-AES256-SHA:xxx CV=no DN="/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock" C="250 OK id=10HmbE-0005vi-00"
+1999-03-02 09:44:33 10HmbD-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss for CALLER@mxdane256tak.test.ex
+1999-03-02 09:44:33 10HmbD-0005vi-00 => CALLER@mxdane256tak.test.ex R=client T=send_to_server H=dane256tak.test.ex [ip4.ip4.ip4.ip4] X=TLSv1:ke-RSA-AES256-SHA:xxx CV=dane DN="/CN=server2.example.com" C="250 OK id=10HmbE-0005vi-00"
 1999-03-02 09:44:33 10HmbD-0005vi-00 Completed
-1999-03-02 09:44:33 End queue run: pid=pppp -qf
 1999-03-02 09:44:33 10HmbF-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss for CALLER@thishost.test.ex
-1999-03-02 09:44:33 Start queue run: pid=pppp -qf
-1999-03-02 09:44:33 10HmbF-0005vi-00 => CALLER@thishost.test.ex R=client T=send_to_server H=thishost.test.ex [127.0.0.1] X=TLSv1:ke-RSA-AES256-SHA:xxx CV=yes DN="/CN=server1.example.com" C="250 OK id=10HmbG-0005vi-00"
+1999-03-02 09:44:33 10HmbF-0005vi-00 [127.0.0.1] SSL verify error: depth=2 error=self signed certificate in certificate chain cert=/O=example.net/CN=clica CA rsa
+1999-03-02 09:44:33 10HmbF-0005vi-00 => CALLER@thishost.test.ex R=client T=send_to_server H=thishost.test.ex [127.0.0.1] X=TLSv1:ke-RSA-AES256-SHA:xxx CV=no DN="/CN=server1.example.net" C="250 OK id=10HmbG-0005vi-00"
 1999-03-02 09:44:33 10HmbF-0005vi-00 Completed
+1999-03-02 09:44:33 10HmbH-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss for CALLER@thishost.test.ex
+1999-03-02 09:44:33 10HmbH-0005vi-00 => CALLER@thishost.test.ex R=client T=send_to_server H=thishost.test.ex [127.0.0.1] X=TLSv1:ke-RSA-AES256-SHA:xxx CV=yes DN="/CN=server1.example.com" C="250 OK id=10HmbI-0005vi-00"
+1999-03-02 09:44:33 10HmbH-0005vi-00 Completed
+1999-03-02 09:44:33 Start queue run: pid=pppp -qf
 1999-03-02 09:44:33 End queue run: pid=pppp -qf
-1999-03-02 09:44:33 10HmbH-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss for CALLER@mxdanelazy.test.ex
-1999-03-02 09:44:33 10HmbI-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss for CALLER@dane.no.1.test.ex
-1999-03-02 09:44:33 10HmbJ-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss for CALLER@dane.no.2.test.ex
-1999-03-02 09:44:33 10HmbK-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss for CALLER@danebroken1.test.ex
-1999-03-02 09:44:33 10HmbL-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss for CALLER@dane.no.3.test.ex
-1999-03-02 09:44:33 10HmbM-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss for CALLER@dane.no.4.test.ex
+1999-03-02 09:44:33 10HmbJ-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss for CALLER@mxdanelazy.test.ex
+1999-03-02 09:44:33 10HmbK-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss for CALLER@dane.no.1.test.ex
+1999-03-02 09:44:33 10HmbL-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss for CALLER@dane.no.2.test.ex
+1999-03-02 09:44:33 10HmbM-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss for CALLER@danebroken1.test.ex
+1999-03-02 09:44:33 10HmbN-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss for CALLER@dane.no.3.test.ex
+1999-03-02 09:44:33 10HmbO-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss for CALLER@dane.no.4.test.ex
 1999-03-02 09:44:33 Start queue run: pid=pppp -qf
-1999-03-02 09:44:33 10HmbH-0005vi-00 H=danelazy.test.ex [ip4.ip4.ip4.ip4]: DANE error: tlsa lookup DEFER
-1999-03-02 09:44:33 10HmbH-0005vi-00 H=danelazy2.test.ex [127.0.0.1]: DANE error: tlsa lookup DEFER
-1999-03-02 09:44:33 10HmbH-0005vi-00 == CALLER@mxdanelazy.test.ex R=client T=send_to_server defer (-36): DANE error: tlsa lookup DEFER
-1999-03-02 09:44:33 10HmbI-0005vi-00 ** CALLER@dane.no.1.test.ex R=client T=send_to_server: DANE error: tlsa lookup FAIL
-1999-03-02 09:44:33 10HmbI-0005vi-00 CALLER@dane.no.1.test.ex: error ignored
-1999-03-02 09:44:33 10HmbI-0005vi-00 Completed
-1999-03-02 09:44:33 10HmbJ-0005vi-00 [127.0.0.1] SSL verify error: depth=0 error=self signed certificate cert=/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock
-1999-03-02 09:44:33 10HmbJ-0005vi-00 [127.0.0.1] SSL verify error: certificate name mismatch: DN="/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock" H="dane.no.2.test.ex"
-1999-03-02 09:44:33 10HmbJ-0005vi-00 => CALLER@dane.no.2.test.ex R=client T=send_to_server H=dane.no.2.test.ex [127.0.0.1] X=TLSv1:ke-RSA-AES256-SHA:xxx CV=no DN="/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock" C="250 OK id=10HmbN-0005vi-00"
-1999-03-02 09:44:33 10HmbJ-0005vi-00 Completed
-1999-03-02 09:44:33 10HmbK-0005vi-00 H=danebroken1.test.ex [127.0.0.1]: DANE error: tlsa lookup DEFER
-1999-03-02 09:44:33 10HmbK-0005vi-00 == CALLER@danebroken1.test.ex R=client T=send_to_server defer (-36): DANE error: tlsa lookup DEFER
-1999-03-02 09:44:33 10HmbL-0005vi-00 ** CALLER@dane.no.3.test.ex R=client T=send_to_server: DANE error: tlsa lookup FAIL
-1999-03-02 09:44:33 10HmbL-0005vi-00 CALLER@dane.no.3.test.ex: error ignored
+1999-03-02 09:44:33 10HmbJ-0005vi-00 H=danelazy.test.ex [ip4.ip4.ip4.ip4]: DANE error: tlsa lookup DEFER
+1999-03-02 09:44:33 10HmbJ-0005vi-00 H=danelazy2.test.ex [127.0.0.1]: DANE error: tlsa lookup DEFER
+1999-03-02 09:44:33 10HmbJ-0005vi-00 == CALLER@mxdanelazy.test.ex R=client T=send_to_server defer (-36): DANE error: tlsa lookup DEFER
+1999-03-02 09:44:33 10HmbK-0005vi-00 ** CALLER@dane.no.1.test.ex R=client T=send_to_server: DANE error: tlsa lookup FAIL
+1999-03-02 09:44:33 10HmbK-0005vi-00 CALLER@dane.no.1.test.ex: error ignored
+1999-03-02 09:44:33 10HmbK-0005vi-00 Completed
+1999-03-02 09:44:33 10HmbL-0005vi-00 [127.0.0.1] SSL verify error: certificate name mismatch: DN="/CN=server1.example.com" H="dane.no.2.test.ex"
+1999-03-02 09:44:33 10HmbL-0005vi-00 => CALLER@dane.no.2.test.ex R=client T=send_to_server H=dane.no.2.test.ex [127.0.0.1] X=TLSv1:ke-RSA-AES256-SHA:xxx CV=no DN="/CN=server1.example.com" C="250 OK id=10HmbP-0005vi-00"
 1999-03-02 09:44:33 10HmbL-0005vi-00 Completed
-1999-03-02 09:44:33 10HmbM-0005vi-00 [127.0.0.1] SSL verify error: depth=0 error=self signed certificate cert=/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock
-1999-03-02 09:44:33 10HmbM-0005vi-00 [127.0.0.1] SSL verify error: certificate name mismatch: DN="/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock" H="dane.no.4.test.ex"
-1999-03-02 09:44:33 10HmbM-0005vi-00 => CALLER@dane.no.4.test.ex R=client T=send_to_server H=dane.no.4.test.ex [127.0.0.1] X=TLSv1:ke-RSA-AES256-SHA:xxx CV=no DN="/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock" C="250 OK id=10HmbO-0005vi-00"
-1999-03-02 09:44:33 10HmbM-0005vi-00 Completed
+1999-03-02 09:44:33 10HmbM-0005vi-00 H=danebroken1.test.ex [127.0.0.1]: DANE error: tlsa lookup DEFER
+1999-03-02 09:44:33 10HmbM-0005vi-00 == CALLER@danebroken1.test.ex R=client T=send_to_server defer (-36): DANE error: tlsa lookup DEFER
+1999-03-02 09:44:33 10HmbN-0005vi-00 ** CALLER@dane.no.3.test.ex R=client T=send_to_server: DANE error: tlsa lookup FAIL
+1999-03-02 09:44:33 10HmbN-0005vi-00 CALLER@dane.no.3.test.ex: error ignored
+1999-03-02 09:44:33 10HmbN-0005vi-00 Completed
+1999-03-02 09:44:33 10HmbO-0005vi-00 [127.0.0.1] SSL verify error: certificate name mismatch: DN="/CN=server1.example.com" H="dane.no.4.test.ex"
+1999-03-02 09:44:33 10HmbO-0005vi-00 => CALLER@dane.no.4.test.ex R=client T=send_to_server H=dane.no.4.test.ex [127.0.0.1] X=TLSv1:ke-RSA-AES256-SHA:xxx CV=no DN="/CN=server1.example.com" C="250 OK id=10HmbQ-0005vi-00"
+1999-03-02 09:44:33 10HmbO-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qf
+1999-03-02 09:44:33 10HmbR-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss for CALLER@danebroken2.test.ex
+1999-03-02 09:44:33 10HmbR-0005vi-00 DANE attempt failed; TLS connection to danebroken2.test.ex [127.0.0.1]: (SSL_connect): error:xxxxxxxx:SSL routines:ssl3_get_server_certificate:certificate verify failed
+1999-03-02 09:44:33 10HmbR-0005vi-00 == CALLER@danebroken2.test.ex R=client T=send_to_server defer (-37) H=danebroken2.test.ex [127.0.0.1]: TLS session: (SSL_connect): error: <<detail omitted>>
+1999-03-02 09:44:33 10HmbS-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss for CALLER@danebroken3.test.ex
+1999-03-02 09:44:33 10HmbS-0005vi-00 DANE error: TLSA lookup for danebroken3.test.ex not DNSSEC
+1999-03-02 09:44:33 10HmbS-0005vi-00 => CALLER@danebroken3.test.ex R=client T=send_to_server H=danebroken3.test.ex [127.0.0.1] X=TLSv1:ke-RSA-AES256-SHA:xxx CV=yes DN="/CN=server1.example.com" C="250 OK id=10HmbT-0005vi-00"
+1999-03-02 09:44:33 10HmbS-0005vi-00 Completed
+1999-03-02 09:44:33 10HmbU-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss for CALLER@danebroken4.test.ex
+1999-03-02 09:44:33 10HmbU-0005vi-00 DANE error: TLSA lookup for danebroken4.test.ex not DNSSEC
+1999-03-02 09:44:33 10HmbU-0005vi-00 ** CALLER@danebroken4.test.ex R=client T=send_to_server: DANE error: tlsa lookup FAIL
+1999-03-02 09:44:33 10HmbU-0005vi-00 CALLER@danebroken4.test.ex: error ignored
+1999-03-02 09:44:33 10HmbU-0005vi-00 Completed
+1999-03-02 09:44:33 10HmbV-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss for CALLER@danebroken5.test.ex
+1999-03-02 09:44:33 10HmbV-0005vi-00 => CALLER@danebroken5.test.ex R=client T=send_to_server H=danebroken5.test.ex [127.0.0.1] X=TLSv1:ke-RSA-AES256-SHA:xxx CV=yes DN="/CN=server1.example.com" C="250 OK id=10HmbW-0005vi-00"
+1999-03-02 09:44:33 10HmbV-0005vi-00 Completed
+1999-03-02 09:44:33 10HmbX-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss for CALLER@danebroken6.test.ex
+1999-03-02 09:44:33 10HmbX-0005vi-00 ** CALLER@danebroken6.test.ex R=client T=send_to_server: DANE error: danebroken6.test.ex lookup not DNSSEC
+1999-03-02 09:44:33 10HmbX-0005vi-00 CALLER@danebroken6.test.ex: error ignored
+1999-03-02 09:44:33 10HmbX-0005vi-00 Completed
 
 ******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
+1999-03-02 09:44:33 "rcpt ACL"
 1999-03-02 09:44:33 10HmaZ-0005vi-00 <= <> H=the.local.host.name (myhost.test.ex) [ip4.ip4.ip4.ip4] P=esmtps X=TLSv1:ke-RSA-AES256-SHA:xxx CV=no S=sss id=E10HmaX-0005vi-00@myhost.test.ex for CALLER@dane256ee.test.ex
 1999-03-02 09:44:33 10HmaZ-0005vi-00 => :blackhole: <CALLER@dane256ee.test.ex> R=server
 1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
+1999-03-02 09:44:33 "rcpt ACL"
 1999-03-02 09:44:33 10HmbA-0005vi-00 <= <> H=the.local.host.name (myhost.test.ex) [ip4.ip4.ip4.ip4] P=esmtps X=TLSv1:ke-RSA-AES256-SHA:xxx CV=no S=sss id=E10HmaY-0005vi-00@myhost.test.ex for CALLER@mxdane512ee.test.ex
 1999-03-02 09:44:33 10HmbA-0005vi-00 => :blackhole: <CALLER@mxdane512ee.test.ex> R=server
 1999-03-02 09:44:33 10HmbA-0005vi-00 Completed
+1999-03-02 09:44:33 "rcpt ACL"
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
+1999-03-02 09:44:33 "rcpt ACL"
 1999-03-02 09:44:33 10HmbC-0005vi-00 <= <> H=the.local.host.name (myhost.test.ex) [ip4.ip4.ip4.ip4] P=esmtps X=TLSv1:ke-RSA-AES256-SHA:xxx CV=no S=sss id=E10HmbB-0005vi-00@myhost.test.ex for CALLER@mxdane256ta.test.ex
 1999-03-02 09:44:33 10HmbC-0005vi-00 => :blackhole: <CALLER@mxdane256ta.test.ex> R=server
 1999-03-02 09:44:33 10HmbC-0005vi-00 Completed
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
-1999-03-02 09:44:33 10HmbE-0005vi-00 <= <> H=localhost (myhost.test.ex) [127.0.0.1] P=esmtps X=TLSv1:ke-RSA-AES256-SHA:xxx CV=no S=sss id=E10HmbD-0005vi-00@myhost.test.ex for CALLER@thishost.test.ex
-1999-03-02 09:44:33 10HmbE-0005vi-00 => :blackhole: <CALLER@thishost.test.ex> R=server
+1999-03-02 09:44:33 "rcpt ACL"
+1999-03-02 09:44:33 10HmbE-0005vi-00 <= <> H=the.local.host.name (myhost.test.ex) [ip4.ip4.ip4.ip4] P=esmtps X=TLSv1:ke-RSA-AES256-SHA:xxx CV=no S=sss id=E10HmbD-0005vi-00@myhost.test.ex for CALLER@mxdane256tak.test.ex
+1999-03-02 09:44:33 10HmbE-0005vi-00 => :blackhole: <CALLER@mxdane256tak.test.ex> R=server
 1999-03-02 09:44:33 10HmbE-0005vi-00 Completed
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
+1999-03-02 09:44:33 "rcpt ACL"
 1999-03-02 09:44:33 10HmbG-0005vi-00 <= <> H=localhost (myhost.test.ex) [127.0.0.1] P=esmtps X=TLSv1:ke-RSA-AES256-SHA:xxx CV=no S=sss id=E10HmbF-0005vi-00@myhost.test.ex for CALLER@thishost.test.ex
 1999-03-02 09:44:33 10HmbG-0005vi-00 => :blackhole: <CALLER@thishost.test.ex> R=server
 1999-03-02 09:44:33 10HmbG-0005vi-00 Completed
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
-1999-03-02 09:44:33 10HmbN-0005vi-00 <= <> H=localhost (myhost.test.ex) [127.0.0.1] P=esmtps X=TLSv1:ke-RSA-AES256-SHA:xxx CV=no S=sss id=E10HmbJ-0005vi-00@myhost.test.ex for CALLER@dane.no.2.test.ex
-1999-03-02 09:44:33 10HmbN-0005vi-00 => :blackhole: <CALLER@dane.no.2.test.ex> R=server
-1999-03-02 09:44:33 10HmbN-0005vi-00 Completed
-1999-03-02 09:44:33 10HmbO-0005vi-00 <= <> H=localhost (myhost.test.ex) [127.0.0.1] P=esmtps X=TLSv1:ke-RSA-AES256-SHA:xxx CV=no S=sss id=E10HmbM-0005vi-00@myhost.test.ex for CALLER@dane.no.4.test.ex
-1999-03-02 09:44:33 10HmbO-0005vi-00 => :blackhole: <CALLER@dane.no.4.test.ex> R=server
-1999-03-02 09:44:33 10HmbO-0005vi-00 Completed
+1999-03-02 09:44:33 "rcpt ACL"
+1999-03-02 09:44:33 10HmbI-0005vi-00 <= <> H=localhost (myhost.test.ex) [127.0.0.1] P=esmtps X=TLSv1:ke-RSA-AES256-SHA:xxx CV=no S=sss id=E10HmbH-0005vi-00@myhost.test.ex for CALLER@thishost.test.ex
+1999-03-02 09:44:33 10HmbI-0005vi-00 => :blackhole: <CALLER@thishost.test.ex> R=server
+1999-03-02 09:44:33 10HmbI-0005vi-00 Completed
+1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
+1999-03-02 09:44:33 "rcpt ACL"
+1999-03-02 09:44:33 10HmbP-0005vi-00 <= <> H=localhost (myhost.test.ex) [127.0.0.1] P=esmtps X=TLSv1:ke-RSA-AES256-SHA:xxx CV=no S=sss id=E10HmbL-0005vi-00@myhost.test.ex for CALLER@dane.no.2.test.ex
+1999-03-02 09:44:33 10HmbP-0005vi-00 => :blackhole: <CALLER@dane.no.2.test.ex> R=server
+1999-03-02 09:44:33 10HmbP-0005vi-00 Completed
+1999-03-02 09:44:33 "rcpt ACL"
+1999-03-02 09:44:33 10HmbQ-0005vi-00 <= <> H=localhost (myhost.test.ex) [127.0.0.1] P=esmtps X=TLSv1:ke-RSA-AES256-SHA:xxx CV=no S=sss id=E10HmbO-0005vi-00@myhost.test.ex for CALLER@dane.no.4.test.ex
+1999-03-02 09:44:33 10HmbQ-0005vi-00 => :blackhole: <CALLER@dane.no.4.test.ex> R=server
+1999-03-02 09:44:33 10HmbQ-0005vi-00 Completed
+1999-03-02 09:44:33 TLS error on connection from localhost (myhost.test.ex) [127.0.0.1] (SSL_accept): error: <<detail omitted>>
+1999-03-02 09:44:33 "rcpt ACL"
+1999-03-02 09:44:33 10HmbT-0005vi-00 <= <> H=localhost (myhost.test.ex) [127.0.0.1] P=esmtps X=TLSv1:ke-RSA-AES256-SHA:xxx CV=no S=sss id=E10HmbS-0005vi-00@myhost.test.ex for CALLER@danebroken3.test.ex
+1999-03-02 09:44:33 10HmbT-0005vi-00 => :blackhole: <CALLER@danebroken3.test.ex> R=server
+1999-03-02 09:44:33 10HmbT-0005vi-00 Completed
+1999-03-02 09:44:33 "rcpt ACL"
+1999-03-02 09:44:33 10HmbW-0005vi-00 <= <> H=localhost (myhost.test.ex) [127.0.0.1] P=esmtps X=TLSv1:ke-RSA-AES256-SHA:xxx CV=no S=sss id=E10HmbV-0005vi-00@myhost.test.ex for CALLER@danebroken5.test.ex
+1999-03-02 09:44:33 10HmbW-0005vi-00 => :blackhole: <CALLER@danebroken5.test.ex> R=server
+1999-03-02 09:44:33 10HmbW-0005vi-00 Completed
diff --git a/test/log/5860 b/test/log/5860
index 3d39b7878..143548082 100644
--- a/test/log/5860
+++ b/test/log/5860
@@ -1,12 +1,12 @@
 1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss for CALLER@dane256ee.test.ex
 1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss for CALLER@mxdane512ee.test.ex
 1999-03-02 09:44:33 Start queue run: pid=pppp -qf
-1999-03-02 09:44:33 10HmaX-0005vi-00 tls:cert depth = 0 <CN=Phil Pennock,OU=Test Suite,O=The Exim Maintainers,C=UK>
-1999-03-02 09:44:33 10HmaX-0005vi-00 => CALLER@dane256ee.test.ex R=client T=send_to_server H=dane256ee.test.ex [ip4.ip4.ip4.ip4] X=TLSv1:ke-RSA-AES256-SHA:xxx CV=dane DN="/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock" C="250 OK id=10HmaZ-0005vi-00"
+1999-03-02 09:44:33 10HmaX-0005vi-00 tls:cert depth = 0 <CN=server1.example.com>
+1999-03-02 09:44:33 10HmaX-0005vi-00 => CALLER@dane256ee.test.ex R=client T=send_to_server H=dane256ee.test.ex [ip4.ip4.ip4.ip4] X=TLSv1:ke-RSA-AES256-SHA:xxx CV=dane DN="/CN=server1.example.com" C="250 OK id=10HmaZ-0005vi-00"
 1999-03-02 09:44:33 10HmaX-0005vi-00 msg:delivery dane=yes
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
-1999-03-02 09:44:33 10HmaY-0005vi-00 tls:cert depth = 0 <CN=Phil Pennock,OU=Test Suite,O=The Exim Maintainers,C=UK>
-1999-03-02 09:44:33 10HmaY-0005vi-00 => CALLER@mxdane512ee.test.ex R=client T=send_to_server H=dane512ee.test.ex [ip4.ip4.ip4.ip4] X=TLSv1:ke-RSA-AES256-SHA:xxx CV=dane DN="/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock" C="250 OK id=10HmbA-0005vi-00"
+1999-03-02 09:44:33 10HmaY-0005vi-00 tls:cert depth = 0 <CN=server1.example.com>
+1999-03-02 09:44:33 10HmaY-0005vi-00 => CALLER@mxdane512ee.test.ex R=client T=send_to_server H=dane512ee.test.ex [ip4.ip4.ip4.ip4] X=TLSv1:ke-RSA-AES256-SHA:xxx CV=dane DN="/CN=server1.example.com" C="250 OK id=10HmbA-0005vi-00"
 1999-03-02 09:44:33 10HmaY-0005vi-00 msg:delivery dane=yes
 1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qf
diff --git a/test/rejectlog/2014 b/test/rejectlog/2014
index c0a340ea4..0d9f58322 100644
--- a/test/rejectlog/2014
+++ b/test/rejectlog/2014
@@ -1,5 +1,5 @@
 
 ******** SERVER ********
 1999-03-02 09:44:33 H=(rhu2tls.barb) [127.0.0.1] X=TLS1.x:ke_RSA_AES_256_CBC_SHAnnn:256 CV=no F=<userx@test.ex> rejected RCPT <userx@test.ex>: certificate not verified: peerdn=
-1999-03-02 09:44:33 H=[127.0.0.1] X=TLS1.x:ke_RSA_AES_256_CBC_SHAnnn:256 CV=no DN="C=UK,O=The Exim Maintainers,OU=Test Suite,CN=Phil Pennock" F=<userx@test.ex> rejected RCPT <userx@test.ex>: certificate not verified: peerdn=C=UK,O=The Exim Maintainers,OU=Test Suite,CN=Phil Pennock
-1999-03-02 09:44:33 H=[127.0.0.1] X=TLS1.x:ke_RSA_AES_256_CBC_SHAnnn:256 CV=no DN="C=UK,O=The Exim Maintainers,OU=Test Suite,CN=Phil Pennock" F=<userx@test.ex> rejected RCPT <userx@test.ex>: certificate not verified: peerdn=C=UK,O=The Exim Maintainers,OU=Test Suite,CN=Phil Pennock
+1999-03-02 09:44:33 H=[127.0.0.1] X=TLS1.x:ke_RSA_AES_256_CBC_SHAnnn:256 CV=no F=<userx@test.ex> rejected RCPT <userx@test.ex>: certificate not verified: peerdn=
+1999-03-02 09:44:33 H=[127.0.0.1] X=TLS1.x:ke_RSA_AES_256_CBC_SHAnnn:256 CV=no DN="CN=revoked1.example.com" F=<userx@test.ex> rejected RCPT <userx@test.ex>: certificate not verified: peerdn=CN=revoked1.example.com
diff --git a/test/rejectlog/2114 b/test/rejectlog/2114
index 80a140ec2..00bff1111 100644
--- a/test/rejectlog/2114
+++ b/test/rejectlog/2114
@@ -1,5 +1,5 @@
 
 ******** SERVER ********
 1999-03-02 09:44:33 H=(rhu.barb) [127.0.0.1] X=TLSv1:ke-RSA-AES256-SHA:xxx CV=no F=<userx@test.ex> rejected RCPT <userx@test.ex>: certificate not verified: peerdn=
-1999-03-02 09:44:33 H=[127.0.0.1] X=TLSv1:ke-RSA-AES256-SHA:xxx CV=no DN="/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock" F=<userx@test.ex> rejected RCPT <userx@test.ex>: certificate not verified: peerdn=/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock
-1999-03-02 09:44:33 H=[127.0.0.1] X=TLSv1:ke-RSA-AES256-SHA:xxx CV=no DN="/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock" F=<userx@test.ex> rejected RCPT <userx@test.ex>: certificate not verified: peerdn=/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock
+1999-03-02 09:44:33 H=[127.0.0.1] X=TLSv1:ke-RSA-AES256-SHA:xxx CV=no DN="/CN=server1.example.net" F=<userx@test.ex> rejected RCPT <userx@test.ex>: certificate not verified: peerdn=/CN=server1.example.net
+1999-03-02 09:44:33 H=[127.0.0.1] X=TLSv1:ke-RSA-AES256-SHA:xxx CV=no DN="/CN=revoked1.example.com" F=<userx@test.ex> rejected RCPT <userx@test.ex>: certificate not verified: peerdn=/CN=revoked1.example.com
diff --git a/test/scripts/2000-GnuTLS/2014 b/test/scripts/2000-GnuTLS/2014
index c5a01494a..1e12b4ef5 100644
--- a/test/scripts/2000-GnuTLS/2014
+++ b/test/scripts/2000-GnuTLS/2014
@@ -3,7 +3,7 @@ gnutls
 munge gnutls_unexpected
 exim -DSERVER=server -bd -oX PORT_D
 ****
-# No certificate, certificate required
+### No certificate, certificate required
 client-gnutls HOSTIPV4 PORT_D
 ??? 220
 ehlo rhu1.barb
@@ -16,7 +16,7 @@ ehlo rhu1.barb
 starttls
 ??? 220
 ****
-# No certificate, certificate optional at TLS time, required by ACL
+### No certificate, certificate optional at TLS time, required by ACL
 client-gnutls 127.0.0.1 PORT_D
 ??? 220
 ehlo rhu2.barb
@@ -37,8 +37,8 @@ rcpt to:<userx@test.ex>
 quit
 ??? 221
 ****
-# Good certificate, certificate required
-client-gnutls HOSTIPV4 PORT_D aux-fixed/cert2 aux-fixed/cert2
+### Good certificate, certificate required
+client-gnutls HOSTIPV4 PORT_D aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.chain.pem aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.unlocked.key
 ??? 220
 ehlo rhu3.barb
 ??? 250-
@@ -56,8 +56,8 @@ rcpt to:<userx@test.ex>
 quit
 ??? 221
 ****
-# Good certificate, certificate optional at TLS time, checked by ACL
-client-gnutls 127.0.0.1 PORT_D aux-fixed/cert2 aux-fixed/cert2
+### Good certificate, certificate optional at TLS time, checked by ACL
+client-gnutls 127.0.0.1 PORT_D aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.chain.pem aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.unlocked.key
 ??? 220
 ehlo rhu4.barb
 ??? 250-
@@ -75,8 +75,10 @@ rcpt to:<userx@test.ex>
 quit
 ??? 221
 ****
-# Bad certificate, certificate required
-client-gnutls HOSTIPV4 PORT_D aux-fixed/cert1 aux-fixed/cert1
+### Bad certificate, certificate required
+# Actually this test does not have the client presenting a cert at all, as it filters what it has
+# by the options offered by the server first.  So it's not a good testcase.
+client-gnutls HOSTIPV4 PORT_D aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.chain.pem aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.unlocked.key
 ??? 220
 ehlo rhu5.barb
 ??? 250-
@@ -88,8 +90,9 @@ ehlo rhu5.barb
 starttls
 ??? 220
 ****
-# Bad certificate, certificate optional at TLS time, reject at ACL time
-client-gnutls 127.0.0.1 PORT_D aux-fixed/cert1 aux-fixed/cert1
+### Bad certificate, certificate optional at TLS time, reject at ACL time
+# (situation as above)
+client-gnutls 127.0.0.1 PORT_D aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.chain.pem aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.unlocked.key
 ??? 220
 ehlo rhu6.barb
 ??? 250-
@@ -103,16 +106,20 @@ starttls
 mail from:<userx@test.ex>
 ??? 250
 rcpt to:<userx@test.ex>
-??? 550-
 ??? 550
 quit
 ??? 221
 ****
 killdaemon
-exim -DCRL=DIR/aux-fixed/crl.pem -DSERVER=server -bd -oX PORT_D
+#
+#
+#
+#
+exim -DCRL=DIR/aux-fixed/exim-ca/example.com/CA/crl.v2.pem -DSERVER=server -bd -oX PORT_D
 ****
-# Good but revoked certificate, certificate required
-client-gnutls HOSTIPV4 PORT_D aux-fixed/cert2 aux-fixed/cert2
+### Otherwise good but revoked certificate, certificate required
+# GnuTLS seems to not mind the lack of CRLs for the nonleaf certs in the chain, unlike under OpenSSL
+client-gnutls HOSTIPV4 PORT_D aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.chain.pem aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.unlocked.key
 ??? 220
 ehlo rhu7.barb
 ??? 250-
@@ -124,8 +131,8 @@ ehlo rhu7.barb
 starttls
 ??? 220
 ****
-# Revoked certificate, certificate optional at TLS time, reject at ACL time
-client-gnutls 127.0.0.1 PORT_D aux-fixed/cert1 aux-fixed/cert1
+### Revoked certificate, certificate optional at TLS time, reject at ACL time
+client-gnutls 127.0.0.1 PORT_D aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.chain.pem aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.unlocked.key
 ??? 220
 ehlo rhu8.barb
 ??? 250-
@@ -139,9 +146,27 @@ starttls
 mail from:<userx@test.ex>
 ??? 250
 rcpt to:<userx@test.ex>
-??? 550-
 ??? 550
 quit
 ??? 221
 ****
+### Good certificate, certificate required - but nonmatching CRL also present
+client-gnutls HOSTIPV4 PORT_D aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.chain.pem aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.unlocked.key
+??? 220
+ehlo rhu.barb
+??? 250-
+??? 250-
+??? 250-
+??? 250-
+??? 250-
+??? 250
+starttls
+??? 220
+mail from:<userx@test.ex>
+??? 250
+rcpt to:<userx@test.ex>
+??? 250
+quit
+??? 221
+****
 killdaemon
diff --git a/test/scripts/2100-OpenSSL/2114 b/test/scripts/2100-OpenSSL/2114
index 9ba0bf925..49598e366 100644
--- a/test/scripts/2100-OpenSSL/2114
+++ b/test/scripts/2100-OpenSSL/2114
@@ -1,7 +1,7 @@
 # TLS server: mandatory, optional, and revoked certificates
 exim -DSERVER=server -bd -oX PORT_D
 ****
-# No certificate, certificate required
+### No certificate, certificate required
 client-ssl HOSTIPV4 PORT_D
 ??? 220
 ehlo rhu.barb
@@ -14,7 +14,7 @@ ehlo rhu.barb
 starttls
 ??? 220
 ****
-# No certificate, certificate optional at TLS time, required by ACL
+### No certificate, certificate optional at TLS time, required by ACL
 client-ssl 127.0.0.1 PORT_D
 ??? 220
 ehlo rhu.barb
@@ -35,8 +35,8 @@ rcpt to:<userx@test.ex>
 quit
 ??? 221
 ****
-# Good certificate, certificate required
-client-ssl HOSTIPV4 PORT_D aux-fixed/cert2 aux-fixed/cert2
+### Good certificate, certificate required
+client-ssl HOSTIPV4 PORT_D aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.chain.pem aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.unlocked.key
 ??? 220
 ehlo rhu.barb
 ??? 250-
@@ -54,8 +54,8 @@ rcpt to:<userx@test.ex>
 quit
 ??? 221
 ****
-# Good certificate, certificate optional at TLS time, checked by ACL
-client-ssl 127.0.0.1 PORT_D aux-fixed/cert2 aux-fixed/cert2
+### Good certificate, certificate optional at TLS time, checked by ACL
+client-ssl 127.0.0.1 PORT_D aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.chain.pem aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.unlocked.key
 ??? 220
 ehlo rhu.barb
 ??? 250-
@@ -73,8 +73,8 @@ rcpt to:<userx@test.ex>
 quit
 ??? 221
 ****
-# Bad certificate, certificate required
-client-ssl HOSTIPV4 PORT_D aux-fixed/cert1 aux-fixed/cert1
+### Bad certificate, certificate required
+client-ssl HOSTIPV4 PORT_D aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.chain.pem aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.unlocked.key
 ??? 220
 ehlo rhu.barb
 ??? 250-
@@ -86,8 +86,8 @@ ehlo rhu.barb
 starttls
 ??? 220
 ****
-# Bad certificate, certificate optional at TLS time, reject at ACL time
-client-ssl 127.0.0.1 PORT_D aux-fixed/cert1 aux-fixed/cert1
+### Bad certificate, certificate optional at TLS time, reject at ACL time
+client-ssl 127.0.0.1 PORT_D aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.chain.pem aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.unlocked.key
 ??? 220
 ehlo rhu.barb
 ??? 250-
@@ -101,16 +101,19 @@ starttls
 mail from:<userx@test.ex>
 ??? 250
 rcpt to:<userx@test.ex>
-??? 550-
 ??? 550
 quit
 ??? 221
 ****
 killdaemon
-exim -DCRL=DIR/aux-fixed/crl.pem -DSERVER=server -bd -oX PORT_D
+#
+#
+#
+#
+exim -DCRL=DIR/aux-fixed/exim-ca/example.com/CA/crl.chain.pem -DSERVER=server -bd -oX PORT_D
 ****
-# Good but revoked certificate, certificate required
-client-ssl HOSTIPV4 PORT_D aux-fixed/cert2 aux-fixed/cert2
+### Otherwise good but revoked certificate, certificate required
+client-ssl HOSTIPV4 PORT_D aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.chain.pem aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.unlocked.key
 ??? 220
 ehlo rhu.barb
 ??? 250-
@@ -122,8 +125,8 @@ ehlo rhu.barb
 starttls
 ??? 220
 ****
-# Revoked certificate, certificate optional at TLS time, reject at ACL time
-client-ssl 127.0.0.1 PORT_D aux-fixed/cert1 aux-fixed/cert1
+### Revoked certificate, certificate optional at TLS time, reject at ACL time
+client-ssl 127.0.0.1 PORT_D aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.chain.pem aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.unlocked.key
 ??? 220
 ehlo rhu.barb
 ??? 250-
@@ -137,9 +140,27 @@ starttls
 mail from:<userx@test.ex>
 ??? 250
 rcpt to:<userx@test.ex>
-??? 550-
 ??? 550
 quit
 ??? 221
 ****
+### Good certificate, certificate required - but nonmatching CRL also present
+client-ssl HOSTIPV4 PORT_D aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.chain.pem aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.unlocked.key
+??? 220
+ehlo rhu.barb
+??? 250-
+??? 250-
+??? 250-
+??? 250-
+??? 250-
+??? 250
+starttls
+??? 220
+mail from:<userx@test.ex>
+??? 250
+rcpt to:<userx@test.ex>
+??? 250
+quit
+??? 221
+****
 killdaemon
diff --git a/test/scripts/4500-DKIM/4504 b/test/scripts/4500-DKIM/4504
new file mode 100644
index 000000000..5de9e7948
--- /dev/null
+++ b/test/scripts/4500-DKIM/4504
@@ -0,0 +1,45 @@
+# DKIM verify, sha512
+#
+exim -DSERVER=server -bd -oX PORT_D
+****
+#
+# This should pass, only Mail::DKIM::Signer does not handle rsa-sha512.
+#  - sha512, 1024b
+# Mail original in aux-fixed/4500.msg1.txt
+# Sig generated by: perl aux-fixed/dkim/sign.pl --algorithm=rsa-sha512 \
+#			--method=simple/simple < aux-fixed/4500.msg1.txt
+#
+# TODO - until we have that we can only test internal consistency,
+# signing vs. verification.
+#
+client 127.0.0.1 PORT_D
+??? 220
+HELO xxx
+??? 250
+MAIL FROM:<CALLER@bloggs.com>
+??? 250
+RCPT TO:<a@test.ex>
+??? 250
+DATA
+??? 354
+DKIM-Signature: v=1; a=rsa-sha512; c=simple/simple; d=test.ex; h=from:to
+	:date:message-id:subject; s=sel2; bh=3UbbJTudPxmejzh7U1Zg33U3QT+1
+	6kfV2eOTvMeiEis=; b=xQSD/JMqz0C+xKf0A1NTkPTbkDuDdJbpBuyjjT9iYvyP
+	Zez+xl0TkoPobFGVa6EN8+ZeYV18zjifhtWYLSsNmPinUtcpKQLG1zxAKmmS0JEh
+	+qihlWbeGJ5+tK588ugUzXHPj+4JBW0H6kxHvdH0l2SlQE5xs/cdggnx5QX5USY=
+From: mrgus@text.ex
+To: bakawolf@yahoo.com
+Date: Thu, 19 Nov 2015 17:00:07 -0700
+Message-ID: <qwerty1234@disco-zombie.net>
+Subject: simple test
+
+This is a simple test.
+.
+??? 250
+QUIT
+??? 221
+****
+#
+killdaemon
+no_stdout_check
+no_msglog_check
diff --git a/test/scripts/5650-OCSP-GnuTLS/5652 b/test/scripts/5650-OCSP-GnuTLS/5652
new file mode 100644
index 000000000..4a33ea862
--- /dev/null
+++ b/test/scripts/5650-OCSP-GnuTLS/5652
@@ -0,0 +1,37 @@
+# OCSP stapling, server, multiple certs
+#
+#
+#
+exim -z '1: Server sends good staple on request, to client requiring RSA auth'
+****
+#
+exim -bd -oX PORT_D -DSERVER=server
+****
+exim -odf \
+  -DOPT=NONE:+SIGN-RSA-SHA256:+VERS-TLS-ALL:+ECDHE-RSA:+DHE-RSA:+RSA:+CIPHER-ALL:+MAC-ALL:+COMP-NULL:+CURVE-ALL:+CTYPE-X509 \
+  -DCERT=DIR/aux-fixed/exim-ca/example.com/server1.example.com/ca_chain.pem \
+  rsa.auth@test.ex
+Subject: test
+
+.
+****
+killdaemon
+#
+#
+#
+#
+exim -z '2: Server sends good staple on request, to client preferring ECDSA auth'
+****
+#
+exim -bd -oX PORT_D -DSERVER=server
+****
+exim -odf \
+  -DOPT=NONE:+SIGN-ECDSA-SHA512:+VERS-TLS-ALL:+KX-ALL:+CIPHER-ALL:+MAC-ALL:+COMP-NULL:+CURVE-ALL:+CTYPE-X509 \
+  -DCERT=DIR/aux-fixed/exim-ca/example_ec.com/server1.example_ec.com/ca_chain.pem \
+  ecdsa.auth@test.ex
+Subject: test
+
+.
+****
+killdaemon
+no_msglog_check
diff --git a/test/scripts/5820-DANE-GnuTLS/5820 b/test/scripts/5820-DANE-GnuTLS/5820
index 07ad7406d..84684da53 100644
--- a/test/scripts/5820-DANE-GnuTLS/5820
+++ b/test/scripts/5820-DANE-GnuTLS/5820
@@ -1,14 +1,106 @@
 # DANE client: general
 #
-gnutls
-#
-exim -DSERVER=server -bd -oX PORT_D
+exim -DSERVER=server -DDETAILS=ee -bd -oX PORT_D
+****
+### TLSA (3 1 1)
+exim -odq CALLER@dane256ee.test.ex
+Testing
 ****
-exim CALLER@test.ex
+### TLSA (3 1 2)
+exim -odq CALLER@mxdane512ee.test.ex
 Testing
 ****
 exim -qf
 ****
+#
+#
+### Recipient callout
+exim -DOPT=callout -bhc 127.0.0.1
+MAIL FROM: <CALLER@myhost.test.ex>
+RCPT TO: <rcptuser@dane256ee.test.ex>
+****
+killdaemon
+#
+#
+exim -DSERVER=server -DDETAILS=ta -bd -oX PORT_D
+****
+### TLSA (2 0 1)
+exim -odf CALLER@mxdane256ta.test.ex
+Testing
+****
+killdaemon
+# 
+#
+### A server with a nonverifying cert and no TLSA
+# Check we get a non-CV but TLS connection, with try_dane but no require_dane
+exim -DSERVER=server -DDETAILS=no -bd -oX PORT_D
+****
+exim -odf CALLER@thishost.test.ex
+Testing
+****
 killdaemon
-exim -DSERVER=server -DNOTDAEMON -qf
+#
+### A server with a verifying cert and no TLSA
+# Check we get a CV and TLS connection, with try_dane but no require_dane
+exim -DSERVER=server -DDETAILS=ca -bd -oX PORT_D
+****
+exim -odf CALLER@thishost.test.ex
+Testing
+****
+exim -DOPT=no_certname -qf
+****
+killdaemon
+#
+#
+exim -DSERVER=server -DDETAILS=ee -bd -oX PORT_D
+****
+### A server with two MXs for which both TLSA lookups return defer (delivery should defer)
+exim -odq CALLER@mxdanelazy.test.ex
+Testing
+****
+### A server lacking a TLSA, dane required (should fail)
+exim -odq CALLER@dane.no.1.test.ex
+Testing
+****
+### A server lacking a TLSA, dane requested only (should deliver, non-DANE, as the NXDOMAIN is not DNSSEC)
+exim -odq CALLER@dane.no.2.test.ex
+Testing
+****
+### A server where the A is dnssec and the TLSA lookup _fails_ (delivery should defer)
+exim -odq CALLER@danebroken1.test.ex
+Testing
+****
+### A server securely saying "no TLSA records here", dane required (delivery should fail)
+exim -odq CALLER@dane.no.3.test.ex
+Testing
+****
+### A server securely saying "no TLSA records here", dane requested only (should deliver)
+exim -odq CALLER@dane.no.4.test.ex
+Testing
+****
+exim -qf
 ****
+#
+### A server securely serving a wrong TLSA record, dane requested only (delivery should fail)
+exim -odf CALLER@danebroken2.test.ex
+Testing
+****
+### A server insecurely serving a good TLSA record, dane requested only (should deliver, non-DANE)
+exim -odf CALLER@danebroken3.test.ex
+Testing
+****
+### A server insecurely serving a good TLSA record, dane required (delivery should fail)
+exim -odf CALLER@danebroken4.test.ex
+Testing
+****
+### A server insecurely serving a good A record, dane requested only (should deliver, non-DANE)
+exim -odf CALLER@danebroken5.test.ex
+Testing
+****
+### A server insecurely serving a good A record, dane required (delivery should fail)
+exim -odf CALLER@danebroken6.test.ex
+Testing
+****
+#
+killdaemon
+no_msglog_check
diff --git a/test/scripts/5840-DANE-OpenSSL/5840 b/test/scripts/5840-DANE-OpenSSL/5840
index 142a25ad4..7d86621cc 100644
--- a/test/scripts/5840-DANE-OpenSSL/5840
+++ b/test/scripts/5840-DANE-OpenSSL/5840
@@ -25,10 +25,17 @@ killdaemon
 exim -DSERVER=server -DDETAILS=ta -bd -oX PORT_D
 ****
 ### TLSA (2 0 1)
-exim -odq CALLER@mxdane256ta.test.ex
+exim -odf CALLER@mxdane256ta.test.ex
 Testing
 ****
-exim -qf
+killdaemon
+#
+# OpenSSL-specific regression testcase: certificate having Authority Key ID extension
+exim -DSERVER=server -DCERT=DIR/aux-fixed/exim-ca/example.com/server2.example.com/fullchain.pem -DALLOW=DIR/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.unlocked.key -bd -oX PORT_D
+****
+### TLSA (2 1 1)
+exim -odf CALLER@mxdane256tak.test.ex
+Testing
 ****
 killdaemon
 #
@@ -36,18 +43,16 @@ killdaemon
 # Check we get a non-CV but TLS connection, with try_dane but no require_dane
 exim -DSERVER=server -DDETAILS=no -bd -oX PORT_D
 ****
-exim -odq CALLER@thishost.test.ex
+exim -odf CALLER@thishost.test.ex
 Testing
 ****
-exim -qf
-****
 killdaemon
 #
 ### A server with a verifying cert and no TLSA
 # Check we get a CV and TLS connection, with try_dane but no require_dane
 exim -DSERVER=server -DDETAILS=ca -bd -oX PORT_D
 ****
-exim -odq CALLER@thishost.test.ex
+exim -odf CALLER@thishost.test.ex
 Testing
 ****
 exim -DOPT=no_certname -qf
@@ -57,7 +62,7 @@ killdaemon
 #
 exim -DSERVER=server -DDETAILS=ee -bd -oX PORT_D
 ****
-### A server with two MXs for which both TLSA lookups return defer
+### A server with two MXs for which both TLSA lookups return defer (delivery should defer)
 exim -odq CALLER@mxdanelazy.test.ex
 Testing
 ****
@@ -65,23 +70,45 @@ Testing
 exim -odq CALLER@dane.no.1.test.ex
 Testing
 ****
-### A server lacking a TLSA, dane requested only (should fail, as the NXDOMAIN is not DNSSEC)
+### A server lacking a TLSA, dane requested only (should deliver, non-DANE, as the NXDOMAIN is not DNSSEC)
 exim -odq CALLER@dane.no.2.test.ex
 Testing
 ****
-### A server where the A is dnssec and the TLSA _fails_
+### A server where the A is dnssec and the TLSA lookup _fails_ (delivery should defer)
 exim -odq CALLER@danebroken1.test.ex
 Testing
 ****
-### A server securely saying "no TLSA records here", dane required (should fail)
+### A server securely saying "no TLSA records here", dane required (delivery should fail)
 exim -odq CALLER@dane.no.3.test.ex
 Testing
 ****
-### A server securely saying "no TLSA records here", dane requested only (should transmit)
+### A server securely saying "no TLSA records here", dane requested only (should deliver)
 exim -odq CALLER@dane.no.4.test.ex
 Testing
 ****
 exim -qf
 ****
+#
+### A server securely serving a wrong TLSA record, dane requested only (delivery should fail)
+exim -odf CALLER@danebroken2.test.ex
+Testing
+****
+### A server insecurely serving a good TLSA record, dane requested only (should deliver, non-DANE)
+exim -odf CALLER@danebroken3.test.ex
+Testing
+****
+### A server insecurely serving a good TLSA record, dane required (delivery should fail)
+exim -odf CALLER@danebroken4.test.ex
+Testing
+****
+### A server insecurely serving a good A record, dane requested only (should deliver, non-DANE)
+exim -odf CALLER@danebroken5.test.ex
+Testing
+****
+### A server insecurely serving a good A record, dane required (delivery should fail)
+exim -odf CALLER@danebroken6.test.ex
+Testing
+****
+#
 killdaemon
 no_msglog_check
diff --git a/test/stderr/2014 b/test/stderr/2014
new file mode 100644
index 000000000..c47f2f6e8
--- /dev/null
+++ b/test/stderr/2014
@@ -0,0 +1,20 @@
+### No certificate, certificate required
+### No certificate, certificate optional at TLS time, required by ACL
+### Good certificate, certificate required
+### Good certificate, certificate optional at TLS time, checked by ACL
+### Bad certificate, certificate required
+### Bad certificate, certificate optional at TLS time, reject at ACL time
+### Otherwise good but revoked certificate, certificate required
+### Revoked certificate, certificate optional at TLS time, reject at ACL time
+### Good certificate, certificate required - but nonmatching CRL also present
+
+******** SERVER ********
+### No certificate, certificate required
+### No certificate, certificate optional at TLS time, required by ACL
+### Good certificate, certificate required
+### Good certificate, certificate optional at TLS time, checked by ACL
+### Bad certificate, certificate required
+### Bad certificate, certificate optional at TLS time, reject at ACL time
+### Otherwise good but revoked certificate, certificate required
+### Revoked certificate, certificate optional at TLS time, reject at ACL time
+### Good certificate, certificate required - but nonmatching CRL also present
diff --git a/test/stderr/2114 b/test/stderr/2114
new file mode 100644
index 000000000..c47f2f6e8
--- /dev/null
+++ b/test/stderr/2114
@@ -0,0 +1,20 @@
+### No certificate, certificate required
+### No certificate, certificate optional at TLS time, required by ACL
+### Good certificate, certificate required
+### Good certificate, certificate optional at TLS time, checked by ACL
+### Bad certificate, certificate required
+### Bad certificate, certificate optional at TLS time, reject at ACL time
+### Otherwise good but revoked certificate, certificate required
+### Revoked certificate, certificate optional at TLS time, reject at ACL time
+### Good certificate, certificate required - but nonmatching CRL also present
+
+******** SERVER ********
+### No certificate, certificate required
+### No certificate, certificate optional at TLS time, required by ACL
+### Good certificate, certificate required
+### Good certificate, certificate optional at TLS time, checked by ACL
+### Bad certificate, certificate required
+### Bad certificate, certificate optional at TLS time, reject at ACL time
+### Otherwise good but revoked certificate, certificate required
+### Revoked certificate, certificate optional at TLS time, reject at ACL time
+### Good certificate, certificate required - but nonmatching CRL also present
diff --git a/test/stderr/5820 b/test/stderr/5820
new file mode 100644
index 000000000..8cd66384e
--- /dev/null
+++ b/test/stderr/5820
@@ -0,0 +1,100 @@
+### TLSA (3 1 1)
+### TLSA (3 1 2)
+### Recipient callout
+>>> host in hosts_connection_nolog? no (option unset)
+>>> host in host_lookup? no (option unset)
+>>> host in host_reject_connection? no (option unset)
+>>> host in sender_unqualified_hosts? no (option unset)
+>>> host in recipient_unqualified_hosts? no (option unset)
+>>> host in helo_verify_hosts? no (option unset)
+>>> host in helo_try_verify_hosts? no (option unset)
+>>> host in helo_accept_junk_hosts? no (option unset)
+>>> processing "accept"
+>>> check verify = recipient/callout
+>>> >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
+>>> routing rcptuser@dane256ee.test.ex
+>>> calling client router
+>>> dane256ee.test.ex in "*"? yes (matched "*")
+>>> local host found for non-MX address
+>>> routed by client router
+>>> Attempting full verification using callout
+>>> callout cache: no domain record found for dane256ee.test.ex
+>>> callout cache: no address record found for rcptuser@dane256ee.test.ex
+>>> ip4.ip4.ip4.ip4 in hosts_require_dane? yes (matched "ip4.ip4.ip4.ip4")
+>>> interface=NULL port=1225
+>>> Connecting to dane256ee.test.ex [ip4.ip4.ip4.ip4]:1225 ... connected
+>>>   SMTP<< 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
+>>> ip4.ip4.ip4.ip4 in hosts_avoid_esmtp? no (option unset)
+>>>   SMTP>> EHLO myhost.test.ex
+>>> cmd buf flush 21 bytes
+>>>   SMTP<< 250-myhost.test.ex Hello the.local.host.name [ip4.ip4.ip4.ip4]
+>>>          250-SIZE 52428800
+>>>          250-8BITMIME
+>>>          250-PIPELINING
+>>>          250-STARTTLS
+>>>          250 HELP
+>>> ip4.ip4.ip4.ip4 in hosts_avoid_tls? no (option unset)
+>>> ip4.ip4.ip4.ip4 in hosts_verify_avoid_tls? no (option unset)
+>>>   SMTP>> STARTTLS
+>>> cmd buf flush 10 bytes
+>>>   SMTP<< 220 TLS go ahead
+>>> ip4.ip4.ip4.ip4 in hosts_require_ocsp? no (option unset)
+>>> ip4.ip4.ip4.ip4 in hosts_request_ocsp? yes (matched "*")
+>>>   SMTP>> EHLO myhost.test.ex
+>>> cmd buf flush 21 bytes
+>>>   SMTP<< 250-myhost.test.ex Hello the.local.host.name [ip4.ip4.ip4.ip4]
+>>>          250-SIZE 52428800
+>>>          250-8BITMIME
+>>>          250-PIPELINING
+>>>          250 HELP
+>>> ip4.ip4.ip4.ip4 in hosts_avoid_pipelining? no (option unset)
+>>> ip4.ip4.ip4.ip4 in hosts_require_auth? no (option unset)
+>>>   SMTP>> MAIL FROM:<>
+>>>   SMTP>> RCPT TO:<rcptuser@dane256ee.test.ex>
+>>> cmd buf flush 52 bytes
+>>>   SMTP<< 250 OK
+>>>   SMTP<< 250 Accepted
+>>>   SMTP>> QUIT
+>>> cmd buf flush 6 bytes
+>>>   SMTP<< 221 myhost.test.ex closing connection
+>>>   SMTP(close)>>
+>>> wrote callout cache domain record for dane256ee.test.ex:
+>>>   result=1 postmaster=0 random=0
+>>> wrote positive callout cache address record for rcptuser@dane256ee.test.ex
+>>> ----------- end verify ------------
+>>> accept: condition test succeeded in inline ACL
+>>> end of inline ACL: ACCEPT
+LOG: unexpected disconnection while reading SMTP command from [127.0.0.1] D=qqs
+### TLSA (2 0 1)
+### A server with a nonverifying cert and no TLSA
+### A server with a verifying cert and no TLSA
+### A server with two MXs for which both TLSA lookups return defer (delivery should defer)
+### A server lacking a TLSA, dane required (should fail)
+### A server lacking a TLSA, dane requested only (should deliver, non-DANE, as the NXDOMAIN is not DNSSEC)
+### A server where the A is dnssec and the TLSA lookup _fails_ (delivery should defer)
+### A server securely saying "no TLSA records here", dane required (delivery should fail)
+### A server securely saying "no TLSA records here", dane requested only (should deliver)
+### A server securely serving a wrong TLSA record, dane requested only (delivery should fail)
+### A server insecurely serving a good TLSA record, dane requested only (should deliver, non-DANE)
+### A server insecurely serving a good TLSA record, dane required (delivery should fail)
+### A server insecurely serving a good A record, dane requested only (should deliver, non-DANE)
+### A server insecurely serving a good A record, dane required (delivery should fail)
+
+******** SERVER ********
+### TLSA (3 1 1)
+### TLSA (3 1 2)
+### Recipient callout
+### TLSA (2 0 1)
+### A server with a nonverifying cert and no TLSA
+### A server with a verifying cert and no TLSA
+### A server with two MXs for which both TLSA lookups return defer (delivery should defer)
+### A server lacking a TLSA, dane required (should fail)
+### A server lacking a TLSA, dane requested only (should deliver, non-DANE, as the NXDOMAIN is not DNSSEC)
+### A server where the A is dnssec and the TLSA lookup _fails_ (delivery should defer)
+### A server securely saying "no TLSA records here", dane required (delivery should fail)
+### A server securely saying "no TLSA records here", dane requested only (should deliver)
+### A server securely serving a wrong TLSA record, dane requested only (delivery should fail)
+### A server insecurely serving a good TLSA record, dane requested only (should deliver, non-DANE)
+### A server insecurely serving a good TLSA record, dane required (delivery should fail)
+### A server insecurely serving a good A record, dane requested only (should deliver, non-DANE)
+### A server insecurely serving a good A record, dane required (delivery should fail)
diff --git a/test/stderr/5840 b/test/stderr/5840
index 51962ce66..81a812149 100644
--- a/test/stderr/5840
+++ b/test/stderr/5840
@@ -67,25 +67,37 @@
 >>> end of inline ACL: ACCEPT
 LOG: unexpected disconnection while reading SMTP command from [127.0.0.1] D=qqs
 ### TLSA (2 0 1)
+### TLSA (2 1 1)
 ### A server with a nonverifying cert and no TLSA
 ### A server with a verifying cert and no TLSA
-### A server with two MXs for which both TLSA lookups return defer
+### A server with two MXs for which both TLSA lookups return defer (delivery should defer)
 ### A server lacking a TLSA, dane required (should fail)
-### A server lacking a TLSA, dane requested only (should fail, as the NXDOMAIN is not DNSSEC)
-### A server where the A is dnssec and the TLSA _fails_
-### A server securely saying "no TLSA records here", dane required (should fail)
-### A server securely saying "no TLSA records here", dane requested only (should transmit)
+### A server lacking a TLSA, dane requested only (should deliver, non-DANE, as the NXDOMAIN is not DNSSEC)
+### A server where the A is dnssec and the TLSA lookup _fails_ (delivery should defer)
+### A server securely saying "no TLSA records here", dane required (delivery should fail)
+### A server securely saying "no TLSA records here", dane requested only (should deliver)
+### A server securely serving a wrong TLSA record, dane requested only (delivery should fail)
+### A server insecurely serving a good TLSA record, dane requested only (should deliver, non-DANE)
+### A server insecurely serving a good TLSA record, dane required (delivery should fail)
+### A server insecurely serving a good A record, dane requested only (should deliver, non-DANE)
+### A server insecurely serving a good A record, dane required (delivery should fail)
 
 ******** SERVER ********
 ### TLSA (3 1 1)
 ### TLSA (3 1 2)
 ### Recipient callout
 ### TLSA (2 0 1)
+### TLSA (2 1 1)
 ### A server with a nonverifying cert and no TLSA
 ### A server with a verifying cert and no TLSA
-### A server with two MXs for which both TLSA lookups return defer
+### A server with two MXs for which both TLSA lookups return defer (delivery should defer)
 ### A server lacking a TLSA, dane required (should fail)
-### A server lacking a TLSA, dane requested only (should fail, as the NXDOMAIN is not DNSSEC)
-### A server where the A is dnssec and the TLSA _fails_
-### A server securely saying "no TLSA records here", dane required (should fail)
-### A server securely saying "no TLSA records here", dane requested only (should transmit)
+### A server lacking a TLSA, dane requested only (should deliver, non-DANE, as the NXDOMAIN is not DNSSEC)
+### A server where the A is dnssec and the TLSA lookup _fails_ (delivery should defer)
+### A server securely saying "no TLSA records here", dane required (delivery should fail)
+### A server securely saying "no TLSA records here", dane requested only (should deliver)
+### A server securely serving a wrong TLSA record, dane requested only (delivery should fail)
+### A server insecurely serving a good TLSA record, dane requested only (should deliver, non-DANE)
+### A server insecurely serving a good TLSA record, dane required (delivery should fail)
+### A server insecurely serving a good A record, dane requested only (should deliver, non-DANE)
+### A server insecurely serving a good A record, dane required (delivery should fail)
diff --git a/test/stdout/2014 b/test/stdout/2014
index c7aab62f1..cb24d0561 100644
--- a/test/stdout/2014
+++ b/test/stdout/2014
@@ -1,3 +1,4 @@
+### No certificate, certificate required
 Connecting to ip4.ip4.ip4.ip4 port 1225 ... connected
 ??? 220
 <<< 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
@@ -21,6 +22,7 @@ Attempting to start TLS
 A TLS fatal alert has been received.
 Failed to start TLS
 End of script
+### No certificate, certificate optional at TLS time, required by ACL
 Connecting to 127.0.0.1 port 1225 ... connected
 ??? 220
 <<< 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
@@ -55,9 +57,10 @@ Succeeded in starting TLS
 ??? 221
 <<< 221 myhost.test.ex closing connection
 End of script
+### Good certificate, certificate required
 Connecting to ip4.ip4.ip4.ip4 port 1225 ... connected
-Certificate file = aux-fixed/cert2
-Key file = aux-fixed/cert2
+Certificate file = aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.chain.pem
+Key file = aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.unlocked.key
 ??? 220
 <<< 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
 >>> ehlo rhu3.barb
@@ -88,9 +91,10 @@ Succeeded in starting TLS
 ??? 221
 <<< 221 myhost.test.ex closing connection
 End of script
+### Good certificate, certificate optional at TLS time, checked by ACL
 Connecting to 127.0.0.1 port 1225 ... connected
-Certificate file = aux-fixed/cert2
-Key file = aux-fixed/cert2
+Certificate file = aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.chain.pem
+Key file = aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.unlocked.key
 ??? 220
 <<< 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
 >>> ehlo rhu4.barb
@@ -121,9 +125,10 @@ Succeeded in starting TLS
 ??? 221
 <<< 221 myhost.test.ex closing connection
 End of script
+### Bad certificate, certificate required
 Connecting to ip4.ip4.ip4.ip4 port 1225 ... connected
-Certificate file = aux-fixed/cert1
-Key file = aux-fixed/cert1
+Certificate file = aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.chain.pem
+Key file = aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.unlocked.key
 ??? 220
 <<< 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
 >>> ehlo rhu5.barb
@@ -143,11 +148,13 @@ Key file = aux-fixed/cert1
 ??? 220
 <<< 220 TLS go ahead
 Attempting to start TLS
-Succeeded in starting TLS
+A TLS fatal alert has been received.
+Failed to start TLS
 End of script
+### Bad certificate, certificate optional at TLS time, reject at ACL time
 Connecting to 127.0.0.1 port 1225 ... connected
-Certificate file = aux-fixed/cert1
-Key file = aux-fixed/cert1
+Certificate file = aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.chain.pem
+Key file = aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.unlocked.key
 ??? 220
 <<< 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
 >>> ehlo rhu6.barb
@@ -172,17 +179,16 @@ Succeeded in starting TLS
 ??? 250
 <<< 250 OK
 >>> rcpt to:<userx@test.ex>
-??? 550-
-<<< 550-certificate not verified: peerdn=C=UK,O=The Exim Maintainers,OU=Test
 ??? 550
-<<< 550 Suite,CN=Phil Pennock
+<<< 550 certificate not verified: peerdn=
 >>> quit
 ??? 221
 <<< 221 myhost.test.ex closing connection
 End of script
+### Otherwise good but revoked certificate, certificate required
 Connecting to ip4.ip4.ip4.ip4 port 1225 ... connected
-Certificate file = aux-fixed/cert2
-Key file = aux-fixed/cert2
+Certificate file = aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.chain.pem
+Key file = aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.unlocked.key
 ??? 220
 <<< 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
 >>> ehlo rhu7.barb
@@ -204,9 +210,10 @@ Key file = aux-fixed/cert2
 Attempting to start TLS
 Succeeded in starting TLS
 End of script
+### Revoked certificate, certificate optional at TLS time, reject at ACL time
 Connecting to 127.0.0.1 port 1225 ... connected
-Certificate file = aux-fixed/cert1
-Key file = aux-fixed/cert1
+Certificate file = aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.chain.pem
+Key file = aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.unlocked.key
 ??? 220
 <<< 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
 >>> ehlo rhu8.barb
@@ -231,11 +238,54 @@ Succeeded in starting TLS
 ??? 250
 <<< 250 OK
 >>> rcpt to:<userx@test.ex>
-??? 550-
-<<< 550-certificate not verified: peerdn=C=UK,O=The Exim Maintainers,OU=Test
 ??? 550
-<<< 550 Suite,CN=Phil Pennock
+<<< 550 certificate not verified: peerdn=CN=revoked1.example.com
+>>> quit
+??? 221
+<<< 221 myhost.test.ex closing connection
+End of script
+### Good certificate, certificate required - but nonmatching CRL also present
+Connecting to ip4.ip4.ip4.ip4 port 1225 ... connected
+Certificate file = aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.chain.pem
+Key file = aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.unlocked.key
+??? 220
+<<< 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
+>>> ehlo rhu.barb
+??? 250-
+<<< 250-myhost.test.ex Hello rhu.barb [ip4.ip4.ip4.ip4]
+??? 250-
+<<< 250-SIZE 52428800
+??? 250-
+<<< 250-8BITMIME
+??? 250-
+<<< 250-PIPELINING
+??? 250-
+<<< 250-STARTTLS
+??? 250
+<<< 250 HELP
+>>> starttls
+??? 220
+<<< 220 TLS go ahead
+Attempting to start TLS
+Succeeded in starting TLS
+>>> mail from:<userx@test.ex>
+??? 250
+<<< 250 OK
+>>> rcpt to:<userx@test.ex>
+??? 250
+<<< 250 Accepted
 >>> quit
 ??? 221
 <<< 221 myhost.test.ex closing connection
 End of script
+
+******** SERVER ********
+### No certificate, certificate required
+### No certificate, certificate optional at TLS time, required by ACL
+### Good certificate, certificate required
+### Good certificate, certificate optional at TLS time, checked by ACL
+### Bad certificate, certificate required
+### Bad certificate, certificate optional at TLS time, reject at ACL time
+### Otherwise good but revoked certificate, certificate required
+### Revoked certificate, certificate optional at TLS time, reject at ACL time
+### Good certificate, certificate required - but nonmatching CRL also present
diff --git a/test/stdout/2114 b/test/stdout/2114
index 061134789..c3fa9ce98 100644
--- a/test/stdout/2114
+++ b/test/stdout/2114
@@ -1,3 +1,4 @@
+### No certificate, certificate required
 Connecting to ip4.ip4.ip4.ip4 port 1225 ... connected
 ??? 220
 <<< 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
@@ -21,6 +22,7 @@ Attempting to start TLS
 pppp:error:dddddddd:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure:[...]:SSL alert number 40
 Failed to start TLS
 End of script
+### No certificate, certificate optional at TLS time, required by ACL
 Connecting to 127.0.0.1 port 1225 ... connected
 ??? 220
 <<< 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
@@ -56,9 +58,10 @@ Succeeded in starting TLS
 ??? 221
 <<< 221 myhost.test.ex closing connection
 End of script
+### Good certificate, certificate required
 Connecting to ip4.ip4.ip4.ip4 port 1225 ... connected
-Certificate file = aux-fixed/cert2
-Key file = aux-fixed/cert2
+Certificate file = aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.chain.pem
+Key file = aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.unlocked.key
 ??? 220
 <<< 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
 >>> ehlo rhu.barb
@@ -90,9 +93,10 @@ Succeeded in starting TLS
 ??? 221
 <<< 221 myhost.test.ex closing connection
 End of script
+### Good certificate, certificate optional at TLS time, checked by ACL
 Connecting to 127.0.0.1 port 1225 ... connected
-Certificate file = aux-fixed/cert2
-Key file = aux-fixed/cert2
+Certificate file = aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.chain.pem
+Key file = aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.unlocked.key
 ??? 220
 <<< 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
 >>> ehlo rhu.barb
@@ -124,9 +128,10 @@ Succeeded in starting TLS
 ??? 221
 <<< 221 myhost.test.ex closing connection
 End of script
+### Bad certificate, certificate required
 Connecting to ip4.ip4.ip4.ip4 port 1225 ... connected
-Certificate file = aux-fixed/cert1
-Key file = aux-fixed/cert1
+Certificate file = aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.chain.pem
+Key file = aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.unlocked.key
 ??? 220
 <<< 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
 >>> ehlo rhu.barb
@@ -149,9 +154,10 @@ Attempting to start TLS
 pppp:error:dddddddd:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca:[...]:SSL alert number 48
 Failed to start TLS
 End of script
+### Bad certificate, certificate optional at TLS time, reject at ACL time
 Connecting to 127.0.0.1 port 1225 ... connected
-Certificate file = aux-fixed/cert1
-Key file = aux-fixed/cert1
+Certificate file = aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.chain.pem
+Key file = aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.unlocked.key
 ??? 220
 <<< 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
 >>> ehlo rhu.barb
@@ -177,17 +183,16 @@ Succeeded in starting TLS
 ??? 250
 <<< 250 OK
 >>> rcpt to:<userx@test.ex>
-??? 550-
-<<< 550-certificate not verified: peerdn=/C=UK/O=The Exim Maintainers/OU=Test
 ??? 550
-<<< 550 Suite/CN=Phil Pennock
+<<< 550 certificate not verified: peerdn=/CN=server1.example.net
 >>> quit
 ??? 221
 <<< 221 myhost.test.ex closing connection
 End of script
+### Otherwise good but revoked certificate, certificate required
 Connecting to ip4.ip4.ip4.ip4 port 1225 ... connected
-Certificate file = aux-fixed/cert2
-Key file = aux-fixed/cert2
+Certificate file = aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.chain.pem
+Key file = aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.unlocked.key
 ??? 220
 <<< 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
 >>> ehlo rhu.barb
@@ -210,9 +215,10 @@ Attempting to start TLS
 pppp:error:dddddddd:SSL routines:ssl3_read_bytes:sslv3 alert certificate revoked:[...]:SSL alert number 44
 Failed to start TLS
 End of script
+### Revoked certificate, certificate optional at TLS time, reject at ACL time
 Connecting to 127.0.0.1 port 1225 ... connected
-Certificate file = aux-fixed/cert1
-Key file = aux-fixed/cert1
+Certificate file = aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.chain.pem
+Key file = aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.unlocked.key
 ??? 220
 <<< 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
 >>> ehlo rhu.barb
@@ -238,11 +244,55 @@ Succeeded in starting TLS
 ??? 250
 <<< 250 OK
 >>> rcpt to:<userx@test.ex>
-??? 550-
-<<< 550-certificate not verified: peerdn=/C=UK/O=The Exim Maintainers/OU=Test
 ??? 550
-<<< 550 Suite/CN=Phil Pennock
+<<< 550 certificate not verified: peerdn=/CN=revoked1.example.com
 >>> quit
 ??? 221
 <<< 221 myhost.test.ex closing connection
 End of script
+### Good certificate, certificate required - but nonmatching CRL also present
+Connecting to ip4.ip4.ip4.ip4 port 1225 ... connected
+Certificate file = aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.chain.pem
+Key file = aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.unlocked.key
+??? 220
+<<< 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
+>>> ehlo rhu.barb
+??? 250-
+<<< 250-myhost.test.ex Hello rhu.barb [ip4.ip4.ip4.ip4]
+??? 250-
+<<< 250-SIZE 52428800
+??? 250-
+<<< 250-8BITMIME
+??? 250-
+<<< 250-PIPELINING
+??? 250-
+<<< 250-STARTTLS
+??? 250
+<<< 250 HELP
+>>> starttls
+??? 220
+<<< 220 TLS go ahead
+Attempting to start TLS
+SSL connection using ke-RSA-AES256-SHA
+Succeeded in starting TLS
+>>> mail from:<userx@test.ex>
+??? 250
+<<< 250 OK
+>>> rcpt to:<userx@test.ex>
+??? 250
+<<< 250 Accepted
+>>> quit
+??? 221
+<<< 221 myhost.test.ex closing connection
+End of script
+
+******** SERVER ********
+### No certificate, certificate required
+### No certificate, certificate optional at TLS time, required by ACL
+### Good certificate, certificate required
+### Good certificate, certificate optional at TLS time, checked by ACL
+### Bad certificate, certificate required
+### Bad certificate, certificate optional at TLS time, reject at ACL time
+### Otherwise good but revoked certificate, certificate required
+### Revoked certificate, certificate optional at TLS time, reject at ACL time
+### Good certificate, certificate required - but nonmatching CRL also present
diff --git a/test/stdout/5800 b/test/stdout/5800
index b9c64fea0..a2c4ae476 100644
--- a/test/stdout/5800
+++ b/test/stdout/5800
@@ -1,4 +1,4 @@
 > 
-> dnslookup tlsa: 3 1 2 3d5eb81b1dfc3f93c1fa8819e3fb3fdb41bb590441d5f3811db17772f4bc6de29bdd7c4f4b723750dda871b99379192b3f979f03db1252c4f08b03ef7176528d
+> dnslookup tlsa: 3 1 2 69e8a5ddf24df2c51dc503959d26e621be4ce3853f71890512de3ae3390c5749ef3368dd4d274669b0653da8c3663f12ca092cd98e5e242e4de57ee6aa01cde1
 > 
 > 
diff --git a/test/stdout/5820 b/test/stdout/5820
new file mode 100644
index 000000000..49dac098a
--- /dev/null
+++ b/test/stdout/5820
@@ -0,0 +1,45 @@
+### TLSA (3 1 1)
+### TLSA (3 1 2)
+### Recipient callout
+
+**** SMTP testing session as if from host 127.0.0.1
+**** but without any ident (RFC 1413) callback.
+**** This is not for real!
+
+220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
+250 OK
+250 Accepted
+421 myhost.test.ex lost input connection
+### TLSA (2 0 1)
+### A server with a nonverifying cert and no TLSA
+### A server with a verifying cert and no TLSA
+### A server with two MXs for which both TLSA lookups return defer (delivery should defer)
+### A server lacking a TLSA, dane required (should fail)
+### A server lacking a TLSA, dane requested only (should deliver, non-DANE, as the NXDOMAIN is not DNSSEC)
+### A server where the A is dnssec and the TLSA lookup _fails_ (delivery should defer)
+### A server securely saying "no TLSA records here", dane required (delivery should fail)
+### A server securely saying "no TLSA records here", dane requested only (should deliver)
+### A server securely serving a wrong TLSA record, dane requested only (delivery should fail)
+### A server insecurely serving a good TLSA record, dane requested only (should deliver, non-DANE)
+### A server insecurely serving a good TLSA record, dane required (delivery should fail)
+### A server insecurely serving a good A record, dane requested only (should deliver, non-DANE)
+### A server insecurely serving a good A record, dane required (delivery should fail)
+
+******** SERVER ********
+### TLSA (3 1 1)
+### TLSA (3 1 2)
+### Recipient callout
+### TLSA (2 0 1)
+### A server with a nonverifying cert and no TLSA
+### A server with a verifying cert and no TLSA
+### A server with two MXs for which both TLSA lookups return defer (delivery should defer)
+### A server lacking a TLSA, dane required (should fail)
+### A server lacking a TLSA, dane requested only (should deliver, non-DANE, as the NXDOMAIN is not DNSSEC)
+### A server where the A is dnssec and the TLSA lookup _fails_ (delivery should defer)
+### A server securely saying "no TLSA records here", dane required (delivery should fail)
+### A server securely saying "no TLSA records here", dane requested only (should deliver)
+### A server securely serving a wrong TLSA record, dane requested only (delivery should fail)
+### A server insecurely serving a good TLSA record, dane requested only (should deliver, non-DANE)
+### A server insecurely serving a good TLSA record, dane required (delivery should fail)
+### A server insecurely serving a good A record, dane requested only (should deliver, non-DANE)
+### A server insecurely serving a good A record, dane required (delivery should fail)
diff --git a/test/stdout/5840 b/test/stdout/5840
index 32425d2e2..36a3bd158 100644
--- a/test/stdout/5840
+++ b/test/stdout/5840
@@ -11,25 +11,37 @@
 250 Accepted
 421 myhost.test.ex lost input connection
 ### TLSA (2 0 1)
+### TLSA (2 1 1)
 ### A server with a nonverifying cert and no TLSA
 ### A server with a verifying cert and no TLSA
-### A server with two MXs for which both TLSA lookups return defer
+### A server with two MXs for which both TLSA lookups return defer (delivery should defer)
 ### A server lacking a TLSA, dane required (should fail)
-### A server lacking a TLSA, dane requested only (should fail, as the NXDOMAIN is not DNSSEC)
-### A server where the A is dnssec and the TLSA _fails_
-### A server securely saying "no TLSA records here", dane required (should fail)
-### A server securely saying "no TLSA records here", dane requested only (should transmit)
+### A server lacking a TLSA, dane requested only (should deliver, non-DANE, as the NXDOMAIN is not DNSSEC)
+### A server where the A is dnssec and the TLSA lookup _fails_ (delivery should defer)
+### A server securely saying "no TLSA records here", dane required (delivery should fail)
+### A server securely saying "no TLSA records here", dane requested only (should deliver)
+### A server securely serving a wrong TLSA record, dane requested only (delivery should fail)
+### A server insecurely serving a good TLSA record, dane requested only (should deliver, non-DANE)
+### A server insecurely serving a good TLSA record, dane required (delivery should fail)
+### A server insecurely serving a good A record, dane requested only (should deliver, non-DANE)
+### A server insecurely serving a good A record, dane required (delivery should fail)
 
 ******** SERVER ********
 ### TLSA (3 1 1)
 ### TLSA (3 1 2)
 ### Recipient callout
 ### TLSA (2 0 1)
+### TLSA (2 1 1)
 ### A server with a nonverifying cert and no TLSA
 ### A server with a verifying cert and no TLSA
-### A server with two MXs for which both TLSA lookups return defer
+### A server with two MXs for which both TLSA lookups return defer (delivery should defer)
 ### A server lacking a TLSA, dane required (should fail)
-### A server lacking a TLSA, dane requested only (should fail, as the NXDOMAIN is not DNSSEC)
-### A server where the A is dnssec and the TLSA _fails_
-### A server securely saying "no TLSA records here", dane required (should fail)
-### A server securely saying "no TLSA records here", dane requested only (should transmit)
+### A server lacking a TLSA, dane requested only (should deliver, non-DANE, as the NXDOMAIN is not DNSSEC)
+### A server where the A is dnssec and the TLSA lookup _fails_ (delivery should defer)
+### A server securely saying "no TLSA records here", dane required (delivery should fail)
+### A server securely saying "no TLSA records here", dane requested only (should deliver)
+### A server securely serving a wrong TLSA record, dane requested only (delivery should fail)
+### A server insecurely serving a good TLSA record, dane requested only (should deliver, non-DANE)
+### A server insecurely serving a good TLSA record, dane required (delivery should fail)
+### A server insecurely serving a good A record, dane requested only (should deliver, non-DANE)
+### A server insecurely serving a good A record, dane required (delivery should fail)