tests: Use swaks instead of nc for sending mail (#3732)

See associated `CHANGELOG.md` entry for details. --------- Co-authored-by: Brennan Kinney <5098581+polarathene@users.noreply.github.com>
2025-07-30 15:44:56 +02:00 · 2024-01-03 01:17:54 +01:00 · 2024-01-03 01:17:54 +01:00 · 9e81517fe3
commit 9e81517fe3
parent 0889b0ff06
119 changed files with 355 additions and 455 deletions
--- a/test/files/ssl/example.test/README.md
+++ b/test/files/ssl/example.test/README.md
@ -0,0 +1,359 @@
+# Testing certificates for TLS
+
+Use these certificates for any tests that require a certificate during a test. **DO NOT USE IN PRODUCTION**.
+
+These certificates for usage with TLS have been generated via the [Smallstep `step certificate`](https://smallstep.com/docs/step-cli/reference/certificate/create) CLI tool. They have a duration of 10 years and are valid for the SAN `example.test` or it's `mail` subdomain.
+
+`Certificate Details` sections are the output of: `step certificate inspect cert.<key type>.pem`.
+
+Each certificate except for the wildcard one, have the SANs(Subject Alternative Name) `example.test` and `mail.example.test`.
+
+---
+
+**RSA (2048-bit) - self-signed:**
+
+```sh
+step certificate create "Smallstep self-signed" cert.rsa.pem key.rsa.pem \
+  --no-password --insecure \
+  --profile self-signed --subtle \
+  --not-before "2021-01-01T00:00:00+00:00" \
+  --not-after "2031-01-01T00:00:00+00:00" \
+  --san "example.test" \
+  --san "mail.example.test" \
+  --kty RSA --size 2048
+```
+
+<!-- markdownlint-disable MD033 MD040 -->
+<details>
+<summary>Certificate Details:</summary>
+
+```
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 208627341009417536895802991697858158387 (0x9cf42a11521763a5a0fbd1cedb085f33)
+    Signature Algorithm: SHA256-RSA
+        Issuer: CN=Smallstep self-signed
+        Validity
+            Not Before: Jan 1 00:00:00 2021 UTC
+            Not After : Jan 1 00:00:00 2031 UTC
+        Subject: CN=Smallstep self-signed
+        Subject Public Key Info:
+            Public Key Algorithm: RSA
+                Public-Key: (2048 bit)
+                Modulus:
+                    e2:78:fa:af:1b:82:ee:92:8c:b6:9b:96:ee:a7:4f:
+                    b8:dd:72:ec:c6:85:97:a8:53:c0:ad:0c:04:c9:23:
+                    5d:3e:f5:1a:ce:78:b7:14:fd:61:53:1e:51:03:54:
+                    64:60:3c:87:38:c9:fc:ec:55:8e:c0:dd:82:8c:ac:
+                    d9:e9:b8:ee:37:df:95:60:d9:f2:02:f6:21:04:e0:
+                    af:d2:c5:1a:b6:3e:5f:dc:3a:31:b8:e6:c7:37:8b:
+                    7a:53:54:b1:21:61:34:31:05:aa:6f:28:88:89:2d:
+                    ac:43:f8:4f:b0:e7:57:17:fe:b6:4d:b3:7c:0e:f4:
+                    34:58:1c:b7:06:e9:33:13:d3:2a:68:eb:41:c3:5c:
+                    cf:a9:f1:76:b4:41:9e:cd:86:6a:4a:80:6b:05:cd:
+                    5c:0f:1a:6d:f6:8d:ed:50:a2:b5:f7:97:00:75:1b:
+                    36:9f:e8:68:e7:43:d4:1c:cc:7e:d3:03:e0:c5:be:
+                    54:ab:e9:e4:dc:53:36:6c:b2:46:fb:72:bd:26:e7:
+                    9b:c6:45:a9:be:4a:e3:10:b8:80:55:ee:28:63:09:
+                    09:60:9c:fb:57:f4:c7:36:8f:09:39:32:9d:26:92:
+                    4b:78:51:9c:eb:bc:74:61:ec:80:6e:73:59:5d:52:
+                    f2:02:95:24:f7:47:9d:6a:b2:b3:17:35:9d:48:58:
+                    81
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Key Usage: critical
+                Digital Signature, Key Encipherment
+            X509v3 Extended Key Usage:
+                Server Authentication, Client Authentication
+            X509v3 Subject Key Identifier:
+                05:AC:63:51:E2:44:A1:46:F8:08:86:D9:EF:69:32:B2:89:6D:DA:CE
+            X509v3 Subject Alternative Name:
+                DNS:example.test, DNS:mail.example.test
+    Signature Algorithm: SHA256-RSA
+        50:47:7b:59:26:9d:8d:f7:e4:dc:03:94:b0:35:e4:03:b7:94:
+        16:7e:b6:79:c5:bb:e7:61:db:ca:e6:22:cc:c8:a0:9f:9d:b0:
+        7c:12:43:ec:a7:f3:fe:ad:0a:44:69:69:7f:c7:31:f7:3f:e8:
+        98:a7:37:43:bd:fb:5b:c6:85:85:91:dc:29:23:cb:6b:a9:aa:
+        f0:f0:62:79:ce:43:8c:5f:28:49:ee:a1:d4:16:67:6b:59:c3:
+        15:65:e3:d3:3b:35:da:59:35:33:2a:5e:8a:59:ff:14:b9:51:
+        a5:8e:0b:7c:1b:a1:b1:f4:89:1a:3f:2f:d7:b1:8d:23:0a:7a:
+        79:e1:c2:03:b5:2f:ee:34:16:a9:67:27:b6:10:67:5d:f4:1d:
+        d6:b3:e0:ab:80:3d:59:fc:bc:4b:1a:55:fb:36:75:ff:e3:88:
+        73:e3:16:4d:2b:17:7b:2a:21:a3:18:14:04:19:b3:b8:11:39:
+        55:3f:ce:21:b7:d3:5d:8d:78:d5:3a:e0:b2:17:41:ad:3c:8e:
+        a5:a2:ba:eb:3d:b6:9e:2c:ef:7d:d5:cc:71:cb:07:54:21:42:
+        81:79:45:2b:93:74:93:a1:c9:f1:5e:5e:11:3d:ac:df:55:98:
+        37:44:d2:55:a5:15:a9:33:79:6e:fe:49:6d:e5:7b:a0:1c:12:
+        c5:1b:4d:33
+```
+
+</details>
+
+**ECDSA (P-256) - self-signed:**
+
+```sh
+step certificate create "Smallstep self-signed" cert.ecdsa.pem key.ecdsa.pem \
+  --no-password --insecure \
+  --profile self-signed --subtle \
+  --not-before "2021-01-01T00:00:00+00:00" \
+  --not-after "2031-01-01T00:00:00+00:00" \
+  --san "example.test" \
+  --san "mail.example.test" \
+  --kty EC --crv P-256
+```
+
+<details>
+<summary>Certificate Details:</summary>
+
+```
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 311463463867833685003701497925006766941 (0xea51ae60cd02784bbf1ba4e367ffb35d)
+    Signature Algorithm: ECDSA-SHA256
+        Issuer: CN=Smallstep self-signed
+        Validity
+            Not Before: Jan 1 00:00:00 2021 UTC
+            Not After : Jan 1 00:00:00 2031 UTC
+        Subject: CN=Smallstep self-signed
+        Subject Public Key Info:
+            Public Key Algorithm: ECDSA
+                Public-Key: (256 bit)
+                X:
+                    b1:f7:b1:12:75:17:a8:72:9a:39:31:ef:f0:61:b2:
+                    f4:0c:88:c6:05:b2:12:f2:99:e0:ac:81:78:4c:72:
+                    94:e9
+                Y:
+                    52:8f:e9:c1:7b:b0:15:83:90:06:30:d2:c0:6b:66:
+                    63:31:14:54:28:80:1d:89:6e:a4:2c:dd:59:17:5f:
+                    a6:3e
+                Curve: P-256
+        X509v3 extensions:
+            X509v3 Key Usage: critical
+                Digital Signature
+            X509v3 Extended Key Usage:
+                Server Authentication, Client Authentication
+            X509v3 Subject Key Identifier:
+                14:9F:BA:EB:14:52:9F:2C:13:B2:E9:F1:77:DA:5B:F6:E2:1D:54:BD
+            X509v3 Subject Alternative Name:
+                DNS:example.test, DNS:mail.example.test
+    Signature Algorithm: ECDSA-SHA256
+        30:46:02:21:00:f8:72:3d:90:7e:db:9e:7a:4f:6d:80:fb:fa:
+        dc:42:43:e2:dc:8f:6a:ec:18:c5:af:e1:ea:03:fd:66:78:a2:
+        01:02:21:00:f7:86:58:81:17:f5:74:5b:14:c8:0f:93:e2:bb:
+        b8:e9:90:47:c0:f7:b1:60:82:d9:b4:1a:fc:fa:66:fa:48:5c
+```
+
+</details>
+<!-- markdownlint-enable MD033 MD040 -->
+
+---
+
+`self-signed` certs lacks a chain of trust for verifying a certificate. See `test/mail_ssl_manual.bats` which covers verification test.
+
+The minimal setup to satisfy verification is adding a Root CA (self-signed) that is used to sign the server certificate (leaf cert):
+
+Create an ECDSA Root CA cert:
+
+```sh
+step certificate create "Smallstep Root CA" ca-cert.ecdsa.pem ca-key.ecdsa.pem \
+  --no-password --insecure \
+  --profile root-ca \
+  --not-before "2021-01-01T00:00:00+00:00" \
+  --not-after "2031-01-01T00:00:00+00:00" \
+  --kty EC --crv P-256
+```
+
+Create an ECDSA Leaf cert, signed with the Root CA key we just created:
+
+```sh
+step certificate create "Smallstep Leaf" cert.ecdsa.pem key.ecdsa.pem \
+  --no-password --insecure \
+  --profile leaf \
+  --ca ca-cert.ecdsa.pem \
+  --ca-key ca-key.ecdsa.pem \
+  --not-before "2021-01-01T00:00:00+00:00" \
+  --not-after "2031-01-01T00:00:00+00:00" \
+  --san "mail.example.test" \
+  --kty EC --crv P-256
+```
+
+The Root CA certificate does not need to have the same key type as the Leaf certificate, you can mix and match if necessary (eg: an ECDSA and an RSA leaf certs with shared ECDSA Root CA cert).
+
+Both FQDN continue to be assigned as SAN to certs in `with_ca/rsa/`, while certs in `with_ca/ecdsa/` are limited to `mail.example.test` for ECDSA, and `example.test` for RSA. This is to provide a bit more flexibility in test cases where specific FQDN support is required.
+
+<!-- markdownlint-disable MD033 MD040 -->
+<details>
+<summary>Certificate Details (signed by Root CA ECDSA key):</summary>
+
+`step certificate inspect with_ca/ecdsa/cert.ecdsa.pem`:
+
+```
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 39948191589315458296429918694374173514 (0x1e0dbde943f3ab4144909744cd58eb4a)
+    Signature Algorithm: ECDSA-SHA256
+        Issuer: CN=Smallstep Root CA
+        Validity
+            Not Before: Jan 1 00:00:00 2021 UTC
+            Not After : Jan 1 00:00:00 2031 UTC
+        Subject: CN=Smallstep Leaf
+        Subject Public Key Info:
+            Public Key Algorithm: ECDSA
+                Public-Key: (256 bit)
+                X:
+                    f4:5b:00:6a:6a:ca:1d:b8:15:80:81:d0:82:72:be:
+                    af:3a:3c:5e:a7:9b:64:21:16:19:27:f3:75:0b:eb:
+                    e0:fe
+                Y:
+                    47:6a:6c:9e:d7:da:80:0e:1b:09:76:45:fe:8b:fd:
+                    79:09:f7:08:22:1a:93:20:21:74:5e:78:91:53:45:
+                    9e:71
+                Curve: P-256
+        X509v3 extensions:
+            X509v3 Key Usage: critical
+                Digital Signature
+            X509v3 Extended Key Usage:
+                Server Authentication, Client Authentication
+            X509v3 Subject Key Identifier:
+                D8:BE:56:52:27:E7:90:B0:21:5B:5F:79:D8:F8:D4:85:57:F0:2B:BC
+            X509v3 Authority Key Identifier:
+                keyid:DE:90:B3:B9:4D:C1:B3:EE:77:00:88:8B:69:EC:71:C4:30:F9:F6:7F
+            X509v3 Subject Alternative Name:
+                DNS:mail.example.test
+    Signature Algorithm: ECDSA-SHA256
+        30:46:02:21:00:ad:08:7b:f0:82:41:2e:0e:cd:2b:f7:95:fd:
+        ee:73:d9:93:8d:74:7c:ef:29:4d:d5:da:33:04:f0:b6:b1:6b:
+        13:02:21:00:d7:f1:95:db:be:18:b8:db:77:b9:57:07:e6:b9:
+        5a:3d:00:34:d3:f5:eb:18:67:9b:ba:bf:88:62:72:e9:c9:99
+```
+
+</details>
+
+<details>
+<summary>Root CA Certificate Details (self-signed):</summary>
+
+`step certificate inspect with_ca/ecdsa/ca-cert.ecdsa.pem`:
+
+```
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 91810308658606804773211369549707991484 (0x451205b3271cead885a8ea9c5c21d9bc)
+    Signature Algorithm: ECDSA-SHA256
+        Issuer: CN=Smallstep Root CA
+        Validity
+            Not Before: Jan 1 00:00:00 2021 UTC
+            Not After : Jan 1 00:00:00 2031 UTC
+        Subject: CN=Smallstep Root CA
+        Subject Public Key Info:
+            Public Key Algorithm: ECDSA
+                Public-Key: (256 bit)
+                X:
+                    cf:62:31:60:19:3d:72:78:60:59:1e:27:13:dd:cf:
+                    d9:11:36:28:32:af:fa:28:e4:0e:6e:ab:4b:ad:a2:
+                    49:00
+                Y:
+                    dc:6c:89:09:98:fa:f7:f2:8d:ed:50:53:db:cf:6d:
+                    4f:ce:9d:1a:61:97:c5:80:72:5e:26:34:4a:bb:cb:
+                    81:8c
+                Curve: P-256
+        X509v3 extensions:
+            X509v3 Key Usage: critical
+                Certificate Sign, CRL Sign
+            X509v3 Basic Constraints: critical
+                CA:TRUE, pathlen:1
+            X509v3 Subject Key Identifier:
+                DE:90:B3:B9:4D:C1:B3:EE:77:00:88:8B:69:EC:71:C4:30:F9:F6:7F
+    Signature Algorithm: ECDSA-SHA256
+        30:44:02:20:3f:3b:90:e7:ca:82:70:8e:3f:2e:72:2a:b9:27:
+        46:ac:e9:e2:4a:db:56:02:bc:a2:b2:99:e4:8d:10:7a:d5:73:
+        02:20:72:25:64:b6:1c:aa:a6:c3:14:e1:66:35:bf:a1:db:90:
+        ea:49:59:f9:44:e8:63:de:a8:c0:bb:9b:21:08:59:87
+```
+
+</details>
+<!-- markdownlint-enable MD033 MD040 -->
+
+**Wildcard Certificates:**
+
+This is for testing the wildcard SAN `*.example.test`.
+
+Both `with_ca/{ecdsa,rsa}/` directories contain a wildcard cert. The only difference is the Root CA cert used, and the entire chain being purely ECDSA or RSA type.
+
+```sh
+# Run at `example.test/with_ca/ecdsa/`:
+step certificate create "Smallstep Leaf" wildcard/cert.ecdsa.pem wildcard/key.ecdsa.pem \
+  --no-password --insecure \
+  --profile leaf \
+  --ca ca-cert.ecdsa.pem \
+  --ca-key ca-key.ecdsa.pem \
+  --not-before "2021-01-01T00:00:00+00:00" \
+  --not-after "2031-01-01T00:00:00+00:00" \
+  --san "*.example.test" \
+  --kty EC --crv P-256
+```
+
+<!-- markdownlint-disable MD033 MD040 -->
+<details>
+<summary>Certificate Details (signed by Root CA ECDSA key):</summary>
+
+`step certificate inspect with_ca/ecdsa/wildcard/cert.ecdsa.pem`:
+
+```
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 15398717504679308720407721522825999382 (0xb95af63ae03a90f3bd5a6a740133416)
+    Signature Algorithm: ECDSA-SHA256
+        Issuer: CN=Smallstep Root CA
+        Validity
+            Not Before: Jan 1 00:00:00 2021 UTC
+            Not After : Jan 1 00:00:00 2031 UTC
+        Subject: CN=Smallstep Leaf
+        Subject Public Key Info:
+            Public Key Algorithm: ECDSA
+                Public-Key: (256 bit)
+                X:
+                    2f:44:73:14:e4:e8:9a:88:a1:96:82:be:f3:e5:8b:
+                    94:a4:8a:ec:18:c1:73:86:cf:15:8a:e8:05:bd:46:
+                    71:cf
+                Y:
+                    a1:bd:36:84:d0:b8:b3:15:f4:73:e2:53:87:0d:cd:
+                    e8:a5:42:9a:94:91:d8:a3:d4:e1:d1:77:5a:cb:da:
+                    89:ea
+                Curve: P-256
+        X509v3 extensions:
+            X509v3 Key Usage: critical
+                Digital Signature
+            X509v3 Extended Key Usage:
+                Server Authentication, Client Authentication
+            X509v3 Subject Key Identifier:
+                CA:A0:95:BE:58:73:6C:1D:EA:50:B8:BF:34:FF:D3:F1:63:33:1F:6F
+            X509v3 Authority Key Identifier:
+                keyid:DE:90:B3:B9:4D:C1:B3:EE:77:00:88:8B:69:EC:71:C4:30:F9:F6:7F
+            X509v3 Subject Alternative Name:
+                DNS:*.example.test
+    Signature Algorithm: ECDSA-SHA256
+        30:46:02:21:00:f2:50:c0:b5:c9:24:e5:e9:36:a6:7b:35:5d:
+        38:a7:7d:81:af:02:fc:9d:fd:79:f4:2d:4c:8a:04:55:44:a8:
+        3a:02:21:00:b1:2d:d2:25:18:2d:35:19:20:97:78:f1:d5:18:
+        9f:11:d5:97:a9:dc:64:95:2a:6c:9d:4e:78:69:c1:92:23:23
+```
+
+</details>
+<!-- markdownlint-enable MD033 MD040 -->
+
+---
+
+When bundling chain of trust into a single certificate file (eg: `fullchain.pem`), starting with the server cert, include any additional parent certificates in the chain - but do not add the final Root CA cert; otherwise you'll get a related error with not being able to verify trust:
+
+```sh
+$ openssl s_client -connect mail.example.test:587 -starttls smtp
+
+# Verification error: self signed certificate in certificate chain
+```
+
+Thus, the minimal bundle would be `leaf->intermediate` (`fullchain.pem`) with separate Root CA cert.
--- a/test/files/ssl/example.test/cert.ecdsa.pem
+++ b/test/files/ssl/example.test/cert.ecdsa.pem
@ -0,0 +1,12 @@
+-----BEGIN CERTIFICATE-----
+MIIBvDCCAWGgAwIBAgIRAOpRrmDNAnhLvxuk42f/s10wCgYIKoZIzj0EAwIwIDEe
+MBwGA1UEAxMVU21hbGxzdGVwIHNlbGYtc2lnbmVkMB4XDTIxMDEwMTAwMDAwMFoX
+DTMxMDEwMTAwMDAwMFowIDEeMBwGA1UEAxMVU21hbGxzdGVwIHNlbGYtc2lnbmVk
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEsfexEnUXqHKaOTHv8GGy9AyIxgWy
+EvKZ4KyBeExylOlSj+nBe7AVg5AGMNLAa2ZjMRRUKIAdiW6kLN1ZF1+mPqN8MHow
+DgYDVR0PAQH/BAQDAgeAMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAd
+BgNVHQ4EFgQUFJ+66xRSnywTsunxd9pb9uIdVL0wKgYDVR0RBCMwIYIMZXhhbXBs
+ZS50ZXN0ghFtYWlsLmV4YW1wbGUudGVzdDAKBggqhkjOPQQDAgNJADBGAiEA+HI9
+kH7bnnpPbYD7+txCQ+Lcj2rsGMWv4eoD/WZ4ogECIQD3hliBF/V0WxTID5Piu7jp
+kEfA97Fggtm0Gvz6ZvpIXA==
+-----END CERTIFICATE-----
--- a/test/files/ssl/example.test/cert.rsa.pem
+++ b/test/files/ssl/example.test/cert.rsa.pem
@ -0,0 +1,20 @@
+-----BEGIN CERTIFICATE-----
+MIIDRzCCAi+gAwIBAgIRAJz0KhFSF2OloPvRztsIXzMwDQYJKoZIhvcNAQELBQAw
+IDEeMBwGA1UEAxMVU21hbGxzdGVwIHNlbGYtc2lnbmVkMB4XDTIxMDEwMTAwMDAw
+MFoXDTMxMDEwMTAwMDAwMFowIDEeMBwGA1UEAxMVU21hbGxzdGVwIHNlbGYtc2ln
+bmVkMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4nj6rxuC7pKMtpuW
+7qdPuN1y7MaFl6hTwK0MBMkjXT71Gs54txT9YVMeUQNUZGA8hzjJ/OxVjsDdgoys
+2em47jfflWDZ8gL2IQTgr9LFGrY+X9w6MbjmxzeLelNUsSFhNDEFqm8oiIktrEP4
+T7DnVxf+tk2zfA70NFgctwbpMxPTKmjrQcNcz6nxdrRBns2GakqAawXNXA8abfaN
+7VCitfeXAHUbNp/oaOdD1BzMftMD4MW+VKvp5NxTNmyyRvtyvSbnm8ZFqb5K4xC4
+gFXuKGMJCWCc+1f0xzaPCTkynSaSS3hRnOu8dGHsgG5zWV1S8gKVJPdHnWqysxc1
+nUhYgQIDAQABo3wwejAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUH
+AwEGCCsGAQUFBwMCMB0GA1UdDgQWBBQFrGNR4kShRvgIhtnvaTKyiW3azjAqBgNV
+HREEIzAhggxleGFtcGxlLnRlc3SCEW1haWwuZXhhbXBsZS50ZXN0MA0GCSqGSIb3
+DQEBCwUAA4IBAQBQR3tZJp2N9+TcA5SwNeQDt5QWfrZ5xbvnYdvK5iLMyKCfnbB8
+EkPsp/P+rQpEaWl/xzH3P+iYpzdDvftbxoWFkdwpI8trqarw8GJ5zkOMXyhJ7qHU
+FmdrWcMVZePTOzXaWTUzKl6KWf8UuVGljgt8G6Gx9IkaPy/XsY0jCnp54cIDtS/u
+NBapZye2EGdd9B3Ws+CrgD1Z/LxLGlX7NnX/44hz4xZNKxd7KiGjGBQEGbO4ETlV
+P84ht9NdjXjVOuCyF0GtPI6lorrrPbaeLO991cxxywdUIUKBeUUrk3STocnxXl4R
+PazfVZg3RNJVpRWpM3lu/klt5XugHBLFG00z
+-----END CERTIFICATE-----
--- a/test/files/ssl/example.test/key.ecdsa.pem
+++ b/test/files/ssl/example.test/key.ecdsa.pem
@ -0,0 +1,5 @@
+-----BEGIN EC PRIVATE KEY-----
+MHcCAQEEIO4nGpEVFeDjKsUKBBumdJxg0tOx/BEasG6G/denFif1oAoGCCqGSM49
+AwEHoUQDQgAEsfexEnUXqHKaOTHv8GGy9AyIxgWyEvKZ4KyBeExylOlSj+nBe7AV
+g5AGMNLAa2ZjMRRUKIAdiW6kLN1ZF1+mPg==
+-----END EC PRIVATE KEY-----
--- a/test/files/ssl/example.test/key.rsa.pem
+++ b/test/files/ssl/example.test/key.rsa.pem
@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEpQIBAAKCAQEA4nj6rxuC7pKMtpuW7qdPuN1y7MaFl6hTwK0MBMkjXT71Gs54
+txT9YVMeUQNUZGA8hzjJ/OxVjsDdgoys2em47jfflWDZ8gL2IQTgr9LFGrY+X9w6
+MbjmxzeLelNUsSFhNDEFqm8oiIktrEP4T7DnVxf+tk2zfA70NFgctwbpMxPTKmjr
+QcNcz6nxdrRBns2GakqAawXNXA8abfaN7VCitfeXAHUbNp/oaOdD1BzMftMD4MW+
+VKvp5NxTNmyyRvtyvSbnm8ZFqb5K4xC4gFXuKGMJCWCc+1f0xzaPCTkynSaSS3hR
+nOu8dGHsgG5zWV1S8gKVJPdHnWqysxc1nUhYgQIDAQABAoIBAQDA++JycPkjnxH1
+UaRN/Zi7qUkTZx/T2gZ0e4FwWo2eGdX3X9YR/PrlglSlKDczyaYKfGPy+Nj3anXX
+l1R75ORHaqlFu2A9EDT4chWc/fgkCQQh36JfWHafcD+Un4nd3tncBaIUV+CsaGjZ
+EJp6Hf8kgjf01UWLA5spN6RQer0hXbrtcIbzXH/aHPblKHJPrZ1I4HnQ4FlM9DvP
+RZqm4RYf2NLSQiS494x9CthoEh77/CkuIRcwcY499rVT6L70io4oO5CWD8QyBeUK
+qA0pLKZ97vTxpexkMiuOS5hP4t96D7xFfmDMtJv4/qZtlN7DD11+Nl65PG1Qf37+
+GbFfEuYhAoGBAOtkaBnWztqiNP8v9avs1lUoRuAip2pnfM6P86r7dy+8ha2BuAYu
+oCdZnjxFgdLq7KDp4XfgUC0GF9MpP4A5VYo2zR+YjMyXP9JdW0jWjtiBdXiermn5
+oAOFuRUPjtvj0UHhAKcGrTP2gN9Kz+BOS9C2UnmzBgmIYv4NgB5GI0AVAoGBAPZM
+qpJ9Ger3PgZoq1pCDSLoV6X18BWuTzzTH07QYxy8ObVxZ1/iKUKvMEmUz0rQxUsu
+Xc9teD9Q0GKg2KcdTzPh+khuc99THoywhMOElWw0g1RmWwnJWcTmCItLzkyBpmd3
+y3rAig5+eOCiG8DuA6KIwV3L1HrQ/Xn2wIF5wyW9AoGBANGpNAPXzZT1J2koSZSh
+teJRppdapm1i0cqWcz2XD3jIXPTG9qci/mkuLH+YlWLM9oj46GdCt4byx2PAeJv3
+9VXPK/L5iGduTF1N49HDsaXr4TrXc5hWzAx3HfxBSEhY6XjZNSCQFNOUuwKn+vHa
+KzMyQdG+ACGbhjisw7GzXRBlAoGBAMyXXK04e9oBLKWYNpZP/ad8hqoWRCtOUwW8
+feozEdFhzTIaFHvCWvHIonzMvvBvwSM1TbmrPlKh56e14qHWp976HLQkA96DpgHJ
+806SCKkMafcm2wKjHg1/46MKAkDtBXQ3P3AlFcj6Z6B5KEK3s49EuBMY6NRoW9X/
+EWO76E2lAoGASH1EAyBSFSa61M+6BwHzjKFgNCCj3tQP6wGJGeDs+rb4tPsmnbvB
+PFpmI4FvlFWIuCmZu5v/Yx/eqeD3mVhoXk5zibVSUyTAbrChPO2qSu8yCE9qlsOB
+gkXdlpwYF++HnuRaMMIk8jJfU6u48cMULxjDHgrHrDjnUDBBVrBNXuo=
+-----END RSA PRIVATE KEY-----
--- a/test/files/ssl/example.test/testssl.txt
+++ b/test/files/ssl/example.test/testssl.txt
@ -0,0 +1,10 @@
+# Provides commands for `testssl.sh` `--file` option to run multiple tests with
+--jsonfile-pretty port_25.json --starttls smtp example.test:25
+--jsonfile-pretty port_587.json --starttls smtp example.test:587
+--jsonfile-pretty port_465.json example.test:465
+
+--jsonfile-pretty port_110.json --starttls pop3 example.test:110
+--jsonfile-pretty port_995.json example.test:995
+
+--jsonfile-pretty port_143.json --starttls imap example.test:143
+--jsonfile-pretty port_993.json example.test:993
--- a/test/files/ssl/example.test/traefik.md
+++ b/test/files/ssl/example.test/traefik.md
@ -0,0 +1,26 @@
+# Traefik `acme.json` test files
+
+Traefik encodes it's provisioned certificates into `acme.json` instead of separate files, but there is nothing special about the storage or content.
+
+Each `*.acme.json` file provides base64 encoded representations of their equivalent cert and key files at the same relative location.
+
+The only relevant content being tested from these `acme.json` files is in `le.Certificates`, everything else is only placeholder values.
+
+---
+
+Certificates have been encoded into base64 for `acme.json` files from the `example.test/with_ca/{ecdsa,rsa}/` folders:
+
+- Those folders each provide a Root CA cert which functions similar to _Let's Encrypt_ role for verification of the chain of trust. All leaf certificates are signed by the Root CA key file located in these two folders.
+- Leaf certificates are the kind you'd get provisioned normally via a service like _Let's Encrypt_ to use with your own server. These are available in both ECDSA and RSA, where those in `with_ca/rsa/` are valid for both FQDNs `mail.example.test` and `example.test` as SANs; but those in `with_ca/ecdsa/` are restricted to one FQDN.
+- Each `acme.json` file lists the supported FQDNs in the `sans` field. Presently `main` is always `Smallstep Leaf`, which is associated to the certificate "Subject CN", which was often used for an FQDN in the past prior to SAN support. `main` can still provide a valid FQDN, but none of the test `acme.json` have a matching cert to test against.
+- There is also two wildcard configs, where the only difference is a pure ECDSA or RSA chain for `*.example.test`.These are valid for subdomains of `example.test` such as: `mail.example.test`, but not `example.test` itself.
+
+---
+
+Encode and decode certs easily via the [`step base64`](https://smallstep.com/docs/step-cli/reference/base64) command:
+
+- Decode: `echo 'YmFzZTY0IGVuY29kZWQgc3RyaW5nCg==' | step base64 -d`
+  Optionally write the output to a file: `> example.test/with_ca/ecdsa/cert.rsa.pem`
+- Encode: `cat example.test/with_ca/ecdsa/cert.rsa.pem | step base64`
+- Inspect the PEM encoded data: `step certificate inspect example.test/with_ca/ecdsa/cert.rsa.pem`
+  Note: `step certificate inspect` will only work with valid PEM encoded files, not the example base64 value to decode here.
--- a/test/files/ssl/example.test/with_ca/ecdsa/ca-cert.ecdsa.pem
+++ b/test/files/ssl/example.test/with_ca/ecdsa/ca-cert.ecdsa.pem
@ -0,0 +1,10 @@
+-----BEGIN CERTIFICATE-----
+MIIBejCCASGgAwIBAgIQRRIFsycc6tiFqOqcXCHZvDAKBggqhkjOPQQDAjAcMRow
+GAYDVQQDExFTbWFsbHN0ZXAgUm9vdCBDQTAeFw0yMTAxMDEwMDAwMDBaFw0zMTAx
+MDEwMDAwMDBaMBwxGjAYBgNVBAMTEVNtYWxsc3RlcCBSb290IENBMFkwEwYHKoZI
+zj0CAQYIKoZIzj0DAQcDQgAEz2IxYBk9cnhgWR4nE93P2RE2KDKv+ijkDm6rS62i
+SQDcbIkJmPr38o3tUFPbz21Pzp0aYZfFgHJeJjRKu8uBjKNFMEMwDgYDVR0PAQH/
+BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwHQYDVR0OBBYEFN6Qs7lNwbPudwCI
+i2nsccQw+fZ/MAoGCCqGSM49BAMCA0cAMEQCID87kOfKgnCOPy5yKrknRqzp4krb
+VgK8orKZ5I0QetVzAiByJWS2HKqmwxThZjW/oduQ6klZ+UToY96owLubIQhZhw==
+-----END CERTIFICATE-----
--- a/test/files/ssl/example.test/with_ca/ecdsa/ca-key.ecdsa.pem
+++ b/test/files/ssl/example.test/with_ca/ecdsa/ca-key.ecdsa.pem
@ -0,0 +1,5 @@
+-----BEGIN EC PRIVATE KEY-----
+MHcCAQEEIJH8zwg9RIU/CowHtUHTDPe19w740Mqh+BYcFCoqAO4noAoGCCqGSM49
+AwEHoUQDQgAEz2IxYBk9cnhgWR4nE93P2RE2KDKv+ijkDm6rS62iSQDcbIkJmPr3
+8o3tUFPbz21Pzp0aYZfFgHJeJjRKu8uBjA==
+-----END EC PRIVATE KEY-----
--- a/test/files/ssl/example.test/with_ca/ecdsa/cert.ecdsa.pem
+++ b/test/files/ssl/example.test/with_ca/ecdsa/cert.ecdsa.pem
@ -0,0 +1,12 @@
+-----BEGIN CERTIFICATE-----
+MIIBxTCCAWqgAwIBAgIQHg296UPzq0FEkJdEzVjrSjAKBggqhkjOPQQDAjAcMRow
+GAYDVQQDExFTbWFsbHN0ZXAgUm9vdCBDQTAeFw0yMTAxMDEwMDAwMDBaFw0zMTAx
+MDEwMDAwMDBaMBkxFzAVBgNVBAMTDlNtYWxsc3RlcCBMZWFmMFkwEwYHKoZIzj0C
+AQYIKoZIzj0DAQcDQgAE9FsAamrKHbgVgIHQgnK+rzo8XqebZCEWGSfzdQvr4P5H
+amye19qADhsJdkX+i/15CfcIIhqTICF0XniRU0WecaOBkDCBjTAOBgNVHQ8BAf8E
+BAMCB4AwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMB0GA1UdDgQWBBTY
+vlZSJ+eQsCFbX3nY+NSFV/ArvDAfBgNVHSMEGDAWgBTekLO5TcGz7ncAiItp7HHE
+MPn2fzAcBgNVHREEFTATghFtYWlsLmV4YW1wbGUudGVzdDAKBggqhkjOPQQDAgNJ
+ADBGAiEArQh78IJBLg7NK/eV/e5z2ZONdHzvKU3V2jME8LaxaxMCIQDX8ZXbvhi4
+23e5VwfmuVo9ADTT9esYZ5u6v4hicunJmQ==
+-----END CERTIFICATE-----
--- a/test/files/ssl/example.test/with_ca/ecdsa/cert.rsa.pem
+++ b/test/files/ssl/example.test/with_ca/ecdsa/cert.rsa.pem
@ -0,0 +1,16 @@
+-----BEGIN CERTIFICATE-----
+MIICijCCAjGgAwIBAgIRAPXENYk0OaCer/5wnuExtNswCgYIKoZIzj0EAwIwHDEa
+MBgGA1UEAxMRU21hbGxzdGVwIFJvb3QgQ0EwHhcNMjEwMTAxMDAwMDAwWhcNMzEw
+MTAxMDAwMDAwWjAZMRcwFQYDVQQDEw5TbWFsbHN0ZXAgTGVhZjCCASIwDQYJKoZI
+hvcNAQEBBQADggEPADCCAQoCggEBALGRqdTJ6GR1hePrBW64R0fuZLxBiIKtTnUG
+7UKl8WhQuBUrvd9EZpXXft9uZ/QIZkcxoehzGYuysKISmWlQ6jDfglKNgb/BFC9Z
+BEflldcLPqGcROVsNz8hT3u0ALxABNASoyzv4b+Ml4vvoFCztaWb6KzkAdsWljmN
+9o8GVil71vlI8FuPO/y+6EPpQkWvDPtMCecivBAJrzXsKL6ZlHTBQCoXCh8jsv6v
+d+JkzR7IAnJ+c54kRkxuH9XDygVYmZhIJtFNeMc5v2iWBiXcLPdO4OIIBskZFK/9
+36WizsrPfq2XPK87bhwcQRBNiu+Qgpqg+9js0MTI7rBQtOf63fsCAwEAAaOBizCB
+iDAOBgNVHQ8BAf8EBAMCB4AwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMC
+MB0GA1UdDgQWBBQ8autoXwYktv9eakYZBjHpMn13bzAfBgNVHSMEGDAWgBTekLO5
+TcGz7ncAiItp7HHEMPn2fzAXBgNVHREEEDAOggxleGFtcGxlLnRlc3QwCgYIKoZI
+zj0EAwIDRwAwRAIgPmKrjFMwmanoAavvmWzPDhyGl/wF/YIH4f95n4tSzroCIDW0
+KQ9KnNpcqGcr70qOFxtaGZ/cDGf9BwzoWT7fS/8r
+-----END CERTIFICATE-----
--- a/test/files/ssl/example.test/with_ca/ecdsa/ecdsa.acme.json
+++ b/test/files/ssl/example.test/with_ca/ecdsa/ecdsa.acme.json
@ -0,0 +1,29 @@
+{
+    "le": {
+      "Account": {
+        "Email": "acme@example.test",
+        "Registration": {
+          "body": {
+            "status": "valid",
+            "contact": [
+              "mailto:acme@example.test"
+            ]
+          },
+          "uri": "https://acme-v02.api.letsencrypt.org/acme/acct/0123456789"
+        },
+        "PrivateKey": "x",
+        "KeyType": "EC256"
+      },
+      "Certificates": [
+        {
+          "domain": {
+            "main": "Smallstep Leaf",
+            "sans": ["mail.example.test"]
+          },
+          "certificate": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJ4VENDQVdxZ0F3SUJBZ0lRSGcyOTZVUHpxMEZFa0pkRXpWanJTakFLQmdncWhrak9QUVFEQWpBY01Sb3cKR0FZRFZRUURFeEZUYldGc2JITjBaWEFnVW05dmRDQkRRVEFlRncweU1UQXhNREV3TURBd01EQmFGdzB6TVRBeApNREV3TURBd01EQmFNQmt4RnpBVkJnTlZCQU1URGxOdFlXeHNjM1JsY0NCTVpXRm1NRmt3RXdZSEtvWkl6ajBDCkFRWUlLb1pJemowREFRY0RRZ0FFOUZzQWFtcktIYmdWZ0lIUWduSytyem84WHFlYlpDRVdHU2Z6ZFF2cjRQNUgKYW15ZTE5cUFEaHNKZGtYK2kvMTVDZmNJSWhxVElDRjBYbmlSVTBXZWNhT0JrRENCalRBT0JnTlZIUThCQWY4RQpCQU1DQjRBd0hRWURWUjBsQkJZd0ZBWUlLd1lCQlFVSEF3RUdDQ3NHQVFVRkJ3TUNNQjBHQTFVZERnUVdCQlRZCnZsWlNKK2VRc0NGYlgzblkrTlNGVi9BcnZEQWZCZ05WSFNNRUdEQVdnQlRla0xPNVRjR3o3bmNBaUl0cDdISEUKTVBuMmZ6QWNCZ05WSFJFRUZUQVRnaEZ0WVdsc0xtVjRZVzF3YkdVdWRHVnpkREFLQmdncWhrak9QUVFEQWdOSgpBREJHQWlFQXJRaDc4SUpCTGc3TksvZVYvZTV6MlpPTmRIenZLVTNWMmpNRThMYXhheE1DSVFEWDhaWGJ2aGk0CjIzZTVWd2ZtdVZvOUFEVFQ5ZXNZWjV1NnY0aGljdW5KbVE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==",
+          "key": "LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSU1sOWx2c2lTV1VxQ1ErY3ZYZGlNQXBmVmhRL1hIOHp1aU5oRkQzSmJHdjlvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFOUZzQWFtcktIYmdWZ0lIUWduSytyem84WHFlYlpDRVdHU2Z6ZFF2cjRQNUhhbXllMTlxQQpEaHNKZGtYK2kvMTVDZmNJSWhxVElDRjBYbmlSVTBXZWNRPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=",
+          "Store": "default"
+        }
+      ]
+    }
+  }
--- a/test/files/ssl/example.test/with_ca/ecdsa/key.ecdsa.pem
+++ b/test/files/ssl/example.test/with_ca/ecdsa/key.ecdsa.pem
@ -0,0 +1,5 @@
+-----BEGIN EC PRIVATE KEY-----
+MHcCAQEEIMl9lvsiSWUqCQ+cvXdiMApfVhQ/XH8zuiNhFD3JbGv9oAoGCCqGSM49
+AwEHoUQDQgAE9FsAamrKHbgVgIHQgnK+rzo8XqebZCEWGSfzdQvr4P5Hamye19qA
+DhsJdkX+i/15CfcIIhqTICF0XniRU0WecQ==
+-----END EC PRIVATE KEY-----
--- a/test/files/ssl/example.test/with_ca/ecdsa/key.rsa.pem
+++ b/test/files/ssl/example.test/with_ca/ecdsa/key.rsa.pem
@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEogIBAAKCAQEAsZGp1MnoZHWF4+sFbrhHR+5kvEGIgq1OdQbtQqXxaFC4FSu9
+30Rmldd+325n9AhmRzGh6HMZi7KwohKZaVDqMN+CUo2Bv8EUL1kER+WV1ws+oZxE
+5Ww3PyFPe7QAvEAE0BKjLO/hv4yXi++gULO1pZvorOQB2xaWOY32jwZWKXvW+Ujw
+W487/L7oQ+lCRa8M+0wJ5yK8EAmvNewovpmUdMFAKhcKHyOy/q934mTNHsgCcn5z
+niRGTG4f1cPKBViZmEgm0U14xzm/aJYGJdws907g4ggGyRkUr/3fpaLOys9+rZc8
+rztuHBxBEE2K75CCmqD72OzQxMjusFC05/rd+wIDAQABAoIBAGCx2bGuYYaTGN4M
+VWD9qJNbFjAN37CJf3fq1bi9dMBBdHzS3Qp/zP075DL3hFQ3XrrWJDzYsMiJ/fXD
+xaGoYELtYQO2uD4220NJG+ibf40eV64IixsyYjvMsFCPERG+Ff2TjViS6RrgvsI
+lv4AKq2Q/YiE4CixBuDWwh3guQDS8wifWk6vwcDI3ANmpr0vDVYXjEY7kxBspZw
+XG5TtretBHIHQGFbBVbS/l0ofVlbnQh7yLn6AxUZcVWHiTchtQx1tL95QU/H3oMn
+iL3mMLASWvw/rLjWCLDDy4uOj8UWfiVqqPxxFcoyqy4BKul5gtyblB9L/5A5I5i0
+feFW1gECgYEA18FhCYlbv7woet9kOz4zY2+wCPe5lzuIp1t/jfwAfrtvz7/TVUtv
+mAYDDVfOZvZXmRK1nx9Ev+M2Ob71sDsRXc8zJkffz42eKSaSRBE29TUzl7Oyond0
+YMjzXerXKFJwvIcnZychCux/dJWuMPNwbvK98XnQvnRFtRyZob2aVmECgYEA0rDU
+uTrQqhdeZpkipfwuxU4sXK9ubYBRhe4HeCponVxTXFY1zTY2GDQfjZpvL69nle8S
+cqsKeJZZTw5OQNKFWlP+ji+wzBvCKalS7FXYA8ddQhM6adMHkXq4le8sjUBfp0Pt
+dssdhxYShEhDeDVdcu4yOnDIo9+DmWYXqoIzmdsCgYBI8zKrNc1W2/jX6taKDXL0
+qRvdPF19G/0NkStkx5MnRpr8pICBM3ts7IN1rH22ZI6jzCaqwbjOJLX9+mo6Bw7N
+KDTEOcMb+2dBxK/p4eQyLqXeIj1BH6Cy5N8cnz3WfWFu7UfOYfWTKvnBYqa+GGGo
+sdy1XBnPe6LiJORxQpl/oQKBgDyZg/XrBs2Ffy9/aEnZqRIzE+tswhRYzhn5hsh3
+WjO4tHlgioUFzLVVeKXf/471opOreeDldVON2w40DSnz40tB0XvQF8f9S/FztFgp
+sMIVe6tfoHODsS+U3raxXl0aYOjZTtnWPh32qUjHCDDxGHnQLT5F5k/MICvlA3WV
+kYX1AoGAcdctwNK1hzZNtZwmkAKtmizRGAI4Hq4tRoBqSvrCz59BCY1/VnYZYWTz
+/6E/fQuzv7/7auiUy2HM0QHjzKjNzZDshM2DegPR5C6kn/LsDwYz9u5Tq7huk8L3
+5HpxnIhEoy4mQydLuXEu4ZNGprME1giiCG2tTH3o1CjsmuVAnuQ=
+-----END RSA PRIVATE KEY-----
--- a/test/files/ssl/example.test/with_ca/ecdsa/rsa.acme.json
+++ b/test/files/ssl/example.test/with_ca/ecdsa/rsa.acme.json
@ -0,0 +1,29 @@
+{
+    "le": {
+      "Account": {
+        "Email": "acme@example.test",
+        "Registration": {
+          "body": {
+            "status": "valid",
+            "contact": [
+              "mailto:acme@example.test"
+            ]
+          },
+          "uri": "https://acme-v02.api.letsencrypt.org/acme/acct/0123456789"
+        },
+        "PrivateKey": "x",
+        "KeyType": "RSA2048"
+      },
+      "Certificates": [
+        {
+          "domain": {
+            "main": "Smallstep Leaf",
+            "sans": ["example.test"]
+          },
+          "certificate": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUNpakNDQWpHZ0F3SUJBZ0lSQVBYRU5ZazBPYUNlci81d251RXh0TnN3Q2dZSUtvWkl6ajBFQXdJd0hERWEKTUJnR0ExVUVBeE1SVTIxaGJHeHpkR1Z3SUZKdmIzUWdRMEV3SGhjTk1qRXdNVEF4TURBd01EQXdXaGNOTXpFdwpNVEF4TURBd01EQXdXakFaTVJjd0ZRWURWUVFERXc1VGJXRnNiSE4wWlhBZ1RHVmhaakNDQVNJd0RRWUpLb1pJCmh2Y05BUUVCQlFBRGdnRVBBRENDQVFvQ2dnRUJBTEdScWRUSjZHUjFoZVByQlc2NFIwZnVaTHhCaUlLdFRuVUcKN1VLbDhXaFF1QlVydmQ5RVpwWFhmdDl1Wi9RSVprY3hvZWh6R1l1eXNLSVNtV2xRNmpEZmdsS05nYi9CRkM5WgpCRWZsbGRjTFBxR2NST1ZzTno4aFQzdTBBTHhBQk5BU295enY0YitNbDR2dm9GQ3p0YVdiNkt6a0Fkc1dsam1OCjlvOEdWaWw3MXZsSThGdVBPL3krNkVQcFFrV3ZEUHRNQ2VjaXZCQUpyelhzS0w2WmxIVEJRQ29YQ2g4anN2NnYKZCtKa3pSN0lBbkorYzU0a1JreHVIOVhEeWdWWW1aaElKdEZOZU1jNXYyaVdCaVhjTFBkTzRPSUlCc2taRksvOQozNldpenNyUGZxMlhQSzg3Ymh3Y1FSQk5pdStRZ3BxZys5anMwTVRJN3JCUXRPZjYzZnNDQXdFQUFhT0JpekNCCmlEQU9CZ05WSFE4QkFmOEVCQU1DQjRBd0hRWURWUjBsQkJZd0ZBWUlLd1lCQlFVSEF3RUdDQ3NHQVFVRkJ3TUMKTUIwR0ExVWREZ1FXQkJROGF1dG9Yd1lrdHY5ZWFrWVpCakhwTW4xM2J6QWZCZ05WSFNNRUdEQVdnQlRla0xPNQpUY0d6N25jQWlJdHA3SEhFTVBuMmZ6QVhCZ05WSFJFRUVEQU9nZ3hsZUdGdGNHeGxMblJsYzNRd0NnWUlLb1pJCnpqMEVBd0lEUndBd1JBSWdQbUtyakZNd21hbm9BYXZ2bVd6UERoeUdsL3dGL1lJSDRmOTVuNHRTenJvQ0lEVzAKS1E5S25OcGNxR2NyNzBxT0Z4dGFHWi9jREdmOUJ3em9XVDdmUy84cgotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==",
+          "key": "LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb2dJQkFBS0NBUUVBc1pHcDFNbm9aSFdGNCtzRmJyaEhSKzVrdkVHSWdxMU9kUWJ0UXFYeGFGQzRGU3U5CjMwUm1sZGQrMzI1bjlBaG1SekdoNkhNWmk3S3dvaEtaYVZEcU1OK0NVbzJCdjhFVUwxa0VSK1dWMXdzK29aeEUKNVd3M1B5RlBlN1FBdkVBRTBCS2pMTy9odjR5WGkrK2dVTE8xcFp2b3JPUUIyeGFXT1kzMmp3WldLWHZXK1VqdwpXNDg3L0w3b1ErbENSYThNKzB3SjV5SzhFQW12TmV3b3ZwbVVkTUZBS2hjS0h5T3kvcTkzNG1UTkhzZ0NjbjV6Cm5pUkdURzRmMWNQS0JWaVptRWdtMFUxNHh6bS9hSllHSmR3czkwN2c0Z2dHeVJrVXIvM2ZwYUxPeXM5K3JaYzgKcnp0dUhCeEJFRTJLNzVDQ21xRDcyT3pReE1qdXNGQzA1L3JkK3dJREFRQUJBb0lCQUdDeDJiR3VZWWFUR040TQpWV0Q5cUpOYkZqQU4zN0NKZjNmcTFiaTlkTUJCZEh6UzNRcC96UDA3NURMM2hGUTNYcnJXSkR6WXNNaUovZlhECit4YUdvWUVMdFlRTzJ1RDQyMjBOSkcraWJmNDBlVjY0SWl4c3lZanZNc0ZDUEVSRytGZjJUalZpUzZScmd2c0kKK2x2NEFLcTJRL1lpRTRDaXhCdURXd2gzZ3VRRFM4d2lmV2s2dndjREkzQU5tcHIwdkRWWVhqRVk3a3hCc3BadwpYRzVUdHJldEJISUhRR0ZiQlZiUy9sMG9mVmxiblFoN3lMbjZBeFVaY1ZXSGlUY2h0UXgxdEw5NVFVL0gzb01uCmlMM21NTEFTV3Z3L3JMaldDTEREeTR1T2o4VVdmaVZxcVB4eEZjb3lxeTRCS3VsNWd0eWJsQjlMLzVBNUk1aTAKZmVGVzFnRUNnWUVBMThGaENZbGJ2N3dvZXQ5a096NHpZMit3Q1BlNWx6dUlwMXQvamZ3QWZydHZ6Ny9UVlV0dgptQVlERFZmT1p2WlhtUksxbng5RXYrTTJPYjcxc0RzUlhjOHpKa2ZmejQyZUtTYVNSQkUyOVRVemw3T3lvbmQwCllNanpYZXJYS0ZKd3ZJY25aeWNoQ3V4L2RKV3VNUE53YnZLOThYblF2blJGdFJ5Wm9iMmFWbUVDZ1lFQTByRFUKdVRyUXFoZGVacGtpcGZ3dXhVNHNYSzl1YllCUmhlNEhlQ3BvblZ4VFhGWTF6VFkyR0RRZmpacHZMNjlubGU4UwpjcXNLZUpaWlR3NU9RTktGV2xQK2ppK3d6QnZDS2FsUzdGWFlBOGRkUWhNNmFkTUhrWHE0bGU4c2pVQmZwMFB0CmRzc2RoeFlTaEVoRGVEVmRjdTR5T25ESW85K0RtV1lYcW9Jem1kc0NnWUJJOHpLck5jMVcyL2pYNnRhS0RYTDAKcVJ2ZFBGMTlHLzBOa1N0a3g1TW5ScHI4cElDQk0zdHM3SU4xckgyMlpJNmp6Q2Fxd2JqT0pMWDkrbW82Qnc3TgpLRFRFT2NNYisyZEJ4Sy9wNGVReUxxWGVJajFCSDZDeTVOOGNuejNXZldGdTdVZk9ZZldUS3ZuQllxYStHR0dvCnNkeTFYQm5QZTZMaUpPUnhRcGwvb1FLQmdEeVpnL1hyQnMyRmZ5OS9hRW5acVJJekUrdHN3aFJZemhuNWhzaDMKV2pPNHRIbGdpb1VGekxWVmVLWGYvNDcxb3BPcmVlRGxkVk9OMnc0MERTbno0MHRCMFh2UUY4ZjlTL0Z6dEZncApzTUlWZTZ0Zm9IT0RzUytVM3JheFhsMGFZT2paVHRuV1BoMzJxVWpIQ0REeEdIblFMVDVGNWsvTUlDdmxBM1dWCmtZWDFBb0dBY2RjdHdOSzFoelpOdFp3bWtBS3RtaXpSR0FJNEhxNHRSb0JxU3ZyQ3o1OUJDWTEvVm5ZWllXVHoKLzZFL2ZRdXp2Ny83YXVpVXkySE0wUUhqektqTnpaRHNoTTJEZWdQUjVDNmtuL0xzRHdZejl1NVRxN2h1azhMMwo1SHB4bkloRW95NG1ReWRMdVhFdTRaTkdwck1FMWdpaUNHMnRUSDNvMUNqc211VkFudVE9Ci0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg==",
+          "Store": "default"
+        }
+      ]
+    }
+  }
--- a/test/files/ssl/example.test/with_ca/ecdsa/wildcard/cert.ecdsa.pem
+++ b/test/files/ssl/example.test/with_ca/ecdsa/wildcard/cert.ecdsa.pem
@ -0,0 +1,12 @@
+-----BEGIN CERTIFICATE-----
+MIIBwjCCAWegAwIBAgIQC5WvY64DqQ871aanQBM0FjAKBggqhkjOPQQDAjAcMRow
+GAYDVQQDExFTbWFsbHN0ZXAgUm9vdCBDQTAeFw0yMTAxMDEwMDAwMDBaFw0zMTAx
+MDEwMDAwMDBaMBkxFzAVBgNVBAMTDlNtYWxsc3RlcCBMZWFmMFkwEwYHKoZIzj0C
+AQYIKoZIzj0DAQcDQgAEL0RzFOTomoihloK+8+WLlKSK7BjBc4bPFYroBb1Gcc+h
+vTaE0LizFfRz4lOHDc3opUKalJHYo9Th0Xday9qJ6qOBjTCBijAOBgNVHQ8BAf8E
+BAMCB4AwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMB0GA1UdDgQWBBTK
+oJW+WHNsHepQuL80/9PxYzMfbzAfBgNVHSMEGDAWgBTekLO5TcGz7ncAiItp7HHE
+MPn2fzAZBgNVHREEEjAQgg4qLmV4YW1wbGUudGVzdDAKBggqhkjOPQQDAgNJADBG
+AiEA8lDAtckk5ek2pns1XTinfYGvAvyd/Xn0LUyKBFVEqDoCIQCxLdIlGC01GSCX
+ePHVGJ8R1Zep3GSVKmydTnhpwZIjIw==
+-----END CERTIFICATE-----
--- a/test/files/ssl/example.test/with_ca/ecdsa/wildcard/ecdsa.acme.json
+++ b/test/files/ssl/example.test/with_ca/ecdsa/wildcard/ecdsa.acme.json
@ -0,0 +1,29 @@
+{
+    "le": {
+      "Account": {
+        "Email": "acme@example.test",
+        "Registration": {
+          "body": {
+            "status": "valid",
+            "contact": [
+              "mailto:acme@example.test"
+            ]
+          },
+          "uri": "https://acme-v02.api.letsencrypt.org/acme/acct/0123456789"
+        },
+        "PrivateKey": "x",
+        "KeyType": "EC256"
+      },
+      "Certificates": [
+        {
+          "domain": {
+            "main": "Smallstep Leaf",
+            "sans": ["*.example.test"]
+          },
+          "certificate": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJ3akNDQVdlZ0F3SUJBZ0lRQzVXdlk2NERxUTg3MWFhblFCTTBGakFLQmdncWhrak9QUVFEQWpBY01Sb3cKR0FZRFZRUURFeEZUYldGc2JITjBaWEFnVW05dmRDQkRRVEFlRncweU1UQXhNREV3TURBd01EQmFGdzB6TVRBeApNREV3TURBd01EQmFNQmt4RnpBVkJnTlZCQU1URGxOdFlXeHNjM1JsY0NCTVpXRm1NRmt3RXdZSEtvWkl6ajBDCkFRWUlLb1pJemowREFRY0RRZ0FFTDBSekZPVG9tb2lobG9LKzgrV0xsS1NLN0JqQmM0YlBGWXJvQmIxR2NjK2gKdlRhRTBMaXpGZlJ6NGxPSERjM29wVUthbEpIWW85VGgwWGRheTlxSjZxT0JqVENCaWpBT0JnTlZIUThCQWY4RQpCQU1DQjRBd0hRWURWUjBsQkJZd0ZBWUlLd1lCQlFVSEF3RUdDQ3NHQVFVRkJ3TUNNQjBHQTFVZERnUVdCQlRLCm9KVytXSE5zSGVwUXVMODAvOVB4WXpNZmJ6QWZCZ05WSFNNRUdEQVdnQlRla0xPNVRjR3o3bmNBaUl0cDdISEUKTVBuMmZ6QVpCZ05WSFJFRUVqQVFnZzRxTG1WNFlXMXdiR1V1ZEdWemREQUtCZ2dxaGtqT1BRUURBZ05KQURCRwpBaUVBOGxEQXRja2s1ZWsycG5zMVhUaW5mWUd2QXZ5ZC9YbjBMVXlLQkZWRXFEb0NJUUN4TGRJbEdDMDFHU0NYCmVQSFZHSjhSMVplcDNHU1ZLbXlkVG5ocHdaSWpJdz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K",
+          "key": "LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUNSSk9mUGVPSVVvNXl3RW52S0R6dkVJMUtQejV2ZjFrNno5bUN0MlBwYzlvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFTDBSekZPVG9tb2lobG9LKzgrV0xsS1NLN0JqQmM0YlBGWXJvQmIxR2NjK2h2VGFFMExpegpGZlJ6NGxPSERjM29wVUthbEpIWW85VGgwWGRheTlxSjZnPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=",
+          "Store": "default"
+        }
+      ]
+    }
+  }
--- a/test/files/ssl/example.test/with_ca/ecdsa/wildcard/key.ecdsa.pem
+++ b/test/files/ssl/example.test/with_ca/ecdsa/wildcard/key.ecdsa.pem
@ -0,0 +1,5 @@
+-----BEGIN EC PRIVATE KEY-----
+MHcCAQEEICRJOfPeOIUo5ywEnvKDzvEI1KPz5vf1k6z9mCt2Ppc9oAoGCCqGSM49
+AwEHoUQDQgAEL0RzFOTomoihloK+8+WLlKSK7BjBc4bPFYroBb1Gcc+hvTaE0Liz
+FfRz4lOHDc3opUKalJHYo9Th0Xday9qJ6g==
+-----END EC PRIVATE KEY-----
--- a/test/files/ssl/example.test/with_ca/rsa/ca-cert.rsa.pem
+++ b/test/files/ssl/example.test/with_ca/rsa/ca-cert.rsa.pem
@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDCDCCAfCgAwIBAgIRANPCP+3+4OKj3S2gIsfQcoIwDQYJKoZIhvcNAQELBQAw
+HDEaMBgGA1UEAxMRU21hbGxzdGVwIFJvb3QgQ0EwHhcNMjEwMTAxMDAwMDAwWhcN
+MzEwMTAxMDAwMDAwWjAcMRowGAYDVQQDExFTbWFsbHN0ZXAgUm9vdCBDQTCCASIw
+DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKuYF7paXiAvIK8IIE6rnNMSuS94
+z8+1md2a6DnijBiwG/DcB2e1wxBab/kK+XNsPWI26FLUxqc9zGZ0Nn7s7DOT6C52
+43m4vJUrTthsFdLzW9SFCbMFCikYhbOSqfj06oVHRstkAI+WgyX6QrnrSV+h0imk
+gZlwjk+oKpkE6rS8zCGgXZMqi7/06qiTwXCVStMnEnX9FuNTbMjgz6bVQH6FOE9e
+8QbykSUjWvE+x6Rk5gUpbFGV26Bb62zH6zF9FY6ECsdsJJlALJ7e5w6MTfSL23u8
+cRcBhtBaQuHkFg9G6JFigQwbm0DQf7o7crdMJY/paWbCuRhxXx3YGZFOU1sCAwEA
+AaNFMEMwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwHQYDVR0O
+BBYEFB3P7cwUTP3cQLjy3SvvnSYQLz/DMA0GCSqGSIb3DQEBCwUAA4IBAQBcSu9x
+eGVGMjfxOmX1S+MyMJNPWKJuBlW5cX80h7mBIVIKnamJjMBDGu8WJFnaFdch5uwr
+KIlXbDmFJjxBb3id/6W3BC09Ze6fjtY+rPRPkCi5L5CbLs6KU1V2X/xoMhg15upH
+e29Giz2gK/Zd9/ewxa+sNRx2mk9fhIzgLA55q34OkhEdi0dJFlyzNHw+/6eYICPd
+hPv+8z3dreuyXqKBO+M/QqLXHqonvZWbJzeWCqetZn/h9WFM2WXMzRTR/GjaUIQP
+/ZPLXm5P4YMtAEbG+PfHuzC0bwUmj5FTGJ7I6v9Y32KS+P94KlsmHOJICqSwLQWo
+6MbojAT5BXYzHzHq
+-----END CERTIFICATE-----
--- a/test/files/ssl/example.test/with_ca/rsa/ca-key.rsa.pem
+++ b/test/files/ssl/example.test/with_ca/rsa/ca-key.rsa.pem
@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEpQIBAAKCAQEAq5gXulpeIC8grwggTquc0xK5L3jPz7WZ3ZroOeKMGLAb8NwH
+Z7XDEFpv+Qr5c2w9YjboUtTGpz3MZnQ2fuzsM5PoLnbjebi8lStO2GwV0vNb1IUJ
+swUKKRiFs5Kp+PTqhUdGy2QAj5aDJfpCuetJX6HSKaSBmXCOT6gqmQTqtLzMIaBd
+kyqLv/TqqJPBcJVK0ycSdf0W41NsyODPptVAfoU4T17xBvKRJSNa8T7HpGTmBSls
+UZXboFvrbMfrMX0VjoQKx2wkmUAsnt7nDoxN9Ivbe7xxFwGG0FpC4eQWD0bokWKB
+DBubQNB/ujtyt0wlj+lpZsK5GHFfHdgZkU5TWwIDAQABAoIBAEVzKF9fRetmx6av
+9kuA/9caI+OH1SwvRxg/IzCSdbtkQ9rHYyPhmBKdV+aHP5EsxOdka8Fipwh3Zawt
+6wSSJcN2YKm1qrnQQFtrjNzhWi/oGUm5ksRnDMa3Sx30BWFi1yycPZYCYou7Elej
+o7AV/7t6BlKeZ2nP+XlaCeum5svBWHNyeMcRy4d9XF2BkIQ5DcBp0CuVkJ8ERXw7
+l0sYSFBN8lu2amI+nwwbjPq636mxTUcMlQ78kHj8DT3YGuzTDBeIOL0nFeR/oeoL
+hsst3Pppf72c+llaEfDqI08j2xq+Ebg5tgFGZcbZeus5A33PiQkPHC8plRnIblov
+9GzanAECgYEAzHoOkfwtjQz5C/X+pDdiVsegZwzetQMIyX3g50GifnH752t2yDu1
+NXI5MUanxEKGaVJpdgq4xax9VSyJH6i92SPJ0qF+8UeXoq9LNitrqh4Xdj6zDfhO
+b1OYpokcwzIFlIiEfdhFrXR2nVk3l2ObpCxrM1yrPB8eBHiQPb5BCVsCgYEA1tTp
+dKLh/CERPT4j+1IQmsuSPtbxbLprxoZfn8DSZ8jb8ZtGCU4Z6nkHvjnHECe1+yLc
+Qi23TmXJvOyzVh4SX3SASi7JwrPJlK5KnPNV1hbX5gsQqiP0mgzFlbulB8WH2vTi
+i9/RRE9Td+ssdmBVFw4KC8iUx0kC0pN2I+lf/gECgYEAkrNDPtOJLrhO+Zjcv56I
+rC/+0dA2+/EYXc81C1VYqpVGoGrGRrQntxejFspVVQZRfsDErw7UL+Yn6XLRUmhz
+BJWbl8WL2Ll/fhV7xXpzfRKnzIsBVZV/WHnGfDzE6Po7bKxhOhRvMRnse8lli/TH
+1oqTwr7Kj5DXrWd+PP4BlR8CgYEAh1VG4AAABnm6R29O8XJoHWuibE2xdsIVRNG/
+iX7JzTF+RLyBKTl3H/swgogZO7cYb+UtBc+QyyVaKdaevuBgyJs2egTxeuMRWMVX
+IXo1F5H6XeOYkuXln+ntyn6T3spz494inOTZCoRCW6fdsZDL6aMhdvzbpJL84TSd
+1s+cdgECgYEApBsdab9aEDFDaqauA9wT9OtmFvLMsx0+fBy0Q3sU2NNuoIbztbdu
+xRV9uRBH4M/S+eWq4zV/aVoroG/aEgJTepxw840avi2mieUVRr0TPjcA2Z0FsYd0
+EAN4XtdSD6ja4fTpju2edz5nKIDtJOVrlCMxwHUXQedrE5KgWjYBaaE=
+-----END RSA PRIVATE KEY-----
--- a/test/files/ssl/example.test/with_ca/rsa/cert.ecdsa.pem
+++ b/test/files/ssl/example.test/with_ca/rsa/cert.ecdsa.pem
@ -0,0 +1,16 @@
+-----BEGIN CERTIFICATE-----
+MIICkzCCAXugAwIBAgIQXv4WNC7ySKm1D3pp7mJBrjANBgkqhkiG9w0BAQsFADAc
+MRowGAYDVQQDExFTbWFsbHN0ZXAgUm9vdCBDQTAeFw0yMTAxMDEwMDAwMDBaFw0z
+MTAxMDEwMDAwMDBaMBkxFzAVBgNVBAMTDlNtYWxsc3RlcCBMZWFmMFkwEwYHKoZI
+zj0CAQYIKoZIzj0DAQcDQgAE34c1Bax+01yot5EyL7gm8jAjoLVvmfOheirlAWsT
+61UWUClY6PvpdLOLvDkFSolKkDNg8FC2vZ57H5bM2G7yMqOBnjCBmzAOBgNVHQ8B
+Af8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMB0GA1UdDgQW
+BBRT0qcu0mKGD6X/6Q1u5h09uys3vDAfBgNVHSMEGDAWgBQdz+3MFEz93EC48t0r
+750mEC8/wzAqBgNVHREEIzAhggxleGFtcGxlLnRlc3SCEW1haWwuZXhhbXBsZS50
+ZXN0MA0GCSqGSIb3DQEBCwUAA4IBAQAEzx3LO3g8NOE7P+5i3Y0iKv+QG6UMRteR
+vgImc4l5VnSa8BjyAOPvYNEI9gFUeIxCslMrc1Wh4rfHKymoQk91KQGkMAO3cbIa
+axyXdMXNllwOm2FIqTFrK0D2pZ5KSGnQmNGfj6bMl3hHHc0QOV7bgMkSddbms1PY
+HxGfFO5UlseLbvCHj8tofamCTr+t9i5ioAOpoaOTOyq34pIgY7AnDE4/zMP/aCqi
+dxD6NO8gcebjuPrF4oi+8wEqSl5/jPNQu/wfup4mPjDl1PenSyue2PfuHebHOeEh
+39pZNq+6UfsCmw11mqiDNa9XqaRBRMdEtzMiEs4MB03RBLt97KOM
+-----END CERTIFICATE-----
--- a/test/files/ssl/example.test/with_ca/rsa/cert.rsa.pem
+++ b/test/files/ssl/example.test/with_ca/rsa/cert.rsa.pem
@ -0,0 +1,21 @@
+-----BEGIN CERTIFICATE-----
+MIIDXzCCAkegAwIBAgIRAKx4AavefugBgIJG3zel3P4wDQYJKoZIhvcNAQELBQAw
+HDEaMBgGA1UEAxMRU21hbGxzdGVwIFJvb3QgQ0EwHhcNMjEwMTAxMDAwMDAwWhcN
+MzEwMTAxMDAwMDAwWjAZMRcwFQYDVQQDEw5TbWFsbHN0ZXAgTGVhZjCCASIwDQYJ
+KoZIhvcNAQEBBQADggEPADCCAQoCggEBAOAUZVzOK9Apmcjfq5x9o48EQLmZm/Xb
+hbWQGV093yIecsWJD3Rx/As5fo4TLdzS8Xao6dlXqzlVRNjvCmPATs6dJnVP1tm/
+aqeVFwKHqh5lhHqx93FYKTPbMcpQHGfVNY8rD3/aLrTbcWiqGd9wrKUAUJO8LOS4
+HhFsjcUYwulXkosHiYioZImksq1Z/cu1L3fzUuPH5WyRk8Nh+aXUuXpHGxTS1djS
+p7d3OjEvK5Ob8AJQjkY3VS90KlxqQ94epPXPxp0hdYpOxbswXU0FMF4SeO1yc/QW
+KeqKtPMvRwg+IXwkTHqDRyZMHn5xrvAOaV1jkp+mjDptoQpUKzB0OXUCAwEAAaOB
+njCBmzAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUF
+BwMCMB0GA1UdDgQWBBQGnpb0nk82jVI3JImnfdHR7DYjADAfBgNVHSMEGDAWgBQd
+z+3MFEz93EC48t0r750mEC8/wzAqBgNVHREEIzAhggxleGFtcGxlLnRlc3SCEW1h
+aWwuZXhhbXBsZS50ZXN0MA0GCSqGSIb3DQEBCwUAA4IBAQAKNre3khwoMoL0LoQG
+UF8HVi5OxzzKCzueZQMU8fj/MXQhpPWAkXKa4vXwCDvVRBCC1j4u+xSeiqXvMVcR
+n7QyxvYKJRnQ0k/x1zp8N6eed2tOFOz+gyHkoNSr/l9fQsAhqoL0FeVatqczI0co
+DGg5ux5bjZwllFYw6LRIuhtZ4BxIQO4GC5pysrvjXb782v0iAowQHL3yC0x/Eyfr
+ca/qovVST8zoWYf/1pQ/7Kp9do8VraB4dyr5r/zAy0GHPfia8qL864wTqGcuRnW3
+1y2BOcKLgnTNCFp2ncWodmObsxom8KgUAVyW06cDx4XI1wa2FSx4G5mehBgSd/mQ
+1Avy
+-----END CERTIFICATE-----
--- a/test/files/ssl/example.test/with_ca/rsa/ecdsa.acme.json
+++ b/test/files/ssl/example.test/with_ca/rsa/ecdsa.acme.json
@ -0,0 +1,29 @@
+{
+    "le": {
+      "Account": {
+        "Email": "acme@example.test",
+        "Registration": {
+          "body": {
+            "status": "valid",
+            "contact": [
+              "mailto:acme@example.test"
+            ]
+          },
+          "uri": "https://acme-v02.api.letsencrypt.org/acme/acct/0123456789"
+        },
+        "PrivateKey": "x",
+        "KeyType": "EC256"
+      },
+      "Certificates": [
+        {
+          "domain": {
+            "main": "Smallstep Leaf",
+            "sans": ["example.test", "mail.example.test"]
+          },
+          "certificate": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUNrekNDQVh1Z0F3SUJBZ0lRWHY0V05DN3lTS20xRDNwcDdtSkJyakFOQmdrcWhraUc5dzBCQVFzRkFEQWMKTVJvd0dBWURWUVFERXhGVGJXRnNiSE4wWlhBZ1VtOXZkQ0JEUVRBZUZ3MHlNVEF4TURFd01EQXdNREJhRncwegpNVEF4TURFd01EQXdNREJhTUJreEZ6QVZCZ05WQkFNVERsTnRZV3hzYzNSbGNDQk1aV0ZtTUZrd0V3WUhLb1pJCnpqMENBUVlJS29aSXpqMERBUWNEUWdBRTM0YzFCYXgrMDF5b3Q1RXlMN2dtOGpBam9MVnZtZk9oZWlybEFXc1QKNjFVV1VDbFk2UHZwZExPTHZEa0ZTb2xLa0ROZzhGQzJ2WjU3SDViTTJHN3lNcU9CbmpDQm16QU9CZ05WSFE4QgpBZjhFQkFNQ0JhQXdIUVlEVlIwbEJCWXdGQVlJS3dZQkJRVUhBd0VHQ0NzR0FRVUZCd01DTUIwR0ExVWREZ1FXCkJCUlQwcWN1MG1LR0Q2WC82UTF1NWgwOXV5czN2REFmQmdOVkhTTUVHREFXZ0JRZHorM01GRXo5M0VDNDh0MHIKNzUwbUVDOC93ekFxQmdOVkhSRUVJekFoZ2d4bGVHRnRjR3hsTG5SbGMzU0NFVzFoYVd3dVpYaGhiWEJzWlM1MApaWE4wTUEwR0NTcUdTSWIzRFFFQkN3VUFBNElCQVFBRXp4M0xPM2c4Tk9FN1ArNWkzWTBpS3YrUUc2VU1SdGVSCnZnSW1jNGw1Vm5TYThCanlBT1B2WU5FSTlnRlVlSXhDc2xNcmMxV2g0cmZIS3ltb1FrOTFLUUdrTUFPM2NiSWEKYXh5WGRNWE5sbHdPbTJGSXFURnJLMEQycFo1S1NHblFtTkdmajZiTWwzaEhIYzBRT1Y3YmdNa1NkZGJtczFQWQpIeEdmRk81VWxzZUxidkNIajh0b2ZhbUNUcit0OWk1aW9BT3BvYU9UT3lxMzRwSWdZN0FuREU0L3pNUC9hQ3FpCmR4RDZOTzhnY2VianVQckY0b2krOHdFcVNsNS9qUE5RdS93ZnVwNG1QakRsMVBlblN5dWUyUGZ1SGViSE9lRWgKMzlwWk5xKzZVZnNDbXcxMW1xaUROYTlYcWFSQlJNZEV0ek1pRXM0TUIwM1JCTHQ5N0tPTQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==",
+          "key": "LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUIvTXpNMHFLTUQ2NkptRUtPK09Ha2dXTko5R3RoZXl0bTYycmd4U0lwckxvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFMzRjMUJheCswMXlvdDVFeUw3Z204akFqb0xWdm1mT2hlaXJsQVdzVDYxVVdVQ2xZNlB2cApkTE9MdkRrRlNvbEtrRE5nOEZDMnZaNTdINWJNMkc3eU1nPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=",
+          "Store": "default"
+        }
+      ]
+    }
+  }
--- a/test/files/ssl/example.test/with_ca/rsa/key.ecdsa.pem
+++ b/test/files/ssl/example.test/with_ca/rsa/key.ecdsa.pem
@ -0,0 +1,5 @@
+-----BEGIN EC PRIVATE KEY-----
+MHcCAQEEIB/MzM0qKMD66JmEKO+OGkgWNJ9Gtheytm62rgxSIprLoAoGCCqGSM49
+AwEHoUQDQgAE34c1Bax+01yot5EyL7gm8jAjoLVvmfOheirlAWsT61UWUClY6Pvp
+dLOLvDkFSolKkDNg8FC2vZ57H5bM2G7yMg==
+-----END EC PRIVATE KEY-----
--- a/test/files/ssl/example.test/with_ca/rsa/key.rsa.pem
+++ b/test/files/ssl/example.test/with_ca/rsa/key.rsa.pem
@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEpAIBAAKCAQEA4BRlXM4r0CmZyN+rnH2jjwRAuZmb9duFtZAZXT3fIh5yxYkP
+dHH8Czl+jhMt3NLxdqjp2VerOVVE2O8KY8BOzp0mdU/W2b9qp5UXAoeqHmWEerH3
+cVgpM9sxylAcZ9U1jysPf9outNtxaKoZ33CspQBQk7ws5LgeEWyNxRjC6VeSiweJ
+iKhkiaSyrVn9y7Uvd/NS48flbJGTw2H5pdS5ekcbFNLV2NKnt3c6MS8rk5vwAlCO
+RjdVL3QqXGpD3h6k9c/GnSF1ik7FuzBdTQUwXhJ47XJz9BYp6oq08y9HCD4hfCRM
+eoNHJkwefnGu8A5pXWOSn6aMOm2hClQrMHQ5dQIDAQABAoIBAH6Yx1ORX4txlWK5
+i1kUWm2Yd4DkWgqjBX24dbwKEqBSF4Gml8awBzfIOcnG6ChUPPtPHx8duqzfkdAF
+7RbCNUPh4TJx8u5+iKE5SBCz2Nbnf9tZ5HRy3IRhmFW2wPWgrWu/ZjhTagPf3sjF
+IWztWXy3Gs78h1iI9OPfMpFiFeyB8LEE1w4nb/iSSUvFue/VZ0aDS5eOmUFVzjxy
+xNfHZ33QnmRYbsJ58oF2Fr+3fTmltM406y+Tg3+Dao+Mpf41NKq+1r58PnKpUjfH
+cLO5k4/Mqbnk4xi/ftzApIew1A6ClO9xwA3+oYE/S0LQ8JHEVajG1aMw8PEXWbOJ
+wzcXwEECgYEA7NZQDQHjCCzdmECITSr3I3tuXbmnv29RS4sAepn9fS4OVosnntrc
+YnRGriuFIZpyrr/3R5DwTgO61VeBAqvJDYtVjj6zyT9f87fdm8gJeDW7T0G24vt6
+0H4KG8ws8+I/FjMj7wiC4yN4/Hcyd94squh+/9NjdTvwfvS6frwnQR0CgYEA8jXV
+SRfBYJ8U8VBMZxfOmvEtJfxaahtnJGBBEwDcCfgB+rIjVQGw0aZONPKilD8jinAt
+UiBwyBDkHaUL14s6H23+QS6am6Mr9lTz+YPqpYWG0VjGBv8kuHZ50EhlBJFadzMb
+VVR5R5FDP3ChMQy7Q6e8RoIK5DQD86vKjQRegjkCgYAlERGsR3xR3ju8RXVPpobR
+bdMDJjhj1LdDfHjRt2IeAmRKFTNZQGW3nv0k6zjF3pdOVEsOT1fczeai1zQgx+QK
+k6ELRzL6L0oEKeWsKO2ae8ZaDC3kbnl1QhSw7w6mCOXYwp5AHfPmOroHwVwLuKED
+Cqo9vcbWJVBpfkHl7eqy3QKBgQCHOZDrbuzSsd4yX79YK0146b9oHryn0sbB409R
+ecBffGw2d7AMLJZ4Zd3x56jnFV0VVE2pNV1iBTQmbNfwrdV0aKdz4r4EuJO5wnI3
+0vN1F9hOFr7wdxAcQGD/7PshErmsJQdUm4Xec/ZUe+Ayj0YZnpMZ1k6YW4X9S+MY
+2eCd2QKBgQDQRh7HHS3n7PAwwtUDKR9oEFWE0dLOr+RWSeFsXz10gxUbQuHvLXU4
+nOCGA+Add6995PAs9xcnA/Ewju/l3YBgiQPvmLqEnpSZUiRoKQcTE+sAd9FCNB/4
+lORhokK5KlIkxUQISAZ65p0awQe0yyfOD1VJmcvALF1FRwWyz5M1TA==
+-----END RSA PRIVATE KEY-----
--- a/test/files/ssl/example.test/with_ca/rsa/rsa.acme.json
+++ b/test/files/ssl/example.test/with_ca/rsa/rsa.acme.json
@ -0,0 +1,29 @@
+{
+    "le": {
+      "Account": {
+        "Email": "acme@example.test",
+        "Registration": {
+          "body": {
+            "status": "valid",
+            "contact": [
+              "mailto:acme@example.test"
+            ]
+          },
+          "uri": "https://acme-v02.api.letsencrypt.org/acme/acct/0123456789"
+        },
+        "PrivateKey": "x",
+        "KeyType": "RSA2048"
+      },
+      "Certificates": [
+        {
+          "domain": {
+            "main": "Smallstep Leaf",
+            "sans": ["example.test", "mail.example.test"]
+          },
+          "certificate": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURYekNDQWtlZ0F3SUJBZ0lSQUt4NEFhdmVmdWdCZ0lKRzN6ZWwzUDR3RFFZSktvWklodmNOQVFFTEJRQXcKSERFYU1CZ0dBMVVFQXhNUlUyMWhiR3h6ZEdWd0lGSnZiM1FnUTBFd0hoY05NakV3TVRBeE1EQXdNREF3V2hjTgpNekV3TVRBeE1EQXdNREF3V2pBWk1SY3dGUVlEVlFRREV3NVRiV0ZzYkhOMFpYQWdUR1ZoWmpDQ0FTSXdEUVlKCktvWklodmNOQVFFQkJRQURnZ0VQQURDQ0FRb0NnZ0VCQU9BVVpWek9LOUFwbWNqZnE1eDlvNDhFUUxtWm0vWGIKaGJXUUdWMDkzeUllY3NXSkQzUngvQXM1Zm80VExkelM4WGFvNmRsWHF6bFZSTmp2Q21QQVRzNmRKblZQMXRtLwphcWVWRndLSHFoNWxoSHF4OTNGWUtUUGJNY3BRSEdmVk5ZOHJEMy9hTHJUYmNXaXFHZDl3cktVQVVKTzhMT1M0CkhoRnNqY1VZd3VsWGtvc0hpWWlvWklta3NxMVovY3UxTDNmelV1UEg1V3lSazhOaCthWFV1WHBIR3hUUzFkalMKcDdkM09qRXZLNU9iOEFKUWprWTNWUzkwS2x4cVE5NGVwUFhQeHAwaGRZcE94YnN3WFUwRk1GNFNlTzF5Yy9RVwpLZXFLdFBNdlJ3ZytJWHdrVEhxRFJ5Wk1IbjV4cnZBT2FWMWprcCttakRwdG9RcFVLekIwT1hVQ0F3RUFBYU9CCm5qQ0JtekFPQmdOVkhROEJBZjhFQkFNQ0JhQXdIUVlEVlIwbEJCWXdGQVlJS3dZQkJRVUhBd0VHQ0NzR0FRVUYKQndNQ01CMEdBMVVkRGdRV0JCUUducGIwbms4MmpWSTNKSW1uZmRIUjdEWWpBREFmQmdOVkhTTUVHREFXZ0JRZAp6KzNNRkV6OTNFQzQ4dDByNzUwbUVDOC93ekFxQmdOVkhSRUVJekFoZ2d4bGVHRnRjR3hsTG5SbGMzU0NFVzFoCmFXd3VaWGhoYlhCc1pTNTBaWE4wTUEwR0NTcUdTSWIzRFFFQkN3VUFBNElCQVFBS05yZTNraHdvTW9MMExvUUcKVUY4SFZpNU94enpLQ3p1ZVpRTVU4ZmovTVhRaHBQV0FrWEthNHZYd0NEdlZSQkNDMWo0dSt4U2VpcVh2TVZjUgpuN1F5eHZZS0pSblEway94MXpwOE42ZWVkMnRPRk96K2d5SGtvTlNyL2w5ZlFzQWhxb0wwRmVWYXRxY3pJMGNvCkRHZzV1eDVialp3bGxGWXc2TFJJdWh0WjRCeElRTzRHQzVweXNydmpYYjc4MnYwaUFvd1FITDN5QzB4L0V5ZnIKY2EvcW92VlNUOHpvV1lmLzFwUS83S3A5ZG84VnJhQjRkeXI1ci96QXkwR0hQZmlhOHFMODY0d1RxR2N1Um5XMwoxeTJCT2NLTGduVE5DRnAybmNXb2RtT2JzeG9tOEtnVUFWeVcwNmNEeDRYSTF3YTJGU3g0RzVtZWhCZ1NkL21RCjFBdnkKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=",
+          "key": "LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcEFJQkFBS0NBUUVBNEJSbFhNNHIwQ21aeU4rcm5IMmpqd1JBdVptYjlkdUZ0WkFaWFQzZkloNXl4WWtQCmRISDhDemwramhNdDNOTHhkcWpwMlZlck9WVkUyTzhLWThCT3pwMG1kVS9XMmI5cXA1VVhBb2VxSG1XRWVySDMKY1ZncE05c3h5bEFjWjlVMWp5c1BmOW91dE50eGFLb1ozM0NzcFFCUWs3d3M1TGdlRVd5TnhSakM2VmVTaXdlSgppS2hraWFTeXJWbjl5N1V2ZC9OUzQ4ZmxiSkdUdzJINXBkUzVla2NiRk5MVjJOS250M2M2TVM4cms1dndBbENPClJqZFZMM1FxWEdwRDNoNms5Yy9HblNGMWlrN0Z1ekJkVFFVd1hoSjQ3WEp6OUJZcDZvcTA4eTlIQ0Q0aGZDUk0KZW9OSEprd2Vmbkd1OEE1cFhXT1NuNmFNT20yaENsUXJNSFE1ZFFJREFRQUJBb0lCQUg2WXgxT1JYNHR4bFdLNQppMWtVV20yWWQ0RGtXZ3FqQlgyNGRid0tFcUJTRjRHbWw4YXdCemZJT2NuRzZDaFVQUHRQSHg4ZHVxemZrZEFGCjdSYkNOVVBoNFRKeDh1NStpS0U1U0JDejJOYm5mOXRaNUhSeTNJUmhtRlcyd1BXZ3JXdS9aamhUYWdQZjNzakYKSVd6dFdYeTNHczc4aDFpSTlPUGZNcEZpRmV5QjhMRUUxdzRuYi9pU1NVdkZ1ZS9WWjBhRFM1ZU9tVUZWemp4eQp4TmZIWjMzUW5tUllic0o1OG9GMkZyKzNmVG1sdE00MDZ5K1RnMytEYW8rTXBmNDFOS3ErMXI1OFBuS3BVamZICmNMTzVrNC9NcWJuazR4aS9mdHpBcElldzFBNkNsTzl4d0EzK29ZRS9TMExROEpIRVZhakcxYU13OFBFWFdiT0oKd3pjWHdFRUNnWUVBN05aUURRSGpDQ3pkbUVDSVRTcjNJM3R1WGJtbnYyOVJTNHNBZXBuOWZTNE9Wb3NubnRyYwpZblJHcml1RklacHlyci8zUjVEd1RnTzYxVmVCQXF2SkRZdFZqajZ6eVQ5Zjg3ZmRtOGdKZURXN1QwRzI0dnQ2CjBINEtHOHdzOCtJL0ZqTWo3d2lDNHlONC9IY3lkOTRzcXVoKy85TmpkVHZ3ZnZTNmZyd25RUjBDZ1lFQThqWFYKU1JmQllKOFU4VkJNWnhmT212RXRKZnhhYWh0bkpHQkJFd0RjQ2ZnQitySWpWUUd3MGFaT05QS2lsRDhqaW5BdApVaUJ3eUJEa0hhVUwxNHM2SDIzK1FTNmFtNk1yOWxUeitZUHFwWVdHMFZqR0J2OGt1SFo1MEVobEJKRmFkek1iClZWUjVSNUZEUDNDaE1ReTdRNmU4Um9JSzVEUUQ4NnZLalFSZWdqa0NnWUFsRVJHc1IzeFIzanU4UlhWUHBvYlIKYmRNREpqaGoxTGREZkhqUnQySWVBbVJLRlROWlFHVzNudjBrNnpqRjNwZE9WRXNPVDFmY3plYWkxelFneCtRSwprNkVMUnpMNkwwb0VLZVdzS08yYWU4WmFEQzNrYm5sMVFoU3c3dzZtQ09YWXdwNUFIZlBtT3JvSHdWd0x1S0VECkNxbzl2Y2JXSlZCcGZrSGw3ZXF5M1FLQmdRQ0hPWkRyYnV6U3NkNHlYNzlZSzAxNDZiOW9IcnluMHNiQjQwOVIKZWNCZmZHdzJkN0FNTEpaNFpkM3g1NmpuRlYwVlZFMnBOVjFpQlRRbWJOZndyZFYwYUtkejRyNEV1Sk81d25JMwowdk4xRjloT0ZyN3dkeEFjUUdELzdQc2hFcm1zSlFkVW00WGVjL1pVZStBeWowWVpucE1aMWs2WVc0WDlTK01ZCjJlQ2QyUUtCZ1FEUVJoN0hIUzNuN1BBd3d0VURLUjlvRUZXRTBkTE9yK1JXU2VGc1h6MTBneFViUXVIdkxYVTQKbk9DR0ErQWRkNjk5NVBBczl4Y25BL0V3anUvbDNZQmdpUVB2bUxxRW5wU1pVaVJvS1FjVEUrc0FkOUZDTkIvNApsT1Job2tLNUtsSWt4VVFJU0FaNjVwMGF3UWUweXlmT0QxVkptY3ZBTEYxRlJ3V3l6NU0xVEE9PQotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQo=",
+          "Store": "default"
+        }
+      ]
+    }
+  }
--- a/test/files/ssl/example.test/with_ca/rsa/wildcard/cert.rsa.pem
+++ b/test/files/ssl/example.test/with_ca/rsa/wildcard/cert.rsa.pem
@ -0,0 +1,20 @@
+-----BEGIN CERTIFICATE-----
+MIIDTjCCAjagAwIBAgIRAMjWRj4nHDOUhio1Pc+1Om8wDQYJKoZIhvcNAQELBQAw
+HDEaMBgGA1UEAxMRU21hbGxzdGVwIFJvb3QgQ0EwHhcNMjEwMTAxMDAwMDAwWhcN
+MzEwMTAxMDAwMDAwWjAZMRcwFQYDVQQDEw5TbWFsbHN0ZXAgTGVhZjCCASIwDQYJ
+KoZIhvcNAQEBBQADggEPADCCAQoCggEBALQA64PCkaIQLtzNOL3RcUwFT23canZJ
+eQm4Ai6UKPE/CoHlCyc4PvLmstdegD6p7wzNX7Wp9wlrGhl0mW6fC9W5UU7ziSA9
+ffqrAjUzW0MGPusqFERq4XUY6vMIJ/DkoNxNDcsbRRcF7e3x/q60vLhnjwSD7nw6
+s1q1A08MPaz3GOC+etxb83rCa+SIVhHv6t5ScZR/IccINC5BDnQRl9ED96jaRcuE
+DrX59/KUyIicOCYy6lYvqEdxxb9dUPgOYLvUiicgYWhHja56uF23nhagTz+eYMI4
+vZPIeGo2BkvT0rcyBJ7QnGOs34UvoX7bK4Xu9re2fgU+dKvVAdnjZ9UCAwEAAaOB
+jTCBijAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUF
+BwMCMB0GA1UdDgQWBBR4Ut8IBrlcCqeanmb3/eip4J4dwjAfBgNVHSMEGDAWgBQd
+z+3MFEz93EC48t0r750mEC8/wzAZBgNVHREEEjAQgg4qLmV4YW1wbGUudGVzdDAN
+BgkqhkiG9w0BAQsFAAOCAQEAl8+2+jByETsTMJXBc0U4DHdUqEF+nffF5ckMu6zx
+DRMhC8IuXicQ9cd4dlonl2joaP0Y1oOvhZE3JBtVAKdKjDIuiuJCMhsJMvCFimX7
+pCaErMVtIYOrobG4mYo0rQv7Faq7X8xE8/m76yaGQedx6jaeQEDqI72M042UIa8R
+QrexAGIYcVBGSmOoKBXLbgTgY+kw1jweWM9ql9DqjKymdoO70SWpefJwc1k5FAR1
+Xi1eu2RNOAsGZniWsIWitPmInhOkAq3vaJ/clepL0+TUA6Kl1qIh7z2sVK64ms5E
+HKF69RdtrA1UH0gHlQkAueTW8LI2EUYBuZZ+gEMSVczdbQ==
+-----END CERTIFICATE-----
--- a/test/files/ssl/example.test/with_ca/rsa/wildcard/key.rsa.pem
+++ b/test/files/ssl/example.test/with_ca/rsa/wildcard/key.rsa.pem
@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEpAIBAAKCAQEAtADrg8KRohAu3M04vdFxTAVPbdxqdkl5CbgCLpQo8T8KgeUL
+Jzg+8uay116APqnvDM1ftan3CWsaGXSZbp8L1blRTvOJID19+qsCNTNbQwY+6yoU
+RGrhdRjq8wgn8OSg3E0NyxtFFwXt7fH+rrS8uGePBIPufDqzWrUDTww9rPcY4L56
+3FvzesJr5IhWEe/q3lJxlH8hxwg0LkEOdBGX0QP3qNpFy4QOtfn38pTIiJw4JjLq
+Vi+oR3HFv11Q+A5gu9SKJyBhaEeNrnq4XbeeFqBPP55gwji9k8h4ajYGS9PStzIE
+ntCcY6zfhS+hftsrhe72t7Z+BT50q9UB2eNn1QIDAQABAoIBAQCR2Bz6yO8OjGYr
+6OuMgOJ3YeYVcX2hEa7MPRcnfkweC6IL1PTQdjYqwNkuvxbRrwZNLSnbGzdZnjmr
+Xlni02LXbCuA+LmmMaydKWnEiTPsfmcESzfYp3C9W88h0v3ppJThal0+r32vRdKd
+9HESRMaT8vRiCDN23GjtmbRwm85tEPw6Tqm68ORO7pSacHi0Wz2xrufxkXbLij6o
+b0+hFHiSgJ6pUiFIJFL9e1+GiCNJwOcQZSH57Kd23fWu0WwSvzFoW+tudvb/OTN3
+EuX8RDeQuSGsSr+b+Ahu+BbG3qryfmD5rRM4jMm3C/i6jAfoXHVrzAky97i5MRzK
+mSE8T5eRAoGBAN4sT9xbYUpCkzzs/nEx6aXXMWy4pZmZ+8dyUv4WS3dFRcUbCjPK
+V5fl5xXxWOIAzHEmr9TXhPBzhY2+M9xkFbSjIr1NoCVeb2xzZwzSO1FK0hIdxvcT
+WTWZJp9kYWw/9U8JhfH63Xt8o/5N/MmKRHZkbB+aVSRVBRefwRy3tDzPAoGBAM9o
+9VveXFcHxED+L8NV6Pxv4Pe+Pc8UatmGCjgDWVr2kpcEI0oDxPMmUkQEoTFJce+H
+D5kEy9eInENb+fGsxkz89Qu5dUEyNJrMULgkPuY8wDUfUCwJguz54Kr1Gp1RsQZt
+GSQQz1hYiMtG80U88R+UUr2CiqixKQAxwAczuqIbAoGBAI1dXKM1cb4yhkUp9uxH
+egeP2V74TkZh+BZ749rQjMwjQ7Wa8u7pPLrmCheoLYoAQBVvLEodp/TnTH9YGt+M
+v1LkymHxVojwga1b8KHz0tJy7R+h2suzf/veqviYgnTCbXAQ+y1xFiRQtnhFXydN
+1yoN0854ANzRTCAwAkwnh4N5AoGAH1TPm60fbdYyg07ikDNuGpQb+9C1LY78BRgG
+eyemW+NbiYyKeCfRnJlxW+0HHJbnqzNP2+GpmUl9sX83Zpae7gpYSgkd+VdIMwoi
+N27iQY1zy5KLXduh94JXufuEpbctcrcQUS5o5AObxnlVTmRCWG7jgNUzdQAuHWVm
+iK/7xXkCgYB6WmBfvlOdUEXok8/H/UIeAYTjPhsBynuucgz/5RcyAiXZrWDCCOei
+SVqhEm7pZ01DlKhIKX1bCnbjwk7yGK382kkhkHMpSDh6JrkwfPMq6LOZvntP7HMA
+Lj++wxwaCldG7g2vKazWQ4xV08JbQ0SQWMDVofH6SAF27SpPjSeicQ==
+-----END RSA PRIVATE KEY-----
--- a/test/files/ssl/example.test/with_ca/rsa/wildcard/rsa.acme.json
+++ b/test/files/ssl/example.test/with_ca/rsa/wildcard/rsa.acme.json
@ -0,0 +1,29 @@
+{
+    "le": {
+      "Account": {
+        "Email": "acme@example.test",
+        "Registration": {
+          "body": {
+            "status": "valid",
+            "contact": [
+              "mailto:acme@example.test"
+            ]
+          },
+          "uri": "https://acme-v02.api.letsencrypt.org/acme/acct/0123456789"
+        },
+        "PrivateKey": "x",
+        "KeyType": "RSA2048"
+      },
+      "Certificates": [
+        {
+          "domain": {
+            "main": "Smallstep Leaf",
+            "sans": ["*.example.test"]
+          },
+          "certificate": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURUakNDQWphZ0F3SUJBZ0lSQU1qV1JqNG5IRE9VaGlvMVBjKzFPbTh3RFFZSktvWklodmNOQVFFTEJRQXcKSERFYU1CZ0dBMVVFQXhNUlUyMWhiR3h6ZEdWd0lGSnZiM1FnUTBFd0hoY05NakV3TVRBeE1EQXdNREF3V2hjTgpNekV3TVRBeE1EQXdNREF3V2pBWk1SY3dGUVlEVlFRREV3NVRiV0ZzYkhOMFpYQWdUR1ZoWmpDQ0FTSXdEUVlKCktvWklodmNOQVFFQkJRQURnZ0VQQURDQ0FRb0NnZ0VCQUxRQTY0UENrYUlRTHR6Tk9MM1JjVXdGVDIzY2FuWkoKZVFtNEFpNlVLUEUvQ29IbEN5YzRQdkxtc3RkZWdENnA3d3pOWDdXcDl3bHJHaGwwbVc2ZkM5VzVVVTd6aVNBOQpmZnFyQWpVelcwTUdQdXNxRkVScTRYVVk2dk1JSi9Ea29OeE5EY3NiUlJjRjdlM3gvcTYwdkxobmp3U0Q3bnc2CnMxcTFBMDhNUGF6M0dPQytldHhiODNyQ2ErU0lWaEh2NnQ1U2NaUi9JY2NJTkM1QkRuUVJsOUVEOTZqYVJjdUUKRHJYNTkvS1V5SWljT0NZeTZsWXZxRWR4eGI5ZFVQZ09ZTHZVaWljZ1lXaEhqYTU2dUYyM25oYWdUeitlWU1JNAp2WlBJZUdvMkJrdlQwcmN5Qko3UW5HT3MzNFV2b1g3Yks0WHU5cmUyZmdVK2RLdlZBZG5qWjlVQ0F3RUFBYU9CCmpUQ0JpakFPQmdOVkhROEJBZjhFQkFNQ0JhQXdIUVlEVlIwbEJCWXdGQVlJS3dZQkJRVUhBd0VHQ0NzR0FRVUYKQndNQ01CMEdBMVVkRGdRV0JCUjRVdDhJQnJsY0NxZWFubWIzL2VpcDRKNGR3akFmQmdOVkhTTUVHREFXZ0JRZAp6KzNNRkV6OTNFQzQ4dDByNzUwbUVDOC93ekFaQmdOVkhSRUVFakFRZ2c0cUxtVjRZVzF3YkdVdWRHVnpkREFOCkJna3Foa2lHOXcwQkFRc0ZBQU9DQVFFQWw4KzIrakJ5RVRzVE1KWEJjMFU0REhkVXFFRituZmZGNWNrTXU2engKRFJNaEM4SXVYaWNROWNkNGRsb25sMmpvYVAwWTFvT3ZoWkUzSkJ0VkFLZEtqREl1aXVKQ01oc0pNdkNGaW1YNwpwQ2FFck1WdElZT3JvYkc0bVlvMHJRdjdGYXE3WDh4RTgvbTc2eWFHUWVkeDZqYWVRRURxSTcyTTA0MlVJYThSClFyZXhBR0lZY1ZCR1NtT29LQlhMYmdUZ1kra3cxandlV005cWw5RHFqS3ltZG9PNzBTV3BlZkp3YzFrNUZBUjEKWGkxZXUyUk5PQXNHWm5pV3NJV2l0UG1JbmhPa0FxM3ZhSi9jbGVwTDArVFVBNktsMXFJaDd6MnNWSzY0bXM1RQpIS0Y2OVJkdHJBMVVIMGdIbFFrQXVlVFc4TEkyRVVZQnVaWitnRU1TVmN6ZGJRPT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=",
+          "key": "LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcEFJQkFBS0NBUUVBdEFEcmc4S1JvaEF1M00wNHZkRnhUQVZQYmR4cWRrbDVDYmdDTHBRbzhUOEtnZVVMCkp6Zys4dWF5MTE2QVBxbnZETTFmdGFuM0NXc2FHWFNaYnA4TDFibFJUdk9KSUQxOStxc0NOVE5iUXdZKzZ5b1UKUkdyaGRSanE4d2duOE9TZzNFME55eHRGRndYdDdmSCtyclM4dUdlUEJJUHVmRHF6V3JVRFR3dzlyUGNZNEw1NgozRnZ6ZXNKcjVJaFdFZS9xM2xKeGxIOGh4d2cwTGtFT2RCR1gwUVAzcU5wRnk0UU90Zm4zOHBUSWlKdzRKakxxClZpK29SM0hGdjExUStBNWd1OVNLSnlCaGFFZU5ybnE0WGJlZUZxQlBQNTVnd2ppOWs4aDRhallHUzlQU3R6SUUKbnRDY1k2emZoUytoZnRzcmhlNzJ0N1orQlQ1MHE5VUIyZU5uMVFJREFRQUJBb0lCQVFDUjJCejZ5TzhPakdZcgo2T3VNZ09KM1llWVZjWDJoRWE3TVBSY25ma3dlQzZJTDFQVFFkallxd05rdXZ4YlJyd1pOTFNuYkd6ZFpuam1yClhsbmkwMkxYYkN1QStMbW1NYXlkS1duRWlUUHNmbWNFU3pmWXAzQzlXODhoMHYzcHBKVGhhbDArcjMydlJkS2QKOUhFU1JNYVQ4dlJpQ0ROMjNHanRtYlJ3bTg1dEVQdzZUcW02OE9STzdwU2FjSGkwV3oyeHJ1ZnhrWGJMaWo2bwpiMCtoRkhpU2dKNnBVaUZJSkZMOWUxK0dpQ05Kd09jUVpTSDU3S2QyM2ZXdTBXd1N2ekZvVyt0dWR2Yi9PVE4zCkV1WDhSRGVRdVNHc1NyK2IrQWh1K0JiRzNxcnlmbUQ1clJNNGpNbTNDL2k2akFmb1hIVnJ6QWt5OTdpNU1SeksKbVNFOFQ1ZVJBb0dCQU40c1Q5eGJZVXBDa3p6cy9uRXg2YVhYTVd5NHBabVorOGR5VXY0V1MzZEZSY1ViQ2pQSwpWNWZsNXhYeFdPSUF6SEVtcjlUWGhQQnpoWTIrTTl4a0ZiU2pJcjFOb0NWZWIyeHpad3pTTzFGSzBoSWR4dmNUCldUV1pKcDlrWVd3LzlVOEpoZkg2M1h0OG8vNU4vTW1LUkhaa2JCK2FWU1JWQlJlZndSeTN0RHpQQW9HQkFNOW8KOVZ2ZVhGY0h4RUQrTDhOVjZQeHY0UGUrUGM4VWF0bUdDamdEV1ZyMmtwY0VJMG9EeFBNbVVrUUVvVEZKY2UrSApENWtFeTllSW5FTmIrZkdzeGt6ODlRdTVkVUV5TkpyTVVMZ2tQdVk4d0RVZlVDd0pndXo1NEtyMUdwMVJzUVp0CkdTUVF6MWhZaU10RzgwVTg4UitVVXIyQ2lxaXhLUUF4d0FjenVxSWJBb0dCQUkxZFhLTTFjYjR5aGtVcDl1eEgKZWdlUDJWNzRUa1poK0JaNzQ5clFqTXdqUTdXYTh1N3BQTHJtQ2hlb0xZb0FRQlZ2TEVvZHAvVG5USDlZR3QrTQp2MUxreW1IeFZvandnYTFiOEtIejB0Snk3UitoMnN1emYvdmVxdmlZZ25UQ2JYQVEreTF4RmlSUXRuaEZYeWROCjF5b04wODU0QU56UlRDQXdBa3duaDRONUFvR0FIMVRQbTYwZmJkWXlnMDdpa0ROdUdwUWIrOUMxTFk3OEJSZ0cKZXllbVcrTmJpWXlLZUNmUm5KbHhXKzBISEpibnF6TlAyK0dwbVVsOXNYODNacGFlN2dwWVNna2QrVmRJTXdvaQpOMjdpUVkxenk1S0xYZHVoOTRKWHVmdUVwYmN0Y3JjUVVTNW81QU9ieG5sVlRtUkNXRzdqZ05VemRRQXVIV1ZtCmlLLzd4WGtDZ1lCNldtQmZ2bE9kVUVYb2s4L0gvVUllQVlUalBoc0J5bnV1Y2d6LzVSY3lBaVhacldEQ0NPZWkKU1ZxaEVtN3BaMDFEbEtoSUtYMWJDbmJqd2s3eUdLMzgya2toa0hNcFNEaDZKcmt3ZlBNcTZMT1p2bnRQN0hNQQpMaisrd3h3YUNsZEc3ZzJ2S2F6V1E0eFYwOEpiUTBTUVdNRFZvZkg2U0FGMjdTcFBqU2VpY1E9PQotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQo=",
+          "Store": "default"
+        }
+      ]
+    }
+  }