crypto/x509 MTC: Strictly parse extensions in MTC verification Add the missing check that the MTCProof's extensions field is a well-formed list of MTCLogEntryExtension structures in strictly ascending order by type, as required by section 5.2.1. Previously the field was hashed wholesale as opaque bytes without being parsed. No extension types are defined, so well-formed extensions are otherwise still ignored. Bug: 571178555 Change-Id: Ib25e7318ad9c27a4af5c972f34f93f3f6a6a6964 Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/104509 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: Lily Chen <chlily@google.com>

diff --git a/crypto/x509/test/mtc/README.txt b/crypto/x509/test/mtc/README.txt
index 860a2ae..c5b1b18 100644
--- a/crypto/x509/test/mtc/README.txt
+++ b/crypto/x509/test/mtc/README.txt

@@ -3,7 +3,7 @@
 
 Test certificates were generated by running the demo tool
 github.com/ietf-plants-wg/merkle-tree-certs/demo at revision
-7f5561c8f105f40fcb32a420825778eb2964759b.
+cc8797a94f4933e660f6ce369f3bfa5c6573db01.
 
 The main corpus in this directory was generated using the demo tool with the
 config at ./mtc_testdata_config.json. (The demo tool also generates unneeded

diff --git a/crypto/x509/test/mtc/cert_34_0.pem b/crypto/x509/test/mtc/cert_34_0.pem
new file mode 100644
index 0000000..ca557bb
--- /dev/null
+++ b/crypto/x509/test/mtc/cert_34_0.pem

@@ -0,0 +1,66 @@
+-----BEGIN CERTIFICATE PROPERTIES-----
+AB0AAAAEgf1ZAQABABEADw6B/VmB/VkBAQICAIAAgA==
+-----END CERTIFICATE PROPERTIES-----
+-----BEGIN CERTIFICATE-----
+MIILPTCB8qADAgECAgcBAAAAAAAiMAoGCCsGAQUFBwZDMBQxEjAQBggrBgEFBQcZ
+Aw0Egf1ZATAeFw0yMDAxMDEwMDAwMDBaFw0zMDEyMzEyMzU5NTlaMAAwWTATBgcq
+hkjOPQIBBggqhkjOPQMBBwNCAATLGILXqW2z5I4vzs7AeEYPMr393JR3uwzzSMB/
+ndUv4BXfwegcqmYDssmhgt/jJWFxWV41zG5+wB9w+55MtfRWo0MwQTAOBgNVHQ8B
+Af8EBAMCB4AwFgYDVR0lAQH/BAwwCgYIKwYBBQUHAwEwFwYDVR0RAQH/BA0wC4IJ
+YS5leGFtcGxlMAoGCCsGAQUFBwZDA4IKOAAACQABAAAAAgAB/wAAAAAAIAAAAAAA
+QACgTiyogePHZRdytx8RECBPcF5Lzntfmo5JCK0/DBpGgAVpDustPCPAu5hfoosm
+kRGWgFARFVJaAVTFw6JIjC80+PC6VvVAD8XvMlN/227dhecvAaWesX1VALMsfEPP
++4sMdPlwvQ7e6t+1KZHAiXWTzvxiP0MOE/3evonuHiaRUBUKanvW5AhqPJIWfqPX
+4f7iuxrwEhcd/pU9/wna8x1NzwAJewSB/VkBCXTJ+xJqTyA1lHIwTz+W6IsGV+J7
+pNhEyyb606wS4p/J5zOYEP1w/yX+S+1U4uUcdp7oTpA87l/jR5M2ngD6hwQ4HFDa
+/XqoDTxKrOwUCpMWrfHEu/uJU+xw5zOLZG969bx07TToyPcwA8dZ5+bygOGGRhv0
+NCn4UiWkP/TSnYkcUhxVbUMcoEpu5O922z3Fd3H15MvrEpUbfCfe8F3zKJg6ppDv
+fkkBqvFK03F1cXShEc+6lj4x4nvaofrnIuOLFnQa55ptAQfPLCTm3uifxNCUNQ6f
+efbeDT64Tb5xkn/u0X2oV42z1CGlzQd2/DFKUzc0unLFQssj3hejWgU69aT5wDux
+zv1YRzel0dS5cpDihjzb5HWvnzqUOUZvFO5leTF4GQZPsQ7tjS3w/N36L4BDXhUl
+AGqOeqQZ07oIJ+MkMlapdSRn3cqg8iwVI7PSqQQ/ZpZfMnxsaYzCm4qGDok9Ps1D
+zSTUFeAc4ghFS0wVVW8StDJAFOvewi+I0h3ohcTop7xSoWZu7g1rc6oEjZZ7ROMo
+B3WsCBtrkdF7YbUiVO4Ewut38LP1t3lFifmVEPHCpOGUA7Yh1xQ+PmIuMz1UMZI/
+ckMdE4sq8fUi0BH+kKGx+L1NyLaIm7ifJmJHHZXsGMjz7YLPNZIh0K7oo9vbdenW
+6X6quTcdBxeZLDz/+P5rbQOppcJGZ+OFo7TKC9E62caq9TVlJ9omR8Bg4aVU9dL/
+8aTVgX/pfKudNWmkonv/OetB/EhSR/w1bfhwt6obU7O4q5r4jz3vNcm/BB2pnvep
+Nsd9gcU4lAjq4f9VT+BePi7Zhx+KRCFCeQZ9dpFMf8+dFxW2RqwYCgMqv6a+VGNN
+YwXQekOWaRqaVfo8ehYuEjygqNfF7yncOpHlXCLYcboz03VAZX6pXOvKfPa8jFD0
+iXPbJkBqQmQHNSuFxQa/9BxSondE8zFLL1pct6LJKJoBFYWYoPWOwhjxyn2DfCPN
+XeHExNTvs0BdKnxH3t9F7AZo48BIadkRUN/MsD9QqnBsMKeSX8mQgZART2TqjXfk
+kKAVkX3dIljhNY4aTGIhmwrc8IkfbBLv8ZHh3TGA9T2UhnFxPlguR3gCB8ASg68L
+w+MC5xzCBPHOSytunDDPWitosYcRqUba3s1wV+PvBTi1VD3lDIviMg5gPqDJZ9D4
+tMxJZHm1SBVFMl7M5c3nOcRd9+ercukMwfEhZs4A8jQs9hKpGbtt/1S/um1R4TsT
+3o5aT32dF5l5uCXbQwhTeozx3M7sdDwjU674PAFCs/6qyiC4xaTen98RXnEVQ53j
+XN2YpO0bEobtvFg8/pIyXFAi7OKUzD2WaTtCbljPVrnuzbj4jC0l5kBs3JmLb/mn
+84y1LNvanoW32xqfxMLH96Zy69osvvjKesryRO2o4yYDj0o7vy2neFCsdNdVf0ae
+icPWuqAfDFAReSEzzr+C9sL8Ym2r+ha/PxeklkJ7IXbwoqxE50AkjJqop4SbzRah
+PvFWi5lBavf430u1PZiFazcJewQFEPM+QsVbuknJ+I5XIHrYY14zTFHV40uaSnC0
+aBLdEIk1++GDNR9Ap2ppkjR743WEGz5KKsSFrFvi7z9ACiKWKRZqKMwkPPtyLd3A
+eAzPPqzIloda/+tPtY6xUaBQfjzSOzAQdyLQ3kyWApbMGBZgSFVhWzOIKhvy6yoO
+68/d//LKpKLF/5aieYVR2YexXEWixHaGpwxACIl1o+/ow5gnqFtHAl1vaWzMg15S
+m+HGh9/nZs+lWd2oT+Hq+ZpvcwiKM20VbWegIz0bJxqfsuomo8w1HYwKenqbDLfD
+wcY5z4OAEmLRkEOKXilmD/lnZt1phcrBtyaOMcT9Z+Dm13cKR+4QTyzre3JTuAjQ
+GPfZMCYRt02hcr+ENdoAx6Ty7tPGvuLdlaSavm3bEZrgZKwx8Fq/h7PAahyE81O1
+36nGUe8lh+uVYj/p7M8icdUW5wBW1OGrwllbY9XyjcfYQRA8LhwRyOv4DMzWPnYP
+n9cmdJ3mHrZYx+xQ6BHZYR/opykBW6JrM2BQPSH8xUC+ol7lCSnjxmhIUsMw6Blb
+C5EPKxgTXiAQALEnGUKPqKrz0q8M9DHF4c+pNFe2oGrjZFiTD8v1mqpbDrpirHQq
+TLF7oSKPaN3/aOWf44+iB7jfiRMyADraQvbyGGUX3aMesyW4BTq1M7/BeGoeFtKG
+O53V1y9CDde2asDjrvZOopr/a94J0Snu3vGwvj59S7nWJ+TtzcVwCi0SRcb2hhVA
+gtJe1CeMwPce3AyIfNvInKam5NbMdxr4ZVtnpdFW9lN93esnP/MLcQ7UAsvht7Me
+B8PnzVSpgd77dNFsuFBin4rrWnfPaitUNh7ZsViJx3MpPDzL3i9S5YWzB5g0Rin6
+tQ+G2q65YLMJFP+CT293PrR2aIfT11t2J5ods5aNpyEeo4X9BEVQ7A+GkJVoMnJs
+yRDpQU6lJi1XlmaXVKRNfikeVWLUZDlXH93UbZmhYpGCoGH7EJMbe/nU1rcIMzzK
+jVHpdYrFL+Dx1/3G7i9JCdwljeo7fsTE5N/F2kcHKMmz2wu1Ah6ugRO4ndlP6guf
+8I++UrBmO1yY63iIjzeOC6im08wb9CcgH7/QfQmeqwHJYkVjtfCYBdzvCg7hzvcQ
+oTXbwi8rJkm1JzTkRCIx0X+FmL9GGXpfyhtMmTmzTP21Pcyt1D2eC7nwzTY5Y3G9
+FxfDB7b4/jvXZDp9tZKcGM9v2IGl2MUYaA6gy/Jat7DrgDbGVCQWq7AOgaF4ZS0+
+dTCAFqJBqG1KgXljyMMutTQgR01H9h+HI7pwVXNuYY+3KOI0E5J6q71RzvyeWzw3
+WIBJjPpB3jo0v+9hwtGWJGR6k2nyfjIL6uurpKOkajcXWyraRly+D+eORFwIocbi
+9jaLjc9liP8hZWZSAM0cZ4HSnNjrlFvBcG46oahDx+7thEwxKSOGvkcVmMyEHbZs
+ZUrVquvdUu4jrryn1CNfsZzcVt501ztyYiRDfsLlHdnwTUqzRPUo7pXPx78N6/AK
+VtvzIDOMCvDwstd0BkXE8V4Men7vjVCl2c5YJvKYA1CZ88G3xU9dbBzPqmGF6Wa7
+Y+5j2APQNcy0qcBiegAUHzJUYGVpdo2Xxdj2/AYeIysuQktZgJOXnKvF1eXs7vsJ
+ICEmMUBVVmZziZiisbO9wcfM6/X6FjdBRFpjanaSnKO04OjxAAAAAAAAAAAADyI4
+Rw==
+-----END CERTIFICATE-----

diff --git a/crypto/x509/test/mtc/cert_35_0.pem b/crypto/x509/test/mtc/cert_35_0.pem
new file mode 100644
index 0000000..8077e25
--- /dev/null
+++ b/crypto/x509/test/mtc/cert_35_0.pem

@@ -0,0 +1,65 @@
+-----BEGIN CERTIFICATE PROPERTIES-----
+AB0AAAAEgf1ZAQABABEADw6B/VmB/VkBAQICAIAAgA==
+-----END CERTIFICATE PROPERTIES-----
+-----BEGIN CERTIFICATE-----
+MIILOTCB8qADAgECAgcBAAAAAAAjMAoGCCsGAQUFBwZDMBQxEjAQBggrBgEFBQcZ
+Aw0Egf1ZATAeFw0yMDAxMDEwMDAwMDBaFw0zMDEyMzEyMzU5NTlaMAAwWTATBgcq
+hkjOPQIBBggqhkjOPQMBBwNCAATLGILXqW2z5I4vzs7AeEYPMr393JR3uwzzSMB/
+ndUv4BXfwegcqmYDssmhgt/jJWFxWV41zG5+wB9w+55MtfRWo0MwQTAOBgNVHQ8B
+Af8EBAMCB4AwFgYDVR0lAQH/BAwwCgYIKwYBBQUHAwEwFwYDVR0RAQH/BA0wC4IJ
+YS5leGFtcGxlMAoGCCsGAQUFBwZDA4IKNAAABQABAAX/AAAAAAAgAAAAAABAAKCl
+Hgd6zdFmsmuBjnVPJ9nqfl+dC0cC9tH1uGt3UUsXmmkO6y08I8C7mF+iiyaREZaA
+UBEVUloBVMXDokiMLzT48LpW9UAPxe8yU3/bbt2F5y8BpZ6xfVUAsyx8Q8/7iwx0
++XC9Dt7q37UpkcCJdZPO/GI/Qw4T/d6+ie4eJpFQFQpqe9bkCGo8khZ+o9fh/uK7
+GvASFx3+lT3/CdrzHU3PAAl7BIH9WQEJdDK0wtGh6f3Rhip8oaZjtn2zEcbt8nbd
+UjQ9JlyqY2ZA2E244Iex3EF3GTRbJ/do4z59C4itUbT8dD7o6IFyehGJBIVBZzGe
+Q6xUGg0uVOcO3US79DIkX6bhJ1pcMoDwe6iCds8NXo3cLAKHckfKThQaBDwAGA/T
+VTnlhzhZzl2Nc1kLidbZ9t/FOEmD+hRycuk6isNf/TNziZdPLOlTo1cTvrOtdige
+MhY4T2B/0uK/xExUgAv2+LIh+OCc0eW0jpRZk+Bj2Ls+d+hdrftYod9l+c/P6yby
+QYXGjRLehfTQpZ2JzwfCHfCCBZ6dQWUmNY2kZcpjCNl1B4w26mM8EhSvzZAu0ies
+O8CDru36PjjWw8WEcbLIx4HQUbN1YuuWSJk1/bV3+iiDpy0oC0grv2Rnxheo7F+P
+w4uxQGVQJ6nZDYs+fajUYqJWVOorc7lPKzlmLYt7QZyOf1eU6dRI+wVF/LJEAT16
+8Cg07AQQkOWyZ9/OgD73I28wthK4XibJXzBFiAUljFbfgfJvdp3l0O6tfutQhwWZ
+8xuBGasbxzRXorJy+pBQdCjori39qV7CFiyuO6g7P9MQjm9pg7vzdKiUrHQ5oU+V
+D7xHnJImJdIWFKOGr1kEb542T/pJzQoJWU1r0QnEA3J6yhNBNBjOCcWK/BxYuCSN
+pDj7uXRLdBkUySvhpIyyYRRfGVG/AIeZ9vsE0H0xjQh/yFgWO3igOnwFfoFfBe8Q
+oVyZR4yi/9c3NsaS3bZxCmRN0ryJ8swWl+RZaux205e0Ot8EaQvrne6JfaVeOaPM
+3+x8bzNxu8B1wqA2m/ji9SxPvKFqAj0StuLKAtobUp8jHqzFFVEnPo2NYjGb2XA+
+sgxJj+jrkcJ1Lv5pd5wVDmS3koKjq9xTLvJCOhErFeV7Lz0Pcm8NHJKkpVNFdW7e
+vpBEmlZ0lYbFxmBDRSb3McPaI7ed9l2W9WGLYEO/V2MoytzZ+Qxhift/UG5dl33j
+q0FhpFCx+z+l5MNtX18U0Cj9o5nMhzD4ogC5A2DAqndoXgMWL9nKFKu8JrGVcRCK
+OJe8wPxf6hSWamsEeh69Lce5n6xmbA43x7e0uC7v5C6CLmrloZRSMwCh6nY1xti7
+zJhKFGBfhGg/79aAoHMOebDvbJScYoYJWu1bAfN2cKtgCT6aRQ0MIGpTIHzKn7po
+2hvldmbW92c1M4EVtOnTt7SBe+BYKqb2T6g7B587NAOUwqpxnxa0IOmUVHz60Wnz
+cy8SkJ8w/r/vpUpqsy4+c/7mc7Xxx3acUoSa8vDQhVXsvQsGQp6Qw+UwoZMNWBhK
+fgW/bXeP2BJcnJu7e7lEZ+6F6BPIBYH7X2n3cq0JqVAJ3lTeelDKvJh2Kf8JK5Dt
+B9pQ4AookuBS21ZUfqLUqud4j2juCTWPSzjopIRPl1/Bp7k/F27CKhZSdhWplocE
+6AZvGsc3ZmPX9f/609zjqyQ2sH2/fhodWHALKMa5mNE+58zTCQ1yBOcAbLGXMQPt
+Kk3t/FuG1K3MEeCos8E5ipC84VfyzeCnwj3vfGZNgQKEzApGGfIcalPklARelX4I
+65wwlXcAqnKz6K7ebMeImCWGUJQ5haLYenfUsnKsDkWbBFjYEMKcblrz2uaVVZRV
+2NhTLL9/GroqOCoxQq6+PIv7n6NVvYhiHhUfrDDVaIgBMS2+o/oHbY+yPXhizfR7
+kBFrL5TVh9N+ssEZQfMEEXTze+HcxAu0V+U33Ysk3AzsIeoH3CPdu451OniILpTs
+2uUbuQDJtKqYB4207zy59Qs8EQ5vQjruGKmSaRSI6u/us0/UGhAMqC0rNUbfhHzu
+kNdi/k+UbXtcpQTh+bBYhRT+4y7t5TwpZET7lQlJB51CdENu69V/P/yfzoSdl3c0
+UghnQfFtt98GwrUuXtKDcbLjhSNEokZp9oTQhc+XUHe1CRD5yN3fHdnvcWvnWdea
+KTSoRaog75nES548ejl4oUQ7x8n2p5jOCXz13tyyaRhV99iSMdY2WtDgfTR9kQt0
+HNXJ6jmYOqXYiJPCHIZ9sNRUKuHWHULZBALHYObePcWnZti7oBEXENdfy/Z5Liys
+vjoih2eYHw0NcJO0gD3SW+xKUuuah2wQccZqxfy5Z918QfTKOC147gXICdd3gbe8
++BSlMDeep56R9hinATPAa/oGBw8bxtyFWC5qr1ij2LZC/zDuBfeNR94E6IXFLezG
+DBM807DcXqbhfiDuFLD0VGBWGqM89cMA2FHU6tfWgh+BD+SKGOej6+Z3gta+FKbc
+8GuOAGDxqJN/XWQiReTRWyVeR0Tp3re+Y6gDM6V7sUsCAxqlcnPGRqpbvox0bKYI
+zNvG/iL8mTzttVf4lfm13+uR+flfU8wKbxNPQM+H1ZjmSLQ0uLgTzifd0YwrmmzM
+SdNx/Uo9IU2MTixtpwwSMGz2Ke1PKSU4qmABa+BcaQvwlDDmMJrMXWU8X/4RJdj3
+4EX9Tv0KYKHRqpLAauJYovuwozyM/4BrAahklD0/crYqTyMRvOjfTNygQSacL3U7
+6zGWrvHWOFejW29kPlRk4UjVdltTRJGk3F+/K+y0BG3HfXBqWkg2uSa7NSqJ7Pcp
+Hn5BT7V1oA+qkYhVOAqBBLUBoHHQw2LQV4De2gLmumFV7fe3XFllhBWlYK9piMWe
+oElSBNCeXth5L7u4oSzekIbP2utNUkICPdWQjNZE9HAZdbipHv1a04/MlB11fFyG
+jT12ygWq9mWbcuLrRLTbstnIryT23yZsGF49iCPut5uThCE+DUuM3vLW+T1r0rnI
+fiEJxKZ0+a8ZXP6US8J2TdBQ9VgqU0MfAkCV5nfgLE0sTCR8wTA8o9b7ZgYitgFw
+Bz57VFlAp5IZuczHh8Dy5Txq0LoaxusZCXSK06zB6GAW+Q65wnwZmrfd1Qvb8kC/
+xlwxwCxj69Z2m1M4Px1MKxDnNNXUFFELfIdrZSorgGSSQcGWtloZ8LgN+votX6Xw
+Q3d7z2u20qTBxDjSH/4jAwUqtI6+NrYPG60IGrYKLxJ5VaTwMjnBmqU2McNhxRGn
+d7tpXyy6LiviuWdcY2XrBS68jCzmXo8c6NXe0FHUPxNBzW1+fakYGnW0E22P1GxY
+gCzeSUKLKmVhISYwY4CGiqKlxNYIHz5RU1VXgIe4wdfg9fj+BBcnQVt0fYCVqK2x
+2N7m7fX/Ay82SV9wdIyWwdH2AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALGy05
+-----END CERTIFICATE-----

diff --git a/crypto/x509/test/mtc/cert_36_0.pem b/crypto/x509/test/mtc/cert_36_0.pem
new file mode 100644
index 0000000..6dcf9e3
--- /dev/null
+++ b/crypto/x509/test/mtc/cert_36_0.pem

@@ -0,0 +1,65 @@
+-----BEGIN CERTIFICATE PROPERTIES-----
+AB0AAAAEgf1ZAQABABEADw6B/VmB/VkBAQICAIAAgA==
+-----END CERTIFICATE PROPERTIES-----
+-----BEGIN CERTIFICATE-----
+MIILPDCB8qADAgECAgcBAAAAAAAkMAoGCCsGAQUFBwZDMBQxEjAQBggrBgEFBQcZ
+Aw0Egf1ZATAeFw0yMDAxMDEwMDAwMDBaFw0zMDEyMzEyMzU5NTlaMAAwWTATBgcq
+hkjOPQIBBggqhkjOPQMBBwNCAATLGILXqW2z5I4vzs7AeEYPMr393JR3uwzzSMB/
+ndUv4BXfwegcqmYDssmhgt/jJWFxWV41zG5+wB9w+55MtfRWo0MwQTAOBgNVHQ8B
+Af8EBAMCB4AwFgYDVR0lAQH/BAwwCgYIKwYBBQUHAwEwFwYDVR0RAQH/BA0wC4IJ
+YS5leGFtcGxlMAoGCCsGAQUFBwZDA4IKNwAACAABAAAAAQAAAAAAAAAgAAAAAABA
+AKA4ZPZG864N1G24QrBT6HVk6+58Q+R2y44cyNXn7iNlAzfjuh9FI7fwBAhYqNdu
+XggktXdVAJUoWB8uH40sbHt9i0KI7f+SgI9loBAH9lNF4H3iOGiZYv/sBDQQPh/4
+jSF0+XC9Dt7q37UpkcCJdZPO/GI/Qw4T/d6+ie4eJpFQFQpqe9bkCGo8khZ+o9fh
+/uK7GvASFx3+lT3/CdrzHU3PAAl7BIH9WQEJdNwhwzDBbPsRra3pGoczwh0SkLLQ
+bls4uyDT+LyuSQXP9ikBAzQzxTO7wHOkS36GmOXj634kmii22AaB5i4FjTiqVMgg
+XfWRY/CCTD+jzCxrPyiOv6EuL/HJ0S6E4DUpoBqbutRyRIrtGUdlwN5/s4J9zQrL
+VUqmUWIsEGhr/QmTNP6C3KRd48PcY723j2FI1II5a9w5qJS+JFJYwt/mvXwyb4Lu
+RhBLy4kzuaeXVd6ufPIGeG2pxnj3MMAq/gk0JNua/weWaf+VwI8tEpmg2WmuHUHM
+rBoyYFyVjNTIpXwqFs2HmHIKgDfiKFfcavaAxCD+E5fNzwveWF9v+JimZnt49GZL
+Net1jP1JJ5GaBi53Ff7b1ijI9/720l/7ZYpGv1Oi3HEg2hMd11g3gBWxd00PkWDR
+lkfKLMV3hSCGJyV2aOS+1qkFmYJQM/f9KimtHvOI7L7Pn/7OEX9NzoIad/TbSjiQ
+tlP7pcpJ3BtBDfXVFAicWzEFdlXW/EnCMbfgsrg7jO6AQyZPBiaO2yGhNe9pd5hO
+Qxt2C0nGsQT1ZY2rOn1qV4X/1nLyrogHIJWVXySyNWoskw+x/rTpyMSzZqpho8Yx
+0dmKQqnR1s60xHKXQqAmov+MOITX0i5nAXdA+u7i/u8up1V04wkYq2YlVquOVOZ1
+bB/AMrKHItoZaE3PYMBKuDDurjggMjYcfTg4GVOo/CuC+k621NhtZ2KvaCHAIrpc
+092hHqdeAtt+cNl1sSvjp6QM3h60YvuVbf+O0Wxrf2tscVtRK7fPw87Gt81N6rQg
+WO9uyKokDyC4WjzlVQYhT4k5arPILSOe18zZtZmAvJs1718tihH+KDOujK4NJQOp
+kHt+bBcZ5hMZ0QTFzSgFpoeQAzZr4Dchg4EYJ//b4VRAl6c5E98w7+uuhyltt+nk
+bunlenbALulbh/Q46sCozj56RPTPwXhYZyODh2a5wm+QvhN3L2ow9mbtPoMdeO6h
+AygnVvYU39BgNpfhpeaiJdZAqs6lLtS3SBkHpV28UtbN/WWF1kn4bOgz5OVg0GDH
+LYzzfhi+aF/n+kiANDmMmpPVGQj+gzUcFQJjU9mu+L6yxg5chyuWJ/McOQJxTOJx
+nkoO+LansOxtnwBWzEVCCElPs8uAb/hNyijJYFVTHr7KfHGV66V5jCsVz/FV6Otb
+b67WvMz2OtASbGQdYot7hfnU6DOUvLkscQa7c6wgScqtfB9mZ3acMwjUP6LuZ7Lu
++hP0tCF+zD+p/jmrBbw7d1b+woKPXbxcRPkrbpjTMBwSGydwGPLVvARAd1aNt298
+nCIgKDSoT2QQn3Fhdz92Xo3tlT++qyxWPMyR6TEa7y2mtsW8thxtM2L/nxPEZ82J
+NYWSDzoZdCSE9bS215rb/gd7Bc3hwO38pVaWyA9BA8F88wn9Z7in1kYwbjAw3t/w
+fGHCadwQCnCL5aranUZx2IOhwajwIoxHFZ+swYhBaXBQUygWxkK1ye4DXmh3VbuX
+3bkYIEDewYs24ofrVZKo+oSg6+X0E0Uzu47hWb7RFP3Jtx8Z6atKuJG4042WMO8I
+/NyS+GmMWuLeToD0F0K20g8V60lz13QLCbOxD2LbhEfwlaqBImxLPQY4cwJTl7Of
+d7vL2Tq+4aqy0TMBKTfm/7+2lMJqxaZ4FIzB5Z5lwm35vN4YdDVRRHcq9u3RrOOs
+ZIDOJhXv64pEK/B+qT7TMVtXBq1BsK7X0KX9BmNlyB5qcQ0diOSxH+BPPmhCX2/0
+ATSgo/fgdWr72Ll2/3JYbp683wlizsztesP7swayhUGG8if2zwNYJeqkokJifUP4
+IiE1scySKhYuQ42J795m9Hfron0ABSnm1LE+UNFrNcf+NKS0YW4txJyTK0HOydP8
+YwfNX+gv3JwoDJm0uPM9B8v0LYyq91hWHV+SbenA1zqiT5QcEjcZgXi5B7nJ95G9
+zodE1HHFPDfontz02yOhHBCZBvB22KQjVVoLzwXkFKiczlPokW7/92cDsNwDtbsp
+m7jhVKeyA5pYiCIhQVTx5iJLR5y41fnXoMWSOUoKPXxsMSk+rGy/7fF3/9/l3XPh
+vKburfPmpnvCCxakqXVbMUNcQTTfxkW30dWKZpsR2gf8ge62FxzUR+PneKssz1RL
+nsQw1ZwzCa9AEHgKxUft6JBtMS30FGbQmuZYYqNmbQYIbz1H6zuz9F6y8kTDr6wK
+kDpWe5ekWcKO7d1FjsSXRVQ04CKPA4Mk9NkmumwMYuoLEF6wI7hhl5BhSMmNudTO
+pa+fxUSlEhgAGlE7/9ZmzmiQJaXC6FduI0rfMtuQmzGYIO7kR7MhU8epZYyMnEXZ
+Ijq/aNx4EN26YaZnkoSdbhNoc7kCo7ewBrfWd5iiAKxLz5e6Az2otn1sowg/XDb5
+Jhg3CO8LMZjEQNXLjNIJphp78gvWxyKMlQ//xREyt6rdFW3l3PJjNIHD7uuXp8RP
+D4iJSLaT29CkvOul2a39NJLMyJdClC4jUPCp9QH6bB0LpfXHmXtr1/f7fpbu769q
+WAVc105zq2qQvr6InCGjDxqrLa4HOjRBeErk+keq2gCXptsAhp+YmAN6k7kr71Ml
+3vajAHpn73pVBUdK9TXVXq2rU5ximEMM0gTz8Uw5BmXwRfTOPGg/2GWenmeXUGqM
+Pw1OrpGjNGHzZVeI4tpAITGEhmZxGrV4Y3+MA81994R9wHBTfElk0e4tZMMEU+Kw
+R/oV08ar6GzYJmjXHpTNP7ufw6wPiHozdY5MdS20iphQgcOVcM3ChyV2vVpdC//r
+fXcthKCBqTIY64cC8hTWiTlcvPqcZ2SHgsEkf7Q+E9NjPXuiRlgBo+spl9Lad5Cw
+V7MEGFV06bYe/OQnSZa2PtNn8zjfpYcYepNQGDNs4i3Qr0x+4gklo1dgUA8AzHjY
+ar4V90swFVQJqBwQvYs/O9nDIIzDRVZb8+HEp9MfD7FCDqajtRIqvzu6rPan0Ahm
+1ziyKEXCjLFiS35S9yBEkPwiduSMeplkoGMpwTykuyTEwiu3I9F1fBMet3ZR1r3U
+d1S4zWsfxwX71eONcZnjbmL58e6+ZS5G2/V8g3fFjUHBEzC+419a3/IsukzjAhdv
+1xIMnp/sojVZRf0WBQgqOURRXn2AmKanq9wLEB8qQ0ZwfYCEiJCatLnO3Oz3CyxD
+Sn+MtcXX8Q4QGUB/hI6kprvc3/IAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOISs4
+-----END CERTIFICATE-----

diff --git a/crypto/x509/test/mtc/cert_37_0.pem b/crypto/x509/test/mtc/cert_37_0.pem
new file mode 100644
index 0000000..8582569
--- /dev/null
+++ b/crypto/x509/test/mtc/cert_37_0.pem

@@ -0,0 +1,65 @@
+-----BEGIN CERTIFICATE PROPERTIES-----
+AB0AAAAEgf1ZAQABABEADw6B/VmB/VkBAQICAIAAgA==
+-----END CERTIFICATE PROPERTIES-----
+-----BEGIN CERTIFICATE-----
+MIILPDCB8qADAgECAgcBAAAAAAAlMAoGCCsGAQUFBwZDMBQxEjAQBggrBgEFBQcZ
+Aw0Egf1ZATAeFw0yMDAxMDEwMDAwMDBaFw0zMDEyMzEyMzU5NTlaMAAwWTATBgcq
+hkjOPQIBBggqhkjOPQMBBwNCAATLGILXqW2z5I4vzs7AeEYPMr393JR3uwzzSMB/
+ndUv4BXfwegcqmYDssmhgt/jJWFxWV41zG5+wB9w+55MtfRWo0MwQTAOBgNVHQ8B
+Af8EBAMCB4AwFgYDVR0lAQH/BAwwCgYIKwYBBQUHAwEwFwYDVR0RAQH/BA0wC4IJ
+YS5leGFtcGxlMAoGCCsGAQUFBwZDA4IKNwAACAACAAAAAQAAAAAAAAAgAAAAAABA
+AKDbIMGMtPBXj33Yp51YdX7dWko4SSiTX+bP+JU8UjawYzfjuh9FI7fwBAhYqNdu
+XggktXdVAJUoWB8uH40sbHt9i0KI7f+SgI9loBAH9lNF4H3iOGiZYv/sBDQQPh/4
+jSF0+XC9Dt7q37UpkcCJdZPO/GI/Qw4T/d6+ie4eJpFQFQpqe9bkCGo8khZ+o9fh
+/uK7GvASFx3+lT3/CdrzHU3PAAl7BIH9WQEJdKfPs63LocW6egf1dLREUjU8Sv6C
+odARH69tRuouTbzxl3ZVsi+ikbUVxIXe05bw+iTnMxFhlPDADlHvd5U1t60SYDK2
+nIdVtsvYtVEYwRd8Bn4FQjdGE7p76L28+z3vZY3ZwyqiIneNRYluNih5ilCDvZaZ
+fP42Lwgk1IFvdcCsi4WWitzKPMSiF+k5JH9lQoV9UmVPYY5hvv8R7mMcwArU3Mig
+LaPtja+sIuecQNhbdawfqrXohPtpysgAXxlDn5bsJTsVgGKnuQAcA6ue1lKz0PzC
+K9jAdi27tAMWloHa2ccy8KhOd2dOQgTkeAh3gTLh65egxNmgkj9dfDDxP/zI1ugn
+RsBUJaJkul3QWAZaenjkVK7/tLCHNfUG/QOBMg0g6yv1dNFw8ektOU6D+8EbWsMS
+XxSZ7sxdbq1XB27aX3HwcKGc8+rYnowIooJgdP5zB+MntBAKJRTpT83Ui93AOyg8
+oxCndcnKVKfJ1tq3HPyHl9ElYpiwGV5SSRWCZ5wkH8OosVFP8txQWuJ07nb7hHW6
+TgYLmRyouffv191fnDyHb0MrDOfRRa7vawfF4QtIfqnTX3pMi6rLXNIKtao6P3XU
+2NcXNOfiLCFqhxmedgyG+I93nx8KWYsImtyLSLRh3hJLQEEqDlhlhDSyHCrWvjJr
+QvBo1ZKRKG54IPbf5lZO/EOFJEgg+z6WOufsp7wQXVNrpBslizz0k5Lkwkfc0ocR
+2GhWlQwolGdb+FUq2Ncxfv3fWWCUlxt76384b6o4BdrHPKDVz3mBGopQ8z5wX+dq
+KaxtIGbNldBULHnNe2tycUquYnK06bdMB3sKCFtlPAgZj0OQZ/WG4CRvb16USeW7
+7JEsozc9FAnvp9CcTHxXwhnbJpqG3gi4aoOUoK5Kr4ngtszPphIKNBo2GcRMv3WQ
+dH8cMYAV9Qazvr2MaiD04nwOGMGozB4MYQcCuvpYWaHLj4fkWeab2MsdVPrnjxih
+fEGiJqswsYmbPnr3WWMblD7p8iAM705OfQ5tdH5GD2IEMNxxxxjPTVNI7cE0H50N
+IYUWWt7tsz7mi0dPHdTcvG2tA0Y2sPYNu8M5FIHhtu4RDYFecqW3LwDOo3t3vS8r
+KvHJc2oXr9/hDd4mQukEFEJJY7dSn7jH7HzsyJ/2jpf/3fLSiQVoMz9fkyoQ/ITf
+YY9IAzrx8nnITte2CiMI+Jse8jo46NAyj3Ep/ZYkl/2cq6Eu/8zazZ3MCxNJ3lUS
+vAtrCEjOaUR1tLR7SlITYj0pU+QjQigKmuJ3r8jiC2vPj7H5o8y6QyhK35jHfGjx
+CPuPxF6AntaUh0EYTpCMJ5bQM5EzAK5rCzmT2p/kxHD+X8SbJLbrVKxDZOvbhNm+
+Dvj4YQfTe7dBll/G+k0orK1raVs0xHhdx8otEjIF/zIk4TlzVzJuZ0iDEKhFE1zD
+mlHpnRD9TOKPLgIUp4H7gXw3eN6XEfDMd7qyjWeGwfmee8ea7kh7NL79sYcvZWuh
+Z24pjahP0ki6CejYXqA3HVZiO3ZeGuHG2Bm7FWpe37Ytvfeba1azJ6P0qvDqmsn2
+EVRZkB5xYNjKuiT+UCF4zEhIrUHwfgef2OrEPUNWpQNdl78FlJ+1Yw7ofNTIppdI
+gek7HXFJD2njWhyX/WH+5bWbYjhwtrg9HGvD5k77rURev2HZm2T238XDlr8qSi4P
+0br6W7hDB1keanFyVHBwpG0C5WtxjoWVK7R2i5P30bgCc9KzktZa1QPUMBpY42Ho
+wW7OeCYazgHk1pU4zmCu90PVdPHUqUxI/fBcScGCfn0WzLYm0H2S3S13INB65e2S
+uOtX4yLSPdfagCtG1aJwNMPuTorGRoWaJ1toBP/9lih3Rv/a7iXaDAXnb+gtAhro
+MQOH4aKpQyT5dTHR/YsS39vnFsqpwJztMIkhndYgUa6fNeELNvqJs7E0jTYRP53H
+/rt6zgVerlb4m/6HaehU8IDG9+sQL4apqDJ6WG1z+qmwKtRo+nXGmK/4QIfiysTY
+sr9NEg2upmt2a+k33yL5RRi9AEdcb6FDxkyGd/h0UBMdjgaB7H14Fs/I+dt64mMZ
+GPTVNn+uCVF/A+SNVioZ0ShwFRirGggvqu37iA9PzVX5DKs2snb8sNnJB0RJMo6F
+me2ELhSd+Rk+5Xg5RS0iLpR9No7XxKLc+wM158Jge9lO7j9nENNprY58r3K0iXnV
+vZ1S1Ao7BJI4Mo04+U6wcZNLF7okhpVsXoNoDBO3ZCf/d9l4szAFnP6+sVmlCi0H
+XzsDF+m1qLAK0AEWI4Xm2Ov6pdPy37E6/XpkJi/4CNStex2fvN3jbeyXkJVgU8gy
+ii1fI37uhSzBgfEx2OBRzG0eRyM3H8OCXUomApt9K/ozlIBz7ESGjO0nqmEjH8gr
+3G7hm847mTpzVqQEVwVfaY5nSqLbUCy5zB8sDM4S5ocka/v8QD3wqJDjy3UU6qD9
+v90k6N5YkFx6L3JQPYiWNvraDueDHIyDuqpNCFzWbmBVgE4w2yNImtaSmS+ySJxW
+Spmwj7B+4iAqvwANO2po56nD+kkA6ymCmuZ4IYqzcyVx+R0J7PF7j6bdJ4XxtLIv
+ToNbzz7I/OcMwe2dcajkWjhOpbb3X2T/15gnx+Bixt6YkuHMtCII/GHY8l4KscCj
+lHvTjzYyfeFm37E9lKCEYw+5OPicJNhHDNXUdlFwGSmqb5hzASyqyiqStzx+aiS0
+gl9sdJqz59xjG8e+C9xVI5a3rwwQWsXnWLQvUj+IQFG6JiIAEvASEUwb2hFyICId
+C3Z4e0FHf91NBwMC0UOA1LQzr1ggb/xoRt9kjut6tua6EwhiH9fPRawEci6dvHyb
+bH2RnZDrZTua02gxq7VcUchYv6gZUz0CC9N1cvkvN/M4uYpD2U8jy9rY7XS0V9DI
+RnA7fu1sDXDueroYwMx6Q8oARqcmyzSIZQDBzkqUyOWPimlQTO4FhQ8ziSwqXKsG
+OjROM97lNcfc9HNFlXTMoZKh9Ogk/q515DP2wmE5NM3qa+MsO+aAZ+KfRz9WMazP
+d+hr6o6oQBkrEDY5nVPrVco++YjkT+xLnLMSqj1DqgcjBxh90fZImchO+p5QNx2L
+Gmza4TZ2XUQz8NiaAQkSJzBOT3WJnaeo2Nnj+AROa3ajw8TGzdb7GxwdHy81SWpr
+c5+uyc7V2Nv/AAUWJy8wP0pXaGtsfYKRpcrN6PX8/wAAAAAAAAAAAAAAAAAQGy1D
+-----END CERTIFICATE-----

diff --git a/crypto/x509/test/mtc/mtc_testdata_config.json b/crypto/x509/test/mtc/mtc_testdata_config.json
index e503c76..f8e0f9f 100644
--- a/crypto/x509/test/mtc/mtc_testdata_config.json
+++ b/crypto/x509/test/mtc/mtc_testdata_config.json

@@ -123,7 +123,59 @@
       ]
     },
     {
-      "Repeat": 2000,
+      "//0": "Well-formed MTCEntryExtensions of unrecognized types 1 and 2, which are ignored: 0001 0000 0002 0001 ff",
+      "MTCEntryExtensions": "AAEAAAACAAH/",
+      "PublicKey": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyxiC16lts+SOL87OwHhGDzK9/dyUd7sM80jAf53VL+AV38HoHKpmA7LJoYLf4yVhcVleNcxufsAfcPueTLX0Vg==",
+      "NotBefore": "2020-01-01T00:00:00Z",
+      "NotAfter": "2030-12-31T23:59:59Z",
+      "DNSNames": ["a.example"],
+      "KeyUsage": ["DigitalSignature"],
+      "ExtKeyUsage": ["ServerAuth"],
+      "Certificates": [
+        {"SubtreeStart": 32, "SubtreeEnd": 64, "Cosigners": ["32473.1"]}
+      ]
+    },
+    {
+      "//0": "Invalid because MTCEntryExtensions is truncated: 0001 0005 ff",
+      "MTCEntryExtensions": "AAEABf8=",
+      "PublicKey": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyxiC16lts+SOL87OwHhGDzK9/dyUd7sM80jAf53VL+AV38HoHKpmA7LJoYLf4yVhcVleNcxufsAfcPueTLX0Vg==",
+      "NotBefore": "2020-01-01T00:00:00Z",
+      "NotAfter": "2030-12-31T23:59:59Z",
+      "DNSNames": ["a.example"],
+      "KeyUsage": ["DigitalSignature"],
+      "ExtKeyUsage": ["ServerAuth"],
+      "Certificates": [
+        {"SubtreeStart": 32, "SubtreeEnd": 64, "Cosigners": ["32473.1"]}
+      ]
+    },
+    {
+      "//0": "Invalid because MTCEntryExtensions has a duplicate type: 0001 0000 0001 0000",
+      "MTCEntryExtensions": "AAEAAAABAAA=",
+      "PublicKey": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyxiC16lts+SOL87OwHhGDzK9/dyUd7sM80jAf53VL+AV38HoHKpmA7LJoYLf4yVhcVleNcxufsAfcPueTLX0Vg==",
+      "NotBefore": "2020-01-01T00:00:00Z",
+      "NotAfter": "2030-12-31T23:59:59Z",
+      "DNSNames": ["a.example"],
+      "KeyUsage": ["DigitalSignature"],
+      "ExtKeyUsage": ["ServerAuth"],
+      "Certificates": [
+        {"SubtreeStart": 32, "SubtreeEnd": 64, "Cosigners": ["32473.1"]}
+      ]
+    },
+    {
+      "//0": "Invalid because MTCEntryExtensions types are in descending order: 0002 0000 0001 0000",
+      "MTCEntryExtensions": "AAIAAAABAAA=",
+      "PublicKey": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyxiC16lts+SOL87OwHhGDzK9/dyUd7sM80jAf53VL+AV38HoHKpmA7LJoYLf4yVhcVleNcxufsAfcPueTLX0Vg==",
+      "NotBefore": "2020-01-01T00:00:00Z",
+      "NotAfter": "2030-12-31T23:59:59Z",
+      "DNSNames": ["a.example"],
+      "KeyUsage": ["DigitalSignature"],
+      "ExtKeyUsage": ["ServerAuth"],
+      "Certificates": [
+        {"SubtreeStart": 32, "SubtreeEnd": 64, "Cosigners": ["32473.1"]}
+      ]
+    },
+    {
+      "Repeat": 1996,
       "Subject": {"CommonName": "Some more filler certificates"},
       "PublicKey": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyxiC16lts+SOL87OwHhGDzK9/dyUd7sM80jAf53VL+AV38HoHKpmA7LJoYLf4yVhcVleNcxufsAfcPueTLX0Vg==",
       "NotBefore": "2020-01-01T00:00:00Z",

diff --git a/crypto/x509/x509_mtc.cc b/crypto/x509/x509_mtc.cc
index 85cb04c..5853f8f 100644
--- a/crypto/x509/x509_mtc.cc
+++ b/crypto/x509/x509_mtc.cc

@@ -144,6 +144,29 @@
   return EVP_DigestUpdate(ctx, CBS_data(&element), CBS_len(&element));
 }
 
+// CheckMTCLogEntryExtensions returns whether `extensions` is a well-formed list
+// of MTCLogEntryExtension structures, sorted in strictly ascending order by
+// extension type (see section 5.2.1). No extension types are currently
+// recognized, so the contents are otherwise ignored (see section 12.5).
+bool CheckMTCLogEntryExtensions(CBS extensions) {
+  std::optional<uint16_t> prev_type;
+  while (CBS_len(&extensions) > 0) {
+    uint16_t type;
+    CBS data;
+    if (!CBS_get_u16(&extensions, &type) ||
+        !CBS_get_u16_length_prefixed(&extensions, &data)) {
+      OPENSSL_PUT_ERROR(X509, X509_R_INVALID_MTC_PROOF);
+      return false;
+    }
+    if (prev_type.has_value() && *prev_type >= type) {
+      OPENSSL_PUT_ERROR(X509, X509_R_INVALID_MTC_PROOF);
+      return false;
+    }
+    prev_type = type;
+  }
+  return true;
+}
+
 // MTCCACosigner represents a Merkle Tree CA and its corresponding CA cosigner
 // (see draft-ietf-plants-merkle-tree-certs, section 5.5).
 // Only id-pe-mtcCertificationAuthority-SHA256 is supported.
@@ -433,6 +456,9 @@
     OPENSSL_PUT_ERROR(ASN1, ASN1_R_DECODE_ERROR);
     return 0;
   }
+  if (!CheckMTCLogEntryExtensions(extensions)) {
+    return 0;
+  }
 
   // Iterate through the subtree signatures array to check that they conform to
   // spec, and identify the subtree signature from the CA cosigner.

diff --git a/crypto/x509/x509_test.cc b/crypto/x509/x509_test.cc
index 054bde5..e2e669d 100644
--- a/crypto/x509/x509_test.cc
+++ b/crypto/x509/x509_test.cc

@@ -12681,6 +12681,41 @@
   EXPECT_EQ(X509_V_OK, VerifyMTC(mtc_33_empty_unrecognized_cosignature.get()));
 }
 
+TEST_P(X509VerifyMTCTest, UnrecognizedEntryExtensions) {
+  UniquePtr<X509> mtc_34_unrecognized_extensions =
+      CertFromPEM(GetTestData("crypto/x509/test/mtc/cert_34_0.pem"));
+  ASSERT_TRUE(mtc_34_unrecognized_extensions);
+  EXPECT_EQ(X509_V_OK, VerifyMTC(mtc_34_unrecognized_extensions.get()));
+}
+
+TEST_P(X509VerifyMTCTest, InvalidEntryExtensions) {
+  UniquePtr<X509> mtc_35_truncated_extensions =
+      CertFromPEM(GetTestData("crypto/x509/test/mtc/cert_35_0.pem"));
+  ASSERT_TRUE(mtc_35_truncated_extensions);
+  EXPECT_EQ(X509_V_ERR_CERT_SIGNATURE_FAILURE,
+            VerifyMTC(mtc_35_truncated_extensions.get()));
+  EXPECT_TRUE(
+      ErrorEquals(ERR_get_error(), ERR_LIB_X509, X509_R_INVALID_MTC_PROOF));
+  ERR_clear_error();
+
+  UniquePtr<X509> mtc_36_duplicate_extensions =
+      CertFromPEM(GetTestData("crypto/x509/test/mtc/cert_36_0.pem"));
+  ASSERT_TRUE(mtc_36_duplicate_extensions);
+  EXPECT_EQ(X509_V_ERR_CERT_SIGNATURE_FAILURE,
+            VerifyMTC(mtc_36_duplicate_extensions.get()));
+  EXPECT_TRUE(
+      ErrorEquals(ERR_get_error(), ERR_LIB_X509, X509_R_INVALID_MTC_PROOF));
+  ERR_clear_error();
+
+  UniquePtr<X509> mtc_37_misordered_extensions =
+      CertFromPEM(GetTestData("crypto/x509/test/mtc/cert_37_0.pem"));
+  ASSERT_TRUE(mtc_37_misordered_extensions);
+  EXPECT_EQ(X509_V_ERR_CERT_SIGNATURE_FAILURE,
+            VerifyMTC(mtc_37_misordered_extensions.get()));
+  EXPECT_TRUE(
+      ErrorEquals(ERR_get_error(), ERR_LIB_X509, X509_R_INVALID_MTC_PROOF));
+}
+
 TEST_P(X509VerifyMTCTest, InvalidSerial) {
   // This cert with index 2 is below the minSerial for the CA, which is:
   // {"Log": 1, "Index": 8}.

diff --git a/gen/sources.bzl b/gen/sources.bzl
index b7de20f..6404ca2 100644
--- a/gen/sources.bzl
+++ b/gen/sources.bzl

@@ -1034,6 +1034,10 @@
     "crypto/x509/test/mtc/cert_33_7.pem",
     "crypto/x509/test/mtc/cert_33_8.pem",
     "crypto/x509/test/mtc/cert_33_9.pem",
+    "crypto/x509/test/mtc/cert_34_0.pem",
+    "crypto/x509/test/mtc/cert_35_0.pem",
+    "crypto/x509/test/mtc/cert_36_0.pem",
+    "crypto/x509/test/mtc/cert_37_0.pem",
     "crypto/x509/test/mtc/cert_5036_0.pem",
     "crypto/x509/test/mtc/large_merkle_tree_consistency_proof_tests.txt",
     "crypto/x509/test/mtc/large_merkle_tree_inclusion_proof_tests.txt",

diff --git a/gen/sources.cmake b/gen/sources.cmake
index fa6b0a0..af59729 100644
--- a/gen/sources.cmake
+++ b/gen/sources.cmake

@@ -1066,6 +1066,10 @@
   crypto/x509/test/mtc/cert_33_7.pem
   crypto/x509/test/mtc/cert_33_8.pem
   crypto/x509/test/mtc/cert_33_9.pem
+  crypto/x509/test/mtc/cert_34_0.pem
+  crypto/x509/test/mtc/cert_35_0.pem
+  crypto/x509/test/mtc/cert_36_0.pem
+  crypto/x509/test/mtc/cert_37_0.pem
   crypto/x509/test/mtc/cert_5036_0.pem
   crypto/x509/test/mtc/large_merkle_tree_consistency_proof_tests.txt
   crypto/x509/test/mtc/large_merkle_tree_inclusion_proof_tests.txt

diff --git a/gen/sources.gni b/gen/sources.gni
index e4abad1..545adbf 100644
--- a/gen/sources.gni
+++ b/gen/sources.gni

@@ -1034,6 +1034,10 @@
   "crypto/x509/test/mtc/cert_33_7.pem",
   "crypto/x509/test/mtc/cert_33_8.pem",
   "crypto/x509/test/mtc/cert_33_9.pem",
+  "crypto/x509/test/mtc/cert_34_0.pem",
+  "crypto/x509/test/mtc/cert_35_0.pem",
+  "crypto/x509/test/mtc/cert_36_0.pem",
+  "crypto/x509/test/mtc/cert_37_0.pem",
   "crypto/x509/test/mtc/cert_5036_0.pem",
   "crypto/x509/test/mtc/large_merkle_tree_consistency_proof_tests.txt",
   "crypto/x509/test/mtc/large_merkle_tree_inclusion_proof_tests.txt",

diff --git a/gen/sources.json b/gen/sources.json
index f3fbb43..348e4c8 100644
--- a/gen/sources.json
+++ b/gen/sources.json

@@ -1013,6 +1013,10 @@
       "crypto/x509/test/mtc/cert_33_7.pem",
       "crypto/x509/test/mtc/cert_33_8.pem",
       "crypto/x509/test/mtc/cert_33_9.pem",
+      "crypto/x509/test/mtc/cert_34_0.pem",
+      "crypto/x509/test/mtc/cert_35_0.pem",
+      "crypto/x509/test/mtc/cert_36_0.pem",
+      "crypto/x509/test/mtc/cert_37_0.pem",
       "crypto/x509/test/mtc/cert_5036_0.pem",
       "crypto/x509/test/mtc/large_merkle_tree_consistency_proof_tests.txt",
       "crypto/x509/test/mtc/large_merkle_tree_inclusion_proof_tests.txt",

diff --git a/gen/sources.mk b/gen/sources.mk
index f1b8c6f..1721bfc 100644
--- a/gen/sources.mk
+++ b/gen/sources.mk

@@ -1019,6 +1019,10 @@
   crypto/x509/test/mtc/cert_33_7.pem \
   crypto/x509/test/mtc/cert_33_8.pem \
   crypto/x509/test/mtc/cert_33_9.pem \
+  crypto/x509/test/mtc/cert_34_0.pem \
+  crypto/x509/test/mtc/cert_35_0.pem \
+  crypto/x509/test/mtc/cert_36_0.pem \
+  crypto/x509/test/mtc/cert_37_0.pem \
   crypto/x509/test/mtc/cert_5036_0.pem \
   crypto/x509/test/mtc/large_merkle_tree_consistency_proof_tests.txt \
   crypto/x509/test/mtc/large_merkle_tree_inclusion_proof_tests.txt \