diff --git a/pki/cert_net_fetcher.h b/pki/cert_net_fetcher.h
deleted file mode 100644
index 27341ae..0000000
--- a/pki/cert_net_fetcher.h
+++ /dev/null
@@ -1,98 +0,0 @@
-// Copyright 2015 The Chromium Authors
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef BSSL_PKI_CERT_NET_FETCHER_H_
-#define BSSL_PKI_CERT_NET_FETCHER_H_
-
-#include "webutil/url/url.h"
-#include "fillins/openssl_util.h"
-#include <stdint.h>
-
-#include <memory>
-#include <vector>
-
-#include <memory>
-#include "fillins/log.h"
-#include "fillins/net_errors.h"
-
-
-
-class URL;
-
-namespace bssl {
-
-// CertNetFetcher is a synchronous interface for fetching AIA URLs and CRL
-// URLs. It is shared between a caller thread (which starts and waits for
-// fetches), and a network thread (which does the actual fetches). It can be
-// shutdown from the network thread to cancel outstanding requests.
-//
-// A Request object is returned when starting a fetch. The consumer can
-// use this as a handle for aborting the request (by freeing it), or reading
-// the result of the request (WaitForResult)
-class OPENSSL_EXPORT CertNetFetcher
-     {
- public:
-  class Request {
-   public:
-    virtual ~Request() = default;
-
-    // WaitForResult() can be called at most once.
-    //
-    // It will block and wait for the (network) request to complete, and
-    // then write the result into the provided out-parameters.
-    virtual void WaitForResult(Error* error, std::vector<uint8_t>* bytes) = 0;
-  };
-
-  // This value can be used in place of timeout or max size limits.
-  enum { DEFAULT = -1 };
-
-  CertNetFetcher() = default;
-
-  CertNetFetcher(const CertNetFetcher&) = delete;
-  CertNetFetcher& operator=(const CertNetFetcher&) = delete;
-
-  // Shuts down the CertNetFetcher and cancels outstanding network requests. It
-  // is not guaranteed that any outstanding or subsequent
-  // Request::WaitForResult() calls will be completed. Shutdown() must be called
-  // from the network thread. It can be called more than once, but must be
-  // called before the CertNetFetcher is destroyed.
-  virtual void Shutdown() = 0;
-
-  // The Fetch*() methods start a request which can be cancelled by
-  // deleting the returned Request. Here is the meaning of the common
-  // parameters:
-  //
-  //   * url -- The http:// URL to fetch.
-  //   * timeout_seconds -- The maximum allowed duration for the fetch job. If
-  //         this delay is exceeded then the request will fail. To use a default
-  //         timeout pass DEFAULT.
-  //   * max_response_bytes -- The maximum size of the response body. If this
-  //     size is exceeded then the request will fail. To use a default timeout
-  //     pass DEFAULT.
-
-  [[nodiscard]] virtual std::unique_ptr<Request> FetchCaIssuers(
-      const URL& url,
-      int timeout_milliseconds,
-      int max_response_bytes) = 0;
-
-  [[nodiscard]] virtual std::unique_ptr<Request> FetchCrl(
-      const URL& url,
-      int timeout_milliseconds,
-      int max_response_bytes) = 0;
-
-  [[nodiscard]] virtual std::unique_ptr<Request> FetchOcsp(
-      const URL& url,
-      int timeout_milliseconds,
-      int max_response_bytes) = 0;
-
- protected:
-  virtual ~CertNetFetcher() = default;
-
- private:
-  
-};
-
-}  // namespace net
-
-#endif  // BSSL_PKI_CERT_NET_FETCHER_H_
diff --git a/pki/certificate_policies_unittest.cc b/pki/certificate_policies_unittest.cc
index af9332c..fcf10b8 100644
--- a/pki/certificate_policies_unittest.cc
+++ b/pki/certificate_policies_unittest.cc
@@ -44,7 +44,7 @@
   std::vector<der::Input> policies;
   CertErrors errors;
   EXPECT_FALSE(ParseCertificatePoliciesExtensionOids(
-      der::Input(&der), fail_parsing_unknown_qualifier_oids(), &policies,
+      der::Input(der), fail_parsing_unknown_qualifier_oids(), &policies,
       &errors));
 }
 
@@ -54,7 +54,7 @@
   std::vector<der::Input> policies;
   CertErrors errors;
   EXPECT_FALSE(ParseCertificatePoliciesExtensionOids(
-      der::Input(&der), fail_parsing_unknown_qualifier_oids(), &policies,
+      der::Input(der), fail_parsing_unknown_qualifier_oids(), &policies,
       &errors));
 }
 
@@ -64,7 +64,7 @@
   std::vector<der::Input> policies;
   CertErrors errors;
   EXPECT_TRUE(ParseCertificatePoliciesExtensionOids(
-      der::Input(&der), fail_parsing_unknown_qualifier_oids(), &policies,
+      der::Input(der), fail_parsing_unknown_qualifier_oids(), &policies,
       &errors));
   ASSERT_EQ(1U, policies.size());
   EXPECT_EQ(der::Input(kAnyPolicyOid), policies[0]);
@@ -76,7 +76,7 @@
   std::vector<der::Input> policies;
   CertErrors errors;
   EXPECT_TRUE(ParseCertificatePoliciesExtensionOids(
-      der::Input(&der), fail_parsing_unknown_qualifier_oids(), &policies,
+      der::Input(der), fail_parsing_unknown_qualifier_oids(), &policies,
       &errors));
   ASSERT_EQ(1U, policies.size());
   EXPECT_EQ(der::Input(kAnyPolicyOid), policies[0]);
@@ -90,7 +90,7 @@
   std::vector<der::Input> policies;
   CertErrors errors;
   EXPECT_FALSE(ParseCertificatePoliciesExtensionOids(
-      der::Input(&der), fail_parsing_unknown_qualifier_oids(), &policies,
+      der::Input(der), fail_parsing_unknown_qualifier_oids(), &policies,
       &errors));
 }
 
@@ -100,7 +100,7 @@
   std::vector<der::Input> policies;
   CertErrors errors;
   EXPECT_TRUE(ParseCertificatePoliciesExtensionOids(
-      der::Input(&der), fail_parsing_unknown_qualifier_oids(), &policies,
+      der::Input(der), fail_parsing_unknown_qualifier_oids(), &policies,
       &errors));
   ASSERT_EQ(1U, policies.size());
   EXPECT_EQ(der::Input(policy_1_2_3_der), policies[0]);
@@ -112,7 +112,7 @@
   std::vector<der::Input> policies;
   CertErrors errors;
   EXPECT_TRUE(ParseCertificatePoliciesExtensionOids(
-      der::Input(&der), fail_parsing_unknown_qualifier_oids(), &policies,
+      der::Input(der), fail_parsing_unknown_qualifier_oids(), &policies,
       &errors));
   ASSERT_EQ(1U, policies.size());
   EXPECT_EQ(der::Input(policy_1_2_3_der), policies[0]);
@@ -125,7 +125,7 @@
   std::vector<der::Input> policies;
   CertErrors errors;
   bool result = ParseCertificatePoliciesExtensionOids(
-      der::Input(&der), fail_parsing_unknown_qualifier_oids(), &policies,
+      der::Input(der), fail_parsing_unknown_qualifier_oids(), &policies,
       &errors);
 
   if (fail_parsing_unknown_qualifier_oids()) {
@@ -144,7 +144,7 @@
   std::vector<der::Input> policies;
   CertErrors errors;
   EXPECT_FALSE(ParseCertificatePoliciesExtensionOids(
-      der::Input(&der), fail_parsing_unknown_qualifier_oids(), &policies,
+      der::Input(der), fail_parsing_unknown_qualifier_oids(), &policies,
       &errors));
 }
 
@@ -156,7 +156,7 @@
   std::vector<der::Input> policies;
   CertErrors errors;
   EXPECT_FALSE(ParseCertificatePoliciesExtensionOids(
-      der::Input(&der), fail_parsing_unknown_qualifier_oids(), &policies,
+      der::Input(der), fail_parsing_unknown_qualifier_oids(), &policies,
       &errors));
 }
 
@@ -168,7 +168,7 @@
   std::vector<der::Input> policies;
   CertErrors errors;
   EXPECT_FALSE(ParseCertificatePoliciesExtensionOids(
-      der::Input(&der), fail_parsing_unknown_qualifier_oids(), &policies,
+      der::Input(der), fail_parsing_unknown_qualifier_oids(), &policies,
       &errors));
 }
 
@@ -180,7 +180,7 @@
   std::vector<der::Input> policies;
   CertErrors errors;
   EXPECT_FALSE(ParseCertificatePoliciesExtensionOids(
-      der::Input(&der), fail_parsing_unknown_qualifier_oids(), &policies,
+      der::Input(der), fail_parsing_unknown_qualifier_oids(), &policies,
       &errors));
 }
 
@@ -190,7 +190,7 @@
   std::vector<der::Input> policies;
   CertErrors errors;
   EXPECT_TRUE(ParseCertificatePoliciesExtensionOids(
-      der::Input(&der), fail_parsing_unknown_qualifier_oids(), &policies,
+      der::Input(der), fail_parsing_unknown_qualifier_oids(), &policies,
       &errors));
   ASSERT_EQ(2U, policies.size());
   EXPECT_EQ(der::Input(policy_1_2_3_der), policies[0]);
@@ -203,7 +203,7 @@
   std::vector<der::Input> policies;
   CertErrors errors;
   EXPECT_TRUE(ParseCertificatePoliciesExtensionOids(
-      der::Input(&der), fail_parsing_unknown_qualifier_oids(), &policies,
+      der::Input(der), fail_parsing_unknown_qualifier_oids(), &policies,
       &errors));
   ASSERT_EQ(2U, policies.size());
   EXPECT_EQ(der::Input(policy_1_2_3_der), policies[0]);
@@ -216,7 +216,7 @@
   std::vector<PolicyInformation> policies;
   CertErrors errors;
   EXPECT_FALSE(
-      ParseCertificatePoliciesExtension(der::Input(&der), &policies, &errors));
+      ParseCertificatePoliciesExtension(der::Input(der), &policies, &errors));
 }
 
 TEST(ParseCertificatePoliciesExtensionTest,
@@ -226,7 +226,7 @@
   std::vector<PolicyInformation> policies;
   CertErrors errors;
   EXPECT_FALSE(
-      ParseCertificatePoliciesExtension(der::Input(&der), &policies, &errors));
+      ParseCertificatePoliciesExtension(der::Input(der), &policies, &errors));
 }
 
 TEST(ParseCertificatePoliciesExtensionTest, OnePolicyWithCustomQualifier) {
@@ -235,7 +235,7 @@
   std::vector<PolicyInformation> policies;
   CertErrors errors;
   EXPECT_TRUE(
-      ParseCertificatePoliciesExtension(der::Input(&der), &policies, &errors));
+      ParseCertificatePoliciesExtension(der::Input(der), &policies, &errors));
   ASSERT_EQ(1U, policies.size());
   PolicyInformation& policy = policies[0];
   EXPECT_EQ(der::Input(policy_1_2_3_der), policy.policy_oid);
@@ -256,7 +256,7 @@
   std::vector<PolicyInformation> policies;
   CertErrors errors;
   EXPECT_TRUE(
-      ParseCertificatePoliciesExtension(der::Input(&der), &policies, &errors));
+      ParseCertificatePoliciesExtension(der::Input(der), &policies, &errors));
   ASSERT_EQ(2U, policies.size());
   {
     PolicyInformation& policy = policies[0];
@@ -276,7 +276,7 @@
   std::vector<PolicyInformation> policies;
   CertErrors errors;
   EXPECT_TRUE(
-      ParseCertificatePoliciesExtension(der::Input(&der), &policies, &errors));
+      ParseCertificatePoliciesExtension(der::Input(der), &policies, &errors));
   ASSERT_EQ(2U, policies.size());
   {
     PolicyInformation& policy = policies[0];
diff --git a/pki/crl.cc b/pki/crl.cc
index ff3e704..99eb359 100644
--- a/pki/crl.cc
+++ b/pki/crl.cc
@@ -467,8 +467,9 @@
   std::string normalized_crl_issuer;
   if (!NormalizeNameTLV(tbs_cert_list.issuer_tlv, &normalized_crl_issuer))
     return CRLRevocationStatus::UNKNOWN;
-  if (der::Input(&normalized_crl_issuer) != target_cert->normalized_issuer())
+  if (der::Input(normalized_crl_issuer) != target_cert->normalized_issuer()) {
     return CRLRevocationStatus::UNKNOWN;
+  }
 
   if (tbs_cert_list.crl_extensions_tlv.has_value()) {
     std::map<der::Input, ParsedExtension> extensions;
@@ -584,8 +585,10 @@
     //
     // As the |issuer_cert| is from the already validated chain, it is already
     // known to chain to the same trust anchor as the target certificate.
-    if (der::Input(&normalized_crl_issuer) != issuer_cert->normalized_subject())
+    if (der::Input(normalized_crl_issuer) !=
+        issuer_cert->normalized_subject()) {
       continue;
+    }
 
     // 6.3.3 (f) If a key usage extension is present in the CRL issuer's
     //           certificate, verify that the cRLSign bit is set.
diff --git a/pki/fillins/log.h b/pki/fillins/log.h
index 74007ec..f0bbe61 100644
--- a/pki/fillins/log.h
+++ b/pki/fillins/log.h
@@ -17,8 +17,10 @@
 
 #if defined(_BORINGSSL_LIBPKI_VERBOSE_)
 #define DVLOG(l) std::cerr
+#define LOG(l) std::cerr
 #else
 #define DVLOG(l) 0 && std::cerr
+#define LOG(l) 0 && std::cerr
 #endif  // _BORINGSSL_LIBPKI_VERBOSE_
 
 #endif  // BSSL_FILLINS_LOG_H_
diff --git a/pki/general_names_unittest.cc b/pki/general_names_unittest.cc
index 0f7754d..2c04e7b 100644
--- a/pki/general_names_unittest.cc
+++ b/pki/general_names_unittest.cc
@@ -44,7 +44,7 @@
   ASSERT_TRUE(
       LoadTestSubjectAltNameData("san-invalid-empty.pem", &invalid_san_der));
   CertErrors errors;
-  EXPECT_FALSE(GeneralNames::Create(der::Input(&invalid_san_der), &errors));
+  EXPECT_FALSE(GeneralNames::Create(der::Input(invalid_san_der), &errors));
 }
 
 TEST(GeneralNames, OtherName) {
@@ -53,7 +53,7 @@
 
   CertErrors errors;
   std::unique_ptr<GeneralNames> general_names =
-      GeneralNames::Create(der::Input(&san_der), &errors);
+      GeneralNames::Create(der::Input(san_der), &errors);
   ASSERT_TRUE(general_names);
   EXPECT_EQ(GENERAL_NAME_OTHER_NAME, general_names->present_name_types);
   const uint8_t expected_der[] = {0x06, 0x04, 0x2a, 0x03, 0x04, 0x05,
@@ -68,7 +68,7 @@
 
   CertErrors errors;
   std::unique_ptr<GeneralNames> general_names =
-      GeneralNames::Create(der::Input(&san_der), &errors);
+      GeneralNames::Create(der::Input(san_der), &errors);
   ASSERT_TRUE(general_names);
   EXPECT_EQ(GENERAL_NAME_RFC822_NAME, general_names->present_name_types);
   ASSERT_EQ(1U, general_names->rfc822_names.size());
@@ -80,7 +80,7 @@
   ASSERT_TRUE(LoadTestSubjectAltNameData("san-rfc822name.pem", &san_der));
   ReplaceFirstSubstring(&san_der, "foo@example.com", "f\xF6\xF6@example.com");
   CertErrors errors;
-  EXPECT_FALSE(GeneralNames::Create(der::Input(&san_der), &errors));
+  EXPECT_FALSE(GeneralNames::Create(der::Input(san_der), &errors));
 }
 
 TEST(GeneralNames, DnsName) {
@@ -89,7 +89,7 @@
 
   CertErrors errors;
   std::unique_ptr<GeneralNames> general_names =
-      GeneralNames::Create(der::Input(&san_der), &errors);
+      GeneralNames::Create(der::Input(san_der), &errors);
   ASSERT_TRUE(general_names);
   EXPECT_EQ(GENERAL_NAME_DNS_NAME, general_names->present_name_types);
   ASSERT_EQ(1U, general_names->dns_names.size());
@@ -101,7 +101,7 @@
   ASSERT_TRUE(LoadTestSubjectAltNameData("san-dnsname.pem", &san_der));
   ReplaceFirstSubstring(&san_der, "foo.example.com", "f\xF6\xF6.example.com");
   CertErrors errors;
-  EXPECT_FALSE(GeneralNames::Create(der::Input(&san_der), &errors));
+  EXPECT_FALSE(GeneralNames::Create(der::Input(san_der), &errors));
 }
 
 TEST(GeneralNames, X400Address) {
@@ -110,7 +110,7 @@
 
   CertErrors errors;
   std::unique_ptr<GeneralNames> general_names =
-      GeneralNames::Create(der::Input(&san_der), &errors);
+      GeneralNames::Create(der::Input(san_der), &errors);
   ASSERT_TRUE(general_names);
   EXPECT_EQ(GENERAL_NAME_X400_ADDRESS, general_names->present_name_types);
   ASSERT_EQ(1U, general_names->x400_addresses.size());
@@ -125,7 +125,7 @@
 
   CertErrors errors;
   std::unique_ptr<GeneralNames> general_names =
-      GeneralNames::Create(der::Input(&san_der), &errors);
+      GeneralNames::Create(der::Input(san_der), &errors);
   ASSERT_TRUE(general_names);
   EXPECT_EQ(GENERAL_NAME_DIRECTORY_NAME, general_names->present_name_types);
   ASSERT_EQ(1U, general_names->directory_names.size());
@@ -140,7 +140,7 @@
 
   CertErrors errors;
   std::unique_ptr<GeneralNames> general_names =
-      GeneralNames::Create(der::Input(&san_der), &errors);
+      GeneralNames::Create(der::Input(san_der), &errors);
   ASSERT_TRUE(general_names);
   EXPECT_EQ(GENERAL_NAME_EDI_PARTY_NAME, general_names->present_name_types);
   ASSERT_EQ(1U, general_names->edi_party_names.size());
@@ -154,7 +154,7 @@
 
   CertErrors errors;
   std::unique_ptr<GeneralNames> general_names =
-      GeneralNames::Create(der::Input(&san_der), &errors);
+      GeneralNames::Create(der::Input(san_der), &errors);
   ASSERT_TRUE(general_names);
   EXPECT_EQ(GENERAL_NAME_UNIFORM_RESOURCE_IDENTIFIER,
             general_names->present_name_types);
@@ -169,7 +169,7 @@
   ReplaceFirstSubstring(&san_der, "http://example.com",
                         "http://ex\xE4mple.com");
   CertErrors errors;
-  EXPECT_FALSE(GeneralNames::Create(der::Input(&san_der), &errors));
+  EXPECT_FALSE(GeneralNames::Create(der::Input(san_der), &errors));
 }
 
 TEST(GeneralNames, IPAddress_v4) {
@@ -178,7 +178,7 @@
 
   CertErrors errors;
   std::unique_ptr<GeneralNames> general_names =
-      GeneralNames::Create(der::Input(&san_der), &errors);
+      GeneralNames::Create(der::Input(san_der), &errors);
   ASSERT_TRUE(general_names);
   EXPECT_EQ(GENERAL_NAME_IP_ADDRESS, general_names->present_name_types);
   ASSERT_EQ(1U, general_names->ip_addresses.size());
@@ -192,7 +192,7 @@
 
   CertErrors errors;
   std::unique_ptr<GeneralNames> general_names =
-      GeneralNames::Create(der::Input(&san_der), &errors);
+      GeneralNames::Create(der::Input(san_der), &errors);
   ASSERT_TRUE(general_names);
   EXPECT_EQ(GENERAL_NAME_IP_ADDRESS, general_names->present_name_types);
   ASSERT_EQ(1U, general_names->ip_addresses.size());
@@ -207,7 +207,7 @@
   ASSERT_TRUE(LoadTestSubjectAltNameData("san-invalid-ipaddress.pem",
                                          &invalid_san_der));
   CertErrors errors;
-  EXPECT_FALSE(GeneralNames::Create(der::Input(&invalid_san_der), &errors));
+  EXPECT_FALSE(GeneralNames::Create(der::Input(invalid_san_der), &errors));
 }
 
 TEST(GeneralNames, RegisteredIDs) {
@@ -216,7 +216,7 @@
 
   CertErrors errors;
   std::unique_ptr<GeneralNames> general_names =
-      GeneralNames::Create(der::Input(&san_der), &errors);
+      GeneralNames::Create(der::Input(san_der), &errors);
   ASSERT_TRUE(general_names);
   EXPECT_EQ(GENERAL_NAME_REGISTERED_ID, general_names->present_name_types);
   ASSERT_EQ(1U, general_names->registered_ids.size());
diff --git a/pki/import_spec.json b/pki/import_spec.json
index f81c87a..f6617cd 100644
--- a/pki/import_spec.json
+++ b/pki/import_spec.json
@@ -244,7 +244,6 @@
     "files": [
     "net/cert/asn1_util.h",
     "net/cert/asn1_util.cc",
-    "net/cert/cert_net_fetcher.h",
     "net/cert/cert_status_flags.h",
     "net/cert/cert_status_flags_list.h",
     "net/cert/cert_verify_proc_blocklist.inc",
diff --git a/pki/input.cc b/pki/input.cc
index cf83201..d8e9391 100644
--- a/pki/input.cc
+++ b/pki/input.cc
@@ -10,21 +10,17 @@
 
 namespace bssl::der {
 
-Input::Input(std::string_view in)
-    : data_(reinterpret_cast<const uint8_t*>(in.data())), len_(in.length()) {}
-
-Input::Input(const std::string* s) : Input(std::string_view(*s)) {}
-
 std::string Input::AsString() const {
-  return std::string(reinterpret_cast<const char*>(data_), len_);
+  return std::string(reinterpret_cast<const char*>(data_.data()), data_.size());
 }
 
 std::string_view Input::AsStringView() const {
-  return std::string_view(reinterpret_cast<const char*>(data_), len_);
+  return std::string_view(reinterpret_cast<const char*>(data_.data()),
+                          data_.size());
 }
 
 bssl::Span<const uint8_t> Input::AsSpan() const {
-  return bssl::MakeSpan(data_, len_);
+  return data_;
 }
 
 bool operator==(const Input& lhs, const Input& rhs) {
diff --git a/pki/input.h b/pki/input.h
index 14a1fef..e0dff1f 100644
--- a/pki/input.h
+++ b/pki/input.h
@@ -10,10 +10,11 @@
 #include <stdint.h>
 
 #include <string>
+#include <string_view>
+
 
 #include <openssl/span.h>
 
-
 namespace bssl::der {
 
 // An opaque class that represents a fixed buffer of data of a fixed length,
@@ -31,30 +32,30 @@
   // Creates an empty Input, one from which no data can be read.
   constexpr Input() = default;
 
-  // Creates an Input from a constant array |data|.
-  template <size_t N>
-  constexpr explicit Input(const uint8_t (&data)[N]) : data_(data), len_(N) {}
+  // Creates an Input from a span. The constructed Input is only valid as long
+  // as |data| points to live memory. If constructed from, say, a
+  // |std::vector<uint8_t>|, mutating the vector will invalidate the Input.
+  constexpr explicit Input(bssl::Span<const uint8_t> data) : data_(data) {}
 
   // Creates an Input from the given |data| and |len|.
   constexpr explicit Input(const uint8_t* data, size_t len)
-      : data_(data), len_(len) {}
+      : data_(bssl::MakeConstSpan(data, len)) {}
 
-  // Creates an Input from a std::string_view
-  explicit Input(std::string_view sp);
-
-  // Creates an Input from a std::string. The lifetimes are a bit subtle when
-  // using this function: The constructed Input is only valid so long as |s| is
-  // still alive and not mutated.
-  explicit Input(const std::string* s);
+  // Creates an Input from a std::string_view. The constructed Input is only
+  // valid as long as |data| points to live memory. If constructed from, say, a
+  // |std::string|, mutating the vector will invalidate the Input.
+  explicit Input(std::string_view str)
+      : data_(bssl::MakeConstSpan(reinterpret_cast<const uint8_t*>(str.data()),
+                                  str.size())) {}
 
   // Returns the length in bytes of an Input's data.
-  constexpr size_t Length() const { return len_; }
+  constexpr size_t Length() const { return data_.size(); }
 
   // Returns a pointer to the Input's data. This method is marked as "unsafe"
   // because access to the Input's data should be done through ByteReader
   // instead. This method should only be used where using a ByteReader truly
   // is not an option.
-  constexpr const uint8_t* UnsafeData() const { return data_; }
+  constexpr const uint8_t* UnsafeData() const { return data_.data(); }
 
   // Returns a copy of the data represented by this object as a std::string.
   std::string AsString() const;
@@ -64,21 +65,13 @@
   // this Input.
   std::string_view AsStringView() const;
 
-  // Returns a bssl::Span pointing to the same data as the Input. The resulting
-  // bssl::Span must not outlive the data that was used to construct this
-  // Input.
+  // Returns a span pointing to the same data as the Input. The resulting span
+  // must not outlive the data that was used to construct this Input.
   bssl::Span<const uint8_t> AsSpan() const;
 
  private:
-  // This constructor is deleted to prevent constructing an Input from a
-  // std::string r-value. Since the Input points to memory owned by another
-  // object, such an Input would point to invalid memory. Without this deleted
-  // constructor, a std::string could be passed in to the std::string_view
-  // constructor because of std::string_view's implicit constructor.
-  Input(std::string) = delete;
-
-  const uint8_t* data_ = nullptr;
-  size_t len_ = 0;
+  // TODO(crbug.com/770501): Replace this type with span altogether.
+  bssl::Span<const uint8_t> data_;
 };
 
 // Return true if |lhs|'s data and |rhs|'s data are byte-wise equal.
diff --git a/pki/name_constraints.cc b/pki/name_constraints.cc
index 6dbe2fb..eba142d 100644
--- a/pki/name_constraints.cc
+++ b/pki/name_constraints.cc
@@ -653,19 +653,26 @@
 }
 
 bool NameConstraints::IsPermittedIP(const fillins::IPAddress& ip) const {
+  // fillins::IPAddressMatchesPrefix internally maps v4 addresses to/from v6 on type
+  // mismatch. We don't wish to do this, so check the sizes match first.
   for (const auto& excluded_ip : excluded_subtrees_.ip_address_ranges) {
-    if (fillins::IPAddressMatchesPrefix(ip, excluded_ip.first, excluded_ip.second))
+    if (ip.size() == excluded_ip.first.size() &&
+        fillins::IPAddressMatchesPrefix(ip, excluded_ip.first, excluded_ip.second)) {
       return false;
+    }
   }
 
   // If permitted subtrees are not constrained, any name that is not excluded is
   // allowed.
-  if (!(permitted_subtrees_.present_name_types & GENERAL_NAME_IP_ADDRESS))
+  if (!(permitted_subtrees_.present_name_types & GENERAL_NAME_IP_ADDRESS)) {
     return true;
+  }
 
   for (const auto& permitted_ip : permitted_subtrees_.ip_address_ranges) {
-    if (fillins::IPAddressMatchesPrefix(ip, permitted_ip.first, permitted_ip.second))
+    if (ip.size() == permitted_ip.first.size() &&
+        fillins::IPAddressMatchesPrefix(ip, permitted_ip.first, permitted_ip.second)) {
       return true;
+    }
   }
 
   return false;
diff --git a/pki/name_constraints_unittest.cc b/pki/name_constraints_unittest.cc
index 6d6a121..1fe58ed 100644
--- a/pki/name_constraints_unittest.cc
+++ b/pki/name_constraints_unittest.cc
@@ -10,7 +10,6 @@
 #include "common_cert_errors.h"
 #include "test_helpers.h"
 #include <gtest/gtest.h>
-#include <gtest/gtest.h>
 
 namespace bssl {
 namespace {
@@ -49,12 +48,14 @@
     std::string* result_der) {
   ::testing::AssertionResult load_result =
       LoadTestSubjectAltNameData(basename, result_der);
-  if (!load_result)
+  if (!load_result) {
     return load_result;
+  }
   CertErrors errors;
-  *result = GeneralNames::Create(der::Input(result_der), &errors);
-  if (!*result)
+  *result = GeneralNames::Create(der::Input(*result_der), &errors);
+  if (!*result) {
     return ::testing::AssertionFailure() << "Create failed";
+  }
   return ::testing::AssertionSuccess();
 }
 
@@ -92,7 +93,7 @@
 
   CertErrors errors;
   std::unique_ptr<NameConstraints> name_constraints(
-      NameConstraints::Create(der::Input(&a), is_critical(), &errors));
+      NameConstraints::Create(der::Input(a), is_critical(), &errors));
   ASSERT_TRUE(name_constraints);
 
   EXPECT_TRUE(name_constraints->IsPermittedDNSName("permitted.example.com"));
@@ -181,7 +182,7 @@
   ASSERT_TRUE(LoadTestNameConstraint("dnsname2.pem", &a));
   CertErrors errors;
   std::unique_ptr<NameConstraints> name_constraints(
-      NameConstraints::Create(der::Input(&a), is_critical(), &errors));
+      NameConstraints::Create(der::Input(a), is_critical(), &errors));
   ASSERT_TRUE(name_constraints);
 
   // Matches permitted exactly.
@@ -212,7 +213,7 @@
       LoadTestNameConstraint("dnsname-permitted_with_leading_dot.pem", &a));
   CertErrors errors;
   std::unique_ptr<NameConstraints> name_constraints(
-      NameConstraints::Create(der::Input(&a), is_critical(), &errors));
+      NameConstraints::Create(der::Input(a), is_critical(), &errors));
   ASSERT_TRUE(name_constraints);
 
   // A permitted dNSName constraint of ".bar.com" should only match subdomains
@@ -230,7 +231,7 @@
       LoadTestNameConstraint("dnsname-excluded_with_leading_dot.pem", &a));
   CertErrors errors;
   std::unique_ptr<NameConstraints> name_constraints(
-      NameConstraints::Create(der::Input(&a), is_critical(), &errors));
+      NameConstraints::Create(der::Input(a), is_critical(), &errors));
   ASSERT_TRUE(name_constraints);
 
   // An excluded dNSName constraint of ".bar.com" should only match subdomains
@@ -247,7 +248,7 @@
   ASSERT_TRUE(LoadTestNameConstraint("dnsname-permitted_two_dot.pem", &a));
   CertErrors errors;
   std::unique_ptr<NameConstraints> name_constraints(
-      NameConstraints::Create(der::Input(&a), is_critical(), &errors));
+      NameConstraints::Create(der::Input(a), is_critical(), &errors));
   ASSERT_TRUE(name_constraints);
 
   // A dNSName constraint of ".." isn't meaningful. Shouldn't match anything.
@@ -263,7 +264,7 @@
 
   CertErrors errors;
   std::unique_ptr<NameConstraints> name_constraints(
-      NameConstraints::Create(der::Input(&a), is_critical(), &errors));
+      NameConstraints::Create(der::Input(a), is_critical(), &errors));
   ASSERT_TRUE(name_constraints);
 
   // Only "excluded.permitted.example.com" is excluded, and since permitted is
@@ -283,7 +284,7 @@
 
   CertErrors errors;
   std::unique_ptr<NameConstraints> name_constraints(
-      NameConstraints::Create(der::Input(&a), is_critical(), &errors));
+      NameConstraints::Create(der::Input(a), is_critical(), &errors));
   ASSERT_TRUE(name_constraints);
 
   // "permitted.example.com" is in the permitted section, but since "" is
@@ -301,7 +302,7 @@
 
   CertErrors errors;
   std::unique_ptr<NameConstraints> name_constraints(
-      NameConstraints::Create(der::Input(&a), is_critical(), &errors));
+      NameConstraints::Create(der::Input(a), is_critical(), &errors));
   ASSERT_TRUE(name_constraints);
 
   // "." is excluded, which should match nothing.
@@ -320,7 +321,7 @@
   a.replace(replace_location, 1, 1, -1);
 
   CertErrors errors;
-  EXPECT_FALSE(NameConstraints::Create(der::Input(&a), is_critical(), &errors));
+  EXPECT_FALSE(NameConstraints::Create(der::Input(a), is_critical(), &errors));
 }
 
 TEST_P(ParseNameConstraints, DirectoryNames) {
@@ -347,49 +348,49 @@
 
   CertErrors errors;
   std::unique_ptr<NameConstraints> name_constraints(NameConstraints::Create(
-      der::Input(&constraints_der), is_critical(), &errors));
+      der::Input(constraints_der), is_critical(), &errors));
   ASSERT_TRUE(name_constraints);
 
   // Not in any permitted subtree.
   EXPECT_FALSE(name_constraints->IsPermittedDirectoryName(
-      SequenceValueFromString(&name_ca)));
+      SequenceValueFromString(name_ca)));
   // Within the permitted C=US subtree.
   EXPECT_TRUE(name_constraints->IsPermittedDirectoryName(
-      SequenceValueFromString(&name_us)));
+      SequenceValueFromString(name_us)));
   // Within the permitted C=US subtree.
   EXPECT_TRUE(name_constraints->IsPermittedDirectoryName(
-      SequenceValueFromString(&name_us_az)));
+      SequenceValueFromString(name_us_az)));
   // Within the permitted C=US subtree, however the excluded C=US,ST=California
   // subtree takes priority.
   EXPECT_FALSE(name_constraints->IsPermittedDirectoryName(
-      SequenceValueFromString(&name_us_ca)));
+      SequenceValueFromString(name_us_ca)));
   // Within the permitted C=US subtree as well as the permitted
   // C=US,ST=California,L=Mountain View subtree, however the excluded
   // C=US,ST=California subtree still takes priority.
   EXPECT_FALSE(name_constraints->IsPermittedDirectoryName(
-      SequenceValueFromString(&name_us_ca_mountain_view)));
+      SequenceValueFromString(name_us_ca_mountain_view)));
   // Not in any permitted subtree, and also inside the extraneous excluded C=DE
   // subtree.
   EXPECT_FALSE(name_constraints->IsPermittedDirectoryName(
-      SequenceValueFromString(&name_de)));
+      SequenceValueFromString(name_de)));
   // Not in any permitted subtree.
   EXPECT_FALSE(name_constraints->IsPermittedDirectoryName(
-      SequenceValueFromString(&name_jp)));
+      SequenceValueFromString(name_jp)));
   // Within the permitted C=JP,ST=Tokyo subtree.
   EXPECT_TRUE(name_constraints->IsPermittedDirectoryName(
-      SequenceValueFromString(&name_jp_tokyo)));
+      SequenceValueFromString(name_jp_tokyo)));
 
   EXPECT_EQ(GENERAL_NAME_DIRECTORY_NAME,
             name_constraints->constrained_name_types());
 
   // Within the permitted C=US subtree.
   EXPECT_TRUE(IsPermittedCert(name_constraints.get(),
-                              SequenceValueFromString(&name_us),
+                              SequenceValueFromString(name_us),
                               nullptr /* subject_alt_names */));
   // Within the permitted C=US subtree, however the excluded C=US,ST=California
   // subtree takes priority.
   EXPECT_FALSE(IsPermittedCert(name_constraints.get(),
-                               SequenceValueFromString(&name_us_ca),
+                               SequenceValueFromString(name_us_ca),
                                nullptr /* subject_alt_names */));
 
   std::string san_der;
@@ -417,7 +418,7 @@
       LoadTestNameConstraint("directoryname-excluded.pem", &constraints_der));
   CertErrors errors;
   std::unique_ptr<NameConstraints> name_constraints(NameConstraints::Create(
-      der::Input(&constraints_der), is_critical(), &errors));
+      der::Input(constraints_der), is_critical(), &errors));
   ASSERT_TRUE(name_constraints);
 
   std::string name_empty;
@@ -433,13 +434,13 @@
   // Only "C=US,ST=California" is excluded, and since permitted is empty,
   // any directoryName outside that is allowed.
   EXPECT_TRUE(name_constraints->IsPermittedDirectoryName(
-      SequenceValueFromString(&name_empty)));
+      SequenceValueFromString(name_empty)));
   EXPECT_TRUE(name_constraints->IsPermittedDirectoryName(
-      SequenceValueFromString(&name_us)));
+      SequenceValueFromString(name_us)));
   EXPECT_FALSE(name_constraints->IsPermittedDirectoryName(
-      SequenceValueFromString(&name_us_ca)));
+      SequenceValueFromString(name_us_ca)));
   EXPECT_FALSE(name_constraints->IsPermittedDirectoryName(
-      SequenceValueFromString(&name_us_ca_mountain_view)));
+      SequenceValueFromString(name_us_ca_mountain_view)));
 }
 
 TEST_P(ParseNameConstraints, DirectoryNamesExcludeAll) {
@@ -448,7 +449,7 @@
       LoadTestNameConstraint("directoryname-excludeall.pem", &constraints_der));
   CertErrors errors;
   std::unique_ptr<NameConstraints> name_constraints(NameConstraints::Create(
-      der::Input(&constraints_der), is_critical(), &errors));
+      der::Input(constraints_der), is_critical(), &errors));
   ASSERT_TRUE(name_constraints);
 
   std::string name_empty;
@@ -466,22 +467,22 @@
   // "C=US" is in the permitted section, but since an empty
   // directoryName is excluded, nothing is permitted.
   EXPECT_FALSE(name_constraints->IsPermittedDirectoryName(
-      SequenceValueFromString(&name_empty)));
+      SequenceValueFromString(name_empty)));
   EXPECT_FALSE(name_constraints->IsPermittedDirectoryName(
-      SequenceValueFromString(&name_us)));
+      SequenceValueFromString(name_us)));
   EXPECT_FALSE(name_constraints->IsPermittedDirectoryName(
-      SequenceValueFromString(&name_us_ca)));
+      SequenceValueFromString(name_us_ca)));
   EXPECT_FALSE(name_constraints->IsPermittedDirectoryName(
-      SequenceValueFromString(&name_jp)));
+      SequenceValueFromString(name_jp)));
 }
 
-TEST_P(ParseNameConstraints, IPAdresses) {
+TEST_P(ParseNameConstraints, IPAddresses) {
   std::string a;
   ASSERT_TRUE(LoadTestNameConstraint("ipaddress.pem", &a));
 
   CertErrors errors;
   std::unique_ptr<NameConstraints> name_constraints(
-      NameConstraints::Create(der::Input(&a), is_critical(), &errors));
+      NameConstraints::Create(der::Input(a), is_critical(), &errors));
   ASSERT_TRUE(name_constraints);
 
   // IPv4 tests:
@@ -597,13 +598,13 @@
       IsPermittedCert(name_constraints.get(), der::Input(), san.get()));
 }
 
-TEST_P(ParseNameConstraints, IPAdressesExcludeOnly) {
+TEST_P(ParseNameConstraints, IPAddressesExcludeOnly) {
   std::string a;
   ASSERT_TRUE(LoadTestNameConstraint("ipaddress-excluded.pem", &a));
 
   CertErrors errors;
   std::unique_ptr<NameConstraints> name_constraints(
-      NameConstraints::Create(der::Input(&a), is_critical(), &errors));
+      NameConstraints::Create(der::Input(a), is_critical(), &errors));
   ASSERT_TRUE(name_constraints);
 
   // Only 192.168.5.0/255.255.255.0 is excluded, and since permitted is empty,
@@ -614,13 +615,13 @@
       fillins::IPAddress(1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 13, 0, 0, 0, 1)));
 }
 
-TEST_P(ParseNameConstraints, IPAdressesExcludeAll) {
+TEST_P(ParseNameConstraints, IPAddressesExcludeAll) {
   std::string a;
   ASSERT_TRUE(LoadTestNameConstraint("ipaddress-excludeall.pem", &a));
 
   CertErrors errors;
   std::unique_ptr<NameConstraints> name_constraints(
-      NameConstraints::Create(der::Input(&a), is_critical(), &errors));
+      NameConstraints::Create(der::Input(a), is_critical(), &errors));
   ASSERT_TRUE(name_constraints);
 
   // 192.168.0.0/255.255.0.0 and
@@ -634,13 +635,13 @@
       fillins::IPAddress(1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 13, 0, 0, 0, 1)));
 }
 
-TEST_P(ParseNameConstraints, IPAdressesNetmaskPermitSingleHost) {
+TEST_P(ParseNameConstraints, IPAddressesNetmaskPermitSingleHost) {
   std::string a;
   ASSERT_TRUE(LoadTestNameConstraint("ipaddress-permit_singlehost.pem", &a));
 
   CertErrors errors;
   std::unique_ptr<NameConstraints> name_constraints(
-      NameConstraints::Create(der::Input(&a), is_critical(), &errors));
+      NameConstraints::Create(der::Input(a), is_critical(), &errors));
   ASSERT_TRUE(name_constraints);
 
   EXPECT_FALSE(name_constraints->IsPermittedIP(fillins::IPAddress::IPv4AllZeros()));
@@ -651,13 +652,13 @@
   EXPECT_FALSE(name_constraints->IsPermittedIP(fillins::IPAddress(255, 255, 255, 255)));
 }
 
-TEST_P(ParseNameConstraints, IPAdressesNetmaskPermitPrefixLen31) {
+TEST_P(ParseNameConstraints, IPAddressesNetmaskPermitPrefixLen31) {
   std::string a;
   ASSERT_TRUE(LoadTestNameConstraint("ipaddress-permit_prefix31.pem", &a));
 
   CertErrors errors;
   std::unique_ptr<NameConstraints> name_constraints(
-      NameConstraints::Create(der::Input(&a), is_critical(), &errors));
+      NameConstraints::Create(der::Input(a), is_critical(), &errors));
   ASSERT_TRUE(name_constraints);
 
   EXPECT_FALSE(name_constraints->IsPermittedIP(fillins::IPAddress::IPv4AllZeros()));
@@ -669,13 +670,13 @@
   EXPECT_FALSE(name_constraints->IsPermittedIP(fillins::IPAddress(255, 255, 255, 255)));
 }
 
-TEST_P(ParseNameConstraints, IPAdressesNetmaskPermitPrefixLen1) {
+TEST_P(ParseNameConstraints, IPAddressesNetmaskPermitPrefixLen1) {
   std::string a;
   ASSERT_TRUE(LoadTestNameConstraint("ipaddress-permit_prefix1.pem", &a));
 
   CertErrors errors;
   std::unique_ptr<NameConstraints> name_constraints(
-      NameConstraints::Create(der::Input(&a), is_critical(), &errors));
+      NameConstraints::Create(der::Input(a), is_critical(), &errors));
   ASSERT_TRUE(name_constraints);
 
   EXPECT_FALSE(name_constraints->IsPermittedIP(fillins::IPAddress::IPv4AllZeros()));
@@ -686,13 +687,13 @@
       name_constraints->IsPermittedIP(fillins::IPAddress(0xFF, 0xFF, 0xFF, 0xFF)));
 }
 
-TEST_P(ParseNameConstraints, IPAdressesNetmaskPermitAll) {
+TEST_P(ParseNameConstraints, IPAddressesNetmaskPermitAll) {
   std::string a;
   ASSERT_TRUE(LoadTestNameConstraint("ipaddress-permit_all.pem", &a));
 
   CertErrors errors;
   std::unique_ptr<NameConstraints> name_constraints(
-      NameConstraints::Create(der::Input(&a), is_critical(), &errors));
+      NameConstraints::Create(der::Input(a), is_critical(), &errors));
   ASSERT_TRUE(name_constraints);
 
   EXPECT_TRUE(name_constraints->IsPermittedIP(fillins::IPAddress::IPv4AllZeros()));
@@ -700,32 +701,65 @@
   EXPECT_TRUE(name_constraints->IsPermittedIP(fillins::IPAddress(255, 255, 255, 255)));
 }
 
-TEST_P(ParseNameConstraints, IPAdressesFailOnInvalidAddr) {
+TEST_P(ParseNameConstraints, IPAddressesFailOnInvalidAddr) {
   std::string a;
   ASSERT_TRUE(LoadTestNameConstraint("ipaddress-invalid_addr.pem", &a));
 
   CertErrors errors;
-  EXPECT_FALSE(NameConstraints::Create(der::Input(&a), is_critical(), &errors));
+  EXPECT_FALSE(NameConstraints::Create(der::Input(a), is_critical(), &errors));
 }
 
-TEST_P(ParseNameConstraints, IPAdressesFailOnInvalidMaskNotContiguous) {
+TEST_P(ParseNameConstraints, IPAddressesFailOnInvalidMaskNotContiguous) {
   std::string a;
   ASSERT_TRUE(LoadTestNameConstraint(
       "ipaddress-invalid_mask_not_contiguous_1.pem", &a));
   CertErrors errors;
-  EXPECT_FALSE(NameConstraints::Create(der::Input(&a), is_critical(), &errors));
+  EXPECT_FALSE(NameConstraints::Create(der::Input(a), is_critical(), &errors));
 
   ASSERT_TRUE(LoadTestNameConstraint(
       "ipaddress-invalid_mask_not_contiguous_2.pem", &a));
-  EXPECT_FALSE(NameConstraints::Create(der::Input(&a), is_critical(), &errors));
+  EXPECT_FALSE(NameConstraints::Create(der::Input(a), is_critical(), &errors));
 
   ASSERT_TRUE(LoadTestNameConstraint(
       "ipaddress-invalid_mask_not_contiguous_3.pem", &a));
-  EXPECT_FALSE(NameConstraints::Create(der::Input(&a), is_critical(), &errors));
+  EXPECT_FALSE(NameConstraints::Create(der::Input(a), is_critical(), &errors));
 
   ASSERT_TRUE(LoadTestNameConstraint(
       "ipaddress-invalid_mask_not_contiguous_4.pem", &a));
-  EXPECT_FALSE(NameConstraints::Create(der::Input(&a), is_critical(), &errors));
+  EXPECT_FALSE(NameConstraints::Create(der::Input(a), is_critical(), &errors));
+}
+
+// Test that v4/v6 mapping is not applied when evaluating name constraints.
+TEST_P(ParseNameConstraints, IPAddressesMapped) {
+  std::string a;
+  ASSERT_TRUE(LoadTestNameConstraint("ipaddress-mapped_addrs.pem", &a));
+
+  CertErrors errors;
+  std::unique_ptr<NameConstraints> name_constraints(
+      NameConstraints::Create(der::Input(a), is_critical(), &errors));
+  ASSERT_TRUE(name_constraints);
+
+  // 192.168.1.0/24 is a permitted subtree.
+  EXPECT_TRUE(name_constraints->IsPermittedIP(fillins::IPAddress(192, 168, 1, 0)));
+  // This does not cover ::ffff:192.168.1.0.
+  EXPECT_FALSE(name_constraints->IsPermittedIP(
+      fillins::IPAddress(0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 255, 255, 192, 168, 1, 0)));
+  // 192.168.1.1 is excluded.
+  EXPECT_FALSE(name_constraints->IsPermittedIP(fillins::IPAddress(192, 168, 1, 1)));
+  // ::ffff:192.168.1.2 is excluded, but that does not exclude 192.168.1.2.
+  EXPECT_TRUE(name_constraints->IsPermittedIP(fillins::IPAddress(192, 168, 1, 2)));
+
+  // ::ffff:192.168.2.0/120 is a permitted subtree.
+  EXPECT_TRUE(name_constraints->IsPermittedIP(
+      fillins::IPAddress(0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 255, 255, 192, 168, 2, 0)));
+  // This does not cover 192.168.2.0.
+  EXPECT_FALSE(name_constraints->IsPermittedIP(fillins::IPAddress(192, 168, 2, 0)));
+  // ::ffff:192.168.2.1 is excluded.
+  EXPECT_FALSE(name_constraints->IsPermittedIP(
+      fillins::IPAddress(0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 255, 255, 192, 168, 2, 1)));
+  // 192.168.2.2 is excluded, but that does not exclude ::ffff:192.168.2.2.
+  EXPECT_TRUE(name_constraints->IsPermittedIP(
+      fillins::IPAddress(0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 255, 255, 192, 168, 2, 2)));
 }
 
 TEST_P(ParseNameConstraints, OtherNamesInPermitted) {
@@ -734,7 +768,7 @@
       LoadTestNameConstraint("othername-permitted.pem", &constraints_der));
   CertErrors errors;
   std::unique_ptr<NameConstraints> name_constraints(NameConstraints::Create(
-      der::Input(&constraints_der), is_critical(), &errors));
+      der::Input(constraints_der), is_critical(), &errors));
   ASSERT_TRUE(name_constraints);
 
   if (is_critical()) {
@@ -757,7 +791,7 @@
       LoadTestNameConstraint("othername-excluded.pem", &constraints_der));
   CertErrors errors;
   std::unique_ptr<NameConstraints> name_constraints(NameConstraints::Create(
-      der::Input(&constraints_der), is_critical(), &errors));
+      der::Input(constraints_der), is_critical(), &errors));
   ASSERT_TRUE(name_constraints);
 
   if (is_critical()) {
@@ -780,7 +814,7 @@
       LoadTestNameConstraint("rfc822name-permitted.pem", &constraints_der));
   CertErrors errors;
   std::unique_ptr<NameConstraints> name_constraints(NameConstraints::Create(
-      der::Input(&constraints_der), is_critical(), &errors));
+      der::Input(constraints_der), is_critical(), &errors));
   ASSERT_TRUE(name_constraints);
 
   EXPECT_EQ(GENERAL_NAME_RFC822_NAME,
@@ -842,7 +876,7 @@
       LoadTestNameConstraint("rfc822name-excluded.pem", &constraints_der));
   CertErrors errors;
   std::unique_ptr<NameConstraints> name_constraints(NameConstraints::Create(
-      der::Input(&constraints_der), is_critical(), &errors));
+      der::Input(constraints_der), is_critical(), &errors));
   ASSERT_TRUE(name_constraints);
 
   EXPECT_EQ(GENERAL_NAME_RFC822_NAME,
@@ -892,7 +926,7 @@
                                      &constraints_der));
   CertErrors errors;
   std::unique_ptr<NameConstraints> name_constraints(NameConstraints::Create(
-      der::Input(&constraints_der), is_critical(), &errors));
+      der::Input(constraints_der), is_critical(), &errors));
   ASSERT_TRUE(name_constraints);
 
   EXPECT_EQ(GENERAL_NAME_RFC822_NAME,
@@ -951,7 +985,7 @@
                                      &constraints_der));
   CertErrors errors;
   std::unique_ptr<NameConstraints> name_constraints(NameConstraints::Create(
-      der::Input(&constraints_der), is_critical(), &errors));
+      der::Input(constraints_der), is_critical(), &errors));
   ASSERT_TRUE(name_constraints);
 
   EXPECT_EQ(GENERAL_NAME_RFC822_NAME,
@@ -1000,7 +1034,7 @@
                                      &constraints_der));
   CertErrors errors;
   std::unique_ptr<NameConstraints> name_constraints(NameConstraints::Create(
-      der::Input(&constraints_der), is_critical(), &errors));
+      der::Input(constraints_der), is_critical(), &errors));
   ASSERT_TRUE(name_constraints);
 
   EXPECT_EQ(GENERAL_NAME_RFC822_NAME,
@@ -1050,7 +1084,7 @@
                                      &constraints_der));
   CertErrors errors;
   std::unique_ptr<NameConstraints> name_constraints(NameConstraints::Create(
-      der::Input(&constraints_der), is_critical(), &errors));
+      der::Input(constraints_der), is_critical(), &errors));
   ASSERT_TRUE(name_constraints);
 
   EXPECT_EQ(GENERAL_NAME_RFC822_NAME,
@@ -1100,7 +1134,7 @@
                                      &constraints_der));
   CertErrors errors;
   std::unique_ptr<NameConstraints> name_constraints(NameConstraints::Create(
-      der::Input(&constraints_der), is_critical(), &errors));
+      der::Input(constraints_der), is_critical(), &errors));
   ASSERT_TRUE(name_constraints);
 
   EXPECT_EQ(GENERAL_NAME_RFC822_NAME,
@@ -1138,7 +1172,7 @@
                                      &constraints_der));
   CertErrors errors;
   std::unique_ptr<NameConstraints> name_constraints(NameConstraints::Create(
-      der::Input(&constraints_der), is_critical(), &errors));
+      der::Input(constraints_der), is_critical(), &errors));
   ASSERT_TRUE(name_constraints);
 
   EXPECT_EQ(GENERAL_NAME_RFC822_NAME,
@@ -1177,7 +1211,7 @@
                                      &constraints_der));
   CertErrors errors;
   std::unique_ptr<NameConstraints> name_constraints(NameConstraints::Create(
-      der::Input(&constraints_der), is_critical(), &errors));
+      der::Input(constraints_der), is_critical(), &errors));
   ASSERT_TRUE(name_constraints);
 
   EXPECT_EQ(GENERAL_NAME_RFC822_NAME,
@@ -1202,7 +1236,7 @@
                                      &constraints_der));
   CertErrors errors;
   std::unique_ptr<NameConstraints> name_constraints(NameConstraints::Create(
-      der::Input(&constraints_der), is_critical(), &errors));
+      der::Input(constraints_der), is_critical(), &errors));
   ASSERT_TRUE(name_constraints);
 
   EXPECT_EQ(GENERAL_NAME_RFC822_NAME,
@@ -1227,7 +1261,7 @@
                                      &constraints_der));
   CertErrors errors;
   std::unique_ptr<NameConstraints> name_constraints(NameConstraints::Create(
-      der::Input(&constraints_der), is_critical(), &errors));
+      der::Input(constraints_der), is_critical(), &errors));
   ASSERT_TRUE(name_constraints);
 
   EXPECT_EQ(GENERAL_NAME_RFC822_NAME,
@@ -1257,7 +1291,7 @@
       LoadTestNameConstraint("rfc822name-excluded-ipv4.pem", &constraints_der));
   CertErrors errors;
   std::unique_ptr<NameConstraints> name_constraints(NameConstraints::Create(
-      der::Input(&constraints_der), is_critical(), &errors));
+      der::Input(constraints_der), is_critical(), &errors));
   ASSERT_TRUE(name_constraints);
 
   EXPECT_EQ(GENERAL_NAME_RFC822_NAME,
@@ -1288,7 +1322,7 @@
       LoadTestNameConstraint("othername-excluded.pem", &constraints_der));
   CertErrors errors;
   std::unique_ptr<NameConstraints> name_constraints(NameConstraints::Create(
-      der::Input(&constraints_der), is_critical(), &errors));
+      der::Input(constraints_der), is_critical(), &errors));
   ASSERT_TRUE(name_constraints);
 
   std::string san_der;
@@ -1306,7 +1340,7 @@
                                      &constraints_der));
   CertErrors errors;
   std::unique_ptr<NameConstraints> name_constraints(NameConstraints::Create(
-      der::Input(&constraints_der), is_critical(), &errors));
+      der::Input(constraints_der), is_critical(), &errors));
   ASSERT_TRUE(name_constraints);
 
   std::string san_der;
@@ -1325,7 +1359,7 @@
                                      &constraints_der));
   CertErrors errors;
   std::unique_ptr<NameConstraints> name_constraints(NameConstraints::Create(
-      der::Input(&constraints_der), is_critical(), &errors));
+      der::Input(constraints_der), is_critical(), &errors));
   ASSERT_TRUE(name_constraints);
 
   std::string san_der;
@@ -1345,7 +1379,7 @@
       LoadTestNameConstraint("x400address-permitted.pem", &constraints_der));
   CertErrors errors;
   std::unique_ptr<NameConstraints> name_constraints(NameConstraints::Create(
-      der::Input(&constraints_der), is_critical(), &errors));
+      der::Input(constraints_der), is_critical(), &errors));
   ASSERT_TRUE(name_constraints);
 
   if (is_critical()) {
@@ -1368,7 +1402,7 @@
       LoadTestNameConstraint("x400address-excluded.pem", &constraints_der));
   CertErrors errors;
   std::unique_ptr<NameConstraints> name_constraints(NameConstraints::Create(
-      der::Input(&constraints_der), is_critical(), &errors));
+      der::Input(constraints_der), is_critical(), &errors));
   ASSERT_TRUE(name_constraints);
 
   if (is_critical()) {
@@ -1391,7 +1425,7 @@
       LoadTestNameConstraint("edipartyname-permitted.pem", &constraints_der));
   CertErrors errors;
   std::unique_ptr<NameConstraints> name_constraints(NameConstraints::Create(
-      der::Input(&constraints_der), is_critical(), &errors));
+      der::Input(constraints_der), is_critical(), &errors));
   ASSERT_TRUE(name_constraints);
 
   if (is_critical()) {
@@ -1414,7 +1448,7 @@
       LoadTestNameConstraint("edipartyname-excluded.pem", &constraints_der));
   CertErrors errors;
   std::unique_ptr<NameConstraints> name_constraints(NameConstraints::Create(
-      der::Input(&constraints_der), is_critical(), &errors));
+      der::Input(constraints_der), is_critical(), &errors));
   ASSERT_TRUE(name_constraints);
 
   if (is_critical()) {
@@ -1436,7 +1470,7 @@
   ASSERT_TRUE(LoadTestNameConstraint("uri-permitted.pem", &constraints_der));
   CertErrors errors;
   std::unique_ptr<NameConstraints> name_constraints(NameConstraints::Create(
-      der::Input(&constraints_der), is_critical(), &errors));
+      der::Input(constraints_der), is_critical(), &errors));
   ASSERT_TRUE(name_constraints);
 
   if (is_critical()) {
@@ -1458,7 +1492,7 @@
   ASSERT_TRUE(LoadTestNameConstraint("uri-excluded.pem", &constraints_der));
   CertErrors errors;
   std::unique_ptr<NameConstraints> name_constraints(NameConstraints::Create(
-      der::Input(&constraints_der), is_critical(), &errors));
+      der::Input(constraints_der), is_critical(), &errors));
   ASSERT_TRUE(name_constraints);
 
   if (is_critical()) {
@@ -1481,7 +1515,7 @@
       LoadTestNameConstraint("registeredid-permitted.pem", &constraints_der));
   CertErrors errors;
   std::unique_ptr<NameConstraints> name_constraints(NameConstraints::Create(
-      der::Input(&constraints_der), is_critical(), &errors));
+      der::Input(constraints_der), is_critical(), &errors));
   ASSERT_TRUE(name_constraints);
 
   if (is_critical()) {
@@ -1504,7 +1538,7 @@
       LoadTestNameConstraint("registeredid-excluded.pem", &constraints_der));
   CertErrors errors;
   std::unique_ptr<NameConstraints> name_constraints(NameConstraints::Create(
-      der::Input(&constraints_der), is_critical(), &errors));
+      der::Input(constraints_der), is_critical(), &errors));
   ASSERT_TRUE(name_constraints);
 
   if (is_critical()) {
@@ -1530,7 +1564,7 @@
   // could be changed to allowed if there are buggy encoders out there that
   // include it anyway.
   CertErrors errors;
-  EXPECT_FALSE(NameConstraints::Create(der::Input(&constraints_der),
+  EXPECT_FALSE(NameConstraints::Create(der::Input(constraints_der),
                                        is_critical(), &errors));
 }
 
@@ -1539,7 +1573,7 @@
   ASSERT_TRUE(
       LoadTestNameConstraint("dnsname-with_min_1.pem", &constraints_der));
   CertErrors errors;
-  EXPECT_FALSE(NameConstraints::Create(der::Input(&constraints_der),
+  EXPECT_FALSE(NameConstraints::Create(der::Input(constraints_der),
                                        is_critical(), &errors));
 }
 
@@ -1549,7 +1583,7 @@
   ASSERT_TRUE(LoadTestNameConstraint("dnsname-with_min_0_and_max.pem",
                                      &constraints_der));
   CertErrors errors;
-  EXPECT_FALSE(NameConstraints::Create(der::Input(&constraints_der),
+  EXPECT_FALSE(NameConstraints::Create(der::Input(constraints_der),
                                        is_critical(), &errors));
 }
 
@@ -1558,7 +1592,7 @@
   ASSERT_TRUE(LoadTestNameConstraint("dnsname-with_min_1_and_max.pem",
                                      &constraints_der));
   CertErrors errors;
-  EXPECT_FALSE(NameConstraints::Create(der::Input(&constraints_der),
+  EXPECT_FALSE(NameConstraints::Create(der::Input(constraints_der),
                                        is_critical(), &errors));
 }
 
@@ -1566,14 +1600,14 @@
   std::string constraints_der;
   ASSERT_TRUE(LoadTestNameConstraint("dnsname-with_max.pem", &constraints_der));
   CertErrors errors;
-  EXPECT_FALSE(NameConstraints::Create(der::Input(&constraints_der),
+  EXPECT_FALSE(NameConstraints::Create(der::Input(constraints_der),
                                        is_critical(), &errors));
 }
 
 TEST_P(ParseNameConstraints, FailsOnEmptyExtensionValue) {
   std::string constraints_der = "";
   CertErrors errors;
-  EXPECT_FALSE(NameConstraints::Create(der::Input(&constraints_der),
+  EXPECT_FALSE(NameConstraints::Create(der::Input(constraints_der),
                                        is_critical(), &errors));
 }
 
@@ -1582,7 +1616,7 @@
   ASSERT_TRUE(
       LoadTestNameConstraint("invalid-no_subtrees.pem", &constraints_der));
   CertErrors errors;
-  EXPECT_FALSE(NameConstraints::Create(der::Input(&constraints_der),
+  EXPECT_FALSE(NameConstraints::Create(der::Input(constraints_der),
                                        is_critical(), &errors));
 }
 
@@ -1591,7 +1625,7 @@
   ASSERT_TRUE(LoadTestNameConstraint("invalid-empty_permitted_subtree.pem",
                                      &constraints_der));
   CertErrors errors;
-  EXPECT_FALSE(NameConstraints::Create(der::Input(&constraints_der),
+  EXPECT_FALSE(NameConstraints::Create(der::Input(constraints_der),
                                        is_critical(), &errors));
 }
 
@@ -1600,7 +1634,7 @@
   ASSERT_TRUE(LoadTestNameConstraint("invalid-empty_excluded_subtree.pem",
                                      &constraints_der));
   CertErrors errors;
-  EXPECT_FALSE(NameConstraints::Create(der::Input(&constraints_der),
+  EXPECT_FALSE(NameConstraints::Create(der::Input(constraints_der),
                                        is_critical(), &errors));
 }
 
@@ -1610,7 +1644,7 @@
   ASSERT_TRUE(LoadTestNameConstraint("directoryname.pem", &constraints_der));
   CertErrors errors;
   std::unique_ptr<NameConstraints> name_constraints(NameConstraints::Create(
-      der::Input(&constraints_der), is_critical(), &errors));
+      der::Input(constraints_der), is_critical(), &errors));
   ASSERT_TRUE(name_constraints);
 
   std::string name;
@@ -1618,14 +1652,14 @@
   // Name constraints don't contain rfc822Name, so emailAddress in subject is
   // allowed regardless.
   EXPECT_TRUE(IsPermittedCert(name_constraints.get(),
-                              SequenceValueFromString(&name),
+                              SequenceValueFromString(name),
                               /*subject_alt_names=*/nullptr));
 
   ASSERT_TRUE(LoadTestName("name-us-arizona-email-invalidstring.pem", &name));
   // Name constraints don't contain rfc822Name, so emailAddress in subject is
   // allowed regardless.
   EXPECT_TRUE(IsPermittedCert(name_constraints.get(),
-                              SequenceValueFromString(&name),
+                              SequenceValueFromString(name),
                               /*subject_alt_names=*/nullptr));
 }
 
@@ -1635,7 +1669,7 @@
                                      &constraints_der));
   CertErrors errors;
   std::unique_ptr<NameConstraints> name_constraints(NameConstraints::Create(
-      der::Input(&constraints_der), is_critical(), &errors));
+      der::Input(constraints_der), is_critical(), &errors));
   ASSERT_TRUE(name_constraints);
 
   std::string name;
@@ -1644,21 +1678,21 @@
   // Name constraints contain rfc822Name, and the address matches the
   // constraint (which is all addresses on the hostname.)
   EXPECT_TRUE(IsPermittedCert(name_constraints.get(),
-                              SequenceValueFromString(&name),
+                              SequenceValueFromString(name),
                               /*subject_alt_names=*/nullptr));
 
   ASSERT_TRUE(LoadTestName("name-us-arizona-email-invalidstring.pem", &name));
   // The bytes of the name string match, but the string type is VISIBLESTRING
   // which is not supported, so this should fail.
   EXPECT_FALSE(IsPermittedCert(name_constraints.get(),
-                               SequenceValueFromString(&name),
+                               SequenceValueFromString(name),
                                /*subject_alt_names=*/nullptr));
 
   ASSERT_TRUE(LoadTestName("name-us-arizona-email-multiple.pem", &name));
   // Subject contains multiple rfc822Names, and they all match the constraint
   // (which is all addresses on the hostname.)
   EXPECT_TRUE(IsPermittedCert(name_constraints.get(),
-                              SequenceValueFromString(&name),
+                              SequenceValueFromString(name),
                               /*subject_alt_names=*/nullptr));
 }
 
@@ -1668,7 +1702,7 @@
       LoadTestNameConstraint("rfc822name-permitted.pem", &constraints_der));
   CertErrors errors;
   std::unique_ptr<NameConstraints> name_constraints(NameConstraints::Create(
-      der::Input(&constraints_der), is_critical(), &errors));
+      der::Input(constraints_der), is_critical(), &errors));
   ASSERT_TRUE(name_constraints);
 
   std::string name;
@@ -1677,21 +1711,21 @@
   // Name constraints contain rfc822Name, and the address does not match the
   // constraint.
   EXPECT_FALSE(IsPermittedCert(name_constraints.get(),
-                               SequenceValueFromString(&name),
+                               SequenceValueFromString(name),
                                /*subject_alt_names=*/nullptr));
 
   // Address is a case-insensitive match, but name constraints (permitted) are
   // case-sensitive, so this fails.
   ASSERT_TRUE(LoadTestName("name-us-arizona-email-localpartcase.pem", &name));
   EXPECT_FALSE(IsPermittedCert(name_constraints.get(),
-                               SequenceValueFromString(&name),
+                               SequenceValueFromString(name),
                                /*subject_alt_names=*/nullptr));
 
   ASSERT_TRUE(LoadTestName("name-us-arizona-email-multiple.pem", &name));
   // Subject contains multiple rfc822Names, and only the first one matches the
   // constraint.
   EXPECT_FALSE(IsPermittedCert(name_constraints.get(),
-                               SequenceValueFromString(&name),
+                               SequenceValueFromString(name),
                                /*subject_alt_names=*/nullptr));
 }
 
@@ -1701,7 +1735,7 @@
       LoadTestNameConstraint("rfc822name-excluded.pem", &constraints_der));
   CertErrors errors;
   std::unique_ptr<NameConstraints> name_constraints(NameConstraints::Create(
-      der::Input(&constraints_der), is_critical(), &errors));
+      der::Input(constraints_der), is_critical(), &errors));
   ASSERT_TRUE(name_constraints);
 
   std::string name;
@@ -1710,21 +1744,21 @@
   // Name constraints contain excluded rfc822Name, and the address does not
   // match the constraint.
   EXPECT_TRUE(IsPermittedCert(name_constraints.get(),
-                              SequenceValueFromString(&name),
+                              SequenceValueFromString(name),
                               /*subject_alt_names=*/nullptr));
 
   // Name constraints for excluded are done case-insensitive in the local part,
   // so this is not allowed.
   ASSERT_TRUE(LoadTestName("name-us-arizona-email-localpartcase.pem", &name));
   EXPECT_FALSE(IsPermittedCert(name_constraints.get(),
-                               SequenceValueFromString(&name),
+                               SequenceValueFromString(name),
                                /*subject_alt_names=*/nullptr));
 
   ASSERT_TRUE(LoadTestName("name-us-arizona-email-multiple.pem", &name));
   // Subject contains multiple rfc822Names, and one of them is excluded by the
   // constraint.
   EXPECT_FALSE(IsPermittedCert(name_constraints.get(),
-                               SequenceValueFromString(&name),
+                               SequenceValueFromString(name),
                                /*subject_alt_names=*/nullptr));
 }
 
@@ -1737,7 +1771,7 @@
                                      &constraints_der));
   CertErrors errors;
   std::unique_ptr<NameConstraints> name_constraints(NameConstraints::Create(
-      der::Input(&constraints_der), is_critical(), &errors));
+      der::Input(constraints_der), is_critical(), &errors));
   ASSERT_TRUE(name_constraints);
 
   std::string name_us_az_foocom;
@@ -1746,7 +1780,7 @@
   // (The commonName hostname is not within permitted dNSName constraints, so
   // this would not be permitted if hostnames in commonName were checked.)
   EXPECT_TRUE(IsPermittedCert(name_constraints.get(),
-                              SequenceValueFromString(&name_us_az_foocom),
+                              SequenceValueFromString(name_us_az_foocom),
                               nullptr /* subject_alt_names */));
 
   std::string name_us_az_permitted;
@@ -1756,7 +1790,7 @@
   // permitted dNSName constraints, so this should be permitted regardless if
   // hostnames in commonName are checked or not.
   EXPECT_TRUE(IsPermittedCert(name_constraints.get(),
-                              SequenceValueFromString(&name_us_az_permitted),
+                              SequenceValueFromString(name_us_az_permitted),
                               nullptr /* subject_alt_names */));
 
   std::string name_us_ca_permitted;
@@ -1766,7 +1800,7 @@
   // this should not be allowed, regardless of checking the
   // permitted.example.com in commonName.
   EXPECT_FALSE(IsPermittedCert(name_constraints.get(),
-                               SequenceValueFromString(&name_us_ca_permitted),
+                               SequenceValueFromString(name_us_ca_permitted),
                                nullptr /* subject_alt_names */));
 }
 
@@ -1779,7 +1813,7 @@
       "directoryname_and_dnsname_and_ipaddress.pem", &constraints_der));
   CertErrors errors;
   std::unique_ptr<NameConstraints> name_constraints(NameConstraints::Create(
-      der::Input(&constraints_der), is_critical(), &errors));
+      der::Input(constraints_der), is_critical(), &errors));
   ASSERT_TRUE(name_constraints);
 
   std::string name_us_az_1_1_1_1;
@@ -1788,7 +1822,7 @@
   // (The commonName IP address is not within permitted iPAddresses constraints,
   // so this would not be permitted if IP addresses in commonName were checked.)
   EXPECT_TRUE(IsPermittedCert(name_constraints.get(),
-                              SequenceValueFromString(&name_us_az_1_1_1_1),
+                              SequenceValueFromString(name_us_az_1_1_1_1),
                               nullptr /* subject_alt_names */));
 
   std::string name_us_az_192_168_1_1;
@@ -1798,7 +1832,7 @@
   // permitted iPAddress constraints, so this should be permitted regardless if
   // IP addresses in commonName are checked or not.
   EXPECT_TRUE(IsPermittedCert(name_constraints.get(),
-                              SequenceValueFromString(&name_us_az_192_168_1_1),
+                              SequenceValueFromString(name_us_az_192_168_1_1),
                               nullptr /* subject_alt_names */));
 
   std::string name_us_ca_192_168_1_1;
@@ -1808,7 +1842,7 @@
   // this should not be allowed, regardless of checking the
   // IP address in commonName.
   EXPECT_FALSE(IsPermittedCert(name_constraints.get(),
-                               SequenceValueFromString(&name_us_ca_192_168_1_1),
+                               SequenceValueFromString(name_us_ca_192_168_1_1),
                                nullptr /* subject_alt_names */));
 
   std::string name_us_az_ipv6;
@@ -1817,7 +1851,7 @@
   // (The commonName is an ipv6 address which wasn't supported in the past, but
   // since commonName checking is ignored entirely, this is permitted.)
   EXPECT_TRUE(IsPermittedCert(name_constraints.get(),
-                              SequenceValueFromString(&name_us_az_ipv6),
+                              SequenceValueFromString(name_us_az_ipv6),
                               nullptr /* subject_alt_names */));
 }
 
diff --git a/pki/ocsp.h b/pki/ocsp.h
index c5bbd89..496378b 100644
--- a/pki/ocsp.h
+++ b/pki/ocsp.h
@@ -5,8 +5,8 @@
 #ifndef BSSL_PKI_OCSP_H_
 #define BSSL_PKI_OCSP_H_
 
-#include "webutil/url/url.h"
 #include "fillins/openssl_util.h"
+#include "webutil/url/url.h"
 #include <memory>
 #include <vector>
 
diff --git a/pki/ocsp_unittest.cc b/pki/ocsp_unittest.cc
index 80137ff..32fc1f3 100644
--- a/pki/ocsp_unittest.cc
+++ b/pki/ocsp_unittest.cc
@@ -175,8 +175,7 @@
   std::vector<uint8_t> encoded_request;
   ASSERT_TRUE(CreateOCSPRequest(cert.get(), issuer.get(), &encoded_request));
 
-  EXPECT_EQ(der::Input(encoded_request.data(), encoded_request.size()),
-            der::Input(&request_data));
+  EXPECT_EQ(der::Input(encoded_request), der::Input(request_data));
 }
 
 std::string_view kGetURLTestParams[] = {
diff --git a/pki/parse_certificate_unittest.cc b/pki/parse_certificate_unittest.cc
index 196d401..fc79ca3 100644
--- a/pki/parse_certificate_unittest.cc
+++ b/pki/parse_certificate_unittest.cc
@@ -63,7 +63,7 @@
   der::BitString signature_value;
   CertErrors errors;
   bool actual_result =
-      ParseCertificate(der::Input(&data), &tbs_certificate_tlv,
+      ParseCertificate(der::Input(data), &tbs_certificate_tlv,
                        &signature_algorithm_tlv, &signature_value, &errors);
 
   EXPECT_EQ(expected_result, actual_result);
@@ -72,10 +72,10 @@
   // Ensure that the parsed certificate matches expectations.
   if (expected_result && actual_result) {
     EXPECT_EQ(0, signature_value.unused_bits());
-    EXPECT_EQ(der::Input(&expected_signature), signature_value.bytes());
-    EXPECT_EQ(der::Input(&expected_signature_algorithm),
+    EXPECT_EQ(der::Input(expected_signature), signature_value.bytes());
+    EXPECT_EQ(der::Input(expected_signature_algorithm),
               signature_algorithm_tlv);
-    EXPECT_EQ(der::Input(&expected_tbs_certificate), tbs_certificate_tlv);
+    EXPECT_EQ(der::Input(expected_tbs_certificate), tbs_certificate_tlv);
   }
 }
 
@@ -167,7 +167,7 @@
   ParsedTbsCertificate parsed;
   CertErrors errors;
   bool actual_result =
-      ParseTbsCertificate(der::Input(&data), {}, &parsed, &errors);
+      ParseTbsCertificate(der::Input(data), {}, &parsed, &errors);
 
   EXPECT_EQ(expected_result, actual_result);
   VerifyCertErrors(expected_errors, errors, test_file_path);
@@ -178,36 +178,36 @@
   // Ensure that the ParsedTbsCertificate matches expectations.
   EXPECT_EQ(expected_version, parsed.version);
 
-  EXPECT_EQ(der::Input(&expected_serial_number), parsed.serial_number);
-  EXPECT_EQ(der::Input(&expected_signature_algorithm),
+  EXPECT_EQ(der::Input(expected_serial_number), parsed.serial_number);
+  EXPECT_EQ(der::Input(expected_signature_algorithm),
             parsed.signature_algorithm_tlv);
 
-  EXPECT_EQ(der::Input(&expected_issuer), parsed.issuer_tlv);
+  EXPECT_EQ(der::Input(expected_issuer), parsed.issuer_tlv);
 
   // In the test expectations PEM file, validity is described as a
   // textual string of the parsed value (rather than as DER).
   EXPECT_EQ(expected_validity_not_before, ToString(parsed.validity_not_before));
   EXPECT_EQ(expected_validity_not_after, ToString(parsed.validity_not_after));
 
-  EXPECT_EQ(der::Input(&expected_subject), parsed.subject_tlv);
-  EXPECT_EQ(der::Input(&expected_spki), parsed.spki_tlv);
+  EXPECT_EQ(der::Input(expected_subject), parsed.subject_tlv);
+  EXPECT_EQ(der::Input(expected_spki), parsed.spki_tlv);
 
   EXPECT_EQ(!expected_issuer_unique_id.empty(),
             parsed.issuer_unique_id.has_value());
   if (parsed.issuer_unique_id.has_value()) {
-    EXPECT_EQ(der::Input(&expected_issuer_unique_id),
+    EXPECT_EQ(der::Input(expected_issuer_unique_id),
               parsed.issuer_unique_id->bytes());
   }
   EXPECT_EQ(!expected_subject_unique_id.empty(),
             parsed.subject_unique_id.has_value());
   if (parsed.subject_unique_id.has_value()) {
-    EXPECT_EQ(der::Input(&expected_subject_unique_id),
+    EXPECT_EQ(der::Input(expected_subject_unique_id),
               parsed.subject_unique_id->bytes());
   }
 
   EXPECT_EQ(!expected_extensions.empty(), parsed.extensions_tlv.has_value());
   if (parsed.extensions_tlv) {
-    EXPECT_EQ(der::Input(&expected_extensions), parsed.extensions_tlv.value());
+    EXPECT_EQ(der::Input(expected_extensions), parsed.extensions_tlv.value());
   }
 }
 
@@ -1008,7 +1008,7 @@
       file_name;
   EXPECT_TRUE(ReadTestDataFromPemFile(test_file_path, mappings));
 
-  return ParseAuthorityKeyIdentifier(der::Input(backing_bytes),
+  return ParseAuthorityKeyIdentifier(der::Input(*backing_bytes),
                                      authority_key_identifier);
 }
 
diff --git a/pki/parse_name_unittest.cc b/pki/parse_name_unittest.cc
index a3585bb..fec2e07 100644
--- a/pki/parse_name_unittest.cc
+++ b/pki/parse_name_unittest.cc
@@ -201,7 +201,7 @@
   ASSERT_TRUE(
       LoadTestData("invalid", "AttributeTypeAndValue", "extradata", &invalid));
   RDNSequence atv;
-  ASSERT_FALSE(ParseName(SequenceValueFromString(&invalid), &atv));
+  ASSERT_FALSE(ParseName(SequenceValueFromString(invalid), &atv));
 }
 
 TEST(ParseNameTest, InvalidNameEmpty) {
@@ -209,7 +209,7 @@
   ASSERT_TRUE(
       LoadTestData("invalid", "AttributeTypeAndValue", "empty", &invalid));
   RDNSequence atv;
-  ASSERT_FALSE(ParseName(SequenceValueFromString(&invalid), &atv));
+  ASSERT_FALSE(ParseName(SequenceValueFromString(invalid), &atv));
 }
 
 TEST(ParseNameTest, InvalidNameBadType) {
@@ -217,7 +217,7 @@
   ASSERT_TRUE(LoadTestData("invalid", "AttributeTypeAndValue",
                            "badAttributeType", &invalid));
   RDNSequence atv;
-  ASSERT_FALSE(ParseName(SequenceValueFromString(&invalid), &atv));
+  ASSERT_FALSE(ParseName(SequenceValueFromString(invalid), &atv));
 }
 
 TEST(ParseNameTest, InvalidNameNotSequence) {
@@ -225,21 +225,21 @@
   ASSERT_TRUE(LoadTestData("invalid", "AttributeTypeAndValue", "setNotSequence",
                            &invalid));
   RDNSequence atv;
-  ASSERT_FALSE(ParseName(SequenceValueFromString(&invalid), &atv));
+  ASSERT_FALSE(ParseName(SequenceValueFromString(invalid), &atv));
 }
 
 TEST(ParseNameTest, InvalidNameNotSet) {
   std::string invalid;
   ASSERT_TRUE(LoadTestData("invalid", "RDN", "sequenceInsteadOfSet", &invalid));
   RDNSequence atv;
-  ASSERT_FALSE(ParseName(SequenceValueFromString(&invalid), &atv));
+  ASSERT_FALSE(ParseName(SequenceValueFromString(invalid), &atv));
 }
 
 TEST(ParseNameTest, InvalidNameEmptyRdn) {
   std::string invalid;
   ASSERT_TRUE(LoadTestData("invalid", "RDN", "empty", &invalid));
   RDNSequence atv;
-  ASSERT_FALSE(ParseName(SequenceValueFromString(&invalid), &atv));
+  ASSERT_FALSE(ParseName(SequenceValueFromString(invalid), &atv));
 }
 
 TEST(ParseNameTest, RFC2253FormatBasic) {
diff --git a/pki/parsed_certificate.h b/pki/parsed_certificate.h
index 20fd895..5fbef82 100644
--- a/pki/parsed_certificate.h
+++ b/pki/parsed_certificate.h
@@ -110,7 +110,7 @@
   // Sequence tag). This is guaranteed to be valid DER, though the contents of
   // unhandled string types are treated as raw bytes.
   der::Input normalized_subject() const {
-    return der::Input(&normalized_subject_);
+    return der::Input(normalized_subject_);
   }
   // Returns the DER-encoded raw issuer value (including the outer sequence
   // tag). This is guaranteed to be valid DER, though the contents of unhandled
@@ -120,7 +120,7 @@
   // Sequence tag). This is guaranteed to be valid DER, though the contents of
   // unhandled string types are treated as raw bytes.
   der::Input normalized_issuer() const {
-    return der::Input(&normalized_issuer_);
+    return der::Input(normalized_issuer_);
   }
 
   // Returns true if the certificate has a BasicConstraints extension.
diff --git a/pki/path_builder_pkits_unittest.cc b/pki/path_builder_pkits_unittest.cc
index b49a34d..620205c 100644
--- a/pki/path_builder_pkits_unittest.cc
+++ b/pki/path_builder_pkits_unittest.cc
@@ -5,7 +5,6 @@
 #include "path_builder.h"
 
 #include <cstdint>
-#include <iostream>
 
 #include "fillins/log.h"
 #include "fillins/net_errors.h"
@@ -237,7 +236,7 @@
       for (size_t i = 0; i < result.paths.size(); ++i) {
         const CertPathBuilderResultPath* result_path =
             result.paths[i].get();
-        std::cerr << "path " << i << " errors:\n"
+        LOG(ERROR) << "path " << i << " errors:\n"
                    << result_path->errors.ToDebugString(result_path->certs);
       }
     }
diff --git a/pki/signature_algorithm_unittest.cc b/pki/signature_algorithm_unittest.cc
index 1c420a3..9673ab2 100644
--- a/pki/signature_algorithm_unittest.cc
+++ b/pki/signature_algorithm_unittest.cc
@@ -1155,8 +1155,7 @@
         0x04, 0x02, 0x03, 0xa2, 0x03, 0x02, 0x01, 0x40},
        SignatureAlgorithm::kRsaPssSha512}};
   for (const auto& t : kValidTests) {
-    EXPECT_EQ(ParseSignatureAlgorithm(der::Input(t.data.data(), t.data.size())),
-              t.expected);
+    EXPECT_EQ(ParseSignatureAlgorithm(der::Input(t.data)), t.expected);
   }
 
   struct {
@@ -1346,8 +1345,7 @@
         0x05, 0x00, 0xa2, 0x03, 0x02, 0x01, 0x41}},
   };
   for (const auto& t : kInvalidTests) {
-    EXPECT_FALSE(
-        ParseSignatureAlgorithm(der::Input(t.data.data(), t.data.size())));
+    EXPECT_FALSE(ParseSignatureAlgorithm(der::Input(t.data)));
   }
 }
 
diff --git a/pki/simple_path_builder_delegate_unittest.cc b/pki/simple_path_builder_delegate_unittest.cc
index 7d47406..7b6206c 100644
--- a/pki/simple_path_builder_delegate_unittest.cc
+++ b/pki/simple_path_builder_delegate_unittest.cc
@@ -38,11 +38,11 @@
   ASSERT_TRUE(ReadTestDataFromPemFile(path, mappings));
 
   std::optional<SignatureAlgorithm> sigalg_opt =
-      ParseSignatureAlgorithm(der::Input(&algorithm_str));
+      ParseSignatureAlgorithm(der::Input(algorithm_str));
   ASSERT_TRUE(sigalg_opt);
   *signature_algorithm = *sigalg_opt;
 
-  ASSERT_TRUE(ParsePublicKey(der::Input(&public_key_str), public_key));
+  ASSERT_TRUE(ParsePublicKey(der::Input(public_key_str), public_key));
 }
 
 class SimplePathBuilderDelegate1024SuccessTest
diff --git a/pki/test_helpers.cc b/pki/test_helpers.cc
index 98487d7..36f0ffb 100644
--- a/pki/test_helpers.cc
+++ b/pki/test_helpers.cc
@@ -110,7 +110,7 @@
 
 }  // namespace der
 
-der::Input SequenceValueFromString(const std::string* s) {
+der::Input SequenceValueFromString(std::string_view s) {
   der::Parser parser((der::Input(s)));
   der::Input data;
   if (!parser.ReadTag(der::kSequence, &data)) {
@@ -284,7 +284,7 @@
       if (value == "DEFAULT") {
         value = "211005120000Z";
       }
-      if (!der::ParseUTCTime(der::Input(&value), &test->time)) {
+      if (!der::ParseUTCTime(der::Input(value), &test->time)) {
         ADD_FAILURE() << "Failed parsing UTC time";
         return false;
       }
diff --git a/pki/test_helpers.h b/pki/test_helpers.h
index 73e8afd..6857dd3 100644
--- a/pki/test_helpers.h
+++ b/pki/test_helpers.h
@@ -9,6 +9,7 @@
 
 #include <ostream>
 #include <string>
+#include <string_view>
 #include <vector>
 
 #include "parsed_certificate.h"
@@ -33,7 +34,7 @@
 //
 // The returned der::Input() is only valid so long as the input string is alive
 // and is not mutated.
-der::Input SequenceValueFromString(const std::string* s);
+der::Input SequenceValueFromString(std::string_view s);
 
 // Helper structure that maps a PEM block header (for instance "CERTIFICATE") to
 // the destination where the value for that block should be written.
diff --git a/pki/testdata/name_constraints_unittest/generate_name_constraints.py b/pki/testdata/name_constraints_unittest/generate_name_constraints.py
index bf7e89b..0c474a7 100755
--- a/pki/testdata/name_constraints_unittest/generate_name_constraints.py
+++ b/pki/testdata/name_constraints_unittest/generate_name_constraints.py
@@ -317,6 +317,23 @@
                                  enforce_length=False))
   generate(c, "ipaddress-invalid_addr.pem")
 
+  v4_mapped_prefix = (0, ) * 10 + (255, ) * 2
+  v4_mapped_mask = (255, ) * 12
+  c = NameConstraintsGenerator()
+  c.add_permitted(ip_address_range((192, 168, 1, 0), (255, 255, 255, 0)))
+  c.add_excluded(ip_address_range((192, 168, 1, 1), (255, 255, 255, 255)))
+  c.add_excluded(
+      ip_address_range(v4_mapped_prefix + (192, 168, 1, 2),
+                       v4_mapped_mask + (255, 255, 255, 255)))
+  c.add_permitted(
+      ip_address_range(v4_mapped_prefix + (192, 168, 2, 0),
+                       v4_mapped_mask + (255, 255, 255, 0)))
+  c.add_excluded(
+      ip_address_range(v4_mapped_prefix + (192, 168, 2, 1),
+                       v4_mapped_mask + (255, 255, 255, 255)))
+  c.add_excluded(ip_address_range((192, 168, 2, 2), (255, 255, 255, 255)))
+  generate(c, "ipaddress-mapped_addrs.pem")
+
   n_us = generate_names.NameGenerator()
   n_us.add_rdn().add_attr('countryName', 'PRINTABLESTRING', 'US')
   generate(n_us, "name-us.pem")
diff --git a/pki/testdata/name_constraints_unittest/ipaddress-mapped_addrs.pem b/pki/testdata/name_constraints_unittest/ipaddress-mapped_addrs.pem
new file mode 100644
index 0000000..62dc085
--- /dev/null
+++ b/pki/testdata/name_constraints_unittest/ipaddress-mapped_addrs.pem
@@ -0,0 +1,29 @@
+SEQUENCE {
+  [0] {
+    SEQUENCE {
+      [7 PRIMITIVE] { `c0a80100ffffff00` }
+    }
+    SEQUENCE {
+      [7 PRIMITIVE] { `00000000000000000000ffffc0a80200ffffffffffffffffffffffffffffff00` }
+    }
+  }
+  [1] {
+    SEQUENCE {
+      [7 PRIMITIVE] { `c0a80101ffffffff` }
+    }
+    SEQUENCE {
+      [7 PRIMITIVE] { `00000000000000000000ffffc0a80102ffffffffffffffffffffffffffffffff` }
+    }
+    SEQUENCE {
+      [7 PRIMITIVE] { `00000000000000000000ffffc0a80201ffffffffffffffffffffffffffffffff` }
+    }
+    SEQUENCE {
+      [7 PRIMITIVE] { `c0a80202ffffffff` }
+    }
+  }
+}
+-----BEGIN NAME CONSTRAINTS-----
+MIGUoDAwCocIwKgBAP///wAwIocgAAAAAAAAAAAAAP//wKgCAP///////////////////wChYDAK
+hwjAqAEB/////zAihyAAAAAAAAAAAAAA///AqAEC/////////////////////zAihyAAAAAAAAAA
+AAAA///AqAIB/////////////////////zAKhwjAqAIC/////w==
+-----END NAME CONSTRAINTS-----
diff --git a/pki/testdata/ssl/certificates/README b/pki/testdata/ssl/certificates/README
index c56b7e1..6e3db64 100644
--- a/pki/testdata/ssl/certificates/README
+++ b/pki/testdata/ssl/certificates/README
@@ -46,10 +46,6 @@
      purposes is not recommended. This needs to be updated periodically so the
      server name the cert is valid for may change.
 
-- treadclimber.pem: A chain where the leaf does not contain embedded SCTs,
-  and which has a notBefore date after 2018/10/15. Expires 2020/02/07.
-- treadclimber.sctlist: The TLS encoded SignedCertificateTimestampList for the
-  treadclimber.pem leaf certificate.
 - lets-encrypt-dst-x3-root.pem: A chain that ends in the Lets encrypt DST X3
   root (https://crt.sh/?id=8395). Has the same leaf as
   lets-encrypt-isrg-x1-root.pem.
@@ -193,18 +189,15 @@
      Certificates for testing EV display (including regression test for
      https://crbug.com/1069113).
 
-===== From net/data/ssl/scripts/generate-weak-test-chains.sh
-- 2048-rsa-root.pem
-- {768-rsa,1024-rsa,2048-rsa,prime256v1-ecdsa}-intermediate.pem
-- {768-rsa,1024-rsa,2048-rsa,prime256v1-ecdsa}-ee-by-
-      {768-rsa,1024-rsa,2048-rsa,prime256v1-ecdsa}-intermediate.pem
-      Test certificates used to ensure that weak keys are detected and rejected
-
-===== From net/data/ssl/scripts/generate-cross-signed-certs.sh
-- cross-signed-leaf.pem
-- cross-signed-root-md5.pem
-- cross-signed-root-sha256.pem
-     A certificate chain for regression testing http://crbug.com/108514
+===== From net/data/ssl/scripts/generate-test-keys.sh
+- rsa-{768,1024,2048}-{1..3}.key
+- ec-prime256v1-{1..3}.key
+     Pre-generated keys of various types/sizes.
+     Useful for tests that generate RSA certificates with CertBuilder without
+     having to pay the cost of generating RSA keys at runtime. Multiple keys
+     of each size are provided. (EC keys are cheap to generate at runtime, but
+     having some as files simplifies test logic in cases where the test is
+     reading both RSA and EC keys from files.)
 
 ===== From net/data/ssl/scripts/generate-redundant-test-chains.sh
 - redundant-validated-chain.pem
diff --git a/pki/testdata/ssl/certificates/ec-prime256v1-1.key b/pki/testdata/ssl/certificates/ec-prime256v1-1.key
new file mode 100644
index 0000000..43ba034
--- /dev/null
+++ b/pki/testdata/ssl/certificates/ec-prime256v1-1.key
@@ -0,0 +1,5 @@
+-----BEGIN PRIVATE KEY-----
+MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQg8YeFfq6kLtUZziTV
+eBxKf4sdzWhBIrmoa7R6IQ/L0g2hRANCAATwrGqIPnPdqDreHFlZqECUQ0AjHbyi
+NWFYmGc3FkPsCS1MWu2WhMYdw7UuLDdMKge7Q6IWMsHum/4G04hRdTYL
+-----END PRIVATE KEY-----
diff --git a/pki/testdata/ssl/certificates/ec-prime256v1-2.key b/pki/testdata/ssl/certificates/ec-prime256v1-2.key
new file mode 100644
index 0000000..bfdcc94
--- /dev/null
+++ b/pki/testdata/ssl/certificates/ec-prime256v1-2.key
@@ -0,0 +1,5 @@
+-----BEGIN PRIVATE KEY-----
+MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgSCf4GodSLqPExkQ0
+Ik8+89ysmrauzOM+YOw7a6XXxpOhRANCAASTFjEdz9MMLzVvqiKJ6hiEmG7+tfn1
+6r5Odwu8dkIr69J5RljzPLAbHXN4kXF/ohZbBvKnX+1cEUDO+kBtAHMB
+-----END PRIVATE KEY-----
diff --git a/pki/testdata/ssl/certificates/ec-prime256v1-3.key b/pki/testdata/ssl/certificates/ec-prime256v1-3.key
new file mode 100644
index 0000000..de0b671
--- /dev/null
+++ b/pki/testdata/ssl/certificates/ec-prime256v1-3.key
@@ -0,0 +1,5 @@
+-----BEGIN PRIVATE KEY-----
+MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgSFwCrUE0q+J8WdaB
+wuQtvtQuvSVy4xrVUVKbg/b8qmShRANCAAQ0MQNe+C3m+ZxRjUC2VHut66EhAqDQ
+EXOCJ3se7ctMpdmVa2ml/4cjz3lnrfbSYe/mM5v3hDN8u8dYmk7zDoL3
+-----END PRIVATE KEY-----
diff --git a/pki/testdata/ssl/certificates/leaf_from_known_root.pem b/pki/testdata/ssl/certificates/leaf_from_known_root.pem
index 0594ff8..a3d6120 100644
--- a/pki/testdata/ssl/certificates/leaf_from_known_root.pem
+++ b/pki/testdata/ssl/certificates/leaf_from_known_root.pem
@@ -1,274 +1,666 @@
 ===========================================
-Certificate0: c74f724a594ff8156228aa8d5b06c2335c45bcc0381cf16deb7ec0330cb454a0
+Certificate0: 43a7c7f7b28f92beac4b5e7e002c69801fd82c8656d9cb2993dba2bab0c4ec1e
 ===========================================
 Certificate:
     Data:
         Version: 3 (0x2)
-        Serial Number:
-            13:00:0f:ee:63:1b:df:c3:25:02:e3:e0:7e:a6:39:50
+        Serial Number: 5475531677529648189 (0x4bfcff0cd38dac3d)
         Signature Algorithm: sha256WithRSAEncryption
-        Issuer: C = GB, ST = Greater Manchester, L = Salford, O = Sectigo Limited, CN = Sectigo RSA Domain Validation Secure Server CA
+        Issuer: C = US, ST = Arizona, L = Scottsdale, O = "GoDaddy.com, Inc.", OU = http://certs.godaddy.com/repository/, CN = Go Daddy Secure Certificate Authority - G2
         Validity
-            Not Before: Apr 10 00:00:00 2023 GMT
-            Not After : May 10 23:59:59 2024 GMT
-        Subject: CN = horseweather.com
+            Not Before: Jul 25 02:05:05 2023 GMT
+            Not After : Aug 24 00:14:22 2024 GMT
+        Subject: CN = tntpowerwashservices.com
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
                 Public-Key: (2048 bit)
                 Modulus:
-                    00:b5:4f:7d:c0:1a:22:1c:a6:88:a0:85:01:3e:4a:
-                    56:e3:3e:2a:f9:9c:f8:15:ce:6f:f7:44:74:00:41:
-                    0f:d9:54:ce:7b:51:70:95:0c:9b:35:b1:68:b9:a6:
-                    75:1a:28:93:4b:c9:64:9c:7e:ea:30:d4:4b:73:44:
-                    62:fa:97:0d:5b:19:f6:6e:a3:44:b1:ea:67:7b:c6:
-                    86:c6:1f:b8:1b:9b:ce:b1:9d:f7:f1:63:f4:63:03:
-                    6b:07:72:f8:9c:f7:62:89:5d:15:2f:eb:ea:f8:18:
-                    8f:55:1d:33:e7:2c:76:fd:3e:1a:16:fb:42:c1:02:
-                    3a:03:82:f8:92:9a:a2:de:f1:8b:06:8e:cc:f9:ca:
-                    1e:29:1c:48:7e:dc:0f:c1:5e:81:91:5c:36:eb:41:
-                    1f:55:23:67:f2:b3:3b:10:73:fc:f0:48:2c:9e:8e:
-                    1b:66:1e:52:38:09:0b:53:10:47:96:39:47:bb:81:
-                    67:c4:4f:33:f2:74:19:c8:b5:16:0b:27:1e:d2:0e:
-                    09:c7:4e:c5:e3:a8:8f:aa:00:1a:3c:9a:19:45:09:
-                    c8:aa:74:e0:7e:a0:7f:e2:46:8e:27:42:d4:ee:80:
-                    60:5d:e1:b4:fc:23:9d:cb:70:be:d6:5b:88:ee:15:
-                    61:1d:f5:4b:8d:02:ae:2f:19:5c:20:fc:17:9f:fc:
-                    5d:b9
+                    00:af:a6:20:2e:e2:8f:f6:61:ba:78:bd:8c:c9:b4:
+                    84:6a:38:53:33:4a:28:e1:f6:9a:f8:be:45:14:18:
+                    ef:0c:57:6c:ae:89:7b:8d:06:89:58:b4:76:21:2c:
+                    43:1f:b9:5d:e0:8d:4b:83:ad:3d:04:fb:e1:bf:76:
+                    f2:e9:1a:80:42:f7:24:65:6d:c9:90:fc:fd:8e:82:
+                    0a:0e:5e:22:78:09:68:59:2a:4b:58:10:99:2d:f8:
+                    57:56:d9:92:a6:58:7e:89:c2:12:ea:c6:e2:43:86:
+                    07:6f:84:e2:c2:cd:1e:9d:4f:ee:62:58:35:a2:13:
+                    d5:bc:20:cf:69:65:c4:74:2a:4d:b1:c2:7b:03:85:
+                    b2:fc:dd:c7:36:30:c2:d6:59:02:e8:7c:41:26:ce:
+                    6b:f0:7a:55:1f:90:42:07:53:2e:a1:47:2e:53:42:
+                    a6:48:1c:d0:d2:bb:9c:76:bf:89:4b:39:9d:69:f5:
+                    80:a4:38:b3:bd:e7:cd:41:0c:69:d7:3d:c1:78:27:
+                    88:05:ee:c7:f3:87:9d:01:e1:fd:70:e4:be:4d:97:
+                    d3:2b:61:f3:0a:d3:2f:63:a9:ce:61:22:08:2e:a3:
+                    d6:ba:de:fe:6b:df:69:ed:2f:50:dd:b8:72:c4:d6:
+                    6b:00:5e:a4:8b:9b:58:c0:43:32:ab:cc:44:55:d7:
+                    70:2f
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
-            X509v3 Authority Key Identifier: 
-                8D:8C:5E:C4:54:AD:8A:E1:77:E9:9B:F9:9B:05:E1:B8:01:8D:61:E1
-            X509v3 Subject Key Identifier: 
-                DE:B8:1F:8D:E5:9F:B7:B7:F7:B6:96:56:D3:F4:2F:58:30:4C:36:0D
-            X509v3 Key Usage: critical
-                Digital Signature, Key Encipherment
             X509v3 Basic Constraints: critical
                 CA:FALSE
             X509v3 Extended Key Usage: 
                 TLS Web Server Authentication, TLS Web Client Authentication
+            X509v3 Key Usage: critical
+                Digital Signature, Key Encipherment
+            X509v3 CRL Distribution Points: 
+                Full Name:
+                  URI:http://crl.godaddy.com/gdig2s1-7257.crl
             X509v3 Certificate Policies: 
-                Policy: 1.3.6.1.4.1.6449.1.2.2.7
-                  CPS: https://sectigo.com/CPS
+                Policy: 2.16.840.1.114413.1.7.23.1
+                  CPS: http://certificates.godaddy.com/repository/
                 Policy: 2.23.140.1.2.1
             Authority Information Access: 
-                CA Issuers - URI:http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt
-                OCSP - URI:http://ocsp.sectigo.com
+                OCSP - URI:http://ocsp.godaddy.com/
+                CA Issuers - URI:http://certificates.godaddy.com/repository/gdig2.crt
+            X509v3 Authority Key Identifier: 
+                40:C2:BD:27:8E:CC:34:83:30:A2:33:D7:FB:6C:B3:F0:B4:2C:80:CE
             X509v3 Subject Alternative Name: 
-                DNS:horseweather.com, DNS:www.horseweather.com
+                DNS:tntpowerwashservices.com, DNS:www.tntpowerwashservices.com
+            X509v3 Subject Key Identifier: 
+                15:BE:40:63:3C:B1:6A:3C:27:52:B1:1E:43:06:A1:1C:0B:09:C7:C8
             CT Precertificate SCTs: 
                 Signed Certificate Timestamp:
                     Version   : v1 (0x0)
-                    Log ID    : 76:FF:88:3F:0A:B6:FB:95:51:C2:61:CC:F5:87:BA:34:
-                                B4:A4:CD:BB:29:DC:68:42:0A:9F:E6:67:4C:5A:3A:74
-                    Timestamp : Apr 10 14:57:58.554 2023 GMT
-                    Extensions: none
-                    Signature : ecdsa-with-SHA256
-                                30:44:02:20:2C:72:0F:4C:A5:E0:DE:BA:0F:50:D6:79:
-                                57:BB:1E:4C:57:63:08:41:3E:CE:92:04:AF:1D:8B:43:
-                                AC:D3:E0:A9:02:20:73:BD:5A:86:55:76:F4:84:E5:71:
-                                CE:D4:3B:D4:2F:7F:9F:7F:E9:DB:10:8B:97:0B:A5:EC:
-                                FB:B3:99:03:5A:DF
-                Signed Certificate Timestamp:
-                    Version   : v1 (0x0)
-                    Log ID    : DA:B6:BF:6B:3F:B5:B6:22:9F:9B:C2:BB:5C:6B:E8:70:
-                                91:71:6C:BB:51:84:85:34:BD:A4:3D:30:48:D7:FB:AB
-                    Timestamp : Apr 10 14:57:58.648 2023 GMT
-                    Extensions: none
-                    Signature : ecdsa-with-SHA256
-                                30:45:02:20:6A:FD:3F:78:6C:23:EE:5E:6D:6F:4C:67:
-                                D5:22:B0:9A:CB:78:01:D2:24:79:DF:56:44:40:23:4E:
-                                8B:CE:B9:10:02:21:00:E7:15:11:84:48:04:FC:2C:CD:
-                                F1:88:4E:79:31:19:4B:DC:E0:B3:74:12:49:3C:DD:4E:
-                                DB:E5:6D:D9:1B:B9:60
-                Signed Certificate Timestamp:
-                    Version   : v1 (0x0)
                     Log ID    : EE:CD:D0:64:D5:DB:1A:CE:C5:5C:B7:9D:B4:CD:13:A2:
                                 32:87:46:7C:BC:EC:DE:C3:51:48:59:46:71:1F:B5:9B
-                    Timestamp : Apr 10 14:57:58.679 2023 GMT
+                    Timestamp : Jul 25 02:05:06.473 2023 GMT
                     Extensions: none
                     Signature : ecdsa-with-SHA256
-                                30:46:02:21:00:AF:8C:27:AC:66:5E:08:AC:BA:19:1D:
-                                5A:CF:9A:F5:B8:28:A6:CC:9F:C4:99:45:59:10:2E:80:
-                                17:BA:BA:B0:5E:02:21:00:CD:4E:51:2B:C6:12:73:4D:
-                                7E:23:61:15:22:CB:08:CA:19:62:81:95:7E:31:08:B9:
-                                64:F7:96:71:B0:1E:D2:A8
+                                30:45:02:21:00:B6:D5:26:94:10:7C:69:75:D5:83:A6:
+                                4A:7F:4D:87:A3:86:3D:C6:AD:47:17:B7:04:9F:83:0B:
+                                51:7E:41:C5:06:02:20:1E:2C:1C:2F:03:D1:1B:AB:E2:
+                                F5:A0:65:BC:EC:BE:15:D2:05:ED:CC:AC:1A:44:70:DC:
+                                19:B6:87:58:4E:DF:EA
+                Signed Certificate Timestamp:
+                    Version   : v1 (0x0)
+                    Log ID    : 48:B0:E3:6B:DA:A6:47:34:0F:E5:6A:02:FA:9D:30:EB:
+                                1C:52:01:CB:56:DD:2C:81:D9:BB:BF:AB:39:D8:84:73
+                    Timestamp : Jul 25 02:05:06.771 2023 GMT
+                    Extensions: none
+                    Signature : ecdsa-with-SHA256
+                                30:45:02:20:6F:76:37:49:56:F0:9D:7F:F7:94:58:C9:
+                                9E:D3:D6:36:7D:BD:56:F4:92:41:0B:3E:97:0B:95:84:
+                                53:C6:68:24:02:21:00:87:45:7A:45:89:8E:C0:D9:44:
+                                82:56:24:C1:0D:A3:C4:FC:F8:C8:8E:1D:71:CC:0C:B5:
+                                6E:03:40:8D:3C:34:3A
+                Signed Certificate Timestamp:
+                    Version   : v1 (0x0)
+                    Log ID    : DA:B6:BF:6B:3F:B5:B6:22:9F:9B:C2:BB:5C:6B:E8:70:
+                                91:71:6C:BB:51:84:85:34:BD:A4:3D:30:48:D7:FB:AB
+                    Timestamp : Jul 25 02:05:06.882 2023 GMT
+                    Extensions: none
+                    Signature : ecdsa-with-SHA256
+                                30:46:02:21:00:A1:1F:15:0A:5A:5A:E7:ED:6D:61:5F:
+                                9C:13:0B:66:70:62:95:31:C8:ED:D0:8A:B9:58:B1:90:
+                                97:63:21:C8:2B:02:21:00:F9:67:A5:79:88:32:96:48:
+                                CB:6C:B9:27:76:0D:B6:7C:3A:AE:CB:65:40:87:E3:A5:
+                                A9:FA:03:CA:61:F3:C7:9D
     Signature Algorithm: sha256WithRSAEncryption
     Signature Value:
-        3b:67:4e:46:c0:7f:d6:2f:4e:64:63:80:21:e4:ea:af:46:06:
-        e3:83:47:99:88:73:27:6c:96:ae:5e:eb:d3:36:60:4a:1d:b4:
-        28:57:7d:07:df:40:e2:87:54:d3:dd:bc:5a:e4:e7:9b:f7:72:
-        4b:c7:5f:5d:50:da:c6:c0:6a:0d:36:c3:f9:ff:db:b5:d2:71:
-        84:b6:66:0a:15:31:46:79:39:0f:b2:bc:c0:91:8f:d6:03:ab:
-        10:7d:ea:7e:59:16:13:6c:3a:47:55:12:8b:c5:4a:1f:21:bc:
-        00:f1:a1:0a:0e:e5:e8:b5:af:38:47:78:44:e9:ab:d9:0c:94:
-        a1:af:a1:2c:18:5a:15:00:e1:4e:9f:c5:06:88:87:41:25:e7:
-        92:bf:9e:ee:66:93:88:4d:15:ae:c5:d8:1b:c4:58:e1:3c:fd:
-        12:bc:8e:44:fa:74:4b:a3:37:bd:7d:49:f9:3e:90:a7:bd:2e:
-        dc:3d:24:5d:5b:9f:47:3e:6c:3a:7d:17:ab:dc:3b:3c:53:f1:
-        ac:39:1b:74:51:a9:47:08:d2:af:c1:0c:5b:d3:4c:ed:85:97:
-        5a:d6:75:1e:d7:d5:69:50:e3:1e:bd:26:cf:b9:94:1a:fb:74:
-        0b:ac:18:48:6b:61:10:6a:4e:89:6e:b5:c6:eb:c3:90:64:ee:
-        38:5d:18:17
+        26:c1:ee:ce:fb:7c:3d:bd:15:19:f7:6e:bc:f2:b0:d3:8b:a0:
+        d0:26:84:83:2c:06:65:50:68:0e:9a:1e:96:9e:2b:64:ae:7a:
+        0a:05:e9:78:0a:cc:d5:0d:44:7a:d5:ae:4b:25:0c:a1:5d:a0:
+        b4:3a:1b:60:6c:6a:e2:30:7e:30:23:2e:eb:74:85:80:84:0f:
+        e6:cb:89:ee:b8:a9:9d:79:8a:da:dc:13:e1:6d:77:4f:81:7e:
+        55:b4:0f:4f:41:6d:02:89:bf:73:95:7c:7f:b2:d8:9b:50:4a:
+        f8:60:36:11:e2:13:32:1f:e5:0f:3a:7d:0e:42:1e:b0:90:eb:
+        dd:41:57:0c:52:72:28:31:87:13:cb:39:9a:2f:23:66:9f:ca:
+        a9:4a:d3:26:30:71:ad:72:e2:83:b7:00:29:92:2c:b9:9f:c9:
+        a2:85:b2:90:29:c0:10:41:e4:6f:6e:d7:3c:ad:96:06:81:75:
+        09:ff:7e:47:ff:3d:93:18:f5:e8:62:44:f9:8a:6c:37:db:5a:
+        a6:66:78:ae:3a:84:9b:7c:d0:f0:c9:9d:99:ce:8d:4a:9f:ab:
+        d6:e1:bd:7c:bc:9c:9d:f2:00:c9:17:aa:7d:97:9f:3f:27:9c:
+        6c:91:16:a6:8e:39:c8:86:db:0c:14:ea:20:3d:f7:aa:7d:a3:
+        e2:67:9d:9a
+
+SEQUENCE {
+  SEQUENCE {
+    [0] {
+      INTEGER { 2 }
+    }
+    INTEGER { `4bfcff0cd38dac3d` }
+    SEQUENCE {
+      # sha256WithRSAEncryption
+      OBJECT_IDENTIFIER { 1.2.840.113549.1.1.11 }
+      NULL {}
+    }
+    SEQUENCE {
+      SET {
+        SEQUENCE {
+          # countryName
+          OBJECT_IDENTIFIER { 2.5.4.6 }
+          PrintableString { "US" }
+        }
+      }
+      SET {
+        SEQUENCE {
+          # stateOrProvinceName
+          OBJECT_IDENTIFIER { 2.5.4.8 }
+          PrintableString { "Arizona" }
+        }
+      }
+      SET {
+        SEQUENCE {
+          # localityName
+          OBJECT_IDENTIFIER { 2.5.4.7 }
+          PrintableString { "Scottsdale" }
+        }
+      }
+      SET {
+        SEQUENCE {
+          # organizationName
+          OBJECT_IDENTIFIER { 2.5.4.10 }
+          PrintableString { "GoDaddy.com, Inc." }
+        }
+      }
+      SET {
+        SEQUENCE {
+          # organizationUnitName
+          OBJECT_IDENTIFIER { 2.5.4.11 }
+          PrintableString { "http://certs.godaddy.com/repository/" }
+        }
+      }
+      SET {
+        SEQUENCE {
+          # commonName
+          OBJECT_IDENTIFIER { 2.5.4.3 }
+          PrintableString { "Go Daddy Secure Certificate Authority - G2" }
+        }
+      }
+    }
+    SEQUENCE {
+      UTCTime { "230725020505Z" }
+      UTCTime { "240824001422Z" }
+    }
+    SEQUENCE {
+      SET {
+        SEQUENCE {
+          # commonName
+          OBJECT_IDENTIFIER { 2.5.4.3 }
+          PrintableString { "tntpowerwashservices.com" }
+        }
+      }
+    }
+    SEQUENCE {
+      SEQUENCE {
+        # rsaEncryption
+        OBJECT_IDENTIFIER { 1.2.840.113549.1.1.1 }
+        NULL {}
+      }
+      BIT_STRING {
+        `00`
+        SEQUENCE {
+          INTEGER { `00afa6202ee28ff661ba78bd8cc9b4846a3853334a28e1f69af8be451418ef0c576cae897b8d068958b476212c431fb95de08d4b83ad3d04fbe1bf76f2e91a8042f724656dc990fcfd8e820a0e5e22780968592a4b5810992df85756d992a6587e89c212eac6e24386076f84e2c2cd1e9d4fee625835a213d5bc20cf6965c4742a4db1c27b0385b2fcddc73630c2d65902e87c4126ce6bf07a551f904207532ea1472e5342a6481cd0d2bb9c76bf894b399d69f580a438b3bde7cd410c69d73dc178278805eec7f3879d01e1fd70e4be4d97d32b61f30ad32f63a9ce6122082ea3d6badefe6bdf69ed2f50ddb872c4d66b005ea48b9b58c04332abcc4455d7702f` }
+          INTEGER { 65537 }
+        }
+      }
+    }
+    [3] {
+      SEQUENCE {
+        SEQUENCE {
+          # basicConstraints
+          OBJECT_IDENTIFIER { 2.5.29.19 }
+          BOOLEAN { TRUE }
+          OCTET_STRING {
+            SEQUENCE {}
+          }
+        }
+        SEQUENCE {
+          # extKeyUsage
+          OBJECT_IDENTIFIER { 2.5.29.37 }
+          OCTET_STRING {
+            SEQUENCE {
+              # serverAuth
+              OBJECT_IDENTIFIER { 1.3.6.1.5.5.7.3.1 }
+              # clientAuth
+              OBJECT_IDENTIFIER { 1.3.6.1.5.5.7.3.2 }
+            }
+          }
+        }
+        SEQUENCE {
+          # keyUsage
+          OBJECT_IDENTIFIER { 2.5.29.15 }
+          BOOLEAN { TRUE }
+          OCTET_STRING {
+            BIT_STRING { b`101` }
+          }
+        }
+        SEQUENCE {
+          # cRLDistributionPoints
+          OBJECT_IDENTIFIER { 2.5.29.31 }
+          OCTET_STRING {
+            SEQUENCE {
+              SEQUENCE {
+                [0] {
+                  [0] {
+                    [6 PRIMITIVE] { "http://crl.godaddy.com/gdig2s1-7257.crl" }
+                  }
+                }
+              }
+            }
+          }
+        }
+        SEQUENCE {
+          # certificatePolicies
+          OBJECT_IDENTIFIER { 2.5.29.32 }
+          OCTET_STRING {
+            SEQUENCE {
+              SEQUENCE {
+                OBJECT_IDENTIFIER { 2.16.840.1.114413.1.7.23.1 }
+                SEQUENCE {
+                  SEQUENCE {
+                    OBJECT_IDENTIFIER { 1.3.6.1.5.5.7.2.1 }
+                    IA5String { "http://certificates.godaddy.com/repository/" }
+                  }
+                }
+              }
+              SEQUENCE {
+                # domain-validated
+                OBJECT_IDENTIFIER { 2.23.140.1.2.1 }
+              }
+            }
+          }
+        }
+        SEQUENCE {
+          # authorityInfoAccess
+          OBJECT_IDENTIFIER { 1.3.6.1.5.5.7.1.1 }
+          OCTET_STRING {
+            SEQUENCE {
+              SEQUENCE {
+                # ocsp
+                OBJECT_IDENTIFIER { 1.3.6.1.5.5.7.48.1 }
+                [6 PRIMITIVE] { "http://ocsp.godaddy.com/" }
+              }
+              SEQUENCE {
+                # caIssuers
+                OBJECT_IDENTIFIER { 1.3.6.1.5.5.7.48.2 }
+                [6 PRIMITIVE] { "http://certificates.godaddy.com/repository/gdig2.crt" }
+              }
+            }
+          }
+        }
+        SEQUENCE {
+          # authorityKeyIdentifier
+          OBJECT_IDENTIFIER { 2.5.29.35 }
+          OCTET_STRING {
+            SEQUENCE {
+              [0 PRIMITIVE] { `40c2bd278ecc348330a233d7fb6cb3f0b42c80ce` }
+            }
+          }
+        }
+        SEQUENCE {
+          # subjectAltName
+          OBJECT_IDENTIFIER { 2.5.29.17 }
+          OCTET_STRING {
+            SEQUENCE {
+              [2 PRIMITIVE] { "tntpowerwashservices.com" }
+              [2 PRIMITIVE] { "www.tntpowerwashservices.com" }
+            }
+          }
+        }
+        SEQUENCE {
+          # subjectKeyIdentifier
+          OBJECT_IDENTIFIER { 2.5.29.14 }
+          OCTET_STRING {
+            OCTET_STRING { `15be40633cb16a3c2752b11e4306a11c0b09c7c8` }
+          }
+        }
+        SEQUENCE {
+          # embeddedSCTList
+          OBJECT_IDENTIFIER { 1.3.6.1.4.1.11129.2.4.2 }
+          OCTET_STRING {
+            OCTET_STRING { `0169007600eecdd064d5db1acec55cb79db4cd13a23287467cbcecdec351485946711fb59b000001898acafe290000040300473045022100b6d52694107c6975d583a64a7f4d87a3863dc6ad4717b7049f830b517e41c50602201e2c1c2f03d11babe2f5a065bcecbe15d205edccac1a4470dc19b687584edfea00760048b0e36bdaa647340fe56a02fa9d30eb1c5201cb56dd2c81d9bbbfab39d88473000001898acaff53000004030047304502206f76374956f09d7ff79458c99ed3d6367dbd56f492410b3e970b958453c6682402210087457a45898ec0d944825624c10da3c4fcf8c88e1d71cc0cb56e03408d3c343a007700dab6bf6b3fb5b6229f9bc2bb5c6be87091716cbb51848534bda43d3048d7fbab000001898acaffc20000040300483046022100a11f150a5a5ae7ed6d615f9c130b6670629531c8edd08ab958b190976321c82b022100f967a57988329648cb6cb927760db67c3aaecb654087e3a5a9fa03ca61f3c79d` }
+          }
+        }
+      }
+    }
+  }
+  SEQUENCE {
+    # sha256WithRSAEncryption
+    OBJECT_IDENTIFIER { 1.2.840.113549.1.1.11 }
+    NULL {}
+  }
+  BIT_STRING { `00` `26c1eecefb7c3dbd1519f76ebcf2b0d38ba0d02684832c066550680e9a1e969e2b64ae7a0a05e9780accd50d447ad5ae4b250ca15da0b43a1b606c6ae2307e30232eeb748580840fe6cb89eeb8a99d798adadc13e16d774f817e55b40f4f416d0289bf73957c7fb2d89b504af8603611e213321fe50f3a7d0e421eb090ebdd41570c527228318713cb399a2f23669fcaa94ad3263071ad72e283b70029922cb99fc9a285b29029c01041e46f6ed73cad9606817509ff7e47ff3d9318f5e86244f98a6c37db5aa66678ae3a849b7cd0f0c99d99ce8d4a9fabd6e1bd7cbc9c9df200c917aa7d979f3f279c6c9116a68e39c886db0c14ea203df7aa7da3e2679d9a` }
+}
 
 -----BEGIN CERTIFICATE-----
-MIIGPzCCBSegAwIBAgIQEwAP7mMb38MlAuPgfqY5UDANBgkqhkiG9w0BAQsFADCB
-jzELMAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4G
-A1UEBxMHU2FsZm9yZDEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQD
-Ey5TZWN0aWdvIFJTQSBEb21haW4gVmFsaWRhdGlvbiBTZWN1cmUgU2VydmVyIENB
-MB4XDTIzMDQxMDAwMDAwMFoXDTI0MDUxMDIzNTk1OVowGzEZMBcGA1UEAxMQaG9y
-c2V3ZWF0aGVyLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALVP
-fcAaIhymiKCFAT5KVuM+Kvmc+BXOb/dEdABBD9lUzntRcJUMmzWxaLmmdRook0vJ
-ZJx+6jDUS3NEYvqXDVsZ9m6jRLHqZ3vGhsYfuBubzrGd9/Fj9GMDawdy+Jz3Yold
-FS/r6vgYj1UdM+csdv0+Ghb7QsECOgOC+JKaot7xiwaOzPnKHikcSH7cD8FegZFc
-NutBH1UjZ/KzOxBz/PBILJ6OG2YeUjgJC1MQR5Y5R7uBZ8RPM/J0Gci1FgsnHtIO
-CcdOxeOoj6oAGjyaGUUJyKp04H6gf+JGjidC1O6AYF3htPwjnctwvtZbiO4VYR31
-S40Cri8ZXCD8F5/8XbkCAwEAAaOCAwgwggMEMB8GA1UdIwQYMBaAFI2MXsRUrYrh
-d+mb+ZsF4bgBjWHhMB0GA1UdDgQWBBTeuB+N5Z+3t/e2llbT9C9YMEw2DTAOBgNV
-HQ8BAf8EBAMCBaAwDAYDVR0TAQH/BAIwADAdBgNVHSUEFjAUBggrBgEFBQcDAQYI
-KwYBBQUHAwIwSQYDVR0gBEIwQDA0BgsrBgEEAbIxAQICBzAlMCMGCCsGAQUFBwIB
-FhdodHRwczovL3NlY3RpZ28uY29tL0NQUzAIBgZngQwBAgEwgYQGCCsGAQUFBwEB
-BHgwdjBPBggrBgEFBQcwAoZDaHR0cDovL2NydC5zZWN0aWdvLmNvbS9TZWN0aWdv
-UlNBRG9tYWluVmFsaWRhdGlvblNlY3VyZVNlcnZlckNBLmNydDAjBggrBgEFBQcw
-AYYXaHR0cDovL29jc3Auc2VjdGlnby5jb20wMQYDVR0RBCowKIIQaG9yc2V3ZWF0
-aGVyLmNvbYIUd3d3LmhvcnNld2VhdGhlci5jb20wggF+BgorBgEEAdZ5AgQCBIIB
-bgSCAWoBaAB1AHb/iD8KtvuVUcJhzPWHujS0pM27KdxoQgqf5mdMWjp0AAABh2us
-exoAAAQDAEYwRAIgLHIPTKXg3roPUNZ5V7seTFdjCEE+zpIErx2LQ6zT4KkCIHO9
-WoZVdvSE5XHO1DvUL3+ff+nbEIuXC6Xs+7OZA1rfAHYA2ra/az+1tiKfm8K7XGvo
-cJFxbLtRhIU0vaQ9MEjX+6sAAAGHa6x7eAAABAMARzBFAiBq/T94bCPuXm1vTGfV
-IrCay3gB0iR531ZEQCNOi865EAIhAOcVEYRIBPwszfGITnkxGUvc4LN0Ekk83U7b
-5W3ZG7lgAHcA7s3QZNXbGs7FXLedtM0TojKHRny87N7DUUhZRnEftZsAAAGHa6x7
-lwAABAMASDBGAiEAr4wnrGZeCKy6GR1az5r1uCimzJ/EmUVZEC6AF7q6sF4CIQDN
-TlErxhJzTX4jYRUiywjKGWKBlX4xCLlk95ZxsB7SqDANBgkqhkiG9w0BAQsFAAOC
-AQEAO2dORsB/1i9OZGOAIeTqr0YG44NHmYhzJ2yWrl7r0zZgSh20KFd9B99A4odU
-0928WuTnm/dyS8dfXVDaxsBqDTbD+f/btdJxhLZmChUxRnk5D7K8wJGP1gOrEH3q
-flkWE2w6R1USi8VKHyG8APGhCg7l6LWvOEd4ROmr2QyUoa+hLBhaFQDhTp/FBoiH
-QSXnkr+e7maTiE0VrsXYG8RY4Tz9EryORPp0S6M3vX1J+T6Qp70u3D0kXVufRz5s
-On0Xq9w7PFPxrDkbdFGpRwjSr8EMW9NM7YWXWtZ1HtfVaVDjHr0mz7mUGvt0C6wY
-SGthEGpOiW61xuvDkGTuOF0YFw==
+MIIGtDCCBZygAwIBAgIIS/z/DNONrD0wDQYJKoZIhvcNAQELBQAwgbQxCzAJBgNV
+BAYTAlVTMRAwDgYDVQQIEwdBcml6b25hMRMwEQYDVQQHEwpTY290dHNkYWxlMRow
+GAYDVQQKExFHb0RhZGR5LmNvbSwgSW5jLjEtMCsGA1UECxMkaHR0cDovL2NlcnRz
+LmdvZGFkZHkuY29tL3JlcG9zaXRvcnkvMTMwMQYDVQQDEypHbyBEYWRkeSBTZWN1
+cmUgQ2VydGlmaWNhdGUgQXV0aG9yaXR5IC0gRzIwHhcNMjMwNzI1MDIwNTA1WhcN
+MjQwODI0MDAxNDIyWjAjMSEwHwYDVQQDExh0bnRwb3dlcndhc2hzZXJ2aWNlcy5j
+b20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCvpiAu4o/2Ybp4vYzJ
+tIRqOFMzSijh9pr4vkUUGO8MV2yuiXuNBolYtHYhLEMfuV3gjUuDrT0E++G/dvLp
+GoBC9yRlbcmQ/P2OggoOXiJ4CWhZKktYEJkt+FdW2ZKmWH6JwhLqxuJDhgdvhOLC
+zR6dT+5iWDWiE9W8IM9pZcR0Kk2xwnsDhbL83cc2MMLWWQLofEEmzmvwelUfkEIH
+Uy6hRy5TQqZIHNDSu5x2v4lLOZ1p9YCkOLO9581BDGnXPcF4J4gF7sfzh50B4f1w
+5L5Nl9MrYfMK0y9jqc5hIgguo9a63v5r32ntL1DduHLE1msAXqSLm1jAQzKrzERV
+13AvAgMBAAGjggNYMIIDVDAMBgNVHRMBAf8EAjAAMB0GA1UdJQQWMBQGCCsGAQUF
+BwMBBggrBgEFBQcDAjAOBgNVHQ8BAf8EBAMCBaAwOAYDVR0fBDEwLzAtoCugKYYn
+aHR0cDovL2NybC5nb2RhZGR5LmNvbS9nZGlnMnMxLTcyNTcuY3JsMF0GA1UdIARW
+MFQwSAYLYIZIAYb9bQEHFwEwOTA3BggrBgEFBQcCARYraHR0cDovL2NlcnRpZmlj
+YXRlcy5nb2RhZGR5LmNvbS9yZXBvc2l0b3J5LzAIBgZngQwBAgEwdgYIKwYBBQUH
+AQEEajBoMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5nb2RhZGR5LmNvbS8wQAYI
+KwYBBQUHMAKGNGh0dHA6Ly9jZXJ0aWZpY2F0ZXMuZ29kYWRkeS5jb20vcmVwb3Np
+dG9yeS9nZGlnMi5jcnQwHwYDVR0jBBgwFoAUQMK9J47MNIMwojPX+2yz8LQsgM4w
+QQYDVR0RBDowOIIYdG50cG93ZXJ3YXNoc2VydmljZXMuY29tghx3d3cudG50cG93
+ZXJ3YXNoc2VydmljZXMuY29tMB0GA1UdDgQWBBQVvkBjPLFqPCdSsR5DBqEcCwnH
+yDCCAX8GCisGAQQB1nkCBAIEggFvBIIBawFpAHYA7s3QZNXbGs7FXLedtM0TojKH
+Rny87N7DUUhZRnEftZsAAAGJisr+KQAABAMARzBFAiEAttUmlBB8aXXVg6ZKf02H
+o4Y9xq1HF7cEn4MLUX5BxQYCIB4sHC8D0Rur4vWgZbzsvhXSBe3MrBpEcNwZtodY
+Tt/qAHYASLDja9qmRzQP5WoC+p0w6xxSActW3SyB2bu/qznYhHMAAAGJisr/UwAA
+BAMARzBFAiBvdjdJVvCdf/eUWMme09Y2fb1W9JJBCz6XC5WEU8ZoJAIhAIdFekWJ
+jsDZRIJWJMENo8T8+MiOHXHMDLVuA0CNPDQ6AHcA2ra/az+1tiKfm8K7XGvocJFx
+bLtRhIU0vaQ9MEjX+6sAAAGJisr/wgAABAMASDBGAiEAoR8VClpa5+1tYV+cEwtm
+cGKVMcjt0Iq5WLGQl2MhyCsCIQD5Z6V5iDKWSMtsuSd2DbZ8Oq7LZUCH46Wp+gPK
+YfPHnTANBgkqhkiG9w0BAQsFAAOCAQEAJsHuzvt8Pb0VGfduvPKw04ug0CaEgywG
+ZVBoDpoelp4rZK56CgXpeArM1Q1EetWuSyUMoV2gtDobYGxq4jB+MCMu63SFgIQP
+5suJ7ripnXmK2twT4W13T4F+VbQPT0FtAom/c5V8f7LYm1BK+GA2EeITMh/lDzp9
+DkIesJDr3UFXDFJyKDGHE8s5mi8jZp/KqUrTJjBxrXLig7cAKZIsuZ/JooWykCnA
+EEHkb27XPK2WBoF1Cf9+R/89kxj16GJE+YpsN9tapmZ4rjqEm3zQ8Mmdmc6NSp+r
+1uG9fLycnfIAyReqfZefPyecbJEWpo45yIbbDBTqID33qn2j4medmg==
 -----END CERTIFICATE-----
 
 ===========================================
-Certificate1: 7fa4ff68ec04a99d7528d5085f94907f4d1dd1c5381bacdc832ed5c960214676
+Certificate1: 973a41276ffd01e027a2aad49e34c37846d3e976ff6a620b6712e33832041aa6
 ===========================================
 Certificate:
     Data:
         Version: 3 (0x2)
-        Serial Number:
-            7d:5b:51:26:b4:76:ba:11:db:74:16:0b:bc:53:0d:a7
-        Signature Algorithm: sha384WithRSAEncryption
-        Issuer: C = US, ST = New Jersey, L = Jersey City, O = The USERTRUST Network, CN = USERTrust RSA Certification Authority
+        Serial Number: 7 (0x7)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C = US, ST = Arizona, L = Scottsdale, O = "GoDaddy.com, Inc.", CN = Go Daddy Root Certificate Authority - G2
         Validity
-            Not Before: Nov  2 00:00:00 2018 GMT
-            Not After : Dec 31 23:59:59 2030 GMT
-        Subject: C = GB, ST = Greater Manchester, L = Salford, O = Sectigo Limited, CN = Sectigo RSA Domain Validation Secure Server CA
+            Not Before: May  3 07:00:00 2011 GMT
+            Not After : May  3 07:00:00 2031 GMT
+        Subject: C = US, ST = Arizona, L = Scottsdale, O = "GoDaddy.com, Inc.", OU = http://certs.godaddy.com/repository/, CN = Go Daddy Secure Certificate Authority - G2
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
                 Public-Key: (2048 bit)
                 Modulus:
-                    00:d6:73:33:d6:d7:3c:20:d0:00:d2:17:45:b8:d6:
-                    3e:07:a2:3f:c7:41:ee:32:30:c9:b0:6c:fd:f4:9f:
-                    cb:12:98:0f:2d:3f:8d:4d:01:0c:82:0f:17:7f:62:
-                    2e:e9:b8:48:79:fb:16:83:4e:ad:d7:32:25:93:b7:
-                    07:bf:b9:50:3f:a9:4c:c3:40:2a:e9:39:ff:d9:81:
-                    ca:1f:16:32:41:da:80:26:b9:23:7a:87:20:1e:e3:
-                    ff:20:9a:3c:95:44:6f:87:75:06:90:40:b4:32:93:
-                    16:09:10:08:23:3e:d2:dd:87:0f:6f:5d:51:14:6a:
-                    0a:69:c5:4f:01:72:69:cf:d3:93:4c:6d:04:a0:a3:
-                    1b:82:7e:b1:9a:b9:ed:c5:9e:c5:37:78:9f:9a:08:
-                    34:fb:56:2e:58:c4:09:0e:06:64:5b:bc:37:dc:f1:
-                    9f:28:68:a8:56:b0:92:a3:5c:9f:bb:88:98:08:1b:
-                    24:1d:ab:30:85:ae:af:b0:2e:9e:7a:9d:c1:c0:42:
-                    1c:e2:02:f0:ea:e0:4a:d2:ef:90:0e:b4:c1:40:16:
-                    f0:6f:85:42:4a:64:f7:a4:30:a0:fe:bf:2e:a3:27:
-                    5a:8e:8b:58:b8:ad:c3:19:17:84:63:ed:6f:56:fd:
-                    83:cb:60:34:c4:74:be:e6:9d:db:e1:e4:e5:ca:0c:
-                    5f:15
+                    00:b9:e0:cb:10:d4:af:76:bd:d4:93:62:eb:30:64:
+                    b8:81:08:6c:c3:04:d9:62:17:8e:2f:ff:3e:65:cf:
+                    8f:ce:62:e6:3c:52:1c:da:16:45:4b:55:ab:78:6b:
+                    63:83:62:90:ce:0f:69:6c:99:c8:1a:14:8b:4c:cc:
+                    45:33:ea:88:dc:9e:a3:af:2b:fe:80:61:9d:79:57:
+                    c4:cf:2e:f4:3f:30:3c:5d:47:fc:9a:16:bc:c3:37:
+                    96:41:51:8e:11:4b:54:f8:28:be:d0:8c:be:f0:30:
+                    38:1e:f3:b0:26:f8:66:47:63:6d:de:71:26:47:8f:
+                    38:47:53:d1:46:1d:b4:e3:dc:00:ea:45:ac:bd:bc:
+                    71:d9:aa:6f:00:db:db:cd:30:3a:79:4f:5f:4c:47:
+                    f8:1d:ef:5b:c2:c4:9d:60:3b:b1:b2:43:91:d8:a4:
+                    33:4e:ea:b3:d6:27:4f:ad:25:8a:a5:c6:f4:d5:d0:
+                    a6:ae:74:05:64:57:88:b5:44:55:d4:2d:2a:3a:3e:
+                    f8:b8:bd:e9:32:0a:02:94:64:c4:16:3a:50:f1:4a:
+                    ae:e7:79:33:af:0c:20:07:7f:e8:df:04:39:c2:69:
+                    02:6c:63:52:fa:77:c1:1b:c8:74:87:c8:b9:93:18:
+                    50:54:35:4b:69:4e:bc:3b:d3:49:2e:1f:dc:c1:d2:
+                    52:fb
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
-            X509v3 Authority Key Identifier: 
-                53:79:BF:5A:AA:2B:4A:CF:54:80:E1:D8:9B:C0:9D:F2:B2:03:66:CB
-            X509v3 Subject Key Identifier: 
-                8D:8C:5E:C4:54:AD:8A:E1:77:E9:9B:F9:9B:05:E1:B8:01:8D:61:E1
-            X509v3 Key Usage: critical
-                Digital Signature, Certificate Sign, CRL Sign
             X509v3 Basic Constraints: critical
-                CA:TRUE, pathlen:0
-            X509v3 Extended Key Usage: 
-                TLS Web Server Authentication, TLS Web Client Authentication
-            X509v3 Certificate Policies: 
-                Policy: X509v3 Any Policy
-                Policy: 2.23.140.1.2.1
+                CA:TRUE
+            X509v3 Key Usage: critical
+                Certificate Sign, CRL Sign
+            X509v3 Subject Key Identifier: 
+                40:C2:BD:27:8E:CC:34:83:30:A2:33:D7:FB:6C:B3:F0:B4:2C:80:CE
+            X509v3 Authority Key Identifier: 
+                3A:9A:85:07:10:67:28:B6:EF:F6:BD:05:41:6E:20:C1:94:DA:0F:DE
+            Authority Information Access: 
+                OCSP - URI:http://ocsp.godaddy.com/
             X509v3 CRL Distribution Points: 
                 Full Name:
-                  URI:http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl
-            Authority Information Access: 
-                CA Issuers - URI:http://crt.usertrust.com/USERTrustRSAAddTrustCA.crt
-                OCSP - URI:http://ocsp.usertrust.com
-    Signature Algorithm: sha384WithRSAEncryption
+                  URI:http://crl.godaddy.com/gdroot-g2.crl
+            X509v3 Certificate Policies: 
+                Policy: X509v3 Any Policy
+                  CPS: https://certs.godaddy.com/repository/
+    Signature Algorithm: sha256WithRSAEncryption
     Signature Value:
-        32:bf:61:bd:0e:48:c3:4f:c7:ba:47:4d:f8:9c:78:19:01:dc:
-        13:1d:80:6f:fc:c3:70:b4:52:9a:31:33:9a:57:52:fb:31:9e:
-        6b:a4:ef:54:aa:89:8d:40:17:68:f8:11:10:7c:d2:ca:b1:f1:
-        55:86:c7:ee:b3:36:91:86:f6:39:51:bf:46:bf:0f:a0:ba:b4:
-        f7:7e:49:c4:2a:36:17:9e:e4:68:39:7a:af:94:4e:56:6f:b2:
-        7b:3b:bf:0a:86:bd:cd:c5:77:1c:03:b8:38:b1:a2:1f:5f:7e:
-        db:8a:dc:46:48:b6:68:0a:cf:b2:b5:b4:e2:34:e4:67:a9:38:
-        66:09:5e:d2:b8:fc:9d:28:3a:17:40:27:c2:72:4e:29:fd:21:
-        3c:7c:cf:13:fb:96:2c:c5:31:44:fd:13:ed:d5:9b:a9:69:68:
-        77:7c:ee:e1:ff:a4:f9:36:38:08:53:39:a2:84:34:9c:19:f3:
-        be:0e:ac:d5:24:37:eb:23:a8:78:d0:d3:e7:ef:92:47:64:62:
-        39:22:ef:c6:f7:11:be:22:85:c6:66:44:24:26:8e:10:32:8d:
-        c8:93:ae:07:9e:83:3e:2f:d9:f9:f5:46:8e:63:be:c1:e6:b4:
-        dc:a6:cd:21:a8:86:0a:95:d9:2e:85:26:1a:fd:fc:b1:b6:57:
-        42:6d:95:d1:33:f6:39:14:06:82:41:38:f5:8f:58:dc:80:5b:
-        a4:d5:7d:95:78:fd:a7:9b:ff:fd:c5:a8:69:ab:26:e7:a7:a4:
-        05:87:5b:a9:b7:b8:a3:20:0b:97:a9:45:85:dd:b3:8b:e5:89:
-        37:8e:29:0d:fc:06:17:f6:38:40:0e:42:e4:12:06:fb:7b:f3:
-        c6:11:68:62:df:e3:98:f4:13:d8:15:4f:8b:b1:69:d9:10:60:
-        bc:64:2a:ea:31:b7:e4:b5:a3:3a:14:9b:26:e3:0b:7b:fd:02:
-        8e:b6:99:c1:38:97:59:36:f6:a8:74:a2:86:b6:5e:eb:c6:64:
-        ea:cf:a0:a3:f9:6e:9e:ba:2d:11:b6:86:98:08:58:2d:c9:ac:
-        25:64:f2:5e:75:b4:38:c1:ae:7f:5a:46:83:ea:51:ca:b6:f1:
-        99:11:35:6b:a5:6a:7b:c6:00:b0:e7:f8:be:64:b2:ad:c8:c2:
-        f1:ac:e3:51:ea:a4:93:e0:79:c8:e1:81:40:c9:0a:5b:e1:12:
-        3c:c1:60:2a:e3:97:c0:89:42:ca:94:cf:46:98:12:69:bb:98:
-        d0:c2:d3:0d:72:4b:47:6e:e5:93:c4:32:28:63:87:43:e4:b0:
-        32:3e:0a:d3:4b:bf:23:9b:14:29:41:2b:9a:04:1f:93:2d:f1:
-        c7:39:48:3c:ad:5a:12:7f
+        08:7e:6c:93:10:c8:38:b8:96:a9:90:4b:ff:a1:5f:4f:04:ef:
+        6c:3e:9c:88:06:c9:50:8f:a6:73:f7:57:31:1b:be:bc:e4:2f:
+        db:f8:ba:d3:5b:e0:b4:e7:e6:79:62:0e:0c:a2:d7:6a:63:73:
+        31:b5:f5:a8:48:a4:3b:08:2d:a2:5d:90:d7:b4:7c:25:4f:11:
+        56:30:c4:b6:44:9d:7b:2c:9d:e5:5e:e6:ef:0c:61:aa:bf:e4:
+        2a:1b:ee:84:9e:b8:83:7d:c1:43:ce:44:a7:13:70:0d:91:1f:
+        f4:c8:13:ad:83:60:d9:d8:72:a8:73:24:1e:b5:ac:22:0e:ca:
+        17:89:62:58:44:1b:ab:89:25:01:00:0f:cd:c4:1b:62:db:51:
+        b4:d3:0f:51:2a:9b:f4:bc:73:fc:76:ce:36:a4:cd:d9:d8:2c:
+        ea:ae:9b:f5:2a:b2:90:d1:4d:75:18:8a:3f:8a:41:90:23:7d:
+        5b:4b:fe:a4:03:58:9b:46:b2:c3:60:60:83:f8:7d:50:41:ce:
+        c2:a1:90:c3:bb:ef:02:2f:d2:15:54:ee:44:15:d9:0a:ae:a7:
+        8a:33:ed:b1:2d:76:36:26:dc:04:eb:9f:f7:61:1f:15:dc:87:
+        6f:ee:46:96:28:ad:a1:26:7d:0a:09:a7:2e:04:a3:8d:bc:f8:
+        bc:04:30:01
+
+SEQUENCE {
+  SEQUENCE {
+    [0] {
+      INTEGER { 2 }
+    }
+    INTEGER { 7 }
+    SEQUENCE {
+      # sha256WithRSAEncryption
+      OBJECT_IDENTIFIER { 1.2.840.113549.1.1.11 }
+      NULL {}
+    }
+    SEQUENCE {
+      SET {
+        SEQUENCE {
+          # countryName
+          OBJECT_IDENTIFIER { 2.5.4.6 }
+          PrintableString { "US" }
+        }
+      }
+      SET {
+        SEQUENCE {
+          # stateOrProvinceName
+          OBJECT_IDENTIFIER { 2.5.4.8 }
+          PrintableString { "Arizona" }
+        }
+      }
+      SET {
+        SEQUENCE {
+          # localityName
+          OBJECT_IDENTIFIER { 2.5.4.7 }
+          PrintableString { "Scottsdale" }
+        }
+      }
+      SET {
+        SEQUENCE {
+          # organizationName
+          OBJECT_IDENTIFIER { 2.5.4.10 }
+          PrintableString { "GoDaddy.com, Inc." }
+        }
+      }
+      SET {
+        SEQUENCE {
+          # commonName
+          OBJECT_IDENTIFIER { 2.5.4.3 }
+          PrintableString { "Go Daddy Root Certificate Authority - G2" }
+        }
+      }
+    }
+    SEQUENCE {
+      UTCTime { "110503070000Z" }
+      UTCTime { "310503070000Z" }
+    }
+    SEQUENCE {
+      SET {
+        SEQUENCE {
+          # countryName
+          OBJECT_IDENTIFIER { 2.5.4.6 }
+          PrintableString { "US" }
+        }
+      }
+      SET {
+        SEQUENCE {
+          # stateOrProvinceName
+          OBJECT_IDENTIFIER { 2.5.4.8 }
+          PrintableString { "Arizona" }
+        }
+      }
+      SET {
+        SEQUENCE {
+          # localityName
+          OBJECT_IDENTIFIER { 2.5.4.7 }
+          PrintableString { "Scottsdale" }
+        }
+      }
+      SET {
+        SEQUENCE {
+          # organizationName
+          OBJECT_IDENTIFIER { 2.5.4.10 }
+          PrintableString { "GoDaddy.com, Inc." }
+        }
+      }
+      SET {
+        SEQUENCE {
+          # organizationUnitName
+          OBJECT_IDENTIFIER { 2.5.4.11 }
+          PrintableString { "http://certs.godaddy.com/repository/" }
+        }
+      }
+      SET {
+        SEQUENCE {
+          # commonName
+          OBJECT_IDENTIFIER { 2.5.4.3 }
+          PrintableString { "Go Daddy Secure Certificate Authority - G2" }
+        }
+      }
+    }
+    SEQUENCE {
+      SEQUENCE {
+        # rsaEncryption
+        OBJECT_IDENTIFIER { 1.2.840.113549.1.1.1 }
+        NULL {}
+      }
+      BIT_STRING {
+        `00`
+        SEQUENCE {
+          INTEGER { `00b9e0cb10d4af76bdd49362eb3064b881086cc304d962178e2fff3e65cf8fce62e63c521cda16454b55ab786b63836290ce0f696c99c81a148b4ccc4533ea88dc9ea3af2bfe80619d7957c4cf2ef43f303c5d47fc9a16bcc3379641518e114b54f828bed08cbef030381ef3b026f86647636dde7126478f384753d1461db4e3dc00ea45acbdbc71d9aa6f00dbdbcd303a794f5f4c47f81def5bc2c49d603bb1b24391d8a4334eeab3d6274fad258aa5c6f4d5d0a6ae7405645788b54455d42d2a3a3ef8b8bde9320a029464c4163a50f14aaee77933af0c20077fe8df0439c269026c6352fa77c11bc87487c8b993185054354b694ebc3bd3492e1fdcc1d252fb` }
+          INTEGER { 65537 }
+        }
+      }
+    }
+    [3] {
+      SEQUENCE {
+        SEQUENCE {
+          # basicConstraints
+          OBJECT_IDENTIFIER { 2.5.29.19 }
+          BOOLEAN { TRUE }
+          OCTET_STRING {
+            SEQUENCE {
+              BOOLEAN { TRUE }
+            }
+          }
+        }
+        SEQUENCE {
+          # keyUsage
+          OBJECT_IDENTIFIER { 2.5.29.15 }
+          BOOLEAN { TRUE }
+          OCTET_STRING {
+            BIT_STRING { b`0000011` }
+          }
+        }
+        SEQUENCE {
+          # subjectKeyIdentifier
+          OBJECT_IDENTIFIER { 2.5.29.14 }
+          OCTET_STRING {
+            OCTET_STRING { `40c2bd278ecc348330a233d7fb6cb3f0b42c80ce` }
+          }
+        }
+        SEQUENCE {
+          # authorityKeyIdentifier
+          OBJECT_IDENTIFIER { 2.5.29.35 }
+          OCTET_STRING {
+            SEQUENCE {
+              [0 PRIMITIVE] { `3a9a8507106728b6eff6bd05416e20c194da0fde` }
+            }
+          }
+        }
+        SEQUENCE {
+          # authorityInfoAccess
+          OBJECT_IDENTIFIER { 1.3.6.1.5.5.7.1.1 }
+          OCTET_STRING {
+            SEQUENCE {
+              SEQUENCE {
+                # ocsp
+                OBJECT_IDENTIFIER { 1.3.6.1.5.5.7.48.1 }
+                [6 PRIMITIVE] { "http://ocsp.godaddy.com/" }
+              }
+            }
+          }
+        }
+        SEQUENCE {
+          # cRLDistributionPoints
+          OBJECT_IDENTIFIER { 2.5.29.31 }
+          OCTET_STRING {
+            SEQUENCE {
+              SEQUENCE {
+                [0] {
+                  [0] {
+                    [6 PRIMITIVE] { "http://crl.godaddy.com/gdroot-g2.crl" }
+                  }
+                }
+              }
+            }
+          }
+        }
+        SEQUENCE {
+          # certificatePolicies
+          OBJECT_IDENTIFIER { 2.5.29.32 }
+          OCTET_STRING {
+            SEQUENCE {
+              SEQUENCE {
+                # anyPolicy
+                OBJECT_IDENTIFIER { 2.5.29.32.0 }
+                SEQUENCE {
+                  SEQUENCE {
+                    OBJECT_IDENTIFIER { 1.3.6.1.5.5.7.2.1 }
+                    IA5String { "https://certs.godaddy.com/repository/" }
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+  SEQUENCE {
+    # sha256WithRSAEncryption
+    OBJECT_IDENTIFIER { 1.2.840.113549.1.1.11 }
+    NULL {}
+  }
+  BIT_STRING { `00` `087e6c9310c838b896a9904bffa15f4f04ef6c3e9c8806c9508fa673f757311bbebce42fdbf8bad35be0b4e7e679620e0ca2d76a637331b5f5a848a43b082da25d90d7b47c254f115630c4b6449d7b2c9de55ee6ef0c61aabfe42a1bee849eb8837dc143ce44a713700d911ff4c813ad8360d9d872a873241eb5ac220eca17896258441bab892501000fcdc41b62db51b4d30f512a9bf4bc73fc76ce36a4cdd9d82ceaae9bf52ab290d14d75188a3f8a4190237d5b4bfea403589b46b2c3606083f87d5041cec2a190c3bbef022fd21554ee4415d90aaea78a33edb12d763626dc04eb9ff7611f15dc876fee469628ada1267d0a09a72e04a38dbcf8bc043001` }
+}
 
 -----BEGIN CERTIFICATE-----
-MIIGEzCCA/ugAwIBAgIQfVtRJrR2uhHbdBYLvFMNpzANBgkqhkiG9w0BAQwFADCB
-iDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0pl
-cnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNV
-BAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTgx
-MTAyMDAwMDAwWhcNMzAxMjMxMjM1OTU5WjCBjzELMAkGA1UEBhMCR0IxGzAZBgNV
-BAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEYMBYGA1UE
-ChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFJTQSBEb21haW4g
-VmFsaWRhdGlvbiBTZWN1cmUgU2VydmVyIENBMIIBIjANBgkqhkiG9w0BAQEFAAOC
-AQ8AMIIBCgKCAQEA1nMz1tc8INAA0hdFuNY+B6I/x0HuMjDJsGz99J/LEpgPLT+N
-TQEMgg8Xf2Iu6bhIefsWg06t1zIlk7cHv7lQP6lMw0Aq6Tn/2YHKHxYyQdqAJrkj
-eocgHuP/IJo8lURvh3UGkEC0MpMWCRAIIz7S3YcPb11RFGoKacVPAXJpz9OTTG0E
-oKMbgn6xmrntxZ7FN3ifmgg0+1YuWMQJDgZkW7w33PGfKGioVrCSo1yfu4iYCBsk
-Haswha6vsC6eep3BwEIc4gLw6uBK0u+QDrTBQBbwb4VCSmT3pDCg/r8uoydajotY
-uK3DGReEY+1vVv2Dy2A0xHS+5p3b4eTlygxfFQIDAQABo4IBbjCCAWowHwYDVR0j
-BBgwFoAUU3m/WqorSs9UgOHYm8Cd8rIDZsswHQYDVR0OBBYEFI2MXsRUrYrhd+mb
-+ZsF4bgBjWHhMA4GA1UdDwEB/wQEAwIBhjASBgNVHRMBAf8ECDAGAQH/AgEAMB0G
-A1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAbBgNVHSAEFDASMAYGBFUdIAAw
-CAYGZ4EMAQIBMFAGA1UdHwRJMEcwRaBDoEGGP2h0dHA6Ly9jcmwudXNlcnRydXN0
-LmNvbS9VU0VSVHJ1c3RSU0FDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNybDB2Bggr
-BgEFBQcBAQRqMGgwPwYIKwYBBQUHMAKGM2h0dHA6Ly9jcnQudXNlcnRydXN0LmNv
-bS9VU0VSVHJ1c3RSU0FBZGRUcnVzdENBLmNydDAlBggrBgEFBQcwAYYZaHR0cDov
-L29jc3AudXNlcnRydXN0LmNvbTANBgkqhkiG9w0BAQwFAAOCAgEAMr9hvQ5Iw0/H
-ukdN+Jx4GQHcEx2Ab/zDcLRSmjEzmldS+zGea6TvVKqJjUAXaPgREHzSyrHxVYbH
-7rM2kYb2OVG/Rr8PoLq0935JxCo2F57kaDl6r5ROVm+yezu/Coa9zcV3HAO4OLGi
-H19+24rcRki2aArPsrW04jTkZ6k4Zgle0rj8nSg6F0AnwnJOKf0hPHzPE/uWLMUx
-RP0T7dWbqWlod3zu4f+k+TY4CFM5ooQ0nBnzvg6s1SQ36yOoeNDT5++SR2RiOSLv
-xvcRviKFxmZEJCaOEDKNyJOuB56DPi/Z+fVGjmO+wea03KbNIaiGCpXZLoUmGv38
-sbZXQm2V0TP2ORQGgkE49Y9Y3IBbpNV9lXj9p5v//cWoaasm56ekBYdbqbe4oyAL
-l6lFhd2zi+WJN44pDfwGF/Y4QA5C5BIG+3vzxhFoYt/jmPQT2BVPi7Fp2RBgvGQq
-6jG35LWjOhSbJuMLe/0CjraZwTiXWTb2qHSihrZe68Zk6s+go/lunrotEbaGmAhY
-LcmsJWTyXnW0OMGuf1pGg+pRyrbxmRE1a6Vqe8YAsOf4vmSyrcjC8azjUeqkk+B5
-yOGBQMkKW+ESPMFgKuOXwIlCypTPRpgSabuY0MLTDXJLR27lk8QyKGOHQ+SwMj4K
-00u/I5sUKUErmgQfky3xxzlIPK1aEn8=
+MIIE0DCCA7igAwIBAgIBBzANBgkqhkiG9w0BAQsFADCBgzELMAkGA1UEBhMCVVMx
+EDAOBgNVBAgTB0FyaXpvbmExEzARBgNVBAcTClNjb3R0c2RhbGUxGjAYBgNVBAoT
+EUdvRGFkZHkuY29tLCBJbmMuMTEwLwYDVQQDEyhHbyBEYWRkeSBSb290IENlcnRp
+ZmljYXRlIEF1dGhvcml0eSAtIEcyMB4XDTExMDUwMzA3MDAwMFoXDTMxMDUwMzA3
+MDAwMFowgbQxCzAJBgNVBAYTAlVTMRAwDgYDVQQIEwdBcml6b25hMRMwEQYDVQQH
+EwpTY290dHNkYWxlMRowGAYDVQQKExFHb0RhZGR5LmNvbSwgSW5jLjEtMCsGA1UE
+CxMkaHR0cDovL2NlcnRzLmdvZGFkZHkuY29tL3JlcG9zaXRvcnkvMTMwMQYDVQQD
+EypHbyBEYWRkeSBTZWN1cmUgQ2VydGlmaWNhdGUgQXV0aG9yaXR5IC0gRzIwggEi
+MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC54MsQ1K92vdSTYuswZLiBCGzD
+BNliF44v/z5lz4/OYuY8UhzaFkVLVat4a2ODYpDOD2lsmcgaFItMzEUz6ojcnqOv
+K/6AYZ15V8TPLvQ/MDxdR/yaFrzDN5ZBUY4RS1T4KL7QjL7wMDge87Am+GZHY23e
+cSZHjzhHU9FGHbTj3ADqRay9vHHZqm8A29vNMDp5T19MR/gd71vCxJ1gO7GyQ5HY
+pDNO6rPWJ0+tJYqlxvTV0KaudAVkV4i1RFXULSo6Pvi4vekyCgKUZMQWOlDxSq7n
+eTOvDCAHf+jfBDnCaQJsY1L6d8EbyHSHyLmTGFBUNUtpTrw700kuH9zB0lL7AgMB
+AAGjggEaMIIBFjAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNV
+HQ4EFgQUQMK9J47MNIMwojPX+2yz8LQsgM4wHwYDVR0jBBgwFoAUOpqFBxBnKLbv
+9r0FQW4gwZTaD94wNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8v
+b2NzcC5nb2RhZGR5LmNvbS8wNQYDVR0fBC4wLDAqoCigJoYkaHR0cDovL2NybC5n
+b2RhZGR5LmNvbS9nZHJvb3QtZzIuY3JsMEYGA1UdIAQ/MD0wOwYEVR0gADAzMDEG
+CCsGAQUFBwIBFiVodHRwczovL2NlcnRzLmdvZGFkZHkuY29tL3JlcG9zaXRvcnkv
+MA0GCSqGSIb3DQEBCwUAA4IBAQAIfmyTEMg4uJapkEv/oV9PBO9sPpyIBslQj6Zz
+91cxG7685C/b+LrTW+C05+Z5Yg4MotdqY3MxtfWoSKQ7CC2iXZDXtHwlTxFWMMS2
+RJ17LJ3lXubvDGGqv+QqG+6EnriDfcFDzkSnE3ANkR/0yBOtg2DZ2HKocyQetawi
+DsoXiWJYRBuriSUBAA/NxBti21G00w9RKpv0vHP8ds42pM3Z2Czqrpv1KrKQ0U11
+GIo/ikGQI31bS/6kA1ibRrLDYGCD+H1QQc7CoZDDu+8CL9IVVO5EFdkKrqeKM+2x
+LXY2JtwE65/3YR8V3Idv7kaWKK2hJn0KCacuBKONvPi8BDAB
 -----END CERTIFICATE-----
 
diff --git a/pki/testdata/ssl/certificates/rsa-1024-1.key b/pki/testdata/ssl/certificates/rsa-1024-1.key
new file mode 100644
index 0000000..5355480
--- /dev/null
+++ b/pki/testdata/ssl/certificates/rsa-1024-1.key
@@ -0,0 +1,16 @@
+-----BEGIN PRIVATE KEY-----
+MIICeQIBADANBgkqhkiG9w0BAQEFAASCAmMwggJfAgEAAoGBAL7mb78RnGZpGth3
+z5ilQTmz77Cc6YOqZPulE83+Vnjy39YzK0csTluvbWqVMUHtYGsRF8h+gYvywt8l
+zITocpE0UyeXlzsoOI8h7SgUCrYPAl9l6VydsUQ3F14uJ4LWaQcz/R601LhYrvQc
+XgpDr4U1rp108EAFG01BVFFiInCVAgMBAAECgYEAtGnxuCC7r+mrTmNE1d1wHEma
+wE47Po0d7NlhMzAopxvaQYSQZS5RS8MqZC1lpQnjMqyvznMImauvUddWR1GrWz6T
+jU7YJiq/NJZ26qzACKCJWj9UG37fzC3L7JDMz4Yz3K/iISH7iDLIrh4JWw8A6xQL
++cq8/u4ZhjtODbxYHu0CQQDuPMkrqPolGpy6mo18jP8QuNooZmpZ5z5C72GtqqRz
+AMcfIOtluBBcFef7iZoKa+YcEldjpdiCK0I3qy86G9JLAkEAzSIg3A8qta3o/U2d
+TwUq5BMGUotHmG/A1MwEK5GnRHj3L0nu/HpE3tjrKrkMC4i+zVTYBop90XFBPdy6
+d+v8nwJBAM6Qdf0dLoctY+eISlVMC3x8SuvsoRoCnsF6vb7OznfInN4otPIlfknZ
+1KMM1DtlAsgkPxFvoyJ6T5flHbXMmbECQQCaKR/QwYUzbDNAyeeCzztgk/uYZRu1
+L6cXRQuNQrUV/GKno0R7cdf4McTqIo8uy+G4ph6DK+lKUXbaatun7C25AkEAsr/A
+yOyChfU16iQMa45LhT9FoplbNbDvczJ3EUUsf8i1I/8FG/GM4AaUMUshdwCf7hdh
+ZBHFE6S2PIUV9iZVbA==
+-----END PRIVATE KEY-----
diff --git a/pki/testdata/ssl/certificates/rsa-1024-2.key b/pki/testdata/ssl/certificates/rsa-1024-2.key
new file mode 100644
index 0000000..14feba2
--- /dev/null
+++ b/pki/testdata/ssl/certificates/rsa-1024-2.key
@@ -0,0 +1,16 @@
+-----BEGIN PRIVATE KEY-----
+MIICdgIBADANBgkqhkiG9w0BAQEFAASCAmAwggJcAgEAAoGBAM3oM+IGvDDamzE+
+5cZRkeoH8PBYH5HSChJOcRepGpPMxsOjR3aomPCi0eI3cR4IOqaakpxDJswp+ioA
+H4hEMDMoVZijvpXEto0QAy/2O7K7QzhQ1ylFNM8k6WD4xfM8W6PlrlxFHjH47QDq
+k/njjASgxTfj6zHCwauQG4FYTmZNAgMBAAECgYBuds82yDQ35V9yuPKeRW6JZj89
+QZmWKl+a2JhVgDQw7KAJntQc9XAvULpWqTW3TeThMnXK/T+YMkDyPWStPx+3q9PR
+AQS65Bz8BltepO5sdy2QWGnOss97fLG5DJgTHrAZYDKLxJah9hDOf5Tjq4d9GYka
+D6cOgWErS3wv+ERZhQJBAOuVmTnEywk0TIGjIOWud+Yv2TUIc3IqBZnyF1RN8y1y
+NFVGwpCb8aKLRawfDta/kNkQVOkYZCtZRdYb1NHqBJMCQQDfwDel33a3OnVdQNoB
+GbfEJYqmgY7JCzFfH9EVzqB45x6yYvwAHStp1r5dYmwMUSIVs5B8SFA4bUN6cAMr
+BJWfAkEA4xGOXuAP0w9Vrp5NVxSS/IuiEDvVCnT2cSum0NtRSLyLNKa/YiLtBH64
+6O4Gn3aFZrMXJJUd96pUZcrtlma5gQJAaUR0qdxNbPza1Km7JwNjequy5I1VkO5s
+JvXAF8Njqh4KSiDZsHAIyb2XSDYS4WSWZaFaW65l13ZIZeUnCGkavwJAMn0mC5e4
+idlSe3QqaOa3haxAXquQkImH6pSI4jRPzTJxPd8BlShlZeVC4IyCwfz/o6Azce+W
+w+5b/8VIMO2s9g==
+-----END PRIVATE KEY-----
diff --git a/pki/testdata/ssl/certificates/rsa-1024-3.key b/pki/testdata/ssl/certificates/rsa-1024-3.key
new file mode 100644
index 0000000..4a8af8f
--- /dev/null
+++ b/pki/testdata/ssl/certificates/rsa-1024-3.key
@@ -0,0 +1,16 @@
+-----BEGIN PRIVATE KEY-----
+MIICeAIBADANBgkqhkiG9w0BAQEFAASCAmIwggJeAgEAAoGBAMqUxHtJfHQ6709j
+T1yMqY/JH/dg0Kl3DaddDScaVRiv2X+0mhxkFu4/rWEYslj1aSS8CgcdVxSdHsI0
+dXEsumoRFJl/EmfBAwQkukgpkjuE5uUORuxt2vzT1zGPutX0UlMiLINdZ1AB45D6
+c78SBTiIoXai7FZ+SayOf/3MQsYpAgMBAAECgYB7nbITpTD7X+cd43TO/cqOQeVu
+t7Y8YriDMyXOgaQBr3SiF9uejXjsoxCyWjaiUAZ78v6PftjfbE0Tpp0vlWKeNo0q
+iJ0rjbxf04bIpU7+Q+/I4hkXngu7WvmXS8ZjmamEvT1a9XN8bZ1QD+lglYAkZKj5
+iwlVpZfYokj+4sMIgQJBAOnkLBrmlaXhh3KbzLcKPMtmOlm8y2PuSziJN7JTdkb7
+gwaQAa1+5ToOEjAS64qP+BRp9uLTnPuVnbyd27nDElkCQQDduu9KbS2o9IazrVeR
+FMqAitIWb9v/k98IfOc7/LKeyA7oVCzqAsq0nlYM4unGYSiIdlJLLnQCtbVABB4D
+6rhRAkEApM49cbsWqWsQCObVSgixq9Tdusu4OTL4196AW2xKBFxHCAHC3OB0XwL5
+N9ytEda+RIwiBdR8Yh4bpoNJB0z4CQJBAI9yo+LztUmMQSU3LOK4n7X/maFYZuz3
+HqDgJb0iY/Djnvlhk9klSz0E/sjBeNqV+uImImFvQTCLnCI5R63jCbECQQDpeDiP
+DcKOL773vayJixOvvSqruHGvM87KMkpW2zsLbxrlN2gKyf3iMkQX1Kat945qPD98
+kpnDpyVRVRxIc6Sg
+-----END PRIVATE KEY-----
diff --git a/pki/testdata/ssl/certificates/rsa-2048-1.key b/pki/testdata/ssl/certificates/rsa-2048-1.key
new file mode 100644
index 0000000..384bf68
--- /dev/null
+++ b/pki/testdata/ssl/certificates/rsa-2048-1.key
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCvBAyWDWogcaoH
+kjhp9fmm7OognM/SNfIuEKMiqmFLz4GsiNa1I4By8kPqcI8u0KRBvX0F/DDfBvDy
+8nm7gbfMliILkPTKlDqAKY51kV1qBkSQhhiQ7Tl3KXjB4tbdjJemv9TrXfwfr+k4
+9dP8oYLmVmyYRWMGybW7tA6MJewLYeAIBZpbcz0okrKD7izMEi7eCWvQ9O6PdVMG
+atBfUbGrZ0oX0XzsJQgI6iJNq88WQCbfybQLDvXleneem8NHVYO8fCmgVzgsiVw5
+fgaeYWBfCVOGUHsoVwxTDThAfoIGHX1ldQ+3YP+pyph43h5e9jWHHwAjg45SFqkI
+XRTu4I/HAgMBAAECggEASmt63J10qLocdl63TVtSXqg0QEzd1AGrauoZLGbtu3pP
+pimDvv+LIZWhyoE1aU8/4VJtZMuhjlyZvXzcxZ45pS2b6XYomTGhlJjXImf/JFPo
++NmEfa/Z9TE1z6AhBJFBdR7yL2lGCcVX8ygZDb4x9rb+M1uh6aOA+wFsBC0l64pt
+YNGaOtgR1DCqn6mtxFcUOMt6gWEbgu2gwieo4qSGPmGOwNxhEbMWPL+0CPemW+li
+K+fB2RrYpGdSD8kyWHWqZTUT7SegcT2mO3F+eNwwy69srb/R/MAUfbYXbQhTrPuI
+vavor2vT7++Ha2Z7FV+715Jsn2f8OkW0UyFzb7PQsQKBgQDUG5H0XR34wqAfNgaZ
+lzJqDeh6Tg0v991t4imNd/yFBJEa4PyonM9m9ka9o13ySPyIuUyqvUDm0/geVH1g
+dn7o3rTVCKbfeCeDWaU00elMjtCezeDUlnsTgcHpLEpb/5uxJhAL2/KcMlOvHzGv
+ima5zj2tB0dvUfkCtzLthb/etwKBgQDTO4hNrTcNQBTg/XUG2TSERo6WslVOZjJ5
+70AlE9PYgqmoNUONg8XxGwj8n7lx+AY2BB0kfM9ANVc+BNjI2fqFLba2DYDGMpsq
+XrxR2SiRe8UCjftFgHSElIx/mGplgAbElGrSd+pkONwnxtE3E0JD/+y+/dKQeg9z
+iVraymnHcQKBgQC8/9gdU3/qcpo1VXGqGGTuxXfay4PKs2WWjUkTatATQw99UO8x
+25CfoWFFh7Wlt812kw6ysTKMvGJBvG1/r/bDz/Z4QV5Yj/s9enrQRx9IfZV9e9wT
+8ga3Sg8ck7+qnGgCAPWZa6KR9fJFgFlInt2MQS8J6AuKMRPejJmPtndSnwKBgFPP
+dCZ1yrkMKvyWNB+ygL7XC+5I9cX0kKSGxCmx80UdmtktwQ7eMOSYOHmbmkXZBgXa
+ngGDL+wm/eWSoL0Yl+jNmYgkVWrOW3h1PD0xb4JB3IpF8WPDMvgDxLc/rz90i7rl
+tHirsalwUhHKNeqnToySd8nUBf7jH0xVPGJBG7VRAoGBAIty6nRYERJkdWgzrrU+
+TmSxTAFi4hqc/RXMa7kda40SBp3339+/KxaNCQ5YUJjDI/cggEc/Tnm2MjkheH5W
+nBC1iP1A1g9wlk6Ak/RQIq8FRiQFdVwGU2Xa+dRQAyEj8Xq2KudmKkj1M630/kSg
+3qCwc3kKPf2N5fjAtHUwLLHP
+-----END PRIVATE KEY-----
diff --git a/pki/testdata/ssl/certificates/rsa-2048-2.key b/pki/testdata/ssl/certificates/rsa-2048-2.key
new file mode 100644
index 0000000..3336ce7
--- /dev/null
+++ b/pki/testdata/ssl/certificates/rsa-2048-2.key
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCncOKXlHiC4cH7
+YiXsOMc3Vh3OBN26dK/c9tiVG7zQU9EbXbUWz9NNI8+wUDwyBtrR54zH+5R9+cj/
+9QOPd2Vsv3wfaSIaR3qfsag/TK2rooYAis11F17lUHx02KZlZodagEuLCMgdlyIL
+F0RTW4+Nt9ZklEFMXHYxZW2odDiimaUl0tJ3//jGNEBQwHSS7BbA88vKBknjRP4d
+0lFZGJPM7VyEkYElp4qcTBvn4VY89lbgUdVcZjaMOtoUnK6DUZN7GAsWr222y7kc
+BEH5fFOWB2PrgKY//tb41fujm16u2r4jjHngZ8FSs5md3A7z1CP4ChpNF33k9z6s
+AzWb+GNhAgMBAAECggEAFFJdDeyVG71un6Xv2FWjyBGJmIF6r7CNz5GeA6rUJaym
+il27JsOeb5RTFqEGTUQLtsIVkgf0o713KamA/x6MjsBGvkEyRGI8fblAJD6YLWaS
+QOqXuQhXGhnEoSHSQChLcS50/LDaKM048oOmZT+NkrOnL5nWuv/V0HTw9Cr23LT6
+wMuefBrN9cr8ZMmlOMNvJaoTKbCxr6bg4bKjfGr40QX05GnLXaOhg74wWPWMCFZQ
+CfyFhCJvBcXk9Xifb2pMTk9GezfSd28JKy3XKjd2bUTD8KGStgnKvIB7FXVqaQb/
+QOTE0USkYn3l6g53fXWdgk9i87ZRHmMarTv4K8wvaQKBgQDbe6v0CS6ui5A4bliC
+z8EoZVmxxT+vgOf56ZOE65lGcPHOtTMDDL2u8MxqyjnWc7dXrw8FvfpurIe/TEU9
+Y5kCj9NUA08940RKX/5u5RDaW9X2cGVlv7yJSDbA1JxpUjSzc98VFWQJrFkhHBfI
+3eLdVLp+dHBBpGCgZuVQD2ymGwKBgQDDTJwspscuh9q9SWWgcyJv5ke+4MwosgkP
+g8IC2dFFHr3j3GoFnVrrVP6w8zzezNb2ba+9xGaohNgHjmwC203ZcdDCUxem3t/L
+GUM4+dCUC87nB/bGd772pu1jbZZ9bRUBvgf4x1zhlShQNnD+UL2/p/stzWl6SE47
+Yva2416kMwKBgCBZ7lKeN99KewuWWD2P2ezWY44sgOKhoY/YugHRqFoVs87ALrC4
+ZA0xOTBUdooBrHikORajlhJSJAAygdI2qAsUoBW2FywMH7jGxX4bDYziFHuqvYdt
+56BkoI1zyUpM76+z2KIG8SPr34dd2LOm4RW2s3aIOzOxwvxhrlNKsr0ZAoGBALTH
+4LUweKYo2aFoJKueiB0fBAC75CAzlVGIPHoZGK8r4sjfCkFCRJwcpFo1/n2bDc01
+AX3fJMwPlE2CV5dZW7nRslV/RyCPpIdDTkeab6nrOE4BwDw9MkbthEcKdUiLRevD
+9WsjWGX0hUmi63tuUAbuPwNJ5r5r2gb897WZyMyjAoGAYcNgSL1udQE7pEqrAl0t
+ffTbbTJQ487sZm3qhFNXtuitC3h6eXpJecsWRoB/Jnhi4cpSjWgYJzjV4rkZSF79
+es031jtdnPf6G94ZzjTKnkr4z34reDQusukuuD1SSsbURBGVacgZxkq0UaRAROfT
+BTPraf9GfA9BnUEIFdjeKwI=
+-----END PRIVATE KEY-----
diff --git a/pki/testdata/ssl/certificates/rsa-2048-3.key b/pki/testdata/ssl/certificates/rsa-2048-3.key
new file mode 100644
index 0000000..9a6f499
--- /dev/null
+++ b/pki/testdata/ssl/certificates/rsa-2048-3.key
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQDW8jowfwvUgEye
+CyzXw4rrlw1+liz+s9nWucRN5t8dia9L9dQhT0aBg7mUKOQ7L1wcRwzPMVoyFF3G
+KsJw829iMm65P4fy+L9/C1XFfJ9x4rMeya9bHZuKxr29Ieia9KFAaWtASSngF6Uc
+zwvGJ4AZQzUIiE6Ku/ZpGBjki9k36LsufQIeOaEaoHlSPS1K6pMh9Br40xQ+FkB4
+OwFt7zNQygiSJt6NHvET4ib2i+0lZXRa32yl/dEJyf3aWT3iMxm4wLslLOI7Bud+
+y04bVYi6hw+JFUFmFCLkrMW/iZ69S3lUPoUO9xz8fuCR64KjwjSR4FFawZ7ZQUKf
+OUOu3dcXAgMBAAECggEAMss1AwbSxdm3wVVEuIwmBPxCHRrh8SKRJNPrVrlrGjDS
+MvIZufFg6PQ245MyM+ZCLxB/L2srNFBpxI2QO17bgGoIjlA8ESfFIQGNuEh16VS4
+HVtty+tYOVgzuEEOFagffvgqdxuTALi1tPQchSwKcm3WV3jWjqRSW41tPHzrzPEM
+gNw6mlLIUxgaxJ31SytDPfLcCxhjyY1cLOseAtD37x8HZVw52cojmjn0Uy2+TeLu
+6e34KqWzTcO8U7w4mBu6KyQYS5Q2GxR4eMfrja2nmQEJjjtL/MjPCr1RavzRmeO8
+j2w0GbTZaM2otzI21VbNpM+OmX3OkGmKiPNIm0HVKQKBgQDufzscdRfcJSng9Wb/
+kB1mr+AYZubzhHIVgN50UWnzqiLsVBWRGT6+y49z7dN3+4aGHXKjmV0Ceimi/6uC
+nNsZ1kfJrHWXmTbTslQlBxOwyMuBsolWBSZdaqoX3dhDNu7EbUPgWqWjrv412EhH
+UIH/mpmu8TgyA/SPT7BiHjuDcwKBgQDmuIkAYWseZ5iEWXPX2rH1XTtvKAHuzjf7
+yPk5QX+ZeTZiPZPzvn4I6x4kMjnpn5wrVkm5QMQVK2NKpaQwMtdkQcevVybXVJ/u
+0SMRHgXiesF6pG4YgREEJjbHdwmRgAaLffOPVSOvEGPc8ha1tEE7ZwgpKfjnCStC
+2VkmWpcczQKBgQDsn3MIUuxvULfyJ8ge+t8QyKIv07iEFv4Rc6BCC5xxUnX/v5T+
+NuvX5KLZRDaxLe5UFddtlXWARbAVtlB18CY5xi3HW8H3vN12v9FYQ2M33KB8d6Rm
+oglkWbWUpFgyp8fRPw8/AvCgK7ivt3xOtQOlk7+yoEU+6kmz/j5jutcVHQKBgQDP
++ocdPbP3C4GzxIMlkHGc8fcyo0jiwSg8IxVuJHnmmhqJAmNNdGlelrtr+46y53s6
+oaUBhr17K8psrtZL0HjTWmyrxY8wyosFF6dZtcuuNeQVLwZDtozlRaFZuxd3/oVn
+1xjoGuJ42/h5Yg1QrHWlG6KCoOBLO7uwnga8CStw/QKBgQDSzUAJaak3XFAfdou3
+GxWLQJcOXB/WxrZA7gq6K2aWvkY80AOPMGLhVFXA8k1fLI7jn2f9x7Ff6PNrzclf
+mvvN6g6YH0vH9k+W6aHBnen8oGjW3XU4MHn7dPxfxPJ/MDT3toVAvD+6QnKFdd7o
+xCDad5+lKr6f0yyPije/ZDkSSA==
+-----END PRIVATE KEY-----
diff --git a/pki/testdata/ssl/certificates/rsa-768-1.key b/pki/testdata/ssl/certificates/rsa-768-1.key
new file mode 100644
index 0000000..2ccd987
--- /dev/null
+++ b/pki/testdata/ssl/certificates/rsa-768-1.key
@@ -0,0 +1,13 @@
+-----BEGIN PRIVATE KEY-----
+MIIB5gIBADANBgkqhkiG9w0BAQEFAASCAdAwggHMAgEAAmEAn8Be4Q88Bif6duPK
+vG+iyt96BFtCTUgjuNEwhcWoeSO6BeZPeu1VRqOHI7/GE4jHO6iVRCnhw9DJg5eb
++p6zX1IWytyhke/psWBl3RNGXOvLucVWUJctS5pgKN1FNsILAgMBAAECYQCDjRaU
+nsb/CszmOo8ovYWBKqaAD+Z5XX6NIzah8jLaDuGRGic5Q1eF5APVHIcwbuDU2Fyv
+NIJqf768Gx/lUzmAlcGjF9hIRh5vrE4zfeCa2wSUjWNZPmqdTzjkM3r0NYECMQDM
+1ORCXgP/DYHQbCTRFvNA/jYaIXRjUs+HXefXe27jJD32W3Mf+lyIcBV/mR7lRkUC
+MQDHqJMkx3TiRsP2cYmG8citPrEjEA0TwPg181Kvi3N6aE5QzNHHLvl2nVJi7VPl
+VA8CMQCayYKY2J0if52K2D5WN4appbFSu9dNO4YSYJdT0jYwtfGRGvh7wOFuRW0p
+mJetYRUCMQCN9fiZoBAli3duVRAaGPQ86mR8r778mqphgd763kZ/dIaqwNcvruDF
+S9r2aBTM7FUCMD46f/dAx2EfxsAfn3lYQWVpuxFQpK+tIqYzjeKsu/zRaqEkcog5
+BOq06OV3qPYsVA==
+-----END PRIVATE KEY-----
diff --git a/pki/testdata/ssl/certificates/rsa-768-2.key b/pki/testdata/ssl/certificates/rsa-768-2.key
new file mode 100644
index 0000000..6c834c4
--- /dev/null
+++ b/pki/testdata/ssl/certificates/rsa-768-2.key
@@ -0,0 +1,13 @@
+-----BEGIN PRIVATE KEY-----
+MIIB5wIBADANBgkqhkiG9w0BAQEFAASCAdEwggHNAgEAAmEA4SDrD2C751/n+lHQ
+UBn5YynSU9hrO9ttTcnvMgqiL0gv2lAsx0N9QM0dg8rHsQodUYZotUQ0qbzCxzEw
+pRVTHcEYHSnjaO7OfsqpGke+66jK0VhsQBkGbU2RznY3at3fAgMBAAECYQCRzs4v
+QYmxy03ltENk/c2lyhptL4gUVoOulBEVqgls8iX8EV1PGYjwBWkOSLGZGmC3u4KI
+le1z9L9iZxO5GGO0SJ/bLW/pGofgHCikBjLmhhyLuV0oFsY6te/q21fWu2ECMQD0
+nbX+qhNgXYsZ96cb71ZfD80yGtu7dCVEYL/iC30P3BEztLabEIdVwmoUyBFfCDkC
+MQDrmwnyqGx431YH3uyBrlwbJhRvAFfwACMy+6sY54BZdaPni9hHcQoKrAiQOe92
+ptcCMQDcS5AUefybQ4M7bpIbkU7aq7NjVVbgGbhaPTtximElwE3pn+z390m6TS0V
+7Bvg1tkCMQCDkPdUJ1MziFvtV0IxBKHwkyoz9jglEJ6XWMxpwtT8n+HgakpjUq9t
+2DWL/J5JXs8CMQDsP+WjN9GzsQtuUMXEUxc1wgMVRFwvQ55hmXfeWaT2bgX+jpAn
++SreMT1bErrH2M8=
+-----END PRIVATE KEY-----
diff --git a/pki/testdata/ssl/certificates/rsa-768-3.key b/pki/testdata/ssl/certificates/rsa-768-3.key
new file mode 100644
index 0000000..fcf0680
--- /dev/null
+++ b/pki/testdata/ssl/certificates/rsa-768-3.key
@@ -0,0 +1,13 @@
+-----BEGIN PRIVATE KEY-----
+MIIB5AIBADANBgkqhkiG9w0BAQEFAASCAc4wggHKAgEAAmEAtngFrnpogJ4DAPMt
+Jvxxl3vSNFdnNMlpRGlHpPqhtOHTzYzXvRvSmSGzpYhvzVCFujjTvtszd86yehxr
++081ZtQbhHGhPKnudoPfqfYGUB6djJX4+I1pm2cWTOIXiGL7AgMBAAECYE7lbId5
+tA/Qwrm5a8+Mnc0DI+uv0xc280Y6Q1kpaZwdfQhGms3Q5umBcfzkFntvEfgMJstC
+KDWgH5Vo6v7oR/Hk8D0NzOyFNfEU10g72EG47PF2qFMlCZ3dTV5U3lPtOQIxAOfC
+NB/LuHFiMA5LeFlfbV0Fyj4Kr+lqtGdwClmX3+KgfTUj9RcEMs+34z+UpYXt3wIx
+AMmN/LkrZpwktp/iZuaKDvkA5foN660LguOt87/NdIN4l2hn8auEhwmh0Vno5gu2
+ZQIwf6kWFT2eh7ZSSk2AKZrLHyaFVM+GPsksPp4U1W03QhqtXYxFATyq0Ii2gNtc
+of15AjEAvCh2HnM61lebuYTE5UFLGv/QsfBe7GvLpDsXSx5FQBrK1ef7f1A4NDDB
+XLsETzjVAjAegTa8Fk65Qc3YODZhIcDRbJ195DLUaw7ETgpT0utLPH7Kkn1GNyZf
+wzlUtrz3r58=
+-----END PRIVATE KEY-----
diff --git a/pki/testdata/ssl/certificates/rsa-8200-1.key b/pki/testdata/ssl/certificates/rsa-8200-1.key
new file mode 100644
index 0000000..74cf0d9
--- /dev/null
+++ b/pki/testdata/ssl/certificates/rsa-8200-1.key
@@ -0,0 +1,100 @@
+-----BEGIN PRIVATE KEY-----
+MIISRQIBADANBgkqhkiG9w0BAQEFAASCEi8wghIrAgEAAoIEAgCryOGbBSSQ/E53
+duYJ8JpWms7zJk8+FpvZGW8CwGH2Qjs9UQmqMhGKTNySND6Gfk+tAGxd8zWGayyJ
+rVhi5Sigr3+lPieGLt3TLke8LKysm0sSJU+xUUdZUTRjE3eff9Qb2NmgJ0uQIYic
+jSUDznRiOpblzEhX4Rw1Kiw+fkqqsnXRg1+gonL9EmWl28zoeQFvcGRyknZCDpyR
+K4Z667TuPoLk6F8S1IxyIEQPZciFbUnUTABbZTHQWZ33y7HmB3vc/P98PFilXsXH
+41h4AdxzN/5pTI7flRP/bu+4NiVHE/rM1h+ag29R1McxzxoOi9ToYgVRenjSSkgs
+/kjOELvBtIyivHNCwJjRrSXZi9fpZjgGTCqOg2mebU3qWDe0zL97jt9wGG612oFu
+pqCBFnBSn6L/dc03K9Ckx9xuRYv3upc4xOMQnOXKLb9/k/TPpTmSQEk1qhEGOoKw
+NC769IiTo69IxhJbB67gBVQzgJ5CVHfEzFid2SM1g59N3gNezjPb3y44ESlPJSfm
+I/S9Yg/divrE7F4BvFGDP5TIaN3sYZf0IEN6140bz3gNhCP5vD64xFt+Mn3sUfWo
+pAmUpKWY7u7YCn2B3XWg65jHelgzC+itLKHRMt0nSlKCLmIKS/UC/PnmRdNIekBh
+46tS29d3vC9cbeTpeZwneOEP789KO0yqeckGmZyktw6VvF7bFKDyrFQONeYz85No
++dw3L54jnv4BV0bTwuv3CoU6MQI+DSfqaGxv5kmVxMDlLGpGJsezarUyrTseJBSE
+DxungNAGktEawqkyk7ZRWdAUSZlgX/qanVenJ3pwrWWagqkyW5BKmzh+EhnGXnoM
+t23+a2FjyoQRKYFhKL8pJ1QLBYJMNvqK+j2tUWHzgwwYV5YlOdDYz+U3+mQH7xOC
+d0Egg61ci0RmRBRTwLqHWvKhMpOD6JEFhuCEALSe6b73faNkaTvUFV6y7SDkkAea
+fLpBFosHCtGoC5ZwklD9rCKKxcdjJJESMi5RutOMYzA4Y9dayUBN7k1LVx0dw8ei
+ZbWBvETGT3qIbMI9hjvRnJ3x35KyoKbvFXDtbKCQ58HbfO5kk4BAEoFhete+UsFO
+KgMQoKue4Ps9sPNWVWwg7ZxrTKsHMje3dpklMNHdqtgHt69eio88z7zX4ZQPUEN6
+PVUPosX0qWtW/sHVet0iDt0BANKD9T8/iwrns9HbPd2d/LwAOyU0kywdNkplCFOP
+vNHaeSjbrIQq5/SEszLSmbh1kaNOimVBFwjie5Ju5q+4n2FahMtKkEqBajj1f4eT
+dR8hs4evuZaKkzs6jGvQyuI28lBfkz3M9cfumHAShfXoihZcwrb53CBmjN+UBe8l
+LaV0kGIknQIDAQABAoIEAR7kr337fMn+NfZSEaiz9m2gxZsAxrt5wWlXo5kxE+z/
+mDu8uSo8et8OV5SLhLsXOCj6rIJw3K1h1M6luAGBCL9tEF2dQeplv0rdRdVXi243
+N1b6Eszmuxga/Hrc42Rxzql7ZBfjOTmgbjsJPyDiHhgURVLqXBBB0ZrWDMLoX3E3
+Suz03Vu8G0Xb6x/a2YztRg7OfaIFKPNUQV/yHes5PH6kC1IzX/W499EGcHb8bQVh
+1Cczy9Sj7EN1+my32zRtIB9r+F5VU/PZiWQbRKvAWe72oPA67m7TFpeXUdElG6se
+srnnwCM/g+OJipEwl5UKHK32AtLWXagj57r/uAQnCj0ZxTj2/xuAG3uJ0ga/mYLF
++UlYpUaf53ywV5TPbKU9NSp5VUGJg099Dk3h9XeBm42gW+XpP5CudoVL1B6Yr0VL
+7yosblFshf7IH2pIJ3y4UBQ3L3NRNGKUXzBlEhXbqDw08a76wA5S4WY0TyI7/Toc
+irV/smggxq43D40nYh/IoZbnGh7HJ1Cuc/B1guwUGJpVBigoAff58AbUhmNMSKzc
+GEG1E62h2iSoOQTlQLsG2ZjM509YsUCwtKcxaO+sdIN+ZMHBkTSrqR3ZgM5O+FGl
+0KBkKG3A4fjQ6umygbssUdHJwP9ii067fZydHxB1rNhBpZrPwJ0kW6rVmFQPYo4M
++1ENsX0AIz8hLx+10G602hcWu8MVgqO+E1Yoo5n6eNxCbKootZwSRQSwcUXgE9m0
+Q1NHKHsK+pvjR/QyvoEr7SRmcox4PHcYID7EMfPMu2UtsIdRKi4NkIvmzE9a52s1
+MPoanT+t9a4Zte4nQ+htFFFQFt10ue8Vqm16wPJ97gnpEM8keQhVYrttIKDVr2vs
+QEcHJ/PgDeIihy44AbPTQKUYzZ4YEMAkDgoVsBq3Ktk8DTjxOZrZw7xq9xJPS9N3
+5oLaTcUX2670SZUpRAg4/wArQncuE2pfsYP+beaGnUATiYRd8GoDSYtPOSa7BcyN
+Eexo8tB5Kzmvgcypk5N5jefLaVdUdczroIlSDlUcdAQb35Yvnd7F3HLWXJtUIPbh
+LZTJwJWooQVJLDt2lzrg/HQnD+UaYNI1Z8/oMaZ+zUBvQ8gBzArO3SRGfRI7lzvk
+wcJM4LqBO0pIO67NzhVCyhJn7Ua3P++W9d7LULb5fqy/O64W2J2o2Xd9hZEdA47A
+6JidJ2yNsv0p3AUgtVebEhBRQs6bPX4/siYif3xgT1ZZb8fTtQBYWsW8LS4Itdf9
+WaJuUlfI7xdHpQnMVd5qiEjrDk02/x4JI4DmveO/pLyQAJ3qQpvGxXUZ70ecfSAk
+ASn2OADu76TclVlQ4hvZ5913jxx8PWHFykK3w7N82xGZAoICAQ4FzISY+EaKydn8
+jOfOirjfct+0x0PYeDZ3XFEq1CcW7nHARMxlGBe9IwEgoAn/RtLmHtSrscPLpN+8
+mXS8ucPZwxIrbg2tCTZ2FktxAHldz3Fr7aGGeT4F7jE3e0gwYgU1h+CIMyDZZY/H
+j/hANx1a+mAkDr7jafEuOe6nOfnWSuCaTPbyYcyGQ4pIe2Z5A0A6MFATT2Z2YOC6
+tW98BNtw9ucOFNo9ZNakB8ZZ4WOG4vpFSSoSO3xJ2STn5HwuO+j2UF0ptmt5H6Pc
+LzYnbbengq5H0dsnyw/sKbTO4jzXfORjxPhwpvrwNlNvs9hmLB6IKzfiN1PXKITS
+updr+Ts72zD1I95dF3F0TsefncBSY9qq8D0Nq08zF4yYanxPLOmqjc1iCoSWyx95
+RjNTiAoTWqmXvbtd4Z6OBU3M2m5QQYLu1mGcfKveRvW6KdueBhZwXEcY7Vb+pU3q
+1J+Omh4wCQiyuuwsGu6QXmfkcVBOhLDoKxzAQJlch1l3zJdAQoul3iCYnptz6weR
+47Ceg4cdP50KLvgboq4N1VJgI7ivMB9gfP+J/J7JogjUigoQNOLqb/X7Zwmv5ZIX
+ZaKIB39HtKFvo1b/zpZagnx4y1K39pUFY8Nm3v0xZNU+keT3FCjOk44L+sXhdu5F
+tbA81qb+7kBhZn9LMfz9sDTIUXq3OwKCAgEMQCGtq+7q0Scml0Ds5ORrymYX/zhh
+xrkc/jbEHefvq50cCE7Sxmvm+NdFDz3JEpenWR4zPR0+39j8lNCWUK6azUhvqSK/
+HYLLI2EDeUyeCQyULoNT4qva6wnJNuufjaNsOOmwwuBAIgurFKYaTEMD+m+1hYG9
+Pe4drKMm3e3Xdg9IlJdKmY7MY+chxeCuiPfGO/MAm0Rz8pcKo1/cd308HuDL+CnE
+LAFDYc7fa7oaj8i698m6QGeadltIPoggOTntoto659SK8ZLWOHsD3E2YC4Iq6dtQ
+U8p8qWqn2kdWbLPnRhy5BXFcxeVFAbJOvgFMlSw1cCpoOySczBDlSpRjZV3ZP0R3
+gCG6Hjh5N8S+N7aLtQQvurMa/9qz6e1p54LCkXqevDp52wwM2DnjC05J+FaevvWW
+FjIaE8SU+Que77xakQYu7Vk1T2MoTimDAjduqtSTIvDb4uX1WNjgkX66AWUCzbEt
+Gp67cMYh0DjwaLgos6t9XdRp5964m4YPewhAcpVppFV45MOKcBWD99d3nYgOGYs1
+D8+4wXHpEJoU7r0pdz0buljZ1+bPmOiViShWmQgxIrKOCpOMuLKQJl2zJyVam8MN
+dy8xYm3RZF3hCNyROeHp8lEt5dSOpw82LchW2f5ErVYatYzJu/opdu9ToczNuvdU
+/U0liMxSEBr3RgcCggIBBHQzEarEsSNEGcjtuHMR/MZ8ZjG1WQdYp3QiDmXcHM5b
+ziWTtJgnnuKkS6dhLcu3YyVUhZhDTj1QkQAGfd2z41E3dH325sEfO/0l97Bcxi/V
+w+DUCYn82IZpsZg9wCAeAimOjvKzyqtCZvir8d3zo49SF1dcl6UD8WcNX5AeCgzW
+m6Bm8cjq51t9+F4tU878CVpyHf0EKzdObhLfrhlmMY0f3yPJ28fET6iqD4Zc4I/n
+aDa5lnNUEZYjMmW1XPwSa1xRCkZFer1uH03AcSL05nB+QXzuWv24scYBOTy8/zYy
+pRhLZ93gK7RAjR/dr85EFS6LC6T+jdK5O/by7UWOVBIe/N3gFrDa0V5v51f7cyq4
+LKw+wiWlU/KWeEGxEOrVCSLzB1ksnhCHU+fhNExD2W9sTJG14d1f3EyfwqZeestj
+A4N49GgP8UcYotQOl4MJy/bEWJDCUe9v8d+0yTkyGoSHWgvq8zjPFRcl5TnaA/fs
+jYQwrWEjI5MQKoqyoRf4CwMUGqZfOmEHNdBQ0biHblML8YVahdPBSCd8qj1/GxoJ
+3u12xnO9mXHR1ZwsfCXJpolwJmFDyP/lmxFzZrxuJS9RYDVlXCzEIV1+NKrpacyk
+tZCQr2/tQ958eH73OBKChLOYinWjoVaLwALEQsYQJ9qxMiG9vJDVv9WUMi+uMZwh
+AoICAQeazA1OfPrBqWcYX9Ju6KlNNIFTCsIPpZws5vxpgDBUvSvIsH3BdPwlnySc
+qIMoioH1HX07Q+ti9AUfsDiPj0RDiOLgANTY0feeV7vbUceM4IUgNqAdRweX/jQt
+ZqleOIOW9OKopqLJP6sNH2uVycgvb6ckYHyEdEtxfrpC7EFjZWtt6lkB6BZTMgjS
+GH7gQceKMXg/6od7oW2WK4zllBV9KZkUzYCcvJACqHQjIJ0agsYlydFX57iIHnRD
+dSdjvuUYwhXtEhDKk5dt6ldkK7rl8gEHuQAtc7ZdSPs30i8BPdCkwnHMwimQI5np
+yrF827uZop7tqTWY+Upol1hvKpxlMZQJ5Uu1e7pYxj/hcb2PQj+JuDaU1Fg/WZlz
+7tBeSdrUimT9feNlKh7TH2QlAY2Dnuneqv9neeScPt0nmKIqOieSfV8mMcmZJXnA
+w54zAwws+db4ysIFITFj3QXS6/M1qGnMHF9edgjvod8drir3JtMFbcBePd0cdjLt
+QJRdkKrJNp0kyXZJtGU83O5WLShw3yO5kaP307/iPf8rMisqZLzX61RKIpvgncRj
+LIafZS4Uw3QVEPiB8kRZ52b6mhH7jAGqTbQPN3mVm4xvnKN0Z8+zOd2Lcf9m+8Mu
+S5AbbZEUs/YYECp2ZxZYHZwd28Vz3HodxSm6MGjLeeK7YrH7gwKCAgBm0zD2DvKK
+EfDQOk2DpnScdNkuYlRD7WADQfgKg6GheSWIvAi9Dh/Ks3ZIcVAcpQgWQoMlhTie
+ZudfSjWxfFwlTAYKfF1kUnlrOACz04ZqsFMzx7Ks1HkvG1KEBTenAetcDPcL1b79
+U01tql7T6NIkxwtOR/nr1CvxgJa2wuuLYiUIAyIQYY0c18FkyFii1nJuneGb/Zvf
+ctf+S5O+GuSOc+LjDSGIa8RZf5ScxRmKGj6OSrYRGrM7ZoS/psvGQSOJeITN5SNJ
+umAA89mfpz8V87HHn520Vo7G9vmm5pQr27Nu1RBQJBXgrhC5fWXBXk/zmnyqskDM
+Bcb1h3nppB6dr5263iy+HHMxS/L0m6kCUfxfj6A4d1/fTGbv1tRCtlR9Rq4EJxWr
+8n49pbluSvL5XZoJJH2PGjjxNurSpnXVRFFOjpvl73wE/X/bH/Gs8AMtIrpnBRmM
+viaX/AOym3DFU2RTgNIt8zmNtqq/NhAuQmYEhodODXtnzzquh4Z4EZmhfzq/do5e
+nGTfN4hN7a9ODtP9Gt+w2CBCnE+7OnWo6Asj+wK0H59c2wfSD68d5n+V7U+BHHkN
+E8uwIjFNZ+n3LRdH/iY7w4ujgIdZRcQuOMf00a3950mcJM0hz278FuDIipbMFCxG
+qrLjqBtCTH9vu/Df2F0JNICD6Ro21WM/YQ==
+-----END PRIVATE KEY-----
diff --git a/pki/verify_name_match_fuzzer.cc b/pki/verify_name_match_fuzzer.cc
index d76abc6..5b2b159 100644
--- a/pki/verify_name_match_fuzzer.cc
+++ b/pki/verify_name_match_fuzzer.cc
@@ -6,6 +6,7 @@
 
 #include <stddef.h>
 #include <stdint.h>
+#include <stdlib.h>
 
 #include <fuzzer/FuzzedDataProvider.h>
 
@@ -24,11 +25,13 @@
   std::vector<uint8_t> second_part =
       fuzzed_data.ConsumeRemainingBytes<uint8_t>();
 
-  bssl::der::Input in1(first_part.data(), first_part.size());
-  bssl::der::Input in2(second_part.data(), second_part.size());
+  bssl::der::Input in1(first_part);
+  bssl::der::Input in2(second_part);
   bool match = net::VerifyNameMatch(in1, in2);
   bool reverse_order_match = net::VerifyNameMatch(in2, in1);
   // Result should be the same regardless of argument order.
-  CHECK_EQ(match, reverse_order_match);
+  if (match != reverse_order_match) {
+    abort();
+  }
   return 0;
 }
diff --git a/pki/verify_name_match_normalizename_fuzzer.cc b/pki/verify_name_match_normalizename_fuzzer.cc
index 96f4608..0bf31bb 100644
--- a/pki/verify_name_match_normalizename_fuzzer.cc
+++ b/pki/verify_name_match_normalizename_fuzzer.cc
@@ -18,9 +18,13 @@
     // produce the same output again.
     std::string renormalized_der;
     bool renormalize_success = net::NormalizeName(
-        bssl::der::Input(&normalized_der), &renormalized_der, &errors);
-    CHECK(renormalize_success);
-    CHECK_EQ(normalized_der, renormalized_der);
+        bssl::der::Input(normalized_der), &renormalized_der, &errors);
+    if (!renormalize_success) {
+      abort();
+    }
+    if (normalized_der != renormalized_der) {
+      abort();
+    }
   }
   return 0;
 }
diff --git a/pki/verify_name_match_unittest.cc b/pki/verify_name_match_unittest.cc
index 7bdacb2..4e57250 100644
--- a/pki/verify_name_match_unittest.cc
+++ b/pki/verify_name_match_unittest.cc
@@ -71,20 +71,20 @@
 TEST_P(VerifyNameMatchSimpleTest, ExactEquality) {
   std::string der;
   ASSERT_TRUE(LoadTestData("ascii", value_type(), suffix(), &der));
-  EXPECT_TRUE(VerifyNameMatch(SequenceValueFromString(&der),
-                              SequenceValueFromString(&der)));
+  EXPECT_TRUE(VerifyNameMatch(SequenceValueFromString(der),
+                              SequenceValueFromString(der)));
 
   std::string der_extra_attr;
   ASSERT_TRUE(LoadTestData("ascii", value_type(), suffix() + "-extra_attr",
                            &der_extra_attr));
-  EXPECT_TRUE(VerifyNameMatch(SequenceValueFromString(&der_extra_attr),
-                              SequenceValueFromString(&der_extra_attr)));
+  EXPECT_TRUE(VerifyNameMatch(SequenceValueFromString(der_extra_attr),
+                              SequenceValueFromString(der_extra_attr)));
 
   std::string der_extra_rdn;
   ASSERT_TRUE(LoadTestData("ascii", value_type(), suffix() + "-extra_rdn",
                            &der_extra_rdn));
-  EXPECT_TRUE(VerifyNameMatch(SequenceValueFromString(&der_extra_rdn),
-                              SequenceValueFromString(&der_extra_rdn)));
+  EXPECT_TRUE(VerifyNameMatch(SequenceValueFromString(der_extra_rdn),
+                              SequenceValueFromString(der_extra_rdn)));
 }
 
 // Ensure that a Name does not match another Name which is exactly the same but
@@ -95,10 +95,10 @@
   std::string der_extra_attr;
   ASSERT_TRUE(LoadTestData("ascii", value_type(), suffix() + "-extra_attr",
                            &der_extra_attr));
-  EXPECT_FALSE(VerifyNameMatch(SequenceValueFromString(&der),
-                               SequenceValueFromString(&der_extra_attr)));
-  EXPECT_FALSE(VerifyNameMatch(SequenceValueFromString(&der_extra_attr),
-                               SequenceValueFromString(&der)));
+  EXPECT_FALSE(VerifyNameMatch(SequenceValueFromString(der),
+                               SequenceValueFromString(der_extra_attr)));
+  EXPECT_FALSE(VerifyNameMatch(SequenceValueFromString(der_extra_attr),
+                               SequenceValueFromString(der)));
 }
 
 // Ensure that a Name does not match another Name which has the same number of
@@ -111,13 +111,13 @@
   std::string der_extra_attr;
   ASSERT_TRUE(LoadTestData("ascii", value_type(), suffix() + "-extra_attr",
                            &der_extra_attr));
-  EXPECT_FALSE(VerifyNameMatch(SequenceValueFromString(&der_dupe_attr),
-                               SequenceValueFromString(&der_extra_attr)));
-  EXPECT_FALSE(VerifyNameMatch(SequenceValueFromString(&der_extra_attr),
-                               SequenceValueFromString(&der_dupe_attr)));
+  EXPECT_FALSE(VerifyNameMatch(SequenceValueFromString(der_dupe_attr),
+                               SequenceValueFromString(der_extra_attr)));
+  EXPECT_FALSE(VerifyNameMatch(SequenceValueFromString(der_extra_attr),
+                               SequenceValueFromString(der_dupe_attr)));
   // However, the name with a dupe attribute should match itself.
-  EXPECT_TRUE(VerifyNameMatch(SequenceValueFromString(&der_dupe_attr),
-                              SequenceValueFromString(&der_dupe_attr)));
+  EXPECT_TRUE(VerifyNameMatch(SequenceValueFromString(der_dupe_attr),
+                              SequenceValueFromString(der_dupe_attr)));
 }
 
 // Ensure that a Name does not match another Name which is exactly the same but
@@ -128,10 +128,10 @@
   std::string der_extra_rdn;
   ASSERT_TRUE(LoadTestData("ascii", value_type(), suffix() + "-extra_rdn",
                            &der_extra_rdn));
-  EXPECT_FALSE(VerifyNameMatch(SequenceValueFromString(&der),
-                               SequenceValueFromString(&der_extra_rdn)));
-  EXPECT_FALSE(VerifyNameMatch(SequenceValueFromString(&der_extra_rdn),
-                               SequenceValueFromString(&der)));
+  EXPECT_FALSE(VerifyNameMatch(SequenceValueFromString(der),
+                               SequenceValueFromString(der_extra_rdn)));
+  EXPECT_FALSE(VerifyNameMatch(SequenceValueFromString(der_extra_rdn),
+                               SequenceValueFromString(der)));
 }
 
 // Runs VerifyNameMatchSimpleTest for all combinations of value_type and and
@@ -156,11 +156,11 @@
   std::string case_swap;
   ASSERT_TRUE(LoadTestData("ascii", value_type(), "case_swap", &case_swap));
   EXPECT_EQ(expected_result(),
-            VerifyNameMatch(SequenceValueFromString(&normal),
-                            SequenceValueFromString(&case_swap)));
+            VerifyNameMatch(SequenceValueFromString(normal),
+                            SequenceValueFromString(case_swap)));
   EXPECT_EQ(expected_result(),
-            VerifyNameMatch(SequenceValueFromString(&case_swap),
-                            SequenceValueFromString(&normal)));
+            VerifyNameMatch(SequenceValueFromString(case_swap),
+                            SequenceValueFromString(normal)));
 }
 
 // Verify matching folds whitespace (for the types which currently support
@@ -172,11 +172,11 @@
   ASSERT_TRUE(
       LoadTestData("ascii", value_type(), "extra_whitespace", &whitespace));
   EXPECT_EQ(expected_result(),
-            VerifyNameMatch(SequenceValueFromString(&normal),
-                            SequenceValueFromString(&whitespace)));
+            VerifyNameMatch(SequenceValueFromString(normal),
+                            SequenceValueFromString(whitespace)));
   EXPECT_EQ(expected_result(),
-            VerifyNameMatch(SequenceValueFromString(&whitespace),
-                            SequenceValueFromString(&normal)));
+            VerifyNameMatch(SequenceValueFromString(whitespace),
+                            SequenceValueFromString(normal)));
 }
 
 // Runs VerifyNameMatchNormalizationTest for each (expected_result, value_type)
@@ -207,11 +207,11 @@
   std::string der_2;
   ASSERT_TRUE(LoadTestData("ascii", value_type_2(), "unmangled", &der_2));
   if (TypesAreComparable(value_type_1(), value_type_2())) {
-    EXPECT_TRUE(VerifyNameMatch(SequenceValueFromString(&der_1),
-                                SequenceValueFromString(&der_2)));
+    EXPECT_TRUE(VerifyNameMatch(SequenceValueFromString(der_1),
+                                SequenceValueFromString(der_2)));
   } else {
-    EXPECT_FALSE(VerifyNameMatch(SequenceValueFromString(&der_1),
-                                 SequenceValueFromString(&der_2)));
+    EXPECT_FALSE(VerifyNameMatch(SequenceValueFromString(der_1),
+                                 SequenceValueFromString(der_2)));
   }
 }
 
@@ -234,37 +234,37 @@
                            &der_2_extra_attr));
 
   if (TypesAreComparable(value_type_1(), value_type_2())) {
-    EXPECT_TRUE(VerifyNameInSubtree(SequenceValueFromString(&der_1),
-                                    SequenceValueFromString(&der_2)));
-    EXPECT_TRUE(VerifyNameInSubtree(SequenceValueFromString(&der_2),
-                                    SequenceValueFromString(&der_1)));
-    EXPECT_TRUE(VerifyNameInSubtree(SequenceValueFromString(&der_1_extra_rdn),
-                                    SequenceValueFromString(&der_2)));
-    EXPECT_TRUE(VerifyNameInSubtree(SequenceValueFromString(&der_2_extra_rdn),
-                                    SequenceValueFromString(&der_1)));
+    EXPECT_TRUE(VerifyNameInSubtree(SequenceValueFromString(der_1),
+                                    SequenceValueFromString(der_2)));
+    EXPECT_TRUE(VerifyNameInSubtree(SequenceValueFromString(der_2),
+                                    SequenceValueFromString(der_1)));
+    EXPECT_TRUE(VerifyNameInSubtree(SequenceValueFromString(der_1_extra_rdn),
+                                    SequenceValueFromString(der_2)));
+    EXPECT_TRUE(VerifyNameInSubtree(SequenceValueFromString(der_2_extra_rdn),
+                                    SequenceValueFromString(der_1)));
   } else {
-    EXPECT_FALSE(VerifyNameInSubtree(SequenceValueFromString(&der_1),
-                                     SequenceValueFromString(&der_2)));
-    EXPECT_FALSE(VerifyNameInSubtree(SequenceValueFromString(&der_2),
-                                     SequenceValueFromString(&der_1)));
-    EXPECT_FALSE(VerifyNameInSubtree(SequenceValueFromString(&der_1_extra_rdn),
-                                     SequenceValueFromString(&der_2)));
-    EXPECT_FALSE(VerifyNameInSubtree(SequenceValueFromString(&der_2_extra_rdn),
-                                     SequenceValueFromString(&der_1)));
+    EXPECT_FALSE(VerifyNameInSubtree(SequenceValueFromString(der_1),
+                                     SequenceValueFromString(der_2)));
+    EXPECT_FALSE(VerifyNameInSubtree(SequenceValueFromString(der_2),
+                                     SequenceValueFromString(der_1)));
+    EXPECT_FALSE(VerifyNameInSubtree(SequenceValueFromString(der_1_extra_rdn),
+                                     SequenceValueFromString(der_2)));
+    EXPECT_FALSE(VerifyNameInSubtree(SequenceValueFromString(der_2_extra_rdn),
+                                     SequenceValueFromString(der_1)));
   }
 
-  EXPECT_FALSE(VerifyNameInSubtree(SequenceValueFromString(&der_1),
-                                   SequenceValueFromString(&der_2_extra_rdn)));
-  EXPECT_FALSE(VerifyNameInSubtree(SequenceValueFromString(&der_2),
-                                   SequenceValueFromString(&der_1_extra_rdn)));
-  EXPECT_FALSE(VerifyNameInSubtree(SequenceValueFromString(&der_1_extra_attr),
-                                   SequenceValueFromString(&der_2)));
-  EXPECT_FALSE(VerifyNameInSubtree(SequenceValueFromString(&der_2_extra_attr),
-                                   SequenceValueFromString(&der_1)));
-  EXPECT_FALSE(VerifyNameInSubtree(SequenceValueFromString(&der_1),
-                                   SequenceValueFromString(&der_2_extra_attr)));
-  EXPECT_FALSE(VerifyNameInSubtree(SequenceValueFromString(&der_2),
-                                   SequenceValueFromString(&der_1_extra_attr)));
+  EXPECT_FALSE(VerifyNameInSubtree(SequenceValueFromString(der_1),
+                                   SequenceValueFromString(der_2_extra_rdn)));
+  EXPECT_FALSE(VerifyNameInSubtree(SequenceValueFromString(der_2),
+                                   SequenceValueFromString(der_1_extra_rdn)));
+  EXPECT_FALSE(VerifyNameInSubtree(SequenceValueFromString(der_1_extra_attr),
+                                   SequenceValueFromString(der_2)));
+  EXPECT_FALSE(VerifyNameInSubtree(SequenceValueFromString(der_2_extra_attr),
+                                   SequenceValueFromString(der_1)));
+  EXPECT_FALSE(VerifyNameInSubtree(SequenceValueFromString(der_1),
+                                   SequenceValueFromString(der_2_extra_attr)));
+  EXPECT_FALSE(VerifyNameInSubtree(SequenceValueFromString(der_2),
+                                   SequenceValueFromString(der_1_extra_attr)));
 }
 
 // Runs VerifyNameMatchDifferingTypesTest for all combinations of value types in
@@ -293,8 +293,8 @@
   ASSERT_TRUE(LoadTestData(prefix(), value_type_1(), "unmangled", &der_1));
   std::string der_2;
   ASSERT_TRUE(LoadTestData(prefix(), value_type_2(), "unmangled", &der_2));
-  EXPECT_TRUE(VerifyNameMatch(SequenceValueFromString(&der_1),
-                              SequenceValueFromString(&der_2)));
+  EXPECT_TRUE(VerifyNameMatch(SequenceValueFromString(der_1),
+                              SequenceValueFromString(der_2)));
 }
 
 // Runs VerifyNameMatchUnicodeConversionTest with prefix="unicode_bmp" for all
@@ -351,12 +351,12 @@
     }
     der.replace(replace_location, 1, 1, c);
     // Verification should fail due to the invalid character.
-    EXPECT_FALSE(VerifyNameMatch(SequenceValueFromString(&der),
-                                 SequenceValueFromString(&der)));
+    EXPECT_FALSE(VerifyNameMatch(SequenceValueFromString(der),
+                                 SequenceValueFromString(der)));
     std::string normalized_der;
     CertErrors errors;
     EXPECT_FALSE(
-        NormalizeName(SequenceValueFromString(&der), &normalized_der, &errors));
+        NormalizeName(SequenceValueFromString(der), &normalized_der, &errors));
   }
 }
 
@@ -371,11 +371,11 @@
     SCOPED_TRACE(c);
     der.replace(replace_location, 1, 1, c);
     bool expected_result = (c <= 127);
-    EXPECT_EQ(expected_result, VerifyNameMatch(SequenceValueFromString(&der),
-                                               SequenceValueFromString(&der)));
+    EXPECT_EQ(expected_result, VerifyNameMatch(SequenceValueFromString(der),
+                                               SequenceValueFromString(der)));
     std::string normalized_der;
     CertErrors errors;
-    EXPECT_EQ(expected_result, NormalizeName(SequenceValueFromString(&der),
+    EXPECT_EQ(expected_result, NormalizeName(SequenceValueFromString(der),
                                              &normalized_der, &errors));
   }
 }
@@ -386,11 +386,11 @@
       LoadTestData("invalid", "AttributeTypeAndValue", "extradata", &invalid));
   // Verification should fail due to extra element in AttributeTypeAndValue
   // sequence.
-  EXPECT_FALSE(VerifyNameMatch(SequenceValueFromString(&invalid),
-                               SequenceValueFromString(&invalid)));
+  EXPECT_FALSE(VerifyNameMatch(SequenceValueFromString(invalid),
+                               SequenceValueFromString(invalid)));
   std::string normalized_der;
   CertErrors errors;
-  EXPECT_FALSE(NormalizeName(SequenceValueFromString(&invalid), &normalized_der,
+  EXPECT_FALSE(NormalizeName(SequenceValueFromString(invalid), &normalized_der,
                              &errors));
 }
 
@@ -400,11 +400,11 @@
                            &invalid));
   // Verification should fail due to AttributeTypeAndValue sequence having only
   // one element.
-  EXPECT_FALSE(VerifyNameMatch(SequenceValueFromString(&invalid),
-                               SequenceValueFromString(&invalid)));
+  EXPECT_FALSE(VerifyNameMatch(SequenceValueFromString(invalid),
+                               SequenceValueFromString(invalid)));
   std::string normalized_der;
   CertErrors errors;
-  EXPECT_FALSE(NormalizeName(SequenceValueFromString(&invalid), &normalized_der,
+  EXPECT_FALSE(NormalizeName(SequenceValueFromString(invalid), &normalized_der,
                              &errors));
 }
 
@@ -413,11 +413,11 @@
   ASSERT_TRUE(
       LoadTestData("invalid", "AttributeTypeAndValue", "empty", &invalid));
   // Verification should fail due to empty AttributeTypeAndValue sequence.
-  EXPECT_FALSE(VerifyNameMatch(SequenceValueFromString(&invalid),
-                               SequenceValueFromString(&invalid)));
+  EXPECT_FALSE(VerifyNameMatch(SequenceValueFromString(invalid),
+                               SequenceValueFromString(invalid)));
   std::string normalized_der;
   CertErrors errors;
-  EXPECT_FALSE(NormalizeName(SequenceValueFromString(&invalid), &normalized_der,
+  EXPECT_FALSE(NormalizeName(SequenceValueFromString(invalid), &normalized_der,
                              &errors));
 }
 
@@ -426,11 +426,11 @@
   ASSERT_TRUE(LoadTestData("invalid", "AttributeTypeAndValue",
                            "badAttributeType", &invalid));
   // Verification should fail due to Attribute Type not being an OID.
-  EXPECT_FALSE(VerifyNameMatch(SequenceValueFromString(&invalid),
-                               SequenceValueFromString(&invalid)));
+  EXPECT_FALSE(VerifyNameMatch(SequenceValueFromString(invalid),
+                               SequenceValueFromString(invalid)));
   std::string normalized_der;
   CertErrors errors;
-  EXPECT_FALSE(NormalizeName(SequenceValueFromString(&invalid), &normalized_der,
+  EXPECT_FALSE(NormalizeName(SequenceValueFromString(invalid), &normalized_der,
                              &errors));
 }
 
@@ -440,11 +440,11 @@
                            &invalid));
   // Verification should fail due to AttributeTypeAndValue being a Set instead
   // of a Sequence.
-  EXPECT_FALSE(VerifyNameMatch(SequenceValueFromString(&invalid),
-                               SequenceValueFromString(&invalid)));
+  EXPECT_FALSE(VerifyNameMatch(SequenceValueFromString(invalid),
+                               SequenceValueFromString(invalid)));
   std::string normalized_der;
   CertErrors errors;
-  EXPECT_FALSE(NormalizeName(SequenceValueFromString(&invalid), &normalized_der,
+  EXPECT_FALSE(NormalizeName(SequenceValueFromString(invalid), &normalized_der,
                              &errors));
 }
 
@@ -452,11 +452,11 @@
   std::string invalid;
   ASSERT_TRUE(LoadTestData("invalid", "RDN", "sequenceInsteadOfSet", &invalid));
   // Verification should fail due to RDN being a Sequence instead of a Set.
-  EXPECT_FALSE(VerifyNameMatch(SequenceValueFromString(&invalid),
-                               SequenceValueFromString(&invalid)));
+  EXPECT_FALSE(VerifyNameMatch(SequenceValueFromString(invalid),
+                               SequenceValueFromString(invalid)));
   std::string normalized_der;
   CertErrors errors;
-  EXPECT_FALSE(NormalizeName(SequenceValueFromString(&invalid), &normalized_der,
+  EXPECT_FALSE(NormalizeName(SequenceValueFromString(invalid), &normalized_der,
                              &errors));
 }
 
@@ -464,11 +464,11 @@
   std::string invalid;
   ASSERT_TRUE(LoadTestData("invalid", "RDN", "empty", &invalid));
   // Verification should fail due to RDN having zero AttributeTypeAndValues.
-  EXPECT_FALSE(VerifyNameMatch(SequenceValueFromString(&invalid),
-                               SequenceValueFromString(&invalid)));
+  EXPECT_FALSE(VerifyNameMatch(SequenceValueFromString(invalid),
+                               SequenceValueFromString(invalid)));
   std::string normalized_der;
   CertErrors errors;
-  EXPECT_FALSE(NormalizeName(SequenceValueFromString(&invalid), &normalized_der,
+  EXPECT_FALSE(NormalizeName(SequenceValueFromString(invalid), &normalized_der,
                              &errors));
 }
 
@@ -484,11 +484,11 @@
   std::string invalid =
       normal.replace(replace_location, 4, std::string("\xd8\x35\xdc\x00", 4));
   // Verification should fail due to the invalid codepoints.
-  EXPECT_FALSE(VerifyNameMatch(SequenceValueFromString(&invalid),
-                               SequenceValueFromString(&invalid)));
+  EXPECT_FALSE(VerifyNameMatch(SequenceValueFromString(invalid),
+                               SequenceValueFromString(invalid)));
   std::string normalized_der;
   CertErrors errors;
-  EXPECT_FALSE(NormalizeName(SequenceValueFromString(&invalid), &normalized_der,
+  EXPECT_FALSE(NormalizeName(SequenceValueFromString(invalid), &normalized_der,
                              &errors));
 }
 
@@ -496,23 +496,23 @@
   std::string empty;
   ASSERT_TRUE(LoadTestData("valid", "Name", "empty", &empty));
   // Empty names are equal.
-  EXPECT_TRUE(VerifyNameMatch(SequenceValueFromString(&empty),
-                              SequenceValueFromString(&empty)));
+  EXPECT_TRUE(VerifyNameMatch(SequenceValueFromString(empty),
+                              SequenceValueFromString(empty)));
   // An empty name normalized is unchanged.
   std::string normalized_empty_der;
   CertErrors errors;
-  EXPECT_TRUE(NormalizeName(SequenceValueFromString(&empty),
+  EXPECT_TRUE(NormalizeName(SequenceValueFromString(empty),
                             &normalized_empty_der, &errors));
-  EXPECT_EQ(SequenceValueFromString(&empty), der::Input(&normalized_empty_der));
+  EXPECT_EQ(SequenceValueFromString(empty), der::Input(normalized_empty_der));
 
   // An empty name is not equal to non-empty name.
   std::string non_empty;
   ASSERT_TRUE(
       LoadTestData("ascii", "PRINTABLESTRING", "unmangled", &non_empty));
-  EXPECT_FALSE(VerifyNameMatch(SequenceValueFromString(&empty),
-                               SequenceValueFromString(&non_empty)));
-  EXPECT_FALSE(VerifyNameMatch(SequenceValueFromString(&non_empty),
-                               SequenceValueFromString(&empty)));
+  EXPECT_FALSE(VerifyNameMatch(SequenceValueFromString(empty),
+                               SequenceValueFromString(non_empty)));
+  EXPECT_FALSE(VerifyNameMatch(SequenceValueFromString(non_empty),
+                               SequenceValueFromString(empty)));
 }
 
 // Matching should succeed when the RDNs are sorted differently but are still
@@ -522,10 +522,10 @@
   ASSERT_TRUE(LoadTestData("ascii", "PRINTABLESTRING", "rdn_sorting_1", &a));
   std::string b;
   ASSERT_TRUE(LoadTestData("ascii", "PRINTABLESTRING", "rdn_sorting_2", &b));
-  EXPECT_TRUE(VerifyNameMatch(SequenceValueFromString(&a),
-                              SequenceValueFromString(&b)));
-  EXPECT_TRUE(VerifyNameMatch(SequenceValueFromString(&b),
-                              SequenceValueFromString(&a)));
+  EXPECT_TRUE(
+      VerifyNameMatch(SequenceValueFromString(a), SequenceValueFromString(b)));
+  EXPECT_TRUE(
+      VerifyNameMatch(SequenceValueFromString(b), SequenceValueFromString(a)));
 }
 
 // Matching should succeed when the RDNs are sorted differently but are still
@@ -536,10 +536,10 @@
   ASSERT_TRUE(LoadTestData("ascii", "mixed", "rdn_dupetype_sorting_1", &a));
   std::string b;
   ASSERT_TRUE(LoadTestData("ascii", "mixed", "rdn_dupetype_sorting_2", &b));
-  EXPECT_TRUE(VerifyNameMatch(SequenceValueFromString(&a),
-                              SequenceValueFromString(&b)));
-  EXPECT_TRUE(VerifyNameMatch(SequenceValueFromString(&b),
-                              SequenceValueFromString(&a)));
+  EXPECT_TRUE(
+      VerifyNameMatch(SequenceValueFromString(a), SequenceValueFromString(b)));
+  EXPECT_TRUE(
+      VerifyNameMatch(SequenceValueFromString(b), SequenceValueFromString(a)));
 }
 
 TEST(VerifyNameInSubtreeInvalidDataTest, FailOnEmptyRdn) {
@@ -549,12 +549,12 @@
   ASSERT_TRUE(LoadTestData("invalid", "RDN", "empty", &invalid));
   // For both |name| and |parent|, a RelativeDistinguishedName must have at
   // least one AttributeTypeAndValue.
-  EXPECT_FALSE(VerifyNameInSubtree(SequenceValueFromString(&valid),
-                                   SequenceValueFromString(&invalid)));
-  EXPECT_FALSE(VerifyNameInSubtree(SequenceValueFromString(&invalid),
-                                   SequenceValueFromString(&valid)));
-  EXPECT_FALSE(VerifyNameInSubtree(SequenceValueFromString(&invalid),
-                                   SequenceValueFromString(&invalid)));
+  EXPECT_FALSE(VerifyNameInSubtree(SequenceValueFromString(valid),
+                                   SequenceValueFromString(invalid)));
+  EXPECT_FALSE(VerifyNameInSubtree(SequenceValueFromString(invalid),
+                                   SequenceValueFromString(valid)));
+  EXPECT_FALSE(VerifyNameInSubtree(SequenceValueFromString(invalid),
+                                   SequenceValueFromString(invalid)));
 }
 
 TEST(VerifyNameInSubtreeTest, EmptyNameMatching) {
@@ -564,14 +564,14 @@
   ASSERT_TRUE(
       LoadTestData("ascii", "PRINTABLESTRING", "unmangled", &non_empty));
   // Empty name is in the subtree defined by empty name.
-  EXPECT_TRUE(VerifyNameInSubtree(SequenceValueFromString(&empty),
-                                  SequenceValueFromString(&empty)));
+  EXPECT_TRUE(VerifyNameInSubtree(SequenceValueFromString(empty),
+                                  SequenceValueFromString(empty)));
   // Any non-empty name is in the subtree defined by empty name.
-  EXPECT_TRUE(VerifyNameInSubtree(SequenceValueFromString(&non_empty),
-                                  SequenceValueFromString(&empty)));
+  EXPECT_TRUE(VerifyNameInSubtree(SequenceValueFromString(non_empty),
+                                  SequenceValueFromString(empty)));
   // Empty name is not in the subtree defined by non-empty name.
-  EXPECT_FALSE(VerifyNameInSubtree(SequenceValueFromString(&empty),
-                                   SequenceValueFromString(&non_empty)));
+  EXPECT_FALSE(VerifyNameInSubtree(SequenceValueFromString(empty),
+                                   SequenceValueFromString(non_empty)));
 }
 
 // Verify that the normalized output matches the pre-generated expected value
@@ -587,14 +587,14 @@
   ASSERT_TRUE(LoadTestData("unicode", "mixed", "unnormalized", &raw_der));
   std::string normalized_der;
   CertErrors errors;
-  ASSERT_TRUE(NormalizeName(SequenceValueFromString(&raw_der), &normalized_der,
+  ASSERT_TRUE(NormalizeName(SequenceValueFromString(raw_der), &normalized_der,
                             &errors));
-  EXPECT_EQ(SequenceValueFromString(&expected_normalized_der),
-            der::Input(&normalized_der));
+  EXPECT_EQ(SequenceValueFromString(expected_normalized_der),
+            der::Input(normalized_der));
   // Re-normalizing an already normalized Name should not change it.
   std::string renormalized_der;
   ASSERT_TRUE(
-      NormalizeName(der::Input(&normalized_der), &renormalized_der, &errors));
+      NormalizeName(der::Input(normalized_der), &renormalized_der, &errors));
   EXPECT_EQ(normalized_der, renormalized_der);
 }
 
@@ -605,9 +605,9 @@
 
   std::string normalized_der;
   CertErrors errors;
-  ASSERT_TRUE(NormalizeName(SequenceValueFromString(&raw_der), &normalized_der,
+  ASSERT_TRUE(NormalizeName(SequenceValueFromString(raw_der), &normalized_der,
                             &errors));
-  EXPECT_EQ(SequenceValueFromString(&raw_der), der::Input(&normalized_der));
+  EXPECT_EQ(SequenceValueFromString(raw_der), der::Input(normalized_der));
 }
 
 }  // namespace net
diff --git a/pki/verify_name_match_verifynameinsubtree_fuzzer.cc b/pki/verify_name_match_verifynameinsubtree_fuzzer.cc
index 94cc3bf..bfc70d3 100644
--- a/pki/verify_name_match_verifynameinsubtree_fuzzer.cc
+++ b/pki/verify_name_match_verifynameinsubtree_fuzzer.cc
@@ -24,12 +24,15 @@
   std::vector<uint8_t> second_part =
       fuzzed_data.ConsumeRemainingBytes<uint8_t>();
 
-  bssl::der::Input in1(first_part.data(), first_part.size());
-  bssl::der::Input in2(second_part.data(), second_part.size());
+  bssl::der::Input in1(first_part);
+  bssl::der::Input in2(second_part);
   bool match = net::VerifyNameInSubtree(in1, in2);
   bool reverse_order_match = net::VerifyNameInSubtree(in2, in1);
   // If both InSubtree matches are true, then in1 == in2 (modulo normalization).
-  if (match && reverse_order_match)
-    CHECK(net::VerifyNameMatch(in1, in2));
+  if (match && reverse_order_match) {
+    if (!net::VerifyNameMatch(in1, in2)) {
+      abort();
+    }
+  }
   return 0;
 }
diff --git a/pki/verify_signed_data_unittest.cc b/pki/verify_signed_data_unittest.cc
index 3dd5702..6ab0878 100644
--- a/pki/verify_signed_data_unittest.cc
+++ b/pki/verify_signed_data_unittest.cc
@@ -55,10 +55,10 @@
   ASSERT_TRUE(ReadTestDataFromPemFile(path, mappings));
 
   std::optional<SignatureAlgorithm> signature_algorithm =
-      ParseSignatureAlgorithm(der::Input(&algorithm));
+      ParseSignatureAlgorithm(der::Input(algorithm));
   ASSERT_TRUE(signature_algorithm);
 
-  der::Parser signature_value_parser((der::Input(&signature_value)));
+  der::Parser signature_value_parser((der::Input(signature_value)));
   std::optional<der::BitString> signature_value_bit_string =
       signature_value_parser.ReadBitString();
   ASSERT_TRUE(signature_value_bit_string.has_value())
@@ -66,9 +66,9 @@
 
   bool expected_result_bool = expected_result == SUCCESS;
 
-  bool result = VerifySignedData(*signature_algorithm, der::Input(&signed_data),
+  bool result = VerifySignedData(*signature_algorithm, der::Input(signed_data),
                                  signature_value_bit_string.value(),
-                                 der::Input(&public_key), cache);
+                                 der::Input(public_key), cache);
 
   EXPECT_EQ(expected_result_bool, result);
 }