Fairly substantial rewrite.  Collecting certificate attributes is now completed before any checks are performed.  This means that the order of the attributes in OpenSSL output no longer affects the output and allows checks to depend on any combination of attributes. Clearly distinguish between root and intermediate certificates. Indicate expiry time of a certificate that is coming in range of expiry. Blank line in front of root certificates so that things will appear in related blocks (assuming that's how the input is structured).
Fairly substantial rewrite.  Collecting certificate attributes is now completed before any checks are performed.  This means that the order of the attributes in OpenSSL output no longer affects the output and allows checks to depend on any combination of attributes.
Clearly distinguish between root and intermediate certificates.
Indicate expiry time of a certificate that is coming in range of expiry.
Blank line in front of root certificates so that things will appear in related blocks (assuming that's how the input is structured).



ukf/ukf-meta,ukf/ukf-meta,ukf/ukf-meta