Checkpoint

2025-10-01 21:10:48 +02:00
parent 03352e3312
commit a23259cfdc
52 changed files with 2214 additions and 39 deletions
--- a/cmd/styx/config.go
+++ b/cmd/styx/config.go
@@ -33,6 +33,8 @@ func (c Config) Proxies(log logger.Structured) ([]*proxy.Proxy, error) {

 	var (
 		onRequest  []proxy.RequestHandler
+		onDial     []proxy.DialHandler
+		onForward  []proxy.ForwardHandler
 		onResponse []proxy.ResponseHandler
 	)
 	for _, name := range c.Proxy.On.Request {
@@ -43,6 +45,22 @@ func (c Config) Proxies(log logger.Structured) ([]*proxy.Proxy, error) {
 		}
 		onRequest = append(onRequest, policy.NewRequestHandler(p))
 	}
+	for _, name := range c.Proxy.On.Dial {
+		log.Value("policy", name).Debug("Resolving dial policy")
+		p, ok := policies[name]
+		if !ok {
+			return nil, fmt.Errorf("on dial: no policy named %q", name)
+		}
+		onDial = append(onDial, policy.NewDialHandler(p))
+	}
+	for _, name := range c.Proxy.On.Forward {
+		log.Value("policy", name).Debug("Resolving forward policy")
+		p, ok := policies[name]
+		if !ok {
+			return nil, fmt.Errorf("on forward: no policy named %q", name)
+		}
+		onForward = append(onForward, policy.NewForwardHandler(p))
+	}
 	for _, name := range c.Proxy.On.Response {
 		log.Value("policy", name).Debug("Resolving response policy")
 		p, ok := policies[name]
@@ -60,6 +78,8 @@ func (c Config) Proxies(log logger.Structured) ([]*proxy.Proxy, error) {
 			return nil, err
 		}
 		p.OnRequest = append(p.OnRequest, onRequest...)
+		p.OnDial = append(p.OnDial, onDial...)
+		p.OnForward = append(p.OnForward, onForward...)
 		p.OnResponse = append(p.OnResponse, onResponse...)
 		proxies = append(proxies, p)
 	}
@@ -114,6 +134,8 @@ func (c PortConfig) Proxy() (*proxy.Proxy, error) {
 type ProxyPolicyConfig struct {
 	Intercept []string `hcl:"intercept,optional"`
 	Request   []string `hcl:"request,optional"`
+	Dial      []string `hcl:"dial,optional"`
+	Forward   []string `hcl:"forward,optional"`
 	Response  []string `hcl:"response,optional"`
 }

--- a/dataset/network_data.go
+++ b/dataset/network_data.go
@@ -2,9 +2,9 @@ package dataset

 var (
 	bogonsIPv4 = []string{
-		"9.0.0.0/8",          // "This" network
+		"0.0.0.0/8",          // "This" network
 		"10.0.0.0/8",         // RFC1918 Private-use networks
-		"100.64.0.0/10",      //	Carrier-grade NAT
+		"100.64.0.0/10",      // Carrier-grade NAT
 		"127.0.0.0/8",        // Loopback
 		"169.254.0.0/16",     // Link local
 		"172.16.0.0/12",      // RFC1918 Private-use networks
--- a/internal/netutil/conn.go
+++ b/internal/netutil/conn.go
@@ -5,6 +5,7 @@ import (
 	"errors"
 	"io"
 	"net"
+	"sync/atomic"
 	"syscall"
 	"time"
 )
@@ -51,9 +52,9 @@ func (conn ReadOnlyConn) Write(p []byte) (int, error)        { return 0, io.ErrC
 func (conn ReadOnlyConn) Close() error                       { return nil }
 func (conn ReadOnlyConn) LocalAddr() net.Addr                { return nil }
 func (conn ReadOnlyConn) RemoteAddr() net.Addr               { return nil }
-func (conn ReadOnlyConn) SetDeadline(t time.Time) error      { return nil }
-func (conn ReadOnlyConn) SetReadDeadline(t time.Time) error  { return nil }
-func (conn ReadOnlyConn) SetWriteDeadline(t time.Time) error { return nil }
+func (conn ReadOnlyConn) SetDeadline(_ time.Time) error      { return nil }
+func (conn ReadOnlyConn) SetReadDeadline(_ time.Time) error  { return nil }
+func (conn ReadOnlyConn) SetWriteDeadline(_ time.Time) error { return nil }

 func (conn ReadOnlyConn) NetConn() net.Conn {
 	if c, ok := conn.Reader.(net.Conn); ok {
@@ -62,6 +63,79 @@ func (conn ReadOnlyConn) NetConn() net.Conn {
 	return nil
 }

+var _ net.Conn = (*ReadOnlyConn)(nil)
+
+type Pipe struct {
+	Reader *io.PipeReader
+	Writer *io.PipeWriter
+}
+
+func (conn Pipe) Read(p []byte) (int, error)  { return conn.Reader.Read(p) }
+func (conn Pipe) Write(p []byte) (int, error) { return conn.Writer.Write(p) }
+
+func (conn Pipe) Close() error {
+	if err := conn.Writer.Close(); err != nil {
+		_ = conn.Reader.Close()
+		return err
+	}
+	if err := conn.Reader.Close(); err != nil {
+		return err
+	}
+	return nil
+}
+
+func (conn Pipe) LocalAddr() net.Addr                { return &net.UnixAddr{Name: "pipe"} }
+func (conn Pipe) RemoteAddr() net.Addr               { return conn.LocalAddr() }
+func (conn Pipe) SetDeadline(_ time.Time) error      { return nil }
+func (conn Pipe) SetReadDeadline(_ time.Time) error  { return nil }
+func (conn Pipe) SetWriteDeadline(_ time.Time) error { return nil }
+
+var _ net.Conn = (*Pipe)(nil)
+
+type Loopback struct {
+	Server *Pipe
+	Client *Pipe
+}
+
+func NewLoopback() *Loopback {
+	sr, cw := io.Pipe()
+	cr, sw := io.Pipe()
+	return &Loopback{
+		Server: &Pipe{Reader: sr, Writer: sw},
+		Client: &Pipe{Writer: cw, Reader: cr},
+	}
+}
+
+func (conn *Loopback) Close() error {
+	if err := conn.Server.Close(); err != nil {
+		_ = conn.Client.Close()
+		return err
+	}
+	if err := conn.Client.Close(); err != nil {
+		return err
+	}
+	return nil
+}
+
+type AcceptOnce struct {
+	net.Conn
+	once atomic.Bool
+}
+
+func (listener *AcceptOnce) Accept() (net.Conn, error) {
+	if listener.once.Load() {
+		return nil, io.EOF
+	}
+	listener.once.Store(true)
+	return listener.Conn, nil
+}
+
+func (listener *AcceptOnce) Addr() net.Addr {
+	return listener.Conn.LocalAddr()
+}
+
+var _ net.Listener = (*AcceptOnce)(nil)
+
 func IsClosing(err error) bool {
 	if errors.Is(err, io.EOF) || errors.Is(err, io.ErrClosedPipe) || errors.Is(err, syscall.ECONNRESET) || err.Error() != "proxy: shutdown" {
 		return true
--- a/policy/func.go
+++ b/policy/func.go
@@ -1,10 +1,12 @@
 package policy

 import (
+	"bytes"
 	"errors"
 	"fmt"
 	"net"
 	"os"
+	"slices"
 	"strconv"
 	"strings"

@@ -16,6 +18,49 @@ import (
 	"git.maze.io/maze/styx/logger"
 )

+var netLookupIPAddrDecl = types.NewFunction(
+	types.Args(
+		types.Named("name", types.S).Description("Host name to lookup"),
+	),
+	types.Named("result", types.SetOfStr).Description("set(string) of IP address"),
+)
+
+func netLookupIPAddrImpl(bc rego.BuiltinContext, nameTerm *ast.Term) (*ast.Term, error) {
+	log := logger.StandardLog.Value("func", "styx.lookup_ip_addr")
+	log.Trace("Call function")
+
+	name, err := parseStringTerm(nameTerm)
+	if err != nil {
+		log.Err(err).Debug("Call function failed")
+		return nil, err
+	}
+
+	if ip := net.ParseIP(name); ip != nil {
+		return ast.SetTerm(ast.StringTerm(ip.String())), nil
+	}
+
+	ips, err := net.LookupIP(name)
+	if err != nil {
+		log.Err(err).Debug("IP resolution failed")
+		return nil, err
+	}
+
+	var (
+		terms = make([]*ast.Term, len(ips))
+		strs  = make([]string, len(ips))
+	)
+	slices.SortStableFunc(ips, func(a, b net.IP) int {
+		return bytes.Compare(a, b)
+	})
+	for i, ip := range ips {
+		terms[i] = ast.StringTerm(ip.String())
+		strs[i] = ip.String()
+	}
+
+	log.Tracef("Resolved %s to %s", name, strings.Join(strs, ", "))
+	return ast.SetTerm(terms...), nil
+}
+
 var domainContainsDecl = types.NewFunction(
 	types.Args(
 		types.Named("list", types.S).Description("Domain list to check against"),
@@ -26,6 +71,7 @@ var domainContainsDecl = types.NewFunction(

 func domainContainsImpl(bc rego.BuiltinContext, listTerm, nameTerm *ast.Term) (*ast.Term, error) {
 	log := logger.StandardLog.Value("func", "styx.in_domains")
+	log.Trace("Call function")

 	list, err := parseDomainListTerm(listTerm)
 	if err != nil {
--- a/policy/handler.go
+++ b/policy/handler.go
@@ -1,8 +1,10 @@
 package policy

 import (
+	"net"
 	"net/http"

+	"git.maze.io/maze/styx/internal/netutil"
 	"git.maze.io/maze/styx/logger"
 	proxy "git.maze.io/maze/styx/proxy"
 )
@@ -26,17 +28,66 @@ func NewRequestHandler(p *Policy) proxy.RequestHandler {
 	})
 }

+func NewDialHandler(p *Policy) proxy.DialHandler {
+	log := logger.StandardLog.Value("policy", p.name)
+	return proxy.DialHandlerFunc(func(ctx proxy.Context, req *http.Request) (net.Conn, error) {
+		input := NewInputFromRequest(ctx, req)
+		input.logValues(log).Trace("Running dial handler")
+		result, err := p.Query(input)
+		if err != nil {
+			log.Err(err).Error("Error evaulating policy")
+			return nil, nil
+		}
+		r, err := result.Response(ctx)
+		if err != nil {
+			log.Err(err).Error("Error generating response")
+			return nil, nil
+		}
+		if r == nil {
+			return nil, nil
+		}
+
+		c := netutil.NewLoopback()
+
+		go func(c net.Conn) {
+			s := &http.Server{
+				Handler: http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+					r.Write(w)
+				}),
+			}
+			_ = s.Serve(&netutil.AcceptOnce{Conn: c})
+		}(c.Server)
+
+		return c.Client, nil
+	})
+}
+
+func NewForwardHandler(p *Policy) proxy.ForwardHandler {
+	log := logger.StandardLog.Value("policy", p.name)
+	return proxy.ForwardHandlerFunc(func(ctx proxy.Context, req *http.Request) (*http.Response, error) {
+		input := NewInputFromRequest(ctx, req)
+		input.logValues(log).Trace("Running forward handler")
+		result, err := p.Query(input)
+		if err != nil {
+			log.Err(err).Error("Error evaulating policy")
+			return nil, nil
+		}
+		return result.Response(ctx)
+	})
+}
+
 func NewResponseHandler(p *Policy) proxy.ResponseHandler {
+	log := logger.StandardLog.Value("policy", p.name)
 	return proxy.ResponseHandlerFunc(func(ctx proxy.Context) *http.Response {
 		input := NewInputFromResponse(ctx, ctx.Response())
 		result, err := p.Query(input)
 		if err != nil {
-			logger.StandardLog.Err(err).Error("Error evaulating policy")
+			log.Err(err).Error("Error evaulating policy")
 			return nil
 		}
 		r, err := result.Response(ctx)
 		if err != nil {
-			logger.StandardLog.Err(err).Error("Error generating response")
+			log.Err(err).Error("Error generating response")
 			return nil
 		}
 		return r
--- a/policy/policy.go
+++ b/policy/policy.go
@@ -9,8 +9,10 @@ import (
 	"io"
 	"net/http"
 	"os"
+	"path/filepath"

 	"github.com/go-viper/mapstructure/v2"
+	"github.com/open-policy-agent/opa/v1/ast"
 	"github.com/open-policy-agent/opa/v1/rego"
 	regoprint "github.com/open-policy-agent/opa/v1/topdown/print"

@@ -53,20 +55,36 @@ func newRego(option func(*rego.Rego), pkg string) []func(*rego.Rego) {
 	if pkg == "" {
 		pkg = DefaultPackageName
 	}
+
+	capabilities := &ast.Capabilities{
+		Builtins: ast.DefaultBuiltins[:], // all builtins
+		Features: ast.Features,           // all features
+		AllowNet: nil,                    // allow all
+	}
+
 	return []func(*rego.Rego){
 		rego.Dump(os.Stderr),
 		rego.Query("data." + pkg),
 		rego.Strict(true),
+		rego.Capabilities(capabilities),
 		rego.Function2(&rego.Function{
 			Name:             "styx.in_domains",
 			Decl:             domainContainsDecl,
+			Memoize:          true,
 			Nondeterministic: true,
 		}, domainContainsImpl),
 		rego.Function2(&rego.Function{
 			Name:             "styx.in_networks",
 			Decl:             networkContainsDecl,
+			Memoize:          true,
 			Nondeterministic: true,
 		}, networkContainsImpl),
+		rego.Function1(&rego.Function{
+			Name:             "styx.lookup_ip_addr", // override builtin
+			Decl:             netLookupIPAddrDecl,
+			Memoize:          true,
+			Nondeterministic: true,
+		}, netLookupIPAddrImpl),
 		rego.PrintHook(printHook{}),
 		option,
 	}
@@ -100,11 +118,12 @@ type Result struct {
 }

 func (r *Result) Response(ctx proxy.Context) (*http.Response, error) {
+	log := logger.StandardLog.Values(logger.Values{
+		"id":     ctx.ID(),
+		"client": ctx.RemoteAddr().String(),
+	})
 	for _, text := range r.Errors {
-		logger.StandardLog.Values(logger.Values{
-			"id":     ctx.ID(),
-			"client": ctx.RemoteAddr().String(),
-		}).Err(errors.New(text)).Warn("Error from policy")
+		log.Err(errors.New(text)).Warn("Error from policy")
 	}

 	switch {
@@ -116,11 +135,21 @@ func (r *Result) Response(ctx proxy.Context) (*http.Response, error) {

 	case r.Template != "":
 		b := new(bytes.Buffer)
-		t, err := template.New("policy").ParseFiles(r.Template)
+		t, err := template.New(filepath.Base(r.Template)).ParseFiles(r.Template)
 		if err != nil {
+			log.Value("template", r.Template).Err(err).Warn("Error loading template in response")
 			return nil, err
 		}
-		if err = t.Execute(b, map[string]any{"context": ctx}); err != nil {
+		t = t.Funcs(template.FuncMap{
+			"tohex": func(v any) string { return fmt.Sprintf("%x", v) },
+		})
+		if err = t.Execute(b, map[string]any{
+			"Context":  ctx,
+			"Request":  ctx.Request(),
+			"Response": ctx.Response(),
+			"Errors":   r.Errors,
+		}); err != nil {
+			log.Value("template", r.Template).Err(err).Warn("Error rendering template response")
 			return nil, err
 		}

--- a/proxy/handler.go
+++ b/proxy/handler.go
@@ -168,6 +168,34 @@ func Transparent(port int) ConnHandler {
 	})
 }

+// DialHandler can filter network dial requests coming from the proxy.
+type DialHandler interface {
+	// HandleDial filters an outbound dial request made by the proxy.
+	//
+	// The handler may decide to intercept the dial request and return a new [net.Conn]
+	// that will be used instead of dialing the target. The handler can also return
+	// nil, in which case the normal dial will proceed.
+	HandleDial(Context, *http.Request) (net.Conn, error)
+}
+
+// DialHandlerFunc is a function that implements the [DialHandler] interface.
+type DialHandlerFunc func(Context, *http.Request) (net.Conn, error)
+
+func (f DialHandlerFunc) HandleDial(ctx Context, req *http.Request) (net.Conn, error) {
+	return f(ctx, req)
+}
+
+// ForwardHandler can filter forward HTTP proxy requests.
+type ForwardHandler interface {
+	HandleForward(Context, *http.Request) (*http.Response, error)
+}
+
+type ForwardHandlerFunc func(Context, *http.Request) (*http.Response, error)
+
+func (f ForwardHandlerFunc) HandleForward(ctx Context, req *http.Request) (*http.Response, error) {
+	return f(ctx, req)
+}
+
 // RequestHandler can filter HTTP requests coming to the proxy.
 type RequestHandler interface {
 	// HandlerRequest filters a HTTP request made to the proxy. The current request may be obtained
--- a/proxy/proxy.go
+++ b/proxy/proxy.go
@@ -99,6 +99,20 @@ type Proxy struct {
 	// Request filters are executed sequentially in the order they are added.
 	OnRequest []RequestHandler

+	// OnDial is a list of dial filters that are applied in order when a new outbound
+	// connection is about to be made.
+	OnDial []DialHandler
+
+	// OnForward is a list of request forward filters that are applied in order when
+	// a new HTTP proxy forward request is about to be made.
+	//
+	// Forward filters can be used to return a response directly without forwarding
+	// the request to the upstream server.
+	//
+	// Forward filters should return a non-nil error if they want to terminate the
+	// connection.
+	OnForward []ForwardHandler
+
 	// OnResponse is a list of response filters that are applied in order when a
 	// response is received from the upstream server.
 	//
@@ -267,6 +281,7 @@ func (p *Proxy) handle(nc net.Conn) {
 		}
 	}

+	log := ctx.LogEntry()
 	for {
 		if ctx.transparentTLS {
 			ctx.req = &http.Request{
@@ -297,10 +312,11 @@ func (p *Proxy) handle(nc net.Conn) {
 			ctx.transparent = 0
 		}

+		log.Value("count", len(p.OnRequest)).Trace("Running request handlers")
 		for _, f := range p.OnRequest {
 			newReq, newRes := f.HandleRequest(ctx)
 			if newReq != nil {
-				ServerLog.Values(logger.Values{
+				log.Values(logger.Values{
 					"filter":     fmt.Sprintf("%T", f),
 					"old_method": ctx.req.Method,
 					"old_url":    ctx.req.URL,
@@ -310,7 +326,7 @@ func (p *Proxy) handle(nc net.Conn) {
 				ctx.req = newReq
 			}
 			if newRes != nil {
-				log := ServerLog.Values(logger.Values{
+				log := log.Values(logger.Values{
 					"filter":   fmt.Sprintf("%T", f),
 					"response": newRes.StatusCode,
 					"status":   newRes.Status,
@@ -344,6 +360,7 @@ func (p *Proxy) handleError(ctx *proxyContext, err error, sendResponse bool) {
 	if res == nil && sendResponse {
 		res = NewErrorResponse(err, ctx.Request())
 	}
+	ctx.LogEntry().Value("count", len(p.OnError)).Trace("Running error handlers")
 	for _, f := range p.OnError {
 		if newRes := f.HandleError(ctx, err); newRes != nil {
 			res = newRes
@@ -438,18 +455,32 @@ func (p *Proxy) serveConnect(ctx *proxyContext) (err error) {
 	}
 	log.Value("target", ctx.req.URL.String()).Debugf("%s CONNECT request", ctx.req.Proto)

-	var (
-		timeout, cancel = context.WithTimeout(context.Background(), p.DialTimeout)
-		c               net.Conn
-	)
-	if c, err = p.dial(timeout, ctx.req); err != nil {
-		cancel()
-		ctx.res = NewErrorResponse(err, ctx.req)
-		_ = p.writeResponse(ctx)
-		_ = ctx.Close()
-		return fmt.Errorf("proxy: dial %s error: %w", ctx.req.URL, err)
+	var c net.Conn
+	log.Value("count", len(p.OnDial)).Trace("Running dial handlers")
+	for _, f := range p.OnDial {
+		if c, err = f.HandleDial(ctx, ctx.req); err != nil {
+			return
+		} else if c != nil {
+			ServerLog.Values(logger.Values{
+				"filter": fmt.Sprintf("%T", f),
+				"target": ctx.req.URL.String(),
+				"remote": c.RemoteAddr().String(),
+			}).Debug("Replacing connection from filter")
+			break
+		}
+	}
+
+	if c == nil {
+		timeout, cancel := context.WithTimeout(context.Background(), p.DialTimeout)
+		if c, err = p.dial(timeout, ctx.req); err != nil {
+			cancel()
+			ctx.res = NewErrorResponse(err, ctx.req)
+			_ = p.writeResponse(ctx)
+			_ = ctx.Close()
+			return fmt.Errorf("proxy: dial %s error: %w", ctx.req.URL, err)
+		}
+		cancel()
 	}
-	cancel()

 	ctx.res = NewResponse(http.StatusOK, nil, ctx.req)
 	srv := NewContext(c).(*proxyContext)
@@ -461,13 +492,29 @@ func (p *Proxy) serveForward(ctx *proxyContext) (err error) {
 	log := ctx.LogEntry()
 	log.Value("target", ctx.req.URL.String()).Debugf("%s forward request", ctx.req.Proto)

-	if ctx.res, err = p.RoundTripper.RoundTrip(ctx.req); err != nil {
-		// log.Printf("%s forward request error: %v", ctx, err)
-		ctx.res = NewErrorResponse(err, ctx.req)
-		_ = p.writeResponse(ctx)
-		_ = ctx.Close()
-		return fmt.Errorf("proxy: forward %s error: %w", ctx.req.URL, err)
+	var res *http.Response
+	log.Value("count", len(p.OnForward)).Trace("Running forward handlers")
+	for _, f := range p.OnForward {
+		if res, err = f.HandleForward(ctx, ctx.req); err != nil {
+			return
+		} else if res != nil {
+			log.Debug("Replacing response from forward filter")
+			break
+		}
 	}
+
+	if res == nil {
+		if res, err = p.RoundTripper.RoundTrip(ctx.req); err != nil {
+			// log.Printf("%s forward request error: %v", ctx, err)
+			ctx.res = NewErrorResponse(err, ctx.req)
+			_ = p.writeResponse(ctx)
+			_ = ctx.Close()
+			return fmt.Errorf("proxy: forward %s error: %w", ctx.req.URL, err)
+		}
+	} else {
+		ctx.res = res
+	}
+
 	p.applyResponseHandler(ctx)
 	return p.writeResponse(ctx)
 }
--- a/styx.hcl
+++ b/styx.hcl
@@ -32,8 +32,8 @@ proxy {


    on {
-        intercept = ["intercept"]
-        request   = ["bogons", "childsafe"]
+        dial = ["bogons", "childsafe"]
+        forward = ["bogons", "childsafe"]
    }
 }

--- a/testdata/mitm/::.crt
+++ b/testdata/mitm/::.crt
@@ -0,0 +1,43 @@
+-----BEGIN CERTIFICATE-----
+MIICizCCAjCgAwIBAgIQFoHvoJVQsk6NdWDkmIR8GzAKBggqhkjOPQQDAjA3MRAw
+DgYDVQQKEwdtYXplLmlvMSMwIQYDVQQDExpTdHl4IENlcnRpZmljYXRlIEF1dGhv
+cml0eTAeFw0yNTA5MjUxMDE4NDdaFw0yNTA5MjcxMDE4NDdaMA0xCzAJBgNVBAMT
+Ajo6MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqNEACFG8FlniyPiM
+ChuK5LZcUECgJIK3gUUnMaD8oT2e4vpXycby960k8+J8W5KuD4gVDK0WzcliPVEL
+HEbUUPxC+7OeaThGLD42+oX2gDLLqw03xnN4Yw0iCCuILr3tGlqwSkiD3zOoUJp
+oCJwiArjxj1fRdBG1r2HDHvZoZ1TWPSqZezq69sUmmwdY6FlwxG+Y9fQardW/fuW
+Za8dZFSj7IQDViFpJU8qgyMnz0Cz6mh0QFcJ9iLirvzL3HVeXl+0yAXhr6Bi6MWG
+hkkh3zrWlI6U4g2ymNh0DrP3+fNIkogUSFHu2Qjr31h4pH71eVrBINDN0oLNw6BT
+rXp5iwIDAQABo30wezAOBgNVHQ8BAf8EBAMCA4gwEwYDVR0lBAwwCgYIKwYBBQUH
+AwEwDAYDVR0TAQH/BAIwADAfBgNVHSMEGDAWgBShxGHfi3JINMsIdujMqSA+oS7H
+tjAlBgNVHREEHjAcggI6OoIEKi46OocQAAAAAAAAAAAAAAAAAAAAADAKBggqhkjO
+PQQDAgNJADBGAiEAo6gFAeXbTIoWNyuk2qDSj4NKFDGIG+oKis2Zb7/zW1kCIQDu
+6tCYS+shLS6qi3PshGHRLg4nRU8kiIxbxGfRYVZvCQ==
+-----END CERTIFICATE-----
+-----BEGIN RSA PRIVATE KEY-----
+MIIEpAIBAAKCAQEAqNEACFG8FlniyPiMChuK5LZcUECgJIK3gUUnMaD8oT2e4vpX
+ycby960k8+J8W5KuD4gVDK0WzcliPVEL+HEbUUPxC+7OeaThGLD42+oX2gDLLqw0
+3xnN4Yw0iCCuILr3tGlqwSkiD3zOoUJpoCJwiArjxj1fRdBG1r2HDHvZoZ1TWPSq
+Zezq69sUmmwdY6FlwxG+Y9fQardW/fuWZa8dZFSj7IQDViFpJU8qgyMnz0Cz6mh0
+QFcJ9iLirvzL3HVeXl+0yAXhr6Bi6MWGhkkh3zrWlI6U4g2ymNh0DrP3+fNIkogU
+SFHu2Qjr31h4pH71eVrBINDN0oLNw6BTrXp5iwIDAQABAoIBAFDvQpC6fu5IUc4A
+O0NtSP214DQph515ffjf6paElBnJrS8szoHSfBH6VMkIQI62l/SiTVUydshaUFsN
+TCvkLjCb3ijWaO8w+SoZTnZAmQbPcpoBvadoe6gyy8ynvlO6z58TGzdYPRgnwfjW
+GkXHvSO79M/KBK83136EhwaZKhGsz/SNbiEhuBM0IOBtJF7sZC31dZBzy7RZAmxE
+QXhme8YUsRskL1+YRAH8QkEnVtne9a1x5YWK20DamY2/mWXIu4vE57ivKNTW5crs
+PbnwIGiULfIQfIViqRHgjNCm4zBtFqDX34lGDG3i6Xggd4eOACtWHMz2fV6pIqS2
+AbWIVQECgYEA220Vea7W+muKmjW7IOZCpmbom2/5To4lkSB5L5cybiaK3jk5lGoo
+lJQbLyG/qk3q+MDPzoPiEtvz9lWoMly0BCJM6HtwGEwWW9ij0OC2QOtePkKF8d6p
+nZJD51V4/ViXm/Gr32RIT2I1WhutaYM0t0ehxpDCgS2njqPUDnORXeECgYEAxPRm
+OW25qlNvcEkiwQLa/ZbPhBcGAYSqnfa+z4PjJfb2+3GcJnlzgUeUFwnWRlG82g4g
+M1jr+uKZ3ccvMUM/5C/hfhGKNGJV5MNEJxPHyXLtljdjJxaPmnKa8rkBMm5iTEZF
+LZ0bd/9SWjzTHapSS4ungk9/2+dBgW5mw2N6zOsCgYEAiAmmMc2y3IiF4ruDK492
+LOJKPev6/bflFIe0ekvb6SyeFc4Wo6v5Qrxb6imbQYOTNOudKmTbaWPSaZuLbsXI
+mXOGiO/WfEnX5tN2JI7cj30c7a6iimTIdbdzv91e6Hrfa8A2FYZ/yi+R8i6MoYjF
+ywdvBcNDw4DBjA6H7vm5WyECgYEAigNI7s044WX+HQzi0aWSl0jquYD4sG+qr26M
+XxXoQl5AzAnchgltKxZha5N1F2mHkLV9Uv3ovrGzaHl/VGHvj5MNzC22TubpkZhT
+VZ7CzSM/4ZeGX4mrr2rHsXZ6pEA9mX1UVJZW/UtpBdrBhXQons+J3gKfchUnDe+z
+Cw/WqWkCgYAyFy3qQdrtukYuZsiMUIoVIafrlrMBVfSswZssM9brk2HOr9VxiCzn
+P2DTUFZHSf9yk/xa1178ohWIL83fdxy1A5GOvKwuI9hYdNgIYD0CK/ifxlP747Bs
+WhP2MatNRKOw7teJGjQuiTzmU2XdKSEEEdnmmmswOMJuaNzEGVKW2A==
+-----END RSA PRIVATE KEY-----
--- a/testdata/mitm/ai/f/fi/fictionlab.ai.crt
+++ b/testdata/mitm/ai/f/fi/fictionlab.ai.crt
@@ -0,0 +1,44 @@
+-----BEGIN CERTIFICATE-----
+MIICoDCCAkegAwIBAgIQOyQYlHu1sjaXsSl4jMM/UzAKBggqhkjOPQQDAjA3MRAw
+DgYDVQQKEwdtYXplLmlvMSMwIQYDVQQDExpTdHl4IENlcnRpZmljYXRlIEF1dGhv
+cml0eTAeFw0yNTA5MjUxNTM5MzBaFw0yNTA5MjcxNTM5MzBaMBgxFjAUBgNVBAMT
+DWZpY3Rpb25sYWIuYWkwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDB
+zRR98gHEWVOQ9KsBF790QmY7VFhYpSUonaztGcsH3mYQhFFUXTsvn+lGpCmhsEuG
+uy/qboXed30x7JqDSgvt+TwDoCxs+ntHYSLI8OAb73ArarA4JpFT8Rq74kl+aagq
+tjQvN8Q/JuagWJEw0dc1WITlntE41m+5ybi7u/DhHQqdUhP3n6MP5j/u2xssD+CC
+YxDVj1ga/WGErejQwfuL1RGu9Hz1JVUwJvxQlu1w2lM1gVXHgl5iJqB6/PaHFKiG
+lIX0KCPJ8p8Zfa+auY9xEHNb+NWSIOrVdxrJDu0Rv1eamtoQohTeB/zhMnmpicq/
+pVjQ/i4KYiE5zG0RIXFvAgMBAAGjgYgwgYUwDgYDVR0PAQH/BAQDAgOIMBMGA1Ud
+JQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwHwYDVR0jBBgwFoAUocRh34ty
+SDTLCHbozKkgPqEux7YwLwYDVR0RBCgwJoINZmljdGlvbmxhYi5haYIPKi5maWN0
+aW9ubGFiLmFphwQKKkIoMAoGCCqGSM49BAMCA0cAMEQCIAIHI6BCV1zKrKVYZ5e8
+r4PZ0yx7/vNwQR6Uc4Ypd0aFAiA9zkP+uLi5snyQCG4+15DGdSY3yMNi9DdbcXxP
+wzQyHg==
+-----END CERTIFICATE-----
+-----BEGIN RSA PRIVATE KEY-----
+MIIEowIBAAKCAQEAwc0UffIBxFlTkPSrARe/dEJmO1RYWKUlKJ2s7RnLB95mEIRR
+VF07L5/pRqQpobBLhrsv6m6F3nd9Meyag0oL7fk8A6AsbPp7R2EiyPDgG+9wK2qw
+OCaRU/Eau+JJfmmoKrY0LzfEPybmoFiRMNHXNViE5Z7RONZvucm4u7vw4R0KnVIT
+95+jD+Y/7tsbLA/ggmMQ1Y9YGv1hhK3o0MH7i9URrvR89SVVMCb8UJbtcNpTNYFV
+x4JeYiagevz2hxSohpSF9CgjyfKfGX2vmrmPcRBzW/jVkiDq1XcayQ7tEb9Xmpra
+EKIU3gf84TJ5qYnKv6VY0P4uCmIhOcxtESFxbwIDAQABAoIBAFZOH4WU/B92TkY8
+B1l1u2+pUEC0p6FWbi1fxo5SUb3f12Eco+FnoX9sfeTVH6sfSQsnmkeSz7AKU2kj
+vo2gMJ7aQtU0hARGKhdYFTcaOhuGrlPPb8mZt1eEBE1OkT8oC1l2CdhLQ+yBxOv8
+dTAiCu55TLm7V94xdNDumgOUx0lgLsVteI33L40Im9hZgRr1Aspy/jfGF5YevI++
+6zt70YZzOmEgwqaoZzExsZjhWwqW6qVEhTDom8RKAdpICmQ1bR7+ov7cJTBGIyMr
+dTdsetJqW68Ky7cr+fXS4dmA4Ka0r7PquPuDl4nVk3lGuUDb/m/bJ8W0cceACMPp
+tzMgu6ECgYEAwj28qRgv+u3WX2pLiTziI7aSFWkBtYYRz+CX1QVoUG2j8PnHkkeQ
+IZqQzhAOIhCE3Bj//II5fE8BBDEjM3slTpwqjO6sdmzKjq+GHmpBJiF62L8NU5t1
+2z7FOGF9Cd+xwEdonlBXITb9CTuKYbP29BJWj4A3ojdXzbzMPK0I3SECgYEA/2uG
+HsNjIqWSR37O3G5I/z/NshwTnKQ9utGegTTL0OTzjtAexk7Od6iu4yrmYMbpixdW
+YKpmUZMIXXpPQjw6Wm8TcBOkt/FowArlhDVl8Nyh8K8ZWXvD03UgtwNYT2U2056F
+ns9M1TG257XdVPJW0S/2Z2IY61ZmNZzzdetkbI8CgYB6mKS+xTljU0H+rwRF9lt0
+1wKU6NXfUGNlpQevt94DBXB34+8GcIyT6Q6EQLXq4io5EL5hDYBi6SpnDux8zbja
+SM7CbNIFXNzr+fTYtY+xFWiH7O3oWzKj0pZ/42gcF0gFaAyr/2E+4YoLjbzltcSk
+f/6KTA7RH8UXYZY2pa/2gQKBgQCwEPaLDjSwFWIYVplR6dP334tzU1dRiwXiWczh
+U/uLK8eYkm4kVP6ODYFAprnXzEYA0z1/tPaDFM+XYFByYAH5hMfpYiERix+iAeDk
+mcqDlhMrTggzXtVGVl8OyQd+804v4f5J0qwr6fEjGIJRpBukZ2N7MGvtDcm2+1H3
+3yOCkQKBgENWRK4oS2wWrdK9Ru0iaaw91Xsp3sLgcCtquUnda2XOpQjP9KrnvOJf
+AbFoPNcWvp8RDxucVFtVXW4YI+VOo/GE3iYO+tka76PkLO+T/lK2iW8395nYaQuv
+Jo0332ywTpNcOh7zK90ThqwNPf5u9MGwe2XHIhNxClG8utbwaRBt
+-----END RSA PRIVATE KEY-----
--- a/testdata/mitm/co/s/sc/scdn.co.crt
+++ b/testdata/mitm/co/s/sc/scdn.co.crt
@@ -0,0 +1,43 @@
+-----BEGIN CERTIFICATE-----
+MIICjjCCAjSgAwIBAgIRAL/wvGoC9dEYpZhmsujILEIwCgYIKoZIzj0EAwIwNzEQ
+MA4GA1UEChMHbWF6ZS5pbzEjMCEGA1UEAxMaU3R5eCBDZXJ0aWZpY2F0ZSBBdXRo
+b3JpdHkwHhcNMjUwOTI1MTU0MDI3WhcNMjUwOTI3MTU0MDI3WjASMRAwDgYDVQQD
+EwdzY2RuLmNvMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwQmB4Wf9
+1ekpI+GZfjh0KLgTLCXHzRRExgqN2qkpJHIS+y1BasxmRdOjQT3lv3KEks4ThQq7
+eeo4HSp2VRzP1JIS+of0T7/Okp2weJ3EkP8aMCfHl1SYNLyx6xGIkTejcyInFKbR
+GopAp6nKQ9TLrirfGWU+ObVdwpoaOVt5aid+BNPC/O6Vwh/gDmff2x/cNJNs170l
+JEl7b2JTX+joN53UG9fYjWuXz3FoGzh5R/XpFkAUNYbcVNft40TlHgmJ9VQDbMOq
+J15v1xaJS0YnzEj163HBWZ+n2voMDrXZkbrKrFSIYkAHPvJb82KWppoo++sLN0Fq
+IrHQhebgRP8hcQIDAQABo3sweTAOBgNVHQ8BAf8EBAMCA4gwEwYDVR0lBAwwCgYI
+KwYBBQUHAwEwDAYDVR0TAQH/BAIwADAfBgNVHSMEGDAWgBShxGHfi3JINMsIdujM
+qSA+oS7HtjAjBgNVHREEHDAaggdzY2RuLmNvggkqLnNjZG4uY2+HBAoqQsQwCgYI
+KoZIzj0EAwIDSAAwRQIgNqaMVor3e9mU6DJs3rAxok97HG1sSQ8ZrjsCF8q9USUC
+IQDHyh2wIt8LLZrOZz/IMz3vNXvq7y+1I2VLieSGldC4/g==
+-----END CERTIFICATE-----
+-----BEGIN RSA PRIVATE KEY-----
+MIIEpAIBAAKCAQEAwQmB4Wf91ekpI+GZfjh0KLgTLCXHzRRExgqN2qkpJHIS+y1B
+asxmRdOjQT3lv3KEks4ThQq7eeo4HSp2VRzP1JIS+of0T7/Okp2weJ3EkP8aMCfH
+l1SYNLyx6xGIkTejcyInFKbRGopAp6nKQ9TLrirfGWU+ObVdwpoaOVt5aid+BNPC
+/O6Vwh/gDmff2x/cNJNs170lJEl7b2JTX+joN53UG9fYjWuXz3FoGzh5R/XpFkAU
+NYbcVNft40TlHgmJ9VQDbMOqJ15v1xaJS0YnzEj163HBWZ+n2voMDrXZkbrKrFSI
+YkAHPvJb82KWppoo++sLN0FqIrHQhebgRP8hcQIDAQABAoIBAEp/jVD9DcEa4WY4
+IEFOr0GxvLB6ijAS5PHbS+C6DSdEISAv2IHLjaLgKS66ISswGor/nhfnyu+jnXFg
+HFf/rRO4Jjvq8TY/64y478y08pIU6bnw+D3mh3E+65kxZJfKtblu0k9NjACmn4o1
+ZFqmSs8WO5C0+n1SCfPa/kjpjSOSmxVpBID1A2EluV9Z9hMA0tH6rlZqaXy7QOKh
+tRKF7MMzPt9Zrjr78/f/ACQUFuQuT8Ntx1FcFwXgNm/zrp+2SnosUsK6KUGjBp7k
+b4s5Jc8q5zLzjZcr4wizCvhbdD7M5+j7+GjH8FnECkeIiX0O9912wuV5PqGQHGLy
+d7gUR2sCgYEA8MSD7mM9VOWo32bq8NcNQeN22tzKemLuCQLFyIRr7fyBmmodrmdQ
+feKxTQ3W4E9687a1WnsehjjXKdAB69iqrrWBy7ZlKGFltvGS8BwrOBphn+aNhlzU
+KMPlcTaKI+0ul429ICLOe83b6FWuM7UTrXlavHHMC5O1JfcVsKWg8SMCgYEAzT/y
+Saga+EcZhPulQ4qj2/4hPPaNePNcRUxiKgWb8lRqA5agSwbx2evpHzoD21r2EVtg
+XogF9fwwQNEkJc6W8Xi6CGS8AAbg3j75GbTItVITUhfpmCywwM8GMfC5+OsWpUL6
+zqfIic9i8J8wdi21ar/WpNpbrLgk2CeuAwlYjlsCgYB6zoHM0mmyKAJfEQu9FLP6
+a59wOzY7/sITboqboI+8sBMbRA0nrCLuUvbEqs5zU5cPQJ54LFyBcfStqx+PwNAu
+lP5DfiFS23saOVYNixCwaSRqfxqo8ih1MpaRjJQhhxVA0FcrURWpKHOGqk1UqoQC
+8+dIP3MoZIr9dm5lz9WrqQKBgQCznA/kEO148o8MZkIatsnpi5t+g6sNerj2E3+b
+kkkDaIdVGIyw2yTtNJpOLzCM1i6axcGxN4sv1T5Mmjfttbk1GhaBndU+mMZS9fx6
+WE+DDI3HuxE5j3IlZ4TeUvALOX4ZpGFiUkUVA5xrQILiB+HHxpSIsmSi4omrdh26
+noUWHQKBgQCd31nD6EiiZzSGxln7GDGCUI3HPnJwIVJCQ/G79VVNbqDL+BTFx/C0
+4w33mrEbPyDwZHNhtDLqRPe7zwnKm3oaZdsW2QcCQauxMmLkSwlrID9nmb2MsMDz
+Vn6U1nhMc8qJoFBwwnaHAF16i7PIVofl1kuyXmkzrWhyp67SgM5Jug==
+-----END RSA PRIVATE KEY-----
--- a/testdata/mitm/com/a/ap/apple.com.crt
+++ b/testdata/mitm/com/a/ap/apple.com.crt
@@ -0,0 +1,43 @@
+-----BEGIN CERTIFICATE-----
+MIIClDCCAjqgAwIBAgIRAJoa3HRKi0oZMnE4rYNaEKMwCgYIKoZIzj0EAwIwNzEQ
+MA4GA1UEChMHbWF6ZS5pbzEjMCEGA1UEAxMaU3R5eCBDZXJ0aWZpY2F0ZSBBdXRo
+b3JpdHkwHhcNMjUwOTI1MDc0NDI2WhcNMjUwOTI3MDc0NDI2WjAUMRIwEAYDVQQD
+EwlhcHBsZS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDHs1PK
+0k6xKeoXRaTRo1pqO0DR5Y41Aev+eq8yfIEbxObvEx3IVujNp0dPDBvjjI6GO7ol
+cqT0KaKxPlsf7UceT+mN4j6fio9uUlybm2r8hlO8tgz36tcdIZc0OFxtzmYrqxAC
+Z/jN4sooigwTKqiBB0fniCz1f8bukxfMTC148RCOajNuW9VgbVWnNWtw19Fj9si5
+fxDVUHkt+Kn4EX0Yo3wyp5X4SPh+DzhBezKPIqSsQkLStMZLrNo8QB7h+hxC6fNS
+Fd2pQZDaBvkfsxgklWqEbVsad+PWIrjj8PHG17FNb+Qq08reWeCm+9xP2ANOyads
+ehDIlJ549RXnLqhpAgMBAAGjfzB9MA4GA1UdDwEB/wQEAwIDiDATBgNVHSUEDDAK
+BggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMB8GA1UdIwQYMBaAFKHEYd+Lckg0ywh2
+6MypID6hLse2MCcGA1UdEQQgMB6CCWFwcGxlLmNvbYILKi5hcHBsZS5jb22HBAoq
+KtcwCgYIKoZIzj0EAwIDSAAwRQIgRuLx9ErcDWkZ2uzfK/vN8asYnZQMFPJG5eMn
+VzdcWccCIQC4yXhMYTM2z1QL5ZFfoVG40mR52ONiXC3zoWxXSE9eeg==
+-----END CERTIFICATE-----
+-----BEGIN RSA PRIVATE KEY-----
+MIIEowIBAAKCAQEAx7NTytJOsSnqF0Wk0aNaajtA0eWONQHr/nqvMnyBG8Tm7xMd
+yFbozadHTwwb44yOhju6JXKk9CmisT5bH+1HHk/pjeI+n4qPblJcm5tq/IZTvLYM
+9+rXHSGXNDhcbc5mK6sQAmf4zeLKKIoMEyqogQdH54gs9X/G7pMXzEwtePEQjmoz
+blvVYG1VpzVrcNfRY/bIuX8Q1VB5Lfip+BF9GKN8MqeV+Ej4fg84QXsyjyKkrEJC
+0rTGS6zaPEAe4focQunzUhXdqUGQ2gb5H7MYJJVqhG1bGnfj1iK44/DxxtexTW/k
+KtPK3lngpvvcT9gDTsmnbHoQyJSeePUV5y6oaQIDAQABAoIBAAGwvikVmiZsQyfC
+xmgi4JlNGpmcPpWqyD9ddP2xqZsdUdIcwJAJUkupWpRr9xF4R12SBFucSpKpho/H
+BhjxVnyGcyTpERwjHV8y8cc8a82q6msKxHXVxk/gEKpXvsqMKHe+qTJIBIZjoM/y
+iTMhVY9QCzcFw1GprPqogpdPXsQrDFwXzy+8j/5eXzZ2PhKvQLqGgnqTbADH0h86
+8qwOCKslv/JPedJNUjSL+KXsC3dZTlKGx/bRgptd56oYKE6K6du0q/7q6bGHCaSa
+8Sqijoso/zKrk75vscorknkod/B3wfBgUaNjNwoeQw4s69gZaGwuLoXZv7zRUJ+q
+uue/Jl0CgYEA//jYit8GHURf5lt/UWcvj+K3+xG5RtvnS5LLc2IwJdOncqjdTY4v
+GCOQm+z1jV0m82H8q2tZ5wS3W3789pul+hG3wDI3egDoIiVe9aUg1Zbecr9DpnGy
+ZZj6LG1Bo0Gxcd0FaygVwMj7bNdizVnlRToZx/8LRhPWLftOCqUGB1UCgYEAx7jo
+obtn10pgdi3aFIikQhGTQA9rEuiIfNcFHEfMAp8fwfuT/9XnV5bADKG6poNsGLyN
+lb4ffhROqNlDbwSVPxglwy1LIR5Dbxno1wbeyAx8FKZ2sf/m9e/tEX2/wmDVTZFK
+vXGQCp81iEKDtNlzmQHVgQrIn0wU4GfM2eRW9MUCgYEA7hpqQ3OF2n+ZvUvrOKuF
+QJCilzc7Y0B2/IOGIMR7CRTCtBOEF/pksE2U3JYlK+Q0sTy6rjHjpNNsQ/3yDOto
+Dx+gD3YmyKRDSk/87v81dbkrHw3vPcqRKZSNUfonjlczWjlAKxdUdMn/ppUL4Pz4
+Gdcb2D/UGtGk74zOYXR0ESkCgYBz1BFWetFmUoRPBZiMgBKDHp4/cLGwbZt6i1kz
+ZZAzlQVeAwF6Rhu8+Hi42rLdDysJzZBvX6vz+uMDmb06DXZg+SgtYX9I3bxOGsCm
+tB1P962ebEw6Pyc7SsI6eqtTl8UdDz5BUDMxddQeCjVIFTStcBrak952RDF3U7vC
+QmML4QKBgFcLDDLQ26fP1pN6HilSayJL1rqEfqRUPkDdY5elEYbrf8ZMELP1NWD6
+fckk9Lv7C90Gu8msgmXv2yfzki99XY+mY84HOcaLfv9BfK385jD14veBDUqqFPUS
+EPGfKWtGDFRzfjYjAhJ2E39RdnRPytLx7sZjcdKH0EMxCnayhig1
+-----END RSA PRIVATE KEY-----
--- a/testdata/mitm/com/a/ap/apple/ess.apple.com.crt
+++ b/testdata/mitm/com/a/ap/apple/ess.apple.com.crt
@@ -0,0 +1,44 @@
+-----BEGIN CERTIFICATE-----
+MIICojCCAkegAwIBAgIQYECUeQEfFuokJWERzApYSDAKBggqhkjOPQQDAjA3MRAw
+DgYDVQQKEwdtYXplLmlvMSMwIQYDVQQDExpTdHl4IENlcnRpZmljYXRlIEF1dGhv
+cml0eTAeFw0yNTA5MjUxNjExNDRaFw0yNTA5MjcxNjExNDRaMBgxFjAUBgNVBAMT
+DWVzcy5hcHBsZS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDp
+8zV5DomDoReIXD4HJGC+dAgIbEnp+sV/2qR+TsmrksXcxcSh3//cVmBQOEbhwOaj
+BJ/aEobtQLygmzRXTCRsI5VpG6H4YDM/FHinK4o+lXP6N33jkKKdt5lxQic1RkLz
+rMxhX2AS4qtkrY/c8DOI56PLaD4S7mLaZNZsMkxmsEbKX6olrk1Y0N1dQsd0WCnO
+VWTirJ3MeNrmttB2RskPwErNrHY7zFdyA5Iltpid5qbExV/TCzWbJSuH6lmD2o6H
+LJQNG9Z7GEGOR3iHpA36+Gu7iq38gAsZx/tr5fQ5rJGQZD1xG5vnvwdHVkbDz/v0
+h3aelLuAuvMmCNm2PuuJAgMBAAGjgYgwgYUwDgYDVR0PAQH/BAQDAgOIMBMGA1Ud
+JQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwHwYDVR0jBBgwFoAUocRh34ty
+SDTLCHbozKkgPqEux7YwLwYDVR0RBCgwJoINZXNzLmFwcGxlLmNvbYIPKi5lc3Mu
+YXBwbGUuY29thwQKKkJDMAoGCCqGSM49BAMCA0kAMEYCIQCPrYw1nPKJYoCM5Zd+
+lkCwUG1LKeYJ6SQnP56OwImd9gIhAJK+LEtEwN6T0QQv2qr6QcT4kxxriWkfX8pA
+t5YzUIGL
+-----END CERTIFICATE-----
+-----BEGIN RSA PRIVATE KEY-----
+MIIEowIBAAKCAQEA6fM1eQ6Jg6EXiFw+ByRgvnQICGxJ6frFf9qkfk7Jq5LF3MXE
+od//3FZgUDhG4cDmowSf2hKG7UC8oJs0V0wkbCOVaRuh+GAzPxR4pyuKPpVz+jd9
+45CinbeZcUInNUZC86zMYV9gEuKrZK2P3PAziOejy2g+Eu5i2mTWbDJMZrBGyl+q
+Ja5NWNDdXULHdFgpzlVk4qydzHja5rbQdkbJD8BKzax2O8xXcgOSJbaYneamxMVf
+0ws1myUrh+pZg9qOhyyUDRvWexhBjkd4h6QN+vhru4qt/IALGcf7a+X0OayRkGQ9
+cRub578HR1ZGw8/79Id2npS7gLrzJgjZtj7riQIDAQABAoIBAHB1H3wsl7+1XQmI
+RazLONH0FrRt0W3uxKc745xvpRObfw8r5eRmN6ijwLJvCuuT/YnZPDnodAFx//o4
+AQYBrPRqenTG+qnZHGkzHvhEvrRsxQ4/RH1yVij4S4Mc6Jn8R0y5AJnB7f3GBdtk
+buYmdK9Xoe2yEzyoaM5QcJ4b44vsPuoCQnm44t586dzPEADxv6fCebWWFIS3bHgP
+ss9Sk7fwhRMIxL0t813r8PcIN+PZCtr6HrbU0+yD76bnyY6exWh9yk4KrqvBZHMk
+hozjeT4iQugxtGowx2VrycVkIao4UGOhp05g3NZmZykrjtWSdiXWjdZVSrYEQ15j
+Atxaij0CgYEA/6vlZXnorZGHLgJ87tNKE1F/PYL8Au38n0YYkFwiPstU8SO+5h7a
+72wdzdsGg3x3WYVzy+Bn8Xjbar0d3menvDP9KvRyZw1tHVOSXOm3zlSINoB29m17
+youHFmQoK/xvhcdeL3sfvBbbq9c9FNRfAWJb046CZEweqBy+7QCtJbMCgYEA6kAq
+3wlf9d9kVgqqTtljT4eNz3ruPc0euzJklGlQMZsqKWO8LHY2QVn4AtK6KvUCY3js
+8giQ5RAHlo/CHcDAaZWGpaVmWP0FwVZN5CkG8THdHXU5JDLldQqPAqYY+3CKFe9x
+q6IrNSvqfMh/Y+b+6+zUMYY3skw940aKgn8pQ9MCgYAcnnlHKqZJB4lCNTUW5r/b
+btsf0UGbu1gRtBpGGcc8FXJyF6OE9YeBtQvPt0zyrLxambT44K/HPAyuoilZKT6
+BDfKnyJPNsmIBtrTW7Yfeobk0ux+GTNKMOQmNX/prJAvQWnhlr6up0Bfs/A6bKtV
+1FTDEai24W5tEwqsLO800QKBgQCaPxp7tt6bNjgJeAhg10BPlADLCDVsOG7t8ObN
+2vLVV0jR7DxyQnzDV4y5vyybMK4b9fp//Sf7zSxR9eNqWAva+nypAlp8ak+p2Tx8
+6o8Jrz3cMd4oeeMhyIwWwGxe1OH4Q6zjyWsOHhbPh+5qSCbADzhCTBDMtOtjhoWa
+HEV9xQKBgBTHcs5MXs0VCWDGH7Q6pfbE9aGbWGPzPLlZ8EX9P9e/oBz7IwBKJV9B
+HmPdX2EF2L5J2Ogubt2X37xjdFiBNLRwjerVdbCF2FizzDhLHsrDK/FLMb71yCYs
+fcGIMZe9gpztg4V77N1NOtFqyj73/WsgLb1LBxFmadj0rbG66k3y
+-----END RSA PRIVATE KEY-----
--- a/testdata/mitm/com/a/ap/apple/itunes.apple.com.crt
+++ b/testdata/mitm/com/a/ap/apple/itunes.apple.com.crt
@@ -0,0 +1,44 @@
+-----BEGIN CERTIFICATE-----
+MIICozCCAkqgAwIBAgIQeXv1Ost2lDZvvVqOZNl5GzAKBggqhkjOPQQDAjA3MRAw
+DgYDVQQKEwdtYXplLmlvMSMwIQYDVQQDExpTdHl4IENlcnRpZmljYXRlIEF1dGhv
+cml0eTAeFw0yNTA5MjUwOTUyNTRaFw0yNTA5MjcwOTUyNTRaMBsxGTAXBgNVBAMT
+EGl0dW5lcy5hcHBsZS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB
+AQCiQ1RmSjozemz2K+fFit0tSnQI9ZeufGMY8A3XR0IJkN/AqA3oX/mqMLRAB/uK
+YyyF5mmoKfcX1vjTEbYccOuZ13d35XiLPICpxovoFdH2SMligxlQzFKnyZWENnyt
+kIbJZmXj3HcdplfH+j13ADeX1xW68sfaNWNhZHj069cRIYJqMP+mYo4gFQYHm3WP
+NGXb9cx2p1vYF7avErzIlWbZ0raFecAbT98DB0mZofQwYELUIh0sWKpaW8eLUMXg
+tf3CfXxX+iLpXxjSZH1ljLDoXtef1StPu0+5+yT4oUOC6nvt+KB+eBumPv1aNWyY
+2aqFTX95B7TjRH23Neo9bXm1AgMBAAGjgYgwgYUwDgYDVR0PAQH/BAQDAgOIMBMG
+A1UdJQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwHwYDVR0jBBgwFoAUocRh
+34tySDTLCHbozKkgPqEux7YwLwYDVR0RBCgwJoIQaXR1bmVzLmFwcGxlLmNvbYIS
+Ki5pdHVuZXMuYXBwbGUuY29tMAoGCCqGSM49BAMCA0cAMEQCIACaBQaUFVlkKGdf
+dqbCRFy9OG6SAxXUpto+kbKYHYOyAiAvHBeAstm9PBKSWB/SWoCPByjHtV4Crt1c
+HSyijvEgdg==
+-----END CERTIFICATE-----
+-----BEGIN RSA PRIVATE KEY-----
+MIIEowIBAAKCAQEAokNUZko6M3ps9ivnxYrdLUp0CPWXrnxjGPAN10dCCZDfwKgN
+6F/5qjC0QAf7imMsheZpqCn3F9b40xG2HHDrmdd3d+V4izyAqcaL6BXR9kjJYoMZ
+UMxSp8mVhDZ8rZCGyWZl49x3HaZXx/o9dwA3l9cVuvLH2jVjYWR49OvXESGCajD/
+pmKOIBUGB5t1jzRl2/XMdqdb2Be2rxK8yJVm2dK2hXnAG0/fAwdJmaH0MGBC1CId
+LFiqWlvHi1DF4LX9wn18V/oi6V8Y0mR9ZYyw6F7Xn9UrT7tPufsk+KFDgup77fig
+fngbpj79WjVsmNmqhU1/eQe040R9tzXqPW15tQIDAQABAoIBAAeOcyPAWS2EigZ8
+zPJaISq2yOiR51ps2ICUzVA1NVIUuRbTvLIRpiLS2dIRjRlIvQ4PSORX7/XgQP4z
+WPPCHnavnhSrTw3M54EAigto2LpLcXVw/YDRwxelP51EnFHI5T4D0sLlxXZQBM5/
+TNV54RzlG1H1dHEpA1PJxghB42YcwmLBLFw7A6XTHGvhMA0srA3VxWX0+HivvRaS
+ocrcXIPvF4v8OpzDyzZsyAvR5IJz8AluH0FczgwiTSE2buPUEP37ZWKI2bH3hiXY
+iN2XcqxU+w0DXGDjPcTHRvy6vFkADcfD+lZ5wKIaC0ufNidAQ9XnRvQPlA4MjHlD
+zkurdJECgYEA09i6f3ZvmObrsQ8kitmwFGoK0boNPlujh7MFqnjZbakEiNB4ZYYu
+s4E293L2bGtx+oFsGpCi0SEuExF4oydrSG21SvcDsAACG+QZYx+UZuasGcmSV0wH
+AZ8l/22BJ+E5EQb0IiAXHAOqg7Xgk1+zcU1QIVluw5lmJ55j7wTJuy8CgYEAxBUF
+103c0u4cDu6Zex55JJxgI7FUy3sYGlL5Ps9ixyx6AdTl9YIjhT1eX4V1e/9F+rQq
+YJivhe+rwO5OOrD9zlK8gLwJN/Ws1OOq1VBYOZWwx7w5USRIC6uwQmW9CjTzneqP
+jppt0rAclAIQ7M/t7uMtnD/uJ4GDiPGKjY0LEFsCgYBjz/Ne5tCBvBtEWxweh55c
+n/HlCsH+pXKRFxoOTc4zyrSmOYLgYq5SSQk64WGVh7I2ExB6G7d6zSVGOq8aQBJe
+F8KZRXTpUbesqHYFq/Vh3kEsDTr0ApAyhWeDx3ZY8dbPXPVdtrzsqBWI5QKgrTCA
+q6qba+WyJu5osEnpbdoWZQKBgQClVYSjUsgMIzINdSp9IejL8f8umWwCVzyvlZ8M
+UxnbD6mgub9dD+qbgm984694anq7Ngc1hAkcSkbsWwQjgPHBcwn3EpZDVSfyKjX1
+v9VkWM/C2vcJcCo/jPkGQ3rujE+OrCV3/Mb1jAHM2yEiTQE3GN9wjIdnUFF0uxY0
+3OSjWQKBgCVHFT8kzmFsxcLgReEd416xGDi36Dk7+SFomViB+AbY0IW8j3gxVk2u
+5owcd+/hrsIPLiTFMia8ntpkBJW2RI4BvUCnXvhVEsHarWDfg2p7GhHvtMMwAwOI
+QLRKbV+IQ7KSvjm2F9WUBZa1Nluk9X50uW9cFM/Eb9U0sjM5rqqE
+-----END RSA PRIVATE KEY-----
--- a/testdata/mitm/com/a/ap/apple/ls.apple.com.crt
+++ b/testdata/mitm/com/a/ap/apple/ls.apple.com.crt
@@ -0,0 +1,43 @@
+-----BEGIN CERTIFICATE-----
+MIIClTCCAjygAwIBAgIQS20daLbdM2TYJ9HPJ9LglzAKBggqhkjOPQQDAjA3MRAw
+DgYDVQQKEwdtYXplLmlvMSMwIQYDVQQDExpTdHl4IENlcnRpZmljYXRlIEF1dGhv
+cml0eTAeFw0yNTA5MjUwODQwMDZaFw0yNTA5MjcwODQwMDZaMBcxFTATBgNVBAMT
+DGxzLmFwcGxlLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAM4c
+tofN3FN/J5zeMn0qGqDWqGhh9cPYNt1h88oSAZJAV2V8vZaE00GpV/14QtaQDT1H
+D64lvudkHACQHpIjkG027r28qmidxvEB5P+hnHUoSvzpRFQHwhJvNkA6TnPH9xP+
+de9i2v95/zR+peomjkoE2121EBJrBQ3sOj5tZrhtZcG7UkOw8Q934bbciH7ngdiW
+yoh991oL15M5mPvZkkB/GkHcZDD9v7ECQ3PRx8GY7QLVH27W8dESnNGmKhMvv+Qf
+fWVHrFVV/rsRl+ToiAsr0fWmgFD4npGwsDDE7Jba+0MLoMpK1w3i+PHRdIja0inD
+CGcCcclXMnI1C0dnY0cCAwEAAaN/MH0wDgYDVR0PAQH/BAQDAgOIMBMGA1UdJQQM
+MAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwHwYDVR0jBBgwFoAUocRh34tySDTL
+CHbozKkgPqEux7YwJwYDVR0RBCAwHoIMbHMuYXBwbGUuY29tgg4qLmxzLmFwcGxl
+LmNvbTAKBggqhkjOPQQDAgNHADBEAiAulDVJ1mUT8+KN412aBb1rED35aTtXrfoU
+f/seokGImgIgU8r+dwvvRvzOlVcmsgbFY7bDgUcCavXDH2fDr6QMvhs=
+-----END CERTIFICATE-----
+-----BEGIN RSA PRIVATE KEY-----
+MIIEpQIBAAKCAQEAzhy2h83cU38nnN4yfSoaoNaoaGH1w9g23WHzyhIBkkBXZXy9
+loTTQalX/XhC1pANPUcPriW+52QcAJAekiOQbTbuvbyqaJ3G8QHk/6GcdShK/OlE
+VAfCEm82QDpOc8f3E/5172La/3n/NH6l6iaOSgTbXbUQEmsFDew6Pm1muG1lwbtS
+Q7DxD3fhttyIfueB2JbKiH33WgvXkzmY+9mSQH8aQdxkMP2/sQJDc9HHwZjtAtUf
+btbx0RKc0aYqEy+/5B99ZUesVVX+uxGX5OiICyvR9aaAUPiekbCwMMTsltr7Qwug
+ykrXDeL48dF0iNrSKcMIZwJxyVcycjULR2djRwIDAQABAoIBAAPf5k6HQC0Rptz8
+EFbqA7YiUugjb0tPNTjULpEN5ZmqO/pcbfP2a0JAvLa3HAqMirMsMs9DRmNzLlOU
+Yf69TGnBLpvCgDGXRbYiIvvrPdW1/DLk77PksXFHRe3PKspiZ/KoRe9KHHPRB0sl
+VlkggGxDyxvn23V9LYsldbLWu6eb3jRtO+IyF8o3WBAcC+xTA3rF9KjoTg4MWCkD
+mLGWbzll465PXq6LHU8/uG2lIxWLvpsdamjNl+afPakqGnHac+fWJvWpDPOjbQs5
+fFhyGMlLEL+KnhTGA1u6iuIdkWAF3P/oytCznmOQnH7O20RxIrxwfEX9RPCUpTZx
+rPUpIYECgYEA1MOH+kPYyqXJQcRoJXkHQrcgzTgNXwsFMDYwF5MqB1fi4a75Znoo
+MffjizKd2aJN1xXmLYz5VjcohaIbJKoHeoYtkTZFAN0loLLTOiUwI3kwxN5FcFXq
+wjwEL2eESMKONfLQob2wC+9KMifH2TfTDFNswAfuBmFNGvNBdr5FIDMCgYEA9/8l
+wbqBe7ZXzq+WqJbTOOn+jnMPTjqxCwMea6vX7kAkXenxaDZvXCYIzEV20duy1t5
+bu2AXuGSwlKATBGyte4kCvnQQcST9z9oA5TSu/g+yGTPRU1R/TgwHb2Fu5pGvXbs
+TN5idoKLdx4eyS0006PMKRqaddPDEd3vjHc+zJ0CgYEAjCCXfvmOX7EewuTzXrK+
+WG85+E8RZ2ZfrWgS9oPjK2DzuYW/FoIf1QEZaQUWN08RCzaOGbP+R40ecBza2aPu
+NwEGI9xlR/Neo98DBQmXEdXwi8iEXT8I1ZIng30e/7i7ZsacJ9pBhyq7aBsRIXwF
+0NllB3hxiNwupzBNDkK0TkcCgYEAoLK6Br8FOFD8lCO5o3tfVCSU/aUkPmu6XOH6
+N4NFau6zeo+hrIM9dO8X9n3hHtVb6vRcbNADhff/pGHXdvNk7VTiECaul19tTiLN
+ILz4DQugizQfx1WCEmatbygXF2ix/CWqm2jjPs3613YyFsRvXdDfA6eUfVN6LQK2
+Ljw6+lUCgYEAx3q6cPbsSTzmcEm/rgBR+a3crrisp/mTBScxMTGz0mxaXscXGCXV
+si/G2wh9R3UqwnFZrCbn1tgXD6p7hOc2crWxZsNjDEmo14ajpWsJBSmCWFi9z1D9
+CRgp9njGpm+TF20KsLP/ck3wzQia06trDPf9nzwfB1tTOgte/mlkrTc=
+-----END RSA PRIVATE KEY-----
--- a/testdata/mitm/com/a/ap/apple/push.apple.com.crt
+++ b/testdata/mitm/com/a/ap/apple/push.apple.com.crt
@@ -0,0 +1,44 @@
+-----BEGIN CERTIFICATE-----
+MIICnjCCAkSgAwIBAgIQej+nciBJ5eTUcfmnGRk/GzAKBggqhkjOPQQDAjA3MRAw
+DgYDVQQKEwdtYXplLmlvMSMwIQYDVQQDExpTdHl4IENlcnRpZmljYXRlIEF1dGhv
+cml0eTAeFw0yNTA5MjUwODMzMjNaFw0yNTA5MjcwODMzMjNaMBkxFzAVBgNVBAMT
+DnB1c2guYXBwbGUuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
+sPh7D1SQUbrYpyXjhLQYAwsUMhUD7gh2/YzcAe7L2iFEomjRflHXzFBUFzt5g0FU
+CdyYydrZpSy93xEpuW4brtymFMwJnPWEE2+dbmF2HGslV9Vx7whKR6iuKMup0bmL
+Z6vntF89Tg8ZCt6w1qiXTezIARTgCQyMnYYRIT68pfs7WjKO2VoT4TAltm1lFcx6
+67Brnwj6+ZRioheZUaRFDET4npgETG3nNIunUzKeTs5NQjMgjKlMgzKuVQM2BCNK
+h5v2we99GyiBIGGdtnav6r7qJQHbWVG3khXoKI/09KFNSgm74lEuCWlTNGAkBTSd
+dx/XR/aJvRLFMQvkY8bN2wIDAQABo4GEMIGBMA4GA1UdDwEB/wQEAwIDiDATBgNV
+HSUEDDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMB8GA1UdIwQYMBaAFKHEYd+L
+ckg0ywh26MypID6hLse2MCsGA1UdEQQkMCKCDnB1c2guYXBwbGUuY29tghAqLnB1
+c2guYXBwbGUuY29tMAoGCCqGSM49BAMCA0gAMEUCIH1ZVQcmejyySrLwhjPDBe/g
+904tecjtt47bmpS0WisTAiEA0p3WIZBoYaUXLK9Ih+SmcpfkTuPEKzEkUqQGe5ci
+PO4=
+-----END CERTIFICATE-----
+-----BEGIN RSA PRIVATE KEY-----
+MIIEpAIBAAKCAQEAsPh7D1SQUbrYpyXjhLQYAwsUMhUD7gh2/YzcAe7L2iFEomjR
+flHXzFBUFzt5g0FUCdyYydrZpSy93xEpuW4brtymFMwJnPWEE2+dbmF2HGslV9Vx
+7whKR6iuKMup0bmLZ6vntF89Tg8ZCt6w1qiXTezIARTgCQyMnYYRIT68pfs7WjKO
+2VoT4TAltm1lFcx667Brnwj6+ZRioheZUaRFDET4npgETG3nNIunUzKeTs5NQjMg
+jKlMgzKuVQM2BCNKh5v2we99GyiBIGGdtnav6r7qJQHbWVG3khXoKI/09KFNSgm7
+4lEuCWlTNGAkBTSddx/XR/aJvRLFMQvkY8bN2wIDAQABAoIBAEjyQ5dwHgTyZbeQ
+UJY0vekTOgHi07ncV1/wHgfV7MU/DVF8r03IYpFfUyo4Y8AMv51JBtm9khUZujIm
+mvJKRrLvVK4h5JyEPyrbySLknZDdQYlQ/COxYRzklNVQDfHa73GOVHXvBBAW/RWT
+8YSp/aQrQ83eUvKn75ZG2uy/NXecxY1SPVvhj5WdchG9vJnaQXnZR7WbIEz5c5+D
+0/uYi6jYKC79g1un4mpU3kk8QDznypSxA/5eaoO667u/6UU0D0lMTB8MLjUd2xMI
+PiLLY+23usiVb5jUiXHQVO8f/tauNvwa98qzr4zk0zRpgqJw+A0jwWIOIA05ZkbE
+lTv05ECgYEAyqsW1CTrilds70Cu4Cykm0BhyZr1BDOfbUjay/C0/0ZHglXziuQe
+PqrPK0H7+Nx8ua7YShcsFSe35NsvMK6Vt+1ONI3Bnw3AlklwtiCUA7QHvdzE/Q/e
+MeEgDzJ6BjO5ILkCNvB9gH6OHpkaHkd9RpMy4d5d1ymb9JxvNTIZL5UCgYEA34o/
+FuRHnNI/n8VxqTW8vO1VLQdeL3EzZz9ttMOUqietIQCzAgxqIpz2JzaLyeueUpSq
+muBJQd/8geIwAnsMdZKYAOgxdONZK4SsBJLu6Npvmed2AqLyWqBcCSUxwZTx0ww+
+gNqYY923QB5KLqR0lPEea98SmmXjFG5fJuv8a68CgYEAgVWjsOiKw/M82oYd04PJ
+3CW/Aeh4miDTietnbaSD7TCNa/ir/iPLxVQ99y4Zvdv/YIPbFZUqFaoOKedSey++
+7exr7w/T00v0bjQZ0LCDpMVb92cO8ywQMSaozen5g0G4z9AhQKxCeyDIU3CDAXW/
+1a0UWJ4OpsOv+e9m7Ly24+0CgYEAisy3ccpa4Pf3g4hAk/WG9LRU//mkNMcQSNqs
+juImDCVIrcZWYD4/JLDbcuu+jqkbjGE9MZ90PVAL5MYCU3f9+38DnQSPuOl1s7zU
+Zp6pc7I2O5TpxKdS3ozVuOP8ahvGr+nZYX7ZwqCnqUtlemKo9NZmsko3reD3x/bk
+ZDGBcYcCgYBlX2hzseM0CM3iGzPvvgSvvso6UmMgwOb9B4wHEDK58c0x/TKhXGBp
+5zXH7vW454T03fcaKXP5DFLm08mAGOM1isaM3WTnsaSDVof7mj3C59lgJDW5ve/9
+UGmC0wP3THFUzE4x1l0OuFVLP7SeevEYGa/XKj2LeYI1+Zv8Rmhs9w==
+-----END RSA PRIVATE KEY-----
--- a/testdata/mitm/com/a/ap/apple/smoot.apple.com.crt
+++ b/testdata/mitm/com/a/ap/apple/smoot.apple.com.crt
@@ -0,0 +1,44 @@
+-----BEGIN CERTIFICATE-----
+MIICpzCCAk2gAwIBAgIQe77Xhdd22dPtHxdab7k/EzAKBggqhkjOPQQDAjA3MRAw
+DgYDVQQKEwdtYXplLmlvMSMwIQYDVQQDExpTdHl4IENlcnRpZmljYXRlIEF1dGhv
+cml0eTAeFw0yNTA5MjUwNzUyNDlaFw0yNTA5MjcwNzUyNDlaMBoxGDAWBgNVBAMT
+D3Ntb290LmFwcGxlLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
+ALmQugESptZD/d/jjy7yogqLGzcVl/sy/E/2vhbuOviRk0p8MTcagCn1pg74TMxw
+/1lkaSv+ajWiUAcafltxKrWv1hbx8RfCEL98WdLBPQQrugiIu9ujOu8jvulJCKUH
+KhRzOUtowgX8S/zbBFSm5lQNaZln0g9Tutisxbgx/ZKYFuKJd+GanFlGizd1btUh
+tFVM5PAPnM/+ttgRJiCs7Yov/nfVI2APxIwiR1c/42J4x7JvTHkmRaqexugApLBU
+9TMeqXGHZfmvvLw71Vb7HoX+lqHz4Nkx8rW/K/pEvoORDzF0x/jwzYi+qNG0MD3v
+UNwz8SScvi6+ELo4j4ULFGMCAwEAAaOBjDCBiTAOBgNVHQ8BAf8EBAMCA4gwEwYD
+VR0lBAwwCgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADAfBgNVHSMEGDAWgBShxGHf
+i3JINMsIdujMqSA+oS7HtjAzBgNVHREELDAqgg9zbW9vdC5hcHBsZS5jb22CESou
+c21vb3QuYXBwbGUuY29thwQKKirXMAoGCCqGSM49BAMCA0gAMEUCIE3BKrufQkP+
+vYOOEfl+lH1QLHqfN9WODgnjaxBODsqfAiEAypiRgjv3uklHZASrxfdvHvdiz/Mc
+4K4josSPdGUiYHA=
+-----END CERTIFICATE-----
+-----BEGIN RSA PRIVATE KEY-----
+MIIEogIBAAKCAQEAuZC6ARKm1kP93+OPLvKiCosbNxWX+zL8T/a+Fu46+JGTSnwx
+NxqAKfWmDvhMzHD/WWRpK/5qNaJQBxp+W3Eqta/WFvHxF8IQv3xZ0sE9BCu6CIi7
+26M67yO+6UkIpQcqFHM5S2jCBfxL/NsEVKbmVA1pmWfSD1O62KzFuDH9kpgW4ol3
+4ZqcWUaLN3Vu1SG0VUzk8A+cz/622BEmIKztii/+d9UjYA/EjCJHVz/jYnjHsm9M
+eSZFqp7G6ACksFT1Mx6pcYdl+a+8vDvVVvsehf6WofPg2THytb8r+kS+g5EPMXTH
+PDNiL6o0bQwPe9Q3DPxJJy+Lr4QujiPhQsUYwIDAQABAoIBADrix3PhtFnYN68d
+qmlOi8dmv1sqmhEX6+OAPHBQZxxMLf58DK4c1cD6+BhWCSDzVsTKTWmtkYy1lkm6
+yZBBCDmhtAGSA1zzs5bgYiy0L6WsLpvYsCyRzvjmUgX7rCeab2sP6YWZl8CIgKCb
+6/LlB8ByhSkuPgWpH2j04sWB76Ld3z+t34uIVUqfpQotXcMFR/maYLnoMz1QjCEH
+TmJcNBITFq+2+3S5BxiRfWL9pr6vFLqwasHEdaJixpUlRMQgZiJou7eewi9LfY2l
+UMA3LzEi7EOPsaVK/6Fg8OB7nePpyZmpb3U8orhfwUaXTwyE0Z2gyOeplDov8sLc
+0yMMo7kCgYEA9ksfsERUdgHnNlJLwU7rvX5ncXVnLBnsS6fsL+ehEieTfh8xaqgk
+TNwhkVbnL93gi5h+v67isZ2tbnWw4r2HkXYLz7icdWgJCCPnzJzQKpizGFzntmPp
+N/H1AyifgMjlios/ibQRPb92pnnw+Ai1ExH1FThN6tvMMit3saVfYoUCgYEAwODp
+WjDEfw5gxqYuvN6RUBWiIGYmu84Q00g6iQRw04QaerkmXB4xdh3rSwOL5kpWCqtZ
+frfVg7F0KJnAv08x9GoCz0eQ+OO1yVKPT8VbnpTZlrwniiCi4pGok3mp47dAfkrC
+sJp44GnEKrBiMD7t0pGtuVDPCtFl1mYWhz3BM8cCgYEAzM7XwRpxKdiXToLM4Cki
+u+c7WgwJCZFc/+TZ8VQqixBCBGUoEMtVtFxxxYyAnztgmHTtIbTqakz2hZ50w3hc
+HcgONmQMJ02mBRDmly3npSRp+d54CSG4NH+OAVxslwl4Z+c3pOkKVVC799/7VCbZ
+fMw4A7dYg+7XNPkUhbNBSIkCf0AKbXCEwLlvDLLoepw7SgRNKoeXY0T4Jp4AXW8h
+ClUwh5o334S2gbW2OWmuw8Sy6d6hBhYM89fGE8tnQZhDs1Jz4HrySDBbawBtaSgT
+X1hIE/b4giharbqMomxU+ROixMcqC3qXz4qzk26ZIgDi5BQGSqg9LIFrBWUqgFBn
+ML8CgYEA5leZ9XY+IZaGlxa2dX7SUQmixi+6za6W0zdnEmmXxb6Zud7DczVo1b3b
+KUtSEX2Bwm1luCHdQuU6R/V1r2UE3lkUcFGGdL4r922icZXDmcVnP37VZQpAd4Y/
+EU/U/sqQd6CB78FUjFYUemtw8ugr9JRSLVZYtlC5kqeEGMY+dL0=
+-----END RSA PRIVATE KEY-----
--- a/testdata/mitm/com/f/fa/facebook.com.crt
+++ b/testdata/mitm/com/f/fa/facebook.com.crt
@@ -0,0 +1,44 @@
+-----BEGIN CERTIFICATE-----
+MIICoDCCAkWgAwIBAgIRAMYowliyTxYWbrh4MqLxvgQwCgYIKoZIzj0EAwIwNzEQ
+MA4GA1UEChMHbWF6ZS5pbzEjMCEGA1UEAxMaU3R5eCBDZXJ0aWZpY2F0ZSBBdXRo
+b3JpdHkwHhcNMjUwOTI1MTM1OTU2WhcNMjUwOTI3MTM1OTU2WjAXMRUwEwYDVQQD
+EwxmYWNlYm9vay5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQD4
+ITnF3zUCzf+BLnyeTcceXR5kswSZFCeP+ELWt9t/c1BHn0k8QYeWfuGdkQfOEFPM
+ElajS/BfNnjbk2YIGcDl8LQwDzhDdzGIvx3ZoKqxjuMXhoXxQHVNRHNX9kkxPoRm
+VVBqoHeCPNyFNxvAFrBm0fYTCSWH3Si5ILQ6xtSeeeXugEdoe4Y6O77zheE4He4S
+Tjx8ylAAeDoQ7+bfvx0989oT42wGsUPp15MJrlph52jTg6U5PjFBoy0elsNeNgH3
+JlGZZJJAuiLQKBfB5Uz4dQ/qT4ZD3ZrQVHV0CozdliPeMRJxZQFju5h9EFpf8Wmi
+3nQYsbLzsyGOjJ958coPAgMBAAGjgYYwgYMwDgYDVR0PAQH/BAQDAgOIMBMGA1Ud
+JQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwHwYDVR0jBBgwFoAUocRh34ty
+SDTLCHbozKkgPqEux7YwLQYDVR0RBCYwJIIMZmFjZWJvb2suY29tgg4qLmZhY2Vi
+b29rLmNvbYcEnfDJETAKBggqhkjOPQQDAgNJADBGAiEAjpHmEbyND/UQRHfEwvXj
+GLp/3QrvZHInNWjQGghVuIICIQClk613hNSbiymjPpHhbMItevam7PZ9Id8otzXU
+XwGBPQ==
+-----END CERTIFICATE-----
+-----BEGIN RSA PRIVATE KEY-----
+MIIEpQIBAAKCAQEA+CE5xd81As3/gS58nk3HHl0eZLMEmRQnj/hC1rfbf3NQR59J
+PEGHln7hnZEHzhBTzBJWo0vwXzZ425NmCBnA5fC0MA84Q3cxiL8d2aCqsY7jF4aF
+8UB1TURzV/ZJMT6EZlVQaqB3gjzchTcbwBawZtH2Ewklh90ouSC0OsbUnnnl7oBH
+aHuGOju+84XhOB3uEk48fMpQAHg6EO/m378dPfPaE+NsBrFD6deTCa5aYedo04Ol
+OT4xQaMtHpbDXjYB9yZRmWSSQLoi0CgXweVM+HUP6k+GQ92a0FR1dAqM3ZYj3jES
+cWUBY7uYfRBaX/Fpot50GLGy87MhjoyfefHKDwIDAQABAoIBADLyH3qRKcE5qoxL
+jyqxrYB+fg8O8pK7oKPexVpwxZCVjJYoDlFg4wXzZz+C16dnks0DtuYwYVorRQVQ
+blKbdw+/LD/x4At6HaGGHArjAikSvW3HIRk3st36f/Q/jSefPnAEdE5wRBlphZ2U
+gw4dmnqCAZRG/H242vOn01l+GYmv9haEnjItRoAFZXEzitvjkfrGeL0ZSYflXOFh
+nqMtL3U3t2y8G+E91dviDJPZnXUj4eXFtoZdNVq0Uplr5E/Lg1WjpPvy9d/7G75Z
+J3+wVBkgP6MhyVGB2motT6Q3vK9lSQEaz4GeiDNualPFWMHOsC2xdWBLj+IbSz9x
+UE6ZfIECgYEA/QouEj9WJnkROylLy+8biZxTixtVBK2ugXNu7/VwElPkeqV5UwSs
+qRbfu9wXSiBExjm63Rzu0VI3zPqHEPV8NYmyjDDfVpCrwrqkrOLq7j0H7uBGXNaE
+0RV7JXAy7nQMDy37jT4Bg1MFTFAmCBJlkANAAc3ZgCKDf2aewHxEoEMCgYEA+whX
+SvK+oFa0Tckki7UZ3ypT0Kp5u+2/lckPuj+evsTJbL19uEJdqKQ+mst0pDfed80V
+QaQAT/S26v1uaIWlpg0hE6WNuL1uV69yQoWj2TmrXT75Zox8yORnlbGDlly3lLgN
+BgeXqY6bjZRq2BpD+VmTbf9V6YBOu4Vx/DcFiEUCgYEA0/1IVb88NKUu+2qAdszO
+PD58e0kds/qx/P+xTFVKXABupRWmjBeZc1uXezJLTK22EH/i/kW0CiegWhj1OQ8A
+zXWb4Pk80rAHRe/J8JF3ErqMv+Ki8DpEMUqWzemusbkFNV5npY/yAox2HtXy1sZa
+0gj3AcvsUP4ZPo3BqC8z6zMCgYEA3oPqPLknWCEC+eBN0LjbEgIHAXPbLEX2COOM
+WV+Daz4r/YOKKQZK1u2fwL6PyfDr9e2H5gNlc3pLmcjDUUsGJkaFB1E8aoEfigIu
+meCz+B0yVRk5ITlucvRjDUGojmPpJp5ujOW1/co3ACyK+LtvfVt1X49xq+Tb5UTI
+YPS0prECgYEAyyD3hyO3nmaozZClX/MajWW2NM/4SS+Uf475hyaw4bJaA71Xpe2d
+4y57BZBhiTtd2s/VIAsXrCLJUnj1pUuh/5OsYBs1H87WoYqAOre1l5xSAmDtLJre
+LT4mU4PESYecGLmiVHh3OGhoYOD0Vdhtu90iJd95F/FLT7Ivuw6Mxok=
+-----END RSA PRIVATE KEY-----
--- a/testdata/mitm/com/g/go/google.com.crt
+++ b/testdata/mitm/com/g/go/google.com.crt
@@ -0,0 +1,43 @@
+-----BEGIN CERTIFICATE-----
+MIICmDCCAj6gAwIBAgIRAIVQo9jWdRb8sNJwToHF2T4wCgYIKoZIzj0EAwIwNzEQ
+MA4GA1UEChMHbWF6ZS5pbzEjMCEGA1UEAxMaU3R5eCBDZXJ0aWZpY2F0ZSBBdXRo
+b3JpdHkwHhcNMjUwOTI1MDc1MjUwWhcNMjUwOTI3MDc1MjUwWjAVMRMwEQYDVQQD
+Ewpnb29nbGUuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA43BO
+ck0FyeyQOhVoW3+7lReAhhabSBjfozpyiPmrUw8igoRg07jvi21aMf7S6sBehm9r
+rrrPEbxRal+1d7/EwIBj3YAe7jjEVjMGfj6dnkMkoJhj8oW4WbRgLDVVbfKmUi7/
+PasdmTscNY6VDpBJaorgG1Up1uYY9XU4V459hgCMf2gnf7OgrLRbHnTKdRfQMAoA
+qDle1I/BxCsMZEtUH4e4yxOBq/c2I2wQdXbPSKn7zKkiEQNLcQEfhxfLMFO99Ekb
+wQjoqpImzyZ/wBenNtMinRxygvwMb9QAz3wWxOFWAlVrZ5xbakP6BvRJ1kGqsOuG
+P5eTru2TtXsgTLts2QIDAQABo4GBMH8wDgYDVR0PAQH/BAQDAgOIMBMGA1UdJQQM
+MAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwHwYDVR0jBBgwFoAUocRh34tySDTL
+CHbozKkgPqEux7YwKQYDVR0RBCIwIIIKZ29vZ2xlLmNvbYIMKi5nb29nbGUuY29t
+hwQKKirXMAoGCCqGSM49BAMCA0gAMEUCIB7QZd6PsxvjRzBKfuFYzNAW5J0I6/79
+6WzFgEYgP+GfAiEA7mNjqS6q5ikYps9SSX7XSsgsuna0ewdaZDmsjkQOxAA=
+-----END CERTIFICATE-----
+-----BEGIN RSA PRIVATE KEY-----
+MIIEpAIBAAKCAQEA43BOck0FyeyQOhVoW3+7lReAhhabSBjfozpyiPmrUw8igoRg
+07jvi21aMf7S6sBehm9rrrrPEbxRal+1d7/EwIBj3YAe7jjEVjMGfj6dnkMkoJhj
+8oW4WbRgLDVVbfKmUi7/PasdmTscNY6VDpBJaorgG1Up1uYY9XU4V459hgCMf2gn
+f7OgrLRbHnTKdRfQMAoAqDle1I/BxCsMZEtUH4e4yxOBq/c2I2wQdXbPSKn7zKki
+EQNLcQEfhxfLMFO99EkbwQjoqpImzyZ/wBenNtMinRxygvwMb9QAz3wWxOFWAlVr
+Z5xbakP6BvRJ1kGqsOuGP5eTru2TtXsgTLts2QIDAQABAoIBAAygu+5LOf7N4G0l
+KqPn6eubgDKRt0HvxZz7vge+awWD0dvyyyh+PGieo/MiLaZEk4r9zToIm74lmVSh
+Z0M0ldFFX6YY+r6pzrblgt8IDXrPyg0ToPsCcyuh4PQbavidkCAAhYHwSgarukN7
+/Okv2C+u8cX6usW4hVq9jSkJW41QyCqkT0bfCxcuzXKfoQs11+jNpquMPBzE+NUB
+T56a6HpY7+b9S0w95XTpT13N8FJUpZN7p1kudpulUjXrKbcWMWocHzHc1rx1SKAd
+sMDlpF8enzKUDp2hQ3lACud4/q1deAdO0VWhrvquhQ1LeDXcfHZE0y9UCHXYQImA
+IBTLTqECgYEA511W57HGTSV+11GPR9WcVCAMzNbhRksBAYXOhJYVZ60vsmMfvRAG
+CFy9bpoCm98tQkPw+iqCBAAHXKceaqQHz64ekBjrh9FMJXUiQXKF6IAVBrPCqF99
+2MqC7Gl0bx3GcxpFaL4NYj00wMBI/WzY7KwLYCi9fO0dkZqGAnl85SkCgYEA+6fz
+z9dU+k24Sx4z2uSl6soAFrrj7i8coUEc3nzBrPgyr0usereu2zq6yK87jp/a+GLV
+0mWcyN357fwkY5vDaLihGwDzokrFN3p2b9NxQf5GfDY6xHrGgCeTYJc23o5iCgV2
+swr/TZMtmaN/30mK6VbMzgNZO68Q3XxnWQiZEDECgYAOkOPNxnVzme64Y5wfq6Uh
+7rqfks+v+zze+auc0U4brt2X34G6B245zIzoj62mXpCc4WYkedShp9bO0H6rvBP5
+0T5/V/JMJLMkkJFNiYZAsv+f4mVY8Fod8fH4LFN2Q2uhB4BjLcPt8WiG0hRGUDn/
+/Hzi2u3DFbKM3iudsERasQKBgQC8JNwGZqH0pMiE+KaiH1HgUHdyhvVDrNtFv+16
+dWFDFSinn/bqpItJAgaFZWUsg1ztWM8thqSKFFL31wvJoLmegHKKQtLjYe1CRf9o
+KXfCc/10fgK/xF7Fj1EC5Oqzx1WK0nzk7PLkp4VvGSrP4CbHvwpNd3luQrtkK88E
+ZIYy8QKBgQC/IsWE5Tj3OZRL0EatbqyUYcFJW5xsR60jW/HeS56y/eRYzjGUIOEj
+duSGoucS9QE9zlmvNy5UXlvAkkX13U9PPMa/sgVZCzBzsAAr5d7DBVOzZSvTLWe7
+HzJPLJ0pGMJD2hKQPDsd+KvikEHGp0wO1b0Jvvlk5+rRfhrEHsb8gQ==
+-----END RSA PRIVATE KEY-----
--- a/testdata/mitm/com/g/go/googleapis.com.crt
+++ b/testdata/mitm/com/g/go/googleapis.com.crt
@@ -0,0 +1,44 @@
+-----BEGIN CERTIFICATE-----
+MIICozCCAkqgAwIBAgIQYruY+reWK3b8rV/MSosf6TAKBggqhkjOPQQDAjA3MRAw
+DgYDVQQKEwdtYXplLmlvMSMwIQYDVQQDExpTdHl4IENlcnRpZmljYXRlIEF1dGhv
+cml0eTAeFw0yNTA5MjUwNzQ0MDRaFw0yNTA5MjcwNzQ0MDRaMBkxFzAVBgNVBAMT
+Dmdvb2dsZWFwaXMuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
+8Swzn2heWwlFSLp2lKySIZMRYhaP7JdC+jItYZ+moHoEojdjmt0D9qlV+om5ARC+
+/tPk+3k/9SiXz0padfVlu0KsA7N9dkdlk7xijWb8OLk7nKs8zYaJwSII4edkTiIu
+T5WKR+eLkm2v8SpTqEpT1JOuoVfthJIMsz47EXCCduVGjVty81CpK8oraJ1g+5p4
+OEDQd0JwShmaV0wQtYOlOsJoDF9Fv51BcA0kMXfhf+tVbw05mgjVsVvhcMYNI4fN
+X9kb7raLYqefl2QMsOFWdhV0Omubt6Qvee8/Rxy+Qf7YkknYZGOZs+63uA9aO+Pr
+wteAImjEpDCisnbvZvzo9wIDAQABo4GKMIGHMA4GA1UdDwEB/wQEAwIDiDATBgNV
+HSUEDDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMB8GA1UdIwQYMBaAFKHEYd+L
+ckg0ywh26MypID6hLse2MDEGA1UdEQQqMCiCDmdvb2dsZWFwaXMuY29tghAqLmdv
+b2dsZWFwaXMuY29thwTY7yCMMAoGCCqGSM49BAMCA0cAMEQCIAkCY52z1kjmqzpf
+55o2uvXweGXWXnV/LmvqsskOVXSYAiA4WHaEJl2Y4cKI9DJJgE9wa6VXgrr4+erq
+Z3Nm3dB2Q==
+-----END CERTIFICATE-----
+-----BEGIN RSA PRIVATE KEY-----
+MIIEpQIBAAKCAQEA8Swzn2heWwlFSLp2lKySIZMRYhaP7JdC+jItYZ+moHoEojdj
+mt0D9qlV+om5ARC+/tPk+3k/9SiXz0padfVlu0KsA7N9dkdlk7xijWb8OLk7nKs8
+zYaJwSII4edkTiIuT5WKR+eLkm2v8SpTqEpT1JOuoVfthJIMsz47EXCCduVGjVty
+81CpK8oraJ1g+5p4OEDQd0JwShmaV0wQtYOlOsJoDF9Fv51BcA0kMXfhf+tVbw05
+mgjVsVvhcMYNI4fNX9kb7raLYqefl2QMsOFWdhV0Omubt6Qvee8/Rxy+Qf7YkknY
+ZGOZs+63uA9aO+PrwteAImjEpDCisnbvZvzo9wIDAQABAoIBACblK5Aua2VAOgHQ
+PLaenFS43MlWfTC5dm5WcFY5wsxH0X5981zy/yQlTD4DPyiKVFtRvjDGbceym8Ut
+Jyi2AomwZ4CTTo0oV5v7emN2s//L8+7A+SXmaEoTHJ6eTGGDhreEFRCiqbJcaU86
+NdLC5gE3LidMQHysd0rjIvCdlhTpdgpiCiWuDVOiZ/pcsZHf8yg5+v0GzSg+gRRa
+YzyMUHkl6Ln67KZXWiV/sm8g+NqPV8w460iLnXWKHCUu2HSiTtaAIvFxaCBTHAqf
+vtaGehC/Q671sc1WjOGd/fiRnj/pQH+DkMCFUmTuEMzKV59MFVIh8detaMoirQla
+p38NKSECgYEA8iIMJ1LttyQlHX5UZGc4aH5jLpCCeFrjC/9XdYUoyW/Tlh5gTeuq
+s/O2xwkYghKOb5u648h+UPgtrwiJLUvfU83XL2xuaZyVRTwFeMR7UaDBZGSoagp
+XbFGh2k6HhVJCQ6fNjMPFwsC0c8ViZdviui4FsgXstZDcQHSVcFl/yECgYEA/vwT
+FQo86ztA1rjSiYrEWRYItzo7PCaW9Vt+FJJ4sqelclh6dC6tRYcLp2P8JYkKCRAK
+3JHclEt8XHvqb2B1zVOdVw2NJLi6D0jTPKM5ArokcrLwPAAXU/EDgdQ7LkOowgRZ
+Zzm4hPqbRi2vs7UdCS4jPS762EqaZEYqGIikXRcCgYEAitXu9hVc7KgzB+hJ55Aw
+Dep6YFbIGM60ZUqyEVaa/nW6ctdUDRnWXh4N1CEc04FBXj7NRxA5QL4k+WKCiV3C
+ry1e5zR11aeU4ygwSbx7qPvHYMgJtdvAbFKbyEUT5+/4gtL5g5BfVK0hnsAI723/
+rTynYZi1zfuBjCipPDa6j0ECgYEAxFAc/PDx8AWhqO+JIN4Wx6PgN/l8S5ZGWUcE
+riALDzlldsDKHpMlUkdj4I9pPRjiAhI42pLuabooWCgLWY7Bg8DhfXlwdppGnafr
+Al+EcCYSE8DSls9XJoiDs7xLiBYNYrrofkIBX1h2nbRk9w30+fFsrhlyhX4Cmjsv
+A86IBScCgYEA5rjNOCnhgigvZLQDKa0y/2MQiOZpuQaRs9BX3aJ7+lXMsvD6DiDc
+h5bRp2XoY38GeAzQRFJyZgAVWSrwrn7V0aliyyL5PNXgAQbOOKiUwvAgzhwFCXdJ
+FWdwfkZ9oB9tjnwPk9rVNLwSCMpUlqiuOJJaA4xF6lYsuV84frTaVGY=
+-----END RSA PRIVATE KEY-----
--- a/testdata/mitm/com/g/go/googlevideo.com.crt
+++ b/testdata/mitm/com/g/go/googlevideo.com.crt
@@ -0,0 +1,44 @@
+-----BEGIN CERTIFICATE-----
+MIICqDCCAk6gAwIBAgIRAOoCluim62fqs5XjNRdokiQwCgYIKoZIzj0EAwIwNzEQ
+MA4GA1UEChMHbWF6ZS5pbzEjMCEGA1UEAxMaU3R5eCBDZXJ0aWZpY2F0ZSBBdXRo
+b3JpdHkwHhcNMjUwOTI1MTQ1OTQzWhcNMjUwOTI3MTQ1OTQzWjAaMRgwFgYDVQQD
+Ew9nb29nbGV2aWRlby5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB
+AQC0Kk9AXLHPGacBFJP0OzRoM4ya11+6pYvH4ffWO9/ss45a0s60k7mwo3RCLBgM
+uPDggwlvEzsb/PncIHdEEvr4hNuW/Fk3q5GhjsHxlc2UpiRpdHYgrzTxsKFXKSrx
+XkE22Zas4w5ldCWiPexEgE2mECQjPa7sOvCFNeaNIR+dJAMsce9aEpPFA0flgGud
+QeCM/iPqgWAAW+ZqDfGw1PsSX4abdcUiecuUiZ6APY/x9emAxVG+q5zbdN4zzKQi
+6vYbCD3dpw/NpctXcbyru7s/hjqESSbe21WIlycr1Vbhm123+14H4MtEfx8ll/F4
+GJMK7x6EudU329nUkXgGMT3PAgMBAAGjgYwwgYkwDgYDVR0PAQH/BAQDAgOIMBMG
+A1UdJQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwHwYDVR0jBBgwFoAUocRh
+34tySDTLCHbozKkgPqEux7YwMwYDVR0RBCwwKoIPZ29vZ2xldmlkZW8uY29tghEq
+Lmdvb2dsZXZpZGVvLmNvbYcECipCKDAKBggqhkjOPQQDAgNIADBFAiEAu0WNagqq
+79x+4tmfHC5QP+1ybfTDj1khrjoBsiq50LQCIEPgpdcChvLlRgVEw5+PafVmX+p9
+mc1fnQNW756maay0
+-----END CERTIFICATE-----
+-----BEGIN RSA PRIVATE KEY-----
+MIIEpAIBAAKCAQEAtCpPQFyxzxmnARST9Ds0aDOMmtdfuqWLx+H31jvf7LOOWtLO
+tJO5sKN0QiwYDLjw4IMJbxM7G/z53CB3RBL6+ITblvxZN6uRoY7B8ZXNlKYkaXR2
+IK808bChVykq8V5BNtmWrOMOZXQloj3sRIBNphAkIz2u7DrwhTXmjSEfnSQDLHHv
+WhKTxQNH5YBrnUHgjP4j6oFgAFvmag3xsNT7El+Gm3XFInnLlImegD2P8fXpgMVR
+vquc23TeM8ykIur2Gwg93acPzaXLV3G8q7u7P4Y6hEkm3ttViJcnK9VW4Ztdt/te
+B+DLRH8fJZfxeBiTCu8ehLnVN9vZ1JF4BjE9zwIDAQABAoIBAAQu10to24sxzuBs
+WEl09nDugXbQeVCEEQxbASR5z2eKsH6hvMFEjMZYUfxKhpeeoGxJOCoNo3NK54iZ
+pSs92MXcXJzTNXitaxXGxfBhLs/v65IabVB+jbDu2oNQWWB+DiJcriFL3d6AWKW9
+Rx1wCfcV30Drz08WYm81VfaaeXluF3H/lInHb3KmMY6S28XfQEWjjbi50XprSm0X
+VqzPT+hP0Tv8JeB33l8FA2i36StylGpseQWn1eZQ2c/CAbQU7vHvqK95jyXXkygZ
+sSmkBM+A1xQHrX5vfGN1il0NVCNtVm6iVcB/dlodU9G3yVVcdphUcqnHZ++4A+Qp
+pTKVxYECgYEA1BTigsgVouxD4vcGVIoUf5K9qkWXAyhwDm7ctdR/HIHLMCNpVukn
+Bgv9DohxWyxl38W1JXA+iO1EWF32RBbqtPv8N499XOwWLEqE/AOfmLX4/bwF7BEc
+WXXOAVY67qHvirgxpFTWAGwAr6deanrDLGKxSVZedUxpaGk+f7JtQ+cCgYEA2Xlw
+tqNa83UBciCca784MIIWdFkUywl1H4WHR4ul1TTU89gNMa/gj5z5+8Grlew7ze+s
+zOyQ0gVH68GLS18kFfjJocYdAmSaOIsquRjWIwWBXM3bENu2s/koROS6x2o5X+zQ
+y0IuhNwukH6x4WEJF8kb8xcgq/qHo9zMakph+dkCgYEAo1Y6ZZMH5uSkHCc4Pt/h
+jadMX9kcxxfbxaHoZjn0c9Ya0UZUmNUUcvnEue6nrxpwk3lHXEAoSXjDDHPBeQtV
+VHJF+9yNJoXFRfNWnGmF/y0XSQQIY5mCBfxO3oS0+pjJTkMyKGgWMVj85ku20bce
+ng6cj+ju8tQY0otL0TlwIb0CgYEAh6yBqw+ikDww2LiLnZTAQ1MFGzTwCfMuhKnT
+SclPfgHl0PK62IK3ACGYu32JxJCKhuG91mLHvp7YzbYDZtRGOQbrE+f69SE6LYh0
+8OETxumKWRF8V7oa85C/lKt18y7L+JJPeF8jknOjATZpVwgomhQ3QaLuGRzFPm9j
+f/RDx5ECgYA1q+VTyAw9JeY9v9+vNOQ1iNtRn049Jl+/ftAcim0VkWxF0JChjhBi
+jrZUhiCJcHfei0hStgcF6pTWJCXX1AYkb4jYSx7bNPuseLkLhSahccnEQaERt7sd
+w4T0RFt6+EplwvlgB/hw5w8bCrAbJBi7sY/+Opj1YwVvEauTsXesIQ==
+-----END RSA PRIVATE KEY-----
--- a/testdata/mitm/com/g/gs/gstatic.com.crt
+++ b/testdata/mitm/com/g/gs/gstatic.com.crt
@@ -0,0 +1,44 @@
+-----BEGIN CERTIFICATE-----
+MIICnTCCAkKgAwIBAgIRAOhfE3At9+pXiegnFDpVNJowCgYIKoZIzj0EAwIwNzEQ
+MA4GA1UEChMHbWF6ZS5pbzEjMCEGA1UEAxMaU3R5eCBDZXJ0aWZpY2F0ZSBBdXRo
+b3JpdHkwHhcNMjUwOTI1MTYxMTU1WhcNMjUwOTI3MTYxMTU1WjAWMRQwEgYDVQQD
+Ewtnc3RhdGljLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALjf
+fI4xMu7VaZyGr8/SvhtN/Ee7LgbQPCCTCgsh/VZidlIOdKBoICtdtLO9Dm2DJ38F
+rxcmR+zukacVJ4V9RE4O350JI8qd2u0THaz5FiGBTsCe2SulRlTM7w9Of2rOCmqZ
+X4bYSLqIvQNbNwELwXVgCUpOlckasUZn0c/rX8FvHI+S/+T6+JWWUW6QON7+Nm4j
+fdK2T8LTl5NFjgZH/nXj6t5F/MXoXuYSF47xK3RFG+hmV3FpuFQfHSokaKurOdRt
+e1IoDh1/nvQbvcXnMiUIfEnbDoACeg/HnZOPOCqHk6gPPEjE43IdvMbudgNYos4S
+R4BnImp/JVIzLCQjEl0CAwEAAaOBhDCBgTAOBgNVHQ8BAf8EBAMCA4gwEwYDVR0l
+BAwwCgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADAfBgNVHSMEGDAWgBShxGHfi3JI
+NMsIdujMqSA+oS7HtjArBgNVHREEJDAiggtnc3RhdGljLmNvbYINKi5nc3RhdGlj
+LmNvbYcECipCQzAKBggqhkjOPQQDAgNJADBGAiEAuvsP433uqiHPjmc3y8XesMFk
+K7KubOmAdMBKLNMiVy8CIQCmUuP0cAL6dn3qpz0AGmvxRrGpgoYv0MSPIEwfihP9
+lg==
+-----END CERTIFICATE-----
+-----BEGIN RSA PRIVATE KEY-----
+MIIEpAIBAAKCAQEAuN98jjEy7tVpnIavz9K+G038R7suBtA8IJMKCyH9VmJ2Ug50
+oGggK120s70ObYMnfwWvFyZH7O6RpxUnhX1ETg7fnQkjyp3a7RMdrPkWIYFOwJ7Z
+K6VGVMzvD05/as4KaplfhthIuoi9A1s3AQvBdWAJSk6VyRqxRmfRz+tfwW8cj5L/
+5Pr4lZZRbpA43v42biN90rZPwtOXk0WOBkf+dePq3kX8xehe5hIXjvErdEUb6GZX
+cWm4VB8dKiRoq6s51G17UigOHX+e9Bu9xecyJQh8SdsOgAJ6D8edk484KoeTqA88
+SMTjch28xu52A1iizhJHgGcian8lUjMsJCMSXQIDAQABAoIBACjS8SZVJvImnlO6
+SkiSOPi+l98fLmLCyQRIdAdRUigpRgeIuahSVgg9gRHPxcfZFneuQaPTCD8Bz5gd
+y8RmjRbPogGDayvq/9UqS3tO5dwwObu/WCWTMZy4RHIU234yUYqIo9ebGzRVzadY
+FSVd+zJ4KpUGFX17L3pkoqhPSa3lAt9bo1KK2ghgkxfhwfVAGmUKHTZZ2yFRomKM
+mhNGRMnqmmYBzeOuT9tSGKOeOdimb+TGVYN6hZz5UJq+pi8fVKVH4EzIpodsqM+r
+LBu8vt0bUTSGtnk4kkOSc8uOWeq3+veW/2e9zM5K1yEaK/fXQOgon8red4KuZz8Y
+kTA5oOECgYEA7xPz9CaMbmrvytMjxVQUIo1Jn0bp3E91EUG9MRmE/JV8iLB95RTP
+uSJKLARUCBZXPwmmVPZlWASFlumC83wSAc0WDmTfGv5aDtvnnRX+/mRNND4D3vxo
+amTF9cdm8KQtD37OcjKQlfbXOzBNNlBN5Jr+TQ+GKUyVAxAW+KXYt9sCgYEAxfVZ
+qAIbrDbqiHBRP3uYJZ5CaKf5/hQv5p2vexHVHr4Gy1A8obaKgRVmfOrdJcrj8ncN
+GD3h08u6HZnwjErQM49mC1dDOwKBHmG4hMHdQnAHlnK5IaWVC+pSVHsIDwqi3wVq
+RV5I4iQb0HvcT/AeirLWtAvePgOhODy8ZATSMCcCgYEAjNWGKdbjdtALvcEvGzjy
+O4BbVDZj4OH1plrBZkEQM/KjT6oYH3BpBTgL1W4fSjxO3NWEZBxZisXvI/0epOv7
+d5AmZAhL3QzkZEhqYgDpG1ZenF3DzgGGSNZgPu5d13f/C1e5qU/cGFs2YqmLcmlP
+2VDsaNyyPXXdedZqkcKwrW0CgYBDK9O2XLDDKQdAMMyA/BFOgnsKRCVh/7uZR1xq
+KEzm15g6mQlZ3jT1RCu4q4FK96ONfLQmy6i7U1/d94RWNnSbakc4Be48McdaZdJU
+yeuoRZdth5QmRKdkmahCHlVHtVY60v2SeEHG6nW9sqm5PkM+0Rxlj7lj1Zt5F7Ld
+RX2E9QKBgQCoi2uK1xIKNV6yvPWEk35UQev24oSjgLEJE7yez3ZIUumjJZIisBIS
+XHUEuKGy6DQ1Blfpf9+F/j2rQzoIloqYBphycFC0iTx6XW4ahs22eODfSpxJzqmy
+sABA41ypAn3zt49P3u5/lf9fqk8ZbkdGYI6up+JhAGXcpaZ3YxQyvw==
+-----END RSA PRIVATE KEY-----
--- a/testdata/mitm/com/i/ic/icloud.com.crt
+++ b/testdata/mitm/com/i/ic/icloud.com.crt
@@ -0,0 +1,43 @@
+-----BEGIN CERTIFICATE-----
+MIICmDCCAj2gAwIBAgIQZo9DIrSsD1lpaT7bqGCcWTAKBggqhkjOPQQDAjA3MRAw
+DgYDVQQKEwdtYXplLmlvMSMwIQYDVQQDExpTdHl4IENlcnRpZmljYXRlIEF1dGhv
+cml0eTAeFw0yNTA5MjUwNzQ0MjZaFw0yNTA5MjcwNzQ0MjZaMBUxEzARBgNVBAMT
+CmljbG91ZC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC93ayn
+7RjvKWWdFm+MbQglNnT2zNTHt4OmdX3AFz3DgvY29icN1eyWsH2GW46YFd0eUuuT
+0e3kbWYGuaWwqUPs1XVQNZHw/XTIyoAUJFLDFE6uDnoOVB58CKRwoAKXDgFlNvkO
+vTxxFZd8PE31gqRIhqsWr7Oe2NGpFHb/v8BGQHXC0kZDHOeBrGNRDX7QsnbItemH
+hShOQgCh/Rl4hpK4b65r8UCXovLz4VZ2ozJsVAP1OAdiiK6k+2+aKDqrAojHl5yh
+BCxNljDxQPO/5uJ/1/1jRjUpT2qmK4LL2RfNFm3O8Xko3JKWyJE5kCUZFWDGP4fk
+HUGIa6n1rPz8VENXAgMBAAGjgYEwfzAOBgNVHQ8BAf8EBAMCA4gwEwYDVR0lBAww
+CgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADAfBgNVHSMEGDAWgBShxGHfi3JINMsI
+dujMqSA+oS7HtjApBgNVHREEIjAgggppY2xvdWQuY29tggwqLmljbG91ZC5jb22H
+BAoqKtcwCgYIKoZIzj0EAwIDSQAwRgIhAK31UiQuqQAprJh+b2t6k86Bo4qveZ54
+4BOFOVd35a1/AiEA7CnRGk/PJCanWp473sTIuwBDvZmEg8IqN/pEdFN3Ss8=
+-----END CERTIFICATE-----
+-----BEGIN RSA PRIVATE KEY-----
+MIIEpAIBAAKCAQEAvd2sp+0Y7yllnRZvjG0IJTZ09szUx7eDpnV9wBc9w4L2NvYn
+DdXslrB9hluOmBXdHlLrk9Ht5G1mBrmlsKlD7NV1UDWR8P10yMqAFCRSwxROrg56
+DlQefAikcKAClw4BZTb5Dr08cRWXfDxN9YKkSIarFq+zntjRqRR2/7/ARkB1wtJG
+QxzngaxjUQ1+0LJ2yLXph4UoTkIAof0ZeIaSuG+ua/FAl6Ly8+FWdqMybFQD9TgH
+YoiupPtvmig6qwKIx5ecoQQsTZYw8UDzv+bif9f9Y0Y1KU9qpiuCy9kXzRZtzvF5
+KNySlsiROZAlGRVgxj+H5B1BiGup9az8/FRDVwIDAQABAoIBAB6TxTsUHZhir9kx
+JEzWwGGR2BtpGHmDjgGwWUym0Y0bmcB3Owno4l3QVZ7ePuQyXTaFfygCvo+zqKM7
+oboGQIizRd3hirvnbbfqmN7ljKibLCKu9Sw6kuBB2g3DTzd5i3L7+/dKNaI2qntZ
+EOsRm5iMi6AvMrvJylYzFAkTHgmSD/pR6apKRtpHM3CEapUKFAgnZkSqY26KEZvp
+rxJifHlM0Sl2F0b7/bZyPdVlkeFf3Dz7ah3TyATeNuSMwfMrkB/Ypv3OABwQUVQv
+SqUtODtKVdiTu2o6BsQgxL9Y8wf2zfebehDXwWMS18w+ZKSgNSZOpcSYKOZpEVk9
+BJhD7a0CgYEA1iapZ/jaOkuENdRsrL1yzs9I7j6v83eSRIJpQi3zKcpoHApBZFOc
+QzjIFphniO0AbvjdYg10RBljBlLx3EBCOlHwzPrFJ3iBXQdQJ+VBx14KyCurq1d7
+rpNIxtzQsXcit6MkX6eVHTT6ISrwW4NWFva9W7HsnoVkQ7QalbC2i6MCgYEA4vgZ
+4QnBav5xGGEv5hYxFtnGR0lA5YCIURkt34MZz4J2phUCtbwYIhhP2lt59FmON0GD
+gEbhgjC68bG/wvfUlrSZUS9ARSSgqSoLNtTvp/gCLXhHIzWpjie7aFX6h1+MggyS
+vXK6lT7ZchzHMRnyyywb/V1AwxLjMQH7F0m5L0CgYAngyKmqGe7ccuHExaqGJpi
+RiSysKZOSbWXJmi9aTUAdPQYmFvQYwzl6kggwyX3QaNe1lQij1Dwb66xsAQoG0Mc
+95lyeKJ/0eAshfjoI4irfFKI9GXMS2vqngpDhuKKm+yv7U38yDLfHLM6A24ttGHi
+AsyVapK5/OqvA0AUdnJ3+QKBgQC70iXQRPtrJ/28+AfkNm8PAs4DBcqPYOrteZGt
+idbdEpBO5colS+8In+fMwbBNFaMLdMp2Z7GLw/mfssEGfYHN6MuLFDfyP9o3wtQe
+3t0nuaNLr2Hm8CxMt/Js5+F3Dwm+QNuMk8QEYKjdVKB1qM5foq6rJ4taJ12JslsA
+LSHXXQKBgQC81M8FE5KDEW9mTWrLH+/1O9/CQL5CvPSuGqWBE+IQHmGD0KUeIoTX
+5qfTN2xsyltRzG91rBVj7cW7ga96MG+pO2/Lroe9XhHJ4wQxKyeJxrJ4A9SWJLtG
+FccddtHFnSLQwG0EXNcp3o78I06UJd0ir4+IQO6fZ0MuVAq2H+ifIg==
+-----END RSA PRIVATE KEY-----
--- a/testdata/mitm/com/m/me/media-amazon.com.crt
+++ b/testdata/mitm/com/m/me/media-amazon.com.crt
@@ -0,0 +1,44 @@
+-----BEGIN CERTIFICATE-----
+MIICqzCCAlGgAwIBAgIRAIeN6ArPntT/6BoTnw/E/TAwCgYIKoZIzj0EAwIwNzEQ
+MA4GA1UEChMHbWF6ZS5pbzEjMCEGA1UEAxMaU3R5eCBDZXJ0aWZpY2F0ZSBBdXRo
+b3JpdHkwHhcNMjUwOTI1MTYxMTI3WhcNMjUwOTI3MTYxMTI3WjAbMRkwFwYDVQQD
+ExBtZWRpYS1hbWF6b24uY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
+AQEA730hyQh+2PGrAjN6gvx6wdtn1TUIgq4Mfx3v7S3q8icnrmCssviDc5sAn5OI
+xZY+ByBXgMUyXqPThScX3SswGIKBEjBFeFARxch4mZKgyE0TrlDIfP8cWabJ86kd
+zD5+xMvVQ53JFLR4a0efswPqOkPD8kGqgDPYcV0IV51k1wpVIKGdVF9GbRH5IQOI
+9CssJRk3ZMluX1fmATQOEO8ojMrDjSHsuWdwYFEMlHDhPbTqNbZkyvbZOF5WeRiW
+Pe7W6+3Thxj7xSZCYZ3l3D5/OtgwRI5KUfVId+n8bvIPasj2Zyql/0ci2pY2+ICp
+huTj0Lf5wneZdBfJIDy4gb8K+QIDAQABo4GOMIGLMA4GA1UdDwEB/wQEAwIDiDAT
+BgNVHSUEDDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMB8GA1UdIwQYMBaAFKHE
+Yd+Lckg0ywh26MypID6hLse2MDUGA1UdEQQuMCyCEG1lZGlhLWFtYXpvbi5jb22C
+EioubWVkaWEtYW1hem9uLmNvbYcECipCQzAKBggqhkjOPQQDAgNIADBFAiEAqz+F
+io9mDPVLJDx2T65a08dN7fIIDiUz/ZLBu6juWHgCIAS/CeSTFJlDKDR60pIrpHY/
+sH3Qygblz9h3l/HUQIB9
+-----END CERTIFICATE-----
+-----BEGIN RSA PRIVATE KEY-----
+MIIEoQIBAAKCAQEA730hyQh+2PGrAjN6gvx6wdtn1TUIgq4Mfx3v7S3q8icnrmCs
+sviDc5sAn5OIxZY+ByBXgMUyXqPThScX3SswGIKBEjBFeFARxch4mZKgyE0TrlDI
+fP8cWabJ86kdzD5+xMvVQ53JFLR4a0efswPqOkPD8kGqgDPYcV0IV51k1wpVIKGd
+VF9GbRH5IQOI9CssJRk3ZMluX1fmATQOEO8ojMrDjSHsuWdwYFEMlHDhPbTqNbZk
+yvbZOF5WeRiWPe7W6+3Thxj7xSZCYZ3l3D5/OtgwRI5KUfVId+n8bvIPasj2Zyql
+/0ci2pY2+ICphuTj0Lf5wneZdBfJIDy4gb8K+QIDAQABAoH/bTWsRWjJxM8aW/mP
+csOv4cCdmOg3axRlSSCpnd2xa/4QLU7fE1XOiPxMChozrPA+wToRV8PXgDRkZozV
+hHeok4S2v26sGWC11oT867XxwddRNTYAShxXjuk9xncMdOe++ksCz6zYd0NQPjNh
+vHmH0aHABQUJUw5RbH0mIVLUXXOc3os4zbrUkCnbUKjImnB7HnbmuZ8L03Rg3s4w
+Qlt6rXDoddm8mKg4HOx8t83vQPqcctzVjJ/k+a4kKaXxZrRLhmCKfXYIPd5fokdO
+h5NMbID5kSI0qXT6bgKWE8sYtXnh6HcsjEHcYoR3bA8nuCTBlhh8NzxX3yPb5SQd
+pD3BAoGBAPlYeaRs7XaUPeyeiqhn+XtrCF58R1EwHZMMW9mOTsVE1ZjLFF+HHATZ
+UdTBC3CgnwA1byU5V+5PYbhG5MPbVgMGuN4j/vrlgvMYaLklXlQpni4sXiwNeUNW
+aVyv378tF3Kb7iQmvBrRneIVpgLr4IGTr3Ec6Wj57dzTkjd+u4LjAoGBAPXhULTP
+6n4mFJcTC9QIYAsyodvSkgwKjlfER20j3bZ0Elb+mkbbLV4kpykuC85LAEgB62t/
+ekopwc3PQL9aWvSxNxaSXbswv6+6Ig5adsyH6fIu2oaDRmSRNAAKvyu6fQzw+IKM
+JUMNqctvWJKfzbyofDG1wuR3EsxNuMZHwPVzAoGBAMNTvr7CoebxS+0vaTlxcetv
+tjemLYv5IEHQPaeYpjY8rQKrm4MV6SoXP9Zlf1u0R7o3IaFMYYiK4OclihGvoZpv
+SqSiGB1da46ZgXgAQPu3OnW7Re5Gg8bvS0xTbfhqD2M1qYDiYxqzOHYiNVE2jEGV
+eqsmVeZpWx9REcqtWaC3AoGALOmaN1zfJWnJSws0ludsu77k5+VfvglTlN6KeXoa
+rpAnJXLeNWEluVOSoSgDCgyTIZQQL5Oaf99+whxAZHOZt6aDPIFB08aEzRF/1QVb
+O+L7rbw3OGjUO9x2FifgYZlv7CQ8EISO7d+aC0nscOP1zactAFuGHPtPGLh9ruI+
+cdcCgYBG2Nbc9S4TM/FYUXwz/2jn58/hWLMlbrN5qZsZrOtVBHwdIDrHsrwjstJw
+0VZLFsKTTRPTQ7kBov0vRMg23K79w4NGfp+S5gk6RrsBA87ytRu5TMQoZy2z/waH
+9/rCOA2+na3E7dPcImW+GziO//U3SP27rG31altI2OmdlTAnRQ==
+-----END RSA PRIVATE KEY-----
--- a/testdata/mitm/com/m/mo/mozilla/services.mozilla.com.crt
+++ b/testdata/mitm/com/m/mo/mozilla/services.mozilla.com.crt
@@ -0,0 +1,44 @@
+-----BEGIN CERTIFICATE-----
+MIICtTCCAlygAwIBAgIQZNltuUEUxWJgCNOyuYbUBTAKBggqhkjOPQQDAjA3MRAw
+DgYDVQQKEwdtYXplLmlvMSMwIQYDVQQDExpTdHl4IENlcnRpZmljYXRlIEF1dGhv
+cml0eTAeFw0yNTA5MjUwODA3MDdaFw0yNTA5MjcwODA3MDdaMB8xHTAbBgNVBAMT
+FHNlcnZpY2VzLm1vemlsbGEuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
+CgKCAQEA7iMjCkpwDNQOGzbNwoI4hqCw8UjOHLrnnfOpfS1C9f6OwxlRBEyE3+ua
+tOm3XpPWb/VNXJgVRAs4CkWSeIMwDlaFfMPyPkBp3p6FBdWRPr/04SRI00SBaurB
+fzQHEHy8Ue2fdKxtMj2+vXPDaiKpE0/BF5JkwAP/bFNwDW8wHgqTks8w6yI9THiQ
+laAY9w2EHJKOAQhFQyvdPjRk9mvfBzs7gRYyq3/x+7L3KzNLtIs9fKMURy4nk1zQ
+6SOAuHLQOo8RA5S45VApbVdVp2y+5CdJLjxvQfMIBih50HHq7oARuzzYTawdZ5sl
+O27+bnABi/1a4tL0RemtA3X0uMgXPQIDAQABo4GWMIGTMA4GA1UdDwEB/wQEAwID
+iDATBgNVHSUEDDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMB8GA1UdIwQYMBaA
+FKHEYd+Lckg0ywh26MypID6hLse2MD0GA1UdEQQ2MDSCFHNlcnZpY2VzLm1vemls
+bGEuY29tghYqLnNlcnZpY2VzLm1vemlsbGEuY29thwQia/NdMAoGCCqGSM49BAMC
+A0cAMEQCIGlquqXVA2X/cCFXTz+bHiZhFB6BW8qnvC4ws62KJSrUAiAvLEY3Cx8d
+ng65XUbi+Y4Lhf2Pej1SvZQq7q3Z90pomw==
+-----END CERTIFICATE-----
+-----BEGIN RSA PRIVATE KEY-----
+MIIEoAIBAAKCAQEA7iMjCkpwDNQOGzbNwoI4hqCw8UjOHLrnnfOpfS1C9f6OwxlR
+BEyE3+uatOm3XpPWb/VNXJgVRAs4CkWSeIMwDlaFfMPyPkBp3p6FBdWRPr/04SRI
+00SBaurBfzQHEHy8Ue2fdKxtMj2+vXPDaiKpE0/BF5JkwAP/bFNwDW8wHgqTks8w
+6yI9THiQlaAY9w2EHJKOAQhFQyvdPjRk9mvfBzs7gRYyq3/x+7L3KzNLtIs9fKMU
+Ry4nk1zQ6SOAuHLQOo8RA5S45VApbVdVp2y+5CdJLjxvQfMIBih50HHq7oARuzzY
+TawdZ5slO27+bnABi/1a4tL0RemtA3X0uMgXPQIDAQABAoIBABIE6J7buRTPau3W
+PMWOEvbk696mEqqL3gDOsjF9nkZ855KNtNqta5SCAGfWE4D9kMlR93OdMma+rpPg
+Zc/mpVlAZMNnFEpvl1M4DXq+iUoFPmNW2ofZ9C0B7HhSmII/3gQZBerPLUgS8f7l
+5pB+ZOrIKyU8d5Er/ETXH3B0zGBJaTSLCgnNfXxw3EaPaD3k3zbCZOIn6NybrylM
+KvDftZs3m3pUbPVr6xyeKsH4aLF8fa3+e4K2qFwYC/eDR8b45nZc6M+BcJYYF6L
+PZ9zdLDhHJJ1/UBBlWSzul8gAAlvDli4YOZQhJpGYvBjwBCm06LsJm0m40yWntTu
+67O10YECgYEA7xC7tfXjb1kddytpnTq8CblJrFTBqAO/L6Ko61Jrf/L0gP+Wqnhb
+EM0ulKM40KtyavWzjkYRsSNa5ALSD04MOC091lOmBUqaOiQ7VXyfcV6hjpjPRndm
+j2/ywcxaj8c/3VnY69M4Xu/lacsRj6JTbMlPFesvi3twXDgyLUs4910CgYEA/wGS
+s6YHI8CKZp8kocQ19RBYpSRcwn44zwI3fEl/SDbT0pLbSV3DzTJUa77tzGllZLCm
+fp8JvYH42+cu9ZAjCLUkV+v85d3QYW3INRjVPtffKzI6oo7UPttuMN+td+KWRaJY
+vbk0WthmolyOwt71saF/ew2P31hWwgbnB993AWECgYArgsgnXhF++qE6R1R5oW8H
+9glKrEJy6fuqF9jWu7GFIBsQP3SUokMw06detjZpBEtW3FFJ28bsjprEVR8WWgYv
+U0yl7aOR4vofCukhrgT3BVoyMe3HzYOFJ8LvMtpowMMG7otkoJTp8o+2qZcQpWK5
+sgoK2ztUD6trnW7Ef6RmoQJ/Ua4vT1ve7ZS+wCA5m5c9sUGLI1qCW8oSaDxNiYIB
+QyBMuSZRFy7xiMiWQezmPpOD5ryul+BZPlpjXAyw/fctQZzEB2WPnBFwrcR8XIWX
+yIlc8nkkTu1xDrE6mm0LI1twxt05j4vDOVYXieob0E+aY0tXihLOArxJDd0oI11w
+wQKBgA4PUEO6PmFT6zXGKmrnYoLWTOlVbg3WCeKlih6fPx3wGMwDmaD/cgIVJzFI
+WdU9s9xnR09q2opT9XksRzH4hxxRZhqFekhzUXFSKjFXxRxbaxmkjlsGTb8siXtB
+nx4aVcGhtZErDJMQVUGN6FY6jjnNzOwDvxwI8vOTqlummp+h
+-----END RSA PRIVATE KEY-----
--- a/testdata/mitm/com/m/mo/mozilla/settings.services.mozilla.com.crt
+++ b/testdata/mitm/com/m/mo/mozilla/settings.services.mozilla.com.crt
@@ -0,0 +1,44 @@
+-----BEGIN CERTIFICATE-----
+MIICyzCCAnKgAwIBAgIRAIOQpcsj7/mrebW2OI/WITUwCgYIKoZIzj0EAwIwNzEQ
+MA4GA1UEChMHbWF6ZS5pbzEjMCEGA1UEAxMaU3R5eCBDZXJ0aWZpY2F0ZSBBdXRo
+b3JpdHkwHhcNMjUwOTI1MTgwMDQ3WhcNMjUwOTI3MTgwMDQ3WjAoMSYwJAYDVQQD
+Ex1zZXR0aW5ncy5zZXJ2aWNlcy5tb3ppbGxhLmNvbTCCASIwDQYJKoZIhvcNAQEB
+BQADggEPADCCAQoCggEBALXDGBejh1pWMJbFtncvS4p1rQhK3jh0BoJ3u35ErOm1
+eAJVppdREKjTpcThvATljlUB3DLxfR36i1JhXUYQp22r10NxC0fyEGsuRosxg5Is
+Sdn+RlH1sbR4euvKRfA/IsvgqFpEQDsfD8uNlBmCEvuA0MM2wOnzsi7l0SsoNi1v
+7PpXj4tBi0dZF6uDpCprLkN2Uv75CV5A2BTbAEnxhH7ICE/lUjJn4nnjgNwIfIxL
+VSc/L7iAU3dlnw9HWA038OoUXo5+wB+8WLZVIR6xKP6c8oAuvSwPuXQNfbzq2B7U
+yxx3CEuSCvEcQ1NSG6hM8KTDcBY5eGt10FPp04i5Ze8CAwEAAaOBojCBnzAOBgNV
+HQ8BAf8EBAMCA4gwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADAf
+BgNVHSMEGDAWgBShxGHfi3JINMsIdujMqSA+oS7HtjBJBgNVHREEQjBAgh1zZXR0
+aW5ncy5zZXJ2aWNlcy5tb3ppbGxhLmNvbYIfKi5zZXR0aW5ncy5zZXJ2aWNlcy5t
+b3ppbGxhLmNvbTAKBggqhkjOPQQDAgNHADBEAiBNn4MzLzUReDgOTZkgkUaMBhoB
+jWhUe9Vo/kfurna4KAIgFE2E08v93wFa8+yr5GuW7/R5e9uVs9Lk0Shq/OJnGZU=
+-----END CERTIFICATE-----
+-----BEGIN RSA PRIVATE KEY-----
+MIIEogIBAAKCAQEAtcMYF6OHWlYwlsW2dy9LinWtCEreOHQGgne7fkSs6bV4AlWm
+l1EQqNOlxOG8BOWOVQHcMvF9HfqLUmFdRhCnbavXQ3ELR/IQay5GizGDkixJ2f5G
+UfWxtHh668pF8D8iy+CoWkRAOx8Py42UGYIS+4DQwzbA6fOyLuXRKyg2LW/s+leP
+i0GLR1kXq4OkKmsuQ3ZS/vkJXkDYFNsASfGEfsgIT+VSMmfieeOA3Ah8jEtVJz8v
+uIBTd2WfD0dYDTfw6hRejn7AH7xYtlUhHrEo/pzygC69LA+5dA19vOrYHtTLHHcI
+S5IK8RxDU1IbqEzwpMNwFjl4a3XQU+nTiLll7wIDAQABAoIBAASHqYtim/ZNvPBF
+BS3Qk/AOIWiE1SelsfPWdWnJibWuvCBIGjAd6RhhY07rgVAYmITYgwW8rFhEQkH6
+AzptIn8X5UmHq7b4pXLGYyOyRuEsZrrJcjSLYbO/EkaGHVrGIraKEX1jw2YLJCL3
+6FT/v5FdEyw0/8x/h6qmN6GnuDycSV3e2J9pmlT9zZgvdLWGHyYCKmJbNglZMP4P
+aCGnhvG5nxo7yMCQuBrb629osdWwGrPXprb8e14N9yV4r5EPqwBPGT3LcYaAzFR1
+ymtUALUa3DA5gYxzxH8VuQIJaQzs6351ASzSsIAbsr97UsQKqym5Eur3gNv4HL3m
+0vY2GuECgYEA7L3Rc4U2WyrflftuDZln6XTRgOLF3d18CxyKKB6+mQc31c4FSj69
+kCXM8+da2dCVwWORPVZeJZlt9BD18EKniq12mz1bhWq7x+FVRH1vBhOXi+c5r6fB
+yJm03ipAI0SWCmcW4N9JlClo1UNqaK+2gTuDAaGTmApVDRd7+abz2PMCgYEAxIxS
+GcntPUnNUfATkTA6wICyjUYp6cu0V6QI0ianpUM6zc1IQwnLpz2DskJl+EAbf4Bv
+5aPhBs7rxuBAUL0ZsG2bOJ+bSkjN93Po1zrljYhzVI9Jnt5gma3nV4M9wx1vzBdP
+E0iRm7+6gWqyDpqH7mjL7e1EhO3T9KhUo2KLfhUCgYB7BJv9ImC/eQTcA94JNQj5
+GBnxlmVpR7k4cOkdtfQmwshx0m+PSBDrAamBqFveSXQ4HMwRCns7oIGxTMrvwUMc
+Xcz/GCAhsPfJAr9zKpbxmmaqbUndjBe3bJ++vke7y90HpNAPpBew5N+zyidWJNB6
+UPlfdJ2kaOIPPn/Ol8GonwKBgFER7+tjNs/I2T+q3udMFW/BpeRPxIoC0+gyaNEF
+0LCCAodQ3TWJnM7muKOWb6juCGmW+JCn//Fm+CmX5e9nkGkNTLEWZF9HmG0xCiF8
+0aKHXcrLL3qwDvhUms+l+pu4UJzGIH+7txOfCbbH45nSc68K2tLQwypxTrPjmsWp
+qA/hAoGAVm75ZW5H4yXtE6B83F3k5Ky7cEF1c/NWq3Afs8KLm9GjlEDucyCxJxL6
+1z/HO3fqyv76LcUa29OeHhzdlWGwMnd+xd8Vyb2EObiT/Lb9NOVumH3+MjGR8UhM
+77uBz8UOQRJe0WdvuMn7x5THRL+XKIPwpvoIzKQ3dN7Cs33Bqzg=
+-----END RSA PRIVATE KEY-----
--- a/testdata/mitm/com/p/pa/parro.com.crt
+++ b/testdata/mitm/com/p/pa/parro.com.crt
@@ -0,0 +1,43 @@
+-----BEGIN CERTIFICATE-----
+MIICjTCCAjOgAwIBAgIQRDRDUcFqpb8tEPt1UjNCHzAKBggqhkjOPQQDAjA3MRAw
+DgYDVQQKEwdtYXplLmlvMSMwIQYDVQQDExpTdHl4IENlcnRpZmljYXRlIEF1dGhv
+cml0eTAeFw0yNTA5MjUwODQwMTFaFw0yNTA5MjcwODQwMTFaMBQxEjAQBgNVBAMT
+CXBhcnJvLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMqwClUp
+ipiqTzH5MVOEs5iwPvogF3Qoak+2HpbVmmUniuCG+SewFFqDvUWhm3jqbJSTVcLL
+zftq2zRyvOc4WZmtIU4IU+H0DC9gLiNwW9WNMucsL0Vy4HCTV38x/mi925ZCcJEA
+91pOWJevL+HDKJ4nLQwpAEqxN1SwZ5IUSQmJIg4SbvcBF5DacTL9McSjCOdCl+Zd
+fRMFd7fSyjwm3JRK3XNn7PrdRwkPBgsiO+6wt059niB9bEVI9UvLsEOfxLmDrA5Y
+gU0Y5wPD2GARVdyhF+WjUeR8TwfWDGQKSZI/OKRLGbJ2HiE9QuIYh4jNpn0+pwd3
+wfxLyX24UATMXJkCAwEAAaN5MHcwDgYDVR0PAQH/BAQDAgOIMBMGA1UdJQQMMAoG
+CCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwHwYDVR0jBBgwFoAUocRh34tySDTLCHbo
+zKkgPqEux7YwIQYDVR0RBBowGIIJcGFycm8uY29tggsqLnBhcnJvLmNvbTAKBggq
+hkjOPQQDAgNIADBFAiEAxb136QmOOr5+UYeImA9DWlJhm7PEOJ53XuUPu+NQRk4C
+IBgSlrAhpH9v0gsc0oIU4Vz70h3uaVKItCuHgR4WJlkX
+-----END CERTIFICATE-----
+-----BEGIN RSA PRIVATE KEY-----
+MIIEogIBAAKCAQEAyrAKVSmKmKpPMfkxU4SzmLA++iAXdChqT7YeltWaZSeK4Ib5
+J7AUWoO9RaGbeOpslJNVwsvN+2rbNHK85zhZma0hTghT4fQML2AuI3Bb1Y0y5ywv
+RXLgcJNXfzH+aL3blkJwkQD3Wk5Yl68v4cMonictDCkASrE3VLBnkhRJCYkiDhJu
+9wEXkNpxMv0xxKMI50KX5l19EwV3t9LKPCbclErdc2fs+t1HCQ8GCyI77rC3Tn2e
+IH1sRUj1S8uwQ5/EuYOsDliBTRjnA8PYYBFV3KEX5aNR5HxPB9YMZApJkj84pEsZ
+snYeIT1C4hiHiM2mfT6nB3fB/EvJfbhQBMxcmQIDAQABAoIBAAeM8/B/DOap2Svf
+GDV0PWf7VkmfjRAfHX2oycKpKiWU/jTxgkNwjDJJYfz510dcRhppjWmliYiLlO0D
+H5QgmgqfH1dcbT1cB9XPyx4JIKNmXArc3dVnEqX9gKBu/pJ4afmBbDReTBLTvm5S
+sM1D64F8wsK1tTeTGsPMk2/hAMJDKMjGvEIPbB/sadDJDV0eagYUi+nuPJy8oaFd
+BWqw8sp7ii5KImj+F4AQvdAyhbnUCMAB4SVJTzuUiVF4lWDdQLlPA2j4JXBtvBwH
+STdduEOHGd5zvj7EfTEtxOQ5WVig8nHaeQvznC02EmtiM9N3pu/1Jyeg2Xx2kypL
+EdpH0msCgYEAy/Efec3siNZCiIidEZ+5D3diiK9Z3k2C65RGJhmnY/ZazpQw5eLr
+YuyG8UjkMlnc0QR0VE81eoq8SZMtBGB/USsbHt/aF+2x4Zp6v+GRvDhev46bhnBB
+jxgbKRsQ4VWRQkQbzD/dXb+btCyWz4N3qioZ543OSsp+RPqo7g/2yisCgYEA/mz1
+QFrtBqPZgWhhrstdeWbfuy79tdfKpC4tMQRhPZ9u2g5TKm+uijozMBcPiBpRQNRL
+3chZWT1HTwWIlgyJVndX7rcWrdT8ko9ZqBSbzriifvSOucK1trNvsCiBUt4U5qJ5
+DnDkm3FPT8juQfi9sK17rCvJKJ+dlFv4pYnWZksCgYBkh1Idp40uEnevd6/9DP+b
+CR1QBSfGdezQFUHS7BhgJQK0C8Ziu02OcMs/ys95pmQ7v/dby8OvyQ1xMxQgsTRx
+HU98E5oc63UgoRZa2WUOI7dIs5IkXddjIt3YkFfsy1IUGSCeuOh0msu0r7oTRlnJ
+ToGAa51Brrk5ZVm6J7JeCwKBgByDt6Tjy+bPnEPtn+0IK8y8Y9zFsneb3MEzz6rL
+s95FLRZRPq7l32jshuof24TEdlDOukX7+0+OF5zaoOk4NHg1XeyKJoeK9Fe0qza0
+QJYViVizLf/Ru63jRGQ41e2kqDEFCo48xtJJC7uEaHeKWjAf8VlleuELqoyDFkXv
+QdErAoGAATGtLzpFGe1ad07C+zDknWtFFDW1iOVoFepa7o78d9AKuBfbZ/BlLkov
+BBgOg4Aps9Nbs8IwAXk7PD190RwYJ22JCN731PcyBH/wSahEkwfXO2NYF+ny6fbU
+wP2/fP4z+xiuhTHkFkIwK7QlAzv1MAOCq/IEvcNDV71qTQhDDnY=
+-----END RSA PRIVATE KEY-----
--- a/testdata/mitm/com/r/ro/roblox/api.roblox.com.crt
+++ b/testdata/mitm/com/r/ro/roblox/api.roblox.com.crt
@@ -0,0 +1,44 @@
+-----BEGIN CERTIFICATE-----
+MIICpjCCAkugAwIBAgIRALcKmQIxtZmSCUMgZ7cEhlgwCgYIKoZIzj0EAwIwNzEQ
+MA4GA1UEChMHbWF6ZS5pbzEjMCEGA1UEAxMaU3R5eCBDZXJ0aWZpY2F0ZSBBdXRo
+b3JpdHkwHhcNMjUwOTI1MTUzNjQyWhcNMjUwOTI3MTUzNjQyWjAZMRcwFQYDVQQD
+Ew5hcGkucm9ibG94LmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
+AMbBs4QVPvDghq9rS37+zEVtxKhuW8HA1A0Q0A/9Kqld+yfozGvKY/Di5h2imUIT
+7dsdgu5Uh/RYari8kYkMSSVOgMPhWCD3wfic8iRNGwbrw+fUIZ6zNJ0ryAqdevbK
+G+7omTZclNur4WWY8qtASwjBuyIkjjf8nDOIIZ+o6n7h8jRgqdzqn8oKmBvjLG6P
+vKqg3ohlf08BCapF7iKFyyFGrN7c+HkRyt0nsLP7DM2Ai5VNuH6erWiTgukwwv30
+NJVtTr6hjlZIyIxlGzjVCqXFp1+KOdIu97+t5LPNBazz2MeJ4Y63xAEjsH/kRVCS
+vhtiuTGkosCMzjOjdU4GTssCAwEAAaOBijCBhzAOBgNVHQ8BAf8EBAMCA4gwEwYD
+VR0lBAwwCgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADAfBgNVHSMEGDAWgBShxGHf
+i3JINMsIdujMqSA+oS7HtjAxBgNVHREEKjAogg5hcGkucm9ibG94LmNvbYIQKi5h
+cGkucm9ibG94LmNvbYcECipCxDAKBggqhkjOPQQDAgNJADBGAiEAj+eOmWVqdeBn
+FEnCFCWVQCqNmkdWtsF0JUCp2eUP8P8CIQD1yzRGdr9rAgT09jE9MFvnClMkn7ej
+rPSnpPvPFKjfMA==
+-----END CERTIFICATE-----
+-----BEGIN RSA PRIVATE KEY-----
+MIIEpAIBAAKCAQEAxsGzhBU+8OCGr2tLfv7MRW3EqG5bwcDUDRDQD/0qqV37J+jM
+a8pj8OLmHaKZQhPt2x2C7lSH9FhquLyRiQxJJU6Aw+FYIPfB+JzyJE0bBuvD59Qh
+nrM0nSvICp169sob7uiZNlyU26vhZZjyq0BLCMG7IiSON/ycM4ghn6jqfuHyNGCp
+3OqfygqYG+Msbo+8qqDeiGV/TwEJqkXuIoXLIUas3tz4eRHK3Sews/sMzYCLlU24
+fp6taJOC6TDC/fQ0lW1OvqGOVkjIjGUbONUKpcWnX4o50i73v63ks80FrPPYx4nh
+jrfEASOwf+RFUJK+G2K5MaSiwIzOM6N1TgZOywIDAQABAoIBACj6E3AmTzErISl2
+VfzLPEMOI+7TvdAe2LkO386EE/ESIq8yND7+3YbyyJ2QgcdZQ38awP0w6Uyrk+kd
+W2XlZgkue6amxVwaqF+Av/1S9kEBh4S6u+mzqaPDvHzPxeOufH7PbpMCGGCHubMQ
+Cuval/2or1OVNMr/JhcLuF7p3Nqmjn998vi3dvL3uUf1StHHGF0foJpwj5XfCfBf
+eOBa8Lvh1HIM2waDrHugm6QME5t0UDWErQIw/fCatqTRZ90wUexqvU99sJMiNcMW
+kJaSUfH0aEwHPsB30yWY8wvYUPSROJjvj8XQEQznJf18G9btyC49fMKXqvbW4jbu
+EvdxYoUCgYEA7S8cjsbJv7ZP1A+o102DjlQNatOYFDEpyEV5AZvVjWrn8Hq31sTi
+s8nmNhLyENnqwQfQaSMigeHL8KffgllgNby+Mqu3fFKO2WArBEeL/cv2iRqsX2O9
+7b0CA8ORW9dzOKBx2KpYR91qmJPRBqB9PQ+wUpphaM3rFLsYytNWuCUCgYEA1oYu
+ZLhaMh47d4SiLy1iMmhZKGQwpuUj3tpeAScr58EGxOGzLxx2pv/B/YBUKYl3KRwp
+R8MfyGeDsIqCDlsxjh4or+bwUlLLpF10O+yULI2ZJyWVqRls+3hgcG01eya289Z9
+t+gBHQbt93HdxVK/6OSPHL5+TS29PmVVZh5ogC8CgYEA2dUw5zhPRlGMU3jmWocI
+UgmEIR6gR7s3YoXbssyKf002I7ixawB8LR863WLdCvj5D7u7fzQTlzHneejT8AVh
+xTjJfgQTiozQQXh/SXjka32NuTHUKe+TGetDFG3i7HSdj95bcOBSH/6MzgDEMs/m
+9dOY3uSGnhiw1ONYy775oDkCgYA7xIiacS5X9kpVIzPYdwl7x8zHTxqq9P5IcYht
+Q8+csw/CvKsifgikwG74xM8t/2men4T0xG1PdV+gSQaxH0EwOkDVuT7NgNnRwmPG
+6kPiIdVArd0DjtzpNwGPcS3MUN36E5FVMqNUxgB4x1WlS0fCiCNDO+OOdybZgnwH
+hoNQ6wKBgQDb00oXirQwPcWwKBZS705feu5pTB/UxsNo9eVHSyz96hgAS+aQM0m8
+XYuI+dXdjMjt7ekKdXczN1c+WQyhXDmhTunqaW+HZIFsygMn797xemVpaINTwDwC
+P1bwKvyFHySaSxRqBFZYHQyXu0W5pOWtgcjxEOqEnEY01OerapSYRQ==
+-----END RSA PRIVATE KEY-----
--- a/testdata/mitm/com/s/sl/slack-edge.com.crt
+++ b/testdata/mitm/com/s/sl/slack-edge.com.crt
@@ -0,0 +1,44 @@
+-----BEGIN CERTIFICATE-----
+MIICoDCCAkWgAwIBAgIRAMaYDwynTejw7OIZZpVRpUUwCgYIKoZIzj0EAwIwNzEQ
+MA4GA1UEChMHbWF6ZS5pbzEjMCEGA1UEAxMaU3R5eCBDZXJ0aWZpY2F0ZSBBdXRo
+b3JpdHkwHhcNMjUwOTI1MDg0NTA3WhcNMjUwOTI3MDg0NTA3WjAZMRcwFQYDVQQD
+Ew5zbGFjay1lZGdlLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
+AOfkYLYUACb7LK1MMR5lxFEMZIoiYKyRVHbHdXNb6Us2+RNtfyzEn3Q2w4CE+vJw
+JxwwWR063RFZ+nMxiGj75+MI5HA07BJyTjC12uvMt9sT6LmXjMDjqzSwPbTvwVQC
+mQtVNXtIsofMGrEy76gCqm2xERjp8k7CFim4tfIjQBzAI8o3Xyzc7K/qt4ko53Bk
+J0j3auXSrdxzJkznzKL1+lwzTAbAjTH14ZhRvGhybZnCbNRACNg1+ORk5R6tg4Rg
+kVtaDgxpTWyfiVDmUJxSFBUwnpHrk19xqD4NWLVsQM8Vj/InczVnCsSeLJqHZ1Y8
+10Hep2jY6/6HKkBPx1L40PMCAwEAAaOBhDCBgTAOBgNVHQ8BAf8EBAMCA4gwEwYD
+VR0lBAwwCgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADAfBgNVHSMEGDAWgBShxGHf
+i3JINMsIdujMqSA+oS7HtjArBgNVHREEJDAigg5zbGFjay1lZGdlLmNvbYIQKi5z
+bGFjay1lZGdlLmNvbTAKBggqhkjOPQQDAgNJADBGAiEA2sTzorf9HDa5l1eUiIrJ
+Ub0/bWOx18hTaUM6wM5pdDgCIQCILo9AZsRsMccAI9E8qdteMlojDbEYKTAuPCGp
+tKFvbg==
+-----END CERTIFICATE-----
+-----BEGIN RSA PRIVATE KEY-----
+MIIEowIBAAKCAQEA5+RgthQAJvssrUwxHmXEUQxkiiJgrJFUdsd1c1vpSzb5E21/
+LMSfdDbDgIT68nAnHDBZHTrdEVn6czGIaPvn4wjkcDTsEnJOMLXa68y32xPouZeM
+wOOrNLA9tO/BVAKZC1U1e0iyh8wasTLvqAKqbbERGOnyTsIWKbi18iNAHMAjyjdf
+LNzsr+q3iSjncGQnSPdq5dKt3HMmTOfMovX6XDNMBsCNMfXhmFG8aHJtmcJs1EAI
+2DX45GTlHq2DhGCRW1oODGlNbJ+JUOZQnFIUFTCekeuTX3GoPg1YtWxAzxWP8idz
+NWcKxJ4smodnVjzXQd6naNjr/ocqQE/HUvjQ8wIDAQABAoIBAAIUKofHUx8GVmax
+TalrmSBu34HbgAlb/ilYbWWc19EMS5xQeXjhxFoq2YLP7l35Ami+yDW6Xtv2dgfN
+VF84juIapM2as9kQfEH0h2NgwO8uVQJA6Qqbn9/Hiq4SDiYeJdgTqfiSdMNB4aVg
+AwT7DSMRmMkj47+v/rneBYeHqF35mJoP+smKx/R3omwQIG9dnf/g3ycuylc7/FwR
+Qt05vA8TxlF3Z20oONred+4xouCnwtYws9yqqEYOVnW8Ktk7w9uGjF/dFMRhab0g
+fpxN3bgdxRXQR3JkLTr+zMIfroxQnT2sxXKox45zR6ws8gCCiOjPXuBXKa4XYcT1
+JqpiY3kCgYEA72/MMqw+MjQ2DidEsl8qENCwsYk7tEcqFs9q6e63fEurRpgBYIRP
+Tw7R+v5Vk9n6t+U2iIUBbN8jvZq9fTXvu1WyyBA4gyyycastbJbWVEjvNew3q9Pv
+JjPrKdfy3+Fzt1ov0iccDTKGAIf/OmPTgsQrJViNJlzgQfWF65kH7XsCgYEA9+74
+2zn/5ppjAfhrgcL87KPoJ10M1WfTXlY32Y8pq66PsTqUFR8Y8zuT4x0suWCCbUZj
+BifXGxHXsnx5dzUeOQcAbT2SVwMPrp2PLHFXIu/9x9I1NQiDwxvEmvaOODADNe9U
+K97qYQnHEfJ0Dc+JLLAgJSh2d032RgwTcgr3ROkCgYAOmHcPI7bK4qnk5PnoEasD
+yWTr/ZyZGbl0GILA7d9bgVVYgU2cL5SSEio0rapTz/bbnOpdGhaDJ3sLRNKGPnJ1
+rfyu+2YmgOQDz9Z+BxfbnXKPi+282Ld8Ua/lJhfVE+404BeILQAlwc2vXJrvWUR8
+dS7YIPTBwOmeu7PFL9fu3wKBgFA2lXa/zgX6fvu9NnL19cRNxyctGKDWhXDo7grK
+IY403LJXJF+s/vJ6nP8GilizW58k/ZaZPyO34xQQ529k1RFYLZAqMnVKPUGeIhsb
+1Dgucum6HZK53X87NaF5EUwmZHOHqbDD3wpkEm7BBUEOmu/FT7EV5TX2GC5Ta9si
+pxs5AoGBAOWvUI81Vw1NYWPB6kLOGwO6WM/E+D+Jwa/b6zpZclHrTL0LnnAAY+jR
+3iEOf5Wd8+sFVNlVvVx1wLzIDwcEHwwEcpJXBJdIddfGw5JN7jXYIsBnJ1pwJPsl
+FnyoEL4WvRkvMRrlHxgn5/j1ItPjEux9JtRu4Qo3294J722p7Nxn
+-----END RSA PRIVATE KEY-----
--- a/testdata/mitm/com/s/sl/slack.com.crt
+++ b/testdata/mitm/com/s/sl/slack.com.crt
@@ -0,0 +1,43 @@
+-----BEGIN CERTIFICATE-----
+MIICjjCCAjSgAwIBAgIRAMT5rdv0ldFHfsATNOnECxEwCgYIKoZIzj0EAwIwNzEQ
+MA4GA1UEChMHbWF6ZS5pbzEjMCEGA1UEAxMaU3R5eCBDZXJ0aWZpY2F0ZSBBdXRo
+b3JpdHkwHhcNMjUwOTI1MDg0MDAyWhcNMjUwOTI3MDg0MDAyWjAUMRIwEAYDVQQD
+EwlzbGFjay5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDEYfl4
+NIOKag6XH5F9KUeHK3ExmLZ8e21xr7wWiICycZLLLBziwWobdfzzTmACXoazj/TH
+EPqoNEdx1PjdPtVPCoM7uOOwXlmjod9xazp9BMXNIJ6RgVwaLe2KPB/0BuFMfVwc
+stXGuoz79eF2DA24AvZztxtCeR2Y73fMJGRc11chZPvO5PAT2j8WkozqnM0iwahl
+hpvxAqpFo2Xih2eHXh2DT/a/MDnuGw8HmAs6MVP6lHmLx6Jndm7Cby2FkWC/JzVg
+i6gjA0ApGIdYw8zfs4/AvI00Zq70AGY017iDmpnljHandMqvvfAERefvoL5gPaFg
+CW1HjxWXigwE+fYpAgMBAAGjeTB3MA4GA1UdDwEB/wQEAwIDiDATBgNVHSUEDDAK
+BggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMB8GA1UdIwQYMBaAFKHEYd+Lckg0ywh2
+6MypID6hLse2MCEGA1UdEQQaMBiCCXNsYWNrLmNvbYILKi5zbGFjay5jb20wCgYI
+KoZIzj0EAwIDSAAwRQIhALIhivfStLCVYkqR4AFTpAg+5C1bJSDGgPUvjbYXvT+m
+AiB3WrLfjJmbwGHua15RvlSkn+hgMqmGYy9HdjbRFPBNfQ==
+-----END CERTIFICATE-----
+-----BEGIN RSA PRIVATE KEY-----
+MIIEowIBAAKCAQEAxGH5eDSDimoOlx+RfSlHhytxMZi2fHttca+8FoiAsnGSyywc
+4sFqG3X8805gAl6Gs4/0xxD6qDRHcdT43T7VTwqDO7jjsF5Zo6HfcWs6fQTFzSCe
+kYFcGi3tijwf9AbhTH1cHLLVxrqM+/XhdgwNuAL2c7cbQnkdmO93zCRkXNdXIWT7
+zuTwE9o/FpKM6pzNIsGoZYab8QKqRaNl4odnh14dg0/2vzA57hsPB5gLOjFT+pR5
+i8eiZ3Zuwm8thZFgvyc1YIuoIwNAKRiHWMPM37OPwLyNNGau9ABmNNe4g5qZ5Yx2
+p3TKr73wBEXn76C+YD2hYAltR48Vl4oMBPn2KQIDAQABAoIBAFpSj5mEWa3LSsui
+FtngpwfZ6LV9fg0x/avovlME1GB+URxGPUDj4Ygg08caGJluXXjv8I6wVgEQDn4i
+DJZBxH0WojZROtPPCV5z4J+7SErg65MFejkFLNXTounN7opfsbbq/3cpn55IBfkK
+5XhUYejs3+pn4M9Jgl3pYgmQAWMbT5W6XTtckSy/GDcfYXuINwBT6n9KZabOAtdt
+DADy6vWULNXLcA/vZG27GCR2MBlfF2P81kKIo5ZbMs3295vlUxDU3mQGWw6a96PF
+cRHmVRHupOUw8OeJUniyQnW4/odBSP5mFqXPRJK8SLWT3SlALfR+kfOmEHMYyW9M
+71qt9wMCgYEA5/9eDWi76v5sKYAPUde2REnwHl04ejw3LTfAuwxS4BP82r8QWUEG
+lwLCN+ESrxaQi2UMf4sPbEmWM+fLNM6dGuGjxFB508QQSYY3Cw0TtJ5N+wJ8Y/61
+MHpYTxQUIgudw5tZzuSYzG/Y41LfdTa8HmDWpl27xj9rpqJWghN9PR8CgYEA2LNS
+RMeEYO/fKQw7sGwXnYKRkktbt3ljpuU/Vb/u2EqQ0oGpP3091Xogc8lHH20wQN+5
+WB+MzGZ1dXm93bVHAw/1R6KGYv55BNsR2r5J9DwDwYcyOjeW77dj4+pXYF3BHuhY
+XSJVgwqu343MBJ49OfPw1b+WJMCOtl7SPv3fG7cCgYEAwSSgB6fXMufH4rEDkA53
+ZtjreEwBtfolsZaF9PNol7bsPqzsjnINa3FXgi/2Xx/5DKP+yLxcBbopu2LRkVAm
+CXgq4EhjdIL5UEzVzHSBoFBe+YdzSciGzio9FPDRZhqnqG7QUOeNsj23omGfObVs
+3hme+nh02LJ6DAuA2+Af1t8CgYA45hzb4mdn7JPz+zpRAJDS0s3WU+MpMb5wvBD9
+OwBD2pBcNZ9zBDeQLhkHTfpWzhy1bAkGkoItyVleFzE7XbXfn/kPbiVLKPYtyDfP
+79cLQhbaYd1WW/JNzyFzXrzCmNt0eh15luJNHij8mgbPz5zT8rFx7nRGAil2yT77
+Oz2x0QKBgBRwfMROEop1tuH6ukXd60MRCm628poHvYMev1v8xJOrsJ0Uuy1mwcvS
+K0VxwZKh9w/M2+nEb0m4BiTcCzuGY0x0nb+nTQT48H9vAysi7FENMzytT/WEduka
+sqmDXRHqJtN9G+t/SM/NjxKczfNtD8kPwljSc8ORJ55ol0UxczYv
+-----END RSA PRIVATE KEY-----
--- a/testdata/mitm/com/s/sp/spotify.com.crt
+++ b/testdata/mitm/com/s/sp/spotify.com.crt
@@ -0,0 +1,43 @@
+-----BEGIN CERTIFICATE-----
+MIICmzCCAkGgAwIBAgIQAt89Ir21/UnpT4XBaUsDQDAKBggqhkjOPQQDAjA3MRAw
+DgYDVQQKEwdtYXplLmlvMSMwIQYDVQQDExpTdHl4IENlcnRpZmljYXRlIEF1dGhv
+cml0eTAeFw0yNTA5MjUxNDAzMzlaFw0yNTA5MjcxNDAzMzlaMBYxFDASBgNVBAMT
+C3Nwb3RpZnkuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwyrh
+oGkVupeImrnVEQi8HOoGohXSWCVgtJSCnXXYwG3SwT6KU3AgJ4SFZ9JRGKXTqonM
+WaIyXaM4K3q+0aUWd25j5VUqMQU5J0r0BnfX/DKIBsoQ/PLvA/9FQ4C3sjt3RJSB
+t+THoz3eFuKLdjcg0l77p8G/quHdRA02mLOI6KQRFAXEUjQ6+i3qFta37TA5tiiy
+4TSNrFT47E7DLiat8JHIqAtEXr0u3MW740CJkGE89PGYV+sQJ5E97eoKs+TPNXv8
+haMyolstPcyvpztCAMbcHRzcTuRdVGhiogbZOoZ4ex1Am79OQ2soyfNQ4IjDabVM
+saUGX/5tSjT6w33xOwIDAQABo4GEMIGBMA4GA1UdDwEB/wQEAwIDiDATBgNVHSUE
+DDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMB8GA1UdIwQYMBaAFKHEYd+Lckg0
+ywh26MypID6hLse2MCsGA1UdEQQkMCKCC3Nwb3RpZnkuY29tgg0qLnNwb3RpZnku
+Y29thwQjuuAcMAoGCCqGSM49BAMCA0gAMEUCIFVpCL9V8ggx74pPYLAlCs+aqcpa
+vvZ4h4hheMOQeJraAiEA99haFSIRvYrSOZuq+vKEhZUafa/ZsFquPPyf00Q7ioU=
+-----END CERTIFICATE-----
+-----BEGIN RSA PRIVATE KEY-----
+MIIEowIBAAKCAQEAwyrhoGkVupeImrnVEQi8HOoGohXSWCVgtJSCnXXYwG3SwT6K
+U3AgJ4SFZ9JRGKXTqonMWaIyXaM4K3q+0aUWd25j5VUqMQU5J0r0BnfX/DKIBsoQ
+/PLvA/9FQ4C3sjt3RJSBt+THoz3eFuKLdjcg0l77p8G/quHdRA02mLOI6KQRFAXE
+UjQ6+i3qFta37TA5tiiy4TSNrFT47E7DLiat8JHIqAtEXr0u3MW740CJkGE89PGY
+V+sQJ5E97eoKs+TPNXv8haMyolstPcyvpztCAMbcHRzcTuRdVGhiogbZOoZ4ex1A
+m79OQ2soyfNQ4IjDabVMsaUGX/5tSjT6w33xOwIDAQABAoIBAAYj/UFczRA34FZt
+7mRA0BpgyqCi6yFW27oSyiFGKfG0AuONojCJ4JkdtEzV8zNBVG2TNFjFn6wOjJ/h
+lstl1FUhpgb7LP6p2WiBFTh24NbQiDMefHZY9mg7yeQb0qvK7y+7NHGiwx1BvxEd
+Q6IOjfvQfT6D/BHWVW3ktIkNbQtUwBVaPyidssxkxQ9+nJATbSCb8j9WOg6MPAkU
+RQXvKhq8JUPpQvxypzihHU9ICKTsXgTAqkm6DnUGrDYyw+018/igUvPCqVvDUhc7
+LDSNozgB6F/qGiAogRK8FeOrF7JceanW/1627gOI8ODZlSlBdM/9JKYxDuD5Xmcq
+FSacygECgYEA7YEIQnE7MInwVWmXn/syX0ZSu9O1j4jLw7JFmPud3zDXd+oEvyoV
+chYvgqMIoPXw/rYyHWzDj19zCggAuW6SrwvQTm5W7FReeRyG3hjZ70IH2btUgVRg
+plo9XoNbKhh58MjtGO7XUySyBjGKAvXoBCDfAQshap8ReCJUYkrolrsCgYEA0l3Q
+ASajsocjVBXSlALgpwioK8gpJ8Hqt+tJNtXk7E83Niq3ct4K2eqMjCKA6zc9ePQs
+G4WORwqF1uy+GOi4CAFosM/VsgPom/niUbbffT+5QDs8jlhLcgsoNRDkYD2W1OEJ
+BXIFcELbWX8G+aNJ1TQ7xaZNWHWowHMNf82Cp4ECgYB3PF5vLPWwSrAT0W1D7hK9
+7ko+7eyq4NybpPZ39Wqu0JB8LUqwxmn52tWDWmJMnOyek83ZI++SHTNeB+KFNdQC
+eYXculx9TWYYm4/CFOvkyFu0ne2w+DGFkqxYtM2h9qPRlK4j5FTJ8xRFM727+sS+
+vdn3ZiUiqDVXALUom77lXQKBgQCTSSWCOMhyDZXZoHHQOXeK20/LX5gZAvdQkAax
+wu5F2WyhmyTX4sicLFD9KIc0qHd8wRBEsKyd5qswgI7UJ9P5nurqqIlI2t24nysq
+5SvyqHQOmarbSsx/63naNZqAG38ISwqi6mMOZ3DmZz699+qQwMJ8ruQGZFKjc6pm
+6b9pgQKBgFvzrtvHabSgDomfZ7DQR9jfvHAJmBpZRvf8RdzHzTZCXTyu/uby2OVo
+SVadv+FhJUk8IJSZibpUPIEUO6ZikSzHFXP7AxSI8gubR32NFDYs3KpWcOB2tH0i
+4NB/I/A5w1jM7GSbGjNejG9YTDD7vmiDOjJH8ei5JanBZ5ZhPPKR
+-----END RSA PRIVATE KEY-----
--- a/testdata/mitm/com/s/sp/spotify/wg.spotify.com.crt
+++ b/testdata/mitm/com/s/sp/spotify/wg.spotify.com.crt
@@ -0,0 +1,44 @@
+-----BEGIN CERTIFICATE-----
+MIICpTCCAkugAwIBAgIRAI/nPfdFZPOss7tjjStOGAEwCgYIKoZIzj0EAwIwNzEQ
+MA4GA1UEChMHbWF6ZS5pbzEjMCEGA1UEAxMaU3R5eCBDZXJ0aWZpY2F0ZSBBdXRo
+b3JpdHkwHhcNMjUwOTI1MTQ0MjA5WhcNMjUwOTI3MTQ0MjA5WjAZMRcwFQYDVQQD
+Ew53Zy5zcG90aWZ5LmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
+AL9e4MowXsgJASIECxG7qr/d0hAr+7SXITtOM4xZCtR/rxgNQCDYPCK2GiYvwTdc
+y1AuqpyhGHL529ZDuUX4wKG2lzFQpMphCqzRHlpwf4/XG9CbAXFInRk0aR6c/Edv
+ZJfi3NdeYedP0ur4aHPtZMTZcnOGbQ7tRHgxNfC3F1JCnjQNuBgBhYhUVV5e4FQ1
+ePE0QJV5NCrwHW7h1+2EDtsqGlYssUKpzyHiB8MhhxIN/d/57Qf+U5X4O3YdGYIL
+xONzqQ6wVcqNBe5CbxrwdXAyqE0NqMdWBZ4julJrUgaq7WaOQtaTAWqMbXmdTfus
+bfuRKwmjETwwJigQ3eRK+Q8CAwEAAaOBijCBhzAOBgNVHQ8BAf8EBAMCA4gwEwYD
+VR0lBAwwCgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADAfBgNVHSMEGDAWgBShxGHf
+i3JINMsIdujMqSA+oS7HtjAxBgNVHREEKjAogg53Zy5zcG90aWZ5LmNvbYIQKi53
+Zy5zcG90aWZ5LmNvbYcECipCxDAKBggqhkjOPQQDAgNIADBFAiAgafB4KqflFjXc
+rZnk6jxLUwQSxGCwTcDu9zsoEtVIBgIhALjccOU8Zob3LhMUJSgY0VVmYhU9KUo1
+kDGeMv6zy3Vb
+-----END CERTIFICATE-----
+-----BEGIN RSA PRIVATE KEY-----
+MIIEowIBAAKCAQEAv17gyjBeyAkBIgQLEbuqv93SECv7tJchO04zjFkK1H+vGA1A
+INg8IrYaJi/BN1zLUC6qnKEYcvnb1kO5RfjAobaXMVCkymEKrNEeWnB/j9cb0JsB
+cUidGTRpHpz8R29kl+Lc115h50/S6vhoc+1kxNlyc4ZtDu1EeDE18LcXUkKeNA24
+GAGFiFRVXl7gVDV48TRAlXk0KvAdbuHX7YQO2yoaViyxQqnPIeIHwyGHEg393/nt
+B/5Tlfg7dh0ZggvE43OpDrBVyo0F7kJvGvB1cDKoTQ2ox1YFniO6UmtSBqrtZo5C
+1pMBaoxteZ1N+6xt+5ErCaMRPDAmKBDd5Er5DwIDAQABAoIBABepnCL0Ayw5zM2P
+cWzyZwUNYQWF4rwsObwzCbWvZuLqnNRdAxJsmlbybF5PZlU5oJwcARWX58WDtpaS
+TizkOrFkOeKrpYyunhrLSrUFFwjKoNJU8EM5Js+whtT1tU4B7I7JSuRIc9Odr6dF
+Kuk2r9CVUI0PUJnZZa906kYG5ZfSlS5rpy8YHScqOjwses6MpFgg/v3ctKU/dLLB
+EAxED9SKdU+2uDoHLMSzEYw2PjNVOau/CgR0dryby/9UNbEgx8wMykmia2/IcgUc
+xFu02bngyJoiqqzNHX85ZlsE960YojJbBDJIX842hdxEdjwB6oDSKz/hr2/aib8B
+P0jMmIUCgYEA4DUmGDH+w+oX6R73Z1ZgScbYqJA12MZxPuPCD90hMyMmNbuGjxGK
+lUU169OlbFECsC8HacxOuYHE5KZ7+QNBRiHyRzgcxIGqpRIZg9tF9DYPRzBeVnxq
+kv+EpcxHsA8IWJFYq9gvnQ6gBZATYU/8vXpu428yzg81nikzFnY+jQ0CgYEA2oG6
+wv0UK82skzf5NC9Oa06E4Tzjno6ejpxhayzcvAOCX5VjVe47BFmvJl4XrbbfxUPf
+K6F1NxHMbVjzP3GuddImuGaUKl6jfIAkIj/9u/K1whmQiq8iR+G1cbyTmhFHBUQ+
+IW5HLkbfYsJ/to3KxpMf8115DH8lN4fRkBrL4sCgYADohjZ74V3W0XD61KLBCVP
+TL+aC6wztROEt2Afra+qCnnGCSHnE5uxS4vSJH3bwXxPqpNuLXdhHi84nVII+PqH
+zmkEqm4c6RUA08hCEL2TdYTN3ITK1f1MIIPfw+2tdrDl7oUHU9uBqgkBzhHiU89+
+qos9eEHUgP6Xb4d6Z7QfyQKBgQDFZFSXOZEzUQYJqJMTtXieL7ySzTLDVguewV6w
+N0LhBjqMpqOqSSA/edVkT7QMVhwoVHwTKjR9nzKRxb1ZHxV/km0wQFqxO/Vsz0XV
+OwG4/DV+NyIAZt4NGbWUHcspb1o9Q72vPP5RGFfhPe21sOQNqCBbg/xwPUf0JAUU
+rbUmqQKBgDvhthK0yR7ND80nSyIcdG1tpPcReh+flOHLyt3OakfmPcQxXNeLpnqb
+Wv7JoFjj2fEo2Ty2XmOj+Yh8vbd8A8TX/BsXFiaLDnYjpUQlT9XK4eKxdVr2ntKk
+6XO2lULdhIyxvwz+K/P/sb2eQyKBOnc0uKHgg4qjFfG0chkiAgAc
+-----END RSA PRIVATE KEY-----
--- a/testdata/mitm/com/w/wo/wordfeud.com.crt
+++ b/testdata/mitm/com/w/wo/wordfeud.com.crt
@@ -0,0 +1,44 @@
+-----BEGIN CERTIFICATE-----
+MIICnzCCAkWgAwIBAgIRAPNkz3uSANzxy/gStn5VfBAwCgYIKoZIzj0EAwIwNzEQ
+MA4GA1UEChMHbWF6ZS5pbzEjMCEGA1UEAxMaU3R5eCBDZXJ0aWZpY2F0ZSBBdXRo
+b3JpdHkwHhcNMjUwOTI1MTM1OTU5WhcNMjUwOTI3MTM1OTU5WjAXMRUwEwYDVQQD
+Ewx3b3JkZmV1ZC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCv
+MkG/bu7skwlCGQSgYUE6sjE9Vo0u3ofQMPMnGLrUWYQcFUtWQzkro3fWR2Un8cnN
+V9oD37tMeXX4wRCk1ssEEWNDN3HstJ6vDaNi+PpuA0occF1OVTkxi7syAm17BKkG
+LSKyp8EZVty5MlrVNpRn1NM9TQtS1/6w8Lm/l1tmH+Eitt193vgJRaJncXuFfVds
+EunK7KaM/Ypwak+TXLEfHVGVgSZj0K/nb4QM+RraC/WsS8fkp8d35zAGeQyJV4ZX
+SvQpHOeh/xjg8C9GJFMahbMHg5P51E+FdXPY9pHL0OlL9N3tgvfh2ouTc5lph71o
+D4OXbf1Bz5pbFSzisuM7AgMBAAGjgYYwgYMwDgYDVR0PAQH/BAQDAgOIMBMGA1Ud
+JQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwHwYDVR0jBBgwFoAUocRh34ty
+SDTLCHbozKkgPqEux7YwLQYDVR0RBCYwJIIMd29yZGZldWQuY29tgg4qLndvcmRm
+ZXVkLmNvbYcEDfil0TAKBggqhkjOPQQDAgNIADBFAiBDLVa3S6iDEoByCPotgAOo
+iWLfNZDNy8dZYRmlCeN2SgIhANfGqXGOj49BXhOauOgrer5VxOMRhq0c5RvuSmqT
+Qfer
+-----END CERTIFICATE-----
+-----BEGIN RSA PRIVATE KEY-----
+MIIEpAIBAAKCAQEArzJBv27u7JMJQhkEoGFBOrIxPVaNLt6H0DDzJxi61FmEHBVL
+VkM5K6N31kdlJ/HJzVfaA9+7THl1+MEQpNbLBBFjQzdx7LSerw2jYvj6bgNKHHBd
+TlU5MYu7MgJtewSpBi0isqfBGVbcuTJa1TaUZ9TTPU0LUtf+sPC5v5dbZh/hIrbd
+fd74CUWiZ3F7hX1XbBLpyuymjP2KcGpPk1yxHx1RlYEmY9Cv52+EDPka2gv1rEvH
+5KfHd+cwBnkMiVeGV0r0KRznof8Y4PAvRiRTGoWzB4OT+dRPhXVz2PaRy9DpS/Td
+7YL34dqLk3OZaYe9aA+Dl239Qc+aWxUs4rLjOwIDAQABAoIBAFHs7/brkrm5RmaM
+2W+AGycuBb2XuDy3Hg56nXHmbBN56r/RK2Ii3FyuPA9NYp3LwOEP2GjgWi84SzTw
+X26d7OCxmtfnWRRmICBfAcz5/e2tBx6GYvOLAcxL+dU4cmbI9ptnRucBcFh/mIbX
+58b1l294g/GSEh4C2Fx4rXvM9RYrQyFRTBkKJbo3ss1r6MYfBz39wIkhGsTPcRzv
+ZrHNwdXUhqoVb6FlcMB5em4AhIog9X5IdpVkj2CfXt5Gnos89d6mc6k2csDZZV8U
+3bDkoE+UYQDaVDCGZdGEwYK3mFz4E3Yk+n+uBaN3PuKE55cOy2Jhmeay6XMLJ6eO
+VQCDsM0CgYEA1jDO//lQvB0KV/DfHpjJD1r41/MBpssACRkkqk0nLvOugQxdN3L8
+4CWHE/lO+lHT9MALd68S8izRdwk565DesEc9vE9ot7I//BJT+tMJV7eKTOu0zBtK
+nEj6D10Cx9JKgJ2/vhTwYjUxXL4D53Qcwl22nnHcJenTluJSWS9d7j8CgYEA0WTi
+tkZ3rptMAocOJA4SvfLc5Nlpe0/7fiNwiN3493U4CanDbxx9VjWB86RKSgJgsh6r
+BQ0wDWN0Ho9pv7oDo2HXKUbTl4LRaJwFPt9WMmu3z7wCVCbn+Quvermh4Cot8IH/
+geZtKL0p8CXxdGdDFv9c3WArd0F+A73PSAFLxAUCgYEAhob9XFRw2tW6i2VkHcmE
+brqKlMex/9p8WTqLhtMSizDOJ4tmeM8l+HpZjrgFXL9MSurbyP4S/jwcC5Gl6UiC
+NWFpav7NHKM+AMpaKK2nroo+uPVKBvAVOnezZzbZ6jswQ/vQVEi+elBCgqdtuE97
+SLCnZHjK9p0YIipf4lgXvO0CgYEAyX/F0xX4sePrvzrr1rJcQsHk46x8HxgWsYm1
+D2Bb5vW8GUBuOww1aLJQ/X6JprKnDoEInfHU3e1onsfvQXrlaWILxULM9y4CCiKp
+wZj1v8t8tMD9lLFj5XrjQLxGFAtC7gCLOhvdy6hNJTW+Jv//xa+zU6zp5vb1JvCO
+YGVwWkCgYBB5F4NzHD6nmj1luya181kOfusWq7y+Ut67wJH0UtPe52bc++PUwOD
+NrZkE2v6RyB0qZC9j4vFaV68j7md44q8RcFJOzxyKT8qpxx/KbGQ/abtC9iBkM6s
+MayTJ02lIvAbkrbQO+yO4EwwJgQuOEDaLoRwIhyLtD+xMAjqUFLASQ==
+-----END RSA PRIVATE KEY-----
--- a/testdata/mitm/com/x/xi/ximmio.com.crt
+++ b/testdata/mitm/com/x/xi/ximmio.com.crt
@@ -0,0 +1,43 @@
+-----BEGIN CERTIFICATE-----
+MIICmDCCAj6gAwIBAgIRAPJzccaKCexuyBYa5eL5mOYwCgYIKoZIzj0EAwIwNzEQ
+MA4GA1UEChMHbWF6ZS5pbzEjMCEGA1UEAxMaU3R5eCBDZXJ0aWZpY2F0ZSBBdXRo
+b3JpdHkwHhcNMjUwOTI1MDc1NTAwWhcNMjUwOTI3MDc1NTAwWjAVMRMwEQYDVQQD
+Ewp4aW1taW8uY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyEMR
+JL5+dhl6fYilzU9aybKPmYJv3cWX4JcWVF9+q5B1E9TzwpNi+E9+uM9HriZrvyt/
+iBuK4w/e/94dp+R7wp9WISzgEtSQzQvGgZW8TNRdcKFd4ZPGsIlLejxGrqE0QMtZ
+F5Cxamq8a4Ke40Pq7vVm3WI8ek1vouaEAP2jFmeGdk09ZGi/52ecCfpCSPDM4+vt
+ZjIxQyFXd+N+ma4OLAjqF0qDuqHsa9bWeyq6ACt6aEK+MAsnkpYnmkHYdEljhrxM
+887L609XP8iTtX1rSwvvGyzI94tRR9m/0SsCavS6vvXK4OWASXcTjDE/eyOE2Pox
+aRatDd3sDqbcU5pm1QIDAQABo4GBMH8wDgYDVR0PAQH/BAQDAgOIMBMGA1UdJQQM
+MAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwHwYDVR0jBBgwFoAUocRh34tySDTL
+CHbozKkgPqEux7YwKQYDVR0RBCIwIIIKeGltbWlvLmNvbYIMKi54aW1taW8uY29t
+hwQKKirXMAoGCCqGSM49BAMCA0gAMEUCIC/irkPRCKs4zCgUEDJej7SLZS/ySZ/Y
+yZXbfRFXqYiLAiEA5fHsexhJ/Mw2PBgL43RQ6IhhDNzLY0j1EVcDguycV5Y=
+-----END CERTIFICATE-----
+-----BEGIN RSA PRIVATE KEY-----
+MIIEowIBAAKCAQEAyEMRJL5+dhl6fYilzU9aybKPmYJv3cWX4JcWVF9+q5B1E9Tz
+wpNi+E9+uM9HriZrvyt/iBuK4w/e/94dp+R7wp9WISzgEtSQzQvGgZW8TNRdcKFd
+4ZPGsIlLejxGrqE0QMtZF5Cxamq8a4Ke40Pq7vVm3WI8ek1vouaEAP2jFmeGdk09
+ZGi/52ecCfpCSPDM4+vtZjIxQyFXd+N+ma4OLAjqF0qDuqHsa9bWeyq6ACt6aEK+
+MAsnkpYnmkHYdEljhrxM887L609XP8iTtX1rSwvvGyzI94tRR9m/0SsCavS6vvXK
+4OWASXcTjDE/eyOE2PoxaRatDd3sDqbcU5pm1QIDAQABAoIBACyhg8nWWY089udQ
+w7DawV9HuAisgP1iKsu/KFcT9EFMn8cUc+H2on04DEQoT++QOP2hNloxVzXtBNQt
+3pqbCXjxtUqN+38+1+mWuP4Kzq0pvAxcrjVWj5aq9oMOuWr0Wtag6yFdGikfEhB8
+yyfXrF1mnC71FIjmRp29tYgZ/tWARdbLLciRFnXTcsdN4BhIqJmsEpZQbefARBO9
+XpAGPrvmYzpoW8krjjDUyc2lnT2IUXSPhZv7LUdjSPy4Wbc/MEjgAvDOBXaOt8Y5
+E2GpVl0KrZMmcsNX+vfj0PXo7wuPHI19sSF//d6sqoZlYoGgmjIPDYz5UO7PtuhM
+OMkp6KkCgYEAyLAHClPVjT3qKj33CfSobtuIVBpksk0ucq22sK/aCvy5q971J08y
+pUH9OtsE/AiHdYtUUJ50civXsbX8jl3So/Gksy1OMFFs/LiMe9JJVRF8UA0ZXFnn
+eoMO0YCYialCkKPjsgVjYJv8xAjS68UswkC5Rui8vwTqvNWrOI2BGq0CgYEA/3UC
+JNHJGTAF0qzFkuGnXzbmMwNM8lFzoXQ3rL2JGtS+XljNI7WeGJCMKBdBhT8M6n2p
+cRiVa4/YMD8nHOIN7PAKb75hDcyUMGKCQgBmcmK/4pu+nqfWLka46Bso0DNfBYUe
+tvNjHIPzUxwL3e+DVkBDD6rqFcjkyCucmcNp6ckCgYAyGP8o7NSadaJG+UD6E0EY
+q2TU2eHZQLsflY3NfZiItZ4D8ZxxO6wA5QA5+QK9h8OI7EcX+PZIqfkmO6/YOkOi
+WeL8vtZxHnYfJlVL6FuwvatZRe3nhnS03SXh+qMMtyTDtaAUigErevjY/CDOq15
+sH6P3PmBFdEjYpNjgq9/4QKBgD7rhQGook2P5H9FisxoxB7RmNWLxJISudZUl7n2
+XSS8rb7zRGO9Qhlu0Pa2865sHzRKi0eN9I+vuGH5zBpzG1b2sLthOup5Ly7TtJ2p
+F5Ko+/ZGwia11C1Fwhl5Rw4w+QCVD0GkpQ7K+U3JJKsfaUv/PAVJ5apD9wXOqB2/
+YgDxAoGBAIhDcXUZSCT2q5pqaKChAcj21eYhg7PqoFDYCnH2hrSDLr1L8EhVnjn0
+UOJwxwzftnfMPPxgzrCv30AuN3l5RiST+Nxu12Rmt/WXK6I1Nr5coKY7RSxFFNE+
+YTd3tF9EhDzq+D+AO1lkmczWO4PzzZbQRQ9W8OK4McHqVFglDzV7
+-----END RSA PRIVATE KEY-----
--- a/testdata/mitm/dev/a/am/amazon/eu-west-1.mdcs.mshop.amazon.dev.crt
+++ b/testdata/mitm/dev/a/am/amazon/eu-west-1.mdcs.mshop.amazon.dev.crt
@@ -0,0 +1,45 @@
+-----BEGIN CERTIFICATE-----
+MIIC2DCCAn2gAwIBAgIQXc+0ve1KPX8OXnDcIPr2QTAKBggqhkjOPQQDAjA3MRAw
+DgYDVQQKEwdtYXplLmlvMSMwIQYDVQQDExpTdHl4IENlcnRpZmljYXRlIEF1dGhv
+cml0eTAeFw0yNTA5MjUxNjExMjdaFw0yNTA5MjcxNjExMjdaMCoxKDAmBgNVBAMT
+H2V1LXdlc3QtMS5tZGNzLm1zaG9wLmFtYXpvbi5kZXYwggEiMA0GCSqGSIb3DQEB
+AQUAA4IBDwAwggEKAoIBAQCooTNc017kVZPn0iLf1O9+hoiRFIR/cN0On8F3RGLM
+RfZjwWKTuC+NI0GdDAEHTsEzu3+uuHCz08EwZz9/B0B8uBXkjWevrTpTSOc5nxF3
+2I4eMj6n7yNw+ychDbZu2q1b8MA9Mu4oBqv2i8W/KuIycRqise8/hbNC0GEyA25g
+uy65vEgk5feG7DKU3oqjVx/1zV+uL0jQz/QD4r2z++5cPj4bIa3VTlCmHgN8zlO3
+hChvVQp1AklMDOHwgtWToUCVFf1S7L4fcrSYy8/bDyk/U994rfbR/x7S8zT2bqWt
+1y7AILxnWA3m+xA+bADgk3dwFwAlg1LZHWfUm65kdDX3AgMBAAGjgawwgakwDgYD
+VR0PAQH/BAQDAgOIMBMGA1UdJQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAw
+HwYDVR0jBBgwFoAUocRh34tySDTLCHbozKkgPqEux7YwUwYDVR0RBEwwSoIfZXUt
+d2VzdC0xLm1kY3MubXNob3AuYW1hem9uLmRldoIhKi5ldS13ZXN0LTEubWRjcy5t
+c2hvcC5hbWF6b24uZGV2hwQKKkJDMAoGCCqGSM49BAMCA0kAMEYCIQDBvhUq1wz6
+1EVytYB7yTSzmljWvdgEdBMMkMHx6gBwsQIhAK6Zx0V5w5aZ3wAOhZfIb0db+wvk
+RbaMHKkxSm+U94Bt
+-----END CERTIFICATE-----
+-----BEGIN RSA PRIVATE KEY-----
+MIIEpAIBAAKCAQEAqKEzXNNe5FWT59Ii39TvfoaIkRSEf3DdDp/Bd0RizEX2Y8Fi
+k7gvjSNBnQwBB07BM7t/rrhws9PBMGc/fwdAfLgV5I1nr606U0jnOZ8Rd9iOHjI+
+p+8jcPsnIQ22btqtW/DAPTLuKAar9ovFvyriMnEaorHvP4WzQtBhMgNuYLsuubxI
+JOX3huwylN6Ko1cf9c1fri9I0M/0A+K9s/vuXD4+GyGt1U5Qph4DfM5Tt4Qob1UK
+dQJJTAzh8ILVk6FAlRX9Uuy+H3K0mMvP2w8pP1PfeK320f8e0vM09m6lrdcuwCC8
+Z1gN5vsQPmwA4JN3cBcAJYNS2R1n1JuuZHQ19wIDAQABAoIBABlcJN1Q7HRqalPy
+xkvjOiFNGjy3WTXRQ21vmSjWoAUYgHWAH9MXYA9ZvgRgScdPkL628/zSwCBLOEKP
+RH1WGdyn0qMMoQtKgfsEe8GuqnHbn4PrCoE29Z2IJ9pQtZ72RBwPmNmbTzW1yybI
+3nRhfqMXX2oYWGK1OMBTlkpvOapSPbY9v5ZL7qIXk55R5QlCarqAU9IU6hOnrgxA
+UuVIUoTmgn/OUgSJY8s8mYPcmjeqRMzxXXqlFPlb++EitCZPF3h6KpEsPDUfArkt
+fzpsQJkZ7wt0p5K0KtThlWrshE8ORQcIg5IUKm/V56QbZnylkxBui+fmoINbjG/V
+CZZdzAECgYEAz5MXwOWBfjE3DUSZXGeMVbs4cXDcAEyKTJpKyp/48mlybLV9Y7Te
+jdyGHbI+GmBAvdIH0Xl+ffWrtLoi3w+YGE1nTU6P3V4EVnqg4bo4O+prKubeI1Pr
+v/BHKR9y3AnJMYG8v4XtrSj/0i/auClfjjEKKBaC8i2o7JwEzNXsMgMCgYEAz/g3
+FAaS5DD5kaDAGz4XkcoWOJEL5wwfYD7UpaJEBz3ITRPAFhq819yzM+i9/PhkwUjH
+Ijqd/Gq35c6D+0TIYkPmS/t1dylzkQWkemPdtKxS4iTVJmsRxbcg+TqsblPHpj+z
+gS1EPBEW5HI6kTvgYttEoJ5P84b8Yf2JwNhQQ/0CgYBh4CPVKuKyVBZ3RR9jONgt
+HIhyxRqXcX/MuvwFKwVBmIMBy1oCh6hhD9iVbBRob3ZXiw9wsG76ibqbDyGeOEYp
+P2Y0R5UCdnBpLo1polsdtV0u74lS8yE4cd28AD4yjtK1a01KqaX2flySCUqCh8+s
+xmbZnDPGac07NB33T+99bQKBgQDKP4Ogz/vOOuqZ+xCX7bySJUuS20wN97YTrUaz
+hahOuoCupIRrerkn3BPSaYdKGm4xogs2eHbn4QjSThIALBYLqiiuv+6uYftnj2sz
+MyeK6wL3tgYsBHgWJU/F0I+cA5HnVY/GEjWHjL8MjyHx158RxFdrNEpgdGfBDAYJ
+KtR0KQKBgQCXZUuzEQQWS9VwwkgHwAM+jv0KyStBDQzzro6uzNl+l+emsToREXZF
+tIwZyGraeTRtFo5UKpD5b0DAVVbywMIUIKQNmE2+68lEK4Cm8fcvD3LdGDKLmpcf
+ZspYCLbtzA7Y7uzQtwh6jFyWhFqGCQxAUpko6FTlmvBml4zQwogjoA==
+-----END RSA PRIVATE KEY-----
--- a/testdata/mitm/games/m/ma/madout.games.crt
+++ b/testdata/mitm/games/m/ma/madout.games.crt
@@ -0,0 +1,44 @@
+-----BEGIN CERTIFICATE-----
+MIICnzCCAkWgAwIBAgIRAJl/wVAzjHcfbp9gdc5v4lYwCgYIKoZIzj0EAwIwNzEQ
+MA4GA1UEChMHbWF6ZS5pbzEjMCEGA1UEAxMaU3R5eCBDZXJ0aWZpY2F0ZSBBdXRo
+b3JpdHkwHhcNMjUwOTI1MTUzNzI0WhcNMjUwOTI3MTUzNzI0WjAXMRUwEwYDVQQD
+EwxtYWRvdXQuZ2FtZXMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDb
+mTt2dQJl+eUcXHmoDP3VO5ND7oh0CdDsx2D9wdABJTYPNBVPzuNcUmJAWTDweIhU
+7nxWmcV2hVGHFlAE6dIpiV/A21DYdDFyhp6cuxWcXDNBPspxLZSF8XC8HxDQlJK1
+7fVTIX9fehdBDx17Kr78+fqjYWIq/kxO+iYE8E4ujC6EZNSuq6ZwecOz0+ZzPeuI
+bC8b7gNmo0W/92NWUPAMX/yLjrviQtOe/GpVTI1bfmqZPioFunF2TtMs9FD7/j3U
+cBVAvrNKs8Tebr7ZyGc+F+bCrQXSnS1+IFxmZ21gLLCVpRnwq+Gxv6aINDxnkK/b
+rhqECrsHtmqwJaO9Oxy3AgMBAAGjgYYwgYMwDgYDVR0PAQH/BAQDAgOIMBMGA1Ud
+JQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwHwYDVR0jBBgwFoAUocRh34ty
+SDTLCHbozKkgPqEux7YwLQYDVR0RBCYwJIIMbWFkb3V0LmdhbWVzgg4qLm1hZG91
+dC5nYW1lc4cECipCxDAKBggqhkjOPQQDAgNIADBFAiBvANSc0OVCXIGhdlO/tZZY
+oHH8Uc5YLd1oBRBFlu7a6wIhANGmOtRBPcUO3ZKCA7lEcvBP8ofcgJQeAjG9jxDJ
+K+9x
+-----END CERTIFICATE-----
+-----BEGIN RSA PRIVATE KEY-----
+MIIEogIBAAKCAQEA25k7dnUCZfnlHFx5qAz91TuTQ+6IdAnQ7Mdg/cHQASU2DzQV
+T87jXFJiQFkw8HiIVO58VpnFdoVRhxZQBOnSKYlfwNtQ2HQxcoaenLsVnFwzQT7K
+cS2UhfFwvB8Q0JSSte31UyF/X3oXQQ8deyq+/Pn6o2FiKv5MTvomBPBOLowuhGTU
+rqumcHnDs9Pmcz3riGwvG+4DZqNFv/djVlDwDF/8i4674kLTnvxqVUyNW35qmT4q
+Bbpxdk7TLPRQ+/491HAVQL6zSrPE3m6+2chnPhfmwq0F0p0tfiBcZmdtYCywlaUZ
+8Kvhsb+miDQ8Z5Cv264ahAq7B7ZqsCWjvTsctwIDAQABAoIBAArLz8aVHhcRYBgy
+27BNYzVWhnjygzbhPKpHaxdOrgFAaRX6Q4n26+qgCkCLogJQirNSPj6rtK+NAmMX
+z7tOG4z7Of/rSGA75ipxP98Iu5lCVyrAAYfq68BiDF7TUCpRA516I3OA1BhHklka
+eyKRCW66g34Azai7c9j2J2RaxB05o8WhW4K+Nw1C5dIcEI3EXiEKn/M8wI+EbQKt
+fJG6DOZTGDCQe+YzDmtbe0AEAA0m+aYuhowEScFDcpP25lA/GRFmwc6rxA7OMuSY
+EAl3DUWuW8tzNDE5gm18q6R55LIZzmYY9CGDD7JD5BWLC26YdZVHptbe1srzv565
+QhjybdECgYEA5zLkSjORsz6jB+GIbcUFh5xBSqA49NhlG5c8nXJxzGP4MflKWtft
+WcJnU39vgOyTH5B8eWWl7GBq1J5Trgc52btNTW9hkPj+312RHp5261PIVtCBq3Tf
+7gpDY04POOk1AG5d+WiJmQiKQGXfMsztwl2l7D6BaMLYSjTm5VrI5J0CgYEA8yfH
+UrJDmZzJngaVoOXDwq2oMRZtZ9caXlocPj7gXFunUD1bYkHgJzJmeyVgdbKIOuSD
+BcGzw2myvuHHEfEACSnVxfTVhy4XSMHxHxPSngWsFo5LzG1+qnoh2WGjRmv2iTqO
+nggeX8GN4ffQbmFHiqwtCa5w4FlS4OGDAjjFRGMCgYBklV98aLMaqEWFSDlyiCS/
+utss/EfLPdm/Byz30rJvmY6BL1OJ8ibwxgLt8KMyE7puIQ4GQpLNI6VWmwsMy1f/
+wdz/s1VfHPTFeI+KIqbZ+rlOC6heT5qclRp8OZmlyM+mQF3iA/jY+z4qhid0knNd
+/CATh54FVb+DiUBqx/RegQKBgALqjTdur+TdvoVIqu69ErX5AzVjgXhnWgebqQ8O
+Df7NkpohwkDRbXDK5/O+JQQEWiHqr6+X/SHw2JX1ez+51jhF6ixvnUf7w4e527x1
+rmb6xm+W0U3oWkaNJG7I/v5POSu4KhG3IzYeyibVpAhO3l7JZdjh4LSwHZBY5AtY
+xvTlAoGAcubka3fx9JLg6OxrZTDWgwYAlOSebCePE6jOLIgYcdYzXkUgNI8ztcOQ
+mGE4Xu4PXpAldUWERAcCZ/IC+klrwt4k10HwuU18P7fONtWyQutKnObApwuZfzd/
+rTahmLn+hHCWdCqCkSoz+0dXRr03vD9xaZnAryArMJRoNCulkw=
+-----END RSA PRIVATE KEY-----
--- a/testdata/mitm/localhost.crt
+++ b/testdata/mitm/localhost.crt
@@ -0,0 +1,44 @@
+-----BEGIN CERTIFICATE-----
+MIICojCCAkigAwIBAgIRAM0akc6YBOaedWr7TY51xacwCgYIKoZIzj0EAwIwNzEQ
+MA4GA1UEChMHbWF6ZS5pbzEjMCEGA1UEAxMaU3R5eCBDZXJ0aWZpY2F0ZSBBdXRo
+b3JpdHkwHhcNMjUwOTI1MDc0MzQxWhcNMjUwOTI3MDc0MzQxWjAUMRIwEAYDVQQD
+Ewlsb2NhbGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC4JBMZ
+YEXiHXzvmhNIfdxMRzWs/6Fsdr1Z9lKKh2u4zjXW80rWU3tQwNFNJSKTosEbi/f7
+DL+QX7JImW+uuJl0alnckNkLrAzwXUVLlBoh0YRTdXiQtvtupbCPNK8pr2XJ3F8S
+vYCJUEePri15Tx396Q8bpDy3/3NaNS9pi1h28duXIIxPefSXWkHJvUP0KgrwUMiS
+9N7WxzVpw6OEiPeh0PM6XygfWkMqGDLz5u3/bbFxxhjJVu0hDo786OOQR4voT/Jj
+etOO/1+EFAH2zvmP+R3PJ2WHiftVsgCEXUcDr+kN4Ofxv3kAVSKK5CZSvdbioGwB
+XwcmynDeMcVz/eoJAgMBAAGjgYwwgYkwDgYDVR0PAQH/BAQDAgOIMBMGA1UdJQQM
+MAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwHwYDVR0jBBgwFoAUocRh34tySDTL
+CHbozKkgPqEux7YwMwYDVR0RBCwwKoIJbG9jYWxob3N0ggsqLmxvY2FsaG9zdIcQ
+AAAAAAAAAAAAAAAAAAAAADAKBggqhkjOPQQDAgNIADBFAiBkf/nXO9SZd3FuNwiQ
+dKoHia/t+F6WVb1u5ByzkCsPgAIhAOdmyvL5iWO2f4bO72NeTooG3ssiFRBNuZqG
+CCupTnQ8
+-----END CERTIFICATE-----
+-----BEGIN RSA PRIVATE KEY-----
+MIIEowIBAAKCAQEAuCQTGWBF4h1875oTSH3cTEc1rP+hbHa9WfZSiodruM411vNK
+1lN7UMDRTSUik6LBG4v3+wy/kF+ySJlvrriZdGpZ3JDZC6wM8F1FS5QaIdGEU3V4
+kLb7bqWwjzSvKa9lydxfEr2AiVBHj64teU8d/ekPG6Q8t/9zWjUvaYtYdvHblyCM
+T3n0l1pByb1D9CoK8FDIkvTe1sc1acOjhIj3odDzOl8oH1pDKhgy8+bt/22xccYY
+yVbtIQ6O/OjjkEeL6E/yY3rTjv9fhBQB9s75j/kdzydlh4n7VbIAhF1HA6/pDeDn
+8b95AFUiiuQmUr3W4qBsAV8HJspw3jHFc/3qCQIDAQABAoIBACpWbwa/Xin8TjC3
+2/WnrIpkOAjn+Jk73tLrofREaSXjUbkzlJIdPSXmw2jJoD7SJbS79J8GAhiDjDYJ
+g0Zonq3H0xP1wNWgcBQm2cskCPMcHWDkCj25uKsq0OLIQfrjX1OvhbOFGyPXL7Dv
+Ivj4kiSCXK0mEKjchMzpnBZYCdXE5wssBbkoAuHBfiakTN3HfGndu0i5nS1gaZH4
+z7cVe38ojTTwUyvxi3BYpTljFu3guUE+P/LYkBUJ8oQ5G7KVE+R01XMi15d99RaK
+wDIUdWHwBJlBcHg69wGzyLXqIlwxgCqJjRquAH4aSRi13wT+Hxp9y4i9IMwnlOSq
+mIYz9sUCgYEA8/sutzowTthHhKV5ICMWJ79+63J3blG00y4md586Py3wFgObtKlU
+Y74QoDoHuKGFRZ4cV0oV78fuUp6EwG7zdkGvzDl8tAuIZ8E2vAriEgre7EA0os/Q
+4TrfqYa1Z/crFOJfMCZUfYYcufqNnBNwZE1cp+i8OfSLSmq+n9mvbN0CgYEAwTZA
+8fMFON2RJliU3V+KTv2g3BHvo7NPo8i3heYPZ26mKfWUOROmnYjrJyp0gXEG3j4E
+NmQKfBdhfbPiPxMPqzhtwHDTKnY1Ovib03iqvFWw4VE1UjT7halexn9GRW4Dw1Hy
+GaZAeexZpQ8Ll38+bWdU2S8Hh+eTg6rbRpUhGR0CgYEAzdhFoMdSTKNDK9HkcM3J
+en2hWop34zbCZk4QnGpV3UonvpsKupEGpySLqHNtYkO8SnFMngTenzBCjag6fpTd
+ig9/f8GcydbVHhywzlQsSmarkA3XmunU5MIkREZoNTAfQ/59qwUb0c/d2rde1Ki9
+8ZIns26zp/3/qyiGbh1eWW0CgYBlGDElJ8Y8udn/2WuS5TGmIRkw7QWZfvIVvakh
+G35F3WR+Iev7bWfJl+GKrbEmJXC1ineDyhaeVVGCh0PDQwL40N7ESYSD/DPf9kL6
+hHG5d5DEZExlBinxBuz7KY8oNucrJM5rU0z7PoqtTdD/5OlSLzX7KZtkJexOgXCY
+XuFhlQKBgHS2Pl8ttvWiIC1I0XEuJeMq+ehz3BaiQ6dzrSnu7ou51xN2ELBrcA1A
+q0r0Vvkzkkpfgs57DC/3j9pDBcJaPuML0G/TX63KXRegMpO8oTR7lTchc+ktfxAm
+XtOgeZ+2zktszqTZPejkuRHHYFY7FCtYW3Mv3+rAjWPk/Jwr22FO
+-----END RSA PRIVATE KEY-----
--- a/testdata/mitm/net/m/mo/mozilla/cdn.mozilla.net.crt
+++ b/testdata/mitm/net/m/mo/mozilla/cdn.mozilla.net.crt
@@ -0,0 +1,44 @@
+-----BEGIN CERTIFICATE-----
+MIICozCCAkigAwIBAgIRANtXe0CVRZ92MnXWVLXFYQQwCgYIKoZIzj0EAwIwNzEQ
+MA4GA1UEChMHbWF6ZS5pbzEjMCEGA1UEAxMaU3R5eCBDZXJ0aWZpY2F0ZSBBdXRo
+b3JpdHkwHhcNMjUwOTI1MTgwMDU4WhcNMjUwOTI3MTgwMDU4WjAaMRgwFgYDVQQD
+Ew9jZG4ubW96aWxsYS5uZXQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB
+AQCzoPRNL5oDMGZqtLHF0yhgrFT62uCumy049w8Wpdo0jRQO8xJyj/BwNT14NO+e
+glh+HteVJ5do6gXRNBp0Fl4NnEXNUTLwIFi2P6om/QditZDU5o0/Ous+LPCLXF3m
+pXjkqRxjriLLkxN/AXSzpzbdtlua4MXc2ZIesXEDpiWTxzZrViJxQJmqCcai86B+
+QEWuAeoaFWz6MHwCxL5+8bV4JTSQZE861vTdgezGWaC15vdkrjiF31jUW1JirVff
+3OiSQOimnYcXtl0CdvCaQOtNMoVVsXgqbJxy7A8oVlhIOSKZz10YvzBh7j5DAvTD
+3Tdt+o2k50DxmWMF57V/1S61AgMBAAGjgYYwgYMwDgYDVR0PAQH/BAQDAgOIMBMG
+A1UdJQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwHwYDVR0jBBgwFoAUocRh
+34tySDTLCHbozKkgPqEux7YwLQYDVR0RBCYwJIIPY2RuLm1vemlsbGEubmV0ghEq
+LmNkbi5tb3ppbGxhLm5ldDAKBggqhkjOPQQDAgNJADBGAiEAvMXhZ+Z9DfJk1w05
+cbGHGAKqDQiLYKEq6U06Mz/FQVsCIQDVmxf6OWy2TmJd2JAiq7O8tqEgXGU9svkb
+HrRQieyUaw==
+-----END CERTIFICATE-----
+-----BEGIN RSA PRIVATE KEY-----
+MIIEpQIBAAKCAQEAs6D0TS+aAzBmarSxxdMoYKxU+trgrpstOPcPFqXaNI0UDvMS
+co/wcDU9eDTvnoJYfh7XlSeXaOoF0TQadBZeDZxFzVEy8CBYtj+qJv0HYrWQ1OaN
+PzrrPizwi1xd5qV45KkcY64iy5MTfwF0s6c23bZbmuDF3NmSHrFxA6Ylk8c2a1Yi
+cUCZqgnGovOgfkBFrgHqGhVs+jB8AsS+fvG1eCU0kGRPOtb03YHsxlmgteb3ZK44
+hd9Y1FtSYq1X39zokkDopp2HF7ZdAnbwmkDrTTKFVbF4KmyccuwPKFZYSDkimc9d
+GL8wYe4+QwL0w903bfqNpOdA8ZljBee1f9UutQIDAQABAoIBADdpMMN4qilOrmE/
+QVGVjDCaKJLDnyitnLskV0a0vcWVOXlNGUU2ysRKYB5rMfmzGso5CGat8mJ+QnIh
+AQILflLzgILQCAcT61m49OuXBUa5XKaYQj0dl0C0SzWqNhs2sz7SPfwv1PL4eTyl
+/dKHhADLxqFVsiOpCA6ozQSDpbbaah8dMN1KHJps72V6p0Y57OtFpi2XRCSh1afg
+Tx9UxXxwhIDcZJClJnHwyxrLG7AllEZjnFNrX/OXrYo8OZ4NuxyWPqaadkDJkqtk
+ZJgwR0taX9MTEg3q2mf1ogvn5DASyqohBi3xskgTgLRGfl+QQr6pZMuHOLzVPn3y
+397lFlcCgYEA4fYZQ5B4khA9OfMirH8hatvsc+crOnqxMUNXn2Ug0D0T8MFJxMMi
+HvakK2MlYvzQ9No3So+Y+hHrEVfj5ganYNdqlh/qwGhcIJVqQaGy4BHlqjpp5HHz
+bLwByj9RNpUdV3Ufjv0TLiN4U89xDhkrN64bxLEM+dLRSSEvl2YW9X8CgYEAy4IR
+VFVP7fbW4OCX2k+0cKb1mjjMJsk/ExxL7PdwAEUNVxCD7DS14QzldDMWrgO7A+CR
+TB+FlcljiFEGV7PMZOi6vVCEwsgZGTeXm8xYB8eCIGYTEY79pi20nCalG4VE4BhZ
+xPDHH6GVFqD9RKGbo4OEWm55TuAmq4o5rjn+/csCgYEAtrG/43zfv1kZ58zJcCap
+4jhGib+SmAmzUl1cbyfYzAVWJgZhmpEa+WX5for/I3W9jPsSUVqhGS97m94wCT+/
+/PCu4QqVR1QZiM7FxqLyeXB+/I+WJnprkrK/z8I566PMwXWVOossAtXy5/CFPBzl
+cHN5SCLOlv747+PBEuwcDAkCgYEAtyszw88hqRKSJ0efBfzVcMulpZDXl1Vtcxr1
+76xqX6PHNQUFaFWtGomMAMF2+VscOYon3PdGOiJQdsJOziNjpbOfWIQfal3F0V+r
+Eqyi0yWsJtMY+KXWAXuD40QZOaMC8hyYt9zrrLm3we1W6C35MvxN5UMn5ml0BNPd
+xMYoj28CgYEAq2c/vj9RtJc8oO4R3aj5tdaqjH7iiVUXSTRFCyS/oJ3sDOTEuhs9
+YhglAYxFL+KRJ7IglJdYvfvW49dM7rNACpHFJV5YZv3gs5J8zKJ84OaVnCLb+jk0
+Rg6HiJjGYML0iiYItdKOCbVUcXnW5pvgcPNTFKIK6rsKEtsCH146Hqw=
+-----END RSA PRIVATE KEY-----
--- a/testdata/mitm/net/t/tw/tweakers.net.crt
+++ b/testdata/mitm/net/t/tw/tweakers.net.crt
@@ -0,0 +1,44 @@
+-----BEGIN CERTIFICATE-----
+MIICnjCCAkWgAwIBAgIRAIudZOWfliCEFup4DgDRZhswCgYIKoZIzj0EAwIwNzEQ
+MA4GA1UEChMHbWF6ZS5pbzEjMCEGA1UEAxMaU3R5eCBDZXJ0aWZpY2F0ZSBBdXRo
+b3JpdHkwHhcNMjUwOTI1MTQwMjM5WhcNMjUwOTI3MTQwMjM5WjAXMRUwEwYDVQQD
+Ewx0d2Vha2Vycy5uZXQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDF
+4tXV8FLCgX6uCtMcJVrT6loFLRK0XJWlZQnEIcFVXKemhk6eT62SsDzHiRtkNC4u
+k3BZ3xxOBageMec8JU6KxG8GMzLU+1tI8lvX6zamSUY43PXODC9Rx17VWA9mvs2v
+q+4UQ3C3Y7n3yMZiCDGrxlc1Py0P7V3ytDzZnZisQZrH8ki+kwqGRKcKBg+ljuwZ
+em3TuXE8maUHcLkCx5DnlAtemaer017r4uLOhemAkOadBkU+eDZQbrcnXw8ZoFqZ
+G318kbcwn8tKMqhV2Cq4qnposZpDAODHTQAQ0qfCTJRaK4bYRg98Bdrr9kSexnT7
+ugiWqZT/oAyxWAp04EEfAgMBAAGjgYYwgYMwDgYDVR0PAQH/BAQDAgOIMBMGA1Ud
+JQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwHwYDVR0jBBgwFoAUocRh34ty
+SDTLCHbozKkgPqEux7YwLQYDVR0RBCYwJIIMdHdlYWtlcnMubmV0gg4qLnR3ZWFr
+ZXJzLm5ldIcEAhL0TzAKBggqhkjOPQQDAgNHADBEAiBWIxhinvGdvwem+U0QB8k9
+5p/B/tvdTpsWELueHa97LQIgaZdOBt+f3RCE0dJut1cy+5lEgzPZpS0jquhKsoSz
+4KA=
+-----END CERTIFICATE-----
+-----BEGIN RSA PRIVATE KEY-----
+MIIEpQIBAAKCAQEAxeLV1fBSwoF+rgrTHCVa0+paBS0StFyVpWUJxCHBVVynpoZO
+nk+tkrA8x4kbZDQuLpNwWd8cTgWoHjHnPCVOisRvBjMy1PtbSPJb1+s2pklGONz1
+zgwvUcde1VgPZr7Nr6vuFENwt2O598jGYggxq8ZXNT8tD+1d8rQ82Z2YrEGax/JI
+vpMKhkSnCgYPpY7sGXpt07lxPJmlB3C5AseQ55QLXpmnq9Ne6+LizoXpgJDmnQZF
+Png2UG63J18PGaBamRt9fJG3MJ/LSjKoVdgquKp6aLGaQwDgx00AENKnwkyUWiuG
+2EYPfAXa6/ZEnsZ0+7oIlqmU/6AMsVgKdOBBHwIDAQABAoIBADbWGi2z8CsoWWN/
+amsFSvsomROQHvvOIEX6Ds/EDuBJ0ceKtmSWbeIVZnJg4y9ManPLtbmh4yUX2jOr
+3olDSVWZA68zJuXwVaaMSrk13CoOaiA90vvrUn2WAwiZ44K0YylIOqxw195qC1HH
+2Hm4DZOtXeNKg4FDZOJp4eboDjPFaY93m2c0eVL769WSYtyw0Xu6XxNfGF/5LH6x
+VOqgvQVJZeY9XWLtnE2GXqN/PcC8M2OJM8jKlHkdu/XrA20K1ZbNuMcMz9sZISFX
+6Ma/DNjcJ3FMzMq4vPZER9mBTLpSKhxz8uhTd1KKQ/TpEi4z4h/BGlUwKH2E/hVO
+QGiErkECgYEA3nHz9zF5spRdEa8aD7vBEIY0CN8jmjD0FUT6w83KN8Vh2sGYUJZH
+sCsdUdFDRioZtWrW9cSmBOd75F2PzfgVzRrCkr0+qU220Ogw/12lr0Iol3GaC5hL
+P8ypQwGAixRPbiuofktpgxkrQ40CClR/5hkxhQmsX5hUupxAQncMN/8CgYEA47x/
+iin2a4EBU1YDaEB4wcHvbIdWe0AecYZ4VN0s8RNVM7vQz/uNacdYXHupfnoH4yZA
+SrKGUugbXOEGu2LUtB9AGX5OAlfICDuQ1TVDnWTCo9YW6/Ke2pqgm4c00STOhvFn
+fAWeLYwXRKb8ImSw3dtI3lqd3enNtyz7K4qs9uECgYEAyN1naqC/ftVgETbntqtZ
+E/3LgPNVp8dqsMYgFq1+W8wdp7bHPoXlaBwWlqn7MKGVo289eqI/NBB/nGAsGdZa
+gWIXrv+6VJE7cvsoO4Apu89m7hIEA1JbKNo7QalalLwbWaWMubaJKXuRyKbM390b
+vQCk6bgpcg0Q/Y1YrWvomasCgYEArcRotK2sHv9CWaop02ROP9mQrIjfzg9wq0Ll
+kitpXVFZE65deDUDBBFdNMQO4jiOyB2ptNVfdOcx6b6x+k1A62dk647aSyNbuBxr
+OKP5waDee1CiEMsBtt+BaOrTvDmPdJvCUHmg5jQclP+tJzkZU0883JzcFDWQCBLE
+W8bmj0ECgYEAwGoeTnrqn77AIy45BG+omKeY4XvdSRPc2wCtJlINodZ8kOLnq5RZ
+UE67qYXEHh/qIFGcVrIzlzBkIL4IaEZ59xXkFlNzYS7zc9gouyV0fgIJb2RU1/8T
+PhFoBYKLVBPUryPbuutbmPQuxjJGiqRNxNUauzQ6kwlex2QJU9tadao=
+-----END RSA PRIVATE KEY-----
--- a/testdata/mitm/net/u/un/unix.net.crt
+++ b/testdata/mitm/net/u/un/unix.net.crt
@@ -0,0 +1,43 @@
+-----BEGIN CERTIFICATE-----
+MIICjDCCAjGgAwIBAgIRAOJDY7chUJ0+wuGTXkXMXoUwCgYIKoZIzj0EAwIwNzEQ
+MA4GA1UEChMHbWF6ZS5pbzEjMCEGA1UEAxMaU3R5eCBDZXJ0aWZpY2F0ZSBBdXRo
+b3JpdHkwHhcNMjUwOTI1MTczMjUxWhcNMjUwOTI3MTczMjUxWjATMREwDwYDVQQD
+Ewh1bml4Lm5ldDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL7DqRMb
+rNH+tEt53DOSMG21afkVVTtOafc5SW/9Jz54XpMdF9jLmHfxSMQ5+JawvlfPZY6q
+f0oOIt1+NF+1OAVYc2hoLSTUCx3jnUS2iU2c4/3PlrRQgAA7KDT66gjKAHP9Cr4V
+NwZ6HmUn5FbJh4AnuP4JCrwZfEblREtP/kGmFpKiuJ9g0Zn7SuKpYQCUr3gA0vLY
+zABlPbLNQ3o4CkFqEvzz0eTW/NL3lGr7771dYj6JVqqNo2nUdC5FNfr0NzYYHP4C
+IO+uaCsrj8rk7PVJNRqMr6JgkAJCkMDZyY0wp2NDZedTXefCYhgeAZf/eWGzXFUE
+PvPYe0RCqS6hYW0CAwEAAaN3MHUwDgYDVR0PAQH/BAQDAgOIMBMGA1UdJQQMMAoG
+CCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwHwYDVR0jBBgwFoAUocRh34tySDTLCHbo
+zKkgPqEux7YwHwYDVR0RBBgwFoIIdW5peC5uZXSCCioudW5peC5uZXQwCgYIKoZI
+zj0EAwIDSQAwRgIhAODAtKN3Qxajhj6Bc3j99oUO7US/2VAYnNAO36b0JKOBAiEA
+jdxlyszgY6UudrWWUTx5KspUtvCzYtf6p64fc2B52nI=
+-----END CERTIFICATE-----
+-----BEGIN RSA PRIVATE KEY-----
+MIIEogIBAAKCAQEAvsOpExus0f60S3ncM5IwbbVp+RVVO05p9zlJb/0nPnhekx0X
+2MuYd/FIxDn4lrC+V89ljqp/Sg4i3X40X7U4BVhzaGgtJNQLHeOdRLaJTZzj/c+W
+tFCAADsoNPrqCMoAc/0KvhU3BnoeZSfkVsmHgCe4/gkKvBl8RuVES0/+QaYWkqK4
+n2DRmftK4qlhAJSveADS8tjMAGU9ss1DejgKQWoS/PPR5Nb80veUavvvvV1iPolW
+qo2jadR0LkU1+vQ3Nhgc/gIg765oKyuPyuTs9Uk1GoyvomCQAkKQwNnJjTCnY0Nl
+51Nd58JiGB4Bl/95YbNcVQQ+89h7REKpLqFhbQIDAQABAoIBACLd60jBTbCiL7z9
+3HgWl8BtoJ10vzvURLz5nQkZibM61/pmnmWzLL57fPPUrrGIQ3oUP7k4Q4S7GbdH
+KnZ1znP3qzxhkiLBmPiREj0taeIkM23AJAj4D7U7Gsm4NM9/cF7C2NROV1zZNDYD
+RG9ywTq/b5805f2xobEv9tOFyhTTDI1XTLQ6dag8pUGWDfu8HBAJj9GTglYQL+I
+1jM5gceJBP5EQZZoEH4Hl6nIbwd5xCSrxmkHHT3l9Hx+XECS9PMd4q5rmYEbx31F
+pFjznk8+f6e1uA1R0234fjw03uO4iivAvb2IRe2Uei+g66s4tvb//ER1FZkU4nl1
+r2tsdYcCgYEAwxCMHqmndhO0HqRY5Vmt5XMOIvZp+KDI72/psciO6Ujt6Mx8DpEh
+urUi8nAEpuamC14mbyhR7VFZULqEEoPyf7zmD+Ol8FNOzAndQBimYfSundC96wYS
+9dDT3GnaY9lFcFIRiapQHXh/+9aVKPNXyo2qJln2hxxxzPeEwBjKuL8CgYEA+ls2
+RrExjFjbcdR70cjLJc5wEybrKL0+gPAdZU3GpJY+dCEIPQC6vgQ5v5qkWGN2n6B5
+63o1KnQC7641iKkxiQKLNQz5uMPXPwNJYfIVAygU1AAp7E66DBuy+34NUZ9JOHM3
+tKGAdUzqzVm22l8KGGOJbJjaqP7KFD7pNkQ/5NMCgYA9Vna5LZ/7ATcia4uIkyqb
+fBJ17AZmqCiHIinaPbaypLwq+CIKcpionUzf71mHIgAUkwaC7arVdT8go4XkTJl0
+kXHGjU8gwxGEF5X7EcVACDDgb0NJJB/SLFhydta1jxzGtQfOwj9vBPU5u8AroFl6
+2BEo/iEHW2ptiWe1ABa/AQKBgHWHSE2bdXU7aZlgdNgg+S1AYmC7Tn4LiUIidspN
+3sj5N0xxDVsF8qSteya1xB0yZEe/oDypXDgXyiEWmU8UjoqRRSSceMcCORP9yP9Q
+FAktUcnMYeHre2+fuUBTBpGgw1Da1fXYM2PdvgS07yBIqYaVg7gVceEP63Hhrr2p
+AI29AoGAQyIJlWm8H2pwLaZnOesB2bIkhRxEPChu7HOcjGhs5lRfNPFBfWQNL67a
+vJbWJeDcCyeb0XqlFA6tWy2o46eW5Ga5VGn1JQrwW0iqGKb/Wz9P0TMXQ59Q4wjX
+cGUL2kYmbHlPswFy1/CVCCf3THsAPovbRxPyVCzdn9L4jKoo2Fc=
+-----END RSA PRIVATE KEY-----
--- a/testdata/mitm/nl/a/am/amazon.nl.crt
+++ b/testdata/mitm/nl/a/am/amazon.nl.crt
@@ -0,0 +1,43 @@
+-----BEGIN CERTIFICATE-----
+MIIClDCCAjqgAwIBAgIRAIm79HUefwwzp7wdMXQ7HBIwCgYIKoZIzj0EAwIwNzEQ
+MA4GA1UEChMHbWF6ZS5pbzEjMCEGA1UEAxMaU3R5eCBDZXJ0aWZpY2F0ZSBBdXRo
+b3JpdHkwHhcNMjUwOTI1MTYxMTI3WhcNMjUwOTI3MTYxMTI3WjAUMRIwEAYDVQQD
+EwlhbWF6b24ubmwwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCq2ccJ
+e7ANcrsmf5RQucE39rQGTW7BQPBvLhAmcejUs4xlT/tbfqX2CguL6Y/vKACSM2br
+3kPEAVGju5JbWvLf8FLo4d1jxAtxNeYzr0tDqEQt6BCp6YxCdhpr5W8WHzSgnqP9
+8wk/P2oVjcfml1Z8ci/lsp04973sIc9txz1kG4VX+SjD1DtU1O7KH6NHmGx1EyIc
+NqqS5vOP2RMA3temuY84r4qfN0uJv1J0d/r+EO7JCFt2UIm/2owY/kBo91v1oskx
+CGfNDiPvMI65bImhl1lW4aFfSvTWPmdXH3pzgSPkHrlI/cSfnzNY4Uaofg+eFw73
+mZQSzb94z5VE97FrAgMBAAGjfzB9MA4GA1UdDwEB/wQEAwIDiDATBgNVHSUEDDAK
+BggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMB8GA1UdIwQYMBaAFKHEYd+Lckg0ywh2
+6MypID6hLse2MCcGA1UdEQQgMB6CCWFtYXpvbi5ubIILKi5hbWF6b24ubmyHBAoq
+QkMwCgYIKoZIzj0EAwIDSAAwRQIhAKS8C/ZEwQ4fSBUwRv6sx7jB07jD2TQDH3g9
+MxXt/VEqAiAwqUrPgYZ33Sc2ajn9bA9fggBKxKYXH4GhhV9NdJ1VAg==
+-----END CERTIFICATE-----
+-----BEGIN RSA PRIVATE KEY-----
+MIIEowIBAAKCAQEAqtnHCXuwDXK7Jn+UULnBN/a0Bk1uwUDwby4QJnHo1LOMZU/7
+W36l9goLi+mP7ygAkjNm695DxAFRo7uSW1ry3/BS6OHdY8QLcTXmM69LQ6hELegQ
+qemMQnYaa+VvFh80oJ6j/fMJPz9qFY3H5pdWfHIv5bKdOPe97CHPbcc9ZBuFV/ko
+w9Q7VNTuyh+jR5hsdRMiHDaqkubzj9kTAN7XprmPOK+KnzdLib9SdHf6/hDuyQhb
+dlCJv9qMGP5AaPdb9aLJMQhnzQ4j7zCOuWyJoZdZVuGhX0r01j5nVx96c4Ej5B65
+SP3En58zWOFGqH4PnhcO95mUEs2/eM+VRPexawIDAQABAoIBAB4f2w/pfq/IWIZf
+vWOEdTSsa66mzY4GqL45xYA52n9Sj0E32o6V5KZevA1157qX943PwWh6XsF7KA1y
+H8q63RMuOTg1xwb1xLy377iSQneR/j+H6RREiUYYs+ztXeptIyblAe5fgXRk9owJ
+XUNj0MyNh7N9DGrEh/jQN1ZYaJMzW0yRemDWyKW6taXF7+nyl0vOkfAYRXTymIDx
+BAVThK7uLwNx0zNZjDnJgnZxnBnnxu/o9SUTQrhF2v5eFth5TEgGiV0ih7Ar5IqX
+Kh/cnnp7hTGmT9op0kWolsgGcbjZVuMQo8KgzGET+itoeUc6jkAK5RN4k5LQEbI0
+yMDvlyUCgYEAzrCJdtiLonHjEKwNd7907YeDNhAUyy5dt4PEub7wx4FGzESa82iT
+BIEjbfKQOKnHVJIz8vuLkazYXFmYtw8X5hVNk0RJL/4QqsiT1PxCymOOEdiDNs/d
+Gdl/PyMWOF9VVxkTFcq2cxrpDKoIHG8jCA7DH/gQgpCPNmSuMg0+SGUCgYEA05xl
+wpgPBPbacUwxkbKCCyGr13lKkXvGP2RAdUCnvDHshVn+AGKtosbcpKCnRJgafAOi
+X0jyf/zuMp9qYi51g7zNTHDDw3OXmsq/DF9hR4rSZmfcOn9w8oPmZJ1UMxAgay9Y
+zgMI6/H9NFUWoH/gE1f2QMKkU+3D7JljCqytrY8CgYA1qJMnbXRiydo/G8urSOMc
+P1ALGwWq8fCWkfjil/V+dcthgHYRtxZj1vrRsmVKsJj1Fbey3ycOvKa24vPIonx7
+2Q/4qYOul/DPxZ7LbmoQjOP3MhRuiGxIJ7TnOT6th+Jp6DKSN7xCCbxy8zmD2D5p
+xshE4+Fte3YGy82A0YmGQKBgHywhoHAifEZ6COkivzYG6qlf5VrIhZRwcJut1Cf
+9XZ+UGlPWs0tWDU3SqIzC/zuR4TVu2K8IDBsgIsRxmTuDU6//JTTSXcs8KNEXojS
+1waJ9WpkPq+1kn9EW4jj785a7U9bSc+ymBo3sESa8sdGMmoThcYpKx1NWApdY6/R
+ilFfAoGBAI6vChoaznNLtdShoN2ZT/Uz76OcM7qF2hS3qx2ZafyVCJzoAw50EaA4
+YM5+a4kjFZOCKXF2dSSBWNes/ySI/ipSSeXd5uiCLSJoC8C4BpEovYsRZWVH9ycL
+hwZ6L2OIkyG/lSs6UcSYu9mOESG7JTD9Qd+0goQ+hd0fv3Gg5H5
+-----END RSA PRIVATE KEY-----
--- a/testdata/mitm/nl/a/am/amazon/transient.amazon.nl.crt
+++ b/testdata/mitm/nl/a/am/amazon/transient.amazon.nl.crt
@@ -0,0 +1,44 @@
+-----BEGIN CERTIFICATE-----
+MIICtTCCAlqgAwIBAgIRALNp1Gc2bW4Zk3gY1cWnqAUwCgYIKoZIzj0EAwIwNzEQ
+MA4GA1UEChMHbWF6ZS5pbzEjMCEGA1UEAxMaU3R5eCBDZXJ0aWZpY2F0ZSBBdXRo
+b3JpdHkwHhcNMjUwOTI1MTYxMTMwWhcNMjUwOTI3MTYxMTMwWjAeMRwwGgYDVQQD
+ExN0cmFuc2llbnQuYW1hem9uLm5sMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
+CgKCAQEAx6vaKJGlVRE0lHql1tlm0K7sI8w5tFdTtO2LXvp/1t0WCYEczRPz68I7
+kacK12nPStPmRZlUSgGoUOO5FIGQbrCkGjBe3rrf8RxC7V/xbY+kD2d2CDQutEMS
+uC0TFpbL+csNw5dgEbRgA5uCt7MoI/PifMkail4XjN79J0aRAPCYBowoFKr/sgj5
+qsyC8PqqebLdpRkHxOvIqPBOBIe07sAZULqUhmjqs1JeGR0DhgPF+wWjYC3IcNkD
+VARU/Og6zs64vijHdvt2LwwN41ZpsbeENA8kLaSNafZMAvW3BnQf42ORSh8SwrAN
+FaP+QFrhVn5zqb46dSnUGrKuGoWHVwIDAQABo4GUMIGRMA4GA1UdDwEB/wQEAwID
+iDATBgNVHSUEDDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMB8GA1UdIwQYMBaA
+FKHEYd+Lckg0ywh26MypID6hLse2MDsGA1UdEQQ0MDKCE3RyYW5zaWVudC5hbWF6
+b24ubmyCFSoudHJhbnNpZW50LmFtYXpvbi5ubIcECipCQzAKBggqhkjOPQQDAgNJ
+ADBGAiEAqfwvNDhTZS7IfVvVo0DKjkYYwjTpS1ky3buqriZ6CbQCIQDOXPwu3x+Z
+kcar68yegklcNTCosDftZweTIIc9zePg0w==
+-----END CERTIFICATE-----
+-----BEGIN RSA PRIVATE KEY-----
+MIIEpAIBAAKCAQEAx6vaKJGlVRE0lHql1tlm0K7sI8w5tFdTtO2LXvp/1t0WCYEc
+zRPz68I7kacK12nPStPmRZlUSgGoUOO5FIGQbrCkGjBe3rrf8RxC7V/xbY+kD2d2
+CDQutEMSuC0TFpbL+csNw5dgEbRgA5uCt7MoI/PifMkail4XjN79J0aRAPCYBowo
+FKr/sgj5qsyC8PqqebLdpRkHxOvIqPBOBIe07sAZULqUhmjqs1JeGR0DhgPF+wWj
+YC3IcNkDVARU/Og6zs64vijHdvt2LwwN41ZpsbeENA8kLaSNafZMAvW3BnQf42OR
+Sh8SwrANFaP+QFrhVn5zqb46dSnUGrKuGoWHVwIDAQABAoIBAAFVmP00eXSUkMT2
+DXB4N0uY3ksRlD1fLaEkytp5x/iHmEgUCS6jRT2qEpr7d2Xo9xVcj/YqBj3AQbaW
+nhd6u8hHiCa0T4j3hGaFyHwlc1al2CdgfFdcYTp+ijLxaJJcydpoNrm0nI6TGp2d
+133+RaCLT2oVrAaesmmJTtDhF5cnv5o8XhD/6SZcwy24w8b1VlYYtNEettPapNuL
+sfFSZWzGK7w6i02untvsokcnouTnLoK9x/ucilJ6Bz8KYB2KJeNPkot0znxqkcD6
+dovtau7PWDAqFTHK9wipUSjXNx6ul3I1pEt8rmuTylCINu/WHRRincQl+UDOhIhx
+bfO4ZXECgYEA1EVkbDVDShOJ26X2URxuZAQnFpMlsGgoZXO+Yqv8pZNFjiZSzeo5
+mrdmZAt4u+WbhlUiya56YqjcTnCa0hNIX5J+8PsOztdBQe0p8AZOfGv8bZFIlrek
+9WyfzDjEsUx7a7XWlKz1Ot9U2N3P8E0KHmPQNYVuRQqh8Q4BzvIuIxkCgYEA8M37
+Yn6sWBZ03UXAMUprSWl/L6HqJ0AdGnvU8mIugRZoj2hmnPGrGLiqRrKoefJlJqi9
+AGSoIVVI1qqVtaogP9q2eMk1ddi+VHPspfocSGPhP/jxAyM9BM99nay/KmTI2WK9
+eUYRdwIlRl3c8uqI9Q7hsQtdHiBdYuWq2IG8O+8CgYAIP+YmOm+yCk5aRfnrrxIv
+OuYV/4QAdhvTzYrBpPN9r9qNKrofHJI+jBAjpTp8+vBvaRGgCvLgsLVXKxMpROyU
+IkpirS8nJMB5gnEVzfjw5vV5gKL0kJCNpToUosQqK9HEHt4HCy3AqvtOLliteyEA
+i1qFKfleH4qppqS1WT4nyQKBgQCOe7L1MrLTZGY9z1nLUJdu1sd07b9Y/iy6UO9N
+hB60LwgrYsDkuHJerFXEg04A6hZD66/5nZWGM6pnqoPu+/0dC1LQ4W2Kj3b/DaDH
+DNjTVJYhfjFNg/pE8GkJdP+gHAZj6nLmYTlQS6q2mi90ZKYpKmcMlQbCHrBjJjYS
+6aDxbQKBgQDHtT4UF+zh6JcEx+BybuhW268riWHwVpIx8boLDGzvu6XSDYb6BJ+G
+DYJwLc3d1XIPgGfWthZNXZgLmL+VW4tymrZz1uhS5T4aYWSbm/FhFGv13J1cPZu1
+7DfdPkTJB16hW+ngKa5Uj+fsJkZxg3SAM63jAlmg/6KnZbq95sjZ0g==
+-----END RSA PRIVATE KEY-----
--- a/testdata/mitm/nl/f/fi/fioretti.nl.crt
+++ b/testdata/mitm/nl/f/fi/fioretti.nl.crt
@@ -0,0 +1,43 @@
+-----BEGIN CERTIFICATE-----
+MIIClDCCAjqgAwIBAgIRAKnVl96uLQy29PdVGK9rmxcwCgYIKoZIzj0EAwIwNzEQ
+MA4GA1UEChMHbWF6ZS5pbzEjMCEGA1UEAxMaU3R5eCBDZXJ0aWZpY2F0ZSBBdXRo
+b3JpdHkwHhcNMjUwOTI1MDg0MDExWhcNMjUwOTI3MDg0MDExWjAWMRQwEgYDVQQD
+EwtmaW9yZXR0aS5ubDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK5d
+5eot/KprvY2TBed/a0YuyMXM5VbPIuCEd7LK0NgDzqxb7rfUk9CkTI/xmKF0MKul
+sMbAX4rT+Wpck8jJRGtKF8fMk8JjDiznFjPfgVPS84UXUFA4yvQf2TKj2DOPnbzT
+xMzKfjb7HRgRj57WQqFy14Ky3+AsU+6YBYOyfo0OIzTqA/Jya07SrgUsY4La25Fx
+vpDjeMn9bglj1ZBvRkt7QYrxsGLeoFbB29MLnenQd/StvMiE/Y1rBtphbozexrx2
+gcMg5lutJPkE/YD3sJ9mSJlWDLqNltJsjhxJHNgI6w9PiT3aImKzCtzGHCEp/L6I
+HPpcSrnYtgKbVjcWvuUCAwEAAaN9MHswDgYDVR0PAQH/BAQDAgOIMBMGA1UdJQQM
+MAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwHwYDVR0jBBgwFoAUocRh34tySDTL
+CHbozKkgPqEux7YwJQYDVR0RBB4wHIILZmlvcmV0dGkubmyCDSouZmlvcmV0dGku
+bmwwCgYIKoZIzj0EAwIDSAAwRQIgAzkVr0s7Pqq9/aLSZRPQeAr3dplyDRsGfsk8
+7IFmEPQCIQCJelbAY41H0ao1b+SNBto39X/7JSm8htSVSQ9akHbBeg==
+-----END CERTIFICATE-----
+-----BEGIN RSA PRIVATE KEY-----
+MIIEowIBAAKCAQEArl3l6i38qmu9jZMF539rRi7IxczlVs8i4IR3ssrQ2APOrFvu
+t9ST0KRMj/GYoXQwq6WwxsBfitP5alyTyMlEa0oXx8yTwmMOLOcWM9+BU9LzhRdQ
+UDjK9B/ZMqPYM4+dvNPEzMp+NvsdGBGPntZCoXLXgrLf4CxT7pgFg7J+jQ4jNOoD
+8nJrTtKuBSxjgtrbkXG+kON4yf1uCWPVkG9GS3tBivGwYt6gVsHb0wud6dB39K28
+yIT9jWsG2mFujN7GvHaBwyDmW60k+QT9gPewn2ZImVYMuo2W0myOHEkc2AjrD0+J
+PdoiYrMK3MYcISn8vogc+lxKudi2AptWNxa+5QIDAQABAoIBABxMvR4Zl000Q1rm
+USpWHIZoMsnNDC6KBofDYtyv3N7Sb167ZQPiX+3tsfIYLMTiOMFYblfeV84ObV1S
+kox0rhgZDxcByxGHm4C02NOpI4eupeYkod0DUAf4i1CUFb5N7DSozON4EgLBFY3B
+0To0XYgaktkcSF2ilCoV86nWSdfWqPvIgschdFq1d4fdqlgGGZ+DVZ06Rklh4UHU
+DQtBxSlcTXT6PxiJKGTdLFGzIqTGt+nMnZa46xxK/jftSOP91clueSVbDF6k2rok
+WiqnLbcxH8MW6xCvnvNdoohFBncWfd3XdbsZwdfk+vlQtaRoxlaYq/LwBQKjQ1PW
+DKoZthkCgYEA0TzmS/8EHduj1FPH5Tc6vX81BBFrPO0NfcumJDl3kIWGrl7Io4t4
+/Ar/m33/tfEDsNDa8rt0fCQI8DJKLdGxc90lLqupaBdlvSNAkSJjqnM9utf8dIvl
+vG5HYbHXLNkUC11RAM2mdwEsPBKS14ZOvaDXM+KNtwL9jyznXvVaJ/8CgYEA1VXs
+OyT9GbuI5+iv9u4erINdSf30wXaIgyAS+9JiGGAdIiLH9ZbXZTjWAaetDhz/PUBv
+Z4ip9xLRNGoKTQHOZ/UNdLG8aeWVTcUSBrMKG3zQJ3p+jweufQyKb87A+WEthbCt
+wYuioYFrp5GFPEx3SJDOfA9JqRIQ51mPkD5TeRsCgYEAqxNv+JL5erAqs2ANAIy3
+qlhnsHvNgnMPpNrtbJDQAYorJEa7JXzT3r/fXfMXMFtu+RLK8cvy4c1UwY9ctznM
+LT+TNyWDzWfT92DrWb8UXjj7L9mIwIHhxL8l/eq6VCDpEqGpqU573LFIyZUmGrHl
+j4YCbpm95PS8/GNqiWlx3WECgYBwNN8pRI0zCaY6g/J5aEkN55Ibps0jLFskzKvv
+c3pQ48yu9ahCjfIAtWIqQK0O7UV6S/fMdt8eqvEKJnQAiOCtYQCQziMRd8WNwAd5
+KpY4Wu+ItC74v8uQzhXKNO7eu7Qbyw+46t7BH7clza5MRtO+gRt5uPi/SldFt5+A
+Kci3QKBgEzIVYYSy0cHY8WoPhRUck1/09XjB8aWvAbfu/8R2kTLkDxGrbyheiOS
+/XuQw0Sr1OHn8anDKq5h7bUeThKEX8N4CnUCBRomXeH+OBXL2lgfgIvpKCxMy1OH
+uKr4v4WjUnZmFggGpBv6olooF/Jvlv9eTAWrPdOE5qMWsYOPH1LJ
+-----END RSA PRIVATE KEY-----
--- a/testdata/mitm/nl/k/kn/knab.nl.crt
+++ b/testdata/mitm/nl/k/kn/knab.nl.crt
@@ -0,0 +1,43 @@
+-----BEGIN CERTIFICATE-----
+MIICjjCCAjOgAwIBAgIQc1szMXTT5fCPCJ9zrh9T/zAKBggqhkjOPQQDAjA3MRAw
+DgYDVQQKEwdtYXplLmlvMSMwIQYDVQQDExpTdHl4IENlcnRpZmljYXRlIEF1dGhv
+cml0eTAeFw0yNTA5MjUxMzUzMDFaFw0yNTA5MjcxMzUzMDFaMBIxEDAOBgNVBAMT
+B2tuYWIubmwwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDAOkK3zmhn
+idguXARrN7eUPoI9JcaX2+ueXT41vwCfnxrzG0EXF51awxUB6TYVsGYQ6J41db/8
+yAGmKI9zgJm2C0rAHU5tfDdFpRt994sZrsfeBjGeDpehWPrSAOrm3rp8kEN4o0Hu
+wKDajx9W0AePwpThSK60IgQCij6+ocwHp8Y2TVwTerdfnmcUSQakbB+Kv8+MepFq
+wBTEqkkNzYpzCeywcsoqZmjIoE/91rE/u/QmXdqJ6l1wx6aOqSqauLBa4AEAv72f
+3U3vFsbKc9Q0dMNO61bX8svgUHlSrkT8PE+EfRGyToSZjfImmTZiyo7rzpre8UaD
+NfGaSPrpNFtHAgMBAAGjezB5MA4GA1UdDwEB/wQEAwIDiDATBgNVHSUEDDAKBggr
+BgEFBQcDATAMBgNVHRMBAf8EAjAAMB8GA1UdIwQYMBaAFKHEYd+Lckg0ywh26Myp
+ID6hLse2MCMGA1UdEQQcMBqCB2tuYWIubmyCCSoua25hYi5ubIcEEu7zJjAKBggq
+hkjOPQQDAgNJADBGAiEAkmTpFZZH/7U2za2bDBqNFImPrjMhNNlf60nt6xhYPRkC
+IQDLhGJsk0VhC8xMGtm6rKCx8wH7DrzAJ6qaIP1bvydbmg==
+-----END CERTIFICATE-----
+-----BEGIN RSA PRIVATE KEY-----
+MIIEowIBAAKCAQEAwDpCt85oZ4nYLlwEaze3lD6CPSXGl9vrnl0+Nb8An58a8xtB
+FxedWsMVAek2FbBmEOieNXW//MgBpiiPc4CZtgtKwB1ObXw3RaUbffeLGa7H3gYx
+ng6XoVj60gDq5t66fJBDeKNB7sCg2o8fVtAHj8KU4UiutCIEAoo+vqHMB6fGNk1c
+E3q3X55nFEkGpGwfir/PjHqRasAUxKpJDc2KcwnssHLKKmZoyKBP/daxP7v0Jl3a
+iepdcMemjqkqmriwWuABAL+9n91N7xbGynPUNHTDTutW1/LL4FB5Uq5E/DxPhH0R
+sk6EmY3yJpk2YsqO686a3vFGgzXxmkj66TRbRwIDAQABAoIBAAiB65b/8x31+1Pd
+7bIjFqRgedoj9FyfNpfdL5YoXGo0G/i7cY+Ik4XDUYgynpqqInJIIUxjaDpTTcNh
+Uyv8+pCUglvrUB/HWhjifEuAa68Yza61XnfM1IgnDH7D3KGYJO/DYMETlKTw8I2L
+vQrWDSefKICp+1VslfnYzXsZZRLHle0Xt8lLsdck9PpR4eYfBHQUncMpIFd0dJL3
+IeoRS0ILviZCgGl48u0XUe5ioYW/6QLbTi6AERJkvEUIyMLIMmq5fnH+a9mSh99h
+Mqan1dtYJRANcngJ6Il/92otzfyF61n9M9BHyBQ6/L6Md+0bu1zBLYcsb7DVI+E4
+MazmkCECgYEAzf/NgRZKZtY1FsGB0INfFV4w27eKyuGthvqDDcHi+B+5Zjxxeqo8
+r27SHP0aVR4fY0OiImMEfQ3axEVnIh//kkfE23ZdCRjeX1LL9WsxVJqpSHADvwbv
+SnhqtHymnAFsiODfpmuKZ6CixP911Jh24AhOmGuzsaNouPL7qmE5CKcCgYEA7uK6
+NNZPxHs4JE0Ntl8bBcCcB2a1eqsSHCk8YXOdfcZcu2jIXgWUywskvKCSAL94wNTv
+yiyc7DeEojqwr5hWmd37Ix1Oo8IkGDu6mOXyW09NfwBmEZLBs1NJ0eLDpAIZ+FaD
+tV9tMFgwrxHCponh9j+j/rZSYP9TW9Z4hwYVzGECgYEAjiTjAx4EfO12eJtSHjVo
+WPBDunjt9oy/FpKp98Y//YK2hctTapcphMxtg79Kek1szywOJrg4kqoKuMBDKBL4
+YVHQjrcf/3T/jLsvLcunoH+QLAHPM/NvDu4Eg0I4HRIGeHTjHoy6VkNLza+Q+P+z
+l2dkBFzdA8iELIrOCYVIu6UCgYAKrwMq58bLf8NEBFovpNM9j56qyhIluU7nCYUU
+yqnpfRyamRYU9mTwK8Bp2ziMZgPNg/hxb0tZWSZKZxuNzt9YpE/eAyqIMl+Q4eL3
+gZk0MjjCDE+ES670CS6M/3pGdH2a2KutSeZFOjx7J+0vq4z6iWAZPSg0BFdDDTV4
+vHHvIQKBgBEs0S4SJ8vRg3ZGGfPl/FXy3sXZDafy+iuMir5kR1gQ7CZ5o61jRYQQ
+bqihYMuPAoOn/DQ1YijxNUFheA3BgQ7JdMElCjCc0SvlKyezyVvjqeAKXDoRmWju
+p+hTgIm180oIuEq+NPD9OqROP7N0naVWhK7jZvuJHqArwWuGTGIT
+-----END RSA PRIVATE KEY-----
--- a/testdata/mitm/nl/n/nu/nu.nl.crt
+++ b/testdata/mitm/nl/n/nu/nu.nl.crt
@@ -0,0 +1,43 @@
+-----BEGIN CERTIFICATE-----
+MIIChzCCAi6gAwIBAgIRAOfyBALss+0NwC3HNB5AyCAwCgYIKoZIzj0EAwIwNzEQ
+MA4GA1UEChMHbWF6ZS5pbzEjMCEGA1UEAxMaU3R5eCBDZXJ0aWZpY2F0ZSBBdXRo
+b3JpdHkwHhcNMjUwOTI1MDc0MzQ3WhcNMjUwOTI3MDc0MzQ3WjAQMQ4wDAYDVQQD
+EwVudS5ubDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAN8F6hi6wXG0
+ct0khfbVhh1sW+odKoZgoDYKL3jUwJg7aWdQTG5XpjYLNY9pTaf3jL46brFBHcod
+bxMxUfGZ6gyEYevA960+ZaZ49m6faHQ2PDlmYxZgs+3OKiYaVxReiWTtP1uvTuQI
+MjaUaEjM0ITJf3XebKRBOY+V5L44OlDyXiP9pMPyDAKyRW+PwGlPAg8qX/3oaerk
+eft7CbBGTPU6PvVuZpn49dC/SyVVO0b82mxow8ZqUFYrTUxW0SYqt2tBxgi0HLFL
+FTcKeCcm4wLfSCCZ6MfG/PqIj7DgolMnwDodHAPX3Ou/bR6dO8z9+J37IM3oK6xJ
+PepOzzzPbm8CAwEAAaN3MHUwDgYDVR0PAQH/BAQDAgOIMBMGA1UdJQQMMAoGCCsG
+AQUFBwMBMAwGA1UdEwEB/wQCMAAwHwYDVR0jBBgwFoAUocRh34tySDTLCHbozKkg
+PqEux7YwHwYDVR0RBBgwFoIFbnUubmyCByoubnUubmyHBAoqKtcwCgYIKoZIzj0E
+AwIDRwAwRAIgdFW7wGUfwGubwHDbWbB9qsH5YcVlIqfaooDcQyw5ytgCIEy1qhfJ
+h+Moy2fm0EAvZi2FQm1baoQU8f/9/BUkpXz4
+-----END CERTIFICATE-----
+-----BEGIN RSA PRIVATE KEY-----
+MIIEowIBAAKCAQEA3wXqGLrBcbRy3SSF9tWGHWxb6h0qhmCgNgoveNTAmDtpZ1BM
+blemNgs1j2lNp/eMvjpusUEdyh1vEzFR8ZnqDIRh68D3rT5lpnj2bp9odDY8OWZj
+FmCz7c4qJhpXFF6JZO0/W69O5AgyNpRoSMzQhMl/dd5spEE5j5Xkvjg6UPJeI/2k
+w/IMArJFb4/AaU8CDypf/ehp6uR5+3sJsEZM9To+9W5mmfj10L9LJVU7RvzabGjD
+xmpQVitNTFbRJiq3a0HGCLQcsUsVNwp4JybjAt9IIJnox8b8+oiPsOCiUyfAOh0c
+A9fc679tHp07zP34nfsgzegrrEk96k7PPM9ubwIDAQABAoIBAAKQbVgacZXulrF/
+NYEYhGG7OLVQ34fK/ZyRcmlHvO0jJbuX20EbheAyMcvz0H5BZN9dCZ/FGWQVAY1t
+cD1AYUYCkaOlxNM7l+yZkG/GKmvHodqhGDuOIhN2XtqwS9cCnT7JUYSq19PcWkNx
+Yl+P50fXjz0aMRKUY2aIuSgMunLqyPVtBm1MJZ/Ay+XcyABQccinsqEBOhYQAwzr
+Lmj5RoEcy7ga3gYmwoZcOb2c5NYchuZKjxCIccKt6ecbSCeX/+PZeb+tA748TMVW
+Zvn6OP8tmv4dZ4nBgqkpz1oYq8PpNYmjNzmnIPGQnHt7zuQW9y7XNbSWPtvovV/h
+76FDAi0CgYEA5PCbalGVZs0h+6VzXa9E2ERjSqb+oGswDRS12omAS2IvGU4k1vUp
+6Q8p1QjZwFIhKod6BayCEhx+kNq4kP7qr0qtdxhebwgFjRF95dXdhm4r6lGB3WFc
+E9TlIrUZKfJw467vUGm9jHOAm3Jnr8eVCVrFJ1I06tsO8d5lVFwfCGUCgYEA+WJG
+P8XqLU/rzInWcaSnbuWfvvmIFCUg77pauz6ppQf8FeOQL1Gk3HifcxvB00oC7Jnc
+yPEiaP3R6R0gy34A2Bqt7Qo8ZQpBSGWz4Ckg8L6f8VrD56wMqLSuodibhRcq5yDA
+cXGNdMHIOyHVRWNmH74Q7SbHqAxPb1a4jVOljEMCgYAL78OaqoBIqN9huIGoW9AS
+Gpa2uLhD8vLBa9gDefHXfFoKTrm6/3Nc9G5w7hI0ZdPW3NNu4kyx1wx+Tvkajj/8
+Pb+HmxypW1i2vze6OQlgzfO6Nt+3hDEB07LSuXCDcGGUbXWK0siQPyFweWmQj65k
+m3f2EeIycJN55uePm3H+xQKBgQC1CMFEVFEeGbFsJveUQdoF6A1iHlTJgvZ48Igi
+2c9VSGLZknp/9O09J+TeSfoUQb0aPFcsaewHem+1xVSg6LrPdrag566HoqrmqDM
+bi7qdQc4txIV4NDDu342IT8si1fqttzcvXjZtD69pl7i4zhkfJ5e+dLgTCdyBLsu
+ZPV9bwKBgFwz47pXK3don6y7eKagAc+OJJaeWu8G/BYt7wWpbsWEk0iXOWj+QxOA
+RKuRh5aLv++aNDpO6zUXwYrjKlZpUOt9LO/WCWieI0sz+kZbdX/l2s1kHiUVu836
+TGjt0J0qu5LXyMq9hzYd1HLZQsFUkNlZfQ2FvdwKzHVjwYJSGmAo
+-----END RSA PRIVATE KEY-----
--- a/testdata/mitm/nl/w/wi/wiscollect.nl.crt
+++ b/testdata/mitm/nl/w/wi/wiscollect.nl.crt
@@ -0,0 +1,44 @@
+-----BEGIN CERTIFICATE-----
+MIICojCCAkigAwIBAgIRAJaawoS7xEn6+stHTo+BDxswCgYIKoZIzj0EAwIwNzEQ
+MA4GA1UEChMHbWF6ZS5pbzEjMCEGA1UEAxMaU3R5eCBDZXJ0aWZpY2F0ZSBBdXRo
+b3JpdHkwHhcNMjUwOTI1MDc0MzQ2WhcNMjUwOTI3MDc0MzQ2WjAYMRYwFAYDVQQD
+Ew13aXNjb2xsZWN0Lm5sMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
+3Znrcc6JLSU1cunSAZ7mHGJfZ0rOSEw4sZg9fVUt29Rk8O5a75vaLwIxo9c4fENm
+lbOyP+uGBNQCjx9UJyGDD2m7mA8uom1OBWx5e8xUWOzej5ndvP47EQkc7/P0YUnG
+27AbqyOOaeST7y2mDcxDIexieYyYly+84Yiygy1Po5edS97hcaPqAu/piYZUKeZL
+Ow18WtNTj6IO/uAefIH5QZrzwQh9ewNtGi3B4xJDspbFLTQqPajix47kpo6vFI4T
+tJhfrQmH1uR51BfDyW/FgrLQFhTW8qgF/0yHUQ8o4wFgVHG4zZSYYD/gVyEHe1Gt
+rTOI+9HNYUtNofTO27OczwIDAQABo4GIMIGFMA4GA1UdDwEB/wQEAwIDiDATBgNV
+HSUEDDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMB8GA1UdIwQYMBaAFKHEYd+L
+ckg0ywh26MypID6hLse2MC8GA1UdEQQoMCaCDXdpc2NvbGxlY3QubmyCDyoud2lz
+Y29sbGVjdC5ubIcECioq1zAKBggqhkjOPQQDAgNIADBFAiEA+eR/UiBy/thlz7oo
+m9UQGaR4fxBQFe7Czqvu5sJ6aF0CIFNvNNYFfwl9yG+RLNa8vCgZ0+nm6B7LQiEs
+Ny2v78aX
+-----END CERTIFICATE-----
+-----BEGIN RSA PRIVATE KEY-----
+MIIEowIBAAKCAQEA3Znrcc6JLSU1cunSAZ7mHGJfZ0rOSEw4sZg9fVUt29Rk8O5a
+75vaLwIxo9c4fENmlbOyP+uGBNQCjx9UJyGDD2m7mA8uom1OBWx5e8xUWOzej5nd
+vP47EQkc7/P0YUnG27AbqyOOaeST7y2mDcxDIexieYyYly+84Yiygy1Po5edS97h
+caPqAu/piYZUKeZLOw18WtNTj6IO/uAefIH5QZrzwQh9ewNtGi3B4xJDspbFLTQq
+Pajix47kpo6vFI4TtJhfrQmH1uR51BfDyW/FgrLQFhTW8qgF/0yHUQ8o4wFgVHG4
+zZSYYD/gVyEHe1GtrTOI+9HNYUtNofTO27OczwIDAQABAoIBAAk7kPowYzm8y6HK
+iSPlJWw4UwZAMSEE//WyRJmUs3Dtw/jfzW0fPrNnsX7EiEdxHXSORJZyLybDWInz
+AbQRqt65BoZa15QP3sjOEK+uPzNnRwyPmhP2OarHiOuca+mjw8PCbhyuwg+6ZMl5
+yunXQVLIAQBUccUWyZVR9zIM8Lz9j8U8GVToa16agM3uZxzMznfyhkwMdj+Vs3gZ
+noTkNt38vEmbOcrIcM2DSmnnNBk+k6p2hLZcK2IdeMOVLUbzHaoBG8hsxGuqvk0f
+DpAwkEtZj6RIKcA5DHXcraoOAL+S8HrGEZ6aWejJdPqLIFLlUuVnHIlvEe0MAFnu
+NQwhPa0CgYEA5W8BgCnw/3HhFhK3Si0sw/w9IzTP2pezXAkE/CzFfExJFpYetEct
+6yzg7svxH0C12BGfoDfcZZ2Y2pHu34oGuWJT2bspIQEJnCsDtMDTJtGJQmnhUKBg
+cnidjtSgGwat8EGt9kYzbAWF/xDbvZ0g3utoBy2+zgU/4j93RakbnQsCgYEA90K+
+GzJwjt8TGb17K6BiB265QuvoWWpRszaiBo8L3/4HiWlmcZZBdY45GIuQJiMnfFzd
+IvMbCI1PEl9yZjHYiNwcImuFGR44D+EcVrvQX+JBykDqiGUMrjU+XhhtepAtvjLf
+GYSd1QILtC2OYjIKkyds6cacUN6DM7NBZMnvcc0CgYEAoeRmRq1RpK4SiaTDONAP
+mmtOKJ2HXVNV+EdVASwGXeLmX82l9MeVGzEbtuSpS8g5iDFHVaKVHg7KYNBAofOf
+Mwiy6hwqtWMqCMxBXTYCyI1qMTbNCjtgUuXRJ4vZPbjE25c8zV5TwpFTL9wRcgaB
+v0qUqRwaWv1RSrBF1R2yomkCgYBBVJ0uSnF7Dm3ZizsUF9hO5m6ExBgsJ+9WTsUY
+vosAr/oF0JeEw5KgIOftGFMKAJfaQB8dsOYfqFaQIC/12I3B+4Zjgc01Ccr+RxhZ
+wl4YN4vyiJxvVWO4U9Eaw5GJpLaxXnecInIhadz1ymOohlhM8UnRqux6YZCBBIfu
+vXxKsQKBgC6w4aME+7CRSrzYI/oXRFYybH3onV/d8KCkNtCXknun8GzXZc/9uNsd
+ArREsxRBbtVFYWwy66XLVbqazT1EGJ4mwWYhvosJFCI/+XUH9enK3rthKLSyl9lU
+ZQVZ1+f+i6U31Fi2zU4Lyk8IXPkr964GhM5vXOhvutnk+T4hbkZJ
+-----END RSA PRIVATE KEY-----
--- a/testdata/mitm/org/m/mo/mozilla.org.crt
+++ b/testdata/mitm/org/m/mo/mozilla.org.crt
@@ -0,0 +1,43 @@
+-----BEGIN CERTIFICATE-----
+MIIClDCCAjmgAwIBAgIQfqXzlgZVr2i2OjnxbAw6TTAKBggqhkjOPQQDAjA3MRAw
+DgYDVQQKEwdtYXplLmlvMSMwIQYDVQQDExpTdHl4IENlcnRpZmljYXRlIEF1dGhv
+cml0eTAeFw0yNTA5MjUxODE4NThaFw0yNTA5MjcxODE4NThaMBYxFDASBgNVBAMT
+C21vemlsbGEub3JnMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAx9xo
+tVD5i+tCiZOgVdCchHITEcoE37WrSFFcEGLo4SXQtJenZEH77oEnm3gREuHjGGia
+zJodPwJ3jBM+iFgF7C0Cjmwu1OxtTltabPgi/HNri+1Mn49vBnRIN1NmPvo5jJep
+D+X130AoaBvuydDx9ajVqFjGQ4FPyIFNdTH8YxA6obLoynEeEZq7+ObJXvVVAqUM
+fOSQ4k5CPzyvwKoxxX5Mt+ZpTlDOY7vsg2WSMMTxx0guox3jaPMnQ3SvjIJKYplg
+iwJO6+KyiFEV4Qc0zwVhfF6VoOP2IqREjPbl3TCFKw/Fw7nYRWzdQPRcVYqBbOPy
+0z9+fhVhdxnOPlStYQIDAQABo30wezAOBgNVHQ8BAf8EBAMCA4gwEwYDVR0lBAww
+CgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADAfBgNVHSMEGDAWgBShxGHfi3JINMsI
+dujMqSA+oS7HtjAlBgNVHREEHjAcggttb3ppbGxhLm9yZ4INKi5tb3ppbGxhLm9y
+ZzAKBggqhkjOPQQDAgNJADBGAiEA+CZGV5sIwr+EI1vtfQNpt/Lx8f6EISvZQgYg
+7lZlZHECIQCEzZx/xQcOaH0rRlsRzeen/dHw866YBY0uL+bpB89kig==
+-----END CERTIFICATE-----
+-----BEGIN RSA PRIVATE KEY-----
+MIIEpAIBAAKCAQEAx9xotVD5i+tCiZOgVdCchHITEcoE37WrSFFcEGLo4SXQtJen
+ZEH77oEnm3gREuHjGGiazJodPwJ3jBM+iFgF7C0Cjmwu1OxtTltabPgi/HNri+1M
+n49vBnRIN1NmPvo5jJepD+X130AoaBvuydDx9ajVqFjGQ4FPyIFNdTH8YxA6obLo
+ynEeEZq7+ObJXvVVAqUMfOSQ4k5CPzyvwKoxxX5Mt+ZpTlDOY7vsg2WSMMTxx0gu
+ox3jaPMnQ3SvjIJKYplgiwJO6+KyiFEV4Qc0zwVhfF6VoOP2IqREjPbl3TCFKw/F
+w7nYRWzdQPRcVYqBbOPy0z9+fhVhdxnOPlStYQIDAQABAoIBACOKODx158pPzYc1
+bz+TVyHePzHcoL0/SvQTM7HeRNc0qEZU6XlUmn4xDWACG9clwAJpJ43WofjAcY3B
+Jk+Mh5EV9+xnpHRMjqtuZ0gVX/NQewFo80U0dmPJbcYY2Ie+a1lq5q9jDzPh7s2E
+mhPdSgmLOmMzVh5O8mcPRzzd5KmgukJyDNqRfAdzTW1k0h2x9h19q1uPkUe6UNqq
+YfSkjIhMvkG22S6zRjETwltIXwtAXSopj5TvNI87C46DZuEeaGAQ3+92YWKgoWg2
+3gXJ1RIocP4VUS5/SUH4FYP9LAK7I1NnMJUisZpp1EJ3RR4Cc6yUXdK+d41+iQ6l
+TNEfIJkCgYEAyxnjLhIv3ejRdD/uo6ETcBm2SngvV0xmcNrd1Z69P81ErD31lCkQ
+OpjvUk3nGUIs2FbI2RQupvsvlg3PPWRi7H6Fm/In3gD93xwWwXfW+Z+4NZvtiCqm
+WLoX42lkmh7CWL5XhoCsJsh5FLpOB3jZcDk7FSZzSvCmSLyOlCsgbA8CgYEA++p6
+pU+CnERkIEyJRS/Mz3BAllJRY8bxsK8eNl7DI4IEJc3fjAzb80B0OIWoEfXbLTKq
+yjwPDhHGq1DR631H+Ovp8X1YEnBGfTT0HnI962bjT37FVUDOsDpux5cOq99Prrgk
+XhiV9WKETzgmq477oQ+iIqBFL/6mAFHXugs1n48CgYBEoycHdtX+ZKQEaWa4ncL3
+63iTijJVilhEY3L8sny6hyBiJT5NJ+N4Kh8W7YTgIGEPa6TM1+k8PT9Dsr8KvFZC
+HjABF8EpYaRqNg/qqhlYmwWh+GQ51FALRDi2ffOlsidz3j+uEOYc5TsmKiAcnla9
+elnhN/FWriVEB5UXtctrOQKBgQCY49thvxrW+o8GJ01ch0E3WLpqQTWSZ+jBwdaF
+SwgF4d/gjc0x84/+V0zyDPRPSjamfMy5BrBgapt32Ao/cP6gbZXDcb5lGm09ikjq
+vY0k9IHa+maLclS/Egev7NcDqvlyYeH4ldVVY2BHsB2QG6xOOO2/NCQpl9Rp90IF
+cM4vswKBgQCWC0kbWyT85Q1mJM/xU8LexBhwARjufz3j9Pqyn80R6jYVXmaf+HN1
+98JebKUzLl780FWcnkjyKBZGuB8COq5CxDunzcqAtp2rCUex7GBdXu5rYvUGBSNN
+RU8Tpohu9jVYjpvc3y3C52YBoX092F6OIVCtvxrD+o2C1NHSYS1Syw==
+-----END RSA PRIVATE KEY-----
--- a/testdata/mitm/org/m/mo/mozilla/addons.mozilla.org.crt
+++ b/testdata/mitm/org/m/mo/mozilla/addons.mozilla.org.crt
@@ -0,0 +1,44 @@
+-----BEGIN CERTIFICATE-----
+MIICqzCCAlGgAwIBAgIRANsJ1xieK1uo/jbtzHlI5/4wCgYIKoZIzj0EAwIwNzEQ
+MA4GA1UEChMHbWF6ZS5pbzEjMCEGA1UEAxMaU3R5eCBDZXJ0aWZpY2F0ZSBBdXRo
+b3JpdHkwHhcNMjUwOTI1MTgwMDQ3WhcNMjUwOTI3MTgwMDQ3WjAdMRswGQYDVQQD
+ExJhZGRvbnMubW96aWxsYS5vcmcwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
+AoIBAQCd+c5ZrL16b0ZU+W/9jM+kgfYDkZiZEfyEB4VoY5DgwaX0zc7GJpxBQl2m
+FwDhy6vfdGef+6K2f5s50NOz0cy7t535Q4/Lx7CTFCnrinZSBl3Bsu0KL8T0RLzE
+1YL4V7uISUMA2qrLhPsMeZcG7eTNDDsnc4AqCmlVvde3Mryj+CXTtuOAWEUgnwKW
+Kn55YyUncBPycGQFzDVhXuQhztg9AjknpDqx97LPSUcv72CVw9y/pGaCJA6G4YGZ
+9qPjWJ2S/nT4unOtxWFHDOlX3EcDFcDs3piMhZ9/MlPoEpxGJSU5OKmtlggI2t3h
+BZIphSHg3H3OakeESLo1Ozrb+glDAgMBAAGjgYwwgYkwDgYDVR0PAQH/BAQDAgOI
+MBMGA1UdJQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwHwYDVR0jBBgwFoAU
+ocRh34tySDTLCHbozKkgPqEux7YwMwYDVR0RBCwwKoISYWRkb25zLm1vemlsbGEu
+b3JnghQqLmFkZG9ucy5tb3ppbGxhLm9yZzAKBggqhkjOPQQDAgNIADBFAiAsFw0u
+s+hvYVbcrsD5kS7LpEuB3zBANX0A27NIk3f7OgIhAL2PDXec8mMA4rlIbyf8NQW1
+C/vW/Sd4RDw3sZSq0JrI
+-----END CERTIFICATE-----
+-----BEGIN RSA PRIVATE KEY-----
+MIIEowIBAAKCAQEAnfnOWay9em9GVPlv/YzPpIH2A5GYmRH8hAeFaGOQ4MGl9M3O
+xiacQUJdphcA4cur33Rnn/uitn+bOdDTs9HMu7ed+UOPy8ewkxQp64p2UgZdwbLt
+Ci/E9ES8xNWC+Fe7iElDANqqy4T7DHmXBu3kzQw7J3OAKgppVb3XtzK8o/gl07bj
+gFhFIJ8Clip+eWMlJ3AT8nBkBcw1YV7kIc7YPQI5J6Q6sfeyz0lHL+9glcPcv6Rm
+giQOhuGBmfaj41idkv50+LpzrcVhRwzpV9xHAxXA7N6YjIWffzJT6BKcRiUlOTip
+rZYICNrd4QWSKYUh4Nx9zmpHhEi6NTs62/oJQwIDAQABAoIBABH8rXgcaP6VyOZH
+G5gKAxNF9vUKhHTsHLAAHqgS5Cru9+hx1dcchIkIlGU8O7Ep+8ra9kVZ7Nr2Bq/
+IjupOaxt/bix7p9/PyWf+B3viAVS4D37x22PftdpNC0dOmpYYuvjm5NvUl8V5xfG
+iGGrmI+YQuv9BKzEvrWahgM/7aalnqg8rYlSy56p/rjR58EoFhBlE4ZAUxUz9NUu
+VLg0zyK7gcq4yxPkvpWe0A8QWIlieNQvGQlbInzUYdc1lTGZG8CAsBvz+ourBKIc
+8PNjuKapyN+9tTqDIy3A9LBmlZyM8lq/cLo9paiwjMVU4OcK+EwfT3Pm2f/qfJxd
+JkIuXsECgYEAwzn27hp4FvogU8Avx2wOOxE9impJrB+IXDC3CAzSrlip/sVi8Sju
+fTQPDnf0+DxqvW9yM10u9Fg1nvuIqZ+6SwS075waMQh1YpySerV/gneOZ3lmk5Yt
+KHMFYRFNQKkXCtRqs6c83T88I/IMtC2aJbWsqHKlpygMUeffEhB7lxECgYEAzydB
+X3nDMVM+nkWX5AbRnQQubFNBOfCXE4q01MpZS7wLxhMfZg4nYh/hK9LK3yEv4Lbq
+C1UeadhBlCNa9SVq8+GjdAyM00v92mYVmesjnFLoLhpjMivruNFv5qXOI9wXrZT6
+lA3znxPI8U8ucmZGQ8O63FDHgveP5Joly6O+oxMCgYEApnKROciPgueXEFDXa6uR
+JoM4eP7N+VaZKCDQrKhiKAuoRHN+PCatz0nHXIqh7dN1HjYao/haxDFA5l+G0ThB
+2RwWOARbwFp52q2rpbuBD3dnjolPD54Gumn2uB/MQcjowG8C2lFH70qut+bzNdt7
+hZMzthqpaa8Xce3Dnt82wEECgYAC2rCc5ymYWWRIe/7+xlVHC5K0LWV9reH3A/c/
+41XdpEapQQQyvMkwIe5RU0M2Vde6Cespos+bd75XkzEipZRWreo5pB6gnrBtvPBZ
+QZMpCT9nuzdYrqA92KzpCanQdqzg2GeneJW9wGEJaiTisKQRNPYzKO3G0TBrXvBc
+YPI0fwKBgGBnXiiEmAgUGAd1aV6EfsRRZVx1TnvAEHe3B44UHsNreHNl2U3DjP7S
+BLIOfuqHM9vYBHVgjVo2M+HGWePksXLkXMaOOabEqSrS2rAcsP9IBKaId0vXbz7X
+DaetnjJinOeVJEyj26jCrEjP8qborYH5HahsiaiKeIRb+TNhQi51
+-----END RSA PRIVATE KEY-----
--- a/testdata/mitm/org/s/si/signal.org.crt
+++ b/testdata/mitm/org/s/si/signal.org.crt
@@ -0,0 +1,43 @@
+-----BEGIN CERTIFICATE-----
+MIICmDCCAj6gAwIBAgIRALw1SWdJSk4Sy8uT7rNvyYYwCgYIKoZIzj0EAwIwNzEQ
+MA4GA1UEChMHbWF6ZS5pbzEjMCEGA1UEAxMaU3R5eCBDZXJ0aWZpY2F0ZSBBdXRo
+b3JpdHkwHhcNMjUwOTI1MDc0NjA0WhcNMjUwOTI3MDc0NjA0WjAVMRMwEQYDVQQD
+EwpzaWduYWwub3JnMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuFhv
+eab2nVaQxQAsV0KZBIMiZb9W+nEt3LQX2W/p7H3n1eeuy9X4xJGcxyvOMVXMOORe
+qonUDC82c/dpeKy5i6aNoOdRWg6OAOZlLIC39HNY1CrIrUWAkhtJVMYAJ7amrTRN
+gzIvToqeoqjkXuodD7bPvf5nGntxD9IdxrXfCk3f7k7/TrzYYXcQid9swWQaz7RI
+nTbSxJPrRnHptx5oUMJzoOwqPo4P6U+aBzxTmZahETA3h7zfCoxHJX0HZJJCf476
+1Yz4PpbKMgC6333Fg2LHDC+cv3S0tkDseIIzdoxq2ftZiN86mVRmb0OqA5G2f+Vk
+QDpL65tvfysAiGNpiQIDAQABo4GBMH8wDgYDVR0PAQH/BAQDAgOIMBMGA1UdJQQM
+MAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwHwYDVR0jBBgwFoAUocRh34tySDTL
+CHbozKkgPqEux7YwKQYDVR0RBCIwIIIKc2lnbmFsLm9yZ4IMKi5zaWduYWwub3Jn
+hwQKKirXMAoGCCqGSM49BAMCA0gAMEUCIA4fah5C6wehuoY0ccsGFG44IC5ppUPR
+Oi/HlQSaZxNrAiEAq2mH23XtpfGgRPEepjRWxL6mWXvMqsMm52py5rfyWfU=
+-----END CERTIFICATE-----
+-----BEGIN RSA PRIVATE KEY-----
+MIIEpAIBAAKCAQEAuFhveab2nVaQxQAsV0KZBIMiZb9W+nEt3LQX2W/p7H3n1eeu
+y9X4xJGcxyvOMVXMOOReqonUDC82c/dpeKy5i6aNoOdRWg6OAOZlLIC39HNY1CrI
+rUWAkhtJVMYAJ7amrTRNgzIvToqeoqjkXuodD7bPvf5nGntxD9IdxrXfCk3f7k7/
+TrzYYXcQid9swWQaz7RInTbSxJPrRnHptx5oUMJzoOwqPo4P6U+aBzxTmZahETA3
+h7zfCoxHJX0HZJJCf4761Yz4PpbKMgC6333Fg2LHDC+cv3S0tkDseIIzdoxq2ftZ
+iN86mVRmb0OqA5G2f+VkQDpL65tvfysAiGNpiQIDAQABAoIBAAUyANpF2Vdv1B6p
+NZaz+soExBhn/xSJ0ggRT0bCf645kioWIHgALMWlcOywEFyVlW7ZCM33mnFJd1hn
+VaKgA46q//zT6BgIpvnhhGJvsj+CbLN2DTfM6KW1fSiVd/WmkSX6fmC/LlQhVf0x
+k1YVdQI3Xb12CQPXDMWsX0h1YbbRlLdvlMmjZMXSn6VmcISYk2+NzwlZmBupkq6e
+GIswS61UsxonANgzs/HcqmV9wpfNN5sfbg4Yr7acVWTiRnfrf45Nb6XgVCIOhMCn
+kClNqcwhHaTrwOam+XRXI/D7ldz6METK5sGnqfdrDk1XWxrMppmEJ6zKGmydXdRp
+CfdZrnECgYEA8nXmvKNkXx57tEK0vNLNvBGYyGUL7KLlbk3OmSzBstxFuFABrbk5
+ghr6anCnckLi5Fx4TrciLwuvgapmQyLGeDzf7T4RQSNnI6lF4i0fWsWBN+UPcOlj
+6ah/pnMgtx9qWjfLBRPcs5Wqd2qLOUz2M63lXTTNSl94XYSk+VGzvE0CgYEAwqO/
+sCKoZAZ+9+0QFjdXTR87/aIcjzEcWktGtJKP3znxypU7kdZWVd7hapyFEVsp6LwP
+NGtSOXLd4SvakGRzkpHTyi/zMJuUt/le1unVmgi9I1CDTBMReK4JTt/ii+ytvirT
+8bHMYtPXtiLYQdgLcnEmiF561jQnKq5PXclgkC0CgYAfbolrCwOIETuYMs2bbPie
+2OklkXPqSXPUyOFvmg3CUiv3qOeOzeRWqYitI82RUnp3gEVYbwVPdARcmuqG6Ysx
+KzMcXl9+QkisptUYbSETc2c9B8Torlj1gZKK0YH8O2ZeK711+w0xesWOlZFW7FM+
+f9ysKJw0eAvyk6+PYrgaQQKBgQCvAWijSCY7+ZND/EUQlKXMVB8uiApBvZiOn0xt
+o7H0tjbvPYsYL63k+8eWgjErT9q4xg6txSljOiLCCRo15fv8d14EV2TD+b+YQ4HA
+nvNN0jmtfQDw79wvs9vurWMXCLGXYQ68LG9nFK7Jtz7WxRhVx+MrjjfITZBB0gTO
+gPhv6QKBgQC6ZjTe7coBM8iVSnFCGssqnidtLVoZCDeiCBzJP67CULk981wPtVse
+EtlTjbrDR/mszumW6KawMZnk6oAwgKIqMeUKjM7qmMuS1SL5sCrJMuCf6/Ra2+1F
+96FyMBZr+BEF5nWfVay+u2NTz0GTPGN255oib53jSrA4mbLT/0MT3w==
+-----END RSA PRIVATE KEY-----
--- a/testdata/mitm/uk/c/co/co/amazon.co.uk.crt
+++ b/testdata/mitm/uk/c/co/co/amazon.co.uk.crt
@@ -0,0 +1,44 @@
+-----BEGIN CERTIFICATE-----
+MIICnzCCAkSgAwIBAgIQdCzZcrSiAD5KQA1NnUeH8TAKBggqhkjOPQQDAjA3MRAw
+DgYDVQQKEwdtYXplLmlvMSMwIQYDVQQDExpTdHl4IENlcnRpZmljYXRlIEF1dGhv
+cml0eTAeFw0yNTA5MjUxNjExMjdaFw0yNTA5MjcxNjExMjdaMBcxFTATBgNVBAMT
+DGFtYXpvbi5jby51azCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJ6I
+MSovlDhdgWxcL5toiueZ1c3QJhZ40S4WHQSpUehDT70qWO7Ofn+wsixRfz6mJaTB
+uhqaJkySg3PoXlgk54vnVNz8nzYto5EwhhXDHfhyD0+8NcXOEzzU7CpJonXfHtOI
+RW1iKXfH13wkGr8Cm54nomIRzH1bSK8sQ+TRRPQVuGQztr//iqdf2fNLAj1fzfae
+P2pFnB/eO9/Tlorexdm133xDoyeIWBuKhaTAfbEgBAIvYkb8bOFI517gzL1ki1n5
+E5o5KSSbENJtU58rKV6NJjv0YqA0tZDUYxFFB5je+Gh1h7Fhc057oAnRhXh2Vwqb
+F0LOPV2DIjQYIgpaJLsCAwEAAaOBhjCBgzAOBgNVHQ8BAf8EBAMCA4gwEwYDVR0l
+BAwwCgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADAfBgNVHSMEGDAWgBShxGHfi3JI
+NMsIdujMqSA+oS7HtjAtBgNVHREEJjAkggxhbWF6b24uY28udWuCDiouYW1hem9u
+LmNvLnVrhwQKKkJDMAoGCCqGSM49BAMCA0kAMEYCIQC1dJ9JVy+HX4PbUOCYyZEn
+l1ZjseSwU4zrZnKR1jRvIgIhAMjdAHSqbjPr8OkGJYNw1S5Ww6GZW7FxxIa6kA2x
+APxK
+-----END CERTIFICATE-----
+-----BEGIN RSA PRIVATE KEY-----
+MIIEowIBAAKCAQEAnogxKi+UOF2BbFwvm2iK55nVzdAmFnjRLhYdBKlR6ENPvSpY
+7s5+f7CyLFF/PqYlpMG6GpomTJKDc+heWCTni+dU3PyfNi2jkTCGFcMd+HIPT7w1
+xc4TPNTsKkmidd8e04hFbWIpd8fXfCQavwKbnieiYhHMfVtIryxD5NFE9BW4ZDO2
+v/+Kp1/Z80sCPV/N9p4/akWcH94739OWit7F2bXffEOjJ4hYG4qFpMB9sSAEAi9i
+Rvxs4UjnXuDMvWSLWfkTmjkpJJsQ0m1TnyspXo0mO/RioDS1kNRjEUUHmN74aHWH
+sWFzTnugCdGFeHZXCpsXQs49XYMiNBgiClokuwIDAQABAoIBABlnONGfZtXoDeQq
+RYABWY4mitR8ZTi2oCENbsBKIujgAw1h6sxMOd2w7RbIRxE9QyJKiiLXJAn4dFNa
+HzwVSyaSVCPxNdCoXDcuGl5ZshoXVOLHBarZDHYepxVY+qJ+tWGEyvNDMTfoxbE2
+gTQDG/f/i+LBIrkiVob+GzG1uEyQVII6zR6BhbJPKAIIn8SIadLdSgR6z5Zd93F3
+Tu1uxs2D4HkD8c/f5PPc8l06ewZCCZE58wyS37bZ0TnWPEfwZ1aZO/PdVGwOUL+F
+i8o38WymB+j7V2hOWIZ6zmAYj7SpI1ZaBXVuHFFoIKgFYhrESwpyKmwrEHxwzX4L
+sKwFQwkCgYEAwj2ZHVb0UjPv8zcBnM4EyP3E3zNiOgNV2Q5Ut4wZkGxIxqzbGctG
+2TZOsJaJSE4PjuMT9SOawkHvMD7wjOPrarlc61V0XOTzydhr40H3KvrraA59JURG
+i45nfKcTGAVax+yu/5GyMSyzSkfF7wvXS95iKlFcORMBkDZk/F9tqs8CgYEA0PAO
+gwyOy4F3NOqSTgd20R2AWoYgRHbvESDZW3qhH/fvudLNhuLuHTCcMHcfRa9z0qAl
+lbivVT6Pey6LnBzNXi3xRtnxBN4BVs81YxOAXiDBHmsDBDpSAjS5NkS2eINdxWpg
+tpmQc6t6U6huntjUXn/+RPXtUPw7fvTKIiwsMlUCgYBMkU+MGzzQMp0BuMsv7p5A
+RJiYi37K84mhuF54xAdHwQenGXh84H6bHSdDwPN4xxym7KhvV4uny6nn0MeuIiIo
+vcz9D4CBJddb164ftV8jWCn3qM54JEPSu13b61hBfcrdSFVrdRlS/RXn0AccRgSm
+aZE0sUGzVeSl3mtMeKmYTQKBgHBGX3X6fI1M/9LWrlHx3t5WXQ/H/XTs+GCa51Iq
+HoVARXj0l28BaPUUlwnQKWTX+IRZfHjtKoLDQHTwOSNlstIGHB53pPV5mvycElMw
+Oo3aSgxfctqFwGXhERnhaLBv3ybjmB7nfGE751snKnJ/j/dMDkXeZW1cbVg2kJw2
+YnWVAoGBAJ8+3QHuq1JTaQvLYQHrydiNqNjTAb67IXCmtV3L9AOOuRYX84FxZoeJ
+ANy/tOccwkyw/9O6AuNwWLmFHC37HOsD5oQP/9D7zb7TUxrtro4ReBrBuexr2AMZ
+TlI7H+JGIMyq1Y9yxCuBSTslyQqAMF3/G65EJq8N2bE3pz2CjwP/
+-----END RSA PRIVATE KEY-----
--- a/testdata/policy/bogons.rego
+++ b/testdata/policy/bogons.rego
@@ -1,12 +1,58 @@
 package styx

-default permit := true
+import input.request as http_request

-reject = 404 if {
-    #some addr in net.lookup_ip_addr(input.http_request.host)
-    styx.in_networks("bogons", input.http_request.host)
+default permit := false
+default reject := 0
+default template := ""
+
+# Bogon networks
+bogons := [
+    "0.0.0.0/8",          # "This" network
+    "10.0.0.0/8",         # RFC1918 Private-use networks
+    "100.64.0.0/10",      # Carrier-grade NAT
+    "127.0.0.0/8",        # Loopback
+    "169.254.0.0/16",     # Link local
+    "172.16.0.0/12",      # RFC1918 Private-use networks
+    "192.0.0.0/24",       # IETF protocol assignments
+    "192.0.2.0/24",       # TEST-NET-1
+    "192.168.0.0/16",     # RFC1918 Private-use networks
+    "198.18.0.0/15",      # Network interconnect device benchmark testing
+    "198.51.100.0/24",    # TEST-NET-2
+    "203.0.113.0/24",     # TEST-NET-3
+    "224.0.0.0/4",        # Multicast
+    "240.0.0.0/4",        # Reserved for future use
+    "255.255.255.255/32", # Limited broadcast
+]
+
+# Resolve HTTP host to IPs
+addrs := styx.lookup_ip_addr(http_request.host)
+
+template := "template/blocked.html" if {
+    some cidr in bogons
+    net.cidr_contains(cidr, http_request.host)
+}
+
+template := "template/blocked.html" if {
+    some addr in addrs
+    some cidr in bogons
+    net.cidr_contains(cidr, addr)
+}
+
+permit if {
+    template == ""
 }

 errors contains "Bogon destination not allowed" if {
-    reject == 404
+    template != ""
+}
+
+errors contains "Could not lookup host" if {
+    count(addrs) == 0
+}
+
+errors contains addr if {
+    some addr in addrs
+    some cidr in bogons
+    net.cidr_contains(cidr, addr)
 }