Repository: digicert/pkilint (language: python)

Issue:
Add support for linting ETSI website authentication certificates
Linting to be supported with both a new CLI tool as well as REST API.

Add usage documentation to README as well as additional documentation on the Wiki.

Add opt-in support to use pyasn1-fasder for decoding DER
If [pyasn1-fasder](https://github.com/CBonnell/pyasn1-fasder) is installed, then use its DER decoder instead of the default DER decoder. This is currently opt-in, as some more testing (namely longevity) needs to be performed to ensure there are no memory or resource leaks. That being said, initial mass-linting results are promising.

Improvements when installed:
- Linting is 30-40% faster. No more need to re-encode a structure into DER to ensure it was originally DER encoded
- "DER-Ambiguous" ASN.1 grammars can be parsed (e.g., empty revocation lists in CRLs no longer result in a DER decode error)
- Eliminates need for ASN.1 encoding specific validators such as PrintableStringConstraintValidator, as such validation is done by the decoder function.

If further testing reveals that there are no latent issues, the package will be promoted to a dependency.
Relax format for ISO 3166-2 state/province identifiers
Now that SMC-03 has passed, the required format for state/provinces in organizationIdentifier values has been relaxed. Currently, the linter requires exactly 2 letters; the ballot relaxes this to 1-3 alphanumeric characters. This should be relaxed to match the updated language.


Discussion / hints:

Fix patch:
diff --git a/.gitignore b/.gitignore
index d2aee62..84f25b5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -130,3 +130,7 @@ dmypy.json
 
 .vscode/
 .idea/
+
+# Apple-specific
+.DS_Store
+
diff --git a/CHANGELOG.md b/CHANGELOG.md
index f83de6d..5dbc38a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,13 @@
 
 All notable changes to this project from version 0.9.3 onwards are documented in this file.
 
+## 0.11.0 - 2024-06-14
+
+### New features/enhancements
+
+- Add support for linting ETSI website authentication certificates (#80)
+- Add opt-in support for using [pyasn1-fasder](https://github.com/CBonnell/pyasn1-fasder) to decode DER (#81)
+
 ## 0.10.3 - 2024-05-13
 
 ### New features/enhancements
diff --git a/README.md b/README.md
index a1bd820..e6948f1 100644
--- a/README.md
+++ b/README.md
@@ -143,6 +143,7 @@ The list of command line linters bundled with pkilint:
 * [lint_pkix_cert](#lintpkixcert)
 * [lint_cabf_smime_cert](#lintcabfsmimecert)
 * [lint_cabf_serverauth_cert](#lintcabfserverauthcert)
+* [lint_etsi_cert](#lintetsicert)
 * [lint_crl](#lintcrl)
 * [lint_ocsp_response](#lintocspresponse)
 * [lint_pkix_signer_signee_cert_chain](#lintpkixsignersigneecertchain)
@@ -302,6 +303,77 @@ $ lint_cabf_serverauth_cert lint -d dv_final_clean.pem
 $
 ```
 
+### lint_etsi_cert
+
+For further information on this linter, see [the Wiki page](https://github.com/digicert/pkilint/wiki/lint_etsi_cert).
+
+This tool lints certificates against the profiles specified in ETSI EN 319 412 and TS 119 495. Currently, the tool
+has the most comprehensive support for website authentication certificates, but support for electronic signature,
+electronic seal, and timestamping certificates is planned.
+
+The `lint` sub-command requires that the user provide the certificate type/profile of the certificate so that the appropriate
+validations are performed. There are two options:
+
+1. Explicitly specify the type of certificate using the `-t`/`--type` option.
+2. Have the linter detect the type of certificate using the `-d`/`--detect` option. In this case, the linter will determine the certificate type using the values of various extensions and fields included in the certificate. The detection procedure may not always be accurate, so it is recommended to use the `--type` option for the best results.
+
+Several parts of EN 319 412 and TS 119 495 supersede requirements specified in the TLS Baseline Requirements and RFC 5280. For example, the TLS Baseline Requirements requires that certificate validity periods be 398 days or less. However, this requirement need not be followed for PSD2 website authentication certificates that are not trusted
+by browsers. By default, such findings are not reported. To report superseded findings, specify the `--report-all` option.
+
+The `-o`/`--output` option is used to specify that the certificate type used by the linter is written to standard error. This is useful when using the `--detect` option to see which certificate type was determined by the heuristics logic.
+
+#### Example command execution
+
+```shell
+$ echo '-----BEGIN CERTIFICATE-----
+MIIHMTCCBRmgAwIBAgIQVZHNRxiZp9LoR1nlajD1DDANBgkqhkiG9w0BAQsFADCB
+oTELMAkGA1UEBhMCR1IxNjA0BgNVBAoTLUhFTExFTklDIEVYQ0hBTkdFUyAtIEFU
+SEVOUyBTVE9DSyBFWENIQU5HRSBTQTEvMC0GA1UEAxMmQVRIRVggUXVhbGlmaWVk
+IFdFQiBDZXJ0aWZpY2F0ZXMgQ0EtRzMxDzANBgNVBAcTBkF0aGVuczEYMBYGA1UE
+YRMPVkFURUwtMDk5NzU1MTA4MB4XDTI0MDQxMTE0MTY1NVoXDTI1MDQxMTE0MTY1
+NVowgcMxCzAJBgNVBAYTAkdSMTYwNAYDVQQKEy1IRUxMRU5JQyBFWENIQU5HRVMg
+LSBBVEhFTlMgU1RPQ0sgRVhDSEFOR0UgU0ExGDAWBgNVBGETD1ZBVEVMLTA5OTc1
+NTEwODEdMBsGA1UEAxMUd2ViZHNzLmF0aGV4Z3JvdXAuZ3IxDzANBgNVBAcTBkF0
+aGVuczETMBEGCysGAQQBgjc8AgEDEwJHUjEdMBsGA1UEDxMUUHJpdmF0ZSBPcmdh
+bml6YXRpb24wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC4IRER3+RS
+dMkB84htWhzmrcFTqJ47yJtZAgvDxw0aWYWVtyW2SMtygVUZSfp5ewE8OA9tdCa6
+oIuap6hKgZpQnkxS9RP0JRyHrJjxOc4sUUtbOHMCV5hq4Lkonh01DAsad9tVqR4n
+aUSHsPI8v+93fjigi3vBsf5nGeBRrCTBYs8IKqoCC+Z2WWbwRCB6ct+ODsqbLwRx
+T54WY9iTaCNc/71rUlvIo3nkd/H17MCkoBdv4Ec3NG1Jo18FnkATyM12Xzhet+Wv
+vx0yjewRrFxak/wGZ4GGX1Dzy4wHfsceQjAtiZk2oWcn3/mk6oVA0ynF2a/4CmT1
+OZiWGOTqNnxTAgMBAAGjggI/MIICOzAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYB
+BQUHAwIwHwYDVR0jBBgwFoAUIpkkVwZsVnWO2+t9eWWcUzWp0ZEwLQYIKwYBBQUH
+AQMEITAfMAgGBgQAjkYBATATBgYEAI5GAQYwCQYHBACORgEGAzCBlwYIKwYBBQUH
+AQEEgYowgYcwOAYIKwYBBQUHMAGGLGh0dHA6Ly9vY3NwLmF0aGV4Z3JvdXAuZ3Iv
+QXRoZXhRdWFsaWZpZWRDQUczMEsGCCsGAQUFBzAChj9odHRwOi8vcmVwby5hdGhl
+eGdyb3VwLmdyL0FUSEVYUXVhbGlmaWVkV0VCQ2VydGlmaWNhdGVzQ0FHMy5jcnQw
+JQYDVR0gBB4wHDAPBg0rBgEEAYHlWgEDZAEEMAkGBwQAi+xAAQYwTwYDVR0fBEgw
+RjBEoEKgQIY+aHR0cDovL2NybC5hdGhleGdyb3VwLmdyL0FUSEVYUXVhbGlmaWVk
+V0VCQ2VydGlmaWNhdGVzQ0FHMy5jcmwwHQYDVR0OBBYEFNO1Ri+h7gAw1BnwJi1m
+HFV+L6htMA4GA1UdDwEB/wQEAwIHgDB7BgNVHREEdDByghR3ZWJkc3MuYXRoZXhn
+cm91cC5ncoIYd2ViZHNzbW9jay5hdGhleGdyb3VwLmdyghp3ZWJkc3MtcnB4cjEu
+aW5ldC5oZWxleC5ncoIPZHNzLmF0aGV4bmV0LmdyghNkc3Ntb2NrLmF0aGV4bmV0
+LmdyMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADggIBAJl4huEpr01gxqGh
+FzkCbhZYW48Bv+zGQodfBnhISH5Dj9Apb2pUCJiPIGy6NQ3nHygyy1y2aW+1ExrZ
+6ZCmtmw2/isk8q9wKa4PS/ip1+IzOin67XmYAz+t03MRl569wtzH+WPL2hb5Zmsw
+AkTP6/N9Jp1I9cryvHO2ZCEYZreWtgvJQaDBQ/qteUKnVNLyuJle9hAYvsWEbgIO
+xlWaDzPnWYYjZuXbyowImmjhufFyrJ2ngwwgw1sI0Se5vGOWWj+i/KBqLbwpp11I
+yXAJkhNTJVxI5B7BpAqoMGOlqf4w4eCqU/HUKL9ZIOHSClPTzaXS45ppPyb+zzLB
+u4vt0PJTAh3wnujcRZ3NxmetsehqunSpyKg0MzL2FDpxD31XHzmlpq5hQGgX1QF3
+0Wl3IADw5JzT4ApHW4ucsLr22HJBTnFab/tbviqg2HcVDAksUqZbPqNCenN/BW3J
+rhXwewWAfHE4LnDQBlAbq95LuijvHx3MaTt8y7wPSOizYTpry19uHT0aaxXfLivh
+YnIjcWwNwowxjVLSVBK0TBvEUVF2DwDNLRfX2aSpt0rq3rxtNcjvJvwHJrDLio8y
+fSyJXu4qGbQ3OwuuJXaEPiBANUEckaPKg5pdua4Lwt708kOG54E7pzz3xLEjtODU
++9Ru72tw8lf1RlWwp5ZI+7CByD0W
+-----END CERTIFICATE-----' > qncp_w_gen.pem
+
+$ lint_etsi_cert lint -d qncp_w_gen.pem
+SubjectKeyIdentifierValidator @ certificate.tbsCertificate.extensions.6.extnValue.subjectKeyIdentifier
+    pkix.subject_key_identifier_method_1_identified (INFO)
+
+$
+```
+
 ### lint_crl
 
 This tool lints CRLs against the RFC 5280 as well as against the CA/Browser Forum profile for CRLs. It is anticipated that this
@@ -353,10 +425,12 @@ pkilint is built on several open source packages. In particular, these packages
 | cryptography       | Apache Software License; BSD License | The Python Cryptographic Authority and individual contributors | https://github.com/pyca/cryptography              |
 | fastapi            | MIT License                          | Sebastián Ramírez                                              | https://github.com/tiangolo/fastapi               |
 | iso3166            | MIT License                          | Mike Spindel                                                   | http://github.com/deactivated/python-iso3166      |
+| iso4217            | Public Domain                        | Hong Minhee                                                    | https://github.com/dahlia/iso4217                 |
 | publicsuffixlist   | Mozilla Public License 2.0 (MPL 2.0) | ko-zu                                                          | https://github.com/ko-zu/psl                      |
 | pyasn1             | BSD License                          | Christian Heimes and Simon Pichugin                            | https://github.com/pyasn1/pyasn1                  |
 | pyasn1-alt-modules | BSD License                          | Russ Housley                                                   | https://github.com/russhousley/pyasn1-alt-modules |
 | python-dateutil    | Apache Software License; BSD License | Gustavo Niemeyer                                               | https://github.com/dateutil/dateutil              |
+| python-iso639      | Apache Software License              | Jackson L. Lee                                                 | https://github.com/jacksonllee/iso639             |
 | validators         | MIT License                          | Konsta Vesterinen                                              | https://github.com/kvesteri/validators            |
 
 The pkilint maintainers are grateful to the authors of these open source contributions.
diff --git a/VERSION.txt b/VERSION.txt
index a3f5a8e..142464b 100644
--- a/VERSION.txt
+++ b/VERSION.txt
@@ -1,1 +1,1 @@
-0.10.3
+0.11.0
\ No newline at end of file
diff --git a/pkilint/bin/lint_etsi_cert.py b/pkilint/bin/lint_etsi_cert.py
new file mode 100644
index 0000000..3fa6ec3
--- /dev/null
+++ b/pkilint/bin/lint_etsi_cert.py
@@ -0,0 +1,105 @@
+#!/usr/bin/env python
+
+import argparse
+import sys
+
+from pkilint import etsi
+from pkilint import loader, report, util, finding_filter
+from pkilint.etsi import etsi_constants
+from pkilint.pkix import certificate
+
+_CERTIFICATE_TYPE_OPTIONS = [str(t).replace('_', '-') for t in etsi_constants.CertificateType]
+
+
+class EtsiCertificateTypeAction(argparse.Action):
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+
+    def __call__(self, parser, namespace, values, option_string=None):
+        cert_type = etsi_constants.CertificateType.from_option_str(values)
+
+        setattr(namespace, self.dest, cert_type)
+
+
+def main(cli_args=None) -> int:
+    parser = argparse.ArgumentParser(
+        description=f'ETSI v{etsi_constants.EN_319_412_VERSION} Certificate Linter'
+    )
+
+    subparsers = parser.add_subparsers(dest='command', required=True)
+
+    validations_parser = subparsers.add_parser('validations',
+                                               help='Output the set of validations which this linter performs')
+    validations_parser.add_argument('-t', '--type', required=True,
+                                    type=str.upper,
+                                    action=EtsiCertificateTypeAction,
+                                    help='The type of certificate',
+                                    choices=_CERTIFICATE_TYPE_OPTIONS)
+
+    lint_parser = subparsers.add_parser('lint', help='Lint the specified certificate')
+
+    detect_options_group = lint_parser.add_mutually_exclusive_group(required=True)
+    detect_options_group.add_argument('-d', '--detect', action='store_true',
+                                      help='Detect the type of certificate from reserved CA/B Forum policy '
+                                           'OIDs and qualified certificate statements.')
+    detect_options_group.add_argument('-t', '--type',
+                                      type=str.upper,
+                                      action=EtsiCertificateTypeAction,
+                                      help='The type of certificate',
+                                      choices=_CERTIFICATE_TYPE_OPTIONS)
+    lint_parser.add_argument('-o', '--output', action='store_true',
+                             help='Output the type of certificate to standard error. This option may be '
+                                  'useful when using the --detect option.')
+    lint_parser.add_argument('-r', '--report-all', action='store_true', help='Report all findings without filtering '
+                             'any findings that are superseded by other requirements')
+
+    util.add_standard_args(lint_parser)
+    lint_parser.add_argument('file', type=argparse.FileType('rb'),
+                             help='The certificate to lint'
+                             )
+
+    args = parser.parse_args(cli_args)
+
+    if args.command == 'validations':
+        doc_validator = certificate.create_pkix_certificate_validator_container(
+            etsi.create_decoding_validators(args.type),
+            etsi.create_validators(args.type)
+        )
+
+        print(report.report_included_validations(doc_validator))
+
+        return 0
+    else:
+        try:
+            cert = loader.load_certificate(args.file, args.file.name)
+        except ValueError as e:
+            print(f'Failed to load certificate: {e}', file=sys.stderr)
+            return 1
+
+        if args.type:
+            certificate_type = args.type
+        else:
+            certificate_type = etsi.determine_certificate_type(cert)
+
+        if args.output:
+            print(certificate_type.to_option_str, file=sys.stderr)
+
+        doc_validator = certificate.create_pkix_certificate_validator_container(
+            etsi.create_decoding_validators(certificate_type),
+            etsi.create_validators(certificate_type)
+        )
+
+        results = doc_validator.validate(cert.root)
+
+        if not args.report_all:
+            results, _ = finding_filter.filter_results(
+                etsi.create_etsi_finding_filters(certificate_type), results
+            )
+
+        print(args.format(results, args.severity))
+
+        return util.clamp_exit_code(report.get_findings_count(results, args.severity))
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/pkilint/cabf/cabf_ca.py b/pkilint/cabf/cabf_ca.py
index d9d3b07..7834c2d 100644
--- a/pkilint/cabf/cabf_ca.py
+++ b/pkilint/cabf/cabf_ca.py
@@ -2,6 +2,7 @@
 
 from pkilint import validation
 from pkilint.itu import bitstring
+from pkilint.pkix.certificate.certificate_extension import KeyUsageBitName
 
 
 # BR 7.1.2.10.7
@@ -23,7 +24,7 @@ class CaKeyUsageValidator(validation.Validator):
 
     _PROHIBITED_KUS = {
         str(n) for n in rfc5280.KeyUsage.namedValues
-    } - {'digitalSignature', 'keyCertSign', 'cRLSign'}
+    } - {KeyUsageBitName.DIGITAL_SIGNATURE, KeyUsageBitName.KEY_CERT_SIGN, KeyUsageBitName.CRL_SIGN}
 
     def __init__(self):
         super().__init__(
@@ -36,12 +37,12 @@ def __init__(self):
         )
 
     def validate(self, node):
-        if not bitstring.has_named_bit(node, 'keyCertSign'):
+        if not bitstring.has_named_bit(node, KeyUsageBitName.KEY_CERT_SIGN):
             raise validation.ValidationFindingEncountered(
                 self.VALIDATION_CA_CERT_REQUIRED_BIT_MISSING,
                 'keyCertSign not asserted'
             )
-        if not bitstring.has_named_bit(node, 'cRLSign'):
+        if not bitstring.has_named_bit(node, KeyUsageBitName.CRL_SIGN):
             raise validation.ValidationFindingEncountered(
                 self.VALIDATION_CA_CERT_REQUIRED_BIT_MISSING,
                 'cRLSign not asserted'
@@ -55,7 +56,7 @@ def validate(self, node):
                 f'Prohibited KUs present: {prohibited_kus_str}'
             )
 
-        if not bitstring.has_named_bit(node, 'digitalSignature'):
+        if not bitstring.has_named_bit(node, KeyUsageBitName.DIGITAL_SIGNATURE):
             raise validation.ValidationFindingEncountered(self.VALIDATION_CA_CERT_NO_DIG_SIG)
 
 
diff --git a/pkilint/cabf/cabf_constants.py b/pkilint/cabf/cabf_constants.py
deleted file mode 100644
index 236bc60..0000000
--- a/pkilint/cabf/cabf_constants.py
+++ /dev/null
@@ -1,22 +0,0 @@
-import enum
-import typing
-
-
-@enum.unique
-class RegistrationSchemeCountryIdentifierType(enum.IntEnum):
-    NONE = 0
-    XG = 1
-    ISO3166 = 2
-
-
-class RegistrationSchemeNamingConvention(typing.NamedTuple):
-    country_identifier_type: RegistrationSchemeCountryIdentifierType
-    allow_state_province: bool
-    require_registration_reference: bool
-
-
-REGISTRATION_SCHEMES = {
-    'NTR': RegistrationSchemeNamingConvention(RegistrationSchemeCountryIdentifierType.ISO3166, True, True),
-    'VAT': RegistrationSchemeNamingConvention(RegistrationSchemeCountryIdentifierType.ISO3166, False, True),
-    'PSD': RegistrationSchemeNamingConvention(RegistrationSchemeCountryIdentifierType.ISO3166, False, True),
-}
diff --git a/pkilint/cabf/cabf_name.py b/pkilint/cabf/cabf_name.py
index 37d09ba..3d5fc9a 100644
--- a/pkilint/cabf/cabf_name.py
+++ b/pkilint/cabf/cabf_name.py
@@ -1,18 +1,13 @@
-import ipaddress
-import re
 import typing
-from urllib.parse import urlparse
 
-import publicsuffixlist
-import unicodedata
 from iso3166 import countries_by_alpha2
-from pyasn1_alt_modules import rfc5280, rfc8398
+from pyasn1_alt_modules import rfc5280
 
-from pkilint import validation
-from pkilint.cabf import cabf_constants
-from pkilint.cabf.cabf_constants import REGISTRATION_SCHEMES
+from pkilint import validation, document
+from pkilint.common import organization_id
+from pkilint.common.organization_id import ParsedOrganizationIdentifier
 from pkilint.itu import x520_name
-from pkilint.pkix import general_name
+from pkilint.pkix import Rfc2119Word
 
 
 class ValidCountryCodeValidatorBase(validation.TypeMatchingValidator):
@@ -48,138 +43,135 @@ def __init__(self):
                          )
 
 
-ORG_ID_REGEX = re.compile(
-    r'^(?P<scheme>[A-Z]{3})(?P<country>[a-zA-Z]{2})?(\+(?P<sp>[a-zA-Z0-9]{1,3}))?'
-    r'(-(?P<reference>.+))?$'
-)
-
-
-class OrganizationIdentifierAttributeValidator(validation.TypeMatchingValidator):
-    VALIDATION_ORGANIZATION_ID_INVALID_ENCODING = validation.ValidationFinding(
+class CabfOrganizationIdentifierValidatorBase(organization_id.OrganizationIdentifierValidatorBase):
+    VALIDATION_ORGANIZATION_ID_INVALID_SCHEME = validation.ValidationFinding(
         validation.ValidationFindingSeverity.ERROR,
-        'cabf.invalid_subject_organization_identifier_encoding'
+        'cabf.invalid_organization_identifier_registration_scheme'
     )
 
-    VALIDATION_ORGANIZATION_ID_INVALID_FORMAT = validation.ValidationFinding(
+    VALIDATION_ORGANIZATION_ID_INVALID_COUNTRY = validation.ValidationFinding(
         validation.ValidationFindingSeverity.ERROR,
-        'cabf.invalid_subject_organization_identifier_format'
+        'cabf.invalid_organization_identifier_country'
     )
 
-    VALIDATION_ORGANIZATION_ID_INVALID_SCHEME = validation.ValidationFinding(
+    # the attribute name for this finding is prefixed with an underscore so it's not flagged by the "validation report"
+    # test
+    _VALIDATION_ORGANIZATION_ID_INVALID_SP_FORMAT = validation.ValidationFinding(
         validation.ValidationFindingSeverity.ERROR,
-        'cabf.invalid_subject_organization_identifier_registration_scheme'
+        'cabf.invalid_organization_identifier_state_province_format'
     )
 
-    VALIDATION_ORGANIZATION_ID_INVALID_COUNTRY = validation.ValidationFinding(
-        validation.ValidationFindingSeverity.ERROR,
-        'cabf.invalid_subject_organization_identifier_country'
-    )
+    REFERENCE_REQUIRED = (Rfc2119Word.MUST, 'cabf.organization_identifier_reference_missing_for_scheme')
 
-    VALIDATION_ORGANIZATION_ID_INVALID_SP = validation.ValidationFinding(
-        validation.ValidationFindingSeverity.ERROR,
-        'cabf.invalid_subject_organization_identifier_state_province_for_scheme'
+    STATE_PROVINCE_PROHIBITED = (Rfc2119Word.MUST_NOT,
+                                 'cabf.invalid_subject_organization_identifier_state_province_for_scheme')
+
+    _NTR_SCHEME = organization_id.OrganizationIdentifierElementAllowance(
+        country_codes=(organization_id.ISO3166_1_COUNTRY_CODES,
+                       VALIDATION_ORGANIZATION_ID_INVALID_COUNTRY),
+        state_province=(Rfc2119Word.MAY, None),
+        reference=REFERENCE_REQUIRED
     )
 
-    VALIDATION_ORGANIZATION_ID_INVALID_SP_FORMAT = validation.ValidationFinding(
-        validation.ValidationFindingSeverity.ERROR,
-        'cabf.invalid_subject_organization_identifier_state_province_format'
+    _VAT_SCHEME = organization_id.OrganizationIdentifierElementAllowance(
+        country_codes=(organization_id.ISO3166_1_COUNTRY_CODES | {organization_id.COUNTRY_CODE_GREECE_TRADITIONAL,
+                                                                  organization_id.COUNTRY_CODE_NORTHERN_IRELAND},
+                       VALIDATION_ORGANIZATION_ID_INVALID_COUNTRY),
+        state_province=STATE_PROVINCE_PROHIBITED,
+        reference=REFERENCE_REQUIRED
     )
 
-    _ISO3166_AND_ARTICLE_215_COUNTRY_CODES = set(countries_by_alpha2.keys()) | {'EL', 'XI'}
+    _PSD_SCHEME = organization_id.OrganizationIdentifierElementAllowance(
+        country_codes=(organization_id.ISO3166_1_COUNTRY_CODES,
+                       VALIDATION_ORGANIZATION_ID_INVALID_COUNTRY),
+        state_province=STATE_PROVINCE_PROHIBITED,
+        reference=REFERENCE_REQUIRED
+    )
 
-    def __init__(
-            self,
-            relax_stateprovince_syntax=False,
-            additional_schemes: typing.Optional[
-                typing.Mapping[str, cabf_constants.RegistrationSchemeNamingConvention]] = None
-    ):
-        super().__init__(type_oid=x520_name.id_at_organizationIdentifier,
-                         type_path='type', value_path='value.x520OrganizationIdentifier',
-                         pdu_class=rfc5280.AttributeTypeAndValue,
-                         validations=[
-                             self.VALIDATION_ORGANIZATION_ID_INVALID_ENCODING,
-                             self.VALIDATION_ORGANIZATION_ID_INVALID_FORMAT,
-                             self.VALIDATION_ORGANIZATION_ID_INVALID_SCHEME,
-                             self.VALIDATION_ORGANIZATION_ID_INVALID_COUNTRY,
-                             self.VALIDATION_ORGANIZATION_ID_INVALID_SP,
-                             self.VALIDATION_ORGANIZATION_ID_INVALID_SP_FORMAT,
-                         ]
+    _ALLOWED_SCHEME_MAPPINGS = {
+        'NTR': _NTR_SCHEME,
+        'VAT': _VAT_SCHEME,
+        'PSD': _PSD_SCHEME,
+    }
+
+    def __init__(self,
+                 invalid_format_validation: typing.Optional[validation.ValidationFinding],
+                 additional_schemes: typing.Optional[
+                     typing.Mapping[str, organization_id.OrganizationIdentifierElementAllowance]
+                 ] = None,
+                 enforce_strict_state_province_format=True,
+                 additional_validations=None,
+                 **kwargs):
+        self._allowed_schemes = self._ALLOWED_SCHEME_MAPPINGS.copy()
+
+        if additional_schemes:
+            self._allowed_schemes.update(additional_schemes)
+
+        self._enforce_strict_state_province_format = enforce_strict_state_province_format
+
+        additional_validations = [] if additional_validations is None else additional_validations.copy()
+        additional_validations.append(self.VALIDATION_ORGANIZATION_ID_INVALID_SCHEME)
+
+        if self._enforce_strict_state_province_format:
+            additional_validations.append(self._VALIDATION_ORGANIZATION_ID_INVALID_SP_FORMAT)
+
+        super().__init__(self._allowed_schemes,
+                         invalid_format_validation,
+                         additional_validations=additional_validations,
+                         **kwargs
                          )
 
-        if additional_schemes is None:
-            additional_schemes = {}
-        self._allowed_schemes = {**REGISTRATION_SCHEMES, **additional_schemes}
-        self._relax_stateprovince_syntax = relax_stateprovince_syntax
+    @classmethod
+    def handle_unknown_scheme(cls, node: document.PDUNode, parsed: ParsedOrganizationIdentifier):
+        raise validation.ValidationFindingEncountered(
+            cls.VALIDATION_ORGANIZATION_ID_INVALID_SCHEME,
+            f'Invalid registration scheme: "{parsed.scheme}"'
+        )
 
-    def validate_with_value(self, node, choice_node):
-        name, value_node = choice_node.child
+    def validate_with_parsed_value(self, node, parsed):
+        if self._enforce_strict_state_province_format and parsed.state_province is not None:
+            if len(parsed.state_province) != 2 or not parsed.state_province.isalpha():
+                raise validation.ValidationFindingEncountered(
+                    self._VALIDATION_ORGANIZATION_ID_INVALID_SP_FORMAT,
+                    f'State/province "{parsed.state_province}" is not two letters (will be fixed in erratum ballot)'
+                )
 
-        if name not in {'utf8String', 'printableString'}:
-            raise validation.ValidationFindingEncountered(
-                self.VALIDATION_ORGANIZATION_ID_INVALID_ENCODING,
-                f'Invalid ASN.1 encoding: {name}'
-            )
+        return super().validate_with_parsed_value(node, parsed)
 
-        m = ORG_ID_REGEX.match(str(value_node.pdu))
 
-        if m is None:
-            raise validation.ValidationFindingEncountered(
-                self.VALIDATION_ORGANIZATION_ID_INVALID_FORMAT,
-                f'Invalid format: "{value_node.pdu}"'
-            )
-
-        scheme_info = self._allowed_schemes.get(m['scheme'])
-
-        if scheme_info is None:
-            raise validation.ValidationFindingEncountered(
-                self.VALIDATION_ORGANIZATION_ID_INVALID_SCHEME,
-                f'Invalid registration scheme: "{m["scheme"]}"'
-            )
+class CabfOrganizationIdentifierAttributeValidator(CabfOrganizationIdentifierValidatorBase):
+    VALIDATION_ORGANIZATION_ID_INVALID_ENCODING = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.ERROR,
+        'cabf.invalid_subject_organization_identifier_encoding'
+    )
 
-        if scheme_info.require_registration_reference and m['reference'] is None:
-            raise validation.ValidationFindingEncountered(
-                self.VALIDATION_ORGANIZATION_ID_INVALID_FORMAT,
-                f'Missing Registration Reference: "{value_node.pdu}"'
-            )
-        elif not scheme_info.require_registration_reference and m['reference']:
-            raise validation.ValidationFindingEncountered(
-                self.VALIDATION_ORGANIZATION_ID_INVALID_FORMAT,
-                f'Prohibited Registration Reference is present: "{value_node.pdu}"'
-            )
+    VALIDATION_ORGANIZATION_ID_INVALID_FORMAT = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.ERROR,
+        'cabf.invalid_subject_organization_identifier_format'
+    )
 
-        country_code = '' if m['country'] is None else m['country'].upper()
-
-        if scheme_info.country_identifier_type == cabf_constants.RegistrationSchemeCountryIdentifierType.NONE:
-            valid_country_code = (country_code == '')
-        elif scheme_info.country_identifier_type == cabf_constants.RegistrationSchemeCountryIdentifierType.XG:
-            valid_country_code = (country_code == 'XG')
-        elif scheme_info.country_identifier_type == cabf_constants.RegistrationSchemeCountryIdentifierType.ISO3166:
-            if m['scheme'] == 'VAT':
-                valid_country_code = (country_code in self._ISO3166_AND_ARTICLE_215_COUNTRY_CODES)
-            else:
-                valid_country_code = (country_code in countries_by_alpha2)
-        else:
-            raise ValueError(f'Unknown country identifier type for scheme "{m["scheme"]}": '
-                             f'{scheme_info.country_identifier_type}')
-
-        if not valid_country_code:
-            raise validation.ValidationFindingEncountered(
-                self.VALIDATION_ORGANIZATION_ID_INVALID_COUNTRY,
-                f'Invalid country code for scheme "{m["scheme"]}": "{country_code}"'
-            )
+    def __init__(self,
+                 additional_schemes: typing.Optional[
+                     typing.Mapping[str, organization_id.OrganizationIdentifierElementAllowance]
+                 ] = None,
+                 enforce_strict_state_province_format=True):
+        super().__init__(self.VALIDATION_ORGANIZATION_ID_INVALID_FORMAT,
+                         additional_schemes,
+                         enforce_strict_state_province_format,
+                         [self.VALIDATION_ORGANIZATION_ID_INVALID_ENCODING],
+                         pdu_class=x520_name.X520OrganizationIdentifier)
+
+    @classmethod
+    def parse_organization_id_node(cls, node) -> organization_id.ParsedOrganizationIdentifier:
+        name, value_node = node.child
 
-        if m['sp'] is not None and not scheme_info.allow_state_province:
+        if name not in {'utf8String', 'printableString'}:
             raise validation.ValidationFindingEncountered(
-                self.VALIDATION_ORGANIZATION_ID_INVALID_SP,
-                f'Scheme "{m["scheme"]}" does not allow state/province values'
+                cls.VALIDATION_ORGANIZATION_ID_INVALID_ENCODING,
+                f'Invalid ASN.1 encoding: {name}'
             )
 
-        if m['sp'] is not None and not self._relax_stateprovince_syntax and not (
-                len(m['sp']) == 2 and m['sp'].isalpha()):
-            raise validation.ValidationFindingEncountered(
-                self.VALIDATION_ORGANIZATION_ID_INVALID_SP_FORMAT,
-                f'State/province "{m["sp"]}" is not two letters (will be fixed in erratum ballot)'
-            )
+        return organization_id.parse_organization_identifier(str(value_node.pdu))
 
 
 class RelativeDistinguishedNameContainsOneElementValidator(validation.Validator):
@@ -199,173 +191,13 @@ def validate(self, node):
             raise validation.ValidationFindingEncountered(self.VALIDATION_RDN_CONTAINS_MULTIPLE_ATVS)
 
 
-class InternalDomainNameValidator(validation.Validator):
-    VALIDATION_INTERNAL_DOMAIN_NAME = validation.ValidationFinding(
-        validation.ValidationFindingSeverity.ERROR,
-        'cabf.internal_domain_name'
-    )
-
-    def __init__(self, *args, **kwargs):
-        self._psl = publicsuffixlist.PublicSuffixList(accept_unknown=False)
-
-        super().__init__(validations=[self.VALIDATION_INTERNAL_DOMAIN_NAME], **kwargs)
-
-    def extract_domain_name(self, node):
-        return str(node.pdu)
-
-    def validate_with_value(self, node, value):
-        if self._psl.publicsuffix(value) is None:
-            raise validation.ValidationFindingEncountered(
-                self.VALIDATION_INTERNAL_DOMAIN_NAME,
-                f'Internal domain name: "{value}"'
-            )
-
-    def validate(self, node):
-        domain_name = self.extract_domain_name(node)
-
-        return self.validate_with_value(node, domain_name)
-
-
-class GeneralNameDnsNameInternalDomainNameValidator(InternalDomainNameValidator):
-    def __init__(self, allow_onion_tld=False):
-        self._allow_onion_tld = allow_onion_tld
-
-        super().__init__(predicate=general_name.create_generalname_type_predicate('dNSName'))
-
-    def validate_with_value(self, node, value):
-        if len(value) == 0 and general_name.is_nameconstraints_child_node(node):
-            return
-        else:
-            if self._allow_onion_tld and value.lower().endswith('.onion'):
-                return
-            else:
-                return super().validate_with_value(node, value)
-
-
-class UriInternalDomainNameValidator(InternalDomainNameValidator):
-    def __init__(self, *args, **kwargs):
-        super().__init__(*args, **kwargs)
-
-    def extract_domain_name(self, node):
-        return urlparse(str(node.pdu)).hostname or ''
-
-
-class GeneralNameUriInternalDomainNameValidator(InternalDomainNameValidator):
-    def __init__(self):
-        super().__init__(predicate=general_name.create_generalname_type_predicate('uniformResourceIdentifier'))
-
-    def extract_domain_name(self, node):
-        if general_name.is_nameconstraints_child_node(node):
-            return str(node.pdu).lstrip('.')
-        else:
-            return urlparse(str(node.pdu)).hostname or ''
-
-    def validate_with_value(self, node, value):
-        if len(value) == 0 and general_name.is_nameconstraints_child_node(node):
-            return
-        else:
-            return super().validate_with_value(node, value)
-
-
-class EmailAddressInternalDomainNameValidator(InternalDomainNameValidator):
-    def __init__(self, *args, **kwargs):
-        super().__init__(*args, **kwargs)
-
-    def extract_domain_name(self, node):
-        parts = str(node.pdu).split('@', maxsplit=1)
-
-        return parts[1] if len(parts) == 2 else ''
-
-
-class GeneralNameRfc822NameInternalDomainNameValidator(EmailAddressInternalDomainNameValidator):
-    def __init__(self):
-        super().__init__(predicate=general_name.create_generalname_type_predicate('rfc822Name'))
-
-    def extract_domain_name(self, node):
-        if general_name.is_nameconstraints_child_node(node):
-            return str(node.pdu).lstrip('.')
-        else:
-            return super().extract_domain_name(node)
-
-    def validate_with_value(self, node, value):
-        if len(value) == 0 and general_name.is_nameconstraints_child_node(node):
-            return
-        else:
-            super().validate_with_value(node, value)
-
-
-class SmtpUtf8MailboxInternalDomainNameValidator(EmailAddressInternalDomainNameValidator):
-    def __init__(self):
-        super().__init__(pdu_class=rfc8398.SmtpUTF8Mailbox)
-
-    def extract_domain_name(self, node):
-        domain_part = super().extract_domain_name(node)
-
-        return domain_part.encode('idna').decode()
-
-
-class InternalIpAddressValidator(validation.Validator):
-    VALIDATION_INTERNAL_IP_ADDRESS = validation.ValidationFinding(
-        validation.ValidationFindingSeverity.ERROR,
-        'cabf.internal_ip_address'
-    )
-
-    def __init__(self, *args, **kwargs):
-        super().__init__(validations=self.VALIDATION_INTERNAL_IP_ADDRESS, **kwargs)
-
-    @staticmethod
-    def _extract_ip_address(node):
-        octets = node.pdu.asOctets()
-
-        if len(octets) == 4:
-            return ipaddress.IPv4Address(octets)
-        else:
-            return ipaddress.IPv6Address(octets)
-
-    def validate(self, node):
-        ip_addr = InternalIpAddressValidator._extract_ip_address(node)
-
-        if not ip_addr.is_global:
-            raise validation.ValidationFindingEncountered(
-                self.VALIDATION_INTERNAL_IP_ADDRESS,
-                f'Internal IP address: "{ip_addr}"'
-            )
-
-
-class GeneralNameInternalIpAddressValidator(InternalIpAddressValidator):
-    def __init__(self):
-        super().__init__(predicate=general_name.create_generalname_type_predicate('iPAddress'))
-
-    def validate(self, node):
-        if general_name.is_nameconstraints_child_node(node):
-            return
-
-        super().validate(node)
-
-
-class OrganizationNameTruncatedLegalNameValidator(validation.Validator):
-    VALIDATION_ORGANIZATION_NAME_TRUNCATED_LEGAL_NAME = validation.ValidationFinding(
-        validation.ValidationFindingSeverity.ERROR,
-        'cabf.organization_name_no_closing_parenthesis'
-    )
-
-    def __init__(self):
-        super().__init__(validations=[self.VALIDATION_ORGANIZATION_NAME_TRUNCATED_LEGAL_NAME],
-                         pdu_class=rfc5280.X520OrganizationName)
-
-    def validate(self, node):
-        _, value_node = node.child
-
-        value = unicodedata.normalize('NFC', str(value_node.pdu))
-
-        open_paren_idx = value.find('(')
-        if open_paren_idx < 0:
-            return
+VALIDATION_INTERNAL_IP_ADDRESS = validation.ValidationFinding(
+    validation.ValidationFindingSeverity.ERROR,
+    'cabf.internal_ip_address'
+)
 
-        close_paren_idx = value.find(')', open_paren_idx)
 
-        if close_paren_idx < 0:
-            raise validation.ValidationFindingEncountered(
-                self.VALIDATION_ORGANIZATION_NAME_TRUNCATED_LEGAL_NAME,
-                f'Organization name attribute with truncated legal name: "{value}"'
-            )
+VALIDATION_INTERNAL_DOMAIN_NAME = validation.ValidationFinding(
+    validation.ValidationFindingSeverity.ERROR,
+    'cabf.internal_domain_name'
+)
diff --git a/pkilint/cabf/serverauth/__init__.py b/pkilint/cabf/serverauth/__init__.py
index 4b0a4a6..78547f5 100644
--- a/pkilint/cabf/serverauth/__init__.py
+++ b/pkilint/cabf/serverauth/__init__.py
@@ -1,7 +1,7 @@
 import typing
 from typing import List
 
-from pyasn1_alt_modules import rfc5280, rfc4985, rfc6962
+from pyasn1_alt_modules import rfc5280, rfc6962
 
 import pkilint.cabf.cabf_name
 import pkilint.cabf.serverauth.serverauth_extension
@@ -14,11 +14,10 @@
     serverauth_name, serverauth_extension, serverauth_constants,
     serverauth_key, serverauth_root, serverauth_ca, serverauth_ocsp, serverauth_cross_ca, serverauth_finding_filter
 )
+from pkilint.common import alternative_name
 from pkilint.pkix import name, certificate
 from pkilint.pkix.certificate import certificate_validity
 
-OTHER_NAME_MAPPINGS = rfc4985.otherNamesMap.copy()
-
 
 def _has_name_constraints(cert: certificate.RFC5280Certificate):
     return cert.get_extension_by_oid(rfc5280.id_ce_nameConstraints) is not None
@@ -65,7 +64,7 @@ def _determine_subscriber_certificate_type(cert: certificate.RFC5280Certificate)
         return (serverauth_constants.CertificateType.OV_PRE_CERTIFICATE if is_precert
                 else serverauth_constants.CertificateType.OV_FINAL_CERTIFICATE)
     else:
-        # "unknown" certificate types are consider to be DV Subscriber certs
+        # "unknown" certificate types are considered to be DV Subscriber certs
         return (serverauth_constants.CertificateType.DV_PRE_CERTIFICATE if is_precert
                 else serverauth_constants.CertificateType.DV_FINAL_CERTIFICATE)
 
@@ -83,23 +82,30 @@ def determine_certificate_type(cert: certificate.RFC5280Certificate) -> serverau
             return _determine_subscriber_certificate_type(cert)
 
 
-def create_decoding_validators():
+def create_decoding_validators(additional_validators=None):
+    if additional_validators is None:
+        additional_validators = []
+
+    additional_validators.append(
+        certificate.create_qc_statements_decoder(pkilint.etsi.asn1.ETSI_QC_STATEMENTS_MAPPINGS)
+    )
+
     return pkilint.pkix.certificate.create_decoding_validators(
         cabf.NAME_ATTRIBUTE_MAPPINGS,
         cabf.EXTENSION_MAPPINGS,
-        [certificate.create_other_name_decoder(OTHER_NAME_MAPPINGS),
-         certificate.create_qc_statements_decoder(etsi.ETSI_QC_STATEMENTS_MAPPINGS)]
+        additional_validators
     )
 
 
-def create_top_level_certificate_validators(certificate_type: serverauth_constants.CertificateType):
+def create_top_level_certificate_validators(certificate_type: serverauth_constants.CertificateType,
+                                            additional_validators=None):
+    if additional_validators is None:
+        additional_validators = []
+
     validators = [
         serverauth_key.ServerauthAllowedSignatureAlgorithmEncodingValidator(
             path='certificate.tbsCertificate.signature'
         ),
-        serverauth_key.ServerauthAllowedSignatureAlgorithmEncodingValidator(
-            path='certificate.signatureValue'
-        ),
         cabf_extension.CabfExtensionsPresenceValidator(),
     ]
 
@@ -116,18 +122,23 @@ def create_top_level_certificate_validators(certificate_type: serverauth_constan
     else:
         raise ValueError(f'Unsupported certificate type: {certificate_type}')
 
-    return validators
+    return validators + additional_validators
 
 
-def create_spki_validator_container():
-    return validation.ValidatorContainer(validators=[
-        serverauth_key.ServerauthAllowedPublicKeyAlgorithmEncodingValidator(
-            path='certificate.tbsCertificate.subjectPublicKeyInfo.algorithm'
-        ),
-        cabf_key.RsaKeyValidator(),
-        cabf_key.EcdsaKeyValidator(),
-    ],
-        path='certificate.tbsCertificate.subjectPublicKeyInfo')
+def create_spki_validator_container(additional_validators=None):
+    if additional_validators is None:
+        additional_validators = []
+
+    return validation.ValidatorContainer(
+        validators=[
+            serverauth_key.ServerauthAllowedPublicKeyAlgorithmEncodingValidator(
+                path='certificate.tbsCertificate.subjectPublicKeyInfo.algorithm'
+            ),
+            cabf_key.RsaKeyValidator(),
+            cabf_key.EcdsaKeyValidator(),
+        ] + additional_validators,
+        path='certificate.tbsCertificate.subjectPublicKeyInfo'
+    )
 
 
 def create_subject_name_validators() -> List[validation.Validator]:
@@ -139,12 +150,16 @@ def create_subject_name_validators() -> List[validation.Validator]:
         serverauth_name.ValidJurisdictionCountryValidator(),
         cabf_name.ValidCountryValidator(),
         serverauth_name.ValidBusinessCategoryValidator(),
-        cabf_name.OrganizationIdentifierAttributeValidator(relax_stateprovince_syntax=False),
+        cabf_name.CabfOrganizationIdentifierAttributeValidator(),
         serverauth_name.ServerauthRelativeDistinguishedNameContainsOneElementValidator(),
     ]
 
 
-def create_ca_name_validator_container(certificate_type: serverauth_constants.CertificateType):
+def create_ca_name_validator_container(certificate_type: serverauth_constants.CertificateType,
+                                       additional_validators=None):
+    if additional_validators is None:
+        additional_validators = []
+
     validators = [
         serverauth_ca.CaRequiredSubjectAttributesValidator(certificate_type),
         serverauth_name.ServerauthDuplicateAttributeTypeValidator(certificate_type),
@@ -154,10 +169,14 @@ def create_ca_name_validator_container(certificate_type: serverauth_constants.Ce
     if certificate_type == serverauth_constants.CertificateType.ROOT_CA:
         validators.append(serverauth_root.RootSubjectIssuerIdenticalEncodingValidator())
 
-    return certificate.create_subject_validator_container(validators)
+    return certificate.create_subject_validator_container(validators + additional_validators)
+
 
+def create_subscriber_name_validator_container(certificate_type: serverauth_constants.CertificateType,
+                                               additional_validators=None):
+    if additional_validators is None:
+        additional_validators = []
 
-def create_subscriber_name_validator_container(certificate_type: serverauth_constants.CertificateType):
     validators = create_subject_name_validators()
     validators.extend([
         serverauth_subscriber.SubscriberCommonNameValidator(),
@@ -168,7 +187,7 @@ def create_subscriber_name_validator_container(certificate_type: serverauth_cons
         validators.extend([
             serverauth_subscriber.EvSubscriberAttributeAllowanceValidator(),
             serverauth_subscriber.EvSubscriberJurisdictionPresenceValidator(),
-            serverauth_name.OrganizationIdentifierConsistentSubjectAndExtensionValidator()
+            pkilint.cabf.serverauth.serverauth_subscriber.OrganizationIdentifierConsistentSubjectAndExtensionValidator()
         ])
     elif certificate_type in serverauth_constants.IV_CERTIFICATE_TYPES:
         validators.append(serverauth_subscriber.IvSubscriberAttributeAllowanceValidator())
@@ -182,7 +201,7 @@ def create_subscriber_name_validator_container(certificate_type: serverauth_cons
     if certificate_type in serverauth_constants.IDENTITY_CERTIFICATE_TYPES:
         validators.append(serverauth_subscriber.IdentityCertificateStateProvinceAndLocalityPresenceValidator())
 
-    return certificate.create_subject_validator_container(validators)
+    return certificate.create_subject_validator_container(validators + additional_validators)
 
 
 def create_extension_validators() -> List[validation.Validator]:
@@ -193,11 +212,12 @@ def create_extension_validators() -> List[validation.Validator]:
         serverauth_extension.AuthorityInformationAccessHttpUriLocationValidator(),
         serverauth_extension.AuthorityInformationAccessUniqueLocationValidator(),
         cabf_extension.CabfAuthorityKeyIdentifierValidator(),
-        cabf_name.GeneralNameDnsNameInternalDomainNameValidator(allow_onion_tld=True),
-        cabf_name.GeneralNameRfc822NameInternalDomainNameValidator(),
-        cabf_name.GeneralNameUriInternalDomainNameValidator(),
-        cabf_name.UriInternalDomainNameValidator(pdu_class=rfc5280.CPSuri),
-        cabf_name.GeneralNameInternalIpAddressValidator(),
+        alternative_name.create_internal_name_validator_container(
+            cabf_name.VALIDATION_INTERNAL_DOMAIN_NAME,
+            cabf_name.VALIDATION_INTERNAL_IP_ADDRESS,
+            allow_onion_tld=True
+        ),
+        alternative_name.create_cpsuri_internal_domain_name_validator(cabf_name.VALIDATION_INTERNAL_DOMAIN_NAME),
         serverauth_extension.CertificatePolicyQualifierValidator(),
         cabf_extension.CpsUriHttpValidator(),
         serverauth_name.DnsNameLdhLabelSyntaxValidator(),
@@ -207,8 +227,12 @@ def create_extension_validators() -> List[validation.Validator]:
 
 def create_ca_extension_validator_container(
         certificate_type: serverauth_constants.CertificateType,
-        validity_period_start_retriever: document.ValidityPeriodStartRetriever
+        validity_period_start_retriever: document.ValidityPeriodStartRetriever,
+        additional_validators=None
 ):
+    if additional_validators is None:
+        additional_validators = []
+
     validators = create_extension_validators()
 
     validators.extend([
@@ -241,13 +265,16 @@ def create_ca_extension_validator_container(
     if certificate_type in serverauth_constants.CONSTRAINED_TLS_CA_TYPES:
         validators.append(serverauth_ca.TlsCaTechnicallyConstrainedValidator())
 
-    return certificate.create_extensions_validator_container(validators)
+    return certificate.create_extensions_validator_container(validators + additional_validators)
 
 
 def create_subscriber_extension_validator_container(
         certificate_type: serverauth_constants.CertificateType,
-        validity_period_start_retriever: document.ValidityPeriodStartRetriever
-):
+        validity_period_start_retriever: document.ValidityPeriodStartRetriever,
+        additional_validators=None):
+    if additional_validators is None:
+        additional_validators = []
+
     validators = create_extension_validators()
 
     validators.extend([
@@ -269,10 +296,13 @@ def create_subscriber_extension_validator_container(
     else:
         validators.append(serverauth_subscriber.SubscriberSanGeneralNameTypeValidator())
 
-    return certificate.create_extensions_validator_container(validators)
+    return certificate.create_extensions_validator_container(validators + additional_validators)
 
 
-def create_ocsp_extension_validator_container():
+def create_ocsp_extension_validator_container(additional_validators=None):
+    if additional_validators is None:
+        additional_validators = []
+
     validators = create_extension_validators()
 
     validators.extend([
@@ -282,10 +312,13 @@ def create_ocsp_extension_validator_container():
         serverauth_ocsp.OcspBasicConstraintsValidator(),
     ])
 
-    return certificate.create_extensions_validator_container(validators)
+    return certificate.create_extensions_validator_container(validators + additional_validators)
+
 
+def create_validity_validator_container(certificate_type, additional_validators=None):
+    if additional_validators is None:
+        additional_validators = []
 
-def create_validity_validator_container(certificate_type):
     validators = []
 
     if certificate_type == serverauth_constants.CertificateType.ROOT_CA:
@@ -293,73 +326,131 @@ def create_validity_validator_container(certificate_type):
     elif certificate_type in serverauth_constants.SUBSCRIBER_CERTIFICATE_TYPES:
         validators.append(serverauth_subscriber.SubscriberValidityPeriodValidator())
 
-    return certificate.create_validity_validator_container(validators)
+    return certificate.create_validity_validator_container(validators + additional_validators)
 
 
-def create_root_ca_validators(validity_period_start_retriever: document.ValidityPeriodStartRetriever):
+def create_root_ca_validators(
+        validity_period_start_retriever: document.ValidityPeriodStartRetriever,
+        additional_validity_validators=None, additional_spki_validators=None, additional_name_validators=None,
+        additional_extension_validators=None, additional_top_level_validators=None
+):
     return [
-        create_validity_validator_container(serverauth_constants.CertificateType.ROOT_CA),
-        create_spki_validator_container(),
-        create_ca_name_validator_container(serverauth_constants.CertificateType.ROOT_CA),
+        create_validity_validator_container(
+            serverauth_constants.CertificateType.ROOT_CA, additional_validity_validators
+        ),
+        create_spki_validator_container(additional_spki_validators),
+        create_ca_name_validator_container(serverauth_constants.CertificateType.ROOT_CA, additional_name_validators),
         create_ca_extension_validator_container(
-            serverauth_constants.CertificateType.ROOT_CA, validity_period_start_retriever
+            serverauth_constants.CertificateType.ROOT_CA,
+            validity_period_start_retriever,
+            additional_extension_validators
         ),
-    ] + create_top_level_certificate_validators(serverauth_constants.CertificateType.ROOT_CA)
+    ] + create_top_level_certificate_validators(
+        serverauth_constants.CertificateType.ROOT_CA, additional_top_level_validators
+    )
 
 
-def create_intermediate_ca_validators(
-        certificate_type: serverauth_constants.CertificateType,
-        validity_period_start_retriever: document.ValidityPeriodStartRetriever
-):
+def create_intermediate_ca_validators(certificate_type: serverauth_constants.CertificateType,
+                                      validity_period_start_retriever: document.ValidityPeriodStartRetriever,
+                                      additional_validity_validators=None, additional_spki_validators=None,
+                                      additional_name_validators=None,
+                                      additional_extension_validators=None, additional_top_level_validators=None
+                                      ):
     return [
-        create_validity_validator_container(certificate_type),
-        create_spki_validator_container(),
-        create_ca_name_validator_container(certificate_type),
-        create_ca_extension_validator_container(certificate_type, validity_period_start_retriever),
-    ] + create_top_level_certificate_validators(certificate_type)
+        create_validity_validator_container(certificate_type, additional_validity_validators),
+        create_spki_validator_container(additional_spki_validators),
+        create_ca_name_validator_container(certificate_type, additional_name_validators),
+        create_ca_extension_validator_container(
+            certificate_type,
+            validity_period_start_retriever,
+            additional_extension_validators
+        ),
+    ] + create_top_level_certificate_validators(certificate_type, additional_top_level_validators)
 
 
-def create_subscriber_validators(
-        certificate_type: serverauth_constants.CertificateType,
-        validity_period_start_retriever: document.ValidityPeriodStartRetriever
-):
+def create_subscriber_validators(certificate_type: serverauth_constants.CertificateType,
+                                 validity_period_start_retriever: document.ValidityPeriodStartRetriever,
+                                 additional_validity_validators=None, additional_spki_validators=None,
+                                 additional_name_validators=None,
+                                 additional_extension_validators=None, additional_top_level_validators=None
+                                 ):
     return [
-        create_validity_validator_container(certificate_type),
-        create_spki_validator_container(),
-        create_subscriber_name_validator_container(certificate_type),
-        create_subscriber_extension_validator_container(certificate_type, validity_period_start_retriever),
-    ] + create_top_level_certificate_validators(certificate_type)
+        create_validity_validator_container(certificate_type, additional_validity_validators),
+        create_spki_validator_container(additional_spki_validators),
+        create_subscriber_name_validator_container(certificate_type, additional_name_validators),
+        create_subscriber_extension_validator_container(
+            certificate_type,
+            validity_period_start_retriever,
+            additional_extension_validators
+        ),
+    ] + create_top_level_certificate_validators(certificate_type, additional_top_level_validators)
 
 
-def create_ocsp_responder_validators():
+def create_ocsp_responder_validators(
+        additional_validity_validators=None, additional_spki_validators=None,
+        additional_name_validators=None,
+        additional_extension_validators=None, additional_top_level_validators=None
+):
     return [
-        create_validity_validator_container(serverauth_constants.CertificateType.OCSP_RESPONDER),
-        create_spki_validator_container(),
-        create_ca_name_validator_container(serverauth_constants.CertificateType.OCSP_RESPONDER),
-        create_ocsp_extension_validator_container(),
-    ] + create_top_level_certificate_validators(serverauth_constants.CertificateType.OCSP_RESPONDER)
+        create_validity_validator_container(
+            serverauth_constants.CertificateType.OCSP_RESPONDER, additional_validity_validators
+        ),
+        create_spki_validator_container(additional_spki_validators),
+        create_ca_name_validator_container(
+            serverauth_constants.CertificateType.OCSP_RESPONDER, additional_name_validators
+        ),
+        create_ocsp_extension_validator_container(additional_extension_validators),
+    ] + create_top_level_certificate_validators(
+        serverauth_constants.CertificateType.OCSP_RESPONDER, additional_top_level_validators
+    )
 
 
-def create_validators(
-        certificate_type: serverauth_constants.CertificateType,
-        validity_period_start_retriever: typing.Optional[document.ValidityPeriodStartRetriever] = None
-):
+def create_validators(certificate_type: serverauth_constants.CertificateType,
+                      validity_period_start_retriever: typing.Optional[document.ValidityPeriodStartRetriever] = None,
+                      additional_validity_validators=None, additional_spki_validators=None,
+                      additional_name_validators=None,
+                      additional_extension_validators=None, additional_top_level_validators=None
+                      ):
     if validity_period_start_retriever is None:
         validity_period_start_retriever = certificate_validity.CertificateValidityPeriodStartRetriever()
 
     if certificate_type == serverauth_constants.CertificateType.ROOT_CA:
-        return create_root_ca_validators(validity_period_start_retriever)
+        return create_root_ca_validators(
+            validity_period_start_retriever,
+            additional_validity_validators, additional_spki_validators,
+            additional_name_validators, additional_extension_validators,
+            additional_top_level_validators
+        )
     elif certificate_type in serverauth_constants.INTERMEDIATE_CERTIFICATE_TYPES:
-        return create_intermediate_ca_validators(certificate_type, validity_period_start_retriever)
+        return create_intermediate_ca_validators(
+            certificate_type,
+            validity_period_start_retriever,
+            additional_validity_validators,
+            additional_spki_validators,
+            additional_name_validators, additional_extension_validators,
+            additional_top_level_validators
+        )
     elif certificate_type in serverauth_constants.SUBSCRIBER_CERTIFICATE_TYPES:
-        return create_subscriber_validators(certificate_type, validity_period_start_retriever)
+        return create_subscriber_validators(
+            certificate_type,
+            validity_period_start_retriever,
+            additional_validity_validators,
+            additional_spki_validators,
+            additional_name_validators, additional_extension_validators,
+            additional_top_level_validators
+        )
     elif certificate_type == serverauth_constants.CertificateType.OCSP_RESPONDER:
-        return create_ocsp_responder_validators()
+        return create_ocsp_responder_validators(additional_validity_validators, additional_spki_validators,
+                                                additional_name_validators, additional_extension_validators,
+                                                additional_top_level_validators)
     else:
         raise ValueError(f'Unsupported certificate type: {certificate_type}')
 
 
-def create_serverauth_finding_filters(certificate_type: serverauth_constants.CertificateType):
+def create_serverauth_finding_filters(certificate_type: serverauth_constants.CertificateType, additional_filters=None):
+    if additional_filters is None:
+        additional_filters = []
+
     filters = [
         serverauth_finding_filter.NameConstraintsCriticalityFilter(),
         serverauth_finding_filter.PolicyQualifierPresentFilter(),
@@ -371,4 +462,4 @@ def create_serverauth_finding_filters(certificate_type: serverauth_constants.Cer
             serverauth_finding_filter.EndEntitySubjectKeyIdentifierMissingFilter(),
         ]
 
-    return filters
+    return filters + additional_filters
diff --git a/pkilint/cabf/serverauth/finding_metadata.csv b/pkilint/cabf/serverauth/finding_metadata.csv
index c44f9ce..049db01 100644
--- a/pkilint/cabf/serverauth/finding_metadata.csv
+++ b/pkilint/cabf/serverauth/finding_metadata.csv
@@ -128,10 +128,7 @@ ERROR,cabf.serverauth.organization_identifier_ext_invalid_country,Validates that
 ERROR,cabf.serverauth.organization_identifier_ext_invalid_registration_scheme,Validates that the content of the CA/B Forum organizationIdentifier extension conforms with EVG 9.8.2.
 ERROR,cabf.serverauth.organization_identifier_ext_invalid_state_province_for_scheme,Validates that the content of the CA/B Forum organizationIdentifier extension conforms with EVG 9.8.2.
 ERROR,cabf.serverauth.organization_identifier_extension_absent,"Validates that the content of the organizationIdentifier subject attributes and the organizationIdentifier extension are consistent, as per EVG 9.2.8 and 9.2.9."
-ERROR,cabf.serverauth.organization_identifier_mismatched_country_code,"Validates that the content of the organizationIdentifier subject attributes and the organizationIdentifier extension are consistent, as per EVG 9.2.8 and 9.2.9."
-ERROR,cabf.serverauth.organization_identifier_mismatched_registration_reference,"Validates that the content of the organizationIdentifier subject attributes and the organizationIdentifier extension are consistent, as per EVG 9.2.8 and 9.2.9."
-ERROR,cabf.serverauth.organization_identifier_mismatched_scheme,"Validates that the content of the organizationIdentifier subject attributes and the organizationIdentifier extension are consistent, as per EVG 9.2.8 and 9.2.9."
-ERROR,cabf.serverauth.organization_identifier_mismatched_state_province,"Validates that the content of the organizationIdentifier subject attributes and the organizationIdentifier extension are consistent, as per EVG 9.2.8 and 9.2.9."
+ERROR,cabf.serverauth.organization_identifier_mismatched_value,"Validates that the content of the organizationIdentifier subject attributes and the organizationIdentifier extension are consistent, as per EVG 9.2.8 and 9.2.9."
 ERROR,cabf.serverauth.ov.country_attribute_absent,Validates that the content of the subject field conforms with BR 7.1.7.4.: A required element is absent
 ERROR,cabf.serverauth.ov.given_name_attribute_present,Validates that the content of the subject field conforms with BR 7.1.7.4.: A prohibited element is present
 ERROR,cabf.serverauth.ov.organization_name_attribute_absent,Validates that the content of the subject field conforms with BR 7.1.7.4.: A required element is absent
diff --git a/pkilint/cabf/serverauth/serverauth_name.py b/pkilint/cabf/serverauth/serverauth_name.py
index 2d2f7cc..3ab329b 100644
--- a/pkilint/cabf/serverauth/serverauth_name.py
+++ b/pkilint/cabf/serverauth/serverauth_name.py
@@ -5,9 +5,9 @@
 from cryptography.hazmat.primitives import hashes
 from pyasn1_alt_modules import rfc5280
 
-from pkilint import validation, document
+from pkilint import validation
 from pkilint.cabf.asn1 import ev_guidelines
-from pkilint.cabf.cabf_name import ValidCountryCodeValidatorBase, ORG_ID_REGEX
+from pkilint.cabf.cabf_name import ValidCountryCodeValidatorBase
 from pkilint.cabf.serverauth import serverauth_constants
 from pkilint.itu import x520_name
 from pkilint.pkix import name, general_name
@@ -61,127 +61,6 @@ def validate(self, node):
             )
 
 
-class OrganizationIdentifierConsistentSubjectAndExtensionValidator(validation.Validator):
-    """Validates that the content of the organizationIdentifier subject attributes and the organizationIdentifier
-    extension are consistent, as per EVG 9.2.8 and 9.2.9."""
-
-    VALIDATION_CABF_ORG_ID_NO_EXT = validation.ValidationFinding(
-        validation.ValidationFindingSeverity.ERROR,
-        'cabf.serverauth.organization_identifier_extension_absent'
-    )
-
-    VALIDATION_CABF_ORG_ID_INVALID_SYNTAX = validation.ValidationFinding(
-        validation.ValidationFindingSeverity.FATAL,
-        'cabf.serverauth.organization_identifier_invalid_syntax'
-    )
-
-    VALIDATION_CABF_ORG_ID_MISMATCHED_SCHEME = validation.ValidationFinding(
-        validation.ValidationFindingSeverity.ERROR,
-        'cabf.serverauth.organization_identifier_mismatched_scheme'
-    )
-
-    VALIDATION_CABF_ORG_ID_MISMATCHED_COUNTRY = validation.ValidationFinding(
-        validation.ValidationFindingSeverity.ERROR,
-        'cabf.serverauth.organization_identifier_mismatched_country_code'
-    )
-
-    VALIDATION_CABF_ORG_ID_MISMATCHED_SP = validation.ValidationFinding(
-        validation.ValidationFindingSeverity.ERROR,
-        'cabf.serverauth.organization_identifier_mismatched_state_province'
-    )
-
-    VALIDATION_CABF_ORG_ID_MISMATCHED_REFERENCE = validation.ValidationFinding(
-        validation.ValidationFindingSeverity.ERROR,
-        'cabf.serverauth.organization_identifier_mismatched_registration_reference'
-    )
-
-    def __init__(self):
-        super().__init__(
-            validations=[
-                self.VALIDATION_CABF_ORG_ID_NO_EXT,
-                self.VALIDATION_CABF_ORG_ID_INVALID_SYNTAX,
-                self.VALIDATION_CABF_ORG_ID_MISMATCHED_SCHEME,
-                self.VALIDATION_CABF_ORG_ID_MISMATCHED_COUNTRY,
-                self.VALIDATION_CABF_ORG_ID_MISMATCHED_SP,
-                self.VALIDATION_CABF_ORG_ID_MISMATCHED_REFERENCE,
-            ],
-            pdu_class=x520_name.X520OrganizationIdentifier,
-            predicate=lambda n: any(n.children)
-        )
-
-    def validate(self, node):
-        ext_and_idx = node.document.get_extension_by_oid(
-            ev_guidelines.id_CABFOrganizationIdentifier
-        )
-
-        if ext_and_idx is None:
-            raise validation.ValidationFindingEncountered(
-                self.VALIDATION_CABF_ORG_ID_NO_EXT
-            )
-
-        ext, _ = ext_and_idx
-        try:
-            ext = ext.navigate('extnValue.cABFOrganizationIdentifier')
-        except document.PDUNavigationFailedError:
-            return
-
-        attr_value = str(node.child[1].pdu)
-
-        m = ORG_ID_REGEX.match(attr_value)
-        if m is None:
-            raise validation.ValidationFindingEncountered(
-                self.VALIDATION_CABF_ORG_ID_INVALID_SYNTAX,
-                f'Invalid syntax: "{attr_value}"'
-            )
-
-        findings = []
-        ext_scheme = str(ext.children['registrationSchemeIdentifier'].pdu)
-        if m['scheme'] != ext_scheme:
-            findings.append(validation.ValidationFindingDescription(
-                self.VALIDATION_CABF_ORG_ID_MISMATCHED_SCHEME,
-                f'Mismatched scheme: subject: "{m["scheme"]}", extension: '
-                f'"{ext_scheme}"'
-            ))
-
-        ext_country = str(ext.children['registrationCountry'].pdu)
-        if m['country'] != ext_country:
-            findings.append(validation.ValidationFindingDescription(
-                self.VALIDATION_CABF_ORG_ID_MISMATCHED_COUNTRY,
-                f'Mismatched country: subject: "{m["country"]}", extension: '
-                f'"{ext_country}"'
-            ))
-
-        ext_sp_node = ext.children.get('registrationStateOrProvince')
-        ext_sp = None if ext_sp_node is None else str(ext_sp_node.pdu)
-        if m['sp'] is None and ext_sp is not None:
-            findings.append(validation.ValidationFindingDescription(
-                self.VALIDATION_CABF_ORG_ID_MISMATCHED_SP,
-                'Extension has state/province value but subject does not'
-            ))
-        elif m['sp'] is not None and ext_sp is None:
-            findings.append(validation.ValidationFindingDescription(
-                self.VALIDATION_CABF_ORG_ID_MISMATCHED_SP,
-                'Extension does not have state/province value but subject does'
-            ))
-        elif m['sp'] is not None and ext_sp is not None:
-            if ext_sp != m['sp']:
-                findings.append(validation.ValidationFindingDescription(
-                    self.VALIDATION_CABF_ORG_ID_MISMATCHED_SP,
-                    f'Mismatched state/province value: subject: "{m["sp"]}", '
-                    f'extension: "{ext_sp}"'
-                ))
-
-        ext_reg_ref = str(ext.children['registrationReference'].pdu)
-        if m['reference'] != ext_reg_ref:
-            findings.append(validation.ValidationFindingDescription(
-                self.VALIDATION_CABF_ORG_ID_MISMATCHED_REFERENCE,
-                f'Mismatched Registration Reference: subject: "{m["reference"]}"'
-                f', extension: "{ext_reg_ref}"'
-            ))
-
-        return validation.ValidationResult(self, node, findings)
-
-
 class X520NameAttributeValueLengthValidator(validation.Validator):
     """Validates that the length of X520Name values does not exceed the limit stated in BR 7.1.4.2."""
 
diff --git a/pkilint/cabf/serverauth/serverauth_ocsp.py b/pkilint/cabf/serverauth/serverauth_ocsp.py
index 34372e6..ae3f39d 100644
--- a/pkilint/cabf/serverauth/serverauth_ocsp.py
+++ b/pkilint/cabf/serverauth/serverauth_ocsp.py
@@ -4,7 +4,7 @@
 from pkilint import validation, common
 from pkilint.itu import bitstring
 from pkilint.pkix import Rfc2119Word
-
+from pkilint.pkix.certificate.certificate_extension import KeyUsageBitName
 
 _CODE_CLASSIFIER = 'cabf.serverauth.ocsp_responder'
 
@@ -24,14 +24,14 @@ class OcspResponderKeyUsageValidator(validation.Validator):
 
     _PROHIBITED_KUS = {
                           str(n) for n in rfc5280.KeyUsage.namedValues
-                      } - {'digitalSignature'}
+                      } - {KeyUsageBitName.DIGITAL_SIGNATURE}
 
     def __init__(self):
         super().__init__(validations=[self.VALIDATION_DIGSIG_MISSING, self.VALIDATION_PROHIBITED_KU_PRESENT],
                          pdu_class=rfc5280.KeyUsage)
 
     def validate(self, node):
-        if not bitstring.has_named_bit(node, 'digitalSignature'):
+        if not bitstring.has_named_bit(node, KeyUsageBitName.DIGITAL_SIGNATURE):
             raise validation.ValidationFindingEncountered(self.VALIDATION_DIGSIG_MISSING)
 
         prohibited_kus_asserted = sorted((k for k in self._PROHIBITED_KUS if bitstring.has_named_bit(node, k)))
diff --git a/pkilint/cabf/serverauth/serverauth_subscriber.py b/pkilint/cabf/serverauth/serverauth_subscriber.py
index 4753308..606a388 100644
--- a/pkilint/cabf/serverauth/serverauth_subscriber.py
+++ b/pkilint/cabf/serverauth/serverauth_subscriber.py
@@ -1,89 +1,52 @@
-import ipaddress
 import operator
 from datetime import timedelta
 
-from iso3166 import countries_by_alpha2
 from pyasn1_alt_modules import rfc5280, rfc6962, rfc5480
 
 import pkilint.common
 from pkilint import validation, document, oid, common
-from pkilint.cabf import cabf_constants
+from pkilint.cabf import cabf_name
 from pkilint.cabf.asn1 import ev_guidelines
-from pkilint.cabf.cabf_constants import REGISTRATION_SCHEMES
 from pkilint.cabf.serverauth import serverauth_constants
+from pkilint.common import organization_id, common_name
+from pkilint.common.organization_id import ParsedOrganizationIdentifier
 from pkilint.itu import x520_name, bitstring
 from pkilint.pkix import Rfc2119Word, general_name, time
+from pkilint.pkix.certificate.certificate_extension import KeyUsageBitName
 
 
-class CABFOrganizationIdentifierExtensionValidator(validation.Validator):
-    """Validates that the content of the CA/B Forum organizationIdentifier extension conforms with EVG 9.8.2."""
+def _parse_organization_identifier_extension(
+        ext_node: document.PDUNode) -> organization_id.ParsedOrganizationIdentifier:
+    state_province_node = ext_node.children.get('registrationStateOrProvince')
 
-    VALIDATION_ORGANIZATION_ID_INVALID_SCHEME = validation.ValidationFinding(
-        validation.ValidationFindingSeverity.ERROR,
-        'cabf.serverauth.organization_identifier_ext_invalid_registration_scheme'
-    )
+    state_province = str(state_province_node.pdu) if state_province_node else None
 
-    VALIDATION_ORGANIZATION_ID_INVALID_COUNTRY = validation.ValidationFinding(
-        validation.ValidationFindingSeverity.ERROR,
-        'cabf.serverauth.organization_identifier_ext_invalid_country'
-    )
+    reference_node = ext_node.children.get('registrationReference')
+    reference = str(reference_node.pdu) if reference_node else None
 
-    VALIDATION_ORGANIZATION_ID_INVALID_SP = validation.ValidationFinding(
-        validation.ValidationFindingSeverity.ERROR,
-        'cabf.serverauth.organization_identifier_ext_invalid_state_province_for_scheme'
+    return organization_id.ParsedOrganizationIdentifier(
+        raw=None,
+        scheme=str(ext_node.children['registrationSchemeIdentifier'].pdu),
+        is_national_scheme=False,
+        country=str(ext_node.children['registrationCountry'].pdu),
+        state_province=state_province,
+        reference=reference
     )
 
-    _ISO3166_AND_ARTICLE_215_COUNTRY_CODES = set(countries_by_alpha2.keys()) | {'EL', 'XI'}
+
+class CABFOrganizationIdentifierExtensionValidator(cabf_name.CabfOrganizationIdentifierValidatorBase):
+    """Validates that the content of the CA/B Forum organizationIdentifier extension conforms with EVG 9.8.2."""
 
     def __init__(self):
         super().__init__(
-            pdu_class=ev_guidelines.CABFOrganizationIdentifier,
-            validations=[
-                self.VALIDATION_ORGANIZATION_ID_INVALID_SCHEME,
-                self.VALIDATION_ORGANIZATION_ID_INVALID_COUNTRY,
-                self.VALIDATION_ORGANIZATION_ID_INVALID_SP,
-            ]
+            invalid_format_validation=None,
+            enforce_strict_state_province_format=True,
+            pdu_class=ev_guidelines.CABFOrganizationIdentifier
         )
 
-    def validate(self, node):
-        scheme = str(node.children['registrationSchemeIdentifier'].pdu)
-        country = str(node.children['registrationCountry'].pdu).upper()
-
-        scheme_node = node.children.get('registrationStateOrProvince')
-        sp = None if scheme_node is None else str(scheme_node.pdu)
-
-        scheme_info = REGISTRATION_SCHEMES.get(scheme)
-
-        if scheme_info is None:
-            raise validation.ValidationFindingEncountered(
-                self.VALIDATION_ORGANIZATION_ID_INVALID_SCHEME,
-                f'Invalid registration scheme: "{scheme}"'
-            )
-
-        if scheme_info.country_identifier_type == cabf_constants.RegistrationSchemeCountryIdentifierType.NONE:
-            valid_country_code = (country == '')
-        elif scheme_info.country_identifier_type == cabf_constants.RegistrationSchemeCountryIdentifierType.XG:
-            valid_country_code = (country == 'XG')
-        elif scheme_info.country_identifier_type == cabf_constants.RegistrationSchemeCountryIdentifierType.ISO3166:
-            if scheme == 'VAT':
-                valid_country_code = (country in self._ISO3166_AND_ARTICLE_215_COUNTRY_CODES)
-            else:
-                valid_country_code = country in countries_by_alpha2
-        else:
-            raise ValueError(f'Unknown country identifier type for scheme "{scheme}": '
-                             f'{scheme_info.country_identifier_type}')
-
-        if not valid_country_code:
-            raise validation.ValidationFindingEncountered(
-                self.VALIDATION_ORGANIZATION_ID_INVALID_COUNTRY,
-                f'Invalid country code for scheme "{scheme}": "{country}"'
-            )
-
-        if sp is not None and not scheme_info.allow_state_province:
-            raise validation.ValidationFindingEncountered(
-                self.VALIDATION_ORGANIZATION_ID_INVALID_SP,
-                f'Scheme "{scheme}" does not allow state/province values'
-            )
+    @classmethod
+    def parse_organization_id_node(cls, node: document.PDUNode) -> ParsedOrganizationIdentifier:
+        return _parse_organization_identifier_extension(node)
 
 
 class EvSubscriberAttributeAllowanceValidator(pkilint.common.AttributeIdentifierAllowanceValidator):
@@ -302,13 +265,13 @@ class SubscriberKeyUsageValidator(validation.Validator):
 
     _SPKI_OID_TO_KU_ALLOWANCES_MAPPING = {
         rfc5480.rsaEncryption: {
-            'digitalSignature': Rfc2119Word.SHOULD,
-            'keyEncipherment': Rfc2119Word.MAY,
-            'dataEncipherment': Rfc2119Word.SHOULD_NOT,
+            KeyUsageBitName.DIGITAL_SIGNATURE: Rfc2119Word.SHOULD,
+            KeyUsageBitName.KEY_ENCIPHERMENT: Rfc2119Word.MAY,
+            KeyUsageBitName.DATA_ENCIPHERMENT: Rfc2119Word.SHOULD_NOT,
         },
         rfc5480.id_ecPublicKey: {
-            'digitalSignature': Rfc2119Word.MUST,
-            'keyAgreement': Rfc2119Word.SHOULD_NOT,
+            KeyUsageBitName.DIGITAL_SIGNATURE: Rfc2119Word.MUST,
+            KeyUsageBitName.KEY_AGREEMENT: Rfc2119Word.SHOULD_NOT,
         },
     }
 
@@ -358,8 +321,8 @@ def validate(self, node):
                     ))
 
         if spki_alg_oid == rfc5480.rsaEncryption and (
-                bitstring.has_named_bit(node, 'digitalSignature') and
-                bitstring.has_named_bit(node, 'keyEncipherment')):
+                bitstring.has_named_bit(node, KeyUsageBitName.DIGITAL_SIGNATURE) and
+                bitstring.has_named_bit(node, KeyUsageBitName.KEY_ENCIPHERMENT)):
             warning_findings.append(
                 validation.ValidationFindingDescription(self.VALIDATION_RSA_DIGSIG_AND_KEYENCIPHERMENT_PRESENT, None)
             )
@@ -414,22 +377,26 @@ def validate(self, node):
 class SubscriberValidityPeriodValidator(time.ValidityPeriodThresholdsValidator):
     """Validates that the validity period conforms to BR 7.1.2.7."""
 
+    VALIDATION_VALIDITY_PERIOD_EXCEEDS_398_DAYS = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.ERROR,
+        'cabf.certificate_validity_period_exceeds_398_days'
+    )
+
+    VALIDATION_VALIDITY_PERIOD_EXCEEDS_397_DAYS = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.WARNING,
+        'cabf.certificate_validity_period_exceeds_397_days'
+    )
+
     _THRESHOLDS = [
         (
             operator.le,
             timedelta(days=398),
-            validation.ValidationFinding(
-                validation.ValidationFindingSeverity.ERROR,
-                'cabf.certificate_validity_period_exceeds_398_days'
-            )
+            VALIDATION_VALIDITY_PERIOD_EXCEEDS_398_DAYS
         ),
         (
             operator.le,
             timedelta(days=397),
-            validation.ValidationFinding(
-                validation.ValidationFindingSeverity.WARNING,
-                'cabf.certificate_validity_period_exceeds_397_days'
-            )
+            VALIDATION_VALIDITY_PERIOD_EXCEEDS_397_DAYS
         )
     ]
 
@@ -441,7 +408,7 @@ def __init__(self):
                          )
 
 
-class SubscriberCommonNameValidator(validation.Validator):
+class SubscriberCommonNameValidator(common_name.CommonNameValidator):
     """Validates that the content of the commonName attribute conforms to BR 7.1.4.3."""
 
     VALIDATION_COMMON_NAME_UNKNOWN_SOURCE = validation.ValidationFinding(
@@ -449,68 +416,10 @@ class SubscriberCommonNameValidator(validation.Validator):
         'cabf.serverauth.subscriber_common_name_unknown_source'
     )
 
-    VALIDATION_UNPARSED_CN_ENCOUNTERED = validation.ValidationFinding(
-        validation.ValidationFindingSeverity.NOTICE,
-        'cabf.serverauth.unparsed_common_name_encountered'
-    )
-
-    VALIDATION_UNPARSED_SAN_EXTENSION_ENCOUNTERED = validation.ValidationFinding(
-        validation.ValidationFindingSeverity.NOTICE,
-        'cabf.serverauth.unparsed_san_extension_encountered'
-    )
-
     def __init__(self):
         super().__init__(
-            validations=[self.VALIDATION_COMMON_NAME_UNKNOWN_SOURCE, self.VALIDATION_UNPARSED_CN_ENCOUNTERED,
-                         self.VALIDATION_UNPARSED_SAN_EXTENSION_ENCOUNTERED],
-            pdu_class=rfc5280.X520CommonName)
-
-    def validate(self, node):
-        # unparsed CN, return
-        if not any(node.children):
-            raise validation.ValidationFindingEncountered(self.VALIDATION_UNPARSED_CN_ENCOUNTERED)
-
-        _, value_node = node.child
-        value_str = str(value_node.pdu)
-
-        san_ext_and_idx = node.document.get_extension_by_oid(rfc5280.id_ce_subjectAltName)
-
-        if san_ext_and_idx is None:
-            raise validation.ValidationFindingEncountered(
-                self.VALIDATION_COMMON_NAME_UNKNOWN_SOURCE,
-                f'Unknown source for value of common name: "{value_str}"'
-            )
-
-        san_ext_node, _ = san_ext_and_idx
-
-        try:
-            san_value_node = san_ext_node.navigate('extnValue.subjectAltName')
-        except document.PDUNavigationFailedError:
-            # unparsed SAN extension, return
-            raise validation.ValidationFindingEncountered(self.VALIDATION_UNPARSED_SAN_EXTENSION_ENCOUNTERED)
-
-        for gn in san_value_node.children.values():
-            gn_type, gn_value = gn.child
-
-            if gn_type == 'dNSName' and str(gn_value.pdu) == value_str:
-                return
-            elif gn_type == 'iPAddress':
-                address_octets = gn_value.pdu.asOctets()
-
-                if len(address_octets) == 4:
-                    ip_addr = ipaddress.IPv4Address(address_octets)
-                elif len(address_octets) == 16:
-                    ip_addr = ipaddress.IPv6Address(address_octets)
-                else:
-                    # whoa Nellie! let the PKIX validator complain about this one
-                    continue
-
-                if str(ip_addr) == value_str:
-                    return
-
-        raise validation.ValidationFindingEncountered(
-            self.VALIDATION_COMMON_NAME_UNKNOWN_SOURCE,
-            f'Unknown source for value of common name: "{value_str}"'
+            {general_name.GeneralNameTypeName.DNS_NAME, general_name.GeneralNameTypeName.IP_ADDRESS},
+            self.VALIDATION_COMMON_NAME_UNKNOWN_SOURCE
         )
 
 
@@ -654,3 +563,66 @@ class SubscriberAuthorityInformationAccessAccessMethodPresenceValidator(
 
     def __init__(self):
         super().__init__(self._ACCESS_METHOD_ALLOWANCES, self._CODE_CLASSIFIER, Rfc2119Word.MUST_NOT)
+
+
+class OrganizationIdentifierConsistentSubjectAndExtensionValidator(validation.Validator):
+    """Validates that the content of the organizationIdentifier subject attributes and the organizationIdentifier
+    extension are consistent, as per EVG 9.2.8 and 9.2.9."""
+
+    VALIDATION_CABF_ORG_ID_NO_EXT = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.ERROR,
+        'cabf.serverauth.organization_identifier_extension_absent'
+    )
+
+    VALIDATION_CABF_ORG_ID_MISMATCHED_VALUE = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.ERROR,
+        'cabf.serverauth.organization_identifier_mismatched_value'
+    )
+
+    def __init__(self):
+        super().__init__(
+            validations=[
+                self.VALIDATION_CABF_ORG_ID_NO_EXT,
+                self.VALIDATION_CABF_ORG_ID_MISMATCHED_VALUE,
+            ],
+            pdu_class=x520_name.X520OrganizationIdentifier,
+            predicate=lambda n: any(n.children)
+        )
+
+    def validate(self, node):
+        ext_and_idx = node.document.get_extension_by_oid(
+            ev_guidelines.id_CABFOrganizationIdentifier
+        )
+
+        if ext_and_idx is None:
+            raise validation.ValidationFindingEncountered(
+                self.VALIDATION_CABF_ORG_ID_NO_EXT
+            )
+
+        ext_node, _ = ext_and_idx
+        try:
+            ext_node = ext_node.navigate('extnValue.cABFOrganizationIdentifier')
+        except document.PDUNavigationFailedError:
+            return
+
+        attr_value = str(node.child[1].pdu)
+
+        try:
+            org_id_attr_parsed = organization_id.parse_organization_identifier(attr_value)
+        except ValueError:
+            # let the format validator report this error
+            return
+
+        org_id_ext_parsed = _parse_organization_identifier_extension(ext_node)
+
+        try:
+            organization_id.assert_parsed_organization_identifier_equal(
+                org_id_attr_parsed, 'attribute', org_id_ext_parsed, 'extension'
+            )
+        except ValueError as e:
+            raise validation.ValidationFindingEncountered(
+                self.VALIDATION_CABF_ORG_ID_MISMATCHED_VALUE,
+                str(e)
+            )
+
+
diff --git a/pkilint/cabf/smime/__init__.py b/pkilint/cabf/smime/__init__.py
index 1cb1fbf..5c0a4fd 100644
--- a/pkilint/cabf/smime/__init__.py
+++ b/pkilint/cabf/smime/__init__.py
@@ -9,14 +9,16 @@
 import pkilint.cabf.cabf_extension
 import pkilint.cabf.smime.smime_extension
 import pkilint.common
+import pkilint.etsi.asn1
 import pkilint.pkix.certificate
-from pkilint import validation, cabf, document, etsi
+from pkilint import validation, cabf, document
 from pkilint.adobe import adobe_validator
 from pkilint.cabf import cabf_extension, cabf_key, cabf_name
 from pkilint.cabf.smime import (
     smime_constants, smime_name, smime_key, smime_extension
 )
 from pkilint.cabf.smime.smime_constants import Generation
+from pkilint.common import alternative_name
 from pkilint.iso import lei
 from pkilint.msft import asn1 as microsoft_asn1
 from pkilint.msft import msft_name
@@ -119,7 +121,7 @@ def create_decoding_validators():
         cabf.NAME_ATTRIBUTE_MAPPINGS,
         _SMIME_EXTENSION_MAPPINGS,
         [certificate.create_other_name_decoder(OTHER_NAME_MAPPINGS),
-         certificate.create_qc_statements_decoder(etsi.ETSI_QC_STATEMENTS_MAPPINGS)]
+         certificate.create_qc_statements_decoder(pkilint.etsi.asn1.ETSI_QC_STATEMENTS_MAPPINGS)]
     )
 
 
@@ -173,10 +175,14 @@ def create_extensions_validator_container(validation_level, generation):
             cabf_extension.CabfAuthorityKeyIdentifierValidator(),
             smime_extension.SubjectDirectoryAttributesPresenceValidator(validation_level, generation),
             smime_extension.QCStatementsCriticalityValidator(),
-            cabf_name.GeneralNameUriInternalDomainNameValidator(),
-            cabf_name.GeneralNameRfc822NameInternalDomainNameValidator(),
-            cabf_name.SmtpUtf8MailboxInternalDomainNameValidator(),
-            cabf_name.UriInternalDomainNameValidator(pdu_class=rfc5280.CPSuri),
+            alternative_name.create_internal_name_validator_container(
+                cabf_name.VALIDATION_INTERNAL_DOMAIN_NAME,
+                cabf_name.VALIDATION_INTERNAL_IP_ADDRESS,
+                allow_onion_tld=False
+            ),
+            alternative_name.create_cpsuri_internal_domain_name_validator(
+                cabf_name.VALIDATION_INTERNAL_DOMAIN_NAME
+            ),
             adobe_validator.AdobeTimestampValidator(),
             smime_extension.AdobeTimestampCriticalityValidator(),
             smime_extension.AdobeTimestampPresenceValidator(generation),
@@ -230,8 +236,5 @@ def create_subscriber_validators(validation_level, generation):
         smime_key.SmimeAllowedSignatureAlgorithmEncodingValidator(
             path='certificate.tbsCertificate.signature'
         ),
-        smime_key.SmimeAllowedSignatureAlgorithmEncodingValidator(
-            path='certificate.signatureValue'
-        ),
         cabf_extension.CabfExtensionsPresenceValidator(),
     ]
diff --git a/pkilint/cabf/smime/finding_metadata.csv b/pkilint/cabf/smime/finding_metadata.csv
index 75c258d..c9e5a17 100644
--- a/pkilint/cabf/smime/finding_metadata.csv
+++ b/pkilint/cabf/smime/finding_metadata.csv
@@ -8,7 +8,7 @@ ERROR,cabf.authority_key_identifier_has_issuer_cert,SMBR 7.1.2.3 (g),"""authorit
 ERROR,cabf.crldp_extension_missing,SMBR 7.1.2.3 (b),"""SHALL be present"""
 ERROR,cabf.internal_domain_name,,The use of an internal domain name (whose superior domain labels do not appear on the PSL)
 ERROR,cabf.invalid_country_code,,The use of a country code that does not appear on ISO 3166.
-ERROR,cabf.invalid_subject_organization_identifier_country,SMBR 7.1.4.2.2 (d),The use of a country code that is not allowed in the organizationIdentifier attribute
+ERROR,cabf.invalid_organization_identifier_country,SMBR 7.1.4.2.2 (d),The use of a country code that is not allowed in the organizationIdentifier attribute
 ERROR,cabf.invalid_subject_organization_identifier_encoding,SMBR 7.1.4.2.2 (d),The use of a legacy encoding for new subject names (which all S/MIME certificates will have)
 ERROR,cabf.invalid_subject_organization_identifier_format,SMBR 7.1.4.2.2 (d),The inclusion of a value which does not adhere to the specified attribute format
 ERROR,cabf.invalid_subject_organization_identifier_registration_scheme,SMBR 7.1.4.2.2 (d),The inclusion of a scheme which is not recognized
diff --git a/pkilint/cabf/smime/smime_extension.py b/pkilint/cabf/smime/smime_extension.py
index e19962e..c59830d 100644
--- a/pkilint/cabf/smime/smime_extension.py
+++ b/pkilint/cabf/smime/smime_extension.py
@@ -8,7 +8,9 @@
 from pkilint.cabf.smime.smime_constants import Generation, ValidationLevel
 from pkilint.cabf.smime.smime_name import get_email_addresses_from_san
 from pkilint.iso import lei
+from pkilint.itu import bitstring
 from pkilint.pkix import extension
+from pkilint.pkix.certificate.certificate_extension import KeyUsageBitName
 
 
 class CertificatePoliciesPresenceValidator(extension.ExtensionPresenceValidator):
@@ -277,25 +279,6 @@ def validate(self, node):
         return validation.ValidationResult(self, node, findings)
 
 
-def _has_bit(node, bit_name):
-    bit = rfc5280.KeyUsage.namedValues[bit_name]
-    return len(node.pdu) > bit and node.pdu[bit] != 0
-
-
-def _get_prohibited_kus(node, allowed_kus):
-    prohibited_kus = (
-        set(map(str, rfc5280.KeyUsage.namedValues)).difference(
-            allowed_kus
-        )
-    )
-
-    return [
-        pk
-        for pk in prohibited_kus
-        if _has_bit(node, pk)
-    ]
-
-
 class AllowedKeyUsageValidator(validation.Validator):
     VALIDATION_UNKNOWN_CERT_TYPE = validation.ValidationFinding(
         validation.ValidationFindingSeverity.ERROR,
@@ -317,6 +300,8 @@ class AllowedKeyUsageValidator(validation.Validator):
         'cabf.smime.unsupported_public_key_type'
     )
 
+    _ALL_KUS = {str(n) for n in rfc5280.KeyUsage.namedValues}
+
     def __init__(self, generation):
         super().__init__(
             validations=[
@@ -330,37 +315,41 @@ def __init__(self, generation):
 
         self._generation = generation
 
+    @classmethod
+    def _get_prohibited_kus(cls, node, allowed_kus):
+        return {
+            pk
+            for pk in cls._ALL_KUS - allowed_kus
+            if bitstring.has_named_bit(node, pk)
+        }
+
     def validate(self, node):
         spki_alg_oid = node.navigate(
             ':certificate.tbsCertificate.subjectPublicKeyInfo.algorithm.algorithm'
         ).pdu
 
-        DS = 'digitalSignature'
-        NR = 'nonRepudiation'
-        DE = 'dataEncipherment'
-        KE = 'keyEncipherment'
-        KA = 'keyAgreement'
-        EO = 'encipherOnly'
-        DO = 'decipherOnly'
-
-        allowed_kus = {DS}
-        is_signing_cert = _has_bit(node, DS)
+        allowed_kus = {KeyUsageBitName.DIGITAL_SIGNATURE}
+        is_signing_cert = bitstring.has_named_bit(node, KeyUsageBitName.DIGITAL_SIGNATURE)
 
         if is_signing_cert:
-            allowed_kus.add(NR)
+            allowed_kus.add(KeyUsageBitName.NON_REPUDIATION)
 
         if spki_alg_oid == rfc3279.rsaEncryption:
-            allowed_kus.add(KE)
+            allowed_kus.add(KeyUsageBitName.KEY_ENCIPHERMENT)
 
-            is_key_mgmt_cert = _has_bit(node, KE)
+            is_key_mgmt_cert = bitstring.has_named_bit(node, KeyUsageBitName.KEY_ENCIPHERMENT)
 
             if is_key_mgmt_cert and self._generation != Generation.STRICT:
-                allowed_kus.add(DE)
+                allowed_kus.add(KeyUsageBitName.DATA_ENCIPHERMENT)
         elif spki_alg_oid == rfc5480.id_ecPublicKey:
-            is_key_mgmt_cert = _has_bit(node, KA)
+            is_key_mgmt_cert = bitstring.has_named_bit(node, KeyUsageBitName.KEY_AGREEMENT)
 
             if is_key_mgmt_cert:
-                allowed_kus.update({EO, DO, KA})
+                allowed_kus.update({
+                    KeyUsageBitName.ENCIPHER_ONLY,
+                    KeyUsageBitName.DECIPHER_ONLY,
+                    KeyUsageBitName.KEY_AGREEMENT,
+                })
         elif spki_alg_oid in {rfc8410.id_Ed448, rfc8410.id_Ed25519}:
             is_key_mgmt_cert = False
         else:
@@ -369,7 +358,7 @@ def validate(self, node):
         if not is_signing_cert and not is_key_mgmt_cert:
             raise validation.ValidationFindingEncountered(self.VALIDATION_UNKNOWN_CERT_TYPE)
 
-        prohibited_kus = _get_prohibited_kus(node, allowed_kus)
+        prohibited_kus = self._get_prohibited_kus(node, allowed_kus)
 
         if len(prohibited_kus) > 0:
             ku_str = ', '.join(sorted(prohibited_kus))
diff --git a/pkilint/cabf/smime/smime_name.py b/pkilint/cabf/smime/smime_name.py
index 789bf82..0fdb89e 100644
--- a/pkilint/cabf/smime/smime_name.py
+++ b/pkilint/cabf/smime/smime_name.py
@@ -3,12 +3,13 @@
 from pyasn1_alt_modules import rfc5280, rfc8398
 
 from pkilint import validation, pkix, oid
-from pkilint.cabf import cabf_name, cabf_constants
-from pkilint.cabf.cabf_name import OrganizationIdentifierAttributeValidator
+from pkilint.cabf import cabf_name
+from pkilint.cabf.cabf_name import CabfOrganizationIdentifierAttributeValidator
 from pkilint.cabf.smime.smime_constants import Generation, ValidationLevel
-from pkilint.iso import lei
+from pkilint.common import organization_id
+from pkilint.common.organization_id import OrganizationIdentifierLeiValidator
 from pkilint.itu import x520_name
-from pkilint.pkix import certificate, name
+from pkilint.pkix import certificate, name, Rfc2119Word
 
 SHALL = pkix.Rfc2119Word.SHALL
 SHALL_NOT = pkix.Rfc2119Word.SHALL_NOT
@@ -175,7 +176,8 @@ def validate(self, node):
             oids = oid.format_oids(self._required_one_of_n_attributes)
 
             findings.append(validation.ValidationFindingDescription(self.VALIDATION_MISSING_ATTRIBUTE,
-                                                                    f'Missing one of these required attributes: {oids}'))
+                                                                    f'Missing one of these required attributes: {oids}')
+                            )
 
         findings.extend((
             validation.ValidationFindingDescription(self.VALIDATION_PROHIBITED_ATTRIBUTE,
@@ -198,6 +200,40 @@ def validate(self, node):
         return validation.ValidationResult(self, node, findings)
 
 
+class CabfSmimeOrganizationIdentifierAttributeValidator(CabfOrganizationIdentifierAttributeValidator):
+    _REFERENCE_PROHIBITED = (Rfc2119Word.MUST_NOT,
+                             'cabf.smime.prohibited_organization_identifier_reference_present_for_scheme')
+
+    _LEI_SCHEME = organization_id.OrganizationIdentifierElementAllowance(
+        country_codes=({organization_id.COUNTRY_CODE_GLOBAL_SCHEME},
+                       CabfOrganizationIdentifierAttributeValidator.VALIDATION_ORGANIZATION_ID_INVALID_COUNTRY),
+        state_province=CabfOrganizationIdentifierAttributeValidator.STATE_PROVINCE_PROHIBITED,
+        reference=CabfOrganizationIdentifierAttributeValidator.REFERENCE_REQUIRED
+    )
+    _GOV_SCHEME = organization_id.OrganizationIdentifierElementAllowance(
+        country_codes=(organization_id.ISO3166_1_COUNTRY_CODES,
+                       CabfOrganizationIdentifierAttributeValidator.VALIDATION_ORGANIZATION_ID_INVALID_COUNTRY),
+        state_province=(Rfc2119Word.MAY, None),
+        reference=_REFERENCE_PROHIBITED
+    )
+    _INT_SCHEME = organization_id.OrganizationIdentifierElementAllowance(
+        country_codes=({organization_id.COUNTRY_CODE_GLOBAL_SCHEME},
+                       CabfOrganizationIdentifierAttributeValidator.VALIDATION_ORGANIZATION_ID_INVALID_COUNTRY),
+        state_province=CabfOrganizationIdentifierAttributeValidator.STATE_PROVINCE_PROHIBITED,
+        reference=_REFERENCE_PROHIBITED
+    )
+
+    def __init__(self):
+        super().__init__(
+            {
+                'LEI': self._LEI_SCHEME,
+                'GOV': self._GOV_SCHEME,
+                'INT': self._INT_SCHEME,
+            },
+            enforce_strict_state_province_format=False
+        )
+
+
 class SubscriberAttributeDependencyValidator(validation.Validator):
     VALIDATION_MISSING_REQUIRED_ATTRIBUTE = validation.ValidationFinding(
         validation.ValidationFindingSeverity.ERROR,
@@ -248,20 +284,7 @@ def create_subscriber_certificate_subject_validator_container(
         SubjectAlternativeNameContainsSubjectEmailAddressesValidator(),
         cabf_name.ValidCountryValidator(),
         CommonNameValidator(validation_level, generation),
-        OrganizationIdentifierAttributeValidator(relax_stateprovince_syntax=True, additional_schemes={
-            'LEI': cabf_constants.RegistrationSchemeNamingConvention(
-                cabf_constants.RegistrationSchemeCountryIdentifierType.XG,
-                False, True
-            ),
-            'GOV': cabf_constants.RegistrationSchemeNamingConvention(
-                cabf_constants.RegistrationSchemeCountryIdentifierType.ISO3166,
-                True, False
-            ),
-            'INT': cabf_constants.RegistrationSchemeNamingConvention(
-                cabf_constants.RegistrationSchemeCountryIdentifierType.XG,
-                False, False
-            )
-        }),
+        CabfSmimeOrganizationIdentifierAttributeValidator(),
         OrganizationIdentifierLeiValidator(),
         OrganizationIdentifierCountryNameConsistentValidator(),
         cabf_name.RelativeDistinguishedNameContainsOneElementValidator(),
@@ -409,36 +432,6 @@ def validate(self, node):
             )
 
 
-class OrganizationIdentifierLeiValidator(validation.Validator):
-    VALIDATION_INVALID_ORGID_LEI_FORMAT = validation.ValidationFinding(
-        validation.ValidationFindingSeverity.ERROR, 'cabf.smime.invalid_lei_scheme_format'
-    )
-
-    _LEI_PREFIX = 'LEIXG-'
-
-    def __init__(self):
-        super().__init__(validations=[
-            lei.VALIDATION_INVALID_LEI_CHECKSUM, lei.VALIDATION_INVALID_LEI_FORMAT,
-            self.VALIDATION_INVALID_ORGID_LEI_FORMAT
-        ],
-            pdu_class=x520_name.X520OrganizationIdentifier,
-            predicate=lambda n: any(n.children) and str(n.child[1].pdu).startswith('LEI')
-        )
-
-    def validate(self, node):
-        value = str(node.child[1].pdu)
-
-        if not value.startswith(self._LEI_PREFIX):
-            raise validation.ValidationFindingEncountered(
-                self.VALIDATION_INVALID_ORGID_LEI_FORMAT,
-                f'Invalid Organization Identifier format: "{value}"'
-            )
-
-        lei_value = value[len(self._LEI_PREFIX):]
-
-        lei.validate_lei(lei_value)
-
-
 class OrganizationIdentifierCountryNameConsistentValidator(validation.Validator):
     VALIDATION_ORGID_COUNTRYNAME_INCONSISTENT = validation.ValidationFinding(
         validation.ValidationFindingSeverity.ERROR,
@@ -464,15 +457,15 @@ def validate(self, node):
 
             x520_value_str = str(x520_value_node.pdu)
 
-            m = cabf_name.ORG_ID_REGEX.match(x520_value_str)
-
-            if m is None:
+            try:
+                parsed_org_id = organization_id.parse_organization_identifier(x520_value_str)
+            except ValueError:
                 continue
 
-            orgid_country_name = m['country']
+            orgid_country_name = parsed_org_id.country
 
-            # skip this orgId attribute if it doesn't contain a countryName or contains XG
-            if not orgid_country_name or orgid_country_name.upper() == 'XG':
+            # skip this orgId attribute if it contains the global scheme identifier
+            if orgid_country_name.casefold() == organization_id.COUNTRY_CODE_GLOBAL_SCHEME.casefold():
                 continue
 
             if orgid_country_name.casefold() != country_name_value.casefold():
diff --git a/pkilint/common/__init__.py b/pkilint/common/__init__.py
index f2bd09d..509a3bc 100644
--- a/pkilint/common/__init__.py
+++ b/pkilint/common/__init__.py
@@ -1,15 +1,15 @@
-from typing import Callable, Mapping, Optional, NamedTuple
+from typing import Callable, Mapping, Optional
 
 from pyasn1.type import univ
-from pyasn1_alt_modules import rfc5280, rfc6962, rfc6960
+from pyasn1_alt_modules import rfc5280, rfc6962, rfc6960, rfc3739
 
-from pkilint import validation, document, pkix, oid
+from pkilint import validation, document, pkix
 from pkilint.cabf.asn1 import ev_guidelines
 from pkilint.itu import x520_name
 from pkilint.pkix import Rfc2119Word
 
 OID_TO_CODE_NAME = {
-    # EKU
+    # EKUs
     rfc5280.id_kp_codeSigning: 'codesigning',
     rfc5280.id_kp_emailProtection: 'emailprotection',
     rfc5280.id_kp_timeStamping: 'timestamping',
@@ -19,7 +19,7 @@
     rfc5280.id_kp_serverAuth: 'serverauth',
     rfc5280.id_kp_clientAuth: 'clientauth',
 
-    # extension
+    # extensions
     rfc5280.id_ce_authorityKeyIdentifier: 'authority_key_identifier',
     rfc5280.id_ce_basicConstraints: 'basic_constraints',
     rfc5280.id_ce_certificatePolicies: 'certificate_policies',
@@ -33,6 +33,11 @@
     rfc5280.id_ce_subjectAltName: 'subject_altname',
     rfc6962.id_ce_criticalPoison: 'precert_poison',
     rfc6960.id_pkix_ocsp_nocheck: 'ocsp_nocheck',
+    rfc3739.id_pe_qcStatements: 'qc_statements',
+    rfc5280.id_ce_policyMappings: 'policy_mappings',
+    rfc5280.id_ce_policyConstraints: 'policy_constraints',
+    rfc5280.id_ce_inhibitAnyPolicy: 'inhibit_any_policy',
+
 
     # AIA access methods
     rfc5280.id_ad_ocsp: 'ocsp',
@@ -54,16 +59,20 @@
     ev_guidelines.id_evat_jurisdiction_localityName: 'jurisdiction_locality',
     rfc5280.id_at_surname: 'surname',
     rfc5280.id_at_givenName: 'given_name',
+    x520_name.id_at_organizationIdentifier: 'organization_identifier',
 }
 
 
 class ElementIdentifierAllowanceValidator(validation.Validator):
-    @staticmethod
-    def _create_finding(fmt: str, rfc2119word: pkix.Rfc2119Word, o: univ.ObjectIdentifier):
+    # use global mappings by default
+    _OID_TO_CODE_NAME = OID_TO_CODE_NAME
+
+    @classmethod
+    def _create_finding(cls, fmt: str, rfc2119word: pkix.Rfc2119Word, o: univ.ObjectIdentifier):
         if rfc2119word == pkix.Rfc2119Word.MAY:
             return None
         else:
-            return validation.ValidationFinding(rfc2119word.to_severity, fmt.format(oid=OID_TO_CODE_NAME[o]))
+            return validation.ValidationFinding(rfc2119word.to_severity, fmt.format(oid=cls._OID_TO_CODE_NAME[o]))
 
     def __init__(self, element_name: str, element_oid_retriever: Callable[[document.PDUNode], document.PDUNode],
                  known_element_allowances: Mapping[univ.ObjectIdentifier, pkix.Rfc2119Word],
@@ -76,12 +85,12 @@ def __init__(self, element_name: str, element_oid_retriever: Callable[[document.
         self._element_oid_retriever = element_oid_retriever
 
         self._expected_element_presences = {
-            o: ElementIdentifierAllowanceValidator._create_finding(unexpected_absence_code_format, w, o)
+            o: self._create_finding(unexpected_absence_code_format, w, o)
             for o, w in known_element_allowances.items()
             if w in {Rfc2119Word.MAY, Rfc2119Word.SHOULD, Rfc2119Word.MUST}
         }
         self._expected_element_absences = {
-            o: ElementIdentifierAllowanceValidator._create_finding(unexpected_presence_code_format, w, o)
+            o: self._create_finding(unexpected_presence_code_format, w, o)
             for o, w in known_element_allowances.items()
             if w in {Rfc2119Word.MAY, Rfc2119Word.SHOULD_NOT, Rfc2119Word.MUST_NOT}
         }
@@ -123,14 +132,14 @@ def validate(self, node):
 
 
 class ExtensionsPresenceValidator(validation.Validator):
-    def __init__(self, validation):
-        self._validation = validation
+    def __init__(self, validation_extensions_field_absent):
+        self._validation_extensions_field_absent = validation_extensions_field_absent
 
-        super().__init__(validations=validation, pdu_class=rfc5280.TBSCertificate)
+        super().__init__(validations=validation_extensions_field_absent, pdu_class=rfc5280.TBSCertificate)
 
     def validate(self, node):
         if 'extensions' not in node.children:
-            raise validation.ValidationFindingEncountered(self._validation)
+            raise validation.ValidationFindingEncountered(self._validation_extensions_field_absent)
 
 
 class ExtensionIdentifierAllowanceValidator(ElementIdentifierAllowanceValidator):
diff --git a/pkilint/common/alternative_name.py b/pkilint/common/alternative_name.py
new file mode 100644
index 0000000..939cdad
--- /dev/null
+++ b/pkilint/common/alternative_name.py
@@ -0,0 +1,185 @@
+import ipaddress
+from urllib.parse import urlparse
+
+import publicsuffixlist
+from pyasn1_alt_modules import rfc8398, rfc5280
+
+from pkilint import validation
+from pkilint.pkix import general_name
+
+
+class InternalDomainNameValidator(validation.Validator):
+    def __init__(self, validation_internal_domain_name_present: validation.ValidationFinding, *args, **kwargs):
+        self._psl = publicsuffixlist.PublicSuffixList(accept_unknown=False)
+
+        super().__init__(validations=[validation_internal_domain_name_present], **kwargs)
+
+        self._validation_internal_domain_name_present = validation_internal_domain_name_present
+
+    @classmethod
+    def extract_domain_name(cls, node):
+        return str(node.pdu)
+
+    def validate_with_value(self, node, value):
+        if self._psl.publicsuffix(value) is None:
+            raise validation.ValidationFindingEncountered(
+                self._validation_internal_domain_name_present,
+                f'Internal domain name: "{value}"'
+            )
+
+    def validate(self, node):
+        domain_name = self.extract_domain_name(node)
+
+        return self.validate_with_value(node, domain_name)
+
+
+class GeneralNameDnsNameInternalDomainNameValidator(InternalDomainNameValidator):
+    def __init__(self, validation_internal_domain_name_present: validation.ValidationFinding, allow_onion_tld=False):
+        self._allow_onion_tld = allow_onion_tld
+
+        super().__init__(
+            validation_internal_domain_name_present,
+            predicate=general_name.create_generalname_type_predicate(general_name.GeneralNameTypeName.DNS_NAME)
+        )
+
+    def validate_with_value(self, node, value):
+        if len(value) == 0 and general_name.is_nameconstraints_child_node(node):
+            return
+        else:
+            if self._allow_onion_tld and value.lower().endswith('.onion'):
+                return
+            else:
+                return super().validate_with_value(node, value)
+
+
+class UriInternalDomainNameValidator(InternalDomainNameValidator):
+    def __init__(self, validation_internal_domain_name_present: validation.ValidationFinding, *args, **kwargs):
+        super().__init__(validation_internal_domain_name_present, *args, **kwargs)
+
+    def extract_domain_name(self, node):
+        return urlparse(str(node.pdu)).hostname or ''
+
+
+class GeneralNameUriInternalDomainNameValidator(InternalDomainNameValidator):
+    def __init__(self, validation_internal_domain_name_present: validation.ValidationFinding):
+        super().__init__(
+            validation_internal_domain_name_present,
+            predicate=general_name.create_generalname_type_predicate(
+                general_name.GeneralNameTypeName.UNIFORM_RESOURCE_IDENTIFIER
+            )
+        )
+
+    def extract_domain_name(self, node):
+        if general_name.is_nameconstraints_child_node(node):
+            return str(node.pdu).lstrip('.')
+        else:
+            return urlparse(str(node.pdu)).hostname or ''
+
+    def validate_with_value(self, node, value):
+        if len(value) == 0 and general_name.is_nameconstraints_child_node(node):
+            return
+        else:
+            return super().validate_with_value(node, value)
+
+
+class EmailAddressInternalDomainNameValidator(InternalDomainNameValidator):
+    def __init__(self, validation_internal_domain_name_present: validation.ValidationFinding, *args, **kwargs):
+        super().__init__(validation_internal_domain_name_present, *args, **kwargs)
+
+    def extract_domain_name(self, node):
+        parts = str(node.pdu).split('@', maxsplit=1)
+
+        return parts[1] if len(parts) == 2 else ''
+
+
+class GeneralNameRfc822NameInternalDomainNameValidator(EmailAddressInternalDomainNameValidator):
+    def __init__(self, validation_internal_domain_name_present: validation.ValidationFinding):
+        super().__init__(
+            validation_internal_domain_name_present,
+            predicate=general_name.create_generalname_type_predicate(general_name.GeneralNameTypeName.RFC822_NAME)
+        )
+
+    def extract_domain_name(self, node):
+        if general_name.is_nameconstraints_child_node(node):
+            return str(node.pdu).lstrip('.')
+        else:
+            return super().extract_domain_name(node)
+
+    def validate_with_value(self, node, value):
+        if len(value) == 0 and general_name.is_nameconstraints_child_node(node):
+            return
+        else:
+            super().validate_with_value(node, value)
+
+
+class SmtpUtf8MailboxInternalDomainNameValidator(EmailAddressInternalDomainNameValidator):
+    def __init__(self, validation_internal_domain_name_present: validation.ValidationFinding):
+        super().__init__(validation_internal_domain_name_present, pdu_class=rfc8398.SmtpUTF8Mailbox)
+
+    def extract_domain_name(self, node):
+        domain_part = super().extract_domain_name(node)
+
+        # remove ToASCII once RFC 9598 is published
+        return domain_part.encode('idna').decode()
+
+
+class InternalIpAddressValidator(validation.Validator):
+    def __init__(self, validation_internal_ip_address_present: validation.ValidationFinding, *args, **kwargs):
+        super().__init__(validations=[validation_internal_ip_address_present], **kwargs)
+
+        self._validation_internal_ip_address_present = validation_internal_ip_address_present
+
+    @classmethod
+    def _extract_ip_address(cls, node):
+        octets = node.pdu.asOctets()
+
+        if len(octets) == 4:
+            return ipaddress.IPv4Address(octets)
+        else:
+            return ipaddress.IPv6Address(octets)
+
+    def validate(self, node):
+        ip_addr = self._extract_ip_address(node)
+
+        if not ip_addr.is_global:
+            raise validation.ValidationFindingEncountered(
+                self._validation_internal_ip_address_present,
+                f'Internal IP address: "{ip_addr}"'
+            )
+
+
+class GeneralNameInternalIpAddressValidator(InternalIpAddressValidator):
+    def __init__(self, validation_internal_ip_address_present: validation.ValidationFinding):
+        super().__init__(
+            validation_internal_ip_address_present,
+            predicate=general_name.create_generalname_type_predicate(general_name.GeneralNameTypeName.IP_ADDRESS)
+        )
+
+    def validate(self, node):
+        if general_name.is_nameconstraints_child_node(node):
+            return
+
+        super().validate(node)
+
+
+def create_internal_name_validator_container(
+    validation_internal_domain_name_present: validation.ValidationFinding,
+    validation_internal_ip_address_present: validation.ValidationFinding,
+    allow_onion_tld: bool = False
+):
+    validators = [
+        GeneralNameDnsNameInternalDomainNameValidator(validation_internal_domain_name_present, allow_onion_tld),
+        GeneralNameUriInternalDomainNameValidator(validation_internal_domain_name_present),
+        GeneralNameRfc822NameInternalDomainNameValidator(validation_internal_domain_name_present),
+        SmtpUtf8MailboxInternalDomainNameValidator(validation_internal_domain_name_present),
+        GeneralNameInternalIpAddressValidator(validation_internal_ip_address_present),
+    ]
+
+    return validation.ValidatorContainer(
+        validators=validators,
+        pdu_class=rfc5280.GeneralName
+    )
+
+
+def create_cpsuri_internal_domain_name_validator(validation_internal_domain_name_present: validation.ValidationFinding):
+    return UriInternalDomainNameValidator(validation_internal_domain_name_present, pdu_class=rfc5280.CPSuri)
diff --git a/pkilint/common/common_name.py b/pkilint/common/common_name.py
new file mode 100644
index 0000000..e8f97f9
--- /dev/null
+++ b/pkilint/common/common_name.py
@@ -0,0 +1,72 @@
+import ipaddress
+import typing
+
+from pyasn1_alt_modules import rfc5280
+
+from pkilint import validation, document
+from pkilint.pkix import general_name
+
+
+class CommonNameValidator(validation.Validator):
+    def __init__(
+            self,
+            allowed_general_name_types: typing.Set[str],
+            validation_unknown_value_source: validation.ValidationFinding):
+        super().__init__(
+            validations=[validation_unknown_value_source],
+            pdu_class=rfc5280.X520CommonName)
+
+        self._allowed_general_name_types = allowed_general_name_types
+        self._validation_unknown_value_source = validation_unknown_value_source
+
+    def validate(self, node):
+        # unparsed CN, return
+        if not any(node.children):
+            return
+
+        _, value_node = node.child
+        value_str = str(value_node.pdu)
+
+        san_ext_and_idx = node.document.get_extension_by_oid(rfc5280.id_ce_subjectAltName)
+
+        if san_ext_and_idx is None:
+            raise validation.ValidationFindingEncountered(
+                self._validation_unknown_value_source,
+                f'Unknown source for value of common name: "{value_str}"'
+            )
+
+        san_ext_node, _ = san_ext_and_idx
+
+        try:
+            san_value_node = san_ext_node.navigate('extnValue.subjectAltName')
+        except document.PDUNavigationFailedError:
+            # unparsed SAN extension, return
+            return
+
+        for gn in san_value_node.children.values():
+            gn_type, gn_value = gn.child
+
+            if gn_type not in self._allowed_general_name_types:
+                continue
+
+            if gn_type == general_name.GeneralNameTypeName.DNS_NAME:
+                if str(gn_value.pdu) == value_str:
+                    return
+            elif gn_type == general_name.GeneralNameTypeName.IP_ADDRESS:
+                address_octets = gn_value.pdu.asOctets()
+
+                if len(address_octets) == 4:
+                    ip_addr = ipaddress.IPv4Address(address_octets)
+                elif len(address_octets) == 16:
+                    ip_addr = ipaddress.IPv6Address(address_octets)
+                else:
+                    # Whoa, Nellie! Let the PKIX validator complain about this one
+                    continue
+
+                if str(ip_addr) == value_str:
+                    return
+
+        raise validation.ValidationFindingEncountered(
+            self._validation_unknown_value_source,
+            f'Unknown source for value of common name: "{value_str}"'
+        )
diff --git a/pkilint/common/organization_id.py b/pkilint/common/organization_id.py
new file mode 100644
index 0000000..7928510
--- /dev/null
+++ b/pkilint/common/organization_id.py
@@ -0,0 +1,207 @@
+import re
+from typing import NamedTuple, Optional, Set, Tuple, Dict, List
+
+from iso3166 import countries_by_alpha2
+
+from pkilint import validation, document
+from pkilint.iso import lei
+from pkilint.itu import x520_name
+from pkilint.pkix import Rfc2119Word
+
+_ORG_ID_REGEX = re.compile(
+    r'^(?P<scheme>[A-Z]{2}[A-Z:])(?P<country>[a-zA-Z]{2})(\+(?P<sp>[a-zA-Z0-9]{1,3}))?'
+    r'(-(?P<reference>.+))?$'
+)
+
+# alternative country codes
+COUNTRY_CODE_GREECE_TRADITIONAL = 'EL'
+COUNTRY_CODE_NORTHERN_IRELAND = 'XI'
+
+# multi-national codes
+COUNTRY_CODE_GLOBAL_SCHEME = 'XG'
+COUNTRY_CODE_EUROPEAN_UNION = 'EU'
+COUNTRY_CODE_EUROZONE = 'EZ'
+COUNTRY_CODE_USSR = 'SU'
+COUNTRY_CODE_UNITED_NATIONS = 'UN'
+
+TRANSNATIONAL_COUNTRY_CODES = {
+    COUNTRY_CODE_EUROPEAN_UNION,
+    COUNTRY_CODE_EUROZONE,
+    COUNTRY_CODE_USSR,
+    COUNTRY_CODE_UNITED_NATIONS,
+}
+
+ISO3166_1_COUNTRY_CODES = set(countries_by_alpha2.keys())
+ISO3166_1_WITH_TRANSNATIONAL_COUNTRY_CODES = ISO3166_1_COUNTRY_CODES | TRANSNATIONAL_COUNTRY_CODES
+
+
+LEI_PREFIX = 'LEIXG-'
+
+
+class ParsedOrganizationIdentifier(NamedTuple):
+    raw: Optional[str]
+    scheme: str
+    is_national_scheme: bool
+    country: str
+    state_province: Optional[str]
+    reference: Optional[str]
+
+
+def parse_organization_identifier(value: str) -> ParsedOrganizationIdentifier:
+    m = _ORG_ID_REGEX.match(value)
+
+    if m is None:
+        raise ValueError(f'Invalid organization identifier syntax: "{value}"')
+
+    is_national_scheme = m['scheme'].endswith(':')
+
+    scheme = m['scheme'][:2] if is_national_scheme else m['scheme']
+
+    return ParsedOrganizationIdentifier(value, scheme, is_national_scheme, m.group('country'), m.group('sp'),
+                                        m.group('reference'))
+
+
+def assert_parsed_organization_identifier_equal(
+        org1: ParsedOrganizationIdentifier, org1_source: str, org2: ParsedOrganizationIdentifier, org2_source: str):
+    if org1.scheme != org2.scheme:
+        raise ValueError(f'Mismatched scheme: {org1_source}: "{org1.scheme}", {org2_source}: "{org2.scheme}"')
+
+    if org1.country.casefold() != org2.country.casefold():
+        raise ValueError(f'Mismatched country: {org1_source}: "{org1.country}", {org2_source}: "{org2.country}"')
+
+    if org1.state_province != org2.state_province:
+        org1_state_province = '' if org1.state_province is None else org1.state_province
+        org2_state_province = '' if org2.state_province is None else org2.state_province
+
+        raise ValueError(f'Mismatched state/province: {org1_source}: "{org1_state_province}", '
+                         f'{org2_source}: "{org2_state_province}"')
+
+    if org1.reference != org2.reference:
+        org1_reference = '' if org1.reference is None else org1.reference
+        org2_reference = '' if org2.reference is None else org2.reference
+
+        raise ValueError(f'Mismatched registration reference: {org1_source}: "{org1_reference}", '
+                         f'{org2_source}: "{org2_reference}"')
+
+
+class OrganizationIdentifierLeiValidator(validation.Validator):
+    def __init__(self):
+        super().__init__(validations=[lei.VALIDATION_INVALID_LEI_CHECKSUM, lei.VALIDATION_INVALID_LEI_FORMAT],
+                         pdu_class=x520_name.X520OrganizationIdentifier,
+                         predicate=lambda n: any(n.children) and str(n.child[1].pdu).startswith('LEI')
+                         )
+
+    def validate(self, node):
+        value = str(node.child[1].pdu)
+
+        if not value.startswith(LEI_PREFIX):
+            # let the syntax validator report this problem
+            return
+
+        lei_value = value[len(LEI_PREFIX):]
+
+        lei.validate_lei(lei_value)
+
+
+class OrganizationIdentifierElementAllowance(NamedTuple):
+    country_codes: Tuple[Set[str], validation.ValidationFinding]
+    state_province: Tuple[Rfc2119Word, Optional[str]]
+    reference: Tuple[Rfc2119Word, Optional[str]]
+
+
+class OrganizationIdentifierValidatorBase(validation.Validator):
+    def __init__(self, element_allowances: Dict[str, OrganizationIdentifierElementAllowance],
+                 invalid_format_validation: Optional[validation.ValidationFinding],
+                 additional_validations: Optional[List[validation.ValidationFinding]] = None,
+                 **kwargs):
+        if additional_validations is None:
+            additional_validations = []
+
+        self._element_allowances = element_allowances.copy()
+
+        self._invalid_format_validation = invalid_format_validation
+
+        validations = [] + additional_validations
+
+        if self._invalid_format_validation is not None:
+            validations.append(self._invalid_format_validation)
+
+        for allowance in element_allowances.values():
+            validations.append(allowance.country_codes[1])
+
+            OrganizationIdentifierValidatorBase._create_and_append_validation_finding(
+                validations, *allowance.state_province
+            )
+            OrganizationIdentifierValidatorBase._create_and_append_validation_finding(
+                validations, *allowance.reference
+            )
+
+        super().__init__(validations=validations, **kwargs)
+
+    @staticmethod
+    def _create_and_append_validation_finding(validations, presence_word, finding_code):
+        if presence_word != Rfc2119Word.MAY:
+            validations.append(validation.ValidationFinding(presence_word.to_severity, finding_code))
+
+    @classmethod
+    def parse_organization_id_node(cls, node: document.PDUNode) -> ParsedOrganizationIdentifier:
+        pass
+
+    @classmethod
+    def handle_unknown_scheme(cls, node: document.PDUNode, parsed: ParsedOrganizationIdentifier):
+        pass
+
+    def validate_with_parsed_value(self, node: document.PDUNode, parsed: ParsedOrganizationIdentifier):
+        scheme_allowance = self._element_allowances.get(parsed.scheme)
+
+        if scheme_allowance is None:
+            return self.handle_unknown_scheme(node, parsed)
+
+        allowed_country_codes, finding = scheme_allowance.country_codes
+
+        findings = []
+        if parsed.country not in allowed_country_codes:
+            findings.append(
+                validation.ValidationFindingDescription(
+                    finding,
+                    f'Invalid country code for registration scheme "{parsed.scheme}": "{parsed.country}"'
+                )
+            )
+
+        allowance, finding_code = scheme_allowance.state_province
+
+        if parsed.state_province is None and allowance in {Rfc2119Word.SHOULD, Rfc2119Word.MUST}:
+            findings.append(validation.ValidationFindingDescription(
+                validation.ValidationFinding(allowance.to_severity, finding_code),
+                f'State/province missing for registration scheme "{parsed.scheme}"'
+            ))
+        elif parsed.state_province is not None and allowance in {Rfc2119Word.SHOULD_NOT,
+                                                                 Rfc2119Word.MUST_NOT}:
+            findings.append(validation.ValidationFindingDescription(
+                validation.ValidationFinding(allowance.to_severity, finding_code),
+                f'State/province value present for scheme "{parsed.scheme}": "{parsed.state_province}"'
+            ))
+
+        allowance, finding_code = scheme_allowance.reference
+
+        if parsed.reference is None and allowance in {Rfc2119Word.SHOULD, Rfc2119Word.MUST}:
+            findings.append(validation.ValidationFindingDescription(
+                validation.ValidationFinding(allowance.to_severity, finding_code),
+                f'Registration reference missing for scheme "{parsed.scheme}"'
+            ))
+        elif parsed.reference is not None and allowance in {Rfc2119Word.SHOULD_NOT,
+                                                            Rfc2119Word.MUST_NOT}:
+            findings.append(validation.ValidationFindingDescription(
+                validation.ValidationFinding(allowance.to_severity, finding_code),
+                f'Registration reference present for scheme "{parsed.scheme}": "{parsed.reference}"'
+            ))
+
+        return validation.ValidationResult(self, node, findings)
+
+    def validate(self, node):
+        try:
+            parsed = self.parse_organization_id_node(node)
+        except ValueError as e:
+            raise validation.ValidationFindingEncountered(self._invalid_format_validation, str(e))
+
+        return self.validate_with_parsed_value(node, parsed)
diff --git a/pkilint/document.py b/pkilint/document.py
index ccee795..1e72652 100644
--- a/pkilint/document.py
+++ b/pkilint/document.py
@@ -2,7 +2,7 @@
 import datetime
 import logging
 import re
-from typing import Callable, Mapping, Tuple, Type, Union, Optional, Dict, List
+from typing import Callable, Mapping, Tuple, Type, Union, Optional, Dict, List, NamedTuple
 
 from pyasn1.codec.der.decoder import decode
 from pyasn1.codec.der.encoder import encode
@@ -12,11 +12,22 @@
                               Choice, BitString
                               )
 
+
 logger = logging.getLogger(__name__)
 
 PATH_REGEX = re.compile(r'^((?P<doc_name>[^:]*):)?(?P<node_path>([^.]+\.)*[^.]+)?$')
 
 
+try:
+    # noinspection PyUnresolvedReferences
+    from pyasn1_fasder import decode_der
+
+    logging.info('Using pyasn1-fasder for ASN.1 DER decoding')
+    _USE_PYASN1_FASDER = True
+except ImportError:
+    _USE_PYASN1_FASDER = False
+
+
 class PDUNavigationFailedError(Exception):
     """Represents the failure to find the requested node in a document."""
 
@@ -26,8 +37,8 @@ def __init__(self, requested_path: str, traversed_path: str,
         """Creates an instance of an exception that represents a PDU node lookup failure.
 
         Args: requested_path: The requested path relative to the node which
-        :py:method:`pkilint.document.PDUNode.navigate was called. traversed_path: The relative path that was able to
-        be traversed, as those nodes exist. missing_node_name: The name of the node which could not be found.
+        :py:method:`pkilint.document.PDUNode.navigate was called. traversed_path: The relative path that was
+        traversed, as those nodes exist. missing_node_name: The name of the node which could not be found.
         """
         self.requested_path = requested_path
         self.traversed_path = traversed_path
@@ -50,12 +61,11 @@ def __init__(
         """Creates a new Document instance. It is not intended that this class be directly
         instantiated by user code; use a sub-class of this class instead.
 
-        Args:
-            pdu_schema_instance: A pyasn1 ASN.1 instance that represents the top-level ASN.1 schema for this document.
-            substrate_source: The source of the document. This can be a URI, file name, or any other identifier.
-            substrate: The raw DER-encoded document.
-            name: An optional name given to the document. May be useful when a :py:meth:`pkilint.validation.Validator` requires multiple documents.
-            parent: An optional collection of documents that are related.
+        Args: pdu_schema_instance: A pyasn1 ASN.1 instance that represents the top-level ASN.1 schema for this
+        document. substrate_source: The source of the document. This can be a URI, file name, or any other
+        identifier. substrate: The raw DER-encoded document. name: An optional name given to the document. May be
+        useful when a :py:meth:`pkilint.validation.Validator` requires multiple documents. parent: An optional
+        collection of documents that are related.
         """
         self.pdu_schema_instance = pdu_schema_instance
         self.substrate = substrate
@@ -90,12 +100,10 @@ def __init__(self, document: Document, name: str, pdu: Asn1Type,
                  ):
         """Creates a new instance representing a node within a document.
 
-        Args:
-            document: The document which contains this node.
-            name: The name of the node. Generally will match the name of a component
-            within an ASN.1 SEQUENCE.
-            pdu: The underlying ASN.1 value.
-            parent: The node which contains this node. In the case where the current node is the top-level node of a document, this will not be populated.
+        Args: document: The document which contains this node. name: The name of the node. Generally will match the
+        name of a component within an ASN.1 SEQUENCE. pdu: The underlying ASN.1 value. parent: The node which
+        contains this node. In the case where the current node is the top-level node of a document, this will not be
+        populated.
         """
         self.document = document
         self.name = name
@@ -203,6 +211,7 @@ def _generate_child_nodes(self):
             )
             }
         elif isinstance(self.pdu, SequenceOfAndSetOfBase):
+            # noinspection PyTypeChecker
             return {
                 str(i): PDUNode(
                     self.document, str(i), component, self
@@ -264,13 +273,21 @@ def __init__(self, value_node: PDUNode, type_oid: ObjectIdentifier,
         self.message = message
 
 
+class OptionalAsn1TypeWrapper(NamedTuple):
+    asn1_type: Asn1Type
+
+
 class ValueDecoder(object):
     _BITSTRING_SCHEMA_OBJ = BitString()
 
     VALUE_NODE_ABSENT = object()
 
-    def __init__(self, *, type_path: str, value_path: str,
-                 type_mappings: Dict[ObjectIdentifier, Optional[Asn1Type]], default: Optional[Asn1Type] = None):
+    def __init__(self,
+                 *,
+                 type_path: str,
+                 value_path: str,
+                 type_mappings: Dict[ObjectIdentifier, Union[Asn1Type, OptionalAsn1TypeWrapper]],
+                 default: Optional[Union[Asn1Type, OptionalAsn1TypeWrapper]] = None):
         self.type_path = type_path
         self.value_path = value_path
         self.type_mappings = type_mappings.copy()
@@ -293,14 +310,22 @@ def __call__(self, node):
         pdu_type = self.type_mappings.get(type_node.pdu, self.default)
 
         if pdu_type is not None:
+            if type(pdu_type) is OptionalAsn1TypeWrapper:
+                pdu_type = pdu_type.asn1_type
+
+                if value_node is None:
+                    # nothing to decode, so return
+                    return
+
             # value node must be absent, but it exists
-            if pdu_type is self.VALUE_NODE_ABSENT and value_node is not None:
+            elif pdu_type is self.VALUE_NODE_ABSENT and value_node is not None:
                 raise ValueDecodingFailedError(
                     value_node, type_node.pdu, pdu_type,
                     'Value node is present, but the ASN.1 schema specifies that it must be absent'
                 )
+
             # value node must be present, but it doesn't exist
-            if pdu_type is not self.VALUE_NODE_ABSENT and value_node is None:
+            elif pdu_type is not self.VALUE_NODE_ABSENT and value_node is None:
                 raise ValueDecodingFailedError(
                     node, type_node.pdu, pdu_type,
                     'Value node is absent, but the ASN.1 schema specifies that it must be present'
@@ -340,24 +365,29 @@ def decode_substrate(source_document: Document, substrate: bytes,
                      )
         return next(iter(parent_node.children.values()))
 
-    decoded, rest = decode(substrate, asn1Spec=pdu_instance)
+    if _USE_PYASN1_FASDER:
+        decoded, _ = decode_der(substrate, asn1Spec=pdu_instance)
+
+        decoded_pdu_name = get_node_name_for_pdu(decoded)
+    else:
+        decoded, rest = decode(substrate, asn1Spec=pdu_instance)
 
-    decoded_pdu_name = get_node_name_for_pdu(decoded)
+        decoded_pdu_name = get_node_name_for_pdu(decoded)
+
+        if len(rest) > 0:
+            raise ValueError(
+                "Unexpected {} octets following {} DER in {}: {}".format(
+                    len(rest), decoded_pdu_name, source_document.substrate_source,
+                    binascii.hexlify(rest).decode('us-ascii')
+                )
+            )
 
-    if len(rest) > 0:
-        raise ValueError(
-            "Unexpected {} octets following {} DER in {}: {}".format(
-                len(rest), decoded_pdu_name, source_document.substrate_source,
-                binascii.hexlify(rest).decode('us-ascii')
+        encoded = encode(decoded)
+        if encoded != substrate:
+            type_name = decoded.__class__.__name__
+            raise ValueError(
+                f'Substrate of type "{type_name}" is not DER-encoded'
             )
-        )
-
-    encoded = encode(decoded)
-    if encoded != substrate:
-        type_name = decoded.__class__.__name__
-        raise ValueError(
-            f'Substrate of type "{type_name}" is not DER-encoded'
-        )
 
     node = PDUNode(source_document, decoded_pdu_name, decoded, parent_node)
 
diff --git a/pkilint/etsi/__init__.py b/pkilint/etsi/__init__.py
index 89ff314..142c04e 100644
--- a/pkilint/etsi/__init__.py
+++ b/pkilint/etsi/__init__.py
@@ -1,14 +1,353 @@
-from pkilint.etsi.asn1 import en_319_412_5, ts_119_495
-from pkilint import document
-
-
-ETSI_QC_STATEMENTS_MAPPINGS = {
-    en_319_412_5.id_etsi_qcs_QcCompliance: document.ValueDecoder.VALUE_NODE_ABSENT,
-    en_319_412_5.id_etsi_qcs_QcLimitValue: en_319_412_5.QcEuLimitValue(),
-    en_319_412_5.id_etsi_qcs_QcRetentionPeriod: en_319_412_5.QcEuRetentionPeriod(),
-    en_319_412_5.id_etsi_qcs_QcSSCD: document.ValueDecoder.VALUE_NODE_ABSENT,
-    en_319_412_5.id_etsi_qcs_QcPDS: en_319_412_5.QcEuPDS(),
-    en_319_412_5.id_etsi_qcs_QcType: en_319_412_5.QcType(),
-    en_319_412_5.id_etsi_qcs_QcCClegislation: en_319_412_5.QcCClegislation(),
-    ts_119_495.id_etsi_psd2_qcStatement: ts_119_495.PSD2QcType(),
-}
+import typing
+from typing import List
+
+from pyasn1_alt_modules import rfc5280, rfc6962, rfc3739
+
+from pkilint import validation, finding_filter, cabf, document
+from pkilint.cabf import serverauth
+from pkilint.cabf.serverauth import serverauth_constants, serverauth_name, serverauth_finding_filter
+from pkilint.common import organization_id, alternative_name
+from pkilint.etsi import (
+    etsi_constants, ts_119_495, en_319_412_5, en_319_412_1, en_319_412_2, en_319_412_3,
+    ts_119_312, en_319_412_4, etsi_shared, etsi_finding_filter, en_319_411_1
+)
+from pkilint.etsi.asn1 import (
+    en_319_412_1 as en_319_412_asn1, en_319_412_5 as en_319_412_5_asn1, ts_119_495 as ts_119_495_asn1
+)
+from pkilint.etsi.etsi_constants import CertificateType
+from pkilint.itu import x520_name_unbounded
+from pkilint.pkix import certificate
+
+
+def determine_certificate_type(cert: certificate.RFC5280Certificate) -> CertificateType:
+    qualified_statement_ids = cert.qualified_statement_ids
+    policy_oids = cert.policy_oids
+
+    is_qualified = en_319_412_5_asn1.id_etsi_qcs_QcCompliance in qualified_statement_ids
+    is_eidas_qualified = is_qualified and en_319_412_5_asn1.id_etsi_qcs_QcCClegislation not in qualified_statement_ids
+    is_precert = cert.get_extension_by_oid(rfc6962.id_ce_criticalPoison) is not None
+    is_webauth = rfc5280.id_kp_serverAuth in cert.extended_key_usages
+
+    if serverauth_constants.ID_POLICY_EV in policy_oids:
+        is_psd2 = ts_119_495_asn1.id_etsi_psd2_qcStatement in qualified_statement_ids
+
+        if is_psd2:
+            return (
+                CertificateType.QEVCP_W_PSD2_EIDAS_PRE_CERTIFICATE if is_precert
+                else CertificateType.QEVCP_W_PSD2_EIDAS_FINAL_CERTIFICATE
+            )
+        elif is_eidas_qualified:
+            return (
+                CertificateType.QEVCP_W_EIDAS_PRE_CERTIFICATE if is_precert
+                else CertificateType.QEVCP_W_EIDAS_FINAL_CERTIFICATE
+            )
+        elif is_qualified:
+            return (
+                CertificateType.QEVCP_W_NON_EIDAS_PRE_CERTIFICATE if is_precert
+                else CertificateType.QEVCP_W_NON_EIDAS_FINAL_CERTIFICATE
+            )
+        else:
+            return CertificateType.EVCP_PRE_CERTIFICATE if is_precert else CertificateType.EVCP_FINAL_CERTIFICATE
+    elif serverauth_constants.ID_POLICY_OV in policy_oids:
+        if is_eidas_qualified:
+            return (
+                CertificateType.QNCP_W_OV_EIDAS_PRE_CERTIFICATE if is_precert
+                else CertificateType.QNCP_W_OV_EIDAS_FINAL_CERTIFICATE
+            )
+        elif is_qualified:
+            return (
+                CertificateType.QNCP_W_OV_NON_EIDAS_PRE_CERTIFICATE if is_precert
+                else CertificateType.QNCP_W_OV_NON_EIDAS_FINAL_CERTIFICATE
+            )
+        else:
+            return CertificateType.OVCP_PRE_CERTIFICATE if is_precert else CertificateType.OVCP_FINAL_CERTIFICATE
+    elif serverauth_constants.ID_POLICY_IV in policy_oids:
+        if is_eidas_qualified:
+            return (
+                CertificateType.QNCP_W_IV_EIDAS_PRE_CERTIFICATE if is_precert
+                else CertificateType.QNCP_W_IV_EIDAS_FINAL_CERTIFICATE
+            )
+        elif is_qualified:
+            return (
+                CertificateType.QNCP_W_IV_NON_EIDAS_PRE_CERTIFICATE if is_precert
+                else CertificateType.QNCP_W_IV_NON_EIDAS_FINAL_CERTIFICATE
+            )
+        else:
+            return CertificateType.IVCP_PRE_CERTIFICATE if is_precert else CertificateType.IVCP_FINAL_CERTIFICATE
+    elif serverauth_constants.ID_POLICY_DV in policy_oids:
+        return CertificateType.DVCP_PRE_CERTIFICATE if is_precert else CertificateType.DVCP_FINAL_CERTIFICATE
+    else:
+        is_natural_person = any((
+            cert.get_subject_attributes_by_type(rfc5280.id_at_givenName),
+            cert.get_subject_attributes_by_type(rfc5280.id_at_surname),
+            cert.get_subject_attributes_by_type(rfc5280.id_at_pseudonym),
+        ))
+
+        if is_natural_person:
+            if is_webauth:
+                if is_eidas_qualified:
+                    return (
+                        CertificateType.QNCP_W_GEN_NATURAL_PERSON_EIDAS_PRE_CERTIFICATE if is_precert
+                        else CertificateType.QNCP_W_GEN_NATURAL_PERSON_EIDAS_FINAL_CERTIFICATE
+                    )
+                elif is_qualified:
+                    return (
+                        CertificateType.QNCP_W_GEN_NATURAL_PERSON_NON_EIDAS_PRE_CERTIFICATE if is_precert
+                        else CertificateType.QNCP_W_GEN_NATURAL_PERSON_NON_EIDAS_FINAL_CERTIFICATE
+                    )
+                else:
+                    return (
+                        CertificateType.NCP_W_NATURAL_PERSON_PRE_CERTIFICATE if is_webauth
+                        else CertificateType.NCP_W_NATURAL_PERSON_FINAL_CERTIFICATE
+                    )
+
+            return CertificateType.NCP_NATURAL_PERSON_CERTIFICATE
+        else:
+            if is_webauth:
+                if is_eidas_qualified:
+                    return (
+                        CertificateType.QNCP_W_GEN_LEGAL_PERSON_EIDAS_PRE_CERTIFICATE if is_precert
+                        else CertificateType.QNCP_W_GEN_LEGAL_PERSON_EIDAS_FINAL_CERTIFICATE
+                    )
+                elif is_qualified:
+                    return (
+                        CertificateType.QNCP_W_GEN_LEGAL_PERSON_NON_EIDAS_PRE_CERTIFICATE if is_precert
+                        else CertificateType.QNCP_W_GEN_LEGAL_PERSON_NON_EIDAS_FINAL_CERTIFICATE
+                    )
+                else:
+                    return (
+                        CertificateType.NCP_W_LEGAL_PERSON_PRE_CERTIFICATE if is_webauth
+                        else CertificateType.NCP_W_LEGAL_PERSON_FINAL_CERTIFICATE
+                    )
+
+            return CertificateType.NCP_LEGAL_PERSON_CERTIFICATE
+
+
+def create_decoding_validators(certificate_type: CertificateType) -> List[validation.Validator]:
+    if certificate_type in etsi_constants.CABF_CERTIFICATE_TYPES:
+        return serverauth.create_decoding_validators()
+    else:
+        name_attribute_mappings = cabf.NAME_ATTRIBUTE_MAPPINGS.copy()
+
+        """
+        From EN 319 412-2:
+        NAT-4.2.4-18 If present, the size of givenName, surname, pseudonym, commonName, organizationName and
+        organizationalUnitName may be longer than the limit as stated in IETF RFC 5280 [1].
+        
+        From EN 319 412-3:
+        LEG-4.2.1-9: If present, the size of organizationName, organizationalUnitName and commonName may
+        be longer than the limit as stated in IETF RFC 5280 [3].
+        
+        From EN 319 412-4:
+        WEB-4.1.3-4: The following certificate profile requirements specified in the BRG [9] shall apply for subject
+        certificate fields addressed by the following sub-sections of BRG:
+        ...
+        (c) 7.1.4.2.2 Subject Distinguished Name - commonName.
+        """
+        name_attribute_mappings.update({
+            k: v for k, v in x520_name_unbounded.UNBOUNDED_ATTRIBUTE_TYPE_MAPPINGS.items()
+            if k in (
+                rfc5280.id_at_organizationName,
+                rfc5280.id_at_organizationalUnitName,
+                rfc5280.id_at_pseudonym,
+            )
+        })
+
+        if certificate_type not in etsi_constants.WEB_AUTHENTICATION_CERTIFICATE_TYPES:
+            name_attribute_mappings[rfc5280.id_at_commonName]: x520_name_unbounded.X520CommonNameUnbounded()
+
+        additional_validators = [
+            certificate.create_qc_statements_decoder(asn1.ETSI_QC_STATEMENTS_MAPPINGS)
+        ]
+
+        return certificate.create_decoding_validators(
+            name_attribute_mappings,
+            cabf.EXTENSION_MAPPINGS,
+            additional_validators
+        )
+
+
+def create_validators(certificate_type: CertificateType,
+                      validity_period_start_retriever: typing.Optional[document.ValidityPeriodStartRetriever] = None,
+                      additional_validity_validators=None,
+                      additional_spki_validators=None,
+                      additional_name_validators=None,
+                      additional_extension_validators=None,
+                      additional_top_level_validators=None) -> List[validation.Validator]:
+    subject_validators = [
+        en_319_412_1.LegalPersonOrganizationIdentifierValidator(),
+        en_319_412_1.NaturalPersonIdentifierValidator(),
+        en_319_412_1.EidasLegalPersonIdentifierValidator(),
+        en_319_412_1.NaturalPersonEidasIdentifierValidator(),
+        organization_id.OrganizationIdentifierLeiValidator(),
+        en_319_412_3.LegalPersonOrganizationAttributesEqualityValidator(),
+    ]
+
+    if additional_name_validators:
+        subject_validators.extend(additional_name_validators)
+
+    qc_statement_validators = [
+        ts_119_495.RolesOfPspValidator(),
+        ts_119_495.NCANameLatinCharactersValidator(),
+        ts_119_495.NCAIdValidator(),
+        en_319_412_5.QcCCLegislationCountryCodeValidator(),
+        en_319_412_5.QcEuRetentionPeriodValidator(),
+        en_319_412_5.QcTypeValidator(certificate_type),
+        en_319_412_5.QcEuPDSHttpsURLValidator(),
+        en_319_412_5.QcEuLimitValueValidator(),
+        en_319_412_5.QcEuPDSLanguageValidator(),
+        en_319_412_1.LegalPersonIdentifierNameRegistrationAuthoritiesValidator(),
+        en_319_412_1.NaturalPersonIdentifierNameRegistrationAuthoritiesValidator(),
+        en_319_412_5.QcStatementIdentifierAllowanceValidator(certificate_type),
+    ]
+
+    qc_statements_validator_container = validation.ValidatorContainer(
+        validators=qc_statement_validators,
+        pdu_class=rfc3739.QCStatements
+    )
+
+    extension_validators = [
+        en_319_412_2.QualifiedCertificatePoliciesValidator(certificate_type),
+        en_319_412_5.QcStatementsExtensionCriticalityValidator(),
+        qc_statements_validator_container,
+    ]
+
+    if additional_extension_validators:
+        extension_validators.extend(additional_extension_validators)
+
+    spki_validators = [
+        ts_119_312.RsaKeyValidator(),
+        ts_119_312.AllowedPublicKeyTypeValidator(),
+    ]
+
+    if additional_spki_validators:
+        spki_validators.extend(additional_spki_validators)
+
+    top_level_validators = [
+        en_319_412_2.ExtensionsPresenceValidator(),
+        ts_119_312.AllowedSignatureAlgorithmValidator(path='certificate.tbsCertificate.signature'),
+    ]
+
+    if additional_top_level_validators:
+        top_level_validators.extend(additional_top_level_validators)
+
+    if (
+            certificate_type in etsi_constants.LEGAL_PERSON_CERTIFICATE_TYPES and
+            certificate_type not in etsi_constants.CABF_CERTIFICATE_TYPES
+    ):
+        subject_validators.extend([
+            en_319_412_3.LegalPersonSubjectAttributeAllowanceValidator(),
+            en_319_412_3.LegalPersonDuplicateAttributeAllowanceValidator(),
+            en_319_412_3.LegalPersonCountryCodeValidator(),
+        ])
+
+    elif (
+            certificate_type in etsi_constants.NATURAL_PERSON_CERTIFICATE_TYPES and
+            certificate_type not in etsi_constants.CABF_CERTIFICATE_TYPES
+    ):
+        subject_validators.append(en_319_412_2.NaturalPersonSubjectAttributeAllowanceValidator())
+
+    if certificate_type not in etsi_constants.CABF_CERTIFICATE_TYPES:
+        extension_validators.extend([
+            en_319_412_2.CertificatePoliciesCriticalityValidator(),
+            en_319_412_2.SubjectAlternativeNameCriticalityValidator(),
+            en_319_412_2.IssuerAlternativeNameCriticalityValidator(),
+            en_319_412_2.ExtendedKeyUsageCriticalityValidator(),
+            en_319_412_2.CRLDistributionPointsCriticalityValidator(),
+            en_319_412_2.NaturalPersonExtensionIdentifierAllowanceValidator(certificate_type),
+            en_319_412_2.CrlDistributionPointsExtensionPresenceValidator(),
+            en_319_412_2.CrlDistributionPointsValidator(),
+            en_319_412_2.AuthorityInformationAccessValidator(),
+        ])
+
+        if certificate_type in etsi_constants.WEB_AUTHENTICATION_CERTIFICATE_TYPES:
+            extension_validators.extend([
+                en_319_412_4.NcpWExtendedKeyUsagePresenceValidator(),
+                serverauth.serverauth_subscriber.SubscriberEkuAllowanceValidator(),
+                en_319_412_4.NcpWCriticalityExtendedKeyUsageValidator(),
+                serverauth.serverauth_subscriber.SubscriberSanGeneralNameTypeValidator(),
+                serverauth_name.DnsNameLdhLabelSyntaxValidator(),
+                en_319_412_4.NcpWSubjectAltNamePresenceValidator(),
+            ])
+
+        # TODO: fix commitment types when adding support for eSeal and eSignature
+        if certificate_type in etsi_constants.LEGAL_PERSON_CERTIFICATE_TYPES:
+            extension_validators.append(en_319_412_3.LegalPersonKeyUsageValidator(is_content_commitment_type=None))
+        elif certificate_type in etsi_constants.NATURAL_PERSON_CERTIFICATE_TYPES:
+            extension_validators.append(en_319_412_2.NaturalPersonKeyUsageValidator(is_content_commitment_type=None))
+
+    if certificate_type in etsi_constants.QEVCP_W_PSD2_EIDAS_CERTIFICATE_TYPES:
+        qc_statement_validators.append(ts_119_495.PresenceofQCEUPDSStatementValidator())
+
+        subject_validators.append(ts_119_495.PsdOrganizationIdentifierFormatValidator())
+
+    if certificate_type in etsi_constants.QNCP_W_CERTIFICATE_TYPES:
+        subject_validators.append(en_319_412_4.QncpWCommonNameValidator())
+    elif certificate_type in etsi_constants.NCP_W_CERTIFICATE_TYPES:
+        subject_validators.append(en_319_412_4.NcpWCommonNameValidator())
+
+    if certificate_type in etsi_constants.CABF_CERTIFICATE_TYPES:
+        extension_validators.append(en_319_411_1.CertificatePoliciesValidator(certificate_type))
+
+        serverauth_cert_type = etsi_constants.ETSI_TYPE_TO_CABF_SERVERAUTH_TYPE_MAPPINGS[certificate_type]
+
+        return serverauth.create_validators(
+            serverauth_cert_type,
+            validity_period_start_retriever=validity_period_start_retriever,
+            additional_top_level_validators=top_level_validators,
+            additional_validity_validators=additional_validity_validators,
+            additional_name_validators=subject_validators,
+            additional_extension_validators=extension_validators,
+            additional_spki_validators=spki_validators
+        )
+    else:
+        spki_validator_container = validation.ValidatorContainer(
+            validators=spki_validators,
+            path='certificate.tbsCertificate.subjectPublicKeyInfo'
+        )
+
+        top_level_container = validation.ValidatorContainer(
+            validators=top_level_validators,
+            pdu_class=rfc5280.Certificate
+        )
+
+        extension_validators.extend([
+            alternative_name.create_internal_name_validator_container(
+                etsi_shared.VALIDATION_INTERNAL_DOMAIN_NAME,
+                etsi_shared.VALIDATION_INTERNAL_IP_ADDRESS,
+                allow_onion_tld=False
+            ),
+            alternative_name.create_cpsuri_internal_domain_name_validator(
+                etsi_shared.VALIDATION_INTERNAL_DOMAIN_NAME),
+        ])
+
+        return [
+            certificate.create_issuer_validator_container(
+                []
+            ),
+            certificate.create_validity_validator_container(additional_validity_validators),
+            certificate.create_subject_validator_container(
+                subject_validators
+            ),
+            certificate.create_extensions_validator_container(
+                extension_validators
+            ),
+            spki_validator_container,
+            top_level_container,
+        ]
+
+
+def create_etsi_finding_filters(certificate_type) -> List[finding_filter.FindingDescriptionFilter]:
+    if certificate_type in etsi_constants.CABF_CERTIFICATE_TYPES:
+        serverauth_cert_type = etsi_constants.ETSI_TYPE_TO_CABF_SERVERAUTH_TYPE_MAPPINGS[certificate_type]
+
+        filters = serverauth.create_serverauth_finding_filters(serverauth_cert_type)
+    else:
+        filters = [
+            serverauth_finding_filter.DnsNameGeneralNamePreferredNameSyntaxFilter(),
+        ]
+
+    if certificate_type in etsi_constants.QEVCP_W_PSD2_EIDAS_NON_BROWSER_CERTIFICATE_TYPES:
+        filters.append(etsi_finding_filter.Psd2CabfServerauthValidityPeriodFilter())
+
+    return filters
diff --git a/pkilint/etsi/asn1/__init__.py b/pkilint/etsi/asn1/__init__.py
index e69de29..b6e1d93 100644
--- a/pkilint/etsi/asn1/__init__.py
+++ b/pkilint/etsi/asn1/__init__.py
@@ -0,0 +1,17 @@
+from pyasn1_alt_modules import rfc3739
+
+from pkilint import document
+from pkilint.etsi.asn1 import en_319_412_5, ts_119_495, en_319_411_2
+
+ETSI_QC_STATEMENTS_MAPPINGS = {
+    en_319_412_5.id_etsi_qcs_QcCompliance: document.ValueDecoder.VALUE_NODE_ABSENT,
+    en_319_412_5.id_etsi_qcs_QcLimitValue: en_319_412_5.QcEuLimitValue(),
+    en_319_412_5.id_etsi_qcs_QcRetentionPeriod: en_319_412_5.QcEuRetentionPeriod(),
+    en_319_412_5.id_etsi_qcs_QcSSCD: document.ValueDecoder.VALUE_NODE_ABSENT,
+    en_319_412_5.id_etsi_qcs_QcPDS: en_319_412_5.QcEuPDS(),
+    en_319_412_5.id_etsi_qcs_QcType: en_319_412_5.QcType(),
+    en_319_412_5.id_etsi_qcs_QcCClegislation: en_319_412_5.QcCClegislation(),
+    ts_119_495.id_etsi_psd2_qcStatement: ts_119_495.PSD2QcType(),
+    rfc3739.id_qcs_pkixQCSyntax_v1: document.OptionalAsn1TypeWrapper(rfc3739.SemanticsInformation()),
+    rfc3739.id_qcs_pkixQCSyntax_v2: document.OptionalAsn1TypeWrapper(rfc3739.SemanticsInformation()),
+}
diff --git a/pkilint/etsi/asn1/en_319_411_1.py b/pkilint/etsi/asn1/en_319_411_1.py
new file mode 100644
index 0000000..a340397
--- /dev/null
+++ b/pkilint/etsi/asn1/en_319_411_1.py
@@ -0,0 +1,28 @@
+from pyasn1.type import univ
+
+
+_ARC = univ.ObjectIdentifier('0.4.0.2042.1.1')
+
+id_ncp = _ARC + (1,)
+
+id_ncp_plus = _ARC + (2,)
+
+id_lcp = _ARC + (3,)
+
+id_evcp = _ARC + (4,)
+
+id_dvcp = _ARC + (5,)
+
+id_ovcp = _ARC + (6,)
+
+id_ivcp = _ARC + (7,)
+
+POLICY_OIDS = {
+    id_ncp,
+    id_ncp_plus,
+    id_lcp,
+    id_evcp,
+    id_dvcp,
+    id_ovcp,
+    id_ivcp,
+}
diff --git a/pkilint/etsi/asn1/en_319_411_2.py b/pkilint/etsi/asn1/en_319_411_2.py
new file mode 100644
index 0000000..0a08955
--- /dev/null
+++ b/pkilint/etsi/asn1/en_319_411_2.py
@@ -0,0 +1,29 @@
+from pyasn1.type.univ import ObjectIdentifier
+
+
+_ARC = ObjectIdentifier('0.4.0.194112.1')
+
+
+id_qcp_natural = _ARC + (0,)
+
+id_qcp_legal = _ARC + (1,)
+
+id_qcp_natural_qscd = _ARC + (2,)
+
+id_qcp_legal_qscd = _ARC + (3,)
+
+id_qcp_web = _ARC + (4,)
+
+id_qncp_web = _ARC + (5,)
+
+id_qncp_web_gen = _ARC + (6,)
+
+QUALIFIED_POLICY_OIDS = {
+    id_qcp_natural,
+    id_qcp_legal,
+    id_qcp_natural_qscd,
+    id_qcp_legal_qscd,
+    id_qcp_web,
+    id_qncp_web,
+    id_qncp_web_gen,
+}
diff --git a/pkilint/etsi/asn1/en_319_412_1.py b/pkilint/etsi/asn1/en_319_412_1.py
new file mode 100644
index 0000000..0e91e74
--- /dev/null
+++ b/pkilint/etsi/asn1/en_319_412_1.py
@@ -0,0 +1,41 @@
+from pyasn1.type import univ
+
+
+def _OID(*components):
+    output = []
+    for x in tuple(components):
+        if isinstance(x, univ.ObjectIdentifier):
+            output.extend(list(x))
+        else:
+            output.append(int(x))
+
+    return univ.ObjectIdentifier(output)
+
+
+_ID_ETSI_ARC = _OID(0, 4, 0, 194121)
+
+
+id_etsi_qcs_semantics_identifiers = _OID(_ID_ETSI_ARC, 1)
+
+
+id_etsi_qcs_semanticsId_Natural = _OID(id_etsi_qcs_semantics_identifiers, 1)
+
+
+id_etsi_qcs_SemanticsId_Legal = _OID(id_etsi_qcs_semantics_identifiers, 2)
+
+
+id_etsi_qcs_semanticsId_eIDASNatural = _OID(id_etsi_qcs_semantics_identifiers, 3)
+
+
+id_etsi_qcs_SemanticsId_eIDASLegal = _OID(id_etsi_qcs_semantics_identifiers, 4)
+
+
+id_etsi_ext = _OID(_ID_ETSI_ARC, 2)
+
+
+id_etsi_ext_valassured_ST_certs = _OID(id_etsi_ext, 1)
+
+
+EXTENSION_MAPPINGS = {
+    id_etsi_ext_valassured_ST_certs: univ.Null(),
+}
diff --git a/pkilint/etsi/en_319_411_1.py b/pkilint/etsi/en_319_411_1.py
new file mode 100644
index 0000000..0acfd09
--- /dev/null
+++ b/pkilint/etsi/en_319_411_1.py
@@ -0,0 +1,60 @@
+from pyasn1_alt_modules import rfc5280
+
+from pkilint import validation, oid
+from pkilint.etsi import etsi_constants
+from pkilint.etsi.asn1 import en_319_411_1
+
+
+class CertificatePoliciesValidator(validation.Validator):
+    """
+    GEN-6.3.3-12: The CP identifier shall be [CHOICE]:
+    ...
+    """
+    VALIDATION_MULTIPLE_RESERVED_POLICY_OIDS_PRESENT = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.ERROR,
+        'etsi.en_319_411_1.gen-6.3.3-12.multiple_reserved_policy_oids_present',
+    )
+
+    VALIDATION_PROHIBITED_RESERVED_POLICY_OID_PRESENT = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.ERROR,
+        'etsi.en_319_411_1.gen-6.3.3-12.prohibited_reserved_policy_oid_present',
+    )
+
+    _CERTIFICATE_TYPE_SET_TO_POLICY_OID_MAPPINGS = [
+        (etsi_constants.CABF_EV_CERTIFICATE_TYPES, en_319_411_1.id_evcp),
+        (etsi_constants.CABF_DV_CERTIFICATE_TYPES, en_319_411_1.id_dvcp),
+        (etsi_constants.CABF_OV_CERTIFICATE_TYPES, en_319_411_1.id_ovcp),
+        (etsi_constants.CABF_IV_CERTIFICATE_TYPES, en_319_411_1.id_ivcp),
+    ]
+
+    def __init__(self, certificate_type):
+        super().__init__(
+            validations=[
+                self.VALIDATION_MULTIPLE_RESERVED_POLICY_OIDS_PRESENT,
+                self.VALIDATION_PROHIBITED_RESERVED_POLICY_OID_PRESENT
+            ],
+            pdu_class=rfc5280.CertificatePolicies
+        )
+
+        self._expected_policy_oid = next(
+            p for t, p in self._CERTIFICATE_TYPE_SET_TO_POLICY_OID_MAPPINGS if certificate_type in t
+        )
+
+    def validate(self, node):
+        etsi_policy_oids = en_319_411_1.POLICY_OIDS & node.document.policy_oids
+
+        if len(etsi_policy_oids) > 1:
+            oids = oid.format_oids(etsi_policy_oids)
+
+            raise validation.ValidationFindingEncountered(
+                self.VALIDATION_MULTIPLE_RESERVED_POLICY_OIDS_PRESENT,
+                f'Multiple reserved certificate policy OIDs present: {oids}'
+            )
+
+        if etsi_policy_oids and self._expected_policy_oid not in etsi_policy_oids:
+            prohibited_oid = next(iter(etsi_policy_oids))
+
+            raise validation.ValidationFindingEncountered(
+                self.VALIDATION_PROHIBITED_RESERVED_POLICY_OID_PRESENT,
+                f'Prohibited reserved certificate policy OID present: {prohibited_oid}'
+            )
diff --git a/pkilint/etsi/en_319_412_1.py b/pkilint/etsi/en_319_412_1.py
new file mode 100644
index 0000000..9ffb907
--- /dev/null
+++ b/pkilint/etsi/en_319_412_1.py
@@ -0,0 +1,545 @@
+import re
+import typing
+from typing import List
+
+from pyasn1.type import univ
+from pyasn1_alt_modules import rfc5280, rfc3739
+
+from pkilint import validation, document
+from pkilint.common import organization_id
+from pkilint.common.organization_id import ParsedOrganizationIdentifier
+from pkilint.etsi.asn1 import en_319_412_1
+from pkilint.itu import x520_name
+from pkilint.pkix import Rfc2119Word, certificate
+
+
+def _get_semantics_info_nodes(cert: certificate.RFC5280Certificate) -> List[document.PDUNode]:
+    ext_and_idx = cert.get_extension_by_oid(rfc3739.id_pe_qcStatements)
+
+    if ext_and_idx is None:
+        return []
+
+    ext, _ = ext_and_idx
+
+    try:
+        _, ext_decoded_value_node = ext.children['extnValue'].child
+    except ValueError:
+        return []
+
+    nodes = []
+    for statement_node in ext_decoded_value_node.children.values():
+        if statement_node.children['statementId'].pdu == rfc3739.id_qcs_pkixQCSyntax_v2:
+            info_node = statement_node.children.get('statementInfo')
+
+            if info_node is not None:
+                info_node_decoded = info_node.children.get('semanticsInformation')
+
+                if info_node_decoded is not None:
+                    nodes.append(info_node_decoded)
+
+    return nodes
+
+
+def _cert_has_semantics_id(semantics_id: univ.ObjectIdentifier, cert: certificate.RFC5280Certificate) -> bool:
+    # noinspection PyTypeChecker
+    semantics_info_nodes = _get_semantics_info_nodes(cert)
+
+    for semantics_info_node in semantics_info_nodes:
+        id_oid_node = semantics_info_node.children.get('semanticsIdentifier')
+
+        if id_oid_node is not None and id_oid_node.pdu == semantics_id:
+            return True
+
+    return False
+
+
+class LegalPersonOrganizationIdentifierValidator(organization_id.OrganizationIdentifierValidatorBase):
+    VALIDATION_INVALID_ORGANIZATION_ID_FORMAT = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.ERROR,
+        'etsi.en_319_412_1.leg-5.1.4-02.invalid_format'
+    )
+
+    VALIDATION_INVALID_ORGANIZATION_ID_SCHEME = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.ERROR,
+        'etsi.en_319_412_1.leg-5.1.4-03.invalid_scheme'
+    )
+
+    VALIDATION_INVALID_ORGANIZATION_ID_COUNTRY = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.ERROR,
+        'etsi.en_319_412_1.leg-5.1.4-03.invalid_country'
+    )
+
+    VALIDATION_ORGANIZATION_NATIONAL_SCHEME_DETECTED = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.NOTICE,
+        'etsi.en_319_412_1.leg-5.1.4-03.national_identifier_scheme_detected'
+    )
+
+    _STATE_PROVINCE_PROHIBITED = (Rfc2119Word.MUST_NOT, VALIDATION_INVALID_ORGANIZATION_ID_FORMAT.code)
+    _REFERENCE_REQUIRED = (Rfc2119Word.MUST, VALIDATION_INVALID_ORGANIZATION_ID_FORMAT.code)
+
+    _NTR_SCHEME = organization_id.OrganizationIdentifierElementAllowance(
+        country_codes=(organization_id.ISO3166_1_WITH_TRANSNATIONAL_COUNTRY_CODES,
+                       VALIDATION_INVALID_ORGANIZATION_ID_COUNTRY),
+        state_province=_STATE_PROVINCE_PROHIBITED,
+        reference=_REFERENCE_REQUIRED
+    )
+
+    _VAT_SCHEME = organization_id.OrganizationIdentifierElementAllowance(
+        country_codes=(organization_id.ISO3166_1_WITH_TRANSNATIONAL_COUNTRY_CODES | {
+            organization_id.COUNTRY_CODE_GREECE_TRADITIONAL,
+            organization_id.COUNTRY_CODE_NORTHERN_IRELAND
+        },
+                       VALIDATION_INVALID_ORGANIZATION_ID_COUNTRY),
+        state_province=_STATE_PROVINCE_PROHIBITED,
+        reference=_REFERENCE_REQUIRED
+    )
+
+    _PSD_SCHEME = organization_id.OrganizationIdentifierElementAllowance(
+        country_codes=(organization_id.ISO3166_1_WITH_TRANSNATIONAL_COUNTRY_CODES,
+                       VALIDATION_INVALID_ORGANIZATION_ID_COUNTRY),
+        state_province=_STATE_PROVINCE_PROHIBITED,
+        reference=_REFERENCE_REQUIRED
+    )
+
+    _LEI_SCHEME = organization_id.OrganizationIdentifierElementAllowance(
+        country_codes=({organization_id.COUNTRY_CODE_GLOBAL_SCHEME},
+                       VALIDATION_INVALID_ORGANIZATION_ID_COUNTRY),
+        state_province=_STATE_PROVINCE_PROHIBITED,
+        reference=_REFERENCE_REQUIRED
+    )
+
+    _ELEMENT_ALLOWANCES = {
+        'NTR': _NTR_SCHEME,
+        'VAT': _VAT_SCHEME,
+        'PSD': _PSD_SCHEME,
+        'LEI': _LEI_SCHEME,
+    }
+
+    def __init__(self):
+        super().__init__(element_allowances=self._ELEMENT_ALLOWANCES,
+                         invalid_format_validation=self.VALIDATION_INVALID_ORGANIZATION_ID_FORMAT,
+                         additional_validations=[
+                             self.VALIDATION_INVALID_ORGANIZATION_ID_SCHEME,
+                             self.VALIDATION_ORGANIZATION_NATIONAL_SCHEME_DETECTED
+                         ],
+                         pdu_class=x520_name.X520OrganizationIdentifier)
+
+    def match(self, node):
+        if not super().match(node):
+            return False
+
+        # skip nodes that haven't been decoded
+        if not any(node.children):
+            return False
+
+        # noinspection PyTypeChecker
+        return _cert_has_semantics_id(en_319_412_1.id_etsi_qcs_SemanticsId_Legal, node.document)
+
+    @classmethod
+    def handle_unknown_scheme(cls, node: document.PDUNode, parsed: organization_id.ParsedOrganizationIdentifier):
+        is_valid_national_scheme = (
+                parsed.is_national_scheme and
+                parsed.country in organization_id.ISO3166_1_WITH_TRANSNATIONAL_COUNTRY_CODES and
+                parsed.state_province is None and
+                parsed.reference
+        )
+
+        value_str = str(node.child[1].pdu)
+
+        if is_valid_national_scheme:
+            raise validation.ValidationFindingEncountered(
+                cls.VALIDATION_ORGANIZATION_NATIONAL_SCHEME_DETECTED,
+                f'National registration scheme "{parsed.scheme}" in organization identifier: "{value_str}"'
+            )
+        else:
+            raise validation.ValidationFindingEncountered(
+                cls.VALIDATION_INVALID_ORGANIZATION_ID_SCHEME,
+                f'Invalid registration scheme "{parsed.scheme}" in organization identifier: "{value_str}"'
+            )
+
+    @classmethod
+    def parse_organization_id_node(cls, node: document.PDUNode) -> ParsedOrganizationIdentifier:
+        value = str(node.child[1].pdu)
+
+        return organization_id.parse_organization_identifier(value)
+
+
+_NATURAL_PERSON_ID_REGEX = re.compile(
+    r'^(?P<scheme>[A-Z]{2}[A-Z:])(?P<country>[a-zA-Z]{2})-(?P<reference>.+)$'
+)
+
+
+class ParsedNaturalPersonIdentifier(typing.NamedTuple):
+    raw: typing.Optional[str]
+    scheme: str
+    is_national_scheme: bool
+    country: str
+    reference: str
+
+
+def parse_natural_person_identifier(value: str) -> ParsedNaturalPersonIdentifier:
+    m = _NATURAL_PERSON_ID_REGEX.match(value)
+
+    if m is None:
+        raise ValueError(f'Invalid natural person identifier syntax: "{value}"')
+
+    is_national_scheme = m['scheme'].endswith(':')
+
+    scheme = m['scheme'][:2] if is_national_scheme else m['scheme']
+
+    return ParsedNaturalPersonIdentifier(value, scheme, is_national_scheme, m['country'], m['reference'])
+
+
+class NaturalPersonIdentifierValidator(validation.Validator):
+    VALIDATION_INVALID_NATURAL_PERSON_ID_FORMAT = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.ERROR,
+        'etsi.en_319_412_1.nat-5.1.3.invalid_identifier_format'
+    )
+
+    VALIDATION_NATURAL_PERSON_ID_NATIONAL_SCHEME_DETECTED = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.NOTICE,
+        'etsi.en_319_412_1.nat-5.1.3.national_identifier_scheme_detected'
+    )
+
+    VALIDATION_INVALID_NATURAL_PERSON_ID_SCHEME = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.ERROR,
+        'etsi.en_319_412_2.nat-5.1.3.invalid_identifier_scheme'
+    )
+
+    VALIDATION_DEPRECATED_NATURAL_PERSON_ID_SCHEME = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.WARNING,
+        'etsi.en_319_412_3.nat-5.1.3.deprecated_identifier_scheme'
+    )
+
+    VALIDATION_INVALID_NATURAL_PERSON_ID_COUNTRY = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.ERROR,
+        'etsi.en_419_412_4.nat-5.1.3.invalid_identifier_country'
+    )
+
+    _KNOWN_SCHEMES = {
+        'PAS',
+        'IDC',
+        'PNO',
+        'TAX',
+        'TIN',
+    }
+
+    def __init__(self):
+        super().__init__(
+            validations=[
+                self.VALIDATION_INVALID_NATURAL_PERSON_ID_FORMAT,
+                self.VALIDATION_NATURAL_PERSON_ID_NATIONAL_SCHEME_DETECTED,
+                self.VALIDATION_INVALID_NATURAL_PERSON_ID_SCHEME,
+                self.VALIDATION_DEPRECATED_NATURAL_PERSON_ID_SCHEME,
+                self.VALIDATION_INVALID_NATURAL_PERSON_ID_COUNTRY,
+            ],
+            pdu_class=rfc5280.X520SerialNumber
+        )
+
+    def match(self, node):
+        if not super().match(node):
+            return False
+
+        # noinspection PyTypeChecker
+        return _cert_has_semantics_id(en_319_412_1.id_etsi_qcs_semanticsId_Natural, node.document)
+
+    def validate(self, node):
+        value = str(node.pdu)
+
+        try:
+            parsed = parse_natural_person_identifier(value)
+        except ValueError as e:
+            raise validation.ValidationFindingEncountered(
+                self.VALIDATION_INVALID_NATURAL_PERSON_ID_FORMAT,
+                str(e)
+            )
+
+        findings = []
+        if parsed.scheme in self._KNOWN_SCHEMES:
+            if parsed.scheme == 'TAX':
+                findings.append(validation.ValidationFindingDescription(
+                    self.VALIDATION_DEPRECATED_NATURAL_PERSON_ID_SCHEME,
+                    f'Deprecated natural person identifier scheme: "{parsed.scheme}"'
+                ))
+        else:
+            if parsed.is_national_scheme:
+                findings.append(validation.ValidationFindingDescription(
+                    self.VALIDATION_NATURAL_PERSON_ID_NATIONAL_SCHEME_DETECTED,
+                    f'National registration scheme "{parsed.scheme}" in natural person identifier: "{value}"'
+                ))
+            else:
+                findings.append(validation.ValidationFindingDescription(
+                    self.VALIDATION_INVALID_NATURAL_PERSON_ID_SCHEME,
+                    f'Invalid natural person identifier scheme: "{parsed.scheme}"'
+                ))
+
+        if parsed.country not in organization_id.ISO3166_1_WITH_TRANSNATIONAL_COUNTRY_CODES:
+            findings.append(validation.ValidationFindingDescription(
+                self.VALIDATION_INVALID_NATURAL_PERSON_ID_COUNTRY,
+                f'Invalid natural person identifier country code: "{parsed.country}"'
+            ))
+
+        return validation.ValidationResult(self, node, findings)
+
+
+class EidasLegalPersonIdentifierValidator(validation.Validator):
+    """
+    LEG-5.1.6-03: Any organizationIdentifier attribute present in the subject field of the certificate shall
+    comply with the content requirement specified for the eIDAS LegalPersonIdentifier attribute.
+
+    From eIDAS SAML Attribute Profile v1.2 Final, section 2.5:
+    - The Unique Identifier MUST NOT contain any whitespace.
+    - The Unique Identifier MUST NOT exceed a total of 256 characters.
+    """
+    VALIDATION_EIDAS_LEGAL_PERSON_IDENTIFIER_WHITESPACE_PRESENT = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.ERROR,
+        'etsi.en_319_412_1.leg-5.1.6-03.eidas_legal_person_identifier_whitespace_present'
+    )
+
+    VALIDATION_EIDAS_LEGAL_PERSON_IDENTIFIER_TOO_LONG = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.ERROR,
+        'etsi.en_319_412_1.leg-5.1.6-03.eidas_legal_person_identifier_too_long'
+    )
+
+    _MAX_LENGTH = 256
+
+    def __init__(self):
+        super().__init__(
+            validations=[
+                self.VALIDATION_EIDAS_LEGAL_PERSON_IDENTIFIER_WHITESPACE_PRESENT,
+                self.VALIDATION_EIDAS_LEGAL_PERSON_IDENTIFIER_TOO_LONG,
+            ],
+            pdu_class=x520_name.X520OrganizationIdentifier
+        )
+
+    def match(self, node):
+        # noinspection PyTypeChecker
+        return super().match(node) and _cert_has_semantics_id(
+            en_319_412_1.id_etsi_qcs_SemanticsId_eIDASLegal,
+            node.document
+        )
+
+    def validate(self, node):
+        value = str(node.child[1].pdu)
+
+        if any(c.isspace() for c in value):
+            raise validation.ValidationFindingEncountered(
+                self.VALIDATION_EIDAS_LEGAL_PERSON_IDENTIFIER_WHITESPACE_PRESENT,
+                f'Whitespace present in organization identifier: "{value}"'
+            )
+
+        value_len = len(value)
+
+        if value_len > self._MAX_LENGTH:
+            raise validation.ValidationFindingEncountered(
+                self.VALIDATION_EIDAS_LEGAL_PERSON_IDENTIFIER_TOO_LONG,
+                f'Organization identifier "{value}" ({value_len} characters) exceeds maximum length of '
+                f'{self._MAX_LENGTH} characters'
+            )
+
+
+class NameRegistrationAuthoritiesValidatorBase(validation.Validator):
+    def __init__(
+            self,
+            name_registration_authorities_missing_validation: validation.ValidationFinding,
+            name_registration_authorities_uri_missing_validation: validation.ValidationFinding,
+            attribute_type_id: univ.ObjectIdentifier,
+            semantics_id: univ.ObjectIdentifier
+    ):
+        self._name_registration_authorities_missing_validation = name_registration_authorities_missing_validation
+        self._name_registration_authorities_uri_missing_validation = (
+            name_registration_authorities_uri_missing_validation
+        )
+
+        self._attribute_type_id = attribute_type_id
+        self._semantics_id = semantics_id
+
+        validations = [
+            name_registration_authorities_missing_validation,
+            name_registration_authorities_uri_missing_validation,
+        ]
+
+        super().__init__(validations=validations, pdu_class=rfc3739.SemanticsInformation)
+
+    @classmethod
+    def is_attribute_value_national_id_scheme(cls, atv_node: document.PDUNode) -> bool:
+        pass
+
+    def match(self, node):
+        if not super().match(node):
+            return False
+
+        semantics_id_node = node.children.get('semanticsIdentifier')
+
+        if semantics_id_node is None or semantics_id_node.pdu != self._semantics_id:
+            return False
+
+        atvs_and_idxs = node.document.get_subject_attributes_by_type(self._attribute_type_id)
+
+        return any(self.is_attribute_value_national_id_scheme(a) for a, _ in atvs_and_idxs)
+
+    def validate(self, node):
+        nra_node = node.children.get('nameRegistrationAuthorities')
+
+        if nra_node is None:
+            raise validation.ValidationFindingEncountered(self._name_registration_authorities_missing_validation)
+
+        if not any(g.child[0] == 'uniformResourceIdentifier' for g in nra_node.children.values()):
+            raise validation.ValidationFindingEncountered(self._name_registration_authorities_uri_missing_validation)
+
+
+class NaturalPersonIdentifierNameRegistrationAuthoritiesValidator(NameRegistrationAuthoritiesValidatorBase):
+    """
+    NAT-5.1.3-05: When a locally defined identity type reference is provided (two characters followed by ":"), the
+    nameRegistrationAuthorities element of SemanticsInformation (IETF RFC 3739 [1]) shall be present.
+    """
+    VALIDATION_NAME_REGISTRATION_AUTHORITIES_MISSING = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.ERROR,
+        'etsi.en_319_412_1.nat-5.1.3-05.national_id_scheme_name_registration_authorities_missing'
+    )
+
+    """
+    NAT-5.1.3-06: The nameRegistrationAuthorities element of SemanticsInformation (IETF RFC 3739 [1]) shall
+    contain at least a uniformResourceIdentifier generalName.
+    """
+    VALIDATION_NAME_REGISTRATION_AUTHORITIES_URI_MISSING = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.ERROR,
+        'etsi.en_319_412_1.nat-5.1.3-05.national_id_scheme_name_registration_authorities_uri_missing'
+    )
+
+    def __init__(self):
+        super().__init__(
+            self.VALIDATION_NAME_REGISTRATION_AUTHORITIES_MISSING,
+            self.VALIDATION_NAME_REGISTRATION_AUTHORITIES_URI_MISSING,
+            rfc5280.id_at_serialNumber,
+            en_319_412_1.id_etsi_qcs_semanticsId_Natural
+        )
+
+    @classmethod
+    def is_attribute_value_national_id_scheme(cls, atv_node: document.PDUNode) -> bool:
+        value_node = atv_node.children['value']
+
+        try:
+            _, decoded_value_node = value_node.child
+
+            value_str = str(decoded_value_node.pdu)
+
+            parsed = parse_natural_person_identifier(value_str)
+        except ValueError:
+            return False
+
+        return parsed.is_national_scheme
+
+
+class LegalPersonIdentifierNameRegistrationAuthoritiesValidator(NameRegistrationAuthoritiesValidatorBase):
+    """
+    LEG-5.1.4-05: When a locally defined identity type reference is provided (two characters followed by ":"), the
+    nameRegistrationAuthorities element of SemanticsInformation (IETF RFC 3739 [1]) shall be present and
+    shall contain at least a uniformResourceIdentifier generalName.
+    """
+    VALIDATION_NAME_REGISTRATION_AUTHORITIES_MISSING = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.ERROR,
+        'etsi.en_319_412_1.leg-5.1.4-05.national_id_scheme_name_registration_authorities_missing'
+    )
+
+    VALIDATION_NAME_REGISTRATION_AUTHORITIES_URI_MISSING = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.ERROR,
+        'etsi.en_319_412_1.leg-5.1.4-05.national_id_scheme_name_registration_authorities_uri_missing'
+    )
+
+    def __init__(self):
+        super().__init__(
+            self.VALIDATION_NAME_REGISTRATION_AUTHORITIES_MISSING,
+            self.VALIDATION_NAME_REGISTRATION_AUTHORITIES_URI_MISSING,
+            x520_name.id_at_organizationIdentifier,
+            en_319_412_1.id_etsi_qcs_SemanticsId_Legal
+        )
+
+    @classmethod
+    def is_attribute_value_national_id_scheme(cls, atv_node: document.PDUNode) -> bool:
+        value_node = atv_node.children['value']
+
+        try:
+            _, decoded_dirstring_node = value_node.child
+
+            _, decoded_value_node = decoded_dirstring_node.child
+
+            value_str = str(decoded_value_node.pdu)
+
+            parsed = organization_id.parse_organization_identifier(value_str)
+        except ValueError:
+            return False
+
+        return parsed.is_national_scheme
+
+
+class NaturalPersonEidasIdentifierValidator(validation.Validator):
+    """
+    NAT-5.1.5-01: If using electronic identity attributes as specified in eIDAS SAML
+    attribute profile for a certificate issued to natural persons, the semantics of 
+    id-etsi-qcs-SemanticsId-eIDASNatural shall be as follows. 
+    NAT-5.1.5-02: If the eIDAS natural person identifier is included, the values 
+    of attributes in the subject field shall meet the content requirements of corresponding
+    attributes defined by the eIDAS SAML attribute profile according to the following requirements.
+
+    NAT-5.1.5-03: Any serialNumber attribute value in the subject field of the certificate
+    shall comply with the content requirement specified for the eIDAS PersonIdentifier attribute.
+
+    NAT-5.1.5-04: Attributes present in subject field of the certificate are equivalent to defined attributes 
+    in accordance to the below table. This means that the present attribute shall hold equivalent 
+    information, even if the format used to express that information differs.
+
+    serialNumber -> PersonIdentifier Example: ES/AT/02635542Y
+    """
+    VALIDATION_INVALID_ISO_3166 = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.ERROR,
+        'etsi.nat_5.1.5-03.invalid_iso_3166'
+    )
+
+    VALIDATION_INVALID_SYNTAX_SERIAL = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.ERROR,
+        'etsi.nat_5.1.5-03.invalid_syntax_serial'
+    )
+    VALIDATION_INVALID_CHARACTER_SERIAL = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.ERROR,
+        'etsi.nat_5.1.5-03.invalid_character_serial'
+    )
+
+    def __init__(self):
+        super().__init__(
+            validations=[
+                self.VALIDATION_INVALID_ISO_3166,
+                self.VALIDATION_INVALID_SYNTAX_SERIAL,
+                self.VALIDATION_INVALID_CHARACTER_SERIAL
+            ],
+            pdu_class=rfc5280.X520SerialNumber
+        )
+
+    def match(self, node):
+        if not super().match(node):
+            return False
+
+        # noinspection PyTypeChecker
+        return _cert_has_semantics_id(en_319_412_1.id_etsi_qcs_semanticsId_eIDASNatural, node.document)
+
+    def validate(self, node):
+        value = str(node.pdu)
+        findings = []
+        if len(value) < 7:
+            raise validation.ValidationFindingEncountered(self.VALIDATION_INVALID_SYNTAX_SERIAL,
+                                                          "Invalid serial number syntax (needs more characters).")
+        if value[2] != '/' or value[5] != '/':
+            findings.append(validation.ValidationFindingDescription(
+                self.VALIDATION_INVALID_CHARACTER_SERIAL,
+                "No backslash found after ISO-3166 country code."
+            ))
+        if (
+                value[0:2] not in organization_id.ISO3166_1_WITH_TRANSNATIONAL_COUNTRY_CODES or
+                value[3:5] not in organization_id.ISO3166_1_WITH_TRANSNATIONAL_COUNTRY_CODES
+        ):
+            findings.append(validation.ValidationFindingDescription(
+                self.VALIDATION_INVALID_ISO_3166,
+                "Invalid 3166 ISO Code."
+            ))
+
+        return validation.ValidationResult(self, node, findings)
diff --git a/pkilint/etsi/en_319_412_2.py b/pkilint/etsi/en_319_412_2.py
new file mode 100644
index 0000000..c8b28be
--- /dev/null
+++ b/pkilint/etsi/en_319_412_2.py
@@ -0,0 +1,495 @@
+import typing
+
+from pyasn1.type import univ
+from pyasn1_alt_modules import rfc5280, rfc3739
+
+import pkilint.etsi.asn1.en_319_411_2
+from pkilint import validation, oid, document, common
+from pkilint.etsi import asn1 as etsi_asn1, etsi_shared
+from pkilint.etsi import etsi_constants
+from pkilint.etsi.asn1 import en_319_411_2
+from pkilint.pkix import extension, name, Rfc2119Word
+from pkilint.pkix.general_name import GeneralNameTypeName
+
+
+class CertificatePoliciesCriticalityValidator(extension.ExtensionCriticalityValidator):
+    VALIDATION_CERTIFICATE_POLICIES_CRITICAL = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.WARNING,
+        'etsi.en_319_412_2.gen-4.3.3-1.critical_certificate_policies_extension'
+    )
+
+    def __init__(self):
+        super().__init__(validation=self.VALIDATION_CERTIFICATE_POLICIES_CRITICAL,
+                         type_oid=rfc5280.id_ce_certificatePolicies,
+                         is_critical=False)
+
+
+class SubjectAlternativeNameCriticalityValidator(extension.ExtensionCriticalityValidator):
+    VALIDATION_SAN_CRITICAL = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.ERROR,
+        'etsi.en_319_412_2.gen-4.3.5-1.san_extension_is_critical'
+    )
+
+    def __init__(self):
+        super().__init__(validation=self.VALIDATION_SAN_CRITICAL,
+                         type_oid=rfc5280.id_ce_subjectAltName,
+                         is_critical=False)
+
+
+class IssuerAlternativeNameCriticalityValidator(extension.ExtensionCriticalityValidator):
+    VALIDATION_ISSUER_ALTERNATIVE_NAME_CRITICAL = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.ERROR,
+        'etsi.en_319_412_2.gen-4.3.6-1.ian_extension_is_critical'
+    )
+
+    def __init__(self):
+        super().__init__(validation=self.VALIDATION_ISSUER_ALTERNATIVE_NAME_CRITICAL,
+                         type_oid=rfc5280.id_ce_issuerAltName,
+                         is_critical=False)
+
+
+class ExtendedKeyUsageCriticalityValidator(extension.ExtensionCriticalityValidator):
+    VALIDATION_EXTENDED_KEY_USAGE_CRITICAL = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.ERROR,
+        'etsi.en_319_412_2.gen-4.3.10-1.eku_extension_is_critical'
+    )
+
+    def __init__(self):
+        super().__init__(validation=self.VALIDATION_EXTENDED_KEY_USAGE_CRITICAL,
+                         type_oid=rfc5280.id_ce_extKeyUsage,
+                         is_critical=False)
+
+
+class CRLDistributionPointsCriticalityValidator(extension.ExtensionCriticalityValidator):
+    CRL_DISTRIBUTION_POINTS_CRITICAL = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.ERROR,
+        'etsi.en_319_412_2.gen-4.3.11-5.crl_extension_is_critical'
+    )
+
+    def __init__(self):
+        super().__init__(validation=self.CRL_DISTRIBUTION_POINTS_CRITICAL,
+                         type_oid=rfc5280.id_ce_cRLDistributionPoints,
+                         is_critical=False)
+
+
+class NaturalPersonSubjectAttributeAllowanceValidator(validation.Validator):
+    """
+    NAT-4.2.4-1: The subject field shall include the following attributes as specified in Recommendation ITU-T X.520:
+    • countryName;
+    • choice of (givenName and/or surname) or pseudonym; and
+    • commonName.
+    """
+    VALIDATION_NATURAL_PERSON_NAME_ATTRIBUTE_MISSING = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.ERROR,
+        'etsi.en_319_412_2.nat-4.2.4-1.required_attribute_missing'
+    )
+
+    """
+    NAT-4.2.4-4 The pseudonym attribute shall not be present if the givenName
+    and surname attribute are present.
+    """
+    VALIDATION_MIXED_PSEUDONYM_AND_NAME_ATTRIBUTES_PRESENT = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.ERROR,
+        'etsi.en_319_412_2.nat-4.2.4-4.mixed_pseudonym_and_name_attributes_present'
+    )
+
+    """
+    NAT 4.2.4-3 The subject field shall not contain more than one instance of commonName and countryName
+    """
+    VALIDATION_PROHIBITED_DUPLICATE_ATTRIBUTE_PRESENT = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.ERROR,
+        'etsi.en_319_412_2.nat-4.2.4-3.prohibited_duplicate_attribute_present'
+    )
+
+    _REQUIRED_ATTRIBUTES = {
+        rfc5280.id_at_countryName,
+        rfc5280.id_at_commonName,
+    }
+
+    _PSEUDONYM_AND_NAME_ATTRIBUTES = {
+        rfc5280.id_at_givenName,
+        rfc5280.id_at_surname,
+        rfc5280.id_at_pseudonym,
+    }
+
+    _PROHIBITED_DUPLICATE_ATTRIBUTES = {
+        rfc5280.id_at_countryName,
+        rfc5280.id_at_commonName,
+    }
+
+    def __init__(self):
+        super().__init__(
+            validations=[
+                self.VALIDATION_NATURAL_PERSON_NAME_ATTRIBUTE_MISSING,
+                self.VALIDATION_MIXED_PSEUDONYM_AND_NAME_ATTRIBUTES_PRESENT,
+                self.VALIDATION_PROHIBITED_DUPLICATE_ATTRIBUTE_PRESENT
+            ],
+            pdu_class=rfc5280.Name
+        )
+
+    def validate(self, node):
+        attr_counts = name.get_name_attribute_counts(node)
+
+        attrs_present = set(attr_counts.keys())
+
+        missing_attrs = None
+
+        if not attrs_present.issuperset(self._REQUIRED_ATTRIBUTES):
+            missing_attrs = self._REQUIRED_ATTRIBUTES - attrs_present
+        elif attrs_present.isdisjoint(self._PSEUDONYM_AND_NAME_ATTRIBUTES):
+            missing_attrs = self._PSEUDONYM_AND_NAME_ATTRIBUTES - attrs_present
+
+        if missing_attrs:
+            oid_str = oid.format_oids(missing_attrs)
+
+            raise validation.ValidationFindingEncountered(
+                self.VALIDATION_NATURAL_PERSON_NAME_ATTRIBUTE_MISSING,
+                f'Required attributes missing: {oid_str}'
+            )
+
+        if all((a in attrs_present for a in self._PSEUDONYM_AND_NAME_ATTRIBUTES)):
+            raise validation.ValidationFindingEncountered(self.VALIDATION_MIXED_PSEUDONYM_AND_NAME_ATTRIBUTES_PRESENT)
+
+        for a in self._PROHIBITED_DUPLICATE_ATTRIBUTES:
+            if attr_counts[a] > 1:
+                raise validation.ValidationFindingEncountered(
+                    self.VALIDATION_PROHIBITED_DUPLICATE_ATTRIBUTE_PRESENT,
+                    f'Prohibited duplicate attribute present: {a}'
+                )
+
+
+class NaturalPersonExtensionIdentifierAllowanceValidator(common.ExtensionIdentifierAllowanceValidator):
+    _CODE_CLASSIFIER = 'etsi.en_319_412_2'
+
+    _ALLOWANCES = {
+        # GEN-4.3.1-1
+        rfc5280.id_ce_authorityKeyIdentifier: Rfc2119Word.MUST,
+        # NAT-4.3.2-1
+        rfc5280.id_ce_keyUsage: Rfc2119Word.MUST,
+        # GEN-4.3.3-2
+        rfc5280.id_ce_certificatePolicies: Rfc2119Word.MUST,
+        # GEN-4.3.4-1
+        rfc5280.id_ce_policyMappings: Rfc2119Word.MUST_NOT,
+
+        rfc5280.id_ce_subjectAltName: Rfc2119Word.MAY,
+        rfc5280.id_ce_issuerAltName: Rfc2119Word.MAY,
+        rfc5280.id_ce_subjectDirectoryAttributes: Rfc2119Word.MAY,
+        # GEN-4.3.8-1
+        rfc5280.id_ce_nameConstraints: Rfc2119Word.MUST_NOT,
+        # GEN-4.3.9-1
+        rfc5280.id_ce_policyConstraints: Rfc2119Word.MUST_NOT,
+        rfc5280.id_ce_cRLDistributionPoints: Rfc2119Word.MAY,
+        # GEN-4.3.12-1
+        rfc5280.id_ce_inhibitAnyPolicy: Rfc2119Word.MUST_NOT,
+        # GEN-4.4.1-2
+        rfc5280.id_pe_authorityInfoAccess: Rfc2119Word.MUST,
+    }
+
+    def __init__(self, certificate_type: etsi_constants.CertificateType):
+        allowances = self._ALLOWANCES.copy()
+
+        if certificate_type in etsi_constants.EU_QWAC_TYPES:
+            allowances[rfc3739.id_pe_qcStatements] = Rfc2119Word.MUST
+        else:
+            allowances[rfc3739.id_pe_qcStatements] = Rfc2119Word.MAY
+
+        super().__init__(allowances, self._CODE_CLASSIFIER, Rfc2119Word.MAY)
+
+
+def _general_name_has_uri_prefixes(uri_prefixes_lower, general_name_node):
+    gn_type, gn_value = general_name_node.child
+
+    if gn_type == GeneralNameTypeName.UNIFORM_RESOURCE_IDENTIFIER:
+        uri_lower = str(gn_value.pdu).lower()
+
+        return any(uri_lower.startswith(p) for p in uri_prefixes_lower)
+
+    return False
+
+
+_HTTP_OR_HTTPS_PREFIXES = {'http://', 'https://'}
+_HTTP_OR_LDAP_PREFIXES = {'http://', 'ldap://'}
+
+
+def _aia_extension_has_aia_ocsp_http_uri(aia_syntax_node):
+    for ad in aia_syntax_node.children.values():
+        if ad.children['accessMethod'].pdu == rfc5280.id_ad_ocsp:
+
+            location_node = ad.children['accessLocation']
+
+            if _general_name_has_uri_prefixes(_HTTP_OR_HTTPS_PREFIXES, location_node):
+                return True
+
+    return False
+
+
+class CrlDistributionPointsExtensionPresenceValidator(validation.Validator):
+    """
+    GEN-4.3.11-2: If the certificate does not include any access location of an OCSP responder as specified in clause
+    4.4.1, then the certificate shall include a CRL distribution point extension.
+    """
+    VALIDATION_CRLDP_EXTENSION_MISSING = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.ERROR,
+        'etsi.en_319_412_2.gen-4.3.11-2.crldp_extension_missing'
+    )
+
+    def __init__(self):
+        super().__init__(
+            validations=[self.VALIDATION_CRLDP_EXTENSION_MISSING],
+            pdu_class=rfc5280.Extensions
+        )
+
+    def validate(self, node):
+        crldp_ext_and_idx = node.document.get_extension_by_oid(rfc5280.id_ce_cRLDistributionPoints)
+
+        if crldp_ext_and_idx:
+            return
+
+        aia_ext_and_idx = node.document.get_extension_by_oid(rfc5280.id_pe_authorityInfoAccess)
+
+        if aia_ext_and_idx is None:
+            raise validation.ValidationFindingEncountered(self.VALIDATION_CRLDP_EXTENSION_MISSING)
+
+        ext, idx = aia_ext_and_idx
+
+        try:
+            _, aia_syntax_node = ext.children['extnValue'].child
+        except ValueError:
+            # no decoded AIA extension. Let other validator flag that finding
+            return
+
+        if not _aia_extension_has_aia_ocsp_http_uri(aia_syntax_node):
+            raise validation.ValidationFindingEncountered(self.VALIDATION_CRLDP_EXTENSION_MISSING)
+
+
+class CrlDistributionPointsValidator(validation.Validator):
+    """
+    GEN-4.3.11-4: At least one of the present references shall use either http (http://) IETF RFC 7230-7235 [3] or ldap
+    (ldap://) IETF RFC 4516 [4] scheme.
+    """
+    VALIDATION_CRLDP_DP_NO_REQUIRED_URI = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.ERROR,
+        'etsi.en_319_412_2.gen-4.3.11-4.http_or_ldap_crldp_distribution_point_uri_missing'
+    )
+
+    def __init__(self):
+        super().__init__(
+            validations=[self.VALIDATION_CRLDP_DP_NO_REQUIRED_URI],
+            pdu_class=rfc5280.CRLDistributionPoints
+        )
+
+    def validate(self, node):
+        for distribution_point in node.children.values():
+            try:
+                full_name_node = distribution_point.navigate('distributionPoint.fullName')
+            except document.PDUNavigationFailedError:
+                continue
+
+            if any(
+                    _general_name_has_uri_prefixes(
+                        _HTTP_OR_LDAP_PREFIXES, gn
+                    ) for gn in full_name_node.children.values()
+            ):
+                return
+
+        raise validation.ValidationFindingEncountered(self.VALIDATION_CRLDP_DP_NO_REQUIRED_URI)
+
+
+class AuthorityInformationAccessValidator(validation.Validator):
+    """
+    GEN-4.4.1-3: The Authority Information Access extension shall include an accessMethod OID,
+    id-ad-caIssuers, with an accessLocation value specifying at least one access location of a valid CA
+    certificate of the issuing CA.
+    """
+    VALIDATION_AIA_CA_ISSUERS_MISSING = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.ERROR,
+        'etsi.en_319_412_2.gen-4.4.1-3.ca_issuers_aia_access_method_absent'
+    )
+
+    """
+    GEN-4.4.1-4: At least one accessLocation shall use the http (http://) IETF RFC 7230-7235 [3] scheme or https
+    (https://) IETF RFC 2818 [5] scheme.
+    """
+    VALIDATION_AIA_CA_ISSUERS_HTTP_URI_MISSING = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.ERROR,
+        'etsi.en_319_412_2.gen-4.4.1-4.ca_issuers_aia_access_method_http_uri_missing'
+    )
+
+    """
+    GEN-4.4.1-6: If OCSP is supported by the issuing CA, at least one access location shall specify either the http
+    (http://) IETF RFC 7230-7235 [3] or https (https://) IETF RFC 2818 [5] scheme.
+    """
+    VALIDATION_AIA_OCSP_HTTP_URI_MISSING = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.ERROR,
+        'etsi.en_319_412_2.gen-4.4.1-6.ocsp_aia_access_method_http_uri_missing'
+    )
+
+    """
+    GEN-4.4.1-8: If the certificate does not include any CRL distribution point extension in accordance with clause
+    4.3.11, a reference to at least one OCSP responder shall be present.
+    """
+    VALIDATION_AIA_OCSP_MISSING = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.ERROR,
+        'etsi.en_319_412_2.gen-4.4.1-8.ocsp_aia_access_method_absent'
+    )
+
+    def __init__(self):
+        super().__init__(
+            validations=[
+                self.VALIDATION_AIA_CA_ISSUERS_MISSING,
+                self.VALIDATION_AIA_CA_ISSUERS_HTTP_URI_MISSING,
+                self.VALIDATION_AIA_OCSP_MISSING,
+                self.VALIDATION_AIA_OCSP_HTTP_URI_MISSING,
+            ],
+            pdu_class=rfc5280.AuthorityInfoAccessSyntax
+        )
+
+    @classmethod
+    def _get_locations_for_method(cls, method_oid, aia_syntax_node):
+        return [
+            ad.children['accessLocation'] for ad in aia_syntax_node.children.values()
+            if ad.children['accessMethod'].pdu == method_oid
+        ]
+
+    def validate(self, node):
+        ca_issuers_gns = self._get_locations_for_method(rfc5280.id_ad_caIssuers, node)
+
+        if not ca_issuers_gns:
+            raise validation.ValidationFindingEncountered(self.VALIDATION_AIA_CA_ISSUERS_MISSING)
+
+        if not any(_general_name_has_uri_prefixes(_HTTP_OR_HTTPS_PREFIXES, gn) for gn in ca_issuers_gns):
+            raise validation.ValidationFindingEncountered(self.VALIDATION_AIA_CA_ISSUERS_HTTP_URI_MISSING)
+
+        # only check for OCSP if no CRL DP extension is absent
+        if node.document.get_extension_by_oid(rfc5280.id_ce_cRLDistributionPoints) is None:
+            ocsp_gns = self._get_locations_for_method(rfc5280.id_ad_ocsp, node)
+
+            if not ocsp_gns:
+                raise validation.ValidationFindingEncountered(self.VALIDATION_AIA_OCSP_MISSING)
+
+            if not any(_general_name_has_uri_prefixes(_HTTP_OR_HTTPS_PREFIXES, gn) for gn in ocsp_gns):
+                raise validation.ValidationFindingEncountered(self.VALIDATION_AIA_OCSP_HTTP_URI_MISSING)
+
+
+class QualifiedCertificatePoliciesValidator(validation.Validator):
+    """
+    QCS-5.2-1: When certificates are issued as EU Qualified Certificates, they should include, in the certificate
+    policies extension, one of the certificate policy identifiers defined in clause 5.3 of ETSI EN 319 411-2
+    """
+    VALIDATION_RECOMMENDED_POLICY_IDENTIFIER_MISSING = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.WARNING,
+        'etsi.en_319_412_2.qcs-5.2-1.recommended_certificate_type_policy_identifier_missing'
+    )
+
+    VALIDATION_MULTIPLE_POLICY_IDENTIFIERS_PRESENT = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.ERROR,
+        'etsi.en_319_412_2.qcs-5.2-1.multiple_certificate_type_policy_identifiers_present'
+    )
+
+    """
+    QCS-5.2-2: Policy identifiers included in the certificate policies extension of EU Qualified Certificates shall be
+    consistent with the QCStatements according to clause 5.1.
+    """
+    VALIDATION_MISMATCHED_POLICY_IDENTIFIER_FOR_TYPE = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.ERROR,
+        'etsi.en_319_412_2.qcs-5.2-2.mismatched_policy_identifier_for_certificate_type'
+    )
+
+    # TODO: add EU qualified non-website types
+    _CERTIFICATE_TYPE_SET_TO_POLICY_IDENTIFIER_MAPPINGS = [
+        (etsi_constants.QEVCP_W_EIDAS_CERTIFICATE_TYPES, en_319_411_2.id_qcp_web),
+        (etsi_constants.QNCP_W_OV_EIDAS_CERTIFICATE_TYPES, en_319_411_2.id_qncp_web),
+        (etsi_constants.QNCP_W_IV_EIDAS_CERTIFICATE_TYPES, en_319_411_2.id_qncp_web),
+        (etsi_constants.QNCP_W_GEN_LP_EIDAS_CERTIFICATE_TYPES, en_319_411_2.id_qncp_web_gen),
+        (etsi_constants.QNCP_W_GEN_NP_EIDAS_CERTIFICATE_TYPES, en_319_411_2.id_qncp_web_gen),
+    ]
+
+    def __init__(self, certificate_type: etsi_constants.CertificateType):
+        super().__init__(
+            validations=[
+                self.VALIDATION_RECOMMENDED_POLICY_IDENTIFIER_MISSING,
+                self.VALIDATION_MULTIPLE_POLICY_IDENTIFIERS_PRESENT,
+                self.VALIDATION_MISMATCHED_POLICY_IDENTIFIER_FOR_TYPE,
+            ],
+            pdu_class=rfc5280.CertificatePolicies
+        )
+
+        self._certificate_type = certificate_type
+
+        self._recommended_policy_oid = self._get_recommended_policy_oid_for_certificate_type()
+
+    def match(self, node):
+        # TODO: add support for non-QWAC types
+        return super().match(node) and self._recommended_policy_oid is not None
+
+    def _get_recommended_policy_oid_for_certificate_type(self) -> typing.Optional[univ.ObjectIdentifier]:
+        return next(
+            (
+                p for t, p in self._CERTIFICATE_TYPE_SET_TO_POLICY_IDENTIFIER_MAPPINGS
+                if self._certificate_type in t
+            ),
+            None
+        )
+
+    def validate(self, node):
+        policy_oids = node.document.policy_oids
+
+        certificate_type_policy_oids = policy_oids & pkilint.etsi.asn1.en_319_411_2.QUALIFIED_POLICY_OIDS
+
+        if len(certificate_type_policy_oids) > 1:
+            oids = oid.format_oids(certificate_type_policy_oids)
+
+            raise validation.ValidationFindingEncountered(
+                self.VALIDATION_MULTIPLE_POLICY_IDENTIFIERS_PRESENT,
+                f'Multiple certificate type policy identifiers present: {oids}'
+            )
+        elif not certificate_type_policy_oids:
+            raise validation.ValidationFindingEncountered(
+                self.VALIDATION_RECOMMENDED_POLICY_IDENTIFIER_MISSING,
+                f'Missing recommended certificate type policy identifier "{self._recommended_policy_oid}"'
+            )
+        elif self._recommended_policy_oid not in certificate_type_policy_oids:
+            # if we're here, then there's one element in the set, so it's safe to do this
+            policy_oid = next(iter(certificate_type_policy_oids))
+
+            raise validation.ValidationFindingEncountered(
+                self.VALIDATION_MISMATCHED_POLICY_IDENTIFIER_FOR_TYPE,
+                f'Certificate type is {self._certificate_type} ({self._recommended_policy_oid}) but certificate '
+                f'contains certificate type policy identifier "{policy_oid}"'
+            )
+
+
+class NaturalPersonKeyUsageValidator(etsi_shared.KeyUsageValidator):
+    """
+    NAT-4.3.2-2: Certificates used to validate commitment to signed content (e.g. documents, agreements and/or
+    transactions) shall be limited to type A, B or F.
+    """
+    VALIDATION_INVALID_CONTENT_COMMITMENT_SETTING = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.ERROR,
+        'etsi.en_319_412_2.nat-4.3.2-1.invalid_content_commitment_setting'
+    )
+
+    """
+    NAT-4.3.2-3: Of these alternatives, type A should be used (see the security note 2 below).
+    """
+    VALIDATION_NON_PREFERRED_CONTENT_COMMITMENT_SETTING = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.WARNING,
+        'etsi.en_319_412_2.nat-4.3.2-3.non_preferred_content_commitment_setting'
+    )
+
+    def __init__(self, is_content_commitment_type):
+        super().__init__(
+            is_content_commitment_type,
+            self.VALIDATION_INVALID_CONTENT_COMMITMENT_SETTING,
+            self.VALIDATION_NON_PREFERRED_CONTENT_COMMITMENT_SETTING
+        )
+
+
+class ExtensionsPresenceValidator(common.ExtensionsPresenceValidator):
+    VALIDATION_EXTENSIONS_FIELD_ABSENT = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.ERROR,
+        'etsi.extensions_field_absent'
+    )
+
+    def __init__(self):
+        super().__init__(self.VALIDATION_EXTENSIONS_FIELD_ABSENT)
diff --git a/pkilint/etsi/en_319_412_3.py b/pkilint/etsi/en_319_412_3.py
new file mode 100644
index 0000000..9953c7b
--- /dev/null
+++ b/pkilint/etsi/en_319_412_3.py
@@ -0,0 +1,155 @@
+from pyasn1_alt_modules import rfc5280
+
+from pkilint import common
+from pkilint import validation
+from pkilint.common import organization_id
+from pkilint.etsi import etsi_shared
+from pkilint.itu import x520_name
+from pkilint.pkix import Rfc2119Word, name
+
+_REQUIRED_ATTRIBUTES = {
+    rfc5280.id_at_countryName,
+    rfc5280.id_at_organizationName,
+    x520_name.id_at_organizationIdentifier,
+    rfc5280.id_at_commonName,
+}
+
+
+class LegalPersonSubjectAttributeAllowanceValidator(common.AttributeIdentifierAllowanceValidator):
+    """
+    LEG-4.2.1-2: The subject field shall include at least the following attributes as specified in Recommendation
+    ITU-T X.520
+    """
+    _CODE_CLASSIFIER = 'etsi.en_319_412_3.leg-4.2.1-2'
+
+    _ATTRIBUTE_ALLOWANCES = {a: Rfc2119Word.MUST for a in _REQUIRED_ATTRIBUTES}
+
+    def __init__(self):
+        super().__init__(self._ATTRIBUTE_ALLOWANCES, self._CODE_CLASSIFIER, Rfc2119Word.MAY)
+
+
+class LegalPersonDuplicateAttributeAllowanceValidator(validation.Validator):
+    """
+    LEG-4.2.1-3: Only one instance of each of these attributes shall be present.
+    """
+    VALIDATION_PROHIBITED_DUPLICATE_ATTRIBUTE_PRESENT = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.ERROR,
+        'etsi.en_319_412_3.leg-4.2.1-3.prohibited_duplicate_attribute_present'
+    )
+
+    def __init__(self):
+        super().__init__(
+            validations=[self.VALIDATION_PROHIBITED_DUPLICATE_ATTRIBUTE_PRESENT],
+            pdu_class=rfc5280.Name
+        )
+
+    def validate(self, node):
+        attr_counts = name.get_name_attribute_counts(node)
+
+        for a in _REQUIRED_ATTRIBUTES:
+            if attr_counts[a] > 1:
+                raise validation.ValidationFindingEncountered(
+                    self.VALIDATION_PROHIBITED_DUPLICATE_ATTRIBUTE_PRESENT,
+                    f'Prohibited duplicate attribute present: {a}'
+                )
+
+
+class LegalPersonOrganizationAttributesEqualityValidator(validation.Validator):
+    """
+    LEG-4.2.1-6: The organizationIdentifier attribute shall contain an identification of the subject organization
+    different from the organization name.
+    """
+    VALIDATION_ORGID_ORGNAME_ATTRIBUTE_VALUES_EQUAL = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.ERROR,
+        'etsi.en_319_412_3.leg-4.2.1-6.organization_id_and_organization_name_attribute_values_equal'
+    )
+
+    def __init__(self):
+        super().__init__(
+            validations=[self.VALIDATION_ORGID_ORGNAME_ATTRIBUTE_VALUES_EQUAL],
+            pdu_class=rfc5280.Name
+        )
+
+    @classmethod
+    def _get_dirstring_attribute_value(cls, node):
+        try:
+            _, value_node = node.children['value'].child
+            _, decoded_value_node = value_node.child
+
+            return str(decoded_value_node.pdu)
+        except ValueError:
+            return None
+
+    def validate(self, node):
+        # only get the first instance of the attributes
+        orgname_attr_and_idx = next(
+            iter(name.get_name_attributes_by_type(node, rfc5280.id_at_organizationName)), None
+        )
+        orgid_attr_and_idx = next(
+            iter(name.get_name_attributes_by_type(node, x520_name.id_at_organizationIdentifier)), None
+        )
+
+        if orgname_attr_and_idx and orgid_attr_and_idx:
+            orgname_attr, _ = orgname_attr_and_idx
+            orgid_attr, _ = orgid_attr_and_idx
+
+            orgname = self._get_dirstring_attribute_value(orgname_attr)
+            orgid = self._get_dirstring_attribute_value(orgid_attr)
+
+            # if any of the attributes were not decoded, then return early
+            if orgname is None or orgid is None:
+                return
+
+            if orgname.casefold() == orgid.casefold():
+                raise validation.ValidationFindingEncountered(
+                    self.VALIDATION_ORGID_ORGNAME_ATTRIBUTE_VALUES_EQUAL,
+                    f'Organization name and identifier attribute values are equal: "{orgname}"'
+                )
+
+
+class LegalPersonKeyUsageValidator(etsi_shared.KeyUsageValidator):
+    """
+    LEG-4.3.1-3: Certificates used to validate commitment to signed content (e.g. documents, agreements and/or
+    transactions) shall be limited to type A, B or F.
+    """
+    VALIDATION_INVALID_CONTENT_COMMITMENT_SETTING = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.ERROR,
+        'etsi.en_319_412_3.leg-4.3.1-3.invalid_content_commitment_setting'
+    )
+
+    """
+    LEG-4.3.1-4: Of these alternatives, type A should be used (see the security note 2 below).
+    """
+    VALIDATION_NON_PREFERRED_CONTENT_COMMITMENT_SETTING = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.WARNING,
+        'etsi.en_319_412_3.leg-4.3.1-4.non_preferred_content_commitment_setting'
+    )
+
+    def __init__(self, is_content_commitment_type):
+        super().__init__(
+            is_content_commitment_type,
+            self.VALIDATION_INVALID_CONTENT_COMMITMENT_SETTING,
+            self.VALIDATION_NON_PREFERRED_CONTENT_COMMITMENT_SETTING
+        )
+
+
+class LegalPersonCountryCodeValidator(validation.Validator):
+    """
+    LEG-4.2.1-4: The countryName attribute shall specify the country in which the subject (legal person) is established.
+    """
+    VALIDATION_UNKNOWN_COUNTRY_CODE = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.NOTICE,
+        'etsi.en_319_412_3.leg-4.2.1-4.unknown_country_code'
+    )
+
+    def __init__(self):
+        super().__init__(validations=[self.VALIDATION_UNKNOWN_COUNTRY_CODE], pdu_class=rfc5280.X520countryName)
+
+    def validate(self, node):
+        value_str = str(node.pdu)
+
+        if value_str not in organization_id.ISO3166_1_COUNTRY_CODES:
+            raise validation.ValidationFindingEncountered(
+                self.VALIDATION_UNKNOWN_COUNTRY_CODE,
+                f'Unknown country code: "{value_str}"'
+            )
diff --git a/pkilint/etsi/en_319_412_4.py b/pkilint/etsi/en_319_412_4.py
new file mode 100644
index 0000000..1f18d23
--- /dev/null
+++ b/pkilint/etsi/en_319_412_4.py
@@ -0,0 +1,98 @@
+from pyasn1_alt_modules import rfc5280
+
+from pkilint import validation
+from pkilint.common import common_name
+from pkilint.pkix import general_name, extension
+
+_ALLOWED_GENERAL_NAME_TYPES = {general_name.GeneralNameTypeName.DNS_NAME}
+
+
+class NcpWCommonNameValidator(common_name.CommonNameValidator):
+    """
+    WEB-4.1.3-4 (d):
+
+    If necessary to distinguish the website identified by the subject name, the subject commonName may contain a
+    domain name or a Wildcard Domain Name (as defined in BRG [9]) which is one of the dNSName values of
+    the subjectAltName extension of a website authentication certificate.
+    """
+    VALIDATION_COMMON_NAME_UNKNOWN_SOURCE = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.ERROR,
+        'etsi.en_319_412_4.web-4.1.3-4.common_name_unknown_source'
+    )
+
+    def __init__(self):
+        super().__init__(
+            _ALLOWED_GENERAL_NAME_TYPES,
+            self.VALIDATION_COMMON_NAME_UNKNOWN_SOURCE
+        )
+
+
+class QncpWCommonNameValidator(common_name.CommonNameValidator):
+    """
+    WEB-4.1.4-2:
+
+    If necessary to distinguish the website identified by the subject name, the subject commonName may contain a
+    domain name or a Wildcard Domain Name (as defined in BRG [9]) which is one of the dNSName values of
+    the subjectAltName extension of a website authentication certificate.
+    """
+    VALIDATION_COMMON_NAME_UNKNOWN_SOURCE = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.ERROR,
+        'etsi.en_319_412_4.web-4.1.4-2.common_name_unknown_source'
+    )
+
+    def __init__(self):
+        super().__init__(
+            _ALLOWED_GENERAL_NAME_TYPES,
+            self.VALIDATION_COMMON_NAME_UNKNOWN_SOURCE
+        )
+
+
+class NcpWExtendedKeyUsagePresenceValidator(extension.ExtensionPresenceValidator):
+    """
+    WEB-4.1.3-4: The following certificate profile requirements specified in the BRG [9] shall apply for subject
+    certificate fields addressed by the following sub-sections of BRG [9] (the version of BRG [9] shall be as referenced
+    in ETSI EN 319 411-1 [6] for [WEB] requirements):
+    a) 7.1.2.3 f) extKeyUsage
+    """
+    VALIDATION_EKU_MISSING = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.ERROR,
+        'etsi.en_319_412_4.web-4.1.3-4.eku_missing')
+
+    def __init__(self):
+        super().__init__(
+            extension_oid=rfc5280.id_ce_extKeyUsage,
+            validation=self.VALIDATION_EKU_MISSING,
+            pdu_class=rfc5280.Extensions
+        )
+
+
+class NcpWSubjectAltNamePresenceValidator(extension.ExtensionPresenceValidator):
+    """
+    WEB-4.1.3-4: The following certificate profile requirements specified in the BRG [9] shall apply for subject
+    certificate fields addressed by the following sub-sections of BRG [9] (the version of BRG [9] shall be as referenced
+    in ETSI EN 319 411-1 [6] for [WEB] requirements):
+    a) 7.1.2.3 b) Subject Alternative Name
+    """
+    VALIDATION_SAN_MISSING = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.ERROR,
+        'etsi.en_319_412_4.web-4.1.3-4.san_missing')
+
+    def __init__(self):
+        super().__init__(
+            extension_oid=rfc5280.id_ce_subjectAltName,
+            validation=self.VALIDATION_SAN_MISSING,
+            pdu_class=rfc5280.Extensions
+        )
+
+
+class NcpWCriticalityExtendedKeyUsageValidator(extension.ExtensionCriticalityValidator):
+    """Validates that the criticality of the EKU extension conforms to BRG."""
+    EXTENDED_KEY_USAGE_CRITICAL = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.ERROR,
+        'etsi.en_319_412_4.web-4.1.3-4.eku_extension_is_critical'
+    )
+
+    def __init__(self):
+        super().__init__(validation=self.EXTENDED_KEY_USAGE_CRITICAL,
+                         type_oid=rfc5280.id_ce_extKeyUsage,
+                         is_critical=False)
diff --git a/pkilint/etsi/en_319_412_5.py b/pkilint/etsi/en_319_412_5.py
new file mode 100644
index 0000000..e7f3f2f
--- /dev/null
+++ b/pkilint/etsi/en_319_412_5.py
@@ -0,0 +1,307 @@
+from pkilint import validation, common
+from pkilint.etsi import etsi_constants
+from pkilint.etsi.asn1 import en_319_412_5
+from iso3166 import countries_by_alpha2
+from iso4217 import Currency
+from urllib.parse import urlparse
+from pyasn1_alt_modules import rfc3739
+from pkilint.pkix import extension, Rfc2119Word
+import iso639
+
+
+class QcCCLegislationCountryCodeValidator(validation.Validator):
+    """EN 319 412-5 4.2.4.: QCStatement stating the country or set of countries under the legislation of which the
+    certificate is issued as a qualified certificate. Constrained by ISO 3166-1 alpha-2 codes only. This Validator
+    will check to see if there is a country code at all or if it is a valid code."""
+    VALIDATION_ISO_COUNTRY_CODE_LIST_EMPTY = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.ERROR,
+        'etsi.en_319_412_5.gen-4.2.4.iso_country_code_list_empty'
+    )
+    VALIDATION_ISO_COUNTRY_CODE_INVALID = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.ERROR,
+        'etsi.en_319_412_5.gen-4.2.4.iso_country_code_invalid'
+    )
+
+    def __init__(self):
+        super().__init__(
+            validations=[self.VALIDATION_ISO_COUNTRY_CODE_LIST_EMPTY, self.VALIDATION_ISO_COUNTRY_CODE_INVALID],
+            pdu_class=en_319_412_5.QcCClegislation
+        )
+
+    def validate(self, node):
+        if not node.children:
+            raise validation.ValidationFindingEncountered(self.VALIDATION_ISO_COUNTRY_CODE_LIST_EMPTY)
+        for children in node.children.values():
+            country = str(children.pdu)
+            if country not in countries_by_alpha2:
+                raise validation.ValidationFindingEncountered(self.VALIDATION_ISO_COUNTRY_CODE_INVALID,
+                                                              f'Invalid country code found: "{country}"')
+
+
+class QcEuRetentionPeriodValidator(validation.Validator):
+    """EN 319 412-5 4.3.3 QCStatement indicating the duration of the retention period 
+    material information. This QCStatement declares a retention period for material information
+    relevant to the use of and reliance of on a certificate, expressed as a number of years after the expiry
+    date of the certificate. So in short anything greater will be 0 will be valid.
+    """
+    VALIDATION_RETENTION_PERIOD_NOT_POSITIVE = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.ERROR,
+        'etsi.en_319_412_5.gen-4.3.3.retention_period_years_not_positive'
+    )
+
+    def __init__(self):
+        super().__init__(
+            validations=[self.VALIDATION_RETENTION_PERIOD_NOT_POSITIVE],
+            pdu_class=en_319_412_5.QcEuRetentionPeriod
+        )
+
+    def validate(self, node):
+        # noinspection PyTypeChecker
+        valid_yrs = int(node.pdu)
+        if not valid_yrs > 0:
+            raise validation.ValidationFindingEncountered(self.VALIDATION_RETENTION_PERIOD_NOT_POSITIVE)
+
+
+class QcEuPDSLanguageValidator(validation.Validator):
+    """Content of the QcEuPDS statement, in accordance with Clause 4.3.4 of EN 319-412-5.
+    Valid ISO 639-1 language code"""
+    VALIDATION_ISO_LANGUAGE_CODE_INVALID = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.ERROR,
+        'etsi.en_319_412_5.gen-4.3.4.iso_language_code_invalid'
+    )
+
+    def __init__(self):
+        super().__init__(validations=[self.VALIDATION_ISO_LANGUAGE_CODE_INVALID], pdu_class=en_319_412_5.PdsLocation)
+
+    def validate(self, node):
+        language_code = str(node.children['language'].pdu).lower()
+
+        try:
+            iso639.Language.from_part1(language_code)
+        except iso639.LanguageNotFoundError:
+            raise validation.ValidationFindingEncountered(
+                self.VALIDATION_ISO_LANGUAGE_CODE_INVALID,
+                f'Invalid language code found: "{language_code}"'
+            )
+
+
+class QcEuPDSHttpsURLValidator(validation.Validator):
+    """Content of the QcEuPDS statement, in accordance with Clause 4.3.4 of EN 319-412-5.
+    Validator to check if the URL has the 'https' scheme."""
+    VALIDATION_URL_SCHEME_NOT_HTTPS = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.ERROR,
+        'etsi.en_319_412_5.gen-4.3.4.url_scheme_not_https'
+    )
+
+    def __init__(self):
+        super().__init__(validations=[self.VALIDATION_URL_SCHEME_NOT_HTTPS], pdu_class=en_319_412_5.PdsLocation)
+
+    def validate(self, node):
+        url_string = str(node.children['url'].pdu)
+        parsed_url = urlparse(url_string)
+
+        if parsed_url.scheme.lower() != 'https':
+            raise validation.ValidationFindingEncountered(self.VALIDATION_URL_SCHEME_NOT_HTTPS,
+                                                          f'Non-HTTPS URL scheme found: "{parsed_url.scheme}"')
+
+
+class QcTypeValidator(validation.Validator):
+    """EN 319 412-5 4.2.3 Declares that a certificate is issued as one and only one of the purposes
+    of electronic signature, electronic seal or web site authentication. According to Stephen
+    a qwac should never have seal or sign but may have psd2."""
+    VALIDATION_QC_TYPE_MISMATCH = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.ERROR,
+        'etsi.en_319_412_5.gen-4.2.3.qc_type_mismatch'
+    )
+
+    VALIDATION_MULTIPLE_QC_TYPE_VALUES_PRESENT = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.ERROR,
+
+        'etsi.en_319_412_5.gen-4.2.3.multiple_qc_type_values_present'
+    )
+
+    VALIDATION_QC_TYPE_LIST_EMPTY = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.ERROR,
+        'etsi.en_319_412_5.gen-4.2.3.qc_type_list_empty'
+    )
+
+    def __init__(self, certificate_type):
+        super().__init__(
+            validations=[
+                self.VALIDATION_QC_TYPE_MISMATCH,
+                self.VALIDATION_QC_TYPE_LIST_EMPTY,
+                self.VALIDATION_MULTIPLE_QC_TYPE_VALUES_PRESENT
+            ],
+            pdu_class=en_319_412_5.QcType
+        )
+
+        self._certificate_type = certificate_type
+
+        if certificate_type in etsi_constants.WEB_AUTHENTICATION_CERTIFICATE_TYPES:
+            self._expected_qc_type = en_319_412_5.id_etsi_qct_web
+        else:
+            self._expected_qc_type = None
+
+    def validate(self, node):
+        if not node.children.values():
+            raise validation.ValidationFindingEncountered(self.VALIDATION_QC_TYPE_LIST_EMPTY)
+
+        if len(node.children.values()) != 1:
+            raise validation.ValidationFindingEncountered(self.VALIDATION_MULTIPLE_QC_TYPE_VALUES_PRESENT)
+
+        if self._expected_qc_type:
+            _, qctype_value = node.child
+
+            if qctype_value.pdu != self._expected_qc_type:
+                raise validation.ValidationFindingEncountered(
+                    self.VALIDATION_QC_TYPE_MISMATCH,
+                    f'Certificate type is "{self._certificate_type.to_option_str}" but QcType qualified '
+                    f'statement contains "{qctype_value.pdu}"'
+                )
+
+
+class QcEuLimitValueValidator(validation.Validator):
+    """
+    This QCStatement declares a limitation on the value of transaction for which a certificate
+    can be used. 
+    MonetaryValue:: == SEQUENCE {
+        currency Iso4217CurrencyCode,
+        amount INTEGER,
+        exponent INTEGR
+    }
+    -- value = amount * 10^exponent
+    Iso4217CurrencyCode:: = CHOICE {
+        alphabetic PrintableString (Size (3)), -- Recommended
+        numeric INTEGER (1..999) } 
+        -- Alphabetic or numeric currency code as defined in ISO 4217
+        -- It is recommended that the Alphabetic form is used 
+    }
+    QCS-4.3.2-01: The currency codes shall be defined in ISO 4217.
+    QCS-4.3.2-02: The alphabetic form of currency codes should be used.
+
+    Things to validate - valid iso 4217 currency code 
+                       - warning if the numeric code is used 
+                       - Positive amount and exponent value
+    """
+    VALIDATION_CURRENCY_CODE_INVALID = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.ERROR,
+        'etsi.en_319_412_5.gen-4.3.2.currency_code_invalid'
+    )
+
+    DISCOURAGED_VALIDATION_NUMERIC_CURRENCY_CODE_PRESENT = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.WARNING,
+        'etsi.en_319_412_5.gen-4.3.2.discouraged_numeric_currency_code_present'
+    )
+
+    VALIDATION_AMOUNT_NEGATIVE = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.ERROR,
+        'etsi.en_319_412_5.gen-4.3.2.amount_negative'
+    )
+
+    VALIDATION_EXPONENT_NEGATIVE = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.ERROR,
+        'etsi.en_319_412_5.gen-4.3.2.exponent_negative'
+    )
+
+    def __init__(self):
+        self._alpha_codes = set()
+        self._numeric_codes = set()
+
+        for currency in Currency:
+            self._alpha_codes.add(currency.code)
+            self._numeric_codes.add(currency.number)
+
+        # Let's remove the testing and unknown currency codes from the set. 
+        alpha_bad_codes = {'XTS', 'XXX'}
+        numeric_bad_codes = {'999', '963'}
+
+        self._alpha_codes -= alpha_bad_codes
+        self._numeric_codes -= numeric_bad_codes
+
+        super().__init__(
+            validations=[
+                self.VALIDATION_CURRENCY_CODE_INVALID,
+                self.DISCOURAGED_VALIDATION_NUMERIC_CURRENCY_CODE_PRESENT,
+                self.VALIDATION_AMOUNT_NEGATIVE,
+                self.VALIDATION_EXPONENT_NEGATIVE
+            ],
+            pdu_class=en_319_412_5.MonetaryValue)
+
+    def validate(self, node):
+        findings = []
+        currency_code_type, iso_code = node.children["currency"].child
+        if currency_code_type != "alphabetic":
+            findings.append(
+                validation.ValidationFindingDescription(
+                    self.DISCOURAGED_VALIDATION_NUMERIC_CURRENCY_CODE_PRESENT,
+                    None)
+            )
+            iso_code = int(iso_code.pdu)
+        else:
+            iso_code = str(iso_code.pdu)
+
+        if iso_code not in self._alpha_codes and iso_code not in self._numeric_codes:
+            findings.append(validation.ValidationFindingDescription(self.VALIDATION_CURRENCY_CODE_INVALID, None))
+        if node.children["amount"].pdu < 0:
+            findings.append(validation.ValidationFindingDescription(self.VALIDATION_AMOUNT_NEGATIVE, None))
+        if node.children["exponent"].pdu < 0:
+            findings.append(validation.ValidationFindingEncountered(self.VALIDATION_EXPONENT_NEGATIVE, None))
+
+        return validation.ValidationResult(self, node, findings)
+
+
+class QcStatementsExtensionCriticalityValidator(extension.ExtensionCriticalityValidator):
+    """EN 319 412-5 QCS-4.1-02 The qcStatements extension shall not be marked as critical
+    """
+    VALIDATION_QCSTATEMENTS_EXTENSION_CRITICAL = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.ERROR,
+        'etsi.en_319_412_5.qcs-4.1-02.qcstatements_extension_is_critical'
+    )
+
+    def __init__(self):
+        super().__init__(type_oid=rfc3739.id_pe_qcStatements, is_critical=False,
+                         validation=self.VALIDATION_QCSTATEMENTS_EXTENSION_CRITICAL)
+
+
+class QcStatementIdentifierAllowanceValidator(common.ElementIdentifierAllowanceValidator):
+    """
+    EN 319 412-5:
+    QCS-5-01: EU qualified certificates shall include QCStatements in accordance with table 2
+    """
+    _CODE_CLASSIFIER = 'etsi.en_319_412_5.qcs-5.01'
+
+    # qualified statements
+    _OID_TO_CODE_NAME = {
+        en_319_412_5.id_etsi_qcs_QcCompliance: 'qc_compliance',
+        en_319_412_5.id_etsi_qcs_QcType: 'qc_type',
+        en_319_412_5.id_etsi_qcs_QcCClegislation: 'qc_cc_legislation',
+        en_319_412_5.id_etsi_qcs_QcSSCD: 'qc_sscd',
+    }
+
+    @classmethod
+    def retrieve_qualified_statement_id(cls, node):
+        return node.children['statementId']
+
+    def __init__(self, certificate_type: etsi_constants.CertificateType):
+        allowances = {}
+
+        if certificate_type in etsi_constants.EU_QWAC_TYPES:
+            allowances[en_319_412_5.id_etsi_qcs_QcCompliance] = Rfc2119Word.MUST
+            allowances[en_319_412_5.id_etsi_qcs_QcCClegislation] = Rfc2119Word.MUST_NOT
+            allowances[en_319_412_5.id_etsi_qcs_QcType] = Rfc2119Word.MUST
+        elif certificate_type in etsi_constants.NON_EU_QWAC_TYPES:
+            allowances[en_319_412_5.id_etsi_qcs_QcCompliance] = Rfc2119Word.MUST
+            allowances[en_319_412_5.id_etsi_qcs_QcCClegislation] = Rfc2119Word.MUST
+
+        if certificate_type in etsi_constants.QWAC_TYPES:
+            allowances[en_319_412_5.id_etsi_qcs_QcSSCD] = Rfc2119Word.MUST_NOT
+
+        super().__init__(
+            'qualified statement',
+            self.retrieve_qualified_statement_id,
+            allowances,
+            f'{self._CODE_CLASSIFIER}.{{oid}}_qualified_statement_present',
+            f'{self._CODE_CLASSIFIER}.{{oid}}_qualified_statement_absent',
+            None,
+            pdu_class=rfc3739.QCStatements
+        )
diff --git a/pkilint/etsi/etsi_constants.py b/pkilint/etsi/etsi_constants.py
new file mode 100644
index 0000000..00326f6
--- /dev/null
+++ b/pkilint/etsi/etsi_constants.py
@@ -0,0 +1,233 @@
+import enum
+from enum import auto
+
+from pkilint.cabf.serverauth import serverauth_constants
+
+EN_319_412_VERSION = '2023-09'
+
+
+@enum.unique
+class CertificateType(enum.IntEnum):
+    # pre-certificate types
+    NCP_W_NATURAL_PERSON_PRE_CERTIFICATE = auto()
+    NCP_W_LEGAL_PERSON_PRE_CERTIFICATE = auto()
+    DVCP_PRE_CERTIFICATE = auto()
+    IVCP_PRE_CERTIFICATE = auto()
+    OVCP_PRE_CERTIFICATE = auto()
+    EVCP_PRE_CERTIFICATE = auto()
+    QEVCP_W_EIDAS_PRE_CERTIFICATE = auto()
+    QNCP_W_IV_EIDAS_PRE_CERTIFICATE = auto()
+    QNCP_W_OV_EIDAS_PRE_CERTIFICATE = auto()
+    QNCP_W_GEN_NATURAL_PERSON_EIDAS_PRE_CERTIFICATE = auto()
+    QNCP_W_GEN_LEGAL_PERSON_EIDAS_PRE_CERTIFICATE = auto()
+    QEVCP_W_NON_EIDAS_PRE_CERTIFICATE = auto()
+    QNCP_W_IV_NON_EIDAS_PRE_CERTIFICATE = auto()
+    QNCP_W_OV_NON_EIDAS_PRE_CERTIFICATE = auto()
+    QNCP_W_GEN_NATURAL_PERSON_NON_EIDAS_PRE_CERTIFICATE = auto()
+    QNCP_W_GEN_LEGAL_PERSON_NON_EIDAS_PRE_CERTIFICATE = auto()
+    QEVCP_W_PSD2_EIDAS_PRE_CERTIFICATE = auto()
+    QEVCP_W_PSD2_EIDAS_NON_BROWSER_PRE_CERTIFICATE = auto()
+
+    # final certificate types
+    NCP_W_NATURAL_PERSON_FINAL_CERTIFICATE = auto()
+    NCP_W_LEGAL_PERSON_FINAL_CERTIFICATE = auto()
+    DVCP_FINAL_CERTIFICATE = auto()
+    IVCP_FINAL_CERTIFICATE = auto()
+    OVCP_FINAL_CERTIFICATE = auto()
+    EVCP_FINAL_CERTIFICATE = auto()
+    QEVCP_W_EIDAS_FINAL_CERTIFICATE = auto()
+    QNCP_W_IV_EIDAS_FINAL_CERTIFICATE = auto()
+    QNCP_W_OV_EIDAS_FINAL_CERTIFICATE = auto()
+    QNCP_W_GEN_NATURAL_PERSON_EIDAS_FINAL_CERTIFICATE = auto()
+    QNCP_W_GEN_LEGAL_PERSON_EIDAS_FINAL_CERTIFICATE = auto()
+    QEVCP_W_NON_EIDAS_FINAL_CERTIFICATE = auto()
+    QNCP_W_IV_NON_EIDAS_FINAL_CERTIFICATE = auto()
+    QNCP_W_OV_NON_EIDAS_FINAL_CERTIFICATE = auto()
+    QNCP_W_GEN_NATURAL_PERSON_NON_EIDAS_FINAL_CERTIFICATE = auto()
+    QNCP_W_GEN_LEGAL_PERSON_NON_EIDAS_FINAL_CERTIFICATE = auto()
+    QEVCP_W_PSD2_EIDAS_FINAL_CERTIFICATE = auto()
+    QEVCP_W_PSD2_EIDAS_NON_BROWSER_FINAL_CERTIFICATE = auto()
+
+    NCP_NATURAL_PERSON_CERTIFICATE = auto()
+    NCP_LEGAL_PERSON_CERTIFICATE = auto()
+
+    def __str__(self):
+        return self.name
+
+    @property
+    def to_option_str(self):
+        return self.name.replace('_', '-')
+
+    @staticmethod
+    def from_option_str(value):
+        value = value.replace('-', '_').upper()
+
+        return CertificateType[value]
+
+
+DVCP_CERTIFICATE_TYPES = {CertificateType.DVCP_PRE_CERTIFICATE, CertificateType.DVCP_FINAL_CERTIFICATE}
+IVCP_CERTIFICATE_TYPES = {CertificateType.IVCP_PRE_CERTIFICATE, CertificateType.IVCP_FINAL_CERTIFICATE}
+OVCP_CERTIFICATE_TYPES = {CertificateType.OVCP_PRE_CERTIFICATE, CertificateType.OVCP_FINAL_CERTIFICATE}
+EVCP_CERTIFICATE_TYPES = {CertificateType.EVCP_PRE_CERTIFICATE, CertificateType.EVCP_FINAL_CERTIFICATE}
+
+QNCP_W_IV_EIDAS_CERTIFICATE_TYPES = {
+    CertificateType.QNCP_W_IV_EIDAS_PRE_CERTIFICATE,
+    CertificateType.QNCP_W_IV_EIDAS_FINAL_CERTIFICATE,
+}
+QNCP_W_IV_NON_EIDAS_CERTIFICATE_TYPES = {
+    CertificateType.QNCP_W_IV_NON_EIDAS_PRE_CERTIFICATE,
+    CertificateType.QNCP_W_IV_NON_EIDAS_FINAL_CERTIFICATE,
+}
+
+QNCP_W_OV_EIDAS_CERTIFICATE_TYPES = {
+    CertificateType.QNCP_W_OV_EIDAS_PRE_CERTIFICATE,
+    CertificateType.QNCP_W_OV_EIDAS_FINAL_CERTIFICATE,
+}
+QNCP_W_OV_NON_EIDAS_CERTIFICATE_TYPES = {
+    CertificateType.QNCP_W_OV_NON_EIDAS_PRE_CERTIFICATE,
+    CertificateType.QNCP_W_OV_NON_EIDAS_FINAL_CERTIFICATE,
+}
+
+QNCP_W_IV_CERTIFICATE_TYPES = QNCP_W_IV_EIDAS_CERTIFICATE_TYPES | QNCP_W_IV_NON_EIDAS_CERTIFICATE_TYPES
+QNCP_W_OV_CERTIFICATE_TYPES = QNCP_W_OV_EIDAS_CERTIFICATE_TYPES | QNCP_W_OV_NON_EIDAS_CERTIFICATE_TYPES
+
+QNCP_W_GEN_NP_EIDAS_CERTIFICATE_TYPES = {
+    CertificateType.QNCP_W_GEN_NATURAL_PERSON_EIDAS_PRE_CERTIFICATE,
+    CertificateType.QNCP_W_GEN_NATURAL_PERSON_EIDAS_FINAL_CERTIFICATE,
+}
+QNCP_W_GEN_NP_NON_EIDAS_CERTIFICATE_TYPES = {
+    CertificateType.QNCP_W_GEN_NATURAL_PERSON_NON_EIDAS_PRE_CERTIFICATE,
+    CertificateType.QNCP_W_GEN_NATURAL_PERSON_NON_EIDAS_FINAL_CERTIFICATE,
+}
+
+QNCP_W_GEN_NP_CERTIFICATE_TYPES = QNCP_W_GEN_NP_EIDAS_CERTIFICATE_TYPES | QNCP_W_GEN_NP_NON_EIDAS_CERTIFICATE_TYPES
+
+QNCP_W_GEN_LP_EIDAS_CERTIFICATE_TYPES = {
+    CertificateType.QNCP_W_GEN_LEGAL_PERSON_EIDAS_PRE_CERTIFICATE,
+    CertificateType.QNCP_W_GEN_LEGAL_PERSON_EIDAS_FINAL_CERTIFICATE,
+}
+QNCP_W_GEN_LP_NON_EIDAS_CERTIFICATE_TYPES = {
+    CertificateType.QNCP_W_GEN_LEGAL_PERSON_NON_EIDAS_PRE_CERTIFICATE,
+    CertificateType.QNCP_W_GEN_LEGAL_PERSON_NON_EIDAS_FINAL_CERTIFICATE,
+}
+
+QNCP_W_GEN_LP_CERTIFICATE_TYPES = QNCP_W_GEN_LP_EIDAS_CERTIFICATE_TYPES | QNCP_W_GEN_LP_NON_EIDAS_CERTIFICATE_TYPES
+
+QNCP_W_GEN_CERTIFICATE_TYPES = QNCP_W_GEN_NP_CERTIFICATE_TYPES | QNCP_W_GEN_LP_CERTIFICATE_TYPES
+
+NCP_W_NATURAL_PERSON_CERTIFICATE_TYPES = {
+    CertificateType.NCP_W_NATURAL_PERSON_PRE_CERTIFICATE,
+    CertificateType.NCP_W_NATURAL_PERSON_FINAL_CERTIFICATE,
+} | QNCP_W_GEN_NP_CERTIFICATE_TYPES
+
+NCP_W_LEGAL_PERSON_CERTIFICATE_TYPES = {
+    CertificateType.NCP_W_LEGAL_PERSON_PRE_CERTIFICATE,
+    CertificateType.NCP_W_LEGAL_PERSON_FINAL_CERTIFICATE,
+} | QNCP_W_GEN_LP_CERTIFICATE_TYPES
+
+NCP_W_CERTIFICATE_TYPES = NCP_W_NATURAL_PERSON_CERTIFICATE_TYPES | NCP_W_LEGAL_PERSON_CERTIFICATE_TYPES
+
+NCP_NP_CERTIFICATE_TYPES = {CertificateType.NCP_NATURAL_PERSON_CERTIFICATE} | NCP_W_NATURAL_PERSON_CERTIFICATE_TYPES
+
+NCP_LP_CERTIFICATE_TYPES = {CertificateType.NCP_LEGAL_PERSON_CERTIFICATE} | NCP_W_LEGAL_PERSON_CERTIFICATE_TYPES
+
+QEVCP_W_PSD2_EIDAS_NON_BROWSER_CERTIFICATE_TYPES = {
+    CertificateType.QEVCP_W_PSD2_EIDAS_NON_BROWSER_PRE_CERTIFICATE,
+    CertificateType.QEVCP_W_PSD2_EIDAS_NON_BROWSER_FINAL_CERTIFICATE,
+}
+
+QEVCP_W_PSD2_EIDAS_CERTIFICATE_TYPES = {
+    CertificateType.QEVCP_W_PSD2_EIDAS_PRE_CERTIFICATE,
+    CertificateType.QEVCP_W_PSD2_EIDAS_FINAL_CERTIFICATE,
+} | QEVCP_W_PSD2_EIDAS_NON_BROWSER_CERTIFICATE_TYPES
+
+QEVCP_W_EIDAS_CERTIFICATE_TYPES = {
+    CertificateType.QEVCP_W_EIDAS_PRE_CERTIFICATE,
+    CertificateType.QEVCP_W_EIDAS_FINAL_CERTIFICATE
+} | QEVCP_W_PSD2_EIDAS_CERTIFICATE_TYPES
+
+QEVCP_W_NON_EIDAS_CERTIFICATE_TYPES = {
+      CertificateType.QEVCP_W_NON_EIDAS_PRE_CERTIFICATE,
+      CertificateType.QEVCP_W_NON_EIDAS_FINAL_CERTIFICATE
+}
+
+QEVCP_W_CERTIFICATE_TYPES = QEVCP_W_EIDAS_CERTIFICATE_TYPES | QEVCP_W_NON_EIDAS_CERTIFICATE_TYPES
+
+QNCP_W_CERTIFICATE_TYPES = QNCP_W_IV_CERTIFICATE_TYPES | QNCP_W_OV_CERTIFICATE_TYPES | QEVCP_W_CERTIFICATE_TYPES
+
+CABF_DV_CERTIFICATE_TYPES = DVCP_CERTIFICATE_TYPES
+CABF_IV_CERTIFICATE_TYPES = IVCP_CERTIFICATE_TYPES | QNCP_W_IV_CERTIFICATE_TYPES
+CABF_OV_CERTIFICATE_TYPES = OVCP_CERTIFICATE_TYPES | QNCP_W_OV_CERTIFICATE_TYPES
+CABF_EV_CERTIFICATE_TYPES = EVCP_CERTIFICATE_TYPES | QEVCP_W_CERTIFICATE_TYPES | QEVCP_W_PSD2_EIDAS_CERTIFICATE_TYPES
+
+CABF_CERTIFICATE_TYPES = (
+        CABF_DV_CERTIFICATE_TYPES |
+        CABF_IV_CERTIFICATE_TYPES |
+        CABF_OV_CERTIFICATE_TYPES |
+        CABF_EV_CERTIFICATE_TYPES
+)
+
+NATURAL_PERSON_CERTIFICATE_TYPES = (CABF_IV_CERTIFICATE_TYPES | QNCP_W_GEN_NP_CERTIFICATE_TYPES |
+                                    NCP_NP_CERTIFICATE_TYPES)
+
+LEGAL_PERSON_CERTIFICATE_TYPES = (CABF_OV_CERTIFICATE_TYPES | CABF_EV_CERTIFICATE_TYPES |
+                                  QNCP_W_GEN_LP_CERTIFICATE_TYPES | NCP_LP_CERTIFICATE_TYPES)
+
+QWAC_TYPES = (QEVCP_W_CERTIFICATE_TYPES | QNCP_W_IV_CERTIFICATE_TYPES |
+              QNCP_W_OV_CERTIFICATE_TYPES | QNCP_W_GEN_NP_CERTIFICATE_TYPES | QNCP_W_GEN_LP_CERTIFICATE_TYPES |
+              QEVCP_W_PSD2_EIDAS_CERTIFICATE_TYPES)
+
+WEB_AUTHENTICATION_CERTIFICATE_TYPES = CABF_CERTIFICATE_TYPES | QWAC_TYPES | NCP_W_CERTIFICATE_TYPES
+
+NON_CABF_WEB_AUTHENTICATION_CERTIFICATE_TYPES = WEB_AUTHENTICATION_CERTIFICATE_TYPES - CABF_CERTIFICATE_TYPES
+
+EU_QWAC_TYPES = {
+    CertificateType.QEVCP_W_EIDAS_PRE_CERTIFICATE,
+    CertificateType.QEVCP_W_EIDAS_FINAL_CERTIFICATE,
+    CertificateType.QNCP_W_IV_EIDAS_PRE_CERTIFICATE,
+    CertificateType.QNCP_W_IV_EIDAS_FINAL_CERTIFICATE,
+    CertificateType.QNCP_W_OV_EIDAS_PRE_CERTIFICATE,
+    CertificateType.QNCP_W_OV_EIDAS_FINAL_CERTIFICATE,
+    CertificateType.QNCP_W_GEN_NATURAL_PERSON_EIDAS_PRE_CERTIFICATE,
+    CertificateType.QNCP_W_GEN_NATURAL_PERSON_EIDAS_FINAL_CERTIFICATE,
+    CertificateType.QNCP_W_GEN_LEGAL_PERSON_EIDAS_PRE_CERTIFICATE,
+    CertificateType.QNCP_W_GEN_LEGAL_PERSON_EIDAS_FINAL_CERTIFICATE,
+    CertificateType.QEVCP_W_PSD2_EIDAS_PRE_CERTIFICATE,
+    CertificateType.QEVCP_W_PSD2_EIDAS_FINAL_CERTIFICATE,
+    CertificateType.QEVCP_W_PSD2_EIDAS_NON_BROWSER_PRE_CERTIFICATE,
+    CertificateType.QEVCP_W_PSD2_EIDAS_NON_BROWSER_FINAL_CERTIFICATE,
+}
+
+NON_EU_QWAC_TYPES = QWAC_TYPES - EU_QWAC_TYPES
+
+ETSI_TYPE_TO_CABF_SERVERAUTH_TYPE_MAPPINGS = {
+    CertificateType.DVCP_PRE_CERTIFICATE: serverauth_constants.CertificateType.DV_PRE_CERTIFICATE,
+    CertificateType.IVCP_PRE_CERTIFICATE: serverauth_constants.CertificateType.IV_PRE_CERTIFICATE,
+    CertificateType.OVCP_PRE_CERTIFICATE: serverauth_constants.CertificateType.OV_PRE_CERTIFICATE,
+    CertificateType.EVCP_PRE_CERTIFICATE: serverauth_constants.CertificateType.EV_PRE_CERTIFICATE,
+    CertificateType.QEVCP_W_EIDAS_PRE_CERTIFICATE: serverauth_constants.CertificateType.EV_PRE_CERTIFICATE,
+    CertificateType.QNCP_W_IV_EIDAS_PRE_CERTIFICATE: serverauth_constants.CertificateType.IV_PRE_CERTIFICATE,
+    CertificateType.QNCP_W_OV_EIDAS_PRE_CERTIFICATE: serverauth_constants.CertificateType.OV_PRE_CERTIFICATE,
+    CertificateType.QEVCP_W_NON_EIDAS_PRE_CERTIFICATE: serverauth_constants.CertificateType.EV_PRE_CERTIFICATE,
+    CertificateType.QNCP_W_IV_NON_EIDAS_PRE_CERTIFICATE: serverauth_constants.CertificateType.IV_PRE_CERTIFICATE,
+    CertificateType.QNCP_W_OV_NON_EIDAS_PRE_CERTIFICATE: serverauth_constants.CertificateType.OV_PRE_CERTIFICATE,
+    CertificateType.QEVCP_W_PSD2_EIDAS_PRE_CERTIFICATE: serverauth_constants.CertificateType.EV_PRE_CERTIFICATE,
+    CertificateType.QEVCP_W_PSD2_EIDAS_NON_BROWSER_PRE_CERTIFICATE: (
+        serverauth_constants.CertificateType.EV_PRE_CERTIFICATE
+    ),
+
+    CertificateType.DVCP_FINAL_CERTIFICATE: serverauth_constants.CertificateType.DV_FINAL_CERTIFICATE,
+    CertificateType.IVCP_FINAL_CERTIFICATE: serverauth_constants.CertificateType.IV_FINAL_CERTIFICATE,
+    CertificateType.OVCP_FINAL_CERTIFICATE: serverauth_constants.CertificateType.OV_FINAL_CERTIFICATE,
+    CertificateType.EVCP_FINAL_CERTIFICATE: serverauth_constants.CertificateType.EV_FINAL_CERTIFICATE,
+    CertificateType.QEVCP_W_EIDAS_FINAL_CERTIFICATE: serverauth_constants.CertificateType.EV_FINAL_CERTIFICATE,
+    CertificateType.QNCP_W_IV_EIDAS_FINAL_CERTIFICATE: serverauth_constants.CertificateType.IV_FINAL_CERTIFICATE,
+    CertificateType.QNCP_W_OV_EIDAS_FINAL_CERTIFICATE: serverauth_constants.CertificateType.OV_FINAL_CERTIFICATE,
+    CertificateType.QEVCP_W_NON_EIDAS_FINAL_CERTIFICATE: serverauth_constants.CertificateType.EV_FINAL_CERTIFICATE,
+    CertificateType.QNCP_W_IV_NON_EIDAS_FINAL_CERTIFICATE: serverauth_constants.CertificateType.IV_FINAL_CERTIFICATE,
+    CertificateType.QNCP_W_OV_NON_EIDAS_FINAL_CERTIFICATE: serverauth_constants.CertificateType.OV_FINAL_CERTIFICATE,
+    CertificateType.QEVCP_W_PSD2_EIDAS_FINAL_CERTIFICATE: serverauth_constants.CertificateType.EV_FINAL_CERTIFICATE,
+    CertificateType.QEVCP_W_PSD2_EIDAS_NON_BROWSER_FINAL_CERTIFICATE: (
+        serverauth_constants.CertificateType.EV_FINAL_CERTIFICATE
+    ),
+}
diff --git a/pkilint/etsi/etsi_finding_filter.py b/pkilint/etsi/etsi_finding_filter.py
new file mode 100644
index 0000000..e1ce41a
--- /dev/null
+++ b/pkilint/etsi/etsi_finding_filter.py
@@ -0,0 +1,21 @@
+from pkilint import finding_filter
+from pkilint.cabf.serverauth import serverauth_subscriber
+from pkilint.etsi.asn1 import ts_119_495 as ts_119_495_asn1
+
+
+class Psd2CabfServerauthValidityPeriodFilter(finding_filter.FindingDescriptionFilter):
+    _TARGET_VALIDATIONS = {
+        serverauth_subscriber.SubscriberValidityPeriodValidator.VALIDATION_VALIDITY_PERIOD_EXCEEDS_397_DAYS,
+        serverauth_subscriber.SubscriberValidityPeriodValidator.VALIDATION_VALIDITY_PERIOD_EXCEEDS_398_DAYS,
+    }
+
+    def filter(self, result, finding_description):
+        if finding_description.finding in self._TARGET_VALIDATIONS:
+            """
+            OVR-6.1-3: TSPs issuing certificates for EU PSD2 may use the following policy identifier to augment the
+            policy requirements associated with policy identifier QEVCP-w or QNCP-w as specified in
+            ETSI EN 319 411-2 [5] giving precedence to the requirements defined in the present document.
+            """
+            return ts_119_495_asn1.qcp_web_psd2 not in result.node.document.policy_oids
+        else:
+            return True
diff --git a/pkilint/etsi/etsi_shared.py b/pkilint/etsi/etsi_shared.py
new file mode 100644
index 0000000..8917fce
--- /dev/null
+++ b/pkilint/etsi/etsi_shared.py
@@ -0,0 +1,116 @@
+import enum
+from typing import Optional
+
+from pyasn1_alt_modules import rfc5280
+
+from pkilint import validation, document
+from pkilint.itu import bitstring
+from pkilint.pkix.certificate.certificate_extension import KeyUsageBitName
+
+
+class KeyUsageValidator(validation.Validator):
+    """
+    NAT-4.3.2-1: The key usage extension shall be present and shall contain one (and only one) of the key usage settings
+    defined in table 1 (A, B, C, D, E or F).
+    """
+    VALIDATION_UNKNOWN_KEY_USAGE_SETTING = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.ERROR,
+        'etsi.en_319_412_2.nat-4.3.2-1.unknown_key_usage_setting'
+    )
+
+    """
+    NAT-4.3.2-1: ... Type A, C or E should be used to avoid mixed usage of keys.
+    """
+    VALIDATION_MIXED_KEY_USAGE_SETTING = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.WARNING,
+        'etsi.en_319_412_2.nat-4.3.2-1.mixed_key_usage_setting'
+    )
+
+    _ALL_KUS = {str(n) for n in rfc5280.KeyUsage.namedValues}
+
+    def __init__(
+            self,
+            is_content_commitment_type: Optional[bool],
+            validation_invalid_content_commitment_setting: validation.ValidationFinding,
+            validation_non_preferred_content_commitment_setting: validation.ValidationFinding
+    ):
+        super().__init__(
+            validations=[
+                self.VALIDATION_UNKNOWN_KEY_USAGE_SETTING,
+                self.VALIDATION_MIXED_KEY_USAGE_SETTING,
+                validation_invalid_content_commitment_setting,
+                validation_non_preferred_content_commitment_setting,
+            ],
+            pdu_class=rfc5280.KeyUsage
+        )
+
+        self._is_content_commitment_type = is_content_commitment_type
+
+        self._validation_invalid_content_commitment_setting = validation_invalid_content_commitment_setting
+        self._validation_non_preferred_content_commitment_setting = validation_non_preferred_content_commitment_setting
+
+    class KeyUsageSetting(enum.Enum):
+        A = ({KeyUsageBitName.NON_REPUDIATION}, set())
+        B = ({KeyUsageBitName.NON_REPUDIATION, KeyUsageBitName.DIGITAL_SIGNATURE}, set())
+        C = ({KeyUsageBitName.DIGITAL_SIGNATURE}, set())
+        D = ({KeyUsageBitName.DIGITAL_SIGNATURE}, {KeyUsageBitName.KEY_AGREEMENT, KeyUsageBitName.KEY_ENCIPHERMENT})
+        E = (set(), {KeyUsageBitName.KEY_AGREEMENT, KeyUsageBitName.KEY_ENCIPHERMENT})
+        F = (
+            {KeyUsageBitName.NON_REPUDIATION, KeyUsageBitName.DIGITAL_SIGNATURE},
+            {KeyUsageBitName.KEY_AGREEMENT, KeyUsageBitName.KEY_ENCIPHERMENT}
+        )
+
+    _CONTENT_COMMITMENT_SETTINGS = {KeyUsageSetting.A, KeyUsageSetting.B, KeyUsageSetting.F}
+    _NON_CONTENT_COMMITMENT_SETTINGS = {s for s in KeyUsageSetting} - _CONTENT_COMMITMENT_SETTINGS
+
+    _MIXED_USE_SETTINGS = {KeyUsageSetting.B, KeyUsageSetting.D, KeyUsageSetting.F}
+
+    @classmethod
+    def _detect_setting(cls, key_usage_node: document.PDUNode) -> Optional[KeyUsageSetting]:
+        asserted_bits = {k for k in cls._ALL_KUS if bitstring.has_named_bit(key_usage_node, k)}
+
+        for setting in cls.KeyUsageSetting:
+            n_of_n_required_bits, one_of_n_required_bits = setting.value
+
+            allowed_bits = n_of_n_required_bits | one_of_n_required_bits
+
+            if (
+                    asserted_bits >= n_of_n_required_bits and
+                    (len(one_of_n_required_bits & asserted_bits) == 1 or not one_of_n_required_bits) and
+                    not any(asserted_bits - allowed_bits)
+            ):
+                return setting
+
+        return None
+
+    def validate(self, node):
+        setting = self._detect_setting(node)
+
+        if setting is None:
+            raise validation.ValidationFindingEncountered(self.VALIDATION_UNKNOWN_KEY_USAGE_SETTING)
+
+        if self._is_content_commitment_type is not None:
+            if self._is_content_commitment_type:
+                if setting not in self._CONTENT_COMMITMENT_SETTINGS:
+                    raise validation.ValidationFindingEncountered(self._validation_invalid_content_commitment_setting)
+                elif setting != self.KeyUsageSetting.A:
+                    raise validation.ValidationFindingEncountered(
+                        self._validation_non_preferred_content_commitment_setting
+                    )
+            elif not self._is_content_commitment_type and setting not in self._NON_CONTENT_COMMITMENT_SETTINGS:
+                raise validation.ValidationFindingEncountered(self._validation_invalid_content_commitment_setting)
+
+        if setting in self._MIXED_USE_SETTINGS:
+            raise validation.ValidationFindingEncountered(self.VALIDATION_MIXED_KEY_USAGE_SETTING)
+
+
+VALIDATION_INTERNAL_DOMAIN_NAME = validation.ValidationFinding(
+    validation.ValidationFindingSeverity.ERROR,
+    'etsi.internal_domain_name'
+)
+
+
+VALIDATION_INTERNAL_IP_ADDRESS = validation.ValidationFinding(
+    validation.ValidationFindingSeverity.ERROR,
+    'etsi.internal_ip_address'
+)
diff --git a/pkilint/etsi/finding_metadata.csv b/pkilint/etsi/finding_metadata.csv
new file mode 100644
index 0000000..d0685fd
--- /dev/null
+++ b/pkilint/etsi/finding_metadata.csv
@@ -0,0 +1,1 @@
+severity,code,description
diff --git a/pkilint/etsi/ts_119_312.py b/pkilint/etsi/ts_119_312.py
new file mode 100644
index 0000000..a5ea62b
--- /dev/null
+++ b/pkilint/etsi/ts_119_312.py
@@ -0,0 +1,233 @@
+from typing import Optional
+
+from pyasn1.codec.der.encoder import encode
+from pyasn1.type import univ, base
+from pyasn1_alt_modules import rfc3279, rfc5280, rfc5480, rfc5639, rfc4055
+
+from pkilint import validation
+from pkilint.pkix import algorithm
+from pkilint.pkix.certificate import certificate_key
+
+
+class RsaKeyValidator(validation.Validator):
+    """
+    TS 119 312, clause 6.2.2.1:
+
+    The public exponent e shall be an odd positive integer such that 2^16 < e < 2^256.
+    """
+    VALIDATION_RSA_EXPONENT_OUT_OF_RANGE = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.NOTICE,
+        'ts_119_312.6.2.2.1.rsa_exponent_of_range'
+    )
+
+    VALIDATION_RSA_SMALL_MODULUS = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.NOTICE,
+        'ts_119_312.8.4.rsa_small_modulus'
+    )
+
+    _MIN_MODULUS_LENGTH = 1900
+    _MIN_EXPONENT_EXCLUSIVE = 1 << 16
+    _MAX_EXPONENT_EXCLUSIVE = 1 << 256
+
+    def __init__(self):
+        super().__init__(
+            validations=[self.VALIDATION_RSA_EXPONENT_OUT_OF_RANGE, self.VALIDATION_RSA_SMALL_MODULUS],
+            pdu_class=rfc3279.RSAPublicKey
+        )
+
+    def validate(self, node):
+        modulus_len = int(node.children['modulus'].pdu).bit_length()
+        exponent_int = int(node.children['publicExponent'].pdu)
+
+        findings = []
+
+        if modulus_len < 1900:
+            findings.append(validation.ValidationFindingDescription(
+                self.VALIDATION_RSA_SMALL_MODULUS,
+                f'RSA public key has a modulus length of {modulus_len} bits'
+            ))
+
+        if not self._MIN_EXPONENT_EXCLUSIVE < exponent_int < self._MAX_EXPONENT_EXCLUSIVE:
+            findings.append(validation.ValidationFindingDescription(
+                self.VALIDATION_RSA_EXPONENT_OUT_OF_RANGE,
+                f'RSA public key has an exponent of {exponent_int}'
+            ))
+
+        return validation.ValidationResult(self, node, findings)
+
+
+def _create_alg_id_der(o: univ.ObjectIdentifier, params: Optional[base.Asn1Type]) -> bytes:
+    alg_id = rfc5280.AlgorithmIdentifier()
+    alg_id['algorithm'] = o
+
+    if params is not None:
+        alg_id['parameters'] = params
+
+    return encode(alg_id)
+
+
+_SPKI_ALG_ID_ENCODINGS = (
+    [
+        # RSA
+        _create_alg_id_der(rfc5480.rsaEncryption, univ.Null(''))
+    ] + [
+        # ECDSA
+        _create_alg_id_der(rfc5480.id_ecPublicKey, c) for c in (
+            univ.ObjectIdentifier('1.2.250.1.223.101.256.1'),  # FRP256v1
+            rfc5639.brainpoolP256r1,
+            rfc5639.brainpoolP384r1,
+            rfc5639.brainpoolP512r1,
+            rfc5480.secp256r1,
+            rfc5480.secp384r1,
+            rfc5480.secp521r1,
+        )
+    ]
+    # TODO: add DSA
+)
+
+
+class AllowedPublicKeyTypeValidator(certificate_key.AllowedPublicKeyAlgorithmEncodingValidator):
+    """
+    From EN 319 412 2:
+
+    GEN-4.2.5-1
+
+    The subject public key should be selected according to ETSI TS 119 312 [i.7].
+
+    NOTE: Cryptographic suites recommendations defined in ETSI TS 119 312 [i.7] can be superseded by national
+    recommendations.
+    """
+    VALIDATION_DISCOURAGED_PUBLIC_KEY_TYPE = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.NOTICE,
+        'etsi.en_319_412_2.gen-4.2.5-1.discouraged_public_key_type'
+    )
+
+    def __init__(self):
+        super().__init__(
+            validation=self.VALIDATION_DISCOURAGED_PUBLIC_KEY_TYPE,
+            allowed_encodings=_SPKI_ALG_ID_ENCODINGS,
+            pdu_class=rfc5280.AlgorithmIdentifier
+        )
+
+
+_NIST_ALG_ARC = univ.ObjectIdentifier('2.16.840.1.101.3.4')
+_SHA3_ARC = _NIST_ALG_ARC + (2,)
+
+id_sha3_224 = _SHA3_ARC + (7,)
+id_sha3_256 = _SHA3_ARC + (8,)
+id_sha3_384 = _SHA3_ARC + (9,)
+id_sha3_512 = _SHA3_ARC + (10,)
+
+
+_ECDSA_WITH_SHA3_ARC = _NIST_ALG_ARC + (3,)
+
+id_ecdsa_with_sha3_256 = _ECDSA_WITH_SHA3_ARC + (10,)
+id_ecdsa_with_sha3_384 = _ECDSA_WITH_SHA3_ARC + (11,)
+id_ecdsa_with_sha3_512 = _ECDSA_WITH_SHA3_ARC + (12,)
+
+
+_HASH_ALG_ID_TO_HASH_LENGTH = {
+    o: l / 8 for o, l in (
+        (rfc4055.id_sha224, 224),
+        (rfc4055.id_sha256, 256),
+        (rfc4055.id_sha384, 384),
+        (rfc4055.id_sha512, 512),
+        (id_sha3_224, 224),
+        (id_sha3_256, 256),
+        (id_sha3_384, 384),
+        (id_sha3_512, 512),
+    )
+}
+
+
+def _create_rsapss_params(hash_alg, encode_null_params):
+    params = rfc4055.RSASSA_PSS_params()
+    params['hashAlgorithm']['algorithm'] = hash_alg
+
+    if encode_null_params:
+        params['hashAlgorithm']['parameters'] = univ.Null('')
+
+    params['maskGenAlgorithm']['algorithm'] = rfc4055.id_mgf1
+
+    mask_gen_alg_id = rfc5280.AlgorithmIdentifier()
+    mask_gen_alg_id['algorithm'] = hash_alg
+
+    if encode_null_params:
+        mask_gen_alg_id['parameters'] = univ.Null('')
+
+    params['maskGenAlgorithm']['parameters'] = mask_gen_alg_id
+
+    params['saltLength'] = _HASH_ALG_ID_TO_HASH_LENGTH[hash_alg]
+
+    return params
+
+
+_SIGNATURE_ALG_ID_ENCODINGS = (
+    [
+        # PKCS v1.5
+        _create_alg_id_der(o, univ.Null('')) for o in (
+            rfc4055.sha256WithRSAEncryption,
+            rfc4055.sha384WithRSAEncryption,
+            rfc4055.sha512WithRSAEncryption,
+        )
+    ] + [
+        # RSASSA-PSS without null parameters
+        _create_alg_id_der(rfc4055.id_RSASSA_PSS, _create_rsapss_params(h, False)) for h in (
+            rfc4055.id_sha224,
+            rfc4055.id_sha256,
+            rfc4055.id_sha384,
+            rfc4055.id_sha512,
+            id_sha3_224,
+            id_sha3_256,
+            id_sha3_384,
+            id_sha3_512,
+        )
+    ] + [
+        # RSASSA-PSS with null parameters
+        _create_alg_id_der(rfc4055.id_RSASSA_PSS, _create_rsapss_params(h, True)) for h in (
+            rfc4055.id_sha224,
+            rfc4055.id_sha256,
+            rfc4055.id_sha384,
+            rfc4055.id_sha512,
+            id_sha3_224,
+            id_sha3_256,
+            id_sha3_384,
+            id_sha3_512,
+        )
+    ] + [
+        # ECDSA
+        _create_alg_id_der(o, None) for o in (
+            rfc5480.ecdsa_with_SHA256,
+            rfc5480.ecdsa_with_SHA384,
+            rfc5480.ecdsa_with_SHA512,
+            id_ecdsa_with_sha3_256,
+            id_ecdsa_with_sha3_384,
+            id_ecdsa_with_sha3_512,
+        )
+    ]
+    # TODO: add support for Schnorr signatures
+)
+
+
+class AllowedSignatureAlgorithmValidator(algorithm.AllowedSignatureAlgorithmEncodingValidator):
+    """
+    From EN 319 412 2:
+
+    GEN-4.2.2-1
+
+    Signature algorithm should be selected according to ETSI TS 119 312 [i.7].
+
+    NOTE: Cryptographic suites recommendations defined in ETSI TS 119 312 [i.7] can be superseded by national
+    recommendations.
+    """
+    VALIDATION_DISCOURAGED_SIGNATURE_ALGORITHM = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.NOTICE,
+        'etsi.en_319_412_2.gen-4.2.2-1.discouraged_signature_algorithm'
+    )
+
+    def __init__(self, path: str):
+        super().__init__(
+            validation=self.VALIDATION_DISCOURAGED_SIGNATURE_ALGORITHM,
+            allowed_encodings=_SIGNATURE_ALG_ID_ENCODINGS,
+            path=path
+        )
diff --git a/pkilint/etsi/ts_119_495.py b/pkilint/etsi/ts_119_495.py
new file mode 100644
index 0000000..3464d3e
--- /dev/null
+++ b/pkilint/etsi/ts_119_495.py
@@ -0,0 +1,194 @@
+import re
+
+from pkilint import validation
+from pkilint.etsi.asn1 import ts_119_495 as ts_119_495_asn1
+from pyasn1_alt_modules import rfc3739
+from iso3166 import countries_by_alpha2
+import pkilint.oid
+from pkilint.itu import x520_name
+
+
+class RolesOfPspValidator(validation.Validator):
+    """
+    GEN-5.2.2-1: RolesOfPSP shall contain one or more roles or contain a single entry indicating that the role is
+    unspecified.
+    GEN-5.2.2-2 If the certificate is issued for EU PSD2 the role object identifier shall be the
+    appropriate one of the four OIDS defined in the ASN.1 snippet below; and
+    GEN-5.2.2-3 If the certificate is issued for EU PSD2 the role name shall be  the appropriate one of the abbreviated
+    names defined in clause 5.1 PSP_AS, PSP_PI, or PSP_IC.
+    GEN-5.2.2-3A If the role is unspecified the role name shall be "Unspecified"
+    GEN-5.2.2-5 The TSP shall ensure that the name in roleofPSPName is the one associated with the role object
+    identifier held in roleofPSPOid.
+    """
+    VALIDATION_PSP_ROLES_EMPTY = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.ERROR,
+        'etsi.ts_119_495.gen-5.2.2-1.roles_of_psp_empty'
+    )
+    VALIDATION_PSP_ROLES_INVALID = validation.ValidationFinding(validation.ValidationFindingSeverity.ERROR,
+                                                                'etsi.ts_119_495.gen-5.2-2.invalid_psp_role')
+
+    VALIDATION_PSP_OIDS_INVALID = validation.ValidationFinding(validation.ValidationFindingSeverity.ERROR,
+                                                               'etsi.ts_119_495.gen-5.2-2.invalid_psp_oid')
+
+    VALIDATION_PSP_ROLES_MISMATCH = validation.ValidationFinding(validation.ValidationFindingSeverity.ERROR,
+                                                                 'etsi.ts_119_495.gen-5.2.2-5.psp_role_mismatch')
+
+    def __init__(self):
+        super().__init__(validations=[self.VALIDATION_PSP_ROLES_EMPTY, self.VALIDATION_PSP_ROLES_INVALID,
+                                      self.VALIDATION_PSP_ROLES_MISMATCH, self.VALIDATION_PSP_OIDS_INVALID],
+                         pdu_class=ts_119_495_asn1.RolesOfPSP)
+        self._expected_roles = {ts_119_495_asn1.id_psd2_role_psp_ai: 'PSP_AI',
+                                ts_119_495_asn1.id_psd2_role_psp_as: 'PSP_AS',
+                                ts_119_495_asn1.id_psd2_role_psp_ic: 'PSP_IC',
+                                ts_119_495_asn1.id_psd2_role_psp_pi: 'PSP_PI',
+                                ts_119_495_asn1.id_psd2_role_psp_unspecified: 'Unspecified'}
+
+    def validate(self, node):
+        if not any(node.children):
+            raise validation.ValidationFindingEncountered(self.VALIDATION_PSP_ROLES_EMPTY)
+
+        for child in node.children.values():
+            psp_oid = child.children['roleOfPspOid'].pdu
+            role_psp = str(child.children['roleOfPspName'].pdu)
+            expected_role = self._expected_roles.get(psp_oid)
+
+            if psp_oid not in self._expected_roles.keys():
+                raise validation.ValidationFindingEncountered(
+                    self.VALIDATION_PSP_OIDS_INVALID,
+                    f'expected oid values are {pkilint.oid.format_oids(self._expected_roles.keys())} got {psp_oid}'
+                )
+            if role_psp not in self._expected_roles.values():
+                raise validation.ValidationFindingEncountered(
+                    self.VALIDATION_PSP_ROLES_INVALID,
+                    f"expected role values are [ {', '.join(map(str, self._expected_roles.values()))}]. Got {role_psp}"
+                )
+            if role_psp != expected_role:
+                raise validation.ValidationFindingEncountered(
+                    self.VALIDATION_PSP_ROLES_MISMATCH,
+                    f'Expected role is: {expected_role}. Role in cert is: {role_psp}. Oid in cert is: {psp_oid}'
+                )
+
+
+class PresenceofQCEUPDSStatementValidator(validation.Validator):
+    """GEN-5.1.1 The Open Banking Attributes shall be included in a QCSTatement within the qcStatements extension
+    as specified in clause 3.2.5 of IETF RFC 3739."""
+    VALIDATION_QC_EU_PDS_MISSING = validation.ValidationFinding(validation.ValidationFindingSeverity.ERROR,
+                                                                'etsi.ts_119_495.gen-5.1.1.qc_eu_pds_missing')
+
+    def __init__(self):
+        super().__init__(validations=[self.VALIDATION_QC_EU_PDS_MISSING], pdu_class=rfc3739.QCStatements)
+
+    def validate(self, node):
+        if ts_119_495_asn1.id_etsi_psd2_qcStatement not in node.document.qualified_statement_ids:
+            raise validation.ValidationFindingEncountered(self.VALIDATION_QC_EU_PDS_MISSING)
+
+
+class NCANameLatinCharactersValidator(validation.Validator):
+    """GEN-5.2.3-1: The NCAName shall be plain text using Latin alphabet provided by the Competent Authority itself
+    for purpose of identification in certificates."""
+    VALIDATION_NCA_NAME_NON_LATIN = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.ERROR,
+        'etsi.ts_119_495.gen-5.2.3-1.nca_name_non_latin'
+    )
+
+    def __init__(self):
+        super().__init__(validations=[self.VALIDATION_NCA_NAME_NON_LATIN], pdu_class=ts_119_495_asn1.NCAName)
+
+    def validate(self, node):
+        nca_name = str(node.pdu)
+
+        if not nca_name.isascii():
+            raise validation.ValidationFindingEncountered(self.VALIDATION_NCA_NAME_NON_LATIN,
+                                                          f'invalid NCA name: {nca_name}')
+
+
+class NCAIdValidator(validation.Validator):
+    """GEN-5.2.3-2: Validator for NCAId structure.
+    The NCAId shall contain information using the following structure in the presented order:
+    • 2 character ISO 3166-1 country code representing the Competent Authority country;
+    • hyphen-minus "-" (0x2D (ASCII), U+002D (UTF-8)); and
+    • 2-8 character Competent Authority identifier without country code (A-Z uppercase only, no separator)."""
+
+    VALIDATION_INVALID_STRUCTURE = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.ERROR,
+        'etsi.ts_119_495.gen-5.2.3-2.invalid_structure'
+    )
+    VALIDATION_INVALID_ISO_COUNTRY = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.ERROR,
+        'etsi.ts_119_495.gen-5.2.3-2.invalid_iso_country'
+    )
+    VALIDATION_INVALID_CA_IDENTIFIER = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.ERROR,
+        'etsi.ts_119_495.gen-5.2.3-2.invalid_ca_identifier'
+    )
+
+    def __init__(self):
+        super().__init__(validations=[self.VALIDATION_INVALID_STRUCTURE,
+                                      self.VALIDATION_INVALID_ISO_COUNTRY,
+                                      self.VALIDATION_INVALID_CA_IDENTIFIER],
+                         pdu_class=ts_119_495_asn1.NCAId)
+
+    def validate(self, node):
+        nca_id = str(node.pdu)
+
+        if nca_id.count('-') != 1:
+            raise validation.ValidationFindingEncountered(self.VALIDATION_INVALID_STRUCTURE,
+                                                          f'Invalid separator in NCAId: {nca_id}')
+
+        iso_country_code, ca_identifier = nca_id.rsplit('-', 1)
+
+        if iso_country_code not in countries_by_alpha2:
+            raise validation.ValidationFindingEncountered(self.VALIDATION_INVALID_ISO_COUNTRY,
+                                                          f'Invalid ISO country code: {iso_country_code}')
+
+        if not (2 <= len(ca_identifier) <= 8 and ca_identifier.isalpha() and ca_identifier.isupper()):
+            raise validation.ValidationFindingEncountered(self.VALIDATION_INVALID_CA_IDENTIFIER,
+                                                          f'Invalid Competent Authority identifier: {ca_identifier}')
+
+
+class PsdOrganizationIdentifierFormatValidator(validation.Validator):
+    """
+    GEN-5.2.1-3: If an Authorization Number was issued by a Competent Authority the subject organizationIdentifier
+    attribute should contain the Authorization Number encoded using the following structure in the presented order:
+
+    • "PSD" as 3 character legal person identity type reference;
+    • 2 character ISO 3166-1 [8] country code representing the Competent Authority country;
+    • hyphen-minus "-" (0x2D (ASCII), U+002D (UTF-8));
+    • 2-8 character Competent Authority identifier without country code (A-Z uppercase only, no separator);
+    • hyphen-minus "-" (0x2D (ASCII), U+002D (UTF-8)); and
+    • identifier (authorization number as specified by the Competent Authority. There are no restrictions on the
+    characters used).
+
+    ...
+
+    GEN-5.3-3: The organizationIdentifier shall be present in the Subject's Distinguished Name and encoded with legal
+    person syntax as specified in clause 5.2.1.
+    """
+    VALIDATION_INVALID_PSD_ORGANIZATION_ID_FORMAT = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.ERROR,
+        'etsi.ts_119_495.gen-5.2.1-3.invalid_psd_organization_id_format'
+    )
+
+    _PSD_ORGID_FORMAT_REGEX = re.compile('^PSD[A-Z]{2}-[A-Z]{2,8}-.+$')
+
+    def __init__(self):
+        super().__init__(
+            validations=[self.VALIDATION_INVALID_PSD_ORGANIZATION_ID_FORMAT],
+            pdu_class=x520_name.X520OrganizationIdentifier
+        )
+
+    def validate(self, node):
+        try:
+            _, decoded_value_node = node.child
+        except ValueError:
+            return
+
+        value_str = str(decoded_value_node.pdu)
+
+        m = self._PSD_ORGID_FORMAT_REGEX.match(value_str)
+
+        if m is None:
+            raise validation.ValidationFindingEncountered(
+                self.VALIDATION_INVALID_PSD_ORGANIZATION_ID_FORMAT,
+                f'Invalid PSD organization identifier format: "{value_str}"'
+            )
diff --git a/pkilint/itu/x520_name_unbounded.py b/pkilint/itu/x520_name_unbounded.py
new file mode 100644
index 0000000..a58f761
--- /dev/null
+++ b/pkilint/itu/x520_name_unbounded.py
@@ -0,0 +1,46 @@
+from pyasn1.type import namedtype, constraint, char
+from pyasn1_alt_modules import rfc5280
+
+MAX = float('inf')
+
+
+def _create_unbounded_directory_string_namedtypes():
+    return namedtype.NamedTypes(
+        namedtype.NamedType('teletexString',
+                            char.TeletexString().subtype(
+                                subtypeSpec=constraint.ValueSizeConstraint(1, MAX))),
+        namedtype.NamedType('printableString',
+                            char.PrintableString().subtype(
+                                subtypeSpec=constraint.ValueSizeConstraint(1, MAX))),
+        namedtype.NamedType('universalString',
+                            char.UniversalString().subtype(
+                                subtypeSpec=constraint.ValueSizeConstraint(1, MAX))),
+        namedtype.NamedType('utf8String',
+                            char.UTF8String().subtype(subtypeSpec=constraint.ValueSizeConstraint(1, MAX))),
+        namedtype.NamedType('bmpString',
+                            char.BMPString().subtype(subtypeSpec=constraint.ValueSizeConstraint(1, MAX)))
+    )
+
+
+class X520OrganizationNameUnbounded(rfc5280.X520OrganizationName):
+    componentType = _create_unbounded_directory_string_namedtypes()
+
+
+class X520OrganizationalUnitNameUnbounded(rfc5280.X520OrganizationalUnitName):
+    componentType = _create_unbounded_directory_string_namedtypes()
+
+
+class X520CommonNameUnbounded(rfc5280.X520CommonName):
+    componentType = _create_unbounded_directory_string_namedtypes()
+
+
+class X520PseudonymUnbounded(rfc5280.X520Pseudonym):
+    componentType = _create_unbounded_directory_string_namedtypes()
+
+
+UNBOUNDED_ATTRIBUTE_TYPE_MAPPINGS = {
+    rfc5280.id_at_organizationName: X520OrganizationNameUnbounded(),
+    rfc5280.id_at_organizationalUnitName: X520OrganizationalUnitNameUnbounded(),
+    rfc5280.id_at_commonName: X520CommonNameUnbounded(),
+    rfc5280.id_at_pseudonym: X520PseudonymUnbounded(),
+}
diff --git a/pkilint/pkix/certificate/__init__.py b/pkilint/pkix/certificate/__init__.py
index 35da6b2..f93754a 100644
--- a/pkilint/pkix/certificate/__init__.py
+++ b/pkilint/pkix/certificate/__init__.py
@@ -70,6 +70,12 @@ def extended_key_usages(self) -> Set[univ.ObjectIdentifier]:
 
         return {eku_node.pdu for eku_node in decoded.children.values()} if decoded else set()
 
+    @functools.cached_property
+    def qualified_statement_ids(self) -> Set[univ.ObjectIdentifier]:
+        decoded = self._decode_and_append_extension(rfc3739.id_pe_qcStatements, rfc3739.QCStatements())
+
+        return {qs.children['statementId'].pdu for qs in decoded.children.values()} if decoded else set()
+
     @functools.cached_property
     def cryptography_object(self):
         return x509.load_der_x509_certificate(self.substrate)
@@ -304,6 +310,11 @@ def create_extensions_validator_container(additional_validators=None):
             certificate_extension.CtPrecertPoisonCriticalityValidator(),
             certificate_extension.CtPrecertPoisonSctListMutuallyExclusiveExtensionsValidator(),
             certificate_transparency.SctListElementCountValidator(),
+            certificate_extension.PolicyConstraintsPresenceValidator(),
+            certificate_extension.PolicyMappingsPresenceValidator(),
+            certificate_extension.InhibitAnyPolicyPresenceValidator(),
+            certificate_extension.ProhibitedQualifiedStatementValidator(),
+            certificate_extension.IssuerAlternativeNameCriticalityValidator(),
         ] + additional_validators,
         path='certificate.tbsCertificate.extensions'
     )
diff --git a/pkilint/pkix/certificate/certificate_extension.py b/pkilint/pkix/certificate/certificate_extension.py
index 5c0732e..96108e3 100644
--- a/pkilint/pkix/certificate/certificate_extension.py
+++ b/pkilint/pkix/certificate/certificate_extension.py
@@ -2,7 +2,7 @@
 
 import unicodedata
 from pyasn1.type.univ import ObjectIdentifier
-from pyasn1_alt_modules import rfc5280, rfc4262, rfc6962
+from pyasn1_alt_modules import rfc5280, rfc4262, rfc6962, rfc3739
 
 from pkilint import validation, oid
 from pkilint.itu.bitstring import has_named_bit
@@ -448,7 +448,7 @@ def validate(self, node):
 class CertificatePoliciesUserNoticeValidator(validation.Validator):
     VALIDATION_NOTICEREF_PRESENT = validation.ValidationFinding(
         validation.ValidationFindingSeverity.WARNING,
-        'pkix.certificate_policies_usernotice_has_noticeRef'
+        'pkix.certificate_policies_usernotice_has_noticeref'
     )
 
     VALIDATION_EXPLICITTEXT_INVALID_ENCODING_5280 = validation.ValidationFinding(
@@ -568,6 +568,19 @@ def validate(self, node):
             )
 
 
+# TODO: consider subclassing from StrEnum when minimum supported Python version is 3.11
+class KeyUsageBitName:
+    DIGITAL_SIGNATURE = 'digitalSignature'
+    NON_REPUDIATION = 'nonRepudiation'
+    KEY_ENCIPHERMENT = 'keyEncipherment'
+    DATA_ENCIPHERMENT = 'dataEncipherment'
+    KEY_AGREEMENT = 'keyAgreement'
+    KEY_CERT_SIGN = 'keyCertSign'
+    CRL_SIGN = 'cRLSign'
+    ENCIPHER_ONLY = 'encipherOnly'
+    DECIPHER_ONLY = 'decipherOnly'
+
+
 class KeyUsageValidator(validation.Validator):
     VALIDATION_NO_BITS_SET = validation.ValidationFinding(
         validation.ValidationFindingSeverity.ERROR,
@@ -613,7 +626,7 @@ def validate(self, node):
 
         is_ca = node.document.is_ca
 
-        has_keycertsign = has_named_bit(node, 'keyCertSign')
+        has_keycertsign = has_named_bit(node, KeyUsageBitName.KEY_CERT_SIGN)
 
         if is_ca and not has_keycertsign:
             raise validation.ValidationFindingEncountered(
@@ -624,8 +637,8 @@ def validate(self, node):
                 self.VALIDATION_EE_KEYCERTSIGN_SET
             )
 
-        has_eo = has_named_bit(node, 'encipherOnly')
-        has_do = has_named_bit(node, 'decipherOnly')
+        has_eo = has_named_bit(node, KeyUsageBitName.ENCIPHER_ONLY)
+        has_do = has_named_bit(node, KeyUsageBitName.DECIPHER_ONLY)
 
         if has_eo and has_do:
             raise validation.ValidationFindingEncountered(
@@ -780,3 +793,94 @@ def validate(self, node):
         if poison_ext is not None:
             raise validation.ValidationFindingEncountered(
                 self.VALIDATION_SIMULTANEOUS_PRECERT_POISON_SCTLIST_EXTENSIONS)
+
+
+class PolicyConstraintsPresenceValidator(extension.ExtensionTypeMatchingValidator):
+    VALIDATION_EE_POLICY_CONSTRAINTS_PRESENT = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.ERROR,
+        'pkix.end_entity_policy_constraints_extension_present'
+    )
+
+    def __init__(self):
+        super().__init__(
+            extension_oid=rfc5280.id_ce_policyConstraints, validations=[self.VALIDATION_EE_POLICY_CONSTRAINTS_PRESENT]
+         )
+
+    def validate(self, node):
+        if not node.document.is_ca:
+            raise validation.ValidationFindingEncountered(self.VALIDATION_EE_POLICY_CONSTRAINTS_PRESENT)
+
+
+class InhibitAnyPolicyPresenceValidator(extension.ExtensionTypeMatchingValidator):
+    VALIDATION_EE_INHIBIT_ANYPOLICY_PRESENT = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.ERROR,
+        'pkix.end_entity_inhibit_anypolicy_extension_present'
+    )
+
+    def __init__(self):
+        super().__init__(
+            extension_oid=rfc5280.id_ce_inhibitAnyPolicy, validations=[self.VALIDATION_EE_INHIBIT_ANYPOLICY_PRESENT]
+        )
+
+    def validate(self, node):
+        if not node.document.is_ca:
+            raise validation.ValidationFindingEncountered(self.VALIDATION_EE_INHIBIT_ANYPOLICY_PRESENT)
+
+
+class PolicyMappingsPresenceValidator(extension.ExtensionTypeMatchingValidator):
+    VALIDATION_EE_POLICY_MAPPINGS_PRESENT = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.ERROR,
+        'pkix.end_entity_policy_mappings_extension_present'
+    )
+
+    def __init__(self):
+        super().__init__(
+            extension_oid=rfc5280.id_ce_policyMappings, validations=[self.VALIDATION_EE_POLICY_MAPPINGS_PRESENT]
+        )
+
+    def validate(self, node):
+        if not node.document.is_ca:
+            raise validation.ValidationFindingEncountered(self.VALIDATION_EE_POLICY_MAPPINGS_PRESENT)
+
+
+class ProhibitedQualifiedStatementValidator(validation.Validator):
+    """RFC 3739, section 3.2.6.1 says:
+    The certificate statement (id-qcs-pkixQCSyntax-v1), identifies
+    conformance with requirements defined in the obsoleted RFC 3039
+    (Version 1).  This statement is thus provided for identification of
+    old certificates issued in conformance with RFC 3039.  This statement
+    MUST NOT be included in certificates issued in accordance with this
+    profile.
+    """
+    VALIDATION_PROHIBITED_QUALIFIED_STATEMENT_PRESENT = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.ERROR,
+        'pkix.prohibited_qualified_statement_present'
+    )
+
+    def __init__(self):
+        super().__init__(
+            validations=[self.VALIDATION_PROHIBITED_QUALIFIED_STATEMENT_PRESENT],
+            pdu_class=rfc3739.QCStatements
+        )
+
+    def validate(self, node):
+        if rfc3739.id_qcs_pkixQCSyntax_v1 in node.document.qualified_statement_ids:
+            raise validation.ValidationFindingEncountered(self.VALIDATION_PROHIBITED_QUALIFIED_STATEMENT_PRESENT)
+
+
+class IssuerAlternativeNameCriticalityValidator(ExtensionCriticalityValidator):
+    """RFC 5280, section 4.2.1.7 says:
+
+    Where present, conforming CAs SHOULD mark this extension as non-critical.
+    """
+    VALIDATION_ISSUER_ALT_NAME_CRITICAL = validation.ValidationFinding(
+        validation.ValidationFindingSeverity.WARNING,
+        'pkix.issuer_alt_name_extension_critical'
+    )
+
+    def __init__(self):
+        super().__init__(
+            type_oid=rfc5280.id_ce_issuerAltName,
+            is_critical=False,
+            validation=self.VALIDATION_ISSUER_ALT_NAME_CRITICAL
+        )
diff --git a/pkilint/pkix/extension.py b/pkilint/pkix/extension.py
index 73008c5..92be4d4 100644
--- a/pkilint/pkix/extension.py
+++ b/pkilint/pkix/extension.py
@@ -180,6 +180,14 @@ def validate(self, node):
             raise validation.ValidationFindingEncountered(self._validation)
 
 
+class ExtensionTypeMatchingValidator(validation.TypeMatchingValidator):
+    def __init__(self, *, extension_oid, validations):
+        super().__init__(
+            type_path='extnID', type_oid=extension_oid, value_path='extnValue', validations=validations,
+            pdu_class=rfc5280.Extension
+        )
+
+
 class AuthorityKeyIdentifierValidator(validation.Validator):
     VALIDATION_AKI_NO_KEY_ID = validation.ValidationFinding(
         validation.ValidationFindingSeverity.ERROR,
diff --git a/pkilint/pkix/general_name.py b/pkilint/pkix/general_name.py
index caad0e4..0bc1f36 100644
--- a/pkilint/pkix/general_name.py
+++ b/pkilint/pkix/general_name.py
@@ -14,6 +14,19 @@
 OTHER_NAME_MAPPINGS = rfc5280.anotherNameMap.copy()
 
 
+# TODO: consider subclassing from StrEnum when minimum supported Python version is 3.11
+class GeneralNameTypeName:
+    OTHER_NAME = 'otherName'
+    RFC822_NAME = 'rfc822Name'
+    DNS_NAME = 'dNSName'
+    X400_ADDRESS = 'x400Address'
+    DIRECTORY_NAME = 'directoryName'
+    EDI_PARTY_NAME = 'ediPartyName'
+    UNIFORM_RESOURCE_IDENTIFIER = 'uniformResourceIdentifier'
+    IP_ADDRESS = 'iPAddress'
+    REGISTERED_ID = 'registeredID'
+
+
 def validators_predicate(func, value):
     ret = func(value)
 
diff --git a/pkilint/pkix/name.py b/pkilint/pkix/name.py
index 1f66f55..6eb2d4d 100644
--- a/pkilint/pkix/name.py
+++ b/pkilint/pkix/name.py
@@ -1,3 +1,4 @@
+import collections
 from typing import List, Set
 
 import validators
@@ -25,6 +26,15 @@ def get_name_attributes_by_type(name_node, type_oid):
     return atvs
 
 
+def get_name_attribute_counts(name_node):
+    counts = collections.Counter()
+
+    for rdn_idx, rdn in name_node.children['rdnSequence'].children.items():
+        counts.update((atv.children['type'].pdu for atv in rdn.children.values()))
+
+    return counts
+
+
 class EmptyNameValidator(validation.Validator):
     VALIDATION_NAME_IS_EMPTY = validation.ValidationFinding(
         validation.ValidationFindingSeverity.ERROR,
diff --git a/pkilint/rest/__init__.py b/pkilint/rest/__init__.py
index b992f43..e90bbb4 100644
--- a/pkilint/rest/__init__.py
+++ b/pkilint/rest/__init__.py
@@ -3,11 +3,11 @@
 
 from fastapi import FastAPI, HTTPException
 
-from pkilint.rest import cabf_serverauth, cabf_smime, ocsp
+from pkilint.rest import cabf_serverauth, cabf_smime, etsi, ocsp
 from pkilint.rest import model
 
 _PKILINT_VERSION = version('pkilint')
-_API_VERSION = 'v1.2'
+_API_VERSION = 'v1.3'
 
 app = FastAPI(
     title='pkilint API',
@@ -16,9 +16,13 @@
 )
 
 _CERTIFICATE_LINTER_GROUPS = [
-    cabf_smime.create_linter_group_instance(),
-    cabf_serverauth.create_linter_group_instance(),
+    m.create_linter_group_instance() for m in (
+        cabf_smime,
+        cabf_serverauth,
+        etsi,
+    )
 ]
+
 _OCSP_PKIX_LINTER = ocsp.create_ocsp_response_linter()
 
 
diff --git a/pkilint/rest/etsi.py b/pkilint/rest/etsi.py
new file mode 100644
index 0000000..0a5eecc
--- /dev/null
+++ b/pkilint/rest/etsi.py
@@ -0,0 +1,42 @@
+from fastapi import HTTPException
+from pyasn1.error import PyAsn1Error
+from starlette import status
+
+from pkilint import etsi
+from pkilint.pkix import certificate
+from pkilint.rest import model
+
+
+class EtsiLinterGroup(model.LinterGroup):
+    def __init__(self, linters):
+        super().__init__(name='etsi', linters=linters)
+
+    def determine_linter(self, doc):
+        try:
+            cert_type = etsi.determine_certificate_type(doc)
+        except (ValueError, PyAsn1Error) as e:
+            message = f'Parsing error occurred: {e}'
+
+            raise HTTPException(
+                status_code=status.HTTP_422_UNPROCESSABLE_ENTITY,
+                detail=model.create_unprocessable_entity_error_detail(message)
+            )
+
+        # this doesn't fail, so we don't need to guard against not being able to determine the certificate type
+        return next((l for l in self.linters if l.name.casefold() == cert_type.to_option_str.casefold()))
+
+
+def create_linter_group_instance():
+    return EtsiLinterGroup(
+        [
+            model.Linter(
+                validator=certificate.create_pkix_certificate_validator_container(
+                    etsi.create_decoding_validators(cert_type),
+                    etsi.create_validators(cert_type)
+                ),
+                finding_filters=etsi.create_etsi_finding_filters(cert_type),
+                name=cert_type.to_option_str
+            )
+            for cert_type in etsi.CertificateType
+        ]
+    )
diff --git a/setup.cfg b/setup.cfg
index 2e62033..2529679 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -27,13 +27,15 @@ packages = find:
 python_requires = >=3.9
 install_requires =
     pyasn1
-    pyasn1-alt-modules
+    pyasn1-alt-modules >=0.4.3
     cryptography >=39
     iso3166
     # version is pinned due to https://github.com/python-validators/validators/issues/346
     validators==0.22
     python-dateutil
     publicsuffixlist
+    iso4217
+    python-iso639 
 
 [options.extras_require]
 rest =
@@ -51,3 +53,4 @@ console_scripts =
     lint_pkix_signer_signee_cert_chain = pkilint.bin.lint_pkix_signer_signee_cert_chain:main
     lint_cabf_smime_cert = pkilint.bin.lint_cabf_smime_cert:main
     lint_ocsp_response = pkilint.bin.lint_ocsp_response:main
+    lint_etsi_cert = pkilint.bin.lint_etsi_cert:main


Test patch:
diff --git a/tests/etsi/test_en_319_412_1.py b/tests/etsi/test_en_319_412_1.py
new file mode 100644
index 0000000..ce1bc26
--- /dev/null
+++ b/tests/etsi/test_en_319_412_1.py
@@ -0,0 +1,385 @@
+from pyasn1.codec.der.encoder import encode
+from pyasn1_alt_modules import rfc5280, rfc3739
+
+from pkilint import document, validation
+from pkilint.etsi.asn1 import en_319_412_1
+from pkilint.etsi.en_319_412_1 import LegalPersonOrganizationIdentifierValidator, NaturalPersonIdentifierValidator
+from pkilint.itu import x520_name
+
+
+class Doc:
+    def __init__(self, semantics_oid):
+        self._semantics_oid = semantics_oid
+
+    def get_extension_by_oid(self, _):
+        if self._semantics_oid is None:
+            return None
+
+        ext = rfc5280.Extension()
+        ext['extnID'] = rfc3739.id_pe_qcStatements
+
+        semantic_info = rfc3739.SemanticsInformation()
+        semantic_info['semanticsIdentifier'] = self._semantics_oid
+
+        # noinspection PyTypeChecker
+        semantics_info_node = document.PDUNode(self, 'semanticsInformation', semantic_info, None)
+
+        statement = rfc3739.QCStatement()
+        statement['statementId'] = rfc3739.id_qcs_pkixQCSyntax_v2
+        statement['statementInfo'] = encode(semantic_info)
+
+        qc_statements = rfc3739.QCStatements()
+        qc_statements.append(statement)
+
+        ext['extnValue'] = encode(qc_statements)
+
+        # noinspection PyTypeChecker
+        ext_node = document.PDUNode(self, 'ext', ext, None)
+
+        # noinspection PyTypeChecker
+        qc_statements_node = document.PDUNode(self, 'qCStatements', qc_statements, ext_node)
+        qc_statements_node.navigate('0.statementInfo').children['semanticsInformation'] = semantics_info_node
+
+        ext_node.children['extnValue'].children['qCStatements'] = qc_statements_node
+
+        # noinspection PyTypeChecker
+        return ext_node, 0
+
+
+def _create_orgid_node(value, semantics_oid):
+    pyasn1_node = x520_name.X520OrganizationIdentifier()
+    pyasn1_node.setComponentByName('utf8String', value)
+
+    # noinspection PyTypeChecker
+    return document.PDUNode(Doc(semantics_oid), 'node', pyasn1_node, None)
+
+
+def _create_serialnumber_node(value, semantics_oid):
+    pyasn1_node = rfc5280.X520SerialNumber(value=value)
+
+    # noinspection PyTypeChecker
+    return document.PDUNode(Doc(semantics_oid), 'node', pyasn1_node, None)
+
+
+def _expect_finding_for_orgid_value(value, finding):
+    validator = LegalPersonOrganizationIdentifierValidator()
+
+    node = _create_orgid_node(value, en_319_412_1.id_etsi_qcs_SemanticsId_Legal)
+
+    assert validator.match(node)
+
+    try:
+        result = validator.validate(node)
+
+        assert len(result.finding_descriptions) == 1
+
+        assert result.finding_descriptions[0].finding == finding
+    except validation.ValidationFindingEncountered as e:
+        assert e.finding == finding
+
+
+def _expect_no_findings_for_orgid(value):
+    validator = LegalPersonOrganizationIdentifierValidator()
+
+    node = _create_orgid_node(value, en_319_412_1.id_etsi_qcs_SemanticsId_Legal)
+
+    assert validator.match(node)
+
+    result = validator.validate(node)
+
+    assert len(result.finding_descriptions) == 0
+
+
+def test_no_match_no_qc_statement_orgid():
+    validator = LegalPersonOrganizationIdentifierValidator()
+
+    node = _create_orgid_node('FOO', None)
+
+    assert not validator.match(node)
+
+
+def test_no_match_different_semantics_id_orgid():
+    validator = LegalPersonOrganizationIdentifierValidator()
+
+    node = _create_orgid_node('FOO', en_319_412_1.id_etsi_qcs_semanticsId_Natural)
+
+    assert not validator.match(node)
+
+
+def test_invalid_orgid_format():
+    values_under_test = [
+        'TST',
+        'TEST',
+        'TESTXG-1',
+        'TSTXG-',
+        'NTRUS+VA-1',
+    ]
+
+    for value in values_under_test:
+        _expect_finding_for_orgid_value(
+            value,
+            LegalPersonOrganizationIdentifierValidator.VALIDATION_INVALID_ORGANIZATION_ID_FORMAT
+        )
+
+
+def test_invalid_orgid_scheme():
+    values_under_test = [
+        'FOOXG-1',
+        'EI:XX-1',
+        'EI:FR+PA-1',
+    ]
+
+    for value in values_under_test:
+        _expect_finding_for_orgid_value(
+            value,
+            LegalPersonOrganizationIdentifierValidator.VALIDATION_INVALID_ORGANIZATION_ID_SCHEME
+        )
+
+
+def test_valid_vat():
+    values_under_test = [
+        'VATFR-1',
+        'VATXI-1',
+        'VATEL-1',
+    ]
+
+    for value in values_under_test:
+        _expect_no_findings_for_orgid(value)
+
+
+def test_vat_invalid_country():
+    _expect_finding_for_orgid_value(
+        'VATXG-1',
+        LegalPersonOrganizationIdentifierValidator.VALIDATION_INVALID_ORGANIZATION_ID_COUNTRY
+    )
+
+
+def test_vat_invalid_country_lowercase():
+    _expect_finding_for_orgid_value(
+        'VATfr-1',
+        LegalPersonOrganizationIdentifierValidator.VALIDATION_INVALID_ORGANIZATION_ID_COUNTRY
+    )
+
+
+def test_vat_sp_present():
+    _expect_finding_for_orgid_value('VATFR+PA-1',
+                                    LegalPersonOrganizationIdentifierValidator.VALIDATION_INVALID_ORGANIZATION_ID_FORMAT
+                                    )
+
+
+def test_vat_no_reference():
+    _expect_finding_for_orgid_value('VATFR',
+                                    LegalPersonOrganizationIdentifierValidator.VALIDATION_INVALID_ORGANIZATION_ID_FORMAT
+                                    )
+
+
+def test_valid_ntr():
+    values_under_test = [
+        'NTRFR-1',
+    ]
+
+    for value in values_under_test:
+        _expect_no_findings_for_orgid(value)
+
+
+def test_ntr_invalid_country():
+    _expect_finding_for_orgid_value('NTREL-1',
+                                    LegalPersonOrganizationIdentifierValidator.VALIDATION_INVALID_ORGANIZATION_ID_COUNTRY
+                                    )
+
+
+def test_ntr_sp_present():
+    _expect_finding_for_orgid_value('NTRFR+PA-1',
+                                    LegalPersonOrganizationIdentifierValidator.VALIDATION_INVALID_ORGANIZATION_ID_FORMAT
+                                    )
+
+
+def test_ntr_no_reference():
+    _expect_finding_for_orgid_value('NTRFR',
+                                    LegalPersonOrganizationIdentifierValidator.VALIDATION_INVALID_ORGANIZATION_ID_FORMAT
+                                    )
+
+
+def test_valid_psd():
+    values_under_test = [
+        'PSDFR-1',
+    ]
+
+    for value in values_under_test:
+        _expect_no_findings_for_orgid(value)
+
+
+def test_psd_invalid_country():
+    _expect_finding_for_orgid_value('PSDEL-1',
+                                    LegalPersonOrganizationIdentifierValidator.VALIDATION_INVALID_ORGANIZATION_ID_COUNTRY
+                                    )
+
+
+def test_psd_sp_present():
+    _expect_finding_for_orgid_value('PSDFR+PA-1',
+                                    LegalPersonOrganizationIdentifierValidator.VALIDATION_INVALID_ORGANIZATION_ID_FORMAT
+                                    )
+
+
+def test_psd_no_reference():
+    _expect_finding_for_orgid_value('PSDFR',
+                                    LegalPersonOrganizationIdentifierValidator.VALIDATION_INVALID_ORGANIZATION_ID_FORMAT
+                                    )
+
+
+def test_valid_lei():
+    values_under_test = [
+        'LEIXG-1',  # length of reference and other checks are done by the LEI validator
+    ]
+
+    for value in values_under_test:
+        _expect_no_findings_for_orgid(value)
+
+
+def test_lei_invalid_country():
+    _expect_finding_for_orgid_value('LEIFR-1',
+                                    LegalPersonOrganizationIdentifierValidator.VALIDATION_INVALID_ORGANIZATION_ID_COUNTRY
+                                    )
+
+
+def test_lei_sp_present():
+    _expect_finding_for_orgid_value('LEIXG+PA-1',
+                                    LegalPersonOrganizationIdentifierValidator.VALIDATION_INVALID_ORGANIZATION_ID_FORMAT
+                                    )
+
+
+def test_lei_no_reference():
+    _expect_finding_for_orgid_value('LEIXG',
+                                    LegalPersonOrganizationIdentifierValidator.VALIDATION_INVALID_ORGANIZATION_ID_FORMAT
+                                    )
+
+
+def test_orgid_national_scheme():
+    values_under_test = [
+        'EI:SE-5567971433'
+    ]
+
+    for value in values_under_test:
+        _expect_finding_for_orgid_value(
+            value,
+            LegalPersonOrganizationIdentifierValidator.VALIDATION_ORGANIZATION_NATIONAL_SCHEME_DETECTED
+        )
+
+
+def test_orgid_national_scheme_lowercase_country_code():
+    values_under_test = [
+        'EI:se-5567971433'
+    ]
+
+    for value in values_under_test:
+        _expect_finding_for_orgid_value(
+            value,
+            LegalPersonOrganizationIdentifierValidator.VALIDATION_INVALID_ORGANIZATION_ID_SCHEME
+        )
+
+
+def _expect_finding_for_natural_person_id_value(value, finding):
+    validator = NaturalPersonIdentifierValidator()
+
+    node = _create_serialnumber_node(value, en_319_412_1.id_etsi_qcs_semanticsId_Natural)
+
+    assert validator.match(node)
+
+    try:
+        result = validator.validate(node)
+
+        assert len(result.finding_descriptions) == 1
+
+        assert result.finding_descriptions[0].finding == finding
+    except validation.ValidationFindingEncountered as e:
+        assert e.finding == finding
+
+
+def _expect_no_findings_for_natural_person_id(value):
+    validator = NaturalPersonIdentifierValidator()
+
+    node = _create_serialnumber_node(value, en_319_412_1.id_etsi_qcs_semanticsId_Natural)
+
+    assert validator.match(node)
+
+    result = validator.validate(node)
+
+    assert len(result.finding_descriptions) == 0
+
+
+def test_no_match_no_qc_statement_natural_person_id():
+    validator = NaturalPersonIdentifierValidator()
+
+    node = _create_serialnumber_node('FOO', None)
+
+    assert not validator.match(node)
+
+
+def test_no_match_different_semantics_id_natural_person_id():
+    validator = NaturalPersonIdentifierValidator()
+
+    node = _create_serialnumber_node('FOO', en_319_412_1.id_etsi_qcs_SemanticsId_Legal)
+
+    assert not validator.match(node)
+
+
+def test_invalid_natural_person_id_format():
+    values_under_test = [
+        'TST',
+        'TEST',
+        'TSTNO',
+        'TESTXG-1',
+        'TSTXG-',
+        'NTRUS+VA-1',
+    ]
+
+    for value in values_under_test:
+        _expect_finding_for_natural_person_id_value(
+            value,
+            NaturalPersonIdentifierValidator.VALIDATION_INVALID_NATURAL_PERSON_ID_FORMAT
+        )
+
+
+def test_invalid_natural_person_id_scheme():
+    _expect_finding_for_natural_person_id_value(
+        'FOOFR-1',
+        NaturalPersonIdentifierValidator.VALIDATION_INVALID_NATURAL_PERSON_ID_SCHEME
+    )
+
+
+def test_valid_natural_person_values():
+    values_under_test = [
+        'PASFR-1',
+        'IDCFR-1',
+        'PNOFR-1',
+        'TINFR-1',
+    ]
+
+    for value in values_under_test:
+        _expect_no_findings_for_natural_person_id(value)
+
+
+def test_deprecated_tax_value():
+    _expect_finding_for_natural_person_id_value(
+        'TAXFR-1',
+        NaturalPersonIdentifierValidator.VALIDATION_DEPRECATED_NATURAL_PERSON_ID_SCHEME
+    )
+
+
+def test_invalid_natural_person_id_country():
+    _expect_finding_for_natural_person_id_value(
+        'PASXG-1',
+        NaturalPersonIdentifierValidator.VALIDATION_INVALID_NATURAL_PERSON_ID_COUNTRY
+    )
+
+
+def test_natural_person_id_national_scheme():
+    values_under_test = [
+        'EI:SE-5567971433'
+    ]
+
+    for value in values_under_test:
+        _expect_finding_for_natural_person_id_value(
+            value,
+            NaturalPersonIdentifierValidator.VALIDATION_NATURAL_PERSON_ID_NATIONAL_SCHEME_DETECTED
+        )
diff --git a/tests/etsi/test_en_319_412_2.py b/tests/etsi/test_en_319_412_2.py
new file mode 100644
index 0000000..b9de14b
--- /dev/null
+++ b/tests/etsi/test_en_319_412_2.py
@@ -0,0 +1,122 @@
+import pytest
+from pyasn1_alt_modules import rfc5280
+
+import pkilint.etsi.etsi_shared
+from pkilint import document, validation
+from pkilint.etsi import en_319_412_2
+
+
+def _create_node(*bits):
+    ku = rfc5280.KeyUsage(value=','.join(bits))
+
+    return document.PDUNode(None, 'keyUsage', ku, None)
+
+
+def test_setting_a():
+    validator = en_319_412_2.NaturalPersonKeyUsageValidator(None)
+
+    node = _create_node('nonRepudiation')
+
+    assert validator.match(node)
+
+    assert validator.validate(node) is None
+
+
+def test_setting_d():
+    validator = en_319_412_2.NaturalPersonKeyUsageValidator(None)
+
+    node = _create_node('digitalSignature', 'keyEncipherment')
+
+    assert validator.match(node)
+
+    with pytest.raises(validation.ValidationFindingEncountered) as e:
+        validator.validate(node)
+
+    assert e.value.finding == pkilint.etsi.etsi_shared.KeyUsageValidator.VALIDATION_MIXED_KEY_USAGE_SETTING
+
+
+def test_setting_a_prohibited():
+    validator = en_319_412_2.NaturalPersonKeyUsageValidator(False)
+
+    node = _create_node('nonRepudiation')
+
+    assert validator.match(node)
+
+    with pytest.raises(validation.ValidationFindingEncountered) as e:
+        validator.validate(node)
+
+    assert (
+            e.value.finding ==
+            en_319_412_2.NaturalPersonKeyUsageValidator.VALIDATION_INVALID_CONTENT_COMMITMENT_SETTING
+    )
+
+
+def test_setting_c_prohibited():
+    validator = en_319_412_2.NaturalPersonKeyUsageValidator(True)
+
+    node = _create_node('digitalSignature')
+
+    assert validator.match(node)
+
+    with pytest.raises(validation.ValidationFindingEncountered) as e:
+        validator.validate(node)
+
+    assert (
+            e.value.finding ==
+            en_319_412_2.NaturalPersonKeyUsageValidator.VALIDATION_INVALID_CONTENT_COMMITMENT_SETTING
+    )
+
+
+def test_non_preferred_content_commitment_setting():
+    validator = en_319_412_2.NaturalPersonKeyUsageValidator(True)
+
+    node = _create_node('digitalSignature', 'nonRepudiation')
+
+    assert validator.match(node)
+
+    with pytest.raises(validation.ValidationFindingEncountered) as e:
+        validator.validate(node)
+
+    assert (
+            e.value.finding ==
+            en_319_412_2.NaturalPersonKeyUsageValidator.VALIDATION_NON_PREFERRED_CONTENT_COMMITMENT_SETTING
+    )
+
+
+def test_mixed_use_setting():
+    validator = en_319_412_2.NaturalPersonKeyUsageValidator(None)
+
+    node = _create_node('digitalSignature', 'nonRepudiation')
+
+    assert validator.match(node)
+
+    with pytest.raises(validation.ValidationFindingEncountered) as e:
+        validator.validate(node)
+
+    assert e.value.finding == pkilint.etsi.etsi_shared.KeyUsageValidator.VALIDATION_MIXED_KEY_USAGE_SETTING
+
+
+def test_invalid_extra_bit():
+    validator = en_319_412_2.NaturalPersonKeyUsageValidator(None)
+
+    node = _create_node('digitalSignature', 'cRLSign')
+
+    assert validator.match(node)
+
+    with pytest.raises(validation.ValidationFindingEncountered) as e:
+        validator.validate(node)
+
+    assert e.value.finding == pkilint.etsi.etsi_shared.KeyUsageValidator.VALIDATION_UNKNOWN_KEY_USAGE_SETTING
+
+
+def test_invalid_both_bits():
+    validator = en_319_412_2.NaturalPersonKeyUsageValidator(None)
+
+    node = _create_node('digitalSignature', 'keyAgreement', 'keyEncipherment')
+
+    assert validator.match(node)
+
+    with pytest.raises(validation.ValidationFindingEncountered) as e:
+        validator.validate(node)
+
+    assert e.value.finding == pkilint.etsi.etsi_shared.KeyUsageValidator.VALIDATION_UNKNOWN_KEY_USAGE_SETTING
diff --git a/tests/etsi/test_etsi_type_determiner.py b/tests/etsi/test_etsi_type_determiner.py
new file mode 100644
index 0000000..95066ad
--- /dev/null
+++ b/tests/etsi/test_etsi_type_determiner.py
@@ -0,0 +1,152 @@
+from pkilint import etsi
+from pkilint import loader
+from pkilint.etsi.etsi_constants import CertificateType
+
+
+def _assert_pem_is_certificate_type(expected_type, pem):
+    cert = loader.load_certificate(pem, 'pem')
+
+    assert etsi.determine_certificate_type(cert) == expected_type
+
+
+def test_qevcp_w_non_eidas_certificate_type():
+    _assert_pem_is_certificate_type(CertificateType.QEVCP_W_NON_EIDAS_PRE_CERTIFICATE,
+                                    '''-----BEGIN CERTIFICATE-----
+MIIHfTCCBWWgAwIBAgIMFzle8tVI5MLthWVyMA0GCSqGSIb3DQEBCwUAMFkxCzAJ
+BgNVBAYTAkdCMRswGQYDVQQKExJHTU8gR2xvYmFsU2lnbiBMdGQxLTArBgNVBAMT
+JEdsb2JhbFNpZ24gR0NDIFIzIFVLIEVWIFFXQUMgQ0EgMjAyMDAeFw0yMzA2MTYw
+ODMzMzRaFw0yNDA2MTUwODMzMzNaMIHyMR0wGwYDVQQPDBRQcml2YXRlIE9yZ2Fu
+aXphdGlvbjEVMBMGA1UEBRMMMDQ1OS4xMzQuMjU2MRMwEQYLKwYBBAGCNzwCAQMT
+AkJFMQswCQYDVQQGEwJCRTEXMBUGA1UECAwOVmxhYW1zLUJyYWJhbnQxDzANBgNV
+BAcMBkxldXZlbjEXMBUGA1UECQwORGllc3RzZXZlc3QgMTQxFjAUBgNVBAoMDUds
+b2JhbFNpZ24gTlYxIDAeBgNVBAMMF3d3dy5nbG9iYWxzaWduLWRlbW8uY29tMRsw
+GQYDVQRhDBJOVFJCRS0wNDU5LjEzNC4yNTYwggEiMA0GCSqGSIb3DQEBAQUAA4IB
+DwAwggEKAoIBAQCpn0FCPXqC0Lx5clF4Qq4ez3CW3iLRJegKqMaD84PN504skXsY
+bDhLz+naT3naIqsYJUV9A+b01BRVgMR4vZpZ27EY28tRwRf9s7eImzO5QXFPoG+i
+2ztRC7rE4Q33HO5SRKp3ZEV9Es8fW3/mJxGrLFJuS7c6sX0bU/dBdISw1j0pM/8+
+oXN0Kiy/vcMULkP/eL6nmj45jklIFoRxb0AZzemQijj+t8fz8bLWZISLBzvqmL0Y
+hjpCkLnyjgVM5xtElSPf7/a7J7jnaleZ3gJhxYF+FndyHooaBAHxFA32BmSgV3PD
+Rgq3eLMUGrngSlGNXbTWMxnUTh93lrqiturXAgMBAAGjggKpMIICpTBEBgNVHR8E
+PTA7MDmgN6A1hjNodHRwOi8vY3JsLmdsb2JhbHNpZ24uY29tL2dzZ2NjcjN1a2V2
+cXdhY2NhMjAyMC5jcmwwPQYIKwYBBQUHAQMEMTAvMAgGBgQAjkYBATATBgYEAI5G
+AQYwCQYHBACORgEGAzAOBgYEAI5GAQcwBBMCR0IwgZkGCCsGAQUFBwEBBIGMMIGJ
+MEkGCCsGAQUFBzAChj1odHRwOi8vc2VjdXJlLmdsb2JhbHNpZ24uY29tL2NhY2Vy
+dC9nc2djY3IzdWtldnF3YWNjYTIwMjAuY3J0MDwGCCsGAQUFBzABhjBodHRwOi8v
+b2NzcC5nbG9iYWxzaWduLmNvbS9nc2djY3IzdWtldnF3YWNjYTIwMjAwgacGA1Ud
+IASBnzCBnDBBBgkrBgEEAaAyAQEwNDAyBggrBgEFBQcCARYmaHR0cHM6Ly93d3cu
+Z2xvYmFsc2lnbi5jb20vcmVwb3NpdG9yeS8wBwYFZ4EMAQEwCQYHBACL7EABBDBD
+BgsrBgEEAaAyASwoATA0MDIGCCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxz
+aWduLmNvbS9yZXBvc2l0b3J5LzAiBgNVHREEGzAZghd3d3cuZ2xvYmFsc2lnbi1k
+ZW1vLmNvbTAiBgVngQwDAQQZMBcTA05UUhMCQkUMDDA0NTkuMTM0LjI1NjAMBgNV
+HRMBAf8EAjAAMB8GA1UdIwQYMBaAFAeUNkpRlUn97ioGeTZ/wjc7Ttu/MB0GA1Ud
+JQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATAdBgNVHQ4EFgQUzAkXOmPl1fx/NWnn
+M2kcUxBAZ5QwDgYDVR0PAQH/BAQDAgeAMBMGCisGAQQB1nkCBAMBAf8EAgUAMA0G
+CSqGSIb3DQEBCwUAA4ICAQCaXlFvQuIgDR/2ARtUwmknMv2K0hARJ8jIXp+uiOoy
+EejR2HZetKOKKXdLZVeFHAV1gujMujStu7zu/weqnoACLLPyZfizxT1CpImPOorv
+YDzKWOJWz22Dwg7uxk5HuFmxVla2mru12bdQho0JDmsldMJlc7Mq3S7Q88AOUkmi
+roaSEsQ+joZ4NILZtcl2rkD2U/aTOBkUh80CJpyZP8QHD16ztD9sWmBtRtHRnCAd
+xbZAkKAq3VQ/qCYT7OkTcui2xh327ZPwmNJiYILJ5vRIheiZIuj31x3FkmXus/f8
+nTX/p1MmDn1sx2vpuyQ5vGyX8knXyfwqe1NiNKq0QT+1bqLggT2Li21S9XavwFcl
+x6IuRDlBFWMgJTGPgn2ZIpzmsfOxeCvQAKJWVdvGgDItRPSGnAs3WHeSmQPobW8Q
+m/LareZcoDwUBT70C6EMm6cc9C2XVDHPs5wW9eIWL8IF1Jd03tXIIDIfuIHnFX3o
+/UCkHCCN4nQSIp57CI8Z5mDbpj3G0jEAnJyYGTPXR6MugsSuY8tTYIyN2y0qXzYx
+w8PRAMBKq4f+ZYAHj/I54QT/Rvj2Wyhna9QNBvjWgImHPEDrIZ4MGlTeJuL7WjsQ
+hfQZjQ3aw24SEg51Sf1UTQ80xAZJoK8Q3kTzymzUZgqeutUtYrTgXjzd4Mv+52YQ
+oQ==
+-----END CERTIFICATE-----''')
+
+
+def test_qevcp_w_psd2():
+    _assert_pem_is_certificate_type(CertificateType.QEVCP_W_PSD2_EIDAS_PRE_CERTIFICATE, '''-----BEGIN CERTIFICATE-----
+MIIH4DCCBcigAwIBAgIUZ2W0z0CUqkRQtqh+2ZeuUOubCNswDQYJKoZIhvcNAQEL
+BQAwVzELMAkGA1UEBhMCTkwxIDAeBgNVBAoMF1F1b1ZhZGlzIFRydXN0bGluayBC
+LlYuMSYwJAYDVQQDDB1RdW9WYWRpcyBRdWFsaWZpZWQgV2ViIElDQSBHMjAeFw0y
+NDAxMDUxMjM2MzRaFw0yNTAxMDUxMjMxMDBaMIIBEjETMBEGCysGAQQBgjc8AgED
+EwJERTEXMBUGCysGAQQBgjc8AgECDAZCYXllcm4xGTAXBgsrBgEEAYI3PAIBAQwI
+QXVnc2J1cmcxHTAbBgNVBA8MFFByaXZhdGUgT3JnYW5pemF0aW9uMRAwDgYDVQQF
+EwdHblIgNjEyMQswCQYDVQQGEwJERTEPMA0GA1UECAwGQmF5ZXJuMRAwDgYDVQQH
+DAdIdXJsYWNoMRswGQYDVQRhDBJQU0RERS1CQUZJTi0xMDY2NTMxJTAjBgNVBAoM
+HFJhaWZmZWlzZW5iYW5rIFNpbmdvbGR0YWwgZUcxIjAgBgNVBAMMGXhzMmFwc2Qy
+LnJiLXNpbmdvbGR0YWwuZGUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB
+AQDRyGepEOvd+8o7fOluGGj3NwnardkJ+jEnBHtcqF1boA70AoFs2a+MLPF9eoif
+5FjS9EtYwaFzgZN2XqkbKvCes612jsXBHLeYlOahBjZOtTlCjA5NBs+sgZWaVTBQ
+5YPGsYImEAiRrUqtTY6+gGiWKKfbD7y6p8kywJhO++bawKYBnjTdxhMm0SS4cRBl
+Fw/vzjRXXg7up3mpOFlYlvsIb53Dzl+DnpuPg/xBuVJXSdmG6MbzV3LHSaCsN4qy
+75pDDyIQj0UU0HJ/A0XIB434NQkOlfrVCx9aa4hxM+qm754Y9tvuPiNJy74cCKBT
+/uqpXx1Ao017yf9pcbGKweoZAgMBAAGjggLlMIIC4TAfBgNVHSMEGDAWgBS86177
+2A3ogq6GRr07fLJv0Sx/CjCBhQYIKwYBBQUHAQEEeTB3MEkGCCsGAQUFBzAChj1o
+dHRwOi8vdHJ1c3QucXVvdmFkaXNnbG9iYWwuY29tL3F1b3ZhZGlzcXVhbGlmaWVk
+d2ViaWNhZzIuY3J0MCoGCCsGAQUFBzABhh5odHRwOi8vb2NzcC5xdW92YWRpc2ds
+b2JhbC5jb20wJAYDVR0RBB0wG4IZeHMyYXBzZDIucmItc2luZ29sZHRhbC5kZTB/
+BgNVHSAEeDB2MAkGBwQAi+xAAQQwCQYHBACBmCcDATAOBgwrBgEEAb5YAAJkAQIw
+RQYKKwYBBAG+WAGDQjA3MDUGCCsGAQUFBwIBFilodHRwczovL3d3dy5xdW92YWRp
+c2dsb2JhbC5jb20vcmVwb3NpdG9yeTAHBgVngQwBATAdBgNVHSUEFjAUBggrBgEF
+BQcDAgYIKwYBBQUHAwEwgbkGCCsGAQUFBwEDBIGsMIGpMAoGCCsGAQUFBwsCMAgG
+BgQAjkYBATATBgYEAI5GAQYwCQYHBACORgEGAzA7BgYEAI5GAQUwMTAvFilodHRw
+czovL3d3dy5xdW92YWRpc2dsb2JhbC5jb20vcmVwb3NpdG9yeRMCZW4wPwYGBACB
+mCcCMDUwAAwnRmVkZXJhbCBGaW5hbmNpYWwgU3VwZXJ2aXNvcnkgQXV0aG9yaXR5
+DAhERS1CQUZJTjAiBgVngQwDAQQZMBcTA1BTRBMCREUMDEJBRklOLTEwNjY1MzBM
+BgNVHR8ERTBDMEGgP6A9hjtodHRwOi8vY3JsLnF1b3ZhZGlzZ2xvYmFsLmNvbS9x
+dW92YWRpc3F1YWxpZmllZHdlYmljYWcyLmNybDAdBgNVHQ4EFgQU0CDt76mzymMP
+mVDWONHd8j8htIowDgYDVR0PAQH/BAQDAgWgMBMGCisGAQQB1nkCBAMBAf8EAgUA
+MA0GCSqGSIb3DQEBCwUAA4ICAQAgxCKTQCShhgmSJHgV2nBz12jxB4Tl2NIxfmFm
+XGrrzOYbN7+s0rkRW5srtRCRjy4MQlVuaI1zpNvKqmZ8K1YXvIaQbHcnmptNsvje
+rjcG8sbQqBxsRwZ87nB8QQ1Hb+2rUD4jpKXjYhTn4+LBKUGqvuvoxa1h5Ojl13c0
+nzPmtsVk6MvYyE+dOscmeF2L7+CAEMrGtfvVMj4QqWUDUHmBbDG0gTu/lAE3rB0U
+KT8B5tHI6zEsEet3ySx8QZ0CfLyln37JfxlSMVkU0Kyt2AjqlV9QpoaiAZq++Vpf
+vGB1JenDiBYXbO0VNdRuCNC8F++CsgWsqvqdfUlnQGt+9lYSikLHeRpJzr0GwOJc
+OuiFXKMWV22sCQizr2xQCWS9ajbROVaFFsViIoBlK1GykMTZWzHI13f120OUbMZ9
+5wnmCxej8aRZXKuZXg+I6ztu0Wm2tjlHb9hfZnuiTviitveDxpM8tX8+6eDWlFqC
+ZcrLZUy7r4ZdU0dSRsYx2WDRcIuHcQ593VzM8XBYPtYZ7z8cMlzkRr/fUpjWtujH
+1joq8HiMKZaMqLBhS1cyiEaSCv99MRqxq2UT58HanAJ2St/1u6UVbXJ39VXpRtWZ
+3IjZc9mgkHoOf1h1VLc2DSoWSjfWabjbDH2rBLRNywStpQhSjAdeSeiUPTE7wz6N
+yrv/BQ==
+-----END CERTIFICATE-----''')
+
+
+def test_qncp_w_ov_eidas_final_certificate():
+    _assert_pem_is_certificate_type(CertificateType.QNCP_W_OV_EIDAS_FINAL_CERTIFICATE, '''-----BEGIN CERTIFICATE-----
+MIIH4zCCBsugAwIBAgIQT8EQTyw0XlFlsnajhgndxTANBgkqhkiG9w0BAQsFADBH
+MQswCQYDVQQGEwJFUzERMA8GA1UECgwIRk5NVC1SQ00xJTAjBgNVBAsMHEFDIENv
+bXBvbmVudGVzIEluZm9ybcOhdGljb3MwHhcNMjQwMTI1MTQ1NjM1WhcNMjUwMTI1
+MTQ1NjM1WjB5MQswCQYDVQQGEwJFUzEPMA0GA1UEBwwGTUFEUklEMQ0wCwYDVQQK
+DARGTk1UMRIwEAYDVQQFEwlRMjgyNjAwNEoxGDAWBgNVBGEMD1ZBVEVTLVEyODI2
+MDA0SjEcMBoGA1UEAwwTcHJvdmVlZG9yZXMuZm5tdC5lczCCASIwDQYJKoZIhvcN
+AQEBBQADggEPADCCAQoCggEBAJ0gVvo9+5v6TneKbairT1fMHTvHhdV7aZ6ID/UK
+gnM73+hBv0LK1/xdp3uhug5QUiPUlrcI0LknK7xuvVUjpc4bMwBJd1xZpztAOsIM
+hAM8xvvPXAaTUHW5WUNvjj0USTGLkC1guAmQm7VbHW6umAYZKbru4sv8aUQGf166
+z7pcQ7wwLhpk5sMCN1uJ04TuAIm71rTAdRfNnuZaPsMXgFgQ/HlY4Ufv0P6N3GEr
+SkVj9JMnvMnN5hLZ1EiFzQn7m/nuHwVY9Z3koY7+yLGSzYB/2zZuecV/tVxsesOF
+aCZ0UyXZUx7FpegI1PyPOTDg8RkHV0aNVg5eKgDQoAvMirMCAwEAAaOCBJcwggST
+MAwGA1UdEwEB/wQCMAAwgYEGCCsGAQUFBwEBBHUwczA7BggrBgEFBQcwAYYvaHR0
+cDovL29jc3Bjb21wLmNlcnQuZm5tdC5lcy9vY3NwL09jc3BSZXNwb25kZXIwNAYI
+KwYBBQUHMAKGKGh0dHA6Ly93d3cuY2VydC5mbm10LmVzL2NlcnRzL0FDQ09NUC5j
+cnQwWQYDVR0gBFIwUDAIBgZngQwBAgIwOQYKKwYBBAGsZgMJFTArMCkGCCsGAQUF
+BwIBFh1odHRwOi8vd3d3LmNlcnQuZm5tdC5lcy9kcGNzLzAJBgcEAIvsQAEFMB4G
+A1UdEQQXMBWCE3Byb3ZlZWRvcmVzLmZubXQuZXMwHQYDVR0lBBYwFAYIKwYBBQUH
+AwEGCCsGAQUFBwMCMA4GA1UdDwEB/wQEAwIFoDAdBgNVHQ4EFgQU33VouFQ+JLbJ
+QqUjq0Wc2MFmt44wgbAGCCsGAQUFBwEDBIGjMIGgMAsGBgQAjkYBAwIBDzATBgYE
+AI5GAQYwCQYHBACORgEGAzByBgYEAI5GAQUwaDAyFixodHRwczovL3d3dy5jZXJ0
+LmZubXQuZXMvcGRzL1BEU19DT01QX2VzLnBkZhMCZXMwMhYsaHR0cHM6Ly93d3cu
+Y2VydC5mbm10LmVzL3Bkcy9QRFNfQ09NUF9lbi5wZGYTAmVuMAgGBgQAjkYBATAf
+BgNVHSMEGDAWgBQZ+FgvFNamzJsEmAgNTNerAKeDZTCB4AYDVR0fBIHYMIHVMIHS
+oIHPoIHMhoGebGRhcDovL2xkYXBjb21wLmNlcnQuZm5tdC5lcy9DTj1DUkwxLE9V
+PUFDJTIwQ29tcG9uZW50ZXMlMjBJbmZvcm1hdGljb3MsTz1GTk1ULVJDTSxDPUVT
+P2NlcnRpZmljYXRlUmV2b2NhdGlvbkxpc3Q7YmluYXJ5P2Jhc2U/b2JqZWN0Y2xh
+c3M9Y1JMRGlzdHJpYnV0aW9uUG9pbnSGKWh0dHA6Ly93d3cuY2VydC5mbm10LmVz
+L2NybHNjb21wL0NSTDEuY3JsMIIBfQYKKwYBBAHWeQIEAgSCAW0EggFpAWcAdQBO
+daMnXJoQwzhbbNTfP1LrHfDgjhuNacCx+mSxYpo53wAAAY1BH3FbAAAEAwBGMEQC
+IGsslwqMkiUDk8htgr60ujXKWCUrb6AhSbsP7l0eDz7rAiBnZz5wQMd6XYgQqWOz
+vUGDXy3IZFp5G6EkRoTt2d9S/QB2AM8RVu7VLnyv84db2Wkum+kacWdKsBfsrAHS
+W3fOzDsIAAABjUEfcm4AAAQDAEcwRQIgJmWKkBUv4wqEpwZjWfXh3w7CR2E3B9la
+u3U8HRNsZ8UCIQCEKx5A0ipdT5uVneF6V9Lcv+u27TpxXR2HvZ2OT0oNQQB2ABNK
+3xq1mEIJeAxv70x6kaQWtyNJzlhXat+u2qfCq+AiAAABjUEfc3QAAAQDAEcwRQIg
+KHbPdFZwtApBW3e1kmdm5thTEsPli9TnTKB5SwTi0hICIQCDj5GWTjuhPG81kszs
+jNiaKn0EFVXnPG4TNV3D9Thm3zANBgkqhkiG9w0BAQsFAAOCAQEAQdSrj4jTi3vA
+yM7XTSYMFhRHIGVfIMeJ3it1rugyNjhg9dUZsAIozdOlFLyKNNTTk4xOpIwUYz3Q
+uW7NntGHECR0M6HBiKg8fxLSjC728o1/DpFcmJE4h3mvNcQh5cC2JtwHG05HPgjk
+/N+BPq69xDs5QnqH9QUwX3TRkyM6O8hqNyUIHdKQRnvAmxLwZzEnR3KsnZ4LtmPd
+sLcGGRTmBRY8tG32VsdbwFaIH2tX/mV9GOuXx+g/+kPHyCikfwtYnmtNn+lbzTuQ
+0a3sOHC4LATcVfZ3OSt+2Vdk5nHsLxGB2Xla1pI/4u/go3p2B3fFv6zAtPVsTyDh
+qyg2qSji3w==
+-----END CERTIFICATE-----''')
diff --git a/tests/integration_certificate/etsi/evcp_pre_certificate/multiple_etsi_policy_oids.crttest b/tests/integration_certificate/etsi/evcp_pre_certificate/multiple_etsi_policy_oids.crttest
new file mode 100644
index 0000000..827ada5
--- /dev/null
+++ b/tests/integration_certificate/etsi/evcp_pre_certificate/multiple_etsi_policy_oids.crttest
@@ -0,0 +1,40 @@
+-----BEGIN CERTIFICATE-----
+MIIFxzCCBK+gAwIBAgIKTITWVCAMG9n4rDANBgkqhkiG9w0BAQsFADBLMQswCQYD
+VQQGEwJOTzEdMBsGA1UECgwUQnV5cGFzcyBBUy05ODMxNjMzMjcxHTAbBgNVBAMM
+FEJ1eXBhc3MgQ2xhc3MgMyBDQSAyMB4XDTI0MDIxNDEwMzQyMFoXDTI1MDIxMzIy
+NTkwMFowgfIxCzAJBgNVBAYTAk5PMQ0wCwYDVQQHDARPU0xPMQ0wCwYDVQQRDAQw
+OTc4MT8wPQYDVQQKDDZNQVNURVJDQVJEIFBBWU1FTlQgU0VSVklDRVMgSU5GUkFT
+VFJVQ1RVUkUgKE5PUldBWSkgQVMxHTAbBgNVBA8MFFByaXZhdGUgT3JnYW5pemF0
+aW9uMRMwEQYLKwYBBAGCNzwCAQMTAk5PMRIwEAYDVQQFEwk5MjI5ODg4NjIxGDAW
+BgNVBGETD05UUk5PLTkyMjk4ODg2MjEiMCAGA1UEAxMZbXRmLm1jZW5ldHQubWFz
+dGVyY2FyZC5ubzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMPkzQWj
+5Z5lDiodPsk7pYN7j9g9n1lYhzCepFMHJgiyacdcQxVkunYgGlB8m6CcFUcTVbu7
+qkkhN1g1gEKX3wMZVjwrSfmSoAuGsUciOS90T30HkOiDvzVxmnE9TuyhDHRKvANp
+OpNNcUlJHbPondkslHvf3xEO3Q+40M65NjH9GEtepU0aEixKCjPSxnWiwiMM6PFC
+NRtLJu+aQrP1wHOj2eHbaAstiTf20NKTfGbAFGVlskQcPTkNOYe2unZCUsVNyQwW
+KKbaa4Dk1g8SNpiIbyeovsVMS41Ul+/wg3qoT6G7CJd5UBzUFyjnKPz/OFjALOwW
+YCwNDKkmNEOtA/UCAwEAAaOCAgMwggH/MAwGA1UdEwEB/wQCMAAwHwYDVR0jBBgw
+FoAUIjAu0vv2S8rAuDvSBMTpcuaXmwwwDgYDVR0PAQH/BAQDAgeAMB0GA1UdJQQW
+MBQGCCsGAQUFBwMBBggrBgEFBQcDAjBSBgNVHSAESzBJMDEGBWeBDAEBMCgwJgYI
+KwYBBQUHAgEWGmh0dHBzOi8vd3d3LmJ1eXBhc3Mubm8vY3BzMAkGBwQAj3oBAQEw
+CQYHBACPegEBAjA6BgNVHR8EMzAxMC+gLaArhilodHRwOi8vY3JsLmJ1eXBhc3Mu
+bm8vY3JsL0JQQ2xhc3MzQ0EyLmNybDAkBgNVHREEHTAbghltdGYubWNlbmV0dC5t
+YXN0ZXJjYXJkLm5vMGoGCCsGAQUFBwEBBF4wXDAjBggrBgEFBQcwAYYXaHR0cDov
+L29jc3AuYnV5cGFzcy5jb20wNQYIKwYBBQUHMAKGKWh0dHA6Ly9jcnQuYnV5cGFz
+cy5uby9jcnQvQlBDbGFzczNDQTIuY2VyMEcGCCsGAQUFBwEDBDswOTA3BgYEAI5G
+AQUwLTArFiVodHRwczovL3d3dy5idXlwYXNzLm5vL3Bkcy9wZHNfZW4ucGRmEwJl
+bjATBgorBgEEAdZ5AgQDAQH/BAIFADAfBgVngQwDAQQWMBQTA05UUhMCTk8MCTky
+Mjk4ODg2MjANBgkqhkiG9w0BAQsFAAOCAQEAp2ou9Z776IUXDZb4QX+zkEgyI1Fz
+S5H7WrO6+/eISlnlw69lYIy6YG3iAfZa4wLb25syo5rdgagL6085kiLtRKVg5qil
+W6CJpQQjSQVl45VsSHJq2FVN17cUYysQ2AlBGNmifFDdLL0AoY6dObhJiSO5/1r/
+1BTW2V1/bIS1PzsKrrUwN3NKmgsy/y7tzocdnxQDlodtBYK0VdE6TaxjA1Y7dmgW
+AOR0dygHRq2XzjWS05PWLQsv2GLM680uqKrxw/X6qXSqu3pZF50R1rGSGwNFpobX
+QISAjsZL5B4lX+Ce+adzcpMPs8JeilUVlnBqfgTOeYs+EvLTYn2DpPuDbg==
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.subject.rdnSequence,EvSubscriberAttributeAllowanceValidator,WARNING,cabf.ev_guidelines.common_name_attribute_present,
+certificate.tbsCertificate.extensions.4.extnValue.certificatePolicies,CertificatePoliciesValidator,ERROR,etsi.en_319_411_1.gen-6.3.3-12.multiple_reserved_policy_oids_present,"Multiple reserved certificate policy OIDs present: 0.4.0.2042.1.1.1, 0.4.0.2042.1.1.2"
+certificate.tbsCertificate.extensions.4.extnValue.certificatePolicies.0.policyQualifiers.0,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 1.3.6.1.5.5.7.1.3
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 2.23.140.3.1
diff --git a/tests/integration_certificate/etsi/evcp_pre_certificate/prohibited_etsi_policy_oid.crttest b/tests/integration_certificate/etsi/evcp_pre_certificate/prohibited_etsi_policy_oid.crttest
new file mode 100644
index 0000000..26103aa
--- /dev/null
+++ b/tests/integration_certificate/etsi/evcp_pre_certificate/prohibited_etsi_policy_oid.crttest
@@ -0,0 +1,40 @@
+-----BEGIN CERTIFICATE-----
+MIIFvDCCBKSgAwIBAgIKTITWVCAMG9n4rDANBgkqhkiG9w0BAQsFADBLMQswCQYD
+VQQGEwJOTzEdMBsGA1UECgwUQnV5cGFzcyBBUy05ODMxNjMzMjcxHTAbBgNVBAMM
+FEJ1eXBhc3MgQ2xhc3MgMyBDQSAyMB4XDTI0MDIxNDEwMzQyMFoXDTI1MDIxMzIy
+NTkwMFowgfIxCzAJBgNVBAYTAk5PMQ0wCwYDVQQHDARPU0xPMQ0wCwYDVQQRDAQw
+OTc4MT8wPQYDVQQKDDZNQVNURVJDQVJEIFBBWU1FTlQgU0VSVklDRVMgSU5GUkFT
+VFJVQ1RVUkUgKE5PUldBWSkgQVMxHTAbBgNVBA8MFFByaXZhdGUgT3JnYW5pemF0
+aW9uMRMwEQYLKwYBBAGCNzwCAQMTAk5PMRIwEAYDVQQFEwk5MjI5ODg4NjIxGDAW
+BgNVBGETD05UUk5PLTkyMjk4ODg2MjEiMCAGA1UEAxMZbXRmLm1jZW5ldHQubWFz
+dGVyY2FyZC5ubzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMPkzQWj
+5Z5lDiodPsk7pYN7j9g9n1lYhzCepFMHJgiyacdcQxVkunYgGlB8m6CcFUcTVbu7
+qkkhN1g1gEKX3wMZVjwrSfmSoAuGsUciOS90T30HkOiDvzVxmnE9TuyhDHRKvANp
+OpNNcUlJHbPondkslHvf3xEO3Q+40M65NjH9GEtepU0aEixKCjPSxnWiwiMM6PFC
+NRtLJu+aQrP1wHOj2eHbaAstiTf20NKTfGbAFGVlskQcPTkNOYe2unZCUsVNyQwW
+KKbaa4Dk1g8SNpiIbyeovsVMS41Ul+/wg3qoT6G7CJd5UBzUFyjnKPz/OFjALOwW
+YCwNDKkmNEOtA/UCAwEAAaOCAfgwggH0MAwGA1UdEwEB/wQCMAAwHwYDVR0jBBgw
+FoAUIjAu0vv2S8rAuDvSBMTpcuaXmwwwDgYDVR0PAQH/BAQDAgeAMB0GA1UdJQQW
+MBQGCCsGAQUFBwMBBggrBgEFBQcDAjBHBgNVHSAEQDA+MDEGBWeBDAEBMCgwJgYI
+KwYBBQUHAgEWGmh0dHBzOi8vd3d3LmJ1eXBhc3Mubm8vY3BzMAkGBwQAj3oBAQEw
+OgYDVR0fBDMwMTAvoC2gK4YpaHR0cDovL2NybC5idXlwYXNzLm5vL2NybC9CUENs
+YXNzM0NBMi5jcmwwJAYDVR0RBB0wG4IZbXRmLm1jZW5ldHQubWFzdGVyY2FyZC5u
+bzBqBggrBgEFBQcBAQReMFwwIwYIKwYBBQUHMAGGF2h0dHA6Ly9vY3NwLmJ1eXBh
+c3MuY29tMDUGCCsGAQUFBzAChilodHRwOi8vY3J0LmJ1eXBhc3Mubm8vY3J0L0JQ
+Q2xhc3MzQ0EyLmNlcjBHBggrBgEFBQcBAwQ7MDkwNwYGBACORgEFMC0wKxYlaHR0
+cHM6Ly93d3cuYnV5cGFzcy5uby9wZHMvcGRzX2VuLnBkZhMCZW4wEwYKKwYBBAHW
+eQIEAwEB/wQCBQAwHwYFZ4EMAwEEFjAUEwNOVFITAk5PDAk5MjI5ODg4NjIwDQYJ
+KoZIhvcNAQELBQADggEBAKdqLvWe++iFFw2W+EF/s5BIMiNRc0uR+1qzuvv3iEpZ
+5cOvZWCMumBt4gH2WuMC29ubMqOa3YGoC+tPOZIi7USlYOaopVugiaUEI0kFZeOV
+bEhyathVTde3FGMrENgJQRjZonxQ3Sy9AKGOnTm4SYkjuf9a/9QU1tldf2yEtT87
+Cq61MDdzSpoLMv8u7c6HHZ8UA5aHbQWCtFXROk2sYwNWO3ZoFgDkdHcoB0atl841
+ktOT1i0LL9hizOvNLqiq8cP1+ql0qrt6WRedEdaxkhsDRaaG10CEgI7GS+QeJV/g
+nvmnc3KTD7PCXopVFZZwan4EznmLPhLy02J9g6T7g24=
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.subject.rdnSequence,EvSubscriberAttributeAllowanceValidator,WARNING,cabf.ev_guidelines.common_name_attribute_present,
+certificate.tbsCertificate.extensions.4.extnValue.certificatePolicies,CertificatePoliciesValidator,ERROR,etsi.en_319_411_1.gen-6.3.3-12.prohibited_reserved_policy_oid_present,Prohibited reserved certificate policy OID present: 0.4.0.2042.1.1.1
+certificate.tbsCertificate.extensions.4.extnValue.certificatePolicies.0.policyQualifiers.0,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 1.3.6.1.5.5.7.1.3
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 2.23.140.3.1
diff --git a/tests/integration_certificate/etsi/ncp_legal_person_certificate/aia_ca_issuers_missing.crttest b/tests/integration_certificate/etsi/ncp_legal_person_certificate/aia_ca_issuers_missing.crttest
new file mode 100644
index 0000000..6caec94
--- /dev/null
+++ b/tests/integration_certificate/etsi/ncp_legal_person_certificate/aia_ca_issuers_missing.crttest
@@ -0,0 +1,38 @@
+-----BEGIN CERTIFICATE-----
+MIIFRTCCBC2gAwIBAgIKTITWVCAMG9n4rDANBgkqhkiG9w0BAQsFADBLMQswCQYD
+VQQGEwJOTzEdMBsGA1UECgwUQnV5cGFzcyBBUy05ODMxNjMzMjcxHTAbBgNVBAMM
+FEJ1eXBhc3MgQ2xhc3MgMyBDQSAyMB4XDTI0MDIxNDEwMzQyMFoXDTI1MDIxMzIy
+NTkwMFowgbQxCzAJBgNVBAYTAk5PMQ0wCwYDVQQHDARPU0xPMQ0wCwYDVQQRDAQw
+OTc4MT8wPQYDVQQKDDZNQVNURVJDQVJEIFBBWU1FTlQgU0VSVklDRVMgSU5GUkFT
+VFJVQ1RVUkUgKE5PUldBWSkgQVMxHTAbBgNVBA8MFFByaXZhdGUgT3JnYW5pemF0
+aW9uMRMwEQYLKwYBBAGCNzwCAQMTAk5PMRIwEAYDVQQFEwk5MjI5ODg4NjIwggEi
+MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDD5M0Fo+WeZQ4qHT7JO6WDe4/Y
+PZ9ZWIcwnqRTByYIsmnHXEMVZLp2IBpQfJugnBVHE1W7u6pJITdYNYBCl98DGVY8
+K0n5kqALhrFHIjkvdE99B5Dog781cZpxPU7soQx0SrwDaTqTTXFJSR2z6J3ZLJR7
+398RDt0PuNDOuTYx/RhLXqVNGhIsSgoz0sZ1osIjDOjxQjUbSybvmkKz9cBzo9nh
+22gLLYk39tDSk3xmwBRlZbJEHD05DTmHtrp2QlLFTckMFiim2muA5NYPEjaYiG8n
+qL7FTEuNVJfv8IN6qE+huwiXeVAc1Bco5yj8/zhYwCzsFmAsDQypJjRDrQP1AgMB
+AAGjggG/MIIBuzAMBgNVHRMBAf8EAjAAMB8GA1UdIwQYMBaAFCIwLtL79kvKwLg7
+0gTE6XLml5sMMA4GA1UdDwEB/wQEAwIHgDAdBgNVHSUEFjAUBggrBgEFBQcDAQYI
+KwYBBQUHAwIwRwYDVR0gBEAwPjAxBgVngQwBATAoMCYGCCsGAQUFBwIBFhpodHRw
+czovL3d3dy5idXlwYXNzLm5vL2NwczAJBgcEAIvsQAEEMDoGA1UdHwQzMDEwL6At
+oCuGKWh0dHA6Ly9jcmwuYnV5cGFzcy5uby9jcmwvQlBDbGFzczNDQTIuY3JsMCQG
+A1UdEQQdMBuCGW10Zi5tY2VuZXR0Lm1hc3RlcmNhcmQubm8wMwYIKwYBBQUHAQEE
+JzAlMCMGCCsGAQUFBzABhhdodHRwOi8vb2NzcC5idXlwYXNzLmNvbTBmBggrBgEF
+BQcBAwRaMFgwCAYGBACORgEBMBMGBgQAjkYBBjAJBgcEAI5GAQYDMDcGBgQAjkYB
+BTAtMCsWJWh0dHBzOi8vd3d3LmJ1eXBhc3Mubm8vcGRzL3Bkc19lbi5wZGYTAmVu
+MBMGCisGAQQB1nkCBAMBAf8EAgUAMA0GCSqGSIb3DQEBCwUAA4IBAQCnai71nvvo
+hRcNlvhBf7OQSDIjUXNLkftas7r794hKWeXDr2VgjLpgbeIB9lrjAtvbmzKjmt2B
+qAvrTzmSIu1EpWDmqKVboImlBCNJBWXjlWxIcmrYVU3XtxRjKxDYCUEY2aJ8UN0s
+vQChjp05uEmJI7n/Wv/UFNbZXX9shLU/OwqutTA3c0qaCzL/Lu3Ohx2fFAOWh20F
+grRV0TpNrGMDVjt2aBYA5HR3KAdGrZfONZLTk9YtCy/YYszrzS6oqvHD9fqpdKq7
+elkXnRHWsZIbA0WmhtdAhICOxkvkHiVf4J75p3Nykw+zwl6KVRWWcGp+BM55iz4S
+8tNifYOk+4Nu
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.extensions.7.extnValue.authorityInfoAccessSyntax,AuthorityInformationAccessValidator,ERROR,etsi.en_319_412_2.gen-4.4.1-3.ca_issuers_aia_access_method_absent,
+certificate.tbsCertificate.subject.rdnSequence,LegalPersonSubjectAttributeAllowanceValidator,ERROR,etsi.en_319_412_3.leg-4.2.1-2.common_name_attribute_absent,
+certificate.tbsCertificate.subject.rdnSequence,LegalPersonSubjectAttributeAllowanceValidator,ERROR,etsi.en_319_412_3.leg-4.2.1-2.organization_identifier_attribute_absent,
+certificate,SubjectKeyIdentifierPresenceValidator,WARNING,pkix.certificate_skid_end_entity_missing,
+certificate.tbsCertificate.extensions.4.extnValue.certificatePolicies.0,CertificatePolicyQualifierValidator,NOTICE,pkix.certificate_policies_policy_has_qualifier,
diff --git a/tests/integration_certificate/etsi/ncp_legal_person_certificate/aia_ca_issuers_not_http_uri.crttest b/tests/integration_certificate/etsi/ncp_legal_person_certificate/aia_ca_issuers_not_http_uri.crttest
new file mode 100644
index 0000000..971a0ea
--- /dev/null
+++ b/tests/integration_certificate/etsi/ncp_legal_person_certificate/aia_ca_issuers_not_http_uri.crttest
@@ -0,0 +1,39 @@
+-----BEGIN CERTIFICATE-----
+MIIFezCCBGOgAwIBAgIKTITWVCAMG9n4rDANBgkqhkiG9w0BAQsFADBLMQswCQYD
+VQQGEwJOTzEdMBsGA1UECgwUQnV5cGFzcyBBUy05ODMxNjMzMjcxHTAbBgNVBAMM
+FEJ1eXBhc3MgQ2xhc3MgMyBDQSAyMB4XDTI0MDIxNDEwMzQyMFoXDTI1MDIxMzIy
+NTkwMFowgbQxCzAJBgNVBAYTAk5PMQ0wCwYDVQQHDARPU0xPMQ0wCwYDVQQRDAQw
+OTc4MT8wPQYDVQQKDDZNQVNURVJDQVJEIFBBWU1FTlQgU0VSVklDRVMgSU5GUkFT
+VFJVQ1RVUkUgKE5PUldBWSkgQVMxHTAbBgNVBA8MFFByaXZhdGUgT3JnYW5pemF0
+aW9uMRMwEQYLKwYBBAGCNzwCAQMTAk5PMRIwEAYDVQQFEwk5MjI5ODg4NjIwggEi
+MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDD5M0Fo+WeZQ4qHT7JO6WDe4/Y
+PZ9ZWIcwnqRTByYIsmnHXEMVZLp2IBpQfJugnBVHE1W7u6pJITdYNYBCl98DGVY8
+K0n5kqALhrFHIjkvdE99B5Dog781cZpxPU7soQx0SrwDaTqTTXFJSR2z6J3ZLJR7
+398RDt0PuNDOuTYx/RhLXqVNGhIsSgoz0sZ1osIjDOjxQjUbSybvmkKz9cBzo9nh
+22gLLYk39tDSk3xmwBRlZbJEHD05DTmHtrp2QlLFTckMFiim2muA5NYPEjaYiG8n
+qL7FTEuNVJfv8IN6qE+huwiXeVAc1Bco5yj8/zhYwCzsFmAsDQypJjRDrQP1AgMB
+AAGjggH1MIIB8TAMBgNVHRMBAf8EAjAAMB8GA1UdIwQYMBaAFCIwLtL79kvKwLg7
+0gTE6XLml5sMMA4GA1UdDwEB/wQEAwIHgDAdBgNVHSUEFjAUBggrBgEFBQcDAQYI
+KwYBBQUHAwIwRwYDVR0gBEAwPjAxBgVngQwBATAoMCYGCCsGAQUFBwIBFhpodHRw
+czovL3d3dy5idXlwYXNzLm5vL2NwczAJBgcEAIvsQAEEMDoGA1UdHwQzMDEwL6At
+oCuGKWh0dHA6Ly9jcmwuYnV5cGFzcy5uby9jcmwvQlBDbGFzczNDQTIuY3JsMCQG
+A1UdEQQdMBuCGW10Zi5tY2VuZXR0Lm1hc3RlcmNhcmQubm8waQYIKwYBBQUHAQEE
+XTBbMCMGCCsGAQUFBzABhhdodHRwOi8vb2NzcC5idXlwYXNzLmNvbTA0BggrBgEF
+BQcwAoYoZnRwOi8vY3J0LmJ1eXBhc3Mubm8vY3J0L0JQQ2xhc3MzQ0EyLmNlcjBm
+BggrBgEFBQcBAwRaMFgwCAYGBACORgEBMBMGBgQAjkYBBjAJBgcEAI5GAQYDMDcG
+BgQAjkYBBTAtMCsWJWh0dHBzOi8vd3d3LmJ1eXBhc3Mubm8vcGRzL3Bkc19lbi5w
+ZGYTAmVuMBMGCisGAQQB1nkCBAMBAf8EAgUAMA0GCSqGSIb3DQEBCwUAA4IBAQCn
+ai71nvvohRcNlvhBf7OQSDIjUXNLkftas7r794hKWeXDr2VgjLpgbeIB9lrjAtvb
+mzKjmt2BqAvrTzmSIu1EpWDmqKVboImlBCNJBWXjlWxIcmrYVU3XtxRjKxDYCUEY
+2aJ8UN0svQChjp05uEmJI7n/Wv/UFNbZXX9shLU/OwqutTA3c0qaCzL/Lu3Ohx2f
+FAOWh20FgrRV0TpNrGMDVjt2aBYA5HR3KAdGrZfONZLTk9YtCy/YYszrzS6oqvHD
+9fqpdKq7elkXnRHWsZIbA0WmhtdAhICOxkvkHiVf4J75p3Nykw+zwl6KVRWWcGp+
+BM55iz4S8tNifYOk+4Nu
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.extensions.7.extnValue.authorityInfoAccessSyntax,AuthorityInformationAccessValidator,ERROR,etsi.en_319_412_2.gen-4.4.1-4.ca_issuers_aia_access_method_http_uri_missing,
+certificate.tbsCertificate.subject.rdnSequence,LegalPersonSubjectAttributeAllowanceValidator,ERROR,etsi.en_319_412_3.leg-4.2.1-2.common_name_attribute_absent,
+certificate.tbsCertificate.subject.rdnSequence,LegalPersonSubjectAttributeAllowanceValidator,ERROR,etsi.en_319_412_3.leg-4.2.1-2.organization_identifier_attribute_absent,
+certificate,SubjectKeyIdentifierPresenceValidator,WARNING,pkix.certificate_skid_end_entity_missing,
+certificate.tbsCertificate.extensions.4.extnValue.certificatePolicies.0,CertificatePolicyQualifierValidator,NOTICE,pkix.certificate_policies_policy_has_qualifier,
diff --git a/tests/integration_certificate/etsi/ncp_legal_person_certificate/aia_ocsp_missing_crldp_absent.crttest b/tests/integration_certificate/etsi/ncp_legal_person_certificate/aia_ocsp_missing_crldp_absent.crttest
new file mode 100644
index 0000000..7dbd4a9
--- /dev/null
+++ b/tests/integration_certificate/etsi/ncp_legal_person_certificate/aia_ocsp_missing_crldp_absent.crttest
@@ -0,0 +1,38 @@
+-----BEGIN CERTIFICATE-----
+MIIFGzCCBAOgAwIBAgIKTITWVCAMG9n4rDANBgkqhkiG9w0BAQsFADBLMQswCQYD
+VQQGEwJOTzEdMBsGA1UECgwUQnV5cGFzcyBBUy05ODMxNjMzMjcxHTAbBgNVBAMM
+FEJ1eXBhc3MgQ2xhc3MgMyBDQSAyMB4XDTI0MDIxNDEwMzQyMFoXDTI1MDIxMzIy
+NTkwMFowgbQxCzAJBgNVBAYTAk5PMQ0wCwYDVQQHDARPU0xPMQ0wCwYDVQQRDAQw
+OTc4MT8wPQYDVQQKDDZNQVNURVJDQVJEIFBBWU1FTlQgU0VSVklDRVMgSU5GUkFT
+VFJVQ1RVUkUgKE5PUldBWSkgQVMxHTAbBgNVBA8MFFByaXZhdGUgT3JnYW5pemF0
+aW9uMRMwEQYLKwYBBAGCNzwCAQMTAk5PMRIwEAYDVQQFEwk5MjI5ODg4NjIwggEi
+MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDD5M0Fo+WeZQ4qHT7JO6WDe4/Y
+PZ9ZWIcwnqRTByYIsmnHXEMVZLp2IBpQfJugnBVHE1W7u6pJITdYNYBCl98DGVY8
+K0n5kqALhrFHIjkvdE99B5Dog781cZpxPU7soQx0SrwDaTqTTXFJSR2z6J3ZLJR7
+398RDt0PuNDOuTYx/RhLXqVNGhIsSgoz0sZ1osIjDOjxQjUbSybvmkKz9cBzo9nh
+22gLLYk39tDSk3xmwBRlZbJEHD05DTmHtrp2QlLFTckMFiim2muA5NYPEjaYiG8n
+qL7FTEuNVJfv8IN6qE+huwiXeVAc1Bco5yj8/zhYwCzsFmAsDQypJjRDrQP1AgMB
+AAGjggGVMIIBkTAMBgNVHRMBAf8EAjAAMB8GA1UdIwQYMBaAFCIwLtL79kvKwLg7
+0gTE6XLml5sMMA4GA1UdDwEB/wQEAwIHgDAdBgNVHSUEFjAUBggrBgEFBQcDAQYI
+KwYBBQUHAwIwRwYDVR0gBEAwPjAxBgVngQwBATAoMCYGCCsGAQUFBwIBFhpodHRw
+czovL3d3dy5idXlwYXNzLm5vL2NwczAJBgcEAIvsQAEEMCQGA1UdEQQdMBuCGW10
+Zi5tY2VuZXR0Lm1hc3RlcmNhcmQubm8wRQYIKwYBBQUHAQEEOTA3MDUGCCsGAQUF
+BzAChilodHRwOi8vY3J0LmJ1eXBhc3Mubm8vY3J0L0JQQ2xhc3MzQ0EyLmNlcjBm
+BggrBgEFBQcBAwRaMFgwCAYGBACORgEBMBMGBgQAjkYBBjAJBgcEAI5GAQYDMDcG
+BgQAjkYBBTAtMCsWJWh0dHBzOi8vd3d3LmJ1eXBhc3Mubm8vcGRzL3Bkc19lbi5w
+ZGYTAmVuMBMGCisGAQQB1nkCBAMBAf8EAgUAMA0GCSqGSIb3DQEBCwUAA4IBAQCn
+ai71nvvohRcNlvhBf7OQSDIjUXNLkftas7r794hKWeXDr2VgjLpgbeIB9lrjAtvb
+mzKjmt2BqAvrTzmSIu1EpWDmqKVboImlBCNJBWXjlWxIcmrYVU3XtxRjKxDYCUEY
+2aJ8UN0svQChjp05uEmJI7n/Wv/UFNbZXX9shLU/OwqutTA3c0qaCzL/Lu3Ohx2f
+FAOWh20FgrRV0TpNrGMDVjt2aBYA5HR3KAdGrZfONZLTk9YtCy/YYszrzS6oqvHD
+9fqpdKq7elkXnRHWsZIbA0WmhtdAhICOxkvkHiVf4J75p3Nykw+zwl6KVRWWcGp+
+BM55iz4S8tNifYOk+4Nu
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.extensions,CrlDistributionPointsExtensionPresenceValidator,ERROR,etsi.en_319_412_2.gen-4.3.11-2.crldp_extension_missing,
+certificate.tbsCertificate.extensions.6.extnValue.authorityInfoAccessSyntax,AuthorityInformationAccessValidator,ERROR,etsi.en_319_412_2.gen-4.4.1-8.ocsp_aia_access_method_absent,
+certificate.tbsCertificate.subject.rdnSequence,LegalPersonSubjectAttributeAllowanceValidator,ERROR,etsi.en_319_412_3.leg-4.2.1-2.common_name_attribute_absent,
+certificate.tbsCertificate.subject.rdnSequence,LegalPersonSubjectAttributeAllowanceValidator,ERROR,etsi.en_319_412_3.leg-4.2.1-2.organization_identifier_attribute_absent,
+certificate,SubjectKeyIdentifierPresenceValidator,WARNING,pkix.certificate_skid_end_entity_missing,
+certificate.tbsCertificate.extensions.4.extnValue.certificatePolicies.0,CertificatePolicyQualifierValidator,NOTICE,pkix.certificate_policies_policy_has_qualifier,
diff --git a/tests/integration_certificate/etsi/ncp_legal_person_certificate/aia_ocsp_missing_crldp_present.crttetst b/tests/integration_certificate/etsi/ncp_legal_person_certificate/aia_ocsp_missing_crldp_present.crttetst
new file mode 100644
index 0000000..be4856b
--- /dev/null
+++ b/tests/integration_certificate/etsi/ncp_legal_person_certificate/aia_ocsp_missing_crldp_present.crttetst
@@ -0,0 +1,35 @@
+-----BEGIN CERTIFICATE-----
+MIIFVzCCBD+gAwIBAgIKTITWVCAMG9n4rDANBgkqhkiG9w0BAQsFADBLMQswCQYD
+VQQGEwJOTzEdMBsGA1UECgwUQnV5cGFzcyBBUy05ODMxNjMzMjcxHTAbBgNVBAMM
+FEJ1eXBhc3MgQ2xhc3MgMyBDQSAyMB4XDTI0MDIxNDEwMzQyMFoXDTI1MDIxMzIy
+NTkwMFowgbQxCzAJBgNVBAYTAk5PMQ0wCwYDVQQHDARPU0xPMQ0wCwYDVQQRDAQw
+OTc4MT8wPQYDVQQKDDZNQVNURVJDQVJEIFBBWU1FTlQgU0VSVklDRVMgSU5GUkFT
+VFJVQ1RVUkUgKE5PUldBWSkgQVMxHTAbBgNVBA8MFFByaXZhdGUgT3JnYW5pemF0
+aW9uMRMwEQYLKwYBBAGCNzwCAQMTAk5PMRIwEAYDVQQFEwk5MjI5ODg4NjIwggEi
+MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDD5M0Fo+WeZQ4qHT7JO6WDe4/Y
+PZ9ZWIcwnqRTByYIsmnHXEMVZLp2IBpQfJugnBVHE1W7u6pJITdYNYBCl98DGVY8
+K0n5kqALhrFHIjkvdE99B5Dog781cZpxPU7soQx0SrwDaTqTTXFJSR2z6J3ZLJR7
+398RDt0PuNDOuTYx/RhLXqVNGhIsSgoz0sZ1osIjDOjxQjUbSybvmkKz9cBzo9nh
+22gLLYk39tDSk3xmwBRlZbJEHD05DTmHtrp2QlLFTckMFiim2muA5NYPEjaYiG8n
+qL7FTEuNVJfv8IN6qE+huwiXeVAc1Bco5yj8/zhYwCzsFmAsDQypJjRDrQP1AgMB
+AAGjggHRMIIBzTAMBgNVHRMBAf8EAjAAMB8GA1UdIwQYMBaAFCIwLtL79kvKwLg7
+0gTE6XLml5sMMA4GA1UdDwEB/wQEAwIHgDAdBgNVHSUEFjAUBggrBgEFBQcDAQYI
+KwYBBQUHAwIwRwYDVR0gBEAwPjAxBgVngQwBATAoMCYGCCsGAQUFBwIBFhpodHRw
+czovL3d3dy5idXlwYXNzLm5vL2NwczAJBgcEAIvsQAEEMDoGA1UdHwQzMDEwL6At
+oCuGKWh0dHA6Ly9jcmwuYnV5cGFzcy5uby9jcmwvQlBDbGFzczNDQTIuY3JsMCQG
+A1UdEQQdMBuCGW10Zi5tY2VuZXR0Lm1hc3RlcmNhcmQubm8wRQYIKwYBBQUHAQEE
+OTA3MDUGCCsGAQUFBzAChilodHRwOi8vY3J0LmJ1eXBhc3Mubm8vY3J0L0JQQ2xh
+c3MzQ0EyLmNlcjBmBggrBgEFBQcBAwRaMFgwCAYGBACORgEBMBMGBgQAjkYBBjAJ
+BgcEAI5GAQYDMDcGBgQAjkYBBTAtMCsWJWh0dHBzOi8vd3d3LmJ1eXBhc3Mubm8v
+cGRzL3Bkc19lbi5wZGYTAmVuMBMGCisGAQQB1nkCBAMBAf8EAgUAMA0GCSqGSIb3
+DQEBCwUAA4IBAQCnai71nvvohRcNlvhBf7OQSDIjUXNLkftas7r794hKWeXDr2Vg
+jLpgbeIB9lrjAtvbmzKjmt2BqAvrTzmSIu1EpWDmqKVboImlBCNJBWXjlWxIcmrY
+VU3XtxRjKxDYCUEY2aJ8UN0svQChjp05uEmJI7n/Wv/UFNbZXX9shLU/OwqutTA3
+c0qaCzL/Lu3Ohx2fFAOWh20FgrRV0TpNrGMDVjt2aBYA5HR3KAdGrZfONZLTk9Yt
+Cy/YYszrzS6oqvHD9fqpdKq7elkXnRHWsZIbA0WmhtdAhICOxkvkHiVf4J75p3Ny
+kw+zwl6KVRWWcGp+BM55iz4S8tNifYOk+4Nu
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.subject.rdnSequence,LegalPersonSubjectAttributeAllowanceValidator,ERROR,etsi.en_319_412_3.leg-4.2.1-2.common_name_attribute_absent,
+certificate.tbsCertificate.subject.rdnSequence,LegalPersonSubjectAttributeAllowanceValidator,ERROR,etsi.en_319_412_3.leg-4.2.1-2.organization_identifier_attribute_absent,
diff --git a/tests/integration_certificate/etsi/ncp_legal_person_certificate/aia_ocsp_not_http_uri_crldp_absent.crttest b/tests/integration_certificate/etsi/ncp_legal_person_certificate/aia_ocsp_not_http_uri_crldp_absent.crttest
new file mode 100644
index 0000000..c4cc376
--- /dev/null
+++ b/tests/integration_certificate/etsi/ncp_legal_person_certificate/aia_ocsp_not_http_uri_crldp_absent.crttest
@@ -0,0 +1,39 @@
+-----BEGIN CERTIFICATE-----
+MIIFPzCCBCegAwIBAgIKTITWVCAMG9n4rDANBgkqhkiG9w0BAQsFADBLMQswCQYD
+VQQGEwJOTzEdMBsGA1UECgwUQnV5cGFzcyBBUy05ODMxNjMzMjcxHTAbBgNVBAMM
+FEJ1eXBhc3MgQ2xhc3MgMyBDQSAyMB4XDTI0MDIxNDEwMzQyMFoXDTI1MDIxMzIy
+NTkwMFowgbQxCzAJBgNVBAYTAk5PMQ0wCwYDVQQHDARPU0xPMQ0wCwYDVQQRDAQw
+OTc4MT8wPQYDVQQKDDZNQVNURVJDQVJEIFBBWU1FTlQgU0VSVklDRVMgSU5GUkFT
+VFJVQ1RVUkUgKE5PUldBWSkgQVMxHTAbBgNVBA8MFFByaXZhdGUgT3JnYW5pemF0
+aW9uMRMwEQYLKwYBBAGCNzwCAQMTAk5PMRIwEAYDVQQFEwk5MjI5ODg4NjIwggEi
+MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDD5M0Fo+WeZQ4qHT7JO6WDe4/Y
+PZ9ZWIcwnqRTByYIsmnHXEMVZLp2IBpQfJugnBVHE1W7u6pJITdYNYBCl98DGVY8
+K0n5kqALhrFHIjkvdE99B5Dog781cZpxPU7soQx0SrwDaTqTTXFJSR2z6J3ZLJR7
+398RDt0PuNDOuTYx/RhLXqVNGhIsSgoz0sZ1osIjDOjxQjUbSybvmkKz9cBzo9nh
+22gLLYk39tDSk3xmwBRlZbJEHD05DTmHtrp2QlLFTckMFiim2muA5NYPEjaYiG8n
+qL7FTEuNVJfv8IN6qE+huwiXeVAc1Bco5yj8/zhYwCzsFmAsDQypJjRDrQP1AgMB
+AAGjggG5MIIBtTAMBgNVHRMBAf8EAjAAMB8GA1UdIwQYMBaAFCIwLtL79kvKwLg7
+0gTE6XLml5sMMA4GA1UdDwEB/wQEAwIHgDAdBgNVHSUEFjAUBggrBgEFBQcDAQYI
+KwYBBQUHAwIwRwYDVR0gBEAwPjAxBgVngQwBATAoMCYGCCsGAQUFBwIBFhpodHRw
+czovL3d3dy5idXlwYXNzLm5vL2NwczAJBgcEAIvsQAEEMCQGA1UdEQQdMBuCGW10
+Zi5tY2VuZXR0Lm1hc3RlcmNhcmQubm8waQYIKwYBBQUHAQEEXTBbMCIGCCsGAQUF
+BzABhhZmdHA6Ly9vY3NwLmJ1eXBhc3MuY29tMDUGCCsGAQUFBzAChilodHRwOi8v
+Y3J0LmJ1eXBhc3Mubm8vY3J0L0JQQ2xhc3MzQ0EyLmNlcjBmBggrBgEFBQcBAwRa
+MFgwCAYGBACORgEBMBMGBgQAjkYBBjAJBgcEAI5GAQYDMDcGBgQAjkYBBTAtMCsW
+JWh0dHBzOi8vd3d3LmJ1eXBhc3Mubm8vcGRzL3Bkc19lbi5wZGYTAmVuMBMGCisG
+AQQB1nkCBAMBAf8EAgUAMA0GCSqGSIb3DQEBCwUAA4IBAQCnai71nvvohRcNlvhB
+f7OQSDIjUXNLkftas7r794hKWeXDr2VgjLpgbeIB9lrjAtvbmzKjmt2BqAvrTzmS
+Iu1EpWDmqKVboImlBCNJBWXjlWxIcmrYVU3XtxRjKxDYCUEY2aJ8UN0svQChjp05
+uEmJI7n/Wv/UFNbZXX9shLU/OwqutTA3c0qaCzL/Lu3Ohx2fFAOWh20FgrRV0TpN
+rGMDVjt2aBYA5HR3KAdGrZfONZLTk9YtCy/YYszrzS6oqvHD9fqpdKq7elkXnRHW
+sZIbA0WmhtdAhICOxkvkHiVf4J75p3Nykw+zwl6KVRWWcGp+BM55iz4S8tNifYOk
++4Nu
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.extensions,CrlDistributionPointsExtensionPresenceValidator,ERROR,etsi.en_319_412_2.gen-4.3.11-2.crldp_extension_missing,
+certificate,SubjectKeyIdentifierPresenceValidator,WARNING,pkix.certificate_skid_end_entity_missing,
+certificate.tbsCertificate.extensions.4.extnValue.certificatePolicies.0,CertificatePolicyQualifierValidator,NOTICE,pkix.certificate_policies_policy_has_qualifier,
+certificate.tbsCertificate.extensions.6.extnValue.authorityInfoAccessSyntax,AuthorityInformationAccessValidator,ERROR,etsi.en_319_412_2.gen-4.4.1-6.ocsp_aia_access_method_http_uri_missing,
+certificate.tbsCertificate.subject.rdnSequence,LegalPersonSubjectAttributeAllowanceValidator,ERROR,etsi.en_319_412_3.leg-4.2.1-2.common_name_attribute_absent,
+certificate.tbsCertificate.subject.rdnSequence,LegalPersonSubjectAttributeAllowanceValidator,ERROR,etsi.en_319_412_3.leg-4.2.1-2.organization_identifier_attribute_absent,
diff --git a/tests/integration_certificate/etsi/ncp_legal_person_certificate/bad_ecdsa_curve.crttest b/tests/integration_certificate/etsi/ncp_legal_person_certificate/bad_ecdsa_curve.crttest
new file mode 100644
index 0000000..74ac179
--- /dev/null
+++ b/tests/integration_certificate/etsi/ncp_legal_person_certificate/bad_ecdsa_curve.crttest
@@ -0,0 +1,41 @@
+-----BEGIN CERTIFICATE-----
+MIIF8DCCBZWgAwIBAgIOAn2jtGjQ0XIDSuG2eQowCgYIKoZIzj0EAwIwejELMAkG
+A1UEBhMCSFUxETAPBgNVBAcMCEJ1ZGFwZXN0MRYwFAYDVQQKDA1NaWNyb3NlYyBM
+dGQuMRcwFQYDVQRhDA5WQVRIVS0yMzU4NDQ5NzEnMCUGA1UEAwweZS1Temlnbm8g
+UXVhbGlmaWVkIFRMUyBDQSAyMDE4MB4XDTI0MDQzMDE0MDAxMloXDTI0MDUxMDE0
+MDAxMVowgasxEzARBgsrBgEEAYI3PAIBAxMCSFUxHTAbBgNVBA8MFFByaXZhdGUg
+T3JnYW5pemF0aW9uMRUwEwYDVQQFEwwwMS0xMC0wNDcyMTgxCzAJBgNVBAYTAkhV
+MREwDwYDVQQHDAhCdWRhcGVzdDEWMBQGA1UECgwNTWljcm9zZWMgTHRkLjEmMCQG
+A1UEAwwdZXF0bHNjYTIwMTgtdmFsaWQuZS1zemlnbm8uaHUwWTATBgcqhkjOPQIB
+BggqhkjOPQMBDANCAAT6WJ1pvxSfy8QSn2Soe3G8fB7If5XmEZyk6XxwVU2nMYTc
+M8WHDNROTX19TCt0BtcAAUJ/krcWdx/GUKSdwnUGo4IDyzCCA8cwDgYDVR0PAQH/
+BAQDAgOIMBMGCisGAQQB1nkCBAMBAf8EAgUAMB0GA1UdJQQWMBQGCCsGAQUFBwMC
+BggrBgEFBQcDATBYBgNVHSAEUTBPMAcGBWeBDAEBMAkGBwQAi+xAAQQwOQYNKwYB
+BAGBqBgCAQGBKjAoMCYGCCsGAQUFBwIBFhpodHRwOi8vY3AuZS1zemlnbm8uaHUv
+cWNwczAdBgNVHQ4EFgQUbBS7vo72MFT0KTXHGiyafMbtdeswHwYDVR0jBBgwFoAU
+2Y0YuKwjtjuMF8nrbrkXAGkNoIwwKAYDVR0RBCEwH4IdZXF0bHNjYTIwMTgtdmFs
+aWQuZS1zemlnbm8uaHUwgbwGA1UdHwSBtDCBsTA5oDegNYYzaHR0cDovL2VxdGxz
+Y2EyMDE4LWNybDEuZS1zemlnbm8uaHUvZXF0bHNjYTIwMTguY3JsMDmgN6A1hjNo
+dHRwOi8vZXF0bHNjYTIwMTgtY3JsMi5lLXN6aWduby5odS9lcXRsc2NhMjAxOC5j
+cmwwOaA3oDWGM2h0dHA6Ly9lcXRsc2NhMjAxOC1jcmwzLmUtc3ppZ25vLmh1L2Vx
+dGxzY2EyMDE4LmNybDCCAWgGCCsGAQUFBwEBBIIBWjCCAVYwMAYIKwYBBQUHMAGG
+JGh0dHA6Ly9lcXRsc2NhMjAxOC1vY3NwMS5lLXN6aWduby5odTAwBggrBgEFBQcw
+AYYkaHR0cDovL2VxdGxzY2EyMDE4LW9jc3AyLmUtc3ppZ25vLmh1MDAGCCsGAQUF
+BzABhiRodHRwOi8vZXF0bHNjYTIwMTgtb2NzcDMuZS1zemlnbm8uaHUwPgYIKwYB
+BQUHMAKGMmh0dHA6Ly9lcXRsc2NhMjAxOC1jYTEuZS1zemlnbm8uaHUvZXF0bHNj
+YTIwMTguY3J0MD4GCCsGAQUFBzAChjJodHRwOi8vZXF0bHNjYTIwMTgtY2EyLmUt
+c3ppZ25vLmh1L2VxdGxzY2EyMDE4LmNydDA+BggrBgEFBQcwAoYyaHR0cDovL2Vx
+dGxzY2EyMDE4LWNhMy5lLXN6aWduby5odS9lcXRsc2NhMjAxOC5jcnQwgZEGCCsG
+AQUFBwEDBIGEMIGBMAgGBgQAjkYBATALBgYEAI5GAQMCAQowUwYGBACORgEFMEkw
+JBYeaHR0cHM6Ly9jcC5lLXN6aWduby5odS9xY3BzX2VuEwJlbjAhFhtodHRwczov
+L2NwLmUtc3ppZ25vLmh1L3FjcHMTAmh1MBMGBgQAjkYBBjAJBgcEAI5GAQYDMAoG
+CCqGSM49BAMCA0kAMEYCIQDEeYuKo1y3nwSPY23+vVI/1uxCspzoZTgYuEoD2Fa1
+DQIhAOdyCCGlfNPUNS7q+8JpiFFIPB1DEXUmydXmXBYshBHm
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.subject.rdnSequence,LegalPersonSubjectAttributeAllowanceValidator,ERROR,etsi.en_319_412_3.leg-4.2.1-2.organization_identifier_attribute_absent,
+certificate.tbsCertificate.subjectPublicKeyInfo.algorithm,AllowedPublicKeyTypeValidator,NOTICE,etsi.en_319_412_2.gen-4.2.5-1.discouraged_public_key_type,Prohibited encoding: 301306072a8648ce3d020106082a8648ce3d03010c
+certificate.tbsCertificate.extensions.0.extnValue.keyUsage,LegalPersonKeyUsageValidator,WARNING,etsi.en_319_412_2.nat-4.3.2-1.mixed_key_usage_setting,
+certificate.tbsCertificate.extensions.4.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
+certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies.2,CertificatePolicyQualifierValidator,NOTICE,pkix.certificate_policies_policy_has_qualifier,
diff --git a/tests/integration_certificate/etsi/ncp_legal_person_certificate/crl_critical.crttest b/tests/integration_certificate/etsi/ncp_legal_person_certificate/crl_critical.crttest
new file mode 100644
index 0000000..c407db7
--- /dev/null
+++ b/tests/integration_certificate/etsi/ncp_legal_person_certificate/crl_critical.crttest
@@ -0,0 +1,43 @@
+-----BEGIN CERTIFICATE-----
+MIIF+DCCBOCgAwIBAgIKTITWVCAMG9n4rDANBgkqhkiG9w0BAQsFADBLMQswCQYD
+VQQGEwJOTzEdMBsGA1UECgwUQnV5cGFzcyBBUy05ODMxNjMzMjcxHTAbBgNVBAMM
+FEJ1eXBhc3MgQ2xhc3MgMyBDQSAyMB4XDTI0MDIxNDEwMzQyMFoXDTI1MDIxMzIy
+NTkwMFowgdgxCzAJBgNVBAYTAk5PMQ0wCwYDVQQHDARPU0xPMQ0wCwYDVQQRDAQw
+OTc4MT8wPQYDVQQKDDZNQVNURVJDQVJEIFBBWU1FTlQgU0VSVklDRVMgSU5GUkFT
+VFJVQ1RVUkUgKE5PUldBWSkgQVMxIjAgBgNVBAMMGW10Zi5tY2VuZXR0Lm1hc3Rl
+cmNhcmQubm8xHTAbBgNVBA8MFFByaXZhdGUgT3JnYW5pemF0aW9uMRMwEQYLKwYB
+BAGCNzwCAQMTAk5PMRIwEAYDVQQFEwk5MjI5ODg4NjIwggEiMA0GCSqGSIb3DQEB
+AQUAA4IBDwAwggEKAoIBAQDD5M0Fo+WeZQ4qHT7JO6WDe4/YPZ9ZWIcwnqRTByYI
+smnHXEMVZLp2IBpQfJugnBVHE1W7u6pJITdYNYBCl98DGVY8K0n5kqALhrFHIjkv
+dE99B5Dog781cZpxPU7soQx0SrwDaTqTTXFJSR2z6J3ZLJR7398RDt0PuNDOuTYx
+/RhLXqVNGhIsSgoz0sZ1osIjDOjxQjUbSybvmkKz9cBzo9nh22gLLYk39tDSk3xm
+wBRlZbJEHD05DTmHtrp2QlLFTckMFiim2muA5NYPEjaYiG8nqL7FTEuNVJfv8IN6
+qE+huwiXeVAc1Bco5yj8/zhYwCzsFmAsDQypJjRDrQP1AgMBAAGjggJOMIICSjAM
+BgNVHRMBAf8EAjAAMB8GA1UdIwQYMBaAFCIwLtL79kvKwLg70gTE6XLml5sMMB0G
+A1UdDgQWBBQGk5iQPHNAuQUC7fAcAMMQtl+PZTAOBgNVHQ8BAf8EBAMCBaAwHQYD
+VR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMH0GA1UdIAR2MHQwNAYIYIRCARoB
+AwMwKDAmBggrBgEFBQcCARYaaHR0cHM6Ly93d3cuYnV5cGFzcy5uby9jcHMwMQYF
+Z4EMAQEwKDAmBggrBgEFBQcCARYaaHR0cHM6Ly93d3cuYnV5cGFzcy5uby9jcHMw
+CQYHBACL7EABBDA9BgNVHR8BAf8EMzAxMC+gLaArhilodHRwOi8vY3JsLmJ1eXBh
+c3Mubm8vY3JsL0JQQ2xhc3MzQ0EyLmNybDAkBgNVHREEHTAbghltdGYubWNlbmV0
+dC5tYXN0ZXJjYXJkLm5vMGoGCCsGAQUFBwEBBF4wXDAjBggrBgEFBQcwAYYXaHR0
+cDovL29jc3AuYnV5cGFzcy5jb20wNQYIKwYBBQUHMAKGKWh0dHA6Ly9jcnQuYnV5
+cGFzcy5uby9jcnQvQlBDbGFzczNDQTIuY2VyMGYGCCsGAQUFBwEDBFowWDAIBgYE
+AI5GAQEwEwYGBACORgEGMAkGBwQAjkYBBgMwNwYGBACORgEFMC0wKxYlaHR0cHM6
+Ly93d3cuYnV5cGFzcy5uby9wZHMvcGRzX2VuLnBkZhMCZW4wEwYKKwYBBAHWeQIE
+AwEB/wQCBQAwDQYJKoZIhvcNAQELBQADggEBAKdqLvWe++iFFw2W+EF/s5BIMiNR
+c0uR+1qzuvv3iEpZ5cOvZWCMumBt4gH2WuMC29ubMqOa3YGoC+tPOZIi7USlYOao
+pVugiaUEI0kFZeOVbEhyathVTde3FGMrENgJQRjZonxQ3Sy9AKGOnTm4SYkjuf9a
+/9QU1tldf2yEtT87Cq61MDdzSpoLMv8u7c6HHZ8UA5aHbQWCtFXROk2sYwNWO3Zo
+FgDkdHcoB0atl841ktOT1i0LL9hizOvNLqiq8cP1+ql0qrt6WRedEdaxkhsDRaaG
+10CEgI7GS+QeJV/gnvmnc3KTD7PCXopVFZZwan4EznmLPhLy02J9g6T7g24=
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.extensions.2.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
+certificate.tbsCertificate.extensions.6,CrlDpCriticalityValidator,WARNING,pkix.certificate_crldp_extension_critical,Extension 2.5.29.31 is critical
+certificate.tbsCertificate.extensions.6,CRLDistributionPointsCriticalityValidator,ERROR,etsi.en_319_412_2.gen-4.3.11-5.crl_extension_is_critical,Extension 2.5.29.31 is critical
+certificate.tbsCertificate.extensions.3.extnValue.keyUsage,LegalPersonKeyUsageValidator,WARNING,etsi.en_319_412_2.nat-4.3.2-1.mixed_key_usage_setting,
+certificate.tbsCertificate.subject.rdnSequence,LegalPersonSubjectAttributeAllowanceValidator,ERROR,etsi.en_319_412_3.leg-4.2.1-2.organization_identifier_attribute_absent,
+certificate.tbsCertificate.extensions.5.extnValue.certificatePolicies.1,CertificatePolicyQualifierValidator,NOTICE,pkix.certificate_policies_policy_has_qualifier,
+certificate.tbsCertificate.extensions.5.extnValue.certificatePolicies.0,CertificatePolicyQualifierValidator,NOTICE,pkix.certificate_policies_policy_has_qualifier,
diff --git a/tests/integration_certificate/etsi/ncp_legal_person_certificate/crldp_ldap_uri_scheme.crttest b/tests/integration_certificate/etsi/ncp_legal_person_certificate/crldp_ldap_uri_scheme.crttest
new file mode 100644
index 0000000..0056ff9
--- /dev/null
+++ b/tests/integration_certificate/etsi/ncp_legal_person_certificate/crldp_ldap_uri_scheme.crttest
@@ -0,0 +1,39 @@
+-----BEGIN CERTIFICATE-----
+MIIFfDCCBGSgAwIBAgIKTITWVCAMG9n4rDANBgkqhkiG9w0BAQsFADBLMQswCQYD
+VQQGEwJOTzEdMBsGA1UECgwUQnV5cGFzcyBBUy05ODMxNjMzMjcxHTAbBgNVBAMM
+FEJ1eXBhc3MgQ2xhc3MgMyBDQSAyMB4XDTI0MDIxNDEwMzQyMFoXDTI1MDIxMzIy
+NTkwMFowgbQxCzAJBgNVBAYTAk5PMQ0wCwYDVQQHDARPU0xPMQ0wCwYDVQQRDAQw
+OTc4MT8wPQYDVQQKDDZNQVNURVJDQVJEIFBBWU1FTlQgU0VSVklDRVMgSU5GUkFT
+VFJVQ1RVUkUgKE5PUldBWSkgQVMxHTAbBgNVBA8MFFByaXZhdGUgT3JnYW5pemF0
+aW9uMRMwEQYLKwYBBAGCNzwCAQMTAk5PMRIwEAYDVQQFEwk5MjI5ODg4NjIwggEi
+MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDD5M0Fo+WeZQ4qHT7JO6WDe4/Y
+PZ9ZWIcwnqRTByYIsmnHXEMVZLp2IBpQfJugnBVHE1W7u6pJITdYNYBCl98DGVY8
+K0n5kqALhrFHIjkvdE99B5Dog781cZpxPU7soQx0SrwDaTqTTXFJSR2z6J3ZLJR7
+398RDt0PuNDOuTYx/RhLXqVNGhIsSgoz0sZ1osIjDOjxQjUbSybvmkKz9cBzo9nh
+22gLLYk39tDSk3xmwBRlZbJEHD05DTmHtrp2QlLFTckMFiim2muA5NYPEjaYiG8n
+qL7FTEuNVJfv8IN6qE+huwiXeVAc1Bco5yj8/zhYwCzsFmAsDQypJjRDrQP1AgMB
+AAGjggH2MIIB8jAMBgNVHRMBAf8EAjAAMB8GA1UdIwQYMBaAFCIwLtL79kvKwLg7
+0gTE6XLml5sMMA4GA1UdDwEB/wQEAwIHgDAdBgNVHSUEFjAUBggrBgEFBQcDAQYI
+KwYBBQUHAwIwRwYDVR0gBEAwPjAxBgVngQwBATAoMCYGCCsGAQUFBwIBFhpodHRw
+czovL3d3dy5idXlwYXNzLm5vL2NwczAJBgcEAIvsQAEEMDoGA1UdHwQzMDEwL6At
+oCuGKWxkYXA6Ly9jcmwuYnV5cGFzcy5uby9jcmwvQlBDbGFzczNDQTIuY3JsMCQG
+A1UdEQQdMBuCGW10Zi5tY2VuZXR0Lm1hc3RlcmNhcmQubm8wagYIKwYBBQUHAQEE
+XjBcMCMGCCsGAQUFBzABhhdodHRwOi8vb2NzcC5idXlwYXNzLmNvbTA1BggrBgEF
+BQcwAoYpaHR0cDovL2NydC5idXlwYXNzLm5vL2NydC9CUENsYXNzM0NBMi5jZXIw
+ZgYIKwYBBQUHAQMEWjBYMAgGBgQAjkYBATATBgYEAI5GAQYwCQYHBACORgEGAzA3
+BgYEAI5GAQUwLTArFiVodHRwczovL3d3dy5idXlwYXNzLm5vL3Bkcy9wZHNfZW4u
+cGRmEwJlbjATBgorBgEEAdZ5AgQDAQH/BAIFADANBgkqhkiG9w0BAQsFAAOCAQEA
+p2ou9Z776IUXDZb4QX+zkEgyI1FzS5H7WrO6+/eISlnlw69lYIy6YG3iAfZa4wLb
+25syo5rdgagL6085kiLtRKVg5qilW6CJpQQjSQVl45VsSHJq2FVN17cUYysQ2AlB
+GNmifFDdLL0AoY6dObhJiSO5/1r/1BTW2V1/bIS1PzsKrrUwN3NKmgsy/y7tzocd
+nxQDlodtBYK0VdE6TaxjA1Y7dmgWAOR0dygHRq2XzjWS05PWLQsv2GLM680uqKrx
+w/X6qXSqu3pZF50R1rGSGwNFpobXQISAjsZL5B4lX+Ce+adzcpMPs8JeilUVlnBq
+fgTOeYs+EvLTYn2DpPuDbg==
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.extensions.5.extnValue.cRLDistributionPoints.0.distributionPoint.fullName.0.uniformResourceIdentifier,GeneralNameUriSyntaxValidator,NOTICE,pkix.ldap_uri_not_validated,ldap://crl.buypass.no/crl/BPClass3CA2.crl
+certificate.tbsCertificate.subject.rdnSequence,LegalPersonSubjectAttributeAllowanceValidator,ERROR,etsi.en_319_412_3.leg-4.2.1-2.common_name_attribute_absent,
+certificate.tbsCertificate.subject.rdnSequence,LegalPersonSubjectAttributeAllowanceValidator,ERROR,etsi.en_319_412_3.leg-4.2.1-2.organization_identifier_attribute_absent,
+certificate,SubjectKeyIdentifierPresenceValidator,WARNING,pkix.certificate_skid_end_entity_missing,
+certificate.tbsCertificate.extensions.4.extnValue.certificatePolicies.0,CertificatePolicyQualifierValidator,NOTICE,pkix.certificate_policies_policy_has_qualifier,
diff --git a/tests/integration_certificate/etsi/ncp_legal_person_certificate/crldp_prohibited_uri_scheme.crttest b/tests/integration_certificate/etsi/ncp_legal_person_certificate/crldp_prohibited_uri_scheme.crttest
new file mode 100644
index 0000000..5641dd2
--- /dev/null
+++ b/tests/integration_certificate/etsi/ncp_legal_person_certificate/crldp_prohibited_uri_scheme.crttest
@@ -0,0 +1,39 @@
+-----BEGIN CERTIFICATE-----
+MIIFezCCBGOgAwIBAgIKTITWVCAMG9n4rDANBgkqhkiG9w0BAQsFADBLMQswCQYD
+VQQGEwJOTzEdMBsGA1UECgwUQnV5cGFzcyBBUy05ODMxNjMzMjcxHTAbBgNVBAMM
+FEJ1eXBhc3MgQ2xhc3MgMyBDQSAyMB4XDTI0MDIxNDEwMzQyMFoXDTI1MDIxMzIy
+NTkwMFowgbQxCzAJBgNVBAYTAk5PMQ0wCwYDVQQHDARPU0xPMQ0wCwYDVQQRDAQw
+OTc4MT8wPQYDVQQKDDZNQVNURVJDQVJEIFBBWU1FTlQgU0VSVklDRVMgSU5GUkFT
+VFJVQ1RVUkUgKE5PUldBWSkgQVMxHTAbBgNVBA8MFFByaXZhdGUgT3JnYW5pemF0
+aW9uMRMwEQYLKwYBBAGCNzwCAQMTAk5PMRIwEAYDVQQFEwk5MjI5ODg4NjIwggEi
+MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDD5M0Fo+WeZQ4qHT7JO6WDe4/Y
+PZ9ZWIcwnqRTByYIsmnHXEMVZLp2IBpQfJugnBVHE1W7u6pJITdYNYBCl98DGVY8
+K0n5kqALhrFHIjkvdE99B5Dog781cZpxPU7soQx0SrwDaTqTTXFJSR2z6J3ZLJR7
+398RDt0PuNDOuTYx/RhLXqVNGhIsSgoz0sZ1osIjDOjxQjUbSybvmkKz9cBzo9nh
+22gLLYk39tDSk3xmwBRlZbJEHD05DTmHtrp2QlLFTckMFiim2muA5NYPEjaYiG8n
+qL7FTEuNVJfv8IN6qE+huwiXeVAc1Bco5yj8/zhYwCzsFmAsDQypJjRDrQP1AgMB
+AAGjggH1MIIB8TAMBgNVHRMBAf8EAjAAMB8GA1UdIwQYMBaAFCIwLtL79kvKwLg7
+0gTE6XLml5sMMA4GA1UdDwEB/wQEAwIHgDAdBgNVHSUEFjAUBggrBgEFBQcDAQYI
+KwYBBQUHAwIwRwYDVR0gBEAwPjAxBgVngQwBATAoMCYGCCsGAQUFBwIBFhpodHRw
+czovL3d3dy5idXlwYXNzLm5vL2NwczAJBgcEAIvsQAEEMDkGA1UdHwQyMDAwLqAs
+oCqGKGZ0cDovL2NybC5idXlwYXNzLm5vL2NybC9CUENsYXNzM0NBMi5jcmwwJAYD
+VR0RBB0wG4IZbXRmLm1jZW5ldHQubWFzdGVyY2FyZC5ubzBqBggrBgEFBQcBAQRe
+MFwwIwYIKwYBBQUHMAGGF2h0dHA6Ly9vY3NwLmJ1eXBhc3MuY29tMDUGCCsGAQUF
+BzAChilodHRwOi8vY3J0LmJ1eXBhc3Mubm8vY3J0L0JQQ2xhc3MzQ0EyLmNlcjBm
+BggrBgEFBQcBAwRaMFgwCAYGBACORgEBMBMGBgQAjkYBBjAJBgcEAI5GAQYDMDcG
+BgQAjkYBBTAtMCsWJWh0dHBzOi8vd3d3LmJ1eXBhc3Mubm8vcGRzL3Bkc19lbi5w
+ZGYTAmVuMBMGCisGAQQB1nkCBAMBAf8EAgUAMA0GCSqGSIb3DQEBCwUAA4IBAQCn
+ai71nvvohRcNlvhBf7OQSDIjUXNLkftas7r794hKWeXDr2VgjLpgbeIB9lrjAtvb
+mzKjmt2BqAvrTzmSIu1EpWDmqKVboImlBCNJBWXjlWxIcmrYVU3XtxRjKxDYCUEY
+2aJ8UN0svQChjp05uEmJI7n/Wv/UFNbZXX9shLU/OwqutTA3c0qaCzL/Lu3Ohx2f
+FAOWh20FgrRV0TpNrGMDVjt2aBYA5HR3KAdGrZfONZLTk9YtCy/YYszrzS6oqvHD
+9fqpdKq7elkXnRHWsZIbA0WmhtdAhICOxkvkHiVf4J75p3Nykw+zwl6KVRWWcGp+
+BM55iz4S8tNifYOk+4Nu
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.extensions.5.extnValue.cRLDistributionPoints,CrlDistributionPointsValidator,ERROR,etsi.en_319_412_2.gen-4.3.11-4.http_or_ldap_crldp_distribution_point_uri_missing,
+certificate.tbsCertificate.subject.rdnSequence,LegalPersonSubjectAttributeAllowanceValidator,ERROR,etsi.en_319_412_3.leg-4.2.1-2.common_name_attribute_absent,
+certificate.tbsCertificate.subject.rdnSequence,LegalPersonSubjectAttributeAllowanceValidator,ERROR,etsi.en_319_412_3.leg-4.2.1-2.organization_identifier_attribute_absent,
+certificate,SubjectKeyIdentifierPresenceValidator,WARNING,pkix.certificate_skid_end_entity_missing,
+certificate.tbsCertificate.extensions.4.extnValue.certificatePolicies.0,CertificatePolicyQualifierValidator,NOTICE,pkix.certificate_policies_policy_has_qualifier,
diff --git a/tests/integration_certificate/etsi/ncp_legal_person_certificate/extensions_field_absent.crttest b/tests/integration_certificate/etsi/ncp_legal_person_certificate/extensions_field_absent.crttest
new file mode 100644
index 0000000..988e9b1
--- /dev/null
+++ b/tests/integration_certificate/etsi/ncp_legal_person_certificate/extensions_field_absent.crttest
@@ -0,0 +1,28 @@
+-----BEGIN CERTIFICATE-----
+MIIDwDCCAqigAwIBAgIKTITWVCAMG9n4rDANBgkqhkiG9w0BAQsFADBLMQswCQYD
+VQQGEwJOTzEdMBsGA1UECgwUQnV5cGFzcyBBUy05ODMxNjMzMjcxHTAbBgNVBAMM
+FEJ1eXBhc3MgQ2xhc3MgMyBDQSAyMB4XDTI0MDIxNDEwMzQyMFoXDTI1MDIxMzIy
+NTkwMFowgfIxCzAJBgNVBAYTAk5PMQ0wCwYDVQQHDARPU0xPMQ0wCwYDVQQRDAQw
+OTc4MT8wPQYDVQQKDDZNQVNURVJDQVJEIFBBWU1FTlQgU0VSVklDRVMgSU5GUkFT
+VFJVQ1RVUkUgKE5PUldBWSkgQVMxHTAbBgNVBA8MFFByaXZhdGUgT3JnYW5pemF0
+aW9uMRMwEQYLKwYBBAGCNzwCAQMTAk5PMRIwEAYDVQQFEwk5MjI5ODg4NjIxGDAW
+BgNVBGETD05UUk5PLTkyMjk4ODg2MjEiMCAGA1UEAxMZbXRmLm1jZW5ldHQubWFz
+dGVyY2FyZC5ubzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMPkzQWj
+5Z5lDiodPsk7pYN7j9g9n1lYhzCepFMHJgiyacdcQxVkunYgGlB8m6CcFUcTVbu7
+qkkhN1g1gEKX3wMZVjwrSfmSoAuGsUciOS90T30HkOiDvzVxmnE9TuyhDHRKvANp
+OpNNcUlJHbPondkslHvf3xEO3Q+40M65NjH9GEtepU0aEixKCjPSxnWiwiMM6PFC
+NRtLJu+aQrP1wHOj2eHbaAstiTf20NKTfGbAFGVlskQcPTkNOYe2unZCUsVNyQwW
+KKbaa4Dk1g8SNpiIbyeovsVMS41Ul+/wg3qoT6G7CJd5UBzUFyjnKPz/OFjALOwW
+YCwNDKkmNEOtA/UCAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAp2ou9Z776IUXDZb4
+QX+zkEgyI1FzS5H7WrO6+/eISlnlw69lYIy6YG3iAfZa4wLb25syo5rdgagL6085
+kiLtRKVg5qilW6CJpQQjSQVl45VsSHJq2FVN17cUYysQ2AlBGNmifFDdLL0AoY6d
+ObhJiSO5/1r/1BTW2V1/bIS1PzsKrrUwN3NKmgsy/y7tzocdnxQDlodtBYK0VdE6
+TaxjA1Y7dmgWAOR0dygHRq2XzjWS05PWLQsv2GLM680uqKrxw/X6qXSqu3pZF50R
+1rGSGwNFpobXQISAjsZL5B4lX+Ce+adzcpMPs8JeilUVlnBqfgTOeYs+EvLTYn2D
+pPuDbg==
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate,ExtensionsPresenceValidator,ERROR,etsi.extensions_field_absent,
+certificate,SubjectKeyIdentifierPresenceValidator,WARNING,pkix.certificate_skid_end_entity_missing,
+certificate,AuthorityKeyIdentifierPresenceValidator,ERROR,pkix.authority_key_identifier_extension_absent,
diff --git a/tests/integration_certificate/etsi/qevcp_w_eidas_final_certificate/queulimitexponent_negative_amount.crttest b/tests/integration_certificate/etsi/qevcp_w_eidas_final_certificate/queulimitexponent_negative_amount.crttest
new file mode 100644
index 0000000..ac92a18
--- /dev/null
+++ b/tests/integration_certificate/etsi/qevcp_w_eidas_final_certificate/queulimitexponent_negative_amount.crttest
@@ -0,0 +1,72 @@
+-----BEGIN CERTIFICATE-----
+MIIKhjCCCW6gAwIBAgIOXql/HQDkwqSXXIdbtsQwDQYJKoZIhvcNAQELBQAwYTEL
+MAkGA1UEBhMCSFUxETAPBgNVBAcMCEJ1ZGFwZXN0MRUwEwYDVQQKDAxORVRMT0NL
+IEx0ZC4xKDAmBgNVBAMMH05FVExPQ0sgVHJ1c3QgUXVhbGlmaWVkIEVWIENBIDMw
+HhcNMjQwMTAzMDgyMjQxWhcNMjUwMTAyMDgyMjQxWjCBzzELMAkGA1UEBhMCSFUx
+ETAPBgNVBAcMCEJ1ZGFwZXN0MSAwHgYDVQQKDBdFUlNURSBCQU5LIEhVTkdBUlkg
+WnJ0LjEbMBkGA1UEAwwSc3RvcmUuZXJzdGViYW5rLmh1MRwwGgYDVQQFExNWQVRI
+VS0xMDE5Nzg3OS00LTQ0MRwwGgYDVQRhDBNWQVRIVS0xMDE5Nzg3OS00LTQ0MR0w
+GwYDVQQPDBRQcml2YXRlIE9yZ2FuaXphdGlvbjETMBEGCysGAQQBgjc8AgEDEwJI
+VTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAJTQGZJ7f2BOVSOPsPn2
+j0MahcZsdwrVepsAzQzZkxRghan7/BMHmuDwuqHHD0SfHbVCgNr/QQVmqt8jbg8P
+pGIP4cNcH3rdnN5whE10zT30q6vTHDUXSDcNs7weBK47CI2Zh+my44ycQJOcqGub
+PzrMmDHbF27lyiEX/ucYjmHW0RCtGrVRwx71fCWMmDwWziuzoQhy3ufO25DkNQU7
+PAigYs+3XBv6ggbzG2FimqEvPEwoQikfJ3HDXXBuP0UxFMeTbXIWvUoZAtJWw4uq
+08YDLX1WklXW2PkxvAV7GgS80x0yQMjk2iEDEJO64rBNCdebDmK+JNMpDYClAX7O
+fQ6ZEapT4yIIqZny3D5aKVUnqtMcKOnJmlY1zvAHDylICL4rIcf8McQZ5mcQsW1V
+E+Bl4OrRlKMZBcAcU71zK55e9qTVP2YoW1atAM6/4F8jQHy+ZAGleSZCkvwH33br
+IND6F05el0eQYHYT1uW6QuAm8/NqvW3QpdwcJiqd8JMeH1WMny2ZJqb/RO/AsTIp
+2YXNWCQ1BGbON+Mi0WKX9dkZaa0u0fvPficH212W+6EKAMmsTelFe+yGV2M1luSd
+HH2yzjIWOMKvHELTUgMszXEl/8n5GSrxjU5z+OslhxnJAZFUqIHufzcqrq2B8noA
+hhBVpvkq5K06/FSZ/iE64Js5AgMBAAGjggXLMIIFxzAMBgNVHRMBAf8EAjAAMA4G
+A1UdDwEB/wQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwHwYD
+VR0jBBgwFoAUsNyVrpgIyI8XNuCLvORJs49LOlcwggFcBggrBgEFBQcBAQSCAU4w
+ggFKMDEGCCsGAQUFBzABhiVodHRwOi8vb2NzcDEubmV0bG9jay5odS9xdHJ1c3Rl
+djMuY2dpMDEGCCsGAQUFBzABhiVodHRwOi8vb2NzcDIubmV0bG9jay5odS9xdHJ1
+c3RldjMuY2dpMDEGCCsGAQUFBzABhiVodHRwOi8vb2NzcDMubmV0bG9jay5odS9x
+dHJ1c3RldjMuY2dpMDkGCCsGAQUFBzAChi1odHRwOi8vYWlhMS5uZXRsb2NrLmh1
+L2luZGV4LmNnaT9jYT1xdHJ1c3RldjMwOQYIKwYBBQUHMAKGLWh0dHA6Ly9haWEy
+Lm5ldGxvY2suaHUvaW5kZXguY2dpP2NhPXF0cnVzdGV2MzA5BggrBgEFBQcwAoYt
+aHR0cDovL2FpYTMubmV0bG9jay5odS9pbmRleC5jZ2k/Y2E9cXRydXN0ZXYzMIHG
+BgNVHSAEgb4wgbswBwYFZ4EMAQEwga8GBwQAi+xAAQQwgaMwJwYIKwYBBQUHAgEW
+G2h0dHA6Ly93d3cubmV0bG9jay5odS9kb2NzLzB4BggrBgEFBQcCAjBsDGpRdWFs
+aWZpZWQgRVYgY2VydGlmaWNhdGUgZm9yIHdlYnNpdGUgYXV0aGVudGljYXRpb24u
+IE1pbsWRc8OtdGV0dCBFViB3ZWJvbGRhbC1oaXRlbGVzw610xZEgdGFuw7pzw610
+dsOhbnkuMIGtBgNVHR8EgaUwgaIwNKAyoDCGLmh0dHA6Ly9jcmwxLm5ldGxvY2su
+aHUvaW5kZXguY2dpP2NybD1xdHJ1c3RldjMwNKAyoDCGLmh0dHA6Ly9jcmwyLm5l
+dGxvY2suaHUvaW5kZXguY2dpP2NybD1xdHJ1c3RldjMwNKAyoDCGLmh0dHA6Ly9j
+cmwzLm5ldGxvY2suaHUvaW5kZXguY2dpP2NybD1xdHJ1c3RldjMwHQYDVR0OBBYE
+FNf0w0W8aplbXGBhB+1MewJUIItbMIGnBggrBgEFBQcBAwSBmjCBlzAIBgYEAI5G
+AQEwFQYGBACORgECMAsTA0hVRgIBBQIB+jALBgYEAI5GAQMCAQowUgYGBACORgEF
+MEgwIhYcaHR0cHM6Ly93d3cubmV0bG9jay5odS9kb2NzLxMCZW4wIhYcaHR0cHM6
+Ly93d3cubmV0bG9jay5odS9kb2NzLxMCaHUwEwYGBACORgEGMAkGBwQAjkYBBgMw
+HQYDVR0RBBYwFIISc3RvcmUuZXJzdGViYW5rLmh1MIIBfwYKKwYBBAHWeQIEAgSC
+AW8EggFrAWkAdwBOdaMnXJoQwzhbbNTfP1LrHfDgjhuNacCx+mSxYpo53wAAAYzO
+avIzAAAEAwBIMEYCIQDOlyYiOWIexELziU66FIBIJZUMWVsZRDeCl3arw8cxMAIh
+AOYiDDT67K9Cn+L4EcZS8DHFLS7t3m77GWqeqdukLe2EAHYAzPsPaoVxCWX+lZtT
+zumyfCLphVwNl422qX5UwP5MDbAAAAGMzmrz+wAABAMARzBFAiEA/xzNaxjrBIZc
+DCEd/9hakULOMrl/fr3HwWYPLop95TcCIG6j1v1J1FqycRqm/S3PpNMUizcAi2m4
+3d5SYQkceVgEAHYAzxFW7tUufK/zh1vZaS6b6RpxZ0qwF+ysAdJbd87MOwgAAAGM
+zmr47wAABAMARzBFAiAhhS9tNTV6YewKfteM78lWql2xfJhfn/HPVJ4jxHR2fgIh
+APLEynQyBvnusRKddiZ7t5Z+6iizd2JYPYDrFZNZATewMCMGBWeBDAMBBBowGBMD
+VkFUEwJIVQwNMTAxOTc4NzktNC00NDANBgkqhkiG9w0BAQsFAAOCAQEAdLSu3tqF
+mawjSVMFYwA//ofL81LtT9GAhzCEO5Wjb9vYcs0Yad4TiOdXp4nnrVehYQQbz4nK
+C7/ihdNU40ykCqkTWLtYtXiGi6yh0Qs7nuPyrIvLur65/opa2GmBVDKsJ6E1TaBX
+N6DfOYpfOoYXhcuFKlzYfkHZHnPx5zhoqlc4AsVC7zVORu52uefA+8urwKbQ/IRG
+kXVHXGBemdVpOPU0cXEPwStOd0tnbZa4RIhTXoTqkACLIHMf81WopZWpshsI2/BU
++avMAHT/JsaRM2EMicqXCIc8f4W2/TLFGvKHOl+dXY69/tZ9HEaUzM5wD6VfCg61
+dKy6vvjOw5aXWg==
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.subject.rdnSequence,EvSubscriberAttributeAllowanceValidator,WARNING,cabf.ev_guidelines.common_name_attribute_present,
+certificate.tbsCertificate.extensions.1.extnValue.keyUsage,SubscriberKeyUsageValidator,WARNING,cabf.serverauth.subscriber_rsa_digitalsignature_and_keyencipherment_present,
+certificate.tbsCertificate.extensions.5.extnValue.certificatePolicies.1.policyQualifiers.0,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
+certificate.tbsCertificate.extensions.5.extnValue.certificatePolicies.1.policyQualifiers.1,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
+certificate.tbsCertificate.extensions.5.extnValue.certificatePolicies.1.policyQualifiers.1,CertificatePolicyQualifierValidator,ERROR,cabf.serverauth.prohibited_certificate_policy_qualifier_type,Prohibited qualifier type: 1.3.6.1.5.5.7.2.2
+certificate.tbsCertificate.extensions.6.extnValue.cRLDistributionPoints,CrlDpDistributionPointCountValidator,WARNING,cabf.serverauth.crldp_multiple_distributionpoints_present,
+certificate.tbsCertificate.extensions.7.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
+certificate.tbsCertificate.extensions.8.extnValue.qCStatements.1.statementInfo.qcEuLimitValue,QcEuLimitValueValidator,ERROR,etsi.en_319_412_5.gen-4.3.2.exponent_negative,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.subject_key_identifier_extension_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 1.3.6.1.5.5.7.1.3
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 2.23.140.3.1
diff --git a/tests/integration_certificate/etsi/qevcp_w_eidas_final_certificate/queulimitvalue.crttest b/tests/integration_certificate/etsi/qevcp_w_eidas_final_certificate/queulimitvalue.crttest
new file mode 100644
index 0000000..e59aee2
--- /dev/null
+++ b/tests/integration_certificate/etsi/qevcp_w_eidas_final_certificate/queulimitvalue.crttest
@@ -0,0 +1,71 @@
+-----BEGIN CERTIFICATE-----
+MIIKhjCCCW6gAwIBAgIOXql/HQDkwqSXXIdbtsQwDQYJKoZIhvcNAQELBQAwYTEL
+MAkGA1UEBhMCSFUxETAPBgNVBAcMCEJ1ZGFwZXN0MRUwEwYDVQQKDAxORVRMT0NL
+IEx0ZC4xKDAmBgNVBAMMH05FVExPQ0sgVHJ1c3QgUXVhbGlmaWVkIEVWIENBIDMw
+HhcNMjQwMTAzMDgyMjQxWhcNMjUwMTAyMDgyMjQxWjCBzzELMAkGA1UEBhMCSFUx
+ETAPBgNVBAcMCEJ1ZGFwZXN0MSAwHgYDVQQKDBdFUlNURSBCQU5LIEhVTkdBUlkg
+WnJ0LjEbMBkGA1UEAwwSc3RvcmUuZXJzdGViYW5rLmh1MRwwGgYDVQQFExNWQVRI
+VS0xMDE5Nzg3OS00LTQ0MRwwGgYDVQRhDBNWQVRIVS0xMDE5Nzg3OS00LTQ0MR0w
+GwYDVQQPDBRQcml2YXRlIE9yZ2FuaXphdGlvbjETMBEGCysGAQQBgjc8AgEDEwJI
+VTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAJTQGZJ7f2BOVSOPsPn2
+j0MahcZsdwrVepsAzQzZkxRghan7/BMHmuDwuqHHD0SfHbVCgNr/QQVmqt8jbg8P
+pGIP4cNcH3rdnN5whE10zT30q6vTHDUXSDcNs7weBK47CI2Zh+my44ycQJOcqGub
+PzrMmDHbF27lyiEX/ucYjmHW0RCtGrVRwx71fCWMmDwWziuzoQhy3ufO25DkNQU7
+PAigYs+3XBv6ggbzG2FimqEvPEwoQikfJ3HDXXBuP0UxFMeTbXIWvUoZAtJWw4uq
+08YDLX1WklXW2PkxvAV7GgS80x0yQMjk2iEDEJO64rBNCdebDmK+JNMpDYClAX7O
+fQ6ZEapT4yIIqZny3D5aKVUnqtMcKOnJmlY1zvAHDylICL4rIcf8McQZ5mcQsW1V
+E+Bl4OrRlKMZBcAcU71zK55e9qTVP2YoW1atAM6/4F8jQHy+ZAGleSZCkvwH33br
+IND6F05el0eQYHYT1uW6QuAm8/NqvW3QpdwcJiqd8JMeH1WMny2ZJqb/RO/AsTIp
+2YXNWCQ1BGbON+Mi0WKX9dkZaa0u0fvPficH212W+6EKAMmsTelFe+yGV2M1luSd
+HH2yzjIWOMKvHELTUgMszXEl/8n5GSrxjU5z+OslhxnJAZFUqIHufzcqrq2B8noA
+hhBVpvkq5K06/FSZ/iE64Js5AgMBAAGjggXLMIIFxzAMBgNVHRMBAf8EAjAAMA4G
+A1UdDwEB/wQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwHwYD
+VR0jBBgwFoAUsNyVrpgIyI8XNuCLvORJs49LOlcwggFcBggrBgEFBQcBAQSCAU4w
+ggFKMDEGCCsGAQUFBzABhiVodHRwOi8vb2NzcDEubmV0bG9jay5odS9xdHJ1c3Rl
+djMuY2dpMDEGCCsGAQUFBzABhiVodHRwOi8vb2NzcDIubmV0bG9jay5odS9xdHJ1
+c3RldjMuY2dpMDEGCCsGAQUFBzABhiVodHRwOi8vb2NzcDMubmV0bG9jay5odS9x
+dHJ1c3RldjMuY2dpMDkGCCsGAQUFBzAChi1odHRwOi8vYWlhMS5uZXRsb2NrLmh1
+L2luZGV4LmNnaT9jYT1xdHJ1c3RldjMwOQYIKwYBBQUHMAKGLWh0dHA6Ly9haWEy
+Lm5ldGxvY2suaHUvaW5kZXguY2dpP2NhPXF0cnVzdGV2MzA5BggrBgEFBQcwAoYt
+aHR0cDovL2FpYTMubmV0bG9jay5odS9pbmRleC5jZ2k/Y2E9cXRydXN0ZXYzMIHG
+BgNVHSAEgb4wgbswBwYFZ4EMAQEwga8GBwQAi+xAAQQwgaMwJwYIKwYBBQUHAgEW
+G2h0dHA6Ly93d3cubmV0bG9jay5odS9kb2NzLzB4BggrBgEFBQcCAjBsDGpRdWFs
+aWZpZWQgRVYgY2VydGlmaWNhdGUgZm9yIHdlYnNpdGUgYXV0aGVudGljYXRpb24u
+IE1pbsWRc8OtdGV0dCBFViB3ZWJvbGRhbC1oaXRlbGVzw610xZEgdGFuw7pzw610
+dsOhbnkuMIGtBgNVHR8EgaUwgaIwNKAyoDCGLmh0dHA6Ly9jcmwxLm5ldGxvY2su
+aHUvaW5kZXguY2dpP2NybD1xdHJ1c3RldjMwNKAyoDCGLmh0dHA6Ly9jcmwyLm5l
+dGxvY2suaHUvaW5kZXguY2dpP2NybD1xdHJ1c3RldjMwNKAyoDCGLmh0dHA6Ly9j
+cmwzLm5ldGxvY2suaHUvaW5kZXguY2dpP2NybD1xdHJ1c3RldjMwHQYDVR0OBBYE
+FNf0w0W8aplbXGBhB+1MewJUIItbMIGnBggrBgEFBQcBAwSBmjCBlzAIBgYEAI5G
+AQEwFQYGBACORgECMAsTA0hVRgIBBQIBBjALBgYEAI5GAQMCAQowUgYGBACORgEF
+MEgwIhYcaHR0cHM6Ly93d3cubmV0bG9jay5odS9kb2NzLxMCZW4wIhYcaHR0cHM6
+Ly93d3cubmV0bG9jay5odS9kb2NzLxMCaHUwEwYGBACORgEGMAkGBwQAjkYBBgMw
+HQYDVR0RBBYwFIISc3RvcmUuZXJzdGViYW5rLmh1MIIBfwYKKwYBBAHWeQIEAgSC
+AW8EggFrAWkAdwBOdaMnXJoQwzhbbNTfP1LrHfDgjhuNacCx+mSxYpo53wAAAYzO
+avIzAAAEAwBIMEYCIQDOlyYiOWIexELziU66FIBIJZUMWVsZRDeCl3arw8cxMAIh
+AOYiDDT67K9Cn+L4EcZS8DHFLS7t3m77GWqeqdukLe2EAHYAzPsPaoVxCWX+lZtT
+zumyfCLphVwNl422qX5UwP5MDbAAAAGMzmrz+wAABAMARzBFAiEA/xzNaxjrBIZc
+DCEd/9hakULOMrl/fr3HwWYPLop95TcCIG6j1v1J1FqycRqm/S3PpNMUizcAi2m4
+3d5SYQkceVgEAHYAzxFW7tUufK/zh1vZaS6b6RpxZ0qwF+ysAdJbd87MOwgAAAGM
+zmr47wAABAMARzBFAiAhhS9tNTV6YewKfteM78lWql2xfJhfn/HPVJ4jxHR2fgIh
+APLEynQyBvnusRKddiZ7t5Z+6iizd2JYPYDrFZNZATewMCMGBWeBDAMBBBowGBMD
+VkFUEwJIVQwNMTAxOTc4NzktNC00NDANBgkqhkiG9w0BAQsFAAOCAQEAdLSu3tqF
+mawjSVMFYwA//ofL81LtT9GAhzCEO5Wjb9vYcs0Yad4TiOdXp4nnrVehYQQbz4nK
+C7/ihdNU40ykCqkTWLtYtXiGi6yh0Qs7nuPyrIvLur65/opa2GmBVDKsJ6E1TaBX
+N6DfOYpfOoYXhcuFKlzYfkHZHnPx5zhoqlc4AsVC7zVORu52uefA+8urwKbQ/IRG
+kXVHXGBemdVpOPU0cXEPwStOd0tnbZa4RIhTXoTqkACLIHMf81WopZWpshsI2/BU
++avMAHT/JsaRM2EMicqXCIc8f4W2/TLFGvKHOl+dXY69/tZ9HEaUzM5wD6VfCg61
+dKy6vvjOw5aXWg==
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.subject.rdnSequence,EvSubscriberAttributeAllowanceValidator,WARNING,cabf.ev_guidelines.common_name_attribute_present,
+certificate.tbsCertificate.extensions.1.extnValue.keyUsage,SubscriberKeyUsageValidator,WARNING,cabf.serverauth.subscriber_rsa_digitalsignature_and_keyencipherment_present,
+certificate.tbsCertificate.extensions.5.extnValue.certificatePolicies.1.policyQualifiers.0,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
+certificate.tbsCertificate.extensions.5.extnValue.certificatePolicies.1.policyQualifiers.1,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
+certificate.tbsCertificate.extensions.5.extnValue.certificatePolicies.1.policyQualifiers.1,CertificatePolicyQualifierValidator,ERROR,cabf.serverauth.prohibited_certificate_policy_qualifier_type,Prohibited qualifier type: 1.3.6.1.5.5.7.2.2
+certificate.tbsCertificate.extensions.6.extnValue.cRLDistributionPoints,CrlDpDistributionPointCountValidator,WARNING,cabf.serverauth.crldp_multiple_distributionpoints_present,
+certificate.tbsCertificate.extensions.7.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.subject_key_identifier_extension_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 1.3.6.1.5.5.7.1.3
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 2.23.140.3.1
diff --git a/tests/integration_certificate/etsi/qevcp_w_eidas_final_certificate/queulimitvalue_invalid_currency.crttest b/tests/integration_certificate/etsi/qevcp_w_eidas_final_certificate/queulimitvalue_invalid_currency.crttest
new file mode 100644
index 0000000..ee07043
--- /dev/null
+++ b/tests/integration_certificate/etsi/qevcp_w_eidas_final_certificate/queulimitvalue_invalid_currency.crttest
@@ -0,0 +1,72 @@
+-----BEGIN CERTIFICATE-----
+MIIKhjCCCW6gAwIBAgIOXql/HQDkwqSXXIdbtsQwDQYJKoZIhvcNAQELBQAwYTEL
+MAkGA1UEBhMCSFUxETAPBgNVBAcMCEJ1ZGFwZXN0MRUwEwYDVQQKDAxORVRMT0NL
+IEx0ZC4xKDAmBgNVBAMMH05FVExPQ0sgVHJ1c3QgUXVhbGlmaWVkIEVWIENBIDMw
+HhcNMjQwMTAzMDgyMjQxWhcNMjUwMTAyMDgyMjQxWjCBzzELMAkGA1UEBhMCSFUx
+ETAPBgNVBAcMCEJ1ZGFwZXN0MSAwHgYDVQQKDBdFUlNURSBCQU5LIEhVTkdBUlkg
+WnJ0LjEbMBkGA1UEAwwSc3RvcmUuZXJzdGViYW5rLmh1MRwwGgYDVQQFExNWQVRI
+VS0xMDE5Nzg3OS00LTQ0MRwwGgYDVQRhDBNWQVRIVS0xMDE5Nzg3OS00LTQ0MR0w
+GwYDVQQPDBRQcml2YXRlIE9yZ2FuaXphdGlvbjETMBEGCysGAQQBgjc8AgEDEwJI
+VTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAJTQGZJ7f2BOVSOPsPn2
+j0MahcZsdwrVepsAzQzZkxRghan7/BMHmuDwuqHHD0SfHbVCgNr/QQVmqt8jbg8P
+pGIP4cNcH3rdnN5whE10zT30q6vTHDUXSDcNs7weBK47CI2Zh+my44ycQJOcqGub
+PzrMmDHbF27lyiEX/ucYjmHW0RCtGrVRwx71fCWMmDwWziuzoQhy3ufO25DkNQU7
+PAigYs+3XBv6ggbzG2FimqEvPEwoQikfJ3HDXXBuP0UxFMeTbXIWvUoZAtJWw4uq
+08YDLX1WklXW2PkxvAV7GgS80x0yQMjk2iEDEJO64rBNCdebDmK+JNMpDYClAX7O
+fQ6ZEapT4yIIqZny3D5aKVUnqtMcKOnJmlY1zvAHDylICL4rIcf8McQZ5mcQsW1V
+E+Bl4OrRlKMZBcAcU71zK55e9qTVP2YoW1atAM6/4F8jQHy+ZAGleSZCkvwH33br
+IND6F05el0eQYHYT1uW6QuAm8/NqvW3QpdwcJiqd8JMeH1WMny2ZJqb/RO/AsTIp
+2YXNWCQ1BGbON+Mi0WKX9dkZaa0u0fvPficH212W+6EKAMmsTelFe+yGV2M1luSd
+HH2yzjIWOMKvHELTUgMszXEl/8n5GSrxjU5z+OslhxnJAZFUqIHufzcqrq2B8noA
+hhBVpvkq5K06/FSZ/iE64Js5AgMBAAGjggXLMIIFxzAMBgNVHRMBAf8EAjAAMA4G
+A1UdDwEB/wQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwHwYD
+VR0jBBgwFoAUsNyVrpgIyI8XNuCLvORJs49LOlcwggFcBggrBgEFBQcBAQSCAU4w
+ggFKMDEGCCsGAQUFBzABhiVodHRwOi8vb2NzcDEubmV0bG9jay5odS9xdHJ1c3Rl
+djMuY2dpMDEGCCsGAQUFBzABhiVodHRwOi8vb2NzcDIubmV0bG9jay5odS9xdHJ1
+c3RldjMuY2dpMDEGCCsGAQUFBzABhiVodHRwOi8vb2NzcDMubmV0bG9jay5odS9x
+dHJ1c3RldjMuY2dpMDkGCCsGAQUFBzAChi1odHRwOi8vYWlhMS5uZXRsb2NrLmh1
+L2luZGV4LmNnaT9jYT1xdHJ1c3RldjMwOQYIKwYBBQUHMAKGLWh0dHA6Ly9haWEy
+Lm5ldGxvY2suaHUvaW5kZXguY2dpP2NhPXF0cnVzdGV2MzA5BggrBgEFBQcwAoYt
+aHR0cDovL2FpYTMubmV0bG9jay5odS9pbmRleC5jZ2k/Y2E9cXRydXN0ZXYzMIHG
+BgNVHSAEgb4wgbswBwYFZ4EMAQEwga8GBwQAi+xAAQQwgaMwJwYIKwYBBQUHAgEW
+G2h0dHA6Ly93d3cubmV0bG9jay5odS9kb2NzLzB4BggrBgEFBQcCAjBsDGpRdWFs
+aWZpZWQgRVYgY2VydGlmaWNhdGUgZm9yIHdlYnNpdGUgYXV0aGVudGljYXRpb24u
+IE1pbsWRc8OtdGV0dCBFViB3ZWJvbGRhbC1oaXRlbGVzw610xZEgdGFuw7pzw610
+dsOhbnkuMIGtBgNVHR8EgaUwgaIwNKAyoDCGLmh0dHA6Ly9jcmwxLm5ldGxvY2su
+aHUvaW5kZXguY2dpP2NybD1xdHJ1c3RldjMwNKAyoDCGLmh0dHA6Ly9jcmwyLm5l
+dGxvY2suaHUvaW5kZXguY2dpP2NybD1xdHJ1c3RldjMwNKAyoDCGLmh0dHA6Ly9j
+cmwzLm5ldGxvY2suaHUvaW5kZXguY2dpP2NybD1xdHJ1c3RldjMwHQYDVR0OBBYE
+FNf0w0W8aplbXGBhB+1MewJUIItbMIGnBggrBgEFBQcBAwSBmjCBlzAIBgYEAI5G
+AQEwFQYGBACORgECMAsTA1hYWAIBBQIBBjALBgYEAI5GAQMCAQowUgYGBACORgEF
+MEgwIhYcaHR0cHM6Ly93d3cubmV0bG9jay5odS9kb2NzLxMCZW4wIhYcaHR0cHM6
+Ly93d3cubmV0bG9jay5odS9kb2NzLxMCaHUwEwYGBACORgEGMAkGBwQAjkYBBgMw
+HQYDVR0RBBYwFIISc3RvcmUuZXJzdGViYW5rLmh1MIIBfwYKKwYBBAHWeQIEAgSC
+AW8EggFrAWkAdwBOdaMnXJoQwzhbbNTfP1LrHfDgjhuNacCx+mSxYpo53wAAAYzO
+avIzAAAEAwBIMEYCIQDOlyYiOWIexELziU66FIBIJZUMWVsZRDeCl3arw8cxMAIh
+AOYiDDT67K9Cn+L4EcZS8DHFLS7t3m77GWqeqdukLe2EAHYAzPsPaoVxCWX+lZtT
+zumyfCLphVwNl422qX5UwP5MDbAAAAGMzmrz+wAABAMARzBFAiEA/xzNaxjrBIZc
+DCEd/9hakULOMrl/fr3HwWYPLop95TcCIG6j1v1J1FqycRqm/S3PpNMUizcAi2m4
+3d5SYQkceVgEAHYAzxFW7tUufK/zh1vZaS6b6RpxZ0qwF+ysAdJbd87MOwgAAAGM
+zmr47wAABAMARzBFAiAhhS9tNTV6YewKfteM78lWql2xfJhfn/HPVJ4jxHR2fgIh
+APLEynQyBvnusRKddiZ7t5Z+6iizd2JYPYDrFZNZATewMCMGBWeBDAMBBBowGBMD
+VkFUEwJIVQwNMTAxOTc4NzktNC00NDANBgkqhkiG9w0BAQsFAAOCAQEAdLSu3tqF
+mawjSVMFYwA//ofL81LtT9GAhzCEO5Wjb9vYcs0Yad4TiOdXp4nnrVehYQQbz4nK
+C7/ihdNU40ykCqkTWLtYtXiGi6yh0Qs7nuPyrIvLur65/opa2GmBVDKsJ6E1TaBX
+N6DfOYpfOoYXhcuFKlzYfkHZHnPx5zhoqlc4AsVC7zVORu52uefA+8urwKbQ/IRG
+kXVHXGBemdVpOPU0cXEPwStOd0tnbZa4RIhTXoTqkACLIHMf81WopZWpshsI2/BU
++avMAHT/JsaRM2EMicqXCIc8f4W2/TLFGvKHOl+dXY69/tZ9HEaUzM5wD6VfCg61
+dKy6vvjOw5aXWg==
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.subject.rdnSequence,EvSubscriberAttributeAllowanceValidator,WARNING,cabf.ev_guidelines.common_name_attribute_present,
+certificate.tbsCertificate.extensions.1.extnValue.keyUsage,SubscriberKeyUsageValidator,WARNING,cabf.serverauth.subscriber_rsa_digitalsignature_and_keyencipherment_present,
+certificate.tbsCertificate.extensions.5.extnValue.certificatePolicies.1.policyQualifiers.0,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
+certificate.tbsCertificate.extensions.5.extnValue.certificatePolicies.1.policyQualifiers.1,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
+certificate.tbsCertificate.extensions.5.extnValue.certificatePolicies.1.policyQualifiers.1,CertificatePolicyQualifierValidator,ERROR,cabf.serverauth.prohibited_certificate_policy_qualifier_type,Prohibited qualifier type: 1.3.6.1.5.5.7.2.2
+certificate.tbsCertificate.extensions.6.extnValue.cRLDistributionPoints,CrlDpDistributionPointCountValidator,WARNING,cabf.serverauth.crldp_multiple_distributionpoints_present,
+certificate.tbsCertificate.extensions.7.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
+certificate.tbsCertificate.extensions.8.extnValue.qCStatements.1.statementInfo.qcEuLimitValue,QcEuLimitValueValidator,ERROR,etsi.en_319_412_5.gen-4.3.2.currency_code_invalid,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.subject_key_identifier_extension_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 1.3.6.1.5.5.7.1.3
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 2.23.140.3.1
diff --git a/tests/integration_certificate/etsi/qevcp_w_eidas_final_certificate/queulimitvalue_negative_amount.crttest b/tests/integration_certificate/etsi/qevcp_w_eidas_final_certificate/queulimitvalue_negative_amount.crttest
new file mode 100644
index 0000000..3e62a70
--- /dev/null
+++ b/tests/integration_certificate/etsi/qevcp_w_eidas_final_certificate/queulimitvalue_negative_amount.crttest
@@ -0,0 +1,72 @@
+-----BEGIN CERTIFICATE-----
+MIIKhjCCCW6gAwIBAgIOXql/HQDkwqSXXIdbtsQwDQYJKoZIhvcNAQELBQAwYTEL
+MAkGA1UEBhMCSFUxETAPBgNVBAcMCEJ1ZGFwZXN0MRUwEwYDVQQKDAxORVRMT0NL
+IEx0ZC4xKDAmBgNVBAMMH05FVExPQ0sgVHJ1c3QgUXVhbGlmaWVkIEVWIENBIDMw
+HhcNMjQwMTAzMDgyMjQxWhcNMjUwMTAyMDgyMjQxWjCBzzELMAkGA1UEBhMCSFUx
+ETAPBgNVBAcMCEJ1ZGFwZXN0MSAwHgYDVQQKDBdFUlNURSBCQU5LIEhVTkdBUlkg
+WnJ0LjEbMBkGA1UEAwwSc3RvcmUuZXJzdGViYW5rLmh1MRwwGgYDVQQFExNWQVRI
+VS0xMDE5Nzg3OS00LTQ0MRwwGgYDVQRhDBNWQVRIVS0xMDE5Nzg3OS00LTQ0MR0w
+GwYDVQQPDBRQcml2YXRlIE9yZ2FuaXphdGlvbjETMBEGCysGAQQBgjc8AgEDEwJI
+VTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAJTQGZJ7f2BOVSOPsPn2
+j0MahcZsdwrVepsAzQzZkxRghan7/BMHmuDwuqHHD0SfHbVCgNr/QQVmqt8jbg8P
+pGIP4cNcH3rdnN5whE10zT30q6vTHDUXSDcNs7weBK47CI2Zh+my44ycQJOcqGub
+PzrMmDHbF27lyiEX/ucYjmHW0RCtGrVRwx71fCWMmDwWziuzoQhy3ufO25DkNQU7
+PAigYs+3XBv6ggbzG2FimqEvPEwoQikfJ3HDXXBuP0UxFMeTbXIWvUoZAtJWw4uq
+08YDLX1WklXW2PkxvAV7GgS80x0yQMjk2iEDEJO64rBNCdebDmK+JNMpDYClAX7O
+fQ6ZEapT4yIIqZny3D5aKVUnqtMcKOnJmlY1zvAHDylICL4rIcf8McQZ5mcQsW1V
+E+Bl4OrRlKMZBcAcU71zK55e9qTVP2YoW1atAM6/4F8jQHy+ZAGleSZCkvwH33br
+IND6F05el0eQYHYT1uW6QuAm8/NqvW3QpdwcJiqd8JMeH1WMny2ZJqb/RO/AsTIp
+2YXNWCQ1BGbON+Mi0WKX9dkZaa0u0fvPficH212W+6EKAMmsTelFe+yGV2M1luSd
+HH2yzjIWOMKvHELTUgMszXEl/8n5GSrxjU5z+OslhxnJAZFUqIHufzcqrq2B8noA
+hhBVpvkq5K06/FSZ/iE64Js5AgMBAAGjggXLMIIFxzAMBgNVHRMBAf8EAjAAMA4G
+A1UdDwEB/wQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwHwYD
+VR0jBBgwFoAUsNyVrpgIyI8XNuCLvORJs49LOlcwggFcBggrBgEFBQcBAQSCAU4w
+ggFKMDEGCCsGAQUFBzABhiVodHRwOi8vb2NzcDEubmV0bG9jay5odS9xdHJ1c3Rl
+djMuY2dpMDEGCCsGAQUFBzABhiVodHRwOi8vb2NzcDIubmV0bG9jay5odS9xdHJ1
+c3RldjMuY2dpMDEGCCsGAQUFBzABhiVodHRwOi8vb2NzcDMubmV0bG9jay5odS9x
+dHJ1c3RldjMuY2dpMDkGCCsGAQUFBzAChi1odHRwOi8vYWlhMS5uZXRsb2NrLmh1
+L2luZGV4LmNnaT9jYT1xdHJ1c3RldjMwOQYIKwYBBQUHMAKGLWh0dHA6Ly9haWEy
+Lm5ldGxvY2suaHUvaW5kZXguY2dpP2NhPXF0cnVzdGV2MzA5BggrBgEFBQcwAoYt
+aHR0cDovL2FpYTMubmV0bG9jay5odS9pbmRleC5jZ2k/Y2E9cXRydXN0ZXYzMIHG
+BgNVHSAEgb4wgbswBwYFZ4EMAQEwga8GBwQAi+xAAQQwgaMwJwYIKwYBBQUHAgEW
+G2h0dHA6Ly93d3cubmV0bG9jay5odS9kb2NzLzB4BggrBgEFBQcCAjBsDGpRdWFs
+aWZpZWQgRVYgY2VydGlmaWNhdGUgZm9yIHdlYnNpdGUgYXV0aGVudGljYXRpb24u
+IE1pbsWRc8OtdGV0dCBFViB3ZWJvbGRhbC1oaXRlbGVzw610xZEgdGFuw7pzw610
+dsOhbnkuMIGtBgNVHR8EgaUwgaIwNKAyoDCGLmh0dHA6Ly9jcmwxLm5ldGxvY2su
+aHUvaW5kZXguY2dpP2NybD1xdHJ1c3RldjMwNKAyoDCGLmh0dHA6Ly9jcmwyLm5l
+dGxvY2suaHUvaW5kZXguY2dpP2NybD1xdHJ1c3RldjMwNKAyoDCGLmh0dHA6Ly9j
+cmwzLm5ldGxvY2suaHUvaW5kZXguY2dpP2NybD1xdHJ1c3RldjMwHQYDVR0OBBYE
+FNf0w0W8aplbXGBhB+1MewJUIItbMIGnBggrBgEFBQcBAwSBmjCBlzAIBgYEAI5G
+AQEwFQYGBACORgECMAsTA0hVRgIB+wIBBjALBgYEAI5GAQMCAQowUgYGBACORgEF
+MEgwIhYcaHR0cHM6Ly93d3cubmV0bG9jay5odS9kb2NzLxMCZW4wIhYcaHR0cHM6
+Ly93d3cubmV0bG9jay5odS9kb2NzLxMCaHUwEwYGBACORgEGMAkGBwQAjkYBBgMw
+HQYDVR0RBBYwFIISc3RvcmUuZXJzdGViYW5rLmh1MIIBfwYKKwYBBAHWeQIEAgSC
+AW8EggFrAWkAdwBOdaMnXJoQwzhbbNTfP1LrHfDgjhuNacCx+mSxYpo53wAAAYzO
+avIzAAAEAwBIMEYCIQDOlyYiOWIexELziU66FIBIJZUMWVsZRDeCl3arw8cxMAIh
+AOYiDDT67K9Cn+L4EcZS8DHFLS7t3m77GWqeqdukLe2EAHYAzPsPaoVxCWX+lZtT
+zumyfCLphVwNl422qX5UwP5MDbAAAAGMzmrz+wAABAMARzBFAiEA/xzNaxjrBIZc
+DCEd/9hakULOMrl/fr3HwWYPLop95TcCIG6j1v1J1FqycRqm/S3PpNMUizcAi2m4
+3d5SYQkceVgEAHYAzxFW7tUufK/zh1vZaS6b6RpxZ0qwF+ysAdJbd87MOwgAAAGM
+zmr47wAABAMARzBFAiAhhS9tNTV6YewKfteM78lWql2xfJhfn/HPVJ4jxHR2fgIh
+APLEynQyBvnusRKddiZ7t5Z+6iizd2JYPYDrFZNZATewMCMGBWeBDAMBBBowGBMD
+VkFUEwJIVQwNMTAxOTc4NzktNC00NDANBgkqhkiG9w0BAQsFAAOCAQEAdLSu3tqF
+mawjSVMFYwA//ofL81LtT9GAhzCEO5Wjb9vYcs0Yad4TiOdXp4nnrVehYQQbz4nK
+C7/ihdNU40ykCqkTWLtYtXiGi6yh0Qs7nuPyrIvLur65/opa2GmBVDKsJ6E1TaBX
+N6DfOYpfOoYXhcuFKlzYfkHZHnPx5zhoqlc4AsVC7zVORu52uefA+8urwKbQ/IRG
+kXVHXGBemdVpOPU0cXEPwStOd0tnbZa4RIhTXoTqkACLIHMf81WopZWpshsI2/BU
++avMAHT/JsaRM2EMicqXCIc8f4W2/TLFGvKHOl+dXY69/tZ9HEaUzM5wD6VfCg61
+dKy6vvjOw5aXWg==
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.subject.rdnSequence,EvSubscriberAttributeAllowanceValidator,WARNING,cabf.ev_guidelines.common_name_attribute_present,
+certificate.tbsCertificate.extensions.1.extnValue.keyUsage,SubscriberKeyUsageValidator,WARNING,cabf.serverauth.subscriber_rsa_digitalsignature_and_keyencipherment_present,
+certificate.tbsCertificate.extensions.5.extnValue.certificatePolicies.1.policyQualifiers.0,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
+certificate.tbsCertificate.extensions.5.extnValue.certificatePolicies.1.policyQualifiers.1,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
+certificate.tbsCertificate.extensions.5.extnValue.certificatePolicies.1.policyQualifiers.1,CertificatePolicyQualifierValidator,ERROR,cabf.serverauth.prohibited_certificate_policy_qualifier_type,Prohibited qualifier type: 1.3.6.1.5.5.7.2.2
+certificate.tbsCertificate.extensions.6.extnValue.cRLDistributionPoints,CrlDpDistributionPointCountValidator,WARNING,cabf.serverauth.crldp_multiple_distributionpoints_present,
+certificate.tbsCertificate.extensions.7.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
+certificate.tbsCertificate.extensions.8.extnValue.qCStatements.1.statementInfo.qcEuLimitValue,QcEuLimitValueValidator,ERROR,etsi.en_319_412_5.gen-4.3.2.amount_negative,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.subject_key_identifier_extension_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 1.3.6.1.5.5.7.1.3
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 2.23.140.3.1
diff --git a/tests/integration_certificate/etsi/qevcp_w_eidas_final_certificate/queulimitvalue_not_alpha.crttest b/tests/integration_certificate/etsi/qevcp_w_eidas_final_certificate/queulimitvalue_not_alpha.crttest
new file mode 100644
index 0000000..6bf313f
--- /dev/null
+++ b/tests/integration_certificate/etsi/qevcp_w_eidas_final_certificate/queulimitvalue_not_alpha.crttest
@@ -0,0 +1,72 @@
+-----BEGIN CERTIFICATE-----
+MIIKhTCCCW2gAwIBAgIOXql/HQDkwqSXXIdbtsQwDQYJKoZIhvcNAQELBQAwYTEL
+MAkGA1UEBhMCSFUxETAPBgNVBAcMCEJ1ZGFwZXN0MRUwEwYDVQQKDAxORVRMT0NL
+IEx0ZC4xKDAmBgNVBAMMH05FVExPQ0sgVHJ1c3QgUXVhbGlmaWVkIEVWIENBIDMw
+HhcNMjQwMTAzMDgyMjQxWhcNMjUwMTAyMDgyMjQxWjCBzzELMAkGA1UEBhMCSFUx
+ETAPBgNVBAcMCEJ1ZGFwZXN0MSAwHgYDVQQKDBdFUlNURSBCQU5LIEhVTkdBUlkg
+WnJ0LjEbMBkGA1UEAwwSc3RvcmUuZXJzdGViYW5rLmh1MRwwGgYDVQQFExNWQVRI
+VS0xMDE5Nzg3OS00LTQ0MRwwGgYDVQRhDBNWQVRIVS0xMDE5Nzg3OS00LTQ0MR0w
+GwYDVQQPDBRQcml2YXRlIE9yZ2FuaXphdGlvbjETMBEGCysGAQQBgjc8AgEDEwJI
+VTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAJTQGZJ7f2BOVSOPsPn2
+j0MahcZsdwrVepsAzQzZkxRghan7/BMHmuDwuqHHD0SfHbVCgNr/QQVmqt8jbg8P
+pGIP4cNcH3rdnN5whE10zT30q6vTHDUXSDcNs7weBK47CI2Zh+my44ycQJOcqGub
+PzrMmDHbF27lyiEX/ucYjmHW0RCtGrVRwx71fCWMmDwWziuzoQhy3ufO25DkNQU7
+PAigYs+3XBv6ggbzG2FimqEvPEwoQikfJ3HDXXBuP0UxFMeTbXIWvUoZAtJWw4uq
+08YDLX1WklXW2PkxvAV7GgS80x0yQMjk2iEDEJO64rBNCdebDmK+JNMpDYClAX7O
+fQ6ZEapT4yIIqZny3D5aKVUnqtMcKOnJmlY1zvAHDylICL4rIcf8McQZ5mcQsW1V
+E+Bl4OrRlKMZBcAcU71zK55e9qTVP2YoW1atAM6/4F8jQHy+ZAGleSZCkvwH33br
+IND6F05el0eQYHYT1uW6QuAm8/NqvW3QpdwcJiqd8JMeH1WMny2ZJqb/RO/AsTIp
+2YXNWCQ1BGbON+Mi0WKX9dkZaa0u0fvPficH212W+6EKAMmsTelFe+yGV2M1luSd
+HH2yzjIWOMKvHELTUgMszXEl/8n5GSrxjU5z+OslhxnJAZFUqIHufzcqrq2B8noA
+hhBVpvkq5K06/FSZ/iE64Js5AgMBAAGjggXKMIIFxjAMBgNVHRMBAf8EAjAAMA4G
+A1UdDwEB/wQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwHwYD
+VR0jBBgwFoAUsNyVrpgIyI8XNuCLvORJs49LOlcwggFcBggrBgEFBQcBAQSCAU4w
+ggFKMDEGCCsGAQUFBzABhiVodHRwOi8vb2NzcDEubmV0bG9jay5odS9xdHJ1c3Rl
+djMuY2dpMDEGCCsGAQUFBzABhiVodHRwOi8vb2NzcDIubmV0bG9jay5odS9xdHJ1
+c3RldjMuY2dpMDEGCCsGAQUFBzABhiVodHRwOi8vb2NzcDMubmV0bG9jay5odS9x
+dHJ1c3RldjMuY2dpMDkGCCsGAQUFBzAChi1odHRwOi8vYWlhMS5uZXRsb2NrLmh1
+L2luZGV4LmNnaT9jYT1xdHJ1c3RldjMwOQYIKwYBBQUHMAKGLWh0dHA6Ly9haWEy
+Lm5ldGxvY2suaHUvaW5kZXguY2dpP2NhPXF0cnVzdGV2MzA5BggrBgEFBQcwAoYt
+aHR0cDovL2FpYTMubmV0bG9jay5odS9pbmRleC5jZ2k/Y2E9cXRydXN0ZXYzMIHG
+BgNVHSAEgb4wgbswBwYFZ4EMAQEwga8GBwQAi+xAAQQwgaMwJwYIKwYBBQUHAgEW
+G2h0dHA6Ly93d3cubmV0bG9jay5odS9kb2NzLzB4BggrBgEFBQcCAjBsDGpRdWFs
+aWZpZWQgRVYgY2VydGlmaWNhdGUgZm9yIHdlYnNpdGUgYXV0aGVudGljYXRpb24u
+IE1pbsWRc8OtdGV0dCBFViB3ZWJvbGRhbC1oaXRlbGVzw610xZEgdGFuw7pzw610
+dsOhbnkuMIGtBgNVHR8EgaUwgaIwNKAyoDCGLmh0dHA6Ly9jcmwxLm5ldGxvY2su
+aHUvaW5kZXguY2dpP2NybD1xdHJ1c3RldjMwNKAyoDCGLmh0dHA6Ly9jcmwyLm5l
+dGxvY2suaHUvaW5kZXguY2dpP2NybD1xdHJ1c3RldjMwNKAyoDCGLmh0dHA6Ly9j
+cmwzLm5ldGxvY2suaHUvaW5kZXguY2dpP2NybD1xdHJ1c3RldjMwHQYDVR0OBBYE
+FNf0w0W8aplbXGBhB+1MewJUIItbMIGmBggrBgEFBQcBAwSBmTCBljAIBgYEAI5G
+AQEwFAYGBACORgECMAoCAgFcAgEFAgEGMAsGBgQAjkYBAwIBCjBSBgYEAI5GAQUw
+SDAiFhxodHRwczovL3d3dy5uZXRsb2NrLmh1L2RvY3MvEwJlbjAiFhxodHRwczov
+L3d3dy5uZXRsb2NrLmh1L2RvY3MvEwJodTATBgYEAI5GAQYwCQYHBACORgEGAzAd
+BgNVHREEFjAUghJzdG9yZS5lcnN0ZWJhbmsuaHUwggF/BgorBgEEAdZ5AgQCBIIB
+bwSCAWsBaQB3AE51oydcmhDDOFts1N8/Uusd8OCOG41pwLH6ZLFimjnfAAABjM5q
+8jMAAAQDAEgwRgIhAM6XJiI5Yh7EQvOJTroUgEgllQxZWxlEN4KXdqvDxzEwAiEA
+5iIMNPrsr0Kf4vgRxlLwMcUtLu3ebvsZap6p26Qt7YQAdgDM+w9qhXEJZf6Vm1PO
+6bJ8IumFXA2XjbapflTA/kwNsAAAAYzOavP7AAAEAwBHMEUCIQD/HM1rGOsEhlwM
+IR3/2FqRQs4yuX9+vcfBZg8uin3lNwIgbqPW/UnUWrJxGqb9Lc+k0xSLNwCLabjd
+3lJhCRx5WAQAdgDPEVbu1S58r/OHW9lpLpvpGnFnSrAX7KwB0lt3zsw7CAAAAYzO
+avjvAAAEAwBHMEUCICGFL201NXph7Ap+14zvyVaqXbF8mF+f8c9UniPEdHZ+AiEA
+8sTKdDIG+e6xEp12Jnu3ln7qKLN3Ylg9gOsVk1kBN7AwIwYFZ4EMAwEEGjAYEwNW
+QVQTAkhVDA0xMDE5Nzg3OS00LTQ0MA0GCSqGSIb3DQEBCwUAA4IBAQB0tK7e2oWZ
+rCNJUwVjAD/+h8vzUu1P0YCHMIQ7laNv29hyzRhp3hOI51enieetV6FhBBvPicoL
+v+KF01TjTKQKqRNYu1i1eIaLrKHRCzue4/Ksi8u6vrn+ilrYaYFUMqwnoTVNoFc3
+oN85il86hheFy4UqXNh+Qdkec/HnOGiqVzgCxULvNU5G7na558D7y6vAptD8hEaR
+dUdcYF6Z1Wk49TRxcQ/BK053S2dtlrhEiFNehOqQAIsgcx/zVaillamyGwjb8FT5
+q8wAdP8mxpEzYQyJypcIhzx/hbb9MsUa8oc6X51djr3+1n0cRpTMznAPpV8KDrV0
+rLq++M7Dlpda
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.subject.rdnSequence,EvSubscriberAttributeAllowanceValidator,WARNING,cabf.ev_guidelines.common_name_attribute_present,
+certificate.tbsCertificate.extensions.1.extnValue.keyUsage,SubscriberKeyUsageValidator,WARNING,cabf.serverauth.subscriber_rsa_digitalsignature_and_keyencipherment_present,
+certificate.tbsCertificate.extensions.5.extnValue.certificatePolicies.1.policyQualifiers.0,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
+certificate.tbsCertificate.extensions.5.extnValue.certificatePolicies.1.policyQualifiers.1,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
+certificate.tbsCertificate.extensions.5.extnValue.certificatePolicies.1.policyQualifiers.1,CertificatePolicyQualifierValidator,ERROR,cabf.serverauth.prohibited_certificate_policy_qualifier_type,Prohibited qualifier type: 1.3.6.1.5.5.7.2.2
+certificate.tbsCertificate.extensions.6.extnValue.cRLDistributionPoints,CrlDpDistributionPointCountValidator,WARNING,cabf.serverauth.crldp_multiple_distributionpoints_present,
+certificate.tbsCertificate.extensions.7.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
+certificate.tbsCertificate.extensions.8.extnValue.qCStatements.1.statementInfo.qcEuLimitValue,QcEuLimitValueValidator,WARNING,etsi.en_319_412_5.gen-4.3.2.discouraged_numeric_currency_code_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.subject_key_identifier_extension_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 1.3.6.1.5.5.7.1.3
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 2.23.140.3.1
diff --git a/tests/integration_certificate/etsi/qevcp_w_eidas_pre_certificate/almost_clean.crttest b/tests/integration_certificate/etsi/qevcp_w_eidas_pre_certificate/almost_clean.crttest
new file mode 100644
index 0000000..8ac23cf
--- /dev/null
+++ b/tests/integration_certificate/etsi/qevcp_w_eidas_pre_certificate/almost_clean.crttest
@@ -0,0 +1,40 @@
+-----BEGIN CERTIFICATE-----
+MIIF2zCCBMOgAwIBAgIKTITWVCAMG9n4rDANBgkqhkiG9w0BAQsFADBLMQswCQYD
+VQQGEwJOTzEdMBsGA1UECgwUQnV5cGFzcyBBUy05ODMxNjMzMjcxHTAbBgNVBAMM
+FEJ1eXBhc3MgQ2xhc3MgMyBDQSAyMB4XDTI0MDIxNDEwMzQyMFoXDTI1MDIxMzIy
+NTkwMFowgfIxCzAJBgNVBAYTAk5PMQ0wCwYDVQQHDARPU0xPMQ0wCwYDVQQRDAQw
+OTc4MT8wPQYDVQQKDDZNQVNURVJDQVJEIFBBWU1FTlQgU0VSVklDRVMgSU5GUkFT
+VFJVQ1RVUkUgKE5PUldBWSkgQVMxHTAbBgNVBA8MFFByaXZhdGUgT3JnYW5pemF0
+aW9uMRMwEQYLKwYBBAGCNzwCAQMTAk5PMRIwEAYDVQQFEwk5MjI5ODg4NjIxGDAW
+BgNVBGETD05UUk5PLTkyMjk4ODg2MjEiMCAGA1UEAxMZbXRmLm1jZW5ldHQubWFz
+dGVyY2FyZC5ubzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMPkzQWj
+5Z5lDiodPsk7pYN7j9g9n1lYhzCepFMHJgiyacdcQxVkunYgGlB8m6CcFUcTVbu7
+qkkhN1g1gEKX3wMZVjwrSfmSoAuGsUciOS90T30HkOiDvzVxmnE9TuyhDHRKvANp
+OpNNcUlJHbPondkslHvf3xEO3Q+40M65NjH9GEtepU0aEixKCjPSxnWiwiMM6PFC
+NRtLJu+aQrP1wHOj2eHbaAstiTf20NKTfGbAFGVlskQcPTkNOYe2unZCUsVNyQwW
+KKbaa4Dk1g8SNpiIbyeovsVMS41Ul+/wg3qoT6G7CJd5UBzUFyjnKPz/OFjALOwW
+YCwNDKkmNEOtA/UCAwEAAaOCAhcwggITMAwGA1UdEwEB/wQCMAAwHwYDVR0jBBgw
+FoAUIjAu0vv2S8rAuDvSBMTpcuaXmwwwDgYDVR0PAQH/BAQDAgeAMB0GA1UdJQQW
+MBQGCCsGAQUFBwMBBggrBgEFBQcDAjBHBgNVHSAEQDA+MDEGBWeBDAEBMCgwJgYI
+KwYBBQUHAgEWGmh0dHBzOi8vd3d3LmJ1eXBhc3Mubm8vY3BzMAkGBwQAi+xAAQQw
+OgYDVR0fBDMwMTAvoC2gK4YpaHR0cDovL2NybC5idXlwYXNzLm5vL2NybC9CUENs
+YXNzM0NBMi5jcmwwJAYDVR0RBB0wG4IZbXRmLm1jZW5ldHQubWFzdGVyY2FyZC5u
+bzBqBggrBgEFBQcBAQReMFwwIwYIKwYBBQUHMAGGF2h0dHA6Ly9vY3NwLmJ1eXBh
+c3MuY29tMDUGCCsGAQUFBzAChilodHRwOi8vY3J0LmJ1eXBhc3Mubm8vY3J0L0JQ
+Q2xhc3MzQ0EyLmNlcjBmBggrBgEFBQcBAwRaMFgwCAYGBACORgEBMBMGBgQAjkYB
+BjAJBgcEAI5GAQYDMDcGBgQAjkYBBTAtMCsWJWh0dHBzOi8vd3d3LmJ1eXBhc3Mu
+bm8vcGRzL3Bkc19lbi5wZGYTAmVuMBMGCisGAQQB1nkCBAMBAf8EAgUAMB8GBWeB
+DAMBBBYwFBMDTlRSEwJOTwwJOTIyOTg4ODYyMA0GCSqGSIb3DQEBCwUAA4IBAQCn
+ai71nvvohRcNlvhBf7OQSDIjUXNLkftas7r794hKWeXDr2VgjLpgbeIB9lrjAtvb
+mzKjmt2BqAvrTzmSIu1EpWDmqKVboImlBCNJBWXjlWxIcmrYVU3XtxRjKxDYCUEY
+2aJ8UN0svQChjp05uEmJI7n/Wv/UFNbZXX9shLU/OwqutTA3c0qaCzL/Lu3Ohx2f
+FAOWh20FgrRV0TpNrGMDVjt2aBYA5HR3KAdGrZfONZLTk9YtCy/YYszrzS6oqvHD
+9fqpdKq7elkXnRHWsZIbA0WmhtdAhICOxkvkHiVf4J75p3Nykw+zwl6KVRWWcGp+
+BM55iz4S8tNifYOk+4Nu
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.extensions.4.extnValue.certificatePolicies.0.policyQualifiers.0,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 1.3.6.1.5.5.7.1.3
+certificate.tbsCertificate.subject.rdnSequence,EvSubscriberAttributeAllowanceValidator,WARNING,cabf.ev_guidelines.common_name_attribute_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 2.23.140.3.1
diff --git a/tests/integration_certificate/etsi/qevcp_w_eidas_pre_certificate/cc_legislation_present.crttest b/tests/integration_certificate/etsi/qevcp_w_eidas_pre_certificate/cc_legislation_present.crttest
new file mode 100644
index 0000000..d14bc31
--- /dev/null
+++ b/tests/integration_certificate/etsi/qevcp_w_eidas_pre_certificate/cc_legislation_present.crttest
@@ -0,0 +1,54 @@
+-----BEGIN CERTIFICATE-----
+MIIHfTCCBWWgAwIBAgIMFzle8tVI5MLthWVyMA0GCSqGSIb3DQEBCwUAMFkxCzAJ
+BgNVBAYTAkdCMRswGQYDVQQKExJHTU8gR2xvYmFsU2lnbiBMdGQxLTArBgNVBAMT
+JEdsb2JhbFNpZ24gR0NDIFIzIFVLIEVWIFFXQUMgQ0EgMjAyMDAeFw0yMzA2MTYw
+ODMzMzRaFw0yNDA2MTUwODMzMzNaMIHyMR0wGwYDVQQPDBRQcml2YXRlIE9yZ2Fu
+aXphdGlvbjEVMBMGA1UEBRMMMDQ1OS4xMzQuMjU2MRMwEQYLKwYBBAGCNzwCAQMT
+AkJFMQswCQYDVQQGEwJCRTEXMBUGA1UECAwOVmxhYW1zLUJyYWJhbnQxDzANBgNV
+BAcMBkxldXZlbjEXMBUGA1UECQwORGllc3RzZXZlc3QgMTQxFjAUBgNVBAoMDUds
+b2JhbFNpZ24gTlYxIDAeBgNVBAMMF3d3dy5nbG9iYWxzaWduLWRlbW8uY29tMRsw
+GQYDVQRhDBJOVFJCRS0wNDU5LjEzNC4yNTYwggEiMA0GCSqGSIb3DQEBAQUAA4IB
+DwAwggEKAoIBAQCpn0FCPXqC0Lx5clF4Qq4ez3CW3iLRJegKqMaD84PN504skXsY
+bDhLz+naT3naIqsYJUV9A+b01BRVgMR4vZpZ27EY28tRwRf9s7eImzO5QXFPoG+i
+2ztRC7rE4Q33HO5SRKp3ZEV9Es8fW3/mJxGrLFJuS7c6sX0bU/dBdISw1j0pM/8+
+oXN0Kiy/vcMULkP/eL6nmj45jklIFoRxb0AZzemQijj+t8fz8bLWZISLBzvqmL0Y
+hjpCkLnyjgVM5xtElSPf7/a7J7jnaleZ3gJhxYF+FndyHooaBAHxFA32BmSgV3PD
+Rgq3eLMUGrngSlGNXbTWMxnUTh93lrqiturXAgMBAAGjggKpMIICpTBEBgNVHR8E
+PTA7MDmgN6A1hjNodHRwOi8vY3JsLmdsb2JhbHNpZ24uY29tL2dzZ2NjcjN1a2V2
+cXdhY2NhMjAyMC5jcmwwPQYIKwYBBQUHAQMEMTAvMAgGBgQAjkYBATATBgYEAI5G
+AQYwCQYHBACORgEGAzAOBgYEAI5GAQcwBBMCR0IwgZkGCCsGAQUFBwEBBIGMMIGJ
+MEkGCCsGAQUFBzAChj1odHRwOi8vc2VjdXJlLmdsb2JhbHNpZ24uY29tL2NhY2Vy
+dC9nc2djY3IzdWtldnF3YWNjYTIwMjAuY3J0MDwGCCsGAQUFBzABhjBodHRwOi8v
+b2NzcC5nbG9iYWxzaWduLmNvbS9nc2djY3IzdWtldnF3YWNjYTIwMjAwgacGA1Ud
+IASBnzCBnDBBBgkrBgEEAaAyAQEwNDAyBggrBgEFBQcCARYmaHR0cHM6Ly93d3cu
+Z2xvYmFsc2lnbi5jb20vcmVwb3NpdG9yeS8wBwYFZ4EMAQEwCQYHBACL7EABBDBD
+BgsrBgEEAaAyASwoATA0MDIGCCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxz
+aWduLmNvbS9yZXBvc2l0b3J5LzAiBgNVHREEGzAZghd3d3cuZ2xvYmFsc2lnbi1k
+ZW1vLmNvbTAiBgVngQwDAQQZMBcTA05UUhMCQkUMDDA0NTkuMTM0LjI1NjAMBgNV
+HRMBAf8EAjAAMB8GA1UdIwQYMBaAFAeUNkpRlUn97ioGeTZ/wjc7Ttu/MB0GA1Ud
+JQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATAdBgNVHQ4EFgQUzAkXOmPl1fx/NWnn
+M2kcUxBAZ5QwDgYDVR0PAQH/BAQDAgeAMBMGCisGAQQB1nkCBAMBAf8EAgUAMA0G
+CSqGSIb3DQEBCwUAA4ICAQCaXlFvQuIgDR/2ARtUwmknMv2K0hARJ8jIXp+uiOoy
+EejR2HZetKOKKXdLZVeFHAV1gujMujStu7zu/weqnoACLLPyZfizxT1CpImPOorv
+YDzKWOJWz22Dwg7uxk5HuFmxVla2mru12bdQho0JDmsldMJlc7Mq3S7Q88AOUkmi
+roaSEsQ+joZ4NILZtcl2rkD2U/aTOBkUh80CJpyZP8QHD16ztD9sWmBtRtHRnCAd
+xbZAkKAq3VQ/qCYT7OkTcui2xh327ZPwmNJiYILJ5vRIheiZIuj31x3FkmXus/f8
+nTX/p1MmDn1sx2vpuyQ5vGyX8knXyfwqe1NiNKq0QT+1bqLggT2Li21S9XavwFcl
+x6IuRDlBFWMgJTGPgn2ZIpzmsfOxeCvQAKJWVdvGgDItRPSGnAs3WHeSmQPobW8Q
+m/LareZcoDwUBT70C6EMm6cc9C2XVDHPs5wW9eIWL8IF1Jd03tXIIDIfuIHnFX3o
+/UCkHCCN4nQSIp57CI8Z5mDbpj3G0jEAnJyYGTPXR6MugsSuY8tTYIyN2y0qXzYx
+w8PRAMBKq4f+ZYAHj/I54QT/Rvj2Wyhna9QNBvjWgImHPEDrIZ4MGlTeJuL7WjsQ
+hfQZjQ3aw24SEg51Sf1UTQ80xAZJoK8Q3kTzymzUZgqeutUtYrTgXjzd4Mv+52YQ
+oQ==
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.subject.rdnSequence,EvSubscriberAttributeAllowanceValidator,WARNING,cabf.ev_guidelines.common_name_attribute_present,
+certificate.tbsCertificate.extensions.1.extnValue.qCStatements,QcStatementIdentifierAllowanceValidator,ERROR,etsi.en_319_412_5.qcs-5.01.qc_cc_legislation_qualified_statement_present,
+certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies,SubscriberPoliciesValidator,WARNING,cabf.serverauth.subscriber_first_policy_oid_not_reserved,
+certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies.0.policyQualifiers.0,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
+certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies.3.policyQualifiers.0,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
+certificate.tbsCertificate.extensions.9.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.subject_key_identifier_extension_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 1.3.6.1.5.5.7.1.3
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 2.23.140.3.1
diff --git a/tests/integration_certificate/etsi/qevcp_w_eidas_pre_certificate/mismatched_certificate_type_policy_oid.crttest b/tests/integration_certificate/etsi/qevcp_w_eidas_pre_certificate/mismatched_certificate_type_policy_oid.crttest
new file mode 100644
index 0000000..938754f
--- /dev/null
+++ b/tests/integration_certificate/etsi/qevcp_w_eidas_pre_certificate/mismatched_certificate_type_policy_oid.crttest
@@ -0,0 +1,37 @@
+-----BEGIN CERTIFICATE-----
+MIIFfDCCBGSgAwIBAgIKTITWVCAMG9n4rDANBgkqhkiG9w0BAQsFADBLMQswCQYD
+VQQGEwJOTzEdMBsGA1UECgwUQnV5cGFzcyBBUy05ODMxNjMzMjcxHTAbBgNVBAMM
+FEJ1eXBhc3MgQ2xhc3MgMyBDQSAyMB4XDTI0MDIxNDEwMzQyMFoXDTI1MDIxMzIy
+NTkwMFowgbQxCzAJBgNVBAYTAk5PMQ0wCwYDVQQHDARPU0xPMQ0wCwYDVQQRDAQw
+OTc4MT8wPQYDVQQKDDZNQVNURVJDQVJEIFBBWU1FTlQgU0VSVklDRVMgSU5GUkFT
+VFJVQ1RVUkUgKE5PUldBWSkgQVMxHTAbBgNVBA8MFFByaXZhdGUgT3JnYW5pemF0
+aW9uMRMwEQYLKwYBBAGCNzwCAQMTAk5PMRIwEAYDVQQFEwk5MjI5ODg4NjIwggEi
+MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDD5M0Fo+WeZQ4qHT7JO6WDe4/Y
+PZ9ZWIcwnqRTByYIsmnHXEMVZLp2IBpQfJugnBVHE1W7u6pJITdYNYBCl98DGVY8
+K0n5kqALhrFHIjkvdE99B5Dog781cZpxPU7soQx0SrwDaTqTTXFJSR2z6J3ZLJR7
+398RDt0PuNDOuTYx/RhLXqVNGhIsSgoz0sZ1osIjDOjxQjUbSybvmkKz9cBzo9nh
+22gLLYk39tDSk3xmwBRlZbJEHD05DTmHtrp2QlLFTckMFiim2muA5NYPEjaYiG8n
+qL7FTEuNVJfv8IN6qE+huwiXeVAc1Bco5yj8/zhYwCzsFmAsDQypJjRDrQP1AgMB
+AAGjggH2MIIB8jAMBgNVHRMBAf8EAjAAMB8GA1UdIwQYMBaAFCIwLtL79kvKwLg7
+0gTE6XLml5sMMA4GA1UdDwEB/wQEAwIHgDAdBgNVHSUEFjAUBggrBgEFBQcDAQYI
+KwYBBQUHAwIwRwYDVR0gBEAwPjAxBgVngQwBATAoMCYGCCsGAQUFBwIBFhpodHRw
+czovL3d3dy5idXlwYXNzLm5vL2NwczAJBgcEAIvsQAEFMDoGA1UdHwQzMDEwL6At
+oCuGKWh0dHA6Ly9jcmwuYnV5cGFzcy5uby9jcmwvQlBDbGFzczNDQTIuY3JsMCQG
+A1UdEQQdMBuCGW10Zi5tY2VuZXR0Lm1hc3RlcmNhcmQubm8wagYIKwYBBQUHAQEE
+XjBcMCMGCCsGAQUFBzABhhdodHRwOi8vb2NzcC5idXlwYXNzLmNvbTA1BggrBgEF
+BQcwAoYpaHR0cDovL2NydC5idXlwYXNzLm5vL2NydC9CUENsYXNzM0NBMi5jZXIw
+ZgYIKwYBBQUHAQMEWjBYMAgGBgQAjkYBATATBgYEAI5GAQYwCQYHBACORgEGAzA3
+BgYEAI5GAQUwLTArFiVodHRwczovL3d3dy5idXlwYXNzLm5vL3Bkcy9wZHNfZW4u
+cGRmEwJlbjATBgorBgEEAdZ5AgQDAQH/BAIFADANBgkqhkiG9w0BAQsFAAOCAQEA
+p2ou9Z776IUXDZb4QX+zkEgyI1FzS5H7WrO6+/eISlnlw69lYIy6YG3iAfZa4wLb
+25syo5rdgagL6085kiLtRKVg5qilW6CJpQQjSQVl45VsSHJq2FVN17cUYysQ2AlB
+GNmifFDdLL0AoY6dObhJiSO5/1r/1BTW2V1/bIS1PzsKrrUwN3NKmgsy/y7tzocd
+nxQDlodtBYK0VdE6TaxjA1Y7dmgWAOR0dygHRq2XzjWS05PWLQsv2GLM680uqKrx
+w/X6qXSqu3pZF50R1rGSGwNFpobXQISAjsZL5B4lX+Ce+adzcpMPs8JeilUVlnBq
+fgTOeYs+EvLTYn2DpPuDbg==
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.extensions.4.extnValue.certificatePolicies,QualifiedCertificatePoliciesValidator,ERROR,etsi.en_319_412_2.qcs-5.2-2.mismatched_policy_identifier_for_certificate_type,"Certificate type is QEVCP_W_EIDAS_PRE_CERTIFICATE (0.4.0.194112.1.4) but certificate contains certificate type policy identifier ""0.4.0.194112.1.5"""
+certificate.tbsCertificate.extensions.4.extnValue.certificatePolicies.0.policyQualifiers.0,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 1.3.6.1.5.5.7.1.3
diff --git a/tests/integration_certificate/etsi/qevcp_w_eidas_pre_certificate/missing_certificate_type_policy_identifier.crttest b/tests/integration_certificate/etsi/qevcp_w_eidas_pre_certificate/missing_certificate_type_policy_identifier.crttest
new file mode 100644
index 0000000..9dd4e89
--- /dev/null
+++ b/tests/integration_certificate/etsi/qevcp_w_eidas_pre_certificate/missing_certificate_type_policy_identifier.crttest
@@ -0,0 +1,37 @@
+-----BEGIN CERTIFICATE-----
+MIIFcTCCBFmgAwIBAgIKTITWVCAMG9n4rDANBgkqhkiG9w0BAQsFADBLMQswCQYD
+VQQGEwJOTzEdMBsGA1UECgwUQnV5cGFzcyBBUy05ODMxNjMzMjcxHTAbBgNVBAMM
+FEJ1eXBhc3MgQ2xhc3MgMyBDQSAyMB4XDTI0MDIxNDEwMzQyMFoXDTI1MDIxMzIy
+NTkwMFowgbQxCzAJBgNVBAYTAk5PMQ0wCwYDVQQHDARPU0xPMQ0wCwYDVQQRDAQw
+OTc4MT8wPQYDVQQKDDZNQVNURVJDQVJEIFBBWU1FTlQgU0VSVklDRVMgSU5GUkFT
+VFJVQ1RVUkUgKE5PUldBWSkgQVMxHTAbBgNVBA8MFFByaXZhdGUgT3JnYW5pemF0
+aW9uMRMwEQYLKwYBBAGCNzwCAQMTAk5PMRIwEAYDVQQFEwk5MjI5ODg4NjIwggEi
+MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDD5M0Fo+WeZQ4qHT7JO6WDe4/Y
+PZ9ZWIcwnqRTByYIsmnHXEMVZLp2IBpQfJugnBVHE1W7u6pJITdYNYBCl98DGVY8
+K0n5kqALhrFHIjkvdE99B5Dog781cZpxPU7soQx0SrwDaTqTTXFJSR2z6J3ZLJR7
+398RDt0PuNDOuTYx/RhLXqVNGhIsSgoz0sZ1osIjDOjxQjUbSybvmkKz9cBzo9nh
+22gLLYk39tDSk3xmwBRlZbJEHD05DTmHtrp2QlLFTckMFiim2muA5NYPEjaYiG8n
+qL7FTEuNVJfv8IN6qE+huwiXeVAc1Bco5yj8/zhYwCzsFmAsDQypJjRDrQP1AgMB
+AAGjggHrMIIB5zAMBgNVHRMBAf8EAjAAMB8GA1UdIwQYMBaAFCIwLtL79kvKwLg7
+0gTE6XLml5sMMA4GA1UdDwEB/wQEAwIHgDAdBgNVHSUEFjAUBggrBgEFBQcDAQYI
+KwYBBQUHAwIwPAYDVR0gBDUwMzAxBgVngQwBATAoMCYGCCsGAQUFBwIBFhpodHRw
+czovL3d3dy5idXlwYXNzLm5vL2NwczA6BgNVHR8EMzAxMC+gLaArhilodHRwOi8v
+Y3JsLmJ1eXBhc3Mubm8vY3JsL0JQQ2xhc3MzQ0EyLmNybDAkBgNVHREEHTAbghlt
+dGYubWNlbmV0dC5tYXN0ZXJjYXJkLm5vMGoGCCsGAQUFBwEBBF4wXDAjBggrBgEF
+BQcwAYYXaHR0cDovL29jc3AuYnV5cGFzcy5jb20wNQYIKwYBBQUHMAKGKWh0dHA6
+Ly9jcnQuYnV5cGFzcy5uby9jcnQvQlBDbGFzczNDQTIuY2VyMGYGCCsGAQUFBwED
+BFowWDAIBgYEAI5GAQEwEwYGBACORgEGMAkGBwQAjkYBBgMwNwYGBACORgEFMC0w
+KxYlaHR0cHM6Ly93d3cuYnV5cGFzcy5uby9wZHMvcGRzX2VuLnBkZhMCZW4wEwYK
+KwYBBAHWeQIEAwEB/wQCBQAwDQYJKoZIhvcNAQELBQADggEBAKdqLvWe++iFFw2W
++EF/s5BIMiNRc0uR+1qzuvv3iEpZ5cOvZWCMumBt4gH2WuMC29ubMqOa3YGoC+tP
+OZIi7USlYOaopVugiaUEI0kFZeOVbEhyathVTde3FGMrENgJQRjZonxQ3Sy9AKGO
+nTm4SYkjuf9a/9QU1tldf2yEtT87Cq61MDdzSpoLMv8u7c6HHZ8UA5aHbQWCtFXR
+Ok2sYwNWO3ZoFgDkdHcoB0atl841ktOT1i0LL9hizOvNLqiq8cP1+ql0qrt6WRed
+EdaxkhsDRaaG10CEgI7GS+QeJV/gnvmnc3KTD7PCXopVFZZwan4EznmLPhLy02J9
+g6T7g24=
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.extensions.4.extnValue.certificatePolicies,QualifiedCertificatePoliciesValidator,WARNING,etsi.en_319_412_2.qcs-5.2-1.recommended_certificate_type_policy_identifier_missing,"Missing recommended certificate type policy identifier ""0.4.0.194112.1.4"""
+certificate.tbsCertificate.extensions.4.extnValue.certificatePolicies.0.policyQualifiers.0,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 1.3.6.1.5.5.7.1.3
diff --git a/tests/integration_certificate/etsi/qevcp_w_eidas_pre_certificate/multiple_certificate_type_policy_identifiers.crttest b/tests/integration_certificate/etsi/qevcp_w_eidas_pre_certificate/multiple_certificate_type_policy_identifiers.crttest
new file mode 100644
index 0000000..11f670f
--- /dev/null
+++ b/tests/integration_certificate/etsi/qevcp_w_eidas_pre_certificate/multiple_certificate_type_policy_identifiers.crttest
@@ -0,0 +1,37 @@
+-----BEGIN CERTIFICATE-----
+MIIFhzCCBG+gAwIBAgIKTITWVCAMG9n4rDANBgkqhkiG9w0BAQsFADBLMQswCQYD
+VQQGEwJOTzEdMBsGA1UECgwUQnV5cGFzcyBBUy05ODMxNjMzMjcxHTAbBgNVBAMM
+FEJ1eXBhc3MgQ2xhc3MgMyBDQSAyMB4XDTI0MDIxNDEwMzQyMFoXDTI1MDIxMzIy
+NTkwMFowgbQxCzAJBgNVBAYTAk5PMQ0wCwYDVQQHDARPU0xPMQ0wCwYDVQQRDAQw
+OTc4MT8wPQYDVQQKDDZNQVNURVJDQVJEIFBBWU1FTlQgU0VSVklDRVMgSU5GUkFT
+VFJVQ1RVUkUgKE5PUldBWSkgQVMxHTAbBgNVBA8MFFByaXZhdGUgT3JnYW5pemF0
+aW9uMRMwEQYLKwYBBAGCNzwCAQMTAk5PMRIwEAYDVQQFEwk5MjI5ODg4NjIwggEi
+MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDD5M0Fo+WeZQ4qHT7JO6WDe4/Y
+PZ9ZWIcwnqRTByYIsmnHXEMVZLp2IBpQfJugnBVHE1W7u6pJITdYNYBCl98DGVY8
+K0n5kqALhrFHIjkvdE99B5Dog781cZpxPU7soQx0SrwDaTqTTXFJSR2z6J3ZLJR7
+398RDt0PuNDOuTYx/RhLXqVNGhIsSgoz0sZ1osIjDOjxQjUbSybvmkKz9cBzo9nh
+22gLLYk39tDSk3xmwBRlZbJEHD05DTmHtrp2QlLFTckMFiim2muA5NYPEjaYiG8n
+qL7FTEuNVJfv8IN6qE+huwiXeVAc1Bco5yj8/zhYwCzsFmAsDQypJjRDrQP1AgMB
+AAGjggIBMIIB/TAMBgNVHRMBAf8EAjAAMB8GA1UdIwQYMBaAFCIwLtL79kvKwLg7
+0gTE6XLml5sMMA4GA1UdDwEB/wQEAwIHgDAdBgNVHSUEFjAUBggrBgEFBQcDAQYI
+KwYBBQUHAwIwUgYDVR0gBEswSTAxBgVngQwBATAoMCYGCCsGAQUFBwIBFhpodHRw
+czovL3d3dy5idXlwYXNzLm5vL2NwczAJBgcEAIvsQAEFMAkGBwQAi+xAAQYwOgYD
+VR0fBDMwMTAvoC2gK4YpaHR0cDovL2NybC5idXlwYXNzLm5vL2NybC9CUENsYXNz
+M0NBMi5jcmwwJAYDVR0RBB0wG4IZbXRmLm1jZW5ldHQubWFzdGVyY2FyZC5ubzBq
+BggrBgEFBQcBAQReMFwwIwYIKwYBBQUHMAGGF2h0dHA6Ly9vY3NwLmJ1eXBhc3Mu
+Y29tMDUGCCsGAQUFBzAChilodHRwOi8vY3J0LmJ1eXBhc3Mubm8vY3J0L0JQQ2xh
+c3MzQ0EyLmNlcjBmBggrBgEFBQcBAwRaMFgwCAYGBACORgEBMBMGBgQAjkYBBjAJ
+BgcEAI5GAQYDMDcGBgQAjkYBBTAtMCsWJWh0dHBzOi8vd3d3LmJ1eXBhc3Mubm8v
+cGRzL3Bkc19lbi5wZGYTAmVuMBMGCisGAQQB1nkCBAMBAf8EAgUAMA0GCSqGSIb3
+DQEBCwUAA4IBAQCnai71nvvohRcNlvhBf7OQSDIjUXNLkftas7r794hKWeXDr2Vg
+jLpgbeIB9lrjAtvbmzKjmt2BqAvrTzmSIu1EpWDmqKVboImlBCNJBWXjlWxIcmrY
+VU3XtxRjKxDYCUEY2aJ8UN0svQChjp05uEmJI7n/Wv/UFNbZXX9shLU/OwqutTA3
+c0qaCzL/Lu3Ohx2fFAOWh20FgrRV0TpNrGMDVjt2aBYA5HR3KAdGrZfONZLTk9Yt
+Cy/YYszrzS6oqvHD9fqpdKq7elkXnRHWsZIbA0WmhtdAhICOxkvkHiVf4J75p3Ny
+kw+zwl6KVRWWcGp+BM55iz4S8tNifYOk+4Nu
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.extensions.4.extnValue.certificatePolicies,QualifiedCertificatePoliciesValidator,ERROR,etsi.en_319_412_2.qcs-5.2-1.multiple_certificate_type_policy_identifiers_present,"Multiple certificate type policy identifiers present: 0.4.0.194112.1.5, 0.4.0.194112.1.6"
+certificate.tbsCertificate.extensions.4.extnValue.certificatePolicies.0.policyQualifiers.0,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 1.3.6.1.5.5.7.1.3
diff --git a/tests/integration_certificate/etsi/qevcp_w_eidas_pre_certificate/orgname_too_long.crttest b/tests/integration_certificate/etsi/qevcp_w_eidas_pre_certificate/orgname_too_long.crttest
new file mode 100644
index 0000000..555c0c6
--- /dev/null
+++ b/tests/integration_certificate/etsi/qevcp_w_eidas_pre_certificate/orgname_too_long.crttest
@@ -0,0 +1,39 @@
+-----BEGIN CERTIFICATE-----
+MIIF2jCCBMKgAwIBAgIKTITWVCAMG9n4rDANBgkqhkiG9w0BAQsFADBLMQswCQYD
+VQQGEwJOTzEdMBsGA1UECgwUQnV5cGFzcyBBUy05ODMxNjMzMjcxHTAbBgNVBAMM
+FEJ1eXBhc3MgQ2xhc3MgMyBDQSAyMB4XDTI0MDIxNDEwMzQyMFoXDTI1MDIxMzIy
+NTkwMFowggERMQswCQYDVQQGEwJOTzENMAsGA1UEBwwET1NMTzENMAsGA1UEEQwE
+MDk3ODGBmzCBmAYDVQQKDIGQQSBsb29vb29vb29vb29vb29vb29vb29vb29vb29v
+b29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29v
+b29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29v
+b29vbmcgY29tcGFueSBuYW1lMR0wGwYDVQQPDBRQcml2YXRlIE9yZ2FuaXphdGlv
+bjETMBEGCysGAQQBgjc8AgEDEwJOTzESMBAGA1UEBRMJOTIyOTg4ODYyMIIBIjAN
+BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAw+TNBaPlnmUOKh0+yTulg3uP2D2f
+WViHMJ6kUwcmCLJpx1xDFWS6diAaUHyboJwVRxNVu7uqSSE3WDWAQpffAxlWPCtJ
++ZKgC4axRyI5L3RPfQeQ6IO/NXGacT1O7KEMdEq8A2k6k01xSUkds+id2SyUe9/f
+EQ7dD7jQzrk2Mf0YS16lTRoSLEoKM9LGdaLCIwzo8UI1G0sm75pCs/XAc6PZ4dto
+Cy2JN/bQ0pN8ZsAUZWWyRBw9OQ05h7a6dkJSxU3JDBYoptprgOTWDxI2mIhvJ6i+
+xUxLjVSX7/CDeqhPobsIl3lQHNQXKOco/P84WMAs7BZgLA0MqSY0Q60D9QIDAQAB
+o4IB9jCCAfIwDAYDVR0TAQH/BAIwADAfBgNVHSMEGDAWgBQiMC7S+/ZLysC4O9IE
+xOly5pebDDAOBgNVHQ8BAf8EBAMCB4AwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsG
+AQUFBwMCMEcGA1UdIARAMD4wMQYFZ4EMAQEwKDAmBggrBgEFBQcCARYaaHR0cHM6
+Ly93d3cuYnV5cGFzcy5uby9jcHMwCQYHBACL7EABBDA6BgNVHR8EMzAxMC+gLaAr
+hilodHRwOi8vY3JsLmJ1eXBhc3Mubm8vY3JsL0JQQ2xhc3MzQ0EyLmNybDAkBgNV
+HREEHTAbghltdGYubWNlbmV0dC5tYXN0ZXJjYXJkLm5vMGoGCCsGAQUFBwEBBF4w
+XDAjBggrBgEFBQcwAYYXaHR0cDovL29jc3AuYnV5cGFzcy5jb20wNQYIKwYBBQUH
+MAKGKWh0dHA6Ly9jcnQuYnV5cGFzcy5uby9jcnQvQlBDbGFzczNDQTIuY2VyMGYG
+CCsGAQUFBwEDBFowWDAIBgYEAI5GAQEwEwYGBACORgEGMAkGBwQAjkYBBgMwNwYG
+BACORgEFMC0wKxYlaHR0cHM6Ly93d3cuYnV5cGFzcy5uby9wZHMvcGRzX2VuLnBk
+ZhMCZW4wEwYKKwYBBAHWeQIEAwEB/wQCBQAwDQYJKoZIhvcNAQELBQADggEBAKdq
+LvWe++iFFw2W+EF/s5BIMiNRc0uR+1qzuvv3iEpZ5cOvZWCMumBt4gH2WuMC29ub
+MqOa3YGoC+tPOZIi7USlYOaopVugiaUEI0kFZeOVbEhyathVTde3FGMrENgJQRjZ
+onxQ3Sy9AKGOnTm4SYkjuf9a/9QU1tldf2yEtT87Cq61MDdzSpoLMv8u7c6HHZ8U
+A5aHbQWCtFXROk2sYwNWO3ZoFgDkdHcoB0atl841ktOT1i0LL9hizOvNLqiq8cP1
++ql0qrt6WRedEdaxkhsDRaaG10CEgI7GS+QeJV/gnvmnc3KTD7PCXopVFZZwan4E
+znmLPhLy02J9g6T7g24=
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.subject.rdnSequence.3.0,NameDecodingValidator,FATAL,itu.invalid_asn1_syntax,"ASN.1 decoding failure occurred at ""certificate.tbsCertificate.subject.rdnSequence.3.0.value"" with schema ""X520OrganizationName"", OID 2.5.4.10: <ConstraintsIntersection object, consts <ValueSizeConstraint object, consts 1, <Integer value object, tagSet <TagSet object, tags 0:0:2>, payload [64]>>> failed at: ValueConstraintError(""<ValueSizeConstraint object, consts 1, <Integer value object, tagSet <TagSet object, tags 0:0:2>, payload [64]>> failed at: ValueConstraintError('A loooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooong company name')"") at UTF8String"
+certificate.tbsCertificate.extensions.4.extnValue.certificatePolicies.0.policyQualifiers.0,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 1.3.6.1.5.5.7.1.3
diff --git a/tests/integration_certificate/etsi/qevcp_w_eidas_pre_certificate/pds_language_code_invalid.crttest b/tests/integration_certificate/etsi/qevcp_w_eidas_pre_certificate/pds_language_code_invalid.crttest
new file mode 100644
index 0000000..b88c9cf
--- /dev/null
+++ b/tests/integration_certificate/etsi/qevcp_w_eidas_pre_certificate/pds_language_code_invalid.crttest
@@ -0,0 +1,41 @@
+-----BEGIN CERTIFICATE-----
+MIIF2zCCBMOgAwIBAgIKTITWVCAMG9n4rDANBgkqhkiG9w0BAQsFADBLMQswCQYD
+VQQGEwJOTzEdMBsGA1UECgwUQnV5cGFzcyBBUy05ODMxNjMzMjcxHTAbBgNVBAMM
+FEJ1eXBhc3MgQ2xhc3MgMyBDQSAyMB4XDTI0MDIxNDEwMzQyMFoXDTI1MDIxMzIy
+NTkwMFowgfIxCzAJBgNVBAYTAk5PMQ0wCwYDVQQHDARPU0xPMQ0wCwYDVQQRDAQw
+OTc4MT8wPQYDVQQKDDZNQVNURVJDQVJEIFBBWU1FTlQgU0VSVklDRVMgSU5GUkFT
+VFJVQ1RVUkUgKE5PUldBWSkgQVMxHTAbBgNVBA8MFFByaXZhdGUgT3JnYW5pemF0
+aW9uMRMwEQYLKwYBBAGCNzwCAQMTAk5PMRIwEAYDVQQFEwk5MjI5ODg4NjIxGDAW
+BgNVBGETD05UUk5PLTkyMjk4ODg2MjEiMCAGA1UEAxMZbXRmLm1jZW5ldHQubWFz
+dGVyY2FyZC5ubzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMPkzQWj
+5Z5lDiodPsk7pYN7j9g9n1lYhzCepFMHJgiyacdcQxVkunYgGlB8m6CcFUcTVbu7
+qkkhN1g1gEKX3wMZVjwrSfmSoAuGsUciOS90T30HkOiDvzVxmnE9TuyhDHRKvANp
+OpNNcUlJHbPondkslHvf3xEO3Q+40M65NjH9GEtepU0aEixKCjPSxnWiwiMM6PFC
+NRtLJu+aQrP1wHOj2eHbaAstiTf20NKTfGbAFGVlskQcPTkNOYe2unZCUsVNyQwW
+KKbaa4Dk1g8SNpiIbyeovsVMS41Ul+/wg3qoT6G7CJd5UBzUFyjnKPz/OFjALOwW
+YCwNDKkmNEOtA/UCAwEAAaOCAhcwggITMAwGA1UdEwEB/wQCMAAwHwYDVR0jBBgw
+FoAUIjAu0vv2S8rAuDvSBMTpcuaXmwwwDgYDVR0PAQH/BAQDAgeAMB0GA1UdJQQW
+MBQGCCsGAQUFBwMBBggrBgEFBQcDAjBHBgNVHSAEQDA+MDEGBWeBDAEBMCgwJgYI
+KwYBBQUHAgEWGmh0dHBzOi8vd3d3LmJ1eXBhc3Mubm8vY3BzMAkGBwQAi+xAAQQw
+OgYDVR0fBDMwMTAvoC2gK4YpaHR0cDovL2NybC5idXlwYXNzLm5vL2NybC9CUENs
+YXNzM0NBMi5jcmwwJAYDVR0RBB0wG4IZbXRmLm1jZW5ldHQubWFzdGVyY2FyZC5u
+bzBqBggrBgEFBQcBAQReMFwwIwYIKwYBBQUHMAGGF2h0dHA6Ly9vY3NwLmJ1eXBh
+c3MuY29tMDUGCCsGAQUFBzAChilodHRwOi8vY3J0LmJ1eXBhc3Mubm8vY3J0L0JQ
+Q2xhc3MzQ0EyLmNlcjBmBggrBgEFBQcBAwRaMFgwCAYGBACORgEBMBMGBgQAjkYB
+BjAJBgcEAI5GAQYDMDcGBgQAjkYBBTAtMCsWJWh0dHBzOi8vd3d3LmJ1eXBhc3Mu
+bm8vcGRzL3Bkc19lbi5wZGYTAnh4MBMGCisGAQQB1nkCBAMBAf8EAgUAMB8GBWeB
+DAMBBBYwFBMDTlRSEwJOTwwJOTIyOTg4ODYyMA0GCSqGSIb3DQEBCwUAA4IBAQCn
+ai71nvvohRcNlvhBf7OQSDIjUXNLkftas7r794hKWeXDr2VgjLpgbeIB9lrjAtvb
+mzKjmt2BqAvrTzmSIu1EpWDmqKVboImlBCNJBWXjlWxIcmrYVU3XtxRjKxDYCUEY
+2aJ8UN0svQChjp05uEmJI7n/Wv/UFNbZXX9shLU/OwqutTA3c0qaCzL/Lu3Ohx2f
+FAOWh20FgrRV0TpNrGMDVjt2aBYA5HR3KAdGrZfONZLTk9YtCy/YYszrzS6oqvHD
+9fqpdKq7elkXnRHWsZIbA0WmhtdAhICOxkvkHiVf4J75p3Nykw+zwl6KVRWWcGp+
+BM55iz4S8tNifYOk+4Nu
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.subject.rdnSequence,EvSubscriberAttributeAllowanceValidator,WARNING,cabf.ev_guidelines.common_name_attribute_present,
+certificate.tbsCertificate.extensions.4.extnValue.certificatePolicies.0.policyQualifiers.0,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
+certificate.tbsCertificate.extensions.8.extnValue.qCStatements.2.statementInfo.qcEuPDS.0,QcEuPDSLanguageValidator,ERROR,etsi.en_319_412_5.gen-4.3.4.iso_language_code_invalid,"Invalid language code found: ""xx"""
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 1.3.6.1.5.5.7.1.3
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 2.23.140.3.1
diff --git a/tests/integration_certificate/etsi/qevcp_w_eidas_pre_certificate/qc_sscd_present.crttest b/tests/integration_certificate/etsi/qevcp_w_eidas_pre_certificate/qc_sscd_present.crttest
new file mode 100644
index 0000000..3b9a799
--- /dev/null
+++ b/tests/integration_certificate/etsi/qevcp_w_eidas_pre_certificate/qc_sscd_present.crttest
@@ -0,0 +1,53 @@
+-----BEGIN CERTIFICATE-----
+MIIHdzCCBV+gAwIBAgIMFzle8tVI5MLthWVyMA0GCSqGSIb3DQEBCwUAMFkxCzAJ
+BgNVBAYTAkdCMRswGQYDVQQKExJHTU8gR2xvYmFsU2lnbiBMdGQxLTArBgNVBAMT
+JEdsb2JhbFNpZ24gR0NDIFIzIFVLIEVWIFFXQUMgQ0EgMjAyMDAeFw0yMzA2MTYw
+ODMzMzRaFw0yNDA2MTUwODMzMzNaMIHyMR0wGwYDVQQPDBRQcml2YXRlIE9yZ2Fu
+aXphdGlvbjEVMBMGA1UEBRMMMDQ1OS4xMzQuMjU2MRMwEQYLKwYBBAGCNzwCAQMT
+AkJFMQswCQYDVQQGEwJCRTEXMBUGA1UECAwOVmxhYW1zLUJyYWJhbnQxDzANBgNV
+BAcMBkxldXZlbjEXMBUGA1UECQwORGllc3RzZXZlc3QgMTQxFjAUBgNVBAoMDUds
+b2JhbFNpZ24gTlYxIDAeBgNVBAMMF3d3dy5nbG9iYWxzaWduLWRlbW8uY29tMRsw
+GQYDVQRhDBJOVFJCRS0wNDU5LjEzNC4yNTYwggEiMA0GCSqGSIb3DQEBAQUAA4IB
+DwAwggEKAoIBAQCpn0FCPXqC0Lx5clF4Qq4ez3CW3iLRJegKqMaD84PN504skXsY
+bDhLz+naT3naIqsYJUV9A+b01BRVgMR4vZpZ27EY28tRwRf9s7eImzO5QXFPoG+i
+2ztRC7rE4Q33HO5SRKp3ZEV9Es8fW3/mJxGrLFJuS7c6sX0bU/dBdISw1j0pM/8+
+oXN0Kiy/vcMULkP/eL6nmj45jklIFoRxb0AZzemQijj+t8fz8bLWZISLBzvqmL0Y
+hjpCkLnyjgVM5xtElSPf7/a7J7jnaleZ3gJhxYF+FndyHooaBAHxFA32BmSgV3PD
+Rgq3eLMUGrngSlGNXbTWMxnUTh93lrqiturXAgMBAAGjggKjMIICnzBEBgNVHR8E
+PTA7MDmgN6A1hjNodHRwOi8vY3JsLmdsb2JhbHNpZ24uY29tL2dzZ2NjcjN1a2V2
+cXdhY2NhMjAyMC5jcmwwNwYIKwYBBQUHAQMEKzApMAgGBgQAjkYBATATBgYEAI5G
+AQYwCQYHBACORgEGAzAIBgYEAI5GAQQwgZkGCCsGAQUFBwEBBIGMMIGJMEkGCCsG
+AQUFBzAChj1odHRwOi8vc2VjdXJlLmdsb2JhbHNpZ24uY29tL2NhY2VydC9nc2dj
+Y3IzdWtldnF3YWNjYTIwMjAuY3J0MDwGCCsGAQUFBzABhjBodHRwOi8vb2NzcC5n
+bG9iYWxzaWduLmNvbS9nc2djY3IzdWtldnF3YWNjYTIwMjAwgacGA1UdIASBnzCB
+nDBBBgkrBgEEAaAyAQEwNDAyBggrBgEFBQcCARYmaHR0cHM6Ly93d3cuZ2xvYmFs
+c2lnbi5jb20vcmVwb3NpdG9yeS8wBwYFZ4EMAQEwCQYHBACL7EABBDBDBgsrBgEE
+AaAyASwoATA0MDIGCCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNv
+bS9yZXBvc2l0b3J5LzAiBgNVHREEGzAZghd3d3cuZ2xvYmFsc2lnbi1kZW1vLmNv
+bTAiBgVngQwDAQQZMBcTA05UUhMCQkUMDDA0NTkuMTM0LjI1NjAMBgNVHRMBAf8E
+AjAAMB8GA1UdIwQYMBaAFAeUNkpRlUn97ioGeTZ/wjc7Ttu/MB0GA1UdJQQWMBQG
+CCsGAQUFBwMCBggrBgEFBQcDATAdBgNVHQ4EFgQUzAkXOmPl1fx/NWnnM2kcUxBA
+Z5QwDgYDVR0PAQH/BAQDAgeAMBMGCisGAQQB1nkCBAMBAf8EAgUAMA0GCSqGSIb3
+DQEBCwUAA4ICAQCaXlFvQuIgDR/2ARtUwmknMv2K0hARJ8jIXp+uiOoyEejR2HZe
+tKOKKXdLZVeFHAV1gujMujStu7zu/weqnoACLLPyZfizxT1CpImPOorvYDzKWOJW
+z22Dwg7uxk5HuFmxVla2mru12bdQho0JDmsldMJlc7Mq3S7Q88AOUkmiroaSEsQ+
+joZ4NILZtcl2rkD2U/aTOBkUh80CJpyZP8QHD16ztD9sWmBtRtHRnCAdxbZAkKAq
+3VQ/qCYT7OkTcui2xh327ZPwmNJiYILJ5vRIheiZIuj31x3FkmXus/f8nTX/p1Mm
+Dn1sx2vpuyQ5vGyX8knXyfwqe1NiNKq0QT+1bqLggT2Li21S9XavwFclx6IuRDlB
+FWMgJTGPgn2ZIpzmsfOxeCvQAKJWVdvGgDItRPSGnAs3WHeSmQPobW8Qm/LareZc
+oDwUBT70C6EMm6cc9C2XVDHPs5wW9eIWL8IF1Jd03tXIIDIfuIHnFX3o/UCkHCCN
+4nQSIp57CI8Z5mDbpj3G0jEAnJyYGTPXR6MugsSuY8tTYIyN2y0qXzYxw8PRAMBK
+q4f+ZYAHj/I54QT/Rvj2Wyhna9QNBvjWgImHPEDrIZ4MGlTeJuL7WjsQhfQZjQ3a
+w24SEg51Sf1UTQ80xAZJoK8Q3kTzymzUZgqeutUtYrTgXjzd4Mv+52YQoQ==
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.subject.rdnSequence,EvSubscriberAttributeAllowanceValidator,WARNING,cabf.ev_guidelines.common_name_attribute_present,
+certificate.tbsCertificate.extensions.1.extnValue.qCStatements,QcStatementIdentifierAllowanceValidator,ERROR,etsi.en_319_412_5.qcs-5.01.qc_sscd_qualified_statement_present,
+certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies,SubscriberPoliciesValidator,WARNING,cabf.serverauth.subscriber_first_policy_oid_not_reserved,
+certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies.0.policyQualifiers.0,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
+certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies.3.policyQualifiers.0,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
+certificate.tbsCertificate.extensions.9.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.subject_key_identifier_extension_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 1.3.6.1.5.5.7.1.3
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 2.23.140.3.1
diff --git a/tests/integration_certificate/etsi/qevcp_w_eidas_pre_certificate/qc_type_missing.crttest b/tests/integration_certificate/etsi/qevcp_w_eidas_pre_certificate/qc_type_missing.crttest
new file mode 100644
index 0000000..1fcb829
--- /dev/null
+++ b/tests/integration_certificate/etsi/qevcp_w_eidas_pre_certificate/qc_type_missing.crttest
@@ -0,0 +1,53 @@
+-----BEGIN CERTIFICATE-----
+MIIHWDCCBUCgAwIBAgIMFzle8tVI5MLthWVyMA0GCSqGSIb3DQEBCwUAMFkxCzAJ
+BgNVBAYTAkdCMRswGQYDVQQKExJHTU8gR2xvYmFsU2lnbiBMdGQxLTArBgNVBAMT
+JEdsb2JhbFNpZ24gR0NDIFIzIFVLIEVWIFFXQUMgQ0EgMjAyMDAeFw0yMzA2MTYw
+ODMzMzRaFw0yNDA2MTUwODMzMzNaMIHyMR0wGwYDVQQPDBRQcml2YXRlIE9yZ2Fu
+aXphdGlvbjEVMBMGA1UEBRMMMDQ1OS4xMzQuMjU2MRMwEQYLKwYBBAGCNzwCAQMT
+AkJFMQswCQYDVQQGEwJCRTEXMBUGA1UECAwOVmxhYW1zLUJyYWJhbnQxDzANBgNV
+BAcMBkxldXZlbjEXMBUGA1UECQwORGllc3RzZXZlc3QgMTQxFjAUBgNVBAoMDUds
+b2JhbFNpZ24gTlYxIDAeBgNVBAMMF3d3dy5nbG9iYWxzaWduLWRlbW8uY29tMRsw
+GQYDVQRhDBJOVFJCRS0wNDU5LjEzNC4yNTYwggEiMA0GCSqGSIb3DQEBAQUAA4IB
+DwAwggEKAoIBAQCpn0FCPXqC0Lx5clF4Qq4ez3CW3iLRJegKqMaD84PN504skXsY
+bDhLz+naT3naIqsYJUV9A+b01BRVgMR4vZpZ27EY28tRwRf9s7eImzO5QXFPoG+i
+2ztRC7rE4Q33HO5SRKp3ZEV9Es8fW3/mJxGrLFJuS7c6sX0bU/dBdISw1j0pM/8+
+oXN0Kiy/vcMULkP/eL6nmj45jklIFoRxb0AZzemQijj+t8fz8bLWZISLBzvqmL0Y
+hjpCkLnyjgVM5xtElSPf7/a7J7jnaleZ3gJhxYF+FndyHooaBAHxFA32BmSgV3PD
+Rgq3eLMUGrngSlGNXbTWMxnUTh93lrqiturXAgMBAAGjggKEMIICgDBEBgNVHR8E
+PTA7MDmgN6A1hjNodHRwOi8vY3JsLmdsb2JhbHNpZ24uY29tL2dzZ2NjcjN1a2V2
+cXdhY2NhMjAyMC5jcmwwGAYIKwYBBQUHAQMEDDAKMAgGBgQAjkYBATCBmQYIKwYB
+BQUHAQEEgYwwgYkwSQYIKwYBBQUHMAKGPWh0dHA6Ly9zZWN1cmUuZ2xvYmFsc2ln
+bi5jb20vY2FjZXJ0L2dzZ2NjcjN1a2V2cXdhY2NhMjAyMC5jcnQwPAYIKwYBBQUH
+MAGGMGh0dHA6Ly9vY3NwLmdsb2JhbHNpZ24uY29tL2dzZ2NjcjN1a2V2cXdhY2Nh
+MjAyMDCBpwYDVR0gBIGfMIGcMEEGCSsGAQQBoDIBATA0MDIGCCsGAQUFBwIBFiZo
+dHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzAHBgVngQwBATAJ
+BgcEAIvsQAEEMEMGCysGAQQBoDIBLCgBMDQwMgYIKwYBBQUHAgEWJmh0dHBzOi8v
+d3d3Lmdsb2JhbHNpZ24uY29tL3JlcG9zaXRvcnkvMCIGA1UdEQQbMBmCF3d3dy5n
+bG9iYWxzaWduLWRlbW8uY29tMCIGBWeBDAMBBBkwFxMDTlRSEwJCRQwMMDQ1OS4x
+MzQuMjU2MAwGA1UdEwEB/wQCMAAwHwYDVR0jBBgwFoAUB5Q2SlGVSf3uKgZ5Nn/C
+NztO278wHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMBMB0GA1UdDgQWBBTM
+CRc6Y+XV/H81aeczaRxTEEBnlDAOBgNVHQ8BAf8EBAMCB4AwEwYKKwYBBAHWeQIE
+AwEB/wQCBQAwDQYJKoZIhvcNAQELBQADggIBAJpeUW9C4iANH/YBG1TCaScy/YrS
+EBEnyMhen66I6jIR6NHYdl60o4opd0tlV4UcBXWC6My6NK27vO7/B6qegAIss/Jl
++LPFPUKkiY86iu9gPMpY4lbPbYPCDu7GTke4WbFWVraau7XZt1CGjQkOayV0wmVz
+syrdLtDzwA5SSaKuhpISxD6Ohng0gtm1yXauQPZT9pM4GRSHzQImnJk/xAcPXrO0
+P2xaYG1G0dGcIB3FtkCQoCrdVD+oJhPs6RNy6LbGHfbtk/CY0mJggsnm9EiF6Jki
+6PfXHcWSZe6z9/ydNf+nUyYOfWzHa+m7JDm8bJfySdfJ/Cp7U2I0qrRBP7VuouCB
+PYuLbVL1dq/AVyXHoi5EOUEVYyAlMY+CfZkinOax87F4K9AAolZV28aAMi1E9Iac
+CzdYd5KZA+htbxCb8tqt5lygPBQFPvQLoQybpxz0LZdUMc+znBb14hYvwgXUl3Te
+1cggMh+4gecVfej9QKQcII3idBIinnsIjxnmYNumPcbSMQCcnJgZM9dHoy6CxK5j
+y1NgjI3bLSpfNjHDw9EAwEqrh/5lgAeP8jnhBP9G+PZbKGdr1A0G+NaAiYc8QOsh
+ngwaVN4m4vtaOxCF9BmNDdrDbhISDnVJ/VRNDzTEBkmgrxDeRPPKbNRmCp661S1i
+tOBePN3gy/7nZhCh
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.subject.rdnSequence,EvSubscriberAttributeAllowanceValidator,WARNING,cabf.ev_guidelines.common_name_attribute_present,
+certificate.tbsCertificate.extensions.1.extnValue.qCStatements,QcStatementIdentifierAllowanceValidator,ERROR,etsi.en_319_412_5.qcs-5.01.qc_type_qualified_statement_absent,
+certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies,SubscriberPoliciesValidator,WARNING,cabf.serverauth.subscriber_first_policy_oid_not_reserved,
+certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies.0.policyQualifiers.0,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
+certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies.3.policyQualifiers.0,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
+certificate.tbsCertificate.extensions.9.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.subject_key_identifier_extension_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 1.3.6.1.5.5.7.1.3
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 2.23.140.3.1
diff --git a/tests/integration_certificate/etsi/qevcp_w_eidas_pre_certificate/qcstatements_marked_critical.crttest b/tests/integration_certificate/etsi/qevcp_w_eidas_pre_certificate/qcstatements_marked_critical.crttest
new file mode 100644
index 0000000..3b36693
--- /dev/null
+++ b/tests/integration_certificate/etsi/qevcp_w_eidas_pre_certificate/qcstatements_marked_critical.crttest
@@ -0,0 +1,45 @@
+-----BEGIN CERTIFICATE-----
+MIIGHjCCBQagAwIBAgIQd81wE7elcBswLL1AwmWAHDANBgkqhkiG9w0BAQsFADCB
+kzELMAkGA1UEBhMCRVMxHjAcBgNVBAoMFUZpcm1hcHJvZmVzaW9uYWwgUy5BLjEY
+MBYGA1UEYQwPVkFURVMtQTYyNjM0MDY4MRowGAYDVQQLDBFTZWN1cml0eSBTZXJ2
+aWNlczEuMCwGA1UEAwwlQUMgRmlybWFwcm9mZXNpb25hbCAtIFNlY3VyZSBXZWIg
+MjAyMjAeFw0yMzEyMjExNDQ4MjJaFw0yNDEyMjAxNDQ4MjFaMIG9MQswCQYDVQQG
+EwJFUzETMBEGA1UEBwwKTGFzIFBhbG1hczEgMB4GA1UECgwXQXl1bnRhbWllbnRv
+IGRlIFR1aW5lamUxGDAWBgNVBGEMD1ZBVEVTLVAzNTAzMDAwRjESMBAGA1UEBRMJ
+UDM1MDMwMDBGMRgwFgYDVQQDDA9zZWRlLnR1aW5lamUuZXMxGjAYBgNVBA8MEUdv
+dmVybm1lbnQgRW50aXR5MRMwEQYLKwYBBAGCNzwCAQMTAkVTMIIBIjANBgkqhkiG
+9w0BAQEFAAOCAQ8AMIIBCgKCAQEAou+i41mGIjeY9J/zX8K/VgSpwT8cU+8NiVqB
+aE5o/hQppNnDdLabjDogr7oNTl3x0ImDcbwSm/yTBhe8nqVjZJMv+AVX6aQI/Fgr
+K+Er8IzgCLRs5pi3fDnw4VcSKE4hPMCFIkrUu946u7noMLkui5TdvHS7bzO+LHze
+TvOVBtsjSPfRt5fLvOpjRcmorPqOnNe3wMoWVFwORiYgxD1+BV0pci42y8cY1QjL
+bz6S/CWUCvbGa9/7TOr//7YmftxGF5heGi9GlyQmBxDApDh3Qkw1QmL5bl+BFgjb
+bdcT0nrw9tt0v+ZdCsxsjlFEV/W+2ru/c+/IYbmPu9KnSqEvAQIDAQABo4ICQDCC
+AjwwDAYDVR0TAQH/BAIwADAfBgNVHSMEGDAWgBSbjbH+RiIPNZBQOyRB+fM67Oy8
+8TB7BggrBgEFBQcBAQRvMG0wPQYIKwYBBQUHMAKGMWh0dHA6Ly9jcmwuZmlybWFw
+cm9mZXNpb25hbC5jb20vc2VjdXJld2ViMjAyMi5jcnQwLAYIKwYBBQUHMAGGIGh0
+dHA6Ly9vY3NwLmZpcm1hcHJvZmVzaW9uYWwuY29tMBoGA1UdEQQTMBGCD3NlZGUu
+dHVpbmVqZS5lczB1BgNVHSAEbjBsMAcGBWeBDAEBMEAGCysGAQQB5nkKARQCMDEw
+LwYIKwYBBQUHAgEWI2h0dHA6Ly93d3cuZmlybWFwcm9mZXNpb25hbC5jb20vY3Bz
+MAoGCGCFVAEDBQUCMAkGBwQAi+xAAQQwCAYGBACPegEEMBMGA1UdJQQMMAoGCCsG
+AQUFBwMBMD0GCCsGAQUFBwEDAQH/BC4wLDAIBgYEAI5GAQEwCwYGBACORgEDAgEP
+MBMGBgQAjkYBBjAJBgcEAI5GAQYDMB8GBWeBDAMBBBYwFBMDVkFUEwJFUwwJUDM1
+MDMwMDBGMEIGA1UdHwQ7MDkwN6A1oDOGMWh0dHA6Ly9jcmwuZmlybWFwcm9mZXNp
+b25hbC5jb20vc2VjdXJld2ViMjAyMi5jcmwwHQYDVR0OBBYEFOTCYUwoABFevj/5
+VyS2HA/d6sl9MA4GA1UdDwEB/wQEAwIFoDATBgorBgEEAdZ5AgQDAQH/BAIFADAN
+BgkqhkiG9w0BAQsFAAOCAQEAkm9spZtRwdm7z2BttjOR0Hg7VpF9v88awHHk7yzZ
+7Y0+1TwC7bxgsgVdOFYut2OHiG4rmR0s81HucRz07iaGOnulsUrAufbfioXj+5bm
+ssqHCde6ucwHwn08BLYRgU++Cq5fjYN3OpYiKAejI9ZLIlf4LkcVSbt5WjU6+1kj
+7eagoo/qSCWmaGnyDk6MfTeMe5JxhQHlkVPYDO3Z8x+YJ4rRU6pdXCPUACP/PIjL
+gnx+3blQUXtPnKnXMjFz0XNIAL7vfF8WR5bEbRWDXhtxc0OC1DYn8fOWGtMgmGQ0
+quILcVEl0fWJ4Tyao+PKiNgrNtiWKmTa73e4YQg9Tj7CCg==
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.subject.rdnSequence,EvSubscriberAttributeAllowanceValidator,WARNING,cabf.ev_guidelines.common_name_attribute_present,
+certificate.tbsCertificate.extensions.4.extnValue.certificatePolicies.1.policyQualifiers.0,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
+certificate.tbsCertificate.extensions.6,QcStatementsExtensionCriticalityValidator,ERROR,etsi.en_319_412_5.qcs-4.1-02.qcstatements_extension_is_critical,Extension 1.3.6.1.5.5.7.1.3 is critical
+certificate.tbsCertificate.extensions.9.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
+certificate.tbsCertificate.extensions.10.extnValue.keyUsage,SubscriberKeyUsageValidator,WARNING,cabf.serverauth.subscriber_rsa_digitalsignature_and_keyencipherment_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.subject_key_identifier_extension_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 1.3.6.1.5.5.7.1.3
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 2.23.140.3.1
diff --git a/tests/integration_certificate/etsi/qevcp_w_eidas_pre_certificate/same_orgname_and_orgid.crttest b/tests/integration_certificate/etsi/qevcp_w_eidas_pre_certificate/same_orgname_and_orgid.crttest
new file mode 100644
index 0000000..1e1df7e
--- /dev/null
+++ b/tests/integration_certificate/etsi/qevcp_w_eidas_pre_certificate/same_orgname_and_orgid.crttest
@@ -0,0 +1,40 @@
+-----BEGIN CERTIFICATE-----
+MIIFtDCCBJygAwIBAgIKTITWVCAMG9n4rDANBgkqhkiG9w0BAQsFADBLMQswCQYD
+VQQGEwJOTzEdMBsGA1UECgwUQnV5cGFzcyBBUy05ODMxNjMzMjcxHTAbBgNVBAMM
+FEJ1eXBhc3MgQ2xhc3MgMyBDQSAyMB4XDTI0MDIxNDEwMzQyMFoXDTI1MDIxMzIy
+NTkwMFowgcsxCzAJBgNVBAYTAk5PMQ0wCwYDVQQHDARPU0xPMQ0wCwYDVQQRDAQw
+OTc4MRgwFgYDVQQKDA9OVFJOTy05MjI5ODg4NjIxHTAbBgNVBA8MFFByaXZhdGUg
+T3JnYW5pemF0aW9uMRMwEQYLKwYBBAGCNzwCAQMTAk5PMRIwEAYDVQQFEwk5MjI5
+ODg4NjIxGDAWBgNVBGETD05UUk5PLTkyMjk4ODg2MjEiMCAGA1UEAxMZbXRmLm1j
+ZW5ldHQubWFzdGVyY2FyZC5ubzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC
+ggEBAMPkzQWj5Z5lDiodPsk7pYN7j9g9n1lYhzCepFMHJgiyacdcQxVkunYgGlB8
+m6CcFUcTVbu7qkkhN1g1gEKX3wMZVjwrSfmSoAuGsUciOS90T30HkOiDvzVxmnE9
+TuyhDHRKvANpOpNNcUlJHbPondkslHvf3xEO3Q+40M65NjH9GEtepU0aEixKCjPS
+xnWiwiMM6PFCNRtLJu+aQrP1wHOj2eHbaAstiTf20NKTfGbAFGVlskQcPTkNOYe2
+unZCUsVNyQwWKKbaa4Dk1g8SNpiIbyeovsVMS41Ul+/wg3qoT6G7CJd5UBzUFyjn
+KPz/OFjALOwWYCwNDKkmNEOtA/UCAwEAAaOCAhcwggITMAwGA1UdEwEB/wQCMAAw
+HwYDVR0jBBgwFoAUIjAu0vv2S8rAuDvSBMTpcuaXmwwwDgYDVR0PAQH/BAQDAgeA
+MB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjBHBgNVHSAEQDA+MDEGBWeB
+DAEBMCgwJgYIKwYBBQUHAgEWGmh0dHBzOi8vd3d3LmJ1eXBhc3Mubm8vY3BzMAkG
+BwQAi+xAAQQwOgYDVR0fBDMwMTAvoC2gK4YpaHR0cDovL2NybC5idXlwYXNzLm5v
+L2NybC9CUENsYXNzM0NBMi5jcmwwJAYDVR0RBB0wG4IZbXRmLm1jZW5ldHQubWFz
+dGVyY2FyZC5ubzBqBggrBgEFBQcBAQReMFwwIwYIKwYBBQUHMAGGF2h0dHA6Ly9v
+Y3NwLmJ1eXBhc3MuY29tMDUGCCsGAQUFBzAChilodHRwOi8vY3J0LmJ1eXBhc3Mu
+bm8vY3J0L0JQQ2xhc3MzQ0EyLmNlcjBmBggrBgEFBQcBAwRaMFgwCAYGBACORgEB
+MBMGBgQAjkYBBjAJBgcEAI5GAQYDMDcGBgQAjkYBBTAtMCsWJWh0dHBzOi8vd3d3
+LmJ1eXBhc3Mubm8vcGRzL3Bkc19lbi5wZGYTAmVuMBMGCisGAQQB1nkCBAMBAf8E
+AgUAMB8GBWeBDAMBBBYwFBMDTlRSEwJOTwwJOTIyOTg4ODYyMA0GCSqGSIb3DQEB
+CwUAA4IBAQCnai71nvvohRcNlvhBf7OQSDIjUXNLkftas7r794hKWeXDr2VgjLpg
+beIB9lrjAtvbmzKjmt2BqAvrTzmSIu1EpWDmqKVboImlBCNJBWXjlWxIcmrYVU3X
+txRjKxDYCUEY2aJ8UN0svQChjp05uEmJI7n/Wv/UFNbZXX9shLU/OwqutTA3c0qa
+CzL/Lu3Ohx2fFAOWh20FgrRV0TpNrGMDVjt2aBYA5HR3KAdGrZfONZLTk9YtCy/Y
+YszrzS6oqvHD9fqpdKq7elkXnRHWsZIbA0WmhtdAhICOxkvkHiVf4J75p3Nykw+z
+wl6KVRWWcGp+BM55iz4S8tNifYOk+4Nu
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.subject,LegalPersonOrganizationAttributesEqualityValidator,ERROR,etsi.en_319_412_3.leg-4.2.1-6.organization_id_and_organization_name_attribute_values_equal,"Organization name and identifier attribute values are equal: ""NTRNO-922988862"""
+certificate.tbsCertificate.subject.rdnSequence,EvSubscriberAttributeAllowanceValidator,WARNING,cabf.ev_guidelines.common_name_attribute_present,
+certificate.tbsCertificate.extensions.4.extnValue.certificatePolicies.0.policyQualifiers.0,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 1.3.6.1.5.5.7.1.3
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 2.23.140.3.1
diff --git a/tests/integration_certificate/etsi/qevcp_w_non_eidas_pre_certificate/country_code_bad.crttest b/tests/integration_certificate/etsi/qevcp_w_non_eidas_pre_certificate/country_code_bad.crttest
new file mode 100644
index 0000000..5702d12
--- /dev/null
+++ b/tests/integration_certificate/etsi/qevcp_w_non_eidas_pre_certificate/country_code_bad.crttest
@@ -0,0 +1,54 @@
+-----BEGIN CERTIFICATE-----
+MIIHfTCCBWWgAwIBAgIMFzle8tVI5MLthWVyMA0GCSqGSIb3DQEBCwUAMFkxCzAJ
+BgNVBAYTAkdCMRswGQYDVQQKExJHTU8gR2xvYmFsU2lnbiBMdGQxLTArBgNVBAMT
+JEdsb2JhbFNpZ24gR0NDIFIzIFVLIEVWIFFXQUMgQ0EgMjAyMDAeFw0yMzA2MTYw
+ODMzMzRaFw0yNDA2MTUwODMzMzNaMIHyMR0wGwYDVQQPDBRQcml2YXRlIE9yZ2Fu
+aXphdGlvbjEVMBMGA1UEBRMMMDQ1OS4xMzQuMjU2MRMwEQYLKwYBBAGCNzwCAQMT
+AkJFMQswCQYDVQQGEwJCRTEXMBUGA1UECAwOVmxhYW1zLUJyYWJhbnQxDzANBgNV
+BAcMBkxldXZlbjEXMBUGA1UECQwORGllc3RzZXZlc3QgMTQxFjAUBgNVBAoMDUds
+b2JhbFNpZ24gTlYxIDAeBgNVBAMMF3d3dy5nbG9iYWxzaWduLWRlbW8uY29tMRsw
+GQYDVQRhDBJOVFJCRS0wNDU5LjEzNC4yNTYwggEiMA0GCSqGSIb3DQEBAQUAA4IB
+DwAwggEKAoIBAQCpn0FCPXqC0Lx5clF4Qq4ez3CW3iLRJegKqMaD84PN504skXsY
+bDhLz+naT3naIqsYJUV9A+b01BRVgMR4vZpZ27EY28tRwRf9s7eImzO5QXFPoG+i
+2ztRC7rE4Q33HO5SRKp3ZEV9Es8fW3/mJxGrLFJuS7c6sX0bU/dBdISw1j0pM/8+
+oXN0Kiy/vcMULkP/eL6nmj45jklIFoRxb0AZzemQijj+t8fz8bLWZISLBzvqmL0Y
+hjpCkLnyjgVM5xtElSPf7/a7J7jnaleZ3gJhxYF+FndyHooaBAHxFA32BmSgV3PD
+Rgq3eLMUGrngSlGNXbTWMxnUTh93lrqiturXAgMBAAGjggKpMIICpTBEBgNVHR8E
+PTA7MDmgN6A1hjNodHRwOi8vY3JsLmdsb2JhbHNpZ24uY29tL2dzZ2NjcjN1a2V2
+cXdhY2NhMjAyMC5jcmwwPQYIKwYBBQUHAQMEMTAvMAgGBgQAjkYBATATBgYEAI5G
+AQYwCQYHBACORgEGAzAOBgYEAI5GAQcwBBMCWlowgZkGCCsGAQUFBwEBBIGMMIGJ
+MEkGCCsGAQUFBzAChj1odHRwOi8vc2VjdXJlLmdsb2JhbHNpZ24uY29tL2NhY2Vy
+dC9nc2djY3IzdWtldnF3YWNjYTIwMjAuY3J0MDwGCCsGAQUFBzABhjBodHRwOi8v
+b2NzcC5nbG9iYWxzaWduLmNvbS9nc2djY3IzdWtldnF3YWNjYTIwMjAwgacGA1Ud
+IASBnzCBnDBBBgkrBgEEAaAyAQEwNDAyBggrBgEFBQcCARYmaHR0cHM6Ly93d3cu
+Z2xvYmFsc2lnbi5jb20vcmVwb3NpdG9yeS8wBwYFZ4EMAQEwCQYHBACL7EABBDBD
+BgsrBgEEAaAyASwoATA0MDIGCCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxz
+aWduLmNvbS9yZXBvc2l0b3J5LzAiBgNVHREEGzAZghd3d3cuZ2xvYmFsc2lnbi1k
+ZW1vLmNvbTAiBgVngQwDAQQZMBcTA05UUhMCQkUMDDA0NTkuMTM0LjI1NjAMBgNV
+HRMBAf8EAjAAMB8GA1UdIwQYMBaAFAeUNkpRlUn97ioGeTZ/wjc7Ttu/MB0GA1Ud
+JQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATAdBgNVHQ4EFgQUzAkXOmPl1fx/NWnn
+M2kcUxBAZ5QwDgYDVR0PAQH/BAQDAgeAMBMGCisGAQQB1nkCBAMBAf8EAgUAMA0G
+CSqGSIb3DQEBCwUAA4ICAQCaXlFvQuIgDR/2ARtUwmknMv2K0hARJ8jIXp+uiOoy
+EejR2HZetKOKKXdLZVeFHAV1gujMujStu7zu/weqnoACLLPyZfizxT1CpImPOorv
+YDzKWOJWz22Dwg7uxk5HuFmxVla2mru12bdQho0JDmsldMJlc7Mq3S7Q88AOUkmi
+roaSEsQ+joZ4NILZtcl2rkD2U/aTOBkUh80CJpyZP8QHD16ztD9sWmBtRtHRnCAd
+xbZAkKAq3VQ/qCYT7OkTcui2xh327ZPwmNJiYILJ5vRIheiZIuj31x3FkmXus/f8
+nTX/p1MmDn1sx2vpuyQ5vGyX8knXyfwqe1NiNKq0QT+1bqLggT2Li21S9XavwFcl
+x6IuRDlBFWMgJTGPgn2ZIpzmsfOxeCvQAKJWVdvGgDItRPSGnAs3WHeSmQPobW8Q
+m/LareZcoDwUBT70C6EMm6cc9C2XVDHPs5wW9eIWL8IF1Jd03tXIIDIfuIHnFX3o
+/UCkHCCN4nQSIp57CI8Z5mDbpj3G0jEAnJyYGTPXR6MugsSuY8tTYIyN2y0qXzYx
+w8PRAMBKq4f+ZYAHj/I54QT/Rvj2Wyhna9QNBvjWgImHPEDrIZ4MGlTeJuL7WjsQ
+hfQZjQ3aw24SEg51Sf1UTQ80xAZJoK8Q3kTzymzUZgqeutUtYrTgXjzd4Mv+52YQ
+oQ==
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.extensions.1.extnValue.qCStatements.2.statementInfo.qcCClegislation,QcCCLegislationCountryCodeValidator,ERROR,etsi.en_319_412_5.gen-4.2.4.iso_country_code_invalid,"Invalid country code found: ""ZZ"""
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.subject_key_identifier_extension_present,
+certificate.tbsCertificate.extensions.9.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
+certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies,SubscriberPoliciesValidator,WARNING,cabf.serverauth.subscriber_first_policy_oid_not_reserved,
+certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies.3.policyQualifiers.0,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
+certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies.0.policyQualifiers.0,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
+certificate.tbsCertificate.subject.rdnSequence,EvSubscriberAttributeAllowanceValidator,WARNING,cabf.ev_guidelines.common_name_attribute_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 1.3.6.1.5.5.7.1.3
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 2.23.140.3.1
diff --git a/tests/integration_certificate/etsi/qevcp_w_non_eidas_pre_certificate/country_code_empty.crttest b/tests/integration_certificate/etsi/qevcp_w_non_eidas_pre_certificate/country_code_empty.crttest
new file mode 100644
index 0000000..f5f8aae
--- /dev/null
+++ b/tests/integration_certificate/etsi/qevcp_w_non_eidas_pre_certificate/country_code_empty.crttest
@@ -0,0 +1,53 @@
+-----BEGIN CERTIFICATE-----
+MIIHeTCCBWGgAwIBAgIMFzle8tVI5MLthWVyMA0GCSqGSIb3DQEBCwUAMFkxCzAJ
+BgNVBAYTAkdCMRswGQYDVQQKExJHTU8gR2xvYmFsU2lnbiBMdGQxLTArBgNVBAMT
+JEdsb2JhbFNpZ24gR0NDIFIzIFVLIEVWIFFXQUMgQ0EgMjAyMDAeFw0yMzA2MTYw
+ODMzMzRaFw0yNDA2MTUwODMzMzNaMIHyMR0wGwYDVQQPDBRQcml2YXRlIE9yZ2Fu
+aXphdGlvbjEVMBMGA1UEBRMMMDQ1OS4xMzQuMjU2MRMwEQYLKwYBBAGCNzwCAQMT
+AkJFMQswCQYDVQQGEwJCRTEXMBUGA1UECAwOVmxhYW1zLUJyYWJhbnQxDzANBgNV
+BAcMBkxldXZlbjEXMBUGA1UECQwORGllc3RzZXZlc3QgMTQxFjAUBgNVBAoMDUds
+b2JhbFNpZ24gTlYxIDAeBgNVBAMMF3d3dy5nbG9iYWxzaWduLWRlbW8uY29tMRsw
+GQYDVQRhDBJOVFJCRS0wNDU5LjEzNC4yNTYwggEiMA0GCSqGSIb3DQEBAQUAA4IB
+DwAwggEKAoIBAQCpn0FCPXqC0Lx5clF4Qq4ez3CW3iLRJegKqMaD84PN504skXsY
+bDhLz+naT3naIqsYJUV9A+b01BRVgMR4vZpZ27EY28tRwRf9s7eImzO5QXFPoG+i
+2ztRC7rE4Q33HO5SRKp3ZEV9Es8fW3/mJxGrLFJuS7c6sX0bU/dBdISw1j0pM/8+
+oXN0Kiy/vcMULkP/eL6nmj45jklIFoRxb0AZzemQijj+t8fz8bLWZISLBzvqmL0Y
+hjpCkLnyjgVM5xtElSPf7/a7J7jnaleZ3gJhxYF+FndyHooaBAHxFA32BmSgV3PD
+Rgq3eLMUGrngSlGNXbTWMxnUTh93lrqiturXAgMBAAGjggKlMIICoTBEBgNVHR8E
+PTA7MDmgN6A1hjNodHRwOi8vY3JsLmdsb2JhbHNpZ24uY29tL2dzZ2NjcjN1a2V2
+cXdhY2NhMjAyMC5jcmwwOQYIKwYBBQUHAQMELTArMAgGBgQAjkYBATATBgYEAI5G
+AQYwCQYHBACORgEGAzAKBgYEAI5GAQcwADCBmQYIKwYBBQUHAQEEgYwwgYkwSQYI
+KwYBBQUHMAKGPWh0dHA6Ly9zZWN1cmUuZ2xvYmFsc2lnbi5jb20vY2FjZXJ0L2dz
+Z2NjcjN1a2V2cXdhY2NhMjAyMC5jcnQwPAYIKwYBBQUHMAGGMGh0dHA6Ly9vY3Nw
+Lmdsb2JhbHNpZ24uY29tL2dzZ2NjcjN1a2V2cXdhY2NhMjAyMDCBpwYDVR0gBIGf
+MIGcMEEGCSsGAQQBoDIBATA0MDIGCCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9i
+YWxzaWduLmNvbS9yZXBvc2l0b3J5LzAHBgVngQwBATAJBgcEAIvsQAEEMEMGCysG
+AQQBoDIBLCgBMDQwMgYIKwYBBQUHAgEWJmh0dHBzOi8vd3d3Lmdsb2JhbHNpZ24u
+Y29tL3JlcG9zaXRvcnkvMCIGA1UdEQQbMBmCF3d3dy5nbG9iYWxzaWduLWRlbW8u
+Y29tMCIGBWeBDAMBBBkwFxMDTlRSEwJCRQwMMDQ1OS4xMzQuMjU2MAwGA1UdEwEB
+/wQCMAAwHwYDVR0jBBgwFoAUB5Q2SlGVSf3uKgZ5Nn/CNztO278wHQYDVR0lBBYw
+FAYIKwYBBQUHAwIGCCsGAQUFBwMBMB0GA1UdDgQWBBTMCRc6Y+XV/H81aeczaRxT
+EEBnlDAOBgNVHQ8BAf8EBAMCB4AwEwYKKwYBBAHWeQIEAwEB/wQCBQAwDQYJKoZI
+hvcNAQELBQADggIBAJpeUW9C4iANH/YBG1TCaScy/YrSEBEnyMhen66I6jIR6NHY
+dl60o4opd0tlV4UcBXWC6My6NK27vO7/B6qegAIss/Jl+LPFPUKkiY86iu9gPMpY
+4lbPbYPCDu7GTke4WbFWVraau7XZt1CGjQkOayV0wmVzsyrdLtDzwA5SSaKuhpIS
+xD6Ohng0gtm1yXauQPZT9pM4GRSHzQImnJk/xAcPXrO0P2xaYG1G0dGcIB3FtkCQ
+oCrdVD+oJhPs6RNy6LbGHfbtk/CY0mJggsnm9EiF6Jki6PfXHcWSZe6z9/ydNf+n
+UyYOfWzHa+m7JDm8bJfySdfJ/Cp7U2I0qrRBP7VuouCBPYuLbVL1dq/AVyXHoi5E
+OUEVYyAlMY+CfZkinOax87F4K9AAolZV28aAMi1E9IacCzdYd5KZA+htbxCb8tqt
+5lygPBQFPvQLoQybpxz0LZdUMc+znBb14hYvwgXUl3Te1cggMh+4gecVfej9QKQc
+II3idBIinnsIjxnmYNumPcbSMQCcnJgZM9dHoy6CxK5jy1NgjI3bLSpfNjHDw9EA
+wEqrh/5lgAeP8jnhBP9G+PZbKGdr1A0G+NaAiYc8QOshngwaVN4m4vtaOxCF9BmN
+DdrDbhISDnVJ/VRNDzTEBkmgrxDeRPPKbNRmCp661S1itOBePN3gy/7nZhCh
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.extensions.1.extnValue.qCStatements.2.statementInfo.qcCClegislation,QcCCLegislationCountryCodeValidator,ERROR,etsi.en_319_412_5.gen-4.2.4.iso_country_code_list_empty,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.subject_key_identifier_extension_present,
+certificate.tbsCertificate.extensions.9.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
+certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies,SubscriberPoliciesValidator,WARNING,cabf.serverauth.subscriber_first_policy_oid_not_reserved,
+certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies.3.policyQualifiers.0,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
+certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies.0.policyQualifiers.0,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
+certificate.tbsCertificate.subject.rdnSequence,EvSubscriberAttributeAllowanceValidator,WARNING,cabf.ev_guidelines.common_name_attribute_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 1.3.6.1.5.5.7.1.3
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 2.23.140.3.1
diff --git a/tests/integration_certificate/etsi/qevcp_w_non_eidas_pre_certificate/country_code_good.crttest b/tests/integration_certificate/etsi/qevcp_w_non_eidas_pre_certificate/country_code_good.crttest
new file mode 100644
index 0000000..b28638d
--- /dev/null
+++ b/tests/integration_certificate/etsi/qevcp_w_non_eidas_pre_certificate/country_code_good.crttest
@@ -0,0 +1,53 @@
+-----BEGIN CERTIFICATE-----
+MIIHfTCCBWWgAwIBAgIMFzle8tVI5MLthWVyMA0GCSqGSIb3DQEBCwUAMFkxCzAJ
+BgNVBAYTAkdCMRswGQYDVQQKExJHTU8gR2xvYmFsU2lnbiBMdGQxLTArBgNVBAMT
+JEdsb2JhbFNpZ24gR0NDIFIzIFVLIEVWIFFXQUMgQ0EgMjAyMDAeFw0yMzA2MTYw
+ODMzMzRaFw0yNDA2MTUwODMzMzNaMIHyMR0wGwYDVQQPDBRQcml2YXRlIE9yZ2Fu
+aXphdGlvbjEVMBMGA1UEBRMMMDQ1OS4xMzQuMjU2MRMwEQYLKwYBBAGCNzwCAQMT
+AkJFMQswCQYDVQQGEwJCRTEXMBUGA1UECAwOVmxhYW1zLUJyYWJhbnQxDzANBgNV
+BAcMBkxldXZlbjEXMBUGA1UECQwORGllc3RzZXZlc3QgMTQxFjAUBgNVBAoMDUds
+b2JhbFNpZ24gTlYxIDAeBgNVBAMMF3d3dy5nbG9iYWxzaWduLWRlbW8uY29tMRsw
+GQYDVQRhDBJOVFJCRS0wNDU5LjEzNC4yNTYwggEiMA0GCSqGSIb3DQEBAQUAA4IB
+DwAwggEKAoIBAQCpn0FCPXqC0Lx5clF4Qq4ez3CW3iLRJegKqMaD84PN504skXsY
+bDhLz+naT3naIqsYJUV9A+b01BRVgMR4vZpZ27EY28tRwRf9s7eImzO5QXFPoG+i
+2ztRC7rE4Q33HO5SRKp3ZEV9Es8fW3/mJxGrLFJuS7c6sX0bU/dBdISw1j0pM/8+
+oXN0Kiy/vcMULkP/eL6nmj45jklIFoRxb0AZzemQijj+t8fz8bLWZISLBzvqmL0Y
+hjpCkLnyjgVM5xtElSPf7/a7J7jnaleZ3gJhxYF+FndyHooaBAHxFA32BmSgV3PD
+Rgq3eLMUGrngSlGNXbTWMxnUTh93lrqiturXAgMBAAGjggKpMIICpTBEBgNVHR8E
+PTA7MDmgN6A1hjNodHRwOi8vY3JsLmdsb2JhbHNpZ24uY29tL2dzZ2NjcjN1a2V2
+cXdhY2NhMjAyMC5jcmwwPQYIKwYBBQUHAQMEMTAvMAgGBgQAjkYBATATBgYEAI5G
+AQYwCQYHBACORgEGAzAOBgYEAI5GAQcwBBMCR0IwgZkGCCsGAQUFBwEBBIGMMIGJ
+MEkGCCsGAQUFBzAChj1odHRwOi8vc2VjdXJlLmdsb2JhbHNpZ24uY29tL2NhY2Vy
+dC9nc2djY3IzdWtldnF3YWNjYTIwMjAuY3J0MDwGCCsGAQUFBzABhjBodHRwOi8v
+b2NzcC5nbG9iYWxzaWduLmNvbS9nc2djY3IzdWtldnF3YWNjYTIwMjAwgacGA1Ud
+IASBnzCBnDBBBgkrBgEEAaAyAQEwNDAyBggrBgEFBQcCARYmaHR0cHM6Ly93d3cu
+Z2xvYmFsc2lnbi5jb20vcmVwb3NpdG9yeS8wBwYFZ4EMAQEwCQYHBACL7EABBDBD
+BgsrBgEEAaAyASwoATA0MDIGCCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxz
+aWduLmNvbS9yZXBvc2l0b3J5LzAiBgNVHREEGzAZghd3d3cuZ2xvYmFsc2lnbi1k
+ZW1vLmNvbTAiBgVngQwDAQQZMBcTA05UUhMCQkUMDDA0NTkuMTM0LjI1NjAMBgNV
+HRMBAf8EAjAAMB8GA1UdIwQYMBaAFAeUNkpRlUn97ioGeTZ/wjc7Ttu/MB0GA1Ud
+JQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATAdBgNVHQ4EFgQUzAkXOmPl1fx/NWnn
+M2kcUxBAZ5QwDgYDVR0PAQH/BAQDAgeAMBMGCisGAQQB1nkCBAMBAf8EAgUAMA0G
+CSqGSIb3DQEBCwUAA4ICAQCaXlFvQuIgDR/2ARtUwmknMv2K0hARJ8jIXp+uiOoy
+EejR2HZetKOKKXdLZVeFHAV1gujMujStu7zu/weqnoACLLPyZfizxT1CpImPOorv
+YDzKWOJWz22Dwg7uxk5HuFmxVla2mru12bdQho0JDmsldMJlc7Mq3S7Q88AOUkmi
+roaSEsQ+joZ4NILZtcl2rkD2U/aTOBkUh80CJpyZP8QHD16ztD9sWmBtRtHRnCAd
+xbZAkKAq3VQ/qCYT7OkTcui2xh327ZPwmNJiYILJ5vRIheiZIuj31x3FkmXus/f8
+nTX/p1MmDn1sx2vpuyQ5vGyX8knXyfwqe1NiNKq0QT+1bqLggT2Li21S9XavwFcl
+x6IuRDlBFWMgJTGPgn2ZIpzmsfOxeCvQAKJWVdvGgDItRPSGnAs3WHeSmQPobW8Q
+m/LareZcoDwUBT70C6EMm6cc9C2XVDHPs5wW9eIWL8IF1Jd03tXIIDIfuIHnFX3o
+/UCkHCCN4nQSIp57CI8Z5mDbpj3G0jEAnJyYGTPXR6MugsSuY8tTYIyN2y0qXzYx
+w8PRAMBKq4f+ZYAHj/I54QT/Rvj2Wyhna9QNBvjWgImHPEDrIZ4MGlTeJuL7WjsQ
+hfQZjQ3aw24SEg51Sf1UTQ80xAZJoK8Q3kTzymzUZgqeutUtYrTgXjzd4Mv+52YQ
+oQ==
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.subject_key_identifier_extension_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 1.3.6.1.5.5.7.1.3
+certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies.0.policyQualifiers.0,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
+certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies,SubscriberPoliciesValidator,WARNING,cabf.serverauth.subscriber_first_policy_oid_not_reserved,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 2.23.140.3.1
+certificate.tbsCertificate.subject.rdnSequence,EvSubscriberAttributeAllowanceValidator,WARNING,cabf.ev_guidelines.common_name_attribute_present,
+certificate.tbsCertificate.extensions.9.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
+certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies.3.policyQualifiers.0,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
diff --git a/tests/integration_certificate/etsi/qevcp_w_non_eidas_pre_certificate/more_than_one_qctype.crttest b/tests/integration_certificate/etsi/qevcp_w_non_eidas_pre_certificate/more_than_one_qctype.crttest
new file mode 100644
index 0000000..e742a86
--- /dev/null
+++ b/tests/integration_certificate/etsi/qevcp_w_non_eidas_pre_certificate/more_than_one_qctype.crttest
@@ -0,0 +1,54 @@
+-----BEGIN CERTIFICATE-----
+MIIHhjCCBW6gAwIBAgIMFzle8tVI5MLthWVyMA0GCSqGSIb3DQEBCwUAMFkxCzAJ
+BgNVBAYTAkdCMRswGQYDVQQKExJHTU8gR2xvYmFsU2lnbiBMdGQxLTArBgNVBAMT
+JEdsb2JhbFNpZ24gR0NDIFIzIFVLIEVWIFFXQUMgQ0EgMjAyMDAeFw0yMzA2MTYw
+ODMzMzRaFw0yNDA2MTUwODMzMzNaMIHyMR0wGwYDVQQPDBRQcml2YXRlIE9yZ2Fu
+aXphdGlvbjEVMBMGA1UEBRMMMDQ1OS4xMzQuMjU2MRMwEQYLKwYBBAGCNzwCAQMT
+AkJFMQswCQYDVQQGEwJCRTEXMBUGA1UECAwOVmxhYW1zLUJyYWJhbnQxDzANBgNV
+BAcMBkxldXZlbjEXMBUGA1UECQwORGllc3RzZXZlc3QgMTQxFjAUBgNVBAoMDUds
+b2JhbFNpZ24gTlYxIDAeBgNVBAMMF3d3dy5nbG9iYWxzaWduLWRlbW8uY29tMRsw
+GQYDVQRhDBJOVFJCRS0wNDU5LjEzNC4yNTYwggEiMA0GCSqGSIb3DQEBAQUAA4IB
+DwAwggEKAoIBAQCpn0FCPXqC0Lx5clF4Qq4ez3CW3iLRJegKqMaD84PN504skXsY
+bDhLz+naT3naIqsYJUV9A+b01BRVgMR4vZpZ27EY28tRwRf9s7eImzO5QXFPoG+i
+2ztRC7rE4Q33HO5SRKp3ZEV9Es8fW3/mJxGrLFJuS7c6sX0bU/dBdISw1j0pM/8+
+oXN0Kiy/vcMULkP/eL6nmj45jklIFoRxb0AZzemQijj+t8fz8bLWZISLBzvqmL0Y
+hjpCkLnyjgVM5xtElSPf7/a7J7jnaleZ3gJhxYF+FndyHooaBAHxFA32BmSgV3PD
+Rgq3eLMUGrngSlGNXbTWMxnUTh93lrqiturXAgMBAAGjggKyMIICrjBEBgNVHR8E
+PTA7MDmgN6A1hjNodHRwOi8vY3JsLmdsb2JhbHNpZ24uY29tL2dzZ2NjcjN1a2V2
+cXdhY2NhMjAyMC5jcmwwRgYIKwYBBQUHAQMEOjA4MAgGBgQAjkYBATAcBgYEAI5G
+AQYwEgYHBACORgEGAwYHBACORgEGATAOBgYEAI5GAQcwBBMCR0IwgZkGCCsGAQUF
+BwEBBIGMMIGJMEkGCCsGAQUFBzAChj1odHRwOi8vc2VjdXJlLmdsb2JhbHNpZ24u
+Y29tL2NhY2VydC9nc2djY3IzdWtldnF3YWNjYTIwMjAuY3J0MDwGCCsGAQUFBzAB
+hjBodHRwOi8vb2NzcC5nbG9iYWxzaWduLmNvbS9nc2djY3IzdWtldnF3YWNjYTIw
+MjAwgacGA1UdIASBnzCBnDBBBgkrBgEEAaAyAQEwNDAyBggrBgEFBQcCARYmaHR0
+cHM6Ly93d3cuZ2xvYmFsc2lnbi5jb20vcmVwb3NpdG9yeS8wBwYFZ4EMAQEwCQYH
+BACL7EABBDBDBgsrBgEEAaAyASwoATA0MDIGCCsGAQUFBwIBFiZodHRwczovL3d3
+dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzAiBgNVHREEGzAZghd3d3cuZ2xv
+YmFsc2lnbi1kZW1vLmNvbTAiBgVngQwDAQQZMBcTA05UUhMCQkUMDDA0NTkuMTM0
+LjI1NjAMBgNVHRMBAf8EAjAAMB8GA1UdIwQYMBaAFAeUNkpRlUn97ioGeTZ/wjc7
+Ttu/MB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATAdBgNVHQ4EFgQUzAkX
+OmPl1fx/NWnnM2kcUxBAZ5QwDgYDVR0PAQH/BAQDAgeAMBMGCisGAQQB1nkCBAMB
+Af8EAgUAMA0GCSqGSIb3DQEBCwUAA4ICAQCaXlFvQuIgDR/2ARtUwmknMv2K0hAR
+J8jIXp+uiOoyEejR2HZetKOKKXdLZVeFHAV1gujMujStu7zu/weqnoACLLPyZfiz
+xT1CpImPOorvYDzKWOJWz22Dwg7uxk5HuFmxVla2mru12bdQho0JDmsldMJlc7Mq
+3S7Q88AOUkmiroaSEsQ+joZ4NILZtcl2rkD2U/aTOBkUh80CJpyZP8QHD16ztD9s
+WmBtRtHRnCAdxbZAkKAq3VQ/qCYT7OkTcui2xh327ZPwmNJiYILJ5vRIheiZIuj3
+1x3FkmXus/f8nTX/p1MmDn1sx2vpuyQ5vGyX8knXyfwqe1NiNKq0QT+1bqLggT2L
+i21S9XavwFclx6IuRDlBFWMgJTGPgn2ZIpzmsfOxeCvQAKJWVdvGgDItRPSGnAs3
+WHeSmQPobW8Qm/LareZcoDwUBT70C6EMm6cc9C2XVDHPs5wW9eIWL8IF1Jd03tXI
+IDIfuIHnFX3o/UCkHCCN4nQSIp57CI8Z5mDbpj3G0jEAnJyYGTPXR6MugsSuY8tT
+YIyN2y0qXzYxw8PRAMBKq4f+ZYAHj/I54QT/Rvj2Wyhna9QNBvjWgImHPEDrIZ4M
+GlTeJuL7WjsQhfQZjQ3aw24SEg51Sf1UTQ80xAZJoK8Q3kTzymzUZgqeutUtYrTg
+Xjzd4Mv+52YQoQ==
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.extensions.1.extnValue.qCStatements.1.statementInfo.qcType,QcTypeValidator,ERROR,etsi.en_319_412_5.gen-4.2.3.multiple_qc_type_values_present,
+certificate.tbsCertificate.extensions.9.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
+certificate.tbsCertificate.subject.rdnSequence,EvSubscriberAttributeAllowanceValidator,WARNING,cabf.ev_guidelines.common_name_attribute_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.subject_key_identifier_extension_present,
+certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies,SubscriberPoliciesValidator,WARNING,cabf.serverauth.subscriber_first_policy_oid_not_reserved,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 1.3.6.1.5.5.7.1.3
+certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies.3.policyQualifiers.0,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
+certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies.0.policyQualifiers.0,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 2.23.140.3.1
diff --git a/tests/integration_certificate/etsi/qevcp_w_non_eidas_pre_certificate/none_qctype.crttest b/tests/integration_certificate/etsi/qevcp_w_non_eidas_pre_certificate/none_qctype.crttest
new file mode 100644
index 0000000..80b0cd9
--- /dev/null
+++ b/tests/integration_certificate/etsi/qevcp_w_non_eidas_pre_certificate/none_qctype.crttest
@@ -0,0 +1,53 @@
+-----BEGIN CERTIFICATE-----
+MIIHdDCCBVygAwIBAgIMFzle8tVI5MLthWVyMA0GCSqGSIb3DQEBCwUAMFkxCzAJ
+BgNVBAYTAkdCMRswGQYDVQQKExJHTU8gR2xvYmFsU2lnbiBMdGQxLTArBgNVBAMT
+JEdsb2JhbFNpZ24gR0NDIFIzIFVLIEVWIFFXQUMgQ0EgMjAyMDAeFw0yMzA2MTYw
+ODMzMzRaFw0yNDA2MTUwODMzMzNaMIHyMR0wGwYDVQQPDBRQcml2YXRlIE9yZ2Fu
+aXphdGlvbjEVMBMGA1UEBRMMMDQ1OS4xMzQuMjU2MRMwEQYLKwYBBAGCNzwCAQMT
+AkJFMQswCQYDVQQGEwJCRTEXMBUGA1UECAwOVmxhYW1zLUJyYWJhbnQxDzANBgNV
+BAcMBkxldXZlbjEXMBUGA1UECQwORGllc3RzZXZlc3QgMTQxFjAUBgNVBAoMDUds
+b2JhbFNpZ24gTlYxIDAeBgNVBAMMF3d3dy5nbG9iYWxzaWduLWRlbW8uY29tMRsw
+GQYDVQRhDBJOVFJCRS0wNDU5LjEzNC4yNTYwggEiMA0GCSqGSIb3DQEBAQUAA4IB
+DwAwggEKAoIBAQCpn0FCPXqC0Lx5clF4Qq4ez3CW3iLRJegKqMaD84PN504skXsY
+bDhLz+naT3naIqsYJUV9A+b01BRVgMR4vZpZ27EY28tRwRf9s7eImzO5QXFPoG+i
+2ztRC7rE4Q33HO5SRKp3ZEV9Es8fW3/mJxGrLFJuS7c6sX0bU/dBdISw1j0pM/8+
+oXN0Kiy/vcMULkP/eL6nmj45jklIFoRxb0AZzemQijj+t8fz8bLWZISLBzvqmL0Y
+hjpCkLnyjgVM5xtElSPf7/a7J7jnaleZ3gJhxYF+FndyHooaBAHxFA32BmSgV3PD
+Rgq3eLMUGrngSlGNXbTWMxnUTh93lrqiturXAgMBAAGjggKgMIICnDBEBgNVHR8E
+PTA7MDmgN6A1hjNodHRwOi8vY3JsLmdsb2JhbHNpZ24uY29tL2dzZ2NjcjN1a2V2
+cXdhY2NhMjAyMC5jcmwwNAYIKwYBBQUHAQMEKDAmMAgGBgQAjkYBATAKBgYEAI5G
+AQYwADAOBgYEAI5GAQcwBBMCR0IwgZkGCCsGAQUFBwEBBIGMMIGJMEkGCCsGAQUF
+BzAChj1odHRwOi8vc2VjdXJlLmdsb2JhbHNpZ24uY29tL2NhY2VydC9nc2djY3Iz
+dWtldnF3YWNjYTIwMjAuY3J0MDwGCCsGAQUFBzABhjBodHRwOi8vb2NzcC5nbG9i
+YWxzaWduLmNvbS9nc2djY3IzdWtldnF3YWNjYTIwMjAwgacGA1UdIASBnzCBnDBB
+BgkrBgEEAaAyAQEwNDAyBggrBgEFBQcCARYmaHR0cHM6Ly93d3cuZ2xvYmFsc2ln
+bi5jb20vcmVwb3NpdG9yeS8wBwYFZ4EMAQEwCQYHBACL7EABBDBDBgsrBgEEAaAy
+ASwoATA0MDIGCCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9y
+ZXBvc2l0b3J5LzAiBgNVHREEGzAZghd3d3cuZ2xvYmFsc2lnbi1kZW1vLmNvbTAi
+BgVngQwDAQQZMBcTA05UUhMCQkUMDDA0NTkuMTM0LjI1NjAMBgNVHRMBAf8EAjAA
+MB8GA1UdIwQYMBaAFAeUNkpRlUn97ioGeTZ/wjc7Ttu/MB0GA1UdJQQWMBQGCCsG
+AQUFBwMCBggrBgEFBQcDATAdBgNVHQ4EFgQUzAkXOmPl1fx/NWnnM2kcUxBAZ5Qw
+DgYDVR0PAQH/BAQDAgeAMBMGCisGAQQB1nkCBAMBAf8EAgUAMA0GCSqGSIb3DQEB
+CwUAA4ICAQCaXlFvQuIgDR/2ARtUwmknMv2K0hARJ8jIXp+uiOoyEejR2HZetKOK
+KXdLZVeFHAV1gujMujStu7zu/weqnoACLLPyZfizxT1CpImPOorvYDzKWOJWz22D
+wg7uxk5HuFmxVla2mru12bdQho0JDmsldMJlc7Mq3S7Q88AOUkmiroaSEsQ+joZ4
+NILZtcl2rkD2U/aTOBkUh80CJpyZP8QHD16ztD9sWmBtRtHRnCAdxbZAkKAq3VQ/
+qCYT7OkTcui2xh327ZPwmNJiYILJ5vRIheiZIuj31x3FkmXus/f8nTX/p1MmDn1s
+x2vpuyQ5vGyX8knXyfwqe1NiNKq0QT+1bqLggT2Li21S9XavwFclx6IuRDlBFWMg
+JTGPgn2ZIpzmsfOxeCvQAKJWVdvGgDItRPSGnAs3WHeSmQPobW8Qm/LareZcoDwU
+BT70C6EMm6cc9C2XVDHPs5wW9eIWL8IF1Jd03tXIIDIfuIHnFX3o/UCkHCCN4nQS
+Ip57CI8Z5mDbpj3G0jEAnJyYGTPXR6MugsSuY8tTYIyN2y0qXzYxw8PRAMBKq4f+
+ZYAHj/I54QT/Rvj2Wyhna9QNBvjWgImHPEDrIZ4MGlTeJuL7WjsQhfQZjQ3aw24S
+Eg51Sf1UTQ80xAZJoK8Q3kTzymzUZgqeutUtYrTgXjzd4Mv+52YQoQ==
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.extensions.1.extnValue.qCStatements.1.statementInfo.qcType,QcTypeValidator,ERROR,etsi.en_319_412_5.gen-4.2.3.qc_type_list_empty,
+certificate.tbsCertificate.extensions.9.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
+certificate.tbsCertificate.subject.rdnSequence,EvSubscriberAttributeAllowanceValidator,WARNING,cabf.ev_guidelines.common_name_attribute_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.subject_key_identifier_extension_present,
+certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies,SubscriberPoliciesValidator,WARNING,cabf.serverauth.subscriber_first_policy_oid_not_reserved,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 1.3.6.1.5.5.7.1.3
+certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies.3.policyQualifiers.0,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
+certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies.0.policyQualifiers.0,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 2.23.140.3.1
diff --git a/tests/integration_certificate/etsi/qevcp_w_non_eidas_pre_certificate/qc_cc_legislation_missing.crttest b/tests/integration_certificate/etsi/qevcp_w_non_eidas_pre_certificate/qc_cc_legislation_missing.crttest
new file mode 100644
index 0000000..fd838d4
--- /dev/null
+++ b/tests/integration_certificate/etsi/qevcp_w_non_eidas_pre_certificate/qc_cc_legislation_missing.crttest
@@ -0,0 +1,53 @@
+-----BEGIN CERTIFICATE-----
+MIIHbTCCBVWgAwIBAgIMFzle8tVI5MLthWVyMA0GCSqGSIb3DQEBCwUAMFkxCzAJ
+BgNVBAYTAkdCMRswGQYDVQQKExJHTU8gR2xvYmFsU2lnbiBMdGQxLTArBgNVBAMT
+JEdsb2JhbFNpZ24gR0NDIFIzIFVLIEVWIFFXQUMgQ0EgMjAyMDAeFw0yMzA2MTYw
+ODMzMzRaFw0yNDA2MTUwODMzMzNaMIHyMR0wGwYDVQQPDBRQcml2YXRlIE9yZ2Fu
+aXphdGlvbjEVMBMGA1UEBRMMMDQ1OS4xMzQuMjU2MRMwEQYLKwYBBAGCNzwCAQMT
+AkJFMQswCQYDVQQGEwJCRTEXMBUGA1UECAwOVmxhYW1zLUJyYWJhbnQxDzANBgNV
+BAcMBkxldXZlbjEXMBUGA1UECQwORGllc3RzZXZlc3QgMTQxFjAUBgNVBAoMDUds
+b2JhbFNpZ24gTlYxIDAeBgNVBAMMF3d3dy5nbG9iYWxzaWduLWRlbW8uY29tMRsw
+GQYDVQRhDBJOVFJCRS0wNDU5LjEzNC4yNTYwggEiMA0GCSqGSIb3DQEBAQUAA4IB
+DwAwggEKAoIBAQCpn0FCPXqC0Lx5clF4Qq4ez3CW3iLRJegKqMaD84PN504skXsY
+bDhLz+naT3naIqsYJUV9A+b01BRVgMR4vZpZ27EY28tRwRf9s7eImzO5QXFPoG+i
+2ztRC7rE4Q33HO5SRKp3ZEV9Es8fW3/mJxGrLFJuS7c6sX0bU/dBdISw1j0pM/8+
+oXN0Kiy/vcMULkP/eL6nmj45jklIFoRxb0AZzemQijj+t8fz8bLWZISLBzvqmL0Y
+hjpCkLnyjgVM5xtElSPf7/a7J7jnaleZ3gJhxYF+FndyHooaBAHxFA32BmSgV3PD
+Rgq3eLMUGrngSlGNXbTWMxnUTh93lrqiturXAgMBAAGjggKZMIIClTBEBgNVHR8E
+PTA7MDmgN6A1hjNodHRwOi8vY3JsLmdsb2JhbHNpZ24uY29tL2dzZ2NjcjN1a2V2
+cXdhY2NhMjAyMC5jcmwwLQYIKwYBBQUHAQMEITAfMAgGBgQAjkYBATATBgYEAI5G
+AQYwCQYHBACORgEGAzCBmQYIKwYBBQUHAQEEgYwwgYkwSQYIKwYBBQUHMAKGPWh0
+dHA6Ly9zZWN1cmUuZ2xvYmFsc2lnbi5jb20vY2FjZXJ0L2dzZ2NjcjN1a2V2cXdh
+Y2NhMjAyMC5jcnQwPAYIKwYBBQUHMAGGMGh0dHA6Ly9vY3NwLmdsb2JhbHNpZ24u
+Y29tL2dzZ2NjcjN1a2V2cXdhY2NhMjAyMDCBpwYDVR0gBIGfMIGcMEEGCSsGAQQB
+oDIBATA0MDIGCCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9y
+ZXBvc2l0b3J5LzAHBgVngQwBATAJBgcEAIvsQAEEMEMGCysGAQQBoDIBLCgBMDQw
+MgYIKwYBBQUHAgEWJmh0dHBzOi8vd3d3Lmdsb2JhbHNpZ24uY29tL3JlcG9zaXRv
+cnkvMCIGA1UdEQQbMBmCF3d3dy5nbG9iYWxzaWduLWRlbW8uY29tMCIGBWeBDAMB
+BBkwFxMDTlRSEwJCRQwMMDQ1OS4xMzQuMjU2MAwGA1UdEwEB/wQCMAAwHwYDVR0j
+BBgwFoAUB5Q2SlGVSf3uKgZ5Nn/CNztO278wHQYDVR0lBBYwFAYIKwYBBQUHAwIG
+CCsGAQUFBwMBMB0GA1UdDgQWBBTMCRc6Y+XV/H81aeczaRxTEEBnlDAOBgNVHQ8B
+Af8EBAMCB4AwEwYKKwYBBAHWeQIEAwEB/wQCBQAwDQYJKoZIhvcNAQELBQADggIB
+AJpeUW9C4iANH/YBG1TCaScy/YrSEBEnyMhen66I6jIR6NHYdl60o4opd0tlV4Uc
+BXWC6My6NK27vO7/B6qegAIss/Jl+LPFPUKkiY86iu9gPMpY4lbPbYPCDu7GTke4
+WbFWVraau7XZt1CGjQkOayV0wmVzsyrdLtDzwA5SSaKuhpISxD6Ohng0gtm1yXau
+QPZT9pM4GRSHzQImnJk/xAcPXrO0P2xaYG1G0dGcIB3FtkCQoCrdVD+oJhPs6RNy
+6LbGHfbtk/CY0mJggsnm9EiF6Jki6PfXHcWSZe6z9/ydNf+nUyYOfWzHa+m7JDm8
+bJfySdfJ/Cp7U2I0qrRBP7VuouCBPYuLbVL1dq/AVyXHoi5EOUEVYyAlMY+CfZki
+nOax87F4K9AAolZV28aAMi1E9IacCzdYd5KZA+htbxCb8tqt5lygPBQFPvQLoQyb
+pxz0LZdUMc+znBb14hYvwgXUl3Te1cggMh+4gecVfej9QKQcII3idBIinnsIjxnm
+YNumPcbSMQCcnJgZM9dHoy6CxK5jy1NgjI3bLSpfNjHDw9EAwEqrh/5lgAeP8jnh
+BP9G+PZbKGdr1A0G+NaAiYc8QOshngwaVN4m4vtaOxCF9BmNDdrDbhISDnVJ/VRN
+DzTEBkmgrxDeRPPKbNRmCp661S1itOBePN3gy/7nZhCh
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.subject.rdnSequence,EvSubscriberAttributeAllowanceValidator,WARNING,cabf.ev_guidelines.common_name_attribute_present,
+certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies,SubscriberPoliciesValidator,WARNING,cabf.serverauth.subscriber_first_policy_oid_not_reserved,
+certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies.0.policyQualifiers.0,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
+certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies.3.policyQualifiers.0,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
+certificate.tbsCertificate.extensions.9.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.subject_key_identifier_extension_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 1.3.6.1.5.5.7.1.3
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 2.23.140.3.1
+certificate.tbsCertificate.extensions.1.extnValue.qCStatements,QcStatementIdentifierAllowanceValidator,ERROR,etsi.en_319_412_5.qcs-5.01.qc_cc_legislation_qualified_statement_absent,
diff --git a/tests/integration_certificate/etsi/qevcp_w_non_eidas_pre_certificate/second_country_code_bad.crttest b/tests/integration_certificate/etsi/qevcp_w_non_eidas_pre_certificate/second_country_code_bad.crttest
new file mode 100644
index 0000000..bbd8a86
--- /dev/null
+++ b/tests/integration_certificate/etsi/qevcp_w_non_eidas_pre_certificate/second_country_code_bad.crttest
@@ -0,0 +1,54 @@
+-----BEGIN CERTIFICATE-----
+MIIHgTCCBWmgAwIBAgIMFzle8tVI5MLthWVyMA0GCSqGSIb3DQEBCwUAMFkxCzAJ
+BgNVBAYTAkdCMRswGQYDVQQKExJHTU8gR2xvYmFsU2lnbiBMdGQxLTArBgNVBAMT
+JEdsb2JhbFNpZ24gR0NDIFIzIFVLIEVWIFFXQUMgQ0EgMjAyMDAeFw0yMzA2MTYw
+ODMzMzRaFw0yNDA2MTUwODMzMzNaMIHyMR0wGwYDVQQPDBRQcml2YXRlIE9yZ2Fu
+aXphdGlvbjEVMBMGA1UEBRMMMDQ1OS4xMzQuMjU2MRMwEQYLKwYBBAGCNzwCAQMT
+AkJFMQswCQYDVQQGEwJCRTEXMBUGA1UECAwOVmxhYW1zLUJyYWJhbnQxDzANBgNV
+BAcMBkxldXZlbjEXMBUGA1UECQwORGllc3RzZXZlc3QgMTQxFjAUBgNVBAoMDUds
+b2JhbFNpZ24gTlYxIDAeBgNVBAMMF3d3dy5nbG9iYWxzaWduLWRlbW8uY29tMRsw
+GQYDVQRhDBJOVFJCRS0wNDU5LjEzNC4yNTYwggEiMA0GCSqGSIb3DQEBAQUAA4IB
+DwAwggEKAoIBAQCpn0FCPXqC0Lx5clF4Qq4ez3CW3iLRJegKqMaD84PN504skXsY
+bDhLz+naT3naIqsYJUV9A+b01BRVgMR4vZpZ27EY28tRwRf9s7eImzO5QXFPoG+i
+2ztRC7rE4Q33HO5SRKp3ZEV9Es8fW3/mJxGrLFJuS7c6sX0bU/dBdISw1j0pM/8+
+oXN0Kiy/vcMULkP/eL6nmj45jklIFoRxb0AZzemQijj+t8fz8bLWZISLBzvqmL0Y
+hjpCkLnyjgVM5xtElSPf7/a7J7jnaleZ3gJhxYF+FndyHooaBAHxFA32BmSgV3PD
+Rgq3eLMUGrngSlGNXbTWMxnUTh93lrqiturXAgMBAAGjggKtMIICqTBEBgNVHR8E
+PTA7MDmgN6A1hjNodHRwOi8vY3JsLmdsb2JhbHNpZ24uY29tL2dzZ2NjcjN1a2V2
+cXdhY2NhMjAyMC5jcmwwQQYIKwYBBQUHAQMENTAzMAgGBgQAjkYBATATBgYEAI5G
+AQYwCQYHBACORgEGAzASBgYEAI5GAQcwCBMCRlITAlpaMIGZBggrBgEFBQcBAQSB
+jDCBiTBJBggrBgEFBQcwAoY9aHR0cDovL3NlY3VyZS5nbG9iYWxzaWduLmNvbS9j
+YWNlcnQvZ3NnY2NyM3VrZXZxd2FjY2EyMDIwLmNydDA8BggrBgEFBQcwAYYwaHR0
+cDovL29jc3AuZ2xvYmFsc2lnbi5jb20vZ3NnY2NyM3VrZXZxd2FjY2EyMDIwMIGn
+BgNVHSAEgZ8wgZwwQQYJKwYBBAGgMgEBMDQwMgYIKwYBBQUHAgEWJmh0dHBzOi8v
+d3d3Lmdsb2JhbHNpZ24uY29tL3JlcG9zaXRvcnkvMAcGBWeBDAEBMAkGBwQAi+xA
+AQQwQwYLKwYBBAGgMgEsKAEwNDAyBggrBgEFBQcCARYmaHR0cHM6Ly93d3cuZ2xv
+YmFsc2lnbi5jb20vcmVwb3NpdG9yeS8wIgYDVR0RBBswGYIXd3d3Lmdsb2JhbHNp
+Z24tZGVtby5jb20wIgYFZ4EMAwEEGTAXEwNOVFITAkJFDAwwNDU5LjEzNC4yNTYw
+DAYDVR0TAQH/BAIwADAfBgNVHSMEGDAWgBQHlDZKUZVJ/e4qBnk2f8I3O07bvzAd
+BgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwHQYDVR0OBBYEFMwJFzpj5dX8
+fzVp5zNpHFMQQGeUMA4GA1UdDwEB/wQEAwIHgDATBgorBgEEAdZ5AgQDAQH/BAIF
+ADANBgkqhkiG9w0BAQsFAAOCAgEAml5Rb0LiIA0f9gEbVMJpJzL9itIQESfIyF6f
+rojqMhHo0dh2XrSjiil3S2VXhRwFdYLozLo0rbu87v8Hqp6AAiyz8mX4s8U9QqSJ
+jzqK72A8yljiVs9tg8IO7sZOR7hZsVZWtpq7tdm3UIaNCQ5rJXTCZXOzKt0u0PPA
+DlJJoq6GkhLEPo6GeDSC2bXJdq5A9lP2kzgZFIfNAiacmT/EBw9es7Q/bFpgbUbR
+0ZwgHcW2QJCgKt1UP6gmE+zpE3LotsYd9u2T8JjSYmCCyeb0SIXomSLo99cdxZJl
+7rP3/J01/6dTJg59bMdr6bskObxsl/JJ18n8KntTYjSqtEE/tW6i4IE9i4ttUvV2
+r8BXJceiLkQ5QRVjICUxj4J9mSKc5rHzsXgr0ACiVlXbxoAyLUT0hpwLN1h3kpkD
+6G1vEJvy2q3mXKA8FAU+9AuhDJunHPQtl1Qxz7OcFvXiFi/CBdSXdN7VyCAyH7iB
+5xV96P1ApBwgjeJ0EiKeewiPGeZg26Y9xtIxAJycmBkz10ejLoLErmPLU2CMjdst
+Kl82McPD0QDASquH/mWAB4/yOeEE/0b49lsoZ2vUDQb41oCJhzxA6yGeDBpU3ibi
++1o7EIX0GY0N2sNuEhIOdUn9VE0PNMQGSaCvEN5E88ps1GYKnrrVLWK04F483eDL
+/udmEKE=
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.subject.rdnSequence,EvSubscriberAttributeAllowanceValidator,WARNING,cabf.ev_guidelines.common_name_attribute_present,
+certificate.tbsCertificate.extensions.1.extnValue.qCStatements.2.statementInfo.qcCClegislation,QcCCLegislationCountryCodeValidator,ERROR,etsi.en_319_412_5.gen-4.2.4.iso_country_code_invalid,"Invalid country code found: ""ZZ"""
+certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies,SubscriberPoliciesValidator,WARNING,cabf.serverauth.subscriber_first_policy_oid_not_reserved,
+certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies.0.policyQualifiers.0,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
+certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies.3.policyQualifiers.0,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
+certificate.tbsCertificate.extensions.9.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.subject_key_identifier_extension_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 1.3.6.1.5.5.7.1.3
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 2.23.140.3.1
diff --git a/tests/integration_certificate/etsi/qevcp_w_non_eidas_pre_certificate/wrong_qctype.crttest b/tests/integration_certificate/etsi/qevcp_w_non_eidas_pre_certificate/wrong_qctype.crttest
new file mode 100644
index 0000000..c5fd001
--- /dev/null
+++ b/tests/integration_certificate/etsi/qevcp_w_non_eidas_pre_certificate/wrong_qctype.crttest
@@ -0,0 +1,54 @@
+-----BEGIN CERTIFICATE-----
+MIIHfTCCBWWgAwIBAgIMFzle8tVI5MLthWVyMA0GCSqGSIb3DQEBCwUAMFkxCzAJ
+BgNVBAYTAkdCMRswGQYDVQQKExJHTU8gR2xvYmFsU2lnbiBMdGQxLTArBgNVBAMT
+JEdsb2JhbFNpZ24gR0NDIFIzIFVLIEVWIFFXQUMgQ0EgMjAyMDAeFw0yMzA2MTYw
+ODMzMzRaFw0yNDA2MTUwODMzMzNaMIHyMR0wGwYDVQQPDBRQcml2YXRlIE9yZ2Fu
+aXphdGlvbjEVMBMGA1UEBRMMMDQ1OS4xMzQuMjU2MRMwEQYLKwYBBAGCNzwCAQMT
+AkJFMQswCQYDVQQGEwJCRTEXMBUGA1UECAwOVmxhYW1zLUJyYWJhbnQxDzANBgNV
+BAcMBkxldXZlbjEXMBUGA1UECQwORGllc3RzZXZlc3QgMTQxFjAUBgNVBAoMDUds
+b2JhbFNpZ24gTlYxIDAeBgNVBAMMF3d3dy5nbG9iYWxzaWduLWRlbW8uY29tMRsw
+GQYDVQRhDBJOVFJCRS0wNDU5LjEzNC4yNTYwggEiMA0GCSqGSIb3DQEBAQUAA4IB
+DwAwggEKAoIBAQCpn0FCPXqC0Lx5clF4Qq4ez3CW3iLRJegKqMaD84PN504skXsY
+bDhLz+naT3naIqsYJUV9A+b01BRVgMR4vZpZ27EY28tRwRf9s7eImzO5QXFPoG+i
+2ztRC7rE4Q33HO5SRKp3ZEV9Es8fW3/mJxGrLFJuS7c6sX0bU/dBdISw1j0pM/8+
+oXN0Kiy/vcMULkP/eL6nmj45jklIFoRxb0AZzemQijj+t8fz8bLWZISLBzvqmL0Y
+hjpCkLnyjgVM5xtElSPf7/a7J7jnaleZ3gJhxYF+FndyHooaBAHxFA32BmSgV3PD
+Rgq3eLMUGrngSlGNXbTWMxnUTh93lrqiturXAgMBAAGjggKpMIICpTBEBgNVHR8E
+PTA7MDmgN6A1hjNodHRwOi8vY3JsLmdsb2JhbHNpZ24uY29tL2dzZ2NjcjN1a2V2
+cXdhY2NhMjAyMC5jcmwwPQYIKwYBBQUHAQMEMTAvMAgGBgQAjkYBATATBgYEAI5G
+AQYwCQYHBACORgEGATAOBgYEAI5GAQcwBBMCR0IwgZkGCCsGAQUFBwEBBIGMMIGJ
+MEkGCCsGAQUFBzAChj1odHRwOi8vc2VjdXJlLmdsb2JhbHNpZ24uY29tL2NhY2Vy
+dC9nc2djY3IzdWtldnF3YWNjYTIwMjAuY3J0MDwGCCsGAQUFBzABhjBodHRwOi8v
+b2NzcC5nbG9iYWxzaWduLmNvbS9nc2djY3IzdWtldnF3YWNjYTIwMjAwgacGA1Ud
+IASBnzCBnDBBBgkrBgEEAaAyAQEwNDAyBggrBgEFBQcCARYmaHR0cHM6Ly93d3cu
+Z2xvYmFsc2lnbi5jb20vcmVwb3NpdG9yeS8wBwYFZ4EMAQEwCQYHBACL7EABBDBD
+BgsrBgEEAaAyASwoATA0MDIGCCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxz
+aWduLmNvbS9yZXBvc2l0b3J5LzAiBgNVHREEGzAZghd3d3cuZ2xvYmFsc2lnbi1k
+ZW1vLmNvbTAiBgVngQwDAQQZMBcTA05UUhMCQkUMDDA0NTkuMTM0LjI1NjAMBgNV
+HRMBAf8EAjAAMB8GA1UdIwQYMBaAFAeUNkpRlUn97ioGeTZ/wjc7Ttu/MB0GA1Ud
+JQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATAdBgNVHQ4EFgQUzAkXOmPl1fx/NWnn
+M2kcUxBAZ5QwDgYDVR0PAQH/BAQDAgeAMBMGCisGAQQB1nkCBAMBAf8EAgUAMA0G
+CSqGSIb3DQEBCwUAA4ICAQCaXlFvQuIgDR/2ARtUwmknMv2K0hARJ8jIXp+uiOoy
+EejR2HZetKOKKXdLZVeFHAV1gujMujStu7zu/weqnoACLLPyZfizxT1CpImPOorv
+YDzKWOJWz22Dwg7uxk5HuFmxVla2mru12bdQho0JDmsldMJlc7Mq3S7Q88AOUkmi
+roaSEsQ+joZ4NILZtcl2rkD2U/aTOBkUh80CJpyZP8QHD16ztD9sWmBtRtHRnCAd
+xbZAkKAq3VQ/qCYT7OkTcui2xh327ZPwmNJiYILJ5vRIheiZIuj31x3FkmXus/f8
+nTX/p1MmDn1sx2vpuyQ5vGyX8knXyfwqe1NiNKq0QT+1bqLggT2Li21S9XavwFcl
+x6IuRDlBFWMgJTGPgn2ZIpzmsfOxeCvQAKJWVdvGgDItRPSGnAs3WHeSmQPobW8Q
+m/LareZcoDwUBT70C6EMm6cc9C2XVDHPs5wW9eIWL8IF1Jd03tXIIDIfuIHnFX3o
+/UCkHCCN4nQSIp57CI8Z5mDbpj3G0jEAnJyYGTPXR6MugsSuY8tTYIyN2y0qXzYx
+w8PRAMBKq4f+ZYAHj/I54QT/Rvj2Wyhna9QNBvjWgImHPEDrIZ4MGlTeJuL7WjsQ
+hfQZjQ3aw24SEg51Sf1UTQ80xAZJoK8Q3kTzymzUZgqeutUtYrTgXjzd4Mv+52YQ
+oQ==
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.extensions.1.extnValue.qCStatements.1.statementInfo.qcType,QcTypeValidator,ERROR,etsi.en_319_412_5.gen-4.2.3.qc_type_mismatch,"Certificate type is ""QEVCP-W-NON-EIDAS-PRE-CERTIFICATE"" but QcType qualified statement contains ""0.4.0.1862.1.6.1"""
+certificate.tbsCertificate.extensions.9.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
+certificate.tbsCertificate.subject.rdnSequence,EvSubscriberAttributeAllowanceValidator,WARNING,cabf.ev_guidelines.common_name_attribute_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.subject_key_identifier_extension_present,
+certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies,SubscriberPoliciesValidator,WARNING,cabf.serverauth.subscriber_first_policy_oid_not_reserved,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 1.3.6.1.5.5.7.1.3
+certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies.3.policyQualifiers.0,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
+certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies.0.policyQualifiers.0,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 2.23.140.3.1
diff --git a/tests/integration_certificate/etsi/qevcp_w_psd2_eidas_final_certificate/invalid_orgid_scheme.crttest b/tests/integration_certificate/etsi/qevcp_w_psd2_eidas_final_certificate/invalid_orgid_scheme.crttest
new file mode 100644
index 0000000..bcd58a0
--- /dev/null
+++ b/tests/integration_certificate/etsi/qevcp_w_psd2_eidas_final_certificate/invalid_orgid_scheme.crttest
@@ -0,0 +1,72 @@
+-----BEGIN CERTIFICATE-----
+MIIK5zCCCM+gAwIBAgIQM45XX6vGj9RCkPDW99QnMDANBgkqhkiG9w0BAQsFADCB
+wTELMAkGA1UEBhMCR1IxDzANBgNVBAcMBkF0aGVuczErMCkGA1UECgwiR3JlZWsg
+VW5pdmVyc2l0aWVzIE5ldHdvcmsgKEdVbmV0KTEYMBYGA1UEYQwPVkFUR1ItMDk5
+MDI4MjIwMTcwNQYDVQQLDC5IZWxsZW5pYyBBY2FkZW1pYyBhbmQgUmVzZWFyY2gg
+SW5zdGl0dXRpb25zIENBMSEwHwYDVQQDDBhIQVJJQ0EgUVdBQyBSU0EgU3ViQ0Eg
+UjEwHhcNMjMxMTE2MDc0MzQzWhcNMjQxMjAxMDAwMDAwWjCCAQcxCzAJBgNVBAYT
+AkZSMQ4wDAYDVQQHDAVQQVJJUzEdMBsGA1UECgwUTEFaQVJEIEZSRVJFUyBCQU5R
+VUUxGTAXBgNVBGEMEFBBREZSLUFDUFItMzA3NDgxFDASBgNVBAUTCzMzNCA5NjEg
+NzQ1MSswKQYDVQQDDCJzYW5kYm94LnBzZDIubGF6YXJkZnJlcmVzYmFucXVlLmZy
+MR0wGwYDVQQPDBRQcml2YXRlIE9yZ2FuaXphdGlvbjEWMBQGCysGAQQBgjc8AgEB
+DAVQYXJpczEfMB0GCysGAQQBgjc8AgECDA7DjmxlLWRlLUZyYW5jZTETMBEGCysG
+AQQBgjc8AgEDEwJGUjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAMks
+DuJ97bMUpMcZEZXjtaBfCHZ1Kak1x15ZYtrxEeFuZ/rGSZ8Ct5apv9xTgHHYH1/K
+DNW6NmIZ7lOpMEPoqiCoRlSYbU2dkCZK1z18ZdvKxbqwLRTbpFbX0qEbJ/9i2Ral
+HqIQgLdOt8ejUHszSMUczG3t3c4OVLf73j3eEvY/hShumH51sfY+d9X27AEVQpiw
+HatcKvHMfCwSoOyp+v/+HHtCHU0jk9h3dFLnek1+i5RoreABSQGabHY/FPYZqWlR
+oR1l8f0S8KTPL0MdhFHN3VPpp8ioXHTLIeg2uzpMlzZ9FHtzok27vnMIIj9sWL4T
+NTKopYqwzTM/i0+qBVhP/1DZx9Is8ZPMlqQMrD4agzTZtHHb4er3B0LP5LBZJpDu
+iZEpn3UvpOV/p4p4DggY5oXktRrNZepryIMNLaC45PV5YBbKPxjTAkEnvMrNeu5K
+6Oz6fJJHmv2E6IYYXLCxmphp8S9K/kgw4i7Tvv54f70BXbwSQ5v7P0BlicmWlKO/
+jgcnUYvFMiggIk9uVsCZNf3g/WyWY9nYespuZ7Jw7PMdyBWKJoxg4cxT2Ztd3qFj
+j2ypJE90YWFHbWauWDYrImc6cjAjMujv1pvzlOAisYkEICyi3r9YaTehmfjFACRm
+jyg0abKLdNU0df5V3WC92w8kiyObT36ScQ9mKk1dAgMBAAGjggSQMIIEjDAfBgNV
+HSMEGDAWgBRIMseofmJKngUA3s6X+lMb4KNM/DBpBggrBgEFBQcBAQRdMFswNgYI
+KwYBBQUHMAKGKmh0dHA6Ly9jcnQuaGFyaWNhLmdyL0hhcmljYVFXQUNTdWJDQVIx
+LmNlcjAhBggrBgEFBQcwAYYVaHR0cDovL29jc3AuaGFyaWNhLmdyMFUGA1UdEQRO
+MEyCInNhbmRib3gucHNkMi5sYXphcmRmcmVyZXNiYW5xdWUuZnKCJnd3dy5zYW5k
+Ym94LnBzZDIubGF6YXJkZnJlcmVzYmFucXVlLmZyMGEGA1UdIARaMFgwBwYFZ4EM
+AQEwCQYHBACL7EABBDBCBgwrBgEEAYHPEQEBAQYwMjAwBggrBgEFBQcCARYkaHR0
+cHM6Ly9yZXBvLmhhcmljYS5nci9kb2N1bWVudHMvQ1BTMB0GA1UdJQQWMBQGCCsG
+AQUFBwMCBggrBgEFBQcDATCCATMGCCsGAQUFBwEDBIIBJTCCASEwFQYIKwYBBQUH
+CwIwCQYHBACL7EkBAjAIBgYEAI5GAQEwEwYGBACORgEGMAkGBwQAjkYBBgMwgY0G
+BgQAjkYBBTCBgjA/FjlodHRwczovL3JlcG8uaGFyaWNhLmdyL2RvY3VtZW50cy9R
+dWFsaWZpZWRMZWdhbFBEUy1FTi5wZGYTAmVuMD8WOWh0dHBzOi8vcmVwby5oYXJp
+Y2EuZ3IvZG9jdW1lbnRzL1F1YWxpZmllZExlZ2FsUERTLUVMLnBkZhMCZWwwWQYG
+BACBmCcCME8wEzARBgcEAIGYJwEDDAZQU1BfQUkML1BydWRlbnRpYWwgU3VwZXJ2
+aXNvcnkgYW5kIFJlc29sdXRpb24gQXV0aG9yaXR5DAdGUi1BQ1BSMCAGBWeBDAMB
+BBcwFRMDUEFEEwJGUgwKQUNQUi0zMDc0ODA7BgNVHR8ENDAyMDCgLqAshipodHRw
+Oi8vY3JsLmhhcmljYS5nci9IYXJpY2FRV0FDU3ViQ0FSMS5jcmwwDgYDVR0PAQH/
+BAQDAgWgMIIBfQYKKwYBBAHWeQIEAgSCAW0EggFpAWcAdQA/F0tP1yJHWJQdZRyE
+vg0S7ZA3fx+FauvBvyiF7PhkbgAAAYvXHzTFAAAEAwBGMEQCIHhqaDntCMFrjsW3
+94U3B+n8hsaTHljDzhIwwWHmrLvJAiAJ/W+PXoSx0SV9C8hErAOUPKrBLhIm4+F5
+CaQbnIIKoQB3AO7N0GTV2xrOxVy3nbTNE6Iyh0Z8vOzew1FIWUZxH7WbAAABi9cf
+NQ0AAAQDAEgwRgIhANsaSmOqQ6bnpvxnKLZiP5ZW4FMs23xkB0J37PBOoC6IAiEA
+xaof+vjz7mzmR4F5cQZH8VxyD9puyNCY+s+/3bktwrYAdQDf4VbrqgWvtZwPhnGN
+qMAyTq5W2W6n9aVqAdHBO75SXAAAAYvXHzTwAAAEAwBGMEQCIHatKeTX4EdZgwW9
+QeLIq61SmASWuZBUx3WEUAMHMLFfAiAHnqibfXbLHVlvC3LxBVcjXPl6zta+G2oN
+ycWhfCYC5TANBgkqhkiG9w0BAQsFAAOCAgEANZ88Fa+ym325BQ2+gnH8X5no0Qu3
+zXQ3h/ZbD+546x6e/iAVueTwrdgnnporgFysWAet2q/wHu2nH41GhDmY9oJ7Od6w
+MQKYdkxZoMFg7qBXu0fikQjtPjZr1W3VjBFl/aQXw5yGCCuf35xNybwivZr6OSQj
+3kauYN8Lv57pkWcuC3NowpqagOk645EED1RpmfeH5g7Yxbigm3Dsz5rQiZxytkLL
+qUnd5jSjWe9xaj6UbrK/0u6TE+ji4eQm2K/A+KUnziOfblti/ndBv/GLEicvOW7t
+wgR27pK6n3c764084RYFsYLJZGuSptAfiJAa+o5D5hS4mIURDc9eETzyD+YUvKU/
+oPazTUb1FzemGKBiUPmpthKzPKKtPJ7uhPeQyJswKowSv2H4Jz5wcfeO28gi3NfR
+x9hpLR16UZXk90sZHWANtWTVLGPv3DDcXLZ5AE8dGEInQ9H/Vlfppbj9Nbs/AkHj
+IPvOSznvbpHk78ZKj821djpo/YDs4+dCCD7wY8ikO/bwAk8tK/5Nbme2b3e2bUuf
+xvuxfdxUo93KVR530Qhpy24i1CkGi+j+plFBIdQRhrw23BA2rrl29igqmzRQg+Dn
+37HCouLZSUHgjbXY2CUn1A+JSMfwNCcJ5tuNsZK8CyBDKs/PCkolacrEYPvLnPAM
+syRnlCMMEls3sMc=
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.extensions.8.extnValue.keyUsage,SubscriberKeyUsageValidator,WARNING,cabf.serverauth.subscriber_rsa_digitalsignature_and_keyencipherment_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 2.23.140.3.1
+certificate.tbsCertificate.subject.rdnSequence.3.0.value.x520OrganizationIdentifier,LegalPersonOrganizationIdentifierValidator,ERROR,etsi.en_319_412_1.leg-5.1.4-03.invalid_scheme,"Invalid registration scheme ""PAD"" in organization identifier: ""PADFR-ACPR-30748"""
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 1.3.6.1.5.5.7.1.3
+certificate.tbsCertificate.extensions.6.extnValue.cABFOrganizationIdentifier,CABFOrganizationIdentifierExtensionValidator,ERROR,cabf.invalid_organization_identifier_registration_scheme,"Invalid registration scheme: ""PAD"""
+certificate.tbsCertificate.subject.rdnSequence.3.0.value.x520OrganizationIdentifier,CabfOrganizationIdentifierAttributeValidator,ERROR,cabf.invalid_organization_identifier_registration_scheme,"Invalid registration scheme: ""PAD"""
+certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies.2.policyQualifiers.0,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
+certificate.tbsCertificate.subject.rdnSequence,EvSubscriberAttributeAllowanceValidator,WARNING,cabf.ev_guidelines.common_name_attribute_present,
+certificate.tbsCertificate.subject.rdnSequence.3.0.value.x520OrganizationIdentifier,PsdOrganizationIdentifierFormatValidator,ERROR,etsi.ts_119_495.gen-5.2.1-3.invalid_psd_organization_id_format,"Invalid PSD organization identifier format: ""PADFR-ACPR-30748"""
diff --git a/tests/integration_certificate/etsi/qevcp_w_psd2_eidas_non_browser_pre_certificate/validity_period_too_long.crttest b/tests/integration_certificate/etsi/qevcp_w_psd2_eidas_non_browser_pre_certificate/validity_period_too_long.crttest
new file mode 100644
index 0000000..d6df66d
--- /dev/null
+++ b/tests/integration_certificate/etsi/qevcp_w_psd2_eidas_non_browser_pre_certificate/validity_period_too_long.crttest
@@ -0,0 +1,56 @@
+-----BEGIN CERTIFICATE-----
+MIIHvzCCBaegAwIBAgIUaHFoHojMlU3qa6adMxyvPxlyg2UwDQYJKoZIhvcNAQEL
+BQAwVzELMAkGA1UEBhMCTkwxIDAeBgNVBAoMF1F1b1ZhZGlzIFRydXN0bGluayBC
+LlYuMSYwJAYDVQQDDB1RdW9WYWRpcyBRdWFsaWZpZWQgV2ViIElDQSBHMjAeFw0y
+MzA5MDYxMzQzNDBaFw0yNTA5MjYyMzQ1MDBaMIHEMRMwEQYLKwYBBAGCNzwCAQMT
+Ak5MMR0wGwYDVQQPDBRQcml2YXRlIE9yZ2FuaXphdGlvbjERMA8GA1UEBRMINjAz
+ODUwMTQxCzAJBgNVBAYTAk5MMRAwDgYDVQQIDAdVdHJlY2h0MRAwDgYDVQQHDAdV
+dHJlY2h0MRowGAYDVQRhDBFQU0ROTC1ETkItUjE2MTE2MjEXMBUGA1UECgwOTW9u
+ZXlNb25rIEIuVi4xFTATBgNVBAMMDG1vbmV5bW9uay5ubDCCASIwDQYJKoZIhvcN
+AQEBBQADggEPADCCAQoCggEBAMPTtcvEnft2QdRWGwj/ga0GcJJHiLtwbrzFfqVv
+Vk+bOjFAqDDFT+GtKbKVmbAS0z8t5W5dbUAtPrTgPmHky5Xfw9ZEGQ2KYMYAXyrl
+0aXcvYbtgILEhEW+zmfqM2wIY/X4Yf+nK0AQfZTGxu4KqC8nTP9pDxgRkEeuvUhl
+NCGK58J/NfREGwzJeWFWB9vqf72AKj06/2utpG3XLoQ5mAl146pY+Y9X4kKE6dfk
+82m3B0JnGfYF6qn4ZmTjl2ht5p+8678WvJj4kcKDORO+k/oeyouNnct1dHSKbL+D
+kUNqHqXPTAkqJsBcC0Z5hoWbYGxMzsBupSdbrNHbZ3yIF4ECAwEAAaOCAxMwggMP
+MB8GA1UdIwQYMBaAFLzrXvvYDeiCroZGvTt8sm/RLH8KMIGFBggrBgEFBQcBAQR5
+MHcwSQYIKwYBBQUHMAKGPWh0dHA6Ly90cnVzdC5xdW92YWRpc2dsb2JhbC5jb20v
+cXVvdmFkaXNxdWFsaWZpZWR3ZWJpY2FnMi5jcnQwKgYIKwYBBQUHMAGGHmh0dHA6
+Ly9vY3NwLnF1b3ZhZGlzZ2xvYmFsLmNvbTBgBgNVHREEWTBXggxtb25leW1vbmsu
+bmyCEGFwcC5tb25leW1vbmsubmyCEHd3dy5tb25leW1vbmsubmyCEGFwaS5tb25l
+eW1vbmsubmyCEXBzZDIubW9uZXltb25rLm5sMHQGA1UdIARtMGswCQYHBACL7EAB
+BDAOBgwrBgEEAb5YAAJkAQIwRQYKKwYBBAG+WAGDQjA3MDUGCCsGAQUFBwIBFilo
+dHRwczovL3d3dy5xdW92YWRpc2dsb2JhbC5jb20vcmVwb3NpdG9yeTAHBgVngQwB
+ATAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwgbcGCCsGAQUFBwEDBIGq
+MIGnMAoGCCsGAQUFBwsCMAgGBgQAjkYBATATBgYEAI5GAQYwCQYHBACORgEGAzA7
+BgYEAI5GAQUwMTAvFilodHRwczovL3d3dy5xdW92YWRpc2dsb2JhbC5jb20vcmVw
+b3NpdG9yeRMCZW4wPQYGBACBmCcCMDMwEzARBgcEAIGYJwEDDAZQU1BfQUkMFFRo
+ZSBOZXRoZXJsYW5kcyBCYW5rDAZOTC1ETkIwIQYFZ4EMAwEEGDAWEwNQU0QTAk5M
+DAtETkItUjE2MTE2MjBMBgNVHR8ERTBDMEGgP6A9hjtodHRwOi8vY3JsLnF1b3Zh
+ZGlzZ2xvYmFsLmNvbS9xdW92YWRpc3F1YWxpZmllZHdlYmljYWcyLmNybDAdBgNV
+HQ4EFgQUI/0De9jMgV41HNH37wEn+rDQl8UwDgYDVR0PAQH/BAQDAgWgMBMGCisG
+AQQB1nkCBAMBAf8EAgUAMA0GCSqGSIb3DQEBCwUAA4ICAQBOQkva9Lsf6yNsAdE6
+S/hAaK7z/9iOkaZkKE9++aD72Wun901a7YTB8VXj5/QJz8sAkMRR/IqiTTJc4fan
+xQ2eN4cu/XF2iDWh6r47EDPHEI9ifTycfClgi1yKyIWDwYBnRukFx5gEAvTZupDL
+kpb2mnzb3zijRO9asadtrw5DyrSgbwURaJEgDSG5zFIo4mNow0f/qNVw7JGgVDfE
+601SPpwCz9Pq3G9F7iTfheCk4878vW7IcqcwZny3Bmc9Xhn5cs/WTiGFqjGvcCZV
+b8EDa5awZbKEq8HvlHMNatlbNurbZcL57wc+A0mdo9Kbsq8vlKy/KDhkc98QFiiI
+kcmNBAzxzD3mMi/dchgDDSQ/ExKEzjeZJVGTvJl7UwJJRENx2Ld+g7jrUmgz7xk8
+0bUgcr4GAMLWa7MHyR9zFJH/uRAFIPKvOshW43/AOP7Gyyk8EIx/z6K5geZduQx9
+xhw7WAsr8AbPr9cUbmU2LuFBmWU0FQ6KLw4/RvVe/PlTyidOz0IDofp5hRZHzsqG
+4B88XgQp0P4NnJWbpvfUqluT3Ku67SFh25lVOf9+NEuilSM6N5iY5HGUFXn5UD0G
+zpIhrzlRaotYcUkwgw6uW5iuaZOjw+tj3y8ZhRLalmU/W2J35ZRDZsyZKdpGhlxq
+Nx20qkdhYz/f2naib9pus/ileA==
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.validity.notBefore,SubscriberValidityPeriodValidator,ERROR,cabf.certificate_validity_period_exceeds_398_days,"Validity period of 751 days, 10:01:21 exceeds maximum value of 398 days, 0:00:00"
+certificate.tbsCertificate.subject.rdnSequence,EvSubscriberAttributeAllowanceValidator,WARNING,cabf.ev_guidelines.common_name_attribute_present,
+certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies,SubscriberPoliciesValidator,WARNING,cabf.serverauth.subscriber_first_policy_oid_not_reserved,
+certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies.2.policyQualifiers.0,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
+certificate.tbsCertificate.extensions.8.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
+certificate.tbsCertificate.extensions.9.extnValue.keyUsage,SubscriberKeyUsageValidator,WARNING,cabf.serverauth.subscriber_rsa_digitalsignature_and_keyencipherment_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.subject_key_identifier_extension_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 1.3.6.1.5.5.7.1.3
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 2.23.140.3.1
+certificate.tbsCertificate.validity.notBefore,SubscriberValidityPeriodValidator,ERROR,cabf.certificate_validity_period_exceeds_398_days,"Validity period of 751 days, 10:01:21 exceeds maximum value of 398 days, 0:00:00"
diff --git a/tests/integration_certificate/etsi/qevcp_w_psd2_eidas_non_browser_pre_certificate/validity_period_too_long_with_psd2_policy.crttest b/tests/integration_certificate/etsi/qevcp_w_psd2_eidas_non_browser_pre_certificate/validity_period_too_long_with_psd2_policy.crttest
new file mode 100644
index 0000000..cc568ba
--- /dev/null
+++ b/tests/integration_certificate/etsi/qevcp_w_psd2_eidas_non_browser_pre_certificate/validity_period_too_long_with_psd2_policy.crttest
@@ -0,0 +1,54 @@
+-----BEGIN CERTIFICATE-----
+MIIHyjCCBbKgAwIBAgIUaHFoHojMlU3qa6adMxyvPxlyg2UwDQYJKoZIhvcNAQEL
+BQAwVzELMAkGA1UEBhMCTkwxIDAeBgNVBAoMF1F1b1ZhZGlzIFRydXN0bGluayBC
+LlYuMSYwJAYDVQQDDB1RdW9WYWRpcyBRdWFsaWZpZWQgV2ViIElDQSBHMjAeFw0y
+MzA5MDYxMzQzNDBaFw0yNTA5MjYyMzQ1MDBaMIHEMRMwEQYLKwYBBAGCNzwCAQMT
+Ak5MMR0wGwYDVQQPDBRQcml2YXRlIE9yZ2FuaXphdGlvbjERMA8GA1UEBRMINjAz
+ODUwMTQxCzAJBgNVBAYTAk5MMRAwDgYDVQQIDAdVdHJlY2h0MRAwDgYDVQQHDAdV
+dHJlY2h0MRowGAYDVQRhDBFQU0ROTC1ETkItUjE2MTE2MjEXMBUGA1UECgwOTW9u
+ZXlNb25rIEIuVi4xFTATBgNVBAMMDG1vbmV5bW9uay5ubDCCASIwDQYJKoZIhvcN
+AQEBBQADggEPADCCAQoCggEBAMPTtcvEnft2QdRWGwj/ga0GcJJHiLtwbrzFfqVv
+Vk+bOjFAqDDFT+GtKbKVmbAS0z8t5W5dbUAtPrTgPmHky5Xfw9ZEGQ2KYMYAXyrl
+0aXcvYbtgILEhEW+zmfqM2wIY/X4Yf+nK0AQfZTGxu4KqC8nTP9pDxgRkEeuvUhl
+NCGK58J/NfREGwzJeWFWB9vqf72AKj06/2utpG3XLoQ5mAl146pY+Y9X4kKE6dfk
+82m3B0JnGfYF6qn4ZmTjl2ht5p+8678WvJj4kcKDORO+k/oeyouNnct1dHSKbL+D
+kUNqHqXPTAkqJsBcC0Z5hoWbYGxMzsBupSdbrNHbZ3yIF4ECAwEAAaOCAx4wggMa
+MB8GA1UdIwQYMBaAFLzrXvvYDeiCroZGvTt8sm/RLH8KMIGFBggrBgEFBQcBAQR5
+MHcwSQYIKwYBBQUHMAKGPWh0dHA6Ly90cnVzdC5xdW92YWRpc2dsb2JhbC5jb20v
+cXVvdmFkaXNxdWFsaWZpZWR3ZWJpY2FnMi5jcnQwKgYIKwYBBQUHMAGGHmh0dHA6
+Ly9vY3NwLnF1b3ZhZGlzZ2xvYmFsLmNvbTBgBgNVHREEWTBXggxtb25leW1vbmsu
+bmyCEGFwcC5tb25leW1vbmsubmyCEHd3dy5tb25leW1vbmsubmyCEGFwaS5tb25l
+eW1vbmsubmyCEXBzZDIubW9uZXltb25rLm5sMH8GA1UdIAR4MHYwCQYHBACL7EAB
+BDAJBgcEAIGYJwMBMA4GDCsGAQQBvlgAAmQBAjBFBgorBgEEAb5YAYNCMDcwNQYI
+KwYBBQUHAgEWKWh0dHBzOi8vd3d3LnF1b3ZhZGlzZ2xvYmFsLmNvbS9yZXBvc2l0
+b3J5MAcGBWeBDAEBMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATCBtwYI
+KwYBBQUHAQMEgaowgacwCgYIKwYBBQUHCwIwCAYGBACORgEBMBMGBgQAjkYBBjAJ
+BgcEAI5GAQYDMDsGBgQAjkYBBTAxMC8WKWh0dHBzOi8vd3d3LnF1b3ZhZGlzZ2xv
+YmFsLmNvbS9yZXBvc2l0b3J5EwJlbjA9BgYEAIGYJwIwMzATMBEGBwQAgZgnAQMM
+BlBTUF9BSQwUVGhlIE5ldGhlcmxhbmRzIEJhbmsMBk5MLUROQjAhBgVngQwDAQQY
+MBYTA1BTRBMCTkwMC0ROQi1SMTYxMTYyMEwGA1UdHwRFMEMwQaA/oD2GO2h0dHA6
+Ly9jcmwucXVvdmFkaXNnbG9iYWwuY29tL3F1b3ZhZGlzcXVhbGlmaWVkd2ViaWNh
+ZzIuY3JsMB0GA1UdDgQWBBQj/QN72MyBXjUc0ffvASf6sNCXxTAOBgNVHQ8BAf8E
+BAMCBaAwEwYKKwYBBAHWeQIEAwEB/wQCBQAwDQYJKoZIhvcNAQELBQADggIBAE5C
+S9r0ux/rI2wB0TpL+EBorvP/2I6RpmQoT375oPvZa6f3TVrthMHxVePn9AnPywCQ
+xFH8iqJNMlzh9qfFDZ43hy79cXaINaHqvjsQM8cQj2J9PJx8KWCLXIrIhYPBgGdG
+6QXHmAQC9Nm6kMuSlvaafNvfOKNE71qxp22vDkPKtKBvBRFokSANIbnMUijiY2jD
+R/+o1XDskaBUN8TrTVI+nALP0+rcb0XuJN+F4KTjzvy9bshypzBmfLcGZz1eGfly
+z9ZOIYWqMa9wJlVvwQNrlrBlsoSrwe+Ucw1q2Vs26ttlwvnvBz4DSZ2j0puyry+U
+rL8oOGRz3xAWKIiRyY0EDPHMPeYyL91yGAMNJD8TEoTON5klUZO8mXtTAklEQ3HY
+t36DuOtSaDPvGTzRtSByvgYAwtZrswfJH3MUkf+5EAUg8q86yFbjf8A4/sbLKTwQ
+jH/PormB5l25DH3GHDtYCyvwBs+v1xRuZTYu4UGZZTQVDoovDj9G9V78+VPKJ07P
+QgOh+nmFFkfOyobgHzxeBCnQ/g2clZum99SqW5Pcq7rtIWHbmVU5/340S6KVIzo3
+mJjkcZQVeflQPQbOkiGvOVFqi1hxSTCDDq5bmK5pk6PD62PfLxmFEtqWZT9bYnfl
+lENmzJkp2kaGXGo3HbSqR2FjP9/adqJv2m6z+KV4
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.subject.rdnSequence,EvSubscriberAttributeAllowanceValidator,WARNING,cabf.ev_guidelines.common_name_attribute_present,
+certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies,SubscriberPoliciesValidator,WARNING,cabf.serverauth.subscriber_first_policy_oid_not_reserved,
+certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies.3.policyQualifiers.0,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
+certificate.tbsCertificate.extensions.8.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
+certificate.tbsCertificate.extensions.9.extnValue.keyUsage,SubscriberKeyUsageValidator,WARNING,cabf.serverauth.subscriber_rsa_digitalsignature_and_keyencipherment_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.subject_key_identifier_extension_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 1.3.6.1.5.5.7.1.3
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 2.23.140.3.1
diff --git a/tests/integration_certificate/etsi/qevcp_w_psd2_eidas_pre_certificate/badurl.crttest b/tests/integration_certificate/etsi/qevcp_w_psd2_eidas_pre_certificate/badurl.crttest
new file mode 100644
index 0000000..7a09596
--- /dev/null
+++ b/tests/integration_certificate/etsi/qevcp_w_psd2_eidas_pre_certificate/badurl.crttest
@@ -0,0 +1,49 @@
+-----BEGIN CERTIFICATE-----
+MIIG6zCCBdOgAwIBAgIQK7B0T5Jt9ZbWmXDNexg0FjANBgkqhkiG9w0BAQsFADB3
+MQswCQYDVQQGEwJFUzEZMBcGA1UEChMQRW50cnVzdCBFVSwgUy5MLjEYMBYGA1UE
+YRMPVkFURVMtQjgxMTg4MDQ3MTMwMQYDVQQDEypFbnRydXN0IENlcnRpZmljYXRp
+b24gQXV0aG9yaXR5IC0gRVMgUVdBQzIwHhcNMjQwMTI2MTA0NzE3WhcNMjUwMTI1
+MTA0NzE2WjCBuDELMAkGA1UEBhMCRkkxETAPBgNVBAcTCEhlbHNpbmtpMRMwEQYL
+KwYBBAGCNzwCAQMTAkZJMRgwFgYDVQQKEw9Ob3JkZWEgQmFuayBBYnAxHTAbBgNV
+BA8TFFByaXZhdGUgT3JnYW5pemF0aW9uMRIwEAYDVQQFEwkyODU4Mzk0LTkxEzAR
+BgNVBAMTCm5vcmRlYS5jb20xHzAdBgNVBGETFlBTREZJLUZJTkZTQS0yODU4Mzk0
+LTkwggGiMA0GCSqGSIb3DQEBAQUAA4IBjwAwggGKAoIBgQCvkzcQBXg1m7bjVOFf
+9Zvw9YsHxB+/U10b1f8Ar+SSh46WJAlocmp88gGNMyLl44uEILmRWWno0r7xBqPS
+9YrsnBiAePi7QTnb3ag50M1l1smNlpdzhzU0hGdVZi92GvjVlTL/5/5ZqdhDgPsq
+ly/q0tz3GifmSpAJVetoCME30Rag5HTK8OdpSs+weimafSf/59nilC2x/6E4+/Af
+0iiJ5f719lZ/GGLdwm1fn+fXgAS5mXYxp7/D+hZqyngOiYVufoRRMjumeCEUTsz2
+yiCTJ2zXzgf8YTnFs7V/v1YNWhH2BsVnQJjgqIz5dc9ZxlEN2cGO5jEqSLm1RPZM
+MH2hUx7s/Ulx5+qu7TzNorLO9aHMFSrlRm0k2wcQbNaDSkIBS4utO56QEl+momSt
+ZRyd8kc40VaBlcM3Tbac86mCbOrMTQua19UvX6AgFg4V3Uysi9YpY6efMc4XhNvx
+t7Sg2E4VymdyqLRQ1A1g2DvH63hVVLZ+7ZGAjzes/AxRX78CAwEAAaOCAq8wggKr
+MAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFK8C0yrZwru1bR+AVroLqmQsFP9LMB8G
+A1UdIwQYMBaAFEHPrisdYzvLTPWQRHm2WiSJ35KcMGkGCCsGAQUFBwEBBF0wWzAj
+BggrBgEFBQcwAYYXaHR0cDovL29jc3AuZW50cnVzdC5uZXQwNAYIKwYBBQUHMAKG
+KGh0dHA6Ly9haWEuZW50cnVzdC5uZXQvZXNxd2FjMi1jaGFpbi5jZXIwNQYDVR0f
+BC4wLDAqoCigJoYkaHR0cDovL2NybC5lbnRydXN0Lm5ldC9lc3F3YWMyY2EuY3Js
+MCYGBWeBDAMBBB0wGxMDUFNEEwJGSQwQRklORlNBLTI4NTgzOTQtOTCB7QYIKwYB
+BQUHAQMEgeAwgd0wCAYGBACORgEBMCwGBgQAjkYBBTAiMCAWGmh0dHA6Ly93d3cu
+ZW50cnVzdC5uZXQvcnBhEwJlbjATBgYEAI5GAQYwCQYHBACORgEGAzCBjQYGBACB
+mCcCMIGCMEwwEQYHBACBmCcBAwwGUFNQX0FJMBEGBwQAgZgnAQEMBlBTUF9BUzAR
+BgcEAIGYJwEEDAZQU1BfSUMwEQYHBACBmCcBAgwGUFNQX1BJDCdGaW5uaXNoIEZp
+bmFuY2lhbCBTdXBlcnZpc29yeSBBdXRob3JpdHkMCUZJLUZJTkZTQTAlBgNVHREE
+HjAcggpub3JkZWEuY29tgg53d3cubm9yZGVhLmNvbTAOBgNVHQ8BAf8EBAMCBaAw
+HQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMDYGA1UdIAQvMC0wBwYFZ4EM
+AQEwCQYHBACL7EABBDAJBgcEAIGYJwMBMAwGCmCGSAGG+mwKAQIwEwYKKwYBBAHW
+eQIEAwEB/wQCBQAwDQYJKoZIhvcNAQELBQADggEBAFEYUgnNMEQ3vHq0gS1Rb1Yk
+6oJbuY6nYZvafINldl1U2oSp5bRHDzsZ+ZwDgWdX8aU5JJyCcE+2poPeL0gID4BB
+XAzK5/A1qxJnlePOw6CS7KuKcCYTAyTlGefzZwxFF6i4BNHovUntUpY3h8RpNpnk
+LDMX78frkLgoaMH1M98AJSzYxuHLnB6PAw274Uron12pKLqHj1yEqlSj0T3xpIG2
+nR9mMP7bxi60LW28bkO33RxlpkT1UZtTLh2C1qOW11vocAltwwMIXbDXvUi7MhgZ
+JsFZNl5LnR1l3baH6gpcvZvJ43HWdLhngSzgQuNEyzGcPiX4yuauEdYCgQxYF88=
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.extensions.6.extnValue.qCStatements.1.statementInfo.qcEuPDS.0,QcEuPDSHttpsURLValidator,ERROR,etsi.en_319_412_5.gen-4.3.4.url_scheme_not_https,"Non-HTTPS URL scheme found: ""http"""
+certificate.tbsCertificate.extensions.8.extnValue.keyUsage,SubscriberKeyUsageValidator,WARNING,cabf.serverauth.subscriber_rsa_digitalsignature_and_keyencipherment_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.subject_key_identifier_extension_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 2.23.140.3.1
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 1.3.6.1.5.5.7.1.3
+certificate.tbsCertificate.extensions.1.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
+certificate.tbsCertificate.extensions.10.extnValue.certificatePolicies,EvCpsUriPresenceValidator,ERROR,cabf.ev_guidelines.cps_uri_policy_qualifier_missing,
+certificate.tbsCertificate.subject.rdnSequence,EvSubscriberAttributeAllowanceValidator,WARNING,cabf.ev_guidelines.common_name_attribute_present,
diff --git a/tests/integration_certificate/etsi/qevcp_w_psd2_eidas_pre_certificate/iso639.crttest b/tests/integration_certificate/etsi/qevcp_w_psd2_eidas_pre_certificate/iso639.crttest
new file mode 100644
index 0000000..8ec4ca8
--- /dev/null
+++ b/tests/integration_certificate/etsi/qevcp_w_psd2_eidas_pre_certificate/iso639.crttest
@@ -0,0 +1,49 @@
+-----BEGIN CERTIFICATE-----
+MIIG7DCCBdSgAwIBAgIQK7B0T5Jt9ZbWmXDNexg0FjANBgkqhkiG9w0BAQsFADB3
+MQswCQYDVQQGEwJFUzEZMBcGA1UEChMQRW50cnVzdCBFVSwgUy5MLjEYMBYGA1UE
+YRMPVkFURVMtQjgxMTg4MDQ3MTMwMQYDVQQDEypFbnRydXN0IENlcnRpZmljYXRp
+b24gQXV0aG9yaXR5IC0gRVMgUVdBQzIwHhcNMjQwMTI2MTA0NzE3WhcNMjUwMTI1
+MTA0NzE2WjCBuDELMAkGA1UEBhMCRkkxETAPBgNVBAcTCEhlbHNpbmtpMRMwEQYL
+KwYBBAGCNzwCAQMTAkZJMRgwFgYDVQQKEw9Ob3JkZWEgQmFuayBBYnAxHTAbBgNV
+BA8TFFByaXZhdGUgT3JnYW5pemF0aW9uMRIwEAYDVQQFEwkyODU4Mzk0LTkxEzAR
+BgNVBAMTCm5vcmRlYS5jb20xHzAdBgNVBGETFlBTREZJLUZJTkZTQS0yODU4Mzk0
+LTkwggGiMA0GCSqGSIb3DQEBAQUAA4IBjwAwggGKAoIBgQCvkzcQBXg1m7bjVOFf
+9Zvw9YsHxB+/U10b1f8Ar+SSh46WJAlocmp88gGNMyLl44uEILmRWWno0r7xBqPS
+9YrsnBiAePi7QTnb3ag50M1l1smNlpdzhzU0hGdVZi92GvjVlTL/5/5ZqdhDgPsq
+ly/q0tz3GifmSpAJVetoCME30Rag5HTK8OdpSs+weimafSf/59nilC2x/6E4+/Af
+0iiJ5f719lZ/GGLdwm1fn+fXgAS5mXYxp7/D+hZqyngOiYVufoRRMjumeCEUTsz2
+yiCTJ2zXzgf8YTnFs7V/v1YNWhH2BsVnQJjgqIz5dc9ZxlEN2cGO5jEqSLm1RPZM
+MH2hUx7s/Ulx5+qu7TzNorLO9aHMFSrlRm0k2wcQbNaDSkIBS4utO56QEl+momSt
+ZRyd8kc40VaBlcM3Tbac86mCbOrMTQua19UvX6AgFg4V3Uysi9YpY6efMc4XhNvx
+t7Sg2E4VymdyqLRQ1A1g2DvH63hVVLZ+7ZGAjzes/AxRX78CAwEAAaOCArAwggKs
+MAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFK8C0yrZwru1bR+AVroLqmQsFP9LMB8G
+A1UdIwQYMBaAFEHPrisdYzvLTPWQRHm2WiSJ35KcMGkGCCsGAQUFBwEBBF0wWzAj
+BggrBgEFBQcwAYYXaHR0cDovL29jc3AuZW50cnVzdC5uZXQwNAYIKwYBBQUHMAKG
+KGh0dHA6Ly9haWEuZW50cnVzdC5uZXQvZXNxd2FjMi1jaGFpbi5jZXIwNQYDVR0f
+BC4wLDAqoCigJoYkaHR0cDovL2NybC5lbnRydXN0Lm5ldC9lc3F3YWMyY2EuY3Js
+MCYGBWeBDAMBBB0wGxMDUFNEEwJGSQwQRklORlNBLTI4NTgzOTQtOTCB7gYIKwYB
+BQUHAQMEgeEwgd4wCAYGBACORgEBMC0GBgQAjkYBBTAjMCEWG2h0dHBzOi8vd3d3
+LmVudHJ1c3QubmV0L3JwYRMCeHkwEwYGBACORgEGMAkGBwQAjkYBBgMwgY0GBgQA
+gZgnAjCBgjBMMBEGBwQAgZgnAQMMBlBTUF9BSTARBgcEAIGYJwEBDAZQU1BfQVMw
+EQYHBACBmCcBBAwGUFNQX0lDMBEGBwQAgZgnAQIMBlBTUF9QSQwnRmlubmlzaCBG
+aW5hbmNpYWwgU3VwZXJ2aXNvcnkgQXV0aG9yaXR5DAlGSS1GSU5GU0EwJQYDVR0R
+BB4wHIIKbm9yZGVhLmNvbYIOd3d3Lm5vcmRlYS5jb20wDgYDVR0PAQH/BAQDAgWg
+MB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjA2BgNVHSAELzAtMAcGBWeB
+DAEBMAkGBwQAi+xAAQQwCQYHBACBmCcDATAMBgpghkgBhvpsCgECMBMGCisGAQQB
+1nkCBAMBAf8EAgUAMA0GCSqGSIb3DQEBCwUAA4IBAQBRGFIJzTBEN7x6tIEtUW9W
+JOqCW7mOp2Gb2nyDZXZdVNqEqeW0Rw87GfmcA4FnV/GlOSScgnBPtqaD3i9ICA+A
+QVwMyufwNasSZ5XjzsOgkuyrinAmEwMk5Rnn82cMRReouATR6L1J7VKWN4fEaTaZ
+5CwzF+/H65C4KGjB9TPfACUs2Mbhy5wejwMNu+FK6J9dqSi6h49chKpUo9E98aSB
+tp0fZjD+28YutC1tvG5Dt90cZaZE9VGbUy4dgtajltdb6HAJbcMDCF2w171IuzIY
+GSbBWTZeS50dZd22h+oKXL2byeNx1nS4Z4Es4ELjRMsxnD4l+MrmrhHWAoEMWBfP
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.extensions.6.extnValue.qCStatements.1.statementInfo.qcEuPDS.0,QcEuPDSLanguageValidator,ERROR,etsi.en_319_412_5.gen-4.3.4.iso_language_code_invalid,"Invalid language code found: ""xy"""
+certificate.tbsCertificate.extensions.8.extnValue.keyUsage,SubscriberKeyUsageValidator,WARNING,cabf.serverauth.subscriber_rsa_digitalsignature_and_keyencipherment_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.subject_key_identifier_extension_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 2.23.140.3.1
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 1.3.6.1.5.5.7.1.3
+certificate.tbsCertificate.extensions.1.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
+certificate.tbsCertificate.extensions.10.extnValue.certificatePolicies,EvCpsUriPresenceValidator,ERROR,cabf.ev_guidelines.cps_uri_policy_qualifier_missing,
+certificate.tbsCertificate.subject.rdnSequence,EvSubscriberAttributeAllowanceValidator,WARNING,cabf.ev_guidelines.common_name_attribute_present,
diff --git a/tests/integration_certificate/etsi/qevcp_w_psd2_eidas_pre_certificate/nca_id_badiso.crttest b/tests/integration_certificate/etsi/qevcp_w_psd2_eidas_pre_certificate/nca_id_badiso.crttest
new file mode 100644
index 0000000..0d6ec2b
--- /dev/null
+++ b/tests/integration_certificate/etsi/qevcp_w_psd2_eidas_pre_certificate/nca_id_badiso.crttest
@@ -0,0 +1,54 @@
+-----BEGIN CERTIFICATE-----
+MIIHljCCBX6gAwIBAgIUJZ7MTdvRPBvqnKpHKZj47ASxdNIwDQYJKoZIhvcNAQEL
+BQAwVzELMAkGA1UEBhMCTkwxIDAeBgNVBAoMF1F1b1ZhZGlzIFRydXN0bGluayBC
+LlYuMSYwJAYDVQQDDB1RdW9WYWRpcyBRdWFsaWZpZWQgV2ViIElDQSBHMjAeFw0y
+MzA2MTUwNzM0NThaFw0yNDA2MTUwNzI5MDBaMIHHMRMwEQYLKwYBBAGCNzwCAQMT
+Ak5MMR0wGwYDVQQPDBRQcml2YXRlIE9yZ2FuaXphdGlvbjERMA8GA1UEBRMINjgy
+NjI2MjAxCzAJBgNVBAYTAk5MMRYwFAYDVQQIDA1Ob29yZC1Ib2xsYW5kMRIwEAYD
+VQQHDAlBbXN0ZXJkYW0xGjAYBgNVBGEMEVBTRE5MLUROQi1SMTM0NDI4MRMwEQYD
+VQQKDApQZWFrcyBCLlYuMRQwEgYDVQQDDAtwZWFrcy5jbG91ZDCCASIwDQYJKoZI
+hvcNAQEBBQADggEPADCCAQoCggEBAPp5zKRWdzbiG/v3bcAk32hV1MxYC5ZNmW7f
++bvjo1ezZnFYT4c9dx4J89G3V9zQUa8V/8UwbgKmld1b8vUl8OrRfj8iwY6s6uzP
+iXS798bweJgHkapkxL5ac9acpZSBRVZKDMft+HloscKZ5iehkspeorkX7BHtbW5v
+UVLrHGXZNLx8g7UXyXcky52gyRz/EAKnAU/NpHtS/hUX+VkeFTCTIloQHis2UMoo
+28Rn2UXXbbRZa6SqTA3npyuOn8EgsX57hw39lqX2YYHj0lgjdpCpKW7i6FbHJaq1
+7rZobyYXi17Bfzcg/pyj7vaSMQG1CivAjj/PlFvAeadzE4HfPi8CAwEAAaOCAucw
+ggLjMB8GA1UdIwQYMBaAFLzrXvvYDeiCroZGvTt8sm/RLH8KMIGFBggrBgEFBQcB
+AQR5MHcwSQYIKwYBBQUHMAKGPWh0dHA6Ly90cnVzdC5xdW92YWRpc2dsb2JhbC5j
+b20vcXVvdmFkaXNxdWFsaWZpZWR3ZWJpY2FnMi5jcnQwKgYIKwYBBQUHMAGGHmh0
+dHA6Ly9vY3NwLnF1b3ZhZGlzZ2xvYmFsLmNvbTAWBgNVHREEDzANggtwZWFrcy5j
+bG91ZDB/BgNVHSAEeDB2MAkGBwQAi+xAAQQwCQYHBACBmCcDATAOBgwrBgEEAb5Y
+AAJkAQIwRQYKKwYBBAG+WAGDQjA3MDUGCCsGAQUFBwIBFilodHRwczovL3d3dy5x
+dW92YWRpc2dsb2JhbC5jb20vcmVwb3NpdG9yeTAHBgVngQwBATAdBgNVHSUEFjAU
+BggrBgEFBQcDAgYIKwYBBQUHAwEwgcoGCCsGAQUFBwEDBIG9MIG6MAoGCCsGAQUF
+BwsCMAgGBgQAjkYBATATBgYEAI5GAQYwCQYHBACORgEGAzA7BgYEAI5GAQUwMTAv
+FilodHRwczovL3d3dy5xdW92YWRpc2dsb2JhbC5jb20vcmVwb3NpdG9yeRMCZW4w
+UAYGBACBmCcCMEYwJjARBgcEAIGYJwECDAZQU1BfUEkwEQYHBACBmCcBAwwGUFNQ
+X0FJDBRUaGUgTmV0aGVybGFuZHMgQmFuawwGWFktRE5CMCEGBWeBDAMBBBgwFhMD
+UFNEEwJOTAwLRE5CLVIxMzQ0MjgwTAYDVR0fBEUwQzBBoD+gPYY7aHR0cDovL2Ny
+bC5xdW92YWRpc2dsb2JhbC5jb20vcXVvdmFkaXNxdWFsaWZpZWR3ZWJpY2FnMi5j
+cmwwHQYDVR0OBBYEFGiv8Wrgca1VlUYKqUIFFNqxvMFWMA4GA1UdDwEB/wQEAwIF
+oDATBgorBgEEAdZ5AgQDAQH/BAIFADANBgkqhkiG9w0BAQsFAAOCAgEAaQTIdiI9
+6jNdgvyvI+fkXXwUoEEaQzeFha/idRKAPRu7WchzGPohAdKjNSnVFDCavU3R9wdx
+ASq67Da3nwT7l4Hzn7TeM/xXIFtHUsKriBZzW8jvOpZBTBeqwW5NZeZfSIvgGa0/
+YtI4xNMqIH5YCPJDxcJg0fNcmbVhx8sKdXAAifIQxfV5ohtR3Ceu0mJMxkajdIF3
+4CX6KWuM3mMJL3o58rrZt7ow3Jrpq5L5VcXnMiRkADuj5zyKrKqOxtjHV2G8YDbz
+MwMcPWR5SMYFFgPrvaPZc3hQQn2LHoU2bSwzp9pV3Cwro2jjBvpBHfAL6KIgU17K
+nOfLCrRo/AE/t1g/D+M1sLJtsOUxlBC25Qs55LwuBn+1dZxhwDBHvb6t0WUkBd1s
+0oV7XYxnS7g7UyigtQXuW4bONMq44wkHQgChIpY+8QV5DbXanRKluPJB3DhqYCg/
+y4QG38dbWq0uzHv2PLwxGcrPuE27h6GX8X/MTcP40Nt9o3NoZfgBU4b4eXta+3MM
+hw0qrXPtahfbd82+OjtR/k6HFtpojUCFt8NAYF/0g/9fgp0gQ+OOQy/+k3C9+L3l
+FCHfWEXfDEXoaPOUN0KvXQaB5IPEOlILgx3lB2UuIgDZch3m2WFDRvVtUdqYO7u9
+guGnA3O0pfhF0HRD/WgXt4Wzvv9o7wIVZLQ=
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.subject.rdnSequence,EvSubscriberAttributeAllowanceValidator,WARNING,cabf.ev_guidelines.common_name_attribute_present,
+certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies,SubscriberPoliciesValidator,WARNING,cabf.serverauth.subscriber_first_policy_oid_not_reserved,
+certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies.3.policyQualifiers.0,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
+certificate.tbsCertificate.extensions.5.extnValue.qCStatements.4.statementInfo.pSD2QcType.nCAId,NCAIdValidator,ERROR,etsi.ts_119_495.gen-5.2.3-2.invalid_iso_country,Invalid ISO country code: XY
+certificate.tbsCertificate.extensions.8.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
+certificate.tbsCertificate.extensions.9.extnValue.keyUsage,SubscriberKeyUsageValidator,WARNING,cabf.serverauth.subscriber_rsa_digitalsignature_and_keyencipherment_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.subject_key_identifier_extension_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 1.3.6.1.5.5.7.1.3
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 2.23.140.3.1
diff --git a/tests/integration_certificate/etsi/qevcp_w_psd2_eidas_pre_certificate/nca_id_badstructure.crttest b/tests/integration_certificate/etsi/qevcp_w_psd2_eidas_pre_certificate/nca_id_badstructure.crttest
new file mode 100644
index 0000000..c59fd29
--- /dev/null
+++ b/tests/integration_certificate/etsi/qevcp_w_psd2_eidas_pre_certificate/nca_id_badstructure.crttest
@@ -0,0 +1,54 @@
+-----BEGIN CERTIFICATE-----
+MIIHlTCCBX2gAwIBAgIUJZ7MTdvRPBvqnKpHKZj47ASxdNIwDQYJKoZIhvcNAQEL
+BQAwVzELMAkGA1UEBhMCTkwxIDAeBgNVBAoMF1F1b1ZhZGlzIFRydXN0bGluayBC
+LlYuMSYwJAYDVQQDDB1RdW9WYWRpcyBRdWFsaWZpZWQgV2ViIElDQSBHMjAeFw0y
+MzA2MTUwNzM0NThaFw0yNDA2MTUwNzI5MDBaMIHHMRMwEQYLKwYBBAGCNzwCAQMT
+Ak5MMR0wGwYDVQQPDBRQcml2YXRlIE9yZ2FuaXphdGlvbjERMA8GA1UEBRMINjgy
+NjI2MjAxCzAJBgNVBAYTAk5MMRYwFAYDVQQIDA1Ob29yZC1Ib2xsYW5kMRIwEAYD
+VQQHDAlBbXN0ZXJkYW0xGjAYBgNVBGEMEVBTRE5MLUROQi1SMTM0NDI4MRMwEQYD
+VQQKDApQZWFrcyBCLlYuMRQwEgYDVQQDDAtwZWFrcy5jbG91ZDCCASIwDQYJKoZI
+hvcNAQEBBQADggEPADCCAQoCggEBAPp5zKRWdzbiG/v3bcAk32hV1MxYC5ZNmW7f
++bvjo1ezZnFYT4c9dx4J89G3V9zQUa8V/8UwbgKmld1b8vUl8OrRfj8iwY6s6uzP
+iXS798bweJgHkapkxL5ac9acpZSBRVZKDMft+HloscKZ5iehkspeorkX7BHtbW5v
+UVLrHGXZNLx8g7UXyXcky52gyRz/EAKnAU/NpHtS/hUX+VkeFTCTIloQHis2UMoo
+28Rn2UXXbbRZa6SqTA3npyuOn8EgsX57hw39lqX2YYHj0lgjdpCpKW7i6FbHJaq1
+7rZobyYXi17Bfzcg/pyj7vaSMQG1CivAjj/PlFvAeadzE4HfPi8CAwEAAaOCAuYw
+ggLiMB8GA1UdIwQYMBaAFLzrXvvYDeiCroZGvTt8sm/RLH8KMIGFBggrBgEFBQcB
+AQR5MHcwSQYIKwYBBQUHMAKGPWh0dHA6Ly90cnVzdC5xdW92YWRpc2dsb2JhbC5j
+b20vcXVvdmFkaXNxdWFsaWZpZWR3ZWJpY2FnMi5jcnQwKgYIKwYBBQUHMAGGHmh0
+dHA6Ly9vY3NwLnF1b3ZhZGlzZ2xvYmFsLmNvbTAWBgNVHREEDzANggtwZWFrcy5j
+bG91ZDB/BgNVHSAEeDB2MAkGBwQAi+xAAQQwCQYHBACBmCcDATAOBgwrBgEEAb5Y
+AAJkAQIwRQYKKwYBBAG+WAGDQjA3MDUGCCsGAQUFBwIBFilodHRwczovL3d3dy5x
+dW92YWRpc2dsb2JhbC5jb20vcmVwb3NpdG9yeTAHBgVngQwBATAdBgNVHSUEFjAU
+BggrBgEFBQcDAgYIKwYBBQUHAwEwgckGCCsGAQUFBwEDBIG8MIG5MAoGCCsGAQUF
+BwsCMAgGBgQAjkYBATATBgYEAI5GAQYwCQYHBACORgEGAzA7BgYEAI5GAQUwMTAv
+FilodHRwczovL3d3dy5xdW92YWRpc2dsb2JhbC5jb20vcmVwb3NpdG9yeRMCZW4w
+TwYGBACBmCcCMEUwJjARBgcEAIGYJwECDAZQU1BfUEkwEQYHBACBmCcBAwwGUFNQ
+X0FJDBRUaGUgTmV0aGVybGFuZHMgQmFuawwFTkxETkIwIQYFZ4EMAwEEGDAWEwNQ
+U0QTAk5MDAtETkItUjEzNDQyODBMBgNVHR8ERTBDMEGgP6A9hjtodHRwOi8vY3Js
+LnF1b3ZhZGlzZ2xvYmFsLmNvbS9xdW92YWRpc3F1YWxpZmllZHdlYmljYWcyLmNy
+bDAdBgNVHQ4EFgQUaK/xauBxrVWVRgqpQgUU2rG8wVYwDgYDVR0PAQH/BAQDAgWg
+MBMGCisGAQQB1nkCBAMBAf8EAgUAMA0GCSqGSIb3DQEBCwUAA4ICAQBpBMh2Ij3q
+M12C/K8j5+RdfBSgQRpDN4WFr+J1EoA9G7tZyHMY+iEB0qM1KdUUMJq9TdH3B3EB
+KrrsNrefBPuXgfOftN4z/FcgW0dSwquIFnNbyO86lkFMF6rBbk1l5l9Ii+AZrT9i
+0jjE0yogflgI8kPFwmDR81yZtWHHywp1cACJ8hDF9XmiG1HcJ67SYkzGRqN0gXfg
+Jfopa4zeYwkvejnyutm3ujDcmumrkvlVxecyJGQAO6PnPIqsqo7G2MdXYbxgNvMz
+Axw9ZHlIxgUWA+u9o9lzeFBCfYsehTZtLDOn2lXcLCujaOMG+kEd8AvooiBTXsqc
+58sKtGj8AT+3WD8P4zWwsm2w5TGUELblCznkvC4Gf7V1nGHAMEe9vq3RZSQF3WzS
+hXtdjGdLuDtTKKC1Be5bhs40yrjjCQdCAKEilj7xBXkNtdqdEqW48kHcOGpgKD/L
+hAbfx1tarS7Me/Y8vDEZys+4TbuHoZfxf8xNw/jQ232jc2hl+AFThvh5e1r7cwyH
+DSqtc+1qF9t3zb46O1H+TocW2miNQIW3w0BgX/SD/1+CnSBD445DL/6TcL34veUU
+Id9YRd8MReho85Q3Qq9dBoHkg8Q6UguDHeUHZS4iANlyHebZYUNG9W1R2pg7u72C
+4acDc7Sl+EXQdEP9aBe3hbO+/2jvAhVktA==
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.subject.rdnSequence,EvSubscriberAttributeAllowanceValidator,WARNING,cabf.ev_guidelines.common_name_attribute_present,
+certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies,SubscriberPoliciesValidator,WARNING,cabf.serverauth.subscriber_first_policy_oid_not_reserved,
+certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies.3.policyQualifiers.0,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
+certificate.tbsCertificate.extensions.5.extnValue.qCStatements.4.statementInfo.pSD2QcType.nCAId,NCAIdValidator,ERROR,etsi.ts_119_495.gen-5.2.3-2.invalid_structure,Invalid separator in NCAId: NLDNB
+certificate.tbsCertificate.extensions.8.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
+certificate.tbsCertificate.extensions.9.extnValue.keyUsage,SubscriberKeyUsageValidator,WARNING,cabf.serverauth.subscriber_rsa_digitalsignature_and_keyencipherment_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.subject_key_identifier_extension_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 1.3.6.1.5.5.7.1.3
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 2.23.140.3.1
diff --git a/tests/integration_certificate/etsi/qevcp_w_psd2_eidas_pre_certificate/nca_id_invalidid.crttest b/tests/integration_certificate/etsi/qevcp_w_psd2_eidas_pre_certificate/nca_id_invalidid.crttest
new file mode 100644
index 0000000..083c078
--- /dev/null
+++ b/tests/integration_certificate/etsi/qevcp_w_psd2_eidas_pre_certificate/nca_id_invalidid.crttest
@@ -0,0 +1,54 @@
+-----BEGIN CERTIFICATE-----
+MIIHmzCCBYOgAwIBAgIUJZ7MTdvRPBvqnKpHKZj47ASxdNIwDQYJKoZIhvcNAQEL
+BQAwVzELMAkGA1UEBhMCTkwxIDAeBgNVBAoMF1F1b1ZhZGlzIFRydXN0bGluayBC
+LlYuMSYwJAYDVQQDDB1RdW9WYWRpcyBRdWFsaWZpZWQgV2ViIElDQSBHMjAeFw0y
+MzA2MTUwNzM0NThaFw0yNDA2MTUwNzI5MDBaMIHHMRMwEQYLKwYBBAGCNzwCAQMT
+Ak5MMR0wGwYDVQQPDBRQcml2YXRlIE9yZ2FuaXphdGlvbjERMA8GA1UEBRMINjgy
+NjI2MjAxCzAJBgNVBAYTAk5MMRYwFAYDVQQIDA1Ob29yZC1Ib2xsYW5kMRIwEAYD
+VQQHDAlBbXN0ZXJkYW0xGjAYBgNVBGEMEVBTRE5MLUROQi1SMTM0NDI4MRMwEQYD
+VQQKDApQZWFrcyBCLlYuMRQwEgYDVQQDDAtwZWFrcy5jbG91ZDCCASIwDQYJKoZI
+hvcNAQEBBQADggEPADCCAQoCggEBAPp5zKRWdzbiG/v3bcAk32hV1MxYC5ZNmW7f
++bvjo1ezZnFYT4c9dx4J89G3V9zQUa8V/8UwbgKmld1b8vUl8OrRfj8iwY6s6uzP
+iXS798bweJgHkapkxL5ac9acpZSBRVZKDMft+HloscKZ5iehkspeorkX7BHtbW5v
+UVLrHGXZNLx8g7UXyXcky52gyRz/EAKnAU/NpHtS/hUX+VkeFTCTIloQHis2UMoo
+28Rn2UXXbbRZa6SqTA3npyuOn8EgsX57hw39lqX2YYHj0lgjdpCpKW7i6FbHJaq1
+7rZobyYXi17Bfzcg/pyj7vaSMQG1CivAjj/PlFvAeadzE4HfPi8CAwEAAaOCAuww
+ggLoMB8GA1UdIwQYMBaAFLzrXvvYDeiCroZGvTt8sm/RLH8KMIGFBggrBgEFBQcB
+AQR5MHcwSQYIKwYBBQUHMAKGPWh0dHA6Ly90cnVzdC5xdW92YWRpc2dsb2JhbC5j
+b20vcXVvdmFkaXNxdWFsaWZpZWR3ZWJpY2FnMi5jcnQwKgYIKwYBBQUHMAGGHmh0
+dHA6Ly9vY3NwLnF1b3ZhZGlzZ2xvYmFsLmNvbTAWBgNVHREEDzANggtwZWFrcy5j
+bG91ZDB/BgNVHSAEeDB2MAkGBwQAi+xAAQQwCQYHBACBmCcDATAOBgwrBgEEAb5Y
+AAJkAQIwRQYKKwYBBAG+WAGDQjA3MDUGCCsGAQUFBwIBFilodHRwczovL3d3dy5x
+dW92YWRpc2dsb2JhbC5jb20vcmVwb3NpdG9yeTAHBgVngQwBATAdBgNVHSUEFjAU
+BggrBgEFBQcDAgYIKwYBBQUHAwEwgc8GCCsGAQUFBwEDBIHCMIG/MAoGCCsGAQUF
+BwsCMAgGBgQAjkYBATATBgYEAI5GAQYwCQYHBACORgEGAzA7BgYEAI5GAQUwMTAv
+FilodHRwczovL3d3dy5xdW92YWRpc2dsb2JhbC5jb20vcmVwb3NpdG9yeRMCZW4w
+VQYGBACBmCcCMEswJjARBgcEAIGYJwECDAZQU1BfUEkwEQYHBACBmCcBAwwGUFNQ
+X0FJDBRUaGUgTmV0aGVybGFuZHMgQmFuawwLTkwtRE1rbFMzMlgwIQYFZ4EMAwEE
+GDAWEwNQU0QTAk5MDAtETkItUjEzNDQyODBMBgNVHR8ERTBDMEGgP6A9hjtodHRw
+Oi8vY3JsLnF1b3ZhZGlzZ2xvYmFsLmNvbS9xdW92YWRpc3F1YWxpZmllZHdlYmlj
+YWcyLmNybDAdBgNVHQ4EFgQUaK/xauBxrVWVRgqpQgUU2rG8wVYwDgYDVR0PAQH/
+BAQDAgWgMBMGCisGAQQB1nkCBAMBAf8EAgUAMA0GCSqGSIb3DQEBCwUAA4ICAQBp
+BMh2Ij3qM12C/K8j5+RdfBSgQRpDN4WFr+J1EoA9G7tZyHMY+iEB0qM1KdUUMJq9
+TdH3B3EBKrrsNrefBPuXgfOftN4z/FcgW0dSwquIFnNbyO86lkFMF6rBbk1l5l9I
+i+AZrT9i0jjE0yogflgI8kPFwmDR81yZtWHHywp1cACJ8hDF9XmiG1HcJ67SYkzG
+RqN0gXfgJfopa4zeYwkvejnyutm3ujDcmumrkvlVxecyJGQAO6PnPIqsqo7G2MdX
+YbxgNvMzAxw9ZHlIxgUWA+u9o9lzeFBCfYsehTZtLDOn2lXcLCujaOMG+kEd8Avo
+oiBTXsqc58sKtGj8AT+3WD8P4zWwsm2w5TGUELblCznkvC4Gf7V1nGHAMEe9vq3R
+ZSQF3WzShXtdjGdLuDtTKKC1Be5bhs40yrjjCQdCAKEilj7xBXkNtdqdEqW48kHc
+OGpgKD/LhAbfx1tarS7Me/Y8vDEZys+4TbuHoZfxf8xNw/jQ232jc2hl+AFThvh5
+e1r7cwyHDSqtc+1qF9t3zb46O1H+TocW2miNQIW3w0BgX/SD/1+CnSBD445DL/6T
+cL34veUUId9YRd8MReho85Q3Qq9dBoHkg8Q6UguDHeUHZS4iANlyHebZYUNG9W1R
+2pg7u72C4acDc7Sl+EXQdEP9aBe3hbO+/2jvAhVktA==
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.subject.rdnSequence,EvSubscriberAttributeAllowanceValidator,WARNING,cabf.ev_guidelines.common_name_attribute_present,
+certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies,SubscriberPoliciesValidator,WARNING,cabf.serverauth.subscriber_first_policy_oid_not_reserved,
+certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies.3.policyQualifiers.0,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
+certificate.tbsCertificate.extensions.5.extnValue.qCStatements.4.statementInfo.pSD2QcType.nCAId,NCAIdValidator,ERROR,etsi.ts_119_495.gen-5.2.3-2.invalid_ca_identifier,Invalid Competent Authority identifier: DMklS32X
+certificate.tbsCertificate.extensions.8.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
+certificate.tbsCertificate.extensions.9.extnValue.keyUsage,SubscriberKeyUsageValidator,WARNING,cabf.serverauth.subscriber_rsa_digitalsignature_and_keyencipherment_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.subject_key_identifier_extension_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 1.3.6.1.5.5.7.1.3
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 2.23.140.3.1
diff --git a/tests/integration_certificate/etsi/qevcp_w_psd2_eidas_pre_certificate/nca_name_not_latin.crttest b/tests/integration_certificate/etsi/qevcp_w_psd2_eidas_pre_certificate/nca_name_not_latin.crttest
new file mode 100644
index 0000000..6246e3a
--- /dev/null
+++ b/tests/integration_certificate/etsi/qevcp_w_psd2_eidas_pre_certificate/nca_name_not_latin.crttest
@@ -0,0 +1,54 @@
+-----BEGIN CERTIFICATE-----
+MIIHlzCCBX+gAwIBAgIUJZ7MTdvRPBvqnKpHKZj47ASxdNIwDQYJKoZIhvcNAQEL
+BQAwVzELMAkGA1UEBhMCTkwxIDAeBgNVBAoMF1F1b1ZhZGlzIFRydXN0bGluayBC
+LlYuMSYwJAYDVQQDDB1RdW9WYWRpcyBRdWFsaWZpZWQgV2ViIElDQSBHMjAeFw0y
+MzA2MTUwNzM0NThaFw0yNDA2MTUwNzI5MDBaMIHHMRMwEQYLKwYBBAGCNzwCAQMT
+Ak5MMR0wGwYDVQQPDBRQcml2YXRlIE9yZ2FuaXphdGlvbjERMA8GA1UEBRMINjgy
+NjI2MjAxCzAJBgNVBAYTAk5MMRYwFAYDVQQIDA1Ob29yZC1Ib2xsYW5kMRIwEAYD
+VQQHDAlBbXN0ZXJkYW0xGjAYBgNVBGEMEVBTRE5MLUROQi1SMTM0NDI4MRMwEQYD
+VQQKDApQZWFrcyBCLlYuMRQwEgYDVQQDDAtwZWFrcy5jbG91ZDCCASIwDQYJKoZI
+hvcNAQEBBQADggEPADCCAQoCggEBAPp5zKRWdzbiG/v3bcAk32hV1MxYC5ZNmW7f
++bvjo1ezZnFYT4c9dx4J89G3V9zQUa8V/8UwbgKmld1b8vUl8OrRfj8iwY6s6uzP
+iXS798bweJgHkapkxL5ac9acpZSBRVZKDMft+HloscKZ5iehkspeorkX7BHtbW5v
+UVLrHGXZNLx8g7UXyXcky52gyRz/EAKnAU/NpHtS/hUX+VkeFTCTIloQHis2UMoo
+28Rn2UXXbbRZa6SqTA3npyuOn8EgsX57hw39lqX2YYHj0lgjdpCpKW7i6FbHJaq1
+7rZobyYXi17Bfzcg/pyj7vaSMQG1CivAjj/PlFvAeadzE4HfPi8CAwEAAaOCAugw
+ggLkMB8GA1UdIwQYMBaAFLzrXvvYDeiCroZGvTt8sm/RLH8KMIGFBggrBgEFBQcB
+AQR5MHcwSQYIKwYBBQUHMAKGPWh0dHA6Ly90cnVzdC5xdW92YWRpc2dsb2JhbC5j
+b20vcXVvdmFkaXNxdWFsaWZpZWR3ZWJpY2FnMi5jcnQwKgYIKwYBBQUHMAGGHmh0
+dHA6Ly9vY3NwLnF1b3ZhZGlzZ2xvYmFsLmNvbTAWBgNVHREEDzANggtwZWFrcy5j
+bG91ZDB/BgNVHSAEeDB2MAkGBwQAi+xAAQQwCQYHBACBmCcDATAOBgwrBgEEAb5Y
+AAJkAQIwRQYKKwYBBAG+WAGDQjA3MDUGCCsGAQUFBwIBFilodHRwczovL3d3dy5x
+dW92YWRpc2dsb2JhbC5jb20vcmVwb3NpdG9yeTAHBgVngQwBATAdBgNVHSUEFjAU
+BggrBgEFBQcDAgYIKwYBBQUHAwEwgcsGCCsGAQUFBwEDBIG+MIG7MAoGCCsGAQUF
+BwsCMAgGBgQAjkYBATATBgYEAI5GAQYwCQYHBACORgEGAzA7BgYEAI5GAQUwMTAv
+FilodHRwczovL3d3dy5xdW92YWRpc2dsb2JhbC5jb20vcmVwb3NpdG9yeRMCZW4w
+UQYGBACBmCcCMEcwJjARBgcEAIGYJwECDAZQU1BfUEkwEQYHBACBmCcBAwwGUFNQ
+X0FJDBVUaGUgTmV0aGVybGFuZHMgQsOWbmsMBk5MLUROQjAhBgVngQwDAQQYMBYT
+A1BTRBMCTkwMC0ROQi1SMTM0NDI4MEwGA1UdHwRFMEMwQaA/oD2GO2h0dHA6Ly9j
+cmwucXVvdmFkaXNnbG9iYWwuY29tL3F1b3ZhZGlzcXVhbGlmaWVkd2ViaWNhZzIu
+Y3JsMB0GA1UdDgQWBBRor/Fq4HGtVZVGCqlCBRTasbzBVjAOBgNVHQ8BAf8EBAMC
+BaAwEwYKKwYBBAHWeQIEAwEB/wQCBQAwDQYJKoZIhvcNAQELBQADggIBAGkEyHYi
+PeozXYL8ryPn5F18FKBBGkM3hYWv4nUSgD0bu1nIcxj6IQHSozUp1RQwmr1N0fcH
+cQEquuw2t58E+5eB85+03jP8VyBbR1LCq4gWc1vI7zqWQUwXqsFuTWXmX0iL4Bmt
+P2LSOMTTKiB+WAjyQ8XCYNHzXJm1YcfLCnVwAInyEMX1eaIbUdwnrtJiTMZGo3SB
+d+Al+ilrjN5jCS96OfK62be6MNya6auS+VXF5zIkZAA7o+c8iqyqjsbYx1dhvGA2
+8zMDHD1keUjGBRYD672j2XN4UEJ9ix6FNm0sM6faVdwsK6No4wb6QR3wC+iiIFNe
+ypznywq0aPwBP7dYPw/jNbCybbDlMZQQtuULOeS8LgZ/tXWcYcAwR72+rdFlJAXd
+bNKFe12MZ0u4O1MooLUF7luGzjTKuOMJB0IAoSKWPvEFeQ212p0SpbjyQdw4amAo
+P8uEBt/HW1qtLsx79jy8MRnKz7hNu4ehl/F/zE3D+NDbfaNzaGX4AVOG+Hl7Wvtz
+DIcNKq1z7WoX23fNvjo7Uf5OhxbaaI1AhbfDQGBf9IP/X4KdIEPjjkMv/pNwvfi9
+5RQh31hF3wxF6GjzlDdCr10GgeSDxDpSC4Md5QdlLiIA2XId5tlhQ0b1bVHamDu7
+vYLhpwNztKX4RdB0Q/1oF7eFs77/aO8CFWS0
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.subject.rdnSequence,EvSubscriberAttributeAllowanceValidator,WARNING,cabf.ev_guidelines.common_name_attribute_present,
+certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies,SubscriberPoliciesValidator,WARNING,cabf.serverauth.subscriber_first_policy_oid_not_reserved,
+certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies.3.policyQualifiers.0,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
+certificate.tbsCertificate.extensions.5.extnValue.qCStatements.4.statementInfo.pSD2QcType.nCAName,NCANameLatinCharactersValidator,ERROR,etsi.ts_119_495.gen-5.2.3-1.nca_name_non_latin,invalid NCA name: The Netherlands BÖnk
+certificate.tbsCertificate.extensions.8.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
+certificate.tbsCertificate.extensions.9.extnValue.keyUsage,SubscriberKeyUsageValidator,WARNING,cabf.serverauth.subscriber_rsa_digitalsignature_and_keyencipherment_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.subject_key_identifier_extension_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 1.3.6.1.5.5.7.1.3
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 2.23.140.3.1
diff --git a/tests/integration_certificate/etsi/qevcp_w_psd2_eidas_pre_certificate/obsolete_qualified_statement.crttest b/tests/integration_certificate/etsi/qevcp_w_psd2_eidas_pre_certificate/obsolete_qualified_statement.crttest
new file mode 100644
index 0000000..456323c
--- /dev/null
+++ b/tests/integration_certificate/etsi/qevcp_w_psd2_eidas_pre_certificate/obsolete_qualified_statement.crttest
@@ -0,0 +1,58 @@
+-----BEGIN CERTIFICATE-----
+MIIIZTCCBk2gAwIBAgIUQtU7exokgM2hbOvKN6H93GiAE4MwDQYJKoZIhvcNAQEL
+BQAwVzELMAkGA1UEBhMCTkwxIDAeBgNVBAoMF1F1b1ZhZGlzIFRydXN0bGluayBC
+LlYuMSYwJAYDVQQDDB1RdW9WYWRpcyBRdWFsaWZpZWQgV2ViIElDQSBHMjAeFw0y
+MjExMjIwOTMwMTNaFw0yMzExMjIwOTI1MDBaMIIBOzETMBEGCysGAQQBgjc8AgED
+EwJERTEjMCEGCysGAQQBgjc8AgECDBJCYWRlbi1Xw7xydHRlbWJlcmcxGTAXBgsr
+BgEEAYI3PAIBAQwIRnJlaWJ1cmcxHTAbBgNVBA8MFFByaXZhdGUgT3JnYW5pemF0
+aW9uMQ4wDAYDVQQFEwVHblIgNTELMAkGA1UEBhMCREUxGzAZBgNVBAgMEkJhZGVu
+LVfDvHJ0dGVtYmVyZzEVMBMGA1UEBwwMR3VuZGVsZmluZ2VuMRswGQYDVQRhDBJQ
+U0RERS1CQUZJTi0xMDIyMDcxJjAkBgNVBAoMHVJhaWZmZWlzZW5iYW5rIGltIEJy
+ZWlzZ2F1IGVHMS8wLQYDVQQDDCZ4czJhcHNkMi5yYWlmZmVpc2VuYmFuay1pbS1i
+cmVpc2dhdS5kZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAInFRFLk
+xyfaXtprrcYJ8Jw1J6ZAfWSg+Bc4ADHvs3wrh4tTH7Aw7qxl1opeHSazVzbtF9of
+KF1+BHTetfFGuzXZB5DEaOkqgzMSgGPlp6nxjrMaivmhKkrfsVxX+9rB5k/vB01j
+IuBRfoTjhEV5UzW6omvc21FtmIZxlaClVji57ETjH3ejEzizbMfwE0EaL6K6iBcp
+KRtwbwcHd80zX/4D7Kkou5Y5/7wH03gzebIrU8rvuLyCfhUg071WLrtF/VN1CuDG
+2slKK0y6iqdwRi3TaRVOwbIQDow5vwWPAaOOkounzvc0scW0hSrrEOWaQ5j++prS
+Cikp4XEfAmEzFHcCAwEAAaOCA0EwggM9MB8GA1UdIwQYMBaAFLzrXvvYDeiCroZG
+vTt8sm/RLH8KMIGFBggrBgEFBQcBAQR5MHcwSQYIKwYBBQUHMAKGPWh0dHA6Ly90
+cnVzdC5xdW92YWRpc2dsb2JhbC5jb20vcXVvdmFkaXNxdWFsaWZpZWR3ZWJpY2Fn
+Mi5jcnQwKgYIKwYBBQUHMAGGHmh0dHA6Ly9vY3NwLnF1b3ZhZGlzZ2xvYmFsLmNv
+bTAxBgNVHREEKjAogiZ4czJhcHNkMi5yYWlmZmVpc2VuYmFuay1pbS1icmVpc2dh
+dS5kZTB/BgNVHSAEeDB2MAkGBwQAi+xAAQQwCQYHBACBmCcDATAOBgwrBgEEAb5Y
+AAJkAQIwRQYKKwYBBAG+WAGDQjA3MDUGCCsGAQUFBwIBFilodHRwczovL3d3dy5x
+dW92YWRpc2dsb2JhbC5jb20vcmVwb3NpdG9yeTAHBgVngQwBATAdBgNVHSUEFjAU
+BggrBgEFBQcDAgYIKwYBBQUHAwEwggEHBggrBgEFBQcBAwSB+jCB9zAKBggrBgEF
+BQcLATAIBgYEAI5GAQEwEwYGBACORgEGMAkGBwQAjkYBBgMwOwYGBACORgEFMDEw
+LxYpaHR0cHM6Ly93d3cucXVvdmFkaXNnbG9iYWwuY29tL3JlcG9zaXRvcnkTAmVu
+MIGMBgYEAIGYJwIwgYEwTDARBgcEAIGYJwEBDAZQU1BfQVMwEQYHBACBmCcBAgwG
+UFNQX1BJMBEGBwQAgZgnAQMMBlBTUF9BSTARBgcEAIGYJwEEDAZQU1BfSUMMJ0Zl
+ZGVyYWwgRmluYW5jaWFsIFN1cGVydmlzb3J5IEF1dGhvcml0eQwIREUtQkFGSU4w
+IgYFZ4EMAwEEGTAXEwNQU0QTAkRFDAxCQUZJTi0xMDIyMDcwTAYDVR0fBEUwQzBB
+oD+gPYY7aHR0cDovL2NybC5xdW92YWRpc2dsb2JhbC5jb20vcXVvdmFkaXNxdWFs
+aWZpZWR3ZWJpY2FnMi5jcmwwHQYDVR0OBBYEFMrxAUNR7PRLzLbMCtbHTM5rN9c/
+MA4GA1UdDwEB/wQEAwIFoDATBgorBgEEAdZ5AgQDAQH/BAIFADANBgkqhkiG9w0B
+AQsFAAOCAgEAdxzDsEjlfxxhEUiX9b0rPTDxtA6cayLFPz4lxRQ0b5aqQtVpE+a2
+p779xHfiFbGAFZIKvIKweIE71fxjh7teV7QYt1AdgrQvsXEeKJS7/QuowK0Qucn6
+OESYeYVLr/WLFK7dWwDaSyMc6zEcV05EjOcnbA6ph11RyxENYCz4SYaJ2UHm3fit
+0ZGZKxgx0+cyYmQZFBn0TFaV9H+03ICMSMe25looZRRowgTLU9Z/rAl+7/SlovH4
+ubS4HyMt82Tb5H/8ycPYzH5aStTFzLY5AxqPBch8tjDIXl51og32fmwjiJm5cmQN
+Rg6Mo9kx1EnO5PnLC0Gc358qH+GrtfVcC8iN6f6tzEMcnkXTzF7/G3HeggWZoeTV
+SU/nSc4yPL/NqvBoSjwCi6KQ905S0yuqdfpXqNdw2ZOs6LtWWLAYYFquAF/+6JCU
++/8VHz7gJgN+Zj0fNRbswodf4E/4mc4njxNEvJqhDlVHKzqEwnMwEdyu4QjWiriw
+k0vHv+kRPHnw5SuwBP+TnW8FO4i+0AeAFDMRiM3v3kPxrWAoKq76LuvL26gDepQS
+o/AOr5wdC9EAyvlSkKqwfVgwAb3GNesVq1S8aD2PKwcU9ATHcP8Ddgp2FzO1zlkw
+L8eTPzz+P/LmkbaQaf2B0ovc4CSDTZftZ+o0JrSW/ahGpfMUU8acq/8=
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.subject.rdnSequence,EvSubscriberAttributeAllowanceValidator,WARNING,cabf.ev_guidelines.common_name_attribute_present,
+certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies,SubscriberPoliciesValidator,WARNING,cabf.serverauth.subscriber_first_policy_oid_not_reserved,
+certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies.3.policyQualifiers.0,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
+certificate.tbsCertificate.extensions.5.extnValue.qCStatements,ProhibitedQualifiedStatementValidator,ERROR,pkix.prohibited_qualified_statement_present,
+certificate.tbsCertificate.extensions.8.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
+certificate.tbsCertificate.extensions.9.extnValue.keyUsage,SubscriberKeyUsageValidator,WARNING,cabf.serverauth.subscriber_rsa_digitalsignature_and_keyencipherment_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.subject_key_identifier_extension_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 1.3.6.1.5.5.7.1.3
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 2.23.140.3.1
diff --git a/tests/integration_certificate/etsi/qevcp_w_psd2_eidas_pre_certificate/psp_invalid_oid.crttest b/tests/integration_certificate/etsi/qevcp_w_psd2_eidas_pre_certificate/psp_invalid_oid.crttest
new file mode 100644
index 0000000..3b3af85
--- /dev/null
+++ b/tests/integration_certificate/etsi/qevcp_w_psd2_eidas_pre_certificate/psp_invalid_oid.crttest
@@ -0,0 +1,55 @@
+-----BEGIN CERTIFICATE-----
+MIIHzDCCBbSgAwIBAgIUaHFoHojMlU3qa6adMxyvPxlyg2UwDQYJKoZIhvcNAQEL
+BQAwVzELMAkGA1UEBhMCTkwxIDAeBgNVBAoMF1F1b1ZhZGlzIFRydXN0bGluayBC
+LlYuMSYwJAYDVQQDDB1RdW9WYWRpcyBRdWFsaWZpZWQgV2ViIElDQSBHMjAeFw0y
+MzA5MDYxMzQzNDBaFw0yNDA5MjYyMzQ1MDBaMIHEMRMwEQYLKwYBBAGCNzwCAQMT
+Ak5MMR0wGwYDVQQPDBRQcml2YXRlIE9yZ2FuaXphdGlvbjERMA8GA1UEBRMINjAz
+ODUwMTQxCzAJBgNVBAYTAk5MMRAwDgYDVQQIDAdVdHJlY2h0MRAwDgYDVQQHDAdV
+dHJlY2h0MRowGAYDVQRhDBFQU0ROTC1ETkItUjE2MTE2MjEXMBUGA1UECgwOTW9u
+ZXlNb25rIEIuVi4xFTATBgNVBAMMDG1vbmV5bW9uay5ubDCCASIwDQYJKoZIhvcN
+AQEBBQADggEPADCCAQoCggEBAMPTtcvEnft2QdRWGwj/ga0GcJJHiLtwbrzFfqVv
+Vk+bOjFAqDDFT+GtKbKVmbAS0z8t5W5dbUAtPrTgPmHky5Xfw9ZEGQ2KYMYAXyrl
+0aXcvYbtgILEhEW+zmfqM2wIY/X4Yf+nK0AQfZTGxu4KqC8nTP9pDxgRkEeuvUhl
+NCGK58J/NfREGwzJeWFWB9vqf72AKj06/2utpG3XLoQ5mAl146pY+Y9X4kKE6dfk
+82m3B0JnGfYF6qn4ZmTjl2ht5p+8678WvJj4kcKDORO+k/oeyouNnct1dHSKbL+D
+kUNqHqXPTAkqJsBcC0Z5hoWbYGxMzsBupSdbrNHbZ3yIF4ECAwEAAaOCAyAwggMc
+MB8GA1UdIwQYMBaAFLzrXvvYDeiCroZGvTt8sm/RLH8KMIGFBggrBgEFBQcBAQR5
+MHcwSQYIKwYBBQUHMAKGPWh0dHA6Ly90cnVzdC5xdW92YWRpc2dsb2JhbC5jb20v
+cXVvdmFkaXNxdWFsaWZpZWR3ZWJpY2FnMi5jcnQwKgYIKwYBBQUHMAGGHmh0dHA6
+Ly9vY3NwLnF1b3ZhZGlzZ2xvYmFsLmNvbTBgBgNVHREEWTBXggxtb25leW1vbmsu
+bmyCEGFwcC5tb25leW1vbmsubmyCEHd3dy5tb25leW1vbmsubmyCEGFwaS5tb25l
+eW1vbmsubmyCEXBzZDIubW9uZXltb25rLm5sMH8GA1UdIAR4MHYwCQYHBACL7EAB
+BDAJBgcEAIGYJwMBMA4GDCsGAQQBvlgAAmQBAjBFBgorBgEEAb5YAYNCMDcwNQYI
+KwYBBQUHAgEWKWh0dHBzOi8vd3d3LnF1b3ZhZGlzZ2xvYmFsLmNvbS9yZXBvc2l0
+b3J5MAcGBWeBDAEBMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATCBuQYI
+KwYBBQUHAQMEgawwgakwCgYIKwYBBQUHCwIwCAYGBACORgEBMBMGBgQAjkYBBjAJ
+BgcEAI5GAQYDMDsGBgQAjkYBBTAxMC8WKWh0dHBzOi8vd3d3LnF1b3ZhZGlzZ2xv
+YmFsLmNvbS9yZXBvc2l0b3J5EwJlbjA/BgYEAIGYJwIwNTAVMBMGCQQAgZgnAQOH
+ZwwGUFNQX0FJDBRUaGUgTmV0aGVybGFuZHMgQmFuawwGTkwtRE5CMCEGBWeBDAMB
+BBgwFhMDUFNEEwJOTAwLRE5CLVIxNjExNjIwTAYDVR0fBEUwQzBBoD+gPYY7aHR0
+cDovL2NybC5xdW92YWRpc2dsb2JhbC5jb20vcXVvdmFkaXNxdWFsaWZpZWR3ZWJp
+Y2FnMi5jcmwwHQYDVR0OBBYEFCP9A3vYzIFeNRzR9+8BJ/qw0JfFMA4GA1UdDwEB
+/wQEAwIFoDATBgorBgEEAdZ5AgQDAQH/BAIFADANBgkqhkiG9w0BAQsFAAOCAgEA
+TkJL2vS7H+sjbAHROkv4QGiu8//YjpGmZChPfvmg+9lrp/dNWu2EwfFV4+f0Cc/L
+AJDEUfyKok0yXOH2p8UNnjeHLv1xdog1oeq+OxAzxxCPYn08nHwpYItcisiFg8GA
+Z0bpBceYBAL02bqQy5KW9pp82984o0TvWrGnba8OQ8q0oG8FEWiRIA0hucxSKOJj
+aMNH/6jVcOyRoFQ3xOtNUj6cAs/T6txvRe4k34XgpOPO/L1uyHKnMGZ8twZnPV4Z
++XLP1k4hhaoxr3AmVW/BA2uWsGWyhKvB75RzDWrZWzbq22XC+e8HPgNJnaPSm7Kv
+L5Ssvyg4ZHPfEBYoiJHJjQQM8cw95jIv3XIYAw0kPxMShM43mSVRk7yZe1MCSURD
+cdi3foO461JoM+8ZPNG1IHK+BgDC1muzB8kfcxSR/7kQBSDyrzrIVuN/wDj+xssp
+PBCMf8+iuYHmXbkMfcYcO1gLK/AGz6/XFG5lNi7hQZllNBUOii8OP0b1Xvz5U8on
+Ts9CA6H6eYUWR87KhuAfPF4EKdD+DZyVm6b31Kpbk9yruu0hYduZVTn/fjRLopUj
+OjeYmORxlBV5+VA9Bs6SIa85UWqLWHFJMIMOrluYrmmTo8PrY98vGYUS2pZlP1ti
+d+WUQ2bMmSnaRoZcajcdtKpHYWM/39p2om/abrP4pXg=
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.subject.rdnSequence,EvSubscriberAttributeAllowanceValidator,WARNING,cabf.ev_guidelines.common_name_attribute_present,
+certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies,SubscriberPoliciesValidator,WARNING,cabf.serverauth.subscriber_first_policy_oid_not_reserved,
+certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies.3.policyQualifiers.0,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
+certificate.tbsCertificate.extensions.5.extnValue.qCStatements.4.statementInfo.pSD2QcType.rolesOfPSP,RolesOfPspValidator,ERROR,etsi.ts_119_495.gen-5.2-2.invalid_psp_oid,"expected oid values are 0.4.0.19495.1.0, 0.4.0.19495.1.1, 0.4.0.19495.1.2, 0.4.0.19495.1.3, 0.4.0.19495.1.4 got 0.4.0.19495.1.3.999"
+certificate.tbsCertificate.extensions.8.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
+certificate.tbsCertificate.extensions.9.extnValue.keyUsage,SubscriberKeyUsageValidator,WARNING,cabf.serverauth.subscriber_rsa_digitalsignature_and_keyencipherment_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.subject_key_identifier_extension_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 1.3.6.1.5.5.7.1.3
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 2.23.140.3.1
diff --git a/tests/integration_certificate/etsi/qevcp_w_psd2_eidas_pre_certificate/psp_invalid_role.crttest b/tests/integration_certificate/etsi/qevcp_w_psd2_eidas_pre_certificate/psp_invalid_role.crttest
new file mode 100644
index 0000000..92a4e9b
--- /dev/null
+++ b/tests/integration_certificate/etsi/qevcp_w_psd2_eidas_pre_certificate/psp_invalid_role.crttest
@@ -0,0 +1,55 @@
+-----BEGIN CERTIFICATE-----
+MIIH0jCCBbqgAwIBAgIUaHFoHojMlU3qa6adMxyvPxlyg2UwDQYJKoZIhvcNAQEL
+BQAwVzELMAkGA1UEBhMCTkwxIDAeBgNVBAoMF1F1b1ZhZGlzIFRydXN0bGluayBC
+LlYuMSYwJAYDVQQDDB1RdW9WYWRpcyBRdWFsaWZpZWQgV2ViIElDQSBHMjAeFw0y
+MzA5MDYxMzQzNDBaFw0yNDA5MjYyMzQ1MDBaMIHEMRMwEQYLKwYBBAGCNzwCAQMT
+Ak5MMR0wGwYDVQQPDBRQcml2YXRlIE9yZ2FuaXphdGlvbjERMA8GA1UEBRMINjAz
+ODUwMTQxCzAJBgNVBAYTAk5MMRAwDgYDVQQIDAdVdHJlY2h0MRAwDgYDVQQHDAdV
+dHJlY2h0MRowGAYDVQRhDBFQU0ROTC1ETkItUjE2MTE2MjEXMBUGA1UECgwOTW9u
+ZXlNb25rIEIuVi4xFTATBgNVBAMMDG1vbmV5bW9uay5ubDCCASIwDQYJKoZIhvcN
+AQEBBQADggEPADCCAQoCggEBAMPTtcvEnft2QdRWGwj/ga0GcJJHiLtwbrzFfqVv
+Vk+bOjFAqDDFT+GtKbKVmbAS0z8t5W5dbUAtPrTgPmHky5Xfw9ZEGQ2KYMYAXyrl
+0aXcvYbtgILEhEW+zmfqM2wIY/X4Yf+nK0AQfZTGxu4KqC8nTP9pDxgRkEeuvUhl
+NCGK58J/NfREGwzJeWFWB9vqf72AKj06/2utpG3XLoQ5mAl146pY+Y9X4kKE6dfk
+82m3B0JnGfYF6qn4ZmTjl2ht5p+8678WvJj4kcKDORO+k/oeyouNnct1dHSKbL+D
+kUNqHqXPTAkqJsBcC0Z5hoWbYGxMzsBupSdbrNHbZ3yIF4ECAwEAAaOCAyYwggMi
+MB8GA1UdIwQYMBaAFLzrXvvYDeiCroZGvTt8sm/RLH8KMIGFBggrBgEFBQcBAQR5
+MHcwSQYIKwYBBQUHMAKGPWh0dHA6Ly90cnVzdC5xdW92YWRpc2dsb2JhbC5jb20v
+cXVvdmFkaXNxdWFsaWZpZWR3ZWJpY2FnMi5jcnQwKgYIKwYBBQUHMAGGHmh0dHA6
+Ly9vY3NwLnF1b3ZhZGlzZ2xvYmFsLmNvbTBgBgNVHREEWTBXggxtb25leW1vbmsu
+bmyCEGFwcC5tb25leW1vbmsubmyCEHd3dy5tb25leW1vbmsubmyCEGFwaS5tb25l
+eW1vbmsubmyCEXBzZDIubW9uZXltb25rLm5sMH8GA1UdIAR4MHYwCQYHBACL7EAB
+BDAJBgcEAIGYJwMBMA4GDCsGAQQBvlgAAmQBAjBFBgorBgEEAb5YAYNCMDcwNQYI
+KwYBBQUHAgEWKWh0dHBzOi8vd3d3LnF1b3ZhZGlzZ2xvYmFsLmNvbS9yZXBvc2l0
+b3J5MAcGBWeBDAEBMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATCBvwYI
+KwYBBQUHAQMEgbIwga8wCgYIKwYBBQUHCwIwCAYGBACORgEBMBMGBgQAjkYBBjAJ
+BgcEAI5GAQYDMDsGBgQAjkYBBTAxMC8WKWh0dHBzOi8vd3d3LnF1b3ZhZGlzZ2xv
+YmFsLmNvbS9yZXBvc2l0b3J5EwJlbjBFBgYEAIGYJwIwOzAbMBkGBwQAgZgnAQMM
+DlBTUF9BSV9pbnZhbGlkDBRUaGUgTmV0aGVybGFuZHMgQmFuawwGTkwtRE5CMCEG
+BWeBDAMBBBgwFhMDUFNEEwJOTAwLRE5CLVIxNjExNjIwTAYDVR0fBEUwQzBBoD+g
+PYY7aHR0cDovL2NybC5xdW92YWRpc2dsb2JhbC5jb20vcXVvdmFkaXNxdWFsaWZp
+ZWR3ZWJpY2FnMi5jcmwwHQYDVR0OBBYEFCP9A3vYzIFeNRzR9+8BJ/qw0JfFMA4G
+A1UdDwEB/wQEAwIFoDATBgorBgEEAdZ5AgQDAQH/BAIFADANBgkqhkiG9w0BAQsF
+AAOCAgEATkJL2vS7H+sjbAHROkv4QGiu8//YjpGmZChPfvmg+9lrp/dNWu2EwfFV
+4+f0Cc/LAJDEUfyKok0yXOH2p8UNnjeHLv1xdog1oeq+OxAzxxCPYn08nHwpYItc
+isiFg8GAZ0bpBceYBAL02bqQy5KW9pp82984o0TvWrGnba8OQ8q0oG8FEWiRIA0h
+ucxSKOJjaMNH/6jVcOyRoFQ3xOtNUj6cAs/T6txvRe4k34XgpOPO/L1uyHKnMGZ8
+twZnPV4Z+XLP1k4hhaoxr3AmVW/BA2uWsGWyhKvB75RzDWrZWzbq22XC+e8HPgNJ
+naPSm7KvL5Ssvyg4ZHPfEBYoiJHJjQQM8cw95jIv3XIYAw0kPxMShM43mSVRk7yZ
+e1MCSURDcdi3foO461JoM+8ZPNG1IHK+BgDC1muzB8kfcxSR/7kQBSDyrzrIVuN/
+wDj+xsspPBCMf8+iuYHmXbkMfcYcO1gLK/AGz6/XFG5lNi7hQZllNBUOii8OP0b1
+Xvz5U8onTs9CA6H6eYUWR87KhuAfPF4EKdD+DZyVm6b31Kpbk9yruu0hYduZVTn/
+fjRLopUjOjeYmORxlBV5+VA9Bs6SIa85UWqLWHFJMIMOrluYrmmTo8PrY98vGYUS
+2pZlP1tid+WUQ2bMmSnaRoZcajcdtKpHYWM/39p2om/abrP4pXg=
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.subject.rdnSequence,EvSubscriberAttributeAllowanceValidator,WARNING,cabf.ev_guidelines.common_name_attribute_present,
+certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies,SubscriberPoliciesValidator,WARNING,cabf.serverauth.subscriber_first_policy_oid_not_reserved,
+certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies.3.policyQualifiers.0,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
+certificate.tbsCertificate.extensions.5.extnValue.qCStatements.4.statementInfo.pSD2QcType.rolesOfPSP,RolesOfPspValidator,ERROR,etsi.ts_119_495.gen-5.2-2.invalid_psp_role,"expected role values are [ PSP_AI, PSP_AS, PSP_IC, PSP_PI, Unspecified]. Got PSP_AI_invalid"
+certificate.tbsCertificate.extensions.8.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
+certificate.tbsCertificate.extensions.9.extnValue.keyUsage,SubscriberKeyUsageValidator,WARNING,cabf.serverauth.subscriber_rsa_digitalsignature_and_keyencipherment_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.subject_key_identifier_extension_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 1.3.6.1.5.5.7.1.3
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 2.23.140.3.1
diff --git a/tests/integration_certificate/etsi/qevcp_w_psd2_eidas_pre_certificate/psp_not_unspecified.crttest b/tests/integration_certificate/etsi/qevcp_w_psd2_eidas_pre_certificate/psp_not_unspecified.crttest
new file mode 100644
index 0000000..af0a2b8
--- /dev/null
+++ b/tests/integration_certificate/etsi/qevcp_w_psd2_eidas_pre_certificate/psp_not_unspecified.crttest
@@ -0,0 +1,55 @@
+-----BEGIN CERTIFICATE-----
+MIIHyzCCBbOgAwIBAgIUaHFoHojMlU3qa6adMxyvPxlyg2UwDQYJKoZIhvcNAQEL
+BQAwVzELMAkGA1UEBhMCTkwxIDAeBgNVBAoMF1F1b1ZhZGlzIFRydXN0bGluayBC
+LlYuMSYwJAYDVQQDDB1RdW9WYWRpcyBRdWFsaWZpZWQgV2ViIElDQSBHMjAeFw0y
+MzA5MDYxMzQzNDBaFw0yNDA5MjYyMzQ1MDBaMIHEMRMwEQYLKwYBBAGCNzwCAQMT
+Ak5MMR0wGwYDVQQPDBRQcml2YXRlIE9yZ2FuaXphdGlvbjERMA8GA1UEBRMINjAz
+ODUwMTQxCzAJBgNVBAYTAk5MMRAwDgYDVQQIDAdVdHJlY2h0MRAwDgYDVQQHDAdV
+dHJlY2h0MRowGAYDVQRhDBFQU0ROTC1ETkItUjE2MTE2MjEXMBUGA1UECgwOTW9u
+ZXlNb25rIEIuVi4xFTATBgNVBAMMDG1vbmV5bW9uay5ubDCCASIwDQYJKoZIhvcN
+AQEBBQADggEPADCCAQoCggEBAMPTtcvEnft2QdRWGwj/ga0GcJJHiLtwbrzFfqVv
+Vk+bOjFAqDDFT+GtKbKVmbAS0z8t5W5dbUAtPrTgPmHky5Xfw9ZEGQ2KYMYAXyrl
+0aXcvYbtgILEhEW+zmfqM2wIY/X4Yf+nK0AQfZTGxu4KqC8nTP9pDxgRkEeuvUhl
+NCGK58J/NfREGwzJeWFWB9vqf72AKj06/2utpG3XLoQ5mAl146pY+Y9X4kKE6dfk
+82m3B0JnGfYF6qn4ZmTjl2ht5p+8678WvJj4kcKDORO+k/oeyouNnct1dHSKbL+D
+kUNqHqXPTAkqJsBcC0Z5hoWbYGxMzsBupSdbrNHbZ3yIF4ECAwEAAaOCAx8wggMb
+MB8GA1UdIwQYMBaAFLzrXvvYDeiCroZGvTt8sm/RLH8KMIGFBggrBgEFBQcBAQR5
+MHcwSQYIKwYBBQUHMAKGPWh0dHA6Ly90cnVzdC5xdW92YWRpc2dsb2JhbC5jb20v
+cXVvdmFkaXNxdWFsaWZpZWR3ZWJpY2FnMi5jcnQwKgYIKwYBBQUHMAGGHmh0dHA6
+Ly9vY3NwLnF1b3ZhZGlzZ2xvYmFsLmNvbTBgBgNVHREEWTBXggxtb25leW1vbmsu
+bmyCEGFwcC5tb25leW1vbmsubmyCEHd3dy5tb25leW1vbmsubmyCEGFwaS5tb25l
+eW1vbmsubmyCEXBzZDIubW9uZXltb25rLm5sMH8GA1UdIAR4MHYwCQYHBACL7EAB
+BDAJBgcEAIGYJwMBMA4GDCsGAQQBvlgAAmQBAjBFBgorBgEEAb5YAYNCMDcwNQYI
+KwYBBQUHAgEWKWh0dHBzOi8vd3d3LnF1b3ZhZGlzZ2xvYmFsLmNvbS9yZXBvc2l0
+b3J5MAcGBWeBDAEBMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATCBuAYI
+KwYBBQUHAQMEgaswgagwCgYIKwYBBQUHCwIwCAYGBACORgEBMBMGBgQAjkYBBjAJ
+BgcEAI5GAQYDMDsGBgQAjkYBBTAxMC8WKWh0dHBzOi8vd3d3LnF1b3ZhZGlzZ2xv
+YmFsLmNvbS9yZXBvc2l0b3J5EwJlbjA+BgYEAIGYJwIwNDAUMBIGBwQAgZgnAQAM
+B1Vua25vd24MFFRoZSBOZXRoZXJsYW5kcyBCYW5rDAZOTC1ETkIwIQYFZ4EMAwEE
+GDAWEwNQU0QTAk5MDAtETkItUjE2MTE2MjBMBgNVHR8ERTBDMEGgP6A9hjtodHRw
+Oi8vY3JsLnF1b3ZhZGlzZ2xvYmFsLmNvbS9xdW92YWRpc3F1YWxpZmllZHdlYmlj
+YWcyLmNybDAdBgNVHQ4EFgQUI/0De9jMgV41HNH37wEn+rDQl8UwDgYDVR0PAQH/
+BAQDAgWgMBMGCisGAQQB1nkCBAMBAf8EAgUAMA0GCSqGSIb3DQEBCwUAA4ICAQBO
+Qkva9Lsf6yNsAdE6S/hAaK7z/9iOkaZkKE9++aD72Wun901a7YTB8VXj5/QJz8sA
+kMRR/IqiTTJc4fanxQ2eN4cu/XF2iDWh6r47EDPHEI9ifTycfClgi1yKyIWDwYBn
+RukFx5gEAvTZupDLkpb2mnzb3zijRO9asadtrw5DyrSgbwURaJEgDSG5zFIo4mNo
+w0f/qNVw7JGgVDfE601SPpwCz9Pq3G9F7iTfheCk4878vW7IcqcwZny3Bmc9Xhn5
+cs/WTiGFqjGvcCZVb8EDa5awZbKEq8HvlHMNatlbNurbZcL57wc+A0mdo9Kbsq8v
+lKy/KDhkc98QFiiIkcmNBAzxzD3mMi/dchgDDSQ/ExKEzjeZJVGTvJl7UwJJRENx
+2Ld+g7jrUmgz7xk80bUgcr4GAMLWa7MHyR9zFJH/uRAFIPKvOshW43/AOP7Gyyk8
+EIx/z6K5geZduQx9xhw7WAsr8AbPr9cUbmU2LuFBmWU0FQ6KLw4/RvVe/PlTyidO
+z0IDofp5hRZHzsqG4B88XgQp0P4NnJWbpvfUqluT3Ku67SFh25lVOf9+NEuilSM6
+N5iY5HGUFXn5UD0GzpIhrzlRaotYcUkwgw6uW5iuaZOjw+tj3y8ZhRLalmU/W2J3
+5ZRDZsyZKdpGhlxqNx20qkdhYz/f2naib9pus/ileA==
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.subject.rdnSequence,EvSubscriberAttributeAllowanceValidator,WARNING,cabf.ev_guidelines.common_name_attribute_present,
+certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies,SubscriberPoliciesValidator,WARNING,cabf.serverauth.subscriber_first_policy_oid_not_reserved,
+certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies.3.policyQualifiers.0,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
+certificate.tbsCertificate.extensions.5.extnValue.qCStatements.4.statementInfo.pSD2QcType.rolesOfPSP,RolesOfPspValidator,ERROR,etsi.ts_119_495.gen-5.2-2.invalid_psp_role,"expected role values are [ PSP_AI, PSP_AS, PSP_IC, PSP_PI, Unspecified]. Got Unknown"
+certificate.tbsCertificate.extensions.8.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
+certificate.tbsCertificate.extensions.9.extnValue.keyUsage,SubscriberKeyUsageValidator,WARNING,cabf.serverauth.subscriber_rsa_digitalsignature_and_keyencipherment_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.subject_key_identifier_extension_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 1.3.6.1.5.5.7.1.3
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 2.23.140.3.1
diff --git a/tests/integration_certificate/etsi/qevcp_w_psd2_eidas_pre_certificate/psp_role_mismatch.crttest b/tests/integration_certificate/etsi/qevcp_w_psd2_eidas_pre_certificate/psp_role_mismatch.crttest
new file mode 100644
index 0000000..f608427
--- /dev/null
+++ b/tests/integration_certificate/etsi/qevcp_w_psd2_eidas_pre_certificate/psp_role_mismatch.crttest
@@ -0,0 +1,55 @@
+-----BEGIN CERTIFICATE-----
+MIIHyjCCBbKgAwIBAgIUaHFoHojMlU3qa6adMxyvPxlyg2UwDQYJKoZIhvcNAQEL
+BQAwVzELMAkGA1UEBhMCTkwxIDAeBgNVBAoMF1F1b1ZhZGlzIFRydXN0bGluayBC
+LlYuMSYwJAYDVQQDDB1RdW9WYWRpcyBRdWFsaWZpZWQgV2ViIElDQSBHMjAeFw0y
+MzA5MDYxMzQzNDBaFw0yNDA5MjYyMzQ1MDBaMIHEMRMwEQYLKwYBBAGCNzwCAQMT
+Ak5MMR0wGwYDVQQPDBRQcml2YXRlIE9yZ2FuaXphdGlvbjERMA8GA1UEBRMINjAz
+ODUwMTQxCzAJBgNVBAYTAk5MMRAwDgYDVQQIDAdVdHJlY2h0MRAwDgYDVQQHDAdV
+dHJlY2h0MRowGAYDVQRhDBFQU0ROTC1ETkItUjE2MTE2MjEXMBUGA1UECgwOTW9u
+ZXlNb25rIEIuVi4xFTATBgNVBAMMDG1vbmV5bW9uay5ubDCCASIwDQYJKoZIhvcN
+AQEBBQADggEPADCCAQoCggEBAMPTtcvEnft2QdRWGwj/ga0GcJJHiLtwbrzFfqVv
+Vk+bOjFAqDDFT+GtKbKVmbAS0z8t5W5dbUAtPrTgPmHky5Xfw9ZEGQ2KYMYAXyrl
+0aXcvYbtgILEhEW+zmfqM2wIY/X4Yf+nK0AQfZTGxu4KqC8nTP9pDxgRkEeuvUhl
+NCGK58J/NfREGwzJeWFWB9vqf72AKj06/2utpG3XLoQ5mAl146pY+Y9X4kKE6dfk
+82m3B0JnGfYF6qn4ZmTjl2ht5p+8678WvJj4kcKDORO+k/oeyouNnct1dHSKbL+D
+kUNqHqXPTAkqJsBcC0Z5hoWbYGxMzsBupSdbrNHbZ3yIF4ECAwEAAaOCAx4wggMa
+MB8GA1UdIwQYMBaAFLzrXvvYDeiCroZGvTt8sm/RLH8KMIGFBggrBgEFBQcBAQR5
+MHcwSQYIKwYBBQUHMAKGPWh0dHA6Ly90cnVzdC5xdW92YWRpc2dsb2JhbC5jb20v
+cXVvdmFkaXNxdWFsaWZpZWR3ZWJpY2FnMi5jcnQwKgYIKwYBBQUHMAGGHmh0dHA6
+Ly9vY3NwLnF1b3ZhZGlzZ2xvYmFsLmNvbTBgBgNVHREEWTBXggxtb25leW1vbmsu
+bmyCEGFwcC5tb25leW1vbmsubmyCEHd3dy5tb25leW1vbmsubmyCEGFwaS5tb25l
+eW1vbmsubmyCEXBzZDIubW9uZXltb25rLm5sMH8GA1UdIAR4MHYwCQYHBACL7EAB
+BDAJBgcEAIGYJwMBMA4GDCsGAQQBvlgAAmQBAjBFBgorBgEEAb5YAYNCMDcwNQYI
+KwYBBQUHAgEWKWh0dHBzOi8vd3d3LnF1b3ZhZGlzZ2xvYmFsLmNvbS9yZXBvc2l0
+b3J5MAcGBWeBDAEBMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATCBtwYI
+KwYBBQUHAQMEgaowgacwCgYIKwYBBQUHCwIwCAYGBACORgEBMBMGBgQAjkYBBjAJ
+BgcEAI5GAQYDMDsGBgQAjkYBBTAxMC8WKWh0dHBzOi8vd3d3LnF1b3ZhZGlzZ2xv
+YmFsLmNvbS9yZXBvc2l0b3J5EwJlbjA9BgYEAIGYJwIwMzATMBEGBwQAgZgnAQMM
+BlBTUF9BUwwUVGhlIE5ldGhlcmxhbmRzIEJhbmsMBk5MLUROQjAhBgVngQwDAQQY
+MBYTA1BTRBMCTkwMC0ROQi1SMTYxMTYyMEwGA1UdHwRFMEMwQaA/oD2GO2h0dHA6
+Ly9jcmwucXVvdmFkaXNnbG9iYWwuY29tL3F1b3ZhZGlzcXVhbGlmaWVkd2ViaWNh
+ZzIuY3JsMB0GA1UdDgQWBBQj/QN72MyBXjUc0ffvASf6sNCXxTAOBgNVHQ8BAf8E
+BAMCBaAwEwYKKwYBBAHWeQIEAwEB/wQCBQAwDQYJKoZIhvcNAQELBQADggIBAE5C
+S9r0ux/rI2wB0TpL+EBorvP/2I6RpmQoT375oPvZa6f3TVrthMHxVePn9AnPywCQ
+xFH8iqJNMlzh9qfFDZ43hy79cXaINaHqvjsQM8cQj2J9PJx8KWCLXIrIhYPBgGdG
+6QXHmAQC9Nm6kMuSlvaafNvfOKNE71qxp22vDkPKtKBvBRFokSANIbnMUijiY2jD
+R/+o1XDskaBUN8TrTVI+nALP0+rcb0XuJN+F4KTjzvy9bshypzBmfLcGZz1eGfly
+z9ZOIYWqMa9wJlVvwQNrlrBlsoSrwe+Ucw1q2Vs26ttlwvnvBz4DSZ2j0puyry+U
+rL8oOGRz3xAWKIiRyY0EDPHMPeYyL91yGAMNJD8TEoTON5klUZO8mXtTAklEQ3HY
+t36DuOtSaDPvGTzRtSByvgYAwtZrswfJH3MUkf+5EAUg8q86yFbjf8A4/sbLKTwQ
+jH/PormB5l25DH3GHDtYCyvwBs+v1xRuZTYu4UGZZTQVDoovDj9G9V78+VPKJ07P
+QgOh+nmFFkfOyobgHzxeBCnQ/g2clZum99SqW5Pcq7rtIWHbmVU5/340S6KVIzo3
+mJjkcZQVeflQPQbOkiGvOVFqi1hxSTCDDq5bmK5pk6PD62PfLxmFEtqWZT9bYnfl
+lENmzJkp2kaGXGo3HbSqR2FjP9/adqJv2m6z+KV4
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.subject.rdnSequence,EvSubscriberAttributeAllowanceValidator,WARNING,cabf.ev_guidelines.common_name_attribute_present,
+certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies,SubscriberPoliciesValidator,WARNING,cabf.serverauth.subscriber_first_policy_oid_not_reserved,
+certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies.3.policyQualifiers.0,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
+certificate.tbsCertificate.extensions.5.extnValue.qCStatements.4.statementInfo.pSD2QcType.rolesOfPSP,RolesOfPspValidator,ERROR,etsi.ts_119_495.gen-5.2.2-5.psp_role_mismatch,Expected role is: PSP_AI. Role in cert is: PSP_AS. Oid in cert is: 0.4.0.19495.1.3
+certificate.tbsCertificate.extensions.8.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
+certificate.tbsCertificate.extensions.9.extnValue.keyUsage,SubscriberKeyUsageValidator,WARNING,cabf.serverauth.subscriber_rsa_digitalsignature_and_keyencipherment_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.subject_key_identifier_extension_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 1.3.6.1.5.5.7.1.3
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 2.23.140.3.1
diff --git a/tests/integration_certificate/etsi/qevcp_w_psd2_eidas_pre_certificate/psp_roles_empty.crttest b/tests/integration_certificate/etsi/qevcp_w_psd2_eidas_pre_certificate/psp_roles_empty.crttest
new file mode 100644
index 0000000..a178c39
--- /dev/null
+++ b/tests/integration_certificate/etsi/qevcp_w_psd2_eidas_pre_certificate/psp_roles_empty.crttest
@@ -0,0 +1,56 @@
+-----BEGIN CERTIFICATE-----
+MIIH4DCCBcigAwIBAgIUZ2W0z0CUqkRQtqh+2ZeuUOubCNswDQYJKoZIhvcNAQEL
+BQAwVzELMAkGA1UEBhMCTkwxIDAeBgNVBAoMF1F1b1ZhZGlzIFRydXN0bGluayBC
+LlYuMSYwJAYDVQQDDB1RdW9WYWRpcyBRdWFsaWZpZWQgV2ViIElDQSBHMjAeFw0y
+NDAxMDUxMjM2MzRaFw0yNTAxMDUxMjMxMDBaMIIBEjETMBEGCysGAQQBgjc8AgED
+EwJERTEXMBUGCysGAQQBgjc8AgECDAZCYXllcm4xGTAXBgsrBgEEAYI3PAIBAQwI
+QXVnc2J1cmcxHTAbBgNVBA8MFFByaXZhdGUgT3JnYW5pemF0aW9uMRAwDgYDVQQF
+EwdHblIgNjEyMQswCQYDVQQGEwJERTEPMA0GA1UECAwGQmF5ZXJuMRAwDgYDVQQH
+DAdIdXJsYWNoMRswGQYDVQRhDBJQU0RERS1CQUZJTi0xMDY2NTMxJTAjBgNVBAoM
+HFJhaWZmZWlzZW5iYW5rIFNpbmdvbGR0YWwgZUcxIjAgBgNVBAMMGXhzMmFwc2Qy
+LnJiLXNpbmdvbGR0YWwuZGUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB
+AQDRyGepEOvd+8o7fOluGGj3NwnardkJ+jEnBHtcqF1boA70AoFs2a+MLPF9eoif
+5FjS9EtYwaFzgZN2XqkbKvCes612jsXBHLeYlOahBjZOtTlCjA5NBs+sgZWaVTBQ
+5YPGsYImEAiRrUqtTY6+gGiWKKfbD7y6p8kywJhO++bawKYBnjTdxhMm0SS4cRBl
+Fw/vzjRXXg7up3mpOFlYlvsIb53Dzl+DnpuPg/xBuVJXSdmG6MbzV3LHSaCsN4qy
+75pDDyIQj0UU0HJ/A0XIB434NQkOlfrVCx9aa4hxM+qm754Y9tvuPiNJy74cCKBT
+/uqpXx1Ao017yf9pcbGKweoZAgMBAAGjggLlMIIC4TAfBgNVHSMEGDAWgBS86177
+2A3ogq6GRr07fLJv0Sx/CjCBhQYIKwYBBQUHAQEEeTB3MEkGCCsGAQUFBzAChj1o
+dHRwOi8vdHJ1c3QucXVvdmFkaXNnbG9iYWwuY29tL3F1b3ZhZGlzcXVhbGlmaWVk
+d2ViaWNhZzIuY3J0MCoGCCsGAQUFBzABhh5odHRwOi8vb2NzcC5xdW92YWRpc2ds
+b2JhbC5jb20wJAYDVR0RBB0wG4IZeHMyYXBzZDIucmItc2luZ29sZHRhbC5kZTB/
+BgNVHSAEeDB2MAkGBwQAi+xAAQQwCQYHBACBmCcDATAOBgwrBgEEAb5YAAJkAQIw
+RQYKKwYBBAG+WAGDQjA3MDUGCCsGAQUFBwIBFilodHRwczovL3d3dy5xdW92YWRp
+c2dsb2JhbC5jb20vcmVwb3NpdG9yeTAHBgVngQwBATAdBgNVHSUEFjAUBggrBgEF
+BQcDAgYIKwYBBQUHAwEwgbkGCCsGAQUFBwEDBIGsMIGpMAoGCCsGAQUFBwsCMAgG
+BgQAjkYBATATBgYEAI5GAQYwCQYHBACORgEGAzA7BgYEAI5GAQUwMTAvFilodHRw
+czovL3d3dy5xdW92YWRpc2dsb2JhbC5jb20vcmVwb3NpdG9yeRMCZW4wPwYGBACB
+mCcCMDUwAAwnRmVkZXJhbCBGaW5hbmNpYWwgU3VwZXJ2aXNvcnkgQXV0aG9yaXR5
+DAhERS1CQUZJTjAiBgVngQwDAQQZMBcTA1BTRBMCREUMDEJBRklOLTEwNjY1MzBM
+BgNVHR8ERTBDMEGgP6A9hjtodHRwOi8vY3JsLnF1b3ZhZGlzZ2xvYmFsLmNvbS9x
+dW92YWRpc3F1YWxpZmllZHdlYmljYWcyLmNybDAdBgNVHQ4EFgQU0CDt76mzymMP
+mVDWONHd8j8htIowDgYDVR0PAQH/BAQDAgWgMBMGCisGAQQB1nkCBAMBAf8EAgUA
+MA0GCSqGSIb3DQEBCwUAA4ICAQAgxCKTQCShhgmSJHgV2nBz12jxB4Tl2NIxfmFm
+XGrrzOYbN7+s0rkRW5srtRCRjy4MQlVuaI1zpNvKqmZ8K1YXvIaQbHcnmptNsvje
+rjcG8sbQqBxsRwZ87nB8QQ1Hb+2rUD4jpKXjYhTn4+LBKUGqvuvoxa1h5Ojl13c0
+nzPmtsVk6MvYyE+dOscmeF2L7+CAEMrGtfvVMj4QqWUDUHmBbDG0gTu/lAE3rB0U
+KT8B5tHI6zEsEet3ySx8QZ0CfLyln37JfxlSMVkU0Kyt2AjqlV9QpoaiAZq++Vpf
+vGB1JenDiBYXbO0VNdRuCNC8F++CsgWsqvqdfUlnQGt+9lYSikLHeRpJzr0GwOJc
+OuiFXKMWV22sCQizr2xQCWS9ajbROVaFFsViIoBlK1GykMTZWzHI13f120OUbMZ9
+5wnmCxej8aRZXKuZXg+I6ztu0Wm2tjlHb9hfZnuiTviitveDxpM8tX8+6eDWlFqC
+ZcrLZUy7r4ZdU0dSRsYx2WDRcIuHcQ593VzM8XBYPtYZ7z8cMlzkRr/fUpjWtujH
+1joq8HiMKZaMqLBhS1cyiEaSCv99MRqxq2UT58HanAJ2St/1u6UVbXJ39VXpRtWZ
+3IjZc9mgkHoOf1h1VLc2DSoWSjfWabjbDH2rBLRNywStpQhSjAdeSeiUPTE7wz6N
+yrv/BQ==
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.extensions.5.extnValue.qCStatements.4.statementInfo.pSD2QcType.rolesOfPSP,RolesOfPspValidator,ERROR,etsi.ts_119_495.gen-5.2.2-1.roles_of_psp_empty,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 2.23.140.3.1
+certificate.tbsCertificate.subject.rdnSequence,EvSubscriberAttributeAllowanceValidator,WARNING,cabf.ev_guidelines.common_name_attribute_present,
+certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies,SubscriberPoliciesValidator,WARNING,cabf.serverauth.subscriber_first_policy_oid_not_reserved,
+certificate.tbsCertificate.extensions.9.extnValue.keyUsage,SubscriberKeyUsageValidator,WARNING,cabf.serverauth.subscriber_rsa_digitalsignature_and_keyencipherment_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 1.3.6.1.5.5.7.1.3
+certificate.tbsCertificate.extensions.8.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
+certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies.3.policyQualifiers.0,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.subject_key_identifier_extension_present,
diff --git a/tests/integration_certificate/etsi/qevcp_w_psd2_eidas_pre_certificate/psp_roles_good.crttest b/tests/integration_certificate/etsi/qevcp_w_psd2_eidas_pre_certificate/psp_roles_good.crttest
new file mode 100644
index 0000000..ce572df
--- /dev/null
+++ b/tests/integration_certificate/etsi/qevcp_w_psd2_eidas_pre_certificate/psp_roles_good.crttest
@@ -0,0 +1,46 @@
+-----BEGIN CERTIFICATE-----
+MIIHyjCCBbKgAwIBAgIUaHFoHojMlU3qa6adMxyvPxlyg2UwDQYJKoZIhvcNAQELBQAwVzELMAkGA1UE
+BhMCTkwxIDAeBgNVBAoMF1F1b1ZhZGlzIFRydXN0bGluayBCLlYuMSYwJAYDVQQDDB1RdW9WYWRpcyBR
+dWFsaWZpZWQgV2ViIElDQSBHMjAeFw0yMzA5MDYxMzQzNDBaFw0yNDA5MjYyMzQ1MDBaMIHEMRMwEQYL
+KwYBBAGCNzwCAQMTAk5MMR0wGwYDVQQPDBRQcml2YXRlIE9yZ2FuaXphdGlvbjERMA8GA1UEBRMINjAz
+ODUwMTQxCzAJBgNVBAYTAk5MMRAwDgYDVQQIDAdVdHJlY2h0MRAwDgYDVQQHDAdVdHJlY2h0MRowGAYD
+VQRhDBFQU0ROTC1ETkItUjE2MTE2MjEXMBUGA1UECgwOTW9uZXlNb25rIEIuVi4xFTATBgNVBAMMDG1v
+bmV5bW9uay5ubDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMPTtcvEnft2QdRWGwj/ga0G
+cJJHiLtwbrzFfqVvVk+bOjFAqDDFT+GtKbKVmbAS0z8t5W5dbUAtPrTgPmHky5Xfw9ZEGQ2KYMYAXyrl
+0aXcvYbtgILEhEW+zmfqM2wIY/X4Yf+nK0AQfZTGxu4KqC8nTP9pDxgRkEeuvUhlNCGK58J/NfREGwzJ
+eWFWB9vqf72AKj06/2utpG3XLoQ5mAl146pY+Y9X4kKE6dfk82m3B0JnGfYF6qn4ZmTjl2ht5p+8678W
+vJj4kcKDORO+k/oeyouNnct1dHSKbL+DkUNqHqXPTAkqJsBcC0Z5hoWbYGxMzsBupSdbrNHbZ3yIF4EC
+AwEAAaOCAx4wggMaMB8GA1UdIwQYMBaAFLzrXvvYDeiCroZGvTt8sm/RLH8KMIGFBggrBgEFBQcBAQR5
+MHcwSQYIKwYBBQUHMAKGPWh0dHA6Ly90cnVzdC5xdW92YWRpc2dsb2JhbC5jb20vcXVvdmFkaXNxdWFs
+aWZpZWR3ZWJpY2FnMi5jcnQwKgYIKwYBBQUHMAGGHmh0dHA6Ly9vY3NwLnF1b3ZhZGlzZ2xvYmFsLmNv
+bTBgBgNVHREEWTBXggxtb25leW1vbmsubmyCEGFwcC5tb25leW1vbmsubmyCEHd3dy5tb25leW1vbmsu
+bmyCEGFwaS5tb25leW1vbmsubmyCEXBzZDIubW9uZXltb25rLm5sMH8GA1UdIAR4MHYwCQYHBACL7EAB
+BDAJBgcEAIGYJwMBMA4GDCsGAQQBvlgAAmQBAjBFBgorBgEEAb5YAYNCMDcwNQYIKwYBBQUHAgEWKWh0
+dHBzOi8vd3d3LnF1b3ZhZGlzZ2xvYmFsLmNvbS9yZXBvc2l0b3J5MAcGBWeBDAEBMB0GA1UdJQQWMBQG
+CCsGAQUFBwMCBggrBgEFBQcDATCBtwYIKwYBBQUHAQMEgaowgacwCgYIKwYBBQUHCwIwCAYGBACORgEB
+MBMGBgQAjkYBBjAJBgcEAI5GAQYDMDsGBgQAjkYBBTAxMC8WKWh0dHBzOi8vd3d3LnF1b3ZhZGlzZ2xv
+YmFsLmNvbS9yZXBvc2l0b3J5EwJlbjA9BgYEAIGYJwIwMzATMBEGBwQAgZgnAQMMBlBTUF9BSQwUVGhl
+IE5ldGhlcmxhbmRzIEJhbmsMBk5MLUROQjAhBgVngQwDAQQYMBYTA1BTRBMCTkwMC0ROQi1SMTYxMTYy
+MEwGA1UdHwRFMEMwQaA/oD2GO2h0dHA6Ly9jcmwucXVvdmFkaXNnbG9iYWwuY29tL3F1b3ZhZGlzcXVh
+bGlmaWVkd2ViaWNhZzIuY3JsMB0GA1UdDgQWBBQj/QN72MyBXjUc0ffvASf6sNCXxTAOBgNVHQ8BAf8E
+BAMCBaAwEwYKKwYBBAHWeQIEAwEB/wQCBQAwDQYJKoZIhvcNAQELBQADggIBAE5CS9r0ux/rI2wB0TpL
++EBorvP/2I6RpmQoT375oPvZa6f3TVrthMHxVePn9AnPywCQxFH8iqJNMlzh9qfFDZ43hy79cXaINaHq
+vjsQM8cQj2J9PJx8KWCLXIrIhYPBgGdG6QXHmAQC9Nm6kMuSlvaafNvfOKNE71qxp22vDkPKtKBvBRFo
+kSANIbnMUijiY2jDR/+o1XDskaBUN8TrTVI+nALP0+rcb0XuJN+F4KTjzvy9bshypzBmfLcGZz1eGfly
+z9ZOIYWqMa9wJlVvwQNrlrBlsoSrwe+Ucw1q2Vs26ttlwvnvBz4DSZ2j0puyry+UrL8oOGRz3xAWKIiR
+yY0EDPHMPeYyL91yGAMNJD8TEoTON5klUZO8mXtTAklEQ3HYt36DuOtSaDPvGTzRtSByvgYAwtZrswfJ
+H3MUkf+5EAUg8q86yFbjf8A4/sbLKTwQjH/PormB5l25DH3GHDtYCyvwBs+v1xRuZTYu4UGZZTQVDoov
+Dj9G9V78+VPKJ07PQgOh+nmFFkfOyobgHzxeBCnQ/g2clZum99SqW5Pcq7rtIWHbmVU5/340S6KVIzo3
+mJjkcZQVeflQPQbOkiGvOVFqi1hxSTCDDq5bmK5pk6PD62PfLxmFEtqWZT9bYnfllENmzJkp2kaGXGo3
+HbSqR2FjP9/adqJv2m6z+KV4
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.subject.rdnSequence,EvSubscriberAttributeAllowanceValidator,WARNING,cabf.ev_guidelines.common_name_attribute_present,
+certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies,SubscriberPoliciesValidator,WARNING,cabf.serverauth.subscriber_first_policy_oid_not_reserved,
+certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies.3.policyQualifiers.0,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
+certificate.tbsCertificate.extensions.8.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
+certificate.tbsCertificate.extensions.9.extnValue.keyUsage,SubscriberKeyUsageValidator,WARNING,cabf.serverauth.subscriber_rsa_digitalsignature_and_keyencipherment_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.subject_key_identifier_extension_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 1.3.6.1.5.5.7.1.3
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 2.23.140.3.1
diff --git a/tests/integration_certificate/etsi/qevcp_w_psd2_eidas_pre_certificate/qc_eupds_good.crttest b/tests/integration_certificate/etsi/qevcp_w_psd2_eidas_pre_certificate/qc_eupds_good.crttest
new file mode 100644
index 0000000..df8f743
--- /dev/null
+++ b/tests/integration_certificate/etsi/qevcp_w_psd2_eidas_pre_certificate/qc_eupds_good.crttest
@@ -0,0 +1,54 @@
+-----BEGIN CERTIFICATE-----
+MIIHyjCCBbKgAwIBAgIUaHFoHojMlU3qa6adMxyvPxlyg2UwDQYJKoZIhvcNAQEL
+BQAwVzELMAkGA1UEBhMCTkwxIDAeBgNVBAoMF1F1b1ZhZGlzIFRydXN0bGluayBC
+LlYuMSYwJAYDVQQDDB1RdW9WYWRpcyBRdWFsaWZpZWQgV2ViIElDQSBHMjAeFw0y
+MzA5MDYxMzQzNDBaFw0yNDA5MjYyMzQ1MDBaMIHEMRMwEQYLKwYBBAGCNzwCAQMT
+Ak5MMR0wGwYDVQQPDBRQcml2YXRlIE9yZ2FuaXphdGlvbjERMA8GA1UEBRMINjAz
+ODUwMTQxCzAJBgNVBAYTAk5MMRAwDgYDVQQIDAdVdHJlY2h0MRAwDgYDVQQHDAdV
+dHJlY2h0MRowGAYDVQRhDBFQU0ROTC1ETkItUjE2MTE2MjEXMBUGA1UECgwOTW9u
+ZXlNb25rIEIuVi4xFTATBgNVBAMMDG1vbmV5bW9uay5ubDCCASIwDQYJKoZIhvcN
+AQEBBQADggEPADCCAQoCggEBAMPTtcvEnft2QdRWGwj/ga0GcJJHiLtwbrzFfqVv
+Vk+bOjFAqDDFT+GtKbKVmbAS0z8t5W5dbUAtPrTgPmHky5Xfw9ZEGQ2KYMYAXyrl
+0aXcvYbtgILEhEW+zmfqM2wIY/X4Yf+nK0AQfZTGxu4KqC8nTP9pDxgRkEeuvUhl
+NCGK58J/NfREGwzJeWFWB9vqf72AKj06/2utpG3XLoQ5mAl146pY+Y9X4kKE6dfk
+82m3B0JnGfYF6qn4ZmTjl2ht5p+8678WvJj4kcKDORO+k/oeyouNnct1dHSKbL+D
+kUNqHqXPTAkqJsBcC0Z5hoWbYGxMzsBupSdbrNHbZ3yIF4ECAwEAAaOCAx4wggMa
+MB8GA1UdIwQYMBaAFLzrXvvYDeiCroZGvTt8sm/RLH8KMIGFBggrBgEFBQcBAQR5
+MHcwSQYIKwYBBQUHMAKGPWh0dHA6Ly90cnVzdC5xdW92YWRpc2dsb2JhbC5jb20v
+cXVvdmFkaXNxdWFsaWZpZWR3ZWJpY2FnMi5jcnQwKgYIKwYBBQUHMAGGHmh0dHA6
+Ly9vY3NwLnF1b3ZhZGlzZ2xvYmFsLmNvbTBgBgNVHREEWTBXggxtb25leW1vbmsu
+bmyCEGFwcC5tb25leW1vbmsubmyCEHd3dy5tb25leW1vbmsubmyCEGFwaS5tb25l
+eW1vbmsubmyCEXBzZDIubW9uZXltb25rLm5sMH8GA1UdIAR4MHYwCQYHBACL7EAB
+BDAJBgcEAIGYJwMBMA4GDCsGAQQBvlgAAmQBAjBFBgorBgEEAb5YAYNCMDcwNQYI
+KwYBBQUHAgEWKWh0dHBzOi8vd3d3LnF1b3ZhZGlzZ2xvYmFsLmNvbS9yZXBvc2l0
+b3J5MAcGBWeBDAEBMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATCBtwYI
+KwYBBQUHAQMEgaowgacwCgYIKwYBBQUHCwIwCAYGBACORgEBMBMGBgQAjkYBBjAJ
+BgcEAI5GAQYDMDsGBgQAjkYBBTAxMC8WKWh0dHBzOi8vd3d3LnF1b3ZhZGlzZ2xv
+YmFsLmNvbS9yZXBvc2l0b3J5EwJlbjA9BgYEAIGYJwIwMzATMBEGBwQAgZgnAQMM
+BlBTUF9BSQwUVGhlIE5ldGhlcmxhbmRzIEJhbmsMBk5MLUROQjAhBgVngQwDAQQY
+MBYTA1BTRBMCTkwMC0ROQi1SMTYxMTYyMEwGA1UdHwRFMEMwQaA/oD2GO2h0dHA6
+Ly9jcmwucXVvdmFkaXNnbG9iYWwuY29tL3F1b3ZhZGlzcXVhbGlmaWVkd2ViaWNh
+ZzIuY3JsMB0GA1UdDgQWBBQj/QN72MyBXjUc0ffvASf6sNCXxTAOBgNVHQ8BAf8E
+BAMCBaAwEwYKKwYBBAHWeQIEAwEB/wQCBQAwDQYJKoZIhvcNAQELBQADggIBAE5C
+S9r0ux/rI2wB0TpL+EBorvP/2I6RpmQoT375oPvZa6f3TVrthMHxVePn9AnPywCQ
+xFH8iqJNMlzh9qfFDZ43hy79cXaINaHqvjsQM8cQj2J9PJx8KWCLXIrIhYPBgGdG
+6QXHmAQC9Nm6kMuSlvaafNvfOKNE71qxp22vDkPKtKBvBRFokSANIbnMUijiY2jD
+R/+o1XDskaBUN8TrTVI+nALP0+rcb0XuJN+F4KTjzvy9bshypzBmfLcGZz1eGfly
+z9ZOIYWqMa9wJlVvwQNrlrBlsoSrwe+Ucw1q2Vs26ttlwvnvBz4DSZ2j0puyry+U
+rL8oOGRz3xAWKIiRyY0EDPHMPeYyL91yGAMNJD8TEoTON5klUZO8mXtTAklEQ3HY
+t36DuOtSaDPvGTzRtSByvgYAwtZrswfJH3MUkf+5EAUg8q86yFbjf8A4/sbLKTwQ
+jH/PormB5l25DH3GHDtYCyvwBs+v1xRuZTYu4UGZZTQVDoovDj9G9V78+VPKJ07P
+QgOh+nmFFkfOyobgHzxeBCnQ/g2clZum99SqW5Pcq7rtIWHbmVU5/340S6KVIzo3
+mJjkcZQVeflQPQbOkiGvOVFqi1hxSTCDDq5bmK5pk6PD62PfLxmFEtqWZT9bYnfl
+lENmzJkp2kaGXGo3HbSqR2FjP9/adqJv2m6z+KV4
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.subject.rdnSequence,EvSubscriberAttributeAllowanceValidator,WARNING,cabf.ev_guidelines.common_name_attribute_present,
+certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies,SubscriberPoliciesValidator,WARNING,cabf.serverauth.subscriber_first_policy_oid_not_reserved,
+certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies.3.policyQualifiers.0,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
+certificate.tbsCertificate.extensions.8.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
+certificate.tbsCertificate.extensions.9.extnValue.keyUsage,SubscriberKeyUsageValidator,WARNING,cabf.serverauth.subscriber_rsa_digitalsignature_and_keyencipherment_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.subject_key_identifier_extension_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 1.3.6.1.5.5.7.1.3
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 2.23.140.3.1
diff --git a/tests/integration_certificate/etsi/qevcp_w_psd2_eidas_pre_certificate/qc_eupds_missing.crttest b/tests/integration_certificate/etsi/qevcp_w_psd2_eidas_pre_certificate/qc_eupds_missing.crttest
new file mode 100644
index 0000000..2aa955f
--- /dev/null
+++ b/tests/integration_certificate/etsi/qevcp_w_psd2_eidas_pre_certificate/qc_eupds_missing.crttest
@@ -0,0 +1,46 @@
+-----BEGIN CERTIFICATE-----
+MIIGWTCCBUGgAwIBAgIQK7B0T5Jt9ZbWmXDNexg0FjANBgkqhkiG9w0BAQsFADB3
+MQswCQYDVQQGEwJFUzEZMBcGA1UEChMQRW50cnVzdCBFVSwgUy5MLjEYMBYGA1UE
+YRMPVkFURVMtQjgxMTg4MDQ3MTMwMQYDVQQDEypFbnRydXN0IENlcnRpZmljYXRp
+b24gQXV0aG9yaXR5IC0gRVMgUVdBQzIwHhcNMjQwMTI2MTA0NzE3WhcNMjUwMTI1
+MTA0NzE2WjCBuDELMAkGA1UEBhMCRkkxETAPBgNVBAcTCEhlbHNpbmtpMRMwEQYL
+KwYBBAGCNzwCAQMTAkZJMRgwFgYDVQQKEw9Ob3JkZWEgQmFuayBBYnAxHTAbBgNV
+BA8TFFByaXZhdGUgT3JnYW5pemF0aW9uMRIwEAYDVQQFEwkyODU4Mzk0LTkxEzAR
+BgNVBAMTCm5vcmRlYS5jb20xHzAdBgNVBGETFlBTREZJLUZJTkZTQS0yODU4Mzk0
+LTkwggGiMA0GCSqGSIb3DQEBAQUAA4IBjwAwggGKAoIBgQCvkzcQBXg1m7bjVOFf
+9Zvw9YsHxB+/U10b1f8Ar+SSh46WJAlocmp88gGNMyLl44uEILmRWWno0r7xBqPS
+9YrsnBiAePi7QTnb3ag50M1l1smNlpdzhzU0hGdVZi92GvjVlTL/5/5ZqdhDgPsq
+ly/q0tz3GifmSpAJVetoCME30Rag5HTK8OdpSs+weimafSf/59nilC2x/6E4+/Af
+0iiJ5f719lZ/GGLdwm1fn+fXgAS5mXYxp7/D+hZqyngOiYVufoRRMjumeCEUTsz2
+yiCTJ2zXzgf8YTnFs7V/v1YNWhH2BsVnQJjgqIz5dc9ZxlEN2cGO5jEqSLm1RPZM
+MH2hUx7s/Ulx5+qu7TzNorLO9aHMFSrlRm0k2wcQbNaDSkIBS4utO56QEl+momSt
+ZRyd8kc40VaBlcM3Tbac86mCbOrMTQua19UvX6AgFg4V3Uysi9YpY6efMc4XhNvx
+t7Sg2E4VymdyqLRQ1A1g2DvH63hVVLZ+7ZGAjzes/AxRX78CAwEAAaOCAh0wggIZ
+MAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFK8C0yrZwru1bR+AVroLqmQsFP9LMB8G
+A1UdIwQYMBaAFEHPrisdYzvLTPWQRHm2WiSJ35KcMGkGCCsGAQUFBwEBBF0wWzAj
+BggrBgEFBQcwAYYXaHR0cDovL29jc3AuZW50cnVzdC5uZXQwNAYIKwYBBQUHMAKG
+KGh0dHA6Ly9haWEuZW50cnVzdC5uZXQvZXNxd2FjMi1jaGFpbi5jZXIwNQYDVR0f
+BC4wLDAqoCigJoYkaHR0cDovL2NybC5lbnRydXN0Lm5ldC9lc3F3YWMyY2EuY3Js
+MCYGBWeBDAMBBB0wGxMDUFNEEwJGSQwQRklORlNBLTI4NTgzOTQtOTBcBggrBgEF
+BQcBAwRQME4wCAYGBACORgEBMC0GBgQAjkYBBTAjMCEWG2h0dHBzOi8vd3d3LmVu
+dHJ1c3QubmV0L3JwYRMCZW4wEwYGBACORgEGMAkGBwQAjkYBBgMwJQYDVR0RBB4w
+HIIKbm9yZGVhLmNvbYIOd3d3Lm5vcmRlYS5jb20wDgYDVR0PAQH/BAQDAgWgMB0G
+A1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjA2BgNVHSAELzAtMAcGBWeBDAEB
+MAkGBwQAi+xAAQQwCQYHBACBmCcDATAMBgpghkgBhvpsCgECMBMGCisGAQQB1nkC
+BAMBAf8EAgUAMA0GCSqGSIb3DQEBCwUAA4IBAQBRGFIJzTBEN7x6tIEtUW9WJOqC
+W7mOp2Gb2nyDZXZdVNqEqeW0Rw87GfmcA4FnV/GlOSScgnBPtqaD3i9ICA+AQVwM
+yufwNasSZ5XjzsOgkuyrinAmEwMk5Rnn82cMRReouATR6L1J7VKWN4fEaTaZ5Cwz
+F+/H65C4KGjB9TPfACUs2Mbhy5wejwMNu+FK6J9dqSi6h49chKpUo9E98aSBtp0f
+ZjD+28YutC1tvG5Dt90cZaZE9VGbUy4dgtajltdb6HAJbcMDCF2w171IuzIYGSbB
+WTZeS50dZd22h+oKXL2byeNx1nS4Z4Es4ELjRMsxnD4l+MrmrhHWAoEMWBfP
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.subject.rdnSequence,EvSubscriberAttributeAllowanceValidator,WARNING,cabf.ev_guidelines.common_name_attribute_present,
+certificate.tbsCertificate.extensions.1.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
+certificate.tbsCertificate.extensions.6.extnValue.qCStatements,PresenceofQCEUPDSStatementValidator,ERROR,etsi.ts_119_495.gen-5.1.1.qc_eu_pds_missing,
+certificate.tbsCertificate.extensions.8.extnValue.keyUsage,SubscriberKeyUsageValidator,WARNING,cabf.serverauth.subscriber_rsa_digitalsignature_and_keyencipherment_present,
+certificate.tbsCertificate.extensions.10.extnValue.certificatePolicies,EvCpsUriPresenceValidator,ERROR,cabf.ev_guidelines.cps_uri_policy_qualifier_missing,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.subject_key_identifier_extension_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 1.3.6.1.5.5.7.1.3
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 2.23.140.3.1
diff --git a/tests/integration_certificate/etsi/qevcp_w_psd2_eidas_pre_certificate/semantics_info_nra_missing.crttest b/tests/integration_certificate/etsi/qevcp_w_psd2_eidas_pre_certificate/semantics_info_nra_missing.crttest
new file mode 100644
index 0000000..9838744
--- /dev/null
+++ b/tests/integration_certificate/etsi/qevcp_w_psd2_eidas_pre_certificate/semantics_info_nra_missing.crttest
@@ -0,0 +1,64 @@
+-----BEGIN CERTIFICATE-----
+MIIJRDCCByygAwIBAgIQPgSZji6nF1kq/YKdlxV/VTANBgkqhkiG9w0BAQsFADCB
+zDELMAkGA1UEBhMCR1IxKzApBgNVBAoMIkdyZWVrIFVuaXZlcnNpdGllcyBOZXR3
+b3JrIChHVW5ldCkxGDAWBgNVBGEMD1hYOkdSLTA5OTAyODIyMDE3MDUGA1UECwwu
+SGVsbGVuaWMgQWNhZGVtaWMgYW5kIFJlc2VhcmNoIEluc3RpdHV0aW9ucyBDQTE9
+MDsGA1UEAww0SEFSSUNBIFF1YWxpZmllZCBXZWIgQXV0aGVudGljYXRpb24gQ2Vy
+dGlmaWNhdGVzIFJTQTAeFw0yNDAyMTUxMTM5MjdaFw0yNTAyMjAxMTM5MjdaMIHC
+MQswCQYDVQQGEwJGUjENMAsGA1UEBwwETFlPTjErMCkGA1UECgwiQ0FJU1NFIERF
+IENSRURJVCBNVU5JQ0lQQUwgREUgTFlPTjEUMBIGA1UEYQwLWFg6R1ItMTgwNTAx
+EjAQBgNVBAUTCTI2NjkwMDI5OTEZMBcGA1UEAwwQYXBpLmNjbWRpcmVjdC5mcjEd
+MBsGA1UEDwwUUHJpdmF0ZSBPcmdhbml6YXRpb24xEzARBgsrBgEEAYI3PAIBAxMC
+RlIwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC9CMebpRNSfXpeFob/
+SPyAuBGtlbXRqMMc5suNRQR3yKptiMs4ybSpAtxOGDXtemCOEWEQhQVWLggCeJid
+nL27VWaRJUkq2q643agLBgusJIA9odhvPr5GNZlnoEiIsmvtzwlLVmzMh0+I71Rj
+gVt+/7Sbwye3PVMqceKHOlHMuQrW9xutfYDswYS4SI7TNonpvA/h/vI2VobGkr6Z
+jVCt1z+2fQbs0+6GWZDRxSlnC97eROjgMfDumz0fh9gX1Gg7Efm4VwDfOEeBJA16
+DfTIYQPe7CeDGxAgCVHOLa+75jCH/OSv8RefVVWQGlgoZFlHG0+vyhhn3a4/NgnW
+9p2jzQgjq15WeuEJ3YY0qfguNVJ+aGdjYND74XkDD9VpaIkohiwlMMxqkenmQ/AP
+Gq3quR3aaMDdjZVToJ3Hx2TRQFl073FzMRWwMQN1mIrfZCqmT39ah1EXW4R4h6fl
+ta8VxOt3ETHTirK+SJr5RkAgNOTQEEwR/cKjj5y2YRKYG90ZeLr7tsGD3TaV4hXz
+VOvEa0iciGmfar5gpWCZnyfOmr9JhjMlX7JBWmG2g/bzroOR7WApzm+ojSerje/D
+CcdLJNpP3RUkPd+CAFWQbDmOX5FqH7ap6qrkWIVwtB5ZQNoAMYgGsgZzuHRsYMfT
+piWV15PJ7hQPMAVX7wm/J6CDdQIDAQABo4IDKDCCAyQwHwYDVR0jBBgwFoAUtezm
+mxZ4aa2x6ElWR1gT949NpsMwagYIKwYBBQUHAQEEXjBcMDcGCCsGAQUFBzAChito
+dHRwOi8vY3J0LmhhcmljYS5nci9IQVJJQ0EtUVdBQy1TdWItUjEuY2VyMCEGCCsG
+AQUFBzABhhVodHRwOi8vb2NzcC5oYXJpY2EuZ3IwMQYDVR0RBCowKIIQYXBpLmNj
+bWRpcmVjdC5mcoIUd3d3LmFwaS5jY21kaXJlY3QuZnIwYQYDVR0gBFowWDAHBgVn
+gQwBATAJBgcEAIvsQAEEMEIGDCsGAQQBgc8RAQEBBjAyMDAGCCsGAQUFBwIBFiRo
+dHRwczovL3JlcG8uaGFyaWNhLmdyL2RvY3VtZW50cy9DUFMwHQYDVR0lBBYwFAYI
+KwYBBQUHAwIGCCsGAQUFBwMBMIIBWQYIKwYBBQUHAQMEggFLMIIBRzAVBggrBgEF
+BQcLAjAJBgcEAIvsSQECMAgGBgQAjkYBATATBgYEAI5GAQYwCQYHBACORgEGAzCB
+jQYGBACORgEFMIGCMD8WOWh0dHBzOi8vcmVwby5oYXJpY2EuZ3IvZG9jdW1lbnRz
+L1F1YWxpZmllZExlZ2FsUERTLUVOLnBkZhMCZW4wPxY5aHR0cHM6Ly9yZXBvLmhh
+cmljYS5nci9kb2N1bWVudHMvUXVhbGlmaWVkTGVnYWxQRFMtRUwucGRmEwJlbDB/
+BgYEAIGYJwIwdTA5MBEGBwQAgZgnAQEMBlBTUF9BUzARBgcEAIGYJwECDAZQU1Bf
+UEkwEQYHBACBmCcBAwwGUFNQX0FJDC9QcnVkZW50aWFsIFN1cGVydmlzb3J5IGFu
+ZCBSZXNvbHV0aW9uIEF1dGhvcml0eQwHRlItQUNQUjAgBgVngQwDAQQXMBUTA1BT
+RBMCRlIMCkFDUFItMTgwNTAwPAYDVR0fBDUwMzAxoC+gLYYraHR0cDovL2NybC5o
+YXJpY2EuZ3IvSEFSSUNBLVFXQUMtU3ViLVIxLmNybDAOBgNVHQ8BAf8EBAMCBaAw
+EwYKKwYBBAHWeQIEAwEB/wQCBQAwDQYJKoZIhvcNAQELBQADggIBAKlrnXsbANrW
+QhcSVtML052pQHQTi78dJzhHJ4D1iHYBwILR6bmOCflXz3aUdZ3EKS4H7kHcQdnb
+d/K69AUxrQZ01W6eJYaxfyexCFMPGmpSvzpzt2dn8aHCXazDYE7WQdvIUeDnTktI
+xRauLKWNs/22ULU/26umzxNnPfOFlEeVbAZ51Lz03VQ+P0ZKfYTrQDvuukiSu7rq
+3Vp1xR5QjrJqLY32YYLro8Dnpk3AEf+d9/a3l9K5vA+fVecOrJlAMhR+n0lF4jEG
+LHV16mGdmlo/sv4+A0x3q9P+mbbNiA5pc6zE2/5CqXcOFvlJ3I2QZoqApxmv5mBI
+ORyHX7JpQsQhtEYoOAmhilUdatZdDHZk5B8MHZn0GfOGISioDbDNHUklDoJUQjC4
+u9xEwg2uDm/K9LDh6v/H2u+NeJXi8xH0nVVGkdNHuIjH1ycNikiS+Rv6bZ4silaq
+soDIowpDNbvzIv26UzxtgNjQ/D1JyjOWy2e8XUdxRLi9tYvugUg7glVHdq2AJjQx
+yt86igKJBW6sYcboLpHXZro+lq49voceI0/PPA0oh0yC/NpqjhEbIkPfNav12lmb
+PG5PBWihP3kAPSYCAlWt1OzlDknclIwonFWvKL+Im3chcth2PeC9OuClrn0QH1jj
+8xasVCwWQYUashFNaOgMy92gpnVL9vSO
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.subject.rdnSequence,EvSubscriberAttributeAllowanceValidator,WARNING,cabf.ev_guidelines.common_name_attribute_present,
+certificate.tbsCertificate.subject.rdnSequence.3.0.value.x520OrganizationIdentifier,CabfOrganizationIdentifierAttributeValidator,ERROR,cabf.invalid_organization_identifier_registration_scheme,"Invalid registration scheme: ""XX"""
+certificate.tbsCertificate.subject.rdnSequence.3.0.value.x520OrganizationIdentifier,OrganizationIdentifierConsistentSubjectAndExtensionValidator,ERROR,cabf.serverauth.organization_identifier_mismatched_value,"Mismatched scheme: attribute: ""XX"", extension: ""PSD"""
+certificate.tbsCertificate.subject.rdnSequence.3.0.value.x520OrganizationIdentifier,LegalPersonOrganizationIdentifierValidator,NOTICE,etsi.en_319_412_1.leg-5.1.4-03.national_identifier_scheme_detected,"National registration scheme ""XX"" in organization identifier: ""XX:GR-18050"""
+certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies.2.policyQualifiers.0,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
+certificate.tbsCertificate.extensions.5.extnValue.qCStatements.0.statementInfo.semanticsInformation,LegalPersonIdentifierNameRegistrationAuthoritiesValidator,ERROR,etsi.en_319_412_1.leg-5.1.4-05.national_id_scheme_name_registration_authorities_missing,
+certificate.tbsCertificate.extensions.8.extnValue.keyUsage,SubscriberKeyUsageValidator,WARNING,cabf.serverauth.subscriber_rsa_digitalsignature_and_keyencipherment_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 1.3.6.1.5.5.7.1.3
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 2.23.140.3.1
+certificate.tbsCertificate.subject.rdnSequence.3.0.value.x520OrganizationIdentifier,PsdOrganizationIdentifierFormatValidator,ERROR,etsi.ts_119_495.gen-5.2.1-3.invalid_psd_organization_id_format,"Invalid PSD organization identifier format: ""XX:GR-18050"""
diff --git a/tests/integration_certificate/etsi/qevcp_w_psd2_eidas_pre_certificate/semantics_info_nra_uri_missing.crttest b/tests/integration_certificate/etsi/qevcp_w_psd2_eidas_pre_certificate/semantics_info_nra_uri_missing.crttest
new file mode 100644
index 0000000..5767dd3
--- /dev/null
+++ b/tests/integration_certificate/etsi/qevcp_w_psd2_eidas_pre_certificate/semantics_info_nra_uri_missing.crttest
@@ -0,0 +1,64 @@
+-----BEGIN CERTIFICATE-----
+MIIJUzCCBzugAwIBAgIQPgSZji6nF1kq/YKdlxV/VTANBgkqhkiG9w0BAQsFADCB
+zDELMAkGA1UEBhMCR1IxKzApBgNVBAoMIkdyZWVrIFVuaXZlcnNpdGllcyBOZXR3
+b3JrIChHVW5ldCkxGDAWBgNVBGEMD1hYOkdSLTA5OTAyODIyMDE3MDUGA1UECwwu
+SGVsbGVuaWMgQWNhZGVtaWMgYW5kIFJlc2VhcmNoIEluc3RpdHV0aW9ucyBDQTE9
+MDsGA1UEAww0SEFSSUNBIFF1YWxpZmllZCBXZWIgQXV0aGVudGljYXRpb24gQ2Vy
+dGlmaWNhdGVzIFJTQTAeFw0yNDAyMTUxMTM5MjdaFw0yNTAyMjAxMTM5MjdaMIHC
+MQswCQYDVQQGEwJGUjENMAsGA1UEBwwETFlPTjErMCkGA1UECgwiQ0FJU1NFIERF
+IENSRURJVCBNVU5JQ0lQQUwgREUgTFlPTjEUMBIGA1UEYQwLWFg6R1ItMTgwNTAx
+EjAQBgNVBAUTCTI2NjkwMDI5OTEZMBcGA1UEAwwQYXBpLmNjbWRpcmVjdC5mcjEd
+MBsGA1UEDwwUUHJpdmF0ZSBPcmdhbml6YXRpb24xEzARBgsrBgEEAYI3PAIBAxMC
+RlIwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC9CMebpRNSfXpeFob/
+SPyAuBGtlbXRqMMc5suNRQR3yKptiMs4ybSpAtxOGDXtemCOEWEQhQVWLggCeJid
+nL27VWaRJUkq2q643agLBgusJIA9odhvPr5GNZlnoEiIsmvtzwlLVmzMh0+I71Rj
+gVt+/7Sbwye3PVMqceKHOlHMuQrW9xutfYDswYS4SI7TNonpvA/h/vI2VobGkr6Z
+jVCt1z+2fQbs0+6GWZDRxSlnC97eROjgMfDumz0fh9gX1Gg7Efm4VwDfOEeBJA16
+DfTIYQPe7CeDGxAgCVHOLa+75jCH/OSv8RefVVWQGlgoZFlHG0+vyhhn3a4/NgnW
+9p2jzQgjq15WeuEJ3YY0qfguNVJ+aGdjYND74XkDD9VpaIkohiwlMMxqkenmQ/AP
+Gq3quR3aaMDdjZVToJ3Hx2TRQFl073FzMRWwMQN1mIrfZCqmT39ah1EXW4R4h6fl
+ta8VxOt3ETHTirK+SJr5RkAgNOTQEEwR/cKjj5y2YRKYG90ZeLr7tsGD3TaV4hXz
+VOvEa0iciGmfar5gpWCZnyfOmr9JhjMlX7JBWmG2g/bzroOR7WApzm+ojSerje/D
+CcdLJNpP3RUkPd+CAFWQbDmOX5FqH7ap6qrkWIVwtB5ZQNoAMYgGsgZzuHRsYMfT
+piWV15PJ7hQPMAVX7wm/J6CDdQIDAQABo4IDNzCCAzMwHwYDVR0jBBgwFoAUtezm
+mxZ4aa2x6ElWR1gT949NpsMwagYIKwYBBQUHAQEEXjBcMDcGCCsGAQUFBzAChito
+dHRwOi8vY3J0LmhhcmljYS5nci9IQVJJQ0EtUVdBQy1TdWItUjEuY2VyMCEGCCsG
+AQUFBzABhhVodHRwOi8vb2NzcC5oYXJpY2EuZ3IwMQYDVR0RBCowKIIQYXBpLmNj
+bWRpcmVjdC5mcoIUd3d3LmFwaS5jY21kaXJlY3QuZnIwYQYDVR0gBFowWDAHBgVn
+gQwBATAJBgcEAIvsQAEEMEIGDCsGAQQBgc8RAQEBBjAyMDAGCCsGAQUFBwIBFiRo
+dHRwczovL3JlcG8uaGFyaWNhLmdyL2RvY3VtZW50cy9DUFMwHQYDVR0lBBYwFAYI
+KwYBBQUHAwIGCCsGAQUFBwMBMIIBaAYIKwYBBQUHAQMEggFaMIIBVjAkBggrBgEF
+BQcLAjAYBgcEAIvsSQECMA2CC2V4YW1wbGUuY29tMAgGBgQAjkYBATATBgYEAI5G
+AQYwCQYHBACORgEGAzCBjQYGBACORgEFMIGCMD8WOWh0dHBzOi8vcmVwby5oYXJp
+Y2EuZ3IvZG9jdW1lbnRzL1F1YWxpZmllZExlZ2FsUERTLUVOLnBkZhMCZW4wPxY5
+aHR0cHM6Ly9yZXBvLmhhcmljYS5nci9kb2N1bWVudHMvUXVhbGlmaWVkTGVnYWxQ
+RFMtRUwucGRmEwJlbDB/BgYEAIGYJwIwdTA5MBEGBwQAgZgnAQEMBlBTUF9BUzAR
+BgcEAIGYJwECDAZQU1BfUEkwEQYHBACBmCcBAwwGUFNQX0FJDC9QcnVkZW50aWFs
+IFN1cGVydmlzb3J5IGFuZCBSZXNvbHV0aW9uIEF1dGhvcml0eQwHRlItQUNQUjAg
+BgVngQwDAQQXMBUTA1BTRBMCRlIMCkFDUFItMTgwNTAwPAYDVR0fBDUwMzAxoC+g
+LYYraHR0cDovL2NybC5oYXJpY2EuZ3IvSEFSSUNBLVFXQUMtU3ViLVIxLmNybDAO
+BgNVHQ8BAf8EBAMCBaAwEwYKKwYBBAHWeQIEAwEB/wQCBQAwDQYJKoZIhvcNAQEL
+BQADggIBAKlrnXsbANrWQhcSVtML052pQHQTi78dJzhHJ4D1iHYBwILR6bmOCflX
+z3aUdZ3EKS4H7kHcQdnbd/K69AUxrQZ01W6eJYaxfyexCFMPGmpSvzpzt2dn8aHC
+XazDYE7WQdvIUeDnTktIxRauLKWNs/22ULU/26umzxNnPfOFlEeVbAZ51Lz03VQ+
+P0ZKfYTrQDvuukiSu7rq3Vp1xR5QjrJqLY32YYLro8Dnpk3AEf+d9/a3l9K5vA+f
+VecOrJlAMhR+n0lF4jEGLHV16mGdmlo/sv4+A0x3q9P+mbbNiA5pc6zE2/5CqXcO
+FvlJ3I2QZoqApxmv5mBIORyHX7JpQsQhtEYoOAmhilUdatZdDHZk5B8MHZn0GfOG
+ISioDbDNHUklDoJUQjC4u9xEwg2uDm/K9LDh6v/H2u+NeJXi8xH0nVVGkdNHuIjH
+1ycNikiS+Rv6bZ4silaqsoDIowpDNbvzIv26UzxtgNjQ/D1JyjOWy2e8XUdxRLi9
+tYvugUg7glVHdq2AJjQxyt86igKJBW6sYcboLpHXZro+lq49voceI0/PPA0oh0yC
+/NpqjhEbIkPfNav12lmbPG5PBWihP3kAPSYCAlWt1OzlDknclIwonFWvKL+Im3ch
+cth2PeC9OuClrn0QH1jj8xasVCwWQYUashFNaOgMy92gpnVL9vSO
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.subject.rdnSequence,EvSubscriberAttributeAllowanceValidator,WARNING,cabf.ev_guidelines.common_name_attribute_present,
+certificate.tbsCertificate.subject.rdnSequence.3.0.value.x520OrganizationIdentifier,CabfOrganizationIdentifierAttributeValidator,ERROR,cabf.invalid_organization_identifier_registration_scheme,"Invalid registration scheme: ""XX"""
+certificate.tbsCertificate.subject.rdnSequence.3.0.value.x520OrganizationIdentifier,OrganizationIdentifierConsistentSubjectAndExtensionValidator,ERROR,cabf.serverauth.organization_identifier_mismatched_value,"Mismatched scheme: attribute: ""XX"", extension: ""PSD"""
+certificate.tbsCertificate.subject.rdnSequence.3.0.value.x520OrganizationIdentifier,LegalPersonOrganizationIdentifierValidator,NOTICE,etsi.en_319_412_1.leg-5.1.4-03.national_identifier_scheme_detected,"National registration scheme ""XX"" in organization identifier: ""XX:GR-18050"""
+certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies.2.policyQualifiers.0,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
+certificate.tbsCertificate.extensions.5.extnValue.qCStatements.0.statementInfo.semanticsInformation,LegalPersonIdentifierNameRegistrationAuthoritiesValidator,ERROR,etsi.en_319_412_1.leg-5.1.4-05.national_id_scheme_name_registration_authorities_uri_missing,
+certificate.tbsCertificate.extensions.8.extnValue.keyUsage,SubscriberKeyUsageValidator,WARNING,cabf.serverauth.subscriber_rsa_digitalsignature_and_keyencipherment_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 1.3.6.1.5.5.7.1.3
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 2.23.140.3.1
+certificate.tbsCertificate.subject.rdnSequence.3.0.value.x520OrganizationIdentifier,PsdOrganizationIdentifierFormatValidator,ERROR,etsi.ts_119_495.gen-5.2.1-3.invalid_psd_organization_id_format,"Invalid PSD organization identifier format: ""XX:GR-18050"""
diff --git a/tests/integration_certificate/etsi/qevcp_w_psd2_eidas_pre_certificate/validity_period_too_long.crttest b/tests/integration_certificate/etsi/qevcp_w_psd2_eidas_pre_certificate/validity_period_too_long.crttest
new file mode 100644
index 0000000..d6df66d
--- /dev/null
+++ b/tests/integration_certificate/etsi/qevcp_w_psd2_eidas_pre_certificate/validity_period_too_long.crttest
@@ -0,0 +1,56 @@
+-----BEGIN CERTIFICATE-----
+MIIHvzCCBaegAwIBAgIUaHFoHojMlU3qa6adMxyvPxlyg2UwDQYJKoZIhvcNAQEL
+BQAwVzELMAkGA1UEBhMCTkwxIDAeBgNVBAoMF1F1b1ZhZGlzIFRydXN0bGluayBC
+LlYuMSYwJAYDVQQDDB1RdW9WYWRpcyBRdWFsaWZpZWQgV2ViIElDQSBHMjAeFw0y
+MzA5MDYxMzQzNDBaFw0yNTA5MjYyMzQ1MDBaMIHEMRMwEQYLKwYBBAGCNzwCAQMT
+Ak5MMR0wGwYDVQQPDBRQcml2YXRlIE9yZ2FuaXphdGlvbjERMA8GA1UEBRMINjAz
+ODUwMTQxCzAJBgNVBAYTAk5MMRAwDgYDVQQIDAdVdHJlY2h0MRAwDgYDVQQHDAdV
+dHJlY2h0MRowGAYDVQRhDBFQU0ROTC1ETkItUjE2MTE2MjEXMBUGA1UECgwOTW9u
+ZXlNb25rIEIuVi4xFTATBgNVBAMMDG1vbmV5bW9uay5ubDCCASIwDQYJKoZIhvcN
+AQEBBQADggEPADCCAQoCggEBAMPTtcvEnft2QdRWGwj/ga0GcJJHiLtwbrzFfqVv
+Vk+bOjFAqDDFT+GtKbKVmbAS0z8t5W5dbUAtPrTgPmHky5Xfw9ZEGQ2KYMYAXyrl
+0aXcvYbtgILEhEW+zmfqM2wIY/X4Yf+nK0AQfZTGxu4KqC8nTP9pDxgRkEeuvUhl
+NCGK58J/NfREGwzJeWFWB9vqf72AKj06/2utpG3XLoQ5mAl146pY+Y9X4kKE6dfk
+82m3B0JnGfYF6qn4ZmTjl2ht5p+8678WvJj4kcKDORO+k/oeyouNnct1dHSKbL+D
+kUNqHqXPTAkqJsBcC0Z5hoWbYGxMzsBupSdbrNHbZ3yIF4ECAwEAAaOCAxMwggMP
+MB8GA1UdIwQYMBaAFLzrXvvYDeiCroZGvTt8sm/RLH8KMIGFBggrBgEFBQcBAQR5
+MHcwSQYIKwYBBQUHMAKGPWh0dHA6Ly90cnVzdC5xdW92YWRpc2dsb2JhbC5jb20v
+cXVvdmFkaXNxdWFsaWZpZWR3ZWJpY2FnMi5jcnQwKgYIKwYBBQUHMAGGHmh0dHA6
+Ly9vY3NwLnF1b3ZhZGlzZ2xvYmFsLmNvbTBgBgNVHREEWTBXggxtb25leW1vbmsu
+bmyCEGFwcC5tb25leW1vbmsubmyCEHd3dy5tb25leW1vbmsubmyCEGFwaS5tb25l
+eW1vbmsubmyCEXBzZDIubW9uZXltb25rLm5sMHQGA1UdIARtMGswCQYHBACL7EAB
+BDAOBgwrBgEEAb5YAAJkAQIwRQYKKwYBBAG+WAGDQjA3MDUGCCsGAQUFBwIBFilo
+dHRwczovL3d3dy5xdW92YWRpc2dsb2JhbC5jb20vcmVwb3NpdG9yeTAHBgVngQwB
+ATAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwgbcGCCsGAQUFBwEDBIGq
+MIGnMAoGCCsGAQUFBwsCMAgGBgQAjkYBATATBgYEAI5GAQYwCQYHBACORgEGAzA7
+BgYEAI5GAQUwMTAvFilodHRwczovL3d3dy5xdW92YWRpc2dsb2JhbC5jb20vcmVw
+b3NpdG9yeRMCZW4wPQYGBACBmCcCMDMwEzARBgcEAIGYJwEDDAZQU1BfQUkMFFRo
+ZSBOZXRoZXJsYW5kcyBCYW5rDAZOTC1ETkIwIQYFZ4EMAwEEGDAWEwNQU0QTAk5M
+DAtETkItUjE2MTE2MjBMBgNVHR8ERTBDMEGgP6A9hjtodHRwOi8vY3JsLnF1b3Zh
+ZGlzZ2xvYmFsLmNvbS9xdW92YWRpc3F1YWxpZmllZHdlYmljYWcyLmNybDAdBgNV
+HQ4EFgQUI/0De9jMgV41HNH37wEn+rDQl8UwDgYDVR0PAQH/BAQDAgWgMBMGCisG
+AQQB1nkCBAMBAf8EAgUAMA0GCSqGSIb3DQEBCwUAA4ICAQBOQkva9Lsf6yNsAdE6
+S/hAaK7z/9iOkaZkKE9++aD72Wun901a7YTB8VXj5/QJz8sAkMRR/IqiTTJc4fan
+xQ2eN4cu/XF2iDWh6r47EDPHEI9ifTycfClgi1yKyIWDwYBnRukFx5gEAvTZupDL
+kpb2mnzb3zijRO9asadtrw5DyrSgbwURaJEgDSG5zFIo4mNow0f/qNVw7JGgVDfE
+601SPpwCz9Pq3G9F7iTfheCk4878vW7IcqcwZny3Bmc9Xhn5cs/WTiGFqjGvcCZV
+b8EDa5awZbKEq8HvlHMNatlbNurbZcL57wc+A0mdo9Kbsq8vlKy/KDhkc98QFiiI
+kcmNBAzxzD3mMi/dchgDDSQ/ExKEzjeZJVGTvJl7UwJJRENx2Ld+g7jrUmgz7xk8
+0bUgcr4GAMLWa7MHyR9zFJH/uRAFIPKvOshW43/AOP7Gyyk8EIx/z6K5geZduQx9
+xhw7WAsr8AbPr9cUbmU2LuFBmWU0FQ6KLw4/RvVe/PlTyidOz0IDofp5hRZHzsqG
+4B88XgQp0P4NnJWbpvfUqluT3Ku67SFh25lVOf9+NEuilSM6N5iY5HGUFXn5UD0G
+zpIhrzlRaotYcUkwgw6uW5iuaZOjw+tj3y8ZhRLalmU/W2J35ZRDZsyZKdpGhlxq
+Nx20qkdhYz/f2naib9pus/ileA==
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.validity.notBefore,SubscriberValidityPeriodValidator,ERROR,cabf.certificate_validity_period_exceeds_398_days,"Validity period of 751 days, 10:01:21 exceeds maximum value of 398 days, 0:00:00"
+certificate.tbsCertificate.subject.rdnSequence,EvSubscriberAttributeAllowanceValidator,WARNING,cabf.ev_guidelines.common_name_attribute_present,
+certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies,SubscriberPoliciesValidator,WARNING,cabf.serverauth.subscriber_first_policy_oid_not_reserved,
+certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies.2.policyQualifiers.0,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
+certificate.tbsCertificate.extensions.8.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
+certificate.tbsCertificate.extensions.9.extnValue.keyUsage,SubscriberKeyUsageValidator,WARNING,cabf.serverauth.subscriber_rsa_digitalsignature_and_keyencipherment_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.subject_key_identifier_extension_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 1.3.6.1.5.5.7.1.3
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 2.23.140.3.1
+certificate.tbsCertificate.validity.notBefore,SubscriberValidityPeriodValidator,ERROR,cabf.certificate_validity_period_exceeds_398_days,"Validity period of 751 days, 10:01:21 exceeds maximum value of 398 days, 0:00:00"
diff --git a/tests/integration_certificate/etsi/qevcp_w_psd2_eidas_pre_certificate/validity_period_too_long_with_psd2_policy.crttest b/tests/integration_certificate/etsi/qevcp_w_psd2_eidas_pre_certificate/validity_period_too_long_with_psd2_policy.crttest
new file mode 100644
index 0000000..1a5b4fb
--- /dev/null
+++ b/tests/integration_certificate/etsi/qevcp_w_psd2_eidas_pre_certificate/validity_period_too_long_with_psd2_policy.crttest
@@ -0,0 +1,55 @@
+-----BEGIN CERTIFICATE-----
+MIIHyjCCBbKgAwIBAgIUaHFoHojMlU3qa6adMxyvPxlyg2UwDQYJKoZIhvcNAQEL
+BQAwVzELMAkGA1UEBhMCTkwxIDAeBgNVBAoMF1F1b1ZhZGlzIFRydXN0bGluayBC
+LlYuMSYwJAYDVQQDDB1RdW9WYWRpcyBRdWFsaWZpZWQgV2ViIElDQSBHMjAeFw0y
+MzA5MDYxMzQzNDBaFw0yNTA5MjYyMzQ1MDBaMIHEMRMwEQYLKwYBBAGCNzwCAQMT
+Ak5MMR0wGwYDVQQPDBRQcml2YXRlIE9yZ2FuaXphdGlvbjERMA8GA1UEBRMINjAz
+ODUwMTQxCzAJBgNVBAYTAk5MMRAwDgYDVQQIDAdVdHJlY2h0MRAwDgYDVQQHDAdV
+dHJlY2h0MRowGAYDVQRhDBFQU0ROTC1ETkItUjE2MTE2MjEXMBUGA1UECgwOTW9u
+ZXlNb25rIEIuVi4xFTATBgNVBAMMDG1vbmV5bW9uay5ubDCCASIwDQYJKoZIhvcN
+AQEBBQADggEPADCCAQoCggEBAMPTtcvEnft2QdRWGwj/ga0GcJJHiLtwbrzFfqVv
+Vk+bOjFAqDDFT+GtKbKVmbAS0z8t5W5dbUAtPrTgPmHky5Xfw9ZEGQ2KYMYAXyrl
+0aXcvYbtgILEhEW+zmfqM2wIY/X4Yf+nK0AQfZTGxu4KqC8nTP9pDxgRkEeuvUhl
+NCGK58J/NfREGwzJeWFWB9vqf72AKj06/2utpG3XLoQ5mAl146pY+Y9X4kKE6dfk
+82m3B0JnGfYF6qn4ZmTjl2ht5p+8678WvJj4kcKDORO+k/oeyouNnct1dHSKbL+D
+kUNqHqXPTAkqJsBcC0Z5hoWbYGxMzsBupSdbrNHbZ3yIF4ECAwEAAaOCAx4wggMa
+MB8GA1UdIwQYMBaAFLzrXvvYDeiCroZGvTt8sm/RLH8KMIGFBggrBgEFBQcBAQR5
+MHcwSQYIKwYBBQUHMAKGPWh0dHA6Ly90cnVzdC5xdW92YWRpc2dsb2JhbC5jb20v
+cXVvdmFkaXNxdWFsaWZpZWR3ZWJpY2FnMi5jcnQwKgYIKwYBBQUHMAGGHmh0dHA6
+Ly9vY3NwLnF1b3ZhZGlzZ2xvYmFsLmNvbTBgBgNVHREEWTBXggxtb25leW1vbmsu
+bmyCEGFwcC5tb25leW1vbmsubmyCEHd3dy5tb25leW1vbmsubmyCEGFwaS5tb25l
+eW1vbmsubmyCEXBzZDIubW9uZXltb25rLm5sMH8GA1UdIAR4MHYwCQYHBACL7EAB
+BDAJBgcEAIGYJwMBMA4GDCsGAQQBvlgAAmQBAjBFBgorBgEEAb5YAYNCMDcwNQYI
+KwYBBQUHAgEWKWh0dHBzOi8vd3d3LnF1b3ZhZGlzZ2xvYmFsLmNvbS9yZXBvc2l0
+b3J5MAcGBWeBDAEBMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATCBtwYI
+KwYBBQUHAQMEgaowgacwCgYIKwYBBQUHCwIwCAYGBACORgEBMBMGBgQAjkYBBjAJ
+BgcEAI5GAQYDMDsGBgQAjkYBBTAxMC8WKWh0dHBzOi8vd3d3LnF1b3ZhZGlzZ2xv
+YmFsLmNvbS9yZXBvc2l0b3J5EwJlbjA9BgYEAIGYJwIwMzATMBEGBwQAgZgnAQMM
+BlBTUF9BSQwUVGhlIE5ldGhlcmxhbmRzIEJhbmsMBk5MLUROQjAhBgVngQwDAQQY
+MBYTA1BTRBMCTkwMC0ROQi1SMTYxMTYyMEwGA1UdHwRFMEMwQaA/oD2GO2h0dHA6
+Ly9jcmwucXVvdmFkaXNnbG9iYWwuY29tL3F1b3ZhZGlzcXVhbGlmaWVkd2ViaWNh
+ZzIuY3JsMB0GA1UdDgQWBBQj/QN72MyBXjUc0ffvASf6sNCXxTAOBgNVHQ8BAf8E
+BAMCBaAwEwYKKwYBBAHWeQIEAwEB/wQCBQAwDQYJKoZIhvcNAQELBQADggIBAE5C
+S9r0ux/rI2wB0TpL+EBorvP/2I6RpmQoT375oPvZa6f3TVrthMHxVePn9AnPywCQ
+xFH8iqJNMlzh9qfFDZ43hy79cXaINaHqvjsQM8cQj2J9PJx8KWCLXIrIhYPBgGdG
+6QXHmAQC9Nm6kMuSlvaafNvfOKNE71qxp22vDkPKtKBvBRFokSANIbnMUijiY2jD
+R/+o1XDskaBUN8TrTVI+nALP0+rcb0XuJN+F4KTjzvy9bshypzBmfLcGZz1eGfly
+z9ZOIYWqMa9wJlVvwQNrlrBlsoSrwe+Ucw1q2Vs26ttlwvnvBz4DSZ2j0puyry+U
+rL8oOGRz3xAWKIiRyY0EDPHMPeYyL91yGAMNJD8TEoTON5klUZO8mXtTAklEQ3HY
+t36DuOtSaDPvGTzRtSByvgYAwtZrswfJH3MUkf+5EAUg8q86yFbjf8A4/sbLKTwQ
+jH/PormB5l25DH3GHDtYCyvwBs+v1xRuZTYu4UGZZTQVDoovDj9G9V78+VPKJ07P
+QgOh+nmFFkfOyobgHzxeBCnQ/g2clZum99SqW5Pcq7rtIWHbmVU5/340S6KVIzo3
+mJjkcZQVeflQPQbOkiGvOVFqi1hxSTCDDq5bmK5pk6PD62PfLxmFEtqWZT9bYnfl
+lENmzJkp2kaGXGo3HbSqR2FjP9/adqJv2m6z+KV4
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.validity.notBefore,SubscriberValidityPeriodValidator,ERROR,cabf.certificate_validity_period_exceeds_398_days,"Validity period of 751 days, 10:01:21 exceeds maximum value of 398 days, 0:00:00"
+certificate.tbsCertificate.subject.rdnSequence,EvSubscriberAttributeAllowanceValidator,WARNING,cabf.ev_guidelines.common_name_attribute_present,
+certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies,SubscriberPoliciesValidator,WARNING,cabf.serverauth.subscriber_first_policy_oid_not_reserved,
+certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies.3.policyQualifiers.0,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
+certificate.tbsCertificate.extensions.8.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
+certificate.tbsCertificate.extensions.9.extnValue.keyUsage,SubscriberKeyUsageValidator,WARNING,cabf.serverauth.subscriber_rsa_digitalsignature_and_keyencipherment_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.subject_key_identifier_extension_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 1.3.6.1.5.5.7.1.3
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 2.23.140.3.1
diff --git a/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_final_certificate/bad_ecdsa_curve.crttest b/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_final_certificate/bad_ecdsa_curve.crttest
new file mode 100644
index 0000000..5ca3a59
--- /dev/null
+++ b/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_final_certificate/bad_ecdsa_curve.crttest
@@ -0,0 +1,42 @@
+-----BEGIN CERTIFICATE-----
+MIIF8DCCBZWgAwIBAgIOAn2jtGjQ0XIDSuG2eQowCgYIKoZIzj0EAwIwejELMAkG
+A1UEBhMCSFUxETAPBgNVBAcMCEJ1ZGFwZXN0MRYwFAYDVQQKDA1NaWNyb3NlYyBM
+dGQuMRcwFQYDVQRhDA5WQVRIVS0yMzU4NDQ5NzEnMCUGA1UEAwweZS1Temlnbm8g
+UXVhbGlmaWVkIFRMUyBDQSAyMDE4MB4XDTI0MDQzMDE0MDAxMloXDTI0MDUxMDE0
+MDAxMVowgasxEzARBgsrBgEEAYI3PAIBAxMCSFUxHTAbBgNVBA8MFFByaXZhdGUg
+T3JnYW5pemF0aW9uMRUwEwYDVQQFEwwwMS0xMC0wNDcyMTgxCzAJBgNVBAYTAkhV
+MREwDwYDVQQHDAhCdWRhcGVzdDEWMBQGA1UECgwNTWljcm9zZWMgTHRkLjEmMCQG
+A1UEAwwdZXF0bHNjYTIwMTgtdmFsaWQuZS1zemlnbm8uaHUwWTATBgcqhkjOPQIB
+BggqhkjOPQMBDANCAAT6WJ1pvxSfy8QSn2Soe3G8fB7If5XmEZyk6XxwVU2nMYTc
+M8WHDNROTX19TCt0BtcAAUJ/krcWdx/GUKSdwnUGo4IDyzCCA8cwDgYDVR0PAQH/
+BAQDAgOIMBMGCisGAQQB1nkCBAMBAf8EAgUAMB0GA1UdJQQWMBQGCCsGAQUFBwMC
+BggrBgEFBQcDATBYBgNVHSAEUTBPMAcGBWeBDAEBMAkGBwQAi+xAAQQwOQYNKwYB
+BAGBqBgCAQGBKjAoMCYGCCsGAQUFBwIBFhpodHRwOi8vY3AuZS1zemlnbm8uaHUv
+cWNwczAdBgNVHQ4EFgQUbBS7vo72MFT0KTXHGiyafMbtdeswHwYDVR0jBBgwFoAU
+2Y0YuKwjtjuMF8nrbrkXAGkNoIwwKAYDVR0RBCEwH4IdZXF0bHNjYTIwMTgtdmFs
+aWQuZS1zemlnbm8uaHUwgbwGA1UdHwSBtDCBsTA5oDegNYYzaHR0cDovL2VxdGxz
+Y2EyMDE4LWNybDEuZS1zemlnbm8uaHUvZXF0bHNjYTIwMTguY3JsMDmgN6A1hjNo
+dHRwOi8vZXF0bHNjYTIwMTgtY3JsMi5lLXN6aWduby5odS9lcXRsc2NhMjAxOC5j
+cmwwOaA3oDWGM2h0dHA6Ly9lcXRsc2NhMjAxOC1jcmwzLmUtc3ppZ25vLmh1L2Vx
+dGxzY2EyMDE4LmNybDCCAWgGCCsGAQUFBwEBBIIBWjCCAVYwMAYIKwYBBQUHMAGG
+JGh0dHA6Ly9lcXRsc2NhMjAxOC1vY3NwMS5lLXN6aWduby5odTAwBggrBgEFBQcw
+AYYkaHR0cDovL2VxdGxzY2EyMDE4LW9jc3AyLmUtc3ppZ25vLmh1MDAGCCsGAQUF
+BzABhiRodHRwOi8vZXF0bHNjYTIwMTgtb2NzcDMuZS1zemlnbm8uaHUwPgYIKwYB
+BQUHMAKGMmh0dHA6Ly9lcXRsc2NhMjAxOC1jYTEuZS1zemlnbm8uaHUvZXF0bHNj
+YTIwMTguY3J0MD4GCCsGAQUFBzAChjJodHRwOi8vZXF0bHNjYTIwMTgtY2EyLmUt
+c3ppZ25vLmh1L2VxdGxzY2EyMDE4LmNydDA+BggrBgEFBQcwAoYyaHR0cDovL2Vx
+dGxzY2EyMDE4LWNhMy5lLXN6aWduby5odS9lcXRsc2NhMjAxOC5jcnQwgZEGCCsG
+AQUFBwEDBIGEMIGBMAgGBgQAjkYBATALBgYEAI5GAQMCAQowUwYGBACORgEFMEkw
+JBYeaHR0cHM6Ly9jcC5lLXN6aWduby5odS9xY3BzX2VuEwJlbjAhFhtodHRwczov
+L2NwLmUtc3ppZ25vLmh1L3FjcHMTAmh1MBMGBgQAjkYBBjAJBgcEAI5GAQYDMAoG
+CCqGSM49BAMCA0kAMEYCIQDEeYuKo1y3nwSPY23+vVI/1uxCspzoZTgYuEoD2Fa1
+DQIhAOdyCCGlfNPUNS7q+8JpiFFIPB1DEXUmydXmXBYshBHm
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.extensions.0.extnValue.keyUsage,LegalPersonKeyUsageValidator,WARNING,etsi.en_319_412_2.nat-4.3.2-1.mixed_key_usage_setting,
+certificate.tbsCertificate.subject.rdnSequence,LegalPersonSubjectAttributeAllowanceValidator,ERROR,etsi.en_319_412_3.leg-4.2.1-2.organization_identifier_attribute_absent,
+certificate.tbsCertificate.subjectPublicKeyInfo.algorithm,AllowedPublicKeyTypeValidator,NOTICE,etsi.en_319_412_2.gen-4.2.5-1.discouraged_public_key_type,Prohibited encoding: 301306072a8648ce3d020106082a8648ce3d03010c
+certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies.2,CertificatePolicyQualifierValidator,NOTICE,pkix.certificate_policies_policy_has_qualifier,
+certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies,QualifiedCertificatePoliciesValidator,ERROR,etsi.en_319_412_2.qcs-5.2-2.mismatched_policy_identifier_for_certificate_type,"Certificate type is QNCP_W_GEN_LEGAL_PERSON_EIDAS_FINAL_CERTIFICATE (0.4.0.194112.1.6) but certificate contains certificate type policy identifier ""0.4.0.194112.1.4"""
+certificate.tbsCertificate.extensions.4.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
diff --git a/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_final_certificate/clean.crttest b/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_final_certificate/clean.crttest
new file mode 100644
index 0000000..3952d88
--- /dev/null
+++ b/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_final_certificate/clean.crttest
@@ -0,0 +1,44 @@
+-----BEGIN CERTIFICATE-----
+MIIHMTCCBRmgAwIBAgIQVZHNRxiZp9LoR1nlajD1DDANBgkqhkiG9w0BAQsFADCB
+oTELMAkGA1UEBhMCR1IxNjA0BgNVBAoTLUhFTExFTklDIEVYQ0hBTkdFUyAtIEFU
+SEVOUyBTVE9DSyBFWENIQU5HRSBTQTEvMC0GA1UEAxMmQVRIRVggUXVhbGlmaWVk
+IFdFQiBDZXJ0aWZpY2F0ZXMgQ0EtRzMxDzANBgNVBAcTBkF0aGVuczEYMBYGA1UE
+YRMPVkFURUwtMDk5NzU1MTA4MB4XDTI0MDQxMTE0MTY1NVoXDTI1MDQxMTE0MTY1
+NVowgcMxCzAJBgNVBAYTAkdSMTYwNAYDVQQKEy1IRUxMRU5JQyBFWENIQU5HRVMg
+LSBBVEhFTlMgU1RPQ0sgRVhDSEFOR0UgU0ExGDAWBgNVBGETD1ZBVEVMLTA5OTc1
+NTEwODEdMBsGA1UEAxMUd2ViZHNzLmF0aGV4Z3JvdXAuZ3IxDzANBgNVBAcTBkF0
+aGVuczETMBEGCysGAQQBgjc8AgEDEwJHUjEdMBsGA1UEDxMUUHJpdmF0ZSBPcmdh
+bml6YXRpb24wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC4IRER3+RS
+dMkB84htWhzmrcFTqJ47yJtZAgvDxw0aWYWVtyW2SMtygVUZSfp5ewE8OA9tdCa6
+oIuap6hKgZpQnkxS9RP0JRyHrJjxOc4sUUtbOHMCV5hq4Lkonh01DAsad9tVqR4n
+aUSHsPI8v+93fjigi3vBsf5nGeBRrCTBYs8IKqoCC+Z2WWbwRCB6ct+ODsqbLwRx
+T54WY9iTaCNc/71rUlvIo3nkd/H17MCkoBdv4Ec3NG1Jo18FnkATyM12Xzhet+Wv
+vx0yjewRrFxak/wGZ4GGX1Dzy4wHfsceQjAtiZk2oWcn3/mk6oVA0ynF2a/4CmT1
+OZiWGOTqNnxTAgMBAAGjggI/MIICOzAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYB
+BQUHAwIwHwYDVR0jBBgwFoAUIpkkVwZsVnWO2+t9eWWcUzWp0ZEwLQYIKwYBBQUH
+AQMEITAfMAgGBgQAjkYBATATBgYEAI5GAQYwCQYHBACORgEGAzCBlwYIKwYBBQUH
+AQEEgYowgYcwOAYIKwYBBQUHMAGGLGh0dHA6Ly9vY3NwLmF0aGV4Z3JvdXAuZ3Iv
+QXRoZXhRdWFsaWZpZWRDQUczMEsGCCsGAQUFBzAChj9odHRwOi8vcmVwby5hdGhl
+eGdyb3VwLmdyL0FUSEVYUXVhbGlmaWVkV0VCQ2VydGlmaWNhdGVzQ0FHMy5jcnQw
+JQYDVR0gBB4wHDAPBg0rBgEEAYHlWgEDZAEEMAkGBwQAi+xAAQYwTwYDVR0fBEgw
+RjBEoEKgQIY+aHR0cDovL2NybC5hdGhleGdyb3VwLmdyL0FUSEVYUXVhbGlmaWVk
+V0VCQ2VydGlmaWNhdGVzQ0FHMy5jcmwwHQYDVR0OBBYEFNO1Ri+h7gAw1BnwJi1m
+HFV+L6htMA4GA1UdDwEB/wQEAwIHgDB7BgNVHREEdDByghR3ZWJkc3MuYXRoZXhn
+cm91cC5ncoIYd2ViZHNzbW9jay5hdGhleGdyb3VwLmdyghp3ZWJkc3MtcnB4cjEu
+aW5ldC5oZWxleC5ncoIPZHNzLmF0aGV4bmV0LmdyghNkc3Ntb2NrLmF0aGV4bmV0
+LmdyMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADggIBAJl4huEpr01gxqGh
+FzkCbhZYW48Bv+zGQodfBnhISH5Dj9Apb2pUCJiPIGy6NQ3nHygyy1y2aW+1ExrZ
+6ZCmtmw2/isk8q9wKa4PS/ip1+IzOin67XmYAz+t03MRl569wtzH+WPL2hb5Zmsw
+AkTP6/N9Jp1I9cryvHO2ZCEYZreWtgvJQaDBQ/qteUKnVNLyuJle9hAYvsWEbgIO
+xlWaDzPnWYYjZuXbyowImmjhufFyrJ2ngwwgw1sI0Se5vGOWWj+i/KBqLbwpp11I
+yXAJkhNTJVxI5B7BpAqoMGOlqf4w4eCqU/HUKL9ZIOHSClPTzaXS45ppPyb+zzLB
+u4vt0PJTAh3wnujcRZ3NxmetsehqunSpyKg0MzL2FDpxD31XHzmlpq5hQGgX1QF3
+0Wl3IADw5JzT4ApHW4ucsLr22HJBTnFab/tbviqg2HcVDAksUqZbPqNCenN/BW3J
+rhXwewWAfHE4LnDQBlAbq95LuijvHx3MaTt8y7wPSOizYTpry19uHT0aaxXfLivh
+YnIjcWwNwowxjVLSVBK0TBvEUVF2DwDNLRfX2aSpt0rq3rxtNcjvJvwHJrDLio8y
+fSyJXu4qGbQ3OwuuJXaEPiBANUEckaPKg5pdua4Lwt708kOG54E7pzz3xLEjtODU
++9Ru72tw8lf1RlWwp5ZI+7CByD0W
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.extensions.6.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
diff --git a/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_final_certificate/clean_with_wildcard_san.crttest b/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_final_certificate/clean_with_wildcard_san.crttest
new file mode 100644
index 0000000..57830c9
--- /dev/null
+++ b/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_final_certificate/clean_with_wildcard_san.crttest
@@ -0,0 +1,44 @@
+-----BEGIN CERTIFICATE-----
+MIIHMzCCBRugAwIBAgIQVZHNRxiZp9LoR1nlajD1DDANBgkqhkiG9w0BAQsFADCB
+oTELMAkGA1UEBhMCR1IxNjA0BgNVBAoTLUhFTExFTklDIEVYQ0hBTkdFUyAtIEFU
+SEVOUyBTVE9DSyBFWENIQU5HRSBTQTEvMC0GA1UEAxMmQVRIRVggUXVhbGlmaWVk
+IFdFQiBDZXJ0aWZpY2F0ZXMgQ0EtRzMxDzANBgNVBAcTBkF0aGVuczEYMBYGA1UE
+YRMPVkFURUwtMDk5NzU1MTA4MB4XDTI0MDQxMTE0MTY1NVoXDTI1MDQxMTE0MTY1
+NVowgcMxCzAJBgNVBAYTAkdSMTYwNAYDVQQKEy1IRUxMRU5JQyBFWENIQU5HRVMg
+LSBBVEhFTlMgU1RPQ0sgRVhDSEFOR0UgU0ExGDAWBgNVBGETD1ZBVEVMLTA5OTc1
+NTEwODEdMBsGA1UEAxMUd2ViZHNzLmF0aGV4Z3JvdXAuZ3IxDzANBgNVBAcTBkF0
+aGVuczETMBEGCysGAQQBgjc8AgEDEwJHUjEdMBsGA1UEDxMUUHJpdmF0ZSBPcmdh
+bml6YXRpb24wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC4IRER3+RS
+dMkB84htWhzmrcFTqJ47yJtZAgvDxw0aWYWVtyW2SMtygVUZSfp5ewE8OA9tdCa6
+oIuap6hKgZpQnkxS9RP0JRyHrJjxOc4sUUtbOHMCV5hq4Lkonh01DAsad9tVqR4n
+aUSHsPI8v+93fjigi3vBsf5nGeBRrCTBYs8IKqoCC+Z2WWbwRCB6ct+ODsqbLwRx
+T54WY9iTaCNc/71rUlvIo3nkd/H17MCkoBdv4Ec3NG1Jo18FnkATyM12Xzhet+Wv
+vx0yjewRrFxak/wGZ4GGX1Dzy4wHfsceQjAtiZk2oWcn3/mk6oVA0ynF2a/4CmT1
+OZiWGOTqNnxTAgMBAAGjggJBMIICPTAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYB
+BQUHAwIwHwYDVR0jBBgwFoAUIpkkVwZsVnWO2+t9eWWcUzWp0ZEwLQYIKwYBBQUH
+AQMEITAfMAgGBgQAjkYBATATBgYEAI5GAQYwCQYHBACORgEGAzCBlwYIKwYBBQUH
+AQEEgYowgYcwOAYIKwYBBQUHMAGGLGh0dHA6Ly9vY3NwLmF0aGV4Z3JvdXAuZ3Iv
+QXRoZXhRdWFsaWZpZWRDQUczMEsGCCsGAQUFBzAChj9odHRwOi8vcmVwby5hdGhl
+eGdyb3VwLmdyL0FUSEVYUXVhbGlmaWVkV0VCQ2VydGlmaWNhdGVzQ0FHMy5jcnQw
+JQYDVR0gBB4wHDAPBg0rBgEEAYHlWgEDZAEEMAkGBwQAi+xAAQYwTwYDVR0fBEgw
+RjBEoEKgQIY+aHR0cDovL2NybC5hdGhleGdyb3VwLmdyL0FUSEVYUXVhbGlmaWVk
+V0VCQ2VydGlmaWNhdGVzQ0FHMy5jcmwwHQYDVR0OBBYEFNO1Ri+h7gAw1BnwJi1m
+HFV+L6htMA4GA1UdDwEB/wQEAwIHgDB9BgNVHREEdjB0ghR3ZWJkc3MuYXRoZXhn
+cm91cC5ncoIYd2ViZHNzbW9jay5hdGhleGdyb3VwLmdyghp3ZWJkc3MtcnB4cjEu
+aW5ldC5oZWxleC5ncoIPZHNzLmF0aGV4bmV0LmdyghUqLmRzc21vY2suYXRoZXhu
+ZXQuZ3IwDAYDVR0TAQH/BAIwADANBgkqhkiG9w0BAQsFAAOCAgEAmXiG4SmvTWDG
+oaEXOQJuFlhbjwG/7MZCh18GeEhIfkOP0ClvalQImI8gbLo1DecfKDLLXLZpb7UT
+GtnpkKa2bDb+KyTyr3Aprg9L+KnX4jM6KfrteZgDP63TcxGXnr3C3Mf5Y8vaFvlm
+azACRM/r830mnUj1yvK8c7ZkIRhmt5a2C8lBoMFD+q15QqdU0vK4mV72EBi+xYRu
+Ag7GVZoPM+dZhiNm5dvKjAiaaOG58XKsnaeDDCDDWwjRJ7m8Y5ZaP6L8oGotvCmn
+XUjJcAmSE1MlXEjkHsGkCqgwY6Wp/jDh4KpT8dQov1kg4dIKU9PNpdLjmmk/Jv7P
+MsG7i+3Q8lMCHfCe6NxFnc3GZ62x6Gq6dKnIqDQzMvYUOnEPfVcfOaWmrmFAaBfV
+AXfRaXcgAPDknNPgCkdbi5ywuvbYckFOcVpv+1u+KqDYdxUMCSxSpls+o0J6c38F
+bcmuFfB7BYB8cTgucNAGUBur3ku6KO8fHcxpO3zLvA9I6LNhOmvLX24dPRprFd8u
+K+FiciNxbA3CjDGNUtJUErRMG8RRUXYPAM0tF9fZpKm3SurevG01yO8m/AcmsMuK
+jzJ9LIle7ioZtDc7C64ldoQ+IEA1QRyRo8qDml25rgvC3vTyQ4bngTunPPfEsSO0
+4NT71G7va3DyV/VGVbCnlkj7sIHIPRY=
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.extensions.6.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
diff --git a/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_final_certificate/eidas_legal_person_id_too_long.crttest b/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_final_certificate/eidas_legal_person_id_too_long.crttest
new file mode 100644
index 0000000..d14c6f1
--- /dev/null
+++ b/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_final_certificate/eidas_legal_person_id_too_long.crttest
@@ -0,0 +1,51 @@
+-----BEGIN CERTIFICATE-----
+MIIIQTCCBimgAwIBAgIQVZHNRxiZp9LoR1nlajD1DDANBgkqhkiG9w0BAQsFADCB
+oTELMAkGA1UEBhMCR1IxNjA0BgNVBAoTLUhFTExFTklDIEVYQ0hBTkdFUyAtIEFU
+SEVOUyBTVE9DSyBFWENIQU5HRSBTQTEvMC0GA1UEAxMmQVRIRVggUXVhbGlmaWVk
+IFdFQiBDZXJ0aWZpY2F0ZXMgQ0EtRzMxDzANBgNVBAcTBkF0aGVuczEYMBYGA1UE
+YRMPVkFURUwtMDk5NzU1MTA4MB4XDTI0MDQxMTE0MTY1NVoXDTI1MDQxMTE0MTY1
+NVowggG7MQswCQYDVQQGEwJHUjE2MDQGA1UEChMtSEVMTEVOSUMgRVhDSEFOR0VT
+IC0gQVRIRU5TIFNUT0NLIEVYQ0hBTkdFIFNBMYIBDjCCAQoGA1UEYROCAQFhYWFh
+YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh
+YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh
+YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh
+YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh
+YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh
+YWFhYWFhYWFhYWFhYTEdMBsGA1UEAxMUd2ViZHNzLmF0aGV4Z3JvdXAuZ3IxDzAN
+BgNVBAcTBkF0aGVuczETMBEGCysGAQQBgjc8AgEDEwJHUjEdMBsGA1UEDxMUUHJp
+dmF0ZSBPcmdhbml6YXRpb24wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB
+AQC4IRER3+RSdMkB84htWhzmrcFTqJ47yJtZAgvDxw0aWYWVtyW2SMtygVUZSfp5
+ewE8OA9tdCa6oIuap6hKgZpQnkxS9RP0JRyHrJjxOc4sUUtbOHMCV5hq4Lkonh01
+DAsad9tVqR4naUSHsPI8v+93fjigi3vBsf5nGeBRrCTBYs8IKqoCC+Z2WWbwRCB6
+ct+ODsqbLwRxT54WY9iTaCNc/71rUlvIo3nkd/H17MCkoBdv4Ec3NG1Jo18FnkAT
+yM12Xzhet+Wvvx0yjewRrFxak/wGZ4GGX1Dzy4wHfsceQjAtiZk2oWcn3/mk6oVA
+0ynF2a/4CmT1OZiWGOTqNnxTAgMBAAGjggJWMIICUjAdBgNVHSUEFjAUBggrBgEF
+BQcDAQYIKwYBBQUHAwIwHwYDVR0jBBgwFoAUIpkkVwZsVnWO2+t9eWWcUzWp0ZEw
+RAYIKwYBBQUHAQMEODA2MAgGBgQAjkYBATATBgYEAI5GAQYwCQYHBACORgEGAzAV
+BggrBgEFBQcLAjAJBgcEAIvsSQEEMIGXBggrBgEFBQcBAQSBijCBhzA4BggrBgEF
+BQcwAYYsaHR0cDovL29jc3AuYXRoZXhncm91cC5nci9BdGhleFF1YWxpZmllZENB
+RzMwSwYIKwYBBQUHMAKGP2h0dHA6Ly9yZXBvLmF0aGV4Z3JvdXAuZ3IvQVRIRVhR
+dWFsaWZpZWRXRUJDZXJ0aWZpY2F0ZXNDQUczLmNydDAlBgNVHSAEHjAcMA8GDSsG
+AQQBgeVaAQNkAQQwCQYHBACL7EABBjBPBgNVHR8ESDBGMESgQqBAhj5odHRwOi8v
+Y3JsLmF0aGV4Z3JvdXAuZ3IvQVRIRVhRdWFsaWZpZWRXRUJDZXJ0aWZpY2F0ZXND
+QUczLmNybDAdBgNVHQ4EFgQU07VGL6HuADDUGfAmLWYcVX4vqG0wDgYDVR0PAQH/
+BAQDAgeAMHsGA1UdEQR0MHKCFHdlYmRzcy5hdGhleGdyb3VwLmdyghh3ZWJkc3Nt
+b2NrLmF0aGV4Z3JvdXAuZ3KCGndlYmRzcy1ycHhyMS5pbmV0LmhlbGV4Lmdygg9k
+c3MuYXRoZXhuZXQuZ3KCE2Rzc21vY2suYXRoZXhuZXQuZ3IwDAYDVR0TAQH/BAIw
+ADANBgkqhkiG9w0BAQsFAAOCAgEAmXiG4SmvTWDGoaEXOQJuFlhbjwG/7MZCh18G
+eEhIfkOP0ClvalQImI8gbLo1DecfKDLLXLZpb7UTGtnpkKa2bDb+KyTyr3Aprg9L
++KnX4jM6KfrteZgDP63TcxGXnr3C3Mf5Y8vaFvlmazACRM/r830mnUj1yvK8c7Zk
+IRhmt5a2C8lBoMFD+q15QqdU0vK4mV72EBi+xYRuAg7GVZoPM+dZhiNm5dvKjAia
+aOG58XKsnaeDDCDDWwjRJ7m8Y5ZaP6L8oGotvCmnXUjJcAmSE1MlXEjkHsGkCqgw
+Y6Wp/jDh4KpT8dQov1kg4dIKU9PNpdLjmmk/Jv7PMsG7i+3Q8lMCHfCe6NxFnc3G
+Z62x6Gq6dKnIqDQzMvYUOnEPfVcfOaWmrmFAaBfVAXfRaXcgAPDknNPgCkdbi5yw
+uvbYckFOcVpv+1u+KqDYdxUMCSxSpls+o0J6c38FbcmuFfB7BYB8cTgucNAGUBur
+3ku6KO8fHcxpO3zLvA9I6LNhOmvLX24dPRprFd8uK+FiciNxbA3CjDGNUtJUErRM
+G8RRUXYPAM0tF9fZpKm3SurevG01yO8m/AcmsMuKjzJ9LIle7ioZtDc7C64ldoQ+
+IEA1QRyRo8qDml25rgvC3vTyQ4bngTunPPfEsSO04NT71G7va3DyV/VGVbCnlkj7
+sIHIPRY=
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.subject.rdnSequence.2.0.value.x520OrganizationIdentifier,EidasLegalPersonIdentifierValidator,ERROR,etsi.en_319_412_1.leg-5.1.6-03.eidas_legal_person_identifier_too_long,"Organization identifier ""aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"" (257 characters) exceeds maximum length of 256 characters"
+certificate.tbsCertificate.extensions.6.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
diff --git a/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_final_certificate/eidas_legal_person_id_whitespace.crttest b/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_final_certificate/eidas_legal_person_id_whitespace.crttest
new file mode 100644
index 0000000..e6b5088
--- /dev/null
+++ b/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_final_certificate/eidas_legal_person_id_whitespace.crttest
@@ -0,0 +1,45 @@
+-----BEGIN CERTIFICATE-----
+MIIHSTCCBTGgAwIBAgIQVZHNRxiZp9LoR1nlajD1DDANBgkqhkiG9w0BAQsFADCB
+oTELMAkGA1UEBhMCR1IxNjA0BgNVBAoTLUhFTExFTklDIEVYQ0hBTkdFUyAtIEFU
+SEVOUyBTVE9DSyBFWENIQU5HRSBTQTEvMC0GA1UEAxMmQVRIRVggUXVhbGlmaWVk
+IFdFQiBDZXJ0aWZpY2F0ZXMgQ0EtRzMxDzANBgNVBAcTBkF0aGVuczEYMBYGA1UE
+YRMPVkFURUwtMDk5NzU1MTA4MB4XDTI0MDQxMTE0MTY1NVoXDTI1MDQxMTE0MTY1
+NVowgcQxCzAJBgNVBAYTAkdSMTYwNAYDVQQKEy1IRUxMRU5JQyBFWENIQU5HRVMg
+LSBBVEhFTlMgU1RPQ0sgRVhDSEFOR0UgU0ExGTAXBgNVBGETEFZBVEVMLTA5OTc1
+IDUxMDgxHTAbBgNVBAMTFHdlYmRzcy5hdGhleGdyb3VwLmdyMQ8wDQYDVQQHEwZB
+dGhlbnMxEzARBgsrBgEEAYI3PAIBAxMCR1IxHTAbBgNVBA8TFFByaXZhdGUgT3Jn
+YW5pemF0aW9uMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuCEREd/k
+UnTJAfOIbVoc5q3BU6ieO8ibWQILw8cNGlmFlbcltkjLcoFVGUn6eXsBPDgPbXQm
+uqCLmqeoSoGaUJ5MUvUT9CUch6yY8TnOLFFLWzhzAleYauC5KJ4dNQwLGnfbVake
+J2lEh7DyPL/vd344oIt7wbH+ZxngUawkwWLPCCqqAgvmdllm8EQgenLfjg7Kmy8E
+cU+eFmPYk2gjXP+9a1JbyKN55Hfx9ezApKAXb+BHNzRtSaNfBZ5AE8jNdl84Xrfl
+r78dMo3sEaxcWpP8BmeBhl9Q88uMB37HHkIwLYmZNqFnJ9/5pOqFQNMpxdmv+Apk
+9TmYlhjk6jZ8UwIDAQABo4ICVjCCAlIwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsG
+AQUFBwMCMB8GA1UdIwQYMBaAFCKZJFcGbFZ1jtvrfXllnFM1qdGRMEQGCCsGAQUF
+BwEDBDgwNjAIBgYEAI5GAQEwEwYGBACORgEGMAkGBwQAjkYBBgMwFQYIKwYBBQUH
+CwIwCQYHBACL7EkBBDCBlwYIKwYBBQUHAQEEgYowgYcwOAYIKwYBBQUHMAGGLGh0
+dHA6Ly9vY3NwLmF0aGV4Z3JvdXAuZ3IvQXRoZXhRdWFsaWZpZWRDQUczMEsGCCsG
+AQUFBzAChj9odHRwOi8vcmVwby5hdGhleGdyb3VwLmdyL0FUSEVYUXVhbGlmaWVk
+V0VCQ2VydGlmaWNhdGVzQ0FHMy5jcnQwJQYDVR0gBB4wHDAPBg0rBgEEAYHlWgED
+ZAEEMAkGBwQAi+xAAQYwTwYDVR0fBEgwRjBEoEKgQIY+aHR0cDovL2NybC5hdGhl
+eGdyb3VwLmdyL0FUSEVYUXVhbGlmaWVkV0VCQ2VydGlmaWNhdGVzQ0FHMy5jcmww
+HQYDVR0OBBYEFNO1Ri+h7gAw1BnwJi1mHFV+L6htMA4GA1UdDwEB/wQEAwIHgDB7
+BgNVHREEdDByghR3ZWJkc3MuYXRoZXhncm91cC5ncoIYd2ViZHNzbW9jay5hdGhl
+eGdyb3VwLmdyghp3ZWJkc3MtcnB4cjEuaW5ldC5oZWxleC5ncoIPZHNzLmF0aGV4
+bmV0LmdyghNkc3Ntb2NrLmF0aGV4bmV0LmdyMAwGA1UdEwEB/wQCMAAwDQYJKoZI
+hvcNAQELBQADggIBAJl4huEpr01gxqGhFzkCbhZYW48Bv+zGQodfBnhISH5Dj9Ap
+b2pUCJiPIGy6NQ3nHygyy1y2aW+1ExrZ6ZCmtmw2/isk8q9wKa4PS/ip1+IzOin6
+7XmYAz+t03MRl569wtzH+WPL2hb5ZmswAkTP6/N9Jp1I9cryvHO2ZCEYZreWtgvJ
+QaDBQ/qteUKnVNLyuJle9hAYvsWEbgIOxlWaDzPnWYYjZuXbyowImmjhufFyrJ2n
+gwwgw1sI0Se5vGOWWj+i/KBqLbwpp11IyXAJkhNTJVxI5B7BpAqoMGOlqf4w4eCq
+U/HUKL9ZIOHSClPTzaXS45ppPyb+zzLBu4vt0PJTAh3wnujcRZ3NxmetsehqunSp
+yKg0MzL2FDpxD31XHzmlpq5hQGgX1QF30Wl3IADw5JzT4ApHW4ucsLr22HJBTnFa
+b/tbviqg2HcVDAksUqZbPqNCenN/BW3JrhXwewWAfHE4LnDQBlAbq95LuijvHx3M
+aTt8y7wPSOizYTpry19uHT0aaxXfLivhYnIjcWwNwowxjVLSVBK0TBvEUVF2DwDN
+LRfX2aSpt0rq3rxtNcjvJvwHJrDLio8yfSyJXu4qGbQ3OwuuJXaEPiBANUEckaPK
+g5pdua4Lwt708kOG54E7pzz3xLEjtODU+9Ru72tw8lf1RlWwp5ZI+7CByD0W
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.subject.rdnSequence.2.0.value.x520OrganizationIdentifier,EidasLegalPersonIdentifierValidator,ERROR,etsi.en_319_412_1.leg-5.1.6-03.eidas_legal_person_identifier_whitespace_present,"Whitespace present in organization identifier: ""VATEL-09975 5108"""
+certificate.tbsCertificate.extensions.6.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
diff --git a/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_final_certificate/eidas_natural_person_id.crttest b/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_final_certificate/eidas_natural_person_id.crttest
new file mode 100644
index 0000000..1486a31
--- /dev/null
+++ b/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_final_certificate/eidas_natural_person_id.crttest
@@ -0,0 +1,50 @@
+-----BEGIN CERTIFICATE-----
+MIIIWzCCBkOgAwIBAgIQVZHNRxiZp9LoR1nlajD1DDANBgkqhkiG9w0BAQsFADCB
+oTELMAkGA1UEBhMCR1IxNjA0BgNVBAoTLUhFTExFTklDIEVYQ0hBTkdFUyAtIEFU
+SEVOUyBTVE9DSyBFWENIQU5HRSBTQTEvMC0GA1UEAxMmQVRIRVggUXVhbGlmaWVk
+IFdFQiBDZXJ0aWZpY2F0ZXMgQ0EtRzMxDzANBgNVBAcTBkF0aGVuczEYMBYGA1UE
+YRMPVkFURUwtMDk5NzU1MTA4MB4XDTI0MDQxMTE0MTY1NVoXDTI1MDQxMTE0MTY1
+NVowggHVMQswCQYDVQQGEwJHUjE2MDQGA1UEChMtSEVMTEVOSUMgRVhDSEFOR0VT
+IC0gQVRIRU5TIFNUT0NLIEVYQ0hBTkdFIFNBMYIBDjCCAQoGA1UEYROCAQFhYWFh
+YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh
+YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh
+YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh
+YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh
+YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh
+YWFhYWFhYWFhYWFhYTEdMBsGA1UEAxMUd2ViZHNzLmF0aGV4Z3JvdXAuZ3IxDzAN
+BgNVBAcTBkF0aGVuczETMBEGCysGAQQBgjc8AgEDEwJHUjEYMBYGA1UEBRMPRVMv
+QVQvMDI2MzU1NDJZMR0wGwYDVQQPExRQcml2YXRlIE9yZ2FuaXphdGlvbjCCASIw
+DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALghERHf5FJ0yQHziG1aHOatwVOo
+njvIm1kCC8PHDRpZhZW3JbZIy3KBVRlJ+nl7ATw4D210Jrqgi5qnqEqBmlCeTFL1
+E/QlHIesmPE5zixRS1s4cwJXmGrguSieHTUMCxp321WpHidpRIew8jy/73d+OKCL
+e8Gx/mcZ4FGsJMFizwgqqgIL5nZZZvBEIHpy344OypsvBHFPnhZj2JNoI1z/vWtS
+W8ijeeR38fXswKSgF2/gRzc0bUmjXwWeQBPIzXZfOF635a+/HTKN7BGsXFqT/AZn
+gYZfUPPLjAd+xx5CMC2JmTahZyff+aTqhUDTKcXZr/gKZPU5mJYY5Oo2fFMCAwEA
+AaOCAlYwggJSMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAfBgNVHSME
+GDAWgBQimSRXBmxWdY7b6315ZZxTNanRkTBEBggrBgEFBQcBAwQ4MDYwCAYGBACO
+RgEBMBMGBgQAjkYBBjAJBgcEAI5GAQYDMBUGCCsGAQUFBwsCMAkGBwQAi+xJAQMw
+gZcGCCsGAQUFBwEBBIGKMIGHMDgGCCsGAQUFBzABhixodHRwOi8vb2NzcC5hdGhl
+eGdyb3VwLmdyL0F0aGV4UXVhbGlmaWVkQ0FHMzBLBggrBgEFBQcwAoY/aHR0cDov
+L3JlcG8uYXRoZXhncm91cC5nci9BVEhFWFF1YWxpZmllZFdFQkNlcnRpZmljYXRl
+c0NBRzMuY3J0MCUGA1UdIAQeMBwwDwYNKwYBBAGB5VoBA2QBBDAJBgcEAIvsQAEG
+ME8GA1UdHwRIMEYwRKBCoECGPmh0dHA6Ly9jcmwuYXRoZXhncm91cC5nci9BVEhF
+WFF1YWxpZmllZFdFQkNlcnRpZmljYXRlc0NBRzMuY3JsMB0GA1UdDgQWBBTTtUYv
+oe4AMNQZ8CYtZhxVfi+obTAOBgNVHQ8BAf8EBAMCB4AwewYDVR0RBHQwcoIUd2Vi
+ZHNzLmF0aGV4Z3JvdXAuZ3KCGHdlYmRzc21vY2suYXRoZXhncm91cC5ncoIad2Vi
+ZHNzLXJweHIxLmluZXQuaGVsZXguZ3KCD2Rzcy5hdGhleG5ldC5ncoITZHNzbW9j
+ay5hdGhleG5ldC5ncjAMBgNVHRMBAf8EAjAAMA0GCSqGSIb3DQEBCwUAA4ICAQCZ
+eIbhKa9NYMahoRc5Am4WWFuPAb/sxkKHXwZ4SEh+Q4/QKW9qVAiYjyBsujUN5x8o
+MstctmlvtRMa2emQprZsNv4rJPKvcCmuD0v4qdfiMzop+u15mAM/rdNzEZeevcLc
+x/ljy9oW+WZrMAJEz+vzfSadSPXK8rxztmQhGGa3lrYLyUGgwUP6rXlCp1TS8riZ
+XvYQGL7FhG4CDsZVmg8z51mGI2bl28qMCJpo4bnxcqydp4MMIMNbCNEnubxjllo/
+ovygai28KaddSMlwCZITUyVcSOQewaQKqDBjpan+MOHgqlPx1Ci/WSDh0gpT082l
+0uOaaT8m/s8ywbuL7dDyUwId8J7o3EWdzcZnrbHoarp0qcioNDMy9hQ6cQ99Vx85
+paauYUBoF9UBd9FpdyAA8OSc0+AKR1uLnLC69thyQU5xWm/7W74qoNh3FQwJLFKm
+Wz6jQnpzfwVtya4V8HsFgHxxOC5w0AZQG6veS7oo7x8dzGk7fMu8D0jos2E6a8tf
+bh09GmsV3y4r4WJyI3FsDcKMMY1S0lQStEwbxFFRdg8AzS0X19mkqbdK6t68bTXI
+7yb8Byawy4qPMn0siV7uKhm0NzsLriV2hD4gQDVBHJGjyoOaXbmuC8Le9PJDhueB
+O6c898SxI7Tg1PvUbu9rcPJX9UZVsKeWSPuwgcg9Fg==
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.extensions.6.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
diff --git a/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_final_certificate/eidas_natural_person_id_invalid_serial.crttest b/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_final_certificate/eidas_natural_person_id_invalid_serial.crttest
new file mode 100644
index 0000000..c4f5981
--- /dev/null
+++ b/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_final_certificate/eidas_natural_person_id_invalid_serial.crttest
@@ -0,0 +1,51 @@
+-----BEGIN CERTIFICATE-----
+MIIIUjCCBjqgAwIBAgIQVZHNRxiZp9LoR1nlajD1DDANBgkqhkiG9w0BAQsFADCB
+oTELMAkGA1UEBhMCR1IxNjA0BgNVBAoTLUhFTExFTklDIEVYQ0hBTkdFUyAtIEFU
+SEVOUyBTVE9DSyBFWENIQU5HRSBTQTEvMC0GA1UEAxMmQVRIRVggUXVhbGlmaWVk
+IFdFQiBDZXJ0aWZpY2F0ZXMgQ0EtRzMxDzANBgNVBAcTBkF0aGVuczEYMBYGA1UE
+YRMPVkFURUwtMDk5NzU1MTA4MB4XDTI0MDQxMTE0MTY1NVoXDTI1MDQxMTE0MTY1
+NVowggHMMQswCQYDVQQGEwJHUjE2MDQGA1UEChMtSEVMTEVOSUMgRVhDSEFOR0VT
+IC0gQVRIRU5TIFNUT0NLIEVYQ0hBTkdFIFNBMYIBDjCCAQoGA1UEYROCAQFhYWFh
+YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh
+YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh
+YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh
+YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh
+YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh
+YWFhYWFhYWFhYWFhYTEdMBsGA1UEAxMUd2ViZHNzLmF0aGV4Z3JvdXAuZ3IxDzAN
+BgNVBAcTBkF0aGVuczETMBEGCysGAQQBgjc8AgEDEwJHUjEPMA0GA1UEBRMGWlgt
+QVQtMR0wGwYDVQQPExRQcml2YXRlIE9yZ2FuaXphdGlvbjCCASIwDQYJKoZIhvcN
+AQEBBQADggEPADCCAQoCggEBALghERHf5FJ0yQHziG1aHOatwVOonjvIm1kCC8PH
+DRpZhZW3JbZIy3KBVRlJ+nl7ATw4D210Jrqgi5qnqEqBmlCeTFL1E/QlHIesmPE5
+zixRS1s4cwJXmGrguSieHTUMCxp321WpHidpRIew8jy/73d+OKCLe8Gx/mcZ4FGs
+JMFizwgqqgIL5nZZZvBEIHpy344OypsvBHFPnhZj2JNoI1z/vWtSW8ijeeR38fXs
+wKSgF2/gRzc0bUmjXwWeQBPIzXZfOF635a+/HTKN7BGsXFqT/AZngYZfUPPLjAd+
+xx5CMC2JmTahZyff+aTqhUDTKcXZr/gKZPU5mJYY5Oo2fFMCAwEAAaOCAlYwggJS
+MB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAfBgNVHSMEGDAWgBQimSRX
+BmxWdY7b6315ZZxTNanRkTBEBggrBgEFBQcBAwQ4MDYwCAYGBACORgEBMBMGBgQA
+jkYBBjAJBgcEAI5GAQYDMBUGCCsGAQUFBwsCMAkGBwQAi+xJAQMwgZcGCCsGAQUF
+BwEBBIGKMIGHMDgGCCsGAQUFBzABhixodHRwOi8vb2NzcC5hdGhleGdyb3VwLmdy
+L0F0aGV4UXVhbGlmaWVkQ0FHMzBLBggrBgEFBQcwAoY/aHR0cDovL3JlcG8uYXRo
+ZXhncm91cC5nci9BVEhFWFF1YWxpZmllZFdFQkNlcnRpZmljYXRlc0NBRzMuY3J0
+MCUGA1UdIAQeMBwwDwYNKwYBBAGB5VoBA2QBBDAJBgcEAIvsQAEGME8GA1UdHwRI
+MEYwRKBCoECGPmh0dHA6Ly9jcmwuYXRoZXhncm91cC5nci9BVEhFWFF1YWxpZmll
+ZFdFQkNlcnRpZmljYXRlc0NBRzMuY3JsMB0GA1UdDgQWBBTTtUYvoe4AMNQZ8CYt
+ZhxVfi+obTAOBgNVHQ8BAf8EBAMCB4AwewYDVR0RBHQwcoIUd2ViZHNzLmF0aGV4
+Z3JvdXAuZ3KCGHdlYmRzc21vY2suYXRoZXhncm91cC5ncoIad2ViZHNzLXJweHIx
+LmluZXQuaGVsZXguZ3KCD2Rzcy5hdGhleG5ldC5ncoITZHNzbW9jay5hdGhleG5l
+dC5ncjAMBgNVHRMBAf8EAjAAMA0GCSqGSIb3DQEBCwUAA4ICAQCZeIbhKa9NYMah
+oRc5Am4WWFuPAb/sxkKHXwZ4SEh+Q4/QKW9qVAiYjyBsujUN5x8oMstctmlvtRMa
+2emQprZsNv4rJPKvcCmuD0v4qdfiMzop+u15mAM/rdNzEZeevcLcx/ljy9oW+WZr
+MAJEz+vzfSadSPXK8rxztmQhGGa3lrYLyUGgwUP6rXlCp1TS8riZXvYQGL7FhG4C
+DsZVmg8z51mGI2bl28qMCJpo4bnxcqydp4MMIMNbCNEnubxjllo/ovygai28Kadd
+SMlwCZITUyVcSOQewaQKqDBjpan+MOHgqlPx1Ci/WSDh0gpT082l0uOaaT8m/s8y
+wbuL7dDyUwId8J7o3EWdzcZnrbHoarp0qcioNDMy9hQ6cQ99Vx85paauYUBoF9UB
+d9FpdyAA8OSc0+AKR1uLnLC69thyQU5xWm/7W74qoNh3FQwJLFKmWz6jQnpzfwVt
+ya4V8HsFgHxxOC5w0AZQG6veS7oo7x8dzGk7fMu8D0jos2E6a8tfbh09GmsV3y4r
+4WJyI3FsDcKMMY1S0lQStEwbxFFRdg8AzS0X19mkqbdK6t68bTXI7yb8Byawy4qP
+Mn0siV7uKhm0NzsLriV2hD4gQDVBHJGjyoOaXbmuC8Le9PJDhueBO6c898SxI7Tg
+1PvUbu9rcPJX9UZVsKeWSPuwgcg9Fg==
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.subject.rdnSequence.6.0.value.x520SerialNumber,NaturalPersonEidasIdentifierValidator,ERROR,etsi.nat_5.1.5-03.invalid_syntax_serial,Invalid serial number syntax (needs more characters).
+certificate.tbsCertificate.extensions.6.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
diff --git a/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_final_certificate/eidas_natural_person_id_valid_length_hyphen_invalid_iso.crttest b/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_final_certificate/eidas_natural_person_id_valid_length_hyphen_invalid_iso.crttest
new file mode 100644
index 0000000..8659ae8
--- /dev/null
+++ b/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_final_certificate/eidas_natural_person_id_valid_length_hyphen_invalid_iso.crttest
@@ -0,0 +1,53 @@
+-----BEGIN CERTIFICATE-----
+MIIIVjCCBj6gAwIBAgIQVZHNRxiZp9LoR1nlajD1DDANBgkqhkiG9w0BAQsFADCB
+oTELMAkGA1UEBhMCR1IxNjA0BgNVBAoTLUhFTExFTklDIEVYQ0hBTkdFUyAtIEFU
+SEVOUyBTVE9DSyBFWENIQU5HRSBTQTEvMC0GA1UEAxMmQVRIRVggUXVhbGlmaWVk
+IFdFQiBDZXJ0aWZpY2F0ZXMgQ0EtRzMxDzANBgNVBAcTBkF0aGVuczEYMBYGA1UE
+YRMPVkFURUwtMDk5NzU1MTA4MB4XDTI0MDQxMTE0MTY1NVoXDTI1MDQxMTE0MTY1
+NVowggHQMQswCQYDVQQGEwJHUjE2MDQGA1UEChMtSEVMTEVOSUMgRVhDSEFOR0VT
+IC0gQVRIRU5TIFNUT0NLIEVYQ0hBTkdFIFNBMYIBDjCCAQoGA1UEYROCAQFhYWFh
+YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh
+YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh
+YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh
+YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh
+YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh
+YWFhYWFhYWFhYWFhYTEdMBsGA1UEAxMUd2ViZHNzLmF0aGV4Z3JvdXAuZ3IxDzAN
+BgNVBAcTBkF0aGVuczETMBEGCysGAQQBgjc8AgEDEwJHUjETMBEGA1UEBRMKWlgt
+QVQtVXhhWTEdMBsGA1UEDxMUUHJpdmF0ZSBPcmdhbml6YXRpb24wggEiMA0GCSqG
+SIb3DQEBAQUAA4IBDwAwggEKAoIBAQC4IRER3+RSdMkB84htWhzmrcFTqJ47yJtZ
+AgvDxw0aWYWVtyW2SMtygVUZSfp5ewE8OA9tdCa6oIuap6hKgZpQnkxS9RP0JRyH
+rJjxOc4sUUtbOHMCV5hq4Lkonh01DAsad9tVqR4naUSHsPI8v+93fjigi3vBsf5n
+GeBRrCTBYs8IKqoCC+Z2WWbwRCB6ct+ODsqbLwRxT54WY9iTaCNc/71rUlvIo3nk
+d/H17MCkoBdv4Ec3NG1Jo18FnkATyM12Xzhet+Wvvx0yjewRrFxak/wGZ4GGX1Dz
+y4wHfsceQjAtiZk2oWcn3/mk6oVA0ynF2a/4CmT1OZiWGOTqNnxTAgMBAAGjggJW
+MIICUjAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwHwYDVR0jBBgwFoAU
+IpkkVwZsVnWO2+t9eWWcUzWp0ZEwRAYIKwYBBQUHAQMEODA2MAgGBgQAjkYBATAT
+BgYEAI5GAQYwCQYHBACORgEGAzAVBggrBgEFBQcLAjAJBgcEAIvsSQEDMIGXBggr
+BgEFBQcBAQSBijCBhzA4BggrBgEFBQcwAYYsaHR0cDovL29jc3AuYXRoZXhncm91
+cC5nci9BdGhleFF1YWxpZmllZENBRzMwSwYIKwYBBQUHMAKGP2h0dHA6Ly9yZXBv
+LmF0aGV4Z3JvdXAuZ3IvQVRIRVhRdWFsaWZpZWRXRUJDZXJ0aWZpY2F0ZXNDQUcz
+LmNydDAlBgNVHSAEHjAcMA8GDSsGAQQBgeVaAQNkAQQwCQYHBACL7EABBjBPBgNV
+HR8ESDBGMESgQqBAhj5odHRwOi8vY3JsLmF0aGV4Z3JvdXAuZ3IvQVRIRVhRdWFs
+aWZpZWRXRUJDZXJ0aWZpY2F0ZXNDQUczLmNybDAdBgNVHQ4EFgQU07VGL6HuADDU
+GfAmLWYcVX4vqG0wDgYDVR0PAQH/BAQDAgeAMHsGA1UdEQR0MHKCFHdlYmRzcy5h
+dGhleGdyb3VwLmdyghh3ZWJkc3Ntb2NrLmF0aGV4Z3JvdXAuZ3KCGndlYmRzcy1y
+cHhyMS5pbmV0LmhlbGV4Lmdygg9kc3MuYXRoZXhuZXQuZ3KCE2Rzc21vY2suYXRo
+ZXhuZXQuZ3IwDAYDVR0TAQH/BAIwADANBgkqhkiG9w0BAQsFAAOCAgEAmXiG4Smv
+TWDGoaEXOQJuFlhbjwG/7MZCh18GeEhIfkOP0ClvalQImI8gbLo1DecfKDLLXLZp
+b7UTGtnpkKa2bDb+KyTyr3Aprg9L+KnX4jM6KfrteZgDP63TcxGXnr3C3Mf5Y8va
+FvlmazACRM/r830mnUj1yvK8c7ZkIRhmt5a2C8lBoMFD+q15QqdU0vK4mV72EBi+
+xYRuAg7GVZoPM+dZhiNm5dvKjAiaaOG58XKsnaeDDCDDWwjRJ7m8Y5ZaP6L8oGot
+vCmnXUjJcAmSE1MlXEjkHsGkCqgwY6Wp/jDh4KpT8dQov1kg4dIKU9PNpdLjmmk/
+Jv7PMsG7i+3Q8lMCHfCe6NxFnc3GZ62x6Gq6dKnIqDQzMvYUOnEPfVcfOaWmrmFA
+aBfVAXfRaXcgAPDknNPgCkdbi5ywuvbYckFOcVpv+1u+KqDYdxUMCSxSpls+o0J6
+c38FbcmuFfB7BYB8cTgucNAGUBur3ku6KO8fHcxpO3zLvA9I6LNhOmvLX24dPRpr
+Fd8uK+FiciNxbA3CjDGNUtJUErRMG8RRUXYPAM0tF9fZpKm3SurevG01yO8m/Acm
+sMuKjzJ9LIle7ioZtDc7C64ldoQ+IEA1QRyRo8qDml25rgvC3vTyQ4bngTunPPfE
+sSO04NT71G7va3DyV/VGVbCnlkj7sIHIPRY=
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.subject.rdnSequence.6.0.value.x520SerialNumber,NaturalPersonEidasIdentifierValidator,ERROR,etsi.nat_5.1.5-03.invalid_character_serial,No backslash found after ISO-3166 country code.
+certificate.tbsCertificate.subject.rdnSequence.6.0.value.x520SerialNumber,NaturalPersonEidasIdentifierValidator,ERROR,etsi.nat_5.1.5-03.invalid_iso_3166,Invalid 3166 ISO Code.
+certificate.tbsCertificate.extensions.6.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
+
diff --git a/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_final_certificate/internal_names.crttest b/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_final_certificate/internal_names.crttest
new file mode 100644
index 0000000..46c5e22
--- /dev/null
+++ b/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_final_certificate/internal_names.crttest
@@ -0,0 +1,48 @@
+-----BEGIN CERTIFICATE-----
+MIIHPTCCBSWgAwIBAgIQVZHNRxiZp9LoR1nlajD1DDANBgkqhkiG9w0BAQsFADCB
+oTELMAkGA1UEBhMCR1IxNjA0BgNVBAoTLUhFTExFTklDIEVYQ0hBTkdFUyAtIEFU
+SEVOUyBTVE9DSyBFWENIQU5HRSBTQTEvMC0GA1UEAxMmQVRIRVggUXVhbGlmaWVk
+IFdFQiBDZXJ0aWZpY2F0ZXMgQ0EtRzMxDzANBgNVBAcTBkF0aGVuczEYMBYGA1UE
+YRMPVkFURUwtMDk5NzU1MTA4MB4XDTI0MDQxMTE0MTY1NVoXDTI1MDQxMTE0MTY1
+NVowgcMxCzAJBgNVBAYTAkdSMTYwNAYDVQQKEy1IRUxMRU5JQyBFWENIQU5HRVMg
+LSBBVEhFTlMgU1RPQ0sgRVhDSEFOR0UgU0ExGDAWBgNVBGETD1ZBVEVMLTA5OTc1
+NTEwODEdMBsGA1UEAxMUd2ViZHNzLmF0aGV4Z3JvdXAuZ3IxDzANBgNVBAcTBkF0
+aGVuczETMBEGCysGAQQBgjc8AgEDEwJHUjEdMBsGA1UEDxMUUHJpdmF0ZSBPcmdh
+bml6YXRpb24wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC4IRER3+RS
+dMkB84htWhzmrcFTqJ47yJtZAgvDxw0aWYWVtyW2SMtygVUZSfp5ewE8OA9tdCa6
+oIuap6hKgZpQnkxS9RP0JRyHrJjxOc4sUUtbOHMCV5hq4Lkonh01DAsad9tVqR4n
+aUSHsPI8v+93fjigi3vBsf5nGeBRrCTBYs8IKqoCC+Z2WWbwRCB6ct+ODsqbLwRx
+T54WY9iTaCNc/71rUlvIo3nkd/H17MCkoBdv4Ec3NG1Jo18FnkATyM12Xzhet+Wv
+vx0yjewRrFxak/wGZ4GGX1Dzy4wHfsceQjAtiZk2oWcn3/mk6oVA0ynF2a/4CmT1
+OZiWGOTqNnxTAgMBAAGjggJLMIICRzAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYB
+BQUHAwIwHwYDVR0jBBgwFoAUIpkkVwZsVnWO2+t9eWWcUzWp0ZEwLQYIKwYBBQUH
+AQMEITAfMAgGBgQAjkYBATATBgYEAI5GAQYwCQYHBACORgEGAzCBjQYIKwYBBQUH
+AQEEgYAwfjAvBggrBgEFBQcwAYYjaHR0cDovL3Rlc3QudGVzdC9BdGhleFF1YWxp
+ZmllZENBRzMwSwYIKwYBBQUHMAKGP2h0dHA6Ly9yZXBvLmF0aGV4Z3JvdXAuZ3Iv
+QVRIRVhRdWFsaWZpZWRXRUJDZXJ0aWZpY2F0ZXNDQUczLmNydDBFBgNVHSAEPjA8
+MA8GDSsGAQQBgeVaAQNkAQQwKQYHBACL7EABBjAeMBwGCCsGAQUFBwIBFhBodHRw
+Oi8vdGVzdC50ZXN0ME8GA1UdHwRIMEYwRKBCoECGPmh0dHA6Ly9jcmwuYXRoZXhn
+cm91cC5nci9BVEhFWFF1YWxpZmllZFdFQkNlcnRpZmljYXRlc0NBRzMuY3JsMB0G
+A1UdDgQWBBTTtUYvoe4AMNQZ8CYtZhxVfi+obTAOBgNVHQ8BAf8EBAMCB4AwcQYD
+VR0RBGowaIIUd2ViZHNzLmF0aGV4Z3JvdXAuZ3KCGHdlYmRzc21vY2suYXRoZXhn
+cm91cC5ncoIad2ViZHNzLXJweHIxLmluZXQuaGVsZXguZ3KCD2Rzcy5hdGhleG5l
+dC5ncoIJdGVzdC50ZXN0MAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADggIB
+AJl4huEpr01gxqGhFzkCbhZYW48Bv+zGQodfBnhISH5Dj9Apb2pUCJiPIGy6NQ3n
+Hygyy1y2aW+1ExrZ6ZCmtmw2/isk8q9wKa4PS/ip1+IzOin67XmYAz+t03MRl569
+wtzH+WPL2hb5ZmswAkTP6/N9Jp1I9cryvHO2ZCEYZreWtgvJQaDBQ/qteUKnVNLy
+uJle9hAYvsWEbgIOxlWaDzPnWYYjZuXbyowImmjhufFyrJ2ngwwgw1sI0Se5vGOW
+Wj+i/KBqLbwpp11IyXAJkhNTJVxI5B7BpAqoMGOlqf4w4eCqU/HUKL9ZIOHSClPT
+zaXS45ppPyb+zzLBu4vt0PJTAh3wnujcRZ3NxmetsehqunSpyKg0MzL2FDpxD31X
+Hzmlpq5hQGgX1QF30Wl3IADw5JzT4ApHW4ucsLr22HJBTnFab/tbviqg2HcVDAks
+UqZbPqNCenN/BW3JrhXwewWAfHE4LnDQBlAbq95LuijvHx3MaTt8y7wPSOizYTpr
+y19uHT0aaxXfLivhYnIjcWwNwowxjVLSVBK0TBvEUVF2DwDNLRfX2aSpt0rq3rxt
+NcjvJvwHJrDLio8yfSyJXu4qGbQ3OwuuJXaEPiBANUEckaPKg5pdua4Lwt708kOG
+54E7pzz3xLEjtODU+9Ru72tw8lf1RlWwp5ZI+7CByD0W
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.extensions.3.extnValue.authorityInfoAccessSyntax.0.accessLocation.uniformResourceIdentifier,GeneralNameUriInternalDomainNameValidator,ERROR,etsi.internal_domain_name,"Internal domain name: ""test.test"""
+certificate.tbsCertificate.extensions.4.extnValue.certificatePolicies.1,CertificatePolicyQualifierValidator,NOTICE,pkix.certificate_policies_policy_has_qualifier,
+certificate.tbsCertificate.extensions.4.extnValue.certificatePolicies.1.policyQualifiers.0.qualifier.cPSuri,UriInternalDomainNameValidator,ERROR,etsi.internal_domain_name,"Internal domain name: ""test.test"""
+certificate.tbsCertificate.extensions.6.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
+certificate.tbsCertificate.extensions.8.extnValue.subjectAltName.4.dNSName,GeneralNameDnsNameInternalDomainNameValidator,ERROR,etsi.internal_domain_name,"Internal domain name: ""test.test"""
diff --git a/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_final_certificate/invalid_dnsname_syntax_san.crttest b/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_final_certificate/invalid_dnsname_syntax_san.crttest
new file mode 100644
index 0000000..34af877
--- /dev/null
+++ b/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_final_certificate/invalid_dnsname_syntax_san.crttest
@@ -0,0 +1,49 @@
+-----BEGIN CERTIFICATE-----
+MIIHpDCCBYygAwIBAgIQVZHNRxiZp9LoR1nlajD1DDANBgkqhkiG9w0BAQsFADCB
+oTELMAkGA1UEBhMCR1IxNjA0BgNVBAoTLUhFTExFTklDIEVYQ0hBTkdFUyAtIEFU
+SEVOUyBTVE9DSyBFWENIQU5HRSBTQTEvMC0GA1UEAxMmQVRIRVggUXVhbGlmaWVk
+IFdFQiBDZXJ0aWZpY2F0ZXMgQ0EtRzMxDzANBgNVBAcTBkF0aGVuczEYMBYGA1UE
+YRMPVkFURUwtMDk5NzU1MTA4MB4XDTI0MDQxMTE0MTY1NVoXDTI1MDQxMTE0MTY1
+NVowggEIMQswCQYDVQQGEwJHUjF7MHkGA1UEChNyTG9vb29vb29vb29vb29vb29v
+b29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29v
+b29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vbmcgY29tcGFueSBuYW1l
+MRgwFgYDVQRhEw9WQVRFTC0wOTk3NTUxMDgxHTAbBgNVBAMTFHdlYmRzcy5hdGhl
+eGdyb3VwLmdyMQ8wDQYDVQQHEwZBdGhlbnMxEzARBgsrBgEEAYI3PAIBAxMCR1Ix
+HTAbBgNVBA8TFFByaXZhdGUgT3JnYW5pemF0aW9uMIIBIjANBgkqhkiG9w0BAQEF
+AAOCAQ8AMIIBCgKCAQEAuCEREd/kUnTJAfOIbVoc5q3BU6ieO8ibWQILw8cNGlmF
+lbcltkjLcoFVGUn6eXsBPDgPbXQmuqCLmqeoSoGaUJ5MUvUT9CUch6yY8TnOLFFL
+WzhzAleYauC5KJ4dNQwLGnfbVakeJ2lEh7DyPL/vd344oIt7wbH+ZxngUawkwWLP
+CCqqAgvmdllm8EQgenLfjg7Kmy8EcU+eFmPYk2gjXP+9a1JbyKN55Hfx9ezApKAX
+b+BHNzRtSaNfBZ5AE8jNdl84Xrflr78dMo3sEaxcWpP8BmeBhl9Q88uMB37HHkIw
+LYmZNqFnJ9/5pOqFQNMpxdmv+Apk9TmYlhjk6jZ8UwIDAQABo4ICbDCCAmgwHQYD
+VR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMB8GA1UdIwQYMBaAFCKZJFcGbFZ1
+jtvrfXllnFM1qdGRMC0GCCsGAQUFBwEDBCEwHzAIBgYEAI5GAQEwEwYGBACORgEG
+MAkGBwQAjkYBBgMwgZcGCCsGAQUFBwEBBIGKMIGHMDgGCCsGAQUFBzABhixodHRw
+Oi8vb2NzcC5hdGhleGdyb3VwLmdyL0F0aGV4UXVhbGlmaWVkQ0FHMzBLBggrBgEF
+BQcwAoY/aHR0cDovL3JlcG8uYXRoZXhncm91cC5nci9BVEhFWFF1YWxpZmllZFdF
+QkNlcnRpZmljYXRlc0NBRzMuY3J0MCUGA1UdIAQeMBwwDwYNKwYBBAGB5VoBA2QB
+BDAJBgcEAIvsQAEGME8GA1UdHwRIMEYwRKBCoECGPmh0dHA6Ly9jcmwuYXRoZXhn
+cm91cC5nci9BVEhFWFF1YWxpZmllZFdFQkNlcnRpZmljYXRlc0NBRzMuY3JsMB0G
+A1UdDgQWBBTTtUYvoe4AMNQZ8CYtZhxVfi+obTAOBgNVHQ8BAf8EBAMCB4AwgacG
+A1UdEQSBnzCBnIIQX3d3dy5leGFtcGxlLmNvbYIsd3d3LmJsb2cuOC0tLWtpNGIx
+YTJmNWc4YjVlNGp0YS5mYXRlZ28udG9reW+CGHdlYmRzc21vY2suYXRoZXhncm91
+cC5ncoIad2ViZHNzLXJweHIxLmluZXQuaGVsZXguZ3KCD2Rzcy5hdGhleG5ldC5n
+coITZHNzbW9jay5hdGhleG5ldC5ncjAMBgNVHRMBAf8EAjAAMA0GCSqGSIb3DQEB
+CwUAA4ICAQCZeIbhKa9NYMahoRc5Am4WWFuPAb/sxkKHXwZ4SEh+Q4/QKW9qVAiY
+jyBsujUN5x8oMstctmlvtRMa2emQprZsNv4rJPKvcCmuD0v4qdfiMzop+u15mAM/
+rdNzEZeevcLcx/ljy9oW+WZrMAJEz+vzfSadSPXK8rxztmQhGGa3lrYLyUGgwUP6
+rXlCp1TS8riZXvYQGL7FhG4CDsZVmg8z51mGI2bl28qMCJpo4bnxcqydp4MMIMNb
+CNEnubxjllo/ovygai28KaddSMlwCZITUyVcSOQewaQKqDBjpan+MOHgqlPx1Ci/
+WSDh0gpT082l0uOaaT8m/s8ywbuL7dDyUwId8J7o3EWdzcZnrbHoarp0qcioNDMy
+9hQ6cQ99Vx85paauYUBoF9UBd9FpdyAA8OSc0+AKR1uLnLC69thyQU5xWm/7W74q
+oNh3FQwJLFKmWz6jQnpzfwVtya4V8HsFgHxxOC5w0AZQG6veS7oo7x8dzGk7fMu8
+D0jos2E6a8tfbh09GmsV3y4r4WJyI3FsDcKMMY1S0lQStEwbxFFRdg8AzS0X19mk
+qbdK6t68bTXI7yb8Byawy4qPMn0siV7uKhm0NzsLriV2hD4gQDVBHJGjyoOaXbmu
+C8Le9PJDhueBO6c898SxI7Tg1PvUbu9rcPJX9UZVsKeWSPuwgcg9Fg==
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.extensions.6.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
+certificate.tbsCertificate.extensions.8.extnValue.subjectAltName.1.dNSName,DnsNameLdhLabelSyntaxValidator,ERROR,cabf.serverauth.dnsname_contains_prohibited_reserved_label,"Invalid reserved label ""8---ki4b1a2f5g8b5e4jta"" with tag ""8-"" in domain name ""www.blog.8---ki4b1a2f5g8b5e4jta.fatego.tokyo"""
+certificate.tbsCertificate.subject.rdnSequence.3.0.value.x520CommonName,NcpWCommonNameValidator,ERROR,etsi.en_319_412_4.web-4.1.3-4.common_name_unknown_source,"Unknown source for value of common name: ""webdss.athexgroup.gr"""
+certificate.tbsCertificate.extensions.8.extnValue.subjectAltName.0.dNSName,DnsNameLdhLabelSyntaxValidator,ERROR,cabf.serverauth.invalid_dnsname_syntax,"Non-LDH domain label ""_www"" in domain name ""_www.example.com"""
diff --git a/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_final_certificate/ip_addr_common_name_value.crttest b/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_final_certificate/ip_addr_common_name_value.crttest
new file mode 100644
index 0000000..67fb793
--- /dev/null
+++ b/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_final_certificate/ip_addr_common_name_value.crttest
@@ -0,0 +1,45 @@
+-----BEGIN CERTIFICATE-----
+MIIHLTCCBRWgAwIBAgIQVZHNRxiZp9LoR1nlajD1DDANBgkqhkiG9w0BAQsFADCB
+oTELMAkGA1UEBhMCR1IxNjA0BgNVBAoTLUhFTExFTklDIEVYQ0hBTkdFUyAtIEFU
+SEVOUyBTVE9DSyBFWENIQU5HRSBTQTEvMC0GA1UEAxMmQVRIRVggUXVhbGlmaWVk
+IFdFQiBDZXJ0aWZpY2F0ZXMgQ0EtRzMxDzANBgNVBAcTBkF0aGVuczEYMBYGA1UE
+YRMPVkFURUwtMDk5NzU1MTA4MB4XDTI0MDQxMTE0MTY1NVoXDTI1MDQxMTE0MTY1
+NVowgbgxCzAJBgNVBAYTAkdSMTYwNAYDVQQKEy1IRUxMRU5JQyBFWENIQU5HRVMg
+LSBBVEhFTlMgU1RPQ0sgRVhDSEFOR0UgU0ExGDAWBgNVBGETD1ZBVEVMLTA5OTc1
+NTEwODESMBAGA1UEAxMJMTgyLjEuMS4xMQ8wDQYDVQQHEwZBdGhlbnMxEzARBgsr
+BgEEAYI3PAIBAxMCR1IxHTAbBgNVBA8TFFByaXZhdGUgT3JnYW5pemF0aW9uMIIB
+IjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuCEREd/kUnTJAfOIbVoc5q3B
+U6ieO8ibWQILw8cNGlmFlbcltkjLcoFVGUn6eXsBPDgPbXQmuqCLmqeoSoGaUJ5M
+UvUT9CUch6yY8TnOLFFLWzhzAleYauC5KJ4dNQwLGnfbVakeJ2lEh7DyPL/vd344
+oIt7wbH+ZxngUawkwWLPCCqqAgvmdllm8EQgenLfjg7Kmy8EcU+eFmPYk2gjXP+9
+a1JbyKN55Hfx9ezApKAXb+BHNzRtSaNfBZ5AE8jNdl84Xrflr78dMo3sEaxcWpP8
+BmeBhl9Q88uMB37HHkIwLYmZNqFnJ9/5pOqFQNMpxdmv+Apk9TmYlhjk6jZ8UwID
+AQABo4ICRjCCAkIwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMB8GA1Ud
+IwQYMBaAFCKZJFcGbFZ1jtvrfXllnFM1qdGRMC0GCCsGAQUFBwEDBCEwHzAIBgYE
+AI5GAQEwEwYGBACORgEGMAkGBwQAjkYBBgMwgZcGCCsGAQUFBwEBBIGKMIGHMDgG
+CCsGAQUFBzABhixodHRwOi8vb2NzcC5hdGhleGdyb3VwLmdyL0F0aGV4UXVhbGlm
+aWVkQ0FHMzBLBggrBgEFBQcwAoY/aHR0cDovL3JlcG8uYXRoZXhncm91cC5nci9B
+VEhFWFF1YWxpZmllZFdFQkNlcnRpZmljYXRlc0NBRzMuY3J0MCUGA1UdIAQeMBww
+DwYNKwYBBAGB5VoBA2QBBDAJBgcEAIvsQAEGME8GA1UdHwRIMEYwRKBCoECGPmh0
+dHA6Ly9jcmwuYXRoZXhncm91cC5nci9BVEhFWFF1YWxpZmllZFdFQkNlcnRpZmlj
+YXRlc0NBRzMuY3JsMB0GA1UdDgQWBBTTtUYvoe4AMNQZ8CYtZhxVfi+obTAOBgNV
+HQ8BAf8EBAMCB4AwgYEGA1UdEQR6MHiCFHdlYmRzcy5hdGhleGdyb3VwLmdyghh3
+ZWJkc3Ntb2NrLmF0aGV4Z3JvdXAuZ3KCGndlYmRzcy1ycHhyMS5pbmV0LmhlbGV4
+Lmdygg9kc3MuYXRoZXhuZXQuZ3KCE2Rzc21vY2suYXRoZXhuZXQuZ3KHBLYBAQEw
+DAYDVR0TAQH/BAIwADANBgkqhkiG9w0BAQsFAAOCAgEAmXiG4SmvTWDGoaEXOQJu
+FlhbjwG/7MZCh18GeEhIfkOP0ClvalQImI8gbLo1DecfKDLLXLZpb7UTGtnpkKa2
+bDb+KyTyr3Aprg9L+KnX4jM6KfrteZgDP63TcxGXnr3C3Mf5Y8vaFvlmazACRM/r
+830mnUj1yvK8c7ZkIRhmt5a2C8lBoMFD+q15QqdU0vK4mV72EBi+xYRuAg7GVZoP
+M+dZhiNm5dvKjAiaaOG58XKsnaeDDCDDWwjRJ7m8Y5ZaP6L8oGotvCmnXUjJcAmS
+E1MlXEjkHsGkCqgwY6Wp/jDh4KpT8dQov1kg4dIKU9PNpdLjmmk/Jv7PMsG7i+3Q
+8lMCHfCe6NxFnc3GZ62x6Gq6dKnIqDQzMvYUOnEPfVcfOaWmrmFAaBfVAXfRaXcg
+APDknNPgCkdbi5ywuvbYckFOcVpv+1u+KqDYdxUMCSxSpls+o0J6c38FbcmuFfB7
+BYB8cTgucNAGUBur3ku6KO8fHcxpO3zLvA9I6LNhOmvLX24dPRprFd8uK+FiciNx
+bA3CjDGNUtJUErRMG8RRUXYPAM0tF9fZpKm3SurevG01yO8m/AcmsMuKjzJ9LIle
+7ioZtDc7C64ldoQ+IEA1QRyRo8qDml25rgvC3vTyQ4bngTunPPfEsSO04NT71G7v
+a3DyV/VGVbCnlkj7sIHIPRY=
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.extensions.6.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
+certificate.tbsCertificate.subject.rdnSequence.3.0.value.x520CommonName,NcpWCommonNameValidator,ERROR,etsi.en_319_412_4.web-4.1.3-4.common_name_unknown_source,"Unknown source for value of common name: ""182.1.1.1"""
diff --git a/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_final_certificate/long_orgname.crttest b/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_final_certificate/long_orgname.crttest
new file mode 100644
index 0000000..15ec5a3
--- /dev/null
+++ b/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_final_certificate/long_orgname.crttest
@@ -0,0 +1,45 @@
+-----BEGIN CERTIFICATE-----
+MIIHdzCCBV+gAwIBAgIQVZHNRxiZp9LoR1nlajD1DDANBgkqhkiG9w0BAQsFADCB
+oTELMAkGA1UEBhMCR1IxNjA0BgNVBAoTLUhFTExFTklDIEVYQ0hBTkdFUyAtIEFU
+SEVOUyBTVE9DSyBFWENIQU5HRSBTQTEvMC0GA1UEAxMmQVRIRVggUXVhbGlmaWVk
+IFdFQiBDZXJ0aWZpY2F0ZXMgQ0EtRzMxDzANBgNVBAcTBkF0aGVuczEYMBYGA1UE
+YRMPVkFURUwtMDk5NzU1MTA4MB4XDTI0MDQxMTE0MTY1NVoXDTI1MDQxMTE0MTY1
+NVowggEIMQswCQYDVQQGEwJHUjF7MHkGA1UEChNyTG9vb29vb29vb29vb29vb29v
+b29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29v
+b29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vbmcgY29tcGFueSBuYW1l
+MRgwFgYDVQRhEw9WQVRFTC0wOTk3NTUxMDgxHTAbBgNVBAMTFHdlYmRzcy5hdGhl
+eGdyb3VwLmdyMQ8wDQYDVQQHEwZBdGhlbnMxEzARBgsrBgEEAYI3PAIBAxMCR1Ix
+HTAbBgNVBA8TFFByaXZhdGUgT3JnYW5pemF0aW9uMIIBIjANBgkqhkiG9w0BAQEF
+AAOCAQ8AMIIBCgKCAQEAuCEREd/kUnTJAfOIbVoc5q3BU6ieO8ibWQILw8cNGlmF
+lbcltkjLcoFVGUn6eXsBPDgPbXQmuqCLmqeoSoGaUJ5MUvUT9CUch6yY8TnOLFFL
+WzhzAleYauC5KJ4dNQwLGnfbVakeJ2lEh7DyPL/vd344oIt7wbH+ZxngUawkwWLP
+CCqqAgvmdllm8EQgenLfjg7Kmy8EcU+eFmPYk2gjXP+9a1JbyKN55Hfx9ezApKAX
+b+BHNzRtSaNfBZ5AE8jNdl84Xrflr78dMo3sEaxcWpP8BmeBhl9Q88uMB37HHkIw
+LYmZNqFnJ9/5pOqFQNMpxdmv+Apk9TmYlhjk6jZ8UwIDAQABo4ICPzCCAjswHQYD
+VR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMB8GA1UdIwQYMBaAFCKZJFcGbFZ1
+jtvrfXllnFM1qdGRMC0GCCsGAQUFBwEDBCEwHzAIBgYEAI5GAQEwEwYGBACORgEG
+MAkGBwQAjkYBBgMwgZcGCCsGAQUFBwEBBIGKMIGHMDgGCCsGAQUFBzABhixodHRw
+Oi8vb2NzcC5hdGhleGdyb3VwLmdyL0F0aGV4UXVhbGlmaWVkQ0FHMzBLBggrBgEF
+BQcwAoY/aHR0cDovL3JlcG8uYXRoZXhncm91cC5nci9BVEhFWFF1YWxpZmllZFdF
+QkNlcnRpZmljYXRlc0NBRzMuY3J0MCUGA1UdIAQeMBwwDwYNKwYBBAGB5VoBA2QB
+BDAJBgcEAIvsQAEGME8GA1UdHwRIMEYwRKBCoECGPmh0dHA6Ly9jcmwuYXRoZXhn
+cm91cC5nci9BVEhFWFF1YWxpZmllZFdFQkNlcnRpZmljYXRlc0NBRzMuY3JsMB0G
+A1UdDgQWBBTTtUYvoe4AMNQZ8CYtZhxVfi+obTAOBgNVHQ8BAf8EBAMCB4AwewYD
+VR0RBHQwcoIUd2ViZHNzLmF0aGV4Z3JvdXAuZ3KCGHdlYmRzc21vY2suYXRoZXhn
+cm91cC5ncoIad2ViZHNzLXJweHIxLmluZXQuaGVsZXguZ3KCD2Rzcy5hdGhleG5l
+dC5ncoITZHNzbW9jay5hdGhleG5ldC5ncjAMBgNVHRMBAf8EAjAAMA0GCSqGSIb3
+DQEBCwUAA4ICAQCZeIbhKa9NYMahoRc5Am4WWFuPAb/sxkKHXwZ4SEh+Q4/QKW9q
+VAiYjyBsujUN5x8oMstctmlvtRMa2emQprZsNv4rJPKvcCmuD0v4qdfiMzop+u15
+mAM/rdNzEZeevcLcx/ljy9oW+WZrMAJEz+vzfSadSPXK8rxztmQhGGa3lrYLyUGg
+wUP6rXlCp1TS8riZXvYQGL7FhG4CDsZVmg8z51mGI2bl28qMCJpo4bnxcqydp4MM
+IMNbCNEnubxjllo/ovygai28KaddSMlwCZITUyVcSOQewaQKqDBjpan+MOHgqlPx
+1Ci/WSDh0gpT082l0uOaaT8m/s8ywbuL7dDyUwId8J7o3EWdzcZnrbHoarp0qcio
+NDMy9hQ6cQ99Vx85paauYUBoF9UBd9FpdyAA8OSc0+AKR1uLnLC69thyQU5xWm/7
+W74qoNh3FQwJLFKmWz6jQnpzfwVtya4V8HsFgHxxOC5w0AZQG6veS7oo7x8dzGk7
+fMu8D0jos2E6a8tfbh09GmsV3y4r4WJyI3FsDcKMMY1S0lQStEwbxFFRdg8AzS0X
+19mkqbdK6t68bTXI7yb8Byawy4qPMn0siV7uKhm0NzsLriV2hD4gQDVBHJGjyoOa
+XbmuC8Le9PJDhueBO6c898SxI7Tg1PvUbu9rcPJX9UZVsKeWSPuwgcg9Fg==
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.extensions.6.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
diff --git a/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_final_certificate/missing_san.crttest b/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_final_certificate/missing_san.crttest
new file mode 100644
index 0000000..eaccd04
--- /dev/null
+++ b/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_final_certificate/missing_san.crttest
@@ -0,0 +1,45 @@
+-----BEGIN CERTIFICATE-----
+MIIG+jCCBOKgAwIBAgIQVZHNRxiZp9LoR1nlajD1DDANBgkqhkiG9w0BAQsFADCB
+oTELMAkGA1UEBhMCR1IxNjA0BgNVBAoTLUhFTExFTklDIEVYQ0hBTkdFUyAtIEFU
+SEVOUyBTVE9DSyBFWENIQU5HRSBTQTEvMC0GA1UEAxMmQVRIRVggUXVhbGlmaWVk
+IFdFQiBDZXJ0aWZpY2F0ZXMgQ0EtRzMxDzANBgNVBAcTBkF0aGVuczEYMBYGA1UE
+YRMPVkFURUwtMDk5NzU1MTA4MB4XDTI0MDQxMTE0MTY1NVoXDTI1MDQxMTE0MTY1
+NVowggEIMQswCQYDVQQGEwJHUjF7MHkGA1UEChNyTG9vb29vb29vb29vb29vb29v
+b29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29v
+b29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vbmcgY29tcGFueSBuYW1l
+MRgwFgYDVQRhEw9WQVRFTC0wOTk3NTUxMDgxHTAbBgNVBAMTFHdlYmRzcy5hdGhl
+eGdyb3VwLmdyMQ8wDQYDVQQHEwZBdGhlbnMxEzARBgsrBgEEAYI3PAIBAxMCR1Ix
+HTAbBgNVBA8TFFByaXZhdGUgT3JnYW5pemF0aW9uMIIBIjANBgkqhkiG9w0BAQEF
+AAOCAQ8AMIIBCgKCAQEAuCEREd/kUnTJAfOIbVoc5q3BU6ieO8ibWQILw8cNGlmF
+lbcltkjLcoFVGUn6eXsBPDgPbXQmuqCLmqeoSoGaUJ5MUvUT9CUch6yY8TnOLFFL
+WzhzAleYauC5KJ4dNQwLGnfbVakeJ2lEh7DyPL/vd344oIt7wbH+ZxngUawkwWLP
+CCqqAgvmdllm8EQgenLfjg7Kmy8EcU+eFmPYk2gjXP+9a1JbyKN55Hfx9ezApKAX
+b+BHNzRtSaNfBZ5AE8jNdl84Xrflr78dMo3sEaxcWpP8BmeBhl9Q88uMB37HHkIw
+LYmZNqFnJ9/5pOqFQNMpxdmv+Apk9TmYlhjk6jZ8UwIDAQABo4IBwjCCAb4wHQYD
+VR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMB8GA1UdIwQYMBaAFCKZJFcGbFZ1
+jtvrfXllnFM1qdGRMC0GCCsGAQUFBwEDBCEwHzAIBgYEAI5GAQEwEwYGBACORgEG
+MAkGBwQAjkYBBgMwgZcGCCsGAQUFBwEBBIGKMIGHMDgGCCsGAQUFBzABhixodHRw
+Oi8vb2NzcC5hdGhleGdyb3VwLmdyL0F0aGV4UXVhbGlmaWVkQ0FHMzBLBggrBgEF
+BQcwAoY/aHR0cDovL3JlcG8uYXRoZXhncm91cC5nci9BVEhFWFF1YWxpZmllZFdF
+QkNlcnRpZmljYXRlc0NBRzMuY3J0MCUGA1UdIAQeMBwwDwYNKwYBBAGB5VoBA2QB
+BDAJBgcEAIvsQAEGME8GA1UdHwRIMEYwRKBCoECGPmh0dHA6Ly9jcmwuYXRoZXhn
+cm91cC5nci9BVEhFWFF1YWxpZmllZFdFQkNlcnRpZmljYXRlc0NBRzMuY3JsMB0G
+A1UdDgQWBBTTtUYvoe4AMNQZ8CYtZhxVfi+obTAOBgNVHQ8BAf8EBAMCB4AwDAYD
+VR0TAQH/BAIwADANBgkqhkiG9w0BAQsFAAOCAgEAmXiG4SmvTWDGoaEXOQJuFlhb
+jwG/7MZCh18GeEhIfkOP0ClvalQImI8gbLo1DecfKDLLXLZpb7UTGtnpkKa2bDb+
+KyTyr3Aprg9L+KnX4jM6KfrteZgDP63TcxGXnr3C3Mf5Y8vaFvlmazACRM/r830m
+nUj1yvK8c7ZkIRhmt5a2C8lBoMFD+q15QqdU0vK4mV72EBi+xYRuAg7GVZoPM+dZ
+hiNm5dvKjAiaaOG58XKsnaeDDCDDWwjRJ7m8Y5ZaP6L8oGotvCmnXUjJcAmSE1Ml
+XEjkHsGkCqgwY6Wp/jDh4KpT8dQov1kg4dIKU9PNpdLjmmk/Jv7PMsG7i+3Q8lMC
+HfCe6NxFnc3GZ62x6Gq6dKnIqDQzMvYUOnEPfVcfOaWmrmFAaBfVAXfRaXcgAPDk
+nNPgCkdbi5ywuvbYckFOcVpv+1u+KqDYdxUMCSxSpls+o0J6c38FbcmuFfB7BYB8
+cTgucNAGUBur3ku6KO8fHcxpO3zLvA9I6LNhOmvLX24dPRprFd8uK+FiciNxbA3C
+jDGNUtJUErRMG8RRUXYPAM0tF9fZpKm3SurevG01yO8m/AcmsMuKjzJ9LIle7ioZ
+tDc7C64ldoQ+IEA1QRyRo8qDml25rgvC3vTyQ4bngTunPPfEsSO04NT71G7va3Dy
+V/VGVbCnlkj7sIHIPRY=
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.extensions.6.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
+certificate.tbsCertificate.subject.rdnSequence.3.0.value.x520CommonName,NcpWCommonNameValidator,ERROR,etsi.en_319_412_4.web-4.1.3-4.common_name_unknown_source,"Unknown source for value of common name: ""webdss.athexgroup.gr"""
+certificate.tbsCertificate.extensions,NcpWSubjectAltNamePresenceValidator,ERROR,etsi.en_319_412_4.web-4.1.3-4.san_missing,
diff --git a/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_final_certificate/no_eku.crttest b/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_final_certificate/no_eku.crttest
new file mode 100644
index 0000000..cea2ac6
--- /dev/null
+++ b/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_final_certificate/no_eku.crttest
@@ -0,0 +1,44 @@
+-----BEGIN CERTIFICATE-----
+MIIHEjCCBPqgAwIBAgIQVZHNRxiZp9LoR1nlajD1DDANBgkqhkiG9w0BAQsFADCB
+oTELMAkGA1UEBhMCR1IxNjA0BgNVBAoTLUhFTExFTklDIEVYQ0hBTkdFUyAtIEFU
+SEVOUyBTVE9DSyBFWENIQU5HRSBTQTEvMC0GA1UEAxMmQVRIRVggUXVhbGlmaWVk
+IFdFQiBDZXJ0aWZpY2F0ZXMgQ0EtRzMxDzANBgNVBAcTBkF0aGVuczEYMBYGA1UE
+YRMPVkFURUwtMDk5NzU1MTA4MB4XDTI0MDQxMTE0MTY1NVoXDTI1MDQxMTE0MTY1
+NVowgcMxCzAJBgNVBAYTAkdSMTYwNAYDVQQKEy1IRUxMRU5JQyBFWENIQU5HRVMg
+LSBBVEhFTlMgU1RPQ0sgRVhDSEFOR0UgU0ExGDAWBgNVBGETD1ZBVEVMLTA5OTc1
+NTEwODEdMBsGA1UEAxMUd2ViZHNzLmF0aGV4Z3JvdXAuZ3IxDzANBgNVBAcTBkF0
+aGVuczETMBEGCysGAQQBgjc8AgEDEwJHUjEdMBsGA1UEDxMUUHJpdmF0ZSBPcmdh
+bml6YXRpb24wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC4IRER3+RS
+dMkB84htWhzmrcFTqJ47yJtZAgvDxw0aWYWVtyW2SMtygVUZSfp5ewE8OA9tdCa6
+oIuap6hKgZpQnkxS9RP0JRyHrJjxOc4sUUtbOHMCV5hq4Lkonh01DAsad9tVqR4n
+aUSHsPI8v+93fjigi3vBsf5nGeBRrCTBYs8IKqoCC+Z2WWbwRCB6ct+ODsqbLwRx
+T54WY9iTaCNc/71rUlvIo3nkd/H17MCkoBdv4Ec3NG1Jo18FnkATyM12Xzhet+Wv
+vx0yjewRrFxak/wGZ4GGX1Dzy4wHfsceQjAtiZk2oWcn3/mk6oVA0ynF2a/4CmT1
+OZiWGOTqNnxTAgMBAAGjggIgMIICHDAfBgNVHSMEGDAWgBQimSRXBmxWdY7b6315
+ZZxTNanRkTAtBggrBgEFBQcBAwQhMB8wCAYGBACORgEBMBMGBgQAjkYBBjAJBgcE
+AI5GAQYDMIGXBggrBgEFBQcBAQSBijCBhzA4BggrBgEFBQcwAYYsaHR0cDovL29j
+c3AuYXRoZXhncm91cC5nci9BdGhleFF1YWxpZmllZENBRzMwSwYIKwYBBQUHMAKG
+P2h0dHA6Ly9yZXBvLmF0aGV4Z3JvdXAuZ3IvQVRIRVhRdWFsaWZpZWRXRUJDZXJ0
+aWZpY2F0ZXNDQUczLmNydDAlBgNVHSAEHjAcMA8GDSsGAQQBgeVaAQNkAQQwCQYH
+BACL7EABBjBPBgNVHR8ESDBGMESgQqBAhj5odHRwOi8vY3JsLmF0aGV4Z3JvdXAu
+Z3IvQVRIRVhRdWFsaWZpZWRXRUJDZXJ0aWZpY2F0ZXNDQUczLmNybDAdBgNVHQ4E
+FgQU07VGL6HuADDUGfAmLWYcVX4vqG0wDgYDVR0PAQH/BAQDAgeAMHsGA1UdEQR0
+MHKCFHdlYmRzcy5hdGhleGdyb3VwLmdyghh3ZWJkc3Ntb2NrLmF0aGV4Z3JvdXAu
+Z3KCGndlYmRzcy1ycHhyMS5pbmV0LmhlbGV4Lmdygg9kc3MuYXRoZXhuZXQuZ3KC
+E2Rzc21vY2suYXRoZXhuZXQuZ3IwDAYDVR0TAQH/BAIwADANBgkqhkiG9w0BAQsF
+AAOCAgEAmXiG4SmvTWDGoaEXOQJuFlhbjwG/7MZCh18GeEhIfkOP0ClvalQImI8g
+bLo1DecfKDLLXLZpb7UTGtnpkKa2bDb+KyTyr3Aprg9L+KnX4jM6KfrteZgDP63T
+cxGXnr3C3Mf5Y8vaFvlmazACRM/r830mnUj1yvK8c7ZkIRhmt5a2C8lBoMFD+q15
+QqdU0vK4mV72EBi+xYRuAg7GVZoPM+dZhiNm5dvKjAiaaOG58XKsnaeDDCDDWwjR
+J7m8Y5ZaP6L8oGotvCmnXUjJcAmSE1MlXEjkHsGkCqgwY6Wp/jDh4KpT8dQov1kg
+4dIKU9PNpdLjmmk/Jv7PMsG7i+3Q8lMCHfCe6NxFnc3GZ62x6Gq6dKnIqDQzMvYU
+OnEPfVcfOaWmrmFAaBfVAXfRaXcgAPDknNPgCkdbi5ywuvbYckFOcVpv+1u+KqDY
+dxUMCSxSpls+o0J6c38FbcmuFfB7BYB8cTgucNAGUBur3ku6KO8fHcxpO3zLvA9I
+6LNhOmvLX24dPRprFd8uK+FiciNxbA3CjDGNUtJUErRMG8RRUXYPAM0tF9fZpKm3
+SurevG01yO8m/AcmsMuKjzJ9LIle7ioZtDc7C64ldoQ+IEA1QRyRo8qDml25rgvC
+3vTyQ4bngTunPPfEsSO04NT71G7va3DyV/VGVbCnlkj7sIHIPRY=
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.extensions.5.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
+certificate.tbsCertificate.extensions,NcpWExtendedKeyUsagePresenceValidator,ERROR,etsi.en_319_412_4.web-4.1.3-4.eku_missing,
diff --git a/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_final_certificate/prohibited_criticality.crttest b/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_final_certificate/prohibited_criticality.crttest
new file mode 100644
index 0000000..86f97a6
--- /dev/null
+++ b/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_final_certificate/prohibited_criticality.crttest
@@ -0,0 +1,46 @@
+-----BEGIN CERTIFICATE-----
+MIIHNDCCBRygAwIBAgIQVZHNRxiZp9LoR1nlajD1DDANBgkqhkiG9w0BAQsFADCB
+oTELMAkGA1UEBhMCR1IxNjA0BgNVBAoTLUhFTExFTklDIEVYQ0hBTkdFUyAtIEFU
+SEVOUyBTVE9DSyBFWENIQU5HRSBTQTEvMC0GA1UEAxMmQVRIRVggUXVhbGlmaWVk
+IFdFQiBDZXJ0aWZpY2F0ZXMgQ0EtRzMxDzANBgNVBAcTBkF0aGVuczEYMBYGA1UE
+YRMPVkFURUwtMDk5NzU1MTA4MB4XDTI0MDQxMTE0MTY1NVoXDTI1MDQxMTE0MTY1
+NVowgcMxCzAJBgNVBAYTAkdSMTYwNAYDVQQKEy1IRUxMRU5JQyBFWENIQU5HRVMg
+LSBBVEhFTlMgU1RPQ0sgRVhDSEFOR0UgU0ExGDAWBgNVBGETD1ZBVEVMLTA5OTc1
+NTEwODEdMBsGA1UEAxMUd2ViZHNzLmF0aGV4Z3JvdXAuZ3IxDzANBgNVBAcTBkF0
+aGVuczETMBEGCysGAQQBgjc8AgEDEwJHUjEdMBsGA1UEDxMUUHJpdmF0ZSBPcmdh
+bml6YXRpb24wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC4IRER3+RS
+dMkB84htWhzmrcFTqJ47yJtZAgvDxw0aWYWVtyW2SMtygVUZSfp5ewE8OA9tdCa6
+oIuap6hKgZpQnkxS9RP0JRyHrJjxOc4sUUtbOHMCV5hq4Lkonh01DAsad9tVqR4n
+aUSHsPI8v+93fjigi3vBsf5nGeBRrCTBYs8IKqoCC+Z2WWbwRCB6ct+ODsqbLwRx
+T54WY9iTaCNc/71rUlvIo3nkd/H17MCkoBdv4Ec3NG1Jo18FnkATyM12Xzhet+Wv
+vx0yjewRrFxak/wGZ4GGX1Dzy4wHfsceQjAtiZk2oWcn3/mk6oVA0ynF2a/4CmT1
+OZiWGOTqNnxTAgMBAAGjggJCMIICPjAgBgNVHSUBAf8EFjAUBggrBgEFBQcDAQYI
+KwYBBQUHAwIwHwYDVR0jBBgwFoAUIpkkVwZsVnWO2+t9eWWcUzWp0ZEwLQYIKwYB
+BQUHAQMEITAfMAgGBgQAjkYBATATBgYEAI5GAQYwCQYHBACORgEGAzCBlwYIKwYB
+BQUHAQEEgYowgYcwOAYIKwYBBQUHMAGGLGh0dHA6Ly9vY3NwLmF0aGV4Z3JvdXAu
+Z3IvQXRoZXhRdWFsaWZpZWRDQUczMEsGCCsGAQUFBzAChj9odHRwOi8vcmVwby5h
+dGhleGdyb3VwLmdyL0FUSEVYUXVhbGlmaWVkV0VCQ2VydGlmaWNhdGVzQ0FHMy5j
+cnQwJQYDVR0gBB4wHDAPBg0rBgEEAYHlWgEDZAEEMAkGBwQAi+xAAQYwTwYDVR0f
+BEgwRjBEoEKgQIY+aHR0cDovL2NybC5hdGhleGdyb3VwLmdyL0FUSEVYUXVhbGlm
+aWVkV0VCQ2VydGlmaWNhdGVzQ0FHMy5jcmwwHQYDVR0OBBYEFNO1Ri+h7gAw1Bnw
+Ji1mHFV+L6htMA4GA1UdDwEB/wQEAwIHgDB7BgNVHREEdDByghR3ZWJkc3MuYXRo
+ZXhncm91cC5ncoIYd2ViZHNzbW9jay5hdGhleGdyb3VwLmdyghp3ZWJkc3MtcnB4
+cjEuaW5ldC5oZWxleC5ncoIPZHNzLmF0aGV4bmV0LmdyghNkc3Ntb2NrLmF0aGV4
+bmV0LmdyMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADggIBAJl4huEpr01g
+xqGhFzkCbhZYW48Bv+zGQodfBnhISH5Dj9Apb2pUCJiPIGy6NQ3nHygyy1y2aW+1
+ExrZ6ZCmtmw2/isk8q9wKa4PS/ip1+IzOin67XmYAz+t03MRl569wtzH+WPL2hb5
+ZmswAkTP6/N9Jp1I9cryvHO2ZCEYZreWtgvJQaDBQ/qteUKnVNLyuJle9hAYvsWE
+bgIOxlWaDzPnWYYjZuXbyowImmjhufFyrJ2ngwwgw1sI0Se5vGOWWj+i/KBqLbwp
+p11IyXAJkhNTJVxI5B7BpAqoMGOlqf4w4eCqU/HUKL9ZIOHSClPTzaXS45ppPyb+
+zzLBu4vt0PJTAh3wnujcRZ3NxmetsehqunSpyKg0MzL2FDpxD31XHzmlpq5hQGgX
+1QF30Wl3IADw5JzT4ApHW4ucsLr22HJBTnFab/tbviqg2HcVDAksUqZbPqNCenN/
+BW3JrhXwewWAfHE4LnDQBlAbq95LuijvHx3MaTt8y7wPSOizYTpry19uHT0aaxXf
+LivhYnIjcWwNwowxjVLSVBK0TBvEUVF2DwDNLRfX2aSpt0rq3rxtNcjvJvwHJrDL
+io8yfSyJXu4qGbQ3OwuuJXaEPiBANUEckaPKg5pdua4Lwt708kOG54E7pzz3xLEj
+tODU+9Ru72tw8lf1RlWwp5ZI+7CByD0W
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.extensions.0,ExtendedKeyUsageCriticalityValidator,ERROR,etsi.en_319_412_2.gen-4.3.10-1.eku_extension_is_critical,Extension 2.5.29.37 is critical
+certificate.tbsCertificate.extensions.6.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
+certificate.tbsCertificate.extensions.0,NcpWCriticalityExtendedKeyUsageValidator,ERROR,etsi.en_319_412_4.web-4.1.3-4.eku_extension_is_critical,Extension 2.5.29.37 is critical
diff --git a/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_final_certificate/prohibited_eku.crttest b/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_final_certificate/prohibited_eku.crttest
new file mode 100644
index 0000000..7ae61ce
--- /dev/null
+++ b/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_final_certificate/prohibited_eku.crttest
@@ -0,0 +1,45 @@
+-----BEGIN CERTIFICATE-----
+MIIHOzCCBSOgAwIBAgIQVZHNRxiZp9LoR1nlajD1DDANBgkqhkiG9w0BAQsFADCB
+oTELMAkGA1UEBhMCR1IxNjA0BgNVBAoTLUhFTExFTklDIEVYQ0hBTkdFUyAtIEFU
+SEVOUyBTVE9DSyBFWENIQU5HRSBTQTEvMC0GA1UEAxMmQVRIRVggUXVhbGlmaWVk
+IFdFQiBDZXJ0aWZpY2F0ZXMgQ0EtRzMxDzANBgNVBAcTBkF0aGVuczEYMBYGA1UE
+YRMPVkFURUwtMDk5NzU1MTA4MB4XDTI0MDQxMTE0MTY1NVoXDTI1MDQxMTE0MTY1
+NVowgcMxCzAJBgNVBAYTAkdSMTYwNAYDVQQKEy1IRUxMRU5JQyBFWENIQU5HRVMg
+LSBBVEhFTlMgU1RPQ0sgRVhDSEFOR0UgU0ExGDAWBgNVBGETD1ZBVEVMLTA5OTc1
+NTEwODEdMBsGA1UEAxMUd2ViZHNzLmF0aGV4Z3JvdXAuZ3IxDzANBgNVBAcTBkF0
+aGVuczETMBEGCysGAQQBgjc8AgEDEwJHUjEdMBsGA1UEDxMUUHJpdmF0ZSBPcmdh
+bml6YXRpb24wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC4IRER3+RS
+dMkB84htWhzmrcFTqJ47yJtZAgvDxw0aWYWVtyW2SMtygVUZSfp5ewE8OA9tdCa6
+oIuap6hKgZpQnkxS9RP0JRyHrJjxOc4sUUtbOHMCV5hq4Lkonh01DAsad9tVqR4n
+aUSHsPI8v+93fjigi3vBsf5nGeBRrCTBYs8IKqoCC+Z2WWbwRCB6ct+ODsqbLwRx
+T54WY9iTaCNc/71rUlvIo3nkd/H17MCkoBdv4Ec3NG1Jo18FnkATyM12Xzhet+Wv
+vx0yjewRrFxak/wGZ4GGX1Dzy4wHfsceQjAtiZk2oWcn3/mk6oVA0ynF2a/4CmT1
+OZiWGOTqNnxTAgMBAAGjggJJMIICRTAnBgNVHSUEIDAeBggrBgEFBQcDAQYIKwYB
+BQUHAwIGCCsGAQUFBwMJMB8GA1UdIwQYMBaAFCKZJFcGbFZ1jtvrfXllnFM1qdGR
+MC0GCCsGAQUFBwEDBCEwHzAIBgYEAI5GAQEwEwYGBACORgEGMAkGBwQAjkYBBgMw
+gZcGCCsGAQUFBwEBBIGKMIGHMDgGCCsGAQUFBzABhixodHRwOi8vb2NzcC5hdGhl
+eGdyb3VwLmdyL0F0aGV4UXVhbGlmaWVkQ0FHMzBLBggrBgEFBQcwAoY/aHR0cDov
+L3JlcG8uYXRoZXhncm91cC5nci9BVEhFWFF1YWxpZmllZFdFQkNlcnRpZmljYXRl
+c0NBRzMuY3J0MCUGA1UdIAQeMBwwDwYNKwYBBAGB5VoBA2QBBDAJBgcEAIvsQAEG
+ME8GA1UdHwRIMEYwRKBCoECGPmh0dHA6Ly9jcmwuYXRoZXhncm91cC5nci9BVEhF
+WFF1YWxpZmllZFdFQkNlcnRpZmljYXRlc0NBRzMuY3JsMB0GA1UdDgQWBBTTtUYv
+oe4AMNQZ8CYtZhxVfi+obTAOBgNVHQ8BAf8EBAMCB4AwewYDVR0RBHQwcoIUd2Vi
+ZHNzLmF0aGV4Z3JvdXAuZ3KCGHdlYmRzc21vY2suYXRoZXhncm91cC5ncoIad2Vi
+ZHNzLXJweHIxLmluZXQuaGVsZXguZ3KCD2Rzcy5hdGhleG5ldC5ncoITZHNzbW9j
+ay5hdGhleG5ldC5ncjAMBgNVHRMBAf8EAjAAMA0GCSqGSIb3DQEBCwUAA4ICAQCZ
+eIbhKa9NYMahoRc5Am4WWFuPAb/sxkKHXwZ4SEh+Q4/QKW9qVAiYjyBsujUN5x8o
+MstctmlvtRMa2emQprZsNv4rJPKvcCmuD0v4qdfiMzop+u15mAM/rdNzEZeevcLc
+x/ljy9oW+WZrMAJEz+vzfSadSPXK8rxztmQhGGa3lrYLyUGgwUP6rXlCp1TS8riZ
+XvYQGL7FhG4CDsZVmg8z51mGI2bl28qMCJpo4bnxcqydp4MMIMNbCNEnubxjllo/
+ovygai28KaddSMlwCZITUyVcSOQewaQKqDBjpan+MOHgqlPx1Ci/WSDh0gpT082l
+0uOaaT8m/s8ywbuL7dDyUwId8J7o3EWdzcZnrbHoarp0qcioNDMy9hQ6cQ99Vx85
+paauYUBoF9UBd9FpdyAA8OSc0+AKR1uLnLC69thyQU5xWm/7W74qoNh3FQwJLFKm
+Wz6jQnpzfwVtya4V8HsFgHxxOC5w0AZQG6veS7oo7x8dzGk7fMu8D0jos2E6a8tf
+bh09GmsV3y4r4WJyI3FsDcKMMY1S0lQStEwbxFFRdg8AzS0X19mkqbdK6t68bTXI
+7yb8Byawy4qPMn0siV7uKhm0NzsLriV2hD4gQDVBHJGjyoOaXbmuC8Le9PJDhueB
+O6c898SxI7Tg1PvUbu9rcPJX9UZVsKeWSPuwgcg9Fg==
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.extensions.0.extnValue.extKeyUsageSyntax,SubscriberEkuAllowanceValidator,ERROR,cabf.serverauth.subscriber.ocspsigning_eku_present,
+certificate.tbsCertificate.extensions.6.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
diff --git a/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_final_certificate/prohibited_plabel_san.crttest b/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_final_certificate/prohibited_plabel_san.crttest
new file mode 100644
index 0000000..1338668
--- /dev/null
+++ b/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_final_certificate/prohibited_plabel_san.crttest
@@ -0,0 +1,48 @@
+-----BEGIN CERTIFICATE-----
+MIIHfTCCBWWgAwIBAgIQVZHNRxiZp9LoR1nlajD1DDANBgkqhkiG9w0BAQsFADCB
+oTELMAkGA1UEBhMCR1IxNjA0BgNVBAoTLUhFTExFTklDIEVYQ0hBTkdFUyAtIEFU
+SEVOUyBTVE9DSyBFWENIQU5HRSBTQTEvMC0GA1UEAxMmQVRIRVggUXVhbGlmaWVk
+IFdFQiBDZXJ0aWZpY2F0ZXMgQ0EtRzMxDzANBgNVBAcTBkF0aGVuczEYMBYGA1UE
+YRMPVkFURUwtMDk5NzU1MTA4MB4XDTI0MDQxMTE0MTY1NVoXDTI1MDQxMTE0MTY1
+NVowggEIMQswCQYDVQQGEwJHUjF7MHkGA1UEChNyTG9vb29vb29vb29vb29vb29v
+b29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29v
+b29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vbmcgY29tcGFueSBuYW1l
+MRgwFgYDVQRhEw9WQVRFTC0wOTk3NTUxMDgxHTAbBgNVBAMTFHdlYmRzcy5hdGhl
+eGdyb3VwLmdyMQ8wDQYDVQQHEwZBdGhlbnMxEzARBgsrBgEEAYI3PAIBAxMCR1Ix
+HTAbBgNVBA8TFFByaXZhdGUgT3JnYW5pemF0aW9uMIIBIjANBgkqhkiG9w0BAQEF
+AAOCAQ8AMIIBCgKCAQEAuCEREd/kUnTJAfOIbVoc5q3BU6ieO8ibWQILw8cNGlmF
+lbcltkjLcoFVGUn6eXsBPDgPbXQmuqCLmqeoSoGaUJ5MUvUT9CUch6yY8TnOLFFL
+WzhzAleYauC5KJ4dNQwLGnfbVakeJ2lEh7DyPL/vd344oIt7wbH+ZxngUawkwWLP
+CCqqAgvmdllm8EQgenLfjg7Kmy8EcU+eFmPYk2gjXP+9a1JbyKN55Hfx9ezApKAX
+b+BHNzRtSaNfBZ5AE8jNdl84Xrflr78dMo3sEaxcWpP8BmeBhl9Q88uMB37HHkIw
+LYmZNqFnJ9/5pOqFQNMpxdmv+Apk9TmYlhjk6jZ8UwIDAQABo4ICRTCCAkEwHQYD
+VR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMB8GA1UdIwQYMBaAFCKZJFcGbFZ1
+jtvrfXllnFM1qdGRMC0GCCsGAQUFBwEDBCEwHzAIBgYEAI5GAQEwEwYGBACORgEG
+MAkGBwQAjkYBBgMwgZcGCCsGAQUFBwEBBIGKMIGHMDgGCCsGAQUFBzABhixodHRw
+Oi8vb2NzcC5hdGhleGdyb3VwLmdyL0F0aGV4UXVhbGlmaWVkQ0FHMzBLBggrBgEF
+BQcwAoY/aHR0cDovL3JlcG8uYXRoZXhncm91cC5nci9BVEhFWFF1YWxpZmllZFdF
+QkNlcnRpZmljYXRlc0NBRzMuY3J0MCUGA1UdIAQeMBwwDwYNKwYBBAGB5VoBA2QB
+BDAJBgcEAIvsQAEGME8GA1UdHwRIMEYwRKBCoECGPmh0dHA6Ly9jcmwuYXRoZXhn
+cm91cC5nci9BVEhFWFF1YWxpZmllZFdFQkNlcnRpZmljYXRlc0NBRzMuY3JsMB0G
+A1UdDgQWBBTTtUYvoe4AMNQZ8CYtZhxVfi+obTAOBgNVHQ8BAf8EBAMCB4AwgYAG
+A1UdEQR5MHeCGXhuLS1qcmlncmcteG4uZXhhbXBsZS5jb22CGHdlYmRzc21vY2su
+YXRoZXhncm91cC5ncoIad2ViZHNzLXJweHIxLmluZXQuaGVsZXguZ3KCD2Rzcy5h
+dGhleG5ldC5ncoITZHNzbW9jay5hdGhleG5ldC5ncjAMBgNVHRMBAf8EAjAAMA0G
+CSqGSIb3DQEBCwUAA4ICAQCZeIbhKa9NYMahoRc5Am4WWFuPAb/sxkKHXwZ4SEh+
+Q4/QKW9qVAiYjyBsujUN5x8oMstctmlvtRMa2emQprZsNv4rJPKvcCmuD0v4qdfi
+Mzop+u15mAM/rdNzEZeevcLcx/ljy9oW+WZrMAJEz+vzfSadSPXK8rxztmQhGGa3
+lrYLyUGgwUP6rXlCp1TS8riZXvYQGL7FhG4CDsZVmg8z51mGI2bl28qMCJpo4bnx
+cqydp4MMIMNbCNEnubxjllo/ovygai28KaddSMlwCZITUyVcSOQewaQKqDBjpan+
+MOHgqlPx1Ci/WSDh0gpT082l0uOaaT8m/s8ywbuL7dDyUwId8J7o3EWdzcZnrbHo
+arp0qcioNDMy9hQ6cQ99Vx85paauYUBoF9UBd9FpdyAA8OSc0+AKR1uLnLC69thy
+QU5xWm/7W74qoNh3FQwJLFKmWz6jQnpzfwVtya4V8HsFgHxxOC5w0AZQG6veS7oo
+7x8dzGk7fMu8D0jos2E6a8tfbh09GmsV3y4r4WJyI3FsDcKMMY1S0lQStEwbxFFR
+dg8AzS0X19mkqbdK6t68bTXI7yb8Byawy4qPMn0siV7uKhm0NzsLriV2hD4gQDVB
+HJGjyoOaXbmuC8Le9PJDhueBO6c898SxI7Tg1PvUbu9rcPJX9UZVsKeWSPuwgcg9
+Fg==
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.extensions.6.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
+certificate.tbsCertificate.subject.rdnSequence.3.0.value.x520CommonName,NcpWCommonNameValidator,ERROR,etsi.en_319_412_4.web-4.1.3-4.common_name_unknown_source,"Unknown source for value of common name: ""webdss.athexgroup.gr"""
+certificate.tbsCertificate.extensions.8.extnValue.subjectAltName.0.dNSName,DnsNameLdhLabelSyntaxValidator,ERROR,cabf.serverauth.invalid_plabel_encoding,"Invalid P-Label ""xn--jrigrg-xn"" in domain name ""xn--jrigrg-xn.example.com"""
diff --git a/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_final_certificate/prohibited_reservered_label_san.crttest b/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_final_certificate/prohibited_reservered_label_san.crttest
new file mode 100644
index 0000000..6091a6a
--- /dev/null
+++ b/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_final_certificate/prohibited_reservered_label_san.crttest
@@ -0,0 +1,50 @@
+-----BEGIN CERTIFICATE-----
+MIIHvjCCBaagAwIBAgIQVZHNRxiZp9LoR1nlajD1DDANBgkqhkiG9w0BAQsFADCB
+oTELMAkGA1UEBhMCR1IxNjA0BgNVBAoTLUhFTExFTklDIEVYQ0hBTkdFUyAtIEFU
+SEVOUyBTVE9DSyBFWENIQU5HRSBTQTEvMC0GA1UEAxMmQVRIRVggUXVhbGlmaWVk
+IFdFQiBDZXJ0aWZpY2F0ZXMgQ0EtRzMxDzANBgNVBAcTBkF0aGVuczEYMBYGA1UE
+YRMPVkFURUwtMDk5NzU1MTA4MB4XDTI0MDQxMTE0MTY1NVoXDTI1MDQxMTE0MTY1
+NVowggEIMQswCQYDVQQGEwJHUjF7MHkGA1UEChNyTG9vb29vb29vb29vb29vb29v
+b29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29v
+b29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vbmcgY29tcGFueSBuYW1l
+MRgwFgYDVQRhEw9WQVRFTC0wOTk3NTUxMDgxHTAbBgNVBAMTFHdlYmRzcy5hdGhl
+eGdyb3VwLmdyMQ8wDQYDVQQHEwZBdGhlbnMxEzARBgsrBgEEAYI3PAIBAxMCR1Ix
+HTAbBgNVBA8TFFByaXZhdGUgT3JnYW5pemF0aW9uMIIBIjANBgkqhkiG9w0BAQEF
+AAOCAQ8AMIIBCgKCAQEAuCEREd/kUnTJAfOIbVoc5q3BU6ieO8ibWQILw8cNGlmF
+lbcltkjLcoFVGUn6eXsBPDgPbXQmuqCLmqeoSoGaUJ5MUvUT9CUch6yY8TnOLFFL
+WzhzAleYauC5KJ4dNQwLGnfbVakeJ2lEh7DyPL/vd344oIt7wbH+ZxngUawkwWLP
+CCqqAgvmdllm8EQgenLfjg7Kmy8EcU+eFmPYk2gjXP+9a1JbyKN55Hfx9ezApKAX
+b+BHNzRtSaNfBZ5AE8jNdl84Xrflr78dMo3sEaxcWpP8BmeBhl9Q88uMB37HHkIw
+LYmZNqFnJ9/5pOqFQNMpxdmv+Apk9TmYlhjk6jZ8UwIDAQABo4IChjCCAoIwHQYD
+VR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMB8GA1UdIwQYMBaAFCKZJFcGbFZ1
+jtvrfXllnFM1qdGRMC0GCCsGAQUFBwEDBCEwHzAIBgYEAI5GAQEwEwYGBACORgEG
+MAkGBwQAjkYBBgMwgZcGCCsGAQUFBwEBBIGKMIGHMDgGCCsGAQUFBzABhixodHRw
+Oi8vb2NzcC5hdGhleGdyb3VwLmdyL0F0aGV4UXVhbGlmaWVkQ0FHMzBLBggrBgEF
+BQcwAoY/aHR0cDovL3JlcG8uYXRoZXhncm91cC5nci9BVEhFWFF1YWxpZmllZFdF
+QkNlcnRpZmljYXRlc0NBRzMuY3J0MCUGA1UdIAQeMBwwDwYNKwYBBAGB5VoBA2QB
+BDAJBgcEAIvsQAEGME8GA1UdHwRIMEYwRKBCoECGPmh0dHA6Ly9jcmwuYXRoZXhn
+cm91cC5nci9BVEhFWFF1YWxpZmllZFdFQkNlcnRpZmljYXRlc0NBRzMuY3JsMB0G
+A1UdDgQWBBTTtUYvoe4AMNQZ8CYtZhxVfi+obTAOBgNVHQ8BAf8EBAMCB4AwgcEG
+A1UdEQSBuTCBtoIqYmxvZy44LS0ta2k0YjFhd3cyZjVnOGI1ZTRqdGEuZmF0ZWdv
+LnRva3lvgix3d3cuYmxvZy44LS0ta2k0YjFhMmY1ZzhiNWU0anRhLmZhdGVnby50
+b2t5b4IYd2ViZHNzbW9jay5hdGhleGdyb3VwLmdyghp3ZWJkc3MtcnB4cjEuaW5l
+dC5oZWxleC5ncoIPZHNzLmF0aGV4bmV0LmdyghNkc3Ntb2NrLmF0aGV4bmV0Lmdy
+MAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADggIBAJl4huEpr01gxqGhFzkC
+bhZYW48Bv+zGQodfBnhISH5Dj9Apb2pUCJiPIGy6NQ3nHygyy1y2aW+1ExrZ6ZCm
+tmw2/isk8q9wKa4PS/ip1+IzOin67XmYAz+t03MRl569wtzH+WPL2hb5ZmswAkTP
+6/N9Jp1I9cryvHO2ZCEYZreWtgvJQaDBQ/qteUKnVNLyuJle9hAYvsWEbgIOxlWa
+DzPnWYYjZuXbyowImmjhufFyrJ2ngwwgw1sI0Se5vGOWWj+i/KBqLbwpp11IyXAJ
+khNTJVxI5B7BpAqoMGOlqf4w4eCqU/HUKL9ZIOHSClPTzaXS45ppPyb+zzLBu4vt
+0PJTAh3wnujcRZ3NxmetsehqunSpyKg0MzL2FDpxD31XHzmlpq5hQGgX1QF30Wl3
+IADw5JzT4ApHW4ucsLr22HJBTnFab/tbviqg2HcVDAksUqZbPqNCenN/BW3JrhXw
+ewWAfHE4LnDQBlAbq95LuijvHx3MaTt8y7wPSOizYTpry19uHT0aaxXfLivhYnIj
+cWwNwowxjVLSVBK0TBvEUVF2DwDNLRfX2aSpt0rq3rxtNcjvJvwHJrDLio8yfSyJ
+Xu4qGbQ3OwuuJXaEPiBANUEckaPKg5pdua4Lwt708kOG54E7pzz3xLEjtODU+9Ru
+72tw8lf1RlWwp5ZI+7CByD0W
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.extensions.6.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
+certificate.tbsCertificate.subject.rdnSequence.3.0.value.x520CommonName,NcpWCommonNameValidator,ERROR,etsi.en_319_412_4.web-4.1.3-4.common_name_unknown_source,"Unknown source for value of common name: ""webdss.athexgroup.gr"""
+certificate.tbsCertificate.extensions.8.extnValue.subjectAltName.0.dNSName,DnsNameLdhLabelSyntaxValidator,ERROR,cabf.serverauth.dnsname_contains_prohibited_reserved_label,"Invalid reserved label ""8---ki4b1aww2f5g8b5e4jta"" with tag ""8-"" in domain name ""blog.8---ki4b1aww2f5g8b5e4jta.fatego.tokyo"""
+certificate.tbsCertificate.extensions.8.extnValue.subjectAltName.1.dNSName,DnsNameLdhLabelSyntaxValidator,ERROR,cabf.serverauth.dnsname_contains_prohibited_reserved_label,"Invalid reserved label ""8---ki4b1a2f5g8b5e4jta"" with tag ""8-"" in domain name ""www.blog.8---ki4b1a2f5g8b5e4jta.fatego.tokyo"""
diff --git a/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_final_certificate/prohibited_san_type.crttest b/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_final_certificate/prohibited_san_type.crttest
new file mode 100644
index 0000000..59fb297
--- /dev/null
+++ b/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_final_certificate/prohibited_san_type.crttest
@@ -0,0 +1,49 @@
+-----BEGIN CERTIFICATE-----
+MIIHqjCCBZKgAwIBAgIQVZHNRxiZp9LoR1nlajD1DDANBgkqhkiG9w0BAQsFADCB
+oTELMAkGA1UEBhMCR1IxNjA0BgNVBAoTLUhFTExFTklDIEVYQ0hBTkdFUyAtIEFU
+SEVOUyBTVE9DSyBFWENIQU5HRSBTQTEvMC0GA1UEAxMmQVRIRVggUXVhbGlmaWVk
+IFdFQiBDZXJ0aWZpY2F0ZXMgQ0EtRzMxDzANBgNVBAcTBkF0aGVuczEYMBYGA1UE
+YRMPVkFURUwtMDk5NzU1MTA4MB4XDTI0MDQxMTE0MTY1NVoXDTI1MDQxMTE0MTY1
+NVowggEIMQswCQYDVQQGEwJHUjF7MHkGA1UEChNyTG9vb29vb29vb29vb29vb29v
+b29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29v
+b29vb29vb29vb29vb29vb29vb29vb29vb29vb29vb29vbmcgY29tcGFueSBuYW1l
+MRgwFgYDVQRhEw9WQVRFTC0wOTk3NTUxMDgxHTAbBgNVBAMTFHdlYmRzcy5hdGhl
+eGdyb3VwLmdyMQ8wDQYDVQQHEwZBdGhlbnMxEzARBgsrBgEEAYI3PAIBAxMCR1Ix
+HTAbBgNVBA8TFFByaXZhdGUgT3JnYW5pemF0aW9uMIIBIjANBgkqhkiG9w0BAQEF
+AAOCAQ8AMIIBCgKCAQEAuCEREd/kUnTJAfOIbVoc5q3BU6ieO8ibWQILw8cNGlmF
+lbcltkjLcoFVGUn6eXsBPDgPbXQmuqCLmqeoSoGaUJ5MUvUT9CUch6yY8TnOLFFL
+WzhzAleYauC5KJ4dNQwLGnfbVakeJ2lEh7DyPL/vd344oIt7wbH+ZxngUawkwWLP
+CCqqAgvmdllm8EQgenLfjg7Kmy8EcU+eFmPYk2gjXP+9a1JbyKN55Hfx9ezApKAX
+b+BHNzRtSaNfBZ5AE8jNdl84Xrflr78dMo3sEaxcWpP8BmeBhl9Q88uMB37HHkIw
+LYmZNqFnJ9/5pOqFQNMpxdmv+Apk9TmYlhjk6jZ8UwIDAQABo4ICcjCCAm4wHQYD
+VR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMB8GA1UdIwQYMBaAFCKZJFcGbFZ1
+jtvrfXllnFM1qdGRMC0GCCsGAQUFBwEDBCEwHzAIBgYEAI5GAQEwEwYGBACORgEG
+MAkGBwQAjkYBBgMwgZcGCCsGAQUFBwEBBIGKMIGHMDgGCCsGAQUFBzABhixodHRw
+Oi8vb2NzcC5hdGhleGdyb3VwLmdyL0F0aGV4UXVhbGlmaWVkQ0FHMzBLBggrBgEF
+BQcwAoY/aHR0cDovL3JlcG8uYXRoZXhncm91cC5nci9BVEhFWFF1YWxpZmllZFdF
+QkNlcnRpZmljYXRlc0NBRzMuY3J0MCUGA1UdIAQeMBwwDwYNKwYBBAGB5VoBA2QB
+BDAJBgcEAIvsQAEGME8GA1UdHwRIMEYwRKBCoECGPmh0dHA6Ly9jcmwuYXRoZXhn
+cm91cC5nci9BVEhFWFF1YWxpZmllZFdFQkNlcnRpZmljYXRlc0NBRzMuY3JsMB0G
+A1UdDgQWBBTTtUYvoe4AMNQZ8CYtZhxVfi+obTAOBgNVHQ8BAf8EBAMCB4Awga0G
+A1UdEQSBpTCBooEWcG9zdG1hc3RlckBleGFtcGxlLmNvbYIsd3d3LmJsb2cuOC0t
+LWtpNGIxYTJmNWc4YjVlNGp0YS5mYXRlZ28udG9reW+CGHdlYmRzc21vY2suYXRo
+ZXhncm91cC5ncoIad2ViZHNzLXJweHIxLmluZXQuaGVsZXguZ3KCD2Rzcy5hdGhl
+eG5ldC5ncoITZHNzbW9jay5hdGhleG5ldC5ncjAMBgNVHRMBAf8EAjAAMA0GCSqG
+SIb3DQEBCwUAA4ICAQCZeIbhKa9NYMahoRc5Am4WWFuPAb/sxkKHXwZ4SEh+Q4/Q
+KW9qVAiYjyBsujUN5x8oMstctmlvtRMa2emQprZsNv4rJPKvcCmuD0v4qdfiMzop
++u15mAM/rdNzEZeevcLcx/ljy9oW+WZrMAJEz+vzfSadSPXK8rxztmQhGGa3lrYL
+yUGgwUP6rXlCp1TS8riZXvYQGL7FhG4CDsZVmg8z51mGI2bl28qMCJpo4bnxcqyd
+p4MMIMNbCNEnubxjllo/ovygai28KaddSMlwCZITUyVcSOQewaQKqDBjpan+MOHg
+qlPx1Ci/WSDh0gpT082l0uOaaT8m/s8ywbuL7dDyUwId8J7o3EWdzcZnrbHoarp0
+qcioNDMy9hQ6cQ99Vx85paauYUBoF9UBd9FpdyAA8OSc0+AKR1uLnLC69thyQU5x
+Wm/7W74qoNh3FQwJLFKmWz6jQnpzfwVtya4V8HsFgHxxOC5w0AZQG6veS7oo7x8d
+zGk7fMu8D0jos2E6a8tfbh09GmsV3y4r4WJyI3FsDcKMMY1S0lQStEwbxFFRdg8A
+zS0X19mkqbdK6t68bTXI7yb8Byawy4qPMn0siV7uKhm0NzsLriV2hD4gQDVBHJGj
+yoOaXbmuC8Le9PJDhueBO6c898SxI7Tg1PvUbu9rcPJX9UZVsKeWSPuwgcg9Fg==
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.extensions.6.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
+certificate.tbsCertificate.subject.rdnSequence.3.0.value.x520CommonName,NcpWCommonNameValidator,ERROR,etsi.en_319_412_4.web-4.1.3-4.common_name_unknown_source,"Unknown source for value of common name: ""webdss.athexgroup.gr"""
+certificate.tbsCertificate.extensions.8.extnValue.subjectAltName.0,SubscriberSanGeneralNameTypeValidator,ERROR,cabf.serverauth.prohibited_san_type,Prohibited SAN GeneralName type: rfc822Name
+certificate.tbsCertificate.extensions.8.extnValue.subjectAltName.1.dNSName,DnsNameLdhLabelSyntaxValidator,ERROR,cabf.serverauth.dnsname_contains_prohibited_reserved_label,"Invalid reserved label ""8---ki4b1a2f5g8b5e4jta"" with tag ""8-"" in domain name ""www.blog.8---ki4b1a2f5g8b5e4jta.fatego.tokyo"""
diff --git a/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_final_certificate/rsapss_bad_salt_length.crttest b/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_final_certificate/rsapss_bad_salt_length.crttest
new file mode 100644
index 0000000..7758b09
--- /dev/null
+++ b/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_final_certificate/rsapss_bad_salt_length.crttest
@@ -0,0 +1,37 @@
+-----BEGIN CERTIFICATE-----
+MIIENjCCAuqgAwIBAgIUUR5IbqRXwzH/R8S5DC76hBSbIqQwQQYJKoZIhvcNAQEK
+MDSgDzANBglghkgBZQMEAgEFAKEcMBoGCSqGSIb3DQEBCDANBglghkgBZQMEAgEF
+AKIDAgEVMHAxCzAJBgNVBAYTAkdCMRkwFwYDVQQKExBBc2NlcnRpYSBMaW1pdGVk
+MScwJQYDVQQLEx5Bc2NlcnRpYSBTb2Z0d2FyZSBEaXN0cmlidXRpb24xHTAbBgNV
+BAMTFEFEU1MgU2FtcGxlcyBUZXN0IENBMB4XDTIzMTEyMTEyMjMwNFoXDTI0MTEy
+MTEyMjMwNFowRDELMAkGA1UEBhMCR0IxETAPBgNVBAoTCEFzY2VydGlhMRQwEgYD
+VQQLEwtEZXZlbG9wbWVudDEMMAoGA1UEAxMDc2N0MIIBIjANBgkqhkiG9w0BAQEF
+AAOCAQ8AMIIBCgKCAQEAkZuPPnjDa0dBIlKH/0jqqka+Wiw51Z7nWL0mnk1vb0+l
+/zMZfL8YJBlctgv5XlTSz6ssAkAsY7p6PXCMq2/AJTzjlCZKZSLP2pxC/V7ZFtgU
+mDUuD4qT6a5xM6nz0r434SpAZPNysONSL6D9TkbKaFi8zIf0/6xLlb6AhhJkYf70
+65kErkG4960Cxq0zB/MlLX+60IncIH4w4NuMRLg+0ZEOr/o3UwP9055BjBX5FNSE
+en40G9VgXiNB5F0Xk+IH9cV+YCaz4zCB+3Rynnk46GtoFFqGVf7cOjqNzzTrt5xy
+/Q8w5a6oUC0ufl/Yp5irg7fqMwBf5Yus8v/GD94RcwIDAQABo4GLMIGIMBMGCisG
+AQQB1nkCBAMBAf8EAgUAMA4GA1UdDwEB/wQEAwIF4DAMBgNVHRMBAf8EAjAAMB8G
+A1UdIwQYMBaAFDrxBcEMB/klj4Byt5Xqk1CJffAXMB0GA1UdDgQWBBSoPHH8AQPw
+0bghLycnLUTJSEpEozATBgNVHSUEDDAKBggrBgEFBQcDATBBBgkqhkiG9w0BAQow
+NKAPMA0GCWCGSAFlAwQCAQUAoRwwGgYJKoZIhvcNAQEIMA0GCWCGSAFlAwQCAQUA
+ogMCARUDggEBAKoxmT9MxzWiMaM2xdB2c3jHT/IdedAsMkxUq7ZVeFk4w6HKkkNh
+up6z/Dwe/880lAWIN+3y0uxserfKFZ0BfTH5kFuD55nN095D9Z75JV75W7bIpjlS
+6k+0gdXtl0kxn+jPIoqTOTN6F//J/aqoZrK6O8/RNLQ8LvJHeqNx7uTvgTmxT1aT
+YDkAUJ/qZQJ0KbXeTXy5gEgstBrkfdRy1+ql4rsKBdfDmTfwciVUGDSdryGHB3Aj
+xR5E2xWwARVuChj3u6X6pOgceCNNprkEUeBsKieTs47zgBTMoxAScpauVDJtMlbo
+uZLGFrTln/bm6pTbuZqQsySTpc9ZqghNGfE=
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.signature,AllowedSignatureAlgorithmValidator,NOTICE,etsi.en_319_412_2.gen-4.2.2-1.discouraged_signature_algorithm,Prohibited encoding: 304106092a864886f70d01010a3034a00f300d06096086480165030402010500a11c301a06092a864886f70d010108300d06096086480165030402010500a203020115
+certificate.tbsCertificate.subject.rdnSequence,LegalPersonSubjectAttributeAllowanceValidator,ERROR,etsi.en_319_412_3.leg-4.2.1-2.organization_identifier_attribute_absent,
+certificate.tbsCertificate.extensions,NaturalPersonExtensionIdentifierAllowanceValidator,ERROR,etsi.en_319_412_2.certificate_policies_extension_absent,
+certificate.tbsCertificate.extensions,NaturalPersonExtensionIdentifierAllowanceValidator,ERROR,etsi.en_319_412_2.authority_info_access_extension_absent,
+certificate.tbsCertificate.extensions,CrlDistributionPointsExtensionPresenceValidator,ERROR,etsi.en_319_412_2.gen-4.3.11-2.crldp_extension_missing,
+certificate.tbsCertificate.extensions.1.extnValue.keyUsage,LegalPersonKeyUsageValidator,WARNING,etsi.en_319_412_2.nat-4.3.2-1.mixed_key_usage_setting,
+certificate.tbsCertificate.extensions.4.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
+certificate.tbsCertificate.extensions,NaturalPersonExtensionIdentifierAllowanceValidator,ERROR,etsi.en_319_412_2.qc_statements_extension_absent,
+certificate.tbsCertificate.extensions,NcpWSubjectAltNamePresenceValidator,ERROR,etsi.en_319_412_4.web-4.1.3-4.san_missing,
+certificate.tbsCertificate.subject.rdnSequence.3.0.value.x520CommonName,NcpWCommonNameValidator,ERROR,etsi.en_319_412_4.web-4.1.3-4.common_name_unknown_source,"Unknown source for value of common name: ""sct"""
diff --git a/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_final_certificate/rsapss_sig_alg.crttest b/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_final_certificate/rsapss_sig_alg.crttest
new file mode 100644
index 0000000..4b7f07f
--- /dev/null
+++ b/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_final_certificate/rsapss_sig_alg.crttest
@@ -0,0 +1,36 @@
+-----BEGIN CERTIFICATE-----
+MIIENjCCAuqgAwIBAgIUUR5IbqRXwzH/R8S5DC76hBSbIqQwQQYJKoZIhvcNAQEK
+MDSgDzANBglghkgBZQMEAgEFAKEcMBoGCSqGSIb3DQEBCDANBglghkgBZQMEAgEF
+AKIDAgEgMHAxCzAJBgNVBAYTAkdCMRkwFwYDVQQKExBBc2NlcnRpYSBMaW1pdGVk
+MScwJQYDVQQLEx5Bc2NlcnRpYSBTb2Z0d2FyZSBEaXN0cmlidXRpb24xHTAbBgNV
+BAMTFEFEU1MgU2FtcGxlcyBUZXN0IENBMB4XDTIzMTEyMTEyMjMwNFoXDTI0MTEy
+MTEyMjMwNFowRDELMAkGA1UEBhMCR0IxETAPBgNVBAoTCEFzY2VydGlhMRQwEgYD
+VQQLEwtEZXZlbG9wbWVudDEMMAoGA1UEAxMDc2N0MIIBIjANBgkqhkiG9w0BAQEF
+AAOCAQ8AMIIBCgKCAQEAkZuPPnjDa0dBIlKH/0jqqka+Wiw51Z7nWL0mnk1vb0+l
+/zMZfL8YJBlctgv5XlTSz6ssAkAsY7p6PXCMq2/AJTzjlCZKZSLP2pxC/V7ZFtgU
+mDUuD4qT6a5xM6nz0r434SpAZPNysONSL6D9TkbKaFi8zIf0/6xLlb6AhhJkYf70
+65kErkG4960Cxq0zB/MlLX+60IncIH4w4NuMRLg+0ZEOr/o3UwP9055BjBX5FNSE
+en40G9VgXiNB5F0Xk+IH9cV+YCaz4zCB+3Rynnk46GtoFFqGVf7cOjqNzzTrt5xy
+/Q8w5a6oUC0ufl/Yp5irg7fqMwBf5Yus8v/GD94RcwIDAQABo4GLMIGIMBMGCisG
+AQQB1nkCBAMBAf8EAgUAMA4GA1UdDwEB/wQEAwIF4DAMBgNVHRMBAf8EAjAAMB8G
+A1UdIwQYMBaAFDrxBcEMB/klj4Byt5Xqk1CJffAXMB0GA1UdDgQWBBSoPHH8AQPw
+0bghLycnLUTJSEpEozATBgNVHSUEDDAKBggrBgEFBQcDATBBBgkqhkiG9w0BAQow
+NKAPMA0GCWCGSAFlAwQCAQUAoRwwGgYJKoZIhvcNAQEIMA0GCWCGSAFlAwQCAQUA
+ogMCASADggEBAKoxmT9MxzWiMaM2xdB2c3jHT/IdedAsMkxUq7ZVeFk4w6HKkkNh
+up6z/Dwe/880lAWIN+3y0uxserfKFZ0BfTH5kFuD55nN095D9Z75JV75W7bIpjlS
+6k+0gdXtl0kxn+jPIoqTOTN6F//J/aqoZrK6O8/RNLQ8LvJHeqNx7uTvgTmxT1aT
+YDkAUJ/qZQJ0KbXeTXy5gEgstBrkfdRy1+ql4rsKBdfDmTfwciVUGDSdryGHB3Aj
+xR5E2xWwARVuChj3u6X6pOgceCNNprkEUeBsKieTs47zgBTMoxAScpauVDJtMlbo
+uZLGFrTln/bm6pTbuZqQsySTpc9ZqghNGfE=
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.subject.rdnSequence,LegalPersonSubjectAttributeAllowanceValidator,ERROR,etsi.en_319_412_3.leg-4.2.1-2.organization_identifier_attribute_absent,
+certificate.tbsCertificate.extensions,NaturalPersonExtensionIdentifierAllowanceValidator,ERROR,etsi.en_319_412_2.certificate_policies_extension_absent,
+certificate.tbsCertificate.extensions,NaturalPersonExtensionIdentifierAllowanceValidator,ERROR,etsi.en_319_412_2.authority_info_access_extension_absent,
+certificate.tbsCertificate.extensions,CrlDistributionPointsExtensionPresenceValidator,ERROR,etsi.en_319_412_2.gen-4.3.11-2.crldp_extension_missing,
+certificate.tbsCertificate.extensions.1.extnValue.keyUsage,LegalPersonKeyUsageValidator,WARNING,etsi.en_319_412_2.nat-4.3.2-1.mixed_key_usage_setting,
+certificate.tbsCertificate.extensions.4.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
+certificate.tbsCertificate.extensions,NaturalPersonExtensionIdentifierAllowanceValidator,ERROR,etsi.en_319_412_2.qc_statements_extension_absent,
+certificate.tbsCertificate.subject.rdnSequence.3.0.value.x520CommonName,NcpWCommonNameValidator,ERROR,etsi.en_319_412_4.web-4.1.3-4.common_name_unknown_source,"Unknown source for value of common name: ""sct"""
+certificate.tbsCertificate.extensions,NcpWSubjectAltNamePresenceValidator,ERROR,etsi.en_319_412_4.web-4.1.3-4.san_missing,
diff --git a/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_final_certificate/small_rsa_key.crttest b/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_final_certificate/small_rsa_key.crttest
new file mode 100644
index 0000000..093d493
--- /dev/null
+++ b/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_final_certificate/small_rsa_key.crttest
@@ -0,0 +1,45 @@
+-----BEGIN CERTIFICATE-----
+MIIG7jCCBNagAwIBAgIQVZHNRxiZp9LoR1nlajD1DDANBgkqhkiG9w0BAQsFADCB
+oTELMAkGA1UEBhMCR1IxNjA0BgNVBAoTLUhFTExFTklDIEVYQ0hBTkdFUyAtIEFU
+SEVOUyBTVE9DSyBFWENIQU5HRSBTQTEvMC0GA1UEAxMmQVRIRVggUXVhbGlmaWVk
+IFdFQiBDZXJ0aWZpY2F0ZXMgQ0EtRzMxDzANBgNVBAcTBkF0aGVuczEYMBYGA1UE
+YRMPVkFURUwtMDk5NzU1MTA4MB4XDTI0MDQxMTE0MTY1NVoXDTI1MDQxMTE0MTY1
+NVowgcMxCzAJBgNVBAYTAkdSMTYwNAYDVQQKEy1IRUxMRU5JQyBFWENIQU5HRVMg
+LSBBVEhFTlMgU1RPQ0sgRVhDSEFOR0UgU0ExGDAWBgNVBGETD1ZBVEVMLTA5OTc1
+NTEwODEdMBsGA1UEAxMUd2ViZHNzLmF0aGV4Z3JvdXAuZ3IxDzANBgNVBAcTBkF0
+aGVuczETMBEGCysGAQQBgjc8AgEDEwJHUjEdMBsGA1UEDxMUUHJpdmF0ZSBPcmdh
+bml6YXRpb24wgeAwDQYJKoZIhvcNAQEBBQADgc4AMIHKAoHEALghERHf5FJ0yQHz
+iG1aHOatwVOonjvIm1kCC8PHDRpZhZW3JbZIy3KBVRlJ+nl7AT/vd344oIt7wbH+
+ZxngUawkwWLPCCqqAgvmdllm8EQgenLfjg7Kmy8EcU+eFmPYk2gjXP+9a1JbyKN5
+5Hfx9ezApKAXb+BHNzRtSaNfBZ5AE8jNdl84Xrflr78dMo3sEaxcWpP8BmeBhl9Q
+88uMB37HHkIwLYmZNqFnJ9/5pOqFQNMpxdmv+Apk9TmYlhjk6jZ8UwIBA6OCAj8w
+ggI7MB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAfBgNVHSMEGDAWgBQi
+mSRXBmxWdY7b6315ZZxTNanRkTAtBggrBgEFBQcBAwQhMB8wCAYGBACORgEBMBMG
+BgQAjkYBBjAJBgcEAI5GAQYDMIGXBggrBgEFBQcBAQSBijCBhzA4BggrBgEFBQcw
+AYYsaHR0cDovL29jc3AuYXRoZXhncm91cC5nci9BdGhleFF1YWxpZmllZENBRzMw
+SwYIKwYBBQUHMAKGP2h0dHA6Ly9yZXBvLmF0aGV4Z3JvdXAuZ3IvQVRIRVhRdWFs
+aWZpZWRXRUJDZXJ0aWZpY2F0ZXNDQUczLmNydDAlBgNVHSAEHjAcMA8GDSsGAQQB
+geVaAQNkAQQwCQYHBACL7EABBjBPBgNVHR8ESDBGMESgQqBAhj5odHRwOi8vY3Js
+LmF0aGV4Z3JvdXAuZ3IvQVRIRVhRdWFsaWZpZWRXRUJDZXJ0aWZpY2F0ZXNDQUcz
+LmNybDAdBgNVHQ4EFgQU07VGL6HuADDUGfAmLWYcVX4vqG0wDgYDVR0PAQH/BAQD
+AgeAMHsGA1UdEQR0MHKCFHdlYmRzcy5hdGhleGdyb3VwLmdyghh3ZWJkc3Ntb2Nr
+LmF0aGV4Z3JvdXAuZ3KCGndlYmRzcy1ycHhyMS5pbmV0LmhlbGV4Lmdygg9kc3Mu
+YXRoZXhuZXQuZ3KCE2Rzc21vY2suYXRoZXhuZXQuZ3IwDAYDVR0TAQH/BAIwADAN
+BgkqhkiG9w0BAQsFAAOCAgEAmXiG4SmvTWDGoaEXOQJuFlhbjwG/7MZCh18GeEhI
+fkOP0ClvalQImI8gbLo1DecfKDLLXLZpb7UTGtnpkKa2bDb+KyTyr3Aprg9L+KnX
+4jM6KfrteZgDP63TcxGXnr3C3Mf5Y8vaFvlmazACRM/r830mnUj1yvK8c7ZkIRhm
+t5a2C8lBoMFD+q15QqdU0vK4mV72EBi+xYRuAg7GVZoPM+dZhiNm5dvKjAiaaOG5
+8XKsnaeDDCDDWwjRJ7m8Y5ZaP6L8oGotvCmnXUjJcAmSE1MlXEjkHsGkCqgwY6Wp
+/jDh4KpT8dQov1kg4dIKU9PNpdLjmmk/Jv7PMsG7i+3Q8lMCHfCe6NxFnc3GZ62x
+6Gq6dKnIqDQzMvYUOnEPfVcfOaWmrmFAaBfVAXfRaXcgAPDknNPgCkdbi5ywuvbY
+ckFOcVpv+1u+KqDYdxUMCSxSpls+o0J6c38FbcmuFfB7BYB8cTgucNAGUBur3ku6
+KO8fHcxpO3zLvA9I6LNhOmvLX24dPRprFd8uK+FiciNxbA3CjDGNUtJUErRMG8RR
+UXYPAM0tF9fZpKm3SurevG01yO8m/AcmsMuKjzJ9LIle7ioZtDc7C64ldoQ+IEA1
+QRyRo8qDml25rgvC3vTyQ4bngTunPPfEsSO04NT71G7va3DyV/VGVbCnlkj7sIHI
+PRY=
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.subjectPublicKeyInfo.subjectPublicKey.rSAPublicKey,RsaKeyValidator,NOTICE,ts_119_312.8.4.rsa_small_modulus,RSA public key has a modulus length of 1560 bits
+certificate.tbsCertificate.subjectPublicKeyInfo.subjectPublicKey.rSAPublicKey,RsaKeyValidator,NOTICE,ts_119_312.6.2.2.1.rsa_exponent_of_range,RSA public key has an exponent of 3
+certificate.tbsCertificate.extensions.6.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,NOTICE,pkix.unknown_subject_key_identifier_calculation_method,
diff --git a/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_final_certificate/unknown_common_name_value.crttest b/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_final_certificate/unknown_common_name_value.crttest
new file mode 100644
index 0000000..16e6221
--- /dev/null
+++ b/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_final_certificate/unknown_common_name_value.crttest
@@ -0,0 +1,45 @@
+-----BEGIN CERTIFICATE-----
+MIIHJDCCBQygAwIBAgIQVZHNRxiZp9LoR1nlajD1DDANBgkqhkiG9w0BAQsFADCB
+oTELMAkGA1UEBhMCR1IxNjA0BgNVBAoTLUhFTExFTklDIEVYQ0hBTkdFUyAtIEFU
+SEVOUyBTVE9DSyBFWENIQU5HRSBTQTEvMC0GA1UEAxMmQVRIRVggUXVhbGlmaWVk
+IFdFQiBDZXJ0aWZpY2F0ZXMgQ0EtRzMxDzANBgNVBAcTBkF0aGVuczEYMBYGA1UE
+YRMPVkFURUwtMDk5NzU1MTA4MB4XDTI0MDQxMTE0MTY1NVoXDTI1MDQxMTE0MTY1
+NVowgbYxCzAJBgNVBAYTAkdSMTYwNAYDVQQKEy1IRUxMRU5JQyBFWENIQU5HRVMg
+LSBBVEhFTlMgU1RPQ0sgRVhDSEFOR0UgU0ExGDAWBgNVBGETD1ZBVEVMLTA5OTc1
+NTEwODEQMA4GA1UEAxMHZm9vLmNvbTEPMA0GA1UEBxMGQXRoZW5zMRMwEQYLKwYB
+BAGCNzwCAQMTAkdSMR0wGwYDVQQPExRQcml2YXRlIE9yZ2FuaXphdGlvbjCCASIw
+DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALghERHf5FJ0yQHziG1aHOatwVOo
+njvIm1kCC8PHDRpZhZW3JbZIy3KBVRlJ+nl7ATw4D210Jrqgi5qnqEqBmlCeTFL1
+E/QlHIesmPE5zixRS1s4cwJXmGrguSieHTUMCxp321WpHidpRIew8jy/73d+OKCL
+e8Gx/mcZ4FGsJMFizwgqqgIL5nZZZvBEIHpy344OypsvBHFPnhZj2JNoI1z/vWtS
+W8ijeeR38fXswKSgF2/gRzc0bUmjXwWeQBPIzXZfOF635a+/HTKN7BGsXFqT/AZn
+gYZfUPPLjAd+xx5CMC2JmTahZyff+aTqhUDTKcXZr/gKZPU5mJYY5Oo2fFMCAwEA
+AaOCAj8wggI7MB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAfBgNVHSME
+GDAWgBQimSRXBmxWdY7b6315ZZxTNanRkTAtBggrBgEFBQcBAwQhMB8wCAYGBACO
+RgEBMBMGBgQAjkYBBjAJBgcEAI5GAQYDMIGXBggrBgEFBQcBAQSBijCBhzA4Bggr
+BgEFBQcwAYYsaHR0cDovL29jc3AuYXRoZXhncm91cC5nci9BdGhleFF1YWxpZmll
+ZENBRzMwSwYIKwYBBQUHMAKGP2h0dHA6Ly9yZXBvLmF0aGV4Z3JvdXAuZ3IvQVRI
+RVhRdWFsaWZpZWRXRUJDZXJ0aWZpY2F0ZXNDQUczLmNydDAlBgNVHSAEHjAcMA8G
+DSsGAQQBgeVaAQNkAQQwCQYHBACL7EABBjBPBgNVHR8ESDBGMESgQqBAhj5odHRw
+Oi8vY3JsLmF0aGV4Z3JvdXAuZ3IvQVRIRVhRdWFsaWZpZWRXRUJDZXJ0aWZpY2F0
+ZXNDQUczLmNybDAdBgNVHQ4EFgQU07VGL6HuADDUGfAmLWYcVX4vqG0wDgYDVR0P
+AQH/BAQDAgeAMHsGA1UdEQR0MHKCFHdlYmRzcy5hdGhleGdyb3VwLmdyghh3ZWJk
+c3Ntb2NrLmF0aGV4Z3JvdXAuZ3KCGndlYmRzcy1ycHhyMS5pbmV0LmhlbGV4Lmdy
+gg9kc3MuYXRoZXhuZXQuZ3KCE2Rzc21vY2suYXRoZXhuZXQuZ3IwDAYDVR0TAQH/
+BAIwADANBgkqhkiG9w0BAQsFAAOCAgEAmXiG4SmvTWDGoaEXOQJuFlhbjwG/7MZC
+h18GeEhIfkOP0ClvalQImI8gbLo1DecfKDLLXLZpb7UTGtnpkKa2bDb+KyTyr3Ap
+rg9L+KnX4jM6KfrteZgDP63TcxGXnr3C3Mf5Y8vaFvlmazACRM/r830mnUj1yvK8
+c7ZkIRhmt5a2C8lBoMFD+q15QqdU0vK4mV72EBi+xYRuAg7GVZoPM+dZhiNm5dvK
+jAiaaOG58XKsnaeDDCDDWwjRJ7m8Y5ZaP6L8oGotvCmnXUjJcAmSE1MlXEjkHsGk
+CqgwY6Wp/jDh4KpT8dQov1kg4dIKU9PNpdLjmmk/Jv7PMsG7i+3Q8lMCHfCe6NxF
+nc3GZ62x6Gq6dKnIqDQzMvYUOnEPfVcfOaWmrmFAaBfVAXfRaXcgAPDknNPgCkdb
+i5ywuvbYckFOcVpv+1u+KqDYdxUMCSxSpls+o0J6c38FbcmuFfB7BYB8cTgucNAG
+UBur3ku6KO8fHcxpO3zLvA9I6LNhOmvLX24dPRprFd8uK+FiciNxbA3CjDGNUtJU
+ErRMG8RRUXYPAM0tF9fZpKm3SurevG01yO8m/AcmsMuKjzJ9LIle7ioZtDc7C64l
+doQ+IEA1QRyRo8qDml25rgvC3vTyQ4bngTunPPfEsSO04NT71G7va3DyV/VGVbCn
+lkj7sIHIPRY=
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.subject.rdnSequence.3.0.value.x520CommonName,NcpWCommonNameValidator,ERROR,etsi.en_319_412_4.web-4.1.3-4.common_name_unknown_source,"Unknown source for value of common name: ""foo.com"""
+certificate.tbsCertificate.extensions.6.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
diff --git a/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_pre_certificate/duplicate_cn.crttest b/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_pre_certificate/duplicate_cn.crttest
new file mode 100644
index 0000000..5ea711c
--- /dev/null
+++ b/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_pre_certificate/duplicate_cn.crttest
@@ -0,0 +1,41 @@
+-----BEGIN CERTIFICATE-----
+MIIGADCCBOigAwIBAgIKTITWVCAMG9n4rDANBgkqhkiG9w0BAQsFADBLMQswCQYD
+VQQGEwJOTzEdMBsGA1UECgwUQnV5cGFzcyBBUy05ODMxNjMzMjcxHTAbBgNVBAMM
+FEJ1eXBhc3MgQ2xhc3MgMyBDQSAyMB4XDTI0MDIxNDEwMzQyMFoXDTI1MDIxMzIy
+NTkwMFowggEWMQswCQYDVQQGEwJOTzENMAsGA1UEBwwET1NMTzENMAsGA1UEEQwE
+MDk3ODE/MD0GA1UECgw2TUFTVEVSQ0FSRCBQQVlNRU5UIFNFUlZJQ0VTIElORlJB
+U1RSVUNUVVJFIChOT1JXQVkpIEFTMR0wGwYDVQQPDBRQcml2YXRlIE9yZ2FuaXph
+dGlvbjETMBEGCysGAQQBgjc8AgEDEwJOTzESMBAGA1UEBRMJOTIyOTg4ODYyMRgw
+FgYDVQRhEw9OVFJOTy05MjI5ODg4NjIxIjAgBgNVBAMTGW10Zi5tY2VuZXR0Lm1h
+c3RlcmNhcmQubm8xIjAgBgNVBAMTGW10Zi5tY2VuZXR0Lm1hc3RlcmNhcmQubm8w
+ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDD5M0Fo+WeZQ4qHT7JO6WD
+e4/YPZ9ZWIcwnqRTByYIsmnHXEMVZLp2IBpQfJugnBVHE1W7u6pJITdYNYBCl98D
+GVY8K0n5kqALhrFHIjkvdE99B5Dog781cZpxPU7soQx0SrwDaTqTTXFJSR2z6J3Z
+LJR7398RDt0PuNDOuTYx/RhLXqVNGhIsSgoz0sZ1osIjDOjxQjUbSybvmkKz9cBz
+o9nh22gLLYk39tDSk3xmwBRlZbJEHD05DTmHtrp2QlLFTckMFiim2muA5NYPEjaY
+iG8nqL7FTEuNVJfv8IN6qE+huwiXeVAc1Bco5yj8/zhYwCzsFmAsDQypJjRDrQP1
+AgMBAAGjggIXMIICEzAMBgNVHRMBAf8EAjAAMB8GA1UdIwQYMBaAFCIwLtL79kvK
+wLg70gTE6XLml5sMMA4GA1UdDwEB/wQEAwIHgDAdBgNVHSUEFjAUBggrBgEFBQcD
+AQYIKwYBBQUHAwIwRwYDVR0gBEAwPjAxBgVngQwBATAoMCYGCCsGAQUFBwIBFhpo
+dHRwczovL3d3dy5idXlwYXNzLm5vL2NwczAJBgcEAIvsQAEEMDoGA1UdHwQzMDEw
+L6AtoCuGKWh0dHA6Ly9jcmwuYnV5cGFzcy5uby9jcmwvQlBDbGFzczNDQTIuY3Js
+MCQGA1UdEQQdMBuCGW10Zi5tY2VuZXR0Lm1hc3RlcmNhcmQubm8wagYIKwYBBQUH
+AQEEXjBcMCMGCCsGAQUFBzABhhdodHRwOi8vb2NzcC5idXlwYXNzLmNvbTA1Bggr
+BgEFBQcwAoYpaHR0cDovL2NydC5idXlwYXNzLm5vL2NydC9CUENsYXNzM0NBMi5j
+ZXIwZgYIKwYBBQUHAQMEWjBYMAgGBgQAjkYBATATBgYEAI5GAQYwCQYHBACORgEG
+AzA3BgYEAI5GAQUwLTArFiVodHRwczovL3d3dy5idXlwYXNzLm5vL3Bkcy9wZHNf
+ZW4ucGRmEwJlbjATBgorBgEEAdZ5AgQDAQH/BAIFADAfBgVngQwDAQQWMBQTA05U
+UhMCTk8MCTkyMjk4ODg2MjANBgkqhkiG9w0BAQsFAAOCAQEAp2ou9Z776IUXDZb4
+QX+zkEgyI1FzS5H7WrO6+/eISlnlw69lYIy6YG3iAfZa4wLb25syo5rdgagL6085
+kiLtRKVg5qilW6CJpQQjSQVl45VsSHJq2FVN17cUYysQ2AlBGNmifFDdLL0AoY6d
+ObhJiSO5/1r/1BTW2V1/bIS1PzsKrrUwN3NKmgsy/y7tzocdnxQDlodtBYK0VdE6
+TaxjA1Y7dmgWAOR0dygHRq2XzjWS05PWLQsv2GLM680uqKrxw/X6qXSqu3pZF50R
+1rGSGwNFpobXQISAjsZL5B4lX+Ce+adzcpMPs8JeilUVlnBqfgTOeYs+EvLTYn2D
+pPuDbg==
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate,SubjectKeyIdentifierPresenceValidator,WARNING,pkix.certificate_skid_end_entity_missing,
+certificate.tbsCertificate.extensions.4.extnValue.certificatePolicies,QualifiedCertificatePoliciesValidator,ERROR,etsi.en_319_412_2.qcs-5.2-2.mismatched_policy_identifier_for_certificate_type,"Certificate type is QNCP_W_GEN_LEGAL_PERSON_EIDAS_PRE_CERTIFICATE (0.4.0.194112.1.6) but certificate contains certificate type policy identifier ""0.4.0.194112.1.4"""
+certificate.tbsCertificate.extensions.4.extnValue.certificatePolicies.0,CertificatePolicyQualifierValidator,NOTICE,pkix.certificate_policies_policy_has_qualifier,
+certificate.tbsCertificate.subject,LegalPersonDuplicateAttributeAllowanceValidator,ERROR,etsi.en_319_412_3.leg-4.2.1-3.prohibited_duplicate_attribute_present,Prohibited duplicate attribute present: 2.5.4.3
diff --git a/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_pre_certificate/extkeyusage_critical.crttest b/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_pre_certificate/extkeyusage_critical.crttest
new file mode 100644
index 0000000..f510cdc
--- /dev/null
+++ b/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_pre_certificate/extkeyusage_critical.crttest
@@ -0,0 +1,44 @@
+-----BEGIN CERTIFICATE-----
+MIIF+DCCBOCgAwIBAgIKTITWVCAMG9n4rDANBgkqhkiG9w0BAQsFADBLMQswCQYD
+VQQGEwJOTzEdMBsGA1UECgwUQnV5cGFzcyBBUy05ODMxNjMzMjcxHTAbBgNVBAMM
+FEJ1eXBhc3MgQ2xhc3MgMyBDQSAyMB4XDTI0MDIxNDEwMzQyMFoXDTI1MDIxMzIy
+NTkwMFowgdgxCzAJBgNVBAYTAk5PMQ0wCwYDVQQHDARPU0xPMQ0wCwYDVQQRDAQw
+OTc4MT8wPQYDVQQKDDZNQVNURVJDQVJEIFBBWU1FTlQgU0VSVklDRVMgSU5GUkFT
+VFJVQ1RVUkUgKE5PUldBWSkgQVMxIjAgBgNVBAMMGW10Zi5tY2VuZXR0Lm1hc3Rl
+cmNhcmQubm8xHTAbBgNVBA8MFFByaXZhdGUgT3JnYW5pemF0aW9uMRMwEQYLKwYB
+BAGCNzwCAQMTAk5PMRIwEAYDVQQFEwk5MjI5ODg4NjIwggEiMA0GCSqGSIb3DQEB
+AQUAA4IBDwAwggEKAoIBAQDD5M0Fo+WeZQ4qHT7JO6WDe4/YPZ9ZWIcwnqRTByYI
+smnHXEMVZLp2IBpQfJugnBVHE1W7u6pJITdYNYBCl98DGVY8K0n5kqALhrFHIjkv
+dE99B5Dog781cZpxPU7soQx0SrwDaTqTTXFJSR2z6J3ZLJR7398RDt0PuNDOuTYx
+/RhLXqVNGhIsSgoz0sZ1osIjDOjxQjUbSybvmkKz9cBzo9nh22gLLYk39tDSk3xm
+wBRlZbJEHD05DTmHtrp2QlLFTckMFiim2muA5NYPEjaYiG8nqL7FTEuNVJfv8IN6
+qE+huwiXeVAc1Bco5yj8/zhYwCzsFmAsDQypJjRDrQP1AgMBAAGjggJOMIICSjAM
+BgNVHRMBAf8EAjAAMB8GA1UdIwQYMBaAFCIwLtL79kvKwLg70gTE6XLml5sMMB0G
+A1UdDgQWBBQGk5iQPHNAuQUC7fAcAMMQtl+PZTAOBgNVHQ8BAf8EBAMCBaAwIAYD
+VR0lAQH/BBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMH0GA1UdIAR2MHQwNAYIYIRC
+ARoBAwMwKDAmBggrBgEFBQcCARYaaHR0cHM6Ly93d3cuYnV5cGFzcy5uby9jcHMw
+MQYFZ4EMAQEwKDAmBggrBgEFBQcCARYaaHR0cHM6Ly93d3cuYnV5cGFzcy5uby9j
+cHMwCQYHBACL7EABBDA6BgNVHR8EMzAxMC+gLaArhilodHRwOi8vY3JsLmJ1eXBh
+c3Mubm8vY3JsL0JQQ2xhc3MzQ0EyLmNybDAkBgNVHREEHTAbghltdGYubWNlbmV0
+dC5tYXN0ZXJjYXJkLm5vMGoGCCsGAQUFBwEBBF4wXDAjBggrBgEFBQcwAYYXaHR0
+cDovL29jc3AuYnV5cGFzcy5jb20wNQYIKwYBBQUHMAKGKWh0dHA6Ly9jcnQuYnV5
+cGFzcy5uby9jcnQvQlBDbGFzczNDQTIuY2VyMGYGCCsGAQUFBwEDBFowWDAIBgYE
+AI5GAQEwEwYGBACORgEGMAkGBwQAjkYBBgMwNwYGBACORgEFMC0wKxYlaHR0cHM6
+Ly93d3cuYnV5cGFzcy5uby9wZHMvcGRzX2VuLnBkZhMCZW4wEwYKKwYBBAHWeQIE
+AwEB/wQCBQAwDQYJKoZIhvcNAQELBQADggEBAKdqLvWe++iFFw2W+EF/s5BIMiNR
+c0uR+1qzuvv3iEpZ5cOvZWCMumBt4gH2WuMC29ubMqOa3YGoC+tPOZIi7USlYOao
+pVugiaUEI0kFZeOVbEhyathVTde3FGMrENgJQRjZonxQ3Sy9AKGOnTm4SYkjuf9a
+/9QU1tldf2yEtT87Cq61MDdzSpoLMv8u7c6HHZ8UA5aHbQWCtFXROk2sYwNWO3Zo
+FgDkdHcoB0atl841ktOT1i0LL9hizOvNLqiq8cP1+ql0qrt6WRedEdaxkhsDRaaG
+10CEgI7GS+QeJV/gnvmnc3KTD7PCXopVFZZwan4EznmLPhLy02J9g6T7g24=
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.extensions.2.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
+certificate.tbsCertificate.extensions.4,ExtendedKeyUsageCriticalityValidator,ERROR,etsi.en_319_412_2.gen-4.3.10-1.eku_extension_is_critical,Extension 2.5.29.37 is critical
+certificate.tbsCertificate.extensions.3.extnValue.keyUsage,LegalPersonKeyUsageValidator,WARNING,etsi.en_319_412_2.nat-4.3.2-1.mixed_key_usage_setting,
+certificate.tbsCertificate.subject.rdnSequence,LegalPersonSubjectAttributeAllowanceValidator,ERROR,etsi.en_319_412_3.leg-4.2.1-2.organization_identifier_attribute_absent,
+certificate.tbsCertificate.extensions.4,NcpWCriticalityExtendedKeyUsageValidator,ERROR,etsi.en_319_412_4.web-4.1.3-4.eku_extension_is_critical,Extension 2.5.29.37 is critical
+certificate.tbsCertificate.extensions.5.extnValue.certificatePolicies.0,CertificatePolicyQualifierValidator,NOTICE,pkix.certificate_policies_policy_has_qualifier,
+certificate.tbsCertificate.extensions.5.extnValue.certificatePolicies,QualifiedCertificatePoliciesValidator,ERROR,etsi.en_319_412_2.qcs-5.2-2.mismatched_policy_identifier_for_certificate_type,"Certificate type is QNCP_W_GEN_LEGAL_PERSON_EIDAS_PRE_CERTIFICATE (0.4.0.194112.1.6) but certificate contains certificate type policy identifier ""0.4.0.194112.1.4"""
+certificate.tbsCertificate.extensions.5.extnValue.certificatePolicies.1,CertificatePolicyQualifierValidator,NOTICE,pkix.certificate_policies_policy_has_qualifier,
diff --git a/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_pre_certificate/ian_critical.crttest b/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_pre_certificate/ian_critical.crttest
new file mode 100644
index 0000000..e49f0fd
--- /dev/null
+++ b/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_pre_certificate/ian_critical.crttest
@@ -0,0 +1,46 @@
+-----BEGIN CERTIFICATE-----
+MIIGOzCCBSOgAwIBAgIKTITWVCAMG9n4rDANBgkqhkiG9w0BAQsFADBLMQswCQYD
+VQQGEwJOTzEdMBsGA1UECgwUQnV5cGFzcyBBUy05ODMxNjMzMjcxHTAbBgNVBAMM
+FEJ1eXBhc3MgQ2xhc3MgMyBDQSAyMB4XDTI0MDIxNDEwMzQyMFoXDTI1MDIxMzIy
+NTkwMFowgdgxCzAJBgNVBAYTAk5PMQ0wCwYDVQQHDARPU0xPMQ0wCwYDVQQRDAQw
+OTc4MT8wPQYDVQQKDDZNQVNURVJDQVJEIFBBWU1FTlQgU0VSVklDRVMgSU5GUkFT
+VFJVQ1RVUkUgKE5PUldBWSkgQVMxIjAgBgNVBAMMGW10Zi5tY2VuZXR0Lm1hc3Rl
+cmNhcmQubm8xHTAbBgNVBA8MFFByaXZhdGUgT3JnYW5pemF0aW9uMRMwEQYLKwYB
+BAGCNzwCAQMTAk5PMRIwEAYDVQQFEwk5MjI5ODg4NjIwggEiMA0GCSqGSIb3DQEB
+AQUAA4IBDwAwggEKAoIBAQDD5M0Fo+WeZQ4qHT7JO6WDe4/YPZ9ZWIcwnqRTByYI
+smnHXEMVZLp2IBpQfJugnBVHE1W7u6pJITdYNYBCl98DGVY8K0n5kqALhrFHIjkv
+dE99B5Dog781cZpxPU7soQx0SrwDaTqTTXFJSR2z6J3ZLJR7398RDt0PuNDOuTYx
+/RhLXqVNGhIsSgoz0sZ1osIjDOjxQjUbSybvmkKz9cBzo9nh22gLLYk39tDSk3xm
+wBRlZbJEHD05DTmHtrp2QlLFTckMFiim2muA5NYPEjaYiG8nqL7FTEuNVJfv8IN6
+qE+huwiXeVAc1Bco5yj8/zhYwCzsFmAsDQypJjRDrQP1AgMBAAGjggKRMIICjTAM
+BgNVHRMBAf8EAjAAMB8GA1UdIwQYMBaAFCIwLtL79kvKwLg70gTE6XLml5sMMB0G
+A1UdDgQWBBQGk5iQPHNAuQUC7fAcAMMQtl+PZTAOBgNVHQ8BAf8EBAMCBaAwHQYD
+VR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMH0GA1UdIAR2MHQwNAYIYIRCARoB
+AwMwKDAmBggrBgEFBQcCARYaaHR0cHM6Ly93d3cuYnV5cGFzcy5uby9jcHMwMQYF
+Z4EMAQEwKDAmBggrBgEFBQcCARYaaHR0cHM6Ly93d3cuYnV5cGFzcy5uby9jcHMw
+CQYHBACL7EABBDBEBgNVHRIBAf8EOjA4gg5wcm9jZXJ0Lm5ldC52ZaANBgVghl4C
+AaAEDAIwMqAXBgVghl4CAqAODAxKLTMxNjM1MzczLTcwOgYDVR0fBDMwMTAvoC2g
+K4YpaHR0cDovL2NybC5idXlwYXNzLm5vL2NybC9CUENsYXNzM0NBMi5jcmwwJAYD
+VR0RBB0wG4IZbXRmLm1jZW5ldHQubWFzdGVyY2FyZC5ubzBqBggrBgEFBQcBAQRe
+MFwwIwYIKwYBBQUHMAGGF2h0dHA6Ly9vY3NwLmJ1eXBhc3MuY29tMDUGCCsGAQUF
+BzAChilodHRwOi8vY3J0LmJ1eXBhc3Mubm8vY3J0L0JQQ2xhc3MzQ0EyLmNlcjBm
+BggrBgEFBQcBAwRaMFgwCAYGBACORgEBMBMGBgQAjkYBBjAJBgcEAI5GAQYDMDcG
+BgQAjkYBBTAtMCsWJWh0dHBzOi8vd3d3LmJ1eXBhc3Mubm8vcGRzL3Bkc19lbi5w
+ZGYTAmVuMBMGCisGAQQB1nkCBAMBAf8EAgUAMA0GCSqGSIb3DQEBCwUAA4IBAQCn
+ai71nvvohRcNlvhBf7OQSDIjUXNLkftas7r794hKWeXDr2VgjLpgbeIB9lrjAtvb
+mzKjmt2BqAvrTzmSIu1EpWDmqKVboImlBCNJBWXjlWxIcmrYVU3XtxRjKxDYCUEY
+2aJ8UN0svQChjp05uEmJI7n/Wv/UFNbZXX9shLU/OwqutTA3c0qaCzL/Lu3Ohx2f
+FAOWh20FgrRV0TpNrGMDVjt2aBYA5HR3KAdGrZfONZLTk9YtCy/YYszrzS6oqvHD
+9fqpdKq7elkXnRHWsZIbA0WmhtdAhICOxkvkHiVf4J75p3Nykw+zwl6KVRWWcGp+
+BM55iz4S8tNifYOk+4Nu
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.extensions.2.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
+certificate.tbsCertificate.extensions.6,IssuerAlternativeNameCriticalityValidator,ERROR,etsi.en_319_412_2.gen-4.3.6-1.ian_extension_is_critical,Extension 2.5.29.18 is critical
+certificate.tbsCertificate.extensions.6,IssuerAlternativeNameCriticalityValidator,WARNING,pkix.issuer_alt_name_extension_critical,Extension 2.5.29.18 is critical
+certificate.tbsCertificate.extensions.3.extnValue.keyUsage,LegalPersonKeyUsageValidator,WARNING,etsi.en_319_412_2.nat-4.3.2-1.mixed_key_usage_setting,
+certificate.tbsCertificate.subject.rdnSequence,LegalPersonSubjectAttributeAllowanceValidator,ERROR,etsi.en_319_412_3.leg-4.2.1-2.organization_identifier_attribute_absent,
+certificate.tbsCertificate.extensions.5.extnValue.certificatePolicies.0,CertificatePolicyQualifierValidator,NOTICE,pkix.certificate_policies_policy_has_qualifier,
+certificate.tbsCertificate.extensions.5.extnValue.certificatePolicies.1,CertificatePolicyQualifierValidator,NOTICE,pkix.certificate_policies_policy_has_qualifier,
+certificate.tbsCertificate.extensions.5.extnValue.certificatePolicies,QualifiedCertificatePoliciesValidator,ERROR,etsi.en_319_412_2.qcs-5.2-2.mismatched_policy_identifier_for_certificate_type,"Certificate type is QNCP_W_GEN_LEGAL_PERSON_EIDAS_PRE_CERTIFICATE (0.4.0.194112.1.6) but certificate contains certificate type policy identifier ""0.4.0.194112.1.4"""
diff --git a/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_pre_certificate/non_https_pds_url_scheme.crttest b/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_pre_certificate/non_https_pds_url_scheme.crttest
new file mode 100644
index 0000000..1194ad6
--- /dev/null
+++ b/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_pre_certificate/non_https_pds_url_scheme.crttest
@@ -0,0 +1,40 @@
+-----BEGIN CERTIFICATE-----
+MIIF2jCCBMKgAwIBAgIKTITWVCAMG9n4rDANBgkqhkiG9w0BAQsFADBLMQswCQYD
+VQQGEwJOTzEdMBsGA1UECgwUQnV5cGFzcyBBUy05ODMxNjMzMjcxHTAbBgNVBAMM
+FEJ1eXBhc3MgQ2xhc3MgMyBDQSAyMB4XDTI0MDIxNDEwMzQyMFoXDTI1MDIxMzIy
+NTkwMFowgfIxCzAJBgNVBAYTAk5PMQ0wCwYDVQQHDARPU0xPMQ0wCwYDVQQRDAQw
+OTc4MT8wPQYDVQQKDDZNQVNURVJDQVJEIFBBWU1FTlQgU0VSVklDRVMgSU5GUkFT
+VFJVQ1RVUkUgKE5PUldBWSkgQVMxHTAbBgNVBA8MFFByaXZhdGUgT3JnYW5pemF0
+aW9uMRMwEQYLKwYBBAGCNzwCAQMTAk5PMRIwEAYDVQQFEwk5MjI5ODg4NjIxGDAW
+BgNVBGETD05UUk5PLTkyMjk4ODg2MjEiMCAGA1UEAxMZbXRmLm1jZW5ldHQubWFz
+dGVyY2FyZC5ubzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMPkzQWj
+5Z5lDiodPsk7pYN7j9g9n1lYhzCepFMHJgiyacdcQxVkunYgGlB8m6CcFUcTVbu7
+qkkhN1g1gEKX3wMZVjwrSfmSoAuGsUciOS90T30HkOiDvzVxmnE9TuyhDHRKvANp
+OpNNcUlJHbPondkslHvf3xEO3Q+40M65NjH9GEtepU0aEixKCjPSxnWiwiMM6PFC
+NRtLJu+aQrP1wHOj2eHbaAstiTf20NKTfGbAFGVlskQcPTkNOYe2unZCUsVNyQwW
+KKbaa4Dk1g8SNpiIbyeovsVMS41Ul+/wg3qoT6G7CJd5UBzUFyjnKPz/OFjALOwW
+YCwNDKkmNEOtA/UCAwEAAaOCAhYwggISMAwGA1UdEwEB/wQCMAAwHwYDVR0jBBgw
+FoAUIjAu0vv2S8rAuDvSBMTpcuaXmwwwDgYDVR0PAQH/BAQDAgeAMB0GA1UdJQQW
+MBQGCCsGAQUFBwMBBggrBgEFBQcDAjBHBgNVHSAEQDA+MDEGBWeBDAEBMCgwJgYI
+KwYBBQUHAgEWGmh0dHBzOi8vd3d3LmJ1eXBhc3Mubm8vY3BzMAkGBwQAi+xAAQQw
+OgYDVR0fBDMwMTAvoC2gK4YpaHR0cDovL2NybC5idXlwYXNzLm5vL2NybC9CUENs
+YXNzM0NBMi5jcmwwJAYDVR0RBB0wG4IZbXRmLm1jZW5ldHQubWFzdGVyY2FyZC5u
+bzBqBggrBgEFBQcBAQReMFwwIwYIKwYBBQUHMAGGF2h0dHA6Ly9vY3NwLmJ1eXBh
+c3MuY29tMDUGCCsGAQUFBzAChilodHRwOi8vY3J0LmJ1eXBhc3Mubm8vY3J0L0JQ
+Q2xhc3MzQ0EyLmNlcjBlBggrBgEFBQcBAwRZMFcwCAYGBACORgEBMBMGBgQAjkYB
+BjAJBgcEAI5GAQYDMDYGBgQAjkYBBTAsMCoWJGh0dHA6Ly93d3cuYnV5cGFzcy5u
+by9wZHMvcGRzX2VuLnBkZhMCZW4wEwYKKwYBBAHWeQIEAwEB/wQCBQAwHwYFZ4EM
+AwEEFjAUEwNOVFITAk5PDAk5MjI5ODg4NjIwDQYJKoZIhvcNAQELBQADggEBAKdq
+LvWe++iFFw2W+EF/s5BIMiNRc0uR+1qzuvv3iEpZ5cOvZWCMumBt4gH2WuMC29ub
+MqOa3YGoC+tPOZIi7USlYOaopVugiaUEI0kFZeOVbEhyathVTde3FGMrENgJQRjZ
+onxQ3Sy9AKGOnTm4SYkjuf9a/9QU1tldf2yEtT87Cq61MDdzSpoLMv8u7c6HHZ8U
+A5aHbQWCtFXROk2sYwNWO3ZoFgDkdHcoB0atl841ktOT1i0LL9hizOvNLqiq8cP1
++ql0qrt6WRedEdaxkhsDRaaG10CEgI7GS+QeJV/gnvmnc3KTD7PCXopVFZZwan4E
+znmLPhLy02J9g6T7g24=
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.extensions.8.extnValue.qCStatements.2.statementInfo.qcEuPDS.0,QcEuPDSHttpsURLValidator,ERROR,etsi.en_319_412_5.gen-4.3.4.url_scheme_not_https,"Non-HTTPS URL scheme found: ""http"""
+certificate.tbsCertificate.extensions.4.extnValue.certificatePolicies,QualifiedCertificatePoliciesValidator,ERROR,etsi.en_319_412_2.qcs-5.2-2.mismatched_policy_identifier_for_certificate_type,"Certificate type is QNCP_W_GEN_LEGAL_PERSON_EIDAS_PRE_CERTIFICATE (0.4.0.194112.1.6) but certificate contains certificate type policy identifier ""0.4.0.194112.1.4"""
+certificate,SubjectKeyIdentifierPresenceValidator,WARNING,pkix.certificate_skid_end_entity_missing,
+certificate.tbsCertificate.extensions.4.extnValue.certificatePolicies.0,CertificatePolicyQualifierValidator,NOTICE,pkix.certificate_policies_policy_has_qualifier,
diff --git a/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_pre_certificate/policy_critical.crttest b/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_pre_certificate/policy_critical.crttest
new file mode 100644
index 0000000..caa9200
--- /dev/null
+++ b/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_pre_certificate/policy_critical.crttest
@@ -0,0 +1,43 @@
+-----BEGIN CERTIFICATE-----
+MIIF+TCCBOGgAwIBAgIKTITWVCAMG9n4rDANBgkqhkiG9w0BAQsFADBLMQswCQYD
+VQQGEwJOTzEdMBsGA1UECgwUQnV5cGFzcyBBUy05ODMxNjMzMjcxHTAbBgNVBAMM
+FEJ1eXBhc3MgQ2xhc3MgMyBDQSAyMB4XDTI0MDIxNDEwMzQyMFoXDTI1MDIxMzIy
+NTkwMFowgdgxCzAJBgNVBAYTAk5PMQ0wCwYDVQQHDARPU0xPMQ0wCwYDVQQRDAQw
+OTc4MT8wPQYDVQQKDDZNQVNURVJDQVJEIFBBWU1FTlQgU0VSVklDRVMgSU5GUkFT
+VFJVQ1RVUkUgKE5PUldBWSkgQVMxIjAgBgNVBAMMGW10Zi5tY2VuZXR0Lm1hc3Rl
+cmNhcmQubm8xHTAbBgNVBA8MFFByaXZhdGUgT3JnYW5pemF0aW9uMRMwEQYLKwYB
+BAGCNzwCAQMTAk5PMRIwEAYDVQQFEwk5MjI5ODg4NjIwggEiMA0GCSqGSIb3DQEB
+AQUAA4IBDwAwggEKAoIBAQDD5M0Fo+WeZQ4qHT7JO6WDe4/YPZ9ZWIcwnqRTByYI
+smnHXEMVZLp2IBpQfJugnBVHE1W7u6pJITdYNYBCl98DGVY8K0n5kqALhrFHIjkv
+dE99B5Dog781cZpxPU7soQx0SrwDaTqTTXFJSR2z6J3ZLJR7398RDt0PuNDOuTYx
+/RhLXqVNGhIsSgoz0sZ1osIjDOjxQjUbSybvmkKz9cBzo9nh22gLLYk39tDSk3xm
+wBRlZbJEHD05DTmHtrp2QlLFTckMFiim2muA5NYPEjaYiG8nqL7FTEuNVJfv8IN6
+qE+huwiXeVAc1Bco5yj8/zhYwCzsFmAsDQypJjRDrQP1AgMBAAGjggJPMIICSzAM
+BgNVHRMBAf8EAjAAMB8GA1UdIwQYMBaAFCIwLtL79kvKwLg70gTE6XLml5sMMB0G
+A1UdDgQWBBQGk5iQPHNAuQUC7fAcAMMQtl+PZTAOBgNVHQ8BAf8EBAMCBaAwHQYD
+VR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMIGABgNVHSABAf8EdjB0MDQGCGCE
+QgEaAQMDMCgwJgYIKwYBBQUHAgEWGmh0dHBzOi8vd3d3LmJ1eXBhc3Mubm8vY3Bz
+MDEGBWeBDAEBMCgwJgYIKwYBBQUHAgEWGmh0dHBzOi8vd3d3LmJ1eXBhc3Mubm8v
+Y3BzMAkGBwQAi+xAAQQwOgYDVR0fBDMwMTAvoC2gK4YpaHR0cDovL2NybC5idXlw
+YXNzLm5vL2NybC9CUENsYXNzM0NBMi5jcmwwJAYDVR0RBB0wG4IZbXRmLm1jZW5l
+dHQubWFzdGVyY2FyZC5ubzBqBggrBgEFBQcBAQReMFwwIwYIKwYBBQUHMAGGF2h0
+dHA6Ly9vY3NwLmJ1eXBhc3MuY29tMDUGCCsGAQUFBzAChilodHRwOi8vY3J0LmJ1
+eXBhc3Mubm8vY3J0L0JQQ2xhc3MzQ0EyLmNlcjBmBggrBgEFBQcBAwRaMFgwCAYG
+BACORgEBMBMGBgQAjkYBBjAJBgcEAI5GAQYDMDcGBgQAjkYBBTAtMCsWJWh0dHBz
+Oi8vd3d3LmJ1eXBhc3Mubm8vcGRzL3Bkc19lbi5wZGYTAmVuMBMGCisGAQQB1nkC
+BAMBAf8EAgUAMA0GCSqGSIb3DQEBCwUAA4IBAQCnai71nvvohRcNlvhBf7OQSDIj
+UXNLkftas7r794hKWeXDr2VgjLpgbeIB9lrjAtvbmzKjmt2BqAvrTzmSIu1EpWDm
+qKVboImlBCNJBWXjlWxIcmrYVU3XtxRjKxDYCUEY2aJ8UN0svQChjp05uEmJI7n/
+Wv/UFNbZXX9shLU/OwqutTA3c0qaCzL/Lu3Ohx2fFAOWh20FgrRV0TpNrGMDVjt2
+aBYA5HR3KAdGrZfONZLTk9YtCy/YYszrzS6oqvHD9fqpdKq7elkXnRHWsZIbA0Wm
+htdAhICOxkvkHiVf4J75p3Nykw+zwl6KVRWWcGp+BM55iz4S8tNifYOk+4Nu
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.extensions.2.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
+certificate.tbsCertificate.extensions.5,CertificatePoliciesCriticalityValidator,WARNING,etsi.en_319_412_2.gen-4.3.3-1.critical_certificate_policies_extension,Extension 2.5.29.32 is critical
+certificate.tbsCertificate.extensions.3.extnValue.keyUsage,LegalPersonKeyUsageValidator,WARNING,etsi.en_319_412_2.nat-4.3.2-1.mixed_key_usage_setting,
+certificate.tbsCertificate.subject.rdnSequence,LegalPersonSubjectAttributeAllowanceValidator,ERROR,etsi.en_319_412_3.leg-4.2.1-2.organization_identifier_attribute_absent,
+certificate.tbsCertificate.extensions.5.extnValue.certificatePolicies.1,CertificatePolicyQualifierValidator,NOTICE,pkix.certificate_policies_policy_has_qualifier,
+certificate.tbsCertificate.extensions.5.extnValue.certificatePolicies.0,CertificatePolicyQualifierValidator,NOTICE,pkix.certificate_policies_policy_has_qualifier,
+certificate.tbsCertificate.extensions.5.extnValue.certificatePolicies,QualifiedCertificatePoliciesValidator,ERROR,etsi.en_319_412_2.qcs-5.2-2.mismatched_policy_identifier_for_certificate_type,"Certificate type is QNCP_W_GEN_LEGAL_PERSON_EIDAS_PRE_CERTIFICATE (0.4.0.194112.1.6) but certificate contains certificate type policy identifier ""0.4.0.194112.1.4"""
diff --git a/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_pre_certificate/san_critical.crttest b/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_pre_certificate/san_critical.crttest
new file mode 100644
index 0000000..ee60266
--- /dev/null
+++ b/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_pre_certificate/san_critical.crttest
@@ -0,0 +1,44 @@
+-----BEGIN CERTIFICATE-----
+MIIF+DCCBOCgAwIBAgIKTITWVCAMG9n4rDANBgkqhkiG9w0BAQsFADBLMQswCQYD
+VQQGEwJOTzEdMBsGA1UECgwUQnV5cGFzcyBBUy05ODMxNjMzMjcxHTAbBgNVBAMM
+FEJ1eXBhc3MgQ2xhc3MgMyBDQSAyMB4XDTI0MDIxNDEwMzQyMFoXDTI1MDIxMzIy
+NTkwMFowgdgxCzAJBgNVBAYTAk5PMQ0wCwYDVQQHDARPU0xPMQ0wCwYDVQQRDAQw
+OTc4MT8wPQYDVQQKDDZNQVNURVJDQVJEIFBBWU1FTlQgU0VSVklDRVMgSU5GUkFT
+VFJVQ1RVUkUgKE5PUldBWSkgQVMxIjAgBgNVBAMMGW10Zi5tY2VuZXR0Lm1hc3Rl
+cmNhcmQubm8xHTAbBgNVBA8MFFByaXZhdGUgT3JnYW5pemF0aW9uMRMwEQYLKwYB
+BAGCNzwCAQMTAk5PMRIwEAYDVQQFEwk5MjI5ODg4NjIwggEiMA0GCSqGSIb3DQEB
+AQUAA4IBDwAwggEKAoIBAQDD5M0Fo+WeZQ4qHT7JO6WDe4/YPZ9ZWIcwnqRTByYI
+smnHXEMVZLp2IBpQfJugnBVHE1W7u6pJITdYNYBCl98DGVY8K0n5kqALhrFHIjkv
+dE99B5Dog781cZpxPU7soQx0SrwDaTqTTXFJSR2z6J3ZLJR7398RDt0PuNDOuTYx
+/RhLXqVNGhIsSgoz0sZ1osIjDOjxQjUbSybvmkKz9cBzo9nh22gLLYk39tDSk3xm
+wBRlZbJEHD05DTmHtrp2QlLFTckMFiim2muA5NYPEjaYiG8nqL7FTEuNVJfv8IN6
+qE+huwiXeVAc1Bco5yj8/zhYwCzsFmAsDQypJjRDrQP1AgMBAAGjggJOMIICSjAM
+BgNVHRMBAf8EAjAAMB8GA1UdIwQYMBaAFCIwLtL79kvKwLg70gTE6XLml5sMMB0G
+A1UdDgQWBBQGk5iQPHNAuQUC7fAcAMMQtl+PZTAOBgNVHQ8BAf8EBAMCBaAwHQYD
+VR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMH0GA1UdIAR2MHQwNAYIYIRCARoB
+AwMwKDAmBggrBgEFBQcCARYaaHR0cHM6Ly93d3cuYnV5cGFzcy5uby9jcHMwMQYF
+Z4EMAQEwKDAmBggrBgEFBQcCARYaaHR0cHM6Ly93d3cuYnV5cGFzcy5uby9jcHMw
+CQYHBACL7EABBDA6BgNVHR8EMzAxMC+gLaArhilodHRwOi8vY3JsLmJ1eXBhc3Mu
+bm8vY3JsL0JQQ2xhc3MzQ0EyLmNybDAnBgNVHREBAf8EHTAbghltdGYubWNlbmV0
+dC5tYXN0ZXJjYXJkLm5vMGoGCCsGAQUFBwEBBF4wXDAjBggrBgEFBQcwAYYXaHR0
+cDovL29jc3AuYnV5cGFzcy5jb20wNQYIKwYBBQUHMAKGKWh0dHA6Ly9jcnQuYnV5
+cGFzcy5uby9jcnQvQlBDbGFzczNDQTIuY2VyMGYGCCsGAQUFBwEDBFowWDAIBgYE
+AI5GAQEwEwYGBACORgEGMAkGBwQAjkYBBgMwNwYGBACORgEFMC0wKxYlaHR0cHM6
+Ly93d3cuYnV5cGFzcy5uby9wZHMvcGRzX2VuLnBkZhMCZW4wEwYKKwYBBAHWeQIE
+AwEB/wQCBQAwDQYJKoZIhvcNAQELBQADggEBAKdqLvWe++iFFw2W+EF/s5BIMiNR
+c0uR+1qzuvv3iEpZ5cOvZWCMumBt4gH2WuMC29ubMqOa3YGoC+tPOZIi7USlYOao
+pVugiaUEI0kFZeOVbEhyathVTde3FGMrENgJQRjZonxQ3Sy9AKGOnTm4SYkjuf9a
+/9QU1tldf2yEtT87Cq61MDdzSpoLMv8u7c6HHZ8UA5aHbQWCtFXROk2sYwNWO3Zo
+FgDkdHcoB0atl841ktOT1i0LL9hizOvNLqiq8cP1+ql0qrt6WRedEdaxkhsDRaaG
+10CEgI7GS+QeJV/gnvmnc3KTD7PCXopVFZZwan4EznmLPhLy02J9g6T7g24=
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.extensions.2.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
+certificate.tbsCertificate.extensions.7,SubjectAlternativeNameCriticalityValidator,WARNING,pkix.san_extension_is_critical_non_empty_subject,
+certificate.tbsCertificate.extensions.7,SubjectAlternativeNameCriticalityValidator,ERROR,etsi.en_319_412_2.gen-4.3.5-1.san_extension_is_critical,Extension 2.5.29.17 is critical
+certificate.tbsCertificate.extensions.3.extnValue.keyUsage,LegalPersonKeyUsageValidator,WARNING,etsi.en_319_412_2.nat-4.3.2-1.mixed_key_usage_setting,
+certificate.tbsCertificate.subject.rdnSequence,LegalPersonSubjectAttributeAllowanceValidator,ERROR,etsi.en_319_412_3.leg-4.2.1-2.organization_identifier_attribute_absent,
+certificate.tbsCertificate.extensions.5.extnValue.certificatePolicies.1,CertificatePolicyQualifierValidator,NOTICE,pkix.certificate_policies_policy_has_qualifier,
+certificate.tbsCertificate.extensions.5.extnValue.certificatePolicies.0,CertificatePolicyQualifierValidator,NOTICE,pkix.certificate_policies_policy_has_qualifier,
+certificate.tbsCertificate.extensions.5.extnValue.certificatePolicies,QualifiedCertificatePoliciesValidator,ERROR,etsi.en_319_412_2.qcs-5.2-2.mismatched_policy_identifier_for_certificate_type,"Certificate type is QNCP_W_GEN_LEGAL_PERSON_EIDAS_PRE_CERTIFICATE (0.4.0.194112.1.6) but certificate contains certificate type policy identifier ""0.4.0.194112.1.4"""
diff --git a/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_pre_certificate/unknown_country_code.crttest b/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_pre_certificate/unknown_country_code.crttest
new file mode 100644
index 0000000..2841540
--- /dev/null
+++ b/tests/integration_certificate/etsi/qncp_w_gen_legal_person_eidas_pre_certificate/unknown_country_code.crttest
@@ -0,0 +1,40 @@
+-----BEGIN CERTIFICATE-----
+MIIF2zCCBMOgAwIBAgIKTITWVCAMG9n4rDANBgkqhkiG9w0BAQsFADBLMQswCQYD
+VQQGEwJOTzEdMBsGA1UECgwUQnV5cGFzcyBBUy05ODMxNjMzMjcxHTAbBgNVBAMM
+FEJ1eXBhc3MgQ2xhc3MgMyBDQSAyMB4XDTI0MDIxNDEwMzQyMFoXDTI1MDIxMzIy
+NTkwMFowgfIxCzAJBgNVBAYTAlpaMQ0wCwYDVQQHDARPU0xPMQ0wCwYDVQQRDAQw
+OTc4MT8wPQYDVQQKDDZNQVNURVJDQVJEIFBBWU1FTlQgU0VSVklDRVMgSU5GUkFT
+VFJVQ1RVUkUgKE5PUldBWSkgQVMxHTAbBgNVBA8MFFByaXZhdGUgT3JnYW5pemF0
+aW9uMRMwEQYLKwYBBAGCNzwCAQMTAk5PMRIwEAYDVQQFEwk5MjI5ODg4NjIxGDAW
+BgNVBGETD05UUk5PLTkyMjk4ODg2MjEiMCAGA1UEAxMZbXRmLm1jZW5ldHQubWFz
+dGVyY2FyZC5ubzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMPkzQWj
+5Z5lDiodPsk7pYN7j9g9n1lYhzCepFMHJgiyacdcQxVkunYgGlB8m6CcFUcTVbu7
+qkkhN1g1gEKX3wMZVjwrSfmSoAuGsUciOS90T30HkOiDvzVxmnE9TuyhDHRKvANp
+OpNNcUlJHbPondkslHvf3xEO3Q+40M65NjH9GEtepU0aEixKCjPSxnWiwiMM6PFC
+NRtLJu+aQrP1wHOj2eHbaAstiTf20NKTfGbAFGVlskQcPTkNOYe2unZCUsVNyQwW
+KKbaa4Dk1g8SNpiIbyeovsVMS41Ul+/wg3qoT6G7CJd5UBzUFyjnKPz/OFjALOwW
+YCwNDKkmNEOtA/UCAwEAAaOCAhcwggITMAwGA1UdEwEB/wQCMAAwHwYDVR0jBBgw
+FoAUIjAu0vv2S8rAuDvSBMTpcuaXmwwwDgYDVR0PAQH/BAQDAgeAMB0GA1UdJQQW
+MBQGCCsGAQUFBwMBBggrBgEFBQcDAjBHBgNVHSAEQDA+MDEGBWeBDAEBMCgwJgYI
+KwYBBQUHAgEWGmh0dHBzOi8vd3d3LmJ1eXBhc3Mubm8vY3BzMAkGBwQAi+xAAQQw
+OgYDVR0fBDMwMTAvoC2gK4YpaHR0cDovL2NybC5idXlwYXNzLm5vL2NybC9CUENs
+YXNzM0NBMi5jcmwwJAYDVR0RBB0wG4IZbXRmLm1jZW5ldHQubWFzdGVyY2FyZC5u
+bzBqBggrBgEFBQcBAQReMFwwIwYIKwYBBQUHMAGGF2h0dHA6Ly9vY3NwLmJ1eXBh
+c3MuY29tMDUGCCsGAQUFBzAChilodHRwOi8vY3J0LmJ1eXBhc3Mubm8vY3J0L0JQ
+Q2xhc3MzQ0EyLmNlcjBmBggrBgEFBQcBAwRaMFgwCAYGBACORgEBMBMGBgQAjkYB
+BjAJBgcEAI5GAQYDMDcGBgQAjkYBBTAtMCsWJWh0dHBzOi8vd3d3LmJ1eXBhc3Mu
+bm8vcGRzL3Bkc19lbi5wZGYTAmVuMBMGCisGAQQB1nkCBAMBAf8EAgUAMB8GBWeB
+DAMBBBYwFBMDTlRSEwJOTwwJOTIyOTg4ODYyMA0GCSqGSIb3DQEBCwUAA4IBAQCn
+ai71nvvohRcNlvhBf7OQSDIjUXNLkftas7r794hKWeXDr2VgjLpgbeIB9lrjAtvb
+mzKjmt2BqAvrTzmSIu1EpWDmqKVboImlBCNJBWXjlWxIcmrYVU3XtxRjKxDYCUEY
+2aJ8UN0svQChjp05uEmJI7n/Wv/UFNbZXX9shLU/OwqutTA3c0qaCzL/Lu3Ohx2f
+FAOWh20FgrRV0TpNrGMDVjt2aBYA5HR3KAdGrZfONZLTk9YtCy/YYszrzS6oqvHD
+9fqpdKq7elkXnRHWsZIbA0WmhtdAhICOxkvkHiVf4J75p3Nykw+zwl6KVRWWcGp+
+BM55iz4S8tNifYOk+4Nu
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.subject.rdnSequence.0.0.value.x520countryName,LegalPersonCountryCodeValidator,NOTICE,etsi.en_319_412_3.leg-4.2.1-4.unknown_country_code,"Unknown country code: ""ZZ"""
+certificate.tbsCertificate.extensions.4.extnValue.certificatePolicies,QualifiedCertificatePoliciesValidator,ERROR,etsi.en_319_412_2.qcs-5.2-2.mismatched_policy_identifier_for_certificate_type,"Certificate type is QNCP_W_GEN_LEGAL_PERSON_EIDAS_PRE_CERTIFICATE (0.4.0.194112.1.6) but certificate contains certificate type policy identifier ""0.4.0.194112.1.4"""
+certificate,SubjectKeyIdentifierPresenceValidator,WARNING,pkix.certificate_skid_end_entity_missing,
+certificate.tbsCertificate.extensions.4.extnValue.certificatePolicies.0,CertificatePolicyQualifierValidator,NOTICE,pkix.certificate_policies_policy_has_qualifier,
diff --git a/tests/integration_certificate/etsi/qncp_w_gen_natural_person_eidas_final_certificate/missing_subject_cn_and_c.crttest b/tests/integration_certificate/etsi/qncp_w_gen_natural_person_eidas_final_certificate/missing_subject_cn_and_c.crttest
new file mode 100644
index 0000000..8c28985
--- /dev/null
+++ b/tests/integration_certificate/etsi/qncp_w_gen_natural_person_eidas_final_certificate/missing_subject_cn_and_c.crttest
@@ -0,0 +1,51 @@
+-----BEGIN CERTIFICATE-----
+MIIHyzCCBjOgAwIBAgIQL2X1v6Go566TnTal1jPvLzANBgkqhkiG9w0BAQsFADBt
+MQswCQYDVQQGEwJFUzEcMBoGA1UEChMTU2VjdGlnbyAoRXVyb3BlKSBTTDFAMD4G
+A1UEAxM3U2VjdGlnbyBRdWFsaWZpZWQgV2Vic2l0ZSBBdXRoZW50aWNhdGlvbiBD
+QSBOYXR1cmFsIFIzNTAeFw0yMTA1MTYwMDAwMDBaFw0yMjA2MTYyMzU5NTlaMF8x
+EDAOBgNVBAcTB1NhbGZvcmQxFjAUBgNVBAUTDVBBU1VTLTAwMDAwMDExDTALBgNV
+BAQTBFVzZXIxDTALBgNVBCoTBFRlc3QxFTATBgNVBEETDFNhbnRhIENsYXVzZTCC
+ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKnwvtBc9r8VFuyomUP1vCe0
+GEdZbCFg0fpvr9C+DlZUWoE81qUtJ2spsADUiDIfvdTzG8cKCCo4XkAjgZUOIUs8
+cpv/Rjqx/7G3UYtj7ttfnZxN+FPULb/5XE/MnNtiRgtTdrJYN29ZUdiUPZjpPFYj
+3x58AgzE7e5Kv6YK3UF70oLDGYff5ChDO/1jbL6LwRgnPtpoImZay0i+lSdC3Olo
+kNsKbVXA/G2zrljNH3e/1eR3WzMNO77N/vDODUalLBl3iJnycFn0WZIi5HNsnCpU
+2D/rsY9aW0w2RRt7YdKumAANZk71A8T83U78NiPnpIscXm8BWGqXcWp8Qt1ckyUC
+AwEAAaOCA/MwggPvMB8GA1UdIwQYMBaAFOXW0EHCR8DEcoGlPi0ZWOlbJSk4MB0G
+A1UdDgQWBBSYnCAvEPPwvdWA2QJ21vPYmqELvDAOBgNVHQ8BAf8EBAMCBaAwDAYD
+VR0TAQH/BAIwADAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwVQYDVR0g
+BE4wTDA1BgwrBgEEAbIxAQIBBwUwJTAjBggrBgEFBQcCARYXaHR0cHM6Ly9zZWN0
+aWdvLmNvbS9DUFMwCQYHBACL7EABBDAIBgZngQwBAgMwXQYDVR0fBFYwVDBSoFCg
+ToZMaHR0cDovL2NybC5zZWN0aWdvLmNvbS9TZWN0aWdvUXVhbGlmaWVkV2Vic2l0
+ZUF1dGhlbnRpY2F0aW9uQ0FOYXR1cmFsUjM1LmNybDCBjgYIKwYBBQUHAQEEgYEw
+fzBYBggrBgEFBQcwAoZMaHR0cDovL2NydC5zZWN0aWdvLmNvbS9TZWN0aWdvUXVh
+bGlmaWVkV2Vic2l0ZUF1dGhlbnRpY2F0aW9uQ0FOYXR1cmFsUjM1LmNydDAjBggr
+BgEFBQcwAYYXaHR0cDovL29jc3Auc2VjdGlnby5jb20wKQYDVR0RBCIwIIIMc2Vj
+dGlnb3FhLmNhghB3d3cuc2VjdGlnb3FhLmNhMH0GCCsGAQUFBwEDBHEwbzAIBgYE
+AI5GAQEwEwYGBACORgEGMAkGBwQAjkYBBgMwCwYGBACORgEDAgEPMCoGBgQAjkYB
+BTAgMB4WGGh0dHBzOi8vc2VjdGlnby5jb20vcGRzLxMCZW4wFQYIKwYBBQUHCwIw
+CQYHBACL7EkBATCCAX0GCisGAQQB1nkCBAIEggFtBIIBaQFnAHUARqVV63X6kSAw
+taKJafTzfREsQXS+/Um4havy/HD+bUcAAAF5dlAiTgAABAMARjBEAiBN8Zg4dg4E
+jEQbNoHPwZSA6ER/8v6dcHljuz7LZOUGMgIgWgN5JrtmKASEuOO6dXO38yM+L0Ri
+ej53Sa+KaSoh7i0AdgBByMqx3yJGShDGoToJQodeTjGLGwPr60vHaPCQYpYG9gAA
+AXl2UCIFAAAEAwBHMEUCIQCqRGD1yGPJm5E96+iiYqSp0cq3Ny/KdjA1EFJMRPMd
+WwIgZvokw4kCpDMY7Ec+TlqKv8TNlOAouPQ7mDvnGRGVDkQAdgApeb7wnjk5IfBW
+c59jpXflvld9nGAK+PlNXSZcJV3HhAAAAXl2UCHiAAAEAwBHMEUCIEA2kWkFUYI3
+8o46iOnm5Ys2Csmgg/0EKJOpKfFB3pLtAiEAsQ3/OhKeg+akhfTkwhexGJGUzCZo
+98AY06eH3M3ZAzgwDQYJKoZIhvcNAQELBQADggGBAA0GeqU79/1VmILU8tjfwH8O
+CCJOuSG18jUU3s3d5qCyXvj7/22eyiUkDezCyGv5SBDxPQKHC61U1svRsdekxb8k
+Gz/Q3tcT84AXteQTFpPknkkSYak6LM9n+ZMEpxATEkJyV87W5IGd/v9AcYKidE4L
+23ZKZmi12vv+fJlOeeHVy+pxJiz+YBGYA3MUUbIC3dGcjiF6Ya9Uq+jt7ttEUp76
+TTF7gXCuR0o4xA84ub+JORyiLCCw3SAkt/FDBPECxHmTW3K5BotlmlI0zYfCmfxI
+qF9LRn4WBIl/TpxS3ZBv5wc1I7y3L/iwAMrD+B8E98JtoZWSmZ9pFAOLkkKQByGB
+96i/P2vo/sx27TPT42mZsXQD9zcidvp4N+0ZPqXyZduG4c5Nlv1o6n+868oBPzQr
+OSZ+Gkw+zd+oko9HTG2kyva3Sh17Vh7RdnX6jf8jd0cFLhbYNuhOQOZ2RpYs5hdP
+/iXnMYaY7pn/iU823Qv6wvExcFpE7WYfTu5MBhJ1Bg==
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.subject,NaturalPersonSubjectAttributeAllowanceValidator,ERROR,etsi.en_319_412_2.nat-4.2.4-1.required_attribute_missing,"Required attributes missing: 2.5.4.3, 2.5.4.6"
+certificate.tbsCertificate.extensions.1.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
+certificate.tbsCertificate.extensions.2.extnValue.keyUsage,NaturalPersonKeyUsageValidator,WARNING,etsi.en_319_412_2.nat-4.3.2-1.mixed_key_usage_setting,
+certificate.tbsCertificate.extensions.5.extnValue.certificatePolicies.0,CertificatePolicyQualifierValidator,NOTICE,pkix.certificate_policies_policy_has_qualifier,
+certificate.tbsCertificate.extensions.5.extnValue.certificatePolicies,QualifiedCertificatePoliciesValidator,ERROR,etsi.en_319_412_2.qcs-5.2-2.mismatched_policy_identifier_for_certificate_type,"Certificate type is QNCP_W_GEN_NATURAL_PERSON_EIDAS_FINAL_CERTIFICATE (0.4.0.194112.1.6) but certificate contains certificate type policy identifier ""0.4.0.194112.1.4"""
diff --git a/tests/integration_certificate/etsi/qncp_w_gen_natural_person_eidas_final_certificate/multiple_common_names_np.crttest b/tests/integration_certificate/etsi/qncp_w_gen_natural_person_eidas_final_certificate/multiple_common_names_np.crttest
new file mode 100644
index 0000000..1f4d2aa
--- /dev/null
+++ b/tests/integration_certificate/etsi/qncp_w_gen_natural_person_eidas_final_certificate/multiple_common_names_np.crttest
@@ -0,0 +1,53 @@
+-----BEGIN CERTIFICATE-----
+MIIH6zCCBlOgAwIBAgIQL2X1v6Go566TnTal1jPvLzANBgkqhkiG9w0BAQsFADBt
+MQswCQYDVQQGEwJFUzEcMBoGA1UEChMTU2VjdGlnbyAoRXVyb3BlKSBTTDFAMD4G
+A1UEAxM3U2VjdGlnbyBRdWFsaWZpZWQgV2Vic2l0ZSBBdXRoZW50aWNhdGlvbiBD
+QSBOYXR1cmFsIFIzNTAeFw0yMTA1MTYwMDAwMDBaFw0yMjA2MTYyMzU5NTlaMH8x
+CzAJBgNVBAYTAlVTMRAwDgYDVQQHEwdTYWxmb3JkMRYwFAYDVQQFEw1QQVNVUy0w
+MDAwMDAxMQ0wCwYDVQQEEwRVc2VyMQ0wCwYDVQQqEwRUZXN0MRUwEwYDVQQDEwxz
+ZWN0aWdvcWEuY2ExETAPBgNVBAMTCHRlc3QuY29tMIIBIjANBgkqhkiG9w0BAQEF
+AAOCAQ8AMIIBCgKCAQEAqfC+0Fz2vxUW7KiZQ/W8J7QYR1lsIWDR+m+v0L4OVlRa
+gTzWpS0naymwANSIMh+91PMbxwoIKjheQCOBlQ4hSzxym/9GOrH/sbdRi2Pu21+d
+nE34U9Qtv/lcT8yc22JGC1N2slg3b1lR2JQ9mOk8ViPfHnwCDMTt7kq/pgrdQXvS
+gsMZh9/kKEM7/WNsvovBGCc+2mgiZlrLSL6VJ0Lc6WiQ2wptVcD8bbOuWM0fd7/V
+5HdbMw07vs3+8M4NRqUsGXeImfJwWfRZkiLkc2ycKlTYP+uxj1pbTDZFG3th0q6Y
+AA1mTvUDxPzdTvw2I+ekixxebwFYapdxanxC3VyTJQIDAQABo4ID8zCCA+8wHwYD
+VR0jBBgwFoAU5dbQQcJHwMRygaU+LRlY6VslKTgwHQYDVR0OBBYEFJicIC8Q8/C9
+1YDZAnbW89iaoQu8MA4GA1UdDwEB/wQEAwIFoDAMBgNVHRMBAf8EAjAAMB0GA1Ud
+JQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjBVBgNVHSAETjBMMDUGDCsGAQQBsjEB
+AgEHBTAlMCMGCCsGAQUFBwIBFhdodHRwczovL3NlY3RpZ28uY29tL0NQUzAJBgcE
+AIvsQAEEMAgGBmeBDAECAzBdBgNVHR8EVjBUMFKgUKBOhkxodHRwOi8vY3JsLnNl
+Y3RpZ28uY29tL1NlY3RpZ29RdWFsaWZpZWRXZWJzaXRlQXV0aGVudGljYXRpb25D
+QU5hdHVyYWxSMzUuY3JsMIGOBggrBgEFBQcBAQSBgTB/MFgGCCsGAQUFBzAChkxo
+dHRwOi8vY3J0LnNlY3RpZ28uY29tL1NlY3RpZ29RdWFsaWZpZWRXZWJzaXRlQXV0
+aGVudGljYXRpb25DQU5hdHVyYWxSMzUuY3J0MCMGCCsGAQUFBzABhhdodHRwOi8v
+b2NzcC5zZWN0aWdvLmNvbTApBgNVHREEIjAgggxzZWN0aWdvcWEuY2GCEHd3dy5z
+ZWN0aWdvcWEuY2EwfQYIKwYBBQUHAQMEcTBvMAgGBgQAjkYBATATBgYEAI5GAQYw
+CQYHBACORgEGAzALBgYEAI5GAQMCAQ8wKgYGBACORgEFMCAwHhYYaHR0cHM6Ly9z
+ZWN0aWdvLmNvbS9wZHMvEwJlbjAVBggrBgEFBQcLAjAJBgcEAIvsSQEBMIIBfQYK
+KwYBBAHWeQIEAgSCAW0EggFpAWcAdQBGpVXrdfqRIDC1oolp9PN9ESxBdL79SbiF
+q/L8cP5tRwAAAXl2UCJOAAAEAwBGMEQCIE3xmDh2DgSMRBs2gc/BlIDoRH/y/p1w
+eWO7Pstk5QYyAiBaA3kmu2YoBIS447p1c7fzIz4vRGJ6PndJr4ppKiHuLQB2AEHI
+yrHfIkZKEMahOglCh15OMYsbA+vrS8do8JBilgb2AAABeXZQIgUAAAQDAEcwRQIh
+AKpEYPXIY8mbkT3r6KJipKnRyrc3L8p2MDUQUkxE8x1bAiBm+iTDiQKkMxjsRz5O
+Woq/xM2U4Ci49DuYO+cZEZUORAB2ACl5vvCeOTkh8FZzn2Old+W+V32cYAr4+U1d
+JlwlXceEAAABeXZQIeIAAAQDAEcwRQIgQDaRaQVRgjfyjjqI6eblizYKyaCD/QQo
+k6kp8UHeku0CIQCxDf86Ep6D5qSF9OTCF7EYkZTMJmj3wBjTp4fczdkDODANBgkq
+hkiG9w0BAQsFAAOCAYEADQZ6pTv3/VWYgtTy2N/Afw4IIk65IbXyNRTezd3moLJe
++Pv/bZ7KJSQN7MLIa/lIEPE9AocLrVTWy9Gx16TFvyQbP9De1xPzgBe15BMWk+Se
+SRJhqTosz2f5kwSnEBMSQnJXztbkgZ3+/0BxgqJ0TgvbdkpmaLXa+/58mU554dXL
+6nEmLP5gEZgDcxRRsgLd0ZyOIXphr1Sr6O3u20RSnvpNMXuBcK5HSjjEDzi5v4k5
+HKIsILDdICS38UME8QLEeZNbcrkGi2WaUjTNh8KZ/EioX0tGfhYEiX9OnFLdkG/n
+BzUjvLcv+LAAysP4HwT3wm2hlZKZn2kUA4uSQpAHIYH3qL8/a+j+zHbtM9PjaZmx
+dAP3NyJ2+ng37Rk+pfJl24bhzk2W/Wjqf7zrygE/NCs5Jn4aTD7N36iSj0dMbaTK
+9rdKHXtWHtF2dfqN/yN3RwUuFtg26E5A5nZGlizmF0/+Jecxhpjumf+JTzbdC/rC
+8TFwWkTtZh9O7kwGEnUG
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.subject,NaturalPersonSubjectAttributeAllowanceValidator,ERROR,etsi.en_319_412_2.nat-4.2.4-3.prohibited_duplicate_attribute_present,Prohibited duplicate attribute present: 2.5.4.3
+certificate.tbsCertificate.extensions.1.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
+certificate.tbsCertificate.extensions.2.extnValue.keyUsage,NaturalPersonKeyUsageValidator,WARNING,etsi.en_319_412_2.nat-4.3.2-1.mixed_key_usage_setting,
+certificate.tbsCertificate.subject.rdnSequence.6.0.value.x520CommonName,NcpWCommonNameValidator,ERROR,etsi.en_319_412_4.web-4.1.3-4.common_name_unknown_source,"Unknown source for value of common name: ""test.com"""
+certificate.tbsCertificate.extensions.5.extnValue.certificatePolicies,QualifiedCertificatePoliciesValidator,ERROR,etsi.en_319_412_2.qcs-5.2-2.mismatched_policy_identifier_for_certificate_type,"Certificate type is QNCP_W_GEN_NATURAL_PERSON_EIDAS_FINAL_CERTIFICATE (0.4.0.194112.1.6) but certificate contains certificate type policy identifier ""0.4.0.194112.1.4"""
+certificate.tbsCertificate.extensions.5.extnValue.certificatePolicies.0,CertificatePolicyQualifierValidator,NOTICE,pkix.certificate_policies_policy_has_qualifier,
diff --git a/tests/integration_certificate/etsi/qncp_w_gen_natural_person_eidas_final_certificate/multiple_countries_np.crttest b/tests/integration_certificate/etsi/qncp_w_gen_natural_person_eidas_final_certificate/multiple_countries_np.crttest
new file mode 100644
index 0000000..e8a9cf9
--- /dev/null
+++ b/tests/integration_certificate/etsi/qncp_w_gen_natural_person_eidas_final_certificate/multiple_countries_np.crttest
@@ -0,0 +1,52 @@
+-----BEGIN CERTIFICATE-----
+MIIH5TCCBk2gAwIBAgIQL2X1v6Go566TnTal1jPvLzANBgkqhkiG9w0BAQsFADBt
+MQswCQYDVQQGEwJFUzEcMBoGA1UEChMTU2VjdGlnbyAoRXVyb3BlKSBTTDFAMD4G
+A1UEAxM3U2VjdGlnbyBRdWFsaWZpZWQgV2Vic2l0ZSBBdXRoZW50aWNhdGlvbiBD
+QSBOYXR1cmFsIFIzNTAeFw0yMTA1MTYwMDAwMDBaFw0yMjA2MTYyMzU5NTlaMHkx
+CzAJBgNVBAYTAlVTMQswCQYDVQQGEwJHQjEQMA4GA1UEBxMHU2FsZm9yZDEWMBQG
+A1UEBRMNUEFTVVMtMDAwMDAwMTENMAsGA1UEBBMEVXNlcjENMAsGA1UEKhMEVGVz
+dDEVMBMGA1UEAxMMc2VjdGlnb3FhLmNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
+MIIBCgKCAQEAqfC+0Fz2vxUW7KiZQ/W8J7QYR1lsIWDR+m+v0L4OVlRagTzWpS0n
+aymwANSIMh+91PMbxwoIKjheQCOBlQ4hSzxym/9GOrH/sbdRi2Pu21+dnE34U9Qt
+v/lcT8yc22JGC1N2slg3b1lR2JQ9mOk8ViPfHnwCDMTt7kq/pgrdQXvSgsMZh9/k
+KEM7/WNsvovBGCc+2mgiZlrLSL6VJ0Lc6WiQ2wptVcD8bbOuWM0fd7/V5HdbMw07
+vs3+8M4NRqUsGXeImfJwWfRZkiLkc2ycKlTYP+uxj1pbTDZFG3th0q6YAA1mTvUD
+xPzdTvw2I+ekixxebwFYapdxanxC3VyTJQIDAQABo4ID8zCCA+8wHwYDVR0jBBgw
+FoAU5dbQQcJHwMRygaU+LRlY6VslKTgwHQYDVR0OBBYEFJicIC8Q8/C91YDZAnbW
+89iaoQu8MA4GA1UdDwEB/wQEAwIFoDAMBgNVHRMBAf8EAjAAMB0GA1UdJQQWMBQG
+CCsGAQUFBwMBBggrBgEFBQcDAjBVBgNVHSAETjBMMDUGDCsGAQQBsjEBAgEHBTAl
+MCMGCCsGAQUFBwIBFhdodHRwczovL3NlY3RpZ28uY29tL0NQUzAJBgcEAIvsQAEE
+MAgGBmeBDAECAzBdBgNVHR8EVjBUMFKgUKBOhkxodHRwOi8vY3JsLnNlY3RpZ28u
+Y29tL1NlY3RpZ29RdWFsaWZpZWRXZWJzaXRlQXV0aGVudGljYXRpb25DQU5hdHVy
+YWxSMzUuY3JsMIGOBggrBgEFBQcBAQSBgTB/MFgGCCsGAQUFBzAChkxodHRwOi8v
+Y3J0LnNlY3RpZ28uY29tL1NlY3RpZ29RdWFsaWZpZWRXZWJzaXRlQXV0aGVudGlj
+YXRpb25DQU5hdHVyYWxSMzUuY3J0MCMGCCsGAQUFBzABhhdodHRwOi8vb2NzcC5z
+ZWN0aWdvLmNvbTApBgNVHREEIjAgggxzZWN0aWdvcWEuY2GCEHd3dy5zZWN0aWdv
+cWEuY2EwfQYIKwYBBQUHAQMEcTBvMAgGBgQAjkYBATATBgYEAI5GAQYwCQYHBACO
+RgEGAzALBgYEAI5GAQMCAQ8wKgYGBACORgEFMCAwHhYYaHR0cHM6Ly9zZWN0aWdv
+LmNvbS9wZHMvEwJlbjAVBggrBgEFBQcLAjAJBgcEAIvsSQEBMIIBfQYKKwYBBAHW
+eQIEAgSCAW0EggFpAWcAdQBGpVXrdfqRIDC1oolp9PN9ESxBdL79SbiFq/L8cP5t
+RwAAAXl2UCJOAAAEAwBGMEQCIE3xmDh2DgSMRBs2gc/BlIDoRH/y/p1weWO7Pstk
+5QYyAiBaA3kmu2YoBIS447p1c7fzIz4vRGJ6PndJr4ppKiHuLQB2AEHIyrHfIkZK
+EMahOglCh15OMYsbA+vrS8do8JBilgb2AAABeXZQIgUAAAQDAEcwRQIhAKpEYPXI
+Y8mbkT3r6KJipKnRyrc3L8p2MDUQUkxE8x1bAiBm+iTDiQKkMxjsRz5OWoq/xM2U
+4Ci49DuYO+cZEZUORAB2ACl5vvCeOTkh8FZzn2Old+W+V32cYAr4+U1dJlwlXceE
+AAABeXZQIeIAAAQDAEcwRQIgQDaRaQVRgjfyjjqI6eblizYKyaCD/QQok6kp8UHe
+ku0CIQCxDf86Ep6D5qSF9OTCF7EYkZTMJmj3wBjTp4fczdkDODANBgkqhkiG9w0B
+AQsFAAOCAYEADQZ6pTv3/VWYgtTy2N/Afw4IIk65IbXyNRTezd3moLJe+Pv/bZ7K
+JSQN7MLIa/lIEPE9AocLrVTWy9Gx16TFvyQbP9De1xPzgBe15BMWk+SeSRJhqTos
+z2f5kwSnEBMSQnJXztbkgZ3+/0BxgqJ0TgvbdkpmaLXa+/58mU554dXL6nEmLP5g
+EZgDcxRRsgLd0ZyOIXphr1Sr6O3u20RSnvpNMXuBcK5HSjjEDzi5v4k5HKIsILDd
+ICS38UME8QLEeZNbcrkGi2WaUjTNh8KZ/EioX0tGfhYEiX9OnFLdkG/nBzUjvLcv
++LAAysP4HwT3wm2hlZKZn2kUA4uSQpAHIYH3qL8/a+j+zHbtM9PjaZmxdAP3NyJ2
++ng37Rk+pfJl24bhzk2W/Wjqf7zrygE/NCs5Jn4aTD7N36iSj0dMbaTK9rdKHXtW
+HtF2dfqN/yN3RwUuFtg26E5A5nZGlizmF0/+Jecxhpjumf+JTzbdC/rC8TFwWkTt
+Zh9O7kwGEnUG
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.subject,NaturalPersonSubjectAttributeAllowanceValidator,ERROR,etsi.en_319_412_2.nat-4.2.4-3.prohibited_duplicate_attribute_present,Prohibited duplicate attribute present: 2.5.4.6
+certificate.tbsCertificate.extensions.1.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
+certificate.tbsCertificate.extensions.2.extnValue.keyUsage,NaturalPersonKeyUsageValidator,WARNING,etsi.en_319_412_2.nat-4.3.2-1.mixed_key_usage_setting,
+certificate.tbsCertificate.extensions.5.extnValue.certificatePolicies.0,CertificatePolicyQualifierValidator,NOTICE,pkix.certificate_policies_policy_has_qualifier,
+certificate.tbsCertificate.extensions.5.extnValue.certificatePolicies,QualifiedCertificatePoliciesValidator,ERROR,etsi.en_319_412_2.qcs-5.2-2.mismatched_policy_identifier_for_certificate_type,"Certificate type is QNCP_W_GEN_NATURAL_PERSON_EIDAS_FINAL_CERTIFICATE (0.4.0.194112.1.6) but certificate contains certificate type policy identifier ""0.4.0.194112.1.4"""
diff --git a/tests/integration_certificate/etsi/qncp_w_gen_natural_person_eidas_final_certificate/natural_person.crttest b/tests/integration_certificate/etsi/qncp_w_gen_natural_person_eidas_final_certificate/natural_person.crttest
new file mode 100644
index 0000000..4b9e541
--- /dev/null
+++ b/tests/integration_certificate/etsi/qncp_w_gen_natural_person_eidas_final_certificate/natural_person.crttest
@@ -0,0 +1,51 @@
+-----BEGIN CERTIFICATE-----
+MIIH2DCCBkCgAwIBAgIQL2X1v6Go566TnTal1jPvLzANBgkqhkiG9w0BAQsFADBt
+MQswCQYDVQQGEwJFUzEcMBoGA1UEChMTU2VjdGlnbyAoRXVyb3BlKSBTTDFAMD4G
+A1UEAxM3U2VjdGlnbyBRdWFsaWZpZWQgV2Vic2l0ZSBBdXRoZW50aWNhdGlvbiBD
+QSBOYXR1cmFsIFIzNTAeFw0yMTA1MTYwMDAwMDBaFw0yMjA2MTYyMzU5NTlaMGwx
+CzAJBgNVBAYTAlVTMRAwDgYDVQQHEwdTYWxmb3JkMRYwFAYDVQQFEw1QQVNVUy0w
+MDAwMDAxMQ0wCwYDVQQEEwRVc2VyMQ0wCwYDVQQqEwRUZXN0MRUwEwYDVQQDEwxz
+ZWN0aWdvcWEuY2EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCp8L7Q
+XPa/FRbsqJlD9bwntBhHWWwhYNH6b6/Qvg5WVFqBPNalLSdrKbAA1IgyH73U8xvH
+CggqOF5AI4GVDiFLPHKb/0Y6sf+xt1GLY+7bX52cTfhT1C2/+VxPzJzbYkYLU3ay
+WDdvWVHYlD2Y6TxWI98efAIMxO3uSr+mCt1Be9KCwxmH3+QoQzv9Y2y+i8EYJz7a
+aCJmWstIvpUnQtzpaJDbCm1VwPxts65YzR93v9Xkd1szDTu+zf7wzg1GpSwZd4iZ
+8nBZ9FmSIuRzbJwqVNg/67GPWltMNkUbe2HSrpgADWZO9QPE/N1O/DYj56SLHF5v
+AVhql3FqfELdXJMlAgMBAAGjggPzMIID7zAfBgNVHSMEGDAWgBTl1tBBwkfAxHKB
+pT4tGVjpWyUpODAdBgNVHQ4EFgQUmJwgLxDz8L3VgNkCdtbz2JqhC7wwDgYDVR0P
+AQH/BAQDAgWgMAwGA1UdEwEB/wQCMAAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsG
+AQUFBwMCMFUGA1UdIAROMEwwNQYMKwYBBAGyMQECAQcFMCUwIwYIKwYBBQUHAgEW
+F2h0dHBzOi8vc2VjdGlnby5jb20vQ1BTMAkGBwQAi+xAAQQwCAYGZ4EMAQIDMF0G
+A1UdHwRWMFQwUqBQoE6GTGh0dHA6Ly9jcmwuc2VjdGlnby5jb20vU2VjdGlnb1F1
+YWxpZmllZFdlYnNpdGVBdXRoZW50aWNhdGlvbkNBTmF0dXJhbFIzNS5jcmwwgY4G
+CCsGAQUFBwEBBIGBMH8wWAYIKwYBBQUHMAKGTGh0dHA6Ly9jcnQuc2VjdGlnby5j
+b20vU2VjdGlnb1F1YWxpZmllZFdlYnNpdGVBdXRoZW50aWNhdGlvbkNBTmF0dXJh
+bFIzNS5jcnQwIwYIKwYBBQUHMAGGF2h0dHA6Ly9vY3NwLnNlY3RpZ28uY29tMCkG
+A1UdEQQiMCCCDHNlY3RpZ29xYS5jYYIQd3d3LnNlY3RpZ29xYS5jYTB9BggrBgEF
+BQcBAwRxMG8wCAYGBACORgEBMBMGBgQAjkYBBjAJBgcEAI5GAQYDMAsGBgQAjkYB
+AwIBDzAqBgYEAI5GAQUwIDAeFhhodHRwczovL3NlY3RpZ28uY29tL3Bkcy8TAmVu
+MBUGCCsGAQUFBwsCMAkGBwQAi+xJAQEwggF9BgorBgEEAdZ5AgQCBIIBbQSCAWkB
+ZwB1AEalVet1+pEgMLWiiWn0830RLEF0vv1JuIWr8vxw/m1HAAABeXZQIk4AAAQD
+AEYwRAIgTfGYOHYOBIxEGzaBz8GUgOhEf/L+nXB5Y7s+y2TlBjICIFoDeSa7ZigE
+hLjjunVzt/MjPi9EYno+d0mvimkqIe4tAHYAQcjKsd8iRkoQxqE6CUKHXk4xixsD
+6+tLx2jwkGKWBvYAAAF5dlAiBQAABAMARzBFAiEAqkRg9chjyZuRPevoomKkqdHK
+tzcvynYwNRBSTETzHVsCIGb6JMOJAqQzGOxHPk5air/EzZTgKLj0O5g75xkRlQ5E
+AHYAKXm+8J45OSHwVnOfY6V35b5XfZxgCvj5TV0mXCVdx4QAAAF5dlAh4gAABAMA
+RzBFAiBANpFpBVGCN/KOOojp5uWLNgrJoIP9BCiTqSnxQd6S7QIhALEN/zoSnoPm
+pIX05MIXsRiRlMwmaPfAGNOnh9zN2QM4MA0GCSqGSIb3DQEBCwUAA4IBgQANBnql
+O/f9VZiC1PLY38B/DggiTrkhtfI1FN7N3eagsl74+/9tnsolJA3swshr+UgQ8T0C
+hwutVNbL0bHXpMW/JBs/0N7XE/OAF7XkExaT5J5JEmGpOizPZ/mTBKcQExJCclfO
+1uSBnf7/QHGConROC9t2SmZotdr7/nyZTnnh1cvqcSYs/mARmANzFFGyAt3RnI4h
+emGvVKvo7e7bRFKe+k0xe4FwrkdKOMQPOLm/iTkcoiwgsN0gJLfxQwTxAsR5k1ty
+uQaLZZpSNM2Hwpn8SKhfS0Z+FgSJf06cUt2Qb+cHNSO8ty/4sADKw/gfBPfCbaGV
+kpmfaRQDi5JCkAchgfeovz9r6P7Mdu0z0+NpmbF0A/c3Inb6eDftGT6l8mXbhuHO
+TZb9aOp/vOvKAT80KzkmfhpMPs3fqJKPR0xtpMr2t0ode1Ye0XZ1+o3/I3dHBS4W
+2DboTkDmdkaWLOYXT/4l5zGGmO6Z/4lPNt0L+sLxMXBaRO1mH07uTAYSdQY=
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.extensions.1.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
+certificate.tbsCertificate.extensions.2.extnValue.keyUsage,NaturalPersonKeyUsageValidator,WARNING,etsi.en_319_412_2.nat-4.3.2-1.mixed_key_usage_setting,
+certificate.tbsCertificate.extensions.5.extnValue.certificatePolicies.0,CertificatePolicyQualifierValidator,NOTICE,pkix.certificate_policies_policy_has_qualifier,
+certificate.tbsCertificate.extensions.5.extnValue.certificatePolicies,QualifiedCertificatePoliciesValidator,ERROR,etsi.en_319_412_2.qcs-5.2-2.mismatched_policy_identifier_for_certificate_type,"Certificate type is QNCP_W_GEN_NATURAL_PERSON_EIDAS_FINAL_CERTIFICATE (0.4.0.194112.1.6) but certificate contains certificate type policy identifier ""0.4.0.194112.1.4"""
+
diff --git a/tests/integration_certificate/etsi/qncp_w_gen_natural_person_eidas_final_certificate/pseudonymn_np.crttest b/tests/integration_certificate/etsi/qncp_w_gen_natural_person_eidas_final_certificate/pseudonymn_np.crttest
new file mode 100644
index 0000000..481a3e6
--- /dev/null
+++ b/tests/integration_certificate/etsi/qncp_w_gen_natural_person_eidas_final_certificate/pseudonymn_np.crttest
@@ -0,0 +1,52 @@
+-----BEGIN CERTIFICATE-----
+MIIH8DCCBligAwIBAgIQL2X1v6Go566TnTal1jPvLzANBgkqhkiG9w0BAQsFADBt
+MQswCQYDVQQGEwJFUzEcMBoGA1UEChMTU2VjdGlnbyAoRXVyb3BlKSBTTDFAMD4G
+A1UEAxM3U2VjdGlnbyBRdWFsaWZpZWQgV2Vic2l0ZSBBdXRoZW50aWNhdGlvbiBD
+QSBOYXR1cmFsIFIzNTAeFw0yMTA1MTYwMDAwMDBaFw0yMjA2MTYyMzU5NTlaMIGD
+MQswCQYDVQQGEwJVUzEQMA4GA1UEBxMHU2FsZm9yZDEWMBQGA1UEBRMNUEFTVVMt
+MDAwMDAwMTENMAsGA1UEBBMEVXNlcjENMAsGA1UEKhMEVGVzdDEVMBMGA1UEQRMM
+U2FudGEgQ2xhdXNlMRUwEwYDVQQDEwxzZWN0aWdvcWEuY2EwggEiMA0GCSqGSIb3
+DQEBAQUAA4IBDwAwggEKAoIBAQCp8L7QXPa/FRbsqJlD9bwntBhHWWwhYNH6b6/Q
+vg5WVFqBPNalLSdrKbAA1IgyH73U8xvHCggqOF5AI4GVDiFLPHKb/0Y6sf+xt1GL
+Y+7bX52cTfhT1C2/+VxPzJzbYkYLU3ayWDdvWVHYlD2Y6TxWI98efAIMxO3uSr+m
+Ct1Be9KCwxmH3+QoQzv9Y2y+i8EYJz7aaCJmWstIvpUnQtzpaJDbCm1VwPxts65Y
+zR93v9Xkd1szDTu+zf7wzg1GpSwZd4iZ8nBZ9FmSIuRzbJwqVNg/67GPWltMNkUb
+e2HSrpgADWZO9QPE/N1O/DYj56SLHF5vAVhql3FqfELdXJMlAgMBAAGjggPzMIID
+7zAfBgNVHSMEGDAWgBTl1tBBwkfAxHKBpT4tGVjpWyUpODAdBgNVHQ4EFgQUmJwg
+LxDz8L3VgNkCdtbz2JqhC7wwDgYDVR0PAQH/BAQDAgWgMAwGA1UdEwEB/wQCMAAw
+HQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMFUGA1UdIAROMEwwNQYMKwYB
+BAGyMQECAQcFMCUwIwYIKwYBBQUHAgEWF2h0dHBzOi8vc2VjdGlnby5jb20vQ1BT
+MAkGBwQAi+xAAQQwCAYGZ4EMAQIDMF0GA1UdHwRWMFQwUqBQoE6GTGh0dHA6Ly9j
+cmwuc2VjdGlnby5jb20vU2VjdGlnb1F1YWxpZmllZFdlYnNpdGVBdXRoZW50aWNh
+dGlvbkNBTmF0dXJhbFIzNS5jcmwwgY4GCCsGAQUFBwEBBIGBMH8wWAYIKwYBBQUH
+MAKGTGh0dHA6Ly9jcnQuc2VjdGlnby5jb20vU2VjdGlnb1F1YWxpZmllZFdlYnNp
+dGVBdXRoZW50aWNhdGlvbkNBTmF0dXJhbFIzNS5jcnQwIwYIKwYBBQUHMAGGF2h0
+dHA6Ly9vY3NwLnNlY3RpZ28uY29tMCkGA1UdEQQiMCCCDHNlY3RpZ29xYS5jYYIQ
+d3d3LnNlY3RpZ29xYS5jYTB9BggrBgEFBQcBAwRxMG8wCAYGBACORgEBMBMGBgQA
+jkYBBjAJBgcEAI5GAQYDMAsGBgQAjkYBAwIBDzAqBgYEAI5GAQUwIDAeFhhodHRw
+czovL3NlY3RpZ28uY29tL3Bkcy8TAmVuMBUGCCsGAQUFBwsCMAkGBwQAi+xJAQEw
+ggF9BgorBgEEAdZ5AgQCBIIBbQSCAWkBZwB1AEalVet1+pEgMLWiiWn0830RLEF0
+vv1JuIWr8vxw/m1HAAABeXZQIk4AAAQDAEYwRAIgTfGYOHYOBIxEGzaBz8GUgOhE
+f/L+nXB5Y7s+y2TlBjICIFoDeSa7ZigEhLjjunVzt/MjPi9EYno+d0mvimkqIe4t
+AHYAQcjKsd8iRkoQxqE6CUKHXk4xixsD6+tLx2jwkGKWBvYAAAF5dlAiBQAABAMA
+RzBFAiEAqkRg9chjyZuRPevoomKkqdHKtzcvynYwNRBSTETzHVsCIGb6JMOJAqQz
+GOxHPk5air/EzZTgKLj0O5g75xkRlQ5EAHYAKXm+8J45OSHwVnOfY6V35b5XfZxg
+Cvj5TV0mXCVdx4QAAAF5dlAh4gAABAMARzBFAiBANpFpBVGCN/KOOojp5uWLNgrJ
+oIP9BCiTqSnxQd6S7QIhALEN/zoSnoPmpIX05MIXsRiRlMwmaPfAGNOnh9zN2QM4
+MA0GCSqGSIb3DQEBCwUAA4IBgQANBnqlO/f9VZiC1PLY38B/DggiTrkhtfI1FN7N
+3eagsl74+/9tnsolJA3swshr+UgQ8T0ChwutVNbL0bHXpMW/JBs/0N7XE/OAF7Xk
+ExaT5J5JEmGpOizPZ/mTBKcQExJCclfO1uSBnf7/QHGConROC9t2SmZotdr7/nyZ
+Tnnh1cvqcSYs/mARmANzFFGyAt3RnI4hemGvVKvo7e7bRFKe+k0xe4FwrkdKOMQP
+OLm/iTkcoiwgsN0gJLfxQwTxAsR5k1tyuQaLZZpSNM2Hwpn8SKhfS0Z+FgSJf06c
+Ut2Qb+cHNSO8ty/4sADKw/gfBPfCbaGVkpmfaRQDi5JCkAchgfeovz9r6P7Mdu0z
+0+NpmbF0A/c3Inb6eDftGT6l8mXbhuHOTZb9aOp/vOvKAT80KzkmfhpMPs3fqJKP
+R0xtpMr2t0ode1Ye0XZ1+o3/I3dHBS4W2DboTkDmdkaWLOYXT/4l5zGGmO6Z/4lP
+Nt0L+sLxMXBaRO1mH07uTAYSdQY=
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.subject,NaturalPersonSubjectAttributeAllowanceValidator,ERROR,etsi.en_319_412_2.nat-4.2.4-4.mixed_pseudonym_and_name_attributes_present,
+certificate.tbsCertificate.extensions.1.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
+certificate.tbsCertificate.extensions.2.extnValue.keyUsage,NaturalPersonKeyUsageValidator,WARNING,etsi.en_319_412_2.nat-4.3.2-1.mixed_key_usage_setting,
+certificate.tbsCertificate.extensions.5.extnValue.certificatePolicies.0,CertificatePolicyQualifierValidator,NOTICE,pkix.certificate_policies_policy_has_qualifier,
+certificate.tbsCertificate.extensions.5.extnValue.certificatePolicies,QualifiedCertificatePoliciesValidator,ERROR,etsi.en_319_412_2.qcs-5.2-2.mismatched_policy_identifier_for_certificate_type,"Certificate type is QNCP_W_GEN_NATURAL_PERSON_EIDAS_FINAL_CERTIFICATE (0.4.0.194112.1.6) but certificate contains certificate type policy identifier ""0.4.0.194112.1.4"""
diff --git a/tests/integration_certificate/etsi/qncp_w_gen_natural_person_eidas_final_certificate/subject_name_and_pseudonym_attributes_missing.crttest b/tests/integration_certificate/etsi/qncp_w_gen_natural_person_eidas_final_certificate/subject_name_and_pseudonym_attributes_missing.crttest
new file mode 100644
index 0000000..b13bba6
--- /dev/null
+++ b/tests/integration_certificate/etsi/qncp_w_gen_natural_person_eidas_final_certificate/subject_name_and_pseudonym_attributes_missing.crttest
@@ -0,0 +1,52 @@
+-----BEGIN CERTIFICATE-----
+MIIHzTCCBjWgAwIBAgIQL2X1v6Go566TnTal1jPvLzANBgkqhkiG9w0BAQsFADBt
+MQswCQYDVQQGEwJFUzEcMBoGA1UEChMTU2VjdGlnbyAoRXVyb3BlKSBTTDFAMD4G
+A1UEAxM3U2VjdGlnbyBRdWFsaWZpZWQgV2Vic2l0ZSBBdXRoZW50aWNhdGlvbiBD
+QSBOYXR1cmFsIFIzNTAeFw0yMTA1MTYwMDAwMDBaFw0yMjA2MTYyMzU5NTlaMGEx
+CzAJBgNVBAYTAlVTMRAwDgYDVQQHEwdTYWxmb3JkMRYwFAYDVQQFEw1QQVNVUy0w
+MDAwMDAxMRUwEwYDVQQDEwxzZWN0aWdvcWEuY2ExETAPBgNVBAMTCHRlc3QuY29t
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqfC+0Fz2vxUW7KiZQ/W8
+J7QYR1lsIWDR+m+v0L4OVlRagTzWpS0naymwANSIMh+91PMbxwoIKjheQCOBlQ4h
+Szxym/9GOrH/sbdRi2Pu21+dnE34U9Qtv/lcT8yc22JGC1N2slg3b1lR2JQ9mOk8
+ViPfHnwCDMTt7kq/pgrdQXvSgsMZh9/kKEM7/WNsvovBGCc+2mgiZlrLSL6VJ0Lc
+6WiQ2wptVcD8bbOuWM0fd7/V5HdbMw07vs3+8M4NRqUsGXeImfJwWfRZkiLkc2yc
+KlTYP+uxj1pbTDZFG3th0q6YAA1mTvUDxPzdTvw2I+ekixxebwFYapdxanxC3VyT
+JQIDAQABo4ID8zCCA+8wHwYDVR0jBBgwFoAU5dbQQcJHwMRygaU+LRlY6VslKTgw
+HQYDVR0OBBYEFJicIC8Q8/C91YDZAnbW89iaoQu8MA4GA1UdDwEB/wQEAwIFoDAM
+BgNVHRMBAf8EAjAAMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjBVBgNV
+HSAETjBMMDUGDCsGAQQBsjEBAgEHBTAlMCMGCCsGAQUFBwIBFhdodHRwczovL3Nl
+Y3RpZ28uY29tL0NQUzAJBgcEAIvsQAEEMAgGBmeBDAECAzBdBgNVHR8EVjBUMFKg
+UKBOhkxodHRwOi8vY3JsLnNlY3RpZ28uY29tL1NlY3RpZ29RdWFsaWZpZWRXZWJz
+aXRlQXV0aGVudGljYXRpb25DQU5hdHVyYWxSMzUuY3JsMIGOBggrBgEFBQcBAQSB
+gTB/MFgGCCsGAQUFBzAChkxodHRwOi8vY3J0LnNlY3RpZ28uY29tL1NlY3RpZ29R
+dWFsaWZpZWRXZWJzaXRlQXV0aGVudGljYXRpb25DQU5hdHVyYWxSMzUuY3J0MCMG
+CCsGAQUFBzABhhdodHRwOi8vb2NzcC5zZWN0aWdvLmNvbTApBgNVHREEIjAgggxz
+ZWN0aWdvcWEuY2GCEHd3dy5zZWN0aWdvcWEuY2EwfQYIKwYBBQUHAQMEcTBvMAgG
+BgQAjkYBATATBgYEAI5GAQYwCQYHBACORgEGAzALBgYEAI5GAQMCAQ8wKgYGBACO
+RgEFMCAwHhYYaHR0cHM6Ly9zZWN0aWdvLmNvbS9wZHMvEwJlbjAVBggrBgEFBQcL
+AjAJBgcEAIvsSQEBMIIBfQYKKwYBBAHWeQIEAgSCAW0EggFpAWcAdQBGpVXrdfqR
+IDC1oolp9PN9ESxBdL79SbiFq/L8cP5tRwAAAXl2UCJOAAAEAwBGMEQCIE3xmDh2
+DgSMRBs2gc/BlIDoRH/y/p1weWO7Pstk5QYyAiBaA3kmu2YoBIS447p1c7fzIz4v
+RGJ6PndJr4ppKiHuLQB2AEHIyrHfIkZKEMahOglCh15OMYsbA+vrS8do8JBilgb2
+AAABeXZQIgUAAAQDAEcwRQIhAKpEYPXIY8mbkT3r6KJipKnRyrc3L8p2MDUQUkxE
+8x1bAiBm+iTDiQKkMxjsRz5OWoq/xM2U4Ci49DuYO+cZEZUORAB2ACl5vvCeOTkh
+8FZzn2Old+W+V32cYAr4+U1dJlwlXceEAAABeXZQIeIAAAQDAEcwRQIgQDaRaQVR
+gjfyjjqI6eblizYKyaCD/QQok6kp8UHeku0CIQCxDf86Ep6D5qSF9OTCF7EYkZTM
+Jmj3wBjTp4fczdkDODANBgkqhkiG9w0BAQsFAAOCAYEADQZ6pTv3/VWYgtTy2N/A
+fw4IIk65IbXyNRTezd3moLJe+Pv/bZ7KJSQN7MLIa/lIEPE9AocLrVTWy9Gx16TF
+vyQbP9De1xPzgBe15BMWk+SeSRJhqTosz2f5kwSnEBMSQnJXztbkgZ3+/0BxgqJ0
+TgvbdkpmaLXa+/58mU554dXL6nEmLP5gEZgDcxRRsgLd0ZyOIXphr1Sr6O3u20RS
+nvpNMXuBcK5HSjjEDzi5v4k5HKIsILDdICS38UME8QLEeZNbcrkGi2WaUjTNh8KZ
+/EioX0tGfhYEiX9OnFLdkG/nBzUjvLcv+LAAysP4HwT3wm2hlZKZn2kUA4uSQpAH
+IYH3qL8/a+j+zHbtM9PjaZmxdAP3NyJ2+ng37Rk+pfJl24bhzk2W/Wjqf7zrygE/
+NCs5Jn4aTD7N36iSj0dMbaTK9rdKHXtWHtF2dfqN/yN3RwUuFtg26E5A5nZGlizm
+F0/+Jecxhpjumf+JTzbdC/rC8TFwWkTtZh9O7kwGEnUG
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.extensions.1.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
+certificate.tbsCertificate.subject,NaturalPersonSubjectAttributeAllowanceValidator,ERROR,etsi.en_319_412_2.nat-4.2.4-1.required_attribute_missing,"Required attributes missing: 2.5.4.4, 2.5.4.42, 2.5.4.65"
+certificate.tbsCertificate.extensions.2.extnValue.keyUsage,NaturalPersonKeyUsageValidator,WARNING,etsi.en_319_412_2.nat-4.3.2-1.mixed_key_usage_setting,
+certificate.tbsCertificate.extensions.5.extnValue.certificatePolicies.0,CertificatePolicyQualifierValidator,NOTICE,pkix.certificate_policies_policy_has_qualifier,
+certificate.tbsCertificate.subject.rdnSequence.4.0.value.x520CommonName,NcpWCommonNameValidator,ERROR,etsi.en_319_412_4.web-4.1.3-4.common_name_unknown_source,"Unknown source for value of common name: ""test.com"""
+certificate.tbsCertificate.extensions.5.extnValue.certificatePolicies,QualifiedCertificatePoliciesValidator,ERROR,etsi.en_319_412_2.qcs-5.2-2.mismatched_policy_identifier_for_certificate_type,"Certificate type is QNCP_W_GEN_NATURAL_PERSON_EIDAS_FINAL_CERTIFICATE (0.4.0.194112.1.6) but certificate contains certificate type policy identifier ""0.4.0.194112.1.4"""
diff --git a/tests/integration_certificate/etsi/qncp_w_iv_eidas_final_certificate/invalid_natural_person_id_country.crttest b/tests/integration_certificate/etsi/qncp_w_iv_eidas_final_certificate/invalid_natural_person_id_country.crttest
new file mode 100644
index 0000000..6854bb8
--- /dev/null
+++ b/tests/integration_certificate/etsi/qncp_w_iv_eidas_final_certificate/invalid_natural_person_id_country.crttest
@@ -0,0 +1,56 @@
+-----BEGIN CERTIFICATE-----
+MIIH2DCCBkCgAwIBAgIQL2X1v6Go566TnTal1jPvLzANBgkqhkiG9w0BAQsFADBt
+MQswCQYDVQQGEwJFUzEcMBoGA1UEChMTU2VjdGlnbyAoRXVyb3BlKSBTTDFAMD4G
+A1UEAxM3U2VjdGlnbyBRdWFsaWZpZWQgV2Vic2l0ZSBBdXRoZW50aWNhdGlvbiBD
+QSBOYXR1cmFsIFIzNTAeFw0yMTA1MTYwMDAwMDBaFw0yMjA2MTYyMzU5NTlaMGwx
+CzAJBgNVBAYTAlVTMRAwDgYDVQQHEwdTYWxmb3JkMRYwFAYDVQQFEw1QQVNYRy0w
+MDAwMDAxMQ0wCwYDVQQEEwRVc2VyMQ0wCwYDVQQqEwRUZXN0MRUwEwYDVQQDEwxz
+ZWN0aWdvcWEuY2EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCp8L7Q
+XPa/FRbsqJlD9bwntBhHWWwhYNH6b6/Qvg5WVFqBPNalLSdrKbAA1IgyH73U8xvH
+CggqOF5AI4GVDiFLPHKb/0Y6sf+xt1GLY+7bX52cTfhT1C2/+VxPzJzbYkYLU3ay
+WDdvWVHYlD2Y6TxWI98efAIMxO3uSr+mCt1Be9KCwxmH3+QoQzv9Y2y+i8EYJz7a
+aCJmWstIvpUnQtzpaJDbCm1VwPxts65YzR93v9Xkd1szDTu+zf7wzg1GpSwZd4iZ
+8nBZ9FmSIuRzbJwqVNg/67GPWltMNkUbe2HSrpgADWZO9QPE/N1O/DYj56SLHF5v
+AVhql3FqfELdXJMlAgMBAAGjggPzMIID7zAfBgNVHSMEGDAWgBTl1tBBwkfAxHKB
+pT4tGVjpWyUpODAdBgNVHQ4EFgQUmJwgLxDz8L3VgNkCdtbz2JqhC7wwDgYDVR0P
+AQH/BAQDAgWgMAwGA1UdEwEB/wQCMAAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsG
+AQUFBwMCMFUGA1UdIAROMEwwNQYMKwYBBAGyMQECAQcFMCUwIwYIKwYBBQUHAgEW
+F2h0dHBzOi8vc2VjdGlnby5jb20vQ1BTMAkGBwQAi+xAAQQwCAYGZ4EMAQIDMF0G
+A1UdHwRWMFQwUqBQoE6GTGh0dHA6Ly9jcmwuc2VjdGlnby5jb20vU2VjdGlnb1F1
+YWxpZmllZFdlYnNpdGVBdXRoZW50aWNhdGlvbkNBTmF0dXJhbFIzNS5jcmwwgY4G
+CCsGAQUFBwEBBIGBMH8wWAYIKwYBBQUHMAKGTGh0dHA6Ly9jcnQuc2VjdGlnby5j
+b20vU2VjdGlnb1F1YWxpZmllZFdlYnNpdGVBdXRoZW50aWNhdGlvbkNBTmF0dXJh
+bFIzNS5jcnQwIwYIKwYBBQUHMAGGF2h0dHA6Ly9vY3NwLnNlY3RpZ28uY29tMCkG
+A1UdEQQiMCCCDHNlY3RpZ29xYS5jYYIQd3d3LnNlY3RpZ29xYS5jYTB9BggrBgEF
+BQcBAwRxMG8wCAYGBACORgEBMBMGBgQAjkYBBjAJBgcEAI5GAQYDMAsGBgQAjkYB
+AwIBDzAqBgYEAI5GAQUwIDAeFhhodHRwczovL3NlY3RpZ28uY29tL3Bkcy8TAmVu
+MBUGCCsGAQUFBwsCMAkGBwQAi+xJAQEwggF9BgorBgEEAdZ5AgQCBIIBbQSCAWkB
+ZwB1AEalVet1+pEgMLWiiWn0830RLEF0vv1JuIWr8vxw/m1HAAABeXZQIk4AAAQD
+AEYwRAIgTfGYOHYOBIxEGzaBz8GUgOhEf/L+nXB5Y7s+y2TlBjICIFoDeSa7ZigE
+hLjjunVzt/MjPi9EYno+d0mvimkqIe4tAHYAQcjKsd8iRkoQxqE6CUKHXk4xixsD
+6+tLx2jwkGKWBvYAAAF5dlAiBQAABAMARzBFAiEAqkRg9chjyZuRPevoomKkqdHK
+tzcvynYwNRBSTETzHVsCIGb6JMOJAqQzGOxHPk5air/EzZTgKLj0O5g75xkRlQ5E
+AHYAKXm+8J45OSHwVnOfY6V35b5XfZxgCvj5TV0mXCVdx4QAAAF5dlAh4gAABAMA
+RzBFAiBANpFpBVGCN/KOOojp5uWLNgrJoIP9BCiTqSnxQd6S7QIhALEN/zoSnoPm
+pIX05MIXsRiRlMwmaPfAGNOnh9zN2QM4MA0GCSqGSIb3DQEBCwUAA4IBgQANBnql
+O/f9VZiC1PLY38B/DggiTrkhtfI1FN7N3eagsl74+/9tnsolJA3swshr+UgQ8T0C
+hwutVNbL0bHXpMW/JBs/0N7XE/OAF7XkExaT5J5JEmGpOizPZ/mTBKcQExJCclfO
+1uSBnf7/QHGConROC9t2SmZotdr7/nyZTnnh1cvqcSYs/mARmANzFFGyAt3RnI4h
+emGvVKvo7e7bRFKe+k0xe4FwrkdKOMQPOLm/iTkcoiwgsN0gJLfxQwTxAsR5k1ty
+uQaLZZpSNM2Hwpn8SKhfS0Z+FgSJf06cUt2Qb+cHNSO8ty/4sADKw/gfBPfCbaGV
+kpmfaRQDi5JCkAchgfeovz9r6P7Mdu0z0+NpmbF0A/c3Inb6eDftGT6l8mXbhuHO
+TZb9aOp/vOvKAT80KzkmfhpMPs3fqJKPR0xtpMr2t0ode1Ye0XZ1+o3/I3dHBS4W
+2DboTkDmdkaWLOYXT/4l5zGGmO6Z/4lPNt0L+sLxMXBaRO1mH07uTAYSdQY=
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 1.3.6.1.5.5.7.1.3
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.subject_key_identifier_extension_present,
+certificate.tbsCertificate.subject.rdnSequence.2.0.value.x520SerialNumber,NaturalPersonIdentifierValidator,ERROR,etsi.en_419_412_4.nat-5.1.3.invalid_identifier_country,"Invalid natural person identifier country code: ""XG"""
+certificate.tbsCertificate.extensions.2.extnValue.keyUsage,SubscriberKeyUsageValidator,WARNING,cabf.serverauth.subscriber_rsa_digitalsignature_and_keyencipherment_present,
+certificate.tbsCertificate.extensions.5.extnValue.certificatePolicies,SubscriberPoliciesValidator,WARNING,cabf.serverauth.subscriber_first_policy_oid_not_reserved,
+certificate.tbsCertificate.subject.rdnSequence,IvSubscriberAttributeAllowanceValidator,WARNING,cabf.serverauth.iv.common_name_attribute_present,
+certificate.tbsCertificate.extensions.5.extnValue.certificatePolicies.0.policyQualifiers.0,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
+certificate.tbsCertificate.subject.rdnSequence,IvSubscriberAttributeAllowanceValidator,WARNING,cabf.serverauth.iv.unknown_attribute_present,Unknown attribute present: 2.5.4.5
+certificate.tbsCertificate.extensions.1.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
+certificate.tbsCertificate.extensions.5.extnValue.certificatePolicies,QualifiedCertificatePoliciesValidator,ERROR,etsi.en_319_412_2.qcs-5.2-2.mismatched_policy_identifier_for_certificate_type,"Certificate type is QNCP_W_IV_EIDAS_FINAL_CERTIFICATE (0.4.0.194112.1.5) but certificate contains certificate type policy identifier ""0.4.0.194112.1.4"""
diff --git a/tests/integration_certificate/etsi/qncp_w_iv_eidas_final_certificate/semantics_info_nra_missing.crttest b/tests/integration_certificate/etsi/qncp_w_iv_eidas_final_certificate/semantics_info_nra_missing.crttest
new file mode 100644
index 0000000..1b4a60c
--- /dev/null
+++ b/tests/integration_certificate/etsi/qncp_w_iv_eidas_final_certificate/semantics_info_nra_missing.crttest
@@ -0,0 +1,57 @@
+-----BEGIN CERTIFICATE-----
+MIIH0zCCBjugAwIBAgIQL2X1v6Go566TnTal1jPvLzANBgkqhkiG9w0BAQsFADBt
+MQswCQYDVQQGEwJFUzEcMBoGA1UEChMTU2VjdGlnbyAoRXVyb3BlKSBTTDFAMD4G
+A1UEAxM3U2VjdGlnbyBRdWFsaWZpZWQgV2Vic2l0ZSBBdXRoZW50aWNhdGlvbiBD
+QSBOYXR1cmFsIFIzNTAeFw0yMTA1MTYwMDAwMDBaFw0yMjA2MTYyMzU5NTlaMGcx
+CzAJBgNVBAYTAlVTMRAwDgYDVQQHEwdTYWxmb3JkMREwDwYDVQQFEwhQQTpVUy0w
+MTENMAsGA1UEBBMEVXNlcjENMAsGA1UEKhMEVGVzdDEVMBMGA1UEAxMMc2VjdGln
+b3FhLmNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqfC+0Fz2vxUW
+7KiZQ/W8J7QYR1lsIWDR+m+v0L4OVlRagTzWpS0naymwANSIMh+91PMbxwoIKjhe
+QCOBlQ4hSzxym/9GOrH/sbdRi2Pu21+dnE34U9Qtv/lcT8yc22JGC1N2slg3b1lR
+2JQ9mOk8ViPfHnwCDMTt7kq/pgrdQXvSgsMZh9/kKEM7/WNsvovBGCc+2mgiZlrL
+SL6VJ0Lc6WiQ2wptVcD8bbOuWM0fd7/V5HdbMw07vs3+8M4NRqUsGXeImfJwWfRZ
+kiLkc2ycKlTYP+uxj1pbTDZFG3th0q6YAA1mTvUDxPzdTvw2I+ekixxebwFYapdx
+anxC3VyTJQIDAQABo4ID8zCCA+8wHwYDVR0jBBgwFoAU5dbQQcJHwMRygaU+LRlY
+6VslKTgwHQYDVR0OBBYEFJicIC8Q8/C91YDZAnbW89iaoQu8MA4GA1UdDwEB/wQE
+AwIFoDAMBgNVHRMBAf8EAjAAMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcD
+AjBVBgNVHSAETjBMMDUGDCsGAQQBsjEBAgEHBTAlMCMGCCsGAQUFBwIBFhdodHRw
+czovL3NlY3RpZ28uY29tL0NQUzAJBgcEAIvsQAEEMAgGBmeBDAECAzBdBgNVHR8E
+VjBUMFKgUKBOhkxodHRwOi8vY3JsLnNlY3RpZ28uY29tL1NlY3RpZ29RdWFsaWZp
+ZWRXZWJzaXRlQXV0aGVudGljYXRpb25DQU5hdHVyYWxSMzUuY3JsMIGOBggrBgEF
+BQcBAQSBgTB/MFgGCCsGAQUFBzAChkxodHRwOi8vY3J0LnNlY3RpZ28uY29tL1Nl
+Y3RpZ29RdWFsaWZpZWRXZWJzaXRlQXV0aGVudGljYXRpb25DQU5hdHVyYWxSMzUu
+Y3J0MCMGCCsGAQUFBzABhhdodHRwOi8vb2NzcC5zZWN0aWdvLmNvbTApBgNVHREE
+IjAgggxzZWN0aWdvcWEuY2GCEHd3dy5zZWN0aWdvcWEuY2EwfQYIKwYBBQUHAQME
+cTBvMAgGBgQAjkYBATATBgYEAI5GAQYwCQYHBACORgEGAzALBgYEAI5GAQMCAQ8w
+KgYGBACORgEFMCAwHhYYaHR0cHM6Ly9zZWN0aWdvLmNvbS9wZHMvEwJlbjAVBggr
+BgEFBQcLAjAJBgcEAIvsSQEBMIIBfQYKKwYBBAHWeQIEAgSCAW0EggFpAWcAdQBG
+pVXrdfqRIDC1oolp9PN9ESxBdL79SbiFq/L8cP5tRwAAAXl2UCJOAAAEAwBGMEQC
+IE3xmDh2DgSMRBs2gc/BlIDoRH/y/p1weWO7Pstk5QYyAiBaA3kmu2YoBIS447p1
+c7fzIz4vRGJ6PndJr4ppKiHuLQB2AEHIyrHfIkZKEMahOglCh15OMYsbA+vrS8do
+8JBilgb2AAABeXZQIgUAAAQDAEcwRQIhAKpEYPXIY8mbkT3r6KJipKnRyrc3L8p2
+MDUQUkxE8x1bAiBm+iTDiQKkMxjsRz5OWoq/xM2U4Ci49DuYO+cZEZUORAB2ACl5
+vvCeOTkh8FZzn2Old+W+V32cYAr4+U1dJlwlXceEAAABeXZQIeIAAAQDAEcwRQIg
+QDaRaQVRgjfyjjqI6eblizYKyaCD/QQok6kp8UHeku0CIQCxDf86Ep6D5qSF9OTC
+F7EYkZTMJmj3wBjTp4fczdkDODANBgkqhkiG9w0BAQsFAAOCAYEADQZ6pTv3/VWY
+gtTy2N/Afw4IIk65IbXyNRTezd3moLJe+Pv/bZ7KJSQN7MLIa/lIEPE9AocLrVTW
+y9Gx16TFvyQbP9De1xPzgBe15BMWk+SeSRJhqTosz2f5kwSnEBMSQnJXztbkgZ3+
+/0BxgqJ0TgvbdkpmaLXa+/58mU554dXL6nEmLP5gEZgDcxRRsgLd0ZyOIXphr1Sr
+6O3u20RSnvpNMXuBcK5HSjjEDzi5v4k5HKIsILDdICS38UME8QLEeZNbcrkGi2Wa
+UjTNh8KZ/EioX0tGfhYEiX9OnFLdkG/nBzUjvLcv+LAAysP4HwT3wm2hlZKZn2kU
+A4uSQpAHIYH3qL8/a+j+zHbtM9PjaZmxdAP3NyJ2+ng37Rk+pfJl24bhzk2W/Wjq
+f7zrygE/NCs5Jn4aTD7N36iSj0dMbaTK9rdKHXtWHtF2dfqN/yN3RwUuFtg26E5A
+5nZGlizmF0/+Jecxhpjumf+JTzbdC/rC8TFwWkTtZh9O7kwGEnUG
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.subject.rdnSequence,IvSubscriberAttributeAllowanceValidator,WARNING,cabf.serverauth.iv.common_name_attribute_present,
+certificate.tbsCertificate.subject.rdnSequence,IvSubscriberAttributeAllowanceValidator,WARNING,cabf.serverauth.iv.unknown_attribute_present,Unknown attribute present: 2.5.4.5
+certificate.tbsCertificate.subject.rdnSequence.2.0.value.x520SerialNumber,NaturalPersonIdentifierValidator,NOTICE,etsi.en_319_412_1.nat-5.1.3.national_identifier_scheme_detected,"National registration scheme ""PA"" in natural person identifier: ""PA:US-01"""
+certificate.tbsCertificate.extensions.1.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
+certificate.tbsCertificate.extensions.2.extnValue.keyUsage,SubscriberKeyUsageValidator,WARNING,cabf.serverauth.subscriber_rsa_digitalsignature_and_keyencipherment_present,
+certificate.tbsCertificate.extensions.5.extnValue.certificatePolicies,SubscriberPoliciesValidator,WARNING,cabf.serverauth.subscriber_first_policy_oid_not_reserved,
+certificate.tbsCertificate.extensions.5.extnValue.certificatePolicies.0.policyQualifiers.0,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
+certificate.tbsCertificate.extensions.9.extnValue.qCStatements.4.statementInfo.semanticsInformation,NaturalPersonIdentifierNameRegistrationAuthoritiesValidator,ERROR,etsi.en_319_412_1.nat-5.1.3-05.national_id_scheme_name_registration_authorities_missing,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.subject_key_identifier_extension_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 1.3.6.1.5.5.7.1.3
+certificate.tbsCertificate.extensions.5.extnValue.certificatePolicies,QualifiedCertificatePoliciesValidator,ERROR,etsi.en_319_412_2.qcs-5.2-2.mismatched_policy_identifier_for_certificate_type,"Certificate type is QNCP_W_IV_EIDAS_FINAL_CERTIFICATE (0.4.0.194112.1.5) but certificate contains certificate type policy identifier ""0.4.0.194112.1.4"""
diff --git a/tests/integration_certificate/etsi/qncp_w_iv_eidas_final_certificate/semantics_info_nra_uri_missing.crttest b/tests/integration_certificate/etsi/qncp_w_iv_eidas_final_certificate/semantics_info_nra_uri_missing.crttest
new file mode 100644
index 0000000..3fc5a1d
--- /dev/null
+++ b/tests/integration_certificate/etsi/qncp_w_iv_eidas_final_certificate/semantics_info_nra_uri_missing.crttest
@@ -0,0 +1,58 @@
+-----BEGIN CERTIFICATE-----
+MIIH3zCCBkegAwIBAgIQL2X1v6Go566TnTal1jPvLzANBgkqhkiG9w0BAQsFADBt
+MQswCQYDVQQGEwJFUzEcMBoGA1UEChMTU2VjdGlnbyAoRXVyb3BlKSBTTDFAMD4G
+A1UEAxM3U2VjdGlnbyBRdWFsaWZpZWQgV2Vic2l0ZSBBdXRoZW50aWNhdGlvbiBD
+QSBOYXR1cmFsIFIzNTAeFw0yMTA1MTYwMDAwMDBaFw0yMjA2MTYyMzU5NTlaMGcx
+CzAJBgNVBAYTAlVTMRAwDgYDVQQHEwdTYWxmb3JkMREwDwYDVQQFEwhQQTpVUy0w
+MTENMAsGA1UEBBMEVXNlcjENMAsGA1UEKhMEVGVzdDEVMBMGA1UEAxMMc2VjdGln
+b3FhLmNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqfC+0Fz2vxUW
+7KiZQ/W8J7QYR1lsIWDR+m+v0L4OVlRagTzWpS0naymwANSIMh+91PMbxwoIKjhe
+QCOBlQ4hSzxym/9GOrH/sbdRi2Pu21+dnE34U9Qtv/lcT8yc22JGC1N2slg3b1lR
+2JQ9mOk8ViPfHnwCDMTt7kq/pgrdQXvSgsMZh9/kKEM7/WNsvovBGCc+2mgiZlrL
+SL6VJ0Lc6WiQ2wptVcD8bbOuWM0fd7/V5HdbMw07vs3+8M4NRqUsGXeImfJwWfRZ
+kiLkc2ycKlTYP+uxj1pbTDZFG3th0q6YAA1mTvUDxPzdTvw2I+ekixxebwFYapdx
+anxC3VyTJQIDAQABo4ID/zCCA/swHwYDVR0jBBgwFoAU5dbQQcJHwMRygaU+LRlY
+6VslKTgwHQYDVR0OBBYEFJicIC8Q8/C91YDZAnbW89iaoQu8MA4GA1UdDwEB/wQE
+AwIFoDAMBgNVHRMBAf8EAjAAMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcD
+AjBVBgNVHSAETjBMMDUGDCsGAQQBsjEBAgEHBTAlMCMGCCsGAQUFBwIBFhdodHRw
+czovL3NlY3RpZ28uY29tL0NQUzAJBgcEAIvsQAEEMAgGBmeBDAECAzBdBgNVHR8E
+VjBUMFKgUKBOhkxodHRwOi8vY3JsLnNlY3RpZ28uY29tL1NlY3RpZ29RdWFsaWZp
+ZWRXZWJzaXRlQXV0aGVudGljYXRpb25DQU5hdHVyYWxSMzUuY3JsMIGOBggrBgEF
+BQcBAQSBgTB/MFgGCCsGAQUFBzAChkxodHRwOi8vY3J0LnNlY3RpZ28uY29tL1Nl
+Y3RpZ29RdWFsaWZpZWRXZWJzaXRlQXV0aGVudGljYXRpb25DQU5hdHVyYWxSMzUu
+Y3J0MCMGCCsGAQUFBzABhhdodHRwOi8vb2NzcC5zZWN0aWdvLmNvbTApBgNVHREE
+IjAgggxzZWN0aWdvcWEuY2GCEHd3dy5zZWN0aWdvcWEuY2EwgYgGCCsGAQUFBwED
+BHwwejAIBgYEAI5GAQEwEwYGBACORgEGMAkGBwQAjkYBBgMwCwYGBACORgEDAgEP
+MCoGBgQAjkYBBTAgMB4WGGh0dHBzOi8vc2VjdGlnby5jb20vcGRzLxMCZW4wIAYI
+KwYBBQUHCwIwFAYHBACL7EkBATAJggdmb28uY29tMIIBfQYKKwYBBAHWeQIEAgSC
+AW0EggFpAWcAdQBGpVXrdfqRIDC1oolp9PN9ESxBdL79SbiFq/L8cP5tRwAAAXl2
+UCJOAAAEAwBGMEQCIE3xmDh2DgSMRBs2gc/BlIDoRH/y/p1weWO7Pstk5QYyAiBa
+A3kmu2YoBIS447p1c7fzIz4vRGJ6PndJr4ppKiHuLQB2AEHIyrHfIkZKEMahOglC
+h15OMYsbA+vrS8do8JBilgb2AAABeXZQIgUAAAQDAEcwRQIhAKpEYPXIY8mbkT3r
+6KJipKnRyrc3L8p2MDUQUkxE8x1bAiBm+iTDiQKkMxjsRz5OWoq/xM2U4Ci49DuY
+O+cZEZUORAB2ACl5vvCeOTkh8FZzn2Old+W+V32cYAr4+U1dJlwlXceEAAABeXZQ
+IeIAAAQDAEcwRQIgQDaRaQVRgjfyjjqI6eblizYKyaCD/QQok6kp8UHeku0CIQCx
+Df86Ep6D5qSF9OTCF7EYkZTMJmj3wBjTp4fczdkDODANBgkqhkiG9w0BAQsFAAOC
+AYEADQZ6pTv3/VWYgtTy2N/Afw4IIk65IbXyNRTezd3moLJe+Pv/bZ7KJSQN7MLI
+a/lIEPE9AocLrVTWy9Gx16TFvyQbP9De1xPzgBe15BMWk+SeSRJhqTosz2f5kwSn
+EBMSQnJXztbkgZ3+/0BxgqJ0TgvbdkpmaLXa+/58mU554dXL6nEmLP5gEZgDcxRR
+sgLd0ZyOIXphr1Sr6O3u20RSnvpNMXuBcK5HSjjEDzi5v4k5HKIsILDdICS38UME
+8QLEeZNbcrkGi2WaUjTNh8KZ/EioX0tGfhYEiX9OnFLdkG/nBzUjvLcv+LAAysP4
+HwT3wm2hlZKZn2kUA4uSQpAHIYH3qL8/a+j+zHbtM9PjaZmxdAP3NyJ2+ng37Rk+
+pfJl24bhzk2W/Wjqf7zrygE/NCs5Jn4aTD7N36iSj0dMbaTK9rdKHXtWHtF2dfqN
+/yN3RwUuFtg26E5A5nZGlizmF0/+Jecxhpjumf+JTzbdC/rC8TFwWkTtZh9O7kwG
+EnUG
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.subject.rdnSequence,IvSubscriberAttributeAllowanceValidator,WARNING,cabf.serverauth.iv.common_name_attribute_present,
+certificate.tbsCertificate.subject.rdnSequence,IvSubscriberAttributeAllowanceValidator,WARNING,cabf.serverauth.iv.unknown_attribute_present,Unknown attribute present: 2.5.4.5
+certificate.tbsCertificate.subject.rdnSequence.2.0.value.x520SerialNumber,NaturalPersonIdentifierValidator,NOTICE,etsi.en_319_412_1.nat-5.1.3.national_identifier_scheme_detected,"National registration scheme ""PA"" in natural person identifier: ""PA:US-01"""
+certificate.tbsCertificate.extensions.1.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
+certificate.tbsCertificate.extensions.2.extnValue.keyUsage,SubscriberKeyUsageValidator,WARNING,cabf.serverauth.subscriber_rsa_digitalsignature_and_keyencipherment_present,
+certificate.tbsCertificate.extensions.5.extnValue.certificatePolicies,SubscriberPoliciesValidator,WARNING,cabf.serverauth.subscriber_first_policy_oid_not_reserved,
+certificate.tbsCertificate.extensions.5.extnValue.certificatePolicies.0.policyQualifiers.0,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
+certificate.tbsCertificate.extensions.9.extnValue.qCStatements.4.statementInfo.semanticsInformation,NaturalPersonIdentifierNameRegistrationAuthoritiesValidator,ERROR,etsi.en_319_412_1.nat-5.1.3-05.national_id_scheme_name_registration_authorities_uri_missing,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.subject_key_identifier_extension_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 1.3.6.1.5.5.7.1.3
+certificate.tbsCertificate.extensions.5.extnValue.certificatePolicies,QualifiedCertificatePoliciesValidator,ERROR,etsi.en_319_412_2.qcs-5.2-2.mismatched_policy_identifier_for_certificate_type,"Certificate type is QNCP_W_IV_EIDAS_FINAL_CERTIFICATE (0.4.0.194112.1.5) but certificate contains certificate type policy identifier ""0.4.0.194112.1.4"""
diff --git a/tests/integration_certificate/etsi/qncp_w_ov_eidas_final_certificate/qcretention_0_value.crttest b/tests/integration_certificate/etsi/qncp_w_ov_eidas_final_certificate/qcretention_0_value.crttest
new file mode 100644
index 0000000..8415ce6
--- /dev/null
+++ b/tests/integration_certificate/etsi/qncp_w_ov_eidas_final_certificate/qcretention_0_value.crttest
@@ -0,0 +1,59 @@
+-----BEGIN CERTIFICATE-----
+MIIH4zCCBsugAwIBAgIQT8EQTyw0XlFlsnajhgndxTANBgkqhkiG9w0BAQsFADBH
+MQswCQYDVQQGEwJFUzERMA8GA1UECgwIRk5NVC1SQ00xJTAjBgNVBAsMHEFDIENv
+bXBvbmVudGVzIEluZm9ybcOhdGljb3MwHhcNMjQwMTI1MTQ1NjM1WhcNMjUwMTI1
+MTQ1NjM1WjB5MQswCQYDVQQGEwJFUzEPMA0GA1UEBwwGTUFEUklEMQ0wCwYDVQQK
+DARGTk1UMRIwEAYDVQQFEwlRMjgyNjAwNEoxGDAWBgNVBGEMD1ZBVEVTLVEyODI2
+MDA0SjEcMBoGA1UEAwwTcHJvdmVlZG9yZXMuZm5tdC5lczCCASIwDQYJKoZIhvcN
+AQEBBQADggEPADCCAQoCggEBAJ0gVvo9+5v6TneKbairT1fMHTvHhdV7aZ6ID/UK
+gnM73+hBv0LK1/xdp3uhug5QUiPUlrcI0LknK7xuvVUjpc4bMwBJd1xZpztAOsIM
+hAM8xvvPXAaTUHW5WUNvjj0USTGLkC1guAmQm7VbHW6umAYZKbru4sv8aUQGf166
+z7pcQ7wwLhpk5sMCN1uJ04TuAIm71rTAdRfNnuZaPsMXgFgQ/HlY4Ufv0P6N3GEr
+SkVj9JMnvMnN5hLZ1EiFzQn7m/nuHwVY9Z3koY7+yLGSzYB/2zZuecV/tVxsesOF
+aCZ0UyXZUx7FpegI1PyPOTDg8RkHV0aNVg5eKgDQoAvMirMCAwEAAaOCBJcwggST
+MAwGA1UdEwEB/wQCMAAwgYEGCCsGAQUFBwEBBHUwczA7BggrBgEFBQcwAYYvaHR0
+cDovL29jc3Bjb21wLmNlcnQuZm5tdC5lcy9vY3NwL09jc3BSZXNwb25kZXIwNAYI
+KwYBBQUHMAKGKGh0dHA6Ly93d3cuY2VydC5mbm10LmVzL2NlcnRzL0FDQ09NUC5j
+cnQwWQYDVR0gBFIwUDAIBgZngQwBAgIwOQYKKwYBBAGsZgMJFTArMCkGCCsGAQUF
+BwIBFh1odHRwOi8vd3d3LmNlcnQuZm5tdC5lcy9kcGNzLzAJBgcEAIvsQAEFMB4G
+A1UdEQQXMBWCE3Byb3ZlZWRvcmVzLmZubXQuZXMwHQYDVR0lBBYwFAYIKwYBBQUH
+AwEGCCsGAQUFBwMCMA4GA1UdDwEB/wQEAwIFoDAdBgNVHQ4EFgQU33VouFQ+JLbJ
+QqUjq0Wc2MFmt44wgbAGCCsGAQUFBwEDBIGjMIGgMAsGBgQAjkYBAwIBADATBgYE
+AI5GAQYwCQYHBACORgEGAzByBgYEAI5GAQUwaDAyFixodHRwczovL3d3dy5jZXJ0
+LmZubXQuZXMvcGRzL1BEU19DT01QX2VzLnBkZhMCZXMwMhYsaHR0cHM6Ly93d3cu
+Y2VydC5mbm10LmVzL3Bkcy9QRFNfQ09NUF9lbi5wZGYTAmVuMAgGBgQAjkYBATAf
+BgNVHSMEGDAWgBQZ+FgvFNamzJsEmAgNTNerAKeDZTCB4AYDVR0fBIHYMIHVMIHS
+oIHPoIHMhoGebGRhcDovL2xkYXBjb21wLmNlcnQuZm5tdC5lcy9DTj1DUkwxLE9V
+PUFDJTIwQ29tcG9uZW50ZXMlMjBJbmZvcm1hdGljb3MsTz1GTk1ULVJDTSxDPUVT
+P2NlcnRpZmljYXRlUmV2b2NhdGlvbkxpc3Q7YmluYXJ5P2Jhc2U/b2JqZWN0Y2xh
+c3M9Y1JMRGlzdHJpYnV0aW9uUG9pbnSGKWh0dHA6Ly93d3cuY2VydC5mbm10LmVz
+L2NybHNjb21wL0NSTDEuY3JsMIIBfQYKKwYBBAHWeQIEAgSCAW0EggFpAWcAdQBO
+daMnXJoQwzhbbNTfP1LrHfDgjhuNacCx+mSxYpo53wAAAY1BH3FbAAAEAwBGMEQC
+IGsslwqMkiUDk8htgr60ujXKWCUrb6AhSbsP7l0eDz7rAiBnZz5wQMd6XYgQqWOz
+vUGDXy3IZFp5G6EkRoTt2d9S/QB2AM8RVu7VLnyv84db2Wkum+kacWdKsBfsrAHS
+W3fOzDsIAAABjUEfcm4AAAQDAEcwRQIgJmWKkBUv4wqEpwZjWfXh3w7CR2E3B9la
+u3U8HRNsZ8UCIQCEKx5A0ipdT5uVneF6V9Lcv+u27TpxXR2HvZ2OT0oNQQB2ABNK
+3xq1mEIJeAxv70x6kaQWtyNJzlhXat+u2qfCq+AiAAABjUEfc3QAAAQDAEcwRQIg
+KHbPdFZwtApBW3e1kmdm5thTEsPli9TnTKB5SwTi0hICIQCDj5GWTjuhPG81kszs
+jNiaKn0EFVXnPG4TNV3D9Thm3zANBgkqhkiG9w0BAQsFAAOCAQEAQdSrj4jTi3vA
+yM7XTSYMFhRHIGVfIMeJ3it1rugyNjhg9dUZsAIozdOlFLyKNNTTk4xOpIwUYz3Q
+uW7NntGHECR0M6HBiKg8fxLSjC728o1/DpFcmJE4h3mvNcQh5cC2JtwHG05HPgjk
+/N+BPq69xDs5QnqH9QUwX3TRkyM6O8hqNyUIHdKQRnvAmxLwZzEnR3KsnZ4LtmPd
+sLcGGRTmBRY8tG32VsdbwFaIH2tX/mV9GOuXx+g/+kPHyCikfwtYnmtNn+lbzTuQ
+0a3sOHC4LATcVfZ3OSt+2Vdk5nHsLxGB2Xla1pI/4u/go3p2B3fFv6zAtPVsTyDh
+qyg2qSji3w==
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.extensions.7.extnValue.qCStatements.0.statementInfo.qcEuRetentionPeriod,QcEuRetentionPeriodValidator,ERROR,etsi.en_319_412_5.gen-4.3.3.retention_period_years_not_positive,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.subject_key_identifier_extension_present,
+certificate.tbsCertificate.subject.rdnSequence,OvSubscriberAttributeAllowanceValidator,WARNING,cabf.serverauth.ov.unknown_attribute_present,Unknown attribute present: 2.5.4.97
+certificate.tbsCertificate.subject.rdnSequence,OvSubscriberAttributeAllowanceValidator,WARNING,cabf.serverauth.ov.common_name_attribute_present,
+certificate.tbsCertificate.extensions.6.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
+certificate.tbsCertificate.extensions.9.extnValue.cRLDistributionPoints.0.distributionPoint.fullName.0.uniformResourceIdentifier,GeneralNameUriSyntaxValidator,NOTICE,pkix.ldap_uri_not_validated,"ldap://ldapcomp.cert.fnmt.es/CN=CRL1,OU=AC%20Componentes%20Informaticos,O=FNMT-RCM,C=ES?certificateRevocationList;binary?base?objectclass=cRLDistributionPoint"
+certificate.tbsCertificate.subject.rdnSequence,OvSubscriberAttributeAllowanceValidator,WARNING,cabf.serverauth.ov.unknown_attribute_present,Unknown attribute present: 2.5.4.5
+certificate.tbsCertificate.extensions.5.extnValue.keyUsage,SubscriberKeyUsageValidator,WARNING,cabf.serverauth.subscriber_rsa_digitalsignature_and_keyencipherment_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 1.3.6.1.5.5.7.1.3
+certificate.tbsCertificate.extensions.9.extnValue.cRLDistributionPoints.0.distributionPoint,CrlDpDistributionPointNameValidator,ERROR,cabf.serverauth.crldp_dpname_prohibited_uri_scheme,"Prohibited URI scheme: ""ldap"""
+certificate.tbsCertificate.extensions.2.extnValue.certificatePolicies.1.policyQualifiers.0,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
+
diff --git a/tests/integration_certificate/etsi/qncp_w_ov_eidas_final_certificate/qcretention_good.crttest b/tests/integration_certificate/etsi/qncp_w_ov_eidas_final_certificate/qcretention_good.crttest
new file mode 100644
index 0000000..810f608
--- /dev/null
+++ b/tests/integration_certificate/etsi/qncp_w_ov_eidas_final_certificate/qcretention_good.crttest
@@ -0,0 +1,58 @@
+-----BEGIN CERTIFICATE-----
+MIIH4zCCBsugAwIBAgIQT8EQTyw0XlFlsnajhgndxTANBgkqhkiG9w0BAQsFADBH
+MQswCQYDVQQGEwJFUzERMA8GA1UECgwIRk5NVC1SQ00xJTAjBgNVBAsMHEFDIENv
+bXBvbmVudGVzIEluZm9ybcOhdGljb3MwHhcNMjQwMTI1MTQ1NjM1WhcNMjUwMTI1
+MTQ1NjM1WjB5MQswCQYDVQQGEwJFUzEPMA0GA1UEBwwGTUFEUklEMQ0wCwYDVQQK
+DARGTk1UMRIwEAYDVQQFEwlRMjgyNjAwNEoxGDAWBgNVBGEMD1ZBVEVTLVEyODI2
+MDA0SjEcMBoGA1UEAwwTcHJvdmVlZG9yZXMuZm5tdC5lczCCASIwDQYJKoZIhvcN
+AQEBBQADggEPADCCAQoCggEBAJ0gVvo9+5v6TneKbairT1fMHTvHhdV7aZ6ID/UK
+gnM73+hBv0LK1/xdp3uhug5QUiPUlrcI0LknK7xuvVUjpc4bMwBJd1xZpztAOsIM
+hAM8xvvPXAaTUHW5WUNvjj0USTGLkC1guAmQm7VbHW6umAYZKbru4sv8aUQGf166
+z7pcQ7wwLhpk5sMCN1uJ04TuAIm71rTAdRfNnuZaPsMXgFgQ/HlY4Ufv0P6N3GEr
+SkVj9JMnvMnN5hLZ1EiFzQn7m/nuHwVY9Z3koY7+yLGSzYB/2zZuecV/tVxsesOF
+aCZ0UyXZUx7FpegI1PyPOTDg8RkHV0aNVg5eKgDQoAvMirMCAwEAAaOCBJcwggST
+MAwGA1UdEwEB/wQCMAAwgYEGCCsGAQUFBwEBBHUwczA7BggrBgEFBQcwAYYvaHR0
+cDovL29jc3Bjb21wLmNlcnQuZm5tdC5lcy9vY3NwL09jc3BSZXNwb25kZXIwNAYI
+KwYBBQUHMAKGKGh0dHA6Ly93d3cuY2VydC5mbm10LmVzL2NlcnRzL0FDQ09NUC5j
+cnQwWQYDVR0gBFIwUDAIBgZngQwBAgIwOQYKKwYBBAGsZgMJFTArMCkGCCsGAQUF
+BwIBFh1odHRwOi8vd3d3LmNlcnQuZm5tdC5lcy9kcGNzLzAJBgcEAIvsQAEFMB4G
+A1UdEQQXMBWCE3Byb3ZlZWRvcmVzLmZubXQuZXMwHQYDVR0lBBYwFAYIKwYBBQUH
+AwEGCCsGAQUFBwMCMA4GA1UdDwEB/wQEAwIFoDAdBgNVHQ4EFgQU33VouFQ+JLbJ
+QqUjq0Wc2MFmt44wgbAGCCsGAQUFBwEDBIGjMIGgMAsGBgQAjkYBAwIBDzATBgYE
+AI5GAQYwCQYHBACORgEGAzByBgYEAI5GAQUwaDAyFixodHRwczovL3d3dy5jZXJ0
+LmZubXQuZXMvcGRzL1BEU19DT01QX2VzLnBkZhMCZXMwMhYsaHR0cHM6Ly93d3cu
+Y2VydC5mbm10LmVzL3Bkcy9QRFNfQ09NUF9lbi5wZGYTAmVuMAgGBgQAjkYBATAf
+BgNVHSMEGDAWgBQZ+FgvFNamzJsEmAgNTNerAKeDZTCB4AYDVR0fBIHYMIHVMIHS
+oIHPoIHMhoGebGRhcDovL2xkYXBjb21wLmNlcnQuZm5tdC5lcy9DTj1DUkwxLE9V
+PUFDJTIwQ29tcG9uZW50ZXMlMjBJbmZvcm1hdGljb3MsTz1GTk1ULVJDTSxDPUVT
+P2NlcnRpZmljYXRlUmV2b2NhdGlvbkxpc3Q7YmluYXJ5P2Jhc2U/b2JqZWN0Y2xh
+c3M9Y1JMRGlzdHJpYnV0aW9uUG9pbnSGKWh0dHA6Ly93d3cuY2VydC5mbm10LmVz
+L2NybHNjb21wL0NSTDEuY3JsMIIBfQYKKwYBBAHWeQIEAgSCAW0EggFpAWcAdQBO
+daMnXJoQwzhbbNTfP1LrHfDgjhuNacCx+mSxYpo53wAAAY1BH3FbAAAEAwBGMEQC
+IGsslwqMkiUDk8htgr60ujXKWCUrb6AhSbsP7l0eDz7rAiBnZz5wQMd6XYgQqWOz
+vUGDXy3IZFp5G6EkRoTt2d9S/QB2AM8RVu7VLnyv84db2Wkum+kacWdKsBfsrAHS
+W3fOzDsIAAABjUEfcm4AAAQDAEcwRQIgJmWKkBUv4wqEpwZjWfXh3w7CR2E3B9la
+u3U8HRNsZ8UCIQCEKx5A0ipdT5uVneF6V9Lcv+u27TpxXR2HvZ2OT0oNQQB2ABNK
+3xq1mEIJeAxv70x6kaQWtyNJzlhXat+u2qfCq+AiAAABjUEfc3QAAAQDAEcwRQIg
+KHbPdFZwtApBW3e1kmdm5thTEsPli9TnTKB5SwTi0hICIQCDj5GWTjuhPG81kszs
+jNiaKn0EFVXnPG4TNV3D9Thm3zANBgkqhkiG9w0BAQsFAAOCAQEAQdSrj4jTi3vA
+yM7XTSYMFhRHIGVfIMeJ3it1rugyNjhg9dUZsAIozdOlFLyKNNTTk4xOpIwUYz3Q
+uW7NntGHECR0M6HBiKg8fxLSjC728o1/DpFcmJE4h3mvNcQh5cC2JtwHG05HPgjk
+/N+BPq69xDs5QnqH9QUwX3TRkyM6O8hqNyUIHdKQRnvAmxLwZzEnR3KsnZ4LtmPd
+sLcGGRTmBRY8tG32VsdbwFaIH2tX/mV9GOuXx+g/+kPHyCikfwtYnmtNn+lbzTuQ
+0a3sOHC4LATcVfZ3OSt+2Vdk5nHsLxGB2Xla1pI/4u/go3p2B3fFv6zAtPVsTyDh
+qyg2qSji3w==
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.subject_key_identifier_extension_present,
+certificate.tbsCertificate.subject.rdnSequence,OvSubscriberAttributeAllowanceValidator,WARNING,cabf.serverauth.ov.unknown_attribute_present,Unknown attribute present: 2.5.4.97
+certificate.tbsCertificate.subject.rdnSequence,OvSubscriberAttributeAllowanceValidator,WARNING,cabf.serverauth.ov.common_name_attribute_present,
+certificate.tbsCertificate.extensions.6.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
+certificate.tbsCertificate.extensions.9.extnValue.cRLDistributionPoints.0.distributionPoint.fullName.0.uniformResourceIdentifier,GeneralNameUriSyntaxValidator,NOTICE,pkix.ldap_uri_not_validated,"ldap://ldapcomp.cert.fnmt.es/CN=CRL1,OU=AC%20Componentes%20Informaticos,O=FNMT-RCM,C=ES?certificateRevocationList;binary?base?objectclass=cRLDistributionPoint"
+certificate.tbsCertificate.subject.rdnSequence,OvSubscriberAttributeAllowanceValidator,WARNING,cabf.serverauth.ov.unknown_attribute_present,Unknown attribute present: 2.5.4.5
+certificate.tbsCertificate.extensions.5.extnValue.keyUsage,SubscriberKeyUsageValidator,WARNING,cabf.serverauth.subscriber_rsa_digitalsignature_and_keyencipherment_present,
+certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 1.3.6.1.5.5.7.1.3
+certificate.tbsCertificate.extensions.9.extnValue.cRLDistributionPoints.0.distributionPoint,CrlDpDistributionPointNameValidator,ERROR,cabf.serverauth.crldp_dpname_prohibited_uri_scheme,"Prohibited URI scheme: ""ldap"""
+certificate.tbsCertificate.extensions.2.extnValue.certificatePolicies.1.policyQualifiers.0,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
+
diff --git a/tests/integration_certificate/pkix/ee_policy_mappings_present.crttest b/tests/integration_certificate/pkix/ee_policy_mappings_present.crttest
new file mode 100644
index 0000000..fe18387
--- /dev/null
+++ b/tests/integration_certificate/pkix/ee_policy_mappings_present.crttest
@@ -0,0 +1,37 @@
+-----BEGIN CERTIFICATE-----
+MIIFwTCCA6mgAwIBAgIQXAuFXAvnWUHfV8w/f52oNjANBgkqhkiG9w0BAQUFADBk
+MQswCQYDVQQGEwJjaDERMA8GA1UEChMIU3dpc3Njb20xJTAjBgNVBAsTHERpZ2l0
+YWwgQ2VydGlmaWNhdGUgU2VydmljZXMxGzAZBgNVBAMTElN3aXNzY29tIFJvb3Qg
+Q0EgMTAeFw0wNTA4MTgxMjA2MjBaFw0yNTA4MTgyMjA2MjBaMGQxCzAJBgNVBAYT
+AmNoMREwDwYDVQQKEwhTd2lzc2NvbTElMCMGA1UECxMcRGlnaXRhbCBDZXJ0aWZp
+Y2F0ZSBTZXJ2aWNlczEbMBkGA1UEAxMSU3dpc3Njb20gUm9vdCBDQSAxMIICIjAN
+BgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0LmwqAzZuz8h+BvVM5OAFmUgdbI9
+m2BtRsiMMW8Xw/qabFbtPMWRV8PNq5ZJkCoZSx6jbVfd8StiKHVFXqrWW/oLJdih
+FvkcxC7mlSpnzNApbjyFNDhhSbEAn9Y6cV9Nbc5fuankiX9qUvrKm/LcqfmdmUc/
+TilftKaNXXsLmREDA/7n29uj/x2lzZAeAR81sH8A25Bvxn570e56eqeqDFdvpG3F
+EzuwpdntMhy0XmeLVNxzh+XTF3xmUHJd1BpYwdnP2IkCb6dJtDZd0KTeByy2dbco
+kdaXvij1mB7qWybJvbCXc9qukSbraMH5ORXWZ0sKbU/Lz7DkQnGMU3nn7uHbHaBu
+HYwadzVcFh4rUx80i9Fs/PJnB3r1re3WmquhsUvhzDdf/X/NTa64H5xD+SpYVUNF
+vJbNcA78yeNmuk6NO4HLFWR7uZToXTNShXEuT46iBhFRyePLoW4xCGQMwtI89Tbo
+19AOeCMgkckkKmUpWyL3Ic6DXqTz3kvTaI9GdVyDCW4pa8RwjPWd1yAv/0bSKzjC
+L3UcPX7ape8eYIVpQtPM+GP+HkM5haa2Y0EQs3MevNP6yn0WR+Kn1dCjigoIlmJW
+bjTb2QK5MHXjBNLnj8KwEUAKrNVxAmKLMb7dxiNYMUJDLXT5xp6mig/p/r+D5kNX
+JLrvRjSq1xIBOO0CAwEAAaNvMG0wHQYDVR0hBBYwFDASBgdghXQBUwABBgdghXQB
+UwABMAwGA1UdEwEB/wQCMAAwHwYDVR0jBBgwFoAUAyUv3m+CATpcLNwroWm1Z9SM
+0/0wHQYDVR0OBBYEFAMlL95vggE6XCzcK6FptWfUjNP9MA0GCSqGSIb3DQEBBQUA
+A4ICAQA1EMvspgQNDQ/NwNurqPKIlwzfky9NfEBWMXrrpA9gzXrzvsMnjgM+pN0S
+734edAY8PzHyHHuRMSG08NBsl9Tpl7IkVh5WwzW9iAUPWxAaZOHHgjD5Mq2eUCzn
+eAXQMbFamIp1TpBcahQq4FJHgmDmHtqBsfsUC1rxn9KVuj7QG9YVHaO+htXbD8BJ
+ZLsuUBlL0iT43R4HVtA4oJVwIHaM190e3p9xxCPvgxNcoyQVTSlAPGrEqdi3pkSl
+DfTgnXceQHAm/NrZNuR55LU/vJtlvrsRls/bxig5OgjOR1tTWsWZ/l2p3e9M1Mal
+rQLmjAcSHm8D0W+go/MpvRLHUKKwf4ipmXeascClOS5cfGniLLDqN2qk4Vrh9VDl
+g++luyqI54zb/W1elxmofmZ1a3Hqv7HHb6D0jqTsNFFbjCYDcKF31QESVwA12yPe
+Dooomf2xEG9L/zgtYE4snOtnta1J7ksfrK/7DZBaZmBwXarNeNQk7shBoJMBkpxq
+nvy5JMWzFYJ+vq6VK+uxwNrjAWALXmmshFZhvnEX/h0TD/7Gh0Xp/jKgGg0TpJRV
+caUWi7rKibCyx/yP2FS1k2Kdzs9Z+z0YzirLNRWCXf9UIltxUvu3yf5gmwBBZPCq
+Kuy2QkPOiWaByIufOVQDJdMWNY6E0F/6MBr1mmz0DlP5OlvRHA==
+-----END CERTIFICATE-----
+
+node_path,validator,severity,code,message
+certificate.tbsCertificate.extensions.0,PolicyMappingsPresenceValidator,ERROR,pkix.end_entity_policy_mappings_extension_present,
+certificate.tbsCertificate.extensions.3.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
diff --git a/tests/integration_certificate/smime_br/organization/multipurpose/gov_orgid_invalid_country.crttest b/tests/integration_certificate/smime_br/organization/multipurpose/gov_orgid_invalid_country.crttest
index 9417fdf..baa3071 100644
--- a/tests/integration_certificate/smime_br/organization/multipurpose/gov_orgid_invalid_country.crttest
+++ b/tests/integration_certificate/smime_br/organization/multipurpose/gov_orgid_invalid_country.crttest
@@ -35,6 +35,6 @@ G+Tj1GckmJI+dJL7fgjYMqaFLtkKodE/JR0Tp5tQtb5kI1ze8bjKV5qnMlCIV1Rt
 aAubxd8E0dIBazc293NX8ypBQRFYjdUR1A==
 -----END CERTIFICATE-----
 node_path,validator,severity,code,message
-certificate.tbsCertificate.subject.rdnSequence.0.0,OrganizationIdentifierAttributeValidator,ERROR,cabf.invalid_subject_organization_identifier_country,"Invalid country code for scheme ""GOV"": ""XG"""
-certificate.tbsCertificate.extensions.3.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
 
+certificate.tbsCertificate.extensions.3.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
+certificate.tbsCertificate.subject.rdnSequence.0.0.value.x520OrganizationIdentifier,CabfSmimeOrganizationIdentifierAttributeValidator,ERROR,cabf.invalid_organization_identifier_country,"Invalid country code for registration scheme ""GOV"": ""XG"""
diff --git a/tests/integration_certificate/smime_br/organization/multipurpose/gov_orgid_no_country.crttest b/tests/integration_certificate/smime_br/organization/multipurpose/gov_orgid_no_country.crttest
index 48ece79..93798d1 100644
--- a/tests/integration_certificate/smime_br/organization/multipurpose/gov_orgid_no_country.crttest
+++ b/tests/integration_certificate/smime_br/organization/multipurpose/gov_orgid_no_country.crttest
@@ -35,6 +35,6 @@ koohmnIEidKmO4lhGqavh8bSVLy00PiebItEVoD4hgMtrcl3c8yM7C/cpXtmlRvk
 m8XfBNHSAWs3NvdzV/MqQUERWI3VEdQ=
 -----END CERTIFICATE-----
 node_path,validator,severity,code,message
-certificate.tbsCertificate.subject.rdnSequence.0.0,OrganizationIdentifierAttributeValidator,ERROR,cabf.invalid_subject_organization_identifier_country,"Invalid country code for scheme ""GOV"": """""
+certificate.tbsCertificate.subject.rdnSequence.0.0.value.x520OrganizationIdentifier,CabfSmimeOrganizationIdentifierAttributeValidator,ERROR,cabf.invalid_subject_organization_identifier_format,"Invalid organization identifier syntax: ""GOV"""
 certificate.tbsCertificate.extensions.3.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
 
diff --git a/tests/integration_certificate/smime_br/organization/multipurpose/int_orgid_with_reference.crttest b/tests/integration_certificate/smime_br/organization/multipurpose/int_orgid_with_reference.crttest
index 58d9e5c..eefb252 100644
--- a/tests/integration_certificate/smime_br/organization/multipurpose/int_orgid_with_reference.crttest
+++ b/tests/integration_certificate/smime_br/organization/multipurpose/int_orgid_with_reference.crttest
@@ -35,6 +35,6 @@ pXtmlRvk49RnJJiSPnSS+34I2DKmhS7ZCqHRPyUdE6ebULW+ZCNc3vG4yleapzJQ
 iFdUbWgLm8XfBNHSAWs3NvdzV/MqQUERWI3VEdQ=
 -----END CERTIFICATE-----
 node_path,validator,severity,code,message
-certificate.tbsCertificate.subject.rdnSequence.0.0,OrganizationIdentifierAttributeValidator,ERROR,cabf.invalid_subject_organization_identifier_format,"Prohibited Registration Reference is present: ""INTXG-123"""
+certificate.tbsCertificate.subject.rdnSequence.0.0.value.x520OrganizationIdentifier,CabfSmimeOrganizationIdentifierAttributeValidator,ERROR,cabf.smime.prohibited_organization_identifier_reference_present_for_scheme,"Registration reference present for scheme ""INT"": ""123"""
 certificate.tbsCertificate.extensions.3.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
 
diff --git a/tests/integration_certificate/smime_br/organization/multipurpose/int_with_country.crttest b/tests/integration_certificate/smime_br/organization/multipurpose/int_with_country.crttest
index 63c679c..6523e9b 100644
--- a/tests/integration_certificate/smime_br/organization/multipurpose/int_with_country.crttest
+++ b/tests/integration_certificate/smime_br/organization/multipurpose/int_with_country.crttest
@@ -35,6 +35,6 @@ G+Tj1GckmJI+dJL7fgjYMqaFLtkKodE/JR0Tp5tQtb5kI1ze8bjKV5qnMlCIV1Rt
 aAubxd8E0dIBazc293NX8ypBQRFYjdUR1A==
 -----END CERTIFICATE-----
 node_path,validator,severity,code,message
-certificate.tbsCertificate.subject.rdnSequence.0.0,OrganizationIdentifierAttributeValidator,ERROR,cabf.invalid_subject_organization_identifier_country,"Invalid country code for scheme ""INT"": ""US"""
+certificate.tbsCertificate.subject.rdnSequence.0.0.value.x520OrganizationIdentifier,CabfSmimeOrganizationIdentifierAttributeValidator,ERROR,cabf.invalid_organization_identifier_country,"Invalid country code for registration scheme ""INT"": ""US"""
 certificate.tbsCertificate.extensions.3.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
 
diff --git a/tests/integration_certificate/smime_br/organization/multipurpose/int_with_xg_country_and_state.crttest b/tests/integration_certificate/smime_br/organization/multipurpose/int_with_xg_country_and_state.crttest
index d1d8b6f..a7ebd0d 100644
--- a/tests/integration_certificate/smime_br/organization/multipurpose/int_with_xg_country_and_state.crttest
+++ b/tests/integration_certificate/smime_br/organization/multipurpose/int_with_xg_country_and_state.crttest
@@ -35,6 +35,6 @@ e2aVG+Tj1GckmJI+dJL7fgjYMqaFLtkKodE/JR0Tp5tQtb5kI1ze8bjKV5qnMlCI
 V1RtaAubxd8E0dIBazc293NX8ypBQRFYjdUR1A==
 -----END CERTIFICATE-----
 node_path,validator,severity,code,message
-certificate.tbsCertificate.subject.rdnSequence.0.0,OrganizationIdentifierAttributeValidator,ERROR,cabf.invalid_subject_organization_identifier_state_province_for_scheme,"Scheme ""INT"" does not allow state/province values"
+certificate.tbsCertificate.subject.rdnSequence.0.0.value.x520OrganizationIdentifier,CabfSmimeOrganizationIdentifierAttributeValidator,ERROR,cabf.invalid_subject_organization_identifier_state_province_for_scheme,"State/province value present for scheme ""INT"": ""PA"""
 certificate.tbsCertificate.extensions.3.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
 
diff --git a/tests/integration_certificate/smime_br/organization/multipurpose/lei_orgid_with_no_reference.crttest b/tests/integration_certificate/smime_br/organization/multipurpose/lei_orgid_with_no_reference.crttest
index 9062904..e77a68f 100644
--- a/tests/integration_certificate/smime_br/organization/multipurpose/lei_orgid_with_no_reference.crttest
+++ b/tests/integration_certificate/smime_br/organization/multipurpose/lei_orgid_with_no_reference.crttest
@@ -34,8 +34,8 @@ whWSiiGacgSJ0qY7iWEapq+HxtJUvLTQ+J5si0RWgPiGAy2tyXdzzIzsL9yle2aV
 G+Tj1GckmJI+dJL7fgjYMqaFLtkKodE/JR0Tp5tQtb5kI1ze8bjKV5qnMlCIV1Rt
 aAubxd8E0dIBazc293NX8ypBQRFYjdUR1A==
 -----END CERTIFICATE-----
+
 node_path,validator,severity,code,message
-certificate.tbsCertificate.subject.rdnSequence.0.0,OrganizationIdentifierAttributeValidator,ERROR,cabf.invalid_subject_organization_identifier_format,"Missing Registration Reference: ""LEIXG"""
-certificate.tbsCertificate.subject.rdnSequence.0.0.value.x520OrganizationIdentifier,OrganizationIdentifierLeiValidator,ERROR,cabf.smime.invalid_lei_scheme_format,"Invalid Organization Identifier format: ""LEIXG"""
+certificate.tbsCertificate.subject.rdnSequence.0.0.value.x520OrganizationIdentifier,CabfSmimeOrganizationIdentifierAttributeValidator,ERROR,cabf.organization_identifier_reference_missing_for_scheme,"Registration reference missing for scheme ""LEI"""
 certificate.tbsCertificate.extensions.3.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
 
diff --git a/tests/integration_certificate/smime_br/organization/multipurpose/ntr_orgid_with_no_reference.crttest b/tests/integration_certificate/smime_br/organization/multipurpose/ntr_orgid_with_no_reference.crttest
index 9cdcb31..f4fbec2 100644
--- a/tests/integration_certificate/smime_br/organization/multipurpose/ntr_orgid_with_no_reference.crttest
+++ b/tests/integration_certificate/smime_br/organization/multipurpose/ntr_orgid_with_no_reference.crttest
@@ -34,7 +34,7 @@ jf/awhWSiiGacgSJ0qY7iWEapq+HxtJUvLTQ+J5si0RWgPiGAy2tyXdzzIzsL9yl
 e2aVG+Tj1GckmJI+dJL7fgjYMqaFLtkKodE/JR0Tp5tQtb5kI1ze8bjKV5qnMlCI
 V1RtaAubxd8E0dIBazc293NX8ypBQRFYjdUR1A==
 -----END CERTIFICATE-----
+
 node_path,validator,severity,code,message
-certificate.tbsCertificate.subject.rdnSequence.0.0,OrganizationIdentifierAttributeValidator,ERROR,cabf.invalid_subject_organization_identifier_format,"Missing Registration Reference: ""NTRUS+PA"""
+certificate.tbsCertificate.subject.rdnSequence.0.0.value.x520OrganizationIdentifier,CabfSmimeOrganizationIdentifierAttributeValidator,ERROR,cabf.organization_identifier_reference_missing_for_scheme,"Registration reference missing for scheme ""NTR"""
 certificate.tbsCertificate.extensions.3.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
-
diff --git a/tests/integration_certificate/smime_br/organization/multipurpose/orgid_has_unknown_scheme.crttest b/tests/integration_certificate/smime_br/organization/multipurpose/orgid_has_unknown_scheme.crttest
index efc7c46..5517e35 100644
--- a/tests/integration_certificate/smime_br/organization/multipurpose/orgid_has_unknown_scheme.crttest
+++ b/tests/integration_certificate/smime_br/organization/multipurpose/orgid_has_unknown_scheme.crttest
@@ -35,6 +35,6 @@ i0RWgPiGAy2tyXdzzIzsL9yle2aVG+Tj1GckmJI+dJL7fgjYMqaFLtkKodE/JR0T
 p5tQtb5kI1ze8bjKV5qnMlCIV1RtaAubxd8E0dIBazc293NX8ypBQRFYjdUR1A==
 -----END CERTIFICATE-----
 node_path,validator,severity,code,message
-certificate.tbsCertificate.subject.rdnSequence.0.0,OrganizationIdentifierAttributeValidator,ERROR,cabf.invalid_subject_organization_identifier_registration_scheme,"Invalid registration scheme: ""TAX"""
+certificate.tbsCertificate.subject.rdnSequence.0.0.value.x520OrganizationIdentifier,CabfSmimeOrganizationIdentifierAttributeValidator,ERROR,cabf.invalid_organization_identifier_registration_scheme,"Invalid registration scheme: ""TAX"""
 certificate.tbsCertificate.extensions.3.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
 
diff --git a/tests/integration_certificate/smime_br/organization/multipurpose/orgid_lei_has_state.crttest b/tests/integration_certificate/smime_br/organization/multipurpose/orgid_lei_has_state.crttest
index 854314a..46c2557 100644
--- a/tests/integration_certificate/smime_br/organization/multipurpose/orgid_lei_has_state.crttest
+++ b/tests/integration_certificate/smime_br/organization/multipurpose/orgid_lei_has_state.crttest
@@ -36,7 +36,6 @@ JR0Tp5tQtb5kI1ze8bjKV5qnMlCIV1RtaAubxd8E0dIBazc293NX8ypBQRFYjdUR
 1A==
 -----END CERTIFICATE-----
 node_path,validator,severity,code,message
-certificate.tbsCertificate.subject.rdnSequence.0.0,OrganizationIdentifierAttributeValidator,ERROR,cabf.invalid_subject_organization_identifier_state_province_for_scheme,"Scheme ""LEI"" does not allow state/province values"
-certificate.tbsCertificate.subject.rdnSequence.0.0.value.x520OrganizationIdentifier,OrganizationIdentifierLeiValidator,ERROR,cabf.smime.invalid_lei_scheme_format,"Invalid Organization Identifier format: ""LEIXG+PA-AEYE00EKXESVZUUEBP67"""
+certificate.tbsCertificate.subject.rdnSequence.0.0.value.x520OrganizationIdentifier,CabfSmimeOrganizationIdentifierAttributeValidator,ERROR,cabf.invalid_subject_organization_identifier_state_province_for_scheme,"State/province value present for scheme ""LEI"": ""PA"""
 certificate.tbsCertificate.extensions.3.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
 
diff --git a/tests/integration_certificate/smime_br/organization/multipurpose/orgid_lei_has_wrong_country_code.crttest b/tests/integration_certificate/smime_br/organization/multipurpose/orgid_lei_has_wrong_country_code.crttest
index e555b15..fb4a962 100644
--- a/tests/integration_certificate/smime_br/organization/multipurpose/orgid_lei_has_wrong_country_code.crttest
+++ b/tests/integration_certificate/smime_br/organization/multipurpose/orgid_lei_has_wrong_country_code.crttest
@@ -35,6 +35,5 @@ i0RWgPiGAy2tyXdzzIzsL9yle2aVG+Tj1GckmJI+dJL7fgjYMqaFLtkKodE/JR0T
 p5tQtb5kI1ze8bjKV5qnMlCIV1RtaAubxd8E0dIBazc293NX8ypBQRFYjdUR1A==
 -----END CERTIFICATE-----
 node_path,validator,severity,code,message
-certificate.tbsCertificate.subject.rdnSequence.0.0,OrganizationIdentifierAttributeValidator,ERROR,cabf.invalid_subject_organization_identifier_country,"Invalid country code for scheme ""LEI"": ""US"""
-certificate.tbsCertificate.subject.rdnSequence.0.0.value.x520OrganizationIdentifier,OrganizationIdentifierLeiValidator,ERROR,cabf.smime.invalid_lei_scheme_format,"Invalid Organization Identifier format: ""LEIUS-AEYE00EKXESVZUUEBP67"""
+certificate.tbsCertificate.subject.rdnSequence.0.0.value.x520OrganizationIdentifier,CabfSmimeOrganizationIdentifierAttributeValidator,ERROR,cabf.invalid_organization_identifier_country,"Invalid country code for registration scheme ""LEI"": ""US"""
 certificate.tbsCertificate.extensions.3.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
diff --git a/tests/integration_certificate/smime_br/organization/multipurpose/orgid_ntr_with_4letter_state.crttest b/tests/integration_certificate/smime_br/organization/multipurpose/orgid_ntr_with_4letter_state.crttest
index 90c0807..67758de 100644
--- a/tests/integration_certificate/smime_br/organization/multipurpose/orgid_ntr_with_4letter_state.crttest
+++ b/tests/integration_certificate/smime_br/organization/multipurpose/orgid_ntr_with_4letter_state.crttest
@@ -38,4 +38,4 @@ tND4nmyLRFaA+IYDLa3Jd3PMjOwv3KV7ZpUb5OPUZySYkj50kvt+CNgypoUu2Qqh
 
 node_path,validator,severity,code,message
 certificate.tbsCertificate.extensions.3.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
-certificate.tbsCertificate.subject.rdnSequence.0.0,OrganizationIdentifierAttributeValidator,ERROR,cabf.invalid_subject_organization_identifier_format,"Invalid format: ""NTRFR+PARI-AEYE00EKXESVZUUEBP67"""
+certificate.tbsCertificate.subject.rdnSequence.0.0.value.x520OrganizationIdentifier,CabfSmimeOrganizationIdentifierAttributeValidator,ERROR,cabf.invalid_subject_organization_identifier_format,"Invalid organization identifier syntax: ""NTRFR+PARI-AEYE00EKXESVZUUEBP67"""
diff --git a/tests/integration_certificate/smime_br/organization/multipurpose/orgid_unknown_country.crttest b/tests/integration_certificate/smime_br/organization/multipurpose/orgid_unknown_country.crttest
index d2fe39e..a8fc5a4 100644
--- a/tests/integration_certificate/smime_br/organization/multipurpose/orgid_unknown_country.crttest
+++ b/tests/integration_certificate/smime_br/organization/multipurpose/orgid_unknown_country.crttest
@@ -35,6 +35,6 @@ i0RWgPiGAy2tyXdzzIzsL9yle2aVG+Tj1GckmJI+dJL7fgjYMqaFLtkKodE/JR0T
 p5tQtb5kI1ze8bjKV5qnMlCIV1RtaAubxd8E0dIBazc293NX8ypBQRFYjdUR1A==
 -----END CERTIFICATE-----
 node_path,validator,severity,code,message
-certificate.tbsCertificate.subject.rdnSequence.0.0,OrganizationIdentifierAttributeValidator,ERROR,cabf.invalid_subject_organization_identifier_country,"Invalid country code for scheme ""NTR"": ""ZZ"""
+certificate.tbsCertificate.subject.rdnSequence.0.0.value.x520OrganizationIdentifier,CabfSmimeOrganizationIdentifierAttributeValidator,ERROR,cabf.invalid_organization_identifier_country,"Invalid country code for registration scheme ""NTR"": ""ZZ"""
 certificate.tbsCertificate.extensions.3.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
 
diff --git a/tests/integration_certificate/smime_br/organization/multipurpose/vat_invalid_country.crttest b/tests/integration_certificate/smime_br/organization/multipurpose/vat_invalid_country.crttest
index 02a557d..dbedf1c 100644
--- a/tests/integration_certificate/smime_br/organization/multipurpose/vat_invalid_country.crttest
+++ b/tests/integration_certificate/smime_br/organization/multipurpose/vat_invalid_country.crttest
@@ -35,6 +35,6 @@ pXtmlRvk49RnJJiSPnSS+34I2DKmhS7ZCqHRPyUdE6ebULW+ZCNc3vG4yleapzJQ
 iFdUbWgLm8XfBNHSAWs3NvdzV/MqQUERWI3VEdQ=
 -----END CERTIFICATE-----
 node_path,validator,severity,code,message
-certificate.tbsCertificate.subject.rdnSequence.0.0,OrganizationIdentifierAttributeValidator,ERROR,cabf.invalid_subject_organization_identifier_country,"Invalid country code for scheme ""VAT"": ""XG"""
+certificate.tbsCertificate.subject.rdnSequence.0.0.value.x520OrganizationIdentifier,CabfSmimeOrganizationIdentifierAttributeValidator,ERROR,cabf.invalid_organization_identifier_country,"Invalid country code for registration scheme ""VAT"": ""XG"""
 certificate.tbsCertificate.extensions.3.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
 
diff --git a/tests/integration_certificate/smime_br/organization/multipurpose/vat_with_state.crttest b/tests/integration_certificate/smime_br/organization/multipurpose/vat_with_state.crttest
index 9d93f63..62e68bc 100644
--- a/tests/integration_certificate/smime_br/organization/multipurpose/vat_with_state.crttest
+++ b/tests/integration_certificate/smime_br/organization/multipurpose/vat_with_state.crttest
@@ -34,7 +34,7 @@ Hdg+sI3/2sIVkoohmnIEidKmO4lhGqavh8bSVLy00PiebItEVoD4hgMtrcl3c8yM
 7C/cpXtmlRvk49RnJJiSPnSS+34I2DKmhS7ZCqHRPyUdE6ebULW+ZCNc3vG4ylea
 pzJQiFdUbWgLm8XfBNHSAWs3NvdzV/MqQUERWI3VEdQ=
 -----END CERTIFICATE-----
+
 node_path,validator,severity,code,message
-certificate.tbsCertificate.subject.rdnSequence.0.0,OrganizationIdentifierAttributeValidator,ERROR,cabf.invalid_subject_organization_identifier_state_province_for_scheme,"Scheme ""VAT"" does not allow state/province values"
+certificate.tbsCertificate.subject.rdnSequence.0.0.value.x520OrganizationIdentifier,CabfSmimeOrganizationIdentifierAttributeValidator,ERROR,cabf.invalid_subject_organization_identifier_state_province_for_scheme,"State/province value present for scheme ""VAT"": ""PA"""
 certificate.tbsCertificate.extensions.3.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
-
diff --git a/tests/integration_certificate/test_etsi_cert.py b/tests/integration_certificate/test_etsi_cert.py
new file mode 100644
index 0000000..74b0077
--- /dev/null
+++ b/tests/integration_certificate/test_etsi_cert.py
@@ -0,0 +1,32 @@
+import functools
+import glob
+import sys
+from os import path
+
+from pkilint import etsi
+from pkilint.etsi import etsi_constants
+from pkilint.pkix import certificate
+from tests import integration_certificate
+
+this_module = sys.modules[__name__]
+
+
+for certificate_type in etsi_constants.CertificateType:
+    cur_dir = path.dirname(__file__)
+
+    test_dir = path.join(cur_dir, 'etsi', certificate_type.name.lower())
+
+    files = glob.glob(path.join(test_dir, '*.crttest'))
+
+    for file in files:
+        validator = certificate.create_pkix_certificate_validator_container(
+            etsi.create_decoding_validators(certificate_type),
+            etsi.create_validators(certificate_type)
+        )
+        filters = etsi.create_etsi_finding_filters(certificate_type)
+
+        file_no_ext, _ = path.splitext(path.basename(file))
+
+        func_name = f'test_{certificate_type}_{file_no_ext}'
+
+        setattr(this_module, func_name, functools.partial(integration_certificate.run_test, file, validator, filters))
diff --git a/tests/integration_certificate/tls_br/ev_final_certificate/cabf_orgid_bad_country.crttest b/tests/integration_certificate/tls_br/ev_final_certificate/cabf_orgid_bad_country.crttest
index eaecec4..da2851a 100644
--- a/tests/integration_certificate/tls_br/ev_final_certificate/cabf_orgid_bad_country.crttest
+++ b/tests/integration_certificate/tls_br/ev_final_certificate/cabf_orgid_bad_country.crttest
@@ -43,5 +43,5 @@ k5pSOQ1Kzg==
 
 node_path,validator,severity,code,message
 certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 2.23.140.3.1
-certificate.tbsCertificate.extensions.4.extnValue.cABFOrganizationIdentifier,CABFOrganizationIdentifierExtensionValidator,ERROR,cabf.serverauth.organization_identifier_ext_invalid_country,"Invalid country code for scheme ""NTR"": ""ZZ"""
+certificate.tbsCertificate.extensions.4.extnValue.cABFOrganizationIdentifier,CABFOrganizationIdentifierExtensionValidator,ERROR,cabf.invalid_organization_identifier_country,"Invalid country code for registration scheme ""NTR"": ""ZZ"""
 certificate.tbsCertificate.extensions.2.extnValue.certificatePolicies.0.policyQualifiers.0,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
diff --git a/tests/integration_certificate/tls_br/ev_final_certificate/cabf_orgid_bad_scheme.crttest b/tests/integration_certificate/tls_br/ev_final_certificate/cabf_orgid_bad_scheme.crttest
index 17f9ed5..353b262 100644
--- a/tests/integration_certificate/tls_br/ev_final_certificate/cabf_orgid_bad_scheme.crttest
+++ b/tests/integration_certificate/tls_br/ev_final_certificate/cabf_orgid_bad_scheme.crttest
@@ -44,4 +44,4 @@ k5pSOQ1Kzg==
 node_path,validator,severity,code,message
 certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 2.23.140.3.1
 certificate.tbsCertificate.extensions.2.extnValue.certificatePolicies.0.policyQualifiers.0,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
-certificate.tbsCertificate.extensions.4.extnValue.cABFOrganizationIdentifier,CABFOrganizationIdentifierExtensionValidator,ERROR,cabf.serverauth.organization_identifier_ext_invalid_registration_scheme,"Invalid registration scheme: ""FOO"""
+certificate.tbsCertificate.extensions.4.extnValue.cABFOrganizationIdentifier,CABFOrganizationIdentifierExtensionValidator,ERROR,cabf.invalid_organization_identifier_registration_scheme,"Invalid registration scheme: ""FOO"""
diff --git a/tests/integration_certificate/tls_br/ev_final_certificate/cabf_orgid_invalid_state_for_scheme.crttest b/tests/integration_certificate/tls_br/ev_final_certificate/cabf_orgid_invalid_state_for_scheme.crttest
index 8a1c9fd..a1a98c3 100644
--- a/tests/integration_certificate/tls_br/ev_final_certificate/cabf_orgid_invalid_state_for_scheme.crttest
+++ b/tests/integration_certificate/tls_br/ev_final_certificate/cabf_orgid_invalid_state_for_scheme.crttest
@@ -43,5 +43,5 @@ EaAJgzlOHGRsk5NZTCZkXpOaUjkNSs4=
 
 node_path,validator,severity,code,message
 certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 2.23.140.3.1
-certificate.tbsCertificate.extensions.4.extnValue.cABFOrganizationIdentifier,CABFOrganizationIdentifierExtensionValidator,ERROR,cabf.serverauth.organization_identifier_ext_invalid_state_province_for_scheme,"Scheme ""VAT"" does not allow state/province values"
+certificate.tbsCertificate.extensions.4.extnValue.cABFOrganizationIdentifier,CABFOrganizationIdentifierExtensionValidator,ERROR,cabf.invalid_subject_organization_identifier_state_province_for_scheme,"State/province value present for scheme ""VAT"": ""PA"""
 certificate.tbsCertificate.extensions.2.extnValue.certificatePolicies.0.policyQualifiers.0,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
diff --git a/tests/integration_certificate/tls_br/ev_final_certificate/invalid_subject_orgid_country.crttest b/tests/integration_certificate/tls_br/ev_final_certificate/invalid_subject_orgid_country.crttest
index b98b928..0de2e30 100644
--- a/tests/integration_certificate/tls_br/ev_final_certificate/invalid_subject_orgid_country.crttest
+++ b/tests/integration_certificate/tls_br/ev_final_certificate/invalid_subject_orgid_country.crttest
@@ -43,6 +43,6 @@ qj0RoAmDOU4cZGyTk1lMJmRek5pSOQ1Kzg==
 
 node_path,validator,severity,code,message
 certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 2.23.140.3.1
-certificate.tbsCertificate.subject.rdnSequence.7.0.value.x520OrganizationIdentifier,OrganizationIdentifierConsistentSubjectAndExtensionValidator,ERROR,cabf.serverauth.organization_identifier_mismatched_country_code,"Mismatched country: subject: ""ZZ"", extension: ""FR"""
+certificate.tbsCertificate.subject.rdnSequence.7.0.value.x520OrganizationIdentifier,OrganizationIdentifierConsistentSubjectAndExtensionValidator,ERROR,cabf.serverauth.organization_identifier_mismatched_value,"Mismatched country: attribute: ""ZZ"", extension: ""FR"""
 certificate.tbsCertificate.extensions.2.extnValue.certificatePolicies.0.policyQualifiers.0,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
-certificate.tbsCertificate.subject.rdnSequence.7.0,OrganizationIdentifierAttributeValidator,ERROR,cabf.invalid_subject_organization_identifier_country,"Invalid country code for scheme ""VAT"": ""ZZ"""
+certificate.tbsCertificate.subject.rdnSequence.7.0.value.x520OrganizationIdentifier,CabfOrganizationIdentifierAttributeValidator,ERROR,cabf.invalid_organization_identifier_country,"Invalid country code for registration scheme ""VAT"": ""ZZ"""
diff --git a/tests/integration_certificate/tls_br/ev_final_certificate/ntr_el_org_id.crttest b/tests/integration_certificate/tls_br/ev_final_certificate/ntr_el_org_id.crttest
index f41bbd3..4e996a3 100644
--- a/tests/integration_certificate/tls_br/ev_final_certificate/ntr_el_org_id.crttest
+++ b/tests/integration_certificate/tls_br/ev_final_certificate/ntr_el_org_id.crttest
@@ -60,5 +60,5 @@ certificate.tbsCertificate.extensions.9.extnValue.keyUsage,SubscriberKeyUsageVal
 certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.subject_key_identifier_extension_present,
 certificate.tbsCertificate.extensions.8.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
 certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies.2.policyQualifiers.0,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
-certificate.tbsCertificate.extensions.6.extnValue.cABFOrganizationIdentifier,CABFOrganizationIdentifierExtensionValidator,ERROR,cabf.serverauth.organization_identifier_ext_invalid_country,"Invalid country code for scheme ""NTR"": ""EL"""
-certificate.tbsCertificate.subject.rdnSequence.3.0,OrganizationIdentifierAttributeValidator,ERROR,cabf.invalid_subject_organization_identifier_country,"Invalid country code for scheme ""NTR"": ""EL"""
+certificate.tbsCertificate.extensions.6.extnValue.cABFOrganizationIdentifier,CABFOrganizationIdentifierExtensionValidator,ERROR,cabf.invalid_organization_identifier_country,"Invalid country code for registration scheme ""NTR"": ""EL"""
+certificate.tbsCertificate.subject.rdnSequence.3.0.value.x520OrganizationIdentifier,CabfOrganizationIdentifierAttributeValidator,ERROR,cabf.invalid_organization_identifier_country,"Invalid country code for registration scheme ""NTR"": ""EL"""
diff --git a/tests/integration_certificate/tls_br/ev_final_certificate/orgid_bad_state_format.crttest b/tests/integration_certificate/tls_br/ev_final_certificate/orgid_bad_state_format.crttest
index a356f3f..1493f4e 100644
--- a/tests/integration_certificate/tls_br/ev_final_certificate/orgid_bad_state_format.crttest
+++ b/tests/integration_certificate/tls_br/ev_final_certificate/orgid_bad_state_format.crttest
@@ -43,6 +43,6 @@ UZGDp6o9EaAJgzlOHGRsk5NZTCZkXpOaUjkNSs4=
 
 node_path,validator,severity,code,message
 certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 2.23.140.3.1
-certificate.tbsCertificate.subject.rdnSequence.7.0.value.x520OrganizationIdentifier,OrganizationIdentifierConsistentSubjectAndExtensionValidator,ERROR,cabf.serverauth.organization_identifier_mismatched_state_province,Extension does not have state/province value but subject does
+certificate.tbsCertificate.subject.rdnSequence.7.0.value.x520OrganizationIdentifier,OrganizationIdentifierConsistentSubjectAndExtensionValidator,ERROR,cabf.serverauth.organization_identifier_mismatched_value,"Mismatched state/province: attribute: ""AAA"", extension: """""
 certificate.tbsCertificate.extensions.2.extnValue.certificatePolicies.0.policyQualifiers.0,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
-certificate.tbsCertificate.subject.rdnSequence.7.0,OrganizationIdentifierAttributeValidator,ERROR,cabf.invalid_subject_organization_identifier_state_province_format,"State/province ""AAA"" is not two letters (will be fixed in erratum ballot)"
+certificate.tbsCertificate.subject.rdnSequence.7.0.value.x520OrganizationIdentifier,CabfOrganizationIdentifierAttributeValidator,ERROR,cabf.invalid_organization_identifier_state_province_format,"State/province ""AAA"" is not two letters (will be fixed in erratum ballot)"
diff --git a/tests/integration_certificate/tls_br/ev_final_certificate/orgid_teletex_string.crttest b/tests/integration_certificate/tls_br/ev_final_certificate/orgid_teletex_string.crttest
index dbe1272..9c08bad 100644
--- a/tests/integration_certificate/tls_br/ev_final_certificate/orgid_teletex_string.crttest
+++ b/tests/integration_certificate/tls_br/ev_final_certificate/orgid_teletex_string.crttest
@@ -45,4 +45,4 @@ node_path,validator,severity,code,message
 certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 2.23.140.3.1
 certificate.tbsCertificate.subject.rdnSequence.7.0,AttributeValueDirectoryStringValidator,ERROR,cabf.serverauth.attribute_value_invalid_encoding_type,Invalid attribute value encoding: teletexString
 certificate.tbsCertificate.extensions.2.extnValue.certificatePolicies.0.policyQualifiers.0,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
-certificate.tbsCertificate.subject.rdnSequence.7.0,OrganizationIdentifierAttributeValidator,ERROR,cabf.invalid_subject_organization_identifier_encoding,Invalid ASN.1 encoding: teletexString
+certificate.tbsCertificate.subject.rdnSequence.7.0.value.x520OrganizationIdentifier,CabfOrganizationIdentifierAttributeValidator,ERROR,cabf.invalid_subject_organization_identifier_encoding,Invalid ASN.1 encoding: teletexString
diff --git a/tests/integration_certificate/tls_br/ev_pre_certificate/invalid_orgid_syntax.crttest b/tests/integration_certificate/tls_br/ev_pre_certificate/invalid_orgid_syntax.crttest
index 1e72ac8..008a1de 100644
--- a/tests/integration_certificate/tls_br/ev_pre_certificate/invalid_orgid_syntax.crttest
+++ b/tests/integration_certificate/tls_br/ev_pre_certificate/invalid_orgid_syntax.crttest
@@ -50,11 +50,10 @@ DTHXDizrL/M/BMECisiJJQWFSquktLz+8w==
 node_path,validator,severity,code,message
 certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 1.3.6.1.5.5.7.1.3
 certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies,SubscriberPoliciesValidator,WARNING,cabf.serverauth.subscriber_first_policy_oid_not_reserved,
-certificate.tbsCertificate.subject.rdnSequence.6.0.value.x520OrganizationIdentifier,OrganizationIdentifierConsistentSubjectAndExtensionValidator,FATAL,cabf.serverauth.organization_identifier_invalid_syntax,"Invalid syntax: ""NTR@NL-27380834"""
 certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.subject_key_identifier_extension_present,
 certificate.tbsCertificate.extensions.9.extnValue.keyUsage,SubscriberKeyUsageValidator,WARNING,cabf.serverauth.subscriber_rsa_digitalsignature_and_keyencipherment_present,
 certificate.tbsCertificate.extensions.8.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
-certificate.tbsCertificate.subject.rdnSequence.6.0,OrganizationIdentifierAttributeValidator,ERROR,cabf.invalid_subject_organization_identifier_format,"Invalid format: ""NTR@NL-27380834"""
 certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies.2.policyQualifiers.0,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
 certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 2.23.140.3.1
 certificate.tbsCertificate.subject.rdnSequence,EvSubscriberAttributeAllowanceValidator,WARNING,cabf.ev_guidelines.common_name_attribute_present,
+certificate.tbsCertificate.subject.rdnSequence.6.0.value.x520OrganizationIdentifier,CabfOrganizationIdentifierAttributeValidator,ERROR,cabf.invalid_subject_organization_identifier_format,"Invalid organization identifier syntax: ""NTR@NL-27380834"""
diff --git a/tests/integration_certificate/tls_br/ev_pre_certificate/mismatched_country_code.crttest b/tests/integration_certificate/tls_br/ev_pre_certificate/mismatched_country_code.crttest
index 3fcd598..fe9c588 100644
--- a/tests/integration_certificate/tls_br/ev_pre_certificate/mismatched_country_code.crttest
+++ b/tests/integration_certificate/tls_br/ev_pre_certificate/mismatched_country_code.crttest
@@ -48,7 +48,7 @@ MdcOLOsv8z8EwQKKyIklBYVKq6S0vP7z
 -----END CERTIFICATE-----
 
 node_path,validator,severity,code,message
-certificate.tbsCertificate.subject.rdnSequence.6.0.value.x520OrganizationIdentifier,OrganizationIdentifierConsistentSubjectAndExtensionValidator,ERROR,cabf.serverauth.organization_identifier_mismatched_country_code,"Mismatched country: subject: ""US"", extension: ""NL"""
+certificate.tbsCertificate.subject.rdnSequence.6.0.value.x520OrganizationIdentifier,OrganizationIdentifierConsistentSubjectAndExtensionValidator,ERROR,cabf.serverauth.organization_identifier_mismatched_value,"Mismatched country: attribute: ""US"", extension: ""NL"""
 certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 1.3.6.1.5.5.7.1.3
 certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies,SubscriberPoliciesValidator,WARNING,cabf.serverauth.subscriber_first_policy_oid_not_reserved,
 certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.subject_key_identifier_extension_present,
diff --git a/tests/integration_certificate/tls_br/ev_pre_certificate/mismatched_registration_reference.crttest b/tests/integration_certificate/tls_br/ev_pre_certificate/mismatched_registration_reference.crttest
index aff427d..c434c22 100644
--- a/tests/integration_certificate/tls_br/ev_pre_certificate/mismatched_registration_reference.crttest
+++ b/tests/integration_certificate/tls_br/ev_pre_certificate/mismatched_registration_reference.crttest
@@ -48,7 +48,7 @@ MdcOLOsv8z8EwQKKyIklBYVKq6S0vP7z
 -----END CERTIFICATE-----
 
 node_path,validator,severity,code,message
-certificate.tbsCertificate.subject.rdnSequence.6.0.value.x520OrganizationIdentifier,OrganizationIdentifierConsistentSubjectAndExtensionValidator,ERROR,cabf.serverauth.organization_identifier_mismatched_registration_reference,"Mismatched Registration Reference: subject: ""27380835"", extension: ""27380834"""
+certificate.tbsCertificate.subject.rdnSequence.6.0.value.x520OrganizationIdentifier,OrganizationIdentifierConsistentSubjectAndExtensionValidator,ERROR,cabf.serverauth.organization_identifier_mismatched_value,"Mismatched registration reference: attribute: ""27380835"", extension: ""27380834"""
 certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 1.3.6.1.5.5.7.1.3
 certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies,SubscriberPoliciesValidator,WARNING,cabf.serverauth.subscriber_first_policy_oid_not_reserved,
 certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.subject_key_identifier_extension_present,
diff --git a/tests/integration_certificate/tls_br/ev_pre_certificate/mismatched_scheme.crttest b/tests/integration_certificate/tls_br/ev_pre_certificate/mismatched_scheme.crttest
index 80a8a37..b9e9ee0 100644
--- a/tests/integration_certificate/tls_br/ev_pre_certificate/mismatched_scheme.crttest
+++ b/tests/integration_certificate/tls_br/ev_pre_certificate/mismatched_scheme.crttest
@@ -56,4 +56,4 @@ certificate.tbsCertificate.extensions.8.extnValue.subjectKeyIdentifier,SubjectKe
 certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies.2.policyQualifiers.0,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
 certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 2.23.140.3.1
 certificate.tbsCertificate.subject.rdnSequence,EvSubscriberAttributeAllowanceValidator,WARNING,cabf.ev_guidelines.common_name_attribute_present,
-certificate.tbsCertificate.subject.rdnSequence.6.0.value.x520OrganizationIdentifier,OrganizationIdentifierConsistentSubjectAndExtensionValidator,ERROR,cabf.serverauth.organization_identifier_mismatched_scheme,"Mismatched scheme: subject: ""VAT"", extension: ""NTR"""
+certificate.tbsCertificate.subject.rdnSequence.6.0.value.x520OrganizationIdentifier,OrganizationIdentifierConsistentSubjectAndExtensionValidator,ERROR,cabf.serverauth.organization_identifier_mismatched_value,"Mismatched scheme: attribute: ""VAT"", extension: ""NTR"""
diff --git a/tests/integration_certificate/tls_br/ev_pre_certificate/mismatched_state_province.crttest b/tests/integration_certificate/tls_br/ev_pre_certificate/mismatched_state_province.crttest
index c23814e..c6428be 100644
--- a/tests/integration_certificate/tls_br/ev_pre_certificate/mismatched_state_province.crttest
+++ b/tests/integration_certificate/tls_br/ev_pre_certificate/mismatched_state_province.crttest
@@ -48,7 +48,7 @@ b1Nk+mBBDTHXDizrL/M/BMECisiJJQWFSquktLz+8w==
 -----END CERTIFICATE-----
 
 node_path,validator,severity,code,message
-certificate.tbsCertificate.subject.rdnSequence.6.0.value.x520OrganizationIdentifier,OrganizationIdentifierConsistentSubjectAndExtensionValidator,ERROR,cabf.serverauth.organization_identifier_mismatched_state_province,"Mismatched state/province value: subject: ""CA"", extension: ""PA"""
+certificate.tbsCertificate.subject.rdnSequence.6.0.value.x520OrganizationIdentifier,OrganizationIdentifierConsistentSubjectAndExtensionValidator,ERROR,cabf.serverauth.organization_identifier_mismatched_value,"Mismatched state/province: attribute: ""CA"", extension: ""PA"""
 certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 1.3.6.1.5.5.7.1.3
 certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies,SubscriberPoliciesValidator,WARNING,cabf.serverauth.subscriber_first_policy_oid_not_reserved,
 certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.subject_key_identifier_extension_present,
diff --git a/tests/integration_certificate/tls_br/ev_pre_certificate/mismatched_state_province_extension_absent.crttest b/tests/integration_certificate/tls_br/ev_pre_certificate/mismatched_state_province_extension_absent.crttest
index 73a7144..9d8a0a3 100644
--- a/tests/integration_certificate/tls_br/ev_pre_certificate/mismatched_state_province_extension_absent.crttest
+++ b/tests/integration_certificate/tls_br/ev_pre_certificate/mismatched_state_province_extension_absent.crttest
@@ -53,7 +53,7 @@ certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies,Subscriber
 certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.subject_key_identifier_extension_present,
 certificate.tbsCertificate.extensions.9.extnValue.keyUsage,SubscriberKeyUsageValidator,WARNING,cabf.serverauth.subscriber_rsa_digitalsignature_and_keyencipherment_present,
 certificate.tbsCertificate.extensions.8.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
-certificate.tbsCertificate.subject.rdnSequence.6.0.value.x520OrganizationIdentifier,OrganizationIdentifierConsistentSubjectAndExtensionValidator,ERROR,cabf.serverauth.organization_identifier_mismatched_state_province,Extension does not have state/province value but subject does
+certificate.tbsCertificate.subject.rdnSequence.6.0.value.x520OrganizationIdentifier,OrganizationIdentifierConsistentSubjectAndExtensionValidator,ERROR,cabf.serverauth.organization_identifier_mismatched_value,"Mismatched state/province: attribute: ""CA"", extension: """""
 certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies.2.policyQualifiers.0,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
 certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 2.23.140.3.1
 certificate.tbsCertificate.subject.rdnSequence,EvSubscriberAttributeAllowanceValidator,WARNING,cabf.ev_guidelines.common_name_attribute_present,
diff --git a/tests/integration_certificate/tls_br/ev_pre_certificate/mismatched_state_province_subject_absent.crttest b/tests/integration_certificate/tls_br/ev_pre_certificate/mismatched_state_province_subject_absent.crttest
index 34ccc2b..4aa5f7d 100644
--- a/tests/integration_certificate/tls_br/ev_pre_certificate/mismatched_state_province_subject_absent.crttest
+++ b/tests/integration_certificate/tls_br/ev_pre_certificate/mismatched_state_province_subject_absent.crttest
@@ -48,7 +48,7 @@ URI6wPdGKrPlv71iqgF/T0hoYAm49xE+O9duGA2yVjb/PkgXV9sWlQAB+pvlb1Nk
 -----END CERTIFICATE-----
 
 node_path,validator,severity,code,message
-certificate.tbsCertificate.subject.rdnSequence.6.0.value.x520OrganizationIdentifier,OrganizationIdentifierConsistentSubjectAndExtensionValidator,ERROR,cabf.serverauth.organization_identifier_mismatched_state_province,Extension has state/province value but subject does not
+certificate.tbsCertificate.subject.rdnSequence.6.0.value.x520OrganizationIdentifier,OrganizationIdentifierConsistentSubjectAndExtensionValidator,ERROR,cabf.serverauth.organization_identifier_mismatched_value,"Mismatched state/province: attribute: """", extension: ""CA"""
 certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 1.3.6.1.5.5.7.1.3
 certificate.tbsCertificate.extensions.3.extnValue.certificatePolicies,SubscriberPoliciesValidator,WARNING,cabf.serverauth.subscriber_first_policy_oid_not_reserved,
 certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.subject_key_identifier_extension_present,
diff --git a/tests/integration_certificate/tls_br/ev_pre_certificate/subject_orgid_vat_with_state.crttest b/tests/integration_certificate/tls_br/ev_pre_certificate/subject_orgid_vat_with_state.crttest
index a369a3b..4a23b7c 100644
--- a/tests/integration_certificate/tls_br/ev_pre_certificate/subject_orgid_vat_with_state.crttest
+++ b/tests/integration_certificate/tls_br/ev_pre_certificate/subject_orgid_vat_with_state.crttest
@@ -38,11 +38,11 @@ rtR5wjXRnjqZGFhsKzGG2auNDj8=
 
 node_path,validator,severity,code,message
 certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 1.3.6.1.5.5.7.1.3
-certificate.tbsCertificate.subject.rdnSequence.7.0,OrganizationIdentifierAttributeValidator,ERROR,cabf.invalid_subject_organization_identifier_state_province_for_scheme,"Scheme ""VAT"" does not allow state/province values"
+certificate.tbsCertificate.subject.rdnSequence.7.0.value.x520OrganizationIdentifier,CabfOrganizationIdentifierAttributeValidator,ERROR,cabf.invalid_subject_organization_identifier_state_province_for_scheme,"State/province value present for scheme ""VAT"": ""PA"""
+certificate.tbsCertificate.subject.rdnSequence.7.0.value.x520OrganizationIdentifier,OrganizationIdentifierConsistentSubjectAndExtensionValidator,ERROR,cabf.serverauth.organization_identifier_mismatched_value,"Mismatched scheme: attribute: ""VAT"", extension: ""NTR"""
 certificate.tbsCertificate.extensions.1.extnValue.subjectKeyIdentifier,SubjectKeyIdentifierValidator,INFO,pkix.subject_key_identifier_method_1_identified,
 certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.subject_key_identifier_extension_present,
 certificate.tbsCertificate.extensions.10.extnValue.certificatePolicies.0.policyQualifiers.0,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
-certificate.tbsCertificate.subject.rdnSequence.7.0.value.x520OrganizationIdentifier,OrganizationIdentifierConsistentSubjectAndExtensionValidator,ERROR,cabf.serverauth.organization_identifier_mismatched_scheme,"Mismatched scheme: subject: ""VAT"", extension: ""NTR"""
 certificate.tbsCertificate.extensions,SubscriberExtensionAllowanceValidator,WARNING,cabf.serverauth.subscriber.unknown_extension_present,Unknown extension present: 2.23.140.3.1
 certificate.tbsCertificate.subject.rdnSequence,EvSubscriberAttributeAllowanceValidator,WARNING,cabf.ev_guidelines.common_name_attribute_present,
 certificate.tbsCertificate.extensions.8.extnValue.keyUsage,SubscriberKeyUsageValidator,WARNING,cabf.serverauth.subscriber_rsa_digitalsignature_and_keyencipherment_present,
diff --git a/tests/integration_certificate/tls_br/non_tls_ca/unknown_orgid_registration_scheme.crttest b/tests/integration_certificate/tls_br/non_tls_ca/unknown_orgid_registration_scheme.crttest
index 95caf10..0ab165a 100644
--- a/tests/integration_certificate/tls_br/non_tls_ca/unknown_orgid_registration_scheme.crttest
+++ b/tests/integration_certificate/tls_br/non_tls_ca/unknown_orgid_registration_scheme.crttest
@@ -52,6 +52,6 @@ certificate.tbsCertificate.extensions.7.extnValue.cRLDistributionPoints,CrlDpDis
 certificate.tbsCertificate.subject.rdnSequence,CaRequiredSubjectAttributesValidator,WARNING,cabf.serverauth.ca.unknown_attribute_present,Unknown attribute present: 2.5.4.97
 certificate.tbsCertificate.extensions.6.extnValue.certificatePolicies.0.policyQualifiers.0,CertificatePolicyQualifierValidator,WARNING,cabf.serverauth.certificate_policy_qualifier_present,
 certificate.tbsCertificate.subject.rdnSequence,CaRequiredSubjectAttributesValidator,WARNING,cabf.serverauth.ca.unknown_attribute_present,Unknown attribute present: 2.5.4.5
-certificate.tbsCertificate.subject.rdnSequence.2.0,OrganizationIdentifierAttributeValidator,ERROR,cabf.invalid_subject_organization_identifier_registration_scheme,"Invalid registration scheme: ""NIT"""
+certificate.tbsCertificate.subject.rdnSequence.2.0.value.x520OrganizationIdentifier,CabfOrganizationIdentifierAttributeValidator,ERROR,cabf.invalid_organization_identifier_registration_scheme,"Invalid registration scheme: ""NIT"""
 certificate.tbsCertificate.extensions.4.extnValue.keyUsage,CaKeyUsageValidator,NOTICE,cabf.ca_certificate_no_digital_signature_bit,
 certificate.tbsCertificate.subject.rdnSequence,AttributeOrderEncodingValidator,ERROR,cabf.serverauth.invalid_rdn_order,Invalid RDN order: 2.5.4.8 follows 2.5.4.10
diff --git a/tests/integration_certificate/tls_br/ov_final_certificate/bad_rsa_exponent.crttest b/tests/integration_certificate/tls_br/ov_final_certificate/bad_rsa_exponent.crttest
index 88ef9fb..a03e8a4 100644
--- a/tests/integration_certificate/tls_br/ov_final_certificate/bad_rsa_exponent.crttest
+++ b/tests/integration_certificate/tls_br/ov_final_certificate/bad_rsa_exponent.crttest
@@ -50,7 +50,7 @@ certificate.tbsCertificate.subject.rdnSequence,OvSubscriberAttributeAllowanceVal
 certificate.tbsCertificate.subjectPublicKeyInfo.subjectPublicKey.rSAPublicKey,RsaKeyValidator,ERROR,cabf.rsa_exponent_prohibited_value,Exponent is less than 3: 1
 certificate.tbsCertificate.extensions.6.extnValue.certificatePolicies.1.policyQualifiers.1,CertificatePolicyQualifierValidator,ERROR,cabf.serverauth.prohibited_certificate_policy_qualifier_type,Prohibited qualifier type: 1.3.6.1.5.5.7.2.2
 certificate.tbsCertificate.extensions.1.extnValue.keyUsage,SubscriberKeyUsageValidator,ERROR,cabf.serverauth.subscriber_prohibited_ku_present,Prohibited KU present: keyAgreement
-certificate.tbsCertificate.extensions.6.extnValue.certificatePolicies.1.policyQualifiers.1.qualifier.userNotice,CertificatePoliciesUserNoticeValidator,WARNING,pkix.certificate_policies_usernotice_has_noticeRef,
+certificate.tbsCertificate.extensions.6.extnValue.certificatePolicies.1.policyQualifiers.1.qualifier.userNotice,CertificatePoliciesUserNoticeValidator,WARNING,pkix.certificate_policies_usernotice_has_noticeref,
 certificate.tbsCertificate.validity.notBefore,SubscriberValidityPeriodValidator,ERROR,cabf.certificate_validity_period_exceeds_398_days,"Validity period of 730 days, 13:53:13 exceeds maximum value of 398 days, 0:00:00"
 certificate.tbsCertificate.subject.rdnSequence,OvSubscriberAttributeAllowanceValidator,WARNING,cabf.serverauth.ov.common_name_attribute_present,
 certificate.tbsCertificate.extensions.0,SubscriberExtensionCriticalityValidator,ERROR,cabf.serverauth.subscriber.non_critical_basic_constraints_extension,
diff --git a/tests/pkix/certificate/test_extension.py b/tests/pkix/certificate/test_extension.py
index 9c02d58..eab4683 100644
--- a/tests/pkix/certificate/test_extension.py
+++ b/tests/pkix/certificate/test_extension.py
@@ -2,7 +2,8 @@
 from pyasn1.codec.der.encoder import encode
 from pyasn1_alt_modules import rfc5280
 
-from pkilint import document
+from pkilint import document, validation
+from pkilint.pkix.certificate import certificate_extension
 from pkilint.pkix.certificate.certificate_extension import BasicConstraintsValidator
 from pkilint.validation import ValidationFindingEncountered
 from tests import util
@@ -61,3 +62,75 @@ def test_basic_constraints_not_ca_with_pathlen():
         validator.validate(bc)
 
     assert e.value.finding == validator.VALIDATION_ILLEGAL_PATHLEN_SET
+
+
+def _ee_extension_presence_test(ext_oid, validator, expected_finding):
+    class Cert:
+        @property
+        def is_ca(self):
+            return False
+
+    ext = rfc5280.Extension()
+    ext['extnID'] = ext_oid
+    ext['extnValue'] = b''
+
+    # noinspection PyTypeChecker
+    node = document.PDUNode(Cert(), 'ext', ext, None)
+
+    assert validator.match(node)
+
+    with pytest.raises(validation.ValidationFindingEncountered) as e:
+        validator.validate(node)
+
+    assert e.value.finding == expected_finding
+
+
+def test_ee_policy_mappings_presence():
+    _ee_extension_presence_test(
+        rfc5280.id_ce_policyMappings,
+        certificate_extension.PolicyMappingsPresenceValidator(),
+        certificate_extension.PolicyMappingsPresenceValidator.VALIDATION_EE_POLICY_MAPPINGS_PRESENT
+    )
+
+
+def test_ee_policy_constaints_presence():
+    _ee_extension_presence_test(
+        rfc5280.id_ce_policyConstraints,
+        certificate_extension.PolicyConstraintsPresenceValidator(),
+        certificate_extension.PolicyConstraintsPresenceValidator.VALIDATION_EE_POLICY_CONSTRAINTS_PRESENT
+    )
+
+
+def test_ee_inhibit_anypolicy_presence():
+    _ee_extension_presence_test(
+        rfc5280.id_ce_inhibitAnyPolicy,
+        certificate_extension.InhibitAnyPolicyPresenceValidator(),
+        certificate_extension.InhibitAnyPolicyPresenceValidator.VALIDATION_EE_INHIBIT_ANYPOLICY_PRESENT
+    )
+
+
+def test_issuer_alt_name_critical():
+    gns = rfc5280.GeneralNames()
+
+    gn = rfc5280.GeneralName()
+    gn['dNSName'] = 'foo.com'
+    gns.append(gn)
+
+    ext = rfc5280.Extension()
+    ext['extnID'] = rfc5280.id_ce_issuerAltName
+    ext['critical'] = True
+    ext['extnValue'] = encode(gns)
+
+    ext_node = document.PDUNode(None, 'ext', ext, None)
+
+    validator = certificate_extension.IssuerAlternativeNameCriticalityValidator()
+
+    assert validator.match(ext_node)
+
+    with pytest.raises(validation.ValidationFindingEncountered) as e:
+        validator.validate(ext_node)
+
+    assert (
+            e.value.finding ==
+            certificate_extension.IssuerAlternativeNameCriticalityValidator.VALIDATION_ISSUER_ALT_NAME_CRITICAL
+    )
diff --git a/tests/test_cli_smoke.py b/tests/test_cli_smoke.py
index 3f1f6d2..c7fb0c0 100644
--- a/tests/test_cli_smoke.py
+++ b/tests/test_cli_smoke.py
@@ -6,6 +6,7 @@
 
 from pkilint.cabf.serverauth import serverauth_constants
 from pkilint.cabf.smime import smime_constants
+from pkilint.etsi import etsi_constants
 
 
 def _test_program_validations(name, args=None):
@@ -492,3 +493,8 @@ def test_exit_code_multiple_256_findings():
     assert len(out_lines) == 1 + 256  # header line plus the 256 findings
 
     assert ret.returncode == 255
+
+
+def test_lint_etsi_cert_validations():
+    for cert_type in etsi_constants.CertificateType:
+        _test_program_validations('lint_etsi_cert', ['-t', cert_type.to_option_str])
diff --git a/tests/test_server.py b/tests/test_server.py
index f2da58d..98621e7 100644
--- a/tests/test_server.py
+++ b/tests/test_server.py
@@ -8,6 +8,7 @@
 from pkilint.cabf import serverauth
 from pkilint.cabf.serverauth import serverauth_constants
 from pkilint.cabf.smime import smime_constants
+from pkilint.etsi import etsi_constants
 from pkilint.pkix import certificate, ocsp, name, extension
 from pkilint.rest import app as web_app
 
@@ -182,10 +183,8 @@ def test_groups(client):
 
     j = resp.json()
 
-    # SMIME and serverauth
-
     names = {lg['name'] for lg in j}
-    assert names == {'cabf-serverauth', 'cabf-smime'}
+    assert names == {'cabf-serverauth', 'cabf-smime', 'etsi'}
 
 
 def test_group_no_exist(client):
@@ -408,3 +407,19 @@ def test_ocsp_pkix_lint(client):
     j = resp.json()
 
     assert len(j['results']) == 0
+
+
+def test_detect_and_lint_etsi(client):
+    resp = client.post('/certificate/etsi', json={'pem': _OV_FINAL_CLEAN_PEM})
+    assert resp.status_code == HTTPStatus.OK
+
+    j = resp.json()
+
+    assert j['linter']['name'] == etsi_constants.CertificateType.OVCP_FINAL_CERTIFICATE.to_option_str
+
+
+def test_etsi_detect_bad_extension_der(client):
+    resp = client.post('/certificate/etsi', json={'pem': _BAD_CERT_POLICIES_DER_PEM})
+    assert resp.status_code == HTTPStatus.UNPROCESSABLE_ENTITY
+
+    _assert_validationerror_list_present(resp)
diff --git a/tests/test_validation_report.py b/tests/test_validation_report.py
index 3cb28b6..bd47889 100644
--- a/tests/test_validation_report.py
+++ b/tests/test_validation_report.py
@@ -1,6 +1,11 @@
-from pkilint import validation
+from pkilint import validation, etsi
+from pkilint.etsi import etsi_constants
 from pkilint.pkix import certificate
 from pkilint.cabf import serverauth, smime
+import re
+
+
+_FINDING_CODE_REGEX = re.compile(r'^[.a-z0-9\-_]+$')
 
 
 def _test(validator, context: str):
@@ -10,7 +15,20 @@ def _test(validator, context: str):
 
     missing_validations = declared_validations - reported_validations
 
-    assert not any(missing_validations), f'{context}: {validator.__class__.__name__} {missing_validations}'
+    validator_name = f'{context}: {validator.__class__.__name__}'
+
+    assert not any(missing_validations), (
+        f'{validator_name} does not declare that it reports the following finding(s): '
+        f'{missing_validations}'
+    )
+
+    incorrect_code_syntax_findings = [
+        v.code for v in validator.validations if not _FINDING_CODE_REGEX.match(v.code)
+    ]
+
+    assert not any(incorrect_code_syntax_findings), (
+        f'{validator_name} has validations with incorrect code syntax: {incorrect_code_syntax_findings}'
+    )
 
     if isinstance(validator, validation.ValidatorContainer):
         for v in validator.validators:
@@ -40,3 +58,15 @@ def test_smime():
             context = f'cabf.smime.{validation_level}-{generation}'
 
             _test(validator, context)
+
+
+def test_etsi():
+    for certificate_type in etsi_constants.CertificateType:
+        validator = certificate.create_pkix_certificate_validator_container(
+            serverauth.create_decoding_validators(),
+            etsi.create_validators(certificate_type)
+        )
+
+        context = f'etsi.{certificate_type}'
+
+        _test(validator, context)