ASN1, X509: replace user_error's with exceptions