TODO: X.509 certificate extraction