style
verify hostname, authority key id against subject key id; server certificate extensions