Repository: randombit/botan
Pull request #2442 (2020-10-31 12:40:18)

Merge several X.509 header files


Patch:
diff --git a/src/fuzzer/x509_dn.cpp b/src/fuzzer/x509_dn.cpp
index dc14eb347..9fc062cfb 100644
--- a/src/fuzzer/x509_dn.cpp
+++ b/src/fuzzer/x509_dn.cpp
@@ -5,7 +5,7 @@
 */
 
 #include "fuzzers.h"
-#include <botan/x509_dn.h>
+#include <botan/pkix_types.h>
 #include <botan/ber_dec.h>
 #include <botan/hex.h>
 
diff --git a/src/lib/asn1/asn1_attribute.h b/src/lib/asn1/asn1_attribute.h
deleted file mode 100644
index 11670e110..000000000
--- a/src/lib/asn1/asn1_attribute.h
+++ /dev/null
@@ -1,44 +0,0 @@
-/*
-* ASN.1 Attribute
-* (C) 1999-2007,2012 Jack Lloyd
-*
-* Botan is released under the Simplified BSD License (see license.txt)
-*/
-
-#ifndef BOTAN_ASN1_ATTRIBUTE_H_
-#define BOTAN_ASN1_ATTRIBUTE_H_
-
-#include <botan/asn1_obj.h>
-#include <vector>
-
-namespace Botan {
-
-/**
-* Attribute
-*/
-class BOTAN_PUBLIC_API(2,0) Attribute final : public ASN1_Object
-   {
-   public:
-      void encode_into(class DER_Encoder& to) const override;
-      void decode_from(class BER_Decoder& from) override;
-
-      Attribute() = default;
-      Attribute(const OID&, const std::vector<uint8_t>&);
-      Attribute(const std::string&, const std::vector<uint8_t>&);
-
-      const OID& get_oid() const { return oid; }
-
-      const std::vector<uint8_t>& get_parameters() const { return parameters; }
-
-   BOTAN_DEPRECATED_PUBLIC_MEMBER_VARIABLES:
-      /*
-      * These values are public for historical reasons, but in a future release
-      * they will be made private. Do not access them.
-      */
-      OID oid;
-      std::vector<uint8_t> parameters;
-   };
-
-}
-
-#endif
diff --git a/src/lib/tls/credentials_manager.cpp b/src/lib/tls/credentials_manager.cpp
index 158d6f77c..0c5ae9718 100644
--- a/src/lib/tls/credentials_manager.cpp
+++ b/src/lib/tls/credentials_manager.cpp
@@ -6,6 +6,7 @@
 */
 
 #include <botan/credentials_manager.h>
+#include <botan/pkix_types.h>
 
 namespace Botan {
 
diff --git a/src/lib/tls/tls_extensions.h b/src/lib/tls/tls_extensions.h
index 686aaad5d..a426c8e56 100644
--- a/src/lib/tls/tls_extensions.h
+++ b/src/lib/tls/tls_extensions.h
@@ -14,7 +14,7 @@
 #include <botan/tls_magic.h>
 #include <botan/tls_version.h>
 #include <botan/secmem.h>
-#include <botan/x509_dn.h>
+#include <botan/pkix_types.h>
 #include <vector>
 #include <string>
 #include <map>
diff --git a/src/lib/x509/asn1_alt_name.cpp b/src/lib/x509/asn1_alt_name.cpp
index e0437b4a9..a347a3114 100644
--- a/src/lib/x509/asn1_alt_name.cpp
+++ b/src/lib/x509/asn1_alt_name.cpp
@@ -6,14 +6,13 @@
 * Botan is released under the Simplified BSD License (see license.txt)
 */
 
-#include <botan/asn1_alt_name.h>
+#include <botan/pkix_types.h>
 #include <botan/der_enc.h>
 #include <botan/ber_dec.h>
 #include <botan/oids.h>
 #include <botan/internal/stl_util.h>
 #include <botan/parsing.h>
 #include <botan/loadstor.h>
-#include <botan/x509_dn.h>
 
 #include <sstream>
 
diff --git a/src/lib/x509/asn1_alt_name.h b/src/lib/x509/asn1_alt_name.h
index ac9053be7..b0ca1d87e 100644
--- a/src/lib/x509/asn1_alt_name.h
+++ b/src/lib/x509/asn1_alt_name.h
@@ -1,61 +1,11 @@
 /*
-* (C) 1999-2007 Jack Lloyd
-*     2007 Yves Jerschow
-*
 * Botan is released under the Simplified BSD License (see license.txt)
 */
 
 #ifndef BOTAN_X509_ALT_NAME_H_
 #define BOTAN_X509_ALT_NAME_H_
 
-#include <botan/asn1_obj.h>
-#include <botan/x509_dn.h>
-#include <map>
-
-namespace Botan {
-
-/**
-* Alternative Name
-*/
-class BOTAN_PUBLIC_API(2,0) AlternativeName final : public ASN1_Object
-   {
-   public:
-      void encode_into(class DER_Encoder&) const override;
-      void decode_from(class BER_Decoder&) override;
-
-      std::multimap<std::string, std::string> contents() const;
-
-      bool has_field(const std::string& attr) const;
-      std::vector<std::string> get_attribute(const std::string& attr) const;
-
-      std::string get_first_attribute(const std::string& attr) const;
-
-      void add_attribute(const std::string& type, const std::string& value);
-      void add_othername(const OID& oid, const std::string& value, ASN1_Tag type);
-
-      const std::multimap<std::string, std::string>& get_attributes() const
-         {
-         return m_alt_info;
-         }
-
-      const std::multimap<OID, ASN1_String>& get_othernames() const
-         {
-         return m_othernames;
-         }
-
-      X509_DN dn() const;
-
-      bool has_items() const;
-
-      AlternativeName(const std::string& email_addr = "",
-                      const std::string& uri = "",
-                      const std::string& dns = "",
-                      const std::string& ip_address = "");
-   private:
-      std::multimap<std::string, std::string> m_alt_info;
-      std::multimap<OID, ASN1_String> m_othernames;
-   };
-
-}
+#include <botan/pkix_types.h>
+BOTAN_DEPRECATED_HEADER(asn1_alt_name.h)
 
 #endif
diff --git a/src/lib/x509/asn1_attribute.h b/src/lib/x509/asn1_attribute.h
new file mode 100644
index 000000000..0139c18c7
--- /dev/null
+++ b/src/lib/x509/asn1_attribute.h
@@ -0,0 +1,11 @@
+/*
+* Botan is released under the Simplified BSD License (see license.txt)
+*/
+
+#ifndef BOTAN_ASN1_ATTRIBUTE_H_
+#define BOTAN_ASN1_ATTRIBUTE_H_
+
+#include <botan/pkix_types.h>
+BOTAN_DEPRECATED_HEADER(asn1_attribute.h)
+
+#endif
diff --git a/src/lib/x509/cert_status.cpp b/src/lib/x509/cert_status.cpp
index eab196c26..e22d6e1be 100644
--- a/src/lib/x509/cert_status.cpp
+++ b/src/lib/x509/cert_status.cpp
@@ -4,11 +4,10 @@
 * Botan is released under the Simplified BSD License (see license.txt)
 */
 
-#include <botan/cert_status.h>
+#include <botan/pkix_enums.h>
 
 namespace Botan {
 
-//static
 const char* to_string(Certificate_Status_Code code)
    {
    switch(code)
diff --git a/src/lib/x509/cert_status.h b/src/lib/x509/cert_status.h
index 2f869c1ec..f330ff348 100644
--- a/src/lib/x509/cert_status.h
+++ b/src/lib/x509/cert_status.h
@@ -1,105 +1,11 @@
 /*
-* Path validation result enums
-* (C) 2013 Jack Lloyd
-*
 * Botan is released under the Simplified BSD License (see license.txt)
 */
 
 #ifndef BOTAN_X509_PATH_RESULT_H_
 #define BOTAN_X509_PATH_RESULT_H_
 
-#include <botan/types.h>
-
-namespace Botan {
-
-/**
-* Certificate validation status code
-*/
-enum class Certificate_Status_Code {
-   OK = 0,
-   VERIFIED = 0,
-
-   // Revocation status
-   OCSP_RESPONSE_GOOD = 1,
-   OCSP_SIGNATURE_OK = 2,
-   VALID_CRL_CHECKED = 3,
-   OCSP_NO_HTTP = 4,
-
-   // Warnings
-   FIRST_WARNING_STATUS = 500,
-   CERT_SERIAL_NEGATIVE = 500,
-   DN_TOO_LONG = 501,
-   OCSP_NO_REVOCATION_URL = 502,
-   OCSP_SERVER_NOT_AVAILABLE = 503,
-
-   // Typo versions of above - will be removed in future major release
-   OSCP_NO_REVOCATION_URL = 502,
-   OSCP_SERVER_NOT_AVAILABLE = 503,
-
-   // Errors
-   FIRST_ERROR_STATUS = 1000,
-
-   SIGNATURE_METHOD_TOO_WEAK = 1000,
-   UNTRUSTED_HASH = 1001,
-   NO_REVOCATION_DATA = 1002,
-   NO_MATCHING_CRLDP = 1003,
-
-   // Time problems
-   CERT_NOT_YET_VALID = 2000,
-   CERT_HAS_EXPIRED = 2001,
-   OCSP_NOT_YET_VALID = 2002,
-   OCSP_HAS_EXPIRED = 2003,
-   CRL_NOT_YET_VALID = 2004,
-   CRL_HAS_EXPIRED = 2005,
-   OCSP_IS_TOO_OLD = 2006,
-
-   // Chain generation problems
-   CERT_ISSUER_NOT_FOUND = 3000,
-   CANNOT_ESTABLISH_TRUST = 3001,
-   CERT_CHAIN_LOOP = 3002,
-   CHAIN_LACKS_TRUST_ROOT = 3003,
-   CHAIN_NAME_MISMATCH = 3004,
-
-   // Validation errors
-   POLICY_ERROR = 4000,
-   INVALID_USAGE = 4001,
-   CERT_CHAIN_TOO_LONG = 4002,
-   CA_CERT_NOT_FOR_CERT_ISSUER = 4003,
-   NAME_CONSTRAINT_ERROR = 4004,
-
-   // Revocation errors
-   CA_CERT_NOT_FOR_CRL_ISSUER = 4005,
-   OCSP_CERT_NOT_LISTED = 4006,
-   OCSP_BAD_STATUS = 4007,
-
-   // Other problems
-   CERT_NAME_NOMATCH = 4008,
-   UNKNOWN_CRITICAL_EXTENSION = 4009,
-   DUPLICATE_CERT_EXTENSION = 4010,
-   OCSP_SIGNATURE_ERROR = 4501,
-   OCSP_ISSUER_NOT_FOUND = 4502,
-   OCSP_RESPONSE_MISSING_KEYUSAGE = 4503,
-   OCSP_RESPONSE_INVALID = 4504,
-   EXT_IN_V1_V2_CERT = 4505,
-   DUPLICATE_CERT_POLICY = 4506,
-   V2_IDENTIFIERS_IN_V1_CERT = 4507,
-
-   // Hard failures
-   CERT_IS_REVOKED = 5000,
-   CRL_BAD_SIGNATURE = 5001,
-   SIGNATURE_ERROR = 5002,
-   CERT_PUBKEY_INVALID = 5003,
-   SIGNATURE_ALGO_UNKNOWN = 5004,
-   SIGNATURE_ALGO_BAD_PARAMS = 5005
-};
-
-/**
-* Convert a status code to a human readable diagnostic message
-* @param code the certifcate status
-* @return string literal constant, or nullptr if code unknown
-*/
-BOTAN_PUBLIC_API(2,0) const char* to_string(Certificate_Status_Code code);
-
-}
+#include <botan/pkix_enums.h>
+BOTAN_DEPRECATED_HEADER(cert_status.h)
 
 #endif
diff --git a/src/lib/x509/certstor.cpp b/src/lib/x509/certstor.cpp
index 13b7e4621..a066f208d 100644
--- a/src/lib/x509/certstor.cpp
+++ b/src/lib/x509/certstor.cpp
@@ -7,6 +7,7 @@
 */
 
 #include <botan/certstor.h>
+#include <botan/pkix_types.h>
 #include <botan/internal/filesystem.h>
 #include <botan/hash.h>
 #include <botan/data_src.h>
diff --git a/src/lib/x509/certstor_flatfile/certstor_flatfile.cpp b/src/lib/x509/certstor_flatfile/certstor_flatfile.cpp
index 86bda4fc3..9804759b9 100644
--- a/src/lib/x509/certstor_flatfile/certstor_flatfile.cpp
+++ b/src/lib/x509/certstor_flatfile/certstor_flatfile.cpp
@@ -6,11 +6,11 @@
 * Botan is released under the Simplified BSD License (see license.txt)
 */
 
-#include <botan/build.h>
-
 #include <botan/certstor_flatfile.h>
+#include <botan/pkix_types.h>
 #include <botan/data_src.h>
 #include <botan/pem.h>
+#include <stdexcept>
 
 namespace Botan {
 namespace {
diff --git a/src/lib/x509/certstor_sql/certstor_sql.cpp b/src/lib/x509/certstor_sql/certstor_sql.cpp
index 5a4aa595c..ab4b8e64a 100644
--- a/src/lib/x509/certstor_sql/certstor_sql.cpp
+++ b/src/lib/x509/certstor_sql/certstor_sql.cpp
@@ -11,6 +11,7 @@
 #include <botan/ber_dec.h>
 #include <botan/pkcs8.h>
 #include <botan/data_src.h>
+#include <botan/pkix_types.h>
 
 namespace Botan {
 
diff --git a/src/lib/x509/certstor_system/certstor_system.cpp b/src/lib/x509/certstor_system/certstor_system.cpp
index 8b469dec9..0fca1a975 100644
--- a/src/lib/x509/certstor_system/certstor_system.cpp
+++ b/src/lib/x509/certstor_system/certstor_system.cpp
@@ -5,6 +5,7 @@
 */
 
 #include <botan/certstor_system.h>
+#include <botan/pkix_types.h>
 #include <botan/x509cert.h>
 
 #if defined(BOTAN_HAS_CERTSTOR_MACOS)
diff --git a/src/lib/x509/certstor_system_macos/certstor_macos.cpp b/src/lib/x509/certstor_system_macos/certstor_macos.cpp
index 183048d9c..1836f3da4 100644
--- a/src/lib/x509/certstor_system_macos/certstor_macos.cpp
+++ b/src/lib/x509/certstor_system_macos/certstor_macos.cpp
@@ -6,22 +6,19 @@
 * Botan is released under the Simplified BSD License (see license.txt)
 */
 
-#include <botan/build.h>
-
 #include <algorithm>
 #include <array>
 
-#define __ASSERT_MACROS_DEFINE_VERSIONS_WITHOUT_UNDERSCORES 0
-#include <CoreFoundation/CoreFoundation.h>
-#include <CoreServices/CoreServices.h>
-
-#include <botan/assert.h>
 #include <botan/ber_dec.h>
 #include <botan/certstor_macos.h>
 #include <botan/data_src.h>
 #include <botan/der_enc.h>
 #include <botan/exceptn.h>
-#include <botan/x509_dn.h>
+#include <botan/pkix_types.h>
+
+#define __ASSERT_MACROS_DEFINE_VERSIONS_WITHOUT_UNDERSCORES 0
+#include <CoreFoundation/CoreFoundation.h>
+#include <CoreServices/CoreServices.h>
 
 namespace Botan {
 
diff --git a/src/lib/x509/certstor_system_windows/certstor_windows.cpp b/src/lib/x509/certstor_system_windows/certstor_windows.cpp
index c9bbfadb1..51530954a 100644
--- a/src/lib/x509/certstor_system_windows/certstor_windows.cpp
+++ b/src/lib/x509/certstor_system_windows/certstor_windows.cpp
@@ -7,6 +7,7 @@
 */
 
 #include <botan/certstor_windows.h>
+#include <botan/pkix_types.h>
 #include <botan/der_enc.h>
 
 #include <array>
diff --git a/src/lib/x509/crl_ent.cpp b/src/lib/x509/crl_ent.cpp
index 38a1963f1..d83d43d73 100644
--- a/src/lib/x509/crl_ent.cpp
+++ b/src/lib/x509/crl_ent.cpp
@@ -5,7 +5,7 @@
 * Botan is released under the Simplified BSD License (see license.txt)
 */
 
-#include <botan/crl_ent.h>
+#include <botan/x509_crl.h>
 #include <botan/x509cert.h>
 #include <botan/x509_ext.h>
 #include <botan/der_enc.h>
diff --git a/src/lib/x509/crl_ent.h b/src/lib/x509/crl_ent.h
index 4fa562994..aa60d4172 100644
--- a/src/lib/x509/crl_ent.h
+++ b/src/lib/x509/crl_ent.h
@@ -1,106 +1,11 @@
 /*
-* CRL Entry
-* (C) 1999-2007 Jack Lloyd
-*
 * Botan is released under the Simplified BSD License (see license.txt)
 */
 
 #ifndef BOTAN_CRL_ENTRY_H_
 #define BOTAN_CRL_ENTRY_H_
 
-#include <botan/asn1_obj.h>
-
-namespace Botan {
-
-class Extensions;
-class X509_Certificate;
-struct CRL_Entry_Data;
-
-/**
-* X.509v2 CRL Reason Code.
-* This will become an enum class in a future major release
-*/
-enum CRL_Code : uint32_t {
-   UNSPECIFIED            = 0,
-   KEY_COMPROMISE         = 1,
-   CA_COMPROMISE          = 2,
-   AFFILIATION_CHANGED    = 3,
-   SUPERSEDED             = 4,
-   CESSATION_OF_OPERATION = 5,
-   CERTIFICATE_HOLD       = 6,
-   REMOVE_FROM_CRL        = 8,
-   PRIVLEDGE_WITHDRAWN    = 9,
-   PRIVILEGE_WITHDRAWN    = 9,
-   AA_COMPROMISE          = 10,
-
-   DELETE_CRL_ENTRY       = 0xFF00,
-   OCSP_GOOD              = 0xFF01,
-   OCSP_UNKNOWN           = 0xFF02
-};
-
-/**
-* This class represents CRL entries
-*/
-class BOTAN_PUBLIC_API(2,0) CRL_Entry final : public ASN1_Object
-   {
-   public:
-      void encode_into(class DER_Encoder&) const override;
-      void decode_from(class BER_Decoder&) override;
-
-      /**
-      * Get the serial number of the certificate associated with this entry.
-      * @return certificate's serial number
-      */
-      const std::vector<uint8_t>& serial_number() const;
-
-      /**
-      * Get the revocation date of the certificate associated with this entry
-      * @return certificate's revocation date
-      */
-      const X509_Time& expire_time() const;
-
-      /**
-      * Get the entries reason code
-      * @return reason code
-      */
-      CRL_Code reason_code() const;
-
-      /**
-      * Get the extensions on this CRL entry
-      */
-      const Extensions& extensions() const;
-
-      /**
-      * Create uninitialized CRL_Entry object
-      */
-      CRL_Entry() = default;
-
-      /**
-      * Construct an CRL entry.
-      * @param cert the certificate to revoke
-      * @param reason the reason code to set in the entry
-      */
-      CRL_Entry(const X509_Certificate& cert,
-                CRL_Code reason = UNSPECIFIED);
-
-   private:
-      friend class X509_CRL;
-
-      const CRL_Entry_Data& data() const;
-
-      std::shared_ptr<CRL_Entry_Data> m_data;
-   };
-
-/**
-* Test two CRL entries for equality in all fields.
-*/
-BOTAN_PUBLIC_API(2,0) bool operator==(const CRL_Entry&, const CRL_Entry&);
-
-/**
-* Test two CRL entries for inequality in at least one field.
-*/
-BOTAN_PUBLIC_API(2,0) bool operator!=(const CRL_Entry&, const CRL_Entry&);
-
-}
+#include <botan/x509_crl.h>
+BOTAN_DEPRECATED_HEADER(crl_ent.h)
 
 #endif
diff --git a/src/lib/x509/datastor.h b/src/lib/x509/datastor.h
index e849c3d89..1ff85c22c 100644
--- a/src/lib/x509/datastor.h
+++ b/src/lib/x509/datastor.h
@@ -8,8 +8,7 @@
 #ifndef BOTAN_DATA_STORE_H_
 #define BOTAN_DATA_STORE_H_
 
-#include <botan/x509_dn.h>
-#include <botan/asn1_alt_name.h>
+#include <botan/pkix_types.h>
 #include <functional>
 #include <string>
 #include <vector>
diff --git a/src/lib/x509/key_constraint.cpp b/src/lib/x509/key_constraint.cpp
index f7f9523bf..09a4c059a 100644
--- a/src/lib/x509/key_constraint.cpp
+++ b/src/lib/x509/key_constraint.cpp
@@ -6,7 +6,7 @@
 * Botan is released under the Simplified BSD License (see license.txt)
 */
 
-#include <botan/key_constraint.h>
+#include <botan/pkix_types.h>
 #include <botan/pk_keys.h>
 #include <vector>
 
diff --git a/src/lib/x509/key_constraint.h b/src/lib/x509/key_constraint.h
index 75f9fb82f..5d5c7b083 100644
--- a/src/lib/x509/key_constraint.h
+++ b/src/lib/x509/key_constraint.h
@@ -1,49 +1,11 @@
 /*
-* Enumerations
-* (C) 1999-2007 Jack Lloyd
-* (C) 2016 René Korthaus, Rohde & Schwarz Cybersecurity
-*
 * Botan is released under the Simplified BSD License (see license.txt)
 */
 
-#ifndef BOTAN_ENUMS_H_
-#define BOTAN_ENUMS_H_
+#ifndef BOTAN_KEY_CONSTRAINT_H_
+#define BOTAN_KEY_CONSTRAINT_H_
 
-#include <botan/types.h>
-#include <string>
-
-namespace Botan {
-
-/**
-* X.509v3 Key Constraints.
-* If updating update copy in ffi.h
-*/
-enum Key_Constraints {
-   NO_CONSTRAINTS     = 0,
-   DIGITAL_SIGNATURE  = 1 << 15,
-   NON_REPUDIATION    = 1 << 14,
-   KEY_ENCIPHERMENT   = 1 << 13,
-   DATA_ENCIPHERMENT  = 1 << 12,
-   KEY_AGREEMENT      = 1 << 11,
-   KEY_CERT_SIGN      = 1 << 10,
-   CRL_SIGN           = 1 << 9,
-   ENCIPHER_ONLY      = 1 << 8,
-   DECIPHER_ONLY      = 1 << 7
-};
-
-class Public_Key;
-
-/**
-* Check that key constraints are permitted for a specific public key.
-* @param pub_key the public key on which the constraints shall be enforced on
-* @param constraints the constraints that shall be enforced on the key
-* @throw Invalid_Argument if the given constraints are not permitted for this key
-*/
-BOTAN_PUBLIC_API(2,0) void verify_cert_constraints_valid_for_key_type(const Public_Key& pub_key,
-                                                                Key_Constraints constraints);
-
-std::string BOTAN_PUBLIC_API(2,0) key_constraints_to_string(Key_Constraints);
-
-}
+#include <botan/pkix_enums.h>
+BOTAN_DEPRECATED_HEADER(key_constraint.h)
 
 #endif
diff --git a/src/lib/x509/name_constraint.cpp b/src/lib/x509/name_constraint.cpp
index 940c14aea..91c644068 100644
--- a/src/lib/x509/name_constraint.cpp
+++ b/src/lib/x509/name_constraint.cpp
@@ -5,11 +5,9 @@
 * Botan is released under the Simplified BSD License (see license.txt)
 */
 
-#include <botan/name_constraint.h>
-#include <botan/asn1_alt_name.h>
+#include <botan/pkix_types.h>
 #include <botan/ber_dec.h>
 #include <botan/loadstor.h>
-#include <botan/x509_dn.h>
 #include <botan/x509cert.h>
 #include <botan/parsing.h>
 #include <sstream>
diff --git a/src/lib/x509/name_constraint.h b/src/lib/x509/name_constraint.h
index c92121589..4f56f89ed 100644
--- a/src/lib/x509/name_constraint.h
+++ b/src/lib/x509/name_constraint.h
@@ -1,182 +1,11 @@
 /*
-* X.509 Name Constraint
-* (C) 2015 Kai Michaelis
-*
 * Botan is released under the Simplified BSD License (see license.txt)
 */
 
 #ifndef BOTAN_NAME_CONSTRAINT_H_
 #define BOTAN_NAME_CONSTRAINT_H_
 
-#include <botan/asn1_obj.h>
-#include <ostream>
-#include <limits>
-
-namespace Botan {
-
-class BER_Encoder;
-class DER_Encoder;
-class X509_Certificate;
-
-/**
-* @brief X.509 GeneralName Type
-*
-* Handles parsing GeneralName types in their BER and canonical string
-* encoding. Allows matching GeneralNames against each other using
-* the rules laid out in the RFC 5280, sec. 4.2.1.10 (Name Contraints).
-*/
-class BOTAN_PUBLIC_API(2,0) GeneralName final : public ASN1_Object
-   {
-   public:
-      enum MatchResult : int
-            {
-            All,
-            Some,
-            None,
-            NotFound,
-            UnknownType,
-            };
-
-      /**
-      * Creates an empty GeneralName.
-      */
-      GeneralName() = default;
-
-      /**
-      * Creates a new GeneralName for its string format.
-      * @param str type and name, colon-separated, e.g., "DNS:google.com"
-      */
-      GeneralName(const std::string& str);
-
-      void encode_into(DER_Encoder&) const override;
-
-      void decode_from(BER_Decoder&) override;
-
-      /**
-      * @return Type of the name. Can be DN, DNS, IP, RFC822 or URI.
-      */
-      const std::string& type() const { return m_type; }
-
-      /**
-      * @return The name as string. Format depends on type.
-      */
-      const std::string& name() const { return m_name; }
-
-      /**
-      * Checks whether a given certificate (partially) matches this name.
-      * @param cert certificate to be matched
-      * @return the match result
-      */
-      MatchResult matches(const X509_Certificate& cert) const;
-
-   private:
-      std::string m_type;
-      std::string m_name;
-
-      bool matches_dns(const std::string&) const;
-      bool matches_dn(const std::string&) const;
-      bool matches_ip(const std::string&) const;
-   };
-
-std::ostream& operator<<(std::ostream& os, const GeneralName& gn);
-
-/**
-* @brief A single Name Constraint
-*
-* The Name Constraint extension adds a minimum and maximum path
-* length to a GeneralName to form a constraint. The length limits
-* are currently unused.
-*/
-class BOTAN_PUBLIC_API(2,0) GeneralSubtree final : public ASN1_Object
-   {
-   public:
-      /**
-      * Creates an empty name constraint.
-      */
-      GeneralSubtree() : m_base(), m_minimum(0), m_maximum(std::numeric_limits<std::size_t>::max())
-      {}
-
-      /***
-      * Creates a new name constraint.
-      * @param base name
-      * @param min minimum path length
-      * @param max maximum path length
-      */
-      GeneralSubtree(const GeneralName& base, size_t min, size_t max)
-      : m_base(base), m_minimum(min), m_maximum(max)
-      {}
-
-      /**
-      * Creates a new name constraint for its string format.
-      * @param str name constraint
-      */
-      GeneralSubtree(const std::string& str);
-
-      void encode_into(DER_Encoder&) const override;
-
-      void decode_from(BER_Decoder&) override;
-
-      /**
-      * @return name
-      */
-      const GeneralName& base() const { return m_base; }
-
-      /**
-      * @return minimum path length
-      */
-      size_t minimum() const { return m_minimum; }
-
-      /**
-      * @return maximum path length
-      */
-      size_t maximum() const { return m_maximum; }
-
-   private:
-      GeneralName m_base;
-      size_t m_minimum;
-      size_t m_maximum;
-   };
-
-std::ostream& operator<<(std::ostream& os, const GeneralSubtree& gs);
-
-/**
-* @brief Name Constraints
-*
-* Wraps the Name Constraints associated with a certificate.
-*/
-class BOTAN_PUBLIC_API(2,0) NameConstraints final
-   {
-   public:
-      /**
-      * Creates an empty name NameConstraints.
-      */
-      NameConstraints() : m_permitted_subtrees(), m_excluded_subtrees() {}
-
-      /**
-      * Creates NameConstraints from a list of permitted and excluded subtrees.
-      * @param permitted_subtrees names for which the certificate is permitted
-      * @param excluded_subtrees names for which the certificate is not permitted
-      */
-      NameConstraints(std::vector<GeneralSubtree>&& permitted_subtrees,
-                    std::vector<GeneralSubtree>&& excluded_subtrees)
-      : m_permitted_subtrees(permitted_subtrees), m_excluded_subtrees(excluded_subtrees)
-      {}
-
-      /**
-      * @return permitted names
-      */
-      const std::vector<GeneralSubtree>& permitted() const { return m_permitted_subtrees; }
-
-      /**
-      * @return excluded names
-      */
-      const std::vector<GeneralSubtree>& excluded() const { return m_excluded_subtrees; }
-
-   private:
-      std::vector<GeneralSubtree> m_permitted_subtrees;
-      std::vector<GeneralSubtree> m_excluded_subtrees;
-};
-
-}
+#include <botan/pkix_types.h>
+BOTAN_DEPRECATED_HEADER(name_constraint.h)
 
 #endif
diff --git a/src/lib/x509/ocsp.h b/src/lib/x509/ocsp.h
index ba5e5bd95..552245644 100644
--- a/src/lib/x509/ocsp.h
+++ b/src/lib/x509/ocsp.h
@@ -8,9 +8,10 @@
 #ifndef BOTAN_OCSP_H_
 #define BOTAN_OCSP_H_
 
-#include <botan/cert_status.h>
-#include <botan/ocsp_types.h>
-#include <botan/x509_dn.h>
+#include <botan/asn1_obj.h>
+#include <botan/pkix_types.h>
+#include <botan/x509cert.h>
+#include <botan/bigint.h>
 #include <chrono>
 
 namespace Botan {
@@ -19,6 +20,51 @@ class Certificate_Store;
 
 namespace OCSP {
 
+class BOTAN_PUBLIC_API(2,0) CertID final : public ASN1_Object
+   {
+   public:
+      CertID() = default;
+
+      CertID(const X509_Certificate& issuer,
+             const BigInt& subject_serial);
+
+      bool is_id_for(const X509_Certificate& issuer,
+                     const X509_Certificate& subject) const;
+
+      void encode_into(class DER_Encoder& to) const override;
+
+      void decode_from(class BER_Decoder& from) override;
+
+      const std::vector<uint8_t>& issuer_key_hash() const { return m_issuer_key_hash; }
+
+   private:
+      AlgorithmIdentifier m_hash_id;
+      std::vector<uint8_t> m_issuer_dn_hash;
+      std::vector<uint8_t> m_issuer_key_hash;
+      BigInt m_subject_serial;
+   };
+
+class BOTAN_PUBLIC_API(2,0) SingleResponse final : public ASN1_Object
+   {
+   public:
+      const CertID& certid() const { return m_certid; }
+
+      size_t cert_status() const { return m_cert_status; }
+
+      X509_Time this_update() const { return m_thisupdate; }
+
+      X509_Time next_update() const { return m_nextupdate; }
+
+      void encode_into(class DER_Encoder& to) const override;
+
+      void decode_from(class BER_Decoder& from) override;
+   private:
+      CertID m_certid;
+      size_t m_cert_status = 2; // unknown
+      X509_Time m_thisupdate;
+      X509_Time m_nextupdate;
+   };
+
 /**
 * An OCSP request.
 */
diff --git a/src/lib/x509/ocsp_types.cpp b/src/lib/x509/ocsp_types.cpp
index 9a0fbdf8d..c4b78112e 100644
--- a/src/lib/x509/ocsp_types.cpp
+++ b/src/lib/x509/ocsp_types.cpp
@@ -5,7 +5,7 @@
 * Botan is released under the Simplified BSD License (see license.txt)
 */
 
-#include <botan/ocsp_types.h>
+#include <botan/ocsp.h>
 #include <botan/der_enc.h>
 #include <botan/ber_dec.h>
 #include <botan/x509_ext.h>
diff --git a/src/lib/x509/ocsp_types.h b/src/lib/x509/ocsp_types.h
index ea93f3613..aa628d8d6 100644
--- a/src/lib/x509/ocsp_types.h
+++ b/src/lib/x509/ocsp_types.h
@@ -1,68 +1,11 @@
 /*
-* OCSP subtypes
-* (C) 2012 Jack Lloyd
-*
 * Botan is released under the Simplified BSD License (see license.txt)
 */
 
 #ifndef BOTAN_OCSP_TYPES_H_
 #define BOTAN_OCSP_TYPES_H_
 
-#include <botan/x509cert.h>
-#include <botan/asn1_obj.h>
-#include <botan/bigint.h>
-
-namespace Botan {
-
-namespace OCSP {
-
-class BOTAN_PUBLIC_API(2,0) CertID final : public ASN1_Object
-   {
-   public:
-      CertID() = default;
-
-      CertID(const X509_Certificate& issuer,
-             const BigInt& subject_serial);
-
-      bool is_id_for(const X509_Certificate& issuer,
-                     const X509_Certificate& subject) const;
-
-      void encode_into(class DER_Encoder& to) const override;
-
-      void decode_from(class BER_Decoder& from) override;
-
-      const std::vector<uint8_t>& issuer_key_hash() const { return m_issuer_key_hash; }
-
-   private:
-      AlgorithmIdentifier m_hash_id;
-      std::vector<uint8_t> m_issuer_dn_hash;
-      std::vector<uint8_t> m_issuer_key_hash;
-      BigInt m_subject_serial;
-   };
-
-class BOTAN_PUBLIC_API(2,0) SingleResponse final : public ASN1_Object
-   {
-   public:
-      const CertID& certid() const { return m_certid; }
-
-      size_t cert_status() const { return m_cert_status; }
-
-      X509_Time this_update() const { return m_thisupdate; }
-
-      X509_Time next_update() const { return m_nextupdate; }
-
-      void encode_into(class DER_Encoder& to) const override;
-
-      void decode_from(class BER_Decoder& from) override;
-   private:
-      CertID m_certid;
-      size_t m_cert_status = 2; // unknown
-      X509_Time m_thisupdate;
-      X509_Time m_nextupdate;
-   };
-
-}
-
-}
+#include <botan/ocsp.h>
+BOTAN_DEPRECATED_HEADER(ocsp_types.h)
 
 #endif
diff --git a/src/lib/x509/pkcs10.cpp b/src/lib/x509/pkcs10.cpp
index 751097c62..1da5ecca4 100644
--- a/src/lib/x509/pkcs10.cpp
+++ b/src/lib/x509/pkcs10.cpp
@@ -6,6 +6,7 @@
 */
 
 #include <botan/pkcs10.h>
+#include <botan/x509_key.h>
 #include <botan/x509_ext.h>
 #include <botan/x509cert.h>
 #include <botan/ber_dec.h>
diff --git a/src/lib/x509/pkcs10.h b/src/lib/x509/pkcs10.h
index bd8cdb2e1..3f3f87357 100644
--- a/src/lib/x509/pkcs10.h
+++ b/src/lib/x509/pkcs10.h
@@ -10,17 +10,17 @@
 #define BOTAN_PKCS10_H_
 
 #include <botan/x509_obj.h>
-#include <botan/x509_dn.h>
-#include <botan/key_constraint.h>
-#include <botan/asn1_attribute.h>
-#include <botan/asn1_alt_name.h>
+#include <botan/pkix_enums.h>
 #include <vector>
 
 namespace Botan {
 
+struct PKCS10_Data;
+
 class Private_Key;
 class Extensions;
-struct PKCS10_Data;
+class X509_DN;
+class AlternativeName;
 
 /**
 * PKCS #10 Certificate Request.
diff --git a/src/lib/x509/pkix_enums.h b/src/lib/x509/pkix_enums.h
new file mode 100644
index 000000000..a1c85293b
--- /dev/null
+++ b/src/lib/x509/pkix_enums.h
@@ -0,0 +1,143 @@
+/*
+* (C) 2013 Jack Lloyd
+*
+* Botan is released under the Simplified BSD License (see license.txt)
+*/
+
+#ifndef BOTAN_X509_PKIX_ENUMS_H_
+#define BOTAN_X509_PKIX_ENUMS_H_
+
+#include <botan/types.h>
+
+namespace Botan {
+
+/**
+* Certificate validation status code
+*/
+enum class Certificate_Status_Code {
+   OK = 0,
+   VERIFIED = 0,
+
+   // Revocation status
+   OCSP_RESPONSE_GOOD = 1,
+   OCSP_SIGNATURE_OK = 2,
+   VALID_CRL_CHECKED = 3,
+   OCSP_NO_HTTP = 4,
+
+   // Warnings
+   FIRST_WARNING_STATUS = 500,
+   CERT_SERIAL_NEGATIVE = 500,
+   DN_TOO_LONG = 501,
+   OCSP_NO_REVOCATION_URL = 502,
+   OCSP_SERVER_NOT_AVAILABLE = 503,
+
+   // Typo versions of above - will be removed in future major release
+   OSCP_NO_REVOCATION_URL = 502,
+   OSCP_SERVER_NOT_AVAILABLE = 503,
+
+   // Errors
+   FIRST_ERROR_STATUS = 1000,
+
+   SIGNATURE_METHOD_TOO_WEAK = 1000,
+   UNTRUSTED_HASH = 1001,
+   NO_REVOCATION_DATA = 1002,
+   NO_MATCHING_CRLDP = 1003,
+
+   // Time problems
+   CERT_NOT_YET_VALID = 2000,
+   CERT_HAS_EXPIRED = 2001,
+   OCSP_NOT_YET_VALID = 2002,
+   OCSP_HAS_EXPIRED = 2003,
+   CRL_NOT_YET_VALID = 2004,
+   CRL_HAS_EXPIRED = 2005,
+   OCSP_IS_TOO_OLD = 2006,
+
+   // Chain generation problems
+   CERT_ISSUER_NOT_FOUND = 3000,
+   CANNOT_ESTABLISH_TRUST = 3001,
+   CERT_CHAIN_LOOP = 3002,
+   CHAIN_LACKS_TRUST_ROOT = 3003,
+   CHAIN_NAME_MISMATCH = 3004,
+
+   // Validation errors
+   POLICY_ERROR = 4000,
+   INVALID_USAGE = 4001,
+   CERT_CHAIN_TOO_LONG = 4002,
+   CA_CERT_NOT_FOR_CERT_ISSUER = 4003,
+   NAME_CONSTRAINT_ERROR = 4004,
+
+   // Revocation errors
+   CA_CERT_NOT_FOR_CRL_ISSUER = 4005,
+   OCSP_CERT_NOT_LISTED = 4006,
+   OCSP_BAD_STATUS = 4007,
+
+   // Other problems
+   CERT_NAME_NOMATCH = 4008,
+   UNKNOWN_CRITICAL_EXTENSION = 4009,
+   DUPLICATE_CERT_EXTENSION = 4010,
+   OCSP_SIGNATURE_ERROR = 4501,
+   OCSP_ISSUER_NOT_FOUND = 4502,
+   OCSP_RESPONSE_MISSING_KEYUSAGE = 4503,
+   OCSP_RESPONSE_INVALID = 4504,
+   EXT_IN_V1_V2_CERT = 4505,
+   DUPLICATE_CERT_POLICY = 4506,
+   V2_IDENTIFIERS_IN_V1_CERT = 4507,
+
+   // Hard failures
+   CERT_IS_REVOKED = 5000,
+   CRL_BAD_SIGNATURE = 5001,
+   SIGNATURE_ERROR = 5002,
+   CERT_PUBKEY_INVALID = 5003,
+   SIGNATURE_ALGO_UNKNOWN = 5004,
+   SIGNATURE_ALGO_BAD_PARAMS = 5005
+};
+
+/**
+* Convert a status code to a human readable diagnostic message
+* @param code the certifcate status
+* @return string literal constant, or nullptr if code unknown
+*/
+BOTAN_PUBLIC_API(2,0) const char* to_string(Certificate_Status_Code code);
+
+/**
+* X.509v3 Key Constraints.
+* If updating update copy in ffi.h
+*/
+enum Key_Constraints {
+   NO_CONSTRAINTS     = 0,
+   DIGITAL_SIGNATURE  = 1 << 15,
+   NON_REPUDIATION    = 1 << 14,
+   KEY_ENCIPHERMENT   = 1 << 13,
+   DATA_ENCIPHERMENT  = 1 << 12,
+   KEY_AGREEMENT      = 1 << 11,
+   KEY_CERT_SIGN      = 1 << 10,
+   CRL_SIGN           = 1 << 9,
+   ENCIPHER_ONLY      = 1 << 8,
+   DECIPHER_ONLY      = 1 << 7
+};
+
+/**
+* X.509v2 CRL Reason Code.
+* This will become an enum class in a future major release
+*/
+enum CRL_Code : uint32_t {
+   UNSPECIFIED            = 0,
+   KEY_COMPROMISE         = 1,
+   CA_COMPROMISE          = 2,
+   AFFILIATION_CHANGED    = 3,
+   SUPERSEDED             = 4,
+   CESSATION_OF_OPERATION = 5,
+   CERTIFICATE_HOLD       = 6,
+   REMOVE_FROM_CRL        = 8,
+   PRIVLEDGE_WITHDRAWN    = 9,
+   PRIVILEGE_WITHDRAWN    = 9,
+   AA_COMPROMISE          = 10,
+
+   DELETE_CRL_ENTRY       = 0xFF00,
+   OCSP_GOOD              = 0xFF01,
+   OCSP_UNKNOWN           = 0xFF02
+};
+
+}
+
+#endif
diff --git a/src/lib/x509/pkix_types.h b/src/lib/x509/pkix_types.h
new file mode 100644
index 000000000..983121955
--- /dev/null
+++ b/src/lib/x509/pkix_types.h
@@ -0,0 +1,613 @@
+/*
+* (C) 1999-2010,2012,2018,2020 Jack Lloyd
+* (C) 2007 Yves Jerschow
+* (C) 2015 Kai Michaelis
+* (C) 2016 René Korthaus, Rohde & Schwarz Cybersecurity
+* (C) 2017 Fabian Weissberg, Rohde & Schwarz Cybersecurity
+*
+* Botan is released under the Simplified BSD License (see license.txt)
+*/
+
+#ifndef BOTAN_PKIX_TYPES_H_
+#define BOTAN_PKIX_TYPES_H_
+
+#include <botan/asn1_obj.h>
+#include <botan/pkix_enums.h>
+#include <vector>
+#include <string>
+#include <iosfwd>
+#include <map>
+#include <set>
+
+namespace Botan {
+
+class X509_Certificate;
+class Data_Store;
+class Public_Key;
+
+/**
+* Check that key constraints are permitted for a specific public key.
+* @param pub_key the public key on which the constraints shall be enforced on
+* @param constraints the constraints that shall be enforced on the key
+* @throw Invalid_Argument if the given constraints are not permitted for this key
+*/
+BOTAN_PUBLIC_API(2,0) void verify_cert_constraints_valid_for_key_type(const Public_Key& pub_key,
+                                                                      Key_Constraints constraints);
+
+std::string BOTAN_PUBLIC_API(2,0) key_constraints_to_string(Key_Constraints);
+
+/**
+* Distinguished Name
+*/
+class BOTAN_PUBLIC_API(2,0) X509_DN final : public ASN1_Object
+   {
+   public:
+      X509_DN() = default;
+
+      explicit X509_DN(const std::multimap<OID, std::string>& args)
+         {
+         for(auto i : args)
+            add_attribute(i.first, i.second);
+         }
+
+      explicit X509_DN(const std::multimap<std::string, std::string>& args)
+         {
+         for(auto i : args)
+            add_attribute(i.first, i.second);
+         }
+
+      void encode_into(DER_Encoder&) const override;
+      void decode_from(BER_Decoder&) override;
+
+      bool has_field(const OID& oid) const;
+      ASN1_String get_first_attribute(const OID& oid) const;
+
+      /*
+      * Return the BER encoded data, if any
+      */
+      const std::vector<uint8_t>& get_bits() const { return m_dn_bits; }
+
+      bool empty() const { return m_rdn.empty(); }
+
+      std::string to_string() const;
+
+      const std::vector<std::pair<OID,ASN1_String>>& dn_info() const { return m_rdn; }
+
+      std::multimap<OID, std::string> get_attributes() const;
+      std::multimap<std::string, std::string> contents() const;
+
+      bool has_field(const std::string& attr) const;
+      std::vector<std::string> get_attribute(const std::string& attr) const;
+      std::string get_first_attribute(const std::string& attr) const;
+
+      void add_attribute(const std::string& key, const std::string& val);
+
+      void add_attribute(const OID& oid, const std::string& val)
+         {
+         add_attribute(oid, ASN1_String(val));
+         }
+
+      void add_attribute(const OID& oid, const ASN1_String& val);
+
+      static std::string deref_info_field(const std::string& key);
+
+      /**
+      * Lookup upper bounds in characters for the length of distinguished name fields
+      * as given in RFC 5280, Appendix A.
+      *
+      * @param oid the oid of the DN to lookup
+      * @return the upper bound, or zero if no ub is known to Botan
+      */
+      static size_t lookup_ub(const OID& oid);
+
+   private:
+      std::vector<std::pair<OID,ASN1_String>> m_rdn;
+      std::vector<uint8_t> m_dn_bits;
+   };
+
+bool BOTAN_PUBLIC_API(2,0) operator==(const X509_DN& dn1, const X509_DN& dn2);
+bool BOTAN_PUBLIC_API(2,0) operator!=(const X509_DN& dn1, const X509_DN& dn2);
+
+/*
+The ordering here is arbitrary and may change from release to release.
+It is intended for allowing DNs as keys in std::map and similiar containers
+*/
+bool BOTAN_PUBLIC_API(2,0) operator<(const X509_DN& dn1, const X509_DN& dn2);
+
+BOTAN_PUBLIC_API(2,0) std::ostream& operator<<(std::ostream& out, const X509_DN& dn);
+BOTAN_PUBLIC_API(2,0) std::istream& operator>>(std::istream& in, X509_DN& dn);
+
+/**
+* Alternative Name
+*/
+class BOTAN_PUBLIC_API(2,0) AlternativeName final : public ASN1_Object
+   {
+   public:
+      void encode_into(DER_Encoder&) const override;
+      void decode_from(BER_Decoder&) override;
+
+      std::multimap<std::string, std::string> contents() const;
+
+      bool has_field(const std::string& attr) const;
+      std::vector<std::string> get_attribute(const std::string& attr) const;
+
+      std::string get_first_attribute(const std::string& attr) const;
+
+      void add_attribute(const std::string& type, const std::string& value);
+      void add_othername(const OID& oid, const std::string& value, ASN1_Tag type);
+
+      const std::multimap<std::string, std::string>& get_attributes() const
+         {
+         return m_alt_info;
+         }
+
+      const std::multimap<OID, ASN1_String>& get_othernames() const
+         {
+         return m_othernames;
+         }
+
+      X509_DN dn() const;
+
+      bool has_items() const;
+
+      AlternativeName(const std::string& email_addr = "",
+                      const std::string& uri = "",
+                      const std::string& dns = "",
+                      const std::string& ip_address = "");
+   private:
+      std::multimap<std::string, std::string> m_alt_info;
+      std::multimap<OID, ASN1_String> m_othernames;
+   };
+
+/**
+* Attribute
+*/
+class BOTAN_PUBLIC_API(2,0) Attribute final : public ASN1_Object
+   {
+   public:
+      void encode_into(DER_Encoder& to) const override;
+      void decode_from(BER_Decoder& from) override;
+
+      Attribute() = default;
+      Attribute(const OID&, const std::vector<uint8_t>&);
+      Attribute(const std::string&, const std::vector<uint8_t>&);
+
+      const OID& get_oid() const { return oid; }
+
+      const std::vector<uint8_t>& get_parameters() const { return parameters; }
+
+   BOTAN_DEPRECATED_PUBLIC_MEMBER_VARIABLES:
+      /*
+      * These values are public for historical reasons, but in a future release
+      * they will be made private. Do not access them.
+      */
+      OID oid;
+      std::vector<uint8_t> parameters;
+   };
+
+/**
+* @brief X.509 GeneralName Type
+*
+* Handles parsing GeneralName types in their BER and canonical string
+* encoding. Allows matching GeneralNames against each other using
+* the rules laid out in the RFC 5280, sec. 4.2.1.10 (Name Contraints).
+*/
+class BOTAN_PUBLIC_API(2,0) GeneralName final : public ASN1_Object
+   {
+   public:
+      enum MatchResult : int
+            {
+            All,
+            Some,
+            None,
+            NotFound,
+            UnknownType,
+            };
+
+      /**
+      * Creates an empty GeneralName.
+      */
+      GeneralName() = default;
+
+      /**
+      * Creates a new GeneralName for its string format.
+      * @param str type and name, colon-separated, e.g., "DNS:google.com"
+      */
+      GeneralName(const std::string& str);
+
+      void encode_into(DER_Encoder&) const override;
+
+      void decode_from(BER_Decoder&) override;
+
+      /**
+      * @return Type of the name. Can be DN, DNS, IP, RFC822 or URI.
+      */
+      const std::string& type() const { return m_type; }
+
+      /**
+      * @return The name as string. Format depends on type.
+      */
+      const std::string& name() const { return m_name; }
+
+      /**
+      * Checks whether a given certificate (partially) matches this name.
+      * @param cert certificate to be matched
+      * @return the match result
+      */
+      MatchResult matches(const X509_Certificate& cert) const;
+
+   private:
+      std::string m_type;
+      std::string m_name;
+
+      bool matches_dns(const std::string&) const;
+      bool matches_dn(const std::string&) const;
+      bool matches_ip(const std::string&) const;
+   };
+
+std::ostream& operator<<(std::ostream& os, const GeneralName& gn);
+
+/**
+* @brief A single Name Constraint
+*
+* The Name Constraint extension adds a minimum and maximum path
+* length to a GeneralName to form a constraint. The length limits
+* are currently unused.
+*/
+class BOTAN_PUBLIC_API(2,0) GeneralSubtree final : public ASN1_Object
+   {
+   public:
+      /**
+      * Creates an empty name constraint.
+      */
+      GeneralSubtree() : m_base(), m_minimum(0), m_maximum(std::numeric_limits<std::size_t>::max())
+      {}
+
+      /***
+      * Creates a new name constraint.
+      * @param base name
+      * @param min minimum path length
+      * @param max maximum path length
+      */
+      GeneralSubtree(const GeneralName& base, size_t min, size_t max)
+      : m_base(base), m_minimum(min), m_maximum(max)
+      {}
+
+      /**
+      * Creates a new name constraint for its string format.
+      * @param str name constraint
+      */
+      GeneralSubtree(const std::string& str);
+
+      void encode_into(DER_Encoder&) const override;
+
+      void decode_from(BER_Decoder&) override;
+
+      /**
+      * @return name
+      */
+      const GeneralName& base() const { return m_base; }
+
+      /**
+      * @return minimum path length
+      */
+      size_t minimum() const { return m_minimum; }
+
+      /**
+      * @return maximum path length
+      */
+      size_t maximum() const { return m_maximum; }
+
+   private:
+      GeneralName m_base;
+      size_t m_minimum;
+      size_t m_maximum;
+   };
+
+std::ostream& operator<<(std::ostream& os, const GeneralSubtree& gs);
+
+/**
+* @brief Name Constraints
+*
+* Wraps the Name Constraints associated with a certificate.
+*/
+class BOTAN_PUBLIC_API(2,0) NameConstraints final
+   {
+   public:
+      /**
+      * Creates an empty name NameConstraints.
+      */
+      NameConstraints() : m_permitted_subtrees(), m_excluded_subtrees() {}
+
+      /**
+      * Creates NameConstraints from a list of permitted and excluded subtrees.
+      * @param permitted_subtrees names for which the certificate is permitted
+      * @param excluded_subtrees names for which the certificate is not permitted
+      */
+      NameConstraints(std::vector<GeneralSubtree>&& permitted_subtrees,
+                    std::vector<GeneralSubtree>&& excluded_subtrees)
+      : m_permitted_subtrees(permitted_subtrees), m_excluded_subtrees(excluded_subtrees)
+      {}
+
+      /**
+      * @return permitted names
+      */
+      const std::vector<GeneralSubtree>& permitted() const { return m_permitted_subtrees; }
+
+      /**
+      * @return excluded names
+      */
+      const std::vector<GeneralSubtree>& excluded() const { return m_excluded_subtrees; }
+
+   private:
+      std::vector<GeneralSubtree> m_permitted_subtrees;
+      std::vector<GeneralSubtree> m_excluded_subtrees;
+   };
+
+/**
+* X.509 Certificate Extension
+*/
+class BOTAN_PUBLIC_API(2,0) Certificate_Extension
+   {
+   public:
+      /**
+      * @return OID representing this extension
+      */
+      virtual OID oid_of() const = 0;
+
+      /*
+      * @return specific OID name
+      * If possible OIDS table should match oid_name to OIDS, ie
+      * OID::from_string(ext->oid_name()) == ext->oid_of()
+      * Should return empty string if OID is not known
+      */
+      virtual std::string oid_name() const = 0;
+
+      /**
+      * Make a copy of this extension
+      * @return copy of this
+      */
+      virtual Certificate_Extension* copy() const = 0;
+
+      /*
+      * Add the contents of this extension into the information
+      * for the subject and/or issuer, as necessary.
+      * @param subject the subject info
+      * @param issuer the issuer info
+      */
+      virtual void contents_to(Data_Store& subject,
+                               Data_Store& issuer) const = 0;
+
+      /*
+      * Callback visited during path validation.
+      *
+      * An extension can implement this callback to inspect
+      * the path during path validation.
+      *
+      * If an error occurs during validation of this extension,
+      * an appropriate status code shall be added to cert_status.
+      *
+      * @param subject Subject certificate that contains this extension
+      * @param issuer Issuer certificate
+      * @param status Certificate validation status codes for subject certificate
+      * @param cert_path Certificate path which is currently validated
+      * @param pos Position of subject certificate in cert_path
+      */
+      virtual void validate(const X509_Certificate& subject, const X509_Certificate& issuer,
+            const std::vector<std::shared_ptr<const X509_Certificate>>& cert_path,
+            std::vector<std::set<Certificate_Status_Code>>& cert_status,
+            size_t pos);
+
+      virtual ~Certificate_Extension() = default;
+   protected:
+      friend class Extensions;
+      virtual bool should_encode() const { return true; }
+      virtual std::vector<uint8_t> encode_inner() const = 0;
+      virtual void decode_inner(const std::vector<uint8_t>&) = 0;
+   };
+
+/**
+* X.509 Certificate Extension List
+*/
+class BOTAN_PUBLIC_API(2,0) Extensions final : public ASN1_Object
+   {
+   public:
+      /**
+      * Look up an object in the extensions, based on OID Returns
+      * nullptr if not set, if the extension was either absent or not
+      * handled. The pointer returned is owned by the Extensions
+      * object.
+      * This would be better with an optional<T> return value
+      */
+      const Certificate_Extension* get_extension_object(const OID& oid) const;
+
+      template<typename T>
+      const T* get_extension_object_as(const OID& oid = T::static_oid()) const
+         {
+         if(const Certificate_Extension* extn = get_extension_object(oid))
+            {
+            // Unknown_Extension oid_name is empty
+            if(extn->oid_name().empty())
+               {
+               return nullptr;
+               }
+            else if(const T* extn_as_T = dynamic_cast<const T*>(extn))
+               {
+               return extn_as_T;
+               }
+            else
+               {
+               throw Decoding_Error("Exception::get_extension_object_as dynamic_cast failed");
+               }
+            }
+
+         return nullptr;
+         }
+
+      /**
+      * Return the set of extensions in the order they appeared in the certificate
+      * (or as they were added, if constructed)
+      */
+      const std::vector<OID>& get_extension_oids() const
+         {
+         return m_extension_oids;
+         }
+
+      /**
+      * Return true if an extension was set
+      */
+      bool extension_set(const OID& oid) const;
+
+      /**
+      * Return true if an extesion was set and marked critical
+      */
+      bool critical_extension_set(const OID& oid) const;
+
+      /**
+      * Return the raw bytes of the extension
+      * Will throw if OID was not set as an extension.
+      */
+      std::vector<uint8_t> get_extension_bits(const OID& oid) const;
+
+      void encode_into(class DER_Encoder&) const override;
+      void decode_from(class BER_Decoder&) override;
+      void contents_to(Data_Store&, Data_Store&) const;
+
+      /**
+      * Adds a new extension to the list.
+      * @param extn pointer to the certificate extension (Extensions takes ownership)
+      * @param critical whether this extension should be marked as critical
+      * @throw Invalid_Argument if the extension is already present in the list
+      */
+      void add(Certificate_Extension* extn, bool critical = false);
+
+      /**
+      * Adds a new extension to the list unless it already exists. If the extension
+      * already exists within the Extensions object, the extn pointer will be deleted.
+      *
+      * @param extn pointer to the certificate extension (Extensions takes ownership)
+      * @param critical whether this extension should be marked as critical
+      * @return true if the object was added false if the extension was already used
+      */
+      bool add_new(Certificate_Extension* extn, bool critical = false);
+
+      /**
+      * Adds an extension to the list or replaces it.
+      * @param extn the certificate extension
+      * @param critical whether this extension should be marked as critical
+      */
+      void replace(Certificate_Extension* extn, bool critical = false);
+
+      /**
+      * Remove an extension from the list. Returns true if the
+      * extension had been set, false otherwise.
+      */
+      bool remove(const OID& oid);
+
+      /**
+      * Searches for an extension by OID and returns the result.
+      * Only the known extensions types declared in this header
+      * are searched for by this function.
+      * @return Copy of extension with oid, nullptr if not found.
+      * Can avoid creating a copy by using get_extension_object function
+      */
+      std::unique_ptr<Certificate_Extension> get(const OID& oid) const;
+
+      /**
+      * Searches for an extension by OID and returns the result decoding
+      * it to some arbitrary extension type chosen by the application.
+      *
+      * Only the unknown extensions, that is, extensions types that
+      * are not declared in this header, are searched for by this
+      * function.
+      *
+      * @return Pointer to new extension with oid, nullptr if not found.
+      */
+      template<typename T>
+      std::unique_ptr<T> get_raw(const OID& oid) const
+         {
+         auto extn_info = m_extension_info.find(oid);
+
+         if(extn_info != m_extension_info.end())
+            {
+            // Unknown_Extension oid_name is empty
+            if(extn_info->second.obj().oid_name() == "")
+               {
+               std::unique_ptr<T> ext(new T);
+               ext->decode_inner(extn_info->second.bits());
+               return ext;
+               }
+            }
+         return nullptr;
+         }
+
+      /**
+      * Returns a copy of the list of extensions together with the corresponding
+      * criticality flag. All extensions are encoded as some object, falling back
+      * to Unknown_Extension class which simply allows reading the bytes as well
+      * as the criticality flag.
+      */
+      std::vector<std::pair<std::unique_ptr<Certificate_Extension>, bool>> extensions() const;
+
+      /**
+      * Returns the list of extensions as raw, encoded bytes
+      * together with the corresponding criticality flag.
+      * Contains all extensions, including any extensions encoded as Unknown_Extension
+      */
+      std::map<OID, std::pair<std::vector<uint8_t>, bool>> extensions_raw() const;
+
+      Extensions() {}
+
+      Extensions(const Extensions&) = default;
+      Extensions& operator=(const Extensions&) = default;
+
+      Extensions(Extensions&&) = default;
+      Extensions& operator=(Extensions&&) = default;
+
+   private:
+      static std::unique_ptr<Certificate_Extension>
+         create_extn_obj(const OID& oid,
+                         bool critical,
+                         const std::vector<uint8_t>& body);
+
+      class Extensions_Info
+         {
+         public:
+            Extensions_Info(bool critical,
+                            Certificate_Extension* ext) :
+               m_obj(ext),
+               m_bits(m_obj->encode_inner()),
+               m_critical(critical)
+               {
+               }
+
+            Extensions_Info(bool critical,
+                            const std::vector<uint8_t>& encoding,
+                            Certificate_Extension* ext) :
+               m_obj(ext),
+               m_bits(encoding),
+               m_critical(critical)
+               {
+               }
+
+            bool is_critical() const { return m_critical; }
+            const std::vector<uint8_t>& bits() const { return m_bits; }
+            const Certificate_Extension& obj() const
+               {
+               BOTAN_ASSERT_NONNULL(m_obj.get());
+               return *m_obj.get();
+               }
+
+         private:
+            std::shared_ptr<Certificate_Extension> m_obj;
+            std::vector<uint8_t> m_bits;
+            bool m_critical = false;
+         };
+
+      std::vector<OID> m_extension_oids;
+      std::map<OID, Extensions_Info> m_extension_info;
+   };
+
+}
+
+#endif
diff --git a/src/lib/asn1/asn1_attribute.cpp b/src/lib/x509/x509_attribute.cpp
similarity index 96%
rename from src/lib/asn1/asn1_attribute.cpp
rename to src/lib/x509/x509_attribute.cpp
index 3106dda70..035f254c8 100644
--- a/src/lib/asn1/asn1_attribute.cpp
+++ b/src/lib/x509/x509_attribute.cpp
@@ -5,7 +5,7 @@
 * Botan is released under the Simplified BSD License (see license.txt)
 */
 
-#include <botan/asn1_attribute.h>
+#include <botan/pkix_types.h>
 #include <botan/der_enc.h>
 #include <botan/ber_dec.h>
 #include <botan/oids.h>
diff --git a/src/lib/x509/x509_ca.cpp b/src/lib/x509/x509_ca.cpp
index 59bc219b5..542a3a919 100644
--- a/src/lib/x509/x509_ca.cpp
+++ b/src/lib/x509/x509_ca.cpp
@@ -6,20 +6,20 @@
 */
 
 #include <botan/x509_ca.h>
+#include <botan/x509_key.h>
 #include <botan/x509self.h>
-#include <botan/pkcs10.h>
+#include <botan/x509_ext.h>
+#include <botan/pkix_types.h>
 #include <botan/pubkey.h>
 #include <botan/der_enc.h>
 #include <botan/bigint.h>
 #include <botan/parsing.h>
 #include <botan/oids.h>
 #include <botan/hash.h>
-#include <botan/key_constraint.h>
 #include <botan/emsa.h>
 #include <botan/scan_name.h>
 #include <algorithm>
 #include <iterator>
-#include <map>
 
 namespace Botan {
 
diff --git a/src/lib/x509/x509_ca.h b/src/lib/x509/x509_ca.h
index ab24e0301..20e9b1bcc 100644
--- a/src/lib/x509/x509_ca.h
+++ b/src/lib/x509/x509_ca.h
@@ -11,6 +11,7 @@
 #include <botan/x509cert.h>
 #include <botan/x509_crl.h>
 #include <chrono>
+#include <map>
 
 #if defined(BOTAN_HAS_SYSTEM_RNG)
   #include <botan/system_rng.h>
diff --git a/src/lib/x509/x509_crl.h b/src/lib/x509/x509_crl.h
index d52c98e9a..6d4a301ab 100644
--- a/src/lib/x509/x509_crl.h
+++ b/src/lib/x509/x509_crl.h
@@ -9,17 +9,82 @@
 #define BOTAN_X509_CRL_H_
 
 #include <botan/x509_obj.h>
-#include <botan/x509_dn.h>
-#include <botan/crl_ent.h>
+#include <botan/asn1_obj.h>
+#include <botan/pkix_enums.h>
 #include <vector>
 
 namespace Botan {
 
 class Extensions;
 class X509_Certificate;
+class X509_DN;
 
+struct CRL_Entry_Data;
 struct CRL_Data;
 
+/**
+* This class represents CRL entries
+*/
+class BOTAN_PUBLIC_API(2,0) CRL_Entry final : public ASN1_Object
+   {
+   public:
+      void encode_into(class DER_Encoder&) const override;
+      void decode_from(class BER_Decoder&) override;
+
+      /**
+      * Get the serial number of the certificate associated with this entry.
+      * @return certificate's serial number
+      */
+      const std::vector<uint8_t>& serial_number() const;
+
+      /**
+      * Get the revocation date of the certificate associated with this entry
+      * @return certificate's revocation date
+      */
+      const X509_Time& expire_time() const;
+
+      /**
+      * Get the entries reason code
+      * @return reason code
+      */
+      CRL_Code reason_code() const;
+
+      /**
+      * Get the extensions on this CRL entry
+      */
+      const Extensions& extensions() const;
+
+      /**
+      * Create uninitialized CRL_Entry object
+      */
+      CRL_Entry() = default;
+
+      /**
+      * Construct an CRL entry.
+      * @param cert the certificate to revoke
+      * @param reason the reason code to set in the entry
+      */
+      CRL_Entry(const X509_Certificate& cert,
+                CRL_Code reason = UNSPECIFIED);
+
+   private:
+      friend class X509_CRL;
+
+      const CRL_Entry_Data& data() const;
+
+      std::shared_ptr<CRL_Entry_Data> m_data;
+   };
+
+/**
+* Test two CRL entries for equality in all fields.
+*/
+BOTAN_PUBLIC_API(2,0) bool operator==(const CRL_Entry&, const CRL_Entry&);
+
+/**
+* Test two CRL entries for inequality in at least one field.
+*/
+BOTAN_PUBLIC_API(2,0) bool operator!=(const CRL_Entry&, const CRL_Entry&);
+
 /**
 * This class represents X.509 Certificate Revocation Lists (CRLs).
 */
diff --git a/src/lib/x509/x509_dn.cpp b/src/lib/x509/x509_dn.cpp
index bd8b60c40..c5128180f 100644
--- a/src/lib/x509/x509_dn.cpp
+++ b/src/lib/x509/x509_dn.cpp
@@ -5,7 +5,7 @@
 * Botan is released under the Simplified BSD License (see license.txt)
 */
 
-#include <botan/x509_dn.h>
+#include <botan/pkix_types.h>
 #include <botan/der_enc.h>
 #include <botan/ber_dec.h>
 #include <botan/parsing.h>
diff --git a/src/lib/x509/x509_dn.h b/src/lib/x509/x509_dn.h
index 4f9f8041e..cd7beebe9 100644
--- a/src/lib/x509/x509_dn.h
+++ b/src/lib/x509/x509_dn.h
@@ -1,102 +1,11 @@
 /*
-* X.509 Distinguished Name
-* (C) 1999-2010,2018 Jack Lloyd
-* (C) 2017 Fabian Weissberg, Rohde & Schwarz Cybersecurity
-*
 * Botan is released under the Simplified BSD License (see license.txt)
 */
 
 #ifndef BOTAN_X509_DN_H_
 #define BOTAN_X509_DN_H_
 
-#include <botan/asn1_obj.h>
-#include <vector>
-#include <map>
-#include <iosfwd>
-
-namespace Botan {
-
-/**
-* Distinguished Name
-*/
-class BOTAN_PUBLIC_API(2,0) X509_DN final : public ASN1_Object
-   {
-   public:
-      X509_DN() = default;
-
-      explicit X509_DN(const std::multimap<OID, std::string>& args)
-         {
-         for(auto i : args)
-            add_attribute(i.first, i.second);
-         }
-
-      explicit X509_DN(const std::multimap<std::string, std::string>& args)
-         {
-         for(auto i : args)
-            add_attribute(i.first, i.second);
-         }
-
-      void encode_into(class DER_Encoder&) const override;
-      void decode_from(class BER_Decoder&) override;
-
-      bool has_field(const OID& oid) const;
-      ASN1_String get_first_attribute(const OID& oid) const;
-
-      /*
-      * Return the BER encoded data, if any
-      */
-      const std::vector<uint8_t>& get_bits() const { return m_dn_bits; }
-
-      bool empty() const { return m_rdn.empty(); }
-
-      std::string to_string() const;
-
-      const std::vector<std::pair<OID,ASN1_String>>& dn_info() const { return m_rdn; }
-
-      std::multimap<OID, std::string> get_attributes() const;
-      std::multimap<std::string, std::string> contents() const;
-
-      bool has_field(const std::string& attr) const;
-      std::vector<std::string> get_attribute(const std::string& attr) const;
-      std::string get_first_attribute(const std::string& attr) const;
-
-      void add_attribute(const std::string& key, const std::string& val);
-
-      void add_attribute(const OID& oid, const std::string& val)
-         {
-         add_attribute(oid, ASN1_String(val));
-         }
-
-      void add_attribute(const OID& oid, const ASN1_String& val);
-
-      static std::string deref_info_field(const std::string& key);
-
-      /**
-      * Lookup upper bounds in characters for the length of distinguished name fields
-      * as given in RFC 5280, Appendix A.
-      *
-      * @param oid the oid of the DN to lookup
-      * @return the upper bound, or zero if no ub is known to Botan
-      */
-      static size_t lookup_ub(const OID& oid);
-
-   private:
-      std::vector<std::pair<OID,ASN1_String>> m_rdn;
-      std::vector<uint8_t> m_dn_bits;
-   };
-
-bool BOTAN_PUBLIC_API(2,0) operator==(const X509_DN& dn1, const X509_DN& dn2);
-bool BOTAN_PUBLIC_API(2,0) operator!=(const X509_DN& dn1, const X509_DN& dn2);
-
-/*
-The ordering here is arbitrary and may change from release to release.
-It is intended for allowing DNs as keys in std::map and similiar containers
-*/
-bool BOTAN_PUBLIC_API(2,0) operator<(const X509_DN& dn1, const X509_DN& dn2);
-
-BOTAN_PUBLIC_API(2,0) std::ostream& operator<<(std::ostream& out, const X509_DN& dn);
-BOTAN_PUBLIC_API(2,0) std::istream& operator>>(std::istream& in, X509_DN& dn);
-
-}
+#include <botan/pkix_types.h>
+BOTAN_DEPRECATED_HEADER(x509_dn.h)
 
 #endif
diff --git a/src/lib/x509/x509_dn_ub.cpp b/src/lib/x509/x509_dn_ub.cpp
index 0da17f6c0..b5c7645a1 100644
--- a/src/lib/x509/x509_dn_ub.cpp
+++ b/src/lib/x509/x509_dn_ub.cpp
@@ -9,7 +9,7 @@
 * Botan is released under the Simplified BSD License (see license.txt)
 */
 
-#include <botan/x509_dn.h>
+#include <botan/pkix_types.h>
 #include <botan/asn1_obj.h>
 #include <map>
 
diff --git a/src/lib/x509/x509_ext.h b/src/lib/x509/x509_ext.h
index a0a4a84f1..cb6e064c9 100644
--- a/src/lib/x509/x509_ext.h
+++ b/src/lib/x509/x509_ext.h
@@ -8,12 +8,7 @@
 #ifndef BOTAN_X509_EXTENSIONS_H_
 #define BOTAN_X509_EXTENSIONS_H_
 
-#include <botan/asn1_obj.h>
-#include <botan/asn1_alt_name.h>
-#include <botan/cert_status.h>
-#include <botan/name_constraint.h>
-#include <botan/key_constraint.h>
-#include <botan/crl_ent.h>
+#include <botan/pkix_types.h>
 #include <set>
 
 namespace Botan {
@@ -21,270 +16,6 @@ namespace Botan {
 class Data_Store;
 class X509_Certificate;
 
-/**
-* X.509 Certificate Extension
-*/
-class BOTAN_PUBLIC_API(2,0) Certificate_Extension
-   {
-   public:
-      /**
-      * @return OID representing this extension
-      */
-      virtual OID oid_of() const = 0;
-
-      /*
-      * @return specific OID name
-      * If possible OIDS table should match oid_name to OIDS, ie
-      * OID::from_string(ext->oid_name()) == ext->oid_of()
-      * Should return empty string if OID is not known
-      */
-      virtual std::string oid_name() const = 0;
-
-      /**
-      * Make a copy of this extension
-      * @return copy of this
-      */
-      virtual Certificate_Extension* copy() const = 0;
-
-      /*
-      * Add the contents of this extension into the information
-      * for the subject and/or issuer, as necessary.
-      * @param subject the subject info
-      * @param issuer the issuer info
-      */
-      virtual void contents_to(Data_Store& subject,
-                               Data_Store& issuer) const = 0;
-
-      /*
-      * Callback visited during path validation.
-      *
-      * An extension can implement this callback to inspect
-      * the path during path validation.
-      *
-      * If an error occurs during validation of this extension,
-      * an appropriate status code shall be added to cert_status.
-      *
-      * @param subject Subject certificate that contains this extension
-      * @param issuer Issuer certificate
-      * @param status Certificate validation status codes for subject certificate
-      * @param cert_path Certificate path which is currently validated
-      * @param pos Position of subject certificate in cert_path
-      */
-      virtual void validate(const X509_Certificate& subject, const X509_Certificate& issuer,
-            const std::vector<std::shared_ptr<const X509_Certificate>>& cert_path,
-            std::vector<std::set<Certificate_Status_Code>>& cert_status,
-            size_t pos);
-
-      virtual ~Certificate_Extension() = default;
-   protected:
-      friend class Extensions;
-      virtual bool should_encode() const { return true; }
-      virtual std::vector<uint8_t> encode_inner() const = 0;
-      virtual void decode_inner(const std::vector<uint8_t>&) = 0;
-   };
-
-/**
-* X.509 Certificate Extension List
-*/
-class BOTAN_PUBLIC_API(2,0) Extensions final : public ASN1_Object
-   {
-   public:
-      /**
-      * Look up an object in the extensions, based on OID Returns
-      * nullptr if not set, if the extension was either absent or not
-      * handled. The pointer returned is owned by the Extensions
-      * object.
-      * This would be better with an optional<T> return value
-      */
-      const Certificate_Extension* get_extension_object(const OID& oid) const;
-
-      template<typename T>
-      const T* get_extension_object_as(const OID& oid = T::static_oid()) const
-         {
-         if(const Certificate_Extension* extn = get_extension_object(oid))
-            {
-            // Unknown_Extension oid_name is empty
-            if(extn->oid_name().empty())
-               {
-               return nullptr;
-               }
-            else if(const T* extn_as_T = dynamic_cast<const T*>(extn))
-               {
-               return extn_as_T;
-               }
-            else
-               {
-               throw Decoding_Error("Exception::get_extension_object_as dynamic_cast failed");
-               }
-            }
-
-         return nullptr;
-         }
-
-      /**
-      * Return the set of extensions in the order they appeared in the certificate
-      * (or as they were added, if constructed)
-      */
-      const std::vector<OID>& get_extension_oids() const
-         {
-         return m_extension_oids;
-         }
-
-      /**
-      * Return true if an extension was set
-      */
-      bool extension_set(const OID& oid) const;
-
-      /**
-      * Return true if an extesion was set and marked critical
-      */
-      bool critical_extension_set(const OID& oid) const;
-
-      /**
-      * Return the raw bytes of the extension
-      * Will throw if OID was not set as an extension.
-      */
-      std::vector<uint8_t> get_extension_bits(const OID& oid) const;
-
-      void encode_into(class DER_Encoder&) const override;
-      void decode_from(class BER_Decoder&) override;
-      void contents_to(Data_Store&, Data_Store&) const;
-
-      /**
-      * Adds a new extension to the list.
-      * @param extn pointer to the certificate extension (Extensions takes ownership)
-      * @param critical whether this extension should be marked as critical
-      * @throw Invalid_Argument if the extension is already present in the list
-      */
-      void add(Certificate_Extension* extn, bool critical = false);
-
-      /**
-      * Adds a new extension to the list unless it already exists. If the extension
-      * already exists within the Extensions object, the extn pointer will be deleted.
-      *
-      * @param extn pointer to the certificate extension (Extensions takes ownership)
-      * @param critical whether this extension should be marked as critical
-      * @return true if the object was added false if the extension was already used
-      */
-      bool add_new(Certificate_Extension* extn, bool critical = false);
-
-      /**
-      * Adds an extension to the list or replaces it.
-      * @param extn the certificate extension
-      * @param critical whether this extension should be marked as critical
-      */
-      void replace(Certificate_Extension* extn, bool critical = false);
-
-      /**
-      * Remove an extension from the list. Returns true if the
-      * extension had been set, false otherwise.
-      */
-      bool remove(const OID& oid);
-
-      /**
-      * Searches for an extension by OID and returns the result.
-      * Only the known extensions types declared in this header
-      * are searched for by this function.
-      * @return Copy of extension with oid, nullptr if not found.
-      * Can avoid creating a copy by using get_extension_object function
-      */
-      std::unique_ptr<Certificate_Extension> get(const OID& oid) const;
-
-      /**
-      * Searches for an extension by OID and returns the result decoding
-      * it to some arbitrary extension type chosen by the application.
-      *
-      * Only the unknown extensions, that is, extensions types that
-      * are not declared in this header, are searched for by this
-      * function.
-      *
-      * @return Pointer to new extension with oid, nullptr if not found.
-      */
-      template<typename T>
-      std::unique_ptr<T> get_raw(const OID& oid) const
-         {
-         auto extn_info = m_extension_info.find(oid);
-
-         if(extn_info != m_extension_info.end())
-            {
-            // Unknown_Extension oid_name is empty
-            if(extn_info->second.obj().oid_name() == "")
-               {
-               std::unique_ptr<T> ext(new T);
-               ext->decode_inner(extn_info->second.bits());
-               return ext;
-               }
-            }
-         return nullptr;
-         }
-
-      /**
-      * Returns a copy of the list of extensions together with the corresponding
-      * criticality flag. All extensions are encoded as some object, falling back
-      * to Unknown_Extension class which simply allows reading the bytes as well
-      * as the criticality flag.
-      */
-      std::vector<std::pair<std::unique_ptr<Certificate_Extension>, bool>> extensions() const;
-
-      /**
-      * Returns the list of extensions as raw, encoded bytes
-      * together with the corresponding criticality flag.
-      * Contains all extensions, including any extensions encoded as Unknown_Extension
-      */
-      std::map<OID, std::pair<std::vector<uint8_t>, bool>> extensions_raw() const;
-
-      Extensions() {}
-
-      Extensions(const Extensions&) = default;
-      Extensions& operator=(const Extensions&) = default;
-
-      Extensions(Extensions&&) = default;
-      Extensions& operator=(Extensions&&) = default;
-
-   private:
-      static std::unique_ptr<Certificate_Extension>
-         create_extn_obj(const OID& oid,
-                         bool critical,
-                         const std::vector<uint8_t>& body);
-
-      class Extensions_Info
-         {
-         public:
-            Extensions_Info(bool critical,
-                            Certificate_Extension* ext) :
-               m_obj(ext),
-               m_bits(m_obj->encode_inner()),
-               m_critical(critical)
-               {
-               }
-
-            Extensions_Info(bool critical,
-                            const std::vector<uint8_t>& encoding,
-                            Certificate_Extension* ext) :
-               m_obj(ext),
-               m_bits(encoding),
-               m_critical(critical)
-               {
-               }
-
-            bool is_critical() const { return m_critical; }
-            const std::vector<uint8_t>& bits() const { return m_bits; }
-            const Certificate_Extension& obj() const
-               {
-               BOTAN_ASSERT_NONNULL(m_obj.get());
-               return *m_obj.get();
-               }
-
-         private:
-            std::shared_ptr<Certificate_Extension> m_obj;
-            std::vector<uint8_t> m_bits;
-            bool m_critical = false;
-         };
-
-      std::vector<OID> m_extension_oids;
-      std::map<OID, Extensions_Info> m_extension_info;
-   };
-
 namespace Cert_Extension {
 
 static const size_t NO_CERT_PATH_LIMIT = 0xFFFFFFF0;
diff --git a/src/lib/x509/x509_obj.h b/src/lib/x509/x509_obj.h
index ff1a01739..fd972aed9 100644
--- a/src/lib/x509/x509_obj.h
+++ b/src/lib/x509/x509_obj.h
@@ -9,7 +9,7 @@
 #define BOTAN_X509_OBJECT_H_
 
 #include <botan/asn1_obj.h>
-#include <botan/cert_status.h>
+#include <botan/pkix_enums.h>
 #include <vector>
 
 namespace Botan {
diff --git a/src/lib/x509/x509cert.cpp b/src/lib/x509/x509cert.cpp
index ed5906dde..55f279c58 100644
--- a/src/lib/x509/x509cert.cpp
+++ b/src/lib/x509/x509cert.cpp
@@ -7,6 +7,7 @@
 */
 
 #include <botan/x509cert.h>
+#include <botan/x509_key.h>
 #include <botan/datastor.h>
 #include <botan/pk_keys.h>
 #include <botan/x509_ext.h>
@@ -710,6 +711,11 @@ std::unique_ptr<Public_Key> X509_Certificate::load_subject_public_key() const
       }
    }
 
+Public_Key* X509_Certificate::subject_public_key() const
+   {
+   return load_subject_public_key().release();
+   }
+
 std::vector<uint8_t> X509_Certificate::raw_issuer_dn_sha256() const
    {
    if(data().m_issuer_dn_bits_sha256.empty())
diff --git a/src/lib/x509/x509cert.h b/src/lib/x509/x509cert.h
index 982d6b845..0355bbb58 100644
--- a/src/lib/x509/x509cert.h
+++ b/src/lib/x509/x509cert.h
@@ -9,18 +9,15 @@
 #define BOTAN_X509_CERTS_H_
 
 #include <botan/x509_obj.h>
-#include <botan/x509_key.h>
-#include <botan/asn1_obj.h>
-#include <botan/key_constraint.h>
-#include <botan/name_constraint.h>
 #include <memory>
 
 namespace Botan {
 
 class Public_Key;
 class X509_DN;
-class AlternativeName;
 class Extensions;
+class AlternativeName;
+class NameConstraints;
 
 enum class Usage_Type
    {
@@ -45,12 +42,11 @@ class BOTAN_PUBLIC_API(2,0) X509_Certificate : public X509_Object
       * with the subject of this certificate. This object is owned
       * by the caller.
       *
+      * Prefer load_subject_public_key in new code
+      *
       * @return public key
       */
-      Public_Key* subject_public_key() const
-         {
-         return load_subject_public_key().release();
-         }
+      Public_Key* subject_public_key() const;
 
       /**
       * Create a public key object associated with the public key bits in this
diff --git a/src/lib/x509/x509path.h b/src/lib/x509/x509path.h
index ed2cbd592..c8575fd32 100644
--- a/src/lib/x509/x509path.h
+++ b/src/lib/x509/x509path.h
@@ -8,7 +8,7 @@
 #ifndef BOTAN_X509_CERT_PATH_VALIDATION_H_
 #define BOTAN_X509_CERT_PATH_VALIDATION_H_
 
-#include <botan/cert_status.h>
+#include <botan/pkix_enums.h>
 #include <botan/x509cert.h>
 #include <botan/certstor.h>
 #include <botan/ocsp.h>
diff --git a/src/lib/x509/x509self.cpp b/src/lib/x509/x509self.cpp
index dd4ed7e3f..f75827fd8 100644
--- a/src/lib/x509/x509self.cpp
+++ b/src/lib/x509/x509self.cpp
@@ -6,6 +6,7 @@
 */
 
 #include <botan/x509self.h>
+#include <botan/x509_key.h>
 #include <botan/x509_ext.h>
 #include <botan/x509_ca.h>
 #include <botan/der_enc.h>
diff --git a/src/lib/x509/x509self.h b/src/lib/x509/x509self.h
index c105c8457..27c30b12d 100644
--- a/src/lib/x509/x509self.h
+++ b/src/lib/x509/x509self.h
@@ -9,9 +9,8 @@
 #define BOTAN_X509_SELF_H_
 
 #include <botan/x509cert.h>
-#include <botan/x509_ext.h>
 #include <botan/pkcs10.h>
-#include <botan/asn1_obj.h>
+#include <botan/pkix_types.h>
 
 namespace Botan {
 


Test patch:
diff --git a/src/tests/test_certstor.cpp b/src/tests/test_certstor.cpp
index 6cacf431c..6359944f1 100644
--- a/src/tests/test_certstor.cpp
+++ b/src/tests/test_certstor.cpp
@@ -10,6 +10,7 @@
 #if defined(BOTAN_HAS_X509_CERTIFICATES)
    #include <botan/x509cert.h>
    #include <botan/certstor.h>
+   #include <botan/pkix_types.h>
    #include <botan/internal/filesystem.h>
    #include <botan/pkcs8.h>
    #include <botan/pk_keys.h>
diff --git a/src/tests/test_certstor_utils.h b/src/tests/test_certstor_utils.h
index d3b26f52e..ca25f4687 100644
--- a/src/tests/test_certstor_utils.h
+++ b/src/tests/test_certstor_utils.h
@@ -15,7 +15,7 @@
 
 #if defined(BOTAN_HAS_X509_CERTIFICATES)
 
-#include <botan/x509_dn.h>
+#include <botan/pkix_types.h>
 
 namespace Botan_Tests {
 
diff --git a/src/tests/test_ocsp.cpp b/src/tests/test_ocsp.cpp
index 2f6660a17..4ab1221f0 100644
--- a/src/tests/test_ocsp.cpp
+++ b/src/tests/test_ocsp.cpp
@@ -11,7 +11,6 @@
    #include <botan/x509path.h>
    #include <botan/certstor.h>
    #include <botan/calendar.h>
-   #include <botan/cert_status.h>
    #include <fstream>
 #endif
 
diff --git a/src/tests/test_pkcs11_high_level.cpp b/src/tests/test_pkcs11_high_level.cpp
index ccbe26447..6a3367eec 100644
--- a/src/tests/test_pkcs11_high_level.cpp
+++ b/src/tests/test_pkcs11_high_level.cpp
@@ -53,7 +53,7 @@
 
 #if defined(BOTAN_HAS_X509_CERTIFICATES) && defined(BOTAN_HAS_PKCS11)
    #include <botan/p11_x509.h>
-   #include <botan/x509_dn.h>
+   #include <botan/pkix_types.h>
 #endif
 
 #if defined(BOTAN_HAS_HMAC_DRBG)
diff --git a/src/tests/test_x509_dn.cpp b/src/tests/test_x509_dn.cpp
index b244478e0..6358db517 100644
--- a/src/tests/test_x509_dn.cpp
+++ b/src/tests/test_x509_dn.cpp
@@ -7,7 +7,7 @@
 #include "tests.h"
 
 #if defined(BOTAN_HAS_X509_CERTIFICATES)
-   #include <botan/x509_dn.h>
+   #include <botan/pkix_types.h>
    #include <botan/ber_dec.h>
 #endif
 
diff --git a/src/tests/test_x509_path.cpp b/src/tests/test_x509_path.cpp
index 955643f61..3adc917d4 100644
--- a/src/tests/test_x509_path.cpp
+++ b/src/tests/test_x509_path.cpp
@@ -7,6 +7,7 @@
 #include "tests.h"
 
 #if defined(BOTAN_HAS_X509_CERTIFICATES)
+   #include <botan/x509_key.h>
    #include <botan/x509path.h>
    #include <botan/calendar.h>
    #include <botan/internal/filesystem.h>
diff --git a/src/tests/unit_x509.cpp b/src/tests/unit_x509.cpp
index 9071ecb78..1ba8a26ce 100644
--- a/src/tests/unit_x509.cpp
+++ b/src/tests/unit_x509.cpp
@@ -14,6 +14,7 @@
    #include <botan/x509self.h>
    #include <botan/x509path.h>
    #include <botan/x509_ca.h>
+   #include <botan/x509_ext.h>
    #include <botan/pk_algs.h>
    #include <botan/ber_dec.h>
    #include <botan/der_enc.h>