From e1e646c6fc2d26d7cc1803f8205100d017a03e28 Mon Sep 17 00:00:00 2001
From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
Date: Fri, 24 Jul 2026 11:50:15 +0200
Subject: [PATCH] - Fix to allow test fake sha1 on systems with possible sha1  
 support. - Fix to use sha256 for unbound-anchor unit test. - Fix
 unbound-anchor check for return value of   X509_NAME_get_text_by_NID of the
 emailaddress.

---
 doc/Changelog                                 |   5 +
 smallapp/unbound-anchor.c                     |  14 +-
 .../127.0.0.1/no_more_keys.p7s                | Bin 1165 -> 1959 bytes
 .../10-unbound-anchor.tdir/127.0.0.1/root.p7s | Bin 1165 -> 1959 bytes
 testdata/10-unbound-anchor.tdir/key-setup.sh  | 201 ++++++++++++++++++
 testdata/10-unbound-anchor.tdir/petal.key     |  61 ++++--
 testdata/10-unbound-anchor.tdir/petal.pem     |  35 +--
 testdata/10-unbound-anchor.tdir/test_cert.key |  61 ++++--
 testdata/10-unbound-anchor.tdir/test_cert.pem |  38 ++--
 validator/val_secalgo.c                       |   4 +-
 10 files changed, 342 insertions(+), 77 deletions(-)
 create mode 100644 testdata/10-unbound-anchor.tdir/key-setup.sh

diff --git a/doc/Changelog b/doc/Changelog
index e9156214f..2b288c053 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -8,6 +8,11 @@
 	  and block_aaaa, and uses local-data if present.
 	- set code repository version to 1.26.0.
 	- Update generated man pages.
+	- Fix to allow test fake sha1 on systems with possible sha1
+	  support.
+	- Fix to use sha256 for unbound-anchor unit test.
+	- Fix unbound-anchor check for return value of
+	  X509_NAME_get_text_by_NID of the emailaddress.
 
 23 July 2026: Wouter
 	- Updated credits for Xuanchao Xie in 22 july changelog.
diff --git a/smallapp/unbound-anchor.c b/smallapp/unbound-anchor.c
index 93379d27f..8f84bae0e 100644
--- a/smallapp/unbound-anchor.c
+++ b/smallapp/unbound-anchor.c
@@ -1861,10 +1861,10 @@ get_valid_signers(PKCS7* p7, const char* p7signer)
 			}
 #else
 			if(verb >= 3 && X509_NAME_get_text_by_NID(nm,
-				NID_commonName, buf, (int)sizeof(buf)))
+				NID_commonName, buf, (int)sizeof(buf)) > 0)
 				printf("commonName: %s\n", buf);
 			if(verb >= 3 && X509_NAME_get_text_by_NID(nm,
-				NID_pkcs9_emailAddress, buf, (int)sizeof(buf)))
+				NID_pkcs9_emailAddress, buf, (int)sizeof(buf)) > 0)
 				printf("emailAddress: %s\n", buf);
 #endif
 		}
@@ -1890,18 +1890,18 @@ get_valid_signers(PKCS7* p7, const char* p7signer)
 		} else {
 #if !defined(HAVE_X509_NAME_GET_TEXT_BY_NID) || defined(DEPRECATED_X509_NAME_GET_TEXT_BY_NID)
 			if(!has_valid_emailaddr(nm, p7signer)) {
-				if(verb) printf("removed cert with wrong name\n");
+				if(verb) printf("removed cert with wrong emailaddress\n");
 				continue; /* wrong name, skip it */
 			}
 #else
-			if(!X509_NAME_get_text_by_NID(nm,
+			if(X509_NAME_get_text_by_NID(nm,
 				NID_pkcs9_emailAddress,
-				buf, (int)sizeof(buf))) {
-				if(verb) printf("removed cert with no name\n");
+				buf, (int)sizeof(buf)) <= 0) {
+				if(verb) printf("removed cert with no emailaddress\n");
 				continue; /* no name, no use */
 			}
 			if(strcmp(buf, p7signer) != 0) {
-				if(verb) printf("removed cert with wrong name\n");
+				if(verb) printf("removed cert with wrong emailaddress\n");
 				continue; /* wrong name, skip it */
 			}
 #endif
diff --git a/testdata/10-unbound-anchor.tdir/127.0.0.1/no_more_keys.p7s b/testdata/10-unbound-anchor.tdir/127.0.0.1/no_more_keys.p7s
index c76b5b6e4754d5bce27f78f85286159ba3e0df64..c7c33d3db24ac13ec816884fb868f72ba4510f7a 100644
GIT binary patch
literal 1959
zcmXqLVqeV0snzDu_MMlJooPW6`xJvF_6bakjE4LMylk8aZ61uN%q&cdtPBR+2!)Ib
znpmbAG_g!JXkz-kfSHMriAltR`+>;D|9?(0sWKd8JrsY+>Z)ot$Ox$6jNCvY)C~Cy
zc-WXjS(tfP3sOrGa|}fcgy2dz8O0!?26E!OMrH=)MkWT9CWc04QR2KNW(FpP22d{1
z<}@)bLUsbs7tBqJ{R{?8j9pAkjExMt{q}O&uMpMXoq6b13|o5H+pKklKVoYizt8rZ
z`l{Wo!hhxI3<DWahA?6ExeW&X|2}u<O1+!D^l^2Nsp5n6UP6JBoNmi6NH{d}es939
z#jXKUF7JQg_BguhK>D5IzWXjzPYn*RoxPUd?4sGi^X5$N1rIAfD0*}4knh8pb<=~k
zrJeVF9W3^|V`J^HScS-kuA-@NT}`?PrViTDse!+4KmVV+yK-|~p>AZN>aXRmGx(WB
zcuQEPga!!pvTtiEKGf_Y!}M5%QSOr7r?#(O4123HBjy}vw+SgPJJ8-ECcPv5pZdCW
z%+fx)os629%)5$nSzVqxe-YiEe!*nA*`EDL#R2Z#96R%spO#lF2vIkG&e^5MH2q?B
zfad9q$^iw5-+HuPTuzHy=6KKoXw9}CVY!>0zjZM*Vc!*><YoNXy6kMMlFfYmmG9VN
zT0HApJEf8>PEQOEC|L99q{;KA+*ec-B{WV4?2Q%+DbkSRVbEOE@N{$If9JThkry9-
zx+M_xjVo+16Eh<N<Ko6028~+{WP#~ImXAe@MWp0pwvE+Y70<wJ<(q=V!!PgE-{fJC
z2$EK2i86?2z^Y)O))Eb3(?t{Z#3}@`LYR^9KMRKe8<1jRWH1l_i3zfB8n8D((<V1a
zgr9|lnTe?dIdK8gH!yKEGDMts96F0t|5KKm-`pv`W9Pk(3*|}ScDbnMXV};@)%9Wc
z?867`^xwCh-Coi$HS1Du*xAG8-r@;%`wygOEyy>#=PrA5hW~Ge+pdQn>0A2#3}uj*
z!h0y&c0p3h>BI$_Y+@r1)ZNMZ(Q$2h{x#DTTS_Bx);|<2{CFj;HS6pFnFQ@?fvsXY
z-(H$vE*<L0px7ewFw$MTnVIv`^sByqChXbu;+E%2hVREeZ<_t2mQA?kfueiY+;1m0
zG=H1__XMZx!8pV1rz1P(>8>?BbEMQ<%hB?xr^C}j^RFG8zb4E~N9xOrwP&VvT@r~Y
zyxdZ?$0VTt=jJ(18f|jR>U`3-q(**Q-6L`{H~P~#XC9BR9V=x2E?acj=}y+2MTeJK
zTfgL=^3`XZ)0;f*Ox_b8pDpcR^8eeArM~(2SvJFm+;<B)^<O_*{P%J2%0-NYtf>M{
z)iHna8O8ELk_0O1m&OF<Gz&IeoX^Q6aG)ykw0vk_dP$0y<WydP>0xX(-YrpH(mqm|
zXR4(X>kXTjE&z+AGr%&;z>e4yfxGxZDghTXJ~5C$lvd1!$R(nI3_^z0kRPc4GcquW
zGSElJvKT6{C|vJ;B&~eXc=O47?ga<3KR!DVEa7@zt948DW9M&QLt--wDiIp^4RZ{#
zK*cZAEsR>o95G}LlK~eS2c*PhW;fu2vzeHf7#e`76(+~T#OPqa&c>?E$IQfzDz1T?
zsDULWOA}**u1}4|yG^ogJC_Joy2VFyX&#%ird8>5+reK_3jdBot8DhH6snN#GIN|W
zsYYds*_j>hw`=_9d;aK0h^JprLgc$wLDgT6uV4Ca`QQJ>XKorYte<6ds(;}->9=pL
zsi<}9e?IZs_1?ahp1rq{mHw|>v&hH%-Rn2*bC#V<-t(+QEIhyWTaU5M5Ah8jY91ac
zu6dMG9DOWZ>DlkQR{1jW2mIaVdA}|$R8;nGh@JbaXjbT#h#LO$UJEWKy%xwkB=r4&
zw&0}}t9?ubPrdB6I+$(VF!|({ZxbeeIbf_RGynR&NI$-1t}V{(k`ZTXSz@NO?>we0
zR<5Z(?T~`#<KK_<4zHB5Kjko?kMa19H0k2olMIt9rfi$@eM4Y*>H~&cy$KhMr)OBN
znseSiJDPpl)l@hB4@H}n`uvkUnU=CBQRZInx`aj2M}JL86kc)5=)HaOEbj$d&ilA-
zD%<ONcTdZoHB0@LXBRIxT(LG;?8KDc)ql&2?zlhF?wE5$ZuUa1^=FPqc$plYo0Sd#
D4cr4)

literal 1165
zcmXqLV(Db#)N1o+`_9YA&a|M3rOKd*rHqM@(U9AKlZ{oIkC{n|mBD};p@?xo6H}}~
z6H}x?6Jyf?W+p}^CQgQX5lY@od#3+1;Dsw>WCiL|GvqViVPg(uVHRdBNG(asF%&Tn
zf-B)<6oZHw$cghB8XFiInj0FL8kv|ziSrs885$UvK)FPl(|8}*1&pi=%#CLm3>r@|
zH6CQx@gXB|Myu6JGq2(jr4w=7Pj{<*;4J#DJL$~ke-aGymaOF~c<tPsExy(|L&f@-
z#kX1ot!2vkdVl%vXy>gxa#1cNoN3B-3GuIXrmGeUbA6al$kBNA!Kam{*2$cC9b{A2
zAQozOXSJX^&oVu(U=QC))9(K_&dt34o%^aLUupDJzHRx}n0Htx7#`Ze@uFC#m%E@k
zZkg19fO8u!b3B~7yG2(~QG{=gq<-Evn`p^3Uhc8?y|-#*ad`0=y?Fh+%j<|BClfOx
z1LI<T172WkFo(+Wv#>BTF|{E37Z~EqK#$I1u37U;;Jm@r(uGBa@~gLLeh}xr9ih@*
z?<s5enIk9dag>LfLqq3W<LT)q)03<9`Mdgl-|(*&Pn*J$m{Pht@_4gR`3}b#kNqYN
zEn4TTCf_jWGJ7<?*H`Q2t=@fYhm`}qefaoxo~!qP$U6#OSSQJHva&R+ZuU$Fv}85k
zw(4=2?*xCw36pG>HJki-AC!LOjO1a@IcI)cx~^yS#pBcLGfMX!%oW_lY}MGvHFJvN
z9>@KQJl;<i;k?;v;-l<jRuao&*u?k+n7BRwQ=x$|u~Cnl2oVW)LE{Yr2}F8hHbhRy
z1~Ld4RzrTIBxq`A7-gW0kYzCxV-aEaW%JR`!QsZ=?NN{9qPtU<`cDxws6;5@H_S1}
z0_Bv1HV?*BW)?;*WR4gzhsl78jRTVFnAr{Z;A|!)CWZ!JjKbuYm>3-l*df`F9aUTd
zIpTo{ou%<WbzsYedE&43DU=&kSyVo~z9i^6&)p48^R0fzPBv~{#>C?2@T<zi?W5BE
zHQX*KSJ_hk7{3nV_*N3IlY6V!m+}a)hV`6xHZN=RUYy3^cq;GU)a1RIJTpEU8rm(D
zKPi{0>tt8Y?|T2Vew>-2tY1^(H@{TNBU_%EtP(iLVthM2%%t=PTSOz*TF&j~a~Ce2
ztT5NVEpt83iQ50Iysw?ZQ{1;@czFdB+1pyQoy(V4)jcgdj_Fya#_YU_D!xxcx~kvp
F000?Vi{=0T

diff --git a/testdata/10-unbound-anchor.tdir/127.0.0.1/root.p7s b/testdata/10-unbound-anchor.tdir/127.0.0.1/root.p7s
index afbdb1b913884a91350aea629c445257e1f84830..b0dc637a39cf727b6b603338013de3ab33e8fab3 100644
GIT binary patch
literal 1959
zcma)+do<Kp9Kh%Io8QbdjWL8#9&N&!Xt+PdcuhjdyT)TiCPZRtDAbfBGC$8OyS0s-
zo@<!Z)~Qr#m1vDoX%>}i_M{h!*sNMATBUZJ+GWq#J*U6!{XXvZ-h0mHd;msL5Xsj0
zzWL)+hy=?qk`!R1y)Xo!G(aViWAc5Wcsv3_1RS7DH$rj@kpT?Z4>0(R91lY<tnW+d
z)<5_Dts1t(T_dR0{^WYs@{6evABRH}&4|xYZJ<TO^ANliAthcMn}q6vIsdefA^L|b
zm~Tk6X9FjD7I0yq_H2P6mBj`u6nqRnc@73u%zT387kCW%3I{N#2*w}@u5RTO^3vl5
z4C+BuS0qumeOOe5zK+W5eV*u7`n14($Ep)88-R%cj<08RG#jjX_o9$#^h{RSn-St@
z)_ul*PVm=W_dk=zs180Z;Z7*Lxzdh?!4<u0ij=|!%|Soj&L|D#E;)Rf#%^bq-*SSV
z>o%EpZ~47b71VPuOBPa-a4TRals-^+F7tZSf`}e(gZStoj2YwTVPhO0JaK>EeOz7o
z`K(lCM6Bh+_d^?KczvpvAmwrAl#pujx2kfMo4~ym(EK~Lqxr91q9qv{S07OpaKh5I
zD+`M0#+QWetg5Q;#({NS_BpUq(bi3b<paxJ8Z-!Rvt;c0hIL!HJ^{08lg<0ncF4o5
zoCe56wy>-{k-MnnoH;iocC6TDup=S*m}jH2=9-$<{7uyZ!^=??>GIlj{thqPwzows
z<doT+ct(oM_1m4d$0*LZWnVZq<<zK}HPBD_*}`ltqlJ5A4LxiNW4;z{QAKwDdCB`_
z(WfKYdq=x;1Y@)L3K$RJAcf=-ko*8lHC&i#BXmSxtWM;(KD6))u1Tv7H4N{#Vpr`8
zVyDXHhybk4{?CST>+cw!$_4h{u+EvfLJxx8BeMWev%nAz=uG8w5i%fQAK9c#WoQV3
zhvD3raB29~z$L-0zR}A&M6eqbtyp<f`X=hz=g~Z^^_1o9wkuHyR_fgoez>X8-R^l_
z+eL9<spw7#zpcqBz%a(WLAl;qo{T>7F}-(S)f<od-c7&Sxdi>m!_AdaRf$XF>vCIS
z<<*?12xZoT&94hPWyzh6$1iMKoph$hAa&&DggjB3(j>;FGdPc4JA7xalQGW^XO?Ty
z6X9c+gC~#5?gqWxTYq`5%kMYbc=L<u!+n`Vy<OdAK1D~z)Ms<X$|i4+O&g=pi!Bj*
zzGa?vY`wb8$=cK9uAfK0s;slI>=d89*y!bf)2-hW-O-Os?a19(&*Fad=lLUEjQsh>
zvI2z{;v>dR7VF>Jv}W|?GA&>JrQ@cP$0|C!9*7=PG*!B}{YI0%3as+_eKTbv^~T7P
z%0hV6WVXoad~+KS?V&tO*<&~KL^0VLdZGeKCB*A^WkkMBhUm#*>vVSPu8a&$%F)Hz
z%gD2Jlsh9@KH~)o#p~(wN~t<BK9LiUEATfCG}_pjVPv)&#o*f-EwySK2HZcDi2v8u
z3<Js~ePHgit?=kfBLb7@3IV0f6qqAh0PLo#2)Yniz*{@+(r-<OyYlOio9z=u8`SAq
z?W|>7xpI6lTKK5i8Kh4iprJ`XG^O8<Z-K052K1Q$3}zE&eK0Pb1hoIz!!V4?*3kNQ
z4Td2PKq3-swDB<M-+9JNs5Qn!Fep30L7fw~kW`Y+Jmhiz8Kb%2w!l1j+sLi_iAhLr
zWC2I<OIm$Q4<|EfBBM*icdlX%zB%GoK96cyYQ*v9D+rWQ|5OXZZjtoSV4u`y{906O
zLt4WQ8~fJQtjm;mfAN>UY_U~8b*Y*Z$Az?AE<rAm-FIF6Vpd3wc%!Lav+yaNiU>2q
zJ+5gf|8Q6DO=7RN>kDZ!v0i$%-t&w{jWQ>}`uffdo^g@P+C}zB%+DF_6HEu=#wGX4
z`-)GpPabxqc`enxR%N0vtg9KzzTlSa=d!u{``89Ghs9FGF!q<bRd(_G#VK1RYL_Nj
z78rkh=)l!x>Gl%~tmu;QX8~SnmM(a*Qs$W_sg)(4eCXsnpkL-1w9osy(9%<iZ}iRz
zbjQYRAK8Teur>8{aaYQ|QP;q9sOiP<O-bKb=aI(!OFF&#+08@dyQ(bSv0GORyXwvL
wp49G>4{_^V1<q!|$3jz7D4;Q3={@AswS*1J5Rro^9;e1TxDEF-`D_~f3z}N+^Z)<=

literal 1165
zcmXqLV(Db#)N1o+`_9YA&a|M3rOKd*rHqM@(U9AKlZ{oIkC{n|mBD};p@?xo6H}}~
z6H}x?6Jyf?W+p}^CQgQX5lY@od#3+1;Dsw>WCiL|GvqViVPg(uVHRdBNG(asF%&Tn
zf-B)<6oZHw$cghB8XFiInj0FL8kv|ziSrs885$UvK)FPl(|8}*1&pi=%#CLm3>r@|
zH6CQx@gXB|Myu6JGq2(jr4w=7Pj{<*;4J#DJL$~ke-aGymaOF~c<tPsExy(|L&f@-
z#kX1ot!2vkdVl%vXy>gxa#1cNoN3B-3GuIXrmGeUbA6al$kBNA!Kam{*2$cC9b{A2
zAQozOXSJX^&oVu(U=QC))9(K_&dt34o%^aLUupDJzHRx}n0Htx7#`Ze@uFC#m%E@k
zZkg19fO8u!b3B~7yG2(~QG{=gq<-Evn`p^3Uhc8?y|-#*ad`0=y?Fh+%j<|BClfOx
z1LI<T172WkFo(+Wv#>BTF|{E37Z~EqK#$I1u37U;;Jm@r(uGBa@~gLLeh}xr9ih@*
z?<s5enIk9dag>LfLqq3W<LT)q)03<9`Mdgl-|(*&Pn*J$m{Pht@_4gR`3}b#kNqYN
zEn4TTCf_jWGJ7<?*H`Q2t=@fYhm`}qefaoxo~!qP$U6#OSSQJHva&R+ZuU$Fv}85k
zw(4=2?*xCw36pG>HJki-AC!LOjO1a@IcI)cx~^yS#pBcLGfMX!%oW_lY}MGvHFJvN
z9>@KQJl;<i;k?;v;-l<jRuao&*u?k+n7BRwQ=x$|u~Cnl2oVW)LE{Yr2}F8hHbhRy
z1~Ld4RzrTIBxr145oMr^kYzCxV-acoa>wEPnptZa!tedv|Mlf^>0WtfgGz)Ve#0Dt
zEKp8KX!Br9WoBX2Lgt7ebC?Xc*f=1$j+xzn56)&{Vq$0j#wbjViHXs{fE|(z*-^zc
zkRu+L&{-M}$l88oEc#`);JK<3gW=b6#vMM#yRSYxt6UIdZ1^YNc74muJ(5-F(Q3C8
zr^UA0KPbAQY#AT&d%IfYH}l+I?t&h-?w|8uI#}>&$|9Gup}yC&e=ghf*ve4Z(){nu
z<rnPsF7CT{a5AHAndsavtIqRi)ZcfFJXZ14Ie4zIp22se;;)NV&X%3)!n>PYHM-`o
zah8%v(#*Mn7J7UsZ1t~f=f1ueGke;a+Xm*w3l5td;kYXH=Rk<V({pomlTuDR-CR^9
H8hjZ5!qJq^

diff --git a/testdata/10-unbound-anchor.tdir/key-setup.sh b/testdata/10-unbound-anchor.tdir/key-setup.sh
new file mode 100644
index 000000000..7e37c62b9
--- /dev/null
+++ b/testdata/10-unbound-anchor.tdir/key-setup.sh
@@ -0,0 +1,201 @@
+#!/bin/sh
+
+# run in temp dir.
+# Then for petal, move into basedir.
+# For test_cert.key and test_cert.pem, rename the output files to that.
+# And run signit.sh for both signature files, by commenting infile and outfile.
+# for test_cert.pem it has emailAddress and keyUsage, but petal.pem does not
+# need that.
+
+# settings:
+
+# directory for files
+DESTDIR=.
+
+# issuer and subject name for certificates
+SERVERNAME=petal
+CLIENTNAME=petal
+
+# validity period for certificates
+DAYS=7200
+
+# size of keys in bits
+BITS=3072
+
+# hash algorithm
+HASH=sha256
+
+# base name for unbound server keys
+SVR_BASE=petal
+
+# base name for unbound-control keys
+CTL_BASE=petal
+
+# flag to recreate generated certificates
+RECREATE=0
+
+# we want -rw-r----- access (say you run this as root: grp=yes (server), all=no).
+umask 0027
+
+# end of options
+
+set -eu
+
+cleanup() {
+    echo "removing artifacts"
+
+    rm -rf \
+       server.cnf \
+       client.cnf \
+       "${SVR_BASE}_trust.pem" \
+       "${CTL_BASE}_trust.pem" \
+       "${SVR_BASE}_trust.srl"
+}
+
+fatal() {
+    printf "fatal error: $*\n" >/dev/stderr
+    exit 1
+}
+
+usage() {
+    cat <<EOF
+usage: $0 OPTIONS
+OPTIONS
+-d <dir>  used directory to store keys and certificates (default: $DESTDIR)
+-h        show help notice
+-r        recreate certificates
+EOF
+}
+
+OPTIND=1
+while getopts 'd:hr' arg; do
+    case "$arg" in
+      d) DESTDIR="$OPTARG" ;;
+      h) usage; exit 1 ;;
+      r) RECREATE=1 ;;
+      ?) fatal "'$arg' unknown option" ;;
+    esac
+done
+shift $((OPTIND - 1))
+
+if ! openssl version </dev/null >/dev/null 2>&1; then
+    echo "$0 requires openssl to be installed for keys/certificates generation." >&2
+    exit 1
+fi
+
+echo "setup in directory $DESTDIR"
+cd "$DESTDIR"
+
+trap cleanup INT
+
+# ===
+# Generate server certificate
+# ===
+
+# generate private key; do no recreate it if they already exist.
+if [ ! -f "$SVR_BASE.key" ]; then
+    openssl genrsa -out "$SVR_BASE.key" "$BITS"
+fi
+
+cat >server.cnf <<EOF
+[req]
+default_bits=$BITS
+default_md=$HASH
+prompt=no
+distinguished_name=req_distinguished_name
+x509_extensions=v3_ca
+[req_distinguished_name]
+commonName=$SERVERNAME
+emailAddress=$SERVERNAME
+[v3_ca]
+subjectKeyIdentifier=hash
+authorityKeyIdentifier=keyid:always,issuer:always
+basicConstraints=critical,CA:TRUE,pathlen:0
+subjectAltName=DNS:$SERVERNAME
+keyUsage = digitalSignature, keyCertSign
+EOF
+
+[ -f server.cnf ] || fatal "cannot create openssl configuration"
+
+if [ ! -f "$SVR_BASE.pem" -o $RECREATE -eq 1 ]; then
+    openssl req \
+            -new -x509 \
+            -key "$SVR_BASE.key" \
+            -config server.cnf  \
+            -days "$DAYS" \
+            -out "$SVR_BASE.pem"
+
+    [ ! -f "SVR_BASE.pem" ] || fatal "cannot create server certificate"
+fi
+
+# ===
+# Generate client certificate
+# ===
+
+# generate private key; do no recreate it if they already exist.
+if [ ! -f "$CTL_BASE.key" ]; then
+    openssl genrsa -out "$CTL_BASE.key" "$BITS"
+fi
+
+cat >client.cnf <<EOF
+[req]
+default_bits=$BITS
+default_md=$HASH
+prompt=no
+distinguished_name=req_distinguished_name
+req_extensions=v3_req
+[req_distinguished_name]
+commonName=$CLIENTNAME
+[v3_req]
+basicConstraints=critical,CA:FALSE
+subjectAltName=DNS:$CLIENTNAME
+EOF
+
+[ -f client.cnf ] || fatal "cannot create openssl configuration"
+
+if [ ! -f "$CTL_BASE.pem" -o $RECREATE -eq 1 ]; then
+    openssl x509 \
+        -addtrust serverAuth \
+        -in "$SVR_BASE.pem" \
+        -out "${SVR_BASE}_trust.pem"
+
+    openssl req \
+            -new \
+            -config client.cnf \
+            -key "$CTL_BASE.key" \
+        | openssl x509 \
+                  -req \
+                  -days "$DAYS" \
+                  -CA "${SVR_BASE}_trust.pem" \
+                  -CAkey "$SVR_BASE.key" \
+                  -CAcreateserial \
+                  -$HASH \
+                  -extfile client.cnf \
+                  -extensions v3_req \
+                  -out "$CTL_BASE.pem"
+
+    [ ! -f "CTL_BASE.pem" ] || fatal "cannot create signed client certificate"
+fi
+
+# remove unused permissions
+chmod o-rw \
+      "$SVR_BASE.pem" \
+      "$SVR_BASE.key"
+chmod g+r,o-rw \
+      "$CTL_BASE.pem" \
+      "$CTL_BASE.key"
+
+cleanup
+
+echo "Setup success. Certificates created. Enable in unbound.conf file to use"
+
+# create trusted usage pem
+# openssl x509 -in $CTL_BASE.pem -addtrust clientAuth -out $CTL_BASE"_trust.pem"
+
+# see details with openssl x509 -noout -text < $SVR_BASE.pem
+# echo "create $CTL_BASE""_browser.pfx (web client certificate)"
+# echo "create webbrowser PKCS#12 .PFX certificate file. In Firefox import in:"
+# echo "preferences - advanced - encryption - view certificates - your certs"
+# echo "empty password is used, simply click OK on the password dialog box."
+# openssl pkcs12 -export -in $CTL_BASE"_trust.pem" -inkey $CTL_BASE.key -name "unbound remote control client cert" -out $CTL_BASE"_browser.pfx" -password "pass:" || error "could not create browser certificate"
+
diff --git a/testdata/10-unbound-anchor.tdir/petal.key b/testdata/10-unbound-anchor.tdir/petal.key
index 6614e498f..7daef6ab2 100644
--- a/testdata/10-unbound-anchor.tdir/petal.key
+++ b/testdata/10-unbound-anchor.tdir/petal.key
@@ -1,21 +1,40 @@
------BEGIN RSA PRIVATE KEY-----
-MIIDfQIBAAKBwQC1xQ/Kca6zszZbcCtdOTIH2Uy2gOy/DfabMUU7TmNPm0dVE0NJ
-RuN+Rm304SonpwghfP2/ULZNnuDgpG03/32yI7k/VzG6iA4hiF7tT/KAAWC/+2l1
-QCsawCV2bSrFK0VhcZr7ALqXd8vkDaQ867K029ypjOQtAJ85qdO3mERy7TGtdUcu
-O6hLeVet419YeQ2F8cfNxn63d7bOzNGLPW5xwaCd3UcgD+Ib0k4xfFvbinvPQUeU
-J/i4YDWexFYSL+ECAwEAAQKBwCLXXQl+9O+5AEhSnd1Go1Jh0pSA7eBJOuXQcebG
-Rb7ykp+6C4G2NtDziwwPRNdI6wQQQ0sym18RfyVQHydGr78/nbiIbB3HCn5e92Mh
-mefzW6ow9Kvm2txLzGKA1lvoyRbNm81jnG/eygi3u7Nqd5PNv+4dHj2RkTlmxOeh
-qnDMVP5md8uZPv6lYNnrnIzvLCR5vnPNdVwn89AqzI85IcDZdy0R9ZX4NBbsDgAU
-6ig6uXuRXvSGiyJ/OUXSrnogaQJhAOjvkHUhVZQkPOxO90TNH4j0GdKKtbSWxIdz
-lKfuJeBAEqs0TL+C6vbS81Xw3W1alyDdUBk3rJMOBqW6Ryq5HNL+j5H+Jfsh7fvc
-Yle+5wHGci0P9zCFZCrY8It7n9XFIwJhAMfEi6oJa2G8waPJ1bQhxka82Tf9pnKM
-XCn/1BBOFjVIx5F842cpA+zp5a62GENTGYPQTTRBB/2/ZwnW5aIkrlg54AtmbqBZ
-Oh+2kJdJQD/tfoVmc5soUE2ScTHadK5RKwJhAN4w9kjkXS+MSZjX0kIMsBIBVkhh
-C+aREjJqa9ir7/Ey7RvmLXdYuCxtGLRXp7/R8+rjcK49Tx6O+IRJZe042mfhbq3C
-EhS1Tr86f4xXix9EXlDhs9bSxrOgcAN9Dv/opQJhAK7eBcPaav0rVfYh/8emqQHS
-3fJ9Pu6WnzbEksWTFS2ff9KDGCx9YspIFJ5TF/oXDAaumGZdZrlgirm6O1kr8tGY
-F97i04PZl1+bWAaWQH+1TUNI43m2WFUPE7coG2tb8QJgcddDg9VlXliZqgcETZfJ
-kJmYETxrcSn3ao6v116N8yxhEgUgjkmsCTiFgx36iDVnXwK6PIt+sIu8MC7eYNa3
-berrv/M21K0LRn20IWRxvUobG070weHCAgkko7fTWgr2
------END RSA PRIVATE KEY-----
+-----BEGIN PRIVATE KEY-----
+MIIG/gIBADANBgkqhkiG9w0BAQEFAASCBugwggbkAgEAAoIBgQDiNGqbEmyFI9QF
+EvWcU36irjzp1W+VMuMHGD5PDYy5ib1QIrUcUQPvWydV4er/6gnpv6VQ+dfOeVlr
+Acu73kdh+N0u5UgjIY9CJnoN12eEGjTrVFlHoA2Ur/TMbN3DW20Nbyi5LUJ8KrGl
+Yg8tPbLqGvfJsIYTspBEzgQcJg5ZTD3YA2ZESrbZe2sOunri0j1myv+EoTqB4nPb
+ShHx8i11IJpUoBEoHoSyMQgEgYJqbmqCHaTGJWNxHUUhI5MmTPEzyrG6T0B3v5Pb
+y1eFOyAU+I4SCs0fqHPg4DbPlNTe/MEBm2LQAVrUFjcFx+Cq75oOa9sVp6xvBmYN
+nMiwGgLJYjN7l0lhRQEtao6tEGQUYbmpKoLQJMsKs6bjs6HK5TXMzQUfHATirmjE
+C1Fcb/eKJ27HNiKS+uw2g9Tpu/af2qKl3ePNUioPbMYtgGhu5csD22heGeilNVtN
+8D47kU0SveXjokV476CecW0SZnN9rVrvd0IqtnU9fMoAQyZE6ScCAwEAAQKCAYAk
+0//fS3qbmp+0S8ftMbLWbaPBNly6X9SSnSHX4Q7eTkyiNWRjPdV0LNUUqHmIPORs
+SCV0L5kxJpSmVV6EMcZRbyEjt3StM5ONY5JPmphh65peDheTD73mTVd/yOG6IrJ4
+k3Z/35yJdrIBiRuLdBYjA00Aa1sI7fOLIDePFasUYtNWzgbia3+lnPBrL3U+ZJhW
+mgpL36wU5XeTZlXRnGpGPY6i5ISmkYFtOYpioWtIRL3WfVkMYZ31FpzgrlgQzknQ
+lrKN2g7/3q0uLlbasgCsAK50hL2f2xxzsALDCGFjDJbwdIZKfdoxRbgS0L7q7gj0
+SUK4fc1obR5qHc2lTuCSzPpionq022ElC0DChupiosyXN4GxNZ2Dwoln4Y5s2YXo
++VTtyYbVEib15WbhHorvfg0QUO00Nwqu+LVTVUXueNre2n507fSiOhCIpbPUWDGz
+RoeRFEP0T9+mzQgXr56TAiYunIat1qVxXrwaSWSXEfInGUTkdRUC4rctv7KJ1nEC
+gcEA8jDTh1OLBG3/JkQxQNOoqFUFssPlJ+z3LcyaNT6bM5lH5Vwn3sGOFWOMLILD
+f/qbGG/1VPVfoCEY1NEkYsocOMtkLIJrIdtD5DOnWz1JJE7Zh2AoWWfIfXd9v5sh
+m1fB3SVa6D9JtGoDnKttMl25Tqf6YehVo35Axxar74k3kC/vuZrp/81iZscdRsyK
+kQh9fPXl4Oqw2cUYdx3L8UprLS4JguvR0zXvbukJ75DjLZELvjnxBbA1vdtyQz58
+2uk1AoHBAO8aP5h08kwTIJCXS6uyAJ0F8F/30srAtchSpzsC3YEEs/Z+43D7W1RR
+Obw4KhVjjmFeh83U8pdEuUEjv3ua52+uoUCqTywe+o180owiWsTDSXVtDHiUD7bu
+x+nRnpk3flZD28GHKLdWMmJvd8DzMgsa9fJIucMYT7xQHzxCW+4nhhBckX9LEH7i
+Jo6MaVuh8b6NuZXOBgU3cp20GTZ3SwRNkKOigctQVZT4A1Vf4ioLrVyhv/LVLBC+
+UvoIu82wawKBwQDakMXU8sgaj0ocNp5caqdigphJ5BACIBBR/LuOIZnezw3bJ3ez
+x+l51ATEhp33+SnOu/sjWO2bjULjjHrRzKP7fVJB+NDGFSMH5rW52W0Qnzggu96u
+EMMWt6d8K3wAvQnvka6gubzCXIo18V7yfTKmkWGcyhe/HElJYmR4H9VNAnXNgsh6
+Wdfb+QWqxxymFotpImD6wdIoNX8GwJU0hHyEoW9j/320ppAV/6k/0fmzPZrjaVbi
+U0uss0ZC+TmkNaECgcB9L6gGYYyOyiDts1k6LvtlOzvMc0uZPmau2J+YJPrmVxkG
+QQ9CE0iRD+oDowBdrH9aeYzu9sSA8Mlx0o6p38O21J625bSILDwQoj72gfI2PO0U
+HyE9bIABzmk7AbZhEA4Eiojffa2St/2vTh9MFcioydfln7Aq9mqg9O41taS+P1FQ
+9bZ0CFA9rphzYA61nEee9kMprPG3/3zyFt5whuru+NF261m7onb8hRHxvD8EtpJx
+AnsmX/gvWAbHxJTXr7sCgcEAp6QAysy0/sgRYvzBkqv05kz4xBqy2a4ZKjnMLEWY
+7MicZiQrkSsEjMNDy20rjXfZbhDJWGVjBOZ1QsYehKhGAIoORXID9B3aZ32m//VU
+IUxkLcrIPLPmfdzZvlRPnQc/TAZNe41BGBa4WlDwTFE9TdpVtTzjW1ac5yBN7sa+
+V7YbBSiOhP+NuqQFQM01aaZCmOetcj70B4SwJVzswhITS0O+7ZAvicGJiQKTUvUY
+ijWm+Luu3QYDc2HBMwUAmHT5
+-----END PRIVATE KEY-----
diff --git a/testdata/10-unbound-anchor.tdir/petal.pem b/testdata/10-unbound-anchor.tdir/petal.pem
index 19c8b895b..d069d3c11 100644
--- a/testdata/10-unbound-anchor.tdir/petal.pem
+++ b/testdata/10-unbound-anchor.tdir/petal.pem
@@ -1,14 +1,25 @@
 -----BEGIN CERTIFICATE-----
-MIICFzCCAUACCQDO660L5y5LGDANBgkqhkiG9w0BAQUFADAQMQ4wDAYDVQQDEwVw
-ZXRhbDAeFw0xMDA5MzAxMzQzMDFaFw0zMDA2MTcxMzQzMDFaMBAxDjAMBgNVBAMT
-BXBldGFsMIHfMA0GCSqGSIb3DQEBAQUAA4HNADCByQKBwQC1xQ/Kca6zszZbcCtd
-OTIH2Uy2gOy/DfabMUU7TmNPm0dVE0NJRuN+Rm304SonpwghfP2/ULZNnuDgpG03
-/32yI7k/VzG6iA4hiF7tT/KAAWC/+2l1QCsawCV2bSrFK0VhcZr7ALqXd8vkDaQ8
-67K029ypjOQtAJ85qdO3mERy7TGtdUcuO6hLeVet419YeQ2F8cfNxn63d7bOzNGL
-PW5xwaCd3UcgD+Ib0k4xfFvbinvPQUeUJ/i4YDWexFYSL+ECAwEAATANBgkqhkiG
-9w0BAQUFAAOBwQBBkX9KDP2RXbg+xPmdJ4P6CwvA5x1LZwC++ydVx4NlvT0pWicD
-ZUnXjcWAJlkeOuUBAqFG7WHTrXpUUAjmdqFVq2yFjteUYBdrFz0RDB2jM9feeKYO
-mTgxdZyT9a6humxCxt5VfgT02axLjm/2AqCyFPMbf4PASoJDln01AEuZLZ8Xl2gV
-bYHMnHTGoD1Hu6FNEzRgkMC6XT8X3YjHvzQhpc/qL5wEfEsinQGdX4twsuWbf8xd
-q7miNnkO8vd0maw=
+MIIERDCCAqygAwIBAgIUY5FZe4tAZd0ITNbceavVGLvEe2QwDQYJKoZIhvcNAQEL
+BQAwEDEOMAwGA1UEAwwFcGV0YWwwHhcNMjYwNzI0MDkwNTMyWhcNNDYwNDEwMDkw
+NTMyWjAQMQ4wDAYDVQQDDAVwZXRhbDCCAaIwDQYJKoZIhvcNAQEBBQADggGPADCC
+AYoCggGBAOI0apsSbIUj1AUS9ZxTfqKuPOnVb5Uy4wcYPk8NjLmJvVAitRxRA+9b
+J1Xh6v/qCem/pVD51855WWsBy7veR2H43S7lSCMhj0Imeg3XZ4QaNOtUWUegDZSv
+9Mxs3cNbbQ1vKLktQnwqsaViDy09suoa98mwhhOykETOBBwmDllMPdgDZkRKttl7
+aw66euLSPWbK/4ShOoHic9tKEfHyLXUgmlSgESgehLIxCASBgmpuaoIdpMYlY3Ed
+RSEjkyZM8TPKsbpPQHe/k9vLV4U7IBT4jhIKzR+oc+DgNs+U1N78wQGbYtABWtQW
+NwXH4Krvmg5r2xWnrG8GZg2cyLAaAsliM3uXSWFFAS1qjq0QZBRhuakqgtAkywqz
+puOzocrlNczNBR8cBOKuaMQLUVxv94onbsc2IpL67DaD1Om79p/aoqXd481SKg9s
+xi2AaG7lywPbaF4Z6KU1W03wPjuRTRK95eOiRXjvoJ5xbRJmc32tWu93Qiq2dT18
+ygBDJkTpJwIDAQABo4GVMIGSMB0GA1UdDgQWBBSLQ6cvFrU2JiedggRXjiUemV3h
+QzBLBgNVHSMERDBCgBSLQ6cvFrU2JiedggRXjiUemV3hQ6EUpBIwEDEOMAwGA1UE
+AwwFcGV0YWyCFGORWXuLQGXdCEzW3Hmr1Ri7xHtkMBIGA1UdEwEB/wQIMAYBAf8C
+AQAwEAYDVR0RBAkwB4IFcGV0YWwwDQYJKoZIhvcNAQELBQADggGBANj5PXClrk76
+UddT6aniB/VbErfu1MwfyYSGhE4y5VVJVyD+wHYECswdm2IIo/v/4I+4KWgAcGPk
+u+j1B2iXN8sQTe500+KMSRFfaxdbwlX42+oDKwRoz8pwMzETyZYQA4PAE5j2rnjb
+n9USomWzvwavo7GRE6VauBcSAekrNFDjPw43tElmr2TTz4lUFXlvBlQvcbloJ4OU
+60ek8d1erlsLXzAtf4kCFH1aiII0g0fA448gnIOIgT9LiV88smKNDPVqusw9TBd5
+/f1R8ETy7jcIJ9TU34dy6S39s4aUjWUAZMV1TIH3wJPDsE6+1yD5OC5b50akIwpJ
+jO9naDRvgaHIWxJRcREXd+H7IlybL+l+Qq4L4RX583cdL/rZEWdnESgbDq7EkEPn
+ZbpjdM4oNGUlXsrZw0/GFgzYlN2MBFiLht6y2iBbhFxPb2SM3Xx/M5YnsNLym+I/
+m9mck/aeeSEyJ2uIfFfVndfPfqmKxwvoPu0OCv/ppsi+xTvhE6B/UQ==
 -----END CERTIFICATE-----
diff --git a/testdata/10-unbound-anchor.tdir/test_cert.key b/testdata/10-unbound-anchor.tdir/test_cert.key
index b860b1b29..484b8d9d0 100644
--- a/testdata/10-unbound-anchor.tdir/test_cert.key
+++ b/testdata/10-unbound-anchor.tdir/test_cert.key
@@ -1,21 +1,40 @@
------BEGIN RSA PRIVATE KEY-----
-MIIDfAIBAAKBwQC48GhhmIU66TZKc3QiyF4L5bsm8Aly/y2SzLP+GACepK0OcOtD
-i2sXrTtoJDvGOPZ9ICqmIy8u/Q/cK26txNEeZFcClLcYF/U+NaqjEwrwkHEIgc3g
-8qnKrhzM61I8foAWVT7cqxFHDKYuClNITXk1i//Yzpnf9wvVKQ51W9UOtm/WA7g4
-IDHCuAjocyyNC3B7XqYawFDOsdMI4ZW7hC0hIRQOvBkvbvY8WxmsSkdd30u1KmoI
-Sg4y6OvnikrEEQkCAwEAAQKBwQC3hQlv37RF82sGkm8qnP6Ge+AuEYCu9v44cJ4k
-hZkH1I5OiEtN6anKAwOyolIWsCwZmrP3zW5jCIiWiRr5oReLOzMEwqK2a//XTdYY
-oSr38b3ZHUY59VP8Zq75woMGuNed35kAmGxzDRP1gI/TmvTvaHlqYyvxBtxnZJij
-Za1CrT+a9JvR6hI8xXrE33CF0T6JO1v3v0HeBuve5+83cCHKo+GyqIBjL3FJgefZ
-EsPz6rGnPDKTYgMyaljFV3LI5ikCYQDlaBnyiWk1C7tYO5x3CRoHoiuiiREZCncK
-QkSxjiDoSP0rc+3BQp2kG3yy6S9mN4qMQPELEtBa6bORogxNK+Pxg8TRI/+xgeFt
-bod5Bd4pfl6Y5hXm21JwELFlOzPI3PMCYQDOYK6Z7vegiOJyyAJXMjcI07H8S0Gr
-SZW8f4tHRzO+RrRpR5ANzarELX7nF/Qj5mPXiZNiiMDGocxqkNzIa5HFLOqBhRkv
-o7yC1Cj582dUBFHyEbsZxR6UMTPLdE3UaRMCYACC1Nv3dmaJ2ib+KwEQ4h/2Ooao
-K4OUxGMfdqu2l1gtIXNBVNxDW7qL3SFA57wgj4x0cJUHu7MYJjBC3igl2uIk2wFk
-RSOOGIR35JFec/o/r9JDYPUcs/hP8TU6hokCBQJgHbH/rZqa+vh3TPjGjXFmRdjg
-JWNWwaTG7OaVTd5K7bgSwYtQiQvs5Gl/dxUVRg0ilKLxGB6BTpN9bGAHxLbltK9v
-1s8l/praxyBr/PsvBQHSILi4aU7ZxY0G3OGRSV0NAmBx28Msdgc0yHh3qSkbwVEr
-gr7av1iOH73ee+o4CmMWXYUBHOMW5Su0s0QHjNGDMiRiRoCvzYqdLcJj9/sFJxOT
-CM35WGGeKDMNubX7C6YroQ91q7kUmhi7HHY3QOyhCDU=
------END RSA PRIVATE KEY-----
+-----BEGIN PRIVATE KEY-----
+MIIG/gIBADANBgkqhkiG9w0BAQEFAASCBugwggbkAgEAAoIBgQC7Tr0JP6gVKA2Z
+wtpcBmd27WquMfhdfePva0mV6oc+eE+py2gwHBUAVhMnnYAwT/7ziC0a7pel43tS
+NSHgr0oSUZJC2x+gYMKZ341Q+qNFUJTTv+hG41uKwGfcx02+0HuVU1A9m60PNtE2
+oc83Au8RwyPgcuzWwk3hmX6XUrZmz0vrUxbniLF9xl0gWeFFFWVeioItYDVAKxtl
+Ufrb5/9ju3mzfnEtWWEl+qfraA8DFA10BZRVUBKNB7aGc8KDRBwC4yQBHtIu8ob1
+9DGNe2lYnMCHPFR3dsCHjBYbuGf+J66uAxtMu0IygwI3inNtBUTnQ/QVv2fQNJc2
+vL9ic1BHSwi5byPld3igVCc35wmKLgKX0WtQKcuxI1BwYfaMK+jTZl6mQcE4AuMk
+tvhWbbLn7UQxNAe6X2JKM/M7ds1dIjyfL6nuB1yESX+FiRpjOMuRV1BwrPLJNOfl
+C9QkIRgoy1C9WxZUcigeDAApooDls4H/Q16tWdHj8toQWvYKVqMCAwEAAQKCAYBF
+/w+/pA1BEr26Z0nIuA/0Lpb+T+g7r+79Kr/OCV3PJ5DFqCDgUa47eO8hj8c2xr5E
+7e/FL8J2GMOeHgLx/y+UFu2slEyGV4KBlDwwNenL3mgvlXjM/OvZtztZExXnp+t3
+CzJiQ4nxtI+Mdf2E1lDW93Cx0ODXBLesBft7u0o0s2TwpRVbIwcJNJbanxwDABLo
+uKQbJuffefx76Z3wjgsvjwDU5fyPcOZQFhKoczOg995rLCaZlxnHoElCh4H6Ifod
+K9LQAERjLicBtSThAuO+0us353y3dJ6lY3iYsi2u69UBcvFSepzKjFsx/FPv8B8N
+QMmwpfEZvB4ODM7VvZkvmQZcN3HHopRJWVFWkTkCX5A0RXCXO+AaQV+AVJWnGCxj
+dyV6L1qBK/HsyOto9KGIHN1VFj+n4hTthNPWkDE7CkA7gAMomNvmlf6zNOrbwzro
+LznDK7OQC5Qqoge0R+u/l2xgqzIl8hl5jtmwhi6kT47HBBQ1dBKa6M4rNIFRr9EC
+gcEA9CTQHdAax7XcoeETto/TMKKfv0QyfIivscr250/87GNjzsKCK2MxHZ50jmtF
+7Q7iYhepRuvhbvF9h4BwK7fUbi/KQAW4qiVxqi+MfQkoVYdvnLgekhdmnrThqWmf
+p4ZTZ0tBe29m713WdozHZv6nNcyIrt0JXrVvIFDDpil/6ETHa+y6OMiePc8gklDD
+VVCwKpq+F+taFBzfgqNHkdnaMlP/I/35KEQyhV07aLJhR1leExoGkmc7eaK6WqVD
+iQqZAoHBAMRnVukeUNiSPZmC3IyyfD8iMXnjyPmb/+a9LmwaVOs4yjdBUmGTx+ZV
+mnDb94d3ijyshysbjCc8ebZ7FxuXoaIJ7JWYOgTeMJs1JOAoEVsHBtd1W/RpQ8Hr
+NegSwP4cmCzXAQOtenZnCC2QveHlngxk7rUiayj7G4awrJLtyW9Z9WAUokm810Nq
+muUXhHxRobc40H65+qyCuPODKz3wO4Lt5VaYd4vR+wkUFc0IghmRX0HVlVe/q9gA
+JgXwRPfMmwKBwDWRzkh8XSPs95hddqHcNQ664CproFhK9aIhUsO2fVyxAjlf3IgA
+n8pL9m85goJdfbbgUjhJkZFyU4Tj3bj6ARacTdh2aOqMhMA+5qiY1czOhuLwU2Ti
+1ZWFQu6VSn7Lrok/rgKTkxZ6lJA2m5oxziaz1lnoDiJF1ThWAFf5SyN/0/IOY14K
+Rw5w4Ei6h+G0brMqeQNulLlNDI3xncaW8pWQcK9JDt6S+DLjHiH+4fFx3n56e26s
+UBSEbDdvg74SIQKBwQCrCRM2j5/3+eKK/Nrz67snf692Zlduh9uiJL14hrXM4fe3
+hrsnHnrGq2WDQwucfQ11KQnNEIBM6u1TbH4DGVk4s0vEOnzMIHJTt0QVsM7sZoIe
+v6UEg2buSNb48tv+bwhWhCXt/fTXh4InrBSv1DZ+tKbsNrz7QzIFaXXfvhPdVInK
+0i1B6aHMo9mgB4roeG5MEL4AnhUehfhql5/goIQy0NkXQE9bA9GJZmRV2ULy4RYD
+TuxvLguIXxi9sy9cXGECgcEA2MCZvKU9hml/4n1/dEiNvSGEA9rz92Vzsb50yeRM
+3yLTaYe5koVNbag+IpqpCNP4T2xNnWIxv7ceqB78wxWykadF0z5T5I+/HBPYWLms
+mpQPr7grVqcX5gqxJoUwWwxvKLwh5KjqjRX43turXOWlsSHMVNH6KMLt1K3OtArs
+OMROcUcXBJc2hvr+YBeHOpIC1ZlawIr5BRi2FICN7TeIiE3h7VFY0ucAyOOKvfH9
+FzIeEhSTR60ZN1HtILhRJmjG
+-----END PRIVATE KEY-----
diff --git a/testdata/10-unbound-anchor.tdir/test_cert.pem b/testdata/10-unbound-anchor.tdir/test_cert.pem
index 6e588a4ab..5a7c3c266 100644
--- a/testdata/10-unbound-anchor.tdir/test_cert.pem
+++ b/testdata/10-unbound-anchor.tdir/test_cert.pem
@@ -1,15 +1,27 @@
 -----BEGIN CERTIFICATE-----
-MIICWTCCAYKgAwIBAgIJAN5YIkuCvJf5MA0GCSqGSIb3DQEBBQUAMCYxDjAMBgNV
-BAMTBXBldGFsMRQwEgYJKoZIhvcNAQkBFgVwZXRhbDAeFw0xMzAxMTcxMTUyNDVa
-Fw0zMjEwMDQxMTUyNDVaMCYxDjAMBgNVBAMTBXBldGFsMRQwEgYJKoZIhvcNAQkB
-FgVwZXRhbDCB3zANBgkqhkiG9w0BAQEFAAOBzQAwgckCgcEAuPBoYZiFOuk2SnN0
-IsheC+W7JvAJcv8tksyz/hgAnqStDnDrQ4trF607aCQ7xjj2fSAqpiMvLv0P3Ctu
-rcTRHmRXApS3GBf1PjWqoxMK8JBxCIHN4PKpyq4czOtSPH6AFlU+3KsRRwymLgpT
-SE15NYv/2M6Z3/cL1SkOdVvVDrZv1gO4OCAxwrgI6HMsjQtwe16mGsBQzrHTCOGV
-u4QtISEUDrwZL272PFsZrEpHXd9LtSpqCEoOMujr54pKxBEJAgMBAAGjDzANMAsG
-A1UdDwQEAwIChDANBgkqhkiG9w0BAQUFAAOBwQCaA3ys5hDPMNV1oXIxH6u2KfAX
-C9tYJId/SR0x8whsZuNaSEZAgImdM5dnyWdjey8Pio772E9/F2aUBGFkdadZx4My
-d7hBfEi/NECEKs86k9g0ijbin41NKtnajb6GwyNQ9vDx7Z5FS8BZ3CD0BZIdCQUE
-gKuDSWBROQU3tqrjdk2QTwGQkj2mgzT871Jn1MwZw0mczPjS1y469Ejym8wi3uCd
-EboDOoGBCpmUQbxBv6JI75cUCdmNNEwjQjZ0XQw=
+MIIEkzCCAvugAwIBAgIUSAvgFLH//MkCJQDFBcJfyjrVJYswDQYJKoZIhvcNAQEL
+BQAwJjEOMAwGA1UEAwwFcGV0YWwxFDASBgkqhkiG9w0BCQEWBXBldGFsMB4XDTI2
+MDcyNDA5NDEyNloXDTQ2MDQxMDA5NDEyNlowJjEOMAwGA1UEAwwFcGV0YWwxFDAS
+BgkqhkiG9w0BCQEWBXBldGFsMIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKC
+AYEAu069CT+oFSgNmcLaXAZndu1qrjH4XX3j72tJleqHPnhPqctoMBwVAFYTJ52A
+ME/+84gtGu6XpeN7UjUh4K9KElGSQtsfoGDCmd+NUPqjRVCU07/oRuNbisBn3MdN
+vtB7lVNQPZutDzbRNqHPNwLvEcMj4HLs1sJN4Zl+l1K2Zs9L61MW54ixfcZdIFnh
+RRVlXoqCLWA1QCsbZVH62+f/Y7t5s35xLVlhJfqn62gPAxQNdAWUVVASjQe2hnPC
+g0QcAuMkAR7SLvKG9fQxjXtpWJzAhzxUd3bAh4wWG7hn/ieurgMbTLtCMoMCN4pz
+bQVE50P0Fb9n0DSXNry/YnNQR0sIuW8j5Xd4oFQnN+cJii4Cl9FrUCnLsSNQcGH2
+jCvo02ZepkHBOALjJLb4Vm2y5+1EMTQHul9iSjPzO3bNXSI8ny+p7gdchEl/hYka
+YzjLkVdQcKzyyTTn5QvUJCEYKMtQvVsWVHIoHgwAKaKA5bOB/0NerVnR4/LaEFr2
+ClajAgMBAAGjgbgwgbUwHQYDVR0OBBYEFHTJazw63SRJUbZ3slMXV9O9L7JIMGEG
+A1UdIwRaMFiAFHTJazw63SRJUbZ3slMXV9O9L7JIoSqkKDAmMQ4wDAYDVQQDDAVw
+ZXRhbDEUMBIGCSqGSIb3DQEJARYFcGV0YWyCFEgL4BSx//zJAiUAxQXCX8o61SWL
+MBIGA1UdEwEB/wQIMAYBAf8CAQAwEAYDVR0RBAkwB4IFcGV0YWwwCwYDVR0PBAQD
+AgKEMA0GCSqGSIb3DQEBCwUAA4IBgQBYyONVmgUv8mpGTp2U+12e715VDGQLRNEu
+TjGBgpVF4Vebw8E+L++Fzbd0iJVq0o1WzcM3SxdgPr/AZCqgbzHeRx3ZmE/7QNtF
+w+IvOU35VQAYlA3Caz2gYoTLYaCyPF1ZwH7cbviI1pdv1jWotHVYbK/hFXHx1GaF
+as3AHGAr1lGFFrnt0pA3G1VJACGEHOFZRxeDAwnyl9VN/JC8uujaSekA98fzspvk
+fQYTfOAhR4qd9smwg/af/cgJHcFeMbfLWYmeLa01zMR1NypBOdVJQOXCn9bBn6xW
+Niwa9JitzJaK0hRccdOEerw0UI/5s5xCKIYepn5MZ7RlWfarjBTZbVvyzkMMSFa4
+qB39pqLTQtxq3KLDpTs76Q+U9UyuQuxuC2kNyPHmpYgCT/2Aaiezx80GMeEL3XCJ
+L+vmo/3jU6miAXEFZRBCe1z8bwEWb1RiEHh/pVxRbIMRgtGfCQoQwHpZyx9VUWd0
+ZBYZlQ0Ql1YGPEuEWkobTBppzHsaIX8=
 -----END CERTIFICATE-----
diff --git a/validator/val_secalgo.c b/validator/val_secalgo.c
index 2ce52a74b..d0d6d73d8 100644
--- a/validator/val_secalgo.c
+++ b/validator/val_secalgo.c
@@ -745,11 +745,9 @@ verify_canonrrset(sldns_buffer* buf, int algo, unsigned char* sigblock,
 	if((algo == LDNS_DSA || algo == LDNS_DSA_NSEC3) &&(fake_dsa||fake_sha1))
 		return sec_status_secure;
 #endif
-#ifndef USE_SHA1
 	if(fake_sha1 && (algo == LDNS_DSA || algo == LDNS_DSA_NSEC3 || algo == LDNS_RSASHA1 || algo == LDNS_RSASHA1_NSEC3))
 		return sec_status_secure;
-#endif
-	
+
 	if(!setup_key_digest(algo, &evp_key, &digest_type, key, keylen)) {
 		verbose(VERB_QUERY, "verify: failed to setup key");
 		*reason = "use of key for crypto failed";