ok(verify("root-cert-rsa2", "", ["root-cert-rsa2"], [], "-check_ss_sig"),
"Public Key Algorithm rsa instead of rsaEncryption");
-ok(verify("ee-self-signed", "", ["ee-self-signed"], []),
+ok(verify("ee-self-signed", "", ["ee-self-signed"], [], "-attime", "1593565200"),
"accept trusted self-signed EE cert excluding key usage keyCertSign");
SKIP: {