+#ifndef OPENSSL_NO_TLSEXT
+ /* authz/authz_length contain authz data for this certificate. The data
+ * is in wire format, specifically it's a series of records like:
+ * uint8_t authz_type; // (RFC 5878, AuthzDataFormat)
+ * uint16_t length;
+ * uint8_t data[length]; */
+ unsigned char *authz;
+ size_t authz_length;
+#endif
+ /* Set if CERT_PKEY can be used with current SSL session: e.g.
+ * appropriate curve, signature algorithms etc. If zero it can't be
+ * used at all.
+ */
+ int valid_flags;