@Test
    public void testManyExtensions() {
        ServiceTester tester = ServiceTester.test("CertificateFactory").withAlgorithm("X509");
        tester.run((p, algorithm) -> {
            X509Certificate c = certificateFromPEM(p, MANY_EXTENSIONS);

            assertEquals(3, c.getVersion());
            assertEquals(new BigInteger("b5b622b95a04a521", 16), c.getSerialNumber());
            assertDatesEqual(dateFromUTC(2016, Calendar.JULY, 9, 4, 38, 9), c.getNotBefore());
            assertDatesEqual(dateFromUTC(2016, Calendar.AUGUST, 8, 4, 38, 9), c.getNotAfter());
            assertEquals(new X500Principal("CN=Test Issuer"), c.getIssuerX500Principal());
            assertEquals(new X500Principal("CN=Test Subject"), c.getSubjectX500Principal());
            assertEquals("1.2.840.113549.1.1.11", c.getSigAlgOID());
            String signatureHex = "3ec983af1202b61695ca077d9001f743e6ca"
                    + "bb791fa0fc2d18be5b6462d5f04dc511042e"
                    + "77b3589dac72397850c72c298a783e2f79d2"
                    + "054dfbad8882b22670236fb5be48d427f2fc"
                    + "c34dbabf5f7dab3a5f7df80f485854841378"
                    + "fc85937ba623eda6250aed659c8c3c829263"
                    + "fb181901e11865fac062be18efe88343d093"
                    + "f56ee83f865365d19c357461983596c02c1d"
                    + "ddb55ebc8ae9f0e636410cc1b216aedb38c5"
                    + "ceec711ac61d6cbe88c7faffba7f024fd222"
                    + "270ce174b09a543ca4fc4064fafe1362e855"
                    + "df69329594c295b651bb4ee70b064eb639b0"
                    + "ee39b4534dff2fa3b5485e0750b68a339b1b"
                    + "fb5710b6a2c8274cf92ff069ebafd0c5ed23"
                    + "8c679f50";
            assertArrayEquals(TestUtils.decodeHex(signatureHex), c.getSignature());

            // Although documented to only return null when there are no parameters, the SUN
            // provider also returns null when the algorithm uses an explicit parameter with a
            // value of ASN.1 NULL.
            if (c.getSigAlgParams() != null) {
                assertArrayEquals(TestUtils.decodeHex("0500"), c.getSigAlgParams());
            }

            assertArrayEquals(new boolean[] {true, false, true, false}, c.getIssuerUniqueID());
            assertArrayEquals(
                    new boolean[] {false, true, false, true, false}, c.getSubjectUniqueID());
            assertEquals(10, c.getBasicConstraints());
            assertEquals(Arrays.asList("1.3.6.1.5.5.7.3.1", "1.2.840.113554.4.1.72585.2"),
                    c.getExtendedKeyUsage());

            // TODO(davidben): Test the other name types.
            assertGeneralNamesEqual(
                    Arrays.asList(Arrays.asList(1, "issuer@example.com"),
                            Arrays.asList(2, "issuer.example.com"),
                            Arrays.asList(4, "CN=Test Issuer"),
                            Arrays.asList(6, "https://example.com/issuer"),
                            // TODO(https://github.com/google/conscrypt/issues/938): Fix IPv6
                            // handling and include it in this test.
                            Arrays.asList(7, "127.0.0.1"),
                            Arrays.asList(8, "1.2.840.113554.4.1.72585.2")),
                    c.getIssuerAlternativeNames());
            assertGeneralNamesEqual(
                    Arrays.asList(Arrays.asList(1, "subject@example.com"),
                            Arrays.asList(2, "subject.example.com"),
                            Arrays.asList(4, "CN=Test Subject"),
                            Arrays.asList(6, "https://example.com/subject"),
                            // TODO(https://github.com/google/conscrypt/issues/938): Fix IPv6
                            // handling and include it in this test.
                            Arrays.asList(7, "127.0.0.1"),
                            Arrays.asList(8, "1.2.840.113554.4.1.72585.2")),
                    c.getSubjectAlternativeNames());

            // Although the BIT STRING in the certificate only has three bits, getKeyUsage()
            // rounds up to at least 9 bits.
            assertArrayEquals(
                    new boolean[] {true, false, true, false, false, false, false, false, false},
                    c.getKeyUsage());
        });
    }
Confirm that explicit EC params aren't accepted in certificates.
common/src/test/java/org/conscrypt/java/security/cert/X509CertificateTest.java