if err != nil {
		t.Fatalf("failed to parse certificate: %s", err)
	}

	want := []string{
		"http://epscd.catcert.net/crl/ec-acc.crl",
		"http://epscd2.catcert.net/crl/ec-acc.crl",
	}
	if got := cert.CRLDistributionPoints; !reflect.DeepEqual(got, want) {
		t.Errorf("CRL distribution points = %#v, want #%v", got, want)
	}
}

			},
		},
		{
			name: "mesh SDS enabled, tls mode ISTIO_MUTUAL, CRL specified",
			server: &networking.Server{
				Hosts: []string{"httpbin.example.com"},
				Port: &networking.Port{
					Protocol: string(protocol.HTTPS),
				},
				Tls: &networking.ServerTLSSettings{
					Mode:  networking.ServerTLSSettings_ISTIO_MUTUAL,
					CaCrl: "/custom/path/to/crl.pem",
				},
			},
			result: &auth.DownstreamTlsContext{

			},
			"requires a private key", "not-a-cipher-suite",
		},
		{
			"crl specified for SIMPLE TLS",
			&networking.ServerTLSSettings{
				Mode:  networking.ServerTLSSettings_SIMPLE,
				CaCrl: "crl",
			},
			"CRL is not supported with SIMPLE TLS", "",
		},
		{
			"crl specified for CredentialName",
			&networking.ServerTLSSettings{

		}
	}
	if tls.CaCrl != "" {
		if tls.CredentialName != "" {
			v = AppendValidation(v, fmt.Errorf("CRL is not supported with credentialName. CRL has to be specified in the credential"))
		}
		if tls.Mode == networking.ServerTLSSettings_SIMPLE {
			v = AppendValidation(v, fmt.Errorf("CRL is not supported with SIMPLE TLS"))
		}
	}
	return
}

// ValidateDestinationRule checks proxy policies

typically request: \"key encipherment\", \"digital signature\", \"server auth\".\n\nValid values are:\n \"signing\", \"digital signature\", \"content commitment\",\n \"key encipherment\", \"key agreement\", \"data encipherment\",\n \"cert sign\", \"crl sign\", \"encipher only\", \"decipher only\", \"any\",\n \"server auth\", \"client auth\",\n \"code signing\", \"email protection\", \"s/mime\",\n \"ipsec end system\", \"ipsec tunnel\", \"ipsec user\",\n \"timestamping\", \"ocsp signing\", \"microsoft...

ORgB,EAAUF,GAAOE,QAAU,SAAUvD,GACpC,IAAIpC,EACH8B,EAAM,GACN5B,EAAI,EACJZ,EAAW8C,EAAK9C,SAEjB,GAAMA,GAQC,GAAkB,IAAbA,GAA+B,IAAbA,GAA+B,KAAbA,EAAkB,CAIjE,GAAiC,iBAArB8C,EAAKoO,YAChB,OAAOpO,EAAKoO,YAIZ,IAAMpO,EAAOA,EAAKqO,WAAYrO,EAAMA,EAAOA,EAAK+K,YAC/CrL,GAAO6D,EAASvD,QAGZ,GAAkB,IAAb9C,GAA+B,IAAbA,EAC7B,OAAO8C,EAAKsO,eAnBZ,MAAU1Q,EAAOoC,EAAMlC,KAGtB4B,GAAO6D,EAAS3F,GAqBlB,OAAO8B,IAGR4D,EAAOD,GAAOkL,UAAY,CAGzBrE,YAAa,GAEbsE,aAAcpE,GAEd3B,MAAOxC,EAEPyE,WAAY,GAEZ4B,KAAM,GAENmC,SAAU,CACTC,IAAK,CAAEzG,I...

ORgB,EAAUF,GAAOE,QAAU,SAAUvD,GACpC,IAAIpC,EACH8B,EAAM,GACN5B,EAAI,EACJZ,EAAW8C,EAAK9C,SAEjB,GAAMA,GAQC,GAAkB,IAAbA,GAA+B,IAAbA,GAA+B,KAAbA,EAAkB,CAIjE,GAAiC,iBAArB8C,EAAKoO,YAChB,OAAOpO,EAAKoO,YAIZ,IAAMpO,EAAOA,EAAKqO,WAAYrO,EAAMA,EAAOA,EAAK+K,YAC/CrL,GAAO6D,EAASvD,QAGZ,GAAkB,IAAb9C,GAA+B,IAAbA,EAC7B,OAAO8C,EAAKsO,eAnBZ,MAAU1Q,EAAOoC,EAAMlC,KAGtB4B,GAAO6D,EAAS3F,GAqBlB,OAAO8B,IAGR4D,EAAOD,GAAOkL,UAAY,CAGzBrE,YAAa,GAEbsE,aAAcpE,GAEd3B,MAAOxC,EAEPyE,WAAY,GAEZ4B,KAAM,GAENmC,SAAU,CACTC,IAAK,CAAEzG,I...

min_t":1307370946,"max_t":1307370946,"mean_t":1307370946}],"cl_weight":0.15384615384615385,"touches":1,"min_t":1307370946,"max_t":1307370946,"mean_t":1307370946},{"name":"crl","kids":[{"name":"Makefile","kids":[],"cl_weight":0.27692307692307694,"touches":2,"min_t":1305124749,"max_t":1307370946,"mean_t":1306247847},{"name":"crl.go","kids":[],"cl_weight":0.27692307692307694,"touches":2,"min_t":1305124749,"max_t":1307370946,"mean_t":1306247847},{"name":"crl_test.go","kids":[],"cl_weight":0.27692307...