diff --git a/include/mbedtls/x509_crt.h b/include/mbedtls/x509_crt.h
index 49211a9..63f2b40 100644
--- a/include/mbedtls/x509_crt.h
+++ b/include/mbedtls/x509_crt.h
@@ -46,54 +46,114 @@
 /**
  * Container for an X.509 certificate. The certificate may be chained.
  */
-typedef struct mbedtls_x509_crt
-{
-    int MBEDTLS_PRIVATE(own_buffer);                     /**< Indicates if \c raw is owned
-                                         *   by the structure or not.        */
-    mbedtls_x509_buf MBEDTLS_PRIVATE(raw);               /**< The raw certificate data (DER). */
-    mbedtls_x509_buf MBEDTLS_PRIVATE(tbs);               /**< The raw certificate body (DER). The part that is To Be Signed. */
+typedef struct mbedtls_x509_crt {
+    int MBEDTLS_PRIVATE(own_buffer); /**< Indicates if \c raw is owned
+                                      *   by the structure or not.        */
+    mbedtls_x509_buf MBEDTLS_PRIVATE(raw); /**< The raw certificate data (DER).
+                                            */
+    mbedtls_x509_buf MBEDTLS_PRIVATE(tbs); /**< The raw certificate body (DER).
+                                              The part that is To Be Signed. */
 
-    int MBEDTLS_PRIVATE(version);                /**< The X.509 version. (1=v1, 2=v2, 3=v3) */
-    mbedtls_x509_buf MBEDTLS_PRIVATE(serial);            /**< Unique id for certificate issued by a specific CA. */
-    mbedtls_x509_buf MBEDTLS_PRIVATE(sig_oid);           /**< Signature algorithm, e.g. sha1RSA */
+    int MBEDTLS_PRIVATE(version); /**< The X.509 version. (1=v1, 2=v2, 3=v3) */
+    mbedtls_x509_buf MBEDTLS_PRIVATE(serial); /**< Unique id for certificate
+                                                 issued by a specific CA. */
+    mbedtls_x509_buf MBEDTLS_PRIVATE(sig_oid); /**< Signature algorithm, e.g.
+                                                  sha1RSA */
 
-    mbedtls_x509_buf MBEDTLS_PRIVATE(issuer_raw);        /**< The raw issuer data (DER). Used for quick comparison. */
-    mbedtls_x509_buf MBEDTLS_PRIVATE(subject_raw);       /**< The raw subject data (DER). Used for quick comparison. */
+    mbedtls_x509_buf MBEDTLS_PRIVATE(issuer_raw); /**< The raw issuer data
+                                                     (DER). Used for quick
+                                                     comparison. */
+    mbedtls_x509_buf MBEDTLS_PRIVATE(subject_raw); /**< The raw subject data
+                                                      (DER). Used for quick
+                                                      comparison. */
 
-    mbedtls_x509_name MBEDTLS_PRIVATE(issuer);           /**< The parsed issuer data (named information object). */
-    mbedtls_x509_name MBEDTLS_PRIVATE(subject);          /**< The parsed subject data (named information object). */
+    mbedtls_x509_name MBEDTLS_PRIVATE(issuer); /**< The parsed issuer data
+                                                  (named information object). */
+    mbedtls_x509_name MBEDTLS_PRIVATE(subject); /**< The parsed subject data
+                                                   (named information object).
+                                                 */
 
-    mbedtls_x509_time MBEDTLS_PRIVATE(valid_from);       /**< Start time of certificate validity. */
-    mbedtls_x509_time MBEDTLS_PRIVATE(valid_to);         /**< End time of certificate validity. */
+    mbedtls_x509_time MBEDTLS_PRIVATE(valid_from); /**< Start time of
+                                                      certificate validity. */
+    mbedtls_x509_time MBEDTLS_PRIVATE(valid_to); /**< End time of certificate
+                                                    validity. */
 
     mbedtls_x509_buf MBEDTLS_PRIVATE(pk_raw);
-    mbedtls_pk_context MBEDTLS_PRIVATE(pk);              /**< Container for the public key context. */
+    mbedtls_pk_context MBEDTLS_PRIVATE(pk); /**< Container for the public key
+                                               context. */
 
-    mbedtls_x509_buf MBEDTLS_PRIVATE(issuer_id);         /**< Optional X.509 v2/v3 issuer unique identifier. */
-    mbedtls_x509_buf MBEDTLS_PRIVATE(subject_id);        /**< Optional X.509 v2/v3 subject unique identifier. */
-    mbedtls_x509_buf MBEDTLS_PRIVATE(v3_ext);            /**< Optional X.509 v3 extensions.  */
-    mbedtls_x509_sequence MBEDTLS_PRIVATE(subject_alt_names);    /**< Optional list of raw entries of Subject Alternative Names extension (currently only dNSName and OtherName are listed). */
+    mbedtls_x509_buf MBEDTLS_PRIVATE(issuer_id); /**< Optional X.509 v2/v3
+                                                    issuer unique identifier. */
+    mbedtls_x509_buf MBEDTLS_PRIVATE(subject_id); /**< Optional X.509 v2/v3
+                                                     subject unique identifier.
+                                                   */
+    mbedtls_x509_buf MBEDTLS_PRIVATE(v3_ext); /**< Optional X.509 v3 extensions.
+                                               */
+    mbedtls_x509_sequence MBEDTLS_PRIVATE(subject_alt_names); /**< Optional list
+                                                                 of raw entries
+                                                                 of Subject
+                                                                 Alternative
+                                                                 Names extension
+                                                                 (currently only
+                                                                 dNSName and
+                                                                 OtherName are
+                                                                 listed). */
 
-    mbedtls_x509_sequence MBEDTLS_PRIVATE(certificate_policies); /**< Optional list of certificate policies (Only anyPolicy is printed and enforced, however the rest of the policies are still listed). */
+    mbedtls_x509_sequence MBEDTLS_PRIVATE(certificate_policies); /**< Optional
+                                                                    list of
+                                                                    certificate
+                                                                    policies
+                                                                    (Only
+                                                                    anyPolicy is
+                                                                    printed and
+                                                                    enforced,
+                                                                    however the
+                                                                    rest of the
+                                                                    policies are
+                                                                    still
+                                                                    listed). */
 
-    int MBEDTLS_PRIVATE(ext_types);              /**< Bit string containing detected and parsed extensions */
-    int MBEDTLS_PRIVATE(ca_istrue);              /**< Optional Basic Constraint extension value: 1 if this certificate belongs to a CA, 0 otherwise. */
-    int MBEDTLS_PRIVATE(max_pathlen);            /**< Optional Basic Constraint extension value: The maximum path length to the root certificate. Path length is 1 higher than RFC 5280 'meaning', so 1+ */
+    int MBEDTLS_PRIVATE(ext_types); /**< Bit string containing detected and
+                                       parsed extensions */
+    int MBEDTLS_PRIVATE(ca_istrue); /**< Optional Basic Constraint extension
+                                       value: 1 if this certificate belongs to a
+                                       CA, 0 otherwise. */
+    int MBEDTLS_PRIVATE(max_pathlen); /**< Optional Basic Constraint extension
+                                         value: The maximum path length to the
+                                         root certificate. Path length is 1
+                                         higher than RFC 5280 'meaning', so 1+
+                                       */
 
-    unsigned int MBEDTLS_PRIVATE(key_usage);     /**< Optional key usage extension value: See the values in x509.h */
+    unsigned int MBEDTLS_PRIVATE(key_usage); /**< Optional key usage extension
+                                                value: See the values in x509.h
+                                              */
 
-    mbedtls_x509_sequence MBEDTLS_PRIVATE(ext_key_usage); /**< Optional list of extended key usage OIDs. */
+    mbedtls_x509_sequence MBEDTLS_PRIVATE(ext_key_usage); /**< Optional list of
+                                                             extended key usage
+                                                             OIDs. */
 
-    unsigned char MBEDTLS_PRIVATE(ns_cert_type); /**< Optional Netscape certificate type extension value: See the values in x509.h */
+    unsigned char MBEDTLS_PRIVATE(ns_cert_type); /**< Optional Netscape
+                                                    certificate type extension
+                                                    value: See the values in
+                                                    x509.h */
 
-    mbedtls_x509_buf MBEDTLS_PRIVATE(sig);               /**< Signature: hash of the tbs part signed with the private key. */
-    mbedtls_md_type_t MBEDTLS_PRIVATE(sig_md);           /**< Internal representation of the MD algorithm of the signature algorithm, e.g. MBEDTLS_MD_SHA256 */
-    mbedtls_pk_type_t MBEDTLS_PRIVATE(sig_pk);           /**< Internal representation of the Public Key algorithm of the signature algorithm, e.g. MBEDTLS_PK_RSA */
-    void *MBEDTLS_PRIVATE(sig_opts);             /**< Signature options to be passed to mbedtls_pk_verify_ext(), e.g. for RSASSA-PSS */
+    mbedtls_x509_buf MBEDTLS_PRIVATE(sig); /**< Signature: hash of the tbs part
+                                              signed with the private key. */
+    mbedtls_md_type_t MBEDTLS_PRIVATE(sig_md); /**< Internal representation of
+                                                  the MD algorithm of the
+                                                  signature algorithm, e.g.
+                                                  MBEDTLS_MD_SHA256 */
+    mbedtls_pk_type_t MBEDTLS_PRIVATE(sig_pk); /**< Internal representation of
+                                                  the Public Key algorithm of
+                                                  the signature algorithm, e.g.
+                                                  MBEDTLS_PK_RSA */
+    void *MBEDTLS_PRIVATE(sig_opts); /**< Signature options to be passed to
+                                        mbedtls_pk_verify_ext(), e.g. for
+                                        RSASSA-PSS */
 
-    struct mbedtls_x509_crt *MBEDTLS_PRIVATE(next);     /**< Next certificate in the CA-chain. */
-}
-mbedtls_x509_crt;
+    struct mbedtls_x509_crt *MBEDTLS_PRIVATE(next); /**< Next certificate in the
+                                                       CA-chain. */
+} mbedtls_x509_crt;
 
 /**
  * From RFC 5280 section 4.2.1.6:
@@ -101,52 +161,55 @@
  *      type-id    OBJECT IDENTIFIER,
  *      value      [0] EXPLICIT ANY DEFINED BY type-id }
  */
-typedef struct mbedtls_x509_san_other_name
-{
+typedef struct mbedtls_x509_san_other_name {
     /**
      * The type_id is an OID as deifned in RFC 5280.
      * To check the value of the type id, you should use
      * \p MBEDTLS_OID_CMP with a known OID mbedtls_x509_buf.
      */
-    mbedtls_x509_buf MBEDTLS_PRIVATE(type_id);                   /**< The type id. */
-    union
-    {
+    mbedtls_x509_buf MBEDTLS_PRIVATE(type_id); /**< The type id. */
+    union {
         /**
          * From RFC 4108 section 5:
          * HardwareModuleName ::= SEQUENCE {
          *                         hwType OBJECT IDENTIFIER,
          *                         hwSerialNum OCTET STRING }
          */
-        struct
-        {
-            mbedtls_x509_buf MBEDTLS_PRIVATE(oid);               /**< The object identifier. */
-            mbedtls_x509_buf MBEDTLS_PRIVATE(val);               /**< The named value. */
-        }
-        MBEDTLS_PRIVATE(hardware_module_name);
-    }
-    MBEDTLS_PRIVATE(value);
-}
-mbedtls_x509_san_other_name;
+        struct {
+            mbedtls_x509_buf MBEDTLS_PRIVATE(oid); /**< The object identifier.
+                                                    */
+            mbedtls_x509_buf MBEDTLS_PRIVATE(val); /**< The named value. */
+        } MBEDTLS_PRIVATE(hardware_module_name);
+    } MBEDTLS_PRIVATE(value);
+} mbedtls_x509_san_other_name;
 
 /**
- * A structure for holding the parsed Subject Alternative Name, according to type
+ * A structure for holding the parsed Subject Alternative Name, according to
+ * type
  */
-typedef struct mbedtls_x509_subject_alternative_name
-{
-    int MBEDTLS_PRIVATE(type);                              /**< The SAN type, value of MBEDTLS_X509_SAN_XXX. */
+typedef struct mbedtls_x509_subject_alternative_name {
+    int MBEDTLS_PRIVATE(type); /**< The SAN type, value of MBEDTLS_X509_SAN_XXX.
+                                */
     union {
-        mbedtls_x509_san_other_name MBEDTLS_PRIVATE(other_name); /**< The otherName supported type. */
-        mbedtls_x509_buf   MBEDTLS_PRIVATE(unstructured_name); /**< The buffer for the un constructed types. Only dnsName currently supported */
-    }
-    MBEDTLS_PRIVATE(san); /**< A union of the supported SAN types */
-}
-mbedtls_x509_subject_alternative_name;
+        mbedtls_x509_san_other_name MBEDTLS_PRIVATE(other_name); /**< The
+                                                                    otherName
+                                                                    supported
+                                                                    type. */
+        mbedtls_x509_buf MBEDTLS_PRIVATE(unstructured_name); /**< The buffer for
+                                                                the un
+                                                                constructed
+                                                                types. Only
+                                                                dnsName
+                                                                currently
+                                                                supported */
+    } MBEDTLS_PRIVATE(san); /**< A union of the supported SAN types */
+} mbedtls_x509_subject_alternative_name;
 
 /**
  * Build flag from an algorithm/curve identifier (pk, md, ecp)
  * Since 0 is always XXX_NONE, ignore it.
  */
-#define MBEDTLS_X509_ID_FLAG( id )   ( 1 << ( (id) - 1 ) )
+#define MBEDTLS_X509_ID_FLAG(id) (1 << ((id)-1))
 
 /**
  * Security profile for certificate verification.
@@ -173,24 +236,22 @@
  *  my_profile.allowed_pks = MBEDTLS_X509_ID_FLAG( MBEDTLS_PK_RSA );
  *  my_profile.rsa_min_bitlen = 3072;
  */
-typedef struct mbedtls_x509_crt_profile
-{
-    uint32_t allowed_mds;       /**< MDs for signatures         */
-    uint32_t allowed_pks;       /**< PK algs for signatures     */
-    uint32_t allowed_curves;    /**< Elliptic curves for ECDSA  */
-    uint32_t rsa_min_bitlen;    /**< Minimum size for RSA keys  */
-}
-mbedtls_x509_crt_profile;
+typedef struct mbedtls_x509_crt_profile {
+    uint32_t allowed_mds; /**< MDs for signatures         */
+    uint32_t allowed_pks; /**< PK algs for signatures     */
+    uint32_t allowed_curves; /**< Elliptic curves for ECDSA  */
+    uint32_t rsa_min_bitlen; /**< Minimum size for RSA keys  */
+} mbedtls_x509_crt_profile;
 
-#define MBEDTLS_X509_CRT_VERSION_1              0
-#define MBEDTLS_X509_CRT_VERSION_2              1
-#define MBEDTLS_X509_CRT_VERSION_3              2
+#define MBEDTLS_X509_CRT_VERSION_1 0
+#define MBEDTLS_X509_CRT_VERSION_2 1
+#define MBEDTLS_X509_CRT_VERSION_3 2
 
 #define MBEDTLS_X509_RFC5280_MAX_SERIAL_LEN 32
 #define MBEDTLS_X509_RFC5280_UTC_TIME_LEN   15
 
-#if !defined( MBEDTLS_X509_MAX_FILE_PATH_LEN )
-#define MBEDTLS_X509_MAX_FILE_PATH_LEN 512
+#if !defined(MBEDTLS_X509_MAX_FILE_PATH_LEN)
+#    define MBEDTLS_X509_MAX_FILE_PATH_LEN 512
 #endif
 
 /* This macro unfolds to the concatenation of macro invocations
@@ -199,73 +260,71 @@
  *                             human readable description )
  * where X509_CRT_ERROR_INFO is defined by the user.
  * See x509_crt.c for an example of how to use this. */
-#define MBEDTLS_X509_CRT_ERROR_INFO_LIST                                  \
-    X509_CRT_ERROR_INFO( MBEDTLS_X509_BADCERT_EXPIRED,            \
-                         "MBEDTLS_X509_BADCERT_EXPIRED",          \
-                         "The certificate validity has expired" ) \
-    X509_CRT_ERROR_INFO( MBEDTLS_X509_BADCERT_REVOKED,            \
-                         "MBEDTLS_X509_BADCERT_REVOKED",          \
-                         "The certificate has been revoked (is on a CRL)" ) \
-    X509_CRT_ERROR_INFO( MBEDTLS_X509_BADCERT_CN_MISMATCH,                  \
-                         "MBEDTLS_X509_BADCERT_CN_MISMATCH",                \
-                         "The certificate Common Name (CN) does not match with the expected CN" ) \
-    X509_CRT_ERROR_INFO( MBEDTLS_X509_BADCERT_NOT_TRUSTED,                             \
-                         "MBEDTLS_X509_BADCERT_NOT_TRUSTED",                           \
-                         "The certificate is not correctly signed by the trusted CA" ) \
-    X509_CRT_ERROR_INFO( MBEDTLS_X509_BADCRL_NOT_TRUSTED,                      \
-                         "MBEDTLS_X509_BADCRL_NOT_TRUSTED",                    \
-                         "The CRL is not correctly signed by the trusted CA" ) \
-    X509_CRT_ERROR_INFO( MBEDTLS_X509_BADCRL_EXPIRED,    \
-                         "MBEDTLS_X509_BADCRL_EXPIRED",  \
-                         "The CRL is expired" )          \
-    X509_CRT_ERROR_INFO( MBEDTLS_X509_BADCERT_MISSING,   \
-                         "MBEDTLS_X509_BADCERT_MISSING", \
-                         "Certificate was missing" )     \
-    X509_CRT_ERROR_INFO( MBEDTLS_X509_BADCERT_SKIP_VERIFY,         \
-                         "MBEDTLS_X509_BADCERT_SKIP_VERIFY",       \
-                         "Certificate verification was skipped" )  \
-    X509_CRT_ERROR_INFO( MBEDTLS_X509_BADCERT_OTHER,                          \
-                         "MBEDTLS_X509_BADCERT_OTHER",                        \
-                         "Other reason (can be used by verify callback)" )    \
-    X509_CRT_ERROR_INFO( MBEDTLS_X509_BADCERT_FUTURE,                         \
-                         "MBEDTLS_X509_BADCERT_FUTURE",                       \
-                         "The certificate validity starts in the future" )    \
-    X509_CRT_ERROR_INFO( MBEDTLS_X509_BADCRL_FUTURE,     \
-                         "MBEDTLS_X509_BADCRL_FUTURE",   \
-                         "The CRL is from the future" )  \
-    X509_CRT_ERROR_INFO( MBEDTLS_X509_BADCERT_KEY_USAGE,                      \
-                         "MBEDTLS_X509_BADCERT_KEY_USAGE",                    \
-                         "Usage does not match the keyUsage extension" )      \
-    X509_CRT_ERROR_INFO( MBEDTLS_X509_BADCERT_EXT_KEY_USAGE,                       \
-                         "MBEDTLS_X509_BADCERT_EXT_KEY_USAGE",                     \
-                         "Usage does not match the extendedKeyUsage extension" )   \
-    X509_CRT_ERROR_INFO( MBEDTLS_X509_BADCERT_NS_CERT_TYPE,                        \
-                         "MBEDTLS_X509_BADCERT_NS_CERT_TYPE",                      \
-                         "Usage does not match the nsCertType extension" )         \
-    X509_CRT_ERROR_INFO( MBEDTLS_X509_BADCERT_BAD_MD,                              \
-                         "MBEDTLS_X509_BADCERT_BAD_MD",                            \
-                         "The certificate is signed with an unacceptable hash." )  \
-    X509_CRT_ERROR_INFO( MBEDTLS_X509_BADCERT_BAD_PK,                                                  \
-                         "MBEDTLS_X509_BADCERT_BAD_PK",                                                \
-                         "The certificate is signed with an unacceptable PK alg (eg RSA vs ECDSA)." )  \
-    X509_CRT_ERROR_INFO( MBEDTLS_X509_BADCERT_BAD_KEY,                                                            \
-                         "MBEDTLS_X509_BADCERT_BAD_KEY",                                                          \
-                         "The certificate is signed with an unacceptable key (eg bad curve, RSA too short)." )    \
-    X509_CRT_ERROR_INFO( MBEDTLS_X509_BADCRL_BAD_MD,                          \
-                         "MBEDTLS_X509_BADCRL_BAD_MD",                        \
-                         "The CRL is signed with an unacceptable hash." )     \
-    X509_CRT_ERROR_INFO( MBEDTLS_X509_BADCRL_BAD_PK,                                            \
-                         "MBEDTLS_X509_BADCRL_BAD_PK",                                          \
-                         "The CRL is signed with an unacceptable PK alg (eg RSA vs ECDSA)." )   \
-    X509_CRT_ERROR_INFO( MBEDTLS_X509_BADCRL_BAD_KEY,                                                    \
-                         "MBEDTLS_X509_BADCRL_BAD_KEY",                                                  \
-                         "The CRL is signed with an unacceptable key (eg bad curve, RSA too short)." )
+#define MBEDTLS_X509_CRT_ERROR_INFO_LIST                                                     \
+    X509_CRT_ERROR_INFO(MBEDTLS_X509_BADCERT_EXPIRED,                                        \
+                        "MBEDTLS_X509_BADCERT_EXPIRED",                                      \
+                        "The certificate validity has expired")                              \
+    X509_CRT_ERROR_INFO(MBEDTLS_X509_BADCERT_REVOKED,                                        \
+                        "MBEDTLS_X509_BADCERT_REVOKED",                                      \
+                        "The certificate has been revoked (is on a CRL)")                    \
+    X509_CRT_ERROR_INFO(                                                                     \
+        MBEDTLS_X509_BADCERT_CN_MISMATCH, "MBEDTLS_X509_BADCERT_CN_MISMATCH",                \
+        "The certificate Common Name (CN) does not match with the expected CN")              \
+    X509_CRT_ERROR_INFO(                                                                     \
+        MBEDTLS_X509_BADCERT_NOT_TRUSTED, "MBEDTLS_X509_BADCERT_NOT_TRUSTED",                \
+        "The certificate is not correctly signed by the trusted CA")                         \
+    X509_CRT_ERROR_INFO(MBEDTLS_X509_BADCRL_NOT_TRUSTED,                                     \
+                        "MBEDTLS_X509_BADCRL_NOT_TRUSTED",                                   \
+                        "The CRL is not correctly signed by the trusted CA")                 \
+    X509_CRT_ERROR_INFO(MBEDTLS_X509_BADCRL_EXPIRED,                                         \
+                        "MBEDTLS_X509_BADCRL_EXPIRED", "The CRL is expired")                 \
+    X509_CRT_ERROR_INFO(MBEDTLS_X509_BADCERT_MISSING,                                        \
+                        "MBEDTLS_X509_BADCERT_MISSING",                                      \
+                        "Certificate was missing")                                           \
+    X509_CRT_ERROR_INFO(MBEDTLS_X509_BADCERT_SKIP_VERIFY,                                    \
+                        "MBEDTLS_X509_BADCERT_SKIP_VERIFY",                                  \
+                        "Certificate verification was skipped")                              \
+    X509_CRT_ERROR_INFO(MBEDTLS_X509_BADCERT_OTHER,                                          \
+                        "MBEDTLS_X509_BADCERT_OTHER",                                        \
+                        "Other reason (can be used by verify callback)")                     \
+    X509_CRT_ERROR_INFO(MBEDTLS_X509_BADCERT_FUTURE,                                         \
+                        "MBEDTLS_X509_BADCERT_FUTURE",                                       \
+                        "The certificate validity starts in the future")                     \
+    X509_CRT_ERROR_INFO(MBEDTLS_X509_BADCRL_FUTURE,                                          \
+                        "MBEDTLS_X509_BADCRL_FUTURE",                                        \
+                        "The CRL is from the future")                                        \
+    X509_CRT_ERROR_INFO(MBEDTLS_X509_BADCERT_KEY_USAGE,                                      \
+                        "MBEDTLS_X509_BADCERT_KEY_USAGE",                                    \
+                        "Usage does not match the keyUsage extension")                       \
+    X509_CRT_ERROR_INFO(MBEDTLS_X509_BADCERT_EXT_KEY_USAGE,                                  \
+                        "MBEDTLS_X509_BADCERT_EXT_KEY_USAGE",                                \
+                        "Usage does not match the extendedKeyUsage extension")               \
+    X509_CRT_ERROR_INFO(MBEDTLS_X509_BADCERT_NS_CERT_TYPE,                                   \
+                        "MBEDTLS_X509_BADCERT_NS_CERT_TYPE",                                 \
+                        "Usage does not match the nsCertType extension")                     \
+    X509_CRT_ERROR_INFO(                                                                     \
+        MBEDTLS_X509_BADCERT_BAD_MD, "MBEDTLS_X509_BADCERT_BAD_MD",                          \
+        "The certificate is signed with an unacceptable hash.")                              \
+    X509_CRT_ERROR_INFO(                                                                     \
+        MBEDTLS_X509_BADCERT_BAD_PK, "MBEDTLS_X509_BADCERT_BAD_PK",                          \
+        "The certificate is signed with an unacceptable PK alg (eg RSA vs ECDSA).")          \
+    X509_CRT_ERROR_INFO(                                                                     \
+        MBEDTLS_X509_BADCERT_BAD_KEY, "MBEDTLS_X509_BADCERT_BAD_KEY",                        \
+        "The certificate is signed with an unacceptable key (eg bad curve, RSA too short).") \
+    X509_CRT_ERROR_INFO(MBEDTLS_X509_BADCRL_BAD_MD,                                          \
+                        "MBEDTLS_X509_BADCRL_BAD_MD",                                        \
+                        "The CRL is signed with an unacceptable hash.")                      \
+    X509_CRT_ERROR_INFO(                                                                     \
+        MBEDTLS_X509_BADCRL_BAD_PK, "MBEDTLS_X509_BADCRL_BAD_PK",                            \
+        "The CRL is signed with an unacceptable PK alg (eg RSA vs ECDSA).")                  \
+    X509_CRT_ERROR_INFO(                                                                     \
+        MBEDTLS_X509_BADCRL_BAD_KEY, "MBEDTLS_X509_BADCRL_BAD_KEY",                          \
+        "The CRL is signed with an unacceptable key (eg bad curve, RSA too short).")
 
 /**
  * Container for writing a certificate (CRT)
  */
-typedef struct mbedtls_x509write_cert
-{
+typedef struct mbedtls_x509write_cert {
     int MBEDTLS_PRIVATE(version);
     mbedtls_mpi MBEDTLS_PRIVATE(serial);
     mbedtls_pk_context *MBEDTLS_PRIVATE(subject_key);
@@ -276,8 +335,7 @@
     char MBEDTLS_PRIVATE(not_before)[MBEDTLS_X509_RFC5280_UTC_TIME_LEN + 1];
     char MBEDTLS_PRIVATE(not_after)[MBEDTLS_X509_RFC5280_UTC_TIME_LEN + 1];
     mbedtls_asn1_named_data *MBEDTLS_PRIVATE(extensions);
-}
-mbedtls_x509write_cert;
+} mbedtls_x509write_cert;
 
 /**
  * Item in a verification chain: cert and flags for it
@@ -290,14 +348,15 @@
 /**
  * Max size of verification chain: end-entity + intermediates + trusted root
  */
-#define MBEDTLS_X509_MAX_VERIFY_CHAIN_SIZE  ( MBEDTLS_X509_MAX_INTERMEDIATE_CA + 2 )
+#define MBEDTLS_X509_MAX_VERIFY_CHAIN_SIZE \
+    (MBEDTLS_X509_MAX_INTERMEDIATE_CA + 2)
 
 /**
  * Verification chain as built by \c mbedtls_crt_verify_chain()
  */
-typedef struct
-{
-    mbedtls_x509_crt_verify_chain_item MBEDTLS_PRIVATE(items)[MBEDTLS_X509_MAX_VERIFY_CHAIN_SIZE];
+typedef struct {
+    mbedtls_x509_crt_verify_chain_item MBEDTLS_PRIVATE(items)
+        [MBEDTLS_X509_MAX_VERIFY_CHAIN_SIZE];
     unsigned MBEDTLS_PRIVATE(len);
 
 #if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK)
@@ -314,24 +373,26 @@
 /**
  * \brief       Context for resuming X.509 verify operations
  */
-typedef struct
-{
+typedef struct {
     /* for check_signature() */
     mbedtls_pk_restart_ctx MBEDTLS_PRIVATE(pk);
 
     /* for find_parent_in() */
-    mbedtls_x509_crt *MBEDTLS_PRIVATE(parent); /* non-null iff parent_in in progress */
+    mbedtls_x509_crt *MBEDTLS_PRIVATE(parent); /* non-null iff parent_in in
+                                                  progress */
     mbedtls_x509_crt *MBEDTLS_PRIVATE(fallback_parent);
     int MBEDTLS_PRIVATE(fallback_signature_is_good);
 
     /* for find_parent() */
-    int MBEDTLS_PRIVATE(parent_is_trusted); /* -1 if find_parent is not in progress */
+    int MBEDTLS_PRIVATE(parent_is_trusted); /* -1 if find_parent is not in
+                                               progress */
 
     /* for verify_chain() */
-    enum {
+    enum
+    {
         x509_crt_rs_none,
         x509_crt_rs_find_parent,
-    } MBEDTLS_PRIVATE(in_progress);  /* none if no operation is in progress */
+    } MBEDTLS_PRIVATE(in_progress); /* none if no operation is in progress */
     int MBEDTLS_PRIVATE(self_cnt);
     mbedtls_x509_crt_verify_chain MBEDTLS_PRIVATE(ver_chain);
 
@@ -398,9 +459,9 @@
  * \return         \c 0 if successful.
  * \return         A negative error code on failure.
  */
-int mbedtls_x509_crt_parse_der( mbedtls_x509_crt *chain,
-                                const unsigned char *buf,
-                                size_t buflen );
+int mbedtls_x509_crt_parse_der(mbedtls_x509_crt *chain,
+                               const unsigned char *buf,
+                               size_t buflen);
 
 /**
  * \brief          The type of certificate extension callbacks.
@@ -432,12 +493,12 @@
  * \return         \c 0 on success.
  * \return         A negative error code on failure.
  */
-typedef int (*mbedtls_x509_crt_ext_cb_t)( void *p_ctx,
-                                          mbedtls_x509_crt const *crt,
-                                          mbedtls_x509_buf const *oid,
-                                          int critical,
-                                          const unsigned char *p,
-                                          const unsigned char *end );
+typedef int (*mbedtls_x509_crt_ext_cb_t)(void *p_ctx,
+                                         mbedtls_x509_crt const *crt,
+                                         mbedtls_x509_buf const *oid,
+                                         int critical,
+                                         const unsigned char *p,
+                                         const unsigned char *end);
 
 /**
  * \brief            Parse a single DER formatted certificate and add it
@@ -479,12 +540,12 @@
  * \return           \c 0 if successful.
  * \return           A negative error code on failure.
  */
-int mbedtls_x509_crt_parse_der_with_ext_cb( mbedtls_x509_crt *chain,
-                                            const unsigned char *buf,
-                                            size_t buflen,
-                                            int make_copy,
-                                            mbedtls_x509_crt_ext_cb_t cb,
-                                            void *p_ctx );
+int mbedtls_x509_crt_parse_der_with_ext_cb(mbedtls_x509_crt *chain,
+                                           const unsigned char *buf,
+                                           size_t buflen,
+                                           int make_copy,
+                                           mbedtls_x509_crt_ext_cb_t cb,
+                                           void *p_ctx);
 
 /**
  * \brief          Parse a single DER formatted certificate and add it
@@ -513,9 +574,9 @@
  * \return         \c 0 if successful.
  * \return         A negative error code on failure.
  */
-int mbedtls_x509_crt_parse_der_nocopy( mbedtls_x509_crt *chain,
-                                       const unsigned char *buf,
-                                       size_t buflen );
+int mbedtls_x509_crt_parse_der_nocopy(mbedtls_x509_crt *chain,
+                                      const unsigned char *buf,
+                                      size_t buflen);
 
 /**
  * \brief          Parse one DER-encoded or one or more concatenated PEM-encoded
@@ -547,9 +608,11 @@
  * \return         A negative X509 or PEM error code otherwise.
  *
  */
-int mbedtls_x509_crt_parse( mbedtls_x509_crt *chain, const unsigned char *buf, size_t buflen );
+int mbedtls_x509_crt_parse(mbedtls_x509_crt *chain,
+                           const unsigned char *buf,
+                           size_t buflen);
 
-#if defined(MBEDTLS_FS_IO)
+#    if defined(MBEDTLS_FS_IO)
 /**
  * \brief          Load one or more certificates and add them
  *                 to the chained list. Parses permissively. If some
@@ -563,7 +626,7 @@
  * \return         0 if all certificates parsed successfully, a positive number
  *                 if partly successful or a specific X509 or PEM error code
  */
-int mbedtls_x509_crt_parse_file( mbedtls_x509_crt *chain, const char *path );
+int mbedtls_x509_crt_parse_file(mbedtls_x509_crt *chain, const char *path);
 
 /**
  * \brief          Load one or more certificate files from a path and add them
@@ -578,9 +641,9 @@
  * \return         0 if all certificates parsed successfully, a positive number
  *                 if partly successful or a specific X509 or PEM error code
  */
-int mbedtls_x509_crt_parse_path( mbedtls_x509_crt *chain, const char *path );
+int mbedtls_x509_crt_parse_path(mbedtls_x509_crt *chain, const char *path);
 
-#endif /* MBEDTLS_FS_IO */
+#    endif /* MBEDTLS_FS_IO */
 /**
  * \brief          This function parses an item in the SubjectAlternativeNames
  *                 extension.
@@ -608,10 +671,11 @@
  *                 SAN type.
  * \return         Another negative value for any other failure.
  */
-int mbedtls_x509_parse_subject_alt_name( const mbedtls_x509_buf *san_buf,
-                                         mbedtls_x509_subject_alternative_name *san );
+int mbedtls_x509_parse_subject_alt_name(
+    const mbedtls_x509_buf *san_buf,
+    mbedtls_x509_subject_alternative_name *san);
 
-#if !defined(MBEDTLS_X509_REMOVE_INFO)
+#    if !defined(MBEDTLS_X509_REMOVE_INFO)
 /**
  * \brief          Returns an informational string about the
  *                 certificate.
@@ -624,8 +688,10 @@
  * \return         The length of the string written (not including the
  *                 terminated nul byte), or a negative error code.
  */
-int mbedtls_x509_crt_info( char *buf, size_t size, const char *prefix,
-                   const mbedtls_x509_crt *crt );
+int mbedtls_x509_crt_info(char *buf,
+                          size_t size,
+                          const char *prefix,
+                          const mbedtls_x509_crt *crt);
 
 /**
  * \brief          Returns an informational string about the
@@ -639,9 +705,11 @@
  * \return         The length of the string written (not including the
  *                 terminated nul byte), or a negative error code.
  */
-int mbedtls_x509_crt_verify_info( char *buf, size_t size, const char *prefix,
-                          uint32_t flags );
-#endif /* !MBEDTLS_X509_REMOVE_INFO */
+int mbedtls_x509_crt_verify_info(char *buf,
+                                 size_t size,
+                                 const char *prefix,
+                                 uint32_t flags);
+#    endif /* !MBEDTLS_X509_REMOVE_INFO */
 
 /**
  * \brief          Verify a chain of certificates.
@@ -709,12 +777,14 @@
  * \return         Another negative error code in case of a fatal error
  *                 encountered during the verification process.
  */
-int mbedtls_x509_crt_verify( mbedtls_x509_crt *crt,
-                     mbedtls_x509_crt *trust_ca,
-                     mbedtls_x509_crl *ca_crl,
-                     const char *cn, uint32_t *flags,
-                     int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *),
-                     void *p_vrfy );
+int mbedtls_x509_crt_verify(
+    mbedtls_x509_crt *crt,
+    mbedtls_x509_crt *trust_ca,
+    mbedtls_x509_crl *ca_crl,
+    const char *cn,
+    uint32_t *flags,
+    int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *),
+    void *p_vrfy);
 
 /**
  * \brief          Verify a chain of certificates with respect to
@@ -750,13 +820,15 @@
  * \return         Another negative error code in case of a fatal error
  *                 encountered during the verification process.
  */
-int mbedtls_x509_crt_verify_with_profile( mbedtls_x509_crt *crt,
-                     mbedtls_x509_crt *trust_ca,
-                     mbedtls_x509_crl *ca_crl,
-                     const mbedtls_x509_crt_profile *profile,
-                     const char *cn, uint32_t *flags,
-                     int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *),
-                     void *p_vrfy );
+int mbedtls_x509_crt_verify_with_profile(
+    mbedtls_x509_crt *crt,
+    mbedtls_x509_crt *trust_ca,
+    mbedtls_x509_crl *ca_crl,
+    const mbedtls_x509_crt_profile *profile,
+    const char *cn,
+    uint32_t *flags,
+    int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *),
+    void *p_vrfy);
 
 /**
  * \brief          Restartable version of \c mbedtls_crt_verify_with_profile()
@@ -784,14 +856,16 @@
  * \return         #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of
  *                 operations was reached: see \c mbedtls_ecp_set_max_ops().
  */
-int mbedtls_x509_crt_verify_restartable( mbedtls_x509_crt *crt,
-                     mbedtls_x509_crt *trust_ca,
-                     mbedtls_x509_crl *ca_crl,
-                     const mbedtls_x509_crt_profile *profile,
-                     const char *cn, uint32_t *flags,
-                     int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *),
-                     void *p_vrfy,
-                     mbedtls_x509_crt_restart_ctx *rs_ctx );
+int mbedtls_x509_crt_verify_restartable(
+    mbedtls_x509_crt *crt,
+    mbedtls_x509_crt *trust_ca,
+    mbedtls_x509_crl *ca_crl,
+    const mbedtls_x509_crt_profile *profile,
+    const char *cn,
+    uint32_t *flags,
+    int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *),
+    void *p_vrfy,
+    mbedtls_x509_crt_restart_ctx *rs_ctx);
 
 /**
  * \brief               The type of trusted certificate callbacks.
@@ -823,11 +897,11 @@
  *                      to the caller.
  * \return              A negative error code on failure.
  */
-typedef int (*mbedtls_x509_crt_ca_cb_t)( void *p_ctx,
-                                         mbedtls_x509_crt const *child,
-                                         mbedtls_x509_crt **candidate_cas );
+typedef int (*mbedtls_x509_crt_ca_cb_t)(void *p_ctx,
+                                        mbedtls_x509_crt const *child,
+                                        mbedtls_x509_crt **candidate_cas);
 
-#if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK)
+#    if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK)
 /**
  * \brief          Version of \c mbedtls_x509_crt_verify_with_profile() which
  *                 uses a callback to acquire the list of trusted CA
@@ -850,15 +924,17 @@
  *
  * \return         See \c mbedtls_crt_verify_with_profile().
  */
-int mbedtls_x509_crt_verify_with_ca_cb( mbedtls_x509_crt *crt,
-                     mbedtls_x509_crt_ca_cb_t f_ca_cb,
-                     void *p_ca_cb,
-                     const mbedtls_x509_crt_profile *profile,
-                     const char *cn, uint32_t *flags,
-                     int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *),
-                     void *p_vrfy );
+int mbedtls_x509_crt_verify_with_ca_cb(
+    mbedtls_x509_crt *crt,
+    mbedtls_x509_crt_ca_cb_t f_ca_cb,
+    void *p_ca_cb,
+    const mbedtls_x509_crt_profile *profile,
+    const char *cn,
+    uint32_t *flags,
+    int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *),
+    void *p_vrfy);
 
-#endif /* MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK */
+#    endif /* MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK */
 
 /**
  * \brief          Check usage of certificate against keyUsage extension.
@@ -881,8 +957,8 @@
  *                 (intermediate) CAs the keyUsage extension is automatically
  *                 checked by \c mbedtls_x509_crt_verify().
  */
-int mbedtls_x509_crt_check_key_usage( const mbedtls_x509_crt *crt,
-                                      unsigned int usage );
+int mbedtls_x509_crt_check_key_usage(const mbedtls_x509_crt *crt,
+                                     unsigned int usage);
 
 /**
  * \brief           Check usage of certificate against extendedKeyUsage.
@@ -897,11 +973,11 @@
  *
  * \note            Usually only makes sense on leaf certificates.
  */
-int mbedtls_x509_crt_check_extended_key_usage( const mbedtls_x509_crt *crt,
-                                               const char *usage_oid,
-                                               size_t usage_len );
+int mbedtls_x509_crt_check_extended_key_usage(const mbedtls_x509_crt *crt,
+                                              const char *usage_oid,
+                                              size_t usage_len);
 
-#if defined(MBEDTLS_X509_CRL_PARSE_C)
+#    if defined(MBEDTLS_X509_CRL_PARSE_C)
 /**
  * \brief          Verify the certificate revocation status
  *
@@ -911,34 +987,35 @@
  * \return         1 if the certificate is revoked, 0 otherwise
  *
  */
-int mbedtls_x509_crt_is_revoked( const mbedtls_x509_crt *crt, const mbedtls_x509_crl *crl );
-#endif /* MBEDTLS_X509_CRL_PARSE_C */
+int mbedtls_x509_crt_is_revoked(const mbedtls_x509_crt *crt,
+                                const mbedtls_x509_crl *crl);
+#    endif /* MBEDTLS_X509_CRL_PARSE_C */
 
 /**
  * \brief          Initialize a certificate (chain)
  *
  * \param crt      Certificate chain to initialize
  */
-void mbedtls_x509_crt_init( mbedtls_x509_crt *crt );
+void mbedtls_x509_crt_init(mbedtls_x509_crt *crt);
 
 /**
  * \brief          Unallocate all certificate data
  *
  * \param crt      Certificate chain to free
  */
-void mbedtls_x509_crt_free( mbedtls_x509_crt *crt );
+void mbedtls_x509_crt_free(mbedtls_x509_crt *crt);
 
-#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_ECP_RESTARTABLE)
+#    if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_ECP_RESTARTABLE)
 /**
  * \brief           Initialize a restart context
  */
-void mbedtls_x509_crt_restart_init( mbedtls_x509_crt_restart_ctx *ctx );
+void mbedtls_x509_crt_restart_init(mbedtls_x509_crt_restart_ctx *ctx);
 
 /**
  * \brief           Free the components of a restart context
  */
-void mbedtls_x509_crt_restart_free( mbedtls_x509_crt_restart_ctx *ctx );
-#endif /* MBEDTLS_ECDSA_C && MBEDTLS_ECP_RESTARTABLE */
+void mbedtls_x509_crt_restart_free(mbedtls_x509_crt_restart_ctx *ctx);
+#    endif /* MBEDTLS_ECDSA_C && MBEDTLS_ECP_RESTARTABLE */
 #endif /* MBEDTLS_X509_CRT_PARSE_C */
 
 /* \} name */
@@ -950,7 +1027,7 @@
  *
  * \param ctx       CRT context to initialize
  */
-void mbedtls_x509write_crt_init( mbedtls_x509write_cert *ctx );
+void mbedtls_x509write_crt_init(mbedtls_x509write_cert *ctx);
 
 /**
  * \brief           Set the verion for a Certificate
@@ -960,7 +1037,8 @@
  * \param version   version to set (MBEDTLS_X509_CRT_VERSION_1, MBEDTLS_X509_CRT_VERSION_2 or
  *                                  MBEDTLS_X509_CRT_VERSION_3)
  */
-void mbedtls_x509write_crt_set_version( mbedtls_x509write_cert *ctx, int version );
+void mbedtls_x509write_crt_set_version(mbedtls_x509write_cert *ctx,
+                                       int version);
 
 /**
  * \brief           Set the serial number for a Certificate.
@@ -970,7 +1048,8 @@
  *
  * \return          0 if successful
  */
-int mbedtls_x509write_crt_set_serial( mbedtls_x509write_cert *ctx, const mbedtls_mpi *serial );
+int mbedtls_x509write_crt_set_serial(mbedtls_x509write_cert *ctx,
+                                     const mbedtls_mpi *serial);
 
 /**
  * \brief           Set the validity period for a Certificate
@@ -986,8 +1065,9 @@
  * \return          0 if timestamp was parsed successfully, or
  *                  a specific error code
  */
-int mbedtls_x509write_crt_set_validity( mbedtls_x509write_cert *ctx, const char *not_before,
-                                const char *not_after );
+int mbedtls_x509write_crt_set_validity(mbedtls_x509write_cert *ctx,
+                                       const char *not_before,
+                                       const char *not_after);
 
 /**
  * \brief           Set the issuer name for a Certificate
@@ -1001,8 +1081,8 @@
  * \return          0 if issuer name was parsed successfully, or
  *                  a specific error code
  */
-int mbedtls_x509write_crt_set_issuer_name( mbedtls_x509write_cert *ctx,
-                                   const char *issuer_name );
+int mbedtls_x509write_crt_set_issuer_name(mbedtls_x509write_cert *ctx,
+                                          const char *issuer_name);
 
 /**
  * \brief           Set the subject name for a Certificate
@@ -1016,8 +1096,8 @@
  * \return          0 if subject name was parsed successfully, or
  *                  a specific error code
  */
-int mbedtls_x509write_crt_set_subject_name( mbedtls_x509write_cert *ctx,
-                                    const char *subject_name );
+int mbedtls_x509write_crt_set_subject_name(mbedtls_x509write_cert *ctx,
+                                           const char *subject_name);
 
 /**
  * \brief           Set the subject public key for the certificate
@@ -1025,7 +1105,8 @@
  * \param ctx       CRT context to use
  * \param key       public key to include
  */
-void mbedtls_x509write_crt_set_subject_key( mbedtls_x509write_cert *ctx, mbedtls_pk_context *key );
+void mbedtls_x509write_crt_set_subject_key(mbedtls_x509write_cert *ctx,
+                                           mbedtls_pk_context *key);
 
 /**
  * \brief           Set the issuer key used for signing the certificate
@@ -1033,7 +1114,8 @@
  * \param ctx       CRT context to use
  * \param key       private key to sign with
  */
-void mbedtls_x509write_crt_set_issuer_key( mbedtls_x509write_cert *ctx, mbedtls_pk_context *key );
+void mbedtls_x509write_crt_set_issuer_key(mbedtls_x509write_cert *ctx,
+                                          mbedtls_pk_context *key);
 
 /**
  * \brief           Set the MD algorithm to use for the signature
@@ -1042,7 +1124,8 @@
  * \param ctx       CRT context to use
  * \param md_alg    MD algorithm to use
  */
-void mbedtls_x509write_crt_set_md_alg( mbedtls_x509write_cert *ctx, mbedtls_md_type_t md_alg );
+void mbedtls_x509write_crt_set_md_alg(mbedtls_x509write_cert *ctx,
+                                      mbedtls_md_type_t md_alg);
 
 /**
  * \brief           Generic function to add to or replace an extension in the
@@ -1057,10 +1140,12 @@
  *
  * \return          0 if successful, or a MBEDTLS_ERR_X509_ALLOC_FAILED
  */
-int mbedtls_x509write_crt_set_extension( mbedtls_x509write_cert *ctx,
-                                 const char *oid, size_t oid_len,
-                                 int critical,
-                                 const unsigned char *val, size_t val_len );
+int mbedtls_x509write_crt_set_extension(mbedtls_x509write_cert *ctx,
+                                        const char *oid,
+                                        size_t oid_len,
+                                        int critical,
+                                        const unsigned char *val,
+                                        size_t val_len);
 
 /**
  * \brief           Set the basicConstraints extension for a CRT
@@ -1073,10 +1158,11 @@
  *
  * \return          0 if successful, or a MBEDTLS_ERR_X509_ALLOC_FAILED
  */
-int mbedtls_x509write_crt_set_basic_constraints( mbedtls_x509write_cert *ctx,
-                                         int is_ca, int max_pathlen );
+int mbedtls_x509write_crt_set_basic_constraints(mbedtls_x509write_cert *ctx,
+                                                int is_ca,
+                                                int max_pathlen);
 
-#if defined(MBEDTLS_SHA1_C)
+#    if defined(MBEDTLS_SHA1_C)
 /**
  * \brief           Set the subjectKeyIdentifier extension for a CRT
  *                  Requires that mbedtls_x509write_crt_set_subject_key() has been
@@ -1086,7 +1172,8 @@
  *
  * \return          0 if successful, or a MBEDTLS_ERR_X509_ALLOC_FAILED
  */
-int mbedtls_x509write_crt_set_subject_key_identifier( mbedtls_x509write_cert *ctx );
+int mbedtls_x509write_crt_set_subject_key_identifier(
+    mbedtls_x509write_cert *ctx);
 
 /**
  * \brief           Set the authorityKeyIdentifier extension for a CRT
@@ -1097,8 +1184,9 @@
  *
  * \return          0 if successful, or a MBEDTLS_ERR_X509_ALLOC_FAILED
  */
-int mbedtls_x509write_crt_set_authority_key_identifier( mbedtls_x509write_cert *ctx );
-#endif /* MBEDTLS_SHA1_C */
+int mbedtls_x509write_crt_set_authority_key_identifier(
+    mbedtls_x509write_cert *ctx);
+#    endif /* MBEDTLS_SHA1_C */
 
 /**
  * \brief           Set the Key Usage Extension flags
@@ -1109,8 +1197,8 @@
  *
  * \return          0 if successful, or MBEDTLS_ERR_X509_ALLOC_FAILED
  */
-int mbedtls_x509write_crt_set_key_usage( mbedtls_x509write_cert *ctx,
-                                         unsigned int key_usage );
+int mbedtls_x509write_crt_set_key_usage(mbedtls_x509write_cert *ctx,
+                                        unsigned int key_usage);
 
 /**
  * \brief           Set the Netscape Cert Type flags
@@ -1121,15 +1209,15 @@
  *
  * \return          0 if successful, or MBEDTLS_ERR_X509_ALLOC_FAILED
  */
-int mbedtls_x509write_crt_set_ns_cert_type( mbedtls_x509write_cert *ctx,
-                                    unsigned char ns_cert_type );
+int mbedtls_x509write_crt_set_ns_cert_type(mbedtls_x509write_cert *ctx,
+                                           unsigned char ns_cert_type);
 
 /**
  * \brief           Free the contents of a CRT write context
  *
  * \param ctx       CRT context to free
  */
-void mbedtls_x509write_crt_free( mbedtls_x509write_cert *ctx );
+void mbedtls_x509write_crt_free(mbedtls_x509write_cert *ctx);
 
 /**
  * \brief           Write a built up certificate to a X509 DER structure
@@ -1148,11 +1236,13 @@
  *
  * \note            \p f_rng is used for the signature operation.
  */
-int mbedtls_x509write_crt_der( mbedtls_x509write_cert *ctx, unsigned char *buf, size_t size,
-                       int (*f_rng)(void *, unsigned char *, size_t),
-                       void *p_rng );
+int mbedtls_x509write_crt_der(mbedtls_x509write_cert *ctx,
+                              unsigned char *buf,
+                              size_t size,
+                              int (*f_rng)(void *, unsigned char *, size_t),
+                              void *p_rng);
 
-#if defined(MBEDTLS_PEM_WRITE_C)
+#    if defined(MBEDTLS_PEM_WRITE_C)
 /**
  * \brief           Write a built up certificate to a X509 PEM string
  *
@@ -1166,10 +1256,12 @@
  *
  * \note            \p f_rng is used for the signature operation.
  */
-int mbedtls_x509write_crt_pem( mbedtls_x509write_cert *ctx, unsigned char *buf, size_t size,
-                       int (*f_rng)(void *, unsigned char *, size_t),
-                       void *p_rng );
-#endif /* MBEDTLS_PEM_WRITE_C */
+int mbedtls_x509write_crt_pem(mbedtls_x509write_cert *ctx,
+                              unsigned char *buf,
+                              size_t size,
+                              int (*f_rng)(void *, unsigned char *, size_t),
+                              void *p_rng);
+#    endif /* MBEDTLS_PEM_WRITE_C */
 #endif /* MBEDTLS_X509_CRT_WRITE_C */
 
 #ifdef __cplusplus