printf("ECC cert not authorized for key agreement\n");
int check_srvr_ecc_cert_and_alg(X509 *x, SSL_CIPHER *cs)	{	unsigned long alg = cs->algorithms;	EVP_PKEY *pkey = NULL;	int keysize = 0;	int signature_nid = 0;	if (SSL_C_IS_EXPORT(cs))		{		/* ECDH key length in export ciphers must be <= 163 bits */		pkey = X509_get_pubkey(x);		if (pkey == NULL) return 0;		keysize = EVP_PKEY_bits(pkey);		EVP_PKEY_free(pkey);		if (keysize > 163) return 0;		}	/* This call populates the ex_flags field correctly */	X509_check_purpose(x, -1, 0);	if ((x->sig_alg) && (x->sig_alg->algorithm))		signature_nid = OBJ_obj2nid(x->sig_alg->algorithm);	if (alg & SSL_kECDH) 		{		/* key usage, if present, must allow key agreement */		if (ku_reject(x, X509v3_KU_KEY_AGREEMENT))			{			printf("ECC cert not authorized for key agreement\n");			return 0;			}		if (alg & SSL_aECDSA) 			{			/* signature alg must be ECDSA */			if (signature_nid != NID_ecdsa_with_SHA1)				{				printf("ECC cert not signed w/ ECDSA\n");				return 0;				}			}		if (alg & SSL_aRSA)			{			/* signature alg must be RSA */			if ((signature_nid != NID_md5WithRSAEncryption) &&			    (signature_nid != NID_md4WithRSAEncryption) &&			    (signature_nid != NID_md2WithRSAEncryption))				{				printf("ECC cert not signed w/ RSA\n");				return 0;				}			}		} 	else if (alg & SSL_aECDSA)		{		/* key usage, if present, must allow signing */		if (ku_reject(x, X509v3_KU_DIGITAL_SIGNATURE))			{			printf("ECC cert not authorized for signature\n");			return 0;			}		}	return 1;  /* all checks are ok */	}