Certificate association data
Matching type (0=exact, 1=SHA-256, 2=SHA-512)
Selector (0=full certificate, 1=SubjectPublicKeyInfo)
Certificate usage (0=CA constraint, 1=service certificate, 2=trust anchor, 3=domain-issued)
Certificate association data