Could you please include following changes to
/sys/src/ape/lib/sec/port/x509-ape.c: this is for X509toRSApub(2) to
accept some ms-generated certs:

/n/sources/plan9/sys/src/ape/lib/sec/port/x509-ape.c:1583,1588 - /sys/src/ape/lib/sec/port/x509-ape.c:1583,1590
  	ALG_sha1WithRSAEncryption,
  	ALG_sha1WithRSAEncryptionOiw,
  	ALG_md5,
+ 	ALG_sha256WithRSAEncryption,
+ 	ALG_shaWithRSASignatureOiw,
  	NUMALGS
  };
  typedef struct Ints7 {
/n/sources/plan9/sys/src/ape/lib/sec/port/x509-ape.c:1596,1601 - /sys/src/ape/lib/sec/port/x509-ape.c:1598,1605
  static Ints7 oid_sha1WithRSAEncryption ={7, 1, 2, 840, 113549, 1, 1, 5 };
  static Ints7 oid_sha1WithRSAEncryptionOiw ={6, 1, 3, 14, 3, 2, 29 };
  static Ints7 oid_md5 ={6, 1, 2, 840, 113549, 2, 5, 0 };
+ static Ints7 oid_sha256WithRSAEncryption ={7, 1, 2, 840, 113549, 1, 1, 11 };
+ static Ints7 oid_shaWithRSASignatureOiw ={6, 1, 3, 14, 3, 2, 15 };
  static Ints *alg_oid_tab[NUMALGS+1] = {
  	(Ints*)&oid_rsaEncryption,
  	(Ints*)&oid_md2WithRSAEncryption,
/n/sources/plan9/sys/src/ape/lib/sec/port/x509-ape.c:1604,1609 - /sys/src/ape/lib/sec/port/x509-ape.c:1608,1615
  	(Ints*)&oid_sha1WithRSAEncryption,
  	(Ints*)&oid_sha1WithRSAEncryptionOiw,
  	(Ints*)&oid_md5,
+ 	(Ints*)&oid_sha256WithRSAEncryption,
+ 	(Ints*)&oid_shaWithRSASignatureOiw,
  	nil
  };
  static DigestFun digestalg[NUMALGS+1] = { md5, md5, md5, md5, sha1, sha1, md5, nil };