diff --git a/.wolfssl_known_macro_extras b/.wolfssl_known_macro_extras
index 018d1e88e8..ff3f43fde8 100644
--- a/.wolfssl_known_macro_extras
+++ b/.wolfssl_known_macro_extras
@@ -1044,9 +1044,18 @@ WOLFSSL_WC_SLHDSA_RECURSIVE
 WOLFSSL_WC_XMSS_NO_SHA256
 WOLFSSL_WICED_PSEUDO_UNIX_EPOCH_TIME
 WOLFSSL_X25519_NO_MASK_PEER
+WOLFSSL_X509_CERT_GEN
+WOLFSSL_X509_KEY_GEN
+WOLFSSL_X509_PEM
 WOLFSSL_X509_STORE_ALLOW_NON_CA_INTERMEDIATE
 WOLFSSL_X509_STORE_CERTS
+WOLFSSL_X509_TINY
+WOLFSSL_X509_TINY_AKI
+WOLFSSL_X509_TINY_NAME_CONSTRAINTS
+WOLFSSL_X509_TINY_POLICIES
+WOLFSSL_X509_TINY_SKI
 WOLFSSL_X509_TRUSTED_CERTIFICATE_CALLBACK
+WOLFSSL_X509_VERIFY_ONLY
 WOLFSSL_XFREE_NO_NULLNESS_CHECK
 WOLFSSL_XILINX_CRYPTO_OLD
 WOLFSSL_XILINX_PATCH
diff --git a/wolfcrypt/src/asn.c b/wolfcrypt/src/asn.c
index 12d4956caf..cb5fe41ac1 100644
--- a/wolfcrypt/src/asn.c
+++ b/wolfcrypt/src/asn.c
@@ -156,6 +156,12 @@ ASN Options:
  * WOLFSSL_ALLOW_CRIT_AKID:  Allow critical Auth Key Identifier
  * WOLFSSL_ALLOW_CRIT_SKID:  Allow critical Subject Key Identifier
  * WC_ASN_UNKNOWN_EXT_CB:    Callback for unknown extensions
+ * WOLFSSL_X509_VERIFY_ONLY: Verify-only profile. Drops cert/key generation and
+    forces WOLFSSL_NO_PEM unless a gen add-back (WOLFSSL_X509_CERT_GEN /
+    WOLFSSL_X509_KEY_GEN) or WOLFSSL_X509_PEM is set.
+ * WOLFSSL_X509_TINY:        Minimal-extension profile. Compiles out optional
+    X.509 extension decoders behind per-feature WOLFSSL_X509_TINY_<F> add-back
+    macros. Requires WOLFSSL_ASN_TEMPLATE (enforced with #error).
  * WC_ASN_NO_HEAP:           Zero-allocation cert parse: reference key/alt-name
     data in the source DER instead of heap copies, so the source buffer must
     outlive the DecodedCert. Auto-defined when WOLFSSL_NO_MALLOC and
@@ -4503,9 +4509,14 @@ static int GetSignature(DecodedCert* cert);
 static word32 SetAlgoIDImpl(int algoOID, byte* output, int type, int curveSz, byte absentParams);
 #ifndef NO_CERTS
 static int DecodeAltNames(const byte* input, word32 sz, DecodedCert* cert);
+#if !defined(WOLFSSL_X509_TINY) || defined(WOLFSSL_X509_TINY_CRL_DP)
 static int DecodeCrlDist(const byte* input, word32 sz, DecodedCert* cert);
+#endif
+#if !defined(WOLFSSL_X509_TINY) || defined(WOLFSSL_X509_TINY_AIA)
 static int DecodeAuthInfo(const byte* input, word32 sz, DecodedCert* cert);
-#ifndef IGNORE_NAME_CONSTRAINTS
+#endif
+#if !defined(IGNORE_NAME_CONSTRAINTS) && \
+    (!defined(WOLFSSL_X509_TINY) || defined(WOLFSSL_X509_TINY_NAME_CONSTRAINTS))
 static int DecodeSubtree(const byte* input, word32 sz, Base_entry** head,
                          word32 limit, byte* hasUnsupported, void* heap);
 static int DecodeNameConstraints(const byte* input, word32 sz, DecodedCert* cert);
@@ -19344,6 +19355,7 @@ static int DecodeGeneralName(const byte* input, word32* inOutIdx, byte tag,
         }
     }
 #ifndef IGNORE_NAME_CONSTRAINTS
+#if !defined(WOLFSSL_X509_TINY) || defined(WOLFSSL_X509_TINY_SAN_DIR)
     /* GeneralName choice: directoryName */
     else if (tag == (ASN_CONTEXT_SPECIFIC | ASN_CONSTRUCTED | ASN_DIR_TYPE)) {
         int strLen;
@@ -19363,6 +19375,8 @@ static int DecodeGeneralName(const byte* input, word32* inOutIdx, byte tag,
             idx += (word32)len;
         }
     }
+#endif /* !WOLFSSL_X509_TINY || WOLFSSL_X509_TINY_SAN_DIR */
+#if !defined(WOLFSSL_X509_TINY) || defined(WOLFSSL_X509_TINY_SAN_EMAIL)
     /* GeneralName choice: rfc822Name */
     else if (tag == (ASN_CONTEXT_SPECIFIC | ASN_RFC822_TYPE)) {
         ret = SetDNSEntry(cert->heap, WC_DNS_POOL(cert),
@@ -19372,6 +19386,7 @@ static int DecodeGeneralName(const byte* input, word32* inOutIdx, byte tag,
             idx += (word32)len;
         }
     }
+#endif /* !WOLFSSL_X509_TINY || WOLFSSL_X509_TINY_SAN_EMAIL */
     /* GeneralName choice: uniformResourceIdentifier */
     else if (tag == (ASN_CONTEXT_SPECIFIC | ASN_URI_TYPE)) {
         WOLFSSL_MSG("\tPutting URI into list but not using");
@@ -19446,6 +19461,7 @@ static int DecodeGeneralName(const byte* input, word32* inOutIdx, byte tag,
      *     surface the raw octets as OCTET_STRING already (see the
      *     ASN_IP_TYPE case under WOLFSSL_GEN_IPADD in src/x509.c).
      */
+#if !defined(WOLFSSL_X509_TINY) || defined(WOLFSSL_X509_TINY_SAN_IP)
     else if (tag == (ASN_CONTEXT_SPECIFIC | ASN_IP_TYPE)) {
         ret = SetDNSEntry(cert->heap, WC_DNS_POOL(cert),
                 (const char*)(input + idx), len, ASN_IP_TYPE,
@@ -19454,6 +19470,7 @@ static int DecodeGeneralName(const byte* input, word32* inOutIdx, byte tag,
             idx += (word32)len;
         }
     }
+#endif /* !WOLFSSL_X509_TINY || WOLFSSL_X509_TINY_SAN_IP */
     /* GeneralName choice: registeredID
      *
      * Always parse registeredID into cert->altNames so
@@ -19479,6 +19496,7 @@ static int DecodeGeneralName(const byte* input, word32* inOutIdx, byte tag,
      *   - X509_print_name_entry: emits "Registered ID:<unavailable>"
      *     when ridString is not generated, instead of failing the
      *     whole print operation. */
+#if !defined(WOLFSSL_X509_TINY) || defined(WOLFSSL_X509_TINY_SAN_RID)
     else if (tag == (ASN_CONTEXT_SPECIFIC | ASN_RID_TYPE)) {
         ret = SetDNSEntry(cert->heap, WC_DNS_POOL(cert),
                 (const char*)(input + idx), len, ASN_RID_TYPE,
@@ -19487,6 +19505,7 @@ static int DecodeGeneralName(const byte* input, word32* inOutIdx, byte tag,
             idx += (word32)len;
         }
     }
+#endif /* !WOLFSSL_X509_TINY || WOLFSSL_X509_TINY_SAN_RID */
 #endif /* IGNORE_NAME_CONSTRAINTS */
 #ifndef IGNORE_NAME_CONSTRAINTS
     /* GeneralName choice: otherName.
@@ -19776,6 +19795,7 @@ static int DecodeBasicCaConstraintInternal(const byte* input, int sz,
 }
 
 
+#ifndef WOLFSSL_X509_TINY
 static int DecodePolicyConstraints(const byte* input, int sz, DecodedCert* cert)
 {
     word32 idx = 0;
@@ -19829,6 +19849,7 @@ static int DecodePolicyConstraints(const byte* input, int sz, DecodedCert* cert)
 
     return 0;
 }
+#endif /* !WOLFSSL_X509_TINY */
 
 
 /* Context-Specific value for: DistributionPoint.distributionPoint
@@ -19841,7 +19862,8 @@ static int DecodePolicyConstraints(const byte* input, int sz, DecodedCert* cert)
  * From RFC3280 SS4.2.1.7, GeneralName */
 #define GENERALNAME_URI     (ASN_CONTEXT_SPECIFIC | 6)
 
-#ifdef WOLFSSL_ASN_TEMPLATE
+#if defined(WOLFSSL_ASN_TEMPLATE) && \
+    (!defined(WOLFSSL_X509_TINY) || defined(WOLFSSL_X509_TINY_CRL_DP))
 /* ASN.1 template for CRL distribution points.
  * X.509: RFC 5280, 4.2.1.13 - CRL Distribution Points.
  */
@@ -19892,6 +19914,7 @@ enum {
  * @return  BUFFER_E when data in buffer is too small.
  */
 #ifdef WOLFSSL_ASN_TEMPLATE
+#if !defined(WOLFSSL_X509_TINY) || defined(WOLFSSL_X509_TINY_CRL_DP)
 static int DecodeCrlDist(const byte* input, word32 sz, DecodedCert* cert)
 {
     DECL_ASNGETDATA(dataASN, crlDistASN_Length);
@@ -19949,8 +19972,10 @@ static int DecodeCrlDist(const byte* input, word32 sz, DecodedCert* cert)
     FREE_ASNGETDATA(dataASN, cert->heap);
     return ret;
 }
+#endif /* !WOLFSSL_X509_TINY || WOLFSSL_X509_TINY_CRL_DP */
 #endif /* WOLFSSL_ASN_TEMPLATE */
-#ifdef WOLFSSL_ASN_TEMPLATE
+#if defined(WOLFSSL_ASN_TEMPLATE) && \
+    (!defined(WOLFSSL_X509_TINY) || defined(WOLFSSL_X509_TINY_AIA))
 /* ASN.1 template for the access description.
  * X.509: RFC 5280, 4.2.2.1 - Authority Information Access.
  */
@@ -19987,6 +20012,7 @@ enum {
  * @return  ASN_UNKNOWN_OID_E when the OID cannot be verified.
  */
 #ifdef WOLFSSL_ASN_TEMPLATE
+#if !defined(WOLFSSL_X509_TINY) || defined(WOLFSSL_X509_TINY_AIA)
 static int DecodeAuthInfo(const byte* input, word32 sz, DecodedCert* cert)
 {
     word32 idx = 0;
@@ -20055,6 +20081,7 @@ static int DecodeAuthInfo(const byte* input, word32 sz, DecodedCert* cert)
 
     return ret;
 }
+#endif /* !WOLFSSL_X509_TINY || WOLFSSL_X509_TINY_AIA */
 #endif /* WOLFSSL_ASN_TEMPLATE */
 
 #ifdef WOLFSSL_ASN_TEMPLATE
@@ -20195,6 +20222,7 @@ int DecodeAuthKeyId(const byte* input, word32 sz, const byte **extAuthKeyId,
  *          is invalid.
  * @return  BUFFER_E when data in buffer is too small.
  */
+#if !defined(WOLFSSL_X509_TINY) || defined(WOLFSSL_X509_TINY_AKI)
 static int DecodeAuthKeyIdInternal(const byte* input, word32 sz,
                                    DecodedCert* cert)
 {
@@ -20252,6 +20280,7 @@ static int DecodeAuthKeyIdInternal(const byte* input, word32 sz,
 
     return ret;
 }
+#endif /* !WOLFSSL_X509_TINY || WOLFSSL_X509_TINY_AKI */
 
 /* Decode subject key id extension.
  *
@@ -20296,6 +20325,7 @@ int DecodeSubjKeyId(const byte* input, word32 sz, const byte **extSubjKeyId,
  *          invalid.
  * @return  MEMORY_E on dynamic memory allocation failure.
  */
+#if !defined(WOLFSSL_X509_TINY) || defined(WOLFSSL_X509_TINY_SKI)
 static int DecodeSubjKeyIdInternal(const byte* input, word32 sz,
                                    DecodedCert* cert)
 {
@@ -20319,6 +20349,7 @@ static int DecodeSubjKeyIdInternal(const byte* input, word32 sz,
 
     return ret;
 }
+#endif /* !WOLFSSL_X509_TINY || WOLFSSL_X509_TINY_SKI */
 
 #ifdef WOLFSSL_ASN_TEMPLATE
 /* ASN.1 template for KeyUsage.
@@ -20599,6 +20630,7 @@ static int DecodeExtKeyUsageInternal(const byte* input, word32 sz,
 
 #ifndef IGNORE_NETSCAPE_CERT_TYPE
 
+#ifndef WOLFSSL_X509_TINY
 static int DecodeNsCertType(const byte* input, int sz, DecodedCert* cert)
 {
     word32 idx = 0;
@@ -20618,11 +20650,13 @@ static int DecodeNsCertType(const byte* input, int sz, DecodedCert* cert)
 
     return 0;
 }
+#endif /* !WOLFSSL_X509_TINY (DecodeNsCertType) */
 #endif
 
 
 #ifndef IGNORE_NAME_CONSTRAINTS
-#ifdef WOLFSSL_ASN_TEMPLATE
+#if defined(WOLFSSL_ASN_TEMPLATE) && \
+    (!defined(WOLFSSL_X509_TINY) || defined(WOLFSSL_X509_TINY_NAME_CONSTRAINTS))
 /* ASN.1 template for GeneralSubtree.
  * X.509: RFC 5280, 4.2.1.10 - Name Constraints.
  */
@@ -20646,7 +20680,8 @@ enum {
 #define subTreeASN_Length (sizeof(subTreeASN) / sizeof(ASNItem))
 #endif
 
-#ifdef WOLFSSL_ASN_TEMPLATE
+#if defined(WOLFSSL_ASN_TEMPLATE) && \
+    (!defined(WOLFSSL_X509_TINY) || defined(WOLFSSL_X509_TINY_NAME_CONSTRAINTS))
 /* Decode the Subtree's GeneralName.
  *
  * @param [in]      input  Buffer holding data.
@@ -20734,7 +20769,8 @@ static int DecodeSubtreeGeneralName(const byte* input, word32 sz, byte tag,
  * @return  MEMORY_E when dynamic memory allocation fails.
  * @return  ASN_PARSE_E when SEQUENCE is not found as expected.
  */
-#ifdef WOLFSSL_ASN_TEMPLATE
+#if defined(WOLFSSL_ASN_TEMPLATE) && \
+    (!defined(WOLFSSL_X509_TINY) || defined(WOLFSSL_X509_TINY_NAME_CONSTRAINTS))
 /* Decode a sub-tree of name constraints.
  *
  * @param [out]     hasUnsupported  Set to 1 when an entry with a GeneralName
@@ -20827,7 +20863,8 @@ static int DecodeSubtree(const byte* input, word32 sz, Base_entry** head,
     return ret;
 }
 #endif /* WOLFSSL_ASN_TEMPLATE */
-#ifdef WOLFSSL_ASN_TEMPLATE
+#if defined(WOLFSSL_ASN_TEMPLATE) && \
+    (!defined(WOLFSSL_X509_TINY) || defined(WOLFSSL_X509_TINY_NAME_CONSTRAINTS))
 /* ASN.1 template for NameConstraints.
  * X.509: RFC 5280, 4.2.1.10 - Name Constraints.
  */
@@ -20861,6 +20898,7 @@ enum {
  * @return  MEMORY_E on dynamic memory allocation failure.
  */
 #ifdef WOLFSSL_ASN_TEMPLATE
+#if !defined(WOLFSSL_X509_TINY) || defined(WOLFSSL_X509_TINY_NAME_CONSTRAINTS)
 static int DecodeNameConstraints(const byte* input, word32 sz,
     DecodedCert* cert)
 {
@@ -20905,6 +20943,7 @@ static int DecodeNameConstraints(const byte* input, word32 sz,
 
     return ret;
 }
+#endif /* !WOLFSSL_X509_TINY || WOLFSSL_X509_TINY_NAME_CONSTRAINTS */
 #endif /* WOLFSSL_ASN_TEMPLATE */
 #endif /* IGNORE_NAME_CONSTRAINTS */
 
@@ -21474,6 +21513,7 @@ WOLFSSL_TEST_VIS int DecodeExtensionType(const byte* input, word32 length,
     int ret = 0;
     word32 idx = 0;
 
+    (void)idx; /* unused when optional extension cases are gated out (X509_TINY) */
     if (isUnknownExt != NULL)
         *isUnknownExt = 0;
 
@@ -21487,6 +21527,7 @@ WOLFSSL_TEST_VIS int DecodeExtensionType(const byte* input, word32 length,
             }
             break;
 
+#if !defined(WOLFSSL_X509_TINY) || defined(WOLFSSL_X509_TINY_CRL_DP)
         /* CRL Distribution point. */
         case CRL_DIST_OID:
             VERIFY_AND_SET_OID(cert->extCRLdistSet);
@@ -21495,7 +21536,9 @@ WOLFSSL_TEST_VIS int DecodeExtensionType(const byte* input, word32 length,
                 ret = ASN_PARSE_E;
             }
             break;
+#endif /* !WOLFSSL_X509_TINY || WOLFSSL_X509_TINY_CRL_DP */
 
+#if !defined(WOLFSSL_X509_TINY) || defined(WOLFSSL_X509_TINY_AIA)
         /* Authority information access. */
         case AUTH_INFO_OID:
             VERIFY_AND_SET_OID(cert->extAuthInfoSet);
@@ -21516,6 +21559,15 @@ WOLFSSL_TEST_VIS int DecodeExtensionType(const byte* input, word32 length,
                 ret = ASN_PARSE_E;
             }
             break;
+#elif defined(WOLFSSL_X509_TINY)
+        /* Stripped: reject critical even under ALLOW_CRIT_AIA - can't honor an
+         * undecoded extension (RFC 5280 4.2.2.1). No SET_OID, bit means decoded. */
+        case AUTH_INFO_OID:
+            if (critical) {
+                ret = ASN_CRIT_EXT_E;
+            }
+            break;
+#endif /* !WOLFSSL_X509_TINY || WOLFSSL_X509_TINY_AIA */
 
         /* Subject alternative name. */
         case ALT_NAMES_OID:
@@ -21524,6 +21576,7 @@ WOLFSSL_TEST_VIS int DecodeExtensionType(const byte* input, word32 length,
             ret = DecodeAltNames(input, length, cert);
             break;
 
+#if !defined(WOLFSSL_X509_TINY) || defined(WOLFSSL_X509_TINY_AKI)
         /* Authority Key Identifier. */
         case AUTH_KEY_OID:
             VERIFY_AND_SET_OID(cert->extAuthKeyIdSet);
@@ -21544,7 +21597,17 @@ WOLFSSL_TEST_VIS int DecodeExtensionType(const byte* input, word32 length,
                 ret = ASN_PARSE_E;
             }
             break;
+#elif defined(WOLFSSL_X509_TINY)
+        /* Stripped: reject critical even under ALLOW_CRIT_AKID - can't honor an
+         * undecoded extension (RFC 5280 4.2.1.1). No SET_OID, bit means decoded. */
+        case AUTH_KEY_OID:
+            if (critical) {
+                ret = ASN_CRIT_EXT_E;
+            }
+            break;
+#endif /* !WOLFSSL_X509_TINY || WOLFSSL_X509_TINY_AKI */
 
+#if !defined(WOLFSSL_X509_TINY) || defined(WOLFSSL_X509_TINY_SKI)
         /* Subject Key Identifier. */
         case SUBJ_KEY_OID:
             VERIFY_AND_SET_OID(cert->extSubjKeyIdSet);
@@ -21566,7 +21629,17 @@ WOLFSSL_TEST_VIS int DecodeExtensionType(const byte* input, word32 length,
                 ret = ASN_PARSE_E;
             }
             break;
+#elif defined(WOLFSSL_X509_TINY)
+        /* Stripped: reject critical even under ALLOW_CRIT_SKID - can't honor an
+         * undecoded extension (RFC 5280 4.2.1.2). No SET_OID, bit means decoded. */
+        case SUBJ_KEY_OID:
+            if (critical) {
+                ret = ASN_CRIT_EXT_E;
+            }
+            break;
+#endif /* !WOLFSSL_X509_TINY || WOLFSSL_X509_TINY_SKI */
 
+#if !defined(WOLFSSL_X509_TINY) || defined(WOLFSSL_X509_TINY_POLICIES)
         /* Certificate policies. */
         case CERT_POLICY_OID:
         #if defined(WOLFSSL_SEP) || defined(WOLFSSL_CERT_EXT)
@@ -21593,6 +21666,7 @@ WOLFSSL_TEST_VIS int DecodeExtensionType(const byte* input, word32 length,
             #endif
         #endif
             break;
+#endif /* !WOLFSSL_X509_TINY || WOLFSSL_X509_TINY_POLICIES */
 
         /* Key usage. */
         case KEY_USAGE_OID:
@@ -21612,7 +21686,9 @@ WOLFSSL_TEST_VIS int DecodeExtensionType(const byte* input, word32 length,
             }
             break;
 
-        #ifndef IGNORE_NAME_CONSTRAINTS
+        #if !defined(IGNORE_NAME_CONSTRAINTS) && \
+            (!defined(WOLFSSL_X509_TINY) || \
+             defined(WOLFSSL_X509_TINY_NAME_CONSTRAINTS))
         /* Name constraints. */
         case NAME_CONS_OID:
         #ifndef WOLFSSL_NO_ASN_STRICT
@@ -21631,22 +21707,29 @@ WOLFSSL_TEST_VIS int DecodeExtensionType(const byte* input, word32 length,
                 ret = ASN_PARSE_E;
             }
             break;
-        #endif /* IGNORE_NAME_CONSTRAINTS */
+        #elif !defined(IGNORE_NAME_CONSTRAINTS)
+        /* TINY can't enforce name constraints; fail closed rather than ignore. */
+        case NAME_CONS_OID:
+            WOLFSSL_ERROR_VERBOSE(ASN_NAME_INVALID_E);
+            ret = ASN_NAME_INVALID_E;
+            break;
+        #endif /* NAME_CONS_OID (name constraints / TINY) */
 
+        #ifndef WOLFSSL_X509_TINY
         /* Inhibit anyPolicy. */
         case INHIBIT_ANY_OID:
             VERIFY_AND_SET_OID(cert->inhibitAnyOidSet);
             WOLFSSL_MSG("Inhibit anyPolicy extension not supported yet.");
             break;
 
-   #ifndef IGNORE_NETSCAPE_CERT_TYPE
+        #ifndef IGNORE_NETSCAPE_CERT_TYPE
         /* Netscape's certificate type. */
         case NETSCAPE_CT_OID:
             if (DecodeNsCertType(input, (int)length, cert) < 0)
                 ret = ASN_PARSE_E;
             break;
-    #endif
-    #ifdef HAVE_OCSP
+        #endif
+        #ifdef HAVE_OCSP
         /* OCSP no check. */
         case OCSP_NOCHECK_OID:
             VERIFY_AND_SET_OID(cert->ocspNoCheckSet);
@@ -21655,13 +21738,14 @@ WOLFSSL_TEST_VIS int DecodeExtensionType(const byte* input, word32 length,
                 ret = ASN_PARSE_E;
             }
             break;
-    #endif
+        #endif
         case POLICY_CONST_OID:
             VERIFY_AND_SET_OID(cert->extPolicyConstSet);
             cert->extPolicyConstCrit = critical ? 1 : 0;
             if (DecodePolicyConstraints(&input[idx], (int)length, cert) < 0)
                 return ASN_PARSE_E;
             break;
+        #endif /* !WOLFSSL_X509_TINY (inhibitAny/netscape/ocsp/policyConst) */
     #ifdef WOLFSSL_SUBJ_DIR_ATTR
         case SUBJ_DIR_ATTR_OID:
             VERIFY_AND_SET_OID(cert->extSubjDirAttrSet);
@@ -21707,7 +21791,9 @@ WOLFSSL_TEST_VIS int DecodeExtensionType(const byte* input, word32 length,
         default:
             if (isUnknownExt != NULL)
                 *isUnknownExt = 1;
-        #ifndef WOLFSSL_NO_ASN_STRICT
+        /* TINY reaches default: for stripped extensions too, so reject a
+         * critical one even under NO_ASN_STRICT to stay fail-closed. */
+        #if !defined(WOLFSSL_NO_ASN_STRICT) || defined(WOLFSSL_X509_TINY)
             /* While it is a failure to not support critical extensions,
              * still parse the certificate ignoring the unsupported
              * extension to allow caller to accept it with the verify
diff --git a/wolfcrypt/test/test.c b/wolfcrypt/test/test.c
index 7c04604dc1..25193ba8b7 100644
--- a/wolfcrypt/test/test.c
+++ b/wolfcrypt/test/test.c
@@ -1035,6 +1035,10 @@ WOLFSSL_TEST_SUBROUTINE wc_test_ret_t scrypt_test(void);
     defined(WOLFSSL_TSP_RESPONDER)
     WOLFSSL_TEST_SUBROUTINE wc_test_ret_t tsp_test(void);
 #endif
+#if defined(WOLFSSL_X509_TINY) && defined(HAVE_ECC) && \
+    !defined(NO_ECC256) && !defined(NO_ECC_SECP)
+WOLFSSL_TEST_SUBROUTINE wc_test_ret_t cert_x509_tiny_test(void);
+#endif
 #if !defined(NO_ASN_TIME) && !defined(NO_RSA) && defined(WOLFSSL_TEST_CERT) && \
     !defined(NO_FILESYSTEM)
 WOLFSSL_TEST_SUBROUTINE wc_test_ret_t cert_test(void);
@@ -3102,6 +3106,14 @@ options: [-s max_relative_stack_bytes] [-m max_relative_heap_memory_bytes]\n\
         TEST_PASS("FILL SIGNER test passed!\n");
 #endif
 
+#if defined(WOLFSSL_X509_TINY) && defined(HAVE_ECC) && \
+    !defined(NO_ECC256) && !defined(NO_ECC_SECP)
+    if ( (ret = cert_x509_tiny_test()) != 0)
+        TEST_FAIL("X509 TINY test failed!\n", ret);
+    else
+        TEST_PASS("X509 TINY test passed!\n");
+#endif
+
 #if defined(WOLFSSL_TEST_CERT) && defined(USE_CERT_BUFFERS_2048) && \
     !defined(NO_RSA)
     if ( (ret = cert_no_malloc_test()) != 0)
@@ -26399,6 +26411,172 @@ WOLFSSL_TEST_SUBROUTINE wc_test_ret_t cert_test(void)
 }
 #endif /* WOLFSSL_TEST_CERT */
 
+#if defined(WOLFSSL_X509_TINY) && defined(HAVE_ECC) && \
+    !defined(NO_ECC256) && !defined(NO_ECC_SECP)
+static const byte tinyCert_plain[] = {
+    0x30, 0x82, 0x01, 0xBA, 0x30, 0x82, 0x01, 0x60, 0xA0, 0x03, 0x02, 0x01,
+    0x02, 0x02, 0x14, 0x16, 0x9B, 0xFB, 0x03, 0x89, 0xD8, 0xB5, 0x62, 0x72,
+    0xAA, 0xD5, 0x32, 0x9C, 0x7A, 0x26, 0xEE, 0x3F, 0x74, 0xED, 0x5B, 0x30,
+    0x0A, 0x06, 0x08, 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x04, 0x03, 0x02, 0x30,
+    0x11, 0x31, 0x0F, 0x30, 0x0D, 0x06, 0x03, 0x55, 0x04, 0x03, 0x0C, 0x06,
+    0x61, 0x2E, 0x74, 0x65, 0x73, 0x74, 0x30, 0x1E, 0x17, 0x0D, 0x32, 0x36,
+    0x30, 0x36, 0x32, 0x39, 0x32, 0x31, 0x35, 0x34, 0x32, 0x37, 0x5A, 0x17,
+    0x0D, 0x32, 0x37, 0x30, 0x36, 0x32, 0x39, 0x32, 0x31, 0x35, 0x34, 0x32,
+    0x37, 0x5A, 0x30, 0x11, 0x31, 0x0F, 0x30, 0x0D, 0x06, 0x03, 0x55, 0x04,
+    0x03, 0x0C, 0x06, 0x61, 0x2E, 0x74, 0x65, 0x73, 0x74, 0x30, 0x59, 0x30,
+    0x13, 0x06, 0x07, 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x02, 0x01, 0x06, 0x08,
+    0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x03, 0x01, 0x07, 0x03, 0x42, 0x00, 0x04,
+    0x92, 0x60, 0x0B, 0x46, 0xDF, 0x03, 0xD7, 0x55, 0xE2, 0xA5, 0x9A, 0xE3,
+    0xC3, 0x0A, 0x7F, 0xC7, 0x4A, 0x3D, 0xA2, 0x78, 0xB5, 0xB9, 0x17, 0xD8,
+    0x11, 0x59, 0x20, 0x86, 0x2B, 0x71, 0x09, 0x6B, 0x47, 0x35, 0xAA, 0xB0,
+    0xCA, 0x48, 0x0E, 0x39, 0x2D, 0x01, 0x1C, 0xD7, 0x32, 0x17, 0x58, 0xBF,
+    0x20, 0x29, 0xDE, 0x88, 0xA7, 0xDD, 0x28, 0xED, 0xC5, 0x51, 0x32, 0x6F,
+    0x01, 0x76, 0x5C, 0xF7, 0xA3, 0x81, 0x95, 0x30, 0x81, 0x92, 0x30, 0x1D,
+    0x06, 0x03, 0x55, 0x1D, 0x0E, 0x04, 0x16, 0x04, 0x14, 0x6F, 0x14, 0xF7,
+    0xBC, 0xA8, 0x12, 0x67, 0x5E, 0xA5, 0xCF, 0x94, 0x87, 0xD8, 0x0C, 0x98,
+    0xFE, 0xF4, 0x8C, 0xE7, 0x35, 0x30, 0x1F, 0x06, 0x03, 0x55, 0x1D, 0x23,
+    0x04, 0x18, 0x30, 0x16, 0x80, 0x14, 0x6F, 0x14, 0xF7, 0xBC, 0xA8, 0x12,
+    0x67, 0x5E, 0xA5, 0xCF, 0x94, 0x87, 0xD8, 0x0C, 0x98, 0xFE, 0xF4, 0x8C,
+    0xE7, 0x35, 0x30, 0x0F, 0x06, 0x03, 0x55, 0x1D, 0x13, 0x01, 0x01, 0xFF,
+    0x04, 0x05, 0x30, 0x03, 0x01, 0x01, 0xFF, 0x30, 0x1D, 0x06, 0x03, 0x55,
+    0x1D, 0x11, 0x04, 0x16, 0x30, 0x14, 0x82, 0x06, 0x61, 0x2E, 0x74, 0x65,
+    0x73, 0x74, 0x82, 0x0A, 0x77, 0x77, 0x77, 0x2E, 0x61, 0x2E, 0x74, 0x65,
+    0x73, 0x74, 0x30, 0x0B, 0x06, 0x03, 0x55, 0x1D, 0x0F, 0x04, 0x04, 0x03,
+    0x02, 0x07, 0x80, 0x30, 0x13, 0x06, 0x03, 0x55, 0x1D, 0x25, 0x04, 0x0C,
+    0x30, 0x0A, 0x06, 0x08, 0x2B, 0x06, 0x01, 0x05, 0x05, 0x07, 0x03, 0x01,
+    0x30, 0x0A, 0x06, 0x08, 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x04, 0x03, 0x02,
+    0x03, 0x48, 0x00, 0x30, 0x45, 0x02, 0x20, 0x56, 0xC4, 0x82, 0x42, 0x72,
+    0x00, 0xF0, 0x9C, 0x9D, 0xA3, 0x08, 0x7D, 0xA1, 0xB1, 0x02, 0x73, 0x9C,
+    0x1C, 0x1D, 0x09, 0xB5, 0x0B, 0x64, 0xEA, 0xA8, 0xD3, 0x6F, 0x20, 0x63,
+    0xCD, 0xEF, 0x69, 0x02, 0x21, 0x00, 0x88, 0x9C, 0xBF, 0xF2, 0xC5, 0x7F,
+    0xD0, 0x76, 0xFD, 0x77, 0x22, 0xA7, 0xE1, 0xA5, 0xA0, 0xF2, 0x17, 0x4D,
+    0x47, 0xAF, 0x90, 0x70, 0x03, 0x82, 0x8D, 0xCA, 0xEA, 0x38, 0x8F, 0x5E,
+    0x37, 0xCA,
+};
+#ifndef WOLFSSL_NO_ASN_STRICT
+static const byte tinyCert_critUnknown[] = {
+    0x30, 0x82, 0x01, 0x9B, 0x30, 0x82, 0x01, 0x40, 0xA0, 0x03, 0x02, 0x01,
+    0x02, 0x02, 0x14, 0x11, 0xBD, 0xBB, 0x2B, 0x6D, 0x81, 0x95, 0xCF, 0xD1,
+    0x84, 0x74, 0xE2, 0x45, 0xF1, 0x4B, 0x1B, 0xEA, 0xC2, 0xBC, 0xD6, 0x30,
+    0x0A, 0x06, 0x08, 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x04, 0x03, 0x02, 0x30,
+    0x17, 0x31, 0x15, 0x30, 0x13, 0x06, 0x03, 0x55, 0x04, 0x03, 0x0C, 0x0C,
+    0x63, 0x72, 0x69, 0x74, 0x65, 0x78, 0x74, 0x2E, 0x74, 0x65, 0x73, 0x74,
+    0x30, 0x1E, 0x17, 0x0D, 0x32, 0x36, 0x30, 0x36, 0x33, 0x30, 0x32, 0x30,
+    0x31, 0x31, 0x32, 0x34, 0x5A, 0x17, 0x0D, 0x33, 0x36, 0x30, 0x36, 0x32,
+    0x37, 0x32, 0x30, 0x31, 0x31, 0x32, 0x34, 0x5A, 0x30, 0x17, 0x31, 0x15,
+    0x30, 0x13, 0x06, 0x03, 0x55, 0x04, 0x03, 0x0C, 0x0C, 0x63, 0x72, 0x69,
+    0x74, 0x65, 0x78, 0x74, 0x2E, 0x74, 0x65, 0x73, 0x74, 0x30, 0x59, 0x30,
+    0x13, 0x06, 0x07, 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x02, 0x01, 0x06, 0x08,
+    0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x03, 0x01, 0x07, 0x03, 0x42, 0x00, 0x04,
+    0x9D, 0xE8, 0xE5, 0xCA, 0x7A, 0x56, 0x38, 0xC6, 0x2F, 0x03, 0xA9, 0x26,
+    0x6A, 0x4A, 0x39, 0xFC, 0xC4, 0x99, 0xAD, 0xCE, 0x41, 0x17, 0xBE, 0x2C,
+    0xB9, 0x3E, 0xAB, 0x5F, 0x07, 0x77, 0x93, 0x8C, 0x3F, 0x9C, 0xF2, 0x95,
+    0x97, 0xE5, 0x01, 0x52, 0x30, 0x08, 0x2A, 0x19, 0x2B, 0x15, 0x68, 0xA3,
+    0x88, 0x79, 0x9D, 0xA2, 0x87, 0x69, 0x68, 0x85, 0x4F, 0x77, 0x2A, 0x1B,
+    0x06, 0xF6, 0xAD, 0x6A, 0xA3, 0x6A, 0x30, 0x68, 0x30, 0x1D, 0x06, 0x03,
+    0x55, 0x1D, 0x0E, 0x04, 0x16, 0x04, 0x14, 0x4B, 0x5C, 0x3E, 0xD2, 0x40,
+    0x91, 0x80, 0x56, 0xF4, 0xD1, 0xCB, 0x16, 0x56, 0x8B, 0x4F, 0xBC, 0x4F,
+    0xCA, 0xAD, 0x5C, 0x30, 0x1F, 0x06, 0x03, 0x55, 0x1D, 0x23, 0x04, 0x18,
+    0x30, 0x16, 0x80, 0x14, 0x4B, 0x5C, 0x3E, 0xD2, 0x40, 0x91, 0x80, 0x56,
+    0xF4, 0xD1, 0xCB, 0x16, 0x56, 0x8B, 0x4F, 0xBC, 0x4F, 0xCA, 0xAD, 0x5C,
+    0x30, 0x0F, 0x06, 0x03, 0x55, 0x1D, 0x13, 0x01, 0x01, 0xFF, 0x04, 0x05,
+    0x30, 0x03, 0x01, 0x01, 0xFF, 0x30, 0x15, 0x06, 0x09, 0x2B, 0x06, 0x01,
+    0x04, 0x01, 0x86, 0x8D, 0x1F, 0x01, 0x01, 0x01, 0xFF, 0x04, 0x05, 0x04,
+    0x03, 0x01, 0x02, 0x03, 0x30, 0x0A, 0x06, 0x08, 0x2A, 0x86, 0x48, 0xCE,
+    0x3D, 0x04, 0x03, 0x02, 0x03, 0x49, 0x00, 0x30, 0x46, 0x02, 0x21, 0x00,
+    0xD8, 0x78, 0x6A, 0x3F, 0xFC, 0x03, 0x1B, 0x7D, 0x8F, 0x8C, 0x2F, 0xC9,
+    0x80, 0x4B, 0x85, 0x5C, 0x2B, 0xF1, 0x52, 0x82, 0x94, 0x37, 0xE0, 0xA5,
+    0x49, 0x3F, 0x30, 0xBB, 0xC2, 0xBE, 0xC7, 0xE0, 0x02, 0x21, 0x00, 0xF5,
+    0xDD, 0x14, 0x04, 0xC8, 0xA2, 0xC0, 0x78, 0x13, 0x43, 0xE8, 0x97, 0xE1,
+    0xEB, 0xAE, 0x2A, 0x13, 0x3D, 0x46, 0xF3, 0x1D, 0x5D, 0xAA, 0x26, 0x95,
+    0x18, 0x71, 0x77, 0xF7, 0x46, 0x62, 0xD0,
+};
+#endif
+#ifndef IGNORE_NAME_CONSTRAINTS
+static const byte tinyCert_nameConstr[] = {
+    0x30, 0x82, 0x01, 0xA0, 0x30, 0x82, 0x01, 0x45, 0xA0, 0x03, 0x02, 0x01,
+    0x02, 0x02, 0x14, 0x41, 0x1A, 0x20, 0xA6, 0xAB, 0xF3, 0x59, 0x86, 0x30,
+    0xC2, 0x9A, 0xF6, 0x3F, 0x2B, 0x3D, 0x53, 0x46, 0x5B, 0x01, 0x41, 0x30,
+    0x0A, 0x06, 0x08, 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x04, 0x03, 0x02, 0x30,
+    0x15, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x03, 0x0C, 0x0A,
+    0x6E, 0x63, 0x2D, 0x63, 0x61, 0x2E, 0x74, 0x65, 0x73, 0x74, 0x30, 0x1E,
+    0x17, 0x0D, 0x32, 0x36, 0x30, 0x36, 0x33, 0x30, 0x32, 0x30, 0x31, 0x31,
+    0x32, 0x34, 0x5A, 0x17, 0x0D, 0x33, 0x36, 0x30, 0x36, 0x32, 0x37, 0x32,
+    0x30, 0x31, 0x31, 0x32, 0x34, 0x5A, 0x30, 0x15, 0x31, 0x13, 0x30, 0x11,
+    0x06, 0x03, 0x55, 0x04, 0x03, 0x0C, 0x0A, 0x6E, 0x63, 0x2D, 0x63, 0x61,
+    0x2E, 0x74, 0x65, 0x73, 0x74, 0x30, 0x59, 0x30, 0x13, 0x06, 0x07, 0x2A,
+    0x86, 0x48, 0xCE, 0x3D, 0x02, 0x01, 0x06, 0x08, 0x2A, 0x86, 0x48, 0xCE,
+    0x3D, 0x03, 0x01, 0x07, 0x03, 0x42, 0x00, 0x04, 0x9D, 0xE8, 0xE5, 0xCA,
+    0x7A, 0x56, 0x38, 0xC6, 0x2F, 0x03, 0xA9, 0x26, 0x6A, 0x4A, 0x39, 0xFC,
+    0xC4, 0x99, 0xAD, 0xCE, 0x41, 0x17, 0xBE, 0x2C, 0xB9, 0x3E, 0xAB, 0x5F,
+    0x07, 0x77, 0x93, 0x8C, 0x3F, 0x9C, 0xF2, 0x95, 0x97, 0xE5, 0x01, 0x52,
+    0x30, 0x08, 0x2A, 0x19, 0x2B, 0x15, 0x68, 0xA3, 0x88, 0x79, 0x9D, 0xA2,
+    0x87, 0x69, 0x68, 0x85, 0x4F, 0x77, 0x2A, 0x1B, 0x06, 0xF6, 0xAD, 0x6A,
+    0xA3, 0x73, 0x30, 0x71, 0x30, 0x1D, 0x06, 0x03, 0x55, 0x1D, 0x0E, 0x04,
+    0x16, 0x04, 0x14, 0x4B, 0x5C, 0x3E, 0xD2, 0x40, 0x91, 0x80, 0x56, 0xF4,
+    0xD1, 0xCB, 0x16, 0x56, 0x8B, 0x4F, 0xBC, 0x4F, 0xCA, 0xAD, 0x5C, 0x30,
+    0x1F, 0x06, 0x03, 0x55, 0x1D, 0x23, 0x04, 0x18, 0x30, 0x16, 0x80, 0x14,
+    0x4B, 0x5C, 0x3E, 0xD2, 0x40, 0x91, 0x80, 0x56, 0xF4, 0xD1, 0xCB, 0x16,
+    0x56, 0x8B, 0x4F, 0xBC, 0x4F, 0xCA, 0xAD, 0x5C, 0x30, 0x0F, 0x06, 0x03,
+    0x55, 0x1D, 0x13, 0x01, 0x01, 0xFF, 0x04, 0x05, 0x30, 0x03, 0x01, 0x01,
+    0xFF, 0x30, 0x1E, 0x06, 0x03, 0x55, 0x1D, 0x1E, 0x01, 0x01, 0xFF, 0x04,
+    0x14, 0x30, 0x12, 0xA0, 0x10, 0x30, 0x0E, 0x82, 0x0C, 0x2E, 0x65, 0x78,
+    0x61, 0x6D, 0x70, 0x6C, 0x65, 0x2E, 0x63, 0x6F, 0x6D, 0x30, 0x0A, 0x06,
+    0x08, 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x04, 0x03, 0x02, 0x03, 0x49, 0x00,
+    0x30, 0x46, 0x02, 0x21, 0x00, 0xE8, 0xA6, 0xDE, 0xE4, 0x18, 0x4E, 0x7B,
+    0x04, 0x4F, 0xA4, 0xBE, 0x7B, 0x31, 0x97, 0x36, 0x9A, 0x2B, 0xF8, 0x21,
+    0x4E, 0xBD, 0xDB, 0x1A, 0x65, 0x3C, 0xEB, 0xCC, 0xF3, 0x01, 0xB8, 0xBD,
+    0xF6, 0x02, 0x21, 0x00, 0x83, 0xAE, 0x5E, 0x31, 0xE7, 0xF3, 0x7A, 0x70,
+    0x18, 0x05, 0xAC, 0xAD, 0x49, 0x88, 0x28, 0x39, 0xBD, 0xCD, 0x73, 0xFE,
+    0x0A, 0x74, 0x98, 0x11, 0x3F, 0xFA, 0xF1, 0x18, 0xCF, 0x4E, 0x4E, 0x93,
+};
+#endif
+
+/* Exercise the WOLFSSL_X509_TINY profile: a normal cert still parses, a
+ * critical unknown extension is rejected, and nameConstraints fails closed
+ * unless the add-back is enabled. Self-signed P-256, parsed with NO_VERIFY. */
+WOLFSSL_TEST_SUBROUTINE wc_test_ret_t cert_x509_tiny_test(void)
+{
+    wc_test_ret_t ret;
+    DecodedCert cert;
+
+    InitDecodedCert(&cert, tinyCert_plain, (word32)sizeof(tinyCert_plain), NULL);
+    ret = ParseCert(&cert, CERT_TYPE, NO_VERIFY, NULL);
+    FreeDecodedCert(&cert);
+    if (ret != 0)
+        return WC_TEST_RET_ENC_EC(ret);
+
+#ifndef WOLFSSL_NO_ASN_STRICT
+    InitDecodedCert(&cert, tinyCert_critUnknown,
+                    (word32)sizeof(tinyCert_critUnknown), NULL);
+    ret = ParseCert(&cert, CERT_TYPE, NO_VERIFY, NULL);
+    FreeDecodedCert(&cert);
+    if (ret == 0)                            /* expected rejection, got accept */
+        return WC_TEST_RET_ENC_NC;
+    if (ret != WC_NO_ERR_TRACE(ASN_CRIT_EXT_E))
+        return WC_TEST_RET_ENC_EC(ret);
+#endif
+
+#ifndef IGNORE_NAME_CONSTRAINTS
+    InitDecodedCert(&cert, tinyCert_nameConstr,
+                    (word32)sizeof(tinyCert_nameConstr), NULL);
+    ret = ParseCert(&cert, CERT_TYPE, NO_VERIFY, NULL);
+    FreeDecodedCert(&cert);
+#ifdef WOLFSSL_X509_TINY_NAME_CONSTRAINTS
+    if (ret != 0)
+        return WC_TEST_RET_ENC_EC(ret);
+#else
+    if (ret == 0)                            /* expected rejection, got accept */
+        return WC_TEST_RET_ENC_NC;
+    if (ret != WC_NO_ERR_TRACE(ASN_NAME_INVALID_E))
+        return WC_TEST_RET_ENC_EC(ret);
+#endif
+#endif
+
+    return 0;
+}
+#endif /* WOLFSSL_X509_TINY && HAVE_ECC */
+
 #if defined(WOLFSSL_TEST_CERT) && defined(USE_CERT_BUFFERS_2048) && \
     !defined(NO_RSA)
 /* Heap/file-free parse from a const DER buffer; checks in-place refs under
diff --git a/wolfssl/wolfcrypt/settings.h b/wolfssl/wolfcrypt/settings.h
index 711bf7a312..a814d912b0 100644
--- a/wolfssl/wolfcrypt/settings.h
+++ b/wolfssl/wolfcrypt/settings.h
@@ -4754,6 +4754,57 @@ blinding by defining WC_BLINDING_NO_RNG_ACKNOWLEDGE_WEAKNESS."
     #define OPENSSL_EXTRA_X509_SMALL
 #endif /* OPENSSL_EXTRA */
 
+/* X.509 verify-only profile. Define WOLFSSL_X509_PEM (or a gen add-back) to keep
+ * PEM parsing, else WOLFSSL_NO_PEM below also disables PEM-to-DER trust anchors. */
+#ifdef WOLFSSL_X509_VERIFY_ONLY
+    #if !defined(WOLFSSL_X509_PEM) && !defined(WOLFSSL_NO_PEM) && \
+        !defined(WOLFSSL_X509_CERT_GEN) && !defined(WOLFSSL_X509_KEY_GEN)
+        #define WOLFSSL_NO_PEM
+    #endif
+    #if !defined(WOLFSSL_X509_CERT_GEN)
+        #undef WOLFSSL_CERT_GEN
+    #endif
+    #if !defined(WOLFSSL_X509_KEY_GEN)
+        #undef WOLFSSL_KEY_GEN
+    #endif
+#endif
+
+/* TINY gates live only in the template decoder; asn_orig.c would silently
+ * ignore the profile. */
+#if defined(WOLFSSL_X509_TINY) && !defined(WOLFSSL_ASN_TEMPLATE)
+    #error "WOLFSSL_X509_TINY requires WOLFSSL_ASN_TEMPLATE"
+#endif
+
+/* TINY name-constraint enforcement needs the SAN forms it checks to be parsed;
+ * force those SAN add-backs on so enforcement is never silently partial. */
+#if defined(WOLFSSL_X509_TINY) && defined(WOLFSSL_X509_TINY_NAME_CONSTRAINTS)
+    #ifndef WOLFSSL_X509_TINY_SAN_EMAIL
+        #define WOLFSSL_X509_TINY_SAN_EMAIL
+    #endif
+    #ifndef WOLFSSL_X509_TINY_SAN_IP
+        #define WOLFSSL_X509_TINY_SAN_IP
+    #endif
+    #ifndef WOLFSSL_X509_TINY_SAN_DIR
+        #define WOLFSSL_X509_TINY_SAN_DIR
+    #endif
+    #ifndef WOLFSSL_X509_TINY_SAN_RID
+        #define WOLFSSL_X509_TINY_SAN_RID
+    #endif
+#endif
+
+/* Revocation consumers need the locator extensions parsed, else they fail open
+ * (OCSP would assume CERT_GOOD) or silently lose CDP auto-fetch. */
+#if defined(WOLFSSL_X509_TINY) && defined(HAVE_OCSP)
+    #ifndef WOLFSSL_X509_TINY_AIA
+        #define WOLFSSL_X509_TINY_AIA
+    #endif
+#endif
+#if defined(WOLFSSL_X509_TINY) && defined(HAVE_CRL_IO)
+    #ifndef WOLFSSL_X509_TINY_CRL_DP
+        #define WOLFSSL_X509_TINY_CRL_DP
+    #endif
+#endif
+
 /* support for converting DER to PEM */
 #if (defined(WOLFSSL_KEY_GEN) && !defined(WOLFSSL_NO_DER_TO_PEM)) || \
     defined(WOLFSSL_CERT_GEN) || defined(OPENSSL_EXTRA)