diff --git a/Data/Certificate/X509/Ext.hs b/Data/Certificate/X509/Ext.hs
--- a/Data/Certificate/X509/Ext.hs
+++ b/Data/Certificate/X509/Ext.hs
@@ -79,7 +79,7 @@
 
 instance Extension ExtKeyUsage where
 	extOID = const [2,5,29,15]
-	extEncode (ExtKeyUsage _) = undefined
+	extEncode (ExtKeyUsage flags) = [BitString $ flagsToBits flags]
 	extDecode [BitString bits] = Right $ ExtKeyUsage $ bitsToFlags bits
 	extDecode _ = Left "unknown sequence"
 
@@ -88,7 +88,7 @@
 
 instance Extension ExtSubjectKeyId where
 	extOID = const [2,5,29,14]
-	extEncode (ExtSubjectKeyId _) = undefined
+	extEncode (ExtSubjectKeyId o) = [OctetString o]
 	extDecode [OctetString o] = Right $ ExtSubjectKeyId o
 	extDecode _ = Left "unknown sequence"
 
@@ -97,7 +97,10 @@
 
 instance Extension ExtSubjectAltName where
 	extOID = const [2,5,29,17]
-	extEncode (ExtSubjectAltName _) = undefined
+	extEncode (ExtSubjectAltName names) =
+		[Start Sequence]
+		++ map (Other Context 2 . BC.pack) names
+		++ [End Sequence]
 	extDecode l = runParseASN1 parse l where
 		parse = do
 			c <- getNextContainer Sequence
@@ -110,7 +113,8 @@
 
 instance Extension ExtAuthorityKeyId where
 	extOID _ = [2,5,29,35]
-	extEncode (ExtAuthorityKeyId _) = undefined
+	extEncode (ExtAuthorityKeyId keyid) =
+		[Start Sequence,Other Context 0 keyid,End Sequence]
 	extDecode [Start Sequence,Other Context 0 keyid,End Sequence] =
 		Right $ ExtAuthorityKeyId keyid
 	extDecode _ = Left "unknown sequence"
@@ -119,3 +123,7 @@
 bitsToFlags bits = concat $ flip map [0..(bitArrayLength bits-1)] $ \i -> do
 	let isSet = bitArrayGetBit bits i
 	if isSet then [toEnum $ fromIntegral i] else []
+
+flagsToBits :: Enum a => [a] -> BitArray
+flagsToBits flags = foldl bitArraySetBit bitArrayEmpty $ map (fromIntegral . fromEnum) flags
+	where bitArrayEmpty = BitArray 2 (L.pack [0,0])
diff --git a/System/Certificate/X509/MacOS.hs b/System/Certificate/X509/MacOS.hs
--- a/System/Certificate/X509/MacOS.hs
+++ b/System/Certificate/X509/MacOS.hs
@@ -11,10 +11,13 @@
 import Data.Either
 import Data.Maybe
 
+keyChain :: String
+keyChain = "/System/Library/Keychains/SystemRootCertificates.keychain"
+
 findCertificate :: (X509 -> Bool) -> IO (Maybe X509)
 findCertificate f = do
-  (_, h, _, ph) <- runInteractiveCommand "security find-certificate -pa"
-  waitForProcess ph
-  pems <- parsePEMs <$> hGetContents h
+  (_, Just hout, _, ph) <- createProcess (proc "security" ["find-certificate", "-pa", keyChain]) { std_out = CreatePipe }
+  pems <- parsePEMs <$> hGetContents hout
+  _ <- waitForProcess ph
   let targets = rights $ map (decodeCertificate . LBS.fromChunks .  pure . snd) $ filter ((=="CERTIFICATE") . fst) pems
   return $ listToMaybe $ filter f targets
diff --git a/certificate.cabal b/certificate.cabal
--- a/certificate.cabal
+++ b/certificate.cabal
@@ -1,5 +1,5 @@
 Name:                certificate
-Version:             1.1.0
+Version:             1.1.1
 Description:
     Certificates and Key reader/writer
     .
@@ -29,7 +29,7 @@
   Build-Depends:     base >= 3 && < 5
                    , bytestring
                    , mtl
-                   , asn1-data >= 0.6.1 && < 0.7
+                   , asn1-data >= 0.6.1.3 && < 0.7
                    , base64-bytestring
                    , crypto-pubkey-types
                    , directory