LGTM. Five coordinated changes all map to specific Node/OpenSSL behavior gaps:

1. PEM header normalization — normalize_pem_headers rewrites TRUSTED CERTIFICATE and X509 CERTIFICATE to CERTIFICATE before rustls_pemfile::certs parses. Fast-path with windows(N).any(...) avoids allocation when no rewrite is needed. PEM body is base64 (no spaces) so the substrings can't appear inside the data — the textual search is safe. Applied symmetrically in both build_client_config and build_server_config.

2. X.509v1 chain verification via DER walking — replaces the prior "blindly accept v1 certs (skips chain check entirely)" workaround. The new verify_chain_structure walks issuer→subject DER name matches up the chain and returns the right Node code (UNABLE_TO_GET_ISSUER_CERT_LOCALLY if no explicit CA was provided, UNABLE_TO_VERIFY_LEAF_SIGNATURE if it was) when the chain doesn't reach a trusted root. Iteration cap intermediates.len() + 2 defends against cycles. The der_read_element walker correctly handles short-form (<0x80) and long-form (multi-byte) length octets, rejects num_bytes=0 and num_bytes>4, and validates input bounds before slicing.

3. NodeClientCertVerifier::verify_client_cert always succeeds — stores the error in a shared verify_error: VerifyErrorStore and lets the TLS handshake complete. JS onServerSocketSecure then drives rejection via socket.destroy(), producing client-side ECONNRESET instead of a TLS fatal alert. Matches Node/OpenSSL exactly. The store is shared with TLSWrapInner.verify_error via inner.verify_error = client_cert_verify_error so verifyError() on the server-side TLSWrap returns the right code.

4. CertificateRequired alert mapping with TLS-version branching — protocol_version() is now threaded into rustls_error_to_node_error. TLS 1.2 rustls→OpenSSL gets SSLV3_ALERT_HANDSHAKE_FAILURE (matching OpenSSL's TLS 1.2 alert numbering), TLS 1.3 gets TLSV13_ALERT_CERTIFICATE_REQUIRED.

5. Error code accuracy — UNABLE_TO_VERIFY_LEAF_SIGNATURE vs UNABLE_TO_GET_ISSUER_CERT_LOCALLY distinction now keyed on whether explicit CAs were provided, matching OpenSSL's reporting.

Test enrollment alphabetically positioned correctly (client-abort2 < client-auth < client-renegotiation-limit).

CI fully green: 110/110 checks pass.

One observation worth keeping in mind (not blocking): the structural chain check in (2) doesn't verify signatures, validity dates, key usage, or path constraints — it's a graceful degradation for v1 certs that webpki refuses to parse. The comment header acknowledges this. For v3 certs the normal webpki path runs first and only falls through to the structural check on the specific UnsupportedCertVersion / BadEncoding errors, so this only relaxes verification for certs OpenSSL would have accepted with full v1 fallback semantics anyway.