diff --git a/tests/suites/test_suite_x509parse.data b/tests/suites/test_suite_x509parse.data
index a0e5146f2a..3df0982675 100644
--- a/tests/suites/test_suite_x509parse.data
+++ b/tests/suites/test_suite_x509parse.data
@@ -696,6 +696,9 @@ x509parse_crt:"301c301aa0030201028204deadbeef300d06092a864886f70d0101020500":"":
 X509 Certificate ASN1 (TBSCertificate, correct alg, unknown specific alg_id)
 x509parse_crt:"301c301aa0030201028204deadbeef300d06092a864886f70d0101010500":"":POLARSSL_ERR_X509_UNKNOWN_SIG_ALG + POLARSSL_ERR_OID_NOT_FOUND
 
+X509 Certificate ASN1 (TBSCertificate, correct alg, bad RSASSA-PSS params)
+x509parse_crt:"30193017A003020102020118300D06092A864886F70D01010A3100":"":POLARSSL_ERR_X509_INVALID_ALG + POLARSSL_ERR_ASN1_UNEXPECTED_TAG
+
 X509 Certificate ASN1 (TBSCertificate, issuer no set data)
 x509parse_crt:"301e301ca0030201028204deadbeef300d06092a864886f70d01010205003000":"":POLARSSL_ERR_X509_INVALID_NAME + POLARSSL_ERR_ASN1_OUT_OF_DATA
 
@@ -1051,3 +1054,105 @@ X509 crt extendedKeyUsage #7 (any, random)
 depends_on:POLARSSL_ECP_DP_SECP256R1_ENABLED
 x509_check_extended_key_usage:"data_files/server5.eku-cs_any.crt":"2B060105050703FF":0
 
+X509 RSASSA-PSS parameters ASN1 (good, all defaults)
+x509_parse_rsassa_pss_params:"":ASN1_CONSTRUCTED | ASN1_SEQUENCE:POLARSSL_MD_SHA1:POLARSSL_MD_SHA1:20:0
+
+X509 RSASSA-PSS parameters ASN1 (wrong initial tag)
+x509_parse_rsassa_pss_params:"":ASN1_SEQUENCE:POLARSSL_MD_SHA1:POLARSSL_MD_SHA1:20:POLARSSL_ERR_X509_INVALID_ALG + POLARSSL_ERR_ASN1_UNEXPECTED_TAG
+
+X509 RSASSA-PSS parameters ASN1 (unknown tag in top-level sequence)
+x509_parse_rsassa_pss_params:"A400":ASN1_CONSTRUCTED | ASN1_SEQUENCE:POLARSSL_MD_SHA1:POLARSSL_MD_SHA1:20:POLARSSL_ERR_X509_INVALID_ALG + POLARSSL_ERR_ASN1_LENGTH_MISMATCH
+
+X509 RSASSA-PSS parameters ASN1 (good, HashAlg SHA256)
+x509_parse_rsassa_pss_params:"A00D300B0609608648016503040201":ASN1_CONSTRUCTED | ASN1_SEQUENCE:POLARSSL_MD_SHA256:POLARSSL_MD_SHA1:20:0
+
+X509 RSASSA-PSS parameters ASN1 (good, explicit HashAlg = default)
+x509_parse_rsassa_pss_params:"A009300706052B0E03021A":ASN1_CONSTRUCTED | ASN1_SEQUENCE:POLARSSL_MD_SHA1:POLARSSL_MD_SHA1:20:0
+
+X509 RSASSA-PSS parameters ASN1 (HashAlg wrong len #1)
+x509_parse_rsassa_pss_params:"A00A300706052B0E03021A":ASN1_CONSTRUCTED | ASN1_SEQUENCE:POLARSSL_MD_SHA1:POLARSSL_MD_SHA1:20:POLARSSL_ERR_X509_INVALID_ALG + POLARSSL_ERR_ASN1_OUT_OF_DATA
+
+X509 RSASSA-PSS parameters ASN1 (HashAlg wrong len #2)
+x509_parse_rsassa_pss_params:"A00A300706052B0E03021A00":ASN1_CONSTRUCTED | ASN1_SEQUENCE:POLARSSL_MD_SHA1:POLARSSL_MD_SHA1:20:POLARSSL_ERR_X509_INVALID_ALG + POLARSSL_ERR_ASN1_LENGTH_MISMATCH
+
+X509 RSASSA-PSS parameters ASN1 (HashAlg with parameters)
+x509_parse_rsassa_pss_params:"A00F300D06096086480165030402013000":ASN1_CONSTRUCTED | ASN1_SEQUENCE:POLARSSL_MD_SHA256:POLARSSL_MD_SHA1:20:POLARSSL_ERR_X509_INVALID_ALG + POLARSSL_ERR_ASN1_INVALID_DATA
+
+X509 RSASSA-PSS parameters ASN1 (HashAlg unkown OID)
+x509_parse_rsassa_pss_params:"A00D300B06096086480165030402FF":ASN1_CONSTRUCTED | ASN1_SEQUENCE:POLARSSL_MD_SHA256:POLARSSL_MD_SHA1:20:POLARSSL_ERR_X509_INVALID_ALG + POLARSSL_ERR_OID_NOT_FOUND
+
+X509 RSASSA-PSS parameters ASN1 (good, MGAlg = MGF1-SHA256)
+x509_parse_rsassa_pss_params:"A11A301806092A864886F70D010108300B0609608648016503040201":ASN1_CONSTRUCTED | ASN1_SEQUENCE:POLARSSL_MD_SHA1:POLARSSL_MD_SHA256:20:0
+
+X509 RSASSA-PSS parameters ASN1 (good, explicit MGAlg = default)
+x509_parse_rsassa_pss_params:"A116301406092A864886F70D010108300706052B0E03021A":ASN1_CONSTRUCTED | ASN1_SEQUENCE:POLARSSL_MD_SHA1:POLARSSL_MD_SHA1:20:0
+
+X509 RSASSA-PSS parameters ASN1 (MGAlg wrong len #1)
+x509_parse_rsassa_pss_params:"A11B301806092A864886F70D010108300B0609608648016503040201":ASN1_CONSTRUCTED | ASN1_SEQUENCE:POLARSSL_MD_SHA1:POLARSSL_MD_SHA256:20:POLARSSL_ERR_X509_INVALID_ALG + POLARSSL_ERR_ASN1_OUT_OF_DATA
+
+X509 RSASSA-PSS parameters ASN1 (MGAlg wrong len #2)
+x509_parse_rsassa_pss_params:"A11B301806092A864886F70D010108300B060960864801650304020100":ASN1_CONSTRUCTED | ASN1_SEQUENCE:POLARSSL_MD_SHA1:POLARSSL_MD_SHA256:20:POLARSSL_ERR_X509_INVALID_ALG + POLARSSL_ERR_ASN1_LENGTH_MISMATCH
+
+X509 RSASSA-PSS parameters ASN1 (MGAlg AlgId wrong len #1)
+x509_parse_rsassa_pss_params:"A11A301906092A864886F70D010108300B0609608648016503040201":ASN1_CONSTRUCTED | ASN1_SEQUENCE:POLARSSL_MD_SHA1:POLARSSL_MD_SHA256:20:POLARSSL_ERR_X509_INVALID_ALG + POLARSSL_ERR_ASN1_OUT_OF_DATA
+
+X509 RSASSA-PSS parameters ASN1 (MGAlg OID != MGF1)
+x509_parse_rsassa_pss_params:"A11A301806092A864886F70D010109300B0609608648016503040201":ASN1_CONSTRUCTED | ASN1_SEQUENCE:POLARSSL_MD_SHA1:POLARSSL_MD_SHA256:20:POLARSSL_ERR_X509_FEATURE_UNAVAILABLE + POLARSSL_ERR_OID_NOT_FOUND
+
+X509 RSASSA-PSS parameters ASN1 (MGAlg.params wrong tag)
+x509_parse_rsassa_pss_params:"A11A301806092A864886F70D010108310B0609608648016503040201":ASN1_CONSTRUCTED | ASN1_SEQUENCE:POLARSSL_MD_SHA1:POLARSSL_MD_SHA256:20:POLARSSL_ERR_X509_INVALID_ALG + POLARSSL_ERR_ASN1_UNEXPECTED_TAG
+
+X509 RSASSA-PSS parameters ASN1 (MGAlg.params wrong len #1a)
+x509_parse_rsassa_pss_params:"A10F300D06092A864886F70D0101083000":ASN1_CONSTRUCTED | ASN1_SEQUENCE:POLARSSL_MD_SHA1:POLARSSL_MD_SHA256:20:POLARSSL_ERR_X509_INVALID_ALG + POLARSSL_ERR_ASN1_OUT_OF_DATA
+
+X509 RSASSA-PSS parameters ASN1 (MGAlg.params wrong len #1b)
+x509_parse_rsassa_pss_params:"A11B301906092A864886F70D010108300C0609608648016503040201":ASN1_CONSTRUCTED | ASN1_SEQUENCE:POLARSSL_MD_SHA1:POLARSSL_MD_SHA256:20:POLARSSL_ERR_X509_INVALID_ALG + POLARSSL_ERR_ASN1_OUT_OF_DATA
+
+X509 RSASSA-PSS parameters ASN1 (MGAlg.params.alg not an OID)
+x509_parse_rsassa_pss_params:"A11A301806092A864886F70D010108300B0709608648016503040201":ASN1_CONSTRUCTED | ASN1_SEQUENCE:POLARSSL_MD_SHA1:POLARSSL_MD_SHA256:20:POLARSSL_ERR_X509_INVALID_ALG + POLARSSL_ERR_ASN1_UNEXPECTED_TAG
+
+X509 RSASSA-PSS parameters ASN1 (MGAlg.params.alg unknown OID)
+x509_parse_rsassa_pss_params:"A11A301806092A864886F70D010108300B06096086480165030402FF":ASN1_CONSTRUCTED | ASN1_SEQUENCE:POLARSSL_MD_SHA1:POLARSSL_MD_SHA256:20:POLARSSL_ERR_X509_INVALID_ALG + POLARSSL_ERR_OID_NOT_FOUND
+
+X509 RSASSA-PSS parameters ASN1 (MGAlg.params.params NULL)
+x509_parse_rsassa_pss_params:"A11C301A06092A864886F70D010108300D06096086480165030402010500":ASN1_CONSTRUCTED | ASN1_SEQUENCE:POLARSSL_MD_SHA1:POLARSSL_MD_SHA256:20:0
+
+X509 RSASSA-PSS parameters ASN1 (MGAlg.params.params wrong tag)
+x509_parse_rsassa_pss_params:"A11C301A06092A864886F70D010108300D06096086480165030402013000":ASN1_CONSTRUCTED | ASN1_SEQUENCE:POLARSSL_MD_SHA1:POLARSSL_MD_SHA256:20:POLARSSL_ERR_X509_INVALID_ALG + POLARSSL_ERR_ASN1_UNEXPECTED_TAG
+
+X509 RSASSA-PSS parameters ASN1 (MGAlg.params wrong len #1c)
+x509_parse_rsassa_pss_params:"A11D301B06092A864886F70D010108300E06096086480165030402010500":ASN1_CONSTRUCTED | ASN1_SEQUENCE:POLARSSL_MD_SHA1:POLARSSL_MD_SHA256:20:POLARSSL_ERR_X509_INVALID_ALG + POLARSSL_ERR_ASN1_OUT_OF_DATA
+
+X509 RSASSA-PSS parameters ASN1 (MGAlg.params wrong len #2)
+x509_parse_rsassa_pss_params:"A11D301B06092A864886F70D010108300E0609608648016503040201050000":ASN1_CONSTRUCTED | ASN1_SEQUENCE:POLARSSL_MD_SHA1:POLARSSL_MD_SHA256:20:POLARSSL_ERR_X509_INVALID_ALG + POLARSSL_ERR_ASN1_LENGTH_MISMATCH
+
+X509 RSASSA-PSS parameters ASN1 (good, saltLen = 94)
+x509_parse_rsassa_pss_params:"A20302015E":ASN1_CONSTRUCTED | ASN1_SEQUENCE:POLARSSL_MD_SHA1:POLARSSL_MD_SHA1:94:0
+
+X509 RSASSA-PSS parameters ASN1 (good, explicit saltLen = default)
+x509_parse_rsassa_pss_params:"A203020114":ASN1_CONSTRUCTED | ASN1_SEQUENCE:POLARSSL_MD_SHA1:POLARSSL_MD_SHA1:20:0
+
+X509 RSASSA-PSS parameters ASN1 (saltLen wrong len #1)
+x509_parse_rsassa_pss_params:"A20402015E":ASN1_CONSTRUCTED | ASN1_SEQUENCE:POLARSSL_MD_SHA1:POLARSSL_MD_SHA1:94:POLARSSL_ERR_X509_INVALID_ALG + POLARSSL_ERR_ASN1_OUT_OF_DATA
+
+X509 RSASSA-PSS parameters ASN1 (saltLen wrong len #2)
+x509_parse_rsassa_pss_params:"A20402015E00":ASN1_CONSTRUCTED | ASN1_SEQUENCE:POLARSSL_MD_SHA1:POLARSSL_MD_SHA1:94:POLARSSL_ERR_X509_INVALID_ALG + POLARSSL_ERR_ASN1_LENGTH_MISMATCH
+
+X509 RSASSA-PSS parameters ASN1 (saltLen not an int)
+x509_parse_rsassa_pss_params:"A2023000":ASN1_CONSTRUCTED | ASN1_SEQUENCE:POLARSSL_MD_SHA1:POLARSSL_MD_SHA1:94:POLARSSL_ERR_X509_INVALID_ALG + POLARSSL_ERR_ASN1_UNEXPECTED_TAG
+
+X509 RSASSA-PSS parameters ASN1 (good, explicit trailerField = default)
+x509_parse_rsassa_pss_params:"A303020101":ASN1_CONSTRUCTED | ASN1_SEQUENCE:POLARSSL_MD_SHA1:POLARSSL_MD_SHA1:20:0
+
+X509 RSASSA-PSS parameters ASN1 (trailerField wrong len #1)
+x509_parse_rsassa_pss_params:"A304020101":ASN1_CONSTRUCTED | ASN1_SEQUENCE:POLARSSL_MD_SHA1:POLARSSL_MD_SHA1:20:POLARSSL_ERR_X509_INVALID_ALG + POLARSSL_ERR_ASN1_OUT_OF_DATA
+
+X509 RSASSA-PSS parameters ASN1 (trailerField wrong len #2)
+x509_parse_rsassa_pss_params:"A30402010100":ASN1_CONSTRUCTED | ASN1_SEQUENCE:POLARSSL_MD_SHA1:POLARSSL_MD_SHA1:20:POLARSSL_ERR_X509_INVALID_ALG + POLARSSL_ERR_ASN1_LENGTH_MISMATCH
+
+X509 RSASSA-PSS parameters ASN1 (trailerField not an int)
+x509_parse_rsassa_pss_params:"A3023000":ASN1_CONSTRUCTED | ASN1_SEQUENCE:POLARSSL_MD_SHA1:POLARSSL_MD_SHA1:20:POLARSSL_ERR_X509_INVALID_ALG + POLARSSL_ERR_ASN1_UNEXPECTED_TAG
+
+X509 RSASSA-PSS parameters ASN1 (trailerField not 1)
+x509_parse_rsassa_pss_params:"A303020102":ASN1_CONSTRUCTED | ASN1_SEQUENCE:POLARSSL_MD_SHA1:POLARSSL_MD_SHA1:20:POLARSSL_ERR_X509_INVALID_ALG
+
diff --git a/tests/suites/test_suite_x509parse.function b/tests/suites/test_suite_x509parse.function
index 91b53aa0e5..b7a1095123 100644
--- a/tests/suites/test_suite_x509parse.function
+++ b/tests/suites/test_suite_x509parse.function
@@ -373,6 +373,37 @@ void x509_check_extended_key_usage( char *crt_file, char *usage_hex, int ret )
 }
 /* END_CASE */
 
+/* BEGIN_CASE depends_on:POLARSSL_X509_CRT_PARSE_C:POLARSSL_RSASSA_PSS_CERTIFICATES */
+void x509_parse_rsassa_pss_params( char *hex_params, int params_tag,
+                                   int ref_msg_md, int ref_mgf_md,
+                                   int ref_salt_len, int ref_ret )
+{
+    int my_ret;
+    x509_buf params;
+    md_type_t my_msg_md, my_mgf_md;
+    int my_salt_len;
+
+    params.p = unhexify_alloc( hex_params, &params.len );
+    params.tag = params_tag;
+
+    my_ret = x509_get_rsassa_pss_params( &params, &my_msg_md, &my_mgf_md,
+                                         &my_salt_len );
+
+    if( my_ret != ref_ret ) printf( "\n%04X\n", - my_ret );
+
+    TEST_ASSERT( my_ret == ref_ret );
+
+    if( ref_ret == 0 )
+    {
+        TEST_ASSERT( my_msg_md == (md_type_t) ref_msg_md );
+        TEST_ASSERT( my_mgf_md == (md_type_t) ref_mgf_md );
+        TEST_ASSERT( my_salt_len == ref_salt_len );
+    }
+
+    polarssl_free( params.p );
+}
+/* END_CASE */
+
 /* BEGIN_CASE depends_on:POLARSSL_X509_CRT_PARSE_C:POLARSSL_SELF_TEST */
 void x509_selftest()
 {