Four production bugs from a national SSO platform: X.509 parsing, a misdiagnosed 500, a payment clock race, and Chrome's TLS renegotiation asymmetry