diff --git a/include/polarssl/x509.h b/include/polarssl/x509.h
index e11bd90..452ea31 100644
--- a/include/polarssl/x509.h
+++ b/include/polarssl/x509.h
@@ -285,7 +285,8 @@
 #endif
 int x509_get_sig( unsigned char **p, const unsigned char *end, x509_buf *sig );
 int x509_get_sig_alg( const x509_buf *sig_oid, const x509_buf *sig_params,
-                      md_type_t *md_alg, pk_type_t *pk_alg );
+                      md_type_t *md_alg, pk_type_t *pk_alg,
+                      void **sig_opts );
 int x509_get_time( unsigned char **p, const unsigned char *end,
                    x509_time *time );
 int x509_get_serial( unsigned char **p, const unsigned char *end,
diff --git a/include/polarssl/x509_crl.h b/include/polarssl/x509_crl.h
index 81d4734..5c4564a 100644
--- a/include/polarssl/x509_crl.h
+++ b/include/polarssl/x509_crl.h
@@ -92,8 +92,9 @@
     x509_buf sig_oid2;
     x509_buf sig;
     md_type_t sig_md;           /**< Internal representation of the MD algorithm of the signature algorithm, e.g. POLARSSL_MD_SHA256 */
-    pk_type_t sig_pk            /**< Internal representation of the Public Key algorithm of the signature algorithm, e.g. POLARSSL_PK_RSA */;
+    pk_type_t sig_pk;           /**< Internal representation of the Public Key algorithm of the signature algorithm, e.g. POLARSSL_PK_RSA */
 #if defined(POLARSSL_RSASSA_PSS_CERTIFICATES)
+    void *sig_opts;             /**< Signature options to be passed to pk_verify_ext(), eg for RSASSA-PSS */
     x509_buf sig_params;        /**< Parameters for the signature algorithm */
 #endif
 
diff --git a/include/polarssl/x509_crt.h b/include/polarssl/x509_crt.h
index 09cc982..8668631 100644
--- a/include/polarssl/x509_crt.h
+++ b/include/polarssl/x509_crt.h
@@ -92,8 +92,9 @@
     x509_buf sig_oid2;          /**< Signature algorithm. Must match sig_oid1. */
     x509_buf sig;               /**< Signature: hash of the tbs part signed with the private key. */
     md_type_t sig_md;           /**< Internal representation of the MD algorithm of the signature algorithm, e.g. POLARSSL_MD_SHA256 */
-    pk_type_t sig_pk            /**< Internal representation of the Public Key algorithm of the signature algorithm, e.g. POLARSSL_PK_RSA */;
+    pk_type_t sig_pk;           /**< Internal representation of the Public Key algorithm of the signature algorithm, e.g. POLARSSL_PK_RSA */
 #if defined(POLARSSL_RSASSA_PSS_CERTIFICATES)
+    void *sig_opts;             /**< Signature options to be passed to pk_verify_ext(), eg for RSASSA-PSS */
     x509_buf sig_params;        /**< Parameters for the signature algorithm */
 #endif
 
diff --git a/include/polarssl/x509_csr.h b/include/polarssl/x509_csr.h
index af3f226..28ddeda 100644
--- a/include/polarssl/x509_csr.h
+++ b/include/polarssl/x509_csr.h
@@ -66,8 +66,9 @@
     x509_buf sig_oid;
     x509_buf sig;
     md_type_t sig_md;       /**< Internal representation of the MD algorithm of the signature algorithm, e.g. POLARSSL_MD_SHA256 */
-    pk_type_t sig_pk        /**< Internal representation of the Public Key algorithm of the signature algorithm, e.g. POLARSSL_PK_RSA */;
+    pk_type_t sig_pk;       /**< Internal representation of the Public Key algorithm of the signature algorithm, e.g. POLARSSL_PK_RSA */
 #if defined(POLARSSL_RSASSA_PSS_CERTIFICATES)
+    void *sig_opts;             /**< Signature options to be passed to pk_verify_ext(), eg for RSASSA-PSS */
     x509_buf sig_params;        /**< Parameters for the signature algorithm */
 #endif
 }