pemutil

func SanitizeCertificateBundle ¶

func SanitizeCertificateBundle(in []byte) ([]byte, error)

SanitizeCertificateBundle re-encodes a PEM bundle keeping only CERTIFICATE blocks, with block headers stripped and exact duplicates (by DER bytes) removed. It returns an error if the input contains no CERTIFICATE blocks at all — an empty trust bundle is never what a workload should silently receive.

The anchors are deliberately shuffled, as in kubelet's clustertrustbundle manager: order carries no meaning, and a scrambled order keeps consumers from growing a dependence on it.