unsigned

func Design ¶

func Design(cert []byte, replaceSigAlg bool) ([]byte, error)

Design parses the input as an X.509 certificate and returns an unsigned certificate with the same contents.

RFC 9925 says "Senders SHOULD omit the authority key identifier and issuer alternative name extensions", but since we use this for returning lint certificate bytes we leave all fields unchanged, including those fields.

If replaceSigAlg is true, Design emits a proper RFC 9925 certificate with the signature algorithm id-alg-unsigned in both slots. If false, it retains the original signature algorithm and simply truncates the signature. This is convenient for efficiently storing lint certificates where we don't care about the signature bytes.