// the type of the identity.
type Identity struct {
	Type  IdentityType
	Value []byte
}

// BuildSubjectAltNameExtension builds the SAN extension for the certificate.
func BuildSubjectAltNameExtension(hosts string) (*pkix.Extension, error) {
	ids := []Identity{}
	for _, host := range strings.Split(hosts, ",") {
		if ipa, _ := netip.ParseAddr(host); ipa.IsValid() {

	template := &x509.CertificateRequest{
		Subject: pkix.Name{
			Organization: []string{options.Org},
		},
	}

	if h := options.Host; len(h) > 0 {
		s, err := BuildSubjectAltNameExtension(h)
		if err != nil {
			return nil, err
		}
		if options.IsDualUse {
			cn, err := DualUseCommonName(h)
			if err != nil {
				// log and continue

			expectedExt: getSANExtension([]Identity{uriIdentity, ipIdentity, dnsIdentity}, t),
		},
	}

	for id, tc := range testCases {
		if ext, err := BuildSubjectAltNameExtension(tc.hosts); err != nil {
			t.Errorf("Case %q: a unexpected error has been encountered (error: %v)", id, err)
		} else if !reflect.DeepEqual(ext, tc.expectedExt) {