X503,
    X504,
    X505,
    X506,
    X507,
    X508,
    X509,
    X510,
    X511,
    X512,
    X513,
    X514,
    X515,
    X516,
    X517,
    X518,
    X519,
    X520,
    X521,
    X522,
    X523,
    X524,
    X525,
    X526,
    X527,
    X528,
    X529,
    X530,
    X531,
    X532,
    X533,
    X534,
    X535,

pkg crypto/x509, func ParseRevocationList([]uint8) (*RevocationList, error) #50674
pkg crypto/x509, method (*CertPool) Clone() *CertPool #35044
pkg crypto/x509, method (*CertPool) Equal(*CertPool) bool #46057
pkg crypto/x509, method (*RevocationList) CheckSignatureFrom(*Certificate) error #50674
pkg crypto/x509, type RevocationList struct, AuthorityKeyId []uint8 #50674
pkg crypto/x509, type RevocationList struct, Extensions []pkix.Extension #50674

pkg crypto/x509, type Certificate struct, InhibitPolicyMappingZero bool #68484
pkg crypto/x509, type Certificate struct, PolicyMappings []PolicyMapping #68484
pkg crypto/x509, type Certificate struct, RequireExplicitPolicy int #68484
pkg crypto/x509, type Certificate struct, RequireExplicitPolicyZero bool #68484
pkg crypto/x509, type PolicyMapping struct #68484

pkg crypto/x509, const NameConstraintsWithoutSANs InvalidReason
pkg crypto/x509, const TooManyConstraints = 8
pkg crypto/x509, const TooManyConstraints InvalidReason
pkg crypto/x509, const UnconstrainedName = 7
pkg crypto/x509, const UnconstrainedName InvalidReason
pkg crypto/x509, func MarshalPKCS1PublicKey(*rsa.PublicKey) []uint8
pkg crypto/x509, func MarshalPKCS8PrivateKey(interface{}) ([]uint8, error)

Go 1.24 removed the `x509sha1` setting.  `crypto/x509` no longer supports verifying
signatures on certificates that use SHA-1 based signature algorithms.

Go 1.24 changes the default value of the [`x509usepolicies`
setting.](/pkg/crypto/x509/#CreateCertificate) from `0` to `1`. When marshalling
certificates, policies are now taken from the
[`Certificate.Policies`](/pkg/crypto/x509/#Certificate.Policies) field rather
than the

pkg crypto/tls, type QUICSessionTicketOptions struct, Extra [][]uint8 #63691
pkg crypto/x509, func ParseOID(string) (OID, error) #66249
pkg crypto/x509, method (*OID) UnmarshalBinary([]uint8) error #66249
pkg crypto/x509, method (*OID) UnmarshalText([]uint8) error #66249
pkg crypto/x509, method (OID) MarshalBinary() ([]uint8, error) #66249
pkg crypto/x509, method (OID) MarshalText() ([]uint8, error) #66249

    // [distinguished_name]
    // [req_extensions]
    // [x509_extensions]
    // subjectAltName=DNS:localhost.localdomain,DNS:localhost,IP:127.0.0.1
    //
    // $ openssl req -x509 -nodes -days 36500 -subj '/CN=localhost' -config ./cert.cnf \
    //     -newkey rsa:512 -out cert.pem
    val certificate =
      certificate(
        """
        -----BEGIN CERTIFICATE-----

pkg crypto/tls, type SignatureScheme uint16
pkg crypto/x509, const NameMismatch = 5
pkg crypto/x509, const NameMismatch InvalidReason
pkg crypto/x509, const SHA256WithRSAPSS = 13
pkg crypto/x509, const SHA256WithRSAPSS SignatureAlgorithm
pkg crypto/x509, const SHA384WithRSAPSS = 14
pkg crypto/x509, const SHA384WithRSAPSS SignatureAlgorithm

	certificate := r.TLS.PeerCertificates[0]
	if !globalIAMSys.STSTLSConfig.InsecureSkipVerify { // Verify whether the client certificate has been issued by a trusted CA.
		_, err := certificate.Verify(x509.VerifyOptions{
			KeyUsages: []x509.ExtKeyUsage{
				x509.ExtKeyUsageClientAuth,
			},
			Intermediates: intermediates,
			Roots:         globalRootCAs,
		})
		if err != nil {

	VPDPBUSDS X25, X14, K4, X19                        // 62820d0c51d9
	VPDPBUSDS X11, X14, K4, X19                        // 62c20d0c51db
	VPDPBUSDS X17, X14, K4, X19                        // 62a20d0c51d9
	VPDPBUSDS 7(AX)(CX*4), X14, K4, X19                // 62e20d0c519c8807000000
	VPDPBUSDS 7(AX)(CX*1), X14, K4, X19                // 62e20d0c519c0807000000
	VPDPBUSDS X25, X0, K4, X19                         // 62827d0c51d9