// With Go 1.19's updated RevocationList, we can now directly compare
			// the RawSubject of the certificate to RawIssuer on the parsed CRL.
			// However, this doesn't work with our hacked issuers above (that
			// aren't parsed from a proper DER bundle but are instead manually
			// constructed). Prefer RawSubject when it is set.
			if len(tc.issuer.RawSubject) > 0 {
				issuerSubj, err := subjectBytes(tc.issuer)
				if err != nil {

	c := &Certificate{
		RawIssuer:      []byte{1, 2, 3},
		AuthorityKeyId: []byte{1, 2, 3},
	}
	opts := &VerifyOptions{}
	opts.Roots = NewCertPool()
	r := &Certificate{
		RawSubject:   []byte{1, 2, 3},
		SubjectKeyId: []byte{1, 2, 3},
	}
	opts.Roots.AddCert(r)

	_, err := c.buildChains([]*Certificate{r}, nil, opts)
	if _, ok := err.(UnknownAuthorityError); !ok {

pkg crypto/x509, type CertificateRequest struct, PublicKeyAlgorithm PublicKeyAlgorithm
pkg crypto/x509, type CertificateRequest struct, Raw []uint8
pkg crypto/x509, type CertificateRequest struct, RawSubject []uint8
pkg crypto/x509, type CertificateRequest struct, RawSubjectPublicKeyInfo []uint8
pkg crypto/x509, type CertificateRequest struct, RawTBSCertificateRequest []uint8