val root =
      HeldCertificate.Builder()
        .serialNumber(1L)
        .certificateAuthority(1)
        .build()
    val certA =
      HeldCertificate.Builder()
        .serialNumber(2L)
        .certificateAuthority(0)
        .signedBy(root)
        .build()
    val certB =
      HeldCertificate.Builder()
        .serialNumber(3L)
        .signedBy(certA)
        .build()

    val rootCa =
      HeldCertificate.Builder()
        .serialNumber(1L)
        .certificateAuthority(1)
        .commonName("root")
        .build()
    val intermediateCa =
      HeldCertificate.Builder()
        .signedBy(rootCa)
        .certificateAuthority(0)
        .serialNumber(2L)
        .commonName("intermediate_ca")
        .build()
    val certificate =

	}{
		{
			name: "valid",
			cert: &Certificate{
				SerialNumber: big.NewInt(1),
				DNSNames:     []string{"valid.testing.golang.invalid"},
				NotBefore:    now.Add(-time.Hour),
				NotAfter:     now.Add(time.Hour),
				ExtKeyUsage:  []ExtKeyUsage{ExtKeyUsageServerAuth},
			},
		},
		{
			name: "valid (with name)",
			cert: &Certificate{
				SerialNumber: big.NewInt(1),

    serverRootCa =
      HeldCertificate.Builder()
        .serialNumber(1L)
        .certificateAuthority(1)
        .commonName("root")
        .addSubjectAlternativeName("root_ca.com")
        .build()
    serverIntermediateCa =
      HeldCertificate.Builder()
        .signedBy(serverRootCa)
        .certificateAuthority(0)
        .serialNumber(2L)
        .commonName("intermediate_ca")

	ret = n.appendRDNs(ret, n.OrganizationalUnit, oidOrganizationalUnit)
	if len(n.CommonName) > 0 {
		ret = n.appendRDNs(ret, []string{n.CommonName}, oidCommonName)
	}
	if len(n.SerialNumber) > 0 {
		ret = n.appendRDNs(ret, []string{n.SerialNumber}, oidSerialNumber)
	}
	for _, atv := range n.ExtraNames {
		ret = append(ret, []AttributeTypeAndValue{atv})
	}

	return ret
}

    fun serialNumber(serialNumber: BigInteger) =
      apply {
        this.serialNumber = serialNumber
      }

    /** Sets this certificate's serial number. If unset the serial number will be 1. */
    fun serialNumber(serialNumber: Long) =
      apply {
        serialNumber(BigInteger.valueOf(serialNumber))
      }

    /**

    val certA1 =
      HeldCertificate.Builder()
        .serialNumber(100L)
        .build()
    val certA1Sha256Pin = pin(certA1.certificate)
    val certB1 =
      HeldCertificate.Builder()
        .serialNumber(200L)
        .build()
    val certB1Sha256Pin = pin(certB1.certificate)
    val certC1 =
      HeldCertificate.Builder()
        .serialNumber(300L)
        .build()

    assertThat(okHttpCertificate.tbsCertificate.serialNumber).isEqualTo(BigInteger("17"))
  }

  @Test
  fun `missing subject alternative names`() {
    val certificate =
      HeldCertificate.Builder()
        .certificateAuthority(3)
        .commonName("Jurassic Park")
        .organizationalUnit("Gene Research")
        .validityInterval(-1000L, 2000L)
        .serialNumber(17L)
        .build()

	// verify the correct intermediate cert is in the certificate chain
	if intermediateX509.SerialNumber.String() != caX590.SerialNumber.String() {
		return fmt.Errorf("intermediate certificate serial numbers do not match: got %v, wanted %v",
			intermediateX509.SerialNumber.String(), caX590.SerialNumber.String())
	}

	workloadCert, err := base64.StdEncoding.DecodeString(workloadSecret.CertChain[0].Pem)
	if err != nil {

				}
				for i, rce := range parsedCRL.RevokedCertificateEntries {
					expected := tc.template.RevokedCertificateEntries[i]
					if rce.SerialNumber.Cmp(expected.SerialNumber) != 0 {
						t.Fatalf("RevocationListEntry serial mismatch: got %d; want %d.",
							rce.SerialNumber, expected.SerialNumber)
					}
					if !rce.RevocationTime.Equal(expected.RevocationTime) {