- [Other doc]: <link>
  --> ([#119517](https://github.com/kubernetes/kubernetes/pull/119517), [@sanposhiho](https://github.com/sanposhiho)) [SIG Node, Scheduling and Testing]
- '`kubeadm`: added validation to verify that the `CertificateKey` is a valid hex
  encoded AES key.' ([#120064](https://github.com/kubernetes/kubernetes/pull/120064), [@SataQiu](https://github.com/SataQiu))
- A customizable `OrderedScoreFuncs()` function was introduced. Out-of-tree plugins 

     * [certificatePem()][certificatePem] and [privateKeyPkcs8Pem()][privateKeyPkcs8Pem].
     *
     * [rfc_7468]: https://tools.ietf.org/html/rfc7468
     * [rfc_5208]: https://tools.ietf.org/html/rfc5208
     */
    @JvmStatic
    fun decode(certificateAndPrivateKeyPem: String): HeldCertificate {
      var certificatePem: String? = null
      var pkcs8Base64: String? = null

      |lu/GJQZoU9lDrCPeUcQ28tzOW6AKBggqhkjOPQMBBw==
      |-----END PRIVATE KEY-----
      |
      """.trimMargin()
    val heldCertificate = decode(certificatePem + pkcs8Pem)
    assertThat(heldCertificate.certificatePem()).isEqualTo(certificatePem)

    // Slightly different encoding
    if (platform.isBouncyCastle()) {
      assertThat(heldCertificate.privateKeyPkcs8Pem()).isEqualTo(bcPkcs8Pem)
    } else {

import java.security.cert.X509Certificate
import okio.Buffer
import okio.ByteString
import okio.ByteString.Companion.toByteString

/**
 * Decodes a multiline string that contains a [certificate][certificatePem] which is
 * [PEM-encoded][rfc_7468]. A typical input string looks like this:
 *
 * ```
 * -----BEGIN CERTIFICATE-----
 * MIIBYTCCAQegAwIBAgIBKjAKBggqhkjOPQQDAjApMRQwEgYDVQQLEwtlbmdpbmVl

      |
      """.trimMargin()
    val certificateByteString = certificateBase64.decodeBase64()!!
    val certificatePem =
      """
      |-----BEGIN CERTIFICATE-----
      |$certificateBase64
      |-----END CERTIFICATE-----
      |
      """.trimMargin()

    val javaCertificate = certificatePem.decodeCertificatePem()
    val okHttpCertificate =
      CertificateAdapters.certificate

      jaA9VEhgdaVhxBsT2qzUNDsXlOzGsliznDfoqETb
      -----END CERTIFICATE-----
      
      """.trimIndent()
    val certificate = certificateString.decodeCertificatePem()
    assertEquals(certificateString, certificate.certificatePem())
  }

    val heldCertificate =
      HeldCertificate.Builder()
        .commonName("Foo Corp")
        .addSubjectAlternativeName("foo.com")
        .build()
    val session = session(heldCertificate.certificatePem())
    assertThat(verifier.verify("foo.com", session)).isTrue()
    assertThat(verifier.verify("bar.com", session)).isFalse()
  }

  @Test fun specialKInHostname() {

    .build();
```

PEM files
---------

You can encode a `HeldCertificate` in PEM format:

```java
HeldCertificate heldCertificate = ...
System.out.println(heldCertificate.certificatePem())
```

```
-----BEGIN CERTIFICATE-----
MIIBSjCB8aADAgECAgEBMAoGCCqGSM49BAMCMC8xLTArBgNVBAMTJDJiYWY3NzVl
LWE4MzUtNDM5ZS1hYWE2LTgzNmNiNDlmMGM3MTAeFw0xODA3MTMxMjA0MzJaFw0x

    val heldCertificate: HeldCertificate = HeldCertificate.Builder().build()
    val certificate: X509Certificate = heldCertificate.certificate
    val keyPair: KeyPair = heldCertificate.keyPair
    val certificatePem: String = heldCertificate.certificatePem()
    val privateKeyPkcs8Pem: String = heldCertificate.privateKeyPkcs8Pem()
    val privateKeyPkcs1Pem: String = heldCertificate.privateKeyPkcs1Pem()
  }

  @Test

        .build()
    val server = MockWebServer()
    server.useHttps(handshakeCertificates.sslSocketFactory(), false)
    ```

    Get these strings with `HeldCertificate.certificatePem()` and `privateKeyPkcs8Pem()`.

 *  Fix: Handshake now returns peer certificates in canonical order: each certificate is signed by
    the certificate that follows and the last certificate is signed by a trusted root.