HeldCertificate
        .Builder()
        .serialNumber(1L)
        .certificateAuthority(1)
        .commonName("root")
        .addSubjectAlternativeName("root_ca.com")
        .build()
    serverIntermediateCa =
      HeldCertificate
        .Builder()
        .signedBy(serverRootCa)
        .certificateAuthority(0)
        .serialNumber(2L)
        .commonName("intermediate_ca")

      HeldCertificate
        .Builder()
        .serialNumber(1L)
        .certificateAuthority(1)
        .build()
    val certA =
      HeldCertificate
        .Builder()
        .serialNumber(2L)
        .certificateAuthority(0)
        .signedBy(root)
        .build()
    val certB =
      HeldCertificate
        .Builder()
        .serialNumber(3L)
        .signedBy(certA)
        .build()

    fun serialNumber(serialNumber: BigInteger) =
      apply {
        this.serialNumber = serialNumber
      }

    /** Sets this certificate's serial number. If unset the serial number will be 1. */
    fun serialNumber(serialNumber: Long) =
      apply {
        serialNumber(BigInteger.valueOf(serialNumber))
      }

    /**

      HeldCertificate
        .Builder()
        .serialNumber(100L)
        .build()
    val certA1Sha256Pin = pin(certA1.certificate)
    val certB1 =
      HeldCertificate
        .Builder()
        .serialNumber(200L)
        .build()
    val certB1Sha256Pin = pin(certB1.certificate)
    val certC1 =
      HeldCertificate
        .Builder()
        .serialNumber(300L)
        .build()

    internal var certA1: HeldCertificate =
      HeldCertificate
        .Builder()
        .serialNumber(100L)
        .build()
    internal var certA1Sha256Pin = CertificatePinner.pin(certA1.certificate)

    private var certB1 =
      HeldCertificate
        .Builder()
        .serialNumber(200L)
        .build()
    internal var certB1Sha256Pin = CertificatePinner.pin(certB1.certificate)

  private val country = "1.3.6.1.4.1.311.60.2.1.3"
  private val certificateTransparencySignedCertificateTimestamps = "1.3.6.1.4.1.11129.2.4.2"
  private val authorityInfoAccess = "1.3.6.1.5.5.7.1.1"
  private val serialNumber = "2.5.4.5"
  private val countryName = "2.5.4.6"
  private val localityName = "2.5.4.7"
  private val stateOrProvinceName = "2.5.4.8"
  private val organizationName = "2.5.4.10"
  private val businessCategory = "2.5.4.15"

          subjectPublicKey = it[1] as BitString,
        )
      },
    )

  /**
   * ```
   * TBSCertificate ::= SEQUENCE  {
   *   version         [0]  EXPLICIT Version DEFAULT v1,
   *   serialNumber         CertificateSerialNumber,
   *   signature            AlgorithmIdentifier,
   *   issuer               Name,
   *   validity             Validity,
   *   subject              Name,

    }
  }
}

internal data class TbsCertificate(
  /** This is a integer enum. Use 0L for v1, 1L for v2, and 2L for v3. */
  val version: Long,
  val serialNumber: BigInteger,
  val signature: AlgorithmIdentifier,
  val issuer: List<List<AttributeTypeAndValue>>,
  val validity: Validity,
  val subject: List<List<AttributeTypeAndValue>>,

      .isEqualTo(certificate.getIssuerX500Principal().name)
    assertThat(certificate.getIssuerX500Principal().name).matches(Regex("CN=[0-9a-f-]{36}"))
    assertThat(certificate.serialNumber).isEqualTo(BigInteger.ONE)
    assertThat(certificate.subjectAlternativeNames).isNull()
    val deltaMillis = 1000.0
    val durationMillis = TimeUnit.MINUTES.toMillis((60 * 24).toLong())

	notAfter := notBefore.Add(validFor)

	serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128)
	serialNumber, err := crand.Int(crand.Reader, serialNumberLimit)
	if err != nil {
		return nil, nil, fmt.Errorf("failed to generate serial number: %w", err)
	}

	template := x509.Certificate{
		SerialNumber: serialNumber,
		Subject: pkix.Name{
			Organization: []string{"Acme Co"},
		},
		NotBefore: notBefore,