not used during marshaling. It can be used to marshal these larger OIDs, instead
of the existing PolicyIdentifiers field, by using the
[`x509usepolicies` setting.](/pkg/crypto/x509/#CreateCertificate).


### Go 1.21

Go 1.21 made it a run-time error to call `panic` with a nil interface value,
controlled by the [`panicnil` setting](/pkg/builtin/#panic).

		} else {
			template.DNSNames = append(template.DNSNames, h)
		}
	}

	template.IsCA = true
	template.KeyUsage |= x509.KeyUsageCertSign

	derBytes, err := x509.CreateCertificate(crand.Reader, &template, &template, publicKey(priv), priv)
	if err != nil {
		return nil, nil, fmt.Errorf("Failed to create certificate: %w", err)
	}

	certOut := bytes.NewBuffer([]byte{})

pkg crypto/x509, const TooManyIntermediates InvalidReason
pkg crypto/x509, const UnknownPublicKeyAlgorithm PublicKeyAlgorithm
pkg crypto/x509, const UnknownSignatureAlgorithm SignatureAlgorithm
pkg crypto/x509, func CreateCertificate(io.Reader, *Certificate, *Certificate, interface{}, interface{}) ([]uint8, error)
pkg crypto/x509, func MarshalPKCS1PrivateKey(*rsa.PrivateKey) []uint8
pkg crypto/x509, func MarshalPKIXPublicKey(interface{}) ([]uint8, error)