// hex encoded string (suitable for passing to Set.Allow).
func Hash(certificate *x509.Certificate) string {
	spkiHash := sha256.Sum256(certificate.RawSubjectPublicKeyInfo)
	return formatSHA256 + ":" + strings.ToLower(hex.EncodeToString(spkiHash[:]))
}

// allowSHA256 validates a "sha256" format hash and adds a canonical version of it into the Set

type Certificate struct {
	Raw                     []byte // Complete ASN.1 DER content (certificate, signature algorithm and signature).
	RawTBSCertificate       []byte // Certificate part of raw ASN.1 DER content.
	RawSubjectPublicKeyInfo []byte // DER encoded SubjectPublicKeyInfo.
	RawSubject              []byte // DER encoded Subject
	RawIssuer               []byte // DER encoded Issuer

	Signature          []byte

	}
	cert.Subject.FillFromRDNSequence(subjectRDNs)

	var spki cryptobyte.String
	if !tbs.ReadASN1Element(&spki, cryptobyte_asn1.SEQUENCE) {
		return nil, errors.New("x509: malformed spki")
	}
	cert.RawSubjectPublicKeyInfo = spki
	if !spki.ReadASN1(&spki, cryptobyte_asn1.SEQUENCE) {
		return nil, errors.New("x509: malformed spki")
	}
	var pkAISeq cryptobyte.String
	if !spki.ReadASN1(&pkAISeq, cryptobyte_asn1.SEQUENCE) {

		TLSEnabled: globalIsTLS,
		Certs:      []madmin.TLSCert{},
	}

	if globalIsTLS {
		for _, c := range globalPublicCerts {
			check := xxh3.Hash(c.RawIssuer)
			check ^= xxh3.Hash(c.RawSubjectPublicKeyInfo)
			// We XOR, so order doesn't matter.
			for _, v := range c.DNSNames {
				check ^= xxh3.HashString(v)
			}
			for _, v := range c.EmailAddresses {
				check ^= xxh3.HashString(v)
			}

pkg crypto/x509, type CertificateRequest struct, Raw []uint8
pkg crypto/x509, type CertificateRequest struct, RawSubject []uint8
pkg crypto/x509, type CertificateRequest struct, RawSubjectPublicKeyInfo []uint8
pkg crypto/x509, type CertificateRequest struct, RawTBSCertificateRequest []uint8
pkg crypto/x509, type CertificateRequest struct, Signature []uint8

		{"Certificate.PublicKeyAlgorithm", Field, 0},
		{"Certificate.Raw", Field, 0},
		{"Certificate.RawIssuer", Field, 0},
		{"Certificate.RawSubject", Field, 0},
		{"Certificate.RawSubjectPublicKeyInfo", Field, 0},
		{"Certificate.RawTBSCertificate", Field, 0},
		{"Certificate.SerialNumber", Field, 0},
		{"Certificate.Signature", Field, 0},
		{"Certificate.SignatureAlgorithm", Field, 0},

pkg crypto/x509, type Certificate struct, Raw []uint8
pkg crypto/x509, type Certificate struct, RawIssuer []uint8
pkg crypto/x509, type Certificate struct, RawSubject []uint8
pkg crypto/x509, type Certificate struct, RawSubjectPublicKeyInfo []uint8
pkg crypto/x509, type Certificate struct, RawTBSCertificate []uint8
pkg crypto/x509, type Certificate struct, SerialNumber *big.Int
pkg crypto/x509, type Certificate struct, Signature []uint8