// Invalid signature.
    val okHttpCertificateWithBadSignature =
      okHttpCertificate.copy(
        signatureValue =
          okHttpCertificate.signatureValue.copy(
            byteString = okHttpCertificate.signatureValue.byteString.offByOneBit(),
          ),
      )
    assertThat(okHttpCertificateWithBadSignature.checkSignature(root.keyPair.public)).isFalse()

import okio.ByteString
import org.codehaus.mojo.animal_sniffer.IgnoreJRERequirement

internal data class Certificate(
  val tbsCertificate: TbsCertificate,
  val signatureAlgorithm: AlgorithmIdentifier,
  val signatureValue: BitString,
) {
  val commonName: Any?
    get() {
      return tbsCertificate.subject
        .flatten()
        .firstOrNull { it.type == ObjectIdentifiers.COMMON_NAME }
        ?.value
    }

        listOf(
          it.tbsCertificate,
          it.signatureAlgorithm,
          it.signatureValue,
        )
      },
      construct = {
        Certificate(
          tbsCertificate = it[0] as TbsCertificate,
          signatureAlgorithm = it[1] as AlgorithmIdentifier,
          signatureValue = it[2] as BitString,
        )
      },
    )

  /**
   * ```

	return ret, nil
}

// These structures reflect the ASN.1 structure of X.509 certificates.:

type certificate struct {
	TBSCertificate     tbsCertificate
	SignatureAlgorithm pkix.AlgorithmIdentifier
	SignatureValue     asn1.BitString
}

type tbsCertificate struct {
	Raw                asn1.RawContent
	Version            int `asn1:"optional,explicit,default:0,tag:0"`
	SerialNumber       *big.Int

// signature.
//
// Deprecated: x509.RevocationList should be used instead.
type CertificateList struct {
	TBSCertList        TBSCertificateList
	SignatureAlgorithm AlgorithmIdentifier
	SignatureValue     asn1.BitString
}

// HasExpired reports whether certList should have been updated by now.
func (certList *CertificateList) HasExpired(now time.Time) bool {
	return !now.Before(certList.TBSCertList.NextUpdate)

        }

      // Complete signed certificate.
      val certificate =
        Certificate(
          tbsCertificate = tbsCertificate,
          signatureAlgorithm = signatureAlgorithm,
          signatureValue =
            BitString(
              byteString = signature,
              unusedBitsCount = 0,
            ),
        )

      return HeldCertificate(subjectKeyPair, certificate.toX509Certificate())

			t.Errorf("InvalidUnmarshalError mismatch\nGot:  %q\nWant: %q", g, w)
		}
	}
}

type Certificate struct {
	TBSCertificate     TBSCertificate
	SignatureAlgorithm AlgorithmIdentifier
	SignatureValue     BitString
}

type TBSCertificate struct {
	Version            int `asn1:"optional,explicit,default:0,tag:0"`
	SerialNumber       RawValue
	SignatureAlgorithm AlgorithmIdentifier

		{"AttributeTypeAndValueSET.Type", Field, 3},
		{"AttributeTypeAndValueSET.Value", Field, 3},
		{"CertificateList", Type, 0},
		{"CertificateList.SignatureAlgorithm", Field, 0},
		{"CertificateList.SignatureValue", Field, 0},
		{"CertificateList.TBSCertList", Field, 0},
		{"Extension", Type, 0},
		{"Extension.Critical", Field, 0},
		{"Extension.Id", Field, 0},
		{"Extension.Value", Field, 0},
		{"Name", Type, 0},

pkg crypto/x509/pkix, type CertificateList struct
pkg crypto/x509/pkix, type CertificateList struct, SignatureAlgorithm AlgorithmIdentifier
pkg crypto/x509/pkix, type CertificateList struct, SignatureValue asn1.BitString
pkg crypto/x509/pkix, type CertificateList struct, TBSCertList TBSCertificateList
pkg crypto/x509/pkix, type Extension struct
pkg crypto/x509/pkix, type Extension struct, Critical bool