}

    fun build(): HeldCertificate {
      // Subject keys & identity.
      val subjectKeyPair = keyPair ?: generateKeyPair()
      val subjectPublicKeyInfo =
        CertificateAdapters.subjectPublicKeyInfo.fromDer(
          subjectKeyPair.public.encoded.toByteString(),
        )
      val subject: List<List<AttributeTypeAndValue>> = subject()

  // Defaults to "v1" for ServiceAccount subjects.
  // Defaults to "rbac.authorization.k8s.io/v1alpha1" for User and Group subjects.
  // +k8s:conversion-gen=false
  // +optional
  optional string apiVersion = 2;

  // Name of the object being referenced.
  optional string name = 3;

  // APIGroup holds the API group of the referenced subject.
  // Defaults to "" for ServiceAccount subjects.
  // Defaults to "rbac.authorization.k8s.io" for User and Group subjects.
  // +optional
  optional string apiGroup = 2;

  // Name of the object being referenced.
  optional string name = 3;

  // `type` indicates whether this priority level is subject to
  // limitation on request execution.  A value of `"Exempt"` means
  // that requests of this priority level are not subject to a limit
  // (and thus are never queued) and do not detract from the
  // capacity made available to other priority levels.  A value of
  // `"Limited"` means that (a) requests of this priority level
  // _are_ subject to limits and (b) some of the server's limited

  // `type` indicates whether this priority level is subject to
  // limitation on request execution.  A value of `"Exempt"` means
  // that requests of this priority level are not subject to a limit
  // (and thus are never queued) and do not detract from the
  // capacity made available to other priority levels.  A value of
  // `"Limited"` means that (a) requests of this priority level
  // _are_ subject to limits and (b) some of the server's limited

        ObjectIdentifiers.RSA_ENCRYPTION -> Adapters.NULL
        ObjectIdentifiers.EC_PUBLIC_KEY -> Adapters.OBJECT_IDENTIFIER
        else -> null
      }
    }

  /**
   * ```
   * AlgorithmIdentifier ::= SEQUENCE  {
   *   algorithm      OBJECT IDENTIFIER,
   *   parameters     ANY DEFINED BY algorithm OPTIONAL
   * }
   * ```
   */

* All changes should have an associated GitHub issue and/or a release note.
* Large fixes, where the LOC>100 not withstanding unit tests changes, require subject matter expert approval.

# Backporting fixes

* Cherry-picking is discussed in the original PR and subject-matter experts have approved the backport.
    * Behavioral changes should be highly scrutinized, while typo fixes don't require that level of scrutiny.

  val signatureValue: BitString,
) {
  val commonName: Any?
    get() {
      return tbsCertificate.subject
        .flatten()
        .firstOrNull { it.type == ObjectIdentifiers.COMMON_NAME }
        ?.value
    }

  val organizationalUnitName: Any?
    get() {
      return tbsCertificate.subject
        .flatten()
        .firstOrNull { it.type == ObjectIdentifiers.ORGANIZATIONAL_UNIT_NAME }
        ?.value

  // APIGroup holds the API group of the referenced subject.
  // Defaults to "" for ServiceAccount subjects.
  // Defaults to "rbac.authorization.k8s.io" for User and Group subjects.
  // +optional
  optional string apiGroup = 2;

  // Name of the object being referenced.
  optional string name = 3;

      source, and configuration files.

      "Object" form shall mean any form resulting from mechanical
      transformation or translation of a Source form, including but
      not limited to compiled object code, generated documentation,
      and conversions to other media types.

      "Work" shall mean the work of authorship, whether in Source or
      Object form, made available under the License, as indicated by a