t.Fatalf("error was not a NotAuthorizedToSign: %v", err)
	}
}

func expectUnhandledCriticalExtension(t *testing.T, err error) {
	if _, ok := err.(UnhandledCriticalExtension); !ok {
		t.Fatalf("error was not an UnhandledCriticalExtension: %v", err)
	}
}

func certificateFromPEM(pemBytes string) (*Certificate, error) {
	block, _ := pem.Decode([]byte(pemBytes))
	if block == nil {

	algo := getSignatureAlgorithmFromAI(crl.SignatureAlgorithm)
	return c.CheckSignature(algo, crl.TBSCertList.Raw, crl.SignatureValue.RightAlign())
}

type UnhandledCriticalExtension struct{}

func (h UnhandledCriticalExtension) Error() string {
	return "x509: unhandled critical extension"
}

type basicConstraints struct {
	IsCA       bool `asn1:"optional"`
	MaxPathLen int  `asn1:"optional,default:-1"`

// to the chain in currentChain.
func (c *Certificate) isValid(certType int, currentChain []*Certificate, opts *VerifyOptions) error {
	if len(c.UnhandledCriticalExtensions) > 0 {
		return UnhandledCriticalExtension{}
	}

	if len(currentChain) > 0 {
		child := currentChain[len(currentChain)-1]
		if !bytes.Equal(child.RawIssuer, c.RawSubject) {
			return CertificateInvalidError{c, NameMismatch, ""}
		}
	}

		{"(PublicKeyAlgorithm).String", Method, 10},
		{"(SignatureAlgorithm).String", Method, 6},
		{"(SystemRootsError).Error", Method, 1},
		{"(SystemRootsError).Unwrap", Method, 16},
		{"(UnhandledCriticalExtension).Error", Method, 0},
		{"(UnknownAuthorityError).Error", Method, 0},
		{"CANotAuthorizedForExtKeyUsage", Const, 10},
		{"CANotAuthorizedForThisName", Const, 0},
		{"CertPool", Type, 0},

pkg crypto/x509, method (CertificateInvalidError) Error() string
pkg crypto/x509, method (ConstraintViolationError) Error() string
pkg crypto/x509, method (HostnameError) Error() string
pkg crypto/x509, method (UnhandledCriticalExtension) Error() string
pkg crypto/x509, method (UnknownAuthorityError) Error() string
pkg crypto/x509, type CertPool struct
pkg crypto/x509, type Certificate struct