CRLDistributionPoints []string

	// PolicyIdentifiers contains asn1.ObjectIdentifiers, the components
	// of which are limited to int32. If a certificate contains a policy which
	// cannot be represented by asn1.ObjectIdentifier, it will not be included in
	// PolicyIdentifiers, but will be present in Policies, which contains all parsed
	// policy OIDs.
	PolicyIdentifiers []asn1.ObjectIdentifier

			t.Errorf("%s: failed to parse certificate: %s", test.name, err)
			continue
		}

		if len(cert.PolicyIdentifiers) != 1 || !cert.PolicyIdentifiers[0].Equal(template.PolicyIdentifiers[0]) {
			t.Errorf("%s: failed to parse policy identifiers: got:%#v want:%#v", test.name, cert.PolicyIdentifiers, template.PolicyIdentifiers)
		}

				out.Policies, err = parseCertificatePoliciesExtension(e.Value)
				if err != nil {
					return err
				}
				out.PolicyIdentifiers = make([]asn1.ObjectIdentifier, 0, len(out.Policies))
				for _, oid := range out.Policies {
					if oid, ok := oid.toASN1OID(); ok {
						out.PolicyIdentifiers = append(out.PolicyIdentifiers, oid)
					}
				}
			default:
				// Unknown extensions are recorded if critical.
				unhandled = true

field is only used during parsing, when it is populated with policy OIDs, but
not used during marshaling. It can be used to marshal these larger OIDs, instead
of the existing PolicyIdentifiers field, by using the
[`x509usepolicies` setting.](/pkg/crypto/x509/#CreateCertificate).


### Go 1.21

Go 1.21 made it a run-time error to call `panic` with a nil interface value,

		{"Certificate.PermittedEmailAddresses", Field, 10},
		{"Certificate.PermittedIPRanges", Field, 10},
		{"Certificate.PermittedURIDomains", Field, 10},
		{"Certificate.Policies", Field, 22},
		{"Certificate.PolicyIdentifiers", Field, 0},
		{"Certificate.PublicKey", Field, 0},
		{"Certificate.PublicKeyAlgorithm", Field, 0},
		{"Certificate.Raw", Field, 0},
		{"Certificate.RawIssuer", Field, 0},

pkg crypto/x509, type Certificate struct, PermittedDNSDomains []string
pkg crypto/x509, type Certificate struct, PermittedDNSDomainsCritical bool
pkg crypto/x509, type Certificate struct, PolicyIdentifiers []asn1.ObjectIdentifier
pkg crypto/x509, type Certificate struct, PublicKey interface{}
pkg crypto/x509, type Certificate struct, PublicKeyAlgorithm PublicKeyAlgorithm
pkg crypto/x509, type Certificate struct, Raw []uint8