// Sign generates a certificate for a workload or CA, from the given CSR and cert opts.
	Sign(csrPEM []byte, opts ca.CertOpts) ([]byte, error)
	// SignWithCertChain is similar to Sign but returns the leaf cert and the entire cert chain.
	SignWithCertChain(csrPEM []byte, opts ca.CertOpts) ([]string, error)
	// GetCAKeyCertBundle returns the KeyCertBundle used by CA.
	GetCAKeyCertBundle() *util.KeyCertBundle
}

		"citadel_server_cert_chain_expiry_timestamp",
		"The unix timestamp, in seconds, when Citadel cert chain will expire. "+
			"A negative time indicates the cert is expired.",
	)
	certChainExpirySeconds = monitoring.NewDerivedGauge(
		"citadel_server_cert_chain_expiry_seconds",
		"The time remaining, in seconds, before the certificate chain will expire. "+
			"A negative value indicates the cert is expired.",
	)
)

apiVersion: release-notes/v2
kind: bug-fix
area: traffic-management
issue:
  - 31166
releaseNotes:
  - |

	return true
}

// AddCertWithConstraint adds a certificate to the pool with the additional
// constraint. When Certificate.Verify builds a chain which is rooted by cert,
// it will additionally pass the whole chain to constraint to determine its
// validity. If constraint returns a non-nil error, the chain will be discarded.
// constraint may be called concurrently from multiple goroutines.

        ClassWriter classWriter = new ClassWriter(ClassWriter.COMPUTE_MAXS);
        Pair<RelativePath, ClassVisitor> chain = transform.apply(classEntry, classWriter, new ClassData(reader, content, typeRegistry));
        reader.accept(chain.right, 0);
        byte[] bytes = classWriter.toByteArray();
        builder.put(chain.left.getPathString(), bytes, classEntry.getCompressionMethod());
    }

    /**

RESOURCE NAME     TYPE           STATUS     VALID CERT     SERIAL NUMBER                        NOT AFTER                NOT BEFORE
default           Cert Chain     ACTIVE     false          6fbee254c22900615cb1f74e3d2f1713     2023-05-16T01:32:52Z     2023-05-15T01:30:52Z

User -> DefaultGradleConnector: connect()
DefaultGradleConnector -> ConnectionFactory: create()
ConnectionFactory --> DefaultGradleConnector: DefaultProjectConnection
note left
With a chain of ConsumerActionExecutors
and tooling implementation loader
end note

apiVersion: release-notes/v2
kind: bug-fix
area: traffic-management

issue:
  - 51377

releaseNotes:
- |

			caller:             nil,
			authenticateErrMsg: "unsupported auth type: \"not-tls\"",
			fakeAuthInfo:       &mockAuthInfo{"not-tls"},
		},
		"Empty cert chain": {
			certChain:          [][]*x509.Certificate{},
			caller:             nil,
			authenticateErrMsg: "no verified chain is found",
		},
		"Certificate has no SAN": {
			certChain: [][]*x509.Certificate{
				{
					{
						Version: 1,
					},
				},
			},

apiVersion: release-notes/v2
kind: bug-fix
area: traffic-management
issue:
- 44385
releaseNotes:
- |