}

		if !reflect.DeepEqual(cert.ExtKeyUsage, testExtKeyUsage) {
			t.Errorf("%s: extkeyusage wasn't correctly copied from the template. Got %v, want %v", test.name, cert.ExtKeyUsage, testExtKeyUsage)
		}

		if !reflect.DeepEqual(cert.UnknownExtKeyUsage, testUnknownExtKeyUsage) {

		CommonName:   cert.Subject.CommonName,
		Organization: cert.Subject.Organization,
		AltNames: certutil.AltNames{
			IPs:      cert.IPAddresses,
			DNSNames: cert.DNSNames,
		},
		Usages: cert.ExtKeyUsage,
	}
}

func loadCertConfigMutators(certBaseName string) []certConfigMutatorFunc {
	return nil

pkg crypto/x509, const ExtKeyUsageMicrosoftCommercialCodeSigning = 12
pkg crypto/x509, const ExtKeyUsageMicrosoftCommercialCodeSigning ExtKeyUsage
pkg crypto/x509, const ExtKeyUsageMicrosoftKernelCodeSigning = 13
pkg crypto/x509, const ExtKeyUsageMicrosoftKernelCodeSigning ExtKeyUsage
pkg crypto/x509, const NameConstraintsWithoutSANs = 6
pkg crypto/x509, const NameConstraintsWithoutSANs InvalidReason

	if !globalIAMSys.STSTLSConfig.InsecureSkipVerify { // Verify whether the client certificate has been issued by a trusted CA.
		_, err := certificate.Verify(x509.VerifyOptions{
			KeyUsages: []x509.ExtKeyUsage{
				x509.ExtKeyUsageClientAuth,
			},
			Roots: globalRootCAs,
		})
		if err != nil {
			writeSTSErrorResponse(ctx, w, ErrSTSInvalidClientCertificate, err)
			return
		}
	} else {

	return pkiutil.CertConfig{
		Config: certutil.Config{
			CommonName:   spec.ClientName,
			Organization: spec.ClientCertAuth.Organizations,
			Usages:       []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
		},
		NotAfter:            spec.ClientCertNotAfter,
		EncryptionAlgorithm: spec.EncryptionAlgorithm,
	}
}

		opts := x509.VerifyOptions{
			Roots:         c.config.ClientCAs,
			CurrentTime:   c.config.time(),
			Intermediates: x509.NewCertPool(),
			KeyUsages:     []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
		}

		for _, cert := range certs[1:] {
			opts.Intermediates.AddCert(cert)
		}

		chains, err := certs[0].Verify(opts)
		if err != nil {

			Organization: []string{"Acme Co"},
		},
		NotBefore: notBefore,
		NotAfter:  notAfter,

		KeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
		BasicConstraintsValid: true,
	}

	hosts := strings.Split(host, ",")
	for _, h := range hosts {
		if ip := net.ParseIP(h); ip != nil {

pkg crypto/x509, const ExtKeyUsageAny ExtKeyUsage
pkg crypto/x509, const ExtKeyUsageClientAuth ExtKeyUsage
pkg crypto/x509, const ExtKeyUsageCodeSigning ExtKeyUsage
pkg crypto/x509, const ExtKeyUsageEmailProtection ExtKeyUsage
pkg crypto/x509, const ExtKeyUsageOCSPSigning ExtKeyUsage
pkg crypto/x509, const ExtKeyUsageServerAuth ExtKeyUsage
pkg crypto/x509, const ExtKeyUsageTimeStamping ExtKeyUsage
pkg crypto/x509, const KeyUsageCRLSign KeyUsage

		{"Certificate.ExcludedDNSDomains", Field, 9},
		{"Certificate.ExcludedEmailAddresses", Field, 10},
		{"Certificate.ExcludedIPRanges", Field, 10},
		{"Certificate.ExcludedURIDomains", Field, 10},
		{"Certificate.ExtKeyUsage", Field, 0},
		{"Certificate.Extensions", Field, 2},
		{"Certificate.ExtraExtensions", Field, 2},
		{"Certificate.IPAddresses", Field, 1},
		{"Certificate.IsCA", Field, 0},
		{"Certificate.Issuer", Field, 0},

pkg crypto/x509, const ExtKeyUsageIPSECEndSystem ExtKeyUsage
pkg crypto/x509, const ExtKeyUsageIPSECTunnel = 6
pkg crypto/x509, const ExtKeyUsageIPSECTunnel ExtKeyUsage
pkg crypto/x509, const ExtKeyUsageIPSECUser = 7
pkg crypto/x509, const ExtKeyUsageIPSECUser ExtKeyUsage
pkg crypto/x509, const ExtKeyUsageMicrosoftServerGatedCrypto = 10
pkg crypto/x509, const ExtKeyUsageMicrosoftServerGatedCrypto ExtKeyUsage