}
				for i, rce := range parsedCRL.RevokedCertificateEntries {
					expected := tc.template.RevokedCertificateEntries[i]
					if rce.SerialNumber.Cmp(expected.SerialNumber) != 0 {
						t.Fatalf("RevocationListEntry serial mismatch: got %d; want %d.",
							rce.SerialNumber, expected.SerialNumber)
					}
					if !rce.RevocationTime.Equal(expected.RevocationTime) {

  }

  companion object {
    internal var certA1: HeldCertificate =
      HeldCertificate.Builder()
        .serialNumber(100L)
        .build()
    internal var certA1Sha256Pin = CertificatePinner.pin(certA1.certificate)

    private var certB1 =
      HeldCertificate.Builder()
        .serialNumber(200L)
        .build()
    internal var certB1Sha256Pin = CertificatePinner.pin(certB1.certificate)

		return SecretMeta{}, err
	}
	var certType string
	if cert.IsCA {
		certType = "CA"
	} else {
		certType = "Cert Chain"
	}

	today := time.Now()
	return SecretMeta{
		SerialNumber: fmt.Sprintf("%x", cert.SerialNumber),
		NotAfter:     cert.NotAfter.Format(time.RFC3339),
		NotBefore:    cert.NotBefore.Format(time.RFC3339),
		Type:         certType,

type CertsDump struct {
	Identity  string  `json:"identity"`
	State     string  `json:"state"`
	CertChain []*Cert `json:"certChain"`
}

type Cert struct {
	Pem            string `json:"pem"`
	SerialNumber   string `json:"serialNumber"`
	ValidFrom      string `json:"validFrom"`
	ExpirationTime string `json:"expirationTime"`
}

type WorkloadState struct {
	State       string              `json:"state,omitempty"`

	if err != nil {
		t.Fatalf("tls connection failed: %s", err)
	}
	googChain := c.ConnectionState().PeerCertificates

	rootTmpl := &x509.Certificate{
		SerialNumber:          big.NewInt(1),
		Subject:               pkix.Name{CommonName: "Go test root"},
		IsCA:                  true,
		BasicConstraintsValid: true,
		NotBefore:             time.Now().Add(-time.Hour),

	for _, s := range secrets {
		if includeConfigType {
			s.Name = fmt.Sprintf("secret/%s", s.Name)
		}
		fmt.Fprintf(tw, "%s\t%s\t%s\t%t\t%s\t%s\t%s\n",
			s.Name, s.Type, s.State, s.Valid, s.SerialNumber, s.NotAfter, s.NotBefore)
	}
	return tw.Flush()
}

// printSecretItemsJSON prints secret in JSON format, and dumps the raw certificate data with the output

          subjectPublicKey = it[1] as BitString,
        )
      },
    )

  /**
   * ```
   * TBSCertificate ::= SEQUENCE  {
   *   version         [0]  EXPLICIT Version DEFAULT v1,
   *   serialNumber         CertificateSerialNumber,
   *   signature            AlgorithmIdentifier,
   *   issuer               Name,
   *   validity             Validity,
   *   subject              Name,

            tasks.register("myTask", MyTask.class)
        '''

        when:
        succeeds('myTask', '--serial=1234', '--serialNumber=4321')

        then:
        result.assertTaskExecuted(':myTask').assertOutputContains('Serial: 4321')

        when:
        succeeds('myTask', '--serialNumber=4321', '--serial=1234')

        then:
        result.assertTaskExecuted(':myTask').assertOutputContains('Serial: 4321')
    }

    }
  }
}

internal data class TbsCertificate(
  /** This is a integer enum. Use 0L for v1, 1L for v2, and 2L for v3. */
  val version: Long,
  val serialNumber: BigInteger,
  val signature: AlgorithmIdentifier,
  val issuer: List<List<AttributeTypeAndValue>>,
  val validity: Validity,
  val subject: List<List<AttributeTypeAndValue>>,

			if rce.SerialNumber == nil {
				return nil, errors.New("x509: template contains entry with nil SerialNumber field")
			}
			if rce.RevocationTime.IsZero() {
				return nil, errors.New("x509: template contains entry with zero RevocationTime field")
			}

			rc := pkix.RevokedCertificate{
				SerialNumber:   rce.SerialNumber,
				RevocationTime: rce.RevocationTime.UTC(),
			}