if err != nil {
			c.sendAlert(alertInternalError)
			return err
		}
		hs.keyShareKeys = &keySharePrivateKeys{curveID: curveID, ecdhe: key}
		hello.keyShares = []keyShare{{group: curveID, data: key.PublicKey().Bytes()}}
	}

	if len(hello.pskIdentities) > 0 {
		pskSuite := cipherSuiteTLS13ByID(hs.session.cipherSuite)
		if pskSuite == nil {
			return c.sendAlert(alertInternalError)
		}

	template.IPAddresses = append(template.IPAddresses, alternateIPs...)
	template.DNSNames = append(template.DNSNames, alternateDNS...)

	derBytes, err := x509.CreateCertificate(cryptorand.Reader, &template, &template, &priv.PublicKey, priv)
	if err != nil {
		return nil, nil, err
	}

	// Generate cert
	certBuffer := bytes.Buffer{}
	if err := pem.Encode(&certBuffer, &pem.Block{Type: "CERTIFICATE", Bytes: derBytes}); err != nil {

// ignored.
//
// The inputs are not considered confidential, and may leak through timing side
// channels, or if an attacker has control of part of the inputs.
func VerifyPSS(pub *PublicKey, hash crypto.Hash, digest []byte, sig []byte, opts *PSSOptions) error {
	if boring.Enabled {
		bkey, err := boringPublicKey(pub)
		if err != nil {
			return err
		}

	clientWCC := &writeCountingConn{Conn: c}
	serverWCC := &writeCountingConn{Conn: s}

	serverConfig := testConfig.Clone()

	// Cause a signature-time error
	brokenKey := rsa.PrivateKey{PublicKey: testRSAPrivateKey.PublicKey}
	brokenKey.D = big.NewInt(42)
	serverConfig.Certificates = []Certificate{{
		Certificate: [][]byte{testRSACertificate},
		PrivateKey:  &brokenKey,
	}}

	go func() {

pkg crypto/x509, const UnconstrainedName = 7
pkg crypto/x509, const UnconstrainedName InvalidReason
pkg crypto/x509, func MarshalPKCS1PublicKey(*rsa.PublicKey) []uint8
pkg crypto/x509, func MarshalPKCS8PrivateKey(interface{}) ([]uint8, error)
pkg crypto/x509, func ParsePKCS1PublicKey([]uint8) (*rsa.PublicKey, error)
pkg crypto/x509, method (PublicKeyAlgorithm) String() string
pkg crypto/x509, type Certificate struct, ExcludedEmailAddresses []string

		supportedVersions:  []uint16{VersionTLS13},
		cipherSuites:       []uint16{TLS_CHACHA20_POLY1305_SHA256},
		compressionMethods: []uint8{compressionNone},
		keyShares:          []keyShare{{group: X25519, data: pk.PublicKey().Bytes()}},
		supportedCurves:    []CurveID{CurveP256},
	}
	testClientHelloFailure(t, testConfig, clientHello, "client sent key share for group it does not support")
}

func TestHandshakeServerALPN(t *testing.T) {

	rsaBits := 2048

	if len(host) == 0 {
		return nil, nil, fmt.Errorf("Missing host parameter")
	}

	publicKey := func(priv interface{}) interface{} {
		switch k := priv.(type) {
		case *rsa.PrivateKey:
			return &k.PublicKey
		case *ecdsa.PrivateKey:
			return &k.PublicKey
		default:
			return nil
		}
	}

	pemBlockForKey := func(priv interface{}) *pem.Block {

	// load main cert *original description until 2023-08-18*

	/*
		kubernetes mutual (2-way) x509 between client and apiserver:

			>1. apiserver sending its apiserver certificate along with its publickey to client
			2. client verifies the apiserver certificate sent against its cluster certificate authority data
			3. client sending its client certificate along with its public key to the apiserver

		return nil, err
	}

	if parent == nil {
		parent = template
	}
	derBytes, err := CreateCertificate(rand.Reader, template, parent, &key.PublicKey, parentKey)
	if err != nil {
		return nil, err
	}

	caCert, err := ParseCertificate(derBytes)
	if err != nil {
		return nil, err
	}

	return caCert, nil
}

		return nil, caerror.NewError(caerror.TTLError, fmt.Errorf(
			"requested TTL %s is greater than the max allowed TTL %s", requestedLifetime, ca.maxCertTTL))
	}

	certBytes, err := util.GenCertFromCSR(csr, signingCert, csr.PublicKey, *signingKey, subjectIDs, lifetime, forCA)
	if err != nil {
		return nil, caerror.NewError(caerror.CertGenError, err)
	}

	block := &pem.Block{
		Type:  "CERTIFICATE",
		Bytes: certBytes,
	}