package x509

Import Path
	crypto/x509 (on golang.org and go.dev)

Dependency Relation
	imports 36 packages, and imported by 2 packages

Involved Source Files
	    cert_pool.go
	    pem_decrypt.go
	    pkcs1.go
	    pkcs8.go
	    root.go
	    root_linux.go
	    root_unix.go
	    sec1.go
	    verify.go
	d-> x509.go

Exported Type Names

	 type Certificate (struct)
		A Certificate represents an X.509 certificate.

		Exported Fields (44)
			AuthorityKeyId []byte
			BasicConstraintsValid bool
			CRLDistributionPoints []string
			DNSNames []string
			EmailAddresses []string
			ExcludedDNSDomains []string
			ExcludedEmailAddresses []string
			ExcludedIPRanges []*net.IPNet
			ExcludedURIDomains []string
			ExtKeyUsage []ExtKeyUsage
			Extensions []pkix.Extension
			ExtraExtensions []pkix.Extension
			IPAddresses []net.IP
			IsCA bool
			Issuer pkix.Name
			IssuingCertificateURL []string
			KeyUsage KeyUsage
			MaxPathLen int
			MaxPathLenZero bool
			NotAfter time.Time
			NotBefore time.Time
			OCSPServer []string
			PermittedDNSDomains []string
			PermittedDNSDomainsCritical bool
			PermittedEmailAddresses []string
			PermittedIPRanges []*net.IPNet
			PermittedURIDomains []string
			PolicyIdentifiers []asn1.ObjectIdentifier
			PublicKey interface{}
			PublicKeyAlgorithm PublicKeyAlgorithm
			Raw []byte
			RawIssuer []byte
			RawSubject []byte
			RawSubjectPublicKeyInfo []byte
			RawTBSCertificate []byte
			SerialNumber *big.Int
			Signature []byte
			SignatureAlgorithm SignatureAlgorithm
			Subject pkix.Name
			SubjectKeyId []byte
			URIs []*url.URL
			UnhandledCriticalExtensions []asn1.ObjectIdentifier
			UnknownExtKeyUsage []asn1.ObjectIdentifier
			Version int
		Exported Methods (7)
			(*T) CheckCRLSignature(crl *pkix.CertificateList) error
			(*T) CheckSignature(algo SignatureAlgorithm, signed, signature []byte) error
			(*T) CheckSignatureFrom(parent *Certificate) error
			(*T) CreateCRL(rand io.Reader, priv interface{}, revokedCerts []pkix.RevokedCertificate, now, expiry time.Time) (crlBytes []byte, err error)
			(*T) Equal(other *Certificate) bool
			(*T) Verify(opts VerifyOptions) (chains [][]*Certificate, err error)
			(*T) VerifyHostname(h string) error
		As Outputs Of (4+)
			func ParseCertificate(asn1Data []byte) (*Certificate, error)
			func ParseCertificates(asn1Data []byte) ([]*Certificate, error)
			func (*Certificate).Verify(opts VerifyOptions) (chains [][]*Certificate, err error)
			func net/http/httptest.(*Server).Certificate() *Certificate
		As Inputs Of (5+)
			func CreateCertificate(rand io.Reader, template, parent *Certificate, pub, priv interface{}) (cert []byte, err error)
			func CreateRevocationList(rand io.Reader, template *RevocationList, issuer *Certificate, priv crypto.Signer) ([]byte, error)
			func (*Certificate).CheckSignatureFrom(parent *Certificate) error
			func (*Certificate).Equal(other *Certificate) bool
			func (*CertPool).AddCert(cert *Certificate)
	 type CertificateInvalidError (struct)
		CertificateInvalidError results when an odd error occurs. Users of this
		library probably want to handle all these errors uniformly.

		Exported Fields (3)
			Cert *Certificate
			Detail string
			Reason InvalidReason
		One Exported Method
			 (T) Error() string
		Implements (1+)
			 T : error
	 type CertificateRequest (struct)
		CertificateRequest represents a PKCS #10, certificate signature request.

		Exported Fields (17)
			Attributes []pkix.AttributeTypeAndValueSET
			DNSNames []string
			EmailAddresses []string
			Extensions []pkix.Extension
			ExtraExtensions []pkix.Extension
			IPAddresses []net.IP
			PublicKey interface{}
			PublicKeyAlgorithm PublicKeyAlgorithm
			Raw []byte
			RawSubject []byte
			RawSubjectPublicKeyInfo []byte
			RawTBSCertificateRequest []byte
			Signature []byte
			SignatureAlgorithm SignatureAlgorithm
			Subject pkix.Name
			URIs []*url.URL
			Version int
		One Exported Method
			(*T) CheckSignature() error
		As Outputs Of (1+)
			func ParseCertificateRequest(asn1Data []byte) (*CertificateRequest, error)
		As Inputs Of (1+)
			func CreateCertificateRequest(rand io.Reader, template *CertificateRequest, priv interface{}) (csr []byte, err error)
	 type CertPool (struct)
		CertPool is a set of certificates.

		Exported Methods (3)
			(*T) AddCert(cert *Certificate)
			(*T) AppendCertsFromPEM(pemCerts []byte) (ok bool)
			(*T) Subjects() [][]byte
		As Outputs Of (2+)
			func NewCertPool() *CertPool
			func SystemCertPool() (*CertPool, error)
	 type ConstraintViolationError (struct)
		ConstraintViolationError results when a requested usage is not permitted by
		a certificate. For example: checking a signature when the public key isn't a
		certificate signing key.

		One Exported Method
			 (T) Error() string
		Implements (1+)
			 T : error
	 type ExtKeyUsage int
		ExtKeyUsage represents an extended set of actions that are valid for a given key.
		Each of the ExtKeyUsage* constants define a unique action.

		As Types Of (14+)
			const ExtKeyUsageAny
			const ExtKeyUsageClientAuth
			const ExtKeyUsageCodeSigning
			const ExtKeyUsageEmailProtection
			const ExtKeyUsageIPSECEndSystem
			const ExtKeyUsageIPSECTunnel
			const ExtKeyUsageIPSECUser
			const ExtKeyUsageMicrosoftCommercialCodeSigning
			const ExtKeyUsageMicrosoftKernelCodeSigning
			const ExtKeyUsageMicrosoftServerGatedCrypto
			const ExtKeyUsageNetscapeServerGatedCrypto
			const ExtKeyUsageOCSPSigning
			const ExtKeyUsageServerAuth
			const ExtKeyUsageTimeStamping
	 type HostnameError (struct)
		HostnameError results when the set of authorized names doesn't match the
		requested name.

		Exported Fields (2)
			Certificate *Certificate
			Host string
		One Exported Method
			 (T) Error() string
		Implements (1+)
			 T : error
	 type InsecureAlgorithmError SignatureAlgorithm
		An InsecureAlgorithmError

		One Exported Method
			 (T) Error() string
		Implements (1+)
			 T : error
	 type InvalidReason int

		As Types Of (10+)
			const CANotAuthorizedForExtKeyUsage
			const CANotAuthorizedForThisName
			const Expired
			const IncompatibleUsage
			const NameConstraintsWithoutSANs
			const NameMismatch
			const NotAuthorizedToSign
			const TooManyConstraints
			const TooManyIntermediates
			const UnconstrainedName
	 type KeyUsage int
		KeyUsage represents the set of actions that are valid for a given key. It's
		a bitmap of the KeyUsage* constants.

		As Types Of (9+)
			const KeyUsageCertSign
			const KeyUsageContentCommitment
			const KeyUsageCRLSign
			const KeyUsageDataEncipherment
			const KeyUsageDecipherOnly
			const KeyUsageDigitalSignature
			const KeyUsageEncipherOnly
			const KeyUsageKeyAgreement
			const KeyUsageKeyEncipherment
	 type PEMCipher int

		As Inputs Of (1+)
			func EncryptPEMBlock(rand io.Reader, blockType string, data, password []byte, alg PEMCipher) (*pem.Block, error)
		As Types Of (5+)
			const PEMCipher3DES
			const PEMCipherAES128
			const PEMCipherAES192
			const PEMCipherAES256
			const PEMCipherDES
	 type PublicKeyAlgorithm int

		One Exported Method
			 (T) String() string
		Implements (2+)
			 T : expvar.Var
			 T : fmt.Stringer
		As Types Of (5+)
			const DSA
			const ECDSA
			const Ed25519
			const RSA
			const UnknownPublicKeyAlgorithm
	 type RevocationList (struct)
		RevocationList contains the fields used to create an X.509 v2 Certificate
		Revocation list with CreateRevocationList.

		Exported Fields (6)
			ExtraExtensions []pkix.Extension
			NextUpdate time.Time
			Number *big.Int
			RevokedCertificates []pkix.RevokedCertificate
			SignatureAlgorithm SignatureAlgorithm
			ThisUpdate time.Time
		As Inputs Of (1+)
			func CreateRevocationList(rand io.Reader, template *RevocationList, issuer *Certificate, priv crypto.Signer) ([]byte, error)
	 type SignatureAlgorithm int

		One Exported Method
			 (T) String() string
		Implements (2+)
			 T : expvar.Var
			 T : fmt.Stringer
		As Inputs Of (1+)
			func (*Certificate).CheckSignature(algo SignatureAlgorithm, signed, signature []byte) error
		As Types Of (17+)
			const DSAWithSHA1
			const DSAWithSHA256
			const ECDSAWithSHA1
			const ECDSAWithSHA256
			const ECDSAWithSHA384
			const ECDSAWithSHA512
			const MD2WithRSA
			const MD5WithRSA
			const PureEd25519
			const SHA1WithRSA
			const SHA256WithRSA
			const SHA256WithRSAPSS
			const SHA384WithRSA
			const SHA384WithRSAPSS
			const SHA512WithRSA
			const SHA512WithRSAPSS
			const UnknownSignatureAlgorithm
	 type SystemRootsError (struct)
		SystemRootsError results when we fail to load the system root certificates.

		One Exported Field
			Err error
		One Exported Method
			 (T) Error() string
		Implements (1+)
			 T : error
	 type UnhandledCriticalExtension (struct)

		One Exported Method
			 (T) Error() string
		Implements (1+)
			 T : error
	 type UnknownAuthorityError (struct)
		UnknownAuthorityError results when the certificate issuer is unknown

		One Exported Field
			Cert *Certificate
		One Exported Method
			 (T) Error() string
		Implements (1+)
			 T : error
	 type VerifyOptions (struct)
		VerifyOptions contains parameters for Certificate.Verify.

		Exported Fields (6)
			CurrentTime time.Time
			DNSName string
			Intermediates *CertPool
			KeyUsages []ExtKeyUsage
			MaxConstraintComparisions int
			Roots *CertPool
		As Inputs Of (1+)
			func (*Certificate).Verify(opts VerifyOptions) (chains [][]*Certificate, err error)
Exported Values

	const CANotAuthorizedForExtKeyUsage InvalidReason = 9
		CANotAuthorizedForExtKeyUsage results when an intermediate or root
		certificate does not permit a requested extended key usage.
	const CANotAuthorizedForThisName InvalidReason = 2
		CANotAuthorizedForThisName results when an intermediate or root
		certificate has a name constraint which doesn't permit a DNS or
		other name (including IP address) in the leaf certificate.
	 func CreateCertificate(rand io.Reader, template, parent *Certificate, pub, priv interface{}) (cert []byte, err error)
		CreateCertificate creates a new X.509v3 certificate based on a template.
		The following members of template are used:

		 - AuthorityKeyId
		 - BasicConstraintsValid
		 - CRLDistributionPoints
		 - DNSNames
		 - EmailAddresses
		 - ExcludedDNSDomains
		 - ExcludedEmailAddresses
		 - ExcludedIPRanges
		 - ExcludedURIDomains
		 - ExtKeyUsage
		 - ExtraExtensions
		 - IPAddresses
		 - IsCA
		 - IssuingCertificateURL
		 - KeyUsage
		 - MaxPathLen
		 - MaxPathLenZero
		 - NotAfter
		 - NotBefore
		 - OCSPServer
		 - PermittedDNSDomains
		 - PermittedDNSDomainsCritical
		 - PermittedEmailAddresses
		 - PermittedIPRanges
		 - PermittedURIDomains
		 - PolicyIdentifiers
		 - SerialNumber
		 - SignatureAlgorithm
		 - Subject
		 - SubjectKeyId
		 - URIs
		 - UnknownExtKeyUsage

		The certificate is signed by parent. If parent is equal to template then the
		certificate is self-signed. The parameter pub is the public key of the
		signee and priv is the private key of the signer.

		The returned slice is the certificate in DER encoding.

		The currently supported key types are *rsa.PublicKey, *ecdsa.PublicKey and
		ed25519.PublicKey. pub must be a supported key type, and priv must be a
		crypto.Signer with a supported public key.

		The AuthorityKeyId will be taken from the SubjectKeyId of parent, if any,
		unless the resulting certificate is self-signed. Otherwise the value from
		template will be used.

		If SubjectKeyId from template is empty and the template is a CA, SubjectKeyId
		will be generated from the hash of the public key.
	 func CreateCertificateRequest(rand io.Reader, template *CertificateRequest, priv interface{}) (csr []byte, err error)
		CreateCertificateRequest creates a new certificate request based on a
		template. The following members of template are used:

		 - SignatureAlgorithm
		 - Subject
		 - DNSNames
		 - EmailAddresses
		 - IPAddresses
		 - URIs
		 - ExtraExtensions
		 - Attributes (deprecated)

		priv is the private key to sign the CSR with, and the corresponding public
		key will be included in the CSR. It must implement crypto.Signer and its
		Public() method must return a *rsa.PublicKey or a *ecdsa.PublicKey or a
		ed25519.PublicKey. (A *rsa.PrivateKey, *ecdsa.PrivateKey or
		ed25519.PrivateKey satisfies this.)

		The returned slice is the certificate request in DER encoding.
	 func CreateRevocationList(rand io.Reader, template *RevocationList, issuer *Certificate, priv crypto.Signer) ([]byte, error)
		CreateRevocationList creates a new X.509 v2 Certificate Revocation List,
		according to RFC 5280, based on template.

		The CRL is signed by priv which should be the private key associated with
		the public key in the issuer certificate.

		The issuer may not be nil, and the crlSign bit must be set in KeyUsage in
		order to use it as a CRL issuer.

		The issuer distinguished name CRL field and authority key identifier
		extension are populated using the issuer certificate. issuer must have
		SubjectKeyId set.
	 func DecryptPEMBlock(b *pem.Block, password []byte) ([]byte, error)
		DecryptPEMBlock takes a password encrypted PEM block and the password used to
		encrypt it and returns a slice of decrypted DER encoded bytes. It inspects
		the DEK-Info header to determine the algorithm used for decryption. If no
		DEK-Info header is present, an error is returned. If an incorrect password
		is detected an IncorrectPasswordError is returned. Because of deficiencies
		in the encrypted-PEM format, it's not always possible to detect an incorrect
		password. In these cases no error will be returned but the decrypted DER
		bytes will be random noise.
	const DSA PublicKeyAlgorithm = 2
	const DSAWithSHA1 SignatureAlgorithm = 7
	const DSAWithSHA256 SignatureAlgorithm = 8
	const ECDSA PublicKeyAlgorithm = 3
	const ECDSAWithSHA1 SignatureAlgorithm = 9
	const ECDSAWithSHA256 SignatureAlgorithm = 10
	const ECDSAWithSHA384 SignatureAlgorithm = 11
	const ECDSAWithSHA512 SignatureAlgorithm = 12
	const Ed25519 PublicKeyAlgorithm = 4
	 func EncryptPEMBlock(rand io.Reader, blockType string, data, password []byte, alg PEMCipher) (*pem.Block, error)
		EncryptPEMBlock returns a PEM block of the specified type holding the
		given DER-encoded data encrypted with the specified algorithm and
		password.
	  var ErrUnsupportedAlgorithm error
		ErrUnsupportedAlgorithm results from attempting to perform an operation that
		involves algorithms that are not currently implemented.
	const Expired InvalidReason = 1
		Expired results when a certificate has expired, based on the time
		given in the VerifyOptions.
	const ExtKeyUsageAny ExtKeyUsage = 0
	const ExtKeyUsageClientAuth ExtKeyUsage = 2
	const ExtKeyUsageCodeSigning ExtKeyUsage = 3
	const ExtKeyUsageEmailProtection ExtKeyUsage = 4
	const ExtKeyUsageIPSECEndSystem ExtKeyUsage = 5
	const ExtKeyUsageIPSECTunnel ExtKeyUsage = 6
	const ExtKeyUsageIPSECUser ExtKeyUsage = 7
	const ExtKeyUsageMicrosoftCommercialCodeSigning ExtKeyUsage = 12
	const ExtKeyUsageMicrosoftKernelCodeSigning ExtKeyUsage = 13
	const ExtKeyUsageMicrosoftServerGatedCrypto ExtKeyUsage = 10
	const ExtKeyUsageNetscapeServerGatedCrypto ExtKeyUsage = 11
	const ExtKeyUsageOCSPSigning ExtKeyUsage = 9
	const ExtKeyUsageServerAuth ExtKeyUsage = 1
	const ExtKeyUsageTimeStamping ExtKeyUsage = 8
	const IncompatibleUsage InvalidReason = 4
		IncompatibleUsage results when the certificate's key usage indicates
		that it may only be used for a different purpose.
	  var IncorrectPasswordError error
		IncorrectPasswordError is returned when an incorrect password is detected.
	 func IsEncryptedPEMBlock(b *pem.Block) bool
		IsEncryptedPEMBlock returns if the PEM block is password encrypted.
	const KeyUsageCertSign KeyUsage = 32
	const KeyUsageContentCommitment KeyUsage = 2
	const KeyUsageCRLSign KeyUsage = 64
	const KeyUsageDataEncipherment KeyUsage = 8
	const KeyUsageDecipherOnly KeyUsage = 256
	const KeyUsageDigitalSignature KeyUsage = 1
	const KeyUsageEncipherOnly KeyUsage = 128
	const KeyUsageKeyAgreement KeyUsage = 16
	const KeyUsageKeyEncipherment KeyUsage = 4
	 func MarshalECPrivateKey(key *ecdsa.PrivateKey) ([]byte, error)
		MarshalECPrivateKey converts an EC private key to SEC 1, ASN.1 DER form.

		This kind of key is commonly encoded in PEM blocks of type "EC PRIVATE KEY".
		For a more flexible key format which is not EC specific, use
		MarshalPKCS8PrivateKey.
	 func MarshalPKCS1PrivateKey(key *rsa.PrivateKey) []byte
		MarshalPKCS1PrivateKey converts an RSA private key to PKCS #1, ASN.1 DER form.

		This kind of key is commonly encoded in PEM blocks of type "RSA PRIVATE KEY".
		For a more flexible key format which is not RSA specific, use
		MarshalPKCS8PrivateKey.
	 func MarshalPKCS1PublicKey(key *rsa.PublicKey) []byte
		MarshalPKCS1PublicKey converts an RSA public key to PKCS #1, ASN.1 DER form.

		This kind of key is commonly encoded in PEM blocks of type "RSA PUBLIC KEY".
	 func MarshalPKCS8PrivateKey(key interface{}) ([]byte, error)
		MarshalPKCS8PrivateKey converts a private key to PKCS #8, ASN.1 DER form.

		The following key types are currently supported: *rsa.PrivateKey, *ecdsa.PrivateKey
		and ed25519.PrivateKey. Unsupported key types result in an error.

		This kind of key is commonly encoded in PEM blocks of type "PRIVATE KEY".
	 func MarshalPKIXPublicKey(pub interface{}) ([]byte, error)
		MarshalPKIXPublicKey converts a public key to PKIX, ASN.1 DER form.
		The encoded public key is a SubjectPublicKeyInfo structure
		(see RFC 5280, Section 4.1).

		The following key types are currently supported: *rsa.PublicKey, *ecdsa.PublicKey
		and ed25519.PublicKey. Unsupported key types result in an error.

		This kind of key is commonly encoded in PEM blocks of type "PUBLIC KEY".
	const MD2WithRSA SignatureAlgorithm = 1
	const MD5WithRSA SignatureAlgorithm = 2
	const NameConstraintsWithoutSANs InvalidReason = 6
		NameConstraintsWithoutSANs results when a leaf certificate doesn't
		contain a Subject Alternative Name extension, but a CA certificate
		contains name constraints, and the Common Name can be interpreted as
		a hostname.

		This error is only returned when legacy Common Name matching is enabled
		by setting the GODEBUG environment variable to "x509ignoreCN=1". This
		setting might be removed in the future.
	const NameMismatch InvalidReason = 5
		NameMismatch results when the subject name of a parent certificate
		does not match the issuer name in the child.
	 func NewCertPool() *CertPool
		NewCertPool returns a new, empty CertPool.
	const NotAuthorizedToSign InvalidReason = 0
		NotAuthorizedToSign results when a certificate is signed by another
		which isn't marked as a CA certificate.
	 func ParseCertificate(asn1Data []byte) (*Certificate, error)
		ParseCertificate parses a single certificate from the given ASN.1 DER data.
	 func ParseCertificateRequest(asn1Data []byte) (*CertificateRequest, error)
		ParseCertificateRequest parses a single certificate request from the
		given ASN.1 DER data.
	 func ParseCertificates(asn1Data []byte) ([]*Certificate, error)
		ParseCertificates parses one or more certificates from the given ASN.1 DER
		data. The certificates must be concatenated with no intermediate padding.
	 func ParseCRL(crlBytes []byte) (*pkix.CertificateList, error)
		ParseCRL parses a CRL from the given bytes. It's often the case that PEM
		encoded CRLs will appear where they should be DER encoded, so this function
		will transparently handle PEM encoding as long as there isn't any leading
		garbage.
	 func ParseDERCRL(derBytes []byte) (*pkix.CertificateList, error)
		ParseDERCRL parses a DER encoded CRL from the given bytes.
	 func ParseECPrivateKey(der []byte) (*ecdsa.PrivateKey, error)
		ParseECPrivateKey parses an EC private key in SEC 1, ASN.1 DER form.

		This kind of key is commonly encoded in PEM blocks of type "EC PRIVATE KEY".
	 func ParsePKCS1PrivateKey(der []byte) (*rsa.PrivateKey, error)
		ParsePKCS1PrivateKey parses an RSA private key in PKCS #1, ASN.1 DER form.

		This kind of key is commonly encoded in PEM blocks of type "RSA PRIVATE KEY".
	 func ParsePKCS1PublicKey(der []byte) (*rsa.PublicKey, error)
		ParsePKCS1PublicKey parses an RSA public key in PKCS #1, ASN.1 DER form.

		This kind of key is commonly encoded in PEM blocks of type "RSA PUBLIC KEY".
	 func ParsePKCS8PrivateKey(der []byte) (key interface{}, err error)
		ParsePKCS8PrivateKey parses an unencrypted private key in PKCS #8, ASN.1 DER form.

		It returns a *rsa.PrivateKey, a *ecdsa.PrivateKey, or a ed25519.PrivateKey.
		More types might be supported in the future.

		This kind of key is commonly encoded in PEM blocks of type "PRIVATE KEY".
	 func ParsePKIXPublicKey(derBytes []byte) (pub interface{}, err error)
		ParsePKIXPublicKey parses a public key in PKIX, ASN.1 DER form.
		The encoded public key is a SubjectPublicKeyInfo structure
		(see RFC 5280, Section 4.1).

		It returns a *rsa.PublicKey, *dsa.PublicKey, *ecdsa.PublicKey, or
		ed25519.PublicKey. More types might be supported in the future.

		This kind of key is commonly encoded in PEM blocks of type "PUBLIC KEY".
	const PEMCipher3DES PEMCipher = 2
		Possible values for the EncryptPEMBlock encryption algorithm.
	const PEMCipherAES128 PEMCipher = 3
		Possible values for the EncryptPEMBlock encryption algorithm.
	const PEMCipherAES192 PEMCipher = 4
		Possible values for the EncryptPEMBlock encryption algorithm.
	const PEMCipherAES256 PEMCipher = 5
		Possible values for the EncryptPEMBlock encryption algorithm.
	const PEMCipherDES PEMCipher = 1
		Possible values for the EncryptPEMBlock encryption algorithm.
	const PureEd25519 SignatureAlgorithm = 16
	const RSA PublicKeyAlgorithm = 1
	const SHA1WithRSA SignatureAlgorithm = 3
	const SHA256WithRSA SignatureAlgorithm = 4
	const SHA256WithRSAPSS SignatureAlgorithm = 13
	const SHA384WithRSA SignatureAlgorithm = 5
	const SHA384WithRSAPSS SignatureAlgorithm = 14
	const SHA512WithRSA SignatureAlgorithm = 6
	const SHA512WithRSAPSS SignatureAlgorithm = 15
	 func SystemCertPool() (*CertPool, error)
		SystemCertPool returns a copy of the system cert pool.

		On Unix systems other than macOS the environment variables SSL_CERT_FILE and
		SSL_CERT_DIR can be used to override the system default locations for the SSL
		certificate file and SSL certificate files directory, respectively. The
		latter can be a colon-separated list.

		Any mutations to the returned pool are not written to disk and do not affect
		any other pool returned by SystemCertPool.

		New changes in the system cert pool might not be reflected in subsequent calls.
	const TooManyConstraints InvalidReason = 8
		TooManyConstraints results when the number of comparison operations
		needed to check a certificate exceeds the limit set by
		VerifyOptions.MaxConstraintComparisions. This limit exists to
		prevent pathological certificates can consuming excessive amounts of
		CPU time to verify.
	const TooManyIntermediates InvalidReason = 3
		TooManyIntermediates results when a path length constraint is
		violated.
	const UnconstrainedName InvalidReason = 7
		UnconstrainedName results when a CA certificate contains permitted
		name constraints, but leaf certificate contains a name of an
		unsupported or unconstrained type.
	const UnknownPublicKeyAlgorithm PublicKeyAlgorithm = 0
	const UnknownSignatureAlgorithm SignatureAlgorithm = 0

The pages are generated with Golds v0.1.6-preview. (GOOS=linux GOARCH=amd64)
Golds is a Go 101 project and developed by Tapir Liu.
PR and bug reports are welcome and can be submitted to the issue list.
Please follow @Go100and1 (reachable from the left QR code) to get the latest news of Golds.