// Generated by Lisette bindgen
// Source: crypto/x509 (Go stdlib)
// Go: 1.25.5
// Lisette: 0.1.20

import "go:crypto"
import "go:crypto/ecdsa"
import "go:crypto/rsa"
import "go:crypto/x509/pkix"
import "go:encoding/asn1"
import "go:encoding/pem"
import "go:io"
import "go:math/big"
import "go:net"
import "go:net/url"
import "go:time"

pub enum ExtKeyUsage: int {
  ExtKeyUsageAny = 0,
  ExtKeyUsageClientAuth = 2,
  ExtKeyUsageCodeSigning = 3,
  ExtKeyUsageEmailProtection = 4,
  ExtKeyUsageIPSECEndSystem = 5,
  ExtKeyUsageIPSECTunnel = 6,
  ExtKeyUsageIPSECUser = 7,
  ExtKeyUsageMicrosoftCommercialCodeSigning = 12,
  ExtKeyUsageMicrosoftKernelCodeSigning = 13,
  ExtKeyUsageMicrosoftServerGatedCrypto = 10,
  ExtKeyUsageNetscapeServerGatedCrypto = 11,
  ExtKeyUsageOCSPSigning = 9,
  ExtKeyUsageServerAuth = 1,
  ExtKeyUsageTimeStamping = 8,
}

pub const ExtKeyUsageAny: ExtKeyUsage = 0

pub const ExtKeyUsageClientAuth: ExtKeyUsage = 2

pub const ExtKeyUsageCodeSigning: ExtKeyUsage = 3

pub const ExtKeyUsageEmailProtection: ExtKeyUsage = 4

pub const ExtKeyUsageIPSECEndSystem: ExtKeyUsage = 5

pub const ExtKeyUsageIPSECTunnel: ExtKeyUsage = 6

pub const ExtKeyUsageIPSECUser: ExtKeyUsage = 7

pub const ExtKeyUsageMicrosoftCommercialCodeSigning: ExtKeyUsage = 12

pub const ExtKeyUsageMicrosoftKernelCodeSigning: ExtKeyUsage = 13

pub const ExtKeyUsageMicrosoftServerGatedCrypto: ExtKeyUsage = 10

pub const ExtKeyUsageNetscapeServerGatedCrypto: ExtKeyUsage = 11

pub const ExtKeyUsageOCSPSigning: ExtKeyUsage = 9

pub const ExtKeyUsageServerAuth: ExtKeyUsage = 1

pub const ExtKeyUsageTimeStamping: ExtKeyUsage = 8

pub enum InvalidReason: int {
  CANotAuthorizedForExtKeyUsage = 9,
  CANotAuthorizedForThisName = 2,
  Expired = 1,
  IncompatibleUsage = 4,
  NameConstraintsWithoutSANs = 6,
  NameMismatch = 5,
  NoValidChains = 10,
  NotAuthorizedToSign = 0,
  TooManyConstraints = 8,
  TooManyIntermediates = 3,
  UnconstrainedName = 7,
}

pub const CANotAuthorizedForExtKeyUsage: InvalidReason = 9

pub const CANotAuthorizedForThisName: InvalidReason = 2

pub const Expired: InvalidReason = 1

pub const IncompatibleUsage: InvalidReason = 4

pub const NameConstraintsWithoutSANs: InvalidReason = 6

pub const NameMismatch: InvalidReason = 5

pub const NoValidChains: InvalidReason = 10

pub const NotAuthorizedToSign: InvalidReason = 0

pub const TooManyConstraints: InvalidReason = 8

pub const TooManyIntermediates: InvalidReason = 3

pub const UnconstrainedName: InvalidReason = 7

pub enum SignatureAlgorithm: int {
  DSAWithSHA1 = 7,
  DSAWithSHA256 = 8,
  ECDSAWithSHA1 = 9,
  ECDSAWithSHA256 = 10,
  ECDSAWithSHA384 = 11,
  ECDSAWithSHA512 = 12,
  MD2WithRSA = 1,
  MD5WithRSA = 2,
  PureEd25519 = 16,
  SHA1WithRSA = 3,
  SHA256WithRSA = 4,
  SHA256WithRSAPSS = 13,
  SHA384WithRSA = 5,
  SHA384WithRSAPSS = 14,
  SHA512WithRSA = 6,
  SHA512WithRSAPSS = 15,
  UnknownSignatureAlgorithm = 0,
}

pub const DSAWithSHA1: SignatureAlgorithm = 7

pub const DSAWithSHA256: SignatureAlgorithm = 8

pub const ECDSAWithSHA1: SignatureAlgorithm = 9

pub const ECDSAWithSHA256: SignatureAlgorithm = 10

pub const ECDSAWithSHA384: SignatureAlgorithm = 11

pub const ECDSAWithSHA512: SignatureAlgorithm = 12

pub const MD2WithRSA: SignatureAlgorithm = 1

pub const MD5WithRSA: SignatureAlgorithm = 2

pub const PureEd25519: SignatureAlgorithm = 16

pub const SHA1WithRSA: SignatureAlgorithm = 3

pub const SHA256WithRSA: SignatureAlgorithm = 4

pub const SHA256WithRSAPSS: SignatureAlgorithm = 13

pub const SHA384WithRSA: SignatureAlgorithm = 5

pub const SHA384WithRSAPSS: SignatureAlgorithm = 14

pub const SHA512WithRSA: SignatureAlgorithm = 6

pub const SHA512WithRSAPSS: SignatureAlgorithm = 15

pub const UnknownSignatureAlgorithm: SignatureAlgorithm = 0

/// CreateCertificate creates a new X.509 v3 certificate based on a template.
/// The following members of template are currently used:
/// 
///   - AuthorityKeyId
///   - BasicConstraintsValid
///   - CRLDistributionPoints
///   - DNSNames
///   - EmailAddresses
///   - ExcludedDNSDomains
///   - ExcludedEmailAddresses
///   - ExcludedIPRanges
///   - ExcludedURIDomains
///   - ExtKeyUsage
///   - ExtraExtensions
///   - IPAddresses
///   - IsCA
///   - IssuingCertificateURL
///   - KeyUsage
///   - MaxPathLen
///   - MaxPathLenZero
///   - NotAfter
///   - NotBefore
///   - OCSPServer
///   - PermittedDNSDomains
///   - PermittedDNSDomainsCritical
///   - PermittedEmailAddresses
///   - PermittedIPRanges
///   - PermittedURIDomains
///   - PolicyIdentifiers (see note below)
///   - Policies (see note below)
///   - SerialNumber
///   - SignatureAlgorithm
///   - Subject
///   - SubjectKeyId
///   - URIs
///   - UnknownExtKeyUsage
/// 
/// The certificate is signed by parent. If parent is equal to template then the
/// certificate is self-signed. The parameter pub is the public key of the
/// certificate to be generated and priv is the private key of the signer.
/// 
/// The returned slice is the certificate in DER encoding.
/// 
/// The currently supported key types are *rsa.PublicKey, *ecdsa.PublicKey and
/// ed25519.PublicKey. pub must be a supported key type, and priv must be a
/// crypto.Signer or crypto.MessageSigner with a supported public key.
/// 
/// The AuthorityKeyId will be taken from the SubjectKeyId of parent, if any,
/// unless the resulting certificate is self-signed. Otherwise the value from
/// template will be used.
/// 
/// If SubjectKeyId from template is empty and the template is a CA, SubjectKeyId
/// will be generated from the hash of the public key.
/// 
/// If template.SerialNumber is nil, a serial number will be generated which
/// conforms to RFC 5280, Section 4.1.2.2 using entropy from rand.
/// 
/// The PolicyIdentifier and Policies fields can both be used to marshal certificate
/// policy OIDs. By default, only the Policies is marshaled, but if the
/// GODEBUG setting "x509usepolicies" has the value "0", the PolicyIdentifiers field will
/// be marshaled instead of the Policies field. This changed in Go 1.24. The Policies field can
/// be used to marshal policy OIDs which have components that are larger than 31
/// bits.
pub fn CreateCertificate(
  rand: io.Reader,
  template: Ref<Certificate>,
  parent: Ref<Certificate>,
  pub_: Unknown,
  priv: Unknown,
) -> Result<Slice<uint8>, error>

/// CreateCertificateRequest creates a new certificate request based on a
/// template. The following members of template are used:
/// 
///   - SignatureAlgorithm
///   - Subject
///   - DNSNames
///   - EmailAddresses
///   - IPAddresses
///   - URIs
///   - ExtraExtensions
///   - Attributes (deprecated)
/// 
/// priv is the private key to sign the CSR with, and the corresponding public
/// key will be included in the CSR. It must implement crypto.Signer or
/// crypto.MessageSigner and its Public() method must return a *rsa.PublicKey or
/// a *ecdsa.PublicKey or a ed25519.PublicKey. (A *rsa.PrivateKey,
/// *ecdsa.PrivateKey or ed25519.PrivateKey satisfies this.)
/// 
/// The returned slice is the certificate request in DER encoding.
pub fn CreateCertificateRequest(
  rand: io.Reader,
  template: Ref<CertificateRequest>,
  priv: Unknown,
) -> Result<Slice<uint8>, error>

/// CreateRevocationList creates a new X.509 v2 [Certificate] Revocation List,
/// according to RFC 5280, based on template.
/// 
/// The CRL is signed by priv which should be a crypto.Signer or
/// crypto.MessageSigner associated with the public key in the issuer
/// certificate.
/// 
/// The issuer may not be nil, and the crlSign bit must be set in [KeyUsage] in
/// order to use it as a CRL issuer.
/// 
/// The issuer distinguished name CRL field and authority key identifier
/// extension are populated using the issuer certificate. issuer must have
/// SubjectKeyId set.
pub fn CreateRevocationList(
  rand: io.Reader,
  template: Ref<RevocationList>,
  issuer: Ref<Certificate>,
  priv: crypto.Signer,
) -> Result<Slice<uint8>, error>

/// DecryptPEMBlock takes a PEM block encrypted according to RFC 1423 and the
/// password used to encrypt it and returns a slice of decrypted DER encoded
/// bytes. It inspects the DEK-Info header to determine the algorithm used for
/// decryption. If no DEK-Info header is present, an error is returned. If an
/// incorrect password is detected an [IncorrectPasswordError] is returned. Because
/// of deficiencies in the format, it's not always possible to detect an
/// incorrect password. In these cases no error will be returned but the
/// decrypted DER bytes will be random noise.
/// 
/// Deprecated: Legacy PEM encryption as specified in RFC 1423 is insecure by
/// design. Since it does not authenticate the ciphertext, it is vulnerable to
/// padding oracle attacks that can let an attacker recover the plaintext.
pub fn DecryptPEMBlock(b: Ref<pem.Block>, password: Slice<uint8>) -> Result<Slice<uint8>, error>

/// EncryptPEMBlock returns a PEM block of the specified type holding the
/// given DER encoded data encrypted with the specified algorithm and
/// password according to RFC 1423.
/// 
/// Deprecated: Legacy PEM encryption as specified in RFC 1423 is insecure by
/// design. Since it does not authenticate the ciphertext, it is vulnerable to
/// padding oracle attacks that can let an attacker recover the plaintext.
pub fn EncryptPEMBlock(
  rand: io.Reader,
  blockType: string,
  data: Slice<uint8>,
  password: Slice<uint8>,
  alg: PEMCipher,
) -> Result<Ref<pem.Block>, error>

/// IsEncryptedPEMBlock returns whether the PEM block is password encrypted
/// according to RFC 1423.
/// 
/// Deprecated: Legacy PEM encryption as specified in RFC 1423 is insecure by
/// design. Since it does not authenticate the ciphertext, it is vulnerable to
/// padding oracle attacks that can let an attacker recover the plaintext.
pub fn IsEncryptedPEMBlock(b: Ref<pem.Block>) -> bool

/// MarshalECPrivateKey converts an EC private key to SEC 1, ASN.1 DER form.
/// 
/// This kind of key is commonly encoded in PEM blocks of type "EC PRIVATE KEY".
/// For a more flexible key format which is not EC specific, use
/// [MarshalPKCS8PrivateKey].
pub fn MarshalECPrivateKey(key: Ref<ecdsa.PrivateKey>) -> Result<Slice<uint8>, error>

/// MarshalPKCS1PrivateKey converts an [RSA] private key to PKCS #1, ASN.1 DER form.
/// 
/// This kind of key is commonly encoded in PEM blocks of type "RSA PRIVATE KEY".
/// For a more flexible key format which is not [RSA] specific, use
/// [MarshalPKCS8PrivateKey].
/// 
/// The key must have passed validation by calling [rsa.PrivateKey.Validate]
/// first. MarshalPKCS1PrivateKey calls [rsa.PrivateKey.Precompute], which may
/// modify the key if not already precomputed.
pub fn MarshalPKCS1PrivateKey(key: Ref<rsa.PrivateKey>) -> Slice<uint8>

/// MarshalPKCS1PublicKey converts an [RSA] public key to PKCS #1, ASN.1 DER form.
/// 
/// This kind of key is commonly encoded in PEM blocks of type "RSA PUBLIC KEY".
pub fn MarshalPKCS1PublicKey(key: Ref<rsa.PublicKey>) -> Slice<uint8>

/// MarshalPKCS8PrivateKey converts a private key to PKCS #8, ASN.1 DER form.
/// 
/// The following key types are currently supported: *[rsa.PrivateKey],
/// *[ecdsa.PrivateKey], [ed25519.PrivateKey] (not a pointer), and *[ecdh.PrivateKey].
/// Unsupported key types result in an error.
/// 
/// This kind of key is commonly encoded in PEM blocks of type "PRIVATE KEY".
/// 
/// MarshalPKCS8PrivateKey runs [rsa.PrivateKey.Precompute] on RSA keys.
pub fn MarshalPKCS8PrivateKey(key: Unknown) -> Result<Slice<uint8>, error>

/// MarshalPKIXPublicKey converts a public key to PKIX, ASN.1 DER form.
/// The encoded public key is a SubjectPublicKeyInfo structure
/// (see RFC 5280, Section 4.1).
/// 
/// The following key types are currently supported: *[rsa.PublicKey],
/// *[ecdsa.PublicKey], [ed25519.PublicKey] (not a pointer), and *[ecdh.PublicKey].
/// Unsupported key types result in an error.
/// 
/// This kind of key is commonly encoded in PEM blocks of type "PUBLIC KEY".
pub fn MarshalPKIXPublicKey(pub_: Unknown) -> Result<Slice<uint8>, error>

pub fn NewCertPool() -> Ref<CertPool>

pub fn OIDFromInts(oid: Slice<uint64>) -> Result<OID, error>

/// ParseCRL parses a CRL from the given bytes. It's often the case that PEM
/// encoded CRLs will appear where they should be DER encoded, so this function
/// will transparently handle PEM encoding as long as there isn't any leading
/// garbage.
/// 
/// Deprecated: Use [ParseRevocationList] instead.
pub fn ParseCRL(crlBytes: Slice<uint8>) -> Result<Ref<pkix.CertificateList>, error>

pub fn ParseCertificate(der: Slice<uint8>) -> Result<Ref<Certificate>, error>

pub fn ParseCertificateRequest(asn1Data: Slice<uint8>) -> Result<Ref<CertificateRequest>, error>

pub fn ParseCertificates(der: Slice<uint8>) -> Result<Slice<Ref<Certificate>>, error>

/// ParseDERCRL parses a DER encoded CRL from the given bytes.
/// 
/// Deprecated: Use [ParseRevocationList] instead.
pub fn ParseDERCRL(derBytes: Slice<uint8>) -> Result<Ref<pkix.CertificateList>, error>

/// ParseECPrivateKey parses an EC private key in SEC 1, ASN.1 DER form.
/// 
/// This kind of key is commonly encoded in PEM blocks of type "EC PRIVATE KEY".
pub fn ParseECPrivateKey(der: Slice<uint8>) -> Result<Ref<ecdsa.PrivateKey>, error>

pub fn ParseOID(oid: string) -> Result<OID, error>

/// ParsePKCS1PrivateKey parses an [RSA] private key in PKCS #1, ASN.1 DER form.
/// 
/// This kind of key is commonly encoded in PEM blocks of type "RSA PRIVATE KEY".
/// 
/// Before Go 1.24, the CRT parameters were ignored and recomputed. To restore
/// the old behavior, use the GODEBUG=x509rsacrt=0 environment variable.
pub fn ParsePKCS1PrivateKey(der: Slice<uint8>) -> Result<Ref<rsa.PrivateKey>, error>

/// ParsePKCS1PublicKey parses an [RSA] public key in PKCS #1, ASN.1 DER form.
/// 
/// This kind of key is commonly encoded in PEM blocks of type "RSA PUBLIC KEY".
pub fn ParsePKCS1PublicKey(der: Slice<uint8>) -> Result<Ref<rsa.PublicKey>, error>

/// ParsePKCS8PrivateKey parses an unencrypted private key in PKCS #8, ASN.1 DER form.
/// 
/// It returns a *[rsa.PrivateKey], an *[ecdsa.PrivateKey], an [ed25519.PrivateKey] (not
/// a pointer), or an *[ecdh.PrivateKey] (for X25519). More types might be supported
/// in the future.
/// 
/// This kind of key is commonly encoded in PEM blocks of type "PRIVATE KEY".
/// 
/// Before Go 1.24, the CRT parameters of RSA keys were ignored and recomputed.
/// To restore the old behavior, use the GODEBUG=x509rsacrt=0 environment variable.
pub fn ParsePKCS8PrivateKey(der: Slice<uint8>) -> Result<Unknown, error>

/// ParsePKIXPublicKey parses a public key in PKIX, ASN.1 DER form. The encoded
/// public key is a SubjectPublicKeyInfo structure (see RFC 5280, Section 4.1).
/// 
/// It returns a *[rsa.PublicKey], *[dsa.PublicKey], *[ecdsa.PublicKey],
/// [ed25519.PublicKey] (not a pointer), or *[ecdh.PublicKey] (for X25519).
/// More types might be supported in the future.
/// 
/// This kind of key is commonly encoded in PEM blocks of type "PUBLIC KEY".
pub fn ParsePKIXPublicKey(derBytes: Slice<uint8>) -> Result<Unknown, error>

pub fn ParseRevocationList(der: Slice<uint8>) -> Result<Ref<RevocationList>, error>

/// SetFallbackRoots sets the roots to use during certificate verification, if no
/// custom roots are specified and a platform verifier or a system certificate
/// pool is not available (for instance in a container which does not have a root
/// certificate bundle). SetFallbackRoots will panic if roots is nil.
/// 
/// SetFallbackRoots may only be called once, if called multiple times it will
/// panic.
/// 
/// The fallback behavior can be forced on all platforms, even when there is a
/// system certificate pool, by setting GODEBUG=x509usefallbackroots=1 (note that
/// on Windows and macOS this will disable usage of the platform verification
/// APIs and cause the pure Go verifier to be used). Setting
/// x509usefallbackroots=1 without calling SetFallbackRoots has no effect.
pub fn SetFallbackRoots(roots: Ref<CertPool>)

pub fn SystemCertPool() -> Result<Ref<CertPool>, error>

/// CertPool is a set of certificates.
pub type CertPool

/// A Certificate represents an X.509 certificate.
pub struct Certificate {
  pub Raw: Slice<uint8>,
  pub RawTBSCertificate: Slice<uint8>,
  pub RawSubjectPublicKeyInfo: Slice<uint8>,
  pub RawSubject: Slice<uint8>,
  pub RawIssuer: Slice<uint8>,
  pub Signature: Slice<uint8>,
  pub SignatureAlgorithm: SignatureAlgorithm,
  pub PublicKeyAlgorithm: PublicKeyAlgorithm,
  pub PublicKey: Unknown,
  pub Version: int,
  pub SerialNumber: Option<Ref<big.Int>>,
  pub Issuer: pkix.Name,
  pub Subject: pkix.Name,
  pub NotBefore: time.Time,
  pub NotAfter: time.Time,
  pub KeyUsage: KeyUsage,
  pub Extensions: Slice<pkix.Extension>,
  pub ExtraExtensions: Slice<pkix.Extension>,
  pub UnhandledCriticalExtensions: Slice<asn1.ObjectIdentifier>,
  pub ExtKeyUsage: Slice<ExtKeyUsage>,
  pub UnknownExtKeyUsage: Slice<asn1.ObjectIdentifier>,
  pub BasicConstraintsValid: bool,
  pub IsCA: bool,
  pub MaxPathLen: int,
  pub MaxPathLenZero: bool,
  pub SubjectKeyId: Slice<uint8>,
  pub AuthorityKeyId: Slice<uint8>,
  pub OCSPServer: Slice<string>,
  pub IssuingCertificateURL: Slice<string>,
  pub DNSNames: Slice<string>,
  pub EmailAddresses: Slice<string>,
  pub IPAddresses: Slice<net.IP>,
  pub URIs: Slice<Option<Ref<url.URL>>>,
  pub PermittedDNSDomainsCritical: bool,
  pub PermittedDNSDomains: Slice<string>,
  pub ExcludedDNSDomains: Slice<string>,
  pub PermittedIPRanges: Slice<Option<Ref<net.IPNet>>>,
  pub ExcludedIPRanges: Slice<Option<Ref<net.IPNet>>>,
  pub PermittedEmailAddresses: Slice<string>,
  pub ExcludedEmailAddresses: Slice<string>,
  pub PermittedURIDomains: Slice<string>,
  pub ExcludedURIDomains: Slice<string>,
  pub CRLDistributionPoints: Slice<string>,
  pub PolicyIdentifiers: Slice<asn1.ObjectIdentifier>,
  pub Policies: Slice<OID>,
  pub InhibitAnyPolicy: int,
  pub InhibitAnyPolicyZero: bool,
  pub InhibitPolicyMapping: int,
  pub InhibitPolicyMappingZero: bool,
  pub RequireExplicitPolicy: int,
  pub RequireExplicitPolicyZero: bool,
  pub PolicyMappings: Slice<PolicyMapping>,
}

/// CertificateInvalidError results when an odd error occurs. Users of this
/// library probably want to handle all these errors uniformly.
pub struct CertificateInvalidError {
  pub Cert: Option<Ref<Certificate>>,
  pub Reason: InvalidReason,
  pub Detail: string,
}

/// CertificateRequest represents a PKCS #10, certificate signature request.
pub struct CertificateRequest {
  pub Raw: Slice<uint8>,
  pub RawTBSCertificateRequest: Slice<uint8>,
  pub RawSubjectPublicKeyInfo: Slice<uint8>,
  pub RawSubject: Slice<uint8>,
  pub Version: int,
  pub Signature: Slice<uint8>,
  pub SignatureAlgorithm: SignatureAlgorithm,
  pub PublicKeyAlgorithm: PublicKeyAlgorithm,
  pub PublicKey: Unknown,
  pub Subject: pkix.Name,
  pub Attributes: Slice<pkix.AttributeTypeAndValueSET>,
  pub Extensions: Slice<pkix.Extension>,
  pub ExtraExtensions: Slice<pkix.Extension>,
  pub DNSNames: Slice<string>,
  pub EmailAddresses: Slice<string>,
  pub IPAddresses: Slice<net.IP>,
  pub URIs: Slice<Option<Ref<url.URL>>>,
}

/// ConstraintViolationError results when a requested usage is not permitted by
/// a certificate. For example: checking a signature when the public key isn't a
/// certificate signing key.
pub type ConstraintViolationError

/// HostnameError results when the set of authorized names doesn't match the
/// requested name.
pub struct HostnameError {
  pub Certificate: Option<Ref<Certificate>>,
  pub Host: string,
}

/// An InsecureAlgorithmError indicates that the [SignatureAlgorithm] used to
/// generate the signature is not secure, and the signature has been rejected.
pub struct InsecureAlgorithmError(int)

/// KeyUsage represents the set of actions that are valid for a given key. It's
/// a bitmap of the KeyUsage* constants.
pub struct KeyUsage(int)

/// An OID represents an ASN.1 OBJECT IDENTIFIER.
pub type OID

pub struct PEMCipher(int)

/// PolicyMapping represents a policy mapping entry in the policyMappings extension.
pub struct PolicyMapping {
  pub IssuerDomainPolicy: OID,
  pub SubjectDomainPolicy: OID,
}

pub struct PublicKeyAlgorithm(int)

/// RevocationList represents a [Certificate] Revocation List (CRL) as specified
/// by RFC 5280.
pub struct RevocationList {
  pub Raw: Slice<uint8>,
  pub RawTBSRevocationList: Slice<uint8>,
  pub RawIssuer: Slice<uint8>,
  pub Issuer: pkix.Name,
  pub AuthorityKeyId: Slice<uint8>,
  pub Signature: Slice<uint8>,
  pub SignatureAlgorithm: SignatureAlgorithm,
  pub RevokedCertificateEntries: Slice<RevocationListEntry>,
  pub RevokedCertificates: Slice<pkix.RevokedCertificate>,
  pub Number: Option<Ref<big.Int>>,
  pub ThisUpdate: time.Time,
  pub NextUpdate: time.Time,
  pub Extensions: Slice<pkix.Extension>,
  pub ExtraExtensions: Slice<pkix.Extension>,
}

/// RevocationListEntry represents an entry in the revokedCertificates
/// sequence of a CRL.
pub struct RevocationListEntry {
  pub Raw: Slice<uint8>,
  pub SerialNumber: Option<Ref<big.Int>>,
  pub RevocationTime: time.Time,
  pub ReasonCode: int,
  pub Extensions: Slice<pkix.Extension>,
  pub ExtraExtensions: Slice<pkix.Extension>,
}

/// SystemRootsError results when we fail to load the system root certificates.
pub struct SystemRootsError {
  pub Err: error,
}

pub type UnhandledCriticalExtension

/// UnknownAuthorityError results when the certificate issuer is unknown
pub struct UnknownAuthorityError {
  pub Cert: Option<Ref<Certificate>>,
}

/// VerifyOptions contains parameters for Certificate.Verify.
pub struct VerifyOptions {
  pub DNSName: string,
  pub Intermediates: Option<Ref<CertPool>>,
  pub Roots: Option<Ref<CertPool>>,
  pub CurrentTime: time.Time,
  pub KeyUsages: Slice<ExtKeyUsage>,
  pub MaxConstraintComparisions: int,
  pub CertificatePolicies: Slice<OID>,
}

pub const DSA: PublicKeyAlgorithm = 2

pub const ECDSA: PublicKeyAlgorithm = 3

pub const Ed25519: PublicKeyAlgorithm = 4

pub const KeyUsageCRLSign: KeyUsage = 64

pub const KeyUsageCertSign: KeyUsage = 32

pub const KeyUsageContentCommitment: KeyUsage = 2

pub const KeyUsageDataEncipherment: KeyUsage = 8

pub const KeyUsageDecipherOnly: KeyUsage = 256

pub const KeyUsageDigitalSignature: KeyUsage = 1

pub const KeyUsageEncipherOnly: KeyUsage = 128

pub const KeyUsageKeyAgreement: KeyUsage = 16

pub const KeyUsageKeyEncipherment: KeyUsage = 4

pub const PEMCipher3DES: PEMCipher = 2

pub const PEMCipherAES128: PEMCipher = 3

pub const PEMCipherAES192: PEMCipher = 4

pub const PEMCipherAES256: PEMCipher = 5

pub const PEMCipherDES: PEMCipher = 1

pub const RSA: PublicKeyAlgorithm = 1

pub const UnknownPublicKeyAlgorithm: PublicKeyAlgorithm = 0

/// ErrUnsupportedAlgorithm results from attempting to perform an operation that
/// involves algorithms that are not currently implemented.
pub var ErrUnsupportedAlgorithm: error

/// IncorrectPasswordError is returned when an incorrect password is detected.
pub var IncorrectPasswordError: error

impl CertPool {
  /// AddCert adds a certificate to a pool.
  fn AddCert(self: Ref<CertPool>, cert: Ref<Certificate>)

  /// AddCertWithConstraint adds a certificate to the pool with the additional
  /// constraint. When Certificate.Verify builds a chain which is rooted by cert,
  /// it will additionally pass the whole chain to constraint to determine its
  /// validity. If constraint returns a non-nil error, the chain will be discarded.
  /// constraint may be called concurrently from multiple goroutines.
  fn AddCertWithConstraint(
    self: Ref<CertPool>,
    cert: Ref<Certificate>,
    constraint: fn(Slice<Ref<Certificate>>) -> Result<(), error>,
  )

  /// AppendCertsFromPEM attempts to parse a series of PEM encoded certificates.
  /// It appends any certificates found to s and reports whether any certificates
  /// were successfully parsed.
  /// 
  /// On many Linux systems, /etc/ssl/cert.pem will contain the system wide set
  /// of root CAs in a format suitable for this function.
  fn AppendCertsFromPEM(self: Ref<CertPool>, pemCerts: Slice<uint8>) -> bool

  /// Clone returns a copy of s.
  fn Clone(self: Ref<CertPool>) -> Ref<CertPool>

  /// Equal reports whether s and other are equal.
  fn Equal(self: Ref<CertPool>, other: Ref<CertPool>) -> bool

  /// Subjects returns a list of the DER-encoded subjects of
  /// all of the certificates in the pool.
  /// 
  /// Deprecated: if s was returned by [SystemCertPool], Subjects
  /// will not include the system roots.
  fn Subjects(self: Ref<CertPool>) -> Slice<Slice<uint8>>
}

impl Certificate {
  /// CheckCRLSignature checks that the signature in crl is from c.
  /// 
  /// Deprecated: Use [RevocationList.CheckSignatureFrom] instead.
  fn CheckCRLSignature(self: Ref<Certificate>, crl: Ref<pkix.CertificateList>) -> Result<(), error>

  /// CheckSignature verifies that signature is a valid signature over signed from
  /// c's public key.
  /// 
  /// This is a low-level API that performs no validity checks on the certificate.
  /// 
  /// [MD5WithRSA] signatures are rejected, while [SHA1WithRSA] and [ECDSAWithSHA1]
  /// signatures are currently accepted.
  fn CheckSignature(
    self: Ref<Certificate>,
    algo: SignatureAlgorithm,
    signed: Slice<uint8>,
    signature: Slice<uint8>,
  ) -> Result<(), error>

  /// CheckSignatureFrom verifies that the signature on c is a valid signature from parent.
  /// 
  /// This is a low-level API that performs very limited checks, and not a full
  /// path verifier. Most users should use [Certificate.Verify] instead.
  fn CheckSignatureFrom(self: Ref<Certificate>, parent: Ref<Certificate>) -> Result<(), error>

  /// CreateCRL returns a DER encoded CRL, signed by this Certificate, that
  /// contains the given list of revoked certificates.
  /// 
  /// Deprecated: this method does not generate an RFC 5280 conformant X.509 v2 CRL.
  /// To generate a standards compliant CRL, use [CreateRevocationList] instead.
  fn CreateCRL(
    self: Ref<Certificate>,
    rand: io.Reader,
    priv: Unknown,
    revokedCerts: Slice<pkix.RevokedCertificate>,
    now: time.Time,
    expiry: time.Time,
  ) -> Result<Slice<uint8>, error>

  fn Equal(self: Ref<Certificate>, other: Ref<Certificate>) -> bool

  /// Verify attempts to verify c by building one or more chains from c to a
  /// certificate in opts.Roots, using certificates in opts.Intermediates if
  /// needed. If successful, it returns one or more chains where the first
  /// element of the chain is c and the last element is from opts.Roots.
  /// 
  /// If opts.Roots is nil, the platform verifier might be used, and
  /// verification details might differ from what is described below. If system
  /// roots are unavailable the returned error will be of type SystemRootsError.
  /// 
  /// Name constraints in the intermediates will be applied to all names claimed
  /// in the chain, not just opts.DNSName. Thus it is invalid for a leaf to claim
  /// example.com if an intermediate doesn't permit it, even if example.com is not
  /// the name being validated. Note that DirectoryName constraints are not
  /// supported.
  /// 
  /// Name constraint validation follows the rules from RFC 5280, with the
  /// addition that DNS name constraints may use the leading period format
  /// defined for emails and URIs. When a constraint has a leading period
  /// it indicates that at least one additional label must be prepended to
  /// the constrained name to be considered valid.
  /// 
  /// Extended Key Usage values are enforced nested down a chain, so an intermediate
  /// or root that enumerates EKUs prevents a leaf from asserting an EKU not in that
  /// list. (While this is not specified, it is common practice in order to limit
  /// the types of certificates a CA can issue.)
  /// 
  /// Certificates that use SHA1WithRSA and ECDSAWithSHA1 signatures are not supported,
  /// and will not be used to build chains.
  /// 
  /// Certificates other than c in the returned chains should not be modified.
  /// 
  /// WARNING: this function doesn't do any revocation checking.
  fn Verify(self: Ref<Certificate>, opts: VerifyOptions) -> Result<Slice<Slice<Ref<Certificate>>>, error>

  /// VerifyHostname returns nil if c is a valid certificate for the named host.
  /// Otherwise it returns an error describing the mismatch.
  /// 
  /// IP addresses can be optionally enclosed in square brackets and are checked
  /// against the IPAddresses field. Other names are checked case insensitively
  /// against the DNSNames field. If the names are valid hostnames, the certificate
  /// fields can have a wildcard as the complete left-most label (e.g. *.example.com).
  /// 
  /// Note that the legacy Common Name field is ignored.
  fn VerifyHostname(self: Ref<Certificate>, h: string) -> Result<(), error>
}

impl CertificateInvalidError {
  fn Error(self) -> string
}

impl CertificateRequest {
  /// CheckSignature reports whether the signature on c is valid.
  fn CheckSignature(self: Ref<CertificateRequest>) -> Result<(), error>
}

impl ConstraintViolationError {
  fn Error(self) -> string
}

impl HostnameError {
  fn Error(self) -> string
}

impl InsecureAlgorithmError {
  fn Error(self) -> string
}

impl OID {
  /// AppendBinary implements [encoding.BinaryAppender]
  fn AppendBinary(self, mut b: Slice<uint8>) -> Result<Slice<uint8>, error>

  /// AppendText implements [encoding.TextAppender]
  fn AppendText(self, mut b: Slice<uint8>) -> Result<Slice<uint8>, error>

  /// Equal returns true when oid and other represents the same Object Identifier.
  fn Equal(self, other: OID) -> bool

  /// EqualASN1OID returns whether an OID equals an asn1.ObjectIdentifier. If
  /// asn1.ObjectIdentifier cannot represent the OID specified by oid, because
  /// a component of OID requires more than 31 bits, it returns false.
  fn EqualASN1OID(self, other: asn1.ObjectIdentifier) -> bool

  /// MarshalBinary implements [encoding.BinaryMarshaler]
  fn MarshalBinary(self) -> Result<Slice<uint8>, error>

  /// MarshalText implements [encoding.TextMarshaler]
  fn MarshalText(self) -> Result<Slice<uint8>, error>

  /// Strings returns the string representation of the Object Identifier.
  fn String(self) -> string

  /// UnmarshalBinary implements [encoding.BinaryUnmarshaler]
  fn UnmarshalBinary(self: Ref<OID>, b: Slice<uint8>) -> Result<(), error>

  /// UnmarshalText implements [encoding.TextUnmarshaler]
  fn UnmarshalText(self: Ref<OID>, text: Slice<uint8>) -> Result<(), error>
}

impl PublicKeyAlgorithm {
  fn String(self) -> string
}

impl RevocationList {
  /// CheckSignatureFrom verifies that the signature on rl is a valid signature
  /// from issuer.
  fn CheckSignatureFrom(self: Ref<RevocationList>, parent: Ref<Certificate>) -> Result<(), error>
}

impl SignatureAlgorithm {
  fn String(self) -> string
}

impl SystemRootsError {
  fn Error(self) -> string

  fn Unwrap(self) -> Option<error>
}

impl UnhandledCriticalExtension {
  fn Error(self) -> string
}

impl UnknownAuthorityError {
  fn Error(self) -> string
}
