DehydrateCert dehydrates a certificate.

FillRehydratedCertTemplate fills in the domain name (and all dependent fields) to an x509 certificate that was returned by RehydrateCert, and returns a []byte suitable for inserting into a TLS trust store.

ParseDehydratedCert parses a dehydrated certificate from an interface as would be returned by a JSON Unmarshaler.

RehydrateCert converts a dehydrated certificate into a standard x509 certificate, but does not fill in the domain name or any fields that depend on it.

A DehydratedCertificate represents the (nearly) minimal set of data required to deterministically construct a valid x509 certificate when combined with a domain name.