CertificatesWithSamePublicKey returns nil if both byte slices are valid DER encoding of certificates with the same public key.

ExpiresAt returns when the given identity expires, or a zero time.Time in case we cannot determine that.

GetRandomBytes returns len random looking bytes.

GetRandomNonce returns a random byte array of length NonceSize.

LogNonPubKeyMismatchErr logs an error which is not an ErrPubKeyMismatch error.

SanitizeIdentity sanitizes the signature scheme of the identity.

TrackExpiration warns a week before one of the certificates expires.

NonceSize is the default NonceSize.

ErrPubKeyMismatch is used by CertificatesWithSamePublicKey to indicate the two public keys mismatch.

MessageFunc notifies a message happened with the given format, and can be replaced with Warnf or Infof of a logger.

Scheduler invokes f after d time, and can be replaced with time.AfterFunc.