code: func addPolicies(template *x509.Certificate, policies []config.CertificatePolicy) error {
  	asn1PolicyList := []policyInformation{}
  
  	for _, policy := range policies {
  		pi := policyInformation{
  			// The PolicyIdentifier is an OID assigned to a given issuer.
  			PolicyIdentifier: asn1.ObjectIdentifier(policy.ID),
  		}
  		for _, qualifier := range policy.Qualifiers {
  			switch qualifier.Type {
  			case "id-qt-unotice":
  				pi.Qualifiers = append(pi.Qualifiers,
  					userNoticePolicyQualifier{
  						PolicyQualifierID: iDQTUserNotice,
  						Qualifier: userNotice{
  							ExplicitText: qualifier.Value,
  						},
  					})
  			case "id-qt-cps":
  				pi.Qualifiers = append(pi.Qualifiers,
  					cpsPolicyQualifier{
  						PolicyQualifierID: iDQTCertificationPracticeStatement,
  						Qualifier:         qualifier.Value,
  					})
  			default:
  				return errors.New("Invalid qualifier type in Policies " + qualifier.Type)
  			}
  		}
  		asn1PolicyList = append(asn1PolicyList, pi)
  	}
  
  	asn1Bytes, err := asn1.Marshal(asn1PolicyList)
  	if err != nil {
  		return err
  	}
  
  	template.ExtraExtensions = append(template.ExtraExtensions, pkix.Extension{
  		Id:       asn1.ObjectIdentifier{2, 5, 29, 32},
  		Critical: false,
  		Value:    asn1Bytes,
  	})
  	return nil
  }
docs: // addPolicies adds Certificate Policies and optional Policy Qualifiers to a
  // certificate, based on the input config. Go's x509 library allows setting
  // Certificate Policies easily, but does not support nested Policy Qualifiers
  // under those policies. So we need to construct the ASN.1 structure ourselves.