code: func sanitizeECDSASignedCert(cert *x509.Certificate, parentCert *x509.Certificate) (*x509.Certificate, error) {
  	if cert == nil {
  		return nil, errors.New("certificate must be different from nil")
  	}
  	if parentCert == nil {
  		return nil, errors.New("parent certificate must be different from nil")
  	}
  
  	expectedSig, err := utils.SignatureToLowS(parentCert.PublicKey.(*ecdsa.PublicKey), cert.Signature)
  	if err != nil {
  		return nil, err
  	}
  
  	// if sig == cert.Signature, nothing needs to be done
  	if bytes.Equal(cert.Signature, expectedSig) {
  		return cert, nil
  	}
  	// otherwise create a new certificate with the new signature
  
  	// 1. Unmarshal cert.Raw to get an instance of certificate,
  	//    the lower level interface that represent an x509 certificate
  	//    encoding
  	var newCert certificate
  	newCert, err = certFromX509Cert(cert)
  	if err != nil {
  		return nil, err
  	}
  
  	// 2. Change the signature
  	newCert.SignatureValue = asn1.BitString{Bytes: expectedSig, BitLength: len(expectedSig) * 8}
  
  	// 3. marshal again newCert. Raw must be nil
  	newCert.Raw = nil
  	newRaw, err := asn1.Marshal(newCert)
  	if err != nil {
  		return nil, errors.Wrap(err, "marshalling of the certificate failed")
  	}
  
  	// 4. parse newRaw to get an x509 certificate
  	return x509.ParseCertificate(newRaw)
  }
docs: // sanitizeECDSASignedCert checks that the signatures signing a cert
  // is in low-S. This is checked against the public key of parentCert.
  // If the signature is not in low-S, then a new certificate is generated
  // that is equals to cert but the signature that is in low-S.