code: func (msp *bccspmsp) sanitizeCert(cert *x509.Certificate) (*x509.Certificate, error) {
  	if isECDSASignedCert(cert) {
  		// Lookup for a parent certificate to perform the sanitization
  		var parentCert *x509.Certificate
  		chain, err := msp.getUniqueValidationChain(cert, msp.getValidityOptsForCert(cert))
  		if err != nil {
  			return nil, err
  		}
  
  		// at this point, cert might be a root CA certificate
  		// or an intermediate CA certificate
  		if cert.IsCA && len(chain) == 1 {
  			// cert is a root CA certificate
  			parentCert = cert
  		} else {
  			parentCert = chain[1]
  		}
  
  		// Sanitize
  		cert, err = sanitizeECDSASignedCert(cert, parentCert)
  		if err != nil {
  			return nil, err
  		}
  	}
  	return cert, nil
  }
docs: // sanitizeCert ensures that x509 certificates signed using ECDSA
  // do have signatures in Low-S. If this is not the case, the certificate
  // is regenerated to have a Low-S signature.