code: func NewCertificate(cert *x509.Certificate) *Certificate {
  	c := &Certificate{
  		SKI:       fmt.Sprintf("%x", cert.SubjectKeyId),
  		AKI:       fmt.Sprintf("%x", cert.AuthorityKeyId),
  		Serial:    cert.SerialNumber.Bytes(),
  		NotBefore: cert.NotBefore.Unix(),
  		NotAfter:  cert.NotAfter.Unix(),
  		Raw:       cert.Raw,
  	}
  
  	// Workaround the NOT NULL constraint.
  	if cert.SerialNumber.Cmp(nullSerial) == 0 {
  		c.Serial = []byte{0}
  	}
  
  	// Work around the fact that many early CA roots don't have an
  	// SKI. This uses the method found in RFC 5280 Section 4.2.1.2
  	// (1).
  	if c.SKI == "" {
  		ski, err := signer.ComputeSKI(cert)
  		if err != nil {
  			panic("invalid public key in root certificate")
  		}
  
  		c.SKI = fmt.Sprintf("%x", ski)
  	}
  
  	c.cert = cert
  
  	return c
  }
docs: // NewCertificate creates a Certificate from a crypto/x509 Certificate
  // structure.