Export the outer (unsigned) signatureAlgorithm of a Certificate

[sleevi]

parseCertificate currently only exposes the TBSCertificate.SignatureAlgorithm on the exported x509.Certificate, as captured in the following lines:

zcrypto/x509/x509.go

Lines 1508 to 1512 in 2177ed1

	out.Signature = in.SignatureValue.RightAlign()
	out.SignatureAlgorithm =
	GetSignatureAlgorithmFromAI(in.TBSCertificate.SignatureAlgorithm)
	out.SignatureAlgorithmOID = in.TBSCertificate.SignatureAlgorithm.Algorithm

While unsigned (and thus freely malleable), it would be useful to also access the signatureAlgorithm on the certificate, defined here:

zcrypto/x509/x509.go

Line 134 in 2177ed1

SignatureAlgorithm pkix.AlgorithmIdentifier

This would be useful for linting tools to ensure that the outer and the inner signature algorithms are consistent. While the outer algorithm is fully maleable, and unsigned, this can be used by CAs to signal concerns with the production of their certificates in-house.

See the discussion in zmap/zlint#377 (comment) for added context