func validateSubjectAltNameExtension(ext pkix.Extension) error {
	if !ext.Id.Equal(oidExtensionSubjectAltName) {
		return fmt.Errorf("extension is not a SAN type: %s", ext.Id)
	}
	var sequence asn1.RawValue
	if rest, err := asn1.Unmarshal(ext.Value, &sequence); err != nil {
		return fmt.Errorf("failed to unmarshal san extension: %v", err)
	} else if len(rest) != 0 {
		return fmt.Errorf("san extension incorrectly encoded: %v", ext.Value)
	}
	if !sequence.IsCompound || sequence.Tag != asn1.TagSequence || sequence.Class != asn1.ClassUniversal {
		return fmt.Errorf("san extension is incorrectly encoded: %v", ext.Value)
	}
	for bytes := sequence.Bytes; len(bytes) > 0; {
		var (
			rawValue asn1.RawValue
			err      error
		)
		bytes, err = asn1.Unmarshal(bytes, &rawValue)
		if err != nil {
			return err
		}
		if rawValue.Tag != asn1TagURI {
			return fmt.Errorf("non uri san extension given: %s", rawValue.Bytes)
		}
	}
	return nil
}
validateSubjectAltNameExtension validates that the passed extension is a
correctly encoded URI SAN, and is no other SAN type
package extensions
import (
	"bytes"
	"crypto/x509"
	"crypto/x509/pkix"
	"encoding/asn1"
	"fmt"
	utilerrors "k8s.io/apimachinery/pkg/util/errors"
)
const (
	asn1TagURI = 6
)
var (
	oidExtensionKeyUsage         = asn1.ObjectIdentifier{2, 5, 29, 15}
	oidExtensionExtendedKeyUsage = asn1.ObjectIdentifier{2, 5, 29, 37}
	oidExtensionSubjectAltName   = asn1.ObjectIdentifier{2, 5, 29, 17}
	oidExtKeyUsageServerAuth = asn1.ObjectIdentifier{1, 3, 6, 1, 5, 5, 7, 3, 1}
	oidExtKeyUsageClientAuth = asn1.ObjectIdentifier{1, 3, 6, 1, 5, 5, 7, 3, 2}
	allowedKeyUsages = [][]byte{
		{3, 2, 7, 128},  
		{3, 2, 5, 32},   
	}
)
func ValidateCSRExtentions(csr *x509.CertificateRequest) error {
	var el []error
	if len(csr.ExtraExtensions) > 0 {
		el = append(el, fmt.Errorf("forbidden extensions: %v", csr.Extensions))
	}
	for _, extension := range csr.Extensions {
		switch {
		case extension.Id.Equal(oidExtensionSubjectAltName):
			el = append(el, validateSubjectAltNameExtension(extension))
		case extension.Id.Equal(oidExtensionKeyUsage):
			el = append(el, validateKeyUsageExtension(extension.Value))
		case extension.Id.Equal(oidExtensionExtendedKeyUsage):
			el = append(el, validateExtendedKeyUsageExtension(extension))
		default:
			el = append(el, fmt.Errorf("forbidden extension: %s", extension.Id))
		}
	}
	return utilerrors.NewAggregate(el)
}
func validateKeyUsageExtension(value []byte) error {
	if len(value) != 4 {
		return fmt.Errorf("forbidden key usage: %v", value)
	}
	extValue := make([]byte, len(value))
	copy(extValue, value)
	for _, usage := range allowedKeyUsages {
		for i, b := range usage {
			extValue[i] = extValue[i] &^ b
		}
	}
	if !bytes.Equal(extValue, []byte{0, 0, 0, 0}) {
		return fmt.Errorf("forbidden key usage: %v", value)
	}
	return nil
}
func validateExtendedKeyUsageExtension(extension pkix.Extension) error {
	if !extension.Id.Equal(oidExtensionExtendedKeyUsage) {
		return fmt.Errorf("non extended key usage extension: %s", extension.Id)
	}
	var asn1ExtendedUsages []asn1.ObjectIdentifier
	_, err := asn1.Unmarshal(extension.Value, &asn1ExtendedUsages)
	if err != nil {
		return fmt.Errorf("failed to parse extended key usages: %s", err)
	}
	var el []error
	for _, usage := range asn1ExtendedUsages {
		if !usage.Equal(oidExtKeyUsageClientAuth) && !usage.Equal(oidExtKeyUsageServerAuth) {
			el = append(el, fmt.Errorf("forbidden extended key usage: %s", usage))
		}
	}
	return utilerrors.NewAggregate(el)
}