Certificate signatureAlgorithm type is too general.

According to ASN.1 structure in RFC 5280 signatureAlgorithm type should be AlgorithmIdentifier (the same as signature in TBSCertificate).