To comply with the specification the value of the extension should be a ASN.1 OCTET STRING rather than a raw SHA 256 hash. This change uses asn1.Marshal to wrap the hash before putting it in the extension. Change-Id: I4ebe88a00238c6f928555d605e4b5dd98aad8128 Reviewed-on: https://go-review.googlesource.com/118696 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org>