From b1b3196fbc896aff0d52c07883ee6b4b408a9aef Mon Sep 17 00:00:00 2001
From: bkioshn <bkioshn@gmail.com>
Date: Wed, 11 Sep 2024 15:04:29 +0700
Subject: [PATCH 01/19] fix: remove PEN supported

---
 .../src/attributes/attribute.rs               |  18 +--
 .../src/extensions/extension/mod.rs           |  22 ++--
 rust/c509-certificate/src/oid.rs              | 118 +++---------------
 3 files changed, 39 insertions(+), 119 deletions(-)

diff --git a/rust/c509-certificate/src/attributes/attribute.rs b/rust/c509-certificate/src/attributes/attribute.rs
index 1aa99740a91..950ca001b37 100644
--- a/rust/c509-certificate/src/attributes/attribute.rs
+++ b/rust/c509-certificate/src/attributes/attribute.rs
@@ -58,7 +58,7 @@ impl Attribute {
     /// Set whether `Attribute` can be PEN encoded.
     pub(crate) fn set_pen_supported(self) -> Self {
         Self {
-            registered_oid: self.registered_oid.pen_encoded(),
+            registered_oid: self.registered_oid,
             multi_value: self.multi_value,
             value: self.value,
         }
@@ -82,7 +82,9 @@ struct Helper {
 
 impl<'de> Deserialize<'de> for Attribute {
     fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
-    where D: Deserializer<'de> {
+    where
+        D: Deserializer<'de>,
+    {
         let helper = Helper::deserialize(deserializer)?;
         let oid =
             Oid::from_str(&helper.oid).map_err(|e| serde::de::Error::custom(format!("{e:?}")))?;
@@ -96,7 +98,9 @@ impl<'de> Deserialize<'de> for Attribute {
 
 impl Serialize for Attribute {
     fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
-    where S: serde::Serializer {
+    where
+        S: serde::Serializer,
+    {
         let helper = Helper {
             oid: self.registered_oid.get_c509_oid().get_oid().to_string(),
             value: self.value.clone(),
@@ -207,11 +211,9 @@ impl Decode<'_, ()> for AttributeValue {
         match d.datatype()? {
             minicbor::data::Type::String => Ok(AttributeValue::Text(d.str()?.to_string())),
             minicbor::data::Type::Bytes => Ok(AttributeValue::Bytes(d.bytes()?.to_vec())),
-            _ => {
-                Err(minicbor::decode::Error::message(
-                    "Invalid AttributeValue, value should be either String or Bytes",
-                ))
-            },
+            _ => Err(minicbor::decode::Error::message(
+                "Invalid AttributeValue, value should be either String or Bytes",
+            )),
         }
     }
 }
diff --git a/rust/c509-certificate/src/extensions/extension/mod.rs b/rust/c509-certificate/src/extensions/extension/mod.rs
index b2b82e54926..899b6d5c2a5 100644
--- a/rust/c509-certificate/src/extensions/extension/mod.rs
+++ b/rust/c509-certificate/src/extensions/extension/mod.rs
@@ -29,8 +29,7 @@ impl Extension {
     #[must_use]
     pub fn new(oid: Oid<'static>, value: ExtensionValue, critical: bool) -> Self {
         Self {
-            registered_oid: C509oidRegistered::new(oid, EXTENSIONS_LOOKUP.get_int_to_oid_table())
-                .pen_encoded(),
+            registered_oid: C509oidRegistered::new(oid, EXTENSIONS_LOOKUP.get_int_to_oid_table()),
             critical,
             value,
         }
@@ -68,7 +67,9 @@ struct Helper {
 
 impl<'de> Deserialize<'de> for Extension {
     fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
-    where D: Deserializer<'de> {
+    where
+        D: Deserializer<'de>,
+    {
         let helper = Helper::deserialize(deserializer)?;
         let oid =
             Oid::from_str(&helper.oid).map_err(|e| serde::de::Error::custom(format!("{e:?}")))?;
@@ -79,7 +80,9 @@ impl<'de> Deserialize<'de> for Extension {
 
 impl Serialize for Extension {
     fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
-    where S: serde::Serializer {
+    where
+        S: serde::Serializer,
+    {
         let helper = Helper {
             oid: self.registered_oid.get_c509_oid().get_oid().to_string(),
             value: self.value.clone(),
@@ -228,7 +231,8 @@ impl Encode<()> for ExtensionValue {
 }
 
 impl<C> Decode<'_, C> for ExtensionValue
-where C: ExtensionValueTypeTrait + Debug
+where
+    C: ExtensionValueTypeTrait + Debug,
 {
     fn decode(d: &mut Decoder<'_>, ctx: &mut C) -> Result<Self, minicbor::decode::Error> {
         match ctx.get_type() {
@@ -244,11 +248,9 @@ where C: ExtensionValueTypeTrait + Debug
                 let value = AlternativeName::decode(d, &mut ())?;
                 Ok(ExtensionValue::AlternativeName(value))
             },
-            ExtensionValueType::Unsupported => {
-                Err(minicbor::decode::Error::message(
-                    "Cannot decode Unsupported extension value",
-                ))
-            },
+            ExtensionValueType::Unsupported => Err(minicbor::decode::Error::message(
+                "Cannot decode Unsupported extension value",
+            )),
         }
     }
 }
diff --git a/rust/c509-certificate/src/oid.rs b/rust/c509-certificate/src/oid.rs
index 2a8ed92fd9f..5f487d10efe 100644
--- a/rust/c509-certificate/src/oid.rs
+++ b/rust/c509-certificate/src/oid.rs
@@ -7,19 +7,12 @@
 use std::str::FromStr;
 
 use anyhow::Result;
-use asn1_rs::oid;
-use minicbor::{data::Tag, decode, encode::Write, Decode, Decoder, Encode, Encoder};
+use minicbor::{decode, encode::Write, Decode, Decoder, Encode, Encoder};
 use oid_registry::Oid;
 use serde::{Deserialize, Deserializer, Serialize};
 
 use crate::tables::IntegerToOidTable;
 
-/// IANA Private Enterprise Number (PEN) OID prefix.
-const PEN_PREFIX: Oid<'static> = oid!(1.3.6 .1 .4 .1);
-
-/// Tag number representing IANA Private Enterprise Number (PEN) OID.
-const OID_PEN_TAG: u64 = 112;
-
 /// A strut of C509 OID with Registered Integer.
 #[derive(Debug, Clone, PartialEq)]
 pub struct C509oidRegistered {
@@ -38,13 +31,6 @@ impl C509oidRegistered {
         }
     }
 
-    /// Is PEN Encoding supported for this OID.
-    /// Depends on each registration table.
-    pub(crate) fn pen_encoded(mut self) -> Self {
-        self.oid.pen_supported = true;
-        self
-    }
-
     /// Get the `C509oid`.
     #[must_use]
     pub fn get_c509_oid(&self) -> C509oid {
@@ -61,12 +47,7 @@ impl C509oidRegistered {
 
 /// A struct represent an instance of `C509oid`.
 #[derive(Debug, PartialEq, Clone, Eq, Hash)]
-pub struct C509oid {
-    /// The OID.
-    oid: Oid<'static>,
-    /// The flag to indicate whether PEN encoding is supported.
-    pen_supported: bool,
-}
+pub struct C509oid(Oid<'static>);
 
 /// A helper struct for deserialize and serialize `C509oid`.
 #[derive(Debug, Deserialize, Serialize)]
@@ -77,7 +58,9 @@ struct Helper {
 
 impl<'de> Deserialize<'de> for C509oid {
     fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
-    where D: Deserializer<'de> {
+    where
+        D: Deserializer<'de>,
+    {
         let helper = Helper::deserialize(deserializer)?;
         let oid =
             Oid::from_str(&helper.oid).map_err(|e| serde::de::Error::custom(format!("{e:?}")))?;
@@ -87,9 +70,11 @@ impl<'de> Deserialize<'de> for C509oid {
 
 impl Serialize for C509oid {
     fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
-    where S: serde::Serializer {
+    where
+        S: serde::Serializer,
+    {
         let helper = Helper {
-            oid: self.oid.to_string(),
+            oid: self.0.to_string(),
         };
         helper.serialize(serializer)
     }
@@ -100,30 +85,19 @@ impl C509oid {
     /// Default value of PEN flag is false
     #[must_use]
     pub fn new(oid: Oid<'static>) -> Self {
-        Self {
-            oid,
-            pen_supported: false,
-        }
-    }
-
-    /// Is PEN Encoding supported for this OID
-    pub(crate) fn pen_encoded(mut self) -> Self {
-        self.pen_supported = true;
-        self
+        Self(oid)
     }
 
     /// Get the underlying OID of the `C509oid`
     #[must_use]
     pub fn get_oid(self) -> Oid<'static> {
-        self.oid.clone()
+        self.0
     }
 }
 
 impl Encode<()> for C509oid {
     /// Encode an OID
-    /// If `pen_supported` flag is set, and OID start with a valid `PEN_PREFIX`,
-    /// it is encoded as PEN (Private Enterprise Number)
-    /// else encode as an unwrapped OID (~oid) - as bytes string without tag.
+    /// Encode as an unwrapped OID (~oid) - as bytes string without tag.
     ///
     /// # Returns
     ///
@@ -132,66 +106,21 @@ impl Encode<()> for C509oid {
     fn encode<W: Write>(
         &self, e: &mut Encoder<W>, _ctx: &mut (),
     ) -> Result<(), minicbor::encode::Error<W::Error>> {
-        // Check if PEN encoding is supported and the OID starts with the PEN prefix.
-        if self.pen_supported && self.oid.starts_with(&PEN_PREFIX) {
-            // Set the CBOR tag.
-            e.tag(Tag::new(OID_PEN_TAG))?;
-            // Convert OID originally store as [u8] to [u64]
-            // This process is necessary to get the correct OID
-            // For example given - 1.3.6 .1 .4 .1.4.999
-            // This OID will be stored as [u8] - [43, 6, 1, 4, 1, 4, 135, 103]
-            // The first 2 integer has a special encoding formula where,
-            // values is computed using X * 40 + Y (See RFC9090 for more info)
-            // The number 999 exceed the 225 limit (max of u8), so it will be encoded as 2 bytes
-            let raw_oid: Vec<u64> =
-                self.oid
-                    .iter()
-                    .map(Iterator::collect)
-                    .ok_or(minicbor::encode::Error::message(
-                        "Failed to collect OID components from iterator",
-                    ))?;
-            let raw_pen_prefix: Vec<u64> = PEN_PREFIX.iter().map(Iterator::collect).ok_or(
-                minicbor::encode::Error::message("Failed to collect OID components from iterator"),
-            )?;
-            // relative_oid is OID that follows PEN_PREFIX (relative to PEN_PREFIX)
-            // Use the [u64] PEN prefix length to extract the relative OID
-            let oid_slice =
-                raw_oid
-                    .get(raw_pen_prefix.len()..)
-                    .ok_or(minicbor::encode::Error::message(
-                        "Failed to get a OID slice",
-                    ))?;
-            let relative_oid = Oid::from_relative(oid_slice)
-                .map_err(|_| minicbor::encode::Error::message("Failed to get a relative OID"))?;
-            return e.bytes(relative_oid.as_bytes())?.ok();
-        }
-        let oid_bytes = self.oid.as_bytes();
-        e.bytes(oid_bytes)?.ok()
+        let oid_bytes = self.0.as_bytes();
+        e.bytes(oid_bytes)?;
+        Ok(())
     }
 }
 
 impl Decode<'_, ()> for C509oid {
     /// Decode an OID
-    /// If the data to be decoded is a `Tag`, and the tag is an `OID_PEN_TAG`,
-    /// then decode the OID as Private Enterprise Number (PEN) OID.
-    /// else decode the OID as unwrapped OID (~oid) - as bytes string without tag.
+    /// Decode the OID as unwrapped OID (~oid) - as bytes string without tag.
 
     /// # Returns
     ///
     /// A C509oid instance.
     /// If the decoding fails, it will return an error.
     fn decode(d: &mut Decoder, _ctx: &mut ()) -> Result<Self, decode::Error> {
-        if (minicbor::data::Type::Tag == d.datatype()?) && (Tag::new(OID_PEN_TAG) == d.tag()?) {
-            let oid_bytes = d.bytes()?;
-            // raw_oid contains the whole OID which stored in bytes
-            let mut raw_oid = Vec::new();
-            raw_oid.extend_from_slice(PEN_PREFIX.as_bytes());
-            raw_oid.extend_from_slice(oid_bytes);
-            // Convert the raw_oid to Oid
-            let oid = Oid::new(raw_oid.into());
-            return Ok(C509oid::new(oid).pen_encoded());
-        }
-        // Not a PEN Relative OID, so treat as a normal OID
         let oid_bytes = d.bytes()?;
         let oid = Oid::new(oid_bytes.to_owned().into());
         Ok(C509oid::new(oid))
@@ -204,6 +133,7 @@ impl Decode<'_, ()> for C509oid {
 mod test_c509_oid {
 
     use super::*;
+    use asn1_rs::oid;
 
     // Test reference 3.1. Encoding of the SHA-256 OID
     // https://datatracker.ietf.org/doc/rfc9090/
@@ -221,20 +151,6 @@ mod test_c509_oid {
         assert_eq!(decoded_oid, oid);
     }
 
-    #[test]
-    fn encode_decode_pen() {
-        let mut buffer = Vec::new();
-        let mut encoder = Encoder::new(&mut buffer);
-        let oid = C509oid::new(oid!(1.3.6 .1 .4 .1 .1 .1 .29)).pen_encoded();
-        oid.encode(&mut encoder, &mut ())
-            .expect("Failed to encode OID");
-        assert_eq!(hex::encode(buffer.clone()), "d8704301011d");
-
-        let mut decoder = Decoder::new(&buffer);
-        let decoded_oid = C509oid::decode(&mut decoder, &mut ()).expect("Failed to decode OID");
-        assert_eq!(decoded_oid, oid);
-    }
-
     #[test]
     fn partial_equal() {
         let oid1 = C509oid::new(oid_registry::OID_HASH_SHA1);

From 8a045e4973d0b2bec26fe777e2f8bd942eddb76d Mon Sep 17 00:00:00 2001
From: bkioshn <bkioshn@gmail.com>
Date: Wed, 11 Sep 2024 15:43:55 +0700
Subject: [PATCH 02/19] fix(rust/c509-certificate): time

---
 rust/c509-certificate/examples/cli/main.rs | 39 ++++++++++++++--------
 rust/c509-certificate/src/time.rs          | 22 ++++++------
 2 files changed, 36 insertions(+), 25 deletions(-)

diff --git a/rust/c509-certificate/examples/cli/main.rs b/rust/c509-certificate/examples/cli/main.rs
index 816446f487e..3289356cbba 100644
--- a/rust/c509-certificate/examples/cli/main.rs
+++ b/rust/c509-certificate/examples/cli/main.rs
@@ -159,7 +159,12 @@ fn generate(
 
     // Parse validity dates or use defaults
     // Now for not_before date
-    let not_before = parse_or_default_date(c509_json.validity_not_before, Utc::now().timestamp())?;
+    let now_timestamp: u64 = Utc::now()
+        .timestamp()
+        .try_into()
+        .expect("Timestamp cannot be converted to u64");
+
+    let not_before = parse_or_default_date(c509_json.validity_not_before, now_timestamp)?;
     // Default as expire date for not_after
     // Expire date = 9999-12-31T23:59:59+00:00 as mention in the C509 document
     let not_after = parse_or_default_date(
@@ -249,14 +254,16 @@ fn get_key_type(key_type: &Option<String>) -> anyhow::Result<(Oid<'static>, Opti
     }
 }
 
-/// Parse date string to i64.
-fn parse_or_default_date(date_option: Option<String>, default: i64) -> Result<i64, anyhow::Error> {
+/// Parse date string to u64.
+fn parse_or_default_date(date_option: Option<String>, default: u64) -> Result<u64, anyhow::Error> {
     match date_option {
-        Some(date) => {
-            DateTime::parse_from_rfc3339(&date)
-                .map(|dt| dt.timestamp())
-                .map_err(|e| anyhow::anyhow!(format!("Failed to parse date {date}: {e}",)))
-        },
+        Some(date) => DateTime::parse_from_rfc3339(&date)
+            .map(|dt| {
+                dt.timestamp()
+                    .try_into()
+                    .map_err(|_| anyhow::anyhow!("Timestamp is invalid"))
+            })?
+            .map_err(|e| anyhow::anyhow!(format!("Failed to parse date {date}: {e}",))),
         None => Ok(default),
     }
 }
@@ -295,8 +302,8 @@ fn decode(file: &PathBuf, output: Option<PathBuf>) -> anyhow::Result<()> {
         certificate_type: Some(tbs_cert.get_c509_certificate_type()),
         serial_number: Some(tbs_cert.get_certificate_serial_number().clone()),
         issuer: Some(extract_relative_distinguished_name(tbs_cert.get_issuer())?),
-        validity_not_before: Some(time_to_string(tbs_cert.get_validity_not_before().to_i64())?),
-        validity_not_after: Some(time_to_string(tbs_cert.get_validity_not_after().to_i64())?),
+        validity_not_before: Some(time_to_string(tbs_cert.get_validity_not_before().to_u64())?),
+        validity_not_after: Some(time_to_string(tbs_cert.get_validity_not_after().to_u64())?),
         subject: extract_relative_distinguished_name(tbs_cert.get_subject())?,
         subject_public_key_algorithm: Some(tbs_cert.get_subject_public_key_algorithm().clone()),
         // Return a hex formation of the public key
@@ -325,9 +332,15 @@ fn extract_relative_distinguished_name(name: &Name) -> anyhow::Result<RelativeDi
 }
 
 /// Convert time in i64 to string.
-fn time_to_string(time: i64) -> anyhow::Result<String> {
-    let datetime =
-        DateTime::from_timestamp(time, 0).ok_or_else(|| anyhow::anyhow!("Invalid timestamp"))?;
+fn time_to_string(time: u64) -> anyhow::Result<String> {
+    // Attempt to convert the timestamp and handle errors if they occur
+    let timestamp: i64 = time
+        .try_into()
+        .map_err(|e| anyhow::anyhow!("Failed to convert time: {:?}", e))?;
+
+    // Convert the timestamp to a DateTime and handle any potential errors
+    let datetime = DateTime::from_timestamp(timestamp, 0)
+        .ok_or_else(|| anyhow::anyhow!("Invalid timestamp"))?;
     Ok(datetime.to_rfc3339())
 }
 
diff --git a/rust/c509-certificate/src/time.rs b/rust/c509-certificate/src/time.rs
index 48c370f22e6..ade7a5a11e4 100644
--- a/rust/c509-certificate/src/time.rs
+++ b/rust/c509-certificate/src/time.rs
@@ -4,22 +4,24 @@ use minicbor::{encode::Write, Decode, Decoder, Encode, Encoder};
 use serde::{Deserialize, Serialize};
 
 /// A struct representing a time where it accept seconds since the Unix epoch.
+/// Doesn't support dates before the Unix epoch (January 1, 1970, 00:00:00 UTC) 
+/// so unsigned integer is used.
 #[derive(Debug, Clone, PartialEq, Deserialize, Serialize)]
-pub struct Time(i64);
+pub struct Time(u64);
 
 /// No expiration date in seconds since the Unix epoch.
-const NO_EXP_DATE: i64 = 253_402_300_799;
+const NO_EXP_DATE: u64 = 253_402_300_799;
 
 impl Time {
     /// Create a new instance of `Time`.
     #[must_use]
-    pub fn new(time: i64) -> Self {
+    pub fn new(time: u64) -> Self {
         Self(time)
     }
 
-    /// Get the time in i64.
+    /// Get the time in u64.
     #[must_use]
-    pub fn to_i64(&self) -> i64 {
+    pub fn to_u64(&self) -> u64 {
         self.0
     }
 }
@@ -31,7 +33,7 @@ impl Encode<()> for Time {
         if self.0 == NO_EXP_DATE {
             e.null()?;
         } else {
-            e.i64(self.0)?;
+            e.u64(self.0)?;
         }
         Ok(())
     }
@@ -41,14 +43,10 @@ impl Decode<'_, ()> for Time {
     fn decode(d: &mut Decoder<'_>, _ctx: &mut ()) -> Result<Self, minicbor::decode::Error> {
         match d.datatype()? {
             minicbor::data::Type::U8
-            | minicbor::data::Type::I8
             | minicbor::data::Type::U16
-            | minicbor::data::Type::I16
             | minicbor::data::Type::U32
-            | minicbor::data::Type::I32
-            | minicbor::data::Type::U64
-            | minicbor::data::Type::I64 => {
-                let time = d.i64()?;
+            | minicbor::data::Type::U64 => {
+                let time = d.u64()?;
                 Ok(Time::new(time))
             },
             minicbor::data::Type::Null => {

From 4b73607dd85b0a2623e892e41c45f471a0028da8 Mon Sep 17 00:00:00 2001
From: bkioshn <bkioshn@gmail.com>
Date: Wed, 11 Sep 2024 15:49:51 +0700
Subject: [PATCH 03/19] fix(rust/c509-certificate): handle if issuer not set,
 set to subject

---
 rust/c509-certificate/examples/cli/main.rs |  2 +-
 rust/c509-certificate/src/tbs_cert.rs      | 20 +++++++++++---------
 2 files changed, 12 insertions(+), 10 deletions(-)

diff --git a/rust/c509-certificate/examples/cli/main.rs b/rust/c509-certificate/examples/cli/main.rs
index 3289356cbba..a67cab3f88f 100644
--- a/rust/c509-certificate/examples/cli/main.rs
+++ b/rust/c509-certificate/examples/cli/main.rs
@@ -180,7 +180,7 @@ fn generate(
     let tbs = TbsCert::new(
         c509_json.certificate_type.unwrap_or(SELF_SIGNED_INT),
         serial_number,
-        Name::new(NameValue::RelativeDistinguishedName(issuer)),
+        Some(Name::new(NameValue::RelativeDistinguishedName(issuer))),
         Time::new(not_before),
         Time::new(not_after),
         Name::new(NameValue::RelativeDistinguishedName(c509_json.subject)),
diff --git a/rust/c509-certificate/src/tbs_cert.rs b/rust/c509-certificate/src/tbs_cert.rs
index c9f4b555856..f27f5e2a28e 100644
--- a/rust/c509-certificate/src/tbs_cert.rs
+++ b/rust/c509-certificate/src/tbs_cert.rs
@@ -36,18 +36,19 @@ pub struct TbsCert {
 
 impl TbsCert {
     /// Create a new instance of TBS Certificate.
+    /// If issuer is not provided, it will use the subject as the issuer.
     #[must_use]
     #[allow(clippy::too_many_arguments)]
     pub fn new(
-        c509_certificate_type: u8, certificate_serial_number: UnwrappedBigUint, issuer: Name,
-        validity_not_before: Time, validity_not_after: Time, subject: Name,
+        c509_certificate_type: u8, certificate_serial_number: UnwrappedBigUint,
+        issuer: Option<Name>, validity_not_before: Time, validity_not_after: Time, subject: Name,
         subject_public_key_algorithm: SubjectPubKeyAlgorithm, subject_public_key: Vec<u8>,
         extensions: Extensions, issuer_signature_algorithm: IssuerSignatureAlgorithm,
     ) -> Self {
         Self {
             c509_certificate_type,
             certificate_serial_number,
-            issuer,
+            issuer: issuer.unwrap_or_else(|| subject.clone()),
             validity_not_before,
             validity_not_after,
             subject,
@@ -141,7 +142,7 @@ impl Decode<'_, ()> for TbsCert {
     fn decode(d: &mut Decoder<'_>, ctx: &mut ()) -> Result<Self, minicbor::decode::Error> {
         let cert_type = d.u8()?;
         let serial_number = UnwrappedBigUint::decode(d, ctx)?;
-        let issuer = Name::decode(d, ctx)?;
+        let issuer = Some(Name::decode(d, ctx)?);
         let not_before = Time::decode(d, ctx)?;
         let not_after = Time::decode(d, ctx)?;
         let subject = Name::decode(d, ctx)?;
@@ -264,7 +265,7 @@ pub(crate) mod test_tbs_cert {
         TbsCert::new(
             1,
             UnwrappedBigUint::new(128_269),
-            name_cn_text().0,
+            Some(name_cn_text().0),
             Time::new(1_672_531_200),
             Time::new(1_767_225_600),
             name_cn_eui_mac().0,
@@ -419,9 +420,10 @@ pub(crate) mod test_tbs_cert {
                 true,
             ));
             let mut gns = GeneralNames::new();
-            let hw = OtherNameHardwareModuleName::new(oid!(1.3.6 .1 .4 .1 .6175 .10 .1), vec![
-                0x01, 0x02, 0x03, 0x04,
-            ]);
+            let hw = OtherNameHardwareModuleName::new(
+                oid!(1.3.6 .1 .4 .1 .6175 .10 .1),
+                vec![0x01, 0x02, 0x03, 0x04],
+            );
             gns.add_gn(GeneralName::new(
                 GeneralNameTypeRegistry::OtherNameHardwareModuleName,
                 GeneralNameValue::OtherNameHWModuleName(hw),
@@ -441,7 +443,7 @@ pub(crate) mod test_tbs_cert {
         let tbs_cert = TbsCert::new(
             1,
             UnwrappedBigUint::new(9_112_578_475_118_446_130),
-            names().0,
+            Some(names().0),
             Time::new(1_548_934_156),
             Time::new(253_402_300_799),
             subject(),

From 3e70fc0a98a8a2fd43f2becc4c7988f573ec3bb5 Mon Sep 17 00:00:00 2001
From: bkioshn <bkioshn@gmail.com>
Date: Wed, 11 Sep 2024 19:21:47 +0700
Subject: [PATCH 04/19] fix(rust/c509-certificate): remove rdn

---
 rust/c509-certificate/examples/cli/main.rs    |  24 +--
 .../src/attributes/attribute.rs               |   9 -
 rust/c509-certificate/src/attributes/mod.rs   |   9 +-
 rust/c509-certificate/src/name/mod.rs         | 132 +++++++-------
 rust/c509-certificate/src/name/rdn.rs         | 171 ------------------
 rust/c509-certificate/src/tbs_cert.rs         |  22 ++-
 6 files changed, 94 insertions(+), 273 deletions(-)
 delete mode 100644 rust/c509-certificate/src/name/rdn.rs

diff --git a/rust/c509-certificate/examples/cli/main.rs b/rust/c509-certificate/examples/cli/main.rs
index a67cab3f88f..5b176be9817 100644
--- a/rust/c509-certificate/examples/cli/main.rs
+++ b/rust/c509-certificate/examples/cli/main.rs
@@ -8,10 +8,11 @@ use std::{
 
 use asn1_rs::{oid, Oid};
 use c509_certificate::{
+    attributes::Attributes,
     big_uint::UnwrappedBigUint,
     extensions::Extensions,
     issuer_sig_algo::IssuerSignatureAlgorithm,
-    name::{rdn::RelativeDistinguishedName, Name, NameValue},
+    name::{Name, NameValue},
     signing::{PrivateKey, PublicKey},
     subject_pub_key_algo::SubjectPubKeyAlgorithm,
     tbs_cert::TbsCert,
@@ -104,7 +105,7 @@ struct C509Json {
     serial_number: Option<UnwrappedBigUint>,
     /// Optional issuer of the certificate,
     /// if not provided, issuer is the same as subject.
-    issuer: Option<RelativeDistinguishedName>,
+    issuer: Option<Attributes>,
     /// Optional validity not before date,
     /// if not provided, set to current time.
     validity_not_before: Option<String>,
@@ -112,7 +113,7 @@ struct C509Json {
     /// if not provided, set to no expire date 9999-12-31T23:59:59+00:00.
     validity_not_after: Option<String>,
     /// Relative distinguished name of the subject.
-    subject: RelativeDistinguishedName,
+    subject: Attributes,
     /// Optional subject public key algorithm of the certificate,
     /// if not provided, set to Ed25519.
     subject_public_key_algorithm: Option<SubjectPubKeyAlgorithm>,
@@ -180,10 +181,10 @@ fn generate(
     let tbs = TbsCert::new(
         c509_json.certificate_type.unwrap_or(SELF_SIGNED_INT),
         serial_number,
-        Some(Name::new(NameValue::RelativeDistinguishedName(issuer))),
+        Some(Name::new(NameValue::Attributes(issuer))),
         Time::new(not_before),
         Time::new(not_after),
-        Name::new(NameValue::RelativeDistinguishedName(c509_json.subject)),
+        Name::new(NameValue::Attributes(c509_json.subject)),
         c509_json
             .subject_public_key_algorithm
             .unwrap_or(SubjectPubKeyAlgorithm::new(key_type.0.clone(), key_type.1)),
@@ -218,9 +219,8 @@ fn write_to_output_file(output: PathBuf, data: &[u8]) -> anyhow::Result<()> {
 /// If self-signed is true, issuer is the same as subject.
 /// Otherwise, issuer must be present.
 fn determine_issuer(
-    self_signed: bool, issuer: Option<RelativeDistinguishedName>,
-    subject: RelativeDistinguishedName,
-) -> anyhow::Result<RelativeDistinguishedName> {
+    self_signed: bool, issuer: Option<Attributes>, subject: Attributes,
+) -> anyhow::Result<Attributes> {
     if self_signed {
         Ok(subject)
     } else {
@@ -323,11 +323,11 @@ fn decode(file: &PathBuf, output: Option<PathBuf>) -> anyhow::Result<()> {
     Ok(())
 }
 
-/// Extract a `RelativeDistinguishedName` from a `Name`.
-fn extract_relative_distinguished_name(name: &Name) -> anyhow::Result<RelativeDistinguishedName> {
+/// Extract a `Attributes` from a `Name`.
+fn extract_relative_distinguished_name(name: &Name) -> anyhow::Result<Attributes> {
     match name.get_value() {
-        NameValue::RelativeDistinguishedName(rdn) => Ok(rdn.clone()),
-        _ => Err(anyhow::anyhow!("Expected RelativeDistinguishedName")),
+        NameValue::Attributes(attrs) => Ok(attrs.clone()),
+        _ => Err(anyhow::anyhow!("Expected Attributes")),
     }
 }
 
diff --git a/rust/c509-certificate/src/attributes/attribute.rs b/rust/c509-certificate/src/attributes/attribute.rs
index 950ca001b37..5a0e59b9d56 100644
--- a/rust/c509-certificate/src/attributes/attribute.rs
+++ b/rust/c509-certificate/src/attributes/attribute.rs
@@ -55,15 +55,6 @@ impl Attribute {
         &self.value
     }
 
-    /// Set whether `Attribute` can be PEN encoded.
-    pub(crate) fn set_pen_supported(self) -> Self {
-        Self {
-            registered_oid: self.registered_oid,
-            multi_value: self.multi_value,
-            value: self.value,
-        }
-    }
-
     /// Set whether `Attribute` can have multiple value.
     pub(crate) fn set_multi_value(mut self) -> Self {
         self.multi_value = true;
diff --git a/rust/c509-certificate/src/attributes/mod.rs b/rust/c509-certificate/src/attributes/mod.rs
index b188558e18a..928e70cd3b3 100644
--- a/rust/c509-certificate/src/attributes/mod.rs
+++ b/rust/c509-certificate/src/attributes/mod.rs
@@ -15,12 +15,13 @@
 
 use attribute::Attribute;
 use minicbor::{encode::Write, Decode, Decoder, Encode, Encoder};
+use serde::{Deserialize, Serialize};
 
 pub mod attribute;
 mod data;
 
 /// A struct of C509 `Attributes` containing a vector of `Attribute`.
-#[derive(Debug, Clone, PartialEq)]
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
 pub struct Attributes(Vec<Attribute>);
 
 impl Default for Attributes {
@@ -36,6 +37,12 @@ impl Attributes {
         Self(Vec::new())
     }
 
+    /// Get the attributes.
+    #[must_use]
+    pub fn attributes(&self) -> &[Attribute] {
+        &self.0
+    }
+
     /// Add an `Attribute` to the `Attributes`.
     /// and set `Attribute` value to support multiple value.
     pub fn add_attr(&mut self, attribute: Attribute) {
diff --git a/rust/c509-certificate/src/name/mod.rs b/rust/c509-certificate/src/name/mod.rs
index c4144390775..4ddc2be7a28 100644
--- a/rust/c509-certificate/src/name/mod.rs
+++ b/rust/c509-certificate/src/name/mod.rs
@@ -4,26 +4,23 @@
 //! are UTF-8 encoded and all attributeType should be non-negative.
 //!
 //! ```cddl
-//! Name = [ * RelativeDistinguishedName ] / text / bytes
-//! RelativeDistinguishedName = Attribute / [ 2* Attribute ]
+//! Name = [ * Attributes ] / text / bytes
 //! Attribute = ( attributeType: int, attributeValue: text ) //
 //!             ( attributeType: ~oid, attributeValue: bytes ) //
-//!             ( attributeType: pen, attributeValue: bytes )
 //! ```
 //!
 //! For more information about Name,
 //! visit [C509 Certificate](https://datatracker.ietf.org/doc/draft-ietf-cose-cbor-encoded-cert/09/)
 
-// cspell: words rdns
-
-pub mod rdn;
 use asn1_rs::{oid, Oid};
 use minicbor::{encode::Write, Decode, Decoder, Encode, Encoder};
-use rdn::RelativeDistinguishedName;
 use regex::Regex;
 use serde::{Deserialize, Serialize};
 
-use crate::attributes::attribute::{Attribute, AttributeValue};
+use crate::attributes::{
+    attribute::{Attribute, AttributeValue},
+    Attributes,
+};
 
 /// OID of `CommonName` attribute.
 const COMMON_NAME_OID: Oid<'static> = oid!(2.5.4 .3);
@@ -77,8 +74,8 @@ impl Decode<'_, ()> for Name {
 #[derive(Debug, Clone, PartialEq, Deserialize, Serialize)]
 #[serde(rename_all = "snake_case")]
 pub enum NameValue {
-    /// A relative distinguished name.
-    RelativeDistinguishedName(RelativeDistinguishedName),
+    /// Attributes.
+    Attributes(Attributes),
     /// A text.
     Text(String),
     /// bytes.
@@ -90,13 +87,16 @@ impl Encode<()> for NameValue {
         &self, e: &mut Encoder<W>, ctx: &mut (),
     ) -> Result<(), minicbor::encode::Error<W::Error>> {
         match self {
-            NameValue::RelativeDistinguishedName(rdn) => {
-                let attr = rdn.get_attributes();
-                let attr_first = attr.first().ok_or(minicbor::encode::Error::message(
-                    "Cannot get the first Attribute",
-                ))?;
+            NameValue::Attributes(attrs) => {
+                let attr_first =
+                    attrs
+                        .attributes()
+                        .first()
+                        .ok_or(minicbor::encode::Error::message(
+                            "Cannot get the first Attribute",
+                        ))?;
                 //  If Name contains a single Attribute of type CommonName
-                if attr.len() == 1
+                if attrs.attributes().len() == 1
                     && attr_first.get_registered_oid().get_c509_oid().get_oid() == COMMON_NAME_OID
                 {
                     // Get the value of the attribute
@@ -110,7 +110,7 @@ impl Encode<()> for NameValue {
 
                     encode_cn_value(e, cn_value)?;
                 } else {
-                    rdn.encode(e, ctx)?;
+                    attrs.encode(e, ctx)?;
                 }
             },
             NameValue::Text(text) => {
@@ -127,19 +127,13 @@ impl Encode<()> for NameValue {
 impl Decode<'_, ()> for NameValue {
     fn decode(d: &mut Decoder<'_>, ctx: &mut ()) -> Result<Self, minicbor::decode::Error> {
         match d.datatype()? {
-            minicbor::data::Type::Array => {
-                Ok(NameValue::RelativeDistinguishedName(
-                    RelativeDistinguishedName::decode(d, ctx)?,
-                ))
-            },
+            minicbor::data::Type::Array => Ok(NameValue::Attributes(Attributes::decode(d, ctx)?)),
             // If Name is a text string, the attribute is a CommonName
-            minicbor::data::Type::String => Ok(create_rdn_with_cn_attr(d.str()?.to_string())),
+            minicbor::data::Type::String => Ok(create_attributes_with_cn(d.str()?.to_string())),
             minicbor::data::Type::Bytes => decode_bytes(d),
-            _ => {
-                Err(minicbor::decode::Error::message(
-                    "Name must be an array, text or bytes",
-                ))
-            },
+            _ => Err(minicbor::decode::Error::message(
+                "Name must be an array, text or bytes",
+            )),
         }
     }
 }
@@ -235,7 +229,7 @@ fn decode_hex_cn_bytes(bytes: &[u8]) -> Result<NameValue, minicbor::decode::Erro
     let text = hex::encode(bytes.get(1..).ok_or(minicbor::decode::Error::message(
         "Failed to get hex bytes index",
     ))?);
-    Ok(create_rdn_with_cn_attr(text))
+    Ok(create_attributes_with_cn(text))
 }
 
 /// Decode common name EUI-64 bytes.
@@ -253,30 +247,28 @@ fn decode_eui_cn_bytes(bytes: &[u8]) -> Result<NameValue, minicbor::decode::Erro
             // Turn it into HH-HH-HH-FF-FE-HH-HH-HH
             let data = [chunk1, &[0xFF], &[0xFE], chunk4].concat();
             let text = formatted_eui_bytes(&data);
-            Ok(create_rdn_with_cn_attr(text))
+            Ok(create_attributes_with_cn(text))
         },
         // EUI-64
         EUI64_LEN => {
             let text = formatted_eui_bytes(bytes.get(1..).ok_or(
                 minicbor::decode::Error::message("Failed to get EUI-64 bytes index"),
             )?);
-            Ok(create_rdn_with_cn_attr(text))
-        },
-        _ => {
-            Err(minicbor::decode::Error::message(
-                "EUI-64 or MAC address must be 7 or 9 bytes",
-            ))
+            Ok(create_attributes_with_cn(text))
         },
+        _ => Err(minicbor::decode::Error::message(
+            "EUI-64 or MAC address must be 7 or 9 bytes",
+        )),
     }
 }
 
-/// Create a relative distinguished name with attribute common name from string.
-fn create_rdn_with_cn_attr(text: String) -> NameValue {
+/// Create a attributes with attribute common name from string.
+fn create_attributes_with_cn(text: String) -> NameValue {
     let mut attr = Attribute::new(COMMON_NAME_OID);
     attr.add_value(AttributeValue::Text(text));
-    let mut rdn = RelativeDistinguishedName::new();
-    rdn.add_attr(attr);
-    NameValue::RelativeDistinguishedName(rdn)
+    let mut attrs = Attributes::new();
+    attrs.add_attr(attr);
+    NameValue::Attributes(attrs)
 }
 
 // ------------------Test----------------------
@@ -291,11 +283,11 @@ pub(crate) mod test_name {
     pub(crate) fn name_cn_text() -> (Name, String) {
         let mut attr = Attribute::new(oid!(2.5.4 .3));
         attr.add_value(AttributeValue::Text("RFC test CA".to_string()));
-        let mut rdn = RelativeDistinguishedName::new();
-        rdn.add_attr(attr);
+        let mut attrs = Attributes::new();
+        attrs.add_attr(attr);
 
         (
-            Name::new(NameValue::RelativeDistinguishedName(rdn)),
+            Name::new(NameValue::Attributes(attrs)),
             // "RFC test CA" Text string: 6b5246432074657374204341
             "6b5246432074657374204341".to_string(),
         )
@@ -324,10 +316,10 @@ pub(crate) mod test_name {
 
         let mut attr = Attribute::new(oid!(2.5.4 .3));
         attr.add_value(AttributeValue::Text("000123abcd".to_string()));
-        let mut rdn = RelativeDistinguishedName::new();
-        rdn.add_attr(attr);
+        let mut attrs = Attributes::new();
+        attrs.add_attr(attr);
 
-        let name = Name::new(NameValue::RelativeDistinguishedName(rdn));
+        let name = Name::new(NameValue::Attributes(attrs));
         name.encode(&mut encoder, &mut ())
             .expect("Failed to encode Name");
 
@@ -348,10 +340,10 @@ pub(crate) mod test_name {
 
         let mut attr = Attribute::new(oid!(2.5.4 .3));
         attr.add_value(AttributeValue::Text("000123ABCD".to_string()));
-        let mut rdn = RelativeDistinguishedName::new();
-        rdn.add_attr(attr);
+        let mut attrs = Attributes::new();
+        attrs.add_attr(attr);
 
-        let name = Name::new(NameValue::RelativeDistinguishedName(rdn));
+        let name = Name::new(NameValue::Attributes(attrs));
         name.encode(&mut encoder, &mut ())
             .expect("Failed to encode Name");
 
@@ -369,11 +361,11 @@ pub(crate) mod test_name {
     pub(crate) fn name_cn_eui_mac() -> (Name, String) {
         let mut attr = Attribute::new(oid!(2.5.4 .3));
         attr.add_value(AttributeValue::Text("01-23-45-FF-FE-67-89-AB".to_string()));
-        let mut rdn = RelativeDistinguishedName::new();
-        rdn.add_attr(attr);
+        let mut attrs = Attributes::new();
+        attrs.add_attr(attr);
 
         (
-            Name::new(NameValue::RelativeDistinguishedName(rdn)),
+            Name::new(NameValue::Attributes(attrs)),
             // Bytes of length 7: 0x47
             // "01-23-45-FF-FE-67-89-AB" special encode: 0x010123456789AB
             "47010123456789ab".to_string(),
@@ -403,9 +395,9 @@ pub(crate) mod test_name {
 
         let mut attr = Attribute::new(oid!(2.5.4 .3));
         attr.add_value(AttributeValue::Text("01-23-45-ff-fe-67-89-AB".to_string()));
-        let mut rdn = RelativeDistinguishedName::new();
-        rdn.add_attr(attr);
-        let name = Name::new(NameValue::RelativeDistinguishedName(rdn));
+        let mut attrs = Attributes::new();
+        attrs.add_attr(attr);
+        let name = Name::new(NameValue::Attributes(attrs));
 
         name.encode(&mut encoder, &mut ())
             .expect("Failed to encode Name");
@@ -429,10 +421,10 @@ pub(crate) mod test_name {
 
         let mut attr = Attribute::new(oid!(2.5.4 .3));
         attr.add_value(AttributeValue::Text("01-23-45-67-89-AB-00-01".to_string()));
-        let mut rdn = RelativeDistinguishedName::new();
-        rdn.add_attr(attr);
+        let mut attrs = Attributes::new();
+        attrs.add_attr(attr);
 
-        let name = Name::new(NameValue::RelativeDistinguishedName(rdn));
+        let name = Name::new(NameValue::Attributes(attrs));
 
         name.encode(&mut encoder, &mut ())
             .expect("Failed to encode Name");
@@ -451,10 +443,10 @@ pub(crate) mod test_name {
 
         let mut attr = Attribute::new(oid!(2.5.4 .3));
         attr.add_value(AttributeValue::Text("01-23-45-67-89-ab-00-01".to_string()));
-        let mut rdn = RelativeDistinguishedName::new();
-        rdn.add_attr(attr);
+        let mut attrs = Attributes::new();
+        attrs.add_attr(attr);
 
-        let name = Name::new(NameValue::RelativeDistinguishedName(rdn));
+        let name = Name::new(NameValue::Attributes(attrs));
 
         name.encode(&mut encoder, &mut ())
             .expect("Failed to encode Name");
@@ -486,15 +478,15 @@ pub(crate) mod test_name {
         let mut attr5 = Attribute::new(oid!(2.5.4 .3));
         attr5.add_value(AttributeValue::Text("802.1AR CA".to_string()));
 
-        let mut rdn = RelativeDistinguishedName::new();
-        rdn.add_attr(attr1);
-        rdn.add_attr(attr2);
-        rdn.add_attr(attr3);
-        rdn.add_attr(attr4);
-        rdn.add_attr(attr5);
+        let mut attrs = Attributes::new();
+        attrs.add_attr(attr1);
+        attrs.add_attr(attr2);
+        attrs.add_attr(attr3);
+        attrs.add_attr(attr4);
+        attrs.add_attr(attr5);
 
         (
-            Name::new(NameValue::RelativeDistinguishedName(rdn)),
+            Name::new(NameValue::Attributes(attrs)),
             // Array of 10 items [4, "US", 6, "CA", 8, "Example Inc", 9, "certification", 1, "802.1AR CA"] : 0x8a
             // attr1: 0x04625553
             // attr2: 0x06624341
@@ -505,7 +497,7 @@ pub(crate) mod test_name {
         )
     }
     #[test]
-    fn encode_decode_type_name_rdns() {
+    fn encode_decode_type_name_attrs() {
         let mut buffer = Vec::new();
         let mut encoder = Encoder::new(&mut buffer);
 
diff --git a/rust/c509-certificate/src/name/rdn.rs b/rust/c509-certificate/src/name/rdn.rs
deleted file mode 100644
index 13f5eb12f09..00000000000
--- a/rust/c509-certificate/src/name/rdn.rs
+++ /dev/null
@@ -1,171 +0,0 @@
-//! C509 Relative Distinguished Name
-//!
-//! For more information about `RelativeDistinguishedName`,
-//! visit [C509 Certificate](https://datatracker.ietf.org/doc/draft-ietf-cose-cbor-encoded-cert/09/)
-
-// cspell: words rdns
-
-use minicbor::{encode::Write, Decode, Decoder, Encode, Encoder};
-use serde::{Deserialize, Serialize};
-
-use crate::attributes::attribute::Attribute;
-
-/// A struct represents a Relative Distinguished Name containing vector of `Attribute`.
-///
-/// ```cddl
-/// RelativeDistinguishedName = Attribute / [ 2* Attribute ]
-/// ```
-#[derive(Debug, Clone, PartialEq, Deserialize, Serialize)]
-pub struct RelativeDistinguishedName(Vec<Attribute>);
-
-impl Default for RelativeDistinguishedName {
-    fn default() -> Self {
-        Self::new()
-    }
-}
-
-impl RelativeDistinguishedName {
-    /// Create a new instance of `RelativeDistinguishedName` as empty vector.
-    #[must_use]
-    pub fn new() -> Self {
-        Self(Vec::new())
-    }
-
-    /// Add an `Attribute` to the `RelativeDistinguishedName`.
-    pub fn add_attr(&mut self, attribute: Attribute) {
-        // RelativeDistinguishedName support pen encoding
-        self.0.push(attribute.set_pen_supported());
-    }
-
-    /// Get the a vector of `Attribute`.
-    pub(crate) fn get_attributes(&self) -> &Vec<Attribute> {
-        &self.0
-    }
-}
-
-impl Encode<()> for RelativeDistinguishedName {
-    // ```cddl
-    // RelativeDistinguishedName = Attribute / [ 2* Attribute ]
-    // ```
-    fn encode<W: Write>(
-        &self, e: &mut Encoder<W>, ctx: &mut (),
-    ) -> Result<(), minicbor::encode::Error<W::Error>> {
-        // Should contain >= 1 attribute
-        if self.0.is_empty() {
-            return Err(minicbor::encode::Error::message(
-                "RelativeDistinguishedName should not be empty",
-            ));
-        }
-
-        if self.0.len() == 1 {
-            self.0.first().encode(e, ctx)?;
-        } else {
-            // The attribute type should be included in array too
-            e.array(self.0.len() as u64 * 2)?;
-            for attr in &self.0 {
-                attr.encode(e, ctx)?;
-            }
-        }
-        Ok(())
-    }
-}
-
-impl Decode<'_, ()> for RelativeDistinguishedName {
-    fn decode(d: &mut Decoder<'_>, ctx: &mut ()) -> Result<Self, minicbor::decode::Error> {
-        let mut rdn = RelativeDistinguishedName::new();
-
-        match d.datatype()? {
-            minicbor::data::Type::Array => {
-                let len = d.array()?.ok_or(minicbor::decode::Error::message(
-                    "Failed to get array length for relative distinguished name",
-                ))?;
-                // Should contain >= 1 attribute
-                if len == 0 {
-                    return Err(minicbor::decode::Error::message(
-                        "RelativeDistinguishedName should not be empty",
-                    ));
-                }
-                // The attribute type is included in an array, so divide by 2
-                for _ in 0..len / 2 {
-                    rdn.add_attr(Attribute::decode(d, ctx)?);
-                }
-            },
-            _ => rdn.add_attr(Attribute::decode(d, ctx)?),
-        }
-        Ok(rdn)
-    }
-}
-
-// -------------------Test----------------------
-
-#[cfg(test)]
-mod test_relative_distinguished_name {
-
-    use asn1_rs::oid;
-
-    use super::*;
-    use crate::attributes::attribute::AttributeValue;
-
-    #[test]
-    fn encode_decode_rdn() {
-        let mut buffer = Vec::new();
-        let mut encoder = Encoder::new(&mut buffer);
-
-        let mut attr = Attribute::new(oid!(1.2.840 .113549 .1 .9 .1));
-        attr.add_value(AttributeValue::Text("example@example.com".to_string()));
-
-        let mut rdn = RelativeDistinguishedName::new();
-        rdn.add_attr(attr);
-        rdn.encode(&mut encoder, &mut ())
-            .expect("Failed to encode RDN");
-        // Email Address: 0x00
-        // "example@example.como": 736578616d706c65406578616d706c652e636f6d
-        assert_eq!(
-            hex::encode(buffer.clone()),
-            "00736578616d706c65406578616d706c652e636f6d"
-        );
-
-        let mut decoder = Decoder::new(&buffer);
-        let rdn_decoded = RelativeDistinguishedName::decode(&mut decoder, &mut ())
-            .expect("Failed to decode RelativeDistinguishedName");
-        assert_eq!(rdn_decoded, rdn);
-    }
-
-    #[test]
-    fn encode_decode_rdns() {
-        let mut buffer = Vec::new();
-        let mut encoder = Encoder::new(&mut buffer);
-
-        let mut attr1 = Attribute::new(oid!(1.2.840 .113549 .1 .9 .1));
-        attr1.add_value(AttributeValue::Text("example@example.com".to_string()));
-        let mut attr2 = Attribute::new(oid!(2.5.4 .3));
-        attr2.add_value(AttributeValue::Text("example".to_string()));
-
-        let mut rdns = RelativeDistinguishedName::new();
-        rdns.add_attr(attr1);
-        rdns.add_attr(attr2);
-
-        rdns.encode(&mut encoder, &mut ())
-            .expect("Failed to encode RDN");
-        // Array of 2 attributes: 0x84
-        // Email Address example@example.com: 0x00736578616d706c65406578616d706c652e636f6d
-        // Common Name example: 0x01676578616d706c65
-        assert_eq!(
-            hex::encode(buffer.clone()),
-            "8400736578616d706c65406578616d706c652e636f6d01676578616d706c65"
-        );
-        let mut decoder = Decoder::new(&buffer);
-        let rdn_decoded = RelativeDistinguishedName::decode(&mut decoder, &mut ())
-            .expect("Failed to decode RelativeDistinguishedName");
-        assert_eq!(rdn_decoded, rdns);
-    }
-
-    #[test]
-    fn empty_rdn() {
-        let mut buffer = Vec::new();
-        let mut encoder = Encoder::new(&mut buffer);
-        let rdn = RelativeDistinguishedName::new();
-        rdn.encode(&mut encoder, &mut ())
-            .expect_err("Failed to encode RDN");
-    }
-}
diff --git a/rust/c509-certificate/src/tbs_cert.rs b/rust/c509-certificate/src/tbs_cert.rs
index f27f5e2a28e..926e009989b 100644
--- a/rust/c509-certificate/src/tbs_cert.rs
+++ b/rust/c509-certificate/src/tbs_cert.rs
@@ -182,7 +182,10 @@ pub(crate) mod test_tbs_cert {
 
     use super::*;
     use crate::{
-        attributes::attribute::{Attribute, AttributeValue},
+        attributes::{
+            attribute::{Attribute, AttributeValue},
+            Attributes,
+        },
         extensions::{
             alt_name::{AlternativeName, GeneralNamesOrText},
             extension::{Extension, ExtensionValue},
@@ -193,7 +196,6 @@ pub(crate) mod test_tbs_cert {
             GeneralNames,
         },
         name::{
-            rdn::RelativeDistinguishedName,
             test_name::{name_cn_eui_mac, name_cn_text, names},
             NameValue,
         },
@@ -385,15 +387,15 @@ pub(crate) mod test_tbs_cert {
             let mut attr6 = Attribute::new(oid!(2.5.4 .5));
             attr6.add_value(AttributeValue::Text("Wt1234".to_string()));
 
-            let mut rdn = RelativeDistinguishedName::new();
-            rdn.add_attr(attr1);
-            rdn.add_attr(attr2);
-            rdn.add_attr(attr3);
-            rdn.add_attr(attr4);
-            rdn.add_attr(attr5);
-            rdn.add_attr(attr6);
+            let mut attrs = Attributes::new();
+            attrs.add_attr(attr1);
+            attrs.add_attr(attr2);
+            attrs.add_attr(attr3);
+            attrs.add_attr(attr4);
+            attrs.add_attr(attr5);
+            attrs.add_attr(attr6);
 
-            Name::new(NameValue::RelativeDistinguishedName(rdn))
+            Name::new(NameValue::Attributes(attrs))
         }
 
         fn extensions() -> Extensions {

From afe628dd5c2737440f9ff91acf2fcd81c9881480 Mon Sep 17 00:00:00 2001
From: bkioshn <bkioshn@gmail.com>
Date: Wed, 11 Sep 2024 19:23:21 +0700
Subject: [PATCH 05/19] fix(rust/c509-certificate): change certificate version
 number

---
 rust/c509-certificate/examples/cli/data/cert_sample_1.json | 2 +-
 rust/c509-certificate/examples/cli/main.rs                 | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/rust/c509-certificate/examples/cli/data/cert_sample_1.json b/rust/c509-certificate/examples/cli/data/cert_sample_1.json
index ca41ddabfab..fffa5003085 100644
--- a/rust/c509-certificate/examples/cli/data/cert_sample_1.json
+++ b/rust/c509-certificate/examples/cli/data/cert_sample_1.json
@@ -1,6 +1,6 @@
 {
 	"self_signed": true,
-	"c509_certificate_type": 0,
+	"c509_certificate_type": 2,
 	"certificate_serial_number": 128269,
 	"issuer": [
 		{
diff --git a/rust/c509-certificate/examples/cli/main.rs b/rust/c509-certificate/examples/cli/main.rs
index 5b176be9817..01d61984c73 100644
--- a/rust/c509-certificate/examples/cli/main.rs
+++ b/rust/c509-certificate/examples/cli/main.rs
@@ -134,9 +134,9 @@ struct C509Json {
 const ED25519: (Oid, Option<String>) = (oid!(1.3.101 .112), None);
 
 /// Integer indicate that certificate is self-signed.
-/// 0 for Natively Signed C509 Certificate following X.509 v3
-/// 1 for CBOR re-encoding of X.509 v3 Certificate        
-const SELF_SIGNED_INT: u8 = 0;
+/// 2 for Natively Signed C509 Certificate following X.509 v3
+/// 3 for CBOR re-encoding of X.509 v3 Certificate        
+const SELF_SIGNED_INT: u8 = 2;
 
 // -------------------generate-----------------------
 

From 0e30d15669c7b932b8d9122b98301bef217409d1 Mon Sep 17 00:00:00 2001
From: bkioshn <bkioshn@gmail.com>
Date: Wed, 11 Sep 2024 19:24:25 +0700
Subject: [PATCH 06/19] fix(rust/c509-certificate): rearrange tbscertificate

---
 .../examples/cli/data/cert_sample_1.json      |  4 +--
 rust/c509-certificate/examples/cli/main.rs    | 32 +++++++++---------
 rust/c509-certificate/src/tbs_cert.rs         | 33 ++++++++++---------
 3 files changed, 36 insertions(+), 33 deletions(-)

diff --git a/rust/c509-certificate/examples/cli/data/cert_sample_1.json b/rust/c509-certificate/examples/cli/data/cert_sample_1.json
index fffa5003085..f7ed50eb45d 100644
--- a/rust/c509-certificate/examples/cli/data/cert_sample_1.json
+++ b/rust/c509-certificate/examples/cli/data/cert_sample_1.json
@@ -2,6 +2,7 @@
 	"self_signed": true,
 	"c509_certificate_type": 2,
 	"certificate_serial_number": 128269,
+	"issuer_signature_algorithm": null,
 	"issuer": [
 		{
 			"oid": "2.5.4.3",
@@ -24,6 +25,5 @@
 			"value": { "int": 1 },
 			"critical": false
 		}
-	],
-	"issuer_signature_algorithm": null
+	]
 }
diff --git a/rust/c509-certificate/examples/cli/main.rs b/rust/c509-certificate/examples/cli/main.rs
index 01d61984c73..738d19ca17b 100644
--- a/rust/c509-certificate/examples/cli/main.rs
+++ b/rust/c509-certificate/examples/cli/main.rs
@@ -103,6 +103,9 @@ struct C509Json {
     /// Optional serial number of the certificate,
     /// if not provided, a random number will be generated.
     serial_number: Option<UnwrappedBigUint>,
+    /// Optional issuer signature algorithm of the certificate,
+    /// if not provided, set to Ed25519.
+    issuer_signature_algorithm: Option<IssuerSignatureAlgorithm>,
     /// Optional issuer of the certificate,
     /// if not provided, issuer is the same as subject.
     issuer: Option<Attributes>,
@@ -122,9 +125,6 @@ struct C509Json {
     subject_public_key: String,
     /// Extensions of the certificate.
     extensions: Extensions,
-    /// Optional issuer signature algorithm of the certificate,
-    /// if not provided, set to Ed25519.
-    issuer_signature_algorithm: Option<IssuerSignatureAlgorithm>,
     /// Optional issuer signature value of the certificate.
     #[serde(skip_deserializing)]
     issuer_signature_value: Option<Vec<u8>>,
@@ -181,18 +181,18 @@ fn generate(
     let tbs = TbsCert::new(
         c509_json.certificate_type.unwrap_or(SELF_SIGNED_INT),
         serial_number,
+        c509_json
+            .issuer_signature_algorithm
+            .unwrap_or(IssuerSignatureAlgorithm::new(key_type.0.clone(), ED25519.1)),
         Some(Name::new(NameValue::Attributes(issuer))),
         Time::new(not_before),
         Time::new(not_after),
         Name::new(NameValue::Attributes(c509_json.subject)),
         c509_json
             .subject_public_key_algorithm
-            .unwrap_or(SubjectPubKeyAlgorithm::new(key_type.0.clone(), key_type.1)),
+            .unwrap_or(SubjectPubKeyAlgorithm::new(key_type.0, key_type.1)),
         public_key.to_bytes(),
         c509_json.extensions.clone(),
-        c509_json
-            .issuer_signature_algorithm
-            .unwrap_or(IssuerSignatureAlgorithm::new(key_type.0, ED25519.1)),
     );
 
     let cert = c509_certificate::generate(&tbs, private_key)?;
@@ -257,13 +257,15 @@ fn get_key_type(key_type: &Option<String>) -> anyhow::Result<(Oid<'static>, Opti
 /// Parse date string to u64.
 fn parse_or_default_date(date_option: Option<String>, default: u64) -> Result<u64, anyhow::Error> {
     match date_option {
-        Some(date) => DateTime::parse_from_rfc3339(&date)
-            .map(|dt| {
-                dt.timestamp()
-                    .try_into()
-                    .map_err(|_| anyhow::anyhow!("Timestamp is invalid"))
-            })?
-            .map_err(|e| anyhow::anyhow!(format!("Failed to parse date {date}: {e}",))),
+        Some(date) => {
+            DateTime::parse_from_rfc3339(&date)
+                .map(|dt| {
+                    dt.timestamp()
+                        .try_into()
+                        .map_err(|_| anyhow::anyhow!("Timestamp is invalid"))
+                })?
+                .map_err(|e| anyhow::anyhow!(format!("Failed to parse date {date}: {e}",)))
+        },
         None => Ok(default),
     }
 }
@@ -301,6 +303,7 @@ fn decode(file: &PathBuf, output: Option<PathBuf>) -> anyhow::Result<()> {
         self_signed: is_self_signed,
         certificate_type: Some(tbs_cert.get_c509_certificate_type()),
         serial_number: Some(tbs_cert.get_certificate_serial_number().clone()),
+        issuer_signature_algorithm: Some(tbs_cert.get_issuer_signature_algorithm().clone()),
         issuer: Some(extract_relative_distinguished_name(tbs_cert.get_issuer())?),
         validity_not_before: Some(time_to_string(tbs_cert.get_validity_not_before().to_u64())?),
         validity_not_after: Some(time_to_string(tbs_cert.get_validity_not_after().to_u64())?),
@@ -309,7 +312,6 @@ fn decode(file: &PathBuf, output: Option<PathBuf>) -> anyhow::Result<()> {
         // Return a hex formation of the public key
         subject_public_key: tbs_cert.get_subject_public_key().encode_hex(),
         extensions: tbs_cert.get_extensions().clone(),
-        issuer_signature_algorithm: Some(tbs_cert.get_issuer_signature_algorithm().clone()),
         issuer_signature_value: c509.get_issuer_signature_value().clone(),
     };
 
diff --git a/rust/c509-certificate/src/tbs_cert.rs b/rust/c509-certificate/src/tbs_cert.rs
index 926e009989b..d67089a4b6e 100644
--- a/rust/c509-certificate/src/tbs_cert.rs
+++ b/rust/c509-certificate/src/tbs_cert.rs
@@ -16,6 +16,8 @@ pub struct TbsCert {
     c509_certificate_type: u8,
     /// Serial number of the certificate.
     certificate_serial_number: UnwrappedBigUint,
+    /// Issuer Signature Algorithm
+    issuer_signature_algorithm: IssuerSignatureAlgorithm,
     /// Issuer
     issuer: Name,
     /// Validity not before.
@@ -30,8 +32,6 @@ pub struct TbsCert {
     subject_public_key: Vec<u8>,
     /// Extensions
     extensions: Extensions,
-    /// Issuer Signature Algorithm
-    issuer_signature_algorithm: IssuerSignatureAlgorithm,
 }
 
 impl TbsCert {
@@ -41,13 +41,15 @@ impl TbsCert {
     #[allow(clippy::too_many_arguments)]
     pub fn new(
         c509_certificate_type: u8, certificate_serial_number: UnwrappedBigUint,
-        issuer: Option<Name>, validity_not_before: Time, validity_not_after: Time, subject: Name,
+        issuer_signature_algorithm: IssuerSignatureAlgorithm, issuer: Option<Name>,
+        validity_not_before: Time, validity_not_after: Time, subject: Name,
         subject_public_key_algorithm: SubjectPubKeyAlgorithm, subject_public_key: Vec<u8>,
-        extensions: Extensions, issuer_signature_algorithm: IssuerSignatureAlgorithm,
+        extensions: Extensions,
     ) -> Self {
         Self {
             c509_certificate_type,
             certificate_serial_number,
+            issuer_signature_algorithm,
             issuer: issuer.unwrap_or_else(|| subject.clone()),
             validity_not_before,
             validity_not_after,
@@ -55,7 +57,6 @@ impl TbsCert {
             subject_public_key_algorithm,
             subject_public_key,
             extensions,
-            issuer_signature_algorithm,
         }
     }
 
@@ -71,6 +72,12 @@ impl TbsCert {
         &self.certificate_serial_number
     }
 
+    /// Get the issuer signature algorithm.
+    #[must_use]
+    pub fn get_issuer_signature_algorithm(&self) -> &IssuerSignatureAlgorithm {
+        &self.issuer_signature_algorithm
+    }
+
     /// Get the issuer.
     #[must_use]
     pub fn get_issuer(&self) -> &Name {
@@ -112,12 +119,6 @@ impl TbsCert {
     pub fn get_extensions(&self) -> &Extensions {
         &self.extensions
     }
-
-    /// Get the issuer signature algorithm.
-    #[must_use]
-    pub fn get_issuer_signature_algorithm(&self) -> &IssuerSignatureAlgorithm {
-        &self.issuer_signature_algorithm
-    }
 }
 
 impl Encode<()> for TbsCert {
@@ -126,6 +127,7 @@ impl Encode<()> for TbsCert {
     ) -> Result<(), minicbor::encode::Error<W::Error>> {
         e.u8(self.c509_certificate_type)?;
         self.certificate_serial_number.encode(e, ctx)?;
+        self.issuer_signature_algorithm.encode(e, ctx)?;
         self.issuer.encode(e, ctx)?;
         self.validity_not_before.encode(e, ctx)?;
         self.validity_not_after.encode(e, ctx)?;
@@ -133,7 +135,6 @@ impl Encode<()> for TbsCert {
         self.subject_public_key_algorithm.encode(e, ctx)?;
         e.bytes(&self.subject_public_key)?;
         self.extensions.encode(e, ctx)?;
-        self.issuer_signature_algorithm.encode(e, ctx)?;
         Ok(())
     }
 }
@@ -142,6 +143,7 @@ impl Decode<'_, ()> for TbsCert {
     fn decode(d: &mut Decoder<'_>, ctx: &mut ()) -> Result<Self, minicbor::decode::Error> {
         let cert_type = d.u8()?;
         let serial_number = UnwrappedBigUint::decode(d, ctx)?;
+        let issuer_signature_algorithm = IssuerSignatureAlgorithm::decode(d, ctx)?;
         let issuer = Some(Name::decode(d, ctx)?);
         let not_before = Time::decode(d, ctx)?;
         let not_after = Time::decode(d, ctx)?;
@@ -149,11 +151,11 @@ impl Decode<'_, ()> for TbsCert {
         let subject_public_key_algorithm = SubjectPubKeyAlgorithm::decode(d, ctx)?;
         let subject_public_key = d.bytes()?;
         let extensions = Extensions::decode(d, ctx)?;
-        let issuer_signature_algorithm = IssuerSignatureAlgorithm::decode(d, ctx)?;
 
         Ok(TbsCert::new(
             cert_type,
             serial_number,
+            issuer_signature_algorithm,
             issuer,
             not_before,
             not_after,
@@ -161,7 +163,6 @@ impl Decode<'_, ()> for TbsCert {
             subject_public_key_algorithm,
             subject_public_key.to_vec(),
             extensions,
-            issuer_signature_algorithm,
         ))
     }
 }
@@ -267,6 +268,7 @@ pub(crate) mod test_tbs_cert {
         TbsCert::new(
             1,
             UnwrappedBigUint::new(128_269),
+            IssuerSignatureAlgorithm::new(oid!(1.2.840 .10045 .4 .3 .2), None),
             Some(name_cn_text().0),
             Time::new(1_672_531_200),
             Time::new(1_767_225_600),
@@ -274,7 +276,6 @@ pub(crate) mod test_tbs_cert {
             SubjectPubKeyAlgorithm::new(oid!(1.2.840 .10045 .2 .1), None),
             PUBKEY.to_vec(),
             extensions(),
-            IssuerSignatureAlgorithm::new(oid!(1.2.840 .10045 .4 .3 .2), None),
         )
     }
 
@@ -445,6 +446,7 @@ pub(crate) mod test_tbs_cert {
         let tbs_cert = TbsCert::new(
             1,
             UnwrappedBigUint::new(9_112_578_475_118_446_130),
+            IssuerSignatureAlgorithm::new(oid!(1.2.840 .10045 .4 .3 .2), None),
             Some(names().0),
             Time::new(1_548_934_156),
             Time::new(253_402_300_799),
@@ -452,7 +454,6 @@ pub(crate) mod test_tbs_cert {
             SubjectPubKeyAlgorithm::new(oid!(1.2.840 .10045 .2 .1), None),
             PUBKEY.to_vec(),
             extensions(),
-            IssuerSignatureAlgorithm::new(oid!(1.2.840 .10045 .4 .3 .2), None),
         );
 
         let mut buffer = Vec::new();

From 069640b493716388b28cd0f81877ab41b210ee91 Mon Sep 17 00:00:00 2001
From: bkioshn <bkioshn@gmail.com>
Date: Thu, 12 Sep 2024 10:30:33 +0700
Subject: [PATCH 07/19] fix(rust/c509-certificate): update docs

---
 .../c509-cert-plutus-restricted.cddl          | 39 +++++++------------
 rust/c509-certificate/examples/cli/main.rs    |  8 ++--
 rust/c509-certificate/examples/web/index.js   |  8 ++--
 .../src/algorithm_identifier.rs               |  2 +-
 .../src/attributes/attribute.rs               |  5 +--
 rust/c509-certificate/src/attributes/data.rs  |  2 +-
 rust/c509-certificate/src/attributes/mod.rs   | 14 ++++---
 rust/c509-certificate/src/big_uint.rs         |  4 +-
 .../src/extensions/extension/data.rs          |  2 +-
 rust/c509-certificate/src/extensions/mod.rs   | 11 ++----
 .../src/general_names/data.rs                 |  2 +-
 .../src/general_names/general_name.rs         |  2 +-
 .../c509-certificate/src/general_names/mod.rs |  2 +-
 .../src/issuer_sig_algo/data.rs               |  2 +-
 rust/c509-certificate/src/lib.rs              |  2 +-
 rust/c509-certificate/src/name/mod.rs         |  8 ++--
 .../src/subject_pub_key_algo/data.rs          |  2 +-
 rust/c509-certificate/src/tbs_cert.rs         |  4 +-
 rust/c509-certificate/src/time.rs             |  2 +-
 19 files changed, 53 insertions(+), 68 deletions(-)

diff --git a/docs/src/catalyst-standards/draft-cips/c509-plutus-restricted-certificate/c509-cert-plutus-restricted.cddl b/docs/src/catalyst-standards/draft-cips/c509-plutus-restricted-certificate/c509-cert-plutus-restricted.cddl
index 4967ed331e1..6247eaa0892 100644
--- a/docs/src/catalyst-standards/draft-cips/c509-plutus-restricted-certificate/c509-cert-plutus-restricted.cddl
+++ b/docs/src/catalyst-standards/draft-cips/c509-plutus-restricted-certificate/c509-cert-plutus-restricted.cddl
@@ -1,5 +1,5 @@
 ; This c509 Certificate format is based upon:
-; https://datatracker.ietf.org/doc/draft-ietf-cose-cbor-encoded-cert/09/
+; https://datatracker.ietf.org/doc/draft-ietf-cose-cbor-encoded-cert/11/
 ; And is restricted/customized to better enable compatibility with Plutus scripts
 ; that would consume them, without loosing necessary features of x509
 ; Not all x509 features are supported and some fields have different semantics to improve
@@ -11,42 +11,32 @@ C509CertificatePlutusRestrictedSubset = [ TBSCertificate, issuerSignatureValue:
 
 ; The elements of the following group are used in a CBOR Sequence:
 TBSCertificate = (
-	c509CertificateType: &c509CertificateTypeValues, ; Always 0
+	c509CertificateType: int, ; Always 2 as natively signed C509 certificate following X.509 v3
 	certificateSerialNumber: CertificateSerialNumber, ; Can be ignored/set to 0 or used as intended.
-	issuer: Name, ; This could be an on-chain reference to the issuer cert, what would be the best way?  Transaction hash/cert hash?
-	validityNotBefore: Time, ; c509 uses UTC
-	validityNotAfter: Time, ; c509 uses UTC
+	issuerSignatureAlgorithm: AlgorithmIdentifier, ; Must be int(12) = Ed25519
+	issuer: Name / null, ; If set to null, use the `subject`. This could be an on-chain reference to
+						   the issuer cert, what would be the best way?  Transaction hash/cert hash?
+	validityNotBefore: ~time, ; UTC
+	validityNotAfter: ~time / null, ; UTC
 	subject: Name, ; Reference to on-chain keys related to this certificate
 	subjectPublicKeyAlgorithm: AlgorithmIdentifier, ; Must be int(12) = Ed25519
-	subjectPublicKey: subjectPublicKey, ; Ed25519 public key
-	extensions: Extensions, ; No extensions are currently supported must be set to []
-	issuerSignatureAlgorithm: AlgorithmIdentifier, ; Must be int(12) = Ed25519
-)
-
-; 0 = Native CBOR Certificate type
-; 1 = reencoded-der-cert -  Not supported in this restricted version of the format.
-c509CertificateTypeValues = ( native-cbor: 0,
-	; reencoded-der: 1 ; Not supported in this restricted encoding format
+	subjectPublicKey: any, ; Ed25519 public key
+	extensions: Extensions, ; Currently support extensions with basic CBOR types and Alternative Name
 )
 
-CertificateSerialNumber = biguint
-
-Name = [ * RelativeDistinguishedName ]
-	/ text
-	/ bytes
+CertificateSerialNumber = ~biguint
 
-RelativeDistinguishedName = Attribute / [ 2* Attribute ]
+Name = [ * Attribute ] / text / bytes
 
 Attribute = (
 	( attributeType: int, attributeValue: text )
 	// ( attributeType: oid, attributeValue: bytes )
-	// ( attributeType: pen, attributeValue: bytes )
 	// CardanoPublicKey
 )
 
 subjectPublicKey = bytes .size (32..32); Ed25519 public key stored in bytes, adjust size of this if other key types are supported.  
 
-; This is a completely custom Attribute for the RelativeDistinguishedName which is only for use with Plutus scripts.
+; This is a completely custom Attribute,  which is only for use with Plutus scripts.
 ; attributeType = The type of Cardano key we associate with this certificate.
 ; proof = Does the transaction require proof that the key is owned by the transaction signer?
 ; attributeValue = The Cardano public key hash of the attribute type
@@ -61,14 +51,12 @@ cardanoKeyTypes = (
 	ccHotVerificationKeyHash: 4,
 )
 
-; Plutus will need to convert the Unix epoch timestamp to the nearest slot number
+; For `~time` Plutus will need to convert the Unix epoch timestamp to the nearest slot number
 ; validityNotBefore rounds up to the next Slot after that time.
 ; validityNotAfter rounds down to the next Slot before that time.
-Time = ( ~time / null )
 
 ed25519Signature = bstr .size 64; Ed25519 signature must be tagged to identify their type.
 
-
 ; Currently ONLY AlgorithmIdentifier int(12) - Ed25519 is supported.
 ; oid and [ algorithm: oid, parameters: bytes ] are not supported by Plutus.
 AlgorithmIdentifier = (int
@@ -82,5 +70,4 @@ Extensions = [ * Extension ] / int
 Extension = (
 	( extensionID: int, extensionValue: any )
 	// ( extensionID: ~oid, ? critical: true, extensionValue: bytes )
-	// ( extensionID: pen, ? critical: true, extensionValue: bytes )
 )
diff --git a/rust/c509-certificate/examples/cli/main.rs b/rust/c509-certificate/examples/cli/main.rs
index 738d19ca17b..6297b14348e 100644
--- a/rust/c509-certificate/examples/cli/main.rs
+++ b/rust/c509-certificate/examples/cli/main.rs
@@ -115,7 +115,7 @@ struct C509Json {
     /// Optional validity not after date,
     /// if not provided, set to no expire date 9999-12-31T23:59:59+00:00.
     validity_not_after: Option<String>,
-    /// Relative distinguished name of the subject.
+    /// Attributes of the subject.
     subject: Attributes,
     /// Optional subject public key algorithm of the certificate,
     /// if not provided, set to Ed25519.
@@ -304,10 +304,10 @@ fn decode(file: &PathBuf, output: Option<PathBuf>) -> anyhow::Result<()> {
         certificate_type: Some(tbs_cert.get_c509_certificate_type()),
         serial_number: Some(tbs_cert.get_certificate_serial_number().clone()),
         issuer_signature_algorithm: Some(tbs_cert.get_issuer_signature_algorithm().clone()),
-        issuer: Some(extract_relative_distinguished_name(tbs_cert.get_issuer())?),
+        issuer: Some(extract_attributes(tbs_cert.get_issuer())?),
         validity_not_before: Some(time_to_string(tbs_cert.get_validity_not_before().to_u64())?),
         validity_not_after: Some(time_to_string(tbs_cert.get_validity_not_after().to_u64())?),
-        subject: extract_relative_distinguished_name(tbs_cert.get_subject())?,
+        subject: extract_attributes(tbs_cert.get_subject())?,
         subject_public_key_algorithm: Some(tbs_cert.get_subject_public_key_algorithm().clone()),
         // Return a hex formation of the public key
         subject_public_key: tbs_cert.get_subject_public_key().encode_hex(),
@@ -326,7 +326,7 @@ fn decode(file: &PathBuf, output: Option<PathBuf>) -> anyhow::Result<()> {
 }
 
 /// Extract a `Attributes` from a `Name`.
-fn extract_relative_distinguished_name(name: &Name) -> anyhow::Result<Attributes> {
+fn extract_attributes(name: &Name) -> anyhow::Result<Attributes> {
     match name.get_value() {
         NameValue::Attributes(attrs) => Ok(attrs.clone()),
         _ => Err(anyhow::anyhow!("Expected Attributes")),
diff --git a/rust/c509-certificate/examples/web/index.js b/rust/c509-certificate/examples/web/index.js
index dd37a6f83f1..a2bdca0cadf 100644
--- a/rust/c509-certificate/examples/web/index.js
+++ b/rust/c509-certificate/examples/web/index.js
@@ -1,11 +1,11 @@
 // Testing the wasm binding JS functions.
 
 import init, {
-	generate,
-	verify,
 	decode,
-	PublicKey,
+	generate,
 	PrivateKey,
+	PublicKey,
+	verify,
 } from "../../pkg/c509_certificate.js";
 
 const pem_sk = `
@@ -24,7 +24,7 @@ const tbs = {
 	c509_certificate_type: 0,
 	certificate_serial_number: 1000000n,
 	issuer: {
-		relative_distinguished_name: [
+		attributes: [
 			{
 				oid: "2.5.4.3",
 				value: [{ text: "RFC test CA" }],
diff --git a/rust/c509-certificate/src/algorithm_identifier.rs b/rust/c509-certificate/src/algorithm_identifier.rs
index 89bca4b118d..285878c975d 100644
--- a/rust/c509-certificate/src/algorithm_identifier.rs
+++ b/rust/c509-certificate/src/algorithm_identifier.rs
@@ -11,7 +11,7 @@
 //! not implemented yet.
 //!
 //! For more information about `AlgorithmIdentifier`,
-//! visit [C509 Certificate](https://datatracker.ietf.org/doc/draft-ietf-cose-cbor-encoded-cert/09/)
+//! visit [C509 Certificate](https://datatracker.ietf.org/doc/draft-ietf-cose-cbor-encoded-cert/11/)
 
 use asn1_rs::Oid;
 use minicbor::{encode::Write, Decode, Decoder, Encode, Encoder};
diff --git a/rust/c509-certificate/src/attributes/attribute.rs b/rust/c509-certificate/src/attributes/attribute.rs
index 5a0e59b9d56..4567bfcaab0 100644
--- a/rust/c509-certificate/src/attributes/attribute.rs
+++ b/rust/c509-certificate/src/attributes/attribute.rs
@@ -2,12 +2,11 @@
 //!
 //! ```cddl
 //! Attribute = ( attributeType: int, attributeValue: text ) //
-//! ( attributeType: ~oid, attributeValue: bytes ) //
-//! ( attributeType: pen, attributeValue: bytes )
+//!             ( attributeType: ~oid, attributeValue: bytes ) //
 //! ```
 //!
 //! For more information about Attribute,
-//! visit [C509 Certificate](https://datatracker.ietf.org/doc/draft-ietf-cose-cbor-encoded-cert/09/)
+//! visit [C509 Certificate](https://datatracker.ietf.org/doc/draft-ietf-cose-cbor-encoded-cert/11/)
 
 use std::str::FromStr;
 
diff --git a/rust/c509-certificate/src/attributes/data.rs b/rust/c509-certificate/src/attributes/data.rs
index b89fb429cb4..0ae826a3453 100644
--- a/rust/c509-certificate/src/attributes/data.rs
+++ b/rust/c509-certificate/src/attributes/data.rs
@@ -1,5 +1,5 @@
 //! Attribute data provides a necessary information for encoding and decoding of C509
-//! Attribute. See [C509 Certificate](https://datatracker.ietf.org/doc/draft-ietf-cose-cbor-encoded-cert/09/)
+//! Attribute. See [C509 Certificate](https://datatracker.ietf.org/doc/draft-ietf-cose-cbor-encoded-cert/11/)
 //! Section 9.3 C509 Attributes Registry for more information.
 
 use anyhow::Error;
diff --git a/rust/c509-certificate/src/attributes/mod.rs b/rust/c509-certificate/src/attributes/mod.rs
index 928e70cd3b3..ead810ec22e 100644
--- a/rust/c509-certificate/src/attributes/mod.rs
+++ b/rust/c509-certificate/src/attributes/mod.rs
@@ -2,7 +2,7 @@
 //!
 //! ```cddl
 //! Attributes = ( attributeType: int, attributeValue: [+text] ) //
-//! ( attributeType: ~oid, attributeValue: [+bytes] )
+//!             ( attributeType: ~oid, attributeValue: [+bytes] )
 //! ```
 //!
 //! Use case:
@@ -11,7 +11,7 @@
 //! ```
 //!
 //! For more information about `Attributes`,
-//! visit [C509 Certificate](https://datatracker.ietf.org/doc/draft-ietf-cose-cbor-encoded-cert/09/)
+//! visit [C509 Certificate](https://datatracker.ietf.org/doc/draft-ietf-cose-cbor-encoded-cert/11/)
 
 use attribute::Attribute;
 use minicbor::{encode::Write, Decode, Decoder, Encode, Encoder};
@@ -59,7 +59,8 @@ impl Encode<()> for Attributes {
                 "Attributes should not be empty",
             ));
         }
-        e.array(self.0.len() as u64)?;
+        // The attribute type should be included in array too
+        e.array(self.0.len() as u64 * 2)?;
         for attribute in &self.0 {
             attribute.encode(e, ctx)?;
         }
@@ -78,7 +79,8 @@ impl Decode<'_, ()> for Attributes {
 
         let mut attributes = Attributes::new();
 
-        for _ in 0..len {
+        // The attribute type is included in an array, so divide by 2
+        for _ in 0..len / 2 {
             let attribute = Attribute::decode(d, &mut ())?;
             attributes.add_attr(attribute);
         }
@@ -108,13 +110,13 @@ mod test_attributes {
         attributes
             .encode(&mut encoder, &mut ())
             .expect("Failed to encode Attributes");
-        // 1 Attribute value (array len 1): 0x81
+        // 1 Attribute (array len 2 (attribute type + value)): 0x82
         // Email Address: 0x00
         // Attribute value (array len 2): 0x82
         // example@example.com: 0x736578616d706c65406578616d706c652e636f6d
         assert_eq!(
             hex::encode(buffer.clone()),
-            "810082736578616d706c65406578616d706c652e636f6d736578616d706c65406578616d706c652e636f6d"
+            "820082736578616d706c65406578616d706c652e636f6d736578616d706c65406578616d706c652e636f6d"
         );
 
         let mut decoder = Decoder::new(&buffer);
diff --git a/rust/c509-certificate/src/big_uint.rs b/rust/c509-certificate/src/big_uint.rs
index a28e93305d8..ca87c056173 100644
--- a/rust/c509-certificate/src/big_uint.rs
+++ b/rust/c509-certificate/src/big_uint.rs
@@ -54,7 +54,7 @@ mod test_big_uint {
 
     use super::*;
 
-    // Test reference https://datatracker.ietf.org/doc/draft-ietf-cose-cbor-encoded-cert/09/
+    // Test reference https://datatracker.ietf.org/doc/draft-ietf-cose-cbor-encoded-cert/11/
     // A.1.  Example RFC 7925 profiled X.509 Certificate
     #[test]
     fn test_encode_decode() {
@@ -74,7 +74,7 @@ mod test_big_uint {
         assert_eq!(decoded_b_uint, b_uint);
     }
 
-    // Test reference https://datatracker.ietf.org/doc/draft-ietf-cose-cbor-encoded-cert/09/
+    // Test reference https://datatracker.ietf.org/doc/draft-ietf-cose-cbor-encoded-cert/11/
     // A.2.  Example IEEE 802.1AR profiled X.509 Certificate
     #[test]
     fn test_encode_decode_2() {
diff --git a/rust/c509-certificate/src/extensions/extension/data.rs b/rust/c509-certificate/src/extensions/extension/data.rs
index 9bf2b5a8fc8..09980dd4448 100644
--- a/rust/c509-certificate/src/extensions/extension/data.rs
+++ b/rust/c509-certificate/src/extensions/extension/data.rs
@@ -1,5 +1,5 @@
 //! Extension data provides a necessary information for encoding and decoding of C509
-//! Extension. See [C509 Certificate](https://datatracker.ietf.org/doc/draft-ietf-cose-cbor-encoded-cert/09/)
+//! Extension. See [C509 Certificate](https://datatracker.ietf.org/doc/draft-ietf-cose-cbor-encoded-cert/11/)
 //! Section 9.4 C509 Extensions Registry for more information.
 
 // cspell: words Evt
diff --git a/rust/c509-certificate/src/extensions/mod.rs b/rust/c509-certificate/src/extensions/mod.rs
index 1288f9e642b..f5788ee2443 100644
--- a/rust/c509-certificate/src/extensions/mod.rs
+++ b/rust/c509-certificate/src/extensions/mod.rs
@@ -1,21 +1,18 @@
 //! C509 Extension as a part of `TBSCertificate` used in C509 Certificate.
 //!
 //! Extension fallback of C509 OID extension
-//! Given OID if not found in the registered OID table, it will be encoded as a PEN OID.
-//! If the OID is not a PEN OID, it will be encoded as an unwrapped OID.
+//! Given OID if not found in the registered OID table, it will be encoded as an unwrapped OID.
 //!
 //! ```cddl
 //! Extensions and Extension can be encoded as the following:
 //! Extensions = [ * Extension ] / int
 //! Extension = ( extensionID: int, extensionValue: any ) //
-//! ( extensionID: ~oid, ? critical: true,
-//!   extensionValue: bytes ) //
-//! ( extensionID: pen, ? critical: true,
-//!   extensionValue: bytes )
+//!             ( extensionID: ~oid, ? critical: true,
+//!             extensionValue: bytes ) //
 //! ```
 //!
 //! For more information about Extensions,
-//! visit [C509 Certificate](https://datatracker.ietf.org/doc/draft-ietf-cose-cbor-encoded-cert/09/)
+//! visit [C509 Certificate](https://datatracker.ietf.org/doc/draft-ietf-cose-cbor-encoded-cert/11/)
 
 pub mod alt_name;
 pub mod extension;
diff --git a/rust/c509-certificate/src/general_names/data.rs b/rust/c509-certificate/src/general_names/data.rs
index 71ff7649492..993d031ecf2 100644
--- a/rust/c509-certificate/src/general_names/data.rs
+++ b/rust/c509-certificate/src/general_names/data.rs
@@ -1,5 +1,5 @@
 //! General Name data provides a necessary information for encoding and decoding of C509
-//! General Name. See [C509 Certificate](https://datatracker.ietf.org/doc/draft-ietf-cose-cbor-encoded-cert/09/)
+//! General Name. See [C509 Certificate](https://datatracker.ietf.org/doc/draft-ietf-cose-cbor-encoded-cert/11/)
 //! Section 9.9 C509 General Names Registry for more information.
 
 // cspell: words Gntr Gnvt
diff --git a/rust/c509-certificate/src/general_names/general_name.rs b/rust/c509-certificate/src/general_names/general_name.rs
index 0549f37bb4c..e7d400b9ac9 100644
--- a/rust/c509-certificate/src/general_names/general_name.rs
+++ b/rust/c509-certificate/src/general_names/general_name.rs
@@ -1,7 +1,7 @@
 //! C509 General Name
 //!
 //! For more information about `GeneralName`,
-//! visit [C509 Certificate](https://datatracker.ietf.org/doc/draft-ietf-cose-cbor-encoded-cert/09/)
+//! visit [C509 Certificate](https://datatracker.ietf.org/doc/draft-ietf-cose-cbor-encoded-cert/11/)
 
 use std::fmt::Debug;
 
diff --git a/rust/c509-certificate/src/general_names/mod.rs b/rust/c509-certificate/src/general_names/mod.rs
index 1998733be30..3e0867c33d2 100644
--- a/rust/c509-certificate/src/general_names/mod.rs
+++ b/rust/c509-certificate/src/general_names/mod.rs
@@ -1,7 +1,7 @@
 //! C509 General Names
 //!
 //! For more information about `GeneralNames`,
-//! visit [C509 Certificate](https://datatracker.ietf.org/doc/draft-ietf-cose-cbor-encoded-cert/09/)
+//! visit [C509 Certificate](https://datatracker.ietf.org/doc/draft-ietf-cose-cbor-encoded-cert/11/)
 
 mod data;
 pub mod general_name;
diff --git a/rust/c509-certificate/src/issuer_sig_algo/data.rs b/rust/c509-certificate/src/issuer_sig_algo/data.rs
index 1d0e77bf392..c052c7e438b 100644
--- a/rust/c509-certificate/src/issuer_sig_algo/data.rs
+++ b/rust/c509-certificate/src/issuer_sig_algo/data.rs
@@ -1,5 +1,5 @@
 //! Signature algorithm data provides a necessary information for encoding and decoding of
-//! C509 `issuerSignatureAlgorithm`. See [C509 Certificate](https://datatracker.ietf.org/doc/draft-ietf-cose-cbor-encoded-cert/09/)
+//! C509 `issuerSignatureAlgorithm`. See [C509 Certificate](https://datatracker.ietf.org/doc/draft-ietf-cose-cbor-encoded-cert/11/)
 //! Section 9.10 C509 Signature Algorithms Registry for more information.
 
 // cspell: words RSASSA XMSS
diff --git a/rust/c509-certificate/src/lib.rs b/rust/c509-certificate/src/lib.rs
index ae223655b93..a2ca40d225a 100644
--- a/rust/c509-certificate/src/lib.rs
+++ b/rust/c509-certificate/src/lib.rs
@@ -33,7 +33,7 @@
 //!    * issuerSignatureAlgorithm: The algorithm used to sign the certificate (must be the
 //!      algorithm uses to create `IssuerSignatureValue`).
 //!
-//! Please refer to the [C509 Certificate](https://datatracker.ietf.org/doc/draft-ietf-cose-cbor-encoded-cert/09/) for more information.
+//! Please refer to the [C509 Certificate](https://datatracker.ietf.org/doc/draft-ietf-cose-cbor-encoded-cert/11/) for more information.
 
 use anyhow::anyhow;
 use c509::C509;
diff --git a/rust/c509-certificate/src/name/mod.rs b/rust/c509-certificate/src/name/mod.rs
index 4ddc2be7a28..1bf2b13c262 100644
--- a/rust/c509-certificate/src/name/mod.rs
+++ b/rust/c509-certificate/src/name/mod.rs
@@ -10,7 +10,7 @@
 //! ```
 //!
 //! For more information about Name,
-//! visit [C509 Certificate](https://datatracker.ietf.org/doc/draft-ietf-cose-cbor-encoded-cert/09/)
+//! visit [C509 Certificate](https://datatracker.ietf.org/doc/draft-ietf-cose-cbor-encoded-cert/11/)
 
 use asn1_rs::{oid, Oid};
 use minicbor::{encode::Write, Decode, Decoder, Encode, Encoder};
@@ -278,7 +278,7 @@ pub(crate) mod test_name {
     use super::*;
     use crate::attributes::attribute::Attribute;
 
-    // Test data from https://datatracker.ietf.org/doc/draft-ietf-cose-cbor-encoded-cert/09/
+    // Test data from https://datatracker.ietf.org/doc/draft-ietf-cose-cbor-encoded-cert/11/
     // A.1.1.  Example C509 Certificate Encoding
     pub(crate) fn name_cn_text() -> (Name, String) {
         let mut attr = Attribute::new(oid!(2.5.4 .3));
@@ -356,7 +356,7 @@ pub(crate) mod test_name {
         assert_eq!(name_decoded, name);
     }
 
-    // Test data from https://datatracker.ietf.org/doc/draft-ietf-cose-cbor-encoded-cert/09/
+    // Test data from https://datatracker.ietf.org/doc/draft-ietf-cose-cbor-encoded-cert/11/
     // A.1.  Example RFC 7925 profiled X.509 Certificate
     pub(crate) fn name_cn_eui_mac() -> (Name, String) {
         let mut attr = Attribute::new(oid!(2.5.4 .3));
@@ -463,7 +463,7 @@ pub(crate) mod test_name {
         assert_eq!(name_decoded, name);
     }
 
-    // Test data from https://datatracker.ietf.org/doc/draft-ietf-cose-cbor-encoded-cert/09/
+    // Test data from https://datatracker.ietf.org/doc/draft-ietf-cose-cbor-encoded-cert/11/
     // A.2.  Example IEEE 802.1AR profiled X.509 Certificate
     // Issuer: C=US, ST=CA, O=Example Inc, OU=certification, CN=802.1AR CA
     pub(crate) fn names() -> (Name, String) {
diff --git a/rust/c509-certificate/src/subject_pub_key_algo/data.rs b/rust/c509-certificate/src/subject_pub_key_algo/data.rs
index bb37a2d4bf5..0a29de39f48 100644
--- a/rust/c509-certificate/src/subject_pub_key_algo/data.rs
+++ b/rust/c509-certificate/src/subject_pub_key_algo/data.rs
@@ -1,5 +1,5 @@
 //! Public key algorithm data provides a necessary information for encoding and decoding
-//! of C509 `subjectPublicKeyAlgorithm`. See [C509 Certificate](https://datatracker.ietf.org/doc/draft-ietf-cose-cbor-encoded-cert/09/)
+//! of C509 `subjectPublicKeyAlgorithm`. See [C509 Certificate](https://datatracker.ietf.org/doc/draft-ietf-cose-cbor-encoded-cert/11/)
 //! Section 9.11 C509 Public Key Algorithms Registry for more information.
 
 // cspell: words Weierstraß secp XMSS brainpool
diff --git a/rust/c509-certificate/src/tbs_cert.rs b/rust/c509-certificate/src/tbs_cert.rs
index d67089a4b6e..87ae6eb8b4b 100644
--- a/rust/c509-certificate/src/tbs_cert.rs
+++ b/rust/c509-certificate/src/tbs_cert.rs
@@ -205,7 +205,7 @@ pub(crate) mod test_tbs_cert {
     // Mnemonic: match mad promote group rival case
     const PUBKEY: [u8; 8] = [0x88, 0xD0, 0xB6, 0xB0, 0xB3, 0x7B, 0xAA, 0x46];
 
-    // Test reference https://datatracker.ietf.org/doc/draft-ietf-cose-cbor-encoded-cert/09/
+    // Test reference https://datatracker.ietf.org/doc/draft-ietf-cose-cbor-encoded-cert/11/
     // A.1.  Example RFC 7925 profiled X.509 Certificate
     //
     //
@@ -311,7 +311,7 @@ pub(crate) mod test_tbs_cert {
         assert_eq!(decoded_tbs, tbs_cert);
     }
 
-    // Test reference https://datatracker.ietf.org/doc/draft-ietf-cose-cbor-encoded-cert/09/
+    // Test reference https://datatracker.ietf.org/doc/draft-ietf-cose-cbor-encoded-cert/11/
     // A.2.  Example IEEE 802.1AR profiled X.509 Certificate
     //
     // Certificate:
diff --git a/rust/c509-certificate/src/time.rs b/rust/c509-certificate/src/time.rs
index ade7a5a11e4..9e1811c0657 100644
--- a/rust/c509-certificate/src/time.rs
+++ b/rust/c509-certificate/src/time.rs
@@ -79,7 +79,7 @@ mod test_time {
         assert_eq!(decoded_time, time);
     }
 
-    // Test reference https://datatracker.ietf.org/doc/draft-ietf-cose-cbor-encoded-cert/09/
+    // Test reference https://datatracker.ietf.org/doc/draft-ietf-cose-cbor-encoded-cert/11/
     // A.1.  Example RFC 7925 profiled X.509 Certificate
     #[test]
     fn test_encode_decode() {

From b2d22c834c8d52bf62277ce7a497cd8a8ff7b045 Mon Sep 17 00:00:00 2001
From: bkioshn <bkioshn@gmail.com>
Date: Thu, 12 Sep 2024 10:32:53 +0700
Subject: [PATCH 08/19] fix(rust/c509-certificate): format + err handling

---
 rust/c509-certificate/examples/cli/main.rs    |  2 +-
 .../src/attributes/attribute.rs               | 16 +++++++---------
 .../src/extensions/extension/mod.rs           | 19 ++++++++-----------
 rust/c509-certificate/src/extensions/mod.rs   |  3 ++-
 rust/c509-certificate/src/name/mod.rs         | 17 +++++++++++------
 rust/c509-certificate/src/oid.rs              | 11 ++++-------
 rust/c509-certificate/src/tbs_cert.rs         |  8 ++++----
 rust/c509-certificate/src/time.rs             |  2 +-
 8 files changed, 38 insertions(+), 40 deletions(-)

diff --git a/rust/c509-certificate/examples/cli/main.rs b/rust/c509-certificate/examples/cli/main.rs
index 6297b14348e..e7c662de28e 100644
--- a/rust/c509-certificate/examples/cli/main.rs
+++ b/rust/c509-certificate/examples/cli/main.rs
@@ -163,7 +163,7 @@ fn generate(
     let now_timestamp: u64 = Utc::now()
         .timestamp()
         .try_into()
-        .expect("Timestamp cannot be converted to u64");
+        .map_err(|_| anyhow::anyhow!("Current timestamp is invalid"))?;
 
     let not_before = parse_or_default_date(c509_json.validity_not_before, now_timestamp)?;
     // Default as expire date for not_after
diff --git a/rust/c509-certificate/src/attributes/attribute.rs b/rust/c509-certificate/src/attributes/attribute.rs
index 4567bfcaab0..ce5e0b74881 100644
--- a/rust/c509-certificate/src/attributes/attribute.rs
+++ b/rust/c509-certificate/src/attributes/attribute.rs
@@ -72,9 +72,7 @@ struct Helper {
 
 impl<'de> Deserialize<'de> for Attribute {
     fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
-    where
-        D: Deserializer<'de>,
-    {
+    where D: Deserializer<'de> {
         let helper = Helper::deserialize(deserializer)?;
         let oid =
             Oid::from_str(&helper.oid).map_err(|e| serde::de::Error::custom(format!("{e:?}")))?;
@@ -88,9 +86,7 @@ impl<'de> Deserialize<'de> for Attribute {
 
 impl Serialize for Attribute {
     fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
-    where
-        S: serde::Serializer,
-    {
+    where S: serde::Serializer {
         let helper = Helper {
             oid: self.registered_oid.get_c509_oid().get_oid().to_string(),
             value: self.value.clone(),
@@ -201,9 +197,11 @@ impl Decode<'_, ()> for AttributeValue {
         match d.datatype()? {
             minicbor::data::Type::String => Ok(AttributeValue::Text(d.str()?.to_string())),
             minicbor::data::Type::Bytes => Ok(AttributeValue::Bytes(d.bytes()?.to_vec())),
-            _ => Err(minicbor::decode::Error::message(
-                "Invalid AttributeValue, value should be either String or Bytes",
-            )),
+            _ => {
+                Err(minicbor::decode::Error::message(
+                    "Invalid AttributeValue, value should be either String or Bytes",
+                ))
+            },
         }
     }
 }
diff --git a/rust/c509-certificate/src/extensions/extension/mod.rs b/rust/c509-certificate/src/extensions/extension/mod.rs
index 899b6d5c2a5..095ed9c56d5 100644
--- a/rust/c509-certificate/src/extensions/extension/mod.rs
+++ b/rust/c509-certificate/src/extensions/extension/mod.rs
@@ -67,9 +67,7 @@ struct Helper {
 
 impl<'de> Deserialize<'de> for Extension {
     fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
-    where
-        D: Deserializer<'de>,
-    {
+    where D: Deserializer<'de> {
         let helper = Helper::deserialize(deserializer)?;
         let oid =
             Oid::from_str(&helper.oid).map_err(|e| serde::de::Error::custom(format!("{e:?}")))?;
@@ -80,9 +78,7 @@ impl<'de> Deserialize<'de> for Extension {
 
 impl Serialize for Extension {
     fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
-    where
-        S: serde::Serializer,
-    {
+    where S: serde::Serializer {
         let helper = Helper {
             oid: self.registered_oid.get_c509_oid().get_oid().to_string(),
             value: self.value.clone(),
@@ -231,8 +227,7 @@ impl Encode<()> for ExtensionValue {
 }
 
 impl<C> Decode<'_, C> for ExtensionValue
-where
-    C: ExtensionValueTypeTrait + Debug,
+where C: ExtensionValueTypeTrait + Debug
 {
     fn decode(d: &mut Decoder<'_>, ctx: &mut C) -> Result<Self, minicbor::decode::Error> {
         match ctx.get_type() {
@@ -248,9 +243,11 @@ where
                 let value = AlternativeName::decode(d, &mut ())?;
                 Ok(ExtensionValue::AlternativeName(value))
             },
-            ExtensionValueType::Unsupported => Err(minicbor::decode::Error::message(
-                "Cannot decode Unsupported extension value",
-            )),
+            ExtensionValueType::Unsupported => {
+                Err(minicbor::decode::Error::message(
+                    "Cannot decode Unsupported extension value",
+                ))
+            },
         }
     }
 }
diff --git a/rust/c509-certificate/src/extensions/mod.rs b/rust/c509-certificate/src/extensions/mod.rs
index f5788ee2443..51784aaedc4 100644
--- a/rust/c509-certificate/src/extensions/mod.rs
+++ b/rust/c509-certificate/src/extensions/mod.rs
@@ -1,7 +1,8 @@
 //! C509 Extension as a part of `TBSCertificate` used in C509 Certificate.
 //!
 //! Extension fallback of C509 OID extension
-//! Given OID if not found in the registered OID table, it will be encoded as an unwrapped OID.
+//! Given OID if not found in the registered OID table, it will be encoded as an unwrapped
+//! OID.
 //!
 //! ```cddl
 //! Extensions and Extension can be encoded as the following:
diff --git a/rust/c509-certificate/src/name/mod.rs b/rust/c509-certificate/src/name/mod.rs
index 1bf2b13c262..6d11d114771 100644
--- a/rust/c509-certificate/src/name/mod.rs
+++ b/rust/c509-certificate/src/name/mod.rs
@@ -131,9 +131,11 @@ impl Decode<'_, ()> for NameValue {
             // If Name is a text string, the attribute is a CommonName
             minicbor::data::Type::String => Ok(create_attributes_with_cn(d.str()?.to_string())),
             minicbor::data::Type::Bytes => decode_bytes(d),
-            _ => Err(minicbor::decode::Error::message(
-                "Name must be an array, text or bytes",
-            )),
+            _ => {
+                Err(minicbor::decode::Error::message(
+                    "Name must be an array, text or bytes",
+                ))
+            },
         }
     }
 }
@@ -256,9 +258,11 @@ fn decode_eui_cn_bytes(bytes: &[u8]) -> Result<NameValue, minicbor::decode::Erro
             )?);
             Ok(create_attributes_with_cn(text))
         },
-        _ => Err(minicbor::decode::Error::message(
-            "EUI-64 or MAC address must be 7 or 9 bytes",
-        )),
+        _ => {
+            Err(minicbor::decode::Error::message(
+                "EUI-64 or MAC address must be 7 or 9 bytes",
+            ))
+        },
     }
 }
 
@@ -466,6 +470,7 @@ pub(crate) mod test_name {
     // Test data from https://datatracker.ietf.org/doc/draft-ietf-cose-cbor-encoded-cert/11/
     // A.2.  Example IEEE 802.1AR profiled X.509 Certificate
     // Issuer: C=US, ST=CA, O=Example Inc, OU=certification, CN=802.1AR CA
+    #[allow(clippy::similar_names)]
     pub(crate) fn names() -> (Name, String) {
         let mut attr1 = Attribute::new(oid!(2.5.4 .6));
         attr1.add_value(AttributeValue::Text("US".to_string()));
diff --git a/rust/c509-certificate/src/oid.rs b/rust/c509-certificate/src/oid.rs
index 5f487d10efe..2db0b90a3c7 100644
--- a/rust/c509-certificate/src/oid.rs
+++ b/rust/c509-certificate/src/oid.rs
@@ -58,9 +58,7 @@ struct Helper {
 
 impl<'de> Deserialize<'de> for C509oid {
     fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
-    where
-        D: Deserializer<'de>,
-    {
+    where D: Deserializer<'de> {
         let helper = Helper::deserialize(deserializer)?;
         let oid =
             Oid::from_str(&helper.oid).map_err(|e| serde::de::Error::custom(format!("{e:?}")))?;
@@ -70,9 +68,7 @@ impl<'de> Deserialize<'de> for C509oid {
 
 impl Serialize for C509oid {
     fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
-    where
-        S: serde::Serializer,
-    {
+    where S: serde::Serializer {
         let helper = Helper {
             oid: self.0.to_string(),
         };
@@ -132,9 +128,10 @@ impl Decode<'_, ()> for C509oid {
 #[cfg(test)]
 mod test_c509_oid {
 
-    use super::*;
     use asn1_rs::oid;
 
+    use super::*;
+
     // Test reference 3.1. Encoding of the SHA-256 OID
     // https://datatracker.ietf.org/doc/rfc9090/
     #[test]
diff --git a/rust/c509-certificate/src/tbs_cert.rs b/rust/c509-certificate/src/tbs_cert.rs
index 87ae6eb8b4b..f347159040e 100644
--- a/rust/c509-certificate/src/tbs_cert.rs
+++ b/rust/c509-certificate/src/tbs_cert.rs
@@ -371,6 +371,7 @@ pub(crate) mod test_tbs_cert {
     // 83 2A 4D 33 6A 08 AD 67 DF 20 F1 50 64 21 18 8A 0A DE 6D 34 92 36
 
     #[test]
+    #[allow(clippy::similar_names)]
     fn tbs_cert2() {
         // ---------helper----------
         // C=US, ST=CA, L=LA, O=example Inc, OU=IoT/serialNumber=Wt1234
@@ -423,10 +424,9 @@ pub(crate) mod test_tbs_cert {
                 true,
             ));
             let mut gns = GeneralNames::new();
-            let hw = OtherNameHardwareModuleName::new(
-                oid!(1.3.6 .1 .4 .1 .6175 .10 .1),
-                vec![0x01, 0x02, 0x03, 0x04],
-            );
+            let hw = OtherNameHardwareModuleName::new(oid!(1.3.6 .1 .4 .1 .6175 .10 .1), vec![
+                0x01, 0x02, 0x03, 0x04,
+            ]);
             gns.add_gn(GeneralName::new(
                 GeneralNameTypeRegistry::OtherNameHardwareModuleName,
                 GeneralNameValue::OtherNameHWModuleName(hw),
diff --git a/rust/c509-certificate/src/time.rs b/rust/c509-certificate/src/time.rs
index 9e1811c0657..1244473ffa2 100644
--- a/rust/c509-certificate/src/time.rs
+++ b/rust/c509-certificate/src/time.rs
@@ -4,7 +4,7 @@ use minicbor::{encode::Write, Decode, Decoder, Encode, Encoder};
 use serde::{Deserialize, Serialize};
 
 /// A struct representing a time where it accept seconds since the Unix epoch.
-/// Doesn't support dates before the Unix epoch (January 1, 1970, 00:00:00 UTC) 
+/// Doesn't support dates before the Unix epoch (January 1, 1970, 00:00:00 UTC)
 /// so unsigned integer is used.
 #[derive(Debug, Clone, PartialEq, Deserialize, Serialize)]
 pub struct Time(u64);

From c50834af3bfa0b90824552a29db938951a39e020 Mon Sep 17 00:00:00 2001
From: bkioshn <35752733+bkioshn@users.noreply.github.com>
Date: Tue, 17 Sep 2024 15:42:38 +0700
Subject: [PATCH 09/19] fix(rust/c509-certificate): Rename functions + add
 necessary functions (#26)

* fix: naming + add neccesary function

* fix(rust/c509-certificate): cleanup

* fix(rust/c509-certificate): cleanup

---------

Co-authored-by: Steven Johnson <stevenj@users.noreply.github.com>
---
 rust/c509-certificate/examples/cli/main.rs    | 32 +++++++------
 .../src/algorithm_identifier.rs               | 23 +++++----
 .../src/attributes/attribute.rs               | 27 ++++++-----
 rust/c509-certificate/src/attributes/mod.rs   | 18 +++----
 rust/c509-certificate/src/big_uint.rs         | 12 +++++
 rust/c509-certificate/src/c509.rs             |  4 +-
 .../src/extensions/alt_name.rs                | 16 +++----
 .../src/extensions/extension/mod.rs           | 21 ++++----
 rust/c509-certificate/src/extensions/mod.rs   | 46 ++++++++----------
 .../src/general_names/general_name.rs         |  4 +-
 .../c509-certificate/src/general_names/mod.rs | 38 +++++++--------
 .../src/general_names/other_name_hw_module.rs | 14 +++++-
 .../src/issuer_sig_algo/mod.rs                | 25 +++++++---
 rust/c509-certificate/src/lib.rs              |  4 +-
 rust/c509-certificate/src/name/mod.rs         | 32 ++++++-------
 rust/c509-certificate/src/oid.rs              | 39 ++++++++-------
 .../src/subject_pub_key_algo/mod.rs           | 24 +++++++---
 rust/c509-certificate/src/tbs_cert.rs         | 48 +++++++++++--------
 rust/c509-certificate/src/time.rs             | 16 ++++++-
 19 files changed, 256 insertions(+), 187 deletions(-)

diff --git a/rust/c509-certificate/examples/cli/main.rs b/rust/c509-certificate/examples/cli/main.rs
index e7c662de28e..9ef57c157f6 100644
--- a/rust/c509-certificate/examples/cli/main.rs
+++ b/rust/c509-certificate/examples/cli/main.rs
@@ -297,22 +297,26 @@ fn decode(file: &PathBuf, output: Option<PathBuf>) -> anyhow::Result<()> {
     let mut d = minicbor::Decoder::new(&cert);
     let c509 = c509_certificate::c509::C509::decode(&mut d, &mut ())?;
 
-    let tbs_cert = c509.get_tbs_cert();
-    let is_self_signed = tbs_cert.get_c509_certificate_type() == SELF_SIGNED_INT;
+    let tbs_cert = c509.tbs_cert();
+    let is_self_signed = tbs_cert.c509_certificate_type() == SELF_SIGNED_INT;
     let c509_json = C509Json {
         self_signed: is_self_signed,
-        certificate_type: Some(tbs_cert.get_c509_certificate_type()),
-        serial_number: Some(tbs_cert.get_certificate_serial_number().clone()),
-        issuer_signature_algorithm: Some(tbs_cert.get_issuer_signature_algorithm().clone()),
-        issuer: Some(extract_attributes(tbs_cert.get_issuer())?),
-        validity_not_before: Some(time_to_string(tbs_cert.get_validity_not_before().to_u64())?),
-        validity_not_after: Some(time_to_string(tbs_cert.get_validity_not_after().to_u64())?),
-        subject: extract_attributes(tbs_cert.get_subject())?,
-        subject_public_key_algorithm: Some(tbs_cert.get_subject_public_key_algorithm().clone()),
+        certificate_type: Some(tbs_cert.c509_certificate_type()),
+        serial_number: Some(tbs_cert.certificate_serial_number().clone()),
+        issuer_signature_algorithm: Some(tbs_cert.issuer_signature_algorithm().clone()),
+        issuer: Some(extract_attributes(tbs_cert.issuer())?),
+        validity_not_before: Some(time_to_string(
+            tbs_cert.validity_not_before().clone().into(),
+        )?),
+        validity_not_after: Some(time_to_string(
+            tbs_cert.validity_not_after().clone().into(),
+        )?),
+        subject: extract_attributes(tbs_cert.subject())?,
+        subject_public_key_algorithm: Some(tbs_cert.subject_public_key_algorithm().clone()),
         // Return a hex formation of the public key
-        subject_public_key: tbs_cert.get_subject_public_key().encode_hex(),
-        extensions: tbs_cert.get_extensions().clone(),
-        issuer_signature_value: c509.get_issuer_signature_value().clone(),
+        subject_public_key: tbs_cert.subject_public_key().encode_hex(),
+        extensions: tbs_cert.extensions().clone(),
+        issuer_signature_value: c509.issuer_signature_value().clone(),
     };
 
     let data = serde_json::to_string(&c509_json)?;
@@ -327,7 +331,7 @@ fn decode(file: &PathBuf, output: Option<PathBuf>) -> anyhow::Result<()> {
 
 /// Extract a `Attributes` from a `Name`.
 fn extract_attributes(name: &Name) -> anyhow::Result<Attributes> {
-    match name.get_value() {
+    match name.value() {
         NameValue::Attributes(attrs) => Ok(attrs.clone()),
         _ => Err(anyhow::anyhow!("Expected Attributes")),
     }
diff --git a/rust/c509-certificate/src/algorithm_identifier.rs b/rust/c509-certificate/src/algorithm_identifier.rs
index 285878c975d..d6a3e1e1ccb 100644
--- a/rust/c509-certificate/src/algorithm_identifier.rs
+++ b/rust/c509-certificate/src/algorithm_identifier.rs
@@ -23,7 +23,7 @@ use crate::oid::C509oid;
 #[derive(Debug, Clone, PartialEq, Deserialize, Serialize)]
 pub struct AlgorithmIdentifier {
     /// A `C509oid`
-    oid: C509oid,
+    c509_oid: C509oid,
     /// An optional parameter string
     param: Option<String>,
 }
@@ -33,18 +33,20 @@ impl AlgorithmIdentifier {
     #[must_use]
     pub fn new(oid: Oid<'static>, param: Option<String>) -> Self {
         Self {
-            oid: C509oid::new(oid),
+            c509_oid: C509oid::new(oid),
             param,
         }
     }
 
     /// Get the OID.
-    pub(crate) fn get_oid(&self) -> Oid<'static> {
-        self.oid.clone().get_oid()
+    #[must_use]
+    pub fn oid(&self) -> &Oid<'static> {
+        self.c509_oid.oid()
     }
 
     /// Get the parameter.
-    pub(crate) fn get_param(&self) -> &Option<String> {
+    #[must_use]
+    pub fn param(&self) -> &Option<String> {
         &self.param
     }
 }
@@ -57,12 +59,12 @@ impl Encode<()> for AlgorithmIdentifier {
             // [ algorithm: ~oid, parameters: bytes ]
             Some(p) => {
                 e.array(2)?;
-                self.oid.encode(e, ctx)?;
+                self.c509_oid.encode(e, ctx)?;
                 e.bytes(p.as_bytes())?;
             },
             // ~oid
             None => {
-                self.oid.encode(e, ctx)?;
+                self.c509_oid.encode(e, ctx)?;
             },
         }
         Ok(())
@@ -82,11 +84,14 @@ impl Decode<'_, ()> for AlgorithmIdentifier {
             let c509_oid = C509oid::decode(d, ctx)?;
             let param =
                 String::from_utf8(d.bytes()?.to_vec()).map_err(minicbor::decode::Error::message)?;
-            Ok(AlgorithmIdentifier::new(c509_oid.get_oid(), Some(param)))
+            Ok(AlgorithmIdentifier::new(
+                c509_oid.oid().clone(),
+                Some(param),
+            ))
             // ~oid
         } else {
             let oid = C509oid::decode(d, ctx)?;
-            Ok(AlgorithmIdentifier::new(oid.get_oid(), None))
+            Ok(AlgorithmIdentifier::new(oid.oid().clone(), None))
         }
     }
 }
diff --git a/rust/c509-certificate/src/attributes/attribute.rs b/rust/c509-certificate/src/attributes/attribute.rs
index ce5e0b74881..b1da9793cc6 100644
--- a/rust/c509-certificate/src/attributes/attribute.rs
+++ b/rust/c509-certificate/src/attributes/attribute.rs
@@ -39,19 +39,20 @@ impl Attribute {
         }
     }
 
-    /// Add a value to `Attribute`.
-    pub fn add_value(&mut self, value: AttributeValue) {
-        self.value.push(value);
+    /// Get the value of `Attribute`.
+    #[must_use]
+    pub fn value(&self) -> &[AttributeValue] {
+        &self.value
     }
 
     /// Get the registered OID of `Attribute`.
-    pub(crate) fn get_registered_oid(&self) -> &C509oidRegistered {
+    pub(crate) fn registered_oid(&self) -> &C509oidRegistered {
         &self.registered_oid
     }
 
-    /// Get the value of `Attribute`.
-    pub(crate) fn get_value(&self) -> &Vec<AttributeValue> {
-        &self.value
+    /// Add a value to `Attribute`.
+    pub fn add_value(&mut self, value: AttributeValue) {
+        self.value.push(value);
     }
 
     /// Set whether `Attribute` can have multiple value.
@@ -88,7 +89,7 @@ impl Serialize for Attribute {
     fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
     where S: serde::Serializer {
         let helper = Helper {
-            oid: self.registered_oid.get_c509_oid().get_oid().to_string(),
+            oid: self.registered_oid().c509_oid().oid().to_string(),
             value: self.value.clone(),
         };
         helper.serialize(serializer)
@@ -102,14 +103,14 @@ impl Encode<()> for Attribute {
         // Encode CBOR int if available
         if let Some(&oid) = self
             .registered_oid
-            .get_table()
+            .table()
             .get_map()
-            .get_by_right(&self.registered_oid.get_c509_oid().get_oid())
+            .get_by_right(self.registered_oid().c509_oid().oid())
         {
             e.i16(oid)?;
         } else {
-            // Encode unwrapped CBOR OID or CBOR PEN
-            self.registered_oid.get_c509_oid().encode(e, ctx)?;
+            // Encode unwrapped CBOR OID
+            self.registered_oid().c509_oid().encode(e, ctx)?;
         }
 
         // Check if the attribute value is empty
@@ -141,7 +142,7 @@ impl Decode<'_, ()> for Attribute {
         } else {
             // Handle unwrapped CBOR OID or CBOR PEN
             let c509_oid: C509oid = d.decode()?;
-            Attribute::new(c509_oid.get_oid())
+            Attribute::new(c509_oid.oid().clone())
         };
 
         // Handle attribute value
diff --git a/rust/c509-certificate/src/attributes/mod.rs b/rust/c509-certificate/src/attributes/mod.rs
index ead810ec22e..898c3233408 100644
--- a/rust/c509-certificate/src/attributes/mod.rs
+++ b/rust/c509-certificate/src/attributes/mod.rs
@@ -24,12 +24,6 @@ mod data;
 #[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
 pub struct Attributes(Vec<Attribute>);
 
-impl Default for Attributes {
-    fn default() -> Self {
-        Self::new()
-    }
-}
-
 impl Attributes {
     /// Create a new instance of `Attributes` as empty vector.
     #[must_use]
@@ -45,11 +39,17 @@ impl Attributes {
 
     /// Add an `Attribute` to the `Attributes`.
     /// and set `Attribute` value to support multiple value.
-    pub fn add_attr(&mut self, attribute: Attribute) {
+    pub fn add_attribute(&mut self, attribute: Attribute) {
         self.0.push(attribute.set_multi_value());
     }
 }
 
+impl Default for Attributes {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
 impl Encode<()> for Attributes {
     fn encode<W: Write>(
         &self, e: &mut Encoder<W>, ctx: &mut (),
@@ -82,7 +82,7 @@ impl Decode<'_, ()> for Attributes {
         // The attribute type is included in an array, so divide by 2
         for _ in 0..len / 2 {
             let attribute = Attribute::decode(d, &mut ())?;
-            attributes.add_attr(attribute);
+            attributes.add_attribute(attribute);
         }
 
         Ok(attributes)
@@ -106,7 +106,7 @@ mod test_attributes {
         attr.add_value(AttributeValue::Text("example@example.com".to_string()));
         attr.add_value(AttributeValue::Text("example@example.com".to_string()));
         let mut attributes = Attributes::new();
-        attributes.add_attr(attr);
+        attributes.add_attribute(attr);
         attributes
             .encode(&mut encoder, &mut ())
             .expect("Failed to encode Attributes");
diff --git a/rust/c509-certificate/src/big_uint.rs b/rust/c509-certificate/src/big_uint.rs
index ca87c056173..722965ae08c 100644
--- a/rust/c509-certificate/src/big_uint.rs
+++ b/rust/c509-certificate/src/big_uint.rs
@@ -21,6 +21,18 @@ impl UnwrappedBigUint {
     }
 }
 
+impl From<u64> for UnwrappedBigUint {
+    fn from(value: u64) -> Self {
+        UnwrappedBigUint::new(value)
+    }
+}
+
+impl From<UnwrappedBigUint> for u64 {
+    fn from(unwrapped_big_uint: UnwrappedBigUint) -> Self {
+        unwrapped_big_uint.0
+    }
+}
+
 impl Encode<()> for UnwrappedBigUint {
     fn encode<W: Write>(
         &self, e: &mut Encoder<W>, _ctx: &mut (),
diff --git a/rust/c509-certificate/src/c509.rs b/rust/c509-certificate/src/c509.rs
index 75cc23bfa9f..8c2543d907d 100644
--- a/rust/c509-certificate/src/c509.rs
+++ b/rust/c509-certificate/src/c509.rs
@@ -26,13 +26,13 @@ impl C509 {
 
     /// Get the `TBSCertificate` of the C509 Certificate.
     #[must_use]
-    pub fn get_tbs_cert(&self) -> &TbsCert {
+    pub fn tbs_cert(&self) -> &TbsCert {
         &self.tbs_cert
     }
 
     /// Get the `IssuerSignatureValue` of the C509 Certificate.
     #[must_use]
-    pub fn get_issuer_signature_value(&self) -> &Option<Vec<u8>> {
+    pub fn issuer_signature_value(&self) -> &Option<Vec<u8>> {
         &self.issuer_signature_value
     }
 }
diff --git a/rust/c509-certificate/src/extensions/alt_name.rs b/rust/c509-certificate/src/extensions/alt_name.rs
index f5448ff032d..9681fec63df 100644
--- a/rust/c509-certificate/src/extensions/alt_name.rs
+++ b/rust/c509-certificate/src/extensions/alt_name.rs
@@ -21,9 +21,9 @@ impl AlternativeName {
         Self(value)
     }
 
-    /// Get the inner of Alternative Name.
+    /// Get the general name which can be general names or text.
     #[must_use]
-    pub fn get_inner(&self) -> &GeneralNamesOrText {
+    pub fn general_name(&self) -> &GeneralNamesOrText {
         &self.0
     }
 }
@@ -61,12 +61,12 @@ impl Encode<()> for GeneralNamesOrText {
         match self {
             GeneralNamesOrText::GeneralNames(gns) => {
                 let gn = gns
-                    .get_inner()
+                    .general_names()
                     .first()
                     .ok_or(minicbor::encode::Error::message("GeneralNames is empty"))?;
                 // Check whether there is only 1 item in the array which is a DNSName
-                if gns.get_inner().len() == 1 && gn.get_gn_type().is_dns_name() {
-                    gn.get_gn_value().encode(e, ctx)?;
+                if gns.general_names().len() == 1 && gn.gn_type().is_dns_name() {
+                    gn.gn_value().encode(e, ctx)?;
                 } else {
                     gns.encode(e, ctx)?;
                 }
@@ -89,7 +89,7 @@ impl Decode<'_, ()> for GeneralNamesOrText {
                     GeneralNameValue::Text(d.str()?.to_string()),
                 );
                 let mut gns = GeneralNames::new();
-                gns.add_gn(gn_dns);
+                gns.add_general_name(gn_dns);
                 Ok(GeneralNamesOrText::GeneralNames(gns))
             },
             minicbor::data::Type::Array => {
@@ -120,7 +120,7 @@ mod test_alt_name {
         let mut buffer = Vec::new();
         let mut encoder = Encoder::new(&mut buffer);
         let mut gns = GeneralNames::new();
-        gns.add_gn(GeneralName::new(
+        gns.add_general_name(GeneralName::new(
             GeneralNameTypeRegistry::DNSName,
             GeneralNameValue::Text("example.com".to_string()),
         ));
@@ -151,7 +151,7 @@ mod test_alt_name {
 
         // If only text, it should be GeneralNames with only 1 DNSName
         let mut gns = GeneralNames::new();
-        gns.add_gn(GeneralName::new(
+        gns.add_general_name(GeneralName::new(
             GeneralNameTypeRegistry::DNSName,
             GeneralNameValue::Text("example.com".to_string()),
         ));
diff --git a/rust/c509-certificate/src/extensions/extension/mod.rs b/rust/c509-certificate/src/extensions/extension/mod.rs
index 095ed9c56d5..3c261af0002 100644
--- a/rust/c509-certificate/src/extensions/extension/mod.rs
+++ b/rust/c509-certificate/src/extensions/extension/mod.rs
@@ -37,19 +37,19 @@ impl Extension {
 
     /// Get the value of the `Extension` in `ExtensionValue`.
     #[must_use]
-    pub fn get_value(&self) -> &ExtensionValue {
+    pub fn value(&self) -> &ExtensionValue {
         &self.value
     }
 
     /// Get the critical flag of the `Extension`.
     #[must_use]
-    pub fn get_critical(&self) -> bool {
+    pub fn critical(&self) -> bool {
         self.critical
     }
 
     /// Get the registered OID of the `Extension`.
     #[must_use]
-    pub fn get_registered_oid(&self) -> &C509oidRegistered {
+    pub(crate) fn registered_oid(&self) -> &C509oidRegistered {
         &self.registered_oid
     }
 }
@@ -80,7 +80,7 @@ impl Serialize for Extension {
     fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
     where S: serde::Serializer {
         let helper = Helper {
-            oid: self.registered_oid.get_c509_oid().get_oid().to_string(),
+            oid: self.registered_oid.c509_oid().oid().to_string(),
             value: self.value.clone(),
             critical: self.critical,
         };
@@ -92,16 +92,15 @@ impl Encode<()> for Extension {
     // Extension can be encoded as:
     // - (extensionID: int, extensionValue: any)
     // - (extensionID: ~oid, ? critical: true, extensionValue: bytes)
-    // - (extensionID: pen, ? critical: true, extensionValue: bytes)
     fn encode<W: Write>(
         &self, e: &mut Encoder<W>, ctx: &mut (),
     ) -> Result<(), minicbor::encode::Error<W::Error>> {
         // Handle CBOR int based on OID mapping
         if let Some(&mapped_oid) = self
             .registered_oid
-            .get_table()
+            .table()
             .get_map()
-            .get_by_right(&self.registered_oid.get_c509_oid().get_oid())
+            .get_by_right(self.registered_oid.c509_oid().oid())
         {
             // Determine encoded OID value based on critical flag
             let encoded_oid = if self.critical {
@@ -111,8 +110,8 @@ impl Encode<()> for Extension {
             };
             e.i16(encoded_oid)?;
         } else {
-            // Handle unwrapped CBOR OID or CBOR PEN
-            self.registered_oid.get_c509_oid().encode(e, ctx)?;
+            // Handle unwrapped CBOR OID
+            self.registered_oid.c509_oid().encode(e, ctx)?;
             if self.critical {
                 e.bool(self.critical)?;
             }
@@ -150,7 +149,7 @@ impl Decode<'_, ()> for Extension {
                 ))
             },
             _ => {
-                // Handle unwrapped CBOR OID or CBOR PEN
+                // Handle unwrapped CBOR OID
                 let c509_oid = C509oid::decode(d, ctx)?;
                 // Critical flag is optional, so if exist, this mean we have to decode it
                 let critical = if d.datatype()? == minicbor::data::Type::Bool {
@@ -163,7 +162,7 @@ impl Decode<'_, ()> for Extension {
                 let extension_value = ExtensionValue::Bytes(d.bytes()?.to_vec());
 
                 Ok(Extension::new(
-                    c509_oid.get_oid(),
+                    c509_oid.oid().clone(),
                     extension_value,
                     critical,
                 ))
diff --git a/rust/c509-certificate/src/extensions/mod.rs b/rust/c509-certificate/src/extensions/mod.rs
index 51784aaedc4..f97268496d4 100644
--- a/rust/c509-certificate/src/extensions/mod.rs
+++ b/rust/c509-certificate/src/extensions/mod.rs
@@ -32,12 +32,6 @@ static KEY_USAGE_OID: Oid<'static> = oid!(2.5.29 .15);
 #[derive(Debug, Clone, PartialEq, Deserialize, Serialize)]
 pub struct Extensions(Vec<Extension>);
 
-impl Default for Extensions {
-    fn default() -> Self {
-        Self::new()
-    }
-}
-
 impl Extensions {
     /// Create a new instance of `Extensions` as empty vector.
     #[must_use]
@@ -45,15 +39,21 @@ impl Extensions {
         Self(Vec::new())
     }
 
+    /// Get the inner vector of `Extensions`.
+    #[must_use]
+    pub fn extensions(&self) -> &[Extension] {
+        &self.0
+    }
+
     /// Add an `Extension` to the `Extensions`.
-    pub fn add_ext(&mut self, extension: Extension) {
+    pub fn add_extension(&mut self, extension: Extension) {
         self.0.push(extension);
     }
+}
 
-    /// Get the inner vector of `Extensions`.
-    #[must_use]
-    pub fn get_inner(&self) -> &Vec<Extension> {
-        &self.0
+impl Default for Extensions {
+    fn default() -> Self {
+        Self::new()
     }
 }
 
@@ -64,16 +64,10 @@ impl Encode<()> for Extensions {
         // If there is only one extension and it is KeyUsage, encode as int
         // encoding as absolute value of the second int and the sign of the first int
         if let Some(extension) = self.0.first() {
-            if self.0.len() == 1
-                && extension.get_registered_oid().get_c509_oid().get_oid() == KEY_USAGE_OID
-            {
-                match extension.get_value() {
+            if self.0.len() == 1 && extension.registered_oid().c509_oid().oid() == &KEY_USAGE_OID {
+                match extension.value() {
                     ExtensionValue::Int(value) => {
-                        let ku_value = if extension.get_critical() {
-                            -value
-                        } else {
-                            *value
-                        };
+                        let ku_value = if extension.critical() { -value } else { *value };
                         e.i64(ku_value)?;
                         return Ok(());
                     },
@@ -106,7 +100,7 @@ impl Decode<'_, ()> for Extensions {
 
             let extension_value = ExtensionValue::Int(value);
             let mut extensions = Extensions::new();
-            extensions.add_ext(Extension::new(
+            extensions.add_extension(Extension::new(
                 KEY_USAGE_OID.clone(),
                 extension_value,
                 critical,
@@ -120,7 +114,7 @@ impl Decode<'_, ()> for Extensions {
         let mut extensions = Extensions::new();
         for _ in 0..len {
             let extension = Extension::decode(d, &mut ())?;
-            extensions.add_ext(extension);
+            extensions.add_extension(extension);
         }
 
         Ok(extensions)
@@ -139,7 +133,7 @@ mod test_extensions {
         let mut encoder = Encoder::new(&mut buffer);
 
         let mut exts = Extensions::new();
-        exts.add_ext(Extension::new(
+        exts.add_extension(Extension::new(
             oid!(2.5.29 .15),
             ExtensionValue::Int(2),
             false,
@@ -162,7 +156,7 @@ mod test_extensions {
         let mut encoder = Encoder::new(&mut buffer);
 
         let mut exts = Extensions::new();
-        exts.add_ext(Extension::new(
+        exts.add_extension(Extension::new(
             oid!(2.5.29 .15),
             ExtensionValue::Int(2),
             true,
@@ -185,13 +179,13 @@ mod test_extensions {
         let mut encoder = Encoder::new(&mut buffer);
 
         let mut exts = Extensions::new();
-        exts.add_ext(Extension::new(
+        exts.add_extension(Extension::new(
             oid!(2.5.29 .15),
             ExtensionValue::Int(2),
             false,
         ));
 
-        exts.add_ext(Extension::new(
+        exts.add_extension(Extension::new(
             oid!(2.5.29 .14),
             ExtensionValue::Bytes([1, 2, 3, 4].to_vec()),
             false,
diff --git a/rust/c509-certificate/src/general_names/general_name.rs b/rust/c509-certificate/src/general_names/general_name.rs
index e7d400b9ac9..6a15e2ebd70 100644
--- a/rust/c509-certificate/src/general_names/general_name.rs
+++ b/rust/c509-certificate/src/general_names/general_name.rs
@@ -37,13 +37,13 @@ impl GeneralName {
 
     /// Get the `GeneralName` type.
     #[must_use]
-    pub fn get_gn_type(&self) -> &GeneralNameTypeRegistry {
+    pub fn gn_type(&self) -> &GeneralNameTypeRegistry {
         &self.gn_type
     }
 
     /// Get the value of the `GeneralName` in `GeneralNameValue`.
     #[must_use]
-    pub fn get_gn_value(&self) -> &GeneralNameValue {
+    pub fn gn_value(&self) -> &GeneralNameValue {
         &self.value
     }
 }
diff --git a/rust/c509-certificate/src/general_names/mod.rs b/rust/c509-certificate/src/general_names/mod.rs
index 3e0867c33d2..d46413ea52e 100644
--- a/rust/c509-certificate/src/general_names/mod.rs
+++ b/rust/c509-certificate/src/general_names/mod.rs
@@ -18,12 +18,6 @@ use serde::{Deserialize, Serialize};
 #[derive(Debug, Clone, PartialEq, Deserialize, Serialize)]
 pub struct GeneralNames(Vec<GeneralName>);
 
-impl Default for GeneralNames {
-    fn default() -> Self {
-        Self::new()
-    }
-}
-
 impl GeneralNames {
     /// Create a new instance of `GeneralNames` as empty vector.
     #[must_use]
@@ -31,15 +25,21 @@ impl GeneralNames {
         Self(Vec::new())
     }
 
+    /// Get the inner of `GeneralName`.
+    #[must_use]
+    pub fn general_names(&self) -> &[GeneralName] {
+        &self.0
+    }
+
     /// Add a new `GeneralName` to the `GeneralNames`.
-    pub fn add_gn(&mut self, gn: GeneralName) {
+    pub fn add_general_name(&mut self, gn: GeneralName) {
         self.0.push(gn);
     }
+}
 
-    /// Get the inner of `GeneralName`.
-    #[must_use]
-    pub fn get_inner(&self) -> &Vec<GeneralName> {
-        &self.0
+impl Default for GeneralNames {
+    fn default() -> Self {
+        Self::new()
     }
 }
 
@@ -68,7 +68,7 @@ impl Decode<'_, ()> for GeneralNames {
         ))?;
         let mut gn = GeneralNames::new();
         for _ in 0..len / 2 {
-            gn.add_gn(GeneralName::decode(d, ctx)?);
+            gn.add_general_name(GeneralName::decode(d, ctx)?);
         }
         Ok(gn)
     }
@@ -94,22 +94,22 @@ mod test_general_names {
         let mut encoder = Encoder::new(&mut buffer);
 
         let mut gns = GeneralNames::new();
-        gns.add_gn(GeneralName::new(
+        gns.add_general_name(GeneralName::new(
             GeneralNameTypeRegistry::DNSName,
             GeneralNameValue::Text("example.com".to_string()),
         ));
-        gns.add_gn(GeneralName::new(
+        gns.add_general_name(GeneralName::new(
             GeneralNameTypeRegistry::OtherNameHardwareModuleName,
             GeneralNameValue::OtherNameHWModuleName(OtherNameHardwareModuleName::new(
                 oid!(2.16.840 .1 .101 .3 .4 .2 .1),
                 vec![0x01, 0x02, 0x03, 0x04],
             )),
         ));
-        gns.add_gn(GeneralName::new(
+        gns.add_general_name(GeneralName::new(
             GeneralNameTypeRegistry::IPAddress,
             GeneralNameValue::Bytes(Ipv4Addr::new(192, 168, 1, 1).octets().to_vec()),
         ));
-        gns.add_gn(GeneralName::new(
+        gns.add_general_name(GeneralName::new(
             GeneralNameTypeRegistry::RegisteredID,
             GeneralNameValue::Oid(C509oid::new(oid!(2.16.840 .1 .101 .3 .4 .2 .1))),
         ));
@@ -130,15 +130,15 @@ mod test_general_names {
         let mut encoder = Encoder::new(&mut buffer);
 
         let mut gns = GeneralNames::new();
-        gns.add_gn(GeneralName::new(
+        gns.add_general_name(GeneralName::new(
             GeneralNameTypeRegistry::DNSName,
             GeneralNameValue::Text("example.com".to_string()),
         ));
-        gns.add_gn(GeneralName::new(
+        gns.add_general_name(GeneralName::new(
             GeneralNameTypeRegistry::DNSName,
             GeneralNameValue::Text("example.com".to_string()),
         ));
-        gns.add_gn(GeneralName::new(
+        gns.add_general_name(GeneralName::new(
             GeneralNameTypeRegistry::DNSName,
             GeneralNameValue::Text("example.com".to_string()),
         ));
diff --git a/rust/c509-certificate/src/general_names/other_name_hw_module.rs b/rust/c509-certificate/src/general_names/other_name_hw_module.rs
index b57697ce79a..9e6ba200005 100644
--- a/rust/c509-certificate/src/general_names/other_name_hw_module.rs
+++ b/rust/c509-certificate/src/general_names/other_name_hw_module.rs
@@ -29,6 +29,18 @@ impl OtherNameHardwareModuleName {
             hw_serial_num,
         }
     }
+
+    /// Get the c509 OID hardware type.
+    #[must_use]
+    pub fn hw_type(&self) -> &C509oid {
+        &self.hw_type
+    }
+
+    /// Get the hardware serial number.
+    #[must_use]
+    pub fn hw_serial_num(&self) -> &[u8] {
+        &self.hw_serial_num
+    }
 }
 
 impl Encode<()> for OtherNameHardwareModuleName {
@@ -48,7 +60,7 @@ impl<'a> Decode<'a, ()> for OtherNameHardwareModuleName {
         let hw_type = C509oid::decode(d, ctx)?;
         let hw_serial_num = d.bytes()?.to_vec();
         Ok(OtherNameHardwareModuleName::new(
-            hw_type.get_oid(),
+            hw_type.oid().clone(),
             hw_serial_num,
         ))
     }
diff --git a/rust/c509-certificate/src/issuer_sig_algo/mod.rs b/rust/c509-certificate/src/issuer_sig_algo/mod.rs
index ff63acae59a..db15c1f6884 100644
--- a/rust/c509-certificate/src/issuer_sig_algo/mod.rs
+++ b/rust/c509-certificate/src/issuer_sig_algo/mod.rs
@@ -37,7 +37,20 @@ impl IssuerSignatureAlgorithm {
             algo_identifier: AlgorithmIdentifier::new(oid, param),
         }
     }
+
+    /// Get the algorithm identifier.
+    #[must_use]
+    pub fn algo_identifier(&self) -> &AlgorithmIdentifier {
+        &self.algo_identifier
+    }
+
+    /// Get the registered OID.
+    #[allow(dead_code)]
+    pub(crate) fn registered_oid(&self) -> &C509oidRegistered {
+        &self.registered_oid
+    }
 }
+
 /// Helper struct for deserialize and serialize `IssuerSignatureAlgorithm`.
 #[derive(Debug, Deserialize, Serialize)]
 struct Helper {
@@ -62,8 +75,8 @@ impl Serialize for IssuerSignatureAlgorithm {
     fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
     where S: serde::Serializer {
         let helper = Helper {
-            oid: self.registered_oid.get_c509_oid().get_oid().to_string(),
-            param: self.algo_identifier.get_param().clone(),
+            oid: self.registered_oid.c509_oid().oid().to_string(),
+            param: self.algo_identifier.param().clone(),
         };
         helper.serialize(serializer)
     }
@@ -75,9 +88,9 @@ impl Encode<()> for IssuerSignatureAlgorithm {
     ) -> Result<(), minicbor::encode::Error<W::Error>> {
         if let Some(&i) = self
             .registered_oid
-            .get_table()
+            .table()
             .get_map()
-            .get_by_right(&self.registered_oid.get_c509_oid().get_oid())
+            .get_by_right(self.registered_oid.c509_oid().oid())
         {
             e.i16(i)?;
         } else {
@@ -99,8 +112,8 @@ impl Decode<'_, ()> for IssuerSignatureAlgorithm {
             _ => {
                 let algo_identifier = AlgorithmIdentifier::decode(d, ctx)?;
                 Ok(IssuerSignatureAlgorithm::new(
-                    algo_identifier.get_oid(),
-                    algo_identifier.get_param().clone(),
+                    algo_identifier.oid().clone(),
+                    algo_identifier.param().clone(),
                 ))
             },
         }
diff --git a/rust/c509-certificate/src/lib.rs b/rust/c509-certificate/src/lib.rs
index a2ca40d225a..808de48c1dd 100644
--- a/rust/c509-certificate/src/lib.rs
+++ b/rust/c509-certificate/src/lib.rs
@@ -104,8 +104,8 @@ pub fn verify(c509: &[u8], public_key: &PublicKey) -> anyhow::Result<()> {
     let c509 = C509::decode(&mut d, &mut ())?;
     let mut encoded_tbs = Vec::new();
     let mut encoder = minicbor::Encoder::new(&mut encoded_tbs);
-    c509.get_tbs_cert().encode(&mut encoder, &mut ())?;
-    let issuer_sig = c509.get_issuer_signature_value().clone().ok_or(anyhow!(
+    c509.tbs_cert().encode(&mut encoder, &mut ())?;
+    let issuer_sig = c509.issuer_signature_value().clone().ok_or(anyhow!(
         "Signature verification failed, No issuer signature"
     ))?;
     public_key.verify(&encoded_tbs, &issuer_sig)
diff --git a/rust/c509-certificate/src/name/mod.rs b/rust/c509-certificate/src/name/mod.rs
index 6d11d114771..75c04bc0692 100644
--- a/rust/c509-certificate/src/name/mod.rs
+++ b/rust/c509-certificate/src/name/mod.rs
@@ -48,7 +48,7 @@ impl Name {
 
     /// Get the value of the `Name`.
     #[must_use]
-    pub fn get_value(&self) -> &NameValue {
+    pub fn value(&self) -> &NameValue {
         &self.0
     }
 }
@@ -97,12 +97,12 @@ impl Encode<()> for NameValue {
                         ))?;
                 //  If Name contains a single Attribute of type CommonName
                 if attrs.attributes().len() == 1
-                    && attr_first.get_registered_oid().get_c509_oid().get_oid() == COMMON_NAME_OID
+                    && attr_first.registered_oid().c509_oid().oid() == &COMMON_NAME_OID
                 {
                     // Get the value of the attribute
                     let cn_value =
                         attr_first
-                            .get_value()
+                            .value()
                             .first()
                             .ok_or(minicbor::encode::Error::message(
                                 "Cannot get the first Attribute value",
@@ -271,7 +271,7 @@ fn create_attributes_with_cn(text: String) -> NameValue {
     let mut attr = Attribute::new(COMMON_NAME_OID);
     attr.add_value(AttributeValue::Text(text));
     let mut attrs = Attributes::new();
-    attrs.add_attr(attr);
+    attrs.add_attribute(attr);
     NameValue::Attributes(attrs)
 }
 
@@ -288,7 +288,7 @@ pub(crate) mod test_name {
         let mut attr = Attribute::new(oid!(2.5.4 .3));
         attr.add_value(AttributeValue::Text("RFC test CA".to_string()));
         let mut attrs = Attributes::new();
-        attrs.add_attr(attr);
+        attrs.add_attribute(attr);
 
         (
             Name::new(NameValue::Attributes(attrs)),
@@ -321,7 +321,7 @@ pub(crate) mod test_name {
         let mut attr = Attribute::new(oid!(2.5.4 .3));
         attr.add_value(AttributeValue::Text("000123abcd".to_string()));
         let mut attrs = Attributes::new();
-        attrs.add_attr(attr);
+        attrs.add_attribute(attr);
 
         let name = Name::new(NameValue::Attributes(attrs));
         name.encode(&mut encoder, &mut ())
@@ -345,7 +345,7 @@ pub(crate) mod test_name {
         let mut attr = Attribute::new(oid!(2.5.4 .3));
         attr.add_value(AttributeValue::Text("000123ABCD".to_string()));
         let mut attrs = Attributes::new();
-        attrs.add_attr(attr);
+        attrs.add_attribute(attr);
 
         let name = Name::new(NameValue::Attributes(attrs));
         name.encode(&mut encoder, &mut ())
@@ -366,7 +366,7 @@ pub(crate) mod test_name {
         let mut attr = Attribute::new(oid!(2.5.4 .3));
         attr.add_value(AttributeValue::Text("01-23-45-FF-FE-67-89-AB".to_string()));
         let mut attrs = Attributes::new();
-        attrs.add_attr(attr);
+        attrs.add_attribute(attr);
 
         (
             Name::new(NameValue::Attributes(attrs)),
@@ -400,7 +400,7 @@ pub(crate) mod test_name {
         let mut attr = Attribute::new(oid!(2.5.4 .3));
         attr.add_value(AttributeValue::Text("01-23-45-ff-fe-67-89-AB".to_string()));
         let mut attrs = Attributes::new();
-        attrs.add_attr(attr);
+        attrs.add_attribute(attr);
         let name = Name::new(NameValue::Attributes(attrs));
 
         name.encode(&mut encoder, &mut ())
@@ -426,7 +426,7 @@ pub(crate) mod test_name {
         let mut attr = Attribute::new(oid!(2.5.4 .3));
         attr.add_value(AttributeValue::Text("01-23-45-67-89-AB-00-01".to_string()));
         let mut attrs = Attributes::new();
-        attrs.add_attr(attr);
+        attrs.add_attribute(attr);
 
         let name = Name::new(NameValue::Attributes(attrs));
 
@@ -448,7 +448,7 @@ pub(crate) mod test_name {
         let mut attr = Attribute::new(oid!(2.5.4 .3));
         attr.add_value(AttributeValue::Text("01-23-45-67-89-ab-00-01".to_string()));
         let mut attrs = Attributes::new();
-        attrs.add_attr(attr);
+        attrs.add_attribute(attr);
 
         let name = Name::new(NameValue::Attributes(attrs));
 
@@ -484,11 +484,11 @@ pub(crate) mod test_name {
         attr5.add_value(AttributeValue::Text("802.1AR CA".to_string()));
 
         let mut attrs = Attributes::new();
-        attrs.add_attr(attr1);
-        attrs.add_attr(attr2);
-        attrs.add_attr(attr3);
-        attrs.add_attr(attr4);
-        attrs.add_attr(attr5);
+        attrs.add_attribute(attr1);
+        attrs.add_attribute(attr2);
+        attrs.add_attribute(attr3);
+        attrs.add_attribute(attr4);
+        attrs.add_attribute(attr5);
 
         (
             Name::new(NameValue::Attributes(attrs)),
diff --git a/rust/c509-certificate/src/oid.rs b/rust/c509-certificate/src/oid.rs
index 2db0b90a3c7..6148dcfb43c 100644
--- a/rust/c509-certificate/src/oid.rs
+++ b/rust/c509-certificate/src/oid.rs
@@ -17,7 +17,7 @@ use crate::tables::IntegerToOidTable;
 #[derive(Debug, Clone, PartialEq)]
 pub struct C509oidRegistered {
     /// The `C509oid`.
-    oid: C509oid,
+    c509_oid: C509oid,
     /// The registration table.
     registration_table: &'static IntegerToOidTable,
 }
@@ -26,19 +26,19 @@ impl C509oidRegistered {
     /// Create a new instance of `C509oidRegistered`.
     pub(crate) fn new(oid: Oid<'static>, table: &'static IntegerToOidTable) -> Self {
         Self {
-            oid: C509oid::new(oid),
+            c509_oid: C509oid::new(oid),
             registration_table: table,
         }
     }
 
     /// Get the `C509oid`.
     #[must_use]
-    pub fn get_c509_oid(&self) -> C509oid {
-        self.oid.clone()
+    pub fn c509_oid(&self) -> &C509oid {
+        &self.c509_oid
     }
 
     /// Get the registration table.
-    pub(crate) fn get_table(&self) -> &'static IntegerToOidTable {
+    pub(crate) fn table(&self) -> &'static IntegerToOidTable {
         self.registration_table
     }
 }
@@ -56,6 +56,20 @@ struct Helper {
     oid: String,
 }
 
+impl C509oid {
+    /// Create an new instance of `C509oid`.
+    #[must_use]
+    pub fn new(oid: Oid<'static>) -> Self {
+        Self(oid)
+    }
+
+    /// Get the underlying OID of the `C509oid`
+    #[must_use]
+    pub fn oid(&self) -> &Oid<'static> {
+        &self.0
+    }
+}
+
 impl<'de> Deserialize<'de> for C509oid {
     fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
     where D: Deserializer<'de> {
@@ -76,21 +90,6 @@ impl Serialize for C509oid {
     }
 }
 
-impl C509oid {
-    /// Create an new instance of `C509oid`.
-    /// Default value of PEN flag is false
-    #[must_use]
-    pub fn new(oid: Oid<'static>) -> Self {
-        Self(oid)
-    }
-
-    /// Get the underlying OID of the `C509oid`
-    #[must_use]
-    pub fn get_oid(self) -> Oid<'static> {
-        self.0
-    }
-}
-
 impl Encode<()> for C509oid {
     /// Encode an OID
     /// Encode as an unwrapped OID (~oid) - as bytes string without tag.
diff --git a/rust/c509-certificate/src/subject_pub_key_algo/mod.rs b/rust/c509-certificate/src/subject_pub_key_algo/mod.rs
index 014ad6e6cc7..bd59a9b6112 100644
--- a/rust/c509-certificate/src/subject_pub_key_algo/mod.rs
+++ b/rust/c509-certificate/src/subject_pub_key_algo/mod.rs
@@ -39,6 +39,18 @@ impl SubjectPubKeyAlgorithm {
             algo_identifier: AlgorithmIdentifier::new(oid, param),
         }
     }
+
+    /// Get the algorithm identifier.
+    #[must_use]
+    pub fn algo_identifier(&self) -> &AlgorithmIdentifier {
+        &self.algo_identifier
+    }
+
+    /// Get the registered OID.
+    #[allow(dead_code)]
+    pub(crate) fn registered_oid(&self) -> &C509oidRegistered {
+        &self.registered_oid
+    }
 }
 
 /// Helper struct for deserialize and serialize `SubjectPubKeyAlgorithm`.
@@ -65,8 +77,8 @@ impl Serialize for SubjectPubKeyAlgorithm {
     fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
     where S: serde::Serializer {
         let helper = Helper {
-            oid: self.registered_oid.get_c509_oid().get_oid().to_string(),
-            param: self.algo_identifier.get_param().clone(),
+            oid: self.registered_oid.c509_oid().oid().to_string(),
+            param: self.algo_identifier.param().clone(),
         };
         helper.serialize(serializer)
     }
@@ -78,9 +90,9 @@ impl Encode<()> for SubjectPubKeyAlgorithm {
     ) -> Result<(), minicbor::encode::Error<W::Error>> {
         if let Some(&i) = self
             .registered_oid
-            .get_table()
+            .table()
             .get_map()
-            .get_by_right(&self.registered_oid.get_c509_oid().get_oid())
+            .get_by_right(self.registered_oid.c509_oid().oid())
         {
             e.i16(i)?;
         } else {
@@ -100,8 +112,8 @@ impl Decode<'_, ()> for SubjectPubKeyAlgorithm {
         } else {
             let algo_identifier = AlgorithmIdentifier::decode(d, ctx)?;
             Ok(SubjectPubKeyAlgorithm::new(
-                algo_identifier.get_oid(),
-                algo_identifier.get_param().clone(),
+                algo_identifier.oid().clone(),
+                algo_identifier.param().clone(),
             ))
         }
     }
diff --git a/rust/c509-certificate/src/tbs_cert.rs b/rust/c509-certificate/src/tbs_cert.rs
index f347159040e..e0e10551ebf 100644
--- a/rust/c509-certificate/src/tbs_cert.rs
+++ b/rust/c509-certificate/src/tbs_cert.rs
@@ -62,13 +62,13 @@ impl TbsCert {
 
     /// Get the certificate type.
     #[must_use]
-    pub fn get_c509_certificate_type(&self) -> u8 {
+    pub fn c509_certificate_type(&self) -> u8 {
         self.c509_certificate_type
     }
 
     /// Get the certificate serial number.
     #[must_use]
-    pub fn get_certificate_serial_number(&self) -> &UnwrappedBigUint {
+    pub fn certificate_serial_number(&self) -> &UnwrappedBigUint {
         &self.certificate_serial_number
     }
 
@@ -80,45 +80,51 @@ impl TbsCert {
 
     /// Get the issuer.
     #[must_use]
-    pub fn get_issuer(&self) -> &Name {
+    pub fn issuer(&self) -> &Name {
         &self.issuer
     }
 
     /// Get the validity not before.
     #[must_use]
-    pub fn get_validity_not_before(&self) -> &Time {
+    pub fn validity_not_before(&self) -> &Time {
         &self.validity_not_before
     }
 
     /// Get the validity not after.
     #[must_use]
-    pub fn get_validity_not_after(&self) -> &Time {
+    pub fn validity_not_after(&self) -> &Time {
         &self.validity_not_after
     }
 
     /// Get the subject.
     #[must_use]
-    pub fn get_subject(&self) -> &Name {
+    pub fn subject(&self) -> &Name {
         &self.subject
     }
 
     /// Get the subject public key algorithm.
     #[must_use]
-    pub fn get_subject_public_key_algorithm(&self) -> &SubjectPubKeyAlgorithm {
+    pub fn subject_public_key_algorithm(&self) -> &SubjectPubKeyAlgorithm {
         &self.subject_public_key_algorithm
     }
 
     /// Get the subject public key.
     #[must_use]
-    pub fn get_subject_public_key(&self) -> &[u8] {
+    pub fn subject_public_key(&self) -> &[u8] {
         &self.subject_public_key
     }
 
     /// Get the extensions.
     #[must_use]
-    pub fn get_extensions(&self) -> &Extensions {
+    pub fn extensions(&self) -> &Extensions {
         &self.extensions
     }
+
+    /// Get the issuer signature algorithm.
+    #[must_use]
+    pub fn issuer_signature_algorithm(&self) -> &IssuerSignatureAlgorithm {
+        &self.issuer_signature_algorithm
+    }
 }
 
 impl Encode<()> for TbsCert {
@@ -257,7 +263,7 @@ pub(crate) mod test_tbs_cert {
     pub(crate) fn tbs() -> TbsCert {
         fn extensions() -> Extensions {
             let mut exts = Extensions::new();
-            exts.add_ext(Extension::new(
+            exts.add_extension(Extension::new(
                 oid!(2.5.29 .15),
                 ExtensionValue::Int(1),
                 false,
@@ -390,24 +396,24 @@ pub(crate) mod test_tbs_cert {
             attr6.add_value(AttributeValue::Text("Wt1234".to_string()));
 
             let mut attrs = Attributes::new();
-            attrs.add_attr(attr1);
-            attrs.add_attr(attr2);
-            attrs.add_attr(attr3);
-            attrs.add_attr(attr4);
-            attrs.add_attr(attr5);
-            attrs.add_attr(attr6);
+            attrs.add_attribute(attr1);
+            attrs.add_attribute(attr2);
+            attrs.add_attribute(attr3);
+            attrs.add_attribute(attr4);
+            attrs.add_attribute(attr5);
+            attrs.add_attribute(attr6);
 
             Name::new(NameValue::Attributes(attrs))
         }
 
         fn extensions() -> Extensions {
             let mut exts = Extensions::new();
-            exts.add_ext(Extension::new(
+            exts.add_extension(Extension::new(
                 oid!(2.5.29 .19),
                 ExtensionValue::Int(-2),
                 false,
             ));
-            exts.add_ext(Extension::new(
+            exts.add_extension(Extension::new(
                 oid!(2.5.29 .14),
                 ExtensionValue::Bytes(
                     [
@@ -418,7 +424,7 @@ pub(crate) mod test_tbs_cert {
                 ),
                 false,
             ));
-            exts.add_ext(Extension::new(
+            exts.add_extension(Extension::new(
                 oid!(2.5.29 .15),
                 ExtensionValue::Int(5),
                 true,
@@ -427,12 +433,12 @@ pub(crate) mod test_tbs_cert {
             let hw = OtherNameHardwareModuleName::new(oid!(1.3.6 .1 .4 .1 .6175 .10 .1), vec![
                 0x01, 0x02, 0x03, 0x04,
             ]);
-            gns.add_gn(GeneralName::new(
+            gns.add_general_name(GeneralName::new(
                 GeneralNameTypeRegistry::OtherNameHardwareModuleName,
                 GeneralNameValue::OtherNameHWModuleName(hw),
             ));
 
-            exts.add_ext(Extension::new(
+            exts.add_extension(Extension::new(
                 oid!(2.5.29 .17),
                 ExtensionValue::AlternativeName(AlternativeName::new(
                     GeneralNamesOrText::GeneralNames(gns),
diff --git a/rust/c509-certificate/src/time.rs b/rust/c509-certificate/src/time.rs
index 1244473ffa2..6fb9b0896ee 100644
--- a/rust/c509-certificate/src/time.rs
+++ b/rust/c509-certificate/src/time.rs
@@ -19,13 +19,25 @@ impl Time {
         Self(time)
     }
 
-    /// Get the time in u64.
+    /// Get the u64 of `Time`.
     #[must_use]
-    pub fn to_u64(&self) -> u64 {
+    pub fn time(&self) -> u64 {
         self.0
     }
 }
 
+impl From<u64> for Time {
+    fn from(value: u64) -> Self {
+        Time::new(value)
+    }
+}
+
+impl From<Time> for u64 {
+    fn from(time: Time) -> Self {
+        time.0
+    }
+}
+
 impl Encode<()> for Time {
     fn encode<W: Write>(
         &self, e: &mut Encoder<W>, _ctx: &mut (),

From ddf93d232cc69726cbbe2d89e7825a77bdc9c42b Mon Sep 17 00:00:00 2001
From: bkioshn <35752733+bkioshn@users.noreply.github.com>
Date: Thu, 19 Sep 2024 20:15:46 +0700
Subject: [PATCH 10/19] fix(rust/c509-certificate): CBOR decode encode helper
 (#27)

* fix: naming + add neccesary function

* fix(rust/c509-certificate): add encode + decode helper functions

* fix(rust/c509-certificate): cleanup

* fix(rust/c509-certificate): cleanup

* fix(rust/c509-certificate): cleanup

* fix(rust/c509-certificate): remove unnecessary allow(dead_code)

* fix(rust/c509-certificate): generic encode and decode functions
---
 .../src/algorithm_identifier.rs               | 23 ++++---
 .../src/attributes/attribute.rs               | 49 ++++++++++-----
 rust/c509-certificate/src/attributes/mod.rs   | 12 ++--
 rust/c509-certificate/src/big_uint.rs         |  6 +-
 rust/c509-certificate/src/c509.rs             | 16 +++--
 .../src/extensions/alt_name.rs                | 26 +++++---
 .../src/extensions/extension/mod.rs           | 37 ++++++-----
 rust/c509-certificate/src/extensions/mod.rs   | 24 ++++---
 .../src/general_names/general_name.rs         | 27 +++++---
 .../c509-certificate/src/general_names/mod.rs | 10 +--
 .../src/general_names/other_name_hw_module.rs | 20 ++++--
 rust/c509-certificate/src/helper/decode.rs    | 62 +++++++++++++++++++
 rust/c509-certificate/src/helper/encode.rs    | 54 ++++++++++++++++
 rust/c509-certificate/src/helper/mod.rs       |  3 +
 .../src/issuer_sig_algo/mod.rs                | 15 +++--
 rust/c509-certificate/src/lib.rs              |  1 +
 rust/c509-certificate/src/name/mod.rs         | 55 ++++++++++------
 rust/c509-certificate/src/oid.rs              | 12 ++--
 .../src/subject_pub_key_algo/mod.rs           | 15 +++--
 rust/c509-certificate/src/tbs_cert.rs         | 22 ++++---
 rust/c509-certificate/src/time.rs             | 17 +++--
 rust/c509-certificate/src/wasm_binding.rs     |  7 ++-
 22 files changed, 374 insertions(+), 139 deletions(-)
 create mode 100644 rust/c509-certificate/src/helper/decode.rs
 create mode 100644 rust/c509-certificate/src/helper/encode.rs
 create mode 100644 rust/c509-certificate/src/helper/mod.rs

diff --git a/rust/c509-certificate/src/algorithm_identifier.rs b/rust/c509-certificate/src/algorithm_identifier.rs
index d6a3e1e1ccb..1d2e8c26644 100644
--- a/rust/c509-certificate/src/algorithm_identifier.rs
+++ b/rust/c509-certificate/src/algorithm_identifier.rs
@@ -17,8 +17,13 @@ use asn1_rs::Oid;
 use minicbor::{encode::Write, Decode, Decoder, Encode, Encoder};
 use serde::{Deserialize, Serialize};
 
-use crate::oid::C509oid;
-
+use crate::{
+    helper::{
+        decode::{decode_array_len, decode_bytes, decode_datatype},
+        encode::{encode_array_len, encode_bytes},
+    },
+    oid::C509oid,
+};
 /// A struct represents the `AlgorithmIdentifier` type.
 #[derive(Debug, Clone, PartialEq, Deserialize, Serialize)]
 pub struct AlgorithmIdentifier {
@@ -58,9 +63,9 @@ impl Encode<()> for AlgorithmIdentifier {
         match &self.param {
             // [ algorithm: ~oid, parameters: bytes ]
             Some(p) => {
-                e.array(2)?;
+                encode_array_len(e, "Algorithm Identifier", 2)?;
                 self.c509_oid.encode(e, ctx)?;
-                e.bytes(p.as_bytes())?;
+                encode_bytes(e, "Algorithm Identifier", p.as_bytes())?;
             },
             // ~oid
             None => {
@@ -74,16 +79,14 @@ impl Encode<()> for AlgorithmIdentifier {
 impl Decode<'_, ()> for AlgorithmIdentifier {
     fn decode(d: &mut Decoder<'_>, ctx: &mut ()) -> Result<Self, minicbor::decode::Error> {
         // [ algorithm: ~oid, parameters: bytes ]
-        if d.datatype()? == minicbor::data::Type::Array {
-            let len = d.array()?.ok_or(minicbor::decode::Error::message(
-                "Failed to get array length",
-            ))?;
+        if decode_datatype(d, "Algorithm Identifier")? == minicbor::data::Type::Array {
+            let len = decode_array_len(d, "Algorithm Identifier")?;
             if len != 2 {
                 return Err(minicbor::decode::Error::message("Array length must be 2"));
             }
             let c509_oid = C509oid::decode(d, ctx)?;
-            let param =
-                String::from_utf8(d.bytes()?.to_vec()).map_err(minicbor::decode::Error::message)?;
+            let param = String::from_utf8(decode_bytes(d, "Algorithm Identifier")?)
+                .map_err(minicbor::decode::Error::message)?;
             Ok(AlgorithmIdentifier::new(
                 c509_oid.oid().clone(),
                 Some(param),
diff --git a/rust/c509-certificate/src/attributes/attribute.rs b/rust/c509-certificate/src/attributes/attribute.rs
index b1da9793cc6..9c85ba4e2b8 100644
--- a/rust/c509-certificate/src/attributes/attribute.rs
+++ b/rust/c509-certificate/src/attributes/attribute.rs
@@ -15,8 +15,13 @@ use minicbor::{encode::Write, Decode, Decoder, Encode, Encoder};
 use serde::{Deserialize, Deserializer, Serialize};
 
 use super::data::{get_oid_from_int, ATTRIBUTES_LOOKUP};
-use crate::oid::{C509oid, C509oidRegistered};
-
+use crate::{
+    helper::{
+        decode::{decode_array_len, decode_datatype, decode_helper},
+        encode::{encode_array_len, encode_helper},
+    },
+    oid::{C509oid, C509oidRegistered},
+};
 /// A struct of C509 `Attribute`
 #[derive(Debug, Clone, PartialEq)]
 pub struct Attribute {
@@ -107,7 +112,7 @@ impl Encode<()> for Attribute {
             .get_map()
             .get_by_right(self.registered_oid().c509_oid().oid())
         {
-            e.i16(oid)?;
+            encode_helper(e, "Attribute as OID int", ctx, &oid)?;
         } else {
             // Encode unwrapped CBOR OID
             self.registered_oid().c509_oid().encode(e, ctx)?;
@@ -120,7 +125,7 @@ impl Encode<()> for Attribute {
 
         // If multi-value attributes, encode it as array
         if self.multi_value {
-            e.array(self.value.len() as u64)?;
+            encode_array_len(e, "Attribute multiple value", self.value.len() as u64)?;
         }
 
         // Encode each value in the attribute
@@ -135,8 +140,8 @@ impl Encode<()> for Attribute {
 impl Decode<'_, ()> for Attribute {
     fn decode(d: &mut Decoder<'_>, ctx: &mut ()) -> Result<Self, minicbor::decode::Error> {
         // Handle CBOR int
-        let mut attr = if d.datatype()? == minicbor::data::Type::U8 {
-            let i = d.i16()?;
+        let mut attr = if decode_datatype(d, "Attribute as OID int")? == minicbor::data::Type::U8 {
+            let i = decode_helper(d, "Attribute as OID int", ctx)?;
             let oid = get_oid_from_int(i).map_err(minicbor::decode::Error::message)?;
             Attribute::new(oid.clone())
         } else {
@@ -146,11 +151,9 @@ impl Decode<'_, ()> for Attribute {
         };
 
         // Handle attribute value
-        if d.datatype()? == minicbor::data::Type::Array {
+        if decode_datatype(d, "Attribute")? == minicbor::data::Type::Array {
             // When multi-value attribute
-            let len = d.array()?.ok_or_else(|| {
-                minicbor::decode::Error::message("Failed to get array length for attribute value")
-            })?;
+            let len = decode_array_len(d, "Attribute multiple value")?;
 
             if len == 0 {
                 return Err(minicbor::decode::Error::message("Attribute value is empty"));
@@ -183,21 +186,33 @@ pub enum AttributeValue {
 
 impl Encode<()> for AttributeValue {
     fn encode<W: Write>(
-        &self, e: &mut Encoder<W>, _ctx: &mut (),
+        &self, e: &mut Encoder<W>, ctx: &mut (),
     ) -> Result<(), minicbor::encode::Error<W::Error>> {
         match self {
-            AttributeValue::Text(text) => e.str(text)?,
-            AttributeValue::Bytes(bytes) => e.bytes(bytes)?,
+            AttributeValue::Text(text) => encode_helper(e, "Attribute value", ctx, text)?,
+            AttributeValue::Bytes(bytes) => encode_helper(e, "Attribute value", ctx, bytes)?,
         };
         Ok(())
     }
 }
 
 impl Decode<'_, ()> for AttributeValue {
-    fn decode(d: &mut Decoder<'_>, _ctx: &mut ()) -> Result<Self, minicbor::decode::Error> {
-        match d.datatype()? {
-            minicbor::data::Type::String => Ok(AttributeValue::Text(d.str()?.to_string())),
-            minicbor::data::Type::Bytes => Ok(AttributeValue::Bytes(d.bytes()?.to_vec())),
+    fn decode(d: &mut Decoder<'_>, ctx: &mut ()) -> Result<Self, minicbor::decode::Error> {
+        match decode_datatype(d, "Attribute value")? {
+            minicbor::data::Type::String => {
+                Ok(AttributeValue::Text(decode_helper(
+                    d,
+                    "Attribute value",
+                    ctx,
+                )?))
+            },
+            minicbor::data::Type::Bytes => {
+                Ok(AttributeValue::Bytes(decode_helper(
+                    d,
+                    "Attribute value",
+                    ctx,
+                )?))
+            },
             _ => {
                 Err(minicbor::decode::Error::message(
                     "Invalid AttributeValue, value should be either String or Bytes",
diff --git a/rust/c509-certificate/src/attributes/mod.rs b/rust/c509-certificate/src/attributes/mod.rs
index 898c3233408..6b830f28dd5 100644
--- a/rust/c509-certificate/src/attributes/mod.rs
+++ b/rust/c509-certificate/src/attributes/mod.rs
@@ -17,6 +17,8 @@ use attribute::Attribute;
 use minicbor::{encode::Write, Decode, Decoder, Encode, Encoder};
 use serde::{Deserialize, Serialize};
 
+use crate::helper::{decode::decode_array_len, encode::encode_array_len};
+
 pub mod attribute;
 mod data;
 
@@ -60,7 +62,7 @@ impl Encode<()> for Attributes {
             ));
         }
         // The attribute type should be included in array too
-        e.array(self.0.len() as u64 * 2)?;
+        encode_array_len(e, "Attributes", self.0.len() as u64 * 2)?;
         for attribute in &self.0 {
             attribute.encode(e, ctx)?;
         }
@@ -69,10 +71,8 @@ impl Encode<()> for Attributes {
 }
 
 impl Decode<'_, ()> for Attributes {
-    fn decode(d: &mut Decoder<'_>, _ctx: &mut ()) -> Result<Self, minicbor::decode::Error> {
-        let len = d
-            .array()?
-            .ok_or_else(|| minicbor::decode::Error::message("Failed to get array length"))?;
+    fn decode(d: &mut Decoder<'_>, ctx: &mut ()) -> Result<Self, minicbor::decode::Error> {
+        let len = decode_array_len(d, "Attributes")?;
         if len == 0 {
             return Err(minicbor::decode::Error::message("Attributes is empty"));
         }
@@ -81,7 +81,7 @@ impl Decode<'_, ()> for Attributes {
 
         // The attribute type is included in an array, so divide by 2
         for _ in 0..len / 2 {
-            let attribute = Attribute::decode(d, &mut ())?;
+            let attribute = Attribute::decode(d, ctx)?;
             attributes.add_attribute(attribute);
         }
 
diff --git a/rust/c509-certificate/src/big_uint.rs b/rust/c509-certificate/src/big_uint.rs
index 722965ae08c..9a8cfdb644b 100644
--- a/rust/c509-certificate/src/big_uint.rs
+++ b/rust/c509-certificate/src/big_uint.rs
@@ -8,6 +8,7 @@
 use minicbor::{encode::Write, Decode, Decoder, Encode, Encoder};
 use serde::{Deserialize, Serialize};
 
+use crate::helper::{decode::decode_bytes, encode::encode_bytes};
 /// A struct representing an unwrapped CBOR unsigned bignum.
 #[allow(clippy::module_name_repetitions)]
 #[derive(Debug, Clone, PartialEq, Deserialize, Serialize)]
@@ -45,7 +46,7 @@ impl Encode<()> for UnwrappedBigUint {
             .copied()
             .collect::<Vec<u8>>();
 
-        e.bytes(&significant_bytes)?;
+        encode_bytes(e, "Unwrapped big uint", &significant_bytes)?;
         Ok(())
     }
 }
@@ -53,8 +54,7 @@ impl Encode<()> for UnwrappedBigUint {
 impl Decode<'_, ()> for UnwrappedBigUint {
     fn decode(d: &mut Decoder<'_>, _ctx: &mut ()) -> Result<Self, minicbor::decode::Error> {
         // Turn bytes into u64
-        let b = d
-            .bytes()?
+        let b = decode_bytes(d, "Unwrapped big uint")?
             .iter()
             .fold(0, |acc, &b| (acc << 8) | u64::from(b));
         Ok(UnwrappedBigUint::new(b))
diff --git a/rust/c509-certificate/src/c509.rs b/rust/c509-certificate/src/c509.rs
index 8c2543d907d..dfd6d7d019f 100644
--- a/rust/c509-certificate/src/c509.rs
+++ b/rust/c509-certificate/src/c509.rs
@@ -3,7 +3,13 @@
 use minicbor::{encode::Write, Decode, Decoder, Encode, Encoder};
 use serde::{Deserialize, Serialize};
 
-use crate::tbs_cert::TbsCert;
+use crate::{
+    helper::{
+        decode::{decode_bytes, decode_datatype},
+        encode::{encode_bytes, encode_null},
+    },
+    tbs_cert::TbsCert,
+};
 
 #[derive(Debug, Clone, PartialEq, Deserialize, Serialize)]
 /// A struct represents the `C509` Certificate.
@@ -43,8 +49,8 @@ impl Encode<()> for C509 {
     ) -> Result<(), minicbor::encode::Error<W::Error>> {
         self.tbs_cert.encode(e, ctx)?;
         match self.issuer_signature_value {
-            Some(ref value) => e.bytes(value)?,
-            None => e.null()?,
+            Some(ref value) => encode_bytes(e, "C509 Issuer Signature value", value)?,
+            None => encode_null(e, "C509 Issuer Signature value")?,
         };
         Ok(())
     }
@@ -53,8 +59,8 @@ impl Encode<()> for C509 {
 impl Decode<'_, ()> for C509 {
     fn decode(d: &mut Decoder<'_>, ctx: &mut ()) -> Result<Self, minicbor::decode::Error> {
         let tbs_cert = TbsCert::decode(d, ctx)?;
-        let issuer_signature_value = match d.datatype()? {
-            minicbor::data::Type::Bytes => Some(d.bytes()?.to_vec()),
+        let issuer_signature_value = match decode_datatype(d, "C509 Issuer Signature value")? {
+            minicbor::data::Type::Bytes => Some(decode_bytes(d, "C509 Issuer Signature value")?),
             _ => None,
         };
         Ok(Self::new(tbs_cert, issuer_signature_value))
diff --git a/rust/c509-certificate/src/extensions/alt_name.rs b/rust/c509-certificate/src/extensions/alt_name.rs
index 9681fec63df..0f9896c8588 100644
--- a/rust/c509-certificate/src/extensions/alt_name.rs
+++ b/rust/c509-certificate/src/extensions/alt_name.rs
@@ -4,9 +4,15 @@
 use minicbor::{encode::Write, Decode, Decoder, Encode, Encoder};
 use serde::{Deserialize, Serialize};
 
-use crate::general_names::{
-    general_name::{GeneralName, GeneralNameTypeRegistry, GeneralNameValue},
-    GeneralNames,
+use crate::{
+    general_names::{
+        general_name::{GeneralName, GeneralNameTypeRegistry, GeneralNameValue},
+        GeneralNames,
+    },
+    helper::{
+        decode::{decode_datatype, decode_helper},
+        encode::encode_helper,
+    },
 };
 
 /// Alternative Name extension.
@@ -45,6 +51,8 @@ impl Decode<'_, ()> for AlternativeName {
 // ------------------GeneralNamesOrText--------------------
 
 /// Enum for type that can be a `GeneralNames` or a text use in `AlternativeName`.
+/// Type `Text` is also considered as a `GeneralNames` with only 1 `DNSName` as
+/// a special case.
 #[derive(Debug, Clone, PartialEq, Deserialize, Serialize)]
 #[serde(rename_all = "snake_case")]
 pub enum GeneralNamesOrText {
@@ -63,7 +71,7 @@ impl Encode<()> for GeneralNamesOrText {
                 let gn = gns
                     .general_names()
                     .first()
-                    .ok_or(minicbor::encode::Error::message("GeneralNames is empty"))?;
+                    .ok_or(minicbor::encode::Error::message("General Names is empty"))?;
                 // Check whether there is only 1 item in the array which is a DNSName
                 if gns.general_names().len() == 1 && gn.gn_type().is_dns_name() {
                     gn.gn_value().encode(e, ctx)?;
@@ -72,7 +80,7 @@ impl Encode<()> for GeneralNamesOrText {
                 }
             },
             GeneralNamesOrText::Text(text) => {
-                e.str(text)?;
+                encode_helper(e, "Alternative Name - General Name Text", ctx, text)?;
             },
         }
         Ok(())
@@ -81,12 +89,16 @@ impl Encode<()> for GeneralNamesOrText {
 
 impl Decode<'_, ()> for GeneralNamesOrText {
     fn decode(d: &mut Decoder<'_>, ctx: &mut ()) -> Result<Self, minicbor::decode::Error> {
-        match d.datatype()? {
+        match decode_datatype(d, "Alternative Name - General Names")? {
             // If it is a string it is a GeneralNames with only 1 DNSName
             minicbor::data::Type::String => {
                 let gn_dns = GeneralName::new(
                     GeneralNameTypeRegistry::DNSName,
-                    GeneralNameValue::Text(d.str()?.to_string()),
+                    GeneralNameValue::Text(decode_helper(
+                        d,
+                        "Alternative Name - General Name Text",
+                        ctx,
+                    )?),
                 );
                 let mut gns = GeneralNames::new();
                 gns.add_general_name(gn_dns);
diff --git a/rust/c509-certificate/src/extensions/extension/mod.rs b/rust/c509-certificate/src/extensions/extension/mod.rs
index 3c261af0002..88707936049 100644
--- a/rust/c509-certificate/src/extensions/extension/mod.rs
+++ b/rust/c509-certificate/src/extensions/extension/mod.rs
@@ -10,7 +10,13 @@ use serde::{Deserialize, Deserializer, Serialize};
 use strum_macros::EnumDiscriminants;
 
 use super::alt_name::AlternativeName;
-use crate::oid::{C509oid, C509oidRegistered};
+use crate::{
+    helper::{
+        decode::{decode_bytes, decode_datatype, decode_helper},
+        encode::{encode_bytes, encode_helper},
+    },
+    oid::{C509oid, C509oidRegistered},
+};
 
 /// A struct of C509 `Extension`
 #[derive(Debug, Clone, PartialEq)]
@@ -108,12 +114,12 @@ impl Encode<()> for Extension {
             } else {
                 mapped_oid
             };
-            e.i16(encoded_oid)?;
+            encode_helper(e, "Extension as OID int", ctx, &encoded_oid)?;
         } else {
             // Handle unwrapped CBOR OID
             self.registered_oid.c509_oid().encode(e, ctx)?;
             if self.critical {
-                e.bool(self.critical)?;
+                encode_helper(e, "Extension critical", ctx, &self.critical)?;
             }
         }
         // Encode the extension value
@@ -124,7 +130,7 @@ impl Encode<()> for Extension {
 
 impl Decode<'_, ()> for Extension {
     fn decode(d: &mut Decoder<'_>, ctx: &mut ()) -> Result<Self, minicbor::decode::Error> {
-        match d.datatype()? {
+        match decode_datatype(d, "Extension")? {
             // Check whether OID is an int
             // Even the encoding is i16, the minicbor decoder doesn't know what type we encoded,
             // so need to check every possible type.
@@ -132,7 +138,7 @@ impl Decode<'_, ()> for Extension {
             | minicbor::data::Type::U16
             | minicbor::data::Type::I8
             | minicbor::data::Type::I16 => {
-                let int_value = d.i16()?;
+                let int_value: i16 = decode_helper(d, "Extension as OID int", ctx)?;
                 // OID can be negative due to critical flag, so need absolute the value
                 let abs_int_value = int_value.abs();
                 let oid =
@@ -152,14 +158,15 @@ impl Decode<'_, ()> for Extension {
                 // Handle unwrapped CBOR OID
                 let c509_oid = C509oid::decode(d, ctx)?;
                 // Critical flag is optional, so if exist, this mean we have to decode it
-                let critical = if d.datatype()? == minicbor::data::Type::Bool {
-                    d.bool()?
-                } else {
-                    false
-                };
+                let critical =
+                    if decode_datatype(d, "Extension critical")? == minicbor::data::Type::Bool {
+                        decode_helper(d, "Extension critical", ctx)?
+                    } else {
+                        false
+                    };
 
                 // Decode bytes for extension value
-                let extension_value = ExtensionValue::Bytes(d.bytes()?.to_vec());
+                let extension_value = ExtensionValue::Bytes(decode_bytes(d, "Extension")?);
 
                 Ok(Extension::new(
                     c509_oid.oid().clone(),
@@ -207,10 +214,10 @@ impl Encode<()> for ExtensionValue {
     ) -> Result<(), minicbor::encode::Error<W::Error>> {
         match self {
             ExtensionValue::Int(value) => {
-                e.i64(*value)?;
+                encode_helper(e, "Extension Value", ctx, value)?;
             },
             ExtensionValue::Bytes(value) => {
-                e.bytes(value)?;
+                encode_bytes(e, "Extension value", value)?;
             },
             ExtensionValue::AlternativeName(value) => {
                 value.encode(e, ctx)?;
@@ -231,11 +238,11 @@ where C: ExtensionValueTypeTrait + Debug
     fn decode(d: &mut Decoder<'_>, ctx: &mut C) -> Result<Self, minicbor::decode::Error> {
         match ctx.get_type() {
             ExtensionValueType::Int => {
-                let value = d.i64()?;
+                let value = decode_helper(d, "Extension value", ctx)?;
                 Ok(ExtensionValue::Int(value))
             },
             ExtensionValueType::Bytes => {
-                let value = d.bytes()?.to_vec();
+                let value = decode_bytes(d, "Extension value")?;
                 Ok(ExtensionValue::Bytes(value))
             },
             ExtensionValueType::AlternativeName => {
diff --git a/rust/c509-certificate/src/extensions/mod.rs b/rust/c509-certificate/src/extensions/mod.rs
index f97268496d4..1f5ac45801e 100644
--- a/rust/c509-certificate/src/extensions/mod.rs
+++ b/rust/c509-certificate/src/extensions/mod.rs
@@ -25,6 +25,10 @@ use extension::{Extension, ExtensionValue};
 use minicbor::{encode::Write, Decode, Decoder, Encode, Encoder};
 use serde::{Deserialize, Serialize};
 
+use crate::helper::{
+    decode::{decode_array_len, decode_datatype, decode_helper},
+    encode::{encode_array_len, encode_helper},
+};
 /// OID of `KeyUsage` extension
 static KEY_USAGE_OID: Oid<'static> = oid!(2.5.29 .15);
 
@@ -68,7 +72,7 @@ impl Encode<()> for Extensions {
                 match extension.value() {
                     ExtensionValue::Int(value) => {
                         let ku_value = if extension.critical() { -value } else { *value };
-                        e.i64(ku_value)?;
+                        encode_helper(e, "Extensions KeyUsage", ctx, &ku_value)?;
                         return Ok(());
                     },
                     _ => {
@@ -80,7 +84,7 @@ impl Encode<()> for Extensions {
             }
         }
         // Else handle the array of `Extension`
-        e.array(self.0.len() as u64)?;
+        encode_array_len(e, "Extensions", self.0.len() as u64)?;
         for extension in &self.0 {
             extension.encode(e, ctx)?;
         }
@@ -91,14 +95,16 @@ impl Encode<()> for Extensions {
 impl Decode<'_, ()> for Extensions {
     fn decode(d: &mut Decoder<'_>, _ctx: &mut ()) -> Result<Self, minicbor::decode::Error> {
         // If only KeyUsage is in the extension -> will only contain an int
-        if d.datatype()? == minicbor::data::Type::U8 || d.datatype()? == minicbor::data::Type::I8 {
+        if decode_datatype(d, "Extensions KeyUsage")? == minicbor::data::Type::U8
+            || decode_datatype(d, "Extensions KeyUsage")? == minicbor::data::Type::I8
+        {
             // Check if it's a negative number (critical extension)
-            let critical = d.datatype()? == minicbor::data::Type::I8;
+            let critical =
+                decode_datatype(d, "Extensions KeyUsage critical")? == minicbor::data::Type::I8;
             // Note that 'KeyUsage' BIT STRING is interpreted as an unsigned integer,
             // so we can absolute the value
-            let value = d.i64()?.abs();
-
-            let extension_value = ExtensionValue::Int(value);
+            let value: i64 = decode_helper(d, "Extensions KeyUsage value", &mut ())?;
+            let extension_value = ExtensionValue::Int(value.abs());
             let mut extensions = Extensions::new();
             extensions.add_extension(Extension::new(
                 KEY_USAGE_OID.clone(),
@@ -108,9 +114,7 @@ impl Decode<'_, ()> for Extensions {
             return Ok(extensions);
         }
         // Handle array of extensions
-        let len = d
-            .array()?
-            .ok_or_else(|| minicbor::decode::Error::message("Failed to get array length"))?;
+        let len = decode_array_len(d, "Extensions")?;
         let mut extensions = Extensions::new();
         for _ in 0..len {
             let extension = Extension::decode(d, &mut ())?;
diff --git a/rust/c509-certificate/src/general_names/general_name.rs b/rust/c509-certificate/src/general_names/general_name.rs
index 6a15e2ebd70..98b10bd9835 100644
--- a/rust/c509-certificate/src/general_names/general_name.rs
+++ b/rust/c509-certificate/src/general_names/general_name.rs
@@ -13,7 +13,14 @@ use super::{
     data::{get_gn_from_int, get_gn_value_type_from_int, get_int_from_gn},
     other_name_hw_module::OtherNameHardwareModuleName,
 };
-use crate::{name::Name, oid::C509oid};
+use crate::{
+    helper::{
+        decode::{decode_bytes, decode_datatype, decode_helper},
+        encode::{encode_bytes, encode_helper},
+    },
+    name::Name,
+    oid::C509oid,
+};
 
 /// A struct represents a `GeneralName`.
 /// ```cddl
@@ -54,7 +61,7 @@ impl Encode<()> for GeneralName {
     ) -> Result<(), minicbor::encode::Error<W::Error>> {
         // Encode GeneralNameType as int
         let i = get_int_from_gn(self.gn_type).map_err(minicbor::encode::Error::message)?;
-        e.i16(i)?;
+        encode_helper(e, "General Name as OID int", ctx, &i)?;
         // Encode GeneralNameValue as its type
         self.value.encode(e, ctx)?;
         Ok(())
@@ -63,8 +70,10 @@ impl Encode<()> for GeneralName {
 
 impl Decode<'_, ()> for GeneralName {
     fn decode(d: &mut Decoder<'_>, _ctx: &mut ()) -> Result<Self, minicbor::decode::Error> {
-        if minicbor::data::Type::U8 == d.datatype()? || minicbor::data::Type::I8 == d.datatype()? {
-            let i = d.i16()?;
+        if decode_datatype(d, "General Name as OID int")? == minicbor::data::Type::U8
+            || decode_datatype(d, "General Name as OID int")? == minicbor::data::Type::I8
+        {
+            let i = decode_helper(d, "General Name as OID int", &mut ())?;
             let gn = get_gn_from_int(i).map_err(minicbor::decode::Error::message)?;
             let value_type =
                 get_gn_value_type_from_int(i).map_err(minicbor::decode::Error::message)?;
@@ -75,7 +84,7 @@ impl Decode<'_, ()> for GeneralName {
         } else {
             // GeneralName is not type int
             Err(minicbor::decode::Error::message(
-                "GeneralName id type invalid, expected int",
+                "GeneralName ID type invalid, expected int",
             ))
         }
     }
@@ -149,10 +158,10 @@ impl Encode<()> for GeneralNameValue {
     ) -> Result<(), minicbor::encode::Error<W::Error>> {
         match self {
             GeneralNameValue::Text(value) => {
-                e.str(value)?;
+                encode_helper(e, "General Name value", ctx, value)?;
             },
             GeneralNameValue::Bytes(value) => {
-                e.bytes(value)?;
+                encode_bytes(e, "General Name value", value)?;
             },
             GeneralNameValue::Oid(value) => {
                 value.encode(e, ctx)?;
@@ -178,11 +187,11 @@ where C: GeneralNameValueTrait + Debug
     fn decode(d: &mut Decoder<'_>, ctx: &mut C) -> Result<Self, minicbor::decode::Error> {
         match ctx.get_type() {
             GeneralNameValueType::Text => {
-                let value = d.str()?.to_string();
+                let value = decode_helper(d, "General Name value", ctx)?;
                 Ok(GeneralNameValue::Text(value))
             },
             GeneralNameValueType::Bytes => {
-                let value = d.bytes()?.to_vec();
+                let value = decode_bytes(d, "General Name value")?;
                 Ok(GeneralNameValue::Bytes(value))
             },
             GeneralNameValueType::Oid => {
diff --git a/rust/c509-certificate/src/general_names/mod.rs b/rust/c509-certificate/src/general_names/mod.rs
index d46413ea52e..334ed695a42 100644
--- a/rust/c509-certificate/src/general_names/mod.rs
+++ b/rust/c509-certificate/src/general_names/mod.rs
@@ -10,6 +10,8 @@ use general_name::GeneralName;
 use minicbor::{encode::Write, Decode, Decoder, Encode, Encoder};
 use serde::{Deserialize, Serialize};
 
+use crate::helper::{decode::decode_array_len, encode::encode_array_len};
+
 /// A struct represents an array of `GeneralName`.
 ///
 /// ```cddl
@@ -49,11 +51,11 @@ impl Encode<()> for GeneralNames {
     ) -> Result<(), minicbor::encode::Error<W::Error>> {
         if self.0.is_empty() {
             return Err(minicbor::encode::Error::message(
-                "GeneralNames should not be empty",
+                "General Names should not be empty",
             ));
         }
         // The general name type should be included in array too
-        e.array(self.0.len() as u64 * 2)?;
+        encode_array_len(e, "General Names", self.0.len() as u64 * 2)?;
         for gn in &self.0 {
             gn.encode(e, ctx)?;
         }
@@ -63,9 +65,7 @@ impl Encode<()> for GeneralNames {
 
 impl Decode<'_, ()> for GeneralNames {
     fn decode(d: &mut Decoder<'_>, ctx: &mut ()) -> Result<Self, minicbor::decode::Error> {
-        let len = d.array()?.ok_or(minicbor::decode::Error::message(
-            "GeneralNames should be an array",
-        ))?;
+        let len = decode_array_len(d, "General Names")?;
         let mut gn = GeneralNames::new();
         for _ in 0..len / 2 {
             gn.add_general_name(GeneralName::decode(d, ctx)?);
diff --git a/rust/c509-certificate/src/general_names/other_name_hw_module.rs b/rust/c509-certificate/src/general_names/other_name_hw_module.rs
index 9e6ba200005..7e2660cc088 100644
--- a/rust/c509-certificate/src/general_names/other_name_hw_module.rs
+++ b/rust/c509-certificate/src/general_names/other_name_hw_module.rs
@@ -7,7 +7,13 @@ use asn1_rs::Oid;
 use minicbor::{encode::Write, Decode, Decoder, Encode, Encoder};
 use serde::{Deserialize, Serialize};
 
-use crate::oid::C509oid;
+use crate::{
+    helper::{
+        decode::{decode_array_len, decode_bytes},
+        encode::{encode_array_len, encode_bytes},
+    },
+    oid::C509oid,
+};
 
 /// A struct represents the hardwareModuleName type of otherName.
 /// Containing a pair of ( hwType, hwSerialNum ) as mentioned in
@@ -47,18 +53,22 @@ impl Encode<()> for OtherNameHardwareModuleName {
     fn encode<W: Write>(
         &self, e: &mut Encoder<W>, ctx: &mut (),
     ) -> Result<(), minicbor::encode::Error<W::Error>> {
-        e.array(2)?;
+        encode_array_len(e, "OtherNameHardwareModule", 2)?;
         self.hw_type.encode(e, ctx)?;
-        e.bytes(&self.hw_serial_num)?;
+        encode_bytes(
+            e,
+            "OtherNameHardwareModule serial number",
+            &self.hw_serial_num,
+        )?;
         Ok(())
     }
 }
 
 impl<'a> Decode<'a, ()> for OtherNameHardwareModuleName {
     fn decode(d: &mut Decoder<'a>, ctx: &mut ()) -> Result<Self, minicbor::decode::Error> {
-        d.array()?;
+        decode_array_len(d, "OtherNameHardwareModule")?;
         let hw_type = C509oid::decode(d, ctx)?;
-        let hw_serial_num = d.bytes()?.to_vec();
+        let hw_serial_num = decode_bytes(d, "OtherNameHardwareModule serial number")?;
         Ok(OtherNameHardwareModuleName::new(
             hw_type.oid().clone(),
             hw_serial_num,
diff --git a/rust/c509-certificate/src/helper/decode.rs b/rust/c509-certificate/src/helper/decode.rs
new file mode 100644
index 00000000000..0b760e130e8
--- /dev/null
+++ b/rust/c509-certificate/src/helper/decode.rs
@@ -0,0 +1,62 @@
+//! Helper functions for decoding CBOR data.
+
+use minicbor::{decode, Decoder};
+
+/// Generic helper function for decoding different types.
+pub(crate) fn decode_helper<'a, T, C>(
+    d: &mut Decoder<'a>, from: &str, context: &mut C,
+) -> Result<T, decode::Error>
+where T: minicbor::Decode<'a, C> {
+    T::decode(d, context).map_err(|e| {
+        decode::Error::message(&format!(
+            "Failed to decode {:?} in {from}: {e}",
+            std::any::type_name::<T>()
+        ))
+    })
+}
+
+/// Helper function for decoding bytes.
+pub(crate) fn decode_bytes(d: &mut Decoder, from: &str) -> Result<Vec<u8>, decode::Error> {
+    d.bytes().map(<[u8]>::to_vec).map_err(|e| {
+        decode::Error::message(&format!(
+            "Failed to decode bytes in {from}:
+            {e}"
+        ))
+    })
+}
+
+/// Helper function for decoding array.
+pub(crate) fn decode_array_len(d: &mut Decoder, from: &str) -> Result<u64, decode::Error> {
+    d.array()
+        .map_err(|e| {
+            decode::Error::message(&format!(
+                "Failed to decode array in {from}:
+            {e}"
+            ))
+        })?
+        .ok_or(decode::Error::message(&format!(
+            "Failed to decode array in {from}, unexpected indefinite length",
+        )))
+}
+
+/// Helper function for decoding null.
+pub(crate) fn decode_null(d: &mut Decoder, from: &str) -> Result<(), decode::Error> {
+    d.null().map_err(|e| {
+        decode::Error::message(&format!(
+            "Failed to decode null in {from}:
+            {e}"
+        ))
+    })
+}
+
+/// Helper function for decoding datatype.
+pub(crate) fn decode_datatype(
+    d: &mut Decoder, from: &str,
+) -> Result<minicbor::data::Type, decode::Error> {
+    d.datatype().map_err(|e| {
+        decode::Error::message(&format!(
+            "Failed to decode datatype in {from}:
+            {e}"
+        ))
+    })
+}
diff --git a/rust/c509-certificate/src/helper/encode.rs b/rust/c509-certificate/src/helper/encode.rs
new file mode 100644
index 00000000000..0cbfe752878
--- /dev/null
+++ b/rust/c509-certificate/src/helper/encode.rs
@@ -0,0 +1,54 @@
+//! Helper functions for encoding CBOR data.
+
+use minicbor::{
+    encode::{self, Write},
+    Encoder,
+};
+
+/// Generic helper function for encoding different types.
+pub(crate) fn encode_helper<W: Write, C, T>(
+    e: &mut Encoder<W>, from: &str, ctx: &mut C, value: &T,
+) -> Result<(), encode::Error<W::Error>>
+where T: minicbor::Encode<C> {
+    T::encode(value, e, ctx).map_err(|err| {
+        encode::Error::with_message(
+            err,
+            &format!(
+                "Failed to encode {:?} in {from}",
+                std::any::type_name::<T>()
+            ),
+        )
+    })?;
+
+    Ok(())
+}
+
+/// Helper function for encoding bytes.
+pub(crate) fn encode_bytes<W: Write>(
+    e: &mut Encoder<W>, from: &str, value: &[u8],
+) -> Result<(), encode::Error<W::Error>> {
+    e.bytes(value).map_err(|err| {
+        encode::Error::with_message(err, &format!("Failed to encode bytes in {from}"))
+    })?;
+    Ok(())
+}
+
+/// Helper function for encoding null.
+pub(crate) fn encode_null<W: Write>(
+    e: &mut Encoder<W>, from: &str,
+) -> Result<(), encode::Error<W::Error>> {
+    e.null().map_err(|err| {
+        encode::Error::with_message(err, &format!("Failed to encode null in {from}"))
+    })?;
+    Ok(())
+}
+
+/// Helper function for encoding array.
+pub(crate) fn encode_array_len<W: Write>(
+    e: &mut Encoder<W>, from: &str, len: u64,
+) -> Result<(), encode::Error<W::Error>> {
+    e.array(len).map_err(|err| {
+        encode::Error::with_message(err, &format!("Failed to encode array in {from}"))
+    })?;
+    Ok(())
+}
diff --git a/rust/c509-certificate/src/helper/mod.rs b/rust/c509-certificate/src/helper/mod.rs
new file mode 100644
index 00000000000..fc80e075b4e
--- /dev/null
+++ b/rust/c509-certificate/src/helper/mod.rs
@@ -0,0 +1,3 @@
+//! Helper module
+pub mod decode;
+pub mod encode;
diff --git a/rust/c509-certificate/src/issuer_sig_algo/mod.rs b/rust/c509-certificate/src/issuer_sig_algo/mod.rs
index db15c1f6884..ce31e8b23fd 100644
--- a/rust/c509-certificate/src/issuer_sig_algo/mod.rs
+++ b/rust/c509-certificate/src/issuer_sig_algo/mod.rs
@@ -14,7 +14,14 @@ use data::{get_oid_from_int, ISSUER_SIG_ALGO_LOOKUP};
 use minicbor::{encode::Write, Decode, Decoder, Encode, Encoder};
 use serde::{Deserialize, Deserializer, Serialize};
 
-use crate::{algorithm_identifier::AlgorithmIdentifier, oid::C509oidRegistered};
+use crate::{
+    algorithm_identifier::AlgorithmIdentifier,
+    helper::{
+        decode::{decode_datatype, decode_helper},
+        encode::encode_helper,
+    },
+    oid::C509oidRegistered,
+};
 
 /// A struct represents the `IssuerSignatureAlgorithm`
 #[derive(Debug, Clone, PartialEq)]
@@ -92,7 +99,7 @@ impl Encode<()> for IssuerSignatureAlgorithm {
             .get_map()
             .get_by_right(self.registered_oid.c509_oid().oid())
         {
-            e.i16(i)?;
+            encode_helper(e, "Issuer Signature Algorithm as OID int", ctx, &i)?;
         } else {
             AlgorithmIdentifier::encode(&self.algo_identifier, e, ctx)?;
         }
@@ -102,10 +109,10 @@ impl Encode<()> for IssuerSignatureAlgorithm {
 
 impl Decode<'_, ()> for IssuerSignatureAlgorithm {
     fn decode(d: &mut Decoder<'_>, ctx: &mut ()) -> Result<Self, minicbor::decode::Error> {
-        match d.datatype()? {
+        match decode_datatype(d, "Issuer Signature Algorithm")? {
             // Check i16 for -256 and -256
             minicbor::data::Type::U8 | minicbor::data::Type::I16 => {
-                let i = d.i16()?;
+                let i = decode_helper(d, "Issuer Signature Algorithm as OID int", ctx)?;
                 let oid = get_oid_from_int(i).map_err(minicbor::decode::Error::message)?;
                 Ok(Self::new(oid, None))
             },
diff --git a/rust/c509-certificate/src/lib.rs b/rust/c509-certificate/src/lib.rs
index 808de48c1dd..6a0e0821f85 100644
--- a/rust/c509-certificate/src/lib.rs
+++ b/rust/c509-certificate/src/lib.rs
@@ -46,6 +46,7 @@ pub mod big_uint;
 pub mod c509;
 pub mod extensions;
 pub mod general_names;
+mod helper;
 pub mod issuer_sig_algo;
 pub mod name;
 pub mod oid;
diff --git a/rust/c509-certificate/src/name/mod.rs b/rust/c509-certificate/src/name/mod.rs
index 75c04bc0692..8a51f559210 100644
--- a/rust/c509-certificate/src/name/mod.rs
+++ b/rust/c509-certificate/src/name/mod.rs
@@ -17,11 +17,16 @@ use minicbor::{encode::Write, Decode, Decoder, Encode, Encoder};
 use regex::Regex;
 use serde::{Deserialize, Serialize};
 
-use crate::attributes::{
-    attribute::{Attribute, AttributeValue},
-    Attributes,
+use crate::{
+    attributes::{
+        attribute::{Attribute, AttributeValue},
+        Attributes,
+    },
+    helper::{
+        decode::{decode_bytes, decode_datatype, decode_helper},
+        encode::{encode_bytes, encode_helper},
+    },
 };
-
 /// OID of `CommonName` attribute.
 const COMMON_NAME_OID: Oid<'static> = oid!(2.5.4 .3);
 /// EUI-64 prefix.
@@ -114,10 +119,10 @@ impl Encode<()> for NameValue {
                 }
             },
             NameValue::Text(text) => {
-                e.str(text)?;
+                encode_helper(e, "Name", ctx, text)?;
             },
             NameValue::Bytes(bytes) => {
-                e.bytes(bytes)?;
+                encode_bytes(e, "Name", bytes)?;
             },
         }
         Ok(())
@@ -126,11 +131,13 @@ impl Encode<()> for NameValue {
 
 impl Decode<'_, ()> for NameValue {
     fn decode(d: &mut Decoder<'_>, ctx: &mut ()) -> Result<Self, minicbor::decode::Error> {
-        match d.datatype()? {
+        match decode_datatype(d, "Name")? {
             minicbor::data::Type::Array => Ok(NameValue::Attributes(Attributes::decode(d, ctx)?)),
             // If Name is a text string, the attribute is a CommonName
-            minicbor::data::Type::String => Ok(create_attributes_with_cn(d.str()?.to_string())),
-            minicbor::data::Type::Bytes => decode_bytes(d),
+            minicbor::data::Type::String => {
+                Ok(create_attributes_with_cn(decode_helper(d, "Name", ctx)?))
+            },
+            minicbor::data::Type::Bytes => decode_bytes_helper(d),
             _ => {
                 Err(minicbor::decode::Error::message(
                     "Name must be an array, text or bytes",
@@ -157,7 +164,11 @@ fn encode_cn_value<W: Write>(
             // string, prefixed with an initial byte set to '00'
             if hex_regex.is_match(s) && s.len() % 2 == 0 {
                 let decoded_bytes = hex::decode(s).map_err(minicbor::encode::Error::message)?;
-                e.bytes(&[&[HEX_PREFIX], &decoded_bytes[..]].concat())?;
+                encode_bytes(
+                    e,
+                    "Common Name hex",
+                    &[&[HEX_PREFIX], &decoded_bytes[..]].concat(),
+                )?;
 
             // An EUI-64 mapped from a 48-bit MAC address (i.e., of the form
             // "HH-HH-HH-FF-FE-HH-HH-HH) is encoded as a CBOR byte string prefixed with an
@@ -176,7 +187,11 @@ fn encode_cn_value<W: Write>(
                     .ok_or(minicbor::encode::Error::message(
                         "Failed to get MAC EUI-64 bytes index 5 to 6",
                     ))?;
-                e.bytes(&[&[EUI64_PREFIX], chunk2, chunk3].concat())?;
+                encode_bytes(
+                    e,
+                    "Common Name EUI-64 MAC",
+                    &[&[EUI64_PREFIX], chunk2, chunk3].concat(),
+                )?;
 
             // an EUI-64 of the form "HH-HH-HH-HH-HH-HH-HH-HH" where 'H'
             // is one of the symbols '0'–'9' or 'A'–'F' it is encoded as a
@@ -186,9 +201,13 @@ fn encode_cn_value<W: Write>(
                 let clean_name = s.replace('-', "");
                 let decoded_bytes =
                     hex::decode(clean_name).map_err(minicbor::encode::Error::message)?;
-                e.bytes(&[&[EUI64_PREFIX], &decoded_bytes[..]].concat())?;
+                encode_bytes(
+                    e,
+                    "Common Name EUI-64",
+                    &[&[EUI64_PREFIX], &decoded_bytes[..]].concat(),
+                )?;
             } else {
-                e.str(s)?;
+                encode_helper(e, "Common Name", &mut (), s)?;
             }
         },
         AttributeValue::Bytes(_) => {
@@ -209,8 +228,8 @@ fn formatted_eui_bytes(data: &[u8]) -> String {
 }
 
 /// Decode bytes.
-fn decode_bytes(d: &mut Decoder<'_>) -> Result<NameValue, minicbor::decode::Error> {
-    let bytes = d.bytes()?;
+fn decode_bytes_helper(d: &mut Decoder<'_>) -> Result<NameValue, minicbor::decode::Error> {
+    let bytes = decode_bytes(d, "Name")?;
 
     let first_i = bytes.first().ok_or(minicbor::decode::Error::message(
         "Failed to get the first index of bytes",
@@ -219,10 +238,10 @@ fn decode_bytes(d: &mut Decoder<'_>) -> Result<NameValue, minicbor::decode::Erro
     // Bytes prefix
     match *first_i {
         // 0x00 for hex
-        HEX_PREFIX => decode_hex_cn_bytes(bytes),
+        HEX_PREFIX => decode_hex_cn_bytes(&bytes),
         // 0x01 for EUI
-        EUI64_PREFIX => decode_eui_cn_bytes(bytes),
-        _ => Ok(NameValue::Bytes(bytes.to_vec())),
+        EUI64_PREFIX => decode_eui_cn_bytes(&bytes),
+        _ => Ok(NameValue::Bytes(bytes)),
     }
 }
 
diff --git a/rust/c509-certificate/src/oid.rs b/rust/c509-certificate/src/oid.rs
index 6148dcfb43c..4f566394cbb 100644
--- a/rust/c509-certificate/src/oid.rs
+++ b/rust/c509-certificate/src/oid.rs
@@ -11,7 +11,10 @@ use minicbor::{decode, encode::Write, Decode, Decoder, Encode, Encoder};
 use oid_registry::Oid;
 use serde::{Deserialize, Deserializer, Serialize};
 
-use crate::tables::IntegerToOidTable;
+use crate::{
+    helper::{decode::decode_bytes, encode::encode_bytes},
+    tables::IntegerToOidTable,
+};
 
 /// A strut of C509 OID with Registered Integer.
 #[derive(Debug, Clone, PartialEq)]
@@ -102,8 +105,7 @@ impl Encode<()> for C509oid {
         &self, e: &mut Encoder<W>, _ctx: &mut (),
     ) -> Result<(), minicbor::encode::Error<W::Error>> {
         let oid_bytes = self.0.as_bytes();
-        e.bytes(oid_bytes)?;
-        Ok(())
+        encode_bytes(e, "C509 OID", oid_bytes)
     }
 }
 
@@ -116,8 +118,8 @@ impl Decode<'_, ()> for C509oid {
     /// A C509oid instance.
     /// If the decoding fails, it will return an error.
     fn decode(d: &mut Decoder, _ctx: &mut ()) -> Result<Self, decode::Error> {
-        let oid_bytes = d.bytes()?;
-        let oid = Oid::new(oid_bytes.to_owned().into());
+        let oid_bytes = decode_bytes(d, "C509 OID")?;
+        let oid = Oid::new(oid_bytes.into());
         Ok(C509oid::new(oid))
     }
 }
diff --git a/rust/c509-certificate/src/subject_pub_key_algo/mod.rs b/rust/c509-certificate/src/subject_pub_key_algo/mod.rs
index bd59a9b6112..380b2675196 100644
--- a/rust/c509-certificate/src/subject_pub_key_algo/mod.rs
+++ b/rust/c509-certificate/src/subject_pub_key_algo/mod.rs
@@ -16,7 +16,14 @@ use data::{get_oid_from_int, SUBJECT_PUB_KEY_ALGO_LOOKUP};
 use minicbor::{encode::Write, Decode, Decoder, Encode, Encoder};
 use serde::{Deserialize, Deserializer, Serialize};
 
-use crate::{algorithm_identifier::AlgorithmIdentifier, oid::C509oidRegistered};
+use crate::{
+    algorithm_identifier::AlgorithmIdentifier,
+    helper::{
+        decode::{decode_datatype, decode_helper},
+        encode::encode_helper,
+    },
+    oid::C509oidRegistered,
+};
 
 /// A struct represents the `SubjectPubKeyAlgorithm`
 #[derive(Debug, Clone, PartialEq)]
@@ -94,7 +101,7 @@ impl Encode<()> for SubjectPubKeyAlgorithm {
             .get_map()
             .get_by_right(self.registered_oid.c509_oid().oid())
         {
-            e.i16(i)?;
+            encode_helper(e, "Subject public key algorithm", ctx, &i)?;
         } else {
             AlgorithmIdentifier::encode(&self.algo_identifier, e, ctx)?;
         }
@@ -105,8 +112,8 @@ impl Encode<()> for SubjectPubKeyAlgorithm {
 impl Decode<'_, ()> for SubjectPubKeyAlgorithm {
     fn decode(d: &mut Decoder<'_>, ctx: &mut ()) -> Result<Self, minicbor::decode::Error> {
         // Check u8 for 0 - 28
-        if d.datatype()? == minicbor::data::Type::U8 {
-            let i = d.i16()?;
+        if decode_datatype(d, "Subject public key algorithm")? == minicbor::data::Type::U8 {
+            let i = decode_helper(d, "Subject public key algorithm", ctx)?;
             let oid = get_oid_from_int(i).map_err(minicbor::decode::Error::message)?;
             Ok(Self::new(oid, None))
         } else {
diff --git a/rust/c509-certificate/src/tbs_cert.rs b/rust/c509-certificate/src/tbs_cert.rs
index e0e10551ebf..edd194b73ac 100644
--- a/rust/c509-certificate/src/tbs_cert.rs
+++ b/rust/c509-certificate/src/tbs_cert.rs
@@ -4,8 +4,16 @@ use minicbor::{encode::Write, Decode, Decoder, Encode, Encoder};
 use serde::{Deserialize, Serialize};
 
 use crate::{
-    big_uint::UnwrappedBigUint, extensions::Extensions, issuer_sig_algo::IssuerSignatureAlgorithm,
-    name::Name, subject_pub_key_algo::SubjectPubKeyAlgorithm, time::Time,
+    big_uint::UnwrappedBigUint,
+    extensions::Extensions,
+    helper::{
+        decode::{decode_bytes, decode_helper},
+        encode::{encode_bytes, encode_helper},
+    },
+    issuer_sig_algo::IssuerSignatureAlgorithm,
+    name::Name,
+    subject_pub_key_algo::SubjectPubKeyAlgorithm,
+    time::Time,
 };
 
 /// A struct represents a To Be Signed Certificate (TBS Certificate).
@@ -131,7 +139,7 @@ impl Encode<()> for TbsCert {
     fn encode<W: Write>(
         &self, e: &mut Encoder<W>, ctx: &mut (),
     ) -> Result<(), minicbor::encode::Error<W::Error>> {
-        e.u8(self.c509_certificate_type)?;
+        encode_helper(e, "Certificate type", ctx, &self.c509_certificate_type)?;
         self.certificate_serial_number.encode(e, ctx)?;
         self.issuer_signature_algorithm.encode(e, ctx)?;
         self.issuer.encode(e, ctx)?;
@@ -139,7 +147,7 @@ impl Encode<()> for TbsCert {
         self.validity_not_after.encode(e, ctx)?;
         self.subject.encode(e, ctx)?;
         self.subject_public_key_algorithm.encode(e, ctx)?;
-        e.bytes(&self.subject_public_key)?;
+        encode_bytes(e, "Subject Public Key", &self.subject_public_key)?;
         self.extensions.encode(e, ctx)?;
         Ok(())
     }
@@ -147,7 +155,7 @@ impl Encode<()> for TbsCert {
 
 impl Decode<'_, ()> for TbsCert {
     fn decode(d: &mut Decoder<'_>, ctx: &mut ()) -> Result<Self, minicbor::decode::Error> {
-        let cert_type = d.u8()?;
+        let cert_type = decode_helper(d, "Certificate type", ctx)?;
         let serial_number = UnwrappedBigUint::decode(d, ctx)?;
         let issuer_signature_algorithm = IssuerSignatureAlgorithm::decode(d, ctx)?;
         let issuer = Some(Name::decode(d, ctx)?);
@@ -155,7 +163,7 @@ impl Decode<'_, ()> for TbsCert {
         let not_after = Time::decode(d, ctx)?;
         let subject = Name::decode(d, ctx)?;
         let subject_public_key_algorithm = SubjectPubKeyAlgorithm::decode(d, ctx)?;
-        let subject_public_key = d.bytes()?;
+        let subject_public_key = decode_bytes(d, "Subject Public Key")?;
         let extensions = Extensions::decode(d, ctx)?;
 
         Ok(TbsCert::new(
@@ -167,7 +175,7 @@ impl Decode<'_, ()> for TbsCert {
             not_after,
             subject,
             subject_public_key_algorithm,
-            subject_public_key.to_vec(),
+            subject_public_key,
             extensions,
         ))
     }
diff --git a/rust/c509-certificate/src/time.rs b/rust/c509-certificate/src/time.rs
index 6fb9b0896ee..514687ab230 100644
--- a/rust/c509-certificate/src/time.rs
+++ b/rust/c509-certificate/src/time.rs
@@ -3,6 +3,11 @@
 use minicbor::{encode::Write, Decode, Decoder, Encode, Encoder};
 use serde::{Deserialize, Serialize};
 
+use crate::helper::{
+    decode::{decode_datatype, decode_helper, decode_null},
+    encode::{encode_helper, encode_null},
+};
+
 /// A struct representing a time where it accept seconds since the Unix epoch.
 /// Doesn't support dates before the Unix epoch (January 1, 1970, 00:00:00 UTC)
 /// so unsigned integer is used.
@@ -40,12 +45,12 @@ impl From<Time> for u64 {
 
 impl Encode<()> for Time {
     fn encode<W: Write>(
-        &self, e: &mut Encoder<W>, _ctx: &mut (),
+        &self, e: &mut Encoder<W>, ctx: &mut (),
     ) -> Result<(), minicbor::encode::Error<W::Error>> {
         if self.0 == NO_EXP_DATE {
-            e.null()?;
+            encode_null(e, "Time")?;
         } else {
-            e.u64(self.0)?;
+            encode_helper(e, "Time", ctx, &self.0)?;
         }
         Ok(())
     }
@@ -53,16 +58,16 @@ impl Encode<()> for Time {
 
 impl Decode<'_, ()> for Time {
     fn decode(d: &mut Decoder<'_>, _ctx: &mut ()) -> Result<Self, minicbor::decode::Error> {
-        match d.datatype()? {
+        match decode_datatype(d, "Time")? {
             minicbor::data::Type::U8
             | minicbor::data::Type::U16
             | minicbor::data::Type::U32
             | minicbor::data::Type::U64 => {
-                let time = d.u64()?;
+                let time = decode_helper(d, "Time", &mut ())?;
                 Ok(Time::new(time))
             },
             minicbor::data::Type::Null => {
-                d.null()?;
+                decode_null(d, "Time")?;
                 Ok(Time::new(NO_EXP_DATE))
             },
             _ => Err(minicbor::decode::Error::message("Invalid type for Time")),
diff --git a/rust/c509-certificate/src/wasm_binding.rs b/rust/c509-certificate/src/wasm_binding.rs
index 29aea24c59a..90140408931 100644
--- a/rust/c509-certificate/src/wasm_binding.rs
+++ b/rust/c509-certificate/src/wasm_binding.rs
@@ -21,7 +21,7 @@ use crate::{
 pub fn generate(tbs_cert: JsValue, private_key: Option<PrivateKey>) -> Result<JsValue, JsValue> {
     let tbs_cert: TbsCert = serde_wasm_bindgen::from_value(tbs_cert)?;
     let c509 = crate::generate(&tbs_cert, private_key.as_ref())
-        .map_err(|e| JsValue::from(e.to_string()))?;
+        .map_err(|err| JsValue::from(err.to_string()))?;
     Ok(serde_wasm_bindgen::to_value(&c509)?)
 }
 
@@ -33,7 +33,7 @@ pub fn generate(tbs_cert: JsValue, private_key: Option<PrivateKey>) -> Result<Js
 pub fn verify(c509: &[u8], public_key: &PublicKey) -> Result<JsValue, JsValue> {
     match crate::verify(c509, public_key) {
         Ok(()) => Ok(JsValue::from("Signature verified")),
-        Err(e) => Err(JsValue::from(e.to_string())),
+        Err(err) => Err(JsValue::from(err.to_string())),
     }
 }
 
@@ -44,7 +44,8 @@ pub fn verify(c509: &[u8], public_key: &PublicKey) -> Result<JsValue, JsValue> {
 #[wasm_bindgen]
 pub fn decode(c509: &[u8]) -> Result<JsValue, JsValue> {
     let mut d = minicbor::Decoder::new(c509);
-    let c509 = crate::C509::decode(&mut d, &mut ()).map_err(|e| JsValue::from(e.to_string()))?;
+    let c509 =
+        crate::C509::decode(&mut d, &mut ()).map_err(|err| JsValue::from(err.to_string()))?;
     Ok(serde_wasm_bindgen::to_value(&c509)?)
 }
 

From b2881101c664100b02d17ba79d0d365843d01d2f Mon Sep 17 00:00:00 2001
From: bkioshn <35752733+bkioshn@users.noreply.github.com>
Date: Sat, 21 Sep 2024 15:49:58 +0700
Subject: [PATCH 11/19] test(rust/c509-certificate): Fix test for draft11 (#28)

* fix: naming + add neccesary function

* fix(rust/c509-certificate): add encode + decode helper functions

* fix(rust/c509-certificate): cleanup

* fix(rust/c509-certificate): cleanup

* fix(rust/c509-certificate): cleanup

* fix(rust/c509-certificate): remove unnecessary allow(dead_code)

* fix(rust/c509-certificate): fix encode decode Name

* chore(rust/c509-certificate): fix comment

* fix(rust/c509-certificate): add + rewrite test cases

* chore(rust/c509-certificate): earthly no cache

* chore(rust/c509-certificate): earthly no cache

* chore(rust/c509-certificate): earthly no cache

* chore(rust/c509-certificate): remove earthly no-cache

* fix(rust/c509-certificate): add more test comments

* fix(rust/c509-certificate): clippy lints

---------

Co-authored-by: Steven Johnson <stevenj@users.noreply.github.com>
Co-authored-by: Steven Johnson <sakurainds@gmail.com>
---
 rust/c509-certificate/examples/cli/main.rs    |  18 +-
 .../src/attributes/attribute.rs               |   3 +-
 rust/c509-certificate/src/attributes/mod.rs   |   2 +-
 rust/c509-certificate/src/big_uint.rs         |   2 +
 .../src/extensions/extension/mod.rs           |   2 +-
 .../c509-certificate/src/general_names/mod.rs |  10 +
 rust/c509-certificate/src/helper/decode.rs    |  12 +-
 rust/c509-certificate/src/helper/encode.rs    |   8 +-
 rust/c509-certificate/src/lib.rs              |   4 +-
 rust/c509-certificate/src/name/mod.rs         | 195 +++----
 rust/c509-certificate/src/oid.rs              |   3 +
 rust/c509-certificate/src/tbs_cert.rs         | 509 +++++++++---------
 rust/c509-certificate/src/time.rs             |   1 +
 .../src/metadata/cip509/decode_helper.rs      |   8 +-
 14 files changed, 401 insertions(+), 376 deletions(-)

diff --git a/rust/c509-certificate/examples/cli/main.rs b/rust/c509-certificate/examples/cli/main.rs
index 9ef57c157f6..e408ac96a7a 100644
--- a/rust/c509-certificate/examples/cli/main.rs
+++ b/rust/c509-certificate/examples/cli/main.rs
@@ -8,7 +8,7 @@ use std::{
 
 use asn1_rs::{oid, Oid};
 use c509_certificate::{
-    attributes::Attributes,
+    attributes::attribute::Attribute,
     big_uint::UnwrappedBigUint,
     extensions::Extensions,
     issuer_sig_algo::IssuerSignatureAlgorithm,
@@ -108,7 +108,7 @@ struct C509Json {
     issuer_signature_algorithm: Option<IssuerSignatureAlgorithm>,
     /// Optional issuer of the certificate,
     /// if not provided, issuer is the same as subject.
-    issuer: Option<Attributes>,
+    issuer: Option<Vec<Attribute>>,
     /// Optional validity not before date,
     /// if not provided, set to current time.
     validity_not_before: Option<String>,
@@ -116,7 +116,7 @@ struct C509Json {
     /// if not provided, set to no expire date 9999-12-31T23:59:59+00:00.
     validity_not_after: Option<String>,
     /// Attributes of the subject.
-    subject: Attributes,
+    subject: Vec<Attribute>,
     /// Optional subject public key algorithm of the certificate,
     /// if not provided, set to Ed25519.
     subject_public_key_algorithm: Option<SubjectPubKeyAlgorithm>,
@@ -184,10 +184,10 @@ fn generate(
         c509_json
             .issuer_signature_algorithm
             .unwrap_or(IssuerSignatureAlgorithm::new(key_type.0.clone(), ED25519.1)),
-        Some(Name::new(NameValue::Attributes(issuer))),
+        Some(Name::new(NameValue::Attribute(issuer))),
         Time::new(not_before),
         Time::new(not_after),
-        Name::new(NameValue::Attributes(c509_json.subject)),
+        Name::new(NameValue::Attribute(c509_json.subject)),
         c509_json
             .subject_public_key_algorithm
             .unwrap_or(SubjectPubKeyAlgorithm::new(key_type.0, key_type.1)),
@@ -219,8 +219,8 @@ fn write_to_output_file(output: PathBuf, data: &[u8]) -> anyhow::Result<()> {
 /// If self-signed is true, issuer is the same as subject.
 /// Otherwise, issuer must be present.
 fn determine_issuer(
-    self_signed: bool, issuer: Option<Attributes>, subject: Attributes,
-) -> anyhow::Result<Attributes> {
+    self_signed: bool, issuer: Option<Vec<Attribute>>, subject: Vec<Attribute>,
+) -> anyhow::Result<Vec<Attribute>> {
     if self_signed {
         Ok(subject)
     } else {
@@ -330,9 +330,9 @@ fn decode(file: &PathBuf, output: Option<PathBuf>) -> anyhow::Result<()> {
 }
 
 /// Extract a `Attributes` from a `Name`.
-fn extract_attributes(name: &Name) -> anyhow::Result<Attributes> {
+fn extract_attributes(name: &Name) -> anyhow::Result<Vec<Attribute>> {
     match name.value() {
-        NameValue::Attributes(attrs) => Ok(attrs.clone()),
+        NameValue::Attribute(attrs) => Ok(attrs.clone()),
         _ => Err(anyhow::anyhow!("Expected Attributes")),
     }
 }
diff --git a/rust/c509-certificate/src/attributes/attribute.rs b/rust/c509-certificate/src/attributes/attribute.rs
index 9c85ba4e2b8..60da994d00f 100644
--- a/rust/c509-certificate/src/attributes/attribute.rs
+++ b/rust/c509-certificate/src/attributes/attribute.rs
@@ -239,7 +239,8 @@ mod test_attribute {
         attribute
             .encode(&mut encoder, &mut ())
             .expect("Failed to encode Attribute");
-        // Email Address example@example.com: 0x00736578616d706c65406578616d706c652e636f6d
+        // 1.2.840 .113549 .1 .9 .1 in attribute int = 0x00
+        // Email Address example@example.com: 0x736578616d706c65406578616d706c652e636f6d
         assert_eq!(
             hex::encode(buffer.clone()),
             "00736578616d706c65406578616d706c652e636f6d"
diff --git a/rust/c509-certificate/src/attributes/mod.rs b/rust/c509-certificate/src/attributes/mod.rs
index 6b830f28dd5..ef4dd5a8fb4 100644
--- a/rust/c509-certificate/src/attributes/mod.rs
+++ b/rust/c509-certificate/src/attributes/mod.rs
@@ -111,7 +111,7 @@ mod test_attributes {
             .encode(&mut encoder, &mut ())
             .expect("Failed to encode Attributes");
         // 1 Attribute (array len 2 (attribute type + value)): 0x82
-        // Email Address: 0x00
+        // Email Address attribute int: 0x00
         // Attribute value (array len 2): 0x82
         // example@example.com: 0x736578616d706c65406578616d706c652e636f6d
         assert_eq!(
diff --git a/rust/c509-certificate/src/big_uint.rs b/rust/c509-certificate/src/big_uint.rs
index 9a8cfdb644b..a6e67ad0a56 100644
--- a/rust/c509-certificate/src/big_uint.rs
+++ b/rust/c509-certificate/src/big_uint.rs
@@ -77,6 +77,7 @@ mod test_big_uint {
         b_uint
             .encode(&mut encoder, &mut ())
             .expect("Failed to encode UnwrappedBigUint");
+        // 128269 (h'01F50D'): CBOR 0x4301f50d
         assert_eq!(hex::encode(buffer.clone()), "4301f50d");
 
         let mut decoder = minicbor::Decoder::new(&buffer);
@@ -97,6 +98,7 @@ mod test_big_uint {
         b_uint
             .encode(&mut encoder, &mut ())
             .expect("Failed to encode UnwrappedBigUint");
+        // 9112578475118446130 (h'7E7661D7B54E4632'): CBOR 0x487e7661d7b54e4632
         assert_eq!(hex::encode(buffer.clone()), "487e7661d7b54e4632");
 
         let mut decoder = minicbor::Decoder::new(&buffer);
diff --git a/rust/c509-certificate/src/extensions/extension/mod.rs b/rust/c509-certificate/src/extensions/extension/mod.rs
index 88707936049..8fc4ea21cfc 100644
--- a/rust/c509-certificate/src/extensions/extension/mod.rs
+++ b/rust/c509-certificate/src/extensions/extension/mod.rs
@@ -307,7 +307,7 @@ mod test_extension {
         let mut buffer = Vec::new();
         let mut encoder = Encoder::new(&mut buffer);
 
-        // Not PEN OID and not in the registry table
+        // Not in the registry table
         // Value should be bytes
         let ext = Extension::new(
             oid!(2.16.840 .1 .101 .3 .4 .2 .1),
diff --git a/rust/c509-certificate/src/general_names/mod.rs b/rust/c509-certificate/src/general_names/mod.rs
index 334ed695a42..a36530333e6 100644
--- a/rust/c509-certificate/src/general_names/mod.rs
+++ b/rust/c509-certificate/src/general_names/mod.rs
@@ -116,6 +116,16 @@ mod test_general_names {
         gns.encode(&mut encoder, &mut ())
             .expect("Failed to encode GeneralNames");
         // Array of 4 GeneralName (type, value) so 8 items: 0x88
+        // Unsigned int 2 for DNSName: 0x02
+        // DNSName with "example.com": 0x6b6578616d706c652e636f6d
+        // OtherNameHardwareModuleName negative 1: 0x20
+        // Array of 2 items: 0x82
+        // OID 2.16.840 .1 .101 .3 .4 .2 .1: 0x49608648016503040201
+        // vec![0x01, 0x02, 0x03, 0x04]: 0x4401020304
+        // IPAddress: 0x07
+        // IPAddress Value in bytes string 192, 168, 1, 1: 0x44c0a80101
+        // RegisteredID: 0x08
+        // OID 2.16.840 .1 .101 .3 .4 .2 .1: 0x49608648016503040201
         assert_eq!(hex::encode(buffer.clone()), "88026b6578616d706c652e636f6d20824960864801650304020144010203040744c0a801010849608648016503040201");
 
         let mut decoder = Decoder::new(&buffer);
diff --git a/rust/c509-certificate/src/helper/decode.rs b/rust/c509-certificate/src/helper/decode.rs
index 0b760e130e8..d43ef62e5e7 100644
--- a/rust/c509-certificate/src/helper/decode.rs
+++ b/rust/c509-certificate/src/helper/decode.rs
@@ -8,7 +8,7 @@ pub(crate) fn decode_helper<'a, T, C>(
 ) -> Result<T, decode::Error>
 where T: minicbor::Decode<'a, C> {
     T::decode(d, context).map_err(|e| {
-        decode::Error::message(&format!(
+        decode::Error::message(format!(
             "Failed to decode {:?} in {from}: {e}",
             std::any::type_name::<T>()
         ))
@@ -18,7 +18,7 @@ where T: minicbor::Decode<'a, C> {
 /// Helper function for decoding bytes.
 pub(crate) fn decode_bytes(d: &mut Decoder, from: &str) -> Result<Vec<u8>, decode::Error> {
     d.bytes().map(<[u8]>::to_vec).map_err(|e| {
-        decode::Error::message(&format!(
+        decode::Error::message(format!(
             "Failed to decode bytes in {from}:
             {e}"
         ))
@@ -29,12 +29,12 @@ pub(crate) fn decode_bytes(d: &mut Decoder, from: &str) -> Result<Vec<u8>, decod
 pub(crate) fn decode_array_len(d: &mut Decoder, from: &str) -> Result<u64, decode::Error> {
     d.array()
         .map_err(|e| {
-            decode::Error::message(&format!(
+            decode::Error::message(format!(
                 "Failed to decode array in {from}:
             {e}"
             ))
         })?
-        .ok_or(decode::Error::message(&format!(
+        .ok_or(decode::Error::message(format!(
             "Failed to decode array in {from}, unexpected indefinite length",
         )))
 }
@@ -42,7 +42,7 @@ pub(crate) fn decode_array_len(d: &mut Decoder, from: &str) -> Result<u64, decod
 /// Helper function for decoding null.
 pub(crate) fn decode_null(d: &mut Decoder, from: &str) -> Result<(), decode::Error> {
     d.null().map_err(|e| {
-        decode::Error::message(&format!(
+        decode::Error::message(format!(
             "Failed to decode null in {from}:
             {e}"
         ))
@@ -54,7 +54,7 @@ pub(crate) fn decode_datatype(
     d: &mut Decoder, from: &str,
 ) -> Result<minicbor::data::Type, decode::Error> {
     d.datatype().map_err(|e| {
-        decode::Error::message(&format!(
+        decode::Error::message(format!(
             "Failed to decode datatype in {from}:
             {e}"
         ))
diff --git a/rust/c509-certificate/src/helper/encode.rs b/rust/c509-certificate/src/helper/encode.rs
index 0cbfe752878..3184ce0a4cd 100644
--- a/rust/c509-certificate/src/helper/encode.rs
+++ b/rust/c509-certificate/src/helper/encode.rs
@@ -13,7 +13,7 @@ where T: minicbor::Encode<C> {
     T::encode(value, e, ctx).map_err(|err| {
         encode::Error::with_message(
             err,
-            &format!(
+            format!(
                 "Failed to encode {:?} in {from}",
                 std::any::type_name::<T>()
             ),
@@ -28,7 +28,7 @@ pub(crate) fn encode_bytes<W: Write>(
     e: &mut Encoder<W>, from: &str, value: &[u8],
 ) -> Result<(), encode::Error<W::Error>> {
     e.bytes(value).map_err(|err| {
-        encode::Error::with_message(err, &format!("Failed to encode bytes in {from}"))
+        encode::Error::with_message(err, format!("Failed to encode bytes in {from}"))
     })?;
     Ok(())
 }
@@ -38,7 +38,7 @@ pub(crate) fn encode_null<W: Write>(
     e: &mut Encoder<W>, from: &str,
 ) -> Result<(), encode::Error<W::Error>> {
     e.null().map_err(|err| {
-        encode::Error::with_message(err, &format!("Failed to encode null in {from}"))
+        encode::Error::with_message(err, format!("Failed to encode null in {from}"))
     })?;
     Ok(())
 }
@@ -48,7 +48,7 @@ pub(crate) fn encode_array_len<W: Write>(
     e: &mut Encoder<W>, from: &str, len: u64,
 ) -> Result<(), encode::Error<W::Error>> {
     e.array(len).map_err(|err| {
-        encode::Error::with_message(err, &format!("Failed to encode array in {from}"))
+        encode::Error::with_message(err, format!("Failed to encode array in {from}"))
     })?;
     Ok(())
 }
diff --git a/rust/c509-certificate/src/lib.rs b/rust/c509-certificate/src/lib.rs
index 6678370d654..9fad8b8f0d1 100644
--- a/rust/c509-certificate/src/lib.rs
+++ b/rust/c509-certificate/src/lib.rs
@@ -117,13 +117,13 @@ mod test {
     use std::str::FromStr;
 
     use signing::tests::private_key_str;
-    use tbs_cert::test_tbs_cert::tbs;
+    use tbs_cert::test_tbs_cert::tbs_1;
 
     use super::*;
 
     #[test]
     fn test_generate_and_verify_signed_c509_cert() {
-        let tbs_cert = tbs();
+        let (tbs_cert, _) = tbs_1();
 
         let private_key = FromStr::from_str(&private_key_str()).expect(
             "Cannot create
diff --git a/rust/c509-certificate/src/name/mod.rs b/rust/c509-certificate/src/name/mod.rs
index 8a51f559210..78d1c404e36 100644
--- a/rust/c509-certificate/src/name/mod.rs
+++ b/rust/c509-certificate/src/name/mod.rs
@@ -4,7 +4,7 @@
 //! are UTF-8 encoded and all attributeType should be non-negative.
 //!
 //! ```cddl
-//! Name = [ * Attributes ] / text / bytes
+//! Name = [ * Attribute ] / text / bytes
 //! Attribute = ( attributeType: int, attributeValue: text ) //
 //!             ( attributeType: ~oid, attributeValue: bytes ) //
 //! ```
@@ -18,13 +18,10 @@ use regex::Regex;
 use serde::{Deserialize, Serialize};
 
 use crate::{
-    attributes::{
-        attribute::{Attribute, AttributeValue},
-        Attributes,
-    },
+    attributes::attribute::{Attribute, AttributeValue},
     helper::{
-        decode::{decode_bytes, decode_datatype, decode_helper},
-        encode::{encode_bytes, encode_helper},
+        decode::{decode_array_len, decode_bytes, decode_datatype, decode_helper},
+        encode::{encode_array_len, encode_bytes, encode_helper},
     },
 };
 /// OID of `CommonName` attribute.
@@ -79,8 +76,8 @@ impl Decode<'_, ()> for Name {
 #[derive(Debug, Clone, PartialEq, Deserialize, Serialize)]
 #[serde(rename_all = "snake_case")]
 pub enum NameValue {
-    /// Attributes.
-    Attributes(Attributes),
+    /// Attribute.
+    Attribute(Vec<Attribute>),
     /// A text.
     Text(String),
     /// bytes.
@@ -92,30 +89,34 @@ impl Encode<()> for NameValue {
         &self, e: &mut Encoder<W>, ctx: &mut (),
     ) -> Result<(), minicbor::encode::Error<W::Error>> {
         match self {
-            NameValue::Attributes(attrs) => {
-                let attr_first =
-                    attrs
-                        .attributes()
-                        .first()
-                        .ok_or(minicbor::encode::Error::message(
-                            "Cannot get the first Attribute",
-                        ))?;
-                //  If Name contains a single Attribute of type CommonName
-                if attrs.attributes().len() == 1
-                    && attr_first.registered_oid().c509_oid().oid() == &COMMON_NAME_OID
-                {
-                    // Get the value of the attribute
-                    let cn_value =
-                        attr_first
-                            .value()
-                            .first()
-                            .ok_or(minicbor::encode::Error::message(
-                                "Cannot get the first Attribute value",
-                            ))?;
-
-                    encode_cn_value(e, cn_value)?;
+            NameValue::Attribute(attrs) => {
+                if let Some(attr_first) = attrs.first() {
+                    // If `attrs` contains exactly one attribute of type CommonName
+                    if attrs.len() == 1
+                        && attr_first.registered_oid().c509_oid().oid() == &COMMON_NAME_OID
+                    {
+                        // Get the value of the attribute
+                        let cn_value =
+                            attr_first
+                                .value()
+                                .first()
+                                .ok_or(minicbor::encode::Error::message(
+                                    "Cannot get the first attribute value",
+                                ))?;
+
+                        encode_cn_value(e, cn_value)?;
+                    } else {
+                        encode_array_len(e, "Attributes", attrs.len() as u64 * 2)?;
+                        for attribute in attrs {
+                            attribute.encode(e, ctx)?;
+                        }
+                    }
                 } else {
-                    attrs.encode(e, ctx)?;
+                    // If is okay if the attributes is empty
+                    encode_array_len(e, "Attributes", attrs.len() as u64 * 2)?;
+                    for attribute in attrs {
+                        attribute.encode(e, ctx)?;
+                    }
                 }
             },
             NameValue::Text(text) => {
@@ -132,7 +133,17 @@ impl Encode<()> for NameValue {
 impl Decode<'_, ()> for NameValue {
     fn decode(d: &mut Decoder<'_>, ctx: &mut ()) -> Result<Self, minicbor::decode::Error> {
         match decode_datatype(d, "Name")? {
-            minicbor::data::Type::Array => Ok(NameValue::Attributes(Attributes::decode(d, ctx)?)),
+            minicbor::data::Type::Array => {
+                let len = decode_array_len(d, "Attributes")?;
+                let mut attrs = Vec::new();
+
+                // The attribute type is included in an array, so divide by 2
+                for _ in 0..len / 2 {
+                    let attribute = Attribute::decode(d, ctx)?;
+                    attrs.push(attribute);
+                }
+                Ok(NameValue::Attribute(attrs))
+            },
             // If Name is a text string, the attribute is a CommonName
             minicbor::data::Type::String => {
                 Ok(create_attributes_with_cn(decode_helper(d, "Name", ctx)?))
@@ -289,43 +300,34 @@ fn decode_eui_cn_bytes(bytes: &[u8]) -> Result<NameValue, minicbor::decode::Erro
 fn create_attributes_with_cn(text: String) -> NameValue {
     let mut attr = Attribute::new(COMMON_NAME_OID);
     attr.add_value(AttributeValue::Text(text));
-    let mut attrs = Attributes::new();
-    attrs.add_attribute(attr);
-    NameValue::Attributes(attrs)
+    NameValue::Attribute(vec![attr])
 }
 
 // ------------------Test----------------------
 
 #[cfg(test)]
-pub(crate) mod test_name {
+mod test_name {
+    use std::vec;
+
     use super::*;
     use crate::attributes::attribute::Attribute;
 
     // Test data from https://datatracker.ietf.org/doc/draft-ietf-cose-cbor-encoded-cert/11/
     // A.1.1.  Example C509 Certificate Encoding
-    pub(crate) fn name_cn_text() -> (Name, String) {
-        let mut attr = Attribute::new(oid!(2.5.4 .3));
-        attr.add_value(AttributeValue::Text("RFC test CA".to_string()));
-        let mut attrs = Attributes::new();
-        attrs.add_attribute(attr);
-
-        (
-            Name::new(NameValue::Attributes(attrs)),
-            // "RFC test CA" Text string: 6b5246432074657374204341
-            "6b5246432074657374204341".to_string(),
-        )
-    }
-
     #[test]
     fn encode_decode_type_name_cn() {
         let mut buffer = Vec::new();
         let mut encoder = Encoder::new(&mut buffer);
 
-        let name = name_cn_text().0;
+        let mut attr = Attribute::new(oid!(2.5.4 .3));
+        attr.add_value(AttributeValue::Text("RFC test CA".to_string()));
+
+        let name = Name::new(NameValue::Attribute(vec![attr]));
         name.encode(&mut encoder, &mut ())
             .expect("Failed to encode Name");
 
-        assert_eq!(hex::encode(buffer.clone()), name_cn_text().1);
+        // "RFC test CA" text(11): 0x6b5246432074657374204341
+        assert_eq!(hex::encode(buffer.clone()), "6b5246432074657374204341");
 
         let mut decoder = Decoder::new(&buffer);
         let name_decoded = Name::decode(&mut decoder, &mut ()).expect("Failed to decode Name");
@@ -339,10 +341,8 @@ pub(crate) mod test_name {
 
         let mut attr = Attribute::new(oid!(2.5.4 .3));
         attr.add_value(AttributeValue::Text("000123abcd".to_string()));
-        let mut attrs = Attributes::new();
-        attrs.add_attribute(attr);
 
-        let name = Name::new(NameValue::Attributes(attrs));
+        let name = Name::new(NameValue::Attribute(vec![attr]));
         name.encode(&mut encoder, &mut ())
             .expect("Failed to encode Name");
 
@@ -363,10 +363,8 @@ pub(crate) mod test_name {
 
         let mut attr = Attribute::new(oid!(2.5.4 .3));
         attr.add_value(AttributeValue::Text("000123ABCD".to_string()));
-        let mut attrs = Attributes::new();
-        attrs.add_attribute(attr);
 
-        let name = Name::new(NameValue::Attributes(attrs));
+        let name = Name::new(NameValue::Attribute(vec![attr]));
         name.encode(&mut encoder, &mut ())
             .expect("Failed to encode Name");
 
@@ -379,32 +377,21 @@ pub(crate) mod test_name {
         assert_eq!(name_decoded, name);
     }
 
-    // Test data from https://datatracker.ietf.org/doc/draft-ietf-cose-cbor-encoded-cert/11/
-    // A.1.  Example RFC 7925 profiled X.509 Certificate
-    pub(crate) fn name_cn_eui_mac() -> (Name, String) {
-        let mut attr = Attribute::new(oid!(2.5.4 .3));
-        attr.add_value(AttributeValue::Text("01-23-45-FF-FE-67-89-AB".to_string()));
-        let mut attrs = Attributes::new();
-        attrs.add_attribute(attr);
-
-        (
-            Name::new(NameValue::Attributes(attrs)),
-            // Bytes of length 7: 0x47
-            // "01-23-45-FF-FE-67-89-AB" special encode: 0x010123456789AB
-            "47010123456789ab".to_string(),
-        )
-    }
-
     #[test]
     fn encode_decode_type_name_cn_eui_mac() {
         let mut buffer = Vec::new();
         let mut encoder = Encoder::new(&mut buffer);
 
-        let name = name_cn_eui_mac().0;
+        let mut attr = Attribute::new(oid!(2.5.4 .3));
+        attr.add_value(AttributeValue::Text("01-23-45-FF-FE-67-89-AB".to_string()));
+
+        let name = Name::new(NameValue::Attribute(vec![attr]));
 
         name.encode(&mut encoder, &mut ())
             .expect("Failed to encode Name");
-        assert_eq!(hex::encode(buffer.clone()), name_cn_eui_mac().1);
+        // Bytes of length 7: 0x47
+        // "01-23-45-FF-FE-67-89-AB" special encode: 0x010123456789AB
+        assert_eq!(hex::encode(buffer.clone()), "47010123456789ab");
 
         let mut decoder = Decoder::new(&buffer);
         let name_decoded = Name::decode(&mut decoder, &mut ()).expect("Failed to decode Name");
@@ -418,9 +405,7 @@ pub(crate) mod test_name {
 
         let mut attr = Attribute::new(oid!(2.5.4 .3));
         attr.add_value(AttributeValue::Text("01-23-45-ff-fe-67-89-AB".to_string()));
-        let mut attrs = Attributes::new();
-        attrs.add_attribute(attr);
-        let name = Name::new(NameValue::Attributes(attrs));
+        let name = Name::new(NameValue::Attribute(vec![attr]));
 
         name.encode(&mut encoder, &mut ())
             .expect("Failed to encode Name");
@@ -444,14 +429,13 @@ pub(crate) mod test_name {
 
         let mut attr = Attribute::new(oid!(2.5.4 .3));
         attr.add_value(AttributeValue::Text("01-23-45-67-89-AB-00-01".to_string()));
-        let mut attrs = Attributes::new();
-        attrs.add_attribute(attr);
 
-        let name = Name::new(NameValue::Attributes(attrs));
+        let name = Name::new(NameValue::Attribute(vec![attr]));
 
         name.encode(&mut encoder, &mut ())
             .expect("Failed to encode Name");
 
+        // 01-23-45-67-89-AB-00-01 = h'010123456789AB0001': 0x49010123456789ab0001
         assert_eq!(hex::encode(buffer.clone()), "49010123456789ab0001");
 
         let mut decoder = Decoder::new(&buffer);
@@ -466,10 +450,8 @@ pub(crate) mod test_name {
 
         let mut attr = Attribute::new(oid!(2.5.4 .3));
         attr.add_value(AttributeValue::Text("01-23-45-67-89-ab-00-01".to_string()));
-        let mut attrs = Attributes::new();
-        attrs.add_attribute(attr);
 
-        let name = Name::new(NameValue::Attributes(attrs));
+        let name = Name::new(NameValue::Attribute(vec![attr]));
 
         name.encode(&mut encoder, &mut ())
             .expect("Failed to encode Name");
@@ -489,8 +471,11 @@ pub(crate) mod test_name {
     // Test data from https://datatracker.ietf.org/doc/draft-ietf-cose-cbor-encoded-cert/11/
     // A.2.  Example IEEE 802.1AR profiled X.509 Certificate
     // Issuer: C=US, ST=CA, O=Example Inc, OU=certification, CN=802.1AR CA
-    #[allow(clippy::similar_names)]
-    pub(crate) fn names() -> (Name, String) {
+    #[test]
+    fn encode_decode_type_name_attrs() {
+        let mut buffer = Vec::new();
+        let mut encoder = Encoder::new(&mut buffer);
+
         let mut attr1 = Attribute::new(oid!(2.5.4 .6));
         attr1.add_value(AttributeValue::Text("US".to_string()));
         let mut attr2 = Attribute::new(oid!(2.5.4 .8));
@@ -502,34 +487,30 @@ pub(crate) mod test_name {
         let mut attr5 = Attribute::new(oid!(2.5.4 .3));
         attr5.add_value(AttributeValue::Text("802.1AR CA".to_string()));
 
-        let mut attrs = Attributes::new();
-        attrs.add_attribute(attr1);
-        attrs.add_attribute(attr2);
-        attrs.add_attribute(attr3);
-        attrs.add_attribute(attr4);
-        attrs.add_attribute(attr5);
-
-        (
-            Name::new(NameValue::Attributes(attrs)),
-            // Array of 10 items [4, "US", 6, "CA", 8, "Example Inc", 9, "certification", 1, "802.1AR CA"] : 0x8a
-            // attr1: 0x04625553
-            // attr2: 0x06624341
-            // attr3: 0x086b4578616d706c6520496e63
-            // attr4: 0x096d63657274696669636174696f6e
-            // attr5: 0x016a3830322e314152204341
-            "8a0462555306624341086b4578616d706c6520496e63096d63657274696669636174696f6e016a3830322e314152204341".to_string(),
-        )
+        let name = Name::new(NameValue::Attribute(vec![
+            attr1, attr2, attr3, attr4, attr5,
+        ]));
+
+        name.encode(&mut encoder, &mut ())
+            .expect("Failed to encode Name");
+        assert_eq!(hex::encode(buffer.clone()), "8a0462555306624341086b4578616d706c6520496e63096d63657274696669636174696f6e016a3830322e314152204341");
+
+        let mut decoder = Decoder::new(&buffer);
+        let name_decoded = Name::decode(&mut decoder, &mut ()).expect("Failed to decode Name");
+        assert_eq!(name_decoded, name);
     }
+
     #[test]
-    fn encode_decode_type_name_attrs() {
+    fn encode_decode_empty_attribute() {
         let mut buffer = Vec::new();
         let mut encoder = Encoder::new(&mut buffer);
 
-        let name = names().0;
+        let name = Name::new(NameValue::Attribute(vec![]));
 
         name.encode(&mut encoder, &mut ())
             .expect("Failed to encode Name");
-        assert_eq!(hex::encode(buffer.clone()), names().1);
+
+        assert_eq!(hex::encode(buffer.clone()), "80");
 
         let mut decoder = Decoder::new(&buffer);
         let name_decoded = Name::decode(&mut decoder, &mut ()).expect("Failed to decode Name");
diff --git a/rust/c509-certificate/src/oid.rs b/rust/c509-certificate/src/oid.rs
index 4f566394cbb..52ba8e37781 100644
--- a/rust/c509-certificate/src/oid.rs
+++ b/rust/c509-certificate/src/oid.rs
@@ -142,6 +142,9 @@ mod test_c509_oid {
         let oid = C509oid::new(oid!(2.16.840 .1 .101 .3 .4 .2 .1));
         oid.encode(&mut encoder, &mut ())
             .expect("Failed to encode OID");
+        // bytes(9) 0x49
+        // 0x60 (for 2.16)
+        // 0x18, 0x03, 0x60, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01
         assert_eq!(hex::encode(buffer.clone()), "49608648016503040201");
 
         let mut decoder = Decoder::new(&buffer);
diff --git a/rust/c509-certificate/src/tbs_cert.rs b/rust/c509-certificate/src/tbs_cert.rs
index fbaf4d9bd9a..c909c53ae17 100644
--- a/rust/c509-certificate/src/tbs_cert.rs
+++ b/rust/c509-certificate/src/tbs_cert.rs
@@ -197,10 +197,7 @@ pub(crate) mod test_tbs_cert {
 
     use super::*;
     use crate::{
-        attributes::{
-            attribute::{Attribute, AttributeValue},
-            Attributes,
-        },
+        attributes::attribute::{Attribute, AttributeValue},
         extensions::{
             alt_name::{AlternativeName, GeneralNamesOrText},
             extension::{Extension, ExtensionValue},
@@ -210,10 +207,7 @@ pub(crate) mod test_tbs_cert {
             other_name_hw_module::OtherNameHardwareModuleName,
             GeneralNames,
         },
-        name::{
-            test_name::{name_cn_eui_mac, name_cn_text, names},
-            NameValue,
-        },
+        name::NameValue,
     };
 
     // Mnemonic: match mad promote group rival case
@@ -221,81 +215,88 @@ pub(crate) mod test_tbs_cert {
 
     // Test reference https://datatracker.ietf.org/doc/draft-ietf-cose-cbor-encoded-cert/11/
     // A.1.  Example RFC 7925 profiled X.509 Certificate
-    //
-    //
-    // Certificate:
-    // Data:
-    // Version: 3 (0x2)
-    // Serial Number: 128269 (0x1f50d)
-    // Signature Algorithm: ecdsa-with-SHA256
-    // Issuer: CN=RFC test CA
-    // Validity
-    // Not Before: Jan  1 00:00:00 2023 GMT
-    // Not After : Jan  1 00:00:00 2026 GMT
-    // Subject: CN=01-23-45-FF-FE-67-89-AB
-    // Subject Public Key Info:
-    // Public Key Algorithm: id-ecPublicKey
-    // Public-Key: (256 bit)
-    // pub:
-    // 04:b1:21:6a:b9:6e:5b:3b:33:40:f5:bd:f0:2e:69:
-    // 3f:16:21:3a:04:52:5e:d4:44:50:b1:01:9c:2d:fd:
-    // 38:38:ab:ac:4e:14:d8:6c:09:83:ed:5e:9e:ef:24:
-    // 48:c6:86:1c:c4:06:54:71:77:e6:02:60:30:d0:51:
-    // f7:79:2a:c2:06
-    // ASN1 OID: prime256v1
-    // NIST CURVE: P-256
-    // X509v3 extensions:
-    // X509v3 Key Usage:
-    // Digital Signature
-    // Signature Algorithm: ecdsa-with-SHA256
-    // 30:46:02:21:00:d4:32:0b:1d:68:49:e3:09:21:9d:30:03:7e:
-    // 13:81:66:f2:50:82:47:dd:da:e7:6c:ce:ea:55:05:3c:10:8e:
-    // 90:02:21:00:d5:51:f6:d6:01:06:f1:ab:b4:84:cf:be:62:56:
-    // c1:78:e4:ac:33:14:ea:19:19:1e:8b:60:7d:a5:ae:3b:da:16
-    //
-    // 01
-    // 43 01 F5 0D
-    // 6B 52 46 43 20 74 65 73 74 20 43 41
-    // 1A 63 B0 CD 00
-    // 1A 69 55 B9 00
-    // 47 01 01 23 45 67 89 AB
-    // 01
-    // 58 21 02 B1 21 6A B9 6E 5B 3B 33 40 F5 BD F0 2E 69 3F 16 21 3A 04 52
-    // 5E D4 44 50 B1 01 9C 2D FD 38 38 AB
-    // 01
-    // 00
-    // 58 40 D4 32 0B 1D 68 49 E3 09 21 9D 30 03 7E 13 81 66 F2 50 82 47 DD
-    // DA E7 6C CE EA 55 05 3C 10 8E 90 D5 51 F6 D6 01 06 F1 AB B4 84 CF BE
-    // 62 56 C1 78 E4 AC 33 14 EA 19 19 1E 8B 60 7D A5 AE 3B DA 16
-
-    pub(crate) fn tbs() -> TbsCert {
-        fn extensions() -> Extensions {
-            let mut exts = Extensions::new();
-            exts.add_extension(Extension::new(
-                oid!(2.5.29 .15),
-                ExtensionValue::Int(1),
-                false,
-            ));
-            exts
-        }
+    pub(crate) fn tbs_1() -> (TbsCert, String) {
+        let tbs_certificate = (
+            3,                             // c509_certificate_type
+            128_269,                       // certificate_serial_number
+            oid!(1.2.840 .10045 .4 .3 .2), // issuer_signature_algorithm (ecdsa-with-SHA256)
+            (
+                // issuer
+                oid!(2.5.4 .3), // oid (commonName)
+                "RFC test CA",  // value
+                false,          // critical
+            ),
+            1_672_531_200, // validity_not_before
+            1_767_225_600, // validity_not_after
+            (
+                // subject
+                oid!(2.5.4 .3),            // oid (commonName)
+                "01-23-45-FF-FE-67-89-AB", // value
+                false,                     // critical
+            ),
+            oid!(1.2.840 .10045 .2 .1), /* subject_public_key_algorithm (id-ecPublicKey
+                                         * prime256v1 P-256) */
+            PUBKEY, // subject_public_key (modified from the example)
+            (
+                // extensions
+                oid!(2.5.29 .15), // oid (keyUsage)
+                1,                // value
+                false,            // critical
+            ),
+        );
+
+        let tbs_certificate_cbor = [
+            "03",                       // c509_certificate_type
+            "4301f50d",                 // certificate_serial_number
+            "00",                       // issuer_signature_algorithm
+            "6b5246432074657374204341", // issuer
+            "1a63b0cd00",               // validity_not_before
+            "1a6955b900",               // validity_not_after
+            "47010123456789ab",         // subject
+            "01",                       // subject_public_key_algorithm
+            "4888d0b6b0b37baa46",       // subject_public_key
+            "01",                       // extensions
+        ];
+
+        // Issuer
+        let mut attr1 = Attribute::new(tbs_certificate.3 .0);
+        attr1.add_value(AttributeValue::Text(tbs_certificate.3 .1.to_string()));
+        let issuer = Name::new(NameValue::Attribute(vec![attr1]));
+
+        // Subject
+        let mut attr2 = Attribute::new(tbs_certificate.6 .0);
+        attr2.add_value(AttributeValue::Text(tbs_certificate.6 .1.to_string()));
+        let subject = Name::new(NameValue::Attribute(vec![attr2]));
+
+        // Extensions
+        let mut extensions = Extensions::new();
+        extensions.add_extension(Extension::new(
+            tbs_certificate.9 .0,
+            ExtensionValue::Int(tbs_certificate.9 .1),
+            tbs_certificate.9 .2,
+        ));
+
+        let data = TbsCert::new(
+            tbs_certificate.0,
+            UnwrappedBigUint::new(tbs_certificate.1),
+            IssuerSignatureAlgorithm::new(tbs_certificate.2, None),
+            Some(issuer),
+            Time::new(tbs_certificate.4),
+            Time::new(tbs_certificate.5),
+            subject,
+            SubjectPubKeyAlgorithm::new(tbs_certificate.7, None),
+            tbs_certificate.8.to_vec(),
+            extensions,
+        );
 
-        TbsCert::new(
-            1,
-            UnwrappedBigUint::new(128_269),
-            IssuerSignatureAlgorithm::new(oid!(1.2.840 .10045 .4 .3 .2), None),
-            Some(name_cn_text().0),
-            Time::new(1_672_531_200),
-            Time::new(1_767_225_600),
-            name_cn_eui_mac().0,
-            SubjectPubKeyAlgorithm::new(oid!(1.2.840 .10045 .2 .1), None),
-            PUBKEY.to_vec(),
-            extensions(),
-        )
+        let concatenated: String = tbs_certificate_cbor.concat();
+
+        (data, concatenated)
     }
 
     #[test]
-    fn encode_decode_tbs_cert() {
-        let tbs_cert = tbs();
+    fn encode_decode_tbs_cert_1() {
+        let (tbs_cert, tbs_cert_cbor) = tbs_1();
 
         let mut buffer = Vec::new();
         let mut encoder = Encoder::new(&mut buffer);
@@ -303,21 +304,7 @@ pub(crate) mod test_tbs_cert {
             .encode(&mut encoder, &mut ())
             .expect("Failed to encode TBS Certificate");
 
-        // c509_certificate_type: 0x01
-        // certificate_serial_number: 0x4301f50d
-        // issuer: 0x6b5246432074657374204341
-        // validity_not_before: 0x1a63b0cd00
-        // validity_not_after: 0x1a6955b900
-        // subject: 0x47010123456789ab
-        // subject_public_key_algorithm: 0x01
-        // subject_public_key: 0x4888d0b6b0b37baa46
-        // extensions: 0x01
-        // issuer_signature_algorithm: 0x00
-
-        assert_eq!(
-            hex::encode(buffer.clone()),
-            "014301f50d6b52464320746573742043411a63b0cd001a6955b90047010123456789ab014888d0b6b0b37baa460100"
-        );
+        assert_eq!(hex::encode(buffer.clone()), tbs_cert_cbor);
 
         let mut decoder = Decoder::new(&buffer);
         let decoded_tbs =
@@ -327,168 +314,208 @@ pub(crate) mod test_tbs_cert {
 
     // Test reference https://datatracker.ietf.org/doc/draft-ietf-cose-cbor-encoded-cert/11/
     // A.2.  Example IEEE 802.1AR profiled X.509 Certificate
-    //
-    // Certificate:
-    // Data:
-    // Version: 3 (0x2)
-    // Serial Number: 9112578475118446130 (0x7e7661d7b54e4632)
-    // Signature Algorithm: ecdsa-with-SHA256
-    // Issuer: C=US, ST=CA, O=Example Inc, OU=certification, CN=802.1AR CA
-    // Validity
-    // Not Before: Jan 31 11:29:16 2019 GMT
-    // Not After : Dec 31 23:59:59 9999 GMT
-    // Subject: C=US, ST=CA, L=LA, O=example Inc, OU=IoT/serialNumber=Wt1234
-    // Subject Public Key Info:
-    // Public Key Algorithm: id-ecPublicKey
-    // Public-Key: (256 bit)
-    // pub:
-    // 04:c8:b4:21:f1:1c:25:e4:7e:3a:c5:71:23:bf:2d:
-    // 9f:dc:49:4f:02:8b:c3:51:cc:80:c0:3f:15:0b:f5:
-    // 0c:ff:95:8d:75:41:9d:81:a6:a2:45:df:fa:e7:90:
-    // be:95:cf:75:f6:02:f9:15:26:18:f8:16:a2:b2:3b:
-    // 56:38:e5:9f:d9
-    // ASN1 OID: prime256v1
-    // NIST CURVE: P-256
-    // X509v3 extensions:
-    // X509v3 Basic Constraints:
-    // CA:FALSE
-    // X509v3 Subject Key Identifier:
-    // 96:60:0D:87:16:BF:7F:D0:E7:52:D0:AC:76:07:77:AD:66:5D:02:A0
-    // X509v3 Authority Key Identifier:
-    // 68:D1:65:51:F9:51:BF:C8:2A:43:1D:0D:9F:08:BC:2D:20:5B:11:60
-    // X509v3 Key Usage: critical
-    // Digital Signature, Key Encipherment
-    // X509v3 Subject Alternative Name:
-    // otherName:
-    // type-id: 1.3.6.1.5.5.7.8.4 (id-on-hardwareModuleName)
-    // value:
-    // hwType: 1.3.6.1.4.1.6175.10.1
-    // hwSerialNum: 01:02:03:04
-    // Signature Algorithm: ecdsa-with-SHA256
-    // Signature Value:
-    // 30:46:02:21:00:c0:d8:19:96:d2:50:7d:69:3f:3c:48:ea:a5:
-    // ee:94:91:bd:a6:db:21:40:99:d9:81:17:c6:3b:36:13:74:cd:
-    // 86:02:21:00:a7:74:98:9f:4c:32:1a:5c:f2:5d:83:2a:4d:33:
-    // 6a:08:ad:67:df:20:f1:50:64:21:18:8a:0a:de:6d:34:92:36
-    //
-    // 01 48 7E 76 61 D7 B5 4E 46 32 8A 23 62 55 53 06 62 43 41 08 6B 45 78
-    // 61 6D 70 6C 65 20 49 6E 63 09 6D 63 65 72 74 69 66 69 63 61 74 69 6F
-    // 6E 01 6A 38 30 32 2E 31 41 52 20 43 41 1A 5C 52 DC 0C F6 8C 23 62 55
-    // 53 06 62 43 41 05 62 4C 41 08 6B 65 78 61 6D 70 6C 65 20 49 6E 63 09
-    // 63 49 6F 54 22 66 57 74 31 32 33 34 01 58 21 03 C8 B4 21 F1 1C 25 E4
-    // 7E 3A C5 71 23 BF 2D 9F DC 49 4F 02 8B C3 51 CC 80 C0 3F 15 0B F5 0C
-    // FF 95 8A 04 21 01 54 96 60 0D 87 16 BF 7F D0 E7 52 D0 AC 76 07 77 AD
-    // 66 5D 02 A0 07 54 68 D1 65 51 F9 51 BF C8 2A 43 1D 0D 9F 08 BC 2D 20
-    // 5B 11 60 21 05 03 82 20 82 49 2B 06 01 04 01 B0 1F 0A 01 44 01 02 03
-    // 04 00 58 40 C0 D8 19 96 D2 50 7D 69 3F 3C 48 EA A5 EE 94 91 BD A6 DB
-    // 21 40 99 D9 81 17 C6 3B 36 13 74 CD 86 A7 74 98 9F 4C 32 1A 5C F2 5D
-    // 83 2A 4D 33 6A 08 AD 67 DF 20 F1 50 64 21 18 8A 0A DE 6D 34 92 36
-
-    #[test]
-    #[allow(clippy::similar_names)]
-    fn tbs_cert2() {
-        // ---------helper----------
-        // C=US, ST=CA, L=LA, O=example Inc, OU=IoT/serialNumber=Wt1234
-        fn subject() -> Name {
-            let mut attr1 = Attribute::new(oid!(2.5.4 .6));
-            attr1.add_value(AttributeValue::Text("US".to_string()));
-            let mut attr2 = Attribute::new(oid!(2.5.4 .8));
-            attr2.add_value(AttributeValue::Text("CA".to_string()));
-            let mut attr3 = Attribute::new(oid!(2.5.4 .7));
-            attr3.add_value(AttributeValue::Text("LA".to_string()));
-            let mut attr4 = Attribute::new(oid!(2.5.4 .10));
-            attr4.add_value(AttributeValue::Text("example Inc".to_string()));
-            let mut attr5 = Attribute::new(oid!(2.5.4 .11));
-            attr5.add_value(AttributeValue::Text("IoT".to_string()));
-            let mut attr6 = Attribute::new(oid!(2.5.4 .5));
-            attr6.add_value(AttributeValue::Text("Wt1234".to_string()));
-
-            let mut attrs = Attributes::new();
-            attrs.add_attribute(attr1);
-            attrs.add_attribute(attr2);
-            attrs.add_attribute(attr3);
-            attrs.add_attribute(attr4);
-            attrs.add_attribute(attr5);
-            attrs.add_attribute(attr6);
-
-            Name::new(NameValue::Attributes(attrs))
-        }
-
-        fn extensions() -> Extensions {
-            let mut exts = Extensions::new();
-            exts.add_extension(Extension::new(
-                oid!(2.5.29 .19),
-                ExtensionValue::Int(-2),
-                false,
-            ));
-            exts.add_extension(Extension::new(
-                oid!(2.5.29 .14),
-                ExtensionValue::Bytes(
+    #[allow(clippy::too_many_lines)]
+    fn tbs_2() -> (TbsCert, String) {
+        let tbs_certificate = (
+            3,                             // c509_certificate_type
+            9_112_578_475_118_446_130,     // certificate_serial_number
+            oid!(1.2.840 .10045 .4 .3 .2), // issuer_signature_algorithm (ecdsa-with-SHA256)
+            [
+                // issuer
+                (
+                    oid!(2.5.4 .6), // oid (C: countryName)
+                    "US",           // value
+                    false,          // critical
+                ),
+                (
+                    oid!(2.5.4 .8), // oid (ST: stateOrProvinceName)
+                    "CA",           // value
+                    false,          // critical
+                ),
+                (
+                    oid!(2.5.4 .10), // oid (O: organizationName)
+                    "Example Inc",   // value
+                    false,           // critical
+                ),
+                (
+                    oid!(2.5.4 .11), // oid (OU: organizationalUnitName)
+                    "certification", // value
+                    false,           // critical
+                ),
+                (
+                    oid!(2.5.4 .3), // oid (CN: commonName)
+                    "802.1AR CA",   // value
+                    false,          // critical
+                ),
+            ],
+            1_548_934_156,   // validity_not_before
+            253_402_300_799, // validity_not_after
+            [
+                // subject
+                (
+                    oid!(2.5.4 .6), // oid (C: countryName)
+                    "US",           // value
+                    false,          // critical
+                ),
+                (
+                    oid!(2.5.4 .8), // oid (ST: stateOrProvinceName)
+                    "CA",           // value
+                    false,          // critical
+                ),
+                (
+                    oid!(2.5.4 .7), // oid (L: localityName)
+                    "LA",           // value
+                    false,          // critical
+                ),
+                (
+                    oid!(2.5.4 .10), // oid (O: organizationName)
+                    "example Inc",   // value
+                    false,           // critical
+                ),
+                (
+                    oid!(2.5.4 .11), // oid (OU: organizationalUnitName)
+                    "IoT",           // value
+                    false,           // critical
+                ),
+                (
+                    oid!(2.5.4 .5), // oid (serialNumber)
+                    "Wt1234",       // value
+                    false,          // critical
+                ),
+            ],
+            oid!(1.2.840 .10045 .2 .1), /* subject_public_key_algorithm (id-ecPublicKey
+                                         * prime256v1 P-256) */
+            PUBKEY, // subject_public_key (modified from the example)
+            (
+                // extensions
+                (
+                    oid!(2.5.29 .19), // oid (basicConstraints)
+                    -2,               // value
+                    false,            // critical
+                ),
+                (
+                    oid!(2.5.29 .14), // oid (subjectKeyIdentifier)
                     [
                         0x96, 0x60, 0x0D, 0x87, 0x16, 0xBF, 0x7F, 0xD0, 0xE7, 0x52, 0xD0, 0xAC,
                         0x76, 0x07, 0x77, 0xAD, 0x66, 0x5D, 0x02, 0xA0,
-                    ]
-                    .to_vec(),
+                    ], // value
+                    false,            // critical
                 ),
-                false,
-            ));
-            exts.add_extension(Extension::new(
-                oid!(2.5.29 .15),
-                ExtensionValue::Int(5),
-                true,
+                (
+                    oid!(2.5.29 .15), // oid (keyUsage)
+                    5,                // value
+                    true,             // critical
+                ),
+                (
+                    oid!(2.5.29 .17), // oid (subjectAltName)
+                    (
+                        oid!(1.3.6 .1 .4 .1 .6175 .10 .1), // hwType
+                        [0x01, 0x02, 0x03, 0x04],          // hwSerialNum
+                    ),
+                    false, // critical
+                ),
+            ),
+        );
+
+        let tbs_certificate_cbor = [
+                "03", // c509_certificate_type
+                "487e7661d7b54e4632", // certificate_serial_number
+                "00", // issuer_signature_algorithm
+                "8a0462555306624341086b4578616d706c6520496e63096d63657274696669636174696f6e016a3830322e314152204341", // issuer
+                "1a5c52dc0c", // validity_not_before
+                "f6", // validity_not_after
+                "8c046255530662434105624c41086b6578616d706c6520496e630963496f540366577431323334", // subject
+                "01", // subject_public_key_algorithm
+                "4888d0b6b0b37baa46", // subject_public_key
+                "840421015496600d8716bf7fd0e752d0ac760777ad665d02a0210503822082492b06010401b01f0a014401020304", // extensions
+            ];
+
+        // Issuer
+        let mut attributes_1 = Vec::new();
+        for i in 0..tbs_certificate.3.len() {
+            let mut attr = Attribute::new(tbs_certificate.3.get(i).unwrap().0.clone());
+            attr.add_value(AttributeValue::Text(
+                tbs_certificate.3.get(i).unwrap().1.to_string(),
             ));
-            let mut gns = GeneralNames::new();
-            let hw = OtherNameHardwareModuleName::new(oid!(1.3.6 .1 .4 .1 .6175 .10 .1), vec![
-                0x01, 0x02, 0x03, 0x04,
-            ]);
-            gns.add_general_name(GeneralName::new(
-                GeneralNameTypeRegistry::OtherNameHardwareModuleName,
-                GeneralNameValue::OtherNameHWModuleName(hw),
+            attributes_1.push(attr);
+        }
+        let issuer = Name::new(NameValue::Attribute(attributes_1));
+
+        // Subject
+        let mut attributes_2 = Vec::new();
+        for i in 0..tbs_certificate.6.len() {
+            let mut attr = Attribute::new(tbs_certificate.6.get(i).unwrap().0.clone());
+            attr.add_value(AttributeValue::Text(
+                tbs_certificate.6.get(i).unwrap().1.to_string(),
             ));
+            attributes_2.push(attr);
+        }
+        let subject = Name::new(NameValue::Attribute(attributes_2));
+
+        // Extensions
+        let mut extensions = Extensions::new();
+        extensions.add_extension(Extension::new(
+            tbs_certificate.9 .0 .0,
+            ExtensionValue::Int(tbs_certificate.9 .0 .1),
+            tbs_certificate.9 .0 .2,
+        ));
+        extensions.add_extension(Extension::new(
+            tbs_certificate.9 .1 .0,
+            ExtensionValue::Bytes(tbs_certificate.9 .1 .1.to_vec()),
+            tbs_certificate.9 .1 .2,
+        ));
+        extensions.add_extension(Extension::new(
+            tbs_certificate.9 .2 .0,
+            ExtensionValue::Int(tbs_certificate.9 .2 .1),
+            tbs_certificate.9 .2 .2,
+        ));
+        let mut gns = GeneralNames::new();
+        let hw = OtherNameHardwareModuleName::new(
+            tbs_certificate.9 .3 .1 .0,
+            tbs_certificate.9 .3 .1 .1.to_vec(),
+        );
+        gns.add_general_name(GeneralName::new(
+            GeneralNameTypeRegistry::OtherNameHardwareModuleName,
+            GeneralNameValue::OtherNameHWModuleName(hw),
+        ));
+
+        extensions.add_extension(Extension::new(
+            tbs_certificate.9 .3 .0,
+            ExtensionValue::AlternativeName(AlternativeName::new(
+                GeneralNamesOrText::GeneralNames(gns),
+            )),
+            false,
+        ));
+
+        let data = TbsCert::new(
+            tbs_certificate.0,
+            UnwrappedBigUint::new(tbs_certificate.1),
+            IssuerSignatureAlgorithm::new(tbs_certificate.2, None),
+            Some(issuer),
+            Time::new(tbs_certificate.4),
+            Time::new(tbs_certificate.5),
+            subject,
+            SubjectPubKeyAlgorithm::new(tbs_certificate.7, None),
+            tbs_certificate.8.to_vec(),
+            extensions,
+        );
 
-            exts.add_extension(Extension::new(
-                oid!(2.5.29 .17),
-                ExtensionValue::AlternativeName(AlternativeName::new(
-                    GeneralNamesOrText::GeneralNames(gns),
-                )),
-                false,
-            ));
+        let concatenated: String = tbs_certificate_cbor.concat();
 
-            exts
-        }
+        (data, concatenated)
+    }
 
-        let tbs_cert = TbsCert::new(
-            1,
-            UnwrappedBigUint::new(9_112_578_475_118_446_130),
-            IssuerSignatureAlgorithm::new(oid!(1.2.840 .10045 .4 .3 .2), None),
-            Some(names().0),
-            Time::new(1_548_934_156),
-            Time::new(253_402_300_799),
-            subject(),
-            SubjectPubKeyAlgorithm::new(oid!(1.2.840 .10045 .2 .1), None),
-            PUBKEY.to_vec(),
-            extensions(),
-        );
+    #[test]
+    fn encode_decode_tbs_cert_2() {
+        let (tbs_cert, tbs_cert_cbor) = tbs_2();
 
         let mut buffer = Vec::new();
         let mut encoder = Encoder::new(&mut buffer);
         tbs_cert
             .encode(&mut encoder, &mut ())
             .expect("Failed to encode TBS Certificate");
-        // c509_certificate_type: 0x01
-        // certificate_serial_number: 0x487e7661d7b54e4632
-        // issuer: 0x8a0462555306624341086b4578616d706c6520496e63096d63657274696669636174696f6e016a3830322e314152204341
-        // validity_not_before: 0x1a5c52dc0c
-        // validity_not_after: 0xf6
-        // subject: 0x8c046255530662434105624c41086b6578616d706c6520496e630963496f540366577431323334
-        // subject_public_key_algorithm: 0x01
-        // subject_public_key: 0x4888d0b6b0b37baa46
-        // extensions:
-        // 0x840421015496600d8716bf7fd0e752d0ac760777ad665d02a0210503822082492b06010401b01f0a014401020304
-        // issuer_signature_algorithm: 0x00
-        assert_eq!(hex::encode(buffer.clone()),
-         "01487e7661d7b54e46328a0462555306624341086b4578616d706c6520496e63096d63657274696669636174696f6e016a3830322e3141522043411a5c52dc0cf68c046255530662434105624c41086b6578616d706c6520496e630963496f540366577431323334014888d0b6b0b37baa46840421015496600d8716bf7fd0e752d0ac760777ad665d02a0210503822082492b06010401b01f0a01440102030400"
-        );
+        assert_eq!(hex::encode(buffer.clone()), tbs_cert_cbor);
+
         let mut decoder = Decoder::new(&buffer);
         let decoded_tbs =
             TbsCert::decode(&mut decoder, &mut ()).expect("Failed to decode TBS Certificate");
diff --git a/rust/c509-certificate/src/time.rs b/rust/c509-certificate/src/time.rs
index 514687ab230..b3e74a178f9 100644
--- a/rust/c509-certificate/src/time.rs
+++ b/rust/c509-certificate/src/time.rs
@@ -106,6 +106,7 @@ mod test_time {
         let time = Time::new(1_672_531_200);
         time.encode(&mut encoder, &mut ())
             .expect("Failed to encode Time");
+        // 1A 63B0CD00 # unsigned(1672531200)
         assert_eq!(hex::encode(buffer.clone()), "1a63b0cd00");
 
         let mut decoder = minicbor::Decoder::new(&buffer);
diff --git a/rust/cardano-chain-follower/src/metadata/cip509/decode_helper.rs b/rust/cardano-chain-follower/src/metadata/cip509/decode_helper.rs
index 366c20b8923..a75ac3eaa5d 100644
--- a/rust/cardano-chain-follower/src/metadata/cip509/decode_helper.rs
+++ b/rust/cardano-chain-follower/src/metadata/cip509/decode_helper.rs
@@ -8,7 +8,7 @@ pub(crate) fn decode_helper<'a, T, C>(
 ) -> Result<T, decode::Error>
 where T: minicbor::Decode<'a, C> {
     T::decode(d, context).map_err(|e| {
-        decode::Error::message(&format!(
+        decode::Error::message(format!(
             "Failed to decode {:?} in {from}: {e}",
             std::any::type_name::<T>()
         ))
@@ -18,7 +18,7 @@ where T: minicbor::Decode<'a, C> {
 /// Helper function for decoding bytes.
 pub(crate) fn decode_bytes(d: &mut Decoder, from: &str) -> Result<Vec<u8>, decode::Error> {
     d.bytes().map(<[u8]>::to_vec).map_err(|e| {
-        decode::Error::message(&format!(
+        decode::Error::message(format!(
             "Failed to decode bytes in {from}:
             {e}"
         ))
@@ -29,12 +29,12 @@ pub(crate) fn decode_bytes(d: &mut Decoder, from: &str) -> Result<Vec<u8>, decod
 pub(crate) fn decode_array_len(d: &mut Decoder, from: &str) -> Result<u64, decode::Error> {
     d.array()
         .map_err(|e| {
-            decode::Error::message(&format!(
+            decode::Error::message(format!(
                 "Failed to decode array in {from}:
             {e}"
             ))
         })?
-        .ok_or(decode::Error::message(&format!(
+        .ok_or(decode::Error::message(format!(
             "Failed to decode array in {from}, unexpected indefinite length",
         )))
 }

From e49224d8d5f41eda73f9db8e6a71b8f1dd407f8e Mon Sep 17 00:00:00 2001
From: Steven Johnson <sakurainds@gmail.com>
Date: Sat, 21 Sep 2024 15:53:55 +0700
Subject: [PATCH 12/19] test(rust/c509-certificate): break the cache

---
 rust/Earthfile | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/rust/Earthfile b/rust/Earthfile
index 2a74f564b91..5009c1e7acd 100644
--- a/rust/Earthfile
+++ b/rust/Earthfile
@@ -26,6 +26,8 @@ check:
 build:
     FROM +builder
 
+    RUN --no-cache echo "Break Cache"
+
     DO rust-ci+EXECUTE \
         --cmd="/scripts/std_build.py" \
         --output="release/[^\./]+" \

From c04d0b1a1bd369a85ced239893e4cc5b157e85e0 Mon Sep 17 00:00:00 2001
From: Steven Johnson <sakurainds@gmail.com>
Date: Sat, 21 Sep 2024 16:00:49 +0700
Subject: [PATCH 13/19] fix(rust): Lint and lintfix locally in release build
 mode

---
 rust/Justfile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/rust/Justfile b/rust/Justfile
index 8d7081123fe..f7520e0552a 100644
--- a/rust/Justfile
+++ b/rust/Justfile
@@ -26,8 +26,8 @@ code-format:
 
 # Lint the rust code
 code-lint:
-    cargo lintfix
-    cargo lint
+    cargo lintfix -r
+    cargo lint -r
 
 # Pre Push Checks
 pre-push: sync-cfg code-format code-lint license-check

From 01009e7743e0732be795f9633ce8967e52349c77 Mon Sep 17 00:00:00 2001
From: Steven Johnson <sakurainds@gmail.com>
Date: Sat, 21 Sep 2024 16:04:55 +0700
Subject: [PATCH 14/19] test(rust/c509-certificate): rename tbs_cert.rs to
 cert_tbs.rs to test caching in CI

---
 rust/c509-certificate/examples/cli/main.rs             | 2 +-
 rust/c509-certificate/src/c509.rs                      | 2 +-
 rust/c509-certificate/src/{tbs_cert.rs => cert_tbs.rs} | 0
 rust/c509-certificate/src/lib.rs                       | 6 +++---
 rust/c509-certificate/src/wasm_binding.rs              | 2 +-
 5 files changed, 6 insertions(+), 6 deletions(-)
 rename rust/c509-certificate/src/{tbs_cert.rs => cert_tbs.rs} (100%)

diff --git a/rust/c509-certificate/examples/cli/main.rs b/rust/c509-certificate/examples/cli/main.rs
index e408ac96a7a..e636b76c89c 100644
--- a/rust/c509-certificate/examples/cli/main.rs
+++ b/rust/c509-certificate/examples/cli/main.rs
@@ -10,12 +10,12 @@ use asn1_rs::{oid, Oid};
 use c509_certificate::{
     attributes::attribute::Attribute,
     big_uint::UnwrappedBigUint,
+    cert_tbs::TbsCert,
     extensions::Extensions,
     issuer_sig_algo::IssuerSignatureAlgorithm,
     name::{Name, NameValue},
     signing::{PrivateKey, PublicKey},
     subject_pub_key_algo::SubjectPubKeyAlgorithm,
-    tbs_cert::TbsCert,
     time::Time,
 };
 use chrono::{DateTime, Utc};
diff --git a/rust/c509-certificate/src/c509.rs b/rust/c509-certificate/src/c509.rs
index dfd6d7d019f..72c3bc90368 100644
--- a/rust/c509-certificate/src/c509.rs
+++ b/rust/c509-certificate/src/c509.rs
@@ -4,11 +4,11 @@ use minicbor::{encode::Write, Decode, Decoder, Encode, Encoder};
 use serde::{Deserialize, Serialize};
 
 use crate::{
+    cert_tbs::TbsCert,
     helper::{
         decode::{decode_bytes, decode_datatype},
         encode::{encode_bytes, encode_null},
     },
-    tbs_cert::TbsCert,
 };
 
 #[derive(Debug, Clone, PartialEq, Deserialize, Serialize)]
diff --git a/rust/c509-certificate/src/tbs_cert.rs b/rust/c509-certificate/src/cert_tbs.rs
similarity index 100%
rename from rust/c509-certificate/src/tbs_cert.rs
rename to rust/c509-certificate/src/cert_tbs.rs
diff --git a/rust/c509-certificate/src/lib.rs b/rust/c509-certificate/src/lib.rs
index 9fad8b8f0d1..9bda6002151 100644
--- a/rust/c509-certificate/src/lib.rs
+++ b/rust/c509-certificate/src/lib.rs
@@ -37,13 +37,14 @@
 
 use anyhow::anyhow;
 use c509::C509;
+use cert_tbs::TbsCert;
 use minicbor::{Decode, Encode};
 use signing::{PrivateKey, PublicKey};
-use tbs_cert::TbsCert;
 pub mod algorithm_identifier;
 pub mod attributes;
 pub mod big_uint;
 pub mod c509;
+pub mod cert_tbs;
 pub mod extensions;
 pub mod general_names;
 mod helper;
@@ -53,7 +54,6 @@ pub mod oid;
 pub mod signing;
 pub mod subject_pub_key_algo;
 mod tables;
-pub mod tbs_cert;
 pub mod time;
 pub mod wasm_binding;
 
@@ -116,8 +116,8 @@ pub fn verify(c509: &[u8], public_key: &PublicKey) -> anyhow::Result<()> {
 mod test {
     use std::str::FromStr;
 
+    use cert_tbs::test_tbs_cert::tbs_1;
     use signing::tests::private_key_str;
-    use tbs_cert::test_tbs_cert::tbs_1;
 
     use super::*;
 
diff --git a/rust/c509-certificate/src/wasm_binding.rs b/rust/c509-certificate/src/wasm_binding.rs
index 90140408931..b98ee141cc7 100644
--- a/rust/c509-certificate/src/wasm_binding.rs
+++ b/rust/c509-certificate/src/wasm_binding.rs
@@ -6,8 +6,8 @@ use minicbor::Decode;
 use wasm_bindgen::{prelude::wasm_bindgen, JsValue};
 
 use crate::{
+    cert_tbs::TbsCert,
     signing::{PrivateKey, PublicKey},
-    tbs_cert::TbsCert,
 };
 
 /// Wrapper for generate function.

From 84983e430232797d168db73a3e65e10e20b2b9ea Mon Sep 17 00:00:00 2001
From: Steven Johnson <sakurainds@gmail.com>
Date: Mon, 23 Sep 2024 11:29:00 +0700
Subject: [PATCH 15/19] docs(rust/cardano-chain-follower): Fix list of
 enhancements we could do to the chain follower

---
 rust/cardano-chain-follower/Readme.md | 48 +--------------------------
 1 file changed, 1 insertion(+), 47 deletions(-)

diff --git a/rust/cardano-chain-follower/Readme.md b/rust/cardano-chain-follower/Readme.md
index 9e8a4744fb2..a854d294676 100644
--- a/rust/cardano-chain-follower/Readme.md
+++ b/rust/cardano-chain-follower/Readme.md
@@ -1,50 +1,4 @@
-# Things that need fixing
-
-The following fixes would be nice to have to:
-
-1. Improve sync times.
-2. Decrease disk utilization.
-3. Eliminate external dependencies.
-
-## Parallel downloading requires external tool
-
-We currently require an external tool `aria2c` to download the Mithril snapshot.
-We should have a native version to remove this external tool dependency.
-
-See: <https://ochagavia.nl/blog/download-accelerator-async-rust-edition/>
-For a simple version of such we could adapt.
-
-The first version should just replace `Aria2c` and download to a file.
-
-Ideally, we would have an in-memory queue that downloads in parallel, rather than saving to disk.
-This would need to use something like a skip-map to re-order the blocks, and a pool of workers to download the next blocks.
-It's not trivial, but it would remove the necessity to store the actual snapshot archive on-disk.
-
-It's not possible to download the snapshot archive to ram because it is enormous.
-
-## Zstd decompress and tar extraction optimization
-
-Currently, an async zstd decompress and tar extraction is used.
-This is known to be slow, and we are CPU bound doing it.
-
-Change this to run in a Thread outside async and use the zstd library, which links to the C zstd library directly.
-And the non async tar extraction library.  
-
-This will speed up extracting files from the archive.
-
-This would be better also if we had synchronous piped downloading as mentioned above.
-
-## Block Decode Optimization
-
-Currently, to enforce and validate chain integrity, we need to decode the blocks all over the place.
-Decoding blocks is expensive, and this is wasteful.
-As the application will almost certainly require the block to be decoded, it makes sense for it to happen once in a uniform way.  
-We would then pass the decoded block to the application saving it the effort of doing it, itself.
-
-We should Decode LIVE blocks once when we receive them from the network,
-and then keep the decoded as well as raw block data in memory.
-
-For Immutable blocks, we should decode them ONCE when we read them from disk.
+# Improvements TODO
 
 ## Immutable Queue Optimization
 

From 9b9e37f2b5539f7f88d838cd52c81c71ebbc5b35 Mon Sep 17 00:00:00 2001
From: Steven Johnson <sakurainds@gmail.com>
Date: Mon, 23 Sep 2024 11:29:59 +0700
Subject: [PATCH 16/19] ci(rust): Don't break the cache now in a build, but do
 check the cached src == the expected src

---
 rust/Earthfile | 50 +++++++++++++++++++++++++++++++++++++++++++++-----
 1 file changed, 45 insertions(+), 5 deletions(-)

diff --git a/rust/Earthfile b/rust/Earthfile
index 5009c1e7acd..aee4f69bf75 100644
--- a/rust/Earthfile
+++ b/rust/Earthfile
@@ -7,15 +7,40 @@ IMPORT github.com/input-output-hk/catalyst-ci/earthly/rust:v3.2.05 AS rust-ci
 sync-cfg:
     DO rust-ci+SYNC_STD_CFG
 
-# builder : Set up our target toolchains, and copy our files.
-builder:
-    DO rust-ci+SETUP
+COPY_SRC:
+    FUNCTION
+
+    WORKDIR ./build
 
     COPY Cargo.toml clippy.toml deny.toml rustfmt.toml .
     COPY --dir .cargo .config c509-certificate cardano-chain-follower \
                 cbork cbork-abnf-parser cbork-cddl-parser \
                 hermes-ipfs  .
 
+FINGERPRINT_SRC:
+    FUNCTION
+
+    ARG WHENCE=..
+    ARG DIR=build
+    ARG FINGERPRINT=src_fingerprint.txt
+
+    RUN cd $WHENCE; \
+        tar -C ./ -cf - --sort=name --mtime='UTC 2019-01-01' --group=0 --owner=0 --numeric-owner $DIR \
+        | sha256sum  > $FINGERPRINT
+    RUN cat $WHENCE/$FINGERPRINT
+
+
+# builder : Set up our target toolchains, and copy our files.
+builder:
+    DO rust-ci+SETUP
+
+    # Cached copy of the source we build.
+    DO +COPY_SRC
+
+    # Generate Checksums of the source
+    DO +FINGERPRINT_SRC
+    SAVE ARTIFACT ../src_fingerprint.txt 
+
 # check : Run basic check.
 check:
     FROM +builder
@@ -26,8 +51,6 @@ check:
 build:
     FROM +builder
 
-    RUN --no-cache echo "Break Cache"
-
     DO rust-ci+EXECUTE \
         --cmd="/scripts/std_build.py" \
         --output="release/[^\./]+" \
@@ -42,6 +65,23 @@ build:
     SAVE ARTIFACT target/$TARGETARCH/doc doc
     SAVE ARTIFACT target/release/cbork cbork
 
+# build-src-check: Check for any caching issues with the source we are building against.
+check-builder-src-cache:
+    FROM  +builder
+
+    COPY +builder/src_fingerprint.txt .
+
+    RUN --no-cache echo "Cache Disabled"
+
+    # Uncached copy of the source we build.
+    DO +COPY_SRC
+
+    # Generate Checksums of the source
+    DO +FINGERPRINT_SRC --FINGERPRINT=src_fingerprint_uncached.txt
+
+    RUN diff ../src_fingerprint.txt ../src_fingerprint_uncached.txt \
+        || (echo "ERROR: Source fingerprints do not match. Caching Error Detected!!" && exit 1) \
+        && echo "Source fingerprints match. Caching OK."
 
 # local-ci-run: This step simulates the full CI run for local purposes only.
 local-ci-run:

From 391cb8045e0678e592b649c54160ded8fa84b79c Mon Sep 17 00:00:00 2001
From: Steven Johnson <sakurainds@gmail.com>
Date: Tue, 24 Sep 2024 09:16:58 +0700
Subject: [PATCH 17/19] test(rust): In an abundance of caution make sure cached
 src isn't used in the cache check target

---
 rust/Earthfile | 23 +++++++++++++++--------
 1 file changed, 15 insertions(+), 8 deletions(-)

diff --git a/rust/Earthfile b/rust/Earthfile
index aee4f69bf75..e6ceca7537b 100644
--- a/rust/Earthfile
+++ b/rust/Earthfile
@@ -12,10 +12,13 @@ COPY_SRC:
 
     WORKDIR ./build
 
-    COPY Cargo.toml clippy.toml deny.toml rustfmt.toml .
-    COPY --dir .cargo .config c509-certificate cardano-chain-follower \
-                cbork cbork-abnf-parser cbork-cddl-parser \
-                hermes-ipfs  .
+    COPY --keep-ts --dir \
+        Cargo.toml clippy.toml deny.toml rustfmt.toml .cargo .config \
+        c509-certificate \
+        cardano-chain-follower \
+        cbork cbork-abnf-parser cbork-cddl-parser \
+        hermes-ipfs  \
+        .
 
 FINGERPRINT_SRC:
     FUNCTION
@@ -30,10 +33,14 @@ FINGERPRINT_SRC:
     RUN cat $WHENCE/$FINGERPRINT
 
 
-# builder : Set up our target toolchains, and copy our files.
+# builder : Set up our target toolchains.
 builder:
     DO rust-ci+SETUP
 
+# builder_src : Set up our target toolchains, and copy our files.
+builder-src:
+    FROM +builder
+
     # Cached copy of the source we build.
     DO +COPY_SRC
 
@@ -43,13 +50,13 @@ builder:
 
 # check : Run basic check.
 check:
-    FROM +builder
+    FROM +builder-src
 
     DO rust-ci+EXECUTE --cmd="/scripts/std_checks.py"
 
 # build : Build crates.
 build:
-    FROM +builder
+    FROM +builder-src
 
     DO rust-ci+EXECUTE \
         --cmd="/scripts/std_build.py" \
@@ -69,7 +76,7 @@ build:
 check-builder-src-cache:
     FROM  +builder
 
-    COPY +builder/src_fingerprint.txt .
+    COPY +builder-src/src_fingerprint.txt .
 
     RUN --no-cache echo "Cache Disabled"
 

From 3b7bf5bd50ec8886284c3735d1744876198c4b41 Mon Sep 17 00:00:00 2001
From: bkioshn <bkioshn@gmail.com>
Date: Mon, 30 Sep 2024 12:02:30 +0700
Subject: [PATCH 18/19] fix(rust) earthfile

Signed-off-by: bkioshn <bkioshn@gmail.com>
---
 rust/Earthfile | 49 +++----------------------------------------------
 1 file changed, 3 insertions(+), 46 deletions(-)

diff --git a/rust/Earthfile b/rust/Earthfile
index 4ad9d45000a..cd1d38dfe02 100644
--- a/rust/Earthfile
+++ b/rust/Earthfile
@@ -7,33 +7,7 @@ IMPORT github.com/input-output-hk/catalyst-ci/earthly/rust:v3.2.05 AS rust-ci
 sync-cfg:
     DO rust-ci+SYNC_STD_CFG
 
-COPY_SRC:
-    FUNCTION
-
-    WORKDIR ./build
-
-    COPY --keep-ts --dir \
-        Cargo.toml clippy.toml deny.toml rustfmt.toml .cargo .config \
-        c509-certificate \
-        cardano-chain-follower \
-        cbork cbork-abnf-parser cbork-cddl-parser \
-        hermes-ipfs  \
-        .
-
-FINGERPRINT_SRC:
-    FUNCTION
-
-    ARG WHENCE=..
-    ARG DIR=build
-    ARG FINGERPRINT=src_fingerprint.txt
-
-    RUN cd $WHENCE; \
-        tar -C ./ -cf - --sort=name --mtime='UTC 2019-01-01' --group=0 --owner=0 --numeric-owner $DIR \
-        | sha256sum  > $FINGERPRINT
-    RUN cat $WHENCE/$FINGERPRINT
-
-
-# builder : Set up our target toolchains.
+# builder : Set up our target toolchains, and copy our files.
 builder:
     DO rust-ci+SETUP
 
@@ -49,13 +23,13 @@ builder:
 
 # check : Run basic check.
 check:
-    FROM +builder-src
+    FROM +builder
 
     DO rust-ci+EXECUTE --cmd="/scripts/std_checks.py"
 
 # build : Build crates.
 build:
-    FROM +builder-src
+    FROM +builder
 
     DO rust-ci+EXECUTE \
         --cmd="/scripts/std_build.py" \
@@ -69,23 +43,6 @@ build:
     SAVE ARTIFACT target/$TARGETARCH/doc doc
     SAVE ARTIFACT target/release/cbork cbork
 
-# build-src-check: Check for any caching issues with the source we are building against.
-check-builder-src-cache:
-    FROM  +builder
-
-    COPY +builder-src/src_fingerprint.txt .
-
-    RUN --no-cache echo "Cache Disabled"
-
-    # Uncached copy of the source we build.
-    DO +COPY_SRC
-
-    # Generate Checksums of the source
-    DO +FINGERPRINT_SRC --FINGERPRINT=src_fingerprint_uncached.txt
-
-    RUN diff ../src_fingerprint.txt ../src_fingerprint_uncached.txt \
-        || (echo "ERROR: Source fingerprints do not match. Caching Error Detected!!" && exit 1) \
-        && echo "Source fingerprints match. Caching OK."
 
 # local-ci-run: This step simulates the full CI run for local purposes only.
 local-ci-run:

From 84fe964a0f1f80981aa418f4d367ad8d63415b09 Mon Sep 17 00:00:00 2001
From: bkioshn <35752733+bkioshn@users.noreply.github.com>
Date: Thu, 3 Oct 2024 16:04:51 +0700
Subject: [PATCH 19/19] fix(rust/c509-certificate): update docs  (#39)

* fix(rust/c509-certificate): docs

Signed-off-by: bkioshn <bkioshn@gmail.com>

* fix(rust/c509-certificate): spelling

Signed-off-by: bkioshn <bkioshn@gmail.com>

* fix(rust/c509-certificate): anyhow format

Signed-off-by: bkioshn <bkioshn@gmail.com>

* docs(rust/c509-certificate): make doc clearer

Signed-off-by: bkioshn <bkioshn@gmail.com>

---------

Signed-off-by: bkioshn <bkioshn@gmail.com>
---
 .../c509-cert-plutus-restricted.cddl          | 83 +++++++++----------
 rust/c509-certificate/examples/cli/main.rs    |  6 +-
 .../src/algorithm_identifier.rs               |  4 +-
 .../src/attributes/attribute.rs               |  9 +-
 rust/c509-certificate/src/attributes/mod.rs   |  2 +-
 rust/c509-certificate/src/cert_tbs.rs         |  9 +-
 rust/c509-certificate/src/extensions/mod.rs   |  7 +-
 .../src/general_names/general_name.rs         |  4 +
 .../c509-certificate/src/general_names/mod.rs |  4 +
 .../src/issuer_sig_algo/mod.rs                |  5 +-
 rust/c509-certificate/src/lib.rs              | 24 ++++--
 rust/c509-certificate/src/name/mod.rs         |  2 +-
 rust/c509-certificate/src/oid.rs              |  3 +-
 .../src/subject_pub_key_algo/mod.rs           |  6 +-
 14 files changed, 93 insertions(+), 75 deletions(-)

diff --git a/docs/src/catalyst-standards/draft-cips/c509-plutus-restricted-certificate/c509-cert-plutus-restricted.cddl b/docs/src/catalyst-standards/draft-cips/c509-plutus-restricted-certificate/c509-cert-plutus-restricted.cddl
index 6247eaa0892..69eed33abe7 100644
--- a/docs/src/catalyst-standards/draft-cips/c509-plutus-restricted-certificate/c509-cert-plutus-restricted.cddl
+++ b/docs/src/catalyst-standards/draft-cips/c509-plutus-restricted-certificate/c509-cert-plutus-restricted.cddl
@@ -1,73 +1,64 @@
 ; This c509 Certificate format is based upon:
 ; https://datatracker.ietf.org/doc/draft-ietf-cose-cbor-encoded-cert/11/
 ; And is restricted/customized to better enable compatibility with Plutus scripts
-; that would consume them, without loosing necessary features of x509
+; that would consume them, without losing necessary features of x509
 ; Not all x509 features are supported and some fields have different semantics to improve
 ; certificate size and ability to be processed by Plutus Scripts.
 
-; cspell: words reencoded, biguint 
+; cspell: words reencoded, biguint, stake1uyehkck0lajq8gr28t9uxnuvgcqrc6070x3k9r8048z8y5gh6ffgw
 
-C509CertificatePlutusRestrictedSubset = [ TBSCertificate, issuerSignatureValue: ed25519Signature, ]
+C509CertificatePlutusRestrictedSubset = [
+    TBSCertificate, 
+    issuerSignatureValue: ed25519Signature
+]
 
 ; The elements of the following group are used in a CBOR Sequence:
 TBSCertificate = (
-	c509CertificateType: int, ; Always 2 as natively signed C509 certificate following X.509 v3
-	certificateSerialNumber: CertificateSerialNumber, ; Can be ignored/set to 0 or used as intended.
-	issuerSignatureAlgorithm: AlgorithmIdentifier, ; Must be int(12) = Ed25519
-	issuer: Name / null, ; If set to null, use the `subject`. This could be an on-chain reference to
-						   the issuer cert, what would be the best way?  Transaction hash/cert hash?
-	validityNotBefore: ~time, ; UTC
-	validityNotAfter: ~time / null, ; UTC
-	subject: Name, ; Reference to on-chain keys related to this certificate
-	subjectPublicKeyAlgorithm: AlgorithmIdentifier, ; Must be int(12) = Ed25519
-	subjectPublicKey: any, ; Ed25519 public key
-	extensions: Extensions, ; Currently support extensions with basic CBOR types and Alternative Name
+    c509CertificateType: int, ; Always 2 as a natively signed
+    certificateSerialNumber: CertificateSerialNumber, ; Can be ignored/set to 0 or used as intended.
+    issuerSignatureAlgorithm: AlgorithmIdentifier, ; Must be int(12) = Ed25519
+    issuer: Name / null, ; If the 'issuer' field is identical to the 'subject' field (in case of self-signed), then it must be encoded as CBOR null 
+                         ; This could be an on-chain reference to the issuer cert. What would be the best way? Transaction hash/cert hash?
+    validityNotBefore: ~time, ; c509 uses UTC
+    validityNotAfter: ~time / null, ; c509 uses UTC, no expiration date must be set to null
+    subject: Name, ; Reference to on-chain keys related to this certificate
+    subjectPublicKeyAlgorithm: AlgorithmIdentifier, ; Must be int(12) = Ed25519
+    subjectPublicKey: subjectPublicKey, ; Ed25519 public key
+    extensions: Extensions ; Set to [] if no Extensions provided
 )
 
 CertificateSerialNumber = ~biguint
 
-Name = [ * Attribute ] / text / bytes
-
-Attribute = (
-	( attributeType: int, attributeValue: text )
-	// ( attributeType: oid, attributeValue: bytes )
-	// CardanoPublicKey
-)
-
-subjectPublicKey = bytes .size (32..32); Ed25519 public key stored in bytes, adjust size of this if other key types are supported.  
+; Currently ONLY AlgorithmIdentifier int(12) - Ed25519 is supported.
+; oid and [ algorithm: oid, parameters: bytes ] are not supported by Plutus.
+AlgorithmIdentifier = int / ~oid / [ algorithm: ~oid, parameters: bytes ]
 
-; This is a completely custom Attribute,  which is only for use with Plutus scripts.
-; attributeType = The type of Cardano key we associate with this certificate.
-; proof = Does the transaction require proof that the key is owned by the transaction signer?
-; attributeValue = The Cardano public key hash of the attribute type
+Name = [ * Attribute ] / text / bytes
 
-CardanoPublicKey = ( attributeType: &cardanoKeyTypes proof: bool, attributeValue: bytes .size (28..28) )
+Attribute = ( attributeType: int, attributeValue: text ) 
+          // ( attributeType: ~oid, attributeValue: bytes )
 
-cardanoKeyTypes = (
-	paymentKeyHash: 0,
-	stakeKeyHash: 1,
-	drepVerificationKeyHash: 2,
-	ccColdVerificationKeyHash: 3,
-	ccHotVerificationKeyHash: 4,
-)
+subjectPublicKey = bytes .size (32..32) ; Ed25519 public key stored in bytes, adjust size if other key types are supported.
 
-; For `~time` Plutus will need to convert the Unix epoch timestamp to the nearest slot number
+; For ~time, Plutus will need to convert the Unix epoch timestamp to the nearest slot number
 ; validityNotBefore rounds up to the next Slot after that time.
 ; validityNotAfter rounds down to the next Slot before that time.
 
-ed25519Signature = bstr .size 64; Ed25519 signature must be tagged to identify their type.
+ed25519Signature = bstr .size 64 ; Ed25519 signature must be tagged to identify their type.
 
-; Currently ONLY AlgorithmIdentifier int(12) - Ed25519 is supported.
-; oid and [ algorithm: oid, parameters: bytes ] are not supported by Plutus.
-AlgorithmIdentifier = (int
-	/ ~oid
-	/ [ algorithm: ~oid, parameters: bytes ])
+; The only Extension supported is int(3) = SubjectAltName where GeneralNames need to be 
+; int(6) = uniformResourceIdentifier.
+; This uniformResourceIdentifier must conform to the URI based line in CIP-0134:
+; https://github.com/input-output-hk/catalyst-CIPs/tree/cip13-simple-cardano-address-extension/CIP-0134
+; for example, web+cardano://addr/stake1uyehkck0lajq8gr28t9uxnuvgcqrc6070x3k9r8048z8y5gh6ffgw
 
-; Extensions are not currently supported by plutus and should be set to []
-; Any extensions present in the certificate will be ignored by plutus scripts.
 Extensions = [ * Extension ] / int
 
 Extension = (
-	( extensionID: int, extensionValue: any )
-	// ( extensionID: ~oid, ? critical: true, extensionValue: bytes )
+    ( extensionID: int, extensionValue: any )
+    // ( extensionID: ~oid, ? critical: true, extensionValue: bytes )
 )
+
+SubjectAltName = GeneralNames / text
+GeneralNames = [ + GeneralName ]
+GeneralName = ( GeneralNameType: int, GeneralNameValue: any )
\ No newline at end of file
diff --git a/rust/c509-certificate/examples/cli/main.rs b/rust/c509-certificate/examples/cli/main.rs
index e636b76c89c..ddc750f8e78 100644
--- a/rust/c509-certificate/examples/cli/main.rs
+++ b/rust/c509-certificate/examples/cli/main.rs
@@ -98,7 +98,7 @@ impl Cli {
 struct C509Json {
     /// Indicate whether the certificate is self-signed.
     self_signed: bool,
-    /// Optional certificate type, if not provided, set to 0 as self-signed.
+    /// Optional certificate type, if not provided, set to 2 as self-signed.
     certificate_type: Option<u8>,
     /// Optional serial number of the certificate,
     /// if not provided, a random number will be generated.
@@ -234,7 +234,7 @@ fn validate_certificate_type(
 ) -> anyhow::Result<()> {
     if self_signed && certificate_type.unwrap_or(SELF_SIGNED_INT) != SELF_SIGNED_INT {
         return Err(anyhow::anyhow!(
-            "Certificate type must be 0 if self-signed is true"
+            "Certificate type must be {SELF_SIGNED_INT} if self-signed is true"
         ));
     }
     Ok(())
@@ -264,7 +264,7 @@ fn parse_or_default_date(date_option: Option<String>, default: u64) -> Result<u6
                         .try_into()
                         .map_err(|_| anyhow::anyhow!("Timestamp is invalid"))
                 })?
-                .map_err(|e| anyhow::anyhow!(format!("Failed to parse date {date}: {e}",)))
+                .map_err(|e| anyhow::anyhow!("Failed to parse date {date}: {e}"))
         },
         None => Ok(default),
     }
diff --git a/rust/c509-certificate/src/algorithm_identifier.rs b/rust/c509-certificate/src/algorithm_identifier.rs
index 1d2e8c26644..c30d7d32bf7 100644
--- a/rust/c509-certificate/src/algorithm_identifier.rs
+++ b/rust/c509-certificate/src/algorithm_identifier.rs
@@ -1,14 +1,14 @@
 //! C509 Algorithm Identifier
 //!
 //! This module handle the `AlgorithmIdentifier` type where OID does not fall into the
-//! table.
+//! registry table.
 //!
 //! ```cddl
 //!    AlgorithmIdentifier = int / ~oid / [ algorithm: ~oid, parameters: bytes ]
 //! ```
 //!
 //! **Note** `AlgorithmIdentifier` that have the same OID with different parameters are
-//! not implemented yet.
+//! not supported yet.
 //!
 //! For more information about `AlgorithmIdentifier`,
 //! visit [C509 Certificate](https://datatracker.ietf.org/doc/draft-ietf-cose-cbor-encoded-cert/11/)
diff --git a/rust/c509-certificate/src/attributes/attribute.rs b/rust/c509-certificate/src/attributes/attribute.rs
index 60da994d00f..5eb871fd9e8 100644
--- a/rust/c509-certificate/src/attributes/attribute.rs
+++ b/rust/c509-certificate/src/attributes/attribute.rs
@@ -5,6 +5,13 @@
 //!             ( attributeType: ~oid, attributeValue: bytes ) //
 //! ```
 //!
+//! In some case attributeValue can have multiple values.
+//!
+//! ```cddl
+//! Attributes = ( attributeType: int, attributeValue: [+text] ) //
+//!              ( attributeType: ~oid, attributeValue: [+bytes] )
+//! ```
+//!
 //! For more information about Attribute,
 //! visit [C509 Certificate](https://datatracker.ietf.org/doc/draft-ietf-cose-cbor-encoded-cert/11/)
 
@@ -145,7 +152,7 @@ impl Decode<'_, ()> for Attribute {
             let oid = get_oid_from_int(i).map_err(minicbor::decode::Error::message)?;
             Attribute::new(oid.clone())
         } else {
-            // Handle unwrapped CBOR OID or CBOR PEN
+            // Handle unwrapped CBOR OID
             let c509_oid: C509oid = d.decode()?;
             Attribute::new(c509_oid.oid().clone())
         };
diff --git a/rust/c509-certificate/src/attributes/mod.rs b/rust/c509-certificate/src/attributes/mod.rs
index ef4dd5a8fb4..d56ee25a245 100644
--- a/rust/c509-certificate/src/attributes/mod.rs
+++ b/rust/c509-certificate/src/attributes/mod.rs
@@ -7,7 +7,7 @@
 //!
 //! Use case:
 //! ```cddl
-//!     SubjectDirectoryAttributes = [+Attributes]
+//! SubjectDirectoryAttributes = [+Attributes]
 //! ```
 //!
 //! For more information about `Attributes`,
diff --git a/rust/c509-certificate/src/cert_tbs.rs b/rust/c509-certificate/src/cert_tbs.rs
index c909c53ae17..fb80182ed8a 100644
--- a/rust/c509-certificate/src/cert_tbs.rs
+++ b/rust/c509-certificate/src/cert_tbs.rs
@@ -1,4 +1,4 @@
-//! To Be Sign Certificate (TBS Certificate) use to construct a C509 certificate.
+//! C509 certificate To Be Sign Certificate (TBS Certificate)
 
 use minicbor::{encode::Write, Decode, Decoder, Encode, Encoder};
 use serde::{Deserialize, Serialize};
@@ -184,9 +184,10 @@ impl Decode<'_, ()> for TbsCert {
 // ------------------Test----------------------
 
 // Notes
-// - Test is modified to match the current encode and decode where `subject_public_key`
-//   doesn't support
-// special case for rsaEncryption and id-ecPublicKey.
+// - The test from https://datatracker.ietf.org/doc/draft-ietf-cose-cbor-encoded-cert/11/
+// currently uses `subject_public_key` id-ecPublicKey, which has special encoding and
+// decoding that this crate does not yet support. Hence, this test has
+// been modified to align with the current encoding and decoding.
 // - Currently support natively signed c509 certificate, so all text strings
 // are UTF-8 encoded and all attributeType SHALL be non-negative
 // - Some Extension values are not supported yet.
diff --git a/rust/c509-certificate/src/extensions/mod.rs b/rust/c509-certificate/src/extensions/mod.rs
index 1f5ac45801e..a93eff2ca02 100644
--- a/rust/c509-certificate/src/extensions/mod.rs
+++ b/rust/c509-certificate/src/extensions/mod.rs
@@ -1,11 +1,10 @@
-//! C509 Extension as a part of `TBSCertificate` used in C509 Certificate.
+//! C509 Extensions
 //!
 //! Extension fallback of C509 OID extension
-//! Given OID if not found in the registered OID table, it will be encoded as an unwrapped
-//! OID.
+//! Given OID, if it is found in the registered OID table, int value of the
+//! associated OID will be used, if not, it will be encoded as an unwrapped OID (~oid).
 //!
 //! ```cddl
-//! Extensions and Extension can be encoded as the following:
 //! Extensions = [ * Extension ] / int
 //! Extension = ( extensionID: int, extensionValue: any ) //
 //!             ( extensionID: ~oid, ? critical: true,
diff --git a/rust/c509-certificate/src/general_names/general_name.rs b/rust/c509-certificate/src/general_names/general_name.rs
index 98b10bd9835..9cce5cc59df 100644
--- a/rust/c509-certificate/src/general_names/general_name.rs
+++ b/rust/c509-certificate/src/general_names/general_name.rs
@@ -1,5 +1,9 @@
 //! C509 General Name
 //!
+//! ```cddl
+//! GeneralName = ( GeneralNameType : int, GeneralNameValue : any )
+//! ```
+//!
 //! For more information about `GeneralName`,
 //! visit [C509 Certificate](https://datatracker.ietf.org/doc/draft-ietf-cose-cbor-encoded-cert/11/)
 
diff --git a/rust/c509-certificate/src/general_names/mod.rs b/rust/c509-certificate/src/general_names/mod.rs
index a36530333e6..86f6e3488a4 100644
--- a/rust/c509-certificate/src/general_names/mod.rs
+++ b/rust/c509-certificate/src/general_names/mod.rs
@@ -1,5 +1,9 @@
 //! C509 General Names
 //!
+//! ```cddl
+//! GeneralNames = [ + GeneralName ]
+//! ```
+//!
 //! For more information about `GeneralNames`,
 //! visit [C509 Certificate](https://datatracker.ietf.org/doc/draft-ietf-cose-cbor-encoded-cert/11/)
 
diff --git a/rust/c509-certificate/src/issuer_sig_algo/mod.rs b/rust/c509-certificate/src/issuer_sig_algo/mod.rs
index ce31e8b23fd..3fb049d2fae 100644
--- a/rust/c509-certificate/src/issuer_sig_algo/mod.rs
+++ b/rust/c509-certificate/src/issuer_sig_algo/mod.rs
@@ -1,9 +1,12 @@
-//! C509 Issuer Signature Algorithm as a part of `TBSCertificate` used in C509
+//! C509 Issuer Signature Algorithm
 //! Certificate.
 //!
 //! ```cddl
 //! issuerSignatureAlgorithm: AlgorithmIdentifier
 //! ```
+//!
+//! For more information about `issuerSignatureAlgorithm`,
+//! visit [C509 Certificate](https://datatracker.ietf.org/doc/draft-ietf-cose-cbor-encoded-cert/11/)
 
 mod data;
 
diff --git a/rust/c509-certificate/src/lib.rs b/rust/c509-certificate/src/lib.rs
index 9bda6002151..b60c0cade77 100644
--- a/rust/c509-certificate/src/lib.rs
+++ b/rust/c509-certificate/src/lib.rs
@@ -2,7 +2,11 @@
 //!
 //! This crate provides a functionality for generating C509 Certificate.
 //!
-//! ## C509 certificate contains 2 parts
+//! Please refer to the [C509 Certificate](https://datatracker.ietf.org/doc/draft-ietf-cose-cbor-encoded-cert/11/) for more information.
+//!
+//! ## C509 certificate structure
+//!
+//! A C509 certificate is a CBOR encoded X.509 certificate. It consists of two main parts:
 //! 1. `TBSCertificate`
 //! 2. `issuerSignatureValue`
 //!
@@ -13,27 +17,29 @@
 //! # TBS Certificate
 //!
 //! The To Be Sign Certificate contains the following fields:
-//!    * c509CertificateType: A certificate type, whether 0 a natively signed C509
-//!      certificate following X.509 v3 or 1 a CBOR re-encoded X.509 v3 DER certificate.
+//!    * c509CertificateType: A certificate type, where 2 indicates a natively signed C509
+//!      certificate following X.509 v3 or 3 indicates CBOR re-encoded X.509 v3 DER
+//!      certificate.
 //!    * certificateSerialNumber: A unique serial number for the certificate.
-//!    * issuer: The entity that issued the certificate.
+//!    * subjectPublicKeyAlgorithm: Specifies the cryptographic algorithm used for the
+//!      `subjectPublicKey`.
+//!    * issuer: The entity that issued the certificate. In the case of a self-signed
+//!      certificate, the issuer is identical to the subject.
 //!    * validityNotBefore: The duration for which the Certificate Authority (CA)
 //!      guarantees it will retain information regarding the certificate's status on which
 //!      the period begins.
 //!    * validityNotAfter: The duration for which the Certificate Authority (CA)
 //!      guarantees it will retain information regarding the certificate's status on which
-//!      the period ends.
+//!      the period ends. This can be set to no expiry date.
 //!    * subject: The entity associated with the public key stored in the subject public
 //!      key field.
-//!    * subjectPublicKeyAlgorithm: The algorithm that the public key is used.
 //!    * subjectPublicKey: The public key of the subject.
 //!    * extensions: A list of extensions defined for X.509 v3 certificate, providing
 //!      additional attributes for users or public keys, and for managing relationships
 //!      between Certificate Authorities (CAs).
 //!    * issuerSignatureAlgorithm: The algorithm used to sign the certificate (must be the
 //!      algorithm uses to create `IssuerSignatureValue`).
-//!
-//! Please refer to the [C509 Certificate](https://datatracker.ietf.org/doc/draft-ietf-cose-cbor-encoded-cert/11/) for more information.
+//
 
 use anyhow::anyhow;
 use c509::C509;
@@ -68,7 +74,7 @@ pub mod wasm_binding;
 ///
 /// # Errors
 ///
-/// Returns an error if tne data cannot be converted to CBOR bytes.
+/// Returns an error if the generated data is invalid.
 
 pub fn generate(tbs_cert: &TbsCert, private_key: Option<&PrivateKey>) -> anyhow::Result<Vec<u8>> {
     // Encode the TbsCert
diff --git a/rust/c509-certificate/src/name/mod.rs b/rust/c509-certificate/src/name/mod.rs
index 78d1c404e36..e385926f7d6 100644
--- a/rust/c509-certificate/src/name/mod.rs
+++ b/rust/c509-certificate/src/name/mod.rs
@@ -1,7 +1,7 @@
 //! C509 type Name
 //!
 //! Currently only support natively signed c509 certificate, so all text strings
-//! are UTF-8 encoded and all attributeType should be non-negative.
+//! are UTF-8 encoded and all attributeType should be positive.
 //!
 //! ```cddl
 //! Name = [ * Attribute ] / text / bytes
diff --git a/rust/c509-certificate/src/oid.rs b/rust/c509-certificate/src/oid.rs
index 52ba8e37781..a3f45be75d7 100644
--- a/rust/c509-certificate/src/oid.rs
+++ b/rust/c509-certificate/src/oid.rs
@@ -21,7 +21,8 @@ use crate::{
 pub struct C509oidRegistered {
     /// The `C509oid`.
     c509_oid: C509oid,
-    /// The registration table.
+    /// The registration lookup table for associated int to OID.
+    /// Each C509 field or type can have different registration table.
     registration_table: &'static IntegerToOidTable,
 }
 
diff --git a/rust/c509-certificate/src/subject_pub_key_algo/mod.rs b/rust/c509-certificate/src/subject_pub_key_algo/mod.rs
index 380b2675196..b3d923bd1c7 100644
--- a/rust/c509-certificate/src/subject_pub_key_algo/mod.rs
+++ b/rust/c509-certificate/src/subject_pub_key_algo/mod.rs
@@ -1,10 +1,12 @@
-//! C509 Issuer Signature Algorithm as a part of `TBSCertificate` used in C509
+//! C509 Issuer Signature Algorithm
 //! Certificate.
 //!
 //! ```cddl
 //! subjectPublicKeyAlgorithm: AlgorithmIdentifier
 //! ```
-
+//!
+//! For more information about `subjectPublicKeyAlgorithm`,
+//! visit [C509 Certificate](https://datatracker.ietf.org/doc/draft-ietf-cose-cbor-encoded-cert/11/)
 // cspell: words spka
 
 mod data;