// parsing discards the order of the extensions. The signature from SCT we're verifying
// is over the TBSCertificate in its original form, including the order of the extensions.
// Get the list of extensions, in its original order, minus the poison extension.
try (ASN1InputStream aIn = new ASN1InputStream(preCertificate.getEncoded())) {
org.bouncycastle.asn1.x509.Certificate parsedPreCertificate =
org.bouncycastle.asn1.x509.Certificate.getInstance(aIn.readObject());
// Make sure that we have the X509akid of the real issuer if:
// The PreCertificate has this extension, AND:
// The PreCertificate was signed by a PreCertificate signing cert.
if (hasX509AuthorityKeyIdentifier(parsedPreCertificate) &&
issuerInformation.issuedByPreCertificateSigningCert()) {