RFC 1114 Certificate Encoding

Concerning Appendix A.1 and Jeff Thompson's comments on it, I
don't find X.509 particularly ambiguous as to the syntax of a
(signed) certificate (the same can't be said for other portions of
the standard, though).  The SIGNED macro expands to
 
        SEQUENCE {
                ToBeSigned,             -- data being signed
                AlgorithmIdentifier,
                ENCRYPTED OCTET STRING }        -- signature
 
and ENCRYPTED expands to a BIT STRING.  The data being signed is
a SEQUENCE as shown in Appendix A.1 of RFC 1114.  So the SEQUENCE
shown above contains a SEQUENCE, algorithm ID, and BIT STRING. There
is no need to re-encode anything as an octet string.  The signed
certificate is a
 
        SEQUENCE {
                SEQUENCE { ... the certificate components ...},
                AlgorithmIdentifier,
                BIT STRING }            -- the signature
 
 
Regards,
Rich