Wrap []byte for DER certificates in its own type.

acme/client.go

@@ -357,7 +357,7 @@ func (c *Client) requestCertificate(authz *authorizationResource, result chan Ce
 			// Otherwise the body is the certificate.
 			if len(cert) > 0 {
 				cerRes.CertStableURL = resp.Header.Get("Content-Location")
-				cerRes.Certificate = pemEncode(cert)
+				cerRes.Certificate = pemEncode(derCertificateBytes(cert))
 				result <- cerRes
 			} else {
 				// The certificate was granted but is not yet issued.

acme/crypto.go

@@ -10,6 +10,8 @@ import (
 	"time"
 )
 
+type derCertificateBytes []byte
+
 func generatePrivateKey(keyLength int) (*rsa.PrivateKey, error) {
 	return rsa.GenerateKey(rand.Reader, keyLength)
 }
@@ -30,7 +32,7 @@ func pemEncode(data interface{}) []byte {
 	case *rsa.PrivateKey:
 		pemBlock = &pem.Block{Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(key)}
 		break
-	case []byte:
+	case derCertificateBytes:
 		pemBlock = &pem.Block{Type: "CERTIFICATE", Bytes: data.([]byte)}
 	}