This is an otherwise valid input to ParseSignature(), however the signature was changed from a BIT STRING to an OCTET STRING. $ openssl asn1parse -i < [CERTIFICATE] 0:d=0 hl=2 l= 12 cons: SEQUENCE 2:d=1 hl=2 l= 2 cons: SEQUENCE 4:d=2 hl=2 l= 0 prim: NULL 6:d=1 hl=2 l= 2 cons: SEQUENCE 8:d=2 hl=2 l= 0 prim: NULL 10:d=1 hl=2 l= 2 prim: OCTET STRING [HEX DUMP]:0102 -----BEGIN CERTIFICATE----- MAwwAgUAMAIFAAQCAQI= -----END CERTIFICATE-----