I have recently stumbled across a certificate, that when reencoded by node-forge results in a certificate that differs slightly from the actual certificate.

MCV sample (forge 0.8.0): https://jsfiddle.net/9m5v4ct7/3/

The problem appears to be an AlgorithmIdentifier that is PSS with exotic but technically valid Parameters (unfortunately used in some productive certificates from a large CA):

 SEQUENCE
  OBJECT            :rsassaPss
  SEQUENCE
   cont [ 0 ]
    SEQUENCE
     OBJECT            :sha256
   cont [ 1 ]
    SEQUENCE
     OBJECT            :mgf1
     SEQUENCE
      OBJECT            :sha256

When encoding the certificate extracted from the PKCS#12, forge emits the following AlgorithmIdentifier in the unsigned parts of the certificate:

 SEQUENCE
  OBJECT            :rsassaPss
  SEQUENCE
   cont [ 0 ]
    SEQUENCE
     OBJECT            :sha256
     NULL
   cont [ 1 ]
    SEQUENCE
     OBJECT            :mgf1
     SEQUENCE
      OBJECT            :sha256
      NULL
   cont [ 2 ]
    INTEGER           :14

This is semantically equivalent, but not binary identical to the AlgId inside the TBSCertificate. There are actually two different issues here:

1. the usual NULL parameter is added to the digest algorithm identifiers, although not originally present
2. the saltLength 20 (0x14) is emitted, but should not be included since it is the default value (although it should be 32 (0x20) when used with SHA-256, but technically ...)

I will work on a patch that addresses these issues. Is there something I should look out for?