Description

In Go 1.24, the field PolicyIdentifiers on x509.Certificate has changed, and only Policies is marshaled by default. See this in https://pkg.go.dev/crypto/x509#CreateCertificate:

The PolicyIdentifier and Policies fields can both be used to marshal certificate policy OIDs. By default, only the Policies is marshaled, but if the GODEBUG setting "x509usepolicies" has the value "0", the PolicyIdentifiers field will be marshaled instead of the Policies field. This changed in Go 1.24. The Policies field can be used to marshal policy OIDs which have components that are larger than 31 bits.

This will be the default behavior once go.mod is set to 1.24