api/server.go
func validateTLSCertificate(c *tls.Certificate, roots *x509.CertPool) error {
	configHost, err := config.GetString("host")
	if err != nil {
		return err
	}
	urlHost, err := url.Parse(configHost)
	if err != nil {
		return err
	}
	hostname := urlHost.Hostname()
	if c == nil || len(c.Certificate) == 0 {
		return errors.New("there is no certificate provided")
	}
	var intermediateCertPool *x509.CertPool
	if len(c.Certificate) > 1 {
		intermediateCertPool = x509.NewCertPool()
		for i := 1; i < len(c.Certificate); i++ {
			var intermerdiateCert *x509.Certificate
			if intermerdiateCert, err = x509.ParseCertificate(c.Certificate[i]); err != nil {
				return err
			}
			intermediateCertPool.AddCert(intermerdiateCert)
		}
	}
	leafCert, err := x509.ParseCertificate(c.Certificate[0])
	if err != nil {
		return err
	}
	_, err = leafCert.Verify(x509.VerifyOptions{
		DNSName:       hostname,
		Roots:         roots,
		Intermediates: intermediateCertPool,
	})
	return err
}
func validateTLSCertificate(c *tls.Certificate, roots *x509.CertPool) error {
	configHost, err := config.GetString("host")
	if err != nil {
		return err
	}
	urlHost, err := url.Parse(configHost)
	if err != nil {
		return err
	}
	hostname := urlHost.Hostname()
	if c == nil || len(c.Certificate) == 0 {
		return errors.New("there is no certificate provided")
	}
	var intermediateCertPool *x509.CertPool
	if len(c.Certificate) > 1 {
		intermediateCertPool = x509.NewCertPool()
		for i := 1; i < len(c.Certificate); i++ {
			var intermerdiateCert *x509.Certificate
			if intermerdiateCert, err = x509.ParseCertificate(c.Certificate[i]); err != nil {
				return err
			}
			intermediateCertPool.AddCert(intermerdiateCert)
		}
	}
	leafCert, err := x509.ParseCertificate(c.Certificate[0])
	if err != nil {
		return err
	}
	_, err = leafCert.Verify(x509.VerifyOptions{
		DNSName:       hostname,
		Roots:         roots,
		Intermediates: intermediateCertPool,
	})
	return err
}
// validateTLSCertificate checks if c is ready for use in a production env. When
// c is not a good one, returns a non-nil error describing the problem, otherwise
// returns nil indicating success.
//
// A good certificate should be issued (even though indirectly, when providing
// intermediates) by roots; within the issuing time boundary; and, match the
// Common Name or SAN extension with the server's hostname (defined by "host"
// entry in the API config file). See x509.Verify to more detailed info.