def select_role_certificates(rd, use, certs):
    """extend *certs* (a list) by certificates used by role descriptor *rd*.

  Note: *rd* may be ``None``.
  """
    if rd is None:
        return
    for kd in rd.KeyDescriptor:
        if use is None or kd.use is None or use == kd.use:
            ki = kd.KeyInfo
            for x509 in getattr(ki, 'X509Data', ()):
                cert = getattr(x509, 'X509Certificate', None)
                if cert is not None:
                    certs.append(cert[0])
