docs: def cert_chain(certs):
      """Validate PEM-encoded X.509 certificate chain.
  
      See `validate.request` for additional info.
  
      Args:
          certs: list. The certificate chain as a list of
              cryptography.hazmat.backends.openssl.x509._Certificate certificates.
              See `validate.retrieve` to create certs obj.
  
      Returns:
          bool: True if valid, False otherwise.
      """
      if len(certs) < 2:
          warnings.warn('Certificate chain contains < 3 certificates.')
          return False
  
      cert = certs[0]
      today = datetime.datetime.today()
      if not today > cert.not_valid_before:
          warnings.warn('Certificate Not Before date is invalid.')
          return False
      if not today < cert.not_valid_after:
          warnings.warn('Certificate Not After date is invalid.')
          return False
  
      oid_san = x509.oid.ExtensionOID.SUBJECT_ALTERNATIVE_NAME
      ext = cert.extensions.get_extension_for_oid(oid_san)
      sans = ext.value.get_values_for_type(x509.DNSName)
      if not 'echo-api.amazon.com' in sans:
          return False
  
      for i in range(len(certs) - 1):
          if not certs[i].issuer == certs[i + 1].subject:
              return False
  
      return True