code: static PemEncoded toPEM(ByteBufAllocator allocator, boolean useDirect,
              X509Certificate... chain) throws CertificateEncodingException {
  
          if (chain == null || chain.length == 0) {
              throw new IllegalArgumentException("X.509 certificate chain can't be null or empty");
          }
  
          // We can take a shortcut if there is only one certificate and
          // it already happens to be a PemEncoded instance. This is the
          // ideal case and reason why all this exists. It allows the user
          // to pass pre-encoded bytes straight into OpenSSL without having
          // to do any of the extra work.
          if (chain.length == 1) {
              X509Certificate first = chain[0];
              if (first instanceof PemEncoded) {
                  return ((PemEncoded) first).retain();
              }
          }
  
          boolean success = false;
          ByteBuf pem = null;
          try {
              for (X509Certificate cert : chain) {
  
                  if (cert == null) {
                      throw new IllegalArgumentException("Null element in chain: " + Arrays.toString(chain));
                  }
  
                  if (cert instanceof PemEncoded) {
                      pem = append(allocator, useDirect, (PemEncoded) cert, chain.length, pem);
                  } else {
                      pem = append(allocator, useDirect, cert, chain.length, pem);
                  }
              }
  
              PemValue value = new PemValue(pem, false);
              success = true;
              return value;
          } finally {
              // Make sure we never leak the PEM's ByteBuf in the event of an Exception
              if (!success && pem != null) {
                  pem.release();
              }
          }
      }
docs: Creates a {@link PemEncoded} value from the {@link X509Certificate}s.