code: func revCheck(cert *x509.Certificate) (revoked, ok bool, err error) {
  	for _, url := range cert.CRLDistributionPoints {
  		if ldapURL(url) {
  			log.Infof("skipping LDAP CRL: %s", url)
  			continue
  		}
  
  		if revoked, ok, err := certIsRevokedCRL(cert, url); !ok {
  			log.Warning("error checking revocation via CRL")
  			if HardFail {
  				return true, false, err
  			}
  			return false, false, err
  		} else if revoked {
  			log.Info("certificate is revoked via CRL")
  			return true, true, err
  		}
  	}
  
  	if revoked, ok, err := certIsRevokedOCSP(cert, HardFail); !ok {
  		log.Warning("error checking revocation via OCSP")
  		if HardFail {
  			return true, false, err
  		}
  		return false, false, err
  	} else if revoked {
  		log.Info("certificate is revoked via OCSP")
  		return true, true, err
  	}
  
  	return false, true, nil
  }
docs: // revCheck should check the certificate for any revocations. It
  // returns a pair of booleans: the first indicates whether the certificate
  // is revoked, the second indicates whether the revocations were
  // successfully checked.. This leads to the following combinations:
  //
  //  false, false: an error was encountered while checking revocations.
  //
  //  false, true:  the certificate was checked successfully and
  //                  it is not revoked.
  //
  //  true, true:   the certificate was checked successfully and
  //                  it is revoked.
  //
  //  true, false:  failure to check revocation status causes
  //                  verification to fail