code: func ParseCertificatesDER(certsDER []byte, password string) (certs []*x509.Certificate, key crypto.Signer, err error) {
  	certsDER = bytes.TrimSpace(certsDER)
  	pkcs7data, err := pkcs7.ParsePKCS7(certsDER)
  	if err != nil {
  		var pkcs12data interface{}
  		certs = make([]*x509.Certificate, 1)
  		pkcs12data, certs[0], err = pkcs12.Decode(certsDER, password)
  		if err != nil {
  			certs, err = x509.ParseCertificates(certsDER)
  			if err != nil {
  				return nil, nil, cferr.New(cferr.CertificateError, cferr.DecodeFailed)
  			}
  		} else {
  			key = pkcs12data.(crypto.Signer)
  		}
  	} else {
  		if pkcs7data.ContentInfo != "SignedData" {
  			return nil, nil, cferr.Wrap(cferr.CertificateError, cferr.DecodeFailed, errors.New("can only extract certificates from signed data content info"))
  		}
  		certs = pkcs7data.Content.SignedData.Certificates
  	}
  	if certs == nil {
  		return nil, key, cferr.New(cferr.CertificateError, cferr.DecodeFailed)
  	}
  	return certs, key, nil
  }
docs: // ParseCertificatesDER parses a DER encoding of a certificate object and possibly private key,
  // either PKCS #7, PKCS #12, or raw x509.