code: func intermediateCAScan(addr, hostname string) (grade Grade, output Output, err error) {
  	cidr, port, _ := net.SplitHostPort(addr)
  	_, ipnet, err := net.ParseCIDR(cidr)
  	if err != nil {
  		return Skipped, nil, nil
  	}
  	b, err := bundler.NewBundler(caBundleFile, intBundleFile)
  	if err != nil {
  		return
  	}
  	var wg sync.WaitGroup
  	wg.Add(numWorkers)
  	dialer := &net.Dialer{Timeout: timeout}
  	config := &tls.Config{InsecureSkipVerify: true}
  	addrs := make(chan string)
  	chains := make(chan []*x509.Certificate, numWorkers)
  	go func() {
  		for chain := range chains {
  			b.Bundle(chain, nil, bundler.Force)
  		}
  	}()
  	for i := 0; i < numWorkers; i++ {
  		go func() {
  			for addr := range addrs {
  				conn, err := tls.DialWithDialer(dialer, Network, addr, config)
  				if err != nil {
  					continue
  				}
  				conn.Close()
  				if conn.ConnectionState().HandshakeComplete {
  					chains <- conn.ConnectionState().PeerCertificates
  				}
  			}
  			wg.Done()
  		}()
  	}
  	for ip := ipnet.IP.To16(); ipnet.Contains(ip); incrementBytes(ip) {
  		addrs <- net.JoinHostPort(ip.String(), port)
  	}
  	close(addrs)
  	wg.Wait()
  	close(chains)
  	grade = Good
  	return
  }
docs: // intermediateCAScan scans for new intermediate CAs not in the trust store.