code: func checkChainSSLServerPolicy(c *Certificate, chainCtx *syscall.CertChainContext, opts *VerifyOptions) error {
  	servernamep, err := syscall.UTF16PtrFromString(opts.DNSName)
  	if err != nil {
  		return err
  	}
  	sslPara := &syscall.SSLExtraCertChainPolicyPara{
  		AuthType:   syscall.AUTHTYPE_SERVER,
  		ServerName: servernamep,
  	}
  	sslPara.Size = uint32(unsafe.Sizeof(*sslPara))
  
  	para := &syscall.CertChainPolicyPara{
  		ExtraPolicyPara: uintptr(unsafe.Pointer(sslPara)),
  	}
  	para.Size = uint32(unsafe.Sizeof(*para))
  
  	status := syscall.CertChainPolicyStatus{}
  	err = syscall.CertVerifyCertificateChainPolicy(syscall.CERT_CHAIN_POLICY_SSL, chainCtx, para, &status)
  	if err != nil {
  		return err
  	}
  
  	// TODO(mkrautz): use the lChainIndex and lElementIndex fields
  	// of the CertChainPolicyStatus to provide proper context, instead
  	// using c.
  	if status.Error != 0 {
  		switch status.Error {
  		case syscall.CERT_E_EXPIRED:
  			return CertificateInvalidError{c, Expired}
  		case syscall.CERT_E_CN_NO_MATCH:
  			return HostnameError{c, opts.DNSName}
  		case syscall.CERT_E_UNTRUSTEDROOT:
  			return UnknownAuthorityError{c, nil, nil}
  		default:
  			return UnknownAuthorityError{c, nil, nil}
  		}
  	}
  
  	return nil
  }
docs: // checkChainSSLServerPolicy checks that the certificate chain in chainCtx is valid for
  // use as a certificate chain for a SSL/TLS server.