code: func ParseOneCertificateFromPEM(certsPEM []byte) ([]*x509.Certificate, []byte, error) {
  
  	block, rest := pem.Decode(certsPEM)
  	if block == nil {
  		return nil, rest, nil
  	}
  
  	cert, err := x509.ParseCertificate(block.Bytes)
  	if err != nil {
  		pkcs7data, err := pkcs7.ParsePKCS7(block.Bytes)
  		if err != nil {
  			return nil, rest, err
  		}
  		if pkcs7data.ContentInfo != "SignedData" {
  			return nil, rest, errors.New("only PKCS #7 Signed Data Content Info supported for certificate parsing")
  		}
  		certs := pkcs7data.Content.SignedData.Certificates
  		if certs == nil {
  			return nil, rest, errors.New("PKCS #7 structure contains no certificates")
  		}
  		return certs, rest, nil
  	}
  	var certs = []*x509.Certificate{cert}
  	return certs, rest, nil
  }
docs: // ParseOneCertificateFromPEM attempts to parse one PEM encoded certificate object,
  // either a raw x509 certificate or a PKCS #7 structure possibly containing
  // multiple certificates, from the top of certsPEM, which itself may
  // contain multiple PEM encoded certificate objects.