code: func extractCertURI(certs []*x509.Certificate) (*url.URL, error) {
  	if len(certs) < 1 {
  		return nil, errors.New("no peer certificate presented")
  	}
  
  	// Only check the first cert assuming this is the only leaf. It's not clear if
  	// services might ever legitimately present multiple leaf certificates or if
  	// the slice is just to allow presenting the whole chain of intermediates.
  	cert := certs[0]
  
  	// Our certs will only ever have a single URI for now so only check that
  	if len(cert.URIs) < 1 {
  		return nil, errors.New("peer certificate invalid")
  	}
  
  	return cert.URIs[0], nil
  }
docs: // extractCertURI returns the first URI SAN from the leaf certificate presented
  // in the slice. The slice is expected to be the passed from
  // tls.Conn.ConnectionState().PeerCertificates and requires that the leaf has at
  // least one URI and the first URI is the correct one to use.