code: func verifyChain(tlsCfg *tls.Config, rawCerts [][]byte, client bool) (*x509.Certificate, error) {
  
  	// Fetch leaf and intermediates. This is based on code form tls handshake.
  	if len(rawCerts) < 1 {
  		return nil, errors.New("tls: no certificates from peer")
  	}
  	certs := make([]*x509.Certificate, len(rawCerts))
  	for i, asn1Data := range rawCerts {
  		cert, err := x509.ParseCertificate(asn1Data)
  		if err != nil {
  			return nil, errors.New("tls: failed to parse certificate from peer: " + err.Error())
  		}
  		certs[i] = cert
  	}
  
  	cas := tlsCfg.RootCAs
  	if client {
  		cas = tlsCfg.ClientCAs
  	}
  
  	opts := x509.VerifyOptions{
  		Roots:         cas,
  		Intermediates: x509.NewCertPool(),
  	}
  	if !client {
  		// Server side only sets KeyUsages in tls. This defaults to ServerAuth in
  		// x509 lib. See
  		// https://github.com/golang/go/blob/ee7dd810f9ca4e63ecfc1d3044869591783b8b74/src/crypto/x509/verify.go#L866-L868
  		opts.KeyUsages = []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth}
  	}
  
  	// All but the first cert are intermediates
  	for _, cert := range certs[1:] {
  		opts.Intermediates.AddCert(cert)
  	}
  	_, err := certs[0].Verify(opts)
  	return certs[0], err
  }
docs: // verifyChain performs standard TLS verification without enforcing remote
  // hostname matching.