code: func decodeCACert(certPem string) (cert *x509.Certificate, certDer []byte, err error) {
  	certDer, err = utils.ParsePEM(certPem, "CERTIFICATE")
  	if err != nil {
  		return nil, nil, fmt.Errorf("bad PEM - %s", err)
  	}
  	switch cert, err = x509.ParseCertificate(certDer); {
  	case err != nil:
  		return nil, nil, fmt.Errorf("bad cert - %s", err)
  	case !cert.IsCA:
  		return nil, nil, fmt.Errorf("not a CA cert")
  	default:
  		return cert, certDer, nil
  	}
  }
docs: // decodeCACert parses x509 pem-encoded certificate and checks it is a CA cert.
  //
  // Returns the decoded cert, as well as its der-encoded representation.