code: func VerifyCertificateChain(certificateChain []*x509.Certificate) error {
  	// chain needs at least one certificate
  	if len(certificateChain) == 0 {
  		return trace.BadParameter("need at least one certificate in chain")
  	}
  
  	// extract leaf of certificate chain. it is safe to index into the chain here
  	// because readCertificateChain always returns a valid chain with at least
  	// one certificate.
  	leaf := certificateChain[0]
  
  	// extract intermediate certificate chain.
  	intermediates := x509.NewCertPool()
  	if len(certificateChain) > 1 {
  		for _, v := range certificateChain[1:len(certificateChain)] {
  			intermediates.AddCert(v)
  		}
  	}
  
  	// verify certificate chain, roots is nil which will cause us to to use the
  	// system roots.
  	opts := x509.VerifyOptions{
  		Intermediates: intermediates,
  	}
  	_, err := leaf.Verify(opts)
  	if err != nil {
  		return trace.Wrap(err)
  	}
  
  	return nil
  }
docs: // VerifyCertificateChain reads in chain of certificates and makes sure the
  // chain from leaf to root is valid. This ensures that clients (web browsers
  // and CLI) won't have problem validating the chain.