code: func (p *MintParams) Validate() error {
  	// Check FDQN.
  	fqdn, err := p.MachineFQDN()
  	if err != nil {
  		return err
  	}
  	chunks := strings.SplitN(fqdn, ".", 2)
  	if len(chunks) != 2 {
  		return fmt.Errorf("not a valid FQDN %q", fqdn)
  	}
  	domain := chunks[1] // e.g. "us-central1-a.c.project-id.internal"
  
  	// Check DomainConfig for given domain.
  	domainCfg := domainConfig(p.Config, domain)
  	if domainCfg == nil {
  		return fmt.Errorf("the domain %q is not whitelisted in the config", domain)
  	}
  	if domainCfg.MachineTokenLifetime <= 0 {
  		return fmt.Errorf("machine tokens for machines in domain %q are not allowed", domain)
  	}
  
  	// Make sure cert serial number fits into uint64. We don't support negative or
  	// giant SNs.
  	sn := p.Cert.SerialNumber
  	if sn.Sign() <= 0 || sn.Cmp(maxUint64) >= 0 {
  		return fmt.Errorf("invalid certificate serial number: %s", sn)
  	}
  	return nil
  }
docs: // Validate checks that token minting parameters are allowed.