code: func filterExternalCAURLS(ctx context.Context, desiredCert, defaultCert []byte, apiExternalCAs []*api.ExternalCA) (urls []string) {
  	desiredCert = NormalizePEMs(desiredCert)
  
  	// TODO(aaronl): In the future, this will be abstracted with an ExternalCA interface that has different
  	// implementations for different CA types. At the moment, only CFSSL is supported.
  	for i, extCA := range apiExternalCAs {
  		// We want to support old external CA specifications which did not have a CA cert.  If there is no cert specified,
  		// we assume it's the old cert
  		certForExtCA := extCA.CACert
  		if len(certForExtCA) == 0 {
  			certForExtCA = defaultCert
  		}
  		certForExtCA = NormalizePEMs(certForExtCA)
  		if extCA.Protocol != api.ExternalCA_CAProtocolCFSSL {
  			log.G(ctx).Debugf("skipping external CA %d (url: %s) due to unknown protocol type", i, extCA.URL)
  			continue
  		}
  		if !bytes.Equal(certForExtCA, desiredCert) {
  			log.G(ctx).Debugf("skipping external CA %d (url: %s) because it has the wrong CA cert", i, extCA.URL)
  			continue
  		}
  		urls = append(urls, extCA.URL)
  	}
  	return
  }
docs: // filterExternalCAURLS returns a list of external CA urls filtered by the desired cert.