code: func validateExternalCAURL(dialer *net.Dialer, tlsOpts *tls.Config, caURL string) error {
  	parsed, err := url.Parse(caURL)
  	if err != nil {
  		return err
  	}
  	if parsed.Scheme != "https" {
  		return errors.New("invalid HTTP scheme")
  	}
  	host, port, err := net.SplitHostPort(parsed.Host)
  	if err != nil {
  		// It either has no port or is otherwise invalid (e.g. too many colons).  If it's otherwise invalid the dialer
  		// will error later, so just assume it's no port and set the port to the default HTTPS port.
  		host = parsed.Host
  		port = "443"
  	}
  
  	conn, err := tls.DialWithDialer(dialer, "tcp", net.JoinHostPort(host, port), tlsOpts)
  	if conn != nil {
  		conn.Close()
  	}
  	return err
  }
docs: // Checks that a CA URL is connectable using the credentials we have and that its server certificate is signed by the
  // root CA that we expect.  This uses a TCP dialer rather than an HTTP client; because we have custom TLS configuration,
  // if we wanted to use an HTTP client we'd have to create a new transport for every connection.  The docs specify that
  // Transports cache connections for future re-use, which could cause many open connections.