code: func validateHasAtLeastOneExternalCA(ctx context.Context, externalCAs map[string][]*api.ExternalCA, securityConfig *ca.SecurityConfig,
  	wantedCert []byte, desc string) ([]*api.ExternalCA, error) {
  	specific, ok := externalCAs[string(wantedCert)]
  	if ok {
  		pool := x509.NewCertPool()
  		pool.AppendCertsFromPEM(wantedCert)
  		dialer := net.Dialer{Timeout: 5 * time.Second}
  		opts := tls.Config{
  			RootCAs:      pool,
  			Certificates: securityConfig.ClientTLSCreds.Config().Certificates,
  		}
  		for i, ca := range specific {
  			if ca.Protocol == api.ExternalCA_CAProtocolCFSSL {
  				if err := validateExternalCAURL(&dialer, &opts, ca.URL); err != nil {
  					log.G(ctx).WithError(err).Warnf("external CA # %d is unreachable or invalid", i+1)
  				} else {
  					return specific, nil
  				}
  			}
  		}
  	}
  	return nil, status.Errorf(codes.InvalidArgument, "there must be at least one valid, reachable external CA corresponding to the %s CA certificate", desc)
  }
docs: // Validates that there is at least 1 reachable, valid external CA for the given CA certificate.  Returns true if there is, false otherwise.
  // Requires that the wanted cert is already normalized.