code: func makeCertificate(certPEMBlock, keyPEMBlock []byte) (Certificate, error) {
  	var cert Certificate
  
  	// Convert to a tls.Certificate
  	tlsCert, err := tls.X509KeyPair(certPEMBlock, keyPEMBlock)
  	if err != nil {
  		return cert, err
  	}
  	if len(tlsCert.Certificate) == 0 {
  		return cert, errors.New("certificate is empty")
  	}
  	cert.Certificate = tlsCert
  
  	// Parse leaf certificate, extract relevant metadata, and staple OCSP
  	leaf, err := x509.ParseCertificate(tlsCert.Certificate[0])
  	if err != nil {
  		return cert, err
  	}
  	err = fillCertFromLeaf(&cert, leaf)
  	if err != nil {
  		return cert, err
  	}
  	err = stapleOCSP(&cert, certPEMBlock)
  	if err != nil {
  		log.Printf("[WARNING] Stapling OCSP: %v", err)
  	}
  
  	return cert, nil
  }
docs: // makeCertificate turns a certificate PEM bundle and a key PEM block into
  // a Certificate, with OCSP and other relevant metadata tagged with it,
  // except for the OnDemand and Managed flags. It is up to the caller to
  // set those properties.