code: function tryVerify (rawBytes) {
    const {
      tbsCertificate,
      tbsCertificate: {
        validity: {
          notBefore: { value: notBefore },
          notAfter: { value: notAfter }
        }
      },
      signatureAlgorithm: { algorithm },
      signature: { data: signature }
    } = Certificate.decode(rawBytes, 'der')
  
    // Require sha512WithRSAEncryption.
    if (algorithm.join('.') !== '1.2.840.113549.1.1.13') {
      return false
    }
  
    // Check if certificate is still valid.–
    const now = Date.now()
    if (now < notBefore || now > notAfter) {
      return false
    }
    // Make sure the certificate was signed by CloudFlare's origin pull
    // certificate authority.
    const verifier = createVerify('RSA-SHA512')
    verifier.update(TBSCertificate.encode(tbsCertificate, 'der'))
    return verifier.verify(originPullCa, signature)
  }
docs: N.B. This only checks if the timestamps are valid and if the signature matches. Proper certificate validation requires more checks but that seems unnecessary in this case.