code: func validateCertificateWithConfig(cert *x509.Certificate, baseName string, cfg *certutil.Config) error {
  	for _, dnsName := range cfg.AltNames.DNSNames {
  		if err := cert.VerifyHostname(dnsName); err != nil {
  			return errors.Wrapf(err, "certificate %s is invalid", baseName)
  		}
  	}
  	for _, ipAddress := range cfg.AltNames.IPs {
  		if err := cert.VerifyHostname(ipAddress.String()); err != nil {
  			return errors.Wrapf(err, "certificate %s is invalid", baseName)
  		}
  	}
  	return nil
  }
docs: // validateCertificateWithConfig makes sure that a given certificate is valid at
  // least for the SANs defined in the configuration.