}
	return parsed.TrustDomain, nil
}

// RetrieveSpiffeBundleRootCerts retrieves the trusted CA certificates from a list of SPIFFE bundle endpoints.
// It can use the system cert pool and the supplied certificates to validate the endpoints.
func RetrieveSpiffeBundleRootCerts(config map[string]string, caCertPool *x509.CertPool, retryTimeout time.Duration) (

				t.Fatalf("failed to get SystemCertPool: %v", err)
			}
			for _, cert := range c.extraCerts {
				caCertPool.AddCert(cert)
			}

			// This is the system-under-test.
			rootCertMap, err := RetrieveSpiffeBundleRootCerts(c.in, caCertPool, time.Millisecond*50)

			if c.errContains != "" {
				if err == nil {
					t.Fatalf("got nil error; wanted error to contain %q", c.errContains)
				}