pkg crypto/x509, const ExtKeyUsageMicrosoftCommercialCodeSigning = 12
pkg crypto/x509, const ExtKeyUsageMicrosoftCommercialCodeSigning ExtKeyUsage
pkg crypto/x509, const ExtKeyUsageMicrosoftKernelCodeSigning = 13
pkg crypto/x509, const ExtKeyUsageMicrosoftKernelCodeSigning ExtKeyUsage
pkg crypto/x509, const NameConstraintsWithoutSANs = 6
pkg crypto/x509, const NameConstraintsWithoutSANs InvalidReason

	if !globalIAMSys.STSTLSConfig.InsecureSkipVerify { // Verify whether the client certificate has been issued by a trusted CA.
		_, err := certificate.Verify(x509.VerifyOptions{
			KeyUsages: []x509.ExtKeyUsage{
				x509.ExtKeyUsageClientAuth,
			},
			Intermediates: intermediates,
			Roots:         globalRootCAs,
		})
		if err != nil {
			writeSTSErrorResponse(ctx, w, ErrSTSInvalidClientCertificate, err)