logger.FatalIf(err, "Failed to read root CAs (%v)", err)

	// Add the global public crts as part of global root CAs
	for _, publicCrt := range globalPublicCerts {
		globalRootCAs.AddCert(publicCrt)
	}

	// Register root CAs for remote ENVs
	env.RegisterGlobalCAs(globalRootCAs)

	globalEndpoints, setupType, err = createServerEndpoints(globalMinioAddr, ctxt.Layout.pools, ctxt.Layout.legacy)

				return
			}
			if intermediates == nil {
				intermediates = x509.NewCertPool()
			}
			intermediates.AddCert(cert)
		} else {
			peerCertificates = append(peerCertificates, cert)
		}
	}
	r.TLS.PeerCertificates = peerCertificates

	// Now, we have to check that the client has provided exactly one leaf

pkg crypto/x509, func ParsePKCS8PrivateKey([]uint8) (interface{}, error)
pkg crypto/x509, func ParsePKIXPublicKey([]uint8) (interface{}, error)
pkg crypto/x509, method (*CertPool) AddCert(*Certificate)
pkg crypto/x509, method (*CertPool) AppendCertsFromPEM([]uint8) bool
pkg crypto/x509, method (*CertPool) Subjects() [][]uint8
pkg crypto/x509, method (*Certificate) CheckCRLSignature(*pkix.CertificateList) error