expected: false,
		},
	}
	for id, tc := range testCases {
		t.Run(id, func(t *testing.T) {
			certExpired, err := IsCertExpired(tc.filepath)
			if err != nil {
				t.Fatalf("failed to check the cert, err is: %v", err)
			}
			if certExpired != tc.expected {
				t.Errorf("isCertExpired: get %v, want %v", certExpired, tc.expected)
			}
		})
	}

	if !rootCert.IsCA {
		return nil, fmt.Errorf("found root cert is not a ca type cert: %v", rootCert)
	}

	return cert, nil
}

// IsCertExpired returns  whether a cert expires
func IsCertExpired(filepath string) (bool, error) {
	var err error
	var certPEMBlock []byte
	certPEMBlock, err = os.ReadFile(filepath)
	if err != nil {

		GetClientCertificate: func(*tls.CertificateRequestInfo) (*tls.Certificate, error) {
			var certificate tls.Certificate
			key, cert := opts.Key, opts.Cert
			if key != "" && cert != "" {
				isExpired, err := util.IsCertExpired(opts.Cert)
				if err != nil {
					log.Warnf("cannot parse the cert chain, using token instead: %v", err)
					return &certificate, nil
				}
				if isExpired {
					log.Warnf("cert expired, using token instead")