if opts.Client != nil && opts.CAContentProvider != nil {
		return nil, fmt.Errorf("oidc: Client and CAContentProvider are mutually exclusive")
	}

	client := opts.Client

	if client == nil {
		var roots *x509.CertPool
		var err error
		if opts.CAContentProvider != nil {
			// TODO(enj): make this reload CA data dynamically
			roots, err = certutil.NewPoolFromBytes(opts.CAContentProvider.CurrentCABundleContent())
			if err != nil {

	for _, cert := range certs {
		pemBlock.Bytes = cert.Raw
		pem.Encode(file, pemBlock)
	}

	return file
}

func testChainAgainstOpenSSL(t *testing.T, leaf *Certificate, intermediates, roots *CertPool) (string, error) {
	args := []string{"verify", "-no_check_time"}

	rootsFile := writePEMsToTempFile(allCerts(t, roots))
	if debugOpenSSLFailure {
		println("roots file:", rootsFile.Name())
	} else {

}

// configRootCAs configures and returns a reference to tls.Config instance if CAFile is provided
func (evc ExternalEtcdVersionCheck) configRootCAs(config *tls.Config) (*tls.Config, error) {
	var CACertPool *x509.CertPool
	if evc.Etcd.External.CAFile != "" {
		CACert, err := os.ReadFile(evc.Etcd.External.CAFile)
		if err != nil {
			return nil, errors.Wrapf(err, "couldn't load external etcd's server certificate %s", evc.Etcd.External.CAFile)

		{"X25519", Const, 8},
		{"X509KeyPair", Func, 0},
	},
	"crypto/x509": {
		{"(*CertPool).AddCert", Method, 0},
		{"(*CertPool).AddCertWithConstraint", Method, 22},
		{"(*CertPool).AppendCertsFromPEM", Method, 0},
		{"(*CertPool).Clone", Method, 19},
		{"(*CertPool).Equal", Method, 19},
		{"(*CertPool).Subjects", Method, 0},
		{"(*Certificate).CheckCRLSignature", Method, 0},

			logf("%s", p)
			return len(p), nil
		}), "", 0)
	}).ts

	certpool := x509.NewCertPool()
	certpool.AddCert(ts.Certificate())

	c := &Client{Transport: &Transport{
		TLSClientConfig: &tls.Config{
			ServerName: "dns-is-faked.golang",
			RootCAs:    certpool,
		},
	}}

	trace := &httptrace.ClientTrace{

pkg crypto/tls, type CertificateVerificationError struct, Err error #48152
pkg crypto/tls, type CertificateVerificationError struct, UnverifiedCertificates []*x509.Certificate #48152
pkg crypto/x509, func SetFallbackRoots(*CertPool) #43958
pkg debug/elf, const R_LARCH_32_PCREL = 99 #54222
pkg debug/elf, const R_LARCH_32_PCREL R_LARCH #54222
pkg debug/elf, const R_LARCH_ABS64_HI12 = 70 #54222
pkg debug/elf, const R_LARCH_ABS64_HI12 R_LARCH #54222