import (
  "regex"
  (...)
  "k8s.io/klog/v2"
)

(...)

func extractCertAndCA(resp *casapi.Certificate) (cert []byte, ca []byte, err error) {
	klog.Info("Starting extractCertAndCA")
	defer klog.Info("Quit extractCertAndCA")
	if resp == nil {
		return nil, nil, errors.New("extractCertAndCA: certificate response is nil")
	}

	certBuf := &bytes.Buffer{}
	var certs []string

	re := regexp.MustCompile(`(?sU)-{5}BEGIN CERTIFICATE(?:.+)END CERTIFICATE-{5}`)

	// parse the certificate and store it in certs slice
	match := re.FindString(resp.PemCertificate)
	if match == "" {
		return nil, nil, errors.New("extractCertAndCA: leaf certificate is not properly parsed")
	}
	certs = append(certs, match)

	klog.Info("The original Certificate Chain length is ", len(resp.PemCertificateChain))
	// Write any remaining certificates except for the root-most one
	// for _, c := range resp.PemCertificateChain[:len(resp.PemCertificateChain)-1] {
	for _, casCert := range resp.PemCertificateChain {
		match := re.FindAllString(casCert, -1)
		if len(match) == 0 {
			return nil, nil, errors.New("extractCertAndCA: the certificate chain is not properly parsed")
		}
		// Append all matched certs from the certificate chain to the certs slice
		certs = append(certs, match...)
	}

	for _, cert := range certs[:len(certs)-1] {
		// For all the certificate chain, but the most root one (CA cert)
		// We write it to the cert buffer
		certBuf.WriteString(cert)
		certBuf.WriteRune('\n')
	}

	klog.Info("Finally, the Certificate Chain length is ", len(certs)-1, ", including the leaf certificate")
	// Return the root-most certificate in the CA field.
	return certBuf.Bytes(), []byte(certs[len(certs)-1] + "\n"), nil
}