func loadCert(data []byte) ([]byte, error) {
    var certBlock *pem.Block

    for certBlock == nil {
        if data == nil || len(data) == 0 {
            return nil, errors.New(".pem file must have both a CERTIFICATE and an RSA PRIVATE KEY section")
        }

        block, rest := pem.Decode(data)
        if block == nil {
            return nil, errors.New("invalid .pem file")
        }

        switch block.Type {
        case "CERTIFICATE":
            if certBlock != nil {
                return nil, errors.New("multiple CERTIFICATE sections in .pem file")
            }

            certBlock = block
        }

        data = rest
    }

    return certBlock.Bytes, nil
}