Function validate_for_domain 

pub fn validate_for_domain(
    domain: &str,
    cert_pem: &[u8],
    key_pem: &[u8],
) -> ProxyResult<CertificateFacts>

Check a PEM certificate chain and key, and report what they cover.

Four things, each of which has to hold before this certificate can serve a domain:

1. The chain and the key parse.
2. The key belongs to the certificate. Delegated to rustls, which compares the public keys — this is the check whose absence produces a listener that fails every handshake with no clue why.
3. The leaf has not expired.
4. The leaf covers domain, wildcards included.