How can the legitimacy of a digital certificate be verified?

To verify the legitimacy of a digital certificate in Go, the following steps are usually performed:

1. Certificate signature verification — ensure that the certificate is signed by a trusted certification authority (CA).
2. Certificate chain validation — ensure that the chain from the certificate to the root CA is correct and trusted.
3. Expiration check — the certificate must be valid (not expired).
4. Revocation check — using CRL or OCSP.

In Go, the crypto/x509 package is used for this purpose. An example of certificate verification:

import (
    "crypto/x509"
    "encoding/pem"
    "io/ioutil"
    "log"
)

func verifyCert(certPEM []byte, roots *x509.CertPool) error {
    block, _ := pem.Decode(certPEM)
    if block == nil {
        return fmt.Errorf("failed to parse certificate PEM")
    }
    cert, err := x509.ParseCertificate(block.Bytes)
    if err != nil {
        return err
    }

    opts := x509.VerifyOptions{
        Roots: roots,
    }

    _, err = cert.Verify(opts)
    return err
}

Here, roots is a set of trusted root certificates. If cert.Verify does not return an error, the certificate is considered legitimate.