util/gtld.go
func CertificateSubjInTLD(c *x509.Certificate, label string) bool {
	label = strings.ToLower(label)
	if strings.HasPrefix(label, ".") {
		label = label[1:]
	}
	if !IsInTLDMap(label) {
		return false
	}
	for _, name := range append(c.DNSNames, c.Subject.CommonName) {
		if strings.HasSuffix(name, "."+label) {
			return true
		}
	}
	return false
}
func CertificateSubjInTLD(c *x509.Certificate, label string) bool {
	label = strings.ToLower(label)
	if strings.HasPrefix(label, ".") {
		label = label[1:]
	}
	if !IsInTLDMap(label) {
		return false
	}
	for _, name := range append(c.DNSNames, c.Subject.CommonName) {
		if strings.HasSuffix(name, "."+label) {
			return true
		}
	}
	return false
}
// CertificateSubjContainsTLD checks whether the provided Certificate has
// a Subject Common Name or DNS Subject Alternate Name that ends in the provided
// TLD label. If IsInTLDMap(label) returns false then CertificateSubjInTLD will
// return false.