func (c *Certificate) Verify(opts VerifyOptions) (chains [][]*Certificate, err error) {
    // Platform-specific verification needs the ASN.1 contents so
    // this makes the behaviour consistent across platforms.
    if len(c.Raw) == 0 {
        return nil, errNotParsed
    }

    var trueIntermediates *CertPool
    var masqueradingRoots []*Certificate
    if opts.Intermediates != nil {
        trueIntermediates = NewCertPool()
        for _, intermediate := range opts.Intermediates.certs {
            if len(intermediate.Raw) == 0 {
                return nil, errNotParsed
            }
            if len(intermediate.RawSubject) > 0 && bytes.Equal(intermediate.RawSubject, intermediate.RawIssuer) {
                masqueradingRoots = append(masqueradingRoots, intermediate)
            } else {
                trueIntermediates.AddCert(intermediate)
            }
        }
    }

    // Use Windows's own verification and chain building.
    if opts.Roots == nil && runtime.GOOS == "windows" {
        return c.systemVerify(&opts)
    }

    if len(c.UnhandledCriticalExtensions) > 0 {
        return nil, UnhandledCriticalExtension{}
    }

    if opts.Roots == nil {
        opts.Roots = systemRootsPool()
        if opts.Roots == nil {
            return nil, SystemRootsError{systemRootsErr}
        }
    }

    for _, root := range masqueradingRoots {
        opts.Roots.AddCert(root)
    }

    //TODO: Test on Windows; may need to move this before call to c.systemVerify above
    opts.Intermediates = trueIntermediates

    err = c.isValid(leafCertificate, nil, &opts)