code: func TLSConfigFor(c *Config) (*tls.Config, error) {
  	if !(c.HasCA() || c.HasCertAuth() || c.TLS.Insecure) {
  		return nil, nil
  	}
  	if c.HasCA() && c.TLS.Insecure {
  		return nil, fmt.Errorf("specifying a root certificates file with the insecure flag is not allowed")
  	}
  	if err := loadTLSFiles(c); err != nil {
  		return nil, err
  	}
  
  	tlsConfig := &tls.Config{
  		// Change default from SSLv3 to TLSv1.0 (because of POODLE vulnerability)
  		MinVersion:         tls.VersionTLS10,
  		InsecureSkipVerify: c.TLS.Insecure,
  	}
  
  	if c.HasCA() {
  		tlsConfig.RootCAs = rootCertPool(c.TLS.CAData)
  	}
  
  	if c.HasCertAuth() {
  		cert, err := tls.X509KeyPair(c.TLS.CertData, c.TLS.KeyData)
  		if err != nil {
  			return nil, err
  		}
  		tlsConfig.Certificates = []tls.Certificate{cert}
  	}
  
  	return tlsConfig, nil
  }
docs: // TLSConfigFor returns a tls.Config that will provide the transport level security defined
  // by the provided Config. Will return nil if no transport level security is requested.