code: func (hs *serverHandshakeState) processCertsFromClient(certificates [][]byte) (crypto.PublicKey, error) {
  	c := hs.c
  
  	hs.certsFromClient = certificates
  	certs := make([]*x509.Certificate, len(certificates))
  	var err error
  	for i, asn1Data := range certificates {
  		if certs[i], err = x509.ParseCertificate(asn1Data); err != nil {
  			c.sendAlert(alertBadCertificate)
  			return nil, errors.New("tls: failed to parse client certificate: " + err.Error())
  		}
  	}
  
  	if c.config.ClientAuth >= VerifyClientCertIfGiven && len(certs) > 0 {
  		opts := x509.VerifyOptions{
  			Roots:         c.config.ClientCAs,
  			CurrentTime:   c.config.time(),
  			Intermediates: x509.NewCertPool(),
  			KeyUsages:     []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
  		}
  
  		for _, cert := range certs[1:] {
  			opts.Intermediates.AddCert(cert)
  		}
  
  		chains, err := certs[0].Verify(opts)
  		if err != nil {
  			c.sendAlert(alertBadCertificate)
  			return nil, errors.New("tls: failed to verify client's certificate: " + err.Error())
  		}
  
  		c.verifiedChains = chains
  	}
  
  	if len(certs) > 0 {
  		var pub crypto.PublicKey
  		switch key := certs[0].PublicKey.(type) {
  		case *ecdsa.PublicKey, *rsa.PublicKey:
  			pub = key
  		default:
  			c.sendAlert(alertUnsupportedCertificate)
  			return nil, fmt.Errorf("tls: client's certificate contains an unsupported public key of type %T", certs[0].PublicKey)
  		}
  		c.peerCertificates = certs
  		return pub, nil
  	}
  
  	return nil, nil
  }
docs: // processCertsFromClient takes a chain of client certificates either from a
  // Certificates message or from a sessionState and verifies them. It returns
  // the public key of the leaf certificate.