code: func NewClient(server, caCert, tlsCert, tlsKey string) (Client, error) {
  	log.WithFields(log.Fields{
  		"server":   server,
  		"ca_cert":  caCert,
  		"tls_cert": tlsCert,
  		"tls_key":  tlsKey,
  	}).Info("configuring join-server client")
  
  	if caCert == "" && tlsCert == "" && tlsKey == "" {
  		return &client{
  			server:     server,
  			httpClient: http.DefaultClient,
  		}, nil
  	}
  
  	tlsConfig := &tls.Config{}
  
  	if caCert != "" {
  		rawCACert, err := ioutil.ReadFile(caCert)
  		if err != nil {
  			return nil, errors.Wrap(err, "load ca cert error")
  		}
  
  		caCertPool := x509.NewCertPool()
  		if !caCertPool.AppendCertsFromPEM(rawCACert) {
  			return nil, errors.New("append ca cert to pool error")
  		}
  
  		tlsConfig.RootCAs = caCertPool
  	}
  
  	if tlsCert != "" || tlsKey != "" {
  		cert, err := tls.LoadX509KeyPair(tlsCert, tlsKey)
  		if err != nil {
  			return nil, errors.Wrap(err, "load x509 keypair error")
  		}
  		tlsConfig.Certificates = []tls.Certificate{cert}
  	}
  
  	return &client{
  		httpClient: &http.Client{
  			Transport: &http.Transport{
  				TLSClientConfig: tlsConfig,
  			},
  		},
  		server: server,
  	}, nil
  }
docs: // NewClient creates a new join-server client.
  // If the caCert is set, it will configure the CA certificate to validate the
  // join-server server certificate. When the tlsCert and tlsKey are set, then
  // these will be configured as client-certificates for authentication.