code: func NewCFSSLProvider(id *core.Identity, defaultRemote client.Remote) (*CFSSL, error) {
  	if id == nil {
  		return nil, errors.New("transport: the identity hasn't been initialised. Has it been loaded from disk?")
  	}
  
  	cap := &CFSSL{
  		DefaultRemote: defaultRemote,
  	}
  
  	cfssl := id.Profiles["cfssl"]
  	if cfssl != nil {
  		cap.Label = cfssl["label"]
  		cap.Profile = cfssl["profile"]
  
  		if cap.DefaultRemote == nil {
  			cert, err := helpers.LoadClientCertificate(cfssl["mutual-tls-cert"], cfssl["mutual-tls-key"])
  			if err != nil {
  				return nil, err
  			}
  			remoteCAs, err := helpers.LoadPEMCertPool(cfssl["tls-remote-ca"])
  			if err != nil {
  				return nil, err
  			}
  			cap.DefaultRemote = client.NewServerTLS(cfssl["remote"], helpers.CreateTLSConfig(remoteCAs, cert))
  		}
  
  		cap.DefaultAuth.Type = cfssl["auth-type"]
  		cap.DefaultAuth.Key = cfssl["auth-key"]
  	}
  
  	err := cap.setRemoteAndAuth()
  	if err != nil {
  		return nil, err
  	}
  
  	return cap, nil
  }
docs: // NewCFSSLProvider takes the configuration information from an
  // Identity (and an optional default remote), returning a CFSSL
  // instance. There should be a profile in id called "cfssl", which
  // should contain label and profile fields as needed.