code: func createRootCAs(tlsCACertFile string, tlsCACertEnvVar []byte, tlsUseSystemCerts bool) (*x509.CertPool, error) {
  
  	var newRootCAs *x509.CertPool
  
  	if tlsUseSystemCerts {
  		systemCertPool, err := x509.SystemCertPool()
  		if err != nil {
  			return nil, err
  		}
  		newRootCAs = systemCertPool
  	} else {
  		newRootCAs = x509.NewCertPool()
  	}
  
  	if len(tlsCACertFile) > 0 {
  		// Append our cert to the system pool
  		caCert, err := readCertFromFile(tlsCACertFile)
  		if err != nil {
  			return nil, err
  		}
  		if ok := newRootCAs.AppendCertsFromPEM(caCert); !ok {
  			return nil, fmt.Errorf("could not append CA cert from %q", tlsCACertFile)
  		}
  	}
  
  	if len(tlsCACertEnvVar) > 0 {
  		// Append our cert to the system pool
  		if ok := newRootCAs.AppendCertsFromPEM(tlsCACertEnvVar); !ok {
  			return nil, fmt.Errorf("error appending cert from env var %q into system certs", tlsCACertEnvVar)
  		}
  	}
  
  	return newRootCAs, nil
  }
docs: // createRootCAs creates a new Cert Pool from scratch or adds to a copy of System Certs