code: func (h finishedHash) hashForClientCertificate(signatureAndHash signatureAndHash, masterSecret []byte) ([]byte, crypto.Hash, error) {
  	if (h.version == VersionSSL30 || h.version >= VersionTLS12) && h.buffer == nil {
  		panic("a handshake hash for a client-certificate was requested after discarding the handshake buffer")
  	}
  
  	if h.version == VersionSSL30 {
  		if signatureAndHash.signature != signatureRSA {
  			return nil, 0, errors.New("tls: unsupported signature type for client certificate")
  		}
  
  		md5Hash := md5.New()
  		md5Hash.Write(h.buffer)
  		sha1Hash := sha1.New()
  		sha1Hash.Write(h.buffer)
  		return finishedSum30(md5Hash, sha1Hash, masterSecret, nil), crypto.MD5SHA1, nil
  	}
  	if h.version >= VersionTLS12 {
  		hashAlg, err := lookupTLSHash(signatureAndHash.hash)
  		if err != nil {
  			return nil, 0, err
  		}
  		hash := hashAlg.New()
  		hash.Write(h.buffer)
  		return hash.Sum(nil), hashAlg, nil
  	}
  
  	if signatureAndHash.signature == signatureECDSA {
  		return h.server.Sum(nil), crypto.SHA1, nil
  	}
  
  	return h.Sum(), crypto.MD5SHA1, nil
  }
docs: // hashForClientCertificate returns a digest, hash function, and TLS 1.2 hash
  // id suitable for signing by a TLS client certificate.