code: func Dial(address string, tr *Transport) (*tls.Conn, error) {
  	host, _, err := net.SplitHostPort(address)
  	if err != nil {
  		// Assume address is a hostname, and that it should
  		// use the HTTPS port number.
  		host = address
  		address = net.JoinHostPort(address, "443")
  	}
  
  	cfg, err := tr.TLSClientAuthClientConfig(host)
  	if err != nil {
  		return nil, err
  	}
  
  	conn, err := tls.Dial("tcp", address, cfg)
  	if err != nil {
  		return nil, err
  	}
  
  	state := conn.ConnectionState()
  	if len(state.VerifiedChains) == 0 {
  		return nil, errors.New(errors.CertificateError, errors.VerifyFailed)
  	}
  
  	for _, chain := range state.VerifiedChains {
  		for _, cert := range chain {
  			revoked, ok := revoke.VerifyCertificate(cert)
  			if (!tr.RevokeSoftFail && !ok) || revoked {
  				return nil, errors.New(errors.CertificateError, errors.VerifyFailed)
  			}
  		}
  	}
  
  	return conn, nil
  }
docs: // Dial initiates a TLS connection to an outbound server. It returns a
  // TLS connection to the server.